neoagent 3.0.1-beta.20 → 3.0.1-beta.21

package/server/routes/account.js

@@ -328,4 +328,57 @@ router.delete('/providers/:id', accountLimiter, (req, res) => {
   }
 });
 
+// GDPR Art. 20 — data portability. Returns a structured export of the
+// authenticated user's own data (credential columns redacted).
+router.get('/export', accountLimiter, (req, res) => {
+  try {
+    const { exportUserData } = require('../services/account/erasure');
+    const payload = exportUserData(req.session.userId);
+    res.setHeader('Content-Type', 'application/json; charset=utf-8');
+    res.setHeader(
+      'Content-Disposition',
+      `attachment; filename="neoagent-data-export-${req.session.userId}.json"`,
+    );
+    res.send(JSON.stringify(payload, null, 2));
+  } catch (err) {
+    sendRouteError(res, err);
+  }
+});
+
+// GDPR Art. 17 — right to erasure. The user permanently deletes their own
+// account and all associated data. Requires typing the exact username as a
+// destructive-action confirmation (works for password and SSO accounts alike).
+router.post('/delete', accountLimiter, (req, res) => {
+  try {
+    const userId = req.session.userId;
+    const user = db
+      .prepare('SELECT username FROM users WHERE id = ?')
+      .get(userId);
+    if (!user) {
+      return res.status(404).json({ error: 'Account not found.' });
+    }
+    const confirm = String(req.body?.confirmUsername || '').trim();
+    if (confirm !== user.username) {
+      return res.status(400).json({
+        error: 'Confirmation does not match your username.',
+      });
+    }
+
+    const { eraseUserData } = require('../services/account/erasure');
+    const result = eraseUserData(userId, {
+      runtimeManager: req.app.locals.runtimeManager,
+    });
+
+    req.session.destroy(() => {
+      res.clearCookie('neoagent.sid');
+      res.json({ ok: true, tablesCleared: result.tablesCleared });
+    });
+  } catch (err) {
+    if (err.code === 'NOT_FOUND') {
+      return res.status(404).json({ error: 'Account not found.' });
+    }
+    sendRouteError(res, err);
+  }
+});
+
 module.exports = router;

package/server/routes/admin.js

@@ -563,59 +563,16 @@ router.get('/api/users', requireAdminAuth, (req, res) => {
 });
 
 router.delete('/api/users/:id', requireAdminAuth, (req, res) => {
-  const db = require('../db/database');
-  const { DATA_DIR } = require('../../runtime/paths');
+  const { eraseUserData } = require('../services/account/erasure');
   const { id } = req.params;
   if (!id) return res.status(400).json({ error: 'Missing user id' });
   if (!/^\d+$/.test(id)) return res.status(400).json({ error: 'Invalid user id' });
   try {
-    const user = db.prepare('SELECT id FROM users WHERE id = ?').get(id);
-    if (!user) return res.status(404).json({ error: 'User not found' });
-
-    // Collect artifact paths before deletion
-    const artifacts = db.prepare('SELECT storage_path FROM artifacts WHERE user_id = ?').all(id);
-
-    const erase = db.transaction((uid) => {
-      db.prepare('DELETE FROM conversation_messages WHERE conversation_id IN (SELECT id FROM conversations WHERE user_id = ?)').run(uid);
-      db.prepare('DELETE FROM conversations WHERE user_id = ?').run(uid);
-      db.prepare('DELETE FROM agent_steps WHERE run_id IN (SELECT id FROM agent_runs WHERE user_id = ?)').run(uid);
-      db.prepare('DELETE FROM agent_runs WHERE user_id = ?').run(uid);
-      db.prepare('DELETE FROM messages WHERE user_id = ?').run(uid);
-      db.prepare('DELETE FROM memories WHERE user_id = ?').run(uid);
-      db.prepare('DELETE FROM integration_connections WHERE user_id = ?').run(uid);
-      db.prepare('DELETE FROM platform_connections WHERE user_id = ?').run(uid);
-      db.prepare('DELETE FROM mcp_servers WHERE user_id = ?').run(uid);
-      db.prepare('DELETE FROM user_settings WHERE user_id = ?').run(uid);
-      db.prepare('DELETE FROM user_sessions WHERE user_id = ?').run(uid);
-      db.prepare('DELETE FROM desktop_companion_devices WHERE user_id = ?').run(uid);
-      db.prepare('DELETE FROM scheduled_tasks WHERE user_id = ?').run(uid);
-      db.prepare('DELETE FROM recording_sessions WHERE user_id = ?').run(uid);
-      db.prepare('DELETE FROM screen_history WHERE user_id = ?').run(uid);
-      db.prepare('DELETE FROM agents WHERE user_id = ?').run(uid);
-      db.prepare('DELETE FROM artifacts WHERE user_id = ?').run(uid);
-      db.prepare('DELETE FROM users WHERE id = ?').run(uid);
-    });
-    erase(id);
-
-    // Clean up artifact files on disk — containment-checked
-    const artifactsRoot = path.resolve(path.join(DATA_DIR, 'artifacts'));
-    for (const artifact of artifacts) {
-      try {
-        const abs = path.resolve(path.isAbsolute(artifact.storage_path)
-          ? artifact.storage_path
-          : path.join(DATA_DIR, artifact.storage_path));
-        if (abs.startsWith(artifactsRoot + path.sep)) {
-          fs.rmSync(abs, { force: true });
-        }
-      } catch {}
-    }
-    const userArtifactDir = path.resolve(path.join(DATA_DIR, 'artifacts', id));
-    if (userArtifactDir.startsWith(artifactsRoot + path.sep)) {
-      try { fs.rmSync(userArtifactDir, { recursive: true, force: true }); } catch {}
-    }
-
-    res.json({ ok: true });
+    const result = eraseUserData(id, { runtimeManager: req.app.locals.runtimeManager });
+    res.json(result);
   } catch (err) {
+    if (err.code === 'NOT_FOUND') return res.status(404).json({ error: 'User not found' });
+    if (err.code === 'INVALID_ID') return res.status(400).json({ error: 'Invalid user id' });
     res.status(500).json({ error: String(err.message || err) });
   }
 });

