nothumanallowed 15.1.14 → 15.1.17

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nothumanallowed",
-  "version": "15.1.14",
+  "version": "15.1.17",
   "description": "NotHumanAllowed — 38 AI agents, 80 tools, Studio (visual agentic workflows). Email, calendar, browser automation, screen capture, canvas, cron/heartbeat, Alexandria E2E messaging, GitHub, Notion, Slack, voice chat, free AI (Liara), 28 languages. Zero-dependency CLI.",
   "type": "module",
   "bin": {

package/src/cli.mjs

@@ -55,12 +55,14 @@ export async function main(argv) {
     // npm version check (non-blocking). The one-liner uses --prefer-online to
     // bypass npm's metadata cache, which is the #1 reason `npm install -g`
     // appears to "do nothing" — it had stale "latest" in the local cache.
+    // Every command separated by `&&` so users can copy-paste the whole line.
     checkNpmVersion().then(result => {
       if (result?.updateAvailable) {
         console.log('');
         warn(`New NHA version available: ${result.current} → ${result.latest}`);
         info(`Run "nha update" (recommended — auto-installs npm + agents)`);
-        info(`Or manually: npm cache clean --force && npm install -g nothumanallowed@${result.latest} --prefer-online`);
+        info(`Or copy-paste this ENTIRE line (note: --prefer-online, not --pref-online):`);
+        info(`  npm cache clean --force && npm install -g nothumanallowed@${result.latest} --prefer-online && hash -r && nha version`);
       }
     }).catch(() => {});
   }

package/src/constants.mjs

@@ -5,7 +5,7 @@ import { fileURLToPath } from 'url';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
-export const VERSION = '15.1.14';
+export const VERSION = '15.1.17';
 export const BASE_URL = 'https://nothumanallowed.com/cli';
 export const API_BASE = 'https://nothumanallowed.com/api/v1';
 

package/src/server/routes/studio.mjs

@@ -759,16 +759,35 @@ ${okBlock}`;
 
       tok('[Parlamento — Round 2: Cross-Reading & Refinamento] ');
       const r2Results = [];
+      // Per-agent timeout — if any single agent stalls (network, LLM hung)
+      // the loop must not block the whole deliberation. After this budget,
+      // fall back to the agent's Round 1 output and continue.
+      const PER_AGENT_TIMEOUT_MS = 90_000;
       for (const proposal of eligible) {
         tok(`[Round 2: ${proposal.label || proposal.agent}] `);
         const r2Sys = `You are ${proposal.agent}, a specialist AI agent in NHA Studio Parliament. Today is ${today}. Respond entirely in ${language}.\n\n## WORKFLOW GOAL: ${task}\n\n## YOUR ROUND 1 RESPONSE:\n${proposal.output.slice(0,3000)}\n\n## OTHER AGENTS' ROUND 1 PROPOSALS:\n${crossCtx(proposal.agent)}\n\nDELIBERATION ROUND 2 — REFINEMENT:\n1. Review the other agents' proposals carefully\n2. Incorporate valid points where you AGREE — mark with [AGREE]\n3. Flag genuine disagreements with [CONTRADICTION] and explain your reasoning with evidence\n4. Produce your COMPLETE REFINED response — thorough and exhaustive\n5. Keep analysis focused on: ${task}\n\nBe THOROUGH. Minimum 600 words of substantive refined analysis.`;
         let r2Out = '';
+        let fellBack = false;
         try {
-          await callLLMStream(config, r2Sys, 'Produce your refined Round 2 response. Write complete content under every heading — never leave a section title without body text.',
-            (t) => { r2Out += t; }, { max_tokens: 16384 });
-        } catch { r2Out = proposal.output; }
-        r2Results.push({ agent: proposal.agent, label: proposal.label, icon: proposal.icon, output: r2Out });
-        sse({ deliberation_r2: { agent: proposal.agent, label: proposal.label, icon: proposal.icon, output: r2Out } });
+          // Race the LLM stream against a hard timeout.
+          await Promise.race([
+            callLLMStream(config, r2Sys, 'Produce your refined Round 2 response. Write complete content under every heading — never leave a section title without body text.',
+              (t) => { r2Out += t; }, { max_tokens: 16384 }),
+            new Promise((_, reject) => setTimeout(() => reject(new Error('R2_AGENT_TIMEOUT')), PER_AGENT_TIMEOUT_MS)),
+          ]);
+        } catch (err) {
+          // Fallback: use Round 1 output so the rest of deliberation can proceed.
+          fellBack = true;
+          r2Out = proposal.output;
+          tok(`[Round 2 ${proposal.label || proposal.agent}: timeout — uso Round 1 come fallback] `);
+        }
+        // If the stream returned but produced no text (LLM hiccup), also fall back.
+        if (!r2Out || r2Out.trim().length < 50) {
+          fellBack = true;
+          r2Out = proposal.output;
+        }
+        r2Results.push({ agent: proposal.agent, label: proposal.label, icon: proposal.icon, output: r2Out, fellBack });
+        sse({ deliberation_r2: { agent: proposal.agent, label: proposal.label, icon: proposal.icon, output: r2Out, fellBack } });
       }
 
