@xuda.io/ai_module 1.1.5645 → 1.1.5647

package/index.mjs

@@ -7279,10 +7279,96 @@ Available CPI methods: ${cpi_tools_ret.selected_methods.join(', ')}${dashboard_s
   }
 };
 
+// ── Cross-tenant agent-tool guard ───────────────────────────────────────────────────────
+// An installed agent loads its plugin from the PUBLISHER's project, and that same context
+// decides where the plugin writes. So a file the user asks an installed agent to build is
+// created in the publisher's drive, in an account the user does not own, cannot browse and
+// cannot delete from. Left unguarded that is a quiet cross-tenant data write.
+//
+// Consent is recorded per (user, agent) rather than per account, because installing a
+// second agent from the same publisher is a separate decision.
+const cross_tenant_consent_id = (uid, agent_id) =>
+  `agconsent_${crypto.createHash('sha256').update(`${uid}|${agent_id}`).digest('hex').slice(0, 32)}`;
+
+const cross_tenant_tool_check = async function ({ uid, tool_uid, tool_app_id, own_app_id, agent_id, agent_name, plugin_id }) {
+  // Same account, or the tool already runs in the caller's own project: nothing to consent
+  // to, this is the ordinary case and must stay zero-friction.
+  if (!tool_uid || tool_uid === uid) return { blocked: false };
+  if (tool_app_id && own_app_id && tool_app_id === own_app_id) return { blocked: false };
+
+  const label = agent_name || agent_id || plugin_id || 'This agent';
+  let owner_name = 'another Xuda account';
+  try {
+    const owner = await db_module.get_couch_doc_native('xuda_accounts', tool_uid);
+    owner_name = owner?.account_info?.name || owner?.account_info?.email || owner_name;
+  } catch (_) { /* the name is decoration; the block does not depend on it */ }
+
+  let granted = false;
+  try {
+    const got = await db_module.get_couch_doc('xuda_sessions', cross_tenant_consent_id(uid, agent_id), true);
+    granted = got?.code >= 0 && got.data?.granted === true && got.data?.tool_uid === tool_uid;
+  } catch (_) { granted = false; }
+
+  if (granted) return { blocked: false };
+
+  console.warn(`[ai_module] cross-tenant tool blocked: uid ${uid} -> ${label} writes into ${tool_uid} (${tool_app_id})`);
+  return {
+    blocked: true,
+    notice: {
+      kind: 'cross_tenant_tool_consent',
+      agent_id,
+      agent_name: label,
+      plugin_id,
+      owner_uid: tool_uid,
+      owner_name,
+      // Plain words, because this is shown to whoever is chatting, not to a developer.
+      message:
+        `"${label}" needs to create files using tools that run in ${owner_name}'s workspace, not yours. ` +
+        `Anything it makes would be stored there, where you cannot manage or delete it. ` +
+        `Approve this agent in its settings if you want it to work that way.`,
+    },
+  };
+};
+
+// Told to the model so it explains the missing capability instead of improvising an excuse
+// or claiming it did the work. Only used on the interactive path: an unattended auto-reply
+// has nobody to ask, so there the tool is simply withheld.
+const consent_instruction = (notices) =>
+  `IMPORTANT: some of your tools are unavailable in this conversation and you must not pretend otherwise.\n` +
+  notices.map((n) => `- ${n.message}`).join('\n') +
+  `\nIf the user asks for something that needs those tools, say plainly that you cannot do it until they approve it, and repeat the reason above. Never claim to have created or saved a file.`;
+
+// Record (or withdraw) the user's decision. Scoped to the caller: a user can only ever
+// consent on their own behalf, never for someone else.
+export const set_agent_tool_consent = async (req) => {
+  try {
+    const agent_id = String(req.agent_id || '').trim();
+    if (!agent_id) throw new Error('agent_id_required');
+    const granted = req.granted === true || req.granted === 'true';
+    const _id = cross_tenant_consent_id(req.uid, agent_id);
+    const existing = await db_module.get_couch_doc('xuda_sessions', _id, true);
+    const doc = existing?.code >= 0 ? existing.data : { _id, docType: 'agent_tool_consent', created_ts: Date.now() };
+    doc.uid = req.uid;
+    doc.agent_id = agent_id;
+    doc.tool_uid = String(req.owner_uid || '') || doc.tool_uid || null;
+    doc.granted = granted;
+    doc.updated_ts = Date.now();
+    await db_module.save_couch_doc('xuda_sessions', doc);
+    console.log(`[ai_module] agent tool consent ${granted ? 'GRANTED' : 'withdrawn'}: uid ${req.uid} agent ${agent_id}`);
+    return { code: 1, data: { agent_id, granted } };
+  } catch (err) {
+    return { code: -1, data: err.message };
+  }
+};
+
 const get_ai_agent_tools = async function ({ ai_agent_doc, agent_id, reference_type, prompt_suggestion_activated, chat_suggestion_activated, gtp_token, uid, account_profile_info, job_id, headers, context, app_id }) {
   let tools = [];
   let tool_resources = {};
   let eligible_agent = true;
+  // Tools withheld this turn because they would write into an account the caller does not
+  // own. Returned so the caller can tell the user what to approve instead of the agent
+  // simply appearing to have lost a capability.
+  const consent_required = [];
 