package/server/services/account/erasure.js

@@ -0,0 +1,263 @@
+'use strict';
+
+// Complete, schema-driven erasure and export of a single user's data.
+//
+// Both the admin "GDPR: delete all user data" action and the self-service
+// account-deletion endpoint go through eraseUserData() so the two can never
+// drift apart. Rather than hand-maintain a list of tables (which previously
+// missed billing, 2FA, embeddings and other user-scoped tables), we discover
+// every table that has a `user_id` column at runtime via PRAGMA table_info and
+// clear all of them. Child tables that are keyed by a parent id instead of
+// user_id are cleared explicitly below.
+
+const fs = require('fs');
+const path = require('path');
+const db = require('../../db/database');
+const sessionsDb = require('../../db/sessions_db');
+const { DATA_DIR, AGENT_DATA_DIR } = require('../../../runtime/paths');
+const { sanitizeWorkspaceKey } = require('../workspace/manager');
+
+// Tables that carry a `user_id` column but are global/shared configuration and
+// must never be deleted as part of erasing one user.
+const GLOBAL_TABLES = new Set(['billing_plans']);
+
+// Column names whose values are credentials/secrets and must be redacted from a
+// portability export (the user already controls these; echoing them back adds
+// risk without adding portability value).
+const SENSITIVE_COLUMN = /pass|secret|token|hash|cipher|encrypt|_iv$|nonce|totp|recovery|priv(ate)?_?key|api_?key|credential/i;
+
+function userScopedTables() {
+  const rows = db
+    .prepare("SELECT name FROM sqlite_master WHERE type = 'table'")
+    .all();
+  const tables = [];
+  for (const { name } of rows) {
+    if (name === 'users' || GLOBAL_TABLES.has(name) || name.startsWith('admin_')) {
+      continue;
+    }
+    if (name.startsWith('sqlite_')) {
+      continue;
+    }
+    let columns;
+    try {
+      columns = db.prepare(`PRAGMA table_info(${name})`).all();
+    } catch {
+      continue;
+    }
+    if (columns.some((column) => column.name === 'user_id')) {
+      tables.push(name);
+    }
+  }
+  return tables;
+}
+
+// Child tables keyed by a parent id rather than user_id. Foreign keys are
+// declared ON DELETE CASCADE, so with PRAGMA foreign_keys = ON these are removed
+// automatically when the parent row goes — but we delete them explicitly first
+// so erasure is correct even if foreign keys are ever disabled.
+function deleteChildRows(uid) {
+  const childDeletes = [
+    'DELETE FROM conversation_messages WHERE conversation_id IN (SELECT id FROM conversations WHERE user_id = ?)',
+    'DELETE FROM agent_steps WHERE run_id IN (SELECT id FROM agent_runs WHERE user_id = ?)',
+    'DELETE FROM ai_widget_snapshots WHERE widget_id IN (SELECT id FROM ai_widgets WHERE user_id = ?)',
+    'DELETE FROM recording_transcript_segments WHERE session_id IN (SELECT id FROM recording_sessions WHERE user_id = ?)',
+    'DELETE FROM recording_chunks WHERE source_id IN (SELECT s.id FROM recording_sources s JOIN recording_sessions rs ON s.session_id = rs.id WHERE rs.user_id = ?)',
+    'DELETE FROM recording_sources WHERE session_id IN (SELECT id FROM recording_sessions WHERE user_id = ?)',
+    'DELETE FROM memory_source_links WHERE memory_id IN (SELECT id FROM memories WHERE user_id = ?)',
+  ];
+  for (const sql of childDeletes) {
+    try {
+      db.prepare(sql).run(uid);
+    } catch {
+      // Table may not exist on older schema versions — ignore.
+    }
+  }
+}
+
+function collectArtifactPaths(uid) {
+  try {
+    return db
+      .prepare('SELECT storage_path FROM artifacts WHERE user_id = ?')
+      .all(uid)
+      .map((row) => row.storage_path)
+      .filter(Boolean);
+  } catch {
+    return [];
+  }
+}
+
+function removeArtifactFiles(uid, storagePaths) {
+  const artifactsRoot = path.resolve(path.join(DATA_DIR, 'artifacts'));
+  for (const storagePath of storagePaths) {
+    try {
+      const abs = path.resolve(
+        path.isAbsolute(storagePath) ? storagePath : path.join(DATA_DIR, storagePath),
+      );
+      if (abs.startsWith(artifactsRoot + path.sep)) {
+        fs.rmSync(abs, { force: true });
+      }
+    } catch {
+      /* best effort */
+    }
+  }
+  const userArtifactDir = path.resolve(path.join(DATA_DIR, 'artifacts', String(uid)));
+  if (userArtifactDir.startsWith(artifactsRoot + path.sep)) {
+    try {
+      fs.rmSync(userArtifactDir, { recursive: true, force: true });
+    } catch {
+      /* best effort */
+    }
+  }
+}
+
+function removeWorkspaceDir(uid) {
