kimaki 0.22.0 → 0.23.1

package/skills/holocron/SKILL.md

@@ -668,22 +668,23 @@ docs.jsonc ───►│  Vite Plugin  │──────► Build Output
 ```
 ````
 
-## Always run `diagrams fix` after editing diagrams
+## Always run `diagrams fix` after editing diagrams or tables
 
-LLMs cannot count characters reliably. Every time you create or edit a diagram in an MDX page, you **must** run the alignment fixer before committing. This is not optional.
+LLMs cannot count characters or pad table columns reliably. Every time you create or edit a **diagram** or a **GFM table** in an MDX page, you **must** run the fixer before committing. This is not optional.
 
 ```bash
 npx -y "@holocron.so/cli" diagrams fix path/to/file.mdx
 ```
 
 The command:
-- Fixes box alignment (padding, border widths, junctions) in-place
+- Fixes box-drawing diagram alignment (padding, border widths, junctions) in-place
+- Formats GFM tables (column padding, aligned pipes, blank lines above/below)
 - Reports how many lines were changed
-- Exits with code 1 if any lines exceed max width (94 cols by default)
+- Exits with code 1 if any diagram lines exceed max width (94 cols by default) or tables still need formatting (`--check`)
 
-If the output says "No changes", the diagram was already correct. If it reports width violations, shorten the offending lines manually and re-run.
+If the output says "No changes", the file was already correct. If it reports width violations, shorten the offending diagram lines manually and re-run.
 
-**Do not skip this step.** Even if the diagram looks correct in your editor, run the command. Off-by-one padding errors are invisible to LLMs but obvious to humans in monospace fonts.
+**Do not skip this step.** Even if a diagram or table looks fine in your editor, run the command. Off-by-one padding and uneven table columns are invisible to LLMs but obvious to humans in monospace fonts.
 
 ## OpenAPI summaries
 
@@ -741,7 +742,9 @@ If a user wants to customize something that has no CSS variable, **do not hack i
 - All ASCII diagrams in MDX pages must use the `diagram` language hint on the
   code fence (` ```diagram `). This renders them with proper styling on the
   website instead of plain monospace.
-- After creating or editing any diagram, run `npx -y "@holocron.so/cli" diagrams fix <file>`
-  to auto-fix alignment. LLMs cannot count characters reliably.
+- After creating or editing any diagram or GFM table, run
+  `npx -y "@holocron.so/cli" diagrams fix <file>` to auto-fix diagram
+  alignment and table column padding. LLMs cannot count characters or pad
+  columns reliably.
 - Never pipe curl or `--help` output through `head`, `tail`, or any truncation
   command. Always read the full output.

package/src/anthropic-auth-plugin.ts

@@ -28,8 +28,10 @@ import type { OpencodeClient } from "@opencode-ai/sdk/v2";
 import { appendToastSessionMarker } from "./plugin-logger.js";
 import { createPluginClient } from "./plugin-opencode-client.js";
 import {
+  isPermanentOAuthRefreshFailure,
   loadAccountStore,
   rememberAnthropicOAuth,
+  removeAccountByAuth,
   rotateAnthropicAccount,
   saveAccountStore,
   setAnthropicAuth,
@@ -911,50 +913,91 @@ function isOAuthStored(auth: { type: string }): auth is OAuthStored {
   return auth.type === "oauth";
 }
 
+/**
+ * Refresh Anthropic OAuth. On permanent refresh failure (invalid_grant),
+ * remove that account from the pool and retry with the next one.
+ * removeAccountByAuth runs outside withAuthStateLock to avoid nested locks.
+ */
 async function getFreshOAuth(
   getAuth: () => Promise<OAuthStored | { type: string }>,
   client: OpencodeClient,
-) {
+  options?: { sessionId?: string },
+): Promise<OAuthStored | undefined> {
   const auth = await getAuth();
   if (!isOAuthStored(auth)) return undefined;
   if (auth.access && auth.expires > Date.now()) return auth;
 
   const pending = pendingRefresh.get(auth.refresh);
-  if (pending) {
-    return pending;
-  }
+  if (pending) return pending;
 
-  const refreshPromise = withAuthStateLock(async () => {
-    const latest = await getAuth();
-    if (!isOAuthStored(latest)) {
-      throw new Error("Anthropic OAuth credentials disappeared during refresh");
-    }
-    if (latest.access && latest.expires > Date.now()) return latest;
-
-    const refreshed = await refreshAnthropicToken(latest.refresh);
-    await setAnthropicAuth(refreshed, client);
-    const store = await loadAccountStore();
-    if (store.accounts.length > 0) {
-      const identity: AnthropicAccountIdentity | undefined = (() => {
-        const currentIndex = store.accounts.findIndex((account) => {
-          return (
-            account.refresh === latest.refresh ||
-            account.access === latest.access
-          );
+  const refreshPromise = (async () => {
+    const attempted = new Set<string>();
+    while (true) {
+      let failedAuth: OAuthStored | undefined;
+      try {
+        return await withAuthStateLock(async () => {
+          const latest = await getAuth();
+          if (!isOAuthStored(latest)) {
+            throw new Error(
+              "Anthropic OAuth credentials disappeared during refresh",
+            );
+          }
+          if (latest.access && latest.expires > Date.now()) return latest;
+          if (attempted.has(latest.refresh)) {
+            throw new Error(
+              "Anthropic OAuth refresh failed for all remaining accounts",
+            );
+          }
+          attempted.add(latest.refresh);
+
+          try {
+            const refreshed = await refreshAnthropicToken(latest.refresh);
+            await setAnthropicAuth(refreshed, client);
+            const store = await loadAccountStore();
+            if (store.accounts.length > 0) {
+              const current = store.accounts.find(
+                (account) =>
+                  account.refresh === latest.refresh ||
+                  account.access === latest.access,
+              );
+              const identity: AnthropicAccountIdentity | undefined = current
+                ? {
+                    ...(current.email ? { email: current.email } : {}),
+                    ...(current.accountId
+                      ? { accountId: current.accountId }
+                      : {}),
+                  }
+                : undefined;
+              upsertAccount(store, { ...refreshed, ...identity });
+              await saveAccountStore(store);
+            }
+            return refreshed;
+          } catch (error) {
+            if (!isPermanentOAuthRefreshFailure(error)) throw error;
+            failedAuth = latest;
+            throw error;
+          }
         });
-        const current =
-          currentIndex >= 0 ? store.accounts[currentIndex] : undefined;
-        if (!current) return undefined;
-        return {
-          ...(current.email ? { email: current.email } : {}),
-          ...(current.accountId ? { accountId: current.accountId } : {}),
-        };
-      })();
-      upsertAccount(store, { ...refreshed, ...identity });
-      await saveAccountStore(store);
+      } catch (error) {
+        if (!failedAuth || !isPermanentOAuthRefreshFailure(error)) throw error;
+        const removed = await removeAccountByAuth(failedAuth, client);
+        if (!removed) throw error;
+        client.tui
+          .showToast({
+            message: appendToastSessionMarker({
+              message: removed.active
+                ? `Removed expired Anthropic account ${removed.removedLabel}, switched to ${removed.activeLabel ?? "next"}`
+                : `Removed expired Anthropic account ${removed.removedLabel} (no accounts left — re-login required)`,
+              sessionId: options?.sessionId,
+            }),
+            variant: removed.active ? "info" : "error",
+          })
+          .catch(() => {});
+        if (!removed.active) throw error;
+      }
     }
-    return refreshed;
-  });
+  })();
+
   pendingRefresh.set(auth.refresh, refreshPromise);
   return refreshPromise.finally(() => {
     pendingRefresh.delete(auth.refresh);
@@ -1060,7 +1103,9 @@ const AnthropicAuthPlugin: Plugin = async ({ serverUrl, directory }) => {
               });
             };
 
-            const freshAuth = await getFreshOAuth(getAuth, client);
+            const freshAuth = await getFreshOAuth(getAuth, client, {
+              sessionId,
+            });
             if (!freshAuth) return fetch(input, init);
 
             let response = await runRequest(freshAuth);
@@ -1082,7 +1127,9 @@ const AnthropicAuthPlugin: Plugin = async ({ serverUrl, directory }) => {
                       variant: "info",
                     })
                     .catch(() => {});
-                  const retryAuth = await getFreshOAuth(getAuth, client);
+                  const retryAuth = await getFreshOAuth(getAuth, client, {
+                    sessionId,
+                  });
                   if (retryAuth) {
                     response = await runRequest(retryAuth);
                   }

package/src/anthropic-auth-state.test.ts

@@ -1,4 +1,5 @@
-// Tests Anthropic OAuth account persistence, deduplication, and rotation.
+// Tests Anthropic OAuth account persistence, deduplication, rotation, and
+// permanent refresh-failure removal.
 
 import { mkdtemp, readFile, rm, mkdir, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
@@ -7,9 +8,11 @@ import { afterEach, beforeEach, describe, expect, test } from 'vitest'
 import {
   accountLabel,
   authFilePath,
+  isPermanentOAuthRefreshFailure,
   loadAccountStore,
   rememberAnthropicOAuth,
   removeAccount,
+  removeAccountByAuth,
   rotateAnthropicAccount,
   saveAccountStore,
   shouldRotateAuth,
@@ -178,6 +181,61 @@ describe('removeAccount', () => {
   })
 })
 
+describe('removeAccountByAuth', () => {
+  test('removes matched account, promotes next, and syncs auth.set', async () => {
+    await saveAccountStore({
+      version: 1,
+      activeIndex: 0,
+      accounts: [
+        { ...firstAccount, email: 'dead@example.com', addedAt: 1, lastUsed: 1 },
+        { ...secondAccount, email: 'live@example.com', addedAt: 2, lastUsed: 2 },
+      ],
+    })
+
+    const authSetCalls: unknown[] = []
+    const client = {
+      auth: {
+        set: async (input: unknown) => {
+          authSetCalls.push(input)
+        },
+      },
+    }
+
+    const removed = await removeAccountByAuth(firstAccount, client as never)
+    const store = await loadAccountStore()
+
+    expect(removed).toMatchObject({
+      removedLabel: '#1 (dead@example.com)',
+      activeLabel: '#1 (live@example.com)',
+      active: { refresh: 'refresh-second' },
+    })
+    expect(store.accounts).toHaveLength(1)
+    expect(store.accounts[0]?.refresh).toBe('refresh-second')
+    expect(authSetCalls).toHaveLength(1)
+  })
+
+  test('returns undefined when auth is not in the pool', async () => {
+    await saveAccountStore({
+      version: 1,
+      activeIndex: 0,
+      accounts: [{ ...firstAccount, addedAt: 1, lastUsed: 1 }],
+    })
+
+    const removed = await removeAccountByAuth(
+      {
+        type: 'oauth',
+        refresh: 'unknown-refresh',
+        access: 'unknown-access',
+        expires: 1,
+      },
+      { auth: { set: async () => {} } } as never,
+    )
+
+    expect(removed).toBeUndefined()
+    expect((await loadAccountStore()).accounts).toHaveLength(1)
+  })
+})
+
 describe('shouldRotateAuth', () => {
   test('only rotates on rate limit or auth failures', () => {
     expect(shouldRotateAuth(429, '')).toBe(true)
@@ -185,3 +243,17 @@ describe('shouldRotateAuth', () => {
     expect(shouldRotateAuth(400, 'bad request')).toBe(false)
   })
 })
+
+describe('isPermanentOAuthRefreshFailure', () => {
+  test('detects invalid_grant and expired refresh tokens', () => {
+    expect(
+      isPermanentOAuthRefreshFailure(
+        new Error(
+          'HTTP 400 from https://platform.claude.com/v1/oauth/token: {"error": "invalid_grant", "error_description": "Refresh token expired"}',
+        ),
+      ),
+    ).toBe(true)
+    expect(isPermanentOAuthRefreshFailure(new Error('ECONNRESET'))).toBe(false)
+    expect(isPermanentOAuthRefreshFailure(new Error('rate_limit_error'))).toBe(false)
+  })
+})

package/src/anthropic-auth-state.ts

@@ -20,6 +20,7 @@ import {
   authFilePath,
   findCurrentAccountIndex,
   isOAuthStored,
+  isPermanentOAuthRefreshFailure,
   normalizeAccountStore,
   readJson,
   upsertAccount as sharedUpsertAccount,
@@ -30,7 +31,13 @@ import {
 
