@xuda.io/ai_module 1.1.5644 → 1.1.5646

package/index.mjs

@@ -345,6 +345,7 @@ const LIST_SORT_PATHS = {
 };
 
 const account_ms = await import(`${module_path}/account_module/index_ms.mjs`);
+const ticket_ms = await import(`${module_path}/ticket_module/index_ms.mjs`);
 const drive_ms = await import(`${module_path}/drive_module/index_ms.mjs`);
 const jobs_ms = await import(`${module_path}/jobs_module/index_ms.mjs`);
 const team_ms = await import(`${module_path}/team_module/index_ms.mjs`);
@@ -4711,7 +4712,7 @@ export const classify_external_app_scan = async (req) => {
   }
 };
 
-// Triage a CPI error incident for the central error resolver (support_module).
+// Triage a CPI error incident for the central error resolver (ticket_module).
 // The Zod schema lives here because zodTextFormat schemas cannot cross the
 // message broker (it JSON-serializes args and strips functions). The resolver
 // passes a plain-JSON { incident, catalog_entry } payload and gets back a plain
@@ -5002,10 +5003,17 @@ const get_error_message = function (err, fallback = 'Unknown error') {
 };
 
 const get_plugin_import_specifier = function (app_id, plugin_name, resource, dev = true) {
-  const absolute_path = dev ? path.join(process.env.XUDA_HOME, 'plugins', plugin_name, resource) : path.join(_conf.plugins_drive_path, app_id, 'node_modules', plugin_name, resource);
+  // `dev` asks for the repo working copy under $XUDA_HOME/plugins, which only
+  // exists on the debug box. Anywhere else (master, the regions) that directory
+  // is absent, so the plugin has to be the npm copy installed into the app's own
+  // plugins folder. Without the is_debug gate every plugin-backed agent tool
+  // resolved to a path that does not exist in production.
+  const use_source = dev && _conf.is_debug;
+  const absolute_path = use_source ? path.join(process.env.XUDA_HOME, 'plugins', plugin_name, resource) : path.join(_conf.plugins_drive_path, app_id, 'node_modules', plugin_name, resource);
 
   const file_url = pathToFileURL(absolute_path);
-  if (dev) {
+  if (use_source) {
+    // Cache-bust so an edit to the working copy is picked up without a restart.
     file_url.searchParams.set('ts', `${Date.now()}`);
   }
 
@@ -7271,10 +7279,96 @@ Available CPI methods: ${cpi_tools_ret.selected_methods.join(', ')}${dashboard_s
   }
 };
 
