@songsid/agend 2.3.3 → 2.3.4-beta.10

package/dist/daemon.js

@@ -1,3 +1,4 @@
+import { dialogScreenText } from "./dialog-screen-text.js";
 import { readActiveKiroModel } from "./backend/kiro.js";
 import { dashboardAccessOf } from "./dashboard-permissions.js";
 import { sendPackSources } from "./web-office-pack-read.js";
@@ -32,14 +33,14 @@ import { scopedFleetConfigEnvironment } from "./web-experimental.js";
 import { readAgentFile } from "./agent-file-read.js";
 import { ASSET_UPLOAD_MAX_BYTES, receivePreview, sendAssetInParts, writePreview } from "./web-asset-parts.js";
 import { LOGIN_FLOWS } from "./login-flows.js";
-import { ProgressAccumulator, summarizeProgress } from "./tool-progress.js";
+import { ProgressAccumulator, isSearchProgram, summarizeProgress } from "./tool-progress.js";
 import { assembleSystemPrompt, resolveWorkflowText } from "./prompt-file-ref.js";
 import { isCrossInstanceVisibility } from "./cross-instance-notice.js";
 import { ContextGuardian } from "./context-guardian.js";
 import { IpcServer } from "./channel/ipc-bridge.js";
 import { daemonBudgetMs } from "./channel/ipc-timeouts.js";
 import { MessageBus } from "./channel/message-bus.js";
-import { shellQuote, UnsupportedCliError, ResumeBlockedError } from "./backend/types.js";
+import { shellQuote, KiroCompatibilityError, UnsupportedCliError, ResumeBlockedError } from "./backend/types.js";
 import { getTmuxSession } from "./config.js";
 import { routeToolCall } from "./channel/tool-router.js";
 import { parseReplyButtons, replyButtonsFallbackText } from "./reply-buttons.js";
@@ -59,7 +60,8 @@ import { MuseUsageRelay, clearMuseUsageSnapshot } from "./muse-usage-relay.js";
 import { deliveryContentDigest } from "./delivery-outbox.js";
 import { consumedWatches } from "./delivery-consumed-watch.js";
 import { queueResumePolicyForAttempt } from "./delivery-queue-evidence.js";
-import { scanTranscriptForDeliveryMarker } from "./delivery-reconciliation.js";
+import { markerConsumed, scanTranscriptForDeliveryMarker } from "./delivery-reconciliation.js";
+import { QUEUED_HANDOFF_MAX_REDELIVERIES, QueuedHandoffStore } from "./queued-handoffs.js";
 import { measureSyncWork, noteSyncWork } from "./sync-work-attribution.js";
 import { TranscriptDeltaReader } from "./transcript-delta-reader.js";
 import { buildResumeContinuation, clearInFlightTurnMarker, consumeInFlightTurnMarker, decideTurnResume, normalizeResumeBackend, readResumeFingerprint, RESUME_BLOCKING_DELIVERY_STATES, writeInFlightTurnMarker, } from "./turn-resume.js";
@@ -67,8 +69,9 @@ import { codexLiveRowMatches } from "./backend/codex.js";
 import { codexPackageProblemMessage } from "./backend/codex-package.js";
 import { claudeConfigDirFor, claudeProfileConfigDir, claudeSwitchDialog, claudeSwitchTargetMatches } from "./backend/claude-code.js";
 import { MuseBackend } from "./backend/muse.js";
-import { InteractionObservation, INTERACTION_CONFIRM_MS, sameInteractionOwner } from "./interaction-observation.js";
+import { BACKEND_LABELS, InteractionObservation, INTERACTION_CONFIRM_MS, sameInteractionOwner } from "./interaction-observation.js";
 import { unrecognisedPromptShape } from "./unrecognised-prompt.js";
+import { selectionCard } from "./selection-card.js";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 // Tool routing sets — module-level to avoid re-creation on every handleToolCall
@@ -149,6 +152,8 @@ export const HANDOFF_RECHECK_MS = 1_000;
 export const WAIT_STOP_POLL_MS = 250;
 /** #2770: human messages a cancel dropped are told in one notice, this long after the last of them. */
 export const CANCELLED_HUMANS_NOTICE_MS = 1_000;
+/** #3030: a queued hand-off's watch outlives a long turn (the record outlives the watch in any case). */
+export const QUEUED_HANDOFF_WATCH_LIFETIME_MS = 12 * 60 * 60_000;
 /**
  * An instance publishing more than this many execution-state edges inside the
  * window is flapping; its edges stop being logged one by one (#1116). One
@@ -341,7 +346,8 @@ export function shellCommandLabel(command) {
     if (!program)
         return "";
     const isBareWord = (t) => !!t && /^[A-Za-z][A-Za-z0-9_-]*$/.test(t);
-    const label = isBareWord(tokens[1]) ? `${program} ${tokens[1]}` : program;
+    // A search program's next word is what it searches for, not a subcommand: `grep <token>` keeps only `grep`.
+    const label = isBareWord(tokens[1]) && !isSearchProgram(program) ? `${program} ${tokens[1]}` : program;
     return label.length > 40 ? `${label.slice(0, 39)}…` : label;
 }
 export class PaneStateMachine {
@@ -530,6 +536,9 @@ function countOccurrences(haystack, needle) {
 }
 /** Bottom-ready re-poll cadence for Enter-dropping TUIs once the pane is quiet. */
 const BOTTOM_READY_POLL_MS = 250;
+/** M-2267: how often a pane left in a tmux mode is looked at again, and how long the delivery Enter waits for it to end. */
+const PANE_MODE_POLL_MS = 500;
+const PANE_MODE_ENTER_WAIT_MS = 10 * 60_000;
 /** Consecutive unreadable pane probes tolerated by the delivery gate before the delivery is failed (≈10s at the poll cadence). */
 const DIALOG_PROBE_UNKNOWN_MAX = 40;
 /** Startup dialog scan: poll cadence and wall-clock budget (keys and waits included). */
@@ -1305,6 +1314,12 @@ export class Daemon extends EventEmitter {
         holdOnly: true,
         isActive: (pane) => this.unrecognisedPromptActive(pane),
         requestIdentity: () => this.unrecognisedPrompt?.block ?? null,
+        // #2910 D4: a numbered prompt no table knows (Claude's Edit / Write / MCP tool permission menus among them) is put to
+        // a web-only fleet's dashboard as its own options; still never answered by the scanner.
