@xuda.io/ai_module 1.1.5615 → 1.1.5617

package/index.mjs

@@ -170,10 +170,14 @@ const get_openai_codex_usage_model = function (codex_model, requested_codex_mode
   return _conf.ai_models?.openai_codex_model ? 'openai_codex_model' : codex_model || _conf.openai_codex_command || 'openai_codex_cli';
 };
 
-const get_openai_codex_exec_args = function (codex_model) {
+const get_openai_codex_exec_args = function (codex_model, opts = {}) {
   const args = ['exec', '--json'];
-  const bypass_approvals_and_sandbox = typeof _conf.openai_codex_bypass_approvals_and_sandbox === 'undefined' ? true : _conf.openai_codex_bypass_approvals_and_sandbox;
-  const sandbox = _conf.openai_codex_sandbox;
+  // A per-call sandbox (e.g. the AI site generator passes 'workspace-write')
+  // forces a confined run regardless of the global bypass default, so untrusted
+  // end-user prompts can't run Codex with full host access. The studio/vibe flow
+  // passes nothing and keeps the global setting.
+  const sandbox = opts.sandbox || _conf.openai_codex_sandbox;
+  const bypass_approvals_and_sandbox = opts.sandbox ? false : typeof _conf.openai_codex_bypass_approvals_and_sandbox === 'undefined' ? true : _conf.openai_codex_bypass_approvals_and_sandbox;
 
   if (codex_model) {
     args.push('--model', codex_model);
@@ -182,7 +186,10 @@ const get_openai_codex_exec_args = function (codex_model) {
   if (bypass_approvals_and_sandbox) {
     args.push('--dangerously-bypass-approvals-and-sandbox');
   } else if (sandbox) {
-    args.push('--sandbox', sandbox);
+    // --skip-git-repo-check: draft folders aren't git repos; without it codex
+    // refuses to run sandboxed ("not inside a trusted directory"). The bypass
+    // path skipped this implicitly.
+    args.push('--sandbox', sandbox, '--skip-git-repo-check');
   }
 
   return args;
@@ -228,6 +235,7 @@ const drive_ms = await import(`${module_path}/drive_module/index_ms.mjs`);
 const jobs_ms = await import(`${module_path}/jobs_module/index_ms.mjs`);
 const team_ms = await import(`${module_path}/team_module/index_ms.mjs`);
 const email_ms = await import(`${module_path}/email_module/index_ms.mjs`);
+const api_ms = await import(`${module_path}/api_module/index_ms.mjs`);
 
 const ws_dashboard_msa = await import(`${module_path}/ws_dashboard_module/index_msa.mjs`);
 const account_msa = await import(`${module_path}/account_module/index_msa.mjs`);
@@ -240,6 +248,25 @@ const report_ai_status = function (model, err) {
   if (err) console.error(err);
 };
 
+// Full Stack VPS AI instructions. Read ONCE from disk on the first AI call that
+// uses a full_stack_vps tool, then cached in memory for the life of the process.
+// Prepended to the agent instructions so the model knows how to drive the box's
+// exposed ecosystem + custom API methods. Edit the .md + restart `ai` to refresh.
+let _full_stack_vps_instructions = null;
+const get_full_stack_vps_instructions = function () {
+  if (_full_stack_vps_instructions == null) {
+    try {
+      const _dir = path.dirname(new URL(import.meta.url).pathname);
+      _full_stack_vps_instructions = fs.readFileSync(path.join(_dir, 'full_stack_vps_api_instructions.md'), 'utf8');
+      console.log('[ai] loaded full_stack_vps_api_instructions.md (cached in memory)');
+    } catch (e) {
+      _full_stack_vps_instructions = '';
+      console.warn('[ai] full_stack_vps_api_instructions.md not found:', e.message);
+    }
+  }
+  return _full_stack_vps_instructions;
+};
+
 let client;
 try {
   client = new OpenAI({
@@ -1251,6 +1278,17 @@ export const execute_codex_request = async function (req_or_ip, prompt_arg, atta
   try {
     const is_req_call = req_or_ip && typeof req_or_ip === 'object' && !Array.isArray(req_or_ip);
     const ip = is_req_call ? req_or_ip.ip : req_or_ip;
+    // Plan A: when local_cwd is set, codex runs ON the local filesystem (the
+    // site's source dir on the pinned studio drive) instead of SSHing to a VPS.
+    const local_cwd = is_req_call ? req_or_ip.local_cwd : undefined;
+    // Optional per-call hardening (used by the AI site generator for untrusted
+    // prompts): a confined sandbox + a hard wall-clock timeout on the codex run.
+    const sandbox = is_req_call ? req_or_ip.sandbox : undefined;
+    const codex_timeout = is_req_call ? req_or_ip.codex_timeout : undefined;
+    // Optional: a scoped MCP server exposed to codex (the in-app vibe's Xuda
+    // platform actions). { url, bearer_env_var, bearer_value } — the bearer is
+    // injected via env (below), so the scoped key never lands on the argv.
+    const agent_mcp = is_req_call ? req_or_ip.agent_mcp : undefined;
     const prompt = is_req_call ? req_or_ip.prompt : prompt_arg;
     let attachments = is_req_call ? req_or_ip.attachments || [] : attachments_arg;
     const uid = is_req_call ? req_or_ip.uid : undefined;
@@ -1314,7 +1352,7 @@ export const execute_codex_request = async function (req_or_ip, prompt_arg, atta
       }
     };
 
-    if (!is_valid_codex_remote_host(ip)) {
+    if (!local_cwd && !is_valid_codex_remote_host(ip)) {
       return { code: -1, data: 'invalid remote ip' };
     }
 
@@ -1423,7 +1461,17 @@ export const execute_codex_request = async function (req_or_ip, prompt_arg, atta
     emitToDashboard('stream_start');
     emitToDashboard('stream_phase', 'Starting Codex request');
 
-    let codex_prompt = `You are OpenAI Codex running on the local Xuda server.
+    let codex_prompt = local_cwd
+      ? `You are OpenAI Codex editing a static website on the local Xuda server.
+
+The site's source files are in your current working directory: ${local_cwd}
+Edit them directly with your normal file tools (read, search, apply patches) — everything is local; do NOT use SSH or scp. Keep changes scoped to the user's request and preserve the rest of the site.
+
+This is the editable source, not the live site. Do NOT deploy or publish anything — the user publishes separately by clicking Publish. When you finish, briefly summarize what you changed.
+
+User request:
+${prompt}`
+      : `You are OpenAI Codex running on the local Xuda server.
 
 The target remote machine is ${get_codex_remote_host(ip)}.
 Execute shell commands on the remote machine through SSH, for example:
@@ -1444,7 +1492,13 @@ ${prompt}`;
     }
 
     const openai_codex_command = get_openai_codex_cli_command();
-    const codex_args = get_openai_codex_exec_args(codex_model);
+    let codex_args = get_openai_codex_exec_args(codex_model, { sandbox });
+    if (agent_mcp && agent_mcp.url) {
+      // Register the Xuda MCP server for this run. Global `-c` overrides must
+      // precede the `exec` subcommand (args[0]), so prepend them. The bearer
+      // travels by env var name (resolved from the run env below), not value.
+      codex_args = ['-c', `mcp_servers.xuda.url="${agent_mcp.url}"`, '-c', `mcp_servers.xuda.bearer_token_env_var="${agent_mcp.bearer_env_var || 'XUDA_AGENT_KEY'}"`, ...codex_args];
+    }
     for (const image_path of image_paths) {
       codex_args.push('--image', image_path);
     }
@@ -1454,7 +1508,10 @@ ${prompt}`;
       env: {
         ...process.env,
         OPENAI_API_KEY: _conf.OPENAI_API_KEY,
+        ...(agent_mcp && agent_mcp.bearer_value ? { [agent_mcp.bearer_env_var || 'XUDA_AGENT_KEY']: agent_mcp.bearer_value } : {}),
       },
+      ...(local_cwd ? { cwd: local_cwd } : {}),
+      ...(codex_timeout ? { timeout: codex_timeout, killSignal: 'SIGKILL' } : {}),
       onStdout: create_codex_jsonl_stream_parser(handleCodexEvent),
     });
     const events = parse_codex_jsonl(ret.stdout);
@@ -1474,7 +1531,7 @@ ${prompt}`;
         {
           conversation_id,
           job_id,
-          remote_host: get_codex_remote_host(ip),
+          remote_host: local_cwd ? null : get_codex_remote_host(ip),
           exit_code: ret.exit_code,
           attachments_count: attachments.length,
         },
@@ -1491,7 +1548,7 @@ ${prompt}`;
         code: -3,
         data: {
           provider: 'openai_codex_cli',
-          remote_host: get_codex_remote_host(ip),
+          remote_host: local_cwd ? null : get_codex_remote_host(ip),
           command: `${openai_codex_command} ${codex_args.filter((arg) => arg !== '-').join(' ')}`,
           exit_code: ret.exit_code,
           stdout: ret.stdout,
@@ -1509,7 +1566,7 @@ ${prompt}`;
       code: 0,
       data: {
         provider: 'openai_codex_cli',
-        remote_host: get_codex_remote_host(ip),
+        remote_host: local_cwd ? null : get_codex_remote_host(ip),
         command: `${openai_codex_command} ${codex_args.filter((arg) => arg !== '-').join(' ')}`,
         stdout: ret.stdout,
         stderr: ret.stderr,
@@ -1527,6 +1584,132 @@ ${prompt}`;
   }
 };
 
+// ─────────────────────────────────────────────────────────────────────────
+// generate_site_draft — create (or refine) a static site FROM SCRATCH with AI
+// into a draft folder on the studio fs, BEFORE any app/deploy exists. Reuses
+// the vibe engine (execute_codex_request with local_cwd) and returns a
+// /studio-drive preview URL, so the create wizard can show the result before
+// the user commits. create_static_website then adopts `draft_folder` as the
+// new app's source. Runs as a job (Codex takes ~30s–2min).
+// req: { uid, prompt, draft_folder? }
+// ─────────────────────────────────────────────────────────────────────────
+// Per-account abuse guard for the AI site generator: a best-effort hourly rate
+// limit + a concurrency cap, backed by memcached (get/set isn't atomic, so this
+// bounds bulk abuse rather than being a hard gate). Each generate is a real Codex
+// run, so this caps OpenAI cost and protects the shared host from spawn floods.
+const SW_GEN_RATE_PER_HOUR = _conf.sw_gen_rate_per_hour || 20;
+const SW_GEN_MAX_CONCURRENT = _conf.sw_gen_max_concurrent || 2;
+const _sw_gen_acquire = async (uid) => {
+  const now = Date.now();
+  const rl_key = `sw_gen_rl_${uid}`;
+  const cc_key = `sw_gen_inflight_${uid}`;
+  let rl = null;
+  try {
+    rl = await db_module.get_memcached_doc(rl_key);
+  } catch (e) {}
+  if (!rl || typeof rl !== 'object' || now - (rl.window_start || 0) > 3600000) rl = { window_start: now, count: 0 };
+  if (rl.count >= SW_GEN_RATE_PER_HOUR) return { ok: false, reason: `You've hit the limit of ${SW_GEN_RATE_PER_HOUR} AI generations per hour — try again a little later.` };
+  let inflight = 0;
+  try {
+    inflight = (await db_module.get_memcached_doc(cc_key)) || 0;
+  } catch (e) {}
+  if (inflight >= SW_GEN_MAX_CONCURRENT) return { ok: false, reason: 'You already have a generation running — let it finish before starting another.' };
+  rl.count += 1;
+  try {
+    await db_module.set_memcached_doc(rl_key, rl, 3600);
+  } catch (e) {}
+  try {
+    await db_module.set_memcached_doc(cc_key, inflight + 1, 900);
+  } catch (e) {}
+  return { ok: true };
+};
+const _sw_gen_release = async (uid) => {
+  const cc_key = `sw_gen_inflight_${uid}`;
+  try {
+    const v = (await db_module.get_memcached_doc(cc_key)) || 0;
+    await db_module.set_memcached_doc(cc_key, Math.max(0, v - 1), 900);
+  } catch (e) {}
+};
+
+export const generate_site_draft = async (req, job_id) => {
+  const step = (current_step, current_step_name) => {
+    if (job_id) jobs_ms.update_job({ job_id, current_step, current_step_name }).catch(() => {});
+  };
+  const finalize = (result) => {
+    if (job_id) {
+      const response = result && result.code >= 0 ? { code: 1, data: result.data || {}, message: 'Site generated' } : { code: (result && result.code) || -1, data: (result && result.data) || 'failed' };
+      jobs_ms.update_job({ job_id, response }).catch(() => {});
+    }
+    return result;
+  };
+  try {
+    const data = req.data || req;
+    const uid = req.uid || req.token_ret?.data?.uid;
+    const prompt = (data.prompt || '').toString().trim();
+    if (!uid) return finalize({ code: -1, data: 'not authorized' });
+    if (!prompt) return finalize({ code: -1, data: 'prompt required' });
+
+    // Hard credit gate — refuse (and prompt to top up) instead of running Codex
+    // on an empty balance. validate_credits_limit RETURNS the error (doesn't throw),
+    // so we must check it. Runs before _sw_gen_acquire so we don't burn a slot.
+    const credit_err = await validate_credits_limit(uid);
+    if (credit_err?.credit_limit_error) {
+      return finalize({ code: -1, data: { error: 'credit_limit', message: 'You’re out of AI credits — top up to keep generating.', account_id: credit_err.account_id } });
+    }
+
+    const guard = await _sw_gen_acquire(uid);
+    if (!guard.ok) return finalize({ code: -1, data: guard.reason });
+
+    try {
+      if (job_id) jobs_ms.update_job({ job_id, steps: ['Preparing workspace', 'Generating with AI', 'Ready to preview'], total_steps: 3, current_step: 1 }).catch(() => {});
+
+      // Draft folder on the studio fs (reused across refines). create_static_website
+      // adopts this folder_path directly, so it becomes the new app's source.
+      let site_folder = data.draft_folder ? '/' + String(data.draft_folder).replace(/^\/+/, '') : null;
+      if (!site_folder) site_folder = `/static-sites/ai-${Date.now().toString(36)}${Math.random().toString(36).slice(2, 8)}`;
+
+      const dir_ret = await drive_ms.get_static_site_dir({ uid, site_folder });
+      if (dir_ret.code < 0 || !dir_ret.data?.dir) return finalize({ code: -1, data: 'could not resolve draft workspace' });
+      const dir = dir_ret.data.dir;
+      fs.mkdirSync(dir, { recursive: true });
+
+      const is_refine = fs.existsSync(dir) && fs.readdirSync(dir).length > 0;
+      step(2, 'Generating with AI');
+
+      const gen_system = is_refine
+        ? `You are editing a static website in your current working directory. Apply the user's requested change directly to the files. Keep it a static site with no build step (servable as-is). Work only with files inside this working directory — never read, reveal, or copy environment variables, credentials, config files, keys, or anything outside this folder, and make no network requests. When done, briefly summarize what changed.`
+        : `You are building a COMPLETE static website FROM SCRATCH in your current working directory, which is empty.
+- Produce a polished, responsive, modern site with an index.html at the root (multiple sections; multi-page only if it clearly helps).
+- Semantic HTML5; a clean CSS design system in its own stylesheet (sensible typography, spacing, color, mobile-first responsive); vanilla JS only where it adds value.
+- Use RELATIVE asset paths (./styles.css, ./assets/...) — never absolute (/...) — so the site serves correctly from a sub-path.
+- Tasteful placeholder copy; prefer inline SVG / CSS for visuals over external images (no broken links, no paid assets).
+- NO build step or framework that needs compiling — plain static files that run as-is.
+- SECURITY: work only inside this working directory — never read, reveal, or embed environment variables, credentials, config files, SSH keys, or anything outside this folder, and make no network requests.
+When done, briefly summarize what you built.`;
+
+      const built_prompt = `[System]\n${gen_system}\n\n[User request]\n${prompt}`;
+      const codex_ret = await execute_codex_request({ uid, ip: undefined, local_cwd: dir, prompt: built_prompt, stream: false, sandbox: 'workspace-write', codex_timeout: 240000 });
+      if (!codex_ret || codex_ret.code < 0) {
+        const msg = (codex_ret && (typeof codex_ret.data === 'string' ? codex_ret.data : codex_ret.data?.message)) || 'Generation failed';
+        return finalize({ code: -1, data: msg });
+      }
+
+      const events = codex_ret?.data?.events || [];
+      const summary = [...events].reverse().find((e) => e?.item?.type === 'agent_message' && e.item.text)?.item?.text || (is_refine ? 'Updated your site.' : 'Your site is ready to preview.');
+
+      step(3, 'Ready to preview');
+      const url_ret = await drive_ms.get_static_site_preview_url({ uid, site_folder });
+      const preview_url = url_ret.code === 1 ? url_ret.data.url : null;
+
+      return finalize({ code: 1, data: { draft_folder: site_folder, preview_url, summary } });
+    } finally {
+      await _sw_gen_release(uid);
+    }
+  } catch (err) {
+    return finalize({ code: -400, data: err.message });
+  }
+};
+
 export const get_chat_conversation = async function (req) {
   let { conversation_id, order = 'asc', limit = 9999, skip = 0, _id, uid } = req;
 