+// ── Cross-tenant agent-tool guard ───────────────────────────────────────────────────────
+// An installed agent loads its plugin from the PUBLISHER's project, and that same context
+// decides where the plugin writes. So a file the user asks an installed agent to build is
+// created in the publisher's drive, in an account the user does not own, cannot browse and
+// cannot delete from. Left unguarded that is a quiet cross-tenant data write.
+//
+// Consent is recorded per (user, agent) rather than per account, because installing a
+// second agent from the same publisher is a separate decision.
+const cross_tenant_consent_id = (uid, agent_id) =>
+  `agconsent_${crypto.createHash('sha256').update(`${uid}|${agent_id}`).digest('hex').slice(0, 32)}`;
+
+const cross_tenant_tool_check = async function ({ uid, tool_uid, tool_app_id, own_app_id, agent_id, agent_name, plugin_id }) {
+  // Same account, or the tool already runs in the caller's own project: nothing to consent
+  // to, this is the ordinary case and must stay zero-friction.
+  if (!tool_uid || tool_uid === uid) return { blocked: false };
+  if (tool_app_id && own_app_id && tool_app_id === own_app_id) return { blocked: false };
+
+  const label = agent_name || agent_id || plugin_id || 'This agent';
+  let owner_name = 'another Xuda account';
+  try {
+    const owner = await db_module.get_couch_doc_native('xuda_accounts', tool_uid);
+    owner_name = owner?.account_info?.name || owner?.account_info?.email || owner_name;
+  } catch (_) { /* the name is decoration; the block does not depend on it */ }
+
+  let granted = false;
+  try {
+    const got = await db_module.get_couch_doc('xuda_sessions', cross_tenant_consent_id(uid, agent_id), true);
+    granted = got?.code >= 0 && got.data?.granted === true && got.data?.tool_uid === tool_uid;
+  } catch (_) { granted = false; }
+
+  if (granted) return { blocked: false };
+
+  console.warn(`[ai_module] cross-tenant tool blocked: uid ${uid} -> ${label} writes into ${tool_uid} (${tool_app_id})`);
+  return {
+    blocked: true,
+    notice: {
+      kind: 'cross_tenant_tool_consent',
+      agent_id,
+      agent_name: label,
+      plugin_id,
+      owner_uid: tool_uid,
+      owner_name,
+      // Plain words, because this is shown to whoever is chatting, not to a developer.
+      message:
+        `"${label}" needs to create files using tools that run in ${owner_name}'s workspace, not yours. ` +
+        `Anything it makes would be stored there, where you cannot manage or delete it. ` +
+        `Approve this agent in its settings if you want it to work that way.`,
+    },
+  };
+};
+
+// Told to the model so it explains the missing capability instead of improvising an excuse
+// or claiming it did the work. Only used on the interactive path: an unattended auto-reply
+// has nobody to ask, so there the tool is simply withheld.
+const consent_instruction = (notices) =>
+  `IMPORTANT: some of your tools are unavailable in this conversation and you must not pretend otherwise.\n` +
+  notices.map((n) => `- ${n.message}`).join('\n') +
+  `\nIf the user asks for something that needs those tools, say plainly that you cannot do it until they approve it, and repeat the reason above. Never claim to have created or saved a file.`;
+
+// Record (or withdraw) the user's decision. Scoped to the caller: a user can only ever
+// consent on their own behalf, never for someone else.
+export const set_agent_tool_consent = async (req) => {
+  try {
+    const agent_id = String(req.agent_id || '').trim();
+    if (!agent_id) throw new Error('agent_id_required');
+    const granted = req.granted === true || req.granted === 'true';
+    const _id = cross_tenant_consent_id(req.uid, agent_id);
+    const existing = await db_module.get_couch_doc('xuda_sessions', _id, true);
+    const doc = existing?.code >= 0 ? existing.data : { _id, docType: 'agent_tool_consent', created_ts: Date.now() };
+    doc.uid = req.uid;
+    doc.agent_id = agent_id;
+    doc.tool_uid = String(req.owner_uid || '') || doc.tool_uid || null;
+    doc.granted = granted;
+    doc.updated_ts = Date.now();
+    await db_module.save_couch_doc('xuda_sessions', doc);
+    console.log(`[ai_module] agent tool consent ${granted ? 'GRANTED' : 'withdrawn'}: uid ${req.uid} agent ${agent_id}`);
+    return { code: 1, data: { agent_id, granted } };
+  } catch (err) {
+    return { code: -1, data: err.message };
+  }
+};
+
 const get_ai_agent_tools = async function ({ ai_agent_doc, agent_id, reference_type, prompt_suggestion_activated, chat_suggestion_activated, gtp_token, uid, account_profile_info, job_id, headers, context, app_id }) {
   let tools = [];
   let tool_resources = {};
   let eligible_agent = true;
+  // Tools withheld this turn because they would write into an account the caller does not
+  // own. Returned so the caller can tell the user what to approve instead of the agent
+  // simply appearing to have lost a capability.
+  const consent_required = [];
 
   const add_xuda_public_website_tool = function ({ name, description, origin, path_prefix }) {
     if (reference_type !== 'ai_agents' && !prompt_suggestion_activated && !chat_suggestion_activated) {
@@ -7854,9 +7948,41 @@ const get_ai_agent_tools = async function ({ ai_agent_doc, agent_id, reference_t
 
         const { plugin_method, type, plugin_id, ...params } = val;
 
