From e1503632d9cd2853232f9c0900f40d2ad7e8b80d Mon Sep 17 00:00:00 2001
From: Stephan Noller <stephan.noller@gmail.com>
Date: Mon, 13 Apr 2026 14:56:20 +0200
Subject: [PATCH 1/8] feat: add Fetch Email-Config button to admin email
 channel editor

Adds a button that calls the HybridAI agent handles API to retrieve
email configuration and auto-populate IMAP/SMTP fields.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 console/src/api/client.ts          |  4 ++
 console/src/routes/channels.tsx    | 84 ++++++++++++++++++++++++++++++
 src/gateway/gateway-http-server.ts | 67 ++++++++++++++++++++++++
 3 files changed, 155 insertions(+)

diff --git a/console/src/api/client.ts b/console/src/api/client.ts
index d5380a60..c9ddb2df 100644
--- a/console/src/api/client.ts
+++ b/console/src/api/client.ts
@@ -321,6 +321,10 @@ export function fetchConfig(token: string): Promise<AdminConfigResponse> {
   return requestJson<AdminConfigResponse>('/api/admin/config', { token });
 }
 
+export function fetchEmailConfig(token: string): Promise<unknown> {
+  return requestJson<unknown>('/api/admin/email-config/fetch', { token });
+}
+
 export function saveConfig(
   token: string,
   config: AdminConfig,
diff --git a/console/src/routes/channels.tsx b/console/src/routes/channels.tsx
index 066680f7..f0913c0c 100644
--- a/console/src/routes/channels.tsx
+++ b/console/src/routes/channels.tsx
@@ -2,6 +2,7 @@ import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
 import { useEffect, useState } from 'react';
 import {
   fetchConfig,
+  fetchEmailConfig,
   saveConfig,
   setRuntimeSecret,
   validateToken,
@@ -960,6 +961,78 @@ function EmailChannelEditor(props: {
   token: string;
   onSecretSaved: () => void;
 }) {
+  const [fetchingEmailConfig, setFetchingEmailConfig] = useState(false);
+  const toast = useToast();
+
+  async function handleFetchEmailConfig() {
+    setFetchingEmailConfig(true);
+    try {
+      const result = (await fetchEmailConfig(props.token)) as {
+        handles?: Array<{
+          handle?: string;
+          label?: string;
+          status?: string;
+          email_config?: {
+            address?: string;
+            imap_host?: string;
+            imap_port?: number;
+            imap_secure?: boolean;
+            smtp_host?: string;
+            smtp_port?: number;
+            smtp_secure?: boolean;
+            password?: string;
+          };
+        }>;
+      };
+
+      const handles = result?.handles;
+      if (!Array.isArray(handles) || handles.length === 0) {
+        toast.info('No agent handles found on HybridAI.');
+        return;
+      }
+
+      // Find first handle with email_config, or just show what we got
+      const withConfig = handles.find((h) => h.email_config);
+      if (withConfig?.email_config) {
+        const cfg = withConfig.email_config;
+        props.updateDraft((current) => ({
+          ...current,
+          email: {
+            ...current.email,
+            ...(cfg.address ? { address: cfg.address } : {}),
+            ...(cfg.imap_host ? { imapHost: cfg.imap_host } : {}),
+            ...(cfg.imap_port != null ? { imapPort: cfg.imap_port } : {}),
+            ...(cfg.imap_secure != null ? { imapSecure: cfg.imap_secure } : {}),
+            ...(cfg.smtp_host ? { smtpHost: cfg.smtp_host } : {}),
+            ...(cfg.smtp_port != null ? { smtpPort: cfg.smtp_port } : {}),
+            ...(cfg.smtp_secure != null ? { smtpSecure: cfg.smtp_secure } : {}),
+          },
+        }));
+        toast.success(
+          `Email config loaded from handle "${withConfig.handle}".`,
+        );
+        // If a password was included, save it as runtime secret
+        if (cfg.password) {
+          await setRuntimeSecret(props.token, 'EMAIL_PASSWORD', cfg.password);
+          props.onSecretSaved();
+        }
+      } else {
+        // No email_config in handles — show available handles info
+        const summary = handles
+          .map((h) => `${h.handle} (${h.status})`)
+          .join(', ');
+        toast.info(`Handles found: ${summary}. No email config attached.`);
+      }
+    } catch (error) {
+      toast.error(
+        'Failed to fetch email config',
+        getErrorMessage(error),
+      );
+    } finally {
+      setFetchingEmailConfig(false);
+    }
+  }
+
   return (
     <>
       <BooleanField
@@ -978,6 +1051,17 @@ function EmailChannelEditor(props: {
         }
       />
 
+      <div style={{ marginBottom: '1rem' }}>
+        <button
+          type="button"
+          className="btn btn-secondary"
+          disabled={fetchingEmailConfig}
+          onClick={handleFetchEmailConfig}
+        >
+          {fetchingEmailConfig ? 'Fetching…' : 'Fetch Email-Config'}
+        </button>
+      </div>
+
       <div className="field-grid">
         <label className="field">
           <span>Address</span>
diff --git a/src/gateway/gateway-http-server.ts b/src/gateway/gateway-http-server.ts
index 944b86a7..9fa94f29 100644
--- a/src/gateway/gateway-http-server.ts
+++ b/src/gateway/gateway-http-server.ts
@@ -26,6 +26,7 @@ import {
   MSTEAMS_WEBHOOK_PATH,
   WEB_API_TOKEN,
 } from '../config/config.js';
+import { getHybridAIApiKey } from '../auth/hybridai-auth.js';
 import type {
   RuntimeConfig,
   RuntimeDiscordChannelConfig,
@@ -2493,6 +2494,65 @@ async function handleApiAdminConfig(
   sendJson(res, 200, saveGatewayAdminConfig(body.config as RuntimeConfig));
 }
 
