neoagent 2.5.2-beta.9 → 3.0.1-beta.0

package/server/services/security/approval_gate_service.js

@@ -5,28 +5,120 @@ const db = require('../../db/database');
 const { getCategoryForTool } = require('./tool_categories');
 
 const APPROVAL_TIMEOUT_MS = 30_000;
+const SESSION_GRANT_TTL_MS = 12 * 60 * 60 * 1000;
 
 class ApprovalGateService {
   constructor({ io }) {
     this._io = io;
-    /** @type {Map<string, { resolve: Function, timer: NodeJS.Timeout }>} */
+    /** @type {Map<string, { resolve: Function, timer: NodeJS.Timeout, userId: number|string, runId: string|null, toolName: string, toolArgs: object }>} */
     this._pending = new Map();
     /** @type {Set<string>} key = `${userId}:${runId}:${toolName}` */
     this._sessionGrants = new Set();
+    this._loadSessionGrants();
   }
 
   hasSessionGrant(userId, runId, toolName) {
     return this._sessionGrants.has(`${userId}:${runId}:${toolName}`);
   }
 
+  _grantKey(userId, runId, toolName) {
+    return `${userId}:${runId}:${toolName}`;
+  }
+
+  _loadSessionGrants() {
+    try {
+      db.prepare(
+        `DELETE FROM approval_session_grants
+         WHERE expires_at <= datetime('now')`
+      ).run();
+      const rows = db.prepare(
+        `SELECT user_id, run_id, tool_name
+         FROM approval_session_grants
+         WHERE expires_at > datetime('now')`
+      ).all();
+      for (const row of rows) {
+        this._sessionGrants.add(this._grantKey(row.user_id, row.run_id, row.tool_name));
+      }
+    } catch (err) {
+      console.warn('[ApprovalGate] Failed to load session grants:', err.message);
+    }
+  }
+
+  _persistSessionGrant(userId, runId, toolName) {
+    const expiresAt = new Date(Date.now() + SESSION_GRANT_TTL_MS).toISOString();
+    db.prepare(
+      `INSERT INTO approval_session_grants (
+         user_id, run_id, tool_name, expires_at, updated_at
+       ) VALUES (?, ?, ?, ?, datetime('now'))
+       ON CONFLICT(user_id, run_id, tool_name) DO UPDATE SET
+         expires_at = excluded.expires_at,
+         updated_at = excluded.updated_at`
+    ).run(userId, runId, toolName, expiresAt);
+  }
+
+  _persistPendingApproval(approvalId, userId, runId, toolName, toolArgs, category, expiresAt) {
+    db.prepare(
+      `INSERT INTO pending_approvals (
+         id, user_id, run_id, tool_name, tool_args_json, category, status, expires_at, updated_at
+       ) VALUES (?, ?, ?, ?, ?, ?, 'pending', ?, datetime('now'))`
+    ).run(
+      approvalId,
+      userId,
+      runId,
+      toolName,
+      JSON.stringify(toolArgs ?? {}),
+      category,
+      expiresAt,
+    );
+  }
+
+  _updatePendingApprovalStatus(approvalId, status, scope = null) {
+    db.prepare(
+      `UPDATE pending_approvals
+       SET status = ?,
+           scope = COALESCE(?, scope),
+           decided_at = CASE WHEN ? = 'pending' THEN decided_at ELSE COALESCE(decided_at, datetime('now')) END,
+           updated_at = datetime('now')
+       WHERE id = ?`
+    ).run(status, scope, status, approvalId);
+  }
+
+  getStoredApproval(approvalId, userId) {
+    try {
+      return db.prepare(
+        `SELECT id, run_id, tool_name, status, scope, expires_at, decided_at
+         FROM pending_approvals
+         WHERE id = ? AND user_id = ?`
+      ).get(approvalId, userId);
+    } catch {
+      return null;
+    }
+  }
+
+  shutdown(reason = 'Approval expired because the server restarted.') {
+    for (const [approvalId, entry] of this._pending.entries()) {
+      clearTimeout(entry.timer);
+      this._pending.delete(approvalId);
+      this._updatePendingApprovalStatus(approvalId, 'expired', 'once');
+      this._io.to(`user:${entry.userId}`).emit('tool:approval_resolved', {
+        approvalId,
+        decision: 'expired',
+        reason,
+      });
+      this._logDecision(entry.userId, entry.runId, entry.toolName, entry.toolArgs, 'timeout', 'once');
+      entry.resolve('expired');
+    }
+  }
+
   /**
    * Emits tool:approval_required and waits for a decision.
-   * Resolves to 'approved', 'denied', or 'timeout'.
+   * Resolves to 'approved', 'denied', 'timeout', or 'expired'.
    */
   requestApproval(userId, runId, toolName, toolArgs) {
     const approvalId = randomUUID();
     const expiresAt = new Date(Date.now() + APPROVAL_TIMEOUT_MS).toISOString();
     const category = getCategoryForTool(toolName, toolArgs) ?? 'unknown';
+    this._persistPendingApproval(approvalId, userId, runId, toolName, toolArgs, category, expiresAt);
 
