kimaki 1.0.0 → 1.2.0

package/src/ingress.ts

@@ -39,9 +39,13 @@ import { isVoiceAttachment, parseVoiceMessage, transcribe, voiceMediaType, type
 
 const logger = createLogger('INGRESS')
 
-// Owner, Administrator, Manage Server, or a role named "Kimaki". A role named
-// "no-kimaki" always denies. Missing member data fails closed.
-export async function canUseKimaki({ guild, userId }: { guild: Guild; userId: string }): Promise<boolean> {
+// Owner, Administrator, Manage Server, or a role named "Kimaki"; with
+// --allow-all-users every member. A role named "no-kimaki" always denies.
+// Missing member data fails closed.
+export async function canUseKimaki(
+  bot: Pick<Bot, 'allowAllUsers'>,
+  { guild, userId }: { guild: Guild; userId: string },
+): Promise<boolean> {
   const member = await guild.members.fetch({ user: userId, force: true }).catch((error: Error) => error)
   if (member instanceof Error) {
     // Still denied, but say why: a REST failure must not look like a missing role.
@@ -49,19 +53,20 @@ export async function canUseKimaki({ guild, userId }: { guild: Guild; userId: st
     return false
   }
   if (!(member instanceof GuildMember)) return false
-  return memberCanUseKimaki(member)
+  return memberCanUseKimaki(bot, member)
 }
 
 // MESSAGE_CREATE carries the author's current roles: no REST fetch on the hot path.
 // Discord omits the member only for webhook and ephemeral messages, which never get here.
-function authorCanUseKimaki(message: Message<true>): Promise<boolean> {
-  if (message.member instanceof GuildMember) return Promise.resolve(memberCanUseKimaki(message.member))
-  return canUseKimaki({ guild: message.guild, userId: message.author.id })
+function authorCanUseKimaki(bot: Bot, message: Message<true>): Promise<boolean> {
+  if (message.member instanceof GuildMember) return Promise.resolve(memberCanUseKimaki(bot, message.member))
+  return canUseKimaki(bot, { guild: message.guild, userId: message.author.id })
 }
 
-function memberCanUseKimaki(member: GuildMember): boolean {
+function memberCanUseKimaki(bot: Pick<Bot, 'allowAllUsers'>, member: GuildMember): boolean {
   const roleNames = member.roles.cache.map((role) => role.name.toLowerCase())
   if (roleNames.includes('no-kimaki')) return false
+  if (bot.allowAllUsers) return true
   if (member.guild.ownerId === member.id) return true
   if (member.permissions.has(PermissionFlagsBits.Administrator)) return true
   if (member.permissions.has(PermissionFlagsBits.ManageGuild)) return true
@@ -208,7 +213,7 @@ async function handleMessage(bot: Bot, message: Message) {
   if (!project) return
   if (project.channel_type === 'voice') {
     // The text chat of the voice channel talks to the running call.
-    if (message.author.bot || thread || !(await authorCanUseKimaki(message))) return
+    if (message.author.bot || thread || !(await authorCanUseKimaki(bot, message))) return
     bot.features.voiceCalls.text(bot, {
       guildId: message.guild.id,
       channelId,
@@ -221,7 +226,7 @@ async function handleMessage(bot: Bot, message: Message) {
     if (message.author.id !== bot.discord.user?.id) return
     return handleRemoteEnvelope(bot, { message, channelId, threadId: thread?.id ?? null })
   }
-  if (!(await authorCanUseKimaki(message))) {
+  if (!(await authorCanUseKimaki(bot, message))) {
     logger.log(`ignoring ${message.author.username}: no Kimaki permission`)
     return
   }
@@ -317,7 +322,7 @@ export function registerIngress(bot: Bot) {
     serialize(message.channelId, async () => {
       const full = message.partial ? await message.fetch().catch(() => null) : message
       if (!full?.guild || !queuedItemFor(bot, { threadId: full.channelId, messageId: full.id })) return
-      if (!(await canUseKimaki({ guild: full.guild, userId: full.author.id }))) return
+      if (!(await canUseKimaki(bot, { guild: full.guild, userId: full.author.id }))) return
       // The re-queued prompt must carry the message's attachments again.
       const files = await saveAttachments({ dataDir: bot.dataDir, messageId: full.id, attachments: [...full.attachments.values()] })
       if (files instanceof Error) {

