kimaki 0.25.0 → 0.27.0

package/dist/agent-model.e2e.test.js

@@ -189,7 +189,7 @@ function createAgentFile({ projectDirectory, agentName, model, }) {
     fs.mkdirSync(agentDir, { recursive: true });
     const content = [
         '---',
-        `model: ${model}`,
+        ...(model ? [`model: ${model}`] : []),
         'mode: primary',
         `description: Test agent with custom model`,
         '---',
@@ -289,6 +289,10 @@ describe('agent model resolution', () => {
             agentName: 'plan',
             model: `${PROVIDER_NAME}/${PLAN_AGENT_MODEL}`,
         });
+        createAgentFile({
+            projectDirectory: directories.projectDirectory,
+            agentName: 'plain',
+        });
         const dbPath = path.join(directories.dataDir, 'discord-sessions.db');
         const hranaResult = await startHranaServer({ dbPath });
         if (hranaResult instanceof Error) {
@@ -311,7 +315,7 @@ describe('agent model resolution', () => {
         });
         // Register quick agent slash commands so /plan-agent and /test-agent-agent
         // are resolvable by handleQuickAgentCommand via guild.commands.fetch().
-        const agentCommands = ['test-agent', 'plan'].map((agentName) => {
+        const agentCommands = ['test-agent', 'plan', 'plain'].map((agentName) => {
             return new SlashCommandBuilder()
                 .setName(`${agentName}-agent`)
                 .setDescription(buildQuickAgentCommandDescription({
@@ -398,7 +402,7 @@ describe('agent model resolution', () => {
         --- from: assistant (TestBot)
         *using deterministic-provider/agent-model-v2 ⋅ test-agent*
         ⬥ ok
-        *project ⋅ main ⋅ Ns ⋅ N% ⋅ agent-model-v2 ⋅ **test-agent***"
+        *project ⋅ main ⋅ Ns ⋅ N% ⋅ agent-model-v2 ⋅ **test-agent*** <@200000000000000920>"
       `);
         expect(footerMessage).toBeDefined();
         if (!footerMessage) {
@@ -442,7 +446,7 @@ describe('agent model resolution', () => {
         --- from: assistant (TestBot)
         *using deterministic-provider/agent-model-v2 ⋅ test-agent*
         ⬥ system-context-ok
-        *project ⋅ main ⋅ Ns ⋅ N% ⋅ agent-model-v2 ⋅ **test-agent***"
+        *project ⋅ main ⋅ Ns ⋅ N% ⋅ agent-model-v2 ⋅ **test-agent*** <@200000000000000920>"
       `);
     }, 15_000);
     test('session.command path includes kimaki system prompt on first message', async () => {
@@ -548,7 +552,7 @@ describe('agent model resolution', () => {
         --- from: assistant (TestBot)
         *using deterministic-provider/channel-model-v2*
         ⬥ ok
-        *project ⋅ main ⋅ Ns ⋅ N% ⋅ channel-model-v2*"
+        *project ⋅ main ⋅ Ns ⋅ N% ⋅ channel-model-v2* <@200000000000000920>"
       `);
         expect(footerMessage).toBeDefined();
         if (!footerMessage) {
@@ -561,40 +565,30 @@ describe('agent model resolution', () => {
         expect(footerMessage.content).toContain(CHANNEL_MODEL);
         expect(footerMessage.content).not.toContain(DEFAULT_MODEL);
     }, 15_000);
-    test('channel model with variant preference completes without error', async () => {
-        // Clear channel agent so model resolution falls through to channel model
+    test('unsupported channel model variant falls back to the selected model', async () => {
         const db = await getDb();
         await db.delete(schema.channel_agents).where(orm.eq(schema.channel_agents.channel_id, TEXT_CHANNEL_ID));
-        // Set channel model with a variant (thinking level)
-        // The deterministic provider doesn't support thinking, so the variant
-        // is resolved but silently dropped (no matching thinking values).
