neoagent 2.3.1-beta.0 → 2.3.1-beta.100

package/server/routes/memory.js

@@ -1,11 +1,35 @@
 const express = require('express');
 const router = express.Router();
+const rateLimit = require('express-rate-limit');
 const { requireAuth } = require('../middleware/auth');
 const { sanitizeError } = require('../utils/security');
 const { getAgentIdFromRequest, resolveAgentId } = require('../services/agents/manager');
+const {
+  buildLlmTransferPrompt,
+  parseLlmTransferText,
+  importanceForCategory,
+} = require('../services/memory/llm_transfer');
 
 router.use(requireAuth);
 
+const apiKeyMutationLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000,
+  max: 60,
+  message: { error: 'Too many API key update attempts, try again later' },
+  standardHeaders: true,
+  legacyHeaders: false,
+});
+
+const transferImportLimiter = rateLimit({
+  windowMs: 10 * 60 * 1000,
+  max: 20,
+  message: { error: 'Too many memory imports, try again later' },
+  standardHeaders: true,
+  legacyHeaders: false,
+});
+
+const MAX_TRANSFER_TEXT_BYTES = 60 * 1024;
+
 function normalizeMemoryIds(value) {
   return [...new Set(
     (Array.isArray(value) ? value : [])
@@ -24,6 +48,59 @@ function findOwnedMemoryIds(db, userId, agentId, ids) {
   ).all(userId, agentId, ...ids).map((row) => row.id);
 }
 
+function parsePlainObject(input, fieldName) {
+  if (input == null) return null;
+  if (typeof input === 'string') {
+    try {
+      input = JSON.parse(input);
+    } catch {
+      throw new Error(`${fieldName} must be valid JSON.`);
+    }
+  }
+  if (!input || typeof input !== 'object' || Array.isArray(input)) {
+    throw new Error(`${fieldName} must be an object.`);
+  }
+  return input;
+}
+
+function normalizeOptionalStringField(value, fieldName, maxLength, pattern = null) {
+  if (value == null || value === '') return null;
+  if (typeof value !== 'string') {
+    throw new Error(`${fieldName} must be a string.`);
+  }
+  const normalized = value.trim().slice(0, maxLength);
+  if (!normalized) return null;
+  if (pattern && !pattern.test(normalized)) {
+    throw new Error(`${fieldName} has an invalid format.`);
+  }
+  return normalized;
+}
+
+function normalizeSourceRef(input) {
+  const raw = parsePlainObject(input, 'sourceRef');
+  if (!raw) return undefined;
+  return {
+    sourceType: normalizeOptionalStringField(raw.sourceType ?? raw.type, 'sourceRef.sourceType', 48, /^[a-z0-9_:-]+$/i),
+    sourceId: normalizeOptionalStringField(raw.sourceId ?? raw.id, 'sourceRef.sourceId', 128),
+    sourceLabel: normalizeOptionalStringField(raw.sourceLabel ?? raw.label, 'sourceRef.sourceLabel', 160),
+  };
+}
+
+function normalizeScope(input) {
+  const raw = parsePlainObject(input, 'scope');
+  if (!raw) return undefined;
+  const scopeType = normalizeOptionalStringField(raw.scopeType ?? raw.type, 'scope.scopeType', 32, /^(agent|conversation|task|channel|shared)$/i);
+  return {
+    scopeType: scopeType ? scopeType.toLowerCase() : null,
+    scopeId: normalizeOptionalStringField(raw.scopeId ?? raw.id, 'scope.scopeId', 128),
+  };
+}
+
+function normalizeMetadata(input) {
+  const raw = parsePlainObject(input, 'metadata');
+  return raw == null ? undefined : raw;
+}
+
 // ─────────────────────────────────────────────────────────────────────────────
 // Overview (for initial page load)
 // ─────────────────────────────────────────────────────────────────────────────
@@ -37,6 +114,7 @@ router.get('/', (req, res) => {
   res.json({
     agentId,
     assistantBehaviorNotes: mm.getAssistantBehaviorNotes(userId, { agentId }),
+    assistantSelfState: mm.getAssistantSelfState(userId, { agentId }),
     dailyLogs: mm.listDailyLogs(7, userId),
     apiKeys: Object.keys(mm.readApiKeys(userId)),
     coreMemory
@@ -72,13 +150,31 @@ router.post('/memories', async (req, res) => {
   const mm = req.app.locals.memoryManager;
   const userId = req.session.userId;
   const agentId = resolveAgentId(userId, getAgentIdFromRequest(req));
-  const { content, category = 'episodic', importance = 5 } = req.body;
+  const { content, category = 'episodic', importance = 5, sourceRef, scope, staleAfterDays, metadata } = req.body;
   if (!content || !content.trim()) return res.status(400).json({ error: 'content is required' });
   try {
-    const id = await mm.saveMemory(userId, content, category, importance, { agentId });
+    let normalizedStaleAfterDays;
+    if (staleAfterDays != null && staleAfterDays !== '') {
+      normalizedStaleAfterDays = Number.parseInt(staleAfterDays, 10);
+      if (!Number.isInteger(normalizedStaleAfterDays) || normalizedStaleAfterDays <= 0) {
+        return res.status(400).json({ error: 'staleAfterDays must be a positive integer.' });
+      }
+    }
+
+    const id = await mm.saveMemory(userId, content, category, importance, {
+      agentId,
+      sourceRef: normalizeSourceRef(sourceRef),
+      scope: normalizeScope(scope),
+      staleAfterDays: normalizedStaleAfterDays,
+      metadata: normalizeMetadata(metadata),
+    });
     res.json({ success: true, id });
   } catch (err) {
-    res.status(500).json({ error: sanitizeError(err) });
+    const message = sanitizeError(err);
+    if (/must be valid JSON|must be an object|must be a string|has an invalid format/i.test(message)) {
+      return res.status(400).json({ error: message });
+    }
+    res.status(500).json({ error: message });
   }
 });
 