+        remoteCard: (pane) => {
+            const backend = this.config.backend ?? "claude-code";
+            return selectionCard(pane, Object.hasOwn(BACKEND_LABELS, backend) ? BACKEND_LABELS[backend] : "CLI");
+        },
     };
     /**
      * #1690: AgEnD's own runtime `/model` in flight — from the moment its paste went in until its "Switch model?" dialog
@@ -1569,6 +1584,12 @@ export class Daemon extends EventEmitter {
     pendingWhatsNew = null;
     pasteQueueDepth = 0;
     /** #2770: a person's messages a cancel dropped before they reached the CLI, told together (noteCancelledHuman). */
+    /** #3030: people's messages a CLI never took (or that a restart left unverifiable), told once per batch. */
+    unsettledHandoffs = { "not-taken": [], unverifiable: [] };
+    unsettledHandoffsTimer = null;
+    /** #3030: since when (monotonic) the CLI has been idle without a break; null while it is not. */
+    instanceIdleSinceMono = null;
+    queuedHandoffStore = null;
     cancelledHumans = [];
     cancelledHumansTimer = null;
     firstDeliveryDelay = new FirstDeliveryDelay();
@@ -1980,6 +2001,9 @@ export class Daemon extends EventEmitter {
             this.publishWorkingState("turn_closed");
         };
     }
+    /** Register each issued HTTP credential with the same-process lifecycle owner. */
+    agentCredentialIssuer;
+    setAgentCredentialIssuer(issue) { this.agentCredentialIssuer = issue; }
     /** FleetManager and this daemon share a process, so durable begin/ACK is a direct synchronous store call. */
     setDeliveryOutboxPort(port) {
         this.deliveryOutbox = port;
@@ -2116,6 +2140,243 @@ export class Daemon extends EventEmitter {
             logger: this.logger,
         });
     }
+    handoffStore() {
+        return this.queuedHandoffStore ??= new QueuedHandoffStore(this.instanceDir);
+    }
+    /** #3030: the CLI that holds a queued hand-off; a record is settled only by a later one. */
+    handoffHolder() { return `${this.bootId}:${this.spawnGeneration}`; }
+    /**
+     * #3030: before the paste. A hand-off into a busy Claude Code / Codex queue gets its record — the transcript
+     * checkpoint before the paste, the unique leading marker and what a redelivery needs — or, for a redelivery written
+     * as an ordinary idle submission, its record moves its checkpoint here, so a crash right after this paste is still
+     * judged from the transcript that will show it. A write that did not keep a record runs as before.
+     */
+    async recordQueuedHandoff(formatted, handingOff, verdict, durableAttempt, humanVerificationId) {
+        const track = verdict.trackHandoff;
+        if (!track)
+            return;
+        if (!handingOff && !track.id) {
+            // An earlier attempt of this delivery was a hand-off; this one is an idle submission.
+            if (verdict.handoff)
+                this.dropQueuedHandoff(verdict);
+            return;
+        }
+        const backend = this.config.backend ?? this.backend?.binaryName ?? "";
+        if (!["claude-code", "codex"].includes(backend))
+            return;
+        const marker = durableAttempt ? `[agend-delivery-id:${durableAttempt.deliveryId}]`
+            : humanVerificationId ? `[agend-human-id:${humanVerificationId}]` : null;
+        if (!marker || !formatted.startsWith(marker))
+            return;
+        let checkpoint = verdict.transcriptCheckpoint ?? null;
+        if (!checkpoint) {
+            try {
+                checkpoint = await this.transcriptMonitor?.reconciliationCheckpoint() ?? null;
+            }
+            catch (err) {
+                this.logger.debug({ err }, "Could not checkpoint the transcript before a queued hand-off");
+            }
+        }
+        if (!checkpoint)
+            return; // nothing could judge it later: it runs as before (✅ at the hand-off)
+        const entry = {
+            id: track.id ?? randomUUID(), marker, backend, path: checkpoint.path, offset: checkpoint.offset,
+            content: track.content, meta: track.meta, holder: this.handoffHolder(), createdAt: Date.now(),
+            redeliveries: track.redeliveries ?? 0,
+        };
+        try {
+            const dropped = this.handoffStore().put(entry);
+            if (handingOff)
+                verdict.handoff = entry;
+            for (const old of dropped)
+                this.logger.warn({ handoff: old.id, createdAt: old.createdAt }, "Queued hand-off record dropped: too many on record");
+        }
+        catch (err) {
+            this.logger.warn({ err }, "Could not record a queued hand-off; it runs as before (✅ at the hand-off)");
+        }
+    }
+    /**
+     * #3030: after pushChannelMessage's write. A hand-off on record whose paste went out is watched (✅ when a turn
+     * takes it); one that was never written goes. A redelivery that ended as an ordinary submission is done; one that a
+     * cancel dropped goes too (a cancel is the person's); one stopped before its write stays for the next CLI.
+     */
+    afterTrackedWrite(meta, verdict, sent, deliveryEpoch) {
+        try {
+            // A stale epoch with writes still allowed is a cancel (the person's); a stop fences writes too, and keeps records.
+            const cancelled = !this.isDeliveryEpochCurrent(deliveryEpoch) && !this.deliveryWritesStopping;
+            if (verdict.handoff) {
+                if (sent || verdict.paneWriteStarted)
+                    this.watchQueuedHandoff(verdict.handoff);
+                else if (!verdict.trackHandoff?.id || cancelled)
+                    this.dropQueuedHandoff(verdict);
+                return;
+            }
+            const id = meta.handoff_redelivery;
+            if (!id)
+                return;
+            if (sent || verdict.paneWriteStarted || cancelled) {
+                this.handoffStore().remove(id);
+                this.logger.info({ handoff: id, sent, proof: verdict.proof ?? null }, "Queued hand-off redelivered as an ordinary submission");
+            }
+        }
+        catch (err) {
+            this.logger.warn({ err }, "Could not update the queued hand-off record after its write");
+        }
+    }
+    redeliveryStillOurs(meta) {
+        const holder = this.handoffHolder();
+        if (meta.handoff_holder !== holder)
+            return false;
+        try {
+            return this.handoffStore().get(meta.handoff_redelivery)?.holder === holder;
+        }
+        catch {
+            return false;
+        }
+    }
+    dropQueuedHandoff(verdict) {
+        const entry = verdict.handoff;
+        verdict.handoff = undefined;
+        if (!entry)
+            return;
+        try {
+            this.handoffStore().remove(entry.id);
+        }
+        catch (err) {
+            this.logger.warn({ err, handoff: entry.id }, "Could not remove a queued hand-off record");
+        }
+    }
+    /**
+     * #3030: the hand-off's CLI is the current one: watch its transcript for the turn that takes it (✅ then), and for an
+     * idle CLI that never did (reported). A stop ends the watch; the record stays for the next CLI to settle.