+async function handleApiAdminEmailConfigFetch(
+  res: ServerResponse,
+): Promise<void> {
+  let apiKey: string;
+  try {
+    apiKey = getHybridAIApiKey();
+  } catch {
+    sendJson(res, 400, {
+      error:
+        'HYBRIDAI_API_KEY is not configured. Run `hybridclaw auth login hybridai` first.',
+    });
+    return;
+  }
+
+  const baseUrl = (HYBRIDAI_BASE_URL || 'https://hybridai.one').replace(
+    /\/+$/,
+    '',
+  );
+
+  let response: Response;
+  try {
+    response = await fetch(`${baseUrl}/api/v1/agent-handles/`, {
+      headers: { Authorization: `Bearer ${apiKey}` },
+      signal: AbortSignal.timeout(10_000),
+    });
+  } catch (error) {
+    sendJson(res, 502, {
+      error: `Could not reach HybridAI API: ${error instanceof Error ? error.message : String(error)}`,
+    });
+    return;
+  }
+
+  const contentType = response.headers.get('content-type') || '';
+  let payload: unknown;
+  if (contentType.includes('application/json')) {
+    payload = await response.json().catch(() => null);
+  } else {
+    const text = await response.text().catch(() => '');
+    try {
+      payload = JSON.parse(text);
+    } catch {
+      payload = text;
+    }
+  }
+
+  if (!response.ok) {
+    const msg =
+      (payload as Record<string, unknown>)?.message ||
+      (payload as Record<string, unknown>)?.error ||
+      `HybridAI API returned HTTP ${response.status}`;
+    sendJson(res, response.status >= 500 ? 502 : response.status, {
+      error: String(msg),
+    });
+    return;
+  }
+
+  sendJson(res, 200, payload);
+}
+
 async function handleApiAdminModels(
   req: IncomingMessage,
   res: ServerResponse,
@@ -3304,6 +3364,13 @@ export function startGatewayHttpServer(): GatewayHttpServer {
             await handleApiAdminConfig(req, res);
             return;
           }
+          if (
+            pathname === '/api/admin/email-config/fetch' &&
+            method === 'GET'
+          ) {
+            await handleApiAdminEmailConfigFetch(res);
+            return;
+          }
           if (pathname === '/api/admin/audit' && method === 'GET') {
             handleApiAdminAudit(res, url);
             return;

From afb6a8844afd9fdae861b4ca458d4d0804e49176 Mon Sep 17 00:00:00 2001
From: Stephan Noller <stephan.noller@gmail.com>
Date: Mon, 13 Apr 2026 16:07:46 +0200
Subject: [PATCH 2/8] fix: map upstream HybridAI errors to 502 to avoid gateway
 auth confusion

Returning a 401/403 from the HybridAI proxy caused the console to
interpret it as a gateway auth failure and clear WEB_API_TOKEN.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 src/gateway/gateway-http-server.ts | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/gateway/gateway-http-server.ts b/src/gateway/gateway-http-server.ts
index 9fa94f29..680d38fe 100644
--- a/src/gateway/gateway-http-server.ts
+++ b/src/gateway/gateway-http-server.ts
@@ -7,6 +7,7 @@ import path from 'node:path';
 import { createSilentReplyStreamFilter } from '../agent/silent-reply-stream.js';
 import { getAgentById, resolveAgentConfig } from '../agents/agent-registry.js';
 import { DEFAULT_AGENT_ID } from '../agents/agent-types.js';
+import { getHybridAIApiKey } from '../auth/hybridai-auth.js';
 import {
   type DiscordToolActionRequest,
   normalizeDiscordToolAction,
@@ -26,7 +27,6 @@ import {
   MSTEAMS_WEBHOOK_PATH,
   WEB_API_TOKEN,
 } from '../config/config.js';
-import { getHybridAIApiKey } from '../auth/hybridai-auth.js';
 import type {
   RuntimeConfig,
   RuntimeDiscordChannelConfig,
@@ -2544,7 +2544,9 @@ async function handleApiAdminEmailConfigFetch(
       (payload as Record<string, unknown>)?.message ||
       (payload as Record<string, unknown>)?.error ||
       `HybridAI API returned HTTP ${response.status}`;
-    sendJson(res, response.status >= 500 ? 502 : response.status, {
+    // Map all upstream errors to 502 so that 401/403 from HybridAI doesn't
+    // get mistaken for a gateway auth failure (which would clear WEB_API_TOKEN).
+    sendJson(res, 502, {
       error: String(msg),
     });
     return;

From 76474bd65a5f794f073233ee2aeef33bce285311 Mon Sep 17 00:00:00 2001
From: Stephan Noller <stephan.noller@gmail.com>
Date: Mon, 13 Apr 2026 16:08:31 +0200
Subject: [PATCH 3/8] fix: handle nested HybridAI error payloads and set
 no-store cache header

