kernelbot 1.0.33 → 1.0.35

package/src/providers/base.js

@@ -13,16 +13,35 @@ export class BaseProvider {
   }
 
   /**
-   * Wrap an async LLM call with timeout + single retry on transient errors.
+   * Compute retry delay using exponential backoff with full jitter.
+   * Formula: random(0, min(MAX_BACKOFF, BASE * 2^attempt))
+   * This distributes retries across time and avoids thundering-herd
+   * when multiple workers retry simultaneously after a service hiccup.
+   *
+   * @param {number} attempt - Current attempt (1-indexed)
+   * @returns {number} Delay in milliseconds
+   */
+  _retryDelay(attempt) {
+    const BASE_MS = 1000;
+    const MAX_BACKOFF_MS = 30_000;
+    const ceiling = Math.min(MAX_BACKOFF_MS, BASE_MS * Math.pow(2, attempt));
+    return Math.round(Math.random() * ceiling);
+  }
+
+  /**
+   * Wrap an async LLM call with timeout + retries on transient errors (up to 3 attempts).
    * Composes an internal timeout AbortController with an optional external signal
    * (e.g. worker cancellation). Either aborting will cancel the call.
    *
+   * Uses exponential backoff with full jitter between retries to avoid
+   * thundering-herd effects when services recover from outages.
+   *
    * @param {(signal: AbortSignal) => Promise<any>} fn - The API call, receives composed signal
    * @param {AbortSignal} [externalSignal] - Optional external abort signal
    * @returns {Promise<any>}
    */
   async _callWithResilience(fn, externalSignal) {
-    for (let attempt = 1; attempt <= 2; attempt++) {
+    for (let attempt = 1; attempt <= 3; attempt++) {
       const ac = new AbortController();
       const timer = setTimeout(
         () => ac.abort(new Error(`LLM call timed out after ${this.timeout / 1000}s`)),
@@ -55,8 +74,9 @@ export class BaseProvider {
         clearTimeout(timer);
         removeListener?.();
 
-        if (attempt < 2 && this._isTransient(err)) {
-          await new Promise((r) => setTimeout(r, 1500));
+        if (attempt < 3 && this._isTransient(err)) {
+          const delay = this._retryDelay(attempt);
+          await new Promise((r) => setTimeout(r, delay));
           continue;
         }
         throw err;
@@ -66,22 +86,45 @@ export class BaseProvider {
 
   /**
    * Determine if an error is transient and worth retrying.
-   * Covers connection errors, timeouts, 5xx, and 429 rate limits.
+   * Covers connection errors, DNS failures, timeouts, 5xx, and 429 rate limits.
    */
   _isTransient(err) {
     const msg = err?.message || '';
+
+    // Network-level & connection errors
     if (
       msg.includes('Connection error') ||
       msg.includes('ECONNRESET') ||
+      msg.includes('ECONNREFUSED') ||
+      msg.includes('ECONNABORTED') ||
+      msg.includes('EPIPE') ||
+      msg.includes('ENETUNREACH') ||
+      msg.includes('EHOSTUNREACH') ||
       msg.includes('socket hang up') ||
       msg.includes('ETIMEDOUT') ||
+      msg.includes('ENOTFOUND') ||
+      msg.includes('EAI_AGAIN') ||
       msg.includes('fetch failed') ||
-      msg.includes('timed out')
+      msg.includes('timed out') ||
+      msg.includes('network socket disconnected') ||
+      msg.includes('other side closed')
     ) {
       return true;
     }
-    const status = err?.status || err?.statusCode;
-    return (status >= 500 && status < 600) || status === 429;
+
+    // Check top-level status (Anthropic, OpenAI)
+    let status = err?.status || err?.statusCode;
+
+    // Google SDK nests HTTP status in JSON message — try to extract
+    if (!status && msg.startsWith('{')) {
+      try {
+        const parsed = JSON.parse(msg);
+        status = parsed?.error?.code || parsed?.code;
+      } catch {}
+    }
+
+    // Anthropic overloaded (529) is also transient
+    return (status >= 500 && status < 600) || status === 429 || status === 529;
   }
 
