@songsid/agend 2.3.2-beta.1 → 2.3.2-beta.11

package/dist/backend/kiro.js

@@ -5,14 +5,17 @@ import { homedir } from "node:os";
 import { getAgendHome } from "../paths.js";
 import { credentialHomeSpec, credentialProfileHome, credentialProfileStoreHome, prepareCredentialProfileHome, resolveCredentialProfile, } from "./credential-profile.js";
 import { kiroAgentName, kiroFleetTag, writeKiroAgent, removeKiroAgent, writeSharedKiroMcpEntries, removeSharedKiroMcpEntries, writeTaggedKiroSteering, removeTaggedKiroSteering, } from "./kiro-agent.js";
-import { resolveKiroIdentity, listKiroV1Sessions, listKiroV2Sessions, confirmKiroAgentSwitch, kiroAgentConfirmed, forgetKiroIdentity, kiroIdentityNeedsStore, kiroCanonicalDirectory, KiroIdentityError, } from "./kiro-identity.js";
+import { resolveKiroIdentity, listKiroV1Sessions, listKiroV2Sessions, confirmKiroAgentSwitch, kiroAgentConfirmed, forgetKiroIdentity, kiroIdentityNeedsStore, kiroRecordedConversation, kiroCanonicalDirectory, KiroIdentityError, kiroEngineFloor, kiroCarryCandidate, } from "./kiro-identity.js";
 import { readKiroLedger, kiroHasNoLaunchRecord } from "./kiro-engine-ledger.js";
 import { execFileSync } from "node:child_process";
 import { writeFileSync, chmodSync, statSync } from "node:fs";
-import { UnsupportedCliError, resolveBinary, shellQuote, validateEffort, validateModel, warnIfModelMismatch } from "./types.js";
+import { UnsupportedCliError, ResumeBlockedError, resolveBinary, shellQuote, validateEffort, validateModel, warnIfModelMismatch } from "./types.js";
+import { KIRO_SESSION_ID_COMMAND, kiroTitleCommand } from "../kiro-session-proof.js";
 import { PIE_CLASS } from "../tui-glyphs.js";
 import { KIRO_EXPIRED_LOGIN_SCREEN } from "../login-flows.js";
 import { t } from "../locale.js";
+import { sharedKiroV2StoreLane } from "./kiro-v2-store.js";
+import { decideKiroModelError, readKiroKnownModels, readKiroModelRecords, readKiroV1SavedModel, readKiroV2SavedModel, writeKiroModelRecords, KIRO_FALLBACK_MODEL } from "./kiro-retired-model.js";
 import { recordKiroLaunch } from "./kiro-engine-ledger.js";
 import { forgetKiroV3Identity, resolveKiroV3Resume } from "./kiro-v3-identity.js";
 // Kiro CLI feature gates. These are deliberately separate: the flags shipped
@@ -40,7 +43,7 @@ export const KIRO_INSTANCE_AGENT_MIN = "2.21.0";
  * the binary's own --help instead of the version table, and the operator is
  * told the version is unverified.
  */
-export const KIRO_TESTED_MAX = "2.33.0";
+export const KIRO_TESTED_MAX = "2.34.0";
 /**
  * kiro-cli versions, per TUI front-end, whose mid-turn steering AgEnD drives (#1405). Only kiro's TUI steers — typed
  * input while a turn runs is injected into it ("steer", the default) or held for its end ("queue", Ctrl+S toggles); the
@@ -48,10 +51,13 @@ export const KIRO_TESTED_MAX = "2.33.0";
  * queued message mid-tool — has been captured (tests/fixtures/kiro-steer-1405, 2026-10-08: 2.27.1 `--tui
  * --agent-engine=v2` and `--v3`, 2.28.0 `--tui --agent-engine=v2`; identical rows on all three). Any other version,
  * 2.28.0's v3, the legacy UI and an undetected version all deliver a steer as an ordinary message after the turn.
+ * 2.34.0 TUI was checked on the user-authorized #2598 D5 run (tests/fixtures/kiro-2.34.0-tui-d5):
+ * native steer during a read-only tool, a fleet message queued mid-tool, and a native queue entry in the busy turn.
  */
 export const KIRO_STEER_VERIFIED = {
     "2.27.1": ["tui", "v3"],
     "2.28.0": ["tui"],
+    "2.34.0": ["tui"],
 };
 /**
  * The TUI composer's interrupt mode, read off its own row: the LAST row starting at column 0 with `›` (transcript user
@@ -69,8 +75,10 @@ export const KIRO_STEER_VERIFIED = {
  * evidence of either an empty or a full box. The toggle key's label is whatever the user bound; it is read past, never
  * pressed.
  */
-function readKiroComposer(pane) {
-    const rows = pane.split("\n").map(row => row.replace(/\s+$/, ""));
+/** #2682: the takeover hold's key (RuntimeDialog.pattern); kiroTakeoverActive decides, this never matches a pane. */
+const KIRO_TAKEOVER_KEY = /(?!)kiro-takeover/;
+/** The composer's `›` row in `rows` and how many typed-text rows continue below it; null when there is none. */
+function findKiroComposerRow(rows) {
     let i = rows.length - 1;
     while (i >= 0 && (rows[i] === "" || /^[ \t]{20,}\S/.test(rows[i])))
         i--;
@@ -82,30 +90,47 @@ function readKiroComposer(pane) {
         continued++;
     }
     const row = rows[i];
-    if (row === undefined || !/^›[ \t]+\S/.test(row))
+    return row !== undefined && /^›[ \t]+\S/.test(row) ? { index: i, continued } : null;
+}
+function readKiroComposer(pane) {
+    const rows = pane.split("\n").map(row => row.replace(/\s+$/, ""));
+    const at = findKiroComposerRow(rows);
+    if (!at)
         return null;
+    let row = rows[at.index];
     // A placeholder is one row: with continuation rows below it, this is typed text — unless its first row is another
-    // mode's placeholder, which is then not ours to read.
-    if (continued > 0) {
-        if (/^›[ \t]+(?:Kiro is working\b|ask a question or describe a task\b|Goal (?:Active|Paused):|Editing queued message \d|Initializing\b|describe what "|running shell command\b)/.test(row))
-            return null;
-        return { mode: "text", text: row.replace(/^›[ \t]+/, "") };
+    // mode's placeholder. #2682: a narrow pane word-wraps a placeholder onto indented rows; joined, a COMPLETE known form
+    // reads as itself (an idle placeholder is then idle, not unreadable); anything else stays unreadable.
+    if (at.continued > 0) {
+        if (!/^›[ \t]+(?:Kiro is working\b|ask a question or describe a task\b|Goal (?:Active|Paused):|Editing queued message \d|Initializing\b|describe what "|running shell command\b)/.test(row)) {
+            return { mode: "text", text: row.replace(/^›[ \t]+/, "") };
+        }
+        row = [row, ...rows.slice(at.index + 1, at.index + 1 + at.continued).map(r => r.trim())].join(" ");
+        const mode = kiroPlaceholderMode(row);
+        return mode ? { mode, text: row.replace(/^›[ \t]+/, "") } : null;
     }
-    const working = String.raw `^›[ \t]+Kiro is working(?:[ \t]+·[ \t]+[^·]+?)?[ \t]+·[ \t]+`;
     const text = row.replace(/^›[ \t]+/, "");
+    const mode = kiroPlaceholderMode(row);
+    if (mode)
+        return { mode, text };
+    // Other placeholders (and anything the ASCII glyph set paints) are not typed text.
