neoagent 2.4.1-beta.8 → 2.4.1

package/server/routes/browser_extension.js

@@ -4,10 +4,10 @@ const rateLimit = require('express-rate-limit');
 const { requireAuth } = require('../middleware/auth');
 const { sanitizeError } = require('../utils/security');
 const { createZipFromDirectory } = require('../services/browser/extension/zip');
+const { getExtensionManifest } = require('../services/browser/extension/manifest');
 
 const router = express.Router();
 const EXTENSION_DIR = path.join(__dirname, '..', '..', 'extensions', 'chrome-browser');
-const EXTENSION_MANIFEST = require('../../extensions/chrome-browser/manifest.json');
 const pairingLimiter = rateLimit({
   windowMs: 15 * 60 * 1000,
   max: 30,
@@ -55,10 +55,12 @@ router.post('/pairing/request', pairingLimiter, (req, res) => {
 });
 
 router.get('/latest', (req, res) => {
+  const manifest = getExtensionManifest();
   res.json({
-    name: EXTENSION_MANIFEST.name,
-    version: EXTENSION_MANIFEST.version,
-    minimumChromeVersion: EXTENSION_MANIFEST.minimum_chrome_version,
+    name: manifest.name,
+    version: manifest.version,
+    versionName: manifest.version_name,
+    minimumChromeVersion: manifest.minimum_chrome_version,
     downloadUrl: `${baseUrlFor(req)}/api/browser-extension/download`,
   });
 });
@@ -123,6 +125,19 @@ router.get('/status', requireAuth, (req, res) => {
   }
 });
 
+router.post('/select-token', requireAuth, (req, res) => {
+  try {
+    const registry = getRegistry(req);
+    const result = registry.setSelectedTokenId(req.session.userId, req.body?.tokenId);
+    res.json({
+      ...result,
+      status: registry.getStatus(req.session.userId),
+    });
+  } catch (err) {
+    res.status(err.status || 500).json({ error: sanitizeError(err) });
+  }
+});
+
 router.post('/revoke', requireAuth, (req, res) => {
   try {
     res.json(getRegistry(req).revoke(req.session.userId, req.body?.tokenId || null));
@@ -133,8 +148,10 @@ router.post('/revoke', requireAuth, (req, res) => {
 
 router.get('/download', requireAuth, (req, res) => {
   try {
+    const manifest = getExtensionManifest();
     const zip = createZipFromDirectory(EXTENSION_DIR, {
       overrides: {
+        'manifest.json': `${JSON.stringify(manifest, null, 2)}\n`,
         'config.mjs': extensionConfigFor(req),
       },
     });

package/server/routes/desktop.js

@@ -163,6 +163,16 @@ router.post('/click', (req, res) =>
     },
   )));
 
+router.post('/mouse-move', (req, res) =>
+  handleDesktopAction(req, res, (provider, request) => provider.mouseMove(
+    parseFiniteNumber(request.body?.x, 'x', { min: -100000, max: 100000 }),
+    parseFiniteNumber(request.body?.y, 'y', { min: -100000, max: 100000 }),
+    {
+      ...(request.body || {}),
+      deviceId: parseDeviceId(request.body?.deviceId),
+    },
+  )));
+
 router.post('/drag', (req, res) =>
   handleDesktopAction(req, res, (provider, request) => provider.drag({
     ...(request.body || {}),

package/server/routes/mcp.js

@@ -6,6 +6,7 @@ const { sanitizeError } = require('../utils/security');
 const { validateRemoteMcpEndpoint } = require('../services/runtime/mcp');
 const { getAgentIdFromRequest, isMainAgent, resolveAgentId } = require('../services/agents/manager');
 const { resolvePublicBaseUrl } = require('../services/integrations/env');
+const { consumeOAuthState } = require('../services/mcp/client_support');
 
 const MCP_OAUTH_STATE_RE = /^(\d+)::[a-f0-9]{32}$/;
 
