neoagent 2.4.4-beta.7 → 2.4.4-beta.9

package/.env.example

@@ -42,6 +42,11 @@ NEOAGENT_PROFILE=prod
 # can always register regardless of this setting).
 # NEOAGENT_ALLOW_SIGNUP=false
 
+# Rolling per-user AI token limits. Users can have custom overrides in the
+# admin dashboard.
+NEOAGENT_RATE_LIMIT_4H=2500000
+NEOAGENT_RATE_LIMIT_WEEKLY=10000000
+
 # VM runtime settings used by `prod`.
 # Set these before switching NEOAGENT_PROFILE=prod.
 # The app can cache a shared base image automatically from a URL, then create
@@ -80,6 +85,18 @@ NEOAGENT_EMAIL_SMTP_HOST=
 NEOAGENT_EMAIL_SMTP_PORT=587
 NEOAGENT_EMAIL_SMTP_USER=
 NEOAGENT_EMAIL_SMTP_PASS=
+NEOAGENT_EMAIL_SMTP_SECURE=false
+NEOAGENT_EMAIL_SMTP_REQUIRE_TLS=true
+NEOAGENT_EMAIL_SMTP_REJECT_UNAUTHORIZED=true
+NEOAGENT_EMAIL_REPLY_TO=
+NEOAGENT_EMAIL_REQUIRE_SIGNUP_CONFIRMATION=true
+NEOAGENT_EMAIL_REQUIRE_EMAIL_CHANGE_CONFIRMATION=true
+NEOAGENT_EMAIL_NOTIFY_UNUSUAL_LOGIN=true
+NEOAGENT_EMAIL_NOTIFY_ACCOUNT_CHANGES=true
+NEOAGENT_EMAIL_BRAND_NAME=NeoAgent
+NEOAGENT_EMAIL_SUPPORT_URL=
+NEOAGENT_EMAIL_PUBLIC_URL=
+NEOAGENT_EMAIL_TOKEN_TTL_HOURS=24
 
 ########################################
 # Hosted AI providers

package/docs/configuration.md

@@ -117,6 +117,7 @@ Optional. When configured, NeoAgent uses SMTP for account flows: signup confirma
 | `NEOAGENT_EMAIL_NOTIFY_ACCOUNT_CHANGES` | `true` | Notices for password and email changes |
 | `NEOAGENT_EMAIL_BRAND_NAME` | `NeoAgent` | Display name in email templates |
 | `NEOAGENT_EMAIL_SUPPORT_URL` | optional | Support link for email templates |
+| `NEOAGENT_EMAIL_PUBLIC_URL` | `PUBLIC_URL` | Public base URL used in confirmation and reset links |
 | `NEOAGENT_EMAIL_TOKEN_TTL_HOURS` | `24` | Confirmation link expiry |
 
 ## Runtime Isolation

package/docs/supermemory-memory-review.md

@@ -279,7 +279,7 @@ Supermemory can still be used as a benchmark comparison provider, not as NeoAgen
 5. Temporal fact columns.
 6. Integration ingestion jobs and freshness policies.
 7. Conversation summaries and working state.
-8. Manual core memory with confirmation.
+8. Manual core memory management.
 9. UI and API support for memory inspection.
 
 ### Critical Gaps Before This Review

package/flutter_app/lib/main_account_settings.dart

@@ -403,7 +403,8 @@ class _AccountSettingsPanelState extends State<AccountSettingsPanel> {
           controller: _displayNameController,
           decoration: const InputDecoration(
             labelText: 'Display name',
-            helperText: 'Shown in the sidebar. Leave blank to use your username.',
+            helperText:
+                'Shown in the sidebar. Leave blank to use your username.',
           ),
         ),
         if (_displayNameInlineError != null) ...<Widget>[
@@ -607,6 +608,16 @@ class _AccountSettingsPanelState extends State<AccountSettingsPanel> {
     return amount.toString();
   }
 
