What's Changed

• fix(reconcile): don't kill a live session's nested kiro-cli by @luokaiwei in #22356
• test(coder): stop matching words against the random binding id by @mbriones98 in #30002
• fix(hooks): fire a spec's non-gating hooks on claude sessions by @bolichen97 in #30134
• fix(context): honour steering inclusion front matter in the claude load by @bolichen97 in #30113
• refactor: make core independent of the spec-builder app by @bolichen97 in #30091
• feat(apps): pin papyrus, file-explorer, design-critique, pptx-maker by @bolichen97 in #30149
• fix(acp): read claude's adapter-stamped mcp server as trusted identity by @bolichen97 in #30105
• fix(cloud): hold off a second launch while a job file holds bad JSON by @bolichen97 in #30045
• refactor: make core independent of the ops-mission-control app by @bolichen97 in #30061
• refactor: make core independent of the meetings app by @bolichen97 in #30078
• test(gui-user): tell members-dm-hello where the mate list and rail labels are by @JLargent42 in #30161
• fix(cron): refuse an infinite timeout with ValueError, as every_secs is by @RohanK6 in #30152
• fix(cli): write kirocrew bench errors to stderr by @RohanK6 in #30153
• fix(a11y): expose open state on the MCP info and more-sizes toggles by @RohanK6 in #30144
• fix(website): name the artifact comment boxes by @RohanK6 in #30142
• feat: add Kiro Cloud Sessions as a session environment by @kyleseaman in #25347
• feat(members): download a bot's dashboard as one html file by @CrysisDeu in #29353
• refactor: make core independent of the auto-improvement app by @bolichen97 in #30076
• perf(acp): answer a leaf's children from /proc without spawning pgrep by @Pearcekieser in #29328
• fix(install): name the restart command after a re-run under a gateway by @mbriones98 in #30033
• fix(connections): spawn the warm mint without native skill projection by @bolichen97 in #30065
• fix(link-preview): show a card with the reason and Retry when a preview fails to load by @buluoray in #29890
• test: pin utf-8 on text reads and writes in 59 test files by @javenciu in #30104
• perf(dashboard): send the coalesced slot list to capable tabs as row deltas by @Pearcekieser in #29360
• feat(dashboard): reopen closed sessions with Cmd/Ctrl+Shift+T by @bolichen97 in #30177
• feat(session): opt-in idle compaction before prompt-cache expiry by @Pearcekieser in #24384
• fix(history): configurable session-search scan window, say when cut short by @mbriones98 in #23603
• fix(apps): treat any SSH method list as a clone auth refusal by @mbriones98 in #26371
• fix(dashboard): let the @ picker find files in .kiro/specs and steering by @JLargent42 in #30120
• fix(agents): tell agents to send a dependent call in a later step by @iamwhatever in #30189
• fix(kas): keep env-reference mcp entries in the agent block on load by @buluoray in #30175
• fix(dashboard): correct unit and plural in the approval-wait phrase by @chenmingwei23 in #29925
• fix(cloud): print a clean error when no sandbox backend is available by @chenmingwei23 in #29931
• fix(command-palette): keep global shortcuts from firing behind it by @mbriones98 in #30069
• feat(metrics): widen the reviewed product-metrics allowlist by @chenmingwei23 in #29919
• ci(leaf): shard the corpus gates across the matrix by @CrysisDeu in #30115
• feat: let a person cancel an MCP elicitation from the card by @CrysisDeu in #23973
• fix(schedule): return focus to the folder menu when an empty folder's delete is cancelled by @RohanK6 in #30139
• fix(shared-crew): one invite entry and one People row per person by @bolichen97 in #29592
• fix(approvals): resolve an approval by id only in the session it was shown in by @buluoray in #29990
• fix(session): don't resume in an earlier process's hidden scratch dir by @buluoray in #30129
• fix(knowledge): show Live on a Bedrock KB row only while its grant holds by @bolichen97 in #30053
• refactor: make core independent of the issue-radar app by @bolichen97 in #30101
• fix(acp): clear claude effort live with the adapter's default value by @bolichen97 in #30107
• fix(apps): stop an app's in-process routes when it is uninstalled by @bolichen97 in #30163
• test(ratchet): refuse a short literal duration argument and document that production deadlines are not test boundaries by @CrysisDeu in #30029
• refactor: make core independent of the code-review-sage app by @bolichen97 in #30089
• test(chat-sidebar): make the resume-all confirm flake diagnosable (#30081) by @CrysisDeu in #30126
• feat(files-tab): lead with the files this chat edited, browse lazily by @bolichen97 in #29579
• fix(drive-library): restore focus to the opener when the add picker closes by @chenmingwei23 in #30182
• test(project-scan): pin that over-cap nesting never reaches a recursive parser by @JLargent42 in #29913
• fix(mcp): remove a server added through Add Custom by @chenmingwei23 in #29934
• feat(apps): show app.json links as buttons on the store detail page by @buluoray in #30162
• perf(chat): per-turn timing markers behind KIROCREW_TURN_TIMING by @Pearcekieser in #29417
• fix(crew): deprecate the crewmate conductor's inherited user skills for one release by @iamwhatever in #29926
• fix(env): move the mise binary lookup out of env.py by @mbriones98 in #30196
• fix(memory): ask before deleting a semantic memory entry by @mbriones98 in #30022
• fix(resources): say agent memory when the agent slice binds the memory alert by @Pearcekieser in #29318
• ci(macos): run the nightly backend tests in 8 shards by @CrysisDeu in #30037
• fix(connections): read a non-UTF-8 tool-alias record as claiming nothing by @RohanK6 in #30214
• test(crew-log): move the remaining fixed-timeout read-back flush waits to assert_drained() by @iamwhatever in #30216
• fix(design-critique): translate the page's lists, counts and fallback text by @RohanK6 in #30155
• fix(pptx-maker): keep the install banner up until the engine prompt is on disk by @chenmingwei23 in #30185
• fix(taskrunner): keep an active run resumable across a graceful restart by @CrysisDeu in #29983
• fix(mcp): keep the toggle off the shared mcp.json for store-only servers by @mbriones98 in #30102
• fix(composer): re-measure when the height was measured at another width by @LucaButBoring in #29470
• fix(dashboard): restore the file manager under the installed Linux service by @rubencu in #30083
• feat(warm-brief): read PRs before naming them, cite checked facts, list them, and skip unchanged returns by @iamwhatever in #29679
• docs(cron_service): shorten more long comments and docstrings by @iamwhatever in #29757
• fix(website): name the comment thread reply and pending-comment edit boxes by @RohanK6 in #30207
• fix(acp): offer effort on a claude session serving the default model by @bolichen97 in #30084
• fix(dashboard): answer folder and terminal count caps with 409, not 429 by @iamwhatever in #30215
• fix(doctor): ...

