nothumanallowed 10.3.0 → 10.3.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nothumanallowed",
-  "version": "10.3.0",
+  "version": "10.3.1",
   "description": "NotHumanAllowed — 38 AI agents, 53 tools. Email, calendar, browser automation, screen capture, canvas, cron/heartbeat, GitHub, Notion, Slack, voice chat, 28 languages. Zero-dependency CLI.",
   "type": "module",
   "bin": {

package/src/commands/ui.mjs

@@ -383,11 +383,17 @@ export async function cmdUI(args) {
 
         if (collabAction === 'send' && method === 'POST') {
           const body = await parseBody(req);
-          // For simplicity in web UI, send as plaintext (public channel mode)
-          // In private mode, encryption happens client-side
+          // Encrypt with the same channel key used by CLI
+          const channelKey = crypto.createHash('sha256').update('alexandria-channel-key-v1').update(body.channelId).digest();
+          const nonce = crypto.randomBytes(12);
+          const cipher = crypto.createCipheriv('aes-256-gcm', channelKey, nonce);
+          const encrypted = Buffer.concat([cipher.update(body.message, 'utf-8'), cipher.final()]);
+          const tag = cipher.getAuthTag();
+          const ciphertext = Buffer.concat([encrypted, tag]).toString('base64');
+
           const r = await fetch(ALEX_API + '/channels/' + body.channelId + '/messages', {
             method: 'POST', headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({ senderFingerprint: identity.fingerprint, nonce: 'webui', ciphertext: Buffer.from(body.message).toString('base64'), type: 'text' }),
+            body: JSON.stringify({ senderFingerprint: identity.fingerprint, nonce: nonce.toString('base64'), ciphertext, type: 'text' }),
           });
           sendJSON(res, 200, await r.json());
           logRequest(method, pathname, 200, Date.now() - start);

package/src/constants.mjs

@@ -5,7 +5,7 @@ import { fileURLToPath } from 'url';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
-export const VERSION = '10.3.0';
+export const VERSION = '10.3.1';
 export const BASE_URL = 'https://nothumanallowed.com/cli';
 export const API_BASE = 'https://nothumanallowed.com/api/v1';