neoagent 2.3.1-beta.2 → 2.3.1-beta.21

package/server/services/integrations/whatsapp/provider.js

@@ -545,7 +545,7 @@ class WhatsAppPersonalProvider extends EventEmitter {
             chatCount: client.chats.size,
             cachedMessageChats: client.messages.size,
             syncNote:
-              'Read tools only expose chats and messages synchronized through this personal integration session.',
+              'This account is linked and connected. Read tools expose only chats and messages currently available in this session cache.',
           },
         };
       case 'whatsapp_personal_list_chats': {
@@ -557,10 +557,14 @@ class WhatsAppPersonalProvider extends EventEmitter {
           .slice(0, limit);
         return {
           result: {
+            account: client.accountEmail || connection.account_email || null,
+            connected: client.status === 'connected',
             chats,
             count: chats.length,
             syncNote:
-              'Only chats synchronized after linking this personal integration are available here.',
+              chats.length > 0
+                ? 'Chats shown here come from the current personal WhatsApp cache.'
+                : 'The personal WhatsApp account is connected, but no chats are cached yet. The cache populates as history/events are synchronized.',
           },
         };
       }

package/server/services/manager.js

@@ -24,6 +24,7 @@ const { RuntimeManager } = require('./runtime/manager');
 const { BrowserExtensionRegistry } = require('./browser/extension/registry');
 const { DesktopCompanionRegistry } = require('./desktop/registry');
 const { DesktopProvider } = require('./desktop/provider');
+const { ScreenRecorder } = require('./desktop/screenRecorder');
 const { assertRuntimeValidation, getRuntimeValidation } = require('./runtime/validation');
 const {
   getErrorMessage,
@@ -428,6 +429,17 @@ function createWidgetService(app) {
   return widgetService;
 }
 
+function createScreenRecorder(app) {
+  const screenRecorder = registerLocal(
+    app,
+    'screenRecorder',
+    new ScreenRecorder(),
+  );
+  screenRecorder.start();
+  logServiceReady('Screen recorder started');
+  return screenRecorder;
+}
+
 function restoreMessagingConnections(messagingManager) {
   void runBackgroundTask('[Messaging] Restore error:', () =>
     messagingManager.restoreConnections(),
@@ -513,6 +525,7 @@ async function startServices(app, io) {
     const messagingManager = createMessagingManager(app, io, agentEngine);
     const recordingManager = createRecordingManager(app, io);
     createWidgetService(app);
+    createScreenRecorder(app);
 
     restoreMessagingConnections(messagingManager);
     restoreMcpClients(mcpClient);
@@ -639,6 +652,15 @@ async function stopServices(app) {
     }
   }
 
+  if (app.locals.screenRecorder) {
+    try {
+      app.locals.screenRecorder.stop();
+      logServiceReady('Screen recorder stopped');
+    } catch (err) {
+      console.error('[ScreenRecorder] Stop error:', getErrorMessage(err));
+    }
+  }
+
   if (app.locals.browserExtensionRegistry) {
     try {
       app.locals.browserExtensionRegistry.closeAll();

package/server/services/memory/manager.js

@@ -12,6 +12,11 @@ const {
 const { getMemoryStorageDecision } = require('./policy');
 const { AGENT_DATA_DIR } = require('../../../runtime/paths');
 const { isMainAgent, resolveAgentId } = require('../agents/manager');
+const {
+  decryptLocalValue,
+  encryptLocalValue,
+  isLocalEncryptedValue,
+} = require('../../utils/local_secrets');
 