+     */
+    watchQueuedHandoff(entry) {
+        const spawn = this.spawnGeneration, fence = this.launchFenceEpoch, epoch = this.deliveryEpoch;
+        const started = consumedWatches.start({
+            deliveryId: `handoff:${entry.id}`,
+            attemptNo: entry.redeliveries,
+            backend: entry.backend,
+            path: entry.path,
+            offset: entry.offset,
+            marker: entry.marker,
+            // A cancel or stop moves the epoch: the watch ends quietly (a cancel cleared the record, a stop leaves it).
+            current: () => !this.deliveryWritesStopping && spawn === this.spawnGeneration && fence === this.launchFenceEpoch
+                && epoch === this.deliveryEpoch,
+            consumed: (via) => this.settleQueuedHandoff(entry, "taken", `transcript:${via}`),
+            idleForMs: () => this.instanceIdleSinceMono === null ? null : performance.now() - this.instanceIdleSinceMono,
+            notTaken: () => this.settleQueuedHandoff(entry, "not-taken", "transcript:absent-while-idle"),
+            // A queued message waits for the running turn, however long that is.
+            lifetimeMs: QUEUED_HANDOFF_WATCH_LIFETIME_MS,
+            logger: this.logger,
+        });
+        if (!started) {
+            // No watch (the fleet's cap): ✅ as before; the record still lets a restart judge it.
+            const status = channelStatus(entry.meta);
+            if (status)
+                this.emit("message_confirmed", status);
+        }
+    }
+    /** #3030: a record's end — taken (✅), or never taken / not judgeable (❌, told once per batch). */
+    settleQueuedHandoff(entry, outcome, proof) {
+        try {
+            this.handoffStore().remove(entry.id);
+        }
+        catch (err) {
+            this.logger.warn({ err, handoff: entry.id }, "Could not remove a settled queued hand-off record");
+        }
+        const meta = entry.meta;
+        const status = channelStatus(meta);
+        if (outcome === "taken") {
+            this.logger.info({ handoff: entry.id, proof, redeliveries: entry.redeliveries }, "Queued hand-off taken by the CLI");
+            if (status)
+                this.emit("message_confirmed", status);
+            return;
+        }
+        this.logger.warn({ handoff: entry.id, outcome, proof, redeliveries: entry.redeliveries }, "Queued hand-off was not taken by the CLI");
+        if (meta.from_instance) {
+            this.reportCrossInstanceDeliveryFailure(meta, { reached: true, phase: "handoff-not-consumed", proof: outcome === "not-taken" ? "not-taken" : "unverifiable" });
+            return;
+        }
+        if (!status)
+            return;
+        this.unsettledHandoffs[outcome].push({ chatId: status.chatId, messageId: status.messageId, ...(status.threadId ? { threadId: status.threadId } : {}) });
+        if (this.unsettledHandoffsTimer)
+            clearTimeout(this.unsettledHandoffsTimer);
+        this.unsettledHandoffsTimer = setTimeout(() => {
+            this.unsettledHandoffsTimer = null;
+            for (const reason of ["not-taken", "unverifiable"]) {
+                const messages = this.unsettledHandoffs[reason].splice(0);
+                if (messages.length)
+                    this.emit("human_handoffs_unsettled", { reason, messages });
+            }
+        }, CANCELLED_HUMANS_NOTICE_MS);
+        this.unsettledHandoffsTimer.unref?.();
+    }
+    /**
+     * #3030: right after a CLI came up — the records left by CLIs that are gone. Their queue went with them, so each is
+     * judged by its own transcript from its checkpoint: taken there (✅, nothing pasted); proven not taken (the whole
+     * delta read, the marker absent or only enqueued) → redelivered once, with the same marker, through the ordinary
+     * queue; anything that cannot be judged → never pasted, reported. Ownership is evidence: never pasted twice.
+     */
+    async reconcileQueuedHandoffs() {
+        let entries;
+        try {
+            entries = this.handoffStore().list().filter(e => e.holder !== this.handoffHolder());
+        }
+        catch (err) {
+            this.logger.warn({ err }, "Could not read the queued hand-off records");
+            return;
+        }
+        if (!entries.length)
+            return;
+        // Captured before any await: a reconciliation that outlives its CLI can never claim the next CLI's holder.
+        const holder = this.handoffHolder();
+        const spawn = this.spawnGeneration, fence = this.launchFenceEpoch, epoch = this.deliveryEpoch;
+        const fresh = () => spawn === this.spawnGeneration && fence === this.launchFenceEpoch && epoch === this.deliveryEpoch
+            && !this.deliveryWritesStopping;
+        let redelivered = 0, taken = 0, unverifiable = 0;
+        for (const entry of entries) {
+            const kind = await scanTranscriptForDeliveryMarker(entry.path, entry.offset, entry.backend, { marker: entry.marker });
+            // This CLI is gone already, or a cancel came: the next CLI settles them (a cancel cleared them).
+            if (!fresh())
+                return;
+            // …and the record is still the one that was read (another reconciliation or a cancel did not change it meanwhile).
+            let current;
+            try {
+                current = this.handoffStore().get(entry.id);
+            }
+            catch {
+                current = undefined;
+            }
+            if (!current || current.holder !== entry.holder || current.redeliveries !== entry.redeliveries)
+                continue;
+            if (markerConsumed(kind)) {
+                taken++;
+                this.settleQueuedHandoff(entry, "taken", `restart-transcript:${kind}`);
+                continue;
+            }
+            if (kind === "unavailable" || entry.redeliveries >= QUEUED_HANDOFF_MAX_REDELIVERIES) {
+                unverifiable++;
+                this.settleQueuedHandoff(entry, "unverifiable", kind === "unavailable" ? "restart-transcript:unavailable" : "redelivery-limit");
+                continue;
+            }
+            // Proven not taken: the CLI that queued it is gone and its transcript, read to the end, never took it.
+            const next = { ...entry, holder, redeliveries: entry.redeliveries + 1 };
+            try {
+                this.handoffStore().put(next);
+            }
+            catch (err) {
+                this.logger.warn({ err, handoff: entry.id }, "Could not update a queued hand-off record; not redelivered now");
+                continue;
+            }
+            redelivered++;
+            // The person's receipt was settled by the first write: the redelivery carries its marker, not its receipt binding.
