neoagent 2.1.18-beta.79 → 2.1.18-beta.80

package/extensions/chrome-browser/background.mjs

@@ -6,6 +6,9 @@ const protocol = createBrowserProtocol(chrome);
 let socket = null;
 let reconnectTimer = null;
 let suppressSocketClose = false;
+const DEFAULT_FETCH_TIMEOUT_MS = 10000;
+const DEFAULT_WS_CONNECT_TIMEOUT_MS = 10000;
+const EXTENSION_PROTOCOL_VERSION = 1;
 
 function getStorage(keys = STORAGE_KEYS) {
   return chrome.storage.local.get(keys);
@@ -41,6 +44,19 @@ function websocketUrl(serverUrl, token) {
   return url.toString();
 }
 
+async function fetchWithTimeout(url, options = {}, timeoutMs = DEFAULT_FETCH_TIMEOUT_MS) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    return await fetch(url, {
+      ...options,
+      signal: controller.signal,
+    });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
 function compareVersions(a, b) {
   const left = String(a || '0').split('.').map((part) => Number(part) || 0);
   const right = String(b || '0').split('.').map((part) => Number(part) || 0);
@@ -100,17 +116,25 @@ async function connect() {
   const ws = new WebSocket(websocketUrl(serverUrl, token));
   socket = ws;
   await updateStatus('connecting');
+  const connectTimeout = setTimeout(() => {
+    if (socket === ws && ws.readyState !== WebSocket.OPEN) {
+      try { ws.close(); } catch {}
+    }
+  }, DEFAULT_WS_CONNECT_TIMEOUT_MS);
 
   ws.addEventListener('open', () => {
     if (socket !== ws) return;
+    clearTimeout(connectTimeout);
     updateStatus('connected');
   });
   ws.addEventListener('close', () => {
+    clearTimeout(connectTimeout);
     handleSocketDisconnected(ws).catch((error) => {
       console.error('NeoAgent disconnect handling failed', error);
     });
   });
   ws.addEventListener('error', () => {
+    clearTimeout(connectTimeout);
     handleSocketDisconnected(ws).catch((error) => {
       console.error('NeoAgent socket error handling failed', error);
     });
@@ -134,12 +158,23 @@ async function handleSocketMessage(raw) {
   if (!message || message.type !== 'command' || !message.id) {
     return;
   }
+  if (message.version != null && Number(message.version) !== EXTENSION_PROTOCOL_VERSION) {
+    socket?.send(JSON.stringify({
+      type: 'result',
+      version: EXTENSION_PROTOCOL_VERSION,
+      id: message.id,
+      ok: false,
+      error: `Unsupported protocol version: ${message.version}`,
+    }));
+    return;
+  }
   try {
     const result = await protocol.run(message.command, message.payload || {});
-    socket?.send(JSON.stringify({ type: 'result', id: message.id, ok: true, result }));
+    socket?.send(JSON.stringify({ type: 'result', version: EXTENSION_PROTOCOL_VERSION, id: message.id, ok: true, result }));
   } catch (error) {
     socket?.send(JSON.stringify({
       type: 'result',
+      version: EXTENSION_PROTOCOL_VERSION,
       id: message.id,
       ok: false,
       error: error?.message || String(error),
@@ -150,7 +185,7 @@ async function handleSocketMessage(raw) {
 async function startPairing(serverUrl) {
   const normalized = await resolveServerUrl(serverUrl);
   if (!normalized) throw new Error('NeoAgent server URL required.');
-  const response = await fetch(`${normalized}/api/browser-extension/pairing/request`, {
+  const response = await fetchWithTimeout(`${normalized}/api/browser-extension/pairing/request`, {
     method: 'POST',
     headers: { 'content-type': 'application/json' },
     body: JSON.stringify({ extensionName: 'NeoAgent Browser' }),
@@ -173,7 +208,7 @@ async function claimPairing() {
   if (!serverUrl || !pairingId || !pairingSecret) {
     throw new Error('No pending pairing request.');
   }
-  const response = await fetch(`${serverUrl}/api/browser-extension/pairing/${encodeURIComponent(pairingId)}/claim`, {
+  const response = await fetchWithTimeout(`${serverUrl}/api/browser-extension/pairing/${encodeURIComponent(pairingId)}/claim`, {
     method: 'POST',
     headers: { 'content-type': 'application/json' },
     body: JSON.stringify({ pairingSecret, extensionName: 'NeoAgent Browser' }),
@@ -204,7 +239,7 @@ async function disconnect() {
 async function checkForUpdates(preferredServerUrl) {
   const serverUrl = await resolveServerUrl(preferredServerUrl);
   if (!serverUrl) throw new Error('NeoAgent server URL required.');
-  const response = await fetch(`${serverUrl}/api/browser-extension/latest`);
+  const response = await fetchWithTimeout(`${serverUrl}/api/browser-extension/latest`);
   const latest = await response.json().catch(() => ({}));
   if (!response.ok) throw new Error(latest.error || `Update check failed: ${response.status}`);
   const currentVersion = chrome.runtime.getManifest().version;
@@ -249,7 +284,7 @@ chrome.runtime.onMessage.addListener((message, _sender, sendResponse) => {
   };
   run()
     .then((result) => sendResponse({ ok: true, result }))
-    .catch((error) => sendResponse({ ok: false, error: error.message || String(error) }));
+    .catch((error) => sendResponse({ ok: false, error: error?.message || String(error) }));
   return true;
 });
 

