@saadnvd1/agent-os 0.3.534 → 0.3.537

package/README.md

@@ -134,7 +134,8 @@ Pi,
 [Kilo Code CLI](https://kilo.ai/docs/cli),
 [Gemini CLI](https://github.com/google-gemini/gemini-cli),
 [Aider](https://aider.chat/), [Cursor CLI](https://cursor.com/cli), Amp or
-[GitHub Copilot CLI](https://github.com/github/copilot-cli).
+[GitHub Copilot CLI](https://github.com/github/copilot-cli) or
+[Kiro CLI](https://kiro.dev/docs/cli/).
 
 ```bash
 npm install -g @saadnvd1/agent-os
@@ -250,10 +251,21 @@ CLI) with the fix for anything missing (`/api/doctor`).
 | Amp            | ❌   | ✅     | ❌   | `--dangerously-allow-all`                    |
 | Oh My Pi       | ❌   | ❌     | ❌   | N/A                                          |
 | GitHub Copilot | ✅   | ✅     | ❌   | `--allow-all`                                |
+| Kiro CLI       | ❌   | ❌     | ❌   | `--trust-all-tools`                          |
+| Amazon Q (old) | ❌   | ❌     | ❌   | `--trust-all-tools`                          |
 
 Agents without chat run in the terminal. The new-session picker says when an
 agent isn't installed or needs a sign-in first, and what to run.
 
+Kiro CLI (and the older Amazon Q CLI, `q`, shown only where it is installed)
+signs in on its own: a session first checks `whoami`, and if you're signed out
+runs `login --use-device-flow`. AgentOS reads the link and one-time code off
+the screen and shows them in a card above the terminal, with a push when it's
+waiting, so you can finish on your phone. No credential passes through
+AgentOS. Identity Center sign-in (including Microsoft or Okta federation) works
+this way; a login through an external identity provider doesn't support the
+device flow, so sign in once on the machine itself, or set `KIRO_API_KEY`.
+
 ### CLI
 
 ```bash
@@ -969,8 +981,12 @@ name, a time (presets for hourly, daily, weekdays and weekly, or any
 five-field cron expression, in America/Chicago unless you pick another zone),
 a project and a prompt, and starts one of:
 
-- **Task**: a background task that ends in a pull request, as above.
-- **Session**: a chat session in the project that runs the prompt and stays.
+- **Task** and **Session**: now recipes (Settings > Recipes) with a timer.
+  Migration 81 turned each existing recurring task or session schedule into a
+  recipe, with its run history; the Schedules form no longer offers them. A
+  one-off that still has one of these kinds is left as it was. To undo the
+  move, stop AgentOS and run
+  `npx tsx scripts/revert-schedules-move.ts --db <path to agent-os.db>`.
 - **Orchestrator**: the prompt, posted to the workspace's orchestrator as a
   message from "Schedule <name>", marked as a scheduled prompt so it never
   counts as an approval.

package/app/page.tsx

@@ -302,7 +302,7 @@ function HomeContent() {
         isLocal && provider.id === "claude"
           ? ` --append-system-prompt-file "$HOME/.agent-os/bus-brief.md" ${CLAUDE_STATUS_SETTINGS_FLAG}`
           : "";
-      const agentCmd = `${provider.command} ${flagsStr}${busBrief}`;
+      const agentCmd = `${provider.preamble}${provider.command} ${flagsStr}${busBrief}`;
       // The init script is a file on this machine, so remote sessions run the
       // agent directly and drop to a shell when it exits.
       const command =

package/components/Pane/index.tsx

@@ -2,6 +2,8 @@
 
 import { useTaskLogQuery } from "@/data/session-logs";
 import { SetupCard } from "@/components/Chat/SetupCard";
+import { SignInCard } from "@/components/Terminal/SignInCard";
+import { getProviderDefinition } from "@/lib/providers/registry";
 import type { TabData } from "@/lib/panes";
 import { useRef, useCallback, useEffect, memo, useMemo } from "react";
 import dynamic from "next/dynamic";
@@ -322,28 +324,34 @@ export const Pane = memo(function Pane({
         </div>
       );
     const savedState = sessionRegistry.getTerminalState(paneId, tab.id);
+    const signInAgent = own ? getProviderDefinition(own.agent_type) : undefined;
     return (
-      <Terminal
-        ref={getTerminalRef(tab.id)}
-        onConnected={getTerminalConnectedHandler(tab)}
-        onBeforeUnmount={(scrollState) => {
-          sessionRegistry.saveTerminalState(paneId, tab.id, {
-            scrollTop: scrollState.scrollTop,
-            scrollHeight: 0,
-            lastActivity: Date.now(),
-            cursorY: scrollState.cursorY,
-          });
-        }}
-        initialScrollState={
-          savedState
-            ? {
-                scrollTop: savedState.scrollTop,
-                cursorY: savedState.cursorY,
-                baseY: 0,
-              }
-            : undefined
-        }
-      />
+      <div className="relative h-full w-full">
+        {signInAgent?.signIn && own && (
+          <SignInCard sessionId={own.id} agent={signInAgent.name} />
+        )}
+        <Terminal
+          ref={getTerminalRef(tab.id)}
+          onConnected={getTerminalConnectedHandler(tab)}
+          onBeforeUnmount={(scrollState) => {
+            sessionRegistry.saveTerminalState(paneId, tab.id, {
+              scrollTop: scrollState.scrollTop,
+              scrollHeight: 0,
+              lastActivity: Date.now(),
+              cursorY: scrollState.cursorY,
+            });
+          }}
+          initialScrollState={
+            savedState
+              ? {
+                  scrollTop: savedState.scrollTop,
+                  cursorY: savedState.cursorY,
+                  baseY: 0,
+                }
+              : undefined
+          }
+        />
+      </div>
     );
   };
 

package/components/Schedules/ScheduleForm.tsx

@@ -34,6 +34,7 @@ import {
   wall,
   type PresetKind,
 } from "@/lib/schedules/cron";
+import { recipesUiActions } from "@/stores/recipesUi";
 import { parseWhen, relativeTime } from "@/lib/schedules/when";
 
 const KINDS: { value: ScheduleKind; label: string; hint: string }[] = [
@@ -59,6 +60,10 @@ const KINDS: { value: ScheduleKind; label: string; hint: string }[] = [
   },
 ];
 
