agent-messenger 2.33.0 → 2.35.0

package/skills/agent-kakaotalk/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-kakaotalk
 description: Interact with KakaoTalk - send messages, read chats, manage conversations
-version: 2.33.0
+version: 2.35.0
 allowed-tools: Bash(agent-kakaotalk:*)
 metadata:
   openclaw:
@@ -599,6 +599,32 @@ if (!account) throw new Error('Not authenticated')
 const client = await new KakaoTalkClient().login({ oauthToken: account.oauth_token, userId: account.user_id, deviceUuid: account.device_uuid })
 ```
 
+For caller-managed token renewal, use the explicit SDK primitive:
+
+```typescript
+import { refreshKakaoOAuthToken } from 'agent-messenger/kakaotalk'
+
+if (!account.refresh_token) throw new Error('No KakaoTalk refresh token')
+
+const refreshed = await refreshKakaoOAuthToken({
+  accessToken: account.oauth_token,
+  refreshToken: account.refresh_token,
+  deviceUuid: account.device_uuid,
+})
+
+const nextAccount = {
+  ...account,
+  oauth_token: refreshed.accessToken,
+  refresh_token: refreshed.refreshToken,
+  updated_at: new Date().toISOString(),
+}
+
+// Persist nextAccount atomically before another client uses this credential.
+// The refresh primitive intentionally does not write credential files or retry login.
+```
+
+Kakao can rotate the refresh token. Never refresh a copied production credential and discard the returned token set. See [references/authentication.md](references/authentication.md) for error codes and the controlled canary procedure.
+
 ### Example
 
 ```typescript

package/skills/agent-kakaotalk/references/authentication.md

@@ -77,6 +77,22 @@ Re-run with `--device-type pc --force` or `--device-type tablet --force`.
 
 Check email/password and try again.
 
+### Runtime authentication failures
+
+Stored credentials are validated by Kakao only when a command opens a LOCO session. `auth status` confirms that a credential is present; it does not prove that the access token is still accepted by the server.
+
+An expired or revoked access token keeps the existing CLI error shape and reports the server status in the message:
+
+```json
+{
+  "error": "KakaoTalk LOGINLIST invalid access token (status -950)"
+}
+```
+
+Run `agent-kakaotalk auth login` to replace the credential before retrying the command. Other non-zero Kakao authentication responses preserve the returned status in the error message.
+
+A socket close, timeout, or other interrupted `LOGINLIST` remains a transport failure and must not be treated as an invalid token. Rejected authentication closes the provisional connection and does not continue to `LCHATLIST` or sync-state work.
+
 ### Device Slots
 
 KakaoTalk allows these simultaneous sessions:
@@ -246,6 +262,49 @@ KakaoTalk OAuth tokens can expire or be invalidated when:
 - The token naturally expires
 - KakaoTalk's server revokes the session
 
+### Explicit SDK Refresh
+
+The SDK exports `refreshKakaoOAuthToken()` for callers that need to exchange a stored Android sub-device refresh token for a new token set:
+
+```typescript
+import { refreshKakaoOAuthToken } from 'agent-messenger/kakaotalk'
+
+const refreshed = await refreshKakaoOAuthToken({
+  accessToken: account.oauth_token,
+  refreshToken: account.refresh_token,
+  deviceUuid: account.device_uuid,
+})
+```
+
+This is an explicit, stateless operation. It does not retry `LOGINLIST`, update the credentials file, or run automatically when a command receives `invalid_access_token`.
+
+The result always contains an access token and refresh token. Kakao may rotate the refresh token; if the response omits it, the SDK preserves the input refresh token in the returned value. The caller must persist both returned tokens atomically before the process exits or another client uses the same credential.
+
+Do not refresh a copied production credential and discard the result. A successful refresh can invalidate the previously stored refresh token on the server.
+
+#### Controlled Live Canary
+
+Use a dedicated test account and device when possible. If a production credential is the only available canary, use this sequence:
+
+1. Stop every collector, CLI process, and service that can use the credential. Confirm there is only one refresh caller.
+2. Prepare an atomic persistence path before making the request. Credential files must keep `0600` permissions.
+3. Call `refreshKakaoOAuthToken()` exactly once. Record only success, token-rotation booleans, and expiry metadata — never tokens, authorization headers, account IDs, or the raw response.
+4. If a token set is returned, immediately persist both returned tokens with a temporary file, `fsync`, and atomic rename. Do not let the process exit or another client start first.
+5. Start a fresh process, reload the persisted credential, and verify that `LOGINLIST` and a minimal chat-list request succeed.
+6. Scan application logs and temporary files for the old and new token values, confirm the credential still has `0600` permissions, then restart the stopped caller.
+
+If the refresh request fails before returning a token set, leave the stored credential unchanged and stop the canary. Do not loop blindly: an ambiguous network failure may have occurred after server-side rotation, in which case re-authentication can be required.
+
+Failures throw `KakaoOAuthRefreshError` with safe metadata only:
+
+- `refresh_credentials_missing` — an access token, refresh token, or device UUID was not provided.
+- `refresh_rejected` — Kakao returned an explicit non-zero status; inspect `serverStatus`.
+- `refresh_http_error` — the endpoint returned an HTTP failure without a Kakao status; inspect `httpStatus`.
+- `refresh_timeout` / `refresh_request_failed` — the request did not complete.
+- `refresh_malformed_response` — a successful response did not contain a usable access token.
+
+Token values, authorization headers, and raw response bodies are not included in these errors. The endpoint is an undocumented Android API and can change without notice.
+
 ### Re-authentication
 