package/extensions/chrome-browser/popup.css

@@ -19,12 +19,22 @@
 
 body {
   margin: 0;
-  width: 380px;
+  width: min(420px, 100vw);
+  min-width: 320px;
+  max-width: 420px;
   background: var(--bg);
   color: var(--text);
   font: 14px/1.45 system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
 }
 
+body[data-busy="true"] {
+  cursor: progress;
+}
+
+body[data-busy="true"] .status-dot {
+  animation: pulse 1s ease-in-out infinite;
+}
+
 main {
   display: grid;
   gap: 12px;
@@ -215,7 +225,7 @@ button.danger:hover {
 
 button:disabled {
   cursor: not-allowed;
-  opacity: 0.62;
+  opacity: 0.88;
 }
 
 .link-button {
@@ -261,3 +271,18 @@ button:disabled {
 .message[data-tone="success"] {
   color: #86efac;
 }
+
+@keyframes pulse {
+  0% {
+    transform: scale(1);
+    filter: saturate(1);
+  }
+  50% {
+    transform: scale(1.08);
+    filter: saturate(1.2);
+  }
+  100% {
+    transform: scale(1);
+    filter: saturate(1);
+  }
+}

package/extensions/chrome-browser/popup.js

@@ -24,6 +24,7 @@ const STATUS_LABELS = {
 };
 
 let currentState = {};
+let pendingActions = 0;
 
 function send(type, payload = {}) {
   return chrome.runtime.sendMessage({ type, ...payload }).then((response) => {
@@ -50,6 +51,40 @@ function setMessage(text, tone = '') {
   }
 }
 
+function setBusy(isBusy, label = 'Working...') {
+  if (isBusy) {
+    pendingActions += 1;
+  } else {
+    pendingActions = Math.max(0, pendingActions - 1);
+  }
+  const busy = pendingActions > 0;
+
+  [primaryActionEl, secondaryActionEl, openAppEl, disconnectEl, checkUpdateEl, downloadEl].forEach((button) => {
+    if (!button || button.hidden) return;
+    if (busy) {
+      if (!Object.prototype.hasOwnProperty.call(button.dataset, 'wasDisabled')) {
+        button.dataset.wasDisabled = button.disabled ? 'true' : 'false';
+      }
+      button.disabled = true;
+    } else if (button.dataset.wasDisabled) {
+      button.disabled = button.dataset.wasDisabled === 'true';
+      delete button.dataset.wasDisabled;
+    }
+  });
+
+  if (busy) {
+    document.body.dataset.busy = 'true';
+    if (!messageEl.textContent) {
+      setMessage(label, 'success');
+    }
+  } else {
+    delete document.body.dataset.busy;
+    if (messageEl.dataset.tone === 'success' && messageEl.textContent === label) {
+      setMessage('');
+    }
+  }
+}
+
 function setAction(button, { label, action, hidden = false, disabled = false }) {
   button.textContent = label;
   button.dataset.action = action;
@@ -193,9 +228,13 @@ function bindAsyncClick(element, handler) {
   element.addEventListener('click', async () => {
     try {
       setMessage('');
+      setBusy(true);
       await handler();
     } catch (error) {
       setMessage(error.message, 'error');
+    } finally {
+      setBusy(false);
+      updateFlow();
     }
   });
 }

