@songsid/agend 2.3.2-beta.9 → 2.3.2

package/dist/daemon.js

@@ -1,10 +1,13 @@
+import { readActiveKiroModel } from "./backend/kiro.js";
 import { dashboardAccessOf } from "./dashboard-permissions.js";
+import { sendPackSources } from "./web-office-pack-read.js";
 import { agentWhatsNew, agendVersion, planWhatsNew, readWhatsNewRecord, recordWhatsNew, whatsNewNotice } from "./agent-whats-new.js";
 import { join, dirname, resolve } from "node:path";
 import { checkoutTarget, readCheckouts, releaseCandidate, reposRoot, verifyWorktree, writeCheckouts } from "./repo-worktree-guard.js";
 import { mkdirSync, writeFileSync, readFileSync, readdirSync, existsSync, unlinkSync, rmSync, appendFileSync, statSync, renameSync } from "node:fs";
 import { COMPACT_WATCH_TIMEOUT_MS, launchIdentity } from "./compact-watch.js";
 import { KIRO_COMPACT_PANE_LINES, KiroCompactPaneFollower } from "./kiro-compact-pane.js";
+import { clearKiroSessionProof, proveKiroSessionId, recordKiroSessionProof } from "./kiro-session-proof.js";
 import { fileURLToPath } from "node:url";
 import { ensureInstanceDir } from "./private-dir.js";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
@@ -36,13 +39,14 @@ import { ContextGuardian } from "./context-guardian.js";
 import { IpcServer } from "./channel/ipc-bridge.js";
 import { daemonBudgetMs } from "./channel/ipc-timeouts.js";
 import { MessageBus } from "./channel/message-bus.js";
-import { shellQuote, UnsupportedCliError } from "./backend/types.js";
+import { shellQuote, UnsupportedCliError, ResumeBlockedError } from "./backend/types.js";
 import { getTmuxSession } from "./config.js";
 import { routeToolCall } from "./channel/tool-router.js";
 import { parseReplyButtons, replyButtonsFallbackText } from "./reply-buttons.js";
 import { HangDetector } from "./hang-detector.js";
 import { writeSecretFile } from "./secret-file.js";
 import { PaneWriteLock } from "./pane-write-lock.js";
+import { answerRemoteCard } from "./remote-card-answer.js";
 import { buildFleetInstructions } from "./instructions.js";
 import { formatHumanInboundMessage, prepareDeliveryWire, steerInboundEnvelope, BTW_INBOUND_PREFIX, humanBodyHash, humanOwnerObjectId } from "./human-delivery-receipts.js";
 import { formatCrossInstanceInboundMessage, renderCrossInstanceHandoffMetadata, } from "./cross-instance-envelope.js";
@@ -89,6 +93,10 @@ const WEB_THEME_IPC = Object.freeze({
     delete_web_effect: "fleet_delete_web_effect",
     // #2578: its own character in the Office view — the args as they are (the fleet checks them).
     office_view: "fleet_office_view", office_set: "fleet_office_set",
+    // #2692: the skin packs — check and upload read the pack here (web-office-pack-read.ts) and send its bytes in parts.
+    office_pack_check: "fleet_office_pack_check", office_pack_upload: "fleet_office_pack_upload",
+    office_pack_delete: "fleet_office_pack_delete", office_pack_restore: "fleet_office_pack_restore",
+    office_pack_list: "fleet_office_pack_list", office_set_style: "fleet_office_set_style",
 });
 /** The largest picture any slot may take (a card slot's ceiling; the fleet checks the limit in force): read no more. */
 const WEB_THEME_ASSET_MAX_BYTES = ASSET_UPLOAD_MAX_BYTES;
@@ -573,6 +581,8 @@ export const OWN_SWITCH_WAIT_MS = 6_000;
 const OWN_SWITCH_SETTLE_MS = 3_000;
 /** A blocking dialog still on screen this long after first being seen is reported for a human. */
 const DIALOG_PARKED_NOTIFY_MS = 60_000;
+/** #2675: a card a person can answer from the chat is posted once it has been on screen, unchanged, this long. */
+const REMOTE_CARD_STABLE_MS = 1_500;
 /** #1691: a prompt no table knows must sit unchanged this long (monotonic) before it holds deliveries and is reported. */
 export const UNRECOGNISED_PROMPT_STABLE_MS = 60_000;
 /** #1691: the rows under a prompt a backend without a composer reader shows its ready chrome in (status bar, hint). */
@@ -701,6 +711,18 @@ const FIRST_DELIVERY_WINDOW_MS = 5_000;
 const NATIVE_QUEUE_PASTE_VERIFY_MS = 2_000;
 /** #1405: how long a steer's paste gets to show in a mode-switched composer before its one Enter (captures included). */
 const STEER_PASTE_VISIBLE_MS = 2_000;
+/**
+ * #2676: the longest one-line paste kiro's TUI composer still shows as typed text; longer, it collapses to a
+ * `N chars ▸` chip (2.34.0 tui.js: more than 10 lines or 500 characters collapse).
