@@ -233,6 +233,21 @@ experience may change before `1.0.0`.
     (`element is not visible`; deterministic locally in isolation). The helper
     now writes the matching `session-state.json` first, as the reload test
     already does, so the server reports the session the mount pretends to have.
+- The three Kiro agent files are installed as copies, not links. kiro-cli
+  rewrites an agent file it loads -- the legacy `hooks` object becomes the
+  array form, the `toolsSettings` denylist regexes become `permissions.rules`
+  globs -- and through the installer's links that rewrite landed in the
+  repository's `agents/kiro/studyloop.json` and `study-plan-architect.json`
+  on 2026-10-12, both in one second: seven manifest tests red, and the migrated
+  denylist carried a bare `*` (every shell command denied) where
+  `curl .* \| bash` had been. The copy keeps that rewrite on the learner's
+  machine; a re-run of `studyloop install agents` refreshes a migrated copy from
+  the shipped definition (no `.bak`, it is StudyLoop's own file by name), still
+  backs up a foreign file at the same path, and `--uninstall` removes only
+  ours. The directories beside the files (`shared/`, `study-mentor/`,
+  `study-plan-architect/`, skills) stay links, so every `file://` resource
+  resolves as before. Run `studyloop install agents --tool kiro` once to replace
+  an existing link.
 - The `voice-tts` OpenSpec specification described the architecture that was
   deleted, not the one that shipped: it required browser-side Kokoro via
   `transformers.js` and forbade any server-side synthesis for the web path,
 
@@ -48,7 +48,7 @@ Then check the result:
 studyloop doctor --category agents
 ```
 
-The installer links StudyLoop-managed definitions while preserving an existing file as a `.bak` backup when necessary. Use `studyloop install agents --uninstall` to remove links created by StudyLoop.
+The installer links StudyLoop-managed definitions (copying the three Kiro agent files, see below) while preserving an existing file as a `.bak` backup when necessary. Use `studyloop install agents --uninstall` to remove what StudyLoop installed.
 
 ## Start a study session
 
@@ -87,6 +87,15 @@ StudyLoop's `studyloop` and `session-db` MCP servers, and pre-approves no
 tools, the same grants ACP sessions had before it existed. You never start it
 yourself; `studyloop doctor` checks that kiro-cli validates and lists it.
 
+The three Kiro agent files (`study-mentor.json`, `studyloop.json`,
+`study-plan-architect.json`) are installed as **copies** under `~/.kiro/agents/`,
+not links: kiro-cli rewrites an agent file it loads (its hook and permission
+schema migrate in place), and a link would carry that rewrite back into
+StudyLoop's own sources. If kiro-cli has migrated your copy, that is expected;
+`studyloop install agents --tool kiro` refreshes it from the shipped definition.
+The directories beside them (`shared/`, `study-mentor/`, `study-plan-architect/`,
+the skills) remain links, so their `file://` resources resolve exactly as before.
+
 Kiro also receives the opt-in `studyloop-xtiles-wind-down` skill at `~/.kiro/skills/`, as a symlink to the shared copy described below. It stays silent unless your second-brain provider is `xtiles` and an `xtiles` MCP server is connected.
 
 ### Codex
 
@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import json
 import os
 import shutil
 import subprocess
@@ -36,21 +37,43 @@ class LinkSpec:
     and harnesses that already read ``~/.agents/skills`` (Codex, OpenCode, pi)
     would get redundant paths. With a hub, those three are served directly and
     only Kiro/Claude need native-directory links.
+
+    ``copy=True`` installs a COPY of ``source`` at ``target`` instead of a link.
+    For a file the harness itself rewrites that is the only safe shape: kiro-cli
+    migrates an agent file it loads (the legacy ``hooks`` object to the array
+    form, ``toolsSettings`` denylist regexes to ``permissions.rules`` globs) and
+    writes the result back to the path it read -- through a link, into the
+    repository. On 2026-10-12 that left ``agents/kiro/studyloop.json`` and
+    ``study-plan-architect.json`` rewritten in one second, seven manifest tests
+    red, and a bare ``*`` (every shell command denied) in the migrated denylist
+    where ``curl .* \\| bash`` had been. A copy keeps the rewrite where it
+    belongs, on the learner's machine; re-running the installer refreshes it.
