fix(agent-jobs): recover failed claim decryption

packages/backend/convex/agentJobsNode.ts

@@ -58,6 +58,24 @@ export const claimNextForWorker = action({
     if (!claimed) return null;
     if (!claimed.spoon || !claimed.aiProviderProfile) return null;
     const profile = claimed.aiProviderProfile;
+    let profileSecret: string | undefined;
+    let secrets: { name: string; value: string }[];
+    try {
+      profileSecret = profile.encryptedSecret
+        ? decryptSecret(profile.encryptedSecret)
+        : undefined;
+      secrets = claimed.secrets.map((secret: Doc<'spoonSecrets'>) => ({
+        name: secret.name,
+        value: decryptSecret(secret.encryptedValue),
+      }));
+    } catch {
+      await ctx.runMutation(internal.agentJobs.failClaimInternal, {
+        jobId: claimed.job._id,
+        workerId: args.workerId,
+        reason: 'Stored AI credentials or Spoon secrets could not be decrypted.',
+      });
+      return null;
+    }
     return {
       job: claimed.job,
       spoon: claimed.spoon,
@@ -70,9 +88,7 @@ export const claimNextForWorker = action({
         name: profile.name,
         provider: profile.provider,
         authType: profile.authType,
-        secret: profile.encryptedSecret
-          ? decryptSecret(profile.encryptedSecret)
-          : undefined,
+        secret: profileSecret,
         baseUrl: profile.baseUrl,
         model: profile.defaultModel,
         reasoningEffort: profile.reasoningEffort,
@@ -84,10 +100,7 @@ export const claimNextForWorker = action({
           claimed.spoon.githubInstallationId ??
           process.env.GITHUB_APP_INSTALLATION_ID,
       },
-      secrets: claimed.secrets.map((secret: Doc<'spoonSecrets'>) => ({
-        name: secret.name,
-        value: decryptSecret(secret.encryptedValue),
-      })),
+      secrets,
     };
   },
 });