neoagent 3.2.1-beta.1 → 3.2.1-beta.11

package/server/routes/admin.js

@@ -1025,7 +1025,7 @@ router.put('/api/config/rate-limits', requireAdminAuth, express.json(), (req, re
 router.get('/api/models', requireAdminAuth, async (req, res) => {
   const { getSupportedModels } = require('../services/ai/models');
   try {
-    const models = await getSupportedModels(null, null);
+    const models = await getSupportedModels(null, null, { signal: req.signal });
     const disabledStr = process.env.NEOAGENT_DISABLED_MODELS || '';
     const disabledModels = disabledStr ? disabledStr.split(',').map(s => s.trim()).filter(Boolean) : [];
     res.json({ models, disabledModels });

package/server/routes/android.js

@@ -1,3 +1,5 @@
+'use strict';
+
 const express = require('express');
 const fs = require('fs');
 const path = require('path');
@@ -6,8 +8,7 @@ const router = express.Router();
 const { DATA_DIR } = require('../../runtime/paths');
 const { requireAuth } = require('../middleware/auth');
 const { sanitizeError } = require('../utils/security');
-const { validateCloudUrl } = require('../utils/cloud-security');
-const { getRuntimeValidation } = require('../services/runtime/validation');
+const { validateAndroidIntentUrl } = require('../utils/cloud-security');
 
 router.use(requireAuth);
 
@@ -52,18 +53,6 @@ async function getAndroidController(req) {
   throw new Error('Android controller is unavailable.');
 }
 
-function getAndroidStatusSnapshot(req) {
-  const runtimeValidation = getRuntimeValidation(req.app?.locals?.runtimeManager);
-  const ready = Boolean(runtimeValidation?.ready);
-  return {
-    bootstrapped: false,
-    canBootstrap: ready,
-    devices: [],
-    lastStartError: ready ? null : (runtimeValidation?.issues?.[0] || 'VM runtime is not ready.'),
-    runtimeReady: ready,
-  };
-}
-
 function handleAndroidAction(action) {
   return async (req, res) => {
     try {
@@ -79,45 +68,49 @@ function handleAndroidAction(action) {
 router.get('/status', async (req, res) => {
   try {
     const controller = await getAndroidController(req);
-    res.json(await controller.getStatus().catch(() => getAndroidStatusSnapshot(req)));
+    res.json(await controller.getStatus({ signal: req.signal }));
   } catch (err) {
     res.status(500).json({ error: sanitizeError(err) });
   }
 });
 
 router.post('/start', handleAndroidAction((controller, req) =>
-  controller.requestStartEmulator(req.body || {})));
+  controller.requestStartEmulator({ ...(req.body || {}), signal: req.signal })));
 
-router.post('/stop', handleAndroidAction((controller) => controller.stopEmulator()));
+router.post('/stop', handleAndroidAction((controller, req) => controller.stopEmulator({ signal: req.signal })));
 
-router.get('/devices', handleAndroidAction(async (controller) => ({
-  devices: await controller.listDevices(),
+router.get('/devices', handleAndroidAction(async (controller, req) => ({
+  devices: await controller.listDevices({ signal: req.signal }),
 })));
 
 router.post('/screenshot', handleAndroidAction((controller, req) =>
-  controller.screenshot(req.body || {})));
+  controller.screenshot({ ...(req.body || {}), signal: req.signal })));
 
 router.post('/observe', handleAndroidAction((controller, req) =>
-  controller.observe(req.body || {})));
+  controller.observe({ ...(req.body || {}), signal: req.signal })));
 
 router.post('/ui-dump', handleAndroidAction((controller, req) =>
-  controller.dumpUi(req.body || {})));
+  controller.dumpUi({ ...(req.body || {}), signal: req.signal })));
 
 router.get('/apps', handleAndroidAction((controller, req) =>
-  controller.listApps({ includeSystem: req.query.includeSystem === 'true' })));
+  controller.listApps({ includeSystem: req.query.includeSystem === 'true', signal: req.signal })));
 