     """
 
     source: str
     target: str
+    copy: bool = False
 
 
 _HOME = Path.home()
 
 _TOOL_LINKS: dict[str, tuple[LinkSpec, ...]] = {
     "kiro": (
-        LinkSpec("agents/kiro/study-mentor.json", str(_HOME / ".kiro/agents/study-mentor.json")),
+        # The three agent FILES are copies (LinkSpec.copy): kiro-cli rewrites the
+        # agent file it loads, and through a link that rewrite reached the
+        # repository (2026-10-12). The directories beside them stay links --
+        # kiro-cli reads those, it does not write them.
+        LinkSpec(
+            "agents/kiro/study-mentor.json",
+            str(_HOME / ".kiro/agents/study-mentor.json"),
+            copy=True,
+        ),
         # StudyLoop's own persona-neutral agent, named on every Kiro ACP launch
         # (`kiro-cli acp --agent studyloop`) so the learner's default agent never
         # configures a StudyLoop session (owner steer, 2026-09-26).
-        LinkSpec("agents/kiro/studyloop.json", str(_HOME / ".kiro/agents/studyloop.json")),
+        LinkSpec(
+            "agents/kiro/studyloop.json", str(_HOME / ".kiro/agents/studyloop.json"), copy=True
+        ),
         # study-plan-architect.json declares `file://shared/*.md` resources, which
         # Kiro resolves relative to the agent file's directory; this link is what
         # makes them exist there (council phase 2, L7 reviewer).
@@ -59,6 +82,7 @@ class LinkSpec:
         LinkSpec(
             "agents/kiro/study-plan-architect.json",
             str(_HOME / ".kiro/agents/study-plan-architect.json"),
+            copy=True,
         ),
         LinkSpec(
             "agents/kiro/study-plan-architect",
@@ -1384,11 +1408,59 @@ def _points_to(target: Path, source: Path) -> bool:
     return current.resolve() == source.resolve()
 
 
+def _agent_name(path: Path) -> str | None:
+    """The ``name`` of the agent definition at *path*, or None if it is not one."""
+    try:
+        data = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, ValueError):
+        return None
+    name = data.get("name") if isinstance(data, dict) else None
+    return name if isinstance(name, str) else None
+
+
+def _copy_path(source: Path, target: Path, *, uninstall: bool) -> int:
+    """Install ``source`` at ``target`` as a copy (``LinkSpec.copy``); 1 if anything changed.
+
+    The file is StudyLoop's by NAME: a target whose agent ``name`` matches the
+    source's is ours whatever its content now says -- a copy kiro-cli has since
+    migrated is refreshed in place with no backup, since the migration is the
+    reason the file is a copy at all (see :class:`LinkSpec`). A legacy link from
+    an earlier install is replaced. Anything else at the path belongs to the
+    learner: on install it is moved to ``<name>.bak`` first, on uninstall it is
+    left alone.
+    """
+    ours = target.is_symlink() and _points_to(target, source)
+    if not target.is_symlink() and target.is_file():
+        ours = _agent_name(target) == _agent_name(source)
+    if uninstall:
+        if ours:
+            target.unlink()
+            return 1
+        return 0
+    if target.is_symlink():
+        target.unlink()  # legacy layout, or a stale link: the copy replaces it either way
+    elif target.is_file():
+        if target.read_bytes() == source.read_bytes():
+            return 0
+        if not ours:
+            shutil.move(str(target), str(target.with_name(f"{target.name}.bak")))
+    elif target.exists():
+        shutil.move(str(target), str(target.with_name(f"{target.name}.bak")))
+    shutil.copyfile(source, target)
+    return 1
+
+
 def _link_paths(repo_root: Path, specs: tuple[LinkSpec, ...], *, uninstall: bool) -> int:
     changed = 0
     for spec in specs:
         source = _render_source(spec.source, repo_root)
         target = _render_target(spec.target, repo_root)
+        if spec.copy:
+            if not uninstall and not source.exists():
+                raise InstallError(f"Missing install asset: {source}")
+            target.parent.mkdir(parents=True, exist_ok=True)
+            changed += _copy_path(source, target, uninstall=uninstall)
