nothumanallowed 13.5.65 → 13.5.67

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nothumanallowed",
-  "version": "13.5.65",
+  "version": "13.5.67",
   "description": "NotHumanAllowed — 38 AI agents, 80 tools, Studio (visual agentic workflows). Email, calendar, browser automation, screen capture, canvas, cron/heartbeat, Alexandria E2E messaging, GitHub, Notion, Slack, voice chat, free AI (Liara), 28 languages. Zero-dependency CLI.",
   "type": "module",
   "bin": {

package/src/commands/ui.mjs

@@ -4313,6 +4313,13 @@ module.exports = { get, set, del, exists };
             [/require\(['"]\.\.\/\.\.\/config['"]\)/g,                 "{env:process.env}"],
             [/require\(['"]\.\.\/config['"]\)/g,                       "{env:process.env}"],
             [/require\(['"]\.\/config['"]\)/g,                         "{env:process.env}"],
+            // rateLimiter: LLM sometimes creates a separate file instead of importing from security.js
+            [/require\(['"]\.\.\/middleware\/rateLimiter['"]\)/g,      "require('../middleware/security')"],
+            [/require\(['"]\.\/middleware\/rateLimiter['"]\)/g,        "require('./middleware/security')"],
+            [/require\(['"]\.\.\/middleware\/rateLimit['"]\)/g,        "require('../middleware/security')"],
+            [/require\(['"]\.\/middleware\/rateLimit['"]\)/g,          "require('./middleware/security')"],
+            [/require\(['"]\.\.\/middleware\/limiter['"]\)/g,          "require('../middleware/security')"],
+            [/require\(['"]\.\/middleware\/limiter['"]\)/g,            "require('./middleware/security')"],
           ];
           function patchJsFiles(dir) {
             if (!fs.existsSync(dir)) return;

