bunnyquery 1.9.1 → 1.9.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bunnyquery",
-  "version": "1.9.1",
+  "version": "1.9.5",
   "description": "Embeddable BunnyQuery AI chat widget + its framework-agnostic chat engine",
   "main": "bunnyquery.js",
   "exports": {

package/src/engine/history.ts

@@ -323,7 +323,34 @@ export type SplitHistoryResult = {
 };
 
 export async function getSplitChatHistory(
-	params: { service: string; owner: string; platform: 'claude' | 'openai'; userId?: string },
+	params: {
+		service: string;
+		owner: string;
+		platform: 'claude' | 'openai';
+		userId?: string;
+		/**
+		 * Scope the SURFACE fetch to this chat's own queue instead of "everything
+		 * that is not the bg queue".
+		 *
+		 * Set for an ANONYMOUS visitor, and only for one. The backend identifies an
+		 * unauthenticated caller as `ip + "(" + user_agent + ")"`, and the default
+		 * surface fetch (queue_exclude, no queue) is scoped by exactly that string
+		 * server side - so two anonymous visitors behind one NAT on the same browser
+		 * build read each other's transcript, which is the thing per-device history
+		 * exists to prevent. Reading the device's own queue instead scopes it by a
+		 * value the client controls and the other device does not share.
+		 *
+		 * NOT used for a signed-in caller. Their turns are already scoped by their
+		 * `sub`, and queue_exact would additionally hide any history sent under a
+		 * different queue name than the current userId (an older fallback, a
+		 * pre-rename row), which queue_exclude still returns.
+		 *
+		 * The queue name is unguessable but NOT secret: it travels on every request
+		 * and queue listings are not user-scoped server side. Anonymous transcripts
+		 * are non-confidential by construction.
+		 */
+		scopeSurfaceToQueue?: boolean;
+	},
 	fetchOptions: Record<string, any>,
 	/** Test seam: replaces getChatHistory. Not for production callers. */
 	_fetchImpl?: typeof getChatHistory,
@@ -345,7 +372,34 @@ export async function getSplitChatHistory(
 
 async function _getSplitChatHistoryLocked(
 	key: string,
-	params: { service: string; owner: string; platform: 'claude' | 'openai'; userId?: string },
+	params: {
+		service: string;
+		owner: string;
+		platform: 'claude' | 'openai';
+		userId?: string;
+		/**
+		 * Scope the SURFACE fetch to this chat's own queue instead of "everything
+		 * that is not the bg queue".
+		 *
+		 * Set for an ANONYMOUS visitor, and only for one. The backend identifies an
+		 * unauthenticated caller as `ip + "(" + user_agent + ")"`, and the default
+		 * surface fetch (queue_exclude, no queue) is scoped by exactly that string
+		 * server side - so two anonymous visitors behind one NAT on the same browser
+		 * build read each other's transcript, which is the thing per-device history
+		 * exists to prevent. Reading the device's own queue instead scopes it by a
+		 * value the client controls and the other device does not share.
+		 *
+		 * NOT used for a signed-in caller. Their turns are already scoped by their
+		 * `sub`, and queue_exact would additionally hide any history sent under a
+		 * different queue name than the current userId (an older fallback, a
+		 * pre-rename row), which queue_exclude still returns.
+		 *
+		 * The queue name is unguessable but NOT secret: it travels on every request
+		 * and queue listings are not user-scoped server side. Anonymous transcripts
+		 * are non-confidential by construction.
+		 */
+		scopeSurfaceToQueue?: boolean;
+	},
 	fetchOptions: Record<string, any>,
 	releaseLock: () => void,
 	_fetchImpl?: typeof getChatHistory,
@@ -353,6 +407,14 @@ async function _getSplitChatHistoryLocked(
 	const fetch = _fetchImpl || getChatHistory;
 	const bgQueue = bgIndexingQueueName(params.userId, params.service);
 	const base = { service: params.service, owner: params.owner, platform: params.platform };
+	// What the SURFACE (non-background) fetch filters on. `queue_exclude` is the
+	// default and returns every row that is not on the bg chain; the anonymous
+	// path narrows to this chat's OWN queue instead. Same queue name the chat
+	// turns are dispatched under (requests.ts `queue: userId || service`), so the
+	// two cannot drift.
+	const surfaceScope: Record<string, any> = params.scopeSurfaceToQueue && params.userId
+		? { queue: params.userId, queue_exact: true }
+		: { queue_exclude: bgQueue };
 	const fetchMore = !!(fetchOptions && fetchOptions.fetchMore);
 	const limit = fetchOptions && fetchOptions.limit;
 
