@chorus-aidlc/chorus 0.13.2 → 0.14.1

package/cli/codex-session-map.mjs

@@ -5,60 +5,18 @@
 // keyed by the Chorus session anchor (direct idea uuid, or the entity uuid for an
 // ad-hoc session) and `codex exec resume <thread_id>` on the next wake.
 //
-// The store is a single JSON object `{ "<anchor>": "<thread_id>" }` at
-// ~/.chorus/codex-sessions.json (same dir family as daemon.json). The anchor is a
-// globally-unique Chorus uuid, so one flat file is safe across the daemon's
-// multiple path-connections.
-//
-// CONTRACT: this is best-effort and MUST NEVER throw into the wake path. Any
-// read/parse/write/rename failure degrades to "no mapping → next wake starts
-// fresh" with a visible log (no-silent-errors). IO is injectable for tests.
+// Thin wrapper over the generic `createSessionMap` factory (shared with the Kiro
+// backend); the store is ~/.chorus/codex-sessions.json. The public API
+// (getThreadId / setThreadId / codexSessionMapPath) and its injectable-IO deps are
+// unchanged — see session-map.mjs for the best-effort / never-throw contract.
 
-import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { dirname, join } from "node:path";
+import { createSessionMap } from "./session-map.mjs";
 
-const NOOP_LOGGER = { info() {}, warn() {}, error() {} };
+const map = createSessionMap({ filename: "codex-sessions.json", logPrefix: "codex-session-map" });
 
 /** Absolute path to the Codex session-id map, alongside ~/.chorus/daemon.json. */
 export function codexSessionMapPath() {
-  return join(homedir(), ".chorus", "codex-sessions.json");
-}
-
-/** A non-empty trimmed string, or null. */
-function nonEmpty(value) {
-  return typeof value === "string" && value.trim().length > 0 ? value : null;
-}
-
-/**
- * Read the whole map as a plain object. Missing / unreadable / malformed file →
- * `{}` (never throws). A non-object JSON value (array / scalar) is also treated
- * as empty.
- * @param {string} path
- * @param {(p: string) => string} read
- * @param {{warn(m:string):void}} logger
- * @returns {Record<string, unknown>}
- */
-function readMap(path, read, logger) {
-  let raw;
-  try {
-    raw = read(path);
-  } catch (err) {
-    // ENOENT is the normal "no map yet" case — silent. Other read errors warn.
-    if (!(err && err.code === "ENOENT")) {
-      logger.warn(`[Chorus] codex-session-map: read failed (${err}) — treating as empty`);
-    }
-    return {};
-  }
-  try {
-    const parsed = JSON.parse(raw);
-    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) return parsed;
-    logger.warn("[Chorus] codex-session-map: file is not a JSON object — treating as empty");
-    return {};
-  } catch (err) {
-    logger.warn(`[Chorus] codex-session-map: corrupt JSON (${err}) — treating as empty`);
-    return {};
-  }
+  return map.mapPath();
 }
 
 /**
@@ -69,13 +27,7 @@ function readMap(path, read, logger) {
  * @returns {string | null}
  */
 export function getThreadId(anchor, deps = {}) {
-  const a = nonEmpty(anchor);
-  if (!a) return null;
-  const path = deps.path ?? codexSessionMapPath();
-  const read = deps.read ?? ((p) => readFileSync(p, "utf8"));
-  const logger = deps.logger ?? NOOP_LOGGER;
-  const map = readMap(path, read, logger);
-  return nonEmpty(map[a]);
+  return map.get(anchor, deps);
 }
 