+    if (/^›[ \t]+(?:Kiro is working\b|Goal (?:Active|Paused):|Editing queued message \d|Initializing\b|describe what "|running shell command\b|ask a question or describe a task (?:\.|enter\b))/.test(row))
+        return null;
+    return { mode: "text", text };
+}
+/** The empty composer's mode from its whole placeholder (`›  …`, one row or wrapped rows joined); null when it is none. */
+function kiroPlaceholderMode(row) {
+    const working = String.raw `^›[ \t]+Kiro is working(?:[ \t]+·[ \t]+[^·]+?)?[ \t]+·[ \t]+`;
     if (new RegExp(`${working}Type to steer[ \\t]+·[ \\t]+[^·]+?[ \\t]+to queue$`).test(row))
-        return { mode: "steer", text };
+        return "steer";
     if (new RegExp(`${working}Type to queue(?:[ \\t]+·[ \\t]+[^·]+?[ \\t]+to steer)?$`).test(row))
-        return { mode: "queue", text };
+        return "queue";
     const idle = String.raw `^›[ \t]+ask a question or describe a task`;
     if (new RegExp(`${idle}[ \\t]+↵$`).test(row)
         || new RegExp(`${idle}[ \\t]+↵[ \\t]+·[ \\t]+exit plan mode: shift\\+tab$`).test(row)
         || new RegExp(`${idle}[ \\t]+·[ \\t]+/tangent to go back[ \\t]+·[ \\t]+/tangent ls to view$`).test(row))
-        return { mode: "idle", text };
-    // Other placeholders (and anything the ASCII glyph set paints) are not typed text.
-    if (/^›[ \t]+(?:Kiro is working\b|Goal (?:Active|Paused):|Editing queued message \d|Initializing\b|describe what "|running shell command\b|ask a question or describe a task (?:\.|enter\b))/.test(row))
-        return null;
-    return { mode: "text", text };
+        return "idle";
+    return null;
 }
 export function readKiroSteerComposer(pane) {
     return readKiroComposer(pane)?.mode ?? null;
@@ -115,6 +140,178 @@ export function readKiroComposerText(pane) {
     const c = readKiroComposer(pane);
     return c?.mode === "text" ? c.text : null;
 }
+/**
+ * #2683: the composer as a one-line housekeeping command (`/session-id`, `/title …`) sees it: `""` when it is
+ * positively empty (the idle placeholder, nothing else), the typed text of a single-row draft, or null for anything
+ * else (busy, another mode, wrapped text, no composer). A typed slash command opens kiro's command menu below the box
+ * (live 2.34.0, tui and V3; tests/fixtures/kiro-session-id-2681):
+ *
+ *   `› /session-id`
+ *   `/session-id    Print the current session ID`
+ *   `──────…`
+ *   ` esc to cancel · ↵ to select`
+ *
+ * and its `›` row is read past that menu. Enter there runs the highlighted entry, the command itself.
+ */
+export function readKiroCommandComposer(pane) {
+    const rows = pane.split("\n").map(row => row.replace(/\s+$/, ""));
+    let i = rows.length - 1;
+    while (i >= 0 && (rows[i] === "" || /^[ \t]{20,}\S/.test(rows[i])))
+        i--;
+    if (i >= 2 && /^ esc to cancel · .*↵ to select$/.test(rows[i]) && /^─{20,}$/.test(rows[i - 1])) {
+        let r = i - 2, entries = 0;
+        while (r >= 0 && entries < 12 && /^\/[\w-]+ {2,}\S/.test(rows[r])) {
+            r--;
+            entries++;
+        }
+        const row = rows[r];
+        return entries > 0 && row !== undefined && /^›[ \t]+\/\S/.test(row) ? row.replace(/^›[ \t]+/, "") : null;
+    }
+    const at = findKiroComposerRow(rows);
+    if (!at || at.continued > 0)
+        return null;
+    const c = readKiroComposer(pane);
+    return c?.mode === "idle" ? "" : c?.mode === "text" ? c.text : null;
+}
+/**
+ * #2683: kiro's own answer to `/session-id`, where only that answer is painted: the alert at the bottom of the chat,
+ * on the rows right above the footer (the divider within 8 rows above the composer, and the trust banner's divider
+ * above that one when it is shown). Live 2.34.0, tui and V3 (tests/fixtures/kiro-session-id-2681):
+ *
+ *   `• Session ID: <id>`
+ *   `  Resume with: kiro-cli --resume-id <id>`      (the same id)
+ *
+ * or `• Session ID: none` alone. It is a transient alert (10 s), not a turn. The same lines anywhere else (a quoted
+ * user row is `  › …`, an answer scrolls up) are not read; an agent answer that ends with them would sit in the same
+ * place, which is why the daemon also requires that the alert was not there before it typed the command. Null when no
+ * such alert is shown.
+ */
+export function readKiroSessionIdAlert(pane) {
+    const rows = pane.split("\n").map(row => row.replace(/\s+$/, ""));
+    const at = findKiroComposerRow(rows);
+    if (!at)
+        return null;
+    let d = at.index - 1;
+    while (d >= 0 && at.index - d <= 8 && !/^─{20,}$/.test(rows[d]))
+        d--;
+    if (d < 0 || !/^─{20,}$/.test(rows[d]))
+        return null;
+    if (d >= 2 && /^ \S/.test(rows[d - 1]) && /^─{20,}$/.test(rows[d - 2]))
+        d -= 2; // ` Trust All Tools active …`
+    if (rows[d - 1] === "• Session ID: none")
+        return "none";
+    const id = /^ {2}Resume with: kiro-cli --resume-id ([A-Za-z0-9][A-Za-z0-9_.-]{0,199})$/.exec(rows[d - 1] ?? "")?.[1];
+    return id !== undefined && id !== "none" && rows[d - 2] === `• Session ID: ${id}` ? id : null;
+}
+/**
+ * #2676: a collapsed paste on the composer's row. The TUI shows a paste of more than 10 lines or 500 characters as one
+ * chip (2.34.0 tui.js: `n>1 ? "${n} lines" : "${r} chars"`, then `▸`, then the `Press Tab to expand` hint):
+ *
+ *   `›  42 lines ▸   Press Tab to expand`   → 42
+ *   `›  657 chars ▸   Press Tab to expand`  → 1 (one line, shown only by its length)
+ *
+ * `text` is the row's text (readKiroComposerText). Null when it is not such a chip.
+ */
+export function readKiroCollapsedPasteLines(text) {
+    const m = /^(\d+) (lines|chars) ▸(?:[ \t]+Press Tab to expand)?$/.exec(text.trim());
+    if (!m)
+        return null;
+    return m[2] === "lines" ? Number(m[1]) : 1;
+}
+/**
+ * #2682: another program owns kiro's pane, so a paste and an Enter would go into it instead of the chat (captured on
+ * 2.34.0, tests/fixtures/kiro-2.34.0-takeover-2682). Read from kiro's own rows first:
+ * - a focused `/kvim` panel: `── Neovim · focused · Ctrl+\ to chat · :q to close ──`, or `· the agent is waiting on you:`
+ *   (unfocused, `Neovim · Ctrl+\ to edit`, the composer has the keys again);
+ * - a running `!` command (tui, V3): its PTY takes every keystroke, while the composer still reads busy
+ *   (`Kiro is working · Type to steer`) — the nearest turn above kiro's footer is `  › !…`, with only its indented
+ *   output and `• Running...` below (kiroBusyTurn; a turn it cannot see is not called a takeover here, but no busy
+ *   input is typed into it either: KiroBackend.busyTurnTakesInput);
+ * - an editor or pager kiro started (`/editor`, `/transcript`, a full-screen `!vim`/`!less`): no composer row, kiro's
+ *   temp file `kiro-editor-XXXXXX/prompt.md` or `kiro-raw-XXXXXX/conversation.md` on screen;
+ * - legacy: a `!` command running from its prompt row (the bottom row is the prompt with `!…` after the marker: the
+ *   command took the terminal before kiro painted anything else), and its `/editor` and `/reply` temp file
+ *   `q_prompt_<uuid>.md` with no prompt row at the bottom;
+ * and, only where kiro's input row is not on screen (every engine; legacy's `/editor` and `/reply` run `$EDITOR`), the
+ * program's own bottom rows: vi/vim/nvim (`~` rows, its ruler, `-- INSERT --`), less (`:`, `(END)`), more
+ * (`--More--`), nano (`GNU nano` and `^X Exit`). `/fullscreen` is not a takeover: the same composer takes input.
