neoagent 2.5.2-beta.9 → 3.0.1-beta.0

package/server/routes/security.js

@@ -85,6 +85,25 @@ router.post('/approvals/:approvalId', (req, res) => {
     normalizedScope,
   );
   if (!resolved) {
+    const storedApproval = approvalGateService.getStoredApproval?.(
+      approvalId,
+      req.session.userId,
+    );
+    if (storedApproval?.status === 'expired' || storedApproval?.status === 'timeout') {
+      return res.status(410).json({
+        error: 'Approval expired because the run was interrupted or the server restarted.',
+      });
+    }
+    if (runId) {
+      const run = db.prepare(
+        'SELECT status FROM agent_runs WHERE id = ? AND user_id = ?'
+      ).get(runId, req.session.userId);
+      if (run?.status === 'interrupted') {
+        return res.status(410).json({
+          error: 'Approval expired because the run was interrupted or the server restarted.',
+        });
+      }
+    }
     return res.status(404).json({ error: 'Approval not found or already resolved' });
   }
   res.json({ ok: true, approvalId, decision, scope: normalizedScope });

package/server/routes/settings.js

@@ -40,6 +40,7 @@ const AGENT_SETTING_KEYS = new Set([
   'chat_history_window',
   'tool_replay_budget_chars',
   'subagent_max_iterations',
+  'subagent_max_children_per_run',
   'assistant_behavior_notes',
   'auto_skill_learning',
   'auto_recording_insights',

package/server/routes/skills.js

@@ -56,7 +56,7 @@ function parseSkillDocument(content) {
 router.get('/', async (req, res) => {
   try {
     const runner = await getSkillRunner(req.app);
-    const skills = runner.getAll().map(serializeInstalledSkill);
+    const skills = runner.getAll(req.session.userId).map(serializeInstalledSkill);
     res.json(skills.sort(sortInstalledSkills));
   } catch (err) {
     res.status(500).json({ error: sanitizeError(err) });
@@ -107,7 +107,7 @@ router.get('/audit/summary', (req, res) => {
 router.get('/:name', async (req, res) => {
   try {
     const runner = await getSkillRunner(req.app);
-    const skill = runner.getSkill(req.params.name);
+    const skill = runner.getSkill(req.params.name, req.session.userId);
     if (!skill) return res.status(404).json({ error: 'Skill not found' });
     const fs = require('fs');
     const content = fs.readFileSync(skill.filePath, 'utf-8');
@@ -132,6 +132,7 @@ router.post('/', async (req, res) => {
     }
 
     const result = runner.createSkill(
+      req.session.userId,
       req.body.filename || parsed.name,
       parsed.description,
       parsed.instructions,
@@ -149,7 +150,8 @@ router.put('/:name', async (req, res) => {
   try {
     const runner = await getSkillRunner(req.app);
     if (typeof req.body.enabled === 'boolean' && !req.body.content) {
-      const result = runner.setSkillEnabled(req.params.name, req.body.enabled);
+      const result = runner.setSkillEnabled(req.session.userId, req.params.name, req.body.enabled);
+      if (result.code === 'forbidden') return res.status(403).json(result);
       if (result.error) return res.status(404).json(result);
       return res.json(result);
     }
@@ -159,11 +161,12 @@ router.put('/:name', async (req, res) => {
     if (parsed.metadata?.command && !isValidCommandTemplate(parsed.metadata.command)) {
       return res.status(400).json({ error: 'Skill command template contains invalid characters' });
     }
-    const result = runner.updateSkill(req.params.name, {
+    const result = runner.updateSkill(req.session.userId, req.params.name, {
       description: parsed.description,
       instructions: parsed.instructions,
       metadata: parsed.metadata
     });
+    if (result.code === 'forbidden') return res.status(403).json(result);
     if (result.error) return res.status(404).json(result);
     res.json(result);
   } catch (err) {
@@ -174,7 +177,8 @@ router.put('/:name', async (req, res) => {
 router.delete('/:name', async (req, res) => {
   try {
     const runner = await getSkillRunner(req.app);
-    const result = runner.deleteSkill(req.params.name);
+    const result = runner.deleteSkill(req.session.userId, req.params.name);
+    if (result.code === 'forbidden') return res.status(403).json(result);
     if (result.error) return res.status(404).json(result);
     res.json(result);
   } catch (err) {

package/server/services/ai/deliverables/artifact_helpers.js

@@ -72,10 +72,78 @@ const CANDIDATE_KEYS = [
   'mediaPaths',
   'screenshotPath',
   'uiDumpPath',
-  'url',
-  'urls',
+  'artifact',
+  'artifacts',
+  'artifactPath',
+  'artifactPaths',
+  'artifactUrl',
+  'artifactUrls',
+  'artifactUri',
+  'artifactUris',
+  'downloadUrl',
+  'downloadUrls',
+  'downloadUri',
+  'downloadUris',
 ];
 