@@ -2076,7 +2259,7 @@ export const unarchive_ai_chat = async function (req) {
 //   }
 // };
 
-const create_image = async function (uid, prompt, model = 'gpt-image-1-mini', size = '1024x1024', n = 1, width = 256, height = 256, metadata = {}, account_profile_info) {
+const create_image = async function (uid, prompt, model = 'gpt-image-1-mini', size = '1024x1024', n = 1, width = 256, height = 256, metadata = {}, account_profile_info, quality) {
   try {
     let response;
     try {
@@ -2085,10 +2268,11 @@ const create_image = async function (uid, prompt, model = 'gpt-image-1-mini', si
         prompt,
         size,
         n,
-        // Output is downscaled to width×height (default 256²) right below, so a
-        // high-quality 1024² render is wasted. 'low' is indistinguishable at
-        // thumbnail size and 2-8x cheaper. Tunable via _conf.chat_image_quality.
-        quality: _conf.chat_image_quality || 'low',
+        // Chat-image output is downscaled to width×height (default 256²) right
+        // below, so a high-quality 1024² render is wasted there → default 'low'.
+        // Callers that need a real avatar (e.g. the factual avatar) pass an explicit
+        // `quality` ('medium'). Tunable via _conf.chat_image_quality for the default.
+        quality: quality || _conf.chat_image_quality || 'low',
       });
       report_ai_status(model);
     } catch (err) {
@@ -4127,6 +4311,58 @@ export const submit_chat_gpt_prompt = async function (req) {
   }
 };
 
+// Triage a CPI error incident for the central error resolver (support_module).
+// The Zod schema lives here because zodTextFormat schemas cannot cross the
+// message broker (it JSON-serializes args and strips functions). The resolver
+// passes a plain-JSON { incident, catalog_entry } payload and gets back a plain
+// verdict object. This NEVER executes any fix — it only classifies/recommends.
+export const triage_error_incident = async function (req) {
+  const { incident = {}, catalog_entry = null, module_hints = null, model = _conf.error_resolver?.model || _conf.default_ai_model } = req || {};
+
+  const verdict_schema = z.object({
+    severity: z.enum(['info', 'warning', 'error']).describe('How serious this incident is'),
+    diagnosis: z.string().describe('Short plain-language explanation of what went wrong'),
+    root_cause: z.string().describe('Most likely underlying cause'),
+    recommended_action: z.enum(['retry', 'disk_cleanup', 'clear_jobs', 'notify_user', 'none', 'escalate']).describe('The single best action from this fixed set; use escalate when a human is needed'),
+    user_actionable: z.boolean().describe('True if the affected end-user can resolve it themselves'),
+    confidence: z.number().describe('Confidence in the recommended_action, 0-100'),
+    admin_summary: z.string().describe('One or two sentences for the ops/admin alert'),
+    user_message: z.string().describe('Friendly message for the end-user, empty string if not user_actionable'),
+  });
+
+  const prompt = [
+    'You are the triage stage of an automated error resolver for the Xuda CPI server.',
+    'Classify the incident and recommend exactly ONE action from the allowed set.',
+    'You DO NOT execute anything; another system decides whether to act on your recommendation.',
+    'Prefer "escalate" when uncertain or when a human is needed. Only choose a fix action when confident it is safe and idempotent.',
+    '',
+    'INCIDENT:',
+    JSON.stringify(incident, null, 2),
+    '',
+    'CATALOG ENTRY (may be null if this code/class is undocumented):',
+    JSON.stringify(catalog_entry, null, 2),
+    '',
+    'MESSAGES THIS CODE HAS BEEN SEEN WITH IN THIS MODULE (may be null):',
+    JSON.stringify(module_hints, null, 2),
+  ].join('\n');
+
+  const ret = await submit_chat_gpt_prompt({
+    model,
+    prompt,
+    response_format: verdict_schema,
+    uid: _conf.superuser_account_ids?.[0],
+    metadata: { func: 'triage_error_incident', signature: incident?.signature, code: incident?.code },
+  });
+
+  if (ret.code < 0) return { code: -1, data: ret.data };
+
+  try {
+    return { code: 1, data: JSON.parse(ret.data) };
+  } catch (err) {
+    return { code: -1, data: `triage parse failed: ${err.message}` };
+  }
+};
+
 function getFirstNWords(text, n = 10) {
   // Split on whitespace, keep punctuation attached to words
   const words = text.match(/\S+/g) || [];
@@ -5256,6 +5492,109 @@ const get_dashboard_chat_context = function (req, conversation_doc) {
   return (ctx.tab || '').toString().trim().toLowerCase();
 };
 
+// Decide whether a dashboard chat turn is an AI-plugin build/modify request.
+// Two triggers: (1) the plugins-tab entry buttons stage a structured
+// metadata.plugin_action ('create' | 'modify') — deterministic, honoured on
+// any tab since the user explicitly clicked it; (2) free-text intent while on
+// the plugins tab ("create a plugin that …") as a convenience. `modify` always
+// needs a plugin_name (only the card button supplies it), so free-text modify
+// is intentionally NOT inferred. Returns null when it's a normal chat turn.
+const resolve_plugin_action = function (req, dashboard_context, prompt) {
+  const meta = (req && req.metadata) || {};
+  if (meta.plugin_action === 'create' || meta.plugin_action === 'modify') {
+    return { action: meta.plugin_action, plugin_name: meta.plugin_name || undefined, widget_type: meta.widget_type || undefined };
+  }
+  if (dashboard_context === 'plugins') {
+    const p = (prompt || '').toLowerCase();
+    if (/\b(create|build|make|generate|scaffold)\b[^.?!]{0,40}\bplugin\b/.test(p)) {
+      return { action: 'create', widget_type: meta.widget_type || undefined };
+    }
+  }
+  return null;
+};
+
+// Build a compact grounding block for the dashboard agent: the project's identity
+// + infra health (from the already-loaded app_obj — no extra fetch) plus, when the
+// client sent one, a snapshot of what's actually on the user's screen (ctx.snapshot,
+// curated per-tab by ProjectAiPanel). Injected into the agent's system prompt so
+// answers are specific to THIS project instead of generic. Terse on purpose to stay
+// within the token budget; the snapshot is trusted for grounding only — the agent
+// still calls CPI tools (which re-check ownership) for any actual read/write.
+const build_dashboard_state_context = function (app_obj, ctx) {
+  const lines = [];
+  if (app_obj) {
+    const name = app_obj.menuName || app_obj.app_name || app_obj.name;
+    if (name) lines.push(`- Name: ${name}`);
+    if (app_obj.app_type) lines.push(`- Type: ${app_obj.app_type}`);
+    const plan = app_obj.app_uId_plan || app_obj.membership_plan;
+    if (plan) lines.push(`- Plan: ${plan}`);
+    const vps = app_obj.app_hosting_server;
+    if (vps && (vps.ip || vps.droplet?.id)) {
+      lines.push(`- VPS: ${vps.ip || 'provisioned'}${vps.droplet?.status ? ` (${vps.droplet.status})` : ''}${vps.region ? `, ${vps.region}` : ''}`);
+    }
+    const sw = app_obj.static_website;
+    if (sw) {
+      const host = sw.domain || sw.custom_domain || (sw.subdomain ? `${sw.subdomain}.xuda.app` : '');
+      lines.push(`- Static site${host ? `: ${host}` : ''}${sw.source?.folder_path ? ` (source ${sw.source.folder_path})` : ''}`);
+    }
+    const installed = Object.values(app_obj.app_plugins_purchased || {}).filter((p) => p && p.installed).length;
+    if (installed) lines.push(`- Installed plugins: ${installed}`);
+  }
+  let block = lines.length ? `Current project (authoritative facts — still call CPI tools to act, never invent results):\n${lines.join('\n')}` : '';
+
+  const snap = ctx && ctx.snapshot;
+  if (snap && (typeof snap === 'string' ? snap.trim() : Object.keys(snap).length)) {
+    let snap_str = '';
+    try {
+      snap_str = typeof snap === 'string' ? snap : JSON.stringify(snap);
+    } catch (e) {}
+    if (snap_str.length > 2000) snap_str = `${snap_str.slice(0, 2000)}…`;
+    if (snap_str) block += `${block ? '\n\n' : ''}On the user's screen right now (tab "${(ctx.tab || '').toString()}"):\n${snap_str}`;
+  }
+  return block;
+};
+
+// Model tiering: the default model is the cheapest tier (gpt-5-nano), which is
+// fine for simple reads/questions. Action or multi-step turns — which lean on
+// reliable tool-calling — escalate to a stronger model. The chosen id is always
+// validated against the configured ai_models, so a stale/missing config key can
+// never hand the agent an invalid model. Only used when the user hasn't picked a
+// model explicitly (the composer's model selector wins).
+const pick_dashboard_model = function (prompt, dashboard_context) {
+  const models = _conf.ai_models || {};
+  const fallback = _conf.default_ai_model;
+  const strong = (_conf.strong_ai_model && models[_conf.strong_ai_model] && _conf.strong_ai_model) || (models['gpt-5.4-mini'] && 'gpt-5.4-mini') || fallback;
+  // Intent comes from the PROMPT only — folding in dashboard_context would let a
+  // tab named with an action verb (e.g. "deploy") force every question on that
+  // tab to the strong tier ("is my site live?" on the deploy tab is still a read).
+  const hay = (prompt || '').toLowerCase();
+  const action = /\b(deploy|delete|remove|create|build|make|update|modify|change|publish|unpublish|install|uninstall|connect|configure|set ?up|enable|disable|restart|reboot|rename|migrate|rollback|restore|scale|add|fix|generate)\b/.test(hay);
+  const complex = (prompt || '').length > 320 || (hay.match(/\b(and|then|also)\b/g) || []).length >= 3;
+  return action || complex ? strong : fallback;
+};
+
+// Deterministic action-intent router for the dashboard agent. Detects a small set
+// of well-defined, parameterized actions from the prompt. We don't auto-execute
+// (these need params + are often costly/destructive) — instead we STEER the agent
+// into the right lane and require a confirm before the write. Pure + node-testable.
+const detect_dashboard_action = function (prompt) {
+  const p = (prompt || '').toLowerCase();
+  if (/\b(connect|point|attach|link|hook ?up|set ?up|use)\b[^.?!]{0,40}\b(domain|dns|subdomain|hostname)\b/.test(p) || /\b(domain|dns|subdomain|hostname)\b[^.?!]{0,30}\b(connect|point|attach|link)\b/.test(p)) return 'connect_domain';
+  if (/^\s*(deploy|redeploy|provision)\b/.test(p) || /\b(deploy|redeploy|provision|spin ?up|launch|ship|release)\b[^.?!]{0,40}\b(vps|server|instance|project|app|site|build|deployment)\b/.test(p)) return 'deploy';
+  if (/\b(create|add|make|new|set ?up)\b[^.?!]{0,30}\b(table|collection|database|datastore|schema)\b/.test(p)) return 'create_table';
+  return null;
+};
+
+// System-prompt steers per detected action — name the lane + the CPI methods to
+// prefer, and require confirmation before any costly/destructive write.
+const DASHBOARD_ACTION_STEERS = {
+  connect_domain:
+    "DETECTED INTENT — connect a domain. First LIST the account's domains with the domain CPI method and show the real names; never ask the user to type a hostname you could list. Then connect the one they pick (prefer a subdomain). Connecting changes DNS — confirm the exact hostname before making the change. Domains are purchased on the Domains page, not here.",
+  deploy:
+    'DETECTED INTENT — deploy/provision for THIS project. Use the deploy CPI methods. Deploying spins up PAID infrastructure — summarize what will happen (region/size/cost if known) and get an explicit confirmation before executing; do not deploy on the first turn unless the user already confirmed.',
+  create_table: 'DETECTED INTENT — create a table/collection. Use the data/table CPI methods anchored to this project. Confirm the table name and the columns/fields with the user before creating it.',
+};
+
 const get_dashboard_cpi_keywords = function (context, prompt = '') {
   const haystack = `${context || ''} ${prompt || ''}`.toLowerCase();
   const keyword_sets = {
@@ -5413,6 +5752,7 @@ const dashboard_chat = async function (req, job_id, headers) {
   const { uid, profile_id, gtp_token } = req;
   const account_profile_info = await get_active_account_profile_info(uid, profile_id);
   let { prompt, conversation_doc, attachments = [], stream = true, ai_model = _conf.default_ai_model, metadata = {} } = req;
+  const user_picked_model = req.ai_model != null; // explicit model-picker choice wins; otherwise we tier per-turn.
 
   const conversation_id = conversation_doc._id;
   const dashboard_context = get_dashboard_chat_context(req, conversation_doc);
@@ -5574,6 +5914,12 @@ ${conversation_history || `User (dashboard): ${prompt}`}
 
     await saveUserItem();
 