+  String? _nextUsageDropLabel(DateTime? value) {
+    if (value == null) return null;
+    final remaining = value.difference(DateTime.now());
+    if (remaining.isNegative) return 'Usage updates shortly';
+    if (remaining.inHours > 0) {
+      return 'Next usage drop in ${remaining.inHours}h ${remaining.inMinutes.remainder(60)}m';
+    }
+    return 'Next usage drop in ${remaining.inMinutes + 1}m';
+  }
+
   Widget _buildUsagePanel() {
     if (widget.controller.isLoadingAccountSettings) {
       return const Center(
@@ -616,7 +627,7 @@ class _AccountSettingsPanelState extends State<AccountSettingsPanel> {
         ),
       );
     }
-    
+
     final usage = widget.controller.usageAndLimits;
     if (usage == null) {
       return Center(
@@ -639,12 +650,21 @@ class _AccountSettingsPanelState extends State<AccountSettingsPanel> {
       );
     }
 
-    Widget buildStatBox(String label, int current, int? limit, {bool isCustom = false}) {
+    Widget buildStatBox(
+      String label,
+      int current,
+      int? limit, {
+      required int remaining,
+      required bool reached,
+      required DateTime? nextDecreaseAt,
+      bool isCustom = false,
+    }) {
       final double progress = limit != null
           ? (limit <= 0 ? 1.0 : (current / limit).clamp(0.0, 1.0))
           : 0.0;
       final bool nearLimit = progress > 0.8;
-      final bool atLimit = progress >= 1.0;
+      final bool atLimit = reached || progress >= 1.0;
+      final nextDrop = _nextUsageDropLabel(nextDecreaseAt);
 
       return Container(
         width: double.infinity,
@@ -656,8 +676,8 @@ class _AccountSettingsPanelState extends State<AccountSettingsPanel> {
             color: atLimit
                 ? _danger.withValues(alpha: 0.6)
                 : nearLimit
-                    ? _warning.withValues(alpha: 0.5)
-                    : _borderLight,
+                ? _warning.withValues(alpha: 0.5)
+                : _borderLight,
           ),
         ),
         child: Column(
@@ -665,11 +685,20 @@ class _AccountSettingsPanelState extends State<AccountSettingsPanel> {
           children: <Widget>[
             Row(
               children: <Widget>[
-                Text(label, style: const TextStyle(fontSize: 16, fontWeight: FontWeight.w600)),
+                Text(
+                  label,
+                  style: const TextStyle(
+                    fontSize: 16,
+                    fontWeight: FontWeight.w600,
+                  ),
+                ),
                 const Spacer(),
                 if (limit != null)
                   Container(
-                    padding: const EdgeInsets.symmetric(horizontal: 8, vertical: 3),
+                    padding: const EdgeInsets.symmetric(
+                      horizontal: 8,
+                      vertical: 3,
+                    ),
                     decoration: BoxDecoration(
                       color: isCustom
                           ? _warning.withValues(alpha: 0.12)
@@ -696,7 +725,11 @@ class _AccountSettingsPanelState extends State<AccountSettingsPanel> {
                   style: TextStyle(
                     fontSize: 28,
                     fontWeight: FontWeight.w800,
-                    color: atLimit ? _danger : nearLimit ? _warning : null,
+                    color: atLimit
+                        ? _danger
+                        : nearLimit
+                        ? _warning
+                        : null,
                   ),
                 ),
                 Padding(
@@ -728,16 +761,27 @@ class _AccountSettingsPanelState extends State<AccountSettingsPanel> {
                   value: progress,
                   backgroundColor: _border,
                   valueColor: AlwaysStoppedAnimation<Color>(
-                    atLimit ? _danger : nearLimit ? _warning : _accent,
+                    atLimit
+                        ? _danger
+                        : nearLimit
+                        ? _warning
+                        : _accent,
                   ),
                 ),
               ),
               const SizedBox(height: 6),
               Text(
-                '${(progress * 100).toStringAsFixed(0)}% used',
+                atLimit
+                    ? 'Limit reached${nextDrop == null ? '' : ' · $nextDrop'}'
+                    : '${(progress * 100).toStringAsFixed(0)}% used · ${_formatTokens(remaining)} remaining'
+                          '${nextDrop == null ? '' : ' · $nextDrop'}',
                 style: TextStyle(
                   fontSize: 11,
-                  color: atLimit ? _danger : nearLimit ? _warning : _textMuted,
+                  color: atLimit
+                      ? _danger
+                      : nearLimit
+                      ? _warning
+                      : _textMuted,
                 ),
               ),
             ],
@@ -756,9 +800,25 @@ class _AccountSettingsPanelState extends State<AccountSettingsPanel> {
           style: TextStyle(color: _textSecondary, height: 1.4),
         ),
         const SizedBox(height: 24),
-        buildStatBox('Recent Usage (4 Hours)', usage.fourHourUsage, usage.fourHourLimit, isCustom: usage.fourHourIsCustom),
+        buildStatBox(
+          'Recent Usage (4 Hours)',
+          usage.fourHourUsage,
+          usage.fourHourLimit,
+          remaining: usage.fourHourRemaining,
+          reached: usage.fourHourReached,
+          nextDecreaseAt: usage.fourHourNextDecreaseAt,
+          isCustom: usage.fourHourIsCustom,
+        ),
         const SizedBox(height: 16),
-        buildStatBox('Weekly Usage', usage.weeklyUsage, usage.weeklyLimit, isCustom: usage.weeklyIsCustom),
+        buildStatBox(
+          'Weekly Usage',
+          usage.weeklyUsage,
+          usage.weeklyLimit,
+          remaining: usage.weeklyRemaining,
+          reached: usage.weeklyReached,
+          nextDecreaseAt: usage.weeklyNextDecreaseAt,
+          isCustom: usage.weeklyIsCustom,
+        ),
       ],
     );
   }
@@ -1128,7 +1188,11 @@ class _AccountSettingsTabs extends StatelessWidget {
   Widget build(BuildContext context) {
     final buttons = <Widget>[
       _tabButton(AccountSettingsTab.account, Icons.person_outline, 'Account'),
-      _tabButton(AccountSettingsTab.usage, Icons.data_usage_outlined, 'Usage & Limits'),
+      _tabButton(
+        AccountSettingsTab.usage,
+        Icons.data_usage_outlined,
+        'Usage & Limits',
+      ),
       _tabButton(
         AccountSettingsTab.security,
         Icons.security_outlined,

