kimaki 0.22.0 → 0.23.0

package/dist/anthropic-auth-plugin.js

@@ -24,7 +24,7 @@
  */
 import { appendToastSessionMarker } from "./plugin-logger.js";
 import { createPluginClient } from "./plugin-opencode-client.js";
-import { loadAccountStore, rememberAnthropicOAuth, rotateAnthropicAccount, saveAccountStore, setAnthropicAuth, shouldRotateAuth, upsertAccount, withAuthStateLock, } from "./anthropic-auth-state.js";
+import { isPermanentOAuthRefreshFailure, loadAccountStore, rememberAnthropicOAuth, removeAccountByAuth, rotateAnthropicAccount, saveAccountStore, setAnthropicAuth, shouldRotateAuth, upsertAccount, withAuthStateLock, } from "./anthropic-auth-state.js";
 import { extractAnthropicAccountIdentity, } from "./anthropic-account-identity.js";
 // PKCE (Proof Key for Code Exchange) using Web Crypto API.
 // Reference: https://github.com/badlogic/pi-mono/blob/main/packages/ai/src/utils/oauth/pkce.ts
@@ -723,45 +723,86 @@ function mergeBetas(existing, required) {
 function isOAuthStored(auth) {
     return auth.type === "oauth";
 }
-async function getFreshOAuth(getAuth, client) {
+/**
+ * Refresh Anthropic OAuth. On permanent refresh failure (invalid_grant),
+ * remove that account from the pool and retry with the next one.
+ * removeAccountByAuth runs outside withAuthStateLock to avoid nested locks.
+ */
+async function getFreshOAuth(getAuth, client, options) {
     const auth = await getAuth();
     if (!isOAuthStored(auth))
         return undefined;
     if (auth.access && auth.expires > Date.now())
         return auth;
     const pending = pendingRefresh.get(auth.refresh);
-    if (pending) {
+    if (pending)
         return pending;
-    }
-    const refreshPromise = withAuthStateLock(async () => {
-        const latest = await getAuth();
-        if (!isOAuthStored(latest)) {
-            throw new Error("Anthropic OAuth credentials disappeared during refresh");
-        }
-        if (latest.access && latest.expires > Date.now())
-            return latest;
-        const refreshed = await refreshAnthropicToken(latest.refresh);
-        await setAnthropicAuth(refreshed, client);
-        const store = await loadAccountStore();
-        if (store.accounts.length > 0) {
-            const identity = (() => {
-                const currentIndex = store.accounts.findIndex((account) => {
-                    return (account.refresh === latest.refresh ||
-                        account.access === latest.access);
+    const refreshPromise = (async () => {
+        const attempted = new Set();
+        while (true) {
+            let failedAuth;
+            try {
+                return await withAuthStateLock(async () => {
+                    const latest = await getAuth();
+                    if (!isOAuthStored(latest)) {
+                        throw new Error("Anthropic OAuth credentials disappeared during refresh");
+                    }
+                    if (latest.access && latest.expires > Date.now())
+                        return latest;
+                    if (attempted.has(latest.refresh)) {
+                        throw new Error("Anthropic OAuth refresh failed for all remaining accounts");
+                    }
+                    attempted.add(latest.refresh);
+                    try {
+                        const refreshed = await refreshAnthropicToken(latest.refresh);
+                        await setAnthropicAuth(refreshed, client);
+                        const store = await loadAccountStore();
+                        if (store.accounts.length > 0) {
+                            const current = store.accounts.find((account) => account.refresh === latest.refresh ||
+                                account.access === latest.access);
+                            const identity = current
+                                ? {
