A hot patch for 0.12.0: the KAS engine and the Claude backend follow your agent specs, hooks and MCP servers the way kiro-cli does, chats pick up after a planned restart and queued messages wait their turn, and schedules run in the right workspace with a bounded history. A broad set of security, Windows, desktop and accessibility fixes lands with them.

Notable fixes

Chat and sessions. Chats that a planned restart cut off resume, a queued message waits while its card's editor is open and is checked again right before it runs, and a session's own messages are never held behind its sub-agents. A turn the backend refused for model capacity ends with a notice instead of offering Resume, a streaming reply stays live on slow devices, and unsent text in a split view or a Bot chat survives a page reload. If a dashboard module fails to load, the page reloads instead of staying blank, and a cleared chat no longer resumes in a folder you removed. A prompt whose reply was too large to read ends its turn instead of leaving the session waiting.

KAS engine. KAS reads a kiro-cli agent spec the way kiro-cli does: tool aliases, allowedTools globs, allowed shell commands and paths, and a grant beside deniedCommands or deniedPaths keep their meaning, and spec hooks get kiro-cli's field names, cover every call they name and run on scheduled turns too. MCP servers take their settings from your kiro-cli mcp.json and see the gateway's Kerberos ticket cache and ssh agent, and an unattended run waits for a slow server to start. KAS answers /context, /knowledge, /code and /hooks, the session start notice names a refused permissions block or an unreadable mcp.json, and the engine install trusts your system's certificate store and refuses a host whose glibc is too old before it begins.

Claude and other harnesses. On the Claude backend a session loads workspace steering and the project's AGENTS.md and gets them back after a compaction, a spec's toolsSettings allowlists are enforced, a Bot worker starts with only the MCP servers it was granted, and an overloaded error is retried. /clear is answered locally, Claude's own commands appear in the / menu, auto memory stays off in incognito and temporary chats, and kirocrew doctor warns about an outdated claude-agent-acp. A pi session now carries the MCP servers its agent spec declares.

MCP servers and connections. The MCP tab lists servers an agent rebuild dropped, a server added through Add Custom can be removed again, and ${HOME} and ${USER} in a server's settings resolve on Windows. A refused connection sign-in is reported at once instead of after 10 minutes, the Connections badge sees sign-ins KAS holds, and a grant that just failed its check no longer shows as connected. An unreadable global mcp.json is reported as unreadable rather than corrupt, and sign-in callbacks that carry extra provider parameters are accepted.

Bots, crews and sub-agents. A Bot shows as working while its worker sessions run, closing a conductor closes the workers it manages, a conductor wakes only when a worker's status changes, and a Bot worker keeps its own MCP servers and the ones its agent.env resolves. Nested sub-agent runs show in the root chat's sub-agents panel and inherit its trust, and a running sub-agent stops auto-approving once that trust is revoked. Read aloud and auto-speak work in crewmate chats, the task runner keeps an active run resumable across a graceful restart, and the work ledger patrol stays armed after every item closes.

Schedules. A scheduled run's tab opens in its agent's workspace, so its sessions are no longer refused, a job keeps its wall-clock time across a daylight saving change, and previews leave out the dates a job skips. Each job keeps only its 20 newest run transcripts, scheduled commands get the same PATH as agent sessions, and a run whose agent was renamed or uninstalled is marked failed. kirocrew snapshot --keep run from a schedule now prunes older snapshots.

Security. This release tightens several access checks, covering dashboard sign-in, session ownership, channel senders, destructive and self-management commands, sandbox file guards and Windows file access. Started off a terminal, for example by a service manager, the gateway no longer writes its dashboard sign-in link to the log (run kirocrew token for one), the desktop app's live log no longer records the dashboard token, and proxied app requests no longer carry it. KAS keeps PowerShell process control out of auto-approve, a deniedPaths entry ending in * also covers the folders below it, and a Claude session's switched-off tool on an MCP server whose name contains a dot is denied. An unreadable sign-out or token refresh record now fails closed instead of being saved over.

Approvals and the sandbox. Each approval mode says what it runs without asking, Reads mode no longer asks to approve kiro-cli's own file reads, a tool a hook blocked shows as blocked rather than done, and a malformed message rule in config.json no longer breaks every chat turn. max_memory_mb no longer stops Node and GraalVM tools from starting in scheduled runs (the new opt-in max_address_space_mb sets that limit), and the sandbox cleans up after a dead launcher so the runtime folder no longer runs out of inodes.

