@agenticmail/enterprise 0.5.114 → 0.5.115

package/dist/cli-agent-C7AENG3T.js

@@ -0,0 +1,469 @@
+import "./chunk-KFQGP6VL.js";
+
+// src/cli-agent.ts
+import { Hono } from "hono";
+import { serve } from "@hono/node-server";
+async function runAgent(_args) {
+  const DATABASE_URL = process.env.DATABASE_URL;
+  const JWT_SECRET = process.env.JWT_SECRET;
+  const AGENT_ID = process.env.AGENTICMAIL_AGENT_ID;
+  const PORT = parseInt(process.env.PORT || "3000", 10);
+  if (!DATABASE_URL) {
+    console.error("ERROR: DATABASE_URL is required");
+    process.exit(1);
+  }
+  if (!JWT_SECRET) {
+    console.error("ERROR: JWT_SECRET is required");
+    process.exit(1);
+  }
+  if (!AGENT_ID) {
+    console.error("ERROR: AGENTICMAIL_AGENT_ID is required");
+    process.exit(1);
+  }
+  console.log("\u{1F916} AgenticMail Agent Runtime");
+  console.log(`   Agent ID: ${AGENT_ID}`);
+  console.log("   Connecting to database...");
+  const { createAdapter } = await import("./factory-GT6SUZSQ.js");
+  const db = await createAdapter({
+    type: DATABASE_URL.startsWith("postgres") ? "postgres" : "sqlite",
+    connectionString: DATABASE_URL
+  });
+  await db.migrate();
+  const { EngineDatabase } = await import("./db-adapter-65QMSGCB.js");
+  const engineDbInterface = db.getEngineDB();
+  if (!engineDbInterface) {
+    console.error("ERROR: Database does not support engine queries");
+    process.exit(1);
+  }
+  const adapterDialect = db.getDialect();
+  const dialectMap = {
+    sqlite: "sqlite",
+    postgres: "postgres",
+    supabase: "postgres",
+    neon: "postgres",
+    cockroachdb: "postgres"
+  };
+  const engineDialect = dialectMap[adapterDialect] || adapterDialect;
+  const engineDb = new EngineDatabase(engineDbInterface, engineDialect);
+  await engineDb.migrate();
+  const agentRow = await engineDb.query(
+    `SELECT id, name, display_name, config, state FROM managed_agents WHERE id = $1`,
+    [AGENT_ID]
+  );
+  if (!agentRow || agentRow.length === 0) {
+    console.error(`ERROR: Agent ${AGENT_ID} not found in database`);
+    process.exit(1);
+  }
+  const agent = agentRow[0];
+  console.log(`   Agent: ${agent.display_name || agent.name}`);
+  console.log(`   State: ${agent.state}`);
+  const { AgentLifecycleManager } = await import("./lifecycle-IFPWWGQ3.js");
+  const lifecycle = new AgentLifecycleManager({ db: engineDb });
+  await lifecycle.loadFromDb();
+  const managed = lifecycle.getAgent(AGENT_ID);
+  if (!managed) {
+    console.error(`ERROR: Could not load agent ${AGENT_ID} from lifecycle`);
+    process.exit(1);
+  }
+  const config = managed.config;
+  console.log(`   Model: ${config.model?.provider}/${config.model?.modelId}`);
+  let memoryManager;
+  try {
+    const { AgentMemoryManager } = await import("./agent-memory-G7YFTMDO.js");
+    memoryManager = new AgentMemoryManager(engineDb);
+    console.log("   Memory: DB-backed");
+  } catch {
+    console.log("   Memory: file-based fallback");
+  }
+  try {
+    const settings = await db.getSettings();
+    const keys = settings?.modelPricingConfig?.providerApiKeys;
+    if (keys && typeof keys === "object") {
+      const { PROVIDER_REGISTRY } = await import("./providers-DZDNNJTY.js");
+      for (const [providerId, apiKey] of Object.entries(keys)) {
+        const envVar = PROVIDER_REGISTRY[providerId]?.envKey;
+        if (envVar && apiKey && !process.env[envVar]) {
+          process.env[envVar] = apiKey;
+          console.log(`   \u{1F511} Loaded API key for ${providerId}`);
+        }
+      }
+    }
+  } catch {
+  }
+  const { createAgentRuntime } = await import("./runtime-GB7V3PPC.js");
+  const getEmailConfig = (agentId) => {
+    const m = lifecycle.getAgent(agentId);
+    return m?.config?.emailConfig || null;
+  };
+  const onTokenRefresh = (agentId, tokens) => {
+    const m = lifecycle.getAgent(agentId);
+    if (m?.config?.emailConfig) {
+      if (tokens.accessToken) m.config.emailConfig.oauthAccessToken = tokens.accessToken;
+      if (tokens.refreshToken) m.config.emailConfig.oauthRefreshToken = tokens.refreshToken;
