neoagent 3.2.1-beta.0 → 3.2.1-beta.10

package/server/services/android/process.js

@@ -0,0 +1,140 @@
+'use strict';
+
+const { spawn } = require('node:child_process');
+
+const DEFAULT_TIMEOUT_MS = 20_000;
+const DEFAULT_MAX_OUTPUT_BYTES = 4 * 1024 * 1024;
+const MAX_TIMEOUT_MS = 30 * 60 * 1000;
+
+function clampNumber(value, fallback, min, max) {
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed)) return fallback;
+  return Math.min(max, Math.max(min, Math.round(parsed)));
+}
+
+function createProcessError(message, code, details = {}) {
+  const error = new Error(message);
+  error.code = code;
+  Object.assign(error, details);
+  return error;
+}
+
+function runProcess(command, args = [], options = {}) {
+  const timeoutMs = clampNumber(options.timeoutMs, DEFAULT_TIMEOUT_MS, 100, MAX_TIMEOUT_MS);
+  const maxOutputBytes = clampNumber(
+    options.maxOutputBytes,
+    DEFAULT_MAX_OUTPUT_BYTES,
+    1024,
+    1024 * 1024 * 1024,
+  );
+  const encoding = options.encoding === null ? null : (options.encoding || 'utf8');
+
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, {
+      cwd: options.cwd,
+      env: options.env,
+      stdio: ['pipe', 'pipe', 'pipe'],
+      windowsHide: true,
+    });
+    const stdout = [];
+    const stderr = [];
+    let stdoutBytes = 0;
+    let stderrBytes = 0;
+    let settled = false;
+    let forceKillTimer = null;
+
+    const decode = (chunks) => {
+      const buffer = Buffer.concat(chunks);
+      return encoding === null ? buffer : buffer.toString(encoding);
+    };
+    const cleanup = () => {
+      clearTimeout(timeout);
+      options.signal?.removeEventListener('abort', onAbort);
+    };
+    const settle = (error, result = null) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      if (error) reject(error);
+      else resolve(result);
+    };
+    const terminate = (error) => {
+      try { child.kill('SIGTERM'); } catch {}
+      forceKillTimer = setTimeout(() => {
+        try { child.kill('SIGKILL'); } catch {}
+      }, 1000);
+      forceKillTimer.unref?.();
+      settle(error);
+    };
+    const onAbort = () => {
+      const error = options.signal?.reason instanceof Error
+        ? options.signal.reason
+        : createProcessError('Command was aborted.', 'ABORT_ERR');
+      if (!(options.signal?.reason instanceof Error)) error.name = 'AbortError';
+      terminate(error);
+    };
+    const collect = (target, chunk, streamName) => {
+      if (settled) return;
+      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      if (streamName === 'stdout') stdoutBytes += buffer.length;
+      else stderrBytes += buffer.length;
+      if (stdoutBytes + stderrBytes > maxOutputBytes) {
+        terminate(createProcessError(
+          `Command exceeded the ${maxOutputBytes}-byte output limit.`,
+          'PROCESS_OUTPUT_LIMIT',
+        ));
+        return;
+      }
+      target.push(buffer);
+    };
+
+    const timeout = setTimeout(() => {
+      terminate(createProcessError(
+        `Command timed out after ${timeoutMs} ms.`,
+        'PROCESS_TIMEOUT',
+        { timeoutMs },
+      ));
+    }, timeoutMs);
+    timeout.unref?.();
+
+    child.stdout?.on('data', (chunk) => collect(stdout, chunk, 'stdout'));
+    child.stderr?.on('data', (chunk) => collect(stderr, chunk, 'stderr'));
+    child.once('error', (error) => settle(error));
+    child.once('close', (exitCode, signal) => {
+      if (forceKillTimer) clearTimeout(forceKillTimer);
+      if (settled) return;
+      const result = {
+        stdout: decode(stdout),
+        stderr: decode(stderr),
+        exitCode,
+        signal: signal || null,
+      };
+      if (exitCode === 0) {
+        settle(null, result);
+        return;
+      }
+      const stderrText = Buffer.concat(stderr).toString('utf8').trim();
+      const stdoutText = Buffer.concat(stdout).toString('utf8').trim();
+      settle(createProcessError(
+        stderrText || stdoutText || `Command exited with code ${exitCode}.`,
+        'PROCESS_EXIT',
+        result,
+      ));
+    });
+
+    if (options.signal?.aborted) {
+      onAbort();
+      return;
+    }
+    options.signal?.addEventListener('abort', onAbort, { once: true });
+    if (options.input != null) child.stdin?.end(options.input);
+    else child.stdin?.end();
+  });
+}
+
+module.exports = {
+  DEFAULT_MAX_OUTPUT_BYTES,
+  DEFAULT_TIMEOUT_MS,
+  clampNumber,
+  runProcess,
+};

