Full Changelog: v0.6.0-insider.4...v0.6.0-insider.6

Full Changelog: v0.6.0-insider.3...v0.6.0-insider.4

What's Changed

• refactor: extract shared hardened gh runner for all gh spawn paths (#342) by @bolichen97 in #2407
• feat(security): operator keystone extension for OAuth consent-endpoint allowlist (#1341) by @bolichen97 in #2402
• fix: redact model-authored tool titles on all deny surfaces (#2274) by @bolichen97 in #2389
• feat(chat): message-level pinning with pinned messages panel by @RohanK6 in #1676
• ci(review): expand Opus to correctness blocking + sync fork prompt by @iamwhatever in #2379
• feat(mcp-pool): Toggle all switch for poolable MCP servers by @chenmingwei23 in #2433
• fix(knowledge): make the three auto-ingest paths opt-in by @bolichen97 in #2448
• fix(dev-fleet): report slow actions as indeterminate, not as a fake percentage by @chenmingwei23 in #2439
• test(dashboard): make chat-pins transient-I/O test portable on Windows by @iamwhatever in #2454
• feat(voice): add a push-to-talk key for voice input by @CrysisDeu in #1608
• feat(watchdog): detect a stalled turn from outside the turn's read loop by @chenmingwei23 in #2466
• feat: receive images, voice and files on the Weixin channel by @chenmingwei23 in #2444
• fix(dev-fleet): refuse the sync when pip cannot reinstall into the live venv by @chenmingwei23 in #2445
• fix(prepare-pr): re-mirror the local review gate onto the current CI contract by @iamwhatever in #2456
• feat(voice): show info banner + mic-click modal on remote instances by @cixuuz in #2471
• refactor: centralize title hydration by @JoernZheng in #2467
• fix(test_wait_tool_early_end): scope the wait-tool fake clock to the wait loop thread by @tlobinger in #2460
• fix(terminal): complete subcommands for tools the user installed by @dwu96 in #2429
• feat: first-party fixed-argv carve-out in sandbox fail-close (#1563) by @bolichen97 in #2428
• feat: verify internal-API session claims via unix-socket peer creds (#302) by @bolichen97 in #2424
• fix: re-vet cron jobs at fire time; move SEL key to trust/ (#1881) by @bolichen97 in #2421
• build: target Node 24 LTS with a single 22+ floor everywhere (#1070) by @bolichen97 in #2415
• feat: pin tunnel sessions to daemon-verified tailnet peer (#1762) by @bolichen97 in #2411
• fix(appstore): compute app trust fields server-side (#580) by @bolichen97 in #2408
• fix: detect and audit tier downgrades in nested-sandbox passthrough (#691) by @bolichen97 in #2406
• fix: per-root hardlink-scan budgets with loud truncation (#646) by @bolichen97 in #2387
• fix: make revocation generation cover refresh tokens (#2028) by @bolichen97 in #2388
• ci: gate vendored _vendor tree behind a sha256 manifest (#492) by @bolichen97 in #2392
• fix(dashboard): restore isort-clean import order in the dashboard auth module by @iamwhatever in #2479
• feat(instances): carry the kiro-cli context so a sent session resumes by @iamwhatever in #2260
• revert: withdraw multi-account Telegram until a bot is governable (#2203) by @chenmingwei23 in #2476
• docs(autosde): forbid new work on the gateway boot path by @CrysisDeu in #2472
• docs: revise perpetual-agent RFC after a first-principles re-read by @CrysisDeu in #2506
• fix: restore leading slash on git-mangled diff header paths (#2493) by @bolichen97 in #2517
• fix: attach clipboard images despite text/html and synthesize filenames (#2489) by @bolichen97 in #2520
• test(acp): stop the leaked stderr-drain task from mocked _spawn tests by @SebastianYuSun in #2509
