nothumanallowed 13.5.58 → 13.5.60

package/README.md

@@ -1,6 +1,6 @@
 # NotHumanAllowed
 
-**38 specialized AI agents, 81 tools, Studio visual workflows — all local, all free.** Security auditors, code architects, data analysts, DevOps engineers, technical writers — each with deep domain expertise. Use them individually, run complex multi-agent workflows in Studio, or let them deliberate together with Parliament mode.
+**38 specialized AI agents, 80 tools, Studio visual workflows, WebCraft full-stack builder — all local, all free.** Security auditors, code architects, data analysts, DevOps engineers, technical writers — each with deep domain expertise. Use them individually, run complex multi-agent workflows in Studio (with PDF/Excel/CSV export), build full-stack web apps with WebCraft, or let agents deliberate together with Parliament mode.
 
 ## Quick Start
 
@@ -40,6 +40,83 @@ EmailAgent → WebSearchAgent → WriterAgent
 - **Parliament mode** — enable for 2+ specialist agents to cross-read and deliberate: R1 (independent), R2 (agents read each other), R3 (HERALD mediation), convergence score
 - Open `nha ui` → click **Studio** in the sidebar
 
+### Studio Export
+
+When a workflow completes, Studio provides three export formats:
+
+- **PDF** — full structured report with all agent outputs, typography, token counters
+- **Excel (XLSX)** — professional multi-sheet workbook via SheetJS: one sheet per agent, auto-detected numeric columns with formatting, alternating row colors, freeze panes, auto-column widths, index sheet with token summary. Data tables are extracted from Markdown output automatically.
+- **CSV** — all Markdown tables from the report merged into a single file
+
+Export buttons appear in the result panel and in the toolbar after each run.
+
+---
+
+## WebCraft — Full-Stack Web Apps from a Chat
+
+WebCraft is a full-stack web app builder embedded in `nha ui`. Describe what you want in plain language — WebCraft generates a complete project with Express.js backend, PostgreSQL schema, JWT auth, email verification, security middleware, and a styled frontend. Everything runs locally with a live sandbox.
+
+```
+Open nha ui → click WebCraft in the sidebar
+```
+
+### How it works
+
+1. **Describe your project** in the chat (or pick an example: MySaaS, MyShop, MyBlog, MyPortfolio...)
+2. **WebCraft generates** all files: `server/`, `public/`, `db/migrations/`, `.env.example`, `package.json`, nginx config
+3. **Click ▶ Sandbox** — runs `npm install && node server/index.js` in an isolated process, live on a local port
+4. **Chat with the agent** to modify, fix, or extend anything — the agent edits files directly on disk, you see diffs in real time
+
+### WebCraft Agent
+
+An AI assistant permanently available in the chat panel. Powered by Liara (Qwen3 32B, free) or your own API key.
+
+**What it can do:**
+- Edit files surgically (old → new string replace) or rewrite them completely
+- Read any project file for context
+- Auto-fix `MODULE_NOT_FOUND` and common require() path errors
+- Restart the sandbox after fixes
+- Process attached screenshots or PDFs (vision) to debug visual issues
+
+**Context files** (created automatically for every project, editable via sidebar):
+| File | Type | Purpose |
+|---|---|---|
+| `skills/memory.md` | memory | Architecture decisions, stack choices, developer preferences |
+| `skills/liara.md` | provider | Calibrate AI tone, code style, constraints |
+| `skills/skills.md` | skill | Reusable patterns, snippets, API integrations |
+
+Add more skill files (unlimited) for specific integrations (Stripe, email templates, etc.).
+
+### Developer Tools (sidebar toolbar)
+
+| Tool | Description |
+|---|---|
+| **Diff viewer** | After every agent edit, see before/after for each changed file — color-coded, collapsible |
+| **Syntax check** ✅ | Runs `node --check` on all JS files, reports errors instantly |
+| **Search** 🔍 | Grep across all project files — click a result to jump to that file |
+| **Snapshot** 💾 | Save a full point-in-time backup of all files. Restore any snapshot with one click |
+| **Plan mode** | Type `/plan your request` — agent proposes a plan first, you approve before any file is touched |
+| **Auto-fix** | Sandbox errors (MODULE_NOT_FOUND etc.) trigger automatic Liara fix attempts (3 free, unlimited with own key) |
+
+### Example session
+
+```
+You: "Add a contact form with SMTP email and honeypot spam protection"
+Agent: → edits server/routes/api.js (add /contact POST route)
+       → edits server/services/email.js (add sendContactEmail)
+       → edits public/index.html (add form HTML)
+       → edits public/js/main.js (add form JS with honeypot)
+       [Diff viewer shows 4 files changed]
+       [Syntax check: ✅ all files valid]
+       [Sandbox restarted automatically]
+```
+
+```
+You: "/plan refactor auth to use refresh token rotation"
+Agent: → proposes plan (3 files, 6 changes) — no edits yet
+       → you click Approve → agent executes
+```
+
 ## Daily Operations (PAO)
 
