nothumanallowed 13.5.147 → 13.5.148

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nothumanallowed",
-  "version": "13.5.147",
+  "version": "13.5.148",
   "description": "NotHumanAllowed — 38 AI agents, 80 tools, Studio (visual agentic workflows). Email, calendar, browser automation, screen capture, canvas, cron/heartbeat, Alexandria E2E messaging, GitHub, Notion, Slack, voice chat, free AI (Liara), 28 languages. Zero-dependency CLI.",
   "type": "module",
   "bin": {

package/src/commands/ui.mjs

@@ -5869,39 +5869,61 @@ REGOLE CRITICHE:
           // Parse and execute tool calls from response
           // Sanitize JSON from LLM: replace literal newlines and invalid escape sequences inside JSON strings
           // Models often write multiline strings without escaping, or use \s \d \w in regex inside content
-          const sanitizeToolJson = (raw) => {
-            // Valid JSON escape chars after backslash: " \ / b f n r t u
-            const validEscapes = new Set(['"', '\\', '/', 'b', 'f', 'n', 'r', 't', 'u']);
+          // Robust JSON string extractor: reads a JSON string value starting at position i (after the opening ")
+          // Returns { value, end } where end is the index after the closing "
+          const extractJsonString = (s, i) => {
             let out = '';
-            let inStr = false;
-            let escaped = false;
-            for (let ci = 0; ci < raw.length; ci++) {
-              const ch = raw[ci];
-              if (escaped) {
-                escaped = false;
-                // If this is not a valid JSON escape char, double the backslash
-                if (!validEscapes.has(ch)) {
-                  out += '\\\\' + ch;
-                } else {
-                  out += ch;
-                }
-                continue;
-              }
+            const validEscapes = new Set(['"', '\\', '/', 'b', 'f', 'n', 'r', 't', 'u']);
+            while (i < s.length) {
+              const ch = s[i];
               if (ch === '\\') {
-                if (inStr) {
-                  escaped = true;
-                  out += ch;
+                const next = s[i + 1];
+                if (next === undefined) { out += '\\\\'; i++; break; }
+                if (validEscapes.has(next)) {
+                  // valid escape — keep as-is, but handle \u specially
+                  if (next === 'u') {
+                    const hex = s.slice(i + 2, i + 6);
+                    if (/^[0-9a-fA-F]{4}$/.test(hex)) {
+                      out += s.slice(i, i + 6); i += 6;
+                    } else {
+                      out += '\\\\u'; i += 2;
+                    }
+                  } else {
+                    out += s.slice(i, i + 2); i += 2;
+                  }
                 } else {
-                  out += ch;
+                  // invalid escape (e.g. \s \d \w \( \. \n written as literal) — escape the backslash
+                  out += '\\\\' + next; i += 2;
                 }
                 continue;
               }
-              if (ch === '"') { inStr = !inStr; out += ch; continue; }
-              if (inStr && (ch === '\n' || ch === '\r')) {
-                out += ch === '\n' ? '\\n' : '\\r';
-                continue;
+              if (ch === '"') { i++; break; } // closing quote
+              if (ch === '\n') { out += '\\n'; i++; continue; }
+              if (ch === '\r') { out += '\\r'; i++; continue; }
+              if (ch === '\t') { out += '\\t'; i++; continue; }
+              // other control chars
+              if (ch.charCodeAt(0) < 0x20) { out += '\\u' + ch.charCodeAt(0).toString(16).padStart(4, '0'); i++; continue; }
+              out += ch; i++;
+            }
+            return { value: out, end: i };
+          };
+
+          const sanitizeToolJson = (raw) => {
+            // Rebuild the JSON char-by-char, using extractJsonString for string values
+            let out = '';
+            let i = 0;
+            let inStr = false;
+            while (i < raw.length) {
+              if (!inStr && raw[i] === '"') {
+                // Start of a JSON string — extract it robustly
+                out += '"';
+                i++;
+                const { value, end } = extractJsonString(raw, i);
+                out += value + '"';
+                i = end;
+              } else {
+                out += raw[i++];
               }
-              out += ch;
             }
             return out;
           };
@@ -5982,9 +6004,11 @@ Rispondi SOLO con il contenuto completo del file corretto, senza markdown fence,
             } else if (toolCall.op === 'write') {
               const fp = path.join(sandboxDir, toolCall.path.replace(/^\/+/, ''));
               fs.mkdirSync(path.dirname(fp), { recursive: true });
+              const oldContent = fs.existsSync(fp) ? fs.readFileSync(fp, 'utf8') : '';
               fs.writeFileSync(fp, toolCall.content || '', 'utf8');
               toolResults.push({ op: 'write', path: toolCall.path, ok: true });
-              sendEv({ type: 'tool', op: 'write', path: toolCall.path, result: 'ok' });
+              sendEv({ type: 'tool', op: 'write', path: toolCall.path, result: 'ok',
+                oldSnippet: oldContent.slice(0, 300), newSnippet: (toolCall.content || '').slice(0, 300) });
             }
           }
 

package/src/constants.mjs

@@ -5,7 +5,7 @@ import { fileURLToPath } from 'url';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
-export const VERSION = '13.5.147';
+export const VERSION = '13.5.148';
 export const BASE_URL = 'https://nothumanallowed.com/cli';
 export const API_BASE = 'https://nothumanallowed.com/api/v1';