neoagent 2.4.1-beta.8 → 2.4.1

package/server/services/tasks/task_repository.js

@@ -59,16 +59,34 @@ class TaskRepository {
   }
 
   listTasksForAgent(userId, agentId, includeLegacyMainTasks) {
+    const select = `
+      SELECT
+        scheduled_tasks.*,
+        latest_run.id AS last_run_id,
+        latest_run.status AS last_run_status,
+        latest_run.error AS last_run_error,
+        latest_run.created_at AS last_run_started_at
+      FROM scheduled_tasks
+      LEFT JOIN agent_runs AS latest_run ON latest_run.id = (
+        SELECT candidate.id
+        FROM agent_runs AS candidate
+        WHERE candidate.user_id = scheduled_tasks.user_id
+          AND json_valid(candidate.metadata_json)
+          AND CAST(json_extract(candidate.metadata_json, '$.taskId') AS TEXT) = CAST(scheduled_tasks.id AS TEXT)
+        ORDER BY candidate.created_at DESC, candidate.rowid DESC
+        LIMIT 1
+      )`;
     return includeLegacyMainTasks
       ? db.prepare(
-        `SELECT * FROM scheduled_tasks
-         WHERE user_id = ? AND (agent_id = ? OR agent_id IS NULL)
-         ORDER BY created_at DESC`
+        `${select}
+         WHERE scheduled_tasks.user_id = ?
+           AND (scheduled_tasks.agent_id = ? OR scheduled_tasks.agent_id IS NULL)
+         ORDER BY scheduled_tasks.created_at DESC`
       ).all(userId, agentId)
       : db.prepare(
-        `SELECT * FROM scheduled_tasks
-         WHERE user_id = ? AND agent_id = ?
-         ORDER BY created_at DESC`
+        `${select}
+         WHERE scheduled_tasks.user_id = ? AND scheduled_tasks.agent_id = ?
+         ORDER BY scheduled_tasks.created_at DESC`
       ).all(userId, agentId);
   }
 
@@ -126,11 +144,35 @@ class TaskRepository {
     db.prepare('UPDATE scheduled_tasks SET last_run = datetime(\'now\') WHERE id = ? AND user_id = ?').run(taskId, userId);
   }
 
+  markAgentRunFailed(runId, userId, error) {
+    db.prepare(
+      `UPDATE agent_runs
+       SET status = 'failed',
+           error = ?,
+           updated_at = datetime('now'),
+           completed_at = COALESCE(completed_at, datetime('now'))
+       WHERE id = ? AND user_id = ?`
+    ).run(String(error || 'Task execution failed.'), runId, userId);
+  }
+
   updateTaskConfig(taskId, userId, taskConfig) {
     db.prepare('UPDATE scheduled_tasks SET task_config = ? WHERE id = ? AND user_id = ?')
       .run(JSON.stringify(taskConfig), taskId, userId);
   }
 
+  listRecentMessageTargets(userId, agentId, limit = 20) {
+    return db.prepare(
+      `SELECT platform, platform_chat_id
+       FROM messages
+       WHERE user_id = ?
+         AND agent_id = ?
+         AND platform IS NOT NULL
+         AND platform_chat_id IS NOT NULL
+       ORDER BY id DESC
+       LIMIT ?`
+    ).all(userId, agentId, Math.max(1, Math.min(Number(limit) || 20, 100)));
+  }
+
   getAgentSetting(userId, agentId, key) {
     return db.prepare('SELECT value FROM agent_settings WHERE user_id = ? AND agent_id = ? AND key = ?')
       .get(userId, agentId, key);

