neoagent 2.4.2-beta.4 → 2.4.2-beta.6

package/server/routes/admin.js

@@ -416,20 +416,69 @@ router.delete('/api/settings/apikey', requireAdminAuth, settingsLimiter, (req, r
 
 router.get('/api/analytics', requireAdminAuth, (req, res) => {
   const db = require('../db/database');
+  const range = Math.min(Math.max(parseInt(req.query.range) || 30, 1), 365);
   const now = new Date().toISOString();
   const dayAgo  = new Date(Date.now() - 86_400_000).toISOString();
   const weekAgo = new Date(Date.now() - 7 * 86_400_000).toISOString();
+  const rangeAgo = new Date(Date.now() - range * 86_400_000).toISOString();
   try {
+    const totalRunsRow  = db.prepare('SELECT COUNT(*) AS n, COALESCE(SUM(total_tokens),0) AS t FROM agent_runs').get();
+    const successRow    = db.prepare("SELECT COUNT(*) AS n FROM agent_runs WHERE status = 'completed'").get();
     const stats = {
-      totalUsers:    db.prepare('SELECT COUNT(*) AS n FROM users').get().n,
-      activeToday:   db.prepare('SELECT COUNT(*) AS n FROM users WHERE last_login > ?').get(dayAgo).n,
-      newThisWeek:   db.prepare('SELECT COUNT(*) AS n FROM users WHERE created_at > ?').get(weekAgo).n,
-      totalRuns:     db.prepare('SELECT COUNT(*) AS n FROM agent_runs').get().n,
-      runsToday:     db.prepare('SELECT COUNT(*) AS n FROM agent_runs WHERE created_at > ?').get(dayAgo).n,
-      totalTokens:   db.prepare('SELECT COALESCE(SUM(total_tokens),0) AS n FROM agent_runs').get().n,
-      activeSessions:db.prepare('SELECT COUNT(*) AS n FROM user_sessions WHERE revoked_at IS NULL AND expires_at > ?').get(now).n,
-      totalStorage:  db.prepare('SELECT COALESCE(SUM(byte_size),0) AS n FROM artifacts').get().n,
+      totalUsers:     db.prepare('SELECT COUNT(*) AS n FROM users').get().n,
+      activeToday:    db.prepare('SELECT COUNT(*) AS n FROM users WHERE last_login > ?').get(dayAgo).n,
+      newThisWeek:    db.prepare('SELECT COUNT(*) AS n FROM users WHERE created_at > ?').get(weekAgo).n,
+      totalRuns:      totalRunsRow.n,
+      runsToday:      db.prepare('SELECT COUNT(*) AS n FROM agent_runs WHERE created_at > ?').get(dayAgo).n,
+      runsThisWeek:   db.prepare('SELECT COUNT(*) AS n FROM agent_runs WHERE created_at > ?').get(weekAgo).n,
+      totalTokens:    totalRunsRow.t,
+      tokensToday:    db.prepare("SELECT COALESCE(SUM(total_tokens),0) AS n FROM agent_runs WHERE created_at > ?").get(dayAgo).n,
+      avgTokensPerRun: totalRunsRow.n > 0 ? Math.round(totalRunsRow.t / totalRunsRow.n) : 0,
+      successRate:    totalRunsRow.n > 0 ? Math.round((successRow.n / totalRunsRow.n) * 100) : 0,
+      activeSessions: db.prepare('SELECT COUNT(*) AS n FROM user_sessions WHERE revoked_at IS NULL AND expires_at > ?').get(now).n,
+      totalStorage:   db.prepare('SELECT COALESCE(SUM(byte_size),0) AS n FROM artifacts').get().n,
     };
+
+    // Time-series: runs + tokens per day for selected range
+    const runsByDay = db.prepare(`
+      SELECT date(created_at) AS date,
+             COUNT(*) AS runs,
+             COALESCE(SUM(total_tokens), 0) AS tokens
+      FROM agent_runs
+      WHERE created_at > ?
+      GROUP BY date(created_at)
+      ORDER BY date
+    `).all(rangeAgo);
+
+    // New users per day for selected range
+    const usersByDay = db.prepare(`
+      SELECT date(created_at) AS date, COUNT(*) AS newUsers
+      FROM users
+      WHERE created_at > ?
+      GROUP BY date(created_at)
+      ORDER BY date
+    `).all(rangeAgo);
+
+    // Model breakdown (top 10 by runs)
+    const modelBreakdown = db.prepare(`
+      SELECT COALESCE(model, 'unknown') AS model,
+             COUNT(*) AS runs,
+             COALESCE(SUM(total_tokens), 0) AS tokens
+      FROM agent_runs
+      WHERE created_at > ?
+      GROUP BY model
+      ORDER BY runs DESC
+      LIMIT 10
+    `).all(rangeAgo);
+
+    // Run status breakdown
+    const statusBreakdown = db.prepare(`
+      SELECT status, COUNT(*) AS count
+      FROM agent_runs
+      GROUP BY status
+      ORDER BY count DESC
+    `).all();
+
     const topUsers = db.prepare(`
       SELECT u.id, u.username, u.display_name,
              COALESCE(r.runs,    0) AS runs,
@@ -437,25 +486,25 @@ router.get('/api/analytics', requireAdminAuth, (req, res) => {
              COALESCE(a.storage, 0) AS storage
       FROM users u
       LEFT JOIN (
-        SELECT user_id,
-               COUNT(*)                   AS runs,
-               COALESCE(SUM(total_tokens),0) AS tokens
+        SELECT user_id, COUNT(*) AS runs, COALESCE(SUM(total_tokens),0) AS tokens
         FROM agent_runs GROUP BY user_id
       ) r ON r.user_id = u.id
       LEFT JOIN (
         SELECT user_id, COALESCE(SUM(byte_size),0) AS storage
         FROM artifacts GROUP BY user_id
       ) a ON a.user_id = u.id
-      ORDER BY runs DESC LIMIT 8
+      ORDER BY tokens DESC LIMIT 10
     `).all();
+
     const recentRuns = db.prepare(`
-      SELECT r.id, u.username, r.title, r.status, r.total_tokens,
+      SELECT r.id, u.username, r.title, r.status, r.model, r.total_tokens,
              r.created_at, r.completed_at
       FROM agent_runs r
       JOIN users u ON u.id = r.user_id
-      ORDER BY r.created_at DESC LIMIT 20
+      ORDER BY r.created_at DESC LIMIT 25
     `).all();
-    res.json({ stats, topUsers, recentRuns });
+
+    res.json({ stats, runsByDay, usersByDay, modelBreakdown, statusBreakdown, topUsers, recentRuns });
   } catch (err) {
     res.status(500).json({ error: String(err.message || err) });
   }
@@ -645,20 +694,20 @@ router.get('/api/models', requireAdminAuth, async (req, res) => {
   const { getSupportedModels } = require('../services/ai/models');
   try {
     const models = await getSupportedModels(null, null);
-    const enabledModelsStr = process.env.NEOAGENT_ENABLED_MODELS || '';
-    const enabledModelsList = enabledModelsStr ? enabledModelsStr.split(',').map(s => s.trim()).filter(s => s.length > 0) : [];
-    res.json({ models, enabledModels: enabledModelsList });
+    const disabledStr = process.env.NEOAGENT_DISABLED_MODELS || '';
+    const disabledModels = disabledStr ? disabledStr.split(',').map(s => s.trim()).filter(Boolean) : [];
+    res.json({ models, disabledModels });
   } catch (err) {
     res.status(500).json({ error: String(err.message || err) });
   }
 });
 
