@meffecta/agent 1.0.12 → 1.0.13

package/engine.json

@@ -1,4 +1,4 @@
 {
-  "engineTag": "1.0.12",
-  "builtFrom": "222c28d7ab3961fc2512e630a6b41b60430c9558"
+  "engineTag": "1.0.13",
+  "builtFrom": "2c7075fd557116ad9692c5bb1780d60a1559aa01"
 }

package/lib/integrations.js

@@ -199,7 +199,8 @@ const INTEGRATIONS = {
     needs: [
       "A mailbox the agent can read. Either a Workspace mailbox via domain-wide delegation",
       "(keyless, Cloud Run only), or any Gmail account you have already connected — see",
-      "`meffecta-agent connect gmail` first if you have not.",
+      "`meffecta-agent connect gmail` first if you have not. An AgentMail inbox needs none",
+      "of that: set AGENTMAIL_API_KEY and skip to the frontmatter below.",
     ],
     steps: [
       [
@@ -213,11 +214,15 @@ const INTEGRATIONS = {
     more: [
       "Then, in the job's frontmatter:",
       "",
-      "    inbox: crm@yourdomain.com",
+      "    inbox: gmail:crm@yourdomain.com",
       "    allowFrom: you@yourdomain.com, @yourdomain.com",
       "",
       "and `deploy` to register it — both fields are read when the service boots.",
       "",
+      "The system is required: `gmail:<address>`, or `agentmail:<address>` for an inbox the",
+      "agent owns. A bare address is refused rather than guessed at, because an address",
+      "polled against the wrong system finds nothing for ever and looks healthy doing it.",
+      "",
       "allowFrom is required and enforced in code: mail from anyone not listed is dropped",
       "before the run starts, so it never reaches the model. Leave it out and the job",
       "refuses every message — an omission is not read as consent.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meffecta/agent",
-  "version": "1.0.12",
+  "version": "1.0.13",
   "description": "Set up and operate a Meffecta Agent deployment — a self-hosted Claude Code job runner.",
   "type": "module",
   "bin": {

package/scripts/verify-credentials.mjs

@@ -163,6 +163,25 @@ async function checkAhrefs() {
     : fail("AHREFS_API_KEY", `domain-rating-free → ${status}`);
 }
 
+async function checkAgentmail() {
+  if (!env.AGENTMAIL_API_KEY) {
+    return skip("AGENTMAIL_API_KEY", "unset");
+  }
+  // The cheapest call there is, and the one that answers what actually matters about this
+  // key: a key scoped to a single inbox is indistinguishable from an account-wide one until
+  // something asks, and a job pointed at another inbox would fail with a puzzling 404.
+  const { status, json } = await http("https://api.agentmail.to/v0/auth/me", {
+    headers: { Authorization: `Bearer ${env.AGENTMAIL_API_KEY}` },
+  });
+  if (status !== 200) {
+    return fail("AGENTMAIL_API_KEY", `auth/me → ${status}`);
+  }
+  ok(
+    "AGENTMAIL_API_KEY",
+    json?.scope_type === "inbox" ? `scoped to ${json.inbox_id}` : `${json?.scope_type ?? "?"}-wide scope`,
+  );
+}
+
 async function checkSerper() {
   if (!env.SERPER_API_KEY) {
     return skip("SERPER_API_KEY", "unset");
@@ -646,6 +665,7 @@ const CHECKS = [
   ["POSTHOG", checkPosthog],
   ["AHREFS_API_KEY", checkAhrefs],
   ["SERPER_API_KEY", checkSerper],
+  ["AGENTMAIL_API_KEY", checkAgentmail],
   ["HUBSPOT_TOKEN", checkHubspot],
   ["KLEER_API_TOKEN", checkKleer],
   ["CLOUDFLARE", checkCloudflare],