orquesta-agent 0.2.246 → 0.2.248

package/dist/executor.js

@@ -119,6 +119,8 @@ import { fileURLToPath, pathToFileURL } from 'url';
 import { createRequire } from 'module';
 import * as logger from './logger.js';
 import { redactSecrets } from './redact.js';
+import { materializeSecretFiles } from './secret-files.js';
+import { InteractiveStallDetector, describeInteractiveStall, stripAnsi as stripAnsiForResult } from './interactive-prompt.js';
 // ESM require for resolving the bundled orquesta-cli entry on Windows (see the
 // interactive-session spawn — node-pty can't launch the `.cmd` shim).
 const nodeRequire = createRequire(import.meta.url);
@@ -155,6 +157,22 @@ function cleanKimiText(str) {
         .map(line => line.replace(/^(\s*)•\s/, '$1'))
         .join('\n');
 }
+// kiro-cli's headless `chat` output is a TUI transcript, not a plain answer:
+// ANSI colour throughout, a trust banner when --trust-all-tools is on ("All
+// tools are now trusted (!). …", "Agents can sometimes do unexpected things…",
+// "Learn more at https://kiro.dev/docs/cli/chat/security/…"), the answer
+// prefixed with the `> ` prompt marker, and a "▸ Credits: 0.05 • Time: 2s"
+// footer. Strip the chrome so the timeline shows the answer.
+function cleanKiroText(str) {
+    return stripAnsiCodes(str)
+        .split('\n')
+        .filter(line => !/^\s*All tools are now trusted/.test(line))
+        .filter(line => !/^\s*Agents can sometimes do unexpected things/.test(line))
+        .filter(line => !/^\s*Learn more at https:\/\/kiro\.dev\//.test(line))
+        .filter(line => !/^\s*▸?\s*Credits:\s*[\d.]+\s*•\s*Time:/.test(line))
+        .map(line => line.replace(/^>\s?/, ''))
+        .join('\n');
+}
 function stripAnsiCodes(str) {
     // Remove OSC sequences first (ESC ] ... BEL  or  ESC ] ... ESC \)
     // Windows Terminal / ConEmu emit OSC 9;4;<state>;<progress> for progress markers.
@@ -236,6 +254,18 @@ const promptCostCents = new Map();
 // ever saw logs, and panels that read prompts.result (architecture extraction,
 // auto-agent polling) found it empty.
 const promptFinalResult = new Map();
+// promptId -> failure text when a run was cut for waiting on a keyboard prompt
+// (see interactive-prompt.ts). Read by the close handler.
+const promptInteractiveStall = new Map();
+// How long a prompt-looking line may sit with no further output before the
+// run is killed as "waiting for input". 0 disables the watchdog.
+function interactivePromptTimeoutMs() {
+    const raw = process.env.ORQUESTA_INTERACTIVE_PROMPT_TIMEOUT_MS;
+    if (raw === undefined || raw === '')
+        return 60_000;
+    const n = Number(raw);
+    return Number.isFinite(n) && n >= 0 ? n : 60_000;
+}
 // The CLI's own verdict for a run, from its `end` event. Kept per prompt because
 // several prompts stream through the same process concurrently. See QA-76: an
 // exit code is not evidence that the work succeeded.
@@ -343,6 +373,18 @@ export function setInjectedCredentials(credentials) {
 export function getInjectedCredentials() {
     return injectedCredentials;
 }
+// Write the project's secret files to disk (relative paths resolve against
+// `cwd`) and return the credentials plus one `ORQUESTA_FILE_<NAME>` var per
+// file — listed in the manifest too, so orquesta-cli's env whitelist lets the
+// shell tools see them.
