neoagent 2.4.3 → 2.4.4-beta.4

package/server/routes/memory.js

@@ -28,6 +28,14 @@ const transferImportLimiter = rateLimit({
   legacyHeaders: false,
 });
 
+const memorySearchLimiter = rateLimit({
+  windowMs: 1 * 60 * 1000,
+  max: 60,
+  message: { error: 'Too many memory search requests, try again later' },
+  standardHeaders: true,
+  legacyHeaders: false,
+});
+
 const MAX_TRANSFER_TEXT_BYTES = 60 * 1024;
 
 function normalizeMemoryIds(value) {
@@ -378,20 +386,49 @@ router.post('/memories/bulk-archive', (req, res) => {
 });
 
 // Semantic recall (search)
-router.post('/memories/recall', async (req, res) => {
+router.post('/memories/recall', memorySearchLimiter, async (req, res) => {
   const mm = req.app.locals.memoryManager;
   const userId = req.session.userId;
   const agentId = resolveAgentId(userId, getAgentIdFromRequest(req));
   const { query, limit = 8 } = req.body;
   if (!query) return res.status(400).json({ error: 'query is required' });
+
+  let parsedLimit = Number.parseInt(limit, 10);
+  if (!Number.isFinite(parsedLimit) || Number.isNaN(parsedLimit)) {
+    return res.status(400).json({ error: 'limit must be an integer between 1 and 100' });
+  }
+  parsedLimit = Math.max(1, Math.min(100, parsedLimit));
+
   try {
-    const results = await mm.recallMemory(userId, query, parseInt(limit), { agentId });
+    const results = await mm.recallMemory(userId, query, parsedLimit, { agentId });
     res.json(results);
   } catch (err) {
     res.status(500).json({ error: sanitizeError(err) });
   }
 });
 
+// Semantic recall inspection (UI debug)
+router.post('/memories/inspect', memorySearchLimiter, async (req, res) => {
+  const mm = req.app.locals.memoryManager;
+  const userId = req.session.userId;
+  const agentId = resolveAgentId(userId, getAgentIdFromRequest(req));
+  const { query, limit = 20 } = req.body;
+  if (!query) return res.status(400).json({ error: 'query is required' });
+
+  let parsedLimit = Number.parseInt(limit, 10);
+  if (!Number.isFinite(parsedLimit) || Number.isNaN(parsedLimit)) {
+    return res.status(400).json({ error: 'limit must be an integer between 1 and 100' });
+  }
+  parsedLimit = Math.max(1, Math.min(100, parsedLimit));
+
+  try {
+    const results = await mm.recallMemory(userId, query, parsedLimit, { agentId });
+    res.json({ results });
+  } catch (err) {
+    res.status(500).json({ error: sanitizeError(err) });
+  }
+});
+
 // ─────────────────────────────────────────────────────────────────────────────
 // Core Memory
 // ─────────────────────────────────────────────────────────────────────────────

