Security fixes

• Import data loss: _sanitize_reminder now preserves at and timezone fields — daily-at reminders previously had their schedule silently stripped on kim import
• Export file permissions: kim export --output file now creates the file with 0o600 — previously world-readable, leaking Slack tokens/webhook URLs on multi-user systems
• Slack webhook HTTPS enforcement: webhook notifier refuses to send over plain http://
• Self-update integrity: CI generates a .sha256 checksum per binary; kim self-update fetches and verifies before replacing the binary (supply chain mitigation)
• Magic bytes check tightened: script update check now matches b"from " / b"import " instead of b"fr" / b"im"

Bug fixes

• kim remind crash: oneshots.json validated as list before .append() — corrupt non-array file caused AttributeError crash (4 call sites)
• Daemon start with only one-shots: kim start no longer refuses to start when recurring reminders are all disabled but one-shots are pending
• Uninstall drops pending one-shots: kills sleeping fork children, reports count cancelled, wipes oneshots.json before removing files

Stability

• Threading race: _get_utc_offset TZ env mutation guarded by threading.Lock + finally — scheduler and config-reload threads no longer race on os.environ
• Process kill safety: _kill_remind_fire_orphans on Linux now resolves exe path against the actual kim binary before sending SIGTERM — previously could kill unrelated processes

Fix unisntall

kim uninstall

If kim is broken or the above doesn't work, use the standalone uninstaller:

curl -fsSL https://raw.githubusercontent.com/pratikwayal01/kim/main/uninstall.sh | bash

Last resort — manually remove all kim files:

# Stop daemon
[ -f ~/.kim/kim.pid ] && kill $(cat ~/.kim/kim.pid) 2>/dev/null; true
# Remove binary, package, and data
rm -f ~/.local/bin/kim
rm -rf ~/.kim
# Remove autostart (Linux)
systemctl --user disable --now kim.service 2>/dev/null; true
rm -f ~/.config/systemd/user/kim.service
# Remove pip metadata if installed via pip
pip uninstall kim-reminder -y 2>/dev/null; true

v4.5.7 - 2026年04月07日

Added

• kim remove <N> — remove a recurring reminder by 1-based index as shown in kim list. Existing name-based removal still works unchanged.
• kim list shows # index column — recurring reminders now display a 1-based index so users know what number to pass to kim remove.

Upgrade

pip install --upgrade kim-reminder

v4.5.6 - 2026年04月07日

Added

• kim export --oneshots — include pending one-shot reminders in the export (JSON: "oneshots" array; CSV: appended section). Use with -o file to save to a file.
• kim import --oneshots — restore pending one-shot reminders from a file produced by kim export --oneshots. Only future fire times are imported; duplicates are skipped.
• Help footer now shows oneshots: ~/.kim/oneshots.json alongside the config and log paths.

Fixed

• kim uninstall now kills orphaned kim remind fork children — on Linux the uninstall reads /proc directly to find and SIGTERM every sleeping kim remind child process. On macOS/other Unix it falls back to pkill -f. This prevents a one-shot reminder from firing after kim has been uninstalled.
• kim uninstall clears oneshots.json before removing ~/.kim/ — even if a fork child survives the SIGTERM (e.g. already woken), the cleared file means it cannot write back or be replayed on any future kim start.

High severity (4)

• scheduler.py: _wakeup.clear() moved inside the lock — eliminates missed-wakeup race condition
• scheduler.py: Notifier now runs in a daemon Thread — blocking Slack calls no longer stall the scheduler
• misc.py: Unix fork child now calls remove_oneshot() after firing — prevents double-fire on daemon restart
• misc.py + others: all oneshots.json tmp writes now get chmod 0o600 on Unix
  Medium severity (8)
• scheduler.py: Fired one-shots removed from _live dict — memory leak fixed
• misc.py: sleep_seconds clamped to max(0.0, ...) — no crash on clock jump
• management.py: cmd_update --interval validates the value before saving
• config.py: cmd_validate now checks at field is valid HH:MM
• notifications.py: Slack webhook/bot check response body for ok: false
• interactive.py: edit_reminder now removes at/timezone when switching to interval
• interactive.py: add_oneshot prompts for urgency instead of hardcoding "critical"
• core.py: load_config prints a stderr warning on JSON corruption
  Low severity (7)
• cli.py: bare kim now exits 0
• cli.py: import re moved to module level
• scheduler.py: dead update_reminder/disable_reminder wrappers removed
• core.py: parse_interval deprecated (kept for test compat)
• misc.py: import datetime moved to module level
• sound.py: validate_sound_file checks os.access(path, os.R_OK)
• management.py: except Exception narrowed to (json.JSONDecodeError, OSError)

What's Changed
Bug Fixes

• Daemon detection fixed — kim start now correctly detaches to the background on all Linux distros. Previously, systemd's INVOCATION_ID environment variable was inherited by child shells, causing kim start to block the terminal instead of spawning a background process. Detection now uses a TTY check (/dev/tty) which is reliable across Linux and macOS.
• kim start / kim stop now show PID — all start/stop messages include the process ID:
  • kim started. (PID 1234)
  • kim is already running. (PID 1234)
  • kim stopped. (PID 1234)
  • kim is already stopped.
• kim remind output consistent with kim add — confirmation now uses the ✓ prefix:
  • Before: watch set: 'standup' in 10m
  • After: ✓ Reminder set: 'standup' in 10m
• Internal _remind-fire command hidden — no longer leaks into the kim usage line.
• Urgency persisted correctly for one-shot reminders — if the daemon restarts while a kim remind is pending, it now restores the original urgency instead of always upgrading to critical.
  New Features
• kim remind --urgency — one-shot reminders now accept --urgency low|normal|critical (default: normal), matching kim add.
  Installation / Updates
• --break-system-packages added to all pip calls — kim self-update and kim uninstall now work correctly on Arch Linux, Debian 12+, Ubuntu 23.04+, and other distros with externally managed Python environments.
  Shell Completions
• --urgency added to kim remind completions for bash, zsh, and fish.

Upgrade
kim self-update
Or reinstall from scratch:

curl -fsSL https://raw.githubusercontent.com/pratikwayal01/kim/main/install.sh | bash

What changed:

On Windows, pip hits the exact same WinError 32 we did — it tries to os.rename(kim.exe → temp) before deletion, which fails because kim.exe is the running process. The fix is the same pattern we already use for kim.log: exit first, delete after.

The deferred PowerShell script now does three things in sequence after this process exits:

pip uninstall kim-reminder -y — removes kim.exe, kim.bat, all package files
Delete kim.log (retry loop, up to ×ばつ)
Remove ~/.kim/ (retry loop, up to ×ばつ)

What's changed

Bug fix — kim uninstall on pip installs

The root cause of all Windows uninstall errors was that kim uninstall was
trying to delete its own running files (kim.exe, kim.bat) instead of
delegating to pip, which owns them.

Problems fixed

• WinError 5 on kim.exe — eliminated entirely; pip removes it cleanly
• "The batch file cannot be found." — eliminated entirely; pip removes kim.bat cleanly
• Simpler, more reliable uninstall path: one pip uninstall kim-reminder -y call handles all binaries

~/.kim/ user data (not owned by pip) is still removed by kim itself.
On Windows, kim.log is still removed via the deferred PowerShell retry script
after the process exits and releases the file handle.

Refactor

cmd_uninstall was a 260-line monolith. It has been decomposed into focused helpers:

Test suite

• Regression test classes updated to inspect the correct helper functions
• 7 new tests in TestPipUninstallDelegatesToPip
• 238 tests, all passing

Upgrade

pip install --upgrade kim-reminder

What's changed

Bug fixes — kim uninstall on Windows

This release is a focused overhaul of kim uninstall on Windows. Every failure mode encountered in real-world testing has been identified and fixed.

Problems fixed

• WinError 32 on shutil.rmtree — ~/.kim/kim.log was locked by this process's own RotatingFileHandler opened at import time
• WinError 5 on kim.exe — pip entry-point .exe is the running process itself; direct unlink() yields Access Denied
• "The batch file cannot be found." — kim.bat was deleted immediately while cmd.exe was still mid-execution of it
• ~/.kim/kim.log left on disk — orphaned _remind-fire subprocesses (sleeping one-shot reminders) held their own handle on kim.log
• ~/.kim/ directory left on disk — single-attempt Remove-Item -Recurse silently failed while kim.log was still locked
• kim still resolves 1-2 times after uninstall — PowerShell per-session command cache; a note is now printed to open a new terminal

How each is fixed

• Orphaned _remind-fire subprocesses are now killed synchronously before touching ~/.kim (PowerShell Stop-Process on Windows, pkill on Unix)
• kim.bat is never deleted immediately — always deferred to after process exit via a hidden background PowerShell subprocess
• kim.exe is collected as deferred_exe and deleted by the same deferred PS subprocess
• Deferred PS script uses a two-stage retry: delete kim.log first (up to 10 attempts, 1 s apart), then remove the now-empty ~/.kim/ (up to 5 attempts)
• Log handlers are closed on the "kim" named logger, not just the root logger
• A hint is printed after uninstall on Windows: (Open a new terminal for the change to take effect.)

Test suite

• Consolidated test_basic.py + test_features.py into a single canonical tests/test_kim.py
• 10 new regression test classes added to tests/test_regression.py covering every uninstall fix
• 231 tests, all passing

Upgrade

pip install --upgrade kim-reminder

What's new in v4.1.0

Features

• --every alias for -I/--interval on kim add
• --at HH:MM for daily fixed-time reminders (kim add standup --at 09:30)
• kim remind now supports absolute datetime (at tomorrow 14:00, at 2026年04月07日 14:30 --tz ...)
• One-shot reminders are persisted to ~/.kim/oneshots.json and survive daemon restarts

Improvements

• kim start no longer blocks the terminal — spawns a detached background process and returns immediately
• kim start / kim stop output clean status messages with PID (kim started. (PID 1234))
• kim start when already running shows kim is already running. (PID 1234) instead of an error
• kim stop when not running shows kim is already stopped.
• kim status running line shows ●くろまる kim running (PID 1234)

Fixes

• Repaired release.yml CI workflow
• PyPI install instructions added to README and docs
• fix: auto-add pip Scripts dir to Windows PATH on first run — users no longer need to manually update PATH after pip install kim-reminder

Added

• kim remind "msg" in 10m / at tomorrow 9am — one-shot reminders with relative and absolute datetime parsing
• --every <interval> alias for --interval; --at HH:MM for daily at-time reminders
• Live config reload — kim add/remove/enable/disable/update take effect in the running daemon within 1 second, no restart needed (~/.kim/kim.reload flag file + SIGHUP on Unix)