nothumanallowed 14.5.4 → 14.5.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nothumanallowed",
-  "version": "14.5.4",
+  "version": "14.5.6",
   "description": "NotHumanAllowed — 38 AI agents, 80 tools, Studio (visual agentic workflows). Email, calendar, browser automation, screen capture, canvas, cron/heartbeat, Alexandria E2E messaging, GitHub, Notion, Slack, voice chat, free AI (Liara), 28 languages. Zero-dependency CLI.",
   "type": "module",
   "bin": {
@@ -59,6 +59,8 @@
     "prebuild": "cd ../nha-ui && pnpm build"
   },
   "dependencies": {
+    "acorn": "^8.16.0",
+    "acorn-jsx": "^5.3.2",
     "imapflow": "^1.3.3",
     "mailparser": "^3.9.8",
     "ws": "^8.18.0"

package/src/constants.mjs

@@ -5,7 +5,7 @@ import { fileURLToPath } from 'url';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
-export const VERSION = '14.5.4';
+export const VERSION = '14.5.6';
 export const BASE_URL = 'https://nothumanallowed.com/cli';
 export const API_BASE = 'https://nothumanallowed.com/api/v1';
 

package/src/server/routes/webcraft.mjs

@@ -21,6 +21,8 @@ import { sendJSON, sendError, parseBody, sendSSE } from '../index.mjs';
 import { loadConfig }   from '../../config.mjs';
 import { callLLM, callLLMStream, fixQwen3BPE } from '../../services/llm.mjs';
 import { NHA_DIR } from '../../constants.mjs';
+import * as acorn from 'acorn';
+import acornJsx from 'acorn-jsx';
 
 const execAsync = promisify(exec);
 
@@ -42,7 +44,10 @@ class SandboxManager {
   }
 
   isRunning() {
-    return this._sandbox !== null && this._sandbox.proc && !this._sandbox.proc.killed;
+    if (!this._sandbox || !this._sandbox.proc) return false;
+    if (this._sandbox.proc.killed) { this._sandbox = null; return false; }
+    // Verify the process is actually alive (not zombie)
+    try { process.kill(this._sandbox.proc.pid, 0); return true; } catch { this._sandbox = null; return false; }
   }
 
   status() {
@@ -55,17 +60,43 @@ class SandboxManager {
   get port() { return this.isRunning() ? this._sandbox.port : null; }
 
   async stop() {
-    if (!this.isRunning()) return;
-    const { proc } = this._sandbox;
+    if (!this._sandbox) return;
+    const { proc, port } = this._sandbox;
     this._sandbox = null;
+
+    // 1. Kill the entire process group (parent + all children)
     try {
-      proc.kill('SIGTERM');
-      // Give it a grace period then SIGKILL
-      await new Promise((resolve) => {
-        const t = setTimeout(() => { try { proc.kill('SIGKILL'); } catch {} resolve(); }, 4000);
-        proc.once('exit', () => { clearTimeout(t); resolve(); });
-      });
+      if (proc.pid) {
+        // Kill the process group — negative PID kills all processes in the group
+        try { process.kill(-proc.pid, 'SIGTERM'); } catch {}
+        // Grace period, then SIGKILL the group
+        await new Promise((resolve) => {
+          const t = setTimeout(() => {
+            try { process.kill(-proc.pid, 'SIGKILL'); } catch {}
+            try { proc.kill('SIGKILL'); } catch {}
+            resolve();
+          }, 1500);
+          proc.once('exit', () => { clearTimeout(t); resolve(); });
+        });
+      } else {
+        try { proc.kill('SIGKILL'); } catch {}
+      }
     } catch {}
+
+    // 2. Force-kill any orphan processes still holding the port
+    if (port) {
+      try {
+        if (process.platform === 'win32') {
+          await execAsync(`for /f "tokens=5" %a in ('netstat -ano ^| findstr :${port} ^| findstr LISTENING') do taskkill /F /PID %a`, { timeout: 3000 });
+        } else {
+          const { stdout } = await execAsync(`lsof -ti:${port} 2>/dev/null || true`, { timeout: 2000 });
+          const pids = stdout.trim().split(/\s+/).filter(Boolean);
+          for (const pid of pids) { try { process.kill(parseInt(pid), 'SIGKILL'); } catch {} }
+        }
+      } catch {}
+      // Wait for OS to release the port
+      await new Promise((r) => setTimeout(r, 500));
+    }
   }
 
   /**
@@ -155,7 +186,7 @@ class SandboxManager {
         NODE_ENV: 'development',
         NHA_SANDBOX: '1',
       },
-      detached: false,
+      detached: true,
       stdio: ['ignore', 'pipe', 'pipe'],
     });
 
@@ -947,7 +978,7 @@ RULES:
               const proc = spawn('node', [patchedEntry], {
                 cwd: projectDir,
                 env: { ...process.env, PORT: String(port), NODE_ENV: 'development', NHA_SANDBOX: '1' },
-                detached: false, stdio: ['ignore', 'pipe', 'pipe'],
+                detached: true, stdio: ['ignore', 'pipe', 'pipe'],
               });
               sandbox._sandbox = { proc, port, projectName, startedAt: new Date(), healthy: false };
               let sandboxStderr = '';
@@ -1089,7 +1120,7 @@ RULES:
           const proc = spawn('node', [patchedEntry], {
             cwd: projectDir,
             env: { ...process.env, PORT: String(port), NODE_ENV: 'development', NHA_SANDBOX: '1' },
-            detached: false,
+            detached: true,
             stdio: ['ignore', 'pipe', 'pipe'],
           });
           sandbox._sandbox = { proc, port, projectName, startedAt: new Date(), healthy: false };
@@ -1889,6 +1920,386 @@ export function register(router) {
   });
 
   // ── Diagnostics (lint) — returns errors/warnings for a file ───────────────
+  // ── Advanced Linter — AST-based diagnostics (acorn + scope analysis) ─────────
+
+  const JsxParser = acorn.Parser.extend(acornJsx());
+  const JS_BUILTINS = new Set([
+    'undefined','NaN','Infinity','globalThis','eval','isFinite','isNaN','parseFloat','parseInt',
+    'decodeURI','decodeURIComponent','encodeURI','encodeURIComponent',
+    'Array','ArrayBuffer','BigInt','BigInt64Array','BigUint64Array','Boolean','DataView','Date',
+    'Error','EvalError','FinalizationRegistry','Float32Array','Float64Array','Function',
+    'Int8Array','Int16Array','Int32Array','JSON','Map','Math','Number','Object','Promise',
+    'Proxy','RangeError','ReferenceError','Reflect','RegExp','Set','SharedArrayBuffer',
+    'String','Symbol','SyntaxError','TypeError','URIError','Uint8Array','Uint8ClampedArray',
+    'Uint16Array','Uint32Array','WeakMap','WeakRef','WeakSet',
+    'console','setTimeout','setInterval','clearTimeout','clearInterval','queueMicrotask',
+    'atob','btoa','fetch','structuredClone','performance','crypto','navigator','location',
+    'window','document','self','global','process','require','module','exports','__dirname','__filename',
+    'Buffer','URL','URLSearchParams','TextEncoder','TextDecoder','AbortController','AbortSignal',
+    'Event','EventTarget','CustomEvent','FormData','Headers','Request','Response',
+    'ReadableStream','WritableStream','TransformStream','Blob','File','FileReader',
+    'WebSocket','Worker','SharedWorker','BroadcastChannel','MessageChannel','MessagePort',
+    'Intl','alert','confirm','prompt','requestAnimationFrame','cancelAnimationFrame',
+    'MutationObserver','ResizeObserver','IntersectionObserver','PerformanceObserver',
+    'HTMLElement','Element','Node','NodeList','DocumentFragment',
+    'localStorage','sessionStorage','history','screen','CSS','CSSStyleSheet',
+    'XMLHttpRequest','Image','Audio','Video','MediaSource','SourceBuffer',
+    'Map','Set','WeakMap','WeakSet','Proxy','Reflect',
+    'arguments','this','super','import','export',
+  ]);
+  const REACT_GLOBALS = new Set([
+    'React','useState','useEffect','useRef','useCallback','useMemo','useContext',
+    'useReducer','useLayoutEffect','useImperativeHandle','useDebugValue','useTransition',
+    'useDeferredValue','useId','useSyncExternalStore','useInsertionEffect',
+    'createContext','createRef','forwardRef','lazy','memo','startTransition',
+    'Component','PureComponent','Fragment','StrictMode','Suspense','Profiler',
+    'createElement','cloneElement','isValidElement','Children',
+    'jsx','jsxs','jsxDEV',
+  ]);
+  const NODE_MODULES = new Set([
+    'fs','path','os','http','https','url','util','stream','events','crypto','child_process',
+    'net','dgram','dns','tls','zlib','readline','cluster','worker_threads','perf_hooks',
+    'assert','buffer','querystring','string_decoder','timers','v8','vm','inspector',
+  ]);
+
+  function lintJS(content, relPath, projectName) {
+    const diagnostics = [];
+    const ext = relPath.split('.').pop()?.toLowerCase();
+    const isJsx = ext === 'jsx' || ext === 'tsx';
+
+    // 1. Parse with acorn (real AST)
+    let ast;
+    try {
+      ast = JsxParser.parse(content, {
+        ecmaVersion: 'latest',
+        sourceType: 'module',
+        locations: true,
+        allowImportExportEverywhere: true,
+        allowReturnOutsideFunction: true,
+        allowHashBang: true,
+      });
+    } catch (e) {
+      diagnostics.push({
+        from: { line: e.loc?.line || 1, col: e.loc?.column || 0 },
+        severity: 'error',
+        message: e.message.replace(/\(\d+:\d+\)$/, '').trim(),
+      });
+      return diagnostics;
+    }
+
+    // 2. Scope analysis — collect declarations and references
+    const declared = new Set();
+    const imported = new Set();
+    const importSources = [];
+    const references = []; // { name, loc }
+    const exportedNames = new Set();
+
+    function walkNode(node, scope) {
+      if (!node || typeof node !== 'object') return;
+      if (Array.isArray(node)) { node.forEach(n => walkNode(n, scope)); return; }
+      if (!node.type) return;
+
+      const localScope = new Set(scope);
+
+      switch (node.type) {
+        case 'VariableDeclaration':
+          for (const decl of node.declarations) {
+            collectPattern(decl.id, localScope);
+            if (decl.init) walkNode(decl.init, localScope);
+          }
+          // Walk rest of body with the declared vars
+          return;
+
+        case 'FunctionDeclaration':
+          if (node.id) localScope.add(node.id.name);
+          declared.add(node.id?.name);
+          const fnScope = new Set(localScope);
+          for (const p of node.params) collectPattern(p, fnScope);
+          walkNode(node.body, fnScope);
+          return;
+
+        case 'FunctionExpression':
+        case 'ArrowFunctionExpression': {
+          const arrowScope = new Set(localScope);
+          if (node.id) arrowScope.add(node.id.name);
+          for (const p of node.params) collectPattern(p, arrowScope);
+          walkNode(node.body, arrowScope);
+          return;
+        }
+
+        case 'ClassDeclaration':
+        case 'ClassExpression':
+          if (node.id) { localScope.add(node.id.name); declared.add(node.id.name); }
+          if (node.superClass) walkNode(node.superClass, localScope);
+          walkNode(node.body, localScope);
+          return;
+
+        case 'ImportDeclaration':
+          for (const spec of node.specifiers) {
+            imported.add(spec.local.name);
+            localScope.add(spec.local.name);
+          }
+          importSources.push({ source: node.source.value, loc: node.loc });
+          return;
+
+        case 'ExportNamedDeclaration':
+          if (node.declaration) walkNode(node.declaration, localScope);
+          if (node.specifiers) for (const s of node.specifiers) exportedNames.add(s.exported.name || s.exported.value);
+          return;
+
+        case 'ExportDefaultDeclaration':
+          walkNode(node.declaration, localScope);
+          return;
+
+        case 'Identifier':
+          if (!localScope.has(node.name) && !declared.has(node.name) && !imported.has(node.name)) {
+            references.push({ name: node.name, loc: node.loc });
+          }
+          return;
+
+        case 'MemberExpression':
+          walkNode(node.object, localScope);
+          // Don't walk computed property as reference
+          if (node.computed) walkNode(node.property, localScope);
+          return;
+
+        case 'Property':
+        case 'MethodDefinition':
+          // Don't treat keys as references
+          if (node.computed) walkNode(node.key, localScope);
+          walkNode(node.value, localScope);
+          return;
+
+        case 'CatchClause':
+          const catchScope = new Set(localScope);
+          if (node.param) collectPattern(node.param, catchScope);
+          walkNode(node.body, catchScope);
+          return;
+
+        case 'ForInStatement':
+        case 'ForOfStatement': {
+          const forScope = new Set(localScope);
+          if (node.left.type === 'VariableDeclaration') {
+            for (const d of node.left.declarations) collectPattern(d.id, forScope);
+          } else { walkNode(node.left, forScope); }
+          walkNode(node.right, forScope);
+          walkNode(node.body, forScope);
+          return;
+        }
+
+        case 'ForStatement': {
+          const forScope2 = new Set(localScope);
+          if (node.init?.type === 'VariableDeclaration') {
+            for (const d of node.init.declarations) collectPattern(d.id, forScope2);
+          } else if (node.init) { walkNode(node.init, forScope2); }
+          if (node.test) walkNode(node.test, forScope2);
+          if (node.update) walkNode(node.update, forScope2);
+          walkNode(node.body, forScope2);
+          return;
+        }
+
+        case 'BlockStatement':
+        case 'Program': {
+          const blockScope = new Set(localScope);
+          // Pre-scan for hoisted declarations
+          if (node.body) {
+            for (const stmt of node.body) {
+              if (stmt.type === 'FunctionDeclaration' && stmt.id) blockScope.add(stmt.id.name);
+              if (stmt.type === 'VariableDeclaration') {
+                for (const d of stmt.declarations) collectPattern(d.id, blockScope);
+              }
+              if (stmt.type === 'ClassDeclaration' && stmt.id) blockScope.add(stmt.id.name);
+              if (stmt.type === 'ImportDeclaration') {
+                for (const s of stmt.specifiers) { blockScope.add(s.local.name); imported.add(s.local.name); }
+              }
+            }
+          }
+          if (node.body) for (const stmt of node.body) walkNode(stmt, blockScope);
+          return;
+        }
+
+        case 'LabeledStatement':
+          walkNode(node.body, localScope);
+          return;
+
+        case 'JSXIdentifier':
+          // JSX component names (capitalized) are references
+          if (/^[A-Z]/.test(node.name) && !localScope.has(node.name) && !declared.has(node.name) && !imported.has(node.name)) {
+            references.push({ name: node.name, loc: node.loc });
+          }
+          return;
+
+        case 'JSXMemberExpression':
+          walkNode(node.object, localScope);
+          return;
+      }
+
+      // Generic walk for other node types
+      for (const key of Object.keys(node)) {
+        if (key === 'loc' || key === 'start' || key === 'end' || key === 'type' || key === 'raw' || key === 'value' || key === 'name' || key === 'operator' || key === 'prefix' || key === 'sourceType') continue;
+        const val = node[key];
+        if (val && typeof val === 'object') walkNode(val, localScope);
+      }
+    }
+
+    function collectPattern(pattern, scope) {
+      if (!pattern) return;
+      if (pattern.type === 'Identifier') { scope.add(pattern.name); declared.add(pattern.name); }
+      else if (pattern.type === 'ObjectPattern') { for (const p of pattern.properties) collectPattern(p.value || p.argument, scope); }
+      else if (pattern.type === 'ArrayPattern') { for (const e of pattern.elements) if (e) collectPattern(e, scope); }
+      else if (pattern.type === 'RestElement') collectPattern(pattern.argument, scope);
+      else if (pattern.type === 'AssignmentPattern') collectPattern(pattern.left, scope);
+    }
+
+    walkNode(ast, new Set());
+
+    // 3. Report undefined references (excluding builtins and React globals)
+    const allKnown = new Set([...declared, ...imported, ...JS_BUILTINS]);
+    if (isJsx || content.includes('from \'react\'') || content.includes('from "react"')) {
+      for (const g of REACT_GLOBALS) allKnown.add(g);
+    }
+    for (const ref of references) {
+      if (allKnown.has(ref.name)) continue;
+      // Skip single-letter vars (often from minified/short code)
+      if (ref.name.length === 1) continue;
+      // Skip common DOM event handler names
+      if (/^on[A-Z]/.test(ref.name)) continue;
+      diagnostics.push({
+        from: { line: ref.loc.start.line, col: ref.loc.start.column },
+        severity: 'warning',
+        message: `'${ref.name}' is not defined`,
+      });
+    }
+
+    // 4. Check import sources — verify local files exist
+    for (const imp of importSources) {
+      const src = imp.source;
+      if (src.startsWith('.') || src.startsWith('/')) {
+        const dir = path.dirname(relPath);
+        const candidates = [
+          path.join(dir, src),
+          path.join(dir, src + '.js'),
+          path.join(dir, src + '.mjs'),
+          path.join(dir, src + '.jsx'),
+          path.join(dir, src + '/index.js'),
+          path.join(dir, src + '/index.mjs'),
+        ].map(p => p.replace(/\\/g, '/'));
+        const found = candidates.some(c => ProjectStore.readFile(projectName, c) !== null);
+        if (!found) {
+          diagnostics.push({
+            from: { line: imp.loc.start.line, col: imp.loc.start.column },
+            severity: 'error',
+            message: `Cannot resolve import '${src}'`,
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  }
+
+  function lintCSS(content) {
+    const diagnostics = [];
+    const lines = content.split('\n');
+
+    // Brace balance per-line tracking
+    let depth = 0;
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      for (const ch of line) {
+        if (ch === '{') depth++;
+        if (ch === '}') depth--;
+      }
+      if (depth < 0) {
+        diagnostics.push({ from: { line: i + 1, col: 0 }, severity: 'error', message: 'Unexpected closing brace }' });
+        depth = 0;
+      }
+    }
+    if (depth > 0) {
+      diagnostics.push({ from: { line: lines.length, col: 0 }, severity: 'error', message: `${depth} unclosed brace(s) {` });
+    }
+
+    // Check for common CSS errors
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i].trim();
+      // Empty property value
+      if (/^[a-z-]+:\s*;/i.test(line)) {
+        diagnostics.push({ from: { line: i + 1, col: 0 }, severity: 'warning', message: 'Empty property value' });
+      }
+      // Duplicate semicolons
+      if (/;;/.test(line) && !line.startsWith('//') && !line.startsWith('/*')) {
+        diagnostics.push({ from: { line: i + 1, col: line.indexOf(';;') }, severity: 'warning', message: 'Duplicate semicolon' });
+      }
+      // Missing semicolon (property line without ; that isn't a selector/comment/brace)
+      if (/^[a-z-]+\s*:/.test(line) && !line.endsWith(';') && !line.endsWith('{') && !line.endsWith('}') && !line.endsWith(',') && !line.startsWith('//') && !line.startsWith('/*') && !line.startsWith('*')) {
+        diagnostics.push({ from: { line: i + 1, col: line.length }, severity: 'warning', message: 'Missing semicolon' });
+      }
+    }
+
+    return diagnostics;
+  }
+
+  function lintHTML(content, relPath, projectName) {
+    const diagnostics = [];
+    const lines = content.split('\n');
+
+    // Tag balance check
+    const voidTags = new Set(['area','base','br','col','embed','hr','img','input','link','meta','param','source','track','wbr']);
+    const tagStack = [];
+    const tagRegex = /<\/?([a-z][a-z0-9]*)\b[^>]*\/?>/gi;
+    let match;
+    while ((match = tagRegex.exec(content)) !== null) {
+      const full = match[0];
+      const tagName = match[1].toLowerCase();
+      if (voidTags.has(tagName) || full.endsWith('/>')) continue;
+      const lineNum = content.slice(0, match.index).split('\n').length;
+
+      if (full.startsWith('</')) {
+        // Closing tag
+        if (tagStack.length === 0) {
+          diagnostics.push({ from: { line: lineNum, col: 0 }, severity: 'error', message: `Unexpected closing tag </${tagName}>` });
+        } else {
+          const last = tagStack[tagStack.length - 1];
+          if (last.name === tagName) {
+            tagStack.pop();
+          } else {
+            diagnostics.push({ from: { line: lineNum, col: 0 }, severity: 'error', message: `Mismatched tag: expected </${last.name}> but found </${tagName}>` });
+          }
+        }
+      } else {
+        tagStack.push({ name: tagName, line: lineNum });
+      }
+    }
+    // Report unclosed tags (max 5)
+    for (const unclosed of tagStack.slice(-5)) {
+      diagnostics.push({ from: { line: unclosed.line, col: 0 }, severity: 'warning', message: `Unclosed tag <${unclosed.name}>` });
+    }
+
+    // Check src/href references to local files
+    const refRegex = /(?:src|href)=["']([^"']*?\.(?:js|css|mjs|png|jpg|jpeg|gif|svg|ico|webp|woff2?|ttf|eot))["']/gi;
+    let refMatch;
+    while ((refMatch = refRegex.exec(content)) !== null) {
+      const ref = refMatch[1];
+      if (ref.startsWith('http') || ref.startsWith('//') || ref.startsWith('data:') || ref.startsWith('#') || ref.startsWith('mailto:')) continue;
+      const htmlDir = path.dirname(relPath);
+      const refPath = ref.startsWith('/') ? ref.slice(1) : path.join(htmlDir, ref).replace(/\\/g, '/');
+      const publicRef = refPath.startsWith('public/') ? refPath : `public/${refPath}`;
+      const fileExists = ProjectStore.readFile(projectName, refPath) !== null
+        || ProjectStore.readFile(projectName, publicRef) !== null
+        || ProjectStore.readFile(projectName, ref) !== null;
+      if (!fileExists) {
+        const lineNum = content.slice(0, refMatch.index).split('\n').length;
+        diagnostics.push({
+          from: { line: lineNum, col: 0 },
+          severity: 'error',
+          message: `Referenced file not found: ${ref}`,
+        });
+      }
+    }
+
+    return diagnostics;
+  }
+
   router.post('/api/studio/webcraft/lint', async (req, res) => {
     try {
       const { projectName, path: relPath } = await parseBody(req);
@@ -1896,76 +2307,36 @@ export function register(router) {
       const content = ProjectStore.readFile(projectName, relPath);
       if (content === null) return sendJSON(res, 200, { diagnostics: [] });
 
-      const diagnostics = [];
-      const ext = relPath.split('.').pop()?.toLowerCase();
+      const ext = (relPath.split('.').pop() || '').toLowerCase();
+      let diagnostics = [];
 
-      if (ext === 'js' || ext === 'mjs' || ext === 'jsx') {
-        try { new Function(content); } catch (e) {
-          const match = e.message.match(/^(.*?)$/m);
-          const lineMatch = e.message.match(/:(\d+):(\d+)/);
-          diagnostics.push({
-            from: lineMatch ? { line: parseInt(lineMatch[1]), col: parseInt(lineMatch[2]) } : { line: 1, col: 0 },
-            severity: 'error',
-            message: match?.[1] || e.message,
-          });
-        }
+      // JavaScript / JSX — full AST analysis
+      if (['js', 'mjs', 'jsx', 'cjs'].includes(ext)) {
+        diagnostics = lintJS(content, relPath, projectName);
       }
 
+      // JSON — parse errors with precise location
       if (ext === 'json') {
         try { JSON.parse(content); } catch (e) {
-          const posMatch = e.message.match(/position (\d+)/);
+          const posMatch = e.message.match(/position (\d+)/i);
           const pos = posMatch ? parseInt(posMatch[1]) : 0;
-          const lines = content.slice(0, pos).split('\n');
+          const before = content.slice(0, pos).split('\n');
           diagnostics.push({
-            from: { line: lines.length, col: (lines[lines.length - 1] || '').length },
+            from: { line: before.length, col: (before[before.length - 1] || '').length },
             severity: 'error',
             message: e.message,
           });
         }
       }
 
+      // CSS — brace balance + property validation
       if (ext === 'css') {
-        const opens = (content.match(/\{/g) || []).length;
-        const closes = (content.match(/\}/g) || []).length;
-        if (opens !== closes) {
-          diagnostics.push({
-            from: { line: content.split('\n').length, col: 0 },
-            severity: 'warning',
-            message: `Unbalanced braces: ${opens} open, ${closes} close`,
-          });
-        }
+        diagnostics = lintCSS(content);
       }
 
+      // HTML/HTM — tag balance + reference validation
       if (ext === 'html' || ext === 'htm') {
-        if (!content.includes('</html>')) {
-          diagnostics.push({
-            from: { line: content.split('\n').length, col: 0 },
-            severity: 'warning',
-            message: 'Missing </html> closing tag',
-          });
-        }
-        // Check references to local files
-        const refRegex = /(?:src|href)=["']([^"']*?\.(?:js|css|mjs))["']/gi;
-        let refMatch;
-        const lines = content.split('\n');
-        while ((refMatch = refRegex.exec(content)) !== null) {
-          const ref = refMatch[1];
-          if (ref.startsWith('http') || ref.startsWith('//') || ref.startsWith('data:')) continue;
-          const htmlDir = path.dirname(relPath);
-          const refPath = ref.startsWith('/') ? ref.slice(1) : path.join(htmlDir, ref).replace(/\\/g, '/');
-          const publicRef = refPath.startsWith('public/') ? refPath : `public/${refPath}`;
-          const fileExists = ProjectStore.readFile(projectName, refPath) !== null
-            || ProjectStore.readFile(projectName, publicRef) !== null
-            || ProjectStore.readFile(projectName, ref) !== null;
-          if (!fileExists) {
-            const lineNum = content.slice(0, refMatch.index).split('\n').length;
-            diagnostics.push({
-              from: { line: lineNum, col: 0 },
-              severity: 'error',
-              message: `Referenced file not found: ${ref}`,
-            });
-          }
-        }
+        diagnostics = lintHTML(content, relPath, projectName);
       }
 
       sendJSON(res, 200, { diagnostics });
@@ -2006,6 +2377,14 @@ export function register(router) {
     } catch (e) { sendError(res, 500, e.message); }
   });
 
+  // ── Sandbox stop (beacon — for beforeunload) ───────────────────────────────
+  router.post('/api/studio/webcraft/sandbox/stop-beacon', async (_req, res) => {
+    try {
+      await sandbox.stop();
+      sendJSON(res, 200, { ok: true });
+    } catch (e) { sendError(res, 500, e.message); }
+  });
+
   // ── Sandbox status ────────────────────────────────────────────────────────
   router.get('/api/studio/webcraft/sandbox/status', (_req, res) => {
     sendJSON(res, 200, sandbox.status());