neoagent 2.4.1-beta.36 → 2.4.1-beta.37

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neoagent",
-  "version": "2.4.1-beta.36",
+  "version": "2.4.1-beta.37",
   "description": "Proactive personal AI agent with no limits",
   "license": "AGPL-3.0-only",
   "main": "server/index.js",

package/server/db/ftsQuery.js

@@ -0,0 +1,27 @@
+'use strict';
+
+// Shared builder for SQLite FTS5 MATCH expressions. Any code path that feeds a
+// user-supplied string into a `... MATCH ?` query must route it through here:
+// raw input regularly contains characters that are special in FTS5's query
+// grammar and would otherwise throw at query time.
+//
+// Two pitfalls are handled:
+//   1. Hyphens — inside a MATCH a `-` is the NOT/column operator, so a bareword
+//      like `covid-19*` parses as `covid AND NOT column "19"` and throws
+//      "no such column: 19". The token regex excludes `-`, splitting on it.
+//   2. Bareword operators — an uppercase token such as AND/OR/NOT/NEAR is parsed
+//      as an operator ("syntax error near AND"). FTS5's tokenizer is
+//      case-insensitive, so lowercasing each token neutralizes the collision
+//      while preserving matches.
+//
+// Returns a prefix-matched AND query (e.g. `covid* AND 19*`), or null when the
+// input yields no usable tokens — callers should treat null as "no FTS filter".
+
+function buildFtsQuery(query) {
+  const tokens = String(query || '')
+    .match(/[\p{L}\p{N}_]{2,}/gu) || [];
+  if (!tokens.length) return null;
+  return tokens.map((token) => `${token.toLowerCase().replace(/"/g, '')}*`).join(' AND ');
+}
+
+module.exports = { buildFtsQuery };

package/server/middleware/auth.js

@@ -18,43 +18,4 @@ function requireNoAuth(req, res, next) {
   next();
 }
 
-function attachUser(req, res, next) {
-  if (req.session && req.session.userId) {
-    const db = require('../db/database');
-    const now = Date.now();
-    const cacheMaxAgeMs = 5 * 60 * 1000;
-    const cachedUser = req.session._cachedUser;
-    const cachedAt = Number(req.session._cachedUserAt || 0);
-    const cacheFresh = (
-      cachedUser
-      && Number(cachedUser.id) === Number(req.session.userId)
-      && cachedAt > 0
-      && (now - cachedAt) < cacheMaxAgeMs
-    );
-
-    if (cacheFresh) {
-      req.user = { ...cachedUser };
-      return next();
-    }
-
-    const user = db.prepare('SELECT id, username, email, created_at FROM users WHERE id = ?').get(req.session.userId);
-    if (user) {
-      req.user = { ...user };
-      req.session._cachedUser = { ...user };
-      req.session._cachedUserAt = now;
-      console.log(`[Auth] Attached user ${user.id} (${user.username}) to ${req.method} ${req.originalUrl || req.url}`);
-      return next();
-    }
-
-    console.warn(`[Auth] Session user ${req.session.userId} not found for ${req.method} ${req.originalUrl || req.url}; destroying session`);
-    req.session.destroy(() => {});
-    const requestPath = req.originalUrl || req.url || req.path || '';
-    if (requestPath.startsWith('/api/')) {
-      return res.status(401).json({ error: 'Session invalid' });
-    }
-    return res.redirect('/login');
-  }
-  next();
-}
-
-module.exports = { requireAuth, requireNoAuth, attachUser };
+module.exports = { requireAuth, requireNoAuth };

package/server/public/.last_build_id

@@ -1 +1 @@
-cd629bebff6e6d3f781e6810f13e3583
+63ce7c2ea80de28857e3b28e2f06864b

package/server/public/flutter_bootstrap.js

@@ -37,6 +37,6 @@ _flutter.buildConfig = {"engineRevision":"c416acfeb8126e097f758c664aaa3da929e27d
 
 _flutter.loader.load({
   serviceWorkerSettings: {
-    serviceWorkerVersion: "4109168282" /* Flutter's service worker is deprecated and will be removed in a future Flutter release. */
+    serviceWorkerVersion: "2365760185" /* Flutter's service worker is deprecated and will be removed in a future Flutter release. */
   }
 });