+ */
+export function kiroTakeoverActive(pane, ui) {
+    const rows = pane.split("\n").map(row => row.replace(/\s+$/, ""));
+    if (ui === "legacy") {
+        const prompt = kiroLegacyPromptAtBottom(rows);
+        if (prompt !== null)
+            return prompt.startsWith("!");
+        if (rows.some(row => /\/q_prompt_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.md\b/.test(row)))
+            return true;
+        return fullScreenProgramAtBottom(rows);
+    }
+    if (rows.some(row => /^─+ Neovim · (?:focused · |the agent is waiting on you: )/.test(row)))
+        return true;
+    const at = findKiroComposerRow(rows);
+    if (at) {
+        const mode = readKiroComposer(pane)?.mode;
+        return (mode === "steer" || mode === "queue") && kiroBusyTurn(rows, at.index) === "shell";
+    }
+    if (rows.some(row => /\/kiro-(?:editor|raw)-[A-Za-z0-9]{6}\/(?:prompt|conversation)\.md\b/.test(row)))
+        return true;
+    return fullScreenProgramAtBottom(rows);
+}
+/**
+ * #2682: the legacy UI's prompt row as the last non-blank row — `4% !>` (trust-all) or `4% >`, with an optional
+ * `[agent]` prefix and mode glyph, as getBottomReadyPattern — and the text after its marker (a placeholder hint, a
+ * draft, or a `!` command it is running); null when the bottom row is not the prompt.
+ */
+export function kiroLegacyPromptAtBottom(rows) {
+    const last = [...rows].reverse().find(row => row.trim() !== "");
+    const m = last === undefined ? null : /^\s*(?:\[[^\]]*\]\s*)?\d+%\s*(?:[^\s\d%!❯>]{1,2}\s+)?(?:!\s?[❯>]|❯|>)(.*)$/.exec(last);
+    return m ? m[1].trim() : null;
+}
+/**
+ * #2682: what the busy turn nearest above kiro's footer is: "shell" — a `!` command still running (its `  › !` row with
+ * only its output and `• Running...` below), "agent" — positive evidence of the agent's turn first (another user row,
+ * one of kiro's bullets, its spinner), "unknown" — no footer, or nothing that says either up to the top of the pane.
+ * Everything else is passed over, never taken as evidence: the footer and its notes however they wrap, dividers, the
+ * tray and tips, indented output.
+ */
+function kiroBusyTurn(rows, composer) {
+    let d = composer - 1;
+    while (d >= 0 && composer - d <= 8 && !/^─{20,}$/.test(rows[d]))
+        d--;
+    if (d < 0 || !/^─{20,}$/.test(rows[d]))
+        return "unknown"; // no footer divider within reach
+    for (let r = d - 1; r >= 0; r--) {
+        const row = rows[r];
+        if (/^ {2}› !/.test(row))
+            return "shell";
+        if (/^ {2}› /.test(row) || /^• (?!Running\.\.\.$)\S/.test(row) || /^\S[ \t]+(?:Thinking|Working)(?:\.{3}|…)/.test(row))
+            return "agent";
+    }
+    return "unknown";
+}
+/**
+ * #2682: whether a busy composer's typed input goes to kiro's own turn: only when that turn is seen to be the agent's.
+ * A `!` command's PTY would take it, and a turn it cannot see might be one.
+ */
+export function kiroBusyTurnTakesInput(pane) {
+    const rows = pane.split("\n").map(row => row.replace(/\s+$/, ""));
+    const at = findKiroComposerRow(rows);
+    return at !== null && kiroBusyTurn(rows, at.index) === "agent";
+}
+/** #2682: a full-screen editor or pager's own bottom rows (vi/vim/nvim, less, more, nano), whoever started it. */
+function fullScreenProgramAtBottom(rows) {
+    const shown = rows.filter(row => row.trim() !== "");
+    const last = shown[shown.length - 1]?.trim() ?? "";
+    if (last === ":" || /\(END\)$/.test(last) || /^--More--/.test(last))
+        return true; // less, more
+    if (/^-- (?:INSERT|REPLACE|VISUAL(?: LINE| BLOCK)?) --/.test(last))
+        return true; // vi modes
+    if (/\s\d+,\d+(?:-\d+)?\s+(?:All|Top|Bot|\d+%)$/.test(last))
+        return true; // vi ruler
+    if (shown.slice(-7, -1).filter(row => row === "~").length >= 3)
+        return true; // vi's empty lines
+    return shown.slice(-2).some(row => /\^X Exit/.test(row)) && rows.some(row => /^\s*GNU nano\b/.test(row)); // nano
+}
 const UNKNOWN_KIRO_COMPATIBILITY = {
     supportsLegacyUi: false,
     supportsTui: false,
@@ -133,11 +330,12 @@ const warnedVersionGateCacheKeys = new Set();
  * This broad test is only a safety hold: it must never select an option or
  * claim a service outage. A ready prompt below the picker makes it history.
  */
+const KIRO_MODEL_PICKER_HEADER = /^\s*Select model(?: \(type to search\):|:\s+type to search)\s*$/m;
 function kiroModelPickerAtTail(pane) {
     const lines = pane.replace(/\r/g, "").split("\n");
     let pickerIndex = -1;
     for (let index = lines.length - 1; index >= 0; index--) {
-        if (/^\s*Select model \(type to search\):\s*$/.test(lines[index])) {
+        if (KIRO_MODEL_PICKER_HEADER.test(lines[index])) {
             pickerIndex = index;
             break;
         }
@@ -145,7 +343,8 @@ function kiroModelPickerAtTail(pane) {
     if (pickerIndex < 0)
         return false;
     const tail = lines.slice(pickerIndex + 1);
-    if (tail.some(line => /^\s*\d+%[^\n]*[!❯>]\s+\S/.test(line)))
+    const composer = readKiroSteerComposer(tail.join("\n"));
+    if (tail.some(line => /^\s*\d+%[^\n]*[!❯>]\s+\S/.test(line)) || (composer !== null && composer !== "text"))
         return false;
     return tail.some(line => /^\s*[>❯›]\s*\*?\s*\S/.test(line));
 }
@@ -330,6 +529,205 @@ function kiroWorkspaceTrustDialogs(trustAll) {
         },
     ];
 }
+const KIRO_MCP_INPUT_HEADER = /^\s*Input requested · \S.*$/;
+const KIRO_MCP_INPUT_FOOTER = /^\s*esc to cancel · ↑↓ to navigate · enter to select(?: · ctrl\+s to submit)?$/;
+/**
+ * #2587: kiro-cli 2.34.0's V3 engine answers an MCP server's `elicitation/create` (a tool asking the user for input)
+ * with a card in place of the composer: a divider, `Input requested · <server>`, a divider, the server's message and
+ * one row per form field then Submit / Decline (form mode) — or Host, URL and Open in browser / Copy URL / I'll open it
+ * myself / Decline / Cancel (url mode) — with exactly one `❯` cursor row, a divider, and the key hints as the last row
+ * (tests/fixtures/kiro-2.34.0-audit). Bottom-anchored: the card is live only while it is what the pane ends with. The
+ * answer can carry credentials or a sign-in, so it is the person's: never a key, and no delivery's Enter may land in it.