+            const { human_receipt_id: _r, human_owner_key: _o, human_daemon_owner: _d, human_wire_sha256: _w, ...meta } = entry.meta;
+            this.pushChannelMessage(entry.content, { ...meta, handoff_redelivery: entry.id,
+                handoff_redeliveries: String(next.redeliveries), handoff_holder: next.holder }, undefined, epoch);
+        }
+        this.logger.info({ instance: this.name, redelivered, taken, unverifiable, proof: "transcript" }, "Queued hand-offs left by the previous CLI settled");
+    }
     finishDurableSubmission(delivery, verdict) {
         // Legacy backends may accept a pane write without enough pane evidence to
         // claim submission. Keep that row inspectable instead of recording a false
@@ -2624,6 +2885,8 @@ export class Daemon extends EventEmitter {
             this.startErrorMonitor();
         }
         this.startInstanceStateMonitor();
+        // #3030: messages a gone CLI still had queued — judged by its transcript, redelivered once or reported.
+        void this.reconcileQueuedHandoffs().catch(err => this.logger.warn({ err }, "Queued hand-off reconciliation failed"));
         this.logger.info(`${this.name} ready`);
     }
     /**
@@ -3098,8 +3361,6 @@ export class Daemon extends EventEmitter {
                         scheduleNext();
                         return;
                     }
-                    // The CLI owns the MCP server process, so the daemon can only observe it.
-                    measureSyncWork("daemon.healthCheck", () => this.checkMcpServerAlive());
                     // Human-readable backend label for logs (e.g. "claude", "kiro-cli")
                     const cliLabel = this.backend?.binaryName ?? "CLI";
                     const healthTmux = this.tmux;
@@ -3120,6 +3381,9 @@ export class Daemon extends EventEmitter {
                     if (discardStaleHealth())
                         return;
                     if (paneStatus?.alive) {
+                        // A CLI shutdown also closes its MCP children. Revive tools only for
+                        // a positively live pane, never while its exit is being classified.
+                        measureSyncWork("daemon.healthCheck", () => this.checkMcpServerAlive());
                         // Capture only a known primary while it lives. No extra tmux call: PID comes
                         // from this same status read. Fast/unobserved deaths remain ordinary crashes.
                         const key = this.oomSessionKey();
@@ -3166,6 +3430,29 @@ export class Daemon extends EventEmitter {
                             return;
                         }
                     }
+                    // tmux marks the PTY dead when its fd closes, before SIGCHLD can fill
+                    // pane_dead_status. Claude /exit (and any other CLI) can hit this gap.
+                    // Give the status four bounded re-probes; missing is never exit zero.
+                    if (paneStatus && !paneStatus.alive && paneStatus.exitCode === undefined) {
+                        for (let attempt = 0; attempt < 4; attempt++) {
+                            await new Promise(resolve => setTimeout(resolve, 250));
+                            if (discardStaleHealth())
+                                return;
+                            const observed = await healthTmux.getPaneStatus();
+                            if (discardStaleHealth())
+                                return;
+                            if (observed)
+                                paneStatus = observed;
+                            if (paneStatus.alive || paneStatus.exitCode !== undefined)
+                                break;
+                        }
+                        if (paneStatus.alive) {
+                            this.windowQueryFailureTicks = 0;
+                            this.stormWindow?.noteWindowAlive(this.name);
+                            scheduleNext();
+                            return;
+                        }
+                    }
                     // paneStatus === null → window gone entirely (e.g. tmux server crash)
                     // paneStatus.alive === false → pane dead, exit code available
                     const exitCode = paneStatus?.exitCode;
@@ -3349,6 +3636,8 @@ export class Daemon extends EventEmitter {
                             try {
                                 await this.spawnClaudeWindow();
                                 this.setProcessStatus("running");
+                                // #3030: messages a gone CLI still had queued — judged by its transcript, redelivered once or reported.
+                                void this.reconcileQueuedHandoffs().catch(err => this.logger.warn({ err }, "Queued hand-off reconciliation failed"));
                                 this.logger.info("Recovered from background session conflict");
                                 this.emit("crash_respawn", this.name);
                             }
@@ -3508,6 +3797,8 @@ export class Daemon extends EventEmitter {
                             catch { /* may not exist */ }
                         }
                         this.setProcessStatus("running");
+                        // #3030: messages a gone CLI still had queued — judged by its transcript, redelivered once or reported.
+                        void this.reconcileQueuedHandoffs().catch(err => this.logger.warn({ err }, "Queued hand-off reconciliation failed"));
                         this.logger.info({ resumed }, `Respawned ${cliLabel} window after crash`);
                         this.emit("crash_respawn", this.name);
                         // Emit the per-instance audit event while the storm is still active
@@ -3699,7 +3990,9 @@ export class Daemon extends EventEmitter {
                 const interactivePrompt = this.interactivePromptDetector.observe(pane, Date.now(), this.instanceStateLastOutputAt);
                 if (interactivePrompt) {
                     this.logger.warn(interactivePrompt, "Interactive terminal prompt is waiting for human input");
-                    this.emit("interactive_prompt", { name: this.name, ...interactivePrompt });
+                    // M-2269: the prompt as it was on screen, from this capture, for the Log.
+                    const screen = dialogScreenText(pane);
+                    this.emit("interactive_prompt", { name: this.name, ...interactivePrompt, ...(screen ? { screen } : {}) });
                     // A prompt is not an error and must not enter the PTY recovery gate.
                     // Continue scanning real errors in this same snapshot.
                 }
@@ -3894,7 +4187,7 @@ export class Daemon extends EventEmitter {
                     else if (dialog.verifyAfterKeys && !resolved) {
                         this.logger.warn({ dialog: dialog.description }, "Safety dialog choice was sent but follow-up verification or notice submission failed");
                     }
-                    this.trackDialogParked(blockingSeen);
+                    this.trackDialogParked(blockingSeen, pane);
                     return; // Dialog handled (or deliberately deferred): skip error checks this cycle
                 }
                 // Reached only when no dialog was answered this poll (none on screen, a fenced one, or one waiting out its
@@ -3904,7 +4197,7 @@ export class Daemon extends EventEmitter {
                     this.dialogAnswers = null;
                     this.retireParkedNotice("answer");
                 }
-                this.trackDialogParked(blockingSeen);
+                this.trackDialogParked(blockingSeen, pane);
                 this.trackRemoteCard(blockingSeen, pane, captureMono);
                 if (blockingSeen)
                     return; // held dialog: skip error checks this cycle
@@ -4202,6 +4495,14 @@ export class Daemon extends EventEmitter {
         // (Completion paths clear via the guard's onComplete; a cancel with no
         // later idle edge would otherwise leave the marker behind.)
         clearInFlightTurnMarker(this.instanceDir);
+        // #3030: what the person cancelled is not kept for a redelivery (nor reported as not taken).