+        // An INSTALLED agent runs its plugin in the PUBLISHER's project, because that is
+        // where the plugin package lives. That context also decides where the tool WRITES,
+        // so anything it produces (a deck, a document, a render) lands in the publisher's
+        // drive rather than the drive of the person who asked for it. That is a cross-tenant
+        // write: the user's content ends up in an account they do not own and cannot manage.
+        //
+        // Gate it on explicit, recorded consent. Refusing here rather than deeper down is
+        // deliberate: the tool is never handed to the model, so the agent cannot write first
+        // and ask later.
+        const tool_app_id =
+          ai_agent_doc?.reference_doc?.studio_meta?.shared_from_app_id || ai_agent_doc?.reference_doc?.studio_meta?.installed_from_app_id || account_profile_info.app_id;
+        const tool_uid =
+          ai_agent_doc?.reference_doc?.studio_meta?.shared_from_uid || ai_agent_doc?.reference_doc?.studio_meta?.installed_from_app_uid || uid;
+
+        const cross_tenant = await cross_tenant_tool_check({
+          uid,
+          tool_uid,
+          tool_app_id,
+          own_app_id: account_profile_info.app_id,
+          agent_id: ai_agent_doc?._id || ai_agent_doc?.reference_doc?._id,
+          agent_name: ai_agent_doc?.reference_doc?.properties?.menuName || ai_agent_doc?.agent_name,
+          plugin_id: val.plugin_id,
+        });
+
+        if (cross_tenant.blocked) {
+          // Surfaced to the user through the agent instead of failing silently, and the
+          // tool is withheld for this turn.
+          eligible_agent = false;
+          consent_required.push(cross_tenant.notice);
+          break;
+        }
+
         const plugin_tool = await get_plugin_tool(
-          ai_agent_doc?.reference_doc?.studio_meta?.shared_from_app_id || ai_agent_doc?.reference_doc?.studio_meta?.installed_from_app_id || account_profile_info.app_id,
-          ai_agent_doc?.reference_doc?.studio_meta?.shared_from_uid || ai_agent_doc?.reference_doc?.studio_meta?.installed_from_app_uid || uid,
+          tool_app_id,
+          tool_uid,
           val.plugin_id,
           val.plugin_method,
           params,
@@ -7874,7 +8000,7 @@ const get_ai_agent_tools = async function ({ ai_agent_doc, agent_id, reference_t
     }
   }
 
-  return { tools, tool_resources, eligible_agent, context };
+  return { tools, tool_resources, eligible_agent, context, consent_required };
 };
 
 const load_ai_agent_doc = async function (app_id, agent_id) {
@@ -8258,7 +8384,11 @@ const ai_chat_conversation = async function (req, job_id, headers) {
           const agent_name = `${ai_agent_doc._id}`;
           const agent = new Agent({
             name: agent_name.substring(0, 55),
-            instructions: ai_agent_doc.agentConfig.agent_instructions + (reference_type === 'ai_agents' ? get_agent_instructions() : '') + (context?.has_full_stack_vps ? '\n\n' + get_full_stack_vps_instructions() : ''),
+            instructions:
+              ai_agent_doc.agentConfig.agent_instructions +
+              (reference_type === 'ai_agents' ? get_agent_instructions() : '') +
+              (context?.has_full_stack_vps ? '\n\n' + get_full_stack_vps_instructions() : '') +
+              (tools_ret.consent_required?.length ? '\n\n' + consent_instruction(tools_ret.consent_required) : ''),
             model: resolve_ai_model(model),
             tools,
             metadata: {
@@ -9112,7 +9242,9 @@ const run_plugin = async function (app_id, uid, plugin_name, method, prop_data,
     const fields = await get_fields_data(methods[method].fields, prop_data);
     const params = fields;
     const env = { couch, app_id, uid, userName, agent_info };
-    const setup_doc = plugin_doc.setup || { OPENAI_API_KEY: _conf.OPENAI_API_KEY };
+    // Platform credentials come from the box's secrets at call time, never from
+    // the plugin package or a stored per-app copy. See with_platform_plugin_secrets.
+    const setup_doc = _common.with_platform_plugin_secrets(plugin_doc.setup);
 
