Kiro Crew

From the release notes

What's Changed feat: backport app sources, artifact scroll and Windows MCP fixes by @bolichen97 in #11339 fix: refresh cached highlight worker CSP on insider by @bolichen97 in #11374 Full Changelog: v0.7.0-insider.3...v0.7.0-insider.4

From the release notes

What's Changed feat: label and review tier for pinned app registries (backport #11155) by @bolichen97 in #11184 Full Changelog: v0.7.0-insider.2...v0.7.0-insider.3

From the release notes

What's Changed refactor: extract shared hardened gh runner for all gh spawn paths (#342) by @bolichen97 in #2407 feat(security): operator keystone extension for OAuth consent-endpoint allowlist (#1341) by @bolichen97 in #2402 fix: redact model-authored tool titles on all deny surfaces (#2274) by @bolichen97 in #2389 feat(chat): message-level pinning with pinned messages panel by @RohanK6 in #1676 ci(review): expand Opus to correctness blocking + sync fork prompt by @iamwhatever in #2379 feat(mcp-pool): Toggle all switch for poolable MCP servers by @chenmingwei23 in #2433 fix(knowledge): make the three auto-ingest paths opt-in by @bolichen97 in #2448 fix(dev-fleet): report slow actions as indeterminate, not as a fake percentage by @chenmingwei23 in #2439 test(dashboard): make chat-pins transient-I/O test portable on Windows by @iamwhatever in #2454 feat(voice): add a push-to-talk key for voice input by @CrysisDeu in #1608 feat(watchdog): detect a stalled turn from outside the turn's read loop by @chenmingwei23 in #2466 feat: receive images, voice and files on the Weixin channel by @chenmingwei23 in #2444 fix(dev-fleet): refuse the sync when pip cannot reinstall into the live venv by @chenmingwei23 in #2445 fix(prepare-pr): re-mirror the local review gate onto the current CI contract by @iamwhatever in #2456 feat(voice): show info banner + mic-click modal on remote instances by @cixuuz in #2471 refactor: centralize title hydration by @JoernZheng in #2467 fix(test_wait_tool_early_end): scope the wait-tool fake clock to the wait loop thread by @tlobinger in #2460 fix(terminal): complete subcommands for tools the user installed by @dwu96 in #2429 feat: first-party fixed-argv carve-out in sandbox fail-close (#1563) by @bolichen97 in #2428 feat: verify internal-API session claims via unix-socket peer creds (#302) by @bolichen97 in #2424 fix: re-vet cron jobs at fire time; move SEL key to trust/ (#1881) by @bolichen97 in #2421 build: target Node 24 LTS with a single 22+ floor everywhere (#1070) by @bolichen97 in #2415 feat: pin tunnel sessions to daemon-verified tailnet peer (#1762) by @bolichen97 in #2411 fix(appstore): compute app trust fields server-side (#580) by @bolichen97 in #2408 fix: detect and audit tier downgrades in nested-sandbox passthrough (#691) by @bolichen97 in #2406 fix: per-root hardlink-scan budgets with loud truncation (#646) by @bolichen97 in #2387 fix: make revocation generation cover refresh tokens (#2028) by @bolichen97 in #2388 ci: gate vendored _vendor tree behind a sha256 manifest (#492) by @bolichen97 in #2392 fix(dashboard): restore isort-clean import order in the dashboard auth module by @iamwhatever in #2479 feat(instances): carry the kiro-cli context so a sent session resumes by @iamwhatever in #2260 revert: withdraw multi-account Telegram until a bot is governable (#2203) by @chenmingwei23 in #2476 docs(autosde): forbid new work on the gateway boot path by @CrysisDeu in #2472 docs: revis

From the release notes

0.7.0 insider 1

From the release notes

Kiro Crew stops being one agent on one machine: choose the harness that runs your sessions, start a chat on another crew you are connected to, and let crew members dispatch workers of their own. Chat gets quieter, with folded diffs, resumed sessions that stop re-reading their own context, and refused commands that tell the agent what it may do instead. Python 3.12 is the new floor. Before you upgrade Python 3.12 is now the floor: a host on 3.10 or 3.11 must move up before installing or updating, and every installer provisions 3.12 itself when the system package manager has none. The installer now brings its own Python: curl -fsSL https://download.crew.kiro.dev/cli.sh | sh provisions a pinned CPython rather than using the system one, so pass --system-python if you deliberately build against yours. The command gate no longer fences credential paths by reading the command text: the sandbox's bind masks are the fence now, so check that agent.sandbox in config.json is not off if you were relying on that text gate. An unattended auto-run plan now stops after two hours: raise it with orchestrator.max_plan_duration_seconds in config.json, or set 0 to remove the ceiling; a stage-gated plan is never cut. Pick the harness that runs your sessions (Preview) Claude Code, Codex and KAS are selectable harnesses: turn on Developer Mode in Settings → Developer (off by default), then pick one under Developer → Agent Backend, where each option says whether it is installed, missing on this machine, or waiting on a gateway restart. A tool pre-approved in Claude's own settings never reaches Crew's approval path, so its deny rules and audit log do not see that call, and Codex refuses to start while the sandbox is off. Monitor loops, project changes, follow-up cards and conversation reset work on every backend, where they previously failed closed outside Kiro CLI. Remote crews become one dashboard (Preview) Run a chat on another crew you are connected to: set instances.enabled in config.json and turn on Settings → Developer → Feature Previews → Chat on a crew (both off by default), then pick the peer under New chat on crew in the sidebar's new-chat menu; the transcript stays local while every turn runs on that crew. A session that runs elsewhere carries a server badge and the crew's name in your sidebar, so remote work is openable from the list you already read. Crews connect themselves on app load and on tab focus, on by default and switchable at Settings → Remote Instances → Auto-connect crews. Chat that stays out of the way Diffs start folded as a chip naming the file and its +N/-M counts, and Settings → Chat → Plain diffs (off by default) renders patches as plain monospace text instead. A sketch pad and a share action: the composer's + menu gains a Sketch row that draws an image and attaches it, and an assistant reply's Share as image action exports a branded PNG or prefills an X or LinkedIn post. The composer says where you are, and gets out of the

From the release notes

What's Changed fix(deps): backport the electron js-yaml 4.3.2 pin to release/0.6.0 by @bolichen97 in #10076 Full Changelog: v0.6.0-insider.4...v0.6.0-insider.7