       const r2Conv = measureConvergence(r2Results.map(r => r.output));
@@ -792,9 +811,22 @@ ${okBlock}`;
       const medSys = `You are HERALD, the Parliament Mediator in NHA Studio. Today is ${today}. Respond entirely in ${language}.\n\n## WORKFLOW GOAL: ${task}\n\n## ALL AGENTS' REFINED POSITIONS (Round 2):\n${allR2Ctx}${contBlock}\n\n${medTask}\n\nCRITICAL: NEVER write a heading without immediately writing full content below it. Every section MUST have at least 5-8 concrete bullet points or detailed paragraphs. Be EXHAUSTIVE.`;
 
       let mediationOutput = '';
+      const HERALD_TIMEOUT_MS = 120_000;
       try {
-        await callLLMStream(config, medSys, 'Produce the Parliament final synthesis. Be thorough and complete.', (t) => { mediationOutput += t; }, { max_tokens: 16384 });
-      } catch {}
+        await Promise.race([
+          callLLMStream(config, medSys, 'Produce the Parliament final synthesis. Be thorough and complete.', (t) => { mediationOutput += t; }, { max_tokens: 16384 }),
+          new Promise((_, reject) => setTimeout(() => reject(new Error('HERALD_TIMEOUT')), HERALD_TIMEOUT_MS)),
+        ]);
+      } catch (err) {
+        // HERALD timed out — emit whatever we got so the client isn't stuck.
+        tok(`[HERALD mediation: timeout dopo ${HERALD_TIMEOUT_MS/1000}s — restituisco contenuto parziale] `);
+      }
+      // If absolutely nothing came back, fall back to a concatenation of the
+      // r2 outputs so the user has SOMETHING to read instead of a blank panel.
+      if (!mediationOutput || mediationOutput.trim().length < 50) {
+        mediationOutput = `# Sintesi automatica (HERALD non disponibile)\n\n` +
+          r2Results.map(r => `## ${r.label || r.agent}\n${r.output.slice(0, 2000)}`).join('\n\n---\n\n');
+      }
       sse({ deliberation_r3: { output: mediationOutput, converged } });
 
       clearInterval(keepalive);

package/src/services/message-responder.mjs

@@ -278,6 +278,35 @@ async function callAgentWithTools(config, agentName, userMessage, languageOverri
 
