@agenticmail/core 0.9.29 → 0.9.30

package/dist/index.cjs

@@ -13335,6 +13335,24 @@ var ServiceManager = class {
       "",
       'log "AgenticMail starting..."',
       "",
+      "# v0.9.84 \u2014 source ~/.agenticmail/.env before exec so the API process",
+      "# inherits AGENTICMAIL_MASTER_KEY, AGENTICMAIL_INBOUND_SECRET, the",
+      "# Stalwart admin creds, and SMTP/IMAP/data-dir overrides. Without",
+      "# this, launchd's child ran with only HOME / PATH / DATA_DIR (the",
+      "# plist EnvironmentVariables block), so the API silently fell back",
+      "# to a fresh-random INBOUND_SECRET on every boot and could not",
+      "# decrypt master-key-protected secrets at all.",
+      'ENV_FILE="$HOME/.agenticmail/.env"',
+      'if [ -f "$ENV_FILE" ]; then',
+      '  log "Sourcing $ENV_FILE"',
+      "  set -a   # mark all sourced vars for export",
+      "  # shellcheck disable=SC1090",
+      '  . "$ENV_FILE"',
+      "  set +a",
+      "else",
+      '  log "WARNING: $ENV_FILE not found \u2014 API will run with default config (no master key)."',
+      "fi",
+      "",
       "# Wait for Docker daemon (up to 10 minutes \u2014 Docker Desktop can be very slow on first boot)",
       "MAX_WAIT=600",
       "WAITED=0",
@@ -13760,6 +13778,16 @@ var SetupManager = class {
     if ((0, import_node_fs10.existsSync)(configPath)) {
       try {
         const existing = JSON.parse((0, import_node_fs10.readFileSync)(configPath, "utf-8"));
+        let needsRewrite = false;
+        if (!existing.inboundSecret) {
+          existing.inboundSecret = `inb_${(0, import_node_crypto6.randomBytes)(24).toString("hex")}`;
+          needsRewrite = true;
+        }
+        if (needsRewrite) {
+          (0, import_node_fs10.writeFileSync)(configPath, JSON.stringify(existing, null, 2));
+          (0, import_node_fs10.chmodSync)(configPath, 384);
+          this.ensureEnvHasInboundSecret(envPath, existing.inboundSecret);
+        }
         this.generateDockerFiles(existing);
         return { configPath, envPath, config: existing, isNew: false };
       } catch {
@@ -13770,8 +13798,10 @@ var SetupManager = class {
     }
     const masterKey = `mk_${(0, import_node_crypto6.randomBytes)(24).toString("hex")}`;
     const stalwartPassword = (0, import_node_crypto6.randomBytes)(16).toString("hex");
+    const inboundSecret = `inb_${(0, import_node_crypto6.randomBytes)(24).toString("hex")}`;
     const config = {
       masterKey,
+      inboundSecret,
       stalwart: {
         url: "http://localhost:8080",
         adminUser: "admin",
@@ -13790,6 +13820,7 @@ STALWART_ADMIN_PASSWORD=${stalwartPassword}
 STALWART_URL=http://localhost:8080
 
 AGENTICMAIL_MASTER_KEY=${masterKey}
+AGENTICMAIL_INBOUND_SECRET=${inboundSecret}
 AGENTICMAIL_API_PORT=3829
 AGENTICMAIL_DATA_DIR=${dataDir}
 