Gateway, install and doctor. kirocrew restart refuses to run against a stopped installed service, a busy port names its holder and suggests --port, the crash dump of a gateway that died without a clean exit is kept, and the service PATH puts nvm's Node ahead of /usr/bin. The installer stops when the KAS engine download is interrupted, a data home that cannot be written is refused with one line and one another account owns is explained, and the browser harness installs with its own pip where the gateway has none. kirocrew doctor fails when the selected backend is missing kiro-cli or a Claude component, warns instead of failing on a KAS engine the first chat will download, and no longer fails on a missing optional voice extra or ffmpeg. Kiro backend users are no longer told to run aws sso login when access is refused.

Memory, knowledge and artifacts. One unreadable line in the lessons file no longer breaks every lesson, deleting a memory entry asks first, and memory sources are indexed again after the search index repairs itself. A knowledge folder keeps syncing until its scan ends even when one file fails, an upload over the size limit is refused before it is sent, a source says why it waits in pending, and a failed confirm, rename or Sync shows an error. An SVG artifact keeps its own styles without restyling the dashboard, and a failed artifact move no longer leaves new folders behind.

Channels. Slack sends a sentence's last word before the tool card, keeps one answer row when a linked stream rotates, and says why it is not connected when startup turned it off. Teams posts the answer below an approval card and keeps a replayed message as text, Telegram keeps each sender's message in their own turn, and WhatsApp counts a quote on a voice note, sticker or video note and says why an image could not be sent. Messages queued on a channel are answered once a turn elsewhere ends, channel tokens are verified through the channel's proxy, and kiro-cli's steer acknowledgement stays out of replies and titles.

Remote crews and pods. A remote crew offers one ssh line that forwards every pane port, keeps retrying a dropped tunnel for up to an hour, and waits for its running work before it restarts. A pod boots when kiro-cli keeps its engine in its data folder, kirocrew pod down waits for the whole stop, and Windows pod tasks run at normal priority.

Windows and the desktop app. On Windows the gateway and spec hooks start with no console window, a timed-out process ends with its whole tree, an agent's processes end with its runtime, and crash dumps are found in Crashpad's reports folder. A pending desktop update shows its release notes, the top bar stays draggable when docked on macOS and over a scrolled chat on Windows, and Escape ends a video's fullscreen. The Linux package installs on distributions that renamed libasound2 to libasound2t64.

Dashboard, keyboard and languages. Buttons across the dashboard keep keyboard focus while their request runs, toggles and disclosure rows tell a screen reader whether they are on or open, and hover-only row controls appear when the keyboard reaches them. More of the dashboard is translated, counts are pluralized and lists are joined the way each language does, and a sentence around inline code or bold text stays whole. The @ picker finds files in your project's specs and steering folders, the chat composer stays above the iPad keyboard, a proxy's 502 or 503 page shows as a temporary outage, and the chat's path chip and Copy link do what they say.

Built-in apps. App pages load through the dashboard, so they work behind a reverse proxy that asks you to sign in, an app update keeps your edits to its agents and brings its schedules into the running scheduler, and a registry update to an older version is refused. A pptx-maker engine whose lock file was rewritten repairs itself.

What's Changed

• fix(release): backport thirteen KAS, security and reliability fixes to 0.12.0 line by @buluoray in #30954
• fix(release): backport one knowledge fix to 0.12.0 line by @buluoray in #31019
• fix(release): backport six KAS, hook and security fixes to 0.12.0 line by @buluoray in #30987
• fix(release): backport the KAS signed-out chat row translation to 0.12.0 line by @buluoray in #31373
• fix(release): backport two dashboard and Bot steering fixes to 0.12.0 line by @buluoray in https://github.com/kirodotdev/KiroCre...

