nothumanallowed 13.5.70 → 13.5.72

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nothumanallowed",
-  "version": "13.5.70",
+  "version": "13.5.72",
   "description": "NotHumanAllowed — 38 AI agents, 80 tools, Studio (visual agentic workflows). Email, calendar, browser automation, screen capture, canvas, cron/heartbeat, Alexandria E2E messaging, GitHub, Notion, Slack, voice chat, free AI (Liara), 28 languages. Zero-dependency CLI.",
   "type": "module",
   "bin": {

package/src/commands/ui.mjs

@@ -4086,7 +4086,11 @@ ${completedHeadings ? `## SECTIONS ALREADY WRITTEN (headings only):\n${completed
           'Connection': 'keep-alive',
           'Access-Control-Allow-Origin': '*',
         });
-        const sendLog = (msg) => res.write(`data: ${JSON.stringify({ type: 'log', msg })}\n\n`);
+        const _sbLogLines = [];
+        const sendLog = (msg) => {
+          _sbLogLines.push(msg);
+          res.write(`data: ${JSON.stringify({ type: 'log', msg })}\n\n`);
+        };
         const sendReady = (port, dir) => res.write(`data: ${JSON.stringify({ type: 'ready', port, dir })}\n\n`);
         const sendError = (msg) => res.write(`data: ${JSON.stringify({ type: 'error', msg })}\n\n`);
 
@@ -4274,6 +4278,32 @@ module.exports = { get, set, del, exists };
           fs.mkdirSync(path.join(sandboxDir, 'server', 'services'), { recursive: true });
           fs.writeFileSync(path.join(sandboxDir, 'server', 'services', 'cache.js'), cacheShim, 'utf8');
 
+          // Models shim — LLM often generates require('../models/User') etc. that don't exist
+          // Create a generic User model shim backed by the in-memory DB shim
+          const userModelShim = `
+// NHA WebCraft Sandbox — models/User shim (in-memory, no PostgreSQL)
+const db = require('../db');
+const bcrypt = require('bcryptjs');
+const crypto = require('crypto');
+const User = {
+  findById: async function(id) { var r = await db.query('SELECT * FROM users WHERE id=$1',[id]); return (r.rows||[])[0]||null; },
+  findByEmail: async function(email) { var r = await db.query('SELECT * FROM users WHERE email=$1',[email]); return (r.rows||[])[0]||null; },
+  create: async function(data) {
+    var hash = data.password ? await bcrypt.hash(data.password,12) : data.password_hash||'';
+    var token = crypto.randomBytes(32).toString('hex');
+    var r = await db.query('INSERT INTO users (name,email,password_hash,verification_token) VALUES ($1,$2,$3,$4) RETURNING *',[data.name||data.username||'',data.email,hash,token]);
+    return (r.rows||[])[0]||null;
+  },
+  update: async function(id, data) { var r = await db.query('UPDATE users SET verified=true WHERE id=$1 RETURNING *',[id]); return (r.rows||[])[0]||null; },
+  findByVerificationToken: async function(token) { var r = await db.query('SELECT * FROM users WHERE verification_token=$1',[token]); return (r.rows||[])[0]||null; },
+};
+module.exports = User;
+`;
+          fs.mkdirSync(path.join(sandboxDir, 'server', 'models'), { recursive: true });
+          if (!fs.existsSync(path.join(sandboxDir, 'server', 'models', 'User.js'))) {
+            fs.writeFileSync(path.join(sandboxDir, 'server', 'models', 'User.js'), userModelShim, 'utf8');
+          }
+
           // Validators shim — LLM often generates require('../utils/validators') with helpers that don't exist
           const validatorsShim = `
 // NHA WebCraft Sandbox — utils/validators shim
@@ -4310,6 +4340,19 @@ module.exports = { validateEmail, sanitizeText, validatePassword, validateUserna
             [/require\(['"]compression['"]\)/g,            "(()=>(r,s,n)=>n())"],
             [/require\(['"]express-validator['"]\)/g,      "{body:()=>({isEmail:()=>({normalizeEmail:()=>({run:async()=>{}})}),isLength:()=>({run:async()=>{}}),trim:()=>({escape:()=>({run:async()=>{}})}),notEmpty:()=>({run:async()=>{}})}),validationResult:()=>({isEmpty:()=>true,array:()=>[]})}"],
             [/require\(['"]validator['"]\)/g,              "{isEmail:(s)=>/^[^@\\s]+@[^@\\s]+[.][^@\\s]+$/.test(s),escape:(s)=>String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;'),trim:(s)=>String(s).trim(),isEmpty:(s)=>!s||!String(s).trim(),isLength:(s,o)=>{ var l=String(s).length; return (!o.min||l>=o.min)&&(!o.max||l<=o.max); }}"],
+            [/require\(['"]handlebars['"]\)/g,             "{compile:(t)=>(d)=>t.replace(/\\{\\{([^}]+)\\}\\}/g,(_,k)=>d[k.trim()]||''),registerHelper:()=>{},registerPartial:()=>{}}"],
+            [/require\(['"]express-handlebars['"]\)/g,     "{engine:()=>(p,o,cb)=>cb(null,'<html>'+JSON.stringify(o)+'</html>')}"],
+            [/require\(['"]hbs['"]\)/g,                    "{registerHelper:()=>{},registerPartial:()=>{}}"],
+            [/require\(['"]ejs['"]\)/g,                    "{render:(t,d)=>t.replace(/<%=([^%]+)%>/g,(_,k)=>d[k.trim()]||''),renderFile:(f,d,o,cb)=>{ if(typeof o==='function'){o(null,'');}else if(cb){cb(null,'');} }}"],
+            [/require\(['"]pug['"]\)/g,                    "{compile:()=>(d)=>'',renderFile:(f,d,cb)=>cb&&cb(null,'')}"],
+            [/require\(['"]nunjucks['"]\)/g,               "{configure:()=>({}),render:(t,d)=>JSON.stringify(d),renderString:(t,d)=>JSON.stringify(d)}"],
+            [/require\(['"]mustache['"]\)/g,               "{render:(t,d)=>t.replace(/\\{\\{([^}]+)\\}\\}/g,(_,k)=>d[k.trim()]||'')}"],
+            [/require\(['"]marked['"]\)/g,                 "{marked:(s)=>s,parse:(s)=>s}"],
+            [/require\(['"]highlight\.js['"]\)/g,          "{highlight:(c)=>({value:c}),highlightAuto:(c)=>({value:c})}"],
+            [/require\(['"]nodemailer['"]\)/g,             "{createTransport:()=>({sendMail:(o,cb)=>{ if(cb)cb(null,{messageId:'sandbox-'+Date.now()}); return Promise.resolve({messageId:'sandbox'}); }})}"],
+            [/require\(['"]stripe['"]\)/g,                 "(()=>({customers:{create:async()=>({id:'cus_sandbox'})},paymentIntents:{create:async()=>({id:'pi_sandbox',client_secret:'sandbox_secret'})}}))()"],
+            [/require\(['"]@sendgrid\/mail['"]\)/g,        "{setApiKey:()=>{},send:async()=>({statusCode:202})}"],
+            [/require\(['"]twilio['"]\)/g,                 "(()=>({messages:{create:async()=>({sid:'SM_sandbox'})}}))()"],
             [/require\(['"]cookie-parser['"]\)/g,          "(()=>(r,s,n)=>{r.cookies=r.cookies||{};n()})"],
             [/require\(['"]passport['"]\)/g,               "{initialize:()=>(r,s,n)=>n(),session:()=>(r,s,n)=>n(),authenticate:()=>(r,s,n)=>n&&n()}"],
             [/require\(['"]express-session['"]\)/g,        "(()=>(r,s,n)=>{r.session=r.session||{};n()})"],
@@ -4330,6 +4373,10 @@ module.exports = { validateEmail, sanitizeText, validatePassword, validateUserna
             [/require\(['"]\.\.\/\.\.\/config['"]\)/g,                 "{env:process.env}"],
             [/require\(['"]\.\.\/config['"]\)/g,                       "{env:process.env}"],
             [/require\(['"]\.\/config['"]\)/g,                         "{env:process.env}"],
+            // models/* — redirect to shims in server/models/
+            [/require\(['"]\.\.\/models\/User['"]\)/g,     "require('../models/User')"],
+            [/require\(['"]\.\/models\/User['"]\)/g,       "require('./models/User')"],
+            [/require\(['"]\.\.\/models\/user['"]\)/g,     "require('../models/User')"],
             // utils/* — LLM generates helpers that don't exist; redirect to shim
             [/require\(['"]\.\.\/utils\/validators['"]\)/g,   "require('../utils/validators')"],
             [/require\(['"]\.\/utils\/validators['"]\)/g,     "require('./utils/validators')"],
@@ -4493,8 +4540,44 @@ module.exports = { validateEmail, sanitizeText, validatePassword, validateUserna
           });
 
           sendLog(`✅ Sandbox pronta!`);
+
+          // Write sandbox log to skills/ so the agent can read it as context
+          try {
+            const _nl = '\n';
+            const logTs = new Date().toISOString().replace('T', ' ').slice(0, 19);
+            const logName = projName + '-' + logTs.replace(/[: ]/g, '-') + '.log';
+            const logsDir = path.join(sandboxDir, 'skills');
+            fs.mkdirSync(logsDir, { recursive: true });
+            // Keep only last 3 log files to avoid bloat
+            const existing = fs.readdirSync(logsDir).filter(f => f.endsWith('.log') && f.startsWith(projName + '-'));
+            existing.sort().slice(0, -2).forEach(f => { try { fs.unlinkSync(path.join(logsDir, f)); } catch(_) {} });
+            const logContent = '# Sandbox Log — ' + projName + _nl + 'Avviato: ' + logTs + _nl + 'Porta: ' + freePort + _nl + _nl + _sbLogLines.join(_nl);
+            fs.writeFileSync(path.join(logsDir, logName), logContent, 'utf8');
+            // Also update _index.json so the UI knows the type
+            const idxPath = path.join(logsDir, '_index.json');
+            let idx = {};
+            try { idx = JSON.parse(fs.readFileSync(idxPath, 'utf8')); } catch(_) {}
+            idx[logName] = 'log';
+            fs.writeFileSync(idxPath, JSON.stringify(idx), 'utf8');
+          } catch(_) {}
+
           sendReady(freePort, sandboxDir);
         } catch (e) {
+          // Write error log too
+          try {
+            const _nl = '\n';
+            const logTs = new Date().toISOString().replace('T', ' ').slice(0, 19);
+            const logName = projName + '-' + logTs.replace(/[: ]/g, '-') + '-ERROR.log';
+            const logsDir = path.join(sandboxDir, 'skills');
+            fs.mkdirSync(logsDir, { recursive: true });
+            const logContent = '# Sandbox Log — ' + projName + ' [ERRORE]' + _nl + 'Avviato: ' + logTs + _nl + _nl + _sbLogLines.join(_nl) + _nl + _nl + '❌ ERRORE: ' + e.message;
+            fs.writeFileSync(path.join(logsDir, logName), logContent, 'utf8');
+            const idxPath = path.join(logsDir, '_index.json');
+            let idx = {};
+            try { idx = JSON.parse(fs.readFileSync(idxPath, 'utf8')); } catch(_) {}
+            idx[logName] = 'log';
+            fs.writeFileSync(idxPath, JSON.stringify(idx), 'utf8');
+          } catch(_) {}
           sendError(e.message);
         }
         res.end();
@@ -4536,14 +4619,14 @@ module.exports = { validateEmail, sanitizeText, validatePassword, validateUserna
           return;
         }
 
-        // Rate-limit Liara: 3 per 5 minutes
+        // Rate-limit Liara: 6 per 5 minutes (autofix needs headroom for multi-crash startup sequences)
         const isLiara = !config.llm || !config.llm.apiKey || config.llm.provider === 'nha';
         if (isLiara) {
           if (!global._wcAgentCallLog) global._wcAgentCallLog = [];
           const fiveMinAgo = Date.now() - 5 * 60 * 1000;
           global._wcAgentCallLog = global._wcAgentCallLog.filter(t => t > fiveMinAgo);
-          if (global._wcAgentCallLog.length >= 3) {
-            sendJSON(res, 429, { error: 'Auto-fix rate limit: massimo 3 correzioni ogni 5 minuti con Liara. Usa una tua API key per correzioni illimitate.' });
+          if (global._wcAgentCallLog.length >= 6) {
+            sendJSON(res, 429, { error: 'Auto-fix rate limit: massimo 6 correzioni ogni 5 minuti con Liara. Usa una tua API key per correzioni illimitate.' });
             logRequest(method, pathname, 429, Date.now() - start);
             return;
           }
@@ -4573,7 +4656,7 @@ module.exports = { validateEmail, sanitizeText, validatePassword, validateUserna
             let typeIndex = {};
             if (fs.existsSync(indexPath)) { try { typeIndex = JSON.parse(fs.readFileSync(indexPath, 'utf8')); } catch(_) {} }
             const defaultType = (n) => n === 'memory.md' ? 'memory' : n === 'liara.md' ? 'provider' : 'skill';
-            const sections = { memory: [], provider: [], skill: [] };
+            const sections = { memory: [], provider: [], skill: [], log: [] };
             for (const fname of fs.readdirSync(skillsDir)) {
               if (!fname.endsWith('.md')) continue;
               try {
@@ -4588,6 +4671,7 @@ module.exports = { validateEmail, sanitizeText, validatePassword, validateUserna
             if (sections.memory.length) parts.push('MEMORIA PROGETTO:\n' + sections.memory.join('\n\n'));
             if (sections.provider.length) parts.push('ISTRUZIONI MODELLO AI:\n' + sections.provider.join('\n\n'));
             if (sections.skill.length) parts.push('SKILLS & PATTERN:\n' + sections.skill.join('\n\n'));
+            if (sections.log && sections.log.length) parts.push('LOG AVVIO SANDBOX (ultimo):\n' + sections.log[sections.log.length - 1]);
             if (parts.length) skillsContext = '\n' + parts.join('\n\n') + '\n';
           }
 

package/src/services/web-ui.mjs

@@ -6565,10 +6565,10 @@ function wcEsc(s){return s?String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').
 
 function renderWebCraft(el) {
   var fileTabsHtml = wcState.generatedFiles.length > 0
-    ? '<div style="display:flex;gap:0;overflow-x:auto;border-bottom:1px solid var(--border);margin-bottom:0;flex-shrink:0">' +
+    ? '<div id="wcFileTabsRow" style="display:flex;gap:0;overflow-x:auto;border-bottom:1px solid var(--border);margin-bottom:0;flex-shrink:0;scrollbar-width:none">' +
         wcState.generatedFiles.map(function(f,i){
           var active = i === wcState.activeFile;
-          return '<button onclick="wcSetFile('+i+')" style="padding:6px 14px;font-size:11px;font-family:var(--mono);font-weight:'+(active?'700':'400')+';background:'+(active?'var(--bg3)':'transparent')+';border:none;border-bottom:2px solid '+(active?'var(--green3)':'transparent')+';color:'+(active?'var(--green)':'var(--dim)')+';cursor:pointer;white-space:nowrap;flex-shrink:0">'+wcEsc(f.name)+'</button>';
+          return '<button id="wcTab'+i+'" onclick="wcSetFile('+i+')" style="padding:6px 14px;font-size:11px;font-family:var(--mono);font-weight:'+(active?'700':'400')+';background:'+(active?'var(--bg3)':'transparent')+';border:none;border-bottom:2px solid '+(active?'var(--green3)':'transparent')+';color:'+(active?'var(--green)':'var(--dim)')+';cursor:pointer;white-space:nowrap;flex-shrink:0">'+wcEsc(f.name)+'</button>';
         }).join('') +
       '</div>'
     : '';
@@ -6727,11 +6727,11 @@ function wcOpenSandbox() { if (wcState.sandbox.port) window.open('http://127.0.0
 // ── WebCraft Context Files (Skills / Memory / Provider) ───────────────────────
 
 function wcFileTypeIcon(type) {
-  return type === 'memory' ? '&#129504;' : type === 'provider' ? '&#129302;' : '&#128203;';
+  return type === 'memory' ? '&#129504;' : type === 'provider' ? '&#129302;' : type === 'log' ? '&#128196;' : '&#128203;';
 }
 function wcFileTypeBadge(type) {
-  var colors = { memory: '#7c5cbf', provider: '#2a7fff', skill: '#1a7a4a' };
-  var labels = { memory: 'memory', provider: 'provider', skill: 'skill' };
+  var colors = { memory: '#7c5cbf', provider: '#2a7fff', skill: '#1a7a4a', log: '#555' };
+  var labels = { memory: 'memory', provider: 'provider', skill: 'skill', log: 'log' };
   return '<span style="font-size:9px;padding:1px 5px;border-radius:3px;background:' + (colors[type]||'#444') + ';color:#fff;margin-left:4px;flex-shrink:0">' + (labels[type]||type) + '</span>';
 }
 
@@ -6756,14 +6756,16 @@ function wcSkillsPanelHtml() {
   // Can add new skill only (memory + provider are singletons already in defaults)
   var rows = wcSkills.map(function(s, si) {
     var isSingleton = s.type === 'memory' || s.type === 'provider';
+    var isLog = s.type === 'log';
     var isEmpty = !s.content || s.content.trim() === '';
     return '<div style="display:flex;align-items:center;gap:4px;padding:5px 0;border-bottom:1px solid var(--border)">' +
       '<span style="font-size:13px;flex-shrink:0">' + wcFileTypeIcon(s.type) + '</span>' +
-      '<span style="font-size:11px;color:var(--text);flex:1;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap">' + wcEsc(s.name) + '</span>' +
+      '<span style="font-size:11px;color:'+(isLog?'var(--dim)':'var(--text)')+';flex:1;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap" title="'+wcEsc(s.name)+'">' + wcEsc(s.name) + '</span>' +
       wcFileTypeBadge(s.type) +
-      (isEmpty ? '<span title="Vuoto" style="font-size:9px;color:#e09020;flex-shrink:0">&#9888;</span>' : '') +
-      '<button onclick="wcOpenSkill('+si+')" title="Modifica" style="background:none;border:none;color:var(--dim);cursor:pointer;font-size:12px;padding:2px 4px;flex-shrink:0">&#9998;</button>' +
-      (!isSingleton ? '<button onclick="wcClearSkill('+si+')" title="Svuota" style="background:none;border:none;color:var(--dim);cursor:pointer;font-size:11px;padding:2px 4px;flex-shrink:0">&#128465;</button>' : '') +
+      (!isLog && isEmpty ? '<span title="Vuoto" style="font-size:9px;color:#e09020;flex-shrink:0">&#9888;</span>' : '') +
+      '<button onclick="wcOpenSkill('+si+')" title="'+(isLog?'Visualizza log':'Modifica')+'" style="background:none;border:none;color:var(--dim);cursor:pointer;font-size:12px;padding:2px 4px;flex-shrink:0">'+(isLog?'&#128065;':'&#9998;')+'</button>' +
+      (!isSingleton && !isLog ? '<button onclick="wcClearSkill('+si+')" title="Svuota" style="background:none;border:none;color:var(--dim);cursor:pointer;font-size:11px;padding:2px 4px;flex-shrink:0">&#128465;</button>' : '') +
+      (isLog ? '<button onclick="wcDeleteSkill('+si+')" title="Elimina log" style="background:none;border:none;color:var(--dim);cursor:pointer;font-size:11px;padding:2px 4px;flex-shrink:0">&#128465;</button>' : '') +
     '</div>';
   }).join('');
   return '<div style="background:var(--bg2);border:1px solid var(--border);border-radius:10px;padding:14px">' +
@@ -7493,7 +7495,13 @@ function wcAddField() {
   wcState.authFields.push({name:'field'+wcState.authFields.length,label:'New field',type:'text',required:false});
   renderWebCraft(document.getElementById('content'));
 }
-function wcSetFile(i) { wcState.activeFile = i; renderWebCraft(document.getElementById('content')); }
+function wcSetFile(i) {
+  wcState.activeFile = i;
+  renderWebCraft(document.getElementById('content'));
+  // Scroll active tab into view after render
+  var tab = document.getElementById('wcTab' + i);
+  if (tab) tab.scrollIntoView({ behavior: 'smooth', block: 'nearest', inline: 'nearest' });
+}
 
 // ── WebCraft: Diff Viewer ─────────────────────────────────────────────────────
 function wcDiffLines(before, after) {