neoagent 3.2.1-beta.3 → 3.2.1-beta.5

package/flutter_app/lib/src/backend_client.dart

@@ -1359,6 +1359,84 @@ class BackendClient {
     return _asMap(_decodeJson(response.body));
   }
 
+  Future<Map<String, dynamic>> unlockBitwarden(
+    String baseUrl, {
+    required String masterPassword,
+    required int idleTimeoutMinutes,
+    String? agentId,
+  }) {
+    return postMap(
+      baseUrl,
+      '/api/integrations/bitwarden/unlock',
+      _withAgentId(<String, dynamic>{
+        'masterPassword': masterPassword,
+        'idleTimeoutMinutes': idleTimeoutMinutes,
+      }, agentId),
+    );
+  }
+
+  Future<Map<String, dynamic>> lockBitwarden(
+    String baseUrl, {
+    String? agentId,
+  }) {
+    return postMap(
+      baseUrl,
+      '/api/integrations/bitwarden/lock',
+      _withAgentId(<String, dynamic>{}, agentId),
+    );
+  }
+
+  Future<Map<String, dynamic>> fetchBitwardenItems(
+    String baseUrl, {
+    String? agentId,
+  }) {
+    return getMap(
+      baseUrl,
+      _withAgentQuery('/api/integrations/bitwarden/items', agentId),
+    );
+  }
+
+  Future<Map<String, dynamic>> fetchCredentialBindings(
+    String baseUrl, {
+    String? agentId,
+  }) {
+    return getMap(
+      baseUrl,
+      _withAgentQuery('/api/integrations/bitwarden/bindings', agentId),
+    );
+  }
+
+  Future<Map<String, dynamic>> createCredentialBinding(
+    String baseUrl, {
+    required Map<String, dynamic> binding,
+    String? agentId,
+  }) {
+    return postMap(
+      baseUrl,
+      '/api/integrations/bitwarden/bindings',
+      _withAgentId(binding, agentId),
+    );
+  }
+
+  Future<Map<String, dynamic>> deleteCredentialBinding(
+    String baseUrl,
+    String bindingId, {
+    String? agentId,
+  }) async {
+    final response = await _httpClient.delete(
+      _resolveUri(
+        baseUrl,
+        _withAgentQuery(
+          '/api/integrations/bitwarden/bindings/${Uri.encodeComponent(bindingId)}',
+          agentId,
+        ),
+      ),
+      headers: const <String, String>{'Accept': 'application/json'},
+    );
+    _throwIfError(response);
+    return _asMap(_decodeJson(response.body));
+  }
+
   Future<Map<String, dynamic>> fetchMessagingStatus(
     String baseUrl, {
     String? agentId,

package/lib/schema_migrations.js

@@ -713,6 +713,52 @@ function migrateMessagingInboundJobs(db) {
   `);
 }
 
+function migrateCredentialBroker(db) {
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS credential_bindings (
+      id TEXT PRIMARY KEY,
+      user_id INTEGER NOT NULL,
+      agent_id TEXT NOT NULL,
+      provider_key TEXT NOT NULL,
+      connection_id INTEGER NOT NULL,
+      alias TEXT NOT NULL,
+      usage_type TEXT NOT NULL CHECK(usage_type IN ('browser', 'http')),
+      item_ref_encrypted TEXT NOT NULL,
+      field_config_encrypted TEXT NOT NULL,
+      target_config_json TEXT NOT NULL DEFAULT '{}',
+      created_at TEXT DEFAULT (datetime('now')),
+      updated_at TEXT DEFAULT (datetime('now')),
+      FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
+      FOREIGN KEY (agent_id) REFERENCES agents(id) ON DELETE CASCADE,
+      FOREIGN KEY (connection_id) REFERENCES integration_connections(id) ON DELETE CASCADE,
+      UNIQUE(user_id, agent_id, alias)
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_credential_bindings_scope
+      ON credential_bindings(user_id, agent_id, provider_key, usage_type);
+
+    CREATE TABLE IF NOT EXISTS credential_usage_audit (
+      id TEXT PRIMARY KEY,
+      user_id INTEGER NOT NULL,
+      agent_id TEXT NOT NULL,
+      run_id TEXT,
+      binding_id TEXT,
+      operation TEXT NOT NULL,
+      target TEXT,
+      outcome TEXT NOT NULL,
+      error_code TEXT,
+      created_at TEXT DEFAULT (datetime('now')),
+      FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
+      FOREIGN KEY (agent_id) REFERENCES agents(id) ON DELETE CASCADE,
+      FOREIGN KEY (run_id) REFERENCES agent_runs(id) ON DELETE SET NULL,
+      FOREIGN KEY (binding_id) REFERENCES credential_bindings(id) ON DELETE SET NULL
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_credential_usage_audit_scope
+      ON credential_usage_audit(user_id, agent_id, created_at DESC);
+  `);
+}
+
 function runSchemaMigrations(db) {
   removeRetiredCaptureData(db);
   migrateMemoryEmbeddingIndex(db);
@@ -729,6 +775,7 @@ function runSchemaMigrations(db) {
   migrateBilling(db);
   migrateAgentRunLifecycle(db);
   migrateMessagingInboundJobs(db);
+  migrateCredentialBroker(db);
 }
 
 module.exports = {
@@ -748,5 +795,6 @@ module.exports = {
   migrateBilling,
   migrateAgentRunLifecycle,
   migrateMessagingInboundJobs,
+  migrateCredentialBroker,
   runSchemaMigrations,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neoagent",
-  "version": "3.2.1-beta.3",
+  "version": "3.2.1-beta.5",
   "description": "Self-hosted AI agent for long-running tasks, automation, messaging, device control, and local memory",
   "license": "AGPL-3.0-only",
   "main": "server/index.js",
@@ -67,6 +67,7 @@
   "homepage": "https://github.com/NeoLabs-Systems/NeoAgent#readme",
   "dependencies": {
     "@anthropic-ai/sdk": "^0.39.0",
+    "@bitwarden/cli": "^2026.6.0",
     "@google/generative-ai": "^0.24.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@remotion/cli": "^4.0.459",
@@ -86,7 +87,7 @@
     "geoip-lite": "^1.4.10",
     "googleapis": "^150.0.1",
     "helmet": "^8.0.0",
-    "multer": "^1.4.5-lts.1",
+    "multer": "^2.2.0",
     "node-cron": "^4.6.0",
     "node-pty": "^1.0.0",
     "nodemailer": "^9.0.3",
@@ -109,17 +110,24 @@
     "ws": "^8.21.0"
   },
   "overrides": {
+    "@bitwarden/cli": {
+      "form-data": "4.0.6",
+      "inquirer": "8.2.7",
+      "multer": "2.2.0"
+    },
     "@hono/node-server": "^2.0.11",
     "axios": "^1.15.2",
     "basic-ftp": "^5.3.0",
     "dompurify": "^3.4.12",
     "fast-uri": "^3.1.4",
+    "form-data": "4.0.6",
     "follow-redirects": "^1.16.0",
     "hono": "^4.12.31",
     "ip-address": "^10.2.0",
     "linkify-it": "^5.0.2",
     "protobufjs": "^7.6.5",
     "serialize-javascript": "^7.0.5",
+    "tmp": "0.2.7",
     "undici": "^6.27.0",
     "uuid": "$uuid",
     "webpackbar": "^7.0.0",

package/server/guest-agent.cli.package.json

@@ -0,0 +1,13 @@
+{
+  "name": "neoagent-guest-agent-cli",
+  "private": true,
+  "version": "1.0.0",
+  "description": "Guest runtime for isolated NeoAgent CLI services",
+  "engines": {
+    "node": ">=20"
+  },
+  "dependencies": {
+    "express": "^4.21.2",
+    "proper-lockfile": "^4.1.2"
+  }
+}

package/server/guest_agent.js

@@ -4,7 +4,6 @@ const express = require('express');
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
-const { CLIExecutor } = require('./services/cli/executor');
 const { RUNTIME_HOME, DATA_DIR } = require('../runtime/paths');
 
 const PORT = Number(process.env.NEOAGENT_GUEST_AGENT_PORT || 8421);
@@ -21,8 +20,9 @@ function resolveGuestToken() {
 }
 
 const AUTH_TOKEN = resolveGuestToken();
-const GUEST_PROFILE = String(process.env.NEOAGENT_GUEST_PROFILE || 'browser_cli').trim() === 'android'
-  ? 'android'
+const RAW_GUEST_PROFILE = String(process.env.NEOAGENT_GUEST_PROFILE || 'browser_cli').trim();
+const GUEST_PROFILE = ['android', 'browser', 'cli', 'browser_cli'].includes(RAW_GUEST_PROFILE)
+  ? RAW_GUEST_PROFILE
   : 'browser_cli';
 const FILE_ROOT = path.join(RUNTIME_HOME, 'guest-agent-files');
 const MAX_APK_STREAM_BYTES = Number(process.env.NEOAGENT_GUEST_MAX_APK_STREAM_BYTES || 512 * 1024 * 1024);
@@ -32,8 +32,10 @@ fs.mkdirSync(FILE_ROOT, { recursive: true });
 const app = express();
 app.use(express.json({ limit: '100mb' }));
 
-const cliExecutor = new CLIExecutor();
-const browserController = GUEST_PROFILE === 'browser_cli'
+const cliExecutor = ['cli', 'browser_cli', 'android'].includes(GUEST_PROFILE)
+  ? new (require('./services/cli/executor').CLIExecutor)()
+  : null;
+const browserController = ['browser', 'browser_cli'].includes(GUEST_PROFILE)
   ? new (require('./services/browser/controller').BrowserController)({ runtimeBackend: 'vm' })
   : null;
 const androidController = GUEST_PROFILE === 'android'
@@ -139,18 +141,19 @@ app.get('/health', (_req, res) => {
 
 app.post('/exec', async (req, res) => {
   await handleRequest(req, res, async (signal) => {
+    const executor = requireCapability(cliExecutor, 'cli');
     const command = String(req.body?.command || '').trim();
     if (!command) {
       return { error: 'command is required' };
     }
     if (req.body?.pty) {
-      return cliExecutor.executeInteractive(command, req.body?.inputs || [], {
+      return executor.executeInteractive(command, req.body?.inputs || [], {
         cwd: req.body?.cwd,
         timeout: req.body?.timeout,
         signal,
       });
     }
-    return cliExecutor.execute(command, {
+    return executor.execute(command, {
       cwd: req.body?.cwd,
       timeout: req.body?.timeout,
       stdinInput: req.body?.stdin_input,
@@ -161,15 +164,16 @@ app.post('/exec', async (req, res) => {
 
 app.post('/exec/kill', async (req, res) => {
   await handle(res, async () => {
+    const executor = requireCapability(cliExecutor, 'cli');
     const pid = Number(req.body?.pid);
     if (!Number.isInteger(pid) || pid <= 0) {
       return { error: 'pid is required' };
     }
     const reason = String(req.body?.reason || 'aborted').trim();
-    if (typeof cliExecutor.isManaged === 'function' && !cliExecutor.isManaged(pid)) {
+    if (typeof executor.isManaged === 'function' && !executor.isManaged(pid)) {
       return { error: 'pid not managed' };
     }
-    const killed = cliExecutor.kill(pid, reason || 'aborted');
+    const killed = executor.kill(pid, reason || 'aborted');
     return { success: killed, pid };
   });
 });
@@ -207,6 +211,22 @@ app.get('/browser/status', async (_req, res) => {
     };
   });
 });
+
+app.use('/browser', (req, res, next) => {
+  if (!browserController?.hasProtectedCredentialFill?.()) return next();
+  const allowed = new Set([
+    '/status',
+    '/credential-submit',
+    '/credential-cancel',
+    '/close',
+  ]);
+  if (allowed.has(req.path)) return next();
+  return res.status(423).json({
+    error: 'Browser control is paused while a protected credential fill is active. Submit or cancel it first.',
+    code: 'PROTECTED_CREDENTIAL_FILL_ACTIVE',
+  });
+});
+
 function requireCapability(controller, name) {
   if (!controller) {
     throw new Error(`${name} runtime is unavailable in this guest profile.`);
@@ -227,6 +247,9 @@ app.post('/browser/screenshot-jpeg', async (req, res) => handleRequest(req, res,
 app.post('/browser/click', async (req, res) => handleRequest(req, res, (signal) => requireCapability(browserController, 'browser').click(req.body?.selector, req.body?.text, req.body?.screenshot !== false, { signal })));
 app.post('/browser/click-point', async (req, res) => handleRequest(req, res, (signal) => requireCapability(browserController, 'browser').clickPoint(req.body?.x, req.body?.y, req.body?.screenshot !== false, { signal })));
 app.post('/browser/fill', async (req, res) => handleRequest(req, res, (signal) => requireCapability(browserController, 'browser').type(req.body?.selector, String(req.body?.value ?? req.body?.text ?? ''), { ...(req.body || {}), signal })));
+app.post('/browser/credential-fill', async (req, res) => handleRequest(req, res, (signal) => requireCapability(browserController, 'browser').fillCredential(req.body || {}, { signal })));
+app.post('/browser/credential-submit', async (req, res) => handleRequest(req, res, (signal) => requireCapability(browserController, 'browser').submitProtectedCredential(req.body?.protectedFillId, { signal })));
+app.post('/browser/credential-cancel', async (req, res) => handleRequest(req, res, () => requireCapability(browserController, 'browser').cancelProtectedCredential(req.body?.protectedFillId)));
 app.post('/browser/type-text', async (req, res) => handleRequest(req, res, (signal) => requireCapability(browserController, 'browser').typeText(String(req.body?.text || ''), { ...(req.body || {}), signal })));
 app.post('/browser/press-key', async (req, res) => handleRequest(req, res, (signal) => requireCapability(browserController, 'browser').pressKey(req.body?.key, req.body?.screenshot !== false, { signal })));
 app.post('/browser/scroll', async (req, res) => handleRequest(req, res, (signal) => requireCapability(browserController, 'browser').scroll(req.body?.deltaX ?? 0, req.body?.deltaY ?? 0, req.body?.screenshot !== false, { signal })));
@@ -347,7 +370,7 @@ async function shutdown() {
   } catch (err) {
     console.warn('[GuestAgent] Failed to close android controller:', err?.message);
   }
-  cliExecutor.killAll('shutdown');
+  cliExecutor?.killAll?.('shutdown');
   server.close(() => process.exit(0));
 }
 

package/server/public/.last_build_id

@@ -1 +1 @@
-602b98932a60cda4e154d8497aa43085
+33e941ab4e958fa1f09d072c6fdd687f

package/server/public/flutter_bootstrap.js

@@ -37,6 +37,6 @@ _flutter.buildConfig = {"engineRevision":"69c8c61792f04cc809dfef0c910414fb9afc06
 
 _flutter.loader.load({
   serviceWorkerSettings: {
-    serviceWorkerVersion: "593865678" /* Flutter's service worker is deprecated and will be removed in a future Flutter release. */
+    serviceWorkerVersion: "3763943593" /* Flutter's service worker is deprecated and will be removed in a future Flutter release. */
   }
 });