What's Changed

• fix(release): backport thirteen KAS, security and reliability fixes to 0.12.0 line by @buluoray in #30954
• fix(release): backport one knowledge fix to 0.12.0 line by @buluoray in #31019
• fix(release): backport six KAS, hook and security fixes to 0.12.0 line by @buluoray in #30987
• fix(release): backport the KAS signed-out chat row translation to 0.12.0 line by @buluoray in #31373
• fix(release): backport two dashboard and Bot steering fixes to 0.12.0 line by @buluoray in #31422
• fix(release): backport four KAS, Claude-backend and sandbox fixes to 0.12.0 line by @buluoray in #31328
• fix(release): backport eight security, hang and KAS fixes to 0.12.0 line by @buluoray in #30893
• fix(release): backport KAS tool-less helper MCP fix to 0.12.0 line by @buluoray in #31477
• fix(release): backport KAS MCP mute and Bot crew-log fixes to 0.12.0 line by @buluoray in #31512
• fix(release): backport new-Bot creation failure reason to 0.12.0 line by @buluoray in #31554
• fix(release): backport two KAS permission fixes to 0.12.0 line by @buluoray in #31636
• fix(release): backport KAS MCP sign-in logging to 0.12.0 line by @buluoray in #31645
• fix(release): backport twelve low-risk KAS, Bot and runtime fixes to 0.12.0 line by @buluoray in #31693
• fix(release): backport six KAS and security fixes to 0.12.0 line by @buluoray in #30809
• fix(release): backport provider-owned STT session limit to 0.12.0 line by @saisrinivas26 in #31726
• fix(release): backport Bot worker edition MCP tool refs to 0.12.0 line by @buluoray in #31891
• fix(release): backport the idle-slot approval sweep fix to 0.12.0 line by @buluoray in #31894
• fix(release): backport eight MCP, sign-in and user-reported fixes to 0.12.0 line by @buluoray in #31948
• fix(release): backport ten small KAS and Bot fixes to 0.12.0 line by @buluoray in #31926
• fix: backport nine user-reported fixes to 0.12.1 (batch 21) by @buluoray in #31981
• fix(release): backport ten user-reported fixes to 0.12.0 line by @buluoray in #31968
• fix(kas): backport the bare-name hook matcher narrowing to 0.12.1 (batch 23) by @buluoray in #31990
• fix: backport eight user-reported fixes to 0.12.1 (batch 22) by @buluoray in #31987
• fix(release): backport two KAS command-check and redaction fixes to 0.12.0 line by @buluoray in #31694
• fix(models): backport the cold model list fill to 0.12.1 (batch 24) by @buluoray in #32112
• fix(mcp): backport the timed-out local probe retry to 0.12.1 (batch 25) by @buluoray in #32140
• fix(kas): backport the allowedCommands chain grant to 0.12.1 (batch 26) by @buluoray in #32149
• refactor: backport the agents.py effort-levels split to 0.12.1 (batch 29) by @buluoray in #32184
• fix: backport five user-reported fixes to 0.12.1 (batch 30) by @buluoray in #32194
• fix: backport eight MCP, Bot and KAS fixes to 0.12.1 (batch 27) by @buluoray in #32155
• fix: backport four user-reported KAS and MCP fixes to 0.12.1 (batch 28) by @buluoray in #32174
• fix: backport the MCP dropped-server notice and KAS tool aliases to 0.12.1 (batch 31) by @buluoray in #32202
• fix(kas): backport three KAS agent-file, skill and command fixes to 0.12.1 (batch 32) by @buluoray in #32222
• fix: backport the helper-turn memory gate and Ultra Mode chip fix to 0.12.1 (batch 34) by @buluoray in #32242
• fix(kas): backport the allowedTools grant-only settings fix to 0.12.1 (batch 35) by @buluoray in #32245
• fix(kas): backport the checked-deny grant and kiro-cli toolsSettings grant fixes to 0.12.1 (batch 37) by @buluoray in #32467
• fix: backport the edition MCP tools ref and KAS OAuth pointers to 0.12.1 (batch 33) by @buluoray in #32229
• fix: 0.12.1 batch 36 - KAS unattended MCP wait, sign-in wording, withheld-env notice by @buluoray in #32349
• fix(kas): backport the KAS mcp.json parity fix to 0.12.1 (batch 38) by @buluoray in #32492
• fix: 0.12.1 batch 39 - Bolin queue picks and Slack-bound ledger fix by @buluoray in #32572
• fix: 0.12.1 batch 42 - seven fixes from Bolin's queue by @buluoray in #32613
• fix: 0.12.1 batch 41 - report a failed new-session create on the shell notice by @buluoray in #32581
• fix: backport 0.12.1 batch 43 (10 user-reported fixes) by @buluoray in #32641
• fix: backport 0.12.1 batch 44 (10 user-reported fixes) by @buluoray in #32647
• fix: backport #30781 to 0.12.1 (chat save drift is not a delete) by @buluoray in #32658
• fix: backport #30213 and #31102 to 0.12.1 (edit skill menu, sidebar colors) by @buluoray in #32664
• fix: backport 0.12.1 batch 45 (9 user-reported fixes) by @buluoray in #32653
• fix: backport #23603 to 0.12.1 (session-search scan window) by @buluoray in #32671
• fix: backport #26258 to 0.12.1 (artifact viewer 100vh runaway) by @buluoray in #32729
• fix: backport #30873 to 0.12.1 (meeting transcription socket rotation) by @buluoray in #32770
• fix: backport 0.12.1 wide batch 1 (14 user-facing fixes) by @buluoray in #32787
• fix: backport 0.12.1 batch 54 (10 user-reported fixes) by @buluoray in #32801
• fix: backport 0.12.1 batch 53 (9 user-reported fixes) by @buluoray in #32791
• fix: backport 0.12.1 wide batch 2 (8 user-facing fixes + 2 prerequisites) by @buluoray in #32808
• fix: backport #32498 to 0.12.1 (skip a repeated synthesis report) by @buluoray in #32835
• fix: backport 0.12.1 batch 58 (25 wide-bar fixes) by @buluoray in #32855
• fix: backport 0.12.1 batch 59 (25 wide-bar fixes) by @buluoray in #32856
• fix: backport 0.12.1 fast batch v1b-2 (22 user-facing fixes) by @buluoray in #32864
• fix: backport 0.12.1 steer batch (#32396 with its ordering fix #32826) by @buluoray in #32886
• fix: backport 0.12.1 batch 57 (23 wide-bar fixes) by @buluoray in #32851
• fix: backport #32387, #32434 and #32833 to 0.12.1 by @buluoray in #32823
• fix: backport 0.12.1 batch 60 (24 wide-bar fixes) by @buluoray in #32860
• fix: backport #32541 to 0.12.1 (keep the loop thread's stack in a stall dump) by @buluoray in #32887
• fix: backport 0.12.1 wide batch 3 (15 user-facing fixes) by @buluoray in #32836
• fix: backport 0.12.1 fast batch v1b-1 (23 user-facing fixes) by @buluoray in #32840
• fix(slack): 0.12.1 batch 40 - mid-turn link gets the turn's final answer (release-only hand port of #32336) by @buluoray in #32578
• fix: backport 0.12.1 batch 61 (25 wide-bar fixes) by @buluoray in #32888
• fix: backport #27535 and #32804 to 0.12.1 (keep an unreadable agent spec) by @buluoray in #32758
• fix: backport 0.12.1 batch 62 (10 wide-bar fixes) by @buluoray in #32891
• fix: backport 0.12.1 fast batch v1b-4 (11 user-facing fixes) by @buluoray in #32919
• fix: backport 0.12.1 fast batch v1b-3 (23 user-facing fixes) by @buluoray in #32894
• fix: backport 0.12.1 batch bolin-2 (11 user-facing fixes) by @buluoray in #32928
• fix: backport 0.12.1 wide batch 4 (15 user-facing fixes) by @buluoray in #32926
• fix: backport 0.12.1 batch 63 (6 docs/tests-co...

Bots (the new name for Mates) are now on for everyone, the agent can drive a browser you watch and take over live, and two more coding agents join the harness list. Connections, chat, the sidebar, schedules and apps pick up many small controls. Ultra Mode, Explore, Session Environments, Shared Crew and Remote dispatch arrive as previews you can switch on.

Bots for everyone

• Bots without a preview switch: Mates are now called Bots in every screen, prompt and language, the Bots row in the left rail, the /members page and the Bot rows in the command bar are always shown, and starred Bots gather in a Bots group in the rail that you can drag to reorder.
• A desk of its own: each Bot keeps the chats and folders it opens in one sidebar folder named after it, and works in its own git worktree per repository, so two Bots on one repo no longer commit each other's edits.
• Take a Bot with you: the Bot profile card's "Export as file" writes a .kirobot file with an editable lessons draft, and Bots > Import from file reads it back (older .crewjam and .crewmate files still import).

Bots that keep track of their work

• A ledger for handed-out work: a Bot that sends work to workers records each item in a work ledger, and its own chat gets an automatic patrol that watches it.
• Approvals in one place: a Bot's chat shows the approvals and questions from the sessions it started, and its roster row gets a badge.
• A catch-up that checks: when you return after about half an hour away, the card a Bot posts reads the live state of up to five pull requests its open questions name and lists them as pills.

A browser you can watch and take over

• Live view: when the agent uses the browser, the chat shows the page live in the transcript, and you can take it over at any time.
• Sign in without the agent seeing: a sign-in sheet types a secret into the page for you, and nothing typed is saved.
• Settings: Settings > Browser controls which browser is used, the live view and its quality, and recording, and the old browser tool is gone, while browser setup no longer fails on some Python installs.

