[coder]

Description

Adds a coder-labs/kiro-crew module. The module installs Kiro CLI and Kiro Crew, starts the kirocrew gateway and a loopback token-minting redirector, and exposes two subdomain apps: a visible tile that points at the redirector, and a hidden dashboard app. Opening the tile mints a short-lived gateway token and redirects to the dashboard, so it opens already authenticated. At startup the module derives the dashboard origin from the agent's VSCODE_PROXY_URI and from any workspace_proxy_hostnames. The gateway trusts those origins (plus optional extra origins) through KIROCREW_CORS_ORIGINS, and dashboard.url is set to the primary origin. The redirector keeps the browser on the primary deployment or workspace proxy it came through.

This is a port of a Kiro Crew prototype tested by @greg-the-coder, adapted to registry conventions: coder-utils install/start scripts as .tftpl files, $HOME/.coder-modules/coder-labs/kiro-crew data layout, base64 for free-form inputs, the Builder ID token passed through coder_env instead of being rendered into scripts, and Terraform plus Bun tests with mocked installers.

Decision log / deviations from the prototype

• Raw coder_script replaced by coder-utils 0.0.2 (install + start). Logs moved from /tmp to $HOME/.coder-modules/coder-labs/kiro-crew/logs/ (install.log, start.log, gateway.log, redirector.log).
• Ports (8899 gateway, 8898 redirector), the redirector flow (/healthz returns 200 without minting a token; / returns 302 to <dashboard>/?token=…, or 503 while the gateway starts), healthchecks, detached setsid nohup launch, port-based stale-process cleanup, the userns sandbox fallback, PYTHONPATH unset, the pipx guard, and the extra_mcp_json deep merge are preserved.
• aws_builder_id_token is exported as KIRO_AWS_BUILDER_ID_TOKEN through coder_env (as in refactor(registry/harleylrn/modules/kiro-cli)!: remove agentapi, tasks and start logic #1161) instead of being rendered into the script and staged in a file.
• Installers download to a temp file, are syntax-checked, then run, instead of curl | sh.
• Removed the unused subdomain, install_prefix and log_path inputs. Added dashboard_origin (an override for the primary dashboard origin), workspace_proxy_hostnames, pre_install_script, post_install_script, icon, and the scripts output.
• The start script also frees the redirector port before relaunching.
• Generated helpers (start-gateway.sh, redirect-gateway.py, coder-origins.py) are written to $HOME/.coder-modules/coder-labs/kiro-crew/scripts/ next to the coder-utils scripts, not to Kiro Crew's ~/.kiro/crew data directory.

Decision log: dashboard origins and workspace proxies

Problem (reproduced on dogfood). The module derived https://<slug>-dashboard--<ws>--<owner>.<access-host> in Terraform. Dogfood's wildcard is *--apps.dogfood.cdr.dev, and each workspace proxy has its own (*--apps.us-east-2.dogfood.cdr.dev, ...). The redirector sent every browser, on primary or on a proxy, to a host that is not a valid app URL. The real dashboard hosts returned Host header not allowed., because the gateway allowlist is exact-match and fixed at launch.

Evidence.

• Terraform cannot see the wildcard app hostname. The agent's VSCODE_PROXY_URI is <scheme>:// + the primary wildcard with * replaced by {{port}}--<agent>--<ws>--<owner> (coderd/agentapi/manifest.go), with no auth needed.
• Slug apps use <slug>--<ws>--<owner> without the agent (db2sdk.AppSubdomain). Coder also routes the form that names the agent.
• Coder's app proxy keeps the browser's Host (httputil.NewSingleHostReverseProxy does not rewrite req.Host), so the redirector can tell which hostname the browser used.
• Proxy wildcards come only from /api/v2/regions, which needs a user token. The agent token gets 401.

Decisions.

1. Compute origins at startup in a stdlib-only Python helper. Primary comes from VSCODE_PROXY_URI, plus each entry in the new workspace_proxy_hostnames. Both slug forms are trusted. The old Terraform-derived origin is only a last resort, and it logs a warning.
2. One snapshot (~/.kiro/crew/coder-origins.json) feeds both the gateway allowlist and the redirector's exact app host -> dashboard origin routes. The redirector only looks up the request Host and never builds Location from it, so a token never goes to an origin outside the allowlist. Unknown hosts, including unlisted proxies, go to the primary origin.
3. No automatic proxy discovery. It would need data.coder_workspace_owner.me.session_token inside the workspace. coder-utils writes the start script to the persistent home volume, and coder_env would expose the token to every process. Explicit configuration was the safer tradeoff.
4. dashboard_origin still overrides the primary origin. When it is set, VSCODE_PROXY_URI is ignored.
5. Redirects send Cache-Control: no-store and Referrer-Policy: no-referrer.
6. The gateway allowlist is static, so adding a proxy requires a workspace restart (documented).

Type of Change

• New module
• New template
• Bug fix
• Feature/enhancement
• Documentation
• Other

Module Information

Path: registry/coder-labs/modules/kiro-crew
New version: v0.0.1
Breaking change: [ ] Yes [x] No

Testing & Validation

• Tests pass (bun test)

• Code formatted (bun fmt)

• Changes tested locally

• terraform test: 16 passed (plan for input-derived values; apply for healthchecks, coder_env, and the scripts output).

• bun test main.test.ts: 13 passed. Covers cached and fresh installs, use_cached = false, download failure, MCP write and merge, gateway and redirector launch (302 with token, CORS origins, dashboard.url, token env), 503 before the gateway is ready, replacing a stale listener, and a missing binary, proxy-preserving redirects (including the agent-named form, an explicit scheme and port, and unlisted or unrelated hosts falling back to primary, with every redirect origin checked against the gateway allowlist), the dashboard_origin override, and the fallback without VSCODE_PROXY_URI. Installers and the gateway are mocked.

• terraform_validate.sh, readmevalidation, shellcheck (including the rendered .tftpl scripts), and validate_set_u_order.sh pass.

• Live on dogfood (workspace on j-kiro-crew-pr-1196, running the rendered start script): opening the tile via primary, us-east-2, eu-central-1, and ap-southeast-2 redirected to the dashboard on the same hostname and served the Kiro Crew page (HTTP 200). With no workspace_proxy_hostnames, us-east-2 fell back to the primary dashboard, which loaded.

• Not tested: Kiro login.

Related Issues

The companion Kubernetes template is on branch superblink/coder-labs-kiro-crew-template and will be opened as a separate PR after this module is published, because it references registry.coder.com/coder-labs/kiro-crew/coder 0.0.1.

---

Generated with Coder Agents using Claude

Created on behalf of @greg-the-coder

[github-actions]

Module Scorecard Check

coder-labs/kiro-crew: first scorecard, 84 / 100

No specific score is required to contribute, but modules with higher scores are more likely to be approved by the Coder team and widely used.

Full scorecard for this PR

Presentation & Onboarding	Agent Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	15 / 25	20 / 20	20 / 20	10 / 10	84 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README has distinct, well-documented examples for each major configuration mode: pre_install_script for system prerequisites, extra_mcp_json for MCP merging, workspace_proxy_hostnames for proxy setups, dashboard_origin override, headless vs interactive auth, and AWS Builder ID via external auth.
Visual preview	5	0	No image, GIF, or video embedded in the README; only text and icon reference.

Agent Integration — 15 / 25

Criterion	Max	Score	Notes
AI governance	10	0	No mention of Coder AI Gateway or Agent Firewall anywhere in the README.
Dashboard entry point	5	5	coder_app resources kiro_crew (visible) and kiro_crew_dashboard (hidden) are documented, with described launch/redirect behavior.
Session continuity	5	5	Dedicated "Session continuity" section documents reconnection, surviving restarts via persistent $HOME, and the gateway reattaching to running sessions.
Managed configuration	5	5	extra_mcp_json documented with example for deep-merging MCP server config into ~/.kiro/settings/mcp.json.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	aws_builder_id_token variable is sensitive = true. README examples use data.coder_external_auth and coder secret create rather than inline literal/placeholder secrets.
Non-hardcoded auth path	4	4	Documents AWS Builder ID via external auth (coder_external_auth), Coder user secrets for KIRO_API_KEY, and device-code sign-in via kiro-cli login.

Restricted-Environment Readiness — 20 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	5	kiro_cli_install_url and kirocrew_install_url variables override the installer download URLs, documented in a dedicated "Use an internal mirror" section with example.
Bring-your-own binary	10	10	use_cached (default true) documented in "Bring your own binaries (skip all downloads)" with Dockerfile example to bake in binaries and skip installers entirely.
Egress transparency	3	3	Dedicated "Network access" section with a table enumerating install/runtime endpoints (cli.kiro.dev, download.crew.kiro.dev, Astral/uv, PyPI, Kiro model backend) and how to avoid each.
Runs without sudo	2	2	install.sh.tftpl and start.sh.tftpl never invoke sudo; only the user-supplied pre_install_script example uses sudo apt-get, which is optional and outside core module scripts.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Variables have clear descriptions, sensible defaults, and validation blocks for port, redirect_port, slug, share, open_in, dashboard_origin, workspace_proxy_hostnames, and extra_mcp_json.
Test coverage	4	4	.tftest.hcl covers business logic (origin derivation, script args, outputs, validation failures); main.test.ts covers end-to-end behavior (install/start scripts, redirector routing, gateway health, MCP merging).

Overall — 84 / 100

Raw 77 / 92 → round(77 / 92 × 100) = 84

Tip

You can run this locally by telling your agent: "review this module against .github/scorecard/SCORECARD.md".

---

Scored against SCORECARD.md with solstice-1. Language-model scores are advisory.

[greg-the-coder]

CI/Validate is failing as the template requires the included module, which doesn't exist yet. I re-tested successfully locally in my https://partner.coderdemo.io/ environment with the module source copied in directly, and had coder agents update the doco to increase the scorecard check score.

[35C4n0r]

@greg-the-coder the Kiro Crew button redirects me to the workspace dashboard instead.
This is the template that I'm using: https://dogfood.cdr.dev/templates/product/j-kiro-crew-pr-1196/docs

Screen.Recording.2026-10-22.at.19.29.34.mov

[greg-the-coder]

I was able to sort out the kiro crew dashboard URL and workspace proxy issues by testing the module in the dogfood environment, and implemented/tested the other requested changes across both the dogfood and my AWS partner demo environments.

[35C4n0r]

LGTM, gateway spins and the dashboard opens on both dogfood and coderdemo deployments.