neoagent 3.2.1-beta.1 → 3.2.1-beta.11

package/server/services/integrations/bitwarden/provider.js

@@ -0,0 +1,197 @@
+'use strict';
+
+const db = require('../../../db/database');
+const { resolveAgentId } = require('../../agents/manager');
+const { getConnectionAccessMode } = require('../access');
+const {
+  deleteProviderConfig,
+  getProviderConfig,
+  setProviderConfig,
+} = require('../provider_config_store');
+const { encryptValue } = require('../secrets');
+const { BITWARDEN_APP, BITWARDEN_PROVIDER_KEY } = require('./constants');
+const { buildBitwardenSnapshot } = require('./snapshot');
+
+const DEFAULT_SERVER_URL = 'https://vault.bitwarden.com';
+
+function text(value) {
+  return String(value || '').trim();
+}
+
+function normalizeServerUrl(value) {
+  const url = new URL(text(value) || DEFAULT_SERVER_URL);
+  if (url.protocol !== 'https:' || url.username || url.password || url.search || url.hash) {
+    throw new Error('Bitwarden server must be an HTTPS URL without embedded credentials.');
+  }
+  return url.toString().replace(/\/+$/, '');
+}
+
+function parseConfig(raw, existing = {}) {
+  const source = raw && typeof raw === 'object' ? raw : {};
+  return {
+    serverUrl: normalizeServerUrl(source.serverUrl || existing.serverUrl || DEFAULT_SERVER_URL),
+    email: text(source.email) || text(existing.email),
+    clientId: text(source.clientId) || text(existing.clientId),
+    clientSecret: text(source.clientSecret) || text(existing.clientSecret),
+    idleTimeoutMinutes: Math.max(5, Math.min(120, Number(
+      source.idleTimeoutMinutes || existing.idleTimeoutMinutes || 30,
+    ))),
+  };
+}
+
+function loadConnection(userId, agentId) {
+  return db.prepare(
+    `SELECT * FROM integration_connections
+     WHERE user_id = ? AND agent_id = ? AND provider_key = ? AND app_key = ?
+     ORDER BY updated_at DESC, id DESC LIMIT 1`,
+  ).get(userId, agentId, BITWARDEN_PROVIDER_KEY, BITWARDEN_APP.id) || null;
+}
+
+function publicConfig(config, connection, status = {}) {
+  return {
+    serverUrl: config.serverUrl || DEFAULT_SERVER_URL,
+    email: config.email || '',
+    idleTimeoutMinutes: config.idleTimeoutMinutes || 30,
+    hasClientId: Boolean(config.clientId),
+    hasClientSecret: Boolean(config.clientSecret),
+    configured: Boolean(config.email && config.clientId && config.clientSecret),
+    accountCount: connection?.status === 'connected' ? 1 : 0,
+    hasConnectedAccount: connection?.status === 'connected',
+    connectionId: connection?.id || null,
+    cliAvailable: status.cliAvailable !== false,
+    unlocked: Boolean(status.unlocked),
+    lastUsedAt: status.lastUsedAt || null,
+  };
+}
+
+function upsertConnection(userId, agentId, config) {
+  const existing = loadConnection(userId, agentId);
+  const metadata = JSON.stringify({
+    access_mode: getConnectionAccessMode(existing),
+    idleTimeoutMinutes: config.idleTimeoutMinutes,
+  });
+  db.prepare(
+    `INSERT INTO integration_connections (
+       user_id, agent_id, provider_key, app_key, status, account_email,
+       scopes_json, credentials_json, metadata_json, last_connected_at, updated_at
+     ) VALUES (?, ?, ?, ?, 'connected', ?, ?, ?, ?, datetime('now'), datetime('now'))
+     ON CONFLICT(user_id, agent_id, provider_key, app_key, account_email) DO UPDATE SET
+       status = excluded.status,
+       credentials_json = excluded.credentials_json,
+       metadata_json = excluded.metadata_json,
+       last_connected_at = excluded.last_connected_at,
+       updated_at = excluded.updated_at`,
+  ).run(
+    userId,
+    agentId,
+    BITWARDEN_PROVIDER_KEY,
+    BITWARDEN_APP.id,
+    config.email,
+    JSON.stringify(['vault:read_selected']),
+    encryptValue(JSON.stringify(config)),
+    metadata,
+  );
+  if (existing && existing.account_email !== config.email) {
+    db.prepare('DELETE FROM integration_connections WHERE id = ?').run(existing.id);
+  }
+  return loadConnection(userId, agentId);
+}
+
+function createBitwardenProvider(options = {}) {
+  const app = options.app || null;
+  const cli = () => app?.locals?.bitwardenCli;
+  const broker = () => app?.locals?.credentialBroker;
+
+  return {
+    key: BITWARDEN_PROVIDER_KEY,
+    label: 'Bitwarden',
+    description: 'Fill browser logins and authenticate bounded API requests while keeping secrets hidden from the AI.',
