feat(kiro): Kiro plugin: roster wiring and release (FIRE-2036)

.github/workflows/validate.yml

@@ -98,6 +98,11 @@ jobs:
           TEST_SH=dash bash tests/test_actor_sh.sh
           TEST_SH=dash bash tests/test_install_id_sh.sh
           TEST_SH=dash bash tests/test_status_skill_sh.sh
+          # Kiro has no slash-command surface, so its status command is a script
+          # rather than a skill document; both shells, since a developer runs it
+          # by hand under bash and a managed rollout verifies under /bin/sh.
+          TEST_SH=dash bash tests/test_status_kiro_sh.sh
+          TEST_SH=bash bash tests/test_status_kiro_sh.sh
           bash tests/test_plugin_versions_sh.sh
           # Twice, because hooks.json fires auto-update.sh as `sh <script>` - an
           # explicit interpreter overrides its bash shebang, so production really
@@ -199,7 +204,9 @@ jobs:
         # gate an edit to scripts/shared/ that was never propagated ships five stale
         # copies, and an edit made directly to a plugin's copy is silently reverted by
         # the next sync — neither is visible in review.
-        run: bash scripts/sync-shared-scripts.sh --check
+        run: |
+          bash scripts/sync-shared-scripts.sh --check
+          bash tests/test_env_file_trust.sh
 
       - name: Hook-log contract (sh + mjs dispatchers)
         # The per-agent log file, line format and rotation policy are duplicated
@@ -335,7 +342,9 @@ jobs:
           pwsh -NoProfile -File tests/test_heartbeat_ps1.ps1
           pwsh -NoProfile -File tests/test_auto_update_ps1.ps1
           pwsh -NoProfile -File tests/test_setup_env.ps1
+          pwsh -NoProfile -File tests/test_env_file_trust.ps1
           pwsh -NoProfile -File tests/test_install_kiro_ps1.ps1
+          pwsh -NoProfile -File tests/test_status_kiro_ps1.ps1
 
   windows:
     # The job the seam CANNOT stand in for. Every PowerShell test in the job above
@@ -390,5 +399,9 @@ jobs:
           if ($LASTEXITCODE -ne 0) { exit 1 }
           powershell -NoProfile -File tests/test_setup_env.ps1
           if ($LASTEXITCODE -ne 0) { exit 1 }
+          powershell -NoProfile -File tests/test_env_file_trust.ps1
+          if ($LASTEXITCODE -ne 0) { exit 1 }
           powershell -NoProfile -File tests/test_install_kiro_ps1.ps1
           if ($LASTEXITCODE -ne 0) { exit 1 }
+          powershell -NoProfile -File tests/test_status_kiro_ps1.ps1
+          if ($LASTEXITCODE -ne 0) { exit 1 }

README.md

@@ -45,6 +45,8 @@ and writes your API key, confirms your actor identity, and on macOS/Linux
 configures a `Rogue Security` status badge below the Claude prompt
 (🟢 connected / 🔴 not set up).
 
+On macOS, Linux, and WSL, `install.sh` requires Node.js to merge Kiro CLI 2.x agent hooks. Without Node.js, the installer skips those hooks and CLI 2.x sessions are not covered. Install Node.js and re-run the installer. The Windows `install.ps1` merge uses PowerShell and does not require Node.js.
+
 To target specific agents instead of all detected ones, pass `--claude`, `--codex`,
 `--cursor`, `--gemini`, `--copilot`, `--antigravity` and/or `--kiro` (PowerShell:
 `-Claude` / `-Codex` / `-Cursor` / `-Gemini` / `-Copilot` / `-Antigravity` / `-Kiro`):

docs/log-shipping.md

@@ -149,7 +149,7 @@ the one path. This is the same precedence the eleven dispatchers implement and
 ROGUE_LOG_DIR"), and its basename is arbitrary — so, exactly as for the plugin
 shipper, that file's lines are attributed per line off `provider=`, never per file.
 
-Otherwise glob `<dir>/{claude,codex,cursor,gemini,copilot,antigravity}.log` plus each
+Otherwise glob `<dir>/{claude,codex,cursor,gemini,copilot,antigravity,kiro}.log` plus each
 `.1`. Ship `.1` **before** its live file so the batch stays chronological.
 
