nothumanallowed 15.1.47 → 15.1.49

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nothumanallowed",
-  "version": "15.1.47",
+  "version": "15.1.49",
   "description": "NotHumanAllowed — 38 AI agents, 80 tools, Studio (visual agentic workflows). Email, calendar, browser automation, screen capture, canvas, cron/heartbeat, Alexandria E2E messaging, GitHub, Notion, Slack, voice chat, free AI (Liara), 28 languages. Zero-dependency CLI.",
   "type": "module",
   "bin": {

package/src/constants.mjs

@@ -5,7 +5,7 @@ import { fileURLToPath } from 'url';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
-export const VERSION = '15.1.47';
+export const VERSION = '15.1.49';
 export const BASE_URL = 'https://nothumanallowed.com/cli';
 export const API_BASE = 'https://nothumanallowed.com/api/v1';
 

package/src/server/routes/chat.mjs

@@ -16,7 +16,7 @@ import {
 } from '../../services/conversations.mjs';
 import { callLLMStream, callLLM, callLLMVision, parseAgentFile } from '../../services/llm.mjs';
 import { buildMemoryContext } from '../../services/memory.mjs';
-import { parseActions, executeTool, buildSystemPrompt } from '../../services/tool-executor.mjs';
+import { parseActions, executeTool, buildSystemPrompt, stripOrphanFences } from '../../services/tool-executor.mjs';
 
 // Migrate on import (once)
 migrateOldHistory();
@@ -275,17 +275,59 @@ export function register(router) {
           a.params = { url: 'https://' + a.params.query.trim() };
         }
       }
-      // Auto-detect email reading intent — force imap_list if LLM didn't emit the tool
+      // Auto-detect email reading intent — force the right IMAP tool if the
+      // LLM didn't emit one. Semantic keywords (offerta/RFQ/preventivo/...)
+      // trigger `imap_search` across all synced messages with each variant,
+      // because users almost never want "just the 5 latest" — they want
+      // "everything matching X". Generic "leggi le email" still falls back
+      // to imap_list. Multi-language: it/en/de/fr/es.
+      const lower = msg.toLowerCase();
       const wantsReadEmail = /\b(leggi|read|mostra|lista|ultime?|recenti?|email|mail|inbox|posta)\b.*\b(email|mail|messag|inbox|posta)\b|\b(email|mail)\b.*\b(leggi|read|mostra|lista|ultime?|recenti?)\b/i.test(msg);
-      if (wantsReadEmail && !actions.some(a => a.action?.startsWith('imap_') || a.action === 'list_emails')) {
+      // Semantic intent → quote / offer / proposal / order requests
+      const QUOTE_KEYWORDS = {
+        offerta:    ['offerta', 'richiesta offerta', 'richiesta di offerta', 'preventivo', 'quotazione', 'rdo', 'rda'],
+        quote:      ['quote', 'quotation', 'rfq', 'rfp', 'request for quote', 'request for proposal', 'price request', 'pricing'],
+        order:      ['ordine', 'order', 'po ', 'purchase order', 'commessa', 'bestellung', 'commande'],
+        invoice:    ['fattura', 'invoice', 'rechnung', 'facture'],
+        proposal:   ['proposta', 'proposal', 'angebot', 'devis'],
+      };
+      let semanticBag = null;
+      if (/\b(offert|preventiv|quotaz|rdo\b|rda\b|quotation|rfq|rfp|request\s+for\s+(quote|proposal|pricing)|price\s+request|pricing|angebot|devis|proposta|proposal)/i.test(lower)) {
+        semanticBag = 'offerta';
+      } else if (/\b(ordin|order|purchase\s+order|po\s+\d|commessa|bestellung|commande)/i.test(lower)) {
+        semanticBag = 'order';
+      } else if (/\b(fattur|invoice|rechnung|facture)/i.test(lower)) {
+        semanticBag = 'invoice';
+      } else if (/\b(propost|proposal|angebot|devis)/i.test(lower)) {
+        semanticBag = 'proposal';
+      }
+
+      if ((wantsReadEmail || semanticBag) && !actions.some(a => a.action?.startsWith('imap_') || a.action === 'list_emails')) {
         try {
           const { listAccounts: _la } = await import('../../services/email-db.mjs');
           const imapAccs = _la();
           if (imapAccs.length > 0) {
             const firstAcc = imapAccs[0];
-            const limitMatch = msg.match(/\b(\d+)\b/);
-            const limit = limitMatch ? Math.min(parseInt(limitMatch[1]), 20) : 5;
-            actions.push({ action: 'imap_list', params: { accountId: firstAcc.id, limit } });
+            if (semanticBag) {
+              // Push one imap_search per keyword variant in the bag. The
+              // synthesis step will dedupe overlapping hits. We default to a
+              // 60-day window (limit=80 per query) — much wider than the
+              // 5-email peek the old branch did.
+              const bag = QUOTE_KEYWORDS[semanticBag] || [];
+              const variants = [
+                ...(QUOTE_KEYWORDS.offerta || []).slice(0, 3),
+                ...(QUOTE_KEYWORDS.quote   || []).slice(0, 3),
+                ...bag,
+              ];
+              const unique = [...new Set(variants)].slice(0, 6);
+              for (const q of unique) {
+                actions.push({ action: 'imap_search', params: { accountId: firstAcc.id, query: q, limit: 50 } });
+              }
+            } else {
+              const limitMatch = msg.match(/\b(\d+)\b/);
+              const limit = limitMatch ? Math.min(parseInt(limitMatch[1]), 50) : 20;
+              actions.push({ action: 'imap_list', params: { accountId: firstAcc.id, limit } });
+            }
           }
         } catch { /* fallback to LLM response */ }
       }
@@ -383,24 +425,48 @@ export function register(router) {
         const synthesisPrompt = `${enrichedPrompt}\n\n## DATA FROM TOOLS:\n${toolContext}\n\n## STRICT OUTPUT RULES:\n- Write ONLY plain prose or markdown (headers, bullets, bold)\n- NEVER use \`\`\`json, \`\`\`data, or any fenced code block containing data\n- NEVER output raw JSON, arrays, or objects\n- Format numbers/prices as plain text (e.g. "Bitcoin: $103,000")\n- Be concise and human-readable`;
         const synthesisMsg = `${effectiveMsg}\n\nAnswer using ONLY the data above. Plain text/markdown only — zero JSON, zero code blocks.`;
         sse('tool_synthesis', {});
-        fullResponse = '';
-        fullResponse = await callLLMStream(config, synthesisPrompt, synthesisMsg, (chunk) => {
-          sse('token', { content: chunk });
-        });
+        // Keep the pre-synthesis prose around. If the synthesis call returns
+        // empty (provider error, content filter, model bailed), we fall back
+        // to "first-round prose + raw tool output" so the user never sees a
+        // blank message and can still read what the tools returned.
+        const preSynthesis = fullResponse;
+        let synthesized = '';
+        try {
+          synthesized = await callLLMStream(config, synthesisPrompt, synthesisMsg, (chunk) => {
+            sse('token', { content: chunk });
+          });
+        } catch (synthErr) {
+          sse('error', { message: `Synthesis failed: ${synthErr.message}` });
+        }
+        if (synthesized && synthesized.trim()) {
+          fullResponse = synthesized;
+        } else {
+          // Fallback: stream the raw tool context so the user gets the data
+          // even when the LLM round failed silently.
+          const fallback = (preSynthesis && preSynthesis.trim() ? preSynthesis.trim() + '\n\n' : '') +
+            toolResults.map(t => `**${t.action}**\n${cleanResult(t.action, t.result)}`).join('\n\n');
+          sse('token', { content: fallback });
+          fullResponse = fallback;
+        }
       }
 
