@xuda.io/ai_module 1.1.5612 → 1.1.5614

package/index.mjs

@@ -4266,14 +4266,17 @@ export const create_conversation = async function (req, job_id, headers) {
           // write conversation to host after thumbnail update
           // get sender conversation
 
-          const conversation_doc = await db_module.get_app_couch_doc_native(account_profile_info.app_id, conversation_doc._id);
+          // Re-fetch the freshest copy of the conversation doc after process_conversation
+          // had a chance to write thumbnail / title updates. Renamed (was `conversation_doc`)
+          // to avoid TDZ shadowing the outer-scope `conversation_doc` we read for the lookup id.
+          const fresh_conversation_doc = await db_module.get_app_couch_doc_native(account_profile_info.app_id, conversation_doc._id);
 
           const recipient_account_profile_info = await get_active_account_profile_info(recipient_uid);
-          let recipient_conversation_doc = await db_module.get_app_couch_doc_native(recipient_account_profile_info.app_id, conversation_doc._id);
-          recipient_conversation_doc.title = conversation_doc.title;
+          let recipient_conversation_doc = await db_module.get_app_couch_doc_native(recipient_account_profile_info.app_id, fresh_conversation_doc._id);
+          recipient_conversation_doc.title = fresh_conversation_doc.title;
 
-          recipient_conversation_doc.thumbnail_request_ts = conversation_doc.thumbnail_request_ts;
-          recipient_conversation_doc.chat_image = conversation_doc.chat_image;
+          recipient_conversation_doc.thumbnail_request_ts = fresh_conversation_doc.thumbnail_request_ts;
+          recipient_conversation_doc.chat_image = fresh_conversation_doc.chat_image;
           recipient_conversation_doc.direction = 'in';
           await db_module.save_app_couch_doc_native(recipient_account_profile_info.app_id, recipient_conversation_doc);
 
@@ -5927,13 +5930,7 @@ Return a concise answer. Include only non-sensitive findings and mention when th
 
       await fs.promises.mkdir(dump_dir, { recursive: true });
       const sitemap_xml = await fetch_text(`${website_base}/sitemap.xml`, 8000);
-      const priority_urls = [
-        `${website_base}/`,
-        `${website_base}/about`,
-        `${website_base}/legal/privacy-policy`,
-        `${website_base}/legal/terms`,
-        `${website_base}/contact`,
-      ];
+      const priority_urls = [`${website_base}/`, `${website_base}/about`, `${website_base}/legal/privacy-policy`, `${website_base}/legal/terms`, `${website_base}/contact`];
       const sitemap_urls = [...sitemap_xml.matchAll(/<loc>([\s\S]*?)<\/loc>/gi)]
         .map((match) => decode_html(match[1]).trim())
         .filter((url) => {
@@ -6029,10 +6026,7 @@ Return a concise answer. Include only non-sensitive findings and mention when th
           };
 
           try {
-            const data = await Promise.race([
-              run_lookup(),
-              new Promise((_, reject) => setTimeout(() => reject(new Error('xuda.ai website lookup timed out')), 20000)),
-            ]);
+            const data = await Promise.race([run_lookup(), new Promise((_, reject) => setTimeout(() => reject(new Error('xuda.ai website lookup timed out')), 20000))]);
             return JSON.stringify(data, null, 2);
           } catch (err) {
             return `xuda.ai website lookup failed: ${err.message || String(err)}`;
@@ -8197,6 +8191,14 @@ export const get_profile_picture = async function (uid, account_type = 'business
   const uniqueId = Date.now() + '_' + Math.random().toString(36).substring(7);
   const tempOutputPath = path.join(tempDir, `output_${uniqueId}.png`);
 
+  // Normalize: visitor accounts created through the chat widget can arrive with
+  // account_type missing, null, or some other value. Treat anything that isn't
+  // explicitly 'business' as 'personal' so the chat flow doesn't crash before
+  // ever reaching the agent reply.
+  if (account_type !== 'personal' && account_type !== 'business') {
+    account_type = 'personal';
+  }
+
   const { email, create_avatar } = metadata;
 
   let prompt,
@@ -9176,6 +9178,78 @@ export const is_spam_email = async function (uid, email, subject, account_profil
   } catch (error) {}
 };
 
