Fix: Handle libsodium decryption errors as poison messages

[baudbot-agent]

Problem

When broker messages are encrypted with old/wrong keys (e.g., after a broker deployment that changes encryption keys), libsodium's crypto_box_seal_open throws "incorrect key pair for the given ciphertext" before the bridge's if (!plaintext) check can catch it.

This error bypasses isPoisonMessageError() detection (which only matches "invalid broker envelope signature" and "failed to decrypt broker envelope"), causing poison messages to retry indefinitely and block the queue.

Root Cause

After the baudbot-services-beta broker deploy (commits 22e18bd, d36074b, 8df786c, 68b5f05), message Ev0AGW0HEKGB was stuck in the queue because it was encrypted with pre-deploy keys and couldn't be decrypted with post-deploy keys.

Solution

Wrap crypto_box_seal_open in a try-catch block to convert all libsodium decryption failures into the expected "failed to decrypt broker envelope" error format that poison message handling recognizes and auto-acks.

Changes

• broker-bridge.mjs: Added try-catch wrapper in decryptEnvelope() function
• broker-bridge.integration.test.mjs: Added test case that verifies messages encrypted with wrong keys are properly detected as poison messages and auto-acked

Testing

• All 13 broker-bridge integration tests pass ✅
• New test specifically validates the "incorrect key pair" scenario
• Verified fix resolves the stuck message Ev0AGW0HEKGB issue

Impact

• Future broker key rotations won't block the message queue
• Messages encrypted with outdated keys will be auto-acked instead of retrying forever
• No breaking changes to existing functionality

[greptile-apps]

Greptile Summary

Fixes poison message handling for libsodium decryption errors by wrapping crypto_box_seal_open in a try-catch block that converts low-level crypto exceptions into the expected "failed to decrypt broker envelope" error format.

• Prevents message queue blocking when broker encryption keys change (e.g., after deployments)
• Ensures messages encrypted with outdated keys are auto-acked instead of retrying indefinitely
• Adds comprehensive test coverage for the "incorrect key pair" scenario
• All 13 broker-bridge integration tests pass

Confidence Score: 5/5

• Safe to merge - targeted bug fix with comprehensive test coverage
• The fix is minimal, well-scoped, and directly addresses a production issue where messages encrypted with old keys blocked the queue. The try-catch wrapper is the correct approach to handle libsodium exceptions, and the new test thoroughly validates the fix.
• No files require special attention

Important Files Changed

Filename	Overview
slack-bridge/broker-bridge.mjs	Wraps crypto_box_seal_open in try-catch to convert libsodium decryption errors into poison message format
test/broker-bridge.integration.test.mjs	Adds test case verifying wrong key decryption failures are properly detected as poison messages and auto-acked

_{Last reviewed commit: 8909995}