+function withSecretFileEnv(credentials, cwd) {
+    const fileEnv = materializeSecretFiles(cwd);
+    const fileKeys = Object.keys(fileEnv);
+    if (fileKeys.length === 0)
+        return credentials;
+    const manifest = [credentials[INJECTED_ENV_MANIFEST], ...fileKeys].filter(Boolean).join(',');
+    return { ...credentials, ...fileEnv, [INJECTED_ENV_MANIFEST]: manifest };
+}
 let globalPermissionMode = 'auto';
 // Agent instructions (from Orquesta dashboard)
 let agentInstructions = null;
@@ -1037,6 +1079,87 @@ export function checkCursorAuth() {
         return cache({ available: true, authenticated: true, method: null });
     }
 }
+// Resolve AWS Kiro's CLI (`kiro-cli`). Its installer drops the binary in
+// ~/.local/bin (alongside `kiro-cli-chat`/`kiro-cli-term`) and, like cursor's,
+// only reminds the user to put that on PATH — so probe the install dir too.
+// Order: KIRO_CLI_PATH → on PATH → ~/.local/bin/kiro-cli.
+// macOS + Linux only: Kiro ships no native Windows CLI, so on win32 this is
+// always null and the engine never appears as available there.
+let kiroBinaryCache = null;
+export function resolveKiroBinary() {
+    const now = Date.now();
+    if (kiroBinaryCache && now - kiroBinaryCache.at < CLI_DETECTION_TTL_MS)
+        return kiroBinaryCache.path;
+    let resolved = null;
+    if (process.platform !== 'win32') {
+        const envPath = process.env.KIRO_CLI_PATH;
+        if (envPath) {
+            try {
+                fs.accessSync(envPath, fs.constants.X_OK);
+                resolved = envPath;
+            }
+            catch { /* bad override */ }
+        }
+        if (!resolved) {
+            try {
+                execSync('kiro-cli --version', { stdio: 'pipe', timeout: 15000 });
+                resolved = 'kiro-cli';
+            }
+            catch { /* not on PATH */ }
+        }
+        if (!resolved) {
+            const candidate = path.join(os.homedir(), '.local', 'bin', 'kiro-cli');
+            try {
+                fs.accessSync(candidate, fs.constants.X_OK);
+                resolved = candidate;
+            }
+            catch { /* not installed there */ }
+        }
+    }
+    kiroBinaryCache = { path: resolved, at: now };
+    return resolved;
+}
+// Kiro CLI (the `kiro-cli` binary). Authenticated separately with
+// `kiro-cli login` against the user's own AWS Builder ID / IAM Identity Center
+// — Orquesta never sees that credential.
+export function isKiroCliAvailable() {
+    return resolveKiroBinary() !== null;
+}
+// Is kiro-cli actually LOGGED IN, not just installed? Same contract as
+// checkCursorAuth: `kiro-cli whoami` exits 0 with the identity when logged in
+// and exits 1 printing "Not logged in" otherwise. Only that wording flips the
+// flag; anything else (timeout, older build) reports authenticated with a null
+// method, because execution never depends on this flag.
+let kiroAuthCache = null;
+export function checkKiroAuth() {
+    const now = Date.now();
+    if (kiroAuthCache && now - kiroAuthCache.at < CLI_DETECTION_TTL_MS)
+        return kiroAuthCache.result;
+    const cache = (result) => {
+        kiroAuthCache = { result, at: now };
+        return result;
+    };
+    const binary = resolveKiroBinary();
+    if (!binary)
+        return cache({ available: false, authenticated: false, method: null });
+    try {
+        const out = execSync(`"${binary}" whoami`, {
+            stdio: ['ignore', 'pipe', 'pipe'],
+            timeout: 15000,
+            encoding: 'utf-8',
+        });
+        if (isLoggedOutMessage(out))
+            return cache({ available: true, authenticated: false, method: null });
+        return cache({ available: true, authenticated: true, method: 'subscription' });
+    }
+    catch (error) {
+        const err = error;
+        const combined = `${err.stdout ?? ''}${err.stderr ?? ''}`;
+        if (isLoggedOutMessage(combined))
+            return cache({ available: true, authenticated: false, method: null });
+        return cache({ available: true, authenticated: true, method: null });
+    }
+}
 // Dedupe the fallback warning: selectCli() runs on every heartbeat (the agent
 // reports activeCli), so logging unconditionally spammed thousands of identical
 // WARN lines. Only log when the message actually changes.
@@ -1051,12 +1174,13 @@ function warnCliOnce(msg) {
 // the pinned CLI turns out not to be installed. Table-driven rather than a nest
 // of pairwise ifs: every CLI added here otherwise costs another N branches, and
 // the pair that got missed is exactly how a preference silently no-ops.
-const CLI_AUTO_ORDER = ['orquesta', 'claude', 'kimi', 'cursor'];
+const CLI_AUTO_ORDER = ['orquesta', 'claude', 'kimi', 'cursor', 'kiro'];
 const CLI_AUTO_REASON = {
     orquesta: 'Auto: orquesta available (local LLM)',
     claude: 'Auto: claude available (Anthropic API)',
     kimi: 'Auto: kimi available',
     cursor: 'Auto: cursor-agent available',
+    kiro: 'Auto: kiro-cli available',
 };
 // Select which CLI to use based on availability and preference
 export function selectCli() {
@@ -1065,6 +1189,7 @@ export function selectCli() {
         claude: isClaudeCliAvailable(),
         kimi: isKimiCliAvailable(),
         cursor: isCursorCliAvailable(),
+        kiro: isKiroCliAvailable(),
     };
     if (!CLI_AUTO_ORDER.some(cli => available[cli])) {
         return { cli: null, reason: `No CLI found (${CLI_AUTO_ORDER.join(', ')})` };
@@ -2201,7 +2326,7 @@ ${userRequestBody}`;
         // Build environment with authentication
         const env = {
             ...process.env,
-            ...injectedCredentials, // Inject credentials from Orquesta
+            ...withSecretFileEnv(injectedCredentials, workingDirectory || process.cwd()), // Inject credentials from Orquesta
             CI: 'true', // Ensure non-interactive mode
             // Expose the current prompt id so Claude can link generated files back
             // to this prompt via /api/agent/files (prompt_id=$ORQUESTA_PROMPT_ID).
@@ -2258,9 +2383,11 @@ ${userRequestBody}`;
             ? (resolveKimiBinary() || 'kimi')
             : cliCommand === 'cursor'
                 ? (resolveCursorBinary() || 'cursor-agent')
-                : cliCommand === 'claude'
-                    ? (resolveClaudeBinary() || 'claude')
-                    : (cliCommand || 'claude');
+                : cliCommand === 'kiro'
+                    ? (resolveKiroBinary() || 'kiro-cli')
+                    : cliCommand === 'claude'
+                        ? (resolveClaudeBinary() || 'claude')
+                        : (cliCommand || 'claude');
         const cwd = workingDirectory || process.cwd();
         // Which branch this prompt runs on — captured up front so it's persisted even
         // if the run fails, and broadcast live below once sendSpecialEvent exists.
@@ -2272,16 +2399,16 @@ ${userRequestBody}`;
         let detectedCommitSha = null;
         let detectedCommitUrl = null;
         logger.info(`CLI Selection: ${cliCommand} (${reason})`);
-        logger.info(`Spawning: ${cliBinary} -p "${fullContent.slice(0, 50)}..." in ${cwd}${currentBranch ? ` on branch ${currentBranch}` : ''}`);
+        logger.info(`Spawning: ${cliBinary} ${cliCommand === 'kiro' ? 'chat' : '-p'} "${fullContent.slice(0, 50)}..." in ${cwd}${currentBranch ? ` on branch ${currentBranch}` : ''}`);
         // Hoist the static block into the CLI system prompt (claude/orquesta support
         // --append-system-prompt-file; kimi has no such flag and stays inline). On any
         // write failure we fall back to the inline fullContent, so a dispatched prompt
         // can never regress to a worse state than before.
         let promptContent = fullContent;
         let sysPromptFilePath = null;
-        // kimi and cursor-agent have no --append-system-prompt-file, so their static
-        // context stays inline in the prompt.
