kimaki 0.4.78 → 0.4.80

package/dist/hrana-server.js

@@ -31,15 +31,79 @@
 import fs from 'node:fs';
 import http from 'node:http';
 import path from 'node:path';
+import crypto from 'node:crypto';
 import Database from 'libsql';
 import * as errore from 'errore';
 import { createLogger, LogPrefix } from './logger.js';
 import { ServerStartError, FetchError } from './errors.js';
 import { getLockPort } from './config.js';
+import { store } from './store.js';
 const hranaLogger = createLogger(LogPrefix.DB);
 let db = null;
 let server = null;
 let hranaUrl = null;
+let discordGatewayReady = false;
+let readyWaiters = [];
+export function markDiscordGatewayReady() {
+    if (discordGatewayReady) {
+        return;
+    }
+    discordGatewayReady = true;
+    for (const resolve of readyWaiters) {
+        resolve();
+    }
+    readyWaiters = [];
+}
+async function waitForDiscordGatewayReady({ timeoutMs }) {
+    if (discordGatewayReady) {
+        return true;
+    }
+    const readyPromise = new Promise((resolve) => {
+        readyWaiters.push(() => {
+            resolve(true);
+        });
+    });
+    const timeoutPromise = new Promise((resolve) => {
+        setTimeout(() => {
+            resolve(false);
+        }, timeoutMs);
+    });
+    return Promise.race([readyPromise, timeoutPromise]);
+}
+function getRequestAuthToken(req) {
+    const authorizationHeader = req.headers.authorization;
+    if (typeof authorizationHeader === 'string' && authorizationHeader.startsWith('Bearer ')) {
+        return authorizationHeader.slice('Bearer '.length);
+    }
+    return null;
+}
+// Timing-safe comparison to prevent timing attacks when the hrana server
+// is internet-facing (bindAll=true / KIMAKI_INTERNET_REACHABLE_URL set).
+function isAuthorizedRequest(req) {
+    const expectedToken = store.getState().gatewayToken;
+    if (!expectedToken) {
+        return false;
+    }
+    const providedToken = getRequestAuthToken(req);
+    if (!providedToken) {
+        return false;
+    }
+    const expectedBuf = Buffer.from(expectedToken, 'utf8');
+    const providedBuf = Buffer.from(providedToken, 'utf8');
+    if (expectedBuf.length !== providedBuf.length) {
+        return false;
+    }
+    return crypto.timingSafeEqual(expectedBuf, providedBuf);
+}
+function ensureServiceAuthTokenInStore() {
+    const existingToken = store.getState().gatewayToken;
+    if (existingToken) {
+        return existingToken;
+    }
+    const generatedToken = `${crypto.randomUUID()}:${crypto.randomBytes(32).toString('hex')}`;
+    store.setState({ gatewayToken: generatedToken });
+    return generatedToken;
+}
 /**
  * Get the Hrana HTTP URL for injecting into plugin child processes.
  * Returns null if the server hasn't been started yet.
@@ -54,18 +118,62 @@ export function getHranaUrl() {
  * Handles single-instance enforcement: if the port is occupied, kills the
  * existing process first.
  */
-export async function startHranaServer({ dbPath, }) {
+export async function startHranaServer({ dbPath, bindAll = false, }) {
     if (server && db && hranaUrl)
         return hranaUrl;
     const port = getLockPort();
+    const bindHost = bindAll ? '0.0.0.0' : '127.0.0.1';
+    const serviceAuthToken = ensureServiceAuthTokenInStore();
+    process.env.KIMAKI_DB_AUTH_TOKEN = serviceAuthToken;
     fs.mkdirSync(path.dirname(dbPath), { recursive: true });
     await evictExistingInstance({ port });
-    hranaLogger.log(`Starting hrana server on 127.0.0.1:${port} with db: ${dbPath}`);
+    hranaLogger.log(`Starting hrana server on ${bindHost}:${port} with db: ${dbPath}`);
     const database = new Database(dbPath);
     database.exec('PRAGMA journal_mode = WAL');
     database.exec('PRAGMA busy_timeout = 5000');
     db = database;
-    const handler = createHranaHandler(database);
+    const hranaHandler = createHranaHandler(database);
+    // Combined handler: all control/data routes require the same service auth token.
+    const handler = async (req, res) => {
+        const pathname = new URL(req.url || '/', 'http://localhost').pathname;
+        if (pathname === '/kimaki/wake') {
+            if (req.method !== 'POST') {
+                res.writeHead(405, { 'content-type': 'application/json' });
+                res.end(JSON.stringify({ error: 'method_not_allowed' }));
+                return;
+            }
+            if (!isAuthorizedRequest(req)) {
+                res.writeHead(401, { 'content-type': 'application/json' });
+                res.end(JSON.stringify({ error: 'unauthorized' }));
+                return;
+            }
+            const isReady = await waitForDiscordGatewayReady({ timeoutMs: 30_000 });
+            if (!isReady) {
+                res.writeHead(504, { 'content-type': 'application/json' });
+                res.end(JSON.stringify({ ready: false, error: 'timeout_waiting_for_discord_ready' }));
+                return;
+            }
+            res.writeHead(200, { 'content-type': 'application/json' });
+            res.end(JSON.stringify({ ready: true }));
+            return;
+        }
+        // Hrana routes: /health, /v2, /v2/pipeline
+        if (pathname === '/health') {
+            hranaHandler(req, res);
+            return;
+        }
+        if (pathname === '/v2' || pathname === '/v2/pipeline') {
+            if (!isAuthorizedRequest(req)) {
+                res.writeHead(401, { 'content-type': 'application/json' });
+                res.end(JSON.stringify({ error: 'unauthorized' }));
+                return;
+            }
+            hranaHandler(req, res);
+            return;
+        }
+        res.writeHead(404);
+        res.end();
+    };
     const started = await new Promise((resolve) => {
         const srv = http.createServer(handler);
         srv.on('error', (err) => {
@@ -76,7 +184,7 @@ export async function startHranaServer({ dbPath, }) {
                     : err.message,
             }));
         });
-        srv.listen(port, '127.0.0.1', () => {
+        srv.listen(port, bindHost, () => {
             server = srv;
             resolve(true);
         });
@@ -108,6 +216,8 @@ export async function stopHranaServer() {
         db = null;
     }
     hranaUrl = null;
+    discordGatewayReady = false;
+    readyWaiters = [];
     hranaLogger.log('Hrana server stopped');
 }
 // ── Value encoding/decoding ──────────────────────────────────────────────

package/dist/interaction-handler.js

@@ -7,6 +7,7 @@ import { handleNewWorktreeCommand, handleNewWorktreeAutocomplete, } from './comm
 import { handleMergeWorktreeCommand, handleMergeWorktreeAutocomplete, } from './commands/merge-worktree.js';
 import { handleToggleWorktreesCommand } from './commands/worktree-settings.js';
 import { handleWorktreesCommand } from './commands/worktrees.js';
+import { handleTasksCommand } from './commands/tasks.js';
 import { handleToggleMentionModeCommand } from './commands/mention-mode.js';
 import { handleResumeCommand, handleResumeAutocomplete, } from './commands/resume.js';
 import { handleAddProjectCommand, handleAddProjectAutocomplete, } from './commands/add-project.js';
@@ -20,7 +21,7 @@ import { handleDiffCommand } from './commands/diff.js';
 import { handleForkCommand, handleForkSelectMenu } from './commands/fork.js';
 import { handleModelCommand, handleProviderSelectMenu, handleModelSelectMenu, handleModelScopeSelectMenu, } from './commands/model.js';
 import { handleUnsetModelCommand } from './commands/unset-model.js';
-import { handleLoginCommand, handleLoginProviderSelectMenu, handleLoginMethodSelectMenu, handleApiKeyModalSubmit, } from './commands/login.js';
+import { handleLoginCommand, handleLoginSelect, handleLoginTextButton, handleLoginTextModalSubmit, handleLoginApiKeyButton, handleOAuthCodeButton, handleOAuthCodeModalSubmit, handleApiKeyModalSubmit, } from './commands/login.js';
 import { handleTranscriptionApiKeyButton, handleTranscriptionApiKeyCommand, handleTranscriptionApiKeyModalSubmit, } from './commands/gemini-apikey.js';
 import { handleAgentCommand, handleAgentSelectMenu, handleQuickAgentCommand, } from './commands/agent.js';
 import { handleAskQuestionSelectMenu } from './commands/ask-question.js';
@@ -112,6 +113,12 @@ export function registerInteractionHandler({ discordClient, appId, }) {
                             appId,
                         });
                         return;
+                    case 'tasks':
+                        await handleTasksCommand({
+                            command: interaction,
+                            appId,
+                        });
+                        return;
                     case 'toggle-mention-mode':
                         await handleToggleMentionModeCommand({
                             command: interaction,
@@ -260,6 +267,18 @@ export function registerInteractionHandler({ discordClient, appId, }) {
                     await handleFileUploadButton(interaction);
                     return;
                 }
+                if (customId.startsWith('login_text_btn:')) {
+                    await handleLoginTextButton(interaction);
+                    return;
+                }
+                if (customId.startsWith('login_apikey_btn:')) {
+                    await handleLoginApiKeyButton(interaction);
+                    return;
+                }
+                if (customId.startsWith('login_oauth_code_btn:')) {
+                    await handleOAuthCodeButton(interaction);
+                    return;
+                }
                 if (customId.startsWith('action_button:')) {
                     await handleActionButton(interaction);
                     return;
@@ -323,12 +342,8 @@ export function registerInteractionHandler({ discordClient, appId, }) {
                     await handleMcpSelectMenu(interaction);
                     return;
                 }
-                if (customId.startsWith('login_provider:')) {
-                    await handleLoginProviderSelectMenu(interaction);
-                    return;
-                }
-                if (customId.startsWith('login_method:')) {
-                    await handleLoginMethodSelectMenu(interaction);
+                if (customId.startsWith('login_select:')) {
+                    await handleLoginSelect(interaction);
                     return;
                 }
                 return;
@@ -346,6 +361,14 @@ export function registerInteractionHandler({ discordClient, appId, }) {
                     await handleApiKeyModalSubmit(interaction);
                     return;
                 }
+                if (customId.startsWith('login_text:')) {
+                    await handleLoginTextModalSubmit(interaction);
+                    return;
+                }
+                if (customId.startsWith('login_oauth_code:')) {
+                    await handleOAuthCodeModalSubmit(interaction);
+                    return;
+                }
                 if (customId.startsWith('transcription_apikey_modal:')) {
                     await handleTranscriptionApiKeyModalSubmit(interaction);
                     return;

package/dist/ipc-tools-plugin.js

@@ -0,0 +1,186 @@
+// OpenCode plugin that provides IPC-based tools for Discord interaction:
+// - kimaki_file_upload: prompts the Discord user to upload files via native picker
+// - kimaki_action_buttons: shows clickable action buttons in the Discord thread
+//
+// Tools communicate with the bot process via IPC rows in SQLite (the plugin
+// runs inside the OpenCode server process, not the bot process).
+//
+// Exported from opencode-plugin.ts — each export is treated as a separate
+// plugin by OpenCode's plugin loader.
+import dedent from 'string-dedent';
+import { z } from 'zod';
+import { getPrisma, createIpcRequest, getIpcRequestById } from './database.js';
+import { setDataDir } from './config.js';
+import { createLogger, LogPrefix, setLogFilePath } from './logger.js';
+import { initSentry } from './sentry.js';
+// Inlined from '@opencode-ai/plugin/tool' because the subpath value import
+// fails at runtime in global npm installs (#35). Opencode loads this plugin
+// file in its own process and resolves modules from kimaki's install dir,
+// but the '/tool' subpath export isn't found by opencode's module resolver.
+// The type-only imports above are fine (erased at compile time).
+//
+// NOTE: @opencode-ai/plugin bundles its own zod 4.1.x as a hard dependency
+// while goke (used by cli.ts) requires zod 4.3.x. This version skew makes
+// the Plugin return type structurally incompatible with our local tool()
+// even though runtime behavior is identical. ipcToolsPlugin is cast to
+// Plugin via unknown to bypass this purely type-level incompatibility.
+function tool(input) {
+    return input;
+}
+const logger = createLogger(LogPrefix.OPENCODE);
+const FILE_UPLOAD_TIMEOUT_MS = 6 * 60 * 1000;
+const DEFAULT_FILE_UPLOAD_MAX_FILES = 5;
+const ACTION_BUTTON_TIMEOUT_MS = 30 * 1000;
+// @opencode-ai/plugin bundles zod 4.1.x as a hard dep; our code uses 4.3.x
+// (required by goke for ~standard.jsonSchema). The Plugin return type is
+// structurally incompatible due to _zod.version.minor skew even though
+// runtime behavior is identical. `any` bypasses the type-level mismatch —
+// opencode's plugin loader doesn't care about the zod version at runtime.
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+const ipcToolsPlugin = async () => {
+    initSentry();
+    const dataDir = process.env.KIMAKI_DATA_DIR;
+    if (dataDir) {
+        setDataDir(dataDir);
+        setLogFilePath(dataDir);
+    }
+    return {
+        tool: {
+            kimaki_file_upload: tool({
+                description: 'Prompt the Discord user to upload files using a native file picker modal. ' +
+                    'The user sees a button, clicks it, and gets a file upload dialog. ' +
+                    'Returns the local file paths of downloaded files in the project directory. ' +
+                    'Use this when you need the user to provide files (images, documents, configs, etc.). ' +
+                    'IMPORTANT: Always call this tool last in your message, after all text parts.',
+                args: {
+                    prompt: z
+                        .string()
+                        .describe('Message shown to the user explaining what files to upload'),
+                    maxFiles: z
+                        .number()
+                        .min(1)
+                        .max(10)
+                        .optional()
+                        .describe('Maximum number of files the user can upload (1-10, default 5)'),
+                },
+                async execute({ prompt, maxFiles }, context) {
+                    const prisma = await getPrisma();
+                    const row = await prisma.thread_sessions.findFirst({
+                        where: { session_id: context.sessionID },
+                        select: { thread_id: true },
+                    });
+                    if (!row?.thread_id) {
+                        return 'Could not find thread for current session';
+                    }
+                    const ipcRow = await createIpcRequest({
+                        type: 'file_upload',
+                        sessionId: context.sessionID,
+                        threadId: row.thread_id,
+                        payload: JSON.stringify({
+                            prompt,
+                            maxFiles: maxFiles || DEFAULT_FILE_UPLOAD_MAX_FILES,
+                            directory: context.directory,
+                        }),
+                    });
+                    const deadline = Date.now() + FILE_UPLOAD_TIMEOUT_MS;
+                    const POLL_INTERVAL_MS = 300;
+                    while (Date.now() < deadline) {
+                        await new Promise((resolve) => {
+                            setTimeout(resolve, POLL_INTERVAL_MS);
+                        });
+                        const updated = await getIpcRequestById({ id: ipcRow.id });
+                        if (!updated || updated.status === 'cancelled') {
+                            return 'File upload was cancelled';
+                        }
+                        if (updated.response) {
+                            const parsed = JSON.parse(updated.response);
+                            if (parsed.error) {
+                                return `File upload failed: ${parsed.error}`;
+                            }
+                            const filePaths = parsed.filePaths || [];
+                            if (filePaths.length === 0) {
+                                return 'No files were uploaded (user may have cancelled or sent a new message)';
+                            }
+                            return `Files uploaded successfully:\n${filePaths.join('\n')}`;
+                        }
+                    }
+                    return 'File upload timed out - user did not upload files within the time limit';
+                },
+            }),
+            kimaki_action_buttons: tool({
+                description: dedent `
+          Show action buttons in the current Discord thread for quick confirmations.
+          Use this when the user can respond by clicking one of up to 3 buttons.
+          Prefer a single button whenever possible.
+          Default color is white (same visual style as permission deny button).
+          If you need more than 3 options, use the question tool instead.
+          IMPORTANT: Always call this tool last in your message, after all text parts.
+
+          Examples:
+          - buttons: [{"label":"Yes, proceed"}]
+          - buttons: [{"label":"Approve","color":"green"}]
+          - buttons: [
+              {"label":"Confirm","color":"blue"},
+              {"label":"Cancel","color":"white"}
+            ]
+        `,
+                args: {
+                    buttons: z
+                        .array(z.object({
+                        label: z
+                            .string()
+                            .min(1)
+                            .max(80)
+                            .describe('Button label shown to the user (1-80 chars)'),
+                        color: z
+                            .enum(['white', 'blue', 'green', 'red'])
+                            .optional()
+                            .describe('Optional button color. white is default and preferred for most confirmations.'),
+                    }))
+                        .min(1)
+                        .max(3)
+                        .describe('Array of 1-3 action buttons. Prefer one button whenever possible.'),
+                },
+                async execute({ buttons }, context) {
+                    const prisma = await getPrisma();
+                    const row = await prisma.thread_sessions.findFirst({
+                        where: { session_id: context.sessionID },
+                        select: { thread_id: true },
+                    });
+                    if (!row?.thread_id) {
+                        return 'Could not find thread for current session';
+                    }
+                    const ipcRow = await createIpcRequest({
+                        type: 'action_buttons',
+                        sessionId: context.sessionID,
+                        threadId: row.thread_id,
+                        payload: JSON.stringify({
+                            buttons,
+                            directory: context.directory,
+                        }),
+                    });
+                    const deadline = Date.now() + ACTION_BUTTON_TIMEOUT_MS;
+                    const POLL_INTERVAL_MS = 200;
+                    while (Date.now() < deadline) {
+                        await new Promise((resolve) => {
+                            setTimeout(resolve, POLL_INTERVAL_MS);
+                        });
+                        const updated = await getIpcRequestById({ id: ipcRow.id });
+                        if (!updated || updated.status === 'cancelled') {
+                            return 'Action button request was cancelled';
+                        }
+                        if (updated.response) {
+                            const parsed = JSON.parse(updated.response);
+                            if (parsed.error) {
+                                return `Action button request failed: ${parsed.error}`;
+                            }
+                            return `Action button(s) shown: ${buttons.map((button) => button.label).join(', ')}`;
+                        }
+                    }
+                    return 'Action button request timed out';
+                },
+            }),
+        },
+    };
+};
+export { ipcToolsPlugin };

package/dist/message-preprocessing.js

@@ -8,6 +8,7 @@
 // preserving arrival order without a separate threadIngressQueue.
 import { resolveMentions, getFileAttachments, getTextAttachments, } from './message-formatting.js';
 import { processVoiceAttachment } from './voice-handler.js';
+import { isVoiceAttachment } from './voice-attachment.js';
 import { initializeOpencodeForDirectory } from './opencode.js';
 import { getCompactSessionContext, getLastSessionId } from './markdown.js';
 import { getThreadSession } from './database.js';
@@ -28,6 +29,22 @@ function extractQueueSuffix(prompt) {
     }
     return { prompt: prompt.replace(QUEUE_SUFFIX_RE, '').trimEnd(), forceQueue: true };
 }
+function shouldSkipEmptyPrompt({ message, prompt, images, hasVoiceAttachment, }) {
+    if (prompt.trim()) {
+        return false;
+    }
+    if ((images?.length || 0) > 0) {
+        return false;
+    }
+    const inferredVoiceAttachment = message.attachments.some((attachment) => {
+        return isVoiceAttachment(attachment);
+    });
+    if (!hasVoiceAttachment && !inferredVoiceAttachment && message.attachments.size === 0) {
+        return false;
+    }
+    voiceLogger.warn(`[INGRESS] Skipping empty prompt after preprocessing attachments=${message.attachments.size} hasVoiceAttachment=${hasVoiceAttachment} inferredVoiceAttachment=${inferredVoiceAttachment}`);
+    return true;
+}
 /**
  * Pre-process a message in an existing thread (thread already has a session or
  * needs a new one). Handles voice transcription, text/file attachments, and
@@ -111,14 +128,25 @@ export async function preprocessExistingThreadMessage({ message, thread, project
     if (hasVoiceAttachment && !voiceResult && !messageContent.trim()) {
         return { prompt: '', mode: 'opencode', skip: true };
     }
+    // Extract queue suffix from raw message content BEFORE appending text
+    // attachments. Otherwise a text file attachment pushes "? queue" away from
+    // the end of the string and the regex fails to match.
+    const qs = extractQueueSuffix(messageContent);
     const fileAttachments = await getFileAttachments(message);
     const textAttachmentsContent = await getTextAttachments(message);
-    const promptWithAttachments = textAttachmentsContent
-        ? `${messageContent}\n\n${textAttachmentsContent}`
-        : messageContent;
-    const qs = extractQueueSuffix(promptWithAttachments);
+    const prompt = textAttachmentsContent
+        ? `${qs.prompt}\n\n${textAttachmentsContent}`
+        : qs.prompt;
+    if (shouldSkipEmptyPrompt({
+        message,
+        prompt,
+        images: fileAttachments,
+        hasVoiceAttachment,
+    })) {
+        return { prompt: '', mode: 'opencode', skip: true };
+    }
     return {
-        prompt: qs.prompt,
+        prompt,
         images: fileAttachments.length > 0 ? fileAttachments : undefined,
         mode: qs.forceQueue || voiceResult?.queueMessage ? 'local-queue' : 'opencode',
     };
@@ -148,7 +176,7 @@ export async function preprocessNewSessionMessage({ message, thread, projectDire
     const starterMessage = await thread
         .fetchStarterMessage()
         .catch((error) => {
-        logger.warn(`[SESSION] Failed to fetch starter message for thread ${thread.id}:`, error instanceof Error ? error.message : String(error));
+        logger.warn(`[SESSION] Failed to fetch starter message for thread ${thread.id}:`, error instanceof Error ? error.stack : String(error));
         return null;
     });
     if (starterMessage && starterMessage.content !== message.content) {
@@ -162,6 +190,13 @@ export async function preprocessNewSessionMessage({ message, thread, projectDire
         }
     }
     const qs = extractQueueSuffix(prompt);
+    if (shouldSkipEmptyPrompt({
+        message,
+        prompt: qs.prompt,
+        hasVoiceAttachment,
+    })) {
+        return { prompt: '', mode: 'opencode', skip: true };
+    }
     return {
         prompt: qs.prompt,
         mode: qs.forceQueue || voiceResult?.queueMessage ? 'local-queue' : 'opencode',
@@ -187,14 +222,24 @@ export async function preprocessNewThreadMessage({ message, thread, projectDirec
     if (hasVoiceAttachment && !voiceResult && !messageContent.trim()) {
         return { prompt: '', mode: 'opencode', skip: true };
     }
+    // Extract queue suffix from raw message content BEFORE appending text
+    // attachments (same fix as preprocessExistingThreadMessage).
+    const qs = extractQueueSuffix(messageContent);
     const fileAttachments = await getFileAttachments(message);
     const textAttachmentsContent = await getTextAttachments(message);
-    const promptWithAttachments = textAttachmentsContent
-        ? `${messageContent}\n\n${textAttachmentsContent}`
-        : messageContent;
-    const qs = extractQueueSuffix(promptWithAttachments);
+    const prompt = textAttachmentsContent
+        ? `${qs.prompt}\n\n${textAttachmentsContent}`
+        : qs.prompt;
+    if (shouldSkipEmptyPrompt({
+        message,
+        prompt,
+        images: fileAttachments,
+        hasVoiceAttachment,
+    })) {
+        return { prompt: '', mode: 'opencode', skip: true };
+    }
     return {
-        prompt: qs.prompt,
+        prompt,
         images: fileAttachments.length > 0 ? fileAttachments : undefined,
         mode: qs.forceQueue || voiceResult?.queueMessage ? 'local-queue' : 'opencode',
     };

package/dist/onboarding-welcome.js

@@ -32,6 +32,6 @@ export async function sendWelcomeMessage({ channel, mentionUserId, }) {
         logger.log(`Sent welcome message with thread to #${channel.name}`);
     }
     catch (error) {
-        logger.warn(`Failed to send welcome message to #${channel.name}: ${error instanceof Error ? error.message : String(error)}`);
+        logger.warn(`Failed to send welcome message to #${channel.name}: ${error instanceof Error ? error.stack : String(error)}`);
     }
 }