+ */
+export function kiroMcpInputRequestActive(pane) {
+    const rows = pane.replace(/\r/g, "").split("\n").map(row => row.trimEnd());
+    let last = rows.length - 1;
+    while (last >= 0 && !rows[last].trim())
+        last--;
+    if (last < 0 || !KIRO_MCP_INPUT_FOOTER.test(rows[last]))
+        return false;
+    const divider = (row) => row !== undefined && /^─{3,}$/.test(row.trim());
+    if (!divider(rows[last - 1]))
+        return false;
+    let header = -1;
+    for (let index = last - 2; index >= 1; index--) {
+        if (KIRO_MCP_INPUT_HEADER.test(rows[index])) {
+            header = index;
+            break;
+        }
+    }
+    if (header < 0 || !divider(rows[header - 1]) || !divider(rows[header + 1]))
+        return false;
+    const body = rows.slice(header + 2, last - 1);
+    // A V3 composer (`›` at column 0) inside means the card is history. A lone `>` is a form field's own input caret.
+    if (body.some(row => divider(row) || /^›(?:[ \t]|$)/.test(row)))
+        return false;
+    return body.filter(row => /^\s*❯\s+\S/.test(row)).length === 1;
+}
+const KIRO_QUESTION_HEADER = /^\s*(?:\S.* > )?Question$/;
+const KIRO_QUESTION_FOOTER = /^\s*esc to (?:cancel|go back) · ↑↓ to navigate(?: · space to toggle)? · ↵ to submit$/;
+/**
+ * #2592: kiro's V3 engine shows the agent's question to the user (`question_request`) as a card in place of the
+ * composer: a divider, `Question` (or `<name> > Question`), the question, numbered options (a description row under
+ * one, `(recommended)` after one) and `Type a different answer…`, a divider, and the key hints as the last row — or, in
+ * an option's sub-options, `[✓] <title>` rows and `esc to go back · … · space to toggle · ↵ to submit`
+ * (tests/fixtures/kiro-question-2592; unchanged from 2.33.1 to 2.34.0). Any typed character turns the card into a free
+ * answer and Enter submits it, so a delivered message would become the answer to a question nobody read. The person
+ * answers it in the pane (the user's decision on #2592); it is never keyed. Bottom-anchored like
+ * kiroMcpInputRequestActive: the header is the row right under the nearest divider above the key hints' divider.
+ */
+export function kiroQuestionCardActive(pane) {
+    const rows = pane.replace(/\r/g, "").split("\n").map(row => row.trimEnd());
+    let last = rows.length - 1;
+    while (last >= 0 && !rows[last].trim())
+        last--;
+    if (last < 0 || !KIRO_QUESTION_FOOTER.test(rows[last]))
+        return false;
+    const divider = (row) => row !== undefined && /^─{3,}$/.test(row.trim());
+    if (!divider(rows[last - 1]))
+        return false;
+    let top = last - 2;
+    while (top >= 0 && !divider(rows[top]))
+        top--;
+    if (top < 0 || !KIRO_QUESTION_HEADER.test(rows[top + 1] ?? ""))
+        return false;
+    const body = rows.slice(top + 2, last - 1);
+    // The question, then the options: a V3 composer (`›` at column 0) among them means the card is history.
+    if (body.length < 2 || body.some(row => /^›(?:[ \t]|$)/.test(row)))
+        return false;
+    return body.filter(row => /^\s*❯\s+\S/.test(row)).length === 1;
+}
+/** #2675: the live card's rows — the header row, the body between it and the key hints' divider, and the key hints. */
+function kiroCardRows(pane, headerAt) {
+    const rows = pane.replace(/\r/g, "").split("\n").map(row => row.trimEnd());
+    let last = rows.length - 1;
+    while (last >= 0 && !rows[last].trim())
+        last--;
+    const header = headerAt(rows, last);
+    return header < 0 ? null : { header: rows[header].trim(), body: rows.slice(header + 1, last - 1), footer: rows[last].trim(), width: rows[last - 1].trim().length };
+}
+const KIRO_QUESTION_OPTION_ROW = /^ (❯| ) (\d+)\. (.*?)( \(recommended\))?$/;
+const KIRO_QUESTION_SUBOPTION_ROW = /^ (❯| ) \[(✓| )\] (.*)$/;
+const KIRO_QUESTION_FREE_ROW = /^ (❯| ) (Type a different answer…|or type feedback to request changes)$/;
+/**
+ * #2675: the live Question card (see kiroQuestionCardActive), read for a person to answer from the chat: the question,
+ * the numbered options (`(recommended)` and the description row under one), the typed-answer row, and where the `❯`
+ * is (tui.js `A0`; tests/fixtures/kiro-question-2592). On a sub-options page the rows are the `[✓]` boxes; while an
+ * answer is being typed the last row is `❯ <text>`. A row the shapes above do not account for is a wrapped title (the
+ * card's own indent) or description (deeper), joined to the row it continues; one before any option belongs to the
+ * question. Null when the card is not live, or when it is in a shape this reader does not know.
+ */
+export function readKiroQuestionCard(pane) {
+    if (!kiroQuestionCardActive(pane))
+        return null;
+    const card = kiroCardRows(pane, (rows, last) => {
+        let top = last - 2;
+        while (top >= 0 && !/^─{3,}$/.test(rows[top].trim()))
+            top--;
+        return top + 1;
+    });
+    if (!card)
+        return null;
+    const page = /space to toggle/.test(card.footer) ? "suboptions" : "options";
+    const question = [];
+    const options = [];
+    let cursor = null, freeText = false, typed = null, freeRow = false;
+    for (const row of card.body) {
+        const option = page === "options" ? KIRO_QUESTION_OPTION_ROW.exec(row) : null;
+        const sub = page === "suboptions" ? KIRO_QUESTION_SUBOPTION_ROW.exec(row) : null;
+        const free = page === "options" ? KIRO_QUESTION_FREE_ROW.exec(row) : null;
+        if (freeRow)
+            return null; // nothing follows the typed-answer row
+        if (option && Number(option[2]) === options.length + 1) {
+            if (option[1] === "❯")
+                cursor = options.length;
+            options.push({ n: options.length + 1, title: option[3], recommended: option[4] !== undefined, description: null });
+        }
+        else if (sub) {
+            if (sub[1] === "❯")
+                cursor = options.length;
+            options.push({ n: options.length + 1, title: sub[3], recommended: false, description: null, checked: sub[2] === "✓" });
+        }
+        else if (free) {
+            freeText = true;
+            freeRow = true;
+            if (free[1] === "❯")
+                cursor = options.length;
+        }
+        else if (page === "options" && options.length > 0 && /^ ❯ /.test(row)) {
+            freeText = true;
+            freeRow = true;
+            typed = row.slice(3);
+        }
+        else if (!row.trim()) {
+            continue;
+        }
+        else if (options.length === 0) {
+            question.push(row.replace(/^ /, ""));
+        }
+        else {
+            const lastOption = options[options.length - 1];
+            if (/^ {5,}\S/.test(row))
+                lastOption.description = lastOption.description === null ? row.trim() : `${lastOption.description} ${row.trim()}`;
+            else if (lastOption.description === null)
+                lastOption.title = `${lastOption.title} ${row.trim()}`;
+            else
+                return null;
+        }
+    }
+    if (options.length === 0 || question.length === 0)
+        return null;
+    const typing = typed !== null;
+    if (typing ? cursor !== null : cursor === null)
+        return null;
+    const titles = options.map(option => `${option.n}. ${option.title}`).join("\n");
+    return {
+        kind: "question", identity: `${card.header}\n${question.join("\n")}\n${page === "suboptions" ? "sub" : "options"}\n${titles}`,
+        title: card.header, question: question.join("\n").trim(), page: typing ? "freetext" : page, options, freeText, cursor, typed, rowWidth: card.width,
+    };
+}
+const KIRO_MCP_INPUT_ACTIONS = new Set(["Submit", "Decline", "Open in browser", "Copy URL", "I'll open it myself", "Cancel"]);
+/**
+ * #2675: the live MCP `Input requested` card (see kiroMcpInputRequestActive), read for the chat: the server, the body
+ * as painted, with the `URL:` row masked (a sign-in link stays in the pane), its action rows, and the `❯` row. Its
+ * identity is the server, the mode, the message's first row and the actions: moving or filling in a field keeps it.
