neoagent 3.0.1-beta.2 → 3.0.1-beta.21

package/server/routes/agents.js

@@ -10,6 +10,154 @@ const { buildAgentRunContext } = require('./_helpers/agentRunContext');
 
 router.use(requireAuth);
 
+const CHAT_HISTORY_DEFAULT_LIMIT = 40;
+const CHAT_HISTORY_MAX_LIMIT = 100;
+
+function normalizedTimestampExpression(valueSql) {
+  return `julianday(CASE WHEN instr(${valueSql}, 'T') > 0 THEN ${valueSql} ELSE replace(${valueSql}, ' ', 'T') || 'Z' END)`;
+}
+
+function normalizeChatHistoryLimit(rawLimit) {
+  const parsed = Number.parseInt(rawLimit, 10);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    return CHAT_HISTORY_DEFAULT_LIMIT;
+  }
+  return Math.min(parsed, CHAT_HISTORY_MAX_LIMIT);
+}
+
+function parseChatHistoryCursor(query) {
+  const createdAt = query.beforeCreatedAt?.toString().trim() || '';
+  const source = query.beforeSource?.toString().trim() || '';
+  const id = query.beforeId?.toString().trim() || '';
+  if (!createdAt || !source || !id) {
+    return null;
+  }
+  return { createdAt, source, id };
+}
+
+function chatHistoryTimestampMs(value) {
+  if (!value) return 0;
+  const normalized = value.includes('T') ? value : `${value.replace(' ', 'T')}Z`;
+  const parsed = new Date(normalized).getTime();
+  return Number.isFinite(parsed) ? parsed : 0;
+}
+
+function compareChatHistoryDesc(left, right) {
+  const timestampDiff =
+    chatHistoryTimestampMs(right.created_at) - chatHistoryTimestampMs(left.created_at);
+  if (timestampDiff !== 0) {
+    return timestampDiff;
+  }
+  const sourceDiff = String(right.history_source || '').localeCompare(
+    String(left.history_source || '')
+  );
+  if (sourceDiff !== 0) {
+    return sourceDiff;
+  }
+  return String(right.id || '').localeCompare(String(left.id || ''));
+}
+
+function buildRunUsageSummary(runId) {
+  const rows = db.prepare(`
+    SELECT
+      provider,
+      model,
+      phase,
+      input_tokens,
+      output_tokens,
+      reasoning_tokens,
+      cached_read_tokens,
+      cache_write_tokens,
+      total_tokens,
+      estimated_cost_usd,
+      latency_ms
+    FROM agent_model_usage
+    WHERE run_id = ?
+    ORDER BY id ASC
+  `).all(runId);
+  const totals = {
+    inputTokens: 0,
+    outputTokens: 0,
+    reasoningTokens: 0,
+    cachedReadTokens: 0,
+    cacheWriteTokens: 0,
+    totalTokens: 0,
+    estimatedCostUsd: 0,
+    pricedCallCount: 0,
+    latencyMs: 0,
+  };
+  const models = new Map();
+
+  for (const row of rows) {
+    const inputTokens = Number(row.input_tokens || 0);
+    const outputTokens = Number(row.output_tokens || 0);
+    const reasoningTokens = Number(row.reasoning_tokens || 0);
+    const cachedReadTokens = Number(row.cached_read_tokens || 0);
+    const cacheWriteTokens = Number(row.cache_write_tokens || 0);
+    const totalTokens = Number(row.total_tokens || 0);
+    const latencyMs = Number(row.latency_ms || 0);
+    const estimatedCostUsd = Number(row.estimated_cost_usd);
+    const key = `${row.provider}:${row.model}`;
+
+    totals.inputTokens += inputTokens;
+    totals.outputTokens += outputTokens;
+    totals.reasoningTokens += reasoningTokens;
+    totals.cachedReadTokens += cachedReadTokens;
+    totals.cacheWriteTokens += cacheWriteTokens;
+    totals.totalTokens += totalTokens;
+    totals.latencyMs += latencyMs;
+    if (Number.isFinite(estimatedCostUsd)) {
+      totals.estimatedCostUsd += estimatedCostUsd;
+      totals.pricedCallCount += 1;
+    }
+
+    if (!models.has(key)) {
+      models.set(key, {
+        provider: row.provider,
+        model: row.model,
+        callCount: 0,
+        inputTokens: 0,
+        outputTokens: 0,
+        reasoningTokens: 0,
+        cachedReadTokens: 0,
+        cacheWriteTokens: 0,
+        totalTokens: 0,
+        estimatedCostUsd: 0,
+        pricedCallCount: 0,
+        latencyMs: 0,
+        phases: new Set(),
+      });
+    }
+
+    const aggregate = models.get(key);
+    aggregate.callCount += 1;
+    aggregate.inputTokens += inputTokens;
+    aggregate.outputTokens += outputTokens;
+    aggregate.reasoningTokens += reasoningTokens;
+    aggregate.cachedReadTokens += cachedReadTokens;
+    aggregate.cacheWriteTokens += cacheWriteTokens;
+    aggregate.totalTokens += totalTokens;
+    aggregate.latencyMs += latencyMs;
+    aggregate.phases.add(String(row.phase || '').trim() || 'model_turn');
+    if (Number.isFinite(estimatedCostUsd)) {
+      aggregate.estimatedCostUsd += estimatedCostUsd;
+      aggregate.pricedCallCount += 1;
+    }
+  }
+
+  return {
+    totals: {
+      ...totals,
+      estimatedCostUsd: totals.pricedCallCount > 0 ? totals.estimatedCostUsd : null,
+    },
+    models: [...models.values()].map((entry) => ({
+      ...entry,
+      estimatedCostUsd: entry.pricedCallCount > 0 ? entry.estimatedCostUsd : null,
+      phases: [...entry.phases],
+    })),
+  };
+}
+
 // List agent runs
 router.get('/', (req, res) => {
   const limit = Math.min(parseInt(req.query.limit) || 50, 200);
@@ -23,9 +171,31 @@ router.get('/', (req, res) => {
 
