neoagent 2.3.1-beta.25 → 2.3.1-beta.27

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neoagent",
-  "version": "2.3.1-beta.25",
+  "version": "2.3.1-beta.27",
   "description": "Proactive personal AI agent with no limits",
   "license": "MIT",
   "main": "server/index.js",

package/server/http/middleware.js

@@ -69,9 +69,11 @@ ensureSessionStoreSchema(sessionsDb);
 function buildHelmetOptions({ secureCookies }) {
   const wsConnectSrc = secureCookies ? ['wss:'] : ['ws:', 'wss:'];
   const isDevelopment = String(process.env.NODE_ENV || '').trim() === 'development';
-  const allowUnsafeEval = boolEnv('NEOAGENT_CSP_ALLOW_UNSAFE_EVAL', isDevelopment);
-  const allowExternalScriptCdn = boolEnv('NEOAGENT_CSP_ALLOW_EXTERNAL_SCRIPT_CDN', isDevelopment);
-  const allowExternalConnect = boolEnv('NEOAGENT_CSP_ALLOW_EXTERNAL_CONNECT', false);
+  // Flutter web (CanvasKit) requires external script/connect sources and wasm eval.
+  // Keep strict overrides available via env for hardened deployments.
+  const allowUnsafeEval = boolEnv('NEOAGENT_CSP_ALLOW_UNSAFE_EVAL', true);
+  const allowExternalScriptCdn = boolEnv('NEOAGENT_CSP_ALLOW_EXTERNAL_SCRIPT_CDN', true);
+  const allowExternalConnect = boolEnv('NEOAGENT_CSP_ALLOW_EXTERNAL_CONNECT', true);
 
   const scriptSrc = ["'self'", "'unsafe-inline'", 'blob:'];
   if (allowUnsafeEval) {
@@ -83,7 +85,7 @@ function buildHelmetOptions({ secureCookies }) {
 
   const connectSrc = ["'self'", ...wsConnectSrc];
   if (allowExternalConnect) {
-    connectSrc.push('https://fonts.googleapis.com', 'https://fonts.gstatic.com', 'https://www.gstatic.com');
+    connectSrc.push('https://fonts.googleapis.com', 'https://fonts.gstatic.com', 'https://www.gstatic.com', 'https://cdn.jsdelivr.net');
   }
 
   return {

package/server/public/flutter_bootstrap.js

@@ -37,6 +37,6 @@ _flutter.buildConfig = {"engineRevision":"59aa584fdf100e6c78c785d8a5b565d1de4b48
 
 _flutter.loader.load({
   serviceWorkerSettings: {
-    serviceWorkerVersion: "1747451041" /* Flutter's service worker is deprecated and will be removed in a future Flutter release. */
+    serviceWorkerVersion: "450979186" /* Flutter's service worker is deprecated and will be removed in a future Flutter release. */
   }
 });

package/server/services/desktop/screenRecorder.js

@@ -12,7 +12,7 @@ const { getErrorMessage } = require('../bootstrap_helpers');
 const execAsync = promisify(exec);
 
 class ScreenRecorder {
-  constructor() {
+  constructor(options = {}) {
     this.intervalMs = 10000; // 10 seconds
     this.intervalId = null;
     this.cleanupIntervalId = null;
@@ -20,6 +20,9 @@ class ScreenRecorder {
     this.isProcessing = false;
     this.tempFilePath = path.join(os.tmpdir(), `neoagent-screen-${Date.now()}.png`);
     this.lastBenignSkipAt = 0;
+    this.hasActiveRemoteCaptureSession = typeof options.hasActiveRemoteCaptureSession === 'function'
+      ? options.hasActiveRemoteCaptureSession
+      : () => false;
   }
 
   _isCaptureInactiveApp(appName) {
@@ -94,6 +97,13 @@ class ScreenRecorder {
     this.isProcessing = true;
 
     try {
+      // Only capture while at least one external device/session is actively connected.
+      // This prevents host-level screenshots when no user-side capture source is live.
+      if (!this.hasActiveRemoteCaptureSession()) {
+        this._logBenignSkip('no active external capture session');
+        return;
+      }
+
       // Skip capture when the desktop session is inactive (e.g. locked screen).
       let frontmostApp = '';
       try {

package/server/services/integrations/github/provider.js

@@ -337,15 +337,15 @@ function createGithubProvider() {
         method: 'POST',
         headers: {
           'Accept': 'application/json',
-          'Content-Type': 'application/json',
+          'Content-Type': 'application/x-www-form-urlencoded',
         },
-        body: JSON.stringify({
+        body: new URLSearchParams({
           client_id: config.clientId,
           client_secret: config.clientSecret,
           code,
           code_verifier: codeVerifier,
           redirect_uri: config.redirectUri,
-        }),
+        }).toString(),
       });
 
       const tokenBody = await tokenResponse.text();

package/server/services/manager.js

@@ -430,10 +430,35 @@ function createWidgetService(app) {
 }
 
 function createScreenRecorder(app) {
+  const hasActiveRemoteCaptureSession = () => {
+    const desktopRegistry = app.locals.desktopCompanionRegistry;
+    if (desktopRegistry?.connectionsByUser instanceof Map) {
+      for (const userMap of desktopRegistry.connectionsByUser.values()) {
+        if (!(userMap instanceof Map)) continue;
+        for (const connection of userMap.values()) {
+          if (typeof connection?.isOpen === 'function' && connection.isOpen()) {
+            return true;
+          }
+        }
+      }
+    }
+
+    const extensionRegistry = app.locals.browserExtensionRegistry;
+    if (extensionRegistry?.connectionsByUser instanceof Map) {
+      for (const connection of extensionRegistry.connectionsByUser.values()) {
+        if (typeof connection?.isOpen === 'function' && connection.isOpen()) {
+          return true;
+        }
+      }
+    }
+
+    return false;
+  };
+
   const screenRecorder = registerLocal(
     app,
     'screenRecorder',
-    new ScreenRecorder(),
+    new ScreenRecorder({ hasActiveRemoteCaptureSession }),
   );
   screenRecorder.start();
   logServiceReady('Screen recorder started');