nothumanallowed 13.5.130 → 13.5.132

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nothumanallowed",
-  "version": "13.5.130",
+  "version": "13.5.132",
   "description": "NotHumanAllowed — 38 AI agents, 80 tools, Studio (visual agentic workflows). Email, calendar, browser automation, screen capture, canvas, cron/heartbeat, Alexandria E2E messaging, GitHub, Notion, Slack, voice chat, free AI (Liara), 28 languages. Zero-dependency CLI.",
   "type": "module",
   "bin": {

package/src/commands/ui.mjs

@@ -5308,8 +5308,14 @@ module.exports = { validateEmail, sanitizeText, validatePassword, validateUserna
           let pkg = {};
           try { pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8')); } catch(_) {}
           if (!pkg.dependencies) pkg.dependencies = {};
+          // Remove server-side deps that can't run in sandbox
           delete pkg.dependencies.pg;
           delete pkg.dependencies.ioredis;
+          delete pkg.dependencies['pg-pool'];
+          delete pkg.dependencies.redis;
+          delete pkg.dependencies.mongoose;
+          delete pkg.dependencies.mysql2;
+          delete pkg.dependencies.sequelize;
           // Force known-good versions — LLM often generates non-existent patch versions
           pkg.dependencies.express = '^4.19.0';
           pkg.dependencies.bcryptjs = '^2.4.3';
@@ -5320,10 +5326,63 @@ module.exports = { validateEmail, sanitizeText, validatePassword, validateUserna
           pkg.dependencies.dotenv = '^16.4.0';
           pkg.dependencies.nodemailer = '^6.9.0';
           pkg.dependencies['express-validator'] = '^7.0.1';
+          // Auto-detect any require('pkg') in server JS files and add missing deps
+          const KNOWN_VERSIONS = {
+            'xss-clean': '^0.1.4', 'morgan': '^1.10.0', 'compression': '^1.7.4',
+            'multer': '^1.4.5-lts.1', 'uuid': '^9.0.0', 'axios': '^1.6.0',
+            'lodash': '^4.17.21', 'moment': '^2.30.1', 'dayjs': '^1.11.10',
+            'joi': '^17.12.0', 'zod': '^3.22.4', 'yup': '^1.3.3',
+            'stripe': '^14.21.0', 'passport': '^0.7.0', 'passport-local': '^1.0.0',
+            'passport-jwt': '^4.0.1', 'cookie-parser': '^1.4.6', 'body-parser': '^1.20.2',
+            'express-session': '^1.18.0', 'connect-flash': '^0.1.1', 'method-override': '^3.0.0',
+            'serve-static': '^1.15.0', 'path': '0.12.7', 'crypto': '^1.0.1',
+            'sanitize-html': '^2.12.0', 'dompurify': '^3.0.9', 'validator': '^13.11.0',
+            'express-mongo-sanitize': '^2.2.0', 'hpp': '^0.2.3', 'xss': '^1.0.14',
+            'winston': '^3.12.0', 'pino': '^8.19.0', 'chalk': '^5.3.0',
+            'socket.io': '^4.7.4', 'ws': '^8.16.0', 'ejs': '^3.1.9', 'pug': '^3.0.2',
+            'handlebars': '^4.7.8', 'nunjucks': '^3.2.4', 'sharp': '^0.33.3',
+            'qrcode': '^1.5.3', 'pdf-lib': '^1.17.1',
+          };
+          const NODE_BUILTINS = new Set(['fs','path','os','crypto','http','https','net','url','util',
+            'events','stream','buffer','child_process','process','querystring','readline','assert',
+            'zlib','dns','tls','cluster','worker_threads','perf_hooks','vm','v8','module',
+            'string_decoder','timers','punycode','domain','console','sys']);
+          function scanRequires(dir) {
+            const found = new Set();
+            const walk = (d) => {
+              let entries;
+              try { entries = fs.readdirSync(d, { withFileTypes: true }); } catch { return; }
+              for (const e of entries) {
+                if (e.name === 'node_modules' || e.name.startsWith('.')) continue;
+                const full = path.join(d, e.name);
+                if (e.isDirectory()) { walk(full); continue; }
+                if (!e.name.endsWith('.js') && !e.name.endsWith('.mjs') && !e.name.endsWith('.cjs')) continue;
+                let src;
+                try { src = fs.readFileSync(full, 'utf8'); } catch { continue; }
+                const re = /require\s*\(\s*['"]([^'"./][^'"]*)['"]\s*\)/g;
+                let m;
+                while ((m = re.exec(src)) !== null) {
+                  const pkg2 = m[1].startsWith('@') ? m[1].split('/').slice(0,2).join('/') : m[1].split('/')[0];
+                  if (!NODE_BUILTINS.has(pkg2)) found.add(pkg2);
+                }
+              }
+            };
+            walk(dir);
+            return found;
+          }
+          const detected = scanRequires(sandboxDir);
+          const missing = [];
+          for (const mod of detected) {
+            if (!pkg.dependencies[mod] && !pkg.devDependencies?.[mod]) {
+              pkg.dependencies[mod] = KNOWN_VERSIONS[mod] || 'latest';
+              missing.push(mod);
+            }
+          }
+          if (missing.length > 0) sendLog('🔍 Dipendenze auto-rilevate e aggiunte: ' + missing.join(', '));
           pkg.scripts = pkg.scripts || {};
           pkg.scripts.start = 'node server/index.js';
           fs.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2), 'utf8');
-          sendLog('📦 package.json ottimizzato per sandbox (rimosso pg, redis)');
+          sendLog('📦 package.json ottimizzato per sandbox (rimosso pg/redis, auto-scan require)');
 
