Kiro Crew stops being one agent on one machine: choose the harness that runs your sessions, start a chat on another crew you are connected to, and let crew members dispatch workers of their own. Chat gets quieter, with folded diffs, resumed sessions that stop re-reading their own context, and refused commands that tell the agent what it may do instead. Python 3.12 is the new floor.

Before you upgrade

• Python 3.12 is now the floor: a host on 3.10 or 3.11 must move up before installing or updating, and every installer provisions 3.12 itself when the system package manager has none.
• The installer now brings its own Python: curl -fsSL https://download.crew.kiro.dev/cli.sh | sh provisions a pinned CPython rather than using the system one, so pass --system-python if you deliberately build against yours.
• The command gate no longer fences credential paths by reading the command text: the sandbox's bind masks are the fence now, so check that agent.sandbox in config.json is not off if you were relying on that text gate.
• An unattended auto-run plan now stops after two hours: raise it with orchestrator.max_plan_duration_seconds in config.json, or set 0 to remove the ceiling; a stage-gated plan is never cut.

Pick the harness that runs your sessions (Preview)

• Claude Code, Codex and KAS are selectable harnesses: turn on Developer Mode in Settings → Developer (off by default), then pick one under Developer → Agent Backend, where each option says whether it is installed, missing on this machine, or waiting on a gateway restart.
• A tool pre-approved in Claude's own settings never reaches Crew's approval path, so its deny rules and audit log do not see that call, and Codex refuses to start while the sandbox is off.
• Monitor loops, project changes, follow-up cards and conversation reset work on every backend, where they previously failed closed outside Kiro CLI.

Remote crews become one dashboard (Preview)

• Run a chat on another crew you are connected to: set instances.enabled in config.json and turn on Settings → Developer → Feature Previews → Chat on a crew (both off by default), then pick the peer under New chat on crew in the sidebar's new-chat menu; the transcript stays local while every turn runs on that crew.
• A session that runs elsewhere carries a server badge and the crew's name in your sidebar, so remote work is openable from the list you already read.
• Crews connect themselves on app load and on tab focus, on by default and switchable at Settings → Remote Instances → Auto-connect crews.

Chat that stays out of the way

• Diffs start folded as a chip naming the file and its +N/-M counts, and Settings → Chat → Plain diffs (off by default) renders patches as plain monospace text instead.
• A sketch pad and a share action: the composer's + menu gains a Sketch row that draws an image and attaches it, and an assistant reply's Share as image action exports a branded PNG or prefills an X or LinkedIn post.
• The composer says where you are, and gets out of the way: its footer shows the project's branch and uncommitted file count, the context popover's threshold slider sets compaction for this session alone, and the + menu's Collapse the message input hands the room back to the transcript.

Sessions you can find, file and leave open

• Search sessions by the pull request, review or issue on their badge from the sidebar search box, not just by title.
• A resumed session no longer re-injects its full memory, lessons and skills block, so an idle session that comes back reaches compaction far later.
• Folders auto-tag the chats you start in them, set under the folder menu's Folder settings, and the sidebar's Collapse dormant sessions picker now defaults to 7 days instead of 2.

Agents that dispatch and watch

• Agents arm their own watch: an agent can start, revise and stop a monitoring loop on its own session from the dashboard, a Slack thread or a Discord DM, and a loop that names one pull request wakes the agent only when that pull request moves.
• Crew members dispatch work into worker sessions from their own thread on the Claude and KAS backends, and each worker inherits its creator's trust posture so it no longer stalls on a first tool call.
• Session control is on by default; set agent.session_control to false in config.json to withdraw it from every agent at once.

Work that runs for hours, not minutes

• A chat turn now runs up to four hours: agent.chat_turn_timeout_secs in config.json rises from 7200 to 14400 seconds, and a genuinely thinking model on macOS is attested instead of probed and cancelled at ninety seconds.
• A sub-agent gets three hours and up to 1000 tool calls: agent.subagent_timeout_secs rises from 1800 to 10800 and agent.subagent_max_turns now reaches 1000, where the ceiling was 200.
• A monitor loop shows its cycle cap on the composer's goal chip, reading 23/24 as the backstop approaches, re-arms after stopping on an unanswered approval, and now actually arms on the KAS backend.

