Repository navigation
feat: add Konductor Kiro Power (powers/konductor/) - #29
Merged
Merged
Conversation
Ships the Kiro Power at powers/konductor/, imported directly from github.com/aws-solutions/konductor/tree/main/powers/konductor -- no separate publish branch or assembly step, since that directory is already the flat, importable shape Kiro's GitHub import expects. - konductor-setup: onboards a project end to end, with Step 0 consent disclosure, pinned checksum-verified download (cargo fallback on Intel Mac, Windows out of scope for v1), per-target power-cli.json binary tracking, doctor wiring, update/uninstall with --confirmed, and --no-telemetry. - konductor-help: answers CLI/doctor/SOP questions against an existing install. - Thirteen activation keywords in plugin.json, in two tiers: nine konductor-qualified action phrases and four broader discovery phrases. - make kiro-power / make kiro-power-check validate the committed powers/konductor/ tree in place; wired into validate-pr.yml so every PR checks it. - Manual AWS MCP bring-your-own docs (aws-mcp key, Agent Toolkit command, all eight tools reachable, IAM guardrails). - Bumps VERSION (and cli/konductor-rs's Cargo version) to 1.1.0.
knihit
requested review from
georgebearden,
ihmaws,
shsenior and
simonkrol
as code owners
September 30, 2026 03:33
… refusal
CI's Validate PR job runs ShellCheck 0.9.0 (GitHub-hosted ubuntu-latest's
pinned version, per actions/runner-images), which flags SC2120/SC2119 on
resolve_plugin_version's $1 (a ${1:-default} fallback, never otherwise
called with an argument in resolve-version.sh itself). A local ShellCheck
0.11.0+ no longer flags that pattern, so make kiro-power-check passed
locally while CI failed on the identical command. Reproduced the failure
locally against a downloaded 0.9.0 binary before fixing it.
- resolve-version.sh: pass the already-computed script dir explicitly at
the file's one internal call site instead of relying on the function's
own default. The function keeps its documented [script-dir] optional
argument for any other caller. No behavior change -- all 13
resolve-version tests still pass.
- Makefile: kiro-power-check now warns (non-fatal) when the installed
ShellCheck version differs from CI's pinned 0.9.0, and also shellchecks
tests/kiro-power/ (previously unchecked; swept clean under both
versions).
- link-binary.sh: the foreign-file refusal matched -e && ! -L, which also
catches a FIFO/socket/device node, not just a regular file. Reworded the
message to 'something other than a symlink this Power created' and
updated the matching test assertion.
- Reverted docs/index.html and docs/site/user-guide.html to origin/main:
their one-line, ~600KB diff was mostly an unrelated wording edit and was
making CodeQL misattribute pre-existing alerts to this PR. The full
Pages HTML regen (including this PR's new page) is a separate follow-up
PR; build-user-guide.sh --check now reports them stale against the
markdown, as expected.
… guide Rewords every comment across the Kiro Power scripts and tests that cited "adversarial-review finding I1/C1/etc." or konductor-power-design.md section numbers (a doc that does not exist in this repo). Each now states the invariant or rationale it protects directly instead of narrating the review that found it. The underlying fixes are untouched: the consent gates, the source-redirection check, the symlink trust boundary, and the per-target CLI-binary resolution all keep their exact behavior. Also removes every em dash from docs/user-guide/tasks/install-kiro-power.md and the new "Installing via a Kiro Power" section of README.md, replacing each with plain punctuation. Reviewed the 9 setup scripts, 5 validator/schema files, and 10 test files for genuine KISS/YAGNI overreach. Found the file-per-step decomposition, the trust-boundary checks in lib.sh, and the test-file granularity all load-bearing against specific, reproduced bugs (a permanent lockout, a directory-symlink footgun, and a CI shellcheck-version mismatch); no scripts or tests were merged or cut. make kiro-power-check: 158 assertions, 0 failed, under both local ShellCheck 0.11.0 and CI's pinned 0.9.0.