@@ -404,14 +466,14 @@ async function _getSplitChatHistoryLocked(
 		} else {
 			const sOpts: any = { fetchMore };
 			if (limit) sOpts.limit = limit;
-			let s = await fetch({ ...base, queue_exclude: bgQueue }, sOpts);
+			let s = await fetch({ ...base, ...surfaceScope }, sOpts);
 			// Loop past empty-but-not-end pages (see SURFACE_EMPTY_MAX_PAGES).
 			let hops = 0;
 			while (s && !s.endOfList && !((s.list || []).length) && hops < SURFACE_EMPTY_MAX_PAGES) {
 				hops++;
 				const nOpts: any = { fetchMore: true };
 				if (limit) nOpts.limit = limit;
-				s = await fetch({ ...base, queue_exclude: bgQueue }, nOpts);
+				s = await fetch({ ...base, ...surfaceScope }, nOpts);
 			}
 			state.pendingSurface = {
 				list: (s && Array.isArray(s.list)) ? s.list : [],
@@ -588,9 +650,53 @@ async function _getSplitChatHistoryLocked(
 }
 
 
+/**
+ * THE chat key. Every cache, every ownership stamp and every "is this turn for
+ * the chat on screen?" comparison is built here and nowhere else.
+ *
+ * It used to be written out by hand in four places. When a third segment was
+ * added for the chat identity - a browser can hold an anonymous conversation and
+ * a signed-in one on the SAME project, and the two must not share a cache - only
+ * one of those four was updated. The rest kept producing the two-segment form,
+ * so `key !== getHistoryCacheKey()` became permanently true: every send was
+ * treated as belonging to another project, the optimistic bubble and the
+ * "Thinking..." placeholder were never pushed, and nothing appeared until the
+ * server history caught up. One function, so a twin cannot drift again.
+ */
+export function chatCacheKey(
+	projectId: string | undefined,
+	platform: string | undefined,
+	userId?: string,
+): string {
+	if (!projectId || platform === 'none') return '';
+	return projectId + '#' + platform + '#' + (userId || '');
+}
+
+/**
+ * The INDEXING scope key: project + platform, deliberately WITHOUT the identity.
+ *
+ * Claiming, stopping and cancelling a file's indexing are scoped per project and
+ * platform because a storage path is project-relative and one ChatSession serves
+ * every project. They are NOT per user: an anonymous visitor cannot upload or
+ * index at all, so there is no second identity to separate, and folding the
+ * identity in here would only have to be threaded through BgTaskEntry to no end.
+ *
+ * Kept separate from chatCacheKey ON PURPOSE. These two were the same string
+ * once, which is exactly how adding a segment to one silently broke the other.
+ */
+export function indexScopeKey(
+	projectId: string | undefined,
+	platform: string | undefined,
+): string {
+	if (!projectId || platform === 'none') return '';
+	return projectId + '#' + platform;
+}
+
 export type MapHistoryOptions = {
 	clearedAt: number;
 	projectId: string;
+	/** Chat identity, so the `_ownerKey` stamp matches chatCacheKey(). */
+	userId?: string;
 	/** View-side display formatter for "Indexing:/Reindexing: …" bubbles. */
 	formatIndexingLabel: (name: string, mime?: string, size?: number | null, storagePath?: string, reindex?: boolean, continued?: boolean) => string;
 };
@@ -728,7 +834,7 @@ export function mapHistoryListToMessages(list: any[], platform: 'claude' | 'open
 	// unchallenged. That is what let one project's transcript survive on screen
 	// into another project and be persisted under its key.
 	if (opts.projectId) {
-		var ownerKey = opts.projectId + '#' + platform;
+		var ownerKey = chatCacheKey(opts.projectId, platform, opts.userId);
 		for (var oi = 0; oi < mapped.length; oi++) mapped[oi]._ownerKey = ownerKey;
 	}
 	return { messages: mapped, runningItemIds: runningItemIds };

