neoagent 2.3.1-beta.6 → 2.3.1-beta.60

package/lib/manager.js

@@ -542,6 +542,19 @@ async function cmdSetup() {
   const normalizedDeploymentMode = parseDeploymentMode(deploymentMode);
   const normalizedReleaseChannel = parseReleaseChannel(releaseChannel) || 'stable';
 
+  const githubOauthClientId = await askSecret(
+    'GitHub OAuth client ID',
+    current.GITHUB_OAUTH_CLIENT_ID || ''
+  );
+  const githubOauthClientSecret = await askSecret(
+    'GitHub OAuth client secret',
+    current.GITHUB_OAUTH_CLIENT_SECRET || ''
+  );
+  const githubOauthRedirectUri = await ask(
+    'GitHub OAuth redirect URI',
+    current.GITHUB_OAUTH_REDIRECT_URI || ''
+  );
+
   const lines = [
     `NODE_ENV=production`,
     `PORT=${port}`,
@@ -576,6 +589,9 @@ async function cmdSetup() {
     figmaOauthClientId ? `FIGMA_OAUTH_CLIENT_ID=${figmaOauthClientId}` : '',
     figmaOauthClientSecret ? `FIGMA_OAUTH_CLIENT_SECRET=${figmaOauthClientSecret}` : '',
     figmaOauthRedirectUri ? `FIGMA_OAUTH_REDIRECT_URI=${figmaOauthRedirectUri}` : '',
+    githubOauthClientId ? `GITHUB_OAUTH_CLIENT_ID=${githubOauthClientId}` : '',
+    githubOauthClientSecret ? `GITHUB_OAUTH_CLIENT_SECRET=${githubOauthClientSecret}` : '',
+    githubOauthRedirectUri ? `GITHUB_OAUTH_REDIRECT_URI=${githubOauthRedirectUri}` : '',
     deepgramApiKey ? `DEEPGRAM_API_KEY=${deepgramApiKey}` : '',
     deepgramBaseUrl ? `DEEPGRAM_BASE_URL=${deepgramBaseUrl}` : '',
     deepgramModel ? `DEEPGRAM_MODEL=${deepgramModel}` : '',
@@ -674,6 +690,172 @@ async function cmdMigrate(args = []) {
   });
 }
 
