neoagent 3.0.1-beta.2 → 3.0.1-beta.21

package/server/admin/users.js

@@ -31,9 +31,9 @@ async function saveDefaultRateLimits(btn) {
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ rate_limit_4h: parse(v4h), rate_limit_weekly: parse(vw) }),
     });
-    if (!res.ok) { const b = await res.json().catch(() => ({})); alert(b.error || 'Failed'); }
+    if (!res.ok) { const b = await res.json().catch(() => ({})); showToast(b.error || 'Failed', 'error'); }
     else { btn.textContent = 'Saved!'; setTimeout(() => { btn.textContent = orig; btn.disabled = false; }, 2000); return; }
-  } catch (_) { alert('Network error'); }
+  } catch (_) { showToast('Network error', 'error'); }
   btn.disabled = false;
   btn.textContent = orig;
 }
@@ -132,7 +132,7 @@ function renderUsersTable(el, users) {
 }
 
 async function forceLogout(id, username, btn) {
-  if (!confirm(`Force logout ${username}?\n\nThis will revoke all active sessions. They can log back in.`)) return;
+  if (!await showConfirmModal({ title: `Force logout @${esc(username)}?`, body: 'This will revoke all active sessions. They can log back in.', confirmLabel: 'Force Logout', confirmClass: 'btn-danger' })) return;
   btn.disabled = true;
   try {
     const res = await api(`/admin/api/users/${id}/sessions`, { method: 'DELETE' });
@@ -141,22 +141,22 @@ async function forceLogout(id, username, btn) {
       setTimeout(loadUsers, 800);
     } else {
       const b = await res.json().catch(() => ({}));
-      alert(b.error || 'Failed');
+      showToast(b.error || 'Failed', 'error');
       btn.disabled = false;
     }
   } catch (err) {
-    if (err.message !== 'unauthorized') alert('Network error');
+    if (err.message !== 'unauthorized') showToast('Network error', 'error');
     btn.disabled = false;
   }
 }
 
 async function deleteUser(id, displayName, btn) {
-  if (!confirm(
-    `⚠ GDPR Erasure — permanently delete "${displayName}"?\n\n` +
-    'This will delete the account and ALL associated data:\n' +
-    '• Agent runs, steps, and messages\n• Memories and conversations\n• Integrations and platform connections\n• Artifacts and files on disk\n• All sessions\n\n' +
-    'This action CANNOT be undone.'
-  )) return;
+  if (!await showConfirmModal({
+    title: `Delete "${esc(displayName)}"?`,
+    body: `<strong>GDPR Erasure</strong> — permanently deletes the account and <strong>all</strong> associated data:<br><br>• Agent runs, steps, and messages<br>• Memories and conversations<br>• Integrations and platform connections<br>• Artifacts and files on disk<br>• All sessions<br><br><span style="color:var(--danger)">This action cannot be undone.</span>`,
+    confirmLabel: 'Delete User',
+    confirmClass: 'btn-danger',
+  })) return;
   btn.disabled = true;
   btn.textContent = 'Deleting…';
   try {
@@ -170,12 +170,12 @@ async function deleteUser(id, displayName, btn) {
       }
     } else {
       const b = await res.json().catch(() => ({}));
-      alert(b.error || 'Failed to delete user');
+      showToast(b.error || 'Failed to delete user', 'error');
       btn.disabled = false;
       btn.textContent = 'Delete';
     }
   } catch (err) {
-    if (err.message !== 'unauthorized') alert('Network error');
+    if (err.message !== 'unauthorized') showToast('Network error', 'error');
     btn.disabled = false;
     btn.textContent = 'Delete';
   }
@@ -266,12 +266,12 @@ async function editRateLimits(id, username) {
         overlay.remove();
         await fetchUsers(document.getElementById('user-search')?.value?.trim() || '');
       } catch (_) {
-        alert('Failed to save rate limits');
+        showToast('Failed to save rate limits', 'error');
         bSave.disabled = false;
         bSave.textContent = 'Save';
       }
     };
   } catch (_) {
-    alert('Failed to fetch rate limits');
+    showToast('Failed to fetch rate limits', 'error');
   }
 }