package/src/engine/host.ts

@@ -20,6 +20,19 @@ export interface ChatIdentity {
 	owner: string;
 	/** Per-user queue name (falls back to projectId). */
 	userId: string;
+	/**
+	 * This chat is being used by a visitor with NO account, on a project whose
+	 * owner allows that.
+	 *
+	 * It changes where the MCP tools point. A signed-in turn goes to the MCP
+	 * server's root endpoint and authenticates with the caller's own token; an
+	 * anonymous turn has no token to send, and an EMPTY one is worse than none
+	 * (the server cannot identify a project from it, and an empty credential may
+	 * be rejected by the provider before the request is even made). So an
+	 * anonymous turn goes to the project-scoped endpoint instead, which is
+	 * read-only, restricted to public records, and needs no credential at all.
+	 */
+	anonymous?: boolean;
 	platform: 'claude' | 'openai' | 'none';
 	model?: string;
 	serviceName?: string;
@@ -250,6 +263,22 @@ export interface ChatHost {
 	 * whichever pass got there first created the record and the others hoped it had.
 	 */
 	ensureFileIndexRecord?(storagePath: string, meta?: { name?: string; mime?: string; size?: number }): Promise<any>;
+	/**
+	 * The access group this file's records must be written at: the uploader's
+	 * choice, which is the project default or a per-upload answer.
+	 *
+	 * Asked PER FILE, and asked AFTER ensureFileIndexRecord has run, because the
+	 * host is what actually creates the "src::" record and it must report the
+	 * group it really used. The engine threads the answer into the indexing
+	 * prompts so the agent's own records land in the same group; a record saved
+	 * under a different group is in a different table and never comes back with
+	 * the rest of the file.
+	 *
+	 * Optional and may return a promise. A host without it (or one that returns
+	 * nothing) gets "authorized", which is what every record used before the
+	 * setting existed.
+	 */
+	uploadAccessGroup?(storagePath: string): 'public' | 'authorized' | 'private' | undefined | Promise<'public' | 'authorized' | 'private' | undefined>;
 	/** Map a relative path to the consumer's db storage key (e.g. uid-prefixed). */
 	storagePathFor(relPath: string): string;
 	getMimeType(name: string): string | null;

package/src/engine/index.ts

@@ -81,6 +81,11 @@ export {
 	__resetSplitHistoryState,
 	type IndexingRequestRef,
 	type MapHistoryOptions,
+	// THE two key builders. Exported so a consumer (and a test) can assert the
+	// shape rather than rebuild it: a hand-built twin drifting out of step with
+	// getHistoryCacheKey is what stopped the chat rendering sent messages.
+	chatCacheKey,
+	indexScopeKey,
 } from './history';
 
 // Older history is reachable only by scrolling to the top of the message box, so

package/src/engine/prompts/chat_system_prompt.ts

@@ -36,16 +36,35 @@ export type ChatSystemPromptParams = {
 	 * given when the caller says which one this is.
 	 */
 	client?: 'console' | 'widget';
+	/**
+	 * The access group THIS project's indexer writes its records at, from the
+	 * project's `default_access_group` setting.
+	 *
+	 * The MCP auto-fills an index/tag query that names a table but no group with
+	 * "authorized", which used to be right because every BunnyQuery record was
+	 * hardcoded to it. Now a project can index at "public" (so an anonymous
+	 * visitor can read it) or "private", and on those projects the auto-fill
+	 * silently searches a group the data is not in and answers "nothing found".
+	 * Defaults to 'authorized', which is what an unset project still uses.
+	 */
+	indexAccessGroup?: string;
 };
 
 export function buildChatSystemPrompt(params: ChatSystemPromptParams): string {
 	const { projectId, serviceName, serviceDescription, greeting, canUpload, client } = params;
+	// Rendered as the model would have to WRITE it in a tool call: the named
+	// aliases go in quotes, a raw group number does not.
+	const g = params.indexAccessGroup;
+	const indexGroupLiteral =
+		typeof g === 'number' ? String(g)
+		: (g === 'public' || g === 'private' || g === 'authorized' || g === 'admin') ? `"${g}"`
+		: '"authorized"';
 
