@join-pantheon/cli 0.26.5 → 0.27.0

package/README.md

@@ -404,7 +404,7 @@ with no human; the cap and lock governors under two workers per member.
 
 ### Which agent answers
 
-The worker runs whichever agent CLI this machine has — `--agent claude-code|codex|cursor|copilot|auto`.
+The worker runs whichever agent CLI this machine has — `--agent claude-code|codex|cursor|copilot|kiro|auto`.
 With `auto` (the default) the order is: the agent a persona pins, then the one you chose at setup,
 then PATH order — and a candidate that is not signed in is skipped and named in the run log, so a
 run never fails on an expired session when another agent could have answered. If nothing is
@@ -418,6 +418,7 @@ actually works, with the same "no shell unless you said so" rule spelled in its
 | codex | `--sandbox read-only` (codex has no edits-without-shell mode) | `--sandbox workspace-write` |
 | cursor | proposes edits, never applies (`-p` without `--force`) | `--force` |
 | copilot | `--allow-tool=pantheon-worker --allow-tool=write` (edits without shell, Copilot's `write` kind) | `--allow-all-tools` |
+| kiro | an agent whose tools are pantheon's plus `read`, `write`, `grep`, `glob` — all pre-approved | the same, plus `shell` |
 
 Claude Code, Cursor and Codex are verified with **real live woken runs** — an idle machine answering a
 peer's ASK end to end. Codex quirks the tooling handles for
@@ -458,6 +459,58 @@ named as that, with `copilot login` as the fix.
 also restrict MCP servers to an approved registry; the server is called `pantheon` and its only job
 is moving messages between your teammates' agents — nothing here reads code or runs commands.
 
+### Kiro
+
+Kiro is one backend covering the **Kiro CLI** (`kiro-cli`) and the **Kiro IDE**, both of which read
+`~/.kiro/settings/mcp.json`; `pantheon install --user` writes pantheon there. Everything below about
+the CLI was checked live against kiro-cli 2.23.1.
+
+**Sessions report presence on their own.** The entry names its agent (`PANTHEON_AGENT=kiro`), so a Kiro
+session is labelled Kiro to your teammates and reports busy and idle through its own MCP server. Without
+that label it would take the machine's main agent as its own, and on a Claude Code machine report nothing.
+There is deliberately no repo-level Kiro file: Kiro uses a workspace-level server of the same name whole,
+so a committed copy would replace each teammate's own entry.
+
+**Approval.** The entry's `autoApprove` list carries your approval choice, and the Kiro IDE honours it.
+The Kiro CLI ignores it — its default agent asks before each Pantheon call, and has no setting that
+changes that.
+
+**The `pantheon` agent, for the CLI.** In kiro-cli the only hooks that fire are the ones inside an agent
+file; neither of its engines reads the standalone `.kiro/hooks/` files, and the built-in default agent
+cannot carry any. So `pantheon hook install` adds an agent called `pantheon`: Kiro's default — the same
+tools (`tools: ["*"]`) and your own MCP servers (`includeMcpJson: true`) — plus Pantheon's tools
+pre-approved per your choice, a `userPromptSubmit` hook that reports a turn as started and prints
+nothing, and a `stop` hook that holds the turn open while a teammate waits. It is opt-in and nothing
+makes it your default:
+
+```
+kiro-cli chat --agent pantheon           # this session
+kiro-cli agent set-default pantheon      # every session
+```
+
+Checked live: with a teammate's question waiting and a prompt that said only "reply HELLO", the agent
+replied, the stop hook held the turn, and it read, claimed and answered the question through Pantheon
+without one approval prompt. An agent called `pantheon` that you wrote yourself is never overwritten.
+
+**Woken runs.** A woken Kiro run is its own agent, `pantheon-worker`, in a `KIRO_HOME` of its own outside
+the checkout. That matters: Kiro starts every MCP server in its config whatever the agent says, so your own
+pantheon entry would otherwise join every run as a second server reporting you present. The run's home
+holds only its agent and your Kiro settings; your sign-in, which lives in Kiro's data store, still applies.
+The agent's `tools` and `allowedTools` are one list — Pantheon's server and `read`, `write`, `grep`,
+`glob`, with `shell` only under `--allow-bash` — so nothing it can reach needs approval, and no trust flag
+is passed. A repo's own committed Kiro MCP servers still start, as the repo's tooling; their tools are not
+in the run's list, and one that fails does not stop the run.
+
+**Sign in once with `kiro-cli login`, or set `KIRO_API_KEY`.** Signed out, Kiro does not fail: it opens a
+browser to log in and waits. So a woken run is never started with Kiro signed out, even when a persona pins
+Kiro or it is the only agent on the machine; the run is refused with the reason, and `pantheon doctor` says
+so first. Pantheon reads the sign-in with `kiro-cli whoami --format json`, and only once Kiro has run on the
+machine, because on a fresh install that one call creates `~/.kiro` and Kiro's data store.
+
+Not supported: Kiro Crew, which is itself an always-on agent runner and would be a second answerer beside
+Pantheon's worker, and Kiro Mobile, which has nowhere to load an MCP server. The Kiro IDE's own hooks are
+not wired, because they could not be checked here; IDE sessions get the MCP entry and presence.
+
 ### Personas — telling the worker who to be
 
 A worker with no instructions escalates too much and trusts too much. A **persona** is one

