neoagent 2.3.1-beta.5 → 2.3.1-beta.7

package/.env.example

@@ -6,6 +6,10 @@ PORT=3333
 NODE_ENV=production
 SESSION_SECRET=change-this-to-a-random-secret-in-production
 
+# Optional: dedicated key for encrypting local at-rest secrets (for example API_KEYS.json).
+# If unset, encryption falls back to SESSION_SECRET.
+# NEOAGENT_DATA_ENCRYPTION_KEY=
+
 # Public base URL used for OAuth callbacks and external links.
 # Example: https://agent.example.com
 PUBLIC_URL=
@@ -139,6 +143,15 @@ FIGMA_OAUTH_CLIENT_ID=your-figma-oauth-client-id
 FIGMA_OAUTH_CLIENT_SECRET=your-figma-oauth-client-secret
 FIGMA_OAUTH_REDIRECT_URI=
 
+# GitHub official integration OAuth client.
+# Redirect URI should match <PUBLIC_URL>/api/integrations/oauth/callback.
+# Prefer least-privilege OAuth scopes for your use case.
+# Read-oriented examples: public_repo (public repositories), repo:status (commit status), read:org (org membership).
+# Avoid broad blanket scopes unless explicitly required by a specific write workflow.
+GITHUB_OAUTH_CLIENT_ID=your-github-oauth-client-id
+GITHUB_OAUTH_CLIENT_SECRET=your-github-oauth-client-secret
+GITHUB_OAUTH_REDIRECT_URI=
+
 ########################################
 # Tools and media services
 ########################################

package/docs/configuration.md

@@ -90,14 +90,18 @@ All OAuth callbacks default to `PUBLIC_URL + /api/integrations/oauth/callback` u
 | `FIGMA_OAUTH_CLIENT_ID` | Figma OAuth client ID |
 | `FIGMA_OAUTH_CLIENT_SECRET` | Figma OAuth client secret |
 | `FIGMA_OAUTH_REDIRECT_URI` | Optional Figma OAuth callback URL |
-| `HOME_ASSISTANT_BASE_URL` | Home Assistant base URL, for example `https://ha.example.com` |
-| `HOME_ASSISTANT_OAUTH_CLIENT_ID` | Home Assistant OAuth client ID |
-| `HOME_ASSISTANT_OAUTH_CLIENT_SECRET` | Home Assistant OAuth client secret |
-| `HOME_ASSISTANT_OAUTH_REDIRECT_URI` | Optional Home Assistant OAuth callback URL |
+| `HOME_ASSISTANT_BASE_URL` | Optional fallback Home Assistant base URL. Users can configure this per account in Official Integrations. |
+| `HOME_ASSISTANT_OAUTH_CLIENT_ID` | Optional fallback Home Assistant OAuth client ID. |
+| `HOME_ASSISTANT_OAUTH_CLIENT_SECRET` | Optional fallback Home Assistant OAuth client secret. |
+| `HOME_ASSISTANT_OAUTH_REDIRECT_URI` | Optional fallback Home Assistant OAuth callback URL. |
+| `HOME_ASSISTANT_ALLOW_PRIVATE_BASE_URL` | Optional safety override. Set to `1` only if you intentionally allow Home Assistant base URLs on localhost/private networks. |
 | `SPOTIFY_OAUTH_CLIENT_ID` | Spotify OAuth client ID |
 | `SPOTIFY_OAUTH_CLIENT_SECRET` | Spotify OAuth client secret |
 | `SPOTIFY_OAUTH_REDIRECT_URI` | Optional Spotify OAuth callback URL |
 
+Home Assistant no longer requires server-side setup. Each user can open Official Integrations, select Home Assistant, and enter their own base URL and OAuth app credentials.
+For safety, local/private Home Assistant targets are blocked by default unless `HOME_ASSISTANT_ALLOW_PRIVATE_BASE_URL=1` is set on the server.
+
 Weather integration uses Open-Meteo public endpoints and does not require OAuth environment variables.
 
 ## Messaging

package/docs/integrations.md

@@ -17,7 +17,7 @@ The built-in registry includes:
 | Weather | Keyless Open-Meteo current weather and forecast tools |
 | Spotify | Playback state, recently played, search, and playback controls |
 
-OAuth app credentials are configured through server environment variables. Account connections are created in the Flutter UI under **Integrations**. Connected tools are exposed to the agent as structured tools, so prefer them over browser automation when they can do the job.
+OAuth app credentials are configured through server environment variables for most providers. Home Assistant can also be configured per-user in the Flutter **Integrations** UI without any server-side setup. Account connections are created in the Flutter UI under **Integrations**. Connected tools are exposed to the agent as structured tools, so prefer them over browser automation when they can do the job.
 
 Weather note: the Weather integration uses Open-Meteo public APIs and does not require OAuth client credentials.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neoagent",
-  "version": "2.3.1-beta.5",
+  "version": "2.3.1-beta.7",
   "description": "Proactive personal AI agent with no limits",
   "license": "MIT",
   "main": "server/index.js",
@@ -51,6 +51,7 @@
   "homepage": "https://github.com/NeoLabs-Systems/NeoAgent#readme",
   "dependencies": {
     "@anthropic-ai/sdk": "^0.39.0",
+    "@github/copilot-sdk": "^0.3.0",
     "@google/generative-ai": "^0.24.0",
     "@modelcontextprotocol/sdk": "^1.12.1",
     "baileys": "^6.7.21",
@@ -66,6 +67,7 @@
     "geoip-lite": "^1.4.10",
     "googleapis": "^150.0.1",
     "helmet": "^8.0.0",
+    "ipaddr.js": "^2.3.0",
     "multer": "^1.4.5-lts.1",
     "node-cron": "^3.0.3",
     "node-pty": "^1.0.0",

package/server/db/database.js

@@ -272,6 +272,17 @@ db.exec(`
     FOREIGN KEY (agent_id) REFERENCES agents(id) ON DELETE SET NULL
   );
 
+  CREATE TABLE IF NOT EXISTS integration_provider_configs (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    user_id INTEGER NOT NULL,
+    provider_key TEXT NOT NULL,
+    config_json TEXT DEFAULT '{}',
+    created_at TEXT DEFAULT (datetime('now')),
+    updated_at TEXT DEFAULT (datetime('now')),
+    FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
+    UNIQUE(user_id, provider_key)
+  );
+
   CREATE TABLE IF NOT EXISTS browser_extension_pairing_requests (
     id TEXT PRIMARY KEY,
     user_id INTEGER,

package/server/http/middleware.js

@@ -88,7 +88,18 @@ function buildHelmetOptions({ secureCookies }) {
   return {
     strictTransportSecurity: false,
     crossOriginOpenerPolicy: false,
+    crossOriginResourcePolicy: { policy: 'same-site' },
     originAgentCluster: false,
+    referrerPolicy: { policy: 'strict-origin-when-cross-origin' },
+    permissionsPolicy: {
+      features: {
+        camera: ['self'],
+        geolocation: ['self'],
+        microphone: ['self'],
+        payment: [],
+        usb: [],
+      },
+    },
     contentSecurityPolicy: {
       directives: {
         defaultSrc: ["'self'"],
@@ -154,6 +165,16 @@ function applyHttpMiddleware(app, { secureCookies, trustProxy, sessionMiddleware
     const path = `${value}`.split('?')[0];
     return path === '/socket.io/' || path === '/socket.io' || path.startsWith('/socket.io/');
   };
+  const isStateChangingMethod = (method = '') => ['POST', 'PUT', 'PATCH', 'DELETE'].includes(String(method).toUpperCase());
+  const extractOriginFromReferer = (referer = '') => {
+    const value = String(referer || '').trim();
+    if (!value) return '';
+    try {
+      return new URL(value).origin;
+    } catch {
+      return '';
+    }
+  };
   const requestPath = (req) => req.originalUrl || req.url || req.path || '';
   const applyOnlyToRecordingChunk = (handler) => (req, res, next) => (
     isRecordingChunkPath(requestPath(req)) ? handler(req, res, next) : next()
@@ -187,6 +208,35 @@ function applyHttpMiddleware(app, { secureCookies, trustProxy, sessionMiddleware
       });
     })
   );
+  app.use((req, res, next) => {
+    const path = `${req.originalUrl || req.url || req.path || ''}`.split('?')[0];
+    if (path.startsWith('/api/')) {
+      res.setHeader('Cache-Control', 'no-store, max-age=0');
+      res.setHeader('Pragma', 'no-cache');
+      res.setHeader('Expires', '0');
+    }
+    next();
+  });
+  app.use((req, res, next) => {
+    const path = `${req.originalUrl || req.url || req.path || ''}`.split('?')[0];
+    if (!path.startsWith('/api/')) return next();
+    if (!isStateChangingMethod(req.method)) return next();
+
+    const origin = String(req.get('origin') || '').trim() || extractOriginFromReferer(req.get('referer'));
+    if (!origin) return next();
+
+    const allowBrowserExtensionOrigin = isBrowserExtensionCorsPath(path);
+    return validateOrigin(origin, (error) => {
+      if (error) {
+        logRequestSummary('warn', req, 'blocked state-changing request due to invalid origin', { origin });
+        return res.status(403).json({ error: 'Origin not allowed' });
+      }
+      return next();
+    }, {
+      allowChromeExtension: allowBrowserExtensionOrigin,
+      allowMissingOrigin: false,
+    });
+  });
   app.use((req, res, next) => {
     const startedAt = Date.now();
 

package/server/index.js

@@ -97,6 +97,7 @@ if (!configuredSessionSecret()) {
 }
 
 const app = express();
+app.disable('x-powered-by');
 const httpServer = createServer(app);
 const io = createSocketServer(httpServer, { validateOrigin });
 app.locals.httpRuntimeConfig = {

package/server/public/flutter_bootstrap.js

@@ -37,6 +37,6 @@ _flutter.buildConfig = {"engineRevision":"59aa584fdf100e6c78c785d8a5b565d1de4b48
 
 _flutter.loader.load({
   serviceWorkerSettings: {
-    serviceWorkerVersion: "4123024040" /* Flutter's service worker is deprecated and will be removed in a future Flutter release. */
+    serviceWorkerVersion: "1495797212" /* Flutter's service worker is deprecated and will be removed in a future Flutter release. */
   }
 });