package/src/services/web-ui.mjs

@@ -6544,6 +6544,9 @@ var _wcDiffQueue = [];       // [{file, before, after}] diffs from last agent ru
 var _wcGrepOpen = false;     // grep panel visible
 var _wcGrepQuery = '';
 var _wcGrepResults = [];
+var _wcOverlayMinimized = false;   // overlay minimized by user click
+var _wcOverlayTimer = null;        // inactivity timer to restore overlay
+var _wcGenAbortCtrl = null;        // AbortController for generation stop
 var _wcSyntaxResults = [];   // [{file, ok, error}]
 var _wcSnapshots = [];       // [{ts, fileCount}]
 // Skills state
@@ -6657,7 +6660,22 @@ function renderWebCraft(el) {
         : '') +
       '</div>' +
       '<div data-wc-files style="position:relative;flex:1;min-width:0;background:var(--bg2);border:1px solid var(--border);border-radius:10px;display:flex;flex-direction:column;height:100%;overflow:hidden">' +
-        (wcState.running ? '<div id="wcGenOverlay" style="position:absolute;inset:0;background:rgba(0,0,0,0.75);backdrop-filter:blur(4px);border-radius:10px;z-index:50;display:flex;flex-direction:column;align-items:center;justify-content:center;animation:wcBubbleIn .3s ease"><div style="font-size:38px;animation:wcRobotBob 1s ease-in-out infinite">&#129302;</div><div style="font-size:13px;font-weight:700;color:var(--green);margin-top:12px">Avvio generazione...</div><div style="display:flex;gap:4px;margin-top:16px">'+[0,1,2,3,4].map(function(_,idx){ return '<div style="width:6px;height:6px;border-radius:50%;background:var(--green);animation:wcDot 1.1s ease-in-out infinite '+(idx*0.14)+'s"></div>'; }).join('')+'</div></div>' : '') +
+        (wcState.running ? (
+          _wcOverlayMinimized
+          // Minimized: small pill in bottom-right corner
+          ? '<div id="wcGenOverlay" onclick="wcOverlayRestore()" style="position:absolute;bottom:12px;right:12px;z-index:50;background:rgba(0,0,0,0.85);border:1px solid var(--green3);border-radius:20px;padding:5px 12px;display:flex;align-items:center;gap:7px;cursor:pointer;animation:wcBubbleIn .2s ease;backdrop-filter:blur(4px)">'
+              +'<span style="font-size:16px;animation:wcRobotBob .9s ease-in-out infinite">&#129302;</span>'
+              +'<span style="font-size:10px;color:var(--green);font-weight:700">Generando...</span>'
+              +'<span style="display:flex;gap:3px">'+[0,1,2].map(function(_,idx){ return '<span style="width:4px;height:4px;border-radius:50%;background:var(--green);animation:wcDot 1.1s ease-in-out infinite '+(idx*0.18)+'s"></span>'; }).join('')+'</span>'
+            +'</div>'
+          // Full overlay
+          : '<div id="wcGenOverlay" onclick="wcOverlayMinimize()" title="Clicca per nascondere e navigare i file" style="position:absolute;inset:0;background:rgba(0,0,0,0.75);backdrop-filter:blur(4px);border-radius:10px;z-index:50;display:flex;flex-direction:column;align-items:center;justify-content:center;animation:wcBubbleIn .3s ease;cursor:pointer">'
+              +'<div style="font-size:38px;animation:wcRobotBob 1s ease-in-out infinite">&#129302;</div>'
+              +'<div style="font-size:13px;font-weight:700;color:var(--green);margin-top:12px">Generazione in corso...</div>'
+              +'<div style="font-size:10px;color:var(--dim);margin-top:4px">Clicca per navigare i file</div>'
+              +'<div style="display:flex;gap:4px;margin-top:16px">'+[0,1,2,3,4].map(function(_,idx){ return '<div style="width:6px;height:6px;border-radius:50%;background:var(--green);animation:wcDot 1.1s ease-in-out infinite '+(idx*0.14)+'s"></div>'; }).join('')+'</div>'
+            +'</div>'
+        ) : '') +
         '<div style="display:flex;border-bottom:1px solid var(--border);flex-shrink:0">' +
           '<button onclick="wcTabFiles()" style="padding:8px 16px;background:'+(wcRightTab==='preview'?'transparent':'var(--bg3)')+';border:none;border-right:1px solid var(--border);color:'+(wcRightTab==='preview'?'var(--dim)':'var(--text)')+';font-size:11px;font-weight:600;cursor:pointer">&#128196; File</button>' +
           '<button onclick="wcTabPreview()" style="padding:8px 16px;background:'+(wcRightTab==='preview'?'var(--bg3)':'transparent')+';border:none;color:'+(wcRightTab==='preview'?'var(--text)':'var(--dim)')+';font-size:11px;font-weight:600;cursor:pointer">&#127760; Sandbox</button>' +
@@ -7087,7 +7105,10 @@ function wcChatPanelHtml() {
         '<input type="file" id="wcFileInput" multiple accept="image/*,.pdf" style="display:none" onchange="wcHandleFileAttach(this)">' +
       '</label>' +
       '<textarea id="wcChatInput" rows="4" placeholder="'+placeholder+'" '+(inputDisabled?'disabled':'')+' style="flex:1;padding:8px 10px;font-size:12px;border-radius:8px;border:1px solid var(--border2);background:var(--bg3);color:var(--text);resize:vertical;min-height:80px;line-height:1.5;font-family:inherit" onkeydown="wcChatKeydown(event)"></textarea>' +
-      '<button onclick="wcChatSend()" '+(inputDisabled?'disabled':'')+' style="padding:8px 14px;background:var(--green3);border:none;border-radius:8px;color:var(--bg);font-size:13px;font-weight:700;cursor:pointer;flex-shrink:0;height:38px">'+sendBtnLabel+'</button>' +
+      '<div style="display:flex;flex-direction:column;gap:5px;flex-shrink:0">' +
+        '<button onclick="wcChatSend()" '+(inputDisabled?'disabled':'')+' style="padding:8px 14px;background:var(--green3);border:none;border-radius:8px;color:var(--bg);font-size:13px;font-weight:700;cursor:pointer;height:38px;white-space:nowrap">'+sendBtnLabel+'</button>' +
+        (inputDisabled ? '<button onclick="wcStopAll()" style="padding:5px 10px;background:rgba(239,68,68,0.12);border:1px solid rgba(239,68,68,0.4);border-radius:7px;color:#f87171;font-size:11px;font-weight:700;cursor:pointer;white-space:nowrap">&#9632; Stop</button>' : '') +
+      '</div>' +
     '</div>' +
   '</div>';
 }
@@ -7096,6 +7117,17 @@ function wcChatKeydown(e) {
   if (e.key === 'Enter' && !e.shiftKey) { e.preventDefault(); wcChatSend(); }
 }
 