+ */
+const KIRO_COLLAPSE_CHARS = 500;
+/**
+ * #1405/#2676: whether a mode-switched composer in `mode` may take a busy hand-off: a steer only on "steer", an ordinary
+ * message on "steer" or "queue" (kiro takes either into its tray), and "idle" — the turn over — only where `allowIdle`.
+ */
+function composerModeAdmits(mode, allowIdle, steerOnly) {
+    return mode === "steer" || (!steerOnly && mode === "queue") || (allowIdle && mode === "idle");
+}
 /** `promise`'s value if it settles within `ms`, else undefined — the late answer is dropped, never awaited (#1405). */
 async function withinMs(promise, ms) {
     if (ms <= 0) {
@@ -1138,6 +1160,29 @@ export class Daemon extends EventEmitter {
     logTranscriptPath() { return this.transcriptMonitor?.currentPath() ?? null; }
     /** #1218 (kiro): the launch this daemon's backend last built, for the Log's reason only (kiro-log-gate.ts). */
     logLaunch() { return this.backend?.logLaunch?.() ?? null; }
+    async kiroMigrationIdle() {
+        const tmux = this.tmux, owner = this.interactionOwner();
+        if (!tmux || this.spawning || this.runtimeMonitorsFrozen || this.processStatus !== "running")
+            return false;
+        const pane = await tmux.capturePane(2000).catch(() => null);
+        return pane !== null && tmux === this.tmux && sameInteractionOwner(owner, this.interactionOwner())
+            && this.processStatus === "running" && !this.spawning && !this.runtimeMonitorsFrozen && this.paneAuthoritativelyIdle(pane);
+    }
+    /** One read-only migration observation. Never types into a pane or selects a picker. */
+    async kiroMigrationObservation() {
+        const tmux = this.tmux, owner = this.interactionOwner(), backend = this.backend;
+        if (!tmux || backend?.binaryName !== "kiro-cli" || this.processStatus !== "running" || this.spawning || this.runtimeMonitorsFrozen)
+            return null;
+        const pane = await tmux.capturePane(2000).catch(() => null);
+        if (pane === null || tmux !== this.tmux || !sameInteractionOwner(owner, this.interactionOwner())
+            || this.processStatus !== "running" || this.spawning || this.runtimeMonitorsFrozen || !this.paneAuthoritativelyIdle(pane)
+            || backend.readSteerComposer?.(pane) !== "idle")
+            return null;
+        const launch = backend.transcriptLaunch?.(), path = this.logTranscriptPath();
+        // Agent switching is separately disabled for saved-agent resumes; it is not an observation API.
+        const model = readActiveKiroModel(pane);
+        return launch?.engine === "v2" && launch.sessionId && model && path ? { sessionId: launch.sessionId, model, transcript: path } : null;
+    }
     guardian = null;
     adapter = null;
     pendingIpcRequests = new Map();
@@ -1257,6 +1302,12 @@ export class Daemon extends EventEmitter {
     dialogParkedKey = null;
     dialogParkedInteractionEpisode = null;
     dialogParkedReported = false;
+    /** #2675: the card on screen that a person can answer from the chat — what it asks, since when, and whether it was posted. */
+    remoteCardShown = null;
+    /** #2675: when (performance.now, taken before its capture) the newest read the card tracker used was started. */
+    remoteCardReadAt = -Infinity;
+    /** #2675: an answer from the chat is being keyed in (one at a time). */
+    remoteCardAnswering = false;
     /**
      * #1691: the prompt at the bottom of the pane that no backend table knows — its block, since when (performance.now)
      * it has been unchanged, and whether that has lasted UNRECOGNISED_PROMPT_STABLE_MS. Updated by the runtime scan.
@@ -2026,6 +2077,11 @@ export class Daemon extends EventEmitter {
             this.finishDurableDelivery(delivery, "delivered", `steer-accepted; composer emptied (${verdict.proof.slice("steer-composer-".length)})`, verdict);
             return;
         }
+        // #2676: an ordinary message typed into that busy composer, proven the same way: taken into the CLI's tray.
+        if (verdict.proof?.startsWith("handoff-composer-")) {
+            this.finishDurableDelivery(delivery, "delivered", `composer-handoff-accepted; composer emptied (${verdict.proof.slice("handoff-composer-".length)})`, verdict);
+            return;
+        }
         // A backend whose input row cannot be read: all that vouched for this delivery is that the pane printed something
         // after Enter, which a redraw that wiped the paste satisfies too (#758). Its transcript can say more.