A final compliance sweep of the full committed tree (not just this PR's diff hunks) found a handful of references that only make sense to a reader with access to Amazon-internal tooling and documents, surviving because they lived in parts of PR-touched files nobody re-diffed: - CHANGELOG.md and README.md's Project Structure section named the private source package this content originates from, rather than Konductor's own public identity, and listed a build-metadata file that isn't part of this repo at all. - tools/build-user-guide/BUILD_USER_GUIDE_PROMPT.md used that same private package name as a negative example for agent-name prefixes. - tests/kiro-power/helpers.sh explained a `bats`-on-PATH ambiguity by naming a specific unrelated internal CLI; reworded to state the ambiguity generically, since it can hold for any same-named tool. - konductor-setup/SKILL.md and konductor-help/SKILL.md cited a design doc section number and "the design doc" for a document that was never committed to this repo and has no public counterpart. - Makefile cited an internal review-round finding ID in a code comment with no meaning outside that review. - cli/konductor-rs/Cargo.toml justified every pinned dependency version against a private package registry mirror throughout, even though this is a public repo built with a plain `cargo build` against the public registry. No behavior changes. make kiro-power-check: 158 assertions, 0 failed.
commit a6c2015 fixed 8 internal-reference leaks found in a compliance sweep of the full committed tree, not just this PR's own diff hunks. Four of those fixes touched content this PR's own diff never modifies: - CHANGELOG.md's header line names the private source package; this PR only appends a new dated entry below it. - README.md's Project Structure listing includes aim.json; this PR only adds a new section elsewhere in the file. - BUILD_USER_GUIDE_PROMPT.md's runtime-switcher paragraph uses the private package name as a negative example; this PR only adds an unrelated table row earlier in the file. - Cargo.toml's dependency comments justify pinned versions against an internal registry mirror; this PR's only change to the file is the version-number bump at the top. Each of these was already present, unchanged, on origin/main before this PR started, and this PR's own hunks never touch the section in question -- so whether they're internal references is real, but fixing them is a separate cleanup task, not this PR's job. The remaining 4 fixes from a6c2015 stay: three live entirely inside files this PR creates from scratch (tests/kiro-power/helpers.sh, konductor-setup/SKILL.md, konductor-help/SKILL.md -- none exist on origin/main, so there's no pre-existing content to be out of scope), and the Makefile one sits inside a comment block this PR's own diff introduces (the kiro-power-check recipe), so the PR's own change is what made that finding-ID reference stale. make kiro-power-check: 158 assertions, 0 failed.
# Conflicts: # CHANGELOG.md # VERSION # cli/konductor-rs/Cargo.lock # cli/konductor-rs/Cargo.toml
…apping A few comments referenced "the design" for decisions that are just stated directly now (default-on telemetry, SKILL.md as the source of truth), and several multi-line comments had awkward line-wrap splits left over from earlier edits. No behavior changes.
Copy verified and source-built binaries to a temporary file inside the shared release cache, then atomically rename them into place. This prevents another Power invocation from resolving a partially-written cache entry.\n\nPin the documented AWS MCP proxy and tighten the Kiro Power guide, setup skill, and help skill to keep operational guidance concise and current.
Keep the Kiro Power skills concise, but restore explicit consent, source-redirection, credential, telemetry, update, uninstall, diagnostic, and MCP instructions required for safe agent execution.
Standardize agent specs, docs, and generated user-guide pages on mcp-proxy-for-aws-cli==1.7.0 instead of the floating mcp-proxy-for-aws@latest. Generated HTML pages were updated through the sync-html-content.py generator, not hand-edited.
konductor_write_power_cli_record built its temp file path as
"${power_cli_json}.tmp.$$", derivable from the target directory and
the caller's own PID alone. A symlink planted at that exact path ahead
of time turned the write into a write-through-symlink into whatever it
pointed at, before the final rename ever ran.
Use mktemp in the same directory instead, matching the pattern
konductor_publish_cached_binary already uses, and clean up the temp
file on every failure path.