package/server/services/websocket.js

@@ -317,7 +317,7 @@ function setupWebSocket(io, services) {
         const data = asObject(raw);
         const runId = toOptionalString(data?.runId, 128);
         console.warn(`[WS] agent:abort received from user ${userId} for run ${runId || 'unknown'}`);
-        agentEngine.abort(runId || null);
+        agentEngine.abort(runId || null, { userId });
         socket.emit('agent:aborted', { runId: runId || null });
       } catch (err) {
         console.error(`[WS] agent:abort failed for user ${userId}:`, err);
@@ -366,8 +366,14 @@ function setupWebSocket(io, services) {
         }
         console.log(`[WS] agent:run_detail requested by user ${userId} run=${runId}`);
         const run = db.prepare('SELECT * FROM agent_runs WHERE id = ? AND user_id = ?').get(runId, userId);
+        if (!run) {
+          // Don't leak steps/history/events for a run the user doesn't own:
+          // agent_steps and run events are keyed only by run_id, so the run
+          // ownership check is the sole authorization gate.
+          return socket.emit('agent:run_detail', { run: null, steps: [], history: [], events: [] });
+        }
         const steps = db.prepare('SELECT * FROM agent_steps WHERE run_id = ? ORDER BY step_index ASC').all(runId);
-        const history = db.prepare('SELECT * FROM conversation_history WHERE agent_run_id = ? ORDER BY created_at ASC').all(runId);
+        const history = db.prepare('SELECT * FROM conversation_history WHERE agent_run_id = ? AND user_id = ? ORDER BY created_at ASC').all(runId, userId);
         const events = listRunEvents(runId);
         socket.emit('agent:run_detail', { run, steps, history, events });
       } catch (err) {

package/server/services/widgets/service.js

@@ -366,7 +366,23 @@ class WidgetService {
       throw new Error('Widget not found.');
     }
     if (existingRow.is_system) {
-      throw new Error('System widgets cannot be edited directly.');
+      if (!('enabled' in input)) {
+        throw new Error('System widgets cannot be edited directly.');
+      }
+      // Only the enabled state may be toggled on system widgets.
+      const newEnabled = input.enabled !== false;
+      db.prepare(
+        `UPDATE ai_widgets SET enabled = ?, updated_at = datetime('now') WHERE id = ? AND user_id = ?`
+      ).run(newEnabled ? 1 : 0, widgetId, userId);
+      if (existingRow.scheduled_task_id && this.taskRuntime) {
+        await this.taskRuntime.updateTask(
+          existingRow.scheduled_task_id,
+          userId,
+          { enabled: newEnabled },
+          { allowManaged: true },
+        );
+      }
+      return this.getWidget(userId, widgetId);
     }
 
     const current = this._serializeWidget(existingRow, null, []);

package/server/services/workspace/manager.js

@@ -80,9 +80,125 @@ class WorkspaceManager {
     if (relative.startsWith('..') || path.isAbsolute(relative)) {
       throw new Error(`${label} is outside the per-user workspace.`);
     }
+    this._assertResolvedPathInsideRoot(root, absolute, label);
     return absolute;
   }
 
