talon-agent 3.34.0 → 3.35.0

package/src/core/auth/expiry-monitor.ts

@@ -0,0 +1,89 @@
+/**
+ * Login-expiry monitor — the daemon-side version of the CLI's "you have
+ * N days to log in again" banner, delivered to the admin chat.
+ *
+ * Checks every provider's credential file on an interval and alerts the
+ * admin (via the core notify seam) when a login is within
+ * {@link WARN_DAYS} of expiring, has expired, or is missing. Each distinct
+ * state is announced once; the latch re-arms when the state changes (a
+ * fresh login clears it, so the next expiry warns again).
+ */
+
+import { notifyAdmin } from "../notify.js";
+import {
+  daysUntil,
+  PROVIDER_LABELS,
+  readAllProviderStatus,
+  type ProviderAuthStatus,
+} from "./status.js";
+
+const WARN_DAYS = 7;
+const CHECK_INTERVAL_MS = 6 * 60 * 60_000;
+
+/** The alert key for a status, or undefined when nothing needs saying. */
+export function alertKeyFor(
+  s: ProviderAuthStatus,
+  now = Date.now(),
+): string | undefined {
+  if (!s.loggedIn) return `${s.provider}:missing`;
+  if (s.expired) return `${s.provider}:expired`;
+  if (s.loginExpiresAt === undefined) return undefined;
+  const days = daysUntil(s.loginExpiresAt, now);
+  if (days > WARN_DAYS) return undefined;
+  return `${s.provider}:expiring:${Math.max(days, 0)}`;
+}
+
+export function alertTextFor(s: ProviderAuthStatus, now = Date.now()): string {
+  const label = PROVIDER_LABELS[s.provider];
+  if (!s.loggedIn)
+    return `🔑 ${label} is not signed in — send /auth to sign in from here.`;
+  if (s.expired)
+    return `🔑 ${label} login has expired — send /auth to sign in again.`;
+  const days =
+    s.loginExpiresAt === undefined ? 0 : daysUntil(s.loginExpiresAt, now);
+  const when = days <= 0 ? "today" : `in ${days} day${days === 1 ? "" : "s"}`;
+  return `⏳ ${label} login expires ${when} — send /auth to renew it before it lapses.`;
+}
+
+const announced = new Map<string, string>();
+
+/** One check pass; exported for tests and for the panel's refresh button. */
+export async function runAuthExpiryCheck(
+  now = Date.now(),
+  notify: (text: string) => Promise<unknown> = notifyAdmin,
+): Promise<string[]> {
+  const sent: string[] = [];
+  for (const status of await readAllProviderStatus()) {
+    const key = alertKeyFor(status, now);
+    const prev = announced.get(status.provider);
+    if (key === undefined) {
+      announced.delete(status.provider);
+      continue;
+    }
+    if (prev === key) continue;
+    announced.set(status.provider, key);
+    const text = alertTextFor(status, now);
+    sent.push(text);
+    await notify(text);
+  }
+  return sent;
+}
+
+export function resetAuthExpiryAnnouncements(): void {
+  announced.clear();
+}
+
+export function startAuthExpiryMonitor(): () => void {
+  const tick = (): void => {
+    void runAuthExpiryCheck().catch(() => {});
+  };
+  // First check shortly after boot so a lapsed login is surfaced right away.
+  const first = setTimeout(tick, 30_000);
+  const interval = setInterval(tick, CHECK_INTERVAL_MS);
+  first.unref();
+  interval.unref();
+  return () => {
+    clearTimeout(first);
+    clearInterval(interval);
+  };
+}