+                                    ...(current.email ? { email: current.email } : {}),
+                                    ...(current.accountId
+                                        ? { accountId: current.accountId }
+                                        : {}),
+                                }
+                                : undefined;
+                            upsertAccount(store, { ...refreshed, ...identity });
+                            await saveAccountStore(store);
+                        }
+                        return refreshed;
+                    }
+                    catch (error) {
+                        if (!isPermanentOAuthRefreshFailure(error))
+                            throw error;
+                        failedAuth = latest;
+                        throw error;
+                    }
                 });
-                const current = currentIndex >= 0 ? store.accounts[currentIndex] : undefined;
-                if (!current)
-                    return undefined;
-                return {
-                    ...(current.email ? { email: current.email } : {}),
-                    ...(current.accountId ? { accountId: current.accountId } : {}),
-                };
-            })();
-            upsertAccount(store, { ...refreshed, ...identity });
-            await saveAccountStore(store);
+            }
+            catch (error) {
+                if (!failedAuth || !isPermanentOAuthRefreshFailure(error))
+                    throw error;
+                const removed = await removeAccountByAuth(failedAuth, client);
+                if (!removed)
+                    throw error;
+                client.tui
+                    .showToast({
+                    message: appendToastSessionMarker({
+                        message: removed.active
+                            ? `Removed expired Anthropic account ${removed.removedLabel}, switched to ${removed.activeLabel ?? "next"}`
+                            : `Removed expired Anthropic account ${removed.removedLabel} (no accounts left — re-login required)`,
+                        sessionId: options?.sessionId,
+                    }),
+                    variant: removed.active ? "info" : "error",
+                })
+                    .catch(() => { });
+                if (!removed.active)
+                    throw error;
+            }
         }
-        return refreshed;
-    });
+    })();
     pendingRefresh.set(auth.refresh, refreshPromise);
     return refreshPromise.finally(() => {
         pendingRefresh.delete(auth.refresh);
@@ -846,7 +887,9 @@ const AnthropicAuthPlugin = async ({ serverUrl, directory }) => {
                                 headers: requestHeaders,
                             });
                         };
-                        const freshAuth = await getFreshOAuth(getAuth, client);
+                        const freshAuth = await getFreshOAuth(getAuth, client, {
+                            sessionId,
+                        });
                         if (!freshAuth)
                             return fetch(input, init);
                         let response = await runRequest(freshAuth);
@@ -868,7 +911,9 @@ const AnthropicAuthPlugin = async ({ serverUrl, directory }) => {
                                         variant: "info",
                                     })
                                         .catch(() => { });
-                                    const retryAuth = await getFreshOAuth(getAuth, client);
+                                    const retryAuth = await getFreshOAuth(getAuth, client, {
+                                        sessionId,
+                                    });
                                     if (retryAuth) {
                                         response = await runRequest(retryAuth);
                                     }

