neoagent 3.0.1-beta.5 → 3.0.1-beta.7

package/README.md

@@ -43,9 +43,8 @@ npm install -g neoagent
 neoagent install
 ```
 
-<p>
+<p align="center">
   <a href="https://github.com/NeoLabs-Systems/NeoAgent/releases/latest"><img alt="Download macOS app" src="https://img.shields.io/badge/macOS_app-download-black?style=flat-square&logo=apple&logoColor=white"></a>
-  &nbsp;The macOS desktop app includes a graphical installer — open it and use the <strong>Server</strong> tab instead of the CLI.
 </p>
 
 Open `http://localhost:3333`, create the first account, and configure a model.

package/landing/index.html

@@ -910,7 +910,7 @@ p { margin: 0; text-wrap: pretty; }
   <div class="wrap">
     <div class="hero-grid">
       <div class="hero-copy">
-        <div class="pill"><span class="tag">New</span> <b>NeoAgent is now in private beta</b></div>
+        <div class="pill"><span class="tag">New</span> <b>NeoAgent is now in beta</b></div>
         <h1>
           <span class="h1-line"><span class="w" style="--i:0">One</span> <span class="w" style="--i:1">agent</span> <span class="w" style="--i:2">for</span> <span class="w" style="--i:3">your</span></span>
           <span class="h1-line"><span class="w" style="--i:4"><em>whole</em></span> <span class="w" style="--i:5"><em>digital</em></span> <span class="w" style="--i:6"><em>life</em></span></span>
@@ -1194,7 +1194,7 @@ p { margin: 0; text-wrap: pretty; }
 <section class="section-tight" id="cta" data-screen-label="cta">
   <div class="wrap">
     <div class="final reveal">
-      <span class="eyebrow" style="display:block;margin-bottom:20px;">Private beta · Limited spots</span>
+      <span class="eyebrow" style="display:block;margin-bottom:20px;">Beta · Limited spots</span>
       <h2>The agent that just <em>handles it.</em></h2>
       <p>Be first to put NeoAgent to work across your devices, channels, and life. We'll send your invite as spots open up.</p>
       <div class="hero-actions" style="justify-content:center;">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neoagent",
-  "version": "3.0.1-beta.5",
+  "version": "3.0.1-beta.7",
   "description": "Self-hosted AI agent for long-running tasks, automation, messaging, device control, and local memory",
   "license": "AGPL-3.0-only",
   "main": "server/index.js",
@@ -54,7 +54,8 @@
     "benchmark:tokens": "node scripts/benchmark-token-cost.js",
     "benchmark:memory": "node scripts/benchmark-memory.js",
     "benchmark:memorybench:install": "node scripts/install-memorybench-provider.js",
-    "release": "npx semantic-release"
+    "release": "npx semantic-release",
+    "audit:ci": "npm audit --omit=dev --audit-level=high"
   },
   "repository": {
     "type": "git",
@@ -103,7 +104,7 @@
     "telnyx": "^5.51.0",
     "tesseract.js": "^7.0.0",
     "uuid": "^11.1.0",
-    "ws": "^8.19.0"
+    "ws": "^8.21.0"
   },
   "overrides": {
     "axios": "^1.15.2",
@@ -113,7 +114,8 @@
     "protobufjs": "^7.5.5",
     "serialize-javascript": "^7.0.5",
     "undici": "^6.24.0",
-    "webpackbar": "^7.0.0"
+    "webpackbar": "^7.0.0",
+    "ws": "^8.21.0"
   },
   "devDependencies": {
     "@docusaurus/core": "3.10.0",

package/server/db/database.js

@@ -1879,7 +1879,7 @@ function migrateIntegrationProviderConfigsTable() {
 }
 
 function migrateIntegrationSecretStorage() {
-  try {
+  const migrate = db.transaction(() => {
     const connectionRows = db
       .prepare('SELECT id, credentials_json FROM integration_connections')
       .all();
@@ -1891,11 +1891,7 @@ function migrateIntegrationSecretStorage() {
       if (!current || isEncryptedValue(current)) continue;
       updateConnection.run(encryptValue(current), row.id);
     }
-  } catch {
-    // Preserve startup even if a row cannot be re-encrypted.
-  }
 
-  try {
     const stateRows = db
       .prepare('SELECT id, code_verifier FROM integration_oauth_states')
       .all();
@@ -1907,11 +1903,7 @@ function migrateIntegrationSecretStorage() {
       if (!current || isEncryptedValue(current)) continue;
       updateState.run(encryptValue(current), row.id);
     }
-  } catch {
-    // Preserve startup even if a row cannot be re-encrypted.
-  }
 
-  try {
     const providerRows = db
       .prepare('SELECT id, config_json FROM integration_provider_configs')
       .all();
@@ -1923,8 +1915,13 @@ function migrateIntegrationSecretStorage() {
       if (!current || isEncryptedValue(current)) continue;
       updateProviderConfig.run(encryptValue(current), row.id);
     }
-  } catch {
-    // Preserve startup even if a row cannot be re-encrypted.
