neoagent 2.4.4-beta.8 → 2.5.0

package/server/routes/account.js

@@ -38,6 +38,7 @@ const {
   approveChallenge,
   resolveChallengeForApproval,
 } = require('../services/account/qr_login');
+const { getRateLimitSnapshot } = require('../services/ai/rate_limits');
 
 const accountLimiter = rateLimit({
   windowMs: 15 * 60 * 1000,
@@ -112,29 +113,7 @@ router.get('/', (req, res) => {
 
 router.get('/usage', (req, res) => {
   try {
-    const userId = req.session.userId;
-    const userLimits = db.prepare('SELECT rate_limit_4h, rate_limit_weekly FROM users WHERE id = ?').get(userId);
-    const h4Tokens = db.prepare("SELECT COALESCE(SUM(total_tokens), 0) as t FROM agent_runs WHERE user_id = ? AND created_at > datetime('now', '-4 hours')").get(userId).t;
-    const weeklyTokens = db.prepare("SELECT COALESCE(SUM(total_tokens), 0) as t FROM agent_runs WHERE user_id = ? AND created_at > datetime('now', '-7 days')").get(userId).t;
-
-    const globalLimit4h = process.env.NEOAGENT_RATE_LIMIT_4H ? parseInt(process.env.NEOAGENT_RATE_LIMIT_4H, 10) : null;
-    const globalLimitWeekly = process.env.NEOAGENT_RATE_LIMIT_WEEKLY ? parseInt(process.env.NEOAGENT_RATE_LIMIT_WEEKLY, 10) : null;
-
-    const custom4h = userLimits?.rate_limit_4h ?? null;
-    const customWeekly = userLimits?.rate_limit_weekly ?? null;
-
-    res.json({
-      limits: {
-        fourHour: custom4h ?? globalLimit4h,
-        weekly: customWeekly ?? globalLimitWeekly,
-        fourHourIsCustom: custom4h !== null,
-        weeklyIsCustom: customWeekly !== null,
-      },
-      usage: {
-        fourHour: h4Tokens,
-        weekly: weeklyTokens,
-      }
-    });
+    res.json(getRateLimitSnapshot(req.session.userId));
   } catch (err) {
     sendRouteError(res, err);
   }

package/server/routes/admin.js

@@ -18,6 +18,7 @@ const {
 const { APP_DIR, ENV_FILE, upsertEnvValue } = require('../../runtime/paths');
 const { isManagedDeployment } = require('../utils/deployment');
 const rateLimit = require('express-rate-limit');
+const { configuredDefaultLimits } = require('../services/ai/rate_limits');
 
 const router = express.Router();
 const ADMIN_DIR = path.join(__dirname, '..', 'admin');
@@ -324,6 +325,20 @@ const sqlLimiter = rateLimit({
   message: { error: 'Too many SQL queries, slow down' },
 });
 
+router.get('/api/config/email', requireAdminAuth, (req, res) => {
+  const { getAdminEmailSettings } = require('../services/account/service_email_settings');
+  res.json(getAdminEmailSettings());
+});
+
+router.put('/api/config/email', requireAdminAuth, settingsLimiter, express.json(), (req, res) => {
+  try {
+    const { updateAdminEmailSettings } = require('../services/account/service_email_settings');
+    res.json({ ok: true, ...updateAdminEmailSettings(req.body) });
+  } catch (err) {
+    res.status(err.statusCode || 500).json({ error: err.message });
+  }
+});
+
 // --- Access settings (signup toggle + API key) ---
 
 router.get('/api/settings', requireAdminAuth, (req, res) => {
@@ -670,9 +685,10 @@ router.put('/api/providers', requireAdminAuth, express.json(), (req, res) => {
 // --- Global default rate limits ---
 
 router.get('/api/config/rate-limits', requireAdminAuth, (req, res) => {
+  const defaults = configuredDefaultLimits();
   res.json({
-    rate_limit_4h: process.env.NEOAGENT_RATE_LIMIT_4H ? parseInt(process.env.NEOAGENT_RATE_LIMIT_4H, 10) : null,
-    rate_limit_weekly: process.env.NEOAGENT_RATE_LIMIT_WEEKLY ? parseInt(process.env.NEOAGENT_RATE_LIMIT_WEEKLY, 10) : null,
+    rate_limit_4h: defaults.fourHour,
+    rate_limit_weekly: defaults.weekly,
   });
 });
 