@@ -108,7 +204,7 @@ router.delete('/memories/:id', (req, res) => {
   const agentId = resolveAgentId(req.session.userId, getAgentIdFromRequest(req));
   const existing = db.prepare('SELECT id FROM memories WHERE id = ? AND user_id = ? AND agent_id = ?').get(req.params.id, req.session.userId, agentId);
   if (!existing) return res.status(404).json({ error: 'Memory not found' });
-  mm.deleteMemory(req.params.id);
+  mm.deleteMemories([req.params.id], req.session.userId);
   res.json({ success: true });
 });
 
@@ -125,7 +221,7 @@ router.post('/memories/bulk-delete', (req, res) => {
     if (!ownedIds.length) {
       return res.status(404).json({ error: 'Memory not found' });
     }
-    const deletedCount = mm.deleteMemories(ownedIds);
+    const deletedCount = mm.deleteMemories(ownedIds, req.session.userId);
     res.json({ success: true, deletedCount });
   } catch (err) {
     res.status(500).json({ error: sanitizeError(err) });
@@ -146,7 +242,7 @@ router.post('/memories/bulk-archive', (req, res) => {
     if (!ownedIds.length) {
       return res.status(404).json({ error: 'Memory not found' });
     }
-    const archivedCount = mm.archiveMemories(ownedIds, archived);
+    const archivedCount = mm.archiveMemories(ownedIds, archived, req.session.userId);
     res.json({ success: true, archivedCount });
   } catch (err) {
     res.status(500).json({ error: sanitizeError(err) });
@@ -181,6 +277,81 @@ router.get('/core', (req, res) => {
   res.json(coreMemory);
 });
 