More coding agents

• Strands: Settings > Agent Harness lists Strands once the Strands CLI is installed, its setup card stores the model provider keys in Settings > Secrets, and changing the model or effort in the picker relaunches it on the same session.
• GitHub Copilot CLI: pick it under Settings > Agent Harness (a session on any Copilot CLI release other than 1.0.100 is refused with the install command), and every harness's model picker now shows that backend's own model names.
• KAS on its own: choosing KAS uses your Kiro Crew sign-in, falls back to the account from kiro-cli login, and runs Kiro Crew's own engine when kiro-cli is missing, while /agent, /context, /help, /mcp, /model, /tools and /usage answer locally on the default KAS backend.

Connections and sign-ins

• Google Workspace: the Connections page adds Gmail, Google Drive, Calendar, Sheets, Docs and Slides entries that use your own Google OAuth app.
• Sign-ins that stay: on the default KAS backend, remote MCP sign-ins such as Atlassian, Notion and Figma are kept across sessions, and agent.kas_persist_mcp_sign_in turns that off.
• Start from a popular list: the Add Skill and Add Server dialogs open on a Popular list before you type a search.

Knowledge from your own AWS account

• Bedrock Knowledge Bases: under Capabilities > Knowledge > Sources, "Add Knowledge Base" registers an existing Amazon Bedrock Knowledge Base that is queried live and merged into knowledge search (each search is billed by AWS, only the gateway owner can add one, and it needs the optional bedrock extra).

Settings and themes

• Developer settings for everyone: Developer Mode is gone, so Settings > Developer always shows Feature Previews, Logs, System, Telemetry, Storage, Memory, Config, Debug tools and Archive, and Feature Previews switches are saved on the gateway, so they follow you to every browser and the desktop app, and MCP Management now sits below the MCP Servers list on the Connections page.
• Themes and thresholds: "👁 Color-blind safe" and "💜 Amethyst OLED" are under Settings > Display > Theme, and Settings > Chat > Advanced > Auto-compact threshold gains a Custom option for any percent from 5 to 90.
• Shorter Settings rows: each row keeps one short line about its effect in view and moves the longer explanation behind its info tip, and a section's introduction now sits in a tip beside its heading.

Chat you can handle more ways

• Take back a steer: a steer the running turn has not read yet can be unsent, edited in the message box or queued from its row's menu, on the Kiro CLI harness.
• Copy what you need: code blocks gain "Wrap lines", quotes gain "Copy quote", right-clicking an image offers "Copy image", and Settings > Chat > Transcript adds an opt-in "Copy on select".
• Attach and read more: iPhone HEIC photos attach from the composer and are converted to JPEG, a box you drag over an image in the file viewer can carry a comment, and "Jump to the bottom when you send" in Settings > Chat can be turned off.

Chat that reads and drives better

• Easier to read replies: rendered markdown spaces paragraphs, lists and sections more clearly and tables lose the grey header fill, all following the chat font size setting.
• Keys and slash helpers: Cmd+O (Ctrl+O on Windows and Linux) pops the current session out to its own window, Tab fills the message box with the first follow-up option, typing /workflow opens a menu of your saved workflows, Up-arrow recalls a prompt whose send never reached the transcript, and the dock terminal can search its scrollback and go fullscreen with Cmd+F on macOS and Ctrl+Shift+F on Linux and Windows.
• Session messages as cards: a message one session sends to another shows as a card naming the sender, with a link to open that session, and the sender's chat shows a "Sent to @name" card once the message is delivered.

A sidebar that sorts itself

• Session menu: every session row's menu adds "Copy session ID" and "Reference in chat", and once you have a folder, "Move to folder" ends with "New folder" to create and move in one step.
• Group and filter: the sidebar Filter menu adds "Group by kind" and a "Not in progress" row, and "Clean up sessions" adds 14 and 30 day windows.
• Color and tabs: a session's color now tints its chat header, the Categorical palette under Settings > Display > Sidebar gives twelve fixed hues, and session tabs drag to reorder.

Pick up where you left off

• Resume them all: while sessions are interrupted by a restart or sleep, the sidebar search dock shows "N interrupted sessions" with a "Resume N sessions" button.
• Pin a folder: a folder's header menu adds Pin folder, which keeps its sessions (subfolders included) listed under the status chips, tag chips and folder checkboxes.
• Start again from the first message: the session header menu's Initial prompt submenu shows and copies the first message, or drafts a new session from it on the same agent, project and folder.

Files and paths

• Upload to the Files panel: drag files onto the panel or use Upload files to add new files to the folder it shows, within the usual extension and size limits.
• Show hidden files: a toggle in the Files rail header lists dot-files such as .env, even when git ignores them, and remembers your choice in that browser.
• Relative paths work: paths in diffs, tool calls and replies open against the chat's project directory.