package/server/routes/agents.js

@@ -130,7 +130,11 @@ router.post('/', async (req, res) => {
 
     res.json(result);
   } catch (err) {
-    res.status(500).json({ error: sanitizeError(err) });
+    res.status(err?.statusCode || err?.status || 500).json({
+      error: sanitizeError(err),
+      code: err?.code,
+      rateLimit: err?.rateLimit,
+    });
   }
 });
 

package/server/routes/memory.js

@@ -494,7 +494,7 @@ router.post('/transfer-import', transferImportLimiter, async (req, res) => {
     if (applyCoreMemory && parsed.coreEntries) {
       for (const [key, value] of Object.entries(parsed.coreEntries)) {
         if (!key || key === 'active_context') continue;
-        mm.updateCore(userId, key, value, { agentId, confirmed: true });
+        mm.updateCore(userId, key, value, { agentId });
         coreUpdatedCount += 1;
       }
     }
@@ -526,7 +526,7 @@ router.put('/core/:key', (req, res) => {
   if (req.params.key === 'active_context') {
     return res.status(400).json({ error: 'active_context is no longer a supported core memory key' });
   }
-  mm.updateCore(userId, req.params.key, value, { agentId, confirmed: true });
+  mm.updateCore(userId, req.params.key, value, { agentId });
   res.json({ success: true });
 });
 