+            continue
         # In-repo targets use relative links so they survive repo moves and
         # syncing between machines with different absolute paths.
         in_repo = "{repo_root}" in spec.target
 
@@ -355,7 +355,8 @@ def test_xtiles_skill_installed_for_each_detected_tool(tmp_path: Path, monkeypat
         "_TOOL_LINKS",
         {
             tool: tuple(
-                installers.LinkSpec(spec.source, _rebase(spec.target, tmp_path)) for spec in specs
+                installers.LinkSpec(spec.source, _rebase(spec.target, tmp_path), copy=spec.copy)
+                for spec in specs
             )
             for tool, specs in installers._TOOL_LINKS.items()
         },
@@ -654,7 +655,8 @@ def test_installed_kiro_architect_resolves_its_prompt_and_servers(
         "_TOOL_LINKS",
         {
             tool: tuple(
-                installers.LinkSpec(spec.source, _rebase(spec.target, tmp_path)) for spec in specs
+                installers.LinkSpec(spec.source, _rebase(spec.target, tmp_path), copy=spec.copy)
+                for spec in specs
             )
             for tool, specs in installers._TOOL_LINKS.items()
         },
@@ -707,7 +709,14 @@ def test_installed_kiro_architect_resolves_its_prompt_and_servers(
 
     assert claude_path.is_symlink(), "claude study-plan-architect.md was not linked"
     assert opencode_path.is_symlink(), "opencode study-plan-architect.md was not linked"
-    assert kiro_json.is_symlink(), "kiro study-plan-architect.json was not linked"
+    # A copy, not a link (2026-10-12): kiro-cli rewrites the agent file it loads,
+    # and through a link that rewrite reached agents/kiro/ in the repository.
+    assert kiro_json.is_file() and not kiro_json.is_symlink(), (
+        "kiro study-plan-architect.json was not installed as a copy"
+    )
+    assert (
+        kiro_json.read_bytes() == (repo_root / "agents/kiro/study-plan-architect.json").read_bytes()
+    )
     assert kiro_dir.is_symlink(), "kiro study-plan-architect/ directory was not linked"
     assert (kiro_dir / "persona.md").is_file()
 
@@ -732,7 +741,8 @@ def _install_kiro_into_fake_home(tmp_path: Path, monkeypatch: pytest.MonkeyPatch
         "_TOOL_LINKS",
         {
             tool: tuple(
-                installers.LinkSpec(spec.source, _rebase(spec.target, tmp_path)) for spec in specs
+                installers.LinkSpec(spec.source, _rebase(spec.target, tmp_path), copy=spec.copy)
+                for spec in specs
             )
             for tool, specs in installers._TOOL_LINKS.items()
         },
 
@@ -98,7 +98,11 @@ def test_install_places_it(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
         monkeypatch.setattr(
             installers,
             "_TOOL_LINKS",
-            {"kiro": tuple(installers.LinkSpec(spec.source, str(target)) for spec in specs)},
+            {
+                "kiro": tuple(
+                    installers.LinkSpec(spec.source, str(target), copy=spec.copy) for spec in specs
+                )
+            },
         )