+  });
+
+  try {
+    migrate();
+  } catch (err) {
+    console.error('[DB] Integration secret migration failed — startup cannot continue with partially migrated secrets:', err.message);
+    throw err;
   }
 }
 

package/server/db/sessions_db.js

@@ -0,0 +1,8 @@
+'use strict';
+
+const Sqlite = require('better-sqlite3');
+const { DATA_DIR } = require('../../runtime/paths');
+
+const sessionsDb = new Sqlite(`${DATA_DIR}/sessions.db`);
+
+module.exports = sessionsDb;

package/server/http/middleware.js

@@ -1,15 +1,13 @@
 'use strict';
 
 const session = require('express-session');
-const Sqlite = require('better-sqlite3');
 const SQLiteStore = require('better-sqlite3-session-store')(session);
 const helmet = require('helmet');
 const cors = require('cors');
-const { DATA_DIR } = require('../../runtime/paths');
 const { logRequestSummary } = require('../utils/logger');
 const { getSessionSecret } = require('../services/account/session_secret');
 
-const sessionsDb = new Sqlite(`${DATA_DIR}/sessions.db`);
+const sessionsDb = require('../db/sessions_db');
 const LEGACY_SESSION_EXPIRE_FALLBACK = 0;
 
 function boolEnv(name, fallback = false) {
@@ -89,7 +87,9 @@ function buildHelmetOptions({ secureCookies }) {
   }
 
   return {
-    strictTransportSecurity: false,
+    strictTransportSecurity: secureCookies
+      ? { maxAge: Number(process.env.NEOAGENT_HSTS_MAX_AGE ?? 86400), includeSubDomains: false }
+      : false,
     crossOriginOpenerPolicy: false,
     crossOriginResourcePolicy: { policy: 'same-site' },
     originAgentCluster: false,

package/server/public/.last_build_id

@@ -1 +1 @@
-5a04b7963f3a3e683486fb212ebbfe09
+60f1b48c2d24c4a137efc1a6529d413f

package/server/public/flutter_bootstrap.js

@@ -37,6 +37,6 @@ _flutter.buildConfig = {"engineRevision":"77e2e94772b6eb43759e34ed1ad7da4674e19c
 
 _flutter.loader.load({
   serviceWorkerSettings: {
-    serviceWorkerVersion: "68949357" /* Flutter's service worker is deprecated and will be removed in a future Flutter release. */
+    serviceWorkerVersion: "2202305600" /* Flutter's service worker is deprecated and will be removed in a future Flutter release. */
   }
 });

package/server/public/main.dart.js

@@ -135597,7 +135597,7 @@ r===$&&A.b()
 p.push(A.jV(q,A.jd(!1,new A.a_(B.uM,A.db(new A.cC(B.jA,new A.a89(r,q),q),q,q),q),!1,B.I,!0),q,q,0,0,0,q))}r=!1
 if(!s.ay)if(!s.ch){r=s.e
 r===$&&A.b()
-r=B.b.u("mqimox8o-0a587b7").length!==0&&r.b}if(r){r=s.d
+r=B.b.u("mqj7s6w1-467cdbb").length!==0&&r.b}if(r){r=s.d
 r===$&&A.b()
 r=r.aP&&!r.ai?84:0
 s=s.e
@@ -141319,7 +141319,7 @@ $S:0}
 A.a_p.prototype={}
 A.T7.prototype={
 nd(a){var s=this
-if(B.b.u("mqimox8o-0a587b7").length===0||s.a!=null)return
+if(B.b.u("mqj7s6w1-467cdbb").length===0||s.a!=null)return
 s.B_()
 s.a=A.ot(B.S2,new A.bde(s))},
 B_(){var s=0,r=A.l(t.H),q,p=2,o=[],n=this,m,l,k,j,i,h,g,f
@@ -141337,7 +141337,7 @@ if(!t.f.b(k)){s=1
 break}i=J.a3(k,"buildId")
 h=i==null?null:B.b.u(J.p(i))
 j=h==null?"":h
-if(J.bj(j)===0||J.e(j,"mqimox8o-0a587b7")){s=1
+if(J.bj(j)===0||J.e(j,"mqj7s6w1-467cdbb")){s=1
 break}n.b=!0
 n.F()
 p=2
@@ -141354,7 +141354,7 @@ case 2:return A.i(o.at(-1),r)}})
 return A.k($async$B_,r)},
 vI(){var s=0,r=A.l(t.H),q,p=2,o=[],n=this,m,l,k,j,i,h,g,f,e,d,c,b,a,a0,a1
 var $async$vI=A.h(function(a2,a3){if(a2===1){o.push(a3)
-s=p}for(;;)switch(s){case 0:if(B.b.u("mqimox8o-0a587b7").length===0||n.c){s=1
+s=p}for(;;)switch(s){case 0:if(B.b.u("mqj7s6w1-467cdbb").length===0||n.c){s=1
 break}n.c=!0
 n.F()
 p=4

package/server/routes/admin.js

@@ -64,8 +64,11 @@ router.get('/login', (req, res) => {
 
 router.post('/api/login', loginLimiter, express.json(), async (req, res) => {
   const { username, password } = req.body || {};
-  const expectedUsername = process.env.ADMIN_USERNAME || 'admin';
-  const expectedPassword = process.env.ADMIN_PASSWORD || 'admin';
+  const expectedUsername = process.env.ADMIN_USERNAME;
+  const expectedPassword = process.env.ADMIN_PASSWORD;
+  if (!expectedUsername || !expectedPassword) {
+    return res.status(503).json({ error: 'Admin interface is not configured. Set ADMIN_USERNAME and ADMIN_PASSWORD environment variables.' });
+  }
   if (username !== expectedUsername || password !== expectedPassword) {
     return res.status(401).json({ error: 'Invalid credentials' });
   }
@@ -81,11 +84,14 @@ router.post('/api/login', loginLimiter, express.json(), async (req, res) => {
       res.json({ ok: false, requiresTwoFactor: true });
     });
   }
-  req.session.isAdmin = true;
-  req.session.cookie.maxAge = ADMIN_SESSION_TTL;
-  req.session.save((err) => {
+  req.session.regenerate((err) => {
     if (err) return res.status(500).json({ error: 'Session error' });
-    res.json({ ok: true });
+    req.session.isAdmin = true;
+    req.session.cookie.maxAge = ADMIN_SESSION_TTL;
+    req.session.save((saveErr) => {
+      if (saveErr) return res.status(500).json({ error: 'Session error' });
+      res.json({ ok: true });
+    });
   });
 });
 
@@ -99,12 +105,14 @@ router.post('/api/2fa/verify', loginLimiter, express.json(), async (req, res) =>
     const adminTwoFactor = require('../services/account/admin_two_factor');
     const valid = await adminTwoFactor.verifyCode(code);
     if (!valid) return res.status(401).json({ error: 'Invalid code — try again' });
-    req.session.adminPendingTwoFactor = false;
-    req.session.isAdmin = true;
-    req.session.cookie.maxAge = ADMIN_SESSION_TTL;
-    req.session.save((err) => {
+    req.session.regenerate((err) => {
       if (err) return res.status(500).json({ error: 'Session error' });
-      res.json({ ok: true });
+      req.session.isAdmin = true;
+      req.session.cookie.maxAge = ADMIN_SESSION_TTL;
+      req.session.save((saveErr) => {
+        if (saveErr) return res.status(500).json({ error: 'Session error' });
+        res.json({ ok: true });
+      });
     });
   } catch (err) {
     res.status(500).json({ error: err.message });