package/server/services/account/service_email_settings.js

@@ -0,0 +1,167 @@
+'use strict';
+
+const { ENV_FILE, upsertEnvValue } = require('../../../runtime/paths');
+
+const STRING_FIELDS = Object.freeze({
+  from: 'NEOAGENT_EMAIL_FROM',
+  smtpHost: 'NEOAGENT_EMAIL_SMTP_HOST',
+  smtpUser: 'NEOAGENT_EMAIL_SMTP_USER',
+  replyTo: 'NEOAGENT_EMAIL_REPLY_TO',
+  brandName: 'NEOAGENT_EMAIL_BRAND_NAME',
+  supportUrl: 'NEOAGENT_EMAIL_SUPPORT_URL',
+  publicUrl: 'NEOAGENT_EMAIL_PUBLIC_URL',
+});
+
+const BOOLEAN_FIELDS = Object.freeze({
+  smtpSecure: ['NEOAGENT_EMAIL_SMTP_SECURE', false],
+  smtpRequireTls: ['NEOAGENT_EMAIL_SMTP_REQUIRE_TLS', true],
+  smtpRejectUnauthorized: ['NEOAGENT_EMAIL_SMTP_REJECT_UNAUTHORIZED', true],
+  requireSignupConfirmation: ['NEOAGENT_EMAIL_REQUIRE_SIGNUP_CONFIRMATION', true],
+  requireEmailChangeConfirmation: ['NEOAGENT_EMAIL_REQUIRE_EMAIL_CHANGE_CONFIRMATION', true],
+  notifyUnusualLogin: ['NEOAGENT_EMAIL_NOTIFY_UNUSUAL_LOGIN', true],
+  notifyAccountChanges: ['NEOAGENT_EMAIL_NOTIFY_ACCOUNT_CHANGES', true],
+});
+
+function envString(env, key) {
+  return String(env[key] || '').trim();
+}
+
+function envBoolean(env, key, defaultValue) {
+  const value = envString(env, key).toLowerCase();
+  if (!value) return defaultValue;
+  return ['1', 'true', 'yes', 'on'].includes(value);
+}
+
+function envPositiveInteger(env, key, defaultValue) {
+  const value = Number(envString(env, key));
+  return Number.isInteger(value) && value > 0 ? value : defaultValue;
+}
+
+function cleanSingleLine(value, label) {
+  const cleaned = String(value ?? '').trim();
+  if (/[\r\n]/.test(cleaned)) {
+    const error = new Error(`${label} must be a single line.`);
+    error.statusCode = 400;
+    throw error;
+  }
+  return cleaned;
+}
+
+function requireBoolean(value, label) {
+  if (typeof value !== 'boolean') {
+    const error = new Error(`${label} must be true or false.`);
+    error.statusCode = 400;
+    throw error;
+  }
+  return value;
+}
+
+function requireInteger(value, label, { min, max }) {
+  const number = Number(value);
+  if (!Number.isInteger(number) || number < min || number > max) {
+    const error = new Error(`${label} must be an integer from ${min} to ${max}.`);
+    error.statusCode = 400;
+    throw error;
+  }
+  return number;
+}
+
+function requireHttpUrl(value, label) {
+  const cleaned = cleanSingleLine(value, label);
+  if (!cleaned) return '';
+  try {
+    const url = new URL(cleaned);
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') throw new Error('invalid protocol');
+  } catch {
+    const error = new Error(`${label} must be an HTTP or HTTPS URL.`);
+    error.statusCode = 400;
+    throw error;
+  }
+  return cleaned.replace(/\/$/, '');
+}
+
+function encodeEnvValue(value) {
+  return JSON.stringify(String(value));
+}
+
+function persistValue(envFile, env, key, value) {
+  upsertEnvValue(envFile, key, encodeEnvValue(value));
+  if (value === '') {
+    delete env[key];
+  } else {
+    env[key] = String(value);
+  }
+}
+
+function getAdminEmailSettings({ env = process.env } = {}) {
+  const smtpPort = envPositiveInteger(env, 'NEOAGENT_EMAIL_SMTP_PORT', 587);
+  const settings = {
+    smtpPort,
+    tokenTtlHours: envPositiveInteger(env, 'NEOAGENT_EMAIL_TOKEN_TTL_HOURS', 24),
+    smtpPasswordConfigured: Boolean(envString(env, 'NEOAGENT_EMAIL_SMTP_PASS')),
+  };
+
+  for (const [name, key] of Object.entries(STRING_FIELDS)) {
+    settings[name] = envString(env, key);
+  }
+  for (const [name, [key, defaultValue]] of Object.entries(BOOLEAN_FIELDS)) {
+    let effectiveDefault = defaultValue;
+    if (name === 'smtpSecure') effectiveDefault = smtpPort === 465;
+    if (name === 'smtpRequireTls') effectiveDefault = !settings.smtpSecure;
+    settings[name] = envBoolean(env, key, effectiveDefault);
+  }
+
+  const missing = [];
+  if (!settings.from) missing.push('Sender address');
+  if (!settings.smtpHost) missing.push('SMTP host');
+
+  return {
+    configured: missing.length === 0,
+    missing,
+    settings,
+  };
+}
+
+function updateAdminEmailSettings(body, { env = process.env, envFile = ENV_FILE } = {}) {
+  if (!body || typeof body !== 'object' || Array.isArray(body)) {
+    const error = new Error('Email settings must be an object.');
+    error.statusCode = 400;
+    throw error;
+  }
+
+  const values = {};
+  for (const name of Object.keys(STRING_FIELDS)) {
+    values[name] = name === 'supportUrl' || name === 'publicUrl'
+      ? requireHttpUrl(body[name], name === 'supportUrl' ? 'Support URL' : 'Public URL')
+      : cleanSingleLine(body[name], name);
+  }
+
+  values.smtpPort = requireInteger(body.smtpPort, 'SMTP port', { min: 1, max: 65535 });
+  values.tokenTtlHours = requireInteger(body.tokenTtlHours, 'Token lifetime', { min: 1, max: 8760 });
+
+  for (const name of Object.keys(BOOLEAN_FIELDS)) {
+    values[name] = requireBoolean(body[name], name);
+  }
+
+  const smtpPassword = cleanSingleLine(body.smtpPassword, 'SMTP password');
+  const clearSmtpPassword = body.clearSmtpPassword === true;
+
+  for (const [name, key] of Object.entries(STRING_FIELDS)) {
+    persistValue(envFile, env, key, values[name]);
+  }
+  persistValue(envFile, env, 'NEOAGENT_EMAIL_SMTP_PORT', values.smtpPort);
+  persistValue(envFile, env, 'NEOAGENT_EMAIL_TOKEN_TTL_HOURS', values.tokenTtlHours);
+  for (const [name, [key]] of Object.entries(BOOLEAN_FIELDS)) {
+    persistValue(envFile, env, key, values[name]);
+  }
+  if (smtpPassword || clearSmtpPassword) {
+    persistValue(envFile, env, 'NEOAGENT_EMAIL_SMTP_PASS', clearSmtpPassword ? '' : smtpPassword);
+  }
+
+  return getAdminEmailSettings({ env });
+}
+
+module.exports = {
+  getAdminEmailSettings,
+  updateAdminEmailSettings,
+};