+const GENERIC_CANDIDATE_KEYS = new Set([
+  'path',
+  'paths',
+  'file',
+  'files',
+  'filePath',
+  'filePaths',
+  'fullPath',
+  'fullPaths',
+  'downloadUrl',
+  'downloadUrls',
+  'downloadUri',
+  'downloadUris',
+]);
+
+const EXPLICIT_CANDIDATE_KEYS = new Set(
+  CANDIDATE_KEYS.filter((key) => !GENERIC_CANDIDATE_KEYS.has(key))
+);
+
+const ARTIFACT_CONTAINER_KEYS = new Set([
+  'artifact',
+  'artifacts',
+  'attachment',
+  'attachments',
+  'deliverable',
+  'deliverables',
+  'download',
+  'downloads',
+  'file',
+  'files',
+  'media',
+  'preview',
+  'screenshot',
+  'screenshots',
+]);
+
+const CONTAINER_URL_KEYS = new Set(['url', 'urls', 'uri', 'uris', 'href', 'hrefs']);
+
+const EVIDENCE_RESULT_TOOLS = /^(execute_command|github_|list_|search_|read_|get_|find_|http_request|web_search|browser_get|browser_read|code_navigate|query_structured_data|memory_|session_search|recordings_|read_health_data)/;
+
+function allowsGenericCandidateKeys(toolName = '') {
+  return !EVIDENCE_RESULT_TOOLS.test(String(toolName || ''));
+}
+
+function isExplicitCandidateKey(keyHint = '', parentKeyHint = '', options = {}) {
+  if (EXPLICIT_CANDIDATE_KEYS.has(keyHint)) return true;
+  if (
+    ARTIFACT_CONTAINER_KEYS.has(parentKeyHint)
+    && CANDIDATE_KEYS.includes(keyHint)
+    && (!GENERIC_CANDIDATE_KEYS.has(parentKeyHint) || options.allowGenericKeys === true)
+  ) {
+    return true;
+  }
+  if (GENERIC_CANDIDATE_KEYS.has(keyHint)) return options.allowGenericKeys === true;
+  if (!CONTAINER_URL_KEYS.has(keyHint)) return false;
+  return ARTIFACT_CONTAINER_KEYS.has(parentKeyHint);
+}
+
 function inferExtension(candidate = '') {
   return path.extname(String(candidate || '').split('?')[0]).toLowerCase();
 }
@@ -102,8 +170,17 @@ function normalizePathOrUri(value) {
   if (!text) return null;
   if (text.startsWith('/api/artifacts/')) return { uri: text, path: null };
   if (/^https?:\/\//i.test(text)) return { uri: text, path: null };
-  if (/^[A-Za-z]:\\/.test(text)) return { path: text, uri: null };
-  if (path.isAbsolute(text)) return { path: text, uri: null };
+  if (text.startsWith('//')) return null;
+  if (/^[A-Za-z]:\\/.test(text)) {
+    const ext = path.extname(text.split('?')[0]).toLowerCase();
+    if (!FILE_EXTENSION_TO_KIND[ext]) return null;
+    return { path: text, uri: null };
+  }
+  if (path.isAbsolute(text)) {
+    const ext = path.extname(text.split('?')[0]).toLowerCase();
+    if (!FILE_EXTENSION_TO_KIND[ext]) return null;
+    return { path: text, uri: null };
+  }
   return null;
 }
 
@@ -154,6 +231,7 @@ async function extractArtifactsFromResult(toolName, result) {
   const seen = new Set();
   const seenCandidates = new Set();
   const fallbackKind = inferArtifactKind(toolName, 'artifact');
+  const allowGenericKeys = allowsGenericCandidateKeys(toolName);
 
   async function pushCandidate(candidate) {
     const candidateKey = String(candidate || '').trim();
@@ -167,23 +245,26 @@ async function extractArtifactsFromResult(toolName, result) {
     artifacts.push(artifact);
   }
 
-  async function visit(value, keyHint = '') {
+  async function visit(value, keyHint = '', parentKeyHint = '') {
     if (value == null) return;
     if (typeof value === 'string') {
-      const explicit = CANDIDATE_KEYS.includes(keyHint);
-      if (explicit) await pushCandidate(value);
+      const explicit = isExplicitCandidateKey(keyHint, parentKeyHint, { allowGenericKeys });
+      if (explicit) {
+        if (normalizePathOrUri(value)) await pushCandidate(value);
+        return;
+      }
       for (const candidate of scanStringForCandidates(value, { explicit })) {
         await pushCandidate(candidate);
       }
       return;
     }
     if (Array.isArray(value)) {
-      for (const item of value) await visit(item, keyHint);
+      for (const item of value) await visit(item, keyHint, parentKeyHint);
       return;
     }
     if (typeof value === 'object') {
       for (const [key, nested] of Object.entries(value)) {
-        await visit(nested, key);
+        await visit(nested, key, keyHint);
       }
     }
   }
@@ -193,8 +274,10 @@ async function extractArtifactsFromResult(toolName, result) {
 }
 