         if (verdict.proof === "output-edge") {
@@ -3432,6 +3488,11 @@ export class Daemon extends EventEmitter {
         if (!(err instanceof UnsupportedCliError))
             return false;
         this.healthCheckPaused = true;
+        if (err instanceof ResumeBlockedError) {
+            this.logger.error({ reason: err.message }, "Not respawning: retained session needs store repair");
+            this.emitSupervisionEnded(err.message, err.remedy, undefined, "resume_blocked");
+            return true;
+        }
         this.logger.error({ reason: err.message }, "Not respawning: the installed CLI cannot run this instance as configured");
         this.emitSupervisionEnded(err.message, "Install a CLI version that supports this instance's configuration, then start it again.", undefined, "cli_unsupported");
         return true;
@@ -3743,6 +3804,7 @@ export class Daemon extends EventEmitter {
                 if (!answersBackedOff)
                     this.dialogAnswers = null;
                 this.trackDialogParked(blockingSeen);
+                this.trackRemoteCard(blockingSeen, pane, captureMono);
                 if (blockingSeen)
                     return; // held dialog: skip error checks this cycle
                 this.evaluateErrorPatterns(pane, patterns, readyPattern, Date.now(), busyPattern);
@@ -6739,6 +6801,10 @@ export class Daemon extends EventEmitter {
             this.config.office_access = update.office_access;
         else if (update.office_access === null)
             delete this.config.office_access;
+        if (typeof update.office_pack_access === "boolean")
+            this.config.office_pack_access = update.office_pack_access;
+        else if (update.office_pack_access === null)
+            delete this.config.office_pack_access;
         if (update.dashboard && typeof update.dashboard === "object" && !dashboardAccessProblem(update.dashboard))
             this.config.dashboard = update.dashboard;
         else if (update.dashboard === null)
@@ -7346,6 +7412,7 @@ export class Daemon extends EventEmitter {
             return false;
         let windowId = this.getWindowId();
         const supportsQueuedInput = this.backend?.supportsQueuedInput?.() === true;
+        const composerQueue = !opts?.steer && this.composerTakesBusyInput() && this.composerCanShowPaste(formatted);
         let handingOffToNativeQueue = false;
         // If the CLI is busy, either hand the complete submission to its native input
         // queue or wait for idle. Native queue support is an explicit backend capability:
@@ -7362,11 +7429,13 @@ export class Daemon extends EventEmitter {
             // press Enter at once. A dialog painted a moment ago is still "busy" to
             // the silence gate, so the probe is mandatory here; "dialog"/"unknown"
             // fall through to the wait.
-            const canHandOff = (supportsQueuedInput || opts?.steer)
+            // #2676: an ordinary message goes into a mode-switched composer (kiro TUI) mid-turn too, on a launch whose busy
+            // composer AgEnD drives, by the steer path's own gates and proof — when its box can show it is this paste.
+            const canHandOff = (supportsQueuedInput || opts?.steer || composerQueue)
                 && readiness === "busy"
                 && (await this.probeBlockingDialog()).state === "clear"
                 && await this.hasPositiveDeliveryInput(true)
-                && (!opts?.steer || (this.launchTakesSteer() && await this.steerComposerAdmits(false)));
+                && ((!opts?.steer && !composerQueue) || (this.launchTakesSteer() && await this.steerComposerAdmits(false, opts?.steer === true)));
             if (canHandOff) {
                 // Native queue (codex), or an explicit /steer: hand the complete
                 // paste+Enter transaction to the busy CLI now. For steer this is the
@@ -7374,7 +7443,9 @@ export class Daemon extends EventEmitter {
                 // visibility check + idle-gated fallback catch TUIs that swallow
                 // busy input (see steerMessage).
                 handingOffToNativeQueue = true;
-                this.logger.debug(opts?.steer ? "CLI busy — steering into the running turn" : "CLI busy — handing message to backend-native input queue");
+                this.logger.debug(opts?.steer ? "CLI busy — steering into the running turn"
+                    : composerQueue ? "CLI busy — typing message into the busy composer"
+                        : "CLI busy — handing message to backend-native input queue");
             }
             else {
                 this.logger.debug("CLI busy — queuing message until idle");
@@ -7468,9 +7539,9 @@ export class Daemon extends EventEmitter {
                 // #1405: a launch that no longer takes a steer is not the one the gate saw — redo from the top (bounded), where
                 // the gate sends it down the idle path. The composer can also have changed mode since (the user's Ctrl+S), or
                 // the turn ended.