package/extensions/chrome-browser/protocol.mjs

@@ -37,9 +37,9 @@ function jsString(value) {
 
 function buildIsolatedEvaluationExpression(script) {
   const source = String(script ?? 'undefined');
-  // Match the host browser controller: keep each arbitrary snippet inside its
-  // own scope so repeated browser_evaluate calls cannot collide on const/let.
-  return `(() => eval(${JSON.stringify(source)}))()`;
+  // Keep each snippet inside its own function scope so repeated browser_evaluate
+  // calls cannot collide on const/let declarations.
+  return `(() => {\nreturn (${source});\n})()`;
 }
 
 function keyCodeFor(key) {

package/lib/install_helpers.js

@@ -68,7 +68,7 @@ function buildBundledWebClientIfPossible({
     ],
     {
       cwd: flutterAppDir,
-      env: process.env,
+      env: withInstallEnv(),
     },
   );
 

package/lib/manager.js

@@ -31,6 +31,8 @@ const {
   choosePreferredBranchForChannel,
   choosePreferredNpmTagForChannel,
 } = require('../runtime/release_channel');
+const { parseEnv } = require('../runtime/env');
+const { createGitHelpers } = require('../runtime/git_helpers');
 const { parseDeploymentMode } = require('../server/utils/deployment');
 
 const APP_NAME = 'NeoAgent';
@@ -109,19 +111,6 @@ function readEnvFileRaw() {
   return fs.readFileSync(ENV_FILE, 'utf8');
 }
 
-function parseEnv(raw) {
-  const lines = raw.split('\n');
-  const map = new Map();
-  for (const line of lines) {
-    if (!line || line.startsWith('#') || !line.includes('=')) continue;
-    const idx = line.indexOf('=');
-    const key = line.slice(0, idx).trim();
-    const value = line.slice(idx + 1);
-    if (key) map.set(key, value);
-  }
-  return map;
-}
-
 function upsertEnvValue(key, value) {
   const raw = readEnvFileRaw();
   const lines = raw ? raw.split('\n') : [];
@@ -167,6 +156,13 @@ function runQuiet(cmd, args, options = {}) {
   return spawnSync(cmd, args, { stdio: ['ignore', 'pipe', 'pipe'], encoding: 'utf8', cwd: APP_DIR, ...options });
 }
 
+const {
+  latestGitTagVersion,
+  gitWorkingTreeDirty,
+  gitLocalBranchExists,
+  gitRemoteBranchExists,
+} = createGitHelpers((cmd, args) => runQuiet(cmd, args));
+
 function readInstalledPackageVersion() {
   try {
     const pkg = JSON.parse(fs.readFileSync(PACKAGE_JSON_PATH, 'utf8'));
@@ -203,29 +199,6 @@ function releaseChannelSummary(channel) {
   return describeReleaseChannelPolicy(parseReleaseChannel(channel) || currentReleaseChannel());
 }
 