Crew members get faces (Preview)

• Give a crew a face that reacts: build its ghost avatar trait by trait or upload a picture at Agent Capabilities → Agents → Avatar → Customize, then set per-state eyes, mouth and a sound cue for working, done and failed on its Expressions pane.
• The member drawer shows recent activity, its auto patrol, and the schedules and webhooks that can wake it when you pick a member on the Crew Members page, where you can also star a crew and filter the roster to Starred, Mine, Built-in or From packages; the desktop-only Crew Companion app, enabled from Apps → Library, shows one avatar across all displays.
• Crew is a preview opt-in: turn on Developer Mode in Settings → Developer, then Settings → Developer → Feature Previews → Crew, to get the Crew Members entry and the new-crew-chat entry back.

Apps get a Launchpad

• Installed apps show as a Launchpad grid under Apps → Library, each an icon tile with a pin badge for the sidebar, an Open button and a menu for Details, Update, Disable and Uninstall, and Create Folders From Project is new there: point it at a project and it makes one nested sidebar folder per package you tick.
• An app can own background work, Command Bar rows, an embedded chat and chips beside the composer: its manifest declares permissions.jobs for server-side runs that continue when you navigate away, contributes.commands for rows in the Cmd+K Command Bar, and contributes.sessionControls for up to two live controls next to the agent and project chips.
• Dev mode for a UI folder outside an app's install now needs the terminal: the dashboard and the API refuse it, and only kirocrew app dev <name> --confirm-out-of-install-root grants it.

Your cloud drive, inside the app

• AWS Control opens on an Overview naming accounts, key health, drive use, month-to-date spend, live links and the backup schedule, then navigates by Files, Library, Backup and Access, each with its own URL; the app ships off, so enable it from Apps → Library first.
• The Files pane previews and renames in place: images, video, audio, PDFs and text open inline, a pencil renames a file, a search box finds one by name across the whole section, and drag to move, drop to upload and delete behind an inline confirm all still work.
• A backup survives leaving the page, and an account can be taken back out: coming back to Backup shows it still going, and an account registered by mistake is removed from its row's overflow menu, which drops only the local registry entry and its consent grants, never anything in AWS.

Meetings, Jira and the Changes panel

• Meeting minutes are editable in place: press Edit this output on an agent's card, then Save, or Discard my edits to get the agent's version back.
• Meetings prepares the meeting about to start once you set a calendar under Meetings → Settings → Calendar; the background polling is already on.
• A Jira issue keeps its formatting and shows its Fix Version in the Issues panel once a Jira API token is in your environment, and the Changes panel now opens instantly from what it already holds and refreshes behind you.

Channels and MCP servers

• Saving an MCP server no longer resets your session on Kiro CLI 2.10.0 or newer, and the chat session menu's MCP servers view reports what this session actually mounted.
• An agent can message a channel by name with send_message, reaching Slack, Discord, Telegram, WhatsApp, Webex, Teams, iMessage and Feishu.
• Search your sessions from Telegram with /sessions <words> in a direct message; with no words it lists the ten most recent.

A gate that explains itself

• A blocked tool call now explains the way forward, so the agent stops retrying the same blocked shape, and kirocrew doctor prints a Credentials section that lists your AWS profiles without opening a secret.
• Deny rules survive re-spelling, and ordinary work stops being refused: quoting, escapes, command substitution and wildcard-spelled program names still reach the rule they used to dodge, while a recursive grep over a worktree, a cd followed by a pipe and a heredoc carrying backticks now run instead of being blocked.
• A host that cannot sandbox refuses to run the agent: armv7l, riscv64, ppc64le and s390x Linux, a libc without prctl, and Windows with Kiro CLI's internal sandbox off all fail closed unless you set agent.sandbox to off or agent.sandbox_allow_unsandboxed_exec to true in config.json.

Approvals you can shape

• A sandboxed command can no longer rewrite your ceiling: the security policy, admission policy, profiles and denied-command list are sealed read-only in every sandbox mode, so an app script, a hook or a command cron cannot grant itself more than you did.
• **A restart s...

What's Changed

• fix(deps): backport the electron js-yaml 4.3.2 pin to release/0.6.0 by @bolichen97 in #10076

Full Changelog: v0.6.0-insider.4...v0.6.0-insider.7

Full Changelog: v0.6.0-insider.4...v0.6.0-insider.6

Full Changelog: v0.6.0-insider.3...v0.6.0-insider.4

What's Changed

• refactor: extract shared hardened gh runner for all gh spawn paths (#342) by @bolichen97 in #2407
• feat(security): operator keystone extension for OAuth consent-endpoint allowlist (#1341) by @bolichen97 in #2402
• fix: redact model-authored tool titles on all deny surfaces (#2274) by @bolichen97 in #2389
• feat(chat): message-level pinning with pinned messages panel by @RohanK6 in #1676
• ci(review): expand Opus to correctness blocking + sync fork prompt by @iamwhatever in #2379
• feat(mcp-pool): Toggle all switch for poolable MCP servers by @chenmingwei23 in #2433
• fix(knowledge): make the three auto-ingest paths opt-in by @bolichen97 in #2448
• fix(dev-fleet): report slow actions as indeterminate, not as a fake percentage by @chenmingwei23 in #2439
• test(dashboard): make chat-pins transient-I/O test portable on Windows by @iamwhatever in #2454
• feat(voice): add a push-to-talk key for voice input by @CrysisDeu in #1608
• feat(watchdog): detect a stalled turn from outside the turn's read loop by @chenmingwei23 in #2466
• feat: receive images, voice and files on the Weixin channel by @chenmingwei23 in #2444
• fix(dev-fleet): refuse the sync when pip cannot reinstall into the live venv by @chenmingwei23 in #2445
• fix(prepare-pr): re-mirror the local review gate onto the current CI contract by @iamwhatever in #2456
• feat(voice): show info banner + mic-click modal on remote instances by @cixuuz in #2471
• refactor: centralize title hydration by @JoernZheng in #2467
• fix(test_wait_tool_early_end): scope the wait-tool fake clock to the wait loop thread by @tlobinger in #2460
• fix(terminal): complete subcommands for tools the user installed by @dwu96 in #2429
• feat: first-party fixed-argv carve-out in sandbox fail-close (#1563) by @bolichen97 in #2428
• feat: verify internal-API session claims via unix-socket peer creds (#302) by @bolichen97 in #2424
• fix: re-vet cron jobs at fire time; move SEL key to trust/ (#1881) by @bolichen97 in #2421
• build: target Node 24 LTS with a single 22+ floor everywhere (#1070) by @bolichen97 in #2415
• feat: pin tunnel sessions to daemon-verified tailnet peer (#1762) by @bolichen97 in #2411
• fix(appstore): compute app trust fields server-side (#580) by @bolichen97 in #2408
• fix: detect and audit tier downgrades in nested-sandbox passthrough (#691) by @bolichen97 in #2406
• fix: per-root hardlink-scan budgets with loud truncation (#646) by @bolichen97 in #2387
• fix: make revocation generation cover refresh tokens (#2028) by @bolichen97 in #2388
• ci: gate vendored _vendor tree behind a sha256 manifest (#492) by @bolichen97 in #2392
• fix(dashboard): restore isort-clean import order in the dashboard auth module by @iamwhatever in #2479
• feat(instances): carry the kiro-cli context so a sent session resumes by @iamwhatever in #2260
• revert: withdraw multi-account Telegram until a bot is governable (#2203) by @chenmingwei23 in #2476
• docs(autosde): forbid new work on the gateway boot path by @CrysisDeu in #2472
• docs: revise perpetual-agent RFC after a first-principles re-read by @CrysisDeu in #2506
• fix: restore leading slash on git-mangled diff header paths (#2493) by @bolichen97 in #2517