 router.post('/open-app', handleAndroidAction((controller, req) =>
-  controller.openApp(req.body || {})));
+  controller.openApp({ ...(req.body || {}), signal: req.signal })));
 
 router.post('/open-intent', async (req, res) => {
   try {
     const body = req.body || {};
     const intentUrl = body.data || body.url || body.uri;
-    if (intentUrl && typeof intentUrl === 'string' && !validateCloudUrl(intentUrl).allowed) {
+    if (
+      intentUrl
+      && typeof intentUrl === 'string'
+      && !(await validateAndroidIntentUrl(intentUrl, { signal: req.signal })).allowed
+    ) {
       return res.status(403).json({ error: 'This URL is not permitted.' });
     }
     const controller = await getAndroidController(req);
-    const result = await controller.openIntent(body);
+    const result = await controller.openIntent({ ...body, signal: req.signal });
     res.json(result);
   } catch (err) {
     res.status(500).json({ error: sanitizeError(err) });
@@ -125,22 +118,22 @@ router.post('/open-intent', async (req, res) => {
 });
 
 router.post('/tap', handleAndroidAction((controller, req) =>
-  controller.tap(req.body || {})));
+  controller.tap({ ...(req.body || {}), signal: req.signal })));
 
 router.post('/long-press', handleAndroidAction((controller, req) =>
-  controller.longPress(req.body || {})));
+  controller.longPress({ ...(req.body || {}), signal: req.signal })));
 
 router.post('/type', handleAndroidAction((controller, req) =>
-  controller.type(req.body || {})));
+  controller.type({ ...(req.body || {}), signal: req.signal })));
 
 router.post('/swipe', handleAndroidAction((controller, req) =>
-  controller.swipe(req.body || {})));
+  controller.swipe({ ...(req.body || {}), signal: req.signal })));
 
 router.post('/press-key', handleAndroidAction((controller, req) =>
-  controller.pressKey(req.body || {})));
+  controller.pressKey({ ...(req.body || {}), signal: req.signal })));
 
 router.post('/wait-for', handleAndroidAction((controller, req) =>
-  controller.waitFor(req.body || {})));
+  controller.waitFor({ ...(req.body || {}), signal: req.signal })));
 
 router.post('/install-apk', (req, res) => {
   androidApkUpload.single('apk')(req, res, async (uploadError) => {
@@ -162,7 +155,7 @@ router.post('/install-apk', (req, res) => {
 
     try {
       const controller = await getAndroidController(req);
-      const result = await controller.installApk({ apkPath: uploadedApkPath });
+      const result = await controller.installApk({ apkPath: uploadedApkPath, signal: req.signal });
       res.json({
         ...result,
         filename: req.file.originalname,
@@ -176,6 +169,9 @@ router.post('/install-apk', (req, res) => {
   });
 });
 
-router.post('/shell', handleAndroidAction((controller, req) => controller.shell(req.body || {})));
+router.post('/shell', handleAndroidAction((controller, req) => controller.shell({
+  ...(req.body || {}),
+  signal: req.signal,
+})));
 
 module.exports = router;

