@xuda.io/ai_module 1.1.5645 → 1.1.5646

package/index.mjs

@@ -7279,10 +7279,96 @@ Available CPI methods: ${cpi_tools_ret.selected_methods.join(', ')}${dashboard_s
   }
 };
 
+// ── Cross-tenant agent-tool guard ───────────────────────────────────────────────────────
+// An installed agent loads its plugin from the PUBLISHER's project, and that same context
+// decides where the plugin writes. So a file the user asks an installed agent to build is
+// created in the publisher's drive, in an account the user does not own, cannot browse and
+// cannot delete from. Left unguarded that is a quiet cross-tenant data write.
+//
+// Consent is recorded per (user, agent) rather than per account, because installing a
+// second agent from the same publisher is a separate decision.
+const cross_tenant_consent_id = (uid, agent_id) =>
+  `agconsent_${crypto.createHash('sha256').update(`${uid}|${agent_id}`).digest('hex').slice(0, 32)}`;
+
+const cross_tenant_tool_check = async function ({ uid, tool_uid, tool_app_id, own_app_id, agent_id, agent_name, plugin_id }) {
+  // Same account, or the tool already runs in the caller's own project: nothing to consent
+  // to, this is the ordinary case and must stay zero-friction.
+  if (!tool_uid || tool_uid === uid) return { blocked: false };
+  if (tool_app_id && own_app_id && tool_app_id === own_app_id) return { blocked: false };
+
+  const label = agent_name || agent_id || plugin_id || 'This agent';
+  let owner_name = 'another Xuda account';
+  try {
+    const owner = await db_module.get_couch_doc_native('xuda_accounts', tool_uid);
+    owner_name = owner?.account_info?.name || owner?.account_info?.email || owner_name;
+  } catch (_) { /* the name is decoration; the block does not depend on it */ }
+
+  let granted = false;
+  try {
+    const got = await db_module.get_couch_doc('xuda_sessions', cross_tenant_consent_id(uid, agent_id), true);
+    granted = got?.code >= 0 && got.data?.granted === true && got.data?.tool_uid === tool_uid;
+  } catch (_) { granted = false; }
+
+  if (granted) return { blocked: false };
+
+  console.warn(`[ai_module] cross-tenant tool blocked: uid ${uid} -> ${label} writes into ${tool_uid} (${tool_app_id})`);
+  return {
+    blocked: true,
+    notice: {
+      kind: 'cross_tenant_tool_consent',
+      agent_id,
+      agent_name: label,
+      plugin_id,
+      owner_uid: tool_uid,
+      owner_name,
+      // Plain words, because this is shown to whoever is chatting, not to a developer.
+      message:
+        `"${label}" needs to create files using tools that run in ${owner_name}'s workspace, not yours. ` +
+        `Anything it makes would be stored there, where you cannot manage or delete it. ` +
+        `Approve this agent in its settings if you want it to work that way.`,
+    },
+  };
+};
+
+// Told to the model so it explains the missing capability instead of improvising an excuse
+// or claiming it did the work. Only used on the interactive path: an unattended auto-reply
+// has nobody to ask, so there the tool is simply withheld.
+const consent_instruction = (notices) =>
+  `IMPORTANT: some of your tools are unavailable in this conversation and you must not pretend otherwise.\n` +
+  notices.map((n) => `- ${n.message}`).join('\n') +
+  `\nIf the user asks for something that needs those tools, say plainly that you cannot do it until they approve it, and repeat the reason above. Never claim to have created or saved a file.`;
+
+// Record (or withdraw) the user's decision. Scoped to the caller: a user can only ever
+// consent on their own behalf, never for someone else.
+export const set_agent_tool_consent = async (req) => {
+  try {
+    const agent_id = String(req.agent_id || '').trim();
+    if (!agent_id) throw new Error('agent_id_required');
+    const granted = req.granted === true || req.granted === 'true';
+    const _id = cross_tenant_consent_id(req.uid, agent_id);
+    const existing = await db_module.get_couch_doc('xuda_sessions', _id, true);
+    const doc = existing?.code >= 0 ? existing.data : { _id, docType: 'agent_tool_consent', created_ts: Date.now() };
+    doc.uid = req.uid;
+    doc.agent_id = agent_id;
+    doc.tool_uid = String(req.owner_uid || '') || doc.tool_uid || null;
+    doc.granted = granted;
+    doc.updated_ts = Date.now();
+    await db_module.save_couch_doc('xuda_sessions', doc);
+    console.log(`[ai_module] agent tool consent ${granted ? 'GRANTED' : 'withdrawn'}: uid ${req.uid} agent ${agent_id}`);
+    return { code: 1, data: { agent_id, granted } };
+  } catch (err) {
+    return { code: -1, data: err.message };
+  }
+};
+
 const get_ai_agent_tools = async function ({ ai_agent_doc, agent_id, reference_type, prompt_suggestion_activated, chat_suggestion_activated, gtp_token, uid, account_profile_info, job_id, headers, context, app_id }) {
   let tools = [];
   let tool_resources = {};
   let eligible_agent = true;
+  // Tools withheld this turn because they would write into an account the caller does not
+  // own. Returned so the caller can tell the user what to approve instead of the agent
+  // simply appearing to have lost a capability.
+  const consent_required = [];
 
   const add_xuda_public_website_tool = function ({ name, description, origin, path_prefix }) {
     if (reference_type !== 'ai_agents' && !prompt_suggestion_activated && !chat_suggestion_activated) {
@@ -7862,9 +7948,41 @@ const get_ai_agent_tools = async function ({ ai_agent_doc, agent_id, reference_t
 
         const { plugin_method, type, plugin_id, ...params } = val;
 
+        // An INSTALLED agent runs its plugin in the PUBLISHER's project, because that is
+        // where the plugin package lives. That context also decides where the tool WRITES,
+        // so anything it produces (a deck, a document, a render) lands in the publisher's
+        // drive rather than the drive of the person who asked for it. That is a cross-tenant
+        // write: the user's content ends up in an account they do not own and cannot manage.
+        //
+        // Gate it on explicit, recorded consent. Refusing here rather than deeper down is
+        // deliberate: the tool is never handed to the model, so the agent cannot write first
+        // and ask later.
+        const tool_app_id =
+          ai_agent_doc?.reference_doc?.studio_meta?.shared_from_app_id || ai_agent_doc?.reference_doc?.studio_meta?.installed_from_app_id || account_profile_info.app_id;
+        const tool_uid =
+          ai_agent_doc?.reference_doc?.studio_meta?.shared_from_uid || ai_agent_doc?.reference_doc?.studio_meta?.installed_from_app_uid || uid;
+
+        const cross_tenant = await cross_tenant_tool_check({
+          uid,
+          tool_uid,
+          tool_app_id,
+          own_app_id: account_profile_info.app_id,
+          agent_id: ai_agent_doc?._id || ai_agent_doc?.reference_doc?._id,
+          agent_name: ai_agent_doc?.reference_doc?.properties?.menuName || ai_agent_doc?.agent_name,
+          plugin_id: val.plugin_id,
+        });
+
+        if (cross_tenant.blocked) {
+          // Surfaced to the user through the agent instead of failing silently, and the
+          // tool is withheld for this turn.
+          eligible_agent = false;
+          consent_required.push(cross_tenant.notice);
+          break;
+        }
+
         const plugin_tool = await get_plugin_tool(
-          ai_agent_doc?.reference_doc?.studio_meta?.shared_from_app_id || ai_agent_doc?.reference_doc?.studio_meta?.installed_from_app_id || account_profile_info.app_id,
-          ai_agent_doc?.reference_doc?.studio_meta?.shared_from_uid || ai_agent_doc?.reference_doc?.studio_meta?.installed_from_app_uid || uid,
+          tool_app_id,
+          tool_uid,
           val.plugin_id,
           val.plugin_method,
           params,
@@ -7882,7 +8000,7 @@ const get_ai_agent_tools = async function ({ ai_agent_doc, agent_id, reference_t
     }
   }
 
-  return { tools, tool_resources, eligible_agent, context };
+  return { tools, tool_resources, eligible_agent, context, consent_required };
 };
 
 const load_ai_agent_doc = async function (app_id, agent_id) {
@@ -8266,7 +8384,11 @@ const ai_chat_conversation = async function (req, job_id, headers) {
           const agent_name = `${ai_agent_doc._id}`;
           const agent = new Agent({
             name: agent_name.substring(0, 55),
-            instructions: ai_agent_doc.agentConfig.agent_instructions + (reference_type === 'ai_agents' ? get_agent_instructions() : '') + (context?.has_full_stack_vps ? '\n\n' + get_full_stack_vps_instructions() : ''),
+            instructions:
+              ai_agent_doc.agentConfig.agent_instructions +
+              (reference_type === 'ai_agents' ? get_agent_instructions() : '') +
+              (context?.has_full_stack_vps ? '\n\n' + get_full_stack_vps_instructions() : '') +
+              (tools_ret.consent_required?.length ? '\n\n' + consent_instruction(tools_ret.consent_required) : ''),
             model: resolve_ai_model(model),
             tools,
             metadata: {

package/index_ms.mjs

@@ -25,6 +25,10 @@ export const classify_external_app_scan = async function (...args) {
   return await broker.send_to_queue("classify_external_app_scan", ...args);
 };
 
+export const set_agent_tool_consent = async function (...args) {
+  return await broker.send_to_queue("set_agent_tool_consent", ...args);
+};
+
 export const execute_codex_request = async function (...args) {
   return await broker.send_to_queue("execute_codex_request", ...args);
 };

package/index_msa.mjs

@@ -25,6 +25,10 @@ export const classify_external_app_scan =  function (...args) {
    broker.send_to_queue_async("classify_external_app_scan", ...args);
 };
 
+export const set_agent_tool_consent =  function (...args) {
+   broker.send_to_queue_async("set_agent_tool_consent", ...args);
+};
+
 export const execute_codex_request =  function (...args) {
    broker.send_to_queue_async("execute_codex_request", ...args);
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xuda.io/ai_module",
-  "version": "1.1.5645",
+  "version": "1.1.5646",
   "description": "Xuda AI Module",
   "main": "index.mjs",
   "type": "module",