package/flutter_app/lib/main_chat.dart

@@ -295,12 +295,13 @@ class _ChatPanelState extends State<ChatPanel> with WidgetsBindingObserver {
       transitionBuilder: (ctx, animation, secondary, child) => FadeTransition(
         opacity: CurvedAnimation(parent: animation, curve: Curves.easeOut),
         child: SlideTransition(
-          position: Tween<Offset>(
-            begin: const Offset(0, 0.04),
-            end: Offset.zero,
-          ).animate(
-            CurvedAnimation(parent: animation, curve: Curves.easeOutCubic),
-          ),
+          position:
+              Tween<Offset>(
+                begin: const Offset(0, 0.04),
+                end: Offset.zero,
+              ).animate(
+                CurvedAnimation(parent: animation, curve: Curves.easeOutCubic),
+              ),
           child: child,
         ),
       ),
@@ -398,6 +399,11 @@ class _ChatPanelState extends State<ChatPanel> with WidgetsBindingObserver {
     _maybeFollowChatContent(messages, controller);
 
     final threadChildren = <Widget>[
+      if (controller.usageAndLimits case final usage?
+          when usage.hasLimits) ...<Widget>[
+        _RateLimitStatusCard(usage: usage),
+        const SizedBox(height: 16),
+      ],
       if (controller.errorMessage != null) ...<Widget>[
         _InlineError(message: controller.errorMessage!),
         const SizedBox(height: 16),
@@ -471,8 +477,12 @@ class _ChatPanelState extends State<ChatPanel> with WidgetsBindingObserver {
               SelectionArea(
                 child: ListView(
                   controller: _scrollController,
-                  padding:
-                      EdgeInsets.fromLTRB(sidePadding, 30, sidePadding, 18),
+                  padding: EdgeInsets.fromLTRB(
+                    sidePadding,
+                    30,
+                    sidePadding,
+                    18,
+                  ),
                   children: <Widget>[
                     Center(
                       child: ConstrainedBox(
@@ -715,6 +725,143 @@ class _ChatPanelState extends State<ChatPanel> with WidgetsBindingObserver {
   }
 }
 