 Connect Gmail + Calendar. 5 specialist agents analyze your day.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nothumanallowed",
-  "version": "13.5.58",
+  "version": "13.5.60",
   "description": "NotHumanAllowed — 38 AI agents, 80 tools, Studio (visual agentic workflows). Email, calendar, browser automation, screen capture, canvas, cron/heartbeat, Alexandria E2E messaging, GitHub, Notion, Slack, voice chat, free AI (Liara), 28 languages. Zero-dependency CLI.",
   "type": "module",
   "bin": {

package/src/commands/ui.mjs

@@ -4632,12 +4632,40 @@ REGOLE CRITICHE:
           }
 
           // Parse and execute tool calls from response
+          // Sanitize JSON from LLM: replace literal newlines inside JSON strings with \n
+          // Models often write multiline strings without escaping, which breaks JSON.parse
+          const sanitizeToolJson = (raw) => {
+            // Replace literal CR/LF inside JSON string values with escaped versions
+            // Strategy: walk char by char, track if we're inside a JSON string
+            let out = '';
+            let inStr = false;
+            let escaped = false;
+            for (let ci = 0; ci < raw.length; ci++) {
+              const ch = raw[ci];
+              if (escaped) { out += ch; escaped = false; continue; }
+              if (ch === '\\') { out += ch; escaped = true; continue; }
+              if (ch === '"') { inStr = !inStr; out += ch; continue; }
+              if (inStr && (ch === '\n' || ch === '\r')) {
+                out += ch === '\n' ? '\\n' : '\\r';
+                continue;
+              }
+              out += ch;
+            }
+            return out;
+          };
+
           const toolRegex = /<tool>([\s\S]*?)<\/tool>/g;
           let toolMatch;
           const toolResults = [];
           while ((toolMatch = toolRegex.exec(fullResponse)) !== null) {
             let toolCall;
-            try { toolCall = JSON.parse(toolMatch[1]); } catch(e) { continue; }
+            try {
+              const raw = toolMatch[1].trim();
+              toolCall = JSON.parse(sanitizeToolJson(raw));
+            } catch(e) {
+              sendEv({ type: 'tool', op: 'parse_error', path: '?', result: 'JSON malformato: ' + e.message.slice(0, 80) });
+              continue;
+            }
 
             if (toolCall.op === 'read') {
               const fp = path.join(sandboxDir, toolCall.path.replace(/^\/+/, ''));

package/src/constants.mjs

@@ -5,7 +5,7 @@ import { fileURLToPath } from 'url';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
-export const VERSION = '13.5.58';
+export const VERSION = '13.5.60';
 export const BASE_URL = 'https://nothumanallowed.com/cli';
 export const API_BASE = 'https://nothumanallowed.com/api/v1';
 

package/src/services/web-ui.mjs

@@ -6984,16 +6984,23 @@ function wcChatPanelHtml() {
       }
     } else {
       var toolBadges = (msg.tools || []).map(function(tool){
-        var icon = tool.op === 'edit' ? '✎' : (tool.op === 'write' ? '➕' : '👁');
-        var color = tool.result === 'ok' ? 'var(--green)' : 'var(--red)';
-        return '<span style="display:inline-flex;align-items:center;gap:3px;background:var(--bg3);border:1px solid var(--border);border-radius:4px;padding:2px 6px;font-size:9px;font-family:var(--mono);color:'+color+'">'+icon+' '+wcEsc(tool.path)+'</span>';
+        var isOk = tool.result === 'ok';
+        var isParseErr = tool.op === 'parse_error';
+        var icon = isParseErr ? '&#10067;' : (tool.op === 'edit' ? '&#9998;' : (tool.op === 'write' ? '&#10133;' : '&#128065;'));
+        var color = isOk ? 'var(--green)' : 'var(--red)';
+        var label = isParseErr ? ('JSON err: ' + wcEsc(tool.result)) : wcEsc(tool.path);
+        var title = isOk ? tool.op + ': ' + tool.path : (tool.result || '');
+        return '<span title="'+wcEsc(title)+'" style="display:inline-flex;align-items:center;gap:3px;background:var(--bg3);border:1px solid '+(isOk?'var(--green3)':'var(--red)')+';border-radius:4px;padding:2px 6px;font-size:9px;font-family:var(--mono);color:'+color+'">' +
+          icon + ' ' + label + '</span>';
       }).join(' ');
-      messagesHtml += '<div style="margin:4px 12px">' +
-        '<div style="display:flex;align-items:center;gap:6px;margin-bottom:3px">' +
-          '<span style="font-size:10px;font-weight:700;color:var(--green)">&#129302; WebCraft Agent</span>' +
+      var agentText = wcEsc(msg.text.replace(new RegExp('<tool>[\\s\\S]*?<\\/tool>', 'g'), '').trim());
+      messagesHtml += '<div style="margin:6px 12px;border:1px solid rgba(255,255,255,0.12);border-radius:10px;background:var(--bg3);overflow:hidden">' +
+        '<div style="display:flex;align-items:center;gap:6px;padding:6px 10px;border-bottom:1px solid rgba(255,255,255,0.06);background:rgba(255,255,255,0.03)">' +
+          '<span style="font-size:13px">&#129302;</span>' +
+          '<span style="font-size:10px;font-weight:700;color:var(--green)">WebCraft Agent</span>' +
         '</div>' +
-        '<div style="font-size:11px;color:var(--text);line-height:1.6;white-space:pre-wrap;max-width:85%">'+wcEsc(msg.text.replace(new RegExp('<tool>[\\s\\S]*?<\\/tool>', 'g'), '').trim())+'</div>' +
-        (toolBadges ? '<div style="display:flex;flex-wrap:wrap;gap:4px;margin-top:5px">'+toolBadges+'</div>' : '') +
+        '<div style="padding:8px 10px;font-size:11px;color:var(--text);line-height:1.6;white-space:pre-wrap">'+agentText+'</div>' +
+        (toolBadges ? '<div style="display:flex;flex-wrap:wrap;gap:4px;padding:6px 10px;border-top:1px solid rgba(255,255,255,0.06)">'+toolBadges+'</div>' : '') +
       '</div>';
     }
   }
@@ -7024,9 +7031,9 @@ function wcChatPanelHtml() {
       '</div>'
     : '<div style="padding:4px 12px 0;font-size:10px;color:var(--dim)">&#128196; <strong style="color:var(--green)">'+wcEsc(wcState.projectName)+'</strong> &mdash; scrivi per modificare o migliorare il progetto</div>';
 