+      if (tokens.expiresAt) m.config.emailConfig.oauthTokenExpiry = tokens.expiresAt;
+      lifecycle.saveAgent(agentId).catch(() => {
+      });
+    }
+  };
+  let defaultModel;
+  const modelStr = process.env.AGENTICMAIL_MODEL || `${config.model?.provider}/${config.model?.modelId}`;
+  if (modelStr && modelStr.includes("/")) {
+    const [provider, ...rest] = modelStr.split("/");
+    defaultModel = {
+      provider,
+      modelId: rest.join("/"),
+      thinkingLevel: process.env.AGENTICMAIL_THINKING || config.model?.thinkingLevel
+    };
+  }
+  const runtime = createAgentRuntime({
+    engineDb,
+    adminDb: db,
+    defaultModel,
+    apiKeys: {},
+    gatewayEnabled: true,
+    getEmailConfig,
+    onTokenRefresh,
+    agentMemoryManager: memoryManager,
+    resumeOnStartup: true
+  });
+  await runtime.start();
+  const runtimeApp = runtime.getApp();
+  const app = new Hono();
+  app.get("/health", (c) => c.json({
+    status: "ok",
+    agentId: AGENT_ID,
+    agentName: agent.display_name || agent.name,
+    uptime: process.uptime()
+  }));
+  app.get("/ready", (c) => c.json({ ready: true, agentId: AGENT_ID }));
+  if (runtimeApp) {
+    app.route("/api/runtime", runtimeApp);
+  }
+  serve({ fetch: app.fetch, port: PORT }, (info) => {
+    console.log(`
+\u2705 Agent runtime started`);
+    console.log(`   Health: http://localhost:${info.port}/health`);
+    console.log(`   Runtime: http://localhost:${info.port}/api/runtime`);
+    console.log("");
+  });
+  const shutdown = () => {
+    console.log("\n\u23F3 Shutting down agent...");
+    runtime.stop().then(() => db.disconnect()).then(() => {
+      console.log("\u2705 Agent shutdown complete");
+      process.exit(0);
+    });
+    setTimeout(() => process.exit(1), 1e4).unref();
+  };
+  process.on("SIGINT", shutdown);
+  process.on("SIGTERM", shutdown);
+  try {
+    await engineDb.query(
+      `UPDATE managed_agents SET state = 'running', updated_at = $1 WHERE id = $2`,
+      [(/* @__PURE__ */ new Date()).toISOString(), AGENT_ID]
+    );
+    console.log("   State: running");
+  } catch {
+  }
+  setTimeout(async () => {
+    try {
+      const orgRows = await engineDb.query(
+        `SELECT org_id FROM managed_agents WHERE id = $1`,
+        [AGENT_ID]
+      );
+      const orgId = orgRows?.[0]?.org_id;
+      if (!orgId) {
+        console.log("[onboarding] No org ID found, skipping");
+        return;
+      }
+      const pendingRows = await engineDb.query(
+        `SELECT r.id, r.policy_id, p.name as policy_name, p.content as policy_content, p.priority
+         FROM onboarding_records r
+         JOIN org_policies p ON r.policy_id = p.id
+         WHERE r.agent_id = $1 AND r.status = 'pending'`,
+        [AGENT_ID]
+      );
+      if (!pendingRows || pendingRows.length === 0) {
+        console.log("[onboarding] Already complete or no records");
+      } else {
+        console.log(`[onboarding] ${pendingRows.length} pending policies \u2014 auto-acknowledging...`);
+        const ts = (/* @__PURE__ */ new Date()).toISOString();
+        const policyNames = [];
+        for (const row of pendingRows) {
+          const policyName = row.policy_name || row.policy_id;
+          policyNames.push(policyName);
+          console.log(`[onboarding] Reading: ${policyName}`);
+          const { createHash } = await import("crypto");
+          const hash = createHash("sha256").update(row.policy_content || "").digest("hex").slice(0, 16);
+          await engineDb.query(
+            `UPDATE onboarding_records SET status = 'acknowledged', acknowledged_at = $1, verification_hash = $2, updated_at = $1 WHERE id = $3`,
+            [ts, hash, row.id]
+          );
+          console.log(`[onboarding] \u2705 Acknowledged: ${policyName}`);
+          if (memoryManager) {
+            try {
+              await memoryManager.storeMemory(AGENT_ID, {
+                content: `Organization policy "${policyName}" (${row.priority}): ${(row.policy_content || "").slice(0, 500)}`,
+                category: "org_knowledge",