-                if (handingOffToNativeQueue && opts?.steer && !this.launchTakesSteer())
+                if (handingOffToNativeQueue && (opts?.steer || composerQueue) && !this.launchTakesSteer())
                     return "spawn-started";
-                if (handingOffToNativeQueue && opts?.steer && !(await this.steerComposerAdmits(true)))
+                if (handingOffToNativeQueue && (opts?.steer || composerQueue) && !(await this.steerComposerAdmits(true, opts?.steer === true)))
                     return "dialog";
                 // #829: a CLI that restores a cancelled prompt into its input box would
                 // have this message pasted onto it and both submitted as one. Clear it
@@ -7968,9 +8039,11 @@ export class Daemon extends EventEmitter {
                 && dialogs.some(other => other !== dialog && Daemon.dialogMatches(other, pane)))
                 continue;
             this.trackDialogParked(dialog);
+            this.trackRemoteCard(dialog, pane, probeMono);
             return { state: "dialog", dialog };
         }
         this.trackDialogParked(null);
+        this.trackRemoteCard(null, pane, probeMono);
         return { state: "clear" };
     }
     /**
@@ -8211,6 +8284,77 @@ export class Daemon extends EventEmitter {
         this.logger.warn({ dialog: dialog.description, attempts: episode.ignored, holdsDeliveries }, "Runtime dialog is ignoring AgEnD's answer — reporting for a human");
         this.emit("dialog_answer_ignored", { name: this.name, description: dialog.description, attempts: episode.ignored, holdsDeliveries });
     }
+    /**
+     * #2675: a held card a person can answer from the chat (the dialog's remoteCard reader) is posted once it has stayed
+     * the same card for REMOTE_CARD_STABLE_MS — `remote_card` with what it asks; the fleet posts it with its buttons. When
+     * it closes or another card replaces it, `remote_card_gone` retires that post. Moving through the card (ours or the
+     * person's in the pane) is the same card: its identity has no cursor. `readAt` is when the pane's capture was started
+     * (performance.now): a read that started before the newest one used here finishes late and says nothing about now —
+     * it may neither retire a newer card nor bring an older one back (#2677 review).
+     */
+    trackRemoteCard(dialog, pane, readAt) {
+        if (readAt < this.remoteCardReadAt)
+            return;
+        this.remoteCardReadAt = readAt;
+        const card = dialog?.remoteCard?.(pane) ?? null;
+        const shown = this.remoteCardShown;
+        if (shown && shown.identity !== card?.identity) {
+            this.remoteCardShown = null;
+            if (shown.posted)
+                this.emit("remote_card_gone", { name: this.name, identity: shown.identity });
+        }
+        if (!card)
+            return;
+        if (!this.remoteCardShown) {
+            this.remoteCardShown = { identity: card.identity, since: performance.now(), posted: false };
+            return;
+        }
+        if (this.remoteCardShown.posted || performance.now() - this.remoteCardShown.since < REMOTE_CARD_STABLE_MS)
+            return;
+        this.remoteCardShown.posted = true;
+        this.logger.info({ kind: card.kind }, "A card a person can answer from the chat is on screen — posting it");
+        this.emit("remote_card", { name: this.name, card });
+    }
+    /** #2675: the card's post was used up without answering it (refused, stopped part-way): post it again once it holds still. */
+    repostRemoteCard() {
+        this.remoteCardShown = null;
+    }
+    /**
+     * #2675: answer the card on screen from the chat, as the person chose: only while it is the card they saw
+     * (`identity`), on a verified cursor, under the pane write lock (remote-card-answer.ts). Never logs the answer.
+     */
+    async answerRemoteCard(identity, action) {
+        const tmux = this.tmux;
+        const readers = this.runtimeDialogs().filter(dialog => dialog.remoteCard);
+        if (!tmux || readers.length === 0)
+            return { outcome: "stale" };
+        if (this.remoteCardAnswering)
+            return { outcome: "refused", reason: "another answer to this card is being keyed in" };
+        this.remoteCardAnswering = true;
+        try {
+            const outcome = await answerRemoteCard({
+                locked: fn => this.paneWriteLock.run(fn),
+                // An unreadable screen (a failed capture, another spawn's pane) is unknown — never "the card closed".
+                read: () => this.tmux === tmux ? tmux.capturePane().catch(() => null) : Promise.resolve(null),
+                key: key => this.tmux !== tmux ? Promise.resolve(false) : key === "Space" ? tmux.sendKeys(" ") : tmux.sendSpecialKey(key),
+                paste: text => this.tmux !== tmux ? Promise.resolve(false) : tmux.pasteBuffer(text),
+                sleep: ms => new Promise(resolve => setTimeout(resolve, ms)),
+                now: () => performance.now(),
+            }, pane => {
+                for (const dialog of readers) {
+                    const card = dialog.remoteCard(pane);
+                    if (card)
+                        return card;
+                }
+                return null;
+            }, identity, action);
+            this.logger.info({ action: action.kind, ...outcome }, "Answered a card from the chat");
+            return outcome;
+        }
+        finally {
+            this.remoteCardAnswering = false;
+        }
+    }
     /**
      * Remember how long a blocking dialog has been on screen. Once it has
      * outlived DIALOG_PARKED_NOTIFY_MS — the auto-dismiss did not take, or the
@@ -8314,21 +8458,48 @@ export class Daemon extends EventEmitter {
      * while a fresh capture reads its composer as "steer" — or "idle" once the turn has ended (`allowIdle`, the pre-write
      * re-check). "queue" (the user's choice), text in the box, or a screen it cannot read: not now — the caller waits for
      * the idle prompt as for any message. AgEnD never switches the mode. Backends without the reader are not asked.