package/server/routes/behavior.js

@@ -0,0 +1,80 @@
+'use strict';
+
+const express = require('express');
+const { requireAuth } = require('../middleware/auth');
+const {
+  MODULE_IDS,
+  cloneDefaults,
+  getBehaviorConfig,
+  setBehaviorConfig,
+  resolveBehaviorConfig,
+} = require('../services/behavior');
+const {
+  getAgentIdFromRequest,
+  resolveAgentId,
+} = require('../services/agents/manager');
+const { invalidateSystemPromptCache } = require('../services/ai/systemPrompt');
+
+const router = express.Router();
+router.use(requireAuth);
+
+function requestAgentId(req) {
+  return resolveAgentId(req.session.userId, getAgentIdFromRequest(req));
+}
+
+router.get('/', (req, res) => {
+  const userId = req.session.userId;
+  const agentId = requestAgentId(req);
+  res.json({
+    agentId,
+    modules: MODULE_IDS,
+    defaults: cloneDefaults(),
+    config: getBehaviorConfig(userId, agentId),
+  });
+});
+
+router.put('/', (req, res) => {
+  if (!req.body?.config || typeof req.body.config !== 'object' || Array.isArray(req.body.config)) {
+    return res.status(400).json({ error: 'config must be an object' });
+  }
+  const userId = req.session.userId;
+  const agentId = requestAgentId(req);
+  const config = setBehaviorConfig(userId, agentId, req.body.config);
+  invalidateSystemPromptCache(userId, agentId);
+  return res.json({ agentId, config });
+});
+
+router.get('/effective', (req, res) => {
+  const userId = req.session.userId;
+  const agentId = requestAgentId(req);
+  const platform = String(req.query.platform || '').trim();
+  const chatId = String(req.query.chatId || '').trim();
+  if (!platform || !chatId) {
+    return res.status(400).json({ error: 'platform and chatId are required' });
+  }
+  return res.json({
+    agentId,
+    config: resolveBehaviorConfig(userId, agentId, {
+      platform,
+      chatId,
+      isGroup: req.query.isGroup !== 'false',
+    }),
+  });
+});
+
+router.get('/diagnostics', (req, res) => {
+  const userId = req.session.userId;
+  const agentId = requestAgentId(req);
+  const platform = String(req.query.platform || '').trim();
+  const chatId = String(req.query.chatId || '').trim();
+  if (!platform || !chatId) {
+    return res.status(400).json({ error: 'platform and chatId are required' });
+  }
+  const pipeline = req.app?.locals?.behaviorPipeline;
+  if (!pipeline?.getDiagnostics) {
+    return res.status(503).json({ error: 'Behavior runtime is not initialized' });
+  }
+  return res.json(pipeline.getDiagnostics(userId, agentId, platform, chatId));
+});
+
+module.exports = router;

package/server/routes/browser.js

@@ -1,8 +1,10 @@
+'use strict';
+
 const express = require('express');
 const router = express.Router();
 const { requireAuth } = require('../middleware/auth');
 const { sanitizeError } = require('../utils/security');
-const { validateCloudUrl } = require('../utils/cloud-security');
+const { validateCloudUrlWithDns } = require('../utils/cloud-security');
 const { getRuntimeValidation } = require('../services/runtime/validation');
 
 router.use(requireAuth);
@@ -11,7 +13,9 @@ async function getBrowserController(req) {
   const runtimeManager = req.app?.locals?.runtimeManager;
   if (runtimeManager && typeof runtimeManager.getBrowserProviderForUser === 'function') {
     const start = Date.now();
-    const runtimeController = await runtimeManager.getBrowserProviderForUser(req.session?.userId);
+    const runtimeController = await runtimeManager.getBrowserProviderForUser(req.session?.userId, {
+      signal: req.signal,
+    });
     const duration = Date.now() - start;
     if (duration > 1000) {
       console.log(`[HTTP] Browser controller acquired for user ${req.session?.userId} in ${duration}ms`);
@@ -73,7 +77,7 @@ router.get('/cookies', async (req, res) => {
     if (typeof bc.getCookies !== 'function') {
       return res.status(501).json({ error: 'Cookie export is unavailable for this browser provider.' });
     }
-    const result = await bc.getCookies();
+    const result = await bc.getCookies({ signal: req.signal });
     res.json(result);
   } catch (err) {
     res.status(500).json({ error: sanitizeError(err) });
@@ -84,7 +88,7 @@ router.get('/cookies', async (req, res) => {
 router.post('/launch', async (req, res) => {
   try {
     const bc = await getBrowserController(req);
-    await bc.launch(req.body || {});
+    await bc.launch({ ...(req.body || {}), signal: req.signal });
     res.json({ success: true });
   } catch (err) {
     res.status(500).json({ error: sanitizeError(err) });
@@ -97,12 +101,12 @@ router.post('/navigate', async (req, res) => {
     const { url, waitFor } = req.body;
     if (!url) return res.status(400).json({ error: 'url required' });
 
