diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index 2e3564a..37d107e 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -98,6 +98,11 @@ jobs:
           TEST_SH=dash bash tests/test_actor_sh.sh
           TEST_SH=dash bash tests/test_install_id_sh.sh
           TEST_SH=dash bash tests/test_status_skill_sh.sh
+          # Kiro has no slash-command surface, so its status command is a script
+          # rather than a skill document; both shells, since a developer runs it
+          # by hand under bash and a managed rollout verifies under /bin/sh.
+          TEST_SH=dash bash tests/test_status_kiro_sh.sh
+          TEST_SH=bash bash tests/test_status_kiro_sh.sh
           bash tests/test_plugin_versions_sh.sh
           # Twice, because hooks.json fires auto-update.sh as `sh <script>` - an
           # explicit interpreter overrides its bash shebang, so production really
@@ -199,7 +204,9 @@ jobs:
         # gate an edit to scripts/shared/ that was never propagated ships five stale
         # copies, and an edit made directly to a plugin's copy is silently reverted by
         # the next sync — neither is visible in review.
-        run: bash scripts/sync-shared-scripts.sh --check
+        run: |
+          bash scripts/sync-shared-scripts.sh --check
+          bash tests/test_env_file_trust.sh
 
       - name: Hook-log contract (sh + mjs dispatchers)
         # The per-agent log file, line format and rotation policy are duplicated
@@ -335,7 +342,9 @@ jobs:
           pwsh -NoProfile -File tests/test_heartbeat_ps1.ps1
           pwsh -NoProfile -File tests/test_auto_update_ps1.ps1
           pwsh -NoProfile -File tests/test_setup_env.ps1
+          pwsh -NoProfile -File tests/test_env_file_trust.ps1
           pwsh -NoProfile -File tests/test_install_kiro_ps1.ps1
+          pwsh -NoProfile -File tests/test_status_kiro_ps1.ps1
 
   windows:
     # The job the seam CANNOT stand in for. Every PowerShell test in the job above
@@ -390,5 +399,9 @@ jobs:
           if ($LASTEXITCODE -ne 0) { exit 1 }
           powershell -NoProfile -File tests/test_setup_env.ps1
           if ($LASTEXITCODE -ne 0) { exit 1 }
+          powershell -NoProfile -File tests/test_env_file_trust.ps1
+          if ($LASTEXITCODE -ne 0) { exit 1 }
           powershell -NoProfile -File tests/test_install_kiro_ps1.ps1
           if ($LASTEXITCODE -ne 0) { exit 1 }
+          powershell -NoProfile -File tests/test_status_kiro_ps1.ps1
+          if ($LASTEXITCODE -ne 0) { exit 1 }
diff --git a/README.md b/README.md
index 0c0de83..655a53b 100644
--- a/README.md
+++ b/README.md
@@ -45,6 +45,8 @@ and writes your API key, confirms your actor identity, and on macOS/Linux
 configures a `Rogue Security` status badge below the Claude prompt
 (🟢 connected / 🔴 not set up).
 
+On macOS, Linux, and WSL, `install.sh` requires Node.js to merge Kiro CLI 2.x agent hooks. Without Node.js, the installer skips those hooks and CLI 2.x sessions are not covered. Install Node.js and re-run the installer. The Windows `install.ps1` merge uses PowerShell and does not require Node.js.
+
 To target specific agents instead of all detected ones, pass `--claude`, `--codex`,
 `--cursor`, `--gemini`, `--copilot`, `--antigravity` and/or `--kiro` (PowerShell:
 `-Claude` / `-Codex` / `-Cursor` / `-Gemini` / `-Copilot` / `-Antigravity` / `-Kiro`):
diff --git a/docs/log-shipping.md b/docs/log-shipping.md
index b115ede..9dffe4c 100644
--- a/docs/log-shipping.md
+++ b/docs/log-shipping.md
@@ -149,7 +149,7 @@ the one path. This is the same precedence the eleven dispatchers implement and
 ROGUE_LOG_DIR"), and its basename is arbitrary — so, exactly as for the plugin
 shipper, that file's lines are attributed per line off `provider=`, never per file.
 
-Otherwise glob `<dir>/{claude,codex,cursor,gemini,copilot,antigravity}.log` plus each
+Otherwise glob `<dir>/{claude,codex,cursor,gemini,copilot,antigravity,kiro}.log` plus each
 `.1`. Ship `.1` **before** its live file so the batch stays chronological.
 
 **Payload.** Let the task narrow the request, all optional:
diff --git a/docs/plugin-log-shipper.md b/docs/plugin-log-shipper.md
index e51595d..202e663 100644
--- a/docs/plugin-log-shipper.md
+++ b/docs/plugin-log-shipper.md
@@ -12,8 +12,8 @@ ever matters.
 ## Files
 
 ```text
-plugins/{rogue,codex,cursor,copilot,antigravity}/scripts/ship-logs.sh    byte-identical ×5
-plugins/{rogue,codex,cursor,copilot,antigravity}/scripts/ship-logs.ps1   byte-identical ×5
+plugins/{rogue,codex,cursor,copilot,antigravity,kiro}/scripts/ship-logs.sh    byte-identical ×6
+plugins/{rogue,codex,cursor,copilot,antigravity,kiro}/scripts/ship-logs.ps1   byte-identical ×6
 plugins/gemini/scripts/ship-logs.mjs                                     Node-only, per repo rule
 tests/test_ship_logs.sh
 tests/test_ship_logs.ps1
@@ -23,7 +23,7 @@ Callers (one line each, no `hooks.json` change anywhere):
 
 | plugin | call site |
 |---|---|
-| claude, codex, copilot, antigravity | `scripts/heartbeat.sh` / `heartbeat.ps1` |
+| claude, codex, copilot, antigravity, kiro | `scripts/heartbeat.sh` / `heartbeat.ps1` |
 | gemini | `scripts/heartbeat.mjs` |
 | cursor | the inline beacon block in `hook.sh` / `hook.ps1` (it has no heartbeat script) |
 
diff --git a/install.ps1 b/install.ps1
index f9cf9af..3d23d61 100644
--- a/install.ps1
+++ b/install.ps1
@@ -141,9 +141,25 @@ function New-KiroHookEntries {
 
 # UTF-8 without BOM: Windows PowerShell 5.1's Set-Content -Encoding UTF8 writes one,
 # and a BOM is not JSON.
+# PowerShell 5.1 silently stringifies objects beyond ConvertTo-Json's limit.
+# Reject those configurations before touching the user's file.
+function Assert-KiroJsonDepth {
+    param($Value, [int]$Depth = 0)
+    if ($null -eq $Value -or $Value -is [string] -or $Value -is [ValueType]) { return }
+    if ($Depth -gt 100) { throw 'Kiro agent configuration exceeds the supported JSON depth (100).' }
+    if ($Value -is [System.Collections.IDictionary]) {
+        foreach ($child in $Value.Values) { Assert-KiroJsonDepth $child ($Depth + 1) }
+    } elseif ($Value -is [System.Collections.IList]) {
+        foreach ($child in $Value) { Assert-KiroJsonDepth $child ($Depth + 1) }
+    } else {
+        foreach ($property in $Value.PSObject.Properties) { Assert-KiroJsonDepth $property.Value ($Depth + 1) }
+    }
+}
+
 function Write-KiroJsonFile {
     param([string]$Path, $Document)
-    $json = $Document | ConvertTo-Json -Depth 10
+    Assert-KiroJsonDepth $Document
+    $json = $Document | ConvertTo-Json -Depth 100 -ErrorAction Stop
     [System.IO.File]::WriteAllText($Path, $json + "`n", (New-Object System.Text.UTF8Encoding($false)))
 }
 
@@ -182,7 +198,8 @@ function Merge-KiroAgentHooks {
     $merged = @($kept + $Entries)
     if ($prop) { $prop.Value = $merged }
     else { $cfg | Add-Member -NotePropertyName hooks -NotePropertyValue $merged }
-    Write-KiroJsonFile $File $cfg
+    try { Write-KiroJsonFile $File $cfg }
+    catch { Warn2 "Leaving $File unchanged: $($_.Exception.Message)"; return 'unparseable' }
     return 'merged'
 }
 
@@ -207,9 +224,18 @@ function Invoke-KiroCli {
     param([string[]]$CliArgs)
     $prev = $ErrorActionPreference
     $ErrorActionPreference = 'Continue'
-    try { $out = (& kiro-cli @CliArgs 2>$null | Out-String).Trim() } catch { $out = '' }
-    finally { $ErrorActionPreference = $prev }
-    return @{ Output = $out; ExitCode = $LASTEXITCODE }
+    $errFile = [System.IO.Path]::GetTempFileName()
+    $code = 1; $out = ''; $err = ''
+    try {
+        $out = (& kiro-cli @CliArgs 2>$errFile | Out-String).Trim()
+        $code = $LASTEXITCODE
+        $err = (Get-Content -Raw -LiteralPath $errFile -ErrorAction SilentlyContinue)
+    } catch { $err = $_.Exception.Message }
+    finally {
+        $ErrorActionPreference = $prev
+        Remove-Item -LiteralPath $errFile -Force -ErrorAction SilentlyContinue
+    }
+    return @{ Output = $out; Error = $err; ExitCode = $code }
 }
 
 # ADR 0001: the built-in default agent cannot carry hooks, so a `rogue` agent is
@@ -222,12 +248,13 @@ function Install-KiroRogueAgent {
     # on an editor window. Unverified on Windows hardware (FIRE-2038).
     $prevEditor = $env:EDITOR; $prevVisual = $env:VISUAL
     $env:EDITOR = 'cmd /c exit'; $env:VISUAL = $env:EDITOR
-    try { $null = Invoke-KiroCli @('agent', 'create', '--name', 'rogue') }
+    try { $res = Invoke-KiroCli @('agent', 'create', '--name', 'rogue') }
     finally { $env:EDITOR = $prevEditor; $env:VISUAL = $prevVisual }
     if (-not (Test-Path -LiteralPath $cfg)) {
         # kiro-cli 2.21.0 refuses `agent create` when it is not logged in, so this
         # is the ordinary first-run path on a fresh machine.
         Warn2 "kiro-cli agent create --name rogue failed - plain 'kiro-cli chat' on the 2.x engine will carry no Rogue hooks."
+        if ($res.Error) { Log $res.Error }
         Log 'If kiro-cli is not logged in, run kiro-cli login and re-run this installer; the default agent is left as it is.'
         return $false
     }
@@ -755,6 +782,7 @@ if ($hasKiro) {
         Ok "Plugin installed -> $pluginDir"
         Install-KiroHooks -PluginDir $pluginDir -WorkspaceDir (Get-Location).Path
         Warn2 'Kiro loads hooks at start: restart the IDE and open a new kiro-cli chat. IDE hooks never run in an untrusted workspace.'
+        Log "Verify with: powershell -NoProfile -ExecutionPolicy Bypass -File `"$pluginDir\scripts\status.ps1`""
     } catch {
         Warn2 "Kiro plugin not installed ($($_.Exception.Message)). If the asset isn't published yet, re-run the installer once it is."
     } finally {
diff --git a/install.sh b/install.sh
index 4659430..1f77c33 100755
--- a/install.sh
+++ b/install.sh
@@ -969,6 +969,7 @@ install_kiro() {
   fi
   note "Kiro loads hooks at start: restart the IDE / Crew, and open a new ${C_DIM}kiro-cli chat${C_RESET}."
   note "IDE: hooks never run in an untrusted workspace — trust the workspace first."
+  note "Verify with ${C_DIM}sh \"$KIRO_PLUGIN_DIR/scripts/status.sh\"${C_RESET} (surfaces, hook wiring, default agent, API key)."
 }
 
 # ── CLI flags ─────────────────────────────────────────────────────────────────
diff --git a/plugins/antigravity/scripts/env-file.ps1 b/plugins/antigravity/scripts/env-file.ps1
index 3e6864a..f0155c9 100644
--- a/plugins/antigravity/scripts/env-file.ps1
+++ b/plugins/antigravity/scripts/env-file.ps1
@@ -1,3 +1,44 @@
+# A Windows PowerShell child can inherit PowerShell 7's PSModulePath. Load
+# this engine's ACL cmdlets explicitly instead of resolving an incompatible module.
+if ($PSVersionTable.PSVersion.Major -eq 5) {
+    Import-Module (Join-Path $PSHOME 'Modules\Microsoft.PowerShell.Security\Microsoft.PowerShell.Security.psd1') -ErrorAction Stop
+}
+
+# Reject files writable by identities other than the current user or Windows
+# administrators/system. System-wide configuration cannot be user-owned.
+function Test-RogueEnvFile {
+    param([string]$Path, [switch]$System)
+    try {
+        if (-not (Test-Path -LiteralPath $Path -PathType Leaf)) { return $false }
+        if ($PSVersionTable.PSVersion.Major -ge 6 -and -not $IsWindows) {
+            $info = & stat -Lc '%u %a' $Path 2>$null
+            if ($LASTEXITCODE -ne 0) { $info = & stat -Lf '%u %Lp' $Path 2>$null }
+            if ($LASTEXITCODE -ne 0 -or $info -notmatch '^(\d+) ([0-7]+)$') { return $false }
+            $ownerId = $Matches[1]; $mode = [Convert]::ToInt32($Matches[2], 8)
+            return (($ownerId -eq '0' -or (-not $System -and $ownerId -eq (& id -u))) -and ($mode -band 18) -eq 0)
+        }
+        $acl = Get-Acl -LiteralPath $Path -ErrorAction Stop
+        $user = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value
+        $admins = @('S-1-5-18', 'S-1-5-32-544')
+        $trusted = @($admins) + $user
+        $owner = $acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value
+        if ($owner -notin $trusted -or ($System -and $owner -notin $admins)) { return $false }
+        $write = [System.Security.AccessControl.FileSystemRights]'Write, Delete, ChangePermissions, TakeOwnership, DeleteSubdirectoriesAndFiles'
+        foreach ($rule in $acl.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier])) {
+            if ($rule.AccessControlType -eq 'Allow' -and ($rule.FileSystemRights -band $write) -and
+                $rule.IdentityReference.Value -notin $trusted) { return $false }
+        }
+        return $true
+    } catch { return $false }
+}
+
+function Read-RogueEnvFile {
+    param([string]$Path)
+    if (Test-RogueEnvFile $Path -System:($Path -eq 'C:\ProgramData\rogue\env')) {
+        Get-Content -LiteralPath $Path -Encoding UTF8 -ErrorAction SilentlyContinue
+    }
+}
+
 function Format-RogueEnvValue {
     param([string]$Value)
     return "'" + $Value.Replace("'", "'\''") + "'"
@@ -7,16 +48,18 @@ function Protect-RogueEnvFile {
     param([string]$Path)
     $script:RogueEnvProtectError = ''
     try {
-        $acl = Get-Acl $Path
+        $acl = Get-Acl -LiteralPath $Path -ErrorAction Stop
         $acl.SetAccessRuleProtection($true, $false)
-        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule(
-            [System.Security.Principal.WindowsIdentity]::GetCurrent().Name,
-            'FullControl', 'Allow')
+        $rule = [System.Security.AccessControl.FileSystemAccessRule]::new(
+            [System.Security.Principal.WindowsIdentity]::GetCurrent().User,
+            [System.Security.AccessControl.FileSystemRights]::FullControl,
+            [System.Security.AccessControl.AccessControlType]::Allow)
         $acl.SetAccessRule($rule)
-        Set-Acl $Path $acl
+        Set-Acl -LiteralPath $Path -AclObject $acl -ErrorAction Stop
         return $true
     } catch {
         $script:RogueEnvProtectError = $_.Exception.Message
+        Write-Warning "Could not restrict credential file permissions: $script:RogueEnvProtectError"
         return $false
     }
 }
diff --git a/plugins/antigravity/scripts/env-file.sh b/plugins/antigravity/scripts/env-file.sh
index 5319fd7..eb1b839 100644
--- a/plugins/antigravity/scripts/env-file.sh
+++ b/plugins/antigravity/scripts/env-file.sh
@@ -1,5 +1,24 @@
 #!/usr/bin/env sh
 
+# Only the current user or root may supply executable configuration. System
+# configuration must belong to root; neither group nor other may write it.
+rogue_env_is_trusted() (
+  [ -f "$1" ] && [ -r "$1" ] || exit 1
+  info=$(stat -Lc '%u %a' "$1" 2>/dev/null) || info=$(stat -Lf '%u %Lp' "$1" 2>/dev/null) || exit 1
+  owner=${info%% *}; mode=${info#* }
+  case "$owner:$mode" in *[!0-9:]*|:*) exit 1 ;; esac
+  case "$1:${2:-0}" in /etc/rogue/env:*|*:1) [ "$owner" = 0 ] || exit 1 ;; esac
+  [ "$owner" = 0 ] || [ "$owner" = "$(id -u)" ] || exit 1
+  [ "$((0$mode & 022))" = 0 ]
+)
+
+rogue_source_env() {
+  if rogue_env_is_trusted "$1" "${2:-0}"; then
+    . "$1"
+  fi
+  return 0
+}
+
 rogue_env_quote() {
   printf "'%s'" "$(printf '%s' "$1" | sed "s/'/'\\\\''/g")"
 }
diff --git a/plugins/antigravity/scripts/ship-logs.ps1 b/plugins/antigravity/scripts/ship-logs.ps1
index 6bbeec7..b375667 100644
--- a/plugins/antigravity/scripts/ship-logs.ps1
+++ b/plugins/antigravity/scripts/ship-logs.ps1
@@ -55,7 +55,7 @@ $ProgressPreference = 'SilentlyContinue'
 
 # ── constants ──────────────────────────────────────────────────────────────
 $SHIP_ENDPOINT_PATH = '/api/v1/hooks/logs'
-$KNOWN_LOG_SLUGS = @('claude', 'codex', 'cursor', 'gemini', 'copilot', 'antigravity')
+$KNOWN_LOG_SLUGS = @('claude', 'codex', 'cursor', 'gemini', 'copilot', 'antigravity', 'kiro')
 # Bytes scanned when fingerprinting a log's first line. NOT 200: a real log line is
 # timestamp + provider + event + up to 400 chars of `raw=`, i.e. commonly 500-700
 # bytes, so a 200-byte window would find no newline in a typical log's first line
@@ -329,6 +329,9 @@ $SHIP_ENV_VARS = @(
     'ROGUE_SHIP_ALL')
 
 function Import-ShipEnv {
+    $envLibrary = Join-Path $PluginRoot 'scripts/env-file.ps1'
+    if ($PSCommandPath) { $envLibrary = Join-Path (Split-Path -Parent $PSCommandPath) 'env-file.ps1' }
+    . ([scriptblock]::Create((Get-Content -Raw -LiteralPath $envLibrary)))
     $resolved = @{}
     $envFiles = @(
         (Join-Path $PluginRoot 'env'),
@@ -336,7 +339,7 @@ function Import-ShipEnv {
         (Join-Path (Get-UserHome) '.rogue-env'))
     foreach ($envFile in $envFiles) {
         if (-not $envFile -or -not (Test-Path -LiteralPath $envFile)) { continue }
-        foreach ($line in (Get-Content -LiteralPath $envFile)) {
+        foreach ($line in (Read-RogueEnvFile $envFile)) {
             if ($line -match '^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.*)$') {
                 $resolved[$Matches[1]] = ConvertFrom-ShellQuoted ($Matches[2].Trim())
             }
diff --git a/plugins/antigravity/scripts/ship-logs.sh b/plugins/antigravity/scripts/ship-logs.sh
index 1407878..ca5fbb1 100644
--- a/plugins/antigravity/scripts/ship-logs.sh
+++ b/plugins/antigravity/scripts/ship-logs.sh
@@ -54,7 +54,7 @@ set -u
 
 # ── constants ──────────────────────────────────────────────────────────────
 SHIP_ENDPOINT_PATH="/api/v1/hooks/logs"
-KNOWN_LOG_SLUGS="claude codex cursor gemini copilot antigravity"
+KNOWN_LOG_SLUGS="claude codex cursor gemini copilot antigravity kiro"
 # Bytes scanned when fingerprinting a log's first line. NOT the 200 an earlier
 # draft of the design doc specified: a real log line is timestamp + provider +
 # event + up to 400 chars of `raw=`, i.e. commonly 500-700 bytes, so a 200-byte
@@ -127,9 +127,10 @@ log() {
   # visible.
   debug "$*"
   [ -n "$SELF_LOG_FILE" ] || return 0
-  mkdir -p "$(dirname "$SELF_LOG_FILE")" 2>/dev/null
-  printf '%s provider=%s event=ShipLogs %s\n' \
-    "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$SHIPPER_SLUG" "$*" >> "$SELF_LOG_FILE" 2>/dev/null
+  ( umask 077
+    mkdir -p "$(dirname "$SELF_LOG_FILE")" 2>/dev/null
+    printf '%s provider=%s event=ShipLogs %s\n' \
+    "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$SHIPPER_SLUG" "$*" >> "$SELF_LOG_FILE" 2>/dev/null )
   return 0
 }
 
@@ -299,11 +300,13 @@ ROGUE_SHIP_MAX_BYTES ROGUE_SHIP_MAX_RUN_BYTES ROGUE_SHIP_MAX_LINE_BYTES
 ROGUE_SHIP_ALL'
 
 load_env() {
+  [ -r "$(dirname "$0")/env-file.sh" ] || return 0
+  . "$(dirname "$0")/env-file.sh"
   for _env_var_name in $SHIP_ENV_VARS; do
     eval "_process_env_$_env_var_name=\${$_env_var_name:-}"
   done
   for _env_file in "$PLUGIN_ROOT/env" /etc/rogue/env "$HOME/.rogue-env"; do
-    [ -n "$_env_file" ] && [ -r "$_env_file" ] && . "$_env_file" 2>/dev/null
+    rogue_source_env "$_env_file" 2>/dev/null
   done
   for _env_var_name in $SHIP_ENV_VARS; do
     eval "[ -n \"\${_process_env_$_env_var_name:-}\" ] && $_env_var_name=\$_process_env_$_env_var_name"
diff --git a/plugins/codex/scripts/env-file.ps1 b/plugins/codex/scripts/env-file.ps1
index 3e6864a..f0155c9 100644
--- a/plugins/codex/scripts/env-file.ps1
+++ b/plugins/codex/scripts/env-file.ps1
@@ -1,3 +1,44 @@
+# A Windows PowerShell child can inherit PowerShell 7's PSModulePath. Load
+# this engine's ACL cmdlets explicitly instead of resolving an incompatible module.
+if ($PSVersionTable.PSVersion.Major -eq 5) {
+    Import-Module (Join-Path $PSHOME 'Modules\Microsoft.PowerShell.Security\Microsoft.PowerShell.Security.psd1') -ErrorAction Stop
+}
+
+# Reject files writable by identities other than the current user or Windows
+# administrators/system. System-wide configuration cannot be user-owned.
+function Test-RogueEnvFile {
+    param([string]$Path, [switch]$System)
+    try {
+        if (-not (Test-Path -LiteralPath $Path -PathType Leaf)) { return $false }
+        if ($PSVersionTable.PSVersion.Major -ge 6 -and -not $IsWindows) {
+            $info = & stat -Lc '%u %a' $Path 2>$null
+            if ($LASTEXITCODE -ne 0) { $info = & stat -Lf '%u %Lp' $Path 2>$null }
+            if ($LASTEXITCODE -ne 0 -or $info -notmatch '^(\d+) ([0-7]+)$') { return $false }
+            $ownerId = $Matches[1]; $mode = [Convert]::ToInt32($Matches[2], 8)
+            return (($ownerId -eq '0' -or (-not $System -and $ownerId -eq (& id -u))) -and ($mode -band 18) -eq 0)
+        }
+        $acl = Get-Acl -LiteralPath $Path -ErrorAction Stop
+        $user = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value
+        $admins = @('S-1-5-18', 'S-1-5-32-544')
+        $trusted = @($admins) + $user
+        $owner = $acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value
+        if ($owner -notin $trusted -or ($System -and $owner -notin $admins)) { return $false }
+        $write = [System.Security.AccessControl.FileSystemRights]'Write, Delete, ChangePermissions, TakeOwnership, DeleteSubdirectoriesAndFiles'
+        foreach ($rule in $acl.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier])) {
+            if ($rule.AccessControlType -eq 'Allow' -and ($rule.FileSystemRights -band $write) -and
+                $rule.IdentityReference.Value -notin $trusted) { return $false }
+        }
+        return $true
+    } catch { return $false }
+}
+
+function Read-RogueEnvFile {
+    param([string]$Path)
+    if (Test-RogueEnvFile $Path -System:($Path -eq 'C:\ProgramData\rogue\env')) {
+        Get-Content -LiteralPath $Path -Encoding UTF8 -ErrorAction SilentlyContinue
+    }
+}
+
 function Format-RogueEnvValue {
     param([string]$Value)
     return "'" + $Value.Replace("'", "'\''") + "'"
@@ -7,16 +48,18 @@ function Protect-RogueEnvFile {
     param([string]$Path)
     $script:RogueEnvProtectError = ''
     try {
-        $acl = Get-Acl $Path
+        $acl = Get-Acl -LiteralPath $Path -ErrorAction Stop
         $acl.SetAccessRuleProtection($true, $false)
-        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule(
-            [System.Security.Principal.WindowsIdentity]::GetCurrent().Name,
-            'FullControl', 'Allow')
+        $rule = [System.Security.AccessControl.FileSystemAccessRule]::new(
+            [System.Security.Principal.WindowsIdentity]::GetCurrent().User,
+            [System.Security.AccessControl.FileSystemRights]::FullControl,
+            [System.Security.AccessControl.AccessControlType]::Allow)
         $acl.SetAccessRule($rule)
-        Set-Acl $Path $acl
+        Set-Acl -LiteralPath $Path -AclObject $acl -ErrorAction Stop
         return $true
     } catch {
         $script:RogueEnvProtectError = $_.Exception.Message
+        Write-Warning "Could not restrict credential file permissions: $script:RogueEnvProtectError"
         return $false
     }
 }
diff --git a/plugins/codex/scripts/env-file.sh b/plugins/codex/scripts/env-file.sh
index 5319fd7..eb1b839 100644
--- a/plugins/codex/scripts/env-file.sh
+++ b/plugins/codex/scripts/env-file.sh
@@ -1,5 +1,24 @@
 #!/usr/bin/env sh
 
+# Only the current user or root may supply executable configuration. System
+# configuration must belong to root; neither group nor other may write it.
+rogue_env_is_trusted() (
+  [ -f "$1" ] && [ -r "$1" ] || exit 1
+  info=$(stat -Lc '%u %a' "$1" 2>/dev/null) || info=$(stat -Lf '%u %Lp' "$1" 2>/dev/null) || exit 1
+  owner=${info%% *}; mode=${info#* }
+  case "$owner:$mode" in *[!0-9:]*|:*) exit 1 ;; esac
+  case "$1:${2:-0}" in /etc/rogue/env:*|*:1) [ "$owner" = 0 ] || exit 1 ;; esac
+  [ "$owner" = 0 ] || [ "$owner" = "$(id -u)" ] || exit 1
+  [ "$((0$mode & 022))" = 0 ]
+)
+
+rogue_source_env() {
+  if rogue_env_is_trusted "$1" "${2:-0}"; then
+    . "$1"
+  fi
+  return 0
+}
+
 rogue_env_quote() {
   printf "'%s'" "$(printf '%s' "$1" | sed "s/'/'\\\\''/g")"
 }
diff --git a/plugins/codex/scripts/ship-logs.ps1 b/plugins/codex/scripts/ship-logs.ps1
index 6bbeec7..b375667 100644
--- a/plugins/codex/scripts/ship-logs.ps1
+++ b/plugins/codex/scripts/ship-logs.ps1
@@ -55,7 +55,7 @@ $ProgressPreference = 'SilentlyContinue'
 
 # ── constants ──────────────────────────────────────────────────────────────
 $SHIP_ENDPOINT_PATH = '/api/v1/hooks/logs'
-$KNOWN_LOG_SLUGS = @('claude', 'codex', 'cursor', 'gemini', 'copilot', 'antigravity')
+$KNOWN_LOG_SLUGS = @('claude', 'codex', 'cursor', 'gemini', 'copilot', 'antigravity', 'kiro')
 # Bytes scanned when fingerprinting a log's first line. NOT 200: a real log line is
 # timestamp + provider + event + up to 400 chars of `raw=`, i.e. commonly 500-700
 # bytes, so a 200-byte window would find no newline in a typical log's first line
@@ -329,6 +329,9 @@ $SHIP_ENV_VARS = @(
     'ROGUE_SHIP_ALL')
 
 function Import-ShipEnv {
+    $envLibrary = Join-Path $PluginRoot 'scripts/env-file.ps1'
+    if ($PSCommandPath) { $envLibrary = Join-Path (Split-Path -Parent $PSCommandPath) 'env-file.ps1' }
+    . ([scriptblock]::Create((Get-Content -Raw -LiteralPath $envLibrary)))
     $resolved = @{}
     $envFiles = @(
         (Join-Path $PluginRoot 'env'),
@@ -336,7 +339,7 @@ function Import-ShipEnv {
         (Join-Path (Get-UserHome) '.rogue-env'))
     foreach ($envFile in $envFiles) {
         if (-not $envFile -or -not (Test-Path -LiteralPath $envFile)) { continue }
-        foreach ($line in (Get-Content -LiteralPath $envFile)) {
+        foreach ($line in (Read-RogueEnvFile $envFile)) {
             if ($line -match '^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.*)$') {
                 $resolved[$Matches[1]] = ConvertFrom-ShellQuoted ($Matches[2].Trim())
             }
diff --git a/plugins/codex/scripts/ship-logs.sh b/plugins/codex/scripts/ship-logs.sh
index 1407878..ca5fbb1 100644
--- a/plugins/codex/scripts/ship-logs.sh
+++ b/plugins/codex/scripts/ship-logs.sh
@@ -54,7 +54,7 @@ set -u
 
 # ── constants ──────────────────────────────────────────────────────────────
 SHIP_ENDPOINT_PATH="/api/v1/hooks/logs"
-KNOWN_LOG_SLUGS="claude codex cursor gemini copilot antigravity"
+KNOWN_LOG_SLUGS="claude codex cursor gemini copilot antigravity kiro"
 # Bytes scanned when fingerprinting a log's first line. NOT the 200 an earlier
 # draft of the design doc specified: a real log line is timestamp + provider +
 # event + up to 400 chars of `raw=`, i.e. commonly 500-700 bytes, so a 200-byte
@@ -127,9 +127,10 @@ log() {
   # visible.
   debug "$*"
   [ -n "$SELF_LOG_FILE" ] || return 0
-  mkdir -p "$(dirname "$SELF_LOG_FILE")" 2>/dev/null
-  printf '%s provider=%s event=ShipLogs %s\n' \
-    "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$SHIPPER_SLUG" "$*" >> "$SELF_LOG_FILE" 2>/dev/null
+  ( umask 077
+    mkdir -p "$(dirname "$SELF_LOG_FILE")" 2>/dev/null
+    printf '%s provider=%s event=ShipLogs %s\n' \
+    "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$SHIPPER_SLUG" "$*" >> "$SELF_LOG_FILE" 2>/dev/null )
   return 0
 }
 
@@ -299,11 +300,13 @@ ROGUE_SHIP_MAX_BYTES ROGUE_SHIP_MAX_RUN_BYTES ROGUE_SHIP_MAX_LINE_BYTES
 ROGUE_SHIP_ALL'
 
 load_env() {
+  [ -r "$(dirname "$0")/env-file.sh" ] || return 0
+  . "$(dirname "$0")/env-file.sh"
   for _env_var_name in $SHIP_ENV_VARS; do
     eval "_process_env_$_env_var_name=\${$_env_var_name:-}"
   done
   for _env_file in "$PLUGIN_ROOT/env" /etc/rogue/env "$HOME/.rogue-env"; do
-    [ -n "$_env_file" ] && [ -r "$_env_file" ] && . "$_env_file" 2>/dev/null
+    rogue_source_env "$_env_file" 2>/dev/null
   done
   for _env_var_name in $SHIP_ENV_VARS; do
     eval "[ -n \"\${_process_env_$_env_var_name:-}\" ] && $_env_var_name=\$_process_env_$_env_var_name"
diff --git a/plugins/copilot/scripts/env-file.ps1 b/plugins/copilot/scripts/env-file.ps1
index 3e6864a..f0155c9 100644
--- a/plugins/copilot/scripts/env-file.ps1
+++ b/plugins/copilot/scripts/env-file.ps1
@@ -1,3 +1,44 @@
+# A Windows PowerShell child can inherit PowerShell 7's PSModulePath. Load
+# this engine's ACL cmdlets explicitly instead of resolving an incompatible module.
+if ($PSVersionTable.PSVersion.Major -eq 5) {
+    Import-Module (Join-Path $PSHOME 'Modules\Microsoft.PowerShell.Security\Microsoft.PowerShell.Security.psd1') -ErrorAction Stop
+}
+
+# Reject files writable by identities other than the current user or Windows
+# administrators/system. System-wide configuration cannot be user-owned.
+function Test-RogueEnvFile {
+    param([string]$Path, [switch]$System)
+    try {
+        if (-not (Test-Path -LiteralPath $Path -PathType Leaf)) { return $false }
+        if ($PSVersionTable.PSVersion.Major -ge 6 -and -not $IsWindows) {
+            $info = & stat -Lc '%u %a' $Path 2>$null
+            if ($LASTEXITCODE -ne 0) { $info = & stat -Lf '%u %Lp' $Path 2>$null }
+            if ($LASTEXITCODE -ne 0 -or $info -notmatch '^(\d+) ([0-7]+)$') { return $false }
+            $ownerId = $Matches[1]; $mode = [Convert]::ToInt32($Matches[2], 8)
+            return (($ownerId -eq '0' -or (-not $System -and $ownerId -eq (& id -u))) -and ($mode -band 18) -eq 0)
+        }
+        $acl = Get-Acl -LiteralPath $Path -ErrorAction Stop
+        $user = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value
+        $admins = @('S-1-5-18', 'S-1-5-32-544')
+        $trusted = @($admins) + $user
+        $owner = $acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value
+        if ($owner -notin $trusted -or ($System -and $owner -notin $admins)) { return $false }
+        $write = [System.Security.AccessControl.FileSystemRights]'Write, Delete, ChangePermissions, TakeOwnership, DeleteSubdirectoriesAndFiles'
+        foreach ($rule in $acl.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier])) {
+            if ($rule.AccessControlType -eq 'Allow' -and ($rule.FileSystemRights -band $write) -and
+                $rule.IdentityReference.Value -notin $trusted) { return $false }
+        }
+        return $true
+    } catch { return $false }
+}
+
+function Read-RogueEnvFile {
+    param([string]$Path)
+    if (Test-RogueEnvFile $Path -System:($Path -eq 'C:\ProgramData\rogue\env')) {
+        Get-Content -LiteralPath $Path -Encoding UTF8 -ErrorAction SilentlyContinue
+    }
+}
+
 function Format-RogueEnvValue {
     param([string]$Value)
     return "'" + $Value.Replace("'", "'\''") + "'"
@@ -7,16 +48,18 @@ function Protect-RogueEnvFile {
     param([string]$Path)
     $script:RogueEnvProtectError = ''
     try {
-        $acl = Get-Acl $Path
+        $acl = Get-Acl -LiteralPath $Path -ErrorAction Stop
         $acl.SetAccessRuleProtection($true, $false)
-        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule(
-            [System.Security.Principal.WindowsIdentity]::GetCurrent().Name,
-            'FullControl', 'Allow')
+        $rule = [System.Security.AccessControl.FileSystemAccessRule]::new(
+            [System.Security.Principal.WindowsIdentity]::GetCurrent().User,
+            [System.Security.AccessControl.FileSystemRights]::FullControl,
+            [System.Security.AccessControl.AccessControlType]::Allow)
         $acl.SetAccessRule($rule)
-        Set-Acl $Path $acl
+        Set-Acl -LiteralPath $Path -AclObject $acl -ErrorAction Stop
         return $true
     } catch {
         $script:RogueEnvProtectError = $_.Exception.Message
+        Write-Warning "Could not restrict credential file permissions: $script:RogueEnvProtectError"
         return $false
     }
 }
diff --git a/plugins/copilot/scripts/env-file.sh b/plugins/copilot/scripts/env-file.sh
index 5319fd7..eb1b839 100644
--- a/plugins/copilot/scripts/env-file.sh
+++ b/plugins/copilot/scripts/env-file.sh
@@ -1,5 +1,24 @@
 #!/usr/bin/env sh
 
+# Only the current user or root may supply executable configuration. System
+# configuration must belong to root; neither group nor other may write it.
+rogue_env_is_trusted() (
+  [ -f "$1" ] && [ -r "$1" ] || exit 1
+  info=$(stat -Lc '%u %a' "$1" 2>/dev/null) || info=$(stat -Lf '%u %Lp' "$1" 2>/dev/null) || exit 1
+  owner=${info%% *}; mode=${info#* }
+  case "$owner:$mode" in *[!0-9:]*|:*) exit 1 ;; esac
+  case "$1:${2:-0}" in /etc/rogue/env:*|*:1) [ "$owner" = 0 ] || exit 1 ;; esac
+  [ "$owner" = 0 ] || [ "$owner" = "$(id -u)" ] || exit 1
+  [ "$((0$mode & 022))" = 0 ]
+)
+
+rogue_source_env() {
+  if rogue_env_is_trusted "$1" "${2:-0}"; then
+    . "$1"
+  fi
+  return 0
+}
+
 rogue_env_quote() {
   printf "'%s'" "$(printf '%s' "$1" | sed "s/'/'\\\\''/g")"
 }
diff --git a/plugins/copilot/scripts/ship-logs.ps1 b/plugins/copilot/scripts/ship-logs.ps1
index 6bbeec7..b375667 100644
--- a/plugins/copilot/scripts/ship-logs.ps1
+++ b/plugins/copilot/scripts/ship-logs.ps1
@@ -55,7 +55,7 @@ $ProgressPreference = 'SilentlyContinue'
 
 # ── constants ──────────────────────────────────────────────────────────────
 $SHIP_ENDPOINT_PATH = '/api/v1/hooks/logs'
-$KNOWN_LOG_SLUGS = @('claude', 'codex', 'cursor', 'gemini', 'copilot', 'antigravity')
+$KNOWN_LOG_SLUGS = @('claude', 'codex', 'cursor', 'gemini', 'copilot', 'antigravity', 'kiro')
 # Bytes scanned when fingerprinting a log's first line. NOT 200: a real log line is
 # timestamp + provider + event + up to 400 chars of `raw=`, i.e. commonly 500-700
 # bytes, so a 200-byte window would find no newline in a typical log's first line
@@ -329,6 +329,9 @@ $SHIP_ENV_VARS = @(
     'ROGUE_SHIP_ALL')
 
 function Import-ShipEnv {
+    $envLibrary = Join-Path $PluginRoot 'scripts/env-file.ps1'
+    if ($PSCommandPath) { $envLibrary = Join-Path (Split-Path -Parent $PSCommandPath) 'env-file.ps1' }
+    . ([scriptblock]::Create((Get-Content -Raw -LiteralPath $envLibrary)))
     $resolved = @{}
     $envFiles = @(
         (Join-Path $PluginRoot 'env'),
@@ -336,7 +339,7 @@ function Import-ShipEnv {
         (Join-Path (Get-UserHome) '.rogue-env'))
     foreach ($envFile in $envFiles) {
         if (-not $envFile -or -not (Test-Path -LiteralPath $envFile)) { continue }
-        foreach ($line in (Get-Content -LiteralPath $envFile)) {
+        foreach ($line in (Read-RogueEnvFile $envFile)) {
             if ($line -match '^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.*)$') {
                 $resolved[$Matches[1]] = ConvertFrom-ShellQuoted ($Matches[2].Trim())
             }
diff --git a/plugins/copilot/scripts/ship-logs.sh b/plugins/copilot/scripts/ship-logs.sh
index 1407878..ca5fbb1 100644
--- a/plugins/copilot/scripts/ship-logs.sh
+++ b/plugins/copilot/scripts/ship-logs.sh
@@ -54,7 +54,7 @@ set -u
 
 # ── constants ──────────────────────────────────────────────────────────────
 SHIP_ENDPOINT_PATH="/api/v1/hooks/logs"
-KNOWN_LOG_SLUGS="claude codex cursor gemini copilot antigravity"
+KNOWN_LOG_SLUGS="claude codex cursor gemini copilot antigravity kiro"
 # Bytes scanned when fingerprinting a log's first line. NOT the 200 an earlier
 # draft of the design doc specified: a real log line is timestamp + provider +
 # event + up to 400 chars of `raw=`, i.e. commonly 500-700 bytes, so a 200-byte
@@ -127,9 +127,10 @@ log() {
   # visible.
   debug "$*"
   [ -n "$SELF_LOG_FILE" ] || return 0
-  mkdir -p "$(dirname "$SELF_LOG_FILE")" 2>/dev/null
-  printf '%s provider=%s event=ShipLogs %s\n' \
-    "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$SHIPPER_SLUG" "$*" >> "$SELF_LOG_FILE" 2>/dev/null
+  ( umask 077
+    mkdir -p "$(dirname "$SELF_LOG_FILE")" 2>/dev/null
+    printf '%s provider=%s event=ShipLogs %s\n' \
+    "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$SHIPPER_SLUG" "$*" >> "$SELF_LOG_FILE" 2>/dev/null )
   return 0
 }
 
@@ -299,11 +300,13 @@ ROGUE_SHIP_MAX_BYTES ROGUE_SHIP_MAX_RUN_BYTES ROGUE_SHIP_MAX_LINE_BYTES
 ROGUE_SHIP_ALL'
 
 load_env() {
+  [ -r "$(dirname "$0")/env-file.sh" ] || return 0
+  . "$(dirname "$0")/env-file.sh"
   for _env_var_name in $SHIP_ENV_VARS; do
     eval "_process_env_$_env_var_name=\${$_env_var_name:-}"
   done
   for _env_file in "$PLUGIN_ROOT/env" /etc/rogue/env "$HOME/.rogue-env"; do
-    [ -n "$_env_file" ] && [ -r "$_env_file" ] && . "$_env_file" 2>/dev/null
+    rogue_source_env "$_env_file" 2>/dev/null
   done
   for _env_var_name in $SHIP_ENV_VARS; do
     eval "[ -n \"\${_process_env_$_env_var_name:-}\" ] && $_env_var_name=\$_process_env_$_env_var_name"
diff --git a/plugins/cursor/scripts/env-file.ps1 b/plugins/cursor/scripts/env-file.ps1
index 3e6864a..f0155c9 100644
--- a/plugins/cursor/scripts/env-file.ps1
+++ b/plugins/cursor/scripts/env-file.ps1
@@ -1,3 +1,44 @@
+# A Windows PowerShell child can inherit PowerShell 7's PSModulePath. Load
+# this engine's ACL cmdlets explicitly instead of resolving an incompatible module.
+if ($PSVersionTable.PSVersion.Major -eq 5) {
+    Import-Module (Join-Path $PSHOME 'Modules\Microsoft.PowerShell.Security\Microsoft.PowerShell.Security.psd1') -ErrorAction Stop
+}
+
+# Reject files writable by identities other than the current user or Windows
+# administrators/system. System-wide configuration cannot be user-owned.
+function Test-RogueEnvFile {
+    param([string]$Path, [switch]$System)
+    try {
+        if (-not (Test-Path -LiteralPath $Path -PathType Leaf)) { return $false }
+        if ($PSVersionTable.PSVersion.Major -ge 6 -and -not $IsWindows) {
+            $info = & stat -Lc '%u %a' $Path 2>$null
+            if ($LASTEXITCODE -ne 0) { $info = & stat -Lf '%u %Lp' $Path 2>$null }
+            if ($LASTEXITCODE -ne 0 -or $info -notmatch '^(\d+) ([0-7]+)$') { return $false }
+            $ownerId = $Matches[1]; $mode = [Convert]::ToInt32($Matches[2], 8)
+            return (($ownerId -eq '0' -or (-not $System -and $ownerId -eq (& id -u))) -and ($mode -band 18) -eq 0)
+        }
+        $acl = Get-Acl -LiteralPath $Path -ErrorAction Stop
+        $user = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value
+        $admins = @('S-1-5-18', 'S-1-5-32-544')
+        $trusted = @($admins) + $user
+        $owner = $acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value
+        if ($owner -notin $trusted -or ($System -and $owner -notin $admins)) { return $false }
+        $write = [System.Security.AccessControl.FileSystemRights]'Write, Delete, ChangePermissions, TakeOwnership, DeleteSubdirectoriesAndFiles'
+        foreach ($rule in $acl.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier])) {
+            if ($rule.AccessControlType -eq 'Allow' -and ($rule.FileSystemRights -band $write) -and
+                $rule.IdentityReference.Value -notin $trusted) { return $false }
+        }
+        return $true
+    } catch { return $false }
+}
+
+function Read-RogueEnvFile {
+    param([string]$Path)
+    if (Test-RogueEnvFile $Path -System:($Path -eq 'C:\ProgramData\rogue\env')) {
+        Get-Content -LiteralPath $Path -Encoding UTF8 -ErrorAction SilentlyContinue
+    }
+}
+
 function Format-RogueEnvValue {
     param([string]$Value)
     return "'" + $Value.Replace("'", "'\''") + "'"
@@ -7,16 +48,18 @@ function Protect-RogueEnvFile {
     param([string]$Path)
     $script:RogueEnvProtectError = ''
     try {
-        $acl = Get-Acl $Path
+        $acl = Get-Acl -LiteralPath $Path -ErrorAction Stop
         $acl.SetAccessRuleProtection($true, $false)
-        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule(
-            [System.Security.Principal.WindowsIdentity]::GetCurrent().Name,
-            'FullControl', 'Allow')
+        $rule = [System.Security.AccessControl.FileSystemAccessRule]::new(
+            [System.Security.Principal.WindowsIdentity]::GetCurrent().User,
+            [System.Security.AccessControl.FileSystemRights]::FullControl,
+            [System.Security.AccessControl.AccessControlType]::Allow)
         $acl.SetAccessRule($rule)
-        Set-Acl $Path $acl
+        Set-Acl -LiteralPath $Path -AclObject $acl -ErrorAction Stop
         return $true
     } catch {
         $script:RogueEnvProtectError = $_.Exception.Message
+        Write-Warning "Could not restrict credential file permissions: $script:RogueEnvProtectError"
         return $false
     }
 }
diff --git a/plugins/cursor/scripts/env-file.sh b/plugins/cursor/scripts/env-file.sh
index 5319fd7..eb1b839 100644
--- a/plugins/cursor/scripts/env-file.sh
+++ b/plugins/cursor/scripts/env-file.sh
@@ -1,5 +1,24 @@
 #!/usr/bin/env sh
 
+# Only the current user or root may supply executable configuration. System
+# configuration must belong to root; neither group nor other may write it.
+rogue_env_is_trusted() (
+  [ -f "$1" ] && [ -r "$1" ] || exit 1
+  info=$(stat -Lc '%u %a' "$1" 2>/dev/null) || info=$(stat -Lf '%u %Lp' "$1" 2>/dev/null) || exit 1
+  owner=${info%% *}; mode=${info#* }
+  case "$owner:$mode" in *[!0-9:]*|:*) exit 1 ;; esac
+  case "$1:${2:-0}" in /etc/rogue/env:*|*:1) [ "$owner" = 0 ] || exit 1 ;; esac
+  [ "$owner" = 0 ] || [ "$owner" = "$(id -u)" ] || exit 1
+  [ "$((0$mode & 022))" = 0 ]
+)
+
+rogue_source_env() {
+  if rogue_env_is_trusted "$1" "${2:-0}"; then
+    . "$1"
+  fi
+  return 0
+}
+
 rogue_env_quote() {
   printf "'%s'" "$(printf '%s' "$1" | sed "s/'/'\\\\''/g")"
 }
diff --git a/plugins/cursor/scripts/ship-logs.ps1 b/plugins/cursor/scripts/ship-logs.ps1
index 6bbeec7..b375667 100644
--- a/plugins/cursor/scripts/ship-logs.ps1
+++ b/plugins/cursor/scripts/ship-logs.ps1
@@ -55,7 +55,7 @@ $ProgressPreference = 'SilentlyContinue'
 
 # ── constants ──────────────────────────────────────────────────────────────
 $SHIP_ENDPOINT_PATH = '/api/v1/hooks/logs'
-$KNOWN_LOG_SLUGS = @('claude', 'codex', 'cursor', 'gemini', 'copilot', 'antigravity')
+$KNOWN_LOG_SLUGS = @('claude', 'codex', 'cursor', 'gemini', 'copilot', 'antigravity', 'kiro')
 # Bytes scanned when fingerprinting a log's first line. NOT 200: a real log line is
 # timestamp + provider + event + up to 400 chars of `raw=`, i.e. commonly 500-700
 # bytes, so a 200-byte window would find no newline in a typical log's first line
@@ -329,6 +329,9 @@ $SHIP_ENV_VARS = @(
     'ROGUE_SHIP_ALL')
 
 function Import-ShipEnv {
+    $envLibrary = Join-Path $PluginRoot 'scripts/env-file.ps1'
+    if ($PSCommandPath) { $envLibrary = Join-Path (Split-Path -Parent $PSCommandPath) 'env-file.ps1' }
+    . ([scriptblock]::Create((Get-Content -Raw -LiteralPath $envLibrary)))
     $resolved = @{}
     $envFiles = @(
         (Join-Path $PluginRoot 'env'),
@@ -336,7 +339,7 @@ function Import-ShipEnv {
         (Join-Path (Get-UserHome) '.rogue-env'))
     foreach ($envFile in $envFiles) {
         if (-not $envFile -or -not (Test-Path -LiteralPath $envFile)) { continue }
-        foreach ($line in (Get-Content -LiteralPath $envFile)) {
+        foreach ($line in (Read-RogueEnvFile $envFile)) {
             if ($line -match '^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.*)$') {
                 $resolved[$Matches[1]] = ConvertFrom-ShellQuoted ($Matches[2].Trim())
             }
diff --git a/plugins/cursor/scripts/ship-logs.sh b/plugins/cursor/scripts/ship-logs.sh
index 1407878..ca5fbb1 100644
--- a/plugins/cursor/scripts/ship-logs.sh
+++ b/plugins/cursor/scripts/ship-logs.sh
@@ -54,7 +54,7 @@ set -u
 
 # ── constants ──────────────────────────────────────────────────────────────
 SHIP_ENDPOINT_PATH="/api/v1/hooks/logs"
-KNOWN_LOG_SLUGS="claude codex cursor gemini copilot antigravity"
+KNOWN_LOG_SLUGS="claude codex cursor gemini copilot antigravity kiro"
 # Bytes scanned when fingerprinting a log's first line. NOT the 200 an earlier
 # draft of the design doc specified: a real log line is timestamp + provider +
 # event + up to 400 chars of `raw=`, i.e. commonly 500-700 bytes, so a 200-byte
@@ -127,9 +127,10 @@ log() {
   # visible.
   debug "$*"
   [ -n "$SELF_LOG_FILE" ] || return 0
-  mkdir -p "$(dirname "$SELF_LOG_FILE")" 2>/dev/null
-  printf '%s provider=%s event=ShipLogs %s\n' \
-    "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$SHIPPER_SLUG" "$*" >> "$SELF_LOG_FILE" 2>/dev/null
+  ( umask 077
+    mkdir -p "$(dirname "$SELF_LOG_FILE")" 2>/dev/null
+    printf '%s provider=%s event=ShipLogs %s\n' \
+    "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$SHIPPER_SLUG" "$*" >> "$SELF_LOG_FILE" 2>/dev/null )
   return 0
 }
 
@@ -299,11 +300,13 @@ ROGUE_SHIP_MAX_BYTES ROGUE_SHIP_MAX_RUN_BYTES ROGUE_SHIP_MAX_LINE_BYTES
 ROGUE_SHIP_ALL'
 
 load_env() {
+  [ -r "$(dirname "$0")/env-file.sh" ] || return 0
+  . "$(dirname "$0")/env-file.sh"
   for _env_var_name in $SHIP_ENV_VARS; do
     eval "_process_env_$_env_var_name=\${$_env_var_name:-}"
   done
   for _env_file in "$PLUGIN_ROOT/env" /etc/rogue/env "$HOME/.rogue-env"; do
-    [ -n "$_env_file" ] && [ -r "$_env_file" ] && . "$_env_file" 2>/dev/null
+    rogue_source_env "$_env_file" 2>/dev/null
   done
   for _env_var_name in $SHIP_ENV_VARS; do
     eval "[ -n \"\${_process_env_$_env_var_name:-}\" ] && $_env_var_name=\$_process_env_$_env_var_name"
diff --git a/plugins/gemini/scripts/ship-logs.mjs b/plugins/gemini/scripts/ship-logs.mjs
index 319fb16..0abd747 100644
--- a/plugins/gemini/scripts/ship-logs.mjs
+++ b/plugins/gemini/scripts/ship-logs.mjs
@@ -33,7 +33,7 @@ import { shellUnquote, IS_WIN } from "./shared.mjs";
 
 // ── constants ──────────────────────────────────────────────────────────────
 const SHIP_ENDPOINT_PATH = "/api/v1/hooks/logs";
-const KNOWN_LOG_SLUGS = ["claude", "codex", "cursor", "gemini", "copilot", "antigravity"];
+const KNOWN_LOG_SLUGS = ["claude", "codex", "cursor", "gemini", "copilot", "antigravity", "kiro"];
 // Bytes scanned when fingerprinting a log's first line. NOT 200: a real log line is
 // timestamp + provider + event + up to 400 chars of `raw=`, i.e. commonly 500-700
 // bytes, so a 200-byte window would find no newline in a typical log's first line and
diff --git a/plugins/kiro/README.md b/plugins/kiro/README.md
index bc1801e..d3978c7 100644
--- a/plugins/kiro/README.md
+++ b/plugins/kiro/README.md
@@ -37,7 +37,63 @@ event, and when a 2.x body carries no `session_id` the bridge copies
 
 One line per event lands in `~/.rogue/logs/kiro.log`
 (`provider=kiro surface=<surface> event=<Event> outcome=… http=… rc=… raw=…`),
-see `docs/hook-log-format.md`.
+see `docs/hook-log-format.md`. The shared shipper (`scripts/ship-logs.sh` /
+`.ps1`, a byte-identical copy of `scripts/shared/`) uploads it in the
+background, and knows `kiro` as one of the per-agent logs its support form
+collects.
+
+## Roster heartbeat
+
+`scripts/heartbeat.sh <surface> <trigger>` (`heartbeat.ps1` on Windows) is
+spawned detached by the bridge on `SessionStart` (unthrottled) and on every
+`Stop` (throttled by the shared `scripts/beacon.sh`). It POSTs
+`/api/v1/hooks/status` so this install shows up in the Coding Agents roster,
+then runs the log shipper. The body is built by one function that the status
+script reuses - `rogue_kiro_status_body` in `scripts/kiro-host.sh`,
+`Get-StatusBody` in `heartbeat.ps1` - because the backend fingerprints the row
+on host, actor, family and agent, and a second copy of the fields is a second
+chance to open a second row for one install:
+
+| field | value | from | stored by the roster today |
+| --- | --- | --- | --- |
+| `agent_family` | `kiro` | fixed | yes |
+| `agent` | the surface argument (`kiro_ide` / `kiro_cli` / `kiro_crew`) | the hook file the event came through | yes, part of the row's fingerprint |
+| `version` | this plugin's version | `plugin.json`, via `scripts/install-id.sh` | yes, drives the "outdated" badge |
+| `host`, `actor_email`, `actor_name` | the install identity | `install-id.sh`, `actor.sh` | yes, the rest of the fingerprint |
+| `agent_version` | the Kiro build the surface runs under | `scripts/kiro-host.sh`: `kiro-cli --version` for the CLI and Crew, the app bundle (`Info.plist`, or the install's `package.json` on Windows) for the IDE | **no** |
+| `default_agent` | the CLI's `chat.defaultAgent`; **omitted** when none is set or off the CLI | `kiro-host.sh`: `kiro-cli settings chat.defaultAgent` | **no** |
+
+`agent_version` and `default_agent` are sent ahead of the backend. The
+`/hooks/status` schema in rogue-aidr-api (`StatusBodySchema`) lists neither,
+and unknown body fields are stripped rather than rejected, so the POST lands
+and the two values are dropped on arrival: the roster does not show the Kiro
+build or the CLI default agent yet. Until the backend half (schema, a column
+on `coding_agent`, the roster UI) ships in the monorepo, `status.sh` /
+`status.ps1` on the machine is where both are visible. They are sent now
+rather than later because the contract is the interesting part: `agent_version`
+is what support needs when a Kiro release changes hook behaviour, and on the
+2.x engine only agents that carry the Rogue hooks are covered (ADR 0001), so a
+`default_agent` that moved away from `rogue` is an uncovered machine.
+
+## Status
+
+Kiro has no slash-command surface for a `/rogue:status` skill, so the status
+command is a script:
+
+```
+sh ~/.rogue/plugins/kiro/scripts/status.sh
+powershell -NoProfile -ExecutionPolicy Bypass -File "$env:USERPROFILE\.rogue\plugins\kiro\scripts\status.ps1"
+```
+
+It reports the credential sources and the resolved key (last four characters),
+the installed surfaces with their Kiro builds, the hook wiring the installer
+wrote (hook file, Crew wrappers, agent configs carrying the hooks, the 2.x
+default agent and whether it is covered), the `/hooks/status` check (HTTP code,
+organisation, running vs latest plugin version) and the last 20 lines of
+`kiro.log`. It posts the heartbeat's own body, resolved through the same
+helpers, so it refreshes the install's roster row rather than opening a second
+one. Exit 0 when configured and the API answered 200, 1 otherwise, so a managed
+rollout can verify a machine from a script.
 
 ## What the installer writes
 
@@ -75,6 +131,16 @@ receives the IDE's prompt-block JSON, which the 3.0 CLI ignores) until the
 hardware matrix (FIRE-2038) finds a run-time signal that tells the two hosts
 apart. This is the one known mislabel.
 
+## Versioning and release
+
+`plugin.json` carries the version of record (`install-id.sh`, `hook.ps1` and
+`heartbeat.ps1` read it there); `VERSION` beside it mirrors the value for
+operators and the release page, and `scripts/plugin-versions.sh` refuses to
+build a release while the two disagree. `release.yml` publishes the plugin as
+`rogue-plugin-kiro.tar.gz` (the archive's top dir is this directory) and lists
+the version in `versions.json` under slug `kiro`, which the backend maps
+family `kiro` to when it decides whether a roster row is outdated.
+
 ## Credentials
 
 Later file wins:
@@ -93,6 +159,8 @@ be sure it applies on both.
 
