neoagent 3.2.1-beta.2 → 3.2.1-beta.4

package/server/services/integrations/github/provider.js

@@ -6,6 +6,8 @@ const { decryptValue } = require('../secrets');
 const { getConnectionAccessMode } = require('../access');
 const { githubToolDefinitions, executeGithubTool } = require('./repos');
 const { base64UrlSha256 } = require('./common');
+const { fetchJson } = require('../oauth_provider');
+const { fetchResponseText } = require('../http');
 
 const GITHUB_ACCOUNT_IDENTITY_SCOPES = [
   'read:user',
@@ -159,8 +161,9 @@ function summarizeAppConnection(app, connectionRows, envStatus) {
   };
 }
 
-async function executeGithubRepoTool(toolName, args, connection) {
+async function executeGithubRepoTool(toolName, args, connection, executionOptions = {}) {
   const auth = await buildAuthorizedClient(connection);
+  auth.signal = executionOptions.signal || null;
   if (!auth.token) {
     throw new Error('GitHub access token is missing or expired. Please reconnect your GitHub account.');
   }
@@ -326,40 +329,32 @@ function createGithubProvider() {
       const url = `https://github.com/login/oauth/authorize?${params.toString()}`;
       return { url, appId: app.id };
     },
-    async finishOAuth({ code, codeVerifier, appKey }) {
+    async finishOAuth({ code, codeVerifier, appKey, signal }) {
       const app = getApp(appKey);
       if (!app) {
         throw new Error(`Unknown GitHub app: ${appKey}`);
       }
       const { config } = createOAuthClient();
 
-      const tokenResponse = await fetch('https://github.com/login/oauth/access_token', {
-        method: 'POST',
-        headers: {
-          'Accept': 'application/json',
-          'Content-Type': 'application/x-www-form-urlencoded',
+      const tokenData = await fetchJson(
+        'https://github.com/login/oauth/access_token',
+        {
+          method: 'POST',
+          form: {
+            client_id: config.clientId,
+            client_secret: config.clientSecret,
+            code,
+            code_verifier: codeVerifier,
+            redirect_uri: config.redirectUri,
+          },
+          signal,
         },
-        body: new URLSearchParams({
-          client_id: config.clientId,
-          client_secret: config.clientSecret,
-          code,
-          code_verifier: codeVerifier,
-          redirect_uri: config.redirectUri,
-        }).toString(),
-      });
-
-      const tokenBody = await tokenResponse.text();
-      let tokenData = {};
-      try {
-        tokenData = tokenBody ? JSON.parse(tokenBody) : {};
-      } catch {
-        tokenData = {};
-      }
-      if (!tokenResponse.ok) {
-        throw new Error(`GitHub OAuth token exchange failed (${tokenResponse.status}): ${tokenBody || 'No response body'}`);
-      }
-      if (tokenData.error) {
-        throw new Error(`GitHub OAuth error: ${tokenData.error_description || tokenData.error}`);
+        { serviceName: 'GitHub OAuth token exchange' },
+      );
+      if (tokenData?.error) {
+        throw new Error(
+          `GitHub OAuth error: ${tokenData.error_description || tokenData.error}`,
+        );
       }
 
       const accessToken = tokenData.access_token;
@@ -367,17 +362,17 @@ function createGithubProvider() {
         throw new Error('GitHub OAuth did not return an access token.');
       }
 
-      const userResponse = await fetch('https://api.github.com/user', {
-        headers: {
-          'Authorization': `Bearer ${accessToken}`,
-          'Accept': 'application/vnd.github.v3+json',
+      const userData = await fetchJson(
+        'https://api.github.com/user',
+        {
+          headers: {
+            'Authorization': `Bearer ${accessToken}`,
+            'Accept': 'application/vnd.github.v3+json',
+          },
+          signal,
         },
-      });
-      if (!userResponse.ok) {
-        const errorBody = await userResponse.text().catch(() => 'Unknown error');
-        throw new Error(`GitHub user profile request failed (${userResponse.status}): ${errorBody}`);
-      }
-      const userData = await userResponse.json();
+        { serviceName: 'GitHub user profile' },
+      );
       const accountEmail = String(userData.login || '').trim();
       if (!accountEmail) {
         throw new Error('GitHub API did not return a user login.');
@@ -398,7 +393,7 @@ function createGithubProvider() {
         },
       };
     },
-    async disconnect(connectionRow) {
+    async disconnect(connectionRow, executionOptions = {}) {
       if (!connectionRow?.credentials_json) return;
       try {
         const credentials = JSON.parse(decryptValue(connectionRow.credentials_json));
@@ -415,20 +410,24 @@ function createGithubProvider() {
 