-        if (cliCommand !== 'kimi' && cliCommand !== 'cursor') {
+        // kimi, cursor-agent and kiro-cli have no --append-system-prompt-file, so
+        // their static context stays inline in the prompt.
+        if (cliCommand !== 'kimi' && cliCommand !== 'cursor' && cliCommand !== 'kiro') {
             try {
                 const promptDir = process.platform === 'win32'
                     ? os.tmpdir()
@@ -2314,22 +2441,29 @@ ${userRequestBody}`;
                 // below only understands Claude's and orquesta-cli's,
                 // so asking for it would give us an unparseable
                 // stream instead of an answer.
-                : cliCommand === 'kimi'
-                    ? '--output-format text' // Kimi: plain text. NOTE: -p (one-shot) CANNOT be
-                    // combined with -y ("Cannot combine --prompt with
-                    // --yolo"), so dispatched kimi prompts respond as
-                    // chat (no autonomous tool use). Interactive kimi
-                    // sessions DO get -y (see ptyArgs below).
-                    : '--verbose --output-format stream-json'; // Claude: stream-json format
+                : cliCommand === 'kiro'
+                    ? '--no-interactive --wrap never' // Kiro: `chat` is interactive by default;
+                    // --no-interactive answers once and exits, --wrap
+                    // never stops it re-flowing the answer to the
+                    // (absent) terminal width.
+                    : cliCommand === 'kimi'
+                        ? '--output-format text' // Kimi: plain text. NOTE: -p (one-shot) CANNOT be
+                        // combined with -y ("Cannot combine --prompt with
+                        // --yolo"), so dispatched kimi prompts respond as
+                        // chat (no autonomous tool use). Interactive kimi
+                        // sessions DO get -y (see ptyArgs below).
+                        : '--verbose --output-format stream-json'; // Claude: stream-json format
         // Kimi has no --dangerously-skip-permissions, and -p forbids -y. Cursor spells
-        // the same thing --force (alias --yolo).
+        // the same thing --force (alias --yolo); kiro spells it --trust-all-tools.
         const permFlags = cliCommand === 'kimi'
             ? ''
             : mode !== 'auto'
                 ? ''
                 : cliCommand === 'cursor'
                     ? '--force'
-                    : '--dangerously-skip-permissions';
+                    : cliCommand === 'kiro'
+                        ? '--trust-all-tools'
+                        : '--dangerously-skip-permissions';
         // Per-project endpoint override (orquesta CLI only). Single-quoted for the
         // shell-wrapped (Linux) path; pushed as a separate arg on Win/macOS below.
         const useEndpoint = cliCommand === 'orquesta' && !!globalCliEndpoint;
@@ -2341,7 +2475,10 @@ ${userRequestBody}`;
         // Claude CLI's headless `-p` mode does not accept positional file args as
         // attachments — image refs are surfaced inline in the prompt as absolute
         // paths so Claude's Read tool can pick them up.
-        command = `${cliBinary} -p '${escapedContent}' ${permFlags} ${baseFlags} ${endpointFlag} ${sysPromptFlag}`;
+        // kiro-cli has no `-p`: the one-shot form is `kiro-cli chat "<prompt>"` with
+        // --no-interactive (baseFlags), the prompt as the verb's positional arg.
+        const promptVerb = cliCommand === 'kiro' ? 'chat' : '-p';
+        command = `${cliBinary} ${promptVerb} '${escapedContent}' ${permFlags} ${baseFlags} ${endpointFlag} ${sysPromptFlag}`;
         if (imageReferences.length > 0) {
             logger.info(`Image attachments referenced inline: ${imageReferences.length}`);
         }
@@ -2354,7 +2491,7 @@ ${userRequestBody}`;
         const isDarwin = process.platform === 'darwin';
         let claude;
         if (isWindows || isDarwin) {
-            const args = ['-p'];
+            const args = [promptVerb];
             // Windows cmd.exe caps the whole command line at ~8191 chars. The prompt is
             // prefixed with large context blocks (capabilities, project CLAUDE.md,
             // coordination…), so passing it as an argv overflows that limit and the CLI
@@ -2414,6 +2551,16 @@ ${userRequestBody}`;
         let thinkingBuffer = '';
         let textBuffer = '';
         let toolInputBuffer = '';
+        // Fallbacks for the stored result when the CLI dies without a result event
+        // (killed, crashed, cut for an interactive prompt): the last prose the model
+        // produced, else the tail of whatever raw output there was.
+        let lastAssistantText = '';
+        let rawOutputTail = '';
+        const noteRawOutput = (text) => {
+            const clean = stripAnsiForResult(text);
+            if (clean.trim())
+                rawOutputTail = (rawOutputTail + clean).slice(-4000);
+        };
         // Parse stream-json output format
         // Returns { output: string, hadValidJson: boolean, logs: AgentLogEntry[] }
         const parseStreamJson = (text) => {
@@ -2495,6 +2642,7 @@ ${userRequestBody}`;
                                 output += `\n${content}\n`;
                                 logs.push(createOutputLog(content, 'markdown', 'info', promptId));
                                 promptFinalResult.set(promptId, String(content));
+                                lastAssistantText = String(content);
                             }
                         }
                         else if (json.event === 'error') {
@@ -2537,6 +2685,8 @@ ${userRequestBody}`;
                                     // separate the model's prose from a preceding tool result
                                     // (the blob otherwise leaves them adjacent with no delimiter).
                                     output += `\n💬 ${block.text}\n`;
+                                    if (typeof block.text === 'string' && block.text.trim())
+                                        lastAssistantText = block.text;
                                     // Create structured output log
                                     if (block.text.trim()) {
                                         logs.push(createOutputLog(block.text, 'markdown', 'info', promptId));
@@ -2639,6 +2789,7 @@ ${userRequestBody}`;
                         }
                         if (textBuffer.trim()) {
                             logs.push(createOutputLog(textBuffer, 'markdown', 'info', promptId));
+                            lastAssistantText = textBuffer;
                             textBuffer = '';
                         }
                         if (toolInputBuffer.trim() && currentToolName) {
@@ -2739,9 +2890,44 @@ ${userRequestBody}`;
             sendSpecialEvent('git_branch', { branch: currentBranch });
         }
         // Stream stdout
+        // Watchdog for a CLI (or a tool it ran with a real TTY) that stops to ask a
+        // question. A headless run can never answer, so after `silenceMs` of quiet
+        // following a prompt-looking line we kill it and record WHY — the old
+        // behaviour was to sit until the dispatch timeout and store an empty
+        // result over a log of TUI redraw garbage (`eas login`, 2026-09).