package/dist/anthropic-auth-state.js

@@ -7,8 +7,8 @@
 import { homedir } from 'node:os';
 import path from 'node:path';
 import { normalizeAnthropicAccountIdentity, } from './anthropic-account-identity.js';
-import { accountLabel, authFilePath, findCurrentAccountIndex, isOAuthStored, normalizeAccountStore, readJson, upsertAccount as sharedUpsertAccount, withAuthStateLock, writeJson, shouldRotateAuth, } from './oauth-rotation-shared.js';
-export { accountLabel, authFilePath, withAuthStateLock, shouldRotateAuth };
+import { accountLabel, authFilePath, findCurrentAccountIndex, isOAuthStored, isPermanentOAuthRefreshFailure, normalizeAccountStore, readJson, upsertAccount as sharedUpsertAccount, withAuthStateLock, writeJson, shouldRotateAuth, } from './oauth-rotation-shared.js';
+export { accountLabel, authFilePath, withAuthStateLock, shouldRotateAuth, isPermanentOAuthRefreshFailure, };
 // --- Store file path ---
 export function accountsFilePath() {
     if (process.env.XDG_DATA_HOME) {
@@ -114,37 +114,72 @@ export async function rotateAnthropicAccount(auth, client) {
     });
 }
 // --- Remove account ---
+/** Splice account at index and promote next. Caller must hold withAuthStateLock. */
+async function spliceAccountAndPromote({ store, index, client, }) {
+    store.accounts.splice(index, 1);
+    if (store.accounts.length === 0) {
+        store.activeIndex = 0;
+        await saveAccountStore(store);
+        await writeAnthropicAuthFile(undefined);
+        return { store, active: undefined, activeLabel: undefined };
+    }
+    if (store.activeIndex > index) {
+        store.activeIndex -= 1;
+    }
+    else if (store.activeIndex >= store.accounts.length) {
+        store.activeIndex = 0;
+    }
+    const active = store.accounts[store.activeIndex];
+    if (!active)
+        throw new Error('Active Anthropic account disappeared during removal');
+    active.lastUsed = Date.now();
+    await saveAccountStore(store);
+    const nextAuth = {
+        type: 'oauth',
+        refresh: active.refresh,
+        access: active.access,
+        expires: active.expires,
+    };
+    if (client) {
+        await setAnthropicAuth(nextAuth, client);
+    }
+    else {
+        await writeAnthropicAuthFile(nextAuth);
+    }
+    return {
+        store,
+        active: nextAuth,
+        activeLabel: accountLabel(active, store.activeIndex),
+    };
+}
 export async function removeAccount(index) {
     return withAuthStateLock(async () => {
         const store = await loadAccountStore();
         if (!Number.isInteger(index) || index < 0 || index >= store.accounts.length) {
             throw new Error(`Account ${index + 1} does not exist`);
         }
-        store.accounts.splice(index, 1);
-        if (store.accounts.length === 0) {
-            store.activeIndex = 0;
-            await saveAccountStore(store);
-            await writeAnthropicAuthFile(undefined);
-            return { store, active: undefined };
-        }
-        if (store.activeIndex > index) {
-            store.activeIndex -= 1;
-        }
-        else if (store.activeIndex >= store.accounts.length) {
-            store.activeIndex = 0;
-        }
-        const active = store.accounts[store.activeIndex];
-        if (!active)
-            throw new Error('Active Anthropic account disappeared during removal');
-        active.lastUsed = Date.now();
-        await saveAccountStore(store);
-        const nextAuth = {
-            type: 'oauth',
-            refresh: active.refresh,
-            access: active.access,
-            expires: active.expires,
+        return spliceAccountAndPromote({ store, index });
+    });
+}
+/**
+ * Remove the pool entry matching these OAuth credentials and promote the next
+ * account. Used when refresh fails permanently (invalid_grant).
+ */
+export async function removeAccountByAuth(auth, client) {
+    return withAuthStateLock(async () => {
+        const store = await loadAccountStore();
+        const index = store.accounts.findIndex((account) => account.refresh === auth.refresh || account.access === auth.access);
+        if (index < 0)
+            return undefined;
+        const removed = store.accounts[index];
+        if (!removed)
+            return undefined;
+        const removedLabel = accountLabel(removed, index);
+        const result = await spliceAccountAndPromote({ store, index, client });
+        return {
+            removedLabel,
+            activeLabel: result.activeLabel,
+            active: result.active,
         };
-        await writeAnthropicAuthFile(nextAuth);
-        return { store, active: nextAuth };
     });
 }

package/dist/anthropic-auth-state.test.js

@@ -1,9 +1,10 @@
-// Tests Anthropic OAuth account persistence, deduplication, and rotation.
+// Tests Anthropic OAuth account persistence, deduplication, rotation, and
+// permanent refresh-failure removal.
 import { mkdtemp, readFile, rm, mkdir, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
 import { afterEach, beforeEach, describe, expect, test } from 'vitest';
-import { accountLabel, authFilePath, loadAccountStore, rememberAnthropicOAuth, removeAccount, rotateAnthropicAccount, saveAccountStore, shouldRotateAuth, } from './anthropic-auth-state.js';
+import { accountLabel, authFilePath, isPermanentOAuthRefreshFailure, loadAccountStore, rememberAnthropicOAuth, removeAccount, removeAccountByAuth, rotateAnthropicAccount, saveAccountStore, shouldRotateAuth, } from './anthropic-auth-state.js';
 const firstAccount = {
     type: 'oauth',
     refresh: 'refresh-first',
@@ -141,6 +142,51 @@ describe('removeAccount', () => {
         expect(authJson.anthropic).toBeUndefined();
     });
 });
+describe('removeAccountByAuth', () => {
+    test('removes matched account, promotes next, and syncs auth.set', async () => {
+        await saveAccountStore({
+            version: 1,
+            activeIndex: 0,
+            accounts: [
+                { ...firstAccount, email: 'dead@example.com', addedAt: 1, lastUsed: 1 },
+                { ...secondAccount, email: 'live@example.com', addedAt: 2, lastUsed: 2 },
+            ],
+        });
+        const authSetCalls = [];
+        const client = {
+            auth: {
+                set: async (input) => {
+                    authSetCalls.push(input);
+                },
+            },
+        };
+        const removed = await removeAccountByAuth(firstAccount, client);
+        const store = await loadAccountStore();
+        expect(removed).toMatchObject({
+            removedLabel: '#1 (dead@example.com)',
+            activeLabel: '#1 (live@example.com)',
+            active: { refresh: 'refresh-second' },
+        });
+        expect(store.accounts).toHaveLength(1);
+        expect(store.accounts[0]?.refresh).toBe('refresh-second');
+        expect(authSetCalls).toHaveLength(1);
+    });
+    test('returns undefined when auth is not in the pool', async () => {
+        await saveAccountStore({
+            version: 1,
+            activeIndex: 0,
+            accounts: [{ ...firstAccount, addedAt: 1, lastUsed: 1 }],
+        });
+        const removed = await removeAccountByAuth({
+            type: 'oauth',
+            refresh: 'unknown-refresh',
+            access: 'unknown-access',
+            expires: 1,
+        }, { auth: { set: async () => { } } });
+        expect(removed).toBeUndefined();
+        expect((await loadAccountStore()).accounts).toHaveLength(1);
+    });
+});
 describe('shouldRotateAuth', () => {
     test('only rotates on rate limit or auth failures', () => {
         expect(shouldRotateAuth(429, '')).toBe(true);
@@ -148,3 +194,10 @@ describe('shouldRotateAuth', () => {
         expect(shouldRotateAuth(400, 'bad request')).toBe(false);
     });
 });
+describe('isPermanentOAuthRefreshFailure', () => {
+    test('detects invalid_grant and expired refresh tokens', () => {
+        expect(isPermanentOAuthRefreshFailure(new Error('HTTP 400 from https://platform.claude.com/v1/oauth/token: {"error": "invalid_grant", "error_description": "Refresh token expired"}'))).toBe(true);
+        expect(isPermanentOAuthRefreshFailure(new Error('ECONNRESET'))).toBe(false);
+        expect(isPermanentOAuthRefreshFailure(new Error('rate_limit_error'))).toBe(false);
+    });
+});