A second hot patch for 0.12.0, on top of 0.12.1: Kiro Crew no longer restarts a running gateway to install an update, chats keep their approvals, queued messages and streams straight under failures, and the KAS engine reads more of a kiro-cli agent spec. Slack, Teams, Telegram and Discord keep each turn's reply in the right place, and security, Windows, cloud crew and accessibility fixes land with them. The Decisions model card gains a SageMaker endpoint option.

Updates

Kiro Crew never restarts a running gateway to install an update. A new version downloads in the background, clicking Update only marks it for the next start, and the desktop app installs it when you quit. An install that was interrupted finishes at the next app start before the gateway starts, and the agent cannot write the record that arms an update.

Notable fixes

Chat and sessions. An old approval answer no longer approves a later tool, approval cards stay answerable when a stop fails, and a streaming turn keeps running when its send fails late. A closed tab stays closed when its late save lands, a requeued message runs on its own row instead of a duplicate, a resume joins the agent already starting, and the reply that streamed before a compaction is kept. The agent greeting shows early, mermaid label images no longer load on render, and clicking a linked image opens only the viewer.

KAS engine. A kiro-cli agent's allowedCommands patterns (\d, \s, \w, {n,m} and Rust style expressions) and read allowedPaths are honoured at Crew's gate, shell allowlist grants survive a policy that pins built-in rules, and trustedAgents allows apply after every deny. An mcp.json tools allowlist and useLegacyMcpJson are read, a project agent file can switch a user-level MCP server off, a model pin the KAS model list does not offer is refused, a host with a too-old glibc is refused before the install begins, and a broken engine copy that kiro-cli left behind is moved aside once. Steering files that may be auto-included are sent by path instead of the whole tree, a runtime start no longer waits on an empty tree scan, spec hook context is sent again after a compaction, and Crew's MCP servers connect before the agent's own.

Claude and other harnesses. A start that dies at once reports the real exit status, a failed kiro sign-in is reported as unfinished with a one click retry, and a kiro-cli engine the host cannot run is reported as such. A Kiro CLI that rejects --auth-method is told once to update, its out of date card lifts when config leaves the KAS relay, and KAS users reach the Kiro sign-in from the account popup, where a bare refusal names the start URL before the region. A Claude session that asks for auto approval keeps Crew's tools beside a foreign settings file, cli.json is kept whole when the gateway cannot read it, and Codex Crew servers carry the gateway instance environment.

MCP servers. A user MCP server whose name contains a colon stays in the default agent spec, a Windows launcher is probed once whatever its spelling, a copied gateway entry drops its provenance records, and a dead pooled backend is named. The launch approval and settings cards of the MCP gateway behave, a KAS MCP sign-in is saved where KAS chats read it, a remote server's sign-in settings always reach the engine, and KAS says when it cannot sign in to a server with its own client. A KAS MCP server's launch reference is shared across sessions, and a conductor is told which of its worker's MCP servers failed.

Bots, crews and the work ledger. The Bot editor, agent picker and roster get four fixes, a Bot whose memory database was deleted reopens, and a .kirobot file that starts with a byte-order mark imports. A new chat never suggests a Bot's home folder, a Bot chat outside its own thread is told to do the work itself, and the custom agents tab lists spec files it used to hide while reserving their names. A folder agent named like a Bot is asked about instead of rewritten, the crew log writes its savepoints when a unit grew during the pass, and the work ledger says when an undo removed a write.

Schedules. Credential failures no longer count toward a job's automatic pause, stateless runs stay out of the session search window, and a run cut off by a restart is reported as such. A deeply nested crons.json value no longer blocks every save, and a scheduled approval mode of auto is refused when it comes from an app token. A HEARTBEAT.md saved with a byte-order mark is read like any other, and a paused job's cut run no longer promises a next run.

Security. Several file, link and permission checks are tightened on Windows and in the dashboard, including junctions, middle link folders, fixed tool lookups, file search scope, a file read check and a channel member check. The dashboard no longer trusts localhost:3000 just because a data home is set, boot.allow_terminal refuses the dashboard terminal, and credentials are masked in long capability messages. Outlook's own links pass the link guard, an oauth_endpoints.json entry can clear a client id that was held back, and a shell call's recovered command is judged under the policy commands.

Channels. Slack keeps a review draft when posting or approving it fails, and an approval click stays on the chat that asked. Teams and Telegram keep a later turn's reply when an earlier turn ends, Discord starts a fresh session when its resume host stays unreachable and opens no new connection after closing, and a quoted directive line is dropped from channel replies. Slack formatted messages are legible in the bell, a linked Slack thread's turns run with the Slack runtime, and a channel's challenge prompt is no longer echoed into its thread.

Cloud, pods and remote crews. A cloud launch into an account without a host policy is refused, a denied launch names the action and points to the IAM policy, and end of input at a yes/no prompt counts as no. The cursor menu picks items past nine by number, only resumable found stacks are offered and never preselected, and list, status and destroy agree about a removed crew. A silent SSM crew or an origin refusal is explained instead of reported as a bad credential, remote crews forward every pane port, the SSH tunnel is marked unsupported on a Windows gateway, and a pod reports a systemctl or journalctl timeout and refuses a name with a trailing newline.

Gateway, update checks and desktop app. An update check lets its fetch finish and cleans up after a cancel, refuses an offer from a channel you left, and words each refusal clearly. A stable release now reaches the insider index and image, one failing cleanup step no longer skips the rest when the gateway stops, a refused systemd stop is reported instead of success, and dashboard sign-in writes and status reads no longer block the gateway. The desktop app bounds and rotates its gateway launch log, keeps its supervision steady, kills a hung renderer under Rosetta, and retries Windows installs through a brief file hold, and setup no longer asks for node on the bundled KAS route.

Memory, knowledge and skills. A knowledge folder keeps a file its scan could not see, the embedding rate limit lets one waiter through per token, and a Bedrock knowledge base counts each id once toward its cap. Office-held files open in the viewer and memory locks are kept. A transcript row with no role no longer stops context from reading on, and crystallize is told the candidate layout.

Monitoring and workflows. A GitHub pull request with over 100 passing checks counts as review ready, a rate limit stays retryable, and a GitLab merge request is reported as conflicting behind another blocker. Only the newest Azure DevOps status per check counts. A cancelled step fails in workflows and in task runner parallel groups, and saved task plans are refused while the task runner is off.