 module.exports = {
+  allowsGenericCandidateKeys,
   extractArtifactsFromResult,
   inferArtifactKind,
   inferMimeType,
+  isExplicitCandidateKey,
   normalizePathOrUri,
 };

package/server/services/ai/deliverables/selector.js

@@ -47,6 +47,23 @@ async function selectDeliverableWorkflow({
   tools = [],
   options = {},
 }) {
+  if (!engine || typeof engine.requestStructuredJson !== 'function') {
+    return {
+      selection: {
+        status: 'standard',
+        type: null,
+        confidence: 0,
+        goal: '',
+        requestedOutputs: [],
+        supportingCapabilities: [],
+      },
+      usage: 0,
+      raw: '',
+      skipped: true,
+      reason: 'structured selector unavailable',
+    };
+  }
+
   const response = await engine.requestStructuredJson({
     provider,
     providerName,

package/server/services/ai/hooks.js

@@ -81,7 +81,8 @@ class AgentHooks {
 
   /**
    * Run all handlers for an event, merging their return values.
-   * If any handler returns { block: true }, short-circuits and returns { block: true }.
+   * If any handler returns { block: true }, short-circuits and preserves the
+   * handler's metadata so the engine can explain why the tool was blocked.
    *
    * @param {string} event
    * @param {object} ctx   - Context passed to every handler
@@ -98,7 +99,7 @@ class AgentHooks {
         console.warn(`[Hooks] Handler "${id}" for "${event}" threw:`, err.message);
         continue; // don't let a bad hook crash the loop
       }
-      if (result?.block === true) return { block: true };
+      if (result?.block === true) return { ...merged, ...result };
       if (result && typeof result === 'object') {
         merged = { ...merged, ...result };
       }

package/server/services/ai/learning.js

@@ -1,5 +1,6 @@
 const crypto = require('crypto');
 const db = require('../../db/database');
+const { getAiSettings } = require('./settings');
 
 function sanitizeSkillName(input) {
   const base = String(input || '')
@@ -111,6 +112,8 @@ class LearningManager {
     if (!userId || !agentId || !runId || !task || !finalContent) return null;
     if (triggerType && triggerType !== 'user') return null;
     if (triggerSource && triggerSource !== 'web') return null;
+    const aiSettings = getAiSettings(userId, agentId);
+    if (!aiSettings.auto_skill_learning) return null;
 
     const successfulSteps = Array.isArray(steps)
       ? steps.filter((step) => step.status === 'completed' && step.tool_name)
@@ -145,12 +148,13 @@ class LearningManager {
     ).get(userId, agentId, draft.metadata.workflow_signature);
     if (Number(observation?.observation_count || 0) < 3) return null;
 
-    const existing = Array.from(this.skillRunner.skills.values()).find(
-      (skill) => skill.metadata?.workflow_signature === draft.metadata.workflow_signature,
+    const existing = this.skillRunner.findSkillByWorkflowSignature(
+      userId,
+      draft.metadata.workflow_signature,
     );
     if (existing) {
       if (existing.metadata?.enabled !== false || existing.metadata?.draft !== true) return null;
-      return this.skillRunner.updateSkill(existing.name, {
+      return this.skillRunner.updateSkill(userId, existing.name, {
         description: draft.description,
         instructions: draft.instructions,
         metadata: {
@@ -163,6 +167,7 @@ class LearningManager {
     }
 
     const result = this.skillRunner.createSkill(
+      userId,
       draft.name,
       draft.description,
       draft.instructions,

package/server/services/ai/loop/agent_engine_core.js

@@ -247,6 +247,7 @@ class AgentEngine {
     const promptSections = await buildSystemPromptSections(userId, context, memoryManager);
     const skillRunner = context.skillRunner || this.skillRunner || null;
     const skillsPrompt = skillRunner?.getSkillsForPrompt?.({
+      userId,
       maxTotalChars: 9000,
       maxDescriptionChars: 180,
       maxTriggerChars: 100,
@@ -1180,6 +1181,24 @@ class AgentEngine {
   }
 
