nothumanallowed 13.5.144 → 13.5.146

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nothumanallowed",
-  "version": "13.5.144",
+  "version": "13.5.146",
   "description": "NotHumanAllowed — 38 AI agents, 80 tools, Studio (visual agentic workflows). Email, calendar, browser automation, screen capture, canvas, cron/heartbeat, Alexandria E2E messaging, GitHub, Notion, Slack, voice chat, free AI (Liara), 28 languages. Zero-dependency CLI.",
   "type": "module",
   "bin": {

package/src/commands/ui.mjs

@@ -4979,6 +4979,8 @@ ${completedHeadings ? `## SECTIONS ALREADY WRITTEN (headings only):\n${completed
               html = html.replace(/<meta[^>]+X-Frame-Options[^>]*>/gi, '');
               // Remove Content-Security-Policy meta http-equiv (server sets it via helmet with sandbox-safe values)
               html = html.replace(/<meta[^>]+http-equiv=["']Content-Security-Policy["'][^>]*>/gi, '');
+              // Remove upgrade-insecure-requests directive if present in any remaining CSP meta
+              html = html.replace(/upgrade-insecure-requests\s*;?\s*/gi, '');
               // Remove frame-ancestors none/self directives from any remaining CSP meta
               html = html.replace(/<meta[^>]+content=["'][^"']*frame-ancestors[^"']*["'][^>]*>/gi, '');
               if (html.length !== before) {
@@ -5273,6 +5275,11 @@ module.exports = { validateEmail, sanitizeText, validatePassword, validateUserna
             [/require\(['"]\.\/middleware\/rateLimit['"]\)/g,          "require('./middleware/security')"],
             [/require\(['"]\.\.\/middleware\/limiter['"]\)/g,          "require('../middleware/security')"],
             [/require\(['"]\.\/middleware\/limiter['"]\)/g,            "require('./middleware/security')"],
+            // nodemailer: LLM calls createTransporter (wrong) instead of createTransport (correct)
+            [/nodemailer\.createTransporter\s*\(/g,                    "nodemailer.createTransport("],
+            [/\{createTransporter\s*:/g,                               "{createTransport:"],
+            // helmet: upgradeInsecureRequests forces HTTPS on local sandbox — always disable it
+            [/upgradeInsecureRequests\s*:\s*(?:true|\{\}|undefined)/g, "upgradeInsecureRequests: false"],
           ];
           function patchJsFiles(dir, rootDir) {
             if (!fs.existsSync(dir)) return;

package/src/constants.mjs

@@ -5,7 +5,7 @@ import { fileURLToPath } from 'url';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
-export const VERSION = '13.5.144';
+export const VERSION = '13.5.146';
 export const BASE_URL = 'https://nothumanallowed.com/cli';
 export const API_BASE = 'https://nothumanallowed.com/api/v1';