neoagent 2.3.1-beta.2 → 2.3.1-beta.21

package/server/services/integrations/home_assistant/provider.js

@@ -1,10 +1,17 @@
 'use strict';
 
 const crypto = require('crypto');
+const net = require('net');
+const ipaddr = require('ipaddr.js');
 const {
   describeEnvStatus,
   resolveHomeAssistantOAuthConfig,
 } = require('../env');
+const {
+  deleteProviderConfig,
+  getProviderConfig,
+  setProviderConfig,
+} = require('../provider_config_store');
 const {
   appendQuery,
   createOAuthProvider,
@@ -93,6 +100,248 @@ const homeAssistantToolDefinitions = [
   },
 ];
 
+function trimText(value) {
+  return String(value || '').trim();
+}
+
+function isTruthyEnv(name) {
+  const value = String(process.env[name] || '').trim().toLowerCase();
+  return value === '1' || value === 'true' || value === 'yes' || value === 'on';
+}
+
+function isLikelyLocalHostname(hostname) {
+  const host = String(hostname || '').trim().toLowerCase();
+  if (!host) return false;
+  if (host === 'localhost' || host === 'host.docker.internal') return true;
+  if (host.endsWith('.localhost')) return true;
+  if (host.endsWith('.local') || host.endsWith('.lan') || host.endsWith('.internal')) {
+    return true;
+  }
+  return false;
+}
+
+function isPrivateIpv4(hostname) {
+  const parts = String(hostname || '').split('.').map((part) => Number(part));
+  if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) {
+    return false;
+  }
+  const [a, b] = parts;
+  if (a === 10) return true;
+  if (a === 127) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 100 && b >= 64 && b <= 127) return true;
+  if (a === 0) return true;
+  return false;
+}
+
+function isPrivateIpv6(hostname) {
+  const host = String(hostname || '').trim().replace(/^\[|\]$/g, '');
+  if (!host) return false;
+  try {
+    const parsed = ipaddr.parse(host);
+    if (parsed.kind() !== 'ipv6') return false;
+
+    // Normalize IPv4-mapped IPv6 literals and enforce the same local/private rules.
+    if (parsed.isIPv4MappedAddress()) {
+      return isPrivateIpv4(parsed.toIPv4Address().toString());
+    }
+
+    const range = parsed.range();
+    return range === 'loopback' || range === 'uniqueLocal' || range === 'linkLocal' || range === 'unspecified';
+  } catch {
+    return false;
+  }
+}
+
+function isPrivateOrLocalIp(hostname) {
+  const host = String(hostname || '').trim().replace(/^\[|\]$/g, '');
+  const kind = net.isIP(host);
+  if (kind === 4) return isPrivateIpv4(host);
+  if (kind === 6) return isPrivateIpv6(host);
+  return false;
+}
+
+function validateHomeAssistantBaseUrlSafety(parsedUrl) {
+  const allowPrivate = isTruthyEnv('HOME_ASSISTANT_ALLOW_PRIVATE_BASE_URL');
+  const host = String(parsedUrl.hostname || '').trim();
+  const localHostname = isLikelyLocalHostname(host);
+  const localIp = isPrivateOrLocalIp(host);
+  const isLocalTarget = localHostname || localIp;
+
+  if (isLocalTarget && !allowPrivate) {
+    throw new Error(
+      'Home Assistant base URL cannot target localhost/private network addresses unless HOME_ASSISTANT_ALLOW_PRIVATE_BASE_URL=1 is set on the server.',
+    );
+  }
+
+  if (parsedUrl.protocol === 'http:' && !isLocalTarget) {
+    throw new Error('Home Assistant base URL must use HTTPS for non-local hosts.');
+  }
+}
+
+function normalizeBaseUrl(value) {
+  const text = trimText(value);
+  if (!text) return '';
+  return text.replace(/\/$/, '');
+}
+
+function normalizeOptionalAbsoluteUrl(value, label) {
+  const text = trimText(value);
+  if (!text) return '';
+  try {
+    const parsed = new URL(text);
+    if (!/^https?:$/.test(parsed.protocol)) {
+      throw new Error(`${label} must use http or https.`);
+    }
+    return parsed.toString().replace(/\/$/, '');
+  } catch {
+    throw new Error(`${label} must be a valid absolute URL.`);
+  }
+}
+
+function normalizeHomeAssistantBaseUrl(value) {
+  const text = trimText(value);
+  if (!text) return '';
+  let parsed;
+  try {
+    parsed = new URL(text);
+  } catch {
+    throw new Error('Home Assistant base URL must be a valid absolute URL.');
+  }
+  if (!/^https?:$/.test(parsed.protocol)) {
+    throw new Error('Home Assistant base URL must use http or https.');
+  }
+  validateHomeAssistantBaseUrlSafety(parsed);
+  return parsed.toString().replace(/\/$/, '');
+}
+
+function normalizeUserHomeAssistantConfig(rawConfig) {
+  const source = rawConfig && typeof rawConfig === 'object' ? rawConfig : {};
+  return {
+    baseUrl: normalizeBaseUrl(source.baseUrl),
+    clientId: trimText(source.clientId),
