@ouro.bot/cli 0.1.0-alpha.471 → 0.1.0-alpha.473

package/changelog.json

@@ -1,6 +1,21 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.473",
+      "changes": [
+        "`mail_send` now resolves Azure Communication Services outbound provider clients from explicit generic vault-item bindings, so production ACS sends can leave the agent mailbox after `CONFIRM_SEND` without parsing vault notes.",
+        "Outbound provider bindings now require an explicit credential item and secret field for ACS access keys, with tests covering missing, blank, malformed, non-object, and legacy-shaped vault payloads without leaking secret values.",
+        "The `ouro.bot` wrapper stays version-synced for the outbound provider-client release."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.472",
+      "changes": [
+        "Mail tools now stay usable when a visible message was encrypted to a missing old private key: `mail_recent`, `mail_search`, and `mail_thread` skip or explain only the undecryptable record with body-safe message/key ids.",
+        "Agent Mail recovery docs now distinguish restoring an old private key from hosted key rotation, so future agents do not repeatedly rotate when only an already-lost message is affected."
+      ]
+    },
     {
       "version": "0.1.0-alpha.471",
       "changes": [

package/dist/mailroom/outbound.js

@@ -35,6 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.parseAcsEmailDeliveryReportEvent = void 0;
 exports.createAcsEmailProviderClient = createAcsEmailProviderClient;
+exports.resolveOutboundProviderClient = resolveOutboundProviderClient;
 exports.resolveOutboundTransport = resolveOutboundTransport;
 exports.createMailDraft = createMailDraft;
 exports.confirmMailDraftSend = confirmMailDraftSend;
@@ -148,6 +149,25 @@ function createAcsEmailProviderClient(input) {
         },
     };
 }
+async function resolveOutboundProviderClient(transport, reader, options = {}) {
+    if (transport.kind !== "azure-communication-services")
+        return undefined;
+    const credentialItem = transport.credentialItem?.trim();
+    if (!credentialItem) {
+        throw new Error("outbound Azure Communication Services transport is missing credentialItem");
+    }
+    const accessKeyField = transport.credentialFields?.accessKey?.trim() || "accessKey";
+    const accessKey = (await reader.readSecretField(credentialItem, accessKeyField)).trim();
+    if (!accessKey) {
+        throw new Error(`outbound Azure Communication Services required secret field ${accessKeyField} is blank`);
+    }
+    return createAcsEmailProviderClient({
+        endpoint: transport.endpoint,
+        accessKey,
+        ...(options.fetch ? { fetch: options.fetch } : {}),
+        ...(options.now ? { now: options.now } : {}),
+    });
+}
 function draftId() {
     return `draft_${crypto.randomBytes(12).toString("hex")}`;
 }