+class _RateLimitStatusCard extends StatelessWidget {
+  const _RateLimitStatusCard({required this.usage});
+
+  final AccountUsageAndLimits usage;
+
+  String _formatTokens(int amount) {
+    if (amount >= 1000000) {
+      final value = amount / 1000000;
+      return '${value.toStringAsFixed(value == value.roundToDouble() ? 0 : 1)}M';
+    }
+    if (amount >= 1000) {
+      final value = amount / 1000;
+      return '${value.toStringAsFixed(value == value.roundToDouble() ? 0 : 1)}k';
+    }
+    return amount.toString();
+  }
+
+  String? _nextDropLabel(DateTime? value) {
+    if (value == null) return null;
+    final remaining = value.difference(DateTime.now());
+    if (remaining.isNegative) return 'Usage updates shortly';
+    if (remaining.inHours > 0) {
+      return 'Next usage drop in ${remaining.inHours}h ${remaining.inMinutes.remainder(60)}m';
+    }
+    return 'Next usage drop in ${remaining.inMinutes + 1}m';
+  }
+
+  Widget _buildWindow({
+    required String label,
+    required int usageAmount,
+    required int? limit,
+    required int remaining,
+    required bool reached,
+    required DateTime? nextDecreaseAt,
+  }) {
+    if (limit == null || limit <= 0) return const SizedBox.shrink();
+    final progress = (usageAmount / limit).clamp(0.0, 1.0);
+    final color = reached
+        ? _danger
+        : progress >= 0.8
+        ? _warning
+        : _accent;
+    final nextDrop = _nextDropLabel(nextDecreaseAt);
+    return Column(
+      crossAxisAlignment: CrossAxisAlignment.start,
+      children: <Widget>[
+        Row(
+          children: <Widget>[
+            Text(label, style: const TextStyle(fontWeight: FontWeight.w600)),
+            const Spacer(),
+            Text(
+              reached ? 'Limit reached' : '${_formatTokens(remaining)} left',
+              style: TextStyle(
+                color: color,
+                fontSize: 12,
+                fontWeight: FontWeight.w600,
+              ),
+            ),
+          ],
+        ),
+        const SizedBox(height: 8),
+        ClipRRect(
+          borderRadius: BorderRadius.circular(999),
+          child: LinearProgressIndicator(
+            minHeight: 7,
+            value: progress,
+            backgroundColor: _border,
+            valueColor: AlwaysStoppedAnimation<Color>(color),
+          ),
+        ),
+        const SizedBox(height: 6),
+        Text(
+          '${_formatTokens(usageAmount)} / ${_formatTokens(limit)} tokens'
+          '${nextDrop == null ? '' : ' · $nextDrop'}',
+          style: TextStyle(color: _textMuted, fontSize: 11),
+        ),
+      ],
+    );
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    final windows = <Widget>[
+      _buildWindow(
+        label: '4-hour usage',
+        usageAmount: usage.fourHourUsage,
+        limit: usage.fourHourLimit,
+        remaining: usage.fourHourRemaining,
+        reached: usage.fourHourReached,
+        nextDecreaseAt: usage.fourHourNextDecreaseAt,
+      ),
+      _buildWindow(
+        label: '7-day usage',
+        usageAmount: usage.weeklyUsage,
+        limit: usage.weeklyLimit,
+        remaining: usage.weeklyRemaining,
+        reached: usage.weeklyReached,
+        nextDecreaseAt: usage.weeklyNextDecreaseAt,
+      ),
+    ];
+    return Container(
+      width: double.infinity,
+      padding: const EdgeInsets.all(14),
+      decoration: BoxDecoration(
+        color: usage.isReached ? _danger.withValues(alpha: 0.08) : _bgSecondary,
+        borderRadius: BorderRadius.circular(16),
+        border: Border.all(
+          color: usage.isReached
+              ? _danger.withValues(alpha: 0.55)
+              : _borderLight,
+        ),
+      ),
+      child: LayoutBuilder(
+        builder: (context, constraints) {
+          if (constraints.maxWidth < 620) {
+            return Column(
+              children: <Widget>[
+                windows.first,
+                const SizedBox(height: 14),
+                windows.last,
+              ],
+            );
+          }
+          return Row(
+            crossAxisAlignment: CrossAxisAlignment.start,
+            children: <Widget>[
+              Expanded(child: windows.first),
+              const SizedBox(width: 24),
+              Expanded(child: windows.last),
+            ],
+          );
+        },
+      ),
+    );
+  }
+}
+
 double _chatSidePadding(BuildContext context) {
   final width = MediaQuery.sizeOf(context).width;
   if (width >= 1280) return 40;

package/flutter_app/lib/main_controller.dart

@@ -2033,6 +2033,11 @@ class NeoAgentController extends ChangeNotifier {
         _backendClient.fetchTokenUsageSummary(backendUrl, agentId: agentId),
         const <String, dynamic>{},
       );
+      final rateLimitFuture = _softRefreshLoad<Map<String, dynamic>>(
+        'rate_limits',
+        _backendClient.fetchAccountUsage(backendUrl),
+        const <String, dynamic>{},
+      );
       final updateFuture = _backendClient
           .fetchUpdateStatus(backendUrl)
           .catchError((_) => const <String, dynamic>{});
@@ -2142,6 +2147,7 @@ class NeoAgentController extends ChangeNotifier {
       final runsResponse = await runsFuture;
       final versionResponse = await versionFuture;
       final tokenResponse = await tokenFuture;
+      final rateLimitResponse = await rateLimitFuture;
       final updateResponse = await updateFuture;
       final messagingResponse = await messagingFuture;
       final messagingMessagesResponse = await messagingMessagesFuture;
@@ -2193,6 +2199,7 @@ class NeoAgentController extends ChangeNotifier {
       versionInfo = versionResponse;
       backendHealthStatus = healthResponse;
       tokenUsage = TokenUsageSnapshot.fromJson(tokenResponse);
+      usageAndLimits = AccountUsageAndLimits.fromJson(rateLimitResponse);
       updateStatus = UpdateStatusSnapshot.fromJson(updateResponse);
       messagingStatuses = messagingResponse.map(
         (key, value) => MapEntry(
@@ -4640,20 +4647,24 @@ class NeoAgentController extends ChangeNotifier {
       }
       activeRun = null;
       await refreshRunsOnly();
+      await refreshRateLimitUsage();
     } catch (error) {
+      final friendlyError = _friendlyErrorMessage(error);
       chatMessages = <ChatEntry>[
         ...chatMessages,
         ChatEntry(
           id: '',
           role: 'assistant',
-          content:
-              'I could not complete that request right now. Please try again in a moment.',
+          content: friendlyError,
           platform: 'flutter',
           createdAt: DateTime.now(),
         ),
       ];
       activeRun = null;
-      errorMessage = _friendlyErrorMessage(error);
+      errorMessage = friendlyError;
+      if (error is BackendException && error.statusCode == 429) {
+        await refreshRateLimitUsage();
+      }
     } finally {
       if (_socket == null || !socketConnected) {
         isSendingMessage = false;
@@ -4786,6 +4797,16 @@ class NeoAgentController extends ChangeNotifier {
     }
   }
 