-        // This test verifies the variant cascade code path runs without crashing
-        // and the correct model still appears in the footer.
         await setChannelModel({
             channelId: TEXT_CHANNEL_ID,
             modelId: `${PROVIDER_NAME}/${CHANNEL_MODEL}`,
             variant: 'high',
         });
+        const prompt = 'Reply with exactly: variant-check';
         await discord.channel(TEXT_CHANNEL_ID).user(TEST_USER_ID).sendMessage({
-            content: 'Reply with exactly: variant-check',
+            content: prompt,
         });
         const thread = await discord.channel(TEXT_CHANNEL_ID).waitForThread({
             timeout: 4_000,
-            predicate: (t) => {
-                return t.name === 'Reply with exactly: variant-check';
-            },
+            predicate: (candidate) => candidate.name === prompt,
         });
-        await waitForBotMessageContaining({
+        const messages = await waitForFooterMessage({
             discord,
             threadId: thread.id,
-            userId: TEST_USER_ID,
-            text: '*project',
             timeout: 4_000,
         });
-        const messages = await discord.thread(thread.id).getMessages();
-        const footerMessage = messages.find((message) => {
-            return (message.author.id === discord.botUserId &&
-                message.content.startsWith('*'));
+        const footer = messages.find((message) => {
+            return message.author.id === discord.botUserId
+                && message.content.startsWith('*');
         });
         expect(await discord.thread(thread.id).text()).toMatchInlineSnapshot(`
         "--- from: user (agent-model-tester)
@@ -602,18 +596,10 @@ describe('agent model resolution', () => {
         --- from: assistant (TestBot)
         *using deterministic-provider/channel-model-v2*
         ⬥ ok
-        *project ⋅ main ⋅ Ns ⋅ N% ⋅ channel-model-v2*"
+        *project ⋅ main ⋅ Ns ⋅ N% ⋅ channel-model-v2* <@200000000000000920>"
       `);
-        expect(footerMessage).toBeDefined();
-        if (!footerMessage) {
-            throw new Error(`Expected footer message but none found. Bot messages: ${messages
-                .filter((m) => m.author.id === discord.botUserId)
-                .map((m) => m.content.slice(0, 150))
-                .join(' | ')}`);
-        }
-        // Footer should still contain the channel model (variant doesn't crash)
-        expect(footerMessage.content).toContain(CHANNEL_MODEL);
-        expect(footerMessage.content).not.toContain(DEFAULT_MODEL);
+        expect(footer?.content).toContain(CHANNEL_MODEL);
+        expect(footer?.content).not.toContain(DEFAULT_MODEL);
     }, 15_000);
     test('/btw fork keeps source session model when channel model differs', async () => {
         const db = await getDb();
@@ -677,7 +663,7 @@ describe('agent model resolution', () => {
         Reusing context from <#SOURCE_THREAD> to answer prompt...
         Reply with exactly: btw-model-check
         ⬥ ok
-        *project ⋅ main ⋅ Ns ⋅ N% ⋅ plan-model-v2*"
+        *project ⋅ main ⋅ Ns ⋅ N% ⋅ plan-model-v2* <@200000000000000920>"
       `);
         expect(forkedSessionModel).toMatchInlineSnapshot(`
         {
@@ -742,12 +728,12 @@ describe('agent model resolution', () => {
         --- from: assistant (TestBot)
         *using deterministic-provider/agent-model-v2 ⋅ test-agent*
         ⬥ ok
-        *project ⋅ main ⋅ Ns ⋅ N% ⋅ agent-model-v2 ⋅ **test-agent***
+        *project ⋅ main ⋅ Ns ⋅ N% ⋅ agent-model-v2 ⋅ **test-agent*** <@200000000000000920>
         --- from: user (agent-model-tester)
         Reply with exactly: second-thread-msg
         --- from: assistant (TestBot)
         ⬥ ok
-        *project ⋅ main ⋅ Ns ⋅ N% ⋅ agent-model-v2 ⋅ **test-agent***"
+        *project ⋅ main ⋅ Ns ⋅ N% ⋅ agent-model-v2 ⋅ **test-agent*** <@200000000000000920>"
       `);
         const secondMessages = await discord.thread(thread.id).getMessages();
         const secondFooter = [...secondMessages]
@@ -761,85 +747,6 @@ describe('agent model resolution', () => {
         expect(secondFooter.content).toContain(AGENT_MODEL);
