Please review changes against upstream code using SCM,
see the Vcs-* tags in debian/control for its location.

--- kwalletcli-3.04beta.orig/BSDmakefile
+++ kwalletcli-3.04beta/BSDmakefile
@@ -1,6 +1,6 @@
 # $MirOS: contrib/hosted/tg/code/kwalletcli/BSDmakefile,v 1.21 2025/12/14 01:58:50 tg Exp $
 #-
-# Copyright © 2009, 2010, 2011, 2012, 2016, 2020
+# Copyright © 2009, 2010, 2011, 2012, 2016, 2020, 2026
 #	mirabilos <m$(date +%Y)@mirbsd.de>
 #
 # Provided that these terms and disclaimer and all copyright notices
@@ -26,6 +26,8 @@ SRCS=		charconv.c main.c
 SCRIPTS=	kwalletaskpass kwalletcli_getpin pinentry-kwallet
 MAN=		${PROG}.1 ${SCRIPTS:=.1}
 BINDIR?=	${BSD_PREFIX}/bin
+ICONDIR?=	${BSD_PREFIX}/share/icons/hicolor
+ICONSUBDIR?=	/apps
 
 PKG_CONFIG?=	pkg-config
 
@@ -59,6 +61,26 @@ afterinstall:
 	    ${.CURDIR}/${_i} ${DESTDIR}${BINDIR}/
 .endfor
 
+iconinstall:
+	${INSTALL} -d -o ${BINOWN} -g ${CONFGRP} -m ${DIRMODE} \
+	    ${DESTDIR}${ICONDIR}/32x32${ICONSUBDIR}
+	${INSTALL} -d -o ${BINOWN} -g ${CONFGRP} -m ${DIRMODE} \
+	    ${DESTDIR}${ICONDIR}/64x64${ICONSUBDIR}
+	${INSTALL} -d -o ${BINOWN} -g ${CONFGRP} -m ${DIRMODE} \
+	    ${DESTDIR}${ICONDIR}/128x128${ICONSUBDIR}
+	${INSTALL} -d -o ${BINOWN} -g ${CONFGRP} -m ${DIRMODE} \
+	    ${DESTDIR}${ICONDIR}/scalable${ICONSUBDIR}
+	${INSTALL} -c -o ${SHAREOWN} -g ${SHAREGRP} -m ${SHAREMODE} kwalletcli32.png \
+	    ${DESTDIR}${ICONDIR}/32x32${ICONSUBDIR}/kwalletcli.png
+	${INSTALL} -c -o ${SHAREOWN} -g ${SHAREGRP} -m ${SHAREMODE} kwalletcli64.png \
+	    ${DESTDIR}${ICONDIR}/64x64${ICONSUBDIR}/kwalletcli.png
+	${INSTALL} -c -o ${SHAREOWN} -g ${SHAREGRP} -m ${SHAREMODE} kwalletcli128.png \
+	    ${DESTDIR}${ICONDIR}/128x128${ICONSUBDIR}/kwalletcli.png
+	${INSTALL} -c -o ${SHAREOWN} -g ${SHAREGRP} -m ${SHAREMODE} kwalletcli.svg \
+	    ${DESTDIR}${ICONDIR}/scalable${ICONSUBDIR}/kwalletcli.svg
+
+.PHONY: iconinstall
+
 .include <bsd.prog.mk>
 
 # HTML manpage generation code (currently assumes the basenames
--- kwalletcli-3.04beta.orig/GNUmakefile
+++ kwalletcli-3.04beta/GNUmakefile
@@ -1,6 +1,6 @@
 # $MirOS: contrib/hosted/tg/code/kwalletcli/GNUmakefile,v 1.17 2025/12/14 01:58:50 tg Exp $
 #-
-# Copyright © 2009, 2011, 2016, 2020
+# Copyright © 2009, 2011, 2016, 2020, 2026
 #	mirabilos <m$(date +%Y)@mirbsd.de>
 #
 # Provided that these terms and disclaimer and all copyright notices
@@ -24,9 +24,14 @@
 SCRIPTS=	kwalletaskpass kwalletcli_getpin pinentry-kwallet
 BINDIR?=	/usr/bin
 MANDIR?=	/usr/share/man/man
+ICONDIR?=	/usr/share/icons/hicolor
+ICONSUBDIR?=	/apps
 