     ///////////////////////
     const execute_server_script = async function (req, app_id_reference, server_script, method, params, setup_doc) {
@@ -9237,7 +9369,9 @@ const get_plugin_tool = async function (app_id, uid, plugin_name, method, prop_d
     const fields = await get_fields_data(_method.fields, prop_data);
     const params = fields;
     const env = { couch, app_id, uid, userName, agent_info, account_profile_obj };
-    const setup_doc = plugin_doc.setup || { OPENAI_API_KEY: _conf.OPENAI_API_KEY };
+    // Platform credentials come from the box's secrets at call time, never from
+    // the plugin package or a stored per-app copy. See with_platform_plugin_secrets.
+    const setup_doc = _common.with_platform_plugin_secrets(plugin_doc.setup);
 
     ///////////////////////
     const execute_server_script = async function (req, app_id_reference, server_script, method, params, setup_doc) {
@@ -17407,7 +17541,40 @@ export const contact_form_submit = async function (req, job_id, headers) {
         const body_parts = [message];
         const detail_bits = [phone && `Phone: ${phone}`, company && `Company: ${company}`].filter(Boolean);
         if (detail_bits.length) body_parts.push(detail_bits.join(' | '));
-        await _contact_form_create_ticket(account_profile_info, contact_id, subject, body_parts.join('\n\n'), origin);
+        const _conv = await _contact_form_create_ticket(account_profile_info, contact_id, subject, body_parts.join('\n\n'), origin);
+
+        // Source 6 of docs/plans/xuda-tickets.md. The conversation above stays the
+        // human-readable thread and the contact mirror; this ALSO files the uniform
+        // ticket so a contact-form submission shows up in the Tickets manager next
+        // to every other source, with the same status, topic, action and SLA. Best
+        // effort on purpose: the visitor already has their conversation, so a
+        // ticketing failure must never fail the submission.
+        try {
+          const _tk = await ticket_ms.ticket_submit({
+            source: 'profile_contact_form',
+            channel: 'form',
+            owner_uid: account_profile_info.uid,
+            owner_profile_id: account_profile_info.account_profile_id,
+            name,
+            email,
+            phone,
+            company,
+            subject,
+            details: body_parts.join('\n\n'),
+            origin: String(origin || '').slice(0, 200),
+          });
+          // Link both ways so the manager can jump to the thread and vice versa.
+          if (_tk?.code > 0 && _tk.data?._id && _conv?._id) {
+            const _c = await db_module.get_app_couch_doc(account_profile_info.app_id, _conv._id);
+            if (_c.code > -1 && _c.data) {
+              _c.data.ticket_id = _tk.data._id;
+              _c.data.ticket_no = _tk.data.ticket_no;
+              await db_module.save_app_couch_doc(account_profile_info.app_id, _c.data);
+            }
+          }
+        } catch (tk_err) {
+          console.warn('[contact_form] uniform ticket not filed:', tk_err.message);
+        }
 
         // Owner notification email (platform template).
         if (config.notify_email !== false) {

package/index_ms.mjs

@@ -25,6 +25,10 @@ export const classify_external_app_scan = async function (...args) {
   return await broker.send_to_queue("classify_external_app_scan", ...args);
 };
 
+export const set_agent_tool_consent = async function (...args) {
+  return await broker.send_to_queue("set_agent_tool_consent", ...args);
+};
+
 export const execute_codex_request = async function (...args) {
   return await broker.send_to_queue("execute_codex_request", ...args);
 };

package/index_msa.mjs

@@ -25,6 +25,10 @@ export const classify_external_app_scan =  function (...args) {
    broker.send_to_queue_async("classify_external_app_scan", ...args);
 };
 
+export const set_agent_tool_consent =  function (...args) {
+   broker.send_to_queue_async("set_agent_tool_consent", ...args);
+};
+
 export const execute_codex_request =  function (...args) {
    broker.send_to_queue_async("execute_codex_request", ...args);
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xuda.io/ai_module",
-  "version": "1.1.5644",
+  "version": "1.1.5646",
   "description": "Xuda AI Module",
   "main": "index.mjs",
   "type": "module",