@xmemo/client 0.4.155 → 0.4.157

package/README.md

@@ -41,6 +41,8 @@ xmemo setup gemini
 xmemo setup gemini --dry-run
 xmemo setup antigravity
 xmemo setup antigravity --dry-run
+xmemo setup kiro
+xmemo setup kiro --dry-run
 xmemo mcp add antigravity2
 xmemo mcp add antigravity2 --write
 xmemo doctor
@@ -69,8 +71,9 @@ xmemo privacy
 - `xmemo doctor`, `xmemo discovery show`, and `xmemo status` do not send tokens.
 - MCP config generated by the CLI references `XMEMO_KEY` or uses the client's
   MCP OAuth flow; it does not write token values into project files.
-- The CLI generates one stable non-secret `XMEMO_AGENT_INSTANCE_ID` per local
-  client profile and stores it in user-scoped config outside git.
+- The CLI generates one stable non-secret `XMEMO_AGENT_INSTANCE_ID` per device
+  and stores it in user-scoped config outside git. All agents on the same device
+  share this instance ID.
 - `xmemo setup <client>` can install a marker-scoped XMemo memory behavior
   profile for the selected agent. The profile contains instructions only; it
   never embeds token values.
@@ -213,8 +216,8 @@ xmemo mcp add antigravity2 --url https://xmemo.dev --write
 
 The generated config uses `https://xmemo.dev/mcp`, contains no bearer token, and
 expects Antigravity 2.0 to complete MCP OAuth in the browser on first use.
-`XMEMO_AGENT_INSTANCE_ID` is generated and stored as a stable non-secret local
-installation identifier when `--write` is used.
+`XMEMO_AGENT_INSTANCE_ID` is a device-level identifier shared by all agents on
+the same machine, generated and stored when `--write` is used.
 
 ## MCP setup
 
@@ -233,6 +236,7 @@ copilot     ~/.copilot/mcp-config.json
 gemini      ~/.gemini/settings.json
 antigravity ~/.gemini/antigravity/mcp_config.json
 antigravity2 ~/.antigravity2/mcp.json
+kiro        ~/.kiro/settings/mcp.json
 ```
 
 For clients without a verified user-scoped write path, generate a read-only
@@ -242,7 +246,7 @@ template and apply it manually after review:
 xmemo mcp config --client generic --base-url "https://your-private-service.example" --json
 ```
 
-Codex, Cursor, Copilot CLI, Gemini CLI, and Antigravity have write-capable setup
+Codex, Cursor, Copilot CLI, Gemini CLI, Antigravity, and Kiro have write-capable setup
 helpers. Antigravity 2.0 is write-capable through `xmemo mcp add antigravity2
 --write`.
 Other client writes should only be added after their official user-scoped config
@@ -417,6 +421,32 @@ directly, for example with `--url` or `--config` in advanced/multi-client setup.
 The CLI refuses to overwrite an existing `XMemo`, `memory_os`, or `memory-os`
 MCP server entry. Edit the config manually if you need to rotate the endpoint.
 
+### Kiro
+
+Recommended Kiro setup:
+
+```bash
+xmemo setup kiro
+```
+
+`setup kiro` merges an XMemo MCP server into Kiro's user MCP config at
+`~/.kiro/settings/mcp.json`. It writes a remote HTTP server using Kiro's
+standard `url` key plus `X-Memory-OS-Agent-ID` and `X-Memory-OS-Agent-Instance-ID`
+headers. Use `xmemo setup kiro --dry-run` to preview without writing.
+
+The Kiro config includes `Authorization: Bearer ${env:XMEMO_KEY}` so
+authentication uses the environment variable approach. Set your XMemo token with:
+
+```bash
+xmemo login
+# or
+printf '%s\n' 'your-token' | xmemo token add --from-stdin
+```
+
+After setup, restart Kiro or reload MCP servers for the changes to take effect.
+The CLI refuses to overwrite an existing `XMemo`, `memory_os`, or `memory-os`
+MCP server entry. Edit the config manually if you need to rotate the endpoint.
+
 ### Antigravity 2.0
 
 Recommended Antigravity 2.0 setup:
@@ -452,8 +482,8 @@ The generated `XMemo` entry uses hosted HTTP MCP:
 
 No token value is written. Restart Antigravity 2.0 after setup and complete the
 MCP OAuth browser flow on first use. If you use `--write`, the CLI also prepares
-a stable non-secret `XMEMO_AGENT_INSTANCE_ID` for this local Antigravity 2.0
-install so XMemo can attribute activity consistently without embedding secrets.
+a device-level `XMEMO_AGENT_INSTANCE_ID` shared by all agents on the same
+machine so XMemo can attribute activity consistently without embedding secrets.
 