   const add_xuda_public_website_tool = function ({ name, description, origin, path_prefix }) {
     if (reference_type !== 'ai_agents' && !prompt_suggestion_activated && !chat_suggestion_activated) {
@@ -7862,9 +7948,41 @@ const get_ai_agent_tools = async function ({ ai_agent_doc, agent_id, reference_t
 
         const { plugin_method, type, plugin_id, ...params } = val;
 
+        // An INSTALLED agent runs its plugin in the PUBLISHER's project, because that is
+        // where the plugin package lives. That context also decides where the tool WRITES,
+        // so anything it produces (a deck, a document, a render) lands in the publisher's
+        // drive rather than the drive of the person who asked for it. That is a cross-tenant
+        // write: the user's content ends up in an account they do not own and cannot manage.
+        //
+        // Gate it on explicit, recorded consent. Refusing here rather than deeper down is
+        // deliberate: the tool is never handed to the model, so the agent cannot write first
+        // and ask later.
+        const tool_app_id =
+          ai_agent_doc?.reference_doc?.studio_meta?.shared_from_app_id || ai_agent_doc?.reference_doc?.studio_meta?.installed_from_app_id || account_profile_info.app_id;
+        const tool_uid =
+          ai_agent_doc?.reference_doc?.studio_meta?.shared_from_uid || ai_agent_doc?.reference_doc?.studio_meta?.installed_from_app_uid || uid;
+
+        const cross_tenant = await cross_tenant_tool_check({
+          uid,
+          tool_uid,
+          tool_app_id,
+          own_app_id: account_profile_info.app_id,
+          agent_id: ai_agent_doc?._id || ai_agent_doc?.reference_doc?._id,
+          agent_name: ai_agent_doc?.reference_doc?.properties?.menuName || ai_agent_doc?.agent_name,
+          plugin_id: val.plugin_id,
+        });
+
+        if (cross_tenant.blocked) {
+          // Surfaced to the user through the agent instead of failing silently, and the
+          // tool is withheld for this turn.
+          eligible_agent = false;
+          consent_required.push(cross_tenant.notice);
+          break;
+        }
+
         const plugin_tool = await get_plugin_tool(
-          ai_agent_doc?.reference_doc?.studio_meta?.shared_from_app_id || ai_agent_doc?.reference_doc?.studio_meta?.installed_from_app_id || account_profile_info.app_id,
-          ai_agent_doc?.reference_doc?.studio_meta?.shared_from_uid || ai_agent_doc?.reference_doc?.studio_meta?.installed_from_app_uid || uid,
+          tool_app_id,
+          tool_uid,
           val.plugin_id,
           val.plugin_method,
           params,
@@ -7882,7 +8000,7 @@ const get_ai_agent_tools = async function ({ ai_agent_doc, agent_id, reference_t
     }
   }
 
-  return { tools, tool_resources, eligible_agent, context };
+  return { tools, tool_resources, eligible_agent, context, consent_required };
 };
 
 const load_ai_agent_doc = async function (app_id, agent_id) {
@@ -8266,7 +8384,11 @@ const ai_chat_conversation = async function (req, job_id, headers) {
           const agent_name = `${ai_agent_doc._id}`;
           const agent = new Agent({
             name: agent_name.substring(0, 55),
-            instructions: ai_agent_doc.agentConfig.agent_instructions + (reference_type === 'ai_agents' ? get_agent_instructions() : '') + (context?.has_full_stack_vps ? '\n\n' + get_full_stack_vps_instructions() : ''),
+            instructions:
+              ai_agent_doc.agentConfig.agent_instructions +
+              (reference_type === 'ai_agents' ? get_agent_instructions() : '') +
+              (context?.has_full_stack_vps ? '\n\n' + get_full_stack_vps_instructions() : '') +
+              (tools_ret.consent_required?.length ? '\n\n' + consent_instruction(tools_ret.consent_required) : ''),
             model: resolve_ai_model(model),
             tools,
             metadata: {
@@ -11163,6 +11285,90 @@ async function normalizeBase64To1024(
   return normalizedBuffer.toString('base64');
 }
 
+// Upload-time content check for a profile picture or a business logo.
+//
+// Deliberately NOT identity verification. It answers "is this the right KIND of
+// image, and is it good enough to use", never "is this the right person". There
+// is no face embedding, no matching against a reference, and nothing about the
+// image is retained — so this does not cross the biometric line drawn in
+// docs/plans/xuda-verify-consent.md, which stays gated on the face-model
+// decision and that document's pre-capture prerequisites. Identity matching is
+// still the unbuilt half of phase 2, see
+// docs/plans/handoff_profile_image_verification.md.
+//
+// The same classification already existed as a private closure inside
+// get_profile_avatar (inspect_person_in_image), but it only ran at AVATAR
+// GENERATION time, which is after verification. Users need the answer while
+// they are still looking at the picker, so it lives here as its own method and
+// covers the business/logo case the original never did.
+export const inspect_profile_picture = async function (req, job_id, headers) {
+  try {
+    const data = req?.data || req || {};
+    const uid = req?.uid;
+    const url = data.url;
+    const account_type = data.account_type === 'business' ? 'business' : 'personal';
+
+    if (!uid) return { code: -401, data: 'not authorized' };
+    if (!url) return { code: -1, data: 'url is required' };
+
+    // Attribution only; a missing profile must not block the check.
+    let account_profile_info;
+    try {
+      account_profile_info = await account_ms.get_active_account_profile_info(uid);
+    } catch (e) {}
+
+    const image_blob_ret = await get_image_blob_from_downloaded_image(url);
+    if (!image_blob_ret?.image_blob) return { code: -1, data: 'could not read that image' };
+    const base64 = Buffer.from(await image_blob_ret.image_blob.arrayBuffer()).toString('base64');
+
+    const is_business = account_type === 'business';
+    const instruction = is_business
+      ? `This image was uploaded as the COMPANY LOGO for a business account. Decide whether it is usable as that logo or brand mark. Reject a photograph of a person, a selfie, a stock photo, a screenshot, a meme, an unrelated object, or an image with no identifiable mark. Also reject it if it is too blurry, too small or too cropped to use.`
+      : `This image was uploaded as a PERSONAL PROFILE PICTURE. Decide whether it is a genuine photograph of a real person, suitable as an authentic account portrait. Reject a company logo, an illustration, a cartoon, an obviously AI-generated render, an object, an animal, a screenshot, or a group shot with no single clear subject. Also reject it if the face is not visible, heavily cropped, very blurry, or too small.`;
+
+    const ret = await submit_chat_gpt_prompt({
+      uid,
+      model: _conf.default_ai_model,
+      prompt: [
+        {
+          role: 'user',
+          content: [
+            { type: 'input_text', text: `${instruction}\n\nBe practical rather than strict: an ordinary phone photo in ordinary lighting is fine. Only reject when a real person would agree it is the wrong kind of image or genuinely unusable.` },
+            { type: 'input_image', image_url: `data:image/png;base64,${base64}` },
+          ],
+        },
+      ],
+      response_format: z.object({
+        acceptable: z.boolean().describe('true only if the image is the right kind AND usable quality'),
+        reason_code: z
+          .string()
+          .describe(
+            'snake_case code. Use ok when acceptable. Otherwise one of: not_a_person, is_a_logo, illustration, ai_generated, object_or_animal, screenshot, multiple_faces, face_not_visible, too_blurry, too_small, too_cropped, not_a_logo, no_clear_mark',
+          ),
+        message: z.string().describe('one short, friendly sentence telling the user what to upload instead. No jargon, no mention of models or scores.'),
+      }),
+      metadata: { func: 'inspect_profile_picture', account_type },
+      account_profile_info,
+    });
+
+    if (ret.code < 0) return ret;
+
+    const res = JSON5.parse(ret.data);
+    return {
+      code: 1,
+      data: {
+        acceptable: Boolean(res?.acceptable),
+        reason_code: res?.reason_code || (res?.acceptable ? 'ok' : 'unusable'),
+        message: res?.message || '',
+        account_type,
+      },
+    };
+  } catch (err) {
+    console.error('[inspect_profile_picture]', err.message);
+    return { code: -1, data: err.message };
+  }
+};
+
 const get_image_blob_from_downloaded_image = async function (url) {
   async function hasTransparentBackground(filePath) {
     const image = sharp(filePath);

