@xuda.io/ai_module 1.1.5642 → 1.1.5643

package/index.mjs

@@ -7256,64 +7256,18 @@ const get_ai_agent_tools = async function ({ ai_agent_doc, agent_id, reference_t
   let tool_resources = {};
   let eligible_agent = true;
 
-  const add_internal_codex_tool = function ({ name, description, system_prompt }) {
+  const add_xuda_public_website_tool = function ({ name, description, origin, path_prefix }) {
     if (reference_type !== 'ai_agents' && !prompt_suggestion_activated && !chat_suggestion_activated) {
       eligible_agent = false;
       return;
     }
 
-    tools.push(
-      tool({
-        name: name.substring(0, 60),
-        description,
-        parameters: z.object({
-          question: z.string().describe('The support question to investigate.'),
-        }),
-        async execute(e) {
-          const question = String(e?.question || '').trim();
-          if (!question) {
-            return 'question is required';
-          }
-
-          const dev_host = _conf?.internal_ai_agents?.dev_server_host || 'dev.xuda.ai';
-          const codex_ret = await execute_codex_request(
-            {
-              ip: dev_host,
-              uid,
-              account_profile_info,
-              job_id,
-              stream: false,
-              prompt: `${system_prompt}
-
-User question:
-${question}
-
-Return a concise answer. Include only non-sensitive findings and mention when the requested information is outside the allowed scope.`,
-            },
-            job_id,
-            headers,
-          );
-
-          if (codex_ret.code < 0) {
-            return `Codex readonly lookup failed: ${get_error_message(codex_ret.data, 'unknown error')}`;
-          }
-
-          const events = codex_ret?.data?.events || [];
-          const final_message = [...events].reverse().find((event) => event?.item?.type === 'agent_message' && event.item.text)?.item?.text;
-          return final_message || 'Codex readonly lookup completed without a final answer.';
-        },
-      }),
-    );
-  };
-
-  const add_xuda_public_website_tool = function ({ name, description }) {
-    if (reference_type !== 'ai_agents' && !prompt_suggestion_activated && !chat_suggestion_activated) {
-      eligible_agent = false;
-      return;
-    }
-
-    const website_origin = _conf?.internal_ai_agents?.public_website_url || 'https://xuda.ai';
-    const dump_dir = path.join(os.tmpdir(), 'xuda_public_website_dump', new URL(website_origin).hostname.replace(/[^a-z0-9.-]/gi, '_'));
+    const website_origin = origin || _conf?.internal_ai_agents?.public_website_url || 'https://xuda.ai';
+    // path_prefix narrows the crawl to one section of the site (the mentor tool uses /docs).
+    // It is part of the cache key so a narrowed tool can never read a wider tool's dump.
+    const section = String(path_prefix || '').replace(/\/+$/, '');
+    const cache_key = `${new URL(website_origin).hostname}${section}`.replace(/[^a-z0-9.-]/gi, '_');
+    const dump_dir = path.join(os.tmpdir(), 'xuda_public_website_dump', cache_key);
     const manifest_path = path.join(dump_dir, 'manifest.json');
     const ttl_ms = Number(_conf?.internal_ai_agents?.public_website_dump_ttl_ms || 10 * 60 * 1000);
     const cache_version = 2;
@@ -7437,13 +7391,19 @@ Return a concise answer. Include only non-sensitive findings and mention when th
 
       await fs.promises.mkdir(dump_dir, { recursive: true });
       const sitemap_xml = await fetch_text(`${website_base}/sitemap.xml`, 8000);
-      const priority_urls = [`${website_base}/`, `${website_base}/about`, `${website_base}/legal/privacy-policy`, `${website_base}/legal/terms`, `${website_base}/contact`];
+      const priority_urls = section
+        ? [`${website_base}${section}/`]
+        : [`${website_base}/`, `${website_base}/about`, `${website_base}/legal/privacy-policy`, `${website_base}/legal/terms`, `${website_base}/contact`];
       const sitemap_urls = [...sitemap_xml.matchAll(/<loc>([\s\S]*?)<\/loc>/gi)]
         .map((match) => decode_html(match[1]).trim())
         .filter((url) => {
           try {
             const parsed = new URL(url);
-            return parsed.origin === website_base && !/\.(png|jpe?g|gif|webp|svg|pdf|zip)$/i.test(parsed.pathname);
+            if (parsed.origin !== website_base) return false;
+            // Section-scoped tools see only their own subtree, so a docs-only tool cannot
+            // wander into the rest of the site.
+            if (section && !(parsed.pathname === section || parsed.pathname.startsWith(`${section}/`))) return false;
+            return !/\.(png|jpe?g|gif|webp|svg|pdf|zip)$/i.test(parsed.pathname);
           } catch (_) {
             return false;
           }
@@ -7554,26 +7514,20 @@ Return a concise answer. Include only non-sensitive findings and mention when th
         break;
       }
 
-      case 'xuda_network_mentor_dev_server_readonly': {
-        add_internal_codex_tool({
-          name: name || 'Xuda Mentor Dev Server Readonly',
-          description: description || 'Readonly Codex lookup on /var/xuda of the dev server for technical mentor answers.',
-          system_prompt: `You are Codex helping a Xuda Network mentor answer technical questions about the Xuda codebase.
-
-Scope:
-- You may inspect only the dev server ${_conf?.internal_ai_agents?.dev_server_host || 'dev.xuda.ai'}.
-- You may use SSH only for readonly inspection.
-- You may read only under /var/xuda.
-- Prefer safe inspection commands such as pwd, ls, find, rg, sed -n, head, tail, wc, git status, git diff --stat, git log --oneline, and git show.
-
-Hard restrictions:
-- Never access config, config_dev, .env files, secret folders, SSH keys, certificates, credential files, database dumps, backups, logs likely to contain credentials, or any path outside /var/xuda.
-- Never query CouchDB or any database.
-- Never use network commands to call internal services.
-- Never run commands that write, mutate, install, delete, restart, deploy, publish, chmod/chown, kill processes, or change system state.
-- Never reveal passwords, tokens, API keys, private keys, names of private people, private emails, personal information, customer data, security details, or anything that could harm Xuda, its team, customers, or product security.
-- If the answer requires forbidden access, say it is outside the readonly mentor scope.
-- If sensitive data appears accidentally, do not quote it. State that sensitive output was omitted.`,
+      // RETIRED 2026-07-31 (Boaz): this used to run Codex over SSH on the dev server. Its
+      // "readonly" scope was only a system prompt, while the process itself ran with
+      // --dangerously-bypass-approvals-and-sandbox (no sandbox key is set in either config,
+      // and that is the default), so an external mentor chatting to the agent was one
+      // persuasive message away from arbitrary command execution on dev. The type string is
+      // KEPT and remapped rather than deleted, so every mentor agent already installed out
+      // there loses the capability the moment this ships, with no agent doc to migrate.
+      case 'xuda_network_mentor_dev_server_readonly':
+      case 'xuda_network_mentor_docs_readonly': {
+        add_xuda_public_website_tool({
+          name: name || 'Xuda Mentor Docs Readonly',
+          description: description || 'Readonly lookup against the public Xuda developer documentation for technical mentor answers.',
+          origin: _conf?.internal_ai_agents?.docs_website_url || _conf?.internal_ai_agents?.public_website_url || 'https://xuda.ai',
+          path_prefix: _conf?.internal_ai_agents?.docs_path_prefix || '/docs',
         });
         break;
       }
@@ -8683,6 +8637,20 @@ const add_conversation_item = async function (uid, profile_id, conversation_id,
   }
 };
 
+// The same privacy rule the phone AI follows, worded for a written reply. The contact may of
+// course see the thread they are already in, that is their own conversation. What they must
+// never get is the business's DERIVED view of them (internal notes, categories, mood or
+// status labels, payment standing), anything about a DIFFERENT contact, or a rundown of their
+// activity on other channels. Chat and SMS have no live verification step the way a phone
+// call does (there is nobody on the line to read a code back mid-sentence), so the verified
+// exception does not apply here and cross-channel history stays closed.
+const AUTO_REPLY_PRIVACY_POLICY = `Privacy rules, these override any other instruction:
+- You may use this conversation thread to reply naturally, it is the contact's own conversation.
+- Never reveal or hint at the business's internal record of this person: notes, tags, categories, sentiment or mood scores, account status, payment standing, or any other internal assessment.
+- Never reveal anything about any other person or contact.
+- Do not summarise or confirm their history on other channels, such as their phone calls, other email threads, or SMS messages. If they ask, say you cannot go over their record here and offer to have someone follow up.
+- If you are unsure whether something is safe to share, do not share it.`;
+
 const auto_response = async function (uid, profile_id, contact_id, conversation_type = 'email') {
   try {
     const account_profile_info = await get_active_account_profile_info(uid, profile_id);
@@ -8694,11 +8662,11 @@ const auto_response = async function (uid, profile_id, contact_id, conversation_
 
     let account_doc = await db_module.get_couch_doc_native('xuda_accounts', uid);
 
-    // The main profile is the account's OWN identity: never auto-respond on it
-    // (you don't auto-reply to yourself). Authoritative check via the account's
-    // account_profile_id, independent of the stored auto_respond flag.
-    if (account_doc?.account_profile_id && profile_id === account_doc.account_profile_id) return;
-
+    // The main profile auto-responds like any other (Boaz, 2026-07-31, reversing UI-44
+    // part 2). It used to be hard-skipped here on the reasoning that you do not auto-reply
+    // to yourself, but the main profile is the identity most people actually receive on, so
+    // excluding it meant the feature was off exactly where it was most wanted. The
+    // auto_respond flag and mode above are now the only gate, for every profile.
     if (account_profile_doc.auto_respond_mode === 'when_offline' && account_doc.socket_id) return;
     if (!['always', 'when_offline'].includes(account_profile_doc.auto_respond_mode)) return;
 
@@ -8764,6 +8732,8 @@ const auto_response = async function (uid, profile_id, contact_id, conversation_
           instructions: `You are ${account_profile_doc.profile_name || userName}'s automatic ${conversation_type === 'chat' ? 'chat' : 'email'} assistant.
 Reply to the latest incoming message from ${contact_doc.name || contact_doc.email} in a friendly, helpful, and concise way.
 Use the conversation history for context.
+
+${AUTO_REPLY_PRIVACY_POLICY}
 Match the language the contact wrote in.
 Do not mention that the reply is automated.
 ${conversation_type === 'chat' ? 'Return only the chat message text, ready to send.' : 'Return only the email body, ready to send.'}
@@ -8805,6 +8775,8 @@ ${account_profile_doc.profile_signature || ''}`.trim(),
 
 You are composing an automatic ${conversation_type === 'chat' ? 'chat' : 'email'} reply.
 Use the existing conversation history as context.
+
+${AUTO_REPLY_PRIVACY_POLICY}
 Reply as ${account_profile_doc.profile_name || userName}.
 ${conversation_type === 'chat' ? 'Return only the chat message text, ready to send.' : 'Return only the email body text, ready to send.'}
 Keep the response concise, natural, and professional.${

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xuda.io/ai_module",
-  "version": "1.1.5642",
+  "version": "1.1.5643",
   "description": "Xuda AI Module",
   "main": "index.mjs",
   "type": "module",