 ```
 bash tests/test_hook_sh_kiro.sh            # bridge end to end against tests/mock_server.py
+bash tests/test_status_kiro_sh.sh          # status.sh under a temp HOME with a fake kiro-cli and curl
+sh tests/test_heartbeat_sh.sh              # beacon throttle + the kiro heartbeat body
 bash tests/test_install_kiro_sh.sh         # install.sh --kiro under a temp HOME with a fake kiro-cli
 pwsh tests/test_install_kiro_ps1.ps1       # the same wiring in install.ps1
 TEST_SH=dash bash tests/test_hook_sh_kiro.sh
diff --git a/plugins/kiro/VERSION b/plugins/kiro/VERSION
new file mode 100644
index 0000000..3eefcb9
--- /dev/null
+++ b/plugins/kiro/VERSION
@@ -0,0 +1 @@
+1.0.0
diff --git a/plugins/kiro/scripts/env-file.ps1 b/plugins/kiro/scripts/env-file.ps1
index 3e6864a..f0155c9 100644
--- a/plugins/kiro/scripts/env-file.ps1
+++ b/plugins/kiro/scripts/env-file.ps1
@@ -1,3 +1,44 @@
+# A Windows PowerShell child can inherit PowerShell 7's PSModulePath. Load
+# this engine's ACL cmdlets explicitly instead of resolving an incompatible module.
+if ($PSVersionTable.PSVersion.Major -eq 5) {
+    Import-Module (Join-Path $PSHOME 'Modules\Microsoft.PowerShell.Security\Microsoft.PowerShell.Security.psd1') -ErrorAction Stop
+}
+
+# Reject files writable by identities other than the current user or Windows
+# administrators/system. System-wide configuration cannot be user-owned.
+function Test-RogueEnvFile {
+    param([string]$Path, [switch]$System)
+    try {
+        if (-not (Test-Path -LiteralPath $Path -PathType Leaf)) { return $false }
+        if ($PSVersionTable.PSVersion.Major -ge 6 -and -not $IsWindows) {
+            $info = & stat -Lc '%u %a' $Path 2>$null
+            if ($LASTEXITCODE -ne 0) { $info = & stat -Lf '%u %Lp' $Path 2>$null }
+            if ($LASTEXITCODE -ne 0 -or $info -notmatch '^(\d+) ([0-7]+)$') { return $false }
+            $ownerId = $Matches[1]; $mode = [Convert]::ToInt32($Matches[2], 8)
+            return (($ownerId -eq '0' -or (-not $System -and $ownerId -eq (& id -u))) -and ($mode -band 18) -eq 0)
+        }
+        $acl = Get-Acl -LiteralPath $Path -ErrorAction Stop
+        $user = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value
+        $admins = @('S-1-5-18', 'S-1-5-32-544')
+        $trusted = @($admins) + $user
+        $owner = $acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value
+        if ($owner -notin $trusted -or ($System -and $owner -notin $admins)) { return $false }
+        $write = [System.Security.AccessControl.FileSystemRights]'Write, Delete, ChangePermissions, TakeOwnership, DeleteSubdirectoriesAndFiles'
+        foreach ($rule in $acl.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier])) {
+            if ($rule.AccessControlType -eq 'Allow' -and ($rule.FileSystemRights -band $write) -and
+                $rule.IdentityReference.Value -notin $trusted) { return $false }
+        }
+        return $true
+    } catch { return $false }
+}
+
+function Read-RogueEnvFile {
+    param([string]$Path)
+    if (Test-RogueEnvFile $Path -System:($Path -eq 'C:\ProgramData\rogue\env')) {
+        Get-Content -LiteralPath $Path -Encoding UTF8 -ErrorAction SilentlyContinue
+    }
+}
+
 function Format-RogueEnvValue {
     param([string]$Value)
     return "'" + $Value.Replace("'", "'\''") + "'"
@@ -7,16 +48,18 @@ function Protect-RogueEnvFile {
     param([string]$Path)
     $script:RogueEnvProtectError = ''
     try {
-        $acl = Get-Acl $Path
+        $acl = Get-Acl -LiteralPath $Path -ErrorAction Stop
         $acl.SetAccessRuleProtection($true, $false)
-        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule(
-            [System.Security.Principal.WindowsIdentity]::GetCurrent().Name,
-            'FullControl', 'Allow')
+        $rule = [System.Security.AccessControl.FileSystemAccessRule]::new(
+            [System.Security.Principal.WindowsIdentity]::GetCurrent().User,
+            [System.Security.AccessControl.FileSystemRights]::FullControl,
+            [System.Security.AccessControl.AccessControlType]::Allow)
         $acl.SetAccessRule($rule)
-        Set-Acl $Path $acl
+        Set-Acl -LiteralPath $Path -AclObject $acl -ErrorAction Stop
         return $true
     } catch {
         $script:RogueEnvProtectError = $_.Exception.Message
+        Write-Warning "Could not restrict credential file permissions: $script:RogueEnvProtectError"
         return $false
     }
 }
diff --git a/plugins/kiro/scripts/env-file.sh b/plugins/kiro/scripts/env-file.sh
index 5319fd7..eb1b839 100644
--- a/plugins/kiro/scripts/env-file.sh
+++ b/plugins/kiro/scripts/env-file.sh
@@ -1,5 +1,24 @@
 #!/usr/bin/env sh
 