@@ -13803,6 +13834,24 @@ IMAP_PORT=143
     this.generateDockerFiles(config);
     return { configPath, envPath, config, isNew: true };
   }
+  /**
+   * Append `AGENTICMAIL_INBOUND_SECRET=...` to .env if the file does
+   * not already contain that key. Used by the lazy-mint path to make
+   * sure existing installs pick up the new secret on next boot
+   * without clobbering anything the operator added.
+   */
+  ensureEnvHasInboundSecret(envPath, secret) {
+    if (!(0, import_node_fs10.existsSync)(envPath)) return;
+    try {
+      const current = (0, import_node_fs10.readFileSync)(envPath, "utf-8");
+      if (/^AGENTICMAIL_INBOUND_SECRET=/m.test(current)) return;
+      const updated = current + (current.endsWith("\n") ? "" : "\n") + `AGENTICMAIL_INBOUND_SECRET=${secret}
+`;
+      (0, import_node_fs10.writeFileSync)(envPath, updated);
+      (0, import_node_fs10.chmodSync)(envPath, 384);
+    } catch {
+    }
+  }
   /**
    * Generate docker-compose.yml and stalwart.toml in ~/.agenticmail/
    * with the correct admin password from config.

package/dist/index.d.cts

@@ -4943,6 +4943,18 @@ declare class ServiceManager {
 
 interface SetupConfig {
     masterKey: string;
+    /**
+     * Shared secret the inbound-email webhook authenticates against
+     * (`X-Inbound-Secret` header). Auto-minted at setup time and
+     * persisted alongside `masterKey` so every API restart reuses the
+     * same value — without this, the API generated a fresh secret on
+     * every cold start and printed a noisy warning to the operator.
+     *
+     * Optional in the type for backward compatibility with existing
+     * on-disk configs; {@link SetupManager.initConfig} lazy-mints it
+     * into older configs the first time it loads them.
+     */
+    inboundSecret?: string;
     stalwart: {
         url: string;
         adminUser: string;
@@ -5004,6 +5016,13 @@ declare class SetupManager {
      * Always regenerates Docker files to keep passwords in sync.
      */
     initConfig(): SetupResult;
+    /**
+     * Append `AGENTICMAIL_INBOUND_SECRET=...` to .env if the file does
+     * not already contain that key. Used by the lazy-mint path to make
+     * sure existing installs pick up the new secret on next boot
+     * without clobbering anything the operator added.
+     */
+    private ensureEnvHasInboundSecret;
     /**
      * Generate docker-compose.yml and stalwart.toml in ~/.agenticmail/
      * with the correct admin password from config.

package/dist/index.d.ts

@@ -4943,6 +4943,18 @@ declare class ServiceManager {
 
 interface SetupConfig {
     masterKey: string;
+    /**
+     * Shared secret the inbound-email webhook authenticates against
+     * (`X-Inbound-Secret` header). Auto-minted at setup time and
+     * persisted alongside `masterKey` so every API restart reuses the
+     * same value — without this, the API generated a fresh secret on
+     * every cold start and printed a noisy warning to the operator.
+     *
+     * Optional in the type for backward compatibility with existing
+     * on-disk configs; {@link SetupManager.initConfig} lazy-mints it
+     * into older configs the first time it loads them.
+     */
+    inboundSecret?: string;
     stalwart: {
         url: string;
         adminUser: string;
@@ -5004,6 +5016,13 @@ declare class SetupManager {
      * Always regenerates Docker files to keep passwords in sync.
      */
     initConfig(): SetupResult;
+    /**
+     * Append `AGENTICMAIL_INBOUND_SECRET=...` to .env if the file does
+     * not already contain that key. Used by the lazy-mint path to make
+     * sure existing installs pick up the new secret on next boot
+     * without clobbering anything the operator added.
+     */
+    private ensureEnvHasInboundSecret;
     /**
      * Generate docker-compose.yml and stalwart.toml in ~/.agenticmail/
      * with the correct admin password from config.