         const basic = Buffer.from(`${clientId}:${clientSecret}`).toString('base64');
         const revokeUrl = `https://api.github.com/applications/${encodeURIComponent(clientId)}/token`;
-        const revokeResponse = await fetch(revokeUrl, {
-          method: 'DELETE',
-          headers: {
-            'Authorization': `Basic ${basic}`,
-            'Accept': 'application/json',
-            'Content-Type': 'application/json',
+        const { response: revokeResponse, text: revokeBody } = await fetchResponseText(
+          revokeUrl,
+          {
+            method: 'DELETE',
+            headers: {
+              'Authorization': `Basic ${basic}`,
+              'Accept': 'application/json',
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              access_token: accessToken,
+            }),
+            signal: executionOptions.signal || null,
           },
-          body: JSON.stringify({
-            access_token: accessToken,
-          }),
-        });
+          { serviceName: 'GitHub token revocation' },
+        );
 
         if (!revokeResponse.ok) {
-          const revokeBody = await revokeResponse.text().catch(() => 'Unknown error');
           console.warn(
             `[GitHub] Failed to revoke token for disconnect (connection ${connectionRow?.id || 'unknown'}): ${revokeResponse.status} ${revokeBody}`,
           );
@@ -439,8 +438,8 @@ function createGithubProvider() {
         );
       }
     },
-    async executeTool(toolName, args, connectionRow) {
-      return executeGithubRepoTool(toolName, args, connectionRow);
+    async executeTool(toolName, args, connectionRow, executionOptions = {}) {
+      return executeGithubRepoTool(toolName, args, connectionRow, executionOptions);
     },
     summarizeConnection(connectionRows) {
       const snapshot = this.buildSnapshot(connectionRows);
@@ -496,4 +495,4 @@ module.exports = {
       scopes: scopes.slice(),
     }),
   ),
-};
+};

package/server/services/integrations/google/provider.js

@@ -10,6 +10,7 @@ const { calendarToolDefinitions, executeCalendarTool } = require('./calendar');
 const { driveToolDefinitions, executeDriveTool } = require('./drive');
 const { docsToolDefinitions, executeDocsTool } = require('./docs');
 const { sheetsToolDefinitions, executeSheetsTool } = require('./sheets');
+const { waitForAbortableResult } = require('../http');
 
 const GOOGLE_ACCOUNT_IDENTITY_SCOPES = [
   'openid',
@@ -118,7 +119,17 @@ function createOAuthClient() {
   };
 }
 
-async function buildAuthorizedClient(connection) {
+function attachAbortSignal(client, signal) {
+  if (!signal) return client;
+  const request = client.transporter.request.bind(client.transporter);
+  client.transporter.request = (requestOptions = {}) => request({
+    ...requestOptions,
+    signal: requestOptions.signal || signal,
+  });
+  return client;
+}
+
+async function buildAuthorizedClient(connection, options = {}) {
   const { client } = createOAuthClient();
   let credentials = {};
   try {
@@ -142,7 +153,7 @@ async function buildAuthorizedClient(connection) {
       });
     }
   });
-  return client;
+  return attachAbortSignal(client, options.signal);
 }
 
 function getApp(appId) {
@@ -247,21 +258,29 @@ function summarizeAppConnection(app, connectionRows, envStatus) {
   };
 }
 
-async function executeGoogleWorkspaceTool(toolName, args, connection) {
-  const auth = await buildAuthorizedClient(connection);
+async function executeGoogleWorkspaceTool(
+  toolName,
+  args,
+  connection,
+  executionOptions = {},
+) {
+  const auth = await buildAuthorizedClient(connection, executionOptions);
   const appId = toolAppMap.get(toolName);
   const app = getApp(appId);
   if (!app) {
     throw new Error(`Unknown tool: ${toolName}`);
   }
-  const result = await app.executor(toolName, args, auth);
+  const result = await waitForAbortableResult(
+    app.executor(toolName, args, auth),
+    executionOptions.signal,
+  );
   if (result === null) {
     throw new Error(`Unknown tool: ${toolName}`);
   }
   return { result, credentials: auth.credentials };
 }
 