package/server/services/ai/engine.js

@@ -56,6 +56,7 @@ const { globalHooks } = require('./hooks');
 const { withProviderRetry, isTransientError } = require('./providerRetry');
 const { normalizeCompletionConfidence, shouldAcceptTaskComplete } = require('./completion');
 const { normalizeUsage, recordModelUsage } = require('./usage');
+const { enforceRateLimits } = require('./rate_limits');
 const { ToolRepetitionGuard } = require('./repetitionGuard');
 const { shortenRunId, summarizeForLog, parseMaybeJson } = require('./logFormat');
 const {
@@ -1786,23 +1787,7 @@ class AgentEngine {
     ensureDefaultAiSettings(userId, agentId);
     const aiSettings = getAiSettings(userId, agentId);
 
-    const userLimits = db.prepare('SELECT rate_limit_4h, rate_limit_weekly FROM users WHERE id = ?').get(userId);
-    const globalLimit4h = process.env.NEOAGENT_RATE_LIMIT_4H ? parseInt(process.env.NEOAGENT_RATE_LIMIT_4H, 10) : null;
-    const globalLimitWeekly = process.env.NEOAGENT_RATE_LIMIT_WEEKLY ? parseInt(process.env.NEOAGENT_RATE_LIMIT_WEEKLY, 10) : null;
-    const effective4h = userLimits?.rate_limit_4h ?? globalLimit4h;
-    const effectiveWeekly = userLimits?.rate_limit_weekly ?? globalLimitWeekly;
-    if (effective4h) {
-      const h4Tokens = db.prepare("SELECT COALESCE(SUM(total_tokens), 0) as t FROM agent_runs WHERE user_id = ? AND created_at > datetime('now', '-4 hours')").get(userId).t;
-      if (h4Tokens >= effective4h) {
-        throw new Error(`Rate limit exceeded: You have used ${h4Tokens} tokens in the last 4 hours (limit: ${effective4h}).`);
-      }
-    }
-    if (effectiveWeekly) {
-      const weeklyTokens = db.prepare("SELECT COALESCE(SUM(total_tokens), 0) as t FROM agent_runs WHERE user_id = ? AND created_at > datetime('now', '-7 days')").get(userId).t;
-      if (weeklyTokens >= effectiveWeekly) {
-        throw new Error(`Rate limit exceeded: You have used ${weeklyTokens} tokens in the last 7 days (limit: ${effectiveWeekly}).`);
-      }
-    }
+    enforceRateLimits(userId);
 
     const runId = options.runId || uuidv4();
     const conversationId = options.conversationId;