+// New jobs of these shapes are recipes; the kinds stay only to edit a
+// schedule that still has one (a one-off, say).
+const LEGACY_KINDS: ScheduleKind[] = ["task", "session"];
+
 type Preset = PresetKind | "custom" | "once";
 
 const PRESETS: { value: Preset; label: string }[] = [
@@ -171,7 +176,7 @@ export function ScheduleForm({
   );
   const [name, setName] = useState(existing?.name ?? draft?.name ?? "");
   const [kind, setKind] = useState<ScheduleKind>(
-    existing?.kind ?? draft?.kind ?? "task"
+    existing?.kind ?? draft?.kind ?? "orchestrator"
   );
   const [targetId, setTargetId] = useState(
     existing?.target_session_id ?? draft?.targetSessionId ?? ""
@@ -329,7 +334,9 @@ export function ScheduleForm({
         <Segmented
           label="What it starts"
           value={kind}
-          options={KINDS}
+          options={KINDS.filter(
+            (k) => !LEGACY_KINDS.includes(k.value) || existing?.kind === k.value
+          )}
           onChange={(k) => {
             setKind(k);
             if (preset === "every" && !frequent(k)) setPreset("daily");
@@ -338,6 +345,17 @@ export function ScheduleForm({
         <p className="text-muted-foreground text-xs">
           {KINDS.find((k) => k.value === kind)?.hint}
         </p>
+        <p className="text-muted-foreground text-xs">
+          To start a task or session on a timer, use a{" "}
+          <button
+            type="button"
+            className="text-foreground underline underline-offset-2"
+            onClick={() => recipesUiActions.open(workspaceId ?? null)}
+          >
+            recipe
+          </button>
+          .
+        </p>
       </Field>
 
       {!workspaceId && (

package/components/Terminal/SignInCard.tsx

@@ -0,0 +1,84 @@
+"use client";
+
+import { useState } from "react";
+import { ExternalLink, X } from "lucide-react";
+import { useSignIn } from "@/data/statuses/useSignIn";
+import { trustedSignInUrl } from "@/lib/agents/signin-screen";
+import { CopyButton } from "@/components/Chat/CopyButton";
+
+// Finishing an agent's sign-in from this device: the link to open and the
+// code to type there. The text is the CLI's own, so a link is only opened
+// when it points at a sign-in page; anything else stays text to copy.
+export function SignInCard({
+  sessionId,
+  agent,
+}: {
+  sessionId: string;
+  agent: string;
+}) {
+  const signIn = useSignIn(sessionId);
+  // Hidden until the sign-in shows something new.
+  const [hidden, setHidden] = useState("");
+  if (!signIn) return null;
+  const { url, code } = signIn;
+  const key = `${url}|${code}`;
+  if (hidden === key) return null;
+  return (
+    <div
+      role="status"
+      className="bg-card hairline absolute inset-x-2 top-2 z-10 flex flex-col gap-3 rounded-lg p-3 shadow-lg"
+    >
+      <div>
+        <div className="flex items-center justify-between gap-2">
+          <p className="text-sm font-medium">Sign in to {agent}</p>
+          <button
+            type="button"
+            aria-label="Dismiss"
+            onClick={() => setHidden(key)}
+            className="text-muted-foreground hover:text-foreground -m-2 flex h-11 w-11 items-center justify-center"
+          >
+            <X className="size-4" />
+          </button>
+        </div>
+        <p className="text-muted-foreground text-xs">
+          Finish signing in on any device; the session carries on by itself.
+        </p>
+      </div>
+      {code && (
+        <div className="flex items-center justify-between gap-2">
+          <span className="font-mono text-2xl tracking-widest select-all">
+            {code}
+          </span>
+          <CopyButton
+            text={code}
+            label="Copy code"
+            className="h-11 w-11 md:h-11 md:w-11"
+          />
+        </div>
+      )}
+      {url &&
+        (trustedSignInUrl(url) ? (
+          <a
+            href={url}
+            target="_blank"
+            rel="noopener noreferrer"
+            className="bg-primary text-primary-foreground flex h-11 items-center justify-center gap-2 rounded-lg text-sm font-medium"
+          >
+            Open sign-in page
+            <ExternalLink className="size-4" />
+          </a>
+        ) : (
+          <div className="flex items-center gap-2">
+            <span className="text-muted-foreground min-w-0 flex-1 text-xs break-all select-all">
+              {url}
+            </span>
+            <CopyButton
+              text={url}
+              label="Copy link"
+              className="h-11 w-11 md:h-11 md:w-11"
+            />
+          </div>
+        ))}
+    </div>
+  );
+}

package/components/Welcome/AgentList.tsx

@@ -23,7 +23,9 @@ export function AgentList() {
 
   useEffect(() => mutate(), [mutate]);
 
-  const providers = getAllProviderDefinitions().filter((p) => p.cli);
+  const providers = getAllProviderDefinitions().filter(
+    (p) => p.cli && (!p.legacy || agents?.[p.id]?.installed)
+  );
   const shown = providers.filter((p) => all || FEATURED_AGENTS.includes(p.id));
   const hidden = providers.length - shown.length;
 

package/components/views/types.ts

@@ -20,6 +20,8 @@ export interface SessionStatus {
   claudeSessionId?: string | null;
   // From a program's OSC 7501 report: untrusted, rendered as plain text.
   detail?: string | null;
+  // The link and code a CLI's sign-in is waiting on (untrusted text).
+  signIn?: { url: string | null; code: string | null } | null;
   progress?: number | null;
 }
 

