neoagent 2.4.1-beta.9 → 2.4.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neoagent",
-  "version": "2.4.1-beta.9",
+  "version": "2.4.1",
   "description": "Proactive personal AI agent with no limits",
   "license": "AGPL-3.0-only",
   "main": "server/index.js",
@@ -38,7 +38,18 @@
     "flutter:run:web": "cd flutter_app && flutter run -d chrome --dart-define=NEOAGENT_WEB_BUILD_ID=$(node ../scripts/web_build_id.js)",
     "flutter:build:web": "cd flutter_app && flutter build web --output ../server/public --dart-define=NEOAGENT_BACKEND_URL=${NEOAGENT_BACKEND_URL:-} --dart-define=NEOAGENT_WEB_BUILD_ID=$(node ../scripts/web_build_id.js)",
     "manage": "node bin/neoagent.js",
-    "test": "node --test",
+    "test": "npm run test:backend",
+    "test:unit": "node --test --test-reporter=spec test/backend/unit/*.test.js",
+    "test:integration": "node --test --test-reporter=spec test/integration/*.test.js",
+    "test:security": "node --test --test-reporter=spec test/security/*.test.js",
+    "test:contract": "node --test --test-reporter=spec test/contract/*.test.js",
+    "test:e2e": "node --test --test-reporter=spec test/e2e/*.test.js",
+    "test:ws": "node --test --test-reporter=spec test/websocket/*.test.js",
+    "test:backend": "npm run test:unit && npm run test:integration && npm run test:security && npm run test:contract && npm run test:e2e && npm run test:ws",
+    "test:load": "node test/load/auth_load.js",
+    "flutter:test": "cd flutter_app && flutter test ../test/flutter/unit ../test/flutter/widget",
+    "flutter:test:unit": "cd flutter_app && flutter test ../test/flutter/unit",
+    "flutter:test:widget": "cd flutter_app && flutter test ../test/flutter/widget",
     "benchmark:tokens": "node scripts/benchmark-token-cost.js",
     "release": "npx semantic-release"
   },
@@ -104,7 +115,10 @@
   "devDependencies": {
     "@docusaurus/core": "3.10.0",
     "@docusaurus/preset-classic": "3.10.0",
+    "autocannon": "^7.15.0",
     "react": "18.3.1",
-    "react-dom": "18.3.1"
+    "react-dom": "18.3.1",
+    "socket.io-client": "^4.8.3",
+    "supertest": "^7.2.2"
   }
 }

package/runtime/paths.js

@@ -246,5 +246,7 @@ module.exports = {
   ensureRuntimeDirs,
   ensureSecureRuntimeEnv,
   getDefaultVmBaseImageUrl,
-  migrateLegacyRuntime
+  migrateLegacyRuntime,
+  upsertEnvValue,
+  readEnvFileRaw,
 };

package/server/admin/access.js

@@ -0,0 +1,198 @@
+'use strict';
+
+// ── Access Settings ────────────────────────────────────────────────────────
+
+let _revealedKey = null; // holds the API key shown after rotation (one-time)
+let _revealTimer  = null;
+
+async function loadAccess() {
+  const el = document.getElementById('access-content');
+  if (!el) return;
+  try {
+    const data = await api('/admin/api/settings').then((r) => r.json());
+    renderAccess(el, data);
+  } catch (err) {
+    if (err.message !== 'unauthorized') el.innerHTML = '<div class="empty">Failed to load settings</div>';
+  }
+}
+
+function renderAccess(el, { signupEnabled, apiKeyConfigured, apiKeyHint }) {
+  el.innerHTML = `
+    <!-- Signup -->
+    <div class="card">
+      <div class="card-title">User Signups</div>
+      <div class="access-row">
+        <div>
+          <div class="access-label">Allow new registrations</div>
+          <div class="access-desc">
+            When disabled, only existing users can log in. The first account can always be created regardless of this setting.
+          </div>
+        </div>
+        <label class="toggle" aria-label="Toggle signups">
+          <input type="checkbox" id="signup-toggle" ${signupEnabled ? 'checked' : ''}
+            onchange="setSignup(this.checked)">
+          <span class="toggle-track"></span>
+          <span class="toggle-thumb"></span>
+        </label>
+      </div>
+      <div id="signup-status" class="access-status"></div>
+    </div>
+
+    <!-- API key -->
+    <div class="card">
+      <div class="card-title">Admin API Key</div>
+      <div class="access-row">
+        <div>
+          <div class="access-label">Programmatic access</div>
+          <div class="access-desc">
+            Use <code>Authorization: Bearer &lt;key&gt;</code> to authenticate against any <code>/admin/api/*</code> endpoint from scripts or automation — without a browser session.