   /**

package/src/providers/google-genai.js

@@ -0,0 +1,198 @@
+import { GoogleGenAI } from '@google/genai';
+import { BaseProvider } from './base.js';
+
+/**
+ * Native Google Gemini provider using @google/genai SDK.
+ */
+export class GoogleGenaiProvider extends BaseProvider {
+  constructor(opts) {
+    super(opts);
+    this.client = new GoogleGenAI({ apiKey: this.apiKey });
+  }
+
+  // ── Format conversion helpers ──
+
+  /** Anthropic tool defs → Google functionDeclarations */
+  _convertTools(tools) {
+    if (!tools || tools.length === 0) return undefined;
+    return [
+      {
+        functionDeclarations: tools.map((t) => ({
+          name: t.name,
+          description: t.description,
+          parameters: t.input_schema,
+        })),
+      },
+    ];
+  }
+
+  /** Anthropic messages → Google contents array */
+  _convertMessages(messages) {
+    const contents = [];
+
+    // Build a map of tool_use_id → tool_name from assistant messages
+    // so we can resolve function names when converting tool_result blocks
+    const toolIdToName = new Map();
+    for (const msg of messages) {
+      if (msg.role === 'assistant' && Array.isArray(msg.content)) {
+        for (const block of msg.content) {
+          if (block.type === 'tool_use') {
+            toolIdToName.set(block.id, block.name);
+          }
+        }
+      }
+    }
+
+    for (const msg of messages) {
+      if (msg.role === 'user') {
+        if (typeof msg.content === 'string') {
+          contents.push({ role: 'user', parts: [{ text: msg.content }] });
+        } else if (Array.isArray(msg.content)) {
+          // Check if it's tool results
+          if (msg.content[0]?.type === 'tool_result') {
+            const parts = msg.content.map((tr) => ({
+              functionResponse: {
+                name: toolIdToName.get(tr.tool_use_id) || tr.tool_use_id,
+                response: {
+                  result:
+                    typeof tr.content === 'string' ? tr.content : JSON.stringify(tr.content),
+                },
+              },
+            }));
+            contents.push({ role: 'user', parts });
+          } else {
+            // Text content blocks
+            const text = msg.content
+              .filter((b) => b.type === 'text')
+              .map((b) => b.text)
+              .join('\n');
+            contents.push({ role: 'user', parts: [{ text: text || '' }] });
+          }
+        }
+      } else if (msg.role === 'assistant') {
+        const parts = [];
+        if (typeof msg.content === 'string') {
+          parts.push({ text: msg.content });
+        } else if (Array.isArray(msg.content)) {
+          for (const block of msg.content) {
+            if (block.type === 'text' && block.text) {
+              parts.push({ text: block.text });
+            } else if (block.type === 'tool_use') {
+              const part = { functionCall: { name: block.name, args: block.input } };
+              // Replay thought signature for thinking models
+              if (block.thoughtSignature) {
+                part.thoughtSignature = block.thoughtSignature;
+              }
+              parts.push(part);
+            }
+          }
+        }
+        if (parts.length > 0) {
+          contents.push({ role: 'model', parts });
+        }
+      }
+    }
+
+    return contents;
+  }
+
+  /** Google response → normalized format with rawContent in Anthropic format */
+  _normalizeResponse(response) {
+    // Access raw parts to preserve thoughtSignature and avoid SDK warning
+    // (response.text logs a warning when there are only functionCall parts)
+    const candidate = response.candidates?.[0];
+    const parts = candidate?.content?.parts || [];
+
+    // Extract text from raw parts instead of response.text
+    const text = parts
+      .filter((p) => p.text)
+      .map((p) => p.text)
+      .join('\n');
+
+    const functionCallParts = parts.filter((p) => p.functionCall);
+    const toolCalls = functionCallParts.map((p, i) => ({
+      id: `toolu_google_${Date.now()}_${i}`,
+      name: p.functionCall.name,
+      input: p.functionCall.args || {},
+      // Preserve thought signature for thinking models (sibling of functionCall)
+      ...(p.thoughtSignature && { thoughtSignature: p.thoughtSignature }),
+    }));
+
+    const stopReason = toolCalls.length > 0 ? 'tool_use' : 'end_turn';
+
+    // Build rawContent in Anthropic format for history consistency
+    const rawContent = [];
+    if (text) {
+      rawContent.push({ type: 'text', text });
+    }
+    for (const tc of toolCalls) {
+      rawContent.push({
+        type: 'tool_use',
+        id: tc.id,
+        name: tc.name,
+        input: tc.input,
+        ...(tc.thoughtSignature && { thoughtSignature: tc.thoughtSignature }),
+      });
+    }
+
+    return { stopReason, text, toolCalls, rawContent };
+  }
+
+  // ── Public API ──
+
+  async chat({ system, messages, tools, signal }) {
+    const config = {
+      temperature: this.temperature,
+      maxOutputTokens: this.maxTokens,
+    };
+
+    if (system) {
+      config.systemInstruction = Array.isArray(system)
+        ? system.map((b) => b.text).join('\n')
+        : system;
+    }
+
+    const convertedTools = this._convertTools(tools);
+    if (convertedTools) {
+      config.tools = convertedTools;
+    }
+
+    const contents = this._convertMessages(messages);
+
+    try {
+      return await this._callWithResilience(async (timedSignal) => {
+        const response = await this.client.models.generateContent({
+          model: this.model,
+          contents,
+          config: {
+            ...config,
+            abortSignal: timedSignal,
+            httpOptions: { timeout: this.timeout },
+          },
+        });
+        return this._normalizeResponse(response);
+      }, signal);
+    } catch (err) {
+      // Normalize Google SDK error: extract clean message from JSON
+      if (err.message?.startsWith('{')) {
+        try {
+          const parsed = JSON.parse(err.message);
+          err.message = parsed?.error?.message || err.message;
+          err.status = parsed?.error?.code;
+        } catch {}
+      }
+      throw err;
+    }
+  }
+
+  async ping() {
+    await this.client.models.generateContent({
+      model: this.model,
+      contents: 'ping',
+      config: {
+        maxOutputTokens: 16,
+        temperature: 0,
+      },
+    });
+  }
+}

