nothumanallowed 15.1.31 → 15.1.33

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nothumanallowed",
-  "version": "15.1.31",
+  "version": "15.1.33",
   "description": "NotHumanAllowed — 38 AI agents, 80 tools, Studio (visual agentic workflows). Email, calendar, browser automation, screen capture, canvas, cron/heartbeat, Alexandria E2E messaging, GitHub, Notion, Slack, voice chat, free AI (Liara), 28 languages. Zero-dependency CLI.",
   "type": "module",
   "bin": {

package/src/constants.mjs

@@ -5,7 +5,7 @@ import { fileURLToPath } from 'url';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
-export const VERSION = '15.1.31';
+export const VERSION = '15.1.33';
 export const BASE_URL = 'https://nothumanallowed.com/cli';
 export const API_BASE = 'https://nothumanallowed.com/api/v1';
 

package/src/server/routes/webcraft.mjs

@@ -14,9 +14,15 @@
 
 import fs   from 'fs';
 import path from 'path';
-import { exec, spawn } from 'child_process';
-import { createServer } from 'net';
+import { exec, spawn, execSync } from 'child_process';
+import { createServer, Socket } from 'net';
 import { promisify } from 'util';
+import { createRequire } from 'module';
+// `require` shim for the rare spots where CJS-style require() was historically
+// used in this ESM file. Without this, every `require(...)` here throws
+// "ReferenceError: require is not defined" — which is exactly the bug that
+// took 31 releases to diagnose because it surfaced in the SSE error channel.
+const require = createRequire(import.meta.url);
 import { sendJSON, sendError, parseBody, sendSSE } from '../index.mjs';
 import { loadConfig }   from '../../config.mjs';
 import { callLLM, callLLMStream, callLLMWithTools, getApiKey, fixQwen3BPE } from '../../services/llm.mjs';
@@ -2410,9 +2416,9 @@ export function register(router) {
       path.resolve(__dir, '../../../node_modules/.bin/tsc'),
       path.resolve(__dir, '../../../../node_modules/.bin/tsc'),
     ];
-    // Also try global
+    // Also try global — execSync imported at top of file (ESM).
     try {
-      const globalTsc = require('child_process').execSync('which tsc 2>/dev/null || where tsc 2>nul', { encoding: 'utf-8', timeout: 3000 }).trim();
+      const globalTsc = execSync('which tsc 2>/dev/null || where tsc 2>nul', { encoding: 'utf-8', timeout: 3000 }).trim();
       if (globalTsc) candidates.push(globalTsc);
     } catch {}
     for (const c of candidates) {
@@ -3525,8 +3531,11 @@ function _waitForPort(port, timeoutMs) {
   return new Promise((resolve) => {
     const deadline = Date.now() + timeoutMs;
     const check = () => {
-      // Try to connect to the port — if connection succeeds, the server is listening
-      const { Socket } = require('net');
+      // Use the ESM-imported Socket — NEVER `require('net')` here, this file
+      // is .mjs and `require` is not defined in ESM. The require call here
+      // was the single root cause of "[error] require is not defined" with
+      // no autofix flow visible — the crash happened INSIDE the nha ui
+      // server itself (in this exact function), not in the child sandbox.
       const sock = new Socket();
       sock.setTimeout(500);
       sock.once('connect', () => { sock.destroy(); resolve(true); });

package/src/services/message-responder.mjs

@@ -822,17 +822,50 @@ class TelegramResponder {
         const shortConfirm = /^(s[ìi]\.?|ok\.?|okay\.?|yes\.?|yep\.?|sure\.?|certo\.?|procedi\.?|fallo\.?|vai\.?|go\.?|do it\.?|conferma\.?|certo che s[ìi]\.?|fallo pure\.?)$/i.test(cleanText.trim());
 