+      // Strip orphan tool-fence blocks that the LLM may have emitted as
+      // a "no-more-tools" marker (e.g. empty ```json ``` or '''json ''').
+      // They leaked into the chat panel as visible noise.
+      const cleanFullResponse = stripOrphanFences(fullResponse);
+
       // Persist to conversation
       if (body.conversationId) {
         try {
           const conv = loadConversation(body.conversationId);
           if (conv) {
-            addMessages(conv, msg, fullResponse);
+            addMessages(conv, msg, cleanFullResponse);
           }
         } catch {}
       }
 
       if (heartbeatInterval) { clearInterval(heartbeatInterval); heartbeatInterval = null; }
-      sse('done', { content: fullResponse });
+      sse('done', { content: cleanFullResponse });
       res.write('data: [DONE]\n\n');
       res.end();
     } catch (e) {

package/src/services/tool-executor.mjs

@@ -455,7 +455,15 @@ TOOLS:
     Only call this if you need to refresh or the section is missing.
 
 66. imap_read(messageId: string)
-    Read a full email message from the local DB by its id. Returns subject, from, to, body_text, body_html, attachments.
+    Read a full email message from the local DB by its id. Returns subject, from, to, body_text, body_html, and a numbered ATTACHMENTS list.
+    If the email has attachments, follow up with imap_attachment_read to read each one's content.
+
+66b. imap_attachment_read(messageId: string, filename?: string, index?: number, attachmentId?: string)
+    Download and parse an attachment of a given email. messageId is required; pick the attachment by filename (substring match,
+    case-insensitive), 1-based index, or attachmentId (exact). Returns extracted text for PDF (text-based POs/quotes/invoices),
+    DOCX (Word), and any text/* type. For image-based PDFs or unsupported binary types, returns metadata and instructs the
+    user to share the relevant section as text. Use this whenever the user says "leggi l'allegato", "read the attachment",
+    "estrai dati dall'allegato", "what's in the PDF", etc.
 
