nothumanallowed 13.5.68 → 13.5.70

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nothumanallowed",
-  "version": "13.5.68",
+  "version": "13.5.70",
   "description": "NotHumanAllowed — 38 AI agents, 80 tools, Studio (visual agentic workflows). Email, calendar, browser automation, screen capture, canvas, cron/heartbeat, Alexandria E2E messaging, GitHub, Notion, Slack, voice chat, free AI (Liara), 28 languages. Zero-dependency CLI.",
   "type": "module",
   "bin": {

package/src/commands/ui.mjs

@@ -4274,6 +4274,21 @@ module.exports = { get, set, del, exists };
           fs.mkdirSync(path.join(sandboxDir, 'server', 'services'), { recursive: true });
           fs.writeFileSync(path.join(sandboxDir, 'server', 'services', 'cache.js'), cacheShim, 'utf8');
 
+          // Validators shim — LLM often generates require('../utils/validators') with helpers that don't exist
+          const validatorsShim = `
+// NHA WebCraft Sandbox — utils/validators shim
+function validateEmail(email) { return typeof email === 'string' && /^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$/.test(email.trim()); }
+function sanitizeText(str) { return typeof str === 'string' ? str.replace(/<[^>]*>/g, '').trim() : ''; }
+function validatePassword(pwd) { return typeof pwd === 'string' && pwd.length >= 8; }
+function validateUsername(u) { return typeof u === 'string' && u.length >= 2 && u.length <= 50; }
+function validatePhone(p) { return typeof p === 'string' && /^[+]?[\\d\\s\\-().]{7,20}$/.test(p.trim()); }
+module.exports = { validateEmail, sanitizeText, validatePassword, validateUsername, validatePhone };
+`;
+          fs.mkdirSync(path.join(sandboxDir, 'server', 'utils'), { recursive: true });
+          if (!fs.existsSync(path.join(sandboxDir, 'server', 'utils', 'validators.js'))) {
+            fs.writeFileSync(path.join(sandboxDir, 'server', 'utils', 'validators.js'), validatorsShim, 'utf8');
+          }
+
           // Patch all generated JS files: fix known wrong require() names
           // The LLM often uses 'bcrypt' instead of 'bcryptjs', 'pg' instead of nothing, etc.
           const requireFixes = [
@@ -4293,6 +4308,8 @@ module.exports = { get, set, del, exists };
             [/require\(['"]winston['"]\)/g,                "{createLogger:()=>({info:()=>{},error:()=>{},warn:()=>{}}),transports:{Console:function(){}},format:{combine:()=>{},timestamp:()=>{},json:()=>{}}}"],
             [/require\(['"]morgan['"]\)/g,                 "(()=>(r,s,n)=>n())"],
             [/require\(['"]compression['"]\)/g,            "(()=>(r,s,n)=>n())"],
+            [/require\(['"]express-validator['"]\)/g,      "{body:()=>({isEmail:()=>({normalizeEmail:()=>({run:async()=>{}})}),isLength:()=>({run:async()=>{}}),trim:()=>({escape:()=>({run:async()=>{}})}),notEmpty:()=>({run:async()=>{}})}),validationResult:()=>({isEmpty:()=>true,array:()=>[]})}"],
+            [/require\(['"]validator['"]\)/g,              "{isEmail:(s)=>/^[^@\\s]+@[^@\\s]+[.][^@\\s]+$/.test(s),escape:(s)=>String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;'),trim:(s)=>String(s).trim(),isEmpty:(s)=>!s||!String(s).trim(),isLength:(s,o)=>{ var l=String(s).length; return (!o.min||l>=o.min)&&(!o.max||l<=o.max); }}"],
             [/require\(['"]cookie-parser['"]\)/g,          "(()=>(r,s,n)=>{r.cookies=r.cookies||{};n()})"],
             [/require\(['"]passport['"]\)/g,               "{initialize:()=>(r,s,n)=>n(),session:()=>(r,s,n)=>n(),authenticate:()=>(r,s,n)=>n&&n()}"],
             [/require\(['"]express-session['"]\)/g,        "(()=>(r,s,n)=>{r.session=r.session||{};n()})"],
@@ -4313,6 +4330,14 @@ module.exports = { get, set, del, exists };
             [/require\(['"]\.\.\/\.\.\/config['"]\)/g,                 "{env:process.env}"],
