nothumanallowed 13.5.69 → 13.5.70

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nothumanallowed",
-  "version": "13.5.69",
+  "version": "13.5.70",
   "description": "NotHumanAllowed — 38 AI agents, 80 tools, Studio (visual agentic workflows). Email, calendar, browser automation, screen capture, canvas, cron/heartbeat, Alexandria E2E messaging, GitHub, Notion, Slack, voice chat, free AI (Liara), 28 languages. Zero-dependency CLI.",
   "type": "module",
   "bin": {

package/src/commands/ui.mjs

@@ -4274,6 +4274,21 @@ module.exports = { get, set, del, exists };
           fs.mkdirSync(path.join(sandboxDir, 'server', 'services'), { recursive: true });
           fs.writeFileSync(path.join(sandboxDir, 'server', 'services', 'cache.js'), cacheShim, 'utf8');
 
+          // Validators shim — LLM often generates require('../utils/validators') with helpers that don't exist
+          const validatorsShim = `
+// NHA WebCraft Sandbox — utils/validators shim
+function validateEmail(email) { return typeof email === 'string' && /^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$/.test(email.trim()); }
+function sanitizeText(str) { return typeof str === 'string' ? str.replace(/<[^>]*>/g, '').trim() : ''; }
+function validatePassword(pwd) { return typeof pwd === 'string' && pwd.length >= 8; }
+function validateUsername(u) { return typeof u === 'string' && u.length >= 2 && u.length <= 50; }
+function validatePhone(p) { return typeof p === 'string' && /^[+]?[\\d\\s\\-().]{7,20}$/.test(p.trim()); }
+module.exports = { validateEmail, sanitizeText, validatePassword, validateUsername, validatePhone };
+`;
+          fs.mkdirSync(path.join(sandboxDir, 'server', 'utils'), { recursive: true });
+          if (!fs.existsSync(path.join(sandboxDir, 'server', 'utils', 'validators.js'))) {
+            fs.writeFileSync(path.join(sandboxDir, 'server', 'utils', 'validators.js'), validatorsShim, 'utf8');
+          }
+
           // Patch all generated JS files: fix known wrong require() names
           // The LLM often uses 'bcrypt' instead of 'bcryptjs', 'pg' instead of nothing, etc.
           const requireFixes = [
@@ -4293,6 +4308,8 @@ module.exports = { get, set, del, exists };
             [/require\(['"]winston['"]\)/g,                "{createLogger:()=>({info:()=>{},error:()=>{},warn:()=>{}}),transports:{Console:function(){}},format:{combine:()=>{},timestamp:()=>{},json:()=>{}}}"],
             [/require\(['"]morgan['"]\)/g,                 "(()=>(r,s,n)=>n())"],
             [/require\(['"]compression['"]\)/g,            "(()=>(r,s,n)=>n())"],
+            [/require\(['"]express-validator['"]\)/g,      "{body:()=>({isEmail:()=>({normalizeEmail:()=>({run:async()=>{}})}),isLength:()=>({run:async()=>{}}),trim:()=>({escape:()=>({run:async()=>{}})}),notEmpty:()=>({run:async()=>{}})}),validationResult:()=>({isEmpty:()=>true,array:()=>[]})}"],
+            [/require\(['"]validator['"]\)/g,              "{isEmail:(s)=>/^[^@\\s]+@[^@\\s]+[.][^@\\s]+$/.test(s),escape:(s)=>String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;'),trim:(s)=>String(s).trim(),isEmpty:(s)=>!s||!String(s).trim(),isLength:(s,o)=>{ var l=String(s).length; return (!o.min||l>=o.min)&&(!o.max||l<=o.max); }}"],
             [/require\(['"]cookie-parser['"]\)/g,          "(()=>(r,s,n)=>{r.cookies=r.cookies||{};n()})"],
             [/require\(['"]passport['"]\)/g,               "{initialize:()=>(r,s,n)=>n(),session:()=>(r,s,n)=>n(),authenticate:()=>(r,s,n)=>n&&n()}"],
             [/require\(['"]express-session['"]\)/g,        "(()=>(r,s,n)=>{r.session=r.session||{};n()})"],
@@ -4313,6 +4330,14 @@ module.exports = { get, set, del, exists };
             [/require\(['"]\.\.\/\.\.\/config['"]\)/g,                 "{env:process.env}"],
             [/require\(['"]\.\.\/config['"]\)/g,                       "{env:process.env}"],
             [/require\(['"]\.\/config['"]\)/g,                         "{env:process.env}"],
+            // utils/* — LLM generates helpers that don't exist; redirect to shim
+            [/require\(['"]\.\.\/utils\/validators['"]\)/g,   "require('../utils/validators')"],
+            [/require\(['"]\.\/utils\/validators['"]\)/g,     "require('./utils/validators')"],
+            [/require\(['"]\.\.\/utils\/validation['"]\)/g,   "require('../utils/validators')"],
+            [/require\(['"]\.\.\/helpers\/validators['"]\)/g, "require('../utils/validators')"],
+            [/require\(['"]\.\.\/utils\/helpers['"]\)/g,      "{sanitize:(s)=>String(s).trim(),escape:(s)=>String(s).replace(/</g,'&lt;')}"],
+            [/require\(['"]\.\.\/utils\/logger['"]\)/g,       "{info:()=>{},error:()=>{},warn:()=>{},debug:()=>{}}"],
+            [/require\(['"]\.\.\/utils\/errors['"]\)/g,       "{AppError:class AppError extends Error{constructor(m,s){super(m);this.statusCode=s||500;}}}"],
             // rateLimiter: LLM sometimes creates a separate file instead of importing from security.js
             [/require\(['"]\.\.\/middleware\/rateLimiter['"]\)/g,      "require('../middleware/security')"],
             [/require\(['"]\.\/middleware\/rateLimiter['"]\)/g,        "require('./middleware/security')"],