 async function getActiveProvider(userId, agentId = null) {
   try {
@@ -516,11 +521,43 @@ class MemoryManager {
         return {};
       }
     }
-    try { return JSON.parse(fs.readFileSync(filePath, 'utf-8')); } catch { return {}; }
+    try {
+      const parsed = JSON.parse(fs.readFileSync(filePath, 'utf-8'));
+      if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        return {};
+      }
+
+      let shouldMigrate = false;
+      const normalized = {};
+
+      for (const [service, rawValue] of Object.entries(parsed)) {
+        const value = String(rawValue || '');
+        if (!value) {
+          normalized[service] = '';
+          continue;
+        }
+
+        if (!isLocalEncryptedValue(value)) shouldMigrate = true;
+        normalized[service] = decryptLocalValue(value);
+      }
+
+      if (shouldMigrate) {
+        this.writeApiKeys(normalized, userId);
+      }
+
+      return normalized;
+    } catch {
+      return {};
+    }
   }
 
   writeApiKeys(keys, userId = null) {
-    fs.writeFileSync(this._userApiKeysPath(userId), JSON.stringify(keys, null, 2), 'utf-8');
+    const encrypted = {};
+    for (const [service, rawValue] of Object.entries(keys || {})) {
+      const value = String(rawValue || '');
+      encrypted[service] = value ? encryptLocalValue(value) : '';
+    }
+    fs.writeFileSync(this._userApiKeysPath(userId), JSON.stringify(encrypted, null, 2), 'utf-8');
   }
 
   setApiKey(service, key, userId = null) {

package/server/services/skills/base_catalog.js

@@ -1161,6 +1161,39 @@ Auto-orients and arranges the STL, applies settings from JSON files, slices all
 3. Build the command from the flags above
 4. Run it and check for errors in the output (debug level 2 is a good default)
 5. Report the output file location and any warnings`
+  },
+
+  {
+    id: 'package-tracker',
+    name: 'Package Tracker',
+    description: 'Track packages by automatically detecting the carrier and fetching the tracking link.',
+    category: 'info',
+    icon: '📦',
+    content: `---
+name: package-tracker
+description: Track packages by automatically detecting the carrier and fetching the tracking link.
+category: info
+icon: 📦
+enabled: true
+---
+
+You are a package tracking assistant. When the user gives you a tracking number, you should:
+
+1. Identify the carrier using common regex patterns:
+   - UPS: \`\\b(1Z[0-9A-Z]{16})\\b\`
+   - FedEx: \`\\b([0-9]{12,15})\\b\` (usually 12 or 15 digits)
+   - USPS: \`\\b(94[0-9]{20})\\b\` or \`\\b([A-Z]{2}[0-9]{9}US)\\b\`
+   - DHL: \`\\b([0-9]{10})\\b\` or \`\\b([0-9]{20})\\b\`
+
+2. Generate the direct tracking link for the user:
+   - UPS: \`https://www.ups.com/track?tracknum={number}\`
+   - FedEx: \`https://www.fedex.com/fedextrack/?trknbr={number}\`
+   - USPS: \`https://tools.usps.com/go/TrackConfirmAction?tLabels={number}\`
+   - DHL: \`https://www.dhl.com/global-en/home/tracking/tracking-express.html?submit=1&tracking-id={number}\`
+
+3. If the carrier is not obvious, use \`web_search\` with the query "track package {number}" to identify the carrier.
+4. Present the carrier and the direct tracking link to the user clearly.
+5. Optionally use \`browser_navigate\` or \`http_request\` to fetch the current status from the tracking link, but note that many carriers block automated scraping. The direct link is the most important output.`
   }
 ];
 

package/server/services/tasks/adapters/index.js

@@ -2,6 +2,7 @@
 
 module.exports = [
   require('./schedule'),
+  require('./manual'),
   require('./gmail_message_received'),
   require('./outlook_email_received'),
   require('./slack_message_received'),

package/server/services/tasks/adapters/manual.js

@@ -0,0 +1,12 @@
+'use strict';
+
+module.exports = {
+  type: 'manual',
+  label: 'Manual Trigger',
+  async validateConfig() {
+    return {};
+  },
+  summarize() {
+    return 'Manual run only';
+  },
+};

package/server/services/tasks/runtime.js

@@ -66,7 +66,7 @@ class TaskRuntime {
       label: adapter.label,
       providerKey: adapter.providerKey || null,
       appKey: adapter.appKey || null,
-      available: adapter.type === 'schedule'
+      available: adapter.type === 'schedule' || adapter.type === 'manual'
         ? true
         : this._hasConnectedApp(userId, agentId, adapter.providerKey, adapter.appKey),
     }));

package/server/services/voice/openaiClient.js

@@ -4,6 +4,7 @@ const fs = require('fs');
 const path = require('path');
 const { OpenAI } = require('openai');
 const { AGENT_DATA_DIR } = require('../../../runtime/paths');
+const { decryptLocalValue } = require('../../utils/local_secrets');
 
 let cachedClient = null;
 
@@ -15,7 +16,9 @@ function resolveOpenAiApiKey() {
   try {
     const keysPath = path.join(AGENT_DATA_DIR, 'API_KEYS.json');
     const keys = JSON.parse(fs.readFileSync(keysPath, 'utf8'));
-    const candidate = keys.OPENAI_API_KEY || keys.openai_api_key || keys.openai;
+    const candidate = decryptLocalValue(keys.OPENAI_API_KEY)
+      || decryptLocalValue(keys.openai_api_key)
+      || decryptLocalValue(keys.openai);
     return typeof candidate === 'string' && candidate.trim() ? candidate.trim() : '';
   } catch {
     return '';

package/server/services/voice/providers.js

@@ -6,6 +6,7 @@ const { AGENT_DATA_DIR } = require('../../../runtime/paths');
 const { getOpenAiClient } = require('./openaiClient');
 const { synthesizeSpeechBuffer } = require('./openaiSpeech');
 const { transcribeChunkWithDeepgram } = require('../recordings/deepgram');
+const { decryptLocalValue } = require('../../utils/local_secrets');
 
 const DEFAULT_STT_PROVIDER = 'openai';
 const DEFAULT_TTS_PROVIDER = 'openai';
@@ -94,7 +95,7 @@ function resolveApiKey(candidates = []) {
     const snake = lower.replace(/[^a-z0-9]+/g, '_');
     const variants = [key, lower, snake];
     for (const variant of variants) {
-      const value = keys[variant];
+      const value = decryptLocalValue(keys[variant]);
       if (typeof value === 'string' && value.trim()) {
         return value.trim();
       }

package/server/services/widgets/service.js

@@ -243,7 +243,11 @@ class WidgetService {
        WHERE id = ? AND user_id = ?`
     ).get(widgetId, userId);
     if (!row) return null;
-    return this._serializeWidget(row, this._loadLatestSnapshotMap([widgetId]).get(widgetId) || null);
+    return this._serializeWidget(
+      row,
+      this._loadLatestSnapshotMap([widgetId]).get(widgetId) || null,
+      this._loadWidgetTasksMap([widgetId], userId).get(widgetId) || []
+    );
   }
 
   listWidgets(userId, { agentId = null } = {}) {
@@ -262,7 +266,8 @@ class WidgetService {
          ORDER BY updated_at DESC, created_at DESC`
       ).all(userId);
     const snapshotMap = this._loadLatestSnapshotMap(rows.map((row) => row.id));
-    return rows.map((row) => this._serializeWidget(row, snapshotMap.get(row.id) || null));
+    const tasksMap = this._loadWidgetTasksMap(rows.map((row) => row.id), userId);
+    return rows.map((row) => this._serializeWidget(row, snapshotMap.get(row.id) || null, tasksMap.get(row.id) || []));
   }
 
   listLatestSnapshots(userId, { agentId = null } = {}) {
@@ -343,7 +348,7 @@ class WidgetService {
       throw new Error('Widget not found.');
     }
 