+  _assertResolvedPathInsideRoot(root, absolute, label = 'path') {
+    const realRoot = fs.realpathSync.native(root);
+    let targetToCheck = absolute;
+    while (!fs.existsSync(targetToCheck)) {
+      const parent = path.dirname(targetToCheck);
+      if (parent === targetToCheck) break;
+      targetToCheck = path.dirname(targetToCheck);
+    }
+    const realTarget = fs.realpathSync.native(targetToCheck);
+    const relative = path.relative(realRoot, realTarget);
+    if (relative.startsWith('..') || path.isAbsolute(relative)) {
+      throw new Error(`${label} is outside the per-user workspace.`);
+    }
+  }
+
+  _toWorkspaceRelative(root, absolute) {
+    const relative = path.relative(root, absolute);
+    return relative && !relative.startsWith('..') && !path.isAbsolute(relative)
+      ? relative.split(path.sep).join('/')
+      : '';
+  }
+
+  listExplorerDirectory(userId, options = {}) {
+    const root = this._ensureWorkspaceRootSync(userId);
+    const dirPath = this.resolvePath(userId, options.path || '.', 'path');
+    let stats;
+    try {
+      stats = fs.statSync(dirPath);
+    } catch (err) {
+      return { path: this._toWorkspaceRelative(root, dirPath), entries: [], error: err.message };
+    }
+    if (!stats.isDirectory()) {
+      return { path: this._toWorkspaceRelative(root, dirPath), entries: [], error: 'Path is not a directory.' };
+    }
+    const entries = fs.readdirSync(dirPath, { withFileTypes: true }).flatMap((entry) => {
+      const fullPath = path.join(dirPath, entry.name);
+      let entryStats;
+      try {
+        entryStats = fs.lstatSync(fullPath);
+        if (entryStats.isSymbolicLink()) return [];
+        entryStats = fs.statSync(fullPath);
+      } catch {
+        return [];
+      }
+      if (!entryStats.isDirectory() && !entryStats.isFile()) return [];
+      return [{
+        name: entry.name,
+        type: entryStats.isDirectory() ? 'directory' : 'file',
+        path: this._toWorkspaceRelative(root, fullPath),
+        size: entryStats.size,
+        mtime: entryStats.mtime.toISOString(),
+      }];
+    }).sort((a, b) => {
+      if (a.type !== b.type) return a.type === 'directory' ? -1 : 1;
+      return a.name.localeCompare(b.name);
+    });
+    return {
+      path: this._toWorkspaceRelative(root, dirPath),
+      parentPath: this._toWorkspaceRelative(root, path.dirname(dirPath)),
+      entries,
+    };
+  }
+
+  readExplorerFile(userId, options = {}) {
+    const root = this._ensureWorkspaceRootSync(userId);
+    const filePath = this.resolvePath(userId, options.path || '', 'path');
+    const stats = fs.statSync(filePath);
+    if (!stats.isFile()) {
+      throw new Error('Path is not a file.');
+    }
+    const maxBytes = Number(options.maxBytes || 1024 * 1024);
+    if (stats.size > maxBytes) {
+      const error = new Error(`File is too large to edit in the browser (${stats.size} bytes).`);
+      error.code = 'WORKSPACE_FILE_TOO_LARGE';
+      throw error;
+    }
+    return {
+      path: this._toWorkspaceRelative(root, filePath),
+      name: path.basename(filePath),
+      content: fs.readFileSync(filePath, 'utf8'),
+      size: stats.size,
+      mtime: stats.mtime.toISOString(),
+    };
+  }
+
+  writeExplorerFile(userId, options = {}) {
+    const root = this._ensureWorkspaceRootSync(userId);
+    const filePath = this.resolvePath(userId, options.path || '', 'path');
+    const content = String(options.content ?? '');
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, content, 'utf8');
+    const stats = fs.statSync(filePath);
+    return {
+      success: true,
+      path: this._toWorkspaceRelative(root, filePath),
+      size: stats.size,
+      mtime: stats.mtime.toISOString(),
+    };
+  }
+
+  getExplorerDownload(userId, options = {}) {
+    const root = this._ensureWorkspaceRootSync(userId);
+    const filePath = this.resolvePath(userId, options.path || '', 'path');
+    const stats = fs.statSync(filePath);
+    if (!stats.isFile()) {
+      throw new Error('Path is not a file.');
+    }
+    return {
+      root,
+      absolutePath: filePath,
+      relativePath: this._toWorkspaceRelative(root, filePath),
+      filename: path.basename(filePath),
+    };
+  }
+
   readFile(userId, options = {}) {
     let filePath;
     try {

package/server/utils/logger.js

@@ -1,5 +1,8 @@
 'use strict';
 
+const fs   = require('fs');
+const path = require('path');
+
 const SENSITIVE_KEY_RE = /(?:^|_|-)(?:token|secret|password|api[_-]?key|authorization|cookie|session(?:id)?|sid)(?:$|_|-)/i;
 
 function redactSecrets(input) {
@@ -96,22 +99,57 @@ function logRequestSummary(level, req, message, extra = null) {
     console[level](redactSecrets(`${prefix} ${message}`), summary);
 }
 
+function getLogFile() {
+    try {
+        const { DATA_DIR } = require('../../runtime/paths');
+        return path.join(DATA_DIR, 'server-logs.jsonl');
+    } catch {
+        return path.join(require('os').homedir(), '.neoagent', 'data', 'server-logs.jsonl');
+    }
+}
+
+function loadPersistedLogs(logFile) {
+    try {
+        const raw = fs.readFileSync(logFile, 'utf8');
+        const entries = [];
+        for (const line of raw.split('\n')) {
+            if (!line.trim()) continue;
+            try { entries.push(JSON.parse(line)); } catch {}
+        }
+        return entries.slice(-1000);
+    } catch {
+        return [];
+    }
+}
+
 /**
- * Intercepts console methods and broadcasts logs via Socket.IO
- * @param {import('socket.io').Server} io 
+ * Intercepts console methods and broadcasts logs via Socket.IO.
+ * Persists up to 1000 entries to disk across server restarts.
+ * @param {import('socket.io').Server} io
  */
 function setupConsoleInterceptor(io) {
-    const logHistory = [];
-    const MAX_LOG_HISTORY = 200;
+    const MAX_LOG_HISTORY = 1000;
+    const TRIM_AT = 1100;
+    const logFile = getLogFile();
     const allowLogHistoryRequests = String(process.env.NEOAGENT_ENABLE_LOG_HISTORY_REQUESTS || '').trim().toLowerCase() === 'true';
 