+        try {
+            for (const entry of this.handoffStore().list())
+                this.handoffStore().remove(entry.id);
+        }
+        catch (err) {
+            this.logger.warn({ err }, "Could not clear queued hand-off records on cancel");
+        }
         this.deliveryEpoch = fleetEpoch === undefined
             ? this.deliveryEpoch + 1
             : Math.max(this.deliveryEpoch, fleetEpoch);
@@ -5498,6 +5799,10 @@ export class Daemon extends EventEmitter {
         if (snapshot.state === "working" && this.recoveryBootSettled
             && this.workingRecoveryInputOwner !== JSON.stringify(this.interactionOwner()))
             this.recoveryNativeWork = true;
+        if (snapshot.state !== "idle")
+            this.instanceIdleSinceMono = null;
+        else if (this.instanceState !== "idle" || this.instanceIdleSinceMono === null)
+            this.instanceIdleSinceMono = performance.now();
         this.instanceState = snapshot.state;
         this.acceptedInstanceSnapshot = { ...snapshot };
         // Reuse an already-captured pane and the backend's pure parser, never capture for the journal.
@@ -5609,7 +5914,7 @@ export class Daemon extends EventEmitter {
      * message can arrive mid-turn and sit queued, and marking at arrival would let
      * the PREVIOUS turn's idle edge consume (and reset) the new turn's state.
      */
-    markTurnStarted(meta, deliveredText, deliveryEpoch = this.deliveryEpoch) {
+    markTurnStarted(meta, deliveredText, deliveryEpoch = this.deliveryEpoch, queuedHandoff = false) {
         // Cancel may have interrupted an in-flight paste before its promise settled.
         // Its late success must not re-arm the turn that the user just cancelled.
         if (!this.isDeliveryEpochCurrent(deliveryEpoch))
@@ -5657,7 +5962,9 @@ export class Daemon extends EventEmitter {
         // during the continuation boots clean instead of chaining resumes.
         // #2544: a reply that settled before this arm already answered the person —
         // writing a marker would re-inject a continuation for a finished turn.
-        if (!meta.resumedContinuationOf && !armed.completionDelivered) {
+        // #3030: a message only queued in the busy CLI has not started a turn: the interrupted turn is still the running one,
+        // and a queued message lost to a restart is the hand-off record's to redeliver, not a continuation's.
+        if (!meta.resumedContinuationOf && !armed.completionDelivered && !queuedHandoff) {
             const resumeBackend = this.config.backend ?? this.backend?.binaryName ?? this.runtimeIdentity?.backend;
             const resumeCwd = this.config.working_directory ?? "";
             writeInFlightTurnMarker(this.instanceDir, {
@@ -7062,10 +7369,12 @@ export class Daemon extends EventEmitter {
         // Command name only — never the arguments. See shellCommandLabel.
         if (name === "Bash")
             return `$ ${shellCommandLabel(String(inp.command ?? ""))}`;
+        // The tool name only — never the search pattern: it can be a literal secret someone is looking for, and this label
+        // reaches the channel's progress line.
         if (name === "Glob")
-            return `Glob ${inp.pattern ?? ""}`;
+            return "Glob";
         if (name === "Grep")
-            return `Grep ${inp.pattern ?? ""}`;
+            return "Grep";
         if (name === "Agent")
             return "Agent (subagent)";
         if (name.startsWith("mcp__agend__"))
@@ -7436,6 +7745,13 @@ export class Daemon extends EventEmitter {
                 if (!this.isDeliveryEpochCurrent(deliveryEpoch)) {
                     this.logger.info("Pending channel delivery dropped by user cancel");
                     this.deferDurableDelivery(meta, "delivery epoch changed while queued");
+                    // #3030: a cancel is the person's — a queued redelivery it dropped is not redelivered later.
+                    if (meta.handoff_redelivery && !this.deliveryWritesStopping) {
+                        try {
+                            this.handoffStore().remove(meta.handoff_redelivery);
+                        }
+                        catch { /* the next CLI judges it */ }
+                    }
                     return;
                 }
                 if (this.config.pre_task_command) {
@@ -7446,13 +7762,26 @@ export class Daemon extends EventEmitter {
                 // #2800: with this real message, in the same paste — never a paste or turn of its own: after its delivery marker
                 // (transcript proof anchors on it), before the message. A person's message with a verified receipt is pasted
                 // byte for byte (its proof is the wire's hash), so the notice waits for the next delivery without one.
-                const whatsNew = this.pendingWhatsNew && !meta.human_receipt_id ? this.currentWhatsNew(this.pendingWhatsNew) : null;
+                const whatsNew = this.pendingWhatsNew && !meta.human_receipt_id && !meta.handoff_redelivery
+                    ? this.currentWhatsNew(this.pendingWhatsNew) : null;
                 const pasted = whatsNew ? withWhatsNew(formatted, whatsNew.notice) : formatted;
                 const status = channelStatus(meta);
                 // A fresh delivery begins a fresh turn — its bubble must not inherit
                 // the previous turn's tool list.
                 this.resetToolProgress();
                 verdict = { reached: false, humanReceipt: this.humanReceiptAttempt(meta, formatted) };
+                // #3030: a hand-off into the CLI's own queue stays on record until a turn takes it (redeliveries included).
+                if (!content.startsWith("/raw ") || meta.from_instance) {
+                    const { handoff_redelivery: redeliveryOf, handoff_redeliveries: redeliveries, handoff_holder: _holder, ...kept } = meta;
+                    verdict.trackHandoff = { content, meta: kept,
+                        ...(redeliveryOf ? { id: redeliveryOf, redeliveries: Number(redeliveries) || 0 } : {}) };
+                }
+                // #3030: a redelivery is written only by the CLI it was issued for, and only while its record still says so —
+                // one queued for a CLI that was replaced meanwhile is that next CLI's reconciliation's to judge again.
+                if (meta.handoff_redelivery && !this.redeliveryStillOurs(meta)) {
+                    this.logger.info({ handoff: meta.handoff_redelivery }, "Queued hand-off redelivery dropped: its CLI was replaced before the write");
+                    return;
+                }
                 const durableAttempt = this.durableDeliveryAttempt(meta, content);
                 if (durableAttempt === false) {
                     this.deferDurableDelivery(meta, "invalid durable delivery attempt metadata");
@@ -7475,10 +7804,11 @@ export class Daemon extends EventEmitter {
                     if (whatsNew && (sent || verdict.paneWriteStarted))
                         this.recordWhatsNewSent(whatsNew);
                 }
+                this.afterTrackedWrite(meta, verdict, !!sent, deliveryEpoch);
                 if (sent) {
                     delivered = true;
                     this.finishDurableSubmission(durable, verdict);
-                    this.markTurnStarted(meta, formatted, deliveryEpoch);
+                    this.markTurnStarted(meta, formatted, deliveryEpoch, !!verdict.handoff);
                 }
                 else if (durableAttempt && verdict.paneWriteStarted) {
                     this.finishDurableDelivery(durable, "uncertain", `${verdict.phase ?? "post-submit"}:${verdict.proof ?? "unproven"}`, verdict);
@@ -7761,6 +8091,9 @@ export class Daemon extends EventEmitter {
                 // The hand-off's last capture had no box: nothing was begun or written — wait for readiness, then try again.
                 if (written === "handoff-box-unread")
                     return "dialog";
+                // M-2267: the pane is in a tmux mode: nothing written — wait for readiness (it holds while the mode lasts), retry.
