neoagent 2.3.1-beta.11 → 2.3.1-beta.111

package/server/routes/account.js

@@ -57,7 +57,7 @@ function accountPayload(req) {
   recordCurrentSession(req, req.session.userId);
   const user = db
     .prepare(
-      `SELECT id, username, email, email_verified_at, created_at, last_login, password_login_enabled
+      `SELECT id, username, display_name, email, email_verified_at, created_at, last_login, password_login_enabled
        FROM users
        WHERE id = ?`,
     )
@@ -68,6 +68,7 @@ function accountPayload(req) {
       ? {
           id: user.id,
           username: user.username,
+          display_name: user.display_name,
           email: user.email,
           email_verified_at: user.email_verified_at,
           created_at: user.created_at,
@@ -90,6 +91,17 @@ function sendRouteError(res, err) {
   res.status(statusCode).json({ error: sanitizeError(err) });
 }
 
+function normalizeDisplayName(value) {
+  const name = String(value || '').trim();
+  if (!name) return null;
+  if (name.length > 64) {
+    const error = new Error('Display name must be 64 characters or fewer.');
+    error.statusCode = 400;
+    throw error;
+  }
+  return name;
+}
+
 router.get('/', (req, res) => {
   try {
     res.json(accountPayload(req));
@@ -98,6 +110,19 @@ router.get('/', (req, res) => {
   }
 });
 
+router.put('/display-name', accountLimiter, (req, res) => {
+  try {
+    const displayName = normalizeDisplayName(req.body?.displayName);
+    db.prepare('UPDATE users SET display_name = ? WHERE id = ?').run(
+      displayName,
+      req.session.userId,
+    );
+    res.json(accountPayload(req));
+  } catch (err) {
+    sendRouteError(res, err);
+  }
+});
+
 router.put('/email', accountLimiter, async (req, res) => {
   try {
     const email = requireValidEmail(req.body?.email);

package/server/routes/agents.js

@@ -4,6 +4,7 @@ const db = require('../db/database');
 const { requireAuth } = require('../middleware/auth');
 const { sanitizeError } = require('../utils/security');
 const { getAgentIdFromRequest, resolveAgentId } = require('../services/agents/manager');
+const { listRunEvents } = require('../services/ai/runEvents');
 const { isInterimAssistantMetadata } = require('../services/ai/interim');
 const { buildAgentRunContext } = require('./_helpers/agentRunContext');
 
@@ -176,12 +177,14 @@ router.get('/:id/steps', (req, res) => {
     || run.final_response
     || null;
 
-  res.json({ run, steps, response });
+  res.json({ run, steps, events: listRunEvents(run.id), response });
 });
 
 // Abort a run
 router.post('/:id/abort', (req, res) => {
   try {
+    const run = db.prepare('SELECT id FROM agent_runs WHERE id = ? AND user_id = ?').get(req.params.id, req.session.userId);
+    if (!run) return res.status(404).json({ error: 'Run not found' });
     const engine = req.app.locals.agentEngine;
     engine.abort(req.params.id);
     res.json({ success: true });
@@ -206,7 +209,8 @@ router.post('/multi-step', async (req, res) => {
   try {
     const { task, steps, options } = req.body;
     const agentId = resolveAgentId(req.session.userId, getAgentIdFromRequest(req));
-    if (!task) return res.status(400).json({ error: 'Task is required' });
+    if (!task || typeof task !== 'string') return res.status(400).json({ error: 'Task must be a non-empty string' });
+    if (task.length > 50000) return res.status(400).json({ error: 'Task exceeds maximum length of 50,000 characters' });
 
     const multiStep = req.app.locals.multiStep;
     if (!multiStep || typeof multiStep.planAndExecute !== 'function') {

package/server/routes/android.js

@@ -6,6 +6,7 @@ const router = express.Router();
 const { DATA_DIR } = require('../../runtime/paths');
 const { requireAuth } = require('../middleware/auth');
 const { sanitizeError } = require('../utils/security');
+const { getRuntimeValidation } = require('../services/runtime/validation');
 
 router.use(requireAuth);
 
