@every-env/compound-plugin 0.8.0 → 0.9.0

package/CHANGELOG.md

@@ -5,6 +5,14 @@ All notable changes to the `@every-env/compound-plugin` CLI tool will be documen
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.9.0] - 2026-02-17
+
+### Added
+
+- **Kiro CLI target** — `--to kiro` converts plugins to `.kiro/` format with custom agent JSON configs, prompt files, skills, steering files, and `mcp.json`. Only stdio MCP servers are supported ([#196](https://github.com/EveryInc/compound-engineering-plugin/pull/196)) — thanks [@krthr](https://github.com/krthr)!
+
+---
+
 ## [0.8.0] - 2026-02-17
 
 ### Added

package/README.md

@@ -18,9 +18,9 @@ A Claude Code plugin marketplace featuring the **Compound Engineering Plugin**
 /add-plugin compound-engineering
 ```
 
-## OpenCode, Codex, Droid, Pi, Gemini & GitHub Copilot (experimental) Install
+## OpenCode, Codex, Droid, Pi, Gemini, Copilot & Kiro (experimental) Install
 
-This repo includes a Bun/TypeScript CLI that converts Claude Code plugins to OpenCode, Codex, Factory Droid, Pi, Gemini CLI and GitHub Copilot.
+This repo includes a Bun/TypeScript CLI that converts Claude Code plugins to OpenCode, Codex, Factory Droid, Pi, Gemini CLI, GitHub Copilot, and Kiro CLI.
 
 ```bash
 # convert the compound-engineering plugin into OpenCode format
@@ -40,6 +40,9 @@ bunx @every-env/compound-plugin install compound-engineering --to gemini
 
 # convert to GitHub Copilot format
 bunx @every-env/compound-plugin install compound-engineering --to copilot
+
+# convert to Kiro CLI format
+bunx @every-env/compound-plugin install compound-engineering --to kiro
 ```
 
 Local dev:
@@ -54,6 +57,7 @@ Droid output is written to `~/.factory/` with commands, droids (agents), and ski
 Pi output is written to `~/.pi/agent/` by default with prompts, skills, extensions, and `compound-engineering/mcporter.json` for MCPorter interoperability.
 Gemini output is written to `.gemini/` with skills (from agents), commands (`.toml`), and `settings.json` (MCP servers). Namespaced commands create directory structure (`workflows:plan` → `commands/workflows/plan.toml`). Skills use the identical SKILL.md standard and pass through unchanged.
 Copilot output is written to `.github/` with agents (`.agent.md`), skills (`SKILL.md`), and `copilot-mcp-config.json`. Agents get Copilot frontmatter (`description`, `tools: ["*"]`, `infer: true`), commands are converted to agent skills, and MCP server env vars are prefixed with `COPILOT_MCP_`.
+Kiro output is written to `.kiro/` with custom agents (`.json` configs + prompt `.md` files), skills (from commands), pass-through skills, steering files (from CLAUDE.md), and `mcp.json`. Agents get `includeMcpJson: true` for MCP server access. Only stdio MCP servers are supported (HTTP servers are skipped with a warning).
 
 All provider targets are experimental and may change as the formats evolve.
 

package/docs/specs/kiro.md

@@ -0,0 +1,171 @@
+# Kiro CLI Spec (Custom Agents, Skills, Steering, MCP, Settings)
+
+Last verified: 2026-02-17
+
+## Primary sources
+
+```
+https://kiro.dev/docs/cli/
+https://kiro.dev/docs/cli/custom-agents/configuration-reference/
+https://kiro.dev/docs/cli/skills/
+https://kiro.dev/docs/cli/steering/
+https://kiro.dev/docs/cli/mcp/
+https://kiro.dev/docs/cli/hooks/
+https://agentskills.io
+```
+
+## Config locations
+
+- Project-level config: `.kiro/` directory at project root.
+- No global/user-level config directory — all config is project-scoped.