@@ -45,8 +46,11 @@ router.get('/', (req, res) => {
     config: JSON.parse(s.config || '{}'),
     agentId: s.agent_id || null,
     enabled: !!s.enabled,
-    status: liveStatuses[s.id]?.status || 'stopped',
-    toolCount: liveStatuses[s.id]?.toolCount || 0
+    status: liveStatuses[s.id]?.status || s.status || 'stopped',
+    toolCount: liveStatuses[s.id]?.toolCount || 0,
+    error: liveStatuses[s.id]?.error || null,
+    consecutiveFails: liveStatuses[s.id]?.consecutiveFails || 0,
+    nextRetryAt: liveStatuses[s.id]?.nextRetryAt || null,
   }));
 
   res.json(result);
@@ -70,20 +74,26 @@ router.post('/', (req, res) => {
 });
 
 // Update an MCP server
-router.put('/:id', (req, res) => {
+router.put('/:id', async (req, res) => {
   try {
     const server = db.prepare('SELECT * FROM mcp_servers WHERE id = ? AND user_id = ?').get(req.params.id, req.session.userId);
     if (!server) return res.status(404).json({ error: 'Server not found' });
 
+    const mcpClient = req.app.locals.mcpClient;
+    const wasLive = Boolean(mcpClient.getStatus(req.session.userId)[server.id]);
     const { name, command, config, enabled } = req.body;
     const agentId = (req.body.agentId !== undefined || req.body.agent_id !== undefined)
       ? resolveAgentId(req.session.userId, getAgentIdFromRequest(req))
       : (server.agent_id || resolveAgentId(req.session.userId, null));
     const endpoint = command ? validateRemoteMcpEndpoint(command) : server.command;
-    db.prepare('UPDATE mcp_servers SET agent_id = ?, name = ?, command = ?, config = ?, enabled = ? WHERE id = ?')
+    db.prepare("UPDATE mcp_servers SET agent_id = ?, name = ?, command = ?, config = ?, enabled = ?, status = 'stopped' WHERE id = ?")
       .run(agentId, name || server.name, endpoint, JSON.stringify(config || JSON.parse(server.config)), enabled !== undefined ? (enabled ? 1 : 0) : server.enabled, server.id);
 
-    res.json({ success: true });
+    if (wasLive) {
+      await mcpClient.stopServer(server.id);
+    }
+
+    res.json({ success: true, status: 'stopped' });
   } catch (err) {
     res.status(400).json({ error: sanitizeError(err) });
   }
@@ -109,9 +119,8 @@ router.post('/:id/start', async (req, res) => {
 
     const mcpClient = req.app.locals.mcpClient;
     const result = await mcpClient.startServer(server.id, server.command, server.name, req.session.userId, { agentId: server.agent_id });
-    const tools = await mcpClient.listTools(server.id, req.session.userId);
 
-    res.json({ ...result, tools });
+    res.json(result);
   } catch (err) {
     if (err.message && err.message.startsWith('OAUTH_REDIRECT:')) {
       const url = err.message.substring(15);
@@ -152,20 +161,27 @@ router.get('/:id/tools', async (req, res) => {
 // OAuth Callback
 router.get('/oauth/callback', async (req, res) => {
   const { code, state, error } = req.query;
-  if (!state) return res.status(400).send('Missing state parameter');
-  if (!error && !code) return res.status(400).send('Missing code parameter');
-  if (error) return res.status(400).send(`OAuth Error: ${error}`);
+  if (!state) return res.status(400).type('text/plain').send('Missing state parameter');
 
   const stateMatch = String(state).match(MCP_OAUTH_STATE_RE);
-  if (!stateMatch) return res.status(400).send('Invalid state format');
+  if (!stateMatch) return res.status(400).type('text/plain').send('Invalid state format');
 