 /**
@@ -91,27 +43,5 @@ export function getThreadId(anchor, deps = {}) {
  * @returns {void}
  */
 export function setThreadId(anchor, threadId, deps = {}) {
-  const a = nonEmpty(anchor);
-  const t = nonEmpty(threadId);
-  if (!a || !t) return; // nothing meaningful to persist
-  const path = deps.path ?? codexSessionMapPath();
-  const read = deps.read ?? ((p) => readFileSync(p, "utf8"));
-  const write = deps.write ?? writeFileSync;
-  const mkdir = deps.mkdir ?? mkdirSync;
-  const rename = deps.rename ?? renameSync;
-  const logger = deps.logger ?? NOOP_LOGGER;
-
-  try {
-    const map = readMap(path, read, logger);
-    map[a] = t;
-    mkdir(dirname(path), { recursive: true });
-    // Atomic write: temp file (0600) in the same dir, then rename over target,
-    // so a crash mid-write never truncates the live map.
-    const tmp = `${path}.tmp`;
-    write(tmp, JSON.stringify(map, null, 2) + "\n", { mode: 0o600 });
-    rename(tmp, path);
-  } catch (err) {
-    // Best-effort: a failed persist just means the next wake starts fresh.
-    logger.warn(`[Chorus] codex-session-map: failed to persist ${a}→${t} (${err}) — wake will start fresh next time`);
-  }
+  map.set(anchor, threadId, deps);
 }

package/cli/daemon-agent.mjs

@@ -1,12 +1,14 @@
 // cli/daemon-agent.mjs
 // Pure resolution + validation of the daemon's `--agent <type>` selection.
-// `claude-code` (the default) and `codex` are both implemented backends
-// (add-daemon-codex-backend cashed in the reserved `codex` slot). Resolving an
-// unknown value is a hard error (no silent fallback). Zero dependencies.
+// `claude-code` (the default), `codex`, and `kiro` are all implemented backends
+// (add-daemon-codex-backend cashed in the reserved `codex` slot;
+// add-daemon-kiro-backend adds `kiro`). Resolving an unknown value is a hard
+// error (no silent fallback). Zero dependencies.
 
-/** The agent backends the daemon recognizes. Both are implemented (claude-code
- * via ClaudeSpawner, codex via CodexSpawner — see spawner-select.mjs). */
-export const KNOWN_AGENTS = ["claude-code", "codex"];
+/** The agent backends the daemon recognizes. All are implemented (claude-code
+ * via ClaudeSpawner, codex via CodexSpawner, kiro via KiroSpawner — see
+ * spawner-select.mjs). */
+export const KNOWN_AGENTS = ["claude-code", "codex", "kiro"];
 
 /** The default agent backend when neither --agent nor CHORUS_AGENT is set. */
 export const DEFAULT_AGENT = "claude-code";
@@ -21,6 +23,7 @@ export const DEFAULT_AGENT = "claude-code";
  */
 export function backendCli(agentType) {
   if (agentType === "codex") return { name: "codex", envVar: "CHORUS_CODEX_PATH" };
+  if (agentType === "kiro") return { name: "kiro-cli", envVar: "CHORUS_KIRO_PATH" };
   return { name: "claude", envVar: "CHORUS_CLAUDE_PATH" };
 }
 
@@ -33,7 +36,9 @@ export function backendCli(agentType) {
  * @returns {string}
  */
 export function backendClientType(agentType) {
-  return agentType === "codex" ? "codex" : "claude_code";
+  if (agentType === "codex") return "codex";
+  if (agentType === "kiro") return "kiro";
+  return "claude_code";
 }
 
 /**

package/cli/daemon-config.mjs

@@ -107,7 +107,7 @@ export function resolveSigintTimeoutMs(flags = {}, deps = {}) {
 // The Waker/SseListener treat an `undefined` entry as "use process.cwd()".
 
 /** Expand a leading `~` to the home dir and resolve to an absolute path. */
-function normalizeCwd(value, home) {
+export function normalizeCwd(value, home) {
   if (typeof value !== "string") return undefined;
   const trimmed = value.trim();
   if (!trimmed) return undefined;
@@ -125,7 +125,7 @@ function normalizeCwd(value, home) {
  * @param {Array<unknown>} list @param {string} home
  * @returns {string[]}
  */
-function cleanCwdList(list, home) {
+export function cleanCwdList(list, home) {
   const seen = new Set();
   const out = [];
   for (const raw of Array.isArray(list) ? list : []) {

