Kiro CLI: Workspace Trust, Workflow Plan Step Trees, and Mermaid Subgraphs

[Fixes] The semantic-search model download no longer extracts a file outside its model directory

This release adds workspace trust to interactive V3 sessions: Kiro CLI asks you to trust a folder before it loads that folder's hooks, agents, MCP servers, steering, workflows, or language server configuration. A cloned repository can no longer change how the agent behaves until you say so.

[Trust a workspace before Kiro loads its configuration] The first time you start an interactive V3 session in a folder, Kiro CLI shows a Trust this workspace? screen before it loads the folder's hooks, agents, MCP servers, steering, workflows, or language server configuration. Choose Trust, continue or Don't trust, exit. Kiro saves your answer per workspace root under `~/.kiro/workspace-roots/`, so the screen appears once per folder. Trust for your home directory is never saved, so Kiro asks again at each launch there. To change your answer, remove `workspaceTrusted` from the per-workspace file the screen names. Learn more

[Set model fallback in V3 sessions] V3 sessions can set model fallback again. The `/model` settings pane and the `/model fallback` commands save fallback configuration when the agent supports it. A saved choice applies to the current session and persists for later sessions. Open `/model` to confirm your fallback choice.

[Improvements] Workflow plans as a step tree: When a V3 workflow asks you to approve its plan, the approval shows a compact step tree; expand a step to read its details before anything runs. With trust-all on, Kiro answers a workflow plan with the one-time Allow option instead of saving a grant. Learn more

[Improvements] Pull request watches act on conflicts, checks, and threads: A V3 workflow that watches a GitHub pull request now acts when the pull request has a merge conflict, a check fails, or a review thread gets an answer; it still waits without model turns until one of these events arrives. Learn more

[Improvements] Parallel grep searches: The V2 `grep` tool scans files in parallel across CPU cores, so searches on large projects finish sooner.

[Improvements] Lower memory in long sessions: V3 sessions hold less memory over time, so the agent stays responsive after hours of use.

[Improvements] Mermaid subgraphs, colors, and wrapped labels: Mermaid flowcharts in chat now draw subgraphs as titled frames, apply style-class colors, and render `<br/>` as a second line. Node labels wrap across up to four rows, and longer text ends in an ellipsis. Learn more

[Improvements] Clearer throttling errors: V3 throttling errors now say whether the model is overloaded or you reached your own rate limit.

[Fixes] V3 cloud config no longer stops updating for the rest of the process after a request that never gets an answer; the request now times out and is retried

[Fixes] V3 workflows now run when your organization turns off the Auto model instead of failing

[Fixes] On Windows, V3 hook commands no longer run a same-named program from the working directory

[Fixes] V3 `/code summary` now generates codebase documentation from the code intelligence overview instead of failing with "Unknown subcommand 'summary'"

[Fixes] In V3, with `chat.terminalTitle` on, the terminal title no longer falls back to the working directory; it now shows the session title

[Fixes] V3 replies Kiro starts on its own, such as after a workflow finishes, no longer cut off after a few words

[Fixes] V3 `/agent`, `/model`, and `/effort` complete a partly typed argument inline again

[Fixes] V3 `/sessions` no longer freezes for seconds at a time while its search index catches up

[Fixes] In your home directory, V3 `/sandbox` no longer treats your global sandbox settings as project settings, so changing project settings there cannot overwrite or delete them

[Fixes] Editing V3 sandbox network rules in `permissions.yaml` now applies to the running sandbox; before, the new rules took effect only after `/sandbox off` and `/sandbox on`

[Fixes] V3 sandbox network rules now match host names regardless of letter case, so a rule written as `example.com` also applies to `Example.COM`

[Fixes] `kiro-cli chat --agent <agent> @agent-sop:<name>` runs the SOP instead of sending the text as typed, also with `--no-interactive`

[Fixes] V3 `/code` in cloud sessions no longer shows your local working directory; it now shows the sandbox workspace root and `lsp.json` path

[Fixes] The V3 `code` tool no longer reports "No diagnostics found" for Python files with real errors; it now waits for Python and other slow language servers to report

[Fixes] V3 Windows workflows no longer reject recipe files whose drive letter case differs

[Fixes] V3 workflow review loops now stop once the reviewer approves instead of running to their limit: a `fileCheck` whose `jsonPath` starts with ``, such as ``, now reads the field it names. Learn more

[Fixes] Pressing Tab after `/model ` shows `set-current-as-default` as a sub-command again, instead of listing it as a model

[Fixes] Auto model retry notices no longer name a model

[Fixes] Starting Kiro CLI from your home directory no longer lists your global agents twice

[Fixes] V3 sessions no longer show a cloud config sync card when your cloud config is empty