package/dist/index.js

@@ -11671,6 +11671,24 @@ var ServiceManager = class {
       "",
       'log "AgenticMail starting..."',
       "",
+      "# v0.9.84 \u2014 source ~/.agenticmail/.env before exec so the API process",
+      "# inherits AGENTICMAIL_MASTER_KEY, AGENTICMAIL_INBOUND_SECRET, the",
+      "# Stalwart admin creds, and SMTP/IMAP/data-dir overrides. Without",
+      "# this, launchd's child ran with only HOME / PATH / DATA_DIR (the",
+      "# plist EnvironmentVariables block), so the API silently fell back",
+      "# to a fresh-random INBOUND_SECRET on every boot and could not",
+      "# decrypt master-key-protected secrets at all.",
+      'ENV_FILE="$HOME/.agenticmail/.env"',
+      'if [ -f "$ENV_FILE" ]; then',
+      '  log "Sourcing $ENV_FILE"',
+      "  set -a   # mark all sourced vars for export",
+      "  # shellcheck disable=SC1090",
+      '  . "$ENV_FILE"',
+      "  set +a",
+      "else",
+      '  log "WARNING: $ENV_FILE not found \u2014 API will run with default config (no master key)."',
+      "fi",
+      "",
       "# Wait for Docker daemon (up to 10 minutes \u2014 Docker Desktop can be very slow on first boot)",
       "MAX_WAIT=600",
       "WAITED=0",
@@ -12096,6 +12114,16 @@ var SetupManager = class {
     if (existsSync9(configPath)) {
       try {
         const existing = JSON.parse(readFileSync6(configPath, "utf-8"));
+        let needsRewrite = false;
+        if (!existing.inboundSecret) {
+          existing.inboundSecret = `inb_${randomBytes3(24).toString("hex")}`;
+          needsRewrite = true;
+        }
+        if (needsRewrite) {
+          writeFileSync7(configPath, JSON.stringify(existing, null, 2));
+          chmodSync2(configPath, 384);
+          this.ensureEnvHasInboundSecret(envPath, existing.inboundSecret);
+        }
         this.generateDockerFiles(existing);
         return { configPath, envPath, config: existing, isNew: false };
       } catch {
@@ -12106,8 +12134,10 @@ var SetupManager = class {
     }
     const masterKey = `mk_${randomBytes3(24).toString("hex")}`;
     const stalwartPassword = randomBytes3(16).toString("hex");
+    const inboundSecret = `inb_${randomBytes3(24).toString("hex")}`;
     const config = {
       masterKey,
+      inboundSecret,
       stalwart: {
         url: "http://localhost:8080",
         adminUser: "admin",
@@ -12126,6 +12156,7 @@ STALWART_ADMIN_PASSWORD=${stalwartPassword}
 STALWART_URL=http://localhost:8080
 
 AGENTICMAIL_MASTER_KEY=${masterKey}
+AGENTICMAIL_INBOUND_SECRET=${inboundSecret}
 AGENTICMAIL_API_PORT=3829
 AGENTICMAIL_DATA_DIR=${dataDir}
 
@@ -12139,6 +12170,24 @@ IMAP_PORT=143
     this.generateDockerFiles(config);
     return { configPath, envPath, config, isNew: true };
   }
+  /**
+   * Append `AGENTICMAIL_INBOUND_SECRET=...` to .env if the file does
+   * not already contain that key. Used by the lazy-mint path to make
+   * sure existing installs pick up the new secret on next boot
+   * without clobbering anything the operator added.
+   */
+  ensureEnvHasInboundSecret(envPath, secret) {
+    if (!existsSync9(envPath)) return;
+    try {
+      const current = readFileSync6(envPath, "utf-8");
+      if (/^AGENTICMAIL_INBOUND_SECRET=/m.test(current)) return;
+      const updated = current + (current.endsWith("\n") ? "" : "\n") + `AGENTICMAIL_INBOUND_SECRET=${secret}
+`;
+      writeFileSync7(envPath, updated);
+      chmodSync2(envPath, 384);
+    } catch {
+    }
+  }
   /**
    * Generate docker-compose.yml and stalwart.toml in ~/.agenticmail/
    * with the correct admin password from config.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agenticmail/core",
-  "version": "0.9.29",
+  "version": "0.9.30",
   "description": "Core SDK for AgenticMail — email, SMS, and phone call-control for AI agents",
   "type": "module",
   "main": "dist/index.js",