Notifications that reach you

• Push when closed: Settings > Notifications > Push notifications > "Notify me even when Kiro Crew is closed" delivers to an installed PWA, including iOS after Add to Home Screen.
• Your own sounds: Settings > Notifications > Custom sounds takes a short MP3, WAV or OGG file for any category.
• Missed approvals: an approval that expires unanswered leaves a bell note naming the tool, a chat that stops on an error you must act on leaves a "Chat errors" bell entry linking to it, and on phones the live banner swipes away.

Slack and other channels

• Slack code channels: with slack.code_channels on (it is off by default, and needs your workspace's Slack code channels feature, an updated app manifest and a reinstall), mentioning Kiro Crew in a thread with multi-step work opens a code channel backed by a dashboard session that you can stop with its button or !stop.
• Feishu commands: Feishu gains /stop (alias /cancel) and /help, like the other channels.
• Discord choices: pressing a long choice answers with its full text instead of the cut label.

Hooks and what agents can do

• Your hook files on KAS: the hook files in your Kiro hooks folder now run on KAS turns as they do on the Kiro CLI engine, a pre-tool hook that exits with 2 blocks the tool, and script hooks saved on the Hooks page also run on messaging channel turns and in 1:1 Slack DMs with the bot.
• Reveal a removed credential: when redaction removes a credential from a reply, the owner can Show, Copy or Hide it in the reply, and every reveal is audited.
• Refuse guessed writes: setting hooks.batch_write_guard refuses a write sent in the same parallel batch as a read, because its arguments would be guesses, and it is off by default.

Schedules and apps

• Quieter failures: the job dialog's "Send the failure message after N failures in a row" (and kirocrew cron add --alert-after N) rings only the bell for earlier failures, and a run the security gate partly refused shows "Partial" (creating a job over the REST API now keeps the limits you send).
• More ways to say when: one-shot times for kirocrew cron add --at accept days and weeks ("in 2 days", "in 1 week"), a cron job with no z...