package/dist/agents.js

@@ -1,8 +1,9 @@
 import { execFileSync } from "node:child_process";
+import { randomBytes } from "node:crypto";
 import { copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir, platform } from "node:os";
 import { join, dirname, isAbsolute } from "node:path";
-import { launcher } from "./install.js";
+import { launcher, kiroDir } from "./install.js";
 import { agentSpawn, which } from "./which.js";
 import { PANTHEON_TOOL_NAMES, PANTHEON_TOOLS } from "./tools.js";
 export function launchArgs(agent, prompt, name) {
@@ -10,6 +11,8 @@ export function launchArgs(agent, prompt, name) {
         return ["--name", name, prompt];
     if (agent === "copilot")
         return ["-n", name, "-i", prompt];
+    if (agent === "kiro")
+        return ["chat", prompt];
     return [prompt];
 }
 export const AGENTS = [
@@ -17,7 +20,11 @@ export const AGENTS = [
     { id: "codex", label: "Codex", binaries: ["codex"] },
     { id: "cursor", label: "Cursor", binaries: ["cursor-agent", "agent"] },
     { id: "copilot", label: "Copilot", binaries: ["copilot"] },
+    { id: "kiro", label: "Kiro", binaries: ["kiro-cli"] },
 ];
+export function kiroHome(home = homedir(), env = process.env) {
+    return kiroDir(home, env);
+}
 export function copilotHome(home = homedir(), env = process.env) {
     return env.COPILOT_HOME || join(home, ".copilot");
 }
@@ -57,6 +64,11 @@ export function detectForHooks(projectDir = process.cwd()) {
                 out.push(backend);
             continue;
         }
+        if (backend.id === "kiro") {
+            if (existsSync(kiroHome()) || existsSync(join(projectDir, ".kiro")))
+                out.push(backend);
+            continue;
+        }
         const userDir = backend.id === "claude-code" ? join(homedir(), ".claude")
             : backend.id === "codex" ? join(homedir(), ".codex")
                 : join(homedir(), ".cursor");
@@ -107,7 +119,28 @@ export const SIGN_IN_CHECK = {
     codex: { args: ["login", "status"], fix: "run `codex login`" },
     cursor: { args: ["status"], fix: "run `cursor-agent login`" },
     copilot: { args: [], fix: "run `copilot login` (or `gh auth login` — copilot uses gh's sign-in too)" },
+    kiro: { args: ["whoami", "--format", "json"], fix: "run `kiro-cli login` (or set KIRO_API_KEY)" },
 };
+export const NEEDS_SIGN_IN_BEFORE_SPAWN = new Set(["kiro"]);
+export function kiroSignedIn(binary, run = runStatus, env = process.env, home = homedir(), os = platform()) {
+    if (env.KIRO_API_KEY)
+        return { ok: true, detail: "signed in (KIRO_API_KEY in the environment)" };
+    if (!kiroHasRunHere(home, env, os))
+        return { ok: false, detail: "never signed in on this machine" };
+    const r = run(binary, SIGN_IN_CHECK.kiro.args);
+    if (r.status === null)
+        return { ok: false, detail: `could not tell (${(r.out.split("\n")[0] ?? "").slice(0, 60) || "no answer"}), so it is not run unattended` };
+    const line = r.out.split("\n").map((l) => l.trim()).reverse().find((l) => l.startsWith("{"));
+    try {
+        const j = JSON.parse(line ?? "");
+        if (typeof j.accountType === "string" && j.accountType)
+            return { ok: true, detail: "signed in" };
+        if ("account" in j)
+            return j.account ? { ok: true, detail: "signed in" } : { ok: false, detail: "not signed in" };
+    }
+    catch { }
+    return { ok: false, detail: "could not tell (kiro-cli whoami answered in a shape this build does not know), so it is not run unattended" };
+}
 export const COPILOT_TOKEN_VARS = ["COPILOT_GITHUB_TOKEN", "GH_TOKEN", "GITHUB_TOKEN"];
 export function copilotSignedIn(run = runStatus, env = process.env, gh = () => !!cliOnPath("gh")) {
     if (COPILOT_TOKEN_VARS.some((k) => env[k]))
@@ -132,10 +165,12 @@ const runStatus = (binary, args) => {
         return { status: err.status ?? null, out: `${err.stdout ?? ""}${err.stderr ?? ""}`.trim() || (err.message ?? "") };
     }
 };
-export const AGENT_HOME_DIR = { "claude-code": ".claude", codex: ".codex", cursor: ".cursor", copilot: ".copilot" };
+export const AGENT_HOME_DIR = { "claude-code": ".claude", codex: ".codex", cursor: ".cursor", copilot: ".copilot", kiro: ".kiro" };
 export function signedIn(backend, binary, run = runStatus, home = homedir()) {
     if (backend.id === "copilot")
         return copilotSignedIn(run);
+    if (backend.id === "kiro")
+        return kiroSignedIn(binary, run, process.env, home);
     if (!existsSync(join(home, AGENT_HOME_DIR[backend.id])))
         return { ok: false, detail: "never signed in on this machine" };
     const check = SIGN_IN_CHECK[backend.id];
@@ -159,14 +194,14 @@ export function chooseAgent(preferred, opts = {}) {
     if (preferred && preferred !== "auto") {
         const backend = agentById(preferred);
         if (!backend)
-            throw new Error(`unknown agent ${preferred} — use claude-code, codex, cursor, copilot, or auto`);
+            throw new Error(`unknown agent ${preferred} — use claude-code, codex, cursor, copilot, kiro, or auto`);
         const hit = available.find((a) => a.backend.id === backend.id);
         if (!hit)
             throw new Error(`${backend.label} is not on PATH (looked for ${backend.binaries.join(", ")})`);
         return { backend, binary: hit.binary, signIn: state(backend, hit.binary), because: "pinned", skipped: [] };
     }
     if (!available.length)
-        throw new Error("no agent CLI on PATH — install claude, codex, cursor-agent, or copilot");
+        throw new Error("no agent CLI on PATH — install claude, codex, cursor-agent, copilot, or kiro-cli");
     const order = [];
     const wanted = opts.prefer ? agentById(opts.prefer) : undefined;
     const chosen = wanted ? available.find((a) => a.backend.id === wanted.id) : undefined;
@@ -182,9 +217,14 @@ export function chooseAgent(preferred, opts = {}) {
             return { backend: c.backend, binary: c.binary, ...(s ? { signIn: s } : {}), because: c.because, skipped };
         skipped.push({ backend: c.backend, why: `${s.detail} — ${SIGN_IN_CHECK[c.backend.id].fix}` });
     }
-    const first = order[0];
+    const first = order.find((o) => !NEEDS_SIGN_IN_BEFORE_SPAWN.has(o.backend.id)) ?? order[0];
     return { backend: first.backend, binary: first.binary, signIn: state(first.backend, first.binary), because: `${first.because} (none signed in)`, skipped };
 }
+export function unattendedRefusal(c) {
+    if (!NEEDS_SIGN_IN_BEFORE_SPAWN.has(c.backend.id) || c.signIn?.ok)
+        return null;
+    return `${c.backend.label} is not signed in (${c.signIn?.detail ?? "not checked"}), and signed out it opens a browser to log in, so it is not started while you are away — ${SIGN_IN_CHECK[c.backend.id].fix}`;
+}
 export function describeChoice(c) {
     const head = `${c.backend.label}${c.signIn ? ` — ${c.signIn.detail}` : ""} (${c.because})`;
     return c.skipped.length ? `${head}; skipped ${c.skipped.map((s) => `${s.backend.label} — ${s.why}`).join("; ")}` : head;
@@ -283,6 +323,30 @@ export function headlessSpawn(opts) {
             ...(opts.runHome && existsSync(settings) ? { copyFiles: [{ from: settings, to: join(home, "settings.json") }] } : {}),
         };
     }
+    if (opts.backend.id === "kiro") {
+        const home = opts.runHome ? join(opts.runHome, "kiro") : join(opts.worktree, ".pantheon", "kiro-home");
+        const tools = [...KIRO_WORKER_TOOLS, ...(opts.allowBash ? ["shell"] : []), `@${KIRO_WORKER_SERVER}`];
+        const agentName = `${KIRO_WORKER_AGENT}-${randomBytes(8).toString("hex")}`;
+        const settings = join(kiroHome(), "settings", "cli.json");
+        return {
+            command: opts.binary,
+            args: ["chat", "--no-interactive", "--agent", agentName, "--require-mcp-startup", "--wrap", "never", opts.prompt],
+            env: { ...procEnv, KIRO_HOME: home, KIRO_NO_AUTO_UPDATE: "1" },
+            writeFiles: [{
+                    path: join(home, "agents", `${KIRO_WORKER_AGENT}.json`),
+                    contents: JSON.stringify({
+                        name: agentName,
+                        description: "A Pantheon run: answers a teammate's request on an isolated branch, while its human is away",
+                        tools,
+                        allowedTools: tools,
+                        includeMcpJson: false,
+                        mcpServers: { [KIRO_WORKER_SERVER]: { command: l.command, args: l.args, env: fileEnv } },
+                        resources: ["file://.kiro/steering/**/*.md"],
+                    }, null, 2),
+                }],
+            ...(opts.runHome && existsSync(settings) ? { copyFiles: [{ from: settings, to: join(home, "settings", "cli.json") }] } : {}),
+        };
+    }
     return {
         command: opts.binary,
         args: [
@@ -310,6 +374,20 @@ export function headlessSpawn(opts) {
     };
 }
 export const COPILOT_WORKER_SERVER = "pantheon-worker";
+export function kiroDataDir(home = homedir(), env = process.env, os = platform()) {
+    if (env.KIRO_DATA_DIR)
+        return env.KIRO_DATA_DIR;
+    if (os === "darwin")
+        return join(home, "Library", "Application Support", "kiro-cli");
+    return null;
+}
+export function kiroHasRunHere(home = homedir(), env = process.env, os = platform()) {
+    const data = kiroDataDir(home, env, os);
+    return data ? existsSync(join(data, "data.sqlite3")) : existsSync(kiroDir(home, env));
+}
+export const KIRO_WORKER_AGENT = "pantheon-worker";
+export const KIRO_WORKER_SERVER = "pantheon";
+export const KIRO_WORKER_TOOLS = ["read", "write", "grep", "glob"];
 function readCopilotConfig() {
     try {
         const doc = JSON.parse(readFileSync(join(copilotHome(), "config.json"), "utf8"));

package/dist/cli.js

@@ -442,6 +442,8 @@ function printReady(tools) {
             oneTime.set("cursor", `cursor   enable the "pantheon" MCP server if it asks`);
         if (/codex/i.test(t.tool))
             oneTime.set("codex", `codex    run /hooks inside codex once to approve the wake-up hook`);
+        if (/kiro/i.test(t.tool))
+            oneTime.set("kiro", `kiro     run kiro-cli chat --agent pantheon (or kiro-cli agent set-default pantheon) to keep working while a teammate waits; stay signed in — a woken run never starts Kiro signed out, since Kiro would open a browser`);
         if (/copilot/i.test(t.tool))
             oneTime.set("copilot", `copilot  say yes once when it asks to trust this folder; on a Copilot Business or Enterprise plan an org owner must have the "MCP servers in Copilot" policy on`);
     }
@@ -501,7 +503,7 @@ ${B("control")}
   pantheon admit <who>        let someone in       (--may-wake to allow unattended work here)
   pantheon admit <who> --revoke     remove them
   pantheon worker             stay answerable while you are away
-                            (--agent claude-code|codex|cursor|copilot|auto, --persona <name>)
+                            (--agent claude-code|codex|cursor|copilot|kiro|auto, --persona <name>)
   pantheon policy             what this machine's worker may do, in one screen (grant/revoke self-upgrade)
   pantheon persona            how a woken worker should behave: list / init <name> / show <name>
   pantheon notifier           alert you when a task requires your decision
@@ -514,7 +516,7 @@ ${B("control")}
   pantheon approvals          decisions waiting on you; show or answer one
   pantheon stop [relay|worker|notifier|menubar|all]  stop it
   pantheon hook install       your agent keeps working when a peer is waiting on it
-                            (auto-detects claude / codex / cursor / copilot on this machine)
+                            (auto-detects claude / codex / cursor / copilot / kiro on this machine)
   pantheon spend              woken runs on this machine, and what pantheon cannot see
   pantheon leave              remove what pantheon put on this machine
   pantheon panic              cut off all unattended work on this machine, now
@@ -1332,13 +1334,13 @@ async function main() {
             const sub = argv[1] ?? "status";
             const hookCfg = resolveForHook();
             const sessionOf = (raw) => {
+                let fromJson;
                 try {
                     const j = JSON.parse(raw);
-                    return j.session_id ?? j.sessionId ?? j.conversation_id ?? "unknown";
-                }
-                catch {
-                    return "unknown";
+                    fromJson = j.session_id ?? j.sessionId ?? j.conversation_id;
                 }
+                catch { }
+                return fromJson ?? process.env.KIRO_SESSION_ID ?? "unknown";
             };
             const reportIdle = async (session, seen) => {
                 if (!hookCfg)
@@ -1353,6 +1355,22 @@ async function main() {
                 }
                 return false;
             };
+            if (sub === "kiro-prompt") {
+                let raw = "";
+                try {
+                    for await (const chunk of process.stdin)
+                        raw += chunk;
+                }
+                catch { }
+                try {
+                    if (hookCfg) {
+                        const { reportActivity } = await import("./pending.js");
+                        await reportActivity({ cfg: hookCfg, session: `hook:${sessionOf(raw)}`, state: "busy" });
+                    }
+                }
+                catch { }
+                process.exit(0);
+            }
             if (sub === "prompt") {
                 let raw = "";
                 try {
@@ -1462,7 +1480,7 @@ async function main() {
                     process.exit(0);
                 }
             }
-            if (sub === "codex-stop" || sub === "copilot-stop") {
+            if (sub === "codex-stop" || sub === "copilot-stop" || sub === "kiro-stop") {
                 let raw = "";
                 try {
                     for await (const chunk of process.stdin)
@@ -1571,7 +1589,7 @@ async function main() {
             }
             const states = agentHookStates();
             if (!states.length) {
-                console.log(`${D("not installed")}\n  Install with: ${C("pantheon hook install")} (auto-detects claude / codex / cursor / copilot on PATH)`);
+                console.log(`${D("not installed")}\n  Install with: ${C("pantheon hook install")} (auto-detects claude / codex / cursor / copilot / kiro on PATH)`);
                 return;
             }
             for (const s of states) {
@@ -1654,7 +1672,7 @@ async function main() {
             else {
                 console.error(`  config: none to remove`);
             }
-            console.error(`\n  ${D("Not touched: the MCP entries in Claude Code and Cursor (pantheon install wrote them; remove them there),")}`);
+            console.error(`\n  ${D("Not touched: the MCP entries in Claude Code, Cursor, Copilot, VS Code and Kiro (pantheon install wrote them; remove them there),")}`);
             console.error(`  ${D("the relay's ledger on disk, and anything you pushed to git. Codex's entry and approval line were removed above.")}`);
             if (cfg) {
                 console.error(`\n  ${D(`Your teammates still list you in "${cfg.space}". Ask one of them to run:`)}`);
@@ -2021,7 +2039,7 @@ async function main() {
                 const publicChange = name !== undefined || title !== undefined || responsibilities !== undefined ||
                     humanRequired !== undefined || agentCanDecide !== undefined || capabilities !== undefined || keywords !== undefined;
                 if (!surface && !publicChange) {
-                    die("usage: pantheon profile set [--surface codex|claude-code|cursor|copilot] [--name name] [--title title] [--responsibilities a,b] [--human-required a,b] [--agent-can-decide a,b] [--keywords 'domain=word|word;domain=word']");
+                    die("usage: pantheon profile set [--surface codex|claude-code|cursor|copilot|kiro] [--name name] [--title title] [--responsibilities a,b] [--human-required a,b] [--agent-can-decide a,b] [--keywords 'domain=word|word;domain=word']");
                 }
                 if (flag("space")) {
                     const pf = loadAll() ?? die("not configured");
@@ -2462,7 +2480,7 @@ async function main() {
                 if (hud.prompt) {
                     const agent = pickExplainAgent(hud.tool ?? p.agent.primary_surface, detectAvailable());
                     if (!agent)
-                        die("no agent CLI found on this machine (claude, cursor-agent, codex, or copilot)");
+                        die("no agent CLI found on this machine (claude, cursor-agent, codex, copilot, or kiro-cli)");
                     console.error(D(`opening ${agent.id}…`));
                     const { spawnSync } = await import("node:child_process");
                     {
@@ -2494,7 +2512,7 @@ async function main() {
             }
             const agent = pickExplainAgent(loadProfile(cfg).agent.primary_surface, detectAvailable());
             if (!agent)
-                die("no agent CLI found on this machine (claude, cursor-agent, codex, or copilot)");
+                die("no agent CLI found on this machine (claude, cursor-agent, codex, copilot, or kiro-cli)");
             console.error(D(`opening ${agent.id} with the question…`));
             const { spawnSync } = await import("node:child_process");
             {