 	let systemPrompt = `
 You are a dedicated assistant for the project ID: "${projectId}".
 Scope: Only answer questions about this project and its data. Do not answer questions about other projects or topics unrelated to this project. When the user refers to "my database", "my data", or "my files", treat those as references to this project's database and file storage. The ONE exception is BunnyQuery itself - what this app is, what it can do, and how to use it - which is always in scope: answer it from the "About BunnyQuery" section at the end of this prompt.
 Knowledge lookup: Before saying you don't know or that something isn't in the chat history, ALWAYS query this project's database through the available MCP tools to look for the answer. The user's data is the source of truth - the chat transcript is not. Only respond with "I don't know" or "I couldn't find that" after you have actually searched the project's data and come back empty.
-Complete answers over stored data: The database holds one record per spreadsheet row, and each uploaded file becomes many records. ONE file is routinely SPLIT ACROSS SEVERAL TABLES - a summary row in one table, its page or row content in another, its extracted photos and other media in "__MEDIA__", and the indexer often invents a differently-named table on each pass. An index or tag filter matches inside ONE table only and requires table_name: on getRecords, an index or tag sent with table_name but no access_group is auto-filled with access_group "authorized" (where the indexer writes; pass access_group explicitly, including 0, to search another group), while an index or tag WITHOUT table_name FAILS with an error instead of answering, so read the error rather than guessing. Reference is the exception: reference ALONE spans EVERY table and EVERY access group, so getRecords with reference "src::<the file's storage path>" is the one call that returns a whole file's records wherever the indexer put them. Adding table_name narrows it to that table; access_group WITHOUT table_name fails with '"table" is required'; table_name on its own returns that whole table across all access groups. For anything NOT scoped to a single file, call getTables FIRST, run the query once per table that could hold the answer, and combine the results. For any request that counts, sums, totals, lists every match, compares across records, finds which one, or asks whether something is present or ABSENT (for example "how many", "total spent", "which card", "is there any", "없어?", "하나도 없나?"), you MUST read the COMPLETE matching set before answering. Query with fetch_all set to true, or page through getToolResponsePage until pagination.complete is true, across EVERY table and EVERY relevant file. A single default query returns only the first page (about 50 records). That is a SAMPLE. Never treat it as the whole dataset. If you already answered from one table and then realise another table holds more, do not simply apologise: re-run the sweep and give the complete answer.
+Complete answers over stored data: The database holds one record per spreadsheet row, and each uploaded file becomes many records. ONE file is routinely SPLIT ACROSS SEVERAL TABLES - a summary row in one table, its page or row content in another, its extracted photos and other media in "__MEDIA__", and the indexer often invents a differently-named table on each pass. An index or tag filter matches inside ONE table only and requires table_name: on getRecords, an index or tag sent with table_name but no access_group is auto-filled with access_group "authorized", but THIS project indexes at access_group ${indexGroupLiteral}, so pass access_group ${indexGroupLiteral} EXPLICITLY on every index or tag query here - the auto-fill would search a group this project's data is not in and come back empty. Files uploaded before the project's setting changed may sit at another group, so when a scoped query comes back empty, retry it across the other groups (0, 1, "private") before concluding there is nothing, while an index or tag WITHOUT table_name FAILS with an error instead of answering, so read the error rather than guessing. Reference is the exception: reference ALONE spans EVERY table and EVERY access group, so getRecords with reference "src::<the file's storage path>" is the one call that returns a whole file's records wherever the indexer put them. Adding table_name narrows it to that table; access_group WITHOUT table_name fails with '"table" is required'; table_name on its own returns that whole table across all access groups. For anything NOT scoped to a single file, call getTables FIRST, run the query once per table that could hold the answer, and combine the results. For any request that counts, sums, totals, lists every match, compares across records, finds which one, or asks whether something is present or ABSENT (for example "how many", "total spent", "which card", "is there any", "없어?", "하나도 없나?"), you MUST read the COMPLETE matching set before answering. Query with fetch_all set to true, or page through getToolResponsePage until pagination.complete is true, across EVERY table and EVERY relevant file. A single default query returns only the first page (about 50 records). That is a SAMPLE. Never treat it as the whole dataset. If you already answered from one table and then realise another table holds more, do not simply apologise: re-run the sweep and give the complete answer.
 Never assert absence from a partial read. Do not say "there is no X", "none", "not found", or "아니요, 없습니다" until a complete scan has come back empty. If you have not finished scanning every relevant table and file, keep querying instead of guessing. A confident "no" that later turns out wrong is worse than telling the user you are still checking.
 Embedded values: a search term is often stored inside a larger string. A merchant "BAKSA" appears as "DNH*BAKSA#4070277042", and a card as "5860****5173". Server-side index filters match only exact values, leading prefixes, or trailing suffixes, and tag filters only EXACT whole-tag values - never a partial or interior substring - so filtering on such a field silently drops rows. When the value you are looking for may be embedded, do not trust a narrow filter to be complete. Fetch the full set with fetch_all and match the substring yourself.
 File attachments: When a user message contains an "Attached files:" section with markdown links, those links point to short-lived signed URLs in this project's db storage and will expire.

package/src/engine/prompts/index.ts

@@ -9,6 +9,7 @@ export { buildChatSystemPrompt, type ChatSystemPromptParams } from './chat_syste
 export { buildIndexingSystemPrompt, type IndexingSystemPromptParams } from './indexing_system_prompt';
 export {
 	buildIndexingUserMessage,
+	indexingAccessGroup,
 	buildIndexingContinueMessage,
 	buildIndexingRenderMessage,
 	buildIndexingRenderContinueTemplate,

package/src/engine/prompts/indexing_system_prompt.ts

@@ -14,10 +14,21 @@ export type IndexingSystemPromptParams = {
 	serviceName?: string;
 	/** Project description. When present, name + description are appended. */
 	serviceDescription?: string;
+	/**
+	 * Access group every record written during this run must carry. Chosen by the
+	 * uploader (project default, or a per-upload prompt) and already applied to
+	 * the "src::" file record before indexing starts. Defaults to "authorized",
+	 * which is what every record written before this setting existed used.
+	 */
+	accessGroup?: 'public' | 'authorized' | 'private';
 };
 
 export function buildIndexingSystemPrompt(params: IndexingSystemPromptParams): string {
 	const { projectId, serviceName, serviceDescription } = params;
+	const accessGroup =
+		params.accessGroup === 'public' || params.accessGroup === 'private'
+			? params.accessGroup
+			: 'authorized';
 