+ */
+export function readKiroMcpInputCard(pane) {
+    if (!kiroMcpInputRequestActive(pane))
+        return null;
+    const card = kiroCardRows(pane, (rows, last) => {
+        for (let index = last - 2; index >= 1; index--)
+            if (KIRO_MCP_INPUT_HEADER.test(rows[index]))
+                return index;
+        return -1;
+    });
+    if (!card)
+        return null;
+    // The URL row is masked, and so is every row after it up to the next action row: a long URL wraps (#2677 review).
+    let inUrl = false;
+    const body = card.body.slice(1).flatMap(row => {
+        if (/^\s*URL: /.test(row)) {
+            inUrl = true;
+            return [row.replace(/URL: .*$/, "URL: (shown in the instance pane)")];
+        }
+        if (inUrl && KIRO_MCP_INPUT_ACTIONS.has(row.replace(/^ ❯ /, "   ").trim()))
+            inUrl = false;
+        return inUrl ? [] : [row];
+    });
+    const strip = (row) => row.replace(/^ ❯ /, "   ").trim();
+    const cursorRow = body.find(row => /^\s*❯\s+\S/.test(row));
+    if (!cursorRow)
+        return null;
+    return {
+        kind: "input", server: card.header.replace(/^Input requested · /, ""),
+        mode: /ctrl\+s to submit/.test(card.footer) ? "form" : "url",
+        rows: body.map(row => row.replace(/^ ❯ /, "   ").replace(/^ {3}/, "")).filter(row => row.trim()),
+        actions: body.map(strip).filter(row => KIRO_MCP_INPUT_ACTIONS.has(row)),
+        cursorRow: strip(cursorRow),
+        // The focused field paints extra rows (its value, its caret) and a typed value changes its row: neither is another request.
+        identity: `${card.header}\n${/ctrl\+s to submit/.test(card.footer) ? "form" : "url"}\n${strip(body[0] ?? "")}\n${body.map(strip).filter(row => KIRO_MCP_INPUT_ACTIONS.has(row)).join("|")}`,
+    };
+}
 /**
  * Kiro's service-unavailable path opens the same picker as `/model`, but only
  * the former needs incident escalation. The runtime scanner and delivery gate
@@ -342,7 +740,7 @@ export function kiroUnavailableModelPickerActive(pane) {
     const lines = pane.replace(/\r/g, "").split("\n");
     let pickerIndex = -1;
     for (let i = lines.length - 1; i >= 0; i--) {
-        if (/^\s*Select model \(type to search\):\s*$/.test(lines[i])) {
+        if (KIRO_MODEL_PICKER_HEADER.test(lines[i])) {
             pickerIndex = i;
             break;
         }
@@ -634,6 +1032,17 @@ function compatibilityFromHelp(version, help) {
         source: "help",
     };
 }
+/**
+ * #2598 (D1): kiro-cli-chat skips its self-update when this is set (2.30.0 and 2.34.0 both read it). AgEnD pins the
+ * kiro version it has audited; an in-place update can swap the engine a running fleet depends on (3.0 drops legacy).
+ * Every chat AgEnD starts carries it: the instance launch (a shell prefix) and the probes (their child env). The
+ * host-wide `app.disableAutoupdates` setting is the operator's half; this holds even where that was never set.
+ */
+export const KIRO_NO_AUTO_UPDATE = "KIRO_NO_AUTO_UPDATE";
+/** A kiro child's environment: the given one (default: ours) with self-update off. */
+export function kiroChildEnv(base = process.env) {
+    return { ...base, [KIRO_NO_AUTO_UPDATE]: "1" };
+}
 /**
  * Probe once per binary generation. A version AgEnD has run (<= TESTED_MAX)
  * is answered from the table without a second CLI call; anything newer, or a
@@ -645,6 +1054,7 @@ export function probeKiroCliCompatibility(binaryPath, run = (binary, args) => me
     encoding: "utf-8",
     timeout: 5000,
     stdio: ["ignore", "pipe", "ignore"],
+    env: kiroChildEnv(),
 }))) {
     return measureSyncWork("kiro.compatibilitySync", () => probeKiroCliCompatibilitySync(binaryPath, run));
 }
@@ -673,6 +1083,8 @@ function nextPatch(version) {
     const [major, minor, patch] = parseSemver(version);
     return `${major}.${minor}.${patch + 1}`;
 }
+/** #2598 B3: engines in the order a conversation can move between them (never back). */
+const KIRO_ENGINE_RANK = { legacy: 1, tui: 2, v3: 3 };
 /** Binary generations already told they cannot isolate (once each). */
 const warnedNoInstanceAgentKeys = new Set();
 /** Instances already told about an untagged steering file (once each). */
@@ -755,6 +1167,34 @@ export function readActiveKiroAgent(pane, ui) {
     }
     return null;
 }
+/** Model on Kiro 2.34's live footer (status, cwd, optional branch, blank, idle composer).
+ * Separate from readActiveKiroAgent: do not widen the disabled agent-switch action's reader.
+ */
+export function readActiveKiroModel(pane, expectedAgent) {
+    if (readKiroSteerComposer(pane) !== "idle")
+        return null;
+    const rows = pane.split("\n").map(row => row.replace(/\s+$/, "")), at = findKiroComposerRow(rows);
+    if (!at)
+        return null;
+    let cwd = false, branch = false;
+    // Footer only. Never search backwards through arbitrary output or a model picker for a matching model.