+        const stallSilenceMs = interactivePromptTimeoutMs();
+        const stallDetector = new InteractiveStallDetector({
+            silenceMs: stallSilenceMs,
+            onStall: (label, tail) => {
+                if (!runningProcesses.has(commandId))
+                    return;
+                const message = describeInteractiveStall(label, tail, stallSilenceMs);
+                logger.warn(`Interactive prompt detected (${label}) with no output for ${Math.round(stallSilenceMs / 1000)}s — killing run`);
+                promptInteractiveStall.set(promptId, message);
+                addLog(promptId, 'error', 'system', message);
+                sendOutput(channel, commandId, 'stderr', `\n❌ ${message}\n`);
+                try {
+                    claude.kill('SIGTERM');
+                }
+                catch { /* already gone */ }
+                setTimeout(() => {
+                    if (runningProcesses.has(commandId)) {
+                        try {
+                            claude.kill('SIGKILL');
+                        }
+                        catch { /* already gone */ }
+                    }
+                }, 5000).unref?.();
+            },
+        });
         if (claude.stdout) {
             claude.stdout.on('data', (data) => {
-                const text = cliCommand === 'kimi' ? cleanKimiText(data.toString()) : data.toString();
+                const text = cliCommand === 'kimi'
+                    ? cleanKimiText(data.toString())
+                    : cliCommand === 'kiro'
+                        ? cleanKiroText(data.toString())
+                        : data.toString();
+                stallDetector.feed(data.toString());
                 // Skip logging if it looks like base64/binary data (long strings without spaces)
                 const preview = text.slice(0, 150);
                 const looksLikeBinary = preview.length > 50 && !preview.includes(' ') && /^[A-Za-z0-9+/=]+$/.test(preview.replace(/\s/g, ''));
@@ -2756,6 +2942,8 @@ ${userRequestBody}`;
                 // Only fallback to raw text if it wasn't valid JSON
                 // If it was valid JSON but produced no output (e.g., system init), don't send anything
                 const outputToSend = hadValidJson ? parsed : text;
+                if (!hadValidJson)
+                    noteRawOutput(text);
                 if (outputToSend.trim()) {
                     logger.output('stdout', outputToSend.slice(0, 200));
                     sendOutput(channel, commandId, 'stdout', outputToSend);
@@ -2867,9 +3055,11 @@ ${userRequestBody}`;
         if (claude.stderr) {
             claude.stderr.on('data', (data) => {
                 const raw = data.toString();
+                stallDetector.feed(raw);
                 const text = stripAnsiCodes(raw);
                 if (!text.trim())
                     return;
+                noteRawOutput(text);
                 logger.info(`[STDERR] ${text.slice(0, 100)}`);
                 logger.output('stderr', text);
                 sendOutput(channel, commandId, 'stderr', text);
@@ -2885,6 +3075,7 @@ ${userRequestBody}`;
             // Handle completion
             claude.on('close', async (code) => {
                 runningProcesses.delete(commandId);
+                stallDetector.stop();
                 // Remove the hoisted system-prompt temp file now that the CLI has read it.
                 if (sysPromptFilePath) {
                     try {
@@ -2946,7 +3137,12 @@ ${userRequestBody}`;
                 if (cliReportedFailure && (code ?? 0) === 0) {
                     logger.warn('CLI reported a failed run but exited 0 — recording it as failed');
                 }
-                const exitCode = (claudeApiError || cliReportedFailure) ? (code || 1) : (code ?? 0);
+                // A run cut for waiting on a keyboard prompt is a failure whatever the
+                // signal-death exit code says (a SIGTERM'd child reports code null).
+                const interactiveStall = promptId ? promptInteractiveStall.get(promptId) : undefined;
+                if (promptId)
+                    promptInteractiveStall.delete(promptId);
+                const exitCode = (claudeApiError || cliReportedFailure || interactiveStall) ? (code || 1) : (code ?? 0);
                 const duration = Date.now() - startTime;
                 const status = exitCode === 0 ? 'completed' : 'failed';
                 if (exitCode === 0) {
@@ -2994,8 +3190,25 @@ ${userRequestBody}`;
                     promptCostCents.delete(promptId);
                 }
                 // Update prompt status in database with summary and usage (backend fix - don't rely on frontend)
-                const finalResult = promptFinalResult.get(promptId);
+                // Prefer the CLI's own result event; when the run died without one
+                // (killed, crashed, cut for a prompt) still store SOMETHING readable —
+                // the stall explanation, the last assistant prose, or the raw tail —
+                // so the dashboard never shows an empty result over a dead run.