 	let systemPrompt =
 `You are a background indexing agent for project ${projectId}.
@@ -28,7 +39,8 @@ export function buildIndexingSystemPrompt(params: IndexingSystemPromptParams): s
 - VISION: when the message (a readFileContent window, an embedded PDF page, or an inline attachment) includes IMAGES - scanned/rendered PDF pages, or photos embedded in a spreadsheet next to a row/block - LOOK at them and capture what they show as record data (the reading/values in a scanned table, the part/defect/condition visible in a photo). The image IS part of the data; correlate each photo with its labelled block ("PHOTO A3" markers tie a photo to that grid row).
 - TRANSCRIBE, DO NOT DESCRIBE. When an image contains ANY text - a label, tag, stamp, form field, serial/part number, handwriting - your FIRST job is to read the characters out and store them VERBATIM, not to describe the scene. A record saying "a red inspection tag with handwritten markings" is worthless: it is unsearchable and every such photo produces the same sentence. Put the characters you can actually read into these EXACT fields, not variations of them: "printed_text" (the pre-printed wording), "handwritten_text" (what a person wrote by hand), and, when you can resolve one, "part_no", "tag_id" and "date". Same reason as the fixed table names: a field called photo_text in one pass and visible_text_notes in the next cannot be queried together. Read PARTIAL values rather than skipping: "500.7402.52__" beats nothing. Only when a character is genuinely unreadable, leave that field null or mark the unreadable span - do NOT invent it, and do NOT replace the whole transcription with a description of what the object looks like. A scene description is a nice extra AFTER the text, never instead of it.
 - IMAGE FILES uploaded as the file itself: if ANY readable character appears ANYWHERE in the image (a label, a stamp, a sign in the background) it counts as an image WITH text - transcribe it per the rule above, and also capture the layout (what appears where) and every entity named. Only a truly text-free image gets description first: a one-line caption, then the objects present with their attributes (type, color, count, condition, position). Either way, save what you extract onto the file's "src::" record with updateRecords, TAG every entity and identifier visible, and INDEX the one number the image offers (a measured value, an amount, a count).
-- Whatever the file type, this file's identity is "src::" + its storage path (the "storage path" metadata line) - never the inline content or a temporary URL. That record ALREADY EXISTS: the upload pipeline creates it in table "file_summaries" (access group "authorized") before indexing starts, so posting it again is rejected as a duplicate unique_id. Reference it from every record you write, and add what you learn to it with updateRecords. If that update unexpectedly reports the record does not exist, post it yourself ONCE with that exact "src::" unique_id (table "file_summaries", access group "authorized") and carry on; this is the ONE exception to the do-NOT-post-the-file-record rules elsewhere in these instructions, because the source identity must never be dropped just because an update failed.
+- Whatever the file type, this file's identity is "src::" + its storage path (the "storage path" metadata line) - never the inline content or a temporary URL. That record ALREADY EXISTS: the upload pipeline creates it in table "file_summaries" (access group "${accessGroup}") before indexing starts, so posting it again is rejected as a duplicate unique_id. Reference it from every record you write, and add what you learn to it with updateRecords. If that update unexpectedly reports the record does not exist, post it yourself ONCE with that exact "src::" unique_id (table "file_summaries", access group "${accessGroup}") and carry on; this is the ONE exception to the do-NOT-post-the-file-record rules elsewhere in these instructions, because the source identity must never be dropped just because an update failed.
+- ACCESS GROUP (hard rule): every record you write for this file - the file record, per-row records, chapters, summaries, intermediates - MUST be posted with access group "${accessGroup}". Pass it explicitly on every postRecords call; do not leave it out and do not vary it between passes of the same file. An access group is part of a record's table key, so records saved under a different group than the file are in a different table and will not come back with the rest of it: a "public" file whose rows were saved as "authorized" is one an anonymous visitor can see the name of and none of the contents of, and a re-index cannot find the strays to clean them up. The one exception is the EXTRACTED MEDIA records in "__MEDIA__", which the pipeline creates for you - leave their group alone and only enrich them.
 - REACHABILITY (hard rule): every record you write while indexing this file MUST be reachable from the file's "src::<storage path>" record by following reference - either reference that record directly, or reference something that already reaches it. A record with no reference, or one pointing outside this file's chain, is an ORPHAN: deleting or re-indexing the file removes the reachable records and leaves the orphan behind forever, where it keeps turning up in later answers as stale data. If you create an intermediate record that OTHER records reference (a page record that rows hang off, a sheet or section record), set source.can_remove_referencing_records to true on it; the delete cascade passes a delete through a record only when that record carries the flag OR a unique_id starting "src::" (the file record cascades because its unique_id starts with "src::"; the intermediates you create carry no "src::" id, so they need the flag), and it cascades ONE LEVEL AT A TIME, so EVERY intermediate record in a chain needs its own marker - an unmarked link stops the cascade there and everything below it survives as orphans. When in doubt, reference the file record directly and keep the chain flat.
 - TABULAR data (any spreadsheet - .csv/.tsv/.xlsx/.xls/.ods, or sheet-like rows): you MUST save EVERY data row as its own record (ONE record per row) with that row's actual column values in the record's "data", keyed by the header names, in a table named EXACTLY "spreadsheet_rows". Do NOT summarize, sample only a few rows, or save just file metadata - index the whole sheet, window by window, until it ends. Make MULTIPLE postRecords calls in batches (e.g. 30-50 rows per call) rather than one oversized call. This per-row completeness OVERRIDES brevity. The file-level "src::" record ALREADY EXISTS - the upload pipeline creates it before indexing starts - so do NOT create it. Link EVERY per-row record to it via reference (set each row record's reference to exactly "src::" + the storage path, with NO sheet/window/summary suffix added; the row records themselves do NOT carry a src:: unique_id). Enrich that same record with sheet name(s), column headers and total row count via updateRecords rather than posting another one. The per-row records AND this reference linkage are BOTH mandatory: the linkage is what lets the whole sheet be found and cleaned up together when the file is re-indexed. INDEX each row record on the row's most useful NUMERIC column (named by its header) so rows sort and range-query; when the row has no numeric column, index the grid row number instead. TAG each row record with the sheet name, the file name, and the row's categorical values (a status, a category, a type) - tags are how rows are filtered without scanning the table.
 - ONE RECORD PER GRID ROW, ALWAYS. "Row" means the numbered row of the sheet (R37 is one record), never a visual block, item, section or left/right pair. Sheets that repeat the same columns side by side (an A/B block beside a C/D block, "paired" or "mirrored" layouts) still get ONE record per grid row, holding BOTH sides - suffix the keys to keep them apart (PART_NO_A / PART_NO_B). Collapsing a 16-row window into 2 or 3 "block" records is the single most damaging mistake here: it silently loses most of the cells and makes every later total wrong, because some windows were counted per row and others per block. If a window shows rows R37 to R52, you save records for R37..R52 and the count you report is the number of grid rows you actually wrote.

package/src/engine/prompts/indexing_user_message.ts

@@ -20,6 +20,18 @@ export type IndexingAttachmentInfo = {
 	size?: number;
 	/** Temporary signed URL the agent/MCP fetches to read the file contents. */
 	url: string;
+	/**
+	 * Access group every record extracted from this file must be written at.
+	 *
+	 * The uploader chooses it (project default, or a per-upload prompt), and the
+	 * `src::` file record is already created at this group before indexing starts.
+	 * The rows, chapters and summaries the agent writes have to MATCH it: skapi's
+	 * access group is part of a record's table key, so a public file whose rows
+	 * were saved as "authorized" is a file an anonymous visitor can see the name
+	 * of and none of the contents of. Omitted means "authorized", which is what
+	 * every record written before this setting existed used.
+	 */
+	accessGroup?: 'public' | 'authorized' | 'private';
 };
 
 export type BuildIndexingUserMessageOptions = {
@@ -44,6 +56,15 @@ export type BuildIndexingUserMessageOptions = {
 	pagedRead?: boolean;
 };
 
+/**
+ * The access group to write this file's records at. One place, so the user
+ * message, the continue message and the system prompt cannot disagree.
+ */
+export function indexingAccessGroup(attachment: { accessGroup?: string }): 'public' | 'authorized' | 'private' {
+	const g = attachment && attachment.accessGroup;
+	return g === 'public' || g === 'private' ? g : 'authorized';
+}
+
 export function buildIndexingUserMessage(
 	attachment: IndexingAttachmentInfo,
 	options?: BuildIndexingUserMessageOptions,
@@ -54,7 +75,11 @@ export function buildIndexingUserMessage(
 		`- name: ${attachment.name}\n` +
 		`- storage path: ${attachment.storagePath}\n` +
 		(attachment.mime ? `- mime type: ${attachment.mime}\n` : '') +
-		(typeof attachment.size === 'number' ? `- size (bytes): ${attachment.size}\n` : '');
+		(typeof attachment.size === 'number' ? `- size (bytes): ${attachment.size}\n` : '') +
+		// Stated in the metadata block as well as the system prompt because this is
+		// the per-FILE value: one project can hold public and private files at once,
+		// and the system prompt is what is constant across the run.
+		`- access group (use this for EVERY record you write for this file): ${indexingAccessGroup(attachment)}\n`;
 
 	if (options?.inlineContent) {
 		// Parsed client-side (an attachment-parser plugin). The content is already
@@ -169,7 +194,8 @@ function buildRenderMeta(attachment: IndexingAttachmentInfo): string {
 		`File metadata:\n` +
 		`- name: ${attachment.name}\n` +
 		`- storage path: ${attachment.storagePath}\n` +
-		(attachment.mime ? `- mime type: ${attachment.mime}\n` : '')
+		(attachment.mime ? `- mime type: ${attachment.mime}\n` : '') +
+		`- access group (use this for EVERY record you write for this file): ${indexingAccessGroup(attachment)}\n`
 	);
 }
 
@@ -262,6 +288,7 @@ export function buildIndexingContinueMessage(attachment: IndexingAttachmentInfo)
 		`- name: ${attachment.name}\n` +
 		`- storage path: ${attachment.storagePath}\n` +
 		(attachment.mime ? `- mime type: ${attachment.mime}\n` : '') +
+		`- access group (use this for EVERY record you write for this file): ${indexingAccessGroup(attachment)}\n` +
 		`\nRecords for the earlier windows/pages of this file are ALREADY saved (they reference "${src}"). ` +
 		`First call getRecords with reference "${src}" to see how far the previous pass got (the furthest row/window already saved). The reference ALONE is the whole query: it returns every record written from this file across ALL tables and ALL access groups, so do NOT add table_name or access_group to narrow it. The response is PAGED, so keep fetching pages until it reports there are no more, and take the furthest point from the WHOLE set, never from the first page. ` +
 		`Then call readFileContent with the storage path above and a CURSOR that RESUMES just after that point - do NOT start at the beginning. The cursor is derivable from what you already saved:\n` +

package/src/engine/requests.ts

@@ -38,6 +38,38 @@ export const DEFAULT_CLAUDE_MODEL = 'claude-sonnet-5';
 export const DEFAULT_OPENAI_MODEL = 'gpt-5.6-luna';
 
 const mcpUrl = () => chatEngineConfig().mcpBaseUrl;
+
+/**
+ * Where a chat turn's MCP tools point, and what they authenticate with.
+ *
+ * A SIGNED-IN turn uses the server's root endpoint with the literal
+ * '$ACCESS_TOKEN', which the backend substitutes from the caller's
+ * `x-access-token` header before the request leaves for the provider.
+ *
+ * An ANONYMOUS turn has no such header, so that substitution yields an EMPTY
+ * credential: `authorization_token: ""` for Claude, `Bearer ` for OpenAI. That is
+ * worse than sending none. The MCP server cannot identify a project from an empty
+ * token, so every tool call 401s — and a pass whose calls all 401 is exactly what
+ * the polling worker classifies as an auth outage, which STOPS the chain. A
+ * provider that validates the field would reject the whole request before that.
+ *
+ * So an anonymous turn points at the project-scoped endpoint `/p/<project id>`
+ * and sends NO credential. That route is anonymous by construction: read-only,
+ * one project, public records only, and a bearer on it is ignored rather than
+ * honoured.
+ *
+ * The project id is the PUBLIC compound token, matching the route's own pattern
+ * and the form the tools accept; the raw regional code would not match.
+ */
+function mcpEndpointFor(
+	anonymous: boolean | undefined,
+	publicProjectId: string | undefined,
+	service: string,
+): { url: string; token?: string } {
+	if (!anonymous) return { url: mcpUrl(), token: '$ACCESS_TOKEN' };
+	const project = publicProjectId || service;
+	return { url: String(mcpUrl()).replace(/\/+$/, '') + '/p/' + project };
+}
 const clientSecretRequest = (opts: any) => chatEngineConfig().clientSecretRequest(opts);
 
 // Resolve the per-image `detail` for OpenAI. The version match tolerates a
@@ -548,7 +580,9 @@ export async function callClaudeWithPublicMcp(
 	fileUrls?: FileUrlDirective[],
 	onResponse?: (res: any) => void,
 	onError?: (err: any) => void,
+	mcpScope?: { anonymous?: boolean; publicProjectId?: string },
 ) {
+	const endpoint = mcpEndpointFor(mcpScope?.anonymous, mcpScope?.publicProjectId, service);
 	return callClaudeWithMcp({
 		prompt,
 		messages,
@@ -562,8 +596,10 @@ export async function callClaudeWithPublicMcp(
 		fileUrls,
 		mcpServer: {
 			name: MCP_NAME,
-			url: mcpUrl(),
-			authorizationToken: '$ACCESS_TOKEN',
+			url: endpoint.url,
+			// Omitted entirely for an anonymous turn; the `if (mcpServer.authorizationToken)`
+			// guard below drops the key rather than sending an empty one.
+			authorizationToken: endpoint.token,
 		},
 		onResponse,
 		onError,
@@ -582,7 +618,9 @@ export async function callOpenAIWithPublicMcp(
 	fileUrls?: FileUrlDirective[],
 	onResponse?: (res: any) => void,
 	onError?: (err: any) => void,
+	mcpScope?: { anonymous?: boolean; publicProjectId?: string },
 ) {
+	const endpoint = mcpEndpointFor(mcpScope?.anonymous, mcpScope?.publicProjectId, service);
 	const resolvedModel = model || DEFAULT_OPENAI_MODEL;
 	const imageDetail = getOpenAIImageDetail(resolvedModel);
 	const messageList =
@@ -636,11 +674,14 @@ export async function callOpenAIWithPublicMcp(
 				{
 					type: 'mcp',
 					server_label: MCP_NAME,
-					server_url: mcpUrl(),
+					server_url: endpoint.url,
 					require_approval: 'never',
-					headers: {
-						Authorization: 'Bearer $ACCESS_TOKEN',
-					},
+					// No `headers` at all for an anonymous turn: `Bearer ` with an
+					// empty token is a credential the MCP server rejects, and the
+					// project-scoped endpoint needs none.
+					...(endpoint.token
+						? { headers: { Authorization: 'Bearer ' + endpoint.token } }
+						: {}),
 				},
 				...(OPENAI_WEB_SEARCH_ENABLED
 					? [
@@ -681,6 +722,13 @@ export type AttachmentSaveInfo = {
 		mime?: string;
 		size?: number;
 		url: string;
+		/**
+		 * Access group this file's records are written at (the uploader's choice,
+		 * already applied to the "src::" record). Threaded into the indexing
+		 * prompts so the agent's own records land in the same group; omitted
+		 * means "authorized", the group everything used before the setting existed.
+		 */
+		accessGroup?: 'public' | 'authorized' | 'private';
 	};
 	/**
 	 * Content parsed CLIENT-SIDE by an attachment-parser plugin (e.g. an .hwp
@@ -892,6 +940,9 @@ export async function notifyAgentSaveAttachment(info: AttachmentSaveInfo) {
 		projectId: info.publicProjectId || service,
 		serviceName: info.serviceName,
 		serviceDescription: info.serviceDescription,
+		// Per-FILE, not per-project: one project holds public and private files at
+		// once, so this travels on the attachment rather than the identity.
+		accessGroup: attachment.accessGroup,
 	});
 
 	if (platform === 'openai') {