+     * #2676: an ordinary message (`steerOnly` false) goes in on "queue" too — kiro takes it into the same tray either way,
+     * held for the turn's end instead of steered into it.
      */
-    async steerComposerAdmits(allowIdle) {
+    async steerComposerAdmits(allowIdle, steerOnly = true) {
         const read = this.backend?.readSteerComposer;
         if (!read)
             return true;
         if (!this.tmux)
             return false;
-        let mode;
+        let pane;
         try {
-            mode = read.call(this.backend, await this.tmux.capturePane());
+            pane = await this.tmux.capturePane();
         }
         catch {
             return false;
         }
-        return mode === "steer" || (allowIdle && mode === "idle");
+        return composerModeAdmits(read.call(this.backend, pane), allowIdle, steerOnly) && this.busyInputReachesTurn(pane);
+    }
+    /** #2682: a busy composer's typed input reaches the CLI's own turn (busyTurnTakesInput); an idle box, or no reader: yes. */
+    busyInputReachesTurn(pane) {
+        const mode = this.backend?.readSteerComposer?.(pane);
+        if (mode !== "steer" && mode !== "queue")
+            return true;
+        return this.backend?.busyTurnTakesInput?.(pane) !== false;
+    }
+    /**
+     * #2676: whether an ordinary message may be typed into this CLI's busy composer — a mode-switched one (kiro TUI) on a
+     * launch whose busy composer AgEnD drives (the same evidence as a steer: KIRO_STEER_VERIFIED). The legacy UI, an
+     * unlisted version and every backend without the reader answer false; claude and codex hand off by
+     * supportsQueuedInput instead.
+     */
+    composerTakesBusyInput() {
+        return !!this.backend?.readSteerComposer && this.backend.supportsSteer?.() === true;
+    }
+    /**
+     * #2676: whether the box can show this payload as this delivery's paste before the Enter (steerPasteIsOurs): its
+     * first line, or a collapsed paste's line count. A one-line payload kiro would collapse (over 500 characters) shows only
+     * a character count, which kiro's own normalisation (tabs widened) makes no proof: it waits for the idle prompt.
+     * kiro measures after widening each tab to its 2-column stop, so a tab is counted as 2 here (at most what it becomes).
+     */
+    composerCanShowPaste(formatted) {
+        return /[\r\n]/.test(formatted) || formatted.replace(/\t/g, "  ").length <= KIRO_COLLAPSE_CHARS;
     }
     /**
      * #1405: one look at a mode-switched composer for a steer's own proof: on the tmux of this write, inside `deadline`
@@ -8362,10 +8533,18 @@ export class Daemon extends EventEmitter {
         if (first === "")
             return false;
         const row = norm(shown);
+        // #2676: a long paste is collapsed to a chip naming its line count (kiro TUI: more than 10 lines or 500 characters);
+        // it is this paste when that count is exactly this payload's as kiro counts it. tmux pastes every LF as CR (no -r),
+        // so a CRLF arrives as CR CR, and kiro turns each CR into a line break: every CR and every LF is one.
+        const collapsed = this.backend?.readSteerComposerPasteLines?.(shown);
+        if (collapsed != null)
+            return collapsed > 1 && collapsed === formatted.split(/\r|\n/).length;
         // The marker line holds nothing but the marker: the row is exactly it.
         if (/^\[agend-(?:delivery|human)-id:[^\]\s]+\]$/.test(first))
             return row === first;
-        return row === first || row.startsWith(`${first} `);
+        // #2676: a first line wider than the box is word-wrapped onto indented rows (live, 2.34.0): the row is its start, cut
+        // at a word boundary.
+        return row === first || row.startsWith(`${first} `) || first.startsWith(`${row} `);
     }
     /**
      * Codex can paint a prompt before the TTY enters raw mode. Both are required.
@@ -8512,6 +8691,18 @@ export class Daemon extends EventEmitter {
         if (this.needsStartupInputProof()) {
             return await this.hasPositiveDeliveryInput() ? "ready" : "transient";
         }
+        // #2682: a backend that can read its own idle input box (kiro's TUI) must show it before an idle paste. Anything
+        // else — another program owning the pane, a frame it cannot read, a capture that fails — is not one to type into.
+        if (this.backend?.idleComposerReady && this.tmux) {
+            try {
+                if (!this.backend.idleComposerReady(await this.tmux.capturePane()))
+                    return "busy";
+            }
+            catch (err) {
+                this.logger.debug({ err }, "capture-pane failed during the composer check — treating the pane as not ready");
+                return "busy";
+            }
+        }
         if (this.backend?.dropsEnterWhileBusy?.() !== true)
             return "ready";
         const prompt = this.backend.getBottomReadyPattern?.();
@@ -9155,15 +9346,16 @@ export class Daemon extends EventEmitter {
             }
             // #1405: on that same last capture a mode-switched composer (kiro TUI) must still read "steer" — or "idle", the
             // turn over. "queue", text in the box or an unreadable row: not written; handled as the unread box above.