@@ -47,11 +48,19 @@ async function getAndroidController(req) {
   if (runtimeManager && typeof runtimeManager.getAndroidProviderForUser === 'function') {
     return runtimeManager.getAndroidProviderForUser(req.session?.userId);
   }
-  const resolver = req.app?.locals?.getAndroidControllerForUser;
-  if (typeof resolver === 'function') {
-    return resolver(req.session?.userId);
-  }
-  return req.app.locals.androidController;
+  throw new Error('Android controller is unavailable.');
+}
+
+function getAndroidStatusSnapshot(req) {
+  const runtimeValidation = getRuntimeValidation(req.app?.locals?.runtimeManager);
+  const ready = Boolean(runtimeValidation?.ready);
+  return {
+    bootstrapped: false,
+    canBootstrap: ready,
+    devices: [],
+    lastStartError: ready ? null : (runtimeValidation?.issues?.[0] || 'VM runtime is not ready.'),
+    runtimeReady: ready,
+  };
 }
 
 function handleAndroidAction(action) {
@@ -66,7 +75,14 @@ function handleAndroidAction(action) {
   };
 }
 
-router.get('/status', handleAndroidAction((controller) => controller.getStatus()));
+router.get('/status', async (req, res) => {
+  try {
+    const controller = await getAndroidController(req);
+    res.json(await controller.getStatus().catch(() => getAndroidStatusSnapshot(req)));
+  } catch (err) {
+    res.status(500).json({ error: sanitizeError(err) });
+  }
+});
 
 router.post('/start', handleAndroidAction((controller, req) =>
   controller.requestStartEmulator(req.body || {})));

package/server/routes/auth.js

@@ -70,11 +70,14 @@ function toUserPayload(user) {
   return {
     id: user.id,
     username: user.username,
+    displayName: user.display_name || null,
+    display_name: user.display_name || null,
     email: user.email || null,
     emailVerifiedAt: user.email_verified_at || null,
     createdAt: user.created_at || null,
     lastLogin: user.last_login || null,
     hasPassword: Number(user.password_login_enabled || 0) === 1,
+    hasCompletedOnboarding: Number(user.has_completed_onboarding || 0) === 1,
   };
 }
 
@@ -119,7 +122,7 @@ function readAuthenticatedUser(req) {
     return null;
   }
   const user = db.prepare(
-    `SELECT id, username, email, email_verified_at, password_login_enabled, created_at, last_login
+    `SELECT id, username, display_name, email, email_verified_at, password_login_enabled, created_at, last_login, has_completed_onboarding
      FROM users
      WHERE id = ?`,
   ).get(req.session.userId);
@@ -322,14 +325,16 @@ router.get('/api/auth/providers/complete', async (req, res) => {
     }
 
     const user = db.prepare(
-      `SELECT id, username, email, email_verified_at, password_login_enabled, created_at, last_login
+      `SELECT id, username, display_name, email, email_verified_at, password_login_enabled, created_at, last_login, has_completed_onboarding
        FROM users
        WHERE id = ?`,
     ).get(completion.result.userId);
     if (!user) {
       return res.status(404).json({ error: 'User not found' });
     }
-    if (getTwoFactorStatus(user.id).enabled) {
+    const providerKey = String(completion.provider || '').trim();
+    const twoFactor = getTwoFactorStatus(user.id);
+    if (twoFactor.enabled) {
       return establishPendingTwoFactorSession(req, res, user);
     }
     updateLastLogin(user.id);
@@ -412,6 +417,7 @@ router.post('/api/auth/register', authLimiter, async (req, res) => {
       password_login_enabled: 1,
       created_at: new Date().toISOString(),
       last_login: null,
+      has_completed_onboarding: 0,
     });
   } catch (err) {
     if (err?.statusCode) {
@@ -443,7 +449,7 @@ router.post('/api/auth/login', authLimiter, async (req, res) => {
     }
 
     const user = db.prepare(
-      `SELECT id, username, email, email_verified_at, password, password_login_enabled, created_at, last_login
+      `SELECT id, username, display_name, email, email_verified_at, password, password_login_enabled, created_at, last_login, has_completed_onboarding
        FROM users
        WHERE username = ?`,
     ).get(username);
@@ -494,7 +500,7 @@ router.post('/api/auth/login/2fa', authLimiter, async (req, res) => {
     }
 
     const user = db.prepare(
-      `SELECT id, username, email, email_verified_at, password_login_enabled, created_at, last_login
+      `SELECT id, username, display_name, email, email_verified_at, password_login_enabled, created_at, last_login, has_completed_onboarding
        FROM users
        WHERE id = ?`,
     ).get(pendingUserId);
@@ -728,4 +734,18 @@ router.get('/api/auth/me', (req, res) => {
   res.json({ user: toUserPayload(user) });
 });
 