+                if (written === "pane-in-mode")
+                    return "dialog";
                 // Fenced before its first write: not attempted — redo after a spawn, else drop without a ❌.
                 return written === false && verdict.fenced ? stale() : written;
             });
@@ -8234,7 +8567,7 @@ export class Daemon extends EventEmitter {
                 && this.hasAutoDialogClaim(dialog)
                 && dialogs.some(other => other !== dialog && Daemon.dialogMatches(other, pane)))
                 continue;
-            this.trackDialogParked(dialog);
+            this.trackDialogParked(dialog, pane);
             this.trackRemoteCard(dialog, pane, probeMono);
             return { state: "dialog", dialog };
         }
@@ -8613,7 +8946,8 @@ export class Daemon extends EventEmitter {
         this.parkedNoticeOut = null;
         this.emit("dialog_unparked", { name: this.name });
     }
-    trackDialogParked(dialog) {
+    /** `pane`: the capture the caller already holds — M-2269 keeps the dialog's text from it for the Log (no new capture). */
+    trackDialogParked(dialog, pane = "") {
         if (!dialog) {
             if (this.dialogParkedSince !== 0)
                 this.logger.info({ dialog: this.dialogParkedKey }, "Blocking dialog is gone from the pane");
@@ -8651,7 +8985,9 @@ export class Daemon extends EventEmitter {
             this.dialogParkedReported = true;
             this.parkedNoticeOut = "parked";
             this.logger.warn({ dialog: dialog.description, parkedForMs: Date.now() - this.dialogParkedSince }, "CLI dialog is still on screen — not auto-answering, reporting for a human");
+            const screen = dialogScreenText(pane);
             this.emit("dialog_parked", { name: this.name, description: dialog.description, holdOnly: dialog.holdOnly === true,
+                ...(screen ? { screen } : {}),
                 ...(dialog.parkedAdvice ? { advice: dialog.parkedAdvice } : {}),
                 ...(episode !== null && interaction.kind ? { kind: interaction.kind, episode, backend: this.config.backend ?? "claude-code" } : {}),
                 ...(unrecognised ? { unrecognised: true, question: this.unrecognisedPrompt?.shape.question ?? null } : {}) });
@@ -9011,6 +9347,14 @@ export class Daemon extends EventEmitter {
                 : await this.waitForPaneIdleForDelivery(windowId, remaining);
             if (idle !== true)
                 return idle;
+            // M-2267: a person left the pane in a tmux mode (copy-mode): its keys would go to the mode. Hold — never take the
+            // pane out of it — and look again; the delivery goes once the mode ends (or this wait's own deadline).
+            if (await this.paneInTmuxMode("readiness")) {
+                if (stop && await stop())
+                    return "stopped";
+                await new Promise(r => setTimeout(r, BOTTOM_READY_POLL_MS));
+                continue;
+            }
             // The idle wait just resolved, so re-reading the silence gate would only
             // add a stale-cache race; ask the pane the remaining questions directly.
             const transient = await this.probeInputTransient();
@@ -9556,17 +9900,119 @@ export class Daemon extends EventEmitter {
      * precisely so the lock's scope is visible at the call site rather than being
      * an invariant maintained by comments.
      */
-    async sendDeliveryEnter(phase, stillCurrent, durableAttempt) {
+    async sendDeliveryEnter(phase, stillCurrent, durableAttempt, onInputHeld) {
         if (!(await this.waitForInputTransientToClear(phase)))
             return false;
-        return this.sendDeliveryEnterAfterAvailability(phase, stillCurrent, durableAttempt);
+        return this.sendDeliveryEnterAfterAvailability(phase, stillCurrent, durableAttempt, onInputHeld);
+    }
+    /**
+     * M-2267 (hmsg-b8a170c0): is the pane in a tmux mode (a person left it in copy-mode)? Logged once per stretch. Unknown
+     * (unreadable) is not a mode: the delivery's own reads decide then, as before.
+     */
+    paneModeSince = 0;
+    async paneInTmuxMode(phase) {
+        const inMode = await this.tmux?.paneInMode?.();
+        if (inMode !== true) {
+            this.paneModeSince = 0;
+            return false;
+        }
+        if (!this.paneModeSince) {
+            this.paneModeSince = performance.now();
+            this.logger.warn({ phase }, "The pane is in a tmux mode (copy-mode) — delivery waits for it to end; no key is sent to it");
+        }
+        return true;
+    }
+    /** M-2267: wait while the pane is in a tmux mode, until `deadline` (PANE_MODE_ENTER_WAIT_MS) — "clear", "stale" (fenced), "held". */
+    async waitWhilePaneInMode(phase, current, deadline = performance.now() + PANE_MODE_ENTER_WAIT_MS) {
+        for (;;) {
+            const inMode = await this.paneInTmuxMode(phase);
+            if (!current())
+                return "stale";
+            if (!inMode)
+                return "clear";
+            if (performance.now() >= deadline)
+                return "held";
+            await new Promise(r => setTimeout(r, PANE_MODE_POLL_MS));
+            if (!current())
+                return "stale";
+        }
     }
     /** Write half only: callers must finish the availability wait before any final recovery ownership proof. */
-    async sendDeliveryEnterAfterAvailability(phase, stillCurrent, durableAttempt) {
-        // A recovery Enter may have waited for a transient while cancel or spawn
-        // replaced the delivery. Check at the last point before the tmux write.
-        if (this.deliveryWritesStopping || (stillCurrent && !stillCurrent()))
+    async sendDeliveryEnterAfterAvailability(phase, stillCurrent, durableAttempt, onInputHeld) {
+        // A recovery Enter may have waited for a transient while cancel or spawn replaced the delivery: check here, and
+        // again after every wait below, at the last point before the tmux write.
+        // M-2290 (#2985 review, Fable): the mode wait can last up to 10 minutes, and a respawn or relaunch reuses the same
+        // tmux object and window — so the spawn generation and launch fence are part of the fence too: an Enter meant for
+        // the CLI this paste went to is never sent to its successor.
+        const tmux = this.tmux;
+        const generation = this.spawnGeneration;
+        const fence = this.launchFenceEpoch;
+        const current = () => this.tmux === tmux && this.spawnGeneration === generation && this.launchFenceEpoch === fence
+            && !this.deliveryWritesStopping && (!stillCurrent || stillCurrent());
+        if (!current())
             return false;
+        // The pasted text may still be in the box: the caller keeps it uncertain (no false failure, no second paste).
+        const hold = () => {
+            onInputHeld?.("pane-in-mode");
+            this.logger.warn({ phase }, "The pane stayed in a tmux mode; Enter withheld");
+            return false;
+        };
+        // M-2267 (#2971): a pane in a tmux mode (a person left it in copy-mode) would take this Enter. Wait for the mode to
+        // end, then look once more within the same deadline — a pane flickering back into a mode is waited out again, never
+        // past the bound. (beta.5: #2958's composer proof that used to sit between the two looks is reverted, decision
+        // f57474aa: it rejected Codex's footer after a resume and while busy. #2957 is open again.)
+        const modeDeadline = performance.now() + PANE_MODE_ENTER_WAIT_MS;
+        for (;;) {
+            const mode = await this.waitWhilePaneInMode(phase, current, modeDeadline);
+            if (mode === "stale")
+                return false;
+            if (mode === "held")
+                return hold();
+            if (await this.paneInTmuxMode(phase)) {
+                if (!current())
+                    return false;
+                if (performance.now() >= modeDeadline)
+                    return hold();
+                await new Promise(r => setTimeout(r, PANE_MODE_POLL_MS));
+                if (!current())
+                    return false;
+                continue;
+            }
+            if (!current())
+                return false;
+            break;
+        }
+        // M-2290 (the simple half of the #2957 redesign, leader xmsg-1793712561468): a dialog the backend RECOGNISES
+        // (runtimeDialogs: a permission card, the dangerous-command card, …) that painted between the paste and this Enter
+        // would take the key as its answer. Read the pane once more: such a dialog withholds the Enter, the caller keeps the
+        // delivery uncertain (Needs-you), and the dialog scanner parks the dialog for a person. Nothing else is judged here
+        // — an unknown or unreadable screen sends, exactly as before: #2958's composer proof (decision f57474aa) is NOT back.
+        // Only a caller that can hold (onInputHeld: the delivery's initial submit, settled uncertain → Needs-you) asks: one
+        // that cannot would read `false` as a failure and paste again. Only the backend's OWN dialogs count — not AgEnD's
+        // unrecognised-prompt guess — so an unknown screen still sends.
+        if (onInputHeld) {
+            let finalPane = null;
+            try {
+                finalPane = await tmux.capturePane();
+            }
+            catch {
+                finalPane = null;
+            }
+            if (!current())
+                return false;
+            let dialog;
+            try {
+                dialog = finalPane === null ? undefined : (this.backend?.getRuntimeDialogs?.() ?? []).find(d => Daemon.dialogMatches(d, finalPane))?.description;
+            }
+            catch {
+                dialog = undefined;
+            }
+            if (dialog !== undefined) {
+                onInputHeld?.("dialog");
+                this.logger.warn({ phase, dialog }, "A dialog is on the pane; the delivery's Enter is withheld (it would answer it)");
+                return false;
+            }
+        }
         // W1: persist the "Enter may have happened" boundary before tmux receives
         // the key. A crash after this commit is never auto-replayed without a
         // positive transcript marker, even if the stale pane still shows composer.
@@ -9574,7 +10020,7 @@ export class Daemon extends EventEmitter {
             this.logger.error({ phase, deliveryId: durableAttempt.deliveryId }, "Could not commit durable Enter write-ahead fence");
             return false;
         }
-        const sent = await this.tmux.sendSpecialKey("Enter");
+        const sent = await tmux.sendSpecialKey("Enter");
         if (!sent) {
             this.logger.error({
                 phase,
@@ -9634,6 +10080,10 @@ export class Daemon extends EventEmitter {
                 verdict.fenced = !verdict.durableBeginCommitted;
                 return false;
             }
+            // M-2267: the pane went into a tmux mode after the readiness wait. Nothing begun or written: the caller waits for
+            // readiness (which holds while it lasts) and tries again — as for a dialog that appeared before the write.
+            if (!verdict.durableBeginCommitted && await this.paneInTmuxMode("paste"))
+                return "pane-in-mode";
             // A hand-off pastes and presses Enter into a busy pane: the box must still be readable on this, the last capture
             // before the write (#1169 review) — a modal that appeared after the under-lock check would take that Enter. Before
             // the durable begin the caller waits for readiness outside the lock and tries again; after it (a paste retry),
@@ -9697,6 +10147,17 @@ export class Daemon extends EventEmitter {
                     }
                 }
             }
+            // #3030: a hand-off into a busy CLI's own queue is on record before its paste (write-ahead): that queue lives only
+            // in the CLI process, and a stop before a turn takes it would lose it without a trace.
+            if (verdict.trackHandoff && !rawPaste) {
+                await this.recordQueuedHandoff(formatted, handingOffToNativeQueue, verdict, durableAttempt, humanVerificationId);
+                if (stillCurrent && !stillCurrent()) {
+                    if (!verdict.trackHandoff.id)
+                        this.dropQueuedHandoff(verdict);
+                    verdict.fenced = !verdict.durableBeginCommitted;
+                    return false;
+                }
+            }
             if (lookBeforePaste) {
                 await lookBeforePaste();
                 // The look awaited: this attempt is still this write's — the same fence, tmux and launch — or nothing is written.
@@ -9730,6 +10191,22 @@ export class Daemon extends EventEmitter {
             // failed/throwing write as uncertain rather than retrying bytes into the
             // same pane; the write-ahead Enter marker later separates safe pre-Enter
             // recovery from a possibly executed command.
+            // M-2267 (#2971 review, Prism P2): EVERY paste attempt — a retry after a failed paste, a first paste whose durable
+            // begin already went — asks too. Before the begin: nothing begun, the caller waits for readiness and tries again.
+            // After it: this attempt waits here, keeping its durable attempt; a mode outlasting the wait fails it unwritten.