@@ -559,7 +567,11 @@ router.delete('/api/users/:id', requireAdminAuth, (req, res) => {
   const { DATA_DIR } = require('../../runtime/paths');
   const { id } = req.params;
   if (!id) return res.status(400).json({ error: 'Missing user id' });
+  if (!/^\d+$/.test(id)) return res.status(400).json({ error: 'Invalid user id' });
   try {
+    const user = db.prepare('SELECT id FROM users WHERE id = ?').get(id);
+    if (!user) return res.status(404).json({ error: 'User not found' });
+
     // Collect artifact paths before deletion
     const artifacts = db.prepare('SELECT storage_path FROM artifacts WHERE user_id = ?').all(id);
 
@@ -585,16 +597,22 @@ router.delete('/api/users/:id', requireAdminAuth, (req, res) => {
     });
     erase(id);
 
-    // Clean up artifact files on disk
+    // Clean up artifact files on disk — containment-checked
+    const artifactsRoot = path.resolve(path.join(DATA_DIR, 'artifacts'));
     for (const artifact of artifacts) {
       try {
-        const abs = path.isAbsolute(artifact.storage_path)
+        const abs = path.resolve(path.isAbsolute(artifact.storage_path)
           ? artifact.storage_path
-          : path.join(DATA_DIR, artifact.storage_path);
-        fs.rmSync(abs, { force: true });
+          : path.join(DATA_DIR, artifact.storage_path));
+        if (abs.startsWith(artifactsRoot + path.sep)) {
+          fs.rmSync(abs, { force: true });
+        }
       } catch {}
     }
-    try { fs.rmSync(path.join(DATA_DIR, 'artifacts', id), { recursive: true, force: true }); } catch {}
+    const userArtifactDir = path.resolve(path.join(DATA_DIR, 'artifacts', id));
+    if (userArtifactDir.startsWith(artifactsRoot + path.sep)) {
+      try { fs.rmSync(userArtifactDir, { recursive: true, force: true }); } catch {}
+    }
 
     res.json({ ok: true });
   } catch (err) {

package/server/routes/triggers.js

@@ -16,7 +16,7 @@ router.post('/geofence', async (req, res) => {
     const userRow = db.prepare('SELECT id FROM users WHERE id = ?').get(req.session.userId);
     if (!userRow) return res.status(401).json({ error: 'Unauthorized' });
 
-    console.log(`[Triggers] Geofence entered: ${label} by user ${req.session.userId}`);
+    console.log(`[Triggers] Geofence event for user ${req.session.userId}`);
 
     res.json({ success: true, message: 'Geofence trigger processed' });
   } catch (err) {
@@ -51,7 +51,7 @@ router.post('/notification', async (req, res) => {
     const userRow = db.prepare('SELECT id FROM users WHERE id = ?').get(req.session.userId);
     if (!userRow) return res.status(401).json({ error: 'Unauthorized' });
 
-    console.log(`[Triggers] Notification received: ${app_package} - ${title} for user ${req.session.userId}`);
+    console.log(`[Triggers] Notification event for user ${req.session.userId}`);
 
     db.prepare(`
       INSERT INTO notification_history (user_id, app_package, title, body, action_taken)

package/server/services/account/sessions.js

@@ -1,19 +1,11 @@
 'use strict';
 
 const crypto = require('crypto');
-const Sqlite = require('better-sqlite3');
-const { DATA_DIR } = require('../../../runtime/paths');
 const db = require('../../db/database');
+const sessionsDb = require('../../db/sessions_db');
 const { clientIpFromRequest, lookupIpLocation } = require('./geoip');
 const { getSessionSecret } = require('./session_secret');
 
-const sessionsDb = new Sqlite(`${DATA_DIR}/sessions.db`);
-try {
-  sessionsDb.exec('CREATE TABLE IF NOT EXISTS sessions (sid PRIMARY KEY, sess, expire)');
-} catch {
-  // The primary session middleware owns schema normalization.
-}
-
 function sessionHash(sessionId) {
   return crypto.createHmac('sha256', getSessionSecret()).update(String(sessionId || '')).digest('hex');
 }

package/server/services/ai/loop/agent_engine_core.js

@@ -21,7 +21,9 @@ const { shouldAcceptTaskComplete } = require('../completion');
 const { shortenRunId, summarizeForLog } = require('../logFormat');
 const { runConversation } = require('./conversation_loop');
 const {
+  buildChurnAssessmentPrompt,
   buildCompletionDecisionPrompt,
+  normalizeChurnAssessment,
   normalizeCompletionDecision,
   resolveRunGoalContext,
 } = require('./completion_judge');
@@ -812,6 +814,46 @@ class AgentEngine {
     };
   }
 
+  async assessChurnState({
+    provider,
+    providerName,
+    model,
+    messages,
+    analysis,
+    plan,
+    toolExecutions,
+    readOnlyCount,
+    alreadyRead,
+    iteration,
+    options,
+  }) {
+    const runMeta = options?.runId ? this.getRunMeta(options.runId) : null;
+    const goalContext = resolveRunGoalContext(runMeta, analysis, plan);
+    const response = await this.requestStructuredJson({
+      provider,
+      providerName,
+      model,
+      messages,
+      prompt: buildChurnAssessmentPrompt({
+        readOnlyCount,
+        alreadyRead,
+        goalContext,
+        toolExecutions,
+        iteration,
+      }),
+      maxTokens: 200,
+      normalize: (raw) => normalizeChurnAssessment(raw),
+      fallback: { assessment: 'churn', reason: 'churn assessment unavailable' },
+      reasoningEffort: this.getReasoningEffort(providerName, options),
+      telemetry: options,
+      phase: 'churn_assessment',
+    });
+    return {
+      assessment: response.value,
+      usage: response.usage,
+    };
+  }
+
   async refreshConversationState({
     conversationId,
     runId,

package/server/services/ai/loop/completion_judge.js

@@ -241,12 +241,61 @@ function normalizeCompletionDecision(raw, fallbackStatus = 'continue') {
   };
 }
 
+/**
+ * Ask the model to self-assess whether it is making genuine progress or
+ * spinning in analysis-paralysis. This replaces the hardcoded nudge threshold
+ * with an AI-controlled signal: the model knows its own plan better than any
+ * regex over tool names can infer.
+ *
+ * Intentionally lightweight — the response is capped at 200 tokens and the
+ * prompt is self-contained so the model can answer without re-reading history.