+          </div>
+        </div>
+        <span class="badge ${apiKeyConfigured ? 'badge-ok' : 'badge-idle'}">
+          ${apiKeyConfigured ? 'configured' : 'not set'}
+        </span>
+      </div>
+
+      ${apiKeyConfigured ? `
+        <div class="access-hint-row">
+          <code class="api-key-hint">${esc(apiKeyHint)}</code>
+          <span style="font-size:11px;color:var(--text-muted);">stored in .env — rotate to reveal</span>
+        </div>` : ''}
+
+      <div id="key-reveal-wrap" style="display:none;">
+        <div class="key-reveal-box">
+          <div style="font-size:11px;color:var(--text-muted);margin-bottom:6px;">
+            New API key — copy it now. It will not be shown again.
+          </div>
+          <div style="display:flex;align-items:center;gap:8px;">
+            <code id="key-reveal-value" class="api-key-full"></code>
+            <button class="btn btn-ghost" style="padding:5px 10px;font-size:11px;flex-shrink:0;"
+              onclick="copyApiKey()">Copy</button>
+          </div>
+          <div style="margin-top:8px;font-size:11px;color:var(--text-muted);" id="key-reveal-timer"></div>
+        </div>
+      </div>
+
+      <div class="access-actions">
+        <button class="btn btn-ghost" onclick="rotateApiKey(this)">
+          ${apiKeyConfigured ? 'Rotate key' : 'Generate key'}
+        </button>
+        ${apiKeyConfigured ? `
+          <button class="btn btn-danger" onclick="revokeApiKey(this)">Revoke key</button>` : ''}
+      </div>
+      <div id="apikey-status" class="access-status"></div>
+    </div>`;
+
+  // If we rotated in this page load, re-show the key
+  if (_revealedKey) showReveal(_revealedKey);
+}
+
+async function setSignup(enabled) {
+  const statusEl = document.getElementById('signup-status');
+  if (statusEl) statusEl.textContent = '';
+  try {
+    const res = await api('/admin/api/settings/signup', {
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ enabled }),
+    });
+    if (res.ok) {
+      showStatus('signup-status', enabled ? 'Signups enabled.' : 'Signups disabled.', false);
+    } else {
+      const b = await res.json().catch(() => ({}));
+      showStatus('signup-status', b.error || 'Failed to update', true);
+      // Revert the toggle
+      const toggle = document.getElementById('signup-toggle');
+      if (toggle) toggle.checked = !enabled;
+    }
+  } catch (err) {
+    if (err.message !== 'unauthorized') showStatus('signup-status', 'Network error', true);
+    const toggle = document.getElementById('signup-toggle');
+    if (toggle) toggle.checked = !enabled;
+  }
+}
+
+async function rotateApiKey(btn) {
+  if (!confirm(
+    'Rotate admin API key?\n\n' +
+    'The current key will stop working immediately.\n' +
+    'Any scripts using it must be updated.\n\n' +
+    'The new key will be shown once — copy it before leaving.'