+    for (let i = at.index - 1; i >= Math.max(0, at.index - 8); i--) {
+        const row = rows[i];
+        if (!row.trim() || RULE_ROW.test(row))
+            continue;
+        if (!branch && /^\s*\([^()\r\n]{1,128}\)\s*$/.test(row)) {
+            branch = true;
+            continue;
+        }
+        if (!cwd && /^\s*(?:\/[^\x00-\x1f]*|~(?:\/[^\x00-\x1f]*)?)\s*$/.test(row)) {
+            cwd = true;
+            continue;
+        }
+        const status = /^\s*(\S+) · ([A-Za-z0-9_.:/-]{1,128}) · .+$/.exec(row);
+        return cwd && status && (expectedAgent === undefined || status[1] === expectedAgent) ? status[2] : null;
+    }
+    return null;
+}
 export function planKiroLaunch(ui, compat) {
     const version = compat.version ?? "of unknown version";
     if (ui === "v3")
@@ -885,6 +1325,9 @@ export const KIRO_RATE_LIMIT_SCREEN = new RegExp(KIRO_MESSAGE_LEAD + wrapToleran
 /** #1636: kiro's monthly cap (MonthlyLimitReached branch); see getErrorPatterns. */
 export const KIRO_REQUEST_LIMIT_SCREEN = new RegExp(KIRO_MESSAGE_LEAD + "(?:" + ["Hourly", "Daily", "Weekly", "Monthly"].map(wrapTolerant).join("|") + ")"
     + wrapTolerant(" request limit reached") + "(?:[ \\t]*$|" + wrapTolerant(" - The limits reset on") + "\\b)", "m");
+/** #2598: Kiro 2.34 lists a carried UUID in both V2 and classic; this proves presence, not a missing session. */
+export const KIRO_AMBIGUOUS_RESUME_SCREEN = new RegExp(wrapTolerant('Error: Session id "') + '[A-Za-z0-9_.\\n-]{1,256}' + wrapTolerant('" is ambiguous (')
+    + "\\d+" + wrapTolerant(" matches)."), "m");
 /** Startup budget for a `--resume` launch (60% first output, 40% ready). */
 export const KIRO_RESUME_STARTUP_BUDGET_MS = 60_000;
 export class KiroBackend {
@@ -913,6 +1356,8 @@ export class KiroBackend {
     activeTrustAll = true;
     /** Version-gate notice for the launch just built (consumeLaunchWarning). */
     launchWarning = null;
+    /** #2648: what this launch's model came from, for a model error to be judged by (decideKiroModelError). */
+    launchModels = null;
     /**
      * What this launch attempt resumes and as which agent (#906), resolved once per attempt in writeConfig — it claims
      * conversations and records fresh starts — and read by the buildCommand that follows it.
@@ -923,7 +1368,10 @@ export class KiroBackend {
     /** #1218: the last launch built in full (cleared when a build starts, set only when it returns). */
     builtLaunch = null;
     preparedV2Store = null;
+    /** #2648: the saved model of the v2 conversation this instance has recorded, read in prepareLaunch (off the loop). */
+    preparedV2Model = null;
     storePreparation = 0;
+    preparedCarry = null;
     storeKey(config) {
         return JSON.stringify([config.instanceName, config.workingDirectory, kiroCanonicalDirectory(config.workingDirectory), config.kiroUi,
             resolveCredentialProfile(config.backendOptions), !!config.skipResume, getAgendHome(), kiroV2SessionsDir(), kiroCanonicalDirectory(kiroV2SessionsDir())]);
@@ -939,6 +1387,8 @@ export class KiroBackend {
     async prepareLaunch(config) {
         const preparation = ++this.storePreparation;
         this.preparedV2Store = null;
+        this.preparedV2Model = null;
+        this.preparedCarry = null;
         if (!config || config.kiroUi !== "tui")
             return;
         if (!this.fixedCompatibility)
@@ -949,11 +1399,63 @@ export class KiroBackend {
             return;
         const opts = { instance: config.instanceName, engine: "v2", workingDirectory: config.workingDirectory,
             credentialProfile: resolveCredentialProfile(config.backendOptions), skipResume: config.skipResume, agendHome: getAgendHome() };
+        if (!config.skipResume && this.needsCarryPreparation()) {
+            try {
+                this.preparedCarry = { key, error: null };
+                if (kiroCarryCandidate(opts)) {
+                    const reply = await sharedKiroV2StoreLane.read({ keys: [], sessionsDir: kiroV2SessionsDir(), carry: {
+                            ...opts, sessionsDir: kiroV2SessionsDir(), dbPath: kiroV1DbPath(opts.credentialProfile),
+                        } });
+                    if (preparation !== this.storePreparation || key !== this.storeKey(config))
+                        return;
+                    this.preparedCarry = { key, error: reply.kind === "unreadable" ? reply.detail : null };
+                    if (reply.kind === "unreadable")
+                        return;
+                    if (reply.carry?.archivePath)
+                        this.addLaunchWarning(t("kiro.archive_done", reply.carry.archivePath));
+                    if (reply.carry?.repaired)
+                        this.addLaunchWarning(t("kiro.carry_pin_repaired"));
+                }
+            }
+            catch (err) {
+                this.preparedCarry = { key, error: err.message };
+                return;
+            }
+        }
         if (kiroIdentityNeedsStore(opts)) {
             const store = await listKiroV2Sessions(config.workingDirectory, kiroV2SessionsDir());
             if (preparation === this.storePreparation && key === this.storeKey(config))
                 this.preparedV2Store = { key, store };
         }
+        // #2648: only for an instance with no model of its own, and only the conversation it has recorded (the resolver
+        // in writeConfig may pick another — then nothing is foreseen, and a model error is handled after the launch).
+        const recorded = !config.model && !config.skipResume ? kiroRecordedConversation(opts) : null;
+        if (recorded) {
+            const model = await readKiroV2SavedModel(kiroV2SessionsDir(), recorded);
+            if (preparation === this.storePreparation && key === this.storeKey(config))
+                this.preparedV2Model = { key, id: recorded, model };
+        }
+    }
+    needsCarryPreparation() {
+        const v = /(?:^|\s)(\d+)\.(\d+)\.(\d+)/.exec(this.compatibility.version ?? "");
+        return !!v && (Number(v[1]) > 2 || (Number(v[1]) === 2 && Number(v[2]) >= 34));
+    }
+    assertCarryPrepared(config) {
+        if (config.kiroUi !== "tui" || config.skipResume || !this.needsCarryPreparation())
+            return;
+        const opts = { agendHome: getAgendHome(), instance: config.instanceName, workingDirectory: config.workingDirectory,
+            credentialProfile: resolveCredentialProfile(config.backendOptions) };
+        let required;
+        try {
+            required = !!kiroCarryCandidate(opts);
+        }
+        catch (err) {
+            throw new ResumeBlockedError(t("kiro.archive_failed", err.message), t("kiro.archive_remedy"));
+        }
+        if (this.preparedCarry?.key === this.storeKey(config) && this.preparedCarry.error)
+            throw new ResumeBlockedError(t("kiro.archive_failed", this.preparedCarry.error), t("kiro.archive_remedy"));
+        if (required && this.preparedCarry?.key !== this.storeKey(config))
+            throw new ResumeBlockedError(t("kiro.archive_failed", "carry preparation is missing"), t("kiro.archive_remedy"));
     }
     constructor(instanceDir, compatibility) {
         this.instanceDir = instanceDir;
@@ -1009,6 +1511,10 @@ export class KiroBackend {
     readSteerComposerText(pane) {
         return this.activeUi === "legacy" ? null : readKiroComposerText(pane);
     }
+    /** #2676: the line count a collapsed paste chip on the composer's row names (readKiroCollapsedPasteLines). */
+    readSteerComposerPasteLines(text) {
+        return this.activeUi === "legacy" ? null : readKiroCollapsedPasteLines(text);
+    }
     /**
      * Live evidence (kiro-cli 2.21.0, 2026-09-03): `--resume` prints nothing
      * until the conversation comes back from the backend ("Picking up where we
@@ -1020,6 +1526,18 @@ export class KiroBackend {
     getStartupBudgetMs(ctx) {
         return ctx.resume ? KIRO_RESUME_STARTUP_BUDGET_MS : undefined;
     }
+    resumeBlockedPattern() { return KIRO_AMBIGUOUS_RESUME_SCREEN; }
+    retainedResumeBlock() {
+        const plan = this.activePlan;
+        if (!plan || plan.engine !== "v2" || plan.mode !== "resume" || !plan.id || !this.activeInstance)
+            return null;
+        let carried = true;
+        try {
+            carried = kiroCarryCandidate({ agendHome: getAgendHome(), instance: this.activeInstance, workingDirectory: plan.cwd, credentialProfile: plan.credentialProfile })?.id === plan.id;
+        }
+        catch { /* lost ownership proof is also a hold, never authority to discard history */ }
+        return carried ? { reason: t("kiro.carry_resume_failed"), remedy: t("kiro.archive_remedy") } : null;
+    }
     retriesResumeOnStartupFailure() {
         // A resume miss is far more often "the backend was slow" than "the session
         // is broken"; one more attempt before abandoning the conversation is cheap.