What's Changed

• test(chat-sidebar): wrap reveal dispatches in act by @javenciu in #27118
• test(pr-quality): pin utf-8 on the test_pr_quality_gates subprocess call by @javenciu in #27094
• test(papyrus-gitops): pin utf-8 on test_papyrus_gitops subprocess calls by @javenciu in #27127
• test(side-panel): wrap dock reset in act for the bottom-dock case by @javenciu in #27144
• perf(crew): read a crewmate turn's managed roots once; wait after a discarded consolidation pass by @iamwhatever in #26986
• test(lightbox-copy): wrap failed copy in async act by @javenciu in #27139
• test(build-desktop): pin utf-8 on 1 subprocess call by @javenciu in #27132
• fix(dashboard): translate view switch labels and mark the active one by @RohanK6 in #27124
• test(chat-page): run the Cmd+F keypress in an async act by @javenciu in #27131
• fix(workflows): read a positional-only ctx and keyword phase titles by @RohanK6 in #27095
• feat(prepare-pr): let a maintainer re-arm green_age's re-sync budget by @tim-finnigan in #26944
• ci(runners): route the two ci.yml matrix Windows legs to the Windows group by @tim-finnigan in #26855
• ci(runners): give the Windows resolver the same group fallback as Linux by @tim-finnigan in #26828
• test(link): give weak tests real outcome checks by @iamwhatever in #26990
• fix(crew): wake a crewmate whose thread a restart left unloaded by @CrysisDeu in #26401
• test(chat-sidebar): wrap reveal dispatch in act by @javenciu in #27154
• test(knowledge-page): wrap search focus in act before escape by @javenciu in #27153
• ci: give backend-test 70 min off CodeBuild so four-wide fork shards finish by @chenmingwei23 in #26987
• fix(knowledge): show why list, tag and bulk actions failed by @RohanK6 in #27103
• build(deps): bump docker/login-action from 4.6.0 to 4.7.0 by @dependabot[bot] in #24489
• test(use-bottom-terminal): wrap store reset in act so late updates land by @javenciu in #27135
• feat(settings): type an exact auto-compact threshold under a Custom… option by @RohanK6 in #26545
• fix(dashboard): name a stopped turn's own opener in its restore by @javenciu in #19959
• fix(i18n): raise the i18next floor to 26.4.4 so an unclosed nesting marker cannot hang the tab by @JLargent42 in #22326
• fix(memory): match episode tags on their stored form, wildcards escaped by @RohanK6 in #27082
• test(whats-app-panel): settle held group save inside act by @javenciu in #27151
• fix(apps): convert HEIC and downscale images in app composer uploads by @RohanK6 in #27160
• test(markdown-panel): wait for the outline read after a decode by @javenciu in #27155
• test(artifact-detail-page): wait for copied state after copy click by @javenciu in #27169
• fix(md-notebook): pin utf-8 on the server subprocess call by @javenciu in #27136
• test(selection-toolbar): await copy click inside act by @javenciu in #27145
• build(deps): bump docker/setup-qemu-action from 4.3.0 to 4.4.0 by @dependabot[bot] in #24490
• feat(side-chat): say Refresh context clears the side chat in every tab by @unstablebrainiac in #24682
• fix(chat): give subagent card stat chips and state glyph spoken labels by @RohanK6 in #26509
• fix: keep the resized badge on files a failed embed send restores by @RohanK6 in #27185
• test(chat-sidebar): wrap folder reveal dispatches in act by @javenciu in #27198
• test(trust-app-modal): act-wrap enable click in the gate helper by @javenciu in #27192
• test(issue-radar-detail): settle stale copy inside act by @javenciu in #27194
• test(markdown-renderer): settle path probe and chip click in act by @javenciu in #27201
• test(kiro-prerequisite): pin utf-8 on 2 subprocess calls by @javenciu in #27174
• test(mochi-chat-panel): deliver test events inside act by @javenciu in #27175
• test(crew-companion): wrap settings focus in act before draft assertions by @javenciu in #27156
• test(pod-e2e): pin utf-8 on test_pod_e2e_harness_paths subprocess calls by @javenciu in #27168
• test(prepare-pr): pin utf-8 on 4 subprocess calls by @javenciu in #27142
• fix(dashboard): check paths in memory admin off the event loop by @javenciu in #27183
• test(markdown-renderer): wait for path copied label in menu by @javenciu in #27202
• test(installer-node): pin utf-8 on 2 subprocess calls by @javenciu in #27162
• test(markdown-renderer): wait for copy and chip state in session tests by @javenciu in #27189
• test(chat-pane): run the topInset renders inside async act by @javenciu in #27182
• test(chat-panel): wait for picker patch settle before ending by @javenciu in #27176
• test(xdist-host): pin utf-8 on test_xdist_host_budget subprocess call by @javenciu in #27157
• test(about-panel): wrap the gateway switch's status reset in act by @javenciu in #27208
• test(drawer-swipe): wrap shadow touch events in act by @javenciu in #27158
• test(use-optimistic-config-paths): act-wrap sibling save settles by @javenciu in #27161
• test(native-notification): wait for approval reconcile before asserting by @javenciu in #27181
• fix(telegram): take a GIF once instead of as animation and document by @RohanK6 in #27193
• test(prompts-tab): wait for create dialog close and row detail by @javenciu in #27170
• test(artifact-body): wrap retry and show clicks in act by @javenciu in #27165
• test(folder-panel): wait for the timeout notice before the retry sleep by @javenciu in #27188
• test(terminal-exit): act() around dial and panel store reset by @javenciu in #27225
• test(markdown-renderer): wrap the escape dispatch in act by @javenciu in #27217
• fix(discord): close with 4000 when reconnecting so resume works by @RohanK6 in #27167
• test(chat-sidebar): wrap reveal dispatches in act by @javenciu in #27233
• fix(dashboard): check paths in slack settings off the event loop by @javenciu in #27259
• fix(dev-fleet): stat paths in worktree ops off the event loop by @javenciu in #27244
• test(pipeline-view): act-wrap track width observer emit by @javenciu in #27234
• fix(cron): log a sandbox-masked history dir at DEBUG, not WARNING by @buluoray in #27215
• fix(autonudge): announce the next deadline and drop stale asks after a cycle (#26390) by @buluoray in #27227
• test(file-path-menu): wait for copy and act-wrap hand-off focus by @javenciu in #27213
• test(agent-session-resume): wrap openSession in act by @javenciu in #27209
• test(task-detail-panel): wait for save and act() around async saves by @javenciu in #27204
• test(agent-home): pin utf-8 on test_agent_home_isolation subprocess call by @javenciu in #27184
• fix(subagent): leave a shutdown-ended pending recovery for the next start (#25403) by @buluoray in #27235
• chore(version): move main to 0.13.0 now that release/0.12.0 is cut by @bolichen97 in #27166
• test(crew-companion-panel): run the self-mount and its callbacks in act by @javenciu in #27...

What's Changed

• chore(release): forward-port the 0.11.2 fixes to release/0.12.0 by @buluoray in #29148
• chore(release): bump release/0.12.0 to 0.12.0-rc.6 by @buluoray in #29151
• fix(config): treat a non-object agent section as malformed (#28885) by @buluoray in #29152
• fix(release): forward-port store data-loss fixes to 0.12 by @buluoray in #29384
• fix(release): forward-port the 30s initialize cold-start floor to 0.12 by @buluoray in #29413
• feat: carry a crewmate's template policy onto its worker (#28501) by @buluoray in #29378
• fix(release): forward-port #29262 and #28798 to 0.12 by @buluoray in #29363

Full Changelog: v0.12.0-rc.5...v0.12.0-rc.6

A hot patch for 0.11.1: the KAS engine starts and signs in to your MCP servers the way kiro-cli does, a broken MCP settings file is never overwritten, and a handful of Windows and start-up fixes land.

Notable fixes

KAS and MCP servers. MCP servers that need environment values or remote headers start and connect on KAS, Crew's own servers start first so a session no longer waits behind a slow one, and builtin app servers get the session identity they need. A remote MCP sign-in is kept across sessions by default and is offered only when you name the server. Leftover launch files from a closed session are removed when it shuts down.

KAS agent specs. Allowed shell commands written with character classes, groups or quoted parentheses match the way kiro-cli matches them, a long rule is split instead of refused, and use_subagent mounts the engine's sub-agent tool. Spec hooks see KIRO_SESSION_ID as they do on kiro-cli, a stored model id reaches the engine in its own spelling, and a web search through the engine's remote tool is judged as the built-in it is.

MCP settings and start-up. A global mcp.json that does not parse is refused instead of replaced, and one that is not UTF-8 is skipped without hiding every other server. An absolute Windows command ending in .EXE starts again, MCP start-up survives a home folder on a masked mount, and kirocrew kas remove with a blank version refuses instead of removing every engine.

What's Changed

• chore(release): backport the 0.11.2 hotfix fixes to release/0.11.0 by @buluoray in #28835
• chore(release): start the 0.11.2 hotfix line (0.11.2-rc.1 and its CHANGELOG) by @buluoray in #29135
• chore(release): drop 0.11.2-rc.1 to bare 0.11.2 by @buluoray in #29233
• ci: give the 0.11 stable gate a blobless checkout and 20 minutes by @buluoray in #29325
• fix(security): accept Salesforce client ids at operator-listed OAuth endpoints (#29262) by @buluoray in #29373
• build(docker): install kiro-cli from the shared pin files, not the latest manifest (#25616) by @buluoray in #29340
• fix(mcp-gateway): backport crewmate broker overlay routing to 0.11 (#23820, #28798) by @buluoray in #29383

Full Changelog: v0.11.1...v0.11.2

What's Changed

• chore(release): backport the 0.11.2 hotfix fixes to release/0.11.0 by @buluoray in #28835
• chore(release): start the 0.11.2 hotfix line (0.11.2-rc.1 and its CHANGELOG) by @buluoray in #29135
• chore(release): drop 0.11.2-rc.1 to bare 0.11.2 by @buluoray in #29233
• ci: give the 0.11 stable gate a blobless checkout and 20 minutes by @buluoray in #29325
• fix(security): accept Salesforce client ids at operator-listed OAuth endpoints (#29262) by @buluoray in #29373
• build(docker): install kiro-cli from the shared pin files, not the latest manifest (#25616) by @buluoray in #29340
• fix(mcp-gateway): backport crewmate broker overlay routing to 0.11 (#23820, #28798) by @buluoray in #29383

Full Changelog: v0.11.1...v0.11.2-rc.4

What's Changed

• chore(release): backport the 0.11.2 hotfix fixes to release/0.11.0 by @buluoray in #28835
• chore(release): start the 0.11.2 hotfix line (0.11.2-rc.1 and its CHANGELOG) by @buluoray in #29135
• chore(release): drop 0.11.2-rc.1 to bare 0.11.2 by @buluoray in #29233

Full Changelog: v0.11.1...v0.11.2-rc.2

What's Changed

• fix(crew): backport the crewmate work ledger and gated patrol to 0.12.0 (#27948, #27933, #27940, #28301) by @KiroCrewCaptain in #28403
• chore(release): 0.12.0-rc.5 by @KiroCrewCaptain in #28430

Full Changelog: v0.12.0-rc.4...v0.12.0-rc.5

What's Changed

• [0.12.0] fix(dashboard): put Explore behind a default-off Feature Preview (#27449) by @bolichen97 in #27603
• chore(release): 0.12.0-rc.4 by @bolichen97 in #27666

Full Changelog: v0.12.0-rc.3...v0.12.0-rc.4