Extract error messages from nested shapes like { error: { message } }
to avoid forwarding "[object Object]". Set Cache-Control: no-store on
the proxy response to prevent caching of potentially sensitive data.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 src/gateway/gateway-http-server.ts | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/src/gateway/gateway-http-server.ts b/src/gateway/gateway-http-server.ts
index 680d38fe..5d553aeb 100644
--- a/src/gateway/gateway-http-server.ts
+++ b/src/gateway/gateway-http-server.ts
@@ -2540,9 +2540,15 @@ async function handleApiAdminEmailConfigFetch(
   }
 
   if (!response.ok) {
+    const record = payload as Record<string, unknown> | null;
+    const nested = record?.error;
     const msg =
-      (payload as Record<string, unknown>)?.message ||
-      (payload as Record<string, unknown>)?.error ||
+      (typeof record?.message === 'string' && record.message) ||
+      (typeof nested === 'string' && nested) ||
+      (nested &&
+        typeof nested === 'object' &&
+        typeof (nested as Record<string, unknown>).message === 'string' &&
+        (nested as Record<string, unknown>).message) ||
       `HybridAI API returned HTTP ${response.status}`;
     // Map all upstream errors to 502 so that 401/403 from HybridAI doesn't
     // get mistaken for a gateway auth failure (which would clear WEB_API_TOKEN).
@@ -2552,6 +2558,7 @@ async function handleApiAdminEmailConfigFetch(
     return;
   }
 
+  res.setHeader('Cache-Control', 'no-store');
   sendJson(res, 200, payload);
 }
 

From 9993e8272b6a013451628e4a30f37fb7d75d1a7e Mon Sep 17 00:00:00 2001
From: Stephan Noller <stephan.noller@gmail.com>
Date: Mon, 13 Apr 2026 16:09:11 +0200
Subject: [PATCH 4/8] fix: use ghost-button styling consistent with rest of
 channels page

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 console/src/routes/channels.tsx | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/console/src/routes/channels.tsx b/console/src/routes/channels.tsx
index f0913c0c..64a23ce4 100644
--- a/console/src/routes/channels.tsx
+++ b/console/src/routes/channels.tsx
@@ -1024,10 +1024,7 @@ function EmailChannelEditor(props: {
         toast.info(`Handles found: ${summary}. No email config attached.`);
       }
     } catch (error) {
-      toast.error(
-        'Failed to fetch email config',
-        getErrorMessage(error),
-      );
+      toast.error('Failed to fetch email config', getErrorMessage(error));
     } finally {
       setFetchingEmailConfig(false);
     }
@@ -1051,10 +1048,10 @@ function EmailChannelEditor(props: {
         }
       />
 
-      <div style={{ marginBottom: '1rem' }}>
+      <div className="button-row">
         <button
           type="button"
-          className="btn btn-secondary"
+          className="ghost-button"
           disabled={fetchingEmailConfig}
           onClick={handleFetchEmailConfig}
         >

From 80cb94b444d9d4c890359764036f3df2d1246302 Mon Sep 17 00:00:00 2001
From: Stephan Noller <stephan.noller@gmail.com>
Date: Mon, 13 Apr 2026 16:11:23 +0200
Subject: [PATCH 5/8] fix: show success toast only after password secret is
 saved

Move the success toast after the setRuntimeSecret call so a partial
failure (fields populated but password save failed) is reported clearly.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 console/src/routes/channels.tsx | 23 ++++++++++++++++++-----
 1 file changed, 18 insertions(+), 5 deletions(-)

diff --git a/console/src/routes/channels.tsx b/console/src/routes/channels.tsx
index 64a23ce4..b2f3b7a3 100644
--- a/console/src/routes/channels.tsx
+++ b/console/src/routes/channels.tsx
@@ -1008,14 +1008,27 @@ function EmailChannelEditor(props: {
             ...(cfg.smtp_secure != null ? { smtpSecure: cfg.smtp_secure } : {}),
           },
         }));
+        // Save password as runtime secret before showing success
+        if (cfg.password) {
+          try {
+            await setRuntimeSecret(
+              props.token,
+              'EMAIL_PASSWORD',
+              cfg.password,
+            );
+            props.onSecretSaved();
+          } catch (err) {
+            toast.error(
+              'Password could not be saved',
+              getErrorMessage(err),
+            );
+            toast.info('Email fields were populated, but password was not saved.');
+            return;
+          }
+        }
         toast.success(
           `Email config loaded from handle "${withConfig.handle}".`,
         );
-        // If a password was included, save it as runtime secret
-        if (cfg.password) {
-          await setRuntimeSecret(props.token, 'EMAIL_PASSWORD', cfg.password);
-          props.onSecretSaved();
-        }
       } else {
         // No email_config in handles — show available handles info
         const summary = handles

From a22651875b5ddb3e331b691c0a23e3fe114692d0 Mon Sep 17 00:00:00 2001
From: Benedikt Koehler <benedikt.koehler@hybridai.one>
Date: Mon, 13 Apr 2026 17:15:32 +0200
Subject: [PATCH 6/8] fix: gate hybridai agent email import