     if (actions.length === 0) {
       finalText = textParts.join('\n').trim();
+
+      // ── HALLUCINATED SUCCESS DETECTION ────────────────────────────────
+      // The model sometimes writes "X è stato cancellato/creato/inviato con
+      // successo" WITHOUT actually emitting a tool block — pure hallucination.
+      // If that happens and we're early in the round budget, force ONE retry
+      // with an explicit instruction to emit the tool JSON. If it still
+      // refuses, replace the fake success with a warning so the user knows
+      // the action did NOT actually happen.
+      const claimsSuccess = isCompletedAction(finalText);
+      const hasReferenceToTool = /\b(eventid|event id|id evento)\b/i.test(finalText);
+      const looksFakeSuccess = claimsSuccess || (hasReferenceToTool && round === 0);
+      if (looksFakeSuccess && round < 1) {
+        // Push the bad response as history so the model sees what it just did,
+        // then ask it to actually emit the tool.
+        history.push({ role: 'assistant', content: response });
+        userMessage =
+          `STOP. Hai dichiarato che un'azione è stata completata ma NON hai emesso nessun blocco tool JSON. ` +
+          `Senza il blocco tool, NESSUNA azione viene eseguita davvero. ` +
+          `Ora emetti il blocco JSON corretto (\`\`\`json ... \`\`\`) per l'azione richiesta dall'utente, usando i parametri corretti. ` +
+          `Se ti serve un eventId, chiama prima calendar_find o calendar_date. Non scrivere altro testo finché non hai eseguito davvero il tool.`;
+        continue; // restart the loop with the corrective user message
+      }
+      if (looksFakeSuccess && round >= 1) {
+        // Second attempt also lied — refuse to forward the fake success.
+        finalText =
+          `Non sono riuscito a eseguire l'azione automaticamente (il modello ha dichiarato un successo senza eseguire il tool). ` +
+          `Riprova riformulando la richiesta, oppure dimmi esattamente cosa vuoi che faccia.`;
+      }
+
       break;
     }
 
@@ -547,8 +576,9 @@ class TelegramResponder {
       const msg =
         `🆕 NHA v${latest} disponibile!\n\n` +
         `Una nuova versione di NotHumanAllowed è stata pubblicata.\n\n` +
-        `Aggiorna con:\nnpm install -g nothumanallowed@latest\n\n` +
-        `Poi riavvia il bot con: nha ops stop && nha ops start`;
+        `Aggiorna con UN SOLO comando (copia e incolla tutto):\n` +
+        `npm cache clean --force && npm install -g nothumanallowed@latest --prefer-online && nha ops stop && nha ops start\n\n` +
+        `Importante: usa esattamente "--prefer-online" (NON "--pref-online") e tieni tutti i "&&" tra i comandi.`;
 
       this.log(`[Telegram] Broadcasting update notification v${latest} to ${chatIds.length} users`);
 
@@ -695,7 +725,7 @@ class TelegramResponder {
       return d.text || '';
     }
 
-    throw new Error('Voice transcription unavailable. The NHA proxy is temporarily unreachable.');
+    throw new Error('servizio di trascrizione vocale momentaneamente non disponibile (NHA proxy irraggiungibile)');
   }
 
   async _handleMessage(message) {
@@ -729,7 +759,7 @@ class TelegramResponder {
         this.log(`[Telegram] Voice transcription failed: ${err.message}`);
         await this._telegramCall('sendMessage', {
           chat_id: chatId,
-          text: `Non riesco a trascrivere il vocale: ${err.message}\n\nAggiungi una chiave Groq (gratuita) con: nha config set groqKey gsk-...`,
+          text: `Non riesco a trascrivere il vocale (${err.message}).\n\nPer abilitare la trascrizione vocale gratuita, dal computer esegui:\nnha config set groqKey TUA_CHIAVE_GROQ\n\nLa chiave si ottiene gratis su https://console.groq.com/keys`,
         });
         return;
       }

package/src/services/tool-executor.mjs

@@ -687,9 +687,13 @@ Never output a JSON block as a suggestion — every block executes immediately.
 ## ABSOLUTE RULES (violate these and the user loses trust)
 