+                importance: row.priority === "mandatory" ? "high" : "medium",
+                confidence: 1
+              });
+            } catch {
+            }
+          }
+        }
+        if (memoryManager) {
+          try {
+            await memoryManager.storeMemory(AGENT_ID, {
+              content: `Completed onboarding: read and acknowledged ${policyNames.length} organization policies: ${policyNames.join(", ")}.`,
+              category: "org_knowledge",
+              importance: "high",
+              confidence: 1
+            });
+          } catch {
+          }
+        }
+        console.log(`[onboarding] \u2705 Onboarding complete \u2014 ${policyNames.length} policies acknowledged`);
+      }
+      const managerEmail = config.managerEmail || (config.manager?.type === "external" ? config.manager.email : null);
+      const emailConfig = config.emailConfig;
+      if (managerEmail && emailConfig) {
+        console.log(`[welcome] Sending introduction email to ${managerEmail}...`);
+        try {
+          const { createEmailProvider } = await import("./agenticmail-TQQF7BI4.js");
+          const providerType = emailConfig.provider || (emailConfig.oauthProvider === "google" ? "google" : emailConfig.oauthProvider === "microsoft" ? "microsoft" : "imap");
+          const emailProvider = createEmailProvider(providerType);
+          let currentAccessToken = emailConfig.oauthAccessToken;
+          const refreshTokenFn = emailConfig.oauthRefreshToken ? async () => {
+            const clientId = emailConfig.oauthClientId;
+            const clientSecret = emailConfig.oauthClientSecret;
+            const refreshToken = emailConfig.oauthRefreshToken;
+            const tokenUrl = providerType === "google" ? "https://oauth2.googleapis.com/token" : "https://login.microsoftonline.com/common/oauth2/v2.0/token";
+            const res = await fetch(tokenUrl, {
+              method: "POST",
+              headers: { "Content-Type": "application/x-www-form-urlencoded" },
+              body: new URLSearchParams({
+                client_id: clientId,
+                client_secret: clientSecret,
+                refresh_token: refreshToken,
+                grant_type: "refresh_token"
+              })
+            });
+            const data = await res.json();
+            if (data.access_token) {
+              currentAccessToken = data.access_token;
+              emailConfig.oauthAccessToken = data.access_token;
+              if (data.expires_in) emailConfig.oauthTokenExpiry = new Date(Date.now() + data.expires_in * 1e3).toISOString();
+              lifecycle.saveAgent(AGENT_ID).catch(() => {
+              });
+              return data.access_token;
+            }
+            throw new Error(`Token refresh failed: ${JSON.stringify(data)}`);
+          } : void 0;
+          if (refreshTokenFn) {
+            try {
+              currentAccessToken = await refreshTokenFn();
+              console.log("[welcome] Refreshed OAuth token");
+            } catch (refreshErr) {
+              console.error(`[welcome] Token refresh failed: ${refreshErr.message}`);
+            }
+          }
+          await emailProvider.connect({
+            agentId: AGENT_ID,
+            name: config.displayName || config.name,
+            email: emailConfig.email || config.email?.address || "",
+            orgId,
+            accessToken: currentAccessToken,
+            refreshToken: refreshTokenFn,
+            provider: providerType
+          });
+          const agentName = config.displayName || config.name;
+          const role = config.identity?.role || "AI Agent";
+          const traits = config.identity?.traits || {};
+          const traitLines = Object.entries(traits).filter(([, v]) => v).map(([k, v]) => `  - ${k}: ${v}`).join("\n");
+          const policyCount = pendingRows?.length || 0;
+          const body = `Hello,
+
+I'm ${agentName}, your new ${role}. I've just been deployed and have completed my onboarding \u2014 I've read and acknowledged all ${policyCount} organization policies.