+    icon: 'password',
+    apps: [BITWARDEN_APP],
+    connectPrompt: 'Add a Bitwarden API key, then unlock the vault when credentials are needed. The master password and vault secrets are never sent to the AI.',
+    supportsMultipleAccounts: false,
+    connectionMethod: 'user_config',
+    getApp(appId) {
+      return text(appId) === BITWARDEN_APP.id ? BITWARDEN_APP : null;
+    },
+    getToolAppId() {
+      return null;
+    },
+    getToolDefinitions() {
+      return [];
+    },
+    supportsTool() {
+      return false;
+    },
+    getEnvStatus(context = {}) {
+      const userId = Number(context.userId);
+      const agentId = Number.isInteger(userId) && userId > 0
+        ? resolveAgentId(userId, context.agentId || null)
+        : null;
+      const config = agentId ? parseConfig(getProviderConfig(userId, BITWARDEN_PROVIDER_KEY, agentId)) : {};
+      const missing = ['email', 'clientId', 'clientSecret'].filter((key) => !config[key]);
+      return {
+        configured: missing.length === 0,
+        missing,
+        summary: missing.length === 0
+          ? 'Bitwarden is configured. Unlock it only when a credential operation is needed.'
+          : 'Add a Bitwarden personal API key in Official Integrations.',
+        setupMode: 'user',
+      };
+    },
+    buildSnapshot(connectionRows, context = {}) {
+      return buildBitwardenSnapshot(this, connectionRows, {
+        ...context,
+        credentialBindingsSummary: context.userId
+          ? broker()?.summarizeBindings(context.userId, context.agentId)
+          : 'No credential bindings are configured.',
+      });
+    },
+    summarizeForModel(snapshot) {
+      if (!snapshot?.connection?.connected) {
+        return 'Bitwarden: not configured. The user can connect it in Official Integrations.';
+      }
+      const bindings = snapshot.credentialBindingsSummary || 'No credential bindings are configured.';
+      return `Bitwarden credential broker: ${bindings} Secret values are never available to the model.`;
+    },
+    getUserConfig({ userId, agentId }) {
+      const normalizedUserId = Number(userId);
+      const scopedAgentId = resolveAgentId(normalizedUserId, agentId || null);
+      const config = parseConfig(getProviderConfig(normalizedUserId, BITWARDEN_PROVIDER_KEY, scopedAgentId));
+      return publicConfig(config, loadConnection(normalizedUserId, scopedAgentId), cli()?.getStatus(normalizedUserId, scopedAgentId));
+    },
+    async saveUserConfig({ userId, agentId, config, signal }) {
+      const normalizedUserId = Number(userId);
+      if (!Number.isInteger(normalizedUserId) || normalizedUserId <= 0) {
+        throw new Error('A valid user is required to save Bitwarden configuration.');
+      }
+      const scopedAgentId = resolveAgentId(normalizedUserId, agentId || null);
+      const existing = getProviderConfig(normalizedUserId, BITWARDEN_PROVIDER_KEY, scopedAgentId);
+      const parsed = parseConfig(config, existing);
+      if (!parsed.email || !parsed.clientId || !parsed.clientSecret) {
+        throw new Error('Bitwarden email, client ID, and client secret are required.');
+      }
+      if (!cli()) throw new Error('Bitwarden credential service is unavailable.');
+      await cli().configure(normalizedUserId, scopedAgentId, parsed, { signal });
+      setProviderConfig(normalizedUserId, BITWARDEN_PROVIDER_KEY, parsed, scopedAgentId);
+      const connection = upsertConnection(normalizedUserId, scopedAgentId, parsed);
+      return publicConfig(parsed, connection, cli().getStatus(normalizedUserId, scopedAgentId));
+    },
+    async clearUserConfig({ userId, agentId }) {
+      const normalizedUserId = Number(userId);
+      const scopedAgentId = resolveAgentId(normalizedUserId, agentId || null);
+      await cli()?.logout(normalizedUserId, scopedAgentId);
+      deleteProviderConfig(normalizedUserId, BITWARDEN_PROVIDER_KEY, scopedAgentId);
+      db.prepare(
+        'DELETE FROM integration_connections WHERE user_id = ? AND agent_id = ? AND provider_key = ?',
+      ).run(normalizedUserId, scopedAgentId, BITWARDEN_PROVIDER_KEY);
+      return { cleared: true };
+    },
+  };
+}
+
+module.exports = {
+  createBitwardenProvider,
+  normalizeServerUrl,
+  parseConfig,
+};