+router.post('/api/auth/onboarding/complete', (req, res) => {
+  const user = readAuthenticatedUser(req);
+  if (!user) {
+    return res.status(401).json({ error: 'Not authenticated' });
+  }
+  try {
+    db.prepare('UPDATE users SET has_completed_onboarding = 1 WHERE id = ?').run(user.id);
+    res.json({ success: true });
+  } catch (err) {
+    console.error('Onboarding complete error:', err);
+    res.status(500).json({ error: 'Failed to update onboarding status' });
+  }
+});
+
 module.exports = router;

package/server/routes/browser.js

@@ -2,36 +2,53 @@ const express = require('express');
 const router = express.Router();
 const { requireAuth } = require('../middleware/auth');
 const { sanitizeError } = require('../utils/security');
+const { getRuntimeValidation } = require('../services/runtime/validation');
 
 router.use(requireAuth);
 
 async function getBrowserController(req) {
   const runtimeManager = req.app?.locals?.runtimeManager;
   if (runtimeManager && typeof runtimeManager.getBrowserProviderForUser === 'function') {
+    const start = Date.now();
     const runtimeController = await runtimeManager.getBrowserProviderForUser(req.session?.userId);
+    const duration = Date.now() - start;
+    if (duration > 1000) {
+      console.log(`[HTTP] Browser controller acquired for user ${req.session?.userId} in ${duration}ms`);
+    }
     if (runtimeController) {
       return runtimeController;
     }
   }
-  const resolver = req.app?.locals?.getBrowserControllerForUser;
-  const userId = req.session?.userId;
-  let controller;
-  if (typeof resolver === "function") {
-    controller = await resolver(userId);
-  } else {
-    controller = req.app?.locals?.browserController;
-  }
-
-  if (!controller) {
-    throw new Error(`getBrowserController: missing browser controller for userId=${userId ?? 'unknown'}`);
-  }
+  throw new Error('Browser controller is unavailable. VM runtime is required.');
+}
 
-  return controller;
+function getBrowserStatusSnapshot(req) {
+  const runtimeValidation = getRuntimeValidation(req.app?.locals?.runtimeManager);
+  const ready = Boolean(runtimeValidation?.ready);
+  return {
+    launched: false,
+    pages: 0,
+    headless: true,
+    pageInfo: null,
+    bootstrapped: false,
+    canBootstrap: ready,
+    runtimeReady: ready,
+    lastStartError: ready ? null : (runtimeValidation?.issues?.[0] || 'VM runtime is not ready.'),
+  };
 }
 
 // Get browser status
 router.get('/status', async (req, res) => {
   try {
+    const runtimeManager = req.app?.locals?.runtimeManager;
+    if (!runtimeManager?.hasVmForUser?.(req.session?.userId, 'browser')) {
+      res.json(getBrowserStatusSnapshot(req));
+      return;
+    }
+    if (!await runtimeManager?.isGuestAgentReadyForUser?.(req.session?.userId, 6000, 'browser')) {
+      res.json(getBrowserStatusSnapshot(req));
+      return;
+    }
     const bc = await getBrowserController(req);
     const pageInfo = await bc.getPageInfo();
     res.json({
@@ -39,12 +56,29 @@ router.get('/status', async (req, res) => {
       pages: await Promise.resolve(bc.getPageCount()),
       headless: bc.headless,
       pageInfo,
+      bootstrapped: true,
+      canBootstrap: true,
+      runtimeReady: true,
+      lastStartError: null,
     });
   } catch (err) {
     res.status(500).json({ error: sanitizeError(err) });
   }
 });
 