---
 console/src/api/types.ts             |   4 ++
 console/src/routes/channels.test.tsx | 102 ++++++++++++++++++++++++++-
 console/src/routes/channels.tsx      |  24 +++++--
 src/gateway/gateway-service.ts       |   5 ++
 src/gateway/gateway-types.ts         |   4 ++
 tests/gateway-status.test.ts         |  32 +++++++++
 6 files changed, 162 insertions(+), 9 deletions(-)

diff --git a/console/src/api/types.ts b/console/src/api/types.ts
index 8dcb9e0c..bbdcc505 100644
--- a/console/src/api/types.ts
+++ b/console/src/api/types.ts
@@ -21,6 +21,10 @@ export interface GatewayStatus {
     expiresAt: number | null;
     reloginRequired: boolean;
   };
+  hybridai?: {
+    apiKeyConfigured: boolean;
+    apiKeySource: 'env' | 'runtime-secrets' | null;
+  };
   sandbox?: {
     mode: 'container' | 'host';
     activeSessions: number;
diff --git a/console/src/routes/channels.test.tsx b/console/src/routes/channels.test.tsx
index 3773ee66..c6f3c154 100644
--- a/console/src/routes/channels.test.tsx
+++ b/console/src/routes/channels.test.tsx
@@ -12,6 +12,7 @@ import { ToastProvider } from '../components/toast';
 import { ChannelsPage } from './channels';
 
 const fetchConfigMock = vi.fn<() => Promise<AdminConfigResponse>>();
+const fetchEmailConfigMock = vi.fn();
 const saveConfigMock = vi.fn();
 const setRuntimeSecretMock = vi.fn();
 const validateTokenMock = vi.fn();
@@ -19,6 +20,7 @@ const useAuthMock = vi.fn();
 
 vi.mock('../api/client', () => ({
   fetchConfig: () => fetchConfigMock(),
+  fetchEmailConfig: (...args: unknown[]) => fetchEmailConfigMock(...args),
   saveConfig: (...args: unknown[]) => saveConfigMock(...args),
   setRuntimeSecret: (...args: unknown[]) => setRuntimeSecretMock(...args),
   validateToken: (...args: unknown[]) => validateTokenMock(...args),
@@ -223,11 +225,16 @@ function renderChannelsPage(): void {
 describe('ChannelsPage', () => {
   beforeEach(() => {
     fetchConfigMock.mockReset();
+    fetchEmailConfigMock.mockReset();
     saveConfigMock.mockReset();
     setRuntimeSecretMock.mockReset();
     validateTokenMock.mockReset();
     useAuthMock.mockReset();
     const gatewayStatus = {
+      hybridai: {
+        apiKeyConfigured: false,
+        apiKeySource: null,
+      },
       discord: {
         tokenConfigured: false,
         tokenSource: null,
@@ -1034,12 +1041,103 @@ describe('ChannelsPage', () => {
 
     renderChannelsPage();
 
-    await screen.findByRole('button', { name: /Email/i });
-    fireEvent.click(screen.getByRole('button', { name: /Email/i }));
+    const [emailChannelButton] = await screen.findAllByRole('button', {
+      name: /Email/i,
+    });
+    fireEvent.click(emailChannelButton);
     screen.getByRole('button', { name: 'Change password' });
     expect(screen.queryByRole('button', { name: 'Set password' })).toBeNull();
   });
 
+  it('hides fetch email config when no HybridAI API key is configured', async () => {
+    fetchConfigMock.mockResolvedValue({
+      path: '/tmp/config.json',
+      config: makeConfig(),
+    });
+
+    renderChannelsPage();
+
+    const [emailChannelButton] = await screen.findAllByRole('button', {
+      name: /Email/i,
+    });
+    fireEvent.click(emailChannelButton);
+
+    expect(
+      screen.queryByRole('button', { name: 'Fetch HybridAI Agent Email' }),
+    ).toBeNull();
+  });
+
+  it('shows fetch email config when a HybridAI API key is configured', async () => {
+    fetchConfigMock.mockResolvedValue({
+      path: '/tmp/config.json',
+      config: makeConfig(),
+    });
+    validateTokenMock.mockResolvedValue({
+      status: 'ok',
+      webAuthConfigured: true,
+      version: 'test',
+      imageTag: null,
+      uptime: 1,
+      sessions: 0,
+      activeContainers: 0,
+      defaultModel: 'gpt-5',
+      ragDefault: true,
+      timestamp: new Date().toISOString(),
+      hybridai: {
+        apiKeyConfigured: true,
+        apiKeySource: 'runtime-secrets',
+      },
+      email: {
+        passwordConfigured: false,
+        passwordSource: null,
+      },
+      imessage: {
+        passwordConfigured: false,
+        passwordSource: null,
+      },
+      whatsapp: {
+        linked: false,
+        jid: null,
+        pairingQrText: null,
+        pairingUpdatedAt: null,
+      },
+    });
+    useAuthMock.mockReturnValue({
+      token: 'test-token',
+      gatewayStatus: {
+        hybridai: {
+          apiKeyConfigured: true,
+          apiKeySource: 'runtime-secrets',
+        },
+        email: {
+          passwordConfigured: false,
+          passwordSource: null,
+        },
+        imessage: {
+          passwordConfigured: false,
+          passwordSource: null,
+        },
+        whatsapp: {
+          linked: false,
+          jid: null,
+          pairingQrText: null,
+          pairingUpdatedAt: null,
+        },
+      },
+    });
+
+    renderChannelsPage();
+
+    const [emailChannelButton] = await screen.findAllByRole('button', {
+      name: /Email/i,
+    });
+    fireEvent.click(emailChannelButton);
+
+    expect(
+      screen.getByRole('button', { name: 'Fetch HybridAI Agent Email' }),
+    ).toBeTruthy();
+  });
+
   it('updates Telegram bot tokens through encrypted runtime secrets', async () => {
     fetchConfigMock.mockResolvedValue({
       path: '/tmp/config.json',
diff --git a/console/src/routes/channels.tsx b/console/src/routes/channels.tsx
index b2f3b7a3..d744299f 100644
--- a/console/src/routes/channels.tsx
+++ b/console/src/routes/channels.tsx
@@ -958,6 +958,7 @@ function EmailChannelEditor(props: {
   updateDraft: ConfigUpdater;
   passwordConfigured: boolean;
   passwordSource: SecretSource;
+  hybridaiApiKeyConfigured: boolean;
   token: string;
   onSecretSaved: () => void;
 }) {
@@ -987,7 +988,7 @@ function EmailChannelEditor(props: {
 
