cloudConfig.getManifest and ActivityLogPublisher return 401 Unable to resolve user ID after upgrade to 2.21.4

Start with the cloudConfig.getManifest and ActivityLogPublisher entry points named in the report, then inspect the authentication used for requests to app.kiro.dev and runtime.us-east-1.kiro.dev. Use q doctor, q restart, and session logs to reproduce the two 401 responses; done means both calls succeed for an authenticated session without the cached-config fallback or activity publish error.

Checks

• I have searched github.com/aws/amazon-q-developer-cli/issues and there are no duplicates of my issue
• I have run q doctor in the affected terminal session
• I have run q restart and replicated the issue again

Operating system

Linux 6.18.33.2-microsoft-standard-WSL2 - Debian GNU/Linux 13 (trixie)

Expected behaviour

Description:
After upgrading kiro-cli to 2.21.4, every session logs a 401 Unauthorized from two backend calls, even when the session is otherwise authenticated
and working normally:

1. network.cloudConfig.getManifest -> https://app.kiro.dev
   errorType: UnauthorizedException, statusCode: 401, message: "Unable to resolve user ID"
   CLI falls back to cached config (cloudConfig.sync.fellBackToCache, reason: authRejected)
   User-visible message: "Couldn't fetch your cloud config — it will retry on a future session."

2. ActivityLogPublisher -> https://runtime.us-east-1.kiro.dev/agents/activity
   Failed to publish to https://runtime.us-east-1.kiro.dev/agents/activity: 401 — {"message":"Unauthorized"}

Reproduction / timeline:

• No occurrences in logs prior to 2026-09-15 06:09 (checked all sessions from 2026-09-14).
• First appears immediately following the kiro-cli upgrade.
• Reproducible in every session since, including fresh sessions after re-authenticating.
• Confirmed not caused by a stale local lock file (~/.kiro/settings/cli.json.lock was removed; issue persists).
• Local config (~/.kiro/settings/cli.json) is valid JSON, no corruption.

Environment:

• kiro-cli version: 2.21.4
• Build: 1.0.437 (5349479558af37fecbfcdb58c199ee59d86d4dd3)
• Platform: x64 Linux

Expected: cloud config manifest and activity log publishing succeed for an authenticated session.
Actual: both consistently return 401 "Unable to resolve user ID" / "Unauthorized", suggesting the auth token used for these specific calls is not
resolving to a valid user identity server-side, despite the CLI session being authenticated for normal chat/tool use.

Actual behaviour

Description:
After upgrading kiro-cli to 2.21.4, every session logs a 401 Unauthorized from two backend calls, even when the session is otherwise authenticated
and working normally:

1. network.cloudConfig.getManifest -> https://app.kiro.dev
   errorType: UnauthorizedException, statusCode: 401, message: "Unable to resolve user ID"
   CLI falls back to cached config (cloudConfig.sync.fellBackToCache, reason: authRejected)
   User-visible message: "Couldn't fetch your cloud config — it will retry on a future session."

2. ActivityLogPublisher -> https://runtime.us-east-1.kiro.dev/agents/activity
   Failed to publish to https://runtime.us-east-1.kiro.dev/agents/activity: 401 — {"message":"Unauthorized"}

Reproduction / timeline:

• No occurrences in logs prior to 2026-09-15 06:09 (checked all sessions from 2026-09-14).
• First appears immediately following the kiro-cli upgrade.
• Reproducible in every session since, including fresh sessions after re-authenticating.
• Confirmed not caused by a stale local lock file (~/.kiro/settings/cli.json.lock was removed; issue persists).
• Local config (~/.kiro/settings/cli.json) is valid JSON, no corruption.

Environment:

• kiro-cli version: 2.21.4
• Build: 1.0.437 (5349479558af37fecbfcdb58c199ee59d86d4dd3)
• Platform: x64 Linux

Expected: cloud config manifest and activity log publishing succeed for an authenticated session.
Actual: both consistently return 401 "Unable to resolve user ID" / "Unauthorized", suggesting the auth token used for these specific calls is not
resolving to a valid user identity server-side, despite the CLI session being authenticated for normal chat/tool use.

