Crew changelog

This version makes Windows and Linux first-class installs, moves your secrets out of the config file and into an encrypted vault, and turns the dashboard into a place to edit code, not just discuss it. Every messaging channel reaches parity with Slack and three new ones arrive, MCP servers stop guessing about safe process sharing, and boot uses far less memory.

Windows now ships a signed installer with in-app auto-updates on the stable channel, and the desktop app installs on Linux from .deb or .rpm with a fixed install path, a desktop entry, and per-format in-app updates. The Linux desktop app needs glibc 2.34 or newer; on an older host the one-line CLI install still works. Kiro Crew can also read and drive native Windows applications through UI Automation, so Computer Use is no longer macOS-only, and the Windows agent tree now runs under a Job-object process and memory ceiling that mirrors the Linux control. Learn more ->

Secrets are now stored in an encrypted vault, managed from a new Settings > Secrets page where values stay masked and are never sent to the browser, and can be withheld from agents on a denylist. An MCP server's environment can reference a stored value as secret://NAME, resolved from the vault at spawn time so the secret never sits in on-disk config. Learn more ->

The transcript gains side-by-side diff rendering, per-file editing inline, and a project file tree in the side panel. A file edit made by a tool now renders as an always-visible diff card instead of hiding inside collapsed tool details, and many more file types preview in place: video and audio play inline, XLSX spreadsheets render with sheet tabs, and notebook previews show embedded images, highlighted code, and Mermaid diagrams. A keystroke-launched command bar names each row's kind and ships on by default. Learn more ->

Three new channels join the roster: WhatsApp (link a personal account by QR code), iMessage (routed through your own Messages.app via a local macOS bridge, deny-by-default with an explicit allowlist), and Feishu (Lark). Teams, Telegram, and Webex reach parity with Slack, and Discord gains a nine-command slash menu with a model picker, runtime stats, and cron delivery. A shared fix means /yolo and per-session Trust now actually take effect on Teams, Webex, WeCom, WeChat, and iMessage, where they were silently inert. Learn more ->

Session search now spans every connected gateway and interleaves local and remote results, and a query like 4411, /pull/4411, or owner/repo#4411 all find the same session. Reaching the top of a long transcript loads older turns instead of stopping, you can filter by tag and assign any custom hex color, and an opt-in dashboard MCP set lets one session message, stop, and read another to hand off work with its full context. Learn more ->

Boot uses about 875MB less memory: the embedding model no longer loads at startup when there is no embedding work to do, and loads on first real use instead. The dashboard opens immediately by printing its URL and launching the browser without waiting on MCP probing, sandboxed spawns are about 1.45 seconds faster each, and kirocrew CLI startup drops from 1.3 seconds and 112MB of imports to 0.5 seconds and 54MB.

This version lets the agent run several threads of your work at once, drives a real browser inside the dashboard, and broadens the desktop lineup with a native Linux ARM64 build and first-class Windows. Sessions now explain themselves when you come back to them, the dashboard gains a Git panel and a dockable side panel, and you can talk to the agent by holding a key.

A few changes need your attention before updating:

• Node.js 22 is now the minimum (24 LTS recommended). A Node 20 install is refused up front rather than failing partway through a build.
• Telegram is single-account. Only one bot token is served; move the token you want to telegram.bot_token. Existing config is preserved but the account map is no longer read.
• kirocrew logout now revokes refresh tokens, so signing out ends the session everywhere.
• Terminal output is no longer scanned for credentials. The scan corrupted CJK text and emoji and could hide secrets you printed on purpose; terminal output now passes through untouched.
• Knowledge auto-ingest is opt-in. A fresh install ingests nothing until you switch it on.

Send your next message without waiting for the last one to finish. Crew Mode dispatches topics to parallel sub-sessions and returns answers independently, so a single chat can advance several pieces of work at the same time. Learn more ->

The dashboard's Browser panel is now something the agent drives directly: it navigates, clicks, types, and screenshots right where you're already looking. A private browser build is fetched for you, so a locked-down machine is one step from a working browser, and native desktop automation (Computer Use) is offered on macOS, where it works. Learn more ->

A side-panel tab summarizes what each thread of a session was trying to do and where it landed, with anything still open pulled to the top — opt-in, and its token cost is shown before you turn it on. Earlier chats resume in the background while you read, so the first message sends immediately instead of waiting on a cold start, and you can watch the context window fill as a percentage and token count. Learn more ->

A Git panel shows repository status and commit log alongside the folder tab, the side panel can dock to the bottom as well as the right, and GitHub, GitLab, and Jira links render inline as chips. Feature Previews get their own page, the session list is redesigned with a status gutter and draggable folders, and URL previews now unfurl in your own messages too.