+  Future<void> refreshRateLimitUsage() async {
+    if (!isAuthenticated) return;
+    try {
+      usageAndLimits = AccountUsageAndLimits.fromJson(
+        await _backendClient.fetchAccountUsage(backendUrl),
+      );
+      notifyListeners();
+    } catch (_) {}
+  }
+
   Future<bool> updateAccountEmail({
     required String email,
     required String currentPassword,
@@ -7292,11 +7313,13 @@ class NeoAgentController extends ChangeNotifier {
       final payload = _jsonMap(data);
       final runId = payload['runId']?.toString() ?? '';
       if (_voiceRunIds.remove(runId)) {
+        unawaited(refreshRateLimitUsage());
         return;
       }
       if (_backgroundRunIds.remove(runId)) {
         unawaited(refreshRunsOnly());
         unawaited(refreshMemory());
+        unawaited(refreshRateLimitUsage());
         notifyListeners();
         return;
       }
@@ -7320,6 +7343,7 @@ class NeoAgentController extends ChangeNotifier {
         );
       }
       unawaited(refreshRunsOnly());
+      unawaited(refreshRateLimitUsage());
       notifyListeners();
     });
     socket.on('run:stopped', (dynamic data) {
@@ -7370,8 +7394,18 @@ class NeoAgentController extends ChangeNotifier {
       streamingAssistant = '';
       activeRun = null;
       isSendingMessage = false;
-      errorMessage =
+      final message =
+          payload['error']?.toString().trim() ??
           'I could not complete that request right now. Please try again in a moment.';
+      errorMessage = _friendlyErrorMessage(
+        BackendException(
+          message,
+          statusCode: payload['code'] == 'RATE_LIMIT_EXCEEDED' ? 429 : null,
+        ),
+      );
+      if (payload['code'] == 'RATE_LIMIT_EXCEEDED') {
+        unawaited(refreshRateLimitUsage());
+      }
       notifyListeners();
     });
     socket.on('tasks:task_complete', (dynamic _) {

package/flutter_app/lib/main_devices.dart

@@ -1734,6 +1734,14 @@ class _InteractiveSurfacePreviewState
   Widget build(BuildContext context) {
     final path = widget.screenshotPath;
     final hasImage = path != null && path.isNotEmpty;
+    final viewportHeight = MediaQuery.sizeOf(context).height;
+    final surfaceHeightCap = widget.surface == _DeviceSurface.android
+        ? 640.0
+        : 560.0;
+    final previewMaxHeight = math.min(
+      surfaceHeightCap,
+      viewportHeight * 0.48,
+    );
     final aspectRatio = switch (widget.surface) {
       _DeviceSurface.browser => 16 / 10,
       _DeviceSurface.android => 10 / 16,
@@ -1755,9 +1763,7 @@ class _InteractiveSurfacePreviewState
       child: Column(
         children: <Widget>[
           ConstrainedBox(
-            constraints: BoxConstraints(
-              maxHeight: widget.surface == _DeviceSurface.android ? 640 : 560,
-            ),
+            constraints: BoxConstraints(maxHeight: previewMaxHeight),
             child: AspectRatio(
               aspectRatio: aspectRatio,
               child: ClipRRect(

package/flutter_app/lib/main_models.dart

@@ -4111,6 +4111,12 @@ class AccountUsageAndLimits {
     this.weeklyLimit,
     this.fourHourUsage = 0,
     this.weeklyUsage = 0,
+    this.fourHourRemaining = 0,
+    this.weeklyRemaining = 0,
+    this.fourHourReached = false,
+    this.weeklyReached = false,
+    this.fourHourNextDecreaseAt,
+    this.weeklyNextDecreaseAt,
     this.fourHourIsCustom = false,
     this.weeklyIsCustom = false,
   });
@@ -4118,11 +4124,28 @@ class AccountUsageAndLimits {
   factory AccountUsageAndLimits.fromJson(Map<String, dynamic> json) {
     final limits = json['limits'] is Map ? json['limits'] as Map : const {};
     final usage = json['usage'] is Map ? json['usage'] as Map : const {};
+    final remaining = json['remaining'] is Map
+        ? json['remaining'] as Map
+        : const {};
+    final reached = json['reached'] is Map ? json['reached'] as Map : const {};
+    final nextDecreaseAt = json['nextDecreaseAt'] is Map
+        ? json['nextDecreaseAt'] as Map
+        : const {};
     return AccountUsageAndLimits(
       fourHourLimit: int.tryParse(limits['fourHour']?.toString() ?? ''),
       weeklyLimit: int.tryParse(limits['weekly']?.toString() ?? ''),
       fourHourUsage: _asInt(usage['fourHour']),
       weeklyUsage: _asInt(usage['weekly']),
+      fourHourRemaining: _asInt(remaining['fourHour']),
+      weeklyRemaining: _asInt(remaining['weekly']),
+      fourHourReached: reached['fourHour'] == true,
+      weeklyReached: reached['weekly'] == true,
+      fourHourNextDecreaseAt: DateTime.tryParse(
+        nextDecreaseAt['fourHour']?.toString() ?? '',
+      ),
+      weeklyNextDecreaseAt: DateTime.tryParse(
+        nextDecreaseAt['weekly']?.toString() ?? '',
+      ),
       fourHourIsCustom: limits['fourHourIsCustom'] == true,
       weeklyIsCustom: limits['weeklyIsCustom'] == true,
     );
@@ -4132,6 +4155,15 @@ class AccountUsageAndLimits {
   final int? weeklyLimit;
   final int fourHourUsage;
   final int weeklyUsage;
+  final int fourHourRemaining;
+  final int weeklyRemaining;
+  final bool fourHourReached;
+  final bool weeklyReached;
+  final DateTime? fourHourNextDecreaseAt;
+  final DateTime? weeklyNextDecreaseAt;
   final bool fourHourIsCustom;
   final bool weeklyIsCustom;
+
+  bool get hasLimits => fourHourLimit != null || weeklyLimit != null;
+  bool get isReached => fourHourReached || weeklyReached;
 }