+ */
+function buildChurnAssessmentPrompt({
+  readOnlyCount,
+  alreadyRead,
+  goalContext,
+  toolExecutions,
+  iteration,
+}) {
+  const lines = [
+    'Return JSON only.',
+    'Self-assess your current loop state — are you making genuine progress or spinning?',
+    'Schema: {"assessment":"progressing|churn|blocked","reason":"one short concrete sentence"}',
+    '',
+    `Context: ${readOnlyCount} consecutive iteration(s) with only read/search/inspect operations — no concrete state changes yet.`,
+    alreadyRead ? `Already inspected: ${alreadyRead}.` : '',
+    goalContext.effectiveGoal ? `Goal: ${goalContext.effectiveGoal}` : '',
+    goalContext.successCriteria.length > 0
+      ? `Success criteria:\n${goalContext.successCriteria.map((c, i) => `${i + 1}. ${c}`).join('\n')}`
+      : '',
+    `Iteration: ${iteration}`,
+    `Recent tool evidence:\n${summarizeToolExecutions(toolExecutions, 6) || 'none'}`,
+    '',
+    'Assessment rules:',
+    '- "progressing": You are systematically gathering necessary context and the next concrete action is already determined — you know exactly what to do next.',
+    '- "churn": You are re-reading/re-searching information already in context, or exploring without a clear next concrete step. Accept the nudge and act.',
+    '- "blocked": No concrete action is available in this run. You have all the evidence needed to deliver a truthful final answer or a specific external blocker.',
+  ];
+  return lines.filter(Boolean).join('\n');
+}
+
+function normalizeChurnAssessment(raw) {
+  const allowed = new Set(['progressing', 'churn', 'blocked']);
+  const assessment = String(raw?.assessment || '').trim().toLowerCase();
+  return {
+    assessment: allowed.has(assessment) ? assessment : 'churn',
+    reason: String(raw?.reason || '').trim().slice(0, 300),
+  };
+}
+
 module.exports = {
+  buildChurnAssessmentPrompt,
   buildCompletionDecisionPrompt,
   buildGoalContractPrompt,
   goalContractFromAnalysis,
   goalContractFromPlan,
   mergeGoalContracts,
+  normalizeChurnAssessment,
   normalizeCompletionDecision,
   normalizeGoalContract,
   resolveRunGoalContext,

package/server/services/ai/loop/conversation_loop.js

@@ -49,7 +49,7 @@ const {
   selectDeliverableWorkflow,
   validateDeliverableExecution,
 } = require('../deliverables');
-const { buildLoopPolicy, resolveToolResultLimits } = require('../loopPolicy');
+const { buildLoopPolicy, resolveToolResultLimits, resolveChurnNudgeThreshold } = require('../loopPolicy');
 const { globalHooks } = require('../hooks');
 const { normalizeCompletionConfidence, shouldAcceptTaskComplete } = require('../completion');
 const { enforceRateLimits } = require('../rate_limits');
@@ -541,7 +541,9 @@ async function runConversation(engine, userId, userMessage, options = {}, _model
   ensureDefaultAiSettings(userId, agentId);
   const aiSettings = getAiSettings(userId, agentId);
 
-  enforceRateLimits(userId);
+  const { releaseReservation } = enforceRateLimits(userId);
+
+  try {
 
   const runId = options.runId || uuidv4();
   const conversationId = options.conversationId;
@@ -895,8 +897,7 @@ async function runConversation(engine, userId, userMessage, options = {}, _model
   let directAnswerEligible = false;
   let analysisUsage = 0;
 
-  try {
-    if (options.skipTaskAnalysis === true) {
+  if (options.skipTaskAnalysis === true) {
       analysis = buildSkipTaskAnalysisResult(options.forceMode);
     } else {
       const analysisResult = await runWithModelFallback('task analysis', () => engine.analyzeTask({
@@ -1180,73 +1181,152 @@ async function runConversation(engine, userId, userMessage, options = {}, _model
       messages = steeringAtLoopStart.messages;
       messages = sanitizeConversationMessages(messages);
 
-      // Analysis-paralysis gate: fire at the start of every iteration where
-      // the agent has spent N turns only reading/listing/searching without
-      // taking any concrete action. Escalates in urgency each turn.
+      // Analysis-paralysis gate (EVE-style: AI self-assessment instead of
+      // hardcoded counters). The nudge threshold is derived from the goal
+      // contract complexity/autonomy_level that the model set during task
+      // analysis, making the loop budget sensitivity AI-controlled.
+      //
+      // Flow:
+      //   readOnlyCount >= maxConsecutiveReadOnlyIterations → hard safety net,
+      //     force wrap-up unconditionally (same as before).
+      //   readOnlyCount >= churnNudgeThreshold → ask the model to self-assess:
+      //     "progressing" → give grace (partial counter reset, loop continues).
+      //     "churn"       → inject the nudge so the model can course-correct.
+      //     "blocked"     → trigger the force wrap-up early (AI-authorised).
       if (analysis.mode === 'execute' || analysis.mode === 'plan_execute') {
         const readOnlyCount = engine.getRunMeta(runId)?.consecutiveReadOnlyIterations || 0;
-        if (readOnlyCount >= 3) {
-          const alreadyRead = summarizeReadTargets(toolExecutions);
-          messages.push({
-            role: 'system',
-            content: buildReadOnlyChurnGuidance({ readOnlyCount, alreadyRead }),
-          });
-        }
-        if (readOnlyCount >= loopPolicy.maxConsecutiveReadOnlyIterations) {
-          const alreadyRead = summarizeReadTargets(toolExecutions);
-          console.warn(
-            `[Run ${shortenRunId(runId)}] no_progress_wrapup readOnlyCount=${readOnlyCount}`
-          );
-          engine.updateRunProgress(runId, {
-            currentPhase: 'model',
-            currentStep: 'model:no_progress_wrapup',
-            currentTool: null,
-            currentStepStartedAt: isoNow(),
-          });
-          let wrapTokens = 0;
-          try {
-            const wrapResponse = await withModelCallTimeout(
-              provider.chat(
-                sanitizeConversationMessages([
-                  ...messages,
-                  {
-                    role: 'system',
-                    content: buildNoProgressWrapupPrompt({
-                      readOnlyCount,
-                      alreadyRead,
-                      platform: options?.source || null,
-                    }),
-                  },
-                ]),
-                [],
-                { model, reasoningEffort: engine.getReasoningEffort(providerName, options) },
-              ),
-              options,
-              'No-progress wrap-up',
-            );
-            wrapTokens = wrapResponse.usage?.totalTokens || 0;
-            lastContent = sanitizeModelOutput(wrapResponse.content || '', { model });
-          } catch (wrapErr) {
-            console.warn(`[Run ${shortenRunId(runId)}] no_progress_wrapup failed: ${summarizeForLog(wrapErr?.message || wrapErr, 180)}`);
-          }
-          totalTokens += wrapTokens;
-          const usableWrap = normalizeOutgoingMessage(lastContent, options?.source || null);
-          if (!usableWrap) {
-            lastContent = buildDeterministicMessagingFallback({ failedStepCount, stepIndex, toolExecutions });
+
+        if (readOnlyCount > 0) {
+          const runGoalCtx = resolveRunGoalContext(engine.getRunMeta(runId), analysis, plan);
+          const churnNudgeThreshold = resolveChurnNudgeThreshold(runGoalCtx.goalContract);
+
+          let triggerForceWrapup = false;
+          let forceWrapupSource = 'hard_limit';
+          // Compute alreadyRead lazily — only needed at or above the nudge threshold.
+          let alreadyRead = '';
+
+          if (readOnlyCount >= loopPolicy.maxConsecutiveReadOnlyIterations) {
+            alreadyRead = summarizeReadTargets(toolExecutions);
+            triggerForceWrapup = true;
+          } else if (readOnlyCount >= churnNudgeThreshold) {
+            alreadyRead = summarizeReadTargets(toolExecutions);
+            let churnResult;
+            try {
+              churnResult = await engine.assessChurnState({
+                provider,
+                providerName,
+                model,
+                messages,
+                analysis,
+                plan,
+                toolExecutions,
+                readOnlyCount,
+                alreadyRead,
+                iteration,
+                options: { ...options, triggerSource, runId, userId, agentId },
+              });
+            } catch (churnErr) {
+              console.warn(`[Run ${shortenRunId(runId)}] churn_assessment failed: ${summarizeForLog(churnErr?.message || churnErr, 120)}`);
+              churnResult = { assessment: { assessment: 'churn', reason: '' }, usage: 0 };
+            }
+            totalTokens += churnResult.usage || 0;
+            engine.recordRunEvent(userId, runId, 'churn_assessment', {
+              assessment: churnResult.assessment.assessment,
+              reason: churnResult.assessment.reason,
+              readOnlyCount,
+              churnNudgeThreshold,
+              iteration,
+            }, { agentId });
+
+            const churnVerdict = churnResult.assessment.assessment;
+            if (churnVerdict === 'blocked') {
+              triggerForceWrapup = true;
+              forceWrapupSource = 'ai_blocked';
+            } else if (churnVerdict === 'progressing') {
+              // Model is genuinely on track — partially reset so it gets
+              // re-assessed after one more read-only turn rather than immediately.
+              const iterMeta = engine.getRunMeta(runId);
+              if (iterMeta) {
+                iterMeta.consecutiveReadOnlyIterations = Math.max(0, churnNudgeThreshold - 1);
+              }
+            } else {
+              // 'churn' — model acknowledges it is spinning; inject the nudge
+              // so it can course-correct in the next iteration.
+              messages.push({
+                role: 'system',
+                content: buildReadOnlyChurnGuidance({ readOnlyCount, alreadyRead }),
+              });
+            }
           }
-          messages.push({ role: 'assistant', content: lastContent });
-          if (conversationId) {
-            db.prepare('INSERT INTO conversation_messages (conversation_id, role, content, tokens) VALUES (?, ?, ?, ?)')
-              .run(conversationId, 'assistant', lastContent, usableWrap ? wrapTokens : 0);
+
+          if (triggerForceWrapup) {
+            console.warn(
+              `[Run ${shortenRunId(runId)}] no_progress_wrapup source=${forceWrapupSource} readOnlyCount=${readOnlyCount}`
+            );
+            engine.updateRunProgress(runId, {
+              currentPhase: 'model',
+              currentStep: 'model:no_progress_wrapup',
+              currentTool: null,
+              currentStepStartedAt: isoNow(),
+            });
+            let wrapTokens = 0;
+            try {
+              const wrapResponse = await withModelCallTimeout(
+                provider.chat(
+                  sanitizeConversationMessages([
+                    ...messages,
+                    {
+                      role: 'system',
+                      content: buildNoProgressWrapupPrompt({
+                        readOnlyCount,
+                        alreadyRead,
+                        platform: options?.source || null,
+                      }),
+                    },
+                  ]),
+                  [],
+                  { model, reasoningEffort: engine.getReasoningEffort(providerName, options) },
+                ),
+                options,
+                'No-progress wrap-up',
+              );
+              wrapTokens = wrapResponse.usage?.totalTokens || 0;
+              lastContent = sanitizeModelOutput(wrapResponse.content || '', { model });
+            } catch (wrapErr) {
+              console.warn(`[Run ${shortenRunId(runId)}] no_progress_wrapup failed: ${summarizeForLog(wrapErr?.message || wrapErr, 180)}`);
+            }
+            totalTokens += wrapTokens;
+            const usableWrap = normalizeOutgoingMessage(lastContent, options?.source || null);
+            if (!usableWrap) {
+              lastContent = buildDeterministicMessagingFallback({ failedStepCount, stepIndex, toolExecutions });
+            }
+            messages.push({ role: 'assistant', content: lastContent });
+            if (conversationId) {
+              db.prepare('INSERT INTO conversation_messages (conversation_id, role, content, tokens) VALUES (?, ?, ?, ?)')
+                .run(conversationId, 'assistant', lastContent, usableWrap ? wrapTokens : 0);
+            }
+            engine.recordRunEvent(userId, runId, 'no_progress_wrapup_delivered', {
+              iteration,
+              readOnlyCount,
+              source: usableWrap ? 'model' : 'deterministic',
+              forceWrapupSource,
+              stepIndex,
+            }, { agentId });
+            // This wrap-up is a forced, tool-less terminal answer: the model had no
+            // way to call send_message itself. On automatic background runs the plain
+            // result is normally gated, which would silently drop this. Mark it so the
+            // task runtime delivers it — a stuck/blocked scheduled task must still
+            // surface its result instead of going silent.
+            if (
+              (triggerSource === 'schedule' || triggerSource === 'tasks')
+              && options.deliveryState
+              && !engine.activeRuns.get(runId)?.messagingSent
+            ) {
+              options.deliveryState.terminalWrapup = true;
+            }
+            directAnswerEligible = true;
+            break;
           }
-          engine.recordRunEvent(userId, runId, 'no_progress_wrapup_delivered', {
-            iteration,
-            readOnlyCount,
-            source: usableWrap ? 'model' : 'deterministic',
-            stepIndex,
-          }, { agentId });
-          directAnswerEligible = true;
-          break;
         }
       }
 
@@ -2550,6 +2630,8 @@ async function runConversation(engine, userId, userMessage, options = {}, _model
     }
 
     throw err;
+  } finally {
+    releaseReservation();
   }
 }
 

package/server/services/ai/loopPolicy.js

@@ -176,4 +176,21 @@ function resolveToolResultLimits(toolName, policy) {
   return { softLimit: soft, hardLimit: hard };
 }
 
-module.exports = { buildLoopPolicy, getToolCategory, resolveToolResultLimits };
+/**
+ * Resolve the read-only churn nudge threshold from the current goal contract.
+ * The AI itself sets complexity and autonomy_level during task analysis, so
+ * this threshold is indirectly AI-controlled rather than a hardcoded constant.
+ *
+ * Simple tasks get nudged sooner (2 read-only turns) because exploration is
+ * rarely needed. Complex/high-autonomy tasks get more latitude (5 turns) before
+ * the churn self-assessment fires.
+ */
+function resolveChurnNudgeThreshold(goalContract) {
+  const complexity = String(goalContract?.complexity || 'standard').toLowerCase();
+  const autonomyLevel = String(goalContract?.autonomyLevel || goalContract?.autonomy_level || 'normal').toLowerCase();
+  if (complexity === 'simple') return 2;
+  if (complexity === 'complex' || autonomyLevel === 'high') return 5;
+  return 3;
+}
+
+module.exports = { buildLoopPolicy, getToolCategory, resolveToolResultLimits, resolveChurnNudgeThreshold };

package/server/services/ai/rate_limits.js

@@ -2,6 +2,10 @@
 
 const db = require('../../db/database');
 
+// In-process reservation map: userId -> reserved token count for in-flight runs.