Adds a test that plants a symlink at the old predictable path and
confirms the symlink's target is left untouched and power-cli.json
ends up a regular file.
construct_tag, fetch_verify_binary, and build_from_source each embed their tag or version argument directly into a filename, a download URL, a cache path under ~/.konductor/cli-releases, or a git clone --branch ref, with no validation. A tag can arrive from --tag or KONDUCTOR_POWER_VERSION, so an unvalidated value such as "../../etc/cron.d/x" would turn any of those into a path-traversal write or a git-ref injection. Validate against a bare-semver or v-prefixed-semver regex (reusing the existing KONDUCTOR_CLI_VERSION_REGEX for the bare form, and adding KONDUCTOR_CLI_TAG_REGEX for the v-prefixed form) at each entry point, before the value is used anywhere. No pre-release suffix is accepted: this repo's own release pipeline (validate-version-semver.sh, release.yml) never produces one either. Also adds --proto '=https' --tlsv1.2 to both curl calls in fetch_verify_binary, so the download is pinned to https and TLS 1.2+ independent of what the URL string says. Two existing test fixtures used a tag shape that is no longer well-formed (used only to simulate a tag that doesn't exist upstream); updated to a validly-shaped nonexistent tag so they still exercise that scenario.
validate-kiro-power-skill-frontmatter.py's frontmatter parser reads each key: value line verbatim and never expands multi-line YAML. If name or description were written as a block scalar (name: |, description: >-, etc.), the real value lives on the following indented lines, which the parser never reads -- it silently treated the bare indicator character itself as the whole value instead of failing with a clear error. Reject name/description values matching a block-scalar indicator (|, >, optionally with a chomping or indentation modifier) with a specific error naming the field and stating block scalars aren't supported, rather than letting them fall through to the generic name-pattern or length checks.
validate-kiro-power-plugin-json.py is a hand-written, stdlib-only stand-in for a real JSON Schema validator, checked against scripts/agent-plugins.schema.json by eye. Nothing enforced that its constants stayed in sync with the schema file after an edit to either one. Add a test that reads the schema's own required list, root additionalProperties, name.pattern, and author.additionalProperties and asserts each against the checker's own module-level constants, imported directly. Exposes the required-fields list as a named _REQUIRED_ROOT_FIELDS constant (it was previously two separate inline checks) so the test has something to import; the checks themselves produce the same errors in the same order as before.
…ipts check-plugin-json-version-drift.sh read plugin.json's version field with a bare python3 -c one-liner: malformed JSON or a missing 'version' key surfaced as an uncaught Python traceback with no '[check-plugin-json-version-drift]' prefix, instead of this script's own error format. Guard both cases explicitly and keep the non-zero exit. render-kiro-power-plugin-json.py wrote the rendered plugin.json directly with write_text. Write it through a same-directory temp file and os.replace instead, so a reader (or a concurrent 'make kiro-power') never observes a partially-written file, and clean up the temp file if the write or replace fails.
kiro-power-check printed the same '=== All checks passed ===' line whether or not shellcheck actually ran, so a developer without shellcheck on PATH had no way to tell a full pass from a run that quietly skipped the shellcheck step. Track whether it was skipped and say so in the final line; CI (which has shellcheck) is unaffected.
[1.1.0] was dated 2026-09-30, before [1.0.3]'s 2026-10-01, breaking the changelog's newest-first ordering. Date it today, and add a Security entry for konductor-setup's new tag/version validation.
Both carried a partial regen (a bundled template diff) not otherwise needed by this branch. Reverted byte-for-byte to origin/main; a full regen is deferred to a later PR.
Brings in the Claude Code plugin marketplace (publish-claude-plugin workflow, generated/claude-plugin assembly, marketplace.json, and the AWS MCP pin to mcp-proxy-for-aws-cli==1.7.0) alongside the Kiro Power install path already on this branch. Resolved conflicts: - CHANGELOG.md: folded main's [Unreleased] entries into this branch's [1.1.0] section, grouped by subsection (Added/Changed/Fixed/Security). - Makefile: combined .PHONY lists (claude-plugin/claude-plugin-check plus kiro-power/kiro-power-check). - docs/user-guide/README.md, docs/user-guide/tasks/README.md: list both install paths (Kiro Power and the Claude Code plugin marketplace) side by side. - docs/user-guide/agents.md: kept main's more detailed k-architect MCP row (per-runtime tool counts) over this branch's shorter version. - tools/build-user-guide/BUILD_USER_GUIDE_PROMPT.md: kept both guide page ids (install-power and install-plugin).