       const handles = result?.handles;
       if (!Array.isArray(handles) || handles.length === 0) {
-        toast.info('No agent handles found on HybridAI.');
+        toast.info('No HybridAI agent handles found.');
         return;
       }
 
@@ -1027,14 +1028,16 @@ function EmailChannelEditor(props: {
           }
         }
         toast.success(
-          `Email config loaded from handle "${withConfig.handle}".`,
+          `HybridAI agent email config loaded from handle "${withConfig.handle}".`,
         );
       } else {
         // No email_config in handles — show available handles info
         const summary = handles
           .map((h) => `${h.handle} (${h.status})`)
           .join(', ');
-        toast.info(`Handles found: ${summary}. No email config attached.`);
+        toast.info(
+          `HybridAI agent handles found: ${summary}. No agent email config attached.`,
+        );
       }
     } catch (error) {
       toast.error('Failed to fetch email config', getErrorMessage(error));
@@ -1061,16 +1064,18 @@ function EmailChannelEditor(props: {
         }
       />
 
-      <div className="button-row">
-        <button
-          type="button"
+      {props.hybridaiApiKeyConfigured ? (
+        <div className="button-row">
+          <button
+            type="button"
           className="ghost-button"
           disabled={fetchingEmailConfig}
           onClick={handleFetchEmailConfig}
         >
-          {fetchingEmailConfig ? 'Fetching…' : 'Fetch Email-Config'}
+          {fetchingEmailConfig ? 'Fetching…' : 'Fetch HybridAI Agent Email'}
         </button>
       </div>
+      ) : null}
 
       <div className="field-grid">
         <label className="field">
@@ -2061,6 +2066,7 @@ function renderSelectedEditor(
       source: SecretSource;
     };
   },
+  hybridaiApiKeyConfigured: boolean,
   whatsappStatus: {
     linked: boolean;
     pairingQrText: string | null;
@@ -2119,6 +2125,7 @@ function renderSelectedEditor(
           updateDraft={updateDraft}
           passwordConfigured={secretStatus.email.configured}
           passwordSource={secretStatus.email.source}
+          hybridaiApiKeyConfigured={hybridaiApiKeyConfigured}
           token={token}
           onSecretSaved={onSecretSaved}
         />
@@ -2244,6 +2251,8 @@ export function ChannelsPage() {
     linked: statusQuery.data?.whatsapp?.linked ?? false,
     pairingQrText: statusQuery.data?.whatsapp?.pairingQrText ?? null,
   };
+  const hybridaiApiKeyConfigured =
+    statusQuery.data?.hybridai?.apiKeyConfigured ?? false;
 
   return (
     <div className="page-stack">
@@ -2294,6 +2303,7 @@ export function ChannelsPage() {
                   updateDraft,
                   auth.token,
                   secretStatus,
+                  hybridaiApiKeyConfigured,
                   whatsappStatus,
                   () => {
                     void queryClient.invalidateQueries({
diff --git a/src/gateway/gateway-service.ts b/src/gateway/gateway-service.ts
index 306e115a..63465599 100644
--- a/src/gateway/gateway-service.ts
+++ b/src/gateway/gateway-service.ts
@@ -2950,6 +2950,7 @@ export function buildTokenUsageAuditPayload(
 
 export async function getGatewayStatus(): Promise<GatewayStatus> {
   const codex = getCodexAuthStatus();
+  const hybridai = getHybridAIAuthStatus();
   const [localBackendsResult, hybridaiResult, whatsappAuthResult] =
     await Promise.allSettled([
       localBackendsProbe.get(),
@@ -3059,6 +3060,10 @@ export async function getGatewayStatus(): Promise<GatewayStatus> {
       expiresAt: codex.expiresAt,
       reloginRequired: codex.reloginRequired,
     },
+    hybridai: {
+      apiKeyConfigured: hybridai.authenticated,
+      apiKeySource: hybridai.source,
+    },
     sandbox,
     observability: getObservabilityIngestState(),
     scheduler: {
diff --git a/src/gateway/gateway-types.ts b/src/gateway/gateway-types.ts
index 800b3ef6..6b2131dd 100644
--- a/src/gateway/gateway-types.ts
+++ b/src/gateway/gateway-types.ts
@@ -354,6 +354,10 @@ export interface GatewayStatus {
     expiresAt: number | null;
     reloginRequired: boolean;
   };
+  hybridai?: {
+    apiKeyConfigured: boolean;
+    apiKeySource: 'env' | 'runtime-secrets' | null;
+  };
   sandbox?: {
     mode: 'container' | 'host';
     modeExplicit: boolean;
diff --git a/tests/gateway-status.test.ts b/tests/gateway-status.test.ts
index f2a09212..e3d2848a 100644
--- a/tests/gateway-status.test.ts
+++ b/tests/gateway-status.test.ts
@@ -6,6 +6,7 @@ import { afterEach, expect, test, vi } from 'vitest';
 import type { RuntimeConfig } from '../src/config/runtime-config.js';
 