 // Chat history (web + social messages merged)
 router.get('/chat-history', (req, res) => {
-  const limit = Math.min(parseInt(req.query.limit) || 100, 500);
+  const limit = normalizeChatHistoryLimit(req.query.limit);
+  const queryLimit = limit + 1;
   const userId = req.session.userId;
   const agentId = resolveAgentId(userId, getAgentIdFromRequest(req));
+  const cursor = parseChatHistoryCursor(req.query);
+  const cursorTimestampSql = normalizedTimestampExpression('@beforeCreatedAt');
+  const historyTimestampSql = normalizedTimestampExpression('created_at');
+  const cursorClause = (sourceName) =>
+    cursor
+      ? `AND (
+        ${historyTimestampSql} < ${cursorTimestampSql}
+        OR (${historyTimestampSql} = ${cursorTimestampSql} AND '${sourceName}' < @beforeSource)
+        OR (${historyTimestampSql} = ${cursorTimestampSql} AND '${sourceName}' = @beforeSource AND CAST(id AS TEXT) < @beforeId)
+      )`
+      : '';
+  const queryParams = cursor
+    ? {
+        userId,
+        agentId,
+        limit: queryLimit,
+        beforeCreatedAt: cursor.createdAt,
+        beforeSource: cursor.source,
+        beforeId: cursor.id,
+      }
+    : { userId, agentId, limit: queryLimit };
 
   const webMsgs = db.prepare(`
     SELECT
@@ -37,9 +207,14 @@ router.get('/chat-history', (req, res) => {
       created_at,
       agent_run_id AS run_id,
       metadata,
-      NULL AS tool_calls
-    FROM conversation_history WHERE user_id = ? AND agent_id = ? ORDER BY created_at DESC LIMIT ?
-  `).all(userId, agentId, limit);
+      NULL AS tool_calls,
+      'conversation' AS history_source
+    FROM conversation_history
+    WHERE user_id = @userId AND agent_id = @agentId
+    ${cursorClause('conversation')}
+    ORDER BY ${historyTimestampSql} DESC, CAST(id AS TEXT) DESC
+    LIMIT @limit
+  `).all(queryParams);
 
   const socialMsgs = db.prepare(`
     SELECT
@@ -51,23 +226,27 @@ router.get('/chat-history', (req, res) => {
       created_at,
       run_id,
       metadata,
-      tool_calls
-    FROM messages WHERE user_id = ? AND agent_id = ? AND platform != 'web'
-    ORDER BY created_at DESC LIMIT ?
-  `).all(userId, agentId, limit);
-
-  // Normalize SQL datetime ('YYYY-MM-DD HH:MM:SS', treated as local) and ISO-Z strings to ms
-  const toMs = (s) => {
-    if (!s) return 0;
-    const normalized = s.includes('T') ? s : s.replace(' ', 'T') + 'Z';
-    return new Date(normalized).getTime();
-  };
+      tool_calls,
+      'message' AS history_source
+    FROM messages
+    WHERE user_id = @userId AND agent_id = @agentId AND platform != 'web'
+    ${cursorClause('message')}
+    ORDER BY ${historyTimestampSql} DESC, CAST(id AS TEXT) DESC
+    LIMIT @limit
+  `).all(queryParams);
 