package/cli/daemon-install-config.mjs

@@ -0,0 +1,213 @@
+// cli/daemon-install-config.mjs
+// The `chorus daemon install` pre-install config phase (fix-daemon-install-config,
+// idea d7592c96). Two pure, dependency-injected helpers that run BEFORE the
+// service unit is written, so a boot-time daemon in systemd/launchd's CLEAN
+// environment can always authenticate and knows which working directories to
+// serve:
+//
+//   resolveInstallCredentials — resolve (flags>env>daemon.json>plugin) → persist
+//     into ~/.chorus/daemon.json → validate against the server → abort (write
+//     nothing) if creds cannot be obtained or the key is invalid. This is the
+//     crux of the fix: a systemd --user unit does NOT inherit the operator's
+//     shell-exported CHORUS_URL/CHORUS_API_KEY, so the creds must live in the
+//     0600 login file the clean boot env reads.
+//
+//   resolveInstallCwds — determine the served working-directory set and persist
+//     it to daemon.json `cwds` (the single source of truth; the unit carries no
+//     --cwd — see cli/daemon-service.mjs buildServiceArgs). Prompts an interactive
+//     add-loop only when nothing is configured and stdin is a TTY.
+//
+// All IO (resolve / validate / persist / prompt / readJson / env / cwd) is
+// injected so the helpers unit-test without real disk, network, or TTY — matching
+// the style of cli/credentials.mjs and cli/daemon-config.mjs.
+
+import { homedir } from "node:os";
+import { resolveCredentials, loginFilePath } from "./credentials.mjs";
+import { updateDaemonConfig, prompt as defaultPrompt } from "./login.mjs";
+import { validateAndFetchIdentity } from "./chorus-client.mjs";
+import { normalizeCwd, cleanCwdList } from "./daemon-config.mjs";
+import { readFileSync } from "node:fs";
+
+/** A non-empty trimmed string, or undefined. */
+function nonEmpty(value) {
+  if (typeof value !== "string") return undefined;
+  const t = value.trim();
+  return t.length > 0 ? t : undefined;
+}
+
+/** Read a JSON file, returning null on any error. Mirrors credentials.mjs. */
+function readJsonSafe(path) {
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    return parsed && typeof parsed === "object" ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Credential preflight for `chorus daemon install`. Resolves credentials, persists
+ * them (with the fetched identity) into ~/.chorus/daemon.json, and validates the
+ * key against the server — all BEFORE the caller writes any service unit.
+ *
+ * Returns `{ ok: true, creds, identity }` on success, or `{ ok: false }` when the
+ * install must abort (no unit should be written). Never throws.
+ *
+ * Behavior (elaboration Q1/Q2/Q8/Q9):
+ *   - Resolve via resolveCredentials (flags > env > daemon.json > plugin).
+ *   - Unresolved + TTY + !skip → prompt login-style (masked key).
+ *   - Unresolved + (skip || !TTY) → abort with the multi-source hint (no prompt).
+ *   - ALWAYS validate the resolved/entered key; abort on failure.
+ *   - On success persist { url, apiKey, agentUuid, agentName } via the 0600
+ *     field-merge writer (preserves cwds / yoloAckAt / sigintTimeoutMs).
+ *
+ * @param {{ url?: string, apiKey?: string }} flags
+ * @param {Record<string,string|undefined>} env
+ * @param {{
+ *   isTTY?: boolean, skip?: boolean,
+ *   resolve?: typeof resolveCredentials,
+ *   validate?: typeof validateAndFetchIdentity,
+ *   writeConfig?: (partial: Record<string, unknown>) => string,
+ *   prompt?: typeof defaultPrompt,
+ *   log?: (m: string) => void,
+ *   errLog?: (m: string) => void,
+ * }} [opts]
+ * @returns {Promise<{ ok: true, creds: {url:string,apiKey:string}, identity: {uuid:string,name:string} } | { ok: false }>}
+ */
+export async function resolveInstallCredentials(flags = {}, env = {}, opts = {}) {
+  const isTTY = opts.isTTY ?? false;
+  const skip = opts.skip ?? false;
+  const resolve = opts.resolve ?? resolveCredentials;
+  const validate = opts.validate ?? validateAndFetchIdentity;
+  const writeConfig = opts.writeConfig ?? updateDaemonConfig;
+  const ask = opts.prompt ?? defaultPrompt;
+  const log = opts.log ?? (() => {});
+  const errLog = opts.errLog ?? (() => {});
+
+  let url;
+  let apiKey;
+
+  // 1. Try the layered resolver. It THROWS (does not return null) when no source
+  //    yields a complete pair — catch it and decide prompt vs abort.
+  try {
+    const resolved = resolve(flags, { env });
+    url = resolved.url;
+    apiKey = resolved.apiKey;
+    log(`[Chorus] credentials resolved from: ${resolved.source}`);
+  } catch (err) {
+    const hint = err instanceof Error ? err.message : String(err);
+    if (!isTTY || skip) {
+      // No way (or no permission) to prompt — abort with the actionable hint
+      // rather than writing a unit that would crash-loop at boot.
+      errLog(hint);