…ll paths install-claude-code.md's footer pointed "Next" at install-kiro-power.md, which has no forward link of its own -- readers following the tour never reached initialize-a-project.md. Restored the footer to point there directly, and added install-kiro-power.md to this page's Related list alongside the plugin marketplace entry. install-kiro-power.md and install-claude-plugin-marketplace.md now also cross-link each other under Related, so all three install paths (Kiro CLI, Claude Code, Kiro Power, and the Claude Code plugin marketplace) reference one another consistently. Also corrects the 1.1.0 changelog entry's date.
simonkrol
previously approved these changes
Oct 14, 2026
run-onboarding.sh now writes power-cli.json as soon as `konductor install` succeeds, before running `konductor doctor`. Doctor can fail on its own (a real, non-zero exit the script still propagates) after install has already written real files; a target in that state still needs run-update.sh/run-uninstall.sh to resolve the CLI binary that performed the install. Adds test-record-written-before-doctor.sh, pinning that power-cli.json exists with the right cli_version/binary even when install succeeds and doctor subsequently fails. Updates test-fail-stop.sh's doctor rate-limit stub to also answer `--version`, now required for that scenario to reach doctor at all.
…tall.sh A target that tracks more than one harness makes a bare `konductor update`/`uninstall` a usage error asking which one to act on. Both wrapper scripts now accept an optional --harness <name>, validated against a safe name shape (lowercase letters, digits, hyphens) and forwarded verbatim as --harness <name> to the underlying CLI call. Omitted, behavior is unchanged. The CLI itself still validates the name against its own registered harnesses, so no second allowlist is kept here. run-uninstall.sh validates --harness independently of --dry-run/ --confirmed, since it names which harness to act on rather than whether to act at all. Documents the new flag in SKILL.md and the user guide's install task, each with a short note on retrying with --harness <name> after a multi-harness usage error. Adds test-harness-flag.sh covering: the value is forwarded verbatim when given; nothing is forwarded when omitted; an unsafe value is rejected before the underlying CLI runs; and --dry-run/--confirmed gating on run-uninstall.sh is unaffected by --harness being present.
run-uninstall.sh deleted <target>/.konductor/power-cli.json after any real removal, including a --harness <name> uninstall that leaves another harness still tracked at the target. That stranded the surviving harness: its next update/uninstall fell to konductor_resolve_target_binary's legacy fallback, which trusts the shared ~/.local/bin/konductor with no version check. Clear power-cli.json only once <target>/.konductor/manifest itself no longer exists -- the signal `konductor uninstall` already maintains for "nothing is tracked here anymore" (it deletes that file outright rather than leaving an empty strategies list). A target still tracking another harness afterward keeps its power-cli.json record.
run-onboarding.sh only checked BINARY_OWN_VERSION for emptiness before writing it into power-cli.json. A binary whose `--version` output isn't the expected "konductor <semver>" shape (e.g. corrupted stdout, an unrelated tool at that path) could still get a non-semver value recorded there. Validate it against KONDUCTOR_CLI_VERSION_REGEX, the same bare-semver shape konductor_resolve_target_binary itself requires before trusting a recorded cli_version, right after extracting it and before the record is written. A malformed value now fails onboarding closed, with no power-cli.json written at all.
simonkrol
previously approved these changes
Oct 14, 2026
ihmaws
reviewed
Oct 15, 2026
ihmaws
left a comment
ihmaws
left a comment
Member
There was a problem hiding this comment.
Thanks for this change.
I checked out 00eee63 and ran it on an Apple Silicon Mac. Here's what I covered:
- Build and tests: built the 1.1.0 CLI;
make kiro-power-checkpasses 255/255 under bash 5.2. - End to end: onboarding, update, and uninstall against the real v1.0.2 release, in a throwaway HOME and project.