package/dist/channel-management.js

@@ -113,6 +113,10 @@ __pycache__/
 .venv/
 *.egg-info/
 `;
+/** Returns the absolute path to the default kimaki project directory. */
+export function getDefaultKimakiDirectory() {
+    return path.join(getProjectsDir(), 'kimaki');
+}
 const DEFAULT_CHANNEL_TOPIC = 'General channel for misc tasks with Kimaki. Not connected to a specific OpenCode project or repository.';
 /**
  * Create (or find) the default "kimaki" channel for general-purpose tasks.
@@ -124,7 +128,7 @@ const DEFAULT_CHANNEL_TOPIC = 'General channel for misc tasks with Kimaki. Not c
  * as a fallback for channels created before DB mapping existed.
  */
 export async function createDefaultKimakiChannel({ guild, botName, appId, isGatewayMode, }) {
-    const projectDirectory = path.join(getProjectsDir(), 'kimaki');
+    const projectDirectory = getDefaultKimakiDirectory();
     // Ensure the default kimaki project directory exists before any DB mapping
     // restoration or git setup. Custom data dirs may not have <dataDir>/projects
     // created yet, and later writes assume the full path is present.
@@ -146,11 +150,29 @@ export async function createDefaultKimakiChannel({ guild, botName, appId, isGate
         directory: projectDirectory,
         channelType: 'text',
     });
-    const mappedChannelInGuild = existingMappings
-        .map((row) => guild.channels.cache.get(row.channel_id))
-        .find((ch) => ch?.type === ChannelType.GuildText);
-    if (mappedChannelInGuild) {
-        logger.log(`Default kimaki channel already exists: ${mappedChannelInGuild.id}`);
+    const mappedRow = existingMappings.find((row) => {
+        const ch = guild.channels.cache.get(row.channel_id);
+        return ch?.type === ChannelType.GuildText;
+    });
+    if (mappedRow) {
+        // Backfill guild_id for rows created before this column existed,
+        // so the tombstone check works if the channel is deleted later.
+        if (mappedRow.guild_id !== guild.id) {
+            await setChannelDirectory({
+                channelId: mappedRow.channel_id,
+                directory: projectDirectory,
+                channelType: 'text',
+                guildId: guild.id,
+            });
+        }
+        logger.log(`Default kimaki channel already exists: ${mappedRow.channel_id}`);
+        return null;
+    }
+    // 1b. If a mapping exists for this guild but the channel is gone from Discord,
+    // it was previously created and then deleted. Don't recreate it.
+    const staleForThisGuild = existingMappings.find((row) => row.guild_id === guild.id);
+    if (staleForThisGuild) {
+        logger.log(`Default kimaki channel was previously provisioned for guild ${guild.name} (${guild.id}) as ${staleForThisGuild.channel_id}, but no longer exists. Skipping recreation.`);
         return null;
     }
     // 2. Fallback: detect existing channel by name+category.
@@ -213,6 +235,7 @@ export async function createDefaultKimakiChannel({ guild, botName, appId, isGate
         channelId: textChannel.id,
         directory: projectDirectory,
         channelType: 'text',
+        guildId: guild.id,
     });
     logger.log(`Created default kimaki channel: #${channelName} (${textChannel.id})`);
     return {

package/dist/cli-commands/project.js

@@ -11,6 +11,7 @@ import { fileURLToPath } from 'node:url';
 import { spawn, execSync } from 'node:child_process';
 import { createLogger, LogPrefix, initLogFile } from '../logger.js';
 import { createDiscordClient, initDatabase, getChannelDirectory, initializeOpencodeForDirectory, createProjectChannels } from '../discord-bot.js';
+import { getDefaultKimakiDirectory } from '../channel-management.js';
 import { getBotTokenWithMode, getThreadSession, getThreadIdBySessionId, getSessionEventSnapshot, getDb, createScheduledTask, listScheduledTasks, cancelScheduledTask, getScheduledTask, updateScheduledTask, getSessionStartSourcesBySessionIds, deleteChannelDirectoryById, findChannelsByDirectory } from '../database.js';
 import { ShareMarkdown } from '../markdown.js';
 import { parseSessionSearchPattern, findFirstSessionSearchHit, buildSessionSearchSnippet, getPartSearchTexts } from '../session-search.js';
@@ -184,6 +185,7 @@ cli
                             channel_id: ch.id,
                             directory: '',
                             channel_type: 'text',
+                            guild_id: guildId,
                             created_at: null,
                             channelName: ch.name,
                             guildId,
@@ -224,7 +226,10 @@ cli
     // Prune stale entries if requested
     let finalEntries = enrichedWithGuild;
     if (options.prune) {
-        const stale = finalEntries.filter((ch) => ch.deleted && ch.isLocal);
+        // Skip default kimaki directory tombstones — those are preserved
+        // intentionally so the tutorial channel isn't recreated after deletion.
+        const defaultDir = getDefaultKimakiDirectory();
+        const stale = finalEntries.filter((ch) => ch.deleted && ch.isLocal && ch.directory !== defaultDir);
         if (stale.length === 0) {
             cliLogger.log('No stale channels to prune');
         }