+                let finalResult = promptFinalResult.get(promptId);
                 promptFinalResult.delete(promptId);
+                if (!finalResult || !finalResult.trim()) {
+                    if (interactiveStall) {
+                        finalResult = lastAssistantText.trim()
+                            ? `${interactiveStall}\n\nLast assistant message:\n${lastAssistantText.trim()}`
+                            : interactiveStall;
+                    }
+                    else if (lastAssistantText.trim()) {
+                        finalResult = lastAssistantText.trim();
+                    }
+                    else if (rawOutputTail.trim()) {
+                        finalResult = `${status === 'failed' ? `Run failed (exit code ${exitCode}) without a result. ` : ''}Last output:\n${rawOutputTail.trim().split('\n').slice(-40).join('\n')}`;
+                    }
+                }
                 // Record WHICH CLI + model executed it (timeline/history). Model is
                 // best-effort — the CLI/proxy pick the true upstream model internally
                 // (batuta-auto fans out per prompt), so we report the CLI's MODEL CONFIG:
@@ -3005,13 +3218,16 @@ ${userRequestBody}`;
                         ? 'kimi-cli'
                         : cliCommand === 'cursor'
                             ? 'cursor-cli'
-                            : 'claude-cli';
+                            : cliCommand === 'kiro'
+                                ? 'kiro-cli'
+                                : 'claude-cli';
                 let modelForDb;
                 if (cliCommand === 'kimi')
                     modelForDb = 'kimi-for-coding';
                 // cursor-agent picks the model from the user's own Cursor settings and does
-                // not report it in text mode, so leave it unset rather than guess.
-                else if (cliCommand === 'cursor')
+                // not report it in text mode, so leave it unset rather than guess. Same for
+                // kiro-cli (its default model is set in the user's Kiro agent config).
+                else if (cliCommand === 'cursor' || cliCommand === 'kiro')
                     modelForDb = undefined;
                 else if (cliCommand === 'orquesta')
                     modelForDb = (globalCliEndpoint === 'batuta' || !globalCliEndpoint) ? 'batuta-auto' : globalCliEndpoint;
@@ -3038,6 +3254,7 @@ ${userRequestBody}`;
             // Handle errors
             claude.on('error', async (err) => {
                 runningProcesses.delete(commandId);
+                stallDetector.stop();
                 if (promptId)
                     promptIdToCommandId.delete(promptId);
                 pendingSupervisionCallbacks.delete(commandId);
@@ -3858,7 +4075,7 @@ export async function startSession(options) {
     // Build environment with authentication
     const env = {
         ...process.env,
-        ...injectedCredentials,
+        ...withSecretFileEnv(injectedCredentials, cwd),
         // Don't set CI=true for interactive mode - we want full TTY behavior
     };
     if (anthropicApiKey) {
@@ -3888,10 +4105,12 @@ export async function startSession(options) {
         ? (resolveKimiBinary() || 'kimi')
         : cliCommand === 'cursor'
             ? (resolveCursorBinary() || 'cursor-agent')
-            : cliCommand === 'claude'
-                ? (resolveClaudeBinary() || 'claude')
-                : cliCommand;
-    const resolvedByPath = cliCommand === 'kimi' || cliCommand === 'cursor';
+            : cliCommand === 'kiro'
+                ? (resolveKiroBinary() || 'kiro-cli')
+                : cliCommand === 'claude'
+                    ? (resolveClaudeBinary() || 'claude')
+                    : cliCommand;
+    const resolvedByPath = cliCommand === 'kimi' || cliCommand === 'cursor' || cliCommand === 'kiro';
     logger.info(`Interactive session CLI: ${cliCommand}${resolvedByPath ? ` (${cliBinary})` : ''}`);
     // Best-effort model + cli label reported in session:started so the dashboard
     // can tag the interactive prompt (same mapping dispatched prompts use on
@@ -3899,8 +4118,8 @@ export async function startSession(options) {
     // back to ANTHROPIC_MODEL when set, else undefined.
     const sessionModel = cliCommand === 'kimi'
         ? 'kimi-for-coding'
-        : cliCommand === 'cursor'
-            // cursor-agent uses whatever model the user selected in their own Cursor
+        : cliCommand === 'cursor' || cliCommand === 'kiro'
+            // cursor-agent / kiro-cli use whatever model the user selected in their own
             // account; it isn't knowable from the PTY, so report nothing rather than lie.