+// ─────────────────────────────────────────────────────────────────────────────
+// LLM Transfer (prompt + import)
+// ─────────────────────────────────────────────────────────────────────────────
+
+router.get('/transfer-prompt', (req, res) => {
+  const prompt = buildLlmTransferPrompt({ agentLabel: 'NeoAgent' });
+  res.json({ prompt });
+});
+
+router.post('/transfer-import', transferImportLimiter, async (req, res) => {
+  const mm = req.app.locals.memoryManager;
+  const userId = req.session.userId;
+  const agentId = resolveAgentId(userId, getAgentIdFromRequest(req));
+  const text = String(req.body?.text || '').trim();
+  if (!text) {
+    return res.status(400).json({ error: 'text is required' });
+  }
+  if (Buffer.byteLength(text, 'utf8') > MAX_TRANSFER_TEXT_BYTES) {
+    return res.status(413).json({ error: 'text exceeds 60KB limit' });
+  }
+
+  const applyBehaviorNotes = req.body?.applyBehaviorNotes !== false;
+  const applyCoreMemory = req.body?.applyCoreMemory !== false;
+
+  try {
+    const parsed = parseLlmTransferText(text);
+    let importedCount = 0;
+    let skippedCount = 0;
+
+    for (const memory of parsed.memories) {
+      const content = String(memory.content || '').trim();
+      if (!content) {
+        skippedCount += 1;
+        continue;
+      }
+      await mm.saveMemory(userId, content, memory.category, importanceForCategory(memory.category), {
+        agentId,
+        sourceRef: {
+          sourceType: 'llm_import',
+          sourceLabel: 'LLM memory transfer',
+        },
+        metadata: {
+          importedFrom: 'llm_transfer',
+        },
+      });
+      importedCount += 1;
+    }
+
+    let coreUpdatedCount = 0;
+    if (applyCoreMemory && parsed.coreEntries) {
+      for (const [key, value] of Object.entries(parsed.coreEntries)) {
+        if (!key || key === 'active_context') continue;
+        mm.updateCore(userId, key, value, { agentId });
+        coreUpdatedCount += 1;
+      }
+    }
+
+    let behaviorNotesUpdated = false;
+    if (applyBehaviorNotes && parsed.behaviorNotes) {
+      mm.setAssistantBehaviorNotes(userId, parsed.behaviorNotes, { agentId });
+      behaviorNotesUpdated = true;
+    }
+
+    res.json({
+      importedCount,
+      skippedCount,
+      coreUpdatedCount,
+      behaviorNotesUpdated,
+      warnings: parsed.warnings || [],
+    });
+  } catch (err) {
+    res.status(500).json({ error: sanitizeError(err) });
+  }
+});
+
 router.put('/core/:key', (req, res) => {
   const mm = req.app.locals.memoryManager;
   const userId = req.session.userId;
@@ -232,12 +403,12 @@ router.get('/api-keys', (req, res) => {
   res.json(masked);
 });
 
-router.put('/api-keys/:service', (req, res) => {
+router.put('/api-keys/:service', apiKeyMutationLimiter, (req, res) => {
   req.app.locals.memoryManager.setApiKey(req.params.service, req.body.key, req.session.userId);
   res.json({ success: true });
 });
 
-router.delete('/api-keys/:service', (req, res) => {
+router.delete('/api-keys/:service', apiKeyMutationLimiter, (req, res) => {
   req.app.locals.memoryManager.deleteApiKey(req.params.service, req.session.userId);
   res.json({ success: true });
 });

package/server/routes/runtime.js

@@ -0,0 +1,14 @@
+'use strict';
+
+const express = require('express');
+const { getAnalyticsConfig } = require('../config/analytics');
+
+const router = express.Router();
+
+router.get('/config', (req, res) => {
+  res.json({
+    analytics: getAnalyticsConfig(),
+  });
+});
+
+module.exports = router;

package/server/routes/screenHistory.js

@@ -0,0 +1,46 @@
+'use strict';
+
+const express = require('express');
+const db = require('../db/database');
+const { getErrorMessage } = require('../services/bootstrap_helpers');
+
+const router = express.Router();
+
+router.get('/search', (req, res) => {
+  const { q, limit = 50, offset = 0 } = req.query;
+
+  if (!req.user || !req.user.id) {
+    return res.status(401).json({ error: 'Unauthorized' });
+  }
+
+  try {
+    let results = [];
+    if (q) {
+      // Full text search
+      results = db.prepare(`
+        SELECT s.id, s.timestamp, s.app_name, s.text_content
+        FROM screen_history_fts fts
+        JOIN screen_history s ON fts.rowid = s.id
+        WHERE screen_history_fts MATCH ? AND s.user_id = ?
+        ORDER BY s.timestamp DESC
+        LIMIT ? OFFSET ?
+      `).all(q, req.user.id, Number(limit), Number(offset));
+    } else {
+      // Recent history
+      results = db.prepare(`
+        SELECT id, timestamp, app_name, text_content
+        FROM screen_history
+        WHERE user_id = ?
+        ORDER BY timestamp DESC
+        LIMIT ? OFFSET ?
+      `).all(req.user.id, Number(limit), Number(offset));
+    }
+
+    res.json({ results });
+  } catch (err) {
+    console.error('[ScreenHistory] Search error:', getErrorMessage(err));
+    res.status(500).json({ error: 'Failed to search screen history' });
+  }
+});
+
+module.exports = router;

package/server/routes/settings.js

@@ -1,5 +1,6 @@
 const express = require('express');
 const router = express.Router();
+const rateLimit = require('express-rate-limit');
 const db = require('../db/database');
 const { requireAuth } = require('../middleware/auth');
 const { normalizeWhatsAppWhitelist } = require('../utils/whatsapp');
@@ -21,6 +22,9 @@ const {
   ensureDefaultAiSettings,
   normalizeProviderConfigs,
 } = require('../services/ai/settings');
+const {
+  readMeshtasticEnabled,
+} = require('../services/messaging/meshtastic_env');
 const {
   ensureDefaultRuntimeSettings,
   getRuntimeSettings,
@@ -75,6 +79,14 @@ const VOICE_SETTING_KEYS = new Set([
   'voice_live_voice',
 ]);
 
+const ENV_BACKED_SETTING_KEYS = new Set([
+  'meshtastic_enabled',
+]);
+
+const READ_ONLY_ENV_SETTING_KEYS = new Set([
+  'meshtastic_enabled',
+]);
+
 function toOptionalTrimmedString(value) {
   if (typeof value !== 'string') return undefined;
   const trimmed = value.trim();
@@ -95,7 +107,15 @@ function extractVoiceSettings(payload = {}) {
   };
 }
 
-router.get('/update/status', (req, res) => {
+const updateTriggerLimiter = rateLimit({
+  windowMs: 5 * 60 * 1000,
+  max: 3,
+  message: { success: false, error: 'Too many update requests, try again later' },
+  standardHeaders: true,
+  legacyHeaders: false,
+});
+
+router.get('/update/status', requireAuth, (req, res) => {
   const status = readUpdateStatus();
   const version = getVersionInfo();
   res.json({
@@ -133,22 +153,41 @@ function getBrowserController(req) {
   if (runtimeManager && typeof runtimeManager.getBrowserProviderForUser === 'function') {
     return runtimeManager.getBrowserProviderForUser(req.session?.userId);
   }
-  const resolver = req.app?.locals?.getBrowserControllerForUser;
-  if (typeof resolver === 'function') {
-    return resolver(req.session?.userId);
-  }
-  return req.app?.locals?.browserController;
+  throw new Error('Browser controller is unavailable. VM runtime is required.');
 }
 
-function applyHeadlessSetting(req, value) {
-  Promise.resolve(getBrowserController(req))
-    .then((controller) => {
-      if (controller && typeof controller.setHeadless === 'function') {
-        return controller.setHeadless(value);
-      }
+
+
+function isEnvBackedSettingKey(key) {
+  return ENV_BACKED_SETTING_KEYS.has(key);
+}
+
+function readEnvBackedSettingValue(key) {
+  switch (key) {
+    case 'meshtastic_enabled':
+      return readMeshtasticEnabled();
+    default:
       return null;
-    })
-    .catch(() => { });
+  }
+}
+
+async function writeEnvBackedSettingValue(req, key, value) {
+  switch (key) {
+    case 'meshtastic_enabled':
+      return readMeshtasticEnabled();
+    default:
+      return value;
+  }
+}
+
+async function resetEnvBackedSettingValue(req, key) {
+  switch (key) {
+    case 'meshtastic_enabled': {
+      return;
+    }
+    default:
+      return;
+  }
 }
 
 // Get supported models metadata
@@ -209,11 +248,17 @@ router.get('/', (req, res) => {
   }
   settings.agentId = agentId;
   settings.ai_provider_configs = normalizeProviderConfigs(settings.ai_provider_configs);
+  settings.meshtastic_enabled = readMeshtasticEnabled();
+  
+  // Normalize runtime settings for consistency across deployments
+  const normalizedRuntime = getRuntimeSettings(req.session.userId);
+  Object.assign(settings, normalizedRuntime);
+  
   res.json(settings);
 });
 
 // Update settings (batch)
-router.put('/', (req, res) => {
+router.put('/', async (req, res) => {
   const userId = req.session.userId;
   const agentId = resolveAgentId(userId, getAgentIdFromRequest(req));
   ensureDefaultAiSettings(userId, agentId);
@@ -238,6 +283,16 @@ router.put('/', (req, res) => {
     normalizedBody.ai_provider_configs = normalizeProviderConfigs(normalizedBody.ai_provider_configs);
   }
 
+  for (const key of Object.keys(normalizedBody)) {
+    if (READ_ONLY_ENV_SETTING_KEYS.has(key)) {
+      delete normalizedBody[key];
+      continue;
+    }
+    if (isEnvBackedSettingKey(key)) {
+      normalizedBody[key] = await writeEnvBackedSettingValue(req, key, normalizedBody[key]);
+    }
+  }
+
   if (
     'runtime_profile' in normalizedBody
     || 'runtime_backend' in normalizedBody
@@ -264,6 +319,8 @@ router.put('/', (req, res) => {
       const v = serializeRuntimeSettingValue(key, value);
       if (isAgentScopedSettingKey(key)) {
         upsertAgent.run(userId, agentId, key, v);
+      } else if (isEnvBackedSettingKey(key)) {
+        continue;
       } else if (key !== 'agentId' && key !== 'agent_id') {
         upsert.run(userId, key, v);
       }
@@ -281,10 +338,7 @@ router.put('/', (req, res) => {
     }
   }
 
-  // Apply headless toggle immediately without restarting
-  if ('headless_browser' in normalizedBody) {
-    applyHeadlessSetting(req, normalizedBody.headless_browser);
-  }
+
 
   res.json({ success: true });
 });
@@ -377,6 +431,9 @@ router.get('/token-usage/summary', (req, res) => {
 
 // Get single setting
 router.get('/:key', (req, res) => {
+  if (isEnvBackedSettingKey(req.params.key)) {
+    return res.json({ value: readEnvBackedSettingValue(req.params.key) });
+  }
   const userId = req.session.userId;
   const agentId = resolveAgentId(userId, getAgentIdFromRequest(req));
   ensureDefaultRuntimeSettings(userId);
@@ -401,11 +458,22 @@ router.get('/:key', (req, res) => {
 });
 