package/index_ms.mjs

@@ -25,6 +25,10 @@ export const classify_external_app_scan = async function (...args) {
   return await broker.send_to_queue("classify_external_app_scan", ...args);
 };
 
+export const set_agent_tool_consent = async function (...args) {
+  return await broker.send_to_queue("set_agent_tool_consent", ...args);
+};
+
 export const execute_codex_request = async function (...args) {
   return await broker.send_to_queue("execute_codex_request", ...args);
 };
@@ -237,6 +241,10 @@ export const is_business_contact_has_person = async function (...args) {
   return await broker.send_to_queue("is_business_contact_has_person", ...args);
 };
 
+export const inspect_profile_picture = async function (...args) {
+  return await broker.send_to_queue("inspect_profile_picture", ...args);
+};
+
 export const get_name_from_email_addr = async function (...args) {
   return await broker.send_to_queue("get_name_from_email_addr", ...args);
 };

package/index_msa.mjs

@@ -25,6 +25,10 @@ export const classify_external_app_scan =  function (...args) {
    broker.send_to_queue_async("classify_external_app_scan", ...args);
 };
 
+export const set_agent_tool_consent =  function (...args) {
+   broker.send_to_queue_async("set_agent_tool_consent", ...args);
+};
+
 export const execute_codex_request =  function (...args) {
    broker.send_to_queue_async("execute_codex_request", ...args);
 };
@@ -237,6 +241,10 @@ export const is_business_contact_has_person =  function (...args) {
    broker.send_to_queue_async("is_business_contact_has_person", ...args);
 };
 
+export const inspect_profile_picture =  function (...args) {
+   broker.send_to_queue_async("inspect_profile_picture", ...args);
+};
+
 export const get_name_from_email_addr =  function (...args) {
    broker.send_to_queue_async("get_name_from_email_addr", ...args);
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xuda.io/ai_module",
-  "version": "1.1.5645",
+  "version": "1.1.5647",
   "description": "Xuda AI Module",
   "main": "index.mjs",
   "type": "module",