+  const workspacesRoot = path.resolve(path.join(AGENT_DATA_DIR, 'workspaces'));
+  const workspaceDir = path.resolve(
+    path.join(workspacesRoot, sanitizeWorkspaceKey(uid)),
+  );
+  if (workspaceDir.startsWith(workspacesRoot + path.sep)) {
+    try {
+      fs.rmSync(workspaceDir, { recursive: true, force: true });
+    } catch {
+      /* best effort */
+    }
+  }
+}
+
+function purgeSessionStore(uid) {
+  // better-sqlite3-session-store keeps a `sessions` table whose `sess` column is
+  // the JSON-serialised session. Remove any row belonging to this user so their
+  // login is invalidated everywhere immediately.
+  for (const needle of [`%"userId":${uid}%`, `%"userId":"${uid}"%`]) {
+    try {
+      sessionsDb.prepare('DELETE FROM sessions WHERE sess LIKE ?').run(needle);
+    } catch {
+      /* table/store may differ — best effort */
+    }
+  }
+}
+
+function killUserRuntime(uid, runtimeManager) {
+  try {
+    const vmManager = runtimeManager?.browserBackend?.vmManager;
+    if (vmManager && typeof vmManager.killVm === 'function') {
+      // Fire-and-forget: container teardown should not block the HTTP response.
+      Promise.resolve(vmManager.killVm(String(uid))).catch(() => {});
+    }
+  } catch {
+    /* best effort */
+  }
+}
+
+/**
+ * Permanently erase all data belonging to a user (GDPR Art. 17).
+ *
+ * @param {number|string} userId
+ * @param {object} [opts]
+ * @param {object} [opts.runtimeManager] live RuntimeManager so the user's
+ *   sandbox container can be torn down as part of erasure.
+ * @returns {{ ok: true, tablesCleared: number }}
+ */
+function eraseUserData(userId, opts = {}) {
+  const uid = Number(userId);
+  if (!Number.isInteger(uid) || uid <= 0) {
+    const error = new Error('Invalid user id');
+    error.code = 'INVALID_ID';
+    throw error;
+  }
+  const exists = db.prepare('SELECT id FROM users WHERE id = ?').get(uid);
+  if (!exists) {
+    const error = new Error('User not found');
+    error.code = 'NOT_FOUND';
+    throw error;
+  }
+
+  const artifactPaths = collectArtifactPaths(uid);
+  const tables = userScopedTables();
+
+  const erase = db.transaction(() => {
+    deleteChildRows(uid);
+    for (const table of tables) {
+      // `table` comes from sqlite_master introspection, never from user input.
+      db.prepare(`DELETE FROM ${table} WHERE user_id = ?`).run(uid);
+    }
+    db.prepare('DELETE FROM users WHERE id = ?').run(uid);
+  });
+  erase();
+
+  // Off-database state: files on disk, the running sandbox, and active sessions.
+  removeArtifactFiles(uid, artifactPaths);
+  removeWorkspaceDir(uid);
+  purgeSessionStore(uid);
+  killUserRuntime(uid, opts.runtimeManager);
+
+  return { ok: true, tablesCleared: tables.length };
+}
+
+function redactRow(row) {
+  const out = {};
+  for (const [key, value] of Object.entries(row)) {
+    out[key] = SENSITIVE_COLUMN.test(key) && value != null ? '[redacted]' : value;
+  }
+  return out;
+}
+
+/**
+ * Build a structured, machine-readable export of a user's personal data
+ * (GDPR Art. 20 data portability). Credential/secret columns are redacted.
+ *
+ * @param {number|string} userId
+ * @returns {object}
+ */
+function exportUserData(userId) {
+  const uid = Number(userId);
+  if (!Number.isInteger(uid) || uid <= 0) {
+    const error = new Error('Invalid user id');
+    error.code = 'INVALID_ID';
+    throw error;
+  }
+  const user = db.prepare('SELECT * FROM users WHERE id = ?').get(uid);
+  if (!user) {
+    const error = new Error('User not found');
+    error.code = 'NOT_FOUND';
+    throw error;
+  }
+
+  const data = { account: redactRow(user) };
+  for (const table of userScopedTables()) {
+    try {
+      const rows = db.prepare(`SELECT * FROM ${table} WHERE user_id = ?`).all(uid);
+      if (rows.length > 0) {
+        data[table] = rows.map(redactRow);
+      }
+    } catch {
+      /* skip unreadable table */
+    }
+  }
+  // Conversation messages are keyed by conversation id, not user_id.
+  try {
+    const messages = db
+      .prepare(
+        'SELECT m.* FROM conversation_messages m JOIN conversations c ON m.conversation_id = c.id WHERE c.user_id = ?',
+      )
+      .all(uid);
+    if (messages.length > 0) {
+      data.conversation_messages = messages.map(redactRow);
+    }
+  } catch {
+    /* best effort */
+  }
+
+  return {
+    exportedAt: new Date().toISOString(),
+    schema: 'neoagent.user-export.v1',
+    userId: uid,
+    data,
+  };
+}
+
+module.exports = {
+  eraseUserData,
+  exportUserData,
+  userScopedTables,
+};

