Crew changelog

Kiro Crew 0.6.0 lets you choose the harness behind a session, start work on a connected remote crew, and let crew members dispatch workers of their own. Chat is quieter and easier to resume, long-running work gets more room to finish, and Apps adds a Launchpad for the tools you install. Python 3.12 is now the minimum supported version.

A few changes need your attention before updating:

• Python 3.12 is now required. Hosts on Python 3.10 or 3.11 must upgrade before installing or updating. The installer provisions its own pinned Python when needed; pass --system-python only when you deliberately want to use your system interpreter.
• Keep the sandbox enabled if you rely on the command gate. Credential-path protection no longer relies on command-text inspection. Check that agent.sandbox in config.json is not off.
• Unattended auto-run plans stop after two hours by default. Raise orchestrator.max_plan_duration_seconds in config.json, or set it to 0 to remove the ceiling. Stage-gated plans are not cut off.
• Crew Members is now a preview opt-in. Turn on Settings > Developer > Feature Previews > Crew Members and Crew Mode to show the Crew Members entry and the new-crew-chat action.
• Automatic knowledge folders are removed. Add and confirm a folder before it appears in the Library. Older folders that were registered automatically remain pending until you confirm them.
• Developing an app UI outside its install root now requires the terminal. Use kirocrew app dev <name> --confirm-out-of-install-root. The dashboard and API no longer grant this access.

Choose Claude Code, Codex, or KAS for a session from Settings > Developer > Agent Backend after enabling Developer Mode. Crew shows whether each option is ready, missing on this machine, or waiting for a Gateway restart, while monitor loops and follow-up cards work across supported backends. Learn more ->

Start a chat on a connected crew without leaving your sidebar. Turn on instances.enabled and Settings > Developer > Feature Previews > Chat on a crew, then select a peer from New chat on crew. The transcript stays local, the remote crew runs each turn, and its name and server badge identify where the work happens. Learn more ->

Diffs now start folded into a file chip, with Settings > Chat > Plain diffs available when you prefer raw patch text. The composer can attach a sketch, show the project branch and changed-file count, and collapse when you need the transcript back. You can also share an assistant reply as a branded image or start a social post from it. Learn more ->

Agents can start, revise, and stop their own monitoring loop from the dashboard, Slack, or Discord, then wake when the work they watch changes. Crew members can dispatch workers from their own threads on Claude and KAS, inheriting the creator's trust posture. Session control is now on by default, and agent.session_control lets you disable it globally when needed. Learn more ->

A chat turn can now run for up to four hours through agent.chat_turn_timeout_secs, whose default rises to 14400. Subagents can run for three hours with agent.subagent_timeout_secs at 10800, and agent.subagent_max_turns supports up to 1000 tool calls. The monitor-loop goal chip also shows its cycle cap before the backstop is reached. Learn more ->

Give a crew member a customized ghost avatar or upload a picture from Agent Capabilities > Agents > Avatar > Customize. The new Expressions pane lets you set a reacting face and sound for working, done, and failed states. The Crew Members page also shows activity, patrols, schedules, webhooks, and roster filters for finding the right member. Learn more ->

Installed apps now appear as an Apps > Library Launchpad grid, where you can open, pin, update, disable, or uninstall each one. App manifests can declare background jobs with permissions.jobs, Command Bar entries with contributes.commands, and up to two live composer controls with contributes.sessionControls. Create Folders From Project also turns selected packages into nested sidebar folders. Learn more ->

AWS Control now opens on an Overview of account health, drive use, month-to-date spend, share links, and backup status. Its Files view opens common file types in a preview dialog, searches by name or path, renames from the item menu, and keeps upload, move, and delete actions close to the files they affect. Backup progress survives navigation, and disconnecting an account removes only Crew's local registry and consent records. Learn more ->

This version gives your AWS account a control room, lets administrators publish one security policy across a fleet, and makes parallel work easier to manage with persistent session tabs. Local dictation works without a separate speech-to-text install, agents can coordinate work across sessions, and script-installed copies can update themselves atomically.