+// AI screening for a marketplace publish. Receives plain-JSON context from
+// marketplace_module (zod schemas cannot cross the broker, so the prompt +
+// structured schema must live here). Returns a structured verdict across the
+// approval rule dimensions. The caller (marketplace_approval_review) merges
+// this with deterministic account-standing checks and decides the final stat.
+export const marketplace_review_item = async function (req) {
+  const { uid, item_type, item = {}, account_context = {}, account_name = '', model = _conf.default_ai_model, account_profile_info } = req || {};
+
+  const check_schema = z.object({
+    flag: z.boolean().describe('true if this concern is present'),
+    severity: z.enum(['none', 'low', 'medium', 'high']).describe('how serious the concern is'),
+    note: z.string().describe('one short sentence of evidence; empty string if no concern'),
+  });
+
+  const response_format = z.object({
+    decision: z.enum(['approve', 'reject', 'manual_review']).describe('approve = safe to publish; reject = clear violation; manual_review = uncertain, needs a human'),
+    confidence: z.number().min(0).max(100).describe('confidence in the decision, 0-100'),
+    checks: z.object({
+      ai_bot_activity: check_schema.describe('automated/bot publishing: high velocity, near-duplicate items, low-effort generated bulk'),
+      commercial_undisclosed: check_schema.describe('undisclosed commercial intent: external paid links, lead-gen, off-platform payment, advertising inconsistent with declared price/category'),
+      harmful_code: check_schema.describe('destructive ops, data exfiltration, crypto-miners, obfuscation, malicious network calls in the submitted code'),
+      suspicious_activity: check_schema.describe('mismatched metadata, hidden payloads, evasion patterns'),
+      malformed_account_name: check_schema.describe('gibberish, homoglyphs, embedded URLs, or impersonation in the account name'),
+      spam_low_quality: check_schema.describe('spam, filler, or low-quality content with no real utility'),
+      impersonation_trademark: check_schema.describe('impersonates a brand/person or abuses a trademark'),
+      prohibited_content: check_schema.describe('adult, illegal, hateful, or otherwise disallowed content'),
+      plagiarism_duplicate: check_schema.describe('appears copied from or duplicates an existing item'),
+      secrets_pii_leak: check_schema.describe('hardcoded API keys, tokens, credentials, or exposed PII in the code'),
+    }),
+    reasons: z.array(z.string()).describe('short user-facing lines explaining the decision (empty if approved cleanly)'),
+  });
+
+  const prompt = `You are the xuda marketplace moderation reviewer. Decide whether the following ${item_type} should be published to the public marketplace.
+
+Account name: ${account_name}
+Account context (signals): ${JSON.stringify(account_context)}
+
+Item:
+- name: ${item.name || ''}
+- description: ${item.description || ''}
+- category: ${item.category || ''}
+- tags: ${JSON.stringify(item.tags || [])}
+- price: ${item.price ?? 0}
+- code/content summary: ${item.code_summary || '(none provided)'}
+
+Evaluate every check honestly. Set decision to:
+- "approve" when no medium/high concerns and the item is genuine and useful.
+- "reject" when there is a clear high-severity violation (harmful code, leaked secrets, prohibited content, obvious impersonation/spam, or clear bot abuse).
+- "manual_review" when concerns are present but ambiguous, or you are not confident.
+Keep "reasons" concise, factual, and user-facing (no internal jargon).`;
+
+  const ret = await submit_chat_gpt_prompt({
+    uid,
+    prompt,
+    model,
+    response_format,
+    metadata: { func: 'marketplace_review_item', item_type },
+    account_profile_info,
+  });
+
+  if (ret.code < 0) {
+    return { code: ret.code, data: ret.data };
+  }
+
+  try {
+    const verdict = JSON.parse(ret.data);
+    return { code: 1, data: { ...verdict, model } };
+  } catch (err) {
+    return { code: -1, data: `marketplace_review_item parse error: ${err.message}` };
+  }
+};
+
 export const is_business_contact = async function (uid, email, name, subject, body, account_profile_info) {
   let prompt = `detect if the email "${email}", subject "${subject}", name "${name}", or body "${body}" is business  or personal. Return true if it is a business , false otherwise.
   
@@ -14254,7 +14328,7 @@ export const get_widget_embed_snippet = async function (req, job_id, headers) {
 };
 
 const _widget_signup_core = async function (req, job_id, headers, opts) {
-  const { profile_id, email, name, widget_origin, google_sub, signup_method } = req;
+  const { profile_id, email, name, widget_origin, google_sub, signup_method, visitor_lang } = req;
   const [owner_uid_part, pid_part] = String(profile_id || '').split('.');
   if (!owner_uid_part || !pid_part) return { code: -404, data: 'invalid_profile' };
 
@@ -14266,19 +14340,19 @@ const _widget_signup_core = async function (req, job_id, headers, opts) {
   if (ap_doc.widget_enabled === false) return { code: -404, data: 'widget_disabled' };
 
   const visitor_uid = await _widget_find_or_create_visitor(email, name, google_sub);
-  return await _widget_signup_finalize(visitor_uid, email, name, widget_origin, signup_method, account_profile_info, canonical_owner_uid, canonical_profile_id, ap_doc, job_id, headers);
+  return await _widget_signup_finalize(visitor_uid, email, name, widget_origin, signup_method, account_profile_info, canonical_owner_uid, canonical_profile_id, ap_doc, job_id, headers, visitor_lang);
 };
 
 export const widget_signup = async function (req, job_id, headers) {
   try {
-    let { profile_id, email, name, widget_origin } = req;
+    let { profile_id, email, name, widget_origin, visitor_lang } = req;
     if (typeof email !== 'string' || typeof name !== 'string') return { code: -1, data: 'invalid_input' };
     email = email.toLowerCase().trim();
     name = name.trim();
     if (!email || !name) return { code: -1, data: 'invalid_input' };
     if (!WIDGET_EMAIL_RE.test(email)) return { code: -1, data: 'invalid_email' };
 