 BINMODE?=	755
+DIRMODE?=	2755
 MANMODE?=	444
+SHAREMODE?=	444
+INSTALL?=	install
 INSTALL_STRIP?=	-s
 
 PROG=		kwalletcli
@@ -73,18 +78,38 @@ CXXFLAGS?=	${CFLAGS}
 all: ${PROG}
 
 install:
-	install -c ${INSTALL_STRIP} -m ${BINMODE} \
+	${INSTALL} -d -m ${DIRMODE} ${DESTDIR}${BINDIR}
+	${INSTALL} -d -m ${DIRMODE} ${DESTDIR}${MANDIR}1
+	${INSTALL} -c ${INSTALL_STRIP} -m ${BINMODE} \
 	    ${PROG} ${DESTDIR}${BINDIR}/
-	install -c -m ${BINMODE} \
+	${INSTALL} -c -m ${BINMODE} \
 	    ${SCRIPTS} ${DESTDIR}${BINDIR}/
 	for f in ${PROG} ${SCRIPTS}; do \
-		install -c -m ${MANMODE} $$f.1 ${DESTDIR}${MANDIR}1/; \
+		${INSTALL} -c -m ${MANMODE} $$f.1 ${DESTDIR}${MANDIR}1/; \
 	done
 
+iconinstall:
+	${INSTALL} -d -m ${DIRMODE} ${DESTDIR}${ICONDIR}/32x32${ICONSUBDIR}
+	${INSTALL} -d -m ${DIRMODE} ${DESTDIR}${ICONDIR}/64x64${ICONSUBDIR}
+	${INSTALL} -d -m ${DIRMODE} ${DESTDIR}${ICONDIR}/128x128${ICONSUBDIR}
+	${INSTALL} -d -m ${DIRMODE} ${DESTDIR}${ICONDIR}/scalable${ICONSUBDIR}
+	${INSTALL} -c -m ${SHAREMODE} kwalletcli32.png \
+	    ${DESTDIR}${ICONDIR}/32x32${ICONSUBDIR}/kwalletcli.png
+	${INSTALL} -c -m ${SHAREMODE} kwalletcli64.png \
+	    ${DESTDIR}${ICONDIR}/64x64${ICONSUBDIR}/kwalletcli.png
+	${INSTALL} -c -m ${SHAREMODE} kwalletcli128.png \
+	    ${DESTDIR}${ICONDIR}/128x128${ICONSUBDIR}/kwalletcli.png
+	${INSTALL} -c -m ${SHAREMODE} kwalletcli.svg \
+	    ${DESTDIR}${ICONDIR}/scalable${ICONSUBDIR}/kwalletcli.svg
+
 uninstall:
 	for f in ${PROG} ${SCRIPTS}; do \
 		rm -f ${DESTDIR}${BINDIR}/$$f ${DESTDIR}${MANDIR}1/$$f.1; \
 	done
+	rm -f ${DESTDIR}${ICONDIR}/32x32${ICONSUBDIR}/kwalletcli.png \
+	    ${DESTDIR}${ICONDIR}/64x64${ICONSUBDIR}/kwalletcli.png \
+	    ${DESTDIR}${ICONDIR}/128x128${ICONSUBDIR}/kwalletcli.png \
+	    ${DESTDIR}${ICONDIR}/scalable${ICONSUBDIR}/kwalletcli.svg
 
 clean:
 	-rm -f ${OBJS} ${PROG}
@@ -97,3 +122,5 @@ ${PROG}: ${OBJS} ${DPADD}
 
 .cc.o:
 	${CXX} ${CPPFLAGS} ${CXXFLAGS} -c -o $@ $<
+
+.PHONY: iconinstall
--- kwalletcli-3.04beta.orig/LICENCE
+++ kwalletcli-3.04beta/LICENCE
@@ -7,7 +7,7 @@ under the following Terms and Conditions
 
 kwalletcli is covered by The MirOS Licence:
 
-Copyright © 2009, 2010, 2011, 2014, 2016, 2018, 2020, 2025
+Copyright © 2009, 2010, 2011, 2014, 2016, 2018, 2020, 2025, 2026
 	mirabilos <m$(date +%Y)@mirbsd.de>
 KDE 4 bindings Copyright © 2009
 	Thomas Fischer <fischer@unix-ag.uni-kl.de>
@@ -85,5 +85,8 @@ to kwalletcli, in one way or the other:
 • Helmut Grohne <helmut@subdivi.de>
 • Vasilis Tsiligiannis (via Launchpad)
 
+The interpretation guidelines of The MirOS Licence shall be applied
+for this work; kwalletcli is “AIn’t”, human-made.
+
  ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲ ̲
 $MirOS: contrib/hosted/tg/code/kwalletcli/LICENCE,v 1.15 2025/12/14 03:06:04 tg Exp $
--- kwalletcli-3.04beta.orig/charconv.c
+++ kwalletcli-3.04beta/charconv.c
@@ -27,7 +27,6 @@ const char __rcsid_charconv_c[] =
 