package/data/statuses/useSignIn.ts

@@ -0,0 +1,16 @@
+import { useQuery } from "@tanstack/react-query";
+import type { SessionStatus } from "@/components/views/types";
+import { statusKeys } from "../sessions/keys";
+import { fetchStatuses } from "./queries";
+
+// The sign-in a session's CLI is waiting on, read from the statuses the
+// sidebar already keeps; asks for nothing of its own.
+export function useSignIn(sessionId: string): SessionStatus["signIn"] {
+  const { data } = useQuery({
+    queryKey: statusKeys.all,
+    queryFn: fetchStatuses,
+    staleTime: 2000,
+    select: (d) => d.statuses[sessionId]?.signIn ?? null,
+  });
+  return data;
+}

package/lib/__fixtures__/screens/kiro-device-login.txt

@@ -0,0 +1,10 @@
+Logging in to Kiro
+
+Confirm the code in your browser:
+
+    ABCD-EFGH
+
+Open this URL to continue:
+https://view.awsapps.com/start/#/device?user_code=ABCD-EFGH
+
+Waiting for authorization...

package/lib/agent-options.ts

@@ -13,6 +13,8 @@ export const AGENT_OPTIONS: { value: AgentType; label: string }[] = [
   { value: "pi", label: "Pi" },
   { value: "omp", label: "Oh My Pi" },
   { value: "copilot", label: "GitHub Copilot" },
+  { value: "kiro", label: "Kiro CLI" },
+  { value: "amazonq", label: "Amazon Q CLI (legacy)" },
 ];
 
 export const agentLabel = (agent: AgentType) =>

package/lib/agents/probe.ts

@@ -87,6 +87,31 @@ function claudeAuth(env: NodeJS.ProcessEnv): AgentAuth {
   return hasJsonKeys(config) ? "needs-login" : "unknown";
 }
 
+// Signed in when `cli args` exits 0. Timing out or failing to start tells
+// nothing; any other exit code is the CLI saying it isn't signed in.
+async function exitAuth(
+  cli: string,
+  env: NodeJS.ProcessEnv,
+  args: string[],
+  signedOut: (code: unknown) => boolean
+): Promise<AgentAuth> {
+  try {
+    await run(cli, args, { timeout: PROBE_MS, env });
+    return "ready";
+  } catch (error) {
+    return signedOut((error as { code?: unknown }).code)
+      ? "needs-login"
+      : "unknown";
+  }
+}
+
+// Kiro's `whoami` is never read, only its exit code: its output names the
+// account.
+const kiroAuth: AuthCheck = (cli, env) =>
+  anyEnv(env, ["KIRO_API_KEY"])
+    ? "ready"
+    : exitAuth(cli, env, ["whoami"], (c) => typeof c === "number" && c !== 0);
+
 const AUTH: Partial<Record<ProviderId, { check: AuthCheck; hint: string }>> = {
   claude: {
     check: (_cli, env) => claudeAuth(env),
@@ -94,16 +119,8 @@ const AUTH: Partial<Record<ProviderId, { check: AuthCheck; hint: string }>> = {
   },
   codex: {
     // Exits 0 signed in, 1 not.
-    check: async (cli, env) => {
-      try {
-        await run(cli, ["login", "status"], { timeout: PROBE_MS, env });
-        return "ready";
-      } catch (error) {
-        return (error as { code?: unknown }).code === 1
-          ? "needs-login"
-          : "unknown";
-      }
-    },
+    check: (cli, env) =>
+      exitAuth(cli, env, ["login", "status"], (c) => c === 1),
     hint: "Run `codex login` in a terminal",
   },
   // OpenCode's own free models need no sign-in.
@@ -153,6 +170,15 @@ const AUTH: Partial<Record<ProviderId, { check: AuthCheck; hint: string }>> = {
         : "needs-login",
     hint: "Run `cursor-agent login` in a terminal",
   },
+  kiro: {
+    check: kiroAuth,
+    hint: "Run `kiro-cli login --use-device-flow` in a terminal, or set KIRO_API_KEY",
+  },
+  amazonq: {
+    check: (cli, env) =>
+      exitAuth(cli, env, ["whoami"], (c) => typeof c === "number" && c !== 0),
+    hint: "Run `q login --use-device-flow` in a terminal",
+  },
   amp: {
     check: (_cli, env) =>
       hasJsonKeys(home(".local", "share", "amp", "secrets.json")) ||

package/lib/agents/setup-commands.ts

@@ -34,6 +34,15 @@ export const SETUP_COMMANDS: Partial<Record<ProviderId, SetupCommands>> = {
     install: "npm install -g @github/copilot",
     signIn: "copilot login",
   },
+  kiro: {
+    install: "curl -fsSL https://cli.kiro.dev/install | bash",
+    signIn: "kiro-cli login --use-device-flow",
+    docs: "https://kiro.dev/docs/cli/",
+  },
+  amazonq: {
+    signIn: "q login --use-device-flow",
+    docs: "https://kiro.dev/docs/cli/",
+  },
   // No installer line we can vouch for from here; its own site has it.
   opencode: { docs: "https://opencode.ai/docs" },
 };

