neoagent 2.3.1-beta.11 → 2.3.1-beta.111

package/server/services/desktop/screenRecorder.js

@@ -12,16 +12,52 @@ const { getErrorMessage } = require('../bootstrap_helpers');
 const execAsync = promisify(exec);
 
 class ScreenRecorder {
-  constructor() {
+  constructor(options = {}) {
     this.intervalMs = 10000; // 10 seconds
     this.intervalId = null;
     this.cleanupIntervalId = null;
     this.isRecording = false;
     this.isProcessing = false;
     this.tempFilePath = path.join(os.tmpdir(), `neoagent-screen-${Date.now()}.png`);
+    this.lastBenignSkipAt = 0;
+    this.hasActiveRemoteCaptureSession = typeof options.hasActiveRemoteCaptureSession === 'function'
+      ? options.hasActiveRemoteCaptureSession
+      : () => false;
+  }
+
+  _isCaptureInactiveApp(appName) {
+    const normalized = String(appName || '').trim().toLowerCase();
+    return normalized === '' || normalized === 'loginwindow' || normalized === 'screensaverengine';
+  }
+
+  _isBenignCaptureError(message) {
+    const text = String(message || '').toLowerCase();
+    return (
+      text.includes('operation not permitted') ||
+      text.includes('not authorized') ||
+      text.includes('user canceled') ||
+      text.includes('cgwindowlistcreateimage') ||
+      text.includes('screencapture') ||
+      text.includes('timed out')
+    );
+  }
+
+  _logBenignSkip(reason) {
+    const now = Date.now();
+    if (now - this.lastBenignSkipAt < 5 * 60 * 1000) {
+      return;
+    }
+    this.lastBenignSkipAt = now;
+    console.log(`[ScreenRecorder] Capture skipped: ${reason}`);
   }
 
   start() {
+    const enabledEnv = String(process.env.NEOAGENT_SCREEN_RECORDER_ENABLED || '').trim().toLowerCase();
+    if (enabledEnv === '0' || enabledEnv === 'false' || enabledEnv === 'off' || enabledEnv === 'no') {
+      console.log('[ScreenRecorder] Not starting: disabled by NEOAGENT_SCREEN_RECORDER_ENABLED.');
+      return;
+    }
+
     if (process.platform !== 'darwin') {
       console.log('[ScreenRecorder] Not starting: Screen recording is currently macOS only.');
       return;
@@ -61,6 +97,27 @@ class ScreenRecorder {
     this.isProcessing = true;
 
     try {
+      // Only capture while at least one external device/session is actively connected.
+      // This prevents host-level screenshots when no user-side capture source is live.
+      if (!this.hasActiveRemoteCaptureSession()) {
+        this._logBenignSkip('no active external capture session');
+        return;
+      }
+
+      // Skip capture when the desktop session is inactive (e.g. locked screen).
+      let frontmostApp = '';
+      try {
+        const { stdout } = await execAsync(`osascript -e 'tell application "System Events" to get name of first application process whose frontmost is true'`);
+        frontmostApp = (stdout || '').trim();
+      } catch {
+        frontmostApp = '';
+      }
+
+      if (this._isCaptureInactiveApp(frontmostApp)) {
+        this._logBenignSkip('no active frontmost app');
+        return;
+      }
+
       // Capture screen silently (-x) to file
       await execAsync(`screencapture -x "${this.tempFilePath}"`);
 
@@ -80,13 +137,7 @@ class ScreenRecorder {
         const userRow = db.prepare('SELECT id FROM users ORDER BY id ASC LIMIT 1').get();
         if (userRow) {
           // Identify the active foreground app via AppleScript
-          let appName = 'Unknown';
-          try {
-            const { stdout } = await execAsync(`osascript -e 'tell application "System Events" to get name of first application process whose frontmost is true'`);
-            appName = stdout.trim();
-          } catch (e) {
-            // Ignore AppleScript errors
-          }
+          let appName = frontmostApp || 'Unknown';
 
           db.prepare(`
             INSERT INTO screen_history (user_id, app_name, text_content)
@@ -96,7 +147,12 @@ class ScreenRecorder {
       }
 