Dashboard, keyboard and languages. Delete, knowledge, Capabilities, Memory and issue radar buttons keep keyboard focus while they work, and the account Refresh button fits its label. The dictation preview keeps its line breaks, the /connections redirect keeps its query, and an SVG artifact keeps its stylesheet off the page around it. The crew board's failed attempts count is pluralized, desktop file links with a drive letter open, a link preview falls back when a title is blank, and creating a worktree names git's reason when it refuses.

Decisions model. The Decisions model card offers a SageMaker endpoint option with an endpoint name and region, and hosted options the organization's ceiling refuses are hidden. A refused configured endpoint reads as No model, and turning on consent for a refused host is refused.

What's Changed

• fix(signing): sign each part of a split request from its own input (0.12.1 backport of #34247) by @bolichen97 in #34249
• fix(desktop): ship macOS bytecode caches for the startup set only (0.12.1 backport of #34252) by @bolichen97 in #34254
• fix: v0.12.2 hotfix batch 1 (82 fixes from main) by @bolichen97 in #34375
• fix: v0.12.2 hotfix batch 2 (65 fixes from main plus release tooling) by @bolichen97 in #34586
• fix: v0.12.2 hotfix batch 3 (8 security and data-loss fixes) by @bolichen97 in #34737
• fix: v0.12.2 hotfix batch 4 (four more of our fixes, adapted to release) by @bolichen97 in #34746
• fix(kas): backport #31892 #33045 #33478 to 0.12 (allowedCommands regex, read allowedPaths) by @buluoray in #34820
• fix: 0.12.2 batch 5 (7 fixes from main) by @bolichen97 in #34923
• fix(kas): withhold a model pin the session's model select does not...

What's Changed

• fix(signing): sign each part of a split request from its own input (0.12.1 backport of #34247) by @bolichen97 in #34249
• fix(desktop): ship macOS bytecode caches for the startup set only (0.12.1 backport of #34252) by @bolichen97 in #34254
• fix: v0.12.2 hotfix batch 1 (82 fixes from main) by @bolichen97 in #34375
• fix: v0.12.2 hotfix batch 2 (65 fixes from main plus release tooling) by @bolichen97 in #34586
• fix: v0.12.2 hotfix batch 3 (8 security and data-loss fixes) by @bolichen97 in #34737
• fix: v0.12.2 hotfix batch 4 (four more of our fixes, adapted to release) by @bolichen97 in #34746
• fix(kas): backport #31892 #33045 #33478 to 0.12 (allowedCommands regex, read allowedPaths) by @buluoray in #34820
• fix: 0.12.2 batch 5 (7 fixes from main) by @bolichen97 in #34923
• fix(kas): withhold a model pin the session's model select does not list [0.12.1 backport of #34090] by @buluoray in #34300
• fix(security): let Outlook's own webLink through the link guard (0.12.2 backport of #34034) by @buluoray in #34567
• fix(acp): share a KAS MCP server's launch reference (backport #34542) by @buluoray in #34610
• fix(security): judge a shell call's recovered command under policy commands (backport #34862) by @buluoray in #35059
• fix(agents): refuse a model pin the KAS model select does not list (backport #34062) by @buluoray in #35050
• fix: linked slack thread runtime and challenge prompt echo (backport #34832, #34905) by @buluoray in #35078
• fix(cron): stop promising a next run to a paused job's cut run (0.12.0 backport) by @buluoray in #35109
• fix(chat): stop mermaid label images loading on render (backport #30925) by @buluoray in #35138
• fix(kas): keep shell allowlist grants when a policy pins built-in rules (0.12.x) by @buluoray in #35154
• fix: mark ssh tunnel as unsupported on a windows gateway (backport #30777) by @buluoray in #35162
• fix(chat): keep the reply that streamed before a harness compaction (backport #34072) by @buluoray in #35171
• fix(acp): let a project agent file switch a user-level MCP server off on KAS (backport #34061) by @buluoray in #35181
• fix(kas): backport #35244 #35262 #35272 #35278 to 0.12 by @buluoray in #35389
• fix(acp): say 'update Kiro CLI' once when it rejects --auth-method (backport #30587) by @buluoray in #35304
• fix(desktop): kill a hung renderer by pid when running under rosetta by @buluoray in #35419
• fix: 0.12.x backport batch 3 (account popup sign-in, linked image, folder agent) by @buluoray in #35470
• fix: 0.12.x backport batch 4 (kas sign-in error text) by @buluoray in #35490
• fix: 0.12.2 batch 6 (update fix, SageMaker option) and the 0.12.2 version by @bolichen97 in #35596
• fix: four 0.12.2-rc.1 release-line reds by @bolichen97 in #35623

Full Changelog: v0.12.1...v0.12.2-rc.2

A hot patch for 0.12.0: the KAS engine and the Claude backend follow your agent specs, hooks and MCP servers the way kiro-cli does, chats pick up after a planned restart and queued messages wait their turn, and schedules run in the right workspace with a bounded history. A broad set of security, Windows, desktop and accessibility fixes lands with them.

Notable fixes

Chat and sessions. Chats that a planned restart cut off resume, a queued message waits while its card's editor is open and is checked again right before it runs, and a session's own messages are never held behind its sub-agents. A turn the backend refused for model capacity ends with a notice instead of offering Resume, a streaming reply stays live on slow devices, and unsent text in a split view or a Bot chat survives a page reload. If a dashboard module fails to load, the page reloads instead of staying blank, and a cleared chat no longer resumes in a folder you removed. A prompt whose reply was too large to read ends its turn instead of leaving the session waiting.

KAS engine. KAS reads a kiro-cli agent spec the way kiro-cli does: tool aliases, allowedTools globs, allowed shell commands and paths, and a grant beside deniedCommands or deniedPaths keep their meaning, and spec hooks get kiro-cli's field names, cover every call they name and run on scheduled turns too. MCP servers take their settings from your kiro-cli mcp.json and see the gateway's Kerberos ticket cache and ssh agent, and an unattended run waits for a slow server to start. KAS answers /context, /knowledge, /code and /hooks, the session start notice names a refused permissions block or an unreadable mcp.json, and the engine install trusts your system's certificate store and refuses a host whose glibc is too old before it begins.

Claude and other harnesses. On the Claude backend a session loads workspace steering and the project's AGENTS.md and gets them back after a compaction, a spec's toolsSettings allowlists are enforced, a Bot worker starts with only the MCP servers it was granted, and an overloaded error is retried. /clear is answered locally, Claude's own commands appear in the / menu, auto memory stays off in incognito and temporary chats, and kirocrew doctor warns about an outdated claude-agent-acp. A pi session now carries the MCP servers its agent spec declares.