+# Only the current user or root may supply executable configuration. System
+# configuration must belong to root; neither group nor other may write it.
+rogue_env_is_trusted() (
+  [ -f "$1" ] && [ -r "$1" ] || exit 1
+  info=$(stat -Lc '%u %a' "$1" 2>/dev/null) || info=$(stat -Lf '%u %Lp' "$1" 2>/dev/null) || exit 1
+  owner=${info%% *}; mode=${info#* }
+  case "$owner:$mode" in *[!0-9:]*|:*) exit 1 ;; esac
+  case "$1:${2:-0}" in /etc/rogue/env:*|*:1) [ "$owner" = 0 ] || exit 1 ;; esac
+  [ "$owner" = 0 ] || [ "$owner" = "$(id -u)" ] || exit 1
+  [ "$((0$mode & 022))" = 0 ]
+)
+
+rogue_source_env() {
+  if rogue_env_is_trusted "$1" "${2:-0}"; then
+    . "$1"
+  fi
+  return 0
+}
+
 rogue_env_quote() {
   printf "'%s'" "$(printf '%s' "$1" | sed "s/'/'\\\\''/g")"
 }
diff --git a/plugins/kiro/scripts/heartbeat.ps1 b/plugins/kiro/scripts/heartbeat.ps1
index 96318f0..542b3e0 100644
--- a/plugins/kiro/scripts/heartbeat.ps1
+++ b/plugins/kiro/scripts/heartbeat.ps1
@@ -15,6 +15,11 @@
 # `Invoke-Main` runs. Shared state lives in the script-scoped variables declared
 # under it, and every write to one is `$script:`-qualified — an unqualified
 # assignment inside a function writes to a local copy that vanishes on return.
+#
+# The validated surface is `$surface`, NOT `$agent`: PowerShell variable names
+# are case-insensitive, so a file-scope `$agent = ''` would overwrite the
+# `$Agent` parameter before Resolve-Surface ever read it, and every install
+# would report kiro_cli. (It did, until the heartbeat was run under test.)
 param([string]$Agent = '', [string]$Trigger = 'SessionStart')
 
 $ErrorActionPreference = 'SilentlyContinue'
@@ -27,7 +32,9 @@ $baseUrl    = ''
 $actorName  = ''
 $actorEmail = ''
 $ver        = 'unknown'   # plugin version, from plugin.json
-$agent      = ''          # which of the three surfaces this install reports for
+$surface    = ''          # which of the three surfaces this install reports for
+$kiroVer    = 'unknown'   # the Kiro build itself (kiro-cli --version / the IDE install)
+$kiroDefault = ''         # the CLI's default agent, empty off the CLI or when unset
 
 function Dbg { param([string]$Msg) if ($env:ROGUE_DEBUG) { [Console]::Error.WriteLine("[rogue-heartbeat] $Msg") } }
 
@@ -103,9 +110,10 @@ function Get-BeaconLibrary {
 # ── credential resolution ──────────────────────────────────────────────────
 function Import-Credentials {
     $script:creds = @{}
+    . ([scriptblock]::Create((Get-Content -Raw -LiteralPath (Join-Path $PluginRoot 'scripts/env-file.ps1'))))
     foreach ($f in @((Join-Path $pluginRoot 'env'), 'C:\ProgramData\rogue\env', (Join-Path $env:USERPROFILE '.rogue-env'))) {
         if (-not $f -or -not (Test-Path -LiteralPath $f)) { continue }
-        foreach ($line in (Get-Content -LiteralPath $f)) {
+        foreach ($line in (Read-RogueEnvFile $f)) {
             if ($line -match '^\s*(?:export\s+)?([A-Z_][A-Z0-9_]*)=(.+)$') {
                 $script:creds[$Matches[1]] = ConvertFrom-ShellQuoted ($Matches[2].Trim())
             }
@@ -168,11 +176,81 @@ function Resolve-Version {
 #    because the value ends up in a roster row. Default kiro_cli, which is what
 #    the route defaults an unknown x-rogue-agent to as well. ──
 function Resolve-Surface {
-    if (@('kiro_ide', 'kiro_cli', 'kiro_crew') -ccontains $Agent) { $script:agent = $Agent; return }
-    $script:agent = 'kiro_cli'
+    if (@('kiro_ide', 'kiro_cli', 'kiro_crew') -ccontains $Agent) { $script:surface = $Agent; return }
+    $script:surface = 'kiro_cli'
+}
+
+# -- what Kiro itself reports (mirrors scripts/kiro-host.sh) -------------------
+# Two versions ride one body: `version` is the plugin's, `agent_version` is the
+# Kiro build it runs under, so support can tell a current plugin from a stale
+# Kiro once the backend stores the second (it does not yet; see README "Roster
+# heartbeat"). The CLI (and Crew, which drives kiro-cli) answers `kiro-cli --version`;
+# the IDE has no CLI, so its version is read from the install under
+# %LOCALAPPDATA%\Programs\Kiro (ROGUE_KIRO_APP overrides the path for tests).
+function Get-KiroCliVersion {
+    if (-not (Get-Command kiro-cli -ErrorAction SilentlyContinue)) { return '' }
+    try { $out = (& kiro-cli --version 2>$null | Out-String) } catch { return '' }
+    $m = [regex]::Match([string]$out, '[0-9]+\.[0-9]+\.[0-9]+')
+    if ($m.Success) { return $m.Value }
+    return ''
 }
 
-# The stamp slug is `kiro`, the log file's name, and NOT $agent: the three
+function Get-KiroIdeVersion {
+    $root = $env:ROGUE_KIRO_APP
+    if (-not $root -and $env:LOCALAPPDATA) { $root = Join-Path $env:LOCALAPPDATA 'Programs\Kiro' }
+    if (-not $root) { return '' }
+    $pkg = Join-Path $root 'resources\app\package.json'
+    if (-not (Test-Path -LiteralPath $pkg)) { return '' }
+    $m = [regex]::Match((Get-Content -Raw -LiteralPath $pkg), '"version"\s*:\s*"([0-9]+\.[0-9]+\.[0-9]+)')
+    if ($m.Success) { return $m.Groups[1].Value }
+    return ''
+}
+
+# The real CLI prints the value quoted ("rogue") and errors out when none is set.
+function Get-KiroDefaultAgent {
+    if (-not (Get-Command kiro-cli -ErrorAction SilentlyContinue)) { return '' }
+    try { $out = (& kiro-cli settings chat.defaultAgent 2>$null | Out-String) } catch { return '' }
+    return ([string]$out).Trim().Trim('"')
+}
+
+# After Resolve-Surface: the surface picks which Kiro binary to ask, and only the
+# CLI has a default agent (on the 2.x engine only agents carrying the Rogue hooks
+# are covered, so a default that moved away from `rogue` is worth showing).
+# Called from Send-Heartbeat AFTER the beacon claim: each probe is a kiro-cli
+# process, and a throttled Stop must not pay for two of them.
+function Resolve-KiroHost {
+    switch ($surface) {
+        'kiro_ide' { $script:kiroVer = Get-KiroIdeVersion; $script:kiroDefault = '' }
+        'kiro_cli' { $script:kiroVer = Get-KiroCliVersion; $script:kiroDefault = Get-KiroDefaultAgent }
+        default    { $script:kiroVer = Get-KiroCliVersion; $script:kiroDefault = '' }
+    }
+    if (-not $script:kiroVer) { $script:kiroVer = 'unknown' }
+}
+
+# The /hooks/status body, from the resolved script state. The ONE builder for
+# this heartbeat and for status.ps1 (which loads this file through the seam):
+# the backend fingerprints a roster row on host|actor|family|agent, so a second
+# copy of these fields is a second chance to disagree on a segment and open a
+# second row for one install. `default_agent` is absent, not empty, when the
+# CLI has none set or the surface is not the CLI: "no field" reads as "not a
+# CLI, or none set", which an empty string would blur.
+function Get-StatusBody {
+    $host_ = $env:COMPUTERNAME
+    if (-not $host_) { try { $host_ = [System.Net.Dns]::GetHostName() } catch { $host_ = 'unknown' } }
+    $fields = @{
+        agent_family = 'kiro'
+        agent = $surface
+        version = $ver
+        agent_version = $kiroVer
+        host = $host_
+        actor_email = [string]$actorEmail
+        actor_name = [string]$actorName
+    }
+    if ($kiroDefault) { $fields['default_agent'] = $kiroDefault }
+    return ($fields | ConvertTo-Json -Compress)
+}
+
+# The stamp slug is `kiro`, the log file's name, and NOT $surface: the three
 # surfaces share one install and one log, so they must share one throttle window
 # too - a per-surface stamp would let a machine with the IDE and the CLI both
 # installed beacon twice as often as configured.
@@ -185,18 +263,8 @@ function Send-Heartbeat {
         Dbg 'beacon throttled'
         return
     }
-
-    $host_ = $env:COMPUTERNAME
-    if (-not $host_) { try { $host_ = [System.Net.Dns]::GetHostName() } catch { $host_ = 'unknown' } }
-
-    $body = @{
-        agent_family = 'kiro'
-        agent        = $agent
-        version      = $ver
-        host         = $host_
-        actor_email  = [string]$actorEmail
-        actor_name   = [string]$actorName
-    } | ConvertTo-Json -Compress
+    Resolve-KiroHost
+    $body = Get-StatusBody
 
     try {
         $bytes = [System.Text.Encoding]::UTF8.GetBytes($body)
@@ -270,7 +338,7 @@ function Invoke-Main {
     Resolve-Actor
     Resolve-Version
     Resolve-Surface
-    Send-Heartbeat
+    Send-Heartbeat     # claims the beacon slot, THEN asks Kiro for its version
     Start-LogShipper
     exit 0
 }
diff --git a/plugins/kiro/scripts/heartbeat.sh b/plugins/kiro/scripts/heartbeat.sh
index 90a83c6..f0fabcb 100755
--- a/plugins/kiro/scripts/heartbeat.sh
+++ b/plugins/kiro/scripts/heartbeat.sh
@@ -29,7 +29,6 @@ set -u
 PLUGIN_ROOT=""
 AGENT=""               # which of the three surfaces this install is reporting for
 VER="unknown"          # plugin version, from plugin.json via install-id.sh
-HOST="unknown"         # hostname; both set by resolve_version via install-id.sh
 TRIGGER="SessionStart" # which hook fired us; anything else is rate-limited
 
 # Self-locate the plugin root from $0 (<root>/scripts/heartbeat.sh).
@@ -40,9 +39,11 @@ locate_plugin_root() {
 
 # Same env precedence as hook.sh (later wins): bundled → MDM → per-user.
 load_env() {
-  [ -r "${PLUGIN_ROOT}/env" ] && . "${PLUGIN_ROOT}/env"
-  [ -r /etc/rogue/env ]       && . /etc/rogue/env
-  [ -r "$HOME/.rogue-env" ]   && . "$HOME/.rogue-env"
+  [ -r "${PLUGIN_ROOT}/scripts/env-file.sh" ] || return 0
+  . "${PLUGIN_ROOT}/scripts/env-file.sh"
+  rogue_source_env "${PLUGIN_ROOT}/env"
+  rogue_source_env /etc/rogue/env
+  rogue_source_env "$HOME/.rogue-env"
   # Trim a trailing slash so a user-set ROGUE_BASE_URL with one doesn't yield
   # "//" in the composed URL (mirrors heartbeat.ps1's .TrimEnd('/')).
   ROGUE_BASE_URL="${ROGUE_BASE_URL:-}"
@@ -77,11 +78,22 @@ resolve_version() {
   SURFACE="$AGENT"
   [ -r "${PLUGIN_ROOT}/scripts/install-id.sh" ] && . "${PLUGIN_ROOT}/scripts/install-id.sh"
   VER="${ROGUE_INSTALL_VERSION:-unknown}"
-  HOST="${ROGUE_INSTALL_HOST:-unknown}"
   return 0
 }
 
-esc() { printf '%s' "$1" | sed -e 's/\\/\\\\/g' -e 's/"/\\"/g'; }
+# What Kiro itself reports: its build (CLI from `kiro-cli --version`, IDE from
+# the app bundle) and, on the CLI, the default agent. Two versions ride one
+# body - `version` is the plugin's, `agent_version` is Kiro's - so support can
+# tell a current plugin from a stale Kiro once the backend stores the second
+# (it does not yet; see README "Roster heartbeat"). kiro-host.sh reads SURFACE too,
+# and also defines rogue_kiro_status_body, the body builder shared with
+# status.sh. Called from post_heartbeat AFTER the beacon claim: each probe is a
+# kiro-cli process, and a throttled Stop must not pay for two of them.
+resolve_kiro_host() {
+  SURFACE="$AGENT"
+  [ -r "${PLUGIN_ROOT}/scripts/kiro-host.sh" ] && . "${PLUGIN_ROOT}/scripts/kiro-host.sh"
+  return 0
+}
 
 # ── beacon throttle ────────────────────────────────────────────────────────
 # The rule lives in scripts/beacon.sh, a byte-identical copy of
@@ -115,9 +127,11 @@ post_heartbeat() {
   _unthrottled=0
   [ "$TRIGGER" = "SessionStart" ] && _unthrottled=1
   rogue_beacon_claim kiro "$_unthrottled" || return 0
-  _body=$(printf '{"agent_family":"kiro","agent":"%s","version":"%s","host":"%s","actor_email":"%s","actor_name":"%s"}' \
-    "$(esc "$AGENT")" "$(esc "$VER")" "$(esc "$HOST")" \
-    "$(esc "${ROGUE_ACTOR_EMAIL:-}")" "$(esc "${ROGUE_ACTOR_NAME:-}")")
+  resolve_kiro_host
+  # No builder means no kiro-host.sh: a partial install has nothing to report
+  # this turn, and the stamp already written keeps it from retrying every turn.
+  command -v rogue_kiro_status_body >/dev/null 2>&1 || return 0
+  _body=$(rogue_kiro_status_body)
 
   curl -sS --max-time 10 -X POST \
     "${ROGUE_BASE_URL:-https://api.rogue.security}/api/v1/hooks/status" \
@@ -157,7 +171,7 @@ main() {
   resolve_surface "${1:-}"
   resolve_version   # after the surface: install-id.sh keys the agent on it
   load_beacon       # after load_env, so the library sees the interval knob
-  post_heartbeat
+  post_heartbeat    # claims the beacon slot, THEN asks Kiro for its version
   ship_logs
   exit 0
 }
diff --git a/plugins/kiro/scripts/hook.ps1 b/plugins/kiro/scripts/hook.ps1
index bab2b72..86a022e 100644
--- a/plugins/kiro/scripts/hook.ps1
+++ b/plugins/kiro/scripts/hook.ps1
@@ -24,7 +24,11 @@
 #   2. C:\ProgramData\rogue\env  (MDM-provisioned; mirrors /etc/rogue/env)
 #   3. %USERPROFILE%\.rogue-env  (user / installer-written)
 
-param([string]$EventName = '', [string]$Surface = '', [string]$PluginRoot = '')
+# $SurfaceArg, not $Surface: PowerShell variable names are case-insensitive, so
+# the file-scope `$script:surface = ''` below would overwrite a parameter of that
+# name before the main body validated it, and every event would go out as
+# kiro_cli. Positional, so the hook file's `hook.ps1 <event> <surface>` is unchanged.
+param([string]$EventName = '', [string]$SurfaceArg = '', [string]$PluginRoot = '')
 
 $ErrorActionPreference = 'SilentlyContinue'
 $ProgressPreference = 'SilentlyContinue'
@@ -187,8 +191,10 @@ function Add-KiroSessionId {
 function Test-KiroDuplicateAgentHook {
     param([string]$TriggerArg, [string]$Payload)
     if ($TriggerArg -cnotin @('agentSpawn', 'userPromptSubmit', 'preToolUse', 'postToolUse', 'stop')) { return $false }
-    if ($Payload -and $Payload -match '"hook_event_name"\s*:\s*"([^"]*)"') { return [bool]($Matches[1] -cmatch '^[A-Z]') }
-    return $false
+    try {
+        $body = ConvertFrom-Json -InputObject $Payload -ErrorAction Stop
+        return ($body -is [PSCustomObject] -and $body.hook_event_name -is [string] -and $body.hook_event_name -cmatch '^[A-Z]')
+    } catch { return $false }
 }
 
 # STRICT shape match: the pair, not the substrings, so an allow that carries
@@ -239,158 +245,182 @@ function Resolve-KiroOutcome {
     return $o
 }
 
-# Test seam: dot-sourcing with ROGUE_PS_LIB_ONLY=1 loads the functions above
-# without running the bridge. Production never sets this.
-if ($env:ROGUE_PS_LIB_ONLY) { return }
+function Initialize-KiroContext {
+    # Windows PowerShell 5.1 may negotiate only TLS 1.0/1.1 by default; add TLS 1.2.
+    try {
+        [Net.ServicePointManager]::SecurityProtocol = `
+            [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
+    } catch {}
 
-# Windows PowerShell 5.1 may negotiate only TLS 1.0/1.1 by default; add TLS 1.2.
-try {
-    [Net.ServicePointManager]::SecurityProtocol = `
-        [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
-} catch {}
-
-# Stand down on non-Windows (Kiro runs hook.sh there; this guards a stray pwsh).
-if ($PSVersionTable.PSVersion.Major -ge 6 -and -not $IsWindows) { exit 0 }
-
-$triggerArg = $EventName
-$EventName = ConvertTo-KiroEvent $EventName
-$script:surface = Get-KiroSurface $Surface
-$agent = if ($script:surface) { $script:surface } else { 'kiro_cli' }
-Dbg "event=$EventName surface=$agent"
-
-if (-not $PluginRoot -and $PSScriptRoot) { $PluginRoot = Split-Path -Parent $PSScriptRoot }
-if (-not $PluginRoot) { $PluginRoot = $env:KIRO_PLUGIN_ROOT }
-if (-not $PluginRoot) { try { $PluginRoot = (Get-Location).Path } catch { $PluginRoot = '.' } }
-
-# -- credential resolution (later file wins; process env wins over all) -----
-$creds = @{}
-foreach ($f in @((Join-Path $PluginRoot 'env'), 'C:\ProgramData\rogue\env', (Join-Path $env:USERPROFILE '.rogue-env'))) {
-    if (-not $f -or -not (Test-Path -LiteralPath $f)) { continue }
-    foreach ($line in (Get-Content -LiteralPath $f)) {
-        if ($line -match '^\s*(?:export\s+)?([A-Z_][A-Z0-9_]*)=(.+)$') {
-            $creds[$Matches[1]] = ConvertFrom-ShellQuoted ($Matches[2].Trim())
+    # Stand down on non-Windows (Kiro runs hook.sh there; this guards a stray pwsh).
+    if ($PSVersionTable.PSVersion.Major -ge 6 -and -not $IsWindows) { exit 0 }
+
+    $script:triggerArg = $EventName
+    $script:EventName = ConvertTo-KiroEvent $EventName
+    $script:surface = Get-KiroSurface $SurfaceArg
+    $script:agent = if ($script:surface) { $script:surface } else { 'kiro_cli' }
+    Dbg "event=$EventName surface=$agent"
+
+    if (-not $PluginRoot -and $PSScriptRoot) { $script:PluginRoot = Split-Path -Parent $PSScriptRoot }
+    if (-not $PluginRoot) { $script:PluginRoot = $env:KIRO_PLUGIN_ROOT }
+    if (-not $PluginRoot) { try { $script:PluginRoot = (Get-Location).Path } catch { $script:PluginRoot = '.' } }
+
+    # -- credential resolution (later file wins; process env wins over all) -----
+    $script:creds = @{}
+    . ([scriptblock]::Create((Get-Content -Raw -LiteralPath (Join-Path $PluginRoot 'scripts/env-file.ps1'))))
+    foreach ($f in @((Join-Path $PluginRoot 'env'), 'C:\ProgramData\rogue\env', (Join-Path $env:USERPROFILE '.rogue-env'))) {
+        if (-not $f -or -not (Test-Path -LiteralPath $f)) { continue }
+        foreach ($line in (Read-RogueEnvFile $f)) {
+            if ($line -match '^\s*(?:export\s+)?([A-Z_][A-Z0-9_]*)=(.+)$') {
+                $creds[$Matches[1]] = ConvertFrom-ShellQuoted ($Matches[2].Trim())
+            }
         }
     }
-}
-# ROGUE_LOG_* ride the same list so a process-env value still beats the files,
-# which is what makes the resolved precedence identical to hook.sh's.
-foreach ($k in 'ROGUE_API_KEY','ROGUE_ACTOR_EMAIL','ROGUE_ACTOR_NAME','ROGUE_BASE_URL','ROGUE_API_URL',
-               'ROGUE_LOG_FILE','ROGUE_LOG_DIR','ROGUE_LOG_MAX_BYTES','ROGUE_HOOK_TIMEOUT') {
-    $val = [Environment]::GetEnvironmentVariable($k); if ($val) { $creds[$k] = $val }
-}
+    # ROGUE_LOG_* ride the same list so a process-env value still beats the files,
+    # which is what makes the resolved precedence identical to hook.sh's.
+    foreach ($k in 'ROGUE_API_KEY','ROGUE_ACTOR_EMAIL','ROGUE_ACTOR_NAME','ROGUE_BASE_URL','ROGUE_API_URL',
+                   'ROGUE_LOG_FILE','ROGUE_LOG_DIR','ROGUE_LOG_MAX_BYTES','ROGUE_HOOK_TIMEOUT') {
+        $val = [Environment]::GetEnvironmentVariable($k); if ($val) { $creds[$k] = $val }
+    }
+
+    # After the credential files (so they can relocate the log), before the API-key
+    # check (so an unconfigured install still records outcome=unconfigured).
+    Initialize-Logging $creds
+    Dbg "logFile=$logFile cap=$logMaxBytes"
+
+    $script:apiKey = $creds['ROGUE_API_KEY']
+    if (-not $apiKey) {
+        Log 'outcome=unconfigured'
+        exit 0
+    }
 
-# After the credential files (so they can relocate the log), before the API-key
-# check (so an unconfigured install still records outcome=unconfigured).
-Initialize-Logging $creds
-Dbg "logFile=$logFile cap=$logMaxBytes"
+    $script:url = $creds['ROGUE_API_URL']
+    if (-not $url) {
+        $baseUrl = $creds['ROGUE_BASE_URL']; if (-not $baseUrl) { $baseUrl = 'https://api.rogue.security' }
+        $script:url = "$($baseUrl.TrimEnd('/'))/api/v1/hooks/kiro"
+    }
 
-$apiKey = $creds['ROGUE_API_KEY']
-if (-not $apiKey) {
-    Log 'outcome=unconfigured'
-    exit 0
+    # curl budget in hook.sh; here the request timeout. The hook file gives the
+    # command 10s, so 8s leaves room without letting Kiro's own timeout be what
+    # fails us open. Zero falls back to the default: -TimeoutSec 0 means NO timeout.
+    $script:timeoutSec = 8
+    $t = $creds['ROGUE_HOOK_TIMEOUT']
+    if ($t -match '^[0-9]{1,9}$' -and [int]$t -gt 0) { $script:timeoutSec = [int]$t }
 }
 
-$url = $creds['ROGUE_API_URL']
-if (-not $url) {
-    $baseUrl = $creds['ROGUE_BASE_URL']; if (-not $baseUrl) { $baseUrl = 'https://api.rogue.security' }
-    $url = "$($baseUrl.TrimEnd('/'))/api/v1/hooks/kiro"
+function Resolve-KiroActor {
+    # -- actor resolution (mirrors actor.sh) -------------------------------------
+    $script:actorName = $creds['ROGUE_ACTOR_NAME']
+    if (-not $actorName) { try { $script:actorName = (& git config --global user.name 2>$null | Out-String).Trim() } catch {} }
+    if (-not $actorName) { $script:actorName = $env:USERNAME }
+
+    $script:actorEmail = $creds['ROGUE_ACTOR_EMAIL']
+    if (-not $actorEmail) { try { $script:actorEmail = (& git config --global user.email 2>$null | Out-String).Trim() } catch {} }
+    if (-not $actorEmail) {
+        if ($env:USERNAME -and $env:COMPUTERNAME) { $script:actorEmail = "$($env:USERNAME)@$($env:COMPUTERNAME)" }
+        elseif ($env:USERNAME) { $script:actorEmail = $env:USERNAME } else { $script:actorEmail = $env:COMPUTERNAME }
+    }
 }
 
-# curl budget in hook.sh; here the request timeout. The hook file gives the
-# command 10s, so 8s leaves room without letting Kiro's own timeout be what
-# fails us open. Zero falls back to the default: -TimeoutSec 0 means NO timeout.
-$timeoutSec = 8
-$t = $creds['ROGUE_HOOK_TIMEOUT']
-if ($t -match '^[0-9]{1,9}$' -and [int]$t -gt 0) { $timeoutSec = [int]$t }
-
-# -- actor resolution (mirrors actor.sh) -------------------------------------
-$actorName = $creds['ROGUE_ACTOR_NAME']
-if (-not $actorName) { try { $actorName = (& git config --global user.name 2>$null | Out-String).Trim() } catch {} }
-if (-not $actorName) { $actorName = $env:USERNAME }
-
-$actorEmail = $creds['ROGUE_ACTOR_EMAIL']
-if (-not $actorEmail) { try { $actorEmail = (& git config --global user.email 2>$null | Out-String).Trim() } catch {} }
-if (-not $actorEmail) {
-    if ($env:USERNAME -and $env:COMPUTERNAME) { $actorEmail = "$($env:USERNAME)@$($env:COMPUTERNAME)" }
-    elseif ($env:USERNAME) { $actorEmail = $env:USERNAME } else { $actorEmail = $env:COMPUTERNAME }
+function Read-KiroPayload {
+    param([System.IO.Stream]$InputStream = [Console]::OpenStandardInput())
+    $bytes = New-Object System.IO.MemoryStream
+    try {
+        $InputStream.CopyTo($bytes)
+        $payload = (New-Object System.Text.UTF8Encoding($false, $true)).GetString($bytes.ToArray())
+    } finally { $bytes.Dispose() }
+    if (-not $payload) { $payload = '{}' }
+    return $payload.TrimStart([char]0xFEFF)
 }
 
-# -- payload from stdin (recover UTF-8, strip BOM), then the 2.x session id ---
-$payload = [Console]::In.ReadToEnd()
-if (-not $payload) { $payload = '{}' }
-try {
-    $raw = [Console]::InputEncoding.GetBytes($payload)
-    $payload = [System.Text.Encoding]::UTF8.GetString($raw)
-} catch {}
-$payload = $payload.TrimStart([char]0xFEFF)
-$payload = Add-KiroSessionId $payload $env:KIRO_SESSION_ID
-
-# One copy per event on the 3.0 engine (see Test-KiroDuplicateAgentHook):
-# before the heartbeat and the request.
-if (Test-KiroDuplicateAgentHook $triggerArg $payload) {
-    Log "outcome=duplicate engine=3.0 trigger=$triggerArg"
-    exit 0
+function Resolve-KiroInstall {
+    # -- install identity: host + version (mirrors install-id.sh) ----------------
+    $installError = @()
+    $script:hostName = $env:COMPUTERNAME
+    if (-not $hostName) { try { $script:hostName = [System.Net.Dns]::GetHostName() } catch { $script:hostName = '' } }
+    if (-not $hostName) { $script:hostName = 'unknown'; $installError += 'host-unresolved' }
+
+    $script:pluginVersion = 'unknown'
+    $pluginJson = Join-Path $PluginRoot 'plugin.json'
+    if (Test-Path -LiteralPath $pluginJson) {
+        $m = [regex]::Match((Get-Content -Raw -LiteralPath $pluginJson), '"version"\s*:\s*"([0-9]+\.[0-9]+\.[0-9]+)')
+        if ($m.Success) { $script:pluginVersion = $m.Groups[1].Value }
+        else { $installError += "version-unparsed:$pluginJson" }
+    } else {
+        $installError += "manifest-missing:$pluginJson"
+    }
+    if ($installError.Count) { Log "error=install-id $($installError -join ',')" }
 }
 
-# -- install identity: host + version (mirrors install-id.sh) ----------------
-$installError = @()
-$hostName = $env:COMPUTERNAME
-if (-not $hostName) { try { $hostName = [System.Net.Dns]::GetHostName() } catch { $hostName = '' } }
-if (-not $hostName) { $hostName = 'unknown'; $installError += 'host-unresolved' }
-
-$pluginVersion = 'unknown'
-$pluginJson = Join-Path $PluginRoot 'plugin.json'
-if (Test-Path -LiteralPath $pluginJson) {
-    $m = [regex]::Match((Get-Content -Raw -LiteralPath $pluginJson), '"version"\s*:\s*"([0-9]+\.[0-9]+\.[0-9]+)')
-    if ($m.Success) { $pluginVersion = $m.Groups[1].Value }
-    else { $installError += "version-unparsed:$pluginJson" }
-} else {
-    $installError += "manifest-missing:$pluginJson"
+function Start-KiroHeartbeat {
+    # -- presence heartbeat (SessionStart unthrottled, Stop throttled) ------------
+    # Detached; heartbeat.ps1 takes the surface and the trigger, as heartbeat.sh does.
+    if ($EventName -eq 'SessionStart' -or $EventName -eq 'Stop') {
+        $hb = Join-Path $PluginRoot 'scripts\heartbeat.ps1'
+        if (Test-Path -LiteralPath $hb) {
+            try {
+                Start-Process -FilePath 'powershell' -WindowStyle Hidden `
+                    -ArgumentList '-NoProfile','-ExecutionPolicy','Bypass','-File',$hb,$agent,$EventName | Out-Null
+            } catch { Dbg "heartbeat spawn failed: $($_.Exception.Message)" }
+        }
+    }
 }
-if ($installError.Count) { Log "error=install-id $($installError -join ',')" }
-
-# -- presence heartbeat (SessionStart unthrottled, Stop throttled) ------------
-# Detached; heartbeat.ps1 takes the surface and the trigger, as heartbeat.sh does.
-if ($EventName -eq 'SessionStart' -or $EventName -eq 'Stop') {
-    $hb = Join-Path $PluginRoot 'scripts\heartbeat.ps1'
-    if (Test-Path -LiteralPath $hb) {
-        try {
-            Start-Process -FilePath 'powershell' -WindowStyle Hidden `
-                -ArgumentList '-NoProfile','-ExecutionPolicy','Bypass','-File',$hb,$agent,$EventName | Out-Null
-        } catch { Dbg "heartbeat spawn failed: $($_.Exception.Message)" }
+
+function Send-KiroRequest {
+    # -- POST (fail-open) --------------------------------------------------------
+    $headers = @{
+        'x-rogue-api-key'     = $apiKey
+        'x-rogue-event'       = $EventName
+        'x-rogue-agent'       = $agent
+        'x-rogue-host'        = $hostName
+        'x-rogue-version'     = $pluginVersion
+        'x-rogue-actor-email' = $actorEmail
+        'x-rogue-actor-name'  = $actorName
     }
+    $bodyBytes = [System.Text.Encoding]::UTF8.GetBytes($payload)
+    $script:resp = ''
+    $script:code = '000'
+    $script:requestRc = 1
+    try {
+        $r = Invoke-WebRequest -Uri $url -Method Post `
+            -Headers $headers -ContentType 'application/json' -Body $bodyBytes `
+            -UseBasicParsing -TimeoutSec $timeoutSec -ErrorAction Stop
+        $script:requestRc = 0
+        $script:code = [string]$r.StatusCode
+        if ($r.StatusCode -eq 200) {
+            try { $script:resp = [System.Text.Encoding]::UTF8.GetString($r.RawContentStream.ToArray()) }
+            catch { $script:resp = [string]$r.Content }
+        }
+    } catch { Dbg "POST failed: $($_.Exception.Message)"; $script:resp = '' }
 }
 
-# -- POST (fail-open) --------------------------------------------------------
-$headers = @{
-    'x-rogue-api-key'     = $apiKey
-    'x-rogue-event'       = $EventName
-    'x-rogue-agent'       = $agent
-    'x-rogue-host'        = $hostName
-    'x-rogue-version'     = $pluginVersion
-    'x-rogue-actor-email' = $actorEmail
-    'x-rogue-actor-name'  = $actorName
+function Write-KiroDecision {
+    # -- translate, log ONE line, answer Kiro -------------------------------------
+    $o = Resolve-KiroOutcome $EventName $resp
+    $respHead = if ($resp.Length -gt 400) { $resp.Substring(0, 400) } else { $resp }
+    $note = if ($o.Note) { " $($o.Note)" } else { '' }
+    Log "outcome=$($o.Outcome)$note http=$code rc=$requestRc raw=$(Sanitize $respHead)"
+
+    if ($o.Stdout) { Write-Raw $o.Stdout }
+    if ($o.Stderr) { [Console]::Error.WriteLine($o.Stderr) }
+    exit $o.ExitCode
 }
-$bodyBytes = [System.Text.Encoding]::UTF8.GetBytes($payload)
-$resp = ''
-$code = '000'
-try {
-    $r = Invoke-WebRequest -Uri $url -Method Post `
-        -Headers $headers -ContentType 'application/json' -Body $bodyBytes `
-        -UseBasicParsing -TimeoutSec $timeoutSec -ErrorAction Stop
-    $code = [string]$r.StatusCode
-    if ($r.StatusCode -eq 200) {
-        try { $resp = [System.Text.Encoding]::UTF8.GetString($r.RawContentStream.ToArray()) }
-        catch { $resp = [string]$r.Content }
-    }
-} catch { Dbg "POST failed: $($_.Exception.Message)"; $resp = '' }
 