+
+About me:
+- Role: ${role}
+- Communication style: ${config.identity?.tone || "professional"}
+- Language: ${config.identity?.language || "English"}
+${traitLines ? `- Personality traits:
+${traitLines}` : ""}
+
+I'm ready to start working. Here's what I can help with:
+- Responding to emails and communications
+- Processing tasks and requests
+- Following organization guidelines and escalation protocols
+
+You can reach me by email at ${config.email?.address || emailConfig?.email || "my configured email address"}, or through the enterprise dashboard.
+
+Looking forward to working with you!
+
+Best regards,
+${agentName}`;
+          await emailProvider.send({
+            to: managerEmail,
+            subject: `Hi! I'm ${agentName}, your new ${role}`,
+            text: body
+          });
+          console.log(`[welcome] \u2705 Welcome email sent to ${managerEmail}`);
+          if (memoryManager) {
+            try {
+              await memoryManager.storeMemory(AGENT_ID, {
+                content: `Sent welcome introduction email to manager at ${managerEmail}. Introduced myself as ${agentName}, ${role}.`,
+                category: "interaction_pattern",
+                importance: "medium",
+                confidence: 1
+              });
+            } catch {
+            }
+          }
+        } catch (err) {
+          console.error(`[welcome] Failed to send welcome email: ${err.message}`);
+        }
+      } else {
+        if (!managerEmail) console.log("[welcome] No manager email configured, skipping welcome email");
+      }
+    } catch (err) {
+      console.error(`[onboarding] Error: ${err.message}`);
+    }
+    startEmailPolling(AGENT_ID, config, lifecycle, runtime, engineDb, memoryManager);
+  }, 3e3);
+}
+async function startEmailPolling(agentId, config, lifecycle, runtime, engineDb, memoryManager) {
+  const emailConfig = config.emailConfig;
+  if (!emailConfig) {
+    console.log("[email-poll] No email config, inbox polling disabled");
+    return;
+  }
+  const providerType = emailConfig.provider || (emailConfig.oauthProvider === "google" ? "google" : emailConfig.oauthProvider === "microsoft" ? "microsoft" : "imap");
+  const refreshTokenFn = emailConfig.oauthRefreshToken ? async () => {
+    const tokenUrl = providerType === "google" ? "https://oauth2.googleapis.com/token" : "https://login.microsoftonline.com/common/oauth2/v2.0/token";
+    const res = await fetch(tokenUrl, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        client_id: emailConfig.oauthClientId,
+        client_secret: emailConfig.oauthClientSecret,
+        refresh_token: emailConfig.oauthRefreshToken,
+        grant_type: "refresh_token"
+      })
+    });
+    const data = await res.json();
+    if (data.access_token) {
+      emailConfig.oauthAccessToken = data.access_token;
+      if (data.expires_in) emailConfig.oauthTokenExpiry = new Date(Date.now() + data.expires_in * 1e3).toISOString();
+      lifecycle.saveAgent(agentId).catch(() => {
+      });
+      return data.access_token;
+    }
+    throw new Error(`Token refresh failed: ${JSON.stringify(data)}`);
+  } : void 0;
+  const { createEmailProvider } = await import("./agenticmail-TQQF7BI4.js");
+  const emailProvider = createEmailProvider(providerType);
+  let accessToken = emailConfig.oauthAccessToken;
+  if (refreshTokenFn) {
+    try {
+      accessToken = await refreshTokenFn();
+    } catch (e) {
+      console.error(`[email-poll] Token refresh failed: ${e.message}`);
+    }
+  }
+  const orgRows = await engineDb.query(`SELECT org_id FROM managed_agents WHERE id = $1`, [agentId]);
+  const orgId = orgRows?.[0]?.org_id || "";
+  await emailProvider.connect({
+    agentId,
+    name: config.displayName || config.name,
+    email: emailConfig.email || config.email?.address || "",
+    orgId,
+    accessToken,
+    refreshToken: refreshTokenFn,
+    provider: providerType
+  });
+  console.log("[email-poll] \u2705 Email provider connected, starting inbox polling (every 30s)");
+  const processedIds = /* @__PURE__ */ new Set();
+  try {
+    const existing = await emailProvider.listMessages("INBOX", { limit: 50 });
+    for (const msg of existing) {
+      processedIds.add(msg.uid);
+    }
+    console.log(`[email-poll] Loaded ${processedIds.size} existing messages (will skip)`);
+  } catch (e) {
+    console.error(`[email-poll] Failed to load existing messages: ${e.message}`);
+  }
+  const POLL_INTERVAL = 3e4;
+  const agentEmail = (emailConfig.email || config.email?.address || "").toLowerCase();
+  async function pollOnce() {
+    try {
+      const messages = await emailProvider.listMessages("INBOX", { limit: 20 });
+      const unread = messages.filter((m) => !m.flags?.includes("\\Seen") && !processedIds.has(m.uid));
+      for (const envelope of unread) {
+        processedIds.add(envelope.uid);
+        if (envelope.from?.email?.toLowerCase() === agentEmail) continue;
+        console.log(`[email-poll] New email from ${envelope.from?.email}: "${envelope.subject}"`);
+        const fullMsg = await emailProvider.readMessage(envelope.uid, "INBOX");
+        try {
+          await emailProvider.markRead(envelope.uid, "INBOX");
+        } catch {
+        }
+        const emailText = [
+          `[Inbound Email]`,
+          `From: ${fullMsg.from?.name ? `${fullMsg.from.name} <${fullMsg.from.email}>` : fullMsg.from?.email}`,
+          `Subject: ${fullMsg.subject}`,
+          fullMsg.inReplyTo ? `In-Reply-To: ${fullMsg.inReplyTo}` : "",
+          "",
+          fullMsg.text || fullMsg.html || "(empty body)"
+        ].filter(Boolean).join("\n");
+        try {
+          const agentName = config.displayName || config.name;
+          const role = config.identity?.role || "AI Agent";
+          const senderName = fullMsg.from?.name || fullMsg.from?.email || "someone";
+          const senderEmail = fullMsg.from?.email || "";
+          const emailSystemPrompt = `You are ${agentName}, a ${role}. You just received an email and need to respond to it.
+
+Your email address: ${agentEmail}
+Sender: ${senderName} <${senderEmail}>
+Subject: ${fullMsg.subject}
+
+IMPORTANT: After composing your response, you MUST reply using the email_reply tool or email_send tool. Do NOT just generate text \u2014 actually send the email reply.
+If you have an email_reply tool, use it with the message UID. If not, use email_send to send to ${senderEmail} with subject "Re: ${fullMsg.subject}".