A few changes need your attention before updating:

• Local dictation now uses one local provider. The whisper, mlx, parakeet, and faster speech-to-text providers are retired. Saved settings fall back to local, which downloads its model on first use. The new default is the 148 MB base model; a stored turbo setting still works but downloads 1.6 GB. Live text is on by default for new installs, and kirocrew doctor reports stored defaults that an earlier build materialized so you can decide which to adopt.
• Snapshot backup to S3 is retired. kirocrew snapshot --to s3://..., --aws-profile, and the s3:// fetch path are removed. Use the AWS Control app for cloud backup. Snapshot restore now supports replacing or merging live state, with a rollback ledger.
• Installed apps may ask for one-time re-consent. App trust is now tied to the repository you approved. A legacy grant that cannot be matched to a repository asks again rather than applying to different code.
• Some commands may ask for approval again. Looking like a help or version check no longer counts as approval, and durable always-allow grants no longer cover structured non-shell tools.
• Kiro CLI bundle overrides are removed. Kiro Crew now uses Kiro CLI's published relay, so custom bundle-path environment overrides from earlier releases are no longer read.
• Knowledge moves into Agent Capabilities. The standalone Knowledge page leaves the sidebar. Its content moves to Agent Capabilities > Knowledge & instructions, and old /knowledge links redirect there.
• Auto-Triage Pipeline moves into Issue Radar. The standalone app and its saved repository are retired. Its boards become a fourth Issue Radar board that follows the repository you select.
• Disconnecting a connection revokes its local OAuth grant. Reconnecting requires sign-in again unless another agent or scope still shares the endpoint.
• Governance configuration fails closed. A misspelled security-policy sandbox key now fails validation, and a malformed publish section denies publishing instead of dropping its restriction.

The new AWS Control app brings connected AWS accounts into one surface. Review account health, browse a private and versioned S3-backed drive, manage access, inspect billing, and run cloud backups. Changes require consent and appear in the audit log. Restore a snapshot into the running install by replacing or merging selected components, with a rollback ledger if you need to undo it. Learn more ->

Administrators can publish one security_policy.json at a URL and have every host fetch, cache, and refresh it without a restart. If the source is unavailable, hosts keep using the cached policy; an invalid document is rejected rather than lowering the current ceiling. Enterprise Kiro accounts also honor administrator-managed MCP registry controls, including version pins. Learn more ->

Keep several sessions open as tabs above the transcript. Middle-click or modifier-click a sidebar row to open one, see live status on each tab, and keep the same set of tabs per surface. Dormant sessions fold behind an expander after a threshold you choose, while pinned, running, and unread sessions stay visible. The + New menu also adds Ephemeral chats: Incognito reads memory but writes none, while Temporary neither reads nor writes memory. Learn more ->

When several tool calls wait on you, approve or reject all of them at once, or reject one call and continue reviewing the rest. Long shell commands show a readable summary with the full command available on hover. kirocrew chat now displays permission prompts and lets you answer them instead of waiting silently. Learn more ->

Agents can send a message into another session as its next turn, and the built-in conductor can divide a larger goal into work items, start a session for each one, check results, and decide the next round. Workflows can be promoted into a versioned global library and invoked with /workflow, while pull request watchers wake on comments, reviews, and verdicts instead of checking only build results. Learn more ->

A single in-process local speech-to-text provider downloads its own model on first use and keeps it ready, so dictation works without installing an external binary. Live text appears as you speak, silence hallucinations and caption boilerplate are filtered out, and settings that require a Gateway restart offer the restart action in the same panel. Learn more ->

kirocrew update installs a new version into a fresh, signature-verified tree and switches to it atomically. Windows Restart & Update now shows installer progress, updates the existing install, updates retained shortcuts, and relaunches the new build. The About page reports when updates were checked and names the version actually running. Learn more ->

This version makes Windows and Linux first-class installs, moves your secrets out of the config file and into an encrypted vault, and turns the dashboard into a place to edit code, not just discuss it. Every messaging channel reaches parity with Slack and three new ones arrive, MCP servers stop guessing about safe process sharing, and boot uses far less memory.