package/dist/commands/login.js

@@ -843,7 +843,7 @@ async function startOAuthFlow(interaction, ctx, hash) {
             // completing login in a browser (possibly on a different machine).
             const button = new ButtonBuilder()
                 .setCustomId(`login_oauth_code_btn:${hash}`)
-                .setLabel('Paste authorization code')
+                .setLabel('Paste authorization code or callback url')
                 .setStyle(ButtonStyle.Primary);
             await interaction.editReply({
                 content: message,

package/dist/commands/new-worktree.js

@@ -4,7 +4,7 @@
 import { ChannelType, REST, } from 'discord.js';
 import fs from 'node:fs';
 import { OpenCodeSdkError } from '../errors.js';
-import { createPendingWorkspace, setWorkspaceReady, setWorkspaceError, getChannelDirectory, getThreadSession, setThreadSession, } from '../database.js';
+import { createPendingWorkspace, setWorkspaceReady, setWorkspaceError, getChannelDirectory, getThreadSession, getThreadWorktreeOrWorkspace, setThreadSession, } from '../database.js';
 import { SILENT_MESSAGE_FLAGS, reactToThread, resolveProjectDirectoryFromAutocomplete, resolveTextChannel, sendThreadMessage, } from '../discord-utils.js';
 import { createLogger, LogPrefix } from '../logger.js';
 import { notifyError } from '../sentry.js';
@@ -173,8 +173,8 @@ async function tryWorkspaceCreate({ threadId, worktreeName, projectDirectory, ba
         return new Error(`Workspace creation failed: ${JSON.stringify(response.error)}`);
     }
     const workspace = response.data;
-    if (!workspace?.directory) {
-        return new Error('Workspace SDK returned no directory');
+    if (!workspace?.directory || !workspace.id) {
+        return new Error('Workspace SDK returned no directory or ID');
     }
     return { directory: workspace.directory, workspaceId: workspace.id };
 }
@@ -451,6 +451,11 @@ async function handleWorktreeInThread({ command, thread, appId, }) {
             await sendThreadMessage(worktreeThread, 'Worktree is ready. Send a message here to start a fresh session in this checkout.');
             return;
         }
+        const workspace = await getThreadWorktreeOrWorkspace(worktreeThread.id);
+        if (!workspace?.workspace_id) {
+            await sendThreadMessage(worktreeThread, '✗ Worktree is ready, but OpenCode returned no workspace ID for context reuse.');
+            return;
+        }
         const getClient = await initializeOpencodeForDirectory(result, {
             originalRepoDirectory: projectDirectory,
             channelId: parent.id,
@@ -462,6 +467,7 @@ async function handleWorktreeInThread({ command, thread, appId, }) {
         const forkResponse = await getClient().session.fork({
             sessionID: sourceSessionId,
             directory: result,
+            workspace: workspace.workspace_id,
         }).catch((e) => new OpenCodeSdkError({ operation: 'session.fork', cause: e }));
         if (forkResponse instanceof Error) {
             logger.error('[NEW-WORKTREE] Failed to fork session into worktree:', forkResponse);

package/dist/commands/queue.js

@@ -117,9 +117,19 @@ export async function handleClearQueueCommand({ command, }) {
         logger.log(`[QUEUE] User ${command.user.displayName} cleared queued position ${position} in thread ${channel.id}`);
         return;
     }
-    runtime?.clearQueue();
+    const cleared = runtime?.clearQueue() ?? [];
+    const lines = cleared.map((item, i) => {
+        const label = item.command
+            ? `/${item.command.name}`
+            : item.prompt;
+        return `${i + 1}. ${label}`;
+    });
+    let list = lines.join('\n');
+    if (list.length > 600) {
+        list = list.slice(0, 597) + '...';
+    }
     await command.reply({
-        content: `Cleared ${queueLength} queued message${queueLength > 1 ? 's' : ''}`,
+        content: `Cleared ${cleared.length} queued message${cleared.length > 1 ? 's' : ''}:\n${list}`,
         flags: SILENT_MESSAGE_FLAGS,
     });
     logger.log(`[QUEUE] User ${command.user.displayName} cleared queue in thread ${channel.id}`);

