cloudConfig.getManifest and ActivityLogPublisher return 401 Unable to resolve user ID after upgrade to 2.21.4

[cj-arto-hakola]

Checks

• I have searched github.com/aws/amazon-q-developer-cli/issues and there are no duplicates of my issue
• I have run q doctor in the affected terminal session
• I have run q restart and replicated the issue again

Operating system

Linux 6.18.33.2-microsoft-standard-WSL2 - Debian GNU/Linux 13 (trixie)

Expected behaviour

Description:
After upgrading kiro-cli to 2.21.4, every session logs a 401 Unauthorized from two backend calls, even when the session is otherwise authenticated
and working normally:

1. network.cloudConfig.getManifest -> https://app.kiro.dev
   errorType: UnauthorizedException, statusCode: 401, message: "Unable to resolve user ID"
   CLI falls back to cached config (cloudConfig.sync.fellBackToCache, reason: authRejected)
   User-visible message: "Couldn't fetch your cloud config — it will retry on a future session."

2. ActivityLogPublisher -> https://runtime.us-east-1.kiro.dev/agents/activity
   Failed to publish to https://runtime.us-east-1.kiro.dev/agents/activity: 401 — {"message":"Unauthorized"}

Reproduction / timeline:

• No occurrences in logs prior to 2026-09-15 06:09 (checked all sessions from 2026-09-14).
• First appears immediately following the kiro-cli upgrade.
• Reproducible in every session since, including fresh sessions after re-authenticating.
• Confirmed not caused by a stale local lock file (~/.kiro/settings/cli.json.lock was removed; issue persists).
• Local config (~/.kiro/settings/cli.json) is valid JSON, no corruption.

Environment:

• kiro-cli version: 2.21.4
• Build: 1.0.437 (5349479558af37fecbfcdb58c199ee59d86d4dd3)
• Platform: x64 Linux

Expected: cloud config manifest and activity log publishing succeed for an authenticated session.
Actual: both consistently return 401 "Unable to resolve user ID" / "Unauthorized", suggesting the auth token used for these specific calls is not
resolving to a valid user identity server-side, despite the CLI session being authenticated for normal chat/tool use.

Actual behaviour

Description:
After upgrading kiro-cli to 2.21.4, every session logs a 401 Unauthorized from two backend calls, even when the session is otherwise authenticated
and working normally:

1. network.cloudConfig.getManifest -> https://app.kiro.dev
   errorType: UnauthorizedException, statusCode: 401, message: "Unable to resolve user ID"
   CLI falls back to cached config (cloudConfig.sync.fellBackToCache, reason: authRejected)
   User-visible message: "Couldn't fetch your cloud config — it will retry on a future session."

2. ActivityLogPublisher -> https://runtime.us-east-1.kiro.dev/agents/activity
   Failed to publish to https://runtime.us-east-1.kiro.dev/agents/activity: 401 — {"message":"Unauthorized"}

Reproduction / timeline:

• No occurrences in logs prior to 2026-09-15 06:09 (checked all sessions from 2026-09-14).
• First appears immediately following the kiro-cli upgrade.
• Reproducible in every session since, including fresh sessions after re-authenticating.
• Confirmed not caused by a stale local lock file (~/.kiro/settings/cli.json.lock was removed; issue persists).
• Local config (~/.kiro/settings/cli.json) is valid JSON, no corruption.

Environment:

• kiro-cli version: 2.21.4
• Build: 1.0.437 (5349479558af37fecbfcdb58c199ee59d86d4dd3)
• Platform: x64 Linux

Expected: cloud config manifest and activity log publishing succeed for an authenticated session.
Actual: both consistently return 401 "Unable to resolve user ID" / "Unauthorized", suggesting the auth token used for these specific calls is not
resolving to a valid user identity server-side, despite the CLI session being authenticated for normal chat/tool use.

