kimaki 0.4.90 → 0.4.91

package/dist/opencode-command-detection.test.js

@@ -0,0 +1,210 @@
+import { describe, test, expect } from 'vitest';
+import { extractLeadingOpencodeCommand } from './opencode-command-detection.js';
+const fixtures = [
+    {
+        name: 'build',
+        discordCommandName: 'build-cmd',
+        description: 'build the project',
+        source: 'command',
+    },
+    {
+        name: 'namespace:foo',
+        discordCommandName: 'namespace-foo-cmd',
+        description: 'namespaced',
+        source: 'command',
+    },
+    {
+        name: 'review',
+        discordCommandName: 'review-skill',
+        description: 'review skill',
+        source: 'skill',
+    },
+    {
+        name: 'plan',
+        discordCommandName: 'plan-mcp-prompt',
+        description: 'plan via mcp',
+        source: 'mcp',
+    },
+];
+describe('extractLeadingOpencodeCommand', () => {
+    test('plain /build with args', () => {
+        expect(extractLeadingOpencodeCommand('/build foo bar', fixtures)).toMatchInlineSnapshot(`
+      {
+        "command": {
+          "arguments": "foo bar",
+          "name": "build",
+        },
+      }
+    `);
+    });
+    test('plain /build no args', () => {
+        expect(extractLeadingOpencodeCommand('/build', fixtures))
+            .toMatchInlineSnapshot(`
+      {
+        "command": {
+          "arguments": "",
+          "name": "build",
+        },
+      }
+    `);
+    });
+    test('/build-cmd suffix resolves to build', () => {
+        expect(extractLeadingOpencodeCommand('/build-cmd hello world', fixtures)).toMatchInlineSnapshot(`
+      {
+        "command": {
+          "arguments": "hello world",
+          "name": "build",
+        },
+      }
+    `);
+    });
+    test('-skill suffix', () => {
+        expect(extractLeadingOpencodeCommand('/review-skill a b', fixtures)).toMatchInlineSnapshot(`
+      {
+        "command": {
+          "arguments": "a b",
+          "name": "review",
+        },
+      }
+    `);
+    });
+    test('-mcp-prompt suffix', () => {
+        expect(extractLeadingOpencodeCommand('/plan-mcp-prompt go', fixtures)).toMatchInlineSnapshot(`
+      {
+        "command": {
+          "arguments": "go",
+          "name": "plan",
+        },
+      }
+    `);
+    });
+    test('original namespaced name with colon', () => {
+        expect(extractLeadingOpencodeCommand('/namespace:foo arg', fixtures)).toMatchInlineSnapshot(`
+      {
+        "command": {
+          "arguments": "arg",
+          "name": "namespace:foo",
+        },
+      }
+    `);
+    });
+    test('discord-sanitized namespaced name', () => {
+        expect(extractLeadingOpencodeCommand('/namespace-foo-cmd arg', fixtures)).toMatchInlineSnapshot(`
+      {
+        "command": {
+          "arguments": "arg",
+          "name": "namespace:foo",
+        },
+      }
+    `);
+    });
+    test('kimaki-cli prefix on its own line', () => {
+        expect(extractLeadingOpencodeCommand('» **kimaki-cli:**\n/build foo bar', fixtures)).toMatchInlineSnapshot(`
+      {
+        "command": {
+          "arguments": "foo bar",
+          "name": "build",
+        },
+      }
+    `);
+    });
+    test('queue-style user prefix on its own line', () => {
+        expect(extractLeadingOpencodeCommand('» **Tommy:**\n/build hey', fixtures)).toMatchInlineSnapshot(`
+      {
+        "command": {
+          "arguments": "hey",
+          "name": "build",
+        },
+      }
+    `);
+    });
+    test('username containing asterisk on its own line', () => {
+        expect(extractLeadingOpencodeCommand('» **A*B:**\n/build hi', fixtures)).toMatchInlineSnapshot(`
+      {
+        "command": {
+          "arguments": "hi",
+          "name": "build",
+        },
+      }
+    `);
+    });
+    test('Context from thread wrapping still detects command', () => {
+        const wrapped = 'Context from thread:\nsome starter text\n\nUser request:\n/build foo';
+        expect(extractLeadingOpencodeCommand(wrapped, fixtures))
+            .toMatchInlineSnapshot(`
+      {
+        "command": {
+          "arguments": "foo",
+          "name": "build",
+        },
+      }
+    `);
+    });
+    test('unknown command returns null', () => {
+        expect(extractLeadingOpencodeCommand('/nothing here', fixtures)).toMatchInlineSnapshot(`null`);
+    });
+    test('no leading slash on any line returns null', () => {
+        expect(extractLeadingOpencodeCommand('hello /build\nmore text', fixtures)).toMatchInlineSnapshot(`null`);
+    });
+    test('just slash returns null', () => {
+        expect(extractLeadingOpencodeCommand('/', fixtures)).toMatchInlineSnapshot(`null`);
+    });
+    test('empty string returns null', () => {
+        expect(extractLeadingOpencodeCommand('', fixtures)).toMatchInlineSnapshot(`null`);
+    });
+    test('empty registry returns null even for known-looking commands', () => {
+        expect(extractLeadingOpencodeCommand('/build foo', [])).toMatchInlineSnapshot(`null`);
+    });
+    test('leading whitespace before slash still matches', () => {
+        expect(extractLeadingOpencodeCommand('   /build foo', fixtures)).toMatchInlineSnapshot(`
+      {
+        "command": {
+          "arguments": "foo",
+          "name": "build",
+        },
+      }
+    `);
+    });
+    test('first matching line wins', () => {
+        const prompt = 'noise line\n/build first args\n/review second args';
+        expect(extractLeadingOpencodeCommand(prompt, fixtures))
+            .toMatchInlineSnapshot(`
+      {
+        "command": {
+          "arguments": "first args",
+          "name": "build",
+        },
+      }
+    `);
+    });
+    test('unknown command on one line, known on next', () => {
+        const prompt = '/unknown foo\n/build bar';
+        expect(extractLeadingOpencodeCommand(prompt, fixtures))
+            .toMatchInlineSnapshot(`
+      {
+        "command": {
+          "arguments": "bar",
+          "name": "build",
+        },
+      }
+    `);
+    });
+    test('suffix strip does not clobber a command whose name happens to end in -cmd', () => {
+        const custom = [
+            {
+                name: 'deploy-cmd',
+                discordCommandName: 'deploy-cmd-cmd',
+                description: '',
+                source: 'command',
+            },
+        ];
+        expect(extractLeadingOpencodeCommand('/deploy-cmd now', custom)).toMatchInlineSnapshot(`
+      {
+        "command": {
+          "arguments": "now",
+          "name": "deploy-cmd",
+        },
+      }
+    `);
+    });
+});

package/dist/opencode-interrupt-plugin.js

@@ -8,6 +8,53 @@
 // (createInterruptState). The plugin hooks only interact with the returned
 // API — they cannot directly touch Maps/Sets or break invariants like
 // forgetting to clear a timer.
+function toPromptParts(parts) {
+    return parts.reduce((acc, part) => {
+        if (part.type === 'text') {
+            acc.push({
+                id: part.id,
+                type: 'text',
+                text: part.text,
+                synthetic: part.synthetic,
+                ignored: part.ignored,
+                time: part.time,
+                metadata: part.metadata,
+            });
+            return acc;
+        }
+        if (part.type === 'file') {
+            acc.push({
+                id: part.id,
+                type: 'file',
+                mime: part.mime,
+                filename: part.filename,
+                url: part.url,
+                source: part.source,
+            });
+            return acc;
+        }
+        if (part.type === 'agent') {
+            acc.push({
+                id: part.id,
+                type: 'agent',
+                name: part.name,
+                source: part.source,
+            });
+            return acc;
+        }
+        if (part.type === 'subtask') {
+            acc.push({
+                id: part.id,
+                type: 'subtask',
+                prompt: part.prompt,
+                description: part.description,
+                agent: part.agent,
+            });
+            return acc;
+        }
+        return acc;
+    }, []);
+}
 const DEFAULT_INTERRUPT_STEP_TIMEOUT_MS = 3_000;
 function getInterruptStepTimeoutMsFromEnv() {
     const raw = process.env['KIMAKI_INTERRUPT_STEP_TIMEOUT_MS'];
@@ -89,7 +136,7 @@ function createInterruptState() {
         },
         // Schedule a timeout to interrupt a pending message. Cleans up any
         // existing timer for the same messageID before setting a new one.
-        schedulePending({ messageID, sessionID, delayMs, onTimeout, }) {
+        schedulePending({ messageID, sessionID, parts, delayMs, onTimeout, }) {
             const existing = pendingByMessageId.get(messageID);
             if (existing) {
                 clearTimeout(existing.timer);
@@ -100,6 +147,7 @@ function createInterruptState() {
                 started: false,
                 timer,
                 abortAfterStepMessageID: latestAssistantMessageIDBySession.get(sessionID),
+                parts,
                 agent: undefined,
                 model: undefined,
             });
@@ -159,6 +207,7 @@ const interruptOpencodeSessionOnUserMessage = async (ctx) => {
             state.schedulePending({
                 messageID,
                 sessionID,
+                parts: pending.parts,
                 delayMs: 200,
                 onTimeout: () => {
                     void interruptPendingMessage(messageID);
@@ -193,19 +242,24 @@ const interruptOpencodeSessionOnUserMessage = async (ctx) => {
                 state.clearPending(messageID);
                 return;
             }
-            // Keep the queued user message execution context across abort+resume.
-            // Without this, OpenCode re-resolves model defaults and can ignore
-            // /model session overrides (issue #77).
-            const resumeBody = { parts: [] };
+            // Resubmit the original queued user message after abort.
+            // session.abort() clears OpenCode's internal prompt queue, so resuming
+            // with an empty parts array can silently drop the user's message.
+            // Keep the original messageID + parts and preserve agent/model context so
+            // session overrides (issue #77) survive the abort + replay path.
+            const replayBody = {
+                messageID,
+                parts: currentPending.parts,
+            };
             if (currentPending.agent) {
-                resumeBody.agent = currentPending.agent;
+                replayBody.agent = currentPending.agent;
             }
             if (currentPending.model) {
-                resumeBody.model = currentPending.model;
+                replayBody.model = currentPending.model;
             }
             await ctx.client.session.promptAsync({
                 path: { id: sessionID },
-                body: resumeBody,
+                body: replayBody,
             });
             state.clearPending(messageID);
             const nextPending = state.getNextPendingForSession(sessionID);
@@ -215,6 +269,7 @@ const interruptOpencodeSessionOnUserMessage = async (ctx) => {
             state.schedulePending({
                 messageID: nextPending.messageID,
                 sessionID,
+                parts: nextPending.pending.parts,
                 delayMs: 50,
                 onTimeout: () => {
                     void interruptPendingMessage(nextPending.messageID);
@@ -288,6 +343,7 @@ const interruptOpencodeSessionOnUserMessage = async (ctx) => {
             state.schedulePending({
                 messageID,
                 sessionID,
+                parts: toPromptParts(output.parts),
                 delayMs: interruptStepTimeoutMs,
                 onTimeout: () => {
                     void interruptPendingMessage(messageID);

package/dist/opencode-interrupt-plugin.test.js

@@ -230,7 +230,10 @@ describe('interruptOpencodeSessionOnUserMessage', () => {
         expect(promptAsyncCalls).toEqual([
             {
                 path: { id: REAL_RATE_LIMIT_CASE.sessionID },
-                body: { parts: [] },
+                body: {
+                    messageID: REAL_RATE_LIMIT_CASE.queuedMessageID,
+                    parts: [{ type: 'text', text: 'user message' }],
+                },
             },
         ]);
     });
@@ -287,25 +290,7 @@ describe('interruptOpencodeSessionOnUserMessage', () => {
         expect(abortCalls).toEqual([]);
         expect(promptAsyncCalls).toEqual([]);
     });
-    // Reproduces production bug from ses_33bb324aaffeQuvMZeixQ9x11N:
-    //
-    // Timeline:
-    //   1. Session is busy streaming response to firstMsg
-    //   2. User sends userMsg (queued via promptAsync in opencode)
-    //   3. 3s timeout fires - no assistant started on userMsg
-    //   4. Plugin aborts session → session goes idle
-    //   5. Plugin sends promptAsync({parts:[]}) → opencode creates NEW empty
-    //      user message and processes THAT instead of userMsg
-    //   6. userMsg is silently lost — no assistant ever responds to it
-    //
-    // Root cause: session.abort() clears opencode's internal prompt queue.
-    // The empty promptAsync({parts:[]}) is supposed to "resume" but instead
-    // creates a separate message. The user's actual message is gone.
-    //
-    // This is a unit-level repro — it proves the plugin clears the user
-    // message from tracking without any assistant acknowledgement. A full
-    // e2e test is needed to prove the message is lost in Discord.
-    test.todo('BUG REPRO: user message dropped after abort because promptAsync({parts:[]}) replaces it', async () => {
+    test('abort recovery replays the original queued user message', async () => {
         process.env['KIMAKI_INTERRUPT_STEP_TIMEOUT_MS'] = '20';
         const abortCalls = [];
         const promptAsyncCalls = [];
@@ -349,25 +334,18 @@ describe('interruptOpencodeSessionOnUserMessage', () => {
         await delay({ ms: 20 });
         // 5. Verify plugin aborted the session
         expect(abortCalls).toEqual([{ path: { id: sessionID } }]);
-        // 6. BUG: plugin sent promptAsync({parts:[]}) which creates a NEW empty
-        //    user message in opencode. The user's actual message (userMsgID) was
-        //    cleared from the prompt queue by abort() and is never processed.
+        // 6. Recovery should replay the queued message itself, not an empty
+        //    resume prompt. This preserves the original messageID + parts after
+        //    session.abort() clears OpenCode's internal prompt queue.
         expect(promptAsyncCalls).toEqual([
-            { path: { id: sessionID }, body: { parts: [] } },
+            {
+                path: { id: sessionID },
+                body: {
+                    messageID: userMsgID,
+                    parts: [{ type: 'text', text: 'user message' }],
+                },
+            },
         ]);
-        // 7. Verify the plugin cleared userMsgID from pending tracking.
-        //    Re-registering it via chatHook succeeds (doesn't hit the dedup guard
-        //    at line 225), proving the plugin considers it "handled" even though
-        //    no assistant message.updated with parentID=userMsgID was ever received.
-        //
-        //    In production this means the user's message is silently lost:
-        //    - opencode processed the empty prompt instead
-        //    - the bot thinks the message was dispatched (promptAsync returned OK)
-        //    - nobody re-sends the user's actual message
-        let reRegisteredWithoutDedup = false;
-        await chatHook({ sessionID, messageID: userMsgID }, createChatOutput({ sessionID, messageID: userMsgID }));
-        reRegisteredWithoutDedup = true;
-        expect(reRegisteredWithoutDedup).toBe(true);
     });
     test('real sleep interrupt trace still recovers queued interrupt message', async () => {
         process.env['KIMAKI_INTERRUPT_STEP_TIMEOUT_MS'] = '20';
@@ -414,7 +392,10 @@ describe('interruptOpencodeSessionOnUserMessage', () => {
         expect(promptAsyncCalls).toEqual([
             {
                 path: { id: REAL_SLEEP_INTERRUPT_CASE.sessionID },
-                body: { parts: [] },
+                body: {
+                    messageID: REAL_SLEEP_INTERRUPT_CASE.interruptingMessageID,
+                    parts: [{ type: 'text', text: 'user message' }],
+                },
             },
         ]);
     });
@@ -467,7 +448,10 @@ describe('interruptOpencodeSessionOnUserMessage', () => {
         expect(promptAsyncCalls).toEqual([
             {
                 path: { id: sessionID },
-                body: { parts: [] },
+                body: {
+                    messageID: queuedMessageID,
+                    parts: [{ type: 'text', text: 'user message' }],
+                },
             },
         ]);
     });

package/dist/opencode.js

@@ -314,10 +314,14 @@ async function ensureSingleServer() {
 async function startSingleServer() {
     ensureProcessCleanupHandlersRegistered();
     const port = await getOpenPort();
-    const serveArgs = ['serve', '--port', port.toString()];
-    if (store.getState().verboseOpencodeServer) {
-        serveArgs.push('--print-logs', '--log-level', 'DEBUG');
-    }
+    const serveArgs = [
+        'serve',
+        '--port',
+        port.toString(),
+        '--print-logs',
+        '--log-level',
+        'WARN',
+    ];
     const { command: spawnCommand, args: spawnArgs, windowsVerbatimArguments, } = getSpawnCommandAndArgs({
         resolvedCommand: resolveOpencodeCommand(),
         baseArgs: serveArgs,
@@ -460,7 +464,6 @@ async function startSingleServer() {
     });
     startingServerProcess = serverProcess;
     // Buffer logs until we know if server started successfully.
-    // Once ready, switch to forwarding if --verbose-opencode-server is set.
     const logBuffer = [];
     const startupStderrTail = [];
     let serverReady = false;
@@ -473,10 +476,8 @@ async function startSingleServer() {
                 logBuffer.push(...lines.map((line) => `[stdout] ${line}`));
                 return;
             }
-            if (store.getState().verboseOpencodeServer) {
-                for (const line of lines) {
-                    opencodeLogger.log(`[server:${port}] ${line}`);
-                }
+            for (const line of lines) {
+                opencodeLogger.log(line);
             }
         }
         catch (error) {
@@ -492,10 +493,8 @@ async function startSingleServer() {
                 pushStartupStderrTail({ stderrTail: startupStderrTail, chunk });
                 return;
             }
-            if (store.getState().verboseOpencodeServer) {
-                for (const line of lines) {
-                    opencodeLogger.error(`[server:${port}] ${line}`);
-                }
+            for (const line of lines) {
+                opencodeLogger.error(line);
             }
         }
         catch (error) {
@@ -561,12 +560,10 @@ async function startSingleServer() {
     }
     serverReady = true;
     opencodeLogger.log(`Server ready on port ${port}`);
-    // When verbose mode is enabled, also dump startup logs so plugin loading
-    // errors and other startup output are visible in kimaki.log.
-    if (store.getState().verboseOpencodeServer) {
-        for (const line of logBuffer) {
-            opencodeLogger.log(`[server:${port}:startup] ${line}`);
-        }
+    // Always dump startup logs so plugin loading errors and other startup output
+    // are visible in kimaki.log.
+    for (const line of logBuffer) {
+        opencodeLogger.log(line);
     }
     const server = {
         process: serverProcess,
@@ -628,7 +625,6 @@ export async function initializeOpencodeForDirectory(directory, _options) {
     }
     if (!initializedDirectories.has(directory)) {
         initializedDirectories.add(directory);
-        opencodeLogger.log(`Using shared server on port ${server.port} for directory: ${directory}`);
     }
     return () => {
         if (!singleServer) {

package/dist/pkce.js

@@ -0,0 +1,23 @@
+/**
+ * PKCE (Proof Key for Code Exchange) utilities using Web Crypto API.
+ * Zero-dependency replacement for @openauthjs/openauth/pkce.
+ * Works in Node.js 20+ and browsers.
+ *
+ * Reference: https://github.com/badlogic/pi-mono/blob/main/packages/ai/src/utils/oauth/pkce.ts
+ */
+function base64urlEncode(bytes) {
+    let binary = '';
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
+}
+export async function generatePKCE() {
+    const verifierBytes = new Uint8Array(32);
+    crypto.getRandomValues(verifierBytes);
+    const verifier = base64urlEncode(verifierBytes);
+    const data = new TextEncoder().encode(verifier);
+    const hashBuffer = await crypto.subtle.digest('SHA-256', data);
+    const challenge = base64urlEncode(new Uint8Array(hashBuffer));
+    return { verifier, challenge };
+}

package/dist/plugin-logger.js

@@ -0,0 +1,59 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import util from 'node:util';
+import { sanitizeSensitiveText, sanitizeUnknownValue } from './privacy-sanitizer.js';
+let pluginLogFilePath = null;
+export function setPluginLogFilePath(dataDir) {
+    pluginLogFilePath = path.join(dataDir, 'kimaki.log');
+}
+function formatArg(arg) {
+    if (typeof arg === 'string') {
+        return sanitizeSensitiveText(arg, { redactPaths: false });
+    }
+    const safeArg = sanitizeUnknownValue(arg, { redactPaths: false });
+    return util.inspect(safeArg, { colors: false, depth: 4 });
+}
+export function formatPluginErrorWithStack(error) {
+    if (error instanceof Error) {
+        return sanitizeSensitiveText(error.stack ?? `${error.name}: ${error.message}`, { redactPaths: false });
+    }
+    if (typeof error === 'string') {
+        return sanitizeSensitiveText(error, { redactPaths: false });
+    }
+    const safeError = sanitizeUnknownValue(error, { redactPaths: false });
+    return sanitizeSensitiveText(util.inspect(safeError, { colors: false, depth: 4 }), {
+        redactPaths: false,
+    });
+}
+function writeToFile(level, prefix, args) {
+    if (!pluginLogFilePath) {
+        return;
+    }
+    const timestamp = new Date().toISOString();
+    const message = `[${timestamp}] [${level}] [${prefix}] ${args.map(formatArg).join(' ')}\n`;
+    try {
+        fs.appendFileSync(pluginLogFilePath, message);
+    }
+    catch {
+        // Plugin logging must never break the OpenCode plugin process.
+    }
+}
+export function createPluginLogger(prefix) {
+    return {
+        log: (...args) => {
+            writeToFile('LOG', prefix, args);
+        },
+        info: (...args) => {
+            writeToFile('INFO', prefix, args);
+        },
+        warn: (...args) => {
+            writeToFile('WARN', prefix, args);
+        },
+        error: (...args) => {
+            writeToFile('ERROR', prefix, args);
+        },
+        debug: (...args) => {
+            writeToFile('DEBUG', prefix, args);
+        },
+    };
+}

package/dist/queue-advanced-permissions-typing.e2e.test.js

@@ -85,12 +85,12 @@ describe('queue advanced: typing around permissions', () => {
         "--- from: user (queue-permission-tester)
         PERMISSION_TYPING_MARKER
         --- from: assistant (TestBot)
+        ⬥ requesting external read permission
         ⚠️ **Permission Required**
         **Type:** \`external_directory\`
         Agent is accessing files outside the project. [Learn more](https://opencode.ai/docs/permissions/#external-directories)
         **Pattern:** \`/Users/morse/*\`
         ✅ Permission **accepted**
-        ⬥ requesting external read permission
         [user clicks button]
         ⬥ permission-flow-done
         *project ⋅ main ⋅ Ns ⋅ N% ⋅ deterministic-v2*"