package/dist/database.js

@@ -103,10 +103,9 @@ export async function recoverStaleRunningScheduledTasks({ staleBefore }) {
         .returning({ id: schema.scheduled_tasks.id });
     return countRows(rows);
 }
-export async function markScheduledTaskOneShotCompleted({ taskId, completedAt }) {
+export async function deleteScheduledTask(taskId) {
     const db = await getDb();
-    await db.update(schema.scheduled_tasks)
-        .set({ status: 'completed', last_run_at: completedAt, running_started_at: null, last_error: null })
+    await db.delete(schema.scheduled_tasks)
         .where(orm.eq(schema.scheduled_tasks.id, taskId));
 }
 export async function markScheduledTaskCronRescheduled({ taskId, completedAt, nextRunAt }) {
@@ -584,17 +583,17 @@ export async function getAnyAudioApiKey() {
         return { provider: 'gemini', apiKey: row.gemini_api_key, appId: row.app_id };
     return null;
 }
-export async function setChannelDirectory({ channelId, directory, channelType, skipIfExists = false }) {
+export async function setChannelDirectory({ channelId, directory, channelType, guildId, skipIfExists = false }) {
     const db = await getDb();
     if (skipIfExists) {
         await db.insert(schema.channel_directories)
-            .values({ channel_id: channelId, directory, channel_type: channelType })
+            .values({ channel_id: channelId, directory, channel_type: channelType, guild_id: guildId })
             .onConflictDoNothing({ target: schema.channel_directories.channel_id });
         return;
     }
     await db.insert(schema.channel_directories)
-        .values({ channel_id: channelId, directory, channel_type: channelType })
-        .onConflictDoUpdate({ target: schema.channel_directories.channel_id, set: { directory, channel_type: channelType } });
+        .values({ channel_id: channelId, directory, channel_type: channelType, guild_id: guildId })
+        .onConflictDoUpdate({ target: schema.channel_directories.channel_id, set: { directory, channel_type: channelType, guild_id: guildId } });
 }
 export async function findChannelsByDirectory({ directory, channelType }) {
     const db = await getDb();
@@ -605,7 +604,7 @@ export async function findChannelsByDirectory({ directory, channelType }) {
             : channelType
                 ? { channel_type: channelType }
                 : undefined;
-    return db.query.channel_directories.findMany({ where, columns: { channel_id: true, directory: true, channel_type: true } });
+    return db.query.channel_directories.findMany({ where, columns: { channel_id: true, directory: true, channel_type: true, guild_id: true } });
 }
 export async function getAllTextChannelDirectories() {
     const db = await getDb();

package/dist/db.js

@@ -120,6 +120,7 @@ async function migrateSchema({ db, client, }) {
         "ALTER TABLE thread_sessions ADD COLUMN source TEXT DEFAULT 'kimaki'",
         'ALTER TABLE thread_sessions ADD COLUMN last_synced_name TEXT',
         'ALTER TABLE thread_sessions ADD COLUMN parent_session_id TEXT',
+        'ALTER TABLE channel_directories ADD COLUMN guild_id TEXT',
     ];
     for (const stmt of alterStatements) {
         await client.execute(stmt).catch(() => undefined);