 /* From MirOS: contrib/hosted/tg/code/any2utf8/wide.c,v 1.1 2009/08/02 17:12:07 tg Exp */
 
-
 size_t
 utf_32to8(char *dst, unsigned int wc)
 {
--- kwalletcli-3.04beta.orig/kwalletaskpass
+++ kwalletcli-3.04beta/kwalletaskpass
@@ -70,7 +70,7 @@ set -U # regardless
 
 rv=1
 trywallet=0
-[[ -n $DISPLAY ]] && case $1 in
+[[ -n $DISPLAY$WAYLAND_DISPLAY ]] && case $1 in
 ('Enter PIN for CA'*)
 	;;
 ('Enter passphrase for '*|'Password for '*|'Enter PIN for'*@(authenticator|key)*)
@@ -85,7 +85,7 @@ if (( trywallet )); then
 	rv=$?
 fi
 
-# whitelist of known binary queries
+# list of known binary queries
 barg=
 [[ $1 = 'Allow shared connection to '* || \
    $1 = 'Add key '*' to agent?'* || \
--- kwalletcli-3.04beta.orig/kwalletaskpass.1
+++ kwalletcli-3.04beta/kwalletaskpass.1
@@ -1,6 +1,6 @@
 .\" $MirOS: contrib/hosted/tg/code/kwalletcli/kwalletaskpass.1,v 1.24 2025/12/14 08:04:53 tg Exp $
 .\"-
-.\" Copyright © 2009, 2010, 2011, 2016
+.\" Copyright © 2009, 2010, 2011, 2016, 2026
 .\"	mirabilos <m$(date +%Y)@mirbsd.de>
 .\"
 .\" Provided that these terms and disclaimer and all copyright notices
@@ -249,7 +249,7 @@ Negative answers will be stored in the K
 .Nm
 uses the KWallet folders
 .Ic kwalletaskpass
-and
+and, for a denylist,
 .Ic kwalletaskpass\-blacklist
 with matching entry names.
 .Pp
@@ -272,15 +272,23 @@ or \*(Gt1 if an error occurred.
 .Bl -tag -width PINENTRY
 .It Ev DISPLAY
 The X11 display to use for child processes.
-If this is unset or empty,
+If
+.Ev DISPLAY
+and
+.Ev WAYLAND_DISPLAY
+are unset or empty,
 .Nm kwalletcli
-will not be called.
+will not be run.
 .It Ev PINENTRY
 The
 .Nm pinentry
 program to use.
 The default is inherited from
 .Xr kwalletcli_getpin 1 .
+.It Ev WAYLAND_DISPLAY
+Must be nonempty if not ran under X11, see
+.Ev DISPLAY
+above.
 .El
 .Pp
 .Nm
--- kwalletcli-3.04beta.orig/kwalletcli.1
+++ kwalletcli-3.04beta/kwalletcli.1
@@ -1,6 +1,6 @@
 .\" $MirOS: contrib/hosted/tg/code/kwalletcli/kwalletcli.1,v 1.30 2025/12/14 08:22:08 tg Exp $
 .\"-
-.\" Copyright © 2009, 2010, 2011, 2016, 2018
+.\" Copyright © 2009, 2010, 2011, 2016, 2018, 2026
 .\"	mirabilos <m$(date +%Y)@mirbsd.de>
 .\"
 .\" Provided that these terms and disclaimer and all copyright notices
@@ -235,7 +235,8 @@
 The
 .Nm
 utility is a command line interface to KWallet.
-It will only work if KDE is running (DCOP) and reachable (via X11).
+It will only work if KDE is running (DCOP) and reachable
+.Pq via X11 or Wayland .
 .Nm
 can be used to get password entries from the default Wallet,
 or to write them there.
@@ -301,7 +302,9 @@ The Wallet could not be opened.
 May be a missing DCOP connection.
 Perhaps
 .Ev DISPLAY
-is not set.
+and
+.Ev WAYLAND_DISPLAY
+are both not set.
 .It 4
 The folder specified cannot be found (read access).
 .It 5
@@ -320,6 +323,10 @@ KWallet should not be used any more duri
 .Bl -tag -width DISPLAY
 .It Ev DISPLAY
 The X11 display to use for communicating with the KDE Wallet.
+.It Ev WAYLAND_DISPLAY
+Must be nonempty if not ran under X11, see
+.Ev DISPLAY
+above.
 .El
 .Sh EXAMPLES
 The following command...
@@ -358,15 +365,13 @@ Beware of trailing newlines, especially
 scripts!
 .Sh BUGS
 If
-.Ev DISPLAY
-is not set, not valid, or
 .Nm kdeinit
 or
 .Nm kdeinit4
-cannot start for other reasons,
+cannot start for any reason,
 .Nm
 may not recover gracefully.
-In KDE 4 versions, this may even result in a Segmentation fault.
+On KDE 4, it may even segfault.
 The author does not know of a way to catch this early; patches are welcome.
 .Pp
 .Pa https://bugs.launchpad.net/%75buntu/%2Bsource/kwalletcli
--- kwalletcli-3.04beta.orig/kwalletcli.h
+++ kwalletcli-3.04beta/kwalletcli.h
@@ -39,7 +39,8 @@ extern "C" {
 extern const char __rcsid_kwif[];
 