 const ORIGINAL_HOME = process.env.HOME;
+const ORIGINAL_CWD = process.cwd();
 const ORIGINAL_DISCORD_TOKEN = process.env.DISCORD_TOKEN;
 const ORIGINAL_HYBRIDAI_API_KEY = process.env.HYBRIDAI_API_KEY;
 const ORIGINAL_OPENROUTER_API_KEY = process.env.OPENROUTER_API_KEY;
@@ -66,6 +67,7 @@ afterEach(() => {
   vi.doUnmock('../src/providers/local-health.js');
   vi.resetModules();
   restoreEnvVar('HOME', ORIGINAL_HOME);
+  process.chdir(ORIGINAL_CWD);
   restoreEnvVar('DISCORD_TOKEN', ORIGINAL_DISCORD_TOKEN);
   restoreEnvVar('HYBRIDAI_API_KEY', ORIGINAL_HYBRIDAI_API_KEY);
   restoreEnvVar('OPENROUTER_API_KEY', ORIGINAL_OPENROUTER_API_KEY);
@@ -216,6 +218,10 @@ test('getGatewayStatus includes Codex auth state', async () => {
     );
   expect(codexRequest).toBeDefined();
   expect(codexRequest?.url.searchParams.get('client_version')).toBeTruthy();
+  expect(status.hybridai).toEqual({
+    apiKeyConfigured: true,
+    apiKeySource: 'env',
+  });
   expect(status.providerHealth?.hybridai).toMatchObject({
     kind: 'remote',
     reachable: true,
@@ -651,6 +657,32 @@ test('getGatewayStatus includes Discord token status from runtime secrets', asyn
   });
 });
 
+test('getGatewayStatus reports missing HybridAI API keys separately from provider health', async () => {
+  const homeDir = makeTempHome();
+  process.env.HOME = homeDir;
+  delete process.env.HYBRIDAI_API_KEY;
+  process.chdir(homeDir);
+  vi.resetModules();
+  mockHealthProbes();
+
+  const { initDatabase } = await import('../src/memory/db.ts');
+  const { getGatewayStatus } = await import(
+    '../src/gateway/gateway-service.ts'
+  );
+
+  initDatabase({ quiet: true });
+  const status = await getGatewayStatus();
+
+  expect(status.hybridai).toEqual({
+    apiKeyConfigured: false,
+    apiKeySource: null,
+  });
+  expect(status.providerHealth?.hybridai).toMatchObject({
+    kind: 'remote',
+    reachable: false,
+  });
+});
+
 test('status command includes the current session agent', async () => {
   const homeDir = makeTempHome();
   process.env.HOME = homeDir;

From 5a2985d70e5b88a2bc7eb444792413d260091e81 Mon Sep 17 00:00:00 2001
From: Benedikt Koehler <benedikt.koehler@hybridai.one>
Date: Mon, 13 Apr 2026 17:15:47 +0200
Subject: [PATCH 7/8] chore: format email channel editor

---
 console/src/routes/channels.tsx | 27 +++++++++++----------------
 1 file changed, 11 insertions(+), 16 deletions(-)

diff --git a/console/src/routes/channels.tsx b/console/src/routes/channels.tsx
index d744299f..dfb8f2eb 100644
--- a/console/src/routes/channels.tsx
+++ b/console/src/routes/channels.tsx
@@ -1012,18 +1012,13 @@ function EmailChannelEditor(props: {
         // Save password as runtime secret before showing success
         if (cfg.password) {
           try {
-            await setRuntimeSecret(
-              props.token,
-              'EMAIL_PASSWORD',
-              cfg.password,
-            );
+            await setRuntimeSecret(props.token, 'EMAIL_PASSWORD', cfg.password);
             props.onSecretSaved();
           } catch (err) {
-            toast.error(
-              'Password could not be saved',
-              getErrorMessage(err),
+            toast.error('Password could not be saved', getErrorMessage(err));
+            toast.info(
+              'Email fields were populated, but password was not saved.',
             );
-            toast.info('Email fields were populated, but password was not saved.');
             return;
           }
         }
@@ -1068,13 +1063,13 @@ function EmailChannelEditor(props: {
         <div className="button-row">
           <button
             type="button"
-          className="ghost-button"
-          disabled={fetchingEmailConfig}
-          onClick={handleFetchEmailConfig}
-        >
-          {fetchingEmailConfig ? 'Fetching…' : 'Fetch HybridAI Agent Email'}
-        </button>
-      </div>
+            className="ghost-button"
+            disabled={fetchingEmailConfig}
+            onClick={handleFetchEmailConfig}
+          >
+            {fetchingEmailConfig ? 'Fetching…' : 'Fetch HybridAI Agent Email'}
+          </button>
+        </div>
       ) : null}
 