package/server/routes/security.js

@@ -0,0 +1,112 @@
+'use strict';
+
+const express = require('express');
+const router = express.Router();
+const { requireAuth } = require('../middleware/auth');
+const db = require('../db/database');
+const { TOOL_CATEGORIES, getCategoryForTool } = require('../services/security/tool_categories');
+
+router.use(requireAuth);
+
+// ── Security mode ─────────────────────────────────────────────────────────────
+
+// GET /api/security/mode — current global security mode
+router.get('/mode', (req, res) => {
+  const mode = req.app.locals.toolPolicyService.getSecurityMode(req.session.userId);
+  res.json({ mode });
+});
+
+// PUT /api/security/mode — update global security mode
+router.put('/mode', (req, res) => {
+  const { mode } = req.body;
+  if (!mode) return res.status(400).json({ error: 'mode is required' });
+  try {
+    req.app.locals.toolPolicyService.setSecurityMode(req.session.userId, mode);
+    res.json({ ok: true, mode });
+  } catch (err) {
+    res.status(400).json({ error: err.message });
+  }
+});
+
+// ── Per-category policies ─────────────────────────────────────────────────────
+
+// GET /api/security/policies — all category policies + current mode
+router.get('/policies', (req, res) => {
+  const { toolPolicyService } = req.app.locals;
+  const policies = toolPolicyService.getPolicies(req.session.userId);
+  const mode = toolPolicyService.getSecurityMode(req.session.userId);
+  res.json({ policies, mode, categories: Object.keys(TOOL_CATEGORIES) });
+});
+
+// PUT /api/security/policies — update a single category policy
+router.put('/policies', (req, res) => {
+  const { category, policy } = req.body;
+  if (!category || !policy) {
+    return res.status(400).json({ error: 'category and policy are required' });
+  }
+  try {
+    req.app.locals.toolPolicyService.setPolicy(req.session.userId, category, policy);
+    res.json({ ok: true, category, policy });
+  } catch (err) {
+    res.status(400).json({ error: err.message });
+  }
+});
+
+// ── Approval decisions ────────────────────────────────────────────────────────
+
+// POST /api/security/approvals/:approvalId — resolve a pending approval
+router.post('/approvals/:approvalId', (req, res) => {
+  const { approvalId } = req.params;
+  const { decision, scope, runId, toolName, toolArgs } = req.body;
+
+  if (!decision || !['approved', 'denied'].includes(decision)) {
+    return res.status(400).json({ error: 'decision must be approved or denied' });
+  }
+  const normalizedScope = ['once', 'session', 'always'].includes(scope) ? scope : 'once';
+
+  // 'always' scope: also persist the policy so this category is allowed going forward
+  if (decision === 'approved' && normalizedScope === 'always' && toolName) {
+    try {
+      const category = getCategoryForTool(toolName, toolArgs ?? {});
+      if (category) {
+        req.app.locals.toolPolicyService.setPolicy(req.session.userId, category, 'allow');
+      }
+    } catch {}
+  }
+
+  const { approvalGateService } = req.app.locals;
+  const resolved = approvalGateService.resolve(
+    approvalId,
+    req.session.userId,
+    runId || null,
+    toolName || null,
+    toolArgs || {},
+    decision,
+    normalizedScope,
+  );
+  if (!resolved) {
+    return res.status(404).json({ error: 'Approval not found or already resolved' });
+  }
+  res.json({ ok: true, approvalId, decision, scope: normalizedScope });
+});
+
+// ── Audit log ─────────────────────────────────────────────────────────────────
+
+// GET /api/security/approval-log — paginated audit log
+router.get('/approval-log', (req, res) => {
+  const limit = Math.min(Number(req.query.limit) || 50, 200);
+  const offset = Number(req.query.offset) || 0;
+  const rows = db.prepare(`
+    SELECT id, run_id, tool_name, tool_args_json, decision, scope, decided_at
+    FROM tool_approval_log
+    WHERE user_id = ?
+    ORDER BY decided_at DESC
+    LIMIT ? OFFSET ?
+  `).all(req.session.userId, limit, offset);
+  const total = db.prepare(
+    'SELECT COUNT(*) as count FROM tool_approval_log WHERE user_id = ?'
+  ).get(req.session.userId)?.count ?? 0;
+  res.json({ log: rows, total, limit, offset });
+});
+
+module.exports = router;

package/server/services/ai/engine.js

@@ -76,6 +76,18 @@ const {
   inferToolFailureMessage,
   buildAutonomousRecoveryContext,
 } = require('./toolEvidence');
+const {
+  buildMemoryConsolidationInstructions,
+  normalizeMemoryCandidates,
+} = require('../memory/consolidation');
+const {
+  buildPlannerPrompt,
+  buildRerankerPrompt,
+  mergeRetrievalResults,
+  normalizeRerankResult,
+  normalizeRetrievalPlan,
+  shouldEnhanceRetrieval,
+} = require('../memory/retrieval_reasoning');
 
 function generateTitle(task) {
   if (!task || typeof task !== 'string') return 'Untitled';
@@ -341,6 +353,198 @@ class AgentEngine {
     };
   }
 