 1. NEVER invent tool output. If you need data (an event ID, a price, a search result), you MUST emit a tool JSON block and wait for its real response. Do NOT write fake "(eventId: 123456789)" or fake results.
-2. NEVER duplicate. If the user says "correggi/modifica/sposta/aggiorna" referring to an item you just created in this conversation, use the corresponding *_update / *_move tool with the eventId/taskId from your previous tool response. Do NOT create a second item.
-3. NEVER put the TITLE in the description field. The "summary" / "title" field is the SHORT name (what shows on a calendar grid). The "description" field is ONLY for extra notes.
-4. When in doubt, ASK ONE concise question — do not invent details.
+2. NEVER claim an action was completed unless you have just received a SUCCESS tool result for that action in this same turn. NEVER write "cancellato con successo", "creato con successo", "inviato" etc. without a real tool execution behind it. If you didn't emit the tool block, the action didn't happen.
+3. NEVER duplicate. If the user says "correggi/modifica/sposta/aggiorna" referring to an item you just created in this conversation, use the corresponding *_update / *_move tool with the eventId/taskId from your previous tool response. Do NOT create a second item.
+4. NEVER put the TITLE in the description field. The "summary" / "title" field is the SHORT name (what shows on a calendar grid). The "description" field is ONLY for extra notes.
+5. NEVER invent times. If the user did not specify a time, ASK them ("A che ora?"). Do not default to 10:00 or any other time silently. Same for missing date, duration, attendees.
+6. When the user confirms ("procedi", "sì", "fallo", "ok", "vai") AND there is a pending action from the IMMEDIATELY PREVIOUS assistant turn (you proposed something like "Posso cancellare X. Procedo?"), EXECUTE that exact pending action with the same parameters — do NOT search again, do NOT propose again, do NOT ask again. Emit the tool block for the action you just proposed.
+7. When in doubt, ASK ONE concise question — do not invent details.
+8. Tool JSON blocks MUST be wrapped in \`\`\`json ... \`\`\` fences. If you emit raw JSON without fences, the system can sometimes still parse it but it's unreliable — always use the fences.
 
 ## TOOL SIGNATURES (parameters and how to use them)
 
@@ -814,12 +818,53 @@ export function parseActions(text) {
   const trailing = normalized.slice(lastIndex).trim();
   if (trailing) textParts.push(trailing);
 
-  // Fallback: if no fenced blocks found, scan for bare {"action": ...} objects in the text
+  // Fallback: if no fenced blocks found, scan for bare {"action": ...} objects
+  // in the text. The previous regex was naive and stopped at the first `}`,
+  // breaking on nested params like {"action":"X","params":{"summary":"Y"}}.
+  // Now we do proper brace balancing so we always capture the FULL object.
   if (actions.length === 0) {
+    const consumed = new Set();
+    const findBareActions = (src) => {
+      let i = 0;
+      while (i < src.length) {
+        // Quick filter: only consider candidates that start with {"action"
+        const idx = src.indexOf('{"action"', i);
+        if (idx < 0) break;
+        // Walk forward balancing braces, respecting strings
+        let depth = 0;
+        let inStr = false;
+        let escape = false;
+        let end = -1;
+        for (let j = idx; j < src.length; j++) {
+          const c = src[j];
+          if (escape) { escape = false; continue; }
+          if (c === '\\' && inStr) { escape = true; continue; }
+          if (c === '"' && !escape) { inStr = !inStr; continue; }
+          if (inStr) continue;
+          if (c === '{') depth++;
+          else if (c === '}') {
+            depth--;
+            if (depth === 0) { end = j; break; }
+          }
+        }
+        if (end < 0) break;
+        const candidate = src.slice(idx, end + 1);
+        try {
+          const parsed = JSON.parse(candidate);
+          if (parsed.action && typeof parsed.action === 'string' && !consumed.has(candidate)) {
+            actions.push({ action: parsed.action, params: parsed.params || {} });
+            consumed.add(candidate);
+          }
+        } catch { /* not valid JSON, skip */ }
+        i = end + 1;
+      }
+    };
+    findBareActions(text);
+    // Legacy fallback kept for very loose JSON shapes — only fires if the
+    // brace scanner found nothing.
     const bareRegex = /\{[\s\S]*?"action"\s*:\s*"[^"]+[\s\S]*?\}/g;
     let bareMatch;
-    const consumed = new Set();
-    while ((bareMatch = bareRegex.exec(text)) !== null) {
+    while (actions.length === 0 && (bareMatch = bareRegex.exec(text)) !== null) {
       try {
         const parsed = JSON.parse(bareMatch[0]);
         if (parsed.action && typeof parsed.action === 'string' && !consumed.has(bareMatch[0])) {