 ## Release model
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xmemo/client",
-  "version": "0.4.155",
+  "version": "0.4.157",
   "description": "Privacy-first CLI and MCP setup helper for XMemo.",
   "type": "module",
   "bin": {
@@ -10,11 +10,12 @@
   "files": [
     "bin",
     "src",
+    "plugins/kiro",
     "README.md",
     "LICENSE"
   ],
   "scripts": {
-    "lint": "node --check bin/memory-os.js && node --check src/cli.js && node --check test/cli.test.js",
+    "lint": "node scripts/check-js.mjs",
     "test": "node --test",
     "pack:dry-run": "npm pack --dry-run",
     "prepublishOnly": "npm run lint && npm test && npm run pack:dry-run"

package/plugins/kiro/.kiro-plugin/power.json

@@ -0,0 +1,35 @@
+{
+  "name": "xmemo",
+  "displayName": "XMemo",
+  "version": "0.1.0",
+  "description": "Connect Kiro to XMemo's hosted, user-owned memory layer for durable project context, coding preferences, decisions, and reusable agent knowledge.",
+  "author": {
+    "name": "XMemo",
+    "email": "support@xmemo.dev"
+  },
+  "publisher": "XMemo",
+  "homepage": "https://xmemo.dev",
+  "repository": "https://github.com/yonro/memory-os-cli",
+  "license": "UNLICENSED",
+  "logo": "assets/logo.svg",
+  "keywords": [
+    "kiro",
+    "power",
+    "mcp",
+    "memory",
+    "agent-memory",
+    "developer-tools",
+    "oauth"
+  ],
+  "category": "Developer Tools",
+  "tags": [
+    "mcp",
+    "memory",
+    "oauth",
+    "developer-tools"
+  ],
+  "steering": [
+    "steering/xmemo-memory.md"
+  ],
+  "mcpServers": "mcp.json"
+}

package/plugins/kiro/CHANGELOG.md

@@ -0,0 +1,9 @@
+# Changelog
+
+## [0.1.0] - 2026-06-08
+
+### Added
+- Initial Kiro Power release
+- XMemo MCP server configuration for Kiro
+- Steering file for memory management workflow
+- OAuth-first authentication support

package/plugins/kiro/LICENSE

@@ -0,0 +1,7 @@
+Copyright (c) Yonro.
+
+All rights reserved.
+
+This package is published as a client distribution artifact for XMemo.
+No license is granted to copy, modify, distribute, sublicense, or use the source
+code except as expressly permitted by Yonro in a separate written agreement.

package/plugins/kiro/POWER.md

@@ -0,0 +1,147 @@
+# XMemo for Kiro
+
+XMemo gives Kiro a hosted, user-owned memory layer for durable project context, coding preferences, decisions, TODOs, and reusable agent knowledge.
+
+## Overview
+
+This Kiro Power integrates XMemo's MCP server to provide persistent memory across your Kiro sessions. XMemo helps Kiro remember:
+
+- **Project context**: Repository conventions, architecture decisions, and verified commands
+- **Coding preferences**: Your approved preferences for code review, testing, and documentation
+- **Decisions**: Important technical decisions that should inform future work
+- **TODOs**: Follow-up tasks and reminders for future sessions
+- **Knowledge**: Reusable agent knowledge and learnings
+
+## Installation
+
+Install this power through Kiro's Powers panel or manually configure:
+
+```bash
+xmemo setup kiro
+```
+
+This command:
+1. Merges XMemo MCP server configuration into `~/.kiro/settings/mcp.json`
+2. Sets up OAuth or environment-variable-based authentication
+3. Adds agent identity headers for attribution
+
+## Authentication
+
+### OAuth (Recommended)
+
+The power uses OAuth by default. On first use, Kiro will open a browser window for you to authorize XMemo access.
+
+### Environment Variable (Alternative)
+
+If OAuth is unavailable, you can use an environment variable:
+
+```bash
+xmemo login
+```
+
+Or manually set your token:
+
+```bash
+printf '%s\n' 'your-token' | xmemo token add --from-stdin
+```
+
+Then set the environment variable:
+
+```bash
+# PowerShell
+[Environment]::SetEnvironmentVariable("XMEMO_KEY", "your-token", "User")
+
+# Bash/Zsh
+export XMEMO_KEY="your-token"
+```
+
+## Usage
+
+Once installed, Kiro will automatically use XMemo when appropriate. The steering file instructs Kiro to:
+
+1. **Recall first**: Search XMemo before making assumptions about preferences or past decisions
+2. **Save durable information**: Remember important context that should persist across sessions
+3. **Keep content useful**: Store concrete facts, decisions, and action items (not chat transcripts)
+4. **Confirm destructive actions**: Ask before deleting or overwriting memory
+
+### Example Prompts
+
+- "Search XMemo for coding style preferences for this project"
+- "Remember in XMemo: Always use TypeScript strict mode in this project"
+- "Recall what I saved about API design patterns"
+- "Create a TODO in XMemo to refactor the auth module next week"
+- "List my XMemo TODOs"
+
+## What Gets Stored
+
+**Good candidates for XMemo:**
+- Repository conventions and verified commands
+- Architecture decisions and design patterns
+- Release procedures and deployment notes
+- User-approved preferences for development practices
+- TODOs and follow-up actions
+
+**Never store:**
+- Secrets, credentials, API keys, or tokens
+- Private customer data or PII
+- Temporary debugging output
+- Chat transcripts or verbose logs
+
+## Configuration
+
+The power installs:
+- **MCP server**: `https://xmemo.dev/mcp`
+- **Steering file**: Auto-included guidance for when to use XMemo
+- **Agent identity**: Headers for attribution (non-secret)
+
+### Manual Configuration
+
+Advanced users can generate a config snippet:
+
+```bash
+xmemo mcp config --client kiro --json
+```
+
+Or see the dry-run preview:
+
+```bash
+xmemo setup kiro --dry-run
+```
+
+## Troubleshooting
+
+### Connection Issues
+
+Check your token status:
+
+```bash
+xmemo auth status
+xmemo token status --verify
+```
+
+### Configuration Issues
+
+View your current MCP config:
+
+```bash
+cat ~/.kiro/settings/mcp.json
+```
+
+### Reset Configuration
+
+To remove XMemo from Kiro, manually edit `~/.kiro/settings/mcp.json` and remove the `XMemo` entry from `mcpServers`.
+
+## Privacy & Security
+
+- No telemetry or analytics
+- OAuth tokens are stored securely by Kiro
+- Agent identity headers are non-secret attribution IDs
+- Environment variable approach keeps tokens out of config files
+- All memory content is user-owned and controlled through your XMemo account
+
+## Support
+
+- **Documentation**: https://xmemo.dev
+- **CLI Help**: `xmemo --help`
+- **Issues**: https://github.com/yonro/memory-os-cli/issues
+- **Email**: support@xmemo.dev

package/plugins/kiro/README.md

@@ -0,0 +1,31 @@
+# XMemo Kiro Power
+
+XMemo gives Kiro a hosted, user-owned memory layer for durable project context, coding preferences, decisions, TODOs, and reusable agent knowledge.
+
+## What it installs
+
+- `mcp.json` adds the hosted XMemo MCP server at `https://xmemo.dev/mcp`.
+- `assets/logo.svg` reuses the canonical XMemo marketplace icon source used by the existing ChatGPT/Claude listing assets.
+- `steering/xmemo-memory.md` tells Kiro when to use XMemo memory.
+
+## Authentication
+
+The Kiro Power is OAuth-first. The power metadata stores only the hosted MCP URL; the first XMemo tool use should open the browser-based OAuth flow. Do not add `Authorization`, `Bearer`, or `XMEMO_KEY` to the power's `mcp.json`.
+
+Manual direct-key fallback remains available through:
+
+```bash
+xmemo mcp config --client kiro --json
+```
+
+Use that fallback only for local/manual installs where Kiro OAuth is unavailable.
+
+## Reviewer smoke prompts
+
+1. "List the XMemo tools you can use in Kiro."
+2. "Search XMemo for coding style preferences for this project."
+3. "Remember in XMemo: For Kiro review, prefer small PRs with validation evidence."
+4. "Recall what I saved about Kiro review PR preferences."
+5. "Create a XMemo memory TODO to capture Kiro review screenshots tomorrow, then list my TODOs."
+
+Use a dedicated reviewer workspace with synthetic data only. Redact emails, OAuth codes, cookies, bearer tokens, trace IDs, internal account IDs, real memory content, and private local paths from evidence.

package/plugins/kiro/SETUP.md

@@ -0,0 +1,234 @@
+# XMemo Kiro Power Setup Guide
+
+This guide walks you through setting up XMemo for Kiro.
+
+## Quick Start
+
+Install and configure XMemo for Kiro in one command:
+
+```bash
+xmemo setup kiro
+```
+
+This will:
+1. Merge XMemo MCP server config into `~/.kiro/settings/mcp.json`
+2. Configure authentication via `XMEMO_KEY` environment variable
+3. Set up agent identity headers for attribution
+
+## Step-by-Step Setup
+
+### 1. Install XMemo CLI
+
+```bash
+npm install -g @xmemo/client
+```
+
+### 2. Authenticate with XMemo
+
+Choose one of these methods:
+
+#### Option A: OAuth Login (Recommended)
+
+```bash
+xmemo login
+```
+
+This opens your browser for secure OAuth authentication.
+
+#### Option B: Direct Token
+
+If you already have a token:
+
+```bash
+printf '%s\n' 'your-token' | xmemo token add --from-stdin
+```
+
+Set the environment variable:
+
+**PowerShell:**
+```powershell
+[Environment]::SetEnvironmentVariable("XMEMO_KEY", "your-token", "User")
+```
+
+**Bash/Zsh:**
+```bash
+export XMEMO_KEY="your-token"
+```
+
+### 3. Configure Kiro
+
+Preview the configuration first:
+
+```bash
+xmemo setup kiro --dry-run
+```
+
+Then write the configuration:
+
+```bash
+xmemo setup kiro
+```
+
+### 4. Verify Installation
+
+Check your MCP configuration:
+
+```bash
+cat ~/.kiro/settings/mcp.json
+```
+
+You should see an `XMemo` entry in `mcpServers`.
+
+Verify token status:
+
+```bash
+xmemo auth status
+xmemo token status --verify
+```
+
+### 5. Restart Kiro
+
+After configuration, restart Kiro or reload MCP servers for changes to take effect.
+
+## Using XMemo in Kiro
+
+Once installed, you can use XMemo through natural language:
+
+### Search Memory
+```
+Search XMemo for coding style preferences for this project
+```
+
+### Save Information
+```
+Remember in XMemo: Always use TypeScript strict mode in this project
+```
+
+### Recall Decisions
+```
+Recall what I saved about API design patterns
+```
+
+### Manage TODOs
+```
+Create a TODO in XMemo to refactor the auth module next week
+List my XMemo TODOs
+```
+
+## Configuration Details
+
+The setup command creates this configuration:
+
+```json
+{
+  "mcpServers": {
+    "XMemo": {
+      "url": "https://xmemo.dev/mcp",
+      "headers": {
+        "Authorization": "Bearer ${env:XMEMO_KEY}",
+        "X-Memory-OS-Agent-ID": "kiro",
+        "X-Memory-OS-Agent-Instance-ID": "${XMEMO_AGENT_INSTANCE_ID}"
+      }
+    }
+  }
+}
+```
+
+### Configuration Components
+
+- **url**: XMemo MCP server endpoint
+- **Authorization**: Bearer token from `XMEMO_KEY` environment variable
+- **X-Memory-OS-Agent-ID**: Identifies the agent as Kiro
+- **X-Memory-OS-Agent-Instance-ID**: Unique identifier for this installation
+
+## Troubleshooting
+
+### XMemo tools not available
+
+**Check MCP configuration:**
+```bash
+cat ~/.kiro/settings/mcp.json
+```
+
+**Verify the `XMemo` entry exists in `mcpServers`.**
+
+**Restart Kiro** or reload MCP servers.
+
+### Authentication errors
+
+**Check token status:**
+```bash
+xmemo auth status
+xmemo token status --verify
+```
+
+**Verify environment variable:**
+
+PowerShell:
+```powershell
+$env:XMEMO_KEY
+```
+
+Bash/Zsh:
+```bash
+echo $XMEMO_KEY
+```
+
+**Re-authenticate if needed:**
+```bash
+xmemo login
+```
+
+### Duplicate server entries
+
+If you see an error about duplicate entries:
+
+```
+MCP config already contains mcpServers.XMemo
+```
+
+Edit `~/.kiro/settings/mcp.json` manually to remove or update the existing entry.
+
+## Advanced Configuration
+
+### Custom Service URL
+
+For self-hosted or enterprise XMemo:
+
+```bash
+xmemo setup kiro --url https://your-xmemo-instance.example.com
+```
+
+### Manual Configuration
+
+Generate config without writing:
+
+```bash
+xmemo mcp config --client kiro --json
+```
+
+Copy the output and manually merge into your Kiro config.
+
+## Uninstalling
+
+To remove XMemo from Kiro:
+
+1. Edit `~/.kiro/settings/mcp.json`
+2. Remove the `XMemo` entry from `mcpServers`
+3. Restart Kiro or reload MCP servers
+
+## Getting Help
+
+- **Documentation**: https://xmemo.dev
+- **CLI Help**: `xmemo --help`
+- **Setup Help**: `xmemo setup --help`
+- **Issues**: https://github.com/yonro/memory-os-cli/issues
+- **Email**: support@xmemo.dev
+
+## Privacy & Security
+
+- Configuration does not embed token values
+- Tokens are stored securely outside project files
+- Agent identity headers are non-secret attribution IDs
+- No telemetry or analytics
+- All memory content is user-owned

package/plugins/kiro/assets/logo.svg

@@ -0,0 +1,27 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1024 1024" role="img" aria-label="XMemo Claude connector icon">
+  <defs>
+    <radialGradient id="halo" cx="28%" cy="18%" r="78%">
+      <stop offset="0" stop-color="#8df7d5"/>
+      <stop offset="0.36" stop-color="#22d3ee"/>
+      <stop offset="0.74" stop-color="#102033"/>
+      <stop offset="1" stop-color="#070b18"/>
+    </radialGradient>
+    <linearGradient id="mark" x1="180" x2="844" y1="238" y2="786" gradientUnits="userSpaceOnUse">
+      <stop offset="0" stop-color="#f2fff9"/>
+      <stop offset="0.42" stop-color="#8df7d5"/>
+      <stop offset="1" stop-color="#22d3ee"/>
+    </linearGradient>
+    <filter id="glow" x="-20%" y="-20%" width="140%" height="140%" color-interpolation-filters="sRGB">
+      <feDropShadow dx="0" dy="24" stdDeviation="46" flood-color="#22d3ee" flood-opacity="0.36"/>
+      <feDropShadow dx="0" dy="0" stdDeviation="18" flood-color="#8df7d5" flood-opacity="0.46"/>
+    </filter>
+  </defs>
+  <rect width="1024" height="1024" rx="220" fill="#070b18"/>
+  <circle cx="272" cy="214" r="440" fill="url(#halo)" opacity="0.64"/>
+  <circle cx="842" cy="820" r="420" fill="#14b8a6" opacity="0.18"/>
+  <path fill="#ffffff" opacity="0.08" d="M126 746c160 70 310 88 448 56 138-31 246-110 324-235v235c-88 78-197 125-326 141-156 19-304-7-446-79Z"/>
+  <g filter="url(#glow)">
+    <path fill="url(#mark)" d="M224 724V300h118l170 230 170-230h118v424H672V502L552 670h-80L352 502v222Z"/>
+    <path fill="#e6fff8" opacity="0.92" d="M382 300h96l34 48 34-48h96L512 486Z"/>
+  </g>
+</svg>

package/plugins/kiro/mcp.json

@@ -0,0 +1,7 @@
+{
+  "mcpServers": {
+    "XMemo": {
+      "url": "https://xmemo.dev/mcp"
+    }
+  }
+}

package/plugins/kiro/steering/xmemo-memory.md

@@ -0,0 +1,32 @@
+---
+inclusion: auto
+---
+
+# XMemo Memory
+
+Use XMemo's hosted MCP memory tools for durable context, project preferences, decisions, reminders, and cross-session recall in Kiro.
+
+## When to Use
+
+Use XMemo when the task may depend on prior memory, durable project context, coding preferences, decisions, or follow-up actions.
+
+## Workflow
+
+1. **Recall first** when prior context could change the answer. Use XMemo search/recall/context tools before making assumptions about preferences or past decisions.
+2. **Save only durable information** that the user asks to remember or that is clearly useful across future Kiro sessions.
+3. **Keep memory content concise, scoped, and useful**. Prefer concrete facts, decisions, links to public docs, and action items over chat transcripts.
+4. **For destructive memory actions**, confirm the exact target before deleting, forgetting, or overwriting.
+5. **If authorization is missing or expired**, ask the user to reconnect XMemo through Kiro's OAuth flow. Do not request raw bearer tokens in chat.
+
+## Good Memory Candidates
+
+- Repository conventions and verified commands.
+- Architecture decisions, release procedures, and deployment notes.
+- User-approved preferences for code review, testing, documentation, or UX.
+- TODOs and follow-ups that should be visible to future agents.
+
+## Avoid Saving
+
+- Secrets, credentials, OAuth codes, cookies, API keys, or token prefixes.
+- Private customer data or sensitive personal data.
+- Temporary debugging output that will not help future work.