Steps to reproduce

No response

Environment

<This will be visible to anyone. Do not include personal or sensitive information>

[q-details]
version = "2.21.4"
hash = "57c33e903958a4731d1eaaa8353ad807badbe7d7"
date = "2026-09-11T12:46:40.03318Z (5d ago)"
variant = "minimal"

[system-info]
chip = "AMD Ryzen 7 PRO 7840U w/ Radeon 780M Graphics"
total-cores = 3
memory = "10.70 GB"

[system-info.os.linux]
kernel_version = "6.18.33.2-microsoft-standard-WSL2"
id = "debian"
name = "Debian GNU/Linux"
pretty_name = "Debian GNU/Linux 13 (trixie)"
version_id = "13"
version = "13 (trixie)"

[environment]
cwd = "/home/USER"
cli-path = "/home/USER"
os = "Linux"
shell-path = "/usr/bin/bash"
shell-version = "5.2.37"
install-method = "unknown"
in-wsl = true

[env-vars]
DISPLAY = ":0"
PATH = "/home/USER/.nvm/versions/node/v24.21.0/bin:/usr/local/go/bin:/home/USER/.local/bin:/home/USER/bin:/home/USER/.local/bin:/home/USER/.cargo/bin:/home/linuxbrew/.linuxbrew/bin:/home/linuxbrew/.linuxbrew/sbin:/home/USER/.nvm/versions/node/v24.21.0/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/usr/lib/wsl/lib:/mnt/c/Python313/Scripts/:/mnt/c/Python313/:/mnt/c/WINDOWS/system32:/mnt/c/WINDOWS:/mnt/c/WINDOWS/System32/Wbem:/mnt/c/WINDOWS/System32/WindowsPowerShell/v1.0/:/mnt/c/WINDOWS/System32/OpenSSH/:/mnt/c/Program Files/Go/bin:/mnt/c/Program Files/Microsoft SQL Server/150/Tools/Binn/:/mnt/c/Program Files/Microsoft SQL Server/Client SDK/ODBC/170/Tools/Binn/:/mnt/c/Program Files/GitHub CLI/:/mnt/c/Granted:/mnt/c/ProgramData/chocolatey/bin:/mnt/c/Program Files/PostgreSQL/17/bin:/mnt/c/Program Files/Amazon/AWSCLIV2/:/mnt/c/Program Files/dotnet/:/mnt/c/Program Files/Microsoft SQL Server/170/Tools/Binn/:/mnt/c/Program Files/KeePassXC/:/mnt/c/Program Files/PuTTY/:/mnt/c/Program Files/Docker/Docker/resources/bin:/mnt/c/Program Files/Git/cmd:/mnt/c/Program Files/PowerShell/7/:/mnt/c/Users/ArtoHakola/.local/bin:/mnt/c/Users/ArtoHakola/AppData/Local/Microsoft/WindowsApps:/mnt/c/Microsoft VS Code/bin:/mnt/c/Users/ArtoHakola/AppData/Local/Programs/Ollama:/mnt/c/Users/ArtoHakola/AppData/Local/GitHubDesktop/bin:/mnt/c/Users/ArtoHakola/go/bin:/mnt/c/Users/ArtoHakola/AppData/Roaming/npm:/mnt/c/Users/ArtoHakola/.dotnet/tools:/mnt/c/Users/ArtoHakola/AppData/Local/Programs/oh-my-posh/bin:/mnt/c/Users/ArtoHakola/AppData/Local/Microsoft/WinGet/Links:/mnt/c/Users/ArtoHakola/.cache/lm-studio/bin:/mnt/c/Users/ArtoHakola/AppData/Local/Microsoft/WinGet/Packages/astral-sh.uv_Microsoft.Winget.Source_8wekyb3d8bbwe:/mnt/c/Users/ArtoHakola/AppData/Local/Microsoft/WindowsApps:/mnt/c/Users/ArtoHakola/AppData/Local/nvm:/mnt/c/nvm4w/nodejs:/mnt/c/Kiro/bin:/mnt/c/Users/ArtoHakola/.dotnet/tools:/snap/bin:/home/USER/.dotnet/tools:/home/USER/.local/bin:/home/USER/.dotnet/tools:/home/USER/go/bin"
QTERM_SESSION_ID = "fa9fc44e890c48dab9a08487f2a393b2"
Q_SET_PARENT_CHECK = "1"
Q_TERM = "2.21.4"
SHELL = "/bin/bash"
TERM = "xterm-256color"