- Gates: consent, source redirection, and fail-closed on the unpublished v1.1.0 tag all behave as described.
- Multi-harness: the
--harnesshandling works end to end with the 1.1.0 CLI.
Update and uninstall fail (see inline comments). Those two need fixing before merge.
- How was the Power itself tested? The Kiro IDE import is listed as a follow-up, and it's the PR's headline claim. Please run it before merge and post a screenshot of the installed Power and its two skills. (The description also says 158 assertions; the suite runs 255.)
- Shipping from
main. Users import fromtree/main/powers/konductor, so any script change merged tomainreaches every user before a release exists (the tag-not-found window you describe is one symptom of this). Did you consider pointing the docs at a release tag URL instead? What does Kiro's "Check for updates" do in each case? Let me know your thoughts. - Comment volume. About 1,030 of the ~1,850 lines in
konductor-setup/scripts/are comments (lib.shalone is 338 of 611), and there's a ~38-line block abovekiro-power-checkin the Makefile. Could these be cut down to the invariant each one protects, with the history and rationale left to the PR? As written, every future change has to keep that prose in sync. Not blocking, but strongly recommend. - Size. At +5.9k lines across 53 files this is a lot for one review. For next time, a split like this would make it much easier to review:
- PR 1: the Power and its scripts, with tests.
- PR 2: validation tooling and CI.
- PR 3: docs.
- History. Recommend a squash merge, with an edited message rather than the concatenated default.
- Pre-existing cleanup. The CHANGELOG header and the README structure listing on
mainstill reference internal package metadata, and that isn't part of this diff. Could you open an issue to track it?
…nstall-info.json konductor_resolve_target_binary refused update/uninstall for any target onboarded with --no-telemetry, because konductor install --no-telemetry never writes install-info.json (finalize_install_telemetry only writes it when telemetry is on), and update --no-telemetry deletes it on a target that previously had one. Gate on this Power's own power-cli.json instead, falling back to the CLI's own manifest file for a legacy target with no power-cli.json yet. Both are written unconditionally of telemetry, so update and uninstall now work for an opted-out target. The legacy-fallback and trust-boundary logic below the precondition is unchanged. Adds a regression test that onboards with --no-telemetry, then runs update and uninstall against the same target.
run-update.sh and run-uninstall.sh expanded possibly-empty arrays
("${arr[@]}") under set -u, which bash 3.2 (stock macOS) treats as an
unbound variable. Switch to ${arr[@]+"${arr[@]}"}, which short-circuits
to nothing before set -u ever sees it.
Several test stubs used ${args[-1]} for negative array indexing, a bash
4.3+ feature; replaced with ${args[$((${#args[@]} - 1))]}.
Verified against a bash 3.2.57 build (compiled from GNU source) and the
system bash: all 262 kiro-power assertions pass under both.
…in CI tests/test_validate_kiro_power_plugin_json_schema_sync.py and tests/test_validate_kiro_power_skill_frontmatter.py existed but were never run by make kiro-power-check or CI. Add them to that target via python3 -m pytest, and install pytest on the validate-pr.yml runner first since it is not preinstalled on ubuntu-latest and these are plain assert functions, not unittest.TestCase subclasses.
The update/telemetry-opt-out/uninstall examples ran konductor via PATH, contradicting the text that says the Power resolves the per-project CLI binary instead of the shared ~/.local/bin/konductor symlink. Reword each to tell the user to ask the Power to run the action, noting that the raw command invokes whichever konductor is first on PATH. Also link the Playwright MCP setup note to the playwright-mcp entry in the CLI reference instead of pointing at an unnamed "project's MCP integration documentation".
Drop the "Per Kiro's own docs" attribution and state plainly what choosing Install does (registers the Power's manifest) and that onboarding itself runs separately, the first time the Power is invoked.
doctor/power-cli ordering, harness-scoped uninstall cleanup, malformed- tag rejection, and binary --version validation all fix konductor-setup code that is part of this same unreleased [1.1.0] Power and never shipped on its own. Remove the entries instead of describing a fix to something nobody ever saw broken. PR #28's Claude plugin entries are unchanged.