+
+Be helpful, professional, and concise. Follow all organization policies you've been onboarded with.`;
+          const session = await runtime.spawnSession({
+            agentId,
+            message: emailText,
+            systemPrompt: emailSystemPrompt
+          });
+          console.log(`[email-poll] Session ${session.id} created for email from ${senderEmail}`);
+        } catch (sessErr) {
+          console.error(`[email-poll] Failed to create session: ${sessErr.message}`);
+        }
+      }
+    } catch (err) {
+      console.error(`[email-poll] Poll error: ${err.message}`);
+      if (err.message.includes("401") && refreshTokenFn) {
+        try {
+          const newToken = await refreshTokenFn();
+          await emailProvider.connect({
+            agentId,
+            name: config.displayName || config.name,
+            email: emailConfig.email || config.email?.address || "",
+            orgId,
+            accessToken: newToken,
+            refreshToken: refreshTokenFn,
+            provider: providerType
+          });
+          console.log("[email-poll] Reconnected with fresh token");
+        } catch {
+        }
+      }
+    }
+  }
+  setInterval(pollOnce, POLL_INTERVAL);
+  setTimeout(pollOnce, 5e3);
+}
+export {
+  runAgent
+};

package/dist/cli.js

@@ -50,7 +50,7 @@ Skill Development:
     import("./cli-serve-QZA3G4VA.js").then((m) => m.runServe(args.slice(1))).catch(fatal);
     break;
   case "agent":
-    import("./cli-agent-GKRF7X2S.js").then((m) => m.runAgent(args.slice(1))).catch(fatal);
+    import("./cli-agent-C7AENG3T.js").then((m) => m.runAgent(args.slice(1))).catch(fatal);
     break;
   case "setup":
   default:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agenticmail/enterprise",
-  "version": "0.5.114",
+  "version": "0.5.115",
   "description": "AgenticMail Enterprise — cloud-hosted AI agent identity, email, auth & compliance for organizations",
   "type": "module",
   "bin": {

package/src/cli-agent.ts

@@ -390,5 +390,176 @@ ${agentName}`;
     } catch (err: any) {
       console.error(`[onboarding] Error: ${err.message}`);
     }
+
+    // 12. Start email inbox polling loop
+    startEmailPolling(AGENT_ID, config, lifecycle, runtime, engineDb, memoryManager);
   }, 3000);
 }
+
+// ─── Email Polling Loop ─────────────────────────────────────
+
+async function startEmailPolling(
+  agentId: string, config: any, lifecycle: any, runtime: any,
+  engineDb: any, memoryManager: any
+) {
+  const emailConfig = config.emailConfig;
+  if (!emailConfig) {
+    console.log('[email-poll] No email config, inbox polling disabled');
+    return;
+  }
+
+  const providerType = emailConfig.provider || (emailConfig.oauthProvider === 'google' ? 'google' : emailConfig.oauthProvider === 'microsoft' ? 'microsoft' : 'imap');
+
+  // Build token refresh function
+  const refreshTokenFn = emailConfig.oauthRefreshToken ? async () => {
+    const tokenUrl = providerType === 'google'
+      ? 'https://oauth2.googleapis.com/token'
+      : 'https://login.microsoftonline.com/common/oauth2/v2.0/token';
+    const res = await fetch(tokenUrl, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      body: new URLSearchParams({
+        client_id: emailConfig.oauthClientId,
+        client_secret: emailConfig.oauthClientSecret,
+        refresh_token: emailConfig.oauthRefreshToken,
+        grant_type: 'refresh_token',
+      }),
+    });
+    const data = await res.json() as any;
+    if (data.access_token) {
+      emailConfig.oauthAccessToken = data.access_token;
+      if (data.expires_in) emailConfig.oauthTokenExpiry = new Date(Date.now() + data.expires_in * 1000).toISOString();
+      lifecycle.saveAgent(agentId).catch(() => {});
+      return data.access_token;
+    }
+    throw new Error(`Token refresh failed: ${JSON.stringify(data)}`);
+  } : undefined;
+
+  // Create and connect email provider
+  const { createEmailProvider } = await import('./agenticmail/index.js');
+  const emailProvider = createEmailProvider(providerType);
+
+  // Get fresh token
+  let accessToken = emailConfig.oauthAccessToken;
+  if (refreshTokenFn) {
+    try { accessToken = await refreshTokenFn(); } catch (e: any) { console.error(`[email-poll] Token refresh failed: ${e.message}`); }
+  }
+
+  const orgRows = await engineDb.query<any>(`SELECT org_id FROM managed_agents WHERE id = $1`, [agentId]);
+  const orgId = orgRows?.[0]?.org_id || '';
+
+  await emailProvider.connect({
+    agentId,
+    name: config.displayName || config.name,