package/dist/discord-bot.js

@@ -37,6 +37,7 @@ import { markDiscordGatewayReady, stopHranaServer } from './hrana-server.js';
 import { notifyError } from './sentry.js';
 import { flushDebouncedProcessCallbacks } from './debounced-process-flush.js';
 import { startRuntimeIdleSweeper } from './runtime-idle-sweeper.js';
+import { getDefaultKimakiDirectory } from './channel-management.js';
 import { store } from './store.js';
 import { startExternalOpencodeSessionSync, stopExternalOpencodeSessionSync, } from './external-opencode-sync.js';
 export { initDatabase, closeDatabase, getChannelDirectory, } from './database.js';
@@ -1113,6 +1114,14 @@ export async function startDiscordBot({ token, appId, discordClient, useWorktree
     // channel are disposed by their own ThreadDelete events from Discord.
     discordClient.on(Events.ChannelDelete, async (channel) => {
         try {
+            // Check if this is the default kimaki channel. If so, preserve the
+            // channel_directories row as a tombstone so we don't recreate it.
+            const mapping = await getChannelDirectory(channel.id);
+            const defaultDir = getDefaultKimakiDirectory();
+            if (mapping && mapping.directory === defaultDir) {
+                discordLogger.log(`Preserving channel_directories row for deleted default channel ${channel.id} as tombstone`);
+                return;
+            }
             const deleted = await deleteChannelDirectoryById(channel.id);
             if (deleted) {
                 discordLogger.log(`Cleaned up channel_directories for deleted channel ${channel.id}`);

package/dist/hrana-server.js

@@ -19,6 +19,11 @@ import { createLogger, LogPrefix } from './logger.js';
 import { ServerStartError, FetchError } from './errors.js';
 import { getLockPort } from './config.js';
 import { store } from './store.js';
+// Circular import: opencode.ts → hrana-server.ts → opencode.ts.
+// Safe because both sides only use lazy runtime function calls, never
+// top-level initialization values. The cycle could be broken by moving
+// the port into store.ts, but the current approach is simpler.
+import { getOpencodeServerPort } from './opencode.js';
 const hranaLogger = createLogger(LogPrefix.DB);
 let db = null;
 let server = null;
@@ -146,6 +151,20 @@ export async function startHranaServer({ dbPath, bindAll = false, }) {
             res.end(JSON.stringify({ status: 'ok', pid: process.pid }));
             return;
         }
+        // OpenCode server port discovery — no auth required (localhost only).
+        // CLI subcommands query this to reuse the bot's running OpenCode server
+        // instead of spawning a redundant second server process.
+        if (pathname === '/kimaki/opencode-port') {
+            const port = getOpencodeServerPort();
+            if (port === null) {
+                res.writeHead(404, { 'content-type': 'application/json' });
+                res.end(JSON.stringify({ error: 'no_opencode_server' }));
+                return;
+            }
+            res.writeHead(200, { 'content-type': 'application/json' });
+            res.end(JSON.stringify({ port }));
+            return;
+        }
         // Hrana routes: /v2, /v2/pipeline — require auth
         if (pathname === '/v2' || pathname === '/v2/pipeline') {
             if (!isAuthorizedRequest(req)) {

package/dist/oauth-rotation-shared.js

@@ -203,6 +203,27 @@ export function isTokenRefreshError(message) {
         haystack.includes('refresh_token') ||
         (haystack.includes('401') && haystack.includes('refresh')));
 }
+/** Permanent OAuth refresh death (invalid_grant / expired refresh). Remove account, do not rotate. */
+export function isPermanentOAuthRefreshFailure(error) {
+    const message = typeof error === 'string'
+        ? error
+        : error instanceof Error
+            ? error.message
+            : '';
+    const haystack = message.toLowerCase();
+    if (!haystack)
+        return false;
+    if (haystack.includes('invalid_grant'))
+        return true;
+    if (haystack.includes('refresh token expired'))
+        return true;
+    if (haystack.includes('refresh_token') || haystack.includes('refresh token')) {
+        return (haystack.includes('expired') ||
+            haystack.includes('invalid') ||
+            haystack.includes('revoked'));
+    }
+    return false;
+}
 // --- Auth file helpers ---
 export function isOAuthStored(value) {
     if (!value || typeof value !== 'object') {