package/dist/doctor.js

@@ -1,3 +1,4 @@
+import { kiroDefaultIsPantheon, readKiroAgent, kiroAgentFile } from "./kiro-files.js";
 import { execFileSync } from "node:child_process";
 import { instructionBudget } from "./mcp-instructions.js";
 import { describeWindows, scanMcpWindows } from "./mcp-windows.js";
@@ -14,7 +15,7 @@ import { approvalSummary, chosenApproval, onPath } from "./install.js";
 import { hookState, readIntent, agentHookStates } from "./notify.js";
 import { loadPersonas } from "./persona.js";
 import { workerProc, menubarProc, notifierProc } from "./machine.js";
-import { chooseAgent, describeChoice } from "./agents.js";
+import { chooseAgent, describeChoice, unattendedRefusal } from "./agents.js";
 import { onPathNamed } from "./which.js";
 import { VERSION } from "./version.js";
 import { serviceInstalled, servicesUnavailable } from "./service.js";
@@ -156,10 +157,10 @@ export async function doctor(projectDir) {
         if (branch)
             add("pass", "git branch", branch);
     }
-    const agents = ["claude", "codex", "cursor-agent", "copilot"].filter((a) => onPathNamed(a));
+    const agents = ["claude", "codex", "cursor-agent", "copilot", "kiro-cli"].filter((a) => onPathNamed(a));
     agents.length
         ? add("pass", "agent cli", agents.join(", "), undefined, agents.join(", "))
-        : add("warn", "agent cli", "found none of claude / codex / cursor-agent / copilot on PATH", "fine if you only drive agents through a GUI (Conductor, Cursor, VS Code), but `pantheon worker` needs a CLI to spawn", "none of claude / codex / cursor-agent / copilot on PATH");
+        : add("warn", "agent cli", "found none of claude / codex / cursor-agent / copilot / kiro-cli on PATH", "fine if you only drive agents through a GUI (Conductor, Cursor, VS Code, the Kiro IDE), but `pantheon worker` needs a CLI to spawn", "none of claude / codex / cursor-agent / copilot / kiro-cli on PATH");
     if (agents.length) {
         try {
             const choice = chooseAgent("auto", { prefer: prof.agent.primary_surface });
@@ -167,7 +168,10 @@ export async function doctor(projectDir) {
             const bad = choice.signIn && !choice.signIn.ok && !choice.signIn.unknown;
             const fellBack = !!prof.agent.primary_surface && choice.backend.id !== prof.agent.primary_surface && agents.length > 0;
             const shareLine = `${choice.backend.label} — ${choice.signIn?.detail ?? "not checked"}${choice.skipped.length ? `; ${choice.skipped.length} skipped (not signed in)` : ""}`;
-            if (bad)
+            const refused = unattendedRefusal(choice);
+            if (refused)
+                add("warn", "worker agent", line, `woken runs are refused here, not tried: ${refused}`, shareLine);
+            else if (bad)
                 add("warn", "worker agent", line, `nothing is signed in, so every woken run here fails until you sign in: ${choice.skipped.map((x) => x.why).join("; ") || "sign in to the agent CLI"}`, shareLine);
             else if (fellBack)
                 add("warn", "worker agent", line, `you chose ${prof.agent.primary_surface} at setup; runs use ${choice.backend.label} until it is signed in again`, shareLine);
@@ -175,7 +179,13 @@ export async function doctor(projectDir) {
                 add("pass", "worker agent", line, undefined, shareLine);
         }
         catch (e) {
-            add("warn", "worker agent", e.message, "pantheon setup --agent <claude-code|codex|cursor|copilot> names one that is installed", "could not be chosen");
+            add("warn", "worker agent", e.message, "pantheon setup --agent <claude-code|codex|cursor|copilot|kiro> names one that is installed", "could not be chosen");
+        }
+    }
+    {
+        const here = readKiroAgent(kiroAgentFile(join(projectDir, ".kiro")));
+        if (here && !here.ours) {
+            add("warn", "kiro agent", "this repo defines its own agent called pantheon — Kiro uses it instead of yours in this repo", "workspace agents win over your own in Kiro; read .kiro/agents/pantheon.json before running kiro-cli chat --agent pantheon here", "this repo defines its own pantheon agent");
         }
     }
     const budget = instructionBudget(cfg);
@@ -302,7 +312,7 @@ export async function doctor(projectDir) {
         }
     }
     if (!hookStates.length && !hook.installed) {
-        add("warn", "wake-up hook", "not installed — your agent will not notice a peer's message until you ask it to", "pantheon hook install --user (auto-detects claude / codex / cursor / copilot on PATH)", "not installed");
+        add("warn", "wake-up hook", "not installed — your agent will not notice a peer's message until you ask it to", "pantheon hook install --user (auto-detects claude / codex / cursor / copilot / kiro on PATH)", "not installed");
     }
     else if (!reportsActivity) {
         add("warn", "wake-up hook", `installed (${hook.events?.join(", ")}) but predates the activity hook, so a worker cannot tell your idle editor from one you are using`, "re-run `pantheon hook install --user` to add the UserPromptSubmit half", `installed (${hook.events?.join(", ")}), predates the activity hook`);
@@ -316,6 +326,11 @@ export async function doctor(projectDir) {
     if (hookStates.some((s) => s.agent === "codex")) {
         add("warn", "codex hooks", "installed — but codex skips new or changed hooks until they are approved", "run /hooks inside codex once to approve them (needs codex ≥ 0.115; sessions still report presence over MCP either way)", "installed, not yet approved inside codex");
     }
+    if (hookStates.some((s) => s.agent === "kiro")) {
+        kiroDefaultIsPantheon()
+            ? add("pass", "kiro hooks", "in the pantheon agent, which is your Kiro default — every kiro-cli chat keeps working while a teammate waits", undefined, "in the pantheon agent, the default")
+            : add("warn", "kiro hooks", "in the pantheon agent — used only when you run kiro-cli chat --agent pantheon", "kiro-cli agent set-default pantheon makes it every session; without it, Kiro sessions still report presence but end their turn with a teammate waiting", "in the pantheon agent, not the default");
+    }
     const personas = loadPersonas(projectDir);
     if (personas.length) {
         const broken = personas.filter((p) => p.warnings.length);