+      return { ok: false };
+    }
+    // TTY + interactive: complete credentials login-style (masked key).
+    log("[Chorus] no credentials found — configuring them now (saved for the boot service).");
+    url = nonEmpty(await ask("Chorus URL: "));
+    apiKey = nonEmpty(await ask("Chorus API key (cho_...): ", { mask: true }));
+    if (!url || !apiKey) {
+      errLog("[Chorus] both a URL and an API key are required — aborting install.");
+      return { ok: false };
+    }
+  }
+
+  // 2. ALWAYS validate against the server before writing anything (Q2/Q9) — even
+  //    in skip mode. A bad/expired key fails the install instead of at boot.
+  let identity;
+  try {
+    identity = await validate({ url, apiKey });
+  } catch (err) {
+    errLog(`[Chorus] credential validation failed: ${err instanceof Error ? err.message : String(err)}`);
+    errLog("[Chorus] credentials were NOT saved and no service was installed.");
+    return { ok: false };
+  }
+
+  // 3. Persist into the 0600 login file so the clean boot env can read it. The
+  //    field-merge writer preserves cwds / yoloAckAt / sigintTimeoutMs.
+  writeConfig({ url, apiKey, agentUuid: identity.uuid, agentName: identity.name });
+  log(`[Chorus] credentials saved for ${identity.name} (${identity.uuid}).`);
+  return { ok: true, creds: { url, apiKey }, identity };
+}
+
+/**
+ * Determine the set of working directories the daemon serves and persist it to
+ * ~/.chorus/daemon.json `cwds` (the single source of truth — the unit carries no
+ * --cwd). Prompts an interactive add-loop only when nothing is configured and
+ * stdin is a TTY (and skip is false).
+ *
+ * "Configured" ⇔ a `--cwd` flag was passed OR daemon.json already has a non-empty
+ * `cwds` array. Configured, or skip/non-TTY, uses that set (or the process cwd
+ * default) with no prompt.
+ *
+ * Returns `{ cwds: string[] }` — the normalized, de-duplicated set that was
+ * persisted. Never throws.
+ *
+ * @param {{ cwd?: string[] }} flags
+ * @param {{
+ *   isTTY?: boolean, skip?: boolean,
+ *   readJson?: (path: string) => (Record<string, unknown>|null),
+ *   loginPath?: string,
+ *   writeConfig?: (partial: Record<string, unknown>) => string,
+ *   prompt?: typeof defaultPrompt,
+ *   home?: string,
+ *   processCwd?: string,
+ *   log?: (m: string) => void,
+ * }} [opts]
+ * @returns {Promise<{ cwds: string[] }>}
+ */
+export async function resolveInstallCwds(flags = {}, opts = {}) {
+  const isTTY = opts.isTTY ?? false;
+  const skip = opts.skip ?? false;
+  const readJson = opts.readJson ?? readJsonSafe;
+  const loginPath = opts.loginPath ?? loginFilePath();
+  const writeConfig = opts.writeConfig ?? updateDaemonConfig;
+  const ask = opts.prompt ?? defaultPrompt;
+  const home = opts.home ?? homedir();
+  const processCwd = opts.processCwd ?? process.cwd();
+  const log = opts.log ?? (() => {});
+
+  // 1. Explicit --cwd flag(s) → configured; normalize + dedup, no prompt.
+  const flagList = Array.isArray(flags.cwd) ? flags.cwd : typeof flags.cwd === "string" ? [flags.cwd] : [];
+  const fromFlags = cleanCwdList(flagList, home);
+  if (fromFlags.length > 0) {
+    writeConfig({ cwds: fromFlags });
+    return { cwds: fromFlags };
+  }
+
+  // 2. Existing daemon.json `cwds` → configured; use as-is (re-persist is a no-op
+  //    merge, so we skip the write and just return them).
+  const file = readJson(loginPath);
+  const fromFile = file && Array.isArray(file.cwds) ? cleanCwdList(file.cwds, home) : [];
+  if (fromFile.length > 0) {
+    return { cwds: fromFile };
+  }
+
+  // 3. Unconfigured. On a non-TTY or in skip mode, fall back to the process cwd
+  //    default with no prompt.
+  const defaultCwd = normalizeCwd(processCwd, home);
+  if (!isTTY || skip) {
+    const cwds = defaultCwd ? [defaultCwd] : [];
+    if (cwds.length > 0) writeConfig({ cwds });
+    return { cwds };
+  }
+
+  // 4. Unconfigured + TTY + !skip → interactive add-loop. Pre-seed the current
+  //    directory as the suggested first entry (Enter accepts it), then keep
+  //    prompting until a blank line ends the loop.
+  const collected = [];
+  log(`[Chorus] Configure the working directories this daemon serves.`);
+  const first = nonEmpty(await ask(`Working directory [${defaultCwd}] (Enter to accept the default): `));
+  collected.push(first ?? defaultCwd);
+  // subsequent adds
+  // eslint-disable-next-line no-constant-condition
+  while (true) {
+    const next = nonEmpty(await ask("Add another working directory (blank to finish): "));
+    if (!next) break;
+    collected.push(next);
+  }
+  const cwds = cleanCwdList(collected, home);
+  const finalCwds = cwds.length > 0 ? cwds : defaultCwd ? [defaultCwd] : [];
+  if (finalCwds.length > 0) writeConfig({ cwds: finalCwds });
+  return { cwds: finalCwds };
+}