package/src/core/auth/login-flow.ts

@@ -0,0 +1,247 @@
+/**
+ * Interactive CLI logins driven from a chat.
+ *
+ * Both CLIs can only log in interactively — `codex login --device-auth`
+ * prints a URL plus a one-time code and waits for the browser side to
+ * finish; `claude auth login` prints a URL and waits for the code the
+ * browser hands back to be pasted on stdin. Each flow here spawns the CLI
+ * against a THROWAWAY home (`CODEX_HOME` / `CLAUDE_CONFIG_DIR`), so a
+ * cancelled or failed attempt never touches the credentials the daemon is
+ * currently using; only a successful exit installs the new file over the
+ * real one (atomic rename). One flow per provider at a time — starting a
+ * new one cancels the old.
+ */
+
+import { spawn, type ChildProcess } from "node:child_process";
+import { copyFile, mkdtemp, rename, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { log, logWarn } from "../../util/log.js";
+import {
+  claudeCredentialsPath,
+  clearProviderExpired,
+  codexAuthPath,
+  type AuthProvider,
+} from "./status.js";
+
+const LOGIN_TIMEOUT_MS = 15 * 60_000;
+
+export interface LoginPrompt {
+  /** Page the human must open. */
+  url: string;
+  /** One-time code shown to the human (Codex device auth). */
+  code?: string;
+  /** True when the human must send a code back to us (Claude). */
+  needsCode: boolean;
+}
+
+type LoginOutcome =
+  | { ok: true }
+  | { ok: false; reason: "cancelled" | "timeout" | "failed"; detail?: string };
+
+export interface LoginFlow {
+  provider: AuthProvider;
+  /** Resolves once the CLI has printed enough to instruct the human. */
+  prompt: Promise<LoginPrompt>;
+  /** Resolves when the CLI exits (or is cancelled / times out). */
+  done: Promise<LoginOutcome>;
+  /** Feed the pasted code to the CLI (Claude). */
+  submitCode(code: string): void;
+  cancel(): void;
+}
+
+export interface LoginBinaries {
+  claude?: string;
+  codex?: string;
+}
+
+// oxlint-disable-next-line no-control-regex
+const ANSI = /\x1b\[[0-9;]*[A-Za-z]/g;
+
+export function stripAnsi(text: string): string {
+  return text.replace(ANSI, "");
+}
+
+/** Parse `codex login --device-auth` output into URL + code, once both are present. */
+export function parseCodexDevicePrompt(
+  output: string,
+): LoginPrompt | undefined {
+  const text = stripAnsi(output);
+  const url = /https:\/\/\S+\/device\S*/.exec(text)?.[0];
+  const code = /\b([A-Z0-9]{4}-[A-Z0-9]{5,6})\b/.exec(text)?.[1];
+  if (!url || !code) return undefined;
+  return { url, code, needsCode: false };
+}
+
+/** Parse `claude auth login` output into the sign-in URL, once printed. */
+export function parseClaudeLoginPrompt(
+  output: string,
+): LoginPrompt | undefined {
+  const text = stripAnsi(output);
+  const url = /https:\/\/\S+oauth\/authorize\S*/.exec(text)?.[0];
+  if (!url) return undefined;
+  return { url, needsCode: true };
+}
+
+const active = new Map<AuthProvider, LoginFlow>();
+
+export function activeLoginFlow(provider: AuthProvider): LoginFlow | undefined {
+  return active.get(provider);
+}
+
+interface Spec {
+  bin: string;
+  args: string[];
+  homeVar: "CODEX_HOME" | "CLAUDE_CONFIG_DIR";
+  parse: (out: string) => LoginPrompt | undefined;
+  /** Credential file inside the throwaway home → real destination. */
+  install: (tmpHome: string) => { from: string; to: string };
+}
+
+function specFor(provider: AuthProvider, bins: LoginBinaries): Spec {
+  if (provider === "codex") {
+    return {
+      bin: bins.codex || "codex",
+      args: ["login", "--device-auth"],
+      homeVar: "CODEX_HOME",
+      parse: parseCodexDevicePrompt,
+      install: (tmp) => ({ from: join(tmp, "auth.json"), to: codexAuthPath() }),
+    };
+  }
+  return {
+    bin: bins.claude || "claude",
+    args: ["auth", "login"],
+    homeVar: "CLAUDE_CONFIG_DIR",
+    parse: parseClaudeLoginPrompt,
+    install: (tmp) => ({