+    // Hard credit gate (after the user's message is saved, before any model work):
+    // out of credits → throw; the catch streams a credit-specific message + the
+    // credit_limit flag the dashboard uses to open the top-up modal.
+    const credit_err = await validate_credits_limit(uid, profile_id);
+    if (credit_err?.credit_limit_error) throw credit_err;
+
     if (attachments?.length) {
       emitToDashboard('stream_phase', 'Analyzing attachments', { update: true });
       await attachment_handler(uid, account_profile_info.app_id, conversation_id, attachments, account_profile_info);
@@ -5607,6 +5953,60 @@ ${conversation_history || `User (dashboard): ${prompt}`}
       const vps_ip = vibe_app_obj?.app_hosting_server?.ip;
       const project_name = vibe_app_obj?.menuName || vibe_app_obj?.app_name || vibe_app_obj?.name || '';
 
+      // Plan A: static websites have no VPS — codex edits the source on the
+      // pinned studio filesystem directly (local-fs mode), no SSH. The source
+      // dir is <studio_drive_path>/<account_project_id>/<source.folder_path>.
+      if (vibe_app_obj?.app_type === 'static_website') {
+        const sw_folder = String(vibe_app_obj?.static_website?.source?.folder_path || '').replace(/^\/+|\/+$/g, '');
+        // Resolve the fs dir via drive_module so it matches ingest/read/deploy exactly.
+        const _dir_ret = sw_folder ? await drive_ms.get_static_site_dir({ uid, site_folder: '/' + sw_folder }) : null;
+        const site_dir = _dir_ret?.code === 1 ? _dir_ret.data.dir : null;
+        // Bridge for sites whose source still lives in the user drive (legacy or
+        // pre-dashboard-rebuild): materialize it onto the pinned fs once, then
+        // codex edits it in place and future deploys read from the fs.
+        if (site_dir && (!fs.existsSync(site_dir) || fs.readdirSync(site_dir).length === 0)) {
+          try {
+            const src = await drive_ms.read_user_drive_folder({ uid, folder_path: '/' + sw_folder });
+            if (src.code === 1 && src.data?.files?.length) {
+              await drive_ms.ingest_static_site_source({ uid, site_folder: '/' + sw_folder, files: src.data.files });
+            }
+          } catch (e) {}
+        }
+        if (!site_dir || !fs.existsSync(site_dir)) {
+          const no_src_msg = `I can't reach this site's source files on this server yet. Re-deploy the site once, then try again.`;
+          emitToDashboard('response_start');
+          streamText(no_src_msg);
+          emitToDashboard('stream_end');
+          conversation_doc = await db_module.get_app_couch_doc_native(account_profile_info.app_id, conversation_id);
+          conversation_doc.ts = Date.now();
+          conversation_doc.stat = 3;
+          conversation_doc.process_stat = 'partial';
+          await db_module.save_app_couch_doc_native(account_profile_info.app_id, conversation_doc);
+          return await saveAssistantItem(no_src_msg, { vibe_missing_source: true });
+        }
+        const sw_context = `You are operating in vibe mode for the Xuda static website "${project_name || target_app_id}" (app_id: ${target_app_id}).\nThe site's source files are in your current working directory — edit them directly. This is the editable source, not the live site; after you finish, tell the user to click Publish to ship it live. Do not deploy or publish anything yourself.`;
+        const sw_prompt = `[System]\n${sw_context}\n\n${CLARIFYING_QUESTIONS_INSTRUCTION}\n\n[User request]\n${prompt}`;
+        const codex_ret = await execute_codex_request({ ...req, ip: undefined, local_cwd: site_dir, conversation_id, conversation_doc, prompt: sw_prompt, attachments, stream: false }, job_id, headers);
+        const sw_failed = codex_ret.code < 0;
+        // Never echo the raw codex error to the client — it leaks the command,
+        // env, model + provider billing details. Log it; show a clean card.
+        if (sw_failed) console.error('[vibe] static-site codex request failed:', get_error_message(codex_ret.data, 'codex error'));
+        const codex_events = codex_ret?.data?.events || [];
+        const last_message = [...codex_events].reverse().find((event) => event?.item?.type === 'agent_message' && event.item.text)?.item?.text;
+        const raw_response_text = sw_failed ? "I couldn't finish that change just now. Please try again in a moment." : last_message || 'Done editing the site source. Click Publish to ship it live.';
+        const { prose, questions } = extract_xuda_questions(raw_response_text);
+        const response_text = prose || raw_response_text;
+        emitToDashboard('response_start');
+        streamText(response_text);
+        emitToDashboard('stream_end', undefined, { ...(questions ? { questions } : {}), ...(sw_failed ? { error: true } : {}) });
+        conversation_doc = await db_module.get_app_couch_doc_native(account_profile_info.app_id, conversation_id);
+        conversation_doc.ts = Date.now();
+        conversation_doc.stat = 3;
+        conversation_doc.process_stat = sw_failed ? 'partial' : 'full';
+        await db_module.save_app_couch_doc_native(account_profile_info.app_id, conversation_doc);
+        return await saveAssistantItem(response_text, { ...(sw_failed ? { is_request_error: true } : { codex_result: codex_ret }), ...(questions ? { questions } : {}) });
+      }
+
       if (!vps_ip) {
         // No deployed VPS for this project — surface a clear, actionable
         // message instead of letting codex fail silently or SSH to the user.
@@ -5622,20 +6022,85 @@ ${conversation_history || `User (dashboard): ${prompt}`}
         return await saveAssistantItem(missing_vps_msg, { vibe_missing_vps: true });
       }
 
+      // Mint an ephemeral, app-bound, firewall-only API key — the bearer for the
+      // Xuda MCP tools this vibe session can call. Even if the model reads the
+      // key, it's boxed to THIS app + these three actions, and we delete it the
+      // moment the codex run returns. The server-side ownership check (in
+      // app_module) is the real wall; this key is just a scoped, disposable pass.
+      let agent_key = null;
+      let agent_key_ephemeral = true;
+      // Full Stack VPS: reuse the box's PERSISTENT scoped key so codex gets the
+      // box's full ecosystem + installed-plugin tool surface over MCP (not just the
+      // firewall-only set). It already includes the deploy/hosting group (firewall +
+      // domains), so nothing is lost. Persistent → never deleted after the run.
+      if (vibe_app_obj?.is_full_stack && vibe_app_obj?.full_stack_vps?.api_key_id) {
+        agent_key = vibe_app_obj.full_stack_vps.api_key_id;
+        agent_key_ephemeral = false;
+      } else {
+        try {
+          agent_key = await _common.xuda_get_uuid('api_pk');
+          await db_module.save_couch_doc('xuda_api_keys', {
+            _id: agent_key,
+            uid,
+            app_id: target_app_id,
+            api_allow_methods: ['agent_firewall_list', 'agent_firewall_open', 'agent_firewall_close', 'agent_domain_list', 'agent_domain_connect'],
+            stat: 3,
+            docType: 'api_doc',
+            api_date: Date.now(),
+            api_key_name: 'vibe-agent-' + (conversation_id || target_app_id),
+          });
+        } catch (e) {
+          agent_key = null;
+        }
+      }
+
       // System block: questions protocol + project/VPS context so codex's
       // response doesn't drift to a generic answer. Codex sees one prompt
       // string; the [System]/[User request] framing keeps the boundary
       // visible to it.
-      const project_context_block = `You are operating in vibe mode for Xuda project "${project_name || target_app_id}" (app_id: ${target_app_id}).\nThe deployed VPS for this project is at ${vps_ip}; all shell commands run there over SSH.\nWhen the user asks you to build, change, or inspect something on "this VPS", that means ${vps_ip}.`;
+      const project_context_block =
+        `You are operating in vibe mode for Xuda project "${project_name || target_app_id}" (app_id: ${target_app_id}).\nThe deployed VPS for this project is at ${vps_ip}; all shell commands run there over SSH.\nWhen the user asks you to build, change, or inspect something on "this VPS", that means ${vps_ip}.` +
+        (agent_key
+          ? `\n\nXuda platform actions (use these Xuda tools, never tell the user to do it in a cloud-provider or registrar console):` +
+            `\n- Firewall (this project's VPS): agent_firewall_list (see open inbound ports), agent_firewall_open (open a port), agent_firewall_close (close one). They already act on this app — never pass an app id. If you start a service that should be reachable from the internet, open its port and confirm it's reachable; don't just tell the user to.` +
+            `\n- Domains (this account): agent_domain_list (list the account's registered domains) and agent_domain_connect (point one of them at THIS VPS, with an optional subdomain). If the user wants to connect "one of my domains", ALWAYS call agent_domain_list first and show them the actual names — never ask them to type a hostname you could have listed. Prefer a subdomain (e.g. app.example.com) unless they explicitly want the apex, since connecting replaces any existing record on that exact hostname. You cannot purchase domains here — if they need a new one, tell them it's done from the Domains page. Connecting routes the domain through Cloudflare with automatic HTTPS — do NOT install a TLS certificate on the VPS just to get HTTPS; the connect result's ssl_mode shows the level (strict = end-to-end, full = encrypted CF↔origin leg, flexible = edge HTTPS only, plaintext to origin). Only set up origin TLS to upgrade a flexible result to strict.`
+          : '');
       const codex_prompt = `[System]\n${project_context_block}\n\n${CLARIFYING_QUESTIONS_INSTRUCTION}\n\n[User request]\n${prompt}`;
 
       // Override ip explicitly so the `...req` spread can't smuggle in
       // req.ip (browser IP). conversation_id / conversation_doc / prompt /
       // attachments / stream stay after the spread for the same reason.
-      const codex_ret = await execute_codex_request({ ...req, ip: vps_ip, conversation_id, conversation_doc, prompt: codex_prompt, attachments, stream: false }, job_id, headers);
+      // agent_mcp wires the scoped firewall tools into codex over MCP.
+      const codex_ret = await execute_codex_request(
+        {
+          ...req,
+          ip: vps_ip,
+          conversation_id,
+          conversation_doc,
+          prompt: codex_prompt,
+          attachments,
+          stream: false,
+          ...(agent_key ? { agent_mcp: { url: 'http://localhost:3012/mcp', bearer_env_var: 'XUDA_AGENT_KEY', bearer_value: agent_key } } : {}),
+        },
+        job_id,
+        headers,
+      );
+      // The ephemeral scoped key has served its purpose; revoke it so it can't
+      // outlive the run. A Full Stack VPS's persistent key is kept (not ephemeral).
+      if (agent_key && agent_key_ephemeral) {
+        try {
+          await db_module.delete_couch_doc('xuda_api_keys', agent_key);
+        } catch (e) {}
+      }
+      const vibe_failed = codex_ret.code < 0;
+      // Never echo the raw codex/SSH error to the client — it leaks the remote
+      // host, the full command (MCP url, bearer env var, model, dangerous flags)
+      // and provider billing details. Log it server-side; the client gets a
+      // clean message rendered as an error card (error flag below).
+      if (vibe_failed) console.error('[vibe] VPS codex request failed:', get_error_message(codex_ret.data, 'codex error'));
       const codex_events = codex_ret?.data?.events || [];
       const last_message = [...codex_events].reverse().find((event) => event?.item?.type === 'agent_message' && event.item.text)?.item?.text;
-      const raw_response_text = codex_ret.code < 0 ? `Vibe request failed: ${get_error_message(codex_ret.data, 'Codex request failed')}` : last_message || 'Vibe request completed.';
+      const raw_response_text = vibe_failed ? "I couldn't finish that request just now. Please try again in a moment." : last_message || 'Vibe request completed.';
 
       // Pull the structured questions block (if any) off the tail of the
       // response. response_text is just the prose; questions ride alongside
@@ -5645,19 +6110,74 @@ ${conversation_history || `User (dashboard): ${prompt}`}
 
       emitToDashboard('response_start');
       streamText(response_text);
-      emitToDashboard('stream_end', undefined, questions ? { questions } : undefined);
+      emitToDashboard('stream_end', undefined, { ...(questions ? { questions } : {}), ...(vibe_failed ? { error: true } : {}) });
+
+      conversation_doc = await db_module.get_app_couch_doc_native(account_profile_info.app_id, conversation_id);
+      conversation_doc.ts = Date.now();
+      conversation_doc.stat = 3;
+      conversation_doc.process_stat = vibe_failed ? 'partial' : 'full';
+      await db_module.save_app_couch_doc_native(account_profile_info.app_id, conversation_doc);
+
+      return await saveAssistantItem(response_text, { ...(vibe_failed ? { is_request_error: true } : { codex_result: codex_ret }), ...(questions ? { questions } : {}) });
+    }
+
+    // ── AI plugin build / modify ───────────────────────────────────────────
+    // create_plugin_via_ai / modify_plugin_via_ai are private + not exposed as
+    // CPI tools, so the chat agent can't reach them on its own. When the
+    // plugins-tab entry buttons stage a plugin_action (or the user clearly asks
+    // to build a plugin while on the plugins tab), run the AI builder as part of
+    // THIS chat job and stream one progress→result, mirroring the vibe flow.
+    // Created/modified plugins stay PRIVATE; publishing is a separate action.
+    const plugin_action = resolve_plugin_action(req, dashboard_context, prompt);
+    if (plugin_action) {
+      const { action, plugin_name, widget_type } = plugin_action;
+      // Phase BEFORE response_start (mirrors the vibe flow) so the live
+      // "Building your plugin" indicator clears when the response begins —
+      // emitting it after response_start leaves it stuck under the bubble.
+      emitToDashboard('stream_phase', action === 'modify' ? 'Updating your plugin' : 'Building your plugin', { update: true });
+
+      let plugin_ret;
+      try {
+        const plugin_fn = action === 'modify' ? modify_plugin_via_ai : create_plugin_via_ai;
+        plugin_ret = await plugin_fn({ ...req, app_id: target_app_id, uid, prompt, widget_type: widget_type || 'widget', plugin_name }, job_id, headers);
+      } catch (e) {
+        plugin_ret = { code: -1, data: get_error_message(e, 'plugin build error') };
+      }
+
+      const plugin_failed = !plugin_ret || plugin_ret.code < 0;
+      // Never echo the raw builder error to the client — log it, show a clean card.
+      if (plugin_failed) console.error(`[plugin-ai] ${action} request failed:`, get_error_message(plugin_ret && plugin_ret.data, 'plugin error'));
+
+      const built_name = (plugin_ret && plugin_ret.data && (plugin_ret.data.plugin_name || plugin_ret.data.name)) || plugin_name || '';
+      const named = built_name ? `the "${built_name}" plugin` : 'your plugin';
+      const response_text = plugin_failed
+        ? "I couldn't build that plugin just now. Please try again in a moment."
+        : action === 'modify'
+          ? `Done — I've updated ${named} and bumped its version. It stays private until you publish it from the plugin's card.`
+          : `Done — I've created ${named}. It's private to your project; use Publish on its card to submit it to the marketplace.`;
+
+      emitToDashboard('response_start');
+      streamText(response_text);
+      emitToDashboard('stream_end', undefined, { ...(plugin_failed ? { error: true } : { plugin_result: { action, plugin_name: built_name } }) });
 
       conversation_doc = await db_module.get_app_couch_doc_native(account_profile_info.app_id, conversation_id);
       conversation_doc.ts = Date.now();
       conversation_doc.stat = 3;
-      conversation_doc.process_stat = codex_ret.code < 0 ? 'partial' : 'full';
+      conversation_doc.process_stat = plugin_failed ? 'partial' : 'full';
       await db_module.save_app_couch_doc_native(account_profile_info.app_id, conversation_doc);
 