package/server/services/integrations/bitwarden/snapshot.js

@@ -0,0 +1,65 @@
+'use strict';
+
+const { getConnectionAccessMode } = require('../access');
+const { BITWARDEN_APP } = require('./constants');
+
+function summarizeAccount(row, env) {
+  if (!row) {
+    return {
+      id: null,
+      status: env.configured ? 'not_connected' : 'env_not_configured',
+      connected: false,
+      accountEmail: null,
+      lastConnectedAt: null,
+      accessMode: 'read_write',
+    };
+  }
+  return {
+    id: row.id,
+    status: row.status,
+    connected: row.status === 'connected',
+    accountEmail: row.account_email || null,
+    lastConnectedAt: row.last_connected_at || null,
+    accessMode: getConnectionAccessMode(row),
+  };
+}
+
+function buildBitwardenSnapshot(provider, connectionRows, context = {}) {
+  const env = provider.getEnvStatus(context);
+  const row = (Array.isArray(connectionRows) ? connectionRows : [])
+    .filter((candidate) => candidate.app_key === BITWARDEN_APP.id)
+    .sort((left, right) => String(right.updated_at || '').localeCompare(String(left.updated_at || '')))[0] || null;
+  const account = summarizeAccount(row, env);
+  const accounts = row ? [account] : [];
+  const connection = {
+    status: !env.configured ? 'env_not_configured' : account.status,
+    connected: account.connected,
+    accountEmail: account.accountEmail,
+    accountCount: account.connected ? 1 : 0,
+    appCount: account.connected ? 1 : 0,
+    lastConnectedAt: account.lastConnectedAt,
+  };
+  return {
+    id: provider.key,
+    label: provider.label,
+    description: provider.description,
+    icon: provider.icon,
+    apps: [{
+      ...BITWARDEN_APP,
+      accounts,
+      connection,
+      availableToolCount: account.connected ? 2 : 0,
+    }],
+    env,
+    connection,
+    availableToolCount: account.connected ? 2 : 0,
+    credentialBindingsSummary: context.credentialBindingsSummary || 'No credential bindings are configured.',
+    connectPrompt: provider.connectPrompt,
+    supportsMultipleAccounts: false,
+    connectionMethod: 'user_config',
+  };
+}
+
+module.exports = {
+  buildBitwardenSnapshot,
+};

package/server/services/integrations/figma/provider.js

@@ -158,25 +158,88 @@ function figmaUrl(path, query) {
   return url.toString();
 }
 