+router.get('/cookies', async (req, res) => {
+  try {
+    const bc = await getBrowserController(req);
+    if (typeof bc.getCookies !== 'function') {
+      return res.status(501).json({ error: 'Cookie export is unavailable for this browser provider.' });
+    }
+    const result = await bc.getCookies();
+    res.json(result);
+  } catch (err) {
+    res.status(500).json({ error: sanitizeError(err) });
+  }
+});
+
 // Launch browser
 router.post('/launch', async (req, res) => {
   try {

package/server/routes/integrations.js

@@ -1,4 +1,5 @@
 const express = require('express');
+const QRCode = require('qrcode');
 const router = express.Router();
 const { requireAuth } = require('../middleware/auth');
 const { sanitizeError } = require('../utils/security');
@@ -143,6 +144,26 @@ router.get('/oauth/callback', async (req, res) => {
 
 router.use(requireAuth);
 
+router.get('/qr-image', async (req, res) => {
+  try {
+    const data = String(req.query.data || '').trim();
+    if (!data) {
+      return res.status(400).send('Missing QR data.');
+    }
+    const svg = await QRCode.toString(data, {
+      errorCorrectionLevel: 'M',
+      margin: 1,
+      type: 'svg',
+      width: 320,
+    });
+    res.setHeader('Content-Type', 'image/svg+xml; charset=utf-8');
+    res.setHeader('Cache-Control', 'no-store, max-age=0');
+    return res.send(svg);
+  } catch (err) {
+    return res.status(400).send(escapeHtml(sanitizeError(err)));
+  }
+});
+
 router.get('/:provider/connect/:sessionId', (req, res) => {
   try {
     const manager = getIntegrationManager(req);
@@ -211,7 +232,7 @@ router.get('/:provider/connect/:sessionId', (req, res) => {
               const status = String(data.status || 'connecting');
               if (status === 'awaiting_qr' && data.qr) {
                 statusEl.textContent = 'Scan this QR code to continue linking.';
-                qrEl.src = 'https://api.qrserver.com/v1/create-qr-code/?data=' + encodeURIComponent(data.qr) + '&size=320x320';
+                qrEl.src = '/api/integrations/qr-image?data=' + encodeURIComponent(data.qr);
                 qrEl.style.display = 'block';
               } else if (status === 'connected') {
                 qrEl.style.display = 'none';

package/server/routes/memory.js

@@ -4,6 +4,11 @@ const rateLimit = require('express-rate-limit');
 const { requireAuth } = require('../middleware/auth');
 const { sanitizeError } = require('../utils/security');
 const { getAgentIdFromRequest, resolveAgentId } = require('../services/agents/manager');
+const {
+  buildLlmTransferPrompt,
+  parseLlmTransferText,
+  importanceForCategory,
+} = require('../services/memory/llm_transfer');
 
 router.use(requireAuth);
 
@@ -15,6 +20,16 @@ const apiKeyMutationLimiter = rateLimit({
   legacyHeaders: false,
 });
 
+const transferImportLimiter = rateLimit({
+  windowMs: 10 * 60 * 1000,
+  max: 20,
+  message: { error: 'Too many memory imports, try again later' },
+  standardHeaders: true,
+  legacyHeaders: false,
+});
+
+const MAX_TRANSFER_TEXT_BYTES = 60 * 1024;
+
 function normalizeMemoryIds(value) {
   return [...new Set(
     (Array.isArray(value) ? value : [])
@@ -33,6 +48,59 @@ function findOwnedMemoryIds(db, userId, agentId, ids) {
   ).all(userId, agentId, ...ids).map((row) => row.id);
 }
 
