fix: harden generated agent platform access

agent_builder/builder.py

@@ -25,6 +25,8 @@ class BuilderContext:
     cp_jwt: str | None = None
     settings: Settings | None = None
     project_prefix: str | None = None
+    workspace: Any | None = None
+    grant_token: str | None = None
     # Optional caller-provided LLM creds (when the outer platform Card
     # declares llm_provisioning=caller_provided). Falls back to settings.
     llm_base_url: str | None = None
@@ -49,6 +51,12 @@ small tool-calling DeepAgent with ``create_deep_agent`` plus
 ``wrap_model_call`` middleware. Do not recreate this from memory: call
 ``init_agent_template`` first and modify the generated files.
 
+Default generated/user agents to ``LLMProvisioning.CALLER_PROVIDED`` and
+``caller_pays_llm=True`` unless the user explicitly wants platform-paid LLM
+usage. ``LLMProvisioning.PLATFORM`` is allowed only through the A2A LiteLLM
+grant path: the generated agent must still read ``ctx.llm`` and must never read
+``A2A_LITELLM_KEY`` or any provider key directly.
+
 You have packaged DeepAgents skills loaded from ``/.agent-builder/skills/``.
 Use ``deepagent-agent-design`` before designing generated agent internals,
 ``a2apack-agent-authoring`` when shaping the public A2A class and Card,
@@ -255,9 +263,15 @@ Discipline:
 
 def build_agent_builder(ctx: BuilderContext) -> Any:
     settings = ctx.settings or load_settings()
-    tools = build_tools(ToolContext(
-        bucket=ctx.bucket, settings=settings, cp_jwt=ctx.cp_jwt,
-    ))
+    tools = build_tools(
+        ToolContext(
+            bucket=ctx.bucket,
+            settings=settings,
+            cp_jwt=ctx.cp_jwt,
+            workspace=ctx.workspace,
+            grant_token=ctx.grant_token,
+        )
+    )
     model_kwargs: dict[str, Any] = {
         "model": ctx.llm_model or settings.litellm_model,
         "base_url": ctx.llm_base_url or (settings.litellm_url + "/v1"),
@@ -295,6 +309,12 @@ def _build_project_backend(ctx: BuilderContext, *, settings: Settings) -> Any |
     prefix = ctx.project_prefix.strip("/")
     if not prefix:
         return _with_builder_skills(StateBackend())
+    if ctx.workspace is not None:
+        try:
+            from a2a_pack.deepagents import WorkspaceBackend
+        except Exception:  # noqa: BLE001
+            return _with_builder_skills(StateBackend())
+        return _with_builder_skills(WorkspaceBackend(ctx.workspace))
     try:
         from a2a_pack import Grant, WorkspaceAccess, WorkspaceMode
         from a2a_pack.deepagents import WorkspaceBackend