-async function figmaRequest(credentials, { method = 'GET', path, query, body }) {
-  return fetchJson(
+function expiresAtFromSeconds(expiresIn) {
+  return new Date(
+    Date.now() + Math.max(1, Number(expiresIn) || 3600) * 1000,
+  ).toISOString();
+}
+
+function tokenExpiresSoon(credentials) {
+  const expiresAt = Date.parse(String(credentials?.expires_at || ''));
+  return Number.isFinite(expiresAt) && expiresAt <= Date.now() + 60 * 1000;
+}
+
+async function refreshFigmaCredentials(credentials, signal) {
+  const refreshToken = String(credentials?.refresh_token || '').trim();
+  if (!refreshToken) {
+    throw new Error('Figma refresh token is missing. Reconnect this integration account.');
+  }
+  const config = resolveFigmaOAuthConfig();
+  const basic = Buffer.from(`${config.clientId}:${config.clientSecret}`).toString(
+    'base64',
+  );
+  const token = await fetchJson(
+    'https://api.figma.com/v1/oauth/token',
+    {
+      method: 'POST',
+      headers: { Authorization: `Basic ${basic}` },
+      form: {
+        grant_type: 'refresh_token',
+        refresh_token: refreshToken,
+      },
+      signal,
+    },
+    { serviceName: 'Figma token refresh' },
+  );
+  if (!String(token?.access_token || '').trim()) {
+    throw new Error('Figma token refresh did not return an access token.');
+  }
+  return {
+    ...credentials,
+    access_token: token.access_token,
+    refresh_token: token.refresh_token || refreshToken,
+    token_type: token.token_type || credentials.token_type || 'bearer',
+    expires_in: token.expires_in,
+    expires_at: expiresAtFromSeconds(token.expires_in),
+  };
+}
+
+async function figmaRequest(context, { method = 'GET', path, query, body }) {
+  const { signal } = context;
+  let credentials = context.credentials;
+  if (tokenExpiresSoon(credentials)) {
+    credentials = await refreshFigmaCredentials(credentials, signal);
+    context.updateCredentials(credentials);
+  }
+
+  const performRequest = (activeCredentials) => fetchJson(
     figmaUrl(path, query),
     {
       method: String(method || 'GET').toUpperCase(),
-      headers: { Authorization: `Bearer ${credentials.access_token}` },
+      headers: { Authorization: `Bearer ${activeCredentials.access_token}` },
       ...(body === undefined ? {} : { json: body }),
+      signal,
     },
     { serviceName: 'Figma' },
   );
+
+  try {
+    return await performRequest(credentials);
+  } catch (error) {
+    if (error?.status !== 401 || !credentials.refresh_token) throw error;
+    credentials = await refreshFigmaCredentials(credentials, signal);
+    context.updateCredentials(credentials);
+    return performRequest(credentials);
+  }
 }
 
-async function executeFigmaTool(toolName, args, { credentials }) {
+async function executeFigmaTool(toolName, args, context) {
   switch (toolName) {
     case 'figma_get_me':
-      return { result: await figmaRequest(credentials, { path: '/v1/me' }) };
+      return { result: await figmaRequest(context, { path: '/v1/me' }) };
     case 'figma_get_file':
       return {
-        result: await figmaRequest(credentials, {
+        result: await figmaRequest(context, {
           path: `/v1/files/${encodeURIComponent(requireText(args.file_key, 'file_key'))}`,
           query: {
             ids: args.ids || undefined,
@@ -186,14 +249,14 @@ async function executeFigmaTool(toolName, args, { credentials }) {
       };
     case 'figma_get_file_nodes':
       return {
-        result: await figmaRequest(credentials, {
+        result: await figmaRequest(context, {
           path: `/v1/files/${encodeURIComponent(requireText(args.file_key, 'file_key'))}/nodes`,
           query: { ids: requireText(args.ids, 'ids') },
         }),
       };
     case 'figma_get_file_images':
       return {
-        result: await figmaRequest(credentials, {
+        result: await figmaRequest(context, {
           path: `/v1/images/${encodeURIComponent(requireText(args.file_key, 'file_key'))}`,
           query: {
             ids: requireText(args.ids, 'ids'),
@@ -204,13 +267,13 @@ async function executeFigmaTool(toolName, args, { credentials }) {
       };
     case 'figma_get_comments':
       return {
-        result: await figmaRequest(credentials, {
+        result: await figmaRequest(context, {
           path: `/v1/files/${encodeURIComponent(requireText(args.file_key, 'file_key'))}/comments`,
         }),
       };
     case 'figma_post_comment':
       return {
-        result: await figmaRequest(credentials, {
+        result: await figmaRequest(context, {
           method: 'POST',
           path: `/v1/files/${encodeURIComponent(requireText(args.file_key, 'file_key'))}/comments`,
           body: {
@@ -221,7 +284,7 @@ async function executeFigmaTool(toolName, args, { credentials }) {
       };
     case 'figma_api_request':
       return {
-        result: await figmaRequest(credentials, {
+        result: await figmaRequest(context, {
           method: args.method,
           path: requireText(args.path, 'path'),
           query: args.query,
@@ -263,7 +326,7 @@ function createFigmaProvider() {
         appId: app.id,
       };
     },
-    async finishOAuth({ code, app }) {
+    async finishOAuth({ code, app, signal }) {
       const config = resolveFigmaOAuthConfig();
       const basic = Buffer.from(`${config.clientId}:${config.clientSecret}`).toString(
         'base64',
@@ -280,6 +343,7 @@ function createFigmaProvider() {
             code,
             grant_type: 'authorization_code',
           },
+          signal,
         },
         { serviceName: 'Figma' },
       );
@@ -290,6 +354,7 @@ function createFigmaProvider() {
           headers: {
             Authorization: `Bearer ${token.access_token}`,
           },
+          signal,
         },
         { serviceName: 'Figma' },
       );
@@ -307,6 +372,7 @@ function createFigmaProvider() {
           access_token: token.access_token,
           refresh_token: token.refresh_token,
           expires_in: token.expires_in,
+          expires_at: expiresAtFromSeconds(token.expires_in),
           token_type: token.token_type,
           scope: token.scope,
         },

package/server/services/integrations/github/common.js

@@ -1,6 +1,7 @@
 'use strict';
 
 const crypto = require('crypto');
+const { fetchResponseText } = require('../http');
 
 function base64UrlSha256(value) {
   return crypto
@@ -46,15 +47,19 @@ async function githubApiRequest(auth, options = {}) {
     headers['Content-Type'] = 'application/json';
   }
 
-  const response = await fetch(url.toString(), {
-    method,
-    headers,
-    body: body ? JSON.stringify(body) : undefined,
-  });
+  const { response, text: rawBody } = await fetchResponseText(
+    url.toString(),
+    {
+      method,
+      headers,
+      body: body ? JSON.stringify(body) : undefined,
+      signal: options.signal || auth?.signal,
+    },
+    { serviceName: 'GitHub API' },
+  );
 
   let data = null;
   if (response.status !== 204 && response.status !== 205) {
-    const rawBody = await response.text();
     if (rawBody.trim()) {
       try {
         data = JSON.parse(rawBody);

package/server/services/integrations/github/provider.js

@@ -6,6 +6,8 @@ const { decryptValue } = require('../secrets');
 const { getConnectionAccessMode } = require('../access');
 const { githubToolDefinitions, executeGithubTool } = require('./repos');
 const { base64UrlSha256 } = require('./common');
+const { fetchJson } = require('../oauth_provider');
+const { fetchResponseText } = require('../http');
 
 const GITHUB_ACCOUNT_IDENTITY_SCOPES = [
   'read:user',
@@ -159,8 +161,9 @@ function summarizeAppConnection(app, connectionRows, envStatus) {
   };
 }
 
-async function executeGithubRepoTool(toolName, args, connection) {
+async function executeGithubRepoTool(toolName, args, connection, executionOptions = {}) {
   const auth = await buildAuthorizedClient(connection);
+  auth.signal = executionOptions.signal || null;
   if (!auth.token) {
     throw new Error('GitHub access token is missing or expired. Please reconnect your GitHub account.');
   }
@@ -326,40 +329,32 @@ function createGithubProvider() {
       const url = `https://github.com/login/oauth/authorize?${params.toString()}`;
       return { url, appId: app.id };
     },
-    async finishOAuth({ code, codeVerifier, appKey }) {
+    async finishOAuth({ code, codeVerifier, appKey, signal }) {
       const app = getApp(appKey);
       if (!app) {
         throw new Error(`Unknown GitHub app: ${appKey}`);
       }
       const { config } = createOAuthClient();
 