-function gitWorkingTreeDirty() {
-  const res = runQuiet('git', ['status', '--porcelain']);
-  return res.status === 0 && Boolean(res.stdout.trim());
-}
-
-function gitLocalBranchExists(branch) {
-  return runQuiet('git', ['show-ref', '--verify', '--quiet', `refs/heads/${branch}`]).status === 0;
-}
-
-function gitRemoteBranchExists(branch) {
-  return runQuiet('git', ['ls-remote', '--exit-code', '--heads', 'origin', branch]).status === 0;
-}
-
-function latestGitTagVersion(pattern) {
-  const res = runQuiet('git', ['tag', '--list', pattern, '--sort=-v:refname']);
-  if (res.status !== 0) return null;
-  const tag = res.stdout
-    .split('\n')
-    .map((value) => value.trim())
-    .find(Boolean);
-  return tag ? tag.replace(/^v/, '') : null;
-}
-
 function resolvePreferredGitBranch(channel) {
   const normalized = parseReleaseChannel(channel) || currentReleaseChannel();
   if (normalized === 'stable') {
@@ -310,7 +283,7 @@ function ensureLogDir() {
 function backupRuntimeData() {
   const backupsDir = path.join(RUNTIME_HOME, 'backups');
   fs.mkdirSync(backupsDir, { recursive: true });
-  const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+  const stamp = new Date().toISOString().replace(/:/g, '-').replace(/\.\d{3}Z$/, 'Z');
   const target = path.join(backupsDir, `pre-update-${stamp}`);
   fs.mkdirSync(target, { recursive: true });
 
@@ -320,7 +293,11 @@ function backupRuntimeData() {
 
 function killByPort(port) {
   if (!commandExists('lsof')) return false;
-  const res = runQuiet('bash', ['-lc', `lsof -ti tcp:${port}`]);
+  const normalizedPort = Number(port);
+  if (!Number.isInteger(normalizedPort) || normalizedPort <= 0 || normalizedPort > 65535) {
+    return false;
+  }
+  const res = runQuiet('lsof', ['-ti', `tcp:${normalizedPort}`]);
   if (res.status !== 0 || !res.stdout.trim()) return false;
   const pids = res.stdout
     .trim()
@@ -343,6 +320,12 @@ function listNeoAgentServerProcesses() {
   const res = runQuiet('ps', ['-axo', 'pid=,ppid=,command=']);
   if (res.status !== 0) return [];
 
+  const normalizedAppIndexPath = path.join(APP_DIR, 'server', 'index.js').replace(/\\/g, '/');
+  const escapedAppIndexPath = normalizedAppIndexPath.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const appIndexPattern = new RegExp(`(^|\\s|["'])${escapedAppIndexPath}(?=$|\\s|["'])`);
+  const genericNeoAgentPattern = /(^|[\s"'])[^\s"']*\/neoagent\/server\/index\.js(?=$|[\s"'])/i;
+  const repoNamePattern = new RegExp(`(^|[\\s"'])[^\\s"']*${path.sep === '\\' ? '\\\\' : '/'}NeoAgent${path.sep === '\\' ? '\\\\' : '/'}server${path.sep === '\\' ? '\\\\' : '/'}index\\.js(?=$|[\\s"'])`, 'i');
+
   return res.stdout
     .split('\n')
     .map((line) => line.trim())
@@ -361,9 +344,9 @@ function listNeoAgentServerProcesses() {
       entry.pid !== process.pid &&
       /(^|\s)node(\s|$)/.test(entry.command) &&
       (
-        entry.command.includes('/neoagent/server/index.js') ||
-        entry.command.includes(`${path.sep}NeoAgent${path.sep}server${path.sep}index.js`) ||
-        entry.command.includes(`${APP_DIR}${path.sep}server${path.sep}index.js`)
+        appIndexPattern.test(String(entry.command || '').replace(/\\/g, '/')) ||
+        genericNeoAgentPattern.test(String(entry.command || '').replace(/\\/g, '/')) ||
+        repoNamePattern.test(String(entry.command || ''))
       )
     );
 }
@@ -675,6 +658,7 @@ function installLinuxService() {
   runOrThrow('systemctl', ['--user', 'daemon-reload']);
   runOrThrow('systemctl', ['--user', 'enable', 'neoagent']);
   runOrThrow('systemctl', ['--user', 'start', 'neoagent']);
+  runOrThrow('systemctl', ['--user', 'is-active', '--quiet', 'neoagent']);
   logOk('systemd user service installed and started');
 }
 