Windows now ships a signed installer with in-app auto-updates on the stable channel, and the desktop app installs on Linux from .deb or .rpm with a fixed install path, a desktop entry, and per-format in-app updates. The Linux desktop app needs glibc 2.34 or newer; on an older host the one-line CLI install still works. Kiro Crew can also read and drive native Windows applications through UI Automation, so Computer Use is no longer macOS-only, and the Windows agent tree now runs under a Job-object process and memory ceiling that mirrors the Linux control. Learn more ->

Secrets are now stored in an encrypted vault, managed from a new Settings > Secrets page where values stay masked and are never sent to the browser, and can be withheld from agents on a denylist. An MCP server's environment can reference a stored value as secret://NAME, resolved from the vault at spawn time so the secret never sits in on-disk config. Learn more ->

The transcript gains side-by-side diff rendering, per-file editing inline, and a project file tree in the side panel. A file edit made by a tool now renders as an always-visible diff card instead of hiding inside collapsed tool details, and many more file types preview in place: video and audio play inline, XLSX spreadsheets render with sheet tabs, and notebook previews show embedded images, highlighted code, and Mermaid diagrams. A keystroke-launched command bar names each row's kind and ships on by default. Learn more ->

Three new channels join the roster: WhatsApp (link a personal account by QR code), iMessage (routed through your own Messages.app via a local macOS bridge, deny-by-default with an explicit allowlist), and Feishu (Lark). Teams, Telegram, and Webex reach parity with Slack, and Discord gains a nine-command slash menu with a model picker, runtime stats, and cron delivery. A shared fix means /yolo and per-session Trust now actually take effect on Teams, Webex, WeCom, WeChat, and iMessage, where they were silently inert. Learn more ->

Session search now spans every connected gateway and interleaves local and remote results, and a query like 4411, /pull/4411, or owner/repo#4411 all find the same session. Reaching the top of a long transcript loads older turns instead of stopping, you can filter by tag and assign any custom hex color, and an opt-in dashboard MCP set lets one session message, stop, and read another to hand off work with its full context. Learn more ->

Boot uses about 875MB less memory: the embedding model no longer loads at startup when there is no embedding work to do, and loads on first real use instead. The dashboard opens immediately by printing its URL and launching the browser without waiting on MCP probing, sandboxed spawns are about 1.45 seconds faster each, and kirocrew CLI startup drops from 1.3 seconds and 112MB of imports to 0.5 seconds and 54MB.

This version lets the agent run several threads of your work at once, drives a real browser inside the dashboard, and broadens the desktop lineup with a native Linux ARM64 build and first-class Windows. Sessions now explain themselves when you come back to them, the dashboard gains a Git panel and a dockable side panel, and you can talk to the agent by holding a key.

A few changes need your attention before updating:

• Node.js 22 is now the minimum (24 LTS recommended). A Node 20 install is refused up front rather than failing partway through a build.
• Telegram is single-account. Only one bot token is served; move the token you want to telegram.bot_token. Existing config is preserved but the account map is no longer read.
• kirocrew logout now revokes refresh tokens, so signing out ends the session everywhere.
• Terminal output is no longer scanned for credentials. The scan corrupted CJK text and emoji and could hide secrets you printed on purpose; terminal output now passes through untouched.
• Knowledge auto-ingest is opt-in. A fresh install ingests nothing until you switch it on.

Send your next message without waiting for the last one to finish. Crew Mode dispatches topics to parallel sub-sessions and returns answers independently, so a single chat can advance several pieces of work at the same time. Learn more ->

The dashboard's Browser panel is now something the agent drives directly: it navigates, clicks, types, and screenshots right where you're already looking. A private browser build is fetched for you, so a locked-down machine is one step from a working browser, and native desktop automation (Computer Use) is offered on macOS, where it works. Learn more ->

A side-panel tab summarizes what each thread of a session was trying to do and where it landed, with anything still open pulled to the top — opt-in, and its token cost is shown before you turn it on. Earlier chats resume in the background while you read, so the first message sends immediately instead of waiting on a cold start, and you can watch the context window fill as a percentage and token count. Learn more ->

A Git panel shows repository status and commit log alongside the folder tab, the side panel can dock to the bottom as well as the right, and GitHub, GitLab, and Jira links render inline as chips. Feature Previews get their own page, the session list is redesigned with a status gutter and draggable folders, and URL previews now unfurl in your own messages too.

The opening turn's latency drops from roughly 7.4 seconds to about 350 milliseconds, a cold dashboard load moves a quarter of the bytes (7.8 MB to 1.85 MB), dictation is about twice as fast on a many-core host, and long replies render smoothly instead of building pressure as they stream.