+function wcStopAll() {
+  // Abort ongoing generation
+  if (_wcGenAbortCtrl) { _wcGenAbortCtrl.abort(); _wcGenAbortCtrl = null; }
+  wcState.running = false;
+  wcChatRunning = false;
+  _wcOverlayMinimized = false;
+  if (_wcOverlayTimer) { clearTimeout(_wcOverlayTimer); _wcOverlayTimer = null; }
+  wcChat.push({ role: 'system', text: '&#9632; Generazione interrotta.' });
+  renderWebCraft(document.getElementById('content'));
+}
+
 function wcRemoveAttachment(ai) {
   wcChatAttachments.splice(ai, 1);
   renderWebCraft(document.getElementById('content'));
@@ -7671,6 +7703,8 @@ async function wcGenerate() {
   wcState.running = true;
   wcState.generatedFiles = [];
   wcState.activeFile = 0;
+  _wcOverlayMinimized = false;
+  _wcGenAbortCtrl = new AbortController();
   renderWebCraft(document.getElementById('content'));
 
   // Security rules always injected
@@ -7698,7 +7732,7 @@ async function wcGenerate() {
     { name: 'server/middleware/security.js', lang: 'javascript', prompt: 'Generate server/middleware/security.js: detect sandbox via isSandbox = !process.env.NODE_ENV || process.env.NODE_ENV === "development". Use helmet CSP: defaultSrc self, scriptSrc self unsafe-inline, styleSrc self unsafe-inline, imgSrc self data:, connectSrc self, objectSrc none. frameAncestors: if isSandbox use ["self", "http://127.0.0.1:*", "http://localhost:*"] else ["none"]. NO X-Frame-Options DENY (conflicts with frameAncestors). NO HSTS in sandbox (HTTP only). Referrer-Policy strict-origin-when-cross-origin. Add express-rate-limit for general routes (100/15min) and strict limiter for auth (5/15min). Export { applySecurityMiddleware, authLimiter }.' },
     { name: 'server/middleware/validate.js', lang: 'javascript', prompt: 'Generate server/middleware/validate.js using express-validator. Export handleValidationErrors middleware. Export auth field validators: registerValidator (fields: '+authFieldsDef+'), loginValidator (email + password).' },
     { name: 'server/services/email.js', lang: 'javascript', prompt: 'Generate server/services/email.js: Nodemailer transporter using SMTP from env. Function sendVerificationEmail(to, token, baseUrl): sends HTML email with verification link. Function sendPasswordResetEmail(to, token, baseUrl). Add SendGrid fallback (commented out, predisposed with transporter swap). Never expose credentials.' },
-    { name: 'server/routes/auth.js',  lang: 'javascript', prompt: 'Generate server/routes/auth.js: POST /register (validate fields: '+authFieldsDef+', check duplicate email, bcrypt hash password cost 12, insert user, send verification email, return 201), POST /login (validate, check email verified, compare bcrypt, issue JWT access 15min + refresh 7d httpOnly cookie), POST /logout (clear refresh cookie), POST /refresh-token (validate refresh from httpOnly cookie, rotate token), GET /verify-email/:token (mark email verified). Use parameterized queries only. Apply authLimiter to register and login.' },
+    { name: 'server/routes/auth.js',  lang: 'javascript', prompt: 'Generate server/routes/auth.js: POST /register (validate fields: '+authFieldsDef+', check duplicate email, bcrypt hash password cost 12, insert user, send verification email, return 201), POST /login (validate, check email verified, compare bcrypt, issue JWT access 15min + refresh 7d httpOnly cookie), POST /logout (clear refresh cookie), POST /refresh-token (validate refresh from httpOnly cookie, rotate token), GET /verify-email/:token (mark email verified). Use parameterized queries only. Import authLimiter EXACTLY like this: const { authLimiter } = require("../middleware/security"); — do NOT create or import from ../middleware/rateLimiter (that file does not exist). Apply authLimiter to register and login.' },
     { name: 'server/routes/api.js',   lang: 'javascript', prompt: 'Generate server/routes/api.js: Express router with a verifyToken middleware (validates JWT Bearer). GET /api/me returns authenticated user profile (no password hash). GET /api/health returns {status: ok, timestamp}. Structure ready for adding more routes.' },
     { name: 'server/index.js',        lang: 'javascript', prompt: 'Generate server/index.js: Express app entry point. Apply applySecurityMiddleware first. Then apply sentinelMiddleware (import from ./middleware/sentinel.js). Use CORS with env CORS_ORIGIN. Parse JSON body (limit 10kb). Mount /api/auth → auth.js, /api → api.js. Serve public/ as static. 404 handler and global error handler (never leak stack traces in production). Start on PORT from env.' },
     { name: 'db/migrations/001_init.sql', lang: 'sql',   prompt: 'Generate PostgreSQL migration 001_init.sql: CREATE TABLE users with id UUID default gen_random_uuid(), fields for '+authFieldsDef+', email_verified BOOLEAN default false, verification_token VARCHAR, reset_token VARCHAR, reset_token_expires TIMESTAMPTZ, refresh_token_hash VARCHAR, created_at TIMESTAMPTZ default now(), updated_at TIMESTAMPTZ default now(). CREATE INDEX on email. CREATE TABLE refresh_tokens (id, user_id FK, token_hash, expires_at, created_at). Add updated_at trigger function.' },
@@ -7731,30 +7765,46 @@ async function wcGenerate() {
   var sysPreamble = 'You are an expert full-stack engineer generating production-quality code.' + _nl + _nl + 'SECURITY RULES (non-negotiable):' + _nl + SECURITY_RULES + _nl + _nl + 'Project: ' + projName + _nl + 'Description: ' + desc + _nl + 'Enabled blocks: ' + blocksEnabled + _nl + _nl + 'Generate ONLY the file content requested. No explanations, no markdown code fences, no comments like "here is the file". Output raw file content only.';
 