-router.put('/api/models/enabled', requireAdminAuth, express.json(), (req, res) => {
-  const { enabledModels } = req.body || {};
-  if (!Array.isArray(enabledModels)) return res.status(400).json({ error: 'enabledModels must be an array' });
-  const value = enabledModels.join(',');
-  upsertEnvValue(ENV_FILE, 'NEOAGENT_ENABLED_MODELS', value);
-  process.env.NEOAGENT_ENABLED_MODELS = value;
+router.put('/api/models/config', requireAdminAuth, express.json(), (req, res) => {
+  const { disabledModels } = req.body || {};
+  if (!Array.isArray(disabledModels)) return res.status(400).json({ error: 'disabledModels must be an array' });
+  const value = disabledModels.join(',');
+  upsertEnvValue(ENV_FILE, 'NEOAGENT_DISABLED_MODELS', value);
+  process.env.NEOAGENT_DISABLED_MODELS = value;
   res.json({ ok: true });
 });
 

package/server/routes/mcp.js

@@ -20,6 +20,15 @@ function getTrustedPostMessageOrigin(req) {
 
 router.use(requireAuth);
 
+router.get('/audit', (req, res) => {
+  try {
+    const agentId = resolveAgentId(req.session.userId, getAgentIdFromRequest(req));
+    res.json(req.app.locals.capabilityAuditService.auditMcp(req.session.userId, { agentId }));
+  } catch (err) {
+    res.status(500).json({ error: sanitizeError(err) });
+  }
+});
+
 // List configured MCP servers
 router.get('/', (req, res) => {
   const agentId = resolveAgentId(req.session.userId, getAgentIdFromRequest(req));

package/server/routes/memory.js

@@ -226,6 +226,39 @@ router.get('/entities', (req, res) => {
   }
 });
 