-    const current = this._serializeWidget(existingRow, null);
+    const current = this._serializeWidget(existingRow, null, []);
     const normalized = normalizeWidgetInput({
       name: input.name ?? current.name,
       template: input.template ?? current.template,
@@ -581,7 +586,46 @@ class WidgetService {
     return map;
   }
 
-  _serializeWidget(row, latestSnapshot) {
+  _loadWidgetTasksMap(widgetIds, userId) {
+    const ids = Array.from(new Set(widgetIds.filter(Boolean)));
+    const map = new Map();
+    if (!ids.length) return map;
+    
+    const placeholders = ids.map(() => '?').join(', ');
+    const params = [userId, ...ids];
+    
+    // We filter tasks where task_type is NOT 'widget_refresh' 
+    // and where the task_config contains the widgetId.
+    const rows = db.prepare(
+      `SELECT id, name, trigger_type, enabled, task_config
+       FROM scheduled_tasks
+       WHERE user_id = ?
+         AND task_type != 'widget_refresh'
+         AND json_extract(task_config, '$.widgetId') IN (${placeholders})
+       ORDER BY created_at ASC`
+    ).all(...params);
+    
+    for (const row of rows) {
+      const config = parseJsonObject(row.task_config, {});
+      const widgetId = config.widgetId;
+      if (!widgetId) continue;
+      
+      const task = {
+        id: row.id,
+        name: row.name,
+        triggerType: row.trigger_type,
+        enabled: row.enabled !== 0 && row.enabled !== false,
+      };
+      
+      if (!map.has(widgetId)) {
+        map.set(widgetId, []);
+      }
+      map.get(widgetId).push(task);
+    }
+    return map;
+  }
+
+  _serializeWidget(row, latestSnapshot, tasks = []) {
     const definition = parseJsonObject(row.definition_json, {});
     return {
       id: row.id,
@@ -600,6 +644,7 @@ class WidgetService {
       updatedAt: row.updated_at || null,
       nextRefresh: row.refresh_cron ? findNextRun(row.refresh_cron)?.toISOString() || null : null,
       latestSnapshot,
+      tasks,
     };
   }
 }

package/server/utils/local_secrets.js

@@ -0,0 +1,56 @@
+'use strict';
+
+const crypto = require('crypto');
+const { getSessionSecret } = require('../services/account/session_secret');
+
+const LOCAL_SECRET_PREFIX = 'enc:local:v1:';
+
+function getLocalSecretMaterial() {
+  const configured = String(process.env.NEOAGENT_DATA_ENCRYPTION_KEY || '').trim();
+  if (configured) return configured;
+  return getSessionSecret();
+}
+
+function deriveKey() {
+  return crypto.createHash('sha256').update(getLocalSecretMaterial()).digest();
+}
+
+function isLocalEncryptedValue(value) {
+  return String(value || '').startsWith(LOCAL_SECRET_PREFIX);
+}
+
+function encryptLocalValue(value) {
+  const text = String(value || '');
+  if (!text) return '';
+  if (isLocalEncryptedValue(text)) return text;
+
+  const iv = crypto.randomBytes(12);
+  const cipher = crypto.createCipheriv('aes-256-gcm', deriveKey(), iv);
+  const encrypted = Buffer.concat([cipher.update(text, 'utf8'), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return `${LOCAL_SECRET_PREFIX}${Buffer.concat([iv, tag, encrypted]).toString('base64')}`;
+}
+
+function decryptLocalValue(value) {
+  const text = String(value || '');
+  if (!text) return '';
+  if (!isLocalEncryptedValue(text)) return text;
+
+  try {
+    const payload = Buffer.from(text.slice(LOCAL_SECRET_PREFIX.length), 'base64');
+    const iv = payload.subarray(0, 12);
+    const tag = payload.subarray(12, 28);
+    const ciphertext = payload.subarray(28);
+    const decipher = crypto.createDecipheriv('aes-256-gcm', deriveKey(), iv);
+    decipher.setAuthTag(tag);
+    return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf8');
+  } catch {
+    return '';
+  }
+}
+
+module.exports = {
+  decryptLocalValue,
+  encryptLocalValue,
+  isLocalEncryptedValue,
+};

package/server/utils/logger.js

@@ -1,14 +1,36 @@
 'use strict';
 
+const SENSITIVE_KEY_RE = /(?:^|_|-)(?:token|secret|password|api[_-]?key|authorization|cookie|session(?:id)?|sid)(?:$|_|-)/i;
+
+function redactSecrets(input) {
+    let text = String(input || '');
+    if (!text) return text;
+
+    text = text
+        .replace(/\b(Bearer\s+)[A-Za-z0-9._~+\/-]+=*/gi, '$1[redacted]')
+        .replace(/([?&](?:token|access_token|refresh_token|api[_-]?key|secret|password|authorization|cookie|session|sid)=)([^&#\s]+)/gi, '$1[redacted]')
+        .replace(/\b(token|access_token|refresh_token|authorization|api[_-]?key|secret|password|cookie|session(?:id)?|sid)\b\s*[:=]\s*("[^"]*"|'[^']*'|[^,\s;]+)/gi, '$1=[redacted]');
+
+    return text;
+}
+
+function sanitizeUrl(value) {
+    return redactSecrets(String(value || ''));
+}
+
+function isSensitiveKey(key) {
+    return SENSITIVE_KEY_RE.test(String(key || ''));
+}
+
 function serializeValue(value, seen = new WeakSet()) {
     if (value instanceof Error) {
         return JSON.stringify({
             name: value.name,
-            message: value.message,
-            stack: value.stack,
+            message: redactSecrets(value.message),
+            stack: redactSecrets(value.stack),
             code: value.code,
             cause: value.cause instanceof Error
-                ? { name: value.cause.name, message: value.cause.message, stack: value.cause.stack }
+                ? { name: value.cause.name, message: redactSecrets(value.cause.message), stack: redactSecrets(value.cause.stack) }
                 : value.cause
         });
     }
@@ -22,7 +44,7 @@ function serializeValue(value, seen = new WeakSet()) {
     }
 
     if (!value || typeof value !== 'object') {
-        return String(value);
+        return redactSecrets(String(value));
     }
 
     if (seen.has(value)) {
@@ -33,21 +55,27 @@ function serializeValue(value, seen = new WeakSet()) {
 
     try {
         return JSON.stringify(value, (key, nestedValue) => {
+            if (isSensitiveKey(key)) {
+                return '[redacted]';
+            }
             if (nestedValue instanceof Error) {
                 return {
                     name: nestedValue.name,
-                    message: nestedValue.message,
-                    stack: nestedValue.stack,
+                    message: redactSecrets(nestedValue.message),
+                    stack: redactSecrets(nestedValue.stack),
                     code: nestedValue.code
                 };
             }
             if (typeof nestedValue === 'bigint') {
                 return nestedValue.toString();
             }
+            if (typeof nestedValue === 'string') {
+                return redactSecrets(nestedValue);
+            }
             return nestedValue;
         });
     } catch (err) {
-        return `[Unserializable object: ${err.message}]`;
+        return `[Unserializable object: ${redactSecrets(err.message)}]`;
     } finally {
         seen.delete(value);
     }
@@ -58,14 +86,14 @@ function formatLogArgs(args) {
 }
 
 function logRequestSummary(level, req, message, extra = null) {
-    const prefix = `[HTTP] ${req.method} ${req.originalUrl || req.url}`;
+    const prefix = `[HTTP] ${req.method} ${sanitizeUrl(req.originalUrl || req.url)}`;
     const summary = {
         ip: req.ip,
         userId: req.session?.userId || null,
         userAgent: req.get?.('user-agent') || null,
         ...extra
     };
-    console[level](`${prefix} ${message}`, summary);
+    console[level](redactSecrets(`${prefix} ${message}`), summary);
 }
 
 /**