-            if (handingOffToNativeQueue && steer && this.backend?.readSteerComposer
-                && pasteBaseline?.steerComposer !== "steer" && pasteBaseline?.steerComposer !== "idle") {
+            // #2676: an ordinary message typed into it (every other hand-off there) may also find "queue".
+            if (handingOffToNativeQueue && this.backend?.readSteerComposer
+                && (!composerModeAdmits(pasteBaseline?.steerComposer ?? null, true, steer) || pasteBaseline?.busyInputReachesTurn === false)) {
                 if (!verdict.durableBeginCommitted)
                     return "handoff-box-unread";
-                return this.failDelivery(verdict, status, "paste", "steer-composer-not-steering");
+                return this.failDelivery(verdict, status, "paste", steer ? "steer-composer-not-steering" : "composer-not-empty");
             }
             // …and the launch must still take a steer (see launchTakesSteer). Not written: before the durable begin the row
-            // is retried, as a steer the gate will then send down the idle path.
-            if (handingOffToNativeQueue && steer && !this.launchTakesSteer()) {
+            // is retried, as a steer the gate will then send down the idle path (#2676: so is a message typed into the box).
+            if (handingOffToNativeQueue && (steer || this.backend?.readSteerComposer) && !this.launchTakesSteer()) {
                 verdict.fenced = !verdict.durableBeginCommitted;
                 return false;
             }
@@ -9293,7 +9485,8 @@ export class Daemon extends EventEmitter {
             // #1405: a steer into a mode-switched composer (kiro TUI) is proven by the box alone — before the Enter it must
             // positively hold typed text, and after it be the empty placeholder again. The empty placeholder here means the
             // paste never reached the box; an unreadable box (a failed or late capture, a dialog) proves nothing: no Enter.
-            const steerComposerProof = handingOffToNativeQueue && steer && !!this.backend?.readSteerComposer && tmuxAtWrite !== null;
+            // #2676: an ordinary message typed into the busy box is proven the same way.
+            const steerComposerProof = handingOffToNativeQueue && !!this.backend?.readSteerComposer && tmuxAtWrite !== null;
             let humanComposerOwned = false;
             let steerEnterDeadline = Infinity;
             if (steerComposerProof) {
@@ -9394,8 +9587,8 @@ export class Daemon extends EventEmitter {
                                 if (humanComposerOwned)
                                     signature.humanPositive?.(after === "steer" ? "composer-empty-steer"
                                         : after === "queue" ? "composer-empty-queue" : "composer-empty-idle");
-                                verdict.phase = "steer-accepted";
-                                verdict.proof = `steer-composer-${after}`;
+                                verdict.phase = steer ? "steer-accepted" : "composer-accepted";
+                                verdict.proof = `${steer ? "steer" : "handoff"}-composer-${after}`;
                                 if (status)
                                     this.emit("message_confirmed", status); // ✅ taken from the box
                                 return true;
@@ -10086,6 +10279,7 @@ export class Daemon extends EventEmitter {
             collapsedPastes: input?.collapsedPastes ?? 0,
             inputReadable: input != null,
             steerComposer: this.backend?.readSteerComposer?.(pane) ?? null,
+            busyInputReachesTurn: this.busyInputReachesTurn(pane),
         };
     }
     /**
@@ -10581,6 +10775,12 @@ export class Daemon extends EventEmitter {
                     reply(failed ? null : answer, failed);
                     return;
                 }
+                if (tool === "office_pack_check" || tool === "office_pack_upload") {
+                    // #2692: the folder (or the manifest's files) is read here, on the agent's side; the fleet gets bytes in parts.
+                    const answer = await sendPackSources(args, { workspace: this.config.working_directory, configuredWorkspace: this.config.working_directory, stateDir: getAgendHome(), instance: this.name }, async (payload) => { const r = await ask(payload); return r.error ? { error: "fleet", message: r.error } : (r.result && typeof r.result === "object" ? r.result : {}); });
+                    reply(answer, undefined);
+                    return;
+                }
                 if (tool === "upload_web_effect") {
                     const owner = { fence: this.launchFenceEpoch, spawn: this.spawnGeneration, boot: this.bootId, ipc: this.ipcServer };
                     const current = () => !!owner.ipc && owner.ipc === this.ipcServer && owner.fence === this.launchFenceEpoch && owner.spawn === this.spawnGeneration && owner.boot === this.bootId && !this.deliveryWritesStopping && !this.startupAborted;
@@ -11351,6 +11551,23 @@ export class Daemon extends EventEmitter {
                         paneText = await this.tmux?.capturePaneWithHistory(50);
                     }
                     catch { /* pane may be gone */ }
+                    if (paneText && this.backend.resumeBlockedPattern?.().test(paneText)) {
+                        // #2598: a duplicate id proves the conversation exists. The generic retry escape hatch must not
+                        // abandon that pin or turn a store-selection error into a fresh conversation, even after many retries.