@@ -1054,7 +1572,14 @@ export class KiroBackend {
         // V3 has a different engine and no verified completion signal yet (#1144).
         this.replyGuardOptedIn = false;
         this.builtLaunch = null;
+        this.assertCarryPrepared(config);
         const ui = config.kiroUi ?? "legacy";
+        // #2598 B3: never back onto an older engine than this instance has run on — that resumes the frozen copy and loses
+        // everything done since. Before any probe: no kiro-cli flag or version changes the answer.
+        const floor = kiroEngineFloor(getAgendHome(), config.instanceName);
+        if (floor && KIRO_ENGINE_RANK[ui] < KIRO_ENGINE_RANK[floor === "v2" ? "tui" : "v3"]) {
+            throw new UnsupportedCliError(t("kiro.engine_floor", config.instanceName, ui, floor === "v2" ? "tui" : "v3"));
+        }
         // Every launch re-reads the binary generation: a crash-respawn reuses this
         // backend, and kiro-cli may have replaced itself in place since the last
         // launch (an auto-update to a release without this instance's engine).
@@ -1075,7 +1600,8 @@ export class KiroBackend {
         const plan = planKiroLaunch(ui, this.compatibility);
         if (plan.kind === "refuse")
             throw new UnsupportedCliError(plan.reason);
-        let cmd = `${this.binaryPath} chat`;
+        // #2598: a shell assignment, so it reaches kiro-cli-chat through `kiro-cli chat` and any credential-home prefix.
+        let cmd = `${KIRO_NO_AUTO_UPDATE}=1 ${this.binaryPath} chat`;
         for (const flag of plan.flags)
             cmd += ` ${flag}`;
         this.noteVersionGate();
@@ -1119,17 +1645,32 @@ export class KiroBackend {
             if (id)
                 cmd += ` --resume-id ${shellQuote(id)}`;
         }
-        else if (!config.skipResume) {
-            // Legacy mode, classic/TUI: the boolean form — kiro resumes the directory's newest conversation. Not isolated
+        else if (!config.skipResume && ui === "legacy") {
+            // Legacy mode, classic: the boolean form — kiro resumes the directory's newest conversation. Not isolated
             // between instances sharing the directory (#1410); an instance launches like this only without the
             // per-instance plan (an old kiro-cli, or a conversation store AgEnD could not read on adoption).
             cmd += " --resume";
         }
+        else if (!config.skipResume && ui === "tui") {
+            // #2598 B3: never the boolean form under the TUI — it takes the directory's newest conversation from EITHER
+            // engine, and on a classic one makes a TUI fork of it (the wrong conversation, possibly another instance's). A
+            // TUI launch without its per-instance plan starts fresh instead, and says so.
+            this.addLaunchWarning(t("kiro.tui_no_plan_fresh"));
+        }
+        const resumed = lp.mode === "resume" && lp.id && (lp.engine === "v1" || lp.engine === "v2") ? { engine: lp.engine, id: lp.id } : null;
+        const fallbackModel = !config.model && resumed && config.instanceDir
+            ? this.retiredModelFallback(config, resumed, credentialProfile) : null;
+        this.launchModels = config.instanceDir
+            ? { instanceDir: config.instanceDir, ownModel: config.model ?? null, launchModel: config.model ?? fallbackModel, conversation: resumed?.id ?? null }
+            : null;
         if (config.model) {
             const model = validateModel(config.model);
             warnIfModelMismatch("kiro-cli", model);
             cmd += ` --model ${shellQuote(model)}`;
         }
+        else if (fallbackModel) {
+            cmd += ` --model ${shellQuote(validateModel(fallbackModel))}`;
+        }
         if (config.effort) {
             const effort = validateEffort(config.effort);
             if (this.compatibility.supportsEffortFlag) {
@@ -1219,6 +1760,7 @@ export class KiroBackend {
         return true;
     }
     writeConfig(config) {
+        this.assertCarryPrepared(config);
         // WORKAROUND: kiro-cli ignores the "env" block of an MCP server entry — the server subprocess inherits the fleet
         // manager's env, with a stale AGEND_SOCKET_PATH from whichever daemon wrote last. Each server therefore runs
         // through a wrapper script that exports this instance's env and execs the real server.
@@ -1290,6 +1832,59 @@ export class KiroBackend {
             this.addLaunchWarning(t("kiro.untagged_steering"));
         }
     }
+    /**
+     * #2648 steps 1 and 3: the model a resumed conversation is launched on instead of its saved one, or null to launch as
+     * before. Only for an instance with no model of its own. The conversation's current saved model decides, every
+     * launch: one kiro's cached list no longer has is switched to kiro's default; one it has — or, without a list, one
+     * other than the model that failed (a later /model choice, or the default kiro saved after a switch) — is launched
+     * as saved, even after an earlier switch (#2649 review). Only when the saved model cannot be read does a recorded
+     * switch (step 2's restart) still apply. Announced once per conversation; the record also keeps that dedupe.
+     */
+    retiredModelFallback(config, resumed, credentialProfile) {
+        const records = readKiroModelRecords(config.instanceDir);
+        let entry = records.switched[resumed.id];
+        const known = readKiroKnownModels(getAgendHome());
+        const prepared = this.preparedV2Model;
+        const saved = resumed.engine === "v1"
+            ? readKiroV1SavedModel({ id: resumed.id, workingDirectory: config.workingDirectory, dbPath: kiroV1DbPath(credentialProfile) })
+            : prepared && prepared.key === this.storeKey(config) && prepared.id === resumed.id ? prepared.model : null;
+        if (saved) {
+            // Step 2's restart recorded no model: the one saved now is the one that failed — unless it is the default the
+            // switch put there (kiro saves the model a launch ran on).