• test(website): cover six app surfaces that had no tests at all by @CrysisDeu in #2514
• feat(cloud): durable launch jobs + owner-only API for EC2 crew setup by @iamwhatever in #2059
• feat(browser): make the built-in browser the default for chat by @iamwhatever in #2082
• fix: reject unknown tag ids on board columns instead of silent drop (#1897) by @bolichen97 in #2568
• fix: surface permanent turn-failure reasons in Telegram replies (#1831) by @bolichen97 in #2565
• refactor(i18n): run the unit-literal scan as a gate, not a vitest test by @k33bz in #2562
• fix(chat): drop the sessions sidebar's pinned Split View button by @chenmingwei23 in #2557
• fix(dev-fleet): actionable error when no trusted git resolves (#2530) by @bolichen97 in #2553
• fix: seed artifact companion composer on first open by @fanhongy in #2529
• fix: detect kiro-cli API-key auth in the readiness probe by @jtoloui in #2527
• fix(cli): match macOS framework Python in stop/restart gateway detection by @mnaameh in #2523
• fix: self-heal dangling storageState in playwright config at load time (#2491) by @bolichen97 in #2522
• feat: deep-link a notification by ts on the notifications page (#2018) by @bolichen97 in #2518
• feat(ci): summarize filed issues, per-issue and in the ship report by @CrysisDeu in #2511
• fix: match multi-word chat-history queries token-wise by @patrigao in #2508
• test(subagent): drop the Windows-tick duration floor from the turn-duration test by @SebastianYuSun in #2505
• fix(side): render the side panel through the shared chat transcript by @chenmingwei23 in #2503
• fix(dashboard): stop a hung usage fetch parking the credit pill forever by @isotope14 in #2498
• feat: stagger gateway startup after a recent loopstall crash dump by @rubencu in #2486
• fix: audit safety-override renew fail-closed before commit (#2453) by @bolichen97 in #2484
• fix: audit deactivate of an already-lapsed safety override grant (#2475) by @bolichen97 in #2483
• fix: label the prune merged-scan as scanning and drop danger styling while it runs (#2451) by @bolichen97 in #2482
• feat(knowledge): global budget, rate limit, source cap, and configurable extraction model by @iamwhatever in #2468
• fix(cloud): keep EC2 UserData dist-check free of ${...} so !Sub accepts it by @iamwhatever in #2596
• fix(preview): report a target that is this gateway instead of a blank frame by @kyleseaman in #2080
• feat(webhooks): reach inbound webhooks from Settings, not the nav rail by @kyleseaman in #2056
• fix(chat): keep link-preview favicons visible on every theme by @kyleseaman in #2593
• fix(voice): keep the draining transcript after a manual dictation stop by @CrysisDeu in #2469
• fix(markdown): stop CJK punctuation being swallowed into bare URLs by @CrysisDeu in #2171
• docs(autosde): freeze the chat session row's line count by @CrysisDeu in #2512
• ci: split Opus review into discovery and validation passes by @CrysisDeu in #2332
• fix: surface the wedged thread's stack in doctor and boot replay by @rubencu in #2490
• style: restore import order in dashboard token_auth (unblocks all PRs) by @chenmingwei23 in #2478
• fix(security): check bash operands verb-independently in the normalizer by @iamwhatever in #2603
• fix(ui): solid glass fallback when backdrop-filter is unsupported (#1817) by @bolichen97 in #2569
• fix(terminal): stop scanning PTY output on the way to the browser by @buluoray in #2152
• fix(test): make the reduced Windows scope green for frontend-only PRs...