• fix: attach clipboard images despite text/html and synthesize filenames (#2489) by @bolichen97 in #2520
• test(acp): stop the leaked stderr-drain task from mocked _spawn tests by @SebastianYuSun in #2509
• test(website): cover six app surfaces that had no tests at all by @CrysisDeu in #2514
• feat(cloud): durable launch jobs + owner-only API for EC2 crew setup by @iamwhatever in #2059
• feat(browser): make the built-in browser the default for chat by @iamwhatever in #2082
• fix: reject unknown tag ids on board columns instead of silent drop (#1897) by @bolichen97 in #2568
• fix: surface permanent turn-failure reasons in Telegram replies (#1831) by @bolichen97 in #2565
• refactor(i18n): run the unit-literal scan as a gate, not a vitest test by @k33bz in #2562
• fix(chat): drop the sessions sidebar's pinned Split View button by @chenmingwei23 in #2557
• fix(dev-fleet): actionable error when no trusted git resolves (#2530) by @bolichen97 in #2553
• fix: seed artifact companion composer on first open by @fanhongy in #2529
• fix: detect kiro-cli API-key auth in the readiness probe by @jtoloui in #2527
• fix(cli): match macOS framework Python in stop/restart gateway detection by @mnaameh in #2523
• fix: self-heal dangling storageState in playwright config at load time (#2491) by @bolichen97 in #2522
• feat: deep-link a notification by ts on the notifications page (#2018) by @bolichen97 in #2518
• feat(ci): summarize filed issues, per-issue and in the ship report by @CrysisDeu in #2511
• fix: match multi-word chat-history queries token-wise by @patrigao in #2508
• test(subagent): drop the Windows-tick duration floor from the turn-duration test by @SebastianYuSun in #2505
• fix(side): render the side panel through the shared chat transcript by @chenmingwei23 in #2503
• fix(dashboard): stop a hung usage fetch parking the credit pill forever by @isotope14 in #2498
• feat: stagger gateway startup after a recent loopstall crash dump by @rubencu in #2486
• fix: audit safety-override renew fail-closed before commit (#2453) by @bolichen97 in #2484
• fix: audit deactivate of an already-lapsed safety override grant (#2475) by @bolichen97 in #2483
• fix: label the prune merged-scan as scanning and drop danger styling while it runs (#2451) by @bolichen97 in #2482
• feat(knowledge): global budget, rate limit, source cap, and configurable extraction model by @iamwhatever in #2468
• fix(cloud): keep EC2 UserData dist-check free of ${...} so !Sub accepts it by @iamwhatever in #2596
• fix(preview): report a target that is this gateway instead of a blank frame by @kyleseaman in #2080
• feat(webhooks): reach inbound webhooks from Settings, not the nav rail by @kyleseaman in #2056
• fix(chat): keep link-preview favicons visible on every theme by @kyleseaman in #2593
• fix(voice): keep the draining transcript after a manual dictation stop by @CrysisDeu in #2469
• fix(markdown): stop CJK punctuation being swallowed into bare URLs by @CrysisDeu in #2171
• docs(autosde): freeze the chat session row's line count by @CrysisDeu in #2512
• ci: split Opus review into discovery and validation passes by @CrysisDeu in #2332
• fix: surface the wedged thread's stack in doctor and boot replay by @rubencu in #2490
• style: restore import order in dashboard token_auth (unblocks all PRs) by @chenmingwei23 in #2478
• fix(security): check bash operands verb-independently in the normalizer by @iamwhatever in #2603
• fix(ui): solid glass fallback when backdrop-filter is unsupported (#1817) by @bolichen97 in #2569
• fix(terminal): stop scanning PTY output on the way to the browser by @buluoray in #2152
• fix(test): make the reduced Windows scope green for frontend-only PRs...