+    try { fs.mkdirSync(path.dirname(logFile), { recursive: true }); } catch {}
+    const logHistory = loadPersistedLogs(logFile);
+
     function broadcastLog(type, args) {
         const msg = formatLogArgs(args);
         const logEntry = { type, message: msg, timestamp: new Date().toISOString() };
         logHistory.push(logEntry);
-        if (logHistory.length > MAX_LOG_HISTORY) logHistory.shift();
 
-        // Broadcast only to authenticated user rooms
+        try { fs.appendFileSync(logFile, JSON.stringify(logEntry) + '\n'); } catch {}
+
+        if (logHistory.length > TRIM_AT) {
+            logHistory.splice(0, logHistory.length - MAX_LOG_HISTORY);
+            try {
+                fs.writeFileSync(logFile, logHistory.map(e => JSON.stringify(e)).join('\n') + '\n');
+            } catch {}
+        }
+
         for (const [, socket] of io.sockets.sockets) {
             const uid = socket.request?.session?.userId;
             if (uid) socket.emit('server:log', logEntry);

package/server/utils/security.js

@@ -15,6 +15,9 @@ function sanitizeError(err) {
   const raw = typeof err === 'string' ? err : err.message || String(err);
 
   let msg = raw;
+  if (!msg || msg === '[object Object]') {
+    msg = 'An unexpected error occurred';
+  }
 
   // Replace home directory path with ~
   if (HOME) {

package/server/utils/version.js

@@ -12,6 +12,11 @@ const {
 const { getDeploymentInfo } = require('./deployment');
 
 const PACKAGE_JSON_PATH = path.join(APP_DIR, 'package.json');
+const GIT_COMMAND_TIMEOUT_MS = 750;
+const VERSION_CACHE_TTL_MS = 30 * 1000;
+
+let cachedVersionInfo = null;
+let cachedVersionInfoAt = 0;
 
 function readPackageVersion() {
   try {
@@ -22,7 +27,16 @@ function readPackageVersion() {
   }
 }
 
-function getVersionInfo() {
+function readGitValue(command) {
+  return execSync(command, {
+    cwd: APP_DIR,
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'ignore'],
+    timeout: GIT_COMMAND_TIMEOUT_MS,
+  }).trim();
+}
+
+function buildVersionInfo() {
   const packageVersion = readPackageVersion() || '0.0.0';
   const releaseChannel = readConfiguredReleaseChannel();
   const deployment = getDeploymentInfo();
@@ -32,24 +46,9 @@ function getVersionInfo() {
   let gitBranch = null;
 
   try {
-    gitVersion =
-      execSync('git describe --tags --always --dirty', {
-        cwd: APP_DIR,
-        encoding: 'utf8',
-        stdio: ['ignore', 'pipe', 'ignore']
-      })
-        .trim()
-        .replace(/^v/, '') || null;
-    gitSha = execSync('git rev-parse --short HEAD', {
-      cwd: APP_DIR,
-      encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'ignore']
-    }).trim();
-    gitBranch = execSync('git rev-parse --abbrev-ref HEAD', {
-      cwd: APP_DIR,
-      encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'ignore']
-    }).trim();
+    gitVersion = readGitValue('git describe --tags --always --dirty').replace(/^v/, '') || null;
+    gitSha = readGitValue('git rev-parse --short HEAD') || null;
+    gitBranch = readGitValue('git rev-parse --abbrev-ref HEAD') || null;
   } catch {
     gitSha = process.env.GIT_SHA || null;
   }
@@ -80,4 +79,15 @@ function getVersionInfo() {
   };
 }
 