+
+## Directory structure
+
+```
+.kiro/
+├── agents/
+│   ├── <name>.json              # Agent configuration
+│   └── prompts/
+│       └── <name>.md            # Agent prompt files
+├── skills/
+│   └── <name>/
+│       └── SKILL.md             # Skill definition
+├── steering/
+│   └── <name>.md                # Always-on context files
+└── settings/
+    └── mcp.json                 # MCP server configuration
+```
+
+## Custom agents (JSON config + prompt files)
+
+- Custom agents are JSON files in `.kiro/agents/`.
+- Each agent has a corresponding prompt `.md` file, referenced via `file://` URI.
+- Agent config has 14 possible fields (see below).
+- Agents are activated by user selection (no auto-activation).
+- The converter outputs a subset of fields relevant to converted plugins.
+
+### Agent config fields
+
+| Field | Type | Used in conversion | Notes |
+|---|---|---|---|
+| `name` | string | Yes | Agent display name |
+| `description` | string | Yes | Human-readable description |
+| `prompt` | string or `file://` URI | Yes | System prompt or file reference |
+| `tools` | string[] | Yes (`["*"]`) | Available tools |
+| `resources` | string[] | Yes | `file://`, `skill://`, `knowledgeBase` URIs |
+| `includeMcpJson` | boolean | Yes (`true`) | Inherit project MCP servers |
+| `welcomeMessage` | string | Yes | Agent switch greeting |
+| `mcpServers` | object | No | Per-agent MCP config (use includeMcpJson instead) |
+| `toolAliases` | Record | No | Tool name remapping |
+| `allowedTools` | string[] | No | Auto-approve patterns |
+| `toolsSettings` | object | No | Per-tool configuration |
+| `hooks` | object | No (future work) | 5 trigger types |
+| `model` | string | No | Model selection |
+| `keyboardShortcut` | string | No | Quick-switch shortcut |
+
+### Example agent config
+
+```json
+{
+  "name": "security-reviewer",
+  "description": "Reviews code for security vulnerabilities",
+  "prompt": "file://./prompts/security-reviewer.md",
+  "tools": ["*"],
+  "resources": [
+    "file://.kiro/steering/**/*.md",
+    "skill://.kiro/skills/**/SKILL.md"
+  ],
+  "includeMcpJson": true,
+  "welcomeMessage": "Switching to security-reviewer. Reviews code for security vulnerabilities"
+}
+```
+
+## Skills (SKILL.md standard)
+
+- Skills follow the open [Agent Skills](https://agentskills.io) standard.
+- A skill is a folder containing `SKILL.md` plus optional supporting files.
+- Skills live in `.kiro/skills/`.
+- `SKILL.md` uses YAML frontmatter with `name` and `description` fields.
+- Kiro activates skills on demand based on description matching.
+- The `description` field is critical — Kiro uses it to decide when to activate the skill.
+
+### Constraints
+
+- Skill name: max 64 characters, pattern `^[a-z][a-z0-9-]*$`, no consecutive hyphens (`--`).
+- Skill description: max 1024 characters.
+- Skill name must match parent directory name.
+
+### Example
+
+```yaml
+---
+name: workflows-plan
+description: Plan work by analyzing requirements and creating actionable steps
+---
+
+# Planning Workflow
+
+Detailed instructions...
+```
+
+## Steering files
+
+- Markdown files in `.kiro/steering/`.
+- Always loaded into every agent session's context.
+- Equivalent to Claude Code's CLAUDE.md.
+- Used for project-wide instructions, coding standards, and conventions.
+
+## MCP server configuration
+
+- MCP servers are configured in `.kiro/settings/mcp.json`.
+- **Only stdio transport is supported** — `command` + `args` + `env`.
+- HTTP/SSE transport (`url`, `headers`) is NOT supported by Kiro CLI.
+- The converter skips HTTP-only MCP servers with a warning.
+
+### Example
+
+```json
+{
+  "mcpServers": {
+    "playwright": {
+      "command": "npx",
+      "args": ["-y", "@anthropic/mcp-playwright"]
+    },
+    "context7": {
+      "command": "npx",
+      "args": ["-y", "@context7/mcp-server"]
+    }
+  }
+}
+```
+
+## Hooks
+
+- Kiro supports 5 hook trigger types: `agentSpawn`, `userPromptSubmit`, `preToolUse`, `postToolUse`, `stop`.