…r step Remove scripts/kiro-power.template.json, scripts/render-kiro-power-plugin-json.py, and the make kiro-power target. powers/konductor/plugin.json is now edited directly; check-plugin-json-version-drift.sh keeps guarding that its version field matches VERSION. validate-kiro-power-plugin-json.py and its schema-sync test are unaffected -- they validate plugin.json's content against the schema, independent of how it was produced. Updates every doc that pointed at the removed render step (README, CHANGELOG, the install guide) to say to edit plugin.json directly and bump its version alongside VERSION.
Users import the Power from a GitHub tree URL. Point every one of them at tree/v1.1.0 (the tag this release will create), not tree/main's moving HEAD, matching how the konductor CLI itself is released. Updates README, the install guide, and CHANGELOG; rewords the "imported from main" comments in check-plugin-json-version-drift.sh and validate-pr.yml to describe the tagged-release convention generically. Add check-kiro-power-import-url-version.sh, wired into make kiro-power-check, which fails if any committed .../tree/<tag>/powers/konductor URL names a tag other than v$(cat VERSION) -- a VERSION bump now forces these URLs to move with it. release.yml's gh release create pins the new tag to the exact commit that triggered the release, and that commit is on main after the VERSION-bump PR merges, so the v1.1.0 tag will contain powers/konductor/ once this merges. Until then, the v1.1.0 URL 404s.
…ation Per this repo's code-discipline convention, keep a comment only when the code can't speak for itself: state the why in one or two lines, drop restatement, history, and repeated rationale already said once elsewhere in the same file. Comment-only change: every non-comment, non-blank line is byte-identical to before this commit (verified file by file). Keeps the safety-rule comments a future editor could break: checksum fail-closed, the trust boundary on which binary gets executed, mktemp's unpredictable temp names, tag/version validation before use, Step 0 SOURCE disclosure and --allow-non-default-repo, --confirmed gating, the record written before doctor runs, power-cli.json kept until the manifest is gone, link-binary's refusals, the ShellCheck 0.9.0 SC2119/SC2120 workaround, and the bash 3.2 array idiom. Line/comment counts (total lines / comment lines), before -> after: lib.sh 623/350 -> 470/196 run-onboarding.sh 322/182 -> 258/118 run-uninstall.sh 159/95 -> 121/57 link-binary.sh 156/92 -> 104/40 build-from-source.sh 135/65 -> 113/43 run-update.sh 135/82 -> 98/45 fetch-verify-binary.sh 132/70 -> 102/40 resolve-version.sh 121/65 -> 100/44 detect-platform.sh 89/50 -> 69/30 Total 1872/1051 -> 1435/613 Also trims the Makefile's kiro-power-check comment block (38 -> 21 comment lines), same rule, same non-comment-identical guarantee.
konductor-setup and the Kiro Power install guide both told every user to run `kiro-cli chat --agent konductor` after a successful install, which gives Kiro IDE users nothing to act on. Add an "In Kiro IDE" step (open the agent selector in the chat input bar and choose `konductor` or a specialist agent, then ask a plain-language question to trigger the about-konductor orientation) alongside the existing "In kiro-cli" step, with links to the agents reference and about-konductor pages for more detail.
The sentence now ends after the example question instead of describing which orientation it triggers.
Contributor
Author
Updates for the review summary:
|
5 tasks done
simonkrol
approved these changes
Oct 16, 2026
knihit
added a commit
that referenced
this pull request
Oct 16, 2026
Resolve the README conflict with the Kiro Power section from #29. Keep the refreshed Quick start layout and fold the Power install into a collapsible section, with the reviewed step wording unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adds the Konductor Kiro Power at
powers/konductor/, imported directly fromhttps://github.com/aws-solutions/konductor/tree/v1.1.0/powers/konductor-- no separate publishbranch needed, since that directory is already the flat, importable shape Kiro's GitHub import
expects. That tag resolves only once this PR merges and the release workflow publishes v1.1.0; it
404s until then. Once installed, saying "konductor" or using Try power installs Konductor into
whichever project you invoke it in.