Steps to reproduce

No response

Environment

<This will be visible to anyone. Do not include personal or sensitive information>

[q-details]
version = "2.21.4"
hash = "57c33e903958a4731d1eaaa8353ad807badbe7d7"
date = "2026-09-11T12:46:40.03318Z (5d ago)"
variant = "minimal"

[system-info]
chip = "AMD Ryzen 7 PRO 7840U w/ Radeon 780M Graphics"
total-cores = 3
memory = "10.70 GB"

[system-info.os.linux]
kernel_version = "6.18.33.2-microsoft-standard-WSL2"
id = "debian"
name = "Debian GNU/Linux"
pretty_name = "Debian GNU/Linux 13 (trixie)"
version_id = "13"
version = "13 (trixie)"

[environment]
cwd = "/home/USER"
cli-path = "/home/USER"
os = "Linux"
shell-path = "/usr/bin/bash"
shell-version = "5.2.37"
install-method = "unknown"
in-wsl = true

[env-vars]
DISPLAY = ":0"
PATH = "/home/USER/.nvm/versions/node/v24.21.0/bin:/usr/local/go/bin:/home/USER/.local/bin:/home/USER/bin:/home/USER/.local/bin:/home/USER/.cargo/bin:/home/linuxbrew/.linuxbrew/bin:/home/linuxbrew/.linuxbrew/sbin:/home/USER/.nvm/versions/node/v24.21.0/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/usr/lib/wsl/lib:/mnt/c/Python313/Scripts/:/mnt/c/Python313/:/mnt/c/WINDOWS/system32:/mnt/c/WINDOWS:/mnt/c/WINDOWS/System32/Wbem:/mnt/c/WINDOWS/System32/WindowsPowerShell/v1.0/:/mnt/c/WINDOWS/System32/OpenSSH/:/mnt/c/Program Files/Go/bin:/mnt/c/Program Files/Microsoft SQL Server/150/Tools/Binn/:/mnt/c/Program Files/Microsoft SQL Server/Client SDK/ODBC/170/Tools/Binn/:/mnt/c/Program Files/GitHub CLI/:/mnt/c/Granted:/mnt/c/ProgramData/chocolatey/bin:/mnt/c/Program Files/PostgreSQL/17/bin:/mnt/c/Program Files/Amazon/AWSCLIV2/:/mnt/c/Program Files/dotnet/:/mnt/c/Program Files/Microsoft SQL Server/170/Tools/Binn/:/mnt/c/Program Files/KeePassXC/:/mnt/c/Program Files/PuTTY/:/mnt/c/Program Files/Docker/Docker/resources/bin:/mnt/c/Program Files/Git/cmd:/mnt/c/Program Files/PowerShell/7/:/mnt/c/Users/ArtoHakola/.local/bin:/mnt/c/Users/ArtoHakola/AppData/Local/Microsoft/WindowsApps:/mnt/c/Microsoft VS Code/bin:/mnt/c/Users/ArtoHakola/AppData/Local/Programs/Ollama:/mnt/c/Users/ArtoHakola/AppData/Local/GitHubDesktop/bin:/mnt/c/Users/ArtoHakola/go/bin:/mnt/c/Users/ArtoHakola/AppData/Roaming/npm:/mnt/c/Users/ArtoHakola/.dotnet/tools:/mnt/c/Users/ArtoHakola/AppData/Local/Programs/oh-my-posh/bin:/mnt/c/Users/ArtoHakola/AppData/Local/Microsoft/WinGet/Links:/mnt/c/Users/ArtoHakola/.cache/lm-studio/bin:/mnt/c/Users/ArtoHakola/AppData/Local/Microsoft/WinGet/Packages/astral-sh.uv_Microsoft.Winget.Source_8wekyb3d8bbwe:/mnt/c/Users/ArtoHakola/AppData/Local/Microsoft/WindowsApps:/mnt/c/Users/ArtoHakola/AppData/Local/nvm:/mnt/c/nvm4w/nodejs:/mnt/c/Kiro/bin:/mnt/c/Users/ArtoHakola/.dotnet/tools:/snap/bin:/home/USER/.dotnet/tools:/home/USER/.local/bin:/home/USER/.dotnet/tools:/home/USER/go/bin"
QTERM_SESSION_ID = "fa9fc44e890c48dab9a08487f2a393b2"
Q_SET_PARENT_CHECK = "1"
Q_TERM = "2.21.4"
SHELL = "/bin/bash"
TERM = "xterm-256color"