+router.get('/facts', (req, res) => {
+  const mm = req.app.locals.memoryManager;
+  const userId = req.session.userId;
+  const agentId = resolveAgentId(userId, getAgentIdFromRequest(req));
+  try {
+    res.json(mm.listFacts(userId, {
+      agentId,
+      status: req.query.status || '',
+      subject: req.query.subject || '',
+      predicate: req.query.predicate || '',
+      validAt: req.query.validAt || '',
+      knownAt: req.query.knownAt || '',
+      limit: req.query.limit,
+    }));
+  } catch (err) {
+    res.status(500).json({ error: sanitizeError(err) });
+  }
+});
+
+router.post('/facts/reconcile', (req, res) => {
+  const mm = req.app.locals.memoryManager;
+  const userId = req.session.userId;
+  const agentId = resolveAgentId(userId, getAgentIdFromRequest(req));
+  try {
+    res.json(mm.reconcileFacts(userId, {
+      agentId,
+      minimumConfidence: req.body?.minimumConfidence,
+    }));
+  } catch (err) {
+    res.status(500).json({ error: sanitizeError(err) });
+  }
+});
+
 router.post('/knowledge-views/materialize', (req, res) => {
   const mm = req.app.locals.memoryManager;
   const userId = req.session.userId;
@@ -424,7 +457,7 @@ router.post('/transfer-import', transferImportLimiter, async (req, res) => {
     if (applyCoreMemory && parsed.coreEntries) {
       for (const [key, value] of Object.entries(parsed.coreEntries)) {
         if (!key || key === 'active_context') continue;
-        mm.updateCore(userId, key, value, { agentId });
+        mm.updateCore(userId, key, value, { agentId, confirmed: true });
         coreUpdatedCount += 1;
       }
     }
@@ -456,7 +489,7 @@ router.put('/core/:key', (req, res) => {
   if (req.params.key === 'active_context') {
     return res.status(400).json({ error: 'active_context is no longer a supported core memory key' });
   }
-  mm.updateCore(userId, req.params.key, value, { agentId });
+  mm.updateCore(userId, req.params.key, value, { agentId, confirmed: true });
   res.json({ success: true });
 });
 

package/server/routes/runtime.js

@@ -1,13 +1,16 @@
 'use strict';
 
 const express = require('express');
-const { getAnalyticsConfig } = require('../config/analytics');
 
 const router = express.Router();
 
 router.get('/config', (req, res) => {
   res.json({
-    analytics: getAnalyticsConfig(),
+    analytics: {
+      enabled: false,
+      provider: null,
+      requiresConsent: true,
+    },
   });
 });
 

package/server/routes/settings.js

@@ -410,6 +410,23 @@ router.get('/token-usage/summary', (req, res) => {
     return acc;
   }, { count: 0, system: 0, tools: 0, history: 0, recall: 0, replay: 0 });
 
+  const normalizedUsage = db.prepare(`
+    SELECT
+      COALESCE(SUM(input_tokens), 0) AS inputTokens,
+      COALESCE(SUM(output_tokens), 0) AS outputTokens,
+      COALESCE(SUM(reasoning_tokens), 0) AS reasoningTokens,
+      COALESCE(SUM(cached_read_tokens), 0) AS cachedReadTokens,
+      COALESCE(SUM(cache_write_tokens), 0) AS cacheWriteTokens,
+      COALESCE(SUM(total_tokens), 0) AS totalTokens,
+      SUM(estimated_cost_usd) AS estimatedCostUsd,
+      COUNT(estimated_cost_usd) AS pricedCallCount,
+      COUNT(*) AS callCount
+    FROM agent_model_usage
+    WHERE user_id = ? AND agent_id = ?
+  `).get(userId, agentId);
+  const cacheEligibleTokens = Number(normalizedUsage?.inputTokens || 0)
+    + Number(normalizedUsage?.cachedReadTokens || 0);
+
   res.json({
     totals: {
       totalTokens: Number(totals?.totalTokens || 0),
@@ -429,7 +446,23 @@ router.get('/token-usage/summary', (req, res) => {
         toolReplayTokens: Math.round(metricTotals.replay / metricTotals.count)
       },
       latest: parsedMetrics[0] || null
-    }
+    },
+    modelUsage: {
+      inputTokens: Number(normalizedUsage?.inputTokens || 0),
+      outputTokens: Number(normalizedUsage?.outputTokens || 0),
+      reasoningTokens: Number(normalizedUsage?.reasoningTokens || 0),
+      cachedReadTokens: Number(normalizedUsage?.cachedReadTokens || 0),
+      cacheWriteTokens: Number(normalizedUsage?.cacheWriteTokens || 0),
+      totalTokens: Number(normalizedUsage?.totalTokens || 0),
+      estimatedCostUsd: Number(normalizedUsage?.pricedCallCount || 0) > 0
+        ? Number(normalizedUsage.estimatedCostUsd)
+        : null,
+      pricedCallCount: Number(normalizedUsage?.pricedCallCount || 0),
+      callCount: Number(normalizedUsage?.callCount || 0),
+      cacheHitRatio: cacheEligibleTokens > 0
+        ? Number(normalizedUsage?.cachedReadTokens || 0) / cacheEligibleTokens
+        : 0,
+    },
   });
 });
 

