v0.11.1

A hot patch for 0.11.0: memory stays fast and intact under load, the KAS engine follows your agent specs the way kiro-cli does, and a set of security, chat and desktop fixes lands.

Notable fixes

Memory. Reading memory no longer waits behind a write, a busy memory pool ends a turn with a retryable error instead of leaving it waiting, and the first replies after a restart start sooner. The memory database keeps its write log when another process closes it, so recent memories are no longer lost, and the startup prefetch can no longer let the memory index be corrupted.

KAS engine. KAS auto-approves the built-in tools a spec grants once Crew's own checks pass, honors a spec's allowed shell commands at the gate and refuses the rest when the spec denies by default, refuses a file write outside a deny-by-default spec's allowed paths, and mounts web search under the name the engine expects. Agent spec hooks block a tool only on exit code 2, as on kiro-cli, an MCP server gets its boolean env flags but never its secrets, and a relative prompt file may use .. as on kiro-cli. A resumed KAS session replays its history when no turns come back.

Chat and settings. File changes from kiro-cli v3 write tools show in the transcript again, each background tool approval gets its own id so one answer no longer settles another, and kiro-cli's read-only file searches are approved after the safety checks. A workflow run that stored an infinite or not-a-number value opens again, Settings refuses a save that config.local.json would override, and a schedule's time label keeps its wall-clock hour across a daylight saving change. Background work such as the live crew log, knowledge ingest and sub-agent events now runs to the end instead of stopping without a word.

Security. The shell reader finds a -c script placed after options and redirections, and every agent process counts as an agent in the cloud guard for human-only actions. A deny rule that wrongly refused commands such as find -type f and od -tx1 as a curl upload is removed. The local decision models install a filelock with its published advisory fixed.

Desktop and CLI. The one-line and install.sh installers download Crew's built-in KAS engine by default (--no-kas skips it), kirocrew restart says when another gateway still serves the port, and kirocrew stop and kirocrew restart refuse a gateway the desktop app supervises. Quitting the desktop app while it starts no longer leaves a gateway running behind it, and Windows recovery retries a failed network check before it gives up. A new terminal stays above the iPhone keyboard, a working icon in the Crew stack blinks and sits flush, and a host-wide out-of-memory kill is no longer blamed on a single sandbox limit.

What's Changed

• fix(cloud): let an edition add host-agent policies to the EC2 role (0.11.0 backport of #25738, #26287) by @bolichen97 in #26350
• chore(release): backport the 0.11.1 hotfix fixes to release/0.11.0 by @bolichen97 in #26487
• chore(release): backport the remaining 0.11.1 hotfix fixes to release/0.11.0 by @bolichen97 in #26594
• chore(release): backport the last 0.11.1 hotfix fixes to release/0.11.0 by @bolichen97 in #26627
• chore(release): start the 0.11.1 hotfix line (0.11.1-rc.1 and its CHANGELOG) by @bolichen97 in #26648
• fix(deps): backport filelock 4.2.1, undici 8.12.2 and zod 4.6.7 to release/0.11.0 (GHSA-v4x8-3wr5-3wq8, GHSA-4w7w-5xrc-9h26, GHSA-mrhx-c7xc-m3w5) by @JLargent42 in #26536
• test: backport the worker-slot leak fix (#25100) to 0.11.0 by @CrysisDeu in #26149
• fix: backport boot-order race and cron DST label fixes to release/0.11.0 (#25703, #24718) by @CrysisDeu in #26729
• chore(release): cut 0.11.1-rc.2 with four more hotfix fixes by @bolichen97 in #26730
• chore(release): drop the rc suffix for the 0.11.1 stable cut by @bolichen97 in #26781

Full Changelog: v0.11.0...v0.11.1