package/dist/hooks-install.js

@@ -2,7 +2,8 @@ import { readFileSync, writeFileSync, existsSync, mkdirSync, rmSync } from "node
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { MAX_CONSECUTIVE_BLOCKS, isOurHookCommand } from "./notify.js";
-import { copilotHome } from "./agents.js";
+import { copilotHome, kiroHome } from "./agents.js";
+import { KIRO_AGENT_NAME, kiroAgentFile, kiroAgentDoc, readKiroAgent, writeKiroAgent, kiroDefaultIsPantheon } from "./kiro-files.js";
 function ours(cmd) {
     return isOurHookCommand(cmd);
 }
@@ -247,4 +248,48 @@ export function removeCopilotHooks(projectDir = process.cwd()) {
     }
     return out;
 }
+export { KIRO_AGENT_NAME };
+export function kiroAgentPath(scope, projectDir = process.cwd()) {
+    return kiroAgentFile(scope === "user" ? kiroHome() : join(projectDir, ".kiro"));
+}
+export function kiroHookState(scope, projectDir = process.cwd()) {
+    const file = kiroAgentPath(scope, projectDir);
+    const a = readKiroAgent(file);
+    return a?.ours
+        ? { agent: "kiro", label: "Kiro", installed: true, scope, file, events: a.events }
+        : { agent: "kiro", label: "Kiro", installed: false };
+}
+export function installKiroHooks(bin, scope, projectDir = process.cwd(), allowed = []) {
+    const file = kiroAgentPath(scope, projectDir);
+    const a = readKiroAgent(file);
+    if (a && !a.ours)
+        return [`  skipped    ${file} is an agent called "${KIRO_AGENT_NAME}" that pantheon did not write — left as it is`];
+    writeKiroAgent(file, kiroAgentDoc(bin, allowed));
+    return [
+        `  ${a ? "updated" : "installed"}  ${file}   (an agent: Kiro's default, plus pantheon's hooks)`,
+        `  runs       ${bin} hook kiro-stop`,
+        `             ${bin} hook kiro-prompt`,
+        kiroDefaultIsPantheon()
+            ? `  ${""}(it is your default agent, so every kiro-cli chat uses it)`
+            : `  \x1b[33mKiro uses these only in the pantheon agent:\x1b[0m kiro-cli chat --agent pantheon`,
+        ...(kiroDefaultIsPantheon() ? [] : [`  ${""}(or always: kiro-cli agent set-default pantheon — pantheon never changes your default)`]),
+    ];
+}
+export function removeKiroHooks(projectDir = process.cwd()) {
+    const out = [];
+    for (const scope of ["project", "user"]) {
+        const file = kiroAgentPath(scope, projectDir);
+        if (!kiroHookState(scope, projectDir).installed)
+            continue;
+        try {
+            rmSync(file, { force: true });
+            out.push(`  removed ${file}`);
+        }
+        catch { }
+    }
+    if (out.length && kiroDefaultIsPantheon()) {
+        out.push("  Kiro's default was the pantheon agent; it now falls back to kiro_default and warns each session — kiro-cli agent set-default kiro_default");
+    }
+    return out;
+}
 //# sourceMappingURL=hooks-install.js.map

package/dist/install.js

@@ -4,11 +4,12 @@ import { homedir, platform } from "node:os";
 import { join, dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { grantToolPermissions, claudeSettingsFile, cursorCliConfigFile } from "./grants.js";
-import { PANTHEON_TOOL_NAMES, WRITE_TOOL_NAMES } from "./tools.js";
+import { PANTHEON_TOOL_NAMES, WRITE_TOOL_NAMES, toolsAllowed } from "./tools.js";
 import { load } from "./config.js";
 import { loadProfile } from "./profile.js";
 import { agentSpawn, onPathNamed, which } from "./which.js";
 import { FEEDBACK_ADDRESS } from "./feedback.js";
+import { kiroDir, kiroAgentFile, refreshKiroAgentAllowed } from "./kiro-files.js";
 const HERE = dirname(fileURLToPath(import.meta.url));
 export function onPath() {
     return onPathNamed("pantheon");
@@ -40,7 +41,7 @@ function mergeMcpJson(file, entry, shape = {}) {
     const existed = existsSync(file);
     doc.mcpServers ??= {};
     const before = JSON.stringify(doc.mcpServers["pantheon"] ?? null);
-    doc.mcpServers["pantheon"] = { ...shape, ...entry, env: {} };
+    doc.mcpServers["pantheon"] = { ...shape, ...entry, env: shape.env ?? {} };
     if (before === JSON.stringify(doc.mcpServers["pantheon"]))
         return "unchanged";
     mkdirSync(dirname(file), { recursive: true });
@@ -61,6 +62,12 @@ export function mergeVsCodeMcpJson(file, entry) {
     return existed ? "updated" : "created";
 }
 export const copilotMcpConfigFile = (home = homedir(), env = process.env) => join(env.COPILOT_HOME || join(home, ".copilot"), "mcp-config.json");
+export { kiroDir };
+export const kiroMcpConfigFile = (home = homedir(), env = process.env) => join(kiroDir(home, env), "settings", "mcp.json");
+export const kiroEntryShape = (approval) => ({
+    autoApprove: toolsAllowed(approval),
+    env: { PANTHEON_AGENT: "kiro" },
+});
 export function vsCodeUserDir(home = homedir(), os = platform(), env = process.env) {
     const dir = os === "darwin" ? join(home, "Library", "Application Support", "Code", "User")
         : os === "win32" ? join(env.APPDATA || join(home, "AppData", "Roaming"), "Code", "User")
@@ -131,6 +138,9 @@ export function install(projectDir, cfg, force, os = platform(), claudeLocal = c
         if (existsSync(p) || f === "AGENTS.md")
             out.push(`  ${f.padEnd(25)} ${upsertBrief(p, cfg)}   (the collaboration brief)`);
     }
+    if (existsSync(kiroDir()) || onPathNamed("kiro-cli")) {
+        out.push(`  .kiro/settings/mcp.json   ${"not used".padEnd(9)} Kiro reads ~/.kiro/settings/mcp.json, which pantheon join wrote — a repo copy would override each teammate's own   (kiro)`);
+    }
     out.push("");
     out.push("  Copilot asks once to trust this folder before it reads the repo's MCP servers and hooks.");
     out.push("  Codex reads ~/.codex/config.toml, which `pantheon join` already wrote at user scope.");
@@ -251,6 +261,21 @@ function copilotUserScope(entry) {
         return { tool, where: file, status: `failed: ${e.message}` };
     }
 }
+function kiroUserScope(entry, approval) {
+    const tool = "kiro";
+    const file = kiroMcpConfigFile();
+    if (!existsSync(kiroDir()) && !onPathNamed("kiro-cli"))
+        return { tool, where: "-", status: "skipped (kiro-cli not on PATH)" };
+    try {
+        const status = mergeMcpJson(file, entry, kiroEntryShape(approval));
+        const agent = refreshKiroAgentAllowed(kiroAgentFile(kiroDir()), toolsAllowed(approval));
+        const which = approval === "ask-before-sending" ? "reads run without asking; send, open_goal and claim prompt" : `the ${PANTHEON_TOOL_NAMES.length} pantheon tools run without asking`;
+        return { tool, where: file, status: `${status} — in the Kiro IDE, ${which}${agent === "absent" ? "; the CLI asks per call unless you use the pantheon agent (pantheon hook install)" : `; in the CLI's pantheon agent too (${agent})`}` };
+    }
+    catch (e) {
+        return { tool, where: file, status: `failed: ${e.message}` };
+    }
+}
 function vsCodeUserScope(entry) {
     const tool = "vs code";
     const dir = vsCodeUserDir();
@@ -268,7 +293,7 @@ export const CODEX_APPROVAL_LINE = `default_tools_approval_mode = "approve"`;
 export function approvalSummary(approval) {
     return approval === "ask-before-sending"
         ? `your agent asks you before each send, goal or claim in your name; reading and waiting run without a prompt. Unattended runs keep their own per-run approvals — this governs the agent you sit in front of`
-        : `pantheon's ${PANTHEON_TOOL_NAMES.length} tools run without a per-call prompt in Claude Code, Cursor and Codex — your agent coordinates for you without stopping to ask. Copilot has no allow-list file: it asks once per tool per folder and remembers your answer`;
+        : `pantheon's ${PANTHEON_TOOL_NAMES.length} tools run without a per-call prompt in Claude Code, Cursor, Codex, the Kiro IDE and Kiro's pantheon agent — your agent coordinates for you without stopping to ask. Copilot has no allow-list file: it asks once per tool per folder and remembers your answer; Kiro's default CLI agent asks per call`;
 }
 export function codexTomlBlock(entry, env = { PANTHEON_AGENT: "codex" }, approval = "approve") {
     const envToml = Object.entries(env)
@@ -466,7 +491,7 @@ export function installForUser(approval = chosenApproval()) {
     const entry = userEntry();
     return [
         claudeUserScope(entry), cursorUserScope(entry), codexUserScope(entry, approval),
-        copilotUserScope(entry), vsCodeUserScope(entry),
+        copilotUserScope(entry), vsCodeUserScope(entry), kiroUserScope(entry, approval),
         ...grantToolPermissions(approval).map((g) => ({
             tool: g.tool,
             where: g.tool.startsWith("claude") ? claudeSettingsFile() : cursorCliConfigFile(),

