nothumanallowed 15.1.16 → 15.1.18

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nothumanallowed",
-  "version": "15.1.16",
+  "version": "15.1.18",
   "description": "NotHumanAllowed — 38 AI agents, 80 tools, Studio (visual agentic workflows). Email, calendar, browser automation, screen capture, canvas, cron/heartbeat, Alexandria E2E messaging, GitHub, Notion, Slack, voice chat, free AI (Liara), 28 languages. Zero-dependency CLI.",
   "type": "module",
   "bin": {

package/src/constants.mjs

@@ -5,7 +5,7 @@ import { fileURLToPath } from 'url';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
-export const VERSION = '15.1.16';
+export const VERSION = '15.1.18';
 export const BASE_URL = 'https://nothumanallowed.com/cli';
 export const API_BASE = 'https://nothumanallowed.com/api/v1';
 

package/src/server/routes/webcraft.mjs

@@ -246,11 +246,10 @@ class SandboxManager {
     if (this._stoppedByUser) return;
     emit({ type: 'status', msg: `Process exited with code ${exitCode}` });
 
-    // Extract missing module name from stderr
+    // ── Tier 1: missing module → npm install + retry ─────────────────────
     const missingMatch = stderrBuf.match(/Cannot find module ['"]([^'"]+)['"]/);
     if (missingMatch && _attempt < MAX_RETRIES) {
       const missingMod = missingMatch[1];
-      // Skip shim-able or built-in modules
       if (!missingMod.startsWith('.') && !missingMod.startsWith('/') && !missingMod.startsWith('node:')) {
         const pkgName = missingMod.startsWith('@') ? missingMod.split('/').slice(0, 2).join('/') : missingMod.split('/')[0];
         emit({ type: 'phase', phase: 'autofix', msg: `Missing module "${pkgName}" — installing...` });
@@ -268,6 +267,102 @@ class SandboxManager {
       }
     }
 