   async spawnSubagent(userId, parentRunId, task, options = {}) {
+    const parentRunMeta = this.getRunMeta(parentRunId);
+    const parentDepth = Math.max(0, Number(parentRunMeta?.subagentDepth) || 0);
+    if (parentDepth >= 1) {
+      return {
+        error: 'Sub-agents cannot spawn additional sub-agents. Continue the current child run or return results to the parent run.',
+      };
+    }
+
+    const aiSettings = getAiSettings(userId, options.agentId || null);
+    const maxSubagentsPerRun = Math.max(1, Number(aiSettings.subagent_max_children_per_run) || 10);
+    const existingSubagents = Array.from(this.subagents.values())
+      .filter((record) => record.parentRunId === parentRunId);
+    if (existingSubagents.length >= maxSubagentsPerRun) {
+      return {
+        error: `This run has already spawned ${existingSubagents.length} sub-agents. The limit for one run is ${maxSubagentsPerRun}.`,
+      };
+    }
+
     const handle = uuidv4();
     const childRunId = uuidv4();
     let relevantMemories = [];
@@ -1256,6 +1275,8 @@ class AgentEngine {
             triggerSource: 'agent',
             runId: childRunId,
             agentId: options.agentId || null,
+            subagentDepth: parentDepth + 1,
+            disallowedToolNames: ['spawn_subagent'],
           },
           options.model || null
         );
@@ -1521,6 +1542,52 @@ class AgentEngine {
     return { handle, status: 'cancelled' };
   }
 
+  interruptRun(runId, reason = 'Server shutting down while run was in progress.') {
+    const runMeta = this.activeRuns.get(runId);
+    const delegatedChildren = db.prepare(
+      "SELECT child_run_id FROM agent_delegations WHERE parent_run_id = ? AND status = 'running'"
+    ).all(runId);
+    if (runMeta) {
+      runMeta.status = 'interrupted';
+      runMeta.stopReason = reason;
+      runMeta.aborted = true;
+      this.emit(runMeta.userId, 'run:stopping', { runId });
+      for (const pid of runMeta.toolPids) {
+        if (this.runtimeManager && typeof this.runtimeManager.killCommand === 'function') {
+          void this.runtimeManager.killCommand(runMeta.userId, pid, 'aborted');
+        }
+      }
+      runMeta.toolPids.clear();
+    }
+    for (const child of delegatedChildren) {
+      if (child.child_run_id && child.child_run_id !== runId) {
+        this.interruptRun(child.child_run_id, reason);
+      }
+    }
+    db.prepare(
+      `UPDATE agent_delegations
+       SET status = 'interrupted',
+           error = COALESCE(NULLIF(error, ''), ?),
+           updated_at = datetime('now'),
+           completed_at = datetime('now')
+       WHERE parent_run_id = ? AND status = 'running'`
+    ).run(reason, runId);
+    db.prepare(
+      `UPDATE agent_runs
+       SET status = 'interrupted',
+           error = COALESCE(NULLIF(error, ''), ?),
+           updated_at = datetime('now'),
+           completed_at = datetime('now')
+       WHERE id = ?`
+    ).run(reason, runId);
+  }
+
+  interruptAllActiveRuns(reason = 'Server shutting down while run was in progress.') {
+    for (const runId of Array.from(this.activeRuns.keys())) {
+      this.interruptRun(runId, reason);
+    }
+  }
+
   stopRun(runId) {
     const runMeta = this.activeRuns.get(runId);
     const delegatedChildren = db.prepare(

package/server/services/ai/loop/blank_recovery.js

@@ -0,0 +1,37 @@
+'use strict';
+
+const { summarizeForLog } = require('../logFormat');
+
+function latestFailedToolExecution(toolExecutions = []) {
+  return [...toolExecutions].reverse().find((item) => item && item.ok === false) || null;
+}
+
+function shouldContinueAfterBlankToolFailure({
+  lastContent = '',
+  failedStepCount = 0,
+  remainingIterations = 0,
+  toolExecutions = [],
+} = {}) {
+  return !String(lastContent || '').trim()
+    && Number(failedStepCount || 0) > 0
+    && Number(remainingIterations || 0) > 0
+    && Boolean(latestFailedToolExecution(toolExecutions));
+}
+
+function buildBlankAfterToolFailureGuidance(toolExecutions = []) {
+  const failedExecution = latestFailedToolExecution(toolExecutions);
+  if (!failedExecution) return '';
+  const toolName = failedExecution.toolName || failedExecution.tool || 'the previous tool';
+  const failure = failedExecution.error || failedExecution.summary || failedExecution.status || 'unknown failure';
+  return [
+    `The previous tool "${toolName}" failed with: ${summarizeForLog(failure, 240)}.`,
+    'The latest assistant turn returned no user-facing answer and no tool call, so the task is not terminal.',
+    'Continue with the next safe recovery action: retry with corrected arguments, use another available tool, verify from existing evidence, or report a real blocker only if no autonomous path remains.',
+  ].join(' ');
+}
+
+module.exports = {
+  buildBlankAfterToolFailureGuidance,
+  latestFailedToolExecution,
+  shouldContinueAfterBlankToolFailure,
+};