package/dist/kiro-files.js

@@ -0,0 +1,56 @@
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+export const kiroDir = (home = homedir(), env = process.env) => env.KIRO_HOME || join(home, ".kiro");
+export const KIRO_AGENT_NAME = "pantheon";
+export const kiroAgentFile = (kiroBase) => join(kiroBase, "agents", `${KIRO_AGENT_NAME}.json`);
+export const isOurKiroHook = (cmd) => !!cmd && /\bhook\s+kiro-(?:prompt|stop)\b/.test(cmd);
+export const kiroAllowed = (tools) => tools.map((t) => `@pantheon/${t}`);
+export function kiroAgentDoc(bin, allowed) {
+    return {
+        name: KIRO_AGENT_NAME,
+        description: "Kiro's default agent, plus Pantheon: its tools run without asking, and a turn is held open while a teammate is waiting on you",
+        tools: ["*"],
+        allowedTools: kiroAllowed(allowed),
+        includeMcpJson: true,
+        hooks: {
+            userPromptSubmit: [{ command: `${bin} hook kiro-prompt >/dev/null 2>&1` }],
+            stop: [{ command: `${bin} hook kiro-stop` }],
+        },
+    };
+}
+export function readKiroAgent(file) {
+    if (!existsSync(file))
+        return null;
+    try {
+        const doc = JSON.parse(readFileSync(file, "utf8"));
+        const events = Object.entries(doc.hooks ?? {}).filter(([, es]) => (es ?? []).some((h) => isOurKiroHook(h.command))).map(([e]) => e);
+        return { doc, ours: events.length > 0, events };
+    }
+    catch {
+        return { doc: {}, ours: false, events: [] };
+    }
+}
+export function writeKiroAgent(file, doc) {
+    mkdirSync(dirname(file), { recursive: true });
+    writeFileSync(file, JSON.stringify(doc, null, 2) + "\n");
+}
+export function refreshKiroAgentAllowed(file, allowed) {
+    const a = readKiroAgent(file);
+    if (!a?.ours)
+        return "absent";
+    const want = kiroAllowed(allowed);
+    if (JSON.stringify(a.doc.allowedTools) === JSON.stringify(want))
+        return "unchanged";
+    writeKiroAgent(file, { ...a.doc, allowedTools: want });
+    return "updated";
+}
+export function kiroDefaultIsPantheon(base = kiroDir()) {
+    try {
+        return JSON.parse(readFileSync(join(base, "settings", "cli.json"), "utf8"))["chat.defaultAgent"] === KIRO_AGENT_NAME;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=kiro-files.js.map

package/dist/machine.js

@@ -4,7 +4,7 @@ import { homedir, platform } from "node:os";
 import { join } from "node:path";
 import { CONFIG_DIR } from "./config.js";
 import { plistPath } from "./service.js";
-import { copilotMcpConfigFile, vsCodeUserDir } from "./install.js";
+import { copilotMcpConfigFile, vsCodeUserDir, kiroMcpConfigFile, kiroDir } from "./install.js";
 const sh = (cmd) => {
     try {
         return execFileSync("sh", ["-lc", cmd], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || null;
@@ -120,6 +120,10 @@ export function wiring() {
         const f = join(vscodeDir, "mcp.json");
         out.push({ tool: "vs code", state: existsSync(f) && /"pantheon"/.test(readFileSync(f, "utf8")) ? "wired" : "not wired" });
     }
+    if (existsSync(kiroDir())) {
+        const f = kiroMcpConfigFile();
+        out.push({ tool: "kiro", state: existsSync(f) && /"pantheon"/.test(readFileSync(f, "utf8")) ? "wired" : "not wired" });
+    }
     return out;
 }
 export function logFileFor(kind, proc) {