-# -- translate, log ONE line, answer Kiro -------------------------------------
-$o = Resolve-KiroOutcome $EventName $resp
-$respHead = if ($resp.Length -gt 400) { $resp.Substring(0, 400) } else { $resp }
-$note = if ($o.Note) { " $($o.Note)" } else { '' }
-Log "outcome=$($o.Outcome)$note http=$code raw=$(Sanitize $respHead)"
+function Invoke-KiroHook {
+    Initialize-KiroContext
+    Resolve-KiroActor
+    $payload = Read-KiroPayload
+    $payload = Add-KiroSessionId $payload $env:KIRO_SESSION_ID
+    if (Test-KiroDuplicateAgentHook $triggerArg $payload) {
+        Log "outcome=duplicate engine=3.0 trigger=$triggerArg"
+        exit 0
+    }
+    Resolve-KiroInstall
+    Start-KiroHeartbeat
+    Send-KiroRequest
+    Write-KiroDecision
+}
 
-if ($o.Stdout) { Write-Raw $o.Stdout }
-if ($o.Stderr) { [Console]::Error.WriteLine($o.Stderr) }
-exit $o.ExitCode
+# Dot-sourcing through the test seam defines every function without running it.
+if ($env:ROGUE_PS_LIB_ONLY) { return }
+try { Invoke-KiroHook } catch { Dbg "bridge failed: $($_.Exception.Message)"; exit 0 }
diff --git a/plugins/kiro/scripts/hook.sh b/plugins/kiro/scripts/hook.sh
index f33eec2..7657dee 100755
--- a/plugins/kiro/scripts/hook.sh
+++ b/plugins/kiro/scripts/hook.sh
@@ -42,23 +42,19 @@
 #   2. /etc/rogue/env            (MDM-provisioned)
 #   3. $HOME/.rogue-env          (per-user / installer-written)
 
-EVENT_ARG="${1:-}"
-SURFACE_ARG="${2:-}"
-
-# Self-locate the plugin root from $0 (the installer writes the absolute path
-# <root>/scripts/hook.sh into the hook file). Fall back to the env token.
-PLUGIN_ROOT="$(CDPATH= cd -- "$(dirname -- "$0")/.." 2>/dev/null && pwd)"
-[ -n "$PLUGIN_ROOT" ] || PLUGIN_ROOT="${KIRO_PLUGIN_ROOT:-${PLUGIN_ROOT:-.}}"
+locate_plugin_root() {
+  PLUGIN_ROOT="$(CDPATH= cd -- "$(dirname -- "$0")/.." 2>/dev/null && pwd)"
+  [ -n "$PLUGIN_ROOT" ] || PLUGIN_ROOT="${KIRO_PLUGIN_ROOT:-${PLUGIN_ROOT:-.}}"
+}
 
-# Env precedence (later wins): bundled → MDM → per-user.
-[ -r "${PLUGIN_ROOT}/env" ] && . "${PLUGIN_ROOT}/env"
-[ -r /etc/rogue/env ]       && . /etc/rogue/env
-[ -r "$HOME/.rogue-env" ]   && . "$HOME/.rogue-env"
+load_env() {
+  [ -r "${PLUGIN_ROOT}/scripts/env-file.sh" ] || return 0
+  . "${PLUGIN_ROOT}/scripts/env-file.sh"
+  rogue_source_env "${PLUGIN_ROOT}/env"
+  rogue_source_env /etc/rogue/env
+  rogue_source_env "$HOME/.rogue-env"
+}
 
-# The canonical hook event, as the route's monitored/blocking tables spell it.
-# The 2.x engine names the same events in camelCase (and SessionStart is
-# `agentSpawn` there); anything unrecognised is passed through verbatim so a new
-# Kiro event is still recorded rather than dropped.
 canonical_event() {
   case "$1" in
     agentSpawn|SessionStart)             echo SessionStart ;;
@@ -69,29 +65,32 @@ canonical_event() {
     *)                                   printf '%s\n' "$1" ;;
   esac
 }
-EVENT=$(canonical_event "$EVENT_ARG")
+initialize_context() {
+  EVENT=$(canonical_event "$EVENT_ARG")
 
-# A closed vocabulary. An unrecognised argument leaves the log token OUT (the
-# hook-log contract forbids a placeholder) and lands on kiro_cli on the wire,
-# which is what the route defaults an unknown x-rogue-agent to anyway.
-case "$SURFACE_ARG" in
-  kiro_ide|kiro_cli|kiro_crew) SURFACE="$SURFACE_ARG" ;;
-  *)                           SURFACE="" ;;
-esac
+  # A closed vocabulary. An unrecognised argument leaves the log token OUT (the
+  # hook-log contract forbids a placeholder) and lands on kiro_cli on the wire,
+  # which is what the route defaults an unknown x-rogue-agent to anyway.
+  case "$SURFACE_ARG" in
+    kiro_ide|kiro_cli|kiro_crew) SURFACE="$SURFACE_ARG" ;;
+    *)                           SURFACE="" ;;
+  esac
+
+  # Log destination — ONE FILE PER AGENT under ~/.rogue/logs (see
+  # docs/hook-log-format.md). Precedence: explicit file → directory → default.
+  ROGUE_LOG_DIR="${ROGUE_LOG_DIR:-$HOME/.rogue/logs}"
+  ROGUE_LOG_FILE="${ROGUE_LOG_FILE:-$ROGUE_LOG_DIR/kiro.log}"
+  # Size cap; over it the log is renamed to <file>.1 (one generation kept). A
+  # numeric zero disables rotation; a non-numeric or oversized value falls back to
+  # the default so a typo can never leave the log growing unbounded. The clamp
+  # mirrors the other five sh dispatchers byte for byte.
+  ROGUE_LOG_MAX_BYTES="${ROGUE_LOG_MAX_BYTES:-10485760}"
+  case "$ROGUE_LOG_MAX_BYTES" in ""|*[!0-9]*) ROGUE_LOG_MAX_BYTES=10485760 ;; esac
+  _lcap="$ROGUE_LOG_MAX_BYTES"
+  while [ "${_lcap#0}" != "$_lcap" ]; do _lcap="${_lcap#0}"; done
+  if [ "${#_lcap}" -gt 18 ]; then ROGUE_LOG_MAX_BYTES=10485760; fi
+}
 
-# Log destination — ONE FILE PER AGENT under ~/.rogue/logs (see
-# docs/hook-log-format.md). Precedence: explicit file → directory → default.
-ROGUE_LOG_DIR="${ROGUE_LOG_DIR:-$HOME/.rogue/logs}"
-ROGUE_LOG_FILE="${ROGUE_LOG_FILE:-$ROGUE_LOG_DIR/kiro.log}"
-# Size cap; over it the log is renamed to <file>.1 (one generation kept). A
-# numeric zero disables rotation; a non-numeric or oversized value falls back to
-# the default so a typo can never leave the log growing unbounded. The clamp
-# mirrors the other five sh dispatchers byte for byte.
-ROGUE_LOG_MAX_BYTES="${ROGUE_LOG_MAX_BYTES:-10485760}"
-case "$ROGUE_LOG_MAX_BYTES" in ""|*[!0-9]*) ROGUE_LOG_MAX_BYTES=10485760 ;; esac
-_lcap="$ROGUE_LOG_MAX_BYTES"
-while [ "${_lcap#0}" != "$_lcap" ]; do _lcap="${_lcap#0}"; done
-if [ "${#_lcap}" -gt 18 ]; then ROGUE_LOG_MAX_BYTES=10485760; fi
 rotate_log() {
   [ -f "$ROGUE_LOG_FILE" ] || return 0
   [ "$ROGUE_LOG_MAX_BYTES" -gt 0 ] || return 0
@@ -113,31 +112,34 @@ log() {
 }
 sanitize() { printf '%s' "$1" | tr -d '\000-\037\177'; }
 
-# Not configured: log it and fail open. No SessionStart hint either — on the
-# 2.x engine a hook's stdout is injected into the model's context, and the
-# installer already told the user how to connect a key.
-if [ -z "${ROGUE_API_KEY:-}" ]; then
-  log "outcome=unconfigured"
-  exit 0
-fi
+require_api_key() {
+  if [ -z "${ROGUE_API_KEY:-}" ]; then
+    log "outcome=unconfigured"
+    exit 0
+  fi
+}
 
-[ -r "${PLUGIN_ROOT}/scripts/actor.sh" ] && . "${PLUGIN_ROOT}/scripts/actor.sh"
-# Host + version + surface, resolved exactly as heartbeat.sh does, so the fleet
-# roster row is refreshed by ordinary hook traffic. install-id.sh reads SURFACE.
-[ -r "${PLUGIN_ROOT}/scripts/install-id.sh" ] && . "${PLUGIN_ROOT}/scripts/install-id.sh"
-[ -n "${ROGUE_INSTALL_ID_ERROR:-}" ] && log "error=install-id $ROGUE_INSTALL_ID_ERROR"
-ROGUE_INSTALL_AGENT="${ROGUE_INSTALL_AGENT:-${SURFACE:-kiro_cli}}"
+load_identity() {
+  [ -r "${PLUGIN_ROOT}/scripts/actor.sh" ] && . "${PLUGIN_ROOT}/scripts/actor.sh"
+  # Host + version + surface, resolved exactly as heartbeat.sh does, so the fleet
+  # roster row is refreshed by ordinary hook traffic. install-id.sh reads SURFACE.
+  [ -r "${PLUGIN_ROOT}/scripts/install-id.sh" ] && . "${PLUGIN_ROOT}/scripts/install-id.sh"
+  [ -n "${ROGUE_INSTALL_ID_ERROR:-}" ] && log "error=install-id $ROGUE_INSTALL_ID_ERROR"
+  ROGUE_INSTALL_AGENT="${ROGUE_INSTALL_AGENT:-${SURFACE:-kiro_cli}}"
+}
 
-URL="${ROGUE_API_URL:-${ROGUE_BASE_URL:-https://api.rogue.security}/api/v1/hooks/kiro}"
+resolve_request() {
+  URL="${ROGUE_API_URL:-${ROGUE_BASE_URL:-https://api.rogue.security}/api/v1/hooks/kiro}"
 
-# curl budget, in seconds. The hook file gives the command 10s and the route
-# evaluates within 3s, so 8s leaves room for the network without ever letting
-# Kiro's own timeout be what fails us open. Tests shorten it. Zero falls back to
-# the default too: `curl --max-time 0` means NO timeout, which would hand the
-# budget to Kiro's 10s. `-gt` also rejects a value too wide for the shell's int.
-HOOK_TIMEOUT="${ROGUE_HOOK_TIMEOUT:-8}"
-case "$HOOK_TIMEOUT" in ''|*[!0-9]*) HOOK_TIMEOUT=8 ;; esac
-[ "$HOOK_TIMEOUT" -gt 0 ] 2>/dev/null || HOOK_TIMEOUT=8
+  # curl budget, in seconds. The hook file gives the command 10s and the route
+  # evaluates within 3s, so 8s leaves room for the network without ever letting
+  # Kiro's own timeout be what fails us open. Tests shorten it. Zero falls back to
+  # the default too: `curl --max-time 0` means NO timeout, which would hand the
+  # budget to Kiro's 10s. `-gt` also rejects a value too wide for the shell's int.
+  HOOK_TIMEOUT="${ROGUE_HOOK_TIMEOUT:-8}"
+  case "$HOOK_TIMEOUT" in ''|*[!0-9]*) HOOK_TIMEOUT=8 ;; esac
+  [ "$HOOK_TIMEOUT" -gt 0 ] 2>/dev/null || HOOK_TIMEOUT=8
+}
 
 # The 2.x engine sends no session_id in the body; it exposes KIRO_SESSION_ID in
 # the hook's environment instead. Copy it into the body under the field the 3.0
@@ -173,66 +175,56 @@ inject_session_id() {
   printf '%s%s"session_id":"%s"}' "$_pre" "$_sep" "$KIRO_SESSION_ID"
 }
 
-BODY="$(inject_session_id "$(cat)")"
+# Only a parsed root event can prove this is the duplicate agent-config hook.
+# Without a JSON runtime, send the event: duplicate telemetry beats a lost gate.
+body_event() {
+  if command -v jq >/dev/null 2>&1; then
+    printf '%s' "$1" | jq -r 'if type == "object" and (.hook_event_name | type) == "string" then .hook_event_name else empty end' 2>/dev/null
+  elif command -v node >/dev/null 2>&1; then
+    printf '%s' "$1" | node -e 'try { const b = JSON.parse(require("fs").readFileSync(0,"utf8")); if (b && typeof b.hook_event_name === "string") process.stdout.write(b.hook_event_name); } catch {}' 2>/dev/null
+  elif command -v python3 >/dev/null 2>&1; then
+    printf '%s' "$1" | python3 -c 'import json,sys; b=json.load(sys.stdin); e=b.get("hook_event_name") if isinstance(b,dict) else None; print(e if isinstance(e,str) else "")' 2>/dev/null
+  fi
+}
 
-# ── one copy per event on the 3.0 engine ─────────────────────────────────────
-# The 3.0 engine (the IDE runs the same one) loads the agent configs written
-# for 2.x AS WELL AS the hook file, so it would run this bridge twice per event:
-# from the hook file (PascalCase trigger) and from the agent hook (camelCase
-# trigger). The second copy gives itself away — a PascalCase hook_event_name in
-# the body of a hook installed under a camelCase trigger — and is dropped here,
-# before the heartbeat and the request: the hook-file copy carries the same
-# event to the same decision. The 2.x engine spells the body in camelCase, so
-# nothing is ever dropped there.
-body_event() { printf '%s' "$1" | sed -nE 's/.*"hook_event_name"[[:space:]]*:[[:space:]]*"([^"]*)".*/\1/p' | head -n1; }
-case "$EVENT_ARG" in
-  agentSpawn|userPromptSubmit|preToolUse|postToolUse|stop)
-    case "$(body_event "$BODY")" in
-      [[:upper:]]*) log "outcome=duplicate engine=3.0 trigger=$EVENT_ARG"; exit 0 ;;
-    esac ;;
-esac
+skip_duplicate() {
+  case "$EVENT_ARG" in
+    agentSpawn|userPromptSubmit|preToolUse|postToolUse|stop)
+      case "$(body_event "$BODY")" in
+        [[:upper:]]*) log "outcome=duplicate engine=3.0 trigger=$EVENT_ARG"; exit 0 ;;
+      esac ;;
+  esac
+}
 
-# ── presence heartbeat (SessionStart unthrottled, Stop throttled) ────────────
-# Fired from here rather than from a second hook entry so the installer writes
-# one command per event. heartbeat.sh takes the surface and the trigger, exactly
-# as the Antigravity one does; scripts/beacon.sh throttles the Stop trigger so a
-# per-turn spawn is not a per-turn request. DETACHED with every fd redirected —
-# Kiro is waiting on our exit code, and the child must not touch stdin.
-case "$EVENT" in
-  SessionStart|Stop)
-    if [ -r "${PLUGIN_ROOT}/scripts/heartbeat.sh" ]; then
-      ( nohup sh "${PLUGIN_ROOT}/scripts/heartbeat.sh" "$ROGUE_INSTALL_AGENT" "$EVENT" \
-          </dev/null >/dev/null 2>&1 & )
-    fi ;;
-esac
+maybe_heartbeat() {
+  case "$EVENT" in
+    SessionStart|Stop)
+      if [ -r "${PLUGIN_ROOT}/scripts/heartbeat.sh" ]; then
+        ( nohup sh "${PLUGIN_ROOT}/scripts/heartbeat.sh" "$ROGUE_INSTALL_AGENT" "$EVENT" \
+            </dev/null >/dev/null 2>&1 & )
+      fi ;;
+  esac
+}
 
-# Capture body + HTTP status. -w appends a final line "<code>"; on any transport
-# failure curl exits non-zero and the code is 000.
-RAW=$(printf '%s' "$BODY" | curl -sS -X POST "$URL" \
-  -H "x-rogue-api-key: $ROGUE_API_KEY" \
-  -H "x-rogue-event: $EVENT" \
-  -H "x-rogue-agent: $ROGUE_INSTALL_AGENT" \
-  -H "x-rogue-host: ${ROGUE_INSTALL_HOST:-unknown}" \
-  -H "x-rogue-version: ${ROGUE_INSTALL_VERSION:-unknown}" \
-  -H "x-rogue-actor-email: ${ROGUE_ACTOR_EMAIL:-}" \
-  -H "x-rogue-actor-name: ${ROGUE_ACTOR_NAME:-}" \
-  -H 'Content-Type: application/json' \
-  --data-binary @- --max-time "$HOOK_TIMEOUT" -w '\n%{http_code}' 2>/dev/null)
-RC=$?
-CODE=$(printf '%s' "$RAW" | tail -n1)
-RESP=$(printf '%s' "$RAW" | sed '$d')
+post_request() {
+  RAW=$(printf '%s' "$BODY" | curl -sS -X POST "$URL" \
+    -H "x-rogue-api-key: $ROGUE_API_KEY" \
+    -H "x-rogue-event: $EVENT" \
+    -H "x-rogue-agent: $ROGUE_INSTALL_AGENT" \
+    -H "x-rogue-host: ${ROGUE_INSTALL_HOST:-unknown}" \
+    -H "x-rogue-version: ${ROGUE_INSTALL_VERSION:-unknown}" \
+    -H "x-rogue-actor-email: ${ROGUE_ACTOR_EMAIL:-}" \
+    -H "x-rogue-actor-name: ${ROGUE_ACTOR_NAME:-}" \
+    -H 'Content-Type: application/json' \
+    --data-binary @- --max-time "$HOOK_TIMEOUT" -w '\n%{http_code}' 2>/dev/null)
+  RC=$?
+  CODE=$(printf '%s' "$RAW" | tail -n1)
+  RESP=$(printf '%s' "$RAW" | sed '$d')
+}
 
-# ONE log line per event: <outcome> [decision=block] http= rc= raw=
 finish() { log "outcome=$1${2:+ $2} http=$CODE rc=$RC raw=$(sanitize "$RESP" | head -c 400)"; }
 
-# Fail-open on transport error, any non-200, or an empty body.
-if [ "$RC" -ne 0 ] || [ "$CODE" != "200" ] || [ -z "$RESP" ]; then
-  finish allow
-  exit 0
-fi
 
-# STRICT shape match: the pair, not the substrings. An allow that carries
-# "block" as some other field's value must not trip this.
 is_block() { printf '%s' "$RESP" | grep -q '"decision"[[:space:]]*:[[:space:]]*"block"'; }
 
 # The reason is a JSON string. jq decodes it exactly; the fallback captures the
@@ -252,23 +244,48 @@ block_reason() {
   printf '%s' "$_r"
 }
 
-if is_block; then
-  case "$EVENT" in
-    PreToolUse)
-      finish block
-      block_reason >&2
-      printf '\n' >&2
-      exit 2 ;;
-    UserPromptSubmit)
-      finish block
-      printf '%s' "$RESP"
-      exit 0 ;;
-    *)
-      # Stop and every audit-only event: recorded, never enforced.
-      finish allow decision=block
-      exit 0 ;;
-  esac
-fi
+relay_decision() {
+  if [ "$RC" -ne 0 ] || [ "$CODE" != "200" ] || [ -z "$RESP" ]; then
+    finish allow
+    exit 0
+  fi
+
+  if is_block; then
+    case "$EVENT" in
+      PreToolUse)
+        finish block
+        block_reason >&2
+        printf '\n' >&2
+        exit 2 ;;
+      UserPromptSubmit)
+        finish block
+        printf '%s' "$RESP"
+        exit 0 ;;
+      *)
+        # Stop and every audit-only event: recorded, never enforced.
+        finish allow decision=block
+        exit 0 ;;
+    esac
+  fi
+
+  finish allow
+  exit 0
+}
+
+main() {
+  EVENT_ARG="${1:-}"
+  SURFACE_ARG="${2:-}"
+  locate_plugin_root
+  load_env
+  initialize_context
+  require_api_key
+  load_identity
+  resolve_request
+  BODY="$(inject_session_id "$(cat)")"
+  skip_duplicate
+  maybe_heartbeat
+  post_request
+  relay_decision
+}
 
-finish allow
-exit 0
+main "$@"
diff --git a/plugins/kiro/scripts/kiro-host.sh b/plugins/kiro/scripts/kiro-host.sh
new file mode 100755
index 0000000..ff9f28d
--- /dev/null
+++ b/plugins/kiro/scripts/kiro-host.sh
@@ -0,0 +1,91 @@
+#!/usr/bin/env bash
+# Sourceable. Resolves what the Kiro HOST itself reports about this install,
+# beside the plugin's own identity from install-id.sh:
+#
+#   ROGUE_KIRO_VERSION        the Kiro build the surface runs under ("unknown"
+#                             when unreadable). The CLI and Crew (which drives
+#                             kiro-cli) from `kiro-cli --version`; the IDE from
+#                             the app bundle, since the IDE has no CLI.
+#   ROGUE_KIRO_DEFAULT_AGENT  the CLI's `chat.defaultAgent`, empty when none is
+#                             set or the surface is not the CLI. On the 2.x
+#                             engine only agents carrying the Rogue hooks are
+#                             covered (ADR 0001), so a default that moved away
+#                             from `rogue` is an uncovered machine - status.sh
+#                             says so; the roster will once the backend stores
+#                             the field (README "Roster heartbeat").
+#
+# The caller sets SURFACE before sourcing, as for install-id.sh. heartbeat.sh
+# sends both values in its /hooks/status body and status.sh prints them.
+# Resolution never fails the caller: every probe is best-effort and quiet.
+#
+# rogue_kiro_status_body, defined below, is the ONE builder of that body: the
+# heartbeat and the status script both POST it, and the backend fingerprints a
+# roster row on host|actor|family|agent, so a second copy of the format string
+# is a second chance to disagree on a segment and open a second row for one
+# install.
+#
+# ROGUE_KIRO_APP overrides the IDE bundle path (default /Applications/Kiro.app)
+# so a test never reads the developer's real install.
+
+_rogue_semver() { grep -oE '[0-9]+\.[0-9]+\.[0-9]+' 2>/dev/null | head -n1; }
+
+rogue_kiro_cli_version() {
+  command -v kiro-cli >/dev/null 2>&1 || return 0
+  kiro-cli --version 2>/dev/null </dev/null | _rogue_semver
+}
+
+# `defaults` reads a binary plist too, which is what a shipped bundle carries;
+# the grep is the Linux path and the fallback when `defaults` is absent.
+rogue_kiro_ide_version() {
+  _plist="${ROGUE_KIRO_APP:-/Applications/Kiro.app}/Contents/Info.plist"
+  [ -r "$_plist" ] || return 0
+  _v=$(defaults read "${_plist%.plist}" CFBundleShortVersionString 2>/dev/null </dev/null | _rogue_semver)
+  [ -n "$_v" ] || _v=$(tr -d '\n' < "$_plist" 2>/dev/null \
+    | sed -nE 's/.*<key>CFBundleShortVersionString<\/key>[[:space:]]*<string>([^<]*)<\/string>.*/\1/p' | _rogue_semver)
+  printf '%s' "$_v"
+}
+
+# The real CLI prints the value quoted ("rogue"); both forms are stripped.
+rogue_kiro_default_agent() {
+  command -v kiro-cli >/dev/null 2>&1 || return 0
+  kiro-cli settings chat.defaultAgent 2>/dev/null </dev/null | head -n1 \
+    | tr -d '\r' | sed -e 's/^[[:space:]]*"\{0,1\}//' -e 's/"\{0,1\}[[:space:]]*$//'
+}
+
+case "${SURFACE:-kiro_cli}" in
+  kiro_ide) ROGUE_KIRO_VERSION=$(rogue_kiro_ide_version); ROGUE_KIRO_DEFAULT_AGENT="" ;;
+  kiro_cli) ROGUE_KIRO_VERSION=$(rogue_kiro_cli_version); ROGUE_KIRO_DEFAULT_AGENT=$(rogue_kiro_default_agent) ;;
+  *)        ROGUE_KIRO_VERSION=$(rogue_kiro_cli_version); ROGUE_KIRO_DEFAULT_AGENT="" ;;
+esac
+[ -n "$ROGUE_KIRO_VERSION" ] || ROGUE_KIRO_VERSION="unknown"
+
+export ROGUE_KIRO_VERSION ROGUE_KIRO_DEFAULT_AGENT
+
+_rogue_json_esc() {
+  # Encode bytes so trailing newlines survive and UTF-8 stays byte-identical.
+  printf '%s' "$1" | od -An -v -t u1 | LC_ALL=C awk '{
+    for (i = 1; i <= NF; i++) {
+      if ($i < 32) printf "\\u%04x", $i
+      else if ($i == 34 || $i == 92) printf "\\%c", $i
+      else printf "%c", $i
+    }
+  }'
+}
+
+# The /hooks/status body, from what actor.sh, install-id.sh and this file
+# resolved into the environment. `default_agent` is ABSENT, not empty, when the
+# CLI has none set or the surface is not the CLI: an absent field reads as
+# "not a CLI, or none set", which an empty string would blur.
+rogue_kiro_status_body() {
+  _extra=""
+  [ -n "${ROGUE_KIRO_DEFAULT_AGENT:-}" ] \
+    && _extra=$(printf ',"default_agent":"%s"' "$(_rogue_json_esc "$ROGUE_KIRO_DEFAULT_AGENT")")
+  printf '{"agent_family":"kiro","agent":"%s","version":"%s","agent_version":"%s","host":"%s","actor_email":"%s","actor_name":"%s"%s}' \
+    "$(_rogue_json_esc "${ROGUE_INSTALL_AGENT:-kiro_cli}")" \
+    "$(_rogue_json_esc "${ROGUE_INSTALL_VERSION:-unknown}")" \
+    "$(_rogue_json_esc "${ROGUE_KIRO_VERSION:-unknown}")" \
+    "$(_rogue_json_esc "${ROGUE_INSTALL_HOST:-unknown}")" \
+    "$(_rogue_json_esc "${ROGUE_ACTOR_EMAIL:-}")" \
+    "$(_rogue_json_esc "${ROGUE_ACTOR_NAME:-}")" \
+    "$_extra"
+}
diff --git a/plugins/kiro/scripts/ship-logs.ps1 b/plugins/kiro/scripts/ship-logs.ps1
index 6bbeec7..b375667 100644
--- a/plugins/kiro/scripts/ship-logs.ps1
+++ b/plugins/kiro/scripts/ship-logs.ps1
@@ -55,7 +55,7 @@ $ProgressPreference = 'SilentlyContinue'
 
 # ── constants ──────────────────────────────────────────────────────────────
 $SHIP_ENDPOINT_PATH = '/api/v1/hooks/logs'
-$KNOWN_LOG_SLUGS = @('claude', 'codex', 'cursor', 'gemini', 'copilot', 'antigravity')
+$KNOWN_LOG_SLUGS = @('claude', 'codex', 'cursor', 'gemini', 'copilot', 'antigravity', 'kiro')
 # Bytes scanned when fingerprinting a log's first line. NOT 200: a real log line is
 # timestamp + provider + event + up to 400 chars of `raw=`, i.e. commonly 500-700
 # bytes, so a 200-byte window would find no newline in a typical log's first line
@@ -329,6 +329,9 @@ $SHIP_ENV_VARS = @(
     'ROGUE_SHIP_ALL')
 
 function Import-ShipEnv {
+    $envLibrary = Join-Path $PluginRoot 'scripts/env-file.ps1'
+    if ($PSCommandPath) { $envLibrary = Join-Path (Split-Path -Parent $PSCommandPath) 'env-file.ps1' }
+    . ([scriptblock]::Create((Get-Content -Raw -LiteralPath $envLibrary)))
     $resolved = @{}
     $envFiles = @(
         (Join-Path $PluginRoot 'env'),
@@ -336,7 +339,7 @@ function Import-ShipEnv {
         (Join-Path (Get-UserHome) '.rogue-env'))
     foreach ($envFile in $envFiles) {
         if (-not $envFile -or -not (Test-Path -LiteralPath $envFile)) { continue }
-        foreach ($line in (Get-Content -LiteralPath $envFile)) {
+        foreach ($line in (Read-RogueEnvFile $envFile)) {
             if ($line -match '^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.*)$') {
                 $resolved[$Matches[1]] = ConvertFrom-ShellQuoted ($Matches[2].Trim())
             }
diff --git a/plugins/kiro/scripts/ship-logs.sh b/plugins/kiro/scripts/ship-logs.sh
index 1407878..ca5fbb1 100644
--- a/plugins/kiro/scripts/ship-logs.sh
+++ b/plugins/kiro/scripts/ship-logs.sh
@@ -54,7 +54,7 @@ set -u
 
 # ── constants ──────────────────────────────────────────────────────────────
 SHIP_ENDPOINT_PATH="/api/v1/hooks/logs"
-KNOWN_LOG_SLUGS="claude codex cursor gemini copilot antigravity"
+KNOWN_LOG_SLUGS="claude codex cursor gemini copilot antigravity kiro"
 # Bytes scanned when fingerprinting a log's first line. NOT the 200 an earlier
 # draft of the design doc specified: a real log line is timestamp + provider +
 # event + up to 400 chars of `raw=`, i.e. commonly 500-700 bytes, so a 200-byte
@@ -127,9 +127,10 @@ log() {
   # visible.
   debug "$*"
   [ -n "$SELF_LOG_FILE" ] || return 0
-  mkdir -p "$(dirname "$SELF_LOG_FILE")" 2>/dev/null
-  printf '%s provider=%s event=ShipLogs %s\n' \
-    "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$SHIPPER_SLUG" "$*" >> "$SELF_LOG_FILE" 2>/dev/null
+  ( umask 077
+    mkdir -p "$(dirname "$SELF_LOG_FILE")" 2>/dev/null
+    printf '%s provider=%s event=ShipLogs %s\n' \
+    "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$SHIPPER_SLUG" "$*" >> "$SELF_LOG_FILE" 2>/dev/null )
   return 0
 }
 