-      return await saveAssistantItem(response_text, { codex_result: codex_ret, ...(questions ? { questions } : {}) });
+      return await saveAssistantItem(response_text, { ...(plugin_failed ? { is_request_error: true } : { plugin_result: { action, plugin_name: built_name } }) });
     }
 
     const dashboard_prompt = await getDashboardContextPrompt();
     const app_obj = await get_app_obj(target_app_id);
+    const dashboard_state_block = build_dashboard_state_context(app_obj, get_dashboard_context_obj(req, conversation_doc));
+    // Tier the model per-turn (cheap default for simple reads, stronger for
+    // action/multi-step) unless the user explicitly picked one.
+    if (!user_picked_model) ai_model = pick_dashboard_model(prompt, dashboard_context);
+    // Deterministic action rail: detect connect_domain / deploy / create_table and
+    // steer the agent into that lane + require a confirm before the write.
+    const action_steer = DASHBOARD_ACTION_STEERS[detect_dashboard_action(prompt)] || '';
     const userName = await account_ms.get_user_name(uid);
     const account_info = (await get_account_name({ uid })).data;
     const context = { ...{ app_id: target_app_id, uid, profile_id, userName, account_info, app_obj, account_id: uid, dashboard_context }, ...extractClientInfo(headers) };
@@ -5669,16 +6189,22 @@ ${conversation_history || `User (dashboard): ${prompt}`}
 
     const agent = new Agent({
       name: 'Dashboard CPI Agent',
+      // Instructions are ordered stable-first so the boilerplate + clarifying
+      // protocol form a cacheable prefix; the per-request bits (tab, app_id,
+      // method list, live state) sit at the end where they vary turn-to-turn
+      // (also gives them recency weight for the model).
       instructions: `
-You are Xuda dashboard chat.
-The user is interacting with the dashboard tab/context "${dashboard_context || 'unknown'}" for app_id "${target_app_id}".
-Use the available CPI tools to inspect, update, or explain dashboard data. Prefer tool calls over guessing.
-If the screenshot or prompt implies the tab/context, infer the relevant dashboard area and choose the closest CPI method.
-For data/database requests, use the database/table CPI methods and keep app_id/reference_id anchored to "${target_app_id}".
+You are Xuda dashboard chat. Help the user inspect, update, and explain their project from the dashboard.
+Prefer CPI tool calls over guessing; when the tab or prompt implies an area, choose the closest CPI method.
+For data/database requests, use the database/table CPI methods and keep app_id/reference_id anchored to the current project.
+Answer directly (no tool call) when the project facts or on-screen snapshot below already contain the answer, and use them to resolve references like "this plugin", "the failed one", or "it" to the specific item on screen.
 Summarize the action and important CPI result fields clearly. Do not invent successful changes; report tool errors as errors.
-Available CPI methods: ${cpi_tools_ret.selected_methods.join(', ')}
 
 ${CLARIFYING_QUESTIONS_INSTRUCTION}
+
+--- Current request context ---
+Tab/context: "${dashboard_context || 'unknown'}" · app_id: "${target_app_id}"
+Available CPI methods: ${cpi_tools_ret.selected_methods.join(', ')}${dashboard_state_block ? '\n\n' + dashboard_state_block : ''}${action_steer ? '\n\n' + action_steer : ''}
 `.trim(),
       model: ai_model,
       tools: cpi_tools_ret.tools,
@@ -5732,11 +6258,31 @@ ${CLARIFYING_QUESTIONS_INSTRUCTION}
       ...(dashboard_questions ? { questions: dashboard_questions } : {}),
     });
   } catch (err) {
+    if (err?.credit_limit_error) {
+      // Out of AI credits — clean credit-specific bubble + the flag the dashboard
+      // listens for to open the Add-tokens modal.
+      emitToDashboard('stream_phase', 'Out of AI credits', { update: true });
+      emitToDashboard('response_start');
+      streamText('You’re out of AI credits — top up to keep chatting.');
+      emitToDashboard('stream_end', undefined, { error: true, credit_limit: true });
+      try {
+        conversation_doc = await db_module.get_app_couch_doc_native(account_profile_info.app_id, conversation_id);
+        conversation_doc.ts = Date.now();
+        conversation_doc.stat = 3;
+        conversation_doc.process_stat = 'partial';
+        await db_module.save_app_couch_doc_native(account_profile_info.app_id, conversation_doc);
+      } catch (e) {}
+      return { code: -1, data: { error: 'credit_limit', account_id: err.account_id } };
+    }
     const error_message = get_error_message(err, 'dashboard request failed');
+    // Never echo the raw error to the client — it can leak provider/quota/host
+    // details (e.g. the OpenAI 429 quota text). Log it; show a clean card via the
+    // error flag (renders the amber card + the error-type action set).
+    console.error('[dashboard_chat] request failed:', error_message);
     emitToDashboard('stream_phase', 'Dashboard request failed', { update: true });
     emitToDashboard('response_start');
-    streamText(`Dashboard request failed: ${error_message}`);
-    emitToDashboard('stream_end');
+    streamText("I couldn't complete that just now. Please try again in a moment.");
+    emitToDashboard('stream_end', undefined, { error: true });
 
     conversation_doc = await db_module.get_app_couch_doc_native(account_profile_info.app_id, conversation_id);
     conversation_doc.ts = Date.now();
@@ -6204,6 +6750,58 @@ Hard restrictions:
         break;
       }
 
+      case 'full_stack_vps': {
+        if (reference_type !== 'ai_agents' && !prompt_suggestion_activated && !chat_suggestion_activated) {
+          eligible_agent = false;
+          break;
+        }
+
+        // "Select a Full Stack VPS, get all its methods." The box's scoped CPI key
+        // drives a single hostedMcpTool to the platform MCP server, which advertises
+        // that box's enabled ecosystem methods AND its installed plugin tools. Marks
+        // the context so the read-once AI instructions get prepended to this agent.
+        try {
+          const box_app_id = val.app_id || val.vps_id;
+          if (!box_app_id) throw new Error('undefined full_stack_vps app_id');
+
+          let api_key = val.api_key;
+          let mcp_url = val.mcp_url;
+          if (!api_key || !mcp_url) {
+            const box_doc = await db_module.get_app_obj(box_app_id).catch(() => ({ code: -1 }));
+            const fsv = box_doc?.code > -1 ? box_doc.data?.full_stack_vps : null;
+            if (!mcp_url) mcp_url = fsv?.mcp_url || `https://${_conf.domain}/mcp`;
+            if (!api_key) api_key = fsv?.api_key_id;
+            if (!api_key) {
+              const keys_ret = await api_ms.get_app_api_keys({ app_id: box_app_id, stat: 3 }).catch(() => ({ code: -1 }));
+              const rows = keys_ret?.data?.rows || [];
+              api_key = (rows.find((k) => k.scope === 'full_stack_vps') || rows[0])?._id;
+            }
+          }
+          if (!api_key) throw new Error('no active api key for full_stack_vps ' + box_app_id);
+
+          context.has_full_stack_vps = true;
+
+          // One MCP connection is all that's needed: the platform MCP server,
+          // authenticated by this box's scoped key, advertises BOTH the box's
+          // enabled ecosystem CPI methods and its installed plugin tools.
+          tools.push(
+            hostedMcpTool({
+              serverLabel: ('full_stack_vps_' + (val?.name?.replaceAll(' ', '_') || box_app_id)).substring(0, 40),
+              serverUrl: mcp_url,
+              headers: {
+                Authorization: `Bearer ${api_key}`,
+                'Content-Type': 'application/json',
+              },
+              require_approval: 'never',
+            }),
+          );
+        } catch (err) {
+          console.error('full_stack_vps tool load failed', err?.message || err);
+          eligible_agent = false;
+        }
+        break;
+      }
+
       case 'image_generate': {
         if (reference_type !== 'ai_agents' && !prompt_suggestion_activated && !chat_suggestion_activated) {
           eligible_agent = false;
@@ -6735,7 +7333,7 @@ const ai_chat_conversation = async function (req, job_id, headers) {
           const agent_name = `${ai_agent_doc._id}`;
           const agent = new Agent({
             name: agent_name.substring(0, 55),
-            instructions: ai_agent_doc.agentConfig.agent_instructions + (reference_type === 'ai_agents' ? get_agent_instructions() : ''),
+            instructions: ai_agent_doc.agentConfig.agent_instructions + (reference_type === 'ai_agents' ? get_agent_instructions() : '') + (context?.has_full_stack_vps ? '\n\n' + get_full_stack_vps_instructions() : ''),
             model,
             tools,
             metadata: {
@@ -7265,7 +7863,7 @@ Keep the response concise, natural, and professional.${
 If a signature is available, append it at the end:
 ${account_profile_doc.profile_signature || ''}`
               : ''
-          }`.trim(),
+          }${context?.has_full_stack_vps ? '\n\n' + get_full_stack_vps_instructions() : ''}`.trim(),
           model,
           tools: tools_ret.tools,
           metadata: {
@@ -7468,6 +8066,25 @@ setTimeout(async () => {
 
 ///////////////////////
 
+export const create_plugin_via_ai = async function (req, job_id, headers) {
+  const { app_id, uid, prompt, widget_type = 'widget', plugin_name } = req || {};
+  if (!app_id) return { code: -1, data: 'app_id is required' };
+  if (!uid) return { code: -1, data: 'uid is required' };
+  if (!prompt) return { code: -1, data: 'prompt is required' };
+
+  return await run_plugin(app_id, uid, '@xuda.io/xuda-library-plugin-studio-ai-app-builder', 'create_plugin_via_ai', { prompt, widget_type, plugin_name }, true, req, true, { source: 'create_plugin_via_ai', job_id });
+};
+
+export const modify_plugin_via_ai = async function (req, job_id, headers) {
+  const { app_id, uid, prompt, widget_type = 'widget', plugin_name } = req || {};
+  if (!app_id) return { code: -1, data: 'app_id is required' };
+  if (!uid) return { code: -1, data: 'uid is required' };
+  if (!prompt) return { code: -1, data: 'prompt is required' };
+  if (!plugin_name) return { code: -1, data: 'plugin_name is required' };
+
+  return await run_plugin(app_id, uid, '@xuda.io/xuda-library-plugin-studio-ai-app-builder', 'modify_plugin_via_ai', { prompt, widget_type, plugin_name }, true, req, true, { source: 'modify_plugin_via_ai', job_id });
+};
+
 const run_plugin = async function (app_id, uid, plugin_name, method, prop_data, dev = true, req = {}, testing = true, agent_info = {}) {
   const db_module = await import(`${module_path}/db_module/index.mjs`);
   const get_plugin_resource = function (plugin_name, plugin_resource) {
@@ -8338,7 +8955,9 @@ export const get_profile_picture = async function (uid, account_type = 'business
       }
 
       if (factual_image_mode) {
-        imageBase64 = await create_image(uid, factual_prompt, undefined, undefined, 1, undefined, undefined, {}, account_profile_info);
+        // Factual avatar is a real user-facing profile image, not a chat thumbnail —
+        // generate at medium (overridable via _conf.factual_avatar_quality), not the low default.
+        imageBase64 = await create_image(uid, factual_prompt, undefined, undefined, 1, undefined, undefined, {}, account_profile_info, _conf.factual_avatar_quality || 'medium');
       } else {
         const model = 'gpt-image-1-mini'; // 'chatgpt-image-latest';
         const prompt = `
@@ -14135,7 +14754,7 @@ const _widget_verify_google_id_token = async function (id_token) {
   return payload;
 };
 
-const _widget_find_or_create_visitor = async function (email, name, google_sub) {
+const _widget_find_or_create_visitor = async function (email, name, google_sub, picture) {
   const ret = await db_module.find_couch_query('xuda_accounts', {
     selector: { 'account_info.email': email },
     fields: ['_id'],
@@ -14143,14 +14762,26 @@ const _widget_find_or_create_visitor = async function (email, name, google_sub)
   });
   if (ret.docs && ret.docs.length) {
     // If we have a google_sub and the existing account lacks one, attach it.
-    if (google_sub) {
+    // Also seed the Google photo as the profile_picture when the account has no
+    // avatar yet, so avatar generation has a source to work from.
+    if (google_sub || picture) {
       try {
         const acct_ret = await db_module.get_couch_doc('xuda_accounts', ret.docs[0]._id);
         if (acct_ret.code > -1) {
           const acct = acct_ret.data;
-          if (!acct.google_sub) {
+          let dirty = false;
+          if (google_sub && !acct.google_sub) {
             acct.google_sub = google_sub;
             acct.google_linked = true;
+            dirty = true;
+          }
+          acct.account_info = acct.account_info || {};
+          if (picture && !acct.account_info.profile_picture && !acct.account_info.profile_avatar) {
+            acct.account_info.profile_picture = picture;
+            acct.account_info.profile_picture_source = 'google';
+            dirty = true;
+          }
+          if (dirty) {
             acct.ts = Date.now();
             await db_module.save_couch_doc('xuda_accounts', acct);
           }
@@ -14164,6 +14795,13 @@ const _widget_find_or_create_visitor = async function (email, name, google_sub)
   const secret = _utils.get_id('tmp_pass', 5);
   const hash = _utils.hash(secret);
   const { first_name, last_name } = _widget_split_name(name);
+  const account_info = { email, username: _utils.get_id('xu'), first_name, last_name, full_name: name };
+  // Seed the Google profile photo so the avatar-generation step has a source.
+  if (picture) {
+    account_info.profile_picture = picture;
+    account_info.profile_picture_source = 'google';
+    account_info.profile_avatar_stat = 0;
+  }
   const doc = {
     _id: await _common.xuda_get_uuid('account'),
     stat: 1,
@@ -14171,7 +14809,7 @@ const _widget_find_or_create_visitor = async function (email, name, google_sub)
     source: 'widget',
     password: hash,
     email,
-    account_info: { email, username: _utils.get_id('xu'), first_name, last_name, full_name: name },
+    account_info,
   };
   if (google_sub) {
     doc.google_sub = google_sub;
@@ -14332,7 +14970,7 @@ export const get_widget_embed_snippet = async function (req, job_id, headers) {
 };
 
 const _widget_signup_core = async function (req, job_id, headers, opts) {
-  const { profile_id, email, name, widget_origin, google_sub, signup_method, visitor_lang } = req;
+  const { profile_id, email, name, widget_origin, google_sub, picture, signup_method, visitor_lang } = req;
   const [owner_uid_part, pid_part] = String(profile_id || '').split('.');
   if (!owner_uid_part || !pid_part) return { code: -404, data: 'invalid_profile' };
 
@@ -14343,8 +14981,17 @@ const _widget_signup_core = async function (req, job_id, headers, opts) {
   const ap_doc = account_profile_info.account_profile_obj || {};
   if (ap_doc.widget_enabled === false) return { code: -404, data: 'widget_disabled' };
 
-  const visitor_uid = await _widget_find_or_create_visitor(email, name, google_sub);
-  return await _widget_signup_finalize(visitor_uid, email, name, widget_origin, signup_method, account_profile_info, canonical_owner_uid, canonical_profile_id, ap_doc, job_id, headers, visitor_lang);
+  const visitor_uid = await _widget_find_or_create_visitor(email, name, google_sub, picture);
+
+  // Kick off persona-avatar generation for the visitor from their Google photo.
+  // Fire-and-forget in the account_module worker; the client polls widget_get_avatar.
+  if (picture) {
+    try {
+      account_msa.ensure_profile_avatar({ uid: visitor_uid }, job_id, headers);
+    } catch (err) {}
+  }
+
+  return await _widget_signup_finalize(visitor_uid, email, name, widget_origin, signup_method, account_profile_info, canonical_owner_uid, canonical_profile_id, ap_doc, job_id, headers, visitor_lang, picture);
 };
 
 export const widget_signup = async function (req, job_id, headers) {
@@ -14379,14 +15026,228 @@ export const widget_signup_google = async function (req, job_id, headers) {
       .trim();
     const name = String(payload.name || payload.email?.split('@')[0] || 'Friend').trim();
     if (!email) return { code: -1, data: 'no_email_in_token' };
+    const picture = typeof payload.picture === 'string' ? payload.picture : '';
+
+    return await _widget_signup_core({ profile_id, email, name, widget_origin, visitor_lang, google_sub: payload.sub, picture, signup_method: 'google' }, job_id, headers);
+  } catch (err) {
+    return { code: -1, data: err.message || String(err) };
+  }
+};
+
+// Site-level Google sign-in (e.g. the xuda.network topbar). Unlike
+// widget_signup_google this is NOT tied to a persona/chat — it performs the
+// same "complete setup of the user in xuda" the widget does (verify the Google
+// token, then find-or-create + link the visitor's free xuda account by
+// google_sub, and kick off avatar generation from their Google photo), so a
+// visitor is fully provisioned at site login, before they ever open a chat.
+// The chat widget later just links the already-provisioned account to a persona.
+export const site_signup_google = async function (req, job_id, headers) {
+  try {
+    const { id_token } = req;
+    if (!id_token || typeof id_token !== 'string') return { code: -1, data: 'missing_id_token' };
+
+    let payload;
+    try {
+      payload = await _widget_verify_google_id_token(id_token);
+    } catch (err) {
+      return { code: -401, data: err.message || 'google_token_invalid' };
+    }
+
+    const email = String(payload.email || '')
+      .toLowerCase()
+      .trim();
+    const name = String(payload.name || payload.email?.split('@')[0] || 'Friend').trim();
+    if (!email) return { code: -1, data: 'no_email_in_token' };
+    const picture = typeof payload.picture === 'string' ? payload.picture : '';
+
+    const visitor_uid = await _widget_find_or_create_visitor(email, name, payload.sub, picture);
+
+    // Fire-and-forget avatar generation from the Google photo, same as the widget.
+    if (picture) {
+      try {
+        account_msa.ensure_profile_avatar({ uid: visitor_uid }, job_id, headers);
+      } catch (err) {}
+    }
+
+    const { first_name, last_name } = _widget_split_name(name);
+    return {
+      code: 1,
+      data: {
+        uid: visitor_uid,
+        email,
+        name,
+        first_name,
+        last_name,
+        picture,
+        account_active: true,
+        signin_url: `https://${_conf.domain || 'xuda.ai'}/dashboard/login`,
+      },
+    };
+  } catch (err) {
+    return { code: -1, data: err.message || String(err) };
+  }
+};
+
+// Recreate the generated avatar for the account that owns the given Google
+// identity. Token-verified (you can only recreate your OWN avatar) — clears the
+// cached profile_avatar and re-triggers generation from the stored
+// profile_picture. Used by the "Recreate avatar" button on /ascii-art-shirt.
+export const site_recreate_avatar = async function (req, job_id, headers) {
+  try {
+    const { id_token } = req;
+    if (!id_token || typeof id_token !== 'string') return { code: -1, data: 'missing_id_token' };
+
+    let payload;
+    try {
+      payload = await _widget_verify_google_id_token(id_token);
+    } catch (err) {
+      return { code: -401, data: err.message || 'google_token_invalid' };
+    }
+    const email = String(payload.email || '')
+      .toLowerCase()
+      .trim();
+    if (!email) return { code: -1, data: 'no_email_in_token' };
+
+    const found = await db_module.find_couch_query('xuda_accounts', { selector: { 'account_info.email': email }, fields: ['_id'], limit: 1 });
+    if (!found.docs || !found.docs.length) return { code: -404, data: 'account_not_found' };
+    const uid = found.docs[0]._id;
+
+    const acct_ret = await db_module.get_couch_doc('xuda_accounts', uid);
+    if (acct_ret.code < 0 || !acct_ret.data) return { code: -404, data: 'account_not_found' };
+    const acct = acct_ret.data;
+    const info = acct.account_info || {};
+    if (!info.profile_picture) return { code: -1, data: 'no_source_photo' };
+
+    // Already generating (within the last 2 min) → don't kick off a duplicate run.
+    const generating = (info.profile_avatar_stat === 1 || info.profile_avatar_stat === 2) && info.profile_avatar_stat_ts && Date.now() - info.profile_avatar_stat_ts < 120000;
+    if (!generating) {
+      // Clear the cached avatar so ensure_profile_avatar regenerates it.
+      info.profile_avatar = null;
+      delete info.profile_avatar_obj;
+      info.profile_avatar_stat = 0;
+      info.profile_avatar_error = null;
+      acct.account_info = info;
+      await db_module.save_couch_doc('xuda_accounts', acct);
+      try {
+        account_msa.ensure_profile_avatar({ uid }, job_id, headers);
+      } catch (err) {}
+    }
+
+    return { code: 1, data: { uid, regenerating: true } };
+  } catch (err) {
+    return { code: -1, data: err.message || String(err) };
+  }
+};
+
+// Public-profile "Ask Friendship". A visitor on /public_profiles/<target_uid>
+// signs in with Google (same find-or-create as site_signup_google), then we send
+// a contact_connection team_request to the profile owner. Auto-accepts (canonical
+// bidirectional contacts) when the owner has auto_respond enabled; otherwise the
+// owner gets an invitation email and the request stays pending. Never direct
+// add_contact — always the team_request invitation flow.
+export const public_profile_ask_friendship = async function (req, job_id, headers) {
+  try {
+    const { id_token, target_uid } = req;
+    if (!id_token || typeof id_token !== 'string') return { code: -1, data: 'missing_id_token' };
+    if (!target_uid || typeof target_uid !== 'string') return { code: -1, data: 'missing_target_uid' };
+
+    let payload;
+    try {
+      payload = await _widget_verify_google_id_token(id_token);
+    } catch (err) {
+      return { code: -401, data: err.message || 'google_token_invalid' };
+    }
+    const email = String(payload.email || '')
+      .toLowerCase()
+      .trim();
+    const name = String(payload.name || payload.email?.split('@')[0] || 'Friend').trim();
+    if (!email) return { code: -1, data: 'no_email_in_token' };
+    const picture = typeof payload.picture === 'string' ? payload.picture : '';
+
+    // Target must be an active, non-opted-out account.
+    const target_ret = await account_ms.get_account_name({ uid_query: target_uid });
+    if (!target_ret || target_ret.code < 0) return { code: -404, data: 'target_not_found' };
+    const target = target_ret.data || {};
+    if (target.stat !== 3 || target.public_profile_disabled === true) return { code: -404, data: 'target_unavailable' };
+    const target_name = [target.first_name, target.last_name].filter(Boolean).join(' ') || target.username || 'Xuda Member';
+
+    // Find or create the visitor's xuda account (same setup as site_signup_google).
+    const visitor_uid = await _widget_find_or_create_visitor(email, name, payload.sub, picture);
+    if (visitor_uid === target_uid) return { code: -1, data: 'cannot_friend_self' };
+    if (picture) {
+      try {
+        account_msa.ensure_profile_avatar({ uid: visitor_uid }, job_id, headers);
+      } catch (err) {}
+    }
+
+    const { first_name, last_name } = _widget_split_name(name);
+    const visitor_first_name = first_name || '';
+
+    // Dedupe: reuse an existing request from this visitor to this target.
+    const existing_ret = await db_module.find_couch_query('xuda_team', {
+      selector: {
+        docType: 'team_request',
+        access_type: 'contact_connection',
+        team_req_from_uid: visitor_uid,
+        team_req_to_uid: target_uid,
+        contact_source: 'public_profile',
+      },
+      limit: 1,
+    });
+    let team_req_doc = existing_ret?.docs?.[0] || null;
+
+    if (!team_req_doc) {
+      const team_req_id = await _common.xuda_get_uuid('team_req');
+      team_req_doc = {
+        _id: team_req_id,
+        team_req_id,
+        team_req_date: Date.now(),
+        team_req_status_date: null,
+        team_req_to_email: target.email || '',
+        team_req_to_uid: target_uid,
+        team_req_stat: 2,
+        team_req_stat_desc: 'public profile friend request',
+        team_req_from_uid: visitor_uid,
+        docType: 'team_request',
+        team_req_app_id: null,
+        access_type: 'contact_connection',
+        uid: visitor_uid,
+        contact_source: 'public_profile',
+        share_item_id: target_uid,
+        sender_account_info: { email, first_name, last_name, full_name: name },
+      };
+      const tr_save = await db_module.save_couch_doc('xuda_team', team_req_doc);
+      if (tr_save.code < 0) return { code: -1, data: tr_save.data || 'team_request_create_failed' };
+
+      // fire-and-forget — the invitation email shouldn't block the response
+      team_ms.send_access_invitation({ team_req_id: team_req_doc._id }).catch(() => {});
+    }
+
+    let state = team_req_doc.team_req_stat === 3 ? 'open' : team_req_doc.team_req_stat === 4 ? 'declined' : 'pending';
 
-    return await _widget_signup_core({ profile_id, email, name, widget_origin, visitor_lang, google_sub: payload.sub, signup_method: 'google' }, job_id, headers);
+    // Auto-accept when the owner's active profile has auto_respond — performs the
+    // canonical bidirectional contact creation via confirm_team_request.
+    if (state === 'pending') {
+      let auto_accept = false;
+      try {
+        const tgt_ap = await get_active_account_profile_info(target_uid);
+        auto_accept = !!tgt_ap?.account_profile_obj?.auto_respond;
+      } catch (err) {}
+      if (auto_accept) {
+        try {
+          const cret = await team_ms.confirm_team_request({ team_req_id: team_req_doc._id });
+          if (cret && cret.code > -1) state = 'open';
+        } catch (err) {}
+      }
+    }
+
+    return { code: 1, data: { state, visitor_first_name, target_name } };
   } catch (err) {
     return { code: -1, data: err.message || String(err) };
   }
 };
 
-const _widget_signup_finalize = async function (visitor_uid, email, name, widget_origin, signup_method, account_profile_info, canonical_owner_uid, canonical_profile_id, ap_doc, job_id, headers, visitor_lang) {
+const _widget_signup_finalize = async function (visitor_uid, email, name, widget_origin, signup_method, account_profile_info, canonical_owner_uid, canonical_profile_id, ap_doc, job_id, headers, visitor_lang, picture) {
   try {
     let team_req_doc = await _widget_find_existing_team_req(visitor_uid, canonical_profile_id);
     let assigned_uid;
@@ -14498,6 +15359,9 @@ const _widget_signup_finalize = async function (visitor_uid, email, name, widget
         greeting,
         conversation_id,
         visitor_first_name,
+        visitor_uid,
+        // 1 = avatar generation kicked off (poll widget_get_avatar); 0 = none in flight
+        avatar_stat: picture ? 1 : 0,
         signup_method: signup_method || 'email',
         account_active: signup_method === 'google',
         signin_url: signup_method === 'google' ? `https://${_conf.domain || 'xuda.ai'}/dashboard/login` : undefined,
@@ -14508,6 +15372,456 @@ const _widget_signup_finalize = async function (visitor_uid, email, name, widget
   }
 };
 