+async function cmdLogin(args = []) {
+  const provider = args[0];
+  if (provider !== 'github-copilot' && provider !== 'openai-codex') {
+    throw new Error(`Unsupported login provider: ${provider || 'none'}. Available: github-copilot, openai-codex`);
+  }
+
+  if (provider === 'github-copilot') {
+    heading('GitHub Copilot Login');
+    const clientId = '01ab8ac9400c4e429b23';
+    logInfo('Requesting device code from GitHub...');
+
+    const reqRes = await fetch('https://github.com/login/device/code', {
+      method: 'POST',
+      headers: { 'Accept': 'application/json', 'Content-Type': 'application/json' },
+      body: JSON.stringify({ client_id: clientId, scope: 'user:email' })
+    });
+
+    if (!reqRes.ok) {
+      throw new Error(`Failed to request device code: HTTP ${reqRes.status}`);
+    }
+
+    const { device_code, user_code, verification_uri, interval } = await reqRes.json();
+
+    console.log(`\n  ${COLORS.cyan}Please visit:${COLORS.reset} ${verification_uri}`);
+    console.log(`  ${COLORS.cyan}And enter the code:${COLORS.reset} ${COLORS.bold}${user_code}${COLORS.reset}\n`);
+    
+    logInfo('Waiting for authorization (timeout in 15m)...');
+    const startTime = Date.now();
+    const timeoutMs = 15 * 60 * 1000;
+    let currentPollInterval = (interval || 5) * 1000;
+
+    while (Date.now() - startTime < timeoutMs) {
+      await new Promise((r) => setTimeout(r, currentPollInterval));
+      const tokenRes = await fetch('https://github.com/login/oauth/access_token', {
+        method: 'POST',
+        headers: { 'Accept': 'application/json', 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          client_id: clientId,
+          device_code,
+          grant_type: 'urn:ietf:params:oauth:grant-type:device_code'
+        })
+      });
+
+      if (!tokenRes.ok) {
+        const errorText = await tokenRes.text().catch(() => 'Unknown error');
+        throw new Error(`GitHub token request failed: HTTP ${tokenRes.status} - ${errorText}`);
+      }
+
+      const data = await tokenRes.json();
+      if (data.access_token) {
+        upsertEnvValue('GITHUB_COPILOT_ACCESS_TOKEN', data.access_token);
+        logOk('Successfully authenticated and saved GitHub Copilot access token to .env');
+        logInfo('Applying updated provider credentials by restarting NeoAgent...');
+        cmdRestart();
+        return;
+      } else if (data.error === 'authorization_pending') {
+        // Continue polling
+      } else if (data.error === 'slow_down') {
+        currentPollInterval += 5000;
+      } else if (data.error) {
+        throw new Error(`Authentication failed: ${data.error_description || data.error}`);
+      }
+    }
+    throw new Error('GitHub authentication timed out after 15 minutes.');
+  } else if (provider === 'openai-codex') {
+    heading('OpenAI Codex Login');
+    const clientId = 'app_EMoamEEZ73f0CkXaXp7hrann';
+    logInfo('Requesting device code from OpenAI...');
+
+    const reqRes = await fetch('https://auth.openai.com/api/accounts/deviceauth/usercode', {
+      method: 'POST',
+      headers: { 'Accept': 'application/json', 'Content-Type': 'application/json' },
+      body: JSON.stringify({ client_id: clientId, scope: 'openid profile email offline_access model.request model.read model.create' })
+    });
+
+    if (!reqRes.ok) {
+      throw new Error(`Failed to request device code: HTTP ${reqRes.status}`);
+    }
+
+    const data = await reqRes.json();
+    const { device_auth_id, interval } = data;
+    const user_code = data.user_code || data.usercode;
+    const verification_uri = 'https://auth.openai.com/codex/device';
+
+    console.log(`\n  ${COLORS.cyan}Please visit:${COLORS.reset} ${verification_uri}`);
+    console.log(`  ${COLORS.cyan}And enter the code:${COLORS.reset} ${COLORS.bold}${user_code}${COLORS.reset}\n`);
+
+    logInfo('Waiting for authorization (timeout in 15m)...');
+    const startTime = Date.now();
+    const timeoutMs = 15 * 60 * 1000;
+    let currentPollInterval = (interval || 5) * 1000;
+    let authorizationCode = null;
+    let codeVerifier = null;
+
+    while (Date.now() - startTime < timeoutMs) {
+      await new Promise((r) => setTimeout(r, currentPollInterval));
+      const tokenRes = await fetch('https://auth.openai.com/api/accounts/deviceauth/token', {
+        method: 'POST',
+        headers: { 'Accept': 'application/json', 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          device_auth_id: device_auth_id,
+          user_code: user_code
+        })
+      });
+
+      if (tokenRes.status === 403 || tokenRes.status === 404) {
+        // These statuses are returned by OpenAI while authorization is pending
+        continue;
+      }
+
+      if (!tokenRes.ok) {
+        const errorText = await tokenRes.text().catch(() => 'Unknown error');
+        throw new Error(`OpenAI token request failed: HTTP ${tokenRes.status} - ${errorText}`);
+      }
+
+      const pollData = await tokenRes.json();
+      if (pollData.authorization_code && pollData.code_verifier) {
+        authorizationCode = pollData.authorization_code;
+        codeVerifier = pollData.code_verifier;
+        break;
+      } else if (pollData.error === 'authorization_pending') {
+        // Continue polling
+      } else if (pollData.error === 'slow_down') {
+        currentPollInterval += 5000;
+      } else if (pollData.error) {
+        throw new Error(`Authentication failed: ${pollData.error_description || pollData.error}`);
+      }
+    }
+
+    if (!authorizationCode || !codeVerifier) {
+      throw new Error('OpenAI authentication timed out after 15 minutes.');
+    }
+
+    logInfo('Exchanging authorization code for access token...');
+    const exchangeRes = await fetch('https://auth.openai.com/oauth/token', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      body: new URLSearchParams({
+        grant_type: 'authorization_code',
+        code: authorizationCode,
+        redirect_uri: 'https://auth.openai.com/deviceauth/callback',
+        client_id: clientId,
+        code_verifier: codeVerifier
+      })
+    });
+
+    if (!exchangeRes.ok) {
+      const errorText = await exchangeRes.text().catch(() => 'Unknown error');
+      throw new Error(`OpenAI token exchange failed: HTTP ${exchangeRes.status} - ${errorText}`);
+    }
+
+    const exchangeData = await exchangeRes.json();
+    if (exchangeData.access_token) {
+      upsertEnvValue('OPENAI_CODEX_ACCESS_TOKEN', exchangeData.access_token);
+      if (exchangeData.refresh_token) {
+        upsertEnvValue('OPENAI_CODEX_REFRESH_TOKEN', exchangeData.refresh_token);
+      }
+      logOk('Successfully authenticated and saved OpenAI Codex tokens to .env');
+      logInfo('Applying updated provider credentials by restarting NeoAgent...');
+      cmdRestart();
+    } else {
+      throw new Error('OpenAI token exchange succeeded but did not return an access token.');
+    }
+  }
+}
+
 function installDependencies() {
   heading('Dependencies');
   runOrThrow('npm', ['install', '--omit=dev', '--no-audit', '--no-fund'], {
@@ -867,6 +1049,11 @@ function cmdRestart() {
   cmdStart();
 }
 
+async function cmdRebuildWeb() {
+  heading(`Rebuild Flutter Web Client`);
+  buildBundledWebClientIfPossible();
+}
+
 function cmdUninstall() {
   heading(`Uninstall ${APP_NAME}`);
   const platform = detectPlatform();
@@ -962,6 +1149,8 @@ function cmdUpdate(args = []) {
   }
   const versionBefore = currentInstalledVersionLabel();
   let versionAfter = versionBefore;
+  const githubInstallRef = releaseChannel === 'beta' ? '#beta' : '';
+  const githubInstallSpec = `git+https://github.com/NeoLabs-Systems/NeoAgent.git${githubInstallRef}`;
 
   if (fs.existsSync(path.join(APP_DIR, '.git')) && commandExists('git')) {
     const current = runQuiet('git', ['rev-parse', '--short', 'HEAD']);
@@ -982,17 +1171,16 @@ function cmdUpdate(args = []) {
       buildBundledWebClientIfPossible();
     }
   } else {
-    const npmTag = resolvePreferredNpmTag(releaseChannel);
-    logWarn(`No git repo detected; attempting npm global update from ${npmTag}.`);
+    logWarn(`No git repo detected; attempting npm global update from ${githubInstallSpec}.`);
     if (commandExists('npm')) {
       try {
         backupRuntimeData();
-        runOrThrow('npm', ['install', '-g', `neoagent@${npmTag}`, '--force'], {
+        runOrThrow('npm', ['install', '-g', githubInstallSpec, '--force'], {
           env: withInstallEnv()
         });
-        logOk('npm global update completed (forced reinstall)');
+        logOk('npm global update completed (forced reinstall from GitHub)');
       } catch {
-        logWarn(`npm global update failed. Run: npm install -g neoagent@${npmTag} --force`);
+        logWarn(`npm global update failed. Run: npm install -g ${githubInstallSpec} --force`);
       }
     } else {
       logWarn('npm not found. Cannot perform global update.');
@@ -1062,7 +1250,8 @@ async function cmdEnv(args = []) {
 function printHelp() {
   console.log(`${APP_NAME} manager`);
   console.log('Usage: neoagent <command>');
-  console.log('Commands: install | setup | env | channel | update | restart | start | stop | status | logs | uninstall | migrate');
+  console.log('Commands: install | setup | env | channel | update | restart | rebuild-web | start | stop | status | logs | uninstall | migrate | login');
+  console.log('Login usage: neoagent login github-copilot | neoagent login openai-codex');
   console.log('Channel usage: neoagent channel | neoagent channel stable | neoagent channel beta');
   console.log('Update usage: neoagent update | neoagent update stable | neoagent update beta');
   console.log('Env usage: neoagent env list | neoagent env get PORT | neoagent env set PORT 3333 | neoagent env unset PORT');
@@ -1094,6 +1283,9 @@ async function runCLI(argv) {
     case 'restart':
       cmdRestart();
       break;
+    case 'rebuild-web':
+      await cmdRebuildWeb();
+      break;
     case 'start':
       cmdStart();
       break;
@@ -1112,6 +1304,9 @@ async function runCLI(argv) {
     case 'migrate':
       await cmdMigrate(argv.slice(1));
       break;
+    case 'login':
+      await cmdLogin(argv.slice(1));
+      break;
     case 'help':
     case '--help':
     case '-h':

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neoagent",
-  "version": "2.3.1-beta.6",
+  "version": "2.3.1-beta.60",
   "description": "Proactive personal AI agent with no limits",
   "license": "MIT",
   "main": "server/index.js",
@@ -16,6 +16,7 @@
     "runtime",
     "server",
     "extensions",
+    "flutter_app",
     "docs",
     "com.neoagent.plist",
     "LICENSE",
@@ -34,8 +35,8 @@
     "docs:dev": "docusaurus start",
     "docs:build": "docusaurus build",
     "docs:preview": "docusaurus serve build",
-    "flutter:run:web": "cd flutter_app && flutter run -d chrome",
-    "flutter:build:web": "cd flutter_app && flutter build web --output ../server/public --dart-define=NEOAGENT_BACKEND_URL=${NEOAGENT_BACKEND_URL:-}",
+    "flutter:run:web": "cd flutter_app && flutter run -d chrome --dart-define=NEOAGENT_WEB_BUILD_ID=$(node ../scripts/web_build_id.js)",
+    "flutter:build:web": "cd flutter_app && flutter build web --output ../server/public --dart-define=NEOAGENT_BACKEND_URL=${NEOAGENT_BACKEND_URL:-} --dart-define=NEOAGENT_WEB_BUILD_ID=$(node ../scripts/web_build_id.js)",
     "manage": "node bin/neoagent.js",
     "test": "node --test",
     "benchmark:tokens": "node scripts/benchmark-token-cost.js",
@@ -76,6 +77,7 @@
     "puppeteer-core": "^24.40.0",
     "puppeteer-extra": "^3.3.6",
     "puppeteer-extra-plugin-stealth": "^2.11.2",
+    "qrcode": "^1.5.4",
     "sharp": "^0.34.5",
     "socket.io": "^4.8.1",
     "telegraf": "^4.16.3",

package/server/db/database.js

@@ -24,7 +24,8 @@ db.exec(`
     password TEXT NOT NULL,
     password_login_enabled INTEGER DEFAULT 1,
     created_at TEXT DEFAULT (datetime('now')),
-    last_login TEXT
+    last_login TEXT,
+    has_completed_onboarding INTEGER DEFAULT 0
   );
 
   CREATE TABLE IF NOT EXISTS agents (
@@ -272,6 +273,19 @@ db.exec(`
     FOREIGN KEY (agent_id) REFERENCES agents(id) ON DELETE SET NULL
   );
 
+  CREATE TABLE IF NOT EXISTS integration_provider_configs (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    user_id INTEGER NOT NULL,
+    agent_id TEXT,
+    provider_key TEXT NOT NULL,
+    config_json TEXT DEFAULT '{}',
+    created_at TEXT DEFAULT (datetime('now')),
+    updated_at TEXT DEFAULT (datetime('now')),
+    FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
+    FOREIGN KEY (agent_id) REFERENCES agents(id) ON DELETE SET NULL,
+    UNIQUE(user_id, agent_id, provider_key)
+  );
+
   CREATE TABLE IF NOT EXISTS browser_extension_pairing_requests (
     id TEXT PRIMARY KEY,
     user_id INTEGER,
@@ -875,6 +889,7 @@ function createAgentScopedIndexes() {
   const statements = [
     ['agent_runs', 'CREATE INDEX IF NOT EXISTS idx_agent_runs_agent ON agent_runs(user_id, agent_id, created_at DESC)'],
     ['integration_connections', 'CREATE INDEX IF NOT EXISTS idx_integration_connections_agent ON integration_connections(user_id, agent_id, provider_key, app_key)'],
+    ['integration_provider_configs', 'CREATE INDEX IF NOT EXISTS idx_integration_provider_configs_agent ON integration_provider_configs(user_id, agent_id, provider_key)'],
     ['messages', 'CREATE INDEX IF NOT EXISTS idx_messages_agent ON messages(user_id, agent_id, created_at DESC)'],
     ['conversations', 'CREATE INDEX IF NOT EXISTS idx_conversations_agent ON conversations(user_id, agent_id, updated_at DESC)'],
     ['scheduled_tasks', 'CREATE INDEX IF NOT EXISTS idx_scheduled_tasks_agent ON scheduled_tasks(user_id, agent_id)'],
@@ -922,6 +937,7 @@ function backfillAgentIds() {
     'platform_connections',
     'mcp_servers',
     'integration_connections',
+    'integration_provider_configs',
     'integration_oauth_states',
     'scheduled_tasks',
     'conversations',
@@ -1303,6 +1319,83 @@ function migrateIntegrationOauthStatesTable() {
   `);
 }
 
+function migrateIntegrationProviderConfigsTable() {
+  if (
+    tableHasColumn('integration_provider_configs', 'agent_id') &&
+    tableHasUniqueIndex('integration_provider_configs', ['user_id', 'agent_id', 'provider_key'])
+  ) {
+    const users = db.prepare('SELECT id FROM users').all();
+    for (const user of users) {
+      const agentId = getMainAgentId(user.id);
+      db.prepare(
+        'UPDATE integration_provider_configs SET agent_id = ? WHERE user_id = ? AND agent_id IS NULL'
+      ).run(agentId, user.id);
+    }
+    return;
+  }
+
+  const rows = db
+    .prepare('SELECT * FROM integration_provider_configs ORDER BY id ASC')
+    .all();
+
+  db.exec('BEGIN');
+  try {
+    db.exec(`
+      ALTER TABLE integration_provider_configs RENAME TO integration_provider_configs_legacy_agent_scope;
+
+      CREATE TABLE integration_provider_configs (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        user_id INTEGER NOT NULL,
+        agent_id TEXT,
+        provider_key TEXT NOT NULL,
+        config_json TEXT DEFAULT '{}',
+        created_at TEXT DEFAULT (datetime('now')),
+        updated_at TEXT DEFAULT (datetime('now')),
+        FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
+        FOREIGN KEY (agent_id) REFERENCES agents(id) ON DELETE SET NULL,
+        UNIQUE(user_id, agent_id, provider_key)
+      );
+    `);
+    const insert = db.prepare(`
+      INSERT OR REPLACE INTO integration_provider_configs (
+        id,
+        user_id,
+        agent_id,
+        provider_key,
+        config_json,
+        created_at,
+        updated_at
+      ) VALUES (?, ?, ?, ?, ?, ?, ?)
+    `);
+
+    for (const row of rows) {
+      insert.run(
+        row.id,
+        row.user_id,
+        row.agent_id || getMainAgentId(row.user_id),
+        row.provider_key,
+        row.config_json,
+        row.created_at,
+        row.updated_at,
+      );
+    }
+
+    db.exec(`
+      DROP TABLE integration_provider_configs_legacy_agent_scope;
+      CREATE INDEX IF NOT EXISTS idx_integration_provider_configs_agent
+        ON integration_provider_configs(user_id, agent_id, provider_key);
+    `);
+    db.exec('COMMIT');
+  } catch (error) {
+    try {
+      db.exec('ROLLBACK');
+    } catch {
+      // Ignore rollback errors and rethrow the original migration failure.
+    }
+    throw error;
+  }
+}
+
 function migrateIntegrationSecretStorage() {
   try {
     const connectionRows = db
@@ -1335,6 +1428,22 @@ function migrateIntegrationSecretStorage() {
   } catch {
     // Preserve startup even if a row cannot be re-encrypted.
   }
+
+  try {
+    const providerRows = db
+      .prepare('SELECT id, config_json FROM integration_provider_configs')
+      .all();
+    const updateProviderConfig = db.prepare(
+      'UPDATE integration_provider_configs SET config_json = ? WHERE id = ?',
+    );
+    for (const row of providerRows) {
+      const current = String(row.config_json || '');
+      if (!current || isEncryptedValue(current)) continue;
+      updateProviderConfig.run(encryptValue(current), row.id);
+    }
+  } catch {
+    // Preserve startup even if a row cannot be re-encrypted.
+  }
 }
 
 function backfillVerifiedAccountEmails() {
@@ -1408,11 +1517,26 @@ rebuildPlatformConnectionsForAgents();
 rebuildCoreMemoryForAgents();
 migrateIntegrationConnectionsTable();
 migrateIntegrationOauthStatesTable();
+migrateIntegrationProviderConfigsTable();
 createAgentScopedIndexes();
+backfillAgentIds();
 migrateIntegrationSecretStorage();
 backfillVerifiedAccountEmails();
 rebuildFtsForAgents();
 
+function migrateUsersOnboarding() {
+  try {
+    const columns = db.pragma('table_info(users)');
+    const hasOnboardingCol = columns.some((c) => c.name === 'has_completed_onboarding');
+    if (!hasOnboardingCol) {
+      db.exec('ALTER TABLE users ADD COLUMN has_completed_onboarding INTEGER DEFAULT 0');
+    }
+  } catch (err) {
+    console.warn('Could not add has_completed_onboarding column:', err.message);
+  }
+}
+migrateUsersOnboarding();
+
 try {
   db.exec(`
     INSERT OR REPLACE INTO conversation_history_fts(rowid, content, role, user_id, agent_id, agent_run_id)

package/server/http/middleware.js

@@ -68,6 +68,9 @@ ensureSessionStoreSchema(sessionsDb);
 
 function buildHelmetOptions({ secureCookies }) {
   const wsConnectSrc = secureCookies ? ['wss:'] : ['ws:', 'wss:'];
+  const isDevelopment = String(process.env.NODE_ENV || '').trim() === 'development';
+  // Flutter web (CanvasKit) requires external script/connect sources and wasm eval.
+  // Keep strict overrides available via env for hardened deployments.
   const allowUnsafeEval = boolEnv('NEOAGENT_CSP_ALLOW_UNSAFE_EVAL', true);
   const allowExternalScriptCdn = boolEnv('NEOAGENT_CSP_ALLOW_EXTERNAL_SCRIPT_CDN', true);
   const allowExternalConnect = boolEnv('NEOAGENT_CSP_ALLOW_EXTERNAL_CONNECT', true);
@@ -82,20 +85,31 @@ function buildHelmetOptions({ secureCookies }) {
 
   const connectSrc = ["'self'", ...wsConnectSrc];
   if (allowExternalConnect) {
-    connectSrc.push('https://fonts.googleapis.com', 'https://fonts.gstatic.com', 'https://www.gstatic.com', 'https://api.qrserver.com');
+    connectSrc.push('https://fonts.googleapis.com', 'https://fonts.gstatic.com', 'https://www.gstatic.com', 'https://cdn.jsdelivr.net');
   }
 
   return {
     strictTransportSecurity: false,
     crossOriginOpenerPolicy: false,
+    crossOriginResourcePolicy: { policy: 'same-site' },
     originAgentCluster: false,
+    referrerPolicy: { policy: 'strict-origin-when-cross-origin' },
+    permissionsPolicy: {
+      features: {
+        camera: ['self'],
+        geolocation: ['self'],
+        microphone: ['self'],
+        payment: [],
+        usb: [],
+      },
+    },
     contentSecurityPolicy: {
       directives: {
         defaultSrc: ["'self'"],
         scriptSrc,
         scriptSrcAttr: ["'unsafe-inline'"],
         styleSrc: ["'self'", "'unsafe-inline'", 'https://fonts.googleapis.com'],
-        imgSrc: ["'self'", 'data:', 'blob:', 'https://api.qrserver.com'],
+        imgSrc: ["'self'", 'data:', 'blob:'],
         mediaSrc: ["'self'", 'data:', 'blob:'],
         connectSrc,
         fontSrc: ["'self'", 'data:', 'https://fonts.gstatic.com'],
@@ -154,6 +168,16 @@ function applyHttpMiddleware(app, { secureCookies, trustProxy, sessionMiddleware
     const path = `${value}`.split('?')[0];
     return path === '/socket.io/' || path === '/socket.io' || path.startsWith('/socket.io/');
   };
+  const isStateChangingMethod = (method = '') => ['POST', 'PUT', 'PATCH', 'DELETE'].includes(String(method).toUpperCase());
+  const extractOriginFromReferer = (referer = '') => {
+    const value = String(referer || '').trim();
+    if (!value) return '';
+    try {
+      return new URL(value).origin;
+    } catch {
+      return '';
+    }
+  };
   const requestPath = (req) => req.originalUrl || req.url || req.path || '';
   const applyOnlyToRecordingChunk = (handler) => (req, res, next) => (
     isRecordingChunkPath(requestPath(req)) ? handler(req, res, next) : next()
@@ -187,6 +211,35 @@ function applyHttpMiddleware(app, { secureCookies, trustProxy, sessionMiddleware
       });
     })
   );
+  app.use((req, res, next) => {
+    const path = `${req.originalUrl || req.url || req.path || ''}`.split('?')[0];
+    if (path.startsWith('/api/')) {
+      res.setHeader('Cache-Control', 'no-store, max-age=0');
+      res.setHeader('Pragma', 'no-cache');
+      res.setHeader('Expires', '0');
+    }
+    next();
+  });
+  app.use((req, res, next) => {
+    const path = `${req.originalUrl || req.url || req.path || ''}`.split('?')[0];
+    if (!path.startsWith('/api/')) return next();
+    if (!isStateChangingMethod(req.method)) return next();
+
+    const origin = String(req.get('origin') || '').trim() || extractOriginFromReferer(req.get('referer'));
+    if (!origin) return next();
+
+    const allowBrowserExtensionOrigin = isBrowserExtensionCorsPath(path);
+    return validateOrigin(origin, (error) => {
+      if (error) {
+        logRequestSummary('warn', req, 'blocked state-changing request due to invalid origin', { origin });
+        return res.status(403).json({ error: 'Origin not allowed' });
+      }
+      return next();
+    }, {
+      allowChromeExtension: allowBrowserExtensionOrigin,
+      allowMissingOrigin: false,
+    });
+  });
   app.use((req, res, next) => {
     const startedAt = Date.now();
 

package/server/http/routes.js

@@ -26,6 +26,7 @@ const routeRegistry = [
   { basePath: '/api/desktop', modulePath: '../routes/desktop' },
   { basePath: '/api/recordings', modulePath: '../routes/recordings' },
   { basePath: '/api/voice-assistant', modulePath: '../routes/voice_assistant' },
+  { basePath: '/api/wearable', modulePath: '../routes/wearable' },
   { basePath: '/api/mobile/health', modulePath: '../routes/mobile-health' },
   { basePath: '/api/screen-history', modulePath: '../routes/screenHistory' },
   { basePath: '/api/triggers', modulePath: '../routes/triggers' }

package/server/http/static.js

@@ -7,6 +7,35 @@ const { DATA_DIR } = require('../../runtime/paths');
 const { requireAuth } = require('../middleware/auth');
 
 const FLUTTER_WEB_DIR = path.join(__dirname, '..', 'public');
+const BUILD_ID_PATH = path.join(FLUTTER_WEB_DIR, '.last_build_id');
+
+function setNoStoreHeaders(res) {
+  res.set('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
+  res.set('Pragma', 'no-cache');
+  res.set('Expires', '0');
+  res.set('Surrogate-Control', 'no-store');
+  res.set('CDN-Cache-Control', 'no-store');
+}
+
+function readCurrentBuildId() {
+  try {
+    return fs.readFileSync(BUILD_ID_PATH, 'utf8').trim() || null;
+  } catch {
+    return null;
+  }
+}
+
+function setFlutterStaticHeaders(res, filePath) {
+  const relativePath = path.relative(FLUTTER_WEB_DIR, filePath).replaceAll('\\', '/');
+  if (
+    relativePath === 'index.html' ||
+    relativePath === 'flutter_bootstrap.js' ||
+    relativePath === 'flutter_service_worker.js' ||
+    relativePath === 'version.json'
+  ) {
+    setNoStoreHeaders(res);
+  }
+}
 
 function registerStaticRoutes(app) {
   app.use(
@@ -27,7 +56,17 @@ function registerStaticRoutes(app) {
     express.static(path.join(DATA_DIR, 'screenshots'))
   );
 
-  app.use(express.static(FLUTTER_WEB_DIR, { index: false }));
+  app.get('/app-build.json', (req, res) => {
+    setNoStoreHeaders(res);
+    res.json({
+      buildId: readCurrentBuildId(),
+    });
+  });
+
+  app.use(express.static(FLUTTER_WEB_DIR, {
+    index: false,
+    setHeaders: setFlutterStaticHeaders,
+  }));
   app.get(/^\/(?!api|screenshots|telnyx-audio).*/, serveFlutterApp);
 }
 
@@ -40,6 +79,7 @@ function serveFlutterApp(req, res) {
         'Flutter web build not found. Run "npm run flutter:build:web" to generate the bundled client.'
       );
   }
+  setNoStoreHeaders(res);
   return res.sendFile(entry);
 }
 

package/server/index.js

@@ -35,6 +35,7 @@ const { registerErrorHandler } = require('./http/errors');
 const { startServices, stopServices } = require('./services/manager');
 const { bindBrowserExtensionGateway } = require('./services/browser/extension/gateway');
 const { bindDesktopCompanionGateway } = require('./services/desktop/gateway');
+const { bindWearableGateway } = require('./services/wearable/gateway');
 
 function parseBooleanFlag(value, fallback = false) {
   const normalized = String(value || '').trim().toLowerCase();
@@ -97,6 +98,7 @@ if (!configuredSessionSecret()) {
 }
 
 const app = express();
+app.disable('x-powered-by');
 const httpServer = createServer(app);
 const io = createSocketServer(httpServer, { validateOrigin });
 app.locals.httpRuntimeConfig = {
@@ -123,6 +125,7 @@ registerStaticRoutes(app);
 registerErrorHandler(app);
 bindBrowserExtensionGateway(httpServer, app);
 bindDesktopCompanionGateway(httpServer, app, sessionMiddleware);
+bindWearableGateway(httpServer, app, sessionMiddleware);
 
 let shuttingDown = false;
 let shutdownExitCode = 0;

package/server/public/.last_build_id

@@ -1 +1 @@
-dc2ac3821de37958afef0c20433c5630
+5688ec90b02e934df4a3c734aec6f6ab