-    const bc = await getBrowserController(req);
-
-    if (bc.providerType === 'vm' && !validateCloudUrl(url).allowed) {
+    const urlValidation = await validateCloudUrlWithDns(url, { signal: req.signal });
+    if (!urlValidation.allowed) {
       return res.status(403).json({ error: 'This URL is not permitted.' });
     }
 
+    const bc = await getBrowserController(req);
     const result = await bc.navigate(url, {
       waitUntil: waitFor || req.body?.waitUntil || 'domcontentloaded',
       waitFor,
@@ -110,6 +114,7 @@ router.post('/navigate', async (req, res) => {
       fullPage: req.body?.fullPage === true,
       referrerMode: req.body?.referrerMode,
       challengeRetry: req.body?.challengeRetry,
+      signal: req.signal,
     });
     res.json(result);
   } catch (err) {
@@ -121,7 +126,7 @@ router.post('/navigate', async (req, res) => {
 router.post('/screenshot', async (req, res) => {
   try {
     const bc = await getBrowserController(req);
-    const result = await bc.screenshot(req.body || {});
+    const result = await bc.screenshot({ ...(req.body || {}), signal: req.signal });
     res.json(result);
   } catch (err) {
     res.status(500).json({ error: sanitizeError(err) });
@@ -133,7 +138,7 @@ router.post('/click', async (req, res) => {
   try {
     const { selector, text } = req.body;
     const bc = await getBrowserController(req);
-    const result = await bc.click(selector, text, req.body?.screenshot !== false);
+    const result = await bc.click(selector, text, req.body?.screenshot !== false, { signal: req.signal });
     res.json(result);
   } catch (err) {
     res.status(500).json({ error: sanitizeError(err) });
@@ -147,7 +152,7 @@ router.post('/click-point', async (req, res) => {
       return res.status(400).json({ error: 'x and y required' });
     }
     const bc = await getBrowserController(req);
-    const result = await bc.clickPoint(x, y, req.body?.screenshot !== false);
+    const result = await bc.clickPoint(x, y, req.body?.screenshot !== false, { signal: req.signal });
     res.json(result);
   } catch (err) {
     res.status(500).json({ error: sanitizeError(err) });
@@ -161,7 +166,7 @@ router.post('/mouse-move', async (req, res) => {
       return res.status(400).json({ error: 'x and y required' });
     }
     const bc = await getBrowserController(req);
-    const result = await bc.hoverPoint(x, y, req.body || {});
+    const result = await bc.hoverPoint(x, y, { ...(req.body || {}), signal: req.signal });
     res.json(result);
   } catch (err) {
     res.status(500).json({ error: sanitizeError(err) });
@@ -179,6 +184,7 @@ router.post('/fill', async (req, res) => {
       clear: req.body?.clear !== false,
       pressEnter: req.body?.pressEnter === true,
       screenshot: req.body?.screenshot !== false,
+      signal: req.signal,
     });
     res.json(result);
   } catch (err) {
@@ -193,6 +199,7 @@ router.post('/type-text', async (req, res) => {
     const result = await bc.typeText(String(text || ''), {
       pressEnter: req.body?.pressEnter === true,
       screenshot: req.body?.screenshot !== false,
+      signal: req.signal,
     });
     res.json(result);
   } catch (err) {
@@ -205,7 +212,7 @@ router.post('/press-key', async (req, res) => {
     const { key } = req.body || {};
     if (!key) return res.status(400).json({ error: 'key required' });
     const bc = await getBrowserController(req);
-    const result = await bc.pressKey(key, req.body?.screenshot !== false);
+    const result = await bc.pressKey(key, req.body?.screenshot !== false, { signal: req.signal });
     res.json(result);
   } catch (err) {
     res.status(500).json({ error: sanitizeError(err) });
@@ -219,6 +226,7 @@ router.post('/scroll', async (req, res) => {
       req.body?.deltaX ?? 0,
       req.body?.deltaY ?? 0,
       req.body?.screenshot !== false,
+      { signal: req.signal },
     );
     res.json(result);
   } catch (err) {
@@ -230,7 +238,7 @@ router.post('/scroll', async (req, res) => {
 router.post('/extract', async (req, res) => {
   try {
     const bc = await getBrowserController(req);
-    const result = await bc.extractContent(req.body || {});
+    const result = await bc.extractContent({ ...(req.body || {}), signal: req.signal });
     res.json(result);
   } catch (err) {
     res.status(500).json({ error: sanitizeError(err) });
@@ -252,7 +260,7 @@ router.post('/execute', async (req, res) => {
     }
 