 // Set single setting
-router.put('/:key', (req, res) => {
+router.put('/:key', async (req, res) => {
   const userId = req.session.userId;
   const agentId = resolveAgentId(userId, getAgentIdFromRequest(req));
   ensureDefaultRuntimeSettings(userId);
   let value = req.body.value;
+  if (READ_ONLY_ENV_SETTING_KEYS.has(req.params.key)) {
+    return res.status(403).json({
+      success: false,
+      error: `${req.params.key} is managed via environment only`,
+      value: readEnvBackedSettingValue(req.params.key),
+    });
+  }
+  if (isEnvBackedSettingKey(req.params.key)) {
+    const saved = await writeEnvBackedSettingValue(req, req.params.key, value);
+    return res.json({ success: true, value: saved });
+  }
   if (req.params.key === 'platform_whitelist_whatsapp') {
     if (typeof value === 'string') {
       try {
@@ -459,14 +527,24 @@ router.put('/:key', (req, res) => {
     }
   }
 
-  if (req.params.key === 'headless_browser') {
-    applyHeadlessSetting(req, value);
-  }
+
   res.json({ success: true });
 });
 
 // Delete setting
 router.delete('/:key', (req, res) => {
+  if (READ_ONLY_ENV_SETTING_KEYS.has(req.params.key)) {
+    return res.status(403).json({
+      success: false,
+      error: `${req.params.key} is managed via environment only`,
+      value: readEnvBackedSettingValue(req.params.key),
+    });
+  }
+  if (isEnvBackedSettingKey(req.params.key)) {
+    return resetEnvBackedSettingValue(req, req.params.key)
+      .then(() => res.json({ success: true }))
+      .catch((err) => res.status(500).json({ success: false, error: err.message }));
+  }
   const userId = req.session.userId;
   const agentId = resolveAgentId(userId, getAgentIdFromRequest(req));
   if (
@@ -481,7 +559,7 @@ router.delete('/:key', (req, res) => {
 });
 
 // Trigger auto-update script
-router.post('/update', (req, res) => {
+router.post('/update', requireAuth, updateTriggerLimiter, (req, res) => {
   if (isManagedDeployment()) {
     return res.status(403).json({
       success: false,

package/server/routes/skills.js

@@ -10,6 +10,12 @@ const {
 
 router.use(requireAuth);
 
+const SHELL_METACHAR_RE = /[;&|`$\n\r(){}\\<>]/;
+function isValidCommandTemplate(template) {
+  const bare = String(template).replace(/\{[^{}]*\}/g, '');
+  return !SHELL_METACHAR_RE.test(bare);
+}
+
 function parseSkillDocument(content) {
   const match = String(content || '').match(/^---\n([\s\S]*?)\n---\n?([\s\S]*)$/);
   if (!match) {
@@ -79,6 +85,9 @@ router.post('/', async (req, res) => {
     const runner = await getSkillRunner(req.app);
     const parsed = parseSkillDocument(req.body.content);
     if (parsed.error) return res.status(400).json({ error: parsed.error });
+    if (parsed.metadata?.command && !isValidCommandTemplate(parsed.metadata.command)) {
+      return res.status(400).json({ error: 'Skill command template contains invalid characters' });
+    }
 
     const result = runner.createSkill(
       req.body.filename || parsed.name,
@@ -105,6 +114,9 @@ router.put('/:name', async (req, res) => {
 
     const parsed = parseSkillDocument(req.body.content);
     if (parsed.error) return res.status(400).json({ error: parsed.error });
+    if (parsed.metadata?.command && !isValidCommandTemplate(parsed.metadata.command)) {
+      return res.status(400).json({ error: 'Skill command template contains invalid characters' });
+    }
     const result = runner.updateSkill(req.params.name, {
       description: parsed.description,
       instructions: parsed.instructions,