package/server/routes/skills.js

@@ -2,6 +2,7 @@ const express = require('express');
 const router = express.Router();
 const { requireAuth } = require('../middleware/auth');
 const { sanitizeError } = require('../utils/security');
+const db = require('../db/database');
 const {
   getSkillRunner,
   serializeInstalledSkill,
@@ -62,6 +63,47 @@ router.get('/', async (req, res) => {
   }
 });
 
+router.get('/metrics/summary', (req, res) => {
+  try {
+    const rows = db.prepare(
+      `SELECT skill_name, invocation_count, success_count, failure_count,
+              correction_count, total_tokens, last_used_at
+       FROM skill_metrics WHERE user_id = ?
+       ORDER BY invocation_count DESC, skill_name ASC`
+    ).all(req.session.userId);
+    res.json(rows.map((row) => {
+      const invocations = Number(row.invocation_count || 0);
+      const successes = Number(row.success_count || 0);
+      const failures = Number(row.failure_count || 0);
+      let recommendation = 'keep';
+      if (invocations >= 5 && failures / invocations >= 0.4) recommendation = 'improve_or_disable';
+      else if (invocations >= 10 && successes === 0) recommendation = 'disable_or_delete';
+      else if (invocations === 0) recommendation = 'review_unused';
+      return {
+        skillName: row.skill_name,
+        invocationCount: invocations,
+        successCount: successes,
+        failureCount: failures,
+        correctionCount: Number(row.correction_count || 0),
+        totalTokens: Number(row.total_tokens || 0),
+        successRate: invocations > 0 ? successes / invocations : null,
+        lastUsedAt: row.last_used_at,
+        recommendation,
+      };
+    }));
+  } catch (err) {
+    res.status(500).json({ error: sanitizeError(err) });
+  }
+});
+
+router.get('/audit/summary', (req, res) => {
+  try {
+    res.json(req.app.locals.capabilityAuditService.auditSkills());
+  } catch (err) {
+    res.status(500).json({ error: sanitizeError(err) });
+  }
+});
+
 router.get('/:name', async (req, res) => {
   try {
     const runner = await getSkillRunner(req.app);

package/server/routes/task_webhooks.js

@@ -0,0 +1,65 @@
+'use strict';
+
+const express = require('express');
+const { requireAuth } = require('../middleware/auth');
+const { sanitizeError } = require('../utils/security');
+
+const router = express.Router();
+
+function parseTaskId(value) {
+  const taskId = Number.parseInt(value, 10);
+  if (!Number.isInteger(taskId) || taskId <= 0) throw new Error('Invalid task id.');
+  return taskId;
+}
+
+router.post('/:taskId/deliver', async (req, res) => {
+  try {
+    const result = await req.app.locals.taskWebhookService.deliver(
+      parseTaskId(req.params.taskId),
+      req.headers,
+      req.rawBody || JSON.stringify(req.body || {}),
+      req.body || {},
+    );
+    res.status(202).json(result);
+  } catch (err) {
+    res.status(err.status || 400).json({ error: sanitizeError(err) });
+  }
+});
+
+router.use(requireAuth);
+
+router.get('/:taskId', (req, res) => {
+  try {
+    res.json(req.app.locals.taskWebhookService.getConfiguration(
+      req.session.userId,
+      parseTaskId(req.params.taskId),
+    ));
+  } catch (err) {
+    res.status(err.status || 400).json({ error: sanitizeError(err) });
+  }
+});
+
+router.post('/:taskId/rotate', (req, res) => {
+  try {
+    res.json(req.app.locals.taskWebhookService.rotateSecret(
+      req.session.userId,
+      parseTaskId(req.params.taskId),
+    ));
+  } catch (err) {
+    res.status(err.status || 400).json({ error: sanitizeError(err) });
+  }
+});
+
+router.get('/:taskId/deliveries', (req, res) => {
+  try {
+    res.json(req.app.locals.taskWebhookService.listDeliveries(
+      req.session.userId,
+      parseTaskId(req.params.taskId),
+      req.query?.limit,
+    ));
+  } catch (err) {
+    res.status(err.status || 400).json({ error: sanitizeError(err) });
+  }
+});
+
+module.exports = router;