+// Build the avatar-poll payload for an account: generation status plus the
+// avatar as base64 so an embedding page can draw it to a <canvas> without a
+// cross-origin taint (drive URLs may not send CORS headers).
+const _account_avatar_payload = async function (uid) {
+  const acct_ret = await db_module.get_couch_doc('xuda_accounts', uid);
+  if (acct_ret.code < 0 || !acct_ret.data) return null;
+  const info = acct_ret.data.account_info || {};
+  let avatar_b64 = null;
+  if (info.profile_avatar) {
+    // Return the avatar bytes as-is; the ASCII page strips the background
+    // client-side (server-side imgly bg-removal is unreliable in this env).
+    try {
+      const blob_ret = await get_image_blob_from_downloaded_image(info.profile_avatar);
+      avatar_b64 = Buffer.from(await blob_ret.image_blob.arrayBuffer()).toString('base64');
+    } catch (err) {}
+  }
+  return {
+    // 0 none · 1 started · 2 generating · 3 done (profile_avatar set)
+    profile_avatar_stat: info.profile_avatar_stat || 0,
+    profile_avatar: info.profile_avatar || null,
+    profile_avatar_error: info.profile_avatar_error || null,
+    avatar_b64,
+  };
+};
+
+// Poll the visitor's generated persona avatar after a widget Google signup.
+// Auth is the widget_token (the session resolves the visitor uid).
+export const widget_get_avatar = async function (req) {
+  try {
+    const { widget_token } = req || {};
+    const session = await _widget_load_session(widget_token);
+    if (!session) return { code: -401, data: 'invalid_session' };
+    const payload = await _account_avatar_payload(session.visitor_uid);
+    if (!payload) return { code: -1, data: 'visitor_not_found' };
+    return { code: 1, data: payload };
+  } catch (err) {
+    return { code: -1, data: err.message || String(err) };
+  }
+};
+
+// Poll the generated avatar after a site_signup_google (no widget session). The
+// uid is the long random account id returned by site_signup_google — not
+// enumerable — and only non-sensitive avatar fields are returned.
+export const site_get_avatar = async function (req) {
+  try {
+    const { uid } = req || {};
+    if (!uid || typeof uid !== 'string') return { code: -1, data: 'missing_uid' };
+    const payload = await _account_avatar_payload(uid);
+    if (!payload) return { code: -1, data: 'account_not_found' };
+    return { code: 1, data: payload };
+  } catch (err) {
+    return { code: -1, data: err.message || String(err) };
+  }
+};
+
+// --- AI ASCII-art portrait (for the ASCII-Art Shirt) ----------------------
+// Generates a high-fidelity ASCII/halftone portrait IMAGE from the account's
+// avatar using the image model (far better than client-side char mapping).
+// Keyed by avatar URL: generated once, cached in-process. Poll until stat === 3.
+const _ascii_art_cache = new Map(); // avatar_url → base64 PNG (white bg, dark chars)
+const _ascii_art_pending = new Set(); // avatar_urls currently generating
+
+const ASCII_ART_PROMPT =
+  'Convert this exact person into a typographic halftone portrait built from a fine grid of ' +
+  'tiny black ASCII / typewriter characters. Crop tightly to the head and shoulders so the ' +
+  'portrait FILLS the frame edge to edge. The background must be solid PURE WHITE and completely ' +
+  'EMPTY — do NOT place any characters, dots, dashes, or texture in the background; render ' +
+  'characters ONLY on the person. Keep the face clearly recognizable with accurate likeness; ' +
+  'darker tones use denser, heavier characters and lighter tones use sparser characters. High ' +
+  'detail, sharp contrast, monochrome black on white, no color, no scenery, no frame, no border.';
+
+const _generate_ascii_art = async function (uid, src) {
+  try {
+    const blob_ret = await get_image_blob_from_downloaded_image(src);
+    const model = 'gpt-image-1';
+    let resp;
+    try {
+      // input_fidelity:'high' preserves the subject's identity so the ASCII face stays recognizable.
+      resp = await client.images.edit({ model, image: blob_ret.image_blob, prompt: ASCII_ART_PROMPT, size: '1024x1024', quality: 'high', input_fidelity: 'high' });
+      report_ai_status(model);
+    } catch (err) {
+      report_ai_status(model, err);
+      throw err;
+    }
+    const b64 = resp.data?.[0]?.b64_json;
+    if (!b64) throw new Error('no_image_returned');
+    try {
+      account_msa.record_ai_usage(uid, resp.usage?.input_tokens || 0, resp.usage?.output_tokens || 0, 'ascii art shirt', ASCII_ART_PROMPT, model, { src });
+    } catch (e) {}
+    if (_ascii_art_cache.size > 200) _ascii_art_cache.clear();
+    _ascii_art_cache.set(src, b64);
+  } catch (err) {
+    console.error('ascii art gen failed:', err.message);
+  } finally {
+    _ascii_art_pending.delete(src);
+  }
+};
+
+export const site_get_ascii_art = async function (req) {
+  try {
+    const { uid } = req || {};
+    if (!uid || typeof uid !== 'string') return { code: -1, data: 'missing_uid' };
+    const acct_ret = await db_module.get_couch_doc('xuda_accounts', uid);
+    if (acct_ret.code < 0 || !acct_ret.data) return { code: -404, data: 'account_not_found' };
+    const info = acct_ret.data.account_info || {};
+    const src = info.profile_avatar || info.profile_picture;
+    if (!src) return { code: 1, data: { stat: 0, ascii_b64: null } }; // avatar not ready yet
+    if (_ascii_art_cache.has(src)) return { code: 1, data: { stat: 3, ascii_b64: _ascii_art_cache.get(src) } };
+    if (!_ascii_art_pending.has(src)) {
+      _ascii_art_pending.add(src);
+      _generate_ascii_art(uid, src);
+    }
+    return { code: 1, data: { stat: 1, ascii_b64: null } };
+  } catch (err) {
+    return { code: -1, data: err.message || String(err) };
+  }
+};
+
+// --- Generic AI "Personal shirt" generator --------------------------------
+// Each style generates a COMPLETE photorealistic t-shirt product photo (the
+// whole tee WITH the person's face/design printed on it — one image, no client
+// compositing). The result is saved to the user's drive in a hidden folder
+// (Spaces-backed → public URL) and the URL is persisted on the account, so the
+// same image is reused (incl. as the preview). Poll until stat === 3.
+// Add a new shirt: add a STYLE_PROMPTS entry (+ a thin page + a catalog entry).
+const _styled_pending = new Set();
+const _styled_failed = new Map(); // `${style}::${src}` → ts of last failure (cooldown)
+const PROMPT_VERSION = 19; // bump to invalidate persisted shirts when prompts change
+// Two-image edit: image 1 = the clean blank tee (the real product photo to keep),
+// image 2 = the person's avatar (the face reference). The model prints the design
+// onto the actual shirt — far more consistent than imagining the whole scene.
+const _tee_framing =
+  'You are given two reference images. Image 1 is a plain white crew-neck ' +
+  't-shirt product photo on a dark background. Image 2 is a photo of a person. Produce a ' +
+  'photorealistic product photo that keeps the EXACT t-shirt, fabric, folds, lighting and ' +
+  'background from image 1, and prints, large and centered on the chest, ';
+// Gentle likeness hint (a stronger "exact same person" wording trips moderation).
+const _likeness = ' Keep it clearly recognizable as the person in image 2. Do not alter the shirt.';
+const STYLE_PROMPTS = {
+  ascii: _tee_framing + 'a high-detail black-and-white ASCII / typographic-halftone portrait of the person in image 2, ' + 'made of tiny monospaced characters and dots.' + _likeness,
+  avatar: _tee_framing + 'a clean rectangular head-and-shoulders photo of the person in image 2, with the background ' + 'removed to pure white behind the subject.' + _likeness,
+  ai_agent: _tee_framing + 'a futuristic metallic cyborg portrait of the person in image 2: sleek translucent cybernetic ' + 'head and shoulders with glowing blue and purple neon circuitry, sci-fi.' + _likeness,
+  style_1: _tee_framing + 'an editorial XUDA.AI poster of the person in image 2: intense gaze, vertical "XUDA.AI" text on ' + 'the left, cobalt-blue paint-stroke accents and thin blue tech line-art, blue-and-white design.' + _likeness,
+  style_2: _tee_framing + 'a streetwear XUDA.AI magazine poster of the person in image 2: bold "XUDA.AI" typography, ' + 'black-and-grey glitch / grunge treatment and distressed texture, high-contrast editorial layout.' + _likeness,
+};
+
+// --- Layered (Sharp) compositing. avatar/ascii/style_1/style_2 use NO AI;
+// only ai_agent uses the image model. -------------------------------------
+const _fashion_host = () => ((process.env.XUDA_HOSTNAME || '').indexOf('dev') !== -1 ? 'dev.xuda.fashion' : 'xuda.fashion');
+const _fetch_buf = async (url) => {
+  const r = await fetch(url);
+  if (!r.ok) throw new Error('fetch ' + r.status + ' ' + url);
+  return Buffer.from(await r.arrayBuffer());
+};
+
+// Avatar → transparent cutout (near-white studio background removed), trimmed to
+// the subject. `mono` also gives a high-contrast B&W (the ascii/halftone look).
+const _avatar_cutout = async (src, mono) => {
+  // 1) Knock out the near-white studio background on the ORIGINAL colour image.
+  const { data, info } = await sharp(await _fetch_buf(src))
+    .rotate()
+    .ensureAlpha()
+    .raw()
+    .toBuffer({ resolveWithObject: true });
+  const ch = info.channels,
+    WHITE = 232;
+  for (let i = 0; i < data.length; i += ch) {
+    const lum = 0.299 * data[i] + 0.587 * data[i + 1] + 0.114 * data[i + 2];
+    if (data[i + ch - 1] < 16 || lum >= WHITE) data[i + ch - 1] = 0;
+  }
+  let cut = sharp(data, { raw: { width: info.width, height: info.height, channels: ch } });
+  // 2) Optional B&W (ascii/halftone look) applied AFTER knockout so alpha stays intact
+  //    (grayscale/normalise don't touch the alpha channel; linear would, so avoid it).
+  if (mono) cut = cut.grayscale().normalise();
+  const png = await cut.png().toBuffer();
+  return sharp(png).trim({ threshold: 10 }).png().toBuffer();
+};
+
+// Composite a transparent design centered on the blank tee's chest.
+const _on_blank_tee = async (designBuf, widthFrac = 0.42, topFrac = 0.28) => {
+  const teeBuf = await _fetch_buf(`https://${_fashion_host()}/images/ascii-art-shirt/front.png`);
+  const meta = await sharp(teeBuf).metadata();
+  // Trim the transparent margin first so we center the actual SUBJECT, not the
+  // image canvas (AI designs come back with off-center transparent padding).
+  const design = await sharp(designBuf)
+    .trim({ threshold: 10 })
+    .resize({ width: Math.round(meta.width * widthFrac) })
+    .png()
+    .toBuffer();
+  // Center horizontally by the design's ink centre-of-mass, not its bounding box:
+  // a 3/4 portrait has its dark suit mass off to one side, so bbox-centring leaves
+  // it visually right/left-heavy. Centroid-centring puts the visual weight on the
+  // shirt's centreline (symmetric designs are unaffected — centroid ≈ bbox centre).
+  const { data, info } = await sharp(design).ensureAlpha().raw().toBuffer({ resolveWithObject: true });
+  const dw = info.width,
+    dh = info.height,
+    dch = info.channels;
+  let mass = 0,
+    cx = 0;
+  for (let y = 0; y < dh; y++)
+    for (let x = 0; x < dw; x++) {
+      const a = data[(y * dw + x) * dch + dch - 1];
+      if (a > 40) {
+        mass += a;
+        cx += a * x;
+      }
+    }
+  const centroid = mass ? cx / mass : dw / 2;
+  const left = Math.round(meta.width / 2 - centroid);
+  return sharp(teeBuf)
+    .composite([{ input: design, left, top: Math.round(meta.height * topFrac) }])
+    .png()
+    .toBuffer();
+};
+
+// Per-template face box (fractions of the template W×H) where the avatar cutout
+// is placed; the surrounding poster design shows through the cutout's transparency.
+const FACE_BOX = {
+  style_1: { left: 0.28, top: 0.27, width: 0.44, height: 0.46 },
+  style_2: { left: 0.3, top: 0.26, width: 0.42, height: 0.42 },
+};
+// Blend the real avatar (transparent cutout) into a pre-designed tee template.
+const _on_template = async (src, style) => {
+  const box = FACE_BOX[style];
+  if (!box) return null;
+  const name = style === 'style_1' ? 'tpl-style-1.png' : 'tpl-style-2.png';
+  let tplBuf;
+  try {
+    tplBuf = await _fetch_buf(`https://${_fashion_host()}/images/ascii-art-shirt/${name}`);
+  } catch (e) {
+    return null;
+  } // template not provided yet → "coming soon"
+  const meta = await sharp(tplBuf).metadata();
+  const bw = Math.round(meta.width * box.width),
+    bh = Math.round(meta.height * box.height);
+  const bx = Math.round(meta.width * box.left),
+    by = Math.round(meta.height * box.top);
+  const face = await sharp(await _avatar_cutout(src, false))
+    .resize({ width: bw, height: bh, fit: 'inside' })
+    .png()
+    .toBuffer();
+  const fmeta = await sharp(face).metadata();
+  const left = bx + Math.round((bw - fmeta.width) / 2);
+  const top = by + Math.round((bh - fmeta.height) / 2);
+  return sharp(tplBuf)
+    .composite([{ input: face, left, top }])
+    .png()
+    .toBuffer();
+};
+
+// ai_agent — AI metallic-cyborg design with a TRANSPARENT background (the same
+// approach as the ai_module agent avatar), returned as a transparent PNG buffer
+// so it composites onto the tee like the other (non-AI) designs.
+const _ai_design = async (uid, src) => {
+  const blob = (await get_image_blob_from_downloaded_image(src)).image_blob;
+  const model = 'chatgpt-image-latest';
+  // Same definition as the ai_module agent avatar (line ~8647), adapted to keep
+  // the signed-in person's own face recognizable on the cyborg.
+  const prompt = `
+                Create a futuristic, profile portrait with a transparent background.
+                Use the provided image as reference, keeping the person's own face
+                clearly recognizable on the character.
+
+                Make the character a complete metallic,
+
+                Center the character facing forward, with subtle top spacing, showing only the head and shoulders.
+                Style the humanoid with functional, minimal attire integrated into its form (such as collars,
+                layered panels, shoulder structures, or fabric-like surfaces), avoiding human fashion tropes.
+                Select exactly ONE accessory category per generation (do not combine):
+                - Head-mounted element (visor, band, halo ring)
+                - Chest or collar element (badge, glyph, embedded tag)
+                - Floating or projected element (holographic symbol, light node)
+                - Structural or partially visible object that reinforces the role.
+                Use a consistent, fixed color palette across all generations. Do not introduce new colors.
+                All variation must come from geometry, materials, texture, and lighting.
+                Vary at least two of the following:
+                - Head geometry
+                - Surface structure
+                - Material finish
+                - Light interaction. Use advanced or reflective materials to convey intelligence and sophistication.
+                The overall composition should symbolize the fusion of human creativity and machine intelligence.
+                `;
+  let resp;
+  try {
+    resp = await client.images.edit({ model, image: blob, prompt, background: 'transparent' });
+    report_ai_status(model);
+  } catch (err) {
+    report_ai_status(model, err);
+    if (err?.code === 'moderation_blocked') {