   function wcUpdateGenOverlay(fi2, total, name) {
+    if (_wcOverlayMinimized) return; // don't touch minimized pill
     var ov = document.getElementById('wcGenOverlay');
     if (!ov) return;
     var pct = Math.round((fi2 / total) * 100);
     ov.innerHTML =
-      '<div style="display:flex;flex-direction:column;align-items:center;justify-content:center;height:100%;gap:16px;padding:24px">' +
-        '<div style="font-size:38px;animation:wcRobotBob 1s ease-in-out infinite">&#129302;</div>' +
-        '<div style="font-size:13px;font-weight:700;color:var(--green)">Generazione in corso...</div>' +
-        '<div style="font-size:11px;color:var(--dim);font-family:var(--mono);max-width:300px;text-align:center;word-break:break-all">'+wcEsc(name)+'</div>' +
-        '<div style="width:220px;height:4px;background:var(--bg3);border-radius:2px;overflow:hidden">' +
-          '<div style="height:100%;width:'+pct+'%;background:var(--green);border-radius:2px;transition:width .4s ease;animation:wcBarPulse 1.5s ease-in-out infinite"></div>' +
-        '</div>' +
-        '<div style="font-size:10px;color:var(--dim)">'+fi2+' / '+total+' file</div>' +
-        '<div style="display:flex;gap:4px;margin-top:4px">' +
-          [0,1,2,3,4].map(function(_,idx){ return '<div style="width:6px;height:6px;border-radius:50%;background:var(--green);animation:wcDot 1.1s ease-in-out infinite '+(idx*0.14)+'s"></div>'; }).join('') +
-        '</div>' +
-      '</div>';
+      '<div style="font-size:38px;animation:wcRobotBob 1s ease-in-out infinite">&#129302;</div>' +
+      '<div style="font-size:13px;font-weight:700;color:var(--green);margin-top:12px">Generazione in corso...</div>' +
+      '<div style="font-size:10px;color:var(--dim);margin-top:2px">Clicca per navigare i file</div>' +
+      '<div style="font-size:11px;color:var(--dim);font-family:var(--mono);max-width:300px;text-align:center;word-break:break-all;margin-top:8px">'+wcEsc(name)+'</div>' +
+      '<div style="width:220px;height:4px;background:rgba(255,255,255,0.1);border-radius:2px;overflow:hidden;margin-top:12px">' +
+        '<div style="height:100%;width:'+pct+'%;background:var(--green);border-radius:2px;transition:width .4s ease;animation:wcBarPulse 1.5s ease-in-out infinite"></div>' +
+      '</div>' +
+      '<div style="font-size:10px;color:var(--dim);margin-top:6px">'+fi2+' / '+total+' file</div>' +
+      '<div style="display:flex;gap:4px;margin-top:10px">'+[0,1,2,3,4].map(function(_,idx){ return '<div style="width:6px;height:6px;border-radius:50%;background:var(--green);animation:wcDot 1.1s ease-in-out infinite '+(idx*0.14)+'s"></div>'; }).join('')+'</div>';
+  }
+
+  function wcOverlayMinimize() {
+    _wcOverlayMinimized = true;
+    renderWebCraft(document.getElementById('content'));
+    // Restore after 10s of inactivity
+    if (_wcOverlayTimer) clearTimeout(_wcOverlayTimer);
+    _wcOverlayTimer = setTimeout(function() {
+      if (wcState.running) { _wcOverlayMinimized = false; renderWebCraft(document.getElementById('content')); }
+    }, 10000);
+  }
+
+  function wcOverlayRestore() {
+    if (_wcOverlayTimer) { clearTimeout(_wcOverlayTimer); _wcOverlayTimer = null; }
+    _wcOverlayMinimized = false;
+    renderWebCraft(document.getElementById('content'));
   }
 