 **Payload.** Let the task narrow the request, all optional:

docs/plugin-log-shipper.md

@@ -12,8 +12,8 @@ ever matters.
 ## Files
 
 ```text
-plugins/{rogue,codex,cursor,copilot,antigravity}/scripts/ship-logs.sh    byte-identical ×5
-plugins/{rogue,codex,cursor,copilot,antigravity}/scripts/ship-logs.ps1   byte-identical ×5
+plugins/{rogue,codex,cursor,copilot,antigravity,kiro}/scripts/ship-logs.sh    byte-identical ×6
+plugins/{rogue,codex,cursor,copilot,antigravity,kiro}/scripts/ship-logs.ps1   byte-identical ×6
 plugins/gemini/scripts/ship-logs.mjs                                     Node-only, per repo rule
 tests/test_ship_logs.sh
 tests/test_ship_logs.ps1
@@ -23,7 +23,7 @@ Callers (one line each, no `hooks.json` change anywhere):
 
 | plugin | call site |
 |---|---|
-| claude, codex, copilot, antigravity | `scripts/heartbeat.sh` / `heartbeat.ps1` |
+| claude, codex, copilot, antigravity, kiro | `scripts/heartbeat.sh` / `heartbeat.ps1` |
 | gemini | `scripts/heartbeat.mjs` |
 | cursor | the inline beacon block in `hook.sh` / `hook.ps1` (it has no heartbeat script) |
 

install.ps1

@@ -141,9 +141,25 @@ function New-KiroHookEntries {
 
 # UTF-8 without BOM: Windows PowerShell 5.1's Set-Content -Encoding UTF8 writes one,
 # and a BOM is not JSON.
+# PowerShell 5.1 silently stringifies objects beyond ConvertTo-Json's limit.
+# Reject those configurations before touching the user's file.
+function Assert-KiroJsonDepth {
+    param($Value, [int]$Depth = 0)
+    if ($null -eq $Value -or $Value -is [string] -or $Value -is [ValueType]) { return }
+    if ($Depth -gt 100) { throw 'Kiro agent configuration exceeds the supported JSON depth (100).' }
+    if ($Value -is [System.Collections.IDictionary]) {
+        foreach ($child in $Value.Values) { Assert-KiroJsonDepth $child ($Depth + 1) }
+    } elseif ($Value -is [System.Collections.IList]) {
+        foreach ($child in $Value) { Assert-KiroJsonDepth $child ($Depth + 1) }
+    } else {
+        foreach ($property in $Value.PSObject.Properties) { Assert-KiroJsonDepth $property.Value ($Depth + 1) }
+    }
+}
+
 function Write-KiroJsonFile {
     param([string]$Path, $Document)
-    $json = $Document | ConvertTo-Json -Depth 10
+    Assert-KiroJsonDepth $Document
+    $json = $Document | ConvertTo-Json -Depth 100 -ErrorAction Stop
     [System.IO.File]::WriteAllText($Path, $json + "`n", (New-Object System.Text.UTF8Encoding($false)))
 }
 
@@ -182,7 +198,8 @@ function Merge-KiroAgentHooks {
     $merged = @($kept + $Entries)
     if ($prop) { $prop.Value = $merged }
     else { $cfg | Add-Member -NotePropertyName hooks -NotePropertyValue $merged }
-    Write-KiroJsonFile $File $cfg
+    try { Write-KiroJsonFile $File $cfg }
+    catch { Warn2 "Leaving $File unchanged: $($_.Exception.Message)"; return 'unparseable' }
     return 'merged'
 }
 
@@ -207,9 +224,18 @@ function Invoke-KiroCli {
     param([string[]]$CliArgs)
     $prev = $ErrorActionPreference
     $ErrorActionPreference = 'Continue'
-    try { $out = (& kiro-cli @CliArgs 2>$null | Out-String).Trim() } catch { $out = '' }
-    finally { $ErrorActionPreference = $prev }
-    return @{ Output = $out; ExitCode = $LASTEXITCODE }
+    $errFile = [System.IO.Path]::GetTempFileName()
+    $code = 1; $out = ''; $err = ''
+    try {
+        $out = (& kiro-cli @CliArgs 2>$errFile | Out-String).Trim()
+        $code = $LASTEXITCODE
+        $err = (Get-Content -Raw -LiteralPath $errFile -ErrorAction SilentlyContinue)