+    email: emailConfig.email || config.email?.address || '',
+    orgId,
+    accessToken,
+    refreshToken: refreshTokenFn,
+    provider: providerType,
+  });
+
+  console.log('[email-poll] ✅ Email provider connected, starting inbox polling (every 30s)');
+
+  // Track processed message IDs to avoid duplicates
+  const processedIds = new Set<string>();
+
+  // Initial load — mark existing messages as processed so we don't reply to old emails
+  try {
+    const existing = await emailProvider.listMessages('INBOX', { limit: 50 });
+    for (const msg of existing) {
+      processedIds.add(msg.uid);
+    }
+    console.log(`[email-poll] Loaded ${processedIds.size} existing messages (will skip)`);
+  } catch (e: any) {
+    console.error(`[email-poll] Failed to load existing messages: ${e.message}`);
+  }
+
+  // Poll loop
+  const POLL_INTERVAL = 30_000; // 30 seconds
+  const agentEmail = (emailConfig.email || config.email?.address || '').toLowerCase();
+
+  async function pollOnce() {
+    try {
+      const messages = await emailProvider.listMessages('INBOX', { limit: 20 });
+      const unread = messages.filter(m => !m.flags?.includes('\\Seen') && !processedIds.has(m.uid));
+
+      for (const envelope of unread) {
+        processedIds.add(envelope.uid);
+
+        // Skip emails from ourselves
+        if (envelope.from?.email?.toLowerCase() === agentEmail) continue;
+
+        console.log(`[email-poll] New email from ${envelope.from?.email}: "${envelope.subject}"`);
+
+        // Read full message
+        const fullMsg = await emailProvider.readMessage(envelope.uid, 'INBOX');
+
+        // Mark as read
+        try { await emailProvider.markRead(envelope.uid, 'INBOX'); } catch {}
+
+        // Format as agent message and spawn a session
+        const emailText = [
+          `[Inbound Email]`,
+          `From: ${fullMsg.from?.name ? `${fullMsg.from.name} <${fullMsg.from.email}>` : fullMsg.from?.email}`,
+          `Subject: ${fullMsg.subject}`,
+          fullMsg.inReplyTo ? `In-Reply-To: ${fullMsg.inReplyTo}` : '',
+          '',
+          fullMsg.text || fullMsg.html || '(empty body)',
+        ].filter(Boolean).join('\n');
+
+        // Create agent session to handle this email
+        try {
+          const agentName = config.displayName || config.name;
+          const role = config.identity?.role || 'AI Agent';
+          const senderName = fullMsg.from?.name || fullMsg.from?.email || 'someone';
+          const senderEmail = fullMsg.from?.email || '';
+
+          // System prompt tells the agent to reply via email
+          const emailSystemPrompt = `You are ${agentName}, a ${role}. You just received an email and need to respond to it.
+
+Your email address: ${agentEmail}
+Sender: ${senderName} <${senderEmail}>
+Subject: ${fullMsg.subject}
+
+IMPORTANT: After composing your response, you MUST reply using the email_reply tool or email_send tool. Do NOT just generate text — actually send the email reply.
+If you have an email_reply tool, use it with the message UID. If not, use email_send to send to ${senderEmail} with subject "Re: ${fullMsg.subject}".
+
+Be helpful, professional, and concise. Follow all organization policies you've been onboarded with.`;
+
+          const session = await runtime.spawnSession({
+            agentId,
+            message: emailText,
+            systemPrompt: emailSystemPrompt,
+          });
+
+          console.log(`[email-poll] Session ${session.id} created for email from ${senderEmail}`);
+        } catch (sessErr: any) {
+          console.error(`[email-poll] Failed to create session: ${sessErr.message}`);
+        }
+      }
+    } catch (err: any) {
+      console.error(`[email-poll] Poll error: ${err.message}`);
+      // If token expired, try to refresh
+      if (err.message.includes('401') && refreshTokenFn) {
+        try {
+          const newToken = await refreshTokenFn();
+          await emailProvider.connect({
+            agentId,
+            name: config.displayName || config.name,
+            email: emailConfig.email || config.email?.address || '',
+            orgId,
+            accessToken: newToken,
+            refreshToken: refreshTokenFn,
+            provider: providerType,
+          });
+          console.log('[email-poll] Reconnected with fresh token');
+        } catch {}
+      }
+    }
+  }
+
+  // Start polling
+  setInterval(pollOnce, POLL_INTERVAL);
+  // First poll after 5s
+  setTimeout(pollOnce, 5000);
+}