       <div className="field-grid">

From 5dc16436b297d127e28b3b944cf7af5f643fe414 Mon Sep 17 00:00:00 2001
From: Stephan Noller <stephan.noller@gmail.com>
Date: Mon, 13 Apr 2026 21:25:24 +0200
Subject: [PATCH 8/8] fix: use correct HybridAI mailbox credentials API

Switch from reading email_config off the handles list to the proper
two-step flow: GET /agent-handles/ to list handles, then
POST /agent-handles/<id>/mailbox/credentials to fetch the actual
email/password/imap/smtp configuration.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 console/src/routes/channels.tsx    |  94 ++++++++++-----------
 src/gateway/gateway-http-server.ts | 131 ++++++++++++++++++++++-------
 2 files changed, 147 insertions(+), 78 deletions(-)

diff --git a/console/src/routes/channels.tsx b/console/src/routes/channels.tsx
index dfb8f2eb..f49f1bc4 100644
--- a/console/src/routes/channels.tsx
+++ b/console/src/routes/channels.tsx
@@ -970,20 +970,19 @@ function EmailChannelEditor(props: {
     try {
       const result = (await fetchEmailConfig(props.token)) as {
         handles?: Array<{
+          id?: string;
           handle?: string;
-          label?: string;
           status?: string;
-          email_config?: {
-            address?: string;
-            imap_host?: string;
-            imap_port?: number;
-            imap_secure?: boolean;
-            smtp_host?: string;
-            smtp_port?: number;
-            smtp_secure?: boolean;
-            password?: string;
-          };
         }>;
+        credentials?: {
+          email?: string;
+          password?: string;
+          imap_host?: string;
+          imap_port?: number;
+          smtp_host?: string;
+          smtp_port?: number;
+        } | null;
+        handleId?: string;
       };
 
       const handles = result?.handles;
@@ -992,48 +991,49 @@ function EmailChannelEditor(props: {
         return;
       }
 
-      // Find first handle with email_config, or just show what we got
-      const withConfig = handles.find((h) => h.email_config);
-      if (withConfig?.email_config) {
-        const cfg = withConfig.email_config;
-        props.updateDraft((current) => ({
-          ...current,
-          email: {
-            ...current.email,
-            ...(cfg.address ? { address: cfg.address } : {}),
-            ...(cfg.imap_host ? { imapHost: cfg.imap_host } : {}),
-            ...(cfg.imap_port != null ? { imapPort: cfg.imap_port } : {}),
-            ...(cfg.imap_secure != null ? { imapSecure: cfg.imap_secure } : {}),
-            ...(cfg.smtp_host ? { smtpHost: cfg.smtp_host } : {}),
-            ...(cfg.smtp_port != null ? { smtpPort: cfg.smtp_port } : {}),
-            ...(cfg.smtp_secure != null ? { smtpSecure: cfg.smtp_secure } : {}),
-          },
-        }));
-        // Save password as runtime secret before showing success
-        if (cfg.password) {
-          try {
-            await setRuntimeSecret(props.token, 'EMAIL_PASSWORD', cfg.password);
-            props.onSecretSaved();
-          } catch (err) {
-            toast.error('Password could not be saved', getErrorMessage(err));
-            toast.info(
-              'Email fields were populated, but password was not saved.',
-            );
-            return;
-          }
-        }
-        toast.success(
-          `HybridAI agent email config loaded from handle "${withConfig.handle}".`,
-        );
-      } else {
-        // No email_config in handles — show available handles info
+      const creds = result?.credentials;
+      if (!creds) {
         const summary = handles
           .map((h) => `${h.handle} (${h.status})`)
           .join(', ');
         toast.info(
-          `HybridAI agent handles found: ${summary}. No agent email config attached.`,
+          `Handles found: ${summary}. Could not retrieve mailbox credentials.`,
         );
+        return;
       }
+
+      props.updateDraft((current) => ({
+        ...current,
+        email: {
+          ...current.email,
+          ...(creds.email ? { address: creds.email } : {}),
+          ...(creds.imap_host ? { imapHost: creds.imap_host } : {}),
+          ...(creds.imap_port != null ? { imapPort: creds.imap_port } : {}),
+          ...(creds.smtp_host ? { smtpHost: creds.smtp_host } : {}),
+          ...(creds.smtp_port != null ? { smtpPort: creds.smtp_port } : {}),
+        },
+      }));
+
+      // Save password as runtime secret before showing success
+      if (creds.password) {
+        try {
+          await setRuntimeSecret(
+            props.token,
+            'EMAIL_PASSWORD',
+            creds.password,
+          );
+          props.onSecretSaved();
+        } catch (err) {
+          toast.error('Password could not be saved', getErrorMessage(err));
+          toast.info(
+            'Email fields were populated, but password was not saved.',
+          );
+          return;
+        }
+      }
+
+      const label = result.handleId || 'HybridAI';
+      toast.success(`Email config loaded from ${label}.`);
     } catch (error) {
       toast.error('Failed to fetch email config', getErrorMessage(error));
     } finally {
diff --git a/src/gateway/gateway-http-server.ts b/src/gateway/gateway-http-server.ts
index 1754c35a..94bb7254 100644
--- a/src/gateway/gateway-http-server.ts
+++ b/src/gateway/gateway-http-server.ts
@@ -2501,6 +2501,48 @@ async function handleApiAdminConfig(
   sendJson(res, 200, saveGatewayAdminConfig(body.config as RuntimeConfig));
 }
 
+function extractUpstreamError(payload: unknown, status: number): string {
+  const record = payload as Record<string, unknown> | null;
+  const nested = record?.error;
+  return String(
+    (typeof record?.message === 'string' && record.message) ||
+      (typeof nested === 'string' && nested) ||
+      (nested &&
+        typeof nested === 'object' &&
+        typeof (nested as Record<string, unknown>).message === 'string' &&
+        (nested as Record<string, unknown>).message) ||
+      `HybridAI API returned HTTP ${status}`,
+  );
+}
+
+async function hybridAIFetch(
+  baseUrl: string,
+  apiKey: string,
+  path: string,
+  method: 'GET' | 'POST' = 'GET',
+): Promise<{ ok: boolean; status: number; payload: unknown }> {
+  const response = await fetch(`${baseUrl}${path}`, {
+    method,
+    headers: { Authorization: `Bearer ${apiKey}` },
+    signal: AbortSignal.timeout(10_000),
+  });
+
+  const contentType = response.headers.get('content-type') || '';
+  let payload: unknown;
+  if (contentType.includes('application/json')) {
+    payload = await response.json().catch(() => null);
+  } else {
+    const text = await response.text().catch(() => '');
+    try {
+      payload = JSON.parse(text);
+    } catch {
+      payload = text;
+    }
+  }
+
+  return { ok: response.ok, status: response.status, payload };
+}
+
 async function handleApiAdminEmailConfigFetch(
   res: ServerResponse,
 ): Promise<void> {
@@ -2520,12 +2562,14 @@ async function handleApiAdminEmailConfigFetch(
     '',
   );
 
-  let response: Response;
+  // Step 1: list agent handles
+  let handlesResult: { ok: boolean; status: number; payload: unknown };
   try {
-    response = await fetch(`${baseUrl}/api/v1/agent-handles/`, {
-      headers: { Authorization: `Bearer ${apiKey}` },
-      signal: AbortSignal.timeout(10_000),
-    });
+    handlesResult = await hybridAIFetch(
+      baseUrl,
+      apiKey,
+      '/api/v1/agent-handles/',
+    );
   } catch (error) {
     sendJson(res, 502, {
       error: `Could not reach HybridAI API: ${error instanceof Error ? error.message : String(error)}`,
@@ -2533,40 +2577,65 @@ async function handleApiAdminEmailConfigFetch(
     return;
   }
 
-  const contentType = response.headers.get('content-type') || '';
-  let payload: unknown;
-  if (contentType.includes('application/json')) {
-    payload = await response.json().catch(() => null);
-  } else {
-    const text = await response.text().catch(() => '');
-    try {
-      payload = JSON.parse(text);
-    } catch {
-      payload = text;
-    }
+  if (!handlesResult.ok) {
+    sendJson(res, 502, {
+      error: extractUpstreamError(handlesResult.payload, handlesResult.status),
+    });
+    return;
   }
 
-  if (!response.ok) {
-    const record = payload as Record<string, unknown> | null;
-    const nested = record?.error;
-    const msg =
-      (typeof record?.message === 'string' && record.message) ||
-      (typeof nested === 'string' && nested) ||
-      (nested &&
-        typeof nested === 'object' &&
-        typeof (nested as Record<string, unknown>).message === 'string' &&
-        (nested as Record<string, unknown>).message) ||
-      `HybridAI API returned HTTP ${response.status}`;
-    // Map all upstream errors to 502 so that 401/403 from HybridAI doesn't
-    // get mistaken for a gateway auth failure (which would clear WEB_API_TOKEN).
+  const handlesPayload = handlesResult.payload as {
+    handles?: Array<{ id?: string; handle?: string; status?: string }>;
+  };
+  const handles = Array.isArray(handlesPayload?.handles)
+    ? handlesPayload.handles
+    : [];
+
+  if (handles.length === 0) {
+    res.setHeader('Cache-Control', 'no-store');
+    sendJson(res, 200, { handles: [], credentials: null });
+    return;
+  }
+
+  // Step 2: fetch mailbox credentials for the first active handle
+  const activeHandle =
+    handles.find((h) => h.status === 'active') || handles[0];
+  const handleId = activeHandle.id || activeHandle.handle;
+
+  if (!handleId) {
+    res.setHeader('Cache-Control', 'no-store');
+    sendJson(res, 200, { handles, credentials: null });
+    return;
+  }
+
+  let credResult: { ok: boolean; status: number; payload: unknown };
+  try {
+    credResult = await hybridAIFetch(
+      baseUrl,
+      apiKey,
+      `/api/v1/agent-handles/${encodeURIComponent(handleId)}/mailbox/credentials`,
+      'POST',
+    );
+  } catch (error) {
+    sendJson(res, 502, {
+      error: `Could not fetch mailbox credentials: ${error instanceof Error ? error.message : String(error)}`,
+    });
+    return;
+  }
+
+  if (!credResult.ok) {
     sendJson(res, 502, {
-      error: String(msg),
+      error: extractUpstreamError(credResult.payload, credResult.status),
     });
     return;
   }
 
   res.setHeader('Cache-Control', 'no-store');
-  sendJson(res, 200, payload);
+  sendJson(res, 200, {
+    handles,
+    credentials: credResult.payload,
+    handleId,
+  });
 }
 
 async function handleApiAdminModels(