 If commands start failing with auth errors:

package/skills/agent-kakaotalk/references/common-patterns.md

@@ -497,6 +497,14 @@ The `deviceType` determines the LOCO protocol identity: `'tablet'` sends `os: 'a
 
 Reconnect only triggers on actual session death. Operation-level errors (invalid chat ID, server rejection, etc.) are thrown immediately without retry, so side effects like `sendMessage` or `sendAttachment` are never duplicated.
 
+Initial `LOGINLIST` failures are classified separately from reconnectable session death:
+
+- `invalid_access_token` with `serverStatus === -950`: the stored Kakao access token has expired or been revoked. Re-authenticate before retrying.
+- `login_rejected`: Kakao explicitly rejected authentication for another server status. Inspect `serverStatus` and the device-slot/account state.
+- `login_failed`: booking, check-in, socket close, timeout, or another transport/protocol interruption. This is not proof that the token is invalid.
+
+Rejected authentication closes the provisional session before it can be adopted. Callers must not continue to `LCHATLIST` or other LOCO operations after either authentication error.
+
 ## See Also
 
 - [Authentication Guide](authentication.md) - Setting up credentials

package/skills/agent-line/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-line
 description: Interact with LINE - send messages, read chats, manage conversations
-version: 2.33.0
+version: 2.35.0
 allowed-tools: Bash(agent-line:*)
 metadata:
   openclaw:

package/skills/agent-slack/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-slack
 description: Interact with Slack workspaces - send messages, read channels, manage reactions
-version: 2.33.0
+version: 2.35.0
 allowed-tools: Bash(agent-slack:*)
 metadata:
   openclaw:

package/skills/agent-slackbot/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-slackbot
 description: Interact with Slack workspaces using bot tokens - send messages, read channels, manage reactions
-version: 2.33.0
+version: 2.35.0
 allowed-tools: Bash(agent-slackbot:*)
 metadata:
   openclaw:

package/skills/agent-teams/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-teams
 description: Interact with Microsoft Teams - send messages, read channels, manage reactions
-version: 2.33.0
+version: 2.35.0
 allowed-tools: Bash(agent-teams:*)
 metadata:
   openclaw:

package/skills/agent-telegram/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-telegram
 description: Interact with Telegram through TDLib - authenticate, inspect chats, and send messages
-version: 2.33.0
+version: 2.35.0
 allowed-tools: Bash(agent-telegram:*)
 ---
 

package/skills/agent-telegrambot/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-telegrambot
 description: Interact with Telegram using bot tokens - send messages, read chats, manage reactions
-version: 2.33.0
+version: 2.35.0
 allowed-tools: Bash(agent-telegrambot:*)
 metadata:
   openclaw:

package/skills/agent-webex/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-webex
 description: Interact with Cisco Webex - send messages, read spaces, manage memberships
-version: 2.33.0
+version: 2.35.0
 allowed-tools: Bash(agent-webex:*)
 metadata:
   openclaw:

package/skills/agent-webexbot/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-webexbot
 description: Interact with Cisco Webex using bot tokens - send messages, reply in threads, upload and download files, look up people, read spaces, manage memberships, stream real-time events
-version: 2.33.0
+version: 2.35.0
 allowed-tools: Bash(agent-webexbot:*)
 metadata:
   openclaw:

package/skills/agent-wechatbot/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-wechatbot
 description: Interact with WeChat Official Account using API credentials - send messages, manage templates, list followers
-version: 2.33.0
+version: 2.35.0
 allowed-tools: Bash(agent-wechatbot:*)
 metadata:
   openclaw:

package/skills/agent-whatsapp/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-whatsapp
 description: Interact with WhatsApp - send messages, read chats, manage conversations
-version: 2.33.0
+version: 2.35.0
 allowed-tools: Bash(agent-whatsapp:*)
 metadata:
   openclaw:

package/skills/agent-whatsappbot/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-whatsappbot
 description: Interact with WhatsApp using Cloud API credentials - send messages, manage templates
-version: 2.33.0
+version: 2.35.0
 allowed-tools: Bash(agent-whatsappbot:*)
 metadata:
   openclaw:

package/src/platforms/discord/client.test.ts

@@ -1,7 +1,7 @@
 import { afterEach, beforeEach, describe, expect, it, spyOn } from 'bun:test'
 
 import { DiscordClient, DiscordError } from './client'
-import type { DiscordReadState } from './types'
+import type { DiscordDMChannel, DiscordReadState } from './types'
 
 describe('DiscordClient', () => {
   const originalFetch = globalThis.fetch
@@ -949,4 +949,154 @@ describe('DiscordClient', () => {
       expect(result.count).toBe(100)
     })
   })
+
+  describe('getUnreadDMs', () => {
+    const dmChannel = (id: string, lastMessageId?: string, type = 1): DiscordDMChannel => ({
+      id,
+      type,
+      recipients: [{ id: `u${id}`, username: `user${id}` }],
+      ...(lastMessageId ? { last_message_id: lastMessageId } : {}),
+    })
+
+    const stub = (client: DiscordClient, channels: DiscordDMChannel[], states: DiscordReadState[], partial = false) => {
+      spyOn(client, 'listDMChannels').mockResolvedValue(channels)
+      spyOn(client, 'fetchReadStateSnapshot').mockResolvedValue({ states, partial })
+    }
+
+    it('keeps channels whose newest message is past the read marker', async () => {
+      // given: c1 has a message newer than its marker, c2 is fully read
+      const client = await new DiscordClient().login({ token: 'test-token' })
+      stub(
+        client,
+        [dmChannel('c1', '200'), dmChannel('c2', '50')],
+        [
+          { channelId: 'c1', lastMessageId: '100', mentionCount: 2 },
+          { channelId: 'c2', lastMessageId: '100', mentionCount: 0 },
+        ],
+      )
+
+      const result = await client.getUnreadDMs()
+
+      expect(result.count).toBe(1)
+      expect(result.channels[0].id).toBe('c1')
+      expect(result.channels[0].unreadCount).toBe(2)
+      expect(result.totalUnread).toBe(2)
+    })
+
+    it('treats an equal snowflake as read', async () => {
+      const client = await new DiscordClient().login({ token: 'test-token' })
+      stub(client, [dmChannel('c1', '100')], [{ channelId: 'c1', lastMessageId: '100', mentionCount: 1 }])
+
+      const result = await client.getUnreadDMs()
+
+      expect(result.count).toBe(0)
+    })
+
+    it('compares snowflakes beyond the safe integer range', async () => {
+      // given: two 19-digit snowflakes that collapse to the same value as Numbers
+      const client = await new DiscordClient().login({ token: 'test-token' })
+      stub(
+        client,
+        [dmChannel('c1', '1234567890123456789')],
+        [{ channelId: 'c1', lastMessageId: '1234567890123456788', mentionCount: 1 }],
+      )
+
+      const result = await client.getUnreadDMs()
+
+      expect(result.count).toBe(1)
+    })
+
+    it('surfaces a channel with no read-state entry as an unknown count', async () => {
+      const client = await new DiscordClient().login({ token: 'test-token' })
+      stub(client, [dmChannel('c1', '200')], [])
+
+      const result = await client.getUnreadDMs()
+
+      expect(result.count).toBe(1)
+      expect(result.channels[0].unreadCount).toBeNull()
+      // then: an unknown count must not be summed as zero-or-anything-else
+      expect(result.totalUnread).toBe(0)
+      expect(result.complete).toBe(true)
+    })
+
+    it('omits absent entries when the read state is partial', async () => {
+      // given: an incomplete collection, where absence means "not delivered", not "never read"
+      const client = await new DiscordClient().login({ token: 'test-token' })
+      stub(client, [dmChannel('c1', '200')], [], true)
+
+      const result = await client.getUnreadDMs()
+
+      expect(result.count).toBe(0)
+      expect(result.complete).toBe(false)
+    })
+
+    it('still reports channels past their marker when the read state is partial', async () => {
+      // given: a delivered entry is authoritative even inside a partial collection
+      const client = await new DiscordClient().login({ token: 'test-token' })
+      stub(client, [dmChannel('c1', '200')], [{ channelId: 'c1', lastMessageId: '100', mentionCount: 2 }], true)
+
+      const result = await client.getUnreadDMs()
+
+      expect(result.count).toBe(1)
+      expect(result.channels[0].unreadCount).toBe(2)
+      expect(result.complete).toBe(false)
+    })
+
+    it('skips channels that never had a message', async () => {
+      const client = await new DiscordClient().login({ token: 'test-token' })
+      stub(client, [dmChannel('c1')], [])
+
+      const result = await client.getUnreadDMs()
+
+      expect(result.count).toBe(0)
+    })
+
+    it('keeps a muted but unread channel with a zero count', async () => {
+      const client = await new DiscordClient().login({ token: 'test-token' })
+      stub(client, [dmChannel('c1', '200')], [{ channelId: 'c1', lastMessageId: '100', mentionCount: 0 }])
+
+      const result = await client.getUnreadDMs()
+
+      expect(result.count).toBe(1)
+      expect(result.channels[0].unreadCount).toBe(0)
+    })
+
+    it('treats a null read marker as never acknowledged', async () => {
+      const client = await new DiscordClient().login({ token: 'test-token' })
+      stub(client, [dmChannel('c1', '200')], [{ channelId: 'c1', lastMessageId: null, mentionCount: 4 }])
+
+      const result = await client.getUnreadDMs()
+
+      expect(result.count).toBe(1)
+      expect(result.channels[0].unreadCount).toBe(4)
+    })
+
+    it('includes group DMs and orders channels newest first', async () => {
+      const client = await new DiscordClient().login({ token: 'test-token' })
+      stub(client, [dmChannel('c1', '200'), dmChannel('c2', '900', 3)], [])
+
+      const result = await client.getUnreadDMs()
+
+      expect(result.channels.map((channel) => channel.id)).toEqual(['c2', 'c1'])
+      expect(result.channels[0].type).toBe(3)
+    })
+
+    it('caps returned channels by limit while keeping totals unfiltered', async () => {
+      const client = await new DiscordClient().login({ token: 'test-token' })
+      stub(
+        client,
+        [dmChannel('c1', '200'), dmChannel('c2', '900')],
+        [
+          { channelId: 'c1', lastMessageId: '100', mentionCount: 2 },
+          { channelId: 'c2', lastMessageId: '100', mentionCount: 5 },
+        ],
+      )
+
+      const result = await client.getUnreadDMs({ limit: 1 })
+
+      expect(result.channels).toHaveLength(1)
+      expect(result.count).toBe(2)
+      expect(result.totalUnread).toBe(7)
+    })
+  })
 })

package/src/platforms/discord/client.ts

@@ -11,10 +11,13 @@ import type {
   DiscordMention,
   DiscordMessage,
   DiscordReadState,
+  DiscordReadStateSnapshot,
   DiscordRelationship,
   DiscordRole,
   DiscordSearchOptions,
   DiscordSearchResult,
+  DiscordUnreadDM,
+  DiscordUnreadDMsResult,
   DiscordUnreadMention,
   DiscordUnreadMentionsResult,
   DiscordUser,
@@ -34,6 +37,47 @@ function isSnowflakeNewer(candidate: string, marker: string): boolean {
   }
 }
 