package/server/services/android/sdk_download.js

@@ -0,0 +1,143 @@
+'use strict';
+
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const https = require('node:https');
+const os = require('node:os');
+const { Transform } = require('node:stream');
+const { pipeline } = require('node:stream/promises');
+const { createAbortError } = require('../../utils/abort');
+const { clampNumber } = require('./process');
+
+// Google publishes the current filenames and checksums at:
+// https://developer.android.com/studio#command-line-tools-only
+const COMMAND_LINE_TOOLS_VERSION = '15859902';
+const COMMAND_LINE_TOOLS_RELEASES = {
+  darwin: {
+    arm64: {
+      url: `https://dl.google.com/android/repository/commandlinetools-mac_arm64-${COMMAND_LINE_TOOLS_VERSION}_latest.zip`,
+      sha256: '835b62a26162b229b441d1f6d4680383815a270809eb33522c0d480fa5002c4e',
+    },
+    x64: {
+      url: `https://dl.google.com/android/repository/commandlinetools-mac_x86_64-${COMMAND_LINE_TOOLS_VERSION}_latest.zip`,
+      sha256: 'c5a6378ab5cf7e0d5701921405115befff13e9ff7417fb588389338f8bd050f3',
+    },
+  },
+  linux: {
+    url: `https://dl.google.com/android/repository/commandlinetools-linux-${COMMAND_LINE_TOOLS_VERSION}_latest.zip`,
+    sha256: '4e4c464f145a7512b57d088ac6c278c03c9eea610886b35a5e0804e74eedf583',
+  },
+  win32: {
+    url: `https://dl.google.com/android/repository/commandlinetools-win-${COMMAND_LINE_TOOLS_VERSION}_latest.zip`,
+    sha256: '90ae805d20434428bffcb699c290860f19bb5f66a67e6b330067e3de801fb04a',
+  },
+};
+
+function resolveCommandLineToolsRelease(platform = process.platform, arch = os.arch()) {
+  const release = COMMAND_LINE_TOOLS_RELEASES[platform];
+  if (!release) throw new Error(`No Android command-line-tools download for platform: ${platform}`);
+  if (platform !== 'darwin') return release;
+  if (arch !== 'arm64' && arch !== 'x64') {
+    throw new Error(`No Android command-line-tools download for macOS architecture: ${arch}`);
+  }
+  return release[arch];
+}
+
+function assertExpectedDigest(actualDigest, expectedDigest) {
+  const expected = String(expectedDigest || '').trim().toLowerCase();
+  if (!/^[a-f0-9]{64}$/.test(expected)) {
+    throw new Error('Android SDK download is missing a valid SHA-256 checksum.');
+  }
+  const actualBuffer = Buffer.from(actualDigest, 'hex');
+  const expectedBuffer = Buffer.from(expected, 'hex');
+  if (!crypto.timingSafeEqual(actualBuffer, expectedBuffer)) {
+    const error = new Error('Android SDK download failed SHA-256 verification.');
+    error.code = 'ANDROID_SDK_CHECKSUM_MISMATCH';
+    throw error;
+  }
+}
+
+async function downloadFile(url, destination, options = {}) {
+  const maxRedirects = clampNumber(options.maxRedirects, 5, 0, 10);
+  const timeoutMs = clampNumber(options.timeoutMs, 60_000, 1000, 10 * 60 * 1000);
+  const maxBytes = clampNumber(options.maxBytes, 500 * 1024 * 1024, 1024, 1024 * 1024 * 1024);
+  const temporary = `${destination}.${process.pid}.${Math.random().toString(16).slice(2)}.part`;
+
+  const openResponse = (target, redirectsLeft) => new Promise((resolve, reject) => {
+    if (options.signal?.aborted) {
+      reject(createAbortError(options.signal, 'Android SDK download was aborted.'));
+      return;
+    }
+    const parsed = new URL(target);
+    if (parsed.protocol !== 'https:') {
+      reject(new Error(`Refusing non-HTTPS Android SDK download: ${parsed.protocol}`));
+      return;
+    }
+    const request = https.get(parsed, (response) => {
+      options.signal?.removeEventListener('abort', onAbort);
+      const status = Number(response.statusCode || 0);
+      if (status >= 300 && status < 400 && response.headers.location) {
+        response.resume();
+        if (redirectsLeft <= 0) {
+          reject(new Error('Android SDK download exceeded its redirect limit.'));
+          return;
+        }
+        resolve(openResponse(new URL(response.headers.location, parsed).toString(), redirectsLeft - 1));
+        return;
+      }
+      if (status !== 200) {
+        response.resume();
+        reject(new Error(`Android SDK download failed with HTTP ${status}.`));
+        return;
+      }
+      const contentLength = Number(response.headers['content-length'] || 0);
+      if (contentLength > maxBytes) {
+        response.destroy();
+        reject(new Error(`Android SDK download exceeds the ${maxBytes}-byte limit.`));
+        return;
+      }
+      resolve(response);
+    });
+    const onAbort = () => request.destroy(createAbortError(options.signal, 'Android SDK download was aborted.'));
+    options.signal?.addEventListener('abort', onAbort, { once: true });
+    request.setTimeout(timeoutMs, () => request.destroy(new Error('Android SDK download timed out.')));
+    request.once('error', (error) => {
+      options.signal?.removeEventListener('abort', onAbort);
+      reject(error);
+    });
+  });
+
+  try {
+    const response = await openResponse(url, maxRedirects);
+    const hash = crypto.createHash('sha256');
+    let received = 0;
+    const verifier = new Transform({
+      transform(chunk, _encoding, callback) {
+        received += chunk.length;
+        if (received > maxBytes) {
+          callback(new Error(`Android SDK download exceeds the ${maxBytes}-byte limit.`));
+          return;
+        }
+        hash.update(chunk);
+        callback(null, chunk);
+      },
+    });
+    await pipeline(response, verifier, fs.createWriteStream(temporary, { mode: 0o600 }), {
+      signal: options.signal,
+    });
+    assertExpectedDigest(hash.digest('hex'), options.expectedSha256);
+    fs.renameSync(temporary, destination);
+  } catch (error) {
+    if (options.signal?.aborted) {
+      throw createAbortError(options.signal, 'Android SDK download was aborted.');
+    }
+    throw error;
+  } finally {
+    try { fs.unlinkSync(temporary); } catch {}
+  }
+}
+
+module.exports = {
+  downloadFile,
+  resolveCommandLineToolsRelease,
+};

package/server/services/android/uia.js

@@ -12,12 +12,13 @@ const DEFAULT_BOUNDS = Object.freeze({
 function decodeXml(value) {
   return String(value || '')
     .replace(/"/g, '"')
-    .replace(/&/g, '&')
+    .replace(/'/g, "'")
     .replace(/&lt;/g, '<')
     .replace(/&gt;/g, '>')
     .replace(/&#10;/g, '\n')
     .replace(/&#13;/g, '\r')
-    .replace(/&#39;/g, "'");
+    .replace(/&#39;/g, "'")
+    .replace(/&amp;/g, '&');
 }
 
 function parseBounds(raw) {
@@ -54,7 +55,7 @@ function parseNodeAttributes(raw) {
 
 function parseUiDump(xml) {
   const nodes = [];
-  const nodeRe = /<node\b([^>]*)\/>/g;
+  const nodeRe = /<node\b([^>]*)>/g;
   let match = nodeRe.exec(String(xml || ''));
 
   while (match) {
@@ -123,8 +124,8 @@ function scoreNode(node, selector = {}) {
     else return -1;
   }
 
-  if (selector.clickable === true && node.clickable) score += 40;
-  if (selector.clickable === true && !node.clickable) score -= 60;
+  if (selector.clickable === true && !node.clickable) return -1;
+  if (selector.clickable === true) score += 40;
   if (node.enabled) score += 10;
   if (node.bounds.width > 0 && node.bounds.height > 0) score += 10;
 

package/server/services/artifacts/store.js

@@ -3,6 +3,7 @@ const path = require('path');
 const { v4: uuidv4 } = require('uuid');
 const db = require('../../db/database');
 const { DATA_DIR } = require('../../../runtime/paths');
+const { writeBufferAtomic } = require('../../utils/files');
 
 const ARTIFACTS_ROOT = path.join(DATA_DIR, 'artifacts');
 fs.mkdirSync(ARTIFACTS_ROOT, { recursive: true });
@@ -121,6 +122,29 @@ class ArtifactStore {
     };
   }
 
+  async createBufferArtifact(userId, options = {}) {
+    const buffer = Buffer.isBuffer(options.content)
+      ? options.content
+      : Buffer.from(options.content || []);
+    const allocation = this.allocateFile(userId, options);
+    try {
+      await writeBufferAtomic(allocation.storagePath, buffer, {
+        signal: options.signal,
+      });
+      db.prepare('UPDATE artifacts SET byte_size = ? WHERE id = ?')
+        .run(buffer.length, allocation.artifactId);
+      return {
+        ...allocation,
+        filePath: allocation.storagePath,
+        byteSize: buffer.length,
+      };
+    } catch (error) {
+      await fs.promises.rm(allocation.storagePath, { force: true }).catch(() => {});
+      db.prepare('DELETE FROM artifacts WHERE id = ?').run(allocation.artifactId);
+      throw error;
+    }
+  }
+
   getArtifactForUser(userId, artifactId) {
     const row = db.prepare(`
       SELECT id, user_id, kind, backend, content_type, storage_path, original_filename, byte_size, metadata_json, created_at