package/server/routes/social_video.js

@@ -0,0 +1,66 @@
+const express = require('express');
+const { requireAuth } = require('../middleware/auth');
+const { getAgentIdFromRequest, resolveAgentId } = require('../services/agents/manager');
+const { sanitizeError } = require('../utils/security');
+
+const router = express.Router();
+
+router.use(requireAuth);
+
+router.get('/health', async (req, res) => {
+  try {
+    const service = req.app?.locals?.socialVideoService;
+    if (!service || typeof service.getHealthStatus !== 'function') {
+      return res.status(503).json({
+        ready: false,
+        error: 'Social video service is unavailable.',
+      });
+    }
+    const health = await service.getHealthStatus({
+      forceRefresh: req.query?.refresh === '1' || req.query?.refresh === 'true',
+    });
+    return res.json(health);
+  } catch (error) {
+    return res.status(500).json({ error: sanitizeError(error) });
+  }
+});
+
+router.post('/extract', async (req, res) => {
+  try {
+    const service = req.app?.locals?.socialVideoService;
+    if (!service || typeof service.extractFromUrl !== 'function') {
+      return res.status(503).json({ error: 'Social video service is unavailable.' });
+    }
+    if (!req.session || !req.session.userId) {
+      return res.status(401).json({ error: 'Authentication required.' });
+    }
+
+    const sourceUrl = String(req.body?.url || '').trim();
+    if (!sourceUrl) {
+      return res.status(400).json({ error: 'url is required.' });
+    }
+
+    const agentId = resolveAgentId(req.session.userId, getAgentIdFromRequest(req));
+
+    const result = await service.extractFromUrl(req.session.userId, sourceUrl, {
+      includeFrame: req.body?.include_frame !== false,
+      forceStt: req.body?.force_stt === true,
+      agentId,
+    });
+
+    if (result?.setup?.ready === false) {
+      return res.status(503).json(result);
+    }
+
+    if (Array.isArray(result.errors) && result.errors.length > 0) {
+      const failed = !result.title && !result.description && !result.transcript && !result.frameImage;
+      return res.status(failed ? 422 : 200).json(result);
+    }
+
+    return res.json(result);
+  } catch (error) {
+    return res.status(500).json({ error: sanitizeError(error) });
+  }
+});
+
+module.exports = router;

package/server/routes/tasks.js

@@ -32,8 +32,17 @@ router.post('/', async (req, res) => {
   try {
     const tasks = req.app.locals.taskRuntime;
     const agentId = resolveAgentId(req.session.userId, getAgentIdFromRequest(req));
+    const {
+      name, triggerType, trigger_type, triggerConfig, trigger_config,
+      taskType, task_type, taskConfig, task_config, enabled,
+      prompt, callTo, callGreeting, model,
+      oneTime, one_time, cronExpression, cron_expression, runAt, run_at,
+    } = req.body || {};
     const task = await tasks.createTask(req.session.userId, {
-      ...req.body,
+      name, triggerType, trigger_type, triggerConfig, trigger_config,
+      taskType, task_type, taskConfig, task_config, enabled,
+      prompt, callTo, callGreeting, model,
+      oneTime, one_time, cronExpression, cron_expression, runAt, run_at,
       agentId,
     });
     res.status(201).json(task);
@@ -49,7 +58,18 @@ router.put('/:id', async (req, res) => {
       return res.status(400).json({ error: 'Invalid task id' });
     }
     const tasks = req.app.locals.taskRuntime;
-    const task = await tasks.updateTask(taskId, req.session.userId, req.body);
+    const {
+      name, triggerType, trigger_type, triggerConfig, trigger_config,
+      taskType, task_type, taskConfig, task_config, enabled,
+      prompt, callTo, callGreeting, model,
+      oneTime, one_time, cronExpression, cron_expression, runAt, run_at,
+    } = req.body || {};
+    const task = await tasks.updateTask(taskId, req.session.userId, {
+      name, triggerType, trigger_type, triggerConfig, trigger_config,
+      taskType, task_type, taskConfig, task_config, enabled,
+      prompt, callTo, callGreeting, model,
+      oneTime, one_time, cronExpression, cron_expression, runAt, run_at,
+    });
     res.json(task);
   } catch (err) {
     res.status(400).json({ error: sanitizeError(err) });