           // Create minimal .env for sandbox
           const envContent = [
@@ -5386,48 +5445,70 @@ module.exports = { validateEmail, sanitizeText, validatePassword, validateUserna
 
           let _lastMissingModule = null;
           let _lastCrashError = null;
+          let _stderrBuffer = '';  // accumulate full stderr for rich error context
           proc.stdout.on('data', d => { const l = d.toString().trim(); if (l) sendLog('  [server] ' + l); });
           proc.stderr.on('data', d => {
             const raw = d.toString();
+            _stderrBuffer += raw;
             // MODULE_NOT_FOUND
             const modMatch = raw.match(/Cannot find module '([^']+)'/);
             if (modMatch) {
               const missingMod = modMatch[1];
               _lastMissingModule = missingMod;
-              _lastCrashError = "Cannot find module '" + missingMod + "'";
+              _lastCrashError = "Cannot find module '" + missingMod + "'\n" + _stderrBuffer.slice(0, 1500);
               sendLog('  ❌ Modulo mancante: ' + missingMod);
               if (!global._wcAutoFixQueue) global._wcAutoFixQueue = [];
               global._wcAutoFixQueue.push({ type: 'module_not_found', module: missingMod, dir: sandboxDir, ts: Date.now() });
               sendLog('  🤖 Avvio auto-fix...');
               return;
             }
-            // TypeError / SyntaxError / ReferenceError — capture for autofix
+            // TypeError / SyntaxError / ReferenceError / Error — capture with full stack
             const crashMatch = raw.match(/^(TypeError|SyntaxError|ReferenceError|Error):\s+(.+)/m);
             if (crashMatch) {
-              _lastCrashError = crashMatch[1] + ': ' + crashMatch[2].trim();
-              sendLog('  ❌ ' + _lastCrashError);
+              _lastCrashError = crashMatch[1] + ': ' + crashMatch[2].trim() + '\n' + _stderrBuffer.slice(0, 1500);
+              sendLog('  ❌ ' + crashMatch[1] + ': ' + crashMatch[2].trim());
               if (!global._wcAutoFixQueue) global._wcAutoFixQueue = [];
               global._wcAutoFixQueue.push({ type: 'crash_error', error: _lastCrashError, dir: sandboxDir, ts: Date.now() });
               sendLog('  🤖 Avvio auto-fix...');
               return;
             }
-            // Skip node internals noise
+            // Log everything else (including at-lines during crash) for visibility
             const l = raw.trim();
-            if (!l || l.startsWith('at ') || l.startsWith('(node:') || l === '^') return;
+            if (!l || l.startsWith('(node:') || l === '^') return;
             sendLog('  [server] ' + l);
           });
 
-          // Wait for server to be ready (max 10s)
+          // Wait for server to be ready (max 30s).
+          // If process exits early (crash), report the error immediately so the client
+          // can trigger auto-fix while the SSE connection is still open.
           await new Promise((resolve, reject) => {
             let attempts = 0;
+            const MAX_ATTEMPTS = 60; // 30s at 500ms intervals
+            let crashed = false;
+
+            proc.on('exit', (code) => {
+              if (crashed || code === 0) return;
+              crashed = true;
+              // Give stderr a moment to flush
+              setTimeout(() => {
+                const errMsg = _lastCrashError || (_lastMissingModule ? "Cannot find module '" + _lastMissingModule + "'" : 'Server crashed (exit code ' + code + ')');
+                reject(new Error(errMsg));
+              }, 300);
+            });
+
             const tryConnect = () => {
-                const s = netMod.createConnection(freePort, '127.0.0.1');
-                s.on('connect', () => { s.destroy(); resolve(); });
-                s.on('error', () => {
-                  s.destroy();
-                  if (++attempts > 20) reject(new Error(_lastMissingModule ? "Cannot find module '" + _lastMissingModule + "'" : 'Server non risponde dopo 10s'));
-                  else setTimeout(tryConnect, 500);
-                });
+              if (crashed) return;
+              const s = netMod.createConnection(freePort, '127.0.0.1');
+              s.on('connect', () => { s.destroy(); resolve(); });
+              s.on('error', () => {
+                s.destroy();
+                if (crashed) return;
+                if (++attempts > MAX_ATTEMPTS) {
+                  reject(new Error(_lastCrashError || (_lastMissingModule ? "Cannot find module '" + _lastMissingModule + "'" : 'Server non risponde dopo 30s')));
+                } else {
+                  setTimeout(tryConnect, 500);
+                }
+              });
             };
             setTimeout(tryConnect, 1000);
           });

package/src/constants.mjs

@@ -5,7 +5,7 @@ import { fileURLToPath } from 'url';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
-export const VERSION = '13.5.130';
+export const VERSION = '13.5.132';
 export const BASE_URL = 'https://nothumanallowed.com/cli';
 export const API_BASE = 'https://nothumanallowed.com/api/v1';