 // Re-export types and functions that consumers rely on
 export type { OAuthStored, RotationResult }
-export { accountLabel, authFilePath, withAuthStateLock, shouldRotateAuth }
+export {
+  accountLabel,
+  authFilePath,
+  withAuthStateLock,
+  shouldRotateAuth,
+  isPermanentOAuthRefreshFailure,
+}
 
 export type CurrentAnthropicAccount = {
   auth: OAuthStored
@@ -38,6 +45,12 @@ export type CurrentAnthropicAccount = {
   index?: number
 }
 
+export type RemoveAccountByAuthResult = {
+  removedLabel: string
+  activeLabel: string | undefined
+  active: OAuthStored | undefined
+}
+
 // --- Store file path ---
 
 export function accountsFilePath() {
@@ -173,38 +186,85 @@ export async function rotateAnthropicAccount(
 
 // --- Remove account ---
 
+/** Splice account at index and promote next. Caller must hold withAuthStateLock. */
+async function spliceAccountAndPromote({
+  store,
+  index,
+  client,
+}: {
+  store: AccountStore
+  index: number
+  client?: OpencodeClient
+}) {
+  store.accounts.splice(index, 1)
+  if (store.accounts.length === 0) {
+    store.activeIndex = 0
+    await saveAccountStore(store)
+    await writeAnthropicAuthFile(undefined)
+    return { store, active: undefined as OAuthStored | undefined, activeLabel: undefined as string | undefined }
+  }
+
+  if (store.activeIndex > index) {
+    store.activeIndex -= 1
+  } else if (store.activeIndex >= store.accounts.length) {
+    store.activeIndex = 0
+  }
+
+  const active = store.accounts[store.activeIndex]
+  if (!active) throw new Error('Active Anthropic account disappeared during removal')
+  active.lastUsed = Date.now()
+  await saveAccountStore(store)
+  const nextAuth: OAuthStored = {
+    type: 'oauth',
+    refresh: active.refresh,
+    access: active.access,
+    expires: active.expires,
+  }
+  if (client) {
+    await setAnthropicAuth(nextAuth, client)
+  } else {
+    await writeAnthropicAuthFile(nextAuth)
+  }
+  return {
+    store,
+    active: nextAuth,
+    activeLabel: accountLabel(active, store.activeIndex),
+  }
+}
+
 export async function removeAccount(index: number) {
   return withAuthStateLock(async () => {
     const store = await loadAccountStore()
     if (!Number.isInteger(index) || index < 0 || index >= store.accounts.length) {
       throw new Error(`Account ${index + 1} does not exist`)
     }
+    return spliceAccountAndPromote({ store, index })
+  })
+}
 
-    store.accounts.splice(index, 1)
-    if (store.accounts.length === 0) {
-      store.activeIndex = 0
-      await saveAccountStore(store)
-      await writeAnthropicAuthFile(undefined)
-      return { store, active: undefined }
-    }
-
-    if (store.activeIndex > index) {
-      store.activeIndex -= 1
-    } else if (store.activeIndex >= store.accounts.length) {
-      store.activeIndex = 0
-    }
+/**
+ * Remove the pool entry matching these OAuth credentials and promote the next
+ * account. Used when refresh fails permanently (invalid_grant).
+ */
+export async function removeAccountByAuth(
+  auth: OAuthStored,
+  client: OpencodeClient,
+): Promise<RemoveAccountByAuthResult | undefined> {
+  return withAuthStateLock(async () => {
+    const store = await loadAccountStore()
+    const index = store.accounts.findIndex(
+      (account) => account.refresh === auth.refresh || account.access === auth.access,
+    )
+    if (index < 0) return undefined
 
-    const active = store.accounts[store.activeIndex]
-    if (!active) throw new Error('Active Anthropic account disappeared during removal')
-    active.lastUsed = Date.now()
-    await saveAccountStore(store)
-    const nextAuth: OAuthStored = {
-      type: 'oauth',
-      refresh: active.refresh,
-      access: active.access,
-      expires: active.expires,
+    const removed = store.accounts[index]
+    if (!removed) return undefined
+    const removedLabel = accountLabel(removed, index)
+    const result = await spliceAccountAndPromote({ store, index, client })
+    return {
+      removedLabel,
+      activeLabel: result.activeLabel,
+      active: result.active,
     }
-    await writeAnthropicAuthFile(nextAuth)
-    return { store, active: nextAuth }
   })
 }

package/src/channel-management.ts

@@ -188,6 +188,11 @@ __pycache__/
 *.egg-info/
 `
 
+/** Returns the absolute path to the default kimaki project directory. */
+export function getDefaultKimakiDirectory(): string {
+  return path.join(getProjectsDir(), 'kimaki')
+}
+
 const DEFAULT_CHANNEL_TOPIC =
   'General channel for misc tasks with Kimaki. Not connected to a specific OpenCode project or repository.'
 
@@ -216,7 +221,7 @@ export async function createDefaultKimakiChannel({
   channelName: string
   projectDirectory: string
 } | null> {
-  const projectDirectory = path.join(getProjectsDir(), 'kimaki')
+  const projectDirectory = getDefaultKimakiDirectory()
 
   // Ensure the default kimaki project directory exists before any DB mapping
   // restoration or git setup. Custom data dirs may not have <dataDir>/projects
@@ -242,11 +247,34 @@ export async function createDefaultKimakiChannel({
     directory: projectDirectory,
     channelType: 'text',
   })
-  const mappedChannelInGuild = existingMappings
-    .map((row) => guild.channels.cache.get(row.channel_id))
-    .find((ch): ch is TextChannel => ch?.type === ChannelType.GuildText)
-  if (mappedChannelInGuild) {
-    logger.log(`Default kimaki channel already exists: ${mappedChannelInGuild.id}`)
+  const mappedRow = existingMappings.find((row) => {
+    const ch = guild.channels.cache.get(row.channel_id)
+    return ch?.type === ChannelType.GuildText
+  })
+  if (mappedRow) {
+    // Backfill guild_id for rows created before this column existed,
+    // so the tombstone check works if the channel is deleted later.
+    if (mappedRow.guild_id !== guild.id) {
+      await setChannelDirectory({
+        channelId: mappedRow.channel_id,
+        directory: projectDirectory,
+        channelType: 'text',
+        guildId: guild.id,
+      })
+    }
+    logger.log(`Default kimaki channel already exists: ${mappedRow.channel_id}`)
+    return null
+  }
+
+  // 1b. If a mapping exists for this guild but the channel is gone from Discord,
+  // it was previously created and then deleted. Don't recreate it.
+  const staleForThisGuild = existingMappings.find(
+    (row) => row.guild_id === guild.id,
+  )
+  if (staleForThisGuild) {
+    logger.log(
+      `Default kimaki channel was previously provisioned for guild ${guild.name} (${guild.id}) as ${staleForThisGuild.channel_id}, but no longer exists. Skipping recreation.`,
+    )
     return null
   }
 
@@ -318,6 +346,7 @@ export async function createDefaultKimakiChannel({
     channelId: textChannel.id,
     directory: projectDirectory,
     channelType: 'text',
+    guildId: guild.id,
   })
 
   logger.log(`Created default kimaki channel: #${channelName} (${textChannel.id})`)

package/src/cli-commands/project.ts

@@ -12,6 +12,7 @@ import { fileURLToPath } from 'node:url'
 import { spawn, execSync } from 'node:child_process'
 import { createLogger, LogPrefix, initLogFile } from '../logger.js'
 import { createDiscordClient, initDatabase, getChannelDirectory, initializeOpencodeForDirectory, createProjectChannels } from '../discord-bot.js'
+import { getDefaultKimakiDirectory } from '../channel-management.js'
 import { getBotTokenWithMode, getThreadSession, getThreadIdBySessionId, getSessionEventSnapshot, getDb, createScheduledTask, listScheduledTasks, cancelScheduledTask, getScheduledTask, updateScheduledTask, getSessionStartSourcesBySessionIds, deleteChannelDirectoryById, findChannelsByDirectory } from '../database.js'
 import { ShareMarkdown } from '../markdown.js'
 import { parseSessionSearchPattern, findFirstSessionSearchHit, buildSessionSearchSnippet, getPartSearchTexts } from '../session-search.js'
@@ -277,6 +278,7 @@ cli
                 channel_id: ch.id,
                 directory: '',
                 channel_type: 'text' as const,
+                guild_id: guildId,
                 created_at: null,
                 channelName: ch.name,
                 guildId,
@@ -323,7 +325,10 @@ cli
     // Prune stale entries if requested
     let finalEntries = enrichedWithGuild
     if (options.prune) {
-      const stale = finalEntries.filter((ch) => ch.deleted && ch.isLocal)
+      // Skip default kimaki directory tombstones — those are preserved
+      // intentionally so the tutorial channel isn't recreated after deletion.
+      const defaultDir = getDefaultKimakiDirectory()
+      const stale = finalEntries.filter((ch) => ch.deleted && ch.isLocal && ch.directory !== defaultDir)
       if (stale.length === 0) {
         cliLogger.log('No stale channels to prune')
       } else {