         if (proposedAction && shortConfirm) {
+          // Extract the SPECIFIC action the assistant proposed (create/delete/
+          // update/move/send/...), so we can inject an explicit tool name in
+          // the instruction. Without this, Liara may pick a random tool —
+          // e.g. user confirms a CREATE proposal and the model fires DELETE
+          // with a hallucinated eventId.
+          const r = lowerReply;
+          let actionHint = '';
+          let toolHint = '';
+          if (/fissat[oa]|inserir[oe]|cre(a|er)[oa]|aggiunger[oeò]|prenota|registr[oa]|mett[oa] (?:in calendario|nel calendario)/.test(r)) {
+            actionHint = 'CREARE un nuovo appuntamento';
+            toolHint = 'calendar_create con i parametri ESATTI (summary, start, end) che hai descritto nel turno precedente';
+          } else if (/cancell|eliminar[eo]|rimuover/.test(r)) {
+            actionHint = 'CANCELLARE un appuntamento esistente';
+            toolHint = 'PRIMA calendar_find/calendar_date per ottenere l\'eventId REALE, POI calendar_delete con quell\'eventId. Mai inventare ID';
+          } else if (/spostar|riprogrammar|cambiar[eo] (?:l\')?orario|cambiar[eo] (?:la )?data/.test(r)) {
+            actionHint = 'SPOSTARE un appuntamento';
+            toolHint = 'PRIMA calendar_find per ottenere eventId, POI calendar_move(eventId, newStart, newEnd)';
+          } else if (/modificar|correggere|rinominar|cambiar[eo] (?:il )?titolo/.test(r)) {
+            actionHint = 'MODIFICARE un appuntamento';
+            toolHint = 'PRIMA calendar_find per eventId, POI calendar_update(eventId, ...) con SOLO i campi da cambiare';
+          } else if (/inviar|spedir|mandar (?:l\'|la )?email|send (?:the )?email/.test(r)) {
+            actionHint = 'INVIARE un\'email';
+            toolHint = 'gmail_send (o gmail_reply se è una risposta) con destinatario, oggetto e corpo già concordati';
+          } else if (/aggiunger[eo] (?:un )?task|creare (?:un )?task|inserir[eo] (?:il )?task/.test(r)) {
+            actionHint = 'CREARE un task';
+            toolHint = 'task_add con la descrizione concordata';
+          } else {
+            actionHint = 'l\'azione che hai proposto';
+            toolHint = 'il tool corrispondente all\'azione (calendar_create se hai detto "fisso"; calendar_delete se "cancello"; gmail_send se "invio"; ecc.). NON inventare eventId — usa SOLO ID reali ricevuti da tool precedenti';
+          }
+
           enrichedMessage =
-            `[CONFERMA UTENTE — Esegui SUBITO l'azione che hai proposto nel turno precedente]\n\n` +
-            `Tuo turno precedente:\n"${(lastCtx.agentReply || '').slice(0, 800)}"\n\n` +
+            `[CONFERMA UTENTE — Esegui SUBITO l'azione che hai proposto]\n\n` +
+            `Tuo turno precedente (proposta):\n"${(lastCtx.agentReply || '').slice(0, 800)}"\n\n` +
             `Risposta utente: "${cleanText.trim()}"\n\n` +
+            `AZIONE DA ESEGUIRE: ${actionHint}\n` +
+            `TOOL DA USARE: ${toolHint}\n\n` +
             `ISTRUZIONI OBBLIGATORIE:\n` +
-            `1. L'utente sta confermando il piano che TU hai proposto. NON chiedere altri chiarimenti.\n` +
-            `2. NON dire "procedo" senza eseguire — emetti SUBITO i tool block JSON.\n` +
-            `3. Se hai promesso N step (cercare, eliminare, mostrare la lista, etc.) — emetti TUTTI gli N tool block in sequenza nel TUO prossimo messaggio.\n` +
-            `4. Esempio: se hai detto "cercherò l'evento, lo eliminerò, mostrerò la lista" → emetti calendar_find → quando ricevi il risultato emetti calendar_delete con l'eventId trovato → infine calendar_month/calendar_week.\n` +
-            `5. NON ripetere "Procedo. Cosa vuoi?" — sai già cosa vuole, lo hai proposto tu. Esegui.`;
-          this.log(`[Telegram] ${fromUser}: pending-action force (proposal detected in prev reply, user confirmed short)`);
+            `1. Emetti SUBITO il blocco JSON \`\`\`json {"action":"...","params":{...}} \`\`\` per ESATTAMENTE l'azione qui sopra.\n` +
+            `2. Usa i parametri (data, ora, titolo, destinatario, eccetera) che HAI GIÀ menzionato nel tuo turno precedente. NON chiedere di nuovo.\n` +
+            `3. Se l'azione è CREATE/SEND/ADD: emetti SOLO quel tool. NIENTE find/delete/update preliminare — quei tool servono per modificare cose esistenti, non per creare di nuove.\n` +
+            `4. Se l'azione è DELETE/UPDATE/MOVE: emetti PRIMA calendar_find o calendar_date per trovare l'eventId REALE (lungo, alfanumerico Google). MAI usare placeholder come "A1B2C3D4E5F6G7H8I9J0", "abc123", "ABC123".\n` +
+            `5. NON chiedere "cosa vuoi". NON dire "Procedo." senza eseguire. SOLO il blocco JSON e una breve conferma in italiano dopo l'esecuzione.`;
+          this.log(`[Telegram] ${fromUser}: pending-action force → ${actionHint}`);
         }
 
         this.log(`[Telegram] ${fromUser}: continuation → ${agent.toUpperCase()} (ctx ${Math.round(stickyAge/1000)}s ago, history=${preHistory ? preHistory.length : 0})`);