package/cli/daemon-service.mjs

@@ -70,17 +70,22 @@ export function resolveScriptPath() {
 
 /**
  * Build the argv the SUPERVISED daemon runs — the normal long-lived daemon
- * (NO `-d`: the supervisor owns the foreground process). Reflects the flags the
- * operator passed to `install` so the boot-time daemon serves the same paths /
- * agent / permission posture. Pure.
+ * (NO `-d`: the supervisor owns the foreground process). Reflects the `--agent`
+ * / `--chorus-only` posture the operator passed to `install`. The served cwd set
+ * is NOT embedded here — it lives in ~/.chorus/daemon.json `cwds` (single source
+ * of truth) and is read by the daemon via resolveDaemonCwds. Pure.
  * @param {{ cwds?: string[], agent?: string, chorusOnly?: boolean, scriptPath: string }} spec
- * @returns {string[]}  e.g. ["/x/chorus.mjs","daemon","--cwd","/a","--cwd","/b"]
+ * @returns {string[]}  e.g. ["/x/chorus.mjs","daemon","--agent","codex"]
  */
 export function buildServiceArgs(spec) {
   const args = [spec.scriptPath, "daemon"];
-  for (const cwd of spec.cwds ?? []) {
-    if (typeof cwd === "string" && cwd) args.push("--cwd", cwd);
-  }
+  // NOTE: --cwd is deliberately NOT emitted. The set of working directories the
+  // daemon serves is persisted to ~/.chorus/daemon.json `cwds` at install time
+  // (the single source of truth) and read back by the daemon via
+  // resolveDaemonCwds. Baking --cwd into the unit too would let the two sources
+  // drift and would hide the paths from a plain `chorus daemon` run
+  // (fix-daemon-install-config, elaboration Q5-A). `spec.cwds` is still accepted
+  // for signature compatibility but ignored here.
   if (spec.agent) args.push("--agent", spec.agent);
   if (spec.chorusOnly) args.push("--chorus-only");
   return args;

package/cli/daemon.mjs

@@ -13,7 +13,11 @@
 // observability idea.
 
 import { resolveCredentials, loginFilePath } from "./credentials.mjs";
-import { prompt, writeLoginFile } from "./login.mjs";
+import { prompt, writeLoginFile, updateDaemonConfig } from "./login.mjs";
+import {
+  resolveInstallCredentials,
+  resolveInstallCwds,
+} from "./daemon-install-config.mjs";
 import {
   resolvePermissionMode,
   yoloWarningLine,
@@ -29,6 +33,7 @@ import { Waker } from "./waker.mjs";
 import { LineageResolver } from "./lineage.mjs";
 import { resolveClaudePath } from "./claude-spawner.mjs";
 import { resolveCodexPath } from "./codex-spawner.mjs";
+import { resolveKiroPath } from "./kiro-spawner.mjs";
 import { selectSpawner } from "./spawner-select.mjs";
 import {
   createExecutionUploadHooks,
@@ -484,6 +489,7 @@ export async function runDaemon(flags = {}, deps = {}) {
   // banner shows the right binary instead of always probing for `claude`.
   const findClaude = deps.resolveClaudePath ?? resolveClaudePath;
   const findCodex = deps.resolveCodexPath ?? resolveCodexPath;
+  const findKiro = deps.resolveKiroPath ?? resolveKiroPath;
   const verbose = flags.verbose === true || env.CHORUS_VERBOSE === "1";
 
   // Resolve the agent backend (default claude-code). An unknown --agent /
@@ -520,7 +526,14 @@ export async function runDaemon(flags = {}, deps = {}) {
   // The preflight dep bundle — built from the same seams runDaemon resolved, so
   // the detach/restart paths run the SAME (injectable) preflight, not the real
   // implementations. Threaded into startDetached so tests can drive it offline.
-  const pfDeps = { flags, env, isTTY, resolve, validate, writeCreds, askPrompt, log, errLog };
+  // writeConfig / readJson / loginPath are optional injectable IO used by the
+  // `install` config phase — default (undefined) means the real 0600 login file.
+  const pfDeps = {
+    flags, env, isTTY, resolve, validate, writeCreds, askPrompt, log, errLog,
+    writeConfig: deps.writeConfig,
+    readJson: deps.readJson,
+    loginPath: deps.loginPath,
+  };
 
   const action = flags.action ?? "run";
   if (action !== "run") {
@@ -557,10 +570,12 @@ export async function runDaemon(flags = {}, deps = {}) {
 
   // Detect the SELECTED backend's executable (non-fatal): the daemon still
   // subscribes when it's missing; a wake surfaces the error visibly when one
-  // arrives. The resolved path (or absence) is shown in the banner below. codex
-  // → resolveCodexPath, otherwise resolveClaudePath — so a `--agent codex` run
-  // probes (and the banner reports) `codex`, not `claude`.
-  const cliPath = agentType === "codex" ? findCodex() : findClaude();
+  // arrives. The resolved path (or absence) is shown in the banner below. Each
+  // backend probes its own binary — codex → resolveCodexPath, kiro →
+  // resolveKiroPath, otherwise resolveClaudePath — so a `--agent kiro` run probes
+  // (and the banner reports) `kiro-cli`, not `claude`.
+  const cliPath =
+    agentType === "codex" ? findCodex() : agentType === "kiro" ? findKiro() : findClaude();
 
   // The daemon.json the layered config readers (credentials, sigint timeout, cwds)
   // consult. Surfacing its absolute path + presence in the banner makes it obvious
@@ -742,11 +757,55 @@ export async function handleLifecycleAction(action, { log, errLog, lifecycle, se
   const svc = service ?? { detectSupervisor: () => ({ kind: "none" }) };
 
   if (action === "install") {
+    // Pre-install config phase (fix-daemon-install-config): BEFORE writing any
+    // unit, guarantee the clean-env boot service can authenticate and knows which
+    // cwds to serve. --yes/-y OR a non-TTY suppress prompts; neither suppresses
+    // the resolve/persist/validate/abort guarantee.
+    const flags = pfDeps?.flags ?? {};
+    const env = pfDeps?.env ?? {};
+    const isTTY = pfDeps?.isTTY ?? false;
+    const skip = flags.yes === true || !isTTY;
+    const installCfg = svc.installConfig ?? {
+      resolveInstallCredentials,
+      resolveInstallCwds,
+    };
+
+    const credResult = await installCfg.resolveInstallCredentials(flags, env, {
+      isTTY,
+      skip,
+      resolve: pfDeps?.resolve,
+      validate: pfDeps?.validate,
+      writeConfig: pfDeps?.writeConfig ?? updateDaemonConfig,
+      prompt: pfDeps?.askPrompt,
+      log,
+      errLog,
+    });
+    if (!credResult.ok) {
+      // Credentials could not be obtained / validated — never install a service
+      // that would fail to authenticate and crash-loop at boot.
+      errLog("[Chorus] install aborted — no service was written.");
+      return 1;
+    }
+
+    // Configure + persist the served cwd set (single source of truth in
+    // daemon.json; the unit carries no --cwd). Never blocks on a non-TTY.
+    // readJson / loginPath are optional injectable seams (default to the real
+    // login file) so the config phase can be exercised hermetically in tests.
+    await installCfg.resolveInstallCwds(flags, {
+      isTTY,
+      skip,
+      writeConfig: pfDeps?.writeConfig ?? updateDaemonConfig,
+      readJson: pfDeps?.readJson,
+      loginPath: pfDeps?.loginPath,
+      prompt: pfDeps?.askPrompt,
+      log,
+    });
+
     const spec = {
       ...svc.resolveServicePaths(),
-      cwds: pfDeps?.flags?.cwd ?? [],
-      agent: pfDeps?.flags?.agent,
-      chorusOnly: pfDeps?.flags?.chorusOnly === true,
+      cwds: flags.cwd ?? [],
+      agent: flags.agent,
+      chorusOnly: flags.chorusOnly === true,
       workingDir: process.cwd(),
     };
     const r = svc.installService(spec);

package/cli/kiro-session-map.mjs

@@ -0,0 +1,49 @@
+// cli/kiro-session-map.mjs
+// Daemon-local persistence of the Kiro `anchor → sessionId` map. Kiro GENERATES
+// its own per-cwd conversation sessionId (unlike Claude, which accepts a
+// client-supplied --session-id), and the daemon works one repo cwd shared by many
+// ideas — so Kiro's native "resume most recent conversation from this directory"
+// would cross-contaminate ideas. Instead we record the generated sessionId keyed
+// by the Chorus session anchor (direct idea uuid, or the entity uuid for an ad-hoc
+// session) and `kiro-cli chat --no-interactive --resume-id <sessionId>` on the
+// next wake for that anchor.
+//
+// Thin wrapper over the generic `createSessionMap` factory (shared with the Codex
+// backend); the store is ~/.chorus/kiro-sessions.json. See session-map.mjs for the
+// best-effort / never-throw contract and the injectable-IO deps.
+
+import { createSessionMap } from "./session-map.mjs";
+
+const map = createSessionMap({ filename: "kiro-sessions.json", logPrefix: "kiro-session-map" });
+
+/** Absolute path to the Kiro session-id map, alongside ~/.chorus/daemon.json. */
+export function kiroSessionMapPath() {
+  return map.mapPath();
+}
+
+/**
+ * Look up the Kiro sessionId recorded for `anchor`, or null when there is none
+ * (no file, no entry, or a non-string entry). Never throws.
+ * @param {string} anchor
+ * @param {{ path?: string, read?: (p: string) => string, logger?: any }} [deps]
+ * @returns {string | null}
+ */
+export function getSessionId(anchor, deps = {}) {
+  return map.get(anchor, deps);
+}
+
+/**
+ * Record `anchor → sessionId`, preserving every other entry. Atomic (temp file +
+ * rename). Best-effort: a blank anchor/sessionId is ignored (no write), and any
+ * IO failure is logged and swallowed — it never throws into the wake path.
+ * @param {string} anchor
+ * @param {string} sessionId
+ * @param {{ path?: string, read?: (p: string) => string,
+ *           write?: (p: string, c: string, o?: object) => void,
+ *           mkdir?: (p: string, o?: object) => void,
+ *           rename?: (from: string, to: string) => void, logger?: any }} [deps]
+ * @returns {void}
+ */
+export function setSessionId(anchor, sessionId, deps = {}) {
+  map.set(anchor, sessionId, deps);
+}