Kiro: preview tab labels sent as file paths, causing wakatime-cli warnings and wasted CPU

[boooobad]

Description

When Kiro has a Preview tab open (e.g. Preview: todo.md), macos-wakatime reads the tab label via accessibility APIs and passes it to wakatime-cli as the file entity path. Because "Preview: todo.md" is a display label — not a real filesystem path — wakatime-cli tries and fails to open it for language detection, generating two warnings per invocation and wasting CPU.

Log evidence

Every Kiro heartbeat from a preview tab produces two warning pairs in ~/.wakatime/wakatime.log:

{"level":"warn","caller":"language/chroma.go:128","message":"failed to load folder files extensions: failed to read directory: open : no such file or directory","file":"Preview: todo.md","plugin":"Kiro/0.12.333-0.12.333 macos-wakatime/5.28.3"}
{"level":"warn","caller":"language/chroma.go:133","message":"failed to load head from file \"Preview: todo.md\": failed to open file \"Preview: todo.md\": open Preview: todo.md: no such file or directory","file":"Preview: todo.md","plugin":"Kiro/0.12.333-0.12.333 macos-wakatime/5.28.3"}

Over a normal working day this accumulates to 1000+ warning pairs (2000+ log lines) in wakatime.log.

Environment

• macOS WakaTime: v5.28.3 (also present in v5.28.4 — no fix in changelog)
• wakatime-cli: v2.15.3 / v2.16.1
• Kiro: 0.12.333 (also reproducible across 0.11.x, 0.12.x as seen in logs)
• macOS: darwin/arm64

Root cause

Kiro is a VS Code-based editor. When a preview tab is active, its window/tab title uses the prefix "Preview: <filename>". The entity extraction in MonitoringManager.heartbeatData reads the window title for apps not explicitly listed in MonitoredApp (Kiro has no dedicated case), and passes the raw label as the file path.

The entity function falls through to the generic title(for:element:) path which returns the window title as-is, without checking whether it resolves to a real path on disk.

Suggested fix

In the entity extraction for Kiro (and other VS Code-based forks), skip or return nil for titles matching ^Preview: — they are virtual tabs, not files. Alternatively, add Kiro as a named MonitoredApp case with the same path-extraction logic used for VS Code / Cursor, which reads the actual file URL from the accessibility tree rather than the window title.

Kiro's bundle ID appears to be kiro.app or similar (Electron-based).

Impact

• Hundreds of bogus wakatime-cli subprocess spawns per session, each opening a nonexistent path
• 2000+ spurious log lines per day inflating wakatime.log
• Contributes to elevated CPU from wakatime-cli on machines running Kiro