+    } catch { $err = $_.Exception.Message }
+    finally {
+        $ErrorActionPreference = $prev
+        Remove-Item -LiteralPath $errFile -Force -ErrorAction SilentlyContinue
+    }
+    return @{ Output = $out; Error = $err; ExitCode = $code }
 }
 
 # ADR 0001: the built-in default agent cannot carry hooks, so a `rogue` agent is
@@ -222,12 +248,13 @@ function Install-KiroRogueAgent {
     # on an editor window. Unverified on Windows hardware (FIRE-2038).
     $prevEditor = $env:EDITOR; $prevVisual = $env:VISUAL
     $env:EDITOR = 'cmd /c exit'; $env:VISUAL = $env:EDITOR
-    try { $null = Invoke-KiroCli @('agent', 'create', '--name', 'rogue') }
+    try { $res = Invoke-KiroCli @('agent', 'create', '--name', 'rogue') }
     finally { $env:EDITOR = $prevEditor; $env:VISUAL = $prevVisual }
     if (-not (Test-Path -LiteralPath $cfg)) {
         # kiro-cli 2.21.0 refuses `agent create` when it is not logged in, so this
         # is the ordinary first-run path on a fresh machine.
         Warn2 "kiro-cli agent create --name rogue failed - plain 'kiro-cli chat' on the 2.x engine will carry no Rogue hooks."
+        if ($res.Error) { Log $res.Error }
         Log 'If kiro-cli is not logged in, run kiro-cli login and re-run this installer; the default agent is left as it is.'
         return $false
     }
@@ -755,6 +782,7 @@ if ($hasKiro) {
         Ok "Plugin installed -> $pluginDir"
         Install-KiroHooks -PluginDir $pluginDir -WorkspaceDir (Get-Location).Path
         Warn2 'Kiro loads hooks at start: restart the IDE and open a new kiro-cli chat. IDE hooks never run in an untrusted workspace.'
+        Log "Verify with: powershell -NoProfile -ExecutionPolicy Bypass -File `"$pluginDir\scripts\status.ps1`""
     } catch {
         Warn2 "Kiro plugin not installed ($($_.Exception.Message)). If the asset isn't published yet, re-run the installer once it is."
     } finally {

install.sh

@@ -969,6 +969,7 @@ install_kiro() {
   fi
   note "Kiro loads hooks at start: restart the IDE / Crew, and open a new ${C_DIM}kiro-cli chat${C_RESET}."
   note "IDE: hooks never run in an untrusted workspace — trust the workspace first."
+  note "Verify with ${C_DIM}sh \"$KIRO_PLUGIN_DIR/scripts/status.sh\"${C_RESET} (surfaces, hook wiring, default agent, API key)."
 }
 
 # ── CLI flags ─────────────────────────────────────────────────────────────────

plugins/antigravity/scripts/env-file.ps1

@@ -1,3 +1,44 @@
+# A Windows PowerShell child can inherit PowerShell 7's PSModulePath. Load
+# this engine's ACL cmdlets explicitly instead of resolving an incompatible module.
+if ($PSVersionTable.PSVersion.Major -eq 5) {
+    Import-Module (Join-Path $PSHOME 'Modules\Microsoft.PowerShell.Security\Microsoft.PowerShell.Security.psd1') -ErrorAction Stop
+}
+
+# Reject files writable by identities other than the current user or Windows
+# administrators/system. System-wide configuration cannot be user-owned.
+function Test-RogueEnvFile {
+    param([string]$Path, [switch]$System)
+    try {
+        if (-not (Test-Path -LiteralPath $Path -PathType Leaf)) { return $false }
+        if ($PSVersionTable.PSVersion.Major -ge 6 -and -not $IsWindows) {
+            $info = & stat -Lc '%u %a' $Path 2>$null
+            if ($LASTEXITCODE -ne 0) { $info = & stat -Lf '%u %Lp' $Path 2>$null }
+            if ($LASTEXITCODE -ne 0 -or $info -notmatch '^(\d+) ([0-7]+)$') { return $false }
+            $ownerId = $Matches[1]; $mode = [Convert]::ToInt32($Matches[2], 8)
+            return (($ownerId -eq '0' -or (-not $System -and $ownerId -eq (& id -u))) -and ($mode -band 18) -eq 0)
+        }
+        $acl = Get-Acl -LiteralPath $Path -ErrorAction Stop
+        $user = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value
+        $admins = @('S-1-5-18', 'S-1-5-32-544')
+        $trusted = @($admins) + $user
+        $owner = $acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value
+        if ($owner -notin $trusted -or ($System -and $owner -notin $admins)) { return $false }
+        $write = [System.Security.AccessControl.FileSystemRights]'Write, Delete, ChangePermissions, TakeOwnership, DeleteSubdirectoriesAndFiles'
+        foreach ($rule in $acl.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier])) {
+            if ($rule.AccessControlType -eq 'Allow' -and ($rule.FileSystemRights -band $write) -and
+                $rule.IdentityReference.Value -notin $trusted) { return $false }
+        }
+        return $true
+    } catch { return $false }
+}
+
+function Read-RogueEnvFile {
+    param([string]$Path)
+    if (Test-RogueEnvFile $Path -System:($Path -eq 'C:\ProgramData\rogue\env')) {
+        Get-Content -LiteralPath $Path -Encoding UTF8 -ErrorAction SilentlyContinue
+    }
+}
+
 function Format-RogueEnvValue {
     param([string]$Value)
     return "'" + $Value.Replace("'", "'\''") + "'"
@@ -7,16 +48,18 @@ function Protect-RogueEnvFile {
     param([string]$Path)
     $script:RogueEnvProtectError = ''
     try {
-        $acl = Get-Acl $Path
+        $acl = Get-Acl -LiteralPath $Path -ErrorAction Stop
         $acl.SetAccessRuleProtection($true, $false)
-        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule(
-            [System.Security.Principal.WindowsIdentity]::GetCurrent().Name,
-            'FullControl', 'Allow')
+        $rule = [System.Security.AccessControl.FileSystemAccessRule]::new(
+            [System.Security.Principal.WindowsIdentity]::GetCurrent().User,
+            [System.Security.AccessControl.FileSystemRights]::FullControl,
+            [System.Security.AccessControl.AccessControlType]::Allow)
         $acl.SetAccessRule($rule)
-        Set-Acl $Path $acl
+        Set-Acl -LiteralPath $Path -AclObject $acl -ErrorAction Stop
         return $true
     } catch {
         $script:RogueEnvProtectError = $_.Exception.Message
+        Write-Warning "Could not restrict credential file permissions: $script:RogueEnvProtectError"
         return $false
     }
 }

plugins/antigravity/scripts/env-file.sh

@@ -1,5 +1,24 @@
 #!/usr/bin/env sh
 
+# Only the current user or root may supply executable configuration. System
+# configuration must belong to root; neither group nor other may write it.
+rogue_env_is_trusted() (
+  [ -f "$1" ] && [ -r "$1" ] || exit 1
+  info=$(stat -Lc '%u %a' "$1" 2>/dev/null) || info=$(stat -Lf '%u %Lp' "$1" 2>/dev/null) || exit 1
+  owner=${info%% *}; mode=${info#* }
+  case "$owner:$mode" in *[!0-9:]*|:*) exit 1 ;; esac
+  case "$1:${2:-0}" in /etc/rogue/env:*|*:1) [ "$owner" = 0 ] || exit 1 ;; esac
+  [ "$owner" = 0 ] || [ "$owner" = "$(id -u)" ] || exit 1
+  [ "$((0$mode & 022))" = 0 ]
+)
+
+rogue_source_env() {
+  if rogue_env_is_trusted "$1" "${2:-0}"; then
+    . "$1"
+  fi
+  return 0
+}
+
 rogue_env_quote() {
   printf "'%s'" "$(printf '%s' "$1" | sed "s/'/'\\\\''/g")"