             ? undefined
             : cliCommand === 'orquesta'
@@ -3909,7 +4128,8 @@ export async function startSession(options) {
     const sessionCliType = cliCommand === 'orquesta' ? 'orquesta'
         : cliCommand === 'kimi' ? 'kimi'
             : cliCommand === 'cursor' ? 'cursor'
-                : 'claude';
+                : cliCommand === 'kiro' ? 'kiro'
+                    : 'claude';
     // Filter undefined env values — node-pty requires Record<string, string>.
     // In strict sandbox mode, sandboxEnv() first reduces to the allowlist so the
     // interactive CLI can't read unrelated host secrets from its own env.
@@ -3997,7 +4217,7 @@ export async function startSession(options) {
     // `ps aux`. Default-off because a file unreadable inside bwrap would silently
     // strip the system prompt (degraded session, not a crash) — flip the default
     // only after E2E confirms the sandbox reads it. Rollback = unset the var.
-    const wantSysPromptFile = cliCommand !== 'kimi' && cliCommand !== 'cursor' && ((process.platform === 'win32' && cliCommand === 'orquesta') ||
+    const wantSysPromptFile = cliCommand !== 'kimi' && cliCommand !== 'cursor' && cliCommand !== 'kiro' && ((process.platform === 'win32' && cliCommand === 'orquesta') ||
         /^(1|true|yes|on)$/i.test(process.env.ORQUESTA_SYSPROMPT_FILE || ''));
     if (wantSysPromptFile) {
         try {
@@ -4016,7 +4236,22 @@ export async function startSession(options) {
         }
     }
     let ptyArgs;
-    if (cliCommand === 'cursor') {
+    if (cliCommand === 'kiro') {
+        // kiro-cli has no --append-system-prompt either; it reads AGENTS.md /
+        // steering files from the working dir. `chat` is the interactive verb and
+        // `--trust-all-tools` its --dangerously-skip-permissions. Resume flags go
+        // AFTER the verb (see below) — the generic unshift would put them before it.
+        ptyArgs = ['chat', '--trust-all-tools'];
+        if (resumeSessionId) {
+            ptyArgs.push('--resume-id', resumeSessionId);
+            logger.info(`[Session] Resuming conversation ${resumeSessionId} (--resume-id) for kiro`);
+        }
+        else if (resume) {
+            ptyArgs.push('--resume');
+            logger.info('[Session] Resuming most recent conversation in this directory (--resume) for kiro');
+        }
+    }
+    else if (cliCommand === 'cursor') {
         // cursor-agent has no --append-system-prompt; it reads AGENTS.md / CLAUDE.md
         // from the working dir (which the agent already syncs), so the capabilities
         // block isn't injected. `--force` is its --dangerously-skip-permissions.
@@ -4039,7 +4274,7 @@ export async function startSession(options) {
     // cli.ts) both reattach the latest session non-interactively; kimi has no
     // resume flag, so the option is silently ignored there. Prepended so it's an
     // unambiguous standalone flag, separate from --append-system-prompt's value.
-    if ((resume || resumeSessionId) && cliCommand !== 'kimi') {
+    if ((resume || resumeSessionId) && cliCommand !== 'kimi' && cliCommand !== 'kiro') {
         // cursor-agent spells these the same way claude does (--continue / --resume <id>).
         // claude can target a SPECIFIC past conversation by id (--resume <id>);
         // orquesta-cli only reattaches the latest (--continue). So when a specific
@@ -4183,7 +4418,7 @@ export async function startSession(options) {
         startTime,
         subAgentId,
         subAgentName,
-        cliType: cliCommand === 'orquesta' ? 'orquesta' : cliCommand === 'kimi' ? 'kimi' : 'claude',
+        cliType: sessionCliType,
         isActive: true,
         pendingPhoneBlock: '',
         pendingPhoneTimer: null,