package/src/services/tool-executor.mjs

@@ -1091,6 +1091,41 @@ export async function buildSystemPrompt(persona, personaDescription, config, ini
  * @param {object} config — NHA config
  * @returns {Promise<string>} result description
  */
+
+/**
+ * Detect IDs that the model has clearly invented vs real Google Calendar
+ * eventIds. Real ones are LONG (≥10), LOWERCASE, alphanumeric (a-v + 0-9,
+ * sometimes with `_` or `-`). Placeholders are typically short, uppercase,
+ * dictionary words, or alternate-letter+digit pseudo-random patterns like
+ * "A1B2C3D4E5F6G7H8I9J0".
+ */
+function isPlaceholderEventId(id) {
+  if (!id || typeof id !== 'string') return true;
+  const s = id.trim();
+  // 1. Explicit literal blocklist (covers everything we've seen so far)
+  const LITERAL = new Set([
+    'abc123', 'def456', 'xyz789', 'event_123', 'event_123456789',
+    '123', '456', 'foo', 'bar', 'baz', 'example', 'placeholder',
+    'eventid', 'event_id', 'id', 'null', 'undefined', 'some-google-id',
+    'event-id', 'id-from-tool', 'event_abc', 'event_xyz',
+  ]);
+  if (LITERAL.has(s.toLowerCase())) return true;
+  // 2. Too short — Google eventIds are always ≥ 16 chars in practice
+  if (s.length < 10) return true;
+  // 3. Contains spaces — never valid
+  if (/\s/.test(s)) return true;
+  // 4. Pseudo-random alternating letter+digit pattern like "A1B2C3D4..."
+  //    Real Google eventIds NEVER look like this — they have natural
+  //    base32-ish randomness, not human-readable patterns.
+  if (/^[A-Z](?:\d[A-Z]){3,}/i.test(s)) return true;
+  // 5. Almost-all-uppercase: Google eventIds are lowercase. UPPERCASE
+  //    is a model invention signature.
+  const upper = (s.match(/[A-Z]/g) || []).length;
+  const lower = (s.match(/[a-z]/g) || []).length;
+  if (upper >= 3 && upper > lower) return true;
+  return false;
+}
+
 export async function executeTool(action, params, config) {
   switch (action) {
     // ── Gmail ──────────────────────────────────────────────────────────────
@@ -1634,14 +1669,10 @@ export async function executeTool(action, params, config) {
       let eventId = String(params.eventId || '').trim();
       if (!eventId) return 'eventId required. Call calendar_find or calendar_date first to get the REAL eventId.';
 
-      // Reject obvious placeholder IDs (model copied from prompt examples)
-      const PLACEHOLDERS = new Set([
-        'abc123', 'def456', 'xyz789', 'event_123', 'event_123456789',
-        '123', '456', 'foo', 'bar', 'baz', 'example', 'placeholder',
-        'eventid', 'event_id', 'id', 'null', 'undefined',
-      ]);
-      if (PLACEHOLDERS.has(eventId.toLowerCase())) {
-        return `"${eventId}" is a placeholder, not a real eventId. Call calendar_find or calendar_date FIRST to get real eventIds.`;
+      // Reject obvious placeholder IDs (model copied from prompt examples or
+      // emitted obvious patterns like "A1B2C3D4E5F6G7H8I9J0").
+      if (isPlaceholderEventId(eventId)) {
+        return `"${eventId}" looks invented (placeholder pattern). Call calendar_find or calendar_date FIRST to get real eventIds.`;
       }
 
       // Smart eventId resolution: if it looks like a name instead of a Google Calendar ID, search for it
@@ -1695,16 +1726,11 @@ export async function executeTool(action, params, config) {
       let delEventId = String(params.eventId).trim();
 
       // Reject placeholder IDs the model may have copied verbatim from prompt
-      // examples or hallucinated wholesale. These are obvious giveaways — real
-      // Google Calendar eventIds are long lowercase alphanumeric strings, not
-      // dictionary words.
-      const PLACEHOLDER_IDS = new Set([
-        'abc123', 'def456', 'xyz789', 'event_123', 'event_123456789',
-        '123', '456', 'foo', 'bar', 'baz', 'example', 'placeholder',
-        'eventid', 'event_id', 'id', 'null', 'undefined',
-      ]);
-      if (PLACEHOLDER_IDS.has(delEventId.toLowerCase())) {
-        return `"${delEventId}" is a placeholder, not a real eventId. Call calendar_date(YYYY-MM-DD) or calendar_find(query) FIRST to get the real eventIds, then call calendar_delete with one of those values.`;
+      // examples or hallucinated wholesale. Real Google Calendar eventIds
+      // are long LOWERCASE alphanumeric strings — never UPPERCASE patterns
+      // like "A1B2C3D4E5F6G7H8I9J0" (visibly invented).
+      if (isPlaceholderEventId(delEventId)) {
+        return `"${delEventId}" looks invented (placeholder pattern). Real Google Calendar eventIds are long lowercase alphanumeric strings (a-v + 0-9, often with - and _). Call calendar_date(YYYY-MM-DD) or calendar_find(query) FIRST to get the real eventIds, then call calendar_delete with one of those.`;
       }
 
       // Branch A — looks like a free-text search query (spaces, caps, very short).