+  )) return;
+  btn.disabled = true;
+  btn.textContent = 'Rotating…';
+  try {
+    const res = await api('/admin/api/settings/apikey/rotate', { method: 'POST' });
+    const data = await res.json();
+    if (res.ok && data.apiKey) {
+      _revealedKey = data.apiKey;
+      await loadAccess(); // re-render to show badge + hint
+    } else {
+      showStatus('apikey-status', data.error || 'Failed to rotate', true);
+      btn.disabled = false;
+      btn.textContent = 'Rotate key';
+    }
+  } catch (err) {
+    if (err.message !== 'unauthorized') showStatus('apikey-status', 'Network error', true);
+    btn.disabled = false;
+    btn.textContent = 'Rotate key';
+  }
+}
+
+async function revokeApiKey(btn) {
+  if (!confirm('Revoke admin API key?\n\nAll programmatic access using this key will stop immediately.')) return;
+  btn.disabled = true;
+  btn.textContent = 'Revoking…';
+  _revealedKey = null;
+  try {
+    const res = await api('/admin/api/settings/apikey', { method: 'DELETE' });
+    if (res.ok) {
+      await loadAccess();
+    } else {
+      const b = await res.json().catch(() => ({}));
+      showStatus('apikey-status', b.error || 'Failed', true);
+      btn.disabled = false;
+      btn.textContent = 'Revoke key';
+    }
+  } catch (err) {
+    if (err.message !== 'unauthorized') showStatus('apikey-status', 'Network error', true);
+    btn.disabled = false;
+    btn.textContent = 'Revoke key';
+  }
+}
+
+function copyApiKey() {
+  if (_revealedKey) navigator.clipboard.writeText(_revealedKey).catch(() => {});
+}
+
+function showReveal(key) {
+  const wrap  = document.getElementById('key-reveal-wrap');
+  const value = document.getElementById('key-reveal-value');
+  if (!wrap || !value) return;
+  value.textContent = key;
+  wrap.style.display = 'block';
+  // Auto-clear after 120 seconds
+  clearTimeout(_revealTimer);
+  let secs = 120;
+  const timerEl = document.getElementById('key-reveal-timer');
+  const tick = () => {
+    if (!timerEl) return;
+    if (secs <= 0) {
+      wrap.style.display = 'none';
+      _revealedKey = null;
+      return;
+    }
+    timerEl.textContent = `Hides in ${secs}s`;
+    secs--;
+    _revealTimer = setTimeout(tick, 1000);
+  };
+  tick();
+}
+
+function showStatus(id, msg, isError) {
+  const el = document.getElementById(id);
+  if (!el) return;
+  el.textContent = msg;
+  el.style.color = isError ? 'var(--danger)' : 'var(--success)';
+  setTimeout(() => { if (el) el.textContent = ''; }, 4000);
+}

package/server/admin/admin.css

@@ -0,0 +1,268 @@
+/* NeoAgent Admin — shared design tokens and base styles */
+
+*, *::before, *::after {
+  box-sizing: border-box;
+  margin: 0;
+  padding: 0;
+}
+
+/* ── Tokens (NeoAgent dark palette) ─────────────────────────────────────── */
+:root {
+  --bg:            #0e1511;
+  --bg-sidebar:    #0a0f0c;
+  --bg-card:       #171f1a;
+  --bg-secondary:  #252d28;
+  --bg-input:      #0a0f0c;
+  --border:        rgba(224, 240, 224, 0.10);
+  --border-light:  rgba(224, 240, 224, 0.17);
+
+  --accent:        #e1b052;
+  --accent-hover:  #eac272;
+  --accent-alt:    #84ba87;
+  --accent-muted:  rgba(225, 176, 82, 0.16);
+
+  --text:          #ecefe5;
+  --text-secondary:#aeb7a6;
+  --text-muted:    #7e8877;
+
+  --success:       #74c07c;
+  --warning:       #d9a24b;
+  --danger:        #de8a78;
+  --info:          #6fb0a4;
+
+  --sidebar-w:     220px;
+  --radius:        10px;
+  --radius-sm:     7px;
+
+  --font-sans:     'Geist', 'Inter', -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;
+  --font-mono:     'Geist Mono', 'JetBrains Mono', 'Fira Code', 'Menlo', monospace;
+}
+
+/* ── Base ────────────────────────────────────────────────────────────────── */
+html, body {
+  height: 100%;
+}
+
+body {
+  background: var(--bg);
+  color: var(--text);
+  font-family: var(--font-sans);
+  font-size: 14px;
+  line-height: 1.5;
+  -webkit-font-smoothing: antialiased;
+  -moz-osx-font-smoothing: grayscale;
+}
+
+/* ── Brand mark ──────────────────────────────────────────────────────────── */
+.brand {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  text-decoration: none;
+  color: inherit;
+}
+
+.brand-mark {
+  width: 28px;
+  height: 28px;
+  border-radius: 8px;
+  flex-shrink: 0;
+  overflow: hidden;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+}
+
+.brand-mark img {
+  width: 28px;
+  height: 28px;
+  display: block;