+interface ReadStateCandidateChannel {
+  id: string
+  last_message_id?: string | null
+}
+
+export interface UnreadChannel<T> {
+  channel: T
+  lastMessageId: string
+  unreadCount: number | null
+}
+
+export function selectUnreadChannels<T extends ReadStateCandidateChannel>(
+  channels: T[],
+  readState: DiscordReadStateSnapshot,
+): UnreadChannel<T>[] {
+  const readStateByChannel = new Map(readState.states.map((state) => [state.channelId, state]))
+
+  const unread: UnreadChannel<T>[] = []
+  for (const channel of channels) {
+    const lastMessageId = channel.last_message_id
+    if (!lastMessageId) continue
+
+    const state = readStateByChannel.get(channel.id)
+    // An absent entry only carries meaning when the collection is complete. In a
+    // complete payload Discord omits read states for channels it never tracked, so a
+    // channel holding messages with no marker is far more likely never-opened than
+    // read: surface it with an unknown count rather than silently hiding it. In a
+    // partial payload the entry may simply have been left out, so reporting it would
+    // be a false positive on an already-read channel.
+    if (!state) {
+      if (!readState.partial) unread.push({ channel, lastMessageId, unreadCount: null })
+      continue
+    }
+
+    if (state.lastMessageId !== null && !isSnowflakeNewer(lastMessageId, state.lastMessageId)) continue
+    unread.push({ channel, lastMessageId, unreadCount: state.mentionCount })
+  }
+
+  return unread.sort((a, b) => (isSnowflakeNewer(a.lastMessageId, b.lastMessageId) ? -1 : 1))
+}
+
 export class DiscordError extends Error {
   code: string
 
@@ -350,6 +394,31 @@ export class DiscordClient {
     })
   }
 
+  async getUnreadDMs(options?: { limit?: number }): Promise<DiscordUnreadDMsResult> {
+    const [readState, channels] = await Promise.all([this.fetchReadStateSnapshot(), this.listDMChannels()])
+
+    const unread = selectUnreadChannels(channels, readState).map(
+      ({ channel, lastMessageId, unreadCount }): DiscordUnreadDM => ({
+        id: channel.id,
+        type: channel.type,
+        name: channel.name ?? null,
+        recipients: channel.recipients,
+        lastMessageId,
+        unreadCount,
+      }),
+    )
+
+    const totalUnread = unread.reduce((sum, channel) => sum + (channel.unreadCount ?? 0), 0)
+    const limited = options?.limit === undefined ? unread : unread.slice(0, options.limit)
+
+    return {
+      channels: limited,
+      count: unread.length,
+      totalUnread,
+      complete: !readState.partial,
+    }
+  }
+
   async getMentions(options?: { limit?: number; guildId?: string; before?: string }): Promise<DiscordMention[]> {
     const params = new URLSearchParams()
     params.set('limit', (options?.limit ?? 25).toString())
@@ -367,15 +436,19 @@ export class DiscordClient {
   }
 
   async fetchReadState(): Promise<DiscordReadState[]> {
+    return (await this.fetchReadStateSnapshot()).states
+  }
+
+  async fetchReadStateSnapshot(): Promise<DiscordReadStateSnapshot> {
     const { DiscordListener } = await import('./listener')
     const listener = new DiscordListener(this)
     try {
       await listener.start()
-      const readState = listener.getReadState()
-      if (readState === null) {
+      const snapshot = listener.getReadStateSnapshot()
+      if (snapshot === null) {
         throw new DiscordError('Discord gateway did not deliver read state', 'no_read_state')
       }
-      return readState
+      return snapshot
     } finally {
       listener.stop()
     }

package/src/platforms/discord/commands/dm.test.ts

@@ -3,7 +3,7 @@ import { afterEach, beforeEach, describe, expect, it, mock, spyOn } from 'bun:te
 import { DiscordClient } from '../client'
 import { DiscordCredentialManager } from '../credential-manager'
 import type { DiscordDMChannel } from '../types'
-import { createAction, listAction } from './dm'
+import { createAction, listAction, unreadAction } from './dm'
 
 class ProcessExit extends Error {
   constructor(readonly code?: string | number | null) {
@@ -13,6 +13,7 @@ class ProcessExit extends Error {
 
 let clientListDMChannelsSpy: ReturnType<typeof spyOn>
 let clientCreateDMSpy: ReturnType<typeof spyOn>
+let clientGetUnreadDMsSpy: ReturnType<typeof spyOn>
 let credManagerLoadSpy: ReturnType<typeof spyOn>
 
 const mockChannels: DiscordDMChannel[] = [
@@ -57,6 +58,30 @@ beforeEach(() => {
     ],
   })
 