+    // ── Tier 2: runtime errors that need code fix (require/import mismatch,
+    //   SyntaxError, ReferenceError, TypeError) — extract failing file from
+    //   stack trace and ask LLM to repair it. This is the bug the user hit:
+    //   "require is not defined" inside an ESM project should auto-rewrite
+    //   require() → import statements, or flip package.json "type" field. ───
+    const runtimePatterns = [
+      { name: 'CJS/ESM mismatch',   re: /require is not defined/i,
+        hint: 'The file uses CommonJS `require()` but the project is ESM ("type":"module" in package.json or .mjs extension). Convert all `require(\'X\')` to ES module `import` statements. Convert `module.exports = ...` to `export default ...`. Keep all logic identical.' },
+      { name: 'ESM/CJS mismatch',   re: /Cannot use import statement outside a module/i,
+        hint: 'The file uses ES module `import` but the project is CommonJS. Either add `"type":"module"` to package.json (preferred for new projects) or convert imports to `require()`.' },
+      { name: 'import.meta misuse', re: /import\.meta(?:\.url)? is only valid in/i,
+        hint: 'The file uses `import.meta` in a CommonJS context. Either switch the project to ESM (add `"type":"module"` to package.json) or replace `import.meta.url` with `__filename` / `__dirname`.' },
+      { name: 'SyntaxError',        re: /SyntaxError:.+/i,
+        hint: 'The file has a JavaScript syntax error. Fix the syntax issue — unclosed brackets, missing commas, invalid tokens. Output the complete corrected file.' },
+      { name: 'ReferenceError',     re: /ReferenceError: (\w+) is not defined/i,
+        hint: 'A variable is referenced but never declared/imported. Either import it from the correct module or declare it. Common missing globals: "require" (use import), "process" (Node only — add `import process from \'node:process\'` in ESM), "__dirname" (in ESM use `import.meta.url` + fileURLToPath).' },
+      { name: 'TypeError null/undefined', re: /TypeError: Cannot read prop(?:erties|erty)? .+ of (?:undefined|null)/i,
+        hint: 'Null/undefined access. Add a null-check or optional chaining (?.) before the failing access.' },
+    ];
+
+    const matchedPattern = runtimePatterns.find(p => p.re.test(stderrBuf));
+    if (matchedPattern && _attempt < MAX_RETRIES) {
+      // Extract the file path from the stack trace.
+      // Patterns: "at /abs/path/file.js:N:M", "at file:///abs/path/file.js:N:M",
+      // "at Object.<anonymous> (/path/file.js:N:M)", or simply at start of stderr.
+      const fileMatches = [...stderrBuf.matchAll(/(?:at\s+(?:[\w<>\.\s]+\s+)?\(?)?(?:file:\/\/)?(\/[^\s:()'"]+\.(?:m?js|cjs|jsx?|tsx?)):\d+(?::\d+)?/g)];
+      const projectFiles = fileMatches
+        .map(m => m[1])
+        .filter(p => p && p.startsWith(projectDir))
+        .map(p => path.relative(projectDir, p))
+        .filter((v, i, a) => a.indexOf(v) === i)
+        .slice(0, 3);
+
+      if (projectFiles.length > 0) {
+        emit({ type: 'phase', phase: 'autofix', msg: `Runtime error (${matchedPattern.name}) — repairing ${projectFiles.length} file(s)...` });
+        let anyFixed = false;
+        for (const rel of projectFiles) {
+          const abs = path.join(projectDir, rel);
+          let original = '';
+          try { original = fs.readFileSync(abs, 'utf-8'); } catch { continue; }
+          if (!original) continue;
+
+          // Build a focused repair prompt — include the runtime error so the
+          // model knows exactly what to fix.
+          const errSnippet = stderrBuf.split('\n').slice(0, 30).join('\n');
+          const fixPrompt =
+`A Node.js sandbox crashed with this runtime error:
+
+${errSnippet.slice(0, 1500)}
+
+The failing file is: ${rel}
+
+What to fix: ${matchedPattern.hint}
+
+CRITICAL: Output ONLY the complete corrected file content. No commentary, no markdown fences. Keep all working logic intact — only change what's necessary to fix the error.
+
+Current file content:
+${original.slice(0, 12_000)}`;
+
+          try {
+            let fixed = '';
+            await callLLMStream(loadConfig(), 'You are a precise code repair assistant. Output only the corrected file, no explanation.', fixPrompt, (c) => { fixed += c; }, { max_tokens: 16384 });
+            fixed = fixed.replace(/^```[\w]*\n/, '').replace(/\n```$/, '').trim();
+            if (fixed.length > 20 && fixed !== original) {
+              fs.writeFileSync(abs, fixed, 'utf-8');
+              emit({ type: 'status', msg: `Repaired ${rel} (${fixed.length} chars)` });
+              anyFixed = true;
+            }
+          } catch (e) {
+            emit({ type: 'warn', msg: `LLM repair of ${rel} failed: ${(e.message || '').slice(0, 200)}` });
+          }
+        }
+        if (anyFixed) {
+          emit({ type: 'status', msg: `Restarting sandbox (attempt ${_attempt + 1}/${MAX_RETRIES})...` });
+          return this.start(projectName, projectDir, emit, _attempt + 1);
+        }
+      }
+
+      // Special fallback for CJS/ESM mismatches: try flipping package.json "type"
+      if (matchedPattern.name.includes('CJS/ESM') || matchedPattern.name.includes('ESM/CJS')) {
+        const pkgPath = path.join(projectDir, 'package.json');
+        if (fs.existsSync(pkgPath)) {
+          try {
+            const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
+            const isCjsError = /Cannot use import statement outside a module/i.test(stderrBuf);
+            if (isCjsError && pkg.type !== 'module') {
+              pkg.type = 'module';
+              fs.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2));
+              emit({ type: 'status', msg: 'Added "type":"module" to package.json — retrying...' });
+              return this.start(projectName, projectDir, emit, _attempt + 1);
+            }
+          } catch { /* ignore */ }
+        }
+      }
+    }
+
     // Show the actual error from stderr — include full trace for debugging
     const stderrLines = stderrBuf.split('\n').filter(l => l.trim());
     const errLine = stderrLines.find((l) => l.includes('Error') || l.includes('error'));

