neoagent 3.0.0 → 3.0.1-beta.0

package/server/services/memory/manager.js

@@ -309,6 +309,34 @@ class MemoryManager {
     return resolveAgentId(userId, options?.agentId || options?.agent_id || null);
   }
 
+  _findExactMemory(userId, agentId, memoryHash, scope) {
+    return db.prepare(
+      `SELECT id FROM memories
+       WHERE user_id = ? AND agent_id = ? AND archived = 0
+         AND memory_hash = ?
+         AND COALESCE(scope_type, 'agent') = ?
+         AND COALESCE(scope_id, '') = COALESCE(?, '')
+       LIMIT 1`
+    ).get(userId, agentId, memoryHash, scope.scopeType, scope.scopeId);
+  }
+
+  _reinforceExactMemory(memoryId, importance) {
+    db.prepare(
+      `UPDATE memories
+       SET importance = MAX(importance, ?),
+           confidence = MIN(1, confidence + 0.03),
+           updated_at = datetime('now')
+       WHERE id = ?`
+    ).run(importance, memoryId);
+    db.prepare(
+      `UPDATE memory_facts
+       SET confidence = MIN(1, confidence + 0.03),
+           updated_at = datetime('now')
+       WHERE memory_id = ? AND status = 'active'`
+    ).run(memoryId);
+    return memoryId;
+  }
+
   _backfillMemoryIntelligence(limit = 1000) {
     try {
       const rows = db.prepare(
@@ -1602,29 +1630,9 @@ class MemoryManager {
     );
     const embedding = embeddingResult?.vector || null;
 
-    const exact = db.prepare(
-      `SELECT id FROM memories
-       WHERE user_id = ? AND agent_id = ? AND archived = 0
-         AND memory_hash = ?
-         AND COALESCE(scope_type, 'agent') = ?
-         AND COALESCE(scope_id, '') = COALESCE(?, '')
-       LIMIT 1`
-    ).get(userId, agentId, memoryHash, scope.scopeType, scope.scopeId);
+    const exact = this._findExactMemory(userId, agentId, memoryHash, scope);
     if (exact?.id) {
-      db.prepare(
-        `UPDATE memories
-         SET importance = MAX(importance, ?),
-             confidence = MIN(1, confidence + 0.03),
-             updated_at = datetime('now')
-         WHERE id = ?`
-      ).run(importance, exact.id);
-      db.prepare(
-        `UPDATE memory_facts
-         SET confidence = MIN(1, confidence + 0.03),
-             updated_at = datetime('now')
-         WHERE memory_id = ? AND status = 'active'`
-      ).run(exact.id);
-      return exact.id;
+      return this._reinforceExactMemory(exact.id, importance);
     }
 
     const duplicateCandidateIds = embedding
@@ -1717,8 +1725,8 @@ class MemoryManager {
 
     // Save new
     const id = uuidv4();
-    db.prepare(
-      `INSERT INTO memories (
+    const insertResult = db.prepare(
+      `INSERT OR IGNORE INTO memories (
         id, user_id, agent_id, category, scope_type, scope_id, source_type, source_id, source_label,
         stale_after_days, metadata_json, content, summary, importance, confidence, memory_hash, embedding,
         embedding_provider, embedding_model, embedding_dimensions, embedded_at
@@ -1747,6 +1755,13 @@ class MemoryManager {
       embeddingResult?.dimensions || null,
       embedding ? new Date().toISOString() : null,
     );
+    if (insertResult.changes === 0) {
+      const existingExact = this._findExactMemory(userId, agentId, memoryHash, scope);
+      if (existingExact?.id) {
+        return this._reinforceExactMemory(existingExact.id, importance);
+      }
+      throw new Error('Memory insert was ignored but no matching memory row was found');
+    }
 
     this._upsertMemoryIntelligence(userId, agentId, id, {
       content,

package/server/services/runtime/manager.js

@@ -161,9 +161,13 @@ class RuntimeManager {
   }
 
   async shutdown() {
-    await Promise.allSettled([
+    const tasks = [
       this.browserBackend?.shutdown?.(),
-    ]);
+    ];
+    if (typeof this.shellWorkerPool?.shutdown === 'function') {
+      tasks.push(Promise.resolve().then(() => this.shellWorkerPool.shutdown()));
+    }
+    await Promise.allSettled(tasks);
   }
 }
 

