@ouro.bot/cli 0.1.0-alpha.471 → 0.1.0-alpha.472

package/changelog.json

@@ -1,6 +1,13 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.472",
+      "changes": [
+        "Mail tools now stay usable when a visible message was encrypted to a missing old private key: `mail_recent`, `mail_search`, and `mail_thread` skip or explain only the undecryptable record with body-safe message/key ids.",
+        "Agent Mail recovery docs now distinguish restoring an old private key from hosted key rotation, so future agents do not repeatedly rotate when only an already-lost message is affected."
+      ]
+    },
     {
       "version": "0.1.0-alpha.471",
       "changes": [

package/dist/repertoire/tools-mail.js

@@ -91,6 +91,55 @@ function parseMailList(value) {
         .map((entry) => entry.trim())
         .filter(Boolean);
 }
+function missingPrivateMailKeyId(error) {
+    const match = /^(?:Error: )?Missing private mail key ([^\s]+)$/.exec(String(error));
+    return match?.[1] ?? null;
+}
+function decryptVisibleMessages(messages, privateKeys) {
+    const decrypted = [];
+    const skipped = [];
+    for (const message of messages) {
+        try {
+            decrypted.push((0, file_store_1.decryptMessages)([message], privateKeys)[0]);
+        }
+        catch (error) {
+            const keyId = missingPrivateMailKeyId(error);
+            if (!keyId)
+                throw error;
+            skipped.push({ messageId: message.id, keyId });
+            (0, runtime_1.emitNervesEvent)({
+                component: "repertoire",
+                event: "repertoire.mail_decrypt_skipped",
+                message: "mail message skipped because its private key is missing",
+                meta: { messageId: message.id, keyId },
+            });
+        }
+    }
+    return { decrypted, skipped };
+}
+function renderDecryptSkips(skipped) {
+    if (skipped.length === 0)
+        return "";
+    const noun = skipped.length === 1 ? "message" : "messages";
+    const sample = skipped.slice(0, 3).map((entry) => `${entry.messageId} (${entry.keyId})`).join(", ");
+    const more = skipped.length > 3 ? `; ${skipped.length - 3} more` : "";
+    return [
+        `${skipped.length} mail ${noun} could not be decrypted because this agent's vault is missing private mail key material.`,
+        `skipped: ${sample}${more}`,
+        "recovery: restore the missing private key if available; hosted key rotation can repair future mail, but rotation cannot recover mail already encrypted to a lost private key.",
+    ].join("\n");
+}
+function appendDecryptSkips(body, skipped) {
+    const warning = renderDecryptSkips(skipped);
+    return warning ? `${body}\n\n${warning}` : body;
+}
+function renderUndecryptableThread(message, keyId) {
+    return [
+        `Mail message ${message.id} could not be decrypted because this agent's vault is missing private mail key ${keyId}.`,
+        "No body or subject was decrypted.",
+        "recovery: restore the missing private key if available; hosted key rotation can repair future mail, but rotation cannot recover mail already encrypted to a lost private key.",
+    ].join("\n");
+}
 function renderMessageSummary(message) {
     const scope = message.compartmentKind === "delegated"
         ? `delegated:${message.ownerEmail ?? "unknown"}:${message.source ?? "source"}`
@@ -250,9 +299,16 @@ function policyScopeForMessage(message) {
     return message.source ? `source:${message.source.toLowerCase()}` : message.compartmentKind;
 }
 function normalizePolicySender(candidate, message, privateKeys) {
+    let decryptedFrom = [];
+    try {
+        decryptedFrom = (0, file_store_1.decryptMessages)([message], privateKeys)[0].private.from;
+    }
+    catch {
+        decryptedFrom = [];
+    }
     const candidates = [
         candidate?.senderEmail,
-        ...(0, file_store_1.decryptMessages)([message], privateKeys)[0].private.from,
+        ...decryptedFrom,
         message.envelope.mailFrom,
     ].filter((value) => typeof value === "string" && value.trim().length > 0 && value !== "(unknown)");
     for (const candidateValue of candidates) {
@@ -383,7 +439,11 @@ exports.mailToolDefinitions = [
                     ...(args.source ? { source: args.source } : {}),
                 });
             }
-            return (0, file_store_1.decryptMessages)(messages, resolved.config.privateKeys).map(renderMessageSummary).join("\n\n");
+            const result = decryptVisibleMessages(messages, resolved.config.privateKeys);
+            if (result.decrypted.length === 0) {
+                return appendDecryptSkips("No decryptable mail to show.", result.skipped);
+            }
+            return appendDecryptSkips(result.decrypted.map(renderMessageSummary).join("\n\n"), result.skipped);
         },
         summaryKeys: ["scope", "placement", "source", "limit"],
     },
@@ -559,7 +619,8 @@ exports.mailToolDefinitions = [
                 source: args.source,
                 limit: 200,
             });
-            const matching = (0, file_store_1.decryptMessages)(all, resolved.config.privateKeys)
+            const result = decryptVisibleMessages(all, resolved.config.privateKeys);
+            const matching = result.decrypted
                 .filter((message) => [
                 message.private.subject,
                 message.private.snippet,
@@ -582,8 +643,8 @@ exports.mailToolDefinitions = [
                 });
             }
             if (matching.length === 0)
-                return "No matching mail.";
-            return matching.map(renderMessageSummary).join("\n\n");
+                return appendDecryptSkips("No matching mail.", result.skipped);
+            return appendDecryptSkips(matching.map(renderMessageSummary).join("\n\n"), result.skipped);
         },
         summaryKeys: ["query", "limit"],
     },
@@ -621,7 +682,6 @@ exports.mailToolDefinitions = [
                 if (blocked)
                     return blocked;
             }
-            const decrypted = (0, file_store_1.decryptMessages)([message], resolved.config.privateKeys)[0];
             await resolved.store.recordAccess({
                 agentId: resolved.agentName,
                 messageId,
@@ -629,6 +689,16 @@ exports.mailToolDefinitions = [
                 reason: args.reason,
                 ...accessProvenance(message),
             });
+            let decrypted;
+            try {
+                decrypted = (0, file_store_1.decryptMessages)([message], resolved.config.privateKeys)[0];
+            }
+            catch (error) {
+                const keyId = missingPrivateMailKeyId(error);
+                if (!keyId)
+                    throw error;
+                return renderUndecryptableThread(message, keyId);
+            }
             const maxChars = numberArg(args.max_chars, 2000, 200, 6000);
             const body = decrypted.private.text.length > maxChars
                 ? `${decrypted.private.text.slice(0, maxChars - 3)}...`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.471",
+  "version": "0.1.0-alpha.472",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",