     } catch (err) {
-      console.error('[ScreenRecorder] Capture/OCR failed:', getErrorMessage(err));
+      const errorMessage = getErrorMessage(err);
+      if (this._isBenignCaptureError(errorMessage)) {
+        this._logBenignSkip(errorMessage);
+      } else {
+        console.error('[ScreenRecorder] Capture/OCR failed:', errorMessage);
+      }
     } finally {
       // Always cleanup the screenshot image immediately
       try {

package/server/services/integrations/figma/provider.js

@@ -240,6 +240,7 @@ function createFigmaProvider() {
     description:
       'Official Figma OAuth account connections for future design file and collaboration workflows.',
     icon: 'figma',
+    requiresRefreshToken: true,
     apps: FIGMA_APPS,
     toolDefinitions: figmaToolDefinitions,
     connectPrompt:

package/server/services/integrations/github/provider.js

@@ -337,15 +337,15 @@ function createGithubProvider() {
         method: 'POST',
         headers: {
           'Accept': 'application/json',
-          'Content-Type': 'application/json',
+          'Content-Type': 'application/x-www-form-urlencoded',
         },
-        body: JSON.stringify({
+        body: new URLSearchParams({
           client_id: config.clientId,
           client_secret: config.clientSecret,
           code,
           code_verifier: codeVerifier,
           redirect_uri: config.redirectUri,
-        }),
+        }).toString(),
       });
 
       const tokenBody = await tokenResponse.text();

package/server/services/integrations/google/provider.js

@@ -300,6 +300,7 @@ function createGoogleWorkspaceProvider() {
     description:
       'Official Gmail, Calendar, Drive, Docs, and Sheets integrations with app-specific accounts.',
     icon: 'google',
+    requiresRefreshToken: true,
     apps: GOOGLE_WORKSPACE_APPS.map(({ id, label, description }) => ({
       id,
       label,

package/server/services/integrations/manager.js

@@ -29,6 +29,27 @@ function isLikelyExpiredConnectionError(error) {
   ].some((hint) => message.includes(hint));
 }
 
+function assertDurableOAuthCredentials(provider, credentials) {
+  const label = String(provider?.label || 'This integration').trim() || 'This integration';
+  const normalizedCredentials =
+    credentials && typeof credentials === 'object' ? credentials : {};
+
+  if (!String(normalizedCredentials.access_token || '').trim()) {
+    throw new Error(
+      `${label} did not return an access token, so the connection could not be completed.`,
+    );
+  }
+
+  if (
+    provider?.requiresRefreshToken === true &&
+    !String(normalizedCredentials.refresh_token || '').trim()
+  ) {
+    throw new Error(
+      `${label} did not return a refresh token, so the connection would expire. Revoke the existing app grant for this provider and reconnect it so offline access is granted.`,
+    );
+  }
+}
+
 class IntegrationManager {
   constructor(options = {}) {
     this.app = options.app || null;
@@ -217,6 +238,7 @@ class IntegrationManager {
       state,
       codeVerifier,
       userId,
+      agentId,
       appKey,
     });
 
@@ -288,6 +310,7 @@ class IntegrationManager {
 
     const result = await provider.finishOAuth({
       userId: stateRow.user_id,
+      agentId: stateRow.agent_id || resolveAgentId(stateRow.user_id, null),
       state: stateRow.state,
       code: normalizedCode,
       codeVerifier: decryptValue(stateRow.code_verifier),
@@ -301,11 +324,7 @@ class IntegrationManager {
       result.accountEmail,
       result.credentials,
     );
-    if (!mergedCredentials.refresh_token) {
-      throw new Error(
-        `${provider.label} did not return a refresh token, so the connection would expire. Revoke the existing app grant for this provider and reconnect it so offline access is granted.`,
-      );
-    }
+    assertDurableOAuthCredentials(provider, mergedCredentials);
 
     db.prepare(
       `INSERT INTO integration_connections (
@@ -725,5 +744,6 @@ class IntegrationManager {
 }
 
 module.exports = {
+  assertDurableOAuthCredentials,
   IntegrationManager,
 };

package/server/services/integrations/microsoft/provider.js

@@ -346,6 +346,7 @@ function createMicrosoftProvider() {
     description:
       'Official Microsoft 365 OAuth account connections for Outlook, Calendar, OneDrive, and Teams.',
     icon: 'microsoft',
+    requiresRefreshToken: true,
     apps: MICROSOFT_APPS,
     toolDefinitions: microsoftToolDefinitions,
     connectPrompt:

package/server/services/integrations/oauth_provider.js

@@ -241,8 +241,11 @@ function createOAuthProvider(options = {}) {
     label: options.label,
     description: options.description,
     icon: options.icon,
+    requiresRefreshToken: options.requiresRefreshToken === true,
     apps: apps.map(({ id, label, description }) => ({ id, label, description })),
     connectPrompt: options.connectPrompt || null,
+    supportsMultipleAccounts: options.supportsMultipleAccounts !== false,
+    connectionMethod: options.connectionMethod || 'oauth',
     getApp,
     getToolAppId(toolName) {
       return toolAppMap.get(String(toolName || '').trim()) || null;
@@ -311,15 +314,17 @@ function createOAuthProvider(options = {}) {
           0,
         ),
         connectPrompt: this.connectPrompt,
+        supportsMultipleAccounts: this.supportsMultipleAccounts,
+        connectionMethod: this.connectionMethod,
       };
     },
-    async beginOAuth({ state, codeVerifier, appKey, userId }) {
+    async beginOAuth({ state, codeVerifier, appKey, userId, agentId }) {
       const app = getApp(appKey);
       if (!app) {
         throw new Error(`Unknown ${this.label} app: ${appKey}`);
       }
       const normalizedState = assertValidOAuthState(state);
-      const env = this.getEnvStatus({ userId });
+      const env = this.getEnvStatus({ userId, agentId });
       if (!env.configured) {
         throw new Error(env.summary);
       }
@@ -327,11 +332,12 @@ function createOAuthProvider(options = {}) {
         state: normalizedState,
         codeVerifier,
         userId,
+        agentId,
         app,
         env,
       });
     },
-    async finishOAuth({ code, codeVerifier, appKey, userId, state }) {
+    async finishOAuth({ code, codeVerifier, appKey, userId, agentId, state }) {
       const app = getApp(appKey);
       if (!app) {
         throw new Error(`Unknown ${this.label} app: ${appKey}`);
@@ -341,9 +347,10 @@ function createOAuthProvider(options = {}) {
         code,
         codeVerifier,
         userId,
+        agentId,
         state: normalizedState,
         app,
-        env: this.getEnvStatus({ userId }),
+        env: this.getEnvStatus({ userId, agentId }),
       });
     },
     async disconnect(connectionRow) {
@@ -368,7 +375,10 @@ function createOAuthProvider(options = {}) {
         appId: toolAppMap.get(String(toolName || '').trim()) || connectionRow.app_key,
         connection: connectionRow,
         credentials,
-        env: this.getEnvStatus({ userId: connectionRow?.user_id }),
+        env: this.getEnvStatus({
+          userId: connectionRow?.user_id,
+          agentId: connectionRow?.agent_id,
+        }),
       });
     },
     summarizeConnection(connectionRows) {

package/server/services/integrations/provider_config_store.js

@@ -2,6 +2,7 @@
 
 const db = require('../../db/database');
 const { decryptValue, encryptValue } = require('./secrets');
+const { resolveAgentId } = require('../agents/manager');
 
 function normalizeProviderKey(providerKey) {
   return String(providerKey || '').trim();
@@ -16,57 +17,65 @@ function parseConfig(value) {
   }
 }
 
-function getProviderConfig(userId, providerKey) {
+function getProviderConfig(userId, providerKey, agentId = null) {
   const normalizedProviderKey = normalizeProviderKey(providerKey);
-  if (!Number.isInteger(Number(userId)) || Number(userId) <= 0 || !normalizedProviderKey) {
+  const normalizedUserId = Number(userId);
+  if (!Number.isInteger(normalizedUserId) || normalizedUserId <= 0 || !normalizedProviderKey) {
     return {};
   }
+  const scopedAgentId = resolveAgentId(normalizedUserId, agentId);
 
   const row = db
     .prepare(
       `SELECT config_json
        FROM integration_provider_configs
-       WHERE user_id = ? AND provider_key = ?`,
+       WHERE user_id = ? AND agent_id = ? AND provider_key = ?`,
     )
-    .get(Number(userId), normalizedProviderKey);
+    .get(normalizedUserId, scopedAgentId, normalizedProviderKey);
 