What's Changed

• feat(desktop): backport the baked EXTERNALLY-MANAGED marker to release/0.6.0 by @bolichen97 in #8857

Full Changelog: v0.6.0-insider.1...v0.6.0-insider.2

What's Changed

• refactor: extract shared hardened gh runner for all gh spawn paths (#342) by @bolichen97 in #2407
• feat(security): operator keystone extension for OAuth consent-endpoint allowlist (#1341) by @bolichen97 in #2402
• fix: redact model-authored tool titles on all deny surfaces (#2274) by @bolichen97 in #2389
• feat(chat): message-level pinning with pinned messages panel by @RohanK6 in #1676
• ci(review): expand Opus to correctness blocking + sync fork prompt by @iamwhatever in #2379
• feat(mcp-pool): Toggle all switch for poolable MCP servers by @chenmingwei23 in #2433
• fix(knowledge): make the three auto-ingest paths opt-in by @bolichen97 in #2448
• fix(dev-fleet): report slow actions as indeterminate, not as a fake percentage by @chenmingwei23 in #2439
• test(dashboard): make chat-pins transient-I/O test portable on Windows by @iamwhatever in #2454
• feat(voice): add a push-to-talk key for voice input by @CrysisDeu in #1608
• feat(watchdog): detect a stalled turn from outside the turn's read loop by @chenmingwei23 in #2466
• feat: receive images, voice and files on the Weixin channel by @chenmingwei23 in #2444
• fix(dev-fleet): refuse the sync when pip cannot reinstall into the live venv by @chenmingwei23 in #2445
• fix(prepare-pr): re-mirror the local review gate onto the current CI contract by @iamwhatever in #2456
• feat(voice): show info banner + mic-click modal on remote instances by @cixuuz in #2471
• refactor: centralize title hydration by @JoernZheng in #2467
• fix(test_wait_tool_early_end): scope the wait-tool fake clock to the wait loop thread by @tlobinger in #2460
• fix(terminal): complete subcommands for tools the user installed by @dwu96 in #2429
• feat: first-party fixed-argv carve-out in sandbox fail-close (#1563) by @bolichen97 in #2428
• feat: verify internal-API session claims via unix-socket peer creds (#302) by @bolichen97 in #2424
• fix: re-vet cron jobs at fire time; move SEL key to trust/ (#1881) by @bolichen97 in #2421
• build: target Node 24 LTS with a single 22+ floor everywhere (#1070) by @bolichen97 in #2415
• feat: pin tunnel sessions to daemon-verified tailnet peer (#1762) by @bolichen97 in #2411
• fix(appstore): compute app trust fields server-side (#580) by @bolichen97 in #2408
• fix: detect and audit tier downgrades in nested-sandbox passthrough (#691) by @bolichen97 in #2406
• fix: per-root hardlink-scan budgets with loud truncation (#646) by @bolichen97 in #2387
• fix: make revocation generation cover refresh tokens (#2028) by @bolichen97 in #2388
• ci: gate vendored _vendor tree behind a sha256 manifest (#492) by @bolichen97 in #2392
• fix(dashboard): restore isort-clean import order in the dashboard auth module by @iamwhatever in #2479
• feat(instances): carry the kiro-cli context so a sent session resumes by @iamwhatever in #2260
• revert: withdraw multi-account Telegram until a bot is governable (#2203) by @chenmingwei23 in #2476
• docs(autosde): forbid new work on the gateway boot path by @CrysisDeu in #2472
• docs: revise perpetual-agent RFC after a first-principles re-read by @CrysisDeu in #2506
• fix: restore leading slash on git-mangled diff header paths (#2493) by @bolichen97 in #2517
• fix: attach clipboard images despite text/html and synthesize filenames (#2489) by @bolichen97 in #2520
• test(acp): stop the leaked stderr-drain task from mocked _spawn tests by @SebastianYuSun in #2509