konductor-setup: onboards a project end to end -- Step 0 consent disclosure, pinnedchecksum-verified download with a source-build fallback on Intel Mac (Windows not supported
natively, use WSL), per-target
power-cli.jsonbinary tracking written via a random tempname (not a predictable one), release tag/version validated before any path, URL, or git-ref
use, TLS 1.2+ pinned on the binary download,
doctorwiring,update/uninstallwith--confirmed, and--no-telemetry.update/uninstallresolve the right binary throughpower-cli.jsonor the CLI's own manifest file, never telemetry'sinstall-info.json-- atarget onboarded with
--no-telemetrycan still be updated and uninstalled.konductor-help: answers CLI/doctor/SOP questions against an existing install.plugin.json: 9konductor-qualified action phrases plus 4 broaderdiscovery phrases.
make kiro-power-checkvalidates the committedpowers/konductor/tree in place, wired intovalidate-pr.yml: VERSION/plugin.jsondrift, every committed import URL naming the matchingrelease tag, the Agent Plugins v1.0.0 schema, skill frontmatter, and the full test suite.
plugin.jsonis edited directly; there is no template or render step.aws-mcpkey, the Agent Toolkitfor AWS's own command, all 8 tools reachable (5 pre-approved, 3 prompting), IAM guardrails.
VERSION(andcli/konductor-rs's Cargo version) to 1.1.0.Type of Change
New skill · CLI (
cli/) change -- Rust, version bump only · Infrastructure / pipeline · DocumentationTesting
make kiro-power-check: 262 assertions, 0 failed, under both the local ShellCheck and CI'spinned 0.9.0; also runs the plugin.json schema-sync and skill-frontmatter pytest suite and the
import-URL-version check
bash: all 262 assertions pass under both, with no bash 4+ syntax (negative array indexing) or
set -u-unsafe empty-array expansions left inkonductor-setup's scripts ortests/kiro-power/actionlinton.github/workflows/*.yml: cleanshellcheckonkonductor-setup'sscripts/,tests/kiro-power/, and the touchedplugin-publish scripts under
scripts/: cleancd cli/konductor-rs && cargo test --release -- --test-threads=1: 1,776 passed, 0 failed,builds
konductor v1.1.0python3 -m pytest tests/ -q: 152 passedmake claude-plugin-check: marketplace.json and the assembled flat plugin tree both validate;the rendered
.claude-plugin/plugin.jsonreports version1.1.0make guide-check: 1 failure, pre-existing onmain, unrelated to this PRdocs/index.html/docs/site/user-guide.htmlmatchorigin/mainbyte-for-byte -- theearlier partial regen has been reverted; a full regen is deferred to a later PR (see
Follow-ups)
Agents Affected
N/A --
agents/k-architect.agent-spec.jsonandagents/k-developer.agent-spec.jsonnow matchmainexactly (both PRs pinnedmcp-proxy-for-aws-cli==1.7.0independently), so this PR carriesno agent-spec diff of its own.
Follow-ups
install-kiro-power.mdpage; its own follow-upPR, since the AI-driven
build-user-guide.shstep needs an interactive session, and theirone-line, ~600KB diff here was mostly unrelated wording and made CodeQL misattribute
pre-existing alerts to this PR.
https://github.com/aws-solutions/konductor/tree/feat/kiro-power/powers/konductor, confirmingonly
konductor-setupandkonductor-helpload.Notes for Reviewers
VERSIONto 1.1.0 and releases it, covering both the Kiro Power and theClaude Code plugin marketplace channels in one release. The push to
mainalso runspublish-claude-pluginfor the first time, opening the first plugin-candidate draft pullrequest into
release/plugins.During it,
konductor-setupfails closed with a tag-not-found error rather than installing thewrong version -- expected, and self-resolves once the release finishes. The README/install-guide
import URLs point at that same
v1.1.0tag and 404 during the identical window.scripts/check-kiro-power-import-url-version.sh(new, wired intomake kiro-power-check)fails if any committed
.../tree/<tag>/powers/konductorURL names a tag other thanv$(cat VERSION), so a future VERSION bump forces these docs to move with it.