Repository navigation
Conversation
…s and start logic - Replace the agentapi module with coder-utils; drop Tasks/web-app inputs, the start script, and the task-reporting coder MCP server. - Install via the official installer for latest; pinned versions and mirrors use the release archive. - Make workdir optional; add mcp (merged into ~/.kiro/settings/mcp.json) and api_key (KIRO_API_KEY). - Keep agent_config and auth_tarball; the tarball is read from its env var instead of being rendered into the script. - Add scripts output, rewrite README and tests, bump to 2.0.0.
Module Scorecard Check
|
| Presentation & Onboarding | Agent Integration | Credential Hygiene | Restricted-Environment Readiness | Engineering Quality | Overall |
|---|---|---|---|---|---|
| 12 / 17 | 10 / 25 | 20 / 20 | 12 / 20 | 7 / 10 | 66 / 100 |
Drilldown
Presentation & Onboarding — 12 / 17
| Criterion | Max | Score | Notes |
|---|---|---|---|
| Configuration-mode examples | 12 | 12 | README shows distinct documented modes: standalone launcher (coder_app), custom agent config with MCP servers, pinned version/internal mirror, and downstream script serialization via scripts output — each with sensible defaults and context. |
| Visual preview | 5 | 0 | No image, GIF, or video anywhere in the README. |
Credential Hygiene — 20 / 20
| Criterion | Max | Score | Notes |
|---|---|---|---|
| Secrets marked sensitive | 16 | 16 | auth_tarball and api_key are sensitive = true; all README examples reference var.kiro_cli_auth_tarball/env vars rather than inline literal secrets, and tests assert secrets never land in rendered scripts. |
| Non-hardcoded auth path | 4 | 4 | README documents kiro-cli login flow and generating a pre-authenticated tarball as alternatives to hardcoding API keys. |
Restricted-Environment Readiness — 12 / 20
| Criterion | Max | Score | Notes |
|---|---|---|---|
| Mirrorable artifact source | 5 | 5 | kiro_install_url variable overrides the base download URL used in install_from_archive (${base_url}/${ARG_VERSION}/kirocli-${arch}-linux.zip); README's "Pinned version or internal mirror" example demonstrates pointing it at https://artifacts.internal.corp/kiro-cli-releases. |
| Bring-your-own binary | 10 | 5 | install_kiro_cli = false variable and ensure_kiro_in_path fallback fully support a baked-in binary (confirmed in main.tf and tests), but README never shows an example setting this variable — only described in the variable's inline description, not in a README example/section. |
| Egress transparency | 3 | 0 | No dedicated README section enumerating install/runtime endpoints (cli.kiro.dev, desktop-release.q.us-east-1.amazonaws.com, custom mirror); URLs only appear scattered inside unrelated config examples. |
| Runs without sudo | 2 | 2 | Install script (install.sh.tftpl) never invokes sudo anywhere; all operations target $HOME. |
Engineering Quality — 7 / 10
| Criterion | Max | Score | Notes |
|---|---|---|---|
| Input quality | 6 | 3 | All variables have clear descriptions and sensible defaults (e.g., install_kiro_cli = true, kiro_cli_version = "latest"), but no validation blocks exist anywhere in main.tf despite opportunities (e.g., validating agent_config JSON or kiro_cli_version format). |
| Test coverage | 4 | 4 | main.tftest.hcl covers business logic (defaults, workdir trimming, env var creation, scripts ordering) and main.test.ts covers end-to-end install/auth/agent-config behavior in containers. |
Agent Integration — 10 / 25
| Criterion | Max | Score | Notes |
|---|---|---|---|
| AI governance | 10 | 0 | No mention of Coder AI Gateway or Agent Firewall anywhere in the README. |
| Dashboard entry point | 5 | 5 | README's "Standalone mode with a launcher app" example defines a full coder_app resource (slug, display_name, icon, open_in, command) launching kiro-cli chat. |
| Session continuity | 5 | 0 | No documentation of resuming sessions, session IDs, or a persistent session manager (tmux/screen/boo). |
| Managed configuration | 5 | 5 | agent_config variable documents writing an agent JSON (tools, MCP servers like playwright) and setting chat.defaultAgent, matching Kiro's agent-configuration format. |
Overall — 66 / 100
Raw 61 / 92 → round(61 / 92 × 100) = 66
Tip
You can run this locally by telling your agent: "review this module against .github/scorecard/SCORECARD.md".
Scored against SCORECARD.md with solstice-1. Language-model scores are advisory.
…api removal and current docs Drop the mcp variable (agent_config already accepts mcpServers), variable validations, and jq-based settings edits; set the default agent with kiro-cli settings. Use the documented release host for pinned installs and trim the README.
|
|
||
| ```tf | ||
| module "kiro-cli" { | ||
| module "kiro_cli" { |
There was a problem hiding this comment.
always use - in names and not _
|
Automated review requested by @matifali. Please sanity-check before acting on it.
SummaryThe agentapi module is replaced with Correctness
Leftovers
Findingsshould-fix S1: upgraded workspaces keep the v1 Tasks agent as Kiro's default. should-fix S2: the migration note is incomplete compared with auggie and the AGENTS.md checklist ("Breaking changes documented: removed inputs, changed defaults").
The auggie README warning (#1177, line 22) is a good template. nit N1: pinned/mirror install dropped nit N2: a broken existing binary aborts silently. nit N3: agent name isn't validated or tested. nit N4: tests still import from the agentapi module. nit N5: provider constraint. nit N6: there's no README example for Tests
CI and reviews
Series consistencyConsistent with claude-code and the rest of the series: |
…_kiro_cli is true Drop the installed-version skip, matching the other agent modules. The official installer prompts on /dev/tty when kiro-cli already exists, so remove the existing binaries before running it.
… expand migration note
|
Addressed review feedback in 3cc4dd1 and 27a7e5b:
Re-tested in a dogfood workspace on the latest head: Kiro CLI 2.32.0 installed, scripts ran in order before a downstream @DevelopmentCats could you review? Generated with Coder Agents. |
## Description Adds a `coder-labs/kiro-crew` module. The module installs Kiro CLI and Kiro Crew, starts the `kirocrew gateway` and a loopback token-minting redirector, and exposes two subdomain apps: a visible tile that points at the redirector, and a hidden dashboard app. Opening the tile mints a short-lived gateway token and redirects to the dashboard, so it opens already authenticated. At startup the module derives the dashboard origin from the agent's `VSCODE_PROXY_URI` and from any `workspace_proxy_hostnames`. The gateway trusts those origins (plus optional extra origins) through `KIROCREW_CORS_ORIGINS`, and `dashboard.url` is set to the primary origin. The redirector keeps the browser on the primary deployment or workspace proxy it came through. This is a port of a Kiro Crew prototype tested by @greg-the-coder, adapted to registry conventions: `coder-utils` install/start scripts as `.tftpl` files, `$HOME/.coder-modules/coder-labs/kiro-crew` data layout, base64 for free-form inputs, the Builder ID token passed through `coder_env` instead of being rendered into scripts, and Terraform plus Bun tests with mocked installers. <details> <summary>Decision log / deviations from the prototype</summary> - Raw `coder_script` replaced by `coder-utils` 0.0.2 (install + start). Logs moved from `/tmp` to `$HOME/.coder-modules/coder-labs/kiro-crew/logs/` (`install.log`, `start.log`, `gateway.log`, `redirector.log`). - Ports (8899 gateway, 8898 redirector), the redirector flow (`/healthz` returns 200 without minting a token; `/` returns 302 to `<dashboard>/?token=…`, or 503 while the gateway starts), healthchecks, detached `setsid nohup` launch, port-based stale-process cleanup, the userns sandbox fallback, `PYTHONPATH` unset, the pipx guard, and the `extra_mcp_json` deep merge are preserved. - `aws_builder_id_token` is exported as `KIRO_AWS_BUILDER_ID_TOKEN` through `coder_env` (as in #1161) instead of being rendered into the script and staged in a file. - Installers download to a temp file, are syntax-checked, then run, instead of `curl | sh`. - Removed the unused `subdomain`, `install_prefix` and `log_path` inputs. Added `dashboard_origin` (an override for the primary dashboard origin), `workspace_proxy_hostnames`, `pre_install_script`, `post_install_script`, `icon`, and the `scripts` output. - The start script also frees the redirector port before relaunching. - Generated helpers (`start-gateway.sh`, `redirect-gateway.py`, `coder-origins.py`) are written to `$HOME/.coder-modules/coder-labs/kiro-crew/scripts/` next to the coder-utils scripts, not to Kiro Crew's `~/.kiro/crew` data directory. </details> <details> <summary>Decision log: dashboard origins and workspace proxies</summary> **Problem (reproduced on dogfood).** The module derived `https://<slug>-dashboard--<ws>--<owner>.<access-host>` in Terraform. Dogfood's wildcard is `*--apps.dogfood.cdr.dev`, and each workspace proxy has its own (`*--apps.us-east-2.dogfood.cdr.dev`, ...). The redirector sent every browser, on primary or on a proxy, to a host that is not a valid app URL. The real dashboard hosts returned `Host header not allowed.`, because the gateway allowlist is exact-match and fixed at launch. **Evidence.** - Terraform cannot see the wildcard app hostname. The agent's `VSCODE_PROXY_URI` is `<scheme>://` + the primary wildcard with `*` replaced by `{{port}}--<agent>--<ws>--<owner>` (`coderd/agentapi/manifest.go`), with no auth needed. - Slug apps use `<slug>--<ws>--<owner>` without the agent (`db2sdk.AppSubdomain`). Coder also routes the form that names the agent. - Coder's app proxy keeps the browser's `Host` (`httputil.NewSingleHostReverseProxy` does not rewrite `req.Host`), so the redirector can tell which hostname the browser used. - Proxy wildcards come only from `/api/v2/regions`, which needs a user token. The agent token gets 401. **Decisions.** 1. Compute origins at startup in a stdlib-only Python helper. Primary comes from `VSCODE_PROXY_URI`, plus each entry in the new `workspace_proxy_hostnames`. Both slug forms are trusted. The old Terraform-derived origin is only a last resort, and it logs a warning. 2. One snapshot (`~/.kiro/crew/coder-origins.json`) feeds both the gateway allowlist and the redirector's exact `app host -> dashboard origin` routes. The redirector only looks up the request `Host` and never builds `Location` from it, so a token never goes to an origin outside the allowlist. Unknown hosts, including unlisted proxies, go to the primary origin. 3. No automatic proxy discovery. It would need `data.coder_workspace_owner.me.session_token` inside the workspace. coder-utils writes the start script to the persistent home volume, and `coder_env` would expose the token to every process. Explicit configuration was the safer tradeoff. 4. `dashboard_origin` still overrides the primary origin. When it is set, `VSCODE_PROXY_URI` is ignored. 5. Redirects send `Cache-Control: no-store` and `Referrer-Policy: no-referrer`. 6. The gateway allowlist is static, so adding a proxy requires a workspace restart (documented). </details> ## Type of Change - [x] New module - [ ] New template - [ ] Bug fix - [ ] Feature/enhancement - [ ] Documentation - [ ] Other ## Module Information **Path:** `registry/coder-labs/modules/kiro-crew` **New version:** `v0.0.1` **Breaking change:** [ ] Yes [x] No ## Testing & Validation - [x] Tests pass (`bun test`) - [x] Code formatted (`bun fmt`) - [x] Changes tested locally - `terraform test`: 16 passed (plan for input-derived values; apply for healthchecks, `coder_env`, and the `scripts` output). - `bun test main.test.ts`: 13 passed. Covers cached and fresh installs, `use_cached = false`, download failure, MCP write and merge, gateway and redirector launch (302 with token, CORS origins, `dashboard.url`, token env), 503 before the gateway is ready, replacing a stale listener, and a missing binary, proxy-preserving redirects (including the agent-named form, an explicit scheme and port, and unlisted or unrelated hosts falling back to primary, with every redirect origin checked against the gateway allowlist), the `dashboard_origin` override, and the fallback without `VSCODE_PROXY_URI`. Installers and the gateway are mocked. - `terraform_validate.sh`, `readmevalidation`, `shellcheck` (including the rendered `.tftpl` scripts), and `validate_set_u_order.sh` pass. - Live on dogfood (workspace on `j-kiro-crew-pr-1196`, running the rendered start script): opening the tile via primary, us-east-2, eu-central-1, and ap-southeast-2 redirected to the dashboard on the same hostname and served the Kiro Crew page (HTTP 200). With no `workspace_proxy_hostnames`, us-east-2 fell back to the primary dashboard, which loaded. - Not tested: Kiro login. ## Related Issues The companion Kubernetes template is on branch `superblink/coder-labs-kiro-crew-template` and will be opened as a separate PR after this module is published, because it references `registry.coder.com/coder-labs/kiro-crew/coder` 0.0.1. --- Generated with Coder Agents using Claude Created on behalf of @greg-the-coder --------- Co-authored-by: coder[bot] <137810501+coder[bot]@users.noreply.github.com> Co-authored-by: greg-the-coder <greg@coder.com>
Closes REG-87
Refactor
harleylrn/kiro-clito install and configure Kiro CLI only, matching the claude-code, codex, copilot, and cursor-cli (#1152) migrations. Changes beyond the AgentAPI removal are limited to what the current Kiro docs require.order,group,report_tasks,cli_app,web_app_display_name,cli_app_display_name,install_agentapi,agentapi_version,agentapi_chat_based_path,ai_prompt,system_prompt,coder_mcp_instructions,trust_all_tools), thetask_app_idoutput, the start script, the default agent template, and the task-reportingcoderMCP server.https://cli.kiro.dev/install) forlatest. A pinnedkiro_cli_versionor customkiro_install_urlinstalls<url>/<version>/kirocli-<arch>-linux.zip(default hostdesktop-release.q.us-east-1.amazonaws.com, as before). Runs on every start wheninstall_kiro_cli = true(existing binaries are removed first because the official installer prompts on/dev/ttyotherwise); withfalse,kiro-climust be onPATH.workdiris optional and created if missing.agent_configis written to~/.kiro/agents/<name>.json(honorsKIRO_HOME) and set withkiro-cli settings chat.defaultAgent. MCP servers go in itsmcpServersfield, so there is no separatemcpinput. Without it, Kiro's built-in default agent is used.api_key(KIRO_API_KEY, documented auth method).auth_tarballis read fromKIRO_CLI_AUTH_TARBALLat install time instead of being rendered into the script.scriptsoutput; README reduced to examples and doc links; rewrite tests. Bump to2.0.0.Important
MCP servers connecting was not verified: Kiro disables MCP unless signed in to a real account, and none was available.
kiro-cli mcp add --agentwrites the same inlinemcpServersstructure the module writes.Decision log
curl -fsSL https://cli.kiro.dev/install | bash(latest only, glibc/musl detection); zip install documented atdesktop-release.../latest/; versioned paths existlatest, release zip for pinned versions/mirrorsmcpServershas the highest precedence;kiro-cli mcp addneeds loginmcpvariable; useagent_config.mcpServerskiro-cli settings chat.defaultAgentworks without login and preserves other keysKIRO_API_KEYapi_key; keepauth_tarballKIRO_HOMEoverrides~/.kiroTesting
terraform test(6 passed),bun test main.test.ts(14 passed, container-based),terraform fmt, prettier, shellcheckCODER_SCRIPT_BIN_DIRsymlink, script order with a downstreamcoder exp syncscript, agent file written and listed as default bykiro-cli agent list, user settings preserved,KIRO_API_KEYset and absent from scripts/logs, restart, pinned 2.29.0 downgrade via release zip, API key rotationGenerated with Coder Agents.