npm - neoagent - Versions diffs - 2.2.1-beta.7 → 2.3.0 - Mend

neoagent 2.2.1-beta.7 → 2.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (25) hide show

package/docs/index.md +1 -0
package/docs/migration.md +238 -0
package/lib/manager.js +99 -2
package/lib/migrations.js +409 -0
package/package.json +1 -1
package/server/catalog_sources/store-bundles/skills/productivity/migration/SKILL.md +173 -0
package/server/public/assets/fonts/MaterialIcons-Regular.otf +0 -0
package/server/public/flutter_bootstrap.js +1 -1
package/server/public/main.dart.js +72170 -70842
package/server/routes/auth.js +13 -5
package/server/routes/integrations.js +22 -0
package/server/routes/messaging.js +41 -5
package/server/routes/settings.js +1 -0
package/server/services/integrations/google/provider.js +20 -2
package/server/services/integrations/manager.js +79 -8
package/server/services/messaging/access_policy.js +703 -0
package/server/services/messaging/access_policy.test.js +228 -0
package/server/services/messaging/automation.js +32 -95
package/server/services/messaging/base.js +39 -0
package/server/services/messaging/discord.js +61 -46
package/server/services/messaging/http_platforms.js +178 -15
package/server/services/messaging/manager.js +136 -69
package/server/services/messaging/telegram.js +54 -40
package/server/services/messaging/telnyx.js +43 -14
package/server/services/messaging/whatsapp.js +27 -0

package/server/routes/auth.js CHANGED Viewed

@@ -239,18 +239,26 @@ function updateLastLogin(userId) {
 }
 router.get('/api/auth/status', (req, res) => {
+  const count = db.prepare('SELECT COUNT(*) as count FROM users').get();
+  const policy = getDeploymentPolicy();
+  const emailConfig = getEmailConfig();
+  const authProviderManager = getAuthProviderManager(req);
   const currentUser = readAuthenticatedUser(req);
   if (!currentUser) {
     return res.json({
+      hasUser: count.count > 0,
+      registrationOpen: policy.registrationOpen || count.count === 0,
+      deploymentProfile: policy.profile,
       authenticated: false,
       user: null,
+      email: {
+        enabled: emailConfig.enabled,
+        configured: emailConfig.configured,
+        signupConfirmationRequired: requireSignupEmailConfirmation(),
+      },
+      providers: authProviderManager ? authProviderManager.listProviders() : [],
     });
   }
-  const count = db.prepare('SELECT COUNT(*) as count FROM users').get();
-  const policy = getDeploymentPolicy();
-  const emailConfig = getEmailConfig();
-  const authProviderManager = getAuthProviderManager(req);
   res.json({
     hasUser: count.count > 0,
     registrationOpen: policy.registrationOpen || count.count === 0,

package/server/routes/integrations.js CHANGED Viewed

@@ -159,6 +159,7 @@ router.get('/:provider/connect/:sessionId', (req, res) => {
     if (!session) {
       return res.status(404).send('Connection session not found.');
     }
+    const trustedOrigin = JSON.stringify(getTrustedPostMessageOrigin(req));
     const statusUrl = `/api/integrations/${encodeURIComponent(req.params.provider)}/connect/${encodeURIComponent(req.params.sessionId)}/status?agentId=${encodeURIComponent(agentId)}`;
     res.send(`
       <html>
@@ -188,6 +189,14 @@ router.get('/:provider/connect/:sessionId', (req, res) => {
             const statusEl = document.getElementById('status');
             const qrEl = document.getElementById('qr');
             const statusUrl = ${JSON.stringify(statusUrl)};
+            const trustedOrigin = ${trustedOrigin};
+            const provider = ${JSON.stringify(req.params.provider)};
+            const appId = ${JSON.stringify(session.appKey)};
+            function notifyOpener(payload) {
+              if (!window.opener) return;
+              window.opener.postMessage(payload, trustedOrigin);
+            }
             async function refresh() {
               const response = await fetch(statusUrl, { credentials: 'same-origin' });
@@ -204,11 +213,24 @@ router.get('/:provider/connect/:sessionId', (req, res) => {
               } else if (status === 'connected') {
                 qrEl.style.display = 'none';
                 statusEl.textContent = 'Connected as ' + (data.accountEmail || 'your WhatsApp account') + '. Closing…';
+                notifyOpener({
+                  type: 'integration_oauth_success',
+                  provider,
+                  appId,
+                  connectionId: data.connectionId || null,
+                  accountEmail: data.accountEmail || null,
+                });
                 setTimeout(() => window.close(), 800);
                 return;
               } else if (status === 'failed' || status === 'logged_out' || status === 'disconnected') {
                 qrEl.style.display = 'none';
                 statusEl.textContent = data.error || ('Connection ended with status: ' + status + '.');
+                notifyOpener({
+                  type: 'integration_oauth_error',
+                  provider,
+                  appId,
+                  error: data.error || ('Connection ended with status: ' + status + '.'),
+                });
                 return;
               } else {
                 statusEl.textContent = 'Waiting for WhatsApp to generate a QR code…';

package/server/routes/messaging.js CHANGED Viewed

@@ -4,6 +4,11 @@ const db = require('../db/database');
 const { requireAuth } = require('../middleware/auth');
 const { sanitizeError } = require('../utils/security');
 const { getAgentIdFromRequest, resolveAgentId } = require('../services/agents/manager');
+const {
+  legacyWhitelistKey,
+  normalizeAccessPolicy,
+  summarizeAccessPolicy,
+} = require('../services/messaging/access_policy');
 const PREFIXED_ENTRY_RE = /[^0-9a-z:_.@#+=\-!$*]/gi;
@@ -135,6 +140,37 @@ router.get('/status/:platform', (req, res) => {
   res.json(manager.getPlatformStatus(req.session.userId, req.params.platform, { agentId }));
 });
+router.get('/:platform/access-policy', async (req, res) => {
+  try {
+    const manager = req.app.locals.messagingManager;
+    const platform = String(req.params.platform || '').replace(/[^0-9a-z_+-]/gi, '');
+    const agentId = resolveAgentId(req.session.userId, getAgentIdFromRequest(req));
+    if (!platform) return res.status(400).json({ error: 'platform is required' });
+    const catalog = await manager.getAccessCatalog(req.session.userId, platform, { agentId });
+    res.json(catalog);
+  } catch (err) {
+    res.status(500).json({ error: sanitizeError(err) });
+  }
+});
+router.put('/:platform/access-policy', (req, res) => {
+  try {
+    const manager = req.app.locals.messagingManager;
+    const platform = String(req.params.platform || '').replace(/[^0-9a-z_+-]/gi, '');
+    const agentId = resolveAgentId(req.session.userId, getAgentIdFromRequest(req));
+    if (!platform) return res.status(400).json({ error: 'platform is required' });
+    const policy = normalizeAccessPolicy(platform, req.body?.policy || req.body || {});
+    const saved = manager.setAccessPolicy(req.session.userId, platform, policy, { agentId });
+    res.json({
+      success: true,
+      policy: saved,
+      summary: summarizeAccessPolicy(platform, saved),
+    });
+  } catch (err) {
+    res.status(500).json({ error: sanitizeError(err) });
+  }
+});
 router.get('/:platform/devices', (req, res) => {
   try {
     const manager = req.app.locals.messagingManager;
@@ -167,9 +203,9 @@ router.put('/telnyx/whitelist', (req, res) => {
     if (!Array.isArray(numbers)) return res.status(400).json({ error: 'numbers must be an array' });
     const list = numbers.map(n => n.replace(/[^0-9+]/g, '')).filter(Boolean);
     const agentId = resolveAgentId(req.session.userId, getAgentIdFromRequest(req));
-    upsertAgentSetting(req.session.userId, agentId, 'platform_whitelist_telnyx', list);
+    upsertAgentSetting(req.session.userId, agentId, legacyWhitelistKey('telnyx'), list);
     const manager = req.app.locals.messagingManager;
-    if (manager) manager.updateTelnyxAllowedNumbers(req.session.userId, list, { agentId });
+    const policy = manager ? manager.updateTelnyxAllowedNumbers(req.session.userId, list, { agentId }) : null;
     res.json({ success: true, numbers: list });
   } catch (err) {
     res.status(500).json({ error: sanitizeError(err) });
@@ -184,7 +220,7 @@ router.put('/discord/whitelist', (req, res) => {
     // Keep prefixed format, strip only clearly unsafe characters
     const list = ids.map(id => String(id).replace(/[^0-9a-z:_-]/gi, '')).filter(Boolean);
     const agentId = resolveAgentId(req.session.userId, getAgentIdFromRequest(req));
-    upsertAgentSetting(req.session.userId, agentId, 'platform_whitelist_discord', list);
+    upsertAgentSetting(req.session.userId, agentId, legacyWhitelistKey('discord'), list);
     const manager = req.app.locals.messagingManager;
     if (manager) manager.updateDiscordAllowedIds(req.session.userId, list, { agentId });
     res.json({ success: true, ids: list });
@@ -201,7 +237,7 @@ router.put('/telegram/whitelist', (req, res) => {
     // Keep prefixed format; group IDs are negative so allow minus sign
     const list = ids.map(id => String(id).replace(/[^0-9a-z:_-]/gi, '')).filter(Boolean);
     const agentId = resolveAgentId(req.session.userId, getAgentIdFromRequest(req));
-    upsertAgentSetting(req.session.userId, agentId, 'platform_whitelist_telegram', list);
+    upsertAgentSetting(req.session.userId, agentId, legacyWhitelistKey('telegram'), list);
     const manager = req.app.locals.messagingManager;
     if (manager) manager.updateTelegramAllowedIds(req.session.userId, list, { agentId });
     res.json({ success: true, ids: list });
@@ -219,7 +255,7 @@ router.put('/:platform/whitelist', (req, res) => {
     if (!platform) return res.status(400).json({ error: 'platform is required' });
     const list = ids.map(id => String(id).replace(PREFIXED_ENTRY_RE, '')).filter(Boolean);
     const agentId = resolveAgentId(req.session.userId, getAgentIdFromRequest(req));
-    upsertAgentSetting(req.session.userId, agentId, `platform_whitelist_${platform}`, list);
+    upsertAgentSetting(req.session.userId, agentId, legacyWhitelistKey(platform), list);
     const manager = req.app.locals.messagingManager;
     if (manager?.updateAllowedEntries) manager.updateAllowedEntries(req.session.userId, platform, list, { agentId });
     res.json({ success: true, ids: list });

package/server/routes/settings.js CHANGED Viewed

@@ -124,6 +124,7 @@ router.use(requireAuth);
 function isAgentScopedSettingKey(key) {
   return AGENT_SETTING_KEYS.has(key)
     || key.startsWith('platform_whitelist_')
+    || key.startsWith('platform_access_policy_')
     || key === 'platform_voice_secret_telnyx';
 }

package/server/services/integrations/google/provider.js CHANGED Viewed

@@ -144,6 +144,15 @@ function getAppScopes(appId) {
   return Array.from(new Set([...GOOGLE_ACCOUNT_IDENTITY_SCOPES, ...app.scopes]));
 }
+function getAllWorkspaceScopes() {
+  return Array.from(
+    new Set([
+      ...GOOGLE_ACCOUNT_IDENTITY_SCOPES,
+      ...GOOGLE_WORKSPACE_APPS.flatMap((app) => app.scopes || []),
+    ]),
+  );
+}
 function sortConnections(rows) {
   return rows.slice().sort((left, right) => {
     const leftEmail = String(left.account_email || '').toLowerCase();
@@ -381,7 +390,9 @@ function createGoogleWorkspaceProvider() {
       const url = client.generateAuthUrl({
         access_type: 'offline',
         prompt: 'consent',
-        scope: getAppScopes(app.id),
+        // Request the full workspace scope bundle so one durable Google grant can
+        // back Gmail, Calendar, Drive, Docs, and Sheets for the same account.
+        scope: getAllWorkspaceScopes(),
         include_granted_scopes: true,
         state,
         code_challenge: codeChallenge,
@@ -410,7 +421,14 @@ function createGoogleWorkspaceProvider() {
         appId: app.id,
         accountEmail,
         credentials: client.credentials,
-        scopes: getAppScopes(app.id),
+        scopes: Array.from(
+          new Set(
+            String(client.credentials.scope || '')
+              .split(/\s+/)
+              .map((scope) => scope.trim())
+              .filter(Boolean),
+          ),
+        ),
         metadata: {
           appId: app.id,
         },

package/server/services/integrations/manager.js CHANGED Viewed

@@ -53,6 +53,58 @@ class IntegrationManager {
     return merged;
   }
+  findReusableConnection(userId, agentId, providerKey, accountEmail, options = {}) {
+    const normalizedEmail = String(accountEmail || '').trim().toLowerCase();
+    if (!normalizedEmail) return null;
+    const excludedConnectionId = Number(options.excludeConnectionId);
+    const connections = this.listConnections(userId, providerKey, agentId).filter(
+      (connection) =>
+        String(connection.account_email || '').trim().toLowerCase() === normalizedEmail &&
+        connection.status === 'connected' &&
+        (!Number.isInteger(excludedConnectionId) || connection.id !== excludedConnectionId),
+    );
+    if (connections.length === 0) return null;
+    return connections.sort((left, right) =>
+      String(right.updated_at || '').localeCompare(String(left.updated_at || '')),
+    )[0];
+  }
+  mergeWithReusableCredentials(userId, agentId, providerKey, accountEmail, credentials, options = {}) {
+    const reusableConnection = this.findReusableConnection(
+      userId,
+      agentId,
+      providerKey,
+      accountEmail,
+      options,
+    );
+    if (!reusableConnection) {
+      return credentials && typeof credentials === 'object' ? credentials : {};
+    }
+    const reusableCredentials = this.parseCredentials(
+      reusableConnection.credentials_json,
+    );
+    return this.mergeUpdatedCredentials(
+      reusableCredentials,
+      credentials,
+    );
+  }
+  persistSharedCredentials(userId, agentId, providerKey, accountEmail, credentials) {
+    const normalizedEmail = String(accountEmail || '').trim();
+    if (!normalizedEmail) return;
+    db.prepare(
+      `UPDATE integration_connections
+       SET credentials_json = ?, updated_at = datetime('now')
+       WHERE user_id = ? AND agent_id = ? AND provider_key = ? AND lower(account_email) = lower(?)`,
+    ).run(
+      encryptValue(JSON.stringify(credentials || {})),
+      userId,
+      agentId,
+      providerKey,
+      normalizedEmail,
+    );
+  }
   getProvider(providerKey) {
     return this.registry.get(providerKey);
   }
@@ -218,6 +270,19 @@ class IntegrationManager {
       appKey: stateRow.app_key,
     });
+    const mergedCredentials = this.mergeWithReusableCredentials(
+      stateRow.user_id,
+      stateRow.agent_id || resolveAgentId(stateRow.user_id, null),
+      provider.key,
+      result.accountEmail,
+      result.credentials,
+    );
+    if (!mergedCredentials.refresh_token) {
+      throw new Error(
+        `${provider.label} did not return a refresh token, so the connection would expire. Revoke the existing app grant for this provider and reconnect it so offline access is granted.`,
+      );
+    }
     db.prepare(
       `INSERT INTO integration_connections (
          user_id,
@@ -246,10 +311,18 @@ class IntegrationManager {
       stateRow.app_key,
       result.accountEmail,
       JSON.stringify(result.scopes || []),
-      encryptValue(JSON.stringify(result.credentials || {})),
+      encryptValue(JSON.stringify(mergedCredentials)),
       JSON.stringify(result.metadata || {}),
     );
+    this.persistSharedCredentials(
+      stateRow.user_id,
+      stateRow.agent_id || resolveAgentId(stateRow.user_id, null),
+      provider.key,
+      result.accountEmail,
+      mergedCredentials,
+    );
     const connection = db
       .prepare(
         `SELECT * FROM integration_connections
@@ -548,14 +621,12 @@ class IntegrationManager {
           existingCredentials,
           execution.credentials,
         );
-        db.prepare(
-          `UPDATE integration_connections
-           SET credentials_json = ?, updated_at = datetime('now')
-           WHERE id = ? AND user_id = ?`,
-        ).run(
-          encryptValue(JSON.stringify(mergedCredentials)),
-          selection.connection.id,
+        this.persistSharedCredentials(
           userId,
+          resolveAgentId(userId, agentId),
+          provider.key,
+          selection.connection.account_email,
+          mergedCredentials,
         );
       }