     const bc = await getBrowserController(req);
-    const result = await bc.executeJS(code);
+    const result = await bc.executeJS(code, { signal: req.signal });
     res.json({ result });
   } catch (err) {
     res.status(500).json({ error: sanitizeError(err) });
@@ -263,7 +271,7 @@ router.post('/execute', async (req, res) => {
 router.post('/close', async (req, res) => {
   try {
     const bc = await getBrowserController(req);
-    await bc.closeBrowser();
+    await bc.closeBrowser({ signal: req.signal });
     res.json({ success: true });
   } catch (err) {
     res.status(500).json({ error: sanitizeError(err) });

package/server/routes/desktop.js

@@ -1,3 +1,5 @@
+'use strict';
+
 const express = require('express');
 const router = express.Router();
 const { requireAuth } = require('../middleware/auth');
@@ -144,6 +146,7 @@ router.post('/screenshot', (req, res) =>
   handleDesktopAction(req, res, (provider, request) => provider.screenshot({
     ...(request.body || {}),
     deviceId: parseDeviceId(request.body?.deviceId),
+    signal: request.signal,
   })));
 
 router.post('/observe', (req, res) =>
@@ -151,6 +154,7 @@ router.post('/observe', (req, res) =>
     ...(request.body || {}),
     deviceId: parseDeviceId(request.body?.deviceId),
     includeTree: parseOptionalBoolean(request.body?.includeTree, false),
+    signal: request.signal,
   })));
 
 router.post('/click', (req, res) =>
@@ -160,6 +164,7 @@ router.post('/click', (req, res) =>
     {
       ...(request.body || {}),
       deviceId: parseDeviceId(request.body?.deviceId),
+      signal: request.signal,
     },
   )));
 
@@ -170,6 +175,7 @@ router.post('/mouse-move', (req, res) =>
     {
       ...(request.body || {}),
       deviceId: parseDeviceId(request.body?.deviceId),
+      signal: request.signal,
     },
   )));
 
@@ -182,6 +188,7 @@ router.post('/drag', (req, res) =>
     x2: parseFiniteNumber(request.body?.x2, 'x2', { min: -100000, max: 100000 }),
     y2: parseFiniteNumber(request.body?.y2, 'y2', { min: -100000, max: 100000 }),
     durationMs: Math.round(parseFiniteNumber(request.body?.durationMs ?? 280, 'durationMs', { min: 20, max: 5000 })),
+    signal: request.signal,
   })));
 
 router.post('/scroll', (req, res) =>
@@ -190,6 +197,7 @@ router.post('/scroll', (req, res) =>
     deviceId: parseDeviceId(request.body?.deviceId),
     deltaX: Math.round(parseFiniteNumber(request.body?.deltaX ?? 0, 'deltaX', { min: -5000, max: 5000 })),
     deltaY: Math.round(parseFiniteNumber(request.body?.deltaY ?? 0, 'deltaY', { min: -5000, max: 5000 })),
+    signal: request.signal,
   })));
 
 router.post('/type-text', (req, res) =>
@@ -199,6 +207,7 @@ router.post('/type-text', (req, res) =>
       ...(request.body || {}),
       deviceId: parseDeviceId(request.body?.deviceId),
       pressEnter: parseOptionalBoolean(request.body?.pressEnter, false),
+      signal: request.signal,
     },
   )));
 
@@ -208,6 +217,7 @@ router.post('/press-key', (req, res) =>
     {
       ...(request.body || {}),
       deviceId: parseDeviceId(request.body?.deviceId),
+      signal: request.signal,
     },
   )));
 
@@ -216,11 +226,15 @@ router.post('/launch-app', (req, res) =>
     ...(request.body || {}),
     deviceId: parseDeviceId(request.body?.deviceId),
     app: parseRequiredString(request.body?.app, 'app', MAX_APP_LENGTH),
+    signal: request.signal,
   })));
 
 router.get('/displays', (req, res) =>
   handleDesktopAction(req, res, (provider, request) =>
-    provider.listDisplays(parseTypedDisplayQuery(request.query))));
+    provider.listDisplays({
+      ...parseTypedDisplayQuery(request.query),
+      signal: request.signal,
+    })));
 
 router.post('/select-display', (req, res) =>
   handleDesktopAction(req, res, (provider, request) => provider.selectDisplay(
@@ -228,6 +242,7 @@ router.post('/select-display', (req, res) =>
     {
       ...(request.body || {}),
       deviceId: parseDeviceId(request.body?.deviceId),
+      signal: request.signal,
     },
   )));
 
@@ -239,12 +254,14 @@ router.post('/pause-device', (req, res) =>
   handleDesktopAction(req, res, (provider, request) => provider.pauseDevice(
     parseRequiredString(request.body?.deviceId, 'deviceId', 256),
     parseOptionalBoolean(request.body?.paused, true),
+    { signal: request.signal },
   )));
 
 router.post('/tree', (req, res) =>
   handleDesktopAction(req, res, (provider, request) => provider.getAccessibilityTree({
     ...(request.body || {}),
     deviceId: parseDeviceId(request.body?.deviceId),
+    signal: request.signal,
   })));
 
 module.exports = router;

package/server/routes/integrations.js

@@ -17,6 +17,14 @@ function getAuthProviderManager(req) {
   return req.app?.locals?.authProviderManager;
 }
 
+function getCredentialScope(req) {
+  const userId = Number(req.session.userId);
+  return {
+    userId,
+    agentId: resolveAgentId(userId, getAgentIdFromRequest(req)),
+  };
+}
+
 function escapeHtml(value) {
   return String(value || '')
     .replace(/&/g, '&')
@@ -101,7 +109,7 @@ router.get('/oauth/callback', async (req, res) => {
     if (!manager) {
       throw new Error('Official integration manager is not available on app.locals.integrationManager.');
     }
-    const result = await manager.finishOAuth(state, code);
+    const result = await manager.finishOAuth(state, code, { signal: req.signal });
     const payload = JSON.stringify({
       type: 'integration_oauth_success',
       provider: result.provider,
@@ -144,6 +152,100 @@ router.get('/oauth/callback', async (req, res) => {
 
 router.use(requireAuth);
 
+router.post('/bitwarden/unlock', async (req, res) => {
+  try {
+    const cli = req.app?.locals?.bitwardenCli;
+    if (!cli) throw new Error('Bitwarden credential service is unavailable.');
+    const scope = getCredentialScope(req);
+    const status = await cli.unlock(
+      scope.userId,
+      scope.agentId,
+      req.body?.masterPassword,
+      req.body?.idleTimeoutMinutes,
+      { signal: req.signal },
+    );
+    res.json(status);
+  } catch (err) {
+    res.status(400).json({ error: sanitizeError(err), code: err.code || null });
+  }
+});
+
+router.post('/bitwarden/lock', async (req, res) => {
+  try {
+    const cli = req.app?.locals?.bitwardenCli;
+    if (!cli) throw new Error('Bitwarden credential service is unavailable.');
+    const scope = getCredentialScope(req);
+    res.json(await cli.lock(scope.userId, scope.agentId));
+  } catch (err) {
+    res.status(400).json({ error: sanitizeError(err), code: err.code || null });
+  }
+});
+
+router.get('/bitwarden/items', async (req, res) => {
+  try {
+    const broker = req.app?.locals?.credentialBroker;
+    if (!broker) throw new Error('Credential broker is unavailable.');
+    const scope = getCredentialScope(req);
+    res.json({ items: await broker.listVaultItems(scope.userId, scope.agentId, { signal: req.signal }) });
+  } catch (err) {
+    res.status(400).json({ error: sanitizeError(err), code: err.code || null });
+  }
+});
+
+router.get('/bitwarden/bindings', (req, res) => {
+  try {
+    const broker = req.app?.locals?.credentialBroker;
+    if (!broker) throw new Error('Credential broker is unavailable.');
+    const scope = getCredentialScope(req);
+    res.json({ bindings: broker.listBindings(scope.userId, scope.agentId) });
+  } catch (err) {
+    res.status(400).json({ error: sanitizeError(err), code: err.code || null });
+  }
+});
+
+router.post('/bitwarden/bindings', async (req, res) => {
+  try {
+    const broker = req.app?.locals?.credentialBroker;
+    if (!broker) throw new Error('Credential broker is unavailable.');
+    const scope = getCredentialScope(req);
+    const binding = await broker.createBinding(scope.userId, scope.agentId, req.body, {
+      signal: req.signal,
+    });
+    res.status(201).json({ binding });
+  } catch (err) {
+    res.status(400).json({ error: sanitizeError(err), code: err.code || null });
+  }
+});
+
+router.put('/bitwarden/bindings/:bindingId', async (req, res) => {
+  try {
+    const broker = req.app?.locals?.credentialBroker;
+    if (!broker) throw new Error('Credential broker is unavailable.');
+    const scope = getCredentialScope(req);
+    const binding = await broker.updateBinding(
+      scope.userId,
+      scope.agentId,
+      req.params.bindingId,
+      req.body,
+      { signal: req.signal },
+    );
+    res.json({ binding });
+  } catch (err) {
+    res.status(400).json({ error: sanitizeError(err), code: err.code || null });
+  }
+});
+
+router.delete('/bitwarden/bindings/:bindingId', (req, res) => {
+  try {
+    const broker = req.app?.locals?.credentialBroker;
+    if (!broker) throw new Error('Credential broker is unavailable.');
+    const scope = getCredentialScope(req);
+    res.json(broker.deleteBinding(scope.userId, scope.agentId, req.params.bindingId));
+  } catch (err) {
+    res.status(400).json({ error: sanitizeError(err), code: err.code || null });
+  }
+});
+
 router.get('/qr-image', async (req, res) => {
   try {
     const data = String(req.query.data || '').trim();
@@ -320,6 +422,7 @@ router.post('/:provider/connect', async (req, res) => {
       {
         appKey: req.body?.appId,
         agentId: resolveAgentId(req.session.userId, getAgentIdFromRequest(req)),
+        signal: req.signal,
       },
     );
     res.json(result);
@@ -340,6 +443,7 @@ router.post('/:provider/disconnect', async (req, res) => {
       {
         connectionId: req.body?.connectionId,
         agentId: resolveAgentId(req.session.userId, getAgentIdFromRequest(req)),
+        signal: req.signal,
       },
     );
     res.json(result);
@@ -429,6 +533,7 @@ router.put('/:provider/config', async (req, res) => {
       userId: req.session.userId,
       agentId: resolveAgentId(req.session.userId, getAgentIdFromRequest(req)),
       config: req.body?.config || req.body || {},
+      signal: req.signal,
     });
     res.json({
       provider: provider.key,
@@ -458,6 +563,7 @@ router.delete('/:provider/config', async (req, res) => {
     await provider.clearUserConfig({
       userId: req.session.userId,
       agentId: resolveAgentId(req.session.userId, getAgentIdFromRequest(req)),
+      signal: req.signal,
     });
     res.json({
       provider: provider.key,

package/server/routes/memory.js

@@ -198,6 +198,7 @@ router.post('/ingestion/documents', async (req, res) => {
       connectionId: req.body.connectionId,
       sourceAccount: req.body.sourceAccount,
       metadata: normalizeMetadata(req.body.metadata),
+      signal: req.signal,
     });
     res.json(result);
   } catch (err) {