+- Hooks are configured inside agent JSON configs (not separate files).
+- 3 of 5 triggers map to Claude Code hooks (`preToolUse`, `postToolUse`, `stop`).
+- Not converted by the plugin converter for MVP — a warning is emitted.
+
+## Conversion lossy mappings
+
+| Claude Code Feature | Kiro Status | Notes |
+|---|---|---|
+| `Edit` tool (surgical replacement) | Degraded -> `write` (full-file) | Kiro write overwrites entire files |
+| `context: fork` | Lost | No execution isolation control |
+| `!`command`` dynamic injection | Lost | No pre-processing of markdown |
+| `disable-model-invocation` | Lost | No invocation control |
+| `allowed-tools` per skill | Lost | No tool permission scoping per skill |
+| `$ARGUMENTS` interpolation | Lost | No structured argument passing |
+| Claude hooks | Skipped | Future follow-up (near-1:1 for 3/5 triggers) |
+| HTTP MCP servers | Skipped | Kiro only supports stdio transport |
+
+## Overwrite behavior during conversion
+
+| Content Type | Strategy | Rationale |
+|---|---|---|
+| Generated agents (JSON + prompt) | Overwrite | Generated, not user-authored |
+| Generated skills (from commands) | Overwrite | Generated, not user-authored |
+| Copied skills (pass-through) | Overwrite | Plugin is source of truth |
+| Steering files | Overwrite | Generated from CLAUDE.md |
+| `mcp.json` | Merge with backup | User may have added their own servers |
+| User-created agents/skills | Preserved | Don't delete orphans |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@every-env/compound-plugin",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "type": "module",
   "private": false,
   "bin": {

package/src/commands/convert.ts

@@ -23,7 +23,7 @@ export default defineCommand({
     to: {
       type: "string",
       default: "opencode",
-      description: "Target format (opencode | codex | droid | cursor | pi | gemini)",
+      description: "Target format (opencode | codex | droid | cursor | pi | gemini | kiro)",
     },
     output: {
       type: "string",
@@ -146,5 +146,6 @@ function resolveTargetOutputRoot(targetName: string, outputRoot: string, codexHo
   if (targetName === "droid") return path.join(os.homedir(), ".factory")
   if (targetName === "cursor") return path.join(outputRoot, ".cursor")
   if (targetName === "gemini") return path.join(outputRoot, ".gemini")
+  if (targetName === "kiro") return path.join(outputRoot, ".kiro")
   return outputRoot
 }

package/src/commands/install.ts

@@ -25,7 +25,7 @@ export default defineCommand({
     to: {
       type: "string",
       default: "opencode",
-      description: "Target format (opencode | codex | droid | cursor | pi | copilot | gemini)",
+      description: "Target format (opencode | codex | droid | cursor | pi | copilot | gemini | kiro)",
     },
     output: {
       type: "string",
@@ -191,6 +191,10 @@ function resolveTargetOutputRoot(
     const base = hasExplicitOutput ? outputRoot : process.cwd()
     return path.join(base, ".github")
   }
+  if (targetName === "kiro") {
+    const base = hasExplicitOutput ? outputRoot : process.cwd()
+    return path.join(base, ".kiro")
+  }
   return outputRoot
 }
 

package/src/converters/claude-to-kiro.ts

@@ -0,0 +1,262 @@
+import { readFileSync, existsSync } from "fs"
+import path from "path"
+import { formatFrontmatter } from "../utils/frontmatter"
+import type { ClaudeAgent, ClaudeCommand, ClaudeMcpServer, ClaudePlugin } from "../types/claude"
+import type {
+  KiroAgent,
+  KiroAgentConfig,
+  KiroBundle,
+  KiroMcpServer,
+  KiroSkill,
+  KiroSteeringFile,
+} from "../types/kiro"
+import type { ClaudeToOpenCodeOptions } from "./claude-to-opencode"
+
+export type ClaudeToKiroOptions = ClaudeToOpenCodeOptions
+
+const KIRO_SKILL_NAME_MAX_LENGTH = 64
+const KIRO_SKILL_NAME_PATTERN = /^[a-z][a-z0-9-]*$/
+const KIRO_DESCRIPTION_MAX_LENGTH = 1024
+
+const CLAUDE_TO_KIRO_TOOLS: Record<string, string> = {
+  Bash: "shell",
+  Write: "write",
+  Read: "read",
+  Edit: "write", // NOTE: Kiro write is full-file, not surgical edit. Lossy mapping.