package/src/providers/index.js

@@ -1,5 +1,6 @@
 import { AnthropicProvider } from './anthropic.js';
 import { OpenAICompatProvider } from './openai-compat.js';
+import { GoogleGenaiProvider } from './google-genai.js';
 import { PROVIDERS } from './models.js';
 
 export { PROVIDERS } from './models.js';
@@ -29,7 +30,11 @@ export function createProvider(config) {
     return new AnthropicProvider(opts);
   }
 
-  // OpenAI, Google, Groq — all use OpenAI-compatible API
+  if (provider === 'google') {
+    return new GoogleGenaiProvider(opts);
+  }
+
+  // OpenAI, Groq — use OpenAI-compatible API
   return new OpenAICompatProvider({
     ...opts,
     baseUrl: providerDef.baseUrl || undefined,

package/src/providers/models.js

@@ -32,11 +32,15 @@ export const PROVIDERS = {
   google: {
     name: 'Google (Gemini)',
     envKey: 'GOOGLE_API_KEY',
-    baseUrl: 'https://generativelanguage.googleapis.com/v1beta/openai/',
     models: [
+      // Gemini 3 series
+      { id: 'gemini-3.1-pro-preview', label: 'Gemini 3.1 Pro' },
+      { id: 'gemini-3-flash-preview', label: 'Gemini 3 Flash' },
+      { id: 'gemini-3-pro-preview', label: 'Gemini 3 Pro' },
+      // Gemini 2.5 series
       { id: 'gemini-2.5-flash', label: 'Gemini 2.5 Flash' },
       { id: 'gemini-2.5-pro', label: 'Gemini 2.5 Pro' },
-      { id: 'gemini-2.0-flash', label: 'Gemini 2.0 Flash' },
+      { id: 'gemini-2.5-flash-lite', label: 'Gemini 2.5 Flash Lite' },
     ],
   },
   groq: {

package/src/providers/openai-compat.js

@@ -35,12 +35,13 @@ export class OpenAICompatProvider extends BaseProvider {
   _convertMessages(system, messages) {
     const out = [];
 
-    // System prompt as first message (skip for reasoning models)
-    if (system && !this.isReasoningModel) {
+    // System prompt — use 'developer' role for reasoning models, 'system' for others
+    if (system) {
       const systemText = Array.isArray(system)
         ? system.map((b) => b.text).join('\n')
         : system;
-      out.push({ role: 'system', content: systemText });
+      const role = this.isReasoningModel ? 'developer' : 'system';
+      out.push({ role, content: systemText });
     }
 
     for (const msg of messages) {
@@ -108,11 +109,18 @@ export class OpenAICompatProvider extends BaseProvider {
 
     const text = choice.message.content || '';
 