-async function collectGoogleMemoryDocuments({ connection, sourceTypes = [] }) {
+async function collectGoogleMemoryDocuments({ connection, sourceTypes = [], signal = null }) {
   const appKey = String(connection?.app_key || '').trim();
   const documents = [];
   const collectedAt = new Date().toISOString();
@@ -271,6 +290,7 @@ async function collectGoogleMemoryDocuments({ connection, sourceTypes = [] }) {
       'google_workspace_gmail_search_threads',
       { query: 'newer_than:7d', max_results: 8 },
       connection,
+      { signal },
     );
     for (const thread of Array.isArray(result?.threads) ? result.threads : []) {
       const subject = String(thread.subject || 'Gmail thread').trim();
@@ -300,6 +320,7 @@ async function collectGoogleMemoryDocuments({ connection, sourceTypes = [] }) {
       'google_workspace_calendar_list_events',
       { time_min: timeMin, time_max: timeMax, max_results: 12 },
       connection,
+      { signal },
     );
     for (const event of Array.isArray(result?.events) ? result.events : []) {
       const title = String(event.summary || 'Calendar event').trim();
@@ -489,19 +510,23 @@ function createGoogleWorkspaceProvider() {
       });
       return { url, appId: app.id };
     },
-    async finishOAuth({ code, codeVerifier, appKey }) {
+    async finishOAuth({ code, codeVerifier, appKey, signal }) {
       const app = getApp(appKey);
       if (!app) {
         throw new Error(`Unknown Google Workspace app: ${appKey}`);
       }
-      const { client } = createOAuthClient();
-      const { tokens } = await client.getToken({
-        code,
-        codeVerifier,
-      });
+      const oauthClient = createOAuthClient();
+      const client = attachAbortSignal(oauthClient.client, signal);
+      const { tokens } = await waitForAbortableResult(
+        client.getToken({
+          code,
+          codeVerifier,
+        }),
+        signal,
+      );
       client.setCredentials(tokens);
       const oauth2 = google.oauth2({ version: 'v2', auth: client });
-      const profile = await oauth2.userinfo.get();
+      const profile = await waitForAbortableResult(oauth2.userinfo.get(), signal);
       const accountEmail = String(profile.data.email || '').trim();
       if (!accountEmail) {
         throw new Error('Google OAuth did not return an account email address.');
@@ -523,26 +548,37 @@ function createGoogleWorkspaceProvider() {
         },
       };
     },
-    async disconnect(connectionRow) {
-      const auth = await buildAuthorizedClient(connectionRow);
+    async disconnect(connectionRow, executionOptions = {}) {
+      const auth = await buildAuthorizedClient(connectionRow, executionOptions);
       const refreshToken = auth.credentials.refresh_token;
       const accessToken = auth.credentials.access_token;
       if (refreshToken) {
-        await auth.revokeToken(refreshToken).catch((error) => {
+        await waitForAbortableResult(
+          auth.revokeToken(refreshToken),
+          executionOptions.signal,
+        ).catch((error) => {
           console.warn(
             `[Google Workspace] Failed to revoke refresh token for disconnect (connection ${connectionRow?.id || 'unknown'}): ${error?.message || error}`,
           );
         });
       } else if (accessToken) {
-        await auth.revokeToken(accessToken).catch((error) => {
+        await waitForAbortableResult(
+          auth.revokeToken(accessToken),
+          executionOptions.signal,
+        ).catch((error) => {
           console.warn(
             `[Google Workspace] Failed to revoke access token for disconnect (connection ${connectionRow?.id || 'unknown'}): ${error?.message || error}`,
           );
         });
       }
     },
-    async executeTool(toolName, args, connectionRow) {
-      return executeGoogleWorkspaceTool(toolName, args, connectionRow);
+    async executeTool(toolName, args, connectionRow, executionOptions = {}) {
+      return executeGoogleWorkspaceTool(
+        toolName,
+        args,
+        connectionRow,
+        executionOptions,
+      );
     },
     async collectMemoryDocuments(options) {
       return collectGoogleMemoryDocuments(options);

package/server/services/integrations/home_assistant/network.js

@@ -2,8 +2,11 @@
 
 const dns = require('dns').promises;
 const net = require('net');
+const {
+  fetchResponseText,
+  waitForAbortableResult,
+} = require('../http');
 
-const HTTP_TIMEOUT_MS = 15000;
 const ALLOWED_PORTS = new Set(['', '443', '8123']);
 
 function trimText(value) {
@@ -100,7 +103,7 @@ function isBlockedIpAddress(address) {
   return true;
 }
 
-async function assertPublicHomeAssistantEndpoint(baseUrl) {
+async function assertPublicHomeAssistantEndpoint(baseUrl, options = {}) {
   const url = new URL(normalizeHomeAssistantBaseUrl(baseUrl));
   const hostname = String(url.hostname || '').replace(/^\[|\]$/g, '');
   if (net.isIP(hostname) && isBlockedIpAddress(hostname)) {
@@ -109,7 +112,10 @@ async function assertPublicHomeAssistantEndpoint(baseUrl) {
 
   let addresses;
   try {
-    addresses = await dns.lookup(hostname, { all: true, verbatim: true });
+    addresses = await waitForAbortableResult(
+      dns.lookup(hostname, { all: true, verbatim: true }),
+      options.signal,
+    );
   } catch (error) {
     throw new Error(`Could not resolve Home Assistant host: ${error?.message || 'DNS lookup failed'}`);
   }
@@ -140,7 +146,7 @@ function buildHomeAssistantUrl(baseUrl, path, query = {}) {
 async function homeAssistantRequest(credentials, options = {}) {
   const baseUrl = normalizeHomeAssistantBaseUrl(credentials.baseUrl);
   const token = requireText(credentials.token, 'Home Assistant token');
-  await assertPublicHomeAssistantEndpoint(baseUrl);
+  await assertPublicHomeAssistantEndpoint(baseUrl, { signal: options.signal });
 
   const method = String(options.method || 'GET').trim().toUpperCase();
   if (!['GET', 'POST', 'PUT', 'PATCH', 'DELETE'].includes(method)) {
@@ -154,31 +160,22 @@ async function homeAssistantRequest(credentials, options = {}) {
     body = JSON.stringify(options.body);
   }
 
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), HTTP_TIMEOUT_MS);
-  let response;
-  try {
-    response = await fetch(buildHomeAssistantUrl(baseUrl, options.path, options.query), {
+  const { response, text } = await fetchResponseText(
+    buildHomeAssistantUrl(baseUrl, options.path, options.query),
+    {
       method,
       headers,
       body,
       redirect: 'manual',
-      signal: controller.signal,
-    });
-  } catch (error) {
-    if (error?.name === 'AbortError') {
-      throw new Error(`Home Assistant request timed out after ${HTTP_TIMEOUT_MS}ms.`);
-    }
-    throw error;
-  } finally {
-    clearTimeout(timer);
-  }
+      signal: options.signal,
+    },
+    { serviceName: 'Home Assistant' },
+  );
 
   if (response.status >= 300 && response.status < 400) {
     throw new Error('Home Assistant redirected the API request; redirects are not followed.');
   }
 
-  const text = await response.text();
   let data = null;
   try {
     data = text ? JSON.parse(text) : null;

package/server/services/integrations/home_assistant/provider.js

@@ -172,8 +172,10 @@ function createHomeAssistantProvider() {
       }
       return 'Home Assistant: native Home Assistant access is connected in this run with tools for config, states, entity state, service calls, and /api requests.';
     },
-    async executeTool(toolName, args, connection) {
-      return executeHomeAssistantTool(toolName, args, connection);
+    async executeTool(toolName, args, connection, executionOptions = {}) {
+      return executeHomeAssistantTool(toolName, args, connection, {
+        signal: executionOptions.signal || null,
+      });
     },
     getUserConfig({ userId, agentId }) {
       const normalizedUserId = Number(userId);
@@ -186,7 +188,7 @@ function createHomeAssistantProvider() {
         hasConnectedAccount: connection?.status === 'connected',
       };
     },
-    async saveUserConfig({ userId, agentId, config }) {
+    async saveUserConfig({ userId, agentId, config, signal }) {
       const normalizedUserId = Number(userId);
       if (!Number.isInteger(normalizedUserId) || normalizedUserId <= 0) {
         throw new Error('A valid user is required to save Home Assistant configuration.');
@@ -203,10 +205,10 @@ function createHomeAssistantProvider() {
       if (!token) throw new Error('Home Assistant Long-Lived Access Token is required.');
 
       const credentials = { baseUrl, token };
-      await assertPublicHomeAssistantEndpoint(baseUrl);
+      await assertPublicHomeAssistantEndpoint(baseUrl, { signal });
       let haConfig;
       try {
-        haConfig = await fetchHomeAssistantConfig(credentials);
+        haConfig = await fetchHomeAssistantConfig(credentials, { signal });
       } catch (error) {
         const message = String(error?.message || '').toLowerCase();
         if (message.includes('401') || message.includes('unauthorized')) {

package/server/services/integrations/home_assistant/tools.js

@@ -3,8 +3,12 @@
 const { decryptValue } = require('../secrets');
 const { homeAssistantRequest, normalizeHomeAssistantBaseUrl, requireText, trimText } = require('./network');
 
-async function fetchHomeAssistantConfig(credentials) {
-  return homeAssistantRequest(credentials, { method: 'GET', path: '/api/config' });
+async function fetchHomeAssistantConfig(credentials, options = {}) {
+  return homeAssistantRequest(credentials, {
+    method: 'GET',
+    path: '/api/config',
+    signal: options.signal,
+  });
 }
 
 function parseCredentials(connection) {
@@ -46,16 +50,21 @@ function validateServiceSegment(value, label) {
   return text;
 }
 
-async function executeHomeAssistantTool(toolName, args, connection) {
+async function executeHomeAssistantTool(toolName, args, connection, options = {}) {
   const credentials = connectionCredentials(connection);
+  const signal = options.signal || null;
 
   switch (toolName) {
     case 'home_assistant_get_config':
-      return { result: await fetchHomeAssistantConfig(credentials) };
+      return { result: await fetchHomeAssistantConfig(credentials, { signal }) };
     case 'home_assistant_list_states':
       return {
         result: filterStates(
-          await homeAssistantRequest(credentials, { method: 'GET', path: '/api/states' }),
+          await homeAssistantRequest(credentials, {
+            method: 'GET',
+            path: '/api/states',
+            signal,
+          }),
           args,
         ),
       };
@@ -64,6 +73,7 @@ async function executeHomeAssistantTool(toolName, args, connection) {
         result: await homeAssistantRequest(credentials, {
           method: 'GET',
           path: `/api/states/${encodeURIComponent(requireText(args.entity_id, 'entity_id'))}`,
+          signal,
         }),
       };
     case 'home_assistant_call_service': {
@@ -77,6 +87,7 @@ async function executeHomeAssistantTool(toolName, args, connection) {
           method: 'POST',
           path: `/api/services/${domain}/${service}`,
           body: serviceData,
+          signal,
         }),
       };
     }
@@ -87,6 +98,7 @@ async function executeHomeAssistantTool(toolName, args, connection) {
           path: requireText(args.path, 'path'),
           query: args.query && typeof args.query === 'object' ? args.query : {},
           body: args.body && typeof args.body === 'object' ? args.body : undefined,
+          signal,
         }),
       };
     default:

package/server/services/integrations/http.js

@@ -0,0 +1,51 @@
+'use strict';
+
+const { createAbortError } = require('../../utils/abort');
+const {
+  DEFAULT_MAX_RESPONSE_BYTES,
+  fetchResponseText: fetchBoundedResponseText,
+  readResponseText: readBoundedResponseText,
+  waitForAbortableResult,
+  waitForBoundedResult: waitForBoundedIo,
+} = require('../network/http');
+
+const DEFAULT_INTEGRATION_HTTP_TIMEOUT_MS = 15000;
+
+function abortError(signal, fallback = 'Integration request aborted.') {
+  return createAbortError(signal, fallback);
+}
+
+async function readResponseText(response, options = {}) {
+  return readBoundedResponseText(response, {
+    ...options,
+    serviceName: String(options.serviceName || 'Integration').trim() || 'Integration',
+    tooLargeCode: 'INTEGRATION_RESPONSE_TOO_LARGE',
+  });
+}
+
+async function fetchResponseText(url, options = {}, context = {}) {
+  return fetchBoundedResponseText(url, {
+    ...options,
+    serviceName: String(context.serviceName || 'Integration').trim() || 'Integration',
+    timeoutCode: 'INTEGRATION_HTTP_TIMEOUT',
+    tooLargeCode: 'INTEGRATION_RESPONSE_TOO_LARGE',
+  });
+}
+
+async function waitForBoundedResult(promise, options = {}) {
+  return waitForBoundedIo(promise, {
+    ...options,
+    serviceName: String(options.serviceName || 'Integration').trim() || 'Integration',
+    timeoutCode: 'INTEGRATION_HTTP_TIMEOUT',
+  });
+}
+
+module.exports = {
+  DEFAULT_INTEGRATION_HTTP_TIMEOUT_MS,
+  DEFAULT_MAX_RESPONSE_BYTES,
+  abortError,
+  fetchResponseText,
+  readResponseText,
+  waitForAbortableResult,
+  waitForBoundedResult,
+};