MCP servers and connections. The MCP tab lists servers an agent rebuild dropped, a server added through Add Custom can be removed again, and ${HOME} and ${USER} in a server's settings resolve on Windows. A refused connection sign-in is reported at once instead of after 10 minutes, the Connections badge sees sign-ins KAS holds, and a grant that just failed its check no longer shows as connected. An unreadable global mcp.json is reported as unreadable rather than corrupt, and sign-in callbacks that carry extra provider parameters are accepted.

Bots, crews and sub-agents. A Bot shows as working while its worker sessions run, closing a conductor closes the workers it manages, a conductor wakes only when a worker's status changes, and a Bot worker keeps its own MCP servers and the ones its agent.env resolves. Nested sub-agent runs show in the root chat's sub-agents panel and inherit its trust, and a running sub-agent stops auto-approving once that trust is revoked. Read aloud and auto-speak work in crewmate chats, the task runner keeps an active run resumable across a graceful restart, and the work ledger patrol stays armed after every item closes.

Schedules. A scheduled run's tab opens in its agent's workspace, so its sessions are no longer refused, a job keeps its wall-clock time across a daylight saving change, and previews leave out the dates a job skips. Each job keeps only its 20 newest run transcripts, scheduled commands get the same PATH as agent sessions, and a run whose agent was renamed or uninstalled is marked failed. kirocrew snapshot --keep run from a schedule now prunes older snapshots.

Security. This release tightens several access checks, covering dashboard sign-in, session ownership, channel senders, destructive and self-management commands, sandbox file guards and Windows file access. Started off a terminal, for example by a service manager, the gateway no longer writes its dashboard sign-in link to the log (run kirocrew token for one), the desktop app's live log no longer records the dashboard token, and proxied app requests no longer carry it. KAS keeps PowerShell process control out of auto-approve, a deniedPaths entry ending in * also covers the folders below it, and a Claude session's switched-off tool on an MCP server whose name contains a dot is denied. An unreadable sign-out or token refresh record now fails closed instead of being saved over.

Approvals and the sandbox. Each approval mode says what it runs without asking, Reads mode no longer asks to approve kiro-cli's own file reads, a tool a hook blocked shows as blocked rather than done, and a malformed message rule in config.json no longer breaks every chat turn. max_memory_mb no longer stops Node and GraalVM tools from starting in scheduled runs (the new opt-in max_address_space_mb sets that limit), and the sandbox cleans up after a dead launcher so the runtime folder no longer runs out of inodes.

Gateway, install and doctor. kirocrew restart refuses to run against a stopped installed service, a busy port names its holder and suggests --port, the crash dump of a gateway that died without a clean exit is kept, and the service PATH puts nvm's Node ahead of /usr/bin. The installer stops when the KAS engine download is interrupted, a data home that cannot be written is refused with one line and one another account owns is explained, and the browser harness installs with its own pip where the gateway has none. kirocrew doctor fails when the selected backend is missing kiro-cli or a Claude component, warns instead of failing on a KAS engine the first chat will download, and no longer fails on a missing optional voice extra or ffmpeg. Kiro backend users are no longer told to run aws sso login when access is refused.

Memory, knowledge and artifacts. One unreadable line in the lessons file no longer breaks every lesson, deleting a memory entry asks first, and memory sources are indexed again after the search index repairs itself. A knowledge folder keeps syncing until its scan ends even when one file fails, an upload over the size limit is refused before it is sent, a source says why it waits in pending, and a failed confirm, rename or Sync shows an error. An SVG artifact keeps its own styles without restyling the dashboard, and a failed artifact move no longer leaves new folders behind.

Channels. Slack sends a sentence's last word before the tool card, keeps one answer row when a linked stream rotates, and says why it is not connected when startup turned it off. Teams posts the answer below an approval card and keeps a replayed message as text, Telegram keeps each sender's message in their own turn, and WhatsApp counts a quote on a voice note, sticker or video note and says why an image could not be sent. Messages queued on a channel are answered once a turn elsewhere ends, channel tokens are verified through the channel's proxy, and kiro-cli's steer acknowledgement stays out of replies and titles.

Remote crews and pods. A remote crew offers one ssh line that forwards every pane port, keeps retrying a dropped tunnel for up to an hour, and waits for its running work before it restarts. A pod boots when kiro-cli keeps its engine in its data folder, kirocrew pod down waits for the whole stop, and Windows pod tasks run at normal priority.

Windows and the desktop app. On Windows the gateway and spec hooks start with no console window, a timed-out process ends with its whole tree, an agent's processes end with its runtime, and crash dumps are found in Crashpad's reports folder. A pending desktop update shows its release notes, the top bar stays draggable when docked on macOS and over a scrolled chat on Windows, and Escape ends a video's fullscreen. The Linux package installs on distributions that renamed libasound2 to libasound2t64.

Dashboard, keyboard and languages. Buttons across the dashboard keep keyboard focus while their request runs, toggles and disclosure rows tell a screen reader whether they are on or open, and hover-only row controls appear when the keyboard reaches them. More of the dashboard is translated, counts are pluralized and lists are joined the way each language does, and a sentence around inline code or bold text stays whole. The @ picker finds files in your project's specs and steering folders, the chat composer stays above the iPad keyboard, a proxy's 502 or 503 page shows as a temporary outage, and the chat's path chip and Copy link do what they say.

Built-in apps. App pages load through the dashboard, so they work behind a reverse proxy that asks you to sign in, an app update keeps your edits to its agents and brings its schedules into the running scheduler, and a registry update to an older version is refused. A pptx-maker engine whose lock file was rewritten repairs itself.

What's Changed

• fix(release): backport thirteen KAS, security and reliability fixes to 0.12.0 line by @buluoray in #30954
• fix(release): backport one knowledge fix to 0.12.0 line by @buluoray in #31019
• fix(release): backport six KAS, hook and security fixes to 0.12.0 line by @buluoray in #30987
• fix(release): backport the KAS signed-out chat row translation to 0.12.0 line by @buluoray in #31373
• fix(release): backport two dashboard and Bot steering fixes to 0.12.0 line by @buluoray in https://github.com/kirodotdev/KiroCre...

