nothumanallowed 13.5.71 → 13.5.72

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nothumanallowed",
-  "version": "13.5.71",
+  "version": "13.5.72",
   "description": "NotHumanAllowed — 38 AI agents, 80 tools, Studio (visual agentic workflows). Email, calendar, browser automation, screen capture, canvas, cron/heartbeat, Alexandria E2E messaging, GitHub, Notion, Slack, voice chat, free AI (Liara), 28 languages. Zero-dependency CLI.",
   "type": "module",
   "bin": {

package/src/commands/ui.mjs

@@ -4278,6 +4278,32 @@ module.exports = { get, set, del, exists };
           fs.mkdirSync(path.join(sandboxDir, 'server', 'services'), { recursive: true });
           fs.writeFileSync(path.join(sandboxDir, 'server', 'services', 'cache.js'), cacheShim, 'utf8');
 
+          // Models shim — LLM often generates require('../models/User') etc. that don't exist
+          // Create a generic User model shim backed by the in-memory DB shim
+          const userModelShim = `
+// NHA WebCraft Sandbox — models/User shim (in-memory, no PostgreSQL)
+const db = require('../db');
+const bcrypt = require('bcryptjs');
+const crypto = require('crypto');
+const User = {
+  findById: async function(id) { var r = await db.query('SELECT * FROM users WHERE id=$1',[id]); return (r.rows||[])[0]||null; },
+  findByEmail: async function(email) { var r = await db.query('SELECT * FROM users WHERE email=$1',[email]); return (r.rows||[])[0]||null; },
+  create: async function(data) {
+    var hash = data.password ? await bcrypt.hash(data.password,12) : data.password_hash||'';
+    var token = crypto.randomBytes(32).toString('hex');
+    var r = await db.query('INSERT INTO users (name,email,password_hash,verification_token) VALUES ($1,$2,$3,$4) RETURNING *',[data.name||data.username||'',data.email,hash,token]);
+    return (r.rows||[])[0]||null;
+  },
+  update: async function(id, data) { var r = await db.query('UPDATE users SET verified=true WHERE id=$1 RETURNING *',[id]); return (r.rows||[])[0]||null; },
+  findByVerificationToken: async function(token) { var r = await db.query('SELECT * FROM users WHERE verification_token=$1',[token]); return (r.rows||[])[0]||null; },
+};
+module.exports = User;
+`;
+          fs.mkdirSync(path.join(sandboxDir, 'server', 'models'), { recursive: true });
+          if (!fs.existsSync(path.join(sandboxDir, 'server', 'models', 'User.js'))) {
+            fs.writeFileSync(path.join(sandboxDir, 'server', 'models', 'User.js'), userModelShim, 'utf8');
+          }
+
           // Validators shim — LLM often generates require('../utils/validators') with helpers that don't exist
           const validatorsShim = `
 // NHA WebCraft Sandbox — utils/validators shim
@@ -4347,6 +4373,10 @@ module.exports = { validateEmail, sanitizeText, validatePassword, validateUserna
             [/require\(['"]\.\.\/\.\.\/config['"]\)/g,                 "{env:process.env}"],
             [/require\(['"]\.\.\/config['"]\)/g,                       "{env:process.env}"],
             [/require\(['"]\.\/config['"]\)/g,                         "{env:process.env}"],
+            // models/* — redirect to shims in server/models/
+            [/require\(['"]\.\.\/models\/User['"]\)/g,     "require('../models/User')"],
+            [/require\(['"]\.\/models\/User['"]\)/g,       "require('./models/User')"],
+            [/require\(['"]\.\.\/models\/user['"]\)/g,     "require('../models/User')"],
             // utils/* — LLM generates helpers that don't exist; redirect to shim
             [/require\(['"]\.\.\/utils\/validators['"]\)/g,   "require('../utils/validators')"],
             [/require\(['"]\.\/utils\/validators['"]\)/g,     "require('./utils/validators')"],
@@ -4589,14 +4619,14 @@ module.exports = { validateEmail, sanitizeText, validatePassword, validateUserna
           return;
         }
 
-        // Rate-limit Liara: 3 per 5 minutes
+        // Rate-limit Liara: 6 per 5 minutes (autofix needs headroom for multi-crash startup sequences)
         const isLiara = !config.llm || !config.llm.apiKey || config.llm.provider === 'nha';
         if (isLiara) {
           if (!global._wcAgentCallLog) global._wcAgentCallLog = [];
           const fiveMinAgo = Date.now() - 5 * 60 * 1000;
           global._wcAgentCallLog = global._wcAgentCallLog.filter(t => t > fiveMinAgo);
-          if (global._wcAgentCallLog.length >= 3) {
-            sendJSON(res, 429, { error: 'Auto-fix rate limit: massimo 3 correzioni ogni 5 minuti con Liara. Usa una tua API key per correzioni illimitate.' });
+          if (global._wcAgentCallLog.length >= 6) {
+            sendJSON(res, 429, { error: 'Auto-fix rate limit: massimo 6 correzioni ogni 5 minuti con Liara. Usa una tua API key per correzioni illimitate.' });
             logRequest(method, pathname, 429, Date.now() - start);
             return;
           }

package/src/services/web-ui.mjs

@@ -6565,10 +6565,10 @@ function wcEsc(s){return s?String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').
 
 function renderWebCraft(el) {
   var fileTabsHtml = wcState.generatedFiles.length > 0
-    ? '<div style="display:flex;gap:0;overflow-x:auto;border-bottom:1px solid var(--border);margin-bottom:0;flex-shrink:0">' +
+    ? '<div id="wcFileTabsRow" style="display:flex;gap:0;overflow-x:auto;border-bottom:1px solid var(--border);margin-bottom:0;flex-shrink:0;scrollbar-width:none">' +
         wcState.generatedFiles.map(function(f,i){
           var active = i === wcState.activeFile;
-          return '<button onclick="wcSetFile('+i+')" style="padding:6px 14px;font-size:11px;font-family:var(--mono);font-weight:'+(active?'700':'400')+';background:'+(active?'var(--bg3)':'transparent')+';border:none;border-bottom:2px solid '+(active?'var(--green3)':'transparent')+';color:'+(active?'var(--green)':'var(--dim)')+';cursor:pointer;white-space:nowrap;flex-shrink:0">'+wcEsc(f.name)+'</button>';
+          return '<button id="wcTab'+i+'" onclick="wcSetFile('+i+')" style="padding:6px 14px;font-size:11px;font-family:var(--mono);font-weight:'+(active?'700':'400')+';background:'+(active?'var(--bg3)':'transparent')+';border:none;border-bottom:2px solid '+(active?'var(--green3)':'transparent')+';color:'+(active?'var(--green)':'var(--dim)')+';cursor:pointer;white-space:nowrap;flex-shrink:0">'+wcEsc(f.name)+'</button>';
         }).join('') +
       '</div>'
     : '';
@@ -7495,7 +7495,13 @@ function wcAddField() {
   wcState.authFields.push({name:'field'+wcState.authFields.length,label:'New field',type:'text',required:false});
   renderWebCraft(document.getElementById('content'));
 }
-function wcSetFile(i) { wcState.activeFile = i; renderWebCraft(document.getElementById('content')); }
+function wcSetFile(i) {
+  wcState.activeFile = i;
+  renderWebCraft(document.getElementById('content'));
+  // Scroll active tab into view after render
+  var tab = document.getElementById('wcTab' + i);
+  if (tab) tab.scrollIntoView({ behavior: 'smooth', block: 'nearest', inline: 'nearest' });
+}
 
 // ── WebCraft: Diff Viewer ─────────────────────────────────────────────────────
 function wcDiffLines(before, after) {