   for (var fi = 0; fi < filePlan.length; fi++) {
     var fp = filePlan[fi];
     wcUpdateGenOverlay(fi, filePlan.length, fp.name);
+    // Check if aborted
+    if (_wcGenAbortCtrl && _wcGenAbortCtrl.signal.aborted) break;
     try {
       var _nl2 = String.fromCharCode(10);
-      var content = await wcCallLLM(sysPreamble, fp.prompt + _nl2 + _nl2 + 'File to generate: ' + fp.name);
+      var content = await wcCallLLM(sysPreamble, fp.prompt + _nl2 + _nl2 + 'File to generate: ' + fp.name, _wcGenAbortCtrl ? _wcGenAbortCtrl.signal : null);
       // Strip markdown code fences if model added them anyway
       var _fence = String.fromCharCode(96,96,96);
       var wcLines = content.split(_nl2);
@@ -7765,11 +7815,14 @@ async function wcGenerate() {
       if (fi === 0) wcState.activeFile = 0;
       renderWebCraft(document.getElementById('content'));
     } catch(e) {
+      if (e && e.name === 'AbortError') break;
       wcState.generatedFiles.push({ name: fp.name, content: '// Error generating this file: ' + e.message, lang: fp.lang });
     }
   }
 
   wcState.running = false;
+  _wcGenAbortCtrl = null;
+  _wcOverlayMinimized = false;
 
   // Auto-save project to ~/.nha/webcraft/<projectName>/
   try {
@@ -7783,12 +7836,14 @@ async function wcGenerate() {
   renderWebCraft(document.getElementById('content'));
 }
 
-async function wcCallLLM(sys, user) {
-  var r = await fetch(API + '/api/studio/webcraft', {
+async function wcCallLLM(sys, user, signal) {
+  var fetchOpts = {
     method: 'POST',
     headers: {'Content-Type':'application/json'},
     body: JSON.stringify({system: sys, user: user, max_tokens: 4096})
-  });
+  };
+  if (signal) fetchOpts.signal = signal;
+  var r = await fetch(API + '/api/studio/webcraft', fetchOpts);
   if (!r.ok) throw new Error('LLM error ' + r.status);
   var d = await r.json();
   return (d && (d.text || d.content || d.result)) || '';