-    return await _widget_signup_core({ profile_id, email, name, widget_origin, signup_method: 'email' }, job_id, headers);
+    return await _widget_signup_core({ profile_id, email, name, widget_origin, visitor_lang, signup_method: 'email' }, job_id, headers);
   } catch (err) {
     return { code: -1, data: err.message || String(err) };
   }
@@ -14286,7 +14360,7 @@ export const widget_signup = async function (req, job_id, headers) {
 
 export const widget_signup_google = async function (req, job_id, headers) {
   try {
-    const { profile_id, id_token, widget_origin } = req;
+    const { profile_id, id_token, widget_origin, visitor_lang } = req;
     if (!id_token || typeof id_token !== 'string') return { code: -1, data: 'missing_id_token' };
 
     let payload;
@@ -14302,13 +14376,13 @@ export const widget_signup_google = async function (req, job_id, headers) {
     const name = String(payload.name || payload.email?.split('@')[0] || 'Friend').trim();
     if (!email) return { code: -1, data: 'no_email_in_token' };
 
-    return await _widget_signup_core({ profile_id, email, name, widget_origin, google_sub: payload.sub, signup_method: 'google' }, job_id, headers);
+    return await _widget_signup_core({ profile_id, email, name, widget_origin, visitor_lang, google_sub: payload.sub, signup_method: 'google' }, job_id, headers);
   } catch (err) {
     return { code: -1, data: err.message || String(err) };
   }
 };
 
-const _widget_signup_finalize = async function (visitor_uid, email, name, widget_origin, signup_method, account_profile_info, canonical_owner_uid, canonical_profile_id, ap_doc, job_id, headers) {
+const _widget_signup_finalize = async function (visitor_uid, email, name, widget_origin, signup_method, account_profile_info, canonical_owner_uid, canonical_profile_id, ap_doc, job_id, headers, visitor_lang) {
   try {
     let team_req_doc = await _widget_find_existing_team_req(visitor_uid, canonical_profile_id);
     let assigned_uid;
@@ -14372,12 +14446,20 @@ const _widget_signup_finalize = async function (visitor_uid, email, name, widget
 
     const widget_token = `wds_${crypto.randomUUID().replace(/-/g, '')}`;
     const now = Date.now();
+    // Normalize visitor_lang to a short tag (e.g. "ja-JP" → "ja"). The
+    // auto-reply agent reads this from the session to respond in the
+    // visitor's language. Empty / missing → English fallback at reply time.
+    const visitor_lang_base = String(visitor_lang || '')
+      .toLowerCase()
+      .split('-')[0]
+      .slice(0, 8);
     const session_doc = {
       _id: widget_token,
       docType: 'widget_session',
       stat: 2,
       state,
       visitor_uid,
+      visitor_lang: visitor_lang_base || '',
       team_req_id: team_req_doc._id,
       assigned_uid,
       owner_uid: canonical_owner_uid,
@@ -14396,6 +14478,12 @@ const _widget_signup_finalize = async function (visitor_uid, email, name, widget
     const assigned_avatar = assigned_info_ret?.data?.profile_picture || assigned_info_ret?.data?.profile_avatar || '';
     const greeting = ap_doc?.widget_config?.greeting || WIDGET_DEFAULT_GREETING;
 
+    // Surface the visitor's first name so the chat widget can personalize the
+    // greeting on the page ("Hi {visitor_first_name}, I'm Valentina..."). The
+    // widget reads this from the persisted session and replaces the
+    // {visitor_name} placeholder client-side.
+    const visitor_first_name = _widget_split_name(name).first_name || '';
+
     return {
       code: 1,
       data: {
@@ -14405,6 +14493,7 @@ const _widget_signup_finalize = async function (visitor_uid, email, name, widget
         assigned_avatar,
         greeting,
         conversation_id,
+        visitor_first_name,
         signup_method: signup_method || 'email',
         account_active: signup_method === 'google',
         signin_url: signup_method === 'google' ? `https://${_conf.domain || 'xuda.ai'}/dashboard/login` : undefined,

package/index_ms.mjs

@@ -260,3 +260,7 @@ export const widget_send_message = async function (...args) {
 export const widget_get_messages = async function (...args) {
   return await broker.send_to_queue("widget_get_messages", ...args);
 };
+
+export const marketplace_review_item = async function (...args) {
+  return await broker.send_to_queue("marketplace_review_item", ...args);
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xuda.io/ai_module",
-  "version": "1.1.5612",
+  "version": "1.1.5614",
   "description": "Xuda AI Module",
   "main": "index.mjs",
   "type": "module",