-    const toolCalls = (choice.message.tool_calls || []).map((tc) => ({
-      id: tc.id,
-      name: tc.function.name,
-      input: JSON.parse(tc.function.arguments),
-    }));
+    const toolCalls = (choice.message.tool_calls || []).map((tc) => {
+      let input = {};
+      try {
+        input = JSON.parse(tc.function.arguments);
+      } catch {
+        // LLM returned malformed JSON — use empty object so the tool call
+        // still reaches the tool executor (which can surface its own error)
+        // rather than crashing the entire chat session.
+        input = { _parseError: true, _raw: (tc.function.arguments || '').slice(0, 200) };
+      }
+      return { id: tc.id, name: tc.function.name, input };
+    });
 
     // Build rawContent in Anthropic format for message history consistency
     const rawContent = [];
@@ -138,7 +146,11 @@ export class OpenAICompatProvider extends BaseProvider {
       params.temperature = this.temperature;
     }
 
-    params.max_tokens = this.maxTokens;
+    if (this.isReasoningModel) {
+      params.max_completion_tokens = this.maxTokens;
+    } else {
+      params.max_tokens = this.maxTokens;
+    }
 
     const convertedTools = this._convertTools(tools);
     if (convertedTools) {
@@ -154,10 +166,12 @@ export class OpenAICompatProvider extends BaseProvider {
   async ping() {
     const params = {
       model: this.model,
-      max_tokens: 16,
       messages: [{ role: 'user', content: 'ping' }],
     };
-    if (!this.isReasoningModel) {
+    if (this.isReasoningModel) {
+      params.max_completion_tokens = 16;
+    } else {
+      params.max_tokens = 16;
       params.temperature = 0;
     }
     await this.client.chat.completions.create(params);

package/src/security/auth.js

@@ -1,9 +1,46 @@
 export function isAllowedUser(userId, config) {
   const allowed = config.telegram.allowed_users;
-  if (!allowed || allowed.length === 0) return true; // dev mode
+  if (!allowed || allowed.length === 0) return false;
   return allowed.includes(userId);
 }
 
 export function getUnauthorizedMessage() {
   return 'Access denied. You are not authorized to use this bot.';
 }
+
+/**
+ * Send an alert to the admin when an unauthorized user attempts access.
+ */
+export async function alertAdmin(bot, { userId, username, firstName, text, type }) {
+  const adminId = Number(process.env.OWNER_TELEGRAM_ID);
+  if (!adminId) return;
+
+  const userTag = username ? `@${username}` : 'بدون معرّف';
+  const name = firstName || 'غير معروف';
+  const content = text || '—';
+  const updateType = type || 'message';
+
+  const alert =
+    `🚨 *محاولة وصول غير مصرح بها\\!*\n\n` +
+    `👤 *المستخدم:* ${escapeMarkdown(userTag)} \\(ID: \`${userId}\`\\)\n` +
+    `📛 *الاسم:* ${escapeMarkdown(name)}\n` +
+    `📩 *النوع:* ${escapeMarkdown(updateType)}\n` +
+    `💬 *المحتوى:* ${escapeMarkdown(content)}`;
+
+  try {
+    await bot.sendMessage(adminId, alert, { parse_mode: 'MarkdownV2' });
+  } catch {
+    // Fallback to plain text if MarkdownV2 fails
+    const plain =
+      `🚨 محاولة وصول غير مصرح بها!\n\n` +
+      `👤 المستخدم: ${userTag} (ID: ${userId})\n` +
+      `📛 الاسم: ${name}\n` +
+      `📩 النوع: ${updateType}\n` +
+      `💬 المحتوى: ${content}`;
+    await bot.sendMessage(adminId, plain).catch(() => {});
+  }
+}
+
+function escapeMarkdown(text) {
+  return String(text).replace(/[_*[\]()~`>#+\-=|{}.!\\]/g, '\\$&');
+}

package/src/services/stt.js

@@ -38,9 +38,18 @@ export class STTService {
 
     return new Promise((resolve, reject) => {
       const writer = createWriteStream(tmpPath);
+
+      const fail = (err) => {
+        writer.destroy();
+        // Clean up the partial temp file so it doesn't leak on disk
+        try { unlinkSync(tmpPath); } catch {}
+        reject(err);
+      };
+
+      response.data.on('error', fail);
       response.data.pipe(writer);
       writer.on('finish', () => resolve(tmpPath));
-      writer.on('error', reject);
+      writer.on('error', fail);
     });
   }
 

package/src/tools/docker.js

@@ -1,13 +1,7 @@
-import { exec } from 'child_process';
+import { shellRun, shellEscape } from '../utils/shell.js';
+import { getLogger } from '../utils/logger.js';
 
