alexa-ai 2.4.0 → 2.5.0

package/CHANGELOG.md

@@ -4,6 +4,29 @@ All notable changes to `alexa-ai` are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project uses
 [Semantic Versioning](https://semver.org/).
 
+## [2.5.0] — 2026-09-07
+
+### Added
+- **`proxy` option / `DEEPAI_PROXY`** — route `/api/*` calls through a
+  residential or mobile proxy (`http(s)://` / `socks5://`). Honoured by the
+  curl transports (`-x`); `transport: 'auto'` drops global fetch from the
+  chain when a proxy is set. This is what makes anonymous image generation
+  work from a VPS / data-center IP.
+- **`englishOnly` (default on)** — the persona instructs English-only replies;
+  any CJK/Kana/Hangul in an answer triggers one translation re-ask and, if
+  that fails, script stripping with a plain-English fallback sentence.
+- `DEEPAI_LOGIN_REQUIRED` error for login-gated models ("model only available
+  to logged in users") — no key rotation, anonymous retry or transport
+  cascade is attempted for them.
+
+### Changed
+- **`detectNsfw()` on free keys** — `nsfw-detector` has no free/anonymous
+  tier, so after the API refusal the engine asks the vision model for a
+  safety score (`via: 'chat'`) and otherwise returns `DEEPAI_PRO_REQUIRED`
+  with an explanatory message.
+- When script stripping empties the reply, a fixed English sentence is sent
+  instead of the original non-English text.
+
 ## [2.4.0] — 2026-09-07
 
 ### Fixed

package/README.md

@@ -908,6 +908,52 @@ retry: <anonymous refusal>`).
 purpose — emoji and typographic dashes render as garbage (Chinese-looking
 mojibake) in cmd.exe/PowerShell with a non-UTF-8 codepage.
 
+**Running on a VPS / server IP.** DeepAI refuses anonymous `/api/*` generation
+from data-center IPs ("Please try this model on deepai.org"), so image
+generation that works at home fails on a VPS. Two options:
+
+1. `proxy` option (2.5.0) — route the `/api/*` calls through a
+   residential/mobile proxy; the curl transports honour
+   `proxy: 'socks5://host:port'` / `http://host:port` (or `DEEPAI_PROXY`).
+   Global fetch cannot use the proxy, so `auto` switches to curl automatically
+   when one is configured.
+2. A DeepAI **Pro key** — works from any IP, no proxy needed.
+
+**English-only replies (`englishOnly`, 2.5.0, on by default).** The persona
+now instructs the model to answer in English only; if a reply still contains
+CJK/Kana/Hangul, the engine re-asks once for an English version and strips any
+remaining script as a last resort. Disable with `englishOnly: false`.
+
+**`detectNsfw()` on a free key.** The `nsfw-detector` model has **no free or
+anonymous tier** on DeepAI (no try-it on its model page; registered free keys
+get the Pro refusal). 2.5.0 therefore: (a) tries the API, (b) on a plan
+refusal asks the vision model for a score instead (`via: 'chat'` — works when
+the key can see images), (c) otherwise returns `error: 'DEEPAI_PRO_REQUIRED'`
+with a clear message. A Pro key makes the real model work.
+
+**Always check `result.ok` before sending media.** On failure every helper
+returns `url: null` — passing that straight to Baileys'
+`prepareWAMessageMedia` crashes the bot with
+`TypeError: Cannot read properties of undefined (reading 'toString')`. Guard
+the bot side:
+
+```js
+const r = await ai.generateImage(prompt);
+if (!r.ok || !r.url) {
+    await sock.sendMessage(jid, { text: `Image failed: ${r.message || r.error}` });
+    return;
+}
+try {
+    await sock.sendMessage(jid, { image: { url: r.url } });
+} catch (e) {
+    console.error('send failed', e);
+}
+```
+
+Also register `process.on('uncaughtException', …)` and
+`process.on('unhandledRejection', …)` handlers in the bot entrypoint so one
+bad send can never kill the whole process.
+
 **`generateImage()` returns `{ ok: false, error: 'DEEPAI_QUOTA_EXCEEDED' }`**
 `/api/text2img` is Pro-only for registered keys ("APIs are only available for
 Pro members in good standing"), the anonymous browser-shaped retry was

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "alexa-ai",
-  "version": "2.4.0",
+  "version": "2.5.0",
   "description": "AI engine for the Alexa WhatsApp bot: DeepAI-powered chat with PostgreSQL-backed long-term memory, cross-chat identity (@lid <-> phone), vision/OCR, image generation and web search.",
   "main": "index.js",
   "scripts": {

package/src/AlexaAI.js

@@ -418,6 +418,26 @@ class AlexaAI {
         // Guarantee no @MEMORY remnant ever reaches WhatsApp.
         if (/@\s*MEMORY/i.test(finalText)) finalText = MemoryExtractor.strip(finalText);
 
+        // English-only replies: if the model answered in another script,
+        // re-ask once for an English version and strip any remainder.
+        if (this.config.englishOnly && ResponseFormatter.hasNonEnglish(finalText)) {
+            let repaired = null;
+            try {
+                repaired = await this.client.chat([
+                    { role: 'user', content: `Rewrite the following in plain English only, keeping the same meaning and formatting. Output only the English text and nothing else:\n\n${finalText}` },
+                ]);
+            } catch {
+                repaired = null;
+            }
+            if (repaired && repaired.trim() && !ResponseFormatter.hasNonEnglish(repaired)) {
+                finalText = repaired.trim();
+            } else {
+                finalText =
+                    ResponseFormatter.stripNonEnglishScripts(finalText) ||
+                    'Sorry, I could not phrase that in English. Please ask me again.';
+            }
+        }
+
         if (!finalText.trim()) {
             finalText = 'Sorry, I did not quite catch that. Could you say it again?';
         }
@@ -790,8 +810,34 @@ class AlexaAI {
         try {
             const data = await this.client.detectNsfw(field, {}, opts);
             const score = typeof data?.output?.nsfw_score === 'number' ? data.output.nsfw_score : null;
-            return { ok: true, score, nsfw: score == null ? null : score >= threshold, error: null, raw: data };
+            return { ok: true, score, nsfw: score == null ? null : score >= threshold, error: null, via: 'api', raw: data };
         } catch (err) {
+            // The dedicated model is Pro/login-only. As a best effort, ask
+            // the vision model for a safety score instead — works whenever
+            // the key can see images.
+            if (err.code === 'DEEPAI_LOGIN_REQUIRED' || err.code === 'DEEPAI_QUOTA_EXCEEDED') {
+                try {
+                    const media = Media.normalize(image);
+                    if (media) {
+                        const judged = await this.vision.describe(media,
+                            'Rate how sexually explicit this image is. Reply with ONLY a single decimal number between 0 (completely safe) and 1 (explicit), with no other text.');
+                        const m = /(?:0\.\d+|1(?:\.0+)?|0|1)/.exec(String(judged.description || judged.text || ''));
+                        if (judged.ok && m) {
+                            const score = Number(m[0]);
+                            return { ok: true, score, nsfw: score >= threshold, error: null, via: 'chat' };
+                        }
+                    }
+                } catch {
+                    /* fall through to the honest refusal */
+                }
+                return {
+                    ok: false,
+                    score: null,
+                    nsfw: null,
+                    error: 'DEEPAI_PRO_REQUIRED',
+                    message: 'nsfw-detector is only available to DeepAI Pro keys (it has no free/anonymous tier), and the vision fallback could not run on this key.',
+                };
+            }
             return { ok: false, score: null, nsfw: null, error: err.code || 'NSFW_FAILED', message: err.message };
         }
     }

package/src/core/Config.js

@@ -126,6 +126,12 @@ class Config {
         this.curlImpersonatePath =
             opts.curlImpersonatePath || process.env.DEEPAI_CURL_IMPERSONATE || null;
         this.curlImpersonateTarget = opts.curlImpersonateTarget || 'chrome136';
+        // Optional proxy for /api/* calls (http/https/socks5 URL). Applied to
+        // the curl transports via -x; global fetch cannot honour it without
+        // the undici package, so 'auto' skips fetch entirely when this is set.
+        // Useful when the bot runs on a server IP that DeepAI refuses for
+        // anonymous generation.
+        this.proxy = opts.proxy || process.env.DEEPAI_PROXY || null;
         // ---- /api/* anonymous fallback ----------------------------------------
         // When a registered key is refused ("Pro members in good standing"),
         // retry once with a fresh anonymous key in the browser dialect
@@ -213,6 +219,10 @@ class Config {
             opts.pool || {}
         );
 
+        // Replies must be plain English: any CJK/Kana/Hangul in a model
+        // answer triggers one translation re-ask, then script stripping.
+        this.englishOnly = opts.englishOnly !== false;
+
         this.debug = Boolean(opts.debug);
         this.logger = opts.logger || console;
 

package/src/core/DeepAIClient.js

@@ -741,7 +741,8 @@ class DeepAIClient {
         if (t === 'fetch') return ['fetch'];
         if (t === 'curl') return ['curl'];
         if (t === 'impersonate') return ['impersonate'];
-        const chain = ['fetch', 'curl'];
+        // A proxy can only be honoured by the curl transports.
+        const chain = this.config.proxy ? ['curl'] : ['fetch', 'curl'];
         if (await DeepAIClient.resolveImpersonateBinary(this.config)) chain.push('impersonate');
         return chain;
     }
@@ -793,6 +794,7 @@ class DeepAIClient {
             : this.apiKey;
 
         const args = impersonate ? ['--impersonate', this.config.curlImpersonateTarget] : [];
+        if (this.config.proxy) args.push('-x', this.config.proxy);
         args.push(
             url,
             '-sS', '--compressed',
@@ -1072,6 +1074,17 @@ class DeepAIClient {
         const msg = statusMessage || DeepAIClient._detectJsonStatus(body) || `HTTP ${status}`;
         const lowered = String(msg).toLowerCase();
 
+        // Login-gated models cannot be recovered by key rotation, anonymous
+        // retries or another transport — report them as their own error.
+        if (lowered.includes('model only available to logged in users')) {
+            return new DeepAIError(`DeepAI refused the request: ${msg}`, {
+                code: 'DEEPAI_LOGIN_REQUIRED',
+                status,
+                body,
+                retryable: false,
+            });
+        }
+
         const quotaHints = [
             'quota exceeded',
             'try it exceeded',

package/src/services/PromptBuilder.js

@@ -128,6 +128,7 @@ class PromptBuilder {
             `You are ${assistantName}, a warm, friendly female WhatsApp assistant created by ${creator}.`,
             `Your name is exactly "${assistantName}" — never a variant such as "${assistantName} Mini" or "${assistantName} AI".`,
             'Never mention DeepAI, ChatGPT, OpenAI, GPT, Llama, Gemini or any model/company name, and never call yourself a language model.',
+            'You always reply in plain English only. Never answer in Chinese, Japanese, Korean or any other non-Latin script.',
             'Use WhatsApp formatting only: *bold*, _italic_, ~strike~, `code`. Never use ** or markdown headers.',
             'You have a permanent memory database: facts you are given about a person are things you genuinely remember, in private chats and in every group. Never claim you cannot remember.',
             'Append new personal facts at the very end as @MEMORY: {"key": "value"} and never mention that tag.',

package/src/services/ResponseFormatter.js

@@ -19,6 +19,23 @@
  * Fenced code blocks are protected and restored verbatim.
  */
 class ResponseFormatter {
+    // CJK ideographs, Kana, Hangul, fullwidth forms — the scripts that must
+    // never appear in an English-only reply.
+    static NON_ENGLISH_RE = /[\u2E80-\u2EFF\u3000-\u303F\u3040-\u30FF\u3130-\u318F\u3400-\u4DBF\u4E00-\u9FFF\uAC00-\uD7AF\uF900-\uFAFF\uFF00-\uFFEF]/;
+
+    /** True when the text contains CJK/Kana/Hangul/fullwidth characters. */
+    static hasNonEnglish(text) {
+        return ResponseFormatter.NON_ENGLISH_RE.test(String(text || ''));
+    }
+
+    /** Remove CJK/Kana/Hangul/fullwidth runs (last-resort cleanup). */
+    static stripNonEnglishScripts(text) {
+        return String(text || '')
+            .replace(/([\u2E80-\u2EFF\u3000-\u303F\u3040-\u30FF\u3130-\u318F\u3400-\u4DBF\u4E00-\u9FFF\uAC00-\uD7AF\uF900-\uFAFF\uFF00-\uFFEF])+/g, ' ')
+            .replace(/ {2,}/g, ' ')
+            .trim();
+    }
+
     /**
      * @param {string} reply
      * @returns {string}

package/test/run-tests.js

@@ -730,18 +730,44 @@ section('DeepAIClient — the whole endpoint surface (mocked transport)');
         const anonNsfw = calls.find((c) => DeepAIClient.isTryItKey(c.key));
         ok('anonymous nsfw retry uses the model-page dialect', anonNsfw && anonNsfw.form.generation_source === 'img');
 
-        // anonymousApiFallback:false keeps the refusal
+        // anonymousApiFallback:false keeps the refusal (no /api retry; the
+        // vision fallback may still run but makes no /api/nsfw-detector call)
         const strict = new AlexaAI({ key: '11111111-2222-3333-4444-555555555555', postgresUrl: 'postgres://u:p@localhost/db', autoMigrate: false, anonymousApiFallback: false });
-        calls.length = 0;
-        let fetchCalls = 0;
+        let apiCalls = 0;
         global.fetch = async (url, init = {}) => {
-            fetchCalls++;
+            if (/nsfw-detector$/.test(String(url))) apiCalls++;
             return { status: 402, headers: { get: () => 'application/json' }, text: async () => JSON.stringify({ status: 'APIs are only available for Pro members in good standing' }) };
         };
         const refused = await strict.detectNsfw(Buffer.from('fake-image-bytes'));
         global.fetch = realFetch;
-        ok('anonymousApiFallback:false surfaces the refusal', refused.ok === false && refused.error === 'DEEPAI_QUOTA_EXCEEDED');
-        ok('no anonymous retry was made', fetchCalls === 1);
+        ok('anonymousApiFallback:false surfaces the refusal', refused.ok === false && refused.error === 'DEEPAI_PRO_REQUIRED');
+        ok('no anonymous retry was made', apiCalls === 1);
+
+        // login-gated models map to DEEPAI_LOGIN_REQUIRED and never rotate keys
+        {
+            const cfg2 = new Config({ key: 'tryit-1-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa', keys: ['tryit-1-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa', 'tryit-2-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb'], postgresUrl: 'postgres://u:p@localhost/db', maxRetries: 0 });
+            const c2 = new DeepAIClient(cfg2);
+            const seen2 = [];
+            global.fetch = async (url, init = {}) => {
+                seen2.push(init.headers['api-key']);
+                return { status: 401, headers: { get: () => 'application/json' }, text: async () => JSON.stringify({ status: 'model only available to logged in users' }) };
+            };
+            let loginErr = null;
+            try { await c2.runApi('nsfw-detector', { image: 'https://x/y.png' }); } catch (e) { loginErr = e; }
+            global.fetch = realFetch;
+            ok('login-gated model raises DEEPAI_LOGIN_REQUIRED', loginErr?.code === 'DEEPAI_LOGIN_REQUIRED');
+            ok('no key rotation on login-gated models', seen2.length === 1);
+        }
+
+        // the vision fallback answers when the model refuses for plan reasons
+        {
+            const ai2 = new AlexaAI({ key: '11111111-2222-3333-4444-555555555555', postgresUrl: 'postgres://u:p@localhost/db', autoMigrate: false });
+            ai2.vision = { describe: async () => ({ ok: true, description: '0.85' }) };
+            global.fetch = async () => ({ status: 402, headers: { get: () => 'application/json' }, text: async () => JSON.stringify({ status: 'APIs are only available for Pro members in good standing' }) });
+            const judged = await ai2.detectNsfw(Buffer.from('fake'), { threshold: 0.7 });
+            global.fetch = realFetch;
+            ok('detectNsfw falls back to the vision model', judged.ok === true && judged.via === 'chat' && judged.score === 0.85 && judged.nsfw === true);
+        }
     }
     
 {
@@ -829,6 +855,22 @@ section('DeepAIClient — the whole endpoint surface (mocked transport)');
         ok('fetch-only transport never shells out', curlCalled === false);
     }
 
+    // 5. a proxy pins the chain to the curl transports and passes -x
+    {
+        let call = null;
+        DeepAIClient.execCurl = async (bin, args) => { call = { bin, args }; return '{"id":"p1","share_url":"https://deepai.org/p.png"}\n200'; };
+        const client = new DeepAIClient(new Config({
+            key: 'k', postgresUrl: 'postgres://u:p@localhost/db',
+            proxy: 'socks5://127.0.0.1:9050', maxRetries: 0,
+        }));
+        const chain = await client._transportChain();
+        ok('proxy removes fetch from the transport chain', !chain.includes('fetch') && chain.includes('curl'));
+        const data = await client.runApi('text2img', { text: 'cat' });
+        ok('proxied request succeeds through curl', data.share_url === 'https://deepai.org/p.png');
+        const xi = call.args.indexOf('-x');
+        ok('curl receives the proxy flag', xi !== -1 && call.args[xi + 1] === 'socks5://127.0.0.1:9050');
+    }
+
     global.fetch = realFetch;
     DeepAIClient.execCurl = realExecCurl;
     DeepAIClient._impersonateCache = realCache;
@@ -925,6 +967,19 @@ async function endToEndTests() {
         deepai.push('Sure! DeepAI can help you with that.');
         const leak = await ai.chat({ message: 'can you help me?', userId: '78151912841263@lid' });
         ok('vendor name never ships', !/deepai/i.test(leak.text));
+
+        // 7. A non-English reply is re-asked in English.
+        deepai.push('你好！很高兴认识你，Nimal。');
+        deepai.push('Hello! Very nice to meet you, Nimal.');
+        const zh = await ai.chat({ message: 'hi again', userId: '78151912841263@lid' });
+        check('Chinese reply is re-asked in English', zh.text, 'Hello! Very nice to meet you, Nimal.');
+
+        // 8. When the re-ask also fails, the CJK is stripped (or replaced).
+        deepai.push('这是一段完全中文的回答。');
+        deepai.push('还是中文。');
+        const zh2 = await ai.chat({ message: 'hello', userId: '78151912841263@lid' });
+        ok('unrecoverable reply carries no CJK', !/[\u4E00-\u9FFF]/.test(zh2.text));
+        ok('unrecoverable reply is non-empty', zh2.text.trim().length > 0);
     } finally {
         deepai.restore();
     }