package/src/services/message-responder.mjs

@@ -278,6 +278,35 @@ async function callAgentWithTools(config, agentName, userMessage, languageOverri
 
     if (actions.length === 0) {
       finalText = textParts.join('\n').trim();
+
+      // ── HALLUCINATED SUCCESS DETECTION ────────────────────────────────
+      // The model sometimes writes "X è stato cancellato/creato/inviato con
+      // successo" WITHOUT actually emitting a tool block — pure hallucination.
+      // If that happens and we're early in the round budget, force ONE retry
+      // with an explicit instruction to emit the tool JSON. If it still
+      // refuses, replace the fake success with a warning so the user knows
+      // the action did NOT actually happen.
+      const claimsSuccess = isCompletedAction(finalText);
+      const hasReferenceToTool = /\b(eventid|event id|id evento)\b/i.test(finalText);
+      const looksFakeSuccess = claimsSuccess || (hasReferenceToTool && round === 0);
+      if (looksFakeSuccess && round < 1) {
+        // Push the bad response as history so the model sees what it just did,
+        // then ask it to actually emit the tool.
+        history.push({ role: 'assistant', content: response });
+        userMessage =
+          `STOP. Hai dichiarato che un'azione è stata completata ma NON hai emesso nessun blocco tool JSON. ` +
+          `Senza il blocco tool, NESSUNA azione viene eseguita davvero. ` +
+          `Ora emetti il blocco JSON corretto (\`\`\`json ... \`\`\`) per l'azione richiesta dall'utente, usando i parametri corretti. ` +
+          `Se ti serve un eventId, chiama prima calendar_find o calendar_date. Non scrivere altro testo finché non hai eseguito davvero il tool.`;
+        continue; // restart the loop with the corrective user message
+      }
+      if (looksFakeSuccess && round >= 1) {
+        // Second attempt also lied — refuse to forward the fake success.
+        finalText =
+          `Non sono riuscito a eseguire l'azione automaticamente (il modello ha dichiarato un successo senza eseguire il tool). ` +
+          `Riprova riformulando la richiesta, oppure dimmi esattamente cosa vuoi che faccia.`;
+      }
+
       break;
     }
 
@@ -696,7 +725,7 @@ class TelegramResponder {
       return d.text || '';
     }
 
-    throw new Error('Voice transcription unavailable. The NHA proxy is temporarily unreachable.');
+    throw new Error('servizio di trascrizione vocale momentaneamente non disponibile (NHA proxy irraggiungibile)');
   }
 
   async _handleMessage(message) {
@@ -730,7 +759,7 @@ class TelegramResponder {
         this.log(`[Telegram] Voice transcription failed: ${err.message}`);
         await this._telegramCall('sendMessage', {
           chat_id: chatId,
-          text: `Non riesco a trascrivere il vocale: ${err.message}\n\nAggiungi una chiave Groq (gratuita) con: nha config set groqKey gsk-...`,
+          text: `Non riesco a trascrivere il vocale (${err.message}).\n\nPer abilitare la trascrizione vocale gratuita, dal computer esegui:\nnha config set groqKey TUA_CHIAVE_GROQ\n\nLa chiave si ottiene gratis su https://console.groq.com/keys`,
         });
         return;
       }

package/src/services/tool-executor.mjs

@@ -687,9 +687,13 @@ Never output a JSON block as a suggestion — every block executes immediately.
 ## ABSOLUTE RULES (violate these and the user loses trust)
 