+    clientSecret: trimText(source.clientSecret),
+    redirectUri: trimText(source.redirectUri),
+  };
+}
+
+function resolveUserHomeAssistantConfig(userId) {
+  const userConfig = normalizeUserHomeAssistantConfig(
+    Number.isInteger(Number(userId)) && Number(userId) > 0
+      ? getProviderConfig(Number(userId), 'home_assistant')
+      : {},
+  );
+  const envConfig = resolveHomeAssistantOAuthConfig();
+  return {
+    baseUrl: userConfig.baseUrl || envConfig.baseUrl,
+    clientId: userConfig.clientId || envConfig.clientId,
+    clientSecret: userConfig.clientSecret || envConfig.clientSecret,
+    redirectUri: userConfig.redirectUri || envConfig.redirectUri,
+  };
+}
+
+function validateResolvedConfig(config) {
+  const missing = [];
+  if (!trimText(config.baseUrl)) missing.push('baseUrl');
+  if (!trimText(config.clientId)) missing.push('clientId');
+  if (!trimText(config.clientSecret)) missing.push('clientSecret');
+  return {
+    configured: missing.length === 0,
+    missing,
+  };
+}
+
+function resolveHomeAssistantConfigForUser(userId) {
+  const merged = resolveUserHomeAssistantConfig(userId);
+  const validatedBaseUrl = merged.baseUrl
+    ? normalizeHomeAssistantBaseUrl(merged.baseUrl)
+    : '';
+  const validatedRedirectUri = merged.redirectUri
+    ? normalizeOptionalAbsoluteUrl(
+        merged.redirectUri,
+        'Home Assistant OAuth redirect URI',
+      )
+    : '';
+  const result = {
+    baseUrl: validatedBaseUrl,
+    clientId: trimText(merged.clientId),
+    clientSecret: trimText(merged.clientSecret),
+    redirectUri: validatedRedirectUri,
+  };
+  const status = validateResolvedConfig(result);
+  return {
+    ...result,
+    configured: status.configured,
+    missing: status.missing,
+  };
+}
+
+function sanitizeHomeAssistantUserConfigForClient(rawConfig) {
+  const config = normalizeUserHomeAssistantConfig(rawConfig);
+  return {
+    baseUrl: config.baseUrl,
+    clientId: config.clientId,
+    redirectUri: config.redirectUri,
+    hasClientSecret: Boolean(config.clientSecret),
+  };
+}
+
+function parseHomeAssistantConfigInput(input, existingConfig = {}) {
+  const source = input && typeof input === 'object' ? input : {};
+  const baseUrl = normalizeHomeAssistantBaseUrl(source.baseUrl);
+  const clientId = trimText(source.clientId);
+  const clientSecret =
+    trimText(source.clientSecret) || trimText(existingConfig.clientSecret);
+  const redirectUri = source.redirectUri
+    ? normalizeOptionalAbsoluteUrl(
+        source.redirectUri,
+        'Home Assistant OAuth redirect URI',
+      )
+    : '';
+
+  if (!baseUrl) {
+    throw new Error('Home Assistant base URL is required.');
+  }
+  if (!clientId) {
+    throw new Error('Home Assistant OAuth client ID is required.');
+  }
+  if (!clientSecret) {
+    throw new Error('Home Assistant OAuth client secret is required.');
+  }
+
+  return {
+    baseUrl,
+    clientId,
+    clientSecret,
+    redirectUri,
+  };
+}
+
+function saveHomeAssistantUserConfig(userId, input) {
+  const normalizedUserId = Number(userId);
+  if (!Number.isInteger(normalizedUserId) || normalizedUserId <= 0) {
+    throw new Error('A valid user is required to save Home Assistant configuration.');
+  }
+  const existingConfig = normalizeUserHomeAssistantConfig(
+    getProviderConfig(normalizedUserId, 'home_assistant'),
+  );
+  const config = parseHomeAssistantConfigInput(input, existingConfig);
+  setProviderConfig(normalizedUserId, 'home_assistant', config);
+  return sanitizeHomeAssistantUserConfigForClient(config);
+}
+
+function getHomeAssistantUserConfig(userId) {
+  const normalizedUserId = Number(userId);
+  if (!Number.isInteger(normalizedUserId) || normalizedUserId <= 0) {
+    return sanitizeHomeAssistantUserConfigForClient({});
+  }
+  return sanitizeHomeAssistantUserConfigForClient(
+    getProviderConfig(normalizedUserId, 'home_assistant'),
+  );
+}
+
 function requireText(value, label) {
   const text = String(value || '').trim();
   if (!text) throw new Error(`${label} is required.`);
@@ -102,7 +351,7 @@ function requireText(value, label) {
 function homeAssistantUrl(baseUrl, path, query) {
   const normalizedBase = String(baseUrl || '').trim().replace(/\/$/, '');
   if (!normalizedBase) {
-    throw new Error('HOME_ASSISTANT_BASE_URL is required.');
+    throw new Error('Home Assistant base URL is required.');
   }
   const url = new URL(
     String(path || '').startsWith('http')
@@ -119,7 +368,7 @@ function homeAssistantUrl(baseUrl, path, query) {
 }
 
