Kiro CLI: MCP Elicitation, Workflow Controls, and Memory Deletion

This release lets V3 MCP tools ask for input, gives you more control over Workflows, and lets you delete memories from `/memories`. It also adds a model picker editor and improves workflow recovery, headless MCP sign-in, saved sessions, accessibility, and more.

[Let MCP tools ask for input] In local V3 sessions, MCP tools can now pause and show a form or link when they need more information. Enter the requested details, complete an action on another page, or decline the request. The tool continues without restarting its call. Learn more

[Improvements] Revise workflow plans before they start: Type suggested changes directly into a V3 workflow plan approval. Kiro updates the plan before any steps run. Learn more

[Improvements] Choose which models appear: Run `/model edit` to hide models you do not use from the `/model` picker. Hidden models remain available by ID. Learn more

[Improvements] Choose when Kiro starts Workflows: The new Workflow use setting offers Only when asked, Only for large tasks, and As much as possible. Learn more

[Improvements] Unclear shell commands are denied: V3 denies shell commands it cannot parse instead of asking you to approve an unclear command.

[Improvements] Tighter sub-agent MCP boundaries: V3 sub-agents no longer receive MCP servers declared inline by their parent agent.

[Improvements] Delete memories from the CLI: Open `/memories`, select a memory, and press `Ctrl+D` to remove it. Learn more

[Improvements] Trust a workspace for one launch: Start V3 with `--trust-workspace` to skip the workspace trust prompt without saving the choice. Learn more

[Improvements] Clearer tool approval choices: V3 approvals list Allow once and Deny once first, followed by choices that save an allow or deny rule.

[Improvements] Safer session deletion: The V3 session dashboard asks for confirmation before deleting a session.

[Fixes] V3 headless mode no longer answers agent questions or approves requests that name no trusted tool

[Fixes] V3 headless mode now reuses MCP sign-ins saved by interactive sessions

[Fixes] V3 Workflows resume after a restart without replanning or repeating completed steps

[Fixes] V2's Rust engine and V3 now preserve partial replies after a model refusal. The fallback model continues from that point instead of answering the prompt again

[Fixes] V3 `/rewind` forks at the right point for failed or unfinished turns

[Fixes] V3 `kiro-cli acp` no longer shuts down while the agent is still running

[Fixes] V3 `/agent` now loads the Skills declared by the agent you switch to

[Fixes] V3 `ssh` and `ssh-keygen` work in the macOS sandbox without `No user exists for uid`

[Fixes] V3 can delete files outside workspace folders on Windows

[Fixes] V3 remote MCP servers over HTTP follow only same-origin redirects

[Fixes] Kiro now shows `Working...` when the agent pauses while preparing a tool call, instead of appearing frozen

[Fixes] V3 `/sessions` opens and scrolls without freezing when you have many saved sessions

[Fixes] `/usage` now shows enterprise overage status and consumed credits

[Fixes] With `chat.allowIcons` off, the terminal drops box-drawing and block characters, and reads arrow keys as words

[Fixes] Mermaid diagrams render in more cases instead of showing raw HTML or failing

[Fixes] V3 deny rules save at your selected scope, and blocked calls are no longer reported as cancelled

[Fixes] V3 workflow monitor approvals open on the current call and close with `q`

[Fixes] Pasted images and pasted or dictated filter text now work in menus and pickers