@@ -299,11 +300,13 @@ ROGUE_SHIP_MAX_BYTES ROGUE_SHIP_MAX_RUN_BYTES ROGUE_SHIP_MAX_LINE_BYTES
 ROGUE_SHIP_ALL'
 
 load_env() {
+  [ -r "$(dirname "$0")/env-file.sh" ] || return 0
+  . "$(dirname "$0")/env-file.sh"
   for _env_var_name in $SHIP_ENV_VARS; do
     eval "_process_env_$_env_var_name=\${$_env_var_name:-}"
   done
   for _env_file in "$PLUGIN_ROOT/env" /etc/rogue/env "$HOME/.rogue-env"; do
-    [ -n "$_env_file" ] && [ -r "$_env_file" ] && . "$_env_file" 2>/dev/null
+    rogue_source_env "$_env_file" 2>/dev/null
   done
   for _env_var_name in $SHIP_ENV_VARS; do
     eval "[ -n \"\${_process_env_$_env_var_name:-}\" ] && $_env_var_name=\$_process_env_$_env_var_name"
diff --git a/plugins/kiro/scripts/status.ps1 b/plugins/kiro/scripts/status.ps1
new file mode 100644
index 0000000..e95a366
--- /dev/null
+++ b/plugins/kiro/scripts/status.ps1
@@ -0,0 +1,222 @@
+# Rogue Security status for the Kiro plugin (Windows / PowerShell).
+# Usage: powershell -NoProfile -ExecutionPolicy Bypass -File "$env:USERPROFILE\.rogue\plugins\kiro\scripts\status.ps1"
+#
+# Native-Windows analogue of status.sh: credential sources, the API key check,
+# the installed surfaces and their Kiro builds, the hook wiring install.ps1
+# -Kiro wrote, the 2.x engine's default agent, and the hook log.
+#
+# The credential, actor, version and Kiro-host helpers are heartbeat.ps1's own,
+# loaded through its ROGUE_PS_LIB_ONLY seam (the one the test suites use) as a
+# scriptblock built from the file's text - never a path dot-source, which is
+# subject to ExecutionPolicy. The /hooks/status body is therefore the
+# heartbeat's, and the row it upserts is the heartbeat's row: the backend
+# fingerprints on host|actor|family|agent, so a second cascade here would
+# register a second row for the install being checked.
+#
+# Exit 0 when configured and the API answered 200; 1 otherwise.
+#
+# Test seam, as in heartbeat.ps1: with ROGUE_PS_LIB_ONLY set the file only
+# defines its functions, and a suite calls Invoke-Status itself with
+# Invoke-WebRequest stubbed and USERPROFILE pointed at a temp dir.
+param()
+
+$ErrorActionPreference = 'SilentlyContinue'
+$ProgressPreference = 'SilentlyContinue'
+
+$scriptsDir = Split-Path $PSCommandPath -Parent
+$saveLibOnly = $env:ROGUE_PS_LIB_ONLY
+$env:ROGUE_PS_LIB_ONLY = '1'
+. ([scriptblock]::Create((Get-Content -Raw -LiteralPath (Join-Path $scriptsDir 'heartbeat.ps1'))))
+$env:ROGUE_PS_LIB_ONLY = $saveLibOnly
+# Resolved HERE, from this file's own path, and never through the heartbeat's
+# Resolve-PluginRoot: that reads $PSCommandPath, which is empty inside functions
+# defined by a scriptblock built from text, so it would fall through to the
+# current directory and read plugin.json and the bundled env from wherever the
+# user happened to run the command.
+$script:pluginRoot = Split-Path $scriptsDir -Parent
+
+$hooksDir = Join-Path (Join-Path $env:USERPROFILE '.kiro') 'hooks'
+$configured = $false
+$haveCli = $false
+$httpCode = '000'
+$statusExit = 1
+
+function Write-Row { param([string]$Label, [string]$Value) Write-Output ('  {0,-38} {1}' -f $Label, $Value) }
+function Write-SurfaceRow { param([string]$Label, [string]$Value) Write-Output ('  {0,-12}{1}' -f $Label, $Value) }
+
+# -- credentials ---------------------------------------------------------------
+function Write-Credentials {
+    Write-Output 'Credentials:'
+    $bundled = Join-Path $script:pluginRoot 'env'
+    if (Test-Path -LiteralPath $bundled) { Write-Output "  $bundled  (plugin bundle)" }
+    if (Test-Path -LiteralPath 'C:\ProgramData\rogue\env') { Write-Output '  C:\ProgramData\rogue\env  (MDM)' }
+    $perUser = Join-Path $env:USERPROFILE '.rogue-env'
+    if (Test-Path -LiteralPath $perUser) { Write-Output "  $perUser  (per-user)" }
+    if ($script:apiKey) {
+        $script:configured = $true
+        $tail = $script:apiKey.Substring([Math]::Max(0, $script:apiKey.Length - 4))
+        Write-Output "  API key resolved: ...$tail"
+    } else {
+        Write-Output '  API key: not resolved - run install.ps1 -Kiro (managed users: contact your security admin)'
+    }
+}
+
+# -- surfaces ------------------------------------------------------------------
+function Get-KiroIdeRoot {
+    if ($env:ROGUE_KIRO_APP) { return $env:ROGUE_KIRO_APP }
+    if ($env:LOCALAPPDATA) { return (Join-Path $env:LOCALAPPDATA 'Programs\Kiro') }
+    return ''
+}
+
+function Write-Surfaces {
+    Write-Output 'Surfaces:'
+    if (Get-Command kiro-cli -ErrorAction SilentlyContinue) {
+        $script:haveCli = $true
+        $v = Get-KiroCliVersion; if (-not $v) { $v = 'unknown' }
+        Write-SurfaceRow 'kiro_cli' "kiro-cli $v"
+    } else {
+        Write-SurfaceRow 'kiro_cli' 'kiro-cli not found'
+    }
+    $ideRoot = Get-KiroIdeRoot
+    if ($ideRoot -and (Test-Path -LiteralPath $ideRoot)) {
+        $v = Get-KiroIdeVersion; if (-not $v) { $v = 'unknown' }
+        Write-SurfaceRow 'kiro_ide' "Kiro $v"
+    } else {
+        Write-SurfaceRow 'kiro_ide' 'Kiro IDE not found'
+    }
+    Write-SurfaceRow 'kiro_crew' 'macOS / Linux only (Crew imports *.sh wrappers)'
+}
+
+# -- hook wiring ---------------------------------------------------------------
+function Get-HookFileStatus {
+    $f = Join-Path $hooksDir 'rogue.json'
+    if (-not (Test-Path -LiteralPath $f)) { return 'MISSING - run install.ps1 -Kiro' }
+    $text = Get-Content -Raw -LiteralPath $f
+    $n = ([regex]::Matches($text, '"name":\s*"rogue-')).Count
+    $m = [regex]::Match($text, 'hook\.ps1[^ ]* [A-Za-z]+ (kiro_[a-z]+)')
+    $surface = 'unknown'; if ($m.Success) { $surface = $m.Groups[1].Value }
+    return "present ($n Rogue hooks, surface $surface)"
+}
+
+function Test-AgentCarriesHooks {
+    param([string]$Path)
+    if (-not (Test-Path -LiteralPath $Path)) { return $false }
+    return [bool]((Get-Content -Raw -LiteralPath $Path) -match '"rogue-preToolUse"')
+}
+
+function Get-HookedAgentCount {
+    $n = 0
+    $dirs = @((Join-Path (Join-Path $env:USERPROFILE '.kiro') 'agents'), (Join-Path (Get-Location).Path '.kiro\agents'))
+    $dirs = @($dirs | Where-Object { Test-Path -LiteralPath $_ } | ForEach-Object { (Resolve-Path -LiteralPath $_).ProviderPath } | Sort-Object -Unique)
+    foreach ($dir in $dirs) {
+        if (-not (Test-Path -LiteralPath $dir)) { continue }
+        foreach ($f in (Get-ChildItem -LiteralPath $dir -Filter *.json -File)) {
+            if (Test-AgentCarriesHooks $f.FullName) { $n++ }
+        }
+    }
+    return $n
+}
+
+function Get-DefaultAgentStatus {
+    if (-not $script:haveCli) { return '(kiro-cli not found)' }
+    $name = Get-KiroDefaultAgent
+    if (-not $name) { return "(none set) - plain 'kiro-cli chat' runs the built-in agent, which carries no hooks; run install.ps1 -Kiro" }
+    $home_ = Join-Path (Join-Path (Join-Path $env:USERPROFILE '.kiro') 'agents') "$name.json"
+    $ws = Join-Path (Get-Location).Path ".kiro\agents\$name.json"
+    if ((Test-AgentCarriesHooks $home_) -or (Test-AgentCarriesHooks $ws)) { return "$name - covered" }
+    return "$name - NOT covered: switch with 'kiro-cli agent set-default rogue' or re-run install.ps1 -Kiro"
+}
+
+function Write-Wiring {
+    Write-Output 'Hook wiring:'
+    Write-Row '~\.kiro\hooks\rogue.json' (Get-HookFileStatus)
+    Write-Row 'agent configs with Rogue hooks' "$(Get-HookedAgentCount) (~\.kiro\agents, .\.kiro\agents)"
+    Write-Row 'default agent (2.x engine)' (Get-DefaultAgentStatus)
+}
+
+# -- connection: the heartbeat's body (its Get-StatusBody), on the heartbeat's row --
+function Get-ConnectionBody {
+    # The CLI's row when kiro-cli is present, the IDE's otherwise: the surface the
+    # SessionStart heartbeat on this machine would report first.
+    $script:surface = 'kiro_ide'; if ($script:haveCli) { $script:surface = 'kiro_cli' }
+    Resolve-KiroHost
+    return (Get-StatusBody)
+}
+
+function Write-HttpExplanation {
+    param([string]$Code, [string]$Body)
+    switch ($Code) {
+        '200' {
+            $org = [regex]::Match($Body, '"id"\s*:\s*"([^"]*)"')
+            if ($org.Success) { Write-Output "  organization: $($org.Groups[1].Value)" }
+            $running = [regex]::Match($Body, '"version"\s*:\s*"([^"]*)"')
+            $latest  = [regex]::Match($Body, '"latest_version"\s*:\s*"([^"]*)"')
+            $rv = 'unknown'; if ($running.Success) { $rv = $running.Groups[1].Value }
+            $lv = 'unknown'; if ($latest.Success)  { $lv = $latest.Groups[1].Value }
+            $upd = 'up to date'; $hint = ''
+            if ($Body -match '"update_available":true') { $upd = 'update available'; $hint = ' - re-run install.ps1 -Kiro to upgrade' }
+            Write-Output "  plugin $rv (latest $lv, $upd)$hint"
+        }
+        '401' { Write-Output '  the API key is invalid - re-run install.ps1 -Kiro with a key from the dashboard' }
+        '000' { Write-Output "  network: $($script:baseUrl) did not answer (proxy or firewall?)" }
+        default { Write-Output "  unexpected response: $Body" }
+    }
+}
+
+function Write-Connection {
+    Write-Output 'Connection:'
+    if (-not $script:configured) { Write-Output '  skipped - no API key'; return }
+    $body = ''
+    try {
+        $bytes = [System.Text.Encoding]::UTF8.GetBytes((Get-ConnectionBody))
+        $resp = Invoke-WebRequest -Uri "$($script:baseUrl)/api/v1/hooks/status" -Method Post `
+            -Headers @{ 'x-rogue-api-key' = $script:apiKey } -ContentType 'application/json' `
+            -Body $bytes -UseBasicParsing -TimeoutSec 10 -ErrorAction Stop
+        $script:httpCode = [string]$resp.StatusCode
+        $body = [string]$resp.Content
+    } catch {
+        $script:httpCode = '000'
+        $r = $_.Exception.Response
+        if ($r) { try { $script:httpCode = ([int]$r.StatusCode).ToString('000') } catch {} }
+    }
+    Write-Output "  POST /api/v1/hooks/status -> HTTP $($script:httpCode)"
+    Write-HttpExplanation $script:httpCode $body
+}
+
+# -- the hook log, honouring the dispatcher's relocation knobs ------------------
+function Get-LogPath {
+    $file = $script:creds['ROGUE_LOG_FILE']; $dir = $script:creds['ROGUE_LOG_DIR']
+    if ($env:ROGUE_LOG_FILE) { $file = $env:ROGUE_LOG_FILE }
+    if ($env:ROGUE_LOG_DIR)  { $dir  = $env:ROGUE_LOG_DIR }
+    if ($file) { return $file }
+    if (-not $dir) { $dir = Join-Path (Join-Path $env:USERPROFILE '.rogue') 'logs' }
+    return (Join-Path $dir 'kiro.log')
+}
+
+function Write-Log {
+    $log = Get-LogPath
+    Write-Output "Log: $log"
+    if ((Test-Path -LiteralPath $log) -and (Get-Item -LiteralPath $log).Length -gt 0) {
+        Get-Content -Tail 20 -LiteralPath $log | ForEach-Object { Write-Output "  $_" }
+    } else {
+        Write-Output '  (no hook log yet)'
+    }
+}
+
+function Invoke-Status {
+    Write-Output 'Rogue Security status (Kiro)'
+    Initialize-Tls
+    Import-Credentials
+    Resolve-BaseUrl
+    Resolve-Actor
+    Resolve-Version
+    Write-Credentials
+    Write-Surfaces
+    Write-Wiring
+    Write-Connection
+    Write-Log
+    $script:statusExit = 1
+    if ($script:configured -and $script:httpCode -eq '200') { $script:statusExit = 0 }
+}
+
+if (-not $env:ROGUE_PS_LIB_ONLY) { Invoke-Status; exit $script:statusExit }
diff --git a/plugins/kiro/scripts/status.sh b/plugins/kiro/scripts/status.sh
new file mode 100755
index 0000000..62b84fc
--- /dev/null
+++ b/plugins/kiro/scripts/status.sh
@@ -0,0 +1,191 @@
+#!/bin/sh
+# Rogue Security status for the Kiro plugin (IDE, CLI, Crew).
+# Usage: sh ~/.rogue/plugins/kiro/scripts/status.sh
+#
+# Kiro has no slash-command surface for a /rogue:status skill, so the status
+# command is this script: the one diagnostic path support has on a Kiro
+# machine. It reports what the other plugins' status skills report -
+# credential sources, the API key check, the hook log - plus what only Kiro
+# needs: which surfaces are installed, whether the hook wiring install.sh
+# wrote is still there, and which agent the 2.x engine runs by default (only
+# agents carrying the Rogue hooks are covered there, ADR 0001).
+#
+# The connection check POSTs /hooks/status, which upserts a roster row
+# fingerprinted on host|actor|family|agent - so the body is the heartbeat's:
+# built by the one rogue_kiro_status_body in kiro-host.sh from the same
+# actor.sh / install-id.sh / kiro-host.sh resolution, or this run would
+# register a second row for the install it is checking.
+#
+# Exit 0 when configured and the API answered 200; 1 otherwise, so a managed
+# rollout can verify a machine from a script.
+set -u
+
+PLUGIN_ROOT="$(CDPATH= cd -- "$(dirname -- "$0")/.." 2>/dev/null && pwd)"
+[ -n "$PLUGIN_ROOT" ] || PLUGIN_ROOT="${KIRO_PLUGIN_ROOT:-.}"
+KIRO_HOOKS_DIR="$HOME/.kiro/hooks"
+KIRO_APP="${ROGUE_KIRO_APP:-/Applications/Kiro.app}"
+
+CONFIGURED=0
+HAVE_CLI=0
+HAVE_IDE=0
+HTTP_CODE=""
+
+row() { printf '  %-38s %s\n' "$1" "$2"; }
+surface_row() { printf '  %-12s%s\n' "$1" "$2"; }
+# The first "<key>": "<string>" value in a JSON body, without jq.
+json_str() { printf '%s' "$2" | sed -nE 's/.*"'"$1"'"[[:space:]]*:[[:space:]]*"([^"]*)".*/\1/p' | head -n1; }
+
+# ── credentials (same precedence as hook.sh: bundled → MDM → per-user) ──────
+load_env() {
+  [ -r "${PLUGIN_ROOT}/scripts/env-file.sh" ] || return 0
+  . "${PLUGIN_ROOT}/scripts/env-file.sh"
+  rogue_source_env "${PLUGIN_ROOT}/env"
+  rogue_source_env /etc/rogue/env
+  rogue_source_env "$HOME/.rogue-env"
+  ROGUE_BASE_URL="${ROGUE_BASE_URL:-https://api.rogue.security}"
+  ROGUE_BASE_URL="${ROGUE_BASE_URL%/}"
+  return 0
+}
+
+report_credentials() {
+  echo "Credentials:"
+  [ -r "${PLUGIN_ROOT}/env" ] && echo "  ${PLUGIN_ROOT}/env  (plugin bundle)"
+  [ -r /etc/rogue/env ]       && echo "  /etc/rogue/env  (MDM)"
+  [ -r "$HOME/.rogue-env" ]   && echo "  $HOME/.rogue-env  (per-user)"
+  if [ -n "${ROGUE_API_KEY:-}" ]; then
+    CONFIGURED=1
+    echo "  API key resolved: ...$(printf '%s' "$ROGUE_API_KEY" | tail -c 4)"
+  else
+    echo "  API key: not resolved - run install.sh --kiro (managed users: contact your security admin)"
+  fi
+}
+
+# ── surfaces: what is installed, and which Kiro build each runs ──────────────
+report_surfaces() {
+  echo "Surfaces:"
+  if command -v kiro-cli >/dev/null 2>&1; then
+    HAVE_CLI=1
+    SURFACE=kiro_cli; . "${PLUGIN_ROOT}/scripts/kiro-host.sh"
+    surface_row kiro_cli "kiro-cli $ROGUE_KIRO_VERSION"
+  else
+    surface_row kiro_cli "kiro-cli not found"
+  fi
+  if [ -d "$KIRO_APP" ]; then
+    HAVE_IDE=1
+    SURFACE=kiro_ide; . "${PLUGIN_ROOT}/scripts/kiro-host.sh"
+    surface_row kiro_ide "Kiro.app $ROGUE_KIRO_VERSION"
+  else
+    surface_row kiro_ide "Kiro.app not found"
+  fi
+  surface_row kiro_crew "via kiro-cli, hooked by the Crew wrappers below"
+}
+
+# ── hook wiring: everything install.sh --kiro writes outside the plugin ──────
+hook_file_status() {
+  f="$KIRO_HOOKS_DIR/rogue.json"
+  [ -f "$f" ] || { echo "MISSING - run install.sh --kiro"; return; }
+  n=$(grep -c '"name": *"rogue-' "$f" 2>/dev/null)
+  s=$(grep -oE 'hook\.sh[\\"]* [A-Za-z]+ kiro_[a-z]+' "$f" 2>/dev/null | head -n1 | awk '{print $NF}')
+  echo "present (${n:-0} Rogue hooks, surface ${s:-unknown})"
+}
+
+crew_wrapper_status() {
+  pre="$KIRO_HOOKS_DIR/rogue-crew-pre.sh"; post="$KIRO_HOOKS_DIR/rogue-crew-post.sh"
+  [ -f "$pre" ] && [ -f "$post" ] || { echo "MISSING - run install.sh --kiro"; return; }
+  [ -x "$pre" ] && [ -x "$post" ] && { echo "present, executable"; return; }
+  echo "present, NOT executable - chmod +x $KIRO_HOOKS_DIR/rogue-crew-*.sh"
+}
+
+agent_carries_hooks() { grep -q '"rogue-preToolUse"' "$1" 2>/dev/null; }
+
+hooked_agent_count() {
+  n=0
+  seen=""
+  for dir in "$HOME/.kiro/agents" ./.kiro/agents; do
+    [ -d "$dir" ] || continue
+    resolved=$(CDPATH= cd -- "$dir" && pwd -P) || continue
+    [ "$resolved" = "$seen" ] && continue
+    seen="$resolved"
+    for f in "$resolved"/*.json; do
+      agent_carries_hooks "$f" && n=$((n + 1))
+    done
+  done
+  echo "$n"
+}
+
+default_agent_status() {
+  [ "$HAVE_CLI" = 1 ] || { echo "(kiro-cli not found)"; return; }
+  SURFACE=kiro_cli; . "${PLUGIN_ROOT}/scripts/kiro-host.sh"
+  name="$ROGUE_KIRO_DEFAULT_AGENT"
+  [ -n "$name" ] || { echo "(none set) - plain 'kiro-cli chat' runs the built-in agent, which carries no hooks; run install.sh --kiro"; return; }
+  if agent_carries_hooks "$HOME/.kiro/agents/$name.json" || agent_carries_hooks "./.kiro/agents/$name.json"; then
+    echo "$name - covered"
+  else
+    echo "$name - NOT covered: switch with 'kiro-cli agent set-default rogue' or re-run install.sh --kiro"
+  fi
+}
+
+report_wiring() {
+  echo "Hook wiring:"
+  row "~/.kiro/hooks/rogue.json" "$(hook_file_status)"
+  row "~/.kiro/hooks/rogue-crew-{pre,post}.sh" "$(crew_wrapper_status)"
+  row "agent configs with Rogue hooks" "$(hooked_agent_count) (~/.kiro/agents, ./.kiro/agents)"
+  row "default agent (2.x engine)" "$(default_agent_status)"
+}
+
+# ── connection: the heartbeat's own body, so it lands on the heartbeat's row ─
+status_body() {
+  [ -r "${PLUGIN_ROOT}/scripts/actor.sh" ] && . "${PLUGIN_ROOT}/scripts/actor.sh"
+  # The CLI's row when kiro-cli is present, the IDE's otherwise: the surface
+  # the SessionStart heartbeat on this machine would report first.
+  SURFACE=kiro_ide; [ "$HAVE_CLI" = 1 ] && SURFACE=kiro_cli
+  . "${PLUGIN_ROOT}/scripts/install-id.sh"
+  . "${PLUGIN_ROOT}/scripts/kiro-host.sh"
+  rogue_kiro_status_body
+}
+
+explain_http() {
+  case "$1" in
+    200) echo "  organization: $(json_str id "$2")"
+         latest=$(json_str latest_version "$2")
+         upd="up to date"; hint=""
+         case "$2" in *'"update_available":true'*) upd="update available"; hint=" - re-run install.sh --kiro to upgrade" ;; esac
+         echo "  plugin $(json_str version "$2") (latest ${latest:-unknown}, $upd)$hint" ;;
+    401) echo "  the API key is invalid - re-run install.sh --kiro with a key from the dashboard" ;;
+    000) echo "  network: ${ROGUE_BASE_URL#*://} did not answer (proxy or firewall?)" ;;
+    *)   echo "  unexpected response: $(printf '%s' "$2" | head -c 200)" ;;
+  esac
+}
+
+report_connection() {
+  echo "Connection:"
+  [ "$CONFIGURED" = 1 ] || { echo "  skipped - no API key"; return; }
+  command -v curl >/dev/null 2>&1 || { echo "  skipped - curl not found"; return; }
+  raw=$(status_body | curl -sS -X POST "$ROGUE_BASE_URL/api/v1/hooks/status" \
+    -H "x-rogue-api-key: $ROGUE_API_KEY" -H 'Content-Type: application/json' \
+    --data-binary @- --max-time 10 -w '\n%{http_code}' 2>/dev/null)
+  HTTP_CODE=$(printf '%s' "$raw" | tail -n1)
+  body=$(printf '%s' "$raw" | sed '$d')
+  echo "  POST /api/v1/hooks/status -> HTTP ${HTTP_CODE:-000}"
+  explain_http "${HTTP_CODE:-000}" "$body"
+}
+
+# ── the hook log, honouring the dispatcher's relocation knobs ────────────────
+report_log() {
+  log="${ROGUE_LOG_FILE:-${ROGUE_LOG_DIR:-$HOME/.rogue/logs}/kiro.log}"
+  echo "Log: $log"
+  [ -s "$log" ] && tail -n 20 "$log" | sed 's/^/  /' || echo "  (no hook log yet)"
+}
+
+main() {
+  echo "Rogue Security status (Kiro)"
+  load_env
+  report_credentials
+  report_surfaces
+  report_wiring
+  report_connection
+  report_log
+  [ "$CONFIGURED" = 1 ] && [ "$HTTP_CODE" = 200 ]
+}
+
+main "$@"
diff --git a/plugins/rogue/scripts/env-file.ps1 b/plugins/rogue/scripts/env-file.ps1
index 3e6864a..f0155c9 100644
--- a/plugins/rogue/scripts/env-file.ps1
+++ b/plugins/rogue/scripts/env-file.ps1
@@ -1,3 +1,44 @@
+# A Windows PowerShell child can inherit PowerShell 7's PSModulePath. Load
+# this engine's ACL cmdlets explicitly instead of resolving an incompatible module.
+if ($PSVersionTable.PSVersion.Major -eq 5) {
+    Import-Module (Join-Path $PSHOME 'Modules\Microsoft.PowerShell.Security\Microsoft.PowerShell.Security.psd1') -ErrorAction Stop
+}
+
+# Reject files writable by identities other than the current user or Windows
+# administrators/system. System-wide configuration cannot be user-owned.
+function Test-RogueEnvFile {
+    param([string]$Path, [switch]$System)
+    try {
+        if (-not (Test-Path -LiteralPath $Path -PathType Leaf)) { return $false }
+        if ($PSVersionTable.PSVersion.Major -ge 6 -and -not $IsWindows) {
+            $info = & stat -Lc '%u %a' $Path 2>$null
+            if ($LASTEXITCODE -ne 0) { $info = & stat -Lf '%u %Lp' $Path 2>$null }
+            if ($LASTEXITCODE -ne 0 -or $info -notmatch '^(\d+) ([0-7]+)$') { return $false }
+            $ownerId = $Matches[1]; $mode = [Convert]::ToInt32($Matches[2], 8)
+            return (($ownerId -eq '0' -or (-not $System -and $ownerId -eq (& id -u))) -and ($mode -band 18) -eq 0)
+        }
+        $acl = Get-Acl -LiteralPath $Path -ErrorAction Stop
+        $user = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value
+        $admins = @('S-1-5-18', 'S-1-5-32-544')
+        $trusted = @($admins) + $user
+        $owner = $acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value
+        if ($owner -notin $trusted -or ($System -and $owner -notin $admins)) { return $false }
+        $write = [System.Security.AccessControl.FileSystemRights]'Write, Delete, ChangePermissions, TakeOwnership, DeleteSubdirectoriesAndFiles'
+        foreach ($rule in $acl.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier])) {
+            if ($rule.AccessControlType -eq 'Allow' -and ($rule.FileSystemRights -band $write) -and
+                $rule.IdentityReference.Value -notin $trusted) { return $false }
+        }
+        return $true
+    } catch { return $false }
+}
+
+function Read-RogueEnvFile {
+    param([string]$Path)
+    if (Test-RogueEnvFile $Path -System:($Path -eq 'C:\ProgramData\rogue\env')) {
+        Get-Content -LiteralPath $Path -Encoding UTF8 -ErrorAction SilentlyContinue
+    }
+}
+
 function Format-RogueEnvValue {
     param([string]$Value)
     return "'" + $Value.Replace("'", "'\''") + "'"
@@ -7,16 +48,18 @@ function Protect-RogueEnvFile {
     param([string]$Path)
     $script:RogueEnvProtectError = ''
     try {
-        $acl = Get-Acl $Path
+        $acl = Get-Acl -LiteralPath $Path -ErrorAction Stop
         $acl.SetAccessRuleProtection($true, $false)
-        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule(
-            [System.Security.Principal.WindowsIdentity]::GetCurrent().Name,
-            'FullControl', 'Allow')
+        $rule = [System.Security.AccessControl.FileSystemAccessRule]::new(
+            [System.Security.Principal.WindowsIdentity]::GetCurrent().User,
+            [System.Security.AccessControl.FileSystemRights]::FullControl,
+            [System.Security.AccessControl.AccessControlType]::Allow)
         $acl.SetAccessRule($rule)
-        Set-Acl $Path $acl
+        Set-Acl -LiteralPath $Path -AclObject $acl -ErrorAction Stop
         return $true
     } catch {
         $script:RogueEnvProtectError = $_.Exception.Message
+        Write-Warning "Could not restrict credential file permissions: $script:RogueEnvProtectError"
         return $false
     }
 }
diff --git a/plugins/rogue/scripts/env-file.sh b/plugins/rogue/scripts/env-file.sh
index 5319fd7..eb1b839 100644
--- a/plugins/rogue/scripts/env-file.sh
+++ b/plugins/rogue/scripts/env-file.sh
@@ -1,5 +1,24 @@
 #!/usr/bin/env sh
 
+# Only the current user or root may supply executable configuration. System
+# configuration must belong to root; neither group nor other may write it.
+rogue_env_is_trusted() (
+  [ -f "$1" ] && [ -r "$1" ] || exit 1
+  info=$(stat -Lc '%u %a' "$1" 2>/dev/null) || info=$(stat -Lf '%u %Lp' "$1" 2>/dev/null) || exit 1
+  owner=${info%% *}; mode=${info#* }
+  case "$owner:$mode" in *[!0-9:]*|:*) exit 1 ;; esac
+  case "$1:${2:-0}" in /etc/rogue/env:*|*:1) [ "$owner" = 0 ] || exit 1 ;; esac
+  [ "$owner" = 0 ] || [ "$owner" = "$(id -u)" ] || exit 1
+  [ "$((0$mode & 022))" = 0 ]
+)
+
+rogue_source_env() {
+  if rogue_env_is_trusted "$1" "${2:-0}"; then
+    . "$1"
+  fi
+  return 0
+}
+
 rogue_env_quote() {
   printf "'%s'" "$(printf '%s' "$1" | sed "s/'/'\\\\''/g")"
 }
diff --git a/plugins/rogue/scripts/ship-logs.ps1 b/plugins/rogue/scripts/ship-logs.ps1
index 6bbeec7..b375667 100644
--- a/plugins/rogue/scripts/ship-logs.ps1
+++ b/plugins/rogue/scripts/ship-logs.ps1
@@ -55,7 +55,7 @@ $ProgressPreference = 'SilentlyContinue'
 
 # ── constants ──────────────────────────────────────────────────────────────
 $SHIP_ENDPOINT_PATH = '/api/v1/hooks/logs'
-$KNOWN_LOG_SLUGS = @('claude', 'codex', 'cursor', 'gemini', 'copilot', 'antigravity')
+$KNOWN_LOG_SLUGS = @('claude', 'codex', 'cursor', 'gemini', 'copilot', 'antigravity', 'kiro')
 # Bytes scanned when fingerprinting a log's first line. NOT 200: a real log line is
 # timestamp + provider + event + up to 400 chars of `raw=`, i.e. commonly 500-700
 # bytes, so a 200-byte window would find no newline in a typical log's first line
@@ -329,6 +329,9 @@ $SHIP_ENV_VARS = @(
     'ROGUE_SHIP_ALL')
 
 function Import-ShipEnv {
+    $envLibrary = Join-Path $PluginRoot 'scripts/env-file.ps1'
+    if ($PSCommandPath) { $envLibrary = Join-Path (Split-Path -Parent $PSCommandPath) 'env-file.ps1' }
+    . ([scriptblock]::Create((Get-Content -Raw -LiteralPath $envLibrary)))
     $resolved = @{}
     $envFiles = @(
         (Join-Path $PluginRoot 'env'),
@@ -336,7 +339,7 @@ function Import-ShipEnv {
         (Join-Path (Get-UserHome) '.rogue-env'))
     foreach ($envFile in $envFiles) {
         if (-not $envFile -or -not (Test-Path -LiteralPath $envFile)) { continue }
-        foreach ($line in (Get-Content -LiteralPath $envFile)) {
+        foreach ($line in (Read-RogueEnvFile $envFile)) {
             if ($line -match '^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.*)$') {
                 $resolved[$Matches[1]] = ConvertFrom-ShellQuoted ($Matches[2].Trim())
             }
diff --git a/plugins/rogue/scripts/ship-logs.sh b/plugins/rogue/scripts/ship-logs.sh
index 1407878..ca5fbb1 100644
--- a/plugins/rogue/scripts/ship-logs.sh
+++ b/plugins/rogue/scripts/ship-logs.sh
@@ -54,7 +54,7 @@ set -u
 
 # ── constants ──────────────────────────────────────────────────────────────
 SHIP_ENDPOINT_PATH="/api/v1/hooks/logs"
-KNOWN_LOG_SLUGS="claude codex cursor gemini copilot antigravity"
+KNOWN_LOG_SLUGS="claude codex cursor gemini copilot antigravity kiro"
 # Bytes scanned when fingerprinting a log's first line. NOT the 200 an earlier
 # draft of the design doc specified: a real log line is timestamp + provider +
 # event + up to 400 chars of `raw=`, i.e. commonly 500-700 bytes, so a 200-byte
@@ -127,9 +127,10 @@ log() {
   # visible.
   debug "$*"
   [ -n "$SELF_LOG_FILE" ] || return 0
-  mkdir -p "$(dirname "$SELF_LOG_FILE")" 2>/dev/null
-  printf '%s provider=%s event=ShipLogs %s\n' \
-    "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$SHIPPER_SLUG" "$*" >> "$SELF_LOG_FILE" 2>/dev/null
+  ( umask 077
+    mkdir -p "$(dirname "$SELF_LOG_FILE")" 2>/dev/null
+    printf '%s provider=%s event=ShipLogs %s\n' \
+    "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$SHIPPER_SLUG" "$*" >> "$SELF_LOG_FILE" 2>/dev/null )
   return 0
 }
 