     const payload = { approvalId, runId, toolName, toolArgs, category, expiresAt };
     this._io.to(`user:${userId}`).emit('tool:approval_required', payload);
@@ -35,6 +127,7 @@ class ApprovalGateService {
       const timer = setTimeout(() => {
         if (this._pending.has(approvalId)) {
           this._pending.delete(approvalId);
+          this._updatePendingApprovalStatus(approvalId, 'timeout', 'once');
           this._io.to(`user:${userId}`).emit('tool:approval_resolved', {
             approvalId, decision: 'timeout',
           });
@@ -43,7 +136,14 @@ class ApprovalGateService {
         }
       }, APPROVAL_TIMEOUT_MS);
 
-      this._pending.set(approvalId, { resolve, timer });
+      this._pending.set(approvalId, {
+        resolve,
+        timer,
+        userId,
+        runId,
+        toolName,
+        toolArgs: toolArgs ?? {},
+      });
     });
   }
 
@@ -63,14 +163,17 @@ class ApprovalGateService {
     const normalizedScope = ['once', 'session', 'always'].includes(scope) ? scope : 'once';
 
     if (normalizedDecision === 'approved' && normalizedScope === 'session') {
-      this._sessionGrants.add(`${userId}:${runId}:${toolName}`);
+      this._sessionGrants.add(this._grantKey(userId, runId, toolName));
+      this._persistSessionGrant(userId, runId, toolName);
     }
     // 'always' scope is handled by the route (sets policy to 'allow') and
     // also acts as a session grant for the current run.
     if (normalizedDecision === 'approved' && normalizedScope === 'always') {
-      this._sessionGrants.add(`${userId}:${runId}:${toolName}`);
+      this._sessionGrants.add(this._grantKey(userId, runId, toolName));
+      this._persistSessionGrant(userId, runId, toolName);
     }
 
+    this._updatePendingApprovalStatus(approvalId, normalizedDecision, normalizedScope);
     const logScope = normalizedScope === 'always' ? 'session' : normalizedScope;
     this._logDecision(userId, runId, toolName, toolArgs, normalizedDecision, logScope);
     this._io.to(`user:${userId}`).emit('tool:approval_resolved', { approvalId, decision: normalizedDecision });

package/server/services/security/tool_categories.js

@@ -27,6 +27,7 @@ const TOOL_CATEGORIES = {
     'update_ai_widget',
     'delete_ai_widget',
   ],
+  external: [],
 };
 
 // Tools that bypass all policy checks — read-only or always safe
@@ -71,6 +72,98 @@ const SAFE_TOOLS = new Set([
   'recordings_get',
 ]);
 
+const BUILT_IN_TOOLS = new Set([
+  'execute_command',
+  'browser_navigate',
+  'browser_click',
+  'browser_type',
+  'browser_extract',
+  'browser_screenshot',
+  'browser_evaluate',
+  'desktop_list_devices',
+  'desktop_select_device',
+  'desktop_observe',
+  'desktop_click',
+  'desktop_drag',
+  'desktop_scroll',
+  'desktop_type',
+  'desktop_press_key',
+  'desktop_launch_app',
+  'desktop_get_tree',
+  'android_start_emulator',
+  'android_stop_emulator',
+  'android_list_devices',
+  'android_open_app',
+  'android_open_intent',
+  'android_tap',
+  'android_long_press',
+  'android_type',
+  'android_swipe',
+  'android_press_key',
+  'android_wait_for',
+  'android_observe',
+  'android_dump_ui',
+  'android_screenshot',
+  'android_list_apps',
+  'android_install_apk',
+  'android_shell',
+  'web_search',
+  'memory_save',
+  'memory_recall',
+  'session_search',
+  'memory_update_core',
+  'memory_write',
+  'memory_read',
+  'make_call',
+  'send_message',
+  'read_file',
+  'read_files',
+  'write_file',
+  'edit_file',
+  'replace_file_range',
+  'list_directory',
+  'search_files',
+  'code_navigate',
+  'query_structured_data',
+  'http_request',
+  'create_skill',
+  'list_skills',
+  'update_skill',
+  'delete_skill',
+  'think',
+  'activate_tools',
+  'spawn_subagent',
+  'delegate_to_agent',
+  'list_subagents',
+  'wait_subagent',
+  'cancel_subagent',
+  'notify_user',
+  'create_task',
+  'list_tasks',
+  'delete_task',
+  'update_task',
+  'create_ai_widget',
+  'list_ai_widgets',
+  'update_ai_widget',
+  'delete_ai_widget',
+  'mcp_add_server',
+  'mcp_list_servers',
+  'mcp_remove_server',
+  'generate_image',
+  'generate_table',
+  'generate_graph',
+  'analyze_image',
+  'ocr_extract',
+  'read_health_data',
+  'recordings_list',
+  'recordings_get',
+  'recordings_search',
+  'social_video_extract',
+  'task_complete',
+  'send_interim_update',
+  'save_widget_snapshot',
+]);
+
 // category → policy for users with no DB row yet
 const DEFAULT_POLICY = {
   shell: 'require_approval',
@@ -80,6 +173,7 @@ const DEFAULT_POLICY = {
   browser_privileged: 'require_approval',
   network_write: 'require_approval',
   skill_mutation: 'deny',
+  external: 'require_approval',
 };
 
 // Reverse map: tool → category, built once
@@ -91,15 +185,30 @@ for (const [category, tools] of Object.entries(TOOL_CATEGORIES)) {
 }
 
 /**
- * Returns the category for a tool, or null if the tool is uncategorised (safe).
- * For http_request, write methods map to network_write; read methods return null.
+ * Returns the category for a tool.
+ * - Known built-in tools may return null when they are read-only or otherwise
+ *   intentionally left uncategorized.
+ * - Unknown tool names are treated as external capabilities and must never
+ *   silently bypass policy checks.
  */
 function getCategoryForTool(toolName, toolArgs = {}) {
   if (toolName === 'http_request') {
     const method = (toolArgs.method || 'GET').toUpperCase();
     return ['GET', 'HEAD', 'OPTIONS'].includes(method) ? null : 'network_write';
   }
-  return _toolToCategory[toolName] ?? null;
+  if (_toolToCategory[toolName]) {
+    return _toolToCategory[toolName];
+  }
+  if (BUILT_IN_TOOLS.has(toolName) || SAFE_TOOLS.has(toolName)) {
+    return null;
+  }
+  return 'external';
 }
 