+// Prevents concurrent run starts from collectively bypassing the per-user budget.
+const _reservations = new Map();
+
 const DEFAULT_RATE_LIMIT_4H = 2_500_000;
 const DEFAULT_RATE_LIMIT_WEEKLY = 10_000_000;
 
@@ -83,7 +87,7 @@ function nextDecreaseAt(rows, durationMs, usage, limit) {
   return null;
 }
 
-function getRateLimitSnapshot(userId) {
+function getRateLimitSnapshot(userId, { includeReservations = false } = {}) {
   const userLimits = db.prepare(
     'SELECT rate_limit_4h, rate_limit_weekly FROM users WHERE id = ?',
   ).get(userId);
@@ -100,6 +104,7 @@ function getRateLimitSnapshot(userId) {
     fourHourIsCustom: customFourHour != null,
     weeklyIsCustom: customWeekly != null,
   };
+  const reserved = includeReservations ? (_reservations.get(String(userId)) || 0) : 0;
   const usage = {};
   const remaining = {};
   const reached = {};
@@ -107,7 +112,8 @@ function getRateLimitSnapshot(userId) {
 
   for (const [windowKey, config] of Object.entries(WINDOWS)) {
     const rows = usageRows(userId, config.durationMs);
-    const used = rows.reduce((total, row) => total + Number(row.tokens || 0), 0);
+    const committed = rows.reduce((total, row) => total + Number(row.tokens || 0), 0);
+    const used = committed + reserved;
     const limit = limits[windowKey];
     usage[windowKey] = used;
     remaining[windowKey] = limit == null ? null : Math.max(0, limit - used);
@@ -130,14 +136,31 @@ function getRateLimitSnapshot(userId) {
 }
 
 function enforceRateLimits(userId) {
-  const snapshot = getRateLimitSnapshot(userId);
+  const snapshot = getRateLimitSnapshot(userId, { includeReservations: true });
   if (snapshot.reached.fourHour) {
     throw new RateLimitExceededError('fourHour', snapshot);
   }
   if (snapshot.reached.weekly) {
     throw new RateLimitExceededError('weekly', snapshot);
   }
-  return snapshot;
+  // Reserve a placeholder so concurrent starts see this run as in-flight.
+  // The reservation is released (or reconciled) when the run completes.
+  const key = String(userId);
+  const limits = snapshot.limits;
+  const reserve = Math.max(limits.fourHour || 0, limits.weekly || 0, 1);
+  _reservations.set(key, (_reservations.get(key) || 0) + reserve);
+  return { snapshot, releaseReservation: () => releaseReservation(userId, reserve) };
+}
+
+function releaseReservation(userId, amount) {
+  const key = String(userId);
+  const current = _reservations.get(key) || 0;
+  const next = current - amount;
+  if (next <= 0) {
+    _reservations.delete(key);
+  } else {
+    _reservations.set(key, next);
+  }
 }
 
 module.exports = {
@@ -147,4 +170,5 @@ module.exports = {
   configuredDefaultLimits,
   enforceRateLimits,
   getRateLimitSnapshot,
+  releaseReservation,
 };

package/server/services/ai/tools.js

@@ -1,6 +1,7 @@
 const fs = require('fs');
 const path = require('path');
 const { analyzeImageForUser } = require('./imageAnalysis');
+const { isPrivateHost } = require('../../utils/cloud-security');
 const db = require('../../db/database');
 const { DATA_DIR } = require('../../../runtime/paths');
 const { isMainAgent } = require('../agents/manager');
@@ -1737,6 +1738,9 @@ async function executeTool(toolName, args, context, engine) {
         }
 
         case 'browser_navigate': {
+            const { validateCloudUrl } = require('../../utils/cloud-security');
+            const urlCheck = validateCloudUrl(args.url);
+            if (!urlCheck.allowed) return { error: 'URL is not allowed: blocked scheme or private/internal network address.' };
             const { provider, backend } = await bc();
             if (!provider) return { error: 'Browser controller not available' };
             return { ...await provider.navigate(args.url, {
@@ -2578,6 +2582,22 @@ async function executeTool(toolName, args, context, engine) {
         }
 
         case 'http_request': {
+            let parsedUrl;
+            try { parsedUrl = new URL(args.url); } catch {
+                return { error: 'Invalid URL' };
+            }
+            const scheme = parsedUrl.protocol.replace(/:$/, '').toLowerCase();
+            if (!['http', 'https'].includes(scheme)) {
+                return { error: 'URL scheme not allowed. Only http and https are permitted.' };
+            }
+            const h = parsedUrl.hostname.toLowerCase().replace(/^\[|\]$/g, '');
+            if (h === 'localhost' || h === '127.0.0.1' || h === '::1' || h.endsWith('.localhost')) {
+                return { error: 'Loopback addresses are not permitted.' };
+            }
+            const allowPrivate = process.env.NEOAGENT_HTTP_ALLOW_PRIVATE !== 'false';
+            if (!allowPrivate && isPrivateHost(parsedUrl.hostname)) {
+                return { error: 'Private/internal network addresses are not permitted.' };
+            }
             const controller = new AbortController();
             const timeoutMs = args.timeout_ms || 30000;
             const timer = setTimeout(() => controller.abort(), timeoutMs);
@@ -2594,11 +2614,28 @@ async function executeTool(toolName, args, context, engine) {
                     }
                 }
                 const res = await fetch(args.url, options);
-                const text = await res.text();
+                const MAX_BODY = 512 * 1024;
+                const reader = res.body.getReader();
+                const chunks = [];
+                let total = 0;
+                let truncated = false;
+                while (true) {
+                    const { done, value } = await reader.read();
+                    if (done) break;
+                    total += value.length;
+                    if (total > MAX_BODY) {
+                        const take = MAX_BODY - (total - value.length);
+                        if (take > 0) chunks.push(value.slice(0, take));
+                        truncated = true;
+                        break;
+                    }
+                    chunks.push(value);
+                }
+                const text = Buffer.concat(chunks.map(c => Buffer.from(c))).toString('utf-8');
                 return {
                     status: res.status,
                     headers: Object.fromEntries(res.headers.entries()),
-                    body: text.length > 50000 ? text.slice(0, 50000) + '\n...[truncated]' : text
+                    body: truncated ? text + '\n...[truncated]' : text,
                 };
             } catch (err) {
                 if (err.name === 'AbortError') return { error: `Request timed out after ${timeoutMs} ms` };

package/server/services/desktop/gateway.js

@@ -28,11 +28,14 @@ function rejectUpgrade(socket, statusCode, message) {
 }
 
 function remoteAddressFromRequest(req) {
-  const forwarded = req.headers?.['x-forwarded-for'];
-  if (typeof forwarded === 'string' && forwarded.trim()) {
-    return forwarded.split(',')[0].trim();
+  const directPeer = req.socket?.remoteAddress || 'unknown';
+  if (process.env.TRUST_PROXY === 'true' || process.env.TRUST_PROXY === '1') {
+    const forwarded = req.headers?.['x-forwarded-for'];
+    if (typeof forwarded === 'string' && forwarded.trim()) {
+      return forwarded.split(',')[0].trim();
+    }
   }
-  return req.socket?.remoteAddress || 'unknown';
+  return directPeer;
 }
 
 function createUpgradeThrottleObserver() {

package/server/services/integrations/secrets.js

@@ -5,13 +5,16 @@ const crypto = require('crypto');
 const SECRET_PREFIX = 'enc:v1:';
 
 function getSecretMaterial() {
-  const secret = String(process.env.SESSION_SECRET || '').trim();
-  if (!secret) {
+  // Prefer a dedicated data-encryption key so rotating SESSION_SECRET
+  // does not invalidate persisted credentials. Fall back to SESSION_SECRET
+  // for existing deployments that haven't set NEOAGENT_ENCRYPTION_KEY yet.
+  const key = String(process.env.NEOAGENT_ENCRYPTION_KEY || process.env.SESSION_SECRET || '').trim();
+  if (!key) {
     throw new Error(
-      'Official integrations require SESSION_SECRET to be configured.',
+      'Official integrations require NEOAGENT_ENCRYPTION_KEY (or SESSION_SECRET) to be configured.',
     );
   }
-  return secret;
+  return key;
 }
 
 function getKey() {

package/server/services/messaging/telnyx.js

@@ -233,7 +233,7 @@ class TelnyxVoicePlatform extends BasePlatform {
       if (!this._hasSession(ccId)) return;
       const sess = this._session(ccId);
       if (!sess.awaitingSecret) return;
-      console.log(`[TelnyxVoice] Secret code timeout for ${ccId.slice(-8)} (${sess.callerNumber})`);
+      console.log(`[TelnyxVoice] Secret code timeout for ${ccId.slice(-8)}`);
       this._banNumber(sess.callerNumber);
       this._endSession(ccId);
       try { await this._hangupCall(ccId); } catch {}
@@ -535,7 +535,7 @@ class TelnyxVoicePlatform extends BasePlatform {
               if (this.voiceSecret && sess.secretDigits.length >= this.voiceSecret.length) {
                 this._cancelSecretTimer(ccId);
                 if (sess.secretDigits === this.voiceSecret) {
-                  console.log(`[TelnyxVoice] Secret accepted for ${ccId.slice(-8)} (${sess.callerNumber})`);
+                  console.log(`[TelnyxVoice] Secret accepted for ${ccId.slice(-8)}`);
                   sess.awaitingSecret = false;
                   sess.secretDigits = '';
                   sess.isProcessing = true;
@@ -613,7 +613,7 @@ class TelnyxVoicePlatform extends BasePlatform {
             break;
           }
 
-          console.log(`[TelnyxVoice] Transcript [${sess.callerNumber}]: ${transcript}`);
+          console.log(`[TelnyxVoice] Transcript received for ${ccId.slice(-8)} (${transcript.length} chars)`);
 
           // Mark as thinking — gates call.playback.ended so think-audio events
           // don't corrupt session state while the agent is processing.

package/server/services/messaging/whatsapp.js

@@ -210,7 +210,7 @@ class WhatsAppPlatform extends BasePlatform {
                   response_format: 'text'
                 });
                 content = (typeof transcription === 'string' ? transcription : transcription?.text || '').trim() || '[Voice Note - empty audio]';
-                console.log(`[WhatsApp] Voice note transcribed: "${content.slice(0, 80)}"`);
+                console.log(`[WhatsApp] Voice note transcribed (${content.length} chars)`);
               } catch (transcribeErr) {
                 console.error('[WhatsApp] Audio transcription failed:', transcribeErr.message);
                 content = '[Voice Note - transcription failed]';

package/server/services/recordings/manager.js

@@ -29,6 +29,12 @@ function ensureRecordingDirs() {
   fs.mkdirSync(RECORDINGS_DIR, { recursive: true });
 }
 
+function validateSourceKey(key) {
+  if (!key || !/^[a-z0-9][a-z0-9_-]*$/.test(key)) {
+    throw new Error(`Invalid sourceKey "${key}": only lowercase alphanumeric, hyphens, and underscores are allowed.`);
+  }
+}
+
 class RecordingManager {
   constructor(io) {
     this.io = io;
@@ -241,10 +247,8 @@ class RecordingManager {
       throw new Error('Recording session is not accepting more chunks.');
     }
 
-    const sourceKey = `${metadata.sourceKey || ''}`.trim();
-    if (!sourceKey) {
-      throw new Error('sourceKey is required.');
-    }
+    const sourceKey = `${metadata.sourceKey || ''}`.trim().toLowerCase();
+    validateSourceKey(sourceKey);
 
     const source = this.#getSessionSourceByKey(sessionId, sourceKey);
 
@@ -289,6 +293,10 @@ class RecordingManager {
     const endMs = Math.max(startMs, Number(metadata.endMs) || startMs);
     const extension = this.#extensionForMime(mimeType);
     const fileDir = path.join(RECORDINGS_DIR, `user-${userId}`, sessionId, sourceKey);
+    const sessionRoot = path.resolve(path.join(RECORDINGS_DIR, `user-${userId}`, sessionId));
+    if (!path.resolve(fileDir).startsWith(sessionRoot + path.sep)) {
+      throw new Error('Invalid recording path');
+    }
     fs.mkdirSync(fileDir, { recursive: true });
     const filePath = path.join(fileDir, `${String(sequenceIndex).padStart(6, '0')}${extension}`);
     const tempPath = `${filePath}.tmp-${process.pid}-${Date.now()}`;
@@ -1113,9 +1121,7 @@ class RecordingManager {
 
     return inputs.map((item, index) => {
       const sourceKey = `${item?.sourceKey || item?.id || `source-${index}`}`.trim().toLowerCase();
-      if (!sourceKey) {
-        throw new Error('Every recording source needs a sourceKey.');
-      }
+      validateSourceKey(sourceKey);
       if (seen.has(sourceKey)) {
         throw new Error(`Duplicate recording source: ${sourceKey}`);
       }

package/server/services/tasks/runtime.js

@@ -801,7 +801,13 @@ class TaskRuntime {
     if (!targets.length) return null;
     const resultText = stringifyTaskResult(result).trim();
     const resultLooksLikeError = Boolean(result?.error);
-    if (!allowPlainResultFallback && !resultLooksLikeError) {
+    // A forced terminal wrap-up (read-only/blocked hard-stop) is the model's final
+    // answer produced WITHOUT the ability to call send_message itself. Gating it
+    // would silently drop a stuck scheduled task's result, so deliver it even on an
+    // automatic run. Ordinary mid-run plain text (model had send_message available
+    // and chose not to use it) is still gated below.
