neoagent 2.1.18-beta.6 → 2.1.18-beta.7

package/.env.example

@@ -69,7 +69,8 @@ MINIMAX_API_KEY=your-minimax-api-key-here
 ########################################
 
 # Google Workspace official integration OAuth client.
-# Redirect URI should match ${PUBLIC_URL:-http://localhost:3333}/api/integrations/oauth/callback
+# Redirect URI should match <PUBLIC_URL>/api/integrations/oauth/callback.
+# Set PUBLIC_URL to your app's public base URL. Local default is http://localhost:3333.
 GOOGLE_OAUTH_CLIENT_ID=your-google-oauth-client-id
 GOOGLE_OAUTH_CLIENT_SECRET=your-google-oauth-client-secret
 GOOGLE_OAUTH_REDIRECT_URI=

package/docs/configuration.md

@@ -42,6 +42,8 @@ At least one hosted-provider API key is required unless you only use local Ollam
 | `DEEPGRAM_LANGUAGE` | Deepgram language override (defaults to `multi`) |
 | `OLLAMA_URL` | Local Ollama (`http://localhost:11434`) |
 
+`GOOGLE_OAUTH_CLIENT_SECRET` is sensitive, just like `SESSION_SECRET`. Do not commit it to version control, print it to logs, or expose it in client-side code. Store it in server-side environment variables or a secrets manager, restrict access to operators who need it, and rotate it immediately if you suspect it was exposed.
+
 ### Messaging
 
 | Variable | Description |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neoagent",
-  "version": "2.1.18-beta.6",
+  "version": "2.1.18-beta.7",
   "description": "Proactive personal AI agent with no limits",
   "license": "MIT",
   "main": "server/index.js",

package/server/db/database.js

@@ -1,6 +1,10 @@
 const Database = require('better-sqlite3');
 const path = require('path');
 const { DATA_DIR, ensureRuntimeDirs } = require('../../runtime/paths');
+const {
+  encryptValue,
+  isEncryptedValue,
+} = require('../services/integrations/secrets');
 ensureRuntimeDirs();
 
 const DB_PATH = path.join(DATA_DIR, 'neoagent.db');
@@ -204,6 +208,7 @@ db.exec(`
   CREATE INDEX IF NOT EXISTS idx_agent_steps_run ON agent_steps(run_id, step_index);
   CREATE INDEX IF NOT EXISTS idx_integration_connections_user ON integration_connections(user_id, provider_key, app_key);
   CREATE INDEX IF NOT EXISTS idx_integration_oauth_states_state ON integration_oauth_states(state);
+  CREATE INDEX IF NOT EXISTS idx_integration_oauth_states_expires ON integration_oauth_states(expires_at);
   CREATE INDEX IF NOT EXISTS idx_messages_user ON messages(user_id, created_at DESC);
   CREATE INDEX IF NOT EXISTS idx_messages_platform ON messages(platform, platform_chat_id);
   CREATE INDEX IF NOT EXISTS idx_conv_messages ON conversation_messages(conversation_id, created_at);
@@ -379,6 +384,12 @@ db.exec(`
   CREATE INDEX IF NOT EXISTS idx_recording_sources_session ON recording_sources(session_id, source_key);
   CREATE INDEX IF NOT EXISTS idx_recording_chunks_source ON recording_chunks(source_id, sequence_index);
   CREATE INDEX IF NOT EXISTS idx_recording_segments_session ON recording_transcript_segments(session_id, start_ms, created_at);
+
+  CREATE TRIGGER IF NOT EXISTS cleanup_expired_oauth_states
+  AFTER INSERT ON integration_oauth_states BEGIN
+    DELETE FROM integration_oauth_states
+    WHERE datetime(expires_at) <= datetime('now');
+  END;
 `);
 
 try {
@@ -581,8 +592,43 @@ function migrateIntegrationOauthStatesTable() {
   `);
 }
 
+function migrateIntegrationSecretStorage() {
+  try {
+    const connectionRows = db
+      .prepare('SELECT id, credentials_json FROM integration_connections')
+      .all();
+    const updateConnection = db.prepare(
+      'UPDATE integration_connections SET credentials_json = ? WHERE id = ?',
+    );
+    for (const row of connectionRows) {
+      const current = String(row.credentials_json || '');
+      if (!current || isEncryptedValue(current)) continue;
+      updateConnection.run(encryptValue(current), row.id);
+    }
+  } catch {
+    // Preserve startup even if a row cannot be re-encrypted.
+  }
+
+  try {
+    const stateRows = db
+      .prepare('SELECT id, code_verifier FROM integration_oauth_states')
+      .all();
+    const updateState = db.prepare(
+      'UPDATE integration_oauth_states SET code_verifier = ? WHERE id = ?',
+    );
+    for (const row of stateRows) {
+      const current = String(row.code_verifier || '');
+      if (!current || isEncryptedValue(current)) continue;
+      updateState.run(encryptValue(current), row.id);
+    }
+  } catch {
+    // Preserve startup even if a row cannot be re-encrypted.
+  }
+}
+
 migrateIntegrationConnectionsTable();
 migrateIntegrationOauthStatesTable();
+migrateIntegrationSecretStorage();
 
 try {
   db.exec(`

package/server/public/flutter_bootstrap.js

@@ -37,6 +37,6 @@ _flutter.buildConfig = {"engineRevision":"425cfb54d01a9472b3e81d9e76fd63a4a44cfb
 
 _flutter.loader.load({
   serviceWorkerSettings: {
-    serviceWorkerVersion: "3090900279" /* Flutter's service worker is deprecated and will be removed in a future Flutter release. */
+    serviceWorkerVersion: "1552279196" /* Flutter's service worker is deprecated and will be removed in a future Flutter release. */
   }
 });