The opening turn's latency drops from roughly 7.4 seconds to about 350 milliseconds, a cold dashboard load moves a quarter of the bytes (7.8 MB to 1.85 MB), dictation is about twice as fast on a many-core host, and long replies render smoothly instead of building pressure as they stream.

A native Linux ARM64 build lands, and Windows becomes a first-class target alongside macOS and Linux x86. A system-wide hotkey (Cmd+Shift+K on macOS, Alt+Shift+K elsewhere) raises the dashboard, you can switch release channels without reinstalling, publish the dashboard on your Tailscale network with kirocrew tailnet up, and launch a cloud crew from the dashboard as a restartable job. Learn more ->

The first feature release since Kiro Crew went open source brings a real browser the agent can operate, eight new built-in apps, a native Windows desktop build, Korean and Japanese interfaces, and setup that no longer assumes Slack, alongside several hundred fixes from the first weeks in the open.

Flip one switch in Settings and the agent can operate a real browser: navigate, click, type, and fill forms, with the live view streaming into the dashboard's Browser panel. Installation happens for you and recovers on its own, and the agent can also serve browser work from the native embedded view. Learn more ->

The App Store adds Spec Builder (spec-driven development), Ops Mission Control (an autonomous ops first responder), Auto-Improvement (measurement-first self-improvement), Meetings (live transcription with structured notes and action items), Papyrus (a LaTeX editor with an AI co-author), Mochi and Crew Companion (desktop companions), and PPTX Maker (describe a deck in chat, get a real .pptx back). Every app is opt-in: install it from the App Store and enable it before it does anything. Learn more ->

The desktop app now ships as a native Windows installer with an integrated titlebar, launcher fixes, and a configurable sandbox tier for agent subprocesses, with skills, usage tracking, and build tooling following Windows conventions. Learn more ->

kirocrew setup no longer asks for Slack tokens. The wizard finishes on the dashboard and points at the full set of chat channels; walk through Slack credentials only when you ask for them with kirocrew setup --slack. Learn more ->

Korean and Japanese join the dashboard, bringing the interface to twelve languages. Bold, italic, and strikethrough now render correctly in CJK prose. Learn more ->

Kiro Crew is now open source. It is a personal AI agent that runs on your own machine, driving kiro-cli over the Agent Client Protocol. Install it, sign in once, and it is yours: no server to rent, no account to create, and your conversations, memory, and files stay on your disk.

Chat with the same agent from a web dashboard, a native desktop app, a terminal CLI (kirocrew chat), or bots for Slack, Discord, Telegram, Microsoft Teams, Webex, WeCom, and WeChat. Every channel shares the same memory and tools, so you can start something at your desk and follow up from your phone. A dashboard session can even hand off to a Slack thread and stay in sync both ways. Learn more ->

Hand the agent a spec with kirocrew run TASK.md and it decomposes, executes, tests, and retries, designed for 10+ hour runs with disk checkpoints so a crash resumes where it stopped. Schedule recurring jobs with cron, split work across parallel sub-agents with kirocrew spawn run, or let a webhook wake the agent when CI or an alert fires. Learn more ->

Preferences, project context, and conversation history persist across sessions and are searched by keyword and by meaning, with embeddings running locally so nothing leaves your machine. Correct the agent once and the lesson sticks in every future session. A Knowledge Library lets you ingest your own documents and code into a searchable personal knowledge graph. Learn more ->

Extend the agent through an in-dashboard App Store with TypeScript and Python SDKs, six apps in the box (including Auto Research, Code Review Sage, and Issue Radar), and Skills: plain markdown files that teach the agent a workflow with no code and no rebuild. Any MCP server can be discovered, probed, and enabled from the dashboard. Learn more ->

The agent can read a native application through the accessibility layer and operate it: press buttons, fill fields, scroll, and drag, reaching work that has no web UI. Actions are delivered to the target app so your mouse pointer never moves by accident, password fields are never read, and every call is written to the audit log. Off by default and macOS-only in this release; enable it in Settings > Computer Use. Learn more ->

An opt-in operating-system sandbox confines kiro-cli subprocesses on Linux and macOS. Layered controls include 137 built-in denied-command patterns that hold even when auto-approval is on, credential redaction, and a two-level governance ceiling enforced at Kiro Crew's own tool gate, stored where the agent can neither read nor write it, so the agent cannot widen its own limits. Learn more ->