@@ -299,11 +300,13 @@ ROGUE_SHIP_MAX_BYTES ROGUE_SHIP_MAX_RUN_BYTES ROGUE_SHIP_MAX_LINE_BYTES
 ROGUE_SHIP_ALL'
 
 load_env() {
+  [ -r "$(dirname "$0")/env-file.sh" ] || return 0
+  . "$(dirname "$0")/env-file.sh"
   for _env_var_name in $SHIP_ENV_VARS; do
     eval "_process_env_$_env_var_name=\${$_env_var_name:-}"
   done
   for _env_file in "$PLUGIN_ROOT/env" /etc/rogue/env "$HOME/.rogue-env"; do
-    [ -n "$_env_file" ] && [ -r "$_env_file" ] && . "$_env_file" 2>/dev/null
+    rogue_source_env "$_env_file" 2>/dev/null
   done
   for _env_var_name in $SHIP_ENV_VARS; do
     eval "[ -n \"\${_process_env_$_env_var_name:-}\" ] && $_env_var_name=\$_process_env_$_env_var_name"
diff --git a/scripts/plugin-versions.sh b/scripts/plugin-versions.sh
index d693ffb..1bb79ce 100755
--- a/scripts/plugin-versions.sh
+++ b/scripts/plugin-versions.sh
@@ -75,7 +75,16 @@ CURSOR_V=$(read_json_version "plugins/cursor/.cursor-plugin/plugin.json")
 COPILOT_V=$(read_json_version "plugins/copilot/plugin.json")
 GEMINI_V=$(read_json_version "plugins/gemini/gemini-extension.json")
 ANTIGRAVITY_V=$(read_plain_version "plugins/antigravity/VERSION")
+# Kiro carries both: plugin.json is the version of record (install-id.sh,
+# hook.ps1 and heartbeat.ps1 all read it there) and a bare VERSION file beside
+# it for operators and the release page. Two files is one drift waiting to
+# happen, so this refuses to publish while they disagree rather than pick one.
 KIRO_V=$(read_json_version "plugins/kiro/plugin.json")
+KIRO_FILE_V=$(read_plain_version "plugins/kiro/VERSION")
+if [ "$KIRO_V" != "$KIRO_FILE_V" ]; then
+  echo "✗ plugins/kiro: plugin.json says $KIRO_V but VERSION says $KIRO_FILE_V" >&2
+  exit 1
+fi
 
 cat <<JSON
 {
diff --git a/scripts/shared/env-file.ps1 b/scripts/shared/env-file.ps1
index 3e6864a..f0155c9 100644
--- a/scripts/shared/env-file.ps1
+++ b/scripts/shared/env-file.ps1
@@ -1,3 +1,44 @@
+# A Windows PowerShell child can inherit PowerShell 7's PSModulePath. Load
+# this engine's ACL cmdlets explicitly instead of resolving an incompatible module.
+if ($PSVersionTable.PSVersion.Major -eq 5) {
+    Import-Module (Join-Path $PSHOME 'Modules\Microsoft.PowerShell.Security\Microsoft.PowerShell.Security.psd1') -ErrorAction Stop
+}
+
+# Reject files writable by identities other than the current user or Windows
+# administrators/system. System-wide configuration cannot be user-owned.
+function Test-RogueEnvFile {
+    param([string]$Path, [switch]$System)
+    try {
+        if (-not (Test-Path -LiteralPath $Path -PathType Leaf)) { return $false }
+        if ($PSVersionTable.PSVersion.Major -ge 6 -and -not $IsWindows) {
+            $info = & stat -Lc '%u %a' $Path 2>$null
+            if ($LASTEXITCODE -ne 0) { $info = & stat -Lf '%u %Lp' $Path 2>$null }
+            if ($LASTEXITCODE -ne 0 -or $info -notmatch '^(\d+) ([0-7]+)$') { return $false }
+            $ownerId = $Matches[1]; $mode = [Convert]::ToInt32($Matches[2], 8)
+            return (($ownerId -eq '0' -or (-not $System -and $ownerId -eq (& id -u))) -and ($mode -band 18) -eq 0)
+        }
+        $acl = Get-Acl -LiteralPath $Path -ErrorAction Stop
+        $user = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value
+        $admins = @('S-1-5-18', 'S-1-5-32-544')
+        $trusted = @($admins) + $user
+        $owner = $acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value
+        if ($owner -notin $trusted -or ($System -and $owner -notin $admins)) { return $false }
+        $write = [System.Security.AccessControl.FileSystemRights]'Write, Delete, ChangePermissions, TakeOwnership, DeleteSubdirectoriesAndFiles'
+        foreach ($rule in $acl.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier])) {
+            if ($rule.AccessControlType -eq 'Allow' -and ($rule.FileSystemRights -band $write) -and
+                $rule.IdentityReference.Value -notin $trusted) { return $false }
+        }
+        return $true
+    } catch { return $false }
+}
+
+function Read-RogueEnvFile {
+    param([string]$Path)
+    if (Test-RogueEnvFile $Path -System:($Path -eq 'C:\ProgramData\rogue\env')) {
+        Get-Content -LiteralPath $Path -Encoding UTF8 -ErrorAction SilentlyContinue
+    }
+}
+
 function Format-RogueEnvValue {
     param([string]$Value)
     return "'" + $Value.Replace("'", "'\''") + "'"
@@ -7,16 +48,18 @@ function Protect-RogueEnvFile {
     param([string]$Path)
     $script:RogueEnvProtectError = ''
     try {
-        $acl = Get-Acl $Path
+        $acl = Get-Acl -LiteralPath $Path -ErrorAction Stop
         $acl.SetAccessRuleProtection($true, $false)
-        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule(
-            [System.Security.Principal.WindowsIdentity]::GetCurrent().Name,
-            'FullControl', 'Allow')
+        $rule = [System.Security.AccessControl.FileSystemAccessRule]::new(
+            [System.Security.Principal.WindowsIdentity]::GetCurrent().User,
+            [System.Security.AccessControl.FileSystemRights]::FullControl,
+            [System.Security.AccessControl.AccessControlType]::Allow)
         $acl.SetAccessRule($rule)
-        Set-Acl $Path $acl
+        Set-Acl -LiteralPath $Path -AclObject $acl -ErrorAction Stop
         return $true
     } catch {
         $script:RogueEnvProtectError = $_.Exception.Message
+        Write-Warning "Could not restrict credential file permissions: $script:RogueEnvProtectError"
         return $false
     }
 }
diff --git a/scripts/shared/env-file.sh b/scripts/shared/env-file.sh
index 5319fd7..eb1b839 100644
--- a/scripts/shared/env-file.sh
+++ b/scripts/shared/env-file.sh
@@ -1,5 +1,24 @@
 #!/usr/bin/env sh
 
+# Only the current user or root may supply executable configuration. System
+# configuration must belong to root; neither group nor other may write it.
+rogue_env_is_trusted() (
+  [ -f "$1" ] && [ -r "$1" ] || exit 1
+  info=$(stat -Lc '%u %a' "$1" 2>/dev/null) || info=$(stat -Lf '%u %Lp' "$1" 2>/dev/null) || exit 1
+  owner=${info%% *}; mode=${info#* }
+  case "$owner:$mode" in *[!0-9:]*|:*) exit 1 ;; esac
+  case "$1:${2:-0}" in /etc/rogue/env:*|*:1) [ "$owner" = 0 ] || exit 1 ;; esac
+  [ "$owner" = 0 ] || [ "$owner" = "$(id -u)" ] || exit 1
+  [ "$((0$mode & 022))" = 0 ]
+)
+
+rogue_source_env() {
+  if rogue_env_is_trusted "$1" "${2:-0}"; then
+    . "$1"
+  fi
+  return 0
+}
+
 rogue_env_quote() {
   printf "'%s'" "$(printf '%s' "$1" | sed "s/'/'\\\\''/g")"
 }
diff --git a/scripts/shared/ship-logs.ps1 b/scripts/shared/ship-logs.ps1
index 6bbeec7..b375667 100644
--- a/scripts/shared/ship-logs.ps1
+++ b/scripts/shared/ship-logs.ps1
@@ -55,7 +55,7 @@ $ProgressPreference = 'SilentlyContinue'
 
 # ── constants ──────────────────────────────────────────────────────────────
 $SHIP_ENDPOINT_PATH = '/api/v1/hooks/logs'
-$KNOWN_LOG_SLUGS = @('claude', 'codex', 'cursor', 'gemini', 'copilot', 'antigravity')
+$KNOWN_LOG_SLUGS = @('claude', 'codex', 'cursor', 'gemini', 'copilot', 'antigravity', 'kiro')
 # Bytes scanned when fingerprinting a log's first line. NOT 200: a real log line is
 # timestamp + provider + event + up to 400 chars of `raw=`, i.e. commonly 500-700
 # bytes, so a 200-byte window would find no newline in a typical log's first line
@@ -329,6 +329,9 @@ $SHIP_ENV_VARS = @(
     'ROGUE_SHIP_ALL')
 
 function Import-ShipEnv {
+    $envLibrary = Join-Path $PluginRoot 'scripts/env-file.ps1'
+    if ($PSCommandPath) { $envLibrary = Join-Path (Split-Path -Parent $PSCommandPath) 'env-file.ps1' }
+    . ([scriptblock]::Create((Get-Content -Raw -LiteralPath $envLibrary)))
     $resolved = @{}
     $envFiles = @(
         (Join-Path $PluginRoot 'env'),
@@ -336,7 +339,7 @@ function Import-ShipEnv {
         (Join-Path (Get-UserHome) '.rogue-env'))
     foreach ($envFile in $envFiles) {
         if (-not $envFile -or -not (Test-Path -LiteralPath $envFile)) { continue }
-        foreach ($line in (Get-Content -LiteralPath $envFile)) {
+        foreach ($line in (Read-RogueEnvFile $envFile)) {
             if ($line -match '^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.*)$') {
                 $resolved[$Matches[1]] = ConvertFrom-ShellQuoted ($Matches[2].Trim())
             }
diff --git a/scripts/shared/ship-logs.sh b/scripts/shared/ship-logs.sh
index 1407878..ca5fbb1 100644
--- a/scripts/shared/ship-logs.sh
+++ b/scripts/shared/ship-logs.sh
@@ -54,7 +54,7 @@ set -u
 
 # ── constants ──────────────────────────────────────────────────────────────
 SHIP_ENDPOINT_PATH="/api/v1/hooks/logs"
-KNOWN_LOG_SLUGS="claude codex cursor gemini copilot antigravity"
+KNOWN_LOG_SLUGS="claude codex cursor gemini copilot antigravity kiro"
 # Bytes scanned when fingerprinting a log's first line. NOT the 200 an earlier
 # draft of the design doc specified: a real log line is timestamp + provider +
 # event + up to 400 chars of `raw=`, i.e. commonly 500-700 bytes, so a 200-byte
@@ -127,9 +127,10 @@ log() {
   # visible.
   debug "$*"
   [ -n "$SELF_LOG_FILE" ] || return 0
-  mkdir -p "$(dirname "$SELF_LOG_FILE")" 2>/dev/null
-  printf '%s provider=%s event=ShipLogs %s\n' \
-    "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$SHIPPER_SLUG" "$*" >> "$SELF_LOG_FILE" 2>/dev/null
+  ( umask 077
+    mkdir -p "$(dirname "$SELF_LOG_FILE")" 2>/dev/null
+    printf '%s provider=%s event=ShipLogs %s\n' \
+    "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$SHIPPER_SLUG" "$*" >> "$SELF_LOG_FILE" 2>/dev/null )
   return 0
 }
 
@@ -299,11 +300,13 @@ ROGUE_SHIP_MAX_BYTES ROGUE_SHIP_MAX_RUN_BYTES ROGUE_SHIP_MAX_LINE_BYTES
 ROGUE_SHIP_ALL'
 
 load_env() {
+  [ -r "$(dirname "$0")/env-file.sh" ] || return 0
+  . "$(dirname "$0")/env-file.sh"
   for _env_var_name in $SHIP_ENV_VARS; do
     eval "_process_env_$_env_var_name=\${$_env_var_name:-}"
   done
   for _env_file in "$PLUGIN_ROOT/env" /etc/rogue/env "$HOME/.rogue-env"; do
-    [ -n "$_env_file" ] && [ -r "$_env_file" ] && . "$_env_file" 2>/dev/null
+    rogue_source_env "$_env_file" 2>/dev/null
   done
   for _env_var_name in $SHIP_ENV_VARS; do
     eval "[ -n \"\${_process_env_$_env_var_name:-}\" ] && $_env_var_name=\$_process_env_$_env_var_name"
diff --git a/tests/e2e_ship_logs.ps1 b/tests/e2e_ship_logs.ps1
index e494822..fe8d476 100644
--- a/tests/e2e_ship_logs.ps1
+++ b/tests/e2e_ship_logs.ps1
@@ -361,6 +361,8 @@ $snippetRoot = Join-Path $sandbox 'plugintree'
 New-Item -ItemType Directory -Path (Join-Path $snippetRoot 'scripts') -Force | Out-Null
 Copy-Item -LiteralPath (Join-Path $repo 'plugins\rogue\scripts\ship-logs.ps1') `
           -Destination (Join-Path $snippetRoot 'scripts\ship-logs.ps1') -Force
+Copy-Item -LiteralPath (Join-Path $repo 'plugins\rogue\scripts\env-file.ps1') `
+          -Destination (Join-Path $snippetRoot 'scripts\env-file.ps1') -Force
 # `e2e-key` because that is what the receiver accepts (E2E_API_KEY above); the point
 # of the case is WHERE the credentials came from, not what they are.
 [System.IO.File]::WriteAllText((Join-Path $snippetRoot 'env'),
diff --git a/tests/test_env_file_trust.ps1 b/tests/test_env_file_trust.ps1
new file mode 100644
index 0000000..8fec370
--- /dev/null
+++ b/tests/test_env_file_trust.ps1
@@ -0,0 +1,26 @@
+$ErrorActionPreference = 'Stop'
+$repo = Split-Path $PSScriptRoot -Parent
+. (Join-Path $repo 'scripts/shared/env-file.ps1')
+$dir = Join-Path ([System.IO.Path]::GetTempPath()) ([guid]::NewGuid().ToString())
+New-Item -ItemType Directory $dir | Out-Null
+$file = Join-Path $dir 'env'
+try {
+    [System.IO.File]::WriteAllText($file, 'ROGUE_TEST_VALUE=trusted')
+    $unix = $PSVersionTable.PSVersion.Major -ge 6 -and -not $IsWindows
+    if ($unix) { & chmod 600 $file }
+    elseif (-not (Protect-RogueEnvFile $file)) { throw $script:RogueEnvProtectError }
+    if (-not (Test-RogueEnvFile $file)) { throw 'owner-only env was rejected' }
+    if ((Read-RogueEnvFile $file) -ne 'ROGUE_TEST_VALUE=trusted') { throw 'trusted env not read' }
+    if ($unix) { & chmod 666 $file }
+    else {
+        $acl = Get-Acl -LiteralPath $file
+        $everyone = New-Object System.Security.Principal.SecurityIdentifier('S-1-1-0')
+        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($everyone, 'Write', 'Allow')
+        $acl.AddAccessRule($rule)
+        Set-Acl -LiteralPath $file -AclObject $acl
+    }
+    if (Test-RogueEnvFile $file) { throw 'world-writable env was trusted' }
+    if (@(Read-RogueEnvFile $file).Count -ne 0) { throw 'unsafe env was read' }
+    if (Test-RogueEnvFile (Join-Path $dir 'missing')) { throw 'missing env was trusted' }
+    Write-Host 'env-file trust: all checks passed'
+} finally { Remove-Item -Recurse -Force $dir }
diff --git a/tests/test_env_file_trust.sh b/tests/test_env_file_trust.sh
new file mode 100644
index 0000000..20ba944
--- /dev/null
+++ b/tests/test_env_file_trust.sh
@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+set -euo pipefail
+REPO="$(cd "$(dirname "$0")/.." && pwd)"
+. "$REPO/scripts/shared/env-file.sh"
+work="$(mktemp -d)"
+trap 'rm -rf "$work"' EXIT
+printf 'ROGUE_TEST_VALUE=trusted\n' > "$work/trusted"
+chmod 600 "$work/trusted"
+rogue_source_env "$work/trusted"
+[ "$ROGUE_TEST_VALUE" = trusted ]
+printf 'ROGUE_TEST_VALUE=untrusted\ntouch "%s/executed"\n' "$work" > "$work/unsafe"
+for mode in 666 620; do
+  chmod "$mode" "$work/unsafe"
+  rogue_source_env "$work/unsafe"
+  [ "$ROGUE_TEST_VALUE" = trusted ] && [ ! -e "$work/executed" ]
+done
+ln -s "$work/unsafe" "$work/link"
+rogue_source_env "$work/link"
+[ "$ROGUE_TEST_VALUE" = trusted ]
+if [ "$(id -u)" != 0 ]; then
+  if rogue_env_is_trusted "$work/trusted" 1; then
+    echo 'FAIL: a user-owned system file was trusted'; exit 1
+  fi
+fi
+rogue_source_env "$work/missing"
+echo 'env-file trust: all checks passed'
diff --git a/tests/test_heartbeat_ps1.ps1 b/tests/test_heartbeat_ps1.ps1
index 323e6d2..da7b750 100644
--- a/tests/test_heartbeat_ps1.ps1
+++ b/tests/test_heartbeat_ps1.ps1
@@ -335,7 +335,142 @@ try {
     $kiroHb = Get-Content -Raw (Join-Path $repo 'plugins/kiro/scripts/heartbeat.ps1')
     Check "kiro heartbeat.ps1 takes the surface positionally" $true `
         ($kiroHb -match "param\(\[string\]\`$Agent = '', \[string\]\`$Trigger = 'SessionStart'\)")
-    Check "kiro heartbeat.ps1 reports family kiro" $true ($kiroHb -match "agent_family = 'kiro'")
+
+    Write-Host "-- the kiro heartbeat, RUN: surface, Kiro build, default agent, throttle --"
+    # Executed through the seam, not grepped. The source-regex checks this block
+    # replaces passed against a heartbeat that reported kiro_cli for EVERY install:
+    # a file-scope `$agent = ''` overwrote the `$Agent` parameter before
+    # Resolve-Surface read it (PowerShell variable names are case-insensitive).
+    # The sh twin (tests/test_heartbeat_sh.sh) runs the same cases against
+    # heartbeat.sh; both halves must agree case for case.
+    #
+    # heartbeat.ps1 is dot-sourced at SCRIPT scope, never inside a function: its
+    # helpers read the file-scope state (`$pluginRoot`, `$ver`, `$surface`...)
+    # unqualified, and a dot-source inside a function would leave that state in
+    # the function's scope while the `$script:` writes land here.
+    $kiroRoot = Join-Path (Join-Path $repo 'plugins') 'kiro'
+    $kiroBin = Join-Path $sandbox 'kiro-bin'
+    New-Item -ItemType Directory -Path $kiroBin -Force | Out-Null
+    $kiroCliLog = Join-Path $sandbox 'kiro-cli.log'
+    # kiro-cli 2.21.0's shape: `--version` prints "kiro-cli <X.Y.Z>", `settings
+    # chat.defaultAgent` prints the value quoted or errors out when none is set.
+    # Every call is recorded, so a throttled beacon can be shown to spawn none.
+    $fakeCli = Join-Path $kiroBin 'kiro-cli.ps1'
+    @'
+param([Parameter(ValueFromRemainingArguments = $true)][string[]]$Argv)
+if ($env:KIRO_CLI_LOG) { Add-Content -LiteralPath $env:KIRO_CLI_LOG -Value ($Argv -join ' ') }
+if ($Argv[0] -eq '--version') { Write-Output 'kiro-cli 2.21.0'; exit 0 }
+if ("$($Argv[0]) $($Argv[1])" -eq 'settings chat.defaultAgent') {
+    if ($env:KIRO_FAKE_DEFAULT) { Write-Output ('"' + $env:KIRO_FAKE_DEFAULT + '"'); exit 0 }
+    [Console]::Error.WriteLine('error: No value associated with chat.defaultAgent')
+    exit 1
+}
+exit 0
+'@ | Set-Content -LiteralPath $fakeCli -Encoding UTF8
+    if ($env:OS -ne 'Windows_NT') {
+        $shim = Join-Path $kiroBin 'kiro-cli'
+        [System.IO.File]::WriteAllText($shim, "#!/bin/sh`nexec pwsh -NoProfile -File `"$fakeCli`" `"`$@`"`n")
+        & chmod +x $shim
+    }
+    # The IDE install as the heartbeat reads it on Windows: <root>\resources\app\package.json.
+    $kiroIde = Join-Path $sandbox 'Kiro'
+    New-Item -ItemType Directory -Path (Join-Path (Join-Path $kiroIde 'resources') 'app') -Force | Out-Null
+    [System.IO.File]::WriteAllText((Join-Path (Join-Path (Join-Path $kiroIde 'resources') 'app') 'package.json'),
+        "{`n  `"version`": `"1.0.437`"`n}`n")
+    [System.IO.File]::WriteAllText((Join-Path $sandbox '.rogue-env'), "export ROGUE_API_KEY=k`n")
+    $kiroStamp = Join-Path (Join-Path (Join-Path $sandbox '.rogue') 'beacon') '.last-kiro'
+    $kiroPluginVer = [regex]::Match((Get-Content -Raw (Join-Path $kiroRoot 'plugin.json')), '"version"\s*:\s*"([^"]+)"').Groups[1].Value
+
+    # Invoke-WebRequest shadowed: functions win over cmdlets. Records the body.
+    $script:kiroSent = $null
+    function Invoke-WebRequest {
+        [CmdletBinding()]
+        param($Uri, $Method, $Headers, $ContentType, $Body, [switch]$UseBasicParsing, $TimeoutSec)
+        $script:kiroSent = [System.Text.Encoding]::UTF8.GetString($Body)
+        return [pscustomobject]@{ StatusCode = 200; Content = '{}' }
+    }
+    # The developer's shell very likely exports a real key and the interval knob;
+    # the trap above (interval 0) would also disable the throttle this block tests.
+    $kiroSavedEnv = @{}
+    foreach ($k in 'PATH','ROGUE_API_KEY','ROGUE_BASE_URL','ROGUE_ACTOR_EMAIL','ROGUE_ACTOR_NAME',
+                   'ROGUE_HEARTBEAT_MIN_INTERVAL','ROGUE_KIRO_APP','KIRO_FAKE_DEFAULT','KIRO_CLI_LOG') {
+        $kiroSavedEnv[$k] = [Environment]::GetEnvironmentVariable($k)
+        if ($k -ne 'PATH') { [Environment]::SetEnvironmentVariable($k, $null) }
+    }
+    $env:PATH = $kiroBin + [System.IO.Path]::PathSeparator + $env:PATH
+    $env:KIRO_CLI_LOG = $kiroCliLog
+    $env:ROGUE_KIRO_APP = Join-Path $sandbox 'no-app'
+
+    $kiroHbPath = Join-Path (Join-Path $kiroRoot 'scripts') 'heartbeat.ps1'
+    # Replays one run (Invoke-Main minus TLS and the exit) for a surface and a
+    # trigger and returns the body it posted, or $null when it posted nothing.
+    # A SCRIPTBLOCK that is dot-invoked, not a function: the file is dot-sourced
+    # WITH its arguments each time so the param block and every file-scope
+    # statement run in the shipped order - which is exactly where the `$Agent`
+    # clobber lived - and all of it lands in this script's scope.
+    $invokeKiroHeartbeat = {
+        param([string]$Which, [string]$When)
+        $script:kiroSent = $null
+        [System.IO.File]::WriteAllText($kiroCliLog, '')
+        . $kiroHbPath $Which $When
+        $script:pluginRoot = $kiroRoot
+        $lib = Get-BeaconLibrary
+        if ($lib) { . $lib }
+        Import-Credentials; Initialize-Beacon; Resolve-BaseUrl; Resolve-Actor; Resolve-Version; Resolve-Surface
+        Send-Heartbeat
+        $script:kiroSent
+    }
+    function Get-KiroCliCalls { return ([System.IO.File]::ReadAllText($kiroCliLog)).Trim() }
+    function Clear-KiroStamp { Remove-Item -LiteralPath $kiroStamp -Force -ErrorAction SilentlyContinue }
+
+    Clear-KiroStamp
+    $env:ROGUE_KIRO_APP = $kiroIde
+    $b = . $invokeKiroHeartbeat 'kiro_ide' 'SessionStart'
+    Check "SessionStart posts a body" $true ($null -ne $b)
+    Check "the body names family kiro" $true ($b -like '*"agent_family":"kiro"*')
+    Check "the body carries the surface argument (kiro_ide, not the kiro_cli default)" $true ($b -like '*"agent":"kiro_ide"*')
+    Check "the version comes from plugin.json" $true ($b -like "*`"version`":`"$kiroPluginVer`"*")
+    Check "kiro_ide reports agent_version from the install's package.json" $true ($b -like '*"agent_version":"1.0.437"*')
+    Check "the IDE reports no default agent (that is a CLI setting)" $false ($b -like '*default_agent*')
+    Check "the IDE never runs kiro-cli" '' (Get-KiroCliCalls)
+    Check "the stamp slug is kiro (the log file's name)" $true (Test-Path -LiteralPath $kiroStamp)
+    $env:ROGUE_KIRO_APP = Join-Path $sandbox 'no-app'
+    Clear-KiroStamp
+    $b = . $invokeKiroHeartbeat 'kiro_ide' 'SessionStart'
+    Check "no install -> agent_version unknown, never blank" $true ($b -like '*"agent_version":"unknown"*')
+
+    Clear-KiroStamp
+    $env:KIRO_FAKE_DEFAULT = 'rogue'
+    $b = . $invokeKiroHeartbeat 'kiro_cli' 'SessionStart'
+    Check "kiro_cli reports agent_version from kiro-cli --version" $true ($b -like '*"agent_version":"2.21.0"*')
+    Check "kiro_cli reports the default agent, unquoted" $true ($b -like '*"default_agent":"rogue"*')
+    Check "SessionStart asks kiro-cli for its version and the default" $true `
+        ((Get-KiroCliCalls) -like '*--version*' -and (Get-KiroCliCalls) -like '*settings chat.defaultAgent*')
+    # Throttled means throttled: the probes are kiro-cli processes, and a per-turn
+    # Stop inside the window must spawn none of them - the claim comes first.
+    $b = . $invokeKiroHeartbeat 'kiro_cli' 'Stop'
+    Check "a Stop inside the window makes no request" $true ($null -eq $b)
+    Check "and asks Kiro nothing (no kiro-cli process)" '' (Get-KiroCliCalls)
+    [System.IO.File]::WriteAllText($kiroStamp, "0`n")
+    $b = . $invokeKiroHeartbeat 'kiro_cli' 'Stop'
+    Check "a Stop past the window posts again" $true ($null -ne $b)
+
+    Clear-KiroStamp
+    $env:KIRO_FAKE_DEFAULT = $null
+    $b = . $invokeKiroHeartbeat 'kiro_cli' 'SessionStart'
+    Check "no default set -> no default_agent field" $false ($b -like '*default_agent*')
+
+    Clear-KiroStamp
+    $env:KIRO_FAKE_DEFAULT = 'rogue'
+    $b = . $invokeKiroHeartbeat 'kiro_crew' 'SessionStart'
+    Check "kiro_crew reports the CLI version (Crew drives kiro-cli)" $true ($b -like '*"agent_version":"2.21.0"*')
+    Check "kiro_crew reports no default agent" $false ($b -like '*default_agent*')
+
+    Clear-KiroStamp
+    $b = . $invokeKiroHeartbeat 'bogus' 'SessionStart'
+    Check "an unrecognised surface falls back to kiro_cli" $true ($b -like '*"agent":"kiro_cli"*')
+
+    foreach ($k in $kiroSavedEnv.Keys) { [Environment]::SetEnvironmentVariable($k, $kiroSavedEnv[$k]) }
 }
 finally {
     $env:USERPROFILE = $saveProfile
diff --git a/tests/test_heartbeat_sh.sh b/tests/test_heartbeat_sh.sh
index 4e6d98d..e8e0ff4 100644
--- a/tests/test_heartbeat_sh.sh
+++ b/tests/test_heartbeat_sh.sh
@@ -222,19 +222,49 @@ KIRO_ROOT="$TMPROOT/kiro"
 KIRO_HOME="$TMPROOT/kiro-home"
 mkdir -p "$KIRO_ROOT/scripts" "$KIRO_HOME" "$TMPROOT/kiro-bin"
 cp "$REPO/plugins/kiro/scripts/heartbeat.sh" "$REPO/plugins/kiro/scripts/beacon.sh" \
-   "$REPO/plugins/kiro/scripts/actor.sh" "$REPO/plugins/kiro/scripts/install-id.sh" "$KIRO_ROOT/scripts/"
+   "$REPO/plugins/kiro/scripts/actor.sh" "$REPO/plugins/kiro/scripts/install-id.sh" \
+   "$REPO/plugins/kiro/scripts/kiro-host.sh" "$REPO/plugins/kiro/scripts/env-file.sh" "$KIRO_ROOT/scripts/"
 echo '{"name":"rogue","version":"9.9.9"}' > "$KIRO_ROOT/plugin.json"
 printf '#!/bin/sh\nprintf "%%s\\n" "$*" >> "$SB_CALLS"\nexit 0\n' > "$TMPROOT/kiro-bin/curl"
 chmod +x "$TMPROOT/kiro-bin/curl"
+# kiro-cli 2.21.0's shape: `--version` prints "kiro-cli <X.Y.Z>", and
+# `settings chat.defaultAgent` prints the value (quoted, as the real CLI does)
+# or errors out when none is set. The IDE has no CLI: its version is the app
+# bundle's Info.plist, pointed at through ROGUE_KIRO_APP so the suite never
+# reads /Applications.
+# Every call is recorded, so a throttled beacon can be shown to spawn none.
+cat > "$TMPROOT/kiro-bin/kiro-cli" <<'STUB'
+#!/bin/sh
+printf '%s\n' "$*" >> "${KIRO_CLI_LOG:-/dev/null}"
+case "$1 $2" in
+  "--version ")                echo "kiro-cli 2.21.0" ;;
+  "settings chat.defaultAgent") [ -n "${KIRO_FAKE_DEFAULT:-}" ] && { echo "\"$KIRO_FAKE_DEFAULT\""; exit 0; }
+                               echo "error: No value associated with chat.defaultAgent" >&2; exit 1 ;;
+esac
+exit 0
+STUB
+chmod +x "$TMPROOT/kiro-bin/kiro-cli"
+KIRO_APP="$TMPROOT/Kiro.app"
+mkdir -p "$KIRO_APP/Contents"
+cat > "$KIRO_APP/Contents/Info.plist" <<'PLIST'
+<?xml version="1.0" encoding="UTF-8"?>
+<plist version="1.0"><dict>
+  <key>CFBundleVersion</key><string>26030401</string>
+  <key>CFBundleShortVersionString</key>
+  <string>1.0.437</string>
+</dict></plist>
+PLIST
 echo 'export ROGUE_API_KEY=k' > "$KIRO_HOME/.rogue-env"
 KIRO_STAMP="$KIRO_HOME/.rogue/beacon/.last-kiro"
 # kiro_beacon <surface> <trigger> → the recorded curl arguments (one line per call)
 # `env -u` scrubs the developer's own ROGUE_* (this suite is very likely run from a
 # shell that exports a real key): only the temp HOME's env file may configure it.
 kiro_beacon() {
-  : > "$TMPROOT/kiro-calls"
+  : > "$TMPROOT/kiro-calls"; : > "$TMPROOT/kiro-cli-calls"
   env -u ROGUE_API_KEY -u ROGUE_BASE_URL -u ROGUE_ACTOR_EMAIL -u ROGUE_ACTOR_NAME \
-      SB_CALLS="$TMPROOT/kiro-calls" PATH="$TMPROOT/kiro-bin:$PATH" HOME="$KIRO_HOME" \
+      SB_CALLS="$TMPROOT/kiro-calls" KIRO_CLI_LOG="$TMPROOT/kiro-cli-calls" \
+      PATH="$TMPROOT/kiro-bin:$PATH" HOME="$KIRO_HOME" \
+      ROGUE_KIRO_APP="${ROGUE_KIRO_APP:-$TMPROOT/no-app}" KIRO_FAKE_DEFAULT="${KIRO_FAKE_DEFAULT:-}" \
       "$SH" "$KIRO_ROOT/scripts/heartbeat.sh" "$1" "$2" >/dev/null 2>&1
   cat "$TMPROOT/kiro-calls"
 }
@@ -244,10 +274,38 @@ check "SessionStart posts /hooks/status" "yes" "$(has "$out" "/api/v1/hooks/stat
 check "the body names family kiro" "yes" "$(has "$out" '"agent_family":"kiro"')"
 check "the body carries the surface argument" "yes" "$(has "$out" '"agent":"kiro_ide"')"
 check "the version comes from plugin.json" "yes" "$(has "$out" '"version":"9.9.9"')"
+check "no app bundle → agent_version unknown, never blank" "yes" "$(has "$out" '"agent_version":"unknown"')"
 check "the stamp slug is kiro (the log file's name)" "yes" "$([ -s "$KIRO_STAMP" ] && echo yes || echo no)"
 check "Stop inside the window is throttled" "" "$(kiro_beacon kiro_ide Stop)"
 rm -rf "${KIRO_STAMP%/*}"
 check "an unrecognised surface falls back to kiro_cli" "yes" "$(has "$(kiro_beacon bogus Stop)" '"agent":"kiro_cli"')"
+rm -rf "${KIRO_STAMP%/*}"
+echo "── the kiro heartbeat reports the host's own version and the CLI default ──"
+# Two versions ride one row: `version` is the plugin's, `agent_version` is the
+# Kiro build it runs under - the CLI from `kiro-cli --version`, the IDE from
+# the app bundle - so support can tell a plugin that is current from a Kiro that
+# is not. The CLI also reports which agent is the default: on the 2.x engine
+# only agents carrying the Rogue hooks are covered, so a machine whose default
+# moved away from `rogue` is a machine the roster should show as uncovered.
+out="$(KIRO_FAKE_DEFAULT=rogue kiro_beacon kiro_cli SessionStart)"
+check "kiro_cli reports agent_version from kiro-cli --version" "yes" "$(has "$out" '"agent_version":"2.21.0"')"
+check "kiro_cli reports the default agent, unquoted" "yes" "$(has "$out" '"default_agent":"rogue"')"
+check "SessionStart asks kiro-cli for its version" "yes" "$(has "$(cat "$TMPROOT/kiro-cli-calls")" '--version')"
+# Throttled means throttled: the probes are kiro-cli processes, and a per-turn
+# Stop inside the window must spawn none of them - the claim comes first.
+check "a Stop inside the window makes no request" "" "$(KIRO_FAKE_DEFAULT=rogue kiro_beacon kiro_cli Stop)"
+check "and asks Kiro nothing (no kiro-cli process)" "" "$(cat "$TMPROOT/kiro-cli-calls")"
+rm -rf "${KIRO_STAMP%/*}"
+out="$(kiro_beacon kiro_cli SessionStart)"
+check "no default set → no default_agent field" "no" "$(has "$out" 'default_agent')"
+rm -rf "${KIRO_STAMP%/*}"
+out="$(ROGUE_KIRO_APP="$KIRO_APP" kiro_beacon kiro_ide SessionStart)"
+check "kiro_ide reports agent_version from the app bundle's Info.plist" "yes" "$(has "$out" '"agent_version":"1.0.437"')"
+check "the IDE reports no default agent (that is a CLI setting)" "no" "$(has "$out" 'default_agent')"
+rm -rf "${KIRO_STAMP%/*}"
+out="$(KIRO_FAKE_DEFAULT=rogue kiro_beacon kiro_crew SessionStart)"
+check "kiro_crew reports the CLI version (Crew drives kiro-cli)" "yes" "$(has "$out" '"agent_version":"2.21.0"')"
+check "kiro_crew reports no default agent" "no" "$(has "$out" 'default_agent')"
 rm -f "$KIRO_HOME/.rogue-env"
 check "unconfigured is a no-op" "" "$(kiro_beacon kiro_cli SessionStart)"
 
diff --git a/tests/test_hook_ps1_kiro.ps1 b/tests/test_hook_ps1_kiro.ps1
index 8dad7e9..78dccd0 100644
--- a/tests/test_hook_ps1_kiro.ps1
+++ b/tests/test_hook_ps1_kiro.ps1
@@ -142,12 +142,27 @@ Assert-Eq $o.ExitCode 0 'a non-canonical event name cannot produce an exit 2'
 Assert-Eq (Sanitize "a`tb`nc`r`0d") 'abcd' 'Sanitize strips tab/LF/CR/NUL'
 Assert-Eq (Sanitize $null) '' 'Sanitize tolerates null'
 