+                        await this.killProcessTree("SIGTERM", "spawn: retained session is blocked");
+                        this.startupAdmission?.();
+                        await this.tmux.killWindow();
+                        this.startupAdmission?.();
+                        throw new ResumeBlockedError(t("inst.kiro_resume_ambiguous"), t("inst.kiro_resume_ambiguous_remedy"));
+                    }
+                    const retained = this.backend.retainedResumeBlock?.();
+                    if (retained) {
+                        await this.killProcessTree("SIGTERM", "spawn: carried session must be preserved");
+                        this.startupAdmission?.();
+                        await this.tmux.killWindow();
+                        this.startupAdmission?.();
+                        throw new ResumeBlockedError(retained.reason, retained.remedy);
+                    }
                     const proven = this.paneSaysNoConversation(paneText);
                     if (!proven) {
                         const failures = this.bumpUnprovenResumeFailures();
@@ -11543,6 +11760,188 @@ export class Daemon extends EventEmitter {
             this.logger.warn({ err }, "The agent switch after resume failed — the shared entries stay; the next launch tries again");
         }
     }
+    /**
+     * M-2025: after a tui/V3 launch is ready, type `/session-id` and `/title` once
+     * each, under the pane-write lock, with the same fences as {@link ensureBackendAgent}.
+     * Does not touch the delivery epoch. A mismatch with the #2617 pin is surfaced;
+     * the pin is never replaced by a file-store guess. Legacy backends return null
+     * from sessionProof().
+     *
+     * #2683: these are AgEnD's own housekeeping, so unlike a delivery (which may join
+     * a person's draft) each one goes only into a composer the final capture shows
+     * positively EMPTY; Enter only once a capture shows exactly the command in the box;
+     * and it counts as run only once the box is empty again — a command left in the
+     * box stops here (it is taken back when the box shows exactly it), and nothing
+     * else is typed after it. The id is taken only from kiro's `/session-id` alert
+     * (readSessionIdAlert) on a capture after the command ran, and never when that
+     * alert was already on the final capture before it was typed: an announcement
+     * that was there before is not an answer to this request.
+     */
+    async ensureKiroSessionProof() {
+        let proof = null;
+        try {
+            proof = this.backend?.sessionProof?.() ?? null;
+        }
+        catch {
+            proof = null;
+        }
+        const tmux = this.tmux;
+        if (!proof || !tmux || !this.backend)
+            return;
+        const windowId = tmux.getWindowId();
+        const spawn = this.spawnGeneration, fence = this.launchFenceEpoch, phase = this.pauseWakeState;
+        const fenced = () => !this.startupAborted && !this.deliveryWritesStopping && !this.fatalStartupBlocked
+            && (phase === "active" || phase === "waking") && this.pauseWakeState === phase
+            && spawn === this.spawnGeneration && fence === this.launchFenceEpoch && this.tmux === tmux;
+        const deadline = performance.now() + Daemon.AGENT_SWITCH_BUDGET_MS;
+        const live = () => { this.startupAdmission?.(); return fenced() && performance.now() < deadline; };
+        if (!live())
+            return;
+        // A proof belongs to the launch that read it: an earlier launch's never stands for this one.
+        try {
+            clearKiroSessionProof(this.instanceDir);
+        }
+        catch { /* recorded again below only on a fresh match */ }
+        const TIMEOUT = Symbol("deadline");
+        const within = (work) => {
+            const left = deadline - performance.now();
+            if (left <= 0) {
+                work.catch(() => { });
+                return Promise.resolve(TIMEOUT);
+            }
+            let timer;
+            return Promise.race([work, new Promise(r => { timer = setTimeout(() => r(TIMEOUT), left); })])
+                .finally(() => clearTimeout(timer));
+        };
+        const capture = async () => {
+            const pane = await within(tmux.capturePane().catch(() => null));
+            return pane === TIMEOUT ? null : pane;
+        };
+        const pause = (ms) => within(new Promise(r => setTimeout(r, ms)));
+        const op = Daemon.AGENT_SWITCH_TMUX_OP_MS;
+        const box = async () => {
+            const pane = await capture();
+            return pane === null ? null : proof.readComposer(pane);
+        };
+        /**
+         * Our command, and only it, is in the box: take it back — also past the deadline, on its own bounded capture.
+         * Anything else there is left as it is.
+         */
+        const takeBack = async (command) => {
+            let timer;
+            const pane = await Promise.race([tmux.capturePane().catch(() => null), new Promise(r => { timer = setTimeout(() => r(null), op); })])
+                .finally(() => clearTimeout(timer));
+            if (pane !== null && fenced() && proof.readComposer(pane) === command)
+                await tmux.deleteBackward(command.length, op);
+        };
+        /**
+         * "ran": typed, Enter, and the box is empty again; `after` then read the pane with the capture from before the
+         * paste, still under the lock. "stuck": typed but not run — nothing more may be typed. null: nothing typed.