 }

plugins/antigravity/scripts/ship-logs.ps1

@@ -55,7 +55,7 @@ $ProgressPreference = 'SilentlyContinue'
 
 # ── constants ──────────────────────────────────────────────────────────────
 $SHIP_ENDPOINT_PATH = '/api/v1/hooks/logs'
-$KNOWN_LOG_SLUGS = @('claude', 'codex', 'cursor', 'gemini', 'copilot', 'antigravity')
+$KNOWN_LOG_SLUGS = @('claude', 'codex', 'cursor', 'gemini', 'copilot', 'antigravity', 'kiro')
 # Bytes scanned when fingerprinting a log's first line. NOT 200: a real log line is
 # timestamp + provider + event + up to 400 chars of `raw=`, i.e. commonly 500-700
 # bytes, so a 200-byte window would find no newline in a typical log's first line
@@ -329,14 +329,17 @@ $SHIP_ENV_VARS = @(
     'ROGUE_SHIP_ALL')
 
 function Import-ShipEnv {
+    $envLibrary = Join-Path $PluginRoot 'scripts/env-file.ps1'
+    if ($PSCommandPath) { $envLibrary = Join-Path (Split-Path -Parent $PSCommandPath) 'env-file.ps1' }
+    . ([scriptblock]::Create((Get-Content -Raw -LiteralPath $envLibrary)))
     $resolved = @{}
     $envFiles = @(
         (Join-Path $PluginRoot 'env'),
         'C:\ProgramData\rogue\env',
         (Join-Path (Get-UserHome) '.rogue-env'))
     foreach ($envFile in $envFiles) {
         if (-not $envFile -or -not (Test-Path -LiteralPath $envFile)) { continue }
-        foreach ($line in (Get-Content -LiteralPath $envFile)) {
+        foreach ($line in (Read-RogueEnvFile $envFile)) {
             if ($line -match '^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.*)$') {
                 $resolved[$Matches[1]] = ConvertFrom-ShellQuoted ($Matches[2].Trim())
             }

plugins/antigravity/scripts/ship-logs.sh

@@ -54,7 +54,7 @@ set -u
 
 # ── constants ──────────────────────────────────────────────────────────────
 SHIP_ENDPOINT_PATH="/api/v1/hooks/logs"
-KNOWN_LOG_SLUGS="claude codex cursor gemini copilot antigravity"
+KNOWN_LOG_SLUGS="claude codex cursor gemini copilot antigravity kiro"
 # Bytes scanned when fingerprinting a log's first line. NOT the 200 an earlier
 # draft of the design doc specified: a real log line is timestamp + provider +
 # event + up to 400 chars of `raw=`, i.e. commonly 500-700 bytes, so a 200-byte
@@ -127,9 +127,10 @@ log() {
   # visible.
   debug "$*"
   [ -n "$SELF_LOG_FILE" ] || return 0
-  mkdir -p "$(dirname "$SELF_LOG_FILE")" 2>/dev/null
-  printf '%s provider=%s event=ShipLogs %s\n' \
-    "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$SHIPPER_SLUG" "$*" >> "$SELF_LOG_FILE" 2>/dev/null
+  ( umask 077
+    mkdir -p "$(dirname "$SELF_LOG_FILE")" 2>/dev/null
+    printf '%s provider=%s event=ShipLogs %s\n' \
+    "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$SHIPPER_SLUG" "$*" >> "$SELF_LOG_FILE" 2>/dev/null )
   return 0
 }
 
@@ -299,11 +300,13 @@ ROGUE_SHIP_MAX_BYTES ROGUE_SHIP_MAX_RUN_BYTES ROGUE_SHIP_MAX_LINE_BYTES
 ROGUE_SHIP_ALL'
 
 load_env() {
+  [ -r "$(dirname "$0")/env-file.sh" ] || return 0
+  . "$(dirname "$0")/env-file.sh"
   for _env_var_name in $SHIP_ENV_VARS; do
     eval "_process_env_$_env_var_name=\${$_env_var_name:-}"
   done
   for _env_file in "$PLUGIN_ROOT/env" /etc/rogue/env "$HOME/.rogue-env"; do
-    [ -n "$_env_file" ] && [ -r "$_env_file" ] && . "$_env_file" 2>/dev/null
+    rogue_source_env "$_env_file" 2>/dev/null
   done
   for _env_var_name in $SHIP_ENV_VARS; do
     eval "[ -n \"\${_process_env_$_env_var_name:-}\" ] && $_env_var_name=\$_process_env_$_env_var_name"