 async function homeAssistantRequest(credentials, options = {}) {
-  const config = resolveHomeAssistantOAuthConfig();
+  const config = resolveHomeAssistantConfigForUser(options.userId);
   const accessToken = String(credentials?.access_token || '').trim();
   if (!accessToken) {
     throw new Error('Home Assistant access token is missing. Reconnect this integration account.');
@@ -138,14 +387,20 @@ async function homeAssistantRequest(credentials, options = {}) {
   );
 }
 
-async function executeHomeAssistantTool(toolName, args, { credentials }) {
+async function executeHomeAssistantTool(toolName, args, { connection, credentials }) {
   switch (toolName) {
     case 'home_assistant_get_config':
       return {
-        result: await homeAssistantRequest(credentials, { path: '/api/config' }),
+        result: await homeAssistantRequest(credentials, {
+          path: '/api/config',
+          userId: connection?.user_id,
+        }),
       };
     case 'home_assistant_list_states': {
-      const states = await homeAssistantRequest(credentials, { path: '/api/states' });
+      const states = await homeAssistantRequest(credentials, {
+        path: '/api/states',
+        userId: connection?.user_id,
+      });
       const domain = String(args.domain || '').trim().toLowerCase();
       const limit = Math.max(1, Math.min(Number(args.limit) || 100, 500));
       const filtered = Array.isArray(states)
@@ -163,6 +418,7 @@ async function executeHomeAssistantTool(toolName, args, { credentials }) {
       return {
         result: await homeAssistantRequest(credentials, {
           path: `/api/states/${encodeURIComponent(requireText(args.entity_id, 'entity_id'))}`,
+          userId: connection?.user_id,
         }),
       };
     case 'home_assistant_call_service':
@@ -171,6 +427,7 @@ async function executeHomeAssistantTool(toolName, args, { credentials }) {
           method: 'POST',
           path: `/api/services/${encodeURIComponent(requireText(args.domain, 'domain'))}/${encodeURIComponent(requireText(args.service, 'service'))}`,
           body: args.service_data || {},
+          userId: connection?.user_id,
         }),
       };
     case 'home_assistant_api_request':
@@ -180,6 +437,7 @@ async function executeHomeAssistantTool(toolName, args, { credentials }) {
           path: requireText(args.path, 'path'),
           query: args.query,
           body: args.body,
+          userId: connection?.user_id,
         }),
       };
     default:
@@ -187,19 +445,25 @@ async function executeHomeAssistantTool(toolName, args, { credentials }) {
   }
 }
 
-function resolveHomeAssistantEnvStatus() {
-  const config = resolveHomeAssistantOAuthConfig();
-  const missing = config.missing.slice();
-  if (!config.baseUrl) {
-    missing.push('HOME_ASSISTANT_BASE_URL');
+function resolveHomeAssistantEnvStatus(userId) {
+  try {
+    const config = resolveHomeAssistantConfigForUser(userId);
+    return {
+      configured: config.configured,
+      missing: config.missing,
+      summary: config.configured
+        ? 'Home Assistant is ready for account connections.'
+        : 'Complete your personal Home Assistant setup to connect an account.',
+      setupMode: 'user',
+    };
+  } catch (error) {
+    return {
+      configured: false,
+      missing: ['baseUrl'],
+      summary: `Home Assistant setup is invalid: ${error?.message || 'unknown error'}`,
+      setupMode: 'user',
+    };
   }
-  return describeEnvStatus(
-    {
-      configured: missing.length === 0,
-      missing,
-    },
-    { label: 'Home Assistant' },
-  );
 }
 
 function normalizeCurrentUser(currentUser) {
@@ -225,8 +489,8 @@ function stableAccountEmailLikeIdentifier(user, config) {
   return `homeassistant@${host}`;
 }
 
-async function fetchCurrentUser(token) {
-  const config = resolveHomeAssistantOAuthConfig();
+async function fetchCurrentUser(token, userId) {
+  const config = resolveHomeAssistantConfigForUser(userId);
   return fetchJson(
     homeAssistantUrl(config.baseUrl, '/api/auth/current_user'),
     {
@@ -250,11 +514,11 @@ function createHomeAssistantProvider() {
     toolDefinitions: homeAssistantToolDefinitions,
     connectPrompt:
       'Connect your Home Assistant account to let the agent read entity states and control services with structured tools.',
-    getEnvStatus() {
-      return resolveHomeAssistantEnvStatus();
+    getEnvStatus(context = {}) {
+      return resolveHomeAssistantEnvStatus(context.userId);
     },
-    async beginOAuth({ state, codeVerifier, app }) {
-      const config = resolveHomeAssistantOAuthConfig();
+    async beginOAuth({ state, codeVerifier, app, userId }) {
+      const config = resolveHomeAssistantConfigForUser(userId);
       const codeChallenge = String(codeChallengeForVerifier(codeVerifier));
       return {
         url: appendQuery(homeAssistantUrl(config.baseUrl, '/auth/authorize'), {
@@ -269,8 +533,8 @@ function createHomeAssistantProvider() {
         appId: app.id,
       };
     },
-    async finishOAuth({ code, codeVerifier, app }) {
-      const config = resolveHomeAssistantOAuthConfig();
+    async finishOAuth({ code, codeVerifier, app, userId }) {
+      const config = resolveHomeAssistantConfigForUser(userId);
       const token = await fetchJson(
         homeAssistantUrl(config.baseUrl, '/auth/token'),
         {
@@ -297,7 +561,7 @@ function createHomeAssistantProvider() {
         throw new Error('Home Assistant OAuth did not return a refresh token.');
       }
 
-      const currentUser = await fetchCurrentUser(accessToken);
+      const currentUser = await fetchCurrentUser(accessToken, userId);
       const normalizedUser = normalizeCurrentUser(currentUser);
       const accountEmail = stableAccountEmailLikeIdentifier(normalizedUser, config);
 
@@ -328,6 +592,20 @@ function createHomeAssistantProvider() {
       };
     },
     executeTool: executeHomeAssistantTool,
+    getUserConfig({ userId }) {
+      return getHomeAssistantUserConfig(userId);
+    },
+    saveUserConfig({ userId, config }) {
+      return saveHomeAssistantUserConfig(userId, config);
+    },
+    clearUserConfig({ userId }) {
+      const normalizedUserId = Number(userId);
+      if (!Number.isInteger(normalizedUserId) || normalizedUserId <= 0) {
+        throw new Error('A valid user is required to clear Home Assistant configuration.');
+      }
+      deleteProviderConfig(normalizedUserId, 'home_assistant');
+      return { cleared: true };
+    },
   });
 }
 
@@ -346,5 +624,7 @@ function codeChallengeForVerifier(codeVerifier) {
 }
 
 module.exports = {
+  getHomeAssistantUserConfig,
+  saveHomeAssistantUserConfig,
   createHomeAssistantProvider,
 };

package/server/services/integrations/manager.js

@@ -13,6 +13,22 @@ const {
 
 const OAUTH_STATE_PATTERN = /^[a-f0-9]{32,128}$/i;
 
+function isLikelyExpiredConnectionError(error) {
+  const message = String(error?.message || error || '').toLowerCase();
+  if (!message) return false;
+  return [
+    'invalid_grant',
+    'token refresh failed',
+    'token expired',
+    'access token is missing',
+    'refresh token is missing',
+    'reconnect this integration account',
+    'account is no longer authorized',
+    'reauthorize',
+    're-authorize',
+  ].some((hint) => message.includes(hint));
+}
+
 class IntegrationManager {
   constructor(options = {}) {
     this.app = options.app || null;
@@ -147,7 +163,12 @@ class IntegrationManager {
 
     return this.registry
       .list()
-      .map((provider) => provider.buildSnapshot(rowsByProvider.get(provider.key) || []));
+      .map((provider) =>
+        provider.buildSnapshot(rowsByProvider.get(provider.key) || [], {
+          userId,
+          agentId: scopedAgentId,
+        }),
+      );
   }
 
   async beginOAuth(userId, providerKey, options = {}) {
@@ -163,7 +184,10 @@ class IntegrationManager {
       throw new Error(`Unknown ${provider.label} app: ${appKey || 'missing app key'}`);
     }
 
-    const env = provider.getEnvStatus();
+    const env = provider.getEnvStatus({
+      userId,
+      agentId,
+    });
     if (!env.configured) {
       throw new Error(env.summary);
     }
@@ -389,7 +413,10 @@ class IntegrationManager {
   getToolDefinitions(userId, agentId = null) {
     const definitions = [];
     for (const provider of this.registry.list()) {
-      const env = provider.getEnvStatus();
+      const env = provider.getEnvStatus({
+        userId,
+        agentId,
+      });
       if (!env.configured) continue;
       const connections = this.listConnections(userId, provider.key, agentId);
       const connectedAppIds = Array.from(
@@ -411,9 +438,15 @@ class IntegrationManager {
     if (!provider) {
       throw new Error(`Unknown integration provider: ${providerKey}`);
     }
-    const env = provider.getEnvStatus();
+    const env = provider.getEnvStatus({
+      userId,
+      agentId,
+    });
     const connections = this.listConnections(userId, provider.key, agentId);
-    const snapshot = provider.buildSnapshot(connections);
+    const snapshot = provider.buildSnapshot(connections, {
+      userId,
+      agentId,
+    });
     const connectedAppIds = snapshot.apps
       .filter((app) => app.connection.connected)
       .map((app) => app.id);
@@ -582,7 +615,10 @@ class IntegrationManager {
     for (const provider of this.registry.list()) {
       if (!provider.supportsTool(toolName)) continue;
       foundSupportingProvider = true;
-      const env = provider.getEnvStatus();
+      const env = provider.getEnvStatus({
+        userId,
+        agentId,
+      });
       if (!env.configured) {
         return { error: env.summary };
       }
@@ -607,6 +643,17 @@ class IntegrationManager {
           selection.connection,
         );
       } catch (err) {
+        if (isLikelyExpiredConnectionError(err)) {
+          db.prepare(
+            `UPDATE integration_connections
+             SET status = 'expired', updated_at = datetime('now')
+             WHERE id = ? AND user_id = ? AND agent_id = ?`,
+          ).run(
+            selection.connection.id,
+            userId,
+            resolveAgentId(userId, agentId),
+          );
+        }
         return { error: err?.message || 'execution_error' };
       }
       if (!execution) {
@@ -641,7 +688,13 @@ class IntegrationManager {
   summarizeConnectedProviders(userId, agentId = null) {
     const providers = this.registry.list().map((provider) => ({
       provider,
-      snapshot: provider.buildSnapshot(this.listConnections(userId, provider.key, agentId)),
+      snapshot: provider.buildSnapshot(
+        this.listConnections(userId, provider.key, agentId),
+        {
+          userId,
+          agentId,
+        },
+      ),
     }));
 
     if (providers.length === 0) {
@@ -655,6 +708,9 @@ class IntegrationManager {
         }
 
         if (!snapshot?.env?.configured) {
+          if (snapshot?.env?.setupMode === 'user') {
+            return `${provider.label}: setup is not complete for this user yet. If the user wants to use it, tell them to finish setup in Official Integrations first.`;
+          }
           return `${provider.label}: available but not configured on the server yet. If the user wants to use it, tell them to finish setup in Official Integrations first.`;
         }
 

package/server/services/integrations/oauth_provider.js

@@ -247,8 +247,8 @@ function createOAuthProvider(options = {}) {
     getToolAppId(toolName) {
       return toolAppMap.get(String(toolName || '').trim()) || null;
     },
-    getEnvStatus() {
-      return options.getEnvStatus();
+    getEnvStatus(context = {}) {
+      return options.getEnvStatus(context);
     },
     getToolDefinitions(toolOptions = {}) {
       const connectedAppIds = new Set(toolOptions.connectedAppIds || []);
@@ -257,8 +257,8 @@ function createOAuthProvider(options = {}) {
     supportsTool(toolName) {
       return toolAppMap.has(String(toolName || '').trim());
     },
-    buildSnapshot(connectionRows) {
-      const env = this.getEnvStatus();
+    buildSnapshot(connectionRows, context = {}) {
+      const env = this.getEnvStatus(context);
       const byApp = new Map();
       for (const row of Array.isArray(connectionRows) ? connectionRows : []) {
         const appId = String(row.app_key || '').trim();
@@ -319,7 +319,7 @@ function createOAuthProvider(options = {}) {
         throw new Error(`Unknown ${this.label} app: ${appKey}`);
       }
       const normalizedState = assertValidOAuthState(state);
-      const env = this.getEnvStatus();
+      const env = this.getEnvStatus({ userId });
       if (!env.configured) {
         throw new Error(env.summary);
       }
@@ -343,7 +343,7 @@ function createOAuthProvider(options = {}) {
         userId,
         state: normalizedState,
         app,
-        env: this.getEnvStatus(),
+        env: this.getEnvStatus({ userId }),
       });
     },
     async disconnect(connectionRow) {
@@ -368,12 +368,16 @@ function createOAuthProvider(options = {}) {
         appId: toolAppMap.get(String(toolName || '').trim()) || connectionRow.app_key,
         connection: connectionRow,
         credentials,
+        env: this.getEnvStatus({ userId: connectionRow?.user_id }),
       });
     },
     summarizeConnection(connectionRows) {
       const snapshot = this.buildSnapshot(connectionRows);
       if (!snapshot.connection.connected) {
         if (snapshot.connection.status === 'env_not_configured') {
+          if (snapshot?.env?.setupMode === 'user') {
+            return `${this.label} still needs per-user setup before accounts can connect.`;
+          }
           return `${this.label} still needs administrator setup before accounts can connect.`;
         }
         return `${this.label} is not connected.`;
@@ -392,6 +396,9 @@ function createOAuthProvider(options = {}) {
     },
     summarizeForModel(snapshot) {
       if (!snapshot?.env?.configured) {
+        if (snapshot?.env?.setupMode === 'user') {
+          return `${this.label}: setup is user-managed and is not complete yet. If the user wants to use it, tell them to open Official Integrations and finish setup in their account first.`;
+        }
         return `${this.label}: workspace setup is not complete yet. If the user wants to use it, tell them to open Official Integrations and ask an administrator to finish setup first.`;
       }