-  const all = [...webMsgs, ...socialMsgs]
-    .sort((a, b) => toMs(a.created_at) - toMs(b.created_at))
-    .slice(-limit);
+  const merged = [...webMsgs, ...socialMsgs].sort(compareChatHistoryDesc);
+  const page = merged.slice(0, limit);
+  const oldest = page.length > 0 ? page[page.length - 1] : null;
 
-  res.json({ messages: all, agentId });
+  res.json({
+    messages: [...page].reverse(),
+    agentId,
+    hasMore: merged.length > limit,
+    nextBeforeCreatedAt: oldest?.created_at || null,
+    nextBeforeSource: oldest?.history_source || null,
+    nextBeforeId: oldest?.id?.toString() || null,
+  });
 });
 
 // Create new agent run
@@ -130,6 +309,7 @@ router.post('/', async (req, res) => {
 
     res.json(result);
   } catch (err) {
+    console.error('[Agents] Run failed:', err?.stack || err);
     res.status(err?.statusCode || err?.status || 500).json({
       error: sanitizeError(err),
       code: err?.code,
@@ -145,8 +325,9 @@ router.get('/:id', (req, res) => {
 
   const steps = db.prepare('SELECT * FROM agent_steps WHERE run_id = ? ORDER BY step_index ASC').all(run.id);
   const history = db.prepare('SELECT * FROM conversation_history WHERE agent_run_id = ? ORDER BY created_at ASC').all(run.id);
+  const usage = buildRunUsageSummary(run.id);
 
-  res.json({ run, steps, history });
+  res.json({ run, steps, history, usage });
 });
 
 // Get detailed steps for a run (for activity history replay)
@@ -180,8 +361,9 @@ router.get('/:id/steps', (req, res) => {
     || latestHistoryAssistant?.content
     || run.final_response
     || null;
+  const usage = buildRunUsageSummary(run.id);
 
-  res.json({ run, steps, events: listRunEvents(run.id), response });
+  res.json({ run, steps, events: listRunEvents(run.id), response, usage });
 });
 
 // Abort a run

package/server/routes/billing.js

@@ -0,0 +1,127 @@
+'use strict';
+
+const express = require('express');
+const router = express.Router();
+const db = require('../db/database');
+const { requireAuth } = require('../middleware/auth');
+const { requireBilling } = require('../middleware/requireBilling');
+const { getStripeConfig } = require('../services/billing/config');
+const { listPlans } = require('../services/billing/plans');
+const subs = require('../services/billing/subscriptions');
+const { getStripeClient } = require('../services/billing/stripe_client');
+
+function isValidHttpsUrl(value) {
+  try {
+    const u = new URL(value);
+    return u.protocol === 'https:' || u.protocol === 'http:';
+  } catch {
+    return false;
+  }
+}
+
+router.use(requireBilling);
+
+// Public — pricing page needs this without login.
+router.get('/plans', (req, res) => {
+  try {
+    res.json({ plans: listPlans() });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+// All remaining routes require authentication.
+router.use(requireAuth);
+
+router.get('/', (req, res) => {
+  try {
+    const userId = req.session.userId;
+    const subscription = subs.getActiveSubscription(userId);
+    const { publicKey } = getStripeConfig();
+    res.json({ subscription, stripePublishableKey: publicKey || null });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+router.post('/checkout', async (req, res) => {
+  try {
+    const { planId, successUrl, cancelUrl } = req.body;
+    if (!planId || !successUrl || !cancelUrl) {
+      return res.status(400).json({ error: 'planId, successUrl and cancelUrl are required.' });
+    }
+    if (!isValidHttpsUrl(successUrl) || !isValidHttpsUrl(cancelUrl)) {
+      return res.status(400).json({ error: 'successUrl and cancelUrl must be valid URLs.' });
+    }
+    const url = await subs.createCheckoutSession(req.session.userId, planId, successUrl, cancelUrl);
+    res.json({ url });
+  } catch (err) {
+    res.status(err.statusCode || 500).json({ error: err.message });
+  }
+});
+
+router.post('/portal', async (req, res) => {
+  try {
+    const { returnUrl } = req.body;
+    if (!returnUrl) return res.status(400).json({ error: 'returnUrl is required.' });
+    if (!isValidHttpsUrl(returnUrl)) {
+      return res.status(400).json({ error: 'returnUrl must be a valid URL.' });
+    }
+    const url = await subs.createCustomerPortalSession(req.session.userId, returnUrl);
+    res.json({ url });
+  } catch (err) {
+    res.status(err.statusCode || 500).json({ error: err.message });
+  }
+});
+
+router.post('/trial', async (req, res) => {
+  try {
+    const { planId, deviceFingerprint } = req.body;
+    if (!planId) return res.status(400).json({ error: 'planId is required.' });
+    if (deviceFingerprint !== undefined) {
+      if (typeof deviceFingerprint !== 'string' || deviceFingerprint.length > 256 || !/^[a-zA-Z0-9_+/=.-]{1,256}$/.test(deviceFingerprint)) {
+        return res.status(400).json({ error: 'Invalid deviceFingerprint.' });
+      }
+    }
+    const ip = req.ip || req.socket?.remoteAddress;
+    const result = await subs.startTrial(req.session.userId, planId, { ip, deviceFp: deviceFingerprint });
+    res.json({ subscription: result.subscription });
+  } catch (err) {
+    res.status(err.statusCode || 500).json({ error: err.message });
+  }
+});
+
+router.post('/cancel', async (req, res) => {
+  try {
+    await subs.cancelSubscription(req.session.userId);
+    res.json({ ok: true });
+  } catch (err) {
+    res.status(err.statusCode || 500).json({ error: err.message });
+  }
+});
+
+router.get('/invoices', async (req, res) => {
+  try {
+    const stripe = getStripeClient();
+    const userId = req.session.userId;
+    const customer = db
+      .prepare('SELECT stripe_customer_id FROM billing_customers WHERE user_id = ?')
+      .get(userId);
+    if (!customer?.stripe_customer_id) return res.json({ invoices: [] });
+    const list = await stripe.invoices.list({ customer: customer.stripe_customer_id, limit: 12 });
+    const invoices = list.data.map((inv) => ({
+      id: inv.id,
+      amount_paid: inv.amount_paid,
+      currency: inv.currency,
+      status: inv.status,
+      created: inv.created,
+      hosted_invoice_url: inv.hosted_invoice_url,
+      invoice_pdf: inv.invoice_pdf,
+    }));
+    res.json({ invoices });
+  } catch (err) {
+    res.status(err.statusCode || 500).json({ error: err.message });
+  }
+});
+
+module.exports = router;