         monkeypatch.setattr(installers, "_SHARED_LINKS", ())
         monkeypatch.setattr(installers, "XTILES_SKILL_LINKS", {})
@@ -109,8 +113,8 @@ def test_install_places_it(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
 
         installers.install_agent_definitions(REPO_ROOT, tools=["kiro"])
 
-        assert target.is_symlink()
-        assert target.resolve() == DEFINITION.resolve()
+        assert target.is_file() and not target.is_symlink(), "installed as a copy, not a link"
+        assert target.read_bytes() == DEFINITION.read_bytes()
         assert json.loads(target.read_text(encoding="utf-8"))["name"] == "studyloop"
 
     def test_the_manifest_tracks_it(self) -> None:
@@ -125,6 +129,139 @@ def test_the_nightly_install_job_checks_it_landed(self) -> None:
         assert 'test -e "$HOME/.kiro/agents/studyloop.json"' in workflow
 
 
+_KIRO_AGENT_SOURCES = (
+    "agents/kiro/study-mentor.json",
+    "agents/kiro/studyloop.json",
+    "agents/kiro/study-plan-architect.json",
+)
+
+
+class TestKiroAgentFilesAreCopiesNotLinks:
+    """kiro-cli rewrites an agent file it loads: the legacy ``hooks`` object becomes
+    the array form, ``toolsSettings`` denylist regexes become ``permissions.rules``
+    globs. Linked into the repository, that rewrite landed in ``agents/kiro/`` on
+    2026-10-12 -- both files in one second, seven manifest tests red, and the
+    migrated denylist carried a bare ``*`` (every shell command denied) where
+    ``curl .* \\| bash`` had been. The installed agent file is therefore a COPY
+    the repository never sees again; the directories beside it (``shared/``,
+    ``study-plan-architect/``, skills) stay links, kiro-cli does not write those.
+    """
+
+    @staticmethod
+    def _install(tmp_path: Path, monkeypatch: pytest.MonkeyPatch, *, uninstall: bool = False):
+        specs = [
+            spec for spec in installers._TOOL_LINKS["kiro"] if spec.source in _KIRO_AGENT_SOURCES
+        ]
+        assert len(specs) == 3, "all three Kiro agent files are in the install table"
+        home = tmp_path / "home"
+        rebased = tuple(
+            installers.LinkSpec(
+                spec.source,
+                spec.target.replace(str(installers._HOME), str(home), 1),
+                copy=spec.copy,
+            )
+            for spec in specs
+        )
+        monkeypatch.setattr(installers, "_TOOL_LINKS", {"kiro": rebased})
+        monkeypatch.setattr(installers, "_SHARED_LINKS", ())
+        monkeypatch.setattr(installers, "XTILES_SKILL_LINKS", {})
+        monkeypatch.setattr(installers, "SESSION_MEMORY_SKILL_LINKS", {})
+        monkeypatch.setattr(installers, "install_session_db_mandate", lambda *_a, **_k: {})
+        monkeypatch.setattr(installers, "register_mcp_servers", lambda *_a, **_k: {})
+        installers.install_agent_definitions(REPO_ROOT, tools=["kiro"], uninstall=uninstall)
+        return home / ".kiro/agents"
+
+    @staticmethod
+    def _kiro_cli_migration(path: Path) -> None:
+        """What kiro-cli 2.29 wrote through the link on 2026-10-12, in shape."""
