neoagent 2.3.1-beta.6 → 2.3.1-beta.60

package/server/services/integrations/google/provider.js

@@ -300,6 +300,7 @@ function createGoogleWorkspaceProvider() {
     description:
       'Official Gmail, Calendar, Drive, Docs, and Sheets integrations with app-specific accounts.',
     icon: 'google',
+    requiresRefreshToken: true,
     apps: GOOGLE_WORKSPACE_APPS.map(({ id, label, description }) => ({
       id,
       label,

package/server/services/integrations/manager.js

@@ -13,6 +13,43 @@ const {
 
 const OAUTH_STATE_PATTERN = /^[a-f0-9]{32,128}$/i;
 
+function isLikelyExpiredConnectionError(error) {
+  const message = String(error?.message || error || '').toLowerCase();
+  if (!message) return false;
+  return [
+    'invalid_grant',
+    'token refresh failed',
+    'token expired',
+    'access token is missing',
+    'refresh token is missing',
+    'reconnect this integration account',
+    'account is no longer authorized',
+    'reauthorize',
+    're-authorize',
+  ].some((hint) => message.includes(hint));
+}
+
+function assertDurableOAuthCredentials(provider, credentials) {
+  const label = String(provider?.label || 'This integration').trim() || 'This integration';
+  const normalizedCredentials =
+    credentials && typeof credentials === 'object' ? credentials : {};
+
+  if (!String(normalizedCredentials.access_token || '').trim()) {
+    throw new Error(
+      `${label} did not return an access token, so the connection could not be completed.`,
+    );
+  }
+
+  if (
+    provider?.requiresRefreshToken === true &&
+    !String(normalizedCredentials.refresh_token || '').trim()
+  ) {
+    throw new Error(
+      `${label} did not return a refresh token, so the connection would expire. Revoke the existing app grant for this provider and reconnect it so offline access is granted.`,
+    );
+  }
+}
+
 class IntegrationManager {
   constructor(options = {}) {
     this.app = options.app || null;
@@ -147,7 +184,12 @@ class IntegrationManager {
 
     return this.registry
       .list()
-      .map((provider) => provider.buildSnapshot(rowsByProvider.get(provider.key) || []));
+      .map((provider) =>
+        provider.buildSnapshot(rowsByProvider.get(provider.key) || [], {
+          userId,
+          agentId: scopedAgentId,
+        }),
+      );
   }
 
   async beginOAuth(userId, providerKey, options = {}) {
@@ -163,7 +205,10 @@ class IntegrationManager {
       throw new Error(`Unknown ${provider.label} app: ${appKey || 'missing app key'}`);
     }
 
-    const env = provider.getEnvStatus();
+    const env = provider.getEnvStatus({
+      userId,
+      agentId,
+    });
     if (!env.configured) {
       throw new Error(env.summary);
     }
@@ -193,6 +238,7 @@ class IntegrationManager {
       state,
       codeVerifier,
       userId,
+      agentId,
       appKey,
     });
 
@@ -264,6 +310,7 @@ class IntegrationManager {
 
     const result = await provider.finishOAuth({
       userId: stateRow.user_id,
+      agentId: stateRow.agent_id || resolveAgentId(stateRow.user_id, null),
       state: stateRow.state,
       code: normalizedCode,
       codeVerifier: decryptValue(stateRow.code_verifier),
@@ -277,11 +324,7 @@ class IntegrationManager {
       result.accountEmail,
       result.credentials,
     );
-    if (!mergedCredentials.refresh_token) {
-      throw new Error(
-        `${provider.label} did not return a refresh token, so the connection would expire. Revoke the existing app grant for this provider and reconnect it so offline access is granted.`,
-      );
-    }
+    assertDurableOAuthCredentials(provider, mergedCredentials);
 