package/dist/repertoire/tools-mail.js

@@ -42,6 +42,7 @@ const outbound_1 = require("../mailroom/outbound");
 const policy_1 = require("../mailroom/policy");
 const core_1 = require("../mailroom/core");
 const runtime_1 = require("../nerves/runtime");
+const credential_access_1 = require("./credential-access");
 function trustAllowsMailRead(ctx) {
     const trustLevel = ctx?.context?.friend?.trustLevel;
     const allowed = trustLevel === undefined || (0, types_1.isTrustedLevel)(trustLevel);
@@ -91,6 +92,83 @@ function parseMailList(value) {
         .map((entry) => entry.trim())
         .filter(Boolean);
 }
+function missingPrivateMailKeyId(error) {
+    const match = /^(?:Error: )?Missing private mail key ([^\s]+)$/.exec(String(error));
+    return match?.[1] ?? null;
+}
+function decryptVisibleMessages(messages, privateKeys) {
+    const decrypted = [];
+    const skipped = [];
+    for (const message of messages) {
+        try {
+            decrypted.push((0, file_store_1.decryptMessages)([message], privateKeys)[0]);
+        }
+        catch (error) {
+            const keyId = missingPrivateMailKeyId(error);
+            if (!keyId)
+                throw error;
+            skipped.push({ messageId: message.id, keyId });
+            (0, runtime_1.emitNervesEvent)({
+                component: "repertoire",
+                event: "repertoire.mail_decrypt_skipped",
+                message: "mail message skipped because its private key is missing",
+                meta: { messageId: message.id, keyId },
+            });
+        }
+    }
+    return { decrypted, skipped };
+}
+function renderDecryptSkips(skipped) {
+    if (skipped.length === 0)
+        return "";
+    const noun = skipped.length === 1 ? "message" : "messages";
+    const sample = skipped.slice(0, 3).map((entry) => `${entry.messageId} (${entry.keyId})`).join(", ");
+    const more = skipped.length > 3 ? `; ${skipped.length - 3} more` : "";
+    return [
+        `${skipped.length} mail ${noun} could not be decrypted because this agent's vault is missing private mail key material.`,
+        `skipped: ${sample}${more}`,
+        "recovery: restore the missing private key if available; hosted key rotation can repair future mail, but rotation cannot recover mail already encrypted to a lost private key.",
+    ].join("\n");
+}
+function appendDecryptSkips(body, skipped) {
+    const warning = renderDecryptSkips(skipped);
+    return warning ? `${body}\n\n${warning}` : body;
+}
+function isRecord(value) {
+    return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function vaultItemSecretField(rawSecret, item, field) {
+    let payload;
+    try {
+        payload = JSON.parse(rawSecret);
+    }
+    catch {
+        throw new Error(`vault item ${item} secret payload must be valid JSON`);
+    }
+    if (!isRecord(payload))
+        throw new Error(`vault item ${item} secret payload must be an object`);
+    const secretFields = isRecord(payload.secretFields) ? payload.secretFields : {};
+    const value = [secretFields[field], payload[field]]
+        .find((candidate) => typeof candidate === "string" && candidate.trim().length > 0);
+    if (!value)
+        throw new Error(`vault item ${item} is missing required secret field ${field}`);
+    return value;
+}
+async function outboundProviderClientForTransport(agentName, transport) {
+    return (0, outbound_1.resolveOutboundProviderClient)(transport, {
+        readSecretField: async (item, field) => {
+            const rawSecret = await (0, credential_access_1.getCredentialStore)(agentName).getRawSecret(item, "password");
+            return vaultItemSecretField(rawSecret, item, field);
+        },
+    });
+}
+function renderUndecryptableThread(message, keyId) {
+    return [
+        `Mail message ${message.id} could not be decrypted because this agent's vault is missing private mail key ${keyId}.`,
+        "No body or subject was decrypted.",
+        "recovery: restore the missing private key if available; hosted key rotation can repair future mail, but rotation cannot recover mail already encrypted to a lost private key.",
+    ].join("\n");
+}
 function renderMessageSummary(message) {
     const scope = message.compartmentKind === "delegated"
         ? `delegated:${message.ownerEmail ?? "unknown"}:${message.source ?? "source"}`
@@ -250,9 +328,16 @@ function policyScopeForMessage(message) {
     return message.source ? `source:${message.source.toLowerCase()}` : message.compartmentKind;
 }
 function normalizePolicySender(candidate, message, privateKeys) {
+    let decryptedFrom = [];
+    try {
+        decryptedFrom = (0, file_store_1.decryptMessages)([message], privateKeys)[0].private.from;
+    }
+    catch {
+        decryptedFrom = [];
+    }
     const candidates = [
         candidate?.senderEmail,
-        ...(0, file_store_1.decryptMessages)([message], privateKeys)[0].private.from,
+        ...decryptedFrom,
         message.envelope.mailFrom,
     ].filter((value) => typeof value === "string" && value.trim().length > 0 && value !== "(unknown)");
     for (const candidateValue of candidates) {
@@ -383,7 +468,11 @@ exports.mailToolDefinitions = [
                     ...(args.source ? { source: args.source } : {}),
                 });
             }
-            return (0, file_store_1.decryptMessages)(messages, resolved.config.privateKeys).map(renderMessageSummary).join("\n\n");
+            const result = decryptVisibleMessages(messages, resolved.config.privateKeys);
+            if (result.decrypted.length === 0) {
+                return appendDecryptSkips("No decryptable mail to show.", result.skipped);
+            }
+            return appendDecryptSkips(result.decrypted.map(renderMessageSummary).join("\n\n"), result.skipped);
         },
         summaryKeys: ["scope", "placement", "source", "limit"],
     },
@@ -476,14 +565,16 @@ exports.mailToolDefinitions = [
             if (!resolved.ok)
                 return resolved.error;
             try {
+                const transport = (0, outbound_1.resolveOutboundTransport)(resolved.config);
                 const sent = await (0, outbound_1.confirmMailDraftSend)({
                     store: resolved.store,
                     agentId: resolved.agentName,
                     draftId,
-                    transport: (0, outbound_1.resolveOutboundTransport)(resolved.config),
+                    transport,
                     confirmation: args.confirmation ?? "",
                     autonomous: args.autonomous === "true",
                     autonomyPolicy: resolved.config.autonomousSendPolicy,
+                    providerClient: await outboundProviderClientForTransport(resolved.agentName, transport),
                     actor: actorFromContext(ctx, resolved.agentName),
                     reason: args.reason ?? "confirmed outbound send",
                 });
@@ -559,7 +650,8 @@ exports.mailToolDefinitions = [
                 source: args.source,
                 limit: 200,
             });
-            const matching = (0, file_store_1.decryptMessages)(all, resolved.config.privateKeys)
+            const result = decryptVisibleMessages(all, resolved.config.privateKeys);
+            const matching = result.decrypted
                 .filter((message) => [
                 message.private.subject,
                 message.private.snippet,
@@ -582,8 +674,8 @@ exports.mailToolDefinitions = [
                 });
             }
             if (matching.length === 0)
-                return "No matching mail.";
-            return matching.map(renderMessageSummary).join("\n\n");
+                return appendDecryptSkips("No matching mail.", result.skipped);
+            return appendDecryptSkips(matching.map(renderMessageSummary).join("\n\n"), result.skipped);
         },
         summaryKeys: ["query", "limit"],
     },
@@ -621,7 +713,6 @@ exports.mailToolDefinitions = [
                 if (blocked)
                     return blocked;
             }
-            const decrypted = (0, file_store_1.decryptMessages)([message], resolved.config.privateKeys)[0];
             await resolved.store.recordAccess({
                 agentId: resolved.agentName,
                 messageId,
@@ -629,6 +720,16 @@ exports.mailToolDefinitions = [
                 reason: args.reason,
                 ...accessProvenance(message),
             });
+            let decrypted;
+            try {
+                decrypted = (0, file_store_1.decryptMessages)([message], resolved.config.privateKeys)[0];
+            }
+            catch (error) {
+                const keyId = missingPrivateMailKeyId(error);
+                if (!keyId)
+                    throw error;
+                return renderUndecryptableThread(message, keyId);
+            }
             const maxChars = numberArg(args.max_chars, 2000, 200, 6000);
             const body = decrypted.private.text.length > maxChars
                 ? `${decrypted.private.text.slice(0, maxChars - 3)}...`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.471",
+  "version": "0.1.0-alpha.473",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",