-module.exports = { TOOL_CATEGORIES, SAFE_TOOLS, DEFAULT_POLICY, getCategoryForTool };
+module.exports = {
+  TOOL_CATEGORIES,
+  SAFE_TOOLS,
+  DEFAULT_POLICY,
+  BUILT_IN_TOOLS,
+  getCategoryForTool,
+};

package/server/services/security/tool_security_hook.js

@@ -63,10 +63,15 @@ function registerToolSecurityHooks(toolPolicyService, approvalGateService) {
     if (decision === 'approved') return;
 
     const isTimeout = decision === 'timeout';
+    const isExpired = decision === 'expired';
     return {
       block: true,
-      blocked_by: isTimeout ? 'approval_timeout' : 'user_denied',
-      reason: isTimeout
+      blocked_by: isExpired
+        ? 'approval_expired'
+        : (isTimeout ? 'approval_timeout' : 'user_denied'),
+      reason: isExpired
+        ? `Approval for "${toolName}" expired because the server restarted or the run was interrupted. Do not retry unless the user explicitly asks you to try again.`
+        : isTimeout
         ? `Approval for "${toolName}" timed out — the user did not respond within 30 seconds. ` +
           `Do not retry unless the user explicitly asks you to try again.`
         : `The user denied the use of "${toolName}". Do not retry this tool call in this run.`,

package/server/services/skills/runtime.js

@@ -21,6 +21,8 @@ function serializeInstalledSkill(skill) {
     autoCreated: skill.metadata?.auto_created === true,
     filePath: skill.filePath,
     storeId: skill.metadata?.store_id || '',
+    readOnly: skill.readOnly === true,
+    ownerType: skill.ownerType || 'global',
   };
 }
 

package/server/services/workspace/manager.js

@@ -294,6 +294,61 @@ class WorkspaceManager {
     }
   }
 
+  replaceFileRange(userId, options = {}) {
+    let filePath;
+    try {
+      filePath = this.resolvePath(userId, options.path || '', 'path');
+      if (!fs.existsSync(filePath)) {
+        return { success: false, error: `File not found: ${filePath}`, path: filePath };
+      }
+
+      const start = Number(options.start_line ?? options.startLine);
+      const end = Number(options.end_line ?? options.endLine ?? start);
+      if (!Number.isInteger(start) || start < 1) {
+        return { success: false, error: 'start_line must be a positive integer', path: filePath };
+      }
+      if (!Number.isInteger(end) || end < 1) {
+        return { success: false, error: 'end_line must be a positive integer', path: filePath };
+      }
+      if (start > end) {
+        return { success: false, error: 'start_line must be less than or equal to end_line', path: filePath };
+      }
+
+      const original = fs.readFileSync(filePath, 'utf8').replace(/\r\n/g, '\n');
+      const hadFinalNewline = original.endsWith('\n');
+      const lines = original.split('\n');
+      if (hadFinalNewline) lines.pop();
+      const totalLines = Math.max(lines.length, 1);
+      if (start > totalLines || end > totalLines) {
+        return {
+          success: false,
+          error: `line range ${start}-${end} is outside file with ${totalLines} lines`,
+          path: filePath,
+          totalLines,
+        };
+      }
+
+      const replacementText = String(options.content ?? '').replace(/\r\n/g, '\n');
+      const replacementLines = replacementText === ''
+        ? []
+        : replacementText.replace(/\n$/, '').split('\n');
+      lines.splice(start - 1, end - start + 1, ...replacementLines);
+      const next = `${lines.join('\n')}${hadFinalNewline ? '\n' : ''}`;
+      fs.writeFileSync(filePath, next, 'utf8');
+      return {
+        success: true,
+        path: filePath,
+        startLine: start,
+        endLine: end,
+        replacedLines: end - start + 1,
+        insertedLines: replacementLines.length,
+        totalLines: lines.length,
+      };
+    } catch (err) {
+      return { success: false, path: filePath || null, error: err.message };
+    }
+  }
+
   listDirectory(userId, options = {}) {
     const dirPath = this.resolvePath(userId, options.path || '.', 'path');
     const depthValue = options.depth != null ? Number(options.depth) : (options.recursive ? 3 : 1);
@@ -414,4 +469,5 @@ class WorkspaceManager {
 
 module.exports = {
   WorkspaceManager,
+  sanitizeWorkspaceKey,
 };