What's Changed

• fix(release): backport thirteen KAS, security and reliability fixes to 0.12.0 line by @buluoray in #30954
• fix(release): backport one knowledge fix to 0.12.0 line by @buluoray in #31019
• fix(release): backport six KAS, hook and security fixes to 0.12.0 line by @buluoray in #30987
• fix(release): backport the KAS signed-out chat row translation to 0.12.0 line by @buluoray in #31373
• fix(release): backport two dashboard and Bot steering fixes to 0.12.0 line by @buluoray in #31422
• fix(release): backport four KAS, Claude-backend and sandbox fixes to 0.12.0 line by @buluoray in #31328
• fix(release): backport eight security, hang and KAS fixes to 0.12.0 line by @buluoray in #30893
• fix(release): backport KAS tool-less helper MCP fix to 0.12.0 line by @buluoray in #31477
• fix(release): backport KAS MCP mute and Bot crew-log fixes to 0.12.0 line by @buluoray in #31512
• fix(release): backport new-Bot creation failure reason to 0.12.0 line by @buluoray in #31554
• fix(release): backport two KAS permission fixes to 0.12.0 line by @buluoray in #31636
• fix(release): backport KAS MCP sign-in logging to 0.12.0 line by @buluoray in #31645
• fix(release): backport twelve low-risk KAS, Bot and runtime fixes to 0.12.0 line by @buluoray in #31693
• fix(release): backport six KAS and security fixes to 0.12.0 line by @buluoray in #30809
• fix(release): backport provider-owned STT session limit to 0.12.0 line by @saisrinivas26 in #31726
• fix(release): backport Bot worker edition MCP tool refs to 0.12.0 line by @buluoray in #31891
• fix(release): backport the idle-slot approval sweep fix to 0.12.0 line by @buluoray in #31894
• fix(release): backport eight MCP, sign-in and user-reported fixes to 0.12.0 line by @buluoray in #31948
• fix(release): backport ten small KAS and Bot fixes to 0.12.0 line by @buluoray in #31926
• fix: backport nine user-reported fixes to 0.12.1 (batch 21) by @buluoray in #31981
• fix(release): backport ten user-reported fixes to 0.12.0 line by @buluoray in #31968
• fix(kas): backport the bare-name hook matcher narrowing to 0.12.1 (batch 23) by @buluoray in #31990
• fix: backport eight user-reported fixes to 0.12.1 (batch 22) by @buluoray in #31987
• fix(release): backport two KAS command-check and redaction fixes to 0.12.0 line by @buluoray in #31694
• fix(models): backport the cold model list fill to 0.12.1 (batch 24) by @buluoray in #32112
• fix(mcp): backport the timed-out local probe retry to 0.12.1 (batch 25) by @buluoray in #32140
• fix(kas): backport the allowedCommands chain grant to 0.12.1 (batch 26) by @buluoray in #32149
• refactor: backport the agents.py effort-levels split to 0.12.1 (batch 29) by @buluoray in #32184
• fix: backport five user-reported fixes to 0.12.1 (batch 30) by @buluoray in #32194
• fix: backport eight MCP, Bot and KAS fixes to 0.12.1 (batch 27) by @buluoray in #32155
• fix: backport four user-reported KAS and MCP fixes to 0.12.1 (batch 28) by @buluoray in #32174
• fix: backport the MCP dropped-server notice and KAS tool aliases to 0.12.1 (batch 31) by @buluoray in #32202
• fix(kas): backport three KAS agent-file, skill and command fixes to 0.12.1 (batch 32) by @buluoray in #32222
• fix: backport the helper-turn memory gate and Ultra Mode chip fix to 0.12.1 (batch 34) by @buluoray in #32242
• fix(kas): backport the allowedTools grant-only settings fix to 0.12.1 (batch 35) by @buluoray in #32245
• fix(kas): backport the checked-deny grant and kiro-cli toolsSettings grant fixes to 0.12.1 (batch 37) by @buluoray in #32467
• fix: backport the edition MCP tools ref and KAS OAuth pointers to 0.12.1 (batch 33) by @buluoray in #32229
• fix: 0.12.1 batch 36 - KAS unattended MCP wait, sign-in wording, withheld-env notice by @buluoray in #32349
• fix(kas): backport the KAS mcp.json parity fix to 0.12.1 (batch 38) by @buluoray in #32492
• fix: 0.12.1 batch 39 - Bolin queue picks and Slack-bound ledger fix by @buluoray in #32572
• fix: 0.12.1 batch 42 - seven fixes from Bolin's queue by @buluoray in #32613
• fix: 0.12.1 batch 41 - report a failed new-session create on the shell notice by @buluoray in #32581
• fix: backport 0.12.1 batch 43 (10 user-reported fixes) by @buluoray in #32641
• fix: backport 0.12.1 batch 44 (10 user-reported fixes) by @buluoray in #32647
• fix: backport #30781 to 0.12.1 (chat save drift is not a delete) by @buluoray in #32658
• fix: backport #30213 and #31102 to 0.12.1 (edit skill menu, sidebar colors) by @buluoray in #32664
• fix: backport 0.12.1 batch 45 (9 user-reported fixes) by @buluoray in #32653
• fix: backport #23603 to 0.12.1 (session-search scan window) by @buluoray in #32671
• fix: backport #26258 to 0.12.1 (artifact viewer 100vh runaway) by @buluoray in #32729
• fix: backport #30873 to 0.12.1 (meeting transcription socket rotation) by @buluoray in #32770
• fix: backport 0.12.1 wide batch 1 (14 user-facing fixes) by @buluoray in #32787
• fix: backport 0.12.1 batch 54 (10 user-reported fixes) by @buluoray in #32801
• fix: backport 0.12.1 batch 53 (9 user-reported fixes) by @buluoray in #32791
• fix: backport 0.12.1 wide batch 2 (8 user-facing fixes + 2 prerequisites) by @buluoray in #32808
• fix: backport #32498 to 0.12.1 (skip a repeated synthesis report) by @buluoray in #32835
• fix: backport 0.12.1 batch 58 (25 wide-bar fixes) by @buluoray in #32855
• fix: backport 0.12.1 batch 59 (25 wide-bar fixes) by @buluoray in #32856
• fix: backport 0.12.1 fast batch v1b-2 (22 user-facing fixes) by @buluoray in #32864
• fix: backport 0.12.1 steer batch (#32396 with its ordering fix #32826) by @buluoray in #32886
• fix: backport 0.12.1 batch 57 (23 wide-bar fixes) by @buluoray in #32851
• fix: backport #32387, #32434 and #32833 to 0.12.1 by @buluoray in #32823
• fix: backport 0.12.1 batch 60 (24 wide-bar fixes) by @buluoray in #32860
• fix: backport #32541 to 0.12.1 (keep the loop thread's stack in a stall dump) by @buluoray in #32887
• fix: backport 0.12.1 wide batch 3 (15 user-facing fixes) by @buluoray in #32836
• fix: backport 0.12.1 fast batch v1b-1 (23 user-facing fixes) by @buluoray in #32840
• fix(slack): 0.12.1 batch 40 - mid-turn link gets the turn's final answer (release-only hand port of #32336) by @buluoray in #32578
• fix: backport 0.12.1 batch 61 (25 wide-bar fixes) by @buluoray in #32888
• fix: backport #27535 and #32804 to 0.12.1 (keep an unreadable agent spec) by @buluoray in #32758
• fix: backport 0.12.1 batch 62 (10 wide-bar fixes) by @buluoray in #32891
• fix: backport 0.12.1 fast batch v1b-4 (11 user-facing fixes) by @buluoray in #32919
• fix: backport 0.12.1 fast batch v1b-3 (23 user-facing fixes) by @buluoray in #32894
• fix: backport 0.12.1 batch bolin-2 (11 user-facing fixes) by @buluoray in #32928
• fix: backport 0.12.1 wide batch 4 (15 user-facing fixes) by @buluoray in #32926
• fix: backport 0.12.1 batch 63 (6 docs/tests-co...

Bots (the new name for Mates) are now on for everyone, the agent can drive a browser you watch and take over live, and two more coding agents join the harness list. Connections, chat, the sidebar, schedules and apps pick up many small controls. Ultra Mode, Explore, Session Environments, Shared Crew and Remote dispatch arrive as previews you can switch on.

Bots for everyone

• Bots without a preview switch: Mates are now called Bots in every screen, prompt and language, the Bots row in the left rail, the /members page and the Bot rows in the command bar are always shown, and starred Bots gather in a Bots group in the rail that you can drag to reorder.
• A desk of its own: each Bot keeps the chats and folders it opens in one sidebar folder named after it, and works in its own git worktree per repository, so two Bots on one repo no longer commit each other's edits.
• Take a Bot with you: the Bot profile card's "Export as file" writes a .kirobot file with an editable lessons draft, and Bots > Import from file reads it back (older .crewjam and .crewmate files still import).

Bots that keep track of their work

• A ledger for handed-out work: a Bot that sends work to workers records each item in a work ledger, and its own chat gets an automatic patrol that watches it.
• Approvals in one place: a Bot's chat shows the approvals and questions from the sessions it started, and its roster row gets a badge.
• A catch-up that checks: when you return after about half an hour away, the card a Bot posts reads the live state of up to five pull requests its open questions name and lists them as pills.

A browser you can watch and take over

• Live view: when the agent uses the browser, the chat shows the page live in the transcript, and you can take it over at any time.
• Sign in without the agent seeing: a sign-in sheet types a secret into the page for you, and nothing typed is saved.
• Settings: Settings > Browser controls which browser is used, the live view and its quality, and recording, and the old browser tool is gone, while browser setup no longer fails on some Python installs.

More coding agents

• Strands: Settings > Agent Harness lists Strands once the Strands CLI is installed, its setup card stores the model provider keys in Settings > Secrets, and changing the model or effort in the picker relaunches it on the same session.
• GitHub Copilot CLI: pick it under Settings > Agent Harness (a session on any Copilot CLI release other than 1.0.100 is refused with the install command), and every harness's model picker now shows that backend's own model names.
• KAS on its own: choosing KAS uses your Kiro Crew sign-in, falls back to the account from kiro-cli login, and runs Kiro Crew's own engine when kiro-cli is missing, while /agent, /context, /help, /mcp, /model, /tools and /usage answer locally on the default KAS backend.

Connections and sign-ins

• Google Workspace: the Connections page adds Gmail, Google Drive, Calendar, Sheets, Docs and Slides entries that use your own Google OAuth app.
• Sign-ins that stay: on the default KAS backend, remote MCP sign-ins such as Atlassian, Notion and Figma are kept across sessions, and agent.kas_persist_mcp_sign_in turns that off.
• Start from a popular list: the Add Skill and Add Server dialogs open on a Popular list before you type a search.

Knowledge from your own AWS account

• Bedrock Knowledge Bases: under Capabilities > Knowledge > Sources, "Add Knowledge Base" registers an existing Amazon Bedrock Knowledge Base that is queried live and merged into knowledge search (each search is billed by AWS, only the gateway owner can add one, and it needs the optional bedrock extra).

Settings and themes

• Developer settings for everyone: Developer Mode is gone, so Settings > Developer always shows Feature Previews, Logs, System, Telemetry, Storage, Memory, Config, Debug tools and Archive, and Feature Previews switches are saved on the gateway, so they follow you to every browser and the desktop app, and MCP Management now sits below the MCP Servers list on the Connections page.
• Themes and thresholds: "👁 Color-blind safe" and "💜 Amethyst OLED" are under Settings > Display > Theme, and Settings > Chat > Advanced > Auto-compact threshold gains a Custom option for any percent from 5 to 90.
• Shorter Settings rows: each row keeps one short line about its effect in view and moves the longer explanation behind its info tip, and a section's introduction now sits in a tip beside its heading.

Chat you can handle more ways

• Take back a steer: a steer the running turn has not read yet can be unsent, edited in the message box or queued from its row's menu, on the Kiro CLI harness.
• Copy what you need: code blocks gain "Wrap lines", quotes gain "Copy quote", right-clicking an image offers "Copy image", and Settings > Chat > Transcript adds an opt-in "Copy on select".
• Attach and read more: iPhone HEIC photos attach from the composer and are converted to JPEG, a box you drag over an image in the file viewer can carry a comment, and "Jump to the bottom when you send" in Settings > Chat can be turned off.

Chat that reads and drives better

• Easier to read replies: rendered markdown spaces paragraphs, lists and sections more clearly and tables lose the grey header fill, all following the chat font size setting.
• Keys and slash helpers: Cmd+O (Ctrl+O on Windows and Linux) pops the current session out to its own window, Tab fills the message box with the first follow-up option, typing /workflow opens a menu of your saved workflows, Up-arrow recalls a prompt whose send never reached the transcript, and the dock terminal can search its scrollback and go fullscreen with Cmd+F on macOS and Ctrl+Shift+F on Linux and Windows.
• Session messages as cards: a message one session sends to another shows as a card naming the sender, with a link to open that session, and the sender's chat shows a "Sent to @name" card once the message is delivered.

A sidebar that sorts itself

• Session menu: every session row's menu adds "Copy session ID" and "Reference in chat", and once you have a folder, "Move to folder" ends with "New folder" to create and move in one step.
• Group and filter: the sidebar Filter menu adds "Group by kind" and a "Not in progress" row, and "Clean up sessions" adds 14 and 30 day windows.
• Color and tabs: a session's color now tints its chat header, the Categorical palette under Settings > Display > Sidebar gives twelve fixed hues, and session tabs drag to reorder.

Pick up where you left off

• Resume them all: while sessions are interrupted by a restart or sleep, the sidebar search dock shows "N interrupted sessions" with a "Resume N sessions" button.
• Pin a folder: a folder's header menu adds Pin folder, which keeps its sessions (subfolders included) listed under the status chips, tag chips and folder checkboxes.
• Start again from the first message: the session header menu's Initial prompt submenu shows and copies the first message, or drafts a new session from it on the same agent, project and folder.

Files and paths

• Upload to the Files panel: drag files onto the panel or use Upload files to add new files to the folder it shows, within the usual extension and size limits.
• Show hidden files: a toggle in the Files rail header lists dot-files such as .env, even when git ignores them, and remembers your choice in that browser.
• Relative paths work: paths in diffs, tool calls and replies open against the chat's project directory.

Notifications that reach you

• Push when closed: Settings > Notifications > Push notifications > "Notify me even when Kiro Crew is closed" delivers to an installed PWA, including iOS after Add to Home Screen.
• Your own sounds: Settings > Notifications > Custom sounds takes a short MP3, WAV or OGG file for any category.
• Missed approvals: an approval that expires unanswered leaves a bell note naming the tool, a chat that stops on an error you must act on leaves a "Chat errors" bell entry linking to it, and on phones the live banner swipes away.

Slack and other channels

• Slack code channels: with slack.code_channels on (it is off by default, and needs your workspace's Slack code channels feature, an updated app manifest and a reinstall), mentioning Kiro Crew in a thread with multi-step work opens a code channel backed by a dashboard session that you can stop with its button or !stop.
• Feishu commands: Feishu gains /stop (alias /cancel) and /help, like the other channels.
• Discord choices: pressing a long choice answers with its full text instead of the cut label.

Hooks and what agents can do

• Your hook files on KAS: the hook files in your Kiro hooks folder now run on KAS turns as they do on the Kiro CLI engine, a pre-tool hook that exits with 2 blocks the tool, and script hooks saved on the Hooks page also run on messaging channel turns and in 1:1 Slack DMs with the bot.
• Reveal a removed credential: when redaction removes a credential from a reply, the owner can Show, Copy or Hide it in the reply, and every reveal is audited.
• Refuse guessed writes: setting hooks.batch_write_guard refuses a write sent in the same parallel batch as a read, because its arguments would be guesses, and it is off by default.

Schedules and apps

• Quieter failures: the job dialog's "Send the failure message after N failures in a row" (and kirocrew cron add --alert-after N) rings only the bell for earlier failures, and a run the security gate partly refused shows "Partial" (creating a job over the REST API now keeps the limits you send).
• More ways to say when: one-shot times for kirocrew cron add --at accept days and weeks ("in 2 days", "in 1 week"), a cron job with no z...

What's Changed

• test(chat-sidebar): wrap reveal dispatches in act by @javenciu in #27118
• test(pr-quality): pin utf-8 on the test_pr_quality_gates subprocess call by @javenciu in #27094
• test(papyrus-gitops): pin utf-8 on test_papyrus_gitops subprocess calls by @javenciu in #27127
• test(side-panel): wrap dock reset in act for the bottom-dock case by @javenciu in #27144
• perf(crew): read a crewmate turn's managed roots once; wait after a discarded consolidation pass by @iamwhatever in #26986
• test(lightbox-copy): wrap failed copy in async act by @javenciu in #27139
• test(build-desktop): pin utf-8 on 1 subprocess call by @javenciu in #27132
• fix(dashboard): translate view switch labels and mark the active one by @RohanK6 in #27124
• test(chat-page): run the Cmd+F keypress in an async act by @javenciu in #27131
• fix(workflows): read a positional-only ctx and keyword phase titles by @RohanK6 in #27095
• feat(prepare-pr): let a maintainer re-arm green_age's re-sync budget by @tim-finnigan in #26944
• ci(runners): route the two ci.yml matrix Windows legs to the Windows group by @tim-finnigan in #26855
• ci(runners): give the Windows resolver the same group fallback as Linux by @tim-finnigan in #26828
• test(link): give weak tests real outcome checks by @iamwhatever in #26990
• fix(crew): wake a crewmate whose thread a restart left unloaded by @CrysisDeu in #26401
• test(chat-sidebar): wrap reveal dispatch in act by @javenciu in #27154
• test(knowledge-page): wrap search focus in act before escape by @javenciu in #27153
• ci: give backend-test 70 min off CodeBuild so four-wide fork shards finish by @chenmingwei23 in #26987
• fix(knowledge): show why list, tag and bulk actions failed by @RohanK6 in #27103
• build(deps): bump docker/login-action from 4.6.0 to 4.7.0 by @dependabot[bot] in #24489
• test(use-bottom-terminal): wrap store reset in act so late updates land by @javenciu in #27135
• feat(settings): type an exact auto-compact threshold under a Custom… option by @RohanK6 in #26545
• fix(dashboard): name a stopped turn's own opener in its restore by @javenciu in #19959
• fix(i18n): raise the i18next floor to 26.4.4 so an unclosed nesting marker cannot hang the tab by @JLargent42 in #22326
• fix(memory): match episode tags on their stored form, wildcards escaped by @RohanK6 in #27082
• test(whats-app-panel): settle held group save inside act by @javenciu in #27151
• fix(apps): convert HEIC and downscale images in app composer uploads by @RohanK6 in #27160
• test(markdown-panel): wait for the outline read after a decode by @javenciu in #27155
• test(artifact-detail-page): wait for copied state after copy click by @javenciu in #27169
• fix(md-notebook): pin utf-8 on the server subprocess call by @javenciu in #27136
• test(selection-toolbar): await copy click inside act by @javenciu in #27145
• build(deps): bump docker/setup-qemu-action from 4.3.0 to 4.4.0 by @dependabot[bot] in #24490
• feat(side-chat): say Refresh context clears the side chat in every tab by @unstablebrainiac in #24682
• fix(chat): give subagent card stat chips and state glyph spoken labels by @RohanK6 in #26509
• fix: keep the resized badge on files a failed embed send restores by @RohanK6 in #27185
• test(chat-sidebar): wrap folder reveal dispatches in act by @javenciu in #27198
• test(trust-app-modal): act-wrap enable click in the gate helper by @javenciu in #27192
• test(issue-radar-detail): settle stale copy inside act by @javenciu in #27194
• test(markdown-renderer): settle path probe and chip click in act by @javenciu in #27201
• test(kiro-prerequisite): pin utf-8 on 2 subprocess calls by @javenciu in #27174
• test(mochi-chat-panel): deliver test events inside act by @javenciu in #27175
• test(crew-companion): wrap settings focus in act before draft assertions by @javenciu in #27156
• test(pod-e2e): pin utf-8 on test_pod_e2e_harness_paths subprocess calls by @javenciu in #27168
• test(prepare-pr): pin utf-8 on 4 subprocess calls by @javenciu in #27142
• fix(dashboard): check paths in memory admin off the event loop by @javenciu in #27183
• test(markdown-renderer): wait for path copied label in menu by @javenciu in #27202
• test(installer-node): pin utf-8 on 2 subprocess calls by @javenciu in #27162
• test(markdown-renderer): wait for copy and chip state in session tests by @javenciu in #27189
• test(chat-pane): run the topInset renders inside async act by @javenciu in #27182
• test(chat-panel): wait for picker patch settle before ending by @javenciu in #27176
• test(xdist-host): pin utf-8 on test_xdist_host_budget subprocess call by @javenciu in #27157
• test(about-panel): wrap the gateway switch's status reset in act by @javenciu in #27208
• test(drawer-swipe): wrap shadow touch events in act by @javenciu in #27158
• test(use-optimistic-config-paths): act-wrap sibling save settles by @javenciu in #27161
• test(native-notification): wait for approval reconcile before asserting by @javenciu in #27181
• fix(telegram): take a GIF once instead of as animation and document by @RohanK6 in #27193
• test(prompts-tab): wait for create dialog close and row detail by @javenciu in #27170
• test(artifact-body): wrap retry and show clicks in act by @javenciu in #27165
• test(folder-panel): wait for the timeout notice before the retry sleep by @javenciu in #27188
• test(terminal-exit): act() around dial and panel store reset by @javenciu in #27225
• test(markdown-renderer): wrap the escape dispatch in act by @javenciu in #27217
• fix(discord): close with 4000 when reconnecting so resume works by @RohanK6 in #27167
• test(chat-sidebar): wrap reveal dispatches in act by @javenciu in #27233
• fix(dashboard): check paths in slack settings off the event loop by @javenciu in #27259
• fix(dev-fleet): stat paths in worktree ops off the event loop by @javenciu in #27244
• test(pipeline-view): act-wrap track width observer emit by @javenciu in #27234
• fix(cron): log a sandbox-masked history dir at DEBUG, not WARNING by @buluoray in #27215
• fix(autonudge): announce the next deadline and drop stale asks after a cycle (#26390) by @buluoray in #27227
• test(file-path-menu): wait for copy and act-wrap hand-off focus by @javenciu in #27213
• test(agent-session-resume): wrap openSession in act by @javenciu in #27209
• test(task-detail-panel): wait for save and act() around async saves by @javenciu in #27204
• test(agent-home): pin utf-8 on test_agent_home_isolation subprocess call by @javenciu in #27184
• fix(subagent): leave a shutdown-ended pending recovery for the next start (#25403) by @buluoray in #27235
• chore(version): move main to 0.13.0 now that release/0.12.0 is cut by @bolichen97 in #27166
• test(crew-companion-panel): run the self-mount and its callbacks in act by @javenciu in #27...

What's Changed

• chore(release): forward-port the 0.11.2 fixes to release/0.12.0 by @buluoray in #29148
• chore(release): bump release/0.12.0 to 0.12.0-rc.6 by @buluoray in #29151
• fix(config): treat a non-object agent section as malformed (#28885) by @buluoray in #29152
• fix(release): forward-port store data-loss fixes to 0.12 by @buluoray in #29384
• fix(release): forward-port the 30s initialize cold-start floor to 0.12 by @buluoray in #29413
• feat: carry a crewmate's template policy onto its worker (#28501) by @buluoray in #29378
• fix(release): forward-port #29262 and #28798 to 0.12 by @buluoray in #29363

Full Changelog: v0.12.0-rc.5...v0.12.0-rc.6

A hot patch for 0.11.1: the KAS engine starts and signs in to your MCP servers the way kiro-cli does, a broken MCP settings file is never overwritten, and a handful of Windows and start-up fixes land.

Notable fixes

KAS and MCP servers. MCP servers that need environment values or remote headers start and connect on KAS, Crew's own servers start first so a session no longer waits behind a slow one, and builtin app servers get the session identity they need. A remote MCP sign-in is kept across sessions by default and is offered only when you name the server. Leftover launch files from a closed session are removed when it shuts down.

KAS agent specs. Allowed shell commands written with character classes, groups or quoted parentheses match the way kiro-cli matches them, a long rule is split instead of refused, and use_subagent mounts the engine's sub-agent tool. Spec hooks see KIRO_SESSION_ID as they do on kiro-cli, a stored model id reaches the engine in its own spelling, and a web search through the engine's remote tool is judged as the built-in it is.

MCP settings and start-up. A global mcp.json that does not parse is refused instead of replaced, and one that is not UTF-8 is skipped without hiding every other server. An absolute Windows command ending in .EXE starts again, MCP start-up survives a home folder on a masked mount, and kirocrew kas remove with a blank version refuses instead of removing every engine.

What's Changed

• chore(release): backport the 0.11.2 hotfix fixes to release/0.11.0 by @buluoray in #28835
• chore(release): start the 0.11.2 hotfix line (0.11.2-rc.1 and its CHANGELOG) by @buluoray in #29135
• chore(release): drop 0.11.2-rc.1 to bare 0.11.2 by @buluoray in #29233
• ci: give the 0.11 stable gate a blobless checkout and 20 minutes by @buluoray in #29325
• fix(security): accept Salesforce client ids at operator-listed OAuth endpoints (#29262) by @buluoray in #29373
• build(docker): install kiro-cli from the shared pin files, not the latest manifest (#25616) by @buluoray in #29340
• fix(mcp-gateway): backport crewmate broker overlay routing to 0.11 (#23820, #28798) by @buluoray in #29383

Full Changelog: v0.11.1...v0.11.2

What's Changed

• chore(release): backport the 0.11.2 hotfix fixes to release/0.11.0 by @buluoray in #28835
• chore(release): start the 0.11.2 hotfix line (0.11.2-rc.1 and its CHANGELOG) by @buluoray in #29135
• chore(release): drop 0.11.2-rc.1 to bare 0.11.2 by @buluoray in #29233
• ci: give the 0.11 stable gate a blobless checkout and 20 minutes by @buluoray in #29325
• fix(security): accept Salesforce client ids at operator-listed OAuth endpoints (#29262) by @buluoray in #29373
• build(docker): install kiro-cli from the shared pin files, not the latest manifest (#25616) by @buluoray in #29340
• fix(mcp-gateway): backport crewmate broker overlay routing to 0.11 (#23820, #28798) by @buluoray in #29383

Full Changelog: v0.11.1...v0.11.2-rc.4