+  clientGetUnreadDMsSpy = spyOn(DiscordClient.prototype, 'getUnreadDMs').mockResolvedValue({
+    channels: [
+      {
+        id: '123',
+        type: 1,
+        name: null,
+        recipients: [{ id: '456', username: 'testuser' }],
+        lastMessageId: '900',
+        unreadCount: 3,
+      },
+      {
+        id: '789',
+        type: 3,
+        name: 'Group Chat',
+        recipients: [{ id: '111', username: 'user1' }],
+        lastMessageId: '800',
+        unreadCount: null,
+      },
+    ],
+    count: 2,
+    totalUnread: 3,
+    complete: true,
+  })
+
   credManagerLoadSpy = spyOn(DiscordCredentialManager.prototype, 'load').mockResolvedValue({
     token: 'test-token',
     current_server: null,
@@ -67,6 +92,7 @@ beforeEach(() => {
 afterEach(() => {
   clientListDMChannelsSpy?.mockRestore()
   clientCreateDMSpy?.mockRestore()
+  clientGetUnreadDMsSpy?.mockRestore()
   credManagerLoadSpy?.mockRestore()
 })
 
@@ -150,4 +176,103 @@ describe('dm commands', () => {
       }
     })
   })
+
+  describe('unreadAction', () => {
+    it('reports unread channels with labelled types and totals', async () => {
+      const consoleSpy = mock(() => {})
+      const originalLog = console.log
+      console.log = consoleSpy
+
+      try {
+        await unreadAction({ pretty: false })
+      } finally {
+        console.log = originalLog
+      }
+
+      const payload = JSON.parse(consoleSpy.mock.calls[0][0] as unknown as string)
+      expect(payload.count).toBe(2)
+      expect(payload.total_unread).toBe(3)
+      expect(payload.complete).toBe(true)
+      expect(payload.channels[0]).toEqual({
+        id: '123',
+        type: 'DM',
+        name: null,
+        recipients: [{ id: '456', username: 'testuser' }],
+        last_message_id: '900',
+        unread_count: 3,
+      })
+      expect(payload.channels[1].type).toBe('Group DM')
+    })
+
+    it('preserves an unknown unread count as null', async () => {
+      const consoleSpy = mock(() => {})
+      const originalLog = console.log
+      console.log = consoleSpy
+
+      try {
+        await unreadAction({ pretty: false })
+      } finally {
+        console.log = originalLog
+      }
+
+      const payload = JSON.parse(consoleSpy.mock.calls[0][0] as unknown as string)
+      expect(payload.channels[1].unread_count).toBeNull()
+    })
+
+    it('surfaces an incomplete read state as complete false', async () => {
+      clientGetUnreadDMsSpy.mockResolvedValue({ channels: [], count: 0, totalUnread: 0, complete: false })
+
+      const consoleSpy = mock(() => {})
+      const originalLog = console.log
+      console.log = consoleSpy
+
+      try {
+        await unreadAction({ pretty: false })
+      } finally {
+        console.log = originalLog
+      }
+
+      const payload = JSON.parse(consoleSpy.mock.calls[0][0] as unknown as string)
+      expect(payload.complete).toBe(false)
+    })
+
+    it('forwards the limit to the client', async () => {
+      const consoleSpy = mock(() => {})
+      const originalLog = console.log
+      console.log = consoleSpy
+
+      try {
+        await unreadAction({ limit: 5, pretty: false })
+      } finally {
+        console.log = originalLog
+      }
+
+      expect(clientGetUnreadDMsSpy).toHaveBeenCalledWith({ limit: 5 })
+    })
+
+    it('handles authentication error', async () => {
+      credManagerLoadSpy.mockResolvedValue({
+        token: '',
+        current_server: null,
+        servers: {},
+      })
+
+      const exitSpy = spyOn(process, 'exit').mockImplementation((code?: string | number | null) => {
+        throw new ProcessExit(code)
+      })
+
+      const consoleSpy = mock(() => {})
+      const originalLog = console.log
+      console.log = consoleSpy
+
+      try {
+        await expect(unreadAction({ pretty: false })).rejects.toThrow(ProcessExit)
+        expect(consoleSpy).toHaveBeenCalledWith(expect.stringContaining('Not authenticated'))
+        expect(exitSpy).toHaveBeenCalledWith(1)
+      } finally {
+        console.log = originalLog
+        exitSpy.mockRestore()
+      }
+    })
+  })
 })