package/server/services/ai/rate_limits.js

@@ -0,0 +1,150 @@
+'use strict';
+
+const db = require('../../db/database');
+
+const DEFAULT_RATE_LIMIT_4H = 2_500_000;
+const DEFAULT_RATE_LIMIT_WEEKLY = 10_000_000;
+
+const WINDOWS = {
+  fourHour: {
+    durationMs: 4 * 60 * 60 * 1000,
+  },
+  weekly: {
+    durationMs: 7 * 24 * 60 * 60 * 1000,
+  },
+};
+
+class RateLimitExceededError extends Error {
+  constructor(windowKey, snapshot) {
+    const label = windowKey === 'fourHour' ? 'the last 4 hours' : 'the last 7 days';
+    const usage = snapshot.usage[windowKey];
+    const limit = snapshot.limits[windowKey];
+    super(`Rate limit exceeded: You have used ${usage} tokens in ${label} (limit: ${limit}).`);
+    this.name = 'RateLimitExceededError';
+    this.statusCode = 429;
+    this.code = 'RATE_LIMIT_EXCEEDED';
+    this.rateLimit = {
+      window: windowKey,
+      ...snapshot,
+    };
+  }
+}
+
+function parsePositiveInteger(value, fallback) {
+  const parsed = Number.parseInt(String(value || ''), 10);
+  return Number.isInteger(parsed) && parsed > 0 ? parsed : fallback;
+}
+
+function configuredDefaultLimits() {
+  return {
+    fourHour: parsePositiveInteger(
+      process.env.NEOAGENT_RATE_LIMIT_4H,
+      DEFAULT_RATE_LIMIT_4H,
+    ),
+    weekly: parsePositiveInteger(
+      process.env.NEOAGENT_RATE_LIMIT_WEEKLY,
+      DEFAULT_RATE_LIMIT_WEEKLY,
+    ),
+  };
+}
+
+function parseSqliteDate(value) {
+  const text = String(value || '').trim();
+  if (!text) return null;
+  const normalized = text.includes('T') ? text : `${text.replace(' ', 'T')}Z`;
+  const date = new Date(normalized);
+  return Number.isNaN(date.getTime()) ? null : date;
+}
+
+function usageRows(userId, durationMs) {
+  const modifier = `-${Math.floor(durationMs / 1000)} seconds`;
+  return db.prepare(
+    `SELECT COALESCE(total_tokens, 0) AS tokens, created_at
+     FROM agent_runs
+     WHERE user_id = ? AND created_at > datetime('now', ?)
+     ORDER BY datetime(created_at) ASC`,
+  ).all(userId, modifier);
+}
+
+function nextDecreaseAt(rows, durationMs, usage, limit) {
+  const positiveRows = rows.filter((row) => Number(row.tokens) > 0);
+  if (positiveRows.length === 0) return null;
+
+  let tokensToExpire = 0;
+  const requiredExpiry = usage >= limit ? usage - limit + 1 : 1;
+  for (const row of positiveRows) {
+    tokensToExpire += Number(row.tokens);
+    if (tokensToExpire < requiredExpiry) continue;
+    const createdAt = parseSqliteDate(row.created_at);
+    return createdAt
+      ? new Date(createdAt.getTime() + durationMs).toISOString()
+      : null;
+  }
+  return null;
+}
+
+function getRateLimitSnapshot(userId) {
+  const userLimits = db.prepare(
+    'SELECT rate_limit_4h, rate_limit_weekly FROM users WHERE id = ?',
+  ).get(userId);
+  const defaults = configuredDefaultLimits();
+  const customFourHour = userLimits?.rate_limit_4h;
+  const customWeekly = userLimits?.rate_limit_weekly;
+  const limits = {
+    fourHour: customFourHour == null
+      ? defaults.fourHour
+      : (customFourHour > 0 ? customFourHour : null),
+    weekly: customWeekly == null
+      ? defaults.weekly
+      : (customWeekly > 0 ? customWeekly : null),
+    fourHourIsCustom: customFourHour != null,
+    weeklyIsCustom: customWeekly != null,
+  };
+  const usage = {};
+  const remaining = {};
+  const reached = {};
+  const nextDecreaseAtByWindow = {};
+
+  for (const [windowKey, config] of Object.entries(WINDOWS)) {
+    const rows = usageRows(userId, config.durationMs);
+    const used = rows.reduce((total, row) => total + Number(row.tokens || 0), 0);
+    const limit = limits[windowKey];
+    usage[windowKey] = used;
+    remaining[windowKey] = limit == null ? null : Math.max(0, limit - used);
+    reached[windowKey] = limit != null && used >= limit;
+    nextDecreaseAtByWindow[windowKey] = limit == null
+      ? null
+      : nextDecreaseAt(rows, config.durationMs, used, limit);
+  }
+
+  return {
+    limits,
+    usage,
+    remaining,
+    reached: {
+      ...reached,
+      any: reached.fourHour || reached.weekly,
+    },
+    nextDecreaseAt: nextDecreaseAtByWindow,
+  };
+}
+
+function enforceRateLimits(userId) {
+  const snapshot = getRateLimitSnapshot(userId);
+  if (snapshot.reached.fourHour) {
+    throw new RateLimitExceededError('fourHour', snapshot);
+  }
+  if (snapshot.reached.weekly) {
+    throw new RateLimitExceededError('weekly', snapshot);
+  }
+  return snapshot;
+}
+
+module.exports = {
+  DEFAULT_RATE_LIMIT_4H,
+  DEFAULT_RATE_LIMIT_WEEKLY,
+  RateLimitExceededError,
+  configuredDefaultLimits,
+  enforceRateLimits,
+  getRateLimitSnapshot,
+};