@@ -729,6 +713,7 @@ function cmdStart() {
 
   if (platform === 'linux' && fs.existsSync(SYSTEMD_UNIT)) {
     runOrThrow('systemctl', ['--user', 'start', 'neoagent']);
+    runOrThrow('systemctl', ['--user', 'is-active', '--quiet', 'neoagent']);
     logOk('systemd start requested');
     return;
   }
@@ -781,9 +766,6 @@ function cmdStop() {
   if (killed) {
     logOk(`Stopped ${processes.length} extra NeoAgent process${processes.length === 1 ? '' : 'es'}`);
   }
-  if (killByPort(port)) {
-    logOk(`Stopped process listening on port ${port}`);
-  }
 }
 
 function cmdRestart() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neoagent",
-  "version": "2.1.18-beta.79",
+  "version": "2.1.18-beta.80",
   "description": "Proactive personal AI agent with no limits",
   "license": "MIT",
   "main": "server/index.js",

package/runtime/env.js

@@ -0,0 +1,17 @@
+'use strict';
+
+function parseEnv(raw) {
+  const map = new Map();
+  for (const line of String(raw ?? '').split(/\r?\n/)) {
+    if (!line || line.startsWith('#') || !line.includes('=')) continue;
+    const idx = line.indexOf('=');
+    const key = line.slice(0, idx).trim();
+    const value = line.slice(idx + 1);
+    if (key) map.set(key, value);
+  }
+  return map;
+}
+
+module.exports = {
+  parseEnv,
+};

package/runtime/git_helpers.js

@@ -0,0 +1,41 @@
+'use strict';
+
+function createGitHelpers(run) {
+  if (typeof run !== 'function') {
+    throw new TypeError('createGitHelpers(run) requires a run function');
+  }
+
+  function latestGitTagVersion(pattern) {
+    const res = run('git', ['tag', '--list', pattern, '--sort=-v:refname']);
+    if (res.status !== 0) return null;
+    const tag = String(res.stdout || '')
+      .split('\n')
+      .map((value) => value.trim())
+      .find(Boolean);
+    return tag ? tag.replace(/^v/, '') : null;
+  }
+
+  function gitWorkingTreeDirty() {
+    const res = run('git', ['status', '--porcelain']);
+    return res.status === 0 && Boolean(String(res.stdout || '').trim());
+  }
+
+  function gitLocalBranchExists(branch) {
+    return run('git', ['show-ref', '--verify', '--quiet', `refs/heads/${branch}`]).status === 0;
+  }
+
+  function gitRemoteBranchExists(branch) {
+    return run('git', ['ls-remote', '--exit-code', '--heads', 'origin', branch]).status === 0;
+  }
+
+  return {
+    latestGitTagVersion,
+    gitWorkingTreeDirty,
+    gitLocalBranchExists,
+    gitRemoteBranchExists,
+  };
+}
+
+module.exports = {
+  createGitHelpers,
+};

package/runtime/paths.js

@@ -45,17 +45,50 @@ function migrateLegacyRuntime(logger = () => {}) {
   ensureRuntimeDirs();
   let changed = false;
 
+  const log = (message) => {
+    if (typeof logger === 'function') {
+      logger(message);
+      return;
+    }
+    if (logger && typeof logger.info === 'function') {
+      logger.info(message);
+    }
+  };
+
+  const logError = (message) => {
+    if (logger && typeof logger.error === 'function') {
+      logger.error(message);
+      return;
+    }
+    if (typeof logger === 'function') {
+      logger(`error: ${message}`);
+      return;
+    }
+    try { console.error(message); } catch {}
+  };
+
   if (copyFileIfMissing(LEGACY_ENV_FILE, ENV_FILE)) {
-    try { fs.chmodSync(ENV_FILE, 0o600); } catch {}
-    logger(`migrated ${LEGACY_ENV_FILE} -> ${ENV_FILE}`);
+    try {
+      fs.chmodSync(ENV_FILE, 0o600);
+    } catch (error) {
+      try {
+        fs.rmSync(ENV_FILE, { force: true });
+      } catch {}
+      logError(
+        `failed to migrate ${LEGACY_ENV_FILE} -> ${ENV_FILE}: chmod(0600) failed (${error.message}). ` +
+        `Migration was reverted. Note: chmod behavior can differ on Windows filesystems.`
+      );
+      return changed;
+    }
+    log(`migrated ${LEGACY_ENV_FILE} -> ${ENV_FILE}`);
     changed = true;
   }
   if (copyDirMerge(LEGACY_DATA_DIR, DATA_DIR)) {
-    logger(`migrated ${LEGACY_DATA_DIR} -> ${DATA_DIR}`);
+    log(`migrated ${LEGACY_DATA_DIR} -> ${DATA_DIR}`);
     changed = true;
   }
   if (copyDirMerge(LEGACY_AGENT_DATA_DIR, AGENT_DATA_DIR)) {
-    logger(`migrated ${LEGACY_AGENT_DATA_DIR} -> ${AGENT_DATA_DIR}`);
+    log(`migrated ${LEGACY_AGENT_DATA_DIR} -> ${AGENT_DATA_DIR}`);
     changed = true;
   }
 

package/runtime/release_channel.js

@@ -3,6 +3,7 @@
 const fs = require('fs');
 const path = require('path');
 const { ENV_FILE } = require('./paths');
+const { parseEnv } = require('./env');
 
 const DEFAULT_RELEASE_CHANNEL = 'stable';
 const RELEASE_CHANNEL_ENV_KEY = 'NEOAGENT_RELEASE_CHANNEL';
@@ -23,18 +24,6 @@ const RELEASE_CHANNEL_NPM_POLICIES = Object.freeze({
   beta: 'newest of beta or latest',
 });
 
-function parseEnv(raw) {
-  const map = new Map();
-  for (const line of String(raw || '').split('\n')) {
-    if (!line || line.startsWith('#') || !line.includes('=')) continue;
-    const idx = line.indexOf('=');
-    const key = line.slice(0, idx).trim();
-    const value = line.slice(idx + 1);
-    if (key) map.set(key, value);
-  }
-  return map;
-}
-
 function parseReleaseChannel(value) {
   const normalized = String(value || '').trim().toLowerCase();
   switch (normalized) {

package/server/config/origins.js

@@ -23,7 +23,10 @@ function isChromeExtensionOrigin(origin) {
 }
 
 function isAllowedOrigin(origin, options = {}) {
-  if (!origin) return true;
+  if (origin == null || origin === '') {
+    return options.allowMissingOrigin === true;
+  }
+  if (origin === 'null') return false;
   if (configuredOrigins.includes(origin)) return true;
   if (isLoopbackOrigin(origin)) return true;
   if (options.allowChromeExtension && isChromeExtensionOrigin(origin)) return true;

package/server/db/database.js

@@ -279,6 +279,34 @@ db.exec(`
     FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
   );
 