+function parsePlainObject(input, fieldName) {
+  if (input == null) return null;
+  if (typeof input === 'string') {
+    try {
+      input = JSON.parse(input);
+    } catch {
+      throw new Error(`${fieldName} must be valid JSON.`);
+    }
+  }
+  if (!input || typeof input !== 'object' || Array.isArray(input)) {
+    throw new Error(`${fieldName} must be an object.`);
+  }
+  return input;
+}
+
+function normalizeOptionalStringField(value, fieldName, maxLength, pattern = null) {
+  if (value == null || value === '') return null;
+  if (typeof value !== 'string') {
+    throw new Error(`${fieldName} must be a string.`);
+  }
+  const normalized = value.trim().slice(0, maxLength);
+  if (!normalized) return null;
+  if (pattern && !pattern.test(normalized)) {
+    throw new Error(`${fieldName} has an invalid format.`);
+  }
+  return normalized;
+}
+
+function normalizeSourceRef(input) {
+  const raw = parsePlainObject(input, 'sourceRef');
+  if (!raw) return undefined;
+  return {
+    sourceType: normalizeOptionalStringField(raw.sourceType ?? raw.type, 'sourceRef.sourceType', 48, /^[a-z0-9_:-]+$/i),
+    sourceId: normalizeOptionalStringField(raw.sourceId ?? raw.id, 'sourceRef.sourceId', 128),
+    sourceLabel: normalizeOptionalStringField(raw.sourceLabel ?? raw.label, 'sourceRef.sourceLabel', 160),
+  };
+}
+
+function normalizeScope(input) {
+  const raw = parsePlainObject(input, 'scope');
+  if (!raw) return undefined;
+  const scopeType = normalizeOptionalStringField(raw.scopeType ?? raw.type, 'scope.scopeType', 32, /^(agent|conversation|task|channel|shared)$/i);
+  return {
+    scopeType: scopeType ? scopeType.toLowerCase() : null,
+    scopeId: normalizeOptionalStringField(raw.scopeId ?? raw.id, 'scope.scopeId', 128),
+  };
+}
+
+function normalizeMetadata(input) {
+  const raw = parsePlainObject(input, 'metadata');
+  return raw == null ? undefined : raw;
+}
+
 // ─────────────────────────────────────────────────────────────────────────────
 // Overview (for initial page load)
 // ─────────────────────────────────────────────────────────────────────────────
@@ -46,6 +114,7 @@ router.get('/', (req, res) => {
   res.json({
     agentId,
     assistantBehaviorNotes: mm.getAssistantBehaviorNotes(userId, { agentId }),
+    assistantSelfState: mm.getAssistantSelfState(userId, { agentId }),
     dailyLogs: mm.listDailyLogs(7, userId),
     apiKeys: Object.keys(mm.readApiKeys(userId)),
     coreMemory
@@ -81,13 +150,31 @@ router.post('/memories', async (req, res) => {
   const mm = req.app.locals.memoryManager;
   const userId = req.session.userId;
   const agentId = resolveAgentId(userId, getAgentIdFromRequest(req));
-  const { content, category = 'episodic', importance = 5 } = req.body;
+  const { content, category = 'episodic', importance = 5, sourceRef, scope, staleAfterDays, metadata } = req.body;
   if (!content || !content.trim()) return res.status(400).json({ error: 'content is required' });
   try {
-    const id = await mm.saveMemory(userId, content, category, importance, { agentId });
+    let normalizedStaleAfterDays;
+    if (staleAfterDays != null && staleAfterDays !== '') {
+      normalizedStaleAfterDays = Number.parseInt(staleAfterDays, 10);
+      if (!Number.isInteger(normalizedStaleAfterDays) || normalizedStaleAfterDays <= 0) {
+        return res.status(400).json({ error: 'staleAfterDays must be a positive integer.' });
+      }
+    }
+
+    const id = await mm.saveMemory(userId, content, category, importance, {
+      agentId,
+      sourceRef: normalizeSourceRef(sourceRef),
+      scope: normalizeScope(scope),
+      staleAfterDays: normalizedStaleAfterDays,
+      metadata: normalizeMetadata(metadata),
+    });
     res.json({ success: true, id });
   } catch (err) {
-    res.status(500).json({ error: sanitizeError(err) });
+    const message = sanitizeError(err);
+    if (/must be valid JSON|must be an object|must be a string|has an invalid format/i.test(message)) {
+      return res.status(400).json({ error: message });
+    }
+    res.status(500).json({ error: message });
   }
 });
 
@@ -117,7 +204,7 @@ router.delete('/memories/:id', (req, res) => {
   const agentId = resolveAgentId(req.session.userId, getAgentIdFromRequest(req));
   const existing = db.prepare('SELECT id FROM memories WHERE id = ? AND user_id = ? AND agent_id = ?').get(req.params.id, req.session.userId, agentId);
   if (!existing) return res.status(404).json({ error: 'Memory not found' });
-  mm.deleteMemory(req.params.id);
+  mm.deleteMemories([req.params.id], req.session.userId);
   res.json({ success: true });
 });
 