+# Nested event names must never suppress a 2.x request.
+foreach ($payload in @(
+    '{"hook_event_name":"preToolUse","tool_input":{"hook_event_name":"PreToolUse"}}',
+    '{"tool_input":{"hook_event_name":"PreToolUse"},"hook_event_name":"preToolUse"}',
+    '{"tool_input":{"hook_event_name":"PreToolUse"}}'
+)) {
+    Assert-Eq (Test-KiroDuplicateAgentHook 'preToolUse' $payload) $false 'nested event name is not a duplicate'
+}
+
+# Raw UTF-8 input is decoded exactly once, regardless of Console.InputEncoding.
+$utf8Text = '{"prompt":"' + [char]0x65e5 + [char]0x672c + [char]0x8a9e + '"}'
+$stream = [System.IO.MemoryStream]::new([System.Text.Encoding]::UTF8.GetBytes($utf8Text))
+Assert-Eq (Read-KiroPayload $stream) $utf8Text 'UTF-8 stdin survives decoding'
+$stream.Dispose()
+
 # -- structural: the main body wires the table to the process ------------------
 # Resolve-KiroOutcome is worthless if the main body ignores its ExitCode, and a
 # stray `exit 2` anywhere else would be a fail-closed path.
 $src = Get-Content -Raw -LiteralPath $hook
 $count++
-if ($src -match '(?m)^exit \$o\.ExitCode\s*$') { Write-Host '  ok: main body exits with the resolved ExitCode' }
+if ($src -match '(?m)^\s*exit\s+\$o\.ExitCode\s*$') { Write-Host '  ok: main body exits with the resolved ExitCode' }
 else { Write-Host 'FAIL [main body exits with the resolved ExitCode]'; $fails++ }
 $count++
 $literalExit2 = [regex]::Matches(($src -replace '(?m)#.*$', ''), '\bexit\s+2\b').Count
@@ -159,9 +174,23 @@ else { Write-Host 'FAIL [main body injects KIRO_SESSION_ID]'; $fails++ }
 # ROGUE_HOOK_TIMEOUT=0 must fall back to the default: -TimeoutSec 0 is NO timeout,
 # which would hand the budget to Kiro's own 10s (mirrors hook.sh's `-gt 0` clamp).
 $count++
-if ($src -match '\[int\]\$t -gt 0\) \{ \$timeoutSec = \[int\]\$t \}') { Write-Host '  ok: a zero ROGUE_HOOK_TIMEOUT keeps the default budget' }
+if ($src -match '\[int\]\$t\s+-gt\s+0\)\s*\{\s*\$(?:script:)?timeoutSec\s*=\s*\[int\]\$t\s*\}') { Write-Host '  ok: a zero ROGUE_HOOK_TIMEOUT keeps the default budget' }
 else { Write-Host 'FAIL [a zero ROGUE_HOOK_TIMEOUT keeps the default budget]'; $fails++ }
 
+# -- no file-scope assignment shadows a parameter ----------------------------
+# PowerShell variable names are case-insensitive: a file-scope
+# `$script:surface = ''` overwrote the `$Surface` parameter before the main body
+# validated it, so every Windows event went out as kiro_cli and no log line
+# carried a surface token. Static, because the main body stands down
+# off-Windows. A reassignment that reads the parameter (`$EventName =
+# ConvertTo-KiroEvent $EventName`) is not a shadow and is allowed.
+$count++
+$paramNames = [regex]::Matches([regex]::Match($src, 'param\(([^)]*)\)').Groups[1].Value, '\$(\w+)') |
+    ForEach-Object { $_.Groups[1].Value }
+$shadowed = @($paramNames | Where-Object { $src -match "(?im)^\`$(script:)?$_\s*=(?!.*\`$$_\b)" })
+if ($shadowed.Count -eq 0) { Write-Host '  ok: no file-scope assignment shadows a parameter' }
+else { Write-Host "FAIL [no file-scope assignment shadows a parameter]: $($shadowed -join ', ')"; $fails++ }
+
 Write-Host ""
 if ($fails -eq 0) { Write-Host "All $count Kiro PowerShell bridge tests passed."; exit 0 }
 Write-Host "$fails of $count failed."
diff --git a/tests/test_hook_sh_kiro.sh b/tests/test_hook_sh_kiro.sh
index c8a6055..f79114e 100755
--- a/tests/test_hook_sh_kiro.sh
+++ b/tests/test_hook_sh_kiro.sh
@@ -86,7 +86,7 @@ run_bridge() {
 make_nojq_path() {
   local d b src
   d="$(mktemp -d)"
-  for b in "$SH" sh dirname basename date mkdir cat sed grep tr tail head awk wc hostname whoami git curl printf; do
+  for b in "$SH" sh dirname basename date mkdir cat sed grep tr tail head awk wc hostname whoami git curl printf stat id; do
     src="$(command -v "$b" 2>/dev/null || true)"
     [ -n "$src" ] || continue
     ln -s "$src" "$d/$(basename "$src")" 2>/dev/null || true
@@ -399,6 +399,11 @@ assert_header "x-rogue-api-key" "user-key" "~/.rogue-env overrides <root>/env (l
 assert_eq "$(posted_header x-rogue-event)" "PreToolUse" "...while <root>/env still supplies the base URL"
 run_prec "$PREC_HOME" 'process-key'
 assert_header "x-rogue-api-key" "user-key" "a sourced file overwrites the process env on the bash bridge"
+printf 'touch "%s/unsafe-executed"\n' "$PREC_HOME" >> "$PREC_HOME/.rogue-env"
+chmod 666 "$PREC_HOME/.rogue-env"
+run_prec "$PREC_HOME" ''
+assert_header "x-rogue-api-key" "bundled-key" "a writable env file cannot override trusted credentials"
+assert_eq "$([ -e "$PREC_HOME/unsafe-executed" ] && echo yes || echo no)" "no" "unsafe env code is never executed"
 rm -rf "$PREC_ROOT" "$PREC_HOME"
 
 # ── Case 18: the presence heartbeat is spawned on SessionStart and Stop ─────
@@ -468,5 +473,16 @@ assert_eq "$LAST_RC" "2" "a 2.x event (camelCase body) is never dropped"
 run_bridge stop kiro_crew "$FIX/cli2-stop.json"
 assert_eq "$LAST_RC" "0" "a 2.x stop goes through (allow)"
 
+# A nested key is tool input, never proof of a duplicate hook invocation.
+for payload in \
+  '{"hook_event_name":"preToolUse","tool_input":{"hook_event_name":"PreToolUse"}}' \
+  '{"tool_input":{"hook_event_name":"PreToolUse"},"hook_event_name":"preToolUse"}' \
+  '{"tool_input":{"hook_event_name":"PreToolUse"}}'; do
+  printf '%s' "$payload" > "$STAGE/nested-event.json"
+  run_bridge preToolUse kiro_cli "$STAGE/nested-event.json"
+  assert_eq "$LAST_RC" "2" "a nested event name never suppresses enforcement"
+done
+
+
 echo
 echo "All Kiro bridge tests passed (TEST_SH=$SH)."
diff --git a/tests/test_install_kiro_ps1.ps1 b/tests/test_install_kiro_ps1.ps1
index b155bf1..a48d15b 100644
--- a/tests/test_install_kiro_ps1.ps1
+++ b/tests/test_install_kiro_ps1.ps1
@@ -32,7 +32,7 @@ $env:KIRO_STATE   = $state
 # with the real CLI's not-logged-in error when KIRO_FAKE_CREATE_FAILS is set;
 # `agent set-default X` records the choice. A .ps1 resolves by bare name from
 # PATH on Windows; on Linux/macOS a sh shim beside it does.
-$fakeCli = Join-Path $bin 'kiro-cli.ps1'
+$fakeCli = Join-Path $bin 'kiro-cli-fixture.ps1'
 @'
 param([Parameter(ValueFromRemainingArguments = $true)][string[]]$Argv)
 Add-Content -LiteralPath $env:KIRO_CLI_LOG -Value ($Argv -join ' ')
@@ -62,7 +62,12 @@ if ($sub -eq 'settings chat.defaultAgent') {
 }
 exit 0
 '@ | Set-Content -LiteralPath $fakeCli -Encoding UTF8
-if ($env:OS -ne 'Windows_NT') {
+if ($env:OS -eq 'Windows_NT') {
+    # A child process, like the real executable: Console.Error from an in-process
+    # .ps1 bypasses PowerShell's error stream and cannot exercise stderr capture.
+    [System.IO.File]::WriteAllText((Join-Path $bin 'kiro-cli.cmd'),
+        "@echo off`r`npowershell.exe -NoProfile -File `"$fakeCli`" %*`r`nexit /b %errorlevel%`r`n")
+} else {
     $shim = Join-Path $bin 'kiro-cli'
     [System.IO.File]::WriteAllText($shim, "#!/bin/sh`nexec pwsh -NoProfile -File `"$fakeCli`" `"`$@`"`n")
     & chmod +x $shim
@@ -229,8 +234,23 @@ Assert-Eq (Test-Path -LiteralPath (Join-Path $agents2 'rogue.json')) $false 'no
 Assert-Eq (@(Get-Content -LiteralPath $env:KIRO_CLI_LOG | Where-Object { $_ -like 'agent set-default*' }).Count) 0 'agent set-default is never called for an agent that does not exist'
 Assert-Eq (Test-Path -LiteralPath (Join-Path $state 'default')) $false 'the CLI default is left unset'
 Assert-Eq ($out -match 'kiro-cli login') $true 'the warning names kiro-cli login'
+Assert-Eq ($out -match 'You are not logged in') $true 'the actual CLI error is reported'
 Assert-Eq (@((Read-Json (Join-Path $agents2 'custom2.json')).hooks).Count) 5 'custom agents are still merged'
 
+# Rewriting an agent must preserve nested user configuration.
+$deepFile = Join-Path $work 'deep-agent.json'
+$deep = [PSCustomObject]@{ value = 'preserve-me' }
+for ($i = 0; $i -lt 15; $i++) { $deep = [PSCustomObject]@{ child = $deep } }
+Write-KiroJsonFile $deepFile $deep
+$read = Get-Content -Raw -LiteralPath $deepFile | ConvertFrom-Json
+for ($i = 0; $i -lt 15; $i++) { $read = $read.child }
+if ($read.value -ne 'preserve-me') { throw 'deep config was changed' }
+$before = [System.IO.File]::ReadAllText($deepFile)
+for ($i = 0; $i -lt 110; $i++) { $deep = [PSCustomObject]@{ child = $deep } }
+$rejected = $false
+try { Write-KiroJsonFile $deepFile $deep } catch { $rejected = $true }
+if (-not $rejected -or [System.IO.File]::ReadAllText($deepFile) -ne $before) { throw 'over-depth config was overwritten' }
+
 $env:USERPROFILE = $prevProfile
 $env:PATH = $prevPath
 Remove-Item -Recurse -Force $work -ErrorAction SilentlyContinue
diff --git a/tests/test_plugin_versions_sh.sh b/tests/test_plugin_versions_sh.sh
index 384e217..ffe17c7 100644
--- a/tests/test_plugin_versions_sh.sh
+++ b/tests/test_plugin_versions_sh.sh
@@ -73,14 +73,16 @@ case "$flat" in
   *) bad "antigravity matches its VERSION file" "expected $agv_expected in: $out" ;;
 esac
 
-# The seven must be DISTINCT reads, not one file echoed seven times. A mapping bug
-# that pointed several slugs at the same manifest would satisfy every assertion
-# above only if those plugins happened to share a version - so assert the shape
-# of the real tree instead: not all seven versions are equal today.
-uniq_count=$(printf '%s' "$flat" | grep -oE '"(claude|codex|cursor|copilot|gemini|antigravity|kiro)":"[0-9]+\.[0-9]+\.[0-9]+"' \
-  | sed -E 's/.*:"//; s/"//' | sort -u | wc -l | tr -d ' ')
-if [ "$uniq_count" -gt 1 ]; then ok "the seven versions are not one value repeated ($uniq_count distinct)"; else
-  bad "the seven versions are not one value repeated" "all seven read $uniq_count distinct value(s)"; fi
+# Kiro carries BOTH: plugin.json is the version of record (every runtime reader
+# - install-id.sh, hook.ps1, heartbeat.ps1 - takes it from there) and a bare
+# VERSION file beside it for operators and the release page. Two files is one
+# drift waiting to happen, so the manifest reader refuses to publish while
+# they disagree rather than picking one.
+kiro_file=$(head -n1 "$REPO/plugins/kiro/VERSION" 2>/dev/null | tr -d ' \r\n')
+kiro_json=$(grep -oE '"version"[[:space:]]*:[[:space:]]*"[^"]*"' "$REPO/plugins/kiro/plugin.json" \
+  | head -1 | sed -E 's/.*"([^"]*)"$/\1/')
+if [ -n "$kiro_file" ] && [ "$kiro_file" = "$kiro_json" ]; then ok "kiro VERSION file mirrors plugin.json ($kiro_file)"; else
+  bad "kiro VERSION file mirrors plugin.json" "VERSION=[$kiro_file] plugin.json=[$kiro_json]"; fi
 
 # ── Fail-hard cases, against fixture trees ───────────────────────────────────
 # A build that emits a manifest with a hole is worse than a build that fails:
@@ -90,16 +92,24 @@ trap 'rm -rf "$fixture"' EXIT
 mkdir -p "$fixture/plugins/rogue/.claude-plugin" "$fixture/plugins/codex/.codex-plugin" \
          "$fixture/plugins/cursor/.cursor-plugin" "$fixture/plugins/copilot" \
          "$fixture/plugins/gemini" "$fixture/plugins/antigravity" "$fixture/plugins/kiro"
-echo '{"version":"9.9.9"}' > "$fixture/plugins/rogue/.claude-plugin/plugin.json"
-echo '{"version":"9.9.9"}' > "$fixture/plugins/codex/.codex-plugin/plugin.json"
-echo '{"version":"9.9.9"}' > "$fixture/plugins/cursor/.cursor-plugin/plugin.json"
+echo '{"version":"1.2.3"}' > "$fixture/plugins/rogue/.claude-plugin/plugin.json"
+echo '{"version":"2.3.4"}' > "$fixture/plugins/codex/.codex-plugin/plugin.json"
+echo '{"version":"3.4.5"}' > "$fixture/plugins/cursor/.cursor-plugin/plugin.json"
 echo '{"version":"9.9.9"}' > "$fixture/plugins/kiro/plugin.json"
-echo '{"version":"9.9.9"}' > "$fixture/plugins/copilot/plugin.json"
-echo '{"version":"9.9.9"}' > "$fixture/plugins/gemini/gemini-extension.json"
-echo '9.9.9' > "$fixture/plugins/antigravity/VERSION"
+echo '9.9.9' > "$fixture/plugins/kiro/VERSION"
+echo '{"version":"4.5.6"}' > "$fixture/plugins/copilot/plugin.json"
+echo '{"version":"5.6.7"}' > "$fixture/plugins/gemini/gemini-extension.json"
+echo '6.7.8' > "$fixture/plugins/antigravity/VERSION"
 
-if bash "$SCRIPT" "$fixture" >/dev/null 2>&1; then ok "complete fixture tree succeeds"; else
-  bad "complete fixture tree succeeds" "exited non-zero"; fi
+out=$(bash "$SCRIPT" "$fixture" 2>/dev/null) || bad "complete fixture tree succeeds" "exited non-zero"
+flat=$(printf '%s' "$out" | tr -d ' \t\n\r')
+for mapping in claude:1.2.3 codex:2.3.4 cursor:3.4.5 copilot:4.5.6 gemini:5.6.7 antigravity:6.7.8 kiro:9.9.9; do
+  slug=${mapping%%:*}; expected=${mapping#*:}
+  case "$flat" in
+    *"\"$slug\":\"$expected\""*) ok "$slug reads its own fixture ($expected)" ;;
+    *) bad "$slug reads its own fixture" "$out" ;;
+  esac
+done
 
 rm -f "$fixture/plugins/gemini/gemini-extension.json"
 if bash "$SCRIPT" "$fixture" >/dev/null 2>&1; then
@@ -116,6 +126,17 @@ if bash "$SCRIPT" "$fixture" >/dev/null 2>&1; then
   bad "empty VERSION file fails" "exited 0"; else ok "empty VERSION file fails"; fi
 echo '9.9.9' > "$fixture/plugins/antigravity/VERSION"
 
+# A kiro VERSION file that disagrees with plugin.json, or is missing, fails the
+# build: publishing either value would be a manifest asserting a version half
+# the plugin does not carry.
+echo '9.9.8' > "$fixture/plugins/kiro/VERSION"
+if bash "$SCRIPT" "$fixture" >/dev/null 2>&1; then
+  bad "kiro VERSION drift fails" "exited 0 with VERSION 9.9.8 vs plugin.json 9.9.9"; else ok "kiro VERSION drift fails"; fi
+rm -f "$fixture/plugins/kiro/VERSION"
+if bash "$SCRIPT" "$fixture" >/dev/null 2>&1; then
+  bad "missing kiro VERSION fails" "exited 0"; else ok "missing kiro VERSION fails"; fi
+echo '9.9.9' > "$fixture/plugins/kiro/VERSION"
+
 # ── The whole field must be validated, not a substring ───────────────────────
 # Both readers used to extract a THREE-FIELD SUBSTRING out of the value and throw
 # the rest away, so "1.2.3-beta" was published as "1.2.3" — a manifest stating a
diff --git a/tests/test_ship_logs.ps1 b/tests/test_ship_logs.ps1
index 950f652..417be32 100644
--- a/tests/test_ship_logs.ps1
+++ b/tests/test_ship_logs.ps1
@@ -307,6 +307,7 @@ $callers = @(
     @{ file = 'plugins/codex/scripts/heartbeat.ps1';       slug = 'codex';       family = 'openai' }
     @{ file = 'plugins/copilot/scripts/heartbeat.ps1';     slug = 'copilot';     family = 'copilot' }
     @{ file = 'plugins/antigravity/scripts/heartbeat.ps1'; slug = 'antigravity'; family = 'antigravity' }
+    @{ file = 'plugins/kiro/scripts/heartbeat.ps1';        slug = 'kiro';        family = 'kiro' }
     @{ file = 'plugins/cursor/scripts/hook.ps1';           slug = 'cursor';      family = 'cursor' }
 )
 foreach ($caller in $callers) {
@@ -339,11 +340,11 @@ foreach ($caller in $callers) {
 
 # ── the five copies are the same file ──────────────────────────────────────
 Write-Host ''
-Write-Host '== the five plugin copies match scripts/shared/ship-logs.ps1'
+Write-Host '== the six plugin copies match scripts/shared/ship-logs.ps1'
 # Every per-plugin difference is an ARGUMENT, which is what lets this be a byte
 # comparison instead of a review. scripts/shared/ is the only editable copy.
 $canonical = [System.IO.File]::ReadAllBytes((Join-Path $repo 'scripts/shared/ship-logs.ps1'))
-foreach ($plugin in @('rogue', 'codex', 'cursor', 'copilot', 'antigravity')) {
+foreach ($plugin in @('rogue', 'codex', 'cursor', 'copilot', 'antigravity', 'kiro')) {
     $copyPath = Join-Path $repo "plugins/$plugin/scripts/ship-logs.ps1"
     if (-not (Test-Path -LiteralPath $copyPath)) { Fail "missing $copyPath"; continue }
     $copy = [System.IO.File]::ReadAllBytes($copyPath)
diff --git a/tests/test_ship_logs.sh b/tests/test_ship_logs.sh
index 6dcf072..dd08710 100644
--- a/tests/test_ship_logs.sh
+++ b/tests/test_ship_logs.sh
@@ -39,9 +39,9 @@ pass() { echo "  ok: $1"; }
 fail() { echo "FAIL: $1"; FAILS=$((FAILS + 1)); }
 check() { if [ "$2" = "$3" ]; then pass "$1"; else fail "$1 (expected [$2], got [$3])"; fi; }
 
-SLUGS='claude codex cursor gemini copilot antigravity'
-# The five plugins that ship the POSIX-sh copy (gemini ships ship-logs.mjs).
-SH_PLUGINS='rogue codex cursor copilot antigravity'
+SLUGS='claude codex cursor gemini copilot antigravity kiro'
+# The six plugins that ship the POSIX-sh copy (gemini ships ship-logs.mjs).
+SH_PLUGINS='rogue codex cursor copilot antigravity kiro'
 
 # ── the fake curl ──────────────────────────────────────────────────────────
 # The shipper invokes: curl … --data-binary @<body> -o /dev/null -w '%{http_code}'
@@ -159,7 +159,7 @@ seed()     { _i="$1"; while [ "$_i" -le "$2" ]; do
 # magic number.
 LINEB=$(printf '2026-08-12T00:00:01Z provider=claude event=PreToolUse outcome=allow n=1\n' | wc -c | tr -d ' ')
 
-echo "== the five sh copies match scripts/shared/ship-logs.sh"
+echo "== the six sh copies match scripts/shared/ship-logs.sh"
 # Every per-plugin difference is an ARGUMENT, which is what lets `cmp` enforce
 # lockstep instead of review. scripts/shared/ is the ONLY editable copy; the plugin
 # copies are committed (three plugins install straight from a git clone with no build
@@ -453,12 +453,12 @@ echo "== ROGUE_SHIP_ALL=1 collects every agent's log"
 new_case shipall
 for s in $SLUGS; do seed 1 2 "$s" "$CASE/home/.rogue/logs/$s.log"; done
 ship "ROGUE_SHIP_ALL=1"
-check "six requests" "6" "$(bodies)"
+check "seven requests" "7" "$(bodies)"
 # agent_family is a FALLBACK HINT for a line with no provider= token, so it is sent
 # only for the caller's OWN log: on a foreign log the shipping plugin's family
 # would mislabel every line (a codex line filed under `claude`).
 own_fam=""; foreign_fam="none"
-i=0; while [ "$i" -lt 6 ]; do
+i=0; while [ "$i" -lt 7 ]; do
   lf=$(strf "$i" log_file); fam=$(strf "$i" agent_family)
   if [ "$lf" = "claude.log" ]; then own_fam="$fam"
   elif [ -n "$fam" ]; then foreign_fam="$fam"; fi
@@ -497,10 +497,10 @@ echo "== a no-argument run collects everything and reports shipper=unknown"
 new_case noargs
 for s in $SLUGS; do seed 1 2 "$s" "$CASE/home/.rogue/logs/$s.log"; done
 ship_as rogue - x x
-check "six requests" "6" "$(bodies)"
+check "seven requests" "7" "$(bodies)"
 check "shipper is unknown" "unknown" "$(strf 0 shipper)"
 allblank=yes; i=0
-while [ "$i" -lt 6 ]; do [ -z "$(strf "$i" agent_family)" ] || allblank=no; i=$((i + 1)); done
+while [ "$i" -lt 7 ]; do [ -z "$(strf "$i" agent_family)" ] || allblank=no; i=$((i + 1)); done
 check "no agent_family anywhere (no slug means no family)" "yes" "$allblank"
 