+    const forcedTerminal = deliveryState?.terminalWrapup === true && Boolean(resultText);
+    if (!allowPlainResultFallback && !resultLooksLikeError && !forcedTerminal) {
       // Automatic run produced substantive text but never made an explicit
       // send_message decision (a deliberate no_response would have short-circuited
       // above). We suppress to avoid recurring-check spam, but surface it so a

package/server/services/voice/runtimeManager.js

@@ -52,6 +52,9 @@ class VoiceRuntimeManager {
       agentId,
     );
     const resolvedSessionId = String(sessionId || randomUUID()).trim();
+    if (this.sessions.has(resolvedSessionId)) {
+      throw new Error('Voice session ID collision: a session with this ID already exists.');
+    }
     const adapter = this.#createAdapter(voiceSettings.liveProvider);
     await adapter.open();
 
@@ -153,9 +156,12 @@ class VoiceRuntimeManager {
     });
   }
 
-  async closeSession(sessionId, reason = 'closed') {
+  async closeSession(sessionId, reason = 'closed', userId = null) {
     const session = this.getSession(sessionId);
     if (!session) return;
+    if (userId != null && session.userId != null && String(session.userId) !== String(userId)) {
+      throw new Error('Voice session access denied.');
+    }
     if (reason === 'socket_disconnected') {
       await this.abortActiveRun(session.id, 'voice_disconnect');
     }
@@ -164,8 +170,8 @@ class VoiceRuntimeManager {
     await session.close(reason);
   }
 
-  async beginInput(sessionId, options = {}) {
-    const session = this.#requireSession(sessionId);
+  async beginInput(sessionId, options = {}, userId = null) {
+    const session = this.#requireSession(sessionId, userId);
     await session.interruptOutput();
     await this.abortActiveRun(session.id, 'voice_interrupt');
     session.resetTurnState();
@@ -176,13 +182,13 @@ class VoiceRuntimeManager {
     await session.setState('listening');
   }
 
-  async appendInputAudio(sessionId, audioBytes, options = {}) {
-    const session = this.#requireSession(sessionId);
+  async appendInputAudio(sessionId, audioBytes, options = {}, userId = null) {
+    const session = this.#requireSession(sessionId, userId);
     return session.adapter.appendAudioChunk(session, audioBytes, options);
   }
 
-  async commitInput(sessionId, options = {}) {
-    const session = this.#requireSession(sessionId);
+  async commitInput(sessionId, options = {}, userId = null) {
+    const session = this.#requireSession(sessionId, userId);
     if (session.inputBytes === 0) {
       return { transcript: '' };
     }
@@ -207,8 +213,8 @@ class VoiceRuntimeManager {
     };
   }
 
-  async interruptSession(sessionId) {
-    const session = this.#requireSession(sessionId);
+  async interruptSession(sessionId, userId = null) {
+    const session = this.#requireSession(sessionId, userId);
     await this.abortActiveRun(session.id, 'voice_interrupt');
     await session.interruptOutput();
     session.resetTurnState();
@@ -378,11 +384,14 @@ class VoiceRuntimeManager {
     return new OpenAiLiveRelayAdapter();
   }
 
-  #requireSession(sessionId) {
+  #requireSession(sessionId, userId = null) {
     const session = this.getSession(sessionId);
     if (!session) {
       throw new Error('Voice session was not found.');
     }
+    if (userId != null && session.userId != null && String(session.userId) !== String(userId)) {
+      throw new Error('Voice session access denied.');
+    }
     return session;
   }
 

package/server/services/wearable/gateway.js

@@ -27,11 +27,14 @@ function rejectUpgrade(socket, statusCode, message) {
 }
 
 function remoteAddressFromRequest(req) {
-  const forwarded = req.headers?.['x-forwarded-for'];
-  if (typeof forwarded === 'string' && forwarded.trim()) {
-    return forwarded.split(',')[0].trim();
+  const directPeer = req.socket?.remoteAddress || 'unknown';
+  if (process.env.TRUST_PROXY === 'true' || process.env.TRUST_PROXY === '1') {
+    const forwarded = req.headers?.['x-forwarded-for'];
+    if (typeof forwarded === 'string' && forwarded.trim()) {
+      return forwarded.split(',')[0].trim();
+    }
   }
-  return req.socket?.remoteAddress || 'unknown';
+  return directPeer;
 }
 
 function createUpgradeLimiter() {

package/server/services/websocket.js

@@ -544,7 +544,7 @@ function setupWebSocket(io, services) {
         await voiceRuntimeManager.beginInput(sessionId, {
           mimeType: toOptionalString(data?.mimeType, 128),
           turnId: toOptionalString(data?.turnId, 128),
-        });
+        }, userId);
       } catch (err) {
         console.error(`[WS] voice:input_start failed for user ${userId}:`, err);
         socket.emit('voice:error', {
@@ -600,7 +600,7 @@ function setupWebSocket(io, services) {
           mimeType: toOptionalString(data?.mimeType, 128),
           turnId,
           sequence,
-        });
+        }, userId);
         socket.emit('voice:chunk_ack', {
           sessionId,
           turnId,
@@ -672,7 +672,7 @@ function setupWebSocket(io, services) {
           finalSequence: toBoundedInt(data?.finalSequence, -1, -1, 1_000_000),
           promptHint: toOptionalString(data?.promptHint, 2000),
           metadata,
-        });
+        }, userId);
       } catch (err) {
         console.error(`[WS] voice:input_commit failed for user ${userId}:`, err);
         socket.emit('voice:error', {
@@ -696,7 +696,7 @@ function setupWebSocket(io, services) {
         if (!sessionId) {
           return socket.emit('voice:error', { error: 'sessionId is required' });
         }
-        await voiceRuntimeManager.interruptSession(sessionId);
+        await voiceRuntimeManager.interruptSession(sessionId, userId);
       } catch (err) {
         console.error(`[WS] voice:interrupt failed for user ${userId}:`, err);
         socket.emit('voice:error', {
@@ -720,7 +720,7 @@ function setupWebSocket(io, services) {
         if (!sessionId) {
           return socket.emit('voice:error', { error: 'sessionId is required' });
         }
-        await voiceRuntimeManager.closeSession(sessionId, 'client_closed');
+        await voiceRuntimeManager.closeSession(sessionId, 'client_closed', userId);
         socket.data.voiceSessionIds?.delete(sessionId);
       } catch (err) {
         console.error(`[WS] voice:session_close failed for user ${userId}:`, err);