package/server/db/database.js

@@ -51,13 +51,6 @@ function initializeDatabase(db, dbPath) {
   return db;
 }
 
-function sleepSync(ms) {
-  if (ms <= 0) return;
-  const buffer = new SharedArrayBuffer(4);
-  const view = new Int32Array(buffer);
-  Atomics.wait(view, 0, 0, ms);
-}
-
 function isSqliteBusyError(error) {
   return Boolean(
     error &&
@@ -69,7 +62,9 @@ function isSqliteBusyError(error) {
   );
 }
 
-function runWithBusyRetry(action, { attempts = 5, delayMs = 50, label = 'SQLite operation' } = {}) {
+function runWithBusyRetry(action, { attempts = 3, label = 'SQLite operation' } = {}) {
+  // busy_timeout pragma already handles waiting at the SQLite layer;
+  // this loop is a last-resort failsafe without adding extra main-thread blocking.
   let lastError = null;
   for (let attempt = 1; attempt <= attempts; attempt += 1) {
     try {
@@ -80,9 +75,8 @@ function runWithBusyRetry(action, { attempts = 5, delayMs = 50, label = 'SQLite
         throw error;
       }
       console.warn(
-        `[Database] ${label} hit a busy lock on attempt ${attempt}/${attempts}; retrying in ${delayMs}ms.`,
+        `[Database] ${label} hit a busy lock on attempt ${attempt}/${attempts}; retrying.`,
       );
-      sleepSync(delayMs);
     }
   }
   throw lastError;
@@ -1328,6 +1322,7 @@ for (const col of [
   "ALTER TABLE memory_facts ADD COLUMN invalidated_at TEXT",
   "ALTER TABLE memory_facts ADD COLUMN status TEXT DEFAULT 'active'",
   "ALTER TABLE memory_facts ADD COLUMN supersedes_fact_id TEXT",
+  "ALTER TABLE users ADD COLUMN billing_override_plan_id TEXT",
 ]) {
   try { db.exec(col); } catch { /* column already exists */ }
 }
@@ -1879,7 +1874,7 @@ function migrateIntegrationProviderConfigsTable() {
 }
 
 function migrateIntegrationSecretStorage() {
-  try {
+  const migrate = db.transaction(() => {
     const connectionRows = db
       .prepare('SELECT id, credentials_json FROM integration_connections')
       .all();
@@ -1891,11 +1886,7 @@ function migrateIntegrationSecretStorage() {
       if (!current || isEncryptedValue(current)) continue;
       updateConnection.run(encryptValue(current), row.id);
     }
-  } catch {
-    // Preserve startup even if a row cannot be re-encrypted.
-  }
 
-  try {
     const stateRows = db
       .prepare('SELECT id, code_verifier FROM integration_oauth_states')
       .all();
@@ -1907,11 +1898,7 @@ function migrateIntegrationSecretStorage() {
       if (!current || isEncryptedValue(current)) continue;
       updateState.run(encryptValue(current), row.id);
     }
-  } catch {
-    // Preserve startup even if a row cannot be re-encrypted.
-  }
 
-  try {
     const providerRows = db
       .prepare('SELECT id, config_json FROM integration_provider_configs')
       .all();
@@ -1923,8 +1910,13 @@ function migrateIntegrationSecretStorage() {
       if (!current || isEncryptedValue(current)) continue;
       updateProviderConfig.run(encryptValue(current), row.id);
     }
-  } catch {
-    // Preserve startup even if a row cannot be re-encrypted.
+  });
+
+  try {
+    migrate();
+  } catch (err) {
+    console.error('[DB] Integration secret migration failed — startup cannot continue with partially migrated secrets:', err.message);
+    throw err;
   }
 }
 