             [/require\(['"]\.\.\/config['"]\)/g,                       "{env:process.env}"],
             [/require\(['"]\.\/config['"]\)/g,                         "{env:process.env}"],
+            // utils/* — LLM generates helpers that don't exist; redirect to shim
+            [/require\(['"]\.\.\/utils\/validators['"]\)/g,   "require('../utils/validators')"],
+            [/require\(['"]\.\/utils\/validators['"]\)/g,     "require('./utils/validators')"],
+            [/require\(['"]\.\.\/utils\/validation['"]\)/g,   "require('../utils/validators')"],
+            [/require\(['"]\.\.\/helpers\/validators['"]\)/g, "require('../utils/validators')"],
+            [/require\(['"]\.\.\/utils\/helpers['"]\)/g,      "{sanitize:(s)=>String(s).trim(),escape:(s)=>String(s).replace(/</g,'&lt;')}"],
+            [/require\(['"]\.\.\/utils\/logger['"]\)/g,       "{info:()=>{},error:()=>{},warn:()=>{},debug:()=>{}}"],
+            [/require\(['"]\.\.\/utils\/errors['"]\)/g,       "{AppError:class AppError extends Error{constructor(m,s){super(m);this.statusCode=s||500;}}}"],
             // rateLimiter: LLM sometimes creates a separate file instead of importing from security.js
             [/require\(['"]\.\.\/middleware\/rateLimiter['"]\)/g,      "require('../middleware/security')"],
             [/require\(['"]\.\/middleware\/rateLimiter['"]\)/g,        "require('./middleware/security')"],
@@ -4321,11 +4346,12 @@ module.exports = { get, set, del, exists };
             [/require\(['"]\.\.\/middleware\/limiter['"]\)/g,          "require('../middleware/security')"],
             [/require\(['"]\.\/middleware\/limiter['"]\)/g,            "require('./middleware/security')"],
           ];
-          function patchJsFiles(dir) {
+          function patchJsFiles(dir, rootDir) {
             if (!fs.existsSync(dir)) return;
+            const _rootDir = rootDir || dir;
             for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
               const full = path.join(dir, entry.name);
-              if (entry.isDirectory()) { patchJsFiles(full); continue; }
+              if (entry.isDirectory()) { patchJsFiles(full, _rootDir); continue; }
               if (!entry.name.endsWith('.js')) continue;
               let src = fs.readFileSync(full, 'utf8');
               let changed = false;
@@ -4333,10 +4359,22 @@ module.exports = { get, set, del, exists };
                 const next = src.replace(pat, rep);
                 if (next !== src) { src = next; changed = true; }
               }
+              // Context-aware db path fix: if file is in a subdirectory of server/
+              // (e.g. routes/, middleware/, services/) and does require('./db'),
+              // correct to require('../db') since db.js lives in server/
+              const depth = path.relative(_rootDir, dir).split(path.sep).filter(Boolean).length;
+              if (depth > 0) {
+                const prefix = '../'.repeat(depth);
+                const next2 = src.replace(/require\(['"]\.\/db['"]\)/g, "require('" + prefix + "db')");
+                if (next2 !== src) { src = next2; changed = true; }
+                // Also fix ./models/* → ../models/*
+                const next3 = src.replace(/require\(['"]\.\/(models\/[^'"]+)['"]\)/g, "require('../$1')");
+                if (next3 !== src) { src = next3; changed = true; }
+              }
               if (changed) fs.writeFileSync(full, src, 'utf8');
             }
           }
-          patchJsFiles(path.join(sandboxDir, 'server'));
+          patchJsFiles(path.join(sandboxDir, 'server'), path.join(sandboxDir, 'server'));
           sendLog('🔧 Shim iniettati: DB (in-memory), Sentinel WAF, Cache — require() patchati');
 
           // Patch package.json to remove pg, add only what's needed