package/lib/agents/signin-screen.ts

@@ -0,0 +1,109 @@
+/**
+ * The sign-in a CLI is waiting on, read from its screen: the link to open
+ * and the one-time code to type there (a device flow), so a device can
+ * finish it. Only the stretch of screen between the two lines a session
+ * prints around its login is read, so the agent's own output (links and the
+ * word "code" are everywhere in it) is never taken for a sign-in. What's
+ * there is the CLI's own output, so nothing is trusted: a link is only
+ * offered to open when its host is a sign-in page.
+ */
+
+// Printed by the session before the login and after it, whatever it did.
+export const SIGN_IN_START = "AgentOS: signing in";
+export const SIGN_IN_END = "AgentOS: sign-in finished";
+
+export interface SignInScreen {
+  url: string | null;
+  code: string | null;
+}
+
+const CUE = /verif|authori[sz]|one.?time|confirm|enter|code|open/i;
+const DONE = /logged in|signed in|success/i;
+const URL_LINE = /https:\/\/\S+/;
+const CODE_IN_URL = /user_code=([A-Z0-9-]{6,12})/;
+const CODE_LINE = /\b([A-Z0-9]{4}-[A-Z0-9]{4})\b/;
+const BARE_CODE = /^[A-Z0-9]{4}-[A-Z0-9]{4}$/;
+const URL_PIECE = /^[\w\-./?=&%#:+~@]+$/;
+// A URL cut by the pane's width: the piece before the cut ran this long.
+const WRAPPED_AT = 30;
+const LOOKBACK = 30;
+const NEAR = 3;
+
+// Where a device flow sends you: AWS's device-authorization page, the
+// Builder ID and Identity Center portals, and Kiro's own login. Not every
+// AWS host: S3 buckets and API gateways are anyone's.
+const TRUSTED_HOSTS = [
+  /^device\.sso\.[a-z0-9-]+\.amazonaws\.com$/,
+  /^view\.awsapps\.com$/,
+  /^d-[a-z0-9]+\.awsapps\.com$/,
+  /^([a-z0-9-]+\.)?kiro\.dev$/,
+];
+
+export function trustedSignInUrl(url: string): boolean {
+  try {
+    const u = new URL(url);
+    return (
+      u.protocol === "https:" &&
+      !u.username &&
+      !u.password &&
+      TRUSTED_HOSTS.some((h) => h.test(u.hostname))
+    );
+  } catch {
+    return false;
+  }
+}
+
+// Lines of the screen, with a URL the pane cut across lines put back.
+function joined(lines: string[]): string[] {
+  const out: string[] = [];
+  for (let i = 0; i < lines.length; i++) {
+    let line = lines[i].trim();
+    const at = line.search(URL_LINE);
+    if (at >= 0 && !/\s/.test(line.slice(at))) {
+      let last = line.slice(at);
+      for (;;) {
+        const next = lines[i + 1]?.trim() ?? "";
+        if (
+          last.length < WRAPPED_AT ||
+          !URL_PIECE.test(next) ||
+          BARE_CODE.test(next)
+        )
+          break;
+        line += next;
+        last = next;
+        i++;
+      }
+    }
+    out.push(line);
+  }
+  return out;
+}
+
+export function findSignIn(text: string): SignInScreen | null {
+  const all = text.split("\n");
+  const start = all.findLastIndex((l) => l.includes(SIGN_IN_START));
+  if (start < 0) return null;
+  const during = all.slice(start + 1);
+  if (during.some((l) => l.includes(SIGN_IN_END))) return null;
+  const lines = joined(during.slice(-LOOKBACK));
+  let found: { at: number; url: string } | null = null;
+  lines.forEach((line, at) => {
+    const url = line.match(URL_LINE)?.[0].replace(/[).,;]+$/, "");
+    if (!url) return;
+    const near = lines.slice(Math.max(0, at - NEAR), at + NEAR + 1);
+    if (near.some((l) => CUE.test(l))) found = { at, url };
+  });
+  if (!found) return null;
+  const { at, url } = found as { at: number; url: string };
+  if (lines.slice(at + 1).some((l) => DONE.test(l))) return null;
+  let code = url.match(CODE_IN_URL)?.[1] ?? null;
+  if (!code)
+    for (const l of lines.slice(Math.max(0, at - NEAR), at + NEAR + 1)) {
+      const m = l.match(CODE_LINE);
+      if (m && l !== url) {
+        code = m[1];
+        break;
+      }
+    }
+  return { url, code };
+}

package/lib/banner.ts

@@ -8,7 +8,10 @@ import * as path from "path";
 /**
  * Generate an init script that shows the AgentOS banner and configures tmux
  */
-function generateInitScript(agentCommand: string): string {
+export function generateInitScript(
+  agentCommand: string,
+  preamble = ""
+): string {
   return `#!/bin/bash
 # AgentOS Session Init Script
 # Auto-generated - do not edit manually
@@ -47,15 +50,15 @@ printf "\\n"
 sleep 0.8
 
 # Start the agent
-exec ${agentCommand}
+${preamble}exec ${agentCommand}
 `;
 }
 
 /**
  * Write init script to temp file and return the command to run it
  */
-export function wrapWithBanner(agentCommand: string): string {
-  const scriptContent = generateInitScript(agentCommand);
+export function wrapWithBanner(agentCommand: string, preamble = ""): string {
+  const scriptContent = generateInitScript(agentCommand, preamble);
   const scriptPath = path.join(os.tmpdir(), `agent-os-init-${Date.now()}.sh`);
 
   fs.writeFileSync(scriptPath, scriptContent, { mode: 0o755 });

package/lib/db/migrations.ts

@@ -8,6 +8,7 @@ import {
   TABLES_WATCHED_80,
 } from "./changes";
 import type Database from "better-sqlite3";
+import { moveSchedulesToRecipes } from "./schedules-move";
 
 interface Migration {
   id: number;
@@ -1957,6 +1958,21 @@ const migrations: Migration[] = [
       installChangeTriggers(db, TABLES_WATCHED_80);
     },
   },
+  {
+    id: 81,
+    name: "schedules_into_recipes",
+    up: (db) => {
+      // Live task and session schedules become recipes with a timer, and
+      // their runs become recipe runs (lib/db/schedules-move). Reversible:
+      // scripts/revert-schedules-move.ts.
+      const cols = (
+        db.prepare(`PRAGMA table_info(schedules)`).all() as { name: string }[]
+      ).map((c) => c.name);
+      if (!cols.includes("recipe_id") || !cols.includes("migrated_from_kind"))
+        throw new Error("migration 80 hasn't run");
+      moveSchedulesToRecipes(db);
+    },
+  },
 ];
 
 // `upTo`: stop after this id (tests that start from an older database).

package/lib/db/schedules-move.ts

@@ -0,0 +1,220 @@
+// Migration 81: live task and session schedules become recipes with a timer
+// (lib/recipes), and their runs become recipe runs. `migrated_from_kind` on
+// the schedule row is what makes it reversible: revertSchedulesMove.
+//
+// A one-off (run_at) and an archived schedule are left as they are: a timer
+// repeats, and history of archived ones stays where it was.
+
+import { randomUUID } from "crypto";
+import type Database from "better-sqlite3";
+
+interface ScheduleRow {
+  id: string;
+  workspace_id: string;
+  project_id: string | null;
+  name: string;
+  prompt: string;
+  kind: "task" | "session";
+  created_by_session_id: string | null;
+  created_at: string;
+}
+
+interface RunRow {
+  id: number;
+  trigger: string;
+  session_id: string;
+  created_at: string;
+  task_status: string | null;
+  pr_number: number | null;
+  pr_url: string | null;
+  session_exists: number;
+}
+
+const TRIGGER: Record<string, string> = {
+  schedule: "timer",
+  "catch-up": "catch-up",
+  manual: "manual",
+};
+
+const FINAL: Record<string, string> = {
+  merged: "succeeded",
+  done: "succeeded",
+  dropped: "failed",
+};
+
+// The name is unique among a workspace's live recipes, ignoring case.
+function freeName(
+  db: Database.Database,
+  workspaceId: string,
+  name: string
+): string {
+  const taken = db.prepare(
+    `SELECT 1 FROM recipes WHERE workspace_id = ? AND archived_at IS NULL AND name = ? COLLATE NOCASE`
+  );
+  if (!taken.get(workspaceId, name)) return name;
+  for (let n = 1; ; n++) {
+    const candidate = `${name} (schedule${n > 1 ? ` ${n}` : ""})`;
+    if (!taken.get(workspaceId, candidate)) return candidate;
+  }
+}
+
+export function moveSchedulesToRecipes(db: Database.Database): {
+  schedules: number;
+  runs: number;
+} {
+  const sessionCols = (
+    db.prepare(`PRAGMA table_info(sessions)`).all() as { name: string }[]
+  ).map((c) => c.name);
+  const pr = sessionCols.includes("pr_number")
+    ? "s.pr_number, s.pr_url"
+    : "NULL AS pr_number, NULL AS pr_url";
+  const hasTaskStatus = sessionCols.includes("task_status");
+
+  const schedules = db
+    .prepare(
+      `SELECT id, workspace_id, project_id, name, prompt, kind, created_by_session_id, created_at
+         FROM schedules
+        WHERE archived_at IS NULL AND kind IN ('task','session')
+          AND run_at IS NULL AND project_id IS NOT NULL
+        ORDER BY created_at, id`
+    )
+    .all() as ScheduleRow[];
+
+  const insertRecipe = db.prepare(
+    `INSERT INTO recipes (id, workspace_id, project_id, name, kind, brief, model, view, created_by_session_id, updated_by_session_id, created_at)
+     VALUES (?, ?, ?, ?, ?, ?, NULL, 'chat', ?, ?, ?)`
+  );
+  const insertRevision = db.prepare(
+    `INSERT INTO recipe_revisions (recipe_id, brief, settings, edited_by_session_id) VALUES (?, ?, ?, ?)`
+  );
+  const switchSchedule = db.prepare(
+    `UPDATE schedules SET kind = 'recipe', recipe_id = ?, migrated_from_kind = ?, updated_at = datetime('now') WHERE id = ?`
+  );
+  const runsOf = db.prepare(
+    `SELECT r.id, r.trigger, r.session_id, r.created_at,
+            ${hasTaskStatus ? "s.task_status" : "NULL"} AS task_status, ${pr},
+            s.id IS NOT NULL AS session_exists
+       FROM schedule_runs r LEFT JOIN sessions s ON s.id = r.session_id
+      WHERE r.schedule_id = ? AND r.session_id IS NOT NULL
+      ORDER BY r.id`
+  );
+  const insertRun = db.prepare(
+    `INSERT INTO recipe_runs (recipe_id, seq, trigger, schedule_run_id, prompt, status, session_id, pr_number, pr_url, summary, started_at, created_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+  );
+
+  let movedRuns = 0;
+  const move = db.transaction(() => {
+    for (const s of schedules) {
+      const recipeId = randomUUID();
+      insertRecipe.run(
+        recipeId,
+        s.workspace_id,
+        s.project_id,
+        freeName(db, s.workspace_id, s.name),
+        s.kind,
+        s.prompt,
+        s.created_by_session_id,
+        s.created_by_session_id,
+        s.created_at
+      );
+      insertRevision.run(
+        recipeId,
+        s.prompt,
+        JSON.stringify({
+          kind: s.kind,
+          model: null,
+          view: "chat",
+          auto_done: true,
+          max_minutes: null,
+        }),
+        s.created_by_session_id
+      );
+      switchSchedule.run(recipeId, s.kind, s.id);
+
+      const runs = runsOf.all(s.id) as RunRow[];
+      runs.forEach((r, i) => {
+        // One live run per recipe: only the latest may still be running
+        // (settle judges it); an earlier one with no recorded end is
+        // closed as cancelled rather than guessed a result.
+        const final = r.task_status ? FINAL[r.task_status] : undefined;
+        const last = i === runs.length - 1;
+        const status = final ?? (last ? "running" : "cancelled");
+        insertRun.run(
+          recipeId,
+          i + 1,
+          TRIGGER[r.trigger] ?? "timer",
+          r.id,
+          s.prompt,
+          status,
+          r.session_id,
+          r.pr_number,
+          r.pr_url,
+          status === "cancelled"
+            ? "Ran before recipes; its outcome wasn't recorded"
+            : null,
+          r.created_at,
+          r.created_at
+        );
+        movedRuns++;
+      });
+    }
+  });
+  move();
+  return { schedules: schedules.length, runs: movedRuns };
+}
+
+// Undo the move: each moved schedule gets its old kind (and the brief as it
+// stands now) back, and the recipes the move made go, with their runs and
+// revisions. The runs stay in schedule_runs, which the move never touched.
+// Migration 81 stays recorded as applied, so a restart doesn't redo it.
+export function revertSchedulesMove(db: Database.Database): {
+  schedules: number;
+} {
+  const moved = db
+    .prepare(
+      `SELECT id, recipe_id, migrated_from_kind FROM schedules WHERE migrated_from_kind IS NOT NULL`
+    )
+    .all() as {
+    id: string;
+    recipe_id: string | null;
+    migrated_from_kind: string;
+  }[];
+  const recipe = db.prepare(
+    `SELECT brief, project_id FROM recipes WHERE id = ?`
+  );
+  const restore = db.prepare(
+    `UPDATE schedules SET kind = ?, recipe_id = NULL, migrated_from_kind = NULL,
+       prompt = COALESCE(?, prompt), project_id = COALESCE(?, project_id), updated_at = datetime('now')
+     WHERE id = ?`
+  );
+  const drop = (table: string) =>
+    db.prepare(`DELETE FROM ${table} WHERE recipe_id = ?`);
+  const [dropRuns, dropRevisions] = [
+    drop("recipe_runs"),
+    drop("recipe_revisions"),
+  ];
+  const dropRecipe = db.prepare(`DELETE FROM recipes WHERE id = ?`);
+
+  db.transaction(() => {
+    for (const s of moved) {
+      const r = s.recipe_id
+        ? (recipe.get(s.recipe_id) as
+            | { brief: string; project_id: string }
+            | undefined)
+        : undefined;
+      restore.run(
+        s.migrated_from_kind,
+        r?.brief ?? null,
+        r?.project_id ?? null,
+        s.id
+      );
+      if (s.recipe_id) {
+        dropRuns.run(s.recipe_id);
+        dropRevisions.run(s.recipe_id);
+        dropRecipe.run(s.recipe_id);
+      }
+    }
+  })();
+  return { schedules: moved.length };
+}

package/lib/orchestration.ts

@@ -168,7 +168,7 @@ export async function spawnWorker(
 
   // Create tmux session with the agent and banner
   const agentCmd = `${provider.command} ${flagsStr}`;
-  const newSessionCmd = wrapWithBanner(agentCmd);
+  const newSessionCmd = wrapWithBanner(agentCmd, provider.preamble);
   try {
     await tmux(["set", "-g", "mouse", "on"]).catch(() => {});
     // The last argument is the agent's command line, which tmux runs.

package/lib/orchestrator/external-gates.ts

@@ -19,6 +19,7 @@ import { resolveAsks } from "./asks";
 import { clearStaleRunning, getCheck } from "./checks";
 import { gateTarget, type ExternalPR } from "./external-pr";
 import { holdingEscalations } from "./gates";
+import { reviewWanted } from "./held-review";
 import { addNote } from "./notes";
 import { commitTime } from "./repo";
 import { review, reviewAt, type ReviewOpts } from "./review";
@@ -154,7 +155,10 @@ export async function reviewExternal(
 ): Promise<string> {
   clearStaleRunning();
   const held = holdingEscalations(ext.id);
-  if (held.length)
+  if (
+    held.length &&
+    !(ext.pr.head && reviewWanted(workspaceId, ext.id, ext.pr.head))
+  )
     return `${ext.name} is with Saad (${held.map((h) => h.gate).join(", ")}); no review needed from you.`;
   if (!ext.pr.head) throw new Error(`${ext.name}'s head commit is unknown`);
   return reviewAt(

package/lib/orchestrator/held-review.ts

@@ -0,0 +1,18 @@
+// A held task is with Saad, so `review` normally has nothing to do. Except
+// when the orchestrator has asked him to merge a commit: sign_off needs a
+// finished review of exactly that commit before an approval of it merges,
+// and a held task would otherwise never get one.
+
+import { latestApproval } from "./ask-approvals";
+import { openBySubject, workSubject } from "./asks";
+
+export function reviewWanted(
+  workspaceId: string,
+  id: string,
+  head: string
+): boolean {
+  const subject = workSubject(id);
+  if (latestApproval(workspaceId, subject)?.sha === head) return true;
+  const open = openBySubject(workspaceId, subject);
+  return open?.raised_by === "orchestrator" && open.sha === head;
+}

package/lib/orchestrator/review.ts

@@ -24,6 +24,7 @@ import { changedFiles, fullDiff } from "./diff";
 import { diffParts } from "./diff-parts";
 import { countFailure, escalate } from "./escalate";
 import { checkGate, holdingEscalations } from "./gates";
+import { reviewWanted } from "./held-review";
 import { mergeApprovalsOn } from "./merge-approvals";
 import {
   baseReviewSkill,
@@ -210,6 +211,8 @@ function countVerdicts(
   target: ReviewTarget,
   sha: string
 ): string {
+  // Held already: the verdict is only stored, for sign_off to read.
+  if (holdingEscalations(target.id).length) return "";
   const escalated: string[] = [];
   for (const gate of ["review", "scope"] as const) {
     if (gate === "scope" && !target.task?.lh_card_id) continue;
@@ -308,11 +311,12 @@ export async function review(
   if (task.task_status !== "running")
     throw new Error(`${task.name} is already ${task.task_status}`);
   const held = holdingEscalations(task.id);
-  if (held.length)
+  const pr = held.length ? await prFor(task, true) : null;
+  if (held.length && !(pr?.head && reviewWanted(workspaceId, task.id, pr.head)))
     return `${task.name} is with Saad (${held.map((h) => h.gate).join(", ")}); no review needed from you.`;
-  const pr = await prFor(task, true);
-  if (!pr?.head) throw new Error(`${task.name} has no PR to review yet`);
-  return reviewAt(workspaceId, taskReviewTarget(task, pr), pr.head, opts);
+  const there = pr ?? (await prFor(task, true));
+  if (!there?.head) throw new Error(`${task.name} has no PR to review yet`);
+  return reviewAt(workspaceId, taskReviewTarget(task, there), there.head, opts);
 }
 
 export function taskReviewTarget(task: Session, pr: TaskPR): ReviewTarget {

package/lib/providers/registry.ts

@@ -16,6 +16,8 @@ export const PROVIDER_IDS = [
   "pi",
   "omp",
   "copilot",
+  "kiro",
+  "amazonq",
   "shell",
 ] as const;
 
@@ -53,6 +55,17 @@ export interface ProviderDefinition {
 
   // Default arguments
   defaultArgs?: string[]; // Always passed to CLI
+
+  // A subcommand that comes before every other argument (`kiro-cli chat`).
+  subcommand?: string[];
+
+  // How to sign in from a terminal: `check` exits 0 when signed in, `login`
+  // prints a link and a code to finish on another device. A session runs
+  // them first, so it never waits on a prompt nobody can see.
+  signIn?: { check: string[]; login: string[] };
+
+  // A superseded CLI, offered only where it is installed.
+  legacy?: boolean;
 }
 
 // The model value that means "whatever the agent itself defaults to".
@@ -63,6 +76,34 @@ export const AGENT_DEFAULT_MODEL = "default";
 export const isAgentModelName = (v: unknown): v is string =>
   typeof v === "string" && /^[A-Za-z0-9][A-Za-z0-9._:/@+-]{0,99}$/.test(v);
 
+const KIRO: ProviderDefinition = {
+  id: "kiro",
+  name: "Kiro CLI",
+  description: "AWS's Kiro CLI (formerly Amazon Q Developer CLI)",
+  cli: "kiro-cli",
+  configDir: "~/.kiro",
+  subcommand: ["chat"],
+  autoApproveFlag: "--trust-all-tools",
+  // `--resume-id` exists, but where Kiro keeps its sessions isn't something
+  // we read yet (lib/providers/resume-ids.ts), so no id ever reaches it.
+  supportsResume: false,
+  supportsFork: false,
+  modelFlag: "--model",
+  initialPromptFlag: "", // Positional argument
+  signIn: { check: ["whoami"], login: ["login", "--use-device-flow"] },
+};
+
+// The same CLI under its old name, with fewer flags.
+const AMAZON_Q: ProviderDefinition = {
+  ...KIRO,
+  id: "amazonq",
+  name: "Amazon Q CLI (legacy)",
+  description: "Amazon Q Developer CLI, replaced by Kiro CLI",
+  cli: "q",
+  configDir: "~/.aws/amazonq",
+  legacy: true,
+};
+
 /**
  * Provider Registry
  * All supported agent providers with their configurations
@@ -211,6 +252,8 @@ export const PROVIDERS: ProviderDefinition[] = [
     modelFlag: "--model",
     initialPromptFlag: "-i",
   },
+  KIRO,
+  AMAZON_Q,
   {
     id: "shell",
     name: "Terminal",

package/lib/providers.ts

@@ -6,6 +6,7 @@
  * into a command line.
  */
 
+import { SIGN_IN_END, SIGN_IN_START } from "./agents/signin-screen";
 import {
   AGENT_DEFAULT_MODEL,
   type ProviderDefinition,
@@ -25,6 +26,8 @@ export interface AgentProvider {
   supportsResume: boolean;
   supportsFork: boolean;
   configDir: string;
+  // Shell that signs in first when the CLI isn't, or "".
+  preamble: string;
   // The CLI's arguments, each already quoted for the shell.
   buildFlags(options: BuildFlagsOptions): string[];
 }
@@ -44,7 +47,7 @@ export function buildArgs(
   def: ProviderDefinition,
   options: BuildFlagsOptions
 ): string[] {
-  const args: string[] = [];
+  const args: string[] = [...(def.subcommand ?? [])];
   if (options.sessionId && def.resumeArgs) {
     args.push(...def.resumeArgs(options.sessionId));
   } else if (options.parentSessionId && def.forkArgs) {
@@ -69,6 +72,20 @@ const SAFE_ARG = /^[\w@%+=:,./-]+$/;
 const quoteArg = (arg: string) =>
   SAFE_ARG.test(arg) ? arg : `'${arg.replace(/'/g, `'\\''`)}'`;
 
+// Signs in when the CLI isn't, between two marker lines the screen reader
+// looks for (lib/agents/signin-screen.ts), and stops if that fails, so the
+// pane shows why instead of a CLI that waits.
+function signInPreamble(def: ProviderDefinition): string {
+  if (!def.signIn) return "";
+  const cli = quoteArg(def.cli);
+  const run = (args: string[]) => [cli, ...args.map(quoteArg)].join(" ");
+  return (
+    `{ ${run(def.signIn.check)} >/dev/null 2>&1 || ` +
+    `{ echo '${SIGN_IN_START}'; ${run(def.signIn.login)}; s=$?; ` +
+    `echo '${SIGN_IN_END}'; [ $s -eq 0 ]; }; } && `
+  );
+}
+
 function toProvider(def: ProviderDefinition): AgentProvider {
   return {
     id: def.id,
@@ -78,6 +95,7 @@ function toProvider(def: ProviderDefinition): AgentProvider {
     supportsResume: def.supportsResume,
     supportsFork: def.supportsFork,
     configDir: def.configDir,
+    preamble: signInPreamble(def),
     buildFlags: (options) => buildArgs(def, options).map(quoteArg),
   };
 }

package/lib/start-options.ts

@@ -6,6 +6,7 @@
  */
 
 import { AGENT_OPTIONS } from "./agent-options";
+import { getProviderDefinition } from "./providers/registry";
 import { probeAgents } from "./agents/probe";
 import { gitCheck } from "./git";
 import { listHosts } from "./hosts";
@@ -64,7 +65,10 @@ export async function startOptions(
           hostId: project.host_id || "local",
         }
       : null,
-    agents: AGENT_OPTIONS.map((a) => ({
+    agents: AGENT_OPTIONS.filter(
+      (a) =>
+        !getProviderDefinition(a.value)?.legacy || probes?.[a.value]?.installed
+    ).map((a) => ({
       value: a.value,
       label: a.label,
       installed: probes?.[a.value]?.installed ?? null,