+  CREATE TABLE IF NOT EXISTS desktop_companion_devices (
+    id TEXT PRIMARY KEY,
+    user_id INTEGER NOT NULL,
+    device_id TEXT NOT NULL,
+    activation_id TEXT,
+    label TEXT NOT NULL,
+    hostname TEXT,
+    platform TEXT,
+    platform_version TEXT,
+    app_version TEXT,
+    companion_enabled INTEGER DEFAULT 0,
+    paused INTEGER DEFAULT 0,
+    status TEXT DEFAULT 'offline',
+    display_count INTEGER DEFAULT 0,
+    active_display_id TEXT,
+    permissions_json TEXT DEFAULT '{}',
+    capabilities_json TEXT DEFAULT '{}',
+    metadata_json TEXT DEFAULT '{}',
+    session_id INTEGER,
+    last_connected_at TEXT,
+    last_seen_at TEXT,
+    revoked_at TEXT,
+    created_at TEXT DEFAULT (datetime('now')),
+    updated_at TEXT DEFAULT (datetime('now')),
+    FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
+    UNIQUE(user_id, device_id)
+  );
+
   CREATE TABLE IF NOT EXISTS scheduled_tasks (
     id INTEGER PRIMARY KEY AUTOINCREMENT,
     user_id INTEGER NOT NULL,
@@ -360,6 +388,8 @@ db.exec(`
   CREATE INDEX IF NOT EXISTS idx_integration_oauth_states_expires ON integration_oauth_states(expires_at);
   CREATE INDEX IF NOT EXISTS idx_browser_extension_pairing_status ON browser_extension_pairing_requests(status, expires_at);
   CREATE INDEX IF NOT EXISTS idx_browser_extension_tokens_user ON browser_extension_tokens(user_id, status, created_at DESC);
+  CREATE INDEX IF NOT EXISTS idx_browser_extension_tokens_hash_status ON browser_extension_tokens(token_hash, status);
+  CREATE INDEX IF NOT EXISTS idx_desktop_companion_devices_user ON desktop_companion_devices(user_id, status, created_at DESC);
   CREATE INDEX IF NOT EXISTS idx_messages_user ON messages(user_id, created_at DESC);
   CREATE INDEX IF NOT EXISTS idx_messages_platform ON messages(platform, platform_chat_id);
   CREATE INDEX IF NOT EXISTS idx_conv_messages ON conversation_messages(conversation_id, created_at);
@@ -732,6 +762,21 @@ for (const col of [
   "ALTER TABLE recording_sessions ADD COLUMN duration_ms INTEGER DEFAULT 0",
   "ALTER TABLE recording_sessions ADD COLUMN structured_content_json TEXT",
   "ALTER TABLE artifacts ADD COLUMN metadata_json TEXT DEFAULT '{}'",
+  "ALTER TABLE desktop_companion_devices ADD COLUMN activation_id TEXT",
+  "ALTER TABLE desktop_companion_devices ADD COLUMN app_version TEXT",
+  "ALTER TABLE desktop_companion_devices ADD COLUMN companion_enabled INTEGER DEFAULT 0",
+  "ALTER TABLE desktop_companion_devices ADD COLUMN paused INTEGER DEFAULT 0",
+  "ALTER TABLE desktop_companion_devices ADD COLUMN status TEXT DEFAULT 'offline'",
+  "ALTER TABLE desktop_companion_devices ADD COLUMN display_count INTEGER DEFAULT 0",
+  "ALTER TABLE desktop_companion_devices ADD COLUMN active_display_id TEXT",
+  "ALTER TABLE desktop_companion_devices ADD COLUMN permissions_json TEXT DEFAULT '{}'",
+  "ALTER TABLE desktop_companion_devices ADD COLUMN capabilities_json TEXT DEFAULT '{}'",
+  "ALTER TABLE desktop_companion_devices ADD COLUMN metadata_json TEXT DEFAULT '{}'",
+  "ALTER TABLE desktop_companion_devices ADD COLUMN session_id INTEGER",
+  "ALTER TABLE desktop_companion_devices ADD COLUMN last_connected_at TEXT",
+  "ALTER TABLE desktop_companion_devices ADD COLUMN last_seen_at TEXT",
+  "ALTER TABLE desktop_companion_devices ADD COLUMN revoked_at TEXT",
+  "ALTER TABLE desktop_companion_devices ADD COLUMN updated_at TEXT DEFAULT (datetime('now'))",
 ]) {
   try { db.exec(col); } catch { /* column already exists */ }
 }
@@ -1234,8 +1279,6 @@ rebuildPlatformConnectionsForAgents();
 rebuildCoreMemoryForAgents();
 migrateIntegrationConnectionsTable();
 migrateIntegrationOauthStatesTable();
-backfillAgentIds();
-backfillAgentPolicies();
 createAgentScopedIndexes();
 migrateIntegrationSecretStorage();
 backfillVerifiedAccountEmails();