Kiro is tracking messages typed in my linux shell, not chat

[jjshoe]

Checks

• I have searched github.com/aws/amazon-q-developer-cli/issues and there are no duplicates of my issue
• I have run q doctor in the affected terminal session
• I have run q restart and replicated the issue again

Operating system

Linux 6.17.0-12-generic - Ubuntu 25.10

Expected behaviour

No terminal commands logged

Actual behaviour

I open a terminal and type any command, echo, ls, cd, etc. I find them in the history table of ~/.local/share/kiro-cli/data.sqlite3

Steps to reproduce

No response

Environment

my bash_profile is:
# Kiro CLI pre block. Keep at the top of this file.
[[ -f "${HOME}/.local/share/kiro-cli/shell/bash_profile.pre.bash" ]] && builtin source "${HOME}/.local/share/kiro-cli/shell/bash_profile.pre.bash"                                                                                                           


# Kiro CLI post block. Keep at the bottom of this file.
[[ -f "${HOME}/.local/share/kiro-cli/shell/bash_profile.post.bash" ]] && builtin source "${HOME}/.local/share/kiro-cli/shell/bash_profile.post.bash"

[jjshoe]

Seems to be a result of using this crate: amazon-q-developer-cli-autocomplete

There is no reason I can think of that it should be saving everything I type.

[jjshoe]

kiro-cli inline status
Inline is disabled

kiro-cli settings autocomplete.disable
true

and this awful behavior continues, I still see shell commands inserted into the db

[mifisignal]

I'm attaching a PDF with some more detailed findings below. Here are the main bullet points (note, this analysis was AI-assisted):

• Every command run after installation is captured locally. Shell hooks persist each
  executed command to a local SQLite database with richer metadata than the shell's own
  history file: working directory, exit code, shell, session ID, and timestamps.

  • crates/fig_settings/src/history.rs#L87
  • crates/alacritty_terminal/src/term/mod.rs#L160 (CommandInfo struct)

• When inline AI completion is active, a rolling window of recent commands is sent to AWS.
  Each time the user pauses typing, the 49 most recently completed commands are formatted
  verbatim and sent to AWS CodeWhisperer's generate_completions API as context. This is the
  intended mechanism of the feature, not a side-effect.

  • crates/figterm/src/inline/mod.rs#L381 (prompt() — formats history verbatim)
  • crates/figterm/src/inline/mod.rs#L245 (placed into FileContext.left_file_content)

• The risk is incidental exposure within that window, not bulk exfiltration. Pre-installation
  history is never transmitted. The concern is that sensitive values passed as command-line
  arguments — credentials, tokens, connection strings — may be present among the 49 most recent
  commands when a completion request fires (e.g. a prior export AWS_SECRET_ACCESS_KEY=... or
  psql postgresql://user:password@host/db).

• Pre-existing shell history is read on launch but stays local. The autocomplete overlay
  runs fc -ln 1 (bash/zsh) and history search (fish) with no lower bound, reading the
  entire native history file including history predating installation. This data is held in
  memory for local suggestions only and is never written to the SQLite database or sent to AWS.

  • packages/autocomplete/src/history/index.ts#L301

• Disabling inline completion stops remote transmission; local capture continues.
  The INLINE_ENABLED setting gates the CodeWhisperer API call but not the shell hooks.
  Local capture runs as long as the hooks are installed.

  • crates/figterm/src/inline/mod.rs#L58

amazon_q_cli_history_report.pdf

[mifisignal]

Some more notes:

• This is documented, sort of, here: https://aws.amazon.com/about-aws/whats-new/2024/06/amazon-q-inline-completions-command-line/ : "To generate accurate suggestions, Q Developer looks at your current shell context and your recent shell history"
• I looked through the Kiro docs and didn't see any discussion of this there, either. It's discussed neither in https://kiro.dev/docs/cli/privacy-and-security/ nor https://kiro.dev/docs/cli/autocomplete/