package/server/services/security/approval_gate_service.js

@@ -5,28 +5,120 @@ const db = require('../../db/database');
 const { getCategoryForTool } = require('./tool_categories');
 
 const APPROVAL_TIMEOUT_MS = 30_000;
+const SESSION_GRANT_TTL_MS = 12 * 60 * 60 * 1000;
 
 class ApprovalGateService {
   constructor({ io }) {
     this._io = io;
-    /** @type {Map<string, { resolve: Function, timer: NodeJS.Timeout }>} */
+    /** @type {Map<string, { resolve: Function, timer: NodeJS.Timeout, userId: number|string, runId: string|null, toolName: string, toolArgs: object }>} */
     this._pending = new Map();
     /** @type {Set<string>} key = `${userId}:${runId}:${toolName}` */
     this._sessionGrants = new Set();
+    this._loadSessionGrants();
   }
 
   hasSessionGrant(userId, runId, toolName) {
     return this._sessionGrants.has(`${userId}:${runId}:${toolName}`);
   }
 
+  _grantKey(userId, runId, toolName) {
+    return `${userId}:${runId}:${toolName}`;
+  }
+
+  _loadSessionGrants() {
+    try {
+      db.prepare(
+        `DELETE FROM approval_session_grants
+         WHERE expires_at <= datetime('now')`
+      ).run();
+      const rows = db.prepare(
+        `SELECT user_id, run_id, tool_name
+         FROM approval_session_grants
+         WHERE expires_at > datetime('now')`
+      ).all();
+      for (const row of rows) {
+        this._sessionGrants.add(this._grantKey(row.user_id, row.run_id, row.tool_name));
+      }
+    } catch (err) {
+      console.warn('[ApprovalGate] Failed to load session grants:', err.message);
+    }
+  }
+
+  _persistSessionGrant(userId, runId, toolName) {
+    const expiresAt = new Date(Date.now() + SESSION_GRANT_TTL_MS).toISOString();
+    db.prepare(
+      `INSERT INTO approval_session_grants (
+         user_id, run_id, tool_name, expires_at, updated_at
+       ) VALUES (?, ?, ?, ?, datetime('now'))
+       ON CONFLICT(user_id, run_id, tool_name) DO UPDATE SET
+         expires_at = excluded.expires_at,
+         updated_at = excluded.updated_at`
+    ).run(userId, runId, toolName, expiresAt);
+  }
+
+  _persistPendingApproval(approvalId, userId, runId, toolName, toolArgs, category, expiresAt) {
+    db.prepare(
+      `INSERT INTO pending_approvals (
+         id, user_id, run_id, tool_name, tool_args_json, category, status, expires_at, updated_at
+       ) VALUES (?, ?, ?, ?, ?, ?, 'pending', ?, datetime('now'))`
+    ).run(
+      approvalId,
+      userId,
+      runId,
+      toolName,
+      JSON.stringify(toolArgs ?? {}),
+      category,
+      expiresAt,
+    );
+  }
+
+  _updatePendingApprovalStatus(approvalId, status, scope = null) {
+    db.prepare(
+      `UPDATE pending_approvals
+       SET status = ?,
+           scope = COALESCE(?, scope),
+           decided_at = CASE WHEN ? = 'pending' THEN decided_at ELSE COALESCE(decided_at, datetime('now')) END,
+           updated_at = datetime('now')
+       WHERE id = ?`
+    ).run(status, scope, status, approvalId);
+  }
+
+  getStoredApproval(approvalId, userId) {
+    try {
+      return db.prepare(
+        `SELECT id, run_id, tool_name, status, scope, expires_at, decided_at
+         FROM pending_approvals
+         WHERE id = ? AND user_id = ?`
+      ).get(approvalId, userId);
+    } catch {
+      return null;
+    }
+  }
+
+  shutdown(reason = 'Approval expired because the server restarted.') {
+    for (const [approvalId, entry] of this._pending.entries()) {
+      clearTimeout(entry.timer);
+      this._pending.delete(approvalId);
+      this._updatePendingApprovalStatus(approvalId, 'expired', 'once');
+      this._io.to(`user:${entry.userId}`).emit('tool:approval_resolved', {
+        approvalId,
+        decision: 'expired',
+        reason,
+      });
+      this._logDecision(entry.userId, entry.runId, entry.toolName, entry.toolArgs, 'timeout', 'once');
+      entry.resolve('expired');
+    }
+  }
+
   /**
    * Emits tool:approval_required and waits for a decision.
-   * Resolves to 'approved', 'denied', or 'timeout'.
+   * Resolves to 'approved', 'denied', 'timeout', or 'expired'.
    */
   requestApproval(userId, runId, toolName, toolArgs) {
     const approvalId = randomUUID();
     const expiresAt = new Date(Date.now() + APPROVAL_TIMEOUT_MS).toISOString();
     const category = getCategoryForTool(toolName, toolArgs) ?? 'unknown';
+    this._persistPendingApproval(approvalId, userId, runId, toolName, toolArgs, category, expiresAt);
 
     const payload = { approvalId, runId, toolName, toolArgs, category, expiresAt };
     this._io.to(`user:${userId}`).emit('tool:approval_required', payload);
@@ -35,6 +127,7 @@ class ApprovalGateService {
       const timer = setTimeout(() => {
         if (this._pending.has(approvalId)) {
           this._pending.delete(approvalId);
+          this._updatePendingApprovalStatus(approvalId, 'timeout', 'once');
           this._io.to(`user:${userId}`).emit('tool:approval_resolved', {
             approvalId, decision: 'timeout',
           });
@@ -43,7 +136,14 @@ class ApprovalGateService {
         }
       }, APPROVAL_TIMEOUT_MS);
 
-      this._pending.set(approvalId, { resolve, timer });
+      this._pending.set(approvalId, {
+        resolve,
+        timer,
+        userId,
+        runId,
+        toolName,
+        toolArgs: toolArgs ?? {},
+      });
     });
   }
 
@@ -63,14 +163,17 @@ class ApprovalGateService {
     const normalizedScope = ['once', 'session', 'always'].includes(scope) ? scope : 'once';
 
     if (normalizedDecision === 'approved' && normalizedScope === 'session') {
-      this._sessionGrants.add(`${userId}:${runId}:${toolName}`);
+      this._sessionGrants.add(this._grantKey(userId, runId, toolName));
+      this._persistSessionGrant(userId, runId, toolName);
     }
     // 'always' scope is handled by the route (sets policy to 'allow') and
     // also acts as a session grant for the current run.
     if (normalizedDecision === 'approved' && normalizedScope === 'always') {
-      this._sessionGrants.add(`${userId}:${runId}:${toolName}`);
+      this._sessionGrants.add(this._grantKey(userId, runId, toolName));
+      this._persistSessionGrant(userId, runId, toolName);
     }
 
+    this._updatePendingApprovalStatus(approvalId, normalizedDecision, normalizedScope);
     const logScope = normalizedScope === 'always' ? 'session' : normalizedScope;
     this._logDecision(userId, runId, toolName, toolArgs, normalizedDecision, logScope);
     this._io.to(`user:${userId}`).emit('tool:approval_resolved', { approvalId, decision: normalizedDecision });

package/server/services/security/tool_categories.js

@@ -27,6 +27,7 @@ const TOOL_CATEGORIES = {
     'update_ai_widget',
     'delete_ai_widget',
   ],
+  external: [],
 };
 
 // Tools that bypass all policy checks — read-only or always safe
@@ -71,6 +72,98 @@ const SAFE_TOOLS = new Set([
   'recordings_get',
 ]);
 