package/server/services/ai/tools.js

@@ -786,10 +786,9 @@ function getAvailableTools(app, options = {}) {
                 type: 'object',
                 properties: {
                     key: { type: 'string', enum: ['user_profile', 'preferences', 'ai_personality'], description: 'user_profile: who the user is, preferences: standing likes/dislikes, ai_personality: concise durable notes for how the agent should behave for this user' },
-                    value: { type: 'string', description: 'Value to set. Keep it concise — this is injected into every single prompt.' },
-                    confirmed: { type: 'boolean', description: 'Must be true only when the user explicitly requested this core-memory change in the current conversation.' }
+                    value: { type: 'string', description: 'Value to set. Keep it concise — this is injected into every single prompt.' }
                 },
-                required: ['key', 'value', 'confirmed']
+                required: ['key', 'value']
             }
         },
         {
@@ -1895,7 +1894,8 @@ async function executeTool(toolName, args, context, engine) {
         case 'memory_save': {
             const { MemoryManager } = require('../memory/manager');
             const mm = new MemoryManager();
-            const id = await mm.saveMemory(userId, args.content, args.category || 'episodic', args.importance || 5, { agentId });
+            const content = typeof args.content === 'string' ? args.content : args.value;
+            const id = await mm.saveMemory(userId, content, args.category || 'episodic', args.importance || 5, { agentId });
             if (!id) {
                 return {
                     success: true,
@@ -1926,12 +1926,15 @@ async function executeTool(toolName, args, context, engine) {
         }
 
         case 'memory_update_core': {
-            const { MemoryManager } = require('../memory/manager');
+            const { MemoryManager, CORE_KEYS } = require('../memory/manager');
             const mm = new MemoryManager();
-            if (args.confirmed !== true) {
-                return { error: 'Core memory updates require explicit current-session user confirmation.' };
+            if (!CORE_KEYS.includes(args.key)) {
+                return { error: `Core memory key must be one of: ${CORE_KEYS.join(', ')}.` };
+            }
+            if (typeof args.value !== 'string' || !args.value.trim()) {
+                return { error: 'Core memory value must be a non-empty string.' };
             }
-            mm.updateCore(userId, args.key, args.value, { agentId, confirmed: true });
+            mm.updateCore(userId, args.key, args.value, { agentId });
             return { success: true, key: args.key, message: 'Core memory updated' };
         }
 

package/server/services/memory/manager.js

@@ -2233,9 +2233,6 @@ class MemoryManager {
   }
 
   updateCore(userId, key, value, options = {}) {
-    if (options.confirmed !== true) {
-      throw new Error('Core memory updates require explicit confirmation.');
-    }
     const agentId = this._agentId(userId, options);
     const strVal = typeof value === 'object' ? JSON.stringify(value) : String(value);
     db.prepare(

package/server/services/websocket.js

@@ -301,7 +301,11 @@ function setupWebSocket(io, services) {
         }
       } catch (err) {
         console.error(`[WS] agent:run failed for user ${userId}:`, err);
-        socket.emit('run:error', { error: sanitizeError(err) });
+        socket.emit('run:error', {
+          error: sanitizeError(err),
+          code: err?.code,
+          rateLimit: err?.rateLimit,
+        });
       }
     });