-function run(cmd, timeout = 30000) {
-  return new Promise((resolve) => {
-    exec(cmd, { timeout, maxBuffer: 10 * 1024 * 1024 }, (error, stdout, stderr) => {
-      if (error) return resolve({ error: stderr || error.message });
-      resolve({ output: stdout.trim() });
-    });
-  });
-}
+const run = (cmd, timeout = 30000) => shellRun(cmd, timeout, { maxBuffer: 10 * 1024 * 1024 });
 
 export const definitions = [
   {
@@ -60,21 +54,49 @@ export const definitions = [
 
 export const handlers = {
   docker_ps: async (params) => {
+    const logger = getLogger();
     const flag = params.all ? '-a' : '';
-    return await run(`docker ps ${flag} --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}\t{{.Image}}"`);
+    logger.debug('docker_ps: listing containers');
+    const result = await run(`docker ps ${flag} --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}\t{{.Image}}"`);
+    if (result.error) logger.error(`docker_ps failed: ${result.error}`);
+    return result;
   },
 
   docker_logs: async (params) => {
-    const tail = params.tail || 100;
-    return await run(`docker logs --tail ${tail} ${params.container}`);
+    const logger = getLogger();
+    if (params.tail != null) {
+      const tail = parseInt(params.tail, 10);
+      if (!Number.isFinite(tail) || tail <= 0 || tail > 10000) {
+        return { error: 'Invalid tail value: must be between 1 and 10000' };
+      }
+      logger.debug(`docker_logs: fetching ${tail} lines from ${params.container}`);
+      const result = await run(`docker logs --tail ${tail} ${shellEscape(params.container)}`);
+      if (result.error) logger.error(`docker_logs failed for ${params.container}: ${result.error}`);
+      return result;
+    }
+    logger.debug(`docker_logs: fetching 100 lines from ${params.container}`);
+    const result = await run(`docker logs --tail 100 ${shellEscape(params.container)}`);
+    if (result.error) logger.error(`docker_logs failed for ${params.container}: ${result.error}`);
+    return result;
   },
 
   docker_exec: async (params) => {
-    return await run(`docker exec ${params.container} ${params.command}`);
+    const logger = getLogger();
+    if (!params.command || !params.command.trim()) {
+      return { error: 'Command must not be empty' };
+    }
+    logger.debug(`docker_exec: running command in ${params.container}`);
+    const result = await run(`docker exec ${shellEscape(params.container)} sh -c ${shellEscape(params.command)}`);
+    if (result.error) logger.error(`docker_exec failed in ${params.container}: ${result.error}`);
+    return result;
   },
 
   docker_compose: async (params) => {
-    const dir = params.project_dir ? `-f ${params.project_dir}/docker-compose.yml` : '';
-    return await run(`docker compose ${dir} ${params.action}`, 120000);
+    const logger = getLogger();
+    const dir = params.project_dir ? `-f ${shellEscape(params.project_dir + '/docker-compose.yml')}` : '';
+    logger.debug(`docker_compose: ${params.action}`);
+    const result = await run(`docker compose ${dir} ${params.action}`, 120000);
+    if (result.error) logger.error(`docker_compose '${params.action}' failed: ${result.error}`);
+    return result;
   },
 };

package/src/tools/git.js

@@ -2,6 +2,7 @@ import simpleGit from 'simple-git';
 import { join } from 'path';
 import { homedir } from 'os';
 import { mkdirSync } from 'fs';
+import { getLogger } from '../utils/logger.js';
 
 function getWorkspaceDir(config) {
   const dir = config.claude_code?.workspace_dir || join(homedir(), '.kernelbot', 'workspaces');
@@ -117,6 +118,7 @@ export const handlers = {
       await git.clone(authUrl, targetDir);
       return { success: true, path: targetDir };
     } catch (err) {
+      getLogger().error(`git_clone failed for ${params.repo}: ${err.message}`);
       return { error: err.message };
     }
   },
@@ -132,6 +134,7 @@ export const handlers = {
       }
       return { success: true, branch };
     } catch (err) {
+      getLogger().error(`git_checkout failed for branch ${params.branch}: ${err.message}`);
       return { error: err.message };
     }
   },
@@ -144,6 +147,7 @@ export const handlers = {
       const result = await git.commit(message);
       return { success: true, commit: result.commit, summary: result.summary };
     } catch (err) {
+      getLogger().error(`git_commit failed: ${err.message}`);
       return { error: err.message };
     }
   },
@@ -169,6 +173,7 @@ export const handlers = {
       await git.push('origin', branch, options);
       return { success: true, branch };
     } catch (err) {
+      getLogger().error(`git_push failed: ${err.message}`);
       return { error: err.message };
     }
   },
@@ -181,6 +186,7 @@ export const handlers = {
       const staged = await git.diff(['--cached']);
       return { unstaged: diff || '(no changes)', staged: staged || '(no staged changes)' };
     } catch (err) {
+      getLogger().error(`git_diff failed: ${err.message}`);
       return { error: err.message };
     }
   },

package/src/tools/github.js

@@ -1,4 +1,5 @@
 import { Octokit } from '@octokit/rest';
+import { getLogger } from '../utils/logger.js';
 
 function getOctokit(config) {
   const token = config.github?.token || process.env.GITHUB_TOKEN;
@@ -104,6 +105,7 @@ export const handlers = {
 
       return { success: true, pr_number: data.number, url: data.html_url };
     } catch (err) {
+      getLogger().error(`github_create_pr failed: ${err.message}`);
       return { error: err.message };
     }
   },
@@ -122,6 +124,7 @@ export const handlers = {
 
       return { diff: data };
     } catch (err) {
+      getLogger().error(`github_get_pr_diff failed: ${err.message}`);
       return { error: err.message };
     }
   },
@@ -141,6 +144,7 @@ export const handlers = {
 
       return { success: true, review_id: data.id };
     } catch (err) {
+      getLogger().error(`github_post_review failed: ${err.message}`);
       return { error: err.message };
     }
   },
@@ -169,6 +173,7 @@ export const handlers = {
 
       return { success: true, url: data.html_url, clone_url: data.clone_url };
     } catch (err) {
+      getLogger().error(`github_create_repo failed: ${err.message}`);
       return { error: err.message };
     }
   },
@@ -195,6 +200,7 @@ export const handlers = {
 
       return { prs };
     } catch (err) {
+      getLogger().error(`github_list_prs failed: ${err.message}`);
       return { error: err.message };
     }
   },

package/src/tools/jira.js

@@ -1,4 +1,5 @@
 import axios from 'axios';
+import { getLogger } from '../utils/logger.js';
 
 /**
  * Create an axios instance configured for the JIRA REST API.
@@ -142,6 +143,7 @@ export const handlers = {
       if (err.response?.status === 404) {
         return { error: `Ticket ${params.ticket_key} not found` };
       }
+      getLogger().error(`jira_get_ticket failed for ${params.ticket_key}: ${err.message}`);
       return { error: err.response?.data?.errorMessages?.join('; ') || err.message };
     }
   },
@@ -169,6 +171,7 @@ export const handlers = {
         tickets: (data.issues || []).map(formatIssue),
       };
     } catch (err) {
+      getLogger().error(`jira_search_tickets failed: ${err.message}`);
       return { error: err.response?.data?.errorMessages?.join('; ') || err.message };
     }
   },
@@ -198,6 +201,7 @@ export const handlers = {
         tickets: (data.issues || []).map(formatIssue),
       };
     } catch (err) {
+      getLogger().error(`jira_list_my_tickets failed: ${err.message}`);
       return { error: err.response?.data?.errorMessages?.join('; ') || err.message };
     }
   },
@@ -226,6 +230,7 @@ export const handlers = {
         tickets: (data.issues || []).map(formatIssue),
       };
     } catch (err) {
+      getLogger().error(`jira_get_project_tickets failed for ${params.project_key}: ${err.message}`);
       return { error: err.response?.data?.errorMessages?.join('; ') || err.message };
     }
   },