+         */
+        const typeOnce = async (command, after) => {
+            const wrote = await within(this.paneWriteLock.run(async () => {
+                if (!live())
+                    return null;
+                const readiness = await within(this.paneReadinessForDelivery(windowId));
+                if (readiness !== "ready" || !live())
+                    return null;
+                const before = await capture();
+                if (before === null || !live())
+                    return null;
+                if (this.inputTransientInPane(before) || !this.paneAuthoritativelyIdle(before))
+                    return null;
+                if (proof.readComposer(before) !== "")
+                    return null; // a draft, or a box that cannot be read
+                if (deadline - performance.now() < Daemon.AGENT_SWITCH_WRITE_RESERVE_MS)
+                    return null;
+                if (!await tmux.pasteBuffer(command, { guard: live, timeoutMs: op }))
+                    return "stuck";
+                let shown = null;
+                for (let i = 0; i < 4 && live() && shown !== command; i++) {
+                    await pause(i === 0 ? Daemon.AGENT_SWITCH_PASTE_SETTLE_MS : Daemon.AGENT_SWITCH_POLL_MS);
+                    shown = await box();
+                }
+                if (shown !== command || !live()) {
+                    await takeBack(command);
+                    return "stuck";
+                }
+                if (!await tmux.sendSpecialKey("Enter", op)) {
+                    await takeBack(command);
+                    return "stuck";
+                }
+                let left = command;
+                for (let i = 0; i < 6 && left !== ""; i++) {
+                    await pause(Daemon.AGENT_SWITCH_POLL_MS);
+                    if (!fenced())
+                        return "stuck";
+                    left = await box();
+                }
+                if (left !== "") {
+                    await takeBack(command);
+                    return "stuck";
+                }
+                return { ran: true, value: await after(before) };
+            }));
+            return wrote === TIMEOUT ? "stuck" : wrote;
+        };
+        try {
+            const sid = await typeOnce(proof.sessionIdCommand, async (before) => {
+                if (proof.readSessionIdAlert(before) !== null)
+                    return null; // already there: ours cannot be told apart
+                for (let i = 0; i < 6 && live(); i++) {
+                    const pane = await capture();
+                    if (pane === null)
+                        break;
+                    const id = proof.readSessionIdAlert(pane);
+                    if (id !== null)
+                        return id;
+                    await pause(Daemon.AGENT_SWITCH_POLL_MS);
+                }
+                return null;
+            });
+            if (!live())
+                return;
+            if (sid === "stuck") {
+                this.logger.warn("kiro /session-id did not run from an empty composer; /title is not typed after it");
+                return;
+            }
+            // Unread/mismatch are about kiro's answer after we ran /session-id.
+            // A composer that never read empty is not unread — we never asked.
+            if (sid) {
+                const verdict = proveKiroSessionId(proof.pinned, sid.value);
+                if (verdict.kind === "mismatch") {
+                    const message = t("kiro.session_id_mismatch", verdict.pinned, verdict.observed);
+                    this.logger.warn({ pinned: verdict.pinned, observed: verdict.observed }, "kiro /session-id does not match the pinned conversation");
+                    this.emit("backend_launch_warning", { name: this.name, message });
+                }
+                else if (verdict.kind === "unread") {
+                    const message = t("kiro.session_id_unread");
+                    this.logger.warn("kiro /session-id did not answer on the pane; not guessing from files");
+                    this.emit("backend_launch_warning", { name: this.name, message });
+                }
+                else if (verdict.kind === "match" || verdict.kind === "fresh") {
+                    this.logger.info({ id: verdict.id, kind: verdict.kind }, "kiro /session-id on the pane");
+                    try {
+                        recordKiroSessionProof(this.instanceDir, { sessionId: verdict.id, kind: verdict.kind });
+                    }
+                    catch (err) {
+                        this.logger.warn({ err, id: verdict.id }, "kiro /session-id was proven on the pane but could not be recorded");
+                    }
+                }
+            }
+            if (!live() || !proof.titleCommand)
+                return;
+            const titled = await typeOnce(proof.titleCommand, async () => true);
+            if (titled && titled !== "stuck")
+                this.logger.info({ title: proof.titleCommand }, "kiro /title sent for this instance");
+            else if (titled === "stuck")
+                this.logger.warn({ title: proof.titleCommand }, "kiro /title did not run from an empty composer");
+        }
+        catch (err) {
+            this.startupAdmission?.();
+            this.logger.warn({ err }, "kiro /session-id or /title after launch failed — the pin was not guessed from files");
+        }
+    }
     /**
      * Startup budget for this launch: the backend's override (resume-aware), never
      * below a user-configured startup_timeout_ms; undefined = trySpawn's default.
@@ -11705,6 +12104,9 @@ export class Daemon extends EventEmitter {
         if (ready)
             await this.ensureBackendAgent();
         this.startupAdmission?.();
+        if (ready)
+            await this.ensureKiroSessionProof();
+        this.startupAdmission?.();
         return ready;
     }
     /**