         expect(secondFooter.content).not.toContain(PLAN_AGENT_MODEL);
     }, 20_000);
-    test('thread created with no agent keeps default model after channel agent is set', async () => {
-        // Clear any channel agent — thread starts with default (no agent)
-        const db = await getDb();
-        await db.delete(schema.channel_agents).where(orm.eq(schema.channel_agents.channel_id, TEXT_CHANNEL_ID));
-        // Also clear channel model so we get the pure default
-        await db.delete(schema.channel_models).where(orm.eq(schema.channel_models.channel_id, TEXT_CHANNEL_ID));
-        // 1. Send a message to create a thread (no channel agent set)
-        await discord.channel(TEXT_CHANNEL_ID).user(TEST_USER_ID).sendMessage({
-            content: 'Reply with exactly: default-thread-msg',
-        });
-        const thread = await discord.channel(TEXT_CHANNEL_ID).waitForThread({
-            timeout: 4_000,
-            predicate: (t) => {
-                return t.name === 'Reply with exactly: default-thread-msg';
-            },
-        });
-        // Wait for footer — should show the default model
-        await waitForFooterMessage({
-            discord,
-            threadId: thread.id,
-            timeout: 4_000,
-            afterMessageIncludes: 'ok',
-            afterAuthorId: discord.botUserId,
-        });
-        const firstMessages = await discord.thread(thread.id).getMessages();
-        const firstFooter = firstMessages.find((m) => {
-            return (m.author.id === discord.botUserId && m.content.startsWith('*'));
-        });
-        expect(firstFooter).toBeDefined();
-        // First run uses the default model (no agent set)
-        expect(firstFooter.content).toContain(DEFAULT_MODEL);
-        expect(firstFooter.content).not.toContain(AGENT_MODEL);
-        // 2. Set channel agent to test-agent via /test-agent-agent in the CHANNEL
-        const { id: interactionId } = await discord
-            .channel(TEXT_CHANNEL_ID)
-            .user(TEST_USER_ID)
-            .runSlashCommand({ name: 'test-agent-agent' });
-        await discord
-            .channel(TEXT_CHANNEL_ID)
-            .waitForInteractionAck({ interactionId, timeout: 4_000 });
-        // 3. Send a second message in the EXISTING thread
-        await discord
-            .thread(thread.id)
-            .user(TEST_USER_ID)
-            .sendMessage({
-            content: 'Reply with exactly: default-second-msg',
-        });
-        await waitForFooterMessage({
-            discord,
-            threadId: thread.id,
-            timeout: 4_000,
-            afterMessageIncludes: 'default-second-msg',
-            afterAuthorId: TEST_USER_ID,
-        });
-        expect(await discord.thread(thread.id).text()).toMatchInlineSnapshot(`
-        "--- from: user (agent-model-tester)
-        Reply with exactly: default-thread-msg
-        --- from: assistant (TestBot)
-        *using deterministic-provider/deterministic-v2*
-        ⬥ ok
-        *project ⋅ main ⋅ Ns ⋅ N% ⋅ deterministic-v2*
-        --- from: user (agent-model-tester)
-        Reply with exactly: default-second-msg
-        --- from: assistant (TestBot)
-        ⬥ ok
-        *project ⋅ main ⋅ Ns ⋅ N% ⋅ deterministic-v2*"
-      `);
-        const secondMessages = await discord.thread(thread.id).getMessages();
-        const secondFooter = [...secondMessages]
-            .reverse()
-            .find((m) => {
-            return (m.author.id === discord.botUserId && m.content.startsWith('*'));
-        });
-        expect(secondFooter).toBeDefined();
-        // The existing thread should still use the DEFAULT model,
-        // NOT the test-agent's model (AGENT_MODEL)
-        expect(secondFooter.content).toContain(DEFAULT_MODEL);
-        expect(secondFooter.content).not.toContain(AGENT_MODEL);
-    }, 20_000);
     test('/plan-agent with prompt starts a session with the plan agent', async () => {
         await setChannelAgent(TEXT_CHANNEL_ID, 'test-agent');
         const prompt = 'Reply with exactly: inline-plan-agent-msg';
@@ -875,7 +782,7 @@ describe('agent model resolution', () => {
         » **agent-model-tester** (plan): Reply with exactly: inline-plan-agent-msg
         *using deterministic-provider/plan-model-v2 ⋅ plan*
         ⬥ ok
-        *project ⋅ main ⋅ Ns ⋅ N% ⋅ plan-model-v2 ⋅ **plan***"
+        *project ⋅ main ⋅ Ns ⋅ N% ⋅ plan-model-v2 ⋅ **plan*** <@200000000000000920>"
       `);
     }, 20_000);
     test('/plan-agent with prompt in an existing thread changes the session agent', async () => {
@@ -920,10 +827,10 @@ describe('agent model resolution', () => {
         --- from: assistant (TestBot)
         *using deterministic-provider/agent-model-v2 ⋅ test-agent*
         ⬥ ok
-        *project ⋅ main ⋅ Ns ⋅ N% ⋅ agent-model-v2 ⋅ **test-agent***
+        *project ⋅ main ⋅ Ns ⋅ N% ⋅ agent-model-v2 ⋅ **test-agent*** <@200000000000000920>
         » **agent-model-tester** (plan): Reply with exactly: inline-existing-plan-msg
         ⬥ ok
-        *project ⋅ main ⋅ Ns ⋅ N% ⋅ plan-model-v2 ⋅ **plan***"
+        *project ⋅ main ⋅ Ns ⋅ N% ⋅ plan-model-v2 ⋅ **plan*** <@200000000000000920>"
       `);
     }, 20_000);
     test('/plan-agent inside a thread switches the model for that thread', async () => {
@@ -974,15 +881,15 @@ describe('agent model resolution', () => {
         --- from: assistant (TestBot)
         *using deterministic-provider/agent-model-v2 ⋅ test-agent*
         ⬥ ok
-        *project ⋅ main ⋅ Ns ⋅ N% ⋅ agent-model-v2 ⋅ **test-agent***
+        *project ⋅ main ⋅ Ns ⋅ N% ⋅ agent-model-v2 ⋅ **test-agent*** <@200000000000000920>
         Switched to **plan** agent for this session (was **test-agent**)
-        Model: *deterministic-provider/plan-model-v2*
+        Model: *deterministic-provider/plan-model-v2* (agent "plan")
         The agent will change on the next message.
         --- from: user (agent-model-tester)
         Reply with exactly: after-switch-msg
         --- from: assistant (TestBot)
         ⬥ ok
-        *project ⋅ main ⋅ Ns ⋅ N% ⋅ plan-model-v2 ⋅ **plan***"
+        *project ⋅ main ⋅ Ns ⋅ N% ⋅ plan-model-v2 ⋅ **plan*** <@200000000000000920>"
       `);
         const secondFooter = [...(await discord.thread(thread.id).getMessages())]
             .reverse()
@@ -994,4 +901,132 @@ describe('agent model resolution', () => {
         expect(secondFooter.content).toContain(PLAN_AGENT_MODEL);
         expect(secondFooter.content).not.toContain(AGENT_MODEL);
     }, 20_000);
+    test('/plan-agent on the same agent refreshes a stale session model', async () => {
+        await setChannelAgent(TEXT_CHANNEL_ID, 'plan');
+        await discord.channel(TEXT_CHANNEL_ID).user(TEST_USER_ID).sendMessage({
+            content: 'Reply with exactly: refresh-agent-model-msg',
+        });
+        const thread = await discord.channel(TEXT_CHANNEL_ID).waitForThread({
+            timeout: 4_000,
+            predicate: (t) => {
+                return t.name === 'Reply with exactly: refresh-agent-model-msg';
+            },
+        });
+        await waitForFooterMessage({
+            discord,
+            threadId: thread.id,
+            timeout: 4_000,
+            afterMessageIncludes: 'ok',
+            afterAuthorId: discord.botUserId,
+        });
+        const sessionId = await getThreadSession(thread.id);
+        expect(sessionId).toBeDefined();
+        if (!sessionId)
+            throw new Error('Expected session');
+        await setSessionModel({
+            sessionId,
+            modelId: `${PROVIDER_NAME}/${CHANNEL_MODEL}`,
+        });
+        const th = discord.thread(thread.id);
+        const { id: interactionId } = await th
+            .user(TEST_USER_ID)
+            .runSlashCommand({ name: 'plan-agent' });
+        await th.waitForInteractionAck({ interactionId, timeout: 4_000 });
+        expect(await th.text()).toMatchInlineSnapshot(`
+        "--- from: user (agent-model-tester)
+        Reply with exactly: refresh-agent-model-msg
+        --- from: assistant (TestBot)
+        *using deterministic-provider/plan-model-v2 ⋅ plan*
+        ⬥ ok
+        *project ⋅ main ⋅ Ns ⋅ N% ⋅ plan-model-v2 ⋅ **plan*** <@200000000000000920>
+        Using **plan** agent for this session
+        Model: *deterministic-provider/plan-model-v2* (agent "plan")
+        The agent will change on the next message."
+      `);
+        expect(await th.text()).not.toContain('Already using');
+        expect(await getSessionModel(sessionId)).toBeUndefined();
+    }, 20_000);
+    test('/plan-agent shows the agent model when a channel model is also set', async () => {
+        await setChannelAgent(TEXT_CHANNEL_ID, 'test-agent');
+        await setChannelModel({
+            channelId: TEXT_CHANNEL_ID,
+            modelId: `${PROVIDER_NAME}/${CHANNEL_MODEL}`,
+        });
+        await discord.channel(TEXT_CHANNEL_ID).user(TEST_USER_ID).sendMessage({
+            content: 'Reply with exactly: channel-vs-agent-msg',
+        });
+        const thread = await discord.channel(TEXT_CHANNEL_ID).waitForThread({
+            timeout: 4_000,
+            predicate: (t) => {
+                return t.name === 'Reply with exactly: channel-vs-agent-msg';
+            },
+        });
+        await waitForFooterMessage({
+            discord,
+            threadId: thread.id,
+            timeout: 4_000,
+            afterMessageIncludes: 'ok',
+            afterAuthorId: discord.botUserId,
+        });
+        const th = discord.thread(thread.id);
+        const { id: interactionId } = await th
+            .user(TEST_USER_ID)
+            .runSlashCommand({ name: 'plan-agent' });
+        await th.waitForInteractionAck({ interactionId, timeout: 4_000 });
+        const threadText = await th.text();
+        expect(threadText).toMatchInlineSnapshot(`
+        "--- from: user (agent-model-tester)
+        Reply with exactly: channel-vs-agent-msg
+        --- from: assistant (TestBot)
+        *using deterministic-provider/agent-model-v2 ⋅ test-agent*
+        ⬥ ok
+        *project ⋅ main ⋅ Ns ⋅ N% ⋅ agent-model-v2 ⋅ **test-agent*** <@200000000000000920>
+        Switched to **plan** agent for this session (was **test-agent**)
+        Model: *deterministic-provider/plan-model-v2* (agent "plan")
+        The agent will change on the next message."
+      `);
+        expect(threadText).toContain(`Model: *${PROVIDER_NAME}/${PLAN_AGENT_MODEL}* (agent "plan")`);
+        expect(threadText).not.toContain('channel override');
+    }, 20_000);
+    test('/plain-agent tells the user to clear a channel model override', async () => {
+        const db = await getDb();
+        await db.delete(schema.channel_agents).where(orm.eq(schema.channel_agents.channel_id, TEXT_CHANNEL_ID));
+        await setChannelModel({
+            channelId: TEXT_CHANNEL_ID,
+            modelId: `${PROVIDER_NAME}/${CHANNEL_MODEL}`,
+        });
+        await discord.channel(TEXT_CHANNEL_ID).user(TEST_USER_ID).sendMessage({
+            content: 'Reply with exactly: plain-agent-override-msg',
+        });
+        const thread = await discord.channel(TEXT_CHANNEL_ID).waitForThread({
+            timeout: 4_000,
+            predicate: (t) => {
+                return t.name === 'Reply with exactly: plain-agent-override-msg';
+            },
+        });
+        await waitForFooterMessage({
+            discord,
+            threadId: thread.id,
+            timeout: 4_000,
+            afterMessageIncludes: 'ok',
+            afterAuthorId: discord.botUserId,
+        });
+        const th = discord.thread(thread.id);
+        const { id: interactionId } = await th
+            .user(TEST_USER_ID)
+            .runSlashCommand({ name: 'plain-agent' });
+        await th.waitForInteractionAck({ interactionId, timeout: 4_000 });
+        expect(await th.text()).toMatchInlineSnapshot(`
+        "--- from: user (agent-model-tester)
+        Reply with exactly: plain-agent-override-msg
+        --- from: assistant (TestBot)
+        *using deterministic-provider/channel-model-v2*
+        ⬥ ok
+        *project ⋅ main ⋅ Ns ⋅ N% ⋅ channel-model-v2* <@200000000000000920>
+        Switched to **plain** agent for this session
+        Model: *deterministic-provider/channel-model-v2* (channel override)
+        This model comes from a channel override. Use /model and press Clear override if you want this agent's model.
+        The agent will change on the next message."
+      `);
+    }, 20_000);
 });

package/dist/analytics.test.js

@@ -90,7 +90,7 @@ describe('analytics', () => {
             bot_mode: 'gateway',
         });
     });
-    it('emits project_registered session_created turn_completed shapes', () => {
+    it('emits project_registered session_created turn_completed tokens_used shapes', () => {
         const captured = _enableAnalyticsTestCapture({
             installId: '33333333-3333-4333-8333-333333333333',
             botMode: 'self_hosted',
@@ -107,10 +107,24 @@ describe('analytics', () => {
         trackEvent('turn_completed', {
             duration_sec: 42,
         });
+        trackEvent('tokens_used', {
+            tokens_input: 100,
+            tokens_output: 20,
+            tokens_reasoning: 5,
+            tokens_cache_read: 10,
+            tokens_cache_write: 2,
+            tokens_total: 137,
+            cost: 0,
+            assistant_message_count: 2,
+            is_subagent: false,
+            model: 'gpt-5.3-codex',
+            provider: 'openai',
+        });
         expect(captured.map((e) => e.name)).toEqual([
             'project_registered',
             'session_created',
             'turn_completed',
+            'tokens_used',
         ]);
         expect(captured[0].properties).toMatchObject({
             project_kind: 'user',
@@ -126,5 +140,20 @@ describe('analytics', () => {
         expect(captured[2].properties).toMatchObject({
             duration_sec: 42,
         });
+        expect(captured[3].properties).toMatchObject({
+            tokens_input: 100,
+            tokens_output: 20,
+            tokens_reasoning: 5,
+            tokens_cache_read: 10,
+            tokens_cache_write: 2,
+            tokens_total: 137,
+            cost: 0,
+            assistant_message_count: 2,
+            is_subagent: false,
+            model: 'gpt-5.3-codex',
+            provider: 'openai',
+            install_id: '33333333-3333-4333-8333-333333333333',
+            schema_version: 1,
+        });
     });
 });

package/dist/anthropic-account-identity.js

@@ -1,3 +1,4 @@
+// LEGACY rotation, superseded by @subrouter/opencode. See oauth-rotation-shared.ts.
 // Helpers for extracting and normalizing Anthropic OAuth account identity.
 const identityHintKeys = new Set(['user', 'profile', 'account', 'viewer']);
 const idKeys = ['user_id', 'userId', 'account_id', 'accountId', 'id', 'sub'];

package/dist/anthropic-auth-plugin.js

@@ -1,3 +1,4 @@
+// LEGACY rotation, superseded by @subrouter/opencode. See oauth-rotation-shared.ts.
 /**
  * Anthropic OAuth authentication plugin for OpenCode.
  *

package/dist/anthropic-auth-state.js

@@ -1,3 +1,4 @@
+// LEGACY rotation, superseded by @subrouter/opencode. See oauth-rotation-shared.ts.
 /**
  * Anthropic OAuth account store and rotation.
  * Uses shared utilities from oauth-rotation-shared.ts for file locking,

package/dist/bin.js

@@ -32,14 +32,57 @@ else {
     console.error('no subcommand detected. kimaki will automatically restart on crash');
     console.error();
     const EXIT_NO_RESTART = 64;
+    // Keep in sync with EXIT_TEMPFAIL in cli-runner.ts. Network-down login
+    // failures use this so a long outage cannot trip the crash-loop detector.
+    const EXIT_TEMPFAIL = 75;
     const MAX_RAPID_RESTARTS = 5;
     const RAPID_RESTART_WINDOW_MS = 60_000;
     const RESTART_DELAY_MS = 2_000;
+    const CHILD_EXIT_DEADLINE_MS = 15_000;
     const restartTimestamps = [];
+    let tempFailAttempts = 0;
     let child = null;
     // Track when we forwarded a termination signal so we don't restart after graceful shutdown
     let shutdownRequested = false;
+    let forceKillTimer = null;
+    let scheduledRestart = null;
+    function clearForceKillTimer() {
+        if (!forceKillTimer)
+            return;
+        clearTimeout(forceKillTimer);
+        forceKillTimer = null;
+    }
+    function clearScheduledRestart() {
+        if (!scheduledRestart)
+            return;
+        clearTimeout(scheduledRestart);
+        scheduledRestart = null;
+    }
+    function killChild(signal) {
+        const target = child;
+        if (!target) {
+            if (shutdownRequested) {
+                clearScheduledRestart();
+                process.exit(0);
+            }
+            return;
+        }
+        const sent = target.kill(signal);
+        if (!sent || forceKillTimer)
+            return;
+        forceKillTimer = setTimeout(() => {
+            forceKillTimer = null;
+            if (child !== target)
+                return;
+            console.error(`[kimaki] Child did not exit within ${CHILD_EXIT_DEADLINE_MS / 1000}s, force-killing it`);
+            target.kill('SIGKILL');
+        }, CHILD_EXIT_DEADLINE_MS);
+        forceKillTimer.unref();
+    }
     function start() {
+        if (shutdownRequested)
+            return;
+        scheduledRestart = null;
         if (!fs.existsSync(HEAP_SNAPSHOT_DIR)) {
             fs.mkdirSync(HEAP_SNAPSHOT_DIR, { recursive: true });
         }
@@ -48,32 +91,42 @@ else {
             `--diagnostic-dir=${HEAP_SNAPSHOT_DIR}`,
         ];
         const args = [...heapArgs, ...process.execArgv, ...process.argv.slice(1)];
-        child = spawn(process.argv[0], args, {
+        const currentChild = spawn(process.argv[0], args, {
             stdio: 'inherit',
             env: { ...process.env, __KIMAKI_CHILD: '1' },
         });
-        child.on('exit', (code, signal) => {
+        child = currentChild;
+        currentChild.on('exit', (code, signal) => {
+            if (child === currentChild)
+                child = null;
+            clearForceKillTimer();
             if (code === 0 || code === EXIT_NO_RESTART || shutdownRequested) {
                 process.exit(code ?? 0);
                 return;
             }
             const now = Date.now();
-            restartTimestamps.push(now);
-            while (restartTimestamps.length > 0 &&
-                restartTimestamps[0] < now - RAPID_RESTART_WINDOW_MS) {
-                restartTimestamps.shift();
-            }
-            if (restartTimestamps.length > MAX_RAPID_RESTARTS) {
-                console.error(`[kimaki] Crash loop detected (${MAX_RAPID_RESTARTS} crashes in ${RAPID_RESTART_WINDOW_MS / 1000}s), exiting`);
-                process.exit(1);
-                return;
+            const isTempFail = code === EXIT_TEMPFAIL;
+            if (!isTempFail) {
+                restartTimestamps.push(now);
+                while (restartTimestamps.length > 0 &&
+                    restartTimestamps[0] < now - RAPID_RESTART_WINDOW_MS) {
+                    restartTimestamps.shift();
+                }
+                if (restartTimestamps.length > MAX_RAPID_RESTARTS) {
+                    console.error(`[kimaki] Crash loop detected (${MAX_RAPID_RESTARTS} crashes in ${RAPID_RESTART_WINDOW_MS / 1000}s), exiting`);
+                    process.exit(1);
+                    return;
+                }
             }
             const reason = signal ? `signal ${signal}` : `code ${code}`;
             // Progressive backoff: 2s, 4s, 8s, 16s, capped at 30s.
             // Prevents hammering DNS/gateway during sustained network outages.
-            const delay = Math.min(RESTART_DELAY_MS * 2 ** (restartTimestamps.length - 1), 30_000);
+            const backoffStep = isTempFail
+                ? Math.min(tempFailAttempts++, 4)
+                : restartTimestamps.length - 1;
+            const delay = Math.min(RESTART_DELAY_MS * 2 ** backoffStep, 30_000);
             console.error(`[kimaki] Process exited with ${reason}, restarting in ${(delay / 1000).toFixed(0)}s...`);
-            setTimeout(start, delay);
+            scheduledRestart = setTimeout(start, delay);
         });
     }
     // Forward signals to child so graceful shutdown and heap snapshots work.
@@ -81,13 +134,14 @@ else {
     for (const sig of ['SIGTERM', 'SIGINT']) {
         process.on(sig, () => {
             shutdownRequested = true;
-            child?.kill(sig);
-        });
-    }
-    for (const sig of ['SIGUSR1', 'SIGUSR2']) {
-        process.on(sig, () => {
-            child?.kill(sig);
+            killChild(sig);
         });
     }
+    process.on('SIGUSR1', () => {
+        child?.kill('SIGUSR1');
+    });
+    process.on('SIGUSR2', () => {
+        killChild('SIGUSR2');
+    });
     start();
 }