   const serverId = Number.parseInt(stateMatch[1], 10);
   if (!Number.isInteger(serverId) || serverId <= 0) {
-    return res.status(400).send('Invalid state format');
+    return res.status(400).type('text/plain').send('Invalid state format');
   }
 
   const server = db.prepare('SELECT id FROM mcp_servers WHERE id = ? AND user_id = ?').get(serverId, req.session.userId);
-  if (!server) return res.status(404).send('Server not found');
+  if (!server) return res.status(404).type('text/plain').send('Server not found');
+  if (!error && !code) {
+    return res.status(400).type('text/plain').send('Missing code parameter');
+  }
+  if (!consumeOAuthState(serverId, state)) {
+    return res.status(400).type('text/plain').send('Invalid or expired OAuth state');
+  }
+  if (error) {
+    return res.status(400).type('text/plain').send(`OAuth error: ${String(error)}`);
+  }
 
   const mcpClient = req.app.locals.mcpClient;
   const trustedOrigin = JSON.stringify(getTrustedPostMessageOrigin(req));

package/server/routes/memory.js

@@ -111,13 +111,19 @@ router.get('/', (req, res) => {
   const agentId = resolveAgentId(userId, getAgentIdFromRequest(req));
   const coreMemory = { ...(mm.getCoreMemory(userId, { agentId }) || {}) };
   delete coreMemory.active_context;
+  const knowledgeViews = mm.listKnowledgeViews(userId, { agentId, limit: 12 });
   res.json({
     agentId,
     assistantBehaviorNotes: mm.getAssistantBehaviorNotes(userId, { agentId }),
     assistantSelfState: mm.getAssistantSelfState(userId, { agentId }),
     dailyLogs: mm.listDailyLogs(7, userId),
     apiKeys: Object.keys(mm.readApiKeys(userId)),
-    coreMemory
+    coreMemory,
+    stats: mm.getMemoryStats(userId, { agentId }),
+    entities: mm.listEntities(userId, { agentId, limit: 12 }),
+    knowledgeViews,
+    ingestionOverview: mm.getIngestionOverview(userId, { agentId }),
+    recentKnowledgeChanges: mm.listRecentKnowledgeChanges(userId, { agentId, limit: 8 }),
   });
 });
 
@@ -157,6 +163,7 @@ router.get('/ingestion/status', (req, res) => {
       jobs: mm.listIngestionJobs(userId, { agentId }),
       recentChanges: mm.listRecentKnowledgeChanges(userId, { agentId }),
       connections: ingestionService?.listConnectionStatuses?.(userId, { agentId }) || [],
+      service: ingestionService?.getStatus?.() || { state: 'unavailable' },
     });
   } catch (err) {
     res.status(500).json({ error: sanitizeError(err) });
@@ -204,6 +211,21 @@ router.get('/knowledge-views', (req, res) => {
   }
 });
 
+router.get('/entities', (req, res) => {
+  const mm = req.app.locals.memoryManager;
+  const userId = req.session.userId;
+  const agentId = resolveAgentId(userId, getAgentIdFromRequest(req));
+  try {
+    res.json(mm.listEntities(userId, {
+      agentId,
+      query: req.query.query || null,
+      limit: req.query.limit,
+    }));
+  } catch (err) {
+    res.status(500).json({ error: sanitizeError(err) });
+  }
+});
+
 router.post('/knowledge-views/materialize', (req, res) => {
   const mm = req.app.locals.memoryManager;
   const userId = req.session.userId;

package/server/routes/messaging.js

@@ -80,6 +80,8 @@ router.post('/disconnect', async (req, res) => {
   try {
     const { platform } = req.body;
     const agentId = resolveAgentId(req.session.userId, getAgentIdFromRequest(req));
+    if (!platform) return res.status(400).json({ error: 'Platform is required' });
+
     const manager = req.app.locals.messagingManager;
     const result = await manager.disconnectPlatform(req.session.userId, platform, { agentId });
     res.json(result);

package/server/routes/screenHistory.js

@@ -2,21 +2,24 @@
 
 const express = require('express');
 const db = require('../db/database');
+const { buildFtsQuery } = require('../db/ftsQuery');
+const { requireAuth } = require('../middleware/auth');
 const { getErrorMessage } = require('../services/bootstrap_helpers');
 
 const router = express.Router();
 
+router.use(requireAuth);
+
 router.get('/search', (req, res) => {
   const { q, limit = 50, offset = 0 } = req.query;
-
-  if (!req.user || !req.user.id) {
-    return res.status(401).json({ error: 'Unauthorized' });
-  }
+  const userId = req.session.userId;
 
   try {
     let results = [];
-    if (q) {
-      // Full text search
+    const ftsQuery = q ? buildFtsQuery(q) : null;
+    if (ftsQuery) {
+      // Full text search. buildFtsQuery sanitizes user input so FTS5 operator
+      // characters (hyphens, AND/OR/NOT) don't throw and 500 the request.
       results = db.prepare(`
         SELECT s.id, s.timestamp, s.app_name, s.text_content
         FROM screen_history_fts fts
@@ -24,7 +27,10 @@ router.get('/search', (req, res) => {
         WHERE screen_history_fts MATCH ? AND s.user_id = ?
         ORDER BY s.timestamp DESC
         LIMIT ? OFFSET ?
-      `).all(q, req.user.id, Number(limit), Number(offset));
+      `).all(ftsQuery, userId, Number(limit), Number(offset));
+    } else if (q) {
+      // Query had no usable search tokens — return no matches rather than error.
+      results = [];
     } else {
       // Recent history
       results = db.prepare(`
@@ -33,7 +39,7 @@ router.get('/search', (req, res) => {
         WHERE user_id = ?
         ORDER BY timestamp DESC
         LIMIT ? OFFSET ?
-      `).all(req.user.id, Number(limit), Number(offset));
+      `).all(userId, Number(limit), Number(offset));
     }
 
     res.json({ results });

package/server/routes/settings.js

@@ -297,7 +297,11 @@ router.put('/', async (req, res) => {
     'runtime_profile' in normalizedBody
     || 'runtime_backend' in normalizedBody
     || 'browser_backend' in normalizedBody
+    || 'browser_extension_token_id' in normalizedBody
+    || 'selected_browser_extension_token_id' in normalizedBody
     || 'android_backend' in normalizedBody
+    || 'cli_backend' in normalizedBody
+    || 'cli_desktop_device_id' in normalizedBody
     || 'mcp_backend' in normalizedBody
   ) {
     const validation = validateRuntimeSettings({
@@ -558,8 +562,16 @@ router.delete('/:key', (req, res) => {
   res.json({ success: true });
 });
 
+function requireAdminSession(req, res, next) {
+  if (req.session?.isAdmin === true) return next();
+  return res.status(403).json({
+    success: false,
+    error: 'Server updates are only available from the admin dashboard.',
+  });
+}
+
 // Trigger auto-update script
-router.post('/update', requireAuth, updateTriggerLimiter, (req, res) => {
+router.post('/update', requireAuth, requireAdminSession, updateTriggerLimiter, (req, res) => {
   if (isManagedDeployment()) {
     return res.status(403).json({
       success: false,
@@ -607,7 +619,7 @@ router.post('/update', requireAuth, updateTriggerLimiter, (req, res) => {
   res.json({ success: true, message: 'Update triggered', pid: child.pid });
 });
 
-router.put('/update/channel', (req, res) => {
+router.put('/update/channel', requireAuth, requireAdminSession, (req, res) => {
   if (isManagedDeployment()) {
     return res.status(403).json({
       success: false,

package/server/routes/stream.js

@@ -111,7 +111,7 @@ router.post('/start', async (req, res) => {
     const platform = normalizePlatform(req.body?.platform);
     const resolved = await resolveStartDeviceId(platform, req);
     const deviceId = resolved.deviceId;
-    const fps = boundedInt(req.body?.fps, platform === 'android' ? 10 : 15, 1, platform === 'android' ? 15 : 20);
+    const fps = boundedInt(req.body?.fps, platform === 'android' ? 12 : 15, 1, platform === 'android' ? 30 : 20);
     const quality = boundedInt(req.body?.quality, platform === 'android' ? 75 : 80, 30, 95);
     const hub = streamHub(req);
     await hub.stopStream(userId, platform, deviceId, 'restart');
@@ -125,8 +125,17 @@ router.post('/start', async (req, res) => {
         displayId: req.body?.displayId || null,
       });
       const resolvedDeviceId = result?.deviceId || result?.device?.deviceId || deviceId;
-      hub.markStarted(userId, resolvedDeviceId, platform, { fps, quality }, () =>
-        provider.stopStream({ deviceId: resolvedDeviceId }));
+      hub.markStarted(userId, resolvedDeviceId, platform, { fps, quality }, async () => {
+        try {
+          await provider.stopStream({ deviceId: resolvedDeviceId });
+        } catch (error) {
+          console.error('[StreamRoute] failed to stop desktop stream', {
+            userId,
+            deviceId: resolvedDeviceId,
+            error: String(error?.message || error),
+          });
+        }
+      });
       return res.json({ ok: true, platform, deviceId: resolvedDeviceId, fps, quality });
     }
 

package/server/routes/triggers.js

@@ -13,10 +13,10 @@ router.post('/geofence', async (req, res) => {
   const { label, latitude, longitude, radius_meters, action } = req.body;
 
   try {
-    const userRow = db.prepare('SELECT id FROM users WHERE id = ?').get(req.user.id);
+    const userRow = db.prepare('SELECT id FROM users WHERE id = ?').get(req.session.userId);
     if (!userRow) return res.status(401).json({ error: 'Unauthorized' });
 
-    console.log(`[Triggers] Geofence entered: ${label} by user ${req.user.id}`);
+    console.log(`[Triggers] Geofence entered: ${label} by user ${req.session.userId}`);
 
     res.json({ success: true, message: 'Geofence trigger processed' });
   } catch (err) {
@@ -29,14 +29,14 @@ router.post('/geofence', async (req, res) => {
   Promise.resolve().then(() => {
     const agentEngine = req.app.locals.agentEngine;
     if (!agentEngine) return;
-    const defaultAgentId = db.prepare('SELECT id FROM agents WHERE user_id = ? ORDER BY is_default DESC LIMIT 1').get(req.user.id)?.id;
+    const defaultAgentId = db.prepare('SELECT id FROM agents WHERE user_id = ? ORDER BY is_default DESC LIMIT 1').get(req.session.userId)?.id;
     if (!defaultAgentId) return;
     const prompt = [
       `A geofence event was triggered.`,
       `Location label: ${label || 'unknown'}`,
       action ? `Suggested action: ${action}` : 'Check if there are any active reminders or tasks related to this location.',
     ].join('\n');
-    return agentEngine.run(req.user.id, prompt, {
+    return agentEngine.run(req.session.userId, prompt, {
       agentId: defaultAgentId,
       triggerSource: 'tasks',
       context: { source: 'geofence', label, latitude, longitude, radius_meters },

package/server/routes/voice_assistant.js

@@ -4,7 +4,8 @@ const { requireAuth } = require('../middleware/auth');
 const { sanitizeError } = require('../utils/security');
 const { getAgentIdFromRequest, resolveAgentId } = require('../services/agents/manager');
 const { TurnCoordinator } = require('../services/voice/turnCoordinator');
-const { normalizeVoiceSynthesisOptions } = require('../services/voice/providers');
+const { normalizeVoiceSynthesisOptions, transcribeVoiceInput } = require('../services/voice/providers');
+const { writeTempAudioFile, removeTempFile } = require('../services/voice/liveAudio');
 const { runVoiceTranscriptTurn } = require('../services/voice/turnRunner');
 
 const router = express.Router();
@@ -135,4 +136,38 @@ router.post('/respond', async (req, res) => {
   }
 });
 
+router.post('/transcribe', async (req, res) => {
+  try {
+    const audioBase64 = String(req.body?.audioBase64 || '').trim();
+    const mimeType = String(req.body?.mimeType || 'audio/pcm;rate=16000;channels=1').trim();
+
+    if (!audioBase64) {
+      return res.status(400).json({ error: 'audioBase64 is required.' });
+    }
+
+    const approxBytes = (audioBase64.length * 3) / 4;
+    if (approxBytes > 25 * 1024 * 1024) {
+      return res.status(400).json({ error: 'Audio exceeds maximum size of 25MB.' });
+    }
+
+    const audioBytes = Buffer.from(audioBase64, 'base64');
+    const { filePath, mimeType: fileMimeType } = await writeTempAudioFile(audioBytes, mimeType);
+    let transcript = '';
+    try {
+      transcript = await transcribeVoiceInput(filePath, {
+        mimeType: fileMimeType,
+        userId: req.session.userId,
+        timeoutMs: 30000,
+      });
+    } finally {
+      await removeTempFile(filePath);
+    }
+
+    return res.json({ transcript: String(transcript || '').trim() });
+  } catch (err) {
+    const message = sanitizeError(err);
+    return res.status(500).json({ error: message });
+  }
+});
+
 module.exports = router;

package/server/routes/workspace.js

@@ -0,0 +1,86 @@
+'use strict';
+
+const express = require('express');
+const { requireAuth } = require('../middleware/auth');
+const { sanitizeError } = require('../utils/security');
+
+const router = express.Router();
+
+const MAX_PATH_LENGTH = 2048;
+const MAX_EDIT_BYTES = 1024 * 1024;
+
+router.use(requireAuth);
+
+function badRequest(message) {
+  const error = new Error(message);
+  error.status = 400;
+  return error;
+}
+
+function parseWorkspacePath(value, fallback = '.') {
+  const normalized = String(value ?? fallback).trim();
+  if (normalized.length > MAX_PATH_LENGTH) {
+    throw badRequest('path is too long.');
+  }
+  return normalized || fallback;
+}
+
+function getWorkspace(req) {
+  const workspace = req.app?.locals?.workspaceManager;
+  if (!workspace) {
+    const error = new Error('Workspace service is unavailable.');
+    error.status = 503;
+    throw error;
+  }
+  return workspace;
+}
+
+function handleWorkspaceAction(req, res, action) {
+  try {
+    const result = action(getWorkspace(req));
+    return res.json(result);
+  } catch (err) {
+    return res.status(err.status || 500).json({ error: sanitizeError(err), code: err.code || null });
+  }
+}
+
+router.get('/files', (req, res) => handleWorkspaceAction(req, res, (workspace) =>
+  workspace.listExplorerDirectory(req.session.userId, {
+    path: parseWorkspacePath(req.query?.path, '.'),
+  })));
+
+router.get('/files/content', (req, res) => handleWorkspaceAction(req, res, (workspace) =>
+  workspace.readExplorerFile(req.session.userId, {
+    path: parseWorkspacePath(req.query?.path, ''),
+    maxBytes: MAX_EDIT_BYTES,
+  })));
+
+router.put('/files/content', (req, res) => handleWorkspaceAction(req, res, (workspace) => {
+  const content = String(req.body?.content ?? '');
+  if (Buffer.byteLength(content, 'utf8') > MAX_EDIT_BYTES) {
+    throw badRequest('content is too large.');
+  }
+  return workspace.writeExplorerFile(req.session.userId, {
+    path: parseWorkspacePath(req.body?.path, ''),
+    content,
+  });
+}));
+
+router.get('/files/download', (req, res) => {
+  try {
+    const workspace = getWorkspace(req);
+    const file = workspace.getExplorerDownload(req.session.userId, {
+      path: parseWorkspacePath(req.query?.path, ''),
+    });
+    res.setHeader('Cache-Control', 'private, no-store');
+    return res.download(file.absolutePath, file.filename, (err) => {
+      if (!err || res.headersSent) return;
+      const status = err.code === 'ENOENT' || err.code === 'EACCES' ? 404 : 500;
+      res.status(status).json({ error: status === 404 ? 'File not found' : 'Failed to download file' });
+    });
+  } catch (err) {
+    return res.status(err.status || 500).json({ error: sanitizeError(err), code: err.code || null });
+  }
+});
+
+module.exports = router;

package/server/services/account/admin_two_factor.js

@@ -0,0 +1,132 @@
+'use strict';
+
+const bcrypt  = require('bcrypt');
+const crypto  = require('crypto');
+const { generateSecret, generateURI, verifySync } = require('otplib');
+const db      = require('../../db/database');
+const { encryptValue, decryptValue } = require('../integrations/secrets');
+
+const TOTP_OPTS = { strategy: 'totp', digits: 6, period: 30, epochTolerance: 30 };
+const RECOVERY_ALPHA = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';
+
+// ── Helpers ────────────────────────────────────────────────────────────────
+
+function getRow() {
+  return db.prepare('SELECT * FROM admin_two_factor WHERE id = 1').get() || null;
+}
+
+function normalizeCode(v) {
+  return String(v || '').trim().replace(/\s+/g, '').toUpperCase();
+}
+
+function verifyTotpCode(secret, code) {
+  const token = String(code || '').trim().replace(/\s+/g, '');
+  if (!/^\d{6}$/.test(token)) return false;
+  return verifySync({ ...TOTP_OPTS, secret, token })?.valid === true;
+}
+
+function makeRecoveryCode() {
+  let raw = '';
+  while (raw.length < 10) raw += RECOVERY_ALPHA[crypto.randomInt(RECOVERY_ALPHA.length)];
+  return `${raw.slice(0, 5)}-${raw.slice(5)}`;
+}
+
+// ── Public API ─────────────────────────────────────────────────────────────
+
+function getStatus() {
+  const row = getRow();
+  const codesLeft = db.prepare('SELECT COUNT(*) AS n FROM admin_recovery_codes WHERE used_at IS NULL').get().n;
+  return {
+    enabled:                row?.enabled === 1,
+    pending:                Boolean(row?.pending_secret),
+    enabledAt:              row?.enabled_at || null,
+    recoveryCodesRemaining: codesLeft,
+  };
+}
+
+function beginSetup() {
+  if (!String(process.env.SESSION_SECRET || '').trim()) {
+    throw Object.assign(new Error('SESSION_SECRET must be configured before enabling 2FA'), { statusCode: 500 });
+  }
+  const secret      = generateSecret();
+  const otpauthUrl  = generateURI({ ...TOTP_OPTS, issuer: 'NeoAgent Admin', label: 'admin', secret });
+  db.prepare(`
+    INSERT INTO admin_two_factor (id, pending_secret, enabled, created_at, updated_at)
+    VALUES (1, ?, COALESCE((SELECT enabled FROM admin_two_factor WHERE id = 1), 0), datetime('now'), datetime('now'))
+    ON CONFLICT(id) DO UPDATE SET pending_secret = excluded.pending_secret, updated_at = datetime('now')
+  `).run(encryptValue(secret));
+  return { otpauthUrl, manualKey: secret };
+}
+
+async function enable(code) {
+  const row = getRow();
+  if (!row?.pending_secret) throw Object.assign(new Error('No 2FA setup pending'), { statusCode: 400 });
+  const secret = decryptValue(row.pending_secret);
+  if (!verifyTotpCode(secret, code)) throw Object.assign(new Error('Invalid code — try again'), { statusCode: 401 });
+
+  const codes  = Array.from({ length: 10 }, makeRecoveryCode);
+  const hashes = await Promise.all(codes.map((c) => bcrypt.hash(normalizeCode(c).replace(/-/g, ''), 12)));
+
+  db.transaction(() => {
+    db.prepare('DELETE FROM admin_recovery_codes').run();
+    const ins = db.prepare("INSERT INTO admin_recovery_codes (code_hash, created_at) VALUES (?, datetime('now'))");
+    for (const h of hashes) ins.run(h);
+    db.prepare(`
+      UPDATE admin_two_factor
+      SET secret = pending_secret, pending_secret = NULL, enabled = 1,
+          enabled_at = datetime('now'), updated_at = datetime('now')
+      WHERE id = 1
+    `).run();
+  })();
+
+  return { recoveryCodes: codes };
+}
+
+/**
+ * Verifies a TOTP code or recovery code.
+ * Returns true if valid (or if 2FA is not enabled).
+ */
+async function verifyCode(code) {
+  const row = getRow();
+  if (!row?.enabled || !row.secret) return true; // 2FA not configured
+
+  const secret = decryptValue(row.secret);
+  if (verifyTotpCode(secret, code)) return true;
+
+  // Try recovery code
+  const normalized = normalizeCode(String(code || '')).replace(/-/g, '');
+  if (normalized.length < 6) return false;
+  const rows = db.prepare('SELECT id, code_hash FROM admin_recovery_codes WHERE used_at IS NULL ORDER BY id').all();
+  for (const r of rows) {
+    if (await bcrypt.compare(normalized, r.code_hash)) {
+      db.prepare("UPDATE admin_recovery_codes SET used_at = datetime('now') WHERE id = ?").run(r.id);
+      return true;
+    }
+  }
+  return false;
+}
+
+async function disable(code) {
+  const row = getRow();
+  if (!row?.enabled) return;
+  if (!await verifyCode(code)) throw Object.assign(new Error('Invalid 2FA code'), { statusCode: 401 });
+  db.transaction(() => {
+    db.prepare(`UPDATE admin_two_factor SET enabled = 0, secret = NULL, pending_secret = NULL,
+      enabled_at = NULL, updated_at = datetime('now') WHERE id = 1`).run();
+    db.prepare('DELETE FROM admin_recovery_codes').run();
+  })();
+}
+
+async function regenerateCodes(code) {
+  if (!await verifyCode(code)) throw Object.assign(new Error('Invalid 2FA code'), { statusCode: 401 });
+  const codes  = Array.from({ length: 10 }, makeRecoveryCode);
+  const hashes = await Promise.all(codes.map((c) => bcrypt.hash(normalizeCode(c).replace(/-/g, ''), 12)));
+  db.transaction(() => {
+    db.prepare('DELETE FROM admin_recovery_codes').run();
+    const ins = db.prepare("INSERT INTO admin_recovery_codes (code_hash, created_at) VALUES (?, datetime('now'))");
+    for (const h of hashes) ins.run(h);
+  })();
+  return { recoveryCodes: codes };
+}
+
+module.exports = { getStatus, beginSetup, enable, verifyCode, disable, regenerateCodes };

package/server/services/account/password_policy.js

@@ -113,7 +113,12 @@ function evaluatePasswordStrength(password, context = {}) {
     label,
     length,
     hasMinimumLength: length >= MIN_PASSWORD_LENGTH,
-    isAcceptable: length >= MIN_PASSWORD_LENGTH && score >= MIN_PASSWORD_SCORE,
+    isAcceptable: length >= MIN_PASSWORD_LENGTH
+      && score >= MIN_PASSWORD_SCORE
+      && !containsPersonalInfo
+      && !usesCommonPattern
+      && !sequential
+      && !repeatedRuns,
     feedback,
   };
 }