 /*
- * KDE Wallet I/O function; it MUST NOT fail if stderr is closed.
+ * KDE Wallet I/O function
+ *
  * It is called at most once per execution and may rely on that.
  */
 int kw_io(const char *, const char *, const char **, const char *);
@@ -71,6 +72,11 @@ size_t utf_32to8(char *, unsigned int)
 #define iswoctet(wc)	(((wc) & WOCTET_MASK) == WOCTET_VALUE)
 
 
+/* exported by main.c */
+
+int check_gui_present(void);
+char *xstrdup(const char *);
+
 #ifdef __cplusplus
 }
 #endif
--- kwalletcli-3.04beta.orig/kwalletcli_getpin
+++ kwalletcli-3.04beta/kwalletcli_getpin
@@ -142,7 +142,6 @@ function get_tty {
 	[[ -n $GPG_TTY ]] || die 5 Please set GPG_TTY yourself
 }
 
-
 asktext='Hast Du das Paßwort?'
 askprompt='Code:'
 askerror=''
@@ -210,7 +209,7 @@ if (( !got_pe )); then
 		thetext=$thetext$sep$(toutf8 "$askprompt")
 	fi
 
-	whence -p xmessage >/dev/null || unset DISPLAY
+	command -v xmessage >/dev/null 2>&1 || unset DISPLAY
 	if (( askbool )) && [[ -n $DISPLAY ]]; then
 		buttons=${btnyes:-OK},${btnno:-Cancel}
 		(( askbool == 2 )) && buttons=${btnyes:-OK}
--- kwalletcli-3.04beta.orig/kwalletcli_getpin.1
+++ kwalletcli-3.04beta/kwalletcli_getpin.1
@@ -379,6 +379,11 @@ initially for tarent GmbH, but is now de
 .Sh CAVEATS
 Some newer pinentry features, such as three-button operation
 or setting the window title, are not supported yet.
+.Pp
+GUI integration relies on
+.Nm xmessage ,
+and therefore, X11.
+Wayland outside of XWayland is not considered a suitable GUI.
 .Sh BUGS
 Some
 .Nm pinentry
--- kwalletcli-3.04beta.orig/kwif3.cc
+++ kwalletcli-3.04beta/kwif3.cc
@@ -28,9 +28,6 @@
 
 #include "kwalletcli.h"
 
-extern "C" char *getenv(const char *);
-extern "C" char *strdup(const char *);
-
 extern "C" const char __rcsid_kwif[] =
     "$MirOS: contrib/hosted/tg/code/kwalletcli/kwif3.cc,v 1.6 2025/12/14 01:58:51 tg Exp $";
 
@@ -40,13 +37,11 @@ kw_io(const char *fld, const char *ent,
 	int rv;
 	QString localwallet, qfld, qent, qpw;
 	KWallet::Wallet *wallet;
-	char *env_DISPLAY;
 
 	if (pwp == NULL)
 		return (KWE_ABORT);
 
-	/* very basic protection against kdeinit errors */
-	if (!(env_DISPLAY = getenv("DISPLAY")) || !*env_DISPLAY)
+	if (check_gui_present())
 		return (KWE_NOWALLET);
 
 	qfld = QString::fromUtf8(fld);
@@ -91,7 +86,7 @@ kw_io(const char *fld, const char *ent,
 			goto out;
 		}
 		rv = KWE_OK_GET;
-		*pwp = strdup((const char *)qpw.utf8());
+		*pwp = xstrdup((const char *)qpw.utf8());
 	} else {
 		if (wallet->writePassword(qent, qpw)) {
 			rv = KWE_ERR_SET;
--- kwalletcli-3.04beta.orig/kwif4.cc
+++ kwalletcli-3.04beta/kwif4.cc
@@ -30,9 +30,6 @@
 
 #include "kwalletcli.h"
 
-extern "C" char *getenv(const char *);
-extern "C" char *strdup(const char *);
-
 extern "C" const char __rcsid_kwif[] =
     "$MirOS: contrib/hosted/tg/code/kwalletcli/kwif4.cc,v 1.4 2025/12/14 01:58:51 tg Exp $";
 
@@ -42,13 +39,11 @@ kw_io(const char *fld, const char *ent,
 	int rv;
 	QString localwallet, qfld, qent, qpw;
 	KWallet::Wallet *wallet;
-	char *env_DISPLAY;
 
 	if (pwp == NULL)
 		return (KWE_ABORT);
 
-	/* very basic protection against kdeinit4 errors */
-	if (!(env_DISPLAY = getenv("DISPLAY")) || !*env_DISPLAY)
+	if (check_gui_present())
 		return (KWE_NOWALLET);
 
 	qfld = QString::fromUtf8(fld);
@@ -93,7 +88,7 @@ kw_io(const char *fld, const char *ent,
 			goto out;
 		}
 		rv = KWE_OK_GET;
-		*pwp = strdup((const char *)qpw.toUtf8().data());
+		*pwp = xstrdup((const char *)qpw.toUtf8().data());
 	} else {
 		if (wallet->writePassword(qent, qpw)) {
 			rv = KWE_ERR_SET;
--- kwalletcli-3.04beta.orig/kwif5.cc
+++ kwalletcli-3.04beta/kwif5.cc
@@ -33,9 +33,6 @@
 
 #include "kwalletcli.h"
 
-extern "C" char *getenv(const char *);
-extern "C" char *strdup(const char *);
-
 extern "C" const char __rcsid_kwif[] =
     "$MirOS: contrib/hosted/tg/code/kwalletcli/kwif5.cc,v 1.5 2025/12/14 01:58:51 tg Exp $";
 
@@ -45,13 +42,11 @@ kw_io(const char *fld, const char *ent,
 	int rv;
 	QString localwallet, qfld, qent, qpw;
 	KWallet::Wallet *wallet;
-	char *env_DISPLAY;
 
 	if (pwp == NULL)
 		return (KWE_ABORT);
 
-	/* very basic protection against kdeinit5 errors */
-	if (!(env_DISPLAY = getenv("DISPLAY")) || !*env_DISPLAY)
+	if (check_gui_present())
 		return (KWE_NOWALLET);
 
 	qfld = QString::fromUtf8(fld);
@@ -102,7 +97,7 @@ kw_io(const char *fld, const char *ent,
 			goto out;
 		}
 		rv = KWE_OK_GET;
-		*pwp = strdup((const char *)qpw.toUtf8().data());
+		*pwp = xstrdup((const char *)qpw.toUtf8().data());
 	} else {
 		if (wallet->writePassword(qent, qpw)) {
 			rv = KWE_ERR_SET;
--- kwalletcli-3.04beta.orig/main.c
+++ kwalletcli-3.04beta/main.c
@@ -1,5 +1,5 @@
 /*-
- * Copyright © 2009, 2011, 2025
+ * Copyright © 2009, 2011, 2025, 2026
  *	mirabilos <m$(date +%Y)@mirbsd.de>
  *
  * Provided that these terms and disclaimer and all copyright notices
@@ -18,7 +18,10 @@
  * of said person’s immediate fault when using the work as intended.
  */
 
+#include <sys/types.h>
+#include <sys/stat.h>
 #include <errno.h>
+#include <fcntl.h>
 #include <stdlib.h>
 #include <stdio.h>
 #include <string.h>
@@ -29,7 +32,6 @@
 const char __rcsid_main_c[] =
     "$MirOS: contrib/hosted/tg/code/kwalletcli/main.c,v 1.14 2025/12/14 02:20:57 tg Exp $";
 
-
 int
 main(int argc, char *argv[])
 {
@@ -123,8 +125,14 @@ main(int argc, char *argv[])
 		kw_pass = cp;
 	}
 
-	if (quiet)
-		fclose(stderr);
+	if (quiet) {
+		int fd;
+
+		if ((fd = open("/dev/null", O_WRONLY)) != -1 && fd != 2) {
+			dup2(fd, 2);
+			close(fd);
+		}
+	}
 	rv = kw_io(kw_folder, kw_entry, &kw_pass, vers ? vers : "");
 	switch (rv) {
 	case KWE_OK_GET: {
@@ -201,3 +209,26 @@ main(int argc, char *argv[])
 	}
 	return (rv);
 }
+
+int
+check_gui_present(void)
+{
+	char *v;
+
+	/* very basic protection against kdeinit errors */
+	if ((v = getenv("DISPLAY")) && *v)
+		return (0);
+	if ((v = getenv("WAYLAND_DISPLAY")) && *v)
+		return (0);
+	return (1);
+}
+
+char *
+xstrdup(const char *src)
+{
+	char *rv;
+
+	if (!(rv = strdup(src)))
+		abort();
+	return (rv);
+}
--- kwalletcli-3.04beta.orig/pinentry-kwallet
+++ kwalletcli-3.04beta/pinentry-kwallet
@@ -1,7 +1,7 @@
 #!/usr/bin/env mksh
 rcsid='$MirOS: contrib/hosted/tg/code/kwalletcli/pinentry-kwallet,v 1.21 2025/12/14 08:06:03 tg Exp $'
 licence='
-# Copyright © 2009, 2010, 2011, 2025
+# Copyright © 2009, 2010, 2011, 2025, 2026
 #	mirabilos <m$(date +%Y)@mirbsd.de>
 #
 # Provided that these terms and disclaimer and all copyright notices
@@ -19,17 +19,25 @@ licence='
 # damage or existence of a defect, except proven that it results out
 # of said person’s immediate fault when using the work as intended.'
 
+# The following line can be changed to 'iodebug=1' (instead of 0) to
+# create a debug logfile, whose name is changable in the line after.
+# As it will contain passwords and secrets in plaintext do this only
+# for debugging and change back once no longer needed.
+iodebug=0
+iodp=~/pinentry-kwallet.debug
+
 set -U
 
 # or e.g. en_US.UTF-8 or en_US.utf8 or the likes, depends on your OS
 # choose one that is always available and uses UTF-8/CESU-8 encoding
 substlocale=C.UTF-8	# sync with manpage ENVIRONMENT section
 
-iodebug=0
-iodp=~/pinentry-kwallet.debug
 if (( iodebug )); then
 	print "\n$$ === new $(date)" >>"$iodp"
 	chmod 0600 "$iodp"
+	# make sure users are informed
+	print -ru2 "W: pinentry-kwallet: iodebug to '$iodp' active!"
+	sleep 1
 fi
 function io_p_in {
 	local io_line
@@ -226,8 +234,8 @@ if [[ -n $PINENTRY_KWALLET_OVERRIDE ]];
 	PINENTRY=$PINENTRY_KWALLET_OVERRIDE
 fi
 
-if [[ -z $DISPLAY ]]; then
-	log "since DISPLAY is not set, replacing with: ${PINENTRY:-pinentry}"
+if [[ -z $DISPLAY$WAYLAND_DISPLAY ]]; then
+	log "since DISPLAY and WAYLAND_DISPLAY are not set, replacing with: ${PINENTRY:-pinentry}"
 	PINENTRY_KWALLET=set exec "${PINENTRY:-pinentry}" "${args[@]}"
 fi
 
@@ -235,17 +243,41 @@ x_dsctxt=
 x_prompt=
 x_errtxt=
 
+kwalletcli_unusable=false
+function docli {
+	local docli_vn=$1 docli_v docli_rv
+	shift
+
+	docli_v=$(kwalletcli "$@")
+	docli_rv=$?
+	if (( docli_rv == 3 )); then
+		print -ru2 'W: kwalletcli unusable'
+		kwalletcli_unusable=true
+	fi
+	[[ $docli_vn = - ]] || eval "$docli_vn=\$docli_v"
+	return $docli_rv
+}
+
 function getit {
 	local type=$1 key=〈${x_prompt}〉$x_dsctxt pw rv tw=0 d errcnt blst=0
 
+	if $kwalletcli_unusable; then
+		require_coprocess
+		return
+	fi
+	# note detection currently relies on KWE_NOWALLET being returned;
+	# if this is insufficient to break the cycle for gpg-using wallets
+	# a timeout needs to be installed for the first docli call, maybe
+	# three seconds, when triggered it must set kwalletcli_unusable…
+
 	copyline=0
 	# the errcnt handling is a little tricky, because GnuPG v2 does
 	# not reuse the pinentry session (suckers, unable to... *rant*)
-	if pw=$(kwalletcli -q -f pinentry-kwallet -e "$type-B-$key") && \
+	if docli pw -q -f pinentry-kwallet -e "$type-B-$key" && \
 	    [[ $pw = yes* ]]; then
-		log "blacklisted"
+		log "denylisted"
 		blst=1
-	elif pw=$(kwalletcli -q -f pinentry-kwallet -e "$type-e-$key"); then
+	elif docli pw -q -f pinentry-kwallet -e "$type-e-$key"; then
 		log "read errcnt: '$pw'"
 		set -A errcnt -- $pw
 		d=$(date -u +'%s')
@@ -256,12 +288,12 @@ function getit {
 	(( blst )) || [[ -z $x_errtxt ]] || (( errcnt[1]++ ))
 	(( blst )) || if (( errcnt[1] )); then
 		errcnt[0]=${d:-$(date -u +'%s')}
-		kwalletcli -q -f pinentry-kwallet -e "$type-e-$key" \
+		docli - -q -f pinentry-kwallet -e "$type-e-$key" \
 		    -p "${errcnt[*]}"
 		log "write errcnt: '${errcnt[*]}' -> $?"
 	fi
 	(( blst )) || if (( errcnt[1] < 2 )); then
-		pw=$(kwalletcli -q -f pinentry-kwallet -e "$type-v-$key")
+		docli pw kwalletcli -q -f pinentry-kwallet -e "$type-v-$key"
 		rv=$?
 		log "read pass $rv: '$pw'"
 		case $type:$rv {
@@ -283,10 +315,7 @@ function getit {
 			;;
 		}
 	fi
-	if (( !have_sub )); then
-		io_p_out 'ERR 85 no coprocess'
-		return
-	fi
+	require_coprocess || return
 	if [[ $type = bool ]]; then
 		io_s_out CONFIRM
 		io_s_in resp
@@ -314,16 +343,20 @@ function getit {
 		fi
 		[[ $resp = OK@(| *) ]] && tw=1
 	fi
-	(( tw && !blst )) && if kwalletcli_getpin -q -b \
-	    -t "Do you want to store your response for description
+	if (( tw && !blst )); then
+		kwalletcli_getpin -q -b \
+		    -t "Do you want to store your response for description
 '$x_dsctxt',
-prompt '$x_prompt' in the KDE Wallet?"; then
-		kwalletcli -q -f pinentry-kwallet -e "$type-v-$key" -p "$pw"
-		log "want store: yes, pw '$pw' -> $?"
-	else
-		# create blacklist entry for this answer
-		kwalletcli -q -f pinentry-kwallet -e "$type-B-$key" -p yes
-		log "want store: no"
+prompt '$x_prompt' in the KDE Wallet?"
+		rv=$?
+		if (( rv == 0 )); then
+			docli - -q -f pinentry-kwallet -e "$type-v-$key" -p "$pw"
+			log "want store: yes, pw '$pw' -> $?"
+		elif (( rv == 1 )); then
+			# create denylist entry for this answer
+			docli - -q -f pinentry-kwallet -e "$type-B-$key" -p yes
+			log "want store: no"
+		fi
 	fi
 	[[ $type = pass ]] && [[ -n $pw ]] && io_p_out -r "D $pw"
 	io_p_out -r -- "$resp"
@@ -376,7 +409,7 @@ ensure_coprocess() {
 	set -U # regardless
 	# pass on to subprocess
 	queued_lines[${#queued_lines[*]}]="OPTION lc-ctype=$LC_CTYPE"
-	if have_lc_type; then
+	if $have_lc_type; then
 		args[${#args[*]}]=--lc-ctype
 		args[${#args[*]}]=$LC_CTYPE
 	fi
@@ -390,6 +423,24 @@ ensure_coprocess() {
 		have_sub=1
 		log have_sub=1
 		trap "kill $copid; exit 255" HUP INT QUIT TRAP PIPE TERM
+
+		local lno=-1 resp
+		while (( ++lno < ${#queued_lines[*]} )); do
+			io_s_out -r -- "${queued_lines[lno]}"
+			resp=
+			while [[ $resp != @(OK|ERR)@(| *) ]]; do
+				io_s_in resp
+			done
+			if [[ $resp = ERR* ]]; then
+				log "queued failed: $resp"
+				have_sub=0
+				trap '' PIPE
+				io_s_out BYE 2>/dev/null
+				io_s_in resp
+				break
+			fi
+		done
+		unset queued_lines
 	else
 		have_sub=0
 		log "have_sub=0${resp:+; error response from coprocess: $resp}"
@@ -397,6 +448,15 @@ ensure_coprocess() {
 	fi
 }
 
+require_coprocess() {
+	if (( !have_sub )); then
+		copyline=0
+		io_p_out 'ERR 85 no coprocess'
+		return 1
+	fi
+	return 0
+}
+
 io_p_out 'OK ready to listen to your demands'
 
 while io_p_in line; do
@@ -425,7 +485,7 @@ while io_p_in line; do
 	(SETERROR\ *)
 		x_errtxt=${line#SETERROR }
 		;;
-	(SETQUALITYBAR*)
+	(SETKEYINFO*|SETQUALITYBAR*|SETREPEAT*)
 		;;
 	(GETPIN)
 		ensure_coprocess
@@ -437,6 +497,7 @@ while io_p_in line; do
 		;;
 	(MESSAGE|CONFIRM\ --one-button)
 		ensure_coprocess
+		require_coprocess
 		;;
 	(OPTION\ ?(--)ttyname[\ =]*)
 		optval=${line#OPTION*ttyname}
@@ -476,8 +537,9 @@ while io_p_in line; do
 	(OPTION\ *)
 		;;
 	(CONFIRM\ *)
-		ensure_coprocess
 		(( quiet )) || print -ru2 "W: unknown CONFIRM option: $line"
+		ensure_coprocess
+		require_coprocess
 		;;
 	(BYE@(| *))
 		trap '' PIPE
@@ -493,26 +555,41 @@ while io_p_in line; do
 		# copy quietly, in case of keepalive
 		(( have_sub )) || copyline=0
 		;;
+	(GETINFO\ flavor)
+		# undocumented, but used by latest
+		io_p_out D kwallet
+		io_p_out OK
+		copyline=0
+		;;
 	(GETINFO\ pid)
 		# undocumented, but used by GnuPG v2
 		io_p_out D $$
 		io_p_out OK
 		copyline=0
 		;;
-	(GETINFO\ version)
+	(GETINFO\ ttyinfo)
+		# undocumented, but used by latest
 		ensure_coprocess
+		require_coprocess
+		#XXX maybe return "ERR 536871187 unknown command"?
+		;;
+	(GETINFO\ version)
 		# undocumented, but used by GnuPG v2
 		# just copy it quietly
+		ensure_coprocess
+		require_coprocess
 		#XXX maybe return "ERR 536871187 unknown command"?
 		;;
 	(GETINFO\ *)
-		ensure_coprocess
 		# undocumented, but used by GnuPG v2
 		(( quiet )) || print -ru2 "W: unknown GETINFO capability: $line"
+		ensure_coprocess
+		require_coprocess
 		;;
 	(*)
-		ensure_coprocess
 		(( quiet )) || print -ru2 "W: unknown line: $line"
+		ensure_coprocess
+		require_coprocess
 		;;
 	}
 	(( copyline )) && if (( !tried_sub )); then
--- kwalletcli-3.04beta.orig/pinentry-kwallet.1
+++ kwalletcli-3.04beta/pinentry-kwallet.1
@@ -1,6 +1,6 @@
 .\" $MirOS: contrib/hosted/tg/code/kwalletcli/pinentry-kwallet.1,v 1.24 2025/12/14 07:49:52 tg Exp $
 .\"-
-.\" Copyright © 2009, 2010, 2011, 2016, 2025
+.\" Copyright © 2009, 2010, 2011, 2016, 2025, 2026
 .\"	mirabilos <m$(date +%Y)@mirbsd.de>
 .\"
 .\" Provided that these terms and disclaimer and all copyright notices
@@ -285,11 +285,15 @@ It will exit 0 after the Assuan session
 .Bl -tag -width PINENTRY
 .It Ev DISPLAY
 The X11 display to use for child processes.
-If not set,
+If
+.Ev DISPLAY
+and
+.Ev WAYLAND_DISPLAY
+are both unset or empty,
 .Nm
-will immediately replace itself with the slave
+will immediately replace itself with the backend
 .Ev PINENTRY
-program to use.
+program.
 .It Ev GPG_TERM
 Terminal type of the current tty.
 .It Ev GPG_TTY
@@ -306,6 +310,10 @@ If not empty, this overrides the value o
 This can be used as a last-resort aid to make things work in the face of
 .Dq trying to call me recursively
 errors.
+.It Ev WAYLAND_DISPLAY
+Must be nonempty if not ran under X11, see
+.Ev DISPLAY
+above.
 .El
 .Pp
 .Nm
@@ -336,3 +344,20 @@ are not supported yet.
 Some commands, such as version inquiry, as passed through to
 the pinentry coprocess indiscriminately, which may lead to
 strange results, should the protocol change or extend.
+.Pp
+.Nm
+cannot be used as
+.Ic pinentry\-program
+for
+.Nm gpg\-agent
+with a KDE Wallet that uses GnuPG/PGP,
+as attempts to unlock the wallet will go into a loop
+with attempts by GnuPG to use the wallet to unlock
+the PGP key.
+Any other uses of
+.Nm
+with such a wallet are fine,
+as are all uses with a wallet that is already unlocked
+and all uses with a wallet that uses Blowfish, or any
+unlocking method in general that does not call
+.Nm .