+            if (!verdict.durableBeginCommitted) {
+                if (await this.paneInTmuxMode("paste"))
+                    return "pane-in-mode";
+            }
+            else {
+                const mode = await this.waitWhilePaneInMode("paste", () => (!stillCurrent || stillCurrent()) && !this.deliveryWritesStopping);
+                if (mode === "stale") {
+                    verdict.fenced = false;
+                    return false;
+                }
+                if (mode === "held")
+                    return this.failDelivery(verdict, status, "paste", "pane-in-tmux-mode");
+            }
             const pasteGeneration = this.spawnGeneration;
             beforePaste?.();
             const pasted = await this.tmux.pasteBuffer(formatted);
@@ -9818,7 +10295,15 @@ export class Daemon extends EventEmitter {
             let enterAt = Date.now();
             const enterMono = performance.now();
             const steerEnterCurrent = () => steerCurrent() && performance.now() <= steerEnterDeadline;
-            if (!(await this.sendDeliveryEnter("initial-submit", steerComposerProof ? steerEnterCurrent : undefined, durableAttempt))) {
+            let inputHeld = null;
+            if (!(await this.sendDeliveryEnter("initial-submit", steerComposerProof ? steerEnterCurrent : undefined, durableAttempt, (why) => { inputHeld = why; }))) {
+                if (inputHeld) {
+                    // #2971: held in a tmux mode past the bound; M-2290: a recognised dialog on the pane. The paste may still be in
+                    // the CLI: keep it uncertain (Needs-you), never re-paste, never answer the dialog.
+                    verdict.phase = "submit-enter";
+                    verdict.proof = inputHeld === "dialog" ? "dialog-on-pane" : "pane-in-mode-held";
+                    return false;
+                }
                 if (steerComposerProof && !steerCurrent()) {
                     verdict.phase = "submit-enter";
                     verdict.proof = "fenced-before-enter";
@@ -9909,8 +10394,9 @@ export class Daemon extends EventEmitter {
                 }
                 const proof = await this.confirmSubmitted(signature, pasteBaseline);
                 if (proof === "submitted") {
-                    if (status)
-                        this.emit("message_confirmed", status); // ✅ native queue accepted
+                    // ✅ native queue accepted — unless it is on record (#3030): then ✅ waits for the turn that takes it.
+                    if (status && !verdict.handoff)
+                        this.emit("message_confirmed", status);
                     return true;
                 }
                 if (proof === "unverifiable") {
@@ -9942,8 +10428,8 @@ export class Daemon extends EventEmitter {
                     this.logger.warn("Paste reached the pane but could not be verified as submitted — accepting without proof");
                     verdict.phase = "best-effort-submission";
                     verdict.proof = "unverified";
-                    if (status)
-                        this.emit("message_confirmed", status); // ✅ (best-effort)
+                    if (status && !verdict.handoff)
+                        this.emit("message_confirmed", status); // ✅ (best-effort; on record: when taken, #3030)
                     return true;
                 }
                 // raw_paste has no unique marker and is not allowed to re-paste or
@@ -9958,8 +10444,14 @@ export class Daemon extends EventEmitter {
                 // confirmation ladder. "stranded" is the case that used to be a silent
                 // ✅ — the text was visible, so the old check called it delivered.
                 this.logger.warn({ proof }, "Native-queue paste not confirmed as submitted — retrying via idle-gated delivery");
-                if (windowId && this.controlClient) {
-                    await this.controlClient.waitUntilIdle(windowId);
+                // #3030: what follows is an idle submission (or a failure the caller reports): no longer a queued hand-off.
+                if (verdict.handoff && !verdict.trackHandoff?.id)
+                    this.dropQueuedHandoff(verdict);
+                verdict.handoff = undefined;
+                if (windowId && this.controlClient && !(await this.controlClient.waitUntilIdle(windowId))) {
+                    verdict.phase = "native-queue-idle-wait";
+                    verdict.proof = "idle-wait-failed";
+                    return false;
                 }
                 // Re-read before doing anything: the CLI had a whole turn to flush its
                 // queue while we waited, and the right recovery differs per outcome.
@@ -12354,7 +12846,12 @@ export class Daemon extends EventEmitter {
                 || this.startupAborted || this.deliveryWritesStopping || this.runtimeMonitorsFrozen || this.healthCheckPaused)) {
                 throw new Error("OOM recovery cancelled: the instance was stopped, paused or replaced while memory was unavailable");
             }
-            return this.trySpawnInsideGate(reuseWindow, startupTimeoutMs);
+            return this.trySpawnInsideGate(reuseWindow, startupTimeoutMs).catch(err => {
+                // Includes an in-place binary replacement during asynchronous launch preparation.
+                if (err instanceof KiroCompatibilityError)
+                    this.emit("kiro_compatibility_hold", err.message);
+                throw err;
+            });
         };
         const ready = !this.spawnGate ? await enter() : await this.spawnGate.run({
             instanceName: this.name,
@@ -12577,6 +13074,11 @@ export class Daemon extends EventEmitter {
         this.startupAdmission?.();
         const launchFence = this.launchFenceEpoch;
         const backendConfig = this.buildBackendConfig();
+        // A compatibility refusal is not a failed resume: no configuration, pin, history or pane may change.
+        if (this.backend?.assertLaunchSupported) {
+            this.backend.assertLaunchSupported(backendConfig);
+            this.emit("kiro_compatibility_hold", null);
+        }
         // #1633: decided before prev-instructions is first written — its absence is what says "never launched before".
         this.prepareWhatsNew(!existsSync(join(this.instanceDir, "prev-instructions")));
         // Record what this launch writes. #2787: a change is never announced in the pane; the CLI takes the new
@@ -12613,6 +13115,7 @@ export class Daemon extends EventEmitter {
         const agentTokenPath = join(this.instanceDir, "agent.token");
         const agentToken = randomBytes(32).toString("hex");
         const tokenWrite = writeSecretFile(agentTokenPath, agentToken);
+        this.agentCredentialIssuer?.(agentToken);
         if (!tokenWrite.ok) {
             // Do not fail the spawn over it — an instance that cannot start is worse
             // than one whose token is readable. But say so, loudly: the whole point of
@@ -12883,7 +13386,7 @@ export class Daemon extends EventEmitter {
                         // ones included: if the auto-dismiss keeps failing here, the human
                         // report should count from first sight, not from the runtime scan.
                         if (!dialog.fatal && this.deliveryBlockingDialogs().some(d => Daemon.dialogKey(d) === Daemon.dialogKey(dialog))) {
-                            this.trackDialogParked(dialog);
+                            this.trackDialogParked(dialog, pane);
                         }
                         // A fatal startup screen cannot be dismissed by keypresses (e.g. a
                         // corrupt claude.json modal offering only "exit" / "reset config").
@@ -12913,7 +13416,7 @@ export class Daemon extends EventEmitter {
                                     this.heldReasonLoggedKey = Daemon.dialogKey(dialog);
                                 this.logger.warn({ description: dialog.description, ...reason }, "Startup dialog held — not auto-answering, deliveries stay blocked");
                             }
-                            this.trackDialogParked(dialog);
+                            this.trackDialogParked(dialog, pane);
                             matched = true;
                             break;
                         }