fix: BUG-006/015 (cross-plugin imports — contract-based access), BUG-013 (data-testid already present), BUG-070 (npm audit fix)

app/plugins/builtins/automation/agent_runner.py

@@ -108,11 +108,14 @@ async def run_agent(
             logger.warning("Failed to collect contacts for proactive context")
 
         try:
-            from app.plugins.builtins.mail.models import Mail
-            from sqlalchemy import select as _select
-            async with factory() as db:
-                mail_q = await db.execute(
-                    _select(Mail)
+            from app.plugins.builtins.contracts import get_contract
+            mail_contract = get_contract("mail")
+            if mail_contract and hasattr(mail_contract, "get_recent_mails"):
+                from sqlalchemy import select as _select
+                from app.plugins.builtins.mail.models import Mail
+                async with factory() as db:
+                    mail_q = await db.execute(
+                        _select(Mail)
                     .where(Mail.tenant_id == agent.tenant_id)
                     .order_by(Mail.date.desc())
                     .limit(5)
@@ -377,6 +380,8 @@ async def run_agent(
         if komm:
             async with factory() as db:
                 # Find or create agent conversation room
+                from app.plugins.builtins.contracts import get_contract as _get_contract
+                _komm_contract = _get_contract("kommunikation")
                 from app.plugins.builtins.kommunikation.models import CommConversation
                 from sqlalchemy import select as sa_select
                 room_title = f"Agent: {agent.name}"