package/lib/status/collect.ts

@@ -9,6 +9,7 @@ import {
   findQuestion,
   plainText,
   readInputBox,
+  screenText,
   statusDetector,
   sessionKey,
   type SessionStatus,
@@ -16,9 +17,12 @@ import {
 import type { AgentType } from "../providers";
 import {
   getManagedSessionPattern,
+  getProviderDefinition,
   getProviderIdFromSessionName,
   getSessionIdFromName,
 } from "../providers/registry";
+import { findSignIn } from "../agents/signin-screen";
+import { noteWaiting } from "../notify/push/waiting";
 import { getDb } from "../db";
 import { beginPass, chatMemo } from "./incremental";
 import { chatCompacting, chatState } from "../chat/runner";
@@ -72,6 +76,8 @@ export interface SessionStatusResponse {
   prStage?: PrStage;
   // A program's own message (OSC 7501): untrusted, plain text only.
   detail?: string | null;
+  // The link and code a sign-in is waiting on (lib/agents/signin-screen).
+  signIn?: { url: string | null; code: string | null } | null;
   progress?: number | null;
 }
 
@@ -244,6 +250,9 @@ function getAgentTypeFromSessionName(sessionName: string): AgentType {
   return getProviderIdFromSessionName(sessionName) || "claude";
 }
 
+// Sessions whose sign-in has started the wait for you, until it is over.
+const signingIn = new Set<string>();
+
 async function collect(full = false): Promise<StatusSnapshot> {
   const sessions = await getTmuxSessions();
 
@@ -308,6 +317,10 @@ async function collect(full = false): Promise<StatusSnapshot> {
           hostId,
         });
     const id = pane.id;
+    // A CLI that signs in with a link and a code shows them while it works.
+    const signIn = getProviderDefinition(agentType)?.signIn
+      ? findSignIn(screenText(screen))
+      : null;
 
     return {
       sessionName,
@@ -316,6 +329,7 @@ async function collect(full = false): Promise<StatusSnapshot> {
       status,
       program,
       screenNeed,
+      signIn,
       claudeSessionId,
       lastLine: lastLineOf(screen),
       agentType,
@@ -323,6 +337,13 @@ async function collect(full = false): Promise<StatusSnapshot> {
   });
 
   const results = await Promise.all(sessionPromises);
+  // A session killed mid-login can't clear its own wait.
+  const alive = new Set(results.map((r) => r.id));
+  for (const id of signingIn)
+    if (!alive.has(id)) {
+      signingIn.delete(id);
+      noteWaiting(id, false);
+    }
   heuristicBusy = results.some((r) => r.status === "running");
 
   for (const {
@@ -332,6 +353,7 @@ async function collect(full = false): Promise<StatusSnapshot> {
     status,
     program,
     screenNeed,
+    signIn,
     claudeSessionId,
     lastLine,
     agentType,
@@ -344,6 +366,20 @@ async function collect(full = false): Promise<StatusSnapshot> {
       agentType,
       title: statusDetector.titleFor(sessionName, hostId),
     };
+    // Waiting on a sign-in is waiting on you, buzzed after the usual minute.
+    if (signIn) {
+      if (!signingIn.has(id)) noteWaiting(id, true);
+      signingIn.add(id);
+      statusMap[id] = {
+        ...shared,
+        status: "waiting",
+        need: "signin",
+        unread: false,
+        signIn: { url: signIn.url, code: signIn.code },
+      };
+      continue;
+    }
+    if (signingIn.delete(id)) noteWaiting(id, false);
     // A question on screen, or a message typed and never sent: it needs you
     // whether or not you've seen it, like a blocked program.
     const needKey = screenNeed ? `${screenNeed.need}:${screenNeed.detail}` : "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saadnvd1/agent-os",
-  "version": "0.3.534",
+  "version": "0.3.537",
   "description": "Self-hosted web UI for managing Claude Code sessions",
   "bin": {
     "agent-os": "scripts/agent-os"

package/scripts/revert-schedules-move.ts

@@ -0,0 +1,24 @@
+/**
+ * Undoes migration 81: schedules that became recipes get their old kind
+ * (task or session) and brief back, and the recipes the move made are
+ * removed with their runs. Stop AgentOS first; it reads the database too.
+ *
+ *   npx tsx scripts/revert-schedules-move.ts --db <path to agent-os.db>
+ *
+ * Migration 81 stays recorded as applied, so a restart won't redo the move.
+ */
+
+import Database from "better-sqlite3";
+import { revertSchedulesMove } from "../lib/db/schedules-move";
+
+const args = process.argv.slice(2);
+const dbPath = args[args.indexOf("--db") + 1];
+if (!args.includes("--db") || !dbPath || dbPath.startsWith("--")) {
+  console.error("usage: revert-schedules-move.ts --db <path>");
+  process.exit(2);
+}
+
+const db = new Database(dbPath, { fileMustExist: true, timeout: 10000 });
+const { schedules } = revertSchedulesMove(db);
+console.log(`Restored ${schedules} schedule(s) to their old kind.`);
+db.close();

package/scripts/setup.sh

@@ -29,7 +29,7 @@ echo "tmux: $(tmux -V)"
 
 # Check AI coding CLI
 AI_CLI_FOUND=""
-for cli in claude codex opencode kilo gemini aider cursor-agent amp pi omp copilot; do
+for cli in claude codex opencode kilo gemini aider cursor-agent amp pi omp copilot kiro-cli q; do
     if command -v "$cli" &> /dev/null; then
         AI_CLI_FOUND="$AI_CLI_FOUND $cli"
     fi
@@ -37,7 +37,7 @@ done
 
 if [ -z "$AI_CLI_FOUND" ]; then
     echo "Error: no supported AI coding CLI is installed"
-    echo "Install one of: Claude Code, Codex, OpenCode, Kilo Code CLI, Gemini CLI, Aider, Cursor CLI, Amp, Pi, or Oh My Pi"
+    echo "Install one of: Claude Code, Codex, OpenCode, Kilo Code CLI, Gemini CLI, Aider, Cursor CLI, Amp, Pi, Oh My Pi, or Kiro CLI"
     exit 1
 fi
 echo "AI CLI(s):$AI_CLI_FOUND"