package/dist/measure.js

@@ -3,7 +3,7 @@ import { existsSync } from "node:fs";
 import { resolve, dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { claudeGrantedEffective, cursorGrantedEffective, claudeAllow, cursorAllow, isServerWide } from "./grants.js";
-import { codexApprovalState, copilotMcpConfigFile } from "./install.js";
+import { codexApprovalState, copilotMcpConfigFile, kiroMcpConfigFile } from "./install.js";
 import { existsSync as fileExists, readFileSync } from "node:fs";
 import { dirname as dirOf } from "node:path";
 import { PANTHEON_TOOL_NAMES, WRITE_TOOL_NAMES } from "./tools.js";
@@ -161,13 +161,41 @@ export function toolsReport(registered, seen, approval, opts = {}) {
     }
     const copilot = seen.copilot === undefined || seen.copilot === null ? null
         : seen.copilot ? "Copilot wired (it asks once per tool per folder and remembers)" : "Copilot has no pantheon entry";
-    const detail = `${head}; ${claude.text}, ${cursor.text}, ${codex}${copilot ? `, ${copilot}` : ""}`;
+    let kiro = null;
+    if (seen.kiro === "absent")
+        kiro = "Kiro has no pantheon entry";
+    else if (Array.isArray(seen.kiro)) {
+        const want = [...(approval === "ask-before-sending" ? PANTHEON_TOOL_NAMES.filter((t) => !WRITE_TOOL_NAMES.includes(t)) : PANTHEON_TOOL_NAMES)].sort();
+        const have = [...new Set(seen.kiro)].filter((t) => t.startsWith("pantheon_")).sort();
+        const extra = have.filter((t) => !want.includes(t)), missing = want.filter((t) => !have.includes(t));
+        if (!extra.length && !missing.length)
+            kiro = `Kiro IDE allows ${have.length}`;
+        else {
+            kiro = `Kiro IDE allows ${have.length}${missing.length ? `, missing ${missing.map((t) => t.replace(/^pantheon_/, "")).join(", ")}` : ""}${extra.length ? `, and allows ${extra.map((t) => t.replace(/^pantheon_/, "")).join(", ")} you chose to be asked about` : ""}`;
+            problems.push("Kiro's autoApprove does not match");
+        }
+    }
+    const detail = `${head}; ${claude.text}, ${cursor.text}, ${codex}${copilot ? `, ${copilot}` : ""}${kiro ? `, ${kiro}` : ""}`;
     if (!problems.length)
         return { level: "pass", detail };
     return { level: "warn", detail, fix: `${problems.join("; ")} — pantheon install --user rewrites every grant in your own settings to match this build and your approval choice; a rule in this repo's .claude/settings*.json or .cursor/cli.json is yours to edit by hand` };
 }
 export function grantsSeen(projectDir = null) {
-    return { claude: claudeGrantedEffective(projectDir), cursor: cursorGrantedEffective(projectDir), codex: codexApprovalState(), copilot: copilotWired() };
+    return { claude: claudeGrantedEffective(projectDir), cursor: cursorGrantedEffective(projectDir), codex: codexApprovalState(), copilot: copilotWired(), kiro: kiroApproved() };
+}
+export function kiroApproved(file = kiroMcpConfigFile()) {
+    if (!fileExists(dirOf(dirOf(file))))
+        return null;
+    try {
+        const doc = JSON.parse(readFileSync(file, "utf8"));
+        const entry = doc.mcpServers?.["pantheon"];
+        if (!entry)
+            return "absent";
+        return Array.isArray(entry.autoApprove) ? entry.autoApprove.filter((t) => typeof t === "string") : [];
+    }
+    catch {
+        return "absent";
+    }
 }
 export function copilotWired(file = copilotMcpConfigFile()) {
     if (!fileExists(dirOf(file)))

package/dist/notice.js

@@ -1,5 +1,5 @@
 import { decisionPrompt, decisionTitle } from "./decision-ui.js";
-export const TOOL_LABELS = { "claude-code": "Claude Code", codex: "Codex", cursor: "Cursor", copilot: "Copilot", grok: "Grok" };
+export const TOOL_LABELS = { "claude-code": "Claude Code", codex: "Codex", cursor: "Cursor", copilot: "Copilot", kiro: "Kiro", grok: "Grok" };
 export const APP_TOOLS = [
     { id: "cursor-app", label: "Cursor app", kind: "app", bundle: "com.todesktop.230313mzl4w4u92", deeplink: "cursor://anysphere.cursor-deeplink/prompt?text={prompt}" },
     { id: "claude-app", label: "Claude app · question copied", kind: "app", bundle: "com.anthropic.claudefordesktop" },
@@ -67,6 +67,8 @@ const agentLabel = (agent) => {
         return "Cursor";
     if (a.includes("copilot"))
         return "Copilot";
+    if (a.includes("kiro"))
+        return "Kiro";
     return null;
 };
 function whoLine(from, agent, ts, now) {

package/dist/notify.js

@@ -1,12 +1,14 @@
+import { chosenApproval } from "./install.js";
+import { toolsAllowed } from "./tools.js";
 import { readFileSync, writeFileSync, existsSync, mkdirSync, rmSync } from "node:fs";
 import { homedir, platform } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { whichPantheon } from "./service.js";
 import { detectForHooks, agentById } from "./agents.js";
-import { codexHookState, cursorHookState, copilotHookState, installCodexHooks, installCursorHooks, installCopilotHooks, removeCodexHooks, removeCursorHooks, removeCopilotHooks, } from "./hooks-install.js";
+import { codexHookState, cursorHookState, copilotHookState, kiroHookState, installCodexHooks, installCursorHooks, installCopilotHooks, installKiroHooks, removeCodexHooks, removeCursorHooks, removeCopilotHooks, removeKiroHooks, } from "./hooks-install.js";
 export const HOOK_MARKER = "pantheon hook";
-export const HOOK_RE = /(?:pantheon(?:\.cmd|\.exe|\.bat)?"?\s+hook\s|cli\.js"?\s+hook\s+(?:stop|prompt|end|codex-stop|copilot-stop|cursor-stop)\b)/i;
+export const HOOK_RE = /(?:pantheon(?:\.cmd|\.exe|\.bat)?"?\s+hook\s|cli\.js"?\s+hook\s+(?:stop|prompt|end|codex-stop|copilot-stop|cursor-stop|kiro-stop|kiro-prompt)\b)/i;
 export const isOurHookCommand = (cmd) => !!cmd && (cmd.includes(HOOK_MARKER) || HOOK_RE.test(cmd));
 export const hookBin = (bin) => (/\s/.test(bin) ? `"${bin}"` : bin);
 const HERE = dirname(fileURLToPath(import.meta.url));
@@ -108,6 +110,9 @@ export function agentHookStates(projectDir = process.cwd(), only) {
         const copilot = copilotHookState(scope, projectDir);
         if (copilot.installed)
             out.push(copilot);
+        const kiro = kiroHookState(scope, projectDir);
+        if (kiro.installed)
+            out.push(kiro);
     }
     const byAgent = new Map();
     for (const s of out) {
@@ -133,6 +138,8 @@ export function repairHook(home) {
             missing.push(id);
         if (id === "copilot" && !copilotHookState(intent.scope, projectDir).installed)
             missing.push(id);
+        if (id === "kiro" && !kiroHookState(intent.scope, projectDir).installed)
+            missing.push(id);
     }
     if (!missing.length)
         return null;
@@ -184,7 +191,7 @@ export function installHooks(scope, projectDir = process.cwd(), only) {
         ? only.map((id) => agentById(id)).filter((b) => !!b)
         : available;
     if (!pick.length) {
-        throw new Error("no agent found — install claude, codex, cursor-agent, or copilot, or open a project that already uses one");
+        throw new Error("no agent found — install claude, codex, cursor-agent, copilot, or kiro-cli, or open a project that already uses one");
     }
     const lines = [];
     const agents = [];
@@ -206,6 +213,10 @@ export function installHooks(scope, projectDir = process.cwd(), only) {
             lines.push(...installCopilotHooks(bin, scope, projectDir));
             agents.push("copilot");
         }
+        else if (backend.id === "kiro") {
+            lines.push(...installKiroHooks(bin, scope, projectDir, toolsAllowed(chosenApproval())));
+            agents.push("kiro");
+        }
     }
     lines.push(`  effect     when your agent tries to finish, it checks whether a peer is waiting`, `             on you — and keeps going instead of leaving them hanging.`, `             it also reports when a turn starts and ends, so a worker can tell`, `             an idle editor from one you are actually using.`);
     return { lines, agents };
@@ -219,6 +230,7 @@ export function removeHook(projectDir = process.cwd()) {
     out.push(...removeCodexHooks(projectDir));
     out.push(...removeCursorHooks(projectDir));
     out.push(...removeCopilotHooks(projectDir));
+    out.push(...removeKiroHooks(projectDir));
     return out.length ? out : ["  nothing installed"];
 }
 function removeClaudeHook(projectDir = process.cwd()) {

package/dist/persona.js

@@ -170,7 +170,7 @@ export const PERSONA_TEMPLATE = `---
 # wake_by: alice, bob          # only these peers' requests are handled by this persona
 # kinds: ANSWER, ACCEPT        # ANSWER (asks), ACCEPT (verdicts), REVISE (objections), CONTINUE (replies/deliveries)
 # goals: launch-*              # only goals whose id or title matches
-# agent: auto                  # claude-code | codex | cursor | copilot | auto
+# agent: auto                  # claude-code | codex | cursor | copilot | kiro | auto
 ---
 Say how this worker should behave when it is woken while you are away — what it
 should take on, what it should refuse, and where its judgment ends and yours

package/dist/profile.js

@@ -1,12 +1,13 @@
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { CONFIG_DIR } from "./config.js";
-export const AGENT_SURFACES = ["codex", "claude-code", "cursor", "copilot"];
+export const AGENT_SURFACES = ["codex", "claude-code", "cursor", "copilot", "kiro"];
 export const SURFACE_BUNDLE_IDS = {
     codex: "com.openai.codex",
     "claude-code": "com.anthropic.claudefordesktop",
     cursor: "com.todesktop.230313mzl4w4u92",
     copilot: "com.microsoft.VSCode",
+    kiro: "com.amazon.codewhisperer",
 };
 export const profilePath = (home = CONFIG_DIR) => join(home, "profile.json");
 export function isAgentSurface(value) {
@@ -17,6 +18,8 @@ export function surfaceFromAgent(agent) {
         return "cursor";
     if (agent && /copilot/i.test(agent))
         return "copilot";
+    if (agent && /kiro/i.test(agent))
+        return "kiro";
     if (agent && /claude/i.test(agent))
         return "claude-code";
     return "codex";

package/dist/run-failure.js

@@ -5,6 +5,7 @@ export const SIGN_IN_FIX = {
     codex: "run `codex login`",
     cursor: "run `cursor-agent login`",
     copilot: "run `copilot login` (or `gh auth login` — copilot uses gh's sign-in too)",
+    kiro: "run `kiro-cli login` (or set KIRO_API_KEY)",
 };
 const sh = (dir, ...args) => execFileSync("git", ["-C", dir, ...args], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5_000 }).trim();
 export const gitProbe = {

package/dist/setup-guide.js

@@ -195,7 +195,7 @@ export async function runGuide(io, ctx, deps = {}, preset = {}) {
                     : "only people you approve by hand (pantheon admit <name> --may-wake)"}`);
         io.say(`  • Alerts: ${shortAlert(a.notifications).toLowerCase()}`);
         io.say(`  • Approval: ${a.approval === "approve"
-            ? "your agent sends to teammates in your name without asking each time (Claude Code, Cursor and Codex; Copilot asks once per tool per folder)"
+            ? "your agent sends to teammates in your name without asking each time (Claude Code, Cursor, Codex, and Kiro's IDE and pantheon agent; Copilot asks once per tool per folder)"
             : "your agent asks you before each send, goal and claim; reading and waiting never prompt"}`);
         io.say(`  • Decisions: ${a.decides.length ? `you personally decide ${a.decides.join(", ")}` : "none reserved for you — your agent may decide; add an area when one comes up"}`);
         if (a.wake !== "no" && ctx.project)

package/dist/tray.js

@@ -144,7 +144,7 @@ async function trayStatusOne(cfg) {
     ];
     const profile = loadProfile(cfg);
     const surface = profile.agent.primary_surface;
-    const surfaceName = surface === "claude-code" ? "Claude" : surface === "cursor" ? "Cursor" : surface === "copilot" ? "Copilot" : "Codex";
+    const surfaceName = surface === "claude-code" ? "Claude" : surface === "cursor" ? "Cursor" : surface === "copilot" ? "Copilot" : surface === "kiro" ? "Kiro" : "Codex";
     const rawWorkerState = workerState();
     return {
         configured: true,

package/dist/worker.js

@@ -4,7 +4,7 @@ import { mkdirSync, writeFileSync, existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
 import { PantheonClient } from "./client.js";
-import { headlessSpawn, materializeSpawnFiles, chooseAgent, describeChoice } from "./agents.js";
+import { headlessSpawn, materializeSpawnFiles, chooseAgent, describeChoice, unattendedRefusal } from "./agents.js";
 import { agentSpawn } from "./which.js";
 import { VERSION } from "./version.js";
 import { applyAnswer, loadPolicy, mayAsk, needsSelfUpgrade, recordAsk, savePolicy, useGrant, } from "./worker-policy.js";
@@ -604,6 +604,9 @@ export class Worker {
                     this.opts.log(`  agent   ${said}`);
                     this.lastAgentSaid = said;
                 }
+                const refused = unattendedRefusal(choice);
+                if (refused)
+                    throw new Error(refused);
                 const plan = headlessSpawn({ backend: choice.backend, binary: choice.binary, prompt: brief, worktree, cfg: this.cfg, branch, allowBash, runHome });
                 materializeSpawnFiles(worktree, plan);
                 ({ command, args, env } = { command: plan.command, args: plan.args, env: { ...env, ...plan.env } });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@join-pantheon/cli",
-  "version": "0.26.5",
+  "version": "0.27.0",
   "description": "Let your coding agent collaborate directly with your teammates' agents — ask, agree an interface, and deliver, without a human relaying messages.",
   "type": "module",
   "bin": {