package/flutter_app/lib/main_settings.dart

@@ -1513,42 +1513,37 @@ class _SettingsPanelState extends State<SettingsPanel> {
 
   Widget _buildSecuritySection(BuildContext context, NeoAgentController controller) {
     return Card(
-      elevation: 0,
-      shape: RoundedRectangleBorder(
-        borderRadius: BorderRadius.circular(12),
-        side: BorderSide(color: Theme.of(context).colorScheme.outlineVariant),
-      ),
-      child: Column(
-        crossAxisAlignment: CrossAxisAlignment.start,
-        children: <Widget>[
-          ListTile(
-            leading: const Icon(Icons.shield_outlined),
-            title: const Text('Security', style: TextStyle(fontWeight: FontWeight.bold)),
-            subtitle: const Text('Tool allowlists, approval gates, and process isolation.'),
-            trailing: const SizedBox.shrink(),
-          ),
-          const Divider(height: 1),
-          ListTile(
-            leading: const Icon(Icons.checklist_outlined),
-            title: const Text('Tool Permissions'),
-            subtitle: const Text('Set block / ask / allow per tool category, or pick a global mode.'),
-            trailing: Row(
-              mainAxisSize: MainAxisSize.min,
-              children: const <Widget>[
-                Icon(Icons.shield_rounded, size: 16, color: Colors.green),
-                SizedBox(width: 4),
-                Icon(Icons.chevron_right),
-              ],
+      child: Padding(
+        padding: const EdgeInsets.all(20),
+        child: Column(
+          crossAxisAlignment: CrossAxisAlignment.start,
+          children: <Widget>[
+            const _SectionTitle('Security'),
+            const SizedBox(height: 10),
+            Text(
+              'Per-tool permission policies, approval gates, and process isolation for shell execution.',
+              style: TextStyle(color: _textSecondary, height: 1.45),
             ),
-            onTap: () {
-              Navigator.of(context).push(
-                MaterialPageRoute<void>(
-                  builder: (_) => MainSecurity(controller: controller),
-                ),
-              );
-            },
-          ),
-        ],
+            const SizedBox(height: 8),
+            ListTile(
+              contentPadding: EdgeInsets.zero,
+              leading: Icon(Icons.checklist_outlined, color: _accentAlt),
+              title: const Text('Tool Permissions'),
+              subtitle: Text(
+                'Set block / ask / allow per tool category, or pick a global mode.',
+                style: TextStyle(color: _textSecondary),
+              ),
+              trailing: const Icon(Icons.chevron_right),
+              onTap: () {
+                Navigator.of(context).push(
+                  MaterialPageRoute<void>(
+                    builder: (_) => MainSecurity(controller: controller),
+                  ),
+                );
+              },
+            ),
+          ],
+        ),
       ),
     );
   }