 echo
diff --git a/tests/test_status_kiro_ps1.ps1 b/tests/test_status_kiro_ps1.ps1
new file mode 100644
index 0000000..82d495d
--- /dev/null
+++ b/tests/test_status_kiro_ps1.ps1
@@ -0,0 +1,309 @@
+#!/usr/bin/env pwsh
+# tests/test_status_kiro_ps1.ps1 - plugins/kiro/scripts/status.ps1 under a temp
+# USERPROFILE, in lockstep with tests/test_status_kiro_sh.sh.
+#
+# Kiro has no slash-command surface for a /rogue:status skill, so the status
+# command IS this script, and on Windows it is the one diagnostic path support
+# has. It POSTs /hooks/status, which upserts a roster row fingerprinted on
+# host|actor|family|agent - so the body it sends has to be the heartbeat's, or
+# the status run registers a second row for the install it is checking. The
+# last case here replays heartbeat.ps1 against the same home and compares the
+# two bodies byte for byte.
+#
+# Loaded through the ROGUE_PS_LIB_ONLY seam and driven by calling Invoke-Status,
+# with Invoke-WebRequest shadowed by a function that records the request and
+# answers a canned response; a fake kiro-cli on PATH answers the two subcommands
+# the script uses and records every call; the IDE install is a fixture reached
+# through ROGUE_KIRO_APP. Runs on any platform with PowerShell; validate.yml
+# also runs it under Windows PowerShell 5.1.
+
+$here = Split-Path -Parent $MyInvocation.MyCommand.Path
+$repo = Split-Path -Parent $here
+$work = Join-Path ([System.IO.Path]::GetTempPath()) ("rogue-kiro-status-" + [System.IO.Path]::GetRandomFileName())
+$bin  = Join-Path $work 'bin'
+New-Item -ItemType Directory -Path $bin -Force | Out-Null
+
+# The developer's own shell very likely exports a real key and knobs; only the
+# temp home's env file may configure the script under test.
+$saved = @{}
+foreach ($k in 'USERPROFILE','PATH','ROGUE_PS_LIB_ONLY','ROGUE_API_KEY','ROGUE_BASE_URL','ROGUE_ACTOR_EMAIL',
+               'ROGUE_ACTOR_NAME','ROGUE_LOG_FILE','ROGUE_LOG_DIR','ROGUE_HEARTBEAT_MIN_INTERVAL',
+               'KIRO_PLUGIN_ROOT','ROGUE_KIRO_APP','KIRO_FAKE_DEFAULT','KIRO_CLI_LOG') {
+    $saved[$k] = [Environment]::GetEnvironmentVariable($k)
+    if ($k -ne 'USERPROFILE' -and $k -ne 'PATH') { [Environment]::SetEnvironmentVariable($k, $null) }
+}
+$prevPath = $saved['PATH']
+
+# -- the fake toolchain --------------------------------------------------------
+# `--version` prints what kiro-cli 2.21.0 prints; `settings chat.defaultAgent`
+# prints the value quoted (as the real CLI does) or errors out when none is set.
+# Every call is appended to KIRO_CLI_LOG. A .ps1 resolves by bare name from PATH
+# on Windows; on Linux/macOS a sh shim beside it does.
+$fakeCli = Join-Path $bin 'kiro-cli.ps1'
+@'
+param([Parameter(ValueFromRemainingArguments = $true)][string[]]$Argv)
+if ($env:KIRO_CLI_LOG) { Add-Content -LiteralPath $env:KIRO_CLI_LOG -Value ($Argv -join ' ') }
+if ($Argv[0] -eq '--version') { Write-Output 'kiro-cli 2.21.0'; exit 0 }
+if ("$($Argv[0]) $($Argv[1])" -eq 'settings chat.defaultAgent') {
+    if ($env:KIRO_FAKE_DEFAULT) { Write-Output ('"' + $env:KIRO_FAKE_DEFAULT + '"'); exit 0 }
+    [Console]::Error.WriteLine('error: No value associated with chat.defaultAgent')
+    exit 1
+}
+exit 0
+'@ | Set-Content -LiteralPath $fakeCli -Encoding UTF8
+if ($env:OS -ne 'Windows_NT') {
+    $shim = Join-Path $bin 'kiro-cli'
+    [System.IO.File]::WriteAllText($shim, "#!/bin/sh`nexec pwsh -NoProfile -File `"$fakeCli`" `"`$@`"`n")
+    & chmod +x $shim
+}
+$withCli = $bin + [System.IO.Path]::PathSeparator + $prevPath
+# The inherited PATH minus every directory holding a kiro-cli, so "absent" is a
+# real case on a developer machine that has the CLI installed.
+$sep = [System.IO.Path]::PathSeparator
+$noCli = (($prevPath -split [regex]::Escape($sep)) | Where-Object {
+    $_ -and -not (Test-Path -LiteralPath (Join-Path $_ 'kiro-cli')) -and
+    -not (Test-Path -LiteralPath (Join-Path $_ 'kiro-cli.exe')) -and
+    -not (Test-Path -LiteralPath (Join-Path $_ 'kiro-cli.cmd'))
+}) -join $sep
+
+# The IDE install as heartbeat.ps1 reads it: <root>\resources\app\package.json.
+$ideRoot = Join-Path $work 'Kiro'
+New-Item -ItemType Directory -Path (Join-Path (Join-Path $ideRoot 'resources') 'app') -Force | Out-Null
+[System.IO.File]::WriteAllText((Join-Path (Join-Path (Join-Path $ideRoot 'resources') 'app') 'package.json'),
+    "{`n  `"name`": `"kiro`",`n  `"version`": `"1.0.437`"`n}`n")
+$noIde = Join-Path $work 'no-app'
+
+# Invoke-WebRequest, shadowed: functions win over cmdlets, so the script under
+# test calls this. Records the request; answers from $script:fakeCode/$fakeBody
+# the way the real cmdlet does - a 2xx as a response object, anything else as a
+# throw whose .Response carries the status, a transport failure as a bare throw.
+$script:fakeCode = 200
+$script:fakeBody = ''
+$script:sentUri = ''; $script:sentKey = ''; $script:sentBody = ''
+function Invoke-WebRequest {
+    [CmdletBinding()]
+    param($Uri, $Method, $Headers, $ContentType, $Body, [switch]$UseBasicParsing, $TimeoutSec)
+    $script:sentUri = [string]$Uri
+    $script:sentKey = [string]$Headers['x-rogue-api-key']
+    $script:sentBody = [System.Text.Encoding]::UTF8.GetString($Body)
+    if ($script:fakeCode -eq 200) {
+        return [pscustomobject]@{ StatusCode = 200; Content = $script:fakeBody }
+    }
+    $e = New-Object System.Exception 'canned failure'
+    if ($script:fakeCode -ne 0) {
+        $e | Add-Member -NotePropertyName Response -NotePropertyValue ([pscustomobject]@{ StatusCode = $script:fakeCode }) -Force
+    }
+    throw $e
+}
+
+$fails = 0
+$count = 0
+function Assert-Has {
+    param([string]$Needle, [string]$Hay, [string]$Label)
+    $script:count++
+    if ($Hay.Contains($Needle)) { Write-Host "  ok: $Label" }
+    else { Write-Host "FAIL [$Label]: expected <$Needle> in output"; $script:fails++ }
+}
+function Assert-Lacks {
+    param([string]$Needle, [string]$Hay, [string]$Label)
+    $script:count++
+    if (-not $Hay.Contains($Needle)) { Write-Host "  ok: $Label" }
+    else { Write-Host "FAIL [$Label]: found <$Needle>, which must not appear"; $script:fails++ }
+}
+function Assert-Eq {
+    param($Got, $Expected, [string]$Label)
+    $script:count++
+    if ([string]$Got -ceq [string]$Expected) { Write-Host "  ok: $Label" }
+    else { Write-Host "FAIL [$Label]: got <$Got>, expected <$Expected>"; $script:fails++ }
+}
+
+# -- a home with the plugin installed the way install.ps1 -Kiro leaves it ------
+function New-Home {  # sets $script:H and $script:PLUGIN; plugin staged, no Kiro wiring yet
+    param([string]$Name)
+    $script:H = Join-Path $work $Name
+    $script:PLUGIN = [System.IO.Path]::Combine($script:H, '.rogue', 'plugins', 'kiro')
+    New-Item -ItemType Directory -Path $script:PLUGIN -Force | Out-Null
+    New-Item -ItemType Directory -Path (Join-Path $script:H 'ws') -Force | Out-Null
+    Copy-Item -Path ([System.IO.Path]::Combine($repo, 'plugins', 'kiro', '*')) -Destination $script:PLUGIN -Recurse -Force
+    [System.IO.File]::WriteAllText((Join-Path $script:PLUGIN 'plugin.json'), "{`"name`":`"rogue`",`"version`":`"1.0.0`"}`n")
+    [System.IO.File]::WriteAllText((Join-Path $script:H '.rogue-env'), "export ROGUE_API_KEY=rsk_test1234`n")
+    $env:USERPROFILE = $script:H
+    $env:KIRO_CLI_LOG = Join-Path $script:H 'kiro-cli.log'
+}
+function Add-KiroWiring {  # the hook file, a rogue agent carrying the hooks, a log
+    $hooks  = [System.IO.Path]::Combine($script:H, '.kiro', 'hooks')
+    $agents = [System.IO.Path]::Combine($script:H, '.kiro', 'agents')
+    $wsAgents = [System.IO.Path]::Combine($script:H, 'ws', '.kiro', 'agents')
+    $logs = [System.IO.Path]::Combine($script:H, '.rogue', 'logs')
+    foreach ($d in @($hooks, $agents, $wsAgents, $logs)) { New-Item -ItemType Directory -Path $d -Force | Out-Null }
+    $bridge = [System.IO.Path]::Combine($script:PLUGIN, 'scripts', 'hook.ps1')
+    $cmd = "powershell -NoProfile -ExecutionPolicy Bypass -File \`"$($bridge -replace '\\', '\\')\`""
+    [System.IO.File]::WriteAllText((Join-Path $hooks 'rogue.json'), @"
+{
+  "version": "v1",
+  "hooks": [
+    {"name": "rogue-SessionStart", "trigger": "SessionStart", "action": {"type": "command", "command": "$cmd SessionStart kiro_ide"}, "timeout": 10},
+    {"name": "rogue-PreToolUse", "trigger": "PreToolUse", "action": {"type": "command", "command": "$cmd PreToolUse kiro_ide"}, "timeout": 10}
+  ]
+}
+"@)
+    [System.IO.File]::WriteAllText((Join-Path $agents 'rogue.json'), '{"name":"rogue","hooks":[{"name":"rogue-preToolUse","trigger":"preToolUse"}]}')
+    [System.IO.File]::WriteAllText((Join-Path $agents 'custom.json'), '{"name":"custom","hooks":[]}')
+    [System.IO.File]::WriteAllText((Join-Path $wsAgents 'ws.json'), '{"name":"ws","hooks":[{"name":"rogue-preToolUse","trigger":"preToolUse"}]}')
+    [System.IO.File]::WriteAllText((Join-Path $logs 'kiro.log'),
+        "2026-09-03T10:00:00Z provider=kiro surface=kiro_cli event=PreToolUse outcome=allow http=200`n")
+}
+
+# Loads THIS home's copy of status.ps1 through the seam (top-level, so its
+# $script: state is this file's) and runs it from the workspace directory - the
+# plugin root must come from the script's own path, not from where it was run.
+# Sets $out and $rc; resets the recorded request first.
+$env:ROGUE_PS_LIB_ONLY = '1'
+function Reset-Request { $script:sentUri = ''; $script:sentKey = ''; $script:sentBody = '' }
+$ErrorActionPreference = 'Stop'
+
+Write-Host "kiro status.ps1"
+
+# ============================================================================
+Write-Host "-- a fully wired CLI + IDE machine, default agent rogue ----------------"
+New-Home 'full'; Add-KiroWiring
+$env:PATH = $withCli; $env:ROGUE_KIRO_APP = $ideRoot; $env:KIRO_FAKE_DEFAULT = 'rogue'
+$script:fakeCode = 200
+$script:fakeBody = '{"ok":true,"connected":true,"organization":{"id":"org_123"},"agent":{"family":"kiro","agent":"kiro_cli","version":"1.0.0","latest_version":"1.2.0","update_available":true}}'
+Reset-Request
+Set-Location (Join-Path $H 'ws')
+. ([System.IO.Path]::Combine($PLUGIN, 'scripts', 'status.ps1'))
+$out = (Invoke-Status | Out-String); $rc = $script:statusExit
+Assert-Eq $rc 0 'exits 0'
+Assert-Has (Join-Path $H '.rogue-env') $out 'lists the per-user credential file'
+Assert-Has 'API key resolved: ...1234' $out "shows the key's last four characters only"
+Assert-Lacks 'rsk_test1234' $out 'never prints the whole key'
+Assert-Has 'kiro_cli' $out 'reports the CLI surface'
+Assert-Has 'kiro-cli 2.21.0' $out 'with the version kiro-cli --version prints'
+Assert-Has 'kiro_ide' $out 'reports the IDE surface'
+Assert-Has 'Kiro 1.0.437' $out "with the version from the install's package.json"
+Assert-Has 'rogue.json' $out 'names the hook file'
+Assert-Has 'present (2 Rogue hooks, surface kiro_ide)' $out 'counts the Rogue entries in the hook file and names their surface'
+Assert-Has 'agent configs with Rogue hooks         2' $out 'counts the agent configs carrying the hooks (home + workspace, not the one without)'
+Assert-Has 'default agent (2.x engine)             rogue - covered' $out 'reports the default agent as covered when its config carries the hooks'
+Assert-Has 'HTTP 200' $out 'reports the connection status code'
+Assert-Has 'organization: org_123' $out 'reports the organization'
+Assert-Has 'plugin 1.0.0 (latest 1.2.0, update available)' $out 'reports running vs latest and the update flag'
+Assert-Has 'provider=kiro surface=kiro_cli' $out 'tails the hook log'
+# The roster row it upserts must be the heartbeat's row.
+Assert-Has '/api/v1/hooks/status' $sentUri 'POSTs /hooks/status'
+Assert-Eq $sentKey 'rsk_test1234' 'authenticates with the resolved key'
+Assert-Has '"agent_family":"kiro"' $sentBody 'body names family kiro'
+Assert-Has '"agent":"kiro_cli"' $sentBody 'body keys the CLI surface when kiro-cli is present'
+Assert-Has '"version":"1.0.0"' $sentBody "body carries the plugin version from the PLUGIN's plugin.json, not the working directory's"
+Assert-Has '"agent_version":"2.21.0"' $sentBody 'body carries the Kiro build'
+Assert-Has '"default_agent":"rogue"' $sentBody 'body carries the default agent'
+Assert-Has '"host":"' $sentBody 'body carries the host'
+$statusBody = $sentBody
+
+Write-Host "-- the body is the heartbeat's, byte for byte ---------------------------"
+# heartbeat.ps1 replayed against the same home, the way Invoke-Main runs it
+# (minus TLS and the exit), with the surface the status run chose. Any field the
+# two disagree on is a second roster row for this install.
+Reset-Request
+. ([System.IO.Path]::Combine($PLUGIN, 'scripts', 'heartbeat.ps1')) 'kiro_cli' 'SessionStart'
+$script:pluginRoot = $PLUGIN
+$beaconLib = Get-BeaconLibrary
+if ($beaconLib) { . $beaconLib }
+Import-Credentials; Initialize-Beacon; Resolve-BaseUrl; Resolve-Actor; Resolve-Version; Resolve-Surface
+Send-Heartbeat
+Assert-Eq $sentBody $statusBody 'status.ps1 posts exactly the body heartbeat.ps1 posts'
+
+Write-Host "-- the default agent moved away from the hooked one ---------------------"
+New-Home 'moved'; Add-KiroWiring
+$env:KIRO_FAKE_DEFAULT = 'custom'
+Set-Location (Join-Path $H 'ws')
+. ([System.IO.Path]::Combine($PLUGIN, 'scripts', 'status.ps1'))
+$out = (Invoke-Status | Out-String)
+Assert-Has 'default agent (2.x engine)             custom - NOT covered' $out 'flags a default whose config carries no Rogue hooks'
+Assert-Has 'kiro-cli agent set-default rogue' $out 'names the fix'
+
+Write-Host "-- no default set, no IDE -----------------------------------------------"
+New-Home 'nodefault'; Add-KiroWiring
+$env:KIRO_FAKE_DEFAULT = $null; $env:ROGUE_KIRO_APP = $noIde
+Reset-Request
+Set-Location (Join-Path $H 'ws')
+. ([System.IO.Path]::Combine($PLUGIN, 'scripts', 'status.ps1'))
+$out = (Invoke-Status | Out-String)
+Assert-Has 'default agent (2.x engine)             (none set)' $out 'reports no default'
+Assert-Has 'kiro_ide    Kiro IDE not found' $out 'reports the IDE absent'
+Assert-Lacks '"default_agent"' $sentBody 'sends no default_agent when none is set'
+
+Write-Host "-- nothing wired: plugin present, Kiro never hooked ---------------------"
+New-Home 'bare'
+Set-Location (Join-Path $H 'ws')
+. ([System.IO.Path]::Combine($PLUGIN, 'scripts', 'status.ps1'))
+$out = (Invoke-Status | Out-String)
+Assert-Has 'rogue.json' $out 'still names the hook file'
+Assert-Has 'MISSING' $out 'reports the hook file missing'
+Assert-Has 'agent configs with Rogue hooks         0' $out 'counts zero hooked agent configs'
+Assert-Has 'install.ps1 -Kiro' $out 'points at the installer'
+Assert-Has '(no hook log yet)' $out 'reports an empty log without failing'
+
+Write-Host "-- unconfigured: no key anywhere ----------------------------------------"
+New-Home 'nokey'; Add-KiroWiring
+Remove-Item -LiteralPath (Join-Path $H '.rogue-env') -Force
+Reset-Request
+Set-Location (Join-Path $H 'ws')
+. ([System.IO.Path]::Combine($PLUGIN, 'scripts', 'status.ps1'))
+$out = (Invoke-Status | Out-String); $rc = $script:statusExit
+Assert-Has 'API key: not resolved' $out 'reports the missing key'
+Assert-Eq $rc 1 'exits non-zero when unconfigured'
+Assert-Eq $sentUri '' 'makes no request without a key'
+
+Write-Host "-- the key is rejected --------------------------------------------------"
+New-Home 'badkey'; Add-KiroWiring
+$script:fakeCode = 401; $script:fakeBody = '{"error":"Unauthorized"}'
+Set-Location (Join-Path $H 'ws')
+. ([System.IO.Path]::Combine($PLUGIN, 'scripts', 'status.ps1'))
+$out = (Invoke-Status | Out-String); $rc = $script:statusExit
+Assert-Has 'HTTP 401' $out 'reports the status code'
+Assert-Has 'invalid' $out 'explains a 401 as an invalid key'
+Assert-Eq $rc 1 'exits non-zero on a failed check'
+
+Write-Host "-- transport failure ----------------------------------------------------"
+New-Home 'offline'; Add-KiroWiring
+$script:fakeCode = 0; $script:fakeBody = ''
+Set-Location (Join-Path $H 'ws')
+. ([System.IO.Path]::Combine($PLUGIN, 'scripts', 'status.ps1'))
+$out = (Invoke-Status | Out-String); $rc = $script:statusExit
+Assert-Has 'HTTP 000' $out 'reports 000 for a request that never got an answer'
+Assert-Has 'network' $out 'explains 000 as a network problem'
+Assert-Eq $rc 1 'exits non-zero on a transport failure'
+
+Write-Host "-- kiro-cli absent, IDE present: the row keys on the IDE ----------------"
+New-Home 'ideonly'; Add-KiroWiring
+$env:PATH = $noCli; $env:ROGUE_KIRO_APP = $ideRoot
+$script:fakeCode = 200; $script:fakeBody = '{"ok":true}'
+Reset-Request
+Set-Location (Join-Path $H 'ws')
+if (Get-Command kiro-cli -ErrorAction SilentlyContinue) {
+    Write-Host '  skip: kiro-cli absent (a real kiro-cli is on PATH)'
+} else {
+    . ([System.IO.Path]::Combine($PLUGIN, 'scripts', 'status.ps1'))
+    $out = (Invoke-Status | Out-String)
+    Assert-Has 'kiro_cli    kiro-cli not found' $out 'reports the CLI absent'
+    Assert-Has '"agent":"kiro_ide"' $sentBody 'body keys the IDE surface'
+    Assert-Has '"agent_version":"1.0.437"' $sentBody 'body carries the IDE build'
+    Assert-Has 'default agent (2.x engine)             (kiro-cli not found)' $out 'no CLI means no default to report'
+}
+
+New-Home 'home-workspace'; Add-KiroWiring
+Set-Location $H
+. ([System.IO.Path]::Combine($PLUGIN, 'scripts', 'status.ps1'))
+Assert-Eq (Get-HookedAgentCount) 1 'running in the home directory counts each agent once'
+
+# -- teardown ------------------------------------------------------------------
+Set-Location $repo
+foreach ($k in $saved.Keys) { [Environment]::SetEnvironmentVariable($k, $saved[$k]) }
+Remove-Item -Recurse -Force $work -ErrorAction SilentlyContinue
+
+Write-Host ""
+if ($fails -eq 0) { Write-Host "test_status_kiro_ps1: all $count passed"; exit 0 }
+Write-Host "test_status_kiro_ps1: $fails of $count failed"
+exit 1
diff --git a/tests/test_status_kiro_sh.sh b/tests/test_status_kiro_sh.sh
new file mode 100644
index 0000000..2bba535
--- /dev/null
+++ b/tests/test_status_kiro_sh.sh
@@ -0,0 +1,223 @@
+#!/usr/bin/env bash
+# tests/test_status_kiro_sh.sh — plugins/kiro/scripts/status.sh under a temp HOME.
+#
+# Kiro has no slash-command surface for a /rogue:status skill, so the status
+# command IS this script, and it is the one diagnostic path support has on a
+# Kiro machine. Like the other plugins' status skills it also POSTs
+# /hooks/status, which upserts a roster row fingerprinted on
+# host|actor|family|agent - so the body it sends has to be the heartbeat's,
+# resolved through the same actor.sh / install-id.sh / kiro-host.sh, or the
+# status run registers a second row for the install it is checking.
+#
+# A fake `curl` on PATH records the request and answers a canned 200; a fake
+# `kiro-cli` answers the two subcommands the script uses; the IDE bundle is a
+# fixture reached through ROGUE_KIRO_APP. HOME is a temp dir, so nothing under
+# the developer's ~/.kiro or ~/.rogue is read or written.
+set -u
+REPO="$(cd "$(dirname "$0")/.." && pwd)"
+SH="${TEST_SH:-sh}"
+fails=0
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+
+ok()  { echo "  ok: $1"; }
+bad() { echo "FAIL [$1]: $2"; fails=$((fails + 1)); }
+assert_has()   { case "$2" in *"$1"*) ok "$3" ;; *) bad "$3" "expected <$1> in output" ;; esac; }
+assert_lacks() { case "$2" in *"$1"*) bad "$3" "found <$1>, which must not appear" ;; *) ok "$3" ;; esac; }
+
+# ── fake toolchain ───────────────────────────────────────────────────────────
+# PATH is a symlink farm plus the fakes, so a real kiro-cli or Kiro.app on the
+# developer's machine is never consulted and "kiro-cli absent" is a real case.
+BIN="$WORK/bin"; FARM="$WORK/farm"; mkdir -p "$BIN" "$FARM"
+for b in sh bash dash dirname basename date mkdir cat sed grep tr tail head awk wc hostname \
+         cp rm mv chmod find mktemp uname env printf ls touch sort defaults stat id od; do
+  src="$(command -v "$b" 2>/dev/null || true)"
+  [ -n "$src" ] && ln -s "$src" "$FARM/$(basename "$src")" 2>/dev/null
+done
+# Records the argument vector and the stdin body (`--data-binary @-`), then
+# answers like the route: a JSON body and, because the script asks for it with
+# -w, the status code on its own line.
+cat > "$BIN/curl" <<'STUB'
+#!/bin/sh
+printf '%s\n' "$*" >> "$CURL_LOG"
+for a in "$@"; do [ "$a" = "@-" ] && { cat >> "$CURL_LOG"; echo >> "$CURL_LOG"; }; done
+printf '%s\n%s' "${FAKE_BODY:-}" "${FAKE_CODE:-200}"
+STUB
+cat > "$BIN/kiro-cli" <<'STUB'
+#!/bin/sh
+case "$1 $2" in
+  "--version ")                echo "kiro-cli 2.21.0" ;;
+  "settings chat.defaultAgent") [ -n "${KIRO_FAKE_DEFAULT:-}" ] && { echo "\"$KIRO_FAKE_DEFAULT\""; exit 0; }
+                               echo "error: No value associated with chat.defaultAgent" >&2; exit 1 ;;
+esac
+exit 0
+STUB
+chmod +x "$BIN/curl" "$BIN/kiro-cli"
+
+APP="$WORK/Kiro.app"; mkdir -p "$APP/Contents"
+printf '<plist version="1.0"><dict><key>CFBundleShortVersionString</key><string>1.0.437</string></dict></plist>\n' \
+  > "$APP/Contents/Info.plist"
+
+# ── a HOME with the plugin installed the way install.sh --kiro leaves it ─────
+new_home() { # new_home <name> -> sets H, PLUGIN; plugin staged, no Kiro wiring yet
+  H="$WORK/$1"; PLUGIN="$H/.rogue/plugins/kiro"
+  mkdir -p "$PLUGIN" "$H/ws"
+  cp -R "$REPO/plugins/kiro/." "$PLUGIN/"
+  printf '{"name":"rogue","version":"1.0.0"}\n' > "$PLUGIN/plugin.json"
+  printf 'export ROGUE_API_KEY=rsk_test1234\n' > "$H/.rogue-env"
+}
+wire_kiro() { # the hook file, the Crew wrappers, a rogue agent carrying the hooks
+  mkdir -p "$H/.kiro/hooks" "$H/.kiro/agents" "$H/ws/.kiro/agents"
+  cat > "$H/.kiro/hooks/rogue.json" <<JSON
+{
+  "version": "v1",
+  "hooks": [
+    {"name": "rogue-SessionStart", "trigger": "SessionStart", "action": {"type": "command", "command": "\"$PLUGIN/scripts/hook.sh\" SessionStart kiro_ide"}, "timeout": 10},
+    {"name": "rogue-PreToolUse", "trigger": "PreToolUse", "action": {"type": "command", "command": "\"$PLUGIN/scripts/hook.sh\" PreToolUse kiro_ide"}, "timeout": 10}
+  ]
+}
+JSON
+  for w in pre post; do
+    printf '#!/bin/sh\n# event: PreToolUse\nexec %s/scripts/hook.sh PreToolUse kiro_crew\n' "$PLUGIN" > "$H/.kiro/hooks/rogue-crew-$w.sh"
+    chmod +x "$H/.kiro/hooks/rogue-crew-$w.sh"
+  done
+  printf '{"name":"rogue","hooks":[{"name":"rogue-preToolUse","trigger":"preToolUse"}]}\n' > "$H/.kiro/agents/rogue.json"
+  printf '{"name":"custom","hooks":[]}\n' > "$H/.kiro/agents/custom.json"
+  printf '{"name":"ws","hooks":[{"name":"rogue-preToolUse","trigger":"preToolUse"}]}\n' > "$H/ws/.kiro/agents/ws.json"
+  mkdir -p "$H/.rogue/logs"
+  printf '2026-09-03T10:00:00Z provider=kiro surface=kiro_cli event=PreToolUse outcome=allow http=200\n' \
+    > "$H/.rogue/logs/kiro.log"
+}
+
+# run_status [path] — runs the script from the workspace; sets out, RC and the
+# recorded curl calls (CURLS). Knobs travel as assignment prefixes on the call:
+# FAKE_BODY / FAKE_CODE (the canned response), KIRO_FAKE_DEFAULT, ROGUE_KIRO_APP.
+# Called directly, never inside $( ), so the three results survive.
+run_status() {
+  : > "$H/curl.log"
+  ( cd "${STATUS_CWD:-$H/ws}" && env -i HOME="$H" PATH="${1:-$BIN:$FARM}" CURL_LOG="$H/curl.log" \
+      ROGUE_KIRO_APP="${ROGUE_KIRO_APP:-$WORK/no-app}" KIRO_FAKE_DEFAULT="${KIRO_FAKE_DEFAULT:-}" \
+      FAKE_BODY="${FAKE_BODY:-}" FAKE_CODE="${FAKE_CODE:-200}" \
+      "$SH" "$PLUGIN/scripts/status.sh" ) > "$H/out" 2>&1
+  RC=$?
+  out=$(cat "$H/out")
+  CURLS=$(cat "$H/curl.log")
+}
+
+echo "kiro status.sh ($SH)"
+[ -f "$REPO/plugins/kiro/scripts/status.sh" ] || { bad "status.sh exists" "missing plugins/kiro/scripts/status.sh"; echo "$fails failure(s)"; exit 1; }
+"$SH" -n "$REPO/plugins/kiro/scripts/status.sh" || bad "status.sh parses under $SH" "syntax error"
+
+# ═════════════════════════════════════════════════════════════════════════════
+echo "── a fully wired CLI + IDE machine, default agent rogue ─────────────────"
+new_home full; wire_kiro
+FAKE_BODY='{"ok":true,"connected":true,"organization":{"id":"org_123"},"agent":{"family":"kiro","agent":"kiro_cli","version":"1.0.0","latest_version":"1.2.0","update_available":true}}'
+FAKE_BODY="$FAKE_BODY" KIRO_FAKE_DEFAULT=rogue ROGUE_KIRO_APP="$APP" run_status
+[ "$RC" = 0 ] && ok "exits 0" || bad "exits 0" "rc=$RC: $out"
+assert_has "$H/.rogue-env"                     "$out" "lists the per-user credential file"
+assert_has 'API key resolved: ...1234'         "$out" "shows the key's last four characters only"
+assert_lacks 'rsk_test1234'                    "$out" "never prints the whole key"
+assert_has 'kiro_cli'                          "$out" "reports the CLI surface"
+assert_has 'kiro-cli 2.21.0'                   "$out" "with the version kiro-cli --version prints"
+assert_has 'kiro_ide'                          "$out" "reports the IDE surface"
+assert_has 'Kiro.app 1.0.437'                  "$out" "with the version from the app bundle"
+assert_has 'rogue.json'                        "$out" "names the hook file"
+assert_has 'present (2 Rogue hooks, surface kiro_ide)' "$out" "counts the Rogue entries in the hook file and names their surface"
+assert_has 'rogue-crew-{pre,post}.sh'          "$out" "names the Crew wrappers"
+assert_has 'present, executable'               "$out" "reports the wrappers present and executable"
+assert_has 'agent configs with Rogue hooks         2' "$out" "counts the agent configs carrying the hooks (home + workspace, not the one without)"
+assert_has 'default agent (2.x engine)             rogue - covered' "$out" "reports the default agent as covered when its config carries the hooks"
+assert_has 'HTTP 200'                          "$out" "reports the connection status code"
+assert_has 'organization: org_123'             "$out" "reports the organization"
+assert_has 'plugin 1.0.0 (latest 1.2.0, update available)' "$out" "reports running vs latest and the update flag"
+assert_has 'provider=kiro surface=kiro_cli'    "$out" "tails the hook log"
+# The roster row it upserts must be the heartbeat's row.
+assert_has '/api/v1/hooks/status'              "$CURLS" "POSTs /hooks/status"
+assert_has 'x-rogue-api-key: rsk_test1234'     "$CURLS" "authenticates with the resolved key"
+assert_has '"agent_family":"kiro"'             "$CURLS" "body names family kiro"
+assert_has '"agent":"kiro_cli"'                "$CURLS" "body keys the CLI surface when kiro-cli is present"
+assert_has '"version":"1.0.0"'                 "$CURLS" "body carries the plugin version from plugin.json"
+assert_has '"agent_version":"2.21.0"'          "$CURLS" "body carries the Kiro build"
+assert_has '"default_agent":"rogue"'           "$CURLS" "body carries the default agent"
+assert_has '"host":"'                          "$CURLS" "body carries the host"
+
+echo "── the body is the heartbeat's, byte for byte ───────────────────────────"
+# heartbeat.sh run against the same home and fakes, with the surface the status
+# run chose. Any field the two disagree on is a second roster row for this
+# install - which is why kiro-host.sh holds the one builder both call.
+status_json=$(grep -o '{"agent_family.*}' "$H/curl.log" | head -n1)
+: > "$H/curl.log"
+( cd "${STATUS_CWD:-$H/ws}" && env -i HOME="$H" PATH="$BIN:$FARM" CURL_LOG="$H/curl.log" \
+    ROGUE_KIRO_APP="$APP" KIRO_FAKE_DEFAULT=rogue \
+    "$SH" "$PLUGIN/scripts/heartbeat.sh" kiro_cli SessionStart ) >/dev/null 2>&1
+heartbeat_json=$(grep -o '{"agent_family.*}' "$H/curl.log" | head -n1)
+[ -n "$heartbeat_json" ] && ok "heartbeat.sh posted a body" || bad "heartbeat.sh posted a body" "no body in $(cat "$H/curl.log")"
+[ "$status_json" = "$heartbeat_json" ] && ok "status.sh posts exactly the body heartbeat.sh posts" \
+  || bad "status.sh posts exactly the body heartbeat.sh posts" "status=$status_json heartbeat=$heartbeat_json"
+
+echo "── the default agent moved away from the hooked one ─────────────────────"
+new_home moved; wire_kiro
+FAKE_BODY="$FAKE_BODY" KIRO_FAKE_DEFAULT=custom run_status
+assert_has 'default agent (2.x engine)             custom - NOT covered' "$out" "flags a default whose config carries no Rogue hooks"
+assert_has 'kiro-cli agent set-default rogue'  "$out" "names the fix"
+
+echo "── no default set, no IDE ───────────────────────────────────────────────"
+new_home nodefault; wire_kiro
+FAKE_BODY="$FAKE_BODY" run_status
+assert_has 'default agent (2.x engine)             (none set)' "$out" "reports no default"
+assert_has 'kiro_ide    Kiro.app not found'    "$out" "reports the IDE absent"
+assert_lacks '"default_agent"'                 "$CURLS" "sends no default_agent when none is set"
+
+echo "── nothing wired: plugin present, Kiro never hooked ─────────────────────"
+new_home bare
+FAKE_BODY="$FAKE_BODY" run_status
+assert_has 'rogue.json'                        "$out" "still names the hook file"
+assert_has 'MISSING'                           "$out" "reports the hook file missing"
+assert_has 'agent configs with Rogue hooks         0' "$out" "counts zero hooked agent configs"
+assert_has 'install.sh --kiro'                 "$out" "points at the installer"
+assert_has '(no hook log yet)'                 "$out" "reports an empty log without failing"
+
+echo "── unconfigured: no key anywhere ────────────────────────────────────────"
+new_home nokey; wire_kiro; rm -f "$H/.rogue-env"
+run_status
+assert_has 'API key: not resolved'             "$out" "reports the missing key"
+[ "$RC" != 0 ] && ok "exits non-zero when unconfigured" || bad "exits non-zero when unconfigured" "rc=0"
+[ -z "$CURLS" ] && ok "makes no request without a key" || bad "makes no request without a key" "$CURLS"
+
+echo "── the key is rejected ──────────────────────────────────────────────────"
+new_home badkey; wire_kiro
+FAKE_BODY='{"error":"Unauthorized"}' FAKE_CODE=401 run_status
+assert_has 'HTTP 401'                          "$out" "reports the status code"
+assert_has 'invalid'                           "$out" "explains a 401 as an invalid key"
+[ "$RC" != 0 ] && ok "exits non-zero on a failed check" || bad "exits non-zero on a failed check" "rc=0"
+
+echo "── transport failure ────────────────────────────────────────────────────"
+new_home offline; wire_kiro
+FAKE_BODY='' FAKE_CODE=000 run_status
+assert_has 'HTTP 000'                          "$out" "reports curl's 000"
+assert_has 'network'                           "$out" "explains 000 as a network problem"
+[ "$RC" != 0 ] && ok "exits non-zero on a transport failure" || bad "exits non-zero on a transport failure" "rc=0"
+
+echo "── kiro-cli absent, IDE present: the row keys on the IDE ────────────────"
+new_home ideonly; wire_kiro
+NOCLI="$WORK/bin-nocli"; mkdir -p "$NOCLI"; cp "$BIN/curl" "$NOCLI/curl"
+FAKE_BODY="$FAKE_BODY" ROGUE_KIRO_APP="$APP" run_status "$NOCLI:$FARM"
+assert_has 'kiro_cli    kiro-cli not found'    "$out" "reports the CLI absent"
+assert_has '"agent":"kiro_ide"'                "$CURLS" "body keys the IDE surface"
+assert_has '"agent_version":"1.0.437"'         "$CURLS" "body carries the IDE build"
+assert_has 'default agent (2.x engine)             (kiro-cli not found)' "$out" "no CLI means no default to report"
+
+new_home same-directory; wire_kiro
+STATUS_CWD="$H" FAKE_BODY='{"ok":true}' run_status
+assert_has 'agent configs with Rogue hooks         1' "$out" "home workspace is counted once"
+
+# Exercise the real body builder with characters that must be JSON-escaped.
+body=$(env -i PATH="$PATH" SURFACE=kiro_ide ROGUE_KIRO_APP="$WORK/no-app" \
+  ROGUE_ACTOR_NAME="$(printf 'Test\tName\n\001')" \
+  sh -c '. "$1"; rogue_kiro_status_body' sh "$PLUGIN/scripts/kiro-host.sh")
+if printf '%s' "$body" | python3 -c 'import json,sys; assert json.load(sys.stdin)["actor_name"] == "Test\tName\n\x01"'; then
+  ok "body builder preserves JSON control characters"
+else bad "body builder preserves JSON control characters" "invalid or changed JSON"; fi
+
+echo ""
+if [ "$fails" = 0 ]; then echo "kiro status.sh: all checks passed"; else echo "kiro status.sh: $fails failure(s)"; exit 1; fi