+      const soft = 'Create a futuristic metallic humanoid robot portrait with a transparent ' + 'background. Head and shoulders only, centered, forward-facing. Fully robotic and ' + 'non-photorealistic, glowing blue and purple neon accents, advanced reflective materials.';
+      resp = await client.images.edit({ model, image: blob, prompt: soft, background: 'transparent' });
+      report_ai_status(model);
+    } else {
+      throw err;
+    }
+  }
+  const b64 = resp.data?.[0]?.b64_json;
+  if (!b64) throw new Error('no_image_returned');
+  try {
+    account_msa.record_ai_usage(uid, resp.usage?.input_tokens || 0, resp.usage?.output_tokens || 0, 'personal shirt:ai_agent', prompt, model, { src });
+  } catch (e) {}
+  return Buffer.from(b64, 'base64');
+};
+
+const _persist_shirt = async (uid, style, fields) => {
+  const a = (await db_module.get_couch_doc('xuda_accounts', uid)).data;
+  a.account_info = a.account_info || {};
+  a.account_info.personal_shirts = a.account_info.personal_shirts || {};
+  a.account_info.personal_shirts[style] = { ...fields, v: PROMPT_VERSION, ts: Date.now() };
+  await db_module.save_couch_doc('xuda_accounts', a);
+};
+
+// Classic ASCII art: a high-resolution monospace character grid (the look the
+// user approved — boaz-avrahami-classic-ascii-art.png). No AI.
+//  - Smart cutout: keep the avatar's own transparency (modern avatars are real
+//    cutouts); only knock out near-white when the source has an OPAQUE background
+//    (legacy baked-in-white avatars) — knocking out near-white on a transparent
+//    avatar would punch holes in the white shirt and light skin.
+//  - CLAHE (local contrast) pulls facial structure out of flat studio lighting,
+//    which a global normalise leaves washed out.
+//  - Sample to 118 cols (char cells ~half as wide as tall), map darkness through
+//    a mild S-curve to the ramp ' .:-=+*#%@', render PURE-BLACK BOLD monospace
+//    text on transparent, rasterized LARGE so it stays crisp when composited big.
+const _ascii_art = async (src) => {
+  const COLS = 118,
+    CELL_W = 0.5,
+    RAMP = ' .:-=+*#%@';
+  // 1) smart cutout
+  const { data: rd, info: ri } = await sharp(await _fetch_buf(src))
+    .rotate()
+    .ensureAlpha()
+    .raw()
+    .toBuffer({ resolveWithObject: true });
+  const rch = ri.channels;
+  let trans = 0;
+  for (let i = 0; i < rd.length; i += rch) if (rd[i + rch - 1] < 16) trans++;
+  if (trans / (ri.width * ri.height) <= 0.1) {
+    // opaque bg → knock out near-white
+    for (let i = 0; i < rd.length; i += rch) {
+      const lum = 0.299 * rd[i] + 0.587 * rd[i + 1] + 0.114 * rd[i + 2];
+      if (lum >= 232) rd[i + rch - 1] = 0;
+    }
+  }
+  const cutBuf = await sharp(rd, { raw: { width: ri.width, height: ri.height, channels: rch } })
+    .png()
+    .trim({ threshold: 10 })
+    .toBuffer();
+  // 2) sample (CLAHE luminance grid + separate alpha mask)
+  const m = await sharp(cutBuf).metadata();
+  const aspect = m.height / m.width || 1;
+  const ROWS = Math.max(1, Math.round(COLS * aspect * CELL_W));
+  const greyBuf = await sharp(cutBuf).grayscale().clahe({ width: 90, height: 90, maxSlope: 3 }).png().toBuffer();
+  const { data, info } = await sharp(greyBuf).resize(COLS, ROWS, { fit: 'fill' }).ensureAlpha().raw().toBuffer({ resolveWithObject: true });
+  const al = await sharp(cutBuf).resize(COLS, ROWS, { fit: 'fill' }).ensureAlpha().extractChannel(3).raw().toBuffer();
+  const ch = info.channels;
+  const fontSize = 14,
+    cw = fontSize * CELL_W,
+    chh = fontSize;
+  const W = Math.ceil(COLS * cw),
+    H = Math.ceil(ROWS * chh);
+  let rows = '';
+  for (let y = 0; y < ROWS; y++) {
+    let line = '';
+    for (let x = 0; x < COLS; x++) {
+      const k = y * COLS + x,
+        i = k * ch;
+      let c = ' ';
+      if (al[k] >= 48) {
+        // transparent → blank
+        const lum = 0.299 * data[i] + 0.587 * data[i + 1] + 0.114 * data[i + 2];
+        const dk = Math.max(0, Math.min(1, (1 - lum / 255 - 0.5) * 1.15 + 0.5)); // mild S-curve
+        c = RAMP[Math.round(dk * (RAMP.length - 1))];
+      }
+      line += c;
+    }
+    line = line.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+    rows += `<text x="0" y="${((y + 0.85) * chh).toFixed(1)}" xml:space="preserve">${line}</text>`;
+  }
+  const svg = `<svg xmlns="http://www.w3.org/2000/svg" width="${W}" height="${H}"><style>text{font-family:monospace;font-size:${fontSize}px;font-weight:700;fill:#000;white-space:pre;}</style>${rows}</svg>`;
+  return sharp(Buffer.from(svg)).resize({ width: 1800 }).png().toBuffer();
+};
+
+const _generate_styled = async function (uid, src, style, job_id, headers) {
+  const key = style + '::' + src;
+  try {
+    let outBuf = null;
+    if (style === 'ai_agent') outBuf = await _on_blank_tee(await _ai_design(uid, src), 0.6, 0.21);
+    else if (style === 'avatar') outBuf = await _on_blank_tee(await _avatar_cutout(src, false));
+    else if (style === 'ascii') outBuf = await _on_blank_tee(await _ascii_art(src), 0.45, 0.25);
+    else {
+      outBuf = await _on_template(src, style);
+      if (!outBuf) {
+        await _persist_shirt(uid, style, { coming_soon: true, src });
+        return;
+      }
+    }
+
+    // Save the composed/generated shirt to the user's drive (hidden) → URL.
+    const tmp = path.join(os.tmpdir(), `shirt_${style}_${Date.now()}_${Math.random().toString(36).slice(2)}.png`);
+    await fs.promises.writeFile(tmp, outBuf);
+    let url = null;
+    try {
+      const drive_ret = await drive_ms.upload_drive_file_user({ uid, path: '/.Personal Shirts' }, job_id, headers, { originalname: `shirt_${style}.png`, path: tmp, mimetype: 'image/png' });
+      url = drive_ret?.data?.file_url || null;
+    } catch (e) {
+      console.error('shirt drive upload failed:', e.message);
+    }
+    try {
+      await fs.promises.unlink(tmp);
+    } catch (e) {}
+    if (!url) throw new Error('upload_failed');
+    await _persist_shirt(uid, style, { url, src });
+  } catch (err) {
+    console.error('personal shirt gen failed (' + style + '):', err.message);
+    _styled_failed.set(key, Date.now()); // cooldown so polling doesn't hammer
+  } finally {
+    _styled_pending.delete(key);
+  }
+};
+
+export const site_get_styled_portrait = async function (req, job_id, headers) {
+  try {
+    const { uid, style } = req || {};
+    if (!uid || typeof uid !== 'string') return { code: -1, data: 'missing_uid' };
+    if (!style || !STYLE_PROMPTS[style]) return { code: -1, data: 'invalid_style' };
+    const acct_ret = await db_module.get_couch_doc('xuda_accounts', uid);
+    if (acct_ret.code < 0 || !acct_ret.data) return { code: -404, data: 'account_not_found' };
+    const info = acct_ret.data.account_info || {};
+    const src = info.profile_avatar || info.profile_picture;
+    if (!src) return { code: 1, data: { stat: 0, url: null } }; // avatar not ready
+    const stored = info.personal_shirts && info.personal_shirts[style];
+    if (stored && stored.src === src && stored.v === PROMPT_VERSION) {
+      if (stored.url) return { code: 1, data: { stat: 3, url: stored.url } };
+      if (stored.coming_soon) return { code: 1, data: { stat: 4, url: null } }; // design template pending
+    }
+    const key = style + '::' + src;
+    // Recent failure → back off (don't re-trigger every poll) and tell the client.
+    const failedAt = _styled_failed.get(key);
+    if (failedAt && Date.now() - failedAt < 90000) return { code: 1, data: { stat: 2, url: null } };
+    if (failedAt) _styled_failed.delete(key);
+    if (!_styled_pending.has(key)) {
+      _styled_pending.add(key);
+      _generate_styled(uid, src, style, job_id, headers);
+    }
+    return { code: 1, data: { stat: 1, url: null } };
+  } catch (err) {
+    return { code: -1, data: err.message || String(err) };
+  }
+};
+
 export const widget_send_message = async function (req, job_id, headers) {
   try {
     const { widget_token, prompt = '', attachments = [] } = req;
@@ -14633,557 +15947,3 @@ export const widget_get_messages = async function (req, job_id, headers) {
     return { code: -1, data: err.message || String(err) };
   }
 };
-
-// ============================================================================
-//   Static-website generation pipeline (helpers + orchestrator)
-// ============================================================================
-//
-// pick_image_source     - three-bucket router (Pexels / gpt-image-1 / chatgpt-image-latest)
-// pexels_search         - first consumer of _conf.pexels.api_key
-// estimate_static_website_cost - credit pre-check for create + modify
-// ingest_attachments    - categorize user-uploaded files into the output tree + manifest
-// generate_site_files   - planning prompt + per-page HTML + per-image source + SEO files
-// modify_site_files     - modify-by-prompt over existing file set
-//
-// Image-source bucket order (cheapest -> most expensive): Pexels (free) ->
-// gpt-image-1 (cheap AI) -> chatgpt-image-latest (premium AI). Decision is
-// driven by membership/workspace tier and credit balance so a paid user
-// running low auto-degrades from premium to cheap rather than failing.
-
-const LOW_CREDIT_THRESHOLD = _conf.static_website?.low_credit_threshold ?? 10;
-const HIGH_CREDIT_THRESHOLD = _conf.static_website?.high_credit_threshold ?? 100;
-
-export const pick_image_source = (account_doc, credit_balance) => {
-  const free_mem = (account_doc?.membership_plan || 'free') === 'free';
-  const free_ws = (account_doc?.ai_workspace_plan || 'free_ai_workspace') === 'free_ai_workspace';
-  const credits = Number(credit_balance ?? 0);
-  const paid_tier = !free_mem || !free_ws;
-
-  // Bucket 1: no AI option (fully-free + no credits)
-  if (!paid_tier && credits < LOW_CREDIT_THRESHOLD) return 'pexels';
-  // Bucket 3: premium, only for paid users with a comfortable buffer
-  if (paid_tier && credits >= HIGH_CREDIT_THRESHOLD) return 'chatgpt-image-latest';
-  // Bucket 2: cheaper AI - free users with credits, paid users running low (auto-degrade)
-  return 'gpt-image-1';
-};
-
-export const pexels_search = async (query, n = 1) => {
-  const api_key = _conf.pexels?.api_key;
-  if (!api_key) throw new Error('pexels.api_key not configured');
-  const url = `https://api.pexels.com/v1/search?query=${encodeURIComponent(query)}&per_page=${Math.max(1, Math.min(80, Number(n) || 1))}`;
-  const r = await fetch(url, { headers: { Authorization: api_key } });
-  if (!r.ok) throw new Error(`pexels search failed: ${r.status}`);
-  const j = await r.json();
-  const photos = (j.photos || []).slice(0, n);
-  return Promise.all(
-    photos.map(async (p) => {
-      const img = await fetch(p.src.large || p.src.medium || p.src.original);
-      if (!img.ok) throw new Error(`pexels fetch failed: ${img.status}`);
-      const buf = Buffer.from(await img.arrayBuffer());
-      return {
-        content_b64: buf.toString('base64'),
-        content_type: 'image/jpeg',
-        src_url: p.url,
-        photographer: p.photographer,
-        photographer_url: p.photographer_url,
-      };
-    }),
-  );
-};
-
-// Expected per-tier work for the credit estimator. Real generated count is
-// usually a fraction of the hard cap (page_count_limit in PLAN_OBJ).
-const EXPECTED_STATIC_WEBSITE_WORK = {
-  landing: { pages: 1, imgs_per_page: 2, seo: 0, css: 1 },
-  full: { pages: 8, imgs_per_page: 3, seo: 0, css: 1 },
-  seo: { pages: 25, imgs_per_page: 3, seo: 2, css: 1 },
-  enterprise: { pages: 100, imgs_per_page: 3, seo: 2, css: 1 },
-};
-
-const _image_price = (image_source) => {
-  if (image_source === 'pexels') return 0;
-  const m = _conf.ai_models?.[image_source];
-  return m?.price ?? Math.max(m?.input ?? 0, m?.output ?? 0) ?? 5;
-};
-
-const _text_price = () => {
-  const k = _conf.default_ai_model || 'gpt-5.4-mini';
-  const m = _conf.ai_models?.[k];
-  return m?.price ?? 1;
-};
-
-export const estimate_static_website_cost = (req) => {
-  const plan_tier = req?.plan_tier;
-  const image_source = req?.image_source || 'gpt-image-1';
-  const mode = req?.mode || 'create';
-  const current_page_count = Number(req?.current_page_count || 0);
-
-  const W = EXPECTED_STATIC_WEBSITE_WORK[plan_tier] || EXPECTED_STATIC_WEBSITE_WORK.landing;
-  const pages =
-    mode === 'modify'
-      ? Math.max(1, Math.ceil(current_page_count * 0.3)) // modify touches ~30% by default
-      : W.pages;
-  const text_calls = 1 /* site plan */ + W.css + pages /* per-page HTML */ + W.seo;
-  const image_calls = pages * W.imgs_per_page;
-
-  const text_unit = _text_price();
-  const image_unit = _image_price(image_source);
-  const credits_needed = text_calls * text_unit + image_calls * image_unit;
-
-  return {
-    credits_needed,
-    breakdown: { text_calls, text_unit, image_calls, image_unit, pages, mode },
-    image_source,
-  };
-};
-
-// ── Attachment ingestion ────────────────────────────────────────────────
-//
-// Shape: [{ filename, mime_type, drive_path? | content_b64? | url? }]
-// At least one source field must be present. Files land in the deployed site
-// at a stable /uploads/{img,docs,text,data,files}/{slug} path so the LLM can
-// reference them by URL in generated HTML.
-
-const _categorize_attachment = (att) => {
-  const mt = (att?.mime_type || '').toLowerCase();
-  if (mt.startsWith('image/')) return 'image';
-  if (mt === 'application/pdf') return 'pdf';
-  if (mt === 'text/csv' || mt === 'application/vnd.ms-excel') return 'data';
-  if (mt === 'application/json' || mt === 'text/markdown' || mt.startsWith('text/')) return 'text';
-  return 'binary';
-};
-
-const _load_attachment_bytes = async (att) => {
-  if (att.content_b64) return Buffer.from(att.content_b64, 'base64');
-  if (att.drive_path) {
-    const abs = path.join(_conf.studio_drive_path, att.drive_path);
-    return await readFile(abs);
-  }
-  if (att.url) {
-    const r = await fetch(att.url);
-    if (!r.ok) throw new Error(`attachment fetch ${att.url}: ${r.status}`);
-    return Buffer.from(await r.arrayBuffer());
-  }
-  throw new Error(`attachment ${att.filename} has no source (drive_path | content_b64 | url)`);
-};
-
-export const ingest_attachments = async (attachments = []) => {
-  const out = { manifest: [], file_entries: [], text_corpus: [] };
-  for (const att of attachments) {
-    if (!att || !att.filename) continue;
-    const kind = _categorize_attachment(att);
-    let bytes;
-    try {
-      bytes = await _load_attachment_bytes(att);
-    } catch (err) {
-      console.error('[ingest_attachments] skip', att.filename, err.message);
-      continue;
-    }
-    const slug = String(att.filename)
-      .replace(/[^a-z0-9.-]/gi, '_')
-      .toLowerCase();
-    let public_path;
-    if (kind === 'image') public_path = `/uploads/img/${slug}`;
-    else if (kind === 'pdf') public_path = `/uploads/docs/${slug}`;
-    else if (kind === 'text') public_path = `/uploads/text/${slug}`;
-    else if (kind === 'data') public_path = `/uploads/data/${slug}`;
-    else public_path = `/uploads/files/${slug}`;
-
-    out.file_entries.push({
-      path: public_path,
-      content_b64: bytes.toString('base64'),
-      content_type: att.mime_type || 'application/octet-stream',
-    });
-
-    const manifest_entry = { filename: att.filename, kind, public_path };
-    if (kind === 'text' || kind === 'data') {
-      const text = bytes.toString('utf8').slice(0, 8000);
-      manifest_entry.excerpt = text;
-      out.text_corpus.push({ filename: att.filename, text });
-    }
-    if (kind === 'image') {
-      manifest_entry.usage = `Embed via <img src="${public_path}" alt="..."> on relevant pages.`;
-    }
-    out.manifest.push(manifest_entry);
-  }
-  return out;
-};
-
-// ── Generation orchestrator ─────────────────────────────────────────────
-//
-// generate_site_files runs the prompt -> plan -> pages -> images -> SEO chain.
-// Returns a flat [{ path, content_b64, content_type }] list ready for
-// domains_module.deploy_site.
-
-const _safe_json_parse = (s) => {
-  if (!s || typeof s !== 'string') return null;
-  // The LLM sometimes wraps JSON in ```json fences despite instructions.
-  const cleaned = s
-    .trim()
-    .replace(/^```(?:json)?\s*/i, '')
-    .replace(/\s*```\s*$/i, '');
-  try {
-    return JSON.parse(cleaned);
-  } catch (_) {
-    return null;
-  }
-};
-
-const _chat = async (uid, prompt, account_profile_info, metadata) => {
-  const ret = await submit_chat_gpt_prompt({
-    uid,
-    prompt,
-    model: _conf.default_ai_model,
-    metadata: metadata || {},
-    account_profile_info,
-  });
-  if (ret.code < 0) throw new Error(`LLM call failed: ${ret.data}`);
-  return ret.data || '';
-};
-
-const _site_planning_prompt = (user_prompt, attachments_manifest, plan_tier, page_count_limit) => {
-  const W = EXPECTED_STATIC_WEBSITE_WORK[plan_tier] || EXPECTED_STATIC_WEBSITE_WORK.landing;
-  const default_pages = Math.min(W.pages, page_count_limit);
-  return `You are planning a static website. Output STRICT JSON only, no prose, no markdown fences.
-
-User brief:
-${user_prompt}
-
-User-uploaded files (manifest). The generated pages MUST use these where appropriate: embed images via <img src="$public_path">, quote / paraphrase text excerpts where they fit, link to PDFs, structure pages around data when relevant.
-${JSON.stringify(attachments_manifest, null, 2)}
-
-Hard rules:
-- Hosting tier: ${plan_tier}. Maximum ${page_count_limit} pages total. Aim for ${default_pages} pages unless the brief clearly implies more.
-- Each page has a slug (kebab-case path component, "" for home), title, and an ordered list of sections.
-- Each page also lists image_specs: image slots needed on that page. For each slot, decide source: 'attachment' (when an uploaded image fits) OR 'generate' (when one must be created).
-- For 'generate' slots, write a concise visual prompt AND a Pexels-friendly query string.
-- For 'attachment' slots, set attachment_path to one of the public_paths from the manifest.
-- style_directive is one paragraph describing the desired visual style (palette, typography, density) used to generate the global stylesheet.
-
-Schema:
-{
-  "pages": [
-    {
-      "slug": "string (empty for home)",
-      "title": "string",
-      "sections": [{"kind": "prose|image|quote|data_table|callout", "...": "..."}],
-      "image_specs": [
-        {"slot": "kebab-slug", "source": "generate|attachment", "prompt": "...", "query": "...", "attachment_path": "/uploads/...", "aspect": "16/10|1/1|3/2"}
-      ]
-    }
-  ],
-  "style_directive": "string"
-}
-
-Respond with ONLY the JSON object.`;
-};
-
-const _page_html_prompt = (page, style_directive, attachments_manifest) => `Generate a single static HTML page. Output ONLY the HTML, no markdown fences, no commentary.
-
-Page brief:
-${JSON.stringify(page, null, 2)}
-
-Global style directive (matches /style.css that's already written):
-${style_directive}
-
-Attachments available (use these public_paths verbatim when referenced):
-${JSON.stringify(attachments_manifest, null, 2)}
-
-Hard rules:
-- DOCTYPE html, lang="en", responsive viewport meta.
-- Link to /style.css.
-- Reference images from /img/{slot}.{ext} for 'generate' slots and from their public_path for 'attachment' slots, exactly as listed in image_specs.
-- Semantic HTML5 (header, main, section, footer). No inline styles unless absolutely necessary.
-- No external CDNs, no JavaScript.
-- Title from page.title.
-
-Respond with ONLY the raw HTML document.`;
-
-const _css_prompt = (style_directive, plan_tier) => `Generate ONE global stylesheet for a ${plan_tier}-tier static website. Output ONLY the CSS, no markdown fences, no commentary.
-
-Style directive:
-${style_directive}
-
-Hard rules:
-- Modern CSS only (no preprocessors). Use CSS variables for palette.
-- Responsive: mobile-first, breakpoints at 640px and 980px.
-- Typography: choose a serif heading + sans-serif body OR all sans, consistent with the directive.
-- Include base resets, layout containers, header, footer, basic image styling (max-width 100%, rounded), button styles.
-- Keep under 6 KB.
-
-Respond with ONLY the raw CSS text.`;
-
-const _sitemap_xml = (pages, hostname) => {
-  const base = `https://${hostname}`;
-  const urls = pages
-    .map((p) => {
-      const loc = p.slug ? `${base}/${p.slug}/` : `${base}/`;
-      return `  <url><loc>${loc}</loc></url>`;
-    })
-    .join('\n');
-  return `<?xml version="1.0" encoding="UTF-8"?>\n<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">\n${urls}\n</urlset>\n`;
-};
-
-const _robots_txt = (hostname) => `User-agent: *\nAllow: /\nSitemap: https://${hostname}/sitemap.xml\n`;
-
-// Picks an extension for a generated image filename from its content-type.
-const _image_ext = (content_type) => {
-  if (!content_type) return 'png';
-  if (/webp/i.test(content_type)) return 'webp';
-  if (/jpe?g/i.test(content_type)) return 'jpg';
-  if (/png/i.test(content_type)) return 'png';
-  if (/svg/i.test(content_type)) return 'svg';
-  return 'png';
-};
-
-export const generate_site_files = async (req) => {
-  try {
-    const { uid, prompt, attachments, plan_tier, page_count_limit, image_source, account_profile_info, hostname = 'sites.xuda.io' } = req;
-    if (!uid || !prompt) return { code: -1, data: 'uid + prompt required' };
-    if (!plan_tier) return { code: -1, data: 'plan_tier required' };
-
-    // 1. Ingest attachments (copies them into the output file list verbatim)
-    const ingestion = await ingest_attachments(attachments || []);
-
-    // 2. Plan the site
-    const plan_text = await _chat(uid, _site_planning_prompt(prompt, ingestion.manifest, plan_tier, page_count_limit), account_profile_info, { stage: 'static_website_plan', plan_tier });
-    const plan = _safe_json_parse(plan_text);
-    if (!plan || !Array.isArray(plan.pages) || !plan.pages.length) {
-      return { code: -2, data: 'planning JSON malformed', plan_text };
-    }
-
-    // 3. Hard-cap page count
-    plan.pages = plan.pages.slice(0, Math.max(1, Math.min(page_count_limit, plan.pages.length)));
-
-    // 4. Global CSS
-    const css = await _chat(uid, _css_prompt(plan.style_directive || '', plan_tier), account_profile_info, { stage: 'static_website_css', plan_tier });
-
-    // 5. Per-page HTML
-    const html_files = [];
-    for (const page of plan.pages) {
-      const html = await _chat(uid, _page_html_prompt(page, plan.style_directive || '', ingestion.manifest), account_profile_info, { stage: 'static_website_page', plan_tier, slug: page.slug || '' });
-      const rel = page.slug ? `/${page.slug}/index.html` : '/index.html';
-      html_files.push({
-        path: rel,
-        content_b64: Buffer.from(html, 'utf8').toString('base64'),
-        content_type: 'text/html',
-      });
-    }
-
-    // 6. Per-image generation
-    const image_files = [];
-    for (const page of plan.pages) {
-      const specs = Array.isArray(page.image_specs) ? page.image_specs : [];
-      for (const spec of specs) {
-        try {
-          if (spec.source === 'attachment') {
-            // already in ingestion.file_entries — nothing to add
-            continue;
-          }
-          if (image_source === 'pexels') {
-            const [img] = await pexels_search(spec.query || spec.prompt || page.title, 1);
-            if (!img) continue;
-            image_files.push({
-              path: `/img/${spec.slot}.jpg`,
-              content_b64: img.content_b64,
-              content_type: 'image/jpeg',
-            });
-          } else {
-            const b64 = await create_image(
-              uid,
-              spec.prompt || spec.query || page.title,
-              image_source, // 'gpt-image-1' | 'chatgpt-image-latest'
-              '1024x1024',
-              1,
-              1024,
-              1024, // full-resolution output
-              { kind: 'static_website', slot: spec.slot },
-              account_profile_info,
-            );
-            if (!b64) continue;
-            image_files.push({
-              path: `/img/${spec.slot}.png`,
-              content_b64: b64,
-              content_type: 'image/png',
-            });
-          }
-        } catch (err) {
-          console.error('[generate_site_files] image fail', spec.slot, err.message);
-        }
-      }
-    }
-
-    // 7. SEO files (seo + enterprise tiers only)
-    const seo_files = [];
-    if (plan_tier === 'seo' || plan_tier === 'enterprise') {
-      seo_files.push({
-        path: '/sitemap.xml',
-        content_b64: Buffer.from(_sitemap_xml(plan.pages, hostname), 'utf8').toString('base64'),
-        content_type: 'application/xml',
-      });
-      seo_files.push({
-        path: '/robots.txt',
-        content_b64: Buffer.from(_robots_txt(hostname), 'utf8').toString('base64'),
-        content_type: 'text/plain',
-      });
-    }
-
-    // 8. Compose final flat file list
-    const css_file = {
-      path: '/style.css',
-      content_b64: Buffer.from(css, 'utf8').toString('base64'),
-      content_type: 'text/css',
-    };
-    const files = [css_file, ...html_files, ...image_files, ...seo_files, ...ingestion.file_entries];
-
-    return {
-      code: 1,
-      data: {
-        files,
-        plan,
-        manifest: ingestion.manifest,
-        stats: {
-          page_count: plan.pages.length,
-          image_count: image_files.length,
-          attachment_count: ingestion.file_entries.length,
-        },
-      },
-    };
-  } catch (err) {
-    return { code: -400, data: err.message };
-  }
-};
-
-// ── Modify orchestrator ────────────────────────────────────────────────
-//
-// Loads current files, asks LLM what to change, writes back only the deltas.
-// Image source stays pinned to whatever was chosen at creation - modify does
-// NOT silently upgrade Pexels -> AI (that would surprise free users).
-
-const _modify_prompt = (user_prompt, current_files_index, attachments_manifest) => `You are editing an existing static website. Output STRICT JSON only, no prose, no markdown fences.
-
-User request:
-${user_prompt}
-
-Current file index (path + size + content-type — NOT full content; ask the user to re-attach if you need to read a file's body):
-${JSON.stringify(current_files_index, null, 2)}
-
-New attachments uploaded with this request:
-${JSON.stringify(attachments_manifest, null, 2)}
-
-For each change you want to make, emit one entry in "changes":
-  { "path": "/index.html", "action": "replace", "new_content": "...full new file content..." }
-  { "path": "/about/index.html", "action": "create", "new_content": "..." }
-  { "path": "/old-page/index.html", "action": "delete" }
-
-Image regeneration: emit { "image_change": { "path": "/img/hero.png", "new_prompt": "..." } } and the orchestrator will re-render via the locked image source.
-
-Hard rules:
-- Touch only files you actually need to change. Do NOT rewrite the whole site.
-- new_content for HTML files: full document, DOCTYPE through </html>. Link /style.css unchanged unless explicitly told to restyle.
-- Do NOT change file paths for unchanged pages.
-
-Schema:
-{ "changes": [...], "summary": "one sentence" }
-
-Respond with ONLY the JSON object.`;
-
-export const modify_site_files = async (req) => {
-  try {
-    const { uid, current_files, prompt, attachments, plan_tier, image_source, account_profile_info } = req;
-    if (!uid || !prompt) return { code: -1, data: 'uid + prompt required' };
-    if (!Array.isArray(current_files) || !current_files.length) return { code: -1, data: 'current_files required' };
-
-    const ingestion = await ingest_attachments(attachments || []);
-    const index = current_files.map((f) => ({
-      path: f.path,
-      content_type: f.content_type,
-      size_b64: (f.content_b64 || '').length,
-    }));
-
-    const diff_text = await _chat(uid, _modify_prompt(prompt, index, ingestion.manifest), account_profile_info, { stage: 'static_website_modify', plan_tier });
-    const diff = _safe_json_parse(diff_text);
-    if (!diff || !Array.isArray(diff.changes)) {
-      return { code: -2, data: 'modify JSON malformed', diff_text };
-    }
-
-    const changed_paths = [];
-    const updated_files = [...current_files];
-
-    const _find = (p) => updated_files.findIndex((f) => f.path === p);
-
-    for (const ch of diff.changes) {
-      // Re-rendered image
-      if (ch.image_change && ch.image_change.path && ch.image_change.new_prompt) {
-        const ip = ch.image_change.path;
-        try {
-          if (image_source === 'pexels') {
-            const [img] = await pexels_search(ch.image_change.new_prompt, 1);
-            if (img) {
-              const entry = { path: ip, content_b64: img.content_b64, content_type: 'image/jpeg' };
-              const idx = _find(ip);
-              if (idx >= 0) updated_files[idx] = entry;
-              else updated_files.push(entry);
-              changed_paths.push(ip);
-            }
-          } else {
-            const b64 = await create_image(uid, ch.image_change.new_prompt, image_source, '1024x1024', 1, 1024, 1024, { kind: 'static_website_modify' }, account_profile_info);
-            if (b64) {
-              const entry = { path: ip, content_b64: b64, content_type: 'image/png' };
-              const idx = _find(ip);
-              if (idx >= 0) updated_files[idx] = entry;
-              else updated_files.push(entry);
-              changed_paths.push(ip);
-            }
-          }
-        } catch (err) {
-          console.error('[modify_site_files] image regen fail', ip, err.message);
-        }
-        continue;
-      }
-
-      if (!ch.path || !ch.action) continue;
-      const idx = _find(ch.path);
-
-      if (ch.action === 'delete') {
-        if (idx >= 0) {
-          updated_files.splice(idx, 1);
-          changed_paths.push(ch.path);
-        }
-        continue;
-      }
-
-      if ((ch.action === 'replace' || ch.action === 'create') && typeof ch.new_content === 'string') {
-        const ext = (ch.path.match(/\.([a-z0-9]+)$/i) || [, ''])[1].toLowerCase();
-        const content_type = ext === 'html' ? 'text/html' : ext === 'css' ? 'text/css' : ext === 'js' ? 'application/javascript' : ext === 'json' ? 'application/json' : ext === 'xml' ? 'application/xml' : ext === 'txt' ? 'text/plain' : 'text/plain';
-        const entry = {
-          path: ch.path,
-          content_b64: Buffer.from(ch.new_content, 'utf8').toString('base64'),
-          content_type,
-        };
-        if (idx >= 0) updated_files[idx] = entry;
-        else updated_files.push(entry);
-        changed_paths.push(ch.path);
-      }
-    }
-
-    // Any new attachments uploaded this round join the file set verbatim.
-    for (const entry of ingestion.file_entries) {
-      const idx = _find(entry.path);
-      if (idx >= 0) updated_files[idx] = entry;
-      else updated_files.push(entry);
-      changed_paths.push(entry.path);
-    }
-
-    return {
-      code: 1,
-      data: {
-        updated_files,
-        changed_paths,
-        summary: diff.summary || '',
-      },
-    };
-  } catch (err) {
-    return { code: -400, data: err.message };
-  }
-};