+function getVersionInfo() {
+  const now = Date.now();
+  if (cachedVersionInfo && now - cachedVersionInfoAt < VERSION_CACHE_TTL_MS) {
+    return { ...cachedVersionInfo };
+  }
+
+  cachedVersionInfo = buildVersionInfo();
+  cachedVersionInfoAt = now;
+  return { ...cachedVersionInfo };
+}
+
 module.exports = { getVersionInfo };

package/server/services/memory/openhuman_uplift.test.js

@@ -1,98 +0,0 @@
-'use strict';
-
-const assert = require('node:assert/strict');
-const test = require('node:test');
-const { randomUUID } = require('node:crypto');
-
-process.env.OPENAI_API_KEY = '';
-process.env.GOOGLE_AI_KEY = '';
-
-const db = require('../../db/database');
-const { resolveAgentId } = require('../agents/manager');
-const { compactTextPayload } = require('../ai/preModelCompaction');
-const { MemoryManager } = require('./manager');
-const { MemoryIngestionService, sourceTypesForConnection } = require('./ingestion');
-const { buildAssistantFocusSnapshot } = require('../widgets/focus_widget');
-
-function createTestUser() {
-  const username = `openhuman-${randomUUID()}`;
-  const result = db.prepare(
-    'INSERT INTO users (username, password) VALUES (?, ?)',
-  ).run(username, 'test');
-  const userId = Number(result.lastInsertRowid);
-  return {
-    userId,
-    agentId: resolveAgentId(userId, null),
-  };
-}
-
-function cleanupUser(userId) {
-  db.prepare('DELETE FROM users WHERE id = ?').run(userId);
-}
-
-test('pre-model compaction strips noisy HTML and records metrics', () => {
-  const input = '<html><style>.x{}</style><body>Read https://example.com/a/really/long/path today.<br>Read https://example.com/a/really/long/path today.</body></html>';
-  const result = compactTextPayload(input, { maxChars: 120, maxLines: 5 });
-
-  assert.equal(result.metrics.applied, true);
-  assert.ok(result.metrics.strategies.includes('html_to_text'));
-  assert.ok(result.metrics.strategies.includes('url_shortening'));
-  assert.match(result.text, /example\.com/);
-  assert.doesNotMatch(result.text, /<body>/);
-});
-
-test('memory ingestion writes typed documents, memory, and materialized views', async () => {
-  const { userId, agentId } = createTestUser();
-  const memoryManager = new MemoryManager();
-  const service = new MemoryIngestionService({ memoryManager, intervalMs: 60_000 });
-
-  try {
-    const result = await service.ingestDocuments(userId, [
-      {
-        externalObjectId: 'thread-123',
-        sourceType: 'email',
-        normalizedType: 'email',
-        title: 'Launch review',
-        content: 'The launch review moved to Friday. Alice owns the deck and Bob owns QA.',
-        sourceAccount: 'team@example.com',
-        salience: 8,
-      },
-    ], {
-      agentId,
-      sourceType: 'email',
-      providerKey: 'google_workspace',
-      sourceAccount: 'team@example.com',
-    });
-
-    assert.equal(result.status, 'completed');
-    assert.equal(result.documentIds.length, 1);
-    assert.equal(result.memoryIds.length, 1);
-
-    const docs = memoryManager.listIngestionDocuments(userId, {
-      agentId,
-      providerKey: 'google_workspace',
-    });
-    assert.equal(docs.length, 1);
-    assert.equal(docs[0].sourceType, 'email');
-    assert.equal(docs[0].sourceAccount, 'team@example.com');
-
-    const changes = memoryManager.listRecentKnowledgeChanges(userId, { agentId });
-    assert.ok(changes.some((change) => change.kind === 'document'));
-
-    const views = memoryManager.listKnowledgeViews(userId, { agentId });
-    assert.ok(views.some((view) => view.viewType === 'timeline'));
-    assert.ok(views.some((view) => view.viewType === 'account'));
-
-    const focus = buildAssistantFocusSnapshot(memoryManager, userId, agentId);
-    assert.equal(focus.backgroundAwareness.changedCount > 0, true);
-    assert.ok(focus.recentKnowledgeChanges.some((change) => change.title === 'Launch review'));
-  } finally {
-    cleanupUser(userId);
-  }
-});
-
-test('integration coverage maps connected apps to durable memory domains', () => {
-  assert.deepEqual(sourceTypesForConnection('google_workspace', 'gmail'), ['email']);
-  assert.deepEqual(sourceTypesForConnection('github', 'repos'), ['repos', 'tickets']);
-  assert.deepEqual(sourceTypesForConnection('spotify', 'spotify'), []);
-});