-  return '<div style="border-top:1px solid var(--border);background:var(--bg2);flex-shrink:0;display:flex;flex-direction:column">' +
+  return '<div style="border-top:1px solid var(--border);background:var(--bg2);flex-shrink:0;display:flex;flex-direction:column;min-height:220px">' +
     // Messages
-    '<div id="wcChatMessages" style="max-height:160px;overflow-y:auto;padding:6px 0">' +
+    '<div id="wcChatMessages" style="max-height:240px;overflow-y:auto;padding:6px 0">' +
       messagesHtml +
     '</div>' +
     // Attachments
@@ -7039,7 +7046,7 @@ function wcChatPanelHtml() {
         '&#128206;' +
         '<input type="file" id="wcFileInput" multiple accept="image/*,.pdf" style="display:none" onchange="wcHandleFileAttach(this)">' +
       '</label>' +
-      '<textarea id="wcChatInput" rows="2" placeholder="'+placeholder+'" '+(inputDisabled?'disabled':'')+' style="flex:1;padding:8px 10px;font-size:12px;border-radius:8px;border:1px solid var(--border2);background:var(--bg3);color:var(--text);resize:none;line-height:1.5;font-family:inherit" onkeydown="wcChatKeydown(event)"></textarea>' +
+      '<textarea id="wcChatInput" rows="4" placeholder="'+placeholder+'" '+(inputDisabled?'disabled':'')+' style="flex:1;padding:8px 10px;font-size:12px;border-radius:8px;border:1px solid var(--border2);background:var(--bg3);color:var(--text);resize:vertical;min-height:80px;line-height:1.5;font-family:inherit" onkeydown="wcChatKeydown(event)"></textarea>' +
       '<button onclick="wcChatSend()" '+(inputDisabled?'disabled':'')+' style="padding:8px 14px;background:var(--green3);border:none;border-radius:8px;color:var(--bg);font-size:13px;font-weight:700;cursor:pointer;flex-shrink:0;height:38px">'+sendBtnLabel+'</button>' +
     '</div>' +
   '</div>';
@@ -7909,6 +7916,20 @@ async function wcStartSandbox() {
             wcState.sandbox.running = false;
             wcState.sandbox.error = evt.msg;
             renderWebCraft(document.getElementById('content'));
+            // Auto-fix: try to detect MODULE_NOT_FOUND in crash message and fix it
+            var errMsg = evt.msg || '';
+            var modMatch = errMsg.match(new RegExp("Cannot find module '([^']+)'")) ||
+                           errMsg.match(new RegExp('Cannot find module "([^"]+)"'));
+            if (modMatch && _wcAutoFixAttempts < 3) {
+              _wcAutoFixAttempts++;
+              wcTriggerAutoFix(modMatch[1]);
+            } else if (errMsg && !modMatch && _wcAutoFixAttempts < 3) {
+              // Generic crash: post error to chat so agent can see it
+              _wcAutoFixAttempts++;
+              wcChat.push({ role: 'system', text: '&#10060; Errore sandbox: ' + errMsg });
+              renderWebCraft(document.getElementById('content'));
+              wcScrollChatToBottom();
+            }
           }
         } catch(_) {}
       }