• test(website): cover six app surfaces that had no tests at all by @CrysisDeu in #2514
• feat(cloud): durable launch jobs + owner-only API for EC2 crew setup by @iamwhatever in #2059
• feat(browser): make the built-in browser the default for chat by @iamwhatever in #2082
• fix: reject unknown tag ids on board columns instead of silent drop (#1897) by @bolichen97 in #2568
• fix: surface permanent turn-failure reasons in Telegram replies (#1831) by @bolichen97 in #2565
• refactor(i18n): run the unit-literal scan as a gate, not a vitest test by @k33bz in #2562
• fix(chat): drop the sessions sidebar's pinned Split View button by @chenmingwei23 in #2557
• fix(dev-fleet): actionable error when no trusted git resolves (#2530) by @bolichen97 in #2553
• fix: seed artifact companion composer on first open by @fanhongy in #2529
• fix: detect kiro-cli API-key auth in the readiness probe by @jtoloui in #2527
• fix(cli): match macOS framework Python in stop/restart gateway detection by @mnaameh in #2523
• fix: self-heal dangling storageState in playwright config at load time (#2491) by @bolichen97 in #2522
• feat: deep-link a notification by ts on the notifications page (#2018) by @bolichen97 in #2518
• feat(ci): summarize filed issues, per-issue and in the ship report by @CrysisDeu in #2511
• fix: match multi-word chat-history queries token-wise by @patrigao in #2508
• test(subagent): drop the Windows-tick duration floor from the turn-duration test by @SebastianYuSun in #2505
• fix(side): render the side panel through the shared chat transcript by @chenmingwei23 in #2503
• fix(dashboard): stop a hung usage fetch parking the credit pill forever by @isotope14 in #2498
• feat: stagger gateway startup after a recent loopstall crash dump by @rubencu in #2486
• fix: audit safety-override renew fail-closed before commit (#2453) by @bolichen97 in #2484
• fix: audit deactivate of an already-lapsed safety override grant (#2475) by @bolichen97 in #2483
• fix: label the prune merged-scan as scanning and drop danger styling while it runs (#2451) by @bolichen97 in #2482
• feat(knowledge): global budget, rate limit, source cap, and configurable extraction model by @iamwhatever in #2468
• fix(cloud): keep EC2 UserData dist-check free of ${...} so !Sub accepts it by @iamwhatever in #2596
• fix(preview): report a target that is this gateway instead of a blank frame by @kyleseaman in #2080
• feat(webhooks): reach inbound webhooks from Settings, not the nav rail by @kyleseaman in #2056
• fix(chat): keep link-preview favicons visible on every theme by @kyleseaman in #2593
• fix(voice): keep the draining transcript after a manual dictation stop by @CrysisDeu in #2469
• fix(markdown): stop CJK punctuation being swallowed into bare URLs by @CrysisDeu in #2171
• docs(autosde): freeze the chat session row's line count by @CrysisDeu in #2512
• ci: split Opus review into discovery and validation passes by @CrysisDeu in #2332
• fix: surface the wedged thread's stack in doctor and boot replay by @rubencu in #2490
• style: restore import order in dashboard token_auth (unblocks all PRs) by @chenmingwei23 in #2478
• fix(security): check bash operands verb-independently in the normalizer by @iamwhatever in #2603
• fix(ui): solid glass fallback when backdrop-filter is unsupported (#1817) by @bolichen97 in #2569
• fix(terminal): stop scanning PTY output on the way to the browser by @buluoray in #2152
• fix(test): make the reduced Windows scope green for frontend-only PRs...

Your AWS account gets a control room and your whole fleet gets one centrally published security policy. Chat grows up: sessions open as tabs, an idle sidebar folds itself away, and approvals can be answered in bulk or refused one call at a time. Dictation now works out of the box with no install, agents can seed and steer other agents' sessions, and a script-installed Kiro Crew updates itself atomically instead of asking you to re-run the installer.

Before you upgrade

Five changes can alter something you already configured. Everything else that changed is in the full 0.5.0 changelog.

• Dictation providers consolidate into one local provider — the whisper, mlx, parakeet and faster providers are retired and a saved setting falls back to the new in-process local one, which downloads its own model on first use. The default model is base (148 MB); a stored turbo still resolves but pulls 1.6 GB. Run kirocrew doctor to see which stored defaults an earlier build materialized for you.
• Snapshot-to-S3 is retired — kirocrew snapshot --to s3://…, --aws-profile and the s3:// fetch path are gone. Cloud backup moves to the AWS Control app; snapshots gain restore-into-live-state in exchange.
• App execution trust is now bound to the code you consented to — a grant records the repository it covers, so an app whose name later resolves to different code is refused, and a legacy grant that cannot be tied to a repository asks for one-time re-consent.
• Some commands that ran silently now ask first — looking like a help or version probe no longer counts as approval, and durable "always allow" grants no longer cover structured non-shell tools.
• Knowledge moves into Agent Capabilities, and the standalone Auto-Triage Pipeline app is retired.

Your AWS account gets a control room

• AWS Control — A new built-in app puts your AWS accounts on one surface: an Accounts page with a health light and reconnect guidance per account, and a per-account console with Library, Drive, Backup, Bill and Access views over a private, versioned, owner-only S3 bucket — consent-gated, with audited mutations.
• A cloud drive you can browse — The drive is its own page: browse and create folders, delete a folder and everything under it, and see the share ledger alongside.
• Restore a snapshot into live state — Replace or merge a snapshot into the running install, per component, with a rollback ledger to undo it.

One policy for the whole fleet

• Centrally published security policy — An administrator can publish one security_policy.json at a URL and have every host fetch, cache and periodically refresh it. A policy change binds fleet-wide with no restart and no host visit; an unreachable source serves the cached copy, and a bad document is rejected rather than lowering the running ceiling.
• Enterprise MCP governance — On an enterprise Kiro account with an admin-configured MCP registry, org-level MCP controls (including a version pin) now take effect. Personal accounts are unaffected.
• A tamper-evident audit log under concurrency — Two Kiro Crew processes writing at once no longer break the audit chain's verification.

Dictation that just works

• No-install local dictation — One whisper.cpp model stays resident in the gateway: a short utterance transcribes in tens of milliseconds, live text appears as you speak, and a session keeps transcribing across pauses.

• Silence stays silent — A filter drops the model's silence hallucinations and caption boilerplate instead of turning them into notes.

• Settings apply without leaving the panel — Speech settings that need a gateway restart now offer the restart button inline.

• Watch words settle — While you dictate, in-flight words fade in as they stabilize and flash when a revision changes them, so you can see the transcription firm up; the panel never mounts under reduced-motion.

Sessions become tabs

• Session tabs — Keep several sessions open as tabs above the transcript: middle-click or modifier-click a sidebar row to open one, each tab shows live status, and the set persists per surface.

• Dormant sessions fold away — Sessions idle past a threshold you choose collapse behind a "Dormant sessions (N)" expander per folder; pinned, running and unread rows always stay visible.

• Deep-linkable settings — Settings pages live at real URLs like /settings/display/session-colors, so any screen can be bookmarked and shared.

• A project folder shows its files — Project tabs gain a full expandable file tree with search and refresh, opening files in de-duplicated tabs with find and save chords that act on the tab you can see.

• Wide notes — A markdown note can be lifted out of the reading column to full width, and the choice is remembered per device.

• Ephemeral chats from the + New menu — The create menu gains an Ephemeral submenu: Incognito (reads memory, writes none) and Temporary (neither) sessions, one tap from the sidebar.

• Agents can color their sessions — An agent's session_color tints every session it starts that has no color of its own, applied at render time so editing the agent re-tints them live; a manual pick always wins.

Approvals you can steer

• Approve or reject everything at once — When several tool calls wait on you, one click answers all of them, and the confirmation lists every command it covers — not just the newest.

• Reject once — Refuse a single tool call and still get asked about the rest, instead of rejecting the whole batch.

• Commands you can read — A long shell call with no stated purpose shows a short readable digest of what it does; the verbatim command stays one hover away.

• Approvals in the CLI — kirocrew chat now shows tool permission prompts and lets you answer them, so a turn no longer hangs silently until it times out.

• The approval bar teaches the modes — It now points at the approval-mode picker, so Reads, Trust and YOLO are discoverable instead of confirming every step forever.

• Name-grants verify identity on every surface — An "always allow" for a shell command now checks, on every auto-approve path including headless runs, that each program name still resolves to the program it named; a shadowed or agent-writable resolution falls back to the prompt — or to the headless deny — instead of inheriting the grant.

• Trusted Slack bots — slack.trusted_bot_ids lets named bots through the bot filter for multi-gateway meshes, with a per-thread turn limit so two trusting gateways cannot answer each other forever.

Agents that drive other agents

• Seed and steer peer sessions — session_send delivers a message into another session as its next turn, so a coordinator can direct peers instead of only opening, reading or stopping them.
• A conductor for goals too big for one session — The built-in conductor agent decomposes a goal, stands up a session per work item, checks acceptance, and decides each next round — patrolling on a monitoring loop that survives tab closes and turn caps.
• A durable workflow library — Promote a session's workflow into a global library, manage revisions and lineage from Agent Capabilities, and invoke saved definitions with /workflow; task-runner plans share the same library.
• Watches that wake on change — A babysat pull request wakes its watcher on human comments, reviews and verdicts — not just check results — and the new interrupt controller turns polling monitors into wake-on-change interrupts for any script cron.
• Auditable fan-outs — Wave digests name the model that actually served each member, the live panel flags a downgraded model while the run is still going, and a finished subagent's results survive a gateway restart.

Update itself, anywhere

• Atomic self-update — kirocrew update installs the new version into a fresh, signature-verified tree and switches to it atomically, so a script-installed Kiro Crew updates itself.
• Windows updates install in place — "Restart & Update" shows installer progress and relaunches the new build instead of nesting a copy and reopening the old one; kept Start Menu and Desktop shortcuts are repointed, and installs are much faster.
• An honest About page — Settings › About shows when the last update check ran and when the next is due, reports your real OS and architecture, and the post-upgrade "What's new" modal shows the notes for the version you are actually running.
• No more downgrade nags — Running ahead of your channel's published release no longer produces an older-build update offer, and a hotfix published on an old release line can never move a channel's update feed backward.

Secrets leave more files

• kirocrew secrets import — Move plaintext credentials out of .env into the encrypted vault, leaving a secret:// reference behind; dry-run by default, --apply to commit.
• Redaction happens before truncation — Credentials near a truncation boundary are redacted before the text is cut, so partial secrets stop leaking into audit rows, logs and dashboard payloads; hook output is redacted too.
• Owner-only from the first byte — Windows config.json writes are locked to your account (over a thousand times faster than before), and secrets written during pod setup and snapshot restore are locked down before publication.

Phones and touch

• One-click phone access — A single "Set up & show QR" action enables trust, restarts the gateway, publishes over Tailscale, and hands you a sign-in QR code — and a phone session now survives gateway restarts and updates instead of needing a fresh scan.
• A sign-in link for a phone that lost its session — A signed-in device can mint a one-time link; the CLI recovery path remains when nothing else is signed in.
• Video in the composer — Attach videos u...

What's Changed

• fix(release): backport the feed-advance guard to release/0.5.0 by @bolichen97 in #8602
• chore(desktop): sync the electron lockfile version to 0.5.0 by @bolichen97 in #8605

Full Changelog: v0.5.0-insider.10...v0.5.0-insider.11

What's Changed

• ci(release): add opt-in stable-rebuild lane so v0.5.0 ships a clean 0.5.0 stamp by @bolichen97 in #8568

Full Changelog: v0.5.0-insider.9...v0.5.0-insider.10