+            if (entry && entry.from === null && saved !== entry.to)
+                entry.from = saved;
+            const supported = known ? known.models.has(saved) : !!entry && (saved === entry.to || (entry.from !== null && saved !== entry.from));
+            if (supported || (!known && !entry)) {
+                if (entry && entry.from !== saved)
+                    this.saveModelRecords(config.instanceDir, records);
+                return null;
+            }
+            if (!entry || entry.from !== saved)
+                entry = records.switched[resumed.id] = { from: saved, to: known?.defaultModel ?? entry?.to ?? KIRO_FALLBACK_MODEL, announced: entry?.announced ?? false };
+        }
+        else if (!entry) {
+            return null;
+        }
+        if (!entry.announced) {
+            this.addLaunchWarning(t("kiro.retired_model_switched", config.instanceName, entry.from ?? t("kiro.retired_model_unknown"), entry.to));
+            entry.announced = true;
+        }
+        this.saveModelRecords(config.instanceDir, records);
+        return entry.to;
+    }
+    saveModelRecords(instanceDir, records) {
+        try {
+            writeKiroModelRecords(instanceDir, records);
+        }
+        catch { /* the next launch decides again; at worst it says so again */ }
+    }
+    /** #2648 steps 2 and 4: what a model error on this launch should do (records it); null before any launch. */
+    onModelError() {
+        const m = this.launchModels;
+        if (!m)
+            return null;
+        return decideKiroModelError(m.instanceDir, m, readKiroKnownModels(getAgendHome())?.defaultModel ?? KIRO_FALLBACK_MODEL);
+    }
     addLaunchWarning(message) {
         this.launchWarning = this.launchWarning ? `${this.launchWarning}\n${message}` : message;
     }
@@ -1656,7 +2251,7 @@ export class KiroBackend {
                 // picker. Its choices range across credit multipliers and capability
                 // tiers, so this must be a human decision, never an automatic Enter or
                 // Escape. The ordinary /model menu alone is intentionally not matched.
-                pattern: /^\s*Select model \(type to search\):\s*$/m,
+                pattern: KIRO_MODEL_PICKER_HEADER,
                 keys: [],
                 description: "Kiro model unavailable — choose a replacement model in the instance pane",
                 blocksDelivery: true,
@@ -1668,7 +2263,7 @@ export class KiroBackend {
                 // Any active /model picker owns stdin, even if a future Kiro release
                 // changes the exact warning, credit wording or row layout. Keep this
                 // after the verified-outage case: it never labels /model as an outage.
-                pattern: /^\s*Select model \(type to search\):\s*$/m,
+                pattern: KIRO_MODEL_PICKER_HEADER,
                 keys: [],
                 description: "Kiro model picker — manual selection required",
                 blocksDelivery: true,
@@ -1676,14 +2271,94 @@ export class KiroBackend {
                 inputBlocked: true,
                 isActive: kiroModelPickerAtTail,
             },
+            {
+                // #2587: an MCP server's input request (kiro-cli 2.34.0 V3) owns stdin until the person answers or cancels it.
+                pattern: KIRO_MCP_INPUT_HEADER,
+                keys: [],
+                description: "Kiro MCP server is asking for input — answer it in the instance pane",
+                blocksDelivery: true,
+                holdOnly: true,
+                inputBlocked: true,
+                isActive: kiroMcpInputRequestActive,
+                requestIdentity: pane => readKiroMcpInputCard(pane)?.identity ?? null,
+                remoteCard: readKiroMcpInputCard,
+            },
+            {
+                // #2592: the agent's question to the user owns stdin until the person answers or cancels it.
+                pattern: KIRO_QUESTION_HEADER,
+                keys: [],
+                description: "Kiro agent is asking a question — answer it in the instance pane",
+                blocksDelivery: true,
+                holdOnly: true,
+                inputBlocked: true,
+                isActive: kiroQuestionCardActive,
+                requestIdentity: pane => readKiroQuestionCard(pane)?.identity ?? null,
+                remoteCard: readKiroQuestionCard,
+            },
             ...kiroTrustPromptDialogs(this.activeTrustAll),
             ...kiroWorkspaceTrustDialogs(this.activeTrustAll),
+            {
+                // #2682: an editor, a pager, a `!` command or a focused /kvim owns the pane: a paste and an Enter would go into
+                // it. Last, so every dialog above keeps its own words; held for the person, never keyed.
+                pattern: KIRO_TAKEOVER_KEY,
+                keys: [],
+                description: "Kiro's terminal is in use by another program (an editor, a pager or a ! command) — finish or close it in the instance pane",
+                blocksDelivery: true,
+                holdOnly: true,
+                inputBlocked: true,
+                isActive: pane => kiroTakeoverActive(pane, this.activeUi),
+            },
         ];
     }
+    /**
+     * #2682: kiro's own input row, read positively, before an idle delivery. TUI and V3: the composer reads "idle", or
+     * "text" (a draft, as before); busy, another mode (a goal, the tray being edited) or no composer at all — an unknown
+     * full-screen program, a blank frame — is not a screen to type into. Legacy: its prompt row is the bottom row (`4% !>`,
+     * or `4% >` without trust-all, live 2.34.0), not running a `!` command. Anything else: the delivery waits.
+     */
+    /** #2682: the busy composer's input reaches kiro's own turn (kiroBusyTurnTakesInput), not a `!` command's PTY. */
+    busyTurnTakesInput(pane) {
+        return this.activeUi !== "legacy" && kiroBusyTurnTakesInput(pane);
+    }
+    idleComposerReady(pane) {
+        if (this.activeUi === "legacy") {
+            const prompt = kiroLegacyPromptAtBottom(pane.split("\n").map(row => row.replace(/\s+$/, "")));
+            return prompt !== null && !prompt.startsWith("!");
+        }
+        const mode = readKiroSteerComposer(pane);
+        return mode === "idle" || mode === "text";
+    }
     getContextUsage() {
         return null;
     }
     logLaunch() { return this.builtLaunch ? { ...this.builtLaunch } : null; }
+    /**
+     * #2598 B1: the store is the launch's engine's (v1 = the classic sqlite store, v2 = the TUI's session files), and the
+     * conversation is the one the launch resumed by id. A fresh or legacy-mode launch owns no id yet.
+     */
+    transcriptLaunch() {
+        const built = this.builtLaunch, plan = this.activePlan;
+        if (!built)
+            return null;
+        return { engine: built.engine, sessionId: plan?.mode === "resume" && plan.id ? plan.id : null };
+    }
+    /**
+     * M-2025: `/session-id` and `/title` exist on tui and V3 only. Legacy keeps
+     * the tmux window name and the sqlite lookup.
+     */
+    sessionProof() {
+        const ui = this.activeUi;
+        if (ui !== "tui" && ui !== "v3")
+            return null;
+        const pinned = this.transcriptLaunch()?.sessionId ?? null;
+        return {
+            pinned,
+            sessionIdCommand: KIRO_SESSION_ID_COMMAND,
+            titleCommand: this.activeInstance ? kiroTitleCommand(this.activeInstance) : null,
+            readComposer: readKiroCommandComposer,
+            readSessionIdAlert: readKiroSessionIdAlert,
+        };
+    }
     getSessionId() {
         // Kiro manages sessions internally via SQLite keyed by working directory.
         // No external session ID needed — --resume handles it automatically.
@@ -1709,7 +2384,7 @@ export class KiroBackend {
      */
     readModelsPayload() {
         try {
-            const out = execFileSync(this.binaryPath, ["chat", "--list-models", "--format", "json"], { encoding: "utf-8", timeout: 5000, stdio: ["ignore", "pipe", "ignore"] });
+            const out = execFileSync(this.binaryPath, ["chat", "--list-models", "--format", "json"], { encoding: "utf-8", timeout: 5000, stdio: ["ignore", "pipe", "ignore"], env: kiroChildEnv() });
             const parsed = JSON.parse(out);
             const arr = Array.isArray(parsed) ? parsed : (parsed?.models ?? []);
             const models = arr.map((m) => {