package/server/routes/billing_webhook.js

@@ -0,0 +1,43 @@
+'use strict';
+
+const express = require('express');
+const router = express.Router();
+const { isBillingEnabled, getStripeConfig } = require('../services/billing/config');
+const { getStripeClient } = require('../services/billing/stripe_client');
+const { handleWebhookEvent } = require('../services/billing/subscriptions');
+
+// Raw body required for Stripe signature verification — applied inline.
+router.post('/', express.raw({ type: 'application/json' }), async (req, res) => {
+  if (!isBillingEnabled()) return res.status(404).json({ error: 'Billing is not enabled.' });
+
+  const sig = req.headers['stripe-signature'];
+  if (!sig) {
+    return res.status(400).json({ error: 'Missing stripe-signature header.' });
+  }
+
+  const { webhookSecret } = getStripeConfig();
+  if (!webhookSecret) {
+    console.warn('[billing] STRIPE_WEBHOOK_SECRET is not set; rejecting webhook.');
+    return res.status(500).json({ error: 'Webhook secret not configured.' });
+  }
+
+  let event;
+  try {
+    const stripe = getStripeClient();
+    event = stripe.webhooks.constructEvent(req.body, sig, webhookSecret);
+  } catch (err) {
+    console.warn('[billing] Webhook signature verification failed:', err.message);
+    return res.status(400).json({ error: `Webhook error: ${err.message}` });
+  }
+
+  try {
+    await handleWebhookEvent(event);
+  } catch (err) {
+    console.error('[billing] Webhook handler error:', err);
+    // Still return 200 so Stripe does not retry immediately for handler bugs.
+  }
+
+  res.json({ received: true });
+});
+
+module.exports = router;

package/server/routes/memory.js

@@ -1,6 +1,7 @@
 const express = require('express');
 const router = express.Router();
 const rateLimit = require('express-rate-limit');
+const db = require('../db/database');
 const { requireAuth } = require('../middleware/auth');
 const { sanitizeError } = require('../utils/security');
 const { getAgentIdFromRequest, resolveAgentId } = require('../services/agents/manager');
@@ -317,7 +318,6 @@ router.post('/memories', async (req, res) => {
 // Update a memory
 router.put('/memories/:id', async (req, res) => {
   const mm = req.app.locals.memoryManager;
-  const db = require('../db/database');
   // Verify ownership before updating
   const agentId = resolveAgentId(req.session.userId, getAgentIdFromRequest(req));
   const existing = db.prepare('SELECT id FROM memories WHERE id = ? AND user_id = ? AND agent_id = ?').get(req.params.id, req.session.userId, agentId);
@@ -335,7 +335,6 @@ router.put('/memories/:id', async (req, res) => {
 // Delete a memory
 router.delete('/memories/:id', (req, res) => {
   const mm = req.app.locals.memoryManager;
-  const db = require('../db/database');
   // Verify ownership before deleting
   const agentId = resolveAgentId(req.session.userId, getAgentIdFromRequest(req));
   const existing = db.prepare('SELECT id FROM memories WHERE id = ? AND user_id = ? AND agent_id = ?').get(req.params.id, req.session.userId, agentId);
@@ -346,7 +345,6 @@ router.delete('/memories/:id', (req, res) => {
 
 router.post('/memories/bulk-delete', (req, res) => {
   const mm = req.app.locals.memoryManager;
-  const db = require('../db/database');
   const ids = normalizeMemoryIds(req.body?.ids);
   if (!ids.length) {
     return res.status(400).json({ error: 'ids is required' });
@@ -366,7 +364,6 @@ router.post('/memories/bulk-delete', (req, res) => {
 
 router.post('/memories/bulk-archive', (req, res) => {
   const mm = req.app.locals.memoryManager;
-  const db = require('../db/database');
   const ids = normalizeMemoryIds(req.body?.ids);
   const archived = req.body?.archived !== false;
   if (!ids.length) {

package/server/routes/settings.js

@@ -34,6 +34,7 @@ const {
 } = require('../services/runtime/settings');
 const { isManagedDeployment } = require('../utils/deployment');
 const { getAgentIdFromRequest, isMainAgent, resolveAgentId } = require('../services/agents/manager');
+const { getProviderHealthCatalog, getSupportedModels } = require('../services/ai/models');
 
 const AGENT_SETTING_KEYS = new Set([
   'cost_mode',
@@ -193,14 +194,12 @@ async function resetEnvBackedSettingValue(req, key) {
 
 // Get supported models metadata
 router.get('/meta/models', async (req, res) => {
-  const { getSupportedModels } = require('../services/ai/models');
   const agentId = resolveAgentId(req.session.userId, getAgentIdFromRequest(req));
   const models = await getSupportedModels(req.session.userId, agentId);
   res.json({ models });
 });
 
 router.get('/meta/ai-providers', async (req, res) => {
-  const { getProviderHealthCatalog, getSupportedModels } = require('../services/ai/models');
   const agentId = resolveAgentId(req.session.userId, getAgentIdFromRequest(req));
   const [providers, models] = await Promise.all([
     getProviderHealthCatalog(req.session.userId, agentId),

package/server/routes/skills.js

@@ -1,3 +1,4 @@
+const fs = require('fs');
 const express = require('express');
 const router = express.Router();
 const { requireAuth } = require('../middleware/auth');
@@ -109,7 +110,6 @@ router.get('/:name', async (req, res) => {
     const runner = await getSkillRunner(req.app);
     const skill = runner.getSkill(req.params.name, req.session.userId);
     if (!skill) return res.status(404).json({ error: 'Skill not found' });
-    const fs = require('fs');
     const content = fs.readFileSync(skill.filePath, 'utf-8');
     res.json({
       name: skill.name,

package/server/routes/triggers.js

@@ -16,7 +16,7 @@ router.post('/geofence', async (req, res) => {
     const userRow = db.prepare('SELECT id FROM users WHERE id = ?').get(req.session.userId);
     if (!userRow) return res.status(401).json({ error: 'Unauthorized' });
 
-    console.log(`[Triggers] Geofence entered: ${label} by user ${req.session.userId}`);
+    console.log(`[Triggers] Geofence event for user ${req.session.userId}`);
 
     res.json({ success: true, message: 'Geofence trigger processed' });
   } catch (err) {
@@ -51,7 +51,7 @@ router.post('/notification', async (req, res) => {
     const userRow = db.prepare('SELECT id FROM users WHERE id = ?').get(req.session.userId);
     if (!userRow) return res.status(401).json({ error: 'Unauthorized' });
 
-    console.log(`[Triggers] Notification received: ${app_package} - ${title} for user ${req.session.userId}`);
+    console.log(`[Triggers] Notification event for user ${req.session.userId}`);
 
     db.prepare(`
       INSERT INTO notification_history (user_id, app_package, title, body, action_taken)