What's Changed

• feat(desktop): backport the baked EXTERNALLY-MANAGED marker to release/0.6.0 by @bolichen97 in #8857

Full Changelog: v0.6.0-insider.1...v0.6.0-insider.2

What's Changed

• refactor: extract shared hardened gh runner for all gh spawn paths (#342) by @bolichen97 in #2407
• feat(security): operator keystone extension for OAuth consent-endpoint allowlist (#1341) by @bolichen97 in #2402
• fix: redact model-authored tool titles on all deny surfaces (#2274) by @bolichen97 in #2389
• feat(chat): message-level pinning with pinned messages panel by @RohanK6 in #1676
• ci(review): expand Opus to correctness blocking + sync fork prompt by @iamwhatever in #2379
• feat(mcp-pool): Toggle all switch for poolable MCP servers by @chenmingwei23 in #2433
• fix(knowledge): make the three auto-ingest paths opt-in by @bolichen97 in #2448
• fix(dev-fleet): report slow actions as indeterminate, not as a fake percentage by @chenmingwei23 in #2439
• test(dashboard): make chat-pins transient-I/O test portable on Windows by @iamwhatever in #2454
• feat(voice): add a push-to-talk key for voice input by @CrysisDeu in #1608
• feat(watchdog): detect a stalled turn from outside the turn's read loop by @chenmingwei23 in #2466
• feat: receive images, voice and files on the Weixin channel by @chenmingwei23 in #2444
• fix(dev-fleet): refuse the sync when pip cannot reinstall into the live venv by @chenmingwei23 in #2445
• fix(prepare-pr): re-mirror the local review gate onto the current CI contract by @iamwhatever in #2456
• feat(voice): show info banner + mic-click modal on remote instances by @cixuuz in #2471
• refactor: centralize title hydration by @JoernZheng in #2467
• fix(test_wait_tool_early_end): scope the wait-tool fake clock to the wait loop thread by @tlobinger in #2460
• fix(terminal): complete subcommands for tools the user installed by @dwu96 in #2429
• feat: first-party fixed-argv carve-out in sandbox fail-close (#1563) by @bolichen97 in #2428
• feat: verify internal-API session claims via unix-socket peer creds (#302) by @bolichen97 in #2424
• fix: re-vet cron jobs at fire time; move SEL key to trust/ (#1881) by @bolichen97 in #2421
• build: target Node 24 LTS with a single 22+ floor everywhere (#1070) by @bolichen97 in #2415
• feat: pin tunnel sessions to daemon-verified tailnet peer (#1762) by @bolichen97 in #2411
• fix(appstore): compute app trust fields server-side (#580) by @bolichen97 in #2408
• fix: detect and audit tier downgrades in nested-sandbox passthrough (#691) by @bolichen97 in #2406
• fix: per-root hardlink-scan budgets with loud truncation (#646) by @bolichen97 in #2387
• fix: make revocation generation cover refresh tokens (#2028) by @bolichen97 in #2388
• ci: gate vendored _vendor tree behind a sha256 manifest (#492) by @bolichen97 in #2392
• fix(dashboard): restore isort-clean import order in the dashboard auth module by @iamwhatever in #2479
• feat(instances): carry the kiro-cli context so a sent session resumes by @iamwhatever in #2260
• revert: withdraw multi-account Telegram until a bot is governable (#2203) by @chenmingwei23 in #2476
• docs(autosde): forbid new work on the gateway boot path by @CrysisDeu in #2472
• docs: revise perpetual-agent RFC after a first-principles re-read by @CrysisDeu in #2506
• fix: restore leading slash on git-mangled diff header paths (#2493) by @bolichen97 in #2517
• fix: attach clipboard images despite text/html and synthesize filenames (#2489) by @bolichen97 in #2520
• test(acp): stop the leaked stderr-drain task from mocked _spawn tests by @SebastianYuSun in #2509
• test(website): cover six app surfaces that had no tests at all by @CrysisDeu in #2514
• feat(cloud): durable launch jobs + owner-only API for EC2 crew setup by @iamwhatever in #2059
• feat(browser): make the built-in browser the default for chat by @iamwhatever in #2082
• fix: reject unknown tag ids on board columns instead of silent drop (#1897) by @bolichen97 in #2568
• fix: surface permanent turn-failure reasons in Telegram replies (#1831) by @bolichen97 in #2565
• refactor(i18n): run the unit-literal scan as a gate, not a vitest test by @k33bz in #2562
• fix(chat): drop the sessions sidebar's pinned Split View button by @chenmingwei23 in #2557
• fix(dev-fleet): actionable error when no trusted git resolves (#2530) by @bolichen97 in #2553
• fix: seed artifact companion composer on first open by @fanhongy in #2529
• fix: detect kiro-cli API-key auth in the readiness probe by @jtoloui in #2527
• fix(cli): match macOS framework Python in stop/restart gateway detection by @mnaameh in #2523
• fix: self-heal dangling storageState in playwright config at load time (#2491) by @bolichen97 in #2522
• feat: deep-link a notification by ts on the notifications page (#2018) by @bolichen97 in #2518
• feat(ci): summarize filed issues, per-issue and in the ship report by @CrysisDeu in #2511
• fix: match multi-word chat-history queries token-wise by @patrigao in #2508
• test(subagent): drop the Windows-tick duration floor from the turn-duration test by @SebastianYuSun in #2505
• fix(side): render the side panel through the shared chat transcript by @chenmingwei23 in #2503
• fix(dashboard): stop a hung usage fetch parking the credit pill forever by @isotope14 in #2498
• feat: stagger gateway startup after a recent loopstall crash dump by @rubencu in #2486
• fix: audit safety-override renew fail-closed before commit (#2453) by @bolichen97 in #2484
• fix: audit deactivate of an already-lapsed safety override grant (#2475) by @bolichen97 in #2483
• fix: label the prune merged-scan as scanning and drop danger styling while it runs (#2451) by @bolichen97 in #2482
• feat(knowledge): global budget, rate limit, source cap, and configurable extraction model by @iamwhatever in #2468
• fix(cloud): keep EC2 UserData dist-check free of ${...} so !Sub accepts it by @iamwhatever in #2596
• fix(preview): report a target that is this gateway instead of a blank frame by @kyleseaman in #2080
• feat(webhooks): reach inbound webhooks from Settings, not the nav rail by @kyleseaman in #2056
• fix(chat): keep link-preview favicons visible on every theme by @kyleseaman in #2593
• fix(voice): keep the draining transcript after a manual dictation stop by @CrysisDeu in #2469
• fix(markdown): stop CJK punctuation being swallowed into bare URLs by @CrysisDeu in #2171
• docs(autosde): freeze the chat session row's line count by @CrysisDeu in #2512
• ci: split Opus review into discovery and validation passes by @CrysisDeu in #2332
• fix: surface the wedged thread's stack in doctor and boot replay by @rubencu in #2490
• style: restore import order in dashboard token_auth (unblocks all PRs) by @chenmingwei23 in #2478
• fix(security): check bash operands verb-independently in the normalizer by @iamwhatever in #2603
• fix(ui): solid glass fallback when backdrop-filter is unsupported (#1817) by @bolichen97 in #2569
• fix(terminal): stop scanning PTY output on the way to the browser by @buluoray in #2152
• fix(test): make the reduced Windows scope green for frontend-only PRs...

Your AWS account gets a control room and your whole fleet gets one centrally published security policy. Chat grows up: sessions open as tabs, an idle sidebar folds itself away, and approvals can be answered in bulk or refused one call at a time. Dictation now works out of the box with no install, agents can seed and steer other agents' sessions, and a script-installed Kiro Crew updates itself atomically instead of asking you to re-run the installer.

Before you upgrade

Five changes can alter something you already configured. Everything else that changed is in the full 0.5.0 changelog.

• Dictation providers consolidate into one local provider — the whisper, mlx, parakeet and faster providers are retired and a saved setting falls back to the new in-process local one, which downloads its own model on first use. The default model is base (148 MB); a stored turbo still resolves but pulls 1.6 GB. Run kirocrew doctor to see which stored defaults an earlier build materialized for you.
• Snapshot-to-S3 is retired — kirocrew snapshot --to s3://…, --aws-profile and the s3:// fetch path are gone. Cloud backup moves to the AWS Control app; snapshots gain restore-into-live-state in exchange.
• App execution trust is now bound to the code you consented to — a grant records the repository it covers, so an app whose name later resolves to different code is refused, and a legacy grant that cannot be tied to a repository asks for one-time re-consent.
• Some commands that ran silently now ask first — looking like a help or version probe no longer counts as approval, and durable "always allow" grants no longer cover structured non-shell tools.
• Knowledge moves into Agent Capabilities, and the standalone Auto-Triage Pipeline app is retired.

Your AWS account gets a control room

• AWS Control — A new built-in app puts your AWS accounts on one surface: an Accounts page with a health light and reconnect guidance per account, and a per-account console with Library, Drive, Backup, Bill and Access views over a private, versioned, owner-only S3 bucket — consent-gated, with audited mutations.
• A cloud drive you can browse — The drive is its own page: browse and create folders, delete a folder and everything under it, and see the share ledger alongside.
• Restore a snapshot into live state — Replace or merge a snapshot into the running install, per component, with a rollback ledger to undo it.

One policy for the whole fleet

• Centrally published security policy — An administrator can publish one security_policy.json at a URL and have every host fetch, cache and periodically refresh it. A policy change binds fleet-wide with no restart and no host visit; an unreachable source serves the cached copy, and a bad document is rejected rather than lowering the running ceiling.
• Enterprise MCP governance — On an enterprise Kiro account with an admin-configured MCP registry, org-level MCP controls (including a version pin) now take effect. Personal accounts are unaffected.
• A tamper-evident audit log under concurrency — Two Kiro Crew processes writing at once no longer break the audit chain's verification.

Dictation that just works

• No-install local dictation — One whisper.cpp model stays resident in the gateway: a short utterance transcribes in tens of milliseconds, live text appears as you speak, and a session keeps transcribing across pauses.

• Silence stays silent — A filter drops the model's silence hallucinations and caption boilerplate instead of turning them into notes.

• Settings apply without leaving the panel — Speech settings that need a gateway restart now offer the restart button inline.

• Watch words settle — While you dictate, in-flight words fade in as they stabilize and flash when a revision changes them, so you can see the transcription firm up; the panel never mounts under reduced-motion.

Sessions become tabs

• Session tabs — Keep several sessions open as tabs above the transcript: middle-click or modifier-click a sidebar row to open one, each tab shows live status, and the set persists per surface.

• Dormant sessions fold away — Sessions idle past a threshold you choose collapse behind a "Dormant sessions (N)" expander per folder; pinned, running and unread rows always stay visible.

• Deep-linkable settings — Settings pages live at real URLs like /settings/display/session-colors, so any screen can be bookmarked and shared.

• A project folder shows its files — Project tabs gain a full expandable file tree with search and refresh, opening files in de-duplicated tabs with find and save chords that act on the tab you can see.

• Wide notes — A markdown note can be lifted out of the reading column to full width, and the choice is remembered per device.

• Ephemeral chats from the + New menu — The create menu gains an Ephemeral submenu: Incognito (reads memory, writes none) and Temporary (neither) sessions, one tap from the sidebar.

• Agents can color their sessions — An agent's session_color tints every session it starts that has no color of its own, applied at render time so editing the agent re-tints them live; a manual pick always wins.

Approvals you can steer

• Approve or reject everything at once — When several tool calls wait on you, one click answers all of them, and the confirmation lists every command it covers — not just the newest.

• Reject once — Refuse a single tool call and still get asked about the rest, instead of rejecting the whole batch.

• Commands you can read — A long shell call with no stated purpose shows a short readable digest of what it does; the verbatim command stays one hover away.

• Approvals in the CLI — kirocrew chat now shows tool permission prompts and lets you answer them, so a turn no longer hangs silently until it times out.

• The approval bar teaches the modes — It now points at the approval-mode picker, so Reads, Trust and YOLO are discoverable instead of confirming every step forever.

• Name-grants verify identity on every surface — An "always allow" for a shell command now checks, on every auto-approve path including headless runs, that each program name still resolves to the program it named; a shadowed or agent-writable resolution falls back to the prompt — or to the headless deny — instead of inheriting the grant.

• Trusted Slack bots — slack.trusted_bot_ids lets named bots through the bot filter for multi-gateway meshes, with a per-thread turn limit so two trusting gateways cannot answer each other forever.

Agents that drive other agents

• Seed and steer peer sessions — session_send delivers a message into another session as its next turn, so a coordinator can direct peers instead of only opening, reading or stopping them.
• A conductor for goals too big for one session — The built-in conductor agent decomposes a goal, stands up a session per work item, checks acceptance, and decides each next round — patrolling on a monitoring loop that survives tab closes and turn caps.
• A durable workflow library — Promote a session's workflow into a global library, manage revisions and lineage from Agent Capabilities, and invoke saved definitions with /workflow; task-runner plans share the same library.
• Watches that wake on change — A babysat pull request wakes its watcher on human comments, reviews and verdicts — not just check results — and the new interrupt controller turns polling monitors into wake-on-change interrupts for any script cron.
• Auditable fan-outs — Wave digests name the model that actually served each member, the live panel flags a downgraded model while the run is still going, and a finished subagent's results survive a gateway restart.

Update itself, anywhere

• Atomic self-update — kirocrew update installs the new version into a fresh, signature-verified tree and switches to it atomically, so a script-installed Kiro Crew updates itself.
• Windows updates install in place — "Restart & Update" shows installer progress and relaunches the new build instead of nesting a copy and reopening the old one; kept Start Menu and Desktop shortcuts are repointed, and installs are much faster.
• An honest About page — Settings › About shows when the last update check ran and when the next is due, reports your real OS and architecture, and the post-upgrade "What's new" modal shows the notes for the version you are actually running.
• No more downgrade nags — Running ahead of your channel's published release no longer produces an older-build update offer, and a hotfix published on an old release line can never move a channel's update feed backward.

Secrets leave more files

• kirocrew secrets import — Move plaintext credentials out of .env into the encrypted vault, leaving a secret:// reference behind; dry-run by default, --apply to commit.
• Redaction happens before truncation — Credentials near a truncation boundary are redacted before the text is cut, so partial secrets stop leaking into audit rows, logs and dashboard payloads; hook output is redacted too.
• Owner-only from the first byte — Windows config.json writes are locked to your account (over a thousand times faster than before), and secrets written during pod setup and snapshot restore are locked down before publication.

Phones and touch

• One-click phone access — A single "Set up & show QR" action enables trust, restarts the gateway, publishes over Tailscale, and hands you a sign-in QR code — and a phone session now survives gateway restarts and updates instead of needing a fresh scan.
• A sign-in link for a phone that lost its session — A signed-in device can mint a one-time link; the CLI recovery path remains when nothing else is signed in.
• Video in the composer — Attach videos u...

What's Changed

• fix(release): backport the feed-advance guard to release/0.5.0 by @bolichen97 in #8602
• chore(desktop): sync the electron lockfile version to 0.5.0 by @bolichen97 in #8605

Full Changelog: v0.5.0-insider.10...v0.5.0-insider.11

What's Changed

• ci(release): add opt-in stable-rebuild lane so v0.5.0 ships a clean 0.5.0 stamp by @bolichen97 in #8568

Full Changelog: v0.5.0-insider.9...v0.5.0-insider.10

What's Changed

• fix(voice): quote the codesign team id, and say a retired STT provider once (#7331) by @bolichen97 in #7682

Full Changelog: v0.5.0-insider.8...v0.5.0-insider.9

What's Changed

• fix(chat): stop code blocks rendering as an empty language header (#7349) by @bolichen97 in #7536

Full Changelog: v0.5.0-insider.7...v0.5.0-insider.8