 1. NEVER invent tool output. If you need data (an event ID, a price, a search result), you MUST emit a tool JSON block and wait for its real response. Do NOT write fake "(eventId: 123456789)" or fake results.
-2. NEVER duplicate. If the user says "correggi/modifica/sposta/aggiorna" referring to an item you just created in this conversation, use the corresponding *_update / *_move tool with the eventId/taskId from your previous tool response. Do NOT create a second item.
-3. NEVER put the TITLE in the description field. The "summary" / "title" field is the SHORT name (what shows on a calendar grid). The "description" field is ONLY for extra notes.
-4. When in doubt, ASK ONE concise question — do not invent details.
+2. NEVER claim an action was completed unless you have just received a SUCCESS tool result for that action in this same turn. NEVER write "cancellato con successo", "creato con successo", "inviato" etc. without a real tool execution behind it. If you didn't emit the tool block, the action didn't happen.
+3. NEVER duplicate. If the user says "correggi/modifica/sposta/aggiorna" referring to an item you just created in this conversation, use the corresponding *_update / *_move tool with the eventId/taskId from your previous tool response. Do NOT create a second item.
+4. NEVER put the TITLE in the description field. The "summary" / "title" field is the SHORT name (what shows on a calendar grid). The "description" field is ONLY for extra notes.
+5. NEVER invent times. If the user did not specify a time, ASK them ("A che ora?"). Do not default to 10:00 or any other time silently. Same for missing date, duration, attendees.
+6. When the user confirms ("procedi", "sì", "fallo", "ok", "vai") AND there is a pending action from the IMMEDIATELY PREVIOUS assistant turn (you proposed something like "Posso cancellare X. Procedo?"), EXECUTE that exact pending action with the same parameters — do NOT search again, do NOT propose again, do NOT ask again. Emit the tool block for the action you just proposed.
+7. When in doubt, ASK ONE concise question — do not invent details.
+8. Tool JSON blocks MUST be wrapped in \`\`\`json ... \`\`\` fences. If you emit raw JSON without fences, the system can sometimes still parse it but it's unreliable — always use the fences.
 
 ## TOOL SIGNATURES (parameters and how to use them)
 
@@ -814,12 +818,53 @@ export function parseActions(text) {
   const trailing = normalized.slice(lastIndex).trim();
   if (trailing) textParts.push(trailing);
 
-  // Fallback: if no fenced blocks found, scan for bare {"action": ...} objects in the text
+  // Fallback: if no fenced blocks found, scan for bare {"action": ...} objects
+  // in the text. The previous regex was naive and stopped at the first `}`,
+  // breaking on nested params like {"action":"X","params":{"summary":"Y"}}.
+  // Now we do proper brace balancing so we always capture the FULL object.
   if (actions.length === 0) {
+    const consumed = new Set();
+    const findBareActions = (src) => {
+      let i = 0;
+      while (i < src.length) {
+        // Quick filter: only consider candidates that start with {"action"
+        const idx = src.indexOf('{"action"', i);
+        if (idx < 0) break;
+        // Walk forward balancing braces, respecting strings
+        let depth = 0;
+        let inStr = false;
+        let escape = false;
+        let end = -1;
+        for (let j = idx; j < src.length; j++) {
+          const c = src[j];
+          if (escape) { escape = false; continue; }
+          if (c === '\\' && inStr) { escape = true; continue; }
+          if (c === '"' && !escape) { inStr = !inStr; continue; }
+          if (inStr) continue;
+          if (c === '{') depth++;
+          else if (c === '}') {
+            depth--;
+            if (depth === 0) { end = j; break; }
+          }
+        }
+        if (end < 0) break;
+        const candidate = src.slice(idx, end + 1);
+        try {
+          const parsed = JSON.parse(candidate);
+          if (parsed.action && typeof parsed.action === 'string' && !consumed.has(candidate)) {
+            actions.push({ action: parsed.action, params: parsed.params || {} });
+            consumed.add(candidate);
+          }
+        } catch { /* not valid JSON, skip */ }
+        i = end + 1;
+      }
+    };
+    findBareActions(text);
+    // Legacy fallback kept for very loose JSON shapes — only fires if the
+    // brace scanner found nothing.
     const bareRegex = /\{[\s\S]*?"action"\s*:\s*"[^"]+[\s\S]*?\}/g;
     let bareMatch;
-    const consumed = new Set();
-    while ((bareMatch = bareRegex.exec(text)) !== null) {
+    while (actions.length === 0 && (bareMatch = bareRegex.exec(text)) !== null) {
       try {
         const parsed = JSON.parse(bareMatch[0]);
         if (parsed.action && typeof parsed.action === 'string' && !consumed.has(bareMatch[0])) {