+const BUILT_IN_TOOLS = new Set([
+  'execute_command',
+  'browser_navigate',
+  'browser_click',
+  'browser_type',
+  'browser_extract',
+  'browser_screenshot',
+  'browser_evaluate',
+  'desktop_list_devices',
+  'desktop_select_device',
+  'desktop_observe',
+  'desktop_click',
+  'desktop_drag',
+  'desktop_scroll',
+  'desktop_type',
+  'desktop_press_key',
+  'desktop_launch_app',
+  'desktop_get_tree',
+  'android_start_emulator',
+  'android_stop_emulator',
+  'android_list_devices',
+  'android_open_app',
+  'android_open_intent',
+  'android_tap',
+  'android_long_press',
+  'android_type',
+  'android_swipe',
+  'android_press_key',
+  'android_wait_for',
+  'android_observe',
+  'android_dump_ui',
+  'android_screenshot',
+  'android_list_apps',
+  'android_install_apk',
+  'android_shell',
+  'web_search',
+  'memory_save',
+  'memory_recall',
+  'session_search',
+  'memory_update_core',
+  'memory_write',
+  'memory_read',
+  'make_call',
+  'send_message',
+  'read_file',
+  'read_files',
+  'write_file',
+  'edit_file',
+  'replace_file_range',
+  'list_directory',
+  'search_files',
+  'code_navigate',
+  'query_structured_data',
+  'http_request',
+  'create_skill',
+  'list_skills',
+  'update_skill',
+  'delete_skill',
+  'think',
+  'activate_tools',
+  'spawn_subagent',
+  'delegate_to_agent',
+  'list_subagents',
+  'wait_subagent',
+  'cancel_subagent',
+  'notify_user',
+  'create_task',
+  'list_tasks',
+  'delete_task',
+  'update_task',
+  'create_ai_widget',
+  'list_ai_widgets',
+  'update_ai_widget',
+  'delete_ai_widget',
+  'mcp_add_server',
+  'mcp_list_servers',
+  'mcp_remove_server',
+  'generate_image',
+  'generate_table',
+  'generate_graph',
+  'analyze_image',
+  'ocr_extract',
+  'read_health_data',
+  'recordings_list',
+  'recordings_get',
+  'recordings_search',
+  'social_video_extract',
+  'task_complete',
+  'send_interim_update',
+  'save_widget_snapshot',
+]);
+
 // category → policy for users with no DB row yet
 const DEFAULT_POLICY = {
   shell: 'require_approval',
@@ -80,6 +173,7 @@ const DEFAULT_POLICY = {
   browser_privileged: 'require_approval',
   network_write: 'require_approval',
   skill_mutation: 'deny',
+  external: 'require_approval',
 };
 
 // Reverse map: tool → category, built once
@@ -91,15 +185,30 @@ for (const [category, tools] of Object.entries(TOOL_CATEGORIES)) {
 }
 
 /**
- * Returns the category for a tool, or null if the tool is uncategorised (safe).
- * For http_request, write methods map to network_write; read methods return null.
+ * Returns the category for a tool.
+ * - Known built-in tools may return null when they are read-only or otherwise
+ *   intentionally left uncategorized.
+ * - Unknown tool names are treated as external capabilities and must never
+ *   silently bypass policy checks.
  */
 function getCategoryForTool(toolName, toolArgs = {}) {
   if (toolName === 'http_request') {
     const method = (toolArgs.method || 'GET').toUpperCase();
     return ['GET', 'HEAD', 'OPTIONS'].includes(method) ? null : 'network_write';
   }
-  return _toolToCategory[toolName] ?? null;
+  if (_toolToCategory[toolName]) {
+    return _toolToCategory[toolName];
+  }
+  if (BUILT_IN_TOOLS.has(toolName) || SAFE_TOOLS.has(toolName)) {
+    return null;
+  }
+  return 'external';
 }
 
-module.exports = { TOOL_CATEGORIES, SAFE_TOOLS, DEFAULT_POLICY, getCategoryForTool };
+module.exports = {
+  TOOL_CATEGORIES,
+  SAFE_TOOLS,
+  DEFAULT_POLICY,
+  BUILT_IN_TOOLS,
+  getCategoryForTool,
+};

package/server/services/security/tool_security_hook.js

@@ -63,10 +63,15 @@ function registerToolSecurityHooks(toolPolicyService, approvalGateService) {
     if (decision === 'approved') return;
 
     const isTimeout = decision === 'timeout';
+    const isExpired = decision === 'expired';
     return {
       block: true,
-      blocked_by: isTimeout ? 'approval_timeout' : 'user_denied',
-      reason: isTimeout
+      blocked_by: isExpired
+        ? 'approval_expired'
+        : (isTimeout ? 'approval_timeout' : 'user_denied'),
+      reason: isExpired
+        ? `Approval for "${toolName}" expired because the server restarted or the run was interrupted. Do not retry unless the user explicitly asks you to try again.`
+        : isTimeout
         ? `Approval for "${toolName}" timed out — the user did not respond within 30 seconds. ` +
           `Do not retry unless the user explicitly asks you to try again.`
         : `The user denied the use of "${toolName}". Do not retry this tool call in this run.`,

package/server/services/skills/runtime.js

@@ -21,6 +21,8 @@ function serializeInstalledSkill(skill) {
     autoCreated: skill.metadata?.auto_created === true,
     filePath: skill.filePath,
     storeId: skill.metadata?.store_id || '',
+    readOnly: skill.readOnly === true,
+    ownerType: skill.ownerType || 'global',
   };
 }