     db.prepare(
       `INSERT INTO integration_connections (
@@ -389,7 +432,10 @@ class IntegrationManager {
   getToolDefinitions(userId, agentId = null) {
     const definitions = [];
     for (const provider of this.registry.list()) {
-      const env = provider.getEnvStatus();
+      const env = provider.getEnvStatus({
+        userId,
+        agentId,
+      });
       if (!env.configured) continue;
       const connections = this.listConnections(userId, provider.key, agentId);
       const connectedAppIds = Array.from(
@@ -411,9 +457,15 @@ class IntegrationManager {
     if (!provider) {
       throw new Error(`Unknown integration provider: ${providerKey}`);
     }
-    const env = provider.getEnvStatus();
+    const env = provider.getEnvStatus({
+      userId,
+      agentId,
+    });
     const connections = this.listConnections(userId, provider.key, agentId);
-    const snapshot = provider.buildSnapshot(connections);
+    const snapshot = provider.buildSnapshot(connections, {
+      userId,
+      agentId,
+    });
     const connectedAppIds = snapshot.apps
       .filter((app) => app.connection.connected)
       .map((app) => app.id);
@@ -582,7 +634,10 @@ class IntegrationManager {
     for (const provider of this.registry.list()) {
       if (!provider.supportsTool(toolName)) continue;
       foundSupportingProvider = true;
-      const env = provider.getEnvStatus();
+      const env = provider.getEnvStatus({
+        userId,
+        agentId,
+      });
       if (!env.configured) {
         return { error: env.summary };
       }
@@ -607,6 +662,17 @@ class IntegrationManager {
           selection.connection,
         );
       } catch (err) {
+        if (isLikelyExpiredConnectionError(err)) {
+          db.prepare(
+            `UPDATE integration_connections
+             SET status = 'expired', updated_at = datetime('now')
+             WHERE id = ? AND user_id = ? AND agent_id = ?`,
+          ).run(
+            selection.connection.id,
+            userId,
+            resolveAgentId(userId, agentId),
+          );
+        }
         return { error: err?.message || 'execution_error' };
       }
       if (!execution) {
@@ -641,7 +707,13 @@ class IntegrationManager {
   summarizeConnectedProviders(userId, agentId = null) {
     const providers = this.registry.list().map((provider) => ({
       provider,
-      snapshot: provider.buildSnapshot(this.listConnections(userId, provider.key, agentId)),
+      snapshot: provider.buildSnapshot(
+        this.listConnections(userId, provider.key, agentId),
+        {
+          userId,
+          agentId,
+        },
+      ),
     }));
 
     if (providers.length === 0) {
@@ -655,6 +727,9 @@ class IntegrationManager {
         }
 
         if (!snapshot?.env?.configured) {
+          if (snapshot?.env?.setupMode === 'user') {
+            return `${provider.label}: setup is not complete for this user yet. If the user wants to use it, tell them to finish setup in Official Integrations first.`;
+          }
           return `${provider.label}: available but not configured on the server yet. If the user wants to use it, tell them to finish setup in Official Integrations first.`;
         }
 
@@ -669,5 +744,6 @@ class IntegrationManager {
 }
 
 module.exports = {
+  assertDurableOAuthCredentials,
   IntegrationManager,
 };

package/server/services/integrations/microsoft/provider.js

@@ -346,6 +346,7 @@ function createMicrosoftProvider() {
     description:
       'Official Microsoft 365 OAuth account connections for Outlook, Calendar, OneDrive, and Teams.',
     icon: 'microsoft',
+    requiresRefreshToken: true,
     apps: MICROSOFT_APPS,
     toolDefinitions: microsoftToolDefinitions,
     connectPrompt:

package/server/services/integrations/oauth_provider.js

@@ -241,14 +241,17 @@ function createOAuthProvider(options = {}) {
     label: options.label,
     description: options.description,
     icon: options.icon,
+    requiresRefreshToken: options.requiresRefreshToken === true,
     apps: apps.map(({ id, label, description }) => ({ id, label, description })),
     connectPrompt: options.connectPrompt || null,
+    supportsMultipleAccounts: options.supportsMultipleAccounts !== false,
+    connectionMethod: options.connectionMethod || 'oauth',
     getApp,
     getToolAppId(toolName) {
       return toolAppMap.get(String(toolName || '').trim()) || null;
     },
-    getEnvStatus() {
-      return options.getEnvStatus();
+    getEnvStatus(context = {}) {
+      return options.getEnvStatus(context);
     },
     getToolDefinitions(toolOptions = {}) {
       const connectedAppIds = new Set(toolOptions.connectedAppIds || []);
@@ -257,8 +260,8 @@ function createOAuthProvider(options = {}) {
     supportsTool(toolName) {
       return toolAppMap.has(String(toolName || '').trim());
     },
-    buildSnapshot(connectionRows) {
-      const env = this.getEnvStatus();
+    buildSnapshot(connectionRows, context = {}) {
+      const env = this.getEnvStatus(context);
       const byApp = new Map();
       for (const row of Array.isArray(connectionRows) ? connectionRows : []) {
         const appId = String(row.app_key || '').trim();
@@ -311,15 +314,17 @@ function createOAuthProvider(options = {}) {
           0,
         ),
         connectPrompt: this.connectPrompt,
+        supportsMultipleAccounts: this.supportsMultipleAccounts,
+        connectionMethod: this.connectionMethod,
       };
     },
-    async beginOAuth({ state, codeVerifier, appKey, userId }) {
+    async beginOAuth({ state, codeVerifier, appKey, userId, agentId }) {
       const app = getApp(appKey);
       if (!app) {
         throw new Error(`Unknown ${this.label} app: ${appKey}`);
       }
       const normalizedState = assertValidOAuthState(state);
-      const env = this.getEnvStatus();
+      const env = this.getEnvStatus({ userId, agentId });
       if (!env.configured) {
         throw new Error(env.summary);
       }
@@ -327,11 +332,12 @@ function createOAuthProvider(options = {}) {
         state: normalizedState,
         codeVerifier,
         userId,
+        agentId,
         app,
         env,
       });
     },
-    async finishOAuth({ code, codeVerifier, appKey, userId, state }) {
+    async finishOAuth({ code, codeVerifier, appKey, userId, agentId, state }) {
       const app = getApp(appKey);
       if (!app) {
         throw new Error(`Unknown ${this.label} app: ${appKey}`);
@@ -341,9 +347,10 @@ function createOAuthProvider(options = {}) {
         code,
         codeVerifier,
         userId,
+        agentId,
         state: normalizedState,
         app,
-        env: this.getEnvStatus(),
+        env: this.getEnvStatus({ userId, agentId }),
       });
     },
     async disconnect(connectionRow) {
@@ -368,12 +375,19 @@ function createOAuthProvider(options = {}) {
         appId: toolAppMap.get(String(toolName || '').trim()) || connectionRow.app_key,
         connection: connectionRow,
         credentials,
+        env: this.getEnvStatus({
+          userId: connectionRow?.user_id,
+          agentId: connectionRow?.agent_id,
+        }),
       });
     },
     summarizeConnection(connectionRows) {
       const snapshot = this.buildSnapshot(connectionRows);
       if (!snapshot.connection.connected) {
         if (snapshot.connection.status === 'env_not_configured') {
+          if (snapshot?.env?.setupMode === 'user') {
+            return `${this.label} still needs per-user setup before accounts can connect.`;
+          }
           return `${this.label} still needs administrator setup before accounts can connect.`;
         }
         return `${this.label} is not connected.`;
@@ -392,6 +406,9 @@ function createOAuthProvider(options = {}) {
     },
     summarizeForModel(snapshot) {
       if (!snapshot?.env?.configured) {
+        if (snapshot?.env?.setupMode === 'user') {
+          return `${this.label}: setup is user-managed and is not complete yet. If the user wants to use it, tell them to open Official Integrations and finish setup in their account first.`;
+        }
         return `${this.label}: workspace setup is not complete yet. If the user wants to use it, tell them to open Official Integrations and ask an administrator to finish setup first.`;
       }
 

package/server/services/integrations/provider_config_store.js

@@ -0,0 +1,85 @@
+'use strict';
+
+const db = require('../../db/database');
+const { decryptValue, encryptValue } = require('./secrets');
+const { resolveAgentId } = require('../agents/manager');
+
+function normalizeProviderKey(providerKey) {
+  return String(providerKey || '').trim();
+}
+
+function parseConfig(value) {
+  try {
+    const parsed = JSON.parse(decryptValue(value || '{}') || '{}');
+    return parsed && typeof parsed === 'object' ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+
+function getProviderConfig(userId, providerKey, agentId = null) {
+  const normalizedProviderKey = normalizeProviderKey(providerKey);
+  const normalizedUserId = Number(userId);
+  if (!Number.isInteger(normalizedUserId) || normalizedUserId <= 0 || !normalizedProviderKey) {
+    return {};
+  }
+  const scopedAgentId = resolveAgentId(normalizedUserId, agentId);
+
+  const row = db
+    .prepare(
+      `SELECT config_json
+       FROM integration_provider_configs
+       WHERE user_id = ? AND agent_id = ? AND provider_key = ?`,
+    )
+    .get(normalizedUserId, scopedAgentId, normalizedProviderKey);
+
+  return parseConfig(row?.config_json);
+}
+
+function setProviderConfig(userId, providerKey, config, agentId = null) {
+  const normalizedProviderKey = normalizeProviderKey(providerKey);
+  const normalizedUserId = Number(userId);
+  if (!Number.isInteger(normalizedUserId) || normalizedUserId <= 0 || !normalizedProviderKey) {
+    throw new Error('A valid user and provider are required to save integration config.');
+  }
+  const scopedAgentId = resolveAgentId(normalizedUserId, agentId);
+
+  const payload = config && typeof config === 'object' ? config : {};
+  db.prepare(
+    `INSERT INTO integration_provider_configs (
+       user_id,
+       agent_id,
+       provider_key,
+       config_json,
+       created_at,
+       updated_at
+     ) VALUES (?, ?, ?, ?, datetime('now'), datetime('now'))
+     ON CONFLICT(user_id, agent_id, provider_key) DO UPDATE SET
+       config_json = excluded.config_json,
+       updated_at = excluded.updated_at`,
+  ).run(
+    normalizedUserId,
+    scopedAgentId,
+    normalizedProviderKey,
+    encryptValue(JSON.stringify(payload)),
+  );
+}
+
+function deleteProviderConfig(userId, providerKey, agentId = null) {
+  const normalizedProviderKey = normalizeProviderKey(providerKey);
+  const normalizedUserId = Number(userId);
+  if (!Number.isInteger(normalizedUserId) || normalizedUserId <= 0 || !normalizedProviderKey) {
+    return;
+  }
+  const scopedAgentId = resolveAgentId(normalizedUserId, agentId);
+
+  db.prepare(
+    'DELETE FROM integration_provider_configs WHERE user_id = ? AND agent_id = ? AND provider_key = ?',
+  ).run(normalizedUserId, scopedAgentId, normalizedProviderKey);
+}
+
+module.exports = {
+  deleteProviderConfig,
+  getProviderConfig,
+  setProviderConfig,
+};

package/server/services/integrations/registry.js

@@ -2,7 +2,8 @@
 
 const { createFigmaProvider } = require('./figma/provider');
 const { createGoogleWorkspaceProvider } = require('./google/provider');
-const { createHomeAssistantProvider } = require('./home_assistant/provider');
+const { createGithubProvider } = require('./github/provider');
+const { createTrelloProvider } = require('./trello/provider');
 const { createMicrosoftProvider } = require('./microsoft/provider');
 const { createNotionProvider } = require('./notion/provider');
 const { createSpotifyProvider } = require('./spotify/provider');
@@ -13,11 +14,12 @@ const { createWhatsAppPersonalProvider } = require('./whatsapp');
 function createIntegrationRegistry(options = {}) {
   const providers = [
     createGoogleWorkspaceProvider(),
+    createGithubProvider(),
     createNotionProvider(),
     createMicrosoftProvider(),
     createSlackProvider(),
     createFigmaProvider(),
-    createHomeAssistantProvider(),
+    createTrelloProvider(),
     createWeatherProvider(),
     createSpotifyProvider(),
     createWhatsAppPersonalProvider(options),

package/server/services/integrations/spotify/provider.js

@@ -394,6 +394,7 @@ function createSpotifyProvider() {
     label: 'Spotify',
     description: 'Official Spotify account integration for music search and playback control.',
     icon: 'spotify',
+    requiresRefreshToken: true,
     apps: SPOTIFY_APPS,
     toolDefinitions: spotifyToolDefinitions,
     connectPrompt: