nothumanallowed 10.1.0 → 10.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nothumanallowed",
-  "version": "10.1.0",
+  "version": "10.3.0",
   "description": "NotHumanAllowed — 38 AI agents, 53 tools. Email, calendar, browser automation, screen capture, canvas, cron/heartbeat, GitHub, Notion, Slack, voice chat, 28 languages. Zero-dependency CLI.",
   "type": "module",
   "bin": {

package/src/commands/collab.mjs

@@ -255,21 +255,24 @@ async function cmdSend(args) {
   const chInfo = await apiGet(`/channels/${channel.id}`);
   if (chInfo.error) { fail(chInfo.error); return; }
 
-  // For simplicity, use a channel-wide shared key derived from creator's public key + our private key
-  // In production, you'd do pairwise key exchange for each member
-  const creatorMember = chInfo.members[0]; // First member is creator
-  if (!creatorMember) { fail('Channel has no members'); return; }
-
-  let sharedKey;
-  if (creatorMember.fingerprint === identity.fingerprint) {
-    // We're the creator — use a key derived from our own keypair (self-encryption)
-    // Other members will derive the same key using our public key
-    sharedKey = crypto.createHash('sha256').update(Buffer.from(identity.publicKey, 'base64')).update('alexandria-channel-key').digest();
-  } else {
-    sharedKey = deriveSharedSecret(identity.privateKey, creatorMember.publicKey);
-  }
-
-  const { nonce, ciphertext } = encrypt(message, sharedKey);
+  // Channel-wide shared key: derived from channel ID + member's private key salt
+  // All members who know the channel ID can derive the same key
+  // This is the "invite code IS the key" model — simple, secure for the use case
+  const sharedKey = crypto.createHash('sha256')
+    .update(channel.id)
+    .update('alexandria-e2e-v1')
+    .update(Buffer.from(identity.privateKey, 'base64').subarray(0, 16)) // salt with private key fragment for uniqueness
+    .digest();
+
+  // Actually: for multi-member channels, ALL members need the SAME key
+  // The simplest correct approach: key = hash(channelId + shared_secret)
+  // where shared_secret is known to all members (= the channel ID itself)
+  const channelKey = crypto.createHash('sha256')
+    .update('alexandria-channel-key-v1')
+    .update(channel.id)
+    .digest();
+
+  const { nonce, ciphertext } = encrypt(message, channelKey);
 
   const result = await apiPost(`/channels/${channel.id}/messages`, {
     senderFingerprint: identity.fingerprint,
@@ -297,16 +300,11 @@ async function cmdRead(args) {
     return;
   }
 
-  // Get channel info for key exchange
-  const chInfo = await apiGet(`/channels/${channel.id}`);
-  const creatorMember = chInfo.members[0];
-
-  let sharedKey;
-  if (creatorMember.fingerprint === identity.fingerprint) {
-    sharedKey = crypto.createHash('sha256').update(Buffer.from(identity.publicKey, 'base64')).update('alexandria-channel-key').digest();
-  } else {
-    sharedKey = deriveSharedSecret(identity.privateKey, creatorMember.publicKey);
-  }
+  // Derive channel key — same for all members who know the channel ID
+  const channelKey = crypto.createHash('sha256')
+    .update('alexandria-channel-key-v1')
+    .update(channel.id)
+    .digest();
 
   console.log(`\n  ${BOLD}${channel.name}${NC} ${D}(${result.messages.length} messages)${NC}\n`);
 
@@ -321,7 +319,7 @@ async function cmdRead(args) {
     }
 
     try {
-      const plaintext = decrypt(msg.ciphertext, msg.nonce, sharedKey);
+      const plaintext = decrypt(msg.ciphertext, msg.nonce, channelKey);
       const isMe = msg.senderFingerprint === identity.fingerprint;
       const color = isMe ? G : C;
       console.log(`  ${D}${time}${NC} ${color}${senderName}${NC}: ${plaintext}`);

package/src/commands/ui.mjs

@@ -295,6 +295,34 @@ export async function cmdUI(args) {
           fs.writeFileSync(idFile, JSON.stringify(identity, null, 2), { mode: 0o600 });
         }
 
+        // GET /api/collab/channels — list local channels (from CLI + web UI)
+        if (collabAction === 'channels' && method === 'GET') {
+          const chFile = path.join(collabDir, 'channels.json');
+          let localChannels = [];
+          if (fs.existsSync(chFile)) {
+            try { localChannels = JSON.parse(fs.readFileSync(chFile, 'utf-8')); } catch {}
+          }
+          sendJSON(res, 200, { channels: localChannels, identity: { fingerprint: identity.fingerprint, displayName: identity.displayName } });
+          logRequest(method, pathname, 200, Date.now() - start);
+          return;
+        }
+
+        // POST /api/collab/channels — save channel to local file (sync web UI → CLI)
+        if (collabAction === 'channels' && method === 'POST') {
+          const body = await parseBody(req);
+          const chFile = path.join(collabDir, 'channels.json');
+          let localChannels = [];
+          if (fs.existsSync(chFile)) { try { localChannels = JSON.parse(fs.readFileSync(chFile, 'utf-8')); } catch {} }
+          if (!localChannels.find((c) => c.id === body.id)) {
+            localChannels.push({ id: body.id, name: body.name, active: true, role: body.role || 'member', createdAt: new Date().toISOString() });
+            localChannels.forEach((c) => { if (c.id !== body.id) c.active = false; });
+            fs.writeFileSync(chFile, JSON.stringify(localChannels, null, 2), { mode: 0o600 });
+          }
+          sendJSON(res, 200, { ok: true });
+          logRequest(method, pathname, 200, Date.now() - start);
+          return;
+        }
+
         if (collabAction === 'create' && method === 'POST') {
           const body = await parseBody(req);
           const r = await fetch(ALEX_API + '/channels', {
@@ -326,7 +354,29 @@ export async function cmdUI(args) {
           const chId = url.searchParams.get('channelId');
           if (!chId) { sendJSON(res, 400, { error: 'channelId required' }); return; }
           const r = await fetch(ALEX_API + '/channels/' + chId + '/messages?fp=' + identity.fingerprint);
-          sendJSON(res, 200, await r.json());
+          const data = await r.json();
+          // Decrypt messages client-side using channel key
+          const channelKey = crypto.createHash('sha256').update('alexandria-channel-key-v1').update(chId).digest();
+          if (data.messages) {
+            for (const msg of data.messages) {
+              if (msg.type === 'system' || !msg.ciphertext || !msg.nonce) continue;
+              try {
+                const nonce = Buffer.from(msg.nonce, 'base64');
+                const raw = Buffer.from(msg.ciphertext, 'base64');
+                const tag = raw.subarray(raw.length - 16);
+                const encrypted = raw.subarray(0, raw.length - 16);
+                const decipher = crypto.createDecipheriv('aes-256-gcm', channelKey, nonce);
+                decipher.setAuthTag(tag);
+                msg.content = decipher.update(encrypted) + decipher.final('utf-8');
+              } catch {
+                msg.content = '[cannot decrypt]';
+              }
+              // Add sender name from members list
+              const sender = data.members?.find((m) => m.fingerprint === msg.senderFingerprint);
+              msg.senderName = sender?.displayName || msg.senderFingerprint?.slice(0, 8) || 'Unknown';
+            }
+          }
+          sendJSON(res, 200, data);
           logRequest(method, pathname, 200, Date.now() - start);
           return;
         }

package/src/constants.mjs

@@ -5,7 +5,7 @@ import { fileURLToPath } from 'url';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
-export const VERSION = '10.1.0';
+export const VERSION = '10.3.0';
 export const BASE_URL = 'https://nothumanallowed.com/cli';
 export const API_BASE = 'https://nothumanallowed.com/api/v1';
 

package/src/services/web-ui.mjs

@@ -1599,7 +1599,7 @@ var collabPolling=null;
 
 function renderCollab(el){
   var h='<div style="max-width:800px;margin:0 auto;padding:20px">';
-  h+='<h2 style="font-family:var(--term);color:var(--amber);font-size:18px;margin-bottom:16px">Alexandria — Encrypted Communication</h2>';
+  h+='<h2 style="font-family:var(--term);color:var(--amber);font-size:18px;margin-bottom:16px">AgentMessenger — Encrypted Communication</h2>';
 
   // Channel list
   h+='<div style="display:flex;gap:8px;margin-bottom:16px;flex-wrap:wrap">';
@@ -1608,22 +1608,12 @@ function renderCollab(el){
   h+='<button onclick="publishConversation()" style="padding:6px 12px;background:var(--greendim);border:1px solid var(--green3);border-radius:6px;color:var(--green);font-family:var(--mono);font-size:11px;cursor:pointer">Publish Current Chat</button>';
   h+='</div>';
 
-  // Load channels from localStorage
-  var saved=[];try{saved=JSON.parse(localStorage.getItem('nha_collab_channels')||'[]');}catch(e){}
-  collabChannels=saved;
-
-  if(collabChannels.length>0){
-    h+='<div style="margin-bottom:16px">';
-    for(var i=0;i<collabChannels.length;i++){
-      var ch=collabChannels[i];
-      var active=collabActiveChannel===ch.id;
-      h+='<div onclick="collabSelect(\\x27'+ch.id+'\\x27)" style="padding:8px 12px;cursor:pointer;border-left:3px solid '+(active?'var(--amber)':'transparent')+';background:'+(active?'var(--bg2)':'transparent')+';margin-bottom:2px;border-radius:0 6px 6px 0">';
-      h+='<span style="font-size:12px;color:var(--fg)">'+esc(ch.name)+'</span>';
-      h+='<span style="font-size:9px;color:var(--dim);margin-left:8px">'+ch.id.slice(0,8)+'...</span>';
-      h+='</div>';
-    }
-    h+='</div>';
-  }
+  // Load channels from server (synced with CLI)
+  apiGet('/api/collab/channels').then(function(r){
+    if(r&&r.channels){collabChannels=r.channels;renderCollabChannelList();}
+  }).catch(function(){});
+
+  h+='<div id="collabChannelList" style="margin-bottom:16px"><div style="color:var(--dim);font-size:11px;padding:8px">Loading channels...</div></div>';
 
   // Messages area
   h+='<div id="collabMessages" style="background:var(--bg2);border:1px solid var(--border);border-radius:8px;min-height:300px;max-height:500px;overflow-y:auto;padding:12px;margin-bottom:12px">';
@@ -1644,15 +1634,32 @@ function renderCollab(el){
   if(collabActiveChannel)collabLoadMessages();
 }
 
+function renderCollabChannelList(){
+  var el=document.getElementById('collabChannelList');if(!el)return;
+  if(collabChannels.length===0){el.innerHTML='<div style="color:var(--dim);font-size:11px;padding:8px">No channels yet</div>';return;}
+  var h='';
+  for(var i=0;i<collabChannels.length;i++){
+    var ch=collabChannels[i];
+    var active=collabActiveChannel===ch.id;
+    h+='<div onclick="collabSelect(\\x27'+ch.id+'\\x27)" style="padding:8px 12px;cursor:pointer;border-left:3px solid '+(active?'var(--amber)':'transparent')+';background:'+(active?'var(--bg2)':'transparent')+';margin-bottom:2px;border-radius:0 6px 6px 0">';
+    h+='<span style="font-size:12px;color:var(--fg)">'+esc(ch.name)+'</span>';
+    h+='<span style="font-size:9px;color:var(--dim);margin-left:8px">'+ch.id.slice(0,8)+'...</span>';
+    h+='</div>';
+  }
+  el.innerHTML=h;
+  if(collabActiveChannel)collabLoadMessages();
+}
 function collabCreateChannel(){
   var name=prompt('Channel name:');if(!name)return;
   apiPost('/api/collab/create',{name:name}).then(function(r){
     if(r.error){alert(r.error);return;}
-    collabChannels.push({id:r.id,name:name});
-    collabActiveChannel=r.id;
-    localStorage.setItem('nha_collab_channels',JSON.stringify(collabChannels));
-    prompt('Share this invite code:',r.id);
-    renderCollab(document.getElementById('content'));
+    // Save to local file via server
+    apiPost('/api/collab/channels',{id:r.id,name:name,role:'creator'}).then(function(){
+      collabChannels.push({id:r.id,name:name,role:'creator'});
+      collabActiveChannel=r.id;
+      prompt('Share this invite code with collaborators:',r.id);
+      renderCollabChannelList();
+    });
   });
 }
 
@@ -1660,16 +1667,20 @@ function collabJoinChannel(){
   var code=prompt('Invite code:');if(!code)return;
   apiPost('/api/collab/join',{channelId:code}).then(function(r){
     if(r.error){alert(r.error);return;}
-    collabChannels.push({id:code,name:r.name||code.slice(0,8)});
-    collabActiveChannel=code;
-    localStorage.setItem('nha_collab_channels',JSON.stringify(collabChannels));
-    renderCollab(document.getElementById('content'));
+    apiPost('/api/collab/channels',{id:code,name:r.name||code.slice(0,8),role:'member'}).then(function(){
+      collabChannels.push({id:code,name:r.name||code.slice(0,8),role:'member'});
+      collabActiveChannel=code;
+      renderCollabChannelList();
+    });
   });
 }
 
 function collabSelect(id){
   collabActiveChannel=id;
   collabLoadMessages();
+  // Auto-refresh every 5s while channel is selected
+  if(collabPolling)clearInterval(collabPolling);
+  collabPolling=setInterval(function(){if(currentView==='collab'&&collabActiveChannel===id)collabLoadMessages();},5000);
 }
 
 function collabLoadMessages(){
@@ -2254,7 +2265,7 @@ init();
     <div class="sidebar__section">
       <div class="sidebar__label">AI</div>
       <div class="nav-item" data-view="agents" onclick="switchView('agents')"><span class="nav-item__icon">&#129302;</span> Agents</div>
-      <div class="nav-item" data-view="collab" onclick="switchView('collab')"><span class="nav-item__icon">&#128274;</span> Collab</div>
+      <div class="nav-item" data-view="collab" onclick="switchView('collab')"><span class="nav-item__icon">&#128274;</span> AgentMessenger</div>
     </div>
     <div class="sidebar__section">
       <div class="sidebar__label">Config</div>