+      from: join(tmp, ".credentials.json"),
+      to: claudeCredentialsPath(),
+    }),
+  };
+}
+
+async function installCredentials(from: string, to: string): Promise<void> {
+  const staging = join(dirname(to), `.${Date.now()}.login.tmp`);
+  await copyFile(from, staging);
+  await rename(staging, to);
+}
+
+export function startLogin(
+  provider: AuthProvider,
+  bins: LoginBinaries = {},
+): LoginFlow {
+  active.get(provider)?.cancel();
+  const spec = specFor(provider, bins);
+
+  let child: ChildProcess | undefined;
+  let tmpHome: string | undefined;
+  let output = "";
+  let settled = false;
+  let cancelled = false;
+  let resolvePrompt!: (p: LoginPrompt) => void;
+  let rejectPrompt!: (e: Error) => void;
+  let resolveDone!: (o: LoginOutcome) => void;
+  const prompt = new Promise<LoginPrompt>((res, rej) => {
+    resolvePrompt = res;
+    rejectPrompt = rej;
+  });
+  const done = new Promise<LoginOutcome>((res) => {
+    resolveDone = res;
+  });
+  let promptSent = false;
+
+  const finish = async (outcome: LoginOutcome): Promise<void> => {
+    if (settled) return;
+    settled = true;
+    clearTimeout(timer);
+    if (active.get(provider) === flow) active.delete(provider);
+    if (!promptSent)
+      rejectPrompt(
+        new Error(outcome.ok ? "no prompt" : outcome.detail || outcome.reason),
+      );
+    if (tmpHome)
+      await rm(tmpHome, { recursive: true, force: true }).catch(() => {});
+    resolveDone(outcome);
+  };
+
+  const timer = setTimeout(() => {
+    child?.kill("SIGTERM");
+    void finish({ ok: false, reason: "timeout" });
+  }, LOGIN_TIMEOUT_MS);
+
+  const flow: LoginFlow = {
+    provider,
+    prompt,
+    done,
+    submitCode(code) {
+      child?.stdin?.write(`${code.trim()}\n`);
+    },
+    cancel() {
+      cancelled = true;
+      child?.kill("SIGTERM");
+      void finish({ ok: false, reason: "cancelled" });
+    },
+  };
+  active.set(provider, flow);
+
+  void (async () => {
+    tmpHome = await mkdtemp(join(tmpdir(), `talon-${provider}-login-`));
+    if (settled) return;
+    child = spawn(spec.bin, spec.args, {
+      env: { ...process.env, [spec.homeVar]: tmpHome },
+      stdio: ["pipe", "pipe", "pipe"],
+    });
+    const onData = (chunk: Buffer): void => {
+      output += chunk.toString("utf8");
+      if (promptSent) return;
+      const parsed = spec.parse(output);
+      if (parsed) {
+        promptSent = true;
+        resolvePrompt(parsed);
+      }
+    };
+    child.stdout?.on("data", onData);
+    child.stderr?.on("data", onData);
+    child.on("error", (err) => {
+      void finish({ ok: false, reason: "failed", detail: err.message });
+    });
+    child.on("exit", async (code, signal) => {
+      if (settled || cancelled) return;
+      if (code === 0 && tmpHome) {
+        const { from, to } = spec.install(tmpHome);
+        try {
+          await installCredentials(from, to);
+          clearProviderExpired(provider);
+          log("notify", `${provider} login installed at ${to}`);
+          await finish({ ok: true });
+          return;
+        } catch (err) {
+          const detail = err instanceof Error ? err.message : String(err);
+          logWarn(
+            "notify",
+            `${provider} login succeeded but install failed: ${detail}`,
+          );
+          await finish({
+            ok: false,
+            reason: "failed",
+            detail: `could not install credentials: ${detail}`,
+          });
+          return;
+        }
+      }
+      const tail = stripAnsi(output)
+        .trim()
+        .split("\n")
+        .slice(-3)
+        .join(" ")
+        .slice(0, 300);
+      await finish({
+        ok: false,
+        reason: "failed",
+        detail: `${spec.bin} exited with ${signal ?? `code ${code}`}${tail ? `: ${tail}` : ""}`,
+      });
+    });
+  })();
+
+  return flow;
+}

package/src/core/auth/status.ts

@@ -0,0 +1,193 @@
+/**
+ * Provider login status — what the CLIs know about their own credentials.
+ *
+ * Talon's Claude and Codex backends borrow the login state of the
+ * `claude` and `codex` CLIs (`~/.claude/.credentials.json` and
+ * `~/.codex/auth.json`). Both files are plain JSON, so status can be read
+ * without spawning anything. Claude's file carries an explicit refresh-token
+ * expiry (the "you have N days to log in again" the CLI prints); Codex's
+ * carries the last refresh time and
+ * only reveals a dead refresh token by failing — so "expired" for Codex
+ * means the file is missing, unparsable, or was reported dead by the
+ * backend (see {@link markProviderExpired}).
+ */
+
+import { readFile, stat } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+export type AuthProvider = "claude" | "codex";
+
+export const AUTH_PROVIDERS: readonly AuthProvider[] = ["claude", "codex"];
+
+export const PROVIDER_LABELS: Record<AuthProvider, string> = {
+  claude: "Claude",
+  codex: "Codex",
+};
+
+export interface ProviderAuthStatus {
+  provider: AuthProvider;
+  loggedIn: boolean;
+  /** Human-readable account descriptor ("max plan", "ChatGPT"), when known. */
+  account?: string;
+  /** Epoch ms after which a fresh login is required, when the file says. */
+  loginExpiresAt?: number;
+  /** Epoch ms of the last token refresh, when the file says. */
+  lastRefreshAt?: number;
+  /** True when the credentials are known to be unusable. */
+  expired: boolean;
+}
+
+export function claudeCredentialsPath(
+  env: NodeJS.ProcessEnv = process.env,
+): string {
+  const configDir = env.CLAUDE_CONFIG_DIR?.trim();
+  return join(
+    configDir ? configDir : join(homedir(), ".claude"),
+    ".credentials.json",
+  );
+}
+
+export function codexAuthPath(env: NodeJS.ProcessEnv = process.env): string {
+  const home = env.CODEX_HOME?.trim();
+  return join(home ? home : join(homedir(), ".codex"), "auth.json");
+}
+
+/** Providers the backends reported as dead since boot (cleared on login). */
+const reportedExpired = new Set<AuthProvider>();
+
+export function markProviderExpired(provider: AuthProvider): void {
+  reportedExpired.add(provider);
+}
+
+export function clearProviderExpired(provider: AuthProvider): void {
+  reportedExpired.delete(provider);
+}
+
+export function parseClaudeCredentials(raw: string): ProviderAuthStatus {
+  const base: ProviderAuthStatus = {
+    provider: "claude",
+    loggedIn: false,
+    expired: true,
+  };
+  let parsed: {
+    claudeAiOauth?: {
+      accessToken?: string;
+      expiresAt?: number;
+      refreshTokenExpiresAt?: number;
+      subscriptionType?: string;
+    };
+  };
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return base;
+  }
+  const oauth = parsed.claudeAiOauth;
+  if (!oauth?.accessToken) return base;
+  const loginExpiresAt =
+    typeof oauth.refreshTokenExpiresAt === "number"
+      ? oauth.refreshTokenExpiresAt
+      : undefined;
+  return {
+    provider: "claude",
+    loggedIn: true,
+    account: oauth.subscriptionType
+      ? `${oauth.subscriptionType} plan`
+      : undefined,
+    loginExpiresAt,
+    expired: loginExpiresAt !== undefined && loginExpiresAt <= Date.now(),
+  };
+}
+
+export function parseCodexAuth(raw: string): ProviderAuthStatus {
+  const base: ProviderAuthStatus = {
+    provider: "codex",
+    loggedIn: false,
+    expired: true,
+  };
+  let parsed: {
+    auth_mode?: string;
+    OPENAI_API_KEY?: string | null;
+    tokens?: { access_token?: string; refresh_token?: string };
+    last_refresh?: string;
+  };
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return base;
+  }
+  const apiKey =
+    typeof parsed.OPENAI_API_KEY === "string" &&
+    parsed.OPENAI_API_KEY.length > 0;
+  const chatgpt = Boolean(
+    parsed.tokens?.refresh_token || parsed.tokens?.access_token,
+  );
+  if (!apiKey && !chatgpt) return base;
+  const lastRefreshAt = parsed.last_refresh
+    ? Date.parse(parsed.last_refresh)
+    : NaN;
+  return {
+    provider: "codex",
+    loggedIn: true,
+    account: chatgpt ? "ChatGPT" : "API key",
+    lastRefreshAt: Number.isFinite(lastRefreshAt) ? lastRefreshAt : undefined,
+    expired: false,
+  };
+}
+
+async function readOrEmpty(path: string): Promise<string | undefined> {
+  try {
+    await stat(path);
+    return await readFile(path, "utf8");
+  } catch {
+    return undefined;
+  }
+}
+
+export async function readProviderStatus(
+  provider: AuthProvider,
+  env: NodeJS.ProcessEnv = process.env,
+): Promise<ProviderAuthStatus> {
+  const path =
+    provider === "claude" ? claudeCredentialsPath(env) : codexAuthPath(env);
+  const raw = await readOrEmpty(path);
+  const status =
+    raw === undefined
+      ? { provider, loggedIn: false, expired: true }
+      : provider === "claude"
+        ? parseClaudeCredentials(raw)
+        : parseCodexAuth(raw);
+  if (reportedExpired.has(provider)) return { ...status, expired: true };
+  return status;
+}
+
+export async function readAllProviderStatus(
+  env: NodeJS.ProcessEnv = process.env,
+): Promise<ProviderAuthStatus[]> {
+  return Promise.all(AUTH_PROVIDERS.map((p) => readProviderStatus(p, env)));
+}
+
+/** Whole days until `at`; negative when already past. */
+export function daysUntil(at: number, now = Date.now()): number {
+  return Math.floor((at - now) / 86_400_000);
+}
+
+/** One-line human summary used by both the panel and the expiry alerts. */
+export function describeProviderStatus(
+  s: ProviderAuthStatus,
+  now = Date.now(),
+): string {
+  if (!s.loggedIn) return "not signed in";
+  if (s.expired) return "login expired — sign in again";
+  const parts: string[] = [`signed in${s.account ? ` (${s.account})` : ""}`];
+  if (s.loginExpiresAt !== undefined) {
+    const days = daysUntil(s.loginExpiresAt, now);
+    parts.push(days <= 0 ? "login expires today" : `login expires in ${days}d`);
+  } else if (s.lastRefreshAt !== undefined) {
+    parts.push(
+      `refreshed ${Math.max(0, -daysUntil(s.lastRefreshAt, now))}d ago`,
+    );
+  }
+  return parts.join(", ");
+}

package/src/core/background/triggers/exit.ts

@@ -8,16 +8,18 @@ import type { ChildProcess } from "node:child_process";
 import {
   getTrigger,
   updateTrigger,
+  SHUTDOWN_KILL_ERROR,
   type Trigger,
   type TriggerStatus,
 } from "../../../storage/trigger-store.js";
-import { log, logError } from "../../../util/log.js";
+import { log, logDebug, logError } from "../../../util/log.js";
 import { appendDailyLog } from "../../../storage/daily-log.js";
 import {
   children,
   timeouts,
   logStreams,
   lineBuffers,
+  lifecycle,
   wardened,
   SIGTERM_GRACE_MS,
   WARDEN_GRACE_SLACK_MS,
@@ -53,6 +55,9 @@ export function cancelTrigger(id: string): boolean {
 
 /** Kill all running children — called during shutdown. */
 export async function shutdownTriggers(): Promise<void> {
+  // Flag first, unconditionally: a child that exits on its own from here on
+  // must not dispatch a wake either — the backend pool is going away.
+  lifecycle.shuttingDown = true;
   if (children.size === 0) return;
   log("triggers", `Shutting down ${children.size} running trigger(s)`);
   const ids = Array.from(children.keys());
@@ -70,7 +75,7 @@ export async function shutdownTriggers(): Promise<void> {
     } else {
       updateTrigger(id, {
         status: "terminated",
-        lastError: "Killed by Talon shutdown",
+        lastError: SHUTDOWN_KILL_ERROR,
       });
     }
     killChild(id, c);
@@ -188,6 +193,18 @@ export async function finalizeExit(
     status === "cancelled" ||
     status === "terminated"
   ) {
+    // During shutdown the backend pool is being torn down alongside us, so a
+    // dispatch here can only fail ("Backend role not bound"). Skip it; the
+    // record keeps status=terminated + SHUTDOWN_KILL_ERROR and no lastFireAt
+    // bump, which is exactly what resumeAfterRestart's late death notice
+    // keys on — the chat hears about it on the next boot instead.
+    if (lifecycle.shuttingDown) {
+      logDebug(
+        "triggers",
+        `Skipped ${status} wake for "${t.name}" [${id}] — shutting down; deferred to next boot`,
+      );
+      return;
+    }
     await fireWake(id, status, payload, /* terminal */ true);
   }
 }

package/src/core/background/triggers/resume.ts

@@ -9,6 +9,7 @@ import {
   getAllTriggers,
   updateTrigger,
   RESTART_KILL_ERROR,
+  SHUTDOWN_KILL_ERROR,
   type Trigger,
 } from "../../../storage/trigger-store.js";
 import { log, logError } from "../../../util/log.js";
@@ -50,19 +51,25 @@ export async function resumeAfterRestart(): Promise<void> {
     // Late death notice. Two cases earn one:
     //   - never fired at all (the old rule) — the chat heard nothing
     //     from this trigger, so its termination is news; and
-    //   - killed by THIS restart (recoverInterrupted stamped the
-    //     marker error) — even a multi-fire watcher that signalled
-    //     mid-run was still an active promise when the process died,
-    //     and without this wake the chat never learns its watcher is
-    //     gone. (Previously gated on lastFireAt === undefined alone,
-    //     which silently dropped exactly those watchers.)
+    //   - killed by THIS restart — either the crash path
+    //     (recoverInterrupted stamped RESTART_KILL_ERROR) or the clean
+    //     path (shutdownTriggers stamped SHUTDOWN_KILL_ERROR and
+    //     finalizeExit deliberately skipped the wake because the
+    //     backend pool was already going away). Even a multi-fire
+    //     watcher that signalled mid-run was still an active promise
+    //     when the process died, and without this wake the chat never
+    //     learns its watcher is gone. (Previously gated on
+    //     lastFireAt === undefined alone, which silently dropped
+    //     exactly those watchers.)
     // Triggers that exited on their own already fired their terminal
     // wake (lastFireAt set, no marker) — they stay silent here.
     if (
       t.status === "terminated" &&
       t.endedAt &&
       Date.now() - t.endedAt < 5 * 60_000 &&
-      (t.lastFireAt === undefined || t.lastError === RESTART_KILL_ERROR)
+      (t.lastFireAt === undefined ||
+        t.lastError === RESTART_KILL_ERROR ||
+        t.lastError === SHUTDOWN_KILL_ERROR)
     ) {
       await fireWake(t.id, "terminated", t.lastError, /* terminal */ true);
     }

package/src/core/background/triggers/state.ts

@@ -20,6 +20,14 @@ export type TriggerDeps = {
 /** Reassignable on a holder object so submodules see the injected deps. */
 export const depsHolder: { deps: TriggerDeps | null } = { deps: null };
 
+/**
+ * Set by shutdownTriggers for the rest of the process lifetime. finalizeExit
+ * consults it so the children it kills don't dispatch wakes into a backend
+ * pool that is being torn down at the same time. initTriggers clears it so a
+ * fresh lifecycle (next boot, or the next test) starts clean.
+ */
+export const lifecycle = { shuttingDown: false };
+
 /** Live child handles, keyed by trigger id. */
 export const children = new Map<string, ChildProcess>();
 export const timeouts = new Map<string, ReturnType<typeof setTimeout>>();
@@ -43,6 +51,7 @@ export const WARDEN_GRACE_SLACK_MS = 2_000;
 
 export function initTriggers(d: TriggerDeps): void {
   depsHolder.deps = d;
+  lifecycle.shuttingDown = false;
   log("triggers", "Initialized");
 }
 

package/src/core/engine/gateway-actions/history.ts

@@ -38,9 +38,20 @@ export const historyHandlers: SharedActionHandlers = {
 
   search_history: (body, chatId) => {
     const limit = Math.min(100, Number(body.limit ?? 20));
+    // Optional ISO date bounds; an unparseable one is ignored rather
+    // than silently narrowing the search to nothing.
+    const bound = (value: unknown): number | undefined => {
+      if (value === undefined || value === null || value === "")
+        return undefined;
+      const ts = Date.parse(String(value));
+      return Number.isFinite(ts) ? ts : undefined;
+    };
     return {
       ok: true,
-      text: searchHistory(String(chatId), String(body.query ?? ""), limit),
+      text: searchHistory(String(chatId), String(body.query ?? ""), limit, {
+        after: bound(body.after),
+        before: bound(body.before),
+      }),
     };
   },
 

package/src/core/errors.ts

@@ -339,7 +339,7 @@ const FRIENDLY_MESSAGES: Record<ErrorReason, string> = {
   overloaded:
     "Upstream model is busy right now. Retrying with a faster fallback...",
   network: "Connection issue. Retrying shortly.",
-  auth: "API key error. Bot operator: check the backend's credentials.",
+  auth: "API key error. Bot operator: check the backend's credentials (admins: /auth to sign in again).",
   context_length:
     "Conversation too long for the context window. Use /reset to start fresh.",
   session_expired: "Session expired. Retrying automatically...",