package/server/services/android/controller.js

@@ -582,7 +582,8 @@ class AndroidController {
     });
 
     progress('Waiting for Android to boot (can take 2–5 min on first run)…');
-    await this.#waitForBoot();
+    // Abort early if the emulator process dies, instead of polling until timeout.
+    await this.#waitForBoot({ isAlive: () => this.#isPidAlive(proc.pid) });
 
     writeState(this.userId, { bootstrapped: true, starting: false, startupPhase: null, lastStartError: null });
     console.log(`[Android] Emulator ready on ${this.adbSerial}`);
@@ -593,10 +594,13 @@ class AndroidController {
     });
   }
 
-  async #waitForBoot(timeoutMs = 10 * 60 * 1000) {
+  async #waitForBoot({ timeoutMs = 10 * 60 * 1000, isAlive = () => true } = {}) {
     const adb = adbBin(this.sdkDir);
     const deadline = Date.now() + timeoutMs;
     while (Date.now() < deadline) {
+      if (!isAlive()) {
+        throw new Error('Emulator process exited before Android finished booting (check virtualization/KVM support and the system image).');
+      }
       try {
         const r = spawnSync(adb, ['-s', this.adbSerial, 'shell', 'getprop', 'sys.boot_completed'], { encoding: 'utf8', timeout: 5000 });
         if (r.stdout?.trim() === '1') return;