+  Glob: "glob",
+  Grep: "grep",
+  WebFetch: "web_fetch",
+  Task: "use_subagent",
+}
+
+export function convertClaudeToKiro(
+  plugin: ClaudePlugin,
+  _options: ClaudeToKiroOptions,
+): KiroBundle {
+  const usedSkillNames = new Set<string>()
+
+  // Pass-through skills are processed first — they're the source of truth
+  const skillDirs = plugin.skills.map((skill) => ({
+    name: skill.name,
+    sourceDir: skill.sourceDir,
+  }))
+  for (const skill of skillDirs) {
+    usedSkillNames.add(normalizeName(skill.name))
+  }
+
+  // Convert agents to Kiro custom agents
+  const agentNames = plugin.agents.map((a) => normalizeName(a.name))
+  const agents = plugin.agents.map((agent) => convertAgentToKiroAgent(agent, agentNames))
+
+  // Convert commands to skills (generated)
+  const generatedSkills = plugin.commands.map((command) =>
+    convertCommandToSkill(command, usedSkillNames, agentNames),
+  )
+
+  // Convert MCP servers (stdio only)
+  const mcpServers = convertMcpServers(plugin.mcpServers)
+
+  // Build steering files from CLAUDE.md
+  const steeringFiles = buildSteeringFiles(plugin, agentNames)
+
+  // Warn about hooks
+  if (plugin.hooks && Object.keys(plugin.hooks.hooks).length > 0) {
+    console.warn(
+      "Warning: Kiro CLI hooks use a different format (preToolUse/postToolUse inside agent configs). Hooks were skipped during conversion.",
+    )
+  }
+
+  return { agents, generatedSkills, skillDirs, steeringFiles, mcpServers }
+}
+
+function convertAgentToKiroAgent(agent: ClaudeAgent, knownAgentNames: string[]): KiroAgent {
+  const name = normalizeName(agent.name)
+  const description = sanitizeDescription(
+    agent.description ?? `Use this agent for ${agent.name} tasks`,
+  )
+
+  const config: KiroAgentConfig = {
+    name,
+    description,
+    prompt: `file://./prompts/${name}.md`,
+    tools: ["*"],
+    resources: [
+      "file://.kiro/steering/**/*.md",
+      "skill://.kiro/skills/**/SKILL.md",
+    ],
+    includeMcpJson: true,
+    welcomeMessage: `Switching to the ${name} agent. ${description}`,
+  }
+
+  let body = transformContentForKiro(agent.body.trim(), knownAgentNames)
+  if (agent.capabilities && agent.capabilities.length > 0) {
+    const capabilities = agent.capabilities.map((c) => `- ${c}`).join("\n")
+    body = `## Capabilities\n${capabilities}\n\n${body}`.trim()
+  }
+  if (body.length === 0) {
+    body = `Instructions converted from the ${agent.name} agent.`
+  }
+
+  return { name, config, promptContent: body }
+}
+
+function convertCommandToSkill(
+  command: ClaudeCommand,
+  usedNames: Set<string>,
+  knownAgentNames: string[],
+): KiroSkill {
+  const rawName = normalizeName(command.name)
+  const name = uniqueName(rawName, usedNames)
+
+  const description = sanitizeDescription(
+    command.description ?? `Converted from Claude command ${command.name}`,
+  )
+
+  const frontmatter: Record<string, unknown> = { name, description }
+
+  let body = transformContentForKiro(command.body.trim(), knownAgentNames)
+  if (body.length === 0) {
+    body = `Instructions converted from the ${command.name} command.`
+  }
+
+  const content = formatFrontmatter(frontmatter, body)
+  return { name, content }
+}
+
+/**
+ * Transform Claude Code content to Kiro-compatible content.
+ *
+ * 1. Task agent calls: Task agent-name(args) -> Use the use_subagent tool ...
+ * 2. Path rewriting: .claude/ -> .kiro/, ~/.claude/ -> ~/.kiro/
+ * 3. Slash command refs: /workflows:plan -> use the workflows-plan skill
+ * 4. Claude tool names: Bash -> shell, Read -> read, etc.
+ * 5. Agent refs: @agent-name -> the agent-name agent (only for known agent names)
+ */
+export function transformContentForKiro(body: string, knownAgentNames: string[] = []): string {
+  let result = body
+
+  // 1. Transform Task agent calls
+  const taskPattern = /^(\s*-?\s*)Task\s+([a-z][a-z0-9-]*)\(([^)]+)\)/gm
+  result = result.replace(taskPattern, (_match, prefix: string, agentName: string, args: string) => {
+    return `${prefix}Use the use_subagent tool to delegate to the ${normalizeName(agentName)} agent: ${args.trim()}`
+  })
+
+  // 2. Rewrite .claude/ paths to .kiro/ (with word-boundary-like lookbehind)
+  result = result.replace(/(?<=^|\s|["'`])~\/\.claude\//gm, "~/.kiro/")
+  result = result.replace(/(?<=^|\s|["'`])\.claude\//gm, ".kiro/")
+
+  // 3. Slash command refs: /command-name -> skill activation language
+  result = result.replace(/(?<=^|\s)`?\/([a-zA-Z][a-zA-Z0-9_:-]*)`?/gm, (_match, cmdName: string) => {
+    const skillName = normalizeName(cmdName)
+    return `the ${skillName} skill`
+  })
+
+  // 4. Claude tool names -> Kiro tool names
+  for (const [claudeTool, kiroTool] of Object.entries(CLAUDE_TO_KIRO_TOOLS)) {
+    // Match tool name references: "the X tool", "using X", "use X to"
+    const toolPattern = new RegExp(`\\b${claudeTool}\\b(?=\\s+tool|\\s+to\\s)`, "g")
+    result = result.replace(toolPattern, kiroTool)
+  }
+
+  // 5. Transform @agent-name references (only for known agent names)
+  if (knownAgentNames.length > 0) {
+    const escapedNames = knownAgentNames.map((n) => n.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"))
+    const agentRefPattern = new RegExp(`@(${escapedNames.join("|")})\\b`, "g")
+    result = result.replace(agentRefPattern, (_match, agentName: string) => {
+      return `the ${normalizeName(agentName)} agent`
+    })
+  }
+
+  return result
+}
+
+function convertMcpServers(
+  servers?: Record<string, ClaudeMcpServer>,
+): Record<string, KiroMcpServer> {
+  if (!servers || Object.keys(servers).length === 0) return {}
+
+  const result: Record<string, KiroMcpServer> = {}
+  for (const [name, server] of Object.entries(servers)) {
+    if (!server.command) {
+      console.warn(
+        `Warning: MCP server "${name}" has no command (HTTP/SSE transport). Kiro only supports stdio. Skipping.`,
+      )
+      continue
+    }
+
+    const entry: KiroMcpServer = { command: server.command }
+    if (server.args && server.args.length > 0) entry.args = server.args
+    if (server.env && Object.keys(server.env).length > 0) entry.env = server.env
+
+    console.log(`MCP server "${name}" will execute: ${server.command}${server.args ? " " + server.args.join(" ") : ""}`)
+    result[name] = entry
+  }
+  return result
+}
+
+function buildSteeringFiles(plugin: ClaudePlugin, knownAgentNames: string[]): KiroSteeringFile[] {
+  const claudeMdPath = path.join(plugin.root, "CLAUDE.md")
+  if (!existsSync(claudeMdPath)) return []
+
+  let content: string
+  try {
+    content = readFileSync(claudeMdPath, "utf8")
+  } catch {
+    return []
+  }
+
+  if (!content || content.trim().length === 0) return []
+
+  const transformed = transformContentForKiro(content, knownAgentNames)
+  return [{ name: "compound-engineering", content: transformed }]
+}
+
+function normalizeName(value: string): string {
+  const trimmed = value.trim()
+  if (!trimmed) return "item"
+  let normalized = trimmed
+    .toLowerCase()
+    .replace(/[\\/]+/g, "-")
+    .replace(/[:\s]+/g, "-")
+    .replace(/[^a-z0-9_-]+/g, "-")
+    .replace(/-+/g, "-") // Collapse consecutive hyphens (Agent Skills standard)
+    .replace(/^-+|-+$/g, "")
+
+  // Enforce max length (truncate at last hyphen boundary)
+  if (normalized.length > KIRO_SKILL_NAME_MAX_LENGTH) {
+    normalized = normalized.slice(0, KIRO_SKILL_NAME_MAX_LENGTH)
+    const lastHyphen = normalized.lastIndexOf("-")
+    if (lastHyphen > 0) {
+      normalized = normalized.slice(0, lastHyphen)
+    }
+    normalized = normalized.replace(/-+$/g, "")
+  }
+
+  // Ensure name starts with a letter
+  if (normalized.length === 0 || !/^[a-z]/.test(normalized)) {
+    return "item"
+  }
+
+  return normalized
+}
+
+function sanitizeDescription(value: string, maxLength = KIRO_DESCRIPTION_MAX_LENGTH): string {
+  const normalized = value.replace(/\s+/g, " ").trim()
+  if (normalized.length <= maxLength) return normalized
+  const ellipsis = "..."
+  return normalized.slice(0, Math.max(0, maxLength - ellipsis.length)).trimEnd() + ellipsis
+}
+
+function uniqueName(base: string, used: Set<string>): string {
+  if (!used.has(base)) {
+    used.add(base)
+    return base
+  }
+  let index = 2
+  while (used.has(`${base}-${index}`)) {
+    index += 1
+  }
+  const name = `${base}-${index}`
+  used.add(name)
+  return name
+}

package/src/targets/index.ts

@@ -5,18 +5,21 @@ import type { DroidBundle } from "../types/droid"
 import type { PiBundle } from "../types/pi"
 import type { CopilotBundle } from "../types/copilot"
 import type { GeminiBundle } from "../types/gemini"
+import type { KiroBundle } from "../types/kiro"
 import { convertClaudeToOpenCode, type ClaudeToOpenCodeOptions } from "../converters/claude-to-opencode"
 import { convertClaudeToCodex } from "../converters/claude-to-codex"
 import { convertClaudeToDroid } from "../converters/claude-to-droid"
 import { convertClaudeToPi } from "../converters/claude-to-pi"
 import { convertClaudeToCopilot } from "../converters/claude-to-copilot"
 import { convertClaudeToGemini } from "../converters/claude-to-gemini"
+import { convertClaudeToKiro } from "../converters/claude-to-kiro"
 import { writeOpenCodeBundle } from "./opencode"
 import { writeCodexBundle } from "./codex"
 import { writeDroidBundle } from "./droid"
 import { writePiBundle } from "./pi"
 import { writeCopilotBundle } from "./copilot"
 import { writeGeminiBundle } from "./gemini"
+import { writeKiroBundle } from "./kiro"
 
 export type TargetHandler<TBundle = unknown> = {
   name: string
@@ -62,4 +65,10 @@ export const targets: Record<string, TargetHandler> = {
     convert: convertClaudeToGemini as TargetHandler<GeminiBundle>["convert"],
     write: writeGeminiBundle as TargetHandler<GeminiBundle>["write"],
   },
+  kiro: {
+    name: "kiro",
+    implemented: true,
+    convert: convertClaudeToKiro as TargetHandler<KiroBundle>["convert"],
+    write: writeKiroBundle as TargetHandler<KiroBundle>["write"],
+  },
 }

package/src/targets/kiro.ts

@@ -0,0 +1,122 @@
+import path from "path"
+import { backupFile, copyDir, ensureDir, pathExists, readJson, writeJson, writeText } from "../utils/files"
+import type { KiroBundle } from "../types/kiro"
+
+export async function writeKiroBundle(outputRoot: string, bundle: KiroBundle): Promise<void> {
+  const paths = resolveKiroPaths(outputRoot)
+  await ensureDir(paths.kiroDir)
+
+  // Write agents
+  if (bundle.agents.length > 0) {
+    for (const agent of bundle.agents) {
+      // Validate name doesn't escape agents directory
+      validatePathSafe(agent.name, "agent")
+
+      // Write agent JSON config
+      await writeJson(
+        path.join(paths.agentsDir, `${agent.name}.json`),
+        agent.config,
+      )
+
+      // Write agent prompt file
+      await writeText(
+        path.join(paths.agentsDir, "prompts", `${agent.name}.md`),
+        agent.promptContent + "\n",
+      )
+    }
+  }
+
+  // Write generated skills (from commands)
+  if (bundle.generatedSkills.length > 0) {
+    for (const skill of bundle.generatedSkills) {
+      validatePathSafe(skill.name, "skill")
+      await writeText(
+        path.join(paths.skillsDir, skill.name, "SKILL.md"),
+        skill.content + "\n",
+      )
+    }
+  }
+
+  // Copy skill directories (pass-through)
+  if (bundle.skillDirs.length > 0) {
+    for (const skill of bundle.skillDirs) {
+      validatePathSafe(skill.name, "skill directory")
+      const destDir = path.join(paths.skillsDir, skill.name)
+
+      // Validate destination doesn't escape skills directory
+      const resolvedDest = path.resolve(destDir)
+      if (!resolvedDest.startsWith(path.resolve(paths.skillsDir))) {
+        console.warn(`Warning: Skill name "${skill.name}" escapes .kiro/skills/. Skipping.`)
+        continue
+      }
+
+      await copyDir(skill.sourceDir, destDir)
+    }
+  }
+
+  // Write steering files
+  if (bundle.steeringFiles.length > 0) {
+    for (const file of bundle.steeringFiles) {
+      validatePathSafe(file.name, "steering file")
+      await writeText(
+        path.join(paths.steeringDir, `${file.name}.md`),
+        file.content + "\n",
+      )
+    }
+  }
+
+  // Write MCP servers to mcp.json
+  if (Object.keys(bundle.mcpServers).length > 0) {
+    const mcpPath = path.join(paths.settingsDir, "mcp.json")
+    const backupPath = await backupFile(mcpPath)
+    if (backupPath) {
+      console.log(`Backed up existing mcp.json to ${backupPath}`)
+    }
+
+    // Merge with existing mcp.json if present
+    let existingConfig: Record<string, unknown> = {}
+    if (await pathExists(mcpPath)) {
+      try {
+        existingConfig = await readJson<Record<string, unknown>>(mcpPath)
+      } catch {
+        console.warn("Warning: existing mcp.json could not be parsed and will be replaced.")
+      }
+    }
+
+    const existingServers =
+      existingConfig.mcpServers && typeof existingConfig.mcpServers === "object"
+        ? (existingConfig.mcpServers as Record<string, unknown>)
+        : {}
+    const merged = { ...existingConfig, mcpServers: { ...existingServers, ...bundle.mcpServers } }
+    await writeJson(mcpPath, merged)
+  }
+}
+
+function resolveKiroPaths(outputRoot: string) {
+  const base = path.basename(outputRoot)
+  // If already pointing at .kiro, write directly into it
+  if (base === ".kiro") {
+    return {
+      kiroDir: outputRoot,
+      agentsDir: path.join(outputRoot, "agents"),
+      skillsDir: path.join(outputRoot, "skills"),
+      steeringDir: path.join(outputRoot, "steering"),
+      settingsDir: path.join(outputRoot, "settings"),
+    }
+  }
+  // Otherwise nest under .kiro
+  const kiroDir = path.join(outputRoot, ".kiro")
+  return {
+    kiroDir,
+    agentsDir: path.join(kiroDir, "agents"),
+    skillsDir: path.join(kiroDir, "skills"),
+    steeringDir: path.join(kiroDir, "steering"),
+    settingsDir: path.join(kiroDir, "settings"),
+  }
+}
+
+function validatePathSafe(name: string, label: string): void {
+  if (name.includes("..") || name.includes("/") || name.includes("\\")) {
+    throw new Error(`${label} name contains unsafe path characters: ${name}`)
+  }
+}