package/src/login.e2e.test.ts

@@ -40,7 +40,7 @@ test('/login API key stores an OpenCode credential and makes its provider availa
     Connect OpenAI
     Connected OpenAI. Use /model to select a model.
     **Set Model Preference**
-    **Current:** OpenCode default
+    **Current (OpenCode default):** \`deterministic-provider/deterministic-v2\`
     Select a provider:"
   `)
   expect(models.select.options.some((option) => option.value === 'openai')).toBe(true)
@@ -75,7 +75,7 @@ test('/login OAuth code uses native attempts and can activate a stored credentia
     Connect OpenAI
     Connected OpenAI. Use /model to select a model.
     **Set Model Preference**
-    **Current:** OpenCode default
+    **Current (OpenCode default):** \`deterministic-provider/deterministic-v2\`
     Select a provider:
     http://127.0.0.1/authorize
     Enter the test authorization code.

package/src/main.ts

@@ -20,7 +20,7 @@ import { createLogger } from './logger.ts'
 import { installPluginShim, watchOpencode, type OpencodeEndpoint } from './opencode-server.ts'
 import { countUserProjects } from './project.ts'
 import { createScheduler, systemClock, type Clock } from './scheduler.ts'
-import { createEventRecorder } from './session-events.ts'
+import { createEventRecorder, syncSessionTranscript } from './session-events.ts'
 import { createPluginWait, refreshCliContext } from './sessions.ts'
 import { createInteractionRegistry, registerSlashCommands } from './slash-commands.ts'
 import { createSleepLock } from './sleeps.ts'
@@ -65,6 +65,9 @@ export type StartBotOptions = {
   // How often due tasks and wakes run; null: never (tests call scheduler.runDueTasks).
   schedulerIntervalMs?: number | null
   autoWorktrees?: boolean
+  allowAllUsers?: boolean
+  // Built-in skill ids denied in new sessions (builtin-skills.ts).
+  disabledSkills?: readonly string[]
 }
 
 export type BotHandle = Bot & {
@@ -138,7 +141,12 @@ export async function startBot(options: StartBotOptions): Promise<Error | BotHan
   })
   cleanup.defer(() => effects.stop())
   const voiceCalls = createVoiceCalls({ opencodeConfigDir: options.opencodeConfigDir })
-  const eventLoop = createEventLoop({ store, db, discord, effects, recorder, analytics: options.analytics, onRunEnded: voiceCalls.runEnded })
+  const onTranscriptDue = (sessionId: string) => {
+    void oc({ opencode }, 'sync transcript', (client) => syncSessionTranscript({ client, dataDir: options.dataDir, sessionId })).then((result) => {
+      if (result instanceof Error) logger.warn(`transcript of ${sessionId} not synced`, result)
+    })
+  }
+  const eventLoop = createEventLoop({ store, db, discord, effects, recorder, analytics: options.analytics, onRunEnded: voiceCalls.runEnded, onTranscriptDue })
   const loaded = await eventLoop.load()
   if (loaded instanceof Error) return loaded
   // Before the service is used, so a service started by ensure() loads it at once.
@@ -175,6 +183,8 @@ export async function startBot(options: StartBotOptions): Promise<Error | BotHan
     transcriptionBaseUrls: options.transcriptionBaseUrls ?? {},
     realtimeBaseUrls: options.realtimeBaseUrls ?? {},
     autoWorktrees: options.autoWorktrees ?? false,
+    allowAllUsers: options.allowAllUsers ?? false,
+    disabledSkills: options.disabledSkills ?? [],
     features: { withSleepLock: createSleepLock(), waitForPlugin: createPluginWait({ opencode }), agentUi, voiceCalls },
   }
   const scheduler = createScheduler({

package/src/opencode-server.test.ts

@@ -18,7 +18,7 @@ test('supported binary wins over OpenCode 1, only OpenCode 1 is an error, nothin
 
   expect(await findOpencodeBinary({ candidates: ['kimaki-missing-opencode2', v2, v1] })).toBe(v2)
   expect(await findOpencodeBinary({ candidates: ['kimaki-missing-opencode2', v1, v2] })).toBe(v2)
-  expect(message(await findOpencodeBinary({ candidates: ['kimaki-missing-opencode2', v1] }))).toMatchInlineSnapshot(`"Kimaki now requires OpenCode 2, but <dir>/opencode is OpenCode 1.15.5. Install OpenCode 2 with: curl -fsSL https://opencode.ai/v2/install | bash (or: npm i -g @opencode/cli). Then run kimaki again"`)
+  expect(message(await findOpencodeBinary({ candidates: ['kimaki-missing-opencode2', v1] }))).toMatchInlineSnapshot(`"Kimaki now requires OpenCode 2, but <dir>/opencode is OpenCode 1.15.5. Install OpenCode 2 with: curl -fsSL https://opencode.ai/v2/install | bash (or: npm i -g @opencode/cli). Then run kimaki again. To keep using OpenCode 1, run the older Kimaki instead: npx kimaki@0"`)
   expect(await findOpencodeBinary({ candidates: ['kimaki-missing-opencode2'] })).toBe(null)
   fs.rmSync(dir, { recursive: true, force: true })
 })

package/src/opencode-server.ts

@@ -147,14 +147,16 @@ export function opencodeDbFile(): string {
 // through its index module. Always dist, also when the bot runs from src: OpenCode
 // reloads the plugin when its files change, so a src target would reload half
 // edited code on every save. dist only changes on `pnpm build`.
-// `kimaki` acts only on marked sessions; `kimaki-anthropic` (provider auth) and
-// `kimaki-session-id` (session ID in the system prompt) apply to every session.
+// `kimaki` acts only on marked sessions (except the session ID line);
+// `kimaki-anthropic` (provider auth) applies to every session.
 const PLUGIN_SHIMS = [
   { name: 'kimaki', directory: '' },
   { name: 'kimaki-anthropic', directory: 'anthropic' },
-  { name: 'kimaki-session-id', directory: 'session-id' },
 ] as const
 
+// Shims of older Kimaki versions, removed on bot start. kimaki-session-id moved into the kimaki plugin.
+const LEGACY_SHIMS = ['kimaki-session-id']
+
 export function kimakiPluginEntry(directory: string = ''): string {
   // This module is <package>/src/opencode-server.ts or <package>/dist/opencode-server.js.
   const root = path.dirname(path.dirname(fileURLToPath(import.meta.url)))
@@ -233,26 +235,27 @@ async function installShim({ configDir, name, entry }: { configDir: string; name
 // A shim whose plugin the global config already lists would load one plugin ID
 // twice. OpenCode keeps the first and reports the other as a failed plugin
 // ("Duplicate plugin ID", plugin/supervisor.ts), so the shim is removed instead.
-async function removeShim({ configDir, name }: { configDir: string; name: string }) {
+async function removeShim({ configDir, name, why }: { configDir: string; name: string; why: string }) {
   const directory = path.join(configDir, 'plugins', name)
   if (!fs.existsSync(directory)) return { file: directory, written: false }
   const removed = await fs.promises
     .rm(directory, { recursive: true, force: true })
     .catch((cause) => new ConfigError({ reason: `Cannot remove the Kimaki OpenCode plugin shim ${directory}. Check permissions of ${configDir}`, cause }))
   if (removed instanceof Error) return removed
-  logger.log(`removed OpenCode plugin shim ${directory}: opencode.json already loads this plugin`)
+  logger.log(`removed OpenCode plugin shim ${directory}: ${why}`)
   return { file: directory, written: true }
 }
 
 export async function installPluginShim({ configDir }: { configDir: string }): Promise<ConfigError | { written: boolean }> {
   const targets = await configuredPluginTargets({ configDir })
-  const results = await Promise.all(
-    PLUGIN_SHIMS.map(async (shim) => {
+  const results = await Promise.all([
+    ...PLUGIN_SHIMS.map(async (shim) => {
       const configured = await Promise.all(targets.map((target) => isKimakiPluginDirectory({ target, directory: shim.directory })))
-      if (configured.includes(true)) return removeShim({ configDir, name: shim.name })
+      if (configured.includes(true)) return removeShim({ configDir, name: shim.name, why: 'opencode.json already loads this plugin' })
       return installShim({ configDir, name: shim.name, entry: kimakiPluginEntry(shim.directory) })
     }),
-  )
+    ...LEGACY_SHIMS.map((name) => removeShim({ configDir, name, why: 'replaced by the kimaki plugin' })),
+  ])
   const failed = results.find((result) => result instanceof Error)
   if (failed instanceof Error) return failed
   return { written: results.some((result) => !(result instanceof Error) && result.written) }

package/src/plugin/index.ts

@@ -1,20 +1,36 @@
-import { Plugin } from '@opencode/plugin'
+import { Plugin, Skill } from '@opencode/plugin'
+import { Schema } from 'effect'
 import { execFile } from 'node:child_process'
 import { promisify } from 'node:util'
 import path from 'node:path'
 
 import { autostartBot } from '../autostart.ts'
+import { readBuiltinSkills } from '../builtin-skills.ts'
 import { fileEditTool, recordToolEdits } from '../file-edit-log.ts'
 import { turnContext } from '../system-prompt.ts'
 
 const exec = promisify(execFile)
 
+const decodeSkill = Schema.decodeUnknownSync(Skill.Info)
+
 const BRANCH_PREFIX = '[current git branch is '
 
 export default Plugin.define({
   id: 'kimaki',
   async setup(ctx) {
     autostartBot()
+    // Skills are per location, not per session, so OpenCode lists them in every
+    // session, TUI included. Descriptions say they are for Kimaki sessions only;
+    // the bot denies disabled ones per session (--disable-skills). A failed read
+    // only loses the skills.
+    const skills = await readBuiltinSkills()
+    if (!(skills instanceof Error)) {
+      await ctx.skill.transform((editor) => {
+        for (const skill of skills) {
+          editor.add(decodeSkill(skill))
+        }
+      })
+    }
     async function marker(sessionID: string) {
       const session = await ctx.session.get({ sessionID }).catch(() => null)
       const value: unknown = session?.metadata?.['kimaki']
@@ -43,6 +59,9 @@ export default Plugin.define({
       await ctx.session.synthetic({ sessionID: event.sessionID, text, delivery: event.delivery, resume: false }).catch(() => undefined)
     })
     await ctx.session.hook('context', async (event) => {
+      // The only prompt change for every session, TUI included. The ID never
+      // changes in a session, so the cached prompt prefix stays stable.
+      event.system.push({ type: 'text', text: `OpenCode session ID: ${event.sessionID}` })
       if (!(await marker(event.sessionID))) return
       // The <discord-user> context of each prompt, built from its metadata, so the
       // stored text stays clean for the TUI and other clients. Same metadata, same

package/src/plugin.e2e.test.ts

@@ -52,8 +52,13 @@ test('bot start writes the plugin shim, OpenCode loads it, a restart does not re
   }
   const kimakiStatus = () => pluginStatus('kimaki')
   expect(await kimakiStatus()).toBe('missing')
+  // Shim of Kimaki 1.0.0; the session ID line now lives in the kimaki plugin.
+  const legacyShim = path.join(server.configDir, 'plugins', 'kimaki-session-id')
+  fs.mkdirSync(legacyShim, { recursive: true })
+  fs.writeFileSync(path.join(legacyShim, 'index.js'), 'export default undefined\n')
 
   bot = await startTestBot({ dataDir, twin, server })
+  expect(fs.existsSync(legacyShim)).toBe(false)
   expect(fs.readFileSync(shim, 'utf8').replace(/file:\/\/\S+\/dist\//, 'file:///<kimaki>/dist/')).toMatchInlineSnapshot(`
     "// Generated by Kimaki on bot start. Loads the plugin of the running Kimaki install.
     export { default } from "file:///<kimaki>/dist/plugin/index.js"
@@ -65,7 +70,7 @@ test('bot start writes the plugin shim, OpenCode loads it, a restart does not re
   await waitForFooter({ discord: twin.discord, threadId: thread.id })
   expect(await kimakiStatus()).toBe('active')
   expect(await pluginStatus('kimaki-anthropic')).toBe('active')
-  expect(await pluginStatus('kimaki-session-id')).toBe('active')
+  expect(await pluginStatus('kimaki-session-id')).toBe('missing')
   expect(await twin.discord.thread(thread.id).text()).toMatchInlineSnapshot(`
     "--- from: user (tommy)
     plugin shim turn

package/src/prompt.ts

@@ -44,7 +44,7 @@ import { allMessages } from './session-events.ts'
 import { ensureSessionMarker, forkBtw, startSession, switchAgent, threadProject } from './sessions.ts'
 import { cancelSleep } from './sleeps.ts'
 import type { ScheduledRun } from './system-prompt.ts'
-import { localFilesBlock, type TurnContext } from './system-prompt.ts'
+import { attachmentsBlock, type PromptAttachment, type TurnContext } from './system-prompt.ts'
 import { isBusy, type UploadFile } from './thread-reducer.ts'
 import { resolveWorkingDirectory } from './worktrees.ts'
 
@@ -88,10 +88,10 @@ export async function prompt(
     echo?: string
   },
 ): Promise<OpenCodeUnavailableError | OpenCodeError | void> {
-  const { attached, localPaths } = await splitPromptFiles(files)
+  const { attached, attachments } = await splitPromptFiles(files)
   // The text stays as the user wrote it. The plugin renders the <discord-user>
   // context from this metadata into the model request only (turnContext()).
-  const discord: TurnContext = { userId: author.id, username: author.username, messageId, threadId, threadName, localFiles: localPaths }
+  const discord: TurnContext = { userId: author.id, username: author.username, messageId, threadId, threadName, attachments }
   const result = await oc(bot, 'session.prompt', (client) =>
     client.session.prompt({
       sessionID: sessionId,
@@ -113,19 +113,19 @@ export async function prompt(
 const OPENCODE_MAX_ATTACHMENT_BYTES = 20 * 1024 * 1024
 const INLINE_MEDIA_EXTENSIONS = new Set(['.png', '.jpg', '.jpeg', '.gif', '.webp', '.pdf'])
 
+// `attachments` keeps every file in the user's order, so "the second image" resolves.
 async function splitPromptFiles(files: readonly PromptFile[]) {
   const attached: Array<{ uri: string; name: string }> = []
-  const localPaths: string[] = []
+  const attachments: PromptAttachment[] = []
   for (const file of files) {
     const local = promptFilePath(file)
     const stat = await fs.promises.stat(local).catch(() => null)
     const tooBig = stat !== null && stat.size > OPENCODE_MAX_ATTACHMENT_BYTES
-    const inline = INLINE_MEDIA_EXTENSIONS.has(path.extname(file.name).toLowerCase())
     if (!tooBig) attached.push({ uri: file.uri, name: file.name })
-    // Text files also get the path: the extension cannot tell text from binary.
-    if (tooBig || !inline) localPaths.push(local)
+    // Text files count as not inline: the extension cannot tell text from binary.
+    attachments.push({ name: file.name, path: local, inline: !tooBig && INLINE_MEDIA_EXTENSIONS.has(path.extname(file.name).toLowerCase()) })
   }
-  return { attached, localPaths }
+  return { attached, attachments }
 }
 
 // Questions and permissions of the thread (root and children) that wait for the user.
@@ -299,8 +299,8 @@ async function command(
     const interrupted = await interrupt(bot, input.sessionId)
     if (interrupted instanceof Error) return interrupted
   }
-  const { attached, localPaths } = await splitPromptFiles(input.files)
-  const block = localFilesBlock(localPaths)
+  const { attached, attachments } = await splitPromptFiles(input.files)
+  const block = attachmentsBlock(attachments)
   bot.eventLoop.dispatch(input.threadId, { type: 'kimaki.command', text: typed, username: input.author.username })
   const result = await oc(bot, 'session.command', (client) =>
     client.session.command({

package/src/session-events.ts

@@ -9,7 +9,9 @@
 //
 //   kimaki session events <sessionId|threadId>   print the JSONL
 //   kimaki session read <sessionId|threadId>     print the messages from OpenCode
+//   kimaki session sync                          write <dataDir>/transcripts/<sessionId>.md for rg
 
+import crypto from 'node:crypto'
 import fs from 'node:fs'
 import path from 'node:path'
 import type { OpenCodeClient } from '@opencode/client'
@@ -106,6 +108,7 @@ export async function resolveSession({
 }
 
 type Message = Awaited<ReturnType<OpenCodeClient['message']['list']>>['data'][number]
+type Session = Awaited<ReturnType<OpenCodeClient['session']['get']>>
 
 function renderMessage(message: Message, options: { thinking?: boolean; verbose?: boolean }): string {
   const time = new Date(message.time.created).toISOString()
@@ -146,10 +149,90 @@ export async function readSessionMarkdown({
   if (session instanceof Error) return session
   const messages = await allMessages({ client, sessionId })
   if (messages instanceof Error) return messages
+  return renderSession({ session, messages, thinking, verbose })
+}
+
+function renderSession({ session, messages, thinking, verbose }: { session: Pick<Session, 'id' | 'title' | 'location'>; messages: Message[]; thinking?: boolean; verbose?: boolean }): string {
   const title = `# ${session.title} (${session.id})\n\ndirectory: ${session.location.directory}`
   return [title, ...messages.map((message) => renderMessage(message, { thinking, verbose }))].join('\n\n')
 }
 
+// Transcripts: <dataDir>/transcripts/<sessionId>.md, the `session read` markdown
+// (no thinking, no tool outputs) so agents can search every session with rg.
+// The file mtime is the session's time.updated: a file at least that new is current.
+export function transcriptsDir({ dataDir }: { dataDir: string }): string {
+  return path.join(dataDir, 'transcripts')
+}
+
+export async function writeTranscript({ client, dataDir, session }: { client: OpenCodeClient; dataDir: string; session: Pick<Session, 'id' | 'title' | 'location'> & { time: Pick<Session['time'], 'updated'> } }): Promise<OpenCodeError | ConfigError | void> {
+  const messages = await allMessages({ client, sessionId: session.id })
+  if (messages instanceof Error) return messages
+  const dir = transcriptsDir({ dataDir })
+  const file = path.join(dir, `${session.id}.md`)
+  const temp = `${file}.${process.pid}.${crypto.randomUUID()}.tmp`
+  const written = await (async () => {
+    await fs.promises.mkdir(dir, { recursive: true, mode: 0o700 })
+    await fs.promises.writeFile(temp, `${renderSession({ session, messages })}\n`, { mode: 0o600 })
+    await fs.promises.utimes(temp, session.time.updated / 1000, session.time.updated / 1000)
+    await fs.promises.rename(temp, file)
+  })().catch((cause) => new ConfigError({ reason: `Cannot write ${file}`, cause }))
+  if (written instanceof Error) await fs.promises.rm(temp, { force: true }).catch((error) => logger.warn(`cannot remove ${temp}`, error))
+  return written
+}
+
+// The bot calls this when a run ends, so transcripts of new sessions appear on their own.
+export async function syncSessionTranscript({ client, dataDir, sessionId }: { client: OpenCodeClient; dataDir: string; sessionId: string }): Promise<OpenCodeError | ConfigError | void> {
+  const session = await client.session.get({ sessionID: sessionId }).catch((cause) => new OpenCodeError({ operation: 'session.get', cause }))
+  if (session instanceof Error) return session
+  return writeTranscript({ client, dataDir, session })
+}
+
+export type SyncResult = { written: number; skipped: number; failed: number }
+
+// Sessions updated in the last `days` days (0 = all time) of every project.
+// Skips sessions whose transcript is current, unless `rebuild`.
+export async function syncTranscripts({
+  client,
+  dataDir,
+  days,
+  rebuild,
+}: {
+  client: OpenCodeClient
+  dataDir: string
+  days: number
+  rebuild: boolean
+}): Promise<OpenCodeError | SyncResult> {
+  const [sessions, active] = await Promise.all([allSessions({ client }), client.session.active().catch((cause) => new OpenCodeError({ operation: 'session.active', cause }))])
+  if (sessions instanceof Error) return sessions
+  if (active instanceof Error) return active
+  const cutoff = days > 0 ? Date.now() - days * 86_400_000 : 0
+  const recent = sessions.filter((session) => session.time.updated >= cutoff)
+  const result: SyncResult = { written: 0, skipped: 0, failed: 0 }
+  const next = { index: 0 }
+  const worker = async () => {
+    while (next.index < recent.length) {
+      const session = recent[next.index++]!
+      const file = path.join(transcriptsDir({ dataDir }), `${session.id}.md`)
+      const stat = await fs.promises.stat(file).catch(() => null)
+      // time.updated may not move when a run ends: the live hook writes busy sessions when they stop.
+      if (session.id in active || (!rebuild && stat && stat.mtimeMs >= session.time.updated - 1)) {
+        result.skipped++
+        continue
+      }
+      const written = await writeTranscript({ client, dataDir, session })
+      if (written instanceof Error) {
+        result.failed++
+        logger.warn(`transcript of ${session.id} failed`, written)
+        continue
+      }
+      result.written++
+      logger.log(`transcript ${result.written + result.skipped + result.failed}/${recent.length}: ${session.id}`)
+    }
+  }
+  await Promise.all(Array.from({ length: Math.min(8, recent.length) }, worker))
+  return result
+}
+
 // Cursor pagination of message.list / session.list: every page, in order.
 export async function collectPages<T>({
   operation,

package/src/sessions.ts

@@ -33,6 +33,7 @@ import { prompt, runInSession } from './prompt.ts'
 import { formatEcho } from './queue.ts'
 import type { Route } from './routes.ts'
 import * as schema from './schema.ts'
+import { disabledSkillRules } from './builtin-skills.ts'
 import { baseInstructions, INSTRUCTION_KEY, type ScheduledRun } from './system-prompt.ts'
 import { createWorktree, resolveWorkingDirectory } from './worktrees.ts'
 
@@ -423,7 +424,7 @@ export async function startSession(
       location: { directory },
       ...(model && { model }),
       ...(agent && { agent }),
-      permissions: [NO_QUESTION_TOOL, ...(permissions ?? [])],
+      permissions: [NO_QUESTION_TOOL, ...disabledSkillRules(bot.disabledSkills), ...(permissions ?? [])],
       metadata: { kimaki },
     }),
   )
@@ -533,7 +534,7 @@ async function adoptSession(
     const kimaki = { ...marker, source: scheduledTask ? 'task' : 'discord', ...cliContext(bot), threadId: thread.id, channelId: channel.id }
     // A session with its own question rule (a fork, or --permission) keeps it.
     const rules = session.permissions ?? []
-    const permissions = rules.some((rule) => rule.action === 'question') ? rules : [NO_QUESTION_TOOL, ...rules]
+    const permissions = rules.some((rule) => rule.action === 'question') ? rules : [NO_QUESTION_TOOL, ...disabledSkillRules(bot.disabledSkills), ...rules]
     const marked = await oc(bot, 'session.update', (client) =>
       client.session.update({ sessionID: sessionId, metadata: { ...session.metadata, kimaki }, permissions }),
     )

package/src/slash-commands.ts

@@ -32,6 +32,7 @@
 //
 // Discord allows 100 commands per guild; skills are cut first.
 
+import { isBuiltinSkill } from './builtin-skills.ts'
 import {
   Events,
   MessageFlags,
@@ -175,7 +176,7 @@ async function readCatalog(bot: Pick<Bot, 'opencode'>, directory: string): Promi
   if (agents instanceof Error) return agents
   if (commands instanceof Error) return commands
   if (skills instanceof Error) return skills
-  return { agents: agents.data, commands: commands.data, skills: skills.data }
+  return { agents: agents.data, commands: commands.data, skills: skills.data.filter((skill) => !isBuiltinSkill(skill.id)) }
 }
 
 // Autocomplete keeps the whole project catalog reachable beyond Discord's shortcut limit.
@@ -187,7 +188,7 @@ function catalogRoutes(): InteractionRoutes {
       if (kind === 'skill') {
         const skills = await oc(bot, 'skill.list', (client) => client.skill.list({ location }))
         if (skills instanceof Error) return skills
-        return skills.data.map((skill) => ({ name: skill.id, description: skill.description }))
+        return skills.data.filter((skill) => !isBuiltinSkill(skill.id)).map((skill) => ({ name: skill.id, description: skill.description }))
       }
       const list = await oc(bot, 'command.list', (client) => client.command.list({ location }))
       if (list instanceof Error) return list
@@ -460,7 +461,7 @@ export function registerSlashCommands(
     if (project instanceof Error) return logger.warn(project)
     if (!project) return
     const guild = interaction.guild ?? (await discord.guilds.fetch(interaction.guildId).catch(() => null))
-    if (!guild || !(await canUseKimaki({ guild, userId: interaction.user.id }))) {
+    if (!guild || !(await canUseKimaki(bot, { guild, userId: interaction.user.id }))) {
       if (interaction.isAutocomplete()) return respondChoices(interaction, [])
       if (interaction.isRepliable()) {
         await interaction.reply({ content: 'You do not have permission to use Kimaki', flags: MessageFlags.Ephemeral })