package/src/commands/login.ts

@@ -1127,7 +1127,7 @@ async function startOAuthFlow(
       // completing login in a browser (possibly on a different machine).
       const button = new ButtonBuilder()
         .setCustomId(`login_oauth_code_btn:${hash}`)
-        .setLabel('Paste authorization code')
+        .setLabel('Paste authorization code or callback url')
         .setStyle(ButtonStyle.Primary)
 
       await interaction.editReply({

package/src/commands/new-worktree.ts

@@ -18,6 +18,7 @@ import {
   setWorkspaceError,
   getChannelDirectory,
   getThreadSession,
+  getThreadWorktreeOrWorkspace,
   setThreadSession,
 } from '../database.js'
 import {
@@ -223,7 +224,7 @@ async function tryWorkspaceCreate({
   worktreeName: string
   projectDirectory: string
   baseBranch?: string
-}): Promise<{ directory: string; workspaceId?: string } | Error> {
+}): Promise<{ directory: string; workspaceId: string } | Error> {
   const getClient = await initializeOpencodeForDirectory(projectDirectory)
   if (getClient instanceof Error) return getClient
 
@@ -239,8 +240,8 @@ async function tryWorkspaceCreate({
     return new Error(`Workspace creation failed: ${JSON.stringify(response.error)}`)
   }
   const workspace = response.data
-  if (!workspace?.directory) {
-    return new Error('Workspace SDK returned no directory')
+  if (!workspace?.directory || !workspace.id) {
+    return new Error('Workspace SDK returned no directory or ID')
   }
   return { directory: workspace.directory, workspaceId: workspace.id }
 }
@@ -613,6 +614,15 @@ async function handleWorktreeInThread({
         return
       }
 
+      const workspace = await getThreadWorktreeOrWorkspace(worktreeThread.id)
+      if (!workspace?.workspace_id) {
+        await sendThreadMessage(
+          worktreeThread,
+          '✗ Worktree is ready, but OpenCode returned no workspace ID for context reuse.',
+        )
+        return
+      }
+
       const getClient = await initializeOpencodeForDirectory(result, {
         originalRepoDirectory: projectDirectory,
         channelId: parent.id,
@@ -628,6 +638,7 @@ async function handleWorktreeInThread({
       const forkResponse = await getClient().session.fork({
         sessionID: sourceSessionId,
         directory: result,
+        workspace: workspace.workspace_id,
       }).catch((e) => new OpenCodeSdkError({ operation: 'session.fork', cause: e }))
       if (forkResponse instanceof Error) {
         logger.error('[NEW-WORKTREE] Failed to fork session into worktree:', forkResponse)

package/src/commands/queue.ts

@@ -156,10 +156,21 @@ export async function handleClearQueueCommand({
     return
   }
 
-  runtime?.clearQueue()
+  const cleared = runtime?.clearQueue() ?? []
+
+  const lines = cleared.map((item, i) => {
+    const label = item.command
+      ? `/${item.command.name}`
+      : item.prompt
+    return `${i + 1}. ${label}`
+  })
+  let list = lines.join('\n')
+  if (list.length > 600) {
+    list = list.slice(0, 597) + '...'
+  }
 
   await command.reply({
-    content: `Cleared ${queueLength} queued message${queueLength > 1 ? 's' : ''}`,
+    content: `Cleared ${cleared.length} queued message${cleared.length > 1 ? 's' : ''}:\n${list}`,
     flags: SILENT_MESSAGE_FLAGS,
   })