-      const tokenResponse = await fetch('https://github.com/login/oauth/access_token', {
-        method: 'POST',
-        headers: {
-          'Accept': 'application/json',
-          'Content-Type': 'application/x-www-form-urlencoded',
+      const tokenData = await fetchJson(
+        'https://github.com/login/oauth/access_token',
+        {
+          method: 'POST',
+          form: {
+            client_id: config.clientId,
+            client_secret: config.clientSecret,
+            code,
+            code_verifier: codeVerifier,
+            redirect_uri: config.redirectUri,
+          },
+          signal,
         },
-        body: new URLSearchParams({
-          client_id: config.clientId,
-          client_secret: config.clientSecret,
-          code,
-          code_verifier: codeVerifier,
-          redirect_uri: config.redirectUri,
-        }).toString(),
-      });
-
-      const tokenBody = await tokenResponse.text();
-      let tokenData = {};
-      try {
-        tokenData = tokenBody ? JSON.parse(tokenBody) : {};
-      } catch {
-        tokenData = {};
-      }
-      if (!tokenResponse.ok) {
-        throw new Error(`GitHub OAuth token exchange failed (${tokenResponse.status}): ${tokenBody || 'No response body'}`);
-      }
-      if (tokenData.error) {
-        throw new Error(`GitHub OAuth error: ${tokenData.error_description || tokenData.error}`);
+        { serviceName: 'GitHub OAuth token exchange' },
+      );
+      if (tokenData?.error) {
+        throw new Error(
+          `GitHub OAuth error: ${tokenData.error_description || tokenData.error}`,
+        );
       }
 
       const accessToken = tokenData.access_token;
@@ -367,17 +362,17 @@ function createGithubProvider() {
         throw new Error('GitHub OAuth did not return an access token.');
       }
 
-      const userResponse = await fetch('https://api.github.com/user', {
-        headers: {
-          'Authorization': `Bearer ${accessToken}`,
-          'Accept': 'application/vnd.github.v3+json',
+      const userData = await fetchJson(
+        'https://api.github.com/user',
+        {
+          headers: {
+            'Authorization': `Bearer ${accessToken}`,
+            'Accept': 'application/vnd.github.v3+json',
+          },
+          signal,
         },
-      });
-      if (!userResponse.ok) {
-        const errorBody = await userResponse.text().catch(() => 'Unknown error');
-        throw new Error(`GitHub user profile request failed (${userResponse.status}): ${errorBody}`);
-      }
-      const userData = await userResponse.json();
+        { serviceName: 'GitHub user profile' },
+      );
       const accountEmail = String(userData.login || '').trim();
       if (!accountEmail) {
         throw new Error('GitHub API did not return a user login.');
@@ -398,7 +393,7 @@ function createGithubProvider() {
         },
       };
     },
-    async disconnect(connectionRow) {
+    async disconnect(connectionRow, executionOptions = {}) {
       if (!connectionRow?.credentials_json) return;
       try {
         const credentials = JSON.parse(decryptValue(connectionRow.credentials_json));
@@ -415,20 +410,24 @@ function createGithubProvider() {
 
         const basic = Buffer.from(`${clientId}:${clientSecret}`).toString('base64');
         const revokeUrl = `https://api.github.com/applications/${encodeURIComponent(clientId)}/token`;
-        const revokeResponse = await fetch(revokeUrl, {
-          method: 'DELETE',
-          headers: {
-            'Authorization': `Basic ${basic}`,
-            'Accept': 'application/json',
-            'Content-Type': 'application/json',
+        const { response: revokeResponse, text: revokeBody } = await fetchResponseText(
+          revokeUrl,
+          {
+            method: 'DELETE',
+            headers: {
+              'Authorization': `Basic ${basic}`,
+              'Accept': 'application/json',
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              access_token: accessToken,
+            }),
+            signal: executionOptions.signal || null,
           },
-          body: JSON.stringify({
-            access_token: accessToken,
-          }),
-        });
+          { serviceName: 'GitHub token revocation' },
+        );
 
         if (!revokeResponse.ok) {
-          const revokeBody = await revokeResponse.text().catch(() => 'Unknown error');
           console.warn(
             `[GitHub] Failed to revoke token for disconnect (connection ${connectionRow?.id || 'unknown'}): ${revokeResponse.status} ${revokeBody}`,
           );
@@ -439,8 +438,8 @@ function createGithubProvider() {
         );
       }
     },
-    async executeTool(toolName, args, connectionRow) {
-      return executeGithubRepoTool(toolName, args, connectionRow);
+    async executeTool(toolName, args, connectionRow, executionOptions = {}) {
+      return executeGithubRepoTool(toolName, args, connectionRow, executionOptions);
     },
     summarizeConnection(connectionRows) {
       const snapshot = this.buildSnapshot(connectionRows);
@@ -496,4 +495,4 @@ module.exports = {
       scopes: scopes.slice(),
     }),
   ),
-};
+};