A native Linux ARM64 build lands, and Windows becomes a first-class target alongside macOS and Linux x86. A system-wide hotkey (Cmd+Shift+K on macOS, Alt+Shift+K elsewhere) raises the dashboard, you can switch release channels without reinstalling, publish the dashboard on your Tailscale network with kirocrew tailnet up, and launch a cloud crew from the dashboard as a restartable job. Learn more ->

The first feature release since Kiro Crew went open source brings a real browser the agent can operate, eight new built-in apps, a native Windows desktop build, Korean and Japanese interfaces, and setup that no longer assumes Slack, alongside several hundred fixes from the first weeks in the open.

Flip one switch in Settings and the agent can operate a real browser: navigate, click, type, and fill forms, with the live view streaming into the dashboard's Browser panel. Installation happens for you and recovers on its own, and the agent can also serve browser work from the native embedded view. Learn more ->

The App Store adds Spec Builder (spec-driven development), Ops Mission Control (an autonomous ops first responder), Auto-Improvement (measurement-first self-improvement), Meetings (live transcription with structured notes and action items), Papyrus (a LaTeX editor with an AI co-author), Mochi and Crew Companion (desktop companions), and PPTX Maker (describe a deck in chat, get a real .pptx back). Every app is opt-in: install it from the App Store and enable it before it does anything. Learn more ->

The desktop app now ships as a native Windows installer with an integrated titlebar, launcher fixes, and a configurable sandbox tier for agent subprocesses, with skills, usage tracking, and build tooling following Windows conventions. Learn more ->

kirocrew setup no longer asks for Slack tokens. The wizard finishes on the dashboard and points at the full set of chat channels; walk through Slack credentials only when you ask for them with kirocrew setup --slack. Learn more ->

Korean and Japanese join the dashboard, bringing the interface to twelve languages. Bold, italic, and strikethrough now render correctly in CJK prose. Learn more ->

Kiro Crew is now open source. It is a personal AI agent that runs on your own machine, driving kiro-cli over the Agent Client Protocol. Install it, sign in once, and it is yours: no server to rent, no account to create, and your conversations, memory, and files stay on your disk.

Chat with the same agent from a web dashboard, a native desktop app, a terminal CLI (kirocrew chat), or bots for Slack, Discord, Telegram, Microsoft Teams, Webex, WeCom, and WeChat. Every channel shares the same memory and tools, so you can start something at your desk and follow up from your phone. A dashboard session can even hand off to a Slack thread and stay in sync both ways. Learn more ->

Hand the agent a spec with kirocrew run TASK.md and it decomposes, executes, tests, and retries, designed for 10+ hour runs with disk checkpoints so a crash resumes where it stopped. Schedule recurring jobs with cron, split work across parallel sub-agents with kirocrew spawn run, or let a webhook wake the agent when CI or an alert fires. Learn more ->

Preferences, project context, and conversation history persist across sessions and are searched by keyword and by meaning, with embeddings running locally so nothing leaves your machine. Correct the agent once and the lesson sticks in every future session. A Knowledge Library lets you ingest your own documents and code into a searchable personal knowledge graph. Learn more ->

Extend the agent through an in-dashboard App Store with TypeScript and Python SDKs, six apps in the box (including Auto Research, Code Review Sage, and Issue Radar), and Skills: plain markdown files that teach the agent a workflow with no code and no rebuild. Any MCP server can be discovered, probed, and enabled from the dashboard. Learn more ->

The agent can read a native application through the accessibility layer and operate it: press buttons, fill fields, scroll, and drag, reaching work that has no web UI. Actions are delivered to the target app so your mouse pointer never moves by accident, password fields are never read, and every call is written to the audit log. Off by default and macOS-only in this release; enable it in Settings > Computer Use. Learn more ->

An opt-in operating-system sandbox confines kiro-cli subprocesses on Linux and macOS. Layered controls include 137 built-in denied-command patterns that hold even when auto-approval is on, credential redaction, and a two-level governance ceiling enforced at Kiro Crew's own tool gate, stored where the agent can neither read nor write it, so the agent cannot widen its own limits. Learn more ->