From dbed82bab41fa81e7d68fb9817b65346a53cd14e Mon Sep 17 00:00:00 2001
From: rope <fredrik@nordhammer.it>
Date: Sat, 1 Aug 2026 17:21:05 +0100
Subject: [PATCH] qs-ask: report why it went quiet on stderr
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Silence on stdout is the launcher's fall-back-to-Wikipedia signal, so it
has to stay clean — but that made a misconfigured key indistinguishable
from a working fallback. Every reason now prints on stderr, which the
launcher discards and a human running qs-ask by hand can read.

Drops curl -f so a 4xx body's own error message ("API key is invalid.")
surfaces instead of just an exit code, and guards the specific mistake of
pasting the sk-ant-... placeholder literally.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 hosts/FredOS-Mediaserver.nix | 48 +++++++++++++++++++++++++++---------
 1 file changed, 37 insertions(+), 11 deletions(-)

diff --git a/hosts/FredOS-Mediaserver.nix b/hosts/FredOS-Mediaserver.nix
index 5b55ce2..7a397f9 100644
--- a/hosts/FredOS-Mediaserver.nix
+++ b/hosts/FredOS-Mediaserver.nix
@@ -78,15 +78,23 @@
       #   printf '%s' sk-ant-... > ~/.config/anthropic/api-key
       #   chmod 600 ~/.config/anthropic/api-key
       #
-      # Prints nothing on a missing key, a failed call, or an UNKNOWN reply —
-      # the launcher reads silence as "fall back to Wikipedia".
+      # STDOUT is the launcher's channel: the answer, or nothing at all on a
+      # missing key, a failed call, or an UNKNOWN reply — silence is what the
+      # launcher reads as "fall back to Wikipedia", so it must stay clean.
+      # Every reason for that silence is reported on STDERR instead, which the
+      # launcher discards but a human running `qs-ask` by hand can read.
       (pkgs.writeShellScriptBin "qs-ask" ''
         q=$(${pkgs.coreutils}/bin/cat)
-        [ -z "$q" ] && exit 0
+        [ -z "$q" ] && { echo "qs-ask: no question on stdin" >&2; exit 0; }
         key_file="$HOME/.config/anthropic/api-key"
-        [ -r "$key_file" ] || exit 0
+        [ -r "$key_file" ] || { echo "qs-ask: no readable key at $key_file" >&2; exit 0; }
         key=$(${pkgs.coreutils}/bin/tr -d '\n' < "$key_file")
-        [ -z "$key" ] && exit 0
+        [ -z "$key" ] && { echo "qs-ask: key file is empty" >&2; exit 0; }
+        # Catches the classic paste-the-placeholder-literally mistake, which
+        # otherwise only shows up as an opaque 401.
+        case "$key" in
+          sk-ant-...|*...) echo "qs-ask: key file holds a placeholder, not a real key" >&2; exit 0 ;;
+        esac
 
         # jq builds the body, so a question containing quotes or backslashes
         # can't break out of the JSON string.
@@ -97,16 +105,34 @@
           messages: [ { role: "user", content: $q } ]
         }')
 
-        ans=$(${pkgs.curl}/bin/curl -sf --max-time 10 https://api.anthropic.com/v1/messages \
+        # No -f here: a 4xx body carries the API's own error message, which is
+        # far more useful on stderr than curl's exit code. Status is appended on
+        # its own line so it can be split off the JSON.
+        resp=$(${pkgs.curl}/bin/curl -s -w '\n%{http_code}' --max-time 10 \
+          https://api.anthropic.com/v1/messages \
           -H 'content-type: application/json' \
           -H "x-api-key: $key" \
           -H 'anthropic-version: 2023-06-01' \
-          --data-raw "$body" \
-          | ${pkgs.jq}/bin/jq -r '[.content[]? | select(.type == "text") | .text] | join(" ")')
+          --data-raw "$body") \
+          || { echo "qs-ask: request failed (network or timeout)" >&2; exit 0; }
 
-        # UNKNOWN, a refusal (empty content), or any transport error: stay quiet
-        # so the launcher's Wikipedia path answers instead.
-        case "$ans" in ""|null|UNKNOWN*) exit 0 ;; esac
+        code=''${resp##*$'\n'}
+        json=''${resp%$'\n'*}
+
+        if [ "$code" != 200 ]; then
+          printf 'qs-ask: HTTP %s — %s\n' "$code" \
+            "$(printf '%s' "$json" | ${pkgs.jq}/bin/jq -r '.error.message // "no error message"')" >&2
+          exit 0
+        fi
+
+        ans=$(printf '%s' "$json" | ${pkgs.jq}/bin/jq -r '[.content[]? | select(.type == "text") | .text] | join(" ")')
+
+        # UNKNOWN or a refusal (empty content): stay quiet on stdout so the
+        # launcher's Wikipedia path answers instead.
+        case "$ans" in
+          "" |null)   echo "qs-ask: empty answer (refusal or no text block)" >&2; exit 0 ;;
+          UNKNOWN*)   echo "qs-ask: model replied UNKNOWN" >&2; exit 0 ;;
+        esac
         printf '%s' "$ans"
       '')
     ];