+        data = json.loads(path.read_text(encoding="utf-8"))
+        hook = data["hooks"]["stop"][0]["command"]
+        data["hooks"] = [
+            {
+                "name": "stop-0",
+                "trigger": "stop",
+                "action": {"type": "command", "command": hook},
+                "timeout": 10,
+            }
+        ]
+        data["permissions"] = {
+            "rules": [
+                {"capability": "shell", "match": ["chmod 777*", "*", "dd if=*"], "effect": "deny"}
+            ]
+        }
+        path.write_text(json.dumps(data, indent=2), encoding="utf-8")
+
+    def test_every_kiro_agent_file_is_a_copy(self, tmp_path: Path, monkeypatch) -> None:
+        agents = self._install(tmp_path, monkeypatch)
+        for source in _KIRO_AGENT_SOURCES:
+            installed = agents / Path(source).name
+            assert installed.is_file() and not installed.is_symlink(), source
+            assert installed.read_bytes() == (REPO_ROOT / source).read_bytes(), source
+
+    def test_a_kiro_cli_rewrite_of_the_copy_leaves_the_repository_untouched(
+        self, tmp_path: Path, monkeypatch
+    ) -> None:
+        before = {s: (REPO_ROOT / s).read_bytes() for s in _KIRO_AGENT_SOURCES}
+        agents = self._install(tmp_path, monkeypatch)
+        for source in _KIRO_AGENT_SOURCES:
+            self._kiro_cli_migration(agents / Path(source).name)
+        after = {s: (REPO_ROOT / s).read_bytes() for s in _KIRO_AGENT_SOURCES}
+        assert after == before, "a rewrite of the installed file reached agents/kiro/"
+        migrated = json.loads((agents / "studyloop.json").read_text(encoding="utf-8"))
+        assert isinstance(migrated["hooks"], list), "the rewrite itself landed on the copy"
+
+    def test_reinstall_refreshes_a_rewritten_copy(self, tmp_path: Path, monkeypatch) -> None:
+        agents = self._install(tmp_path, monkeypatch)
+        self._kiro_cli_migration(agents / "studyloop.json")
+        self._install(tmp_path, monkeypatch)
+        refreshed = agents / "studyloop.json"
+        assert refreshed.read_bytes() == DEFINITION.read_bytes()
+        assert not (agents / "studyloop.json.bak").exists(), "our own file is not backed up"
+
+    def test_reinstall_is_a_no_op_on_an_identical_copy(self, tmp_path: Path, monkeypatch) -> None:
+        agents = self._install(tmp_path, monkeypatch)
+        stamp = (agents / "studyloop.json").stat().st_mtime_ns
+        self._install(tmp_path, monkeypatch)
+        assert (agents / "studyloop.json").stat().st_mtime_ns == stamp
+
+    def test_install_replaces_the_legacy_link_with_a_copy(
+        self, tmp_path: Path, monkeypatch
+    ) -> None:
+        agents = tmp_path / "home/.kiro/agents"
+        agents.mkdir(parents=True)
+        (agents / "studyloop.json").symlink_to(DEFINITION)
+        self._install(tmp_path, monkeypatch)
+        installed = agents / "studyloop.json"
+        assert installed.is_file() and not installed.is_symlink()
+        assert installed.read_bytes() == DEFINITION.read_bytes()
+
+    def test_install_backs_up_a_foreign_file_at_our_name(self, tmp_path: Path, monkeypatch) -> None:
+        agents = tmp_path / "home/.kiro/agents"
+        agents.mkdir(parents=True)
+        foreign = json.dumps({"name": "my-own-agent", "prompt": "mine"})
+        (agents / "studyloop.json").write_text(foreign, encoding="utf-8")
+        self._install(tmp_path, monkeypatch)
+        assert (agents / "studyloop.json").read_bytes() == DEFINITION.read_bytes()
+        assert (agents / "studyloop.json.bak").read_text(encoding="utf-8") == foreign
+
+    def test_uninstall_removes_our_copy_even_after_a_rewrite(
+        self, tmp_path: Path, monkeypatch
+    ) -> None:
+        agents = self._install(tmp_path, monkeypatch)
+        self._kiro_cli_migration(agents / "studyloop.json")
+        self._install(tmp_path, monkeypatch, uninstall=True)
+        for source in _KIRO_AGENT_SOURCES:
+            assert not (agents / Path(source).name).exists(), source
+
+    def test_uninstall_leaves_a_foreign_file_alone(self, tmp_path: Path, monkeypatch) -> None:
+        agents = tmp_path / "home/.kiro/agents"
+        agents.mkdir(parents=True)
+        foreign = json.dumps({"name": "my-own-agent"})
+        (agents / "studyloop.json").write_text(foreign, encoding="utf-8")
+        self._install(tmp_path, monkeypatch, uninstall=True)
+        assert (agents / "studyloop.json").read_text(encoding="utf-8") == foreign
+
+
 class TestTheAcpLaunchNamesIt:
     @staticmethod
     def _argv(agent: str, monkeypatch: pytest.MonkeyPatch) -> list[str]: