@takara-ai/miru-code 1.7.3 → 1.7.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@takara-ai/miru-code",
-  "version": "1.7.3",
+  "version": "1.7.4",
   "description": "Miru (見る) — hybrid code search for agents. Bun, TypeScript, Takara embeddings.",
   "type": "module",
   "license": "MIT",

package/src/embeddings/openai.ts

@@ -1,3 +1,4 @@
+import { CredentialsError } from "../auth/errors.ts";
 import { mapPool, resolveWorkerConcurrency } from "../concurrency.ts";
 import { loadStoredCredentials } from "../credentials.ts";
 import { envFirstString, envOptionalInt, resolveEmbeddingApiKey } from "../env.ts";
@@ -330,7 +331,7 @@ export interface EmbeddingClient {
 export const EMBEDDING_AUTH_ERROR_MESSAGE =
   "Not authorized. Check your API key and/or token balance.";
 
-class EmbeddingApiError extends Error {
+export class EmbeddingApiError extends Error {
   readonly status: number;
   readonly body: string;
 
@@ -339,7 +340,13 @@ class EmbeddingApiError extends Error {
       status === 401 || status === 403
         ? EMBEDDING_AUTH_ERROR_MESSAGE
         : `Embedding API error ${status}: ${body.slice(0, 500)}`;
-    super(message);
+    // A 401/403 means the existing credential cannot authorize embeddings. Preserve
+    // the HTTP details while marking it recoverable so MCP tools can offer the
+    // device-code flow instead of leaving agents to fall back to shell commands.
+    super(
+      message,
+      status === 401 || status === 403 ? { cause: new CredentialsError(message) } : undefined,
+    );
     this.name = "EmbeddingApiError";
     this.status = status;
     this.body = body;

package/src/mcp/auth-tool.ts

@@ -19,13 +19,14 @@ const CHECK_HINT =
 
 /** Appended to credentials failures so an agent knows Miru's own recovery step. */
 const RECOVERY_HINT =
-  'Miru is not signed in. Call the `auth` tool with action "start" — it opens the Takara ' +
-  'device-login page in the browser — then action "check" once the user approves.';
+  'Miru could not authorize its current credentials. Call the `auth` tool with action "start" ' +
+  'to open the Takara device-login page, then action "check" once the user approves. If access ' +
+  "is still denied after signing in, check the account token balance.";
 
 const AUTH_TOOL_DESCRIPTION =
   "Sign in with Takara credentials via device-code login — no terminal required. " +
-  "Only call this in direct response to a tool error mentioning missing/expired " +
-  "credentials — never speculatively, since it starts a real sign-in prompt for the " +
+  "Only call this in direct response to a tool error mentioning missing, expired, rejected, or " +
+  "invalid credentials — never speculatively, since it starts a real sign-in prompt for the " +
   'user. Call with no arguments (or action "start") to begin: it opens the device-login ' +
   `page in the user's browser and returns that URL plus a short code. ${CHECK_HINT}`;