neoagent 2.3.1-beta.84 → 2.3.1-beta.86

package/server/services/runtime/settings.js

@@ -19,8 +19,8 @@ function getEffectiveDefaults() {
 }
 
 const BASE_FALLBACK_SETTINGS = Object.freeze({
-  runtime_profile: 'trusted-host',
-  runtime_backend: 'host',
+  runtime_profile: 'secure-vm',
+  runtime_backend: 'vm',
   browser_backend: 'vm',
   android_backend: 'host',
   mcp_backend: 'host-remote',
@@ -36,15 +36,10 @@ function normalizeChoice(value, allowed, fallback) {
 function deriveDefaultsForProfile(profile) {
   switch (profile) {
     case 'secure-vm':
-      return {
-        runtime_backend: 'vm',
-        browser_backend: 'vm',
-        android_backend: 'vm',
-      };
     case 'trusted-host':
     default:
       return {
-        runtime_backend: 'host',
+        runtime_backend: 'vm',
         browser_backend: 'vm',
         android_backend: 'host',
       };
@@ -56,14 +51,14 @@ function normalizeRuntimeSettings(raw = {}) {
   const defaults = getEffectiveDefaults();
   const profile = normalizeChoice(raw.runtime_profile, ['secure-vm', 'trusted-host'], defaults.runtime_profile);
   const derived = deriveDefaultsForProfile(profile);
-  const runtimeBackend = normalizeChoice(raw.runtime_backend, ['host', 'vm'], derived.runtime_backend);
+  const runtimeBackend = normalizeChoice(raw.runtime_backend, ['vm'], derived.runtime_backend);
   const browserBackend = normalizeChoice(raw.browser_backend, ['vm', 'extension'], derived.browser_backend);
   const androidBackend = normalizeChoice(raw.android_backend, ['host', 'vm'], derived.android_backend);
   return {
-    runtime_profile: profile,
-    runtime_backend: policy.allowHostRuntime ? runtimeBackend : (runtimeBackend === 'host' ? 'vm' : runtimeBackend),
+    runtime_profile: profile === 'trusted-host' ? 'secure-vm' : profile,
+    runtime_backend: runtimeBackend,
     browser_backend: browserBackend === 'extension' ? 'extension' : 'vm',
-    android_backend: policy.allowHostRuntime ? androidBackend : (androidBackend === 'host' ? 'vm' : androidBackend),
+    android_backend: androidBackend === 'vm' ? 'host' : androidBackend,
     mcp_backend: 'host-remote',
   };
 }
@@ -107,8 +102,8 @@ function validateRuntimeSettings(raw = {}) {
     if (settings.browser_backend !== 'vm' && settings.browser_backend !== 'extension') {
       issues.push('This deployment requires the VM browser backend or a paired browser extension backend.');
     }
-    if (settings.android_backend !== 'vm') {
-      issues.push('This deployment requires the VM Android backend.');
+    if (settings.android_backend !== 'host') {
+      issues.push('This deployment requires the host Android backend.');
     }
   }
 

package/server/services/runtime/validation.js

@@ -2,49 +2,23 @@
 
 const { getDeploymentPolicy } = require('../../utils/deployment');
 
-function validateGuestToken(token) {
-  const value = String(token || '').trim();
-  if (!value) {
-    return { valid: false, reason: 'NEOAGENT_VM_GUEST_TOKEN is missing.' };
-  }
-  if (value.length < 32) {
-    return { valid: false, reason: 'NEOAGENT_VM_GUEST_TOKEN must be at least 32 characters long.' };
-  }
-  if (/^(change|replace|set|your|example|sample|placeholder|token|secret)[-_a-z0-9]*$/i.test(value)) {
-    return { valid: false, reason: 'NEOAGENT_VM_GUEST_TOKEN looks like a placeholder value.' };
-  }
-  if (/change-this-guest-token-before-prod/i.test(value)) {
-    return { valid: false, reason: 'NEOAGENT_VM_GUEST_TOKEN is using the insecure example placeholder.' };
-  }
-  if (/^(.)\1+$/.test(value)) {
-    return { valid: false, reason: 'NEOAGENT_VM_GUEST_TOKEN must not be a repeated single character.' };
-  }
-  return { valid: true, reason: null };
-}
-
 function getRuntimeValidation(runtimeManager) {
   const policy = getDeploymentPolicy();
   const nodeEnvIsProd = String(process.env.NODE_ENV || '').trim().toLowerCase() === 'prod';
-  const vmReadiness = runtimeManager?.vmBackend?.vmManager?.getReadiness?.() || null;
-  const guestToken = String(runtimeManager?.vmBackend?.token || process.env.NEOAGENT_VM_GUEST_TOKEN || '').trim();
-  const guestTokenValidation = validateGuestToken(guestToken);
+  const browserVmReadiness = runtimeManager?.browserBackend?.vmManager?.getReadiness?.() || null;
+  const vmReadiness = browserVmReadiness || null;
   const issues = [];
 
   if (policy.profile === 'prod' || nodeEnvIsProd) {
-    if (!vmReadiness?.ready) {
-      if (!vmReadiness) {
-        issues.push('prod profile requires a working local VM runtime.');
-      } else {
-        if (!vmReadiness.qemuAvailable) {
-          issues.push(`prod profile requires QEMU (${vmReadiness.qemuBinary}) to be installed.`);
-        }
-        if (!vmReadiness.baseImageExists && !vmReadiness.downloadConfigured) {
-          issues.push('prod profile requires a VM base image or a downloadable base image URL.');
-        }
+    if (!browserVmReadiness) {
+      issues.push('prod profile requires a working local VM runtime for browser/CLI.');
+    } else if (!browserVmReadiness.ready) {
+      if (!browserVmReadiness.qemuAvailable) {
+        issues.push(`prod profile requires QEMU (${browserVmReadiness.qemuBinary}) to be installed for browser/CLI.`);
+      }
+      if (!browserVmReadiness.baseImageExists && !browserVmReadiness.downloadConfigured) {
+        issues.push('prod profile requires a VM base image or a downloadable base image URL for browser/CLI.');
       }
-    }
-    if (!guestTokenValidation.valid) {
-      issues.push(`prod profile requires a secure NEOAGENT_VM_GUEST_TOKEN. ${guestTokenValidation.reason}`);
     }
   }
 
@@ -52,7 +26,7 @@ function getRuntimeValidation(runtimeManager) {
     ready: issues.length === 0,
     issues,
     vm: vmReadiness,
-    guestTokenConfigured: guestTokenValidation.valid,
+    guestTokenConfigured: true,
     policy,
   };
 }
@@ -68,5 +42,4 @@ function assertRuntimeValidation(runtimeManager) {
 module.exports = {
   assertRuntimeValidation,
   getRuntimeValidation,
-  validateGuestToken,
 };

package/server/utils/deployment.js

@@ -65,13 +65,13 @@ function getDeploymentPolicy(env = process.env) {
     allowSelfUpdate: mode !== DEPLOYMENT_MODE_MANAGED,
     registrationOpen: isProdProfile,
     runtimeDefaults: {
-      runtime_profile: isProdProfile ? 'secure-vm' : 'trusted-host',
-      runtime_backend: isProdProfile ? 'vm' : 'host',
+      runtime_profile: 'secure-vm',
+      runtime_backend: 'vm',
       browser_backend: 'vm',
-      android_backend: isProdProfile ? 'vm' : 'host',
+      android_backend: 'host',
       mcp_backend: 'host-remote',
     },
-    allowHostRuntime: !isProdProfile,
+    allowHostRuntime: false,
   };
 }
 

package/server/guest-agent.package.json

@@ -1,16 +0,0 @@
-{
-  "name": "neoagent-guest-agent",
-  "private": true,
-  "version": "1.0.0",
-  "description": "Minimal guest runtime for NeoAgent VM browser, CLI, and Android services (uses puppeteer-core with playwright-chromium browser binaries)",
-  "engines": {
-    "node": ">=20"
-  },
-  "dependencies": {
-    "express": "^4.21.2",
-    "node-pty": "^1.0.0",
-    "playwright-chromium": "^1.59.1",
-    "proper-lockfile": "^4.1.2",
-    "puppeteer-core": "^24.40.0"
-  }
-}