neoagent 2.3.0 → 2.3.1-beta.10

package/server/services/widgets/service.js

@@ -243,7 +243,11 @@ class WidgetService {
        WHERE id = ? AND user_id = ?`
     ).get(widgetId, userId);
     if (!row) return null;
-    return this._serializeWidget(row, this._loadLatestSnapshotMap([widgetId]).get(widgetId) || null);
+    return this._serializeWidget(
+      row,
+      this._loadLatestSnapshotMap([widgetId]).get(widgetId) || null,
+      this._loadWidgetTasksMap([widgetId], userId).get(widgetId) || []
+    );
   }
 
   listWidgets(userId, { agentId = null } = {}) {
@@ -262,7 +266,8 @@ class WidgetService {
          ORDER BY updated_at DESC, created_at DESC`
       ).all(userId);
     const snapshotMap = this._loadLatestSnapshotMap(rows.map((row) => row.id));
-    return rows.map((row) => this._serializeWidget(row, snapshotMap.get(row.id) || null));
+    const tasksMap = this._loadWidgetTasksMap(rows.map((row) => row.id), userId);
+    return rows.map((row) => this._serializeWidget(row, snapshotMap.get(row.id) || null, tasksMap.get(row.id) || []));
   }
 
   listLatestSnapshots(userId, { agentId = null } = {}) {
@@ -343,7 +348,7 @@ class WidgetService {
       throw new Error('Widget not found.');
     }
 
-    const current = this._serializeWidget(existingRow, null);
+    const current = this._serializeWidget(existingRow, null, []);
     const normalized = normalizeWidgetInput({
       name: input.name ?? current.name,
       template: input.template ?? current.template,
@@ -581,7 +586,46 @@ class WidgetService {
     return map;
   }
 
-  _serializeWidget(row, latestSnapshot) {
+  _loadWidgetTasksMap(widgetIds, userId) {
+    const ids = Array.from(new Set(widgetIds.filter(Boolean)));
+    const map = new Map();
+    if (!ids.length) return map;
+    
+    const placeholders = ids.map(() => '?').join(', ');
+    const params = [userId, ...ids];
+    
+    // We filter tasks where task_type is NOT 'widget_refresh' 
+    // and where the task_config contains the widgetId.
+    const rows = db.prepare(
+      `SELECT id, name, trigger_type, enabled, task_config
+       FROM scheduled_tasks
+       WHERE user_id = ?
+         AND task_type != 'widget_refresh'
+         AND json_extract(task_config, '$.widgetId') IN (${placeholders})
+       ORDER BY created_at ASC`
+    ).all(...params);
+    
+    for (const row of rows) {
+      const config = parseJsonObject(row.task_config, {});
+      const widgetId = config.widgetId;
+      if (!widgetId) continue;
+      
+      const task = {
+        id: row.id,
+        name: row.name,
+        triggerType: row.trigger_type,
+        enabled: row.enabled !== 0 && row.enabled !== false,
+      };
+      
+      if (!map.has(widgetId)) {
+        map.set(widgetId, []);
+      }
+      map.get(widgetId).push(task);
+    }
+    return map;
+  }
+
+  _serializeWidget(row, latestSnapshot, tasks = []) {
     const definition = parseJsonObject(row.definition_json, {});
     return {
       id: row.id,
@@ -600,6 +644,7 @@ class WidgetService {
       updatedAt: row.updated_at || null,
       nextRefresh: row.refresh_cron ? findNextRun(row.refresh_cron)?.toISOString() || null : null,
       latestSnapshot,
+      tasks,
     };
   }
 }

package/server/utils/local_secrets.js

@@ -0,0 +1,56 @@
+'use strict';
+
+const crypto = require('crypto');
+const { getSessionSecret } = require('../services/account/session_secret');
+
+const LOCAL_SECRET_PREFIX = 'enc:local:v1:';
+
+function getLocalSecretMaterial() {
+  const configured = String(process.env.NEOAGENT_DATA_ENCRYPTION_KEY || '').trim();
+  if (configured) return configured;
+  return getSessionSecret();
+}
+
+function deriveKey() {
+  return crypto.createHash('sha256').update(getLocalSecretMaterial()).digest();
+}
+
+function isLocalEncryptedValue(value) {
+  return String(value || '').startsWith(LOCAL_SECRET_PREFIX);
+}
+
+function encryptLocalValue(value) {
+  const text = String(value || '');
+  if (!text) return '';
+  if (isLocalEncryptedValue(text)) return text;
+
+  const iv = crypto.randomBytes(12);
+  const cipher = crypto.createCipheriv('aes-256-gcm', deriveKey(), iv);
+  const encrypted = Buffer.concat([cipher.update(text, 'utf8'), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return `${LOCAL_SECRET_PREFIX}${Buffer.concat([iv, tag, encrypted]).toString('base64')}`;
+}
+
+function decryptLocalValue(value) {
+  const text = String(value || '');
+  if (!text) return '';
+  if (!isLocalEncryptedValue(text)) return text;
+
+  try {
+    const payload = Buffer.from(text.slice(LOCAL_SECRET_PREFIX.length), 'base64');
+    const iv = payload.subarray(0, 12);
+    const tag = payload.subarray(12, 28);
+    const ciphertext = payload.subarray(28);
+    const decipher = crypto.createDecipheriv('aes-256-gcm', deriveKey(), iv);
+    decipher.setAuthTag(tag);
+    return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf8');
+  } catch {
+    return '';
+  }
+}
+
+module.exports = {
+  decryptLocalValue,
+  encryptLocalValue,
+  isLocalEncryptedValue,
+};

package/server/utils/logger.js

@@ -1,14 +1,36 @@
 'use strict';
 
+const SENSITIVE_KEY_RE = /(?:^|_|-)(?:token|secret|password|api[_-]?key|authorization|cookie|session(?:id)?|sid)(?:$|_|-)/i;
+
+function redactSecrets(input) {
+    let text = String(input || '');
+    if (!text) return text;
+
+    text = text
+        .replace(/\b(Bearer\s+)[A-Za-z0-9._~+\/-]+=*/gi, '$1[redacted]')
+        .replace(/([?&](?:token|access_token|refresh_token|api[_-]?key|secret|password|authorization|cookie|session|sid)=)([^&#\s]+)/gi, '$1[redacted]')
+        .replace(/\b(token|access_token|refresh_token|authorization|api[_-]?key|secret|password|cookie|session(?:id)?|sid)\b\s*[:=]\s*("[^"]*"|'[^']*'|[^,\s;]+)/gi, '$1=[redacted]');
+
+    return text;
+}
+
+function sanitizeUrl(value) {
+    return redactSecrets(String(value || ''));
+}
+
+function isSensitiveKey(key) {
+    return SENSITIVE_KEY_RE.test(String(key || ''));
+}
+
 function serializeValue(value, seen = new WeakSet()) {
     if (value instanceof Error) {
         return JSON.stringify({
             name: value.name,
-            message: value.message,
-            stack: value.stack,
+            message: redactSecrets(value.message),
+            stack: redactSecrets(value.stack),
             code: value.code,
             cause: value.cause instanceof Error
-                ? { name: value.cause.name, message: value.cause.message, stack: value.cause.stack }
+                ? { name: value.cause.name, message: redactSecrets(value.cause.message), stack: redactSecrets(value.cause.stack) }
                 : value.cause
         });
     }
@@ -22,7 +44,7 @@ function serializeValue(value, seen = new WeakSet()) {
     }
 
     if (!value || typeof value !== 'object') {
-        return String(value);
+        return redactSecrets(String(value));
     }
 
     if (seen.has(value)) {
@@ -33,21 +55,27 @@ function serializeValue(value, seen = new WeakSet()) {
 
     try {
         return JSON.stringify(value, (key, nestedValue) => {
+            if (isSensitiveKey(key)) {
+                return '[redacted]';
+            }
             if (nestedValue instanceof Error) {
                 return {
                     name: nestedValue.name,
-                    message: nestedValue.message,
-                    stack: nestedValue.stack,
+                    message: redactSecrets(nestedValue.message),
+                    stack: redactSecrets(nestedValue.stack),
                     code: nestedValue.code
                 };
             }
             if (typeof nestedValue === 'bigint') {
                 return nestedValue.toString();
             }
+            if (typeof nestedValue === 'string') {
+                return redactSecrets(nestedValue);
+            }
             return nestedValue;
         });
     } catch (err) {
-        return `[Unserializable object: ${err.message}]`;
+        return `[Unserializable object: ${redactSecrets(err.message)}]`;
     } finally {
         seen.delete(value);
     }
@@ -58,14 +86,14 @@ function formatLogArgs(args) {
 }
 
 function logRequestSummary(level, req, message, extra = null) {
-    const prefix = `[HTTP] ${req.method} ${req.originalUrl || req.url}`;
+    const prefix = `[HTTP] ${req.method} ${sanitizeUrl(req.originalUrl || req.url)}`;
     const summary = {
         ip: req.ip,
         userId: req.session?.userId || null,
         userAgent: req.get?.('user-agent') || null,
         ...extra
     };
-    console[level](`${prefix} ${message}`, summary);
+    console[level](redactSecrets(`${prefix} ${message}`), summary);
 }
 
 /**