package/server/db/sessions_db.js

@@ -0,0 +1,8 @@
+'use strict';
+
+const Sqlite = require('better-sqlite3');
+const { DATA_DIR } = require('../../runtime/paths');
+
+const sessionsDb = new Sqlite(`${DATA_DIR}/sessions.db`);
+
+module.exports = sessionsDb;

package/server/http/middleware.js

@@ -1,15 +1,13 @@
 'use strict';
 
 const session = require('express-session');
-const Sqlite = require('better-sqlite3');
 const SQLiteStore = require('better-sqlite3-session-store')(session);
 const helmet = require('helmet');
 const cors = require('cors');
-const { DATA_DIR } = require('../../runtime/paths');
 const { logRequestSummary } = require('../utils/logger');
 const { getSessionSecret } = require('../services/account/session_secret');
 
-const sessionsDb = new Sqlite(`${DATA_DIR}/sessions.db`);
+const sessionsDb = require('../db/sessions_db');
 const LEGACY_SESSION_EXPIRE_FALLBACK = 0;
 
 function boolEnv(name, fallback = false) {
@@ -89,7 +87,9 @@ function buildHelmetOptions({ secureCookies }) {
   }
 
   return {
-    strictTransportSecurity: false,
+    strictTransportSecurity: secureCookies
+      ? { maxAge: Number(process.env.NEOAGENT_HSTS_MAX_AGE ?? 86400), includeSubDomains: false }
+      : false,
     crossOriginOpenerPolicy: false,
     crossOriginResourcePolicy: { policy: 'same-site' },
     originAgentCluster: false,

package/server/http/routes.js

@@ -48,6 +48,15 @@ function registerApiRoutes(app) {
     }
   }
 
+  // Billing routes are mounted conditionally — only when billing is enabled.
+  // The webhook must be mounted before express.json() consumes the raw body;
+  // billing_webhook.js applies express.raw() inline for its own route.
+  const { isBillingEnabled } = require('../services/billing/config');
+  if (isBillingEnabled()) {
+    app.use('/api/billing/webhook', require('../routes/billing_webhook'));
+    app.use('/api/billing', require('../routes/billing'));
+  }
+
   setupTelnyxWebhook(app);
 
   app.get('/api/health', requireAuth, (req, res) => {

package/server/http/static.js

@@ -78,8 +78,10 @@ function registerStaticRoutes(app) {
   app.get(/^\/app(\/.*)?$/, serveFlutterApp);
 
   // Landing page at /
-  app.use(express.static(LANDING_DIR));
-  app.get('/', (req, res) => res.sendFile(path.join(LANDING_DIR, 'index.html')));
+  if (fs.existsSync(path.join(LANDING_DIR, 'index.html'))) {
+    app.use(express.static(LANDING_DIR));
+    app.get('/', (req, res) => res.sendFile(path.join(LANDING_DIR, 'index.html')));
+  }
 }
 
 function serveFlutterApp(req, res) {

package/server/middleware/requireBilling.js

@@ -0,0 +1,12 @@
+'use strict';
+
+const { isBillingEnabled } = require('../services/billing/config');
+
+function requireBilling(req, res, next) {
+  if (!isBillingEnabled()) {
+    return res.status(404).json({ error: 'Billing is not enabled on this server.' });
+  }
+  next();
+}
+
+module.exports = { requireBilling };

package/server/public/.last_build_id

@@ -1 +1 @@
-c04ddd17135c19eaa7255284a042b387
+480214d898daad039c3f7d2d405af709

package/server/public/flutter_bootstrap.js

@@ -37,6 +37,6 @@ _flutter.buildConfig = {"engineRevision":"77e2e94772b6eb43759e34ed1ad7da4674e19c
 
 _flutter.loader.load({
   serviceWorkerSettings: {
-    serviceWorkerVersion: "3187756582" /* Flutter's service worker is deprecated and will be removed in a future Flutter release. */
+    serviceWorkerVersion: "1637623305" /* Flutter's service worker is deprecated and will be removed in a future Flutter release. */
   }
 });