@@ -134,7 +221,7 @@ router.post('/memories/bulk-delete', (req, res) => {
     if (!ownedIds.length) {
       return res.status(404).json({ error: 'Memory not found' });
     }
-    const deletedCount = mm.deleteMemories(ownedIds);
+    const deletedCount = mm.deleteMemories(ownedIds, req.session.userId);
     res.json({ success: true, deletedCount });
   } catch (err) {
     res.status(500).json({ error: sanitizeError(err) });
@@ -155,7 +242,7 @@ router.post('/memories/bulk-archive', (req, res) => {
     if (!ownedIds.length) {
       return res.status(404).json({ error: 'Memory not found' });
     }
-    const archivedCount = mm.archiveMemories(ownedIds, archived);
+    const archivedCount = mm.archiveMemories(ownedIds, archived, req.session.userId);
     res.json({ success: true, archivedCount });
   } catch (err) {
     res.status(500).json({ error: sanitizeError(err) });
@@ -190,6 +277,81 @@ router.get('/core', (req, res) => {
   res.json(coreMemory);
 });
 
+// ─────────────────────────────────────────────────────────────────────────────
+// LLM Transfer (prompt + import)
+// ─────────────────────────────────────────────────────────────────────────────
+
+router.get('/transfer-prompt', (req, res) => {
+  const prompt = buildLlmTransferPrompt({ agentLabel: 'NeoAgent' });
+  res.json({ prompt });
+});
+
+router.post('/transfer-import', transferImportLimiter, async (req, res) => {
+  const mm = req.app.locals.memoryManager;
+  const userId = req.session.userId;
+  const agentId = resolveAgentId(userId, getAgentIdFromRequest(req));
+  const text = String(req.body?.text || '').trim();
+  if (!text) {
+    return res.status(400).json({ error: 'text is required' });
+  }
+  if (Buffer.byteLength(text, 'utf8') > MAX_TRANSFER_TEXT_BYTES) {
+    return res.status(413).json({ error: 'text exceeds 60KB limit' });
+  }
+
+  const applyBehaviorNotes = req.body?.applyBehaviorNotes !== false;
+  const applyCoreMemory = req.body?.applyCoreMemory !== false;
+
+  try {
+    const parsed = parseLlmTransferText(text);
+    let importedCount = 0;
+    let skippedCount = 0;
+
+    for (const memory of parsed.memories) {
+      const content = String(memory.content || '').trim();
+      if (!content) {
+        skippedCount += 1;
+        continue;
+      }
+      await mm.saveMemory(userId, content, memory.category, importanceForCategory(memory.category), {
+        agentId,
+        sourceRef: {
+          sourceType: 'llm_import',
+          sourceLabel: 'LLM memory transfer',
+        },
+        metadata: {
+          importedFrom: 'llm_transfer',
+        },
+      });
+      importedCount += 1;
+    }
+
+    let coreUpdatedCount = 0;
+    if (applyCoreMemory && parsed.coreEntries) {
+      for (const [key, value] of Object.entries(parsed.coreEntries)) {
+        if (!key || key === 'active_context') continue;
+        mm.updateCore(userId, key, value, { agentId });
+        coreUpdatedCount += 1;
+      }
+    }
+
+    let behaviorNotesUpdated = false;
+    if (applyBehaviorNotes && parsed.behaviorNotes) {
+      mm.setAssistantBehaviorNotes(userId, parsed.behaviorNotes, { agentId });
+      behaviorNotesUpdated = true;
+    }
+
+    res.json({
+      importedCount,
+      skippedCount,
+      coreUpdatedCount,
+      behaviorNotesUpdated,
+      warnings: parsed.warnings || [],
+    });
+  } catch (err) {
+    res.status(500).json({ error: sanitizeError(err) });
+  }
+});
+
 router.put('/core/:key', (req, res) => {
   const mm = req.app.locals.memoryManager;
   const userId = req.session.userId;

package/server/routes/runtime.js

@@ -0,0 +1,14 @@
+'use strict';
+
+const express = require('express');
+const { getAnalyticsConfig } = require('../config/analytics');
+
+const router = express.Router();
+
+router.get('/config', (req, res) => {
+  res.json({
+    analytics: getAnalyticsConfig(),
+  });
+});
+
+module.exports = router;