+}
+
+.brand-name {
+  font-size: 15px;
+  font-weight: 700;
+  color: var(--text);
+  line-height: 1.1;
+  letter-spacing: -0.2px;
+}
+
+.brand-sub {
+  font-size: 11px;
+  color: var(--text-muted);
+  font-weight: 500;
+  letter-spacing: 0.02em;
+  text-transform: uppercase;
+}
+
+/* ── Forms ───────────────────────────────────────────────────────────────── */
+label {
+  display: block;
+  font-size: 12px;
+  font-weight: 600;
+  letter-spacing: 0.04em;
+  color: var(--text-muted);
+  text-transform: uppercase;
+  margin-bottom: 7px;
+}
+
+input[type="text"],
+input[type="password"],
+select {
+  width: 100%;
+  background: var(--bg-input);
+  border: 1px solid var(--border-light);
+  border-radius: var(--radius-sm);
+  padding: 10px 14px;
+  color: var(--text);
+  font-family: var(--font-sans);
+  font-size: 14px;
+  outline: none;
+  transition: border-color 0.15s;
+  -webkit-appearance: none;
+}
+
+input[type="text"]:focus,
+input[type="password"]:focus,
+select:focus {
+  border-color: var(--accent);
+  box-shadow: 0 0 0 3px var(--accent-muted);
+}
+
+.field {
+  margin-bottom: 20px;
+}
+
+/* ── Buttons ─────────────────────────────────────────────────────────────── */
+button,
+.btn {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  gap: 7px;
+  padding: 8px 16px;
+  border-radius: var(--radius-sm);
+  border: none;
+  cursor: pointer;
+  font-family: var(--font-sans);
+  font-size: 13px;
+  font-weight: 600;
+  transition: background 0.15s, opacity 0.15s, box-shadow 0.15s;
+  white-space: nowrap;
+}
+
+button:disabled,
+.btn:disabled {
+  opacity: 0.4;
+  cursor: default;
+  pointer-events: none;
+}
+
+.btn-primary {
+  background: var(--accent);
+  color: var(--bg);
+}
+
+.btn-primary:hover:not(:disabled) {
+  background: var(--accent-hover);
+  box-shadow: 0 2px 12px rgba(225, 176, 82, 0.22);
+}
+
+.btn-ghost {
+  background: var(--bg-secondary);
+  color: var(--text-secondary);
+  border: 1px solid var(--border-light);
+}
+
+.btn-ghost:hover:not(:disabled) {
+  color: var(--text);
+  background: rgba(224, 240, 224, 0.07);
+}
+
+.btn-danger {
+  background: rgba(222, 138, 120, 0.12);
+  color: var(--danger);
+  border: 1px solid rgba(222, 138, 120, 0.20);
+}
+
+.btn-danger:hover:not(:disabled) {
+  background: rgba(222, 138, 120, 0.20);
+}
+
+/* ── Card ────────────────────────────────────────────────────────────────── */
+.card {
+  background: var(--bg-card);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  padding: 20px;
+  margin-bottom: 16px;
+}
+
+.card-title {
+  font-size: 11px;
+  font-weight: 600;
+  text-transform: uppercase;
+  letter-spacing: 0.08em;
+  color: var(--text-muted);
+  margin-bottom: 14px;
+}
+
+/* ── Badges ──────────────────────────────────────────────────────────────── */
+.badge {
+  display: inline-block;
+  padding: 2px 9px;
+  border-radius: 999px;
+  font-size: 11px;
+  font-weight: 600;
+  letter-spacing: 0.03em;
+}
+
+.badge-ok      { background: rgba(116,192,124,0.15); color: var(--success); }
+.badge-warn    { background: rgba(217,162,75,0.15);  color: var(--warning); }
+.badge-err     { background: rgba(222,138,120,0.15); color: var(--danger); }
+.badge-idle    { background: rgba(126,136,119,0.15); color: var(--text-muted); }
+.badge-running { background: var(--accent-muted);    color: var(--accent); }
+
+/* ── Spinner ─────────────────────────────────────────────────────────────── */
+@keyframes spin { to { transform: rotate(360deg); } }
+
+.spinner {
+  display: inline-block;
+  width: 14px;
+  height: 14px;
+  border: 2px solid var(--border-light);
+  border-top-color: var(--accent);
+  border-radius: 50%;
+  animation: spin 0.65s linear infinite;
+  flex-shrink: 0;
+}
+
+/* ── Empty state ─────────────────────────────────────────────────────────── */
+.empty {
+  padding: 28px;
+  text-align: center;
+  color: var(--text-muted);
+  font-size: 13px;
+}
+
+/* ── Alert ───────────────────────────────────────────────────────────────── */
+.alert {
+  border-radius: var(--radius-sm);
+  padding: 10px 14px;
+  font-size: 13px;
+  display: none;
+}
+
+.alert.visible { display: block; }
+
+.alert-error {
+  background: rgba(222, 138, 120, 0.10);
+  border: 1px solid rgba(222, 138, 120, 0.25);
+  color: var(--danger);
+}
+
+.alert-success {
+  background: rgba(116, 192, 124, 0.10);
+  border: 1px solid rgba(116, 192, 124, 0.25);
+  color: var(--success);
+}