+  async buildMemoryRecall({
+    memoryManager,
+    userId,
+    agentId,
+    query,
+    provider,
+    providerName,
+    model,
+    runId,
+    stepId = null,
+    options = {},
+    returnDetails = false,
+  }) {
+    const initial = await memoryManager.recallMemory(userId, query, 12, { agentId });
+
+    const pendingChunks = memoryManager.getPendingExtractionChunks?.(userId, agentId, 5) || [];
+    if (pendingChunks.length) {
+      this.extractPendingChunks(pendingChunks, {
+        userId,
+        agentId,
+        provider,
+        providerName,
+        model,
+        memoryManager,
+      }).catch((err) => console.warn('[Memory] Background chunk extraction failed:', err.message));
+    }
+
+    const decision = shouldEnhanceRetrieval(initial);
+    if (!decision.enhance) {
+      const message = await memoryManager.buildRecallMessage(userId, query, {
+        agentId,
+        recalled: initial.slice(0, 5),
+      });
+      return returnDetails
+        ? { message, results: initial.slice(0, 12), enhanced: false, reason: decision.reason }
+        : message;
+    }
+
+    const stats = memoryManager.getMemoryStats?.(userId, { agentId })
+      || { total: initial.length };
+    if (!Number(stats.total || 0)) {
+      return returnDetails
+        ? { message: null, results: [], enhanced: false, reason: 'empty_memory' }
+        : null;
+    }
+
+    const startedAt = Date.now();
+    let plan = null;
+    let merged = initial;
+    let reranked = initial;
+    try {
+      const planned = await this.requestStructuredJson({
+        provider,
+        providerName,
+        model,
+        messages: [],
+        prompt: buildPlannerPrompt(query, initial, new Date().toISOString()),
+        maxTokens: 650,
+        normalize: (raw) => normalizeRetrievalPlan(raw, query),
+        fallback: normalizeRetrievalPlan({}, query),
+        reasoningEffort: this.getReasoningEffort(providerName, options),
+        telemetry: { runId, stepId, userId, agentId },
+        phase: 'memory_retrieval_plan',
+      });
+      plan = planned.value;
+      const resultSets = [initial];
+      for (const variant of plan.queryVariants) {
+        if (variant === query && initial.length) continue;
+        resultSets.push(await memoryManager.recallMemory(userId, variant, 20, {
+          agentId,
+          validAt: plan.validAt,
+          includeHistory: plan.temporalMode === 'historical',
+        }));
+      }
+      merged = mergeRetrievalResults(resultSets, 30);
+      if (merged.length > 1) {
+        const rerankResponse = await this.requestStructuredJson({
+          provider,
+          providerName,
+          model,
+          messages: [],
+          prompt: buildRerankerPrompt(query, plan, merged.slice(0, 24)),
+          maxTokens: 1200,
+          normalize: (raw) => normalizeRerankResult(raw, merged),
+          fallback: merged,
+          reasoningEffort: this.getReasoningEffort(providerName, options),
+          telemetry: { runId, stepId, userId, agentId },
+          phase: 'memory_retrieval_rerank',
+        });
+        reranked = rerankResponse.value;
+      } else {
+        reranked = merged;
+      }
+    } catch (error) {
+      console.warn('[Memory] Retrieval enhancement failed:', error.message);
+      plan = null;
+      merged = initial;
+      reranked = initial;
+    }
+
+    memoryManager.recordRetrievalEnhancement?.(userId, {
+      query,
+      reason: decision.reason,
+      plan,
+      initialCount: initial.length,
+      mergedCount: merged.length,
+      resultIds: reranked.slice(0, 5).map((result) => result.id),
+      latencyMs: Date.now() - startedAt,
+    }, { agentId, runId });
+
+    const message = await memoryManager.buildRecallMessage(userId, query, {
+      agentId,
+      recalled: reranked.slice(0, 5),
+    });
+    return returnDetails
+      ? {
+        message,
+        results: reranked.slice(0, 12),
+        enhanced: plan !== null,
+        reason: decision.reason,
+        plan,
+      }
+      : message;
+  }
+
+  async extractPendingChunks(chunks, {
+    userId,
+    agentId,
+    provider,
+    providerName,
+    model,
+    memoryManager,
+  }) {
+    const ids = chunks.map((c) => c.id);
+    memoryManager.markChunksExtracted?.(ids, { success: true });
+
+    const consolidationSchema = JSON.stringify({
+      memory_candidates: [{
+        memory: 'Concise standalone fact.',
+        subject: 'Canonical entity or person.',
+        predicate: 'Normalized relationship or attribute.',
+        object: 'Current atomic value.',
+        relation: 'new | updates | extends | derives',
+        category: 'identity | preferences | projects | contacts | events | tasks | episodic | assistant_self',
+        confidence: 0.8,
+        importance: 5,
+        is_static: false,
+        valid_from: null,
+        valid_to: null,
+        forget_after: null,
+        evidence: 'Short source-grounded quote.',
+      }],
+    }, null, 2);
+
+    for (const chunk of chunks) {
+      try {
+        const result = await this.requestStructuredJson({
+          provider,
+          providerName,
+          model,
+          messages: [],
+          prompt: [
+            'Return JSON only. Extract durable memory facts from the document chunk below.',
+            buildMemoryConsolidationInstructions(new Date().toISOString()),
+            `Source type: ${chunk.sourceType || 'document'}`,
+            chunk.title ? `Document title: ${chunk.title}` : '',
+            `Content:\n${String(chunk.content || '').slice(0, 2400)}`,
+            `Schema:\n${consolidationSchema}`,
+          ].filter(Boolean).join('\n\n'),
+          maxTokens: 800,
+          normalize: (raw) => normalizeMemoryCandidates(raw?.memory_candidates || []),
+          fallback: [],
+          phase: 'document_extraction',
+        });
+
+        const candidates = Array.isArray(result.value) ? result.value : [];
+        if (candidates.length) {
+          await memoryManager.consolidateMemoryCandidates(userId, candidates, {
+            agentId,
+            metadata: {
+              trustLevel: 'external_source',
+              sourceChunkMemoryId: chunk.id,
+            },
+          });
+        }
+      } catch (err) {
+        memoryManager.markChunksExtracted?.([chunk.id], { success: false });
+        console.warn('[Memory] Document chunk extraction failed:', err.message);
+      }
+    }
+  }
+
   persistRunMetadata(runId, patch = {}) {
     if (!runId || !patch || typeof patch !== 'object') return;
     const existing = db.prepare('SELECT metadata_json FROM agent_runs WHERE id = ?').get(runId);
@@ -888,6 +1092,7 @@ class AgentEngine {
 
   async refreshConversationState({
     conversationId,
+    runId,
     provider,
     providerName,
     model,
@@ -905,7 +1110,34 @@ class AgentEngine {
     const promptMessages = [
       {
         role: 'system',
-        content: 'Return JSON only. Distill the current thread working state. Keep it concise and concrete. Track summary, open_commitments, unresolved_questions, referenced_entities, and last_verified_facts. Do not invent facts.'
+        content: [
+          'Return JSON only. Distill the current thread working state. Keep it concise and concrete.',
+          'Track summary, open_commitments, unresolved_questions, referenced_entities, and last_verified_facts. Do not invent facts.',
+          buildMemoryConsolidationInstructions(new Date().toISOString()),
+          'Schema:',
+          JSON.stringify({
+            summary: '',
+            open_commitments: [],
+            unresolved_questions: [],
+            referenced_entities: [],
+            last_verified_facts: [],
+            memory_candidates: [{
+              memory: 'Concise standalone fact for future context.',
+              subject: 'Canonical entity or person.',
+              predicate: 'Normalized relationship or attribute.',
+              object: 'Current atomic value.',
+              relation: 'new | updates | extends | derives',
+              category: 'identity | preferences | projects | contacts | events | tasks | episodic | assistant_self',
+              confidence: 0.9,
+              importance: 7,
+              is_static: false,
+              valid_from: null,
+              valid_to: null,
+              forget_after: null,
+              evidence: 'Short source-grounded evidence.',
+            }],
+          }, null, 2),
+        ].join('\n\n')
       },
       {
         role: 'user',
@@ -943,6 +1175,20 @@ class AgentEngine {
     }
 
     memoryManager.updateConversationState(conversationId, nextState);
+    const memoryCandidates = normalizeMemoryCandidates(parsed.memory_candidates);
+    if (memoryCandidates.length) {
+      await memoryManager.consolidateMemoryCandidates(
+        options.userId,
+        memoryCandidates,
+        {
+          agentId: options.agentId || null,
+          conversationId,
+          runId,
+        },
+      );
+      const { invalidateSystemPromptCache } = require('./systemPrompt');
+      invalidateSystemPromptCache(options.userId, options.agentId || null);
+    }
     return nextState;
   }
 
@@ -1107,7 +1353,7 @@ class AgentEngine {
             toolArgs,
             stepIndex: nextStepIndex,
             blocked: true,
-            result: { status: 'skipped', reason: 'Blocked by policy.' },
+            result: { status: 'blocked', reason: hookResult.reason || 'Blocked by policy.', blocked_by: hookResult.blocked_by || 'policy' },
           });
           continue;
         }
@@ -1726,7 +1972,17 @@ class AgentEngine {
     const recallQuery = options.context?.rawUserMessage || userMessage;
     const recallMsg = options.skipGlobalRecall === true
       ? null
-      : await memoryManager.buildRecallMessage(userId, recallQuery, { agentId });
+      : await this.buildMemoryRecall({
+        memoryManager,
+        userId,
+        agentId,
+        query: recallQuery,
+        provider,
+        providerName,
+        model,
+        runId,
+        options,
+      });
 
     let summaryMessage = null;
     let historyMessages = [];
@@ -2428,13 +2684,14 @@ class AgentEngine {
             const hookCtx = { toolName, toolArgs, runId, userId, agentId, iteration };
             const hookResult = await globalHooks.run('before_tool_call', hookCtx);
             if (hookResult.block) {
-              console.warn(`[Run ${shortenRunId(runId)}] before_tool_call hook blocked tool=${toolName}`);
-              // Treat as a soft skip — add a skipped tool message so the model knows
+              const blockReason = hookResult.reason || 'Blocked by policy.';
+              const blockedBy = hookResult.blocked_by || 'policy';
+              console.warn(`[Run ${shortenRunId(runId)}] before_tool_call hook blocked tool=${toolName} reason="${blockReason}"`);
               messages.push({
                 role: 'tool',
                 name: toolName,
                 tool_call_id: toolCall.id,
-                content: JSON.stringify({ tool: toolName, status: 'skipped', reason: 'Blocked by policy.' }),
+                content: JSON.stringify({ tool: toolName, status: 'blocked', reason: blockReason, blocked_by: blockedBy }),
               });
               continue;
             }
@@ -2857,8 +3114,9 @@ class AgentEngine {
           refreshConversationSummary(conversationId, provider, model, historyWindow).catch((err) => {
             console.error('[AI] Conversation summary refresh failed:', err.message);
           });
-          this.refreshConversationState({
+          await this.refreshConversationState({
             conversationId,
+            runId,
             provider,
             providerName,
             model,
@@ -2866,7 +3124,7 @@ class AgentEngine {
             analysis,
             verification,
             historyWindow,
-            options,
+            options: { ...options, userId, agentId },
           }).catch((err) => {
             console.error('[AI] Conversation working state refresh failed:', err.message);
           });
@@ -3166,9 +3424,8 @@ class AgentEngine {
     let relevantMemories = [];
     try {
       relevantMemories = this.memoryManager
-        ? await this.memoryManager.recallMemory(userId, task, {
+        ? await this.memoryManager.recallMemory(userId, task, 4, {
           agentId: options.agentId || null,
-          limit: 4,
         })
         : [];
     } catch {}

package/server/services/ai/systemPrompt.js

@@ -3,6 +3,13 @@ const os = require('os');
 const PROMPT_CACHE_TTL = 30_000;
 const promptCache = new Map();
 
+function invalidateSystemPromptCache(userId, agentId = null) {
+  const prefix = `${String(userId || 'global')}:${String(agentId || 'main')}:`;
+  for (const key of promptCache.keys()) {
+    if (key.startsWith(prefix)) promptCache.delete(key);
+  }
+}
+
 function clampSection(text, maxChars) {
   const str = String(text || '').trim();
   if (!str) return '';
@@ -284,7 +291,7 @@ async function buildSystemPromptSections(userId, context = {}, memoryManager) {
   }
 
   const memCtx = await memoryManager.buildContext(userId, { agentId });
-  const compactMemory = clampSection(memCtx, 3200);
+  const compactMemory = clampSection(memCtx, 1600);
   if (compactMemory) {
     dynamic.push(compactMemory);
   }
@@ -344,4 +351,8 @@ async function buildSystemPrompt(userId, context = {}, memoryManager) {
   return [sections.stable, sections.dynamic].filter(Boolean).join('\n\n');
 }
 
-module.exports = { buildSystemPrompt, buildSystemPromptSections };
+module.exports = {
+  buildSystemPrompt,
+  buildSystemPromptSections,
+  invalidateSystemPromptCache,
+};