   return parseConfig(row?.config_json);
 }
 
-function setProviderConfig(userId, providerKey, config) {
+function setProviderConfig(userId, providerKey, config, agentId = null) {
   const normalizedProviderKey = normalizeProviderKey(providerKey);
-  if (!Number.isInteger(Number(userId)) || Number(userId) <= 0 || !normalizedProviderKey) {
+  const normalizedUserId = Number(userId);
+  if (!Number.isInteger(normalizedUserId) || normalizedUserId <= 0 || !normalizedProviderKey) {
     throw new Error('A valid user and provider are required to save integration config.');
   }
+  const scopedAgentId = resolveAgentId(normalizedUserId, agentId);
 
   const payload = config && typeof config === 'object' ? config : {};
   db.prepare(
     `INSERT INTO integration_provider_configs (
        user_id,
+       agent_id,
        provider_key,
        config_json,
        created_at,
        updated_at
-     ) VALUES (?, ?, ?, datetime('now'), datetime('now'))
-     ON CONFLICT(user_id, provider_key) DO UPDATE SET
+     ) VALUES (?, ?, ?, ?, datetime('now'), datetime('now'))
+     ON CONFLICT(user_id, agent_id, provider_key) DO UPDATE SET
        config_json = excluded.config_json,
        updated_at = excluded.updated_at`,
   ).run(
-    Number(userId),
+    normalizedUserId,
+    scopedAgentId,
     normalizedProviderKey,
     encryptValue(JSON.stringify(payload)),
   );
 }
 
-function deleteProviderConfig(userId, providerKey) {
+function deleteProviderConfig(userId, providerKey, agentId = null) {
   const normalizedProviderKey = normalizeProviderKey(providerKey);
-  if (!Number.isInteger(Number(userId)) || Number(userId) <= 0 || !normalizedProviderKey) {
+  const normalizedUserId = Number(userId);
+  if (!Number.isInteger(normalizedUserId) || normalizedUserId <= 0 || !normalizedProviderKey) {
     return;
   }
+  const scopedAgentId = resolveAgentId(normalizedUserId, agentId);
 
   db.prepare(
-    'DELETE FROM integration_provider_configs WHERE user_id = ? AND provider_key = ?',
-  ).run(Number(userId), normalizedProviderKey);
+    'DELETE FROM integration_provider_configs WHERE user_id = ? AND agent_id = ? AND provider_key = ?',
+  ).run(normalizedUserId, scopedAgentId, normalizedProviderKey);
 }
 
 module.exports = {

package/server/services/integrations/registry.js

@@ -3,14 +3,13 @@
 const { createFigmaProvider } = require('./figma/provider');
 const { createGoogleWorkspaceProvider } = require('./google/provider');
 const { createGithubProvider } = require('./github/provider');
-const { createHomeAssistantProvider } = require('./home_assistant/provider');
+const { createTrelloProvider } = require('./trello/provider');
 const { createMicrosoftProvider } = require('./microsoft/provider');
 const { createNotionProvider } = require('./notion/provider');
 const { createSpotifyProvider } = require('./spotify/provider');
 const { createSlackProvider } = require('./slack/provider');
 const { createWeatherProvider } = require('./weather/provider');
 const { createWhatsAppPersonalProvider } = require('./whatsapp');
-const { createCodexProvider } = require('./codex/provider');
 
 function createIntegrationRegistry(options = {}) {
   const providers = [
@@ -20,11 +19,10 @@ function createIntegrationRegistry(options = {}) {
     createMicrosoftProvider(),
     createSlackProvider(),
     createFigmaProvider(),
-    createHomeAssistantProvider(),
+    createTrelloProvider(),
     createWeatherProvider(),
     createSpotifyProvider(),
     createWhatsAppPersonalProvider(options),
-    createCodexProvider(),
   ];
   const byKey = new Map(providers.map((provider) => [provider.key, provider]));
 

package/server/services/integrations/spotify/provider.js

@@ -394,6 +394,7 @@ function createSpotifyProvider() {
     label: 'Spotify',
     description: 'Official Spotify account integration for music search and playback control.',
     icon: 'spotify',
+    requiresRefreshToken: true,
     apps: SPOTIFY_APPS,
     toolDefinitions: spotifyToolDefinitions,
     connectPrompt: