nothumanallowed 14.6.0 → 15.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nothumanallowed",
-  "version": "14.6.0",
+  "version": "15.0.0",
   "description": "NotHumanAllowed — 38 AI agents, 80 tools, Studio (visual agentic workflows). Email, calendar, browser automation, screen capture, canvas, cron/heartbeat, Alexandria E2E messaging, GitHub, Notion, Slack, voice chat, free AI (Liara), 28 languages. Zero-dependency CLI.",
   "type": "module",
   "bin": {

package/src/constants.mjs

@@ -5,7 +5,7 @@ import { fileURLToPath } from 'url';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
-export const VERSION = '14.6.0';
+export const VERSION = '15.0.0';
 export const BASE_URL = 'https://nothumanallowed.com/cli';
 export const API_BASE = 'https://nothumanallowed.com/api/v1';
 

package/src/server/routes/webcraft.mjs

@@ -1936,10 +1936,9 @@ export function register(router) {
     _tscChecked = true;
     // Our own bundled tsc (from package dependency)
     const __dir = path.dirname(fileURLToPath(import.meta.url));
-    const ownTsc = path.resolve(__dir, '../../node_modules/.bin/tsc');
     const candidates = [
-      ownTsc,
       path.resolve(__dir, '../../../node_modules/.bin/tsc'),
+      path.resolve(__dir, '../../../../node_modules/.bin/tsc'),
     ];
     // Also try global
     try {
@@ -1961,7 +1960,7 @@ export function register(router) {
 
     try {
       const { stdout, stderr } = await execAsync(
-        `"${tsc}" --noEmit --checkJs --allowJs --target es2020 --moduleResolution node --skipLibCheck --lib es2020,dom --strict false "${absFile}" 2>&1`,
+        `"${tsc}" --noEmit --checkJs --allowJs --target es2020 --moduleResolution bundler --skipLibCheck --ignoreConfig "${absFile}" 2>&1`,
         { cwd: projectDir, timeout: 10000 }
       );
       const output = stdout || stderr || '';
@@ -2701,6 +2700,16 @@ function _patchEntry(projectDir, entryFile, shimDir, port) {
     `  } catch(e) {}`,
     `  return _origEnd.apply(this, arguments);`,
     `};`,
+    `// Strip X-Frame-Options so sandbox iframe works`,
+    `const _origSetHeader = require('http').ServerResponse.prototype.setHeader;`,
+    `require('http').ServerResponse.prototype.setHeader = function(name, val) {`,
+    `  if (name.toLowerCase() === 'x-frame-options') return this;`,
+    `  if (name.toLowerCase() === 'content-security-policy' && typeof val === 'string' && val.includes('frame-ancestors')) {`,
+    `    val = val.replace(/frame-ancestors[^;]*(;|$)/gi, '');`,
+    `    if (!val.trim()) return this;`,
+    `  }`,
+    `  return _origSetHeader.call(this, name, val);`,
+    `};`,
     `require('${entryAbs}');`,
   ].join('\n');
   fs.writeFileSync(launcherPath, launcher, 'utf-8');