Review — #1753 fix(email): one ungranted mailbox no longer aborts the whole multi-mailbox scan

Summary

Solid, well-scoped resilience fix: a per-provider try/except ConnectorsError around each backend's triage/pre-scan call lets a granted mailbox keep returning results when a sibling mailbox's grant is revoked, with the failure recorded in a new mailbox_errors list instead of propagating out of the loop. The change is correct, additive (no caller of the old return shape breaks since mailbox_errors only appears when non-empty), and matches GAIA's "fail loudly" rule — the error is surfaced cleanly rather than swallowed, and non-ConnectorsError exceptions still propagate. The single most important thing to know: this is a draft PR and the new test couldn't be executed in my environment (no pytest), so the green-test claim rests on your local 390 passed run — worth a maintainer re-run before un-drafting.

The design decision to keep the available set connection-derived (grant enforcement deferred to the token layer) is the right call and is now well-documented in both config.py docstrings and the closing of #1707's open question.

Issues

🟢 Minor — format_connector_error(exc) is computed twice per error (agent.py:534-542, again at agent.py:658-666)

Both the mailbox_errors entry and the logger.warning call format the same exception independently. Compute once:

except ConnectorsError as exc:
    msg = format_connector_error(exc)
    mailbox_errors.append({"mailbox": provider, "error": msg})
    logger.warning("email triage: skipping %s mailbox — %s", provider, msg)
    continue

Same pattern applies to the _pre_scan_all_backends block. Trivial, non-blocking.

🟢 Minor — local import is inconsistent with the module's own convention (agent.py:507, agent.py:632)

format_connector_error is imported locally inside each method, but the module already imports from gaia.connectors.errors import ConnectorsError at top level (agent.py:68), so the connectors import chain is already loaded at module-import time — the local import buys nothing here. (This differs from config.py, where local backend imports are deliberate to keep config import-time free of the connectors chain — that rationale doesn't apply to agent.py.) Promoting it to a top-level import would be more consistent, but it's harmless as-is.

🟢 Minor (note, not a change request) — mailbox_errors has no dedicated consumer

Nothing reads result["mailbox_errors"] other than the tests; it reaches the user only because the agent loop/LLM sees it in the tool's JSON envelope. That's a legitimate surfacing path for an agent tool, so no action needed — just flagging that there's no guarantee the model verbalizes a skipped mailbox to the user. If you want a hard guarantee, a follow-up could render it in the console/UI envelope. Out of scope for this PR.

Strengths

• Catches the base ConnectorsError, not just AuthRequiredError — correctly resilient to the broader connector-layer failure family for one mailbox while still recording (never swallowing) the error. The continue keeps per-mailbox counters (scanned, merged) untouched, so the budget guard stays correct.
• Genuinely good test coverage: the suite asserts the granted mailbox's results survive, the ungranted provider lands in mailbox_errors with an actionable message, the available set stays connection-derived, the all-granted path is unaffected (regression guard), and the calendar single-backend path returns a clean envelope via the existing per-tool catch. The TDD ordering (failing tests first in f813d592, fix in c50f819c) is clean.
• Honest scoping: the Google-centric error wording for a Microsoft gap is correctly identified as a pre-existing connectors-layer defect (bug(connectors): email agent AGENT_NOT_GRANTED message hardcodes Google, misleads on Outlook/Microsoft grant gaps #1751) and left out of scope rather than patched in the agent — keeps the agent grant-unaware as intended.

Verdict

Approve with suggestions. No blocking issues — the two 🟢 nits (duplicate formatting call, local-vs-top-level import) are optional polish. Recommend a maintainer re-runs pytest tests/unit/agents/email/ before this leaves draft, since the test pass is self-reported and I couldn't execute it here.

Thanks for the review. Addressed both 🟢 nits in c27e055:

• Hoisted format_connector_error to a top-level import in agent.py — the connectors import chain is already loaded via the top-level ConnectorsError import (agent.py:68), so the local imports bought nothing.
• Compute format_connector_error(exc) once per except block (into msg), reused for both the mailbox_errors entry and the logger.warning — in both _triage_all_backends and _pre_scan_all_backends.

The "mailbox_errors has no dedicated consumer" note and the Google-centric wording for a Microsoft gap (tracked in #1751) are intentionally left out of scope here. Full email unit suite still green (390 passed).

Review: fix(email) — one ungranted mailbox no longer aborts the whole scan (#1739)

Summary

Solid, well-scoped fix that does exactly what it says: a single revoked-grant mailbox no longer takes down the whole multi-mailbox triage/pre-scan. The change wraps each backend call in a typed except ConnectorsError, records a per-provider notice in mailbox_errors, and continues — so the granted mailbox still returns results. It reuses the established format_connector_error(exc) convention already used across calendar_tools.py/delete_tools.py, keeps the agent grant-unaware (the documented #1707 decision), and lets non-ConnectorsError exceptions propagate so genuine bugs still fail loudly. The single most important thing to know: the new mailbox_errors field is produced but not yet consumed anywhere in code — it rides in the tool-result JSON for the LLM to surface, so make sure the agent actually tells the user a mailbox was skipped.

Issues

🟢 mailbox_errors has no in-code consumer; surfacing relies entirely on the LLM (agent.py:560, agent.py:698)
The field is returned in the tool envelope but nothing in the agent or prompt explicitly guides surfacing it. In practice the LLM sees the JSON and can mention it, which is the normal tool-result pattern — but a quiet model could drop it and the user would silently get partial results. Worth confirming the email agent's system prompt nudges it to report skipped mailboxes, or adding a one-line note to do so. Not blocking.

🟢 All-mailboxes-ungranted returns ok: True with empty results (agent.py:559, agent.py:681)
When every backend errors, the scan returns success with an empty result set plus a populated mailbox_errors. It's not a silent fallback (the errors are present), but "total failure → ok:True, zero emails" leans on the same LLM-surfacing path as above to avoid reading as "your inbox is empty." Consider whether a wholly-failed scan should be distinguishable. Discussion, not a required change.

Strengths

• Pattern reuse over reinvention — except ConnectorsError: format_connector_error(exc) mirrors the existing per-tool handlers in calendar_tools.py:843, so the fix reads as idiomatic to the module rather than bolted on.
• Tight exception scope — catching ConnectorsError (parent of AuthRequiredError) while letting everything else propagate respects the repo's fail-loudly rule; a real bug in triage_inbox_impl still surfaces.
• Genuinely strong test coverage — test_grant_revoked_clean_error.py is TDD-shaped (the failing-against-main intent is documented), covers both triage and pre-scan loops, the connection-derived available-set invariant, the all-granted regression guard, and the calendar single-backend path. Hermetic fakes, no live connectors.
• Honest scope discipline — the Google-centric error wording for a Microsoft gap is acknowledged and deferred to bug(connectors): email agent AGENT_NOT_GRANTED message hardcodes Google, misleads on Outlook/Microsoft grant gaps #1751 rather than patched ad hoc here, keeping the agent grant-unaware as designed.

Verdict

Approve. No blocking issues. The two 🟢 points are about how clearly the skipped-mailbox notice reaches the end user — worth a glance at the system prompt, but not a merge blocker. (Note: I could not run the test suite in this sandbox — pytest isn't installed here — but the file is well-formed and the PR reports 390 passing; the maintainer has already approved.)

Thanks — both 🟢 points addressed/considered:

• All-mailboxes-ungranted → ok:True empty results (point 2): fixed in 557e843. When every connected mailbox errors, _triage_all_backends / _pre_scan_all_backends now raise a ConnectorsError summarizing each mailbox failure, so the tool envelope is ok:False (fail-loudly) instead of reading as "empty inbox". Partial failure (≥1 mailbox succeeds) still returns results + mailbox_errors. Added all-ungranted tests for both scan loops. Full email suite: 392 passed.
• Surfacing partial skips via the prompt (point 1): intentionally not bundled here — the system prompt is an LLM-affecting surface that needs an email eval run to change responsibly, so I've kept this PR to the deterministic scan-resilience change. With the fix above, the total-failure case is now loud regardless of the model; the residual (one mailbox skipped, quiet model) rides the standard tool-result path and is a reasonable prompt follow-up.