 67. imap_send(accountId: string, to: string, subject: string, bodyHtml: string, cc?: string, inReplyTo?: string)
     Send an email via SMTP from a configured IMAP account. ALWAYS confirm with user before sending.
@@ -820,9 +828,12 @@ export function parseActions(text) {
   const actions = [];
   const textParts = [];
 
-  // Normalize: some LLMs output "json ... " (double-quote fences) instead of ```json ... ```
-  // Replace "json\n{...}\n" patterns with proper ```json fences before parsing
+  // Normalize: some LLMs output "json ... ", 'json ... ' or '''json ... '''
+  // (Python-style triple-quote) instead of ```json ... ```. We rewrite all
+  // these to proper triple-backtick fences before the main regex runs.
   const normalized = text
+    .replace(/'''json\s*\n?([\s\S]*?)\n?\s*'''/g, (_, body) => '```json\n' + body.trim() + '\n```')
+    .replace(/"""json\s*\n?([\s\S]*?)\n?\s*"""/g, (_, body) => '```json\n' + body.trim() + '\n```')
     .replace(/"json\s*\n([\s\S]*?)\n\s*"/g, (_, body) => '```json\n' + body.trim() + '\n```')
     .replace(/'json\s*\n([\s\S]*?)\n\s*'/g, (_, body) => '```json\n' + body.trim() + '\n```');
 
@@ -914,11 +925,112 @@ export function parseActions(text) {
   return { textParts, actions };
 }
 
+/**
+ * Strip orphan tool-fence blocks from a finished LLM response. These appear
+ * when the model emits an empty `'''json '''` (or backtick-fenced) block
+ * as a no-op marker — the parser doesn't pick them up as actions but they
+ * leak into the UI as visible noise. Run this on the final assistant text
+ * before showing it to the user.
+ */
+export function stripOrphanFences(text) {
+  if (!text || typeof text !== 'string') return text;
+  return text
+    // Triple-backtick, triple-single, triple-double quote fences with `json`
+    // marker — empty or with a body. We strip the whole block.
+    .replace(/```json\s*\n?[\s\S]*?```/g, '')
+    .replace(/'''json\s*\n?[\s\S]*?'''/g, '')
+    .replace(/"""json\s*\n?[\s\S]*?"""/g, '')
+    // Bare action JSON that the parser already consumed but the synthesis
+    // step regurgitated (rare but happens with Liara). Only strip if the
+    // JSON shape matches "action":"...".
+    .replace(/\{\s*"action"\s*:\s*"[^"]+"\s*,?\s*("params"\s*:\s*\{[\s\S]*?\}\s*)?\}/g, '')
+    // Collapse blank-line clusters produced by the stripping.
+    .replace(/\n{3,}/g, '\n\n')
+    .trim();
+}
+
 // ── Formatting Helpers ───────────────────────────────────────────────────────
 
 /**
  * Format an ISO timestamp into a human-readable time string.
  */
+// ── Attachment Parsers (zero-deps, best-effort) ────────────────────────────
+
+/**
+ * Extract text from a PDF buffer using a naïve pattern scan. Catches text
+ * inside `BT ... (text) Tj ... ET` blocks of uncompressed content streams.
+ * Won't work on PDFs whose content streams are FlateDecode-compressed — those
+ * need a real parser (pdfjs-dist). For typical ERP-generated POs/quotes the
+ * content stream is usually plain enough that this catches the line items.
+ */
+function _naivePdfText(buf) {
+  if (!Buffer.isBuffer(buf)) return '';
+  // PDFs can store text in (...) strings, sometimes split across multiple Tj
+  // calls. We collect them all, decode the basic escapes, and join with spaces.
+  const raw = buf.toString('latin1');
+  const out = [];
+  // BT ... ET text blocks. Inside: (text) Tj or [(a)(b)] TJ.
+  const blockRe = /BT[\s\S]*?ET/g;
+  let m;
+  while ((m = blockRe.exec(raw))) {
+    const block = m[0];
+    const strRe = /\(((?:\\.|[^\\)])*)\)/g;
+    let sm;
+    const parts = [];
+    while ((sm = strRe.exec(block))) {
+      const s = sm[1]
+        .replace(/\\n/g, '\n').replace(/\\r/g, '\r').replace(/\\t/g, '\t')
+        .replace(/\\\(/g, '(').replace(/\\\)/g, ')').replace(/\\\\/g, '\\')
+        .replace(/\\([0-7]{1,3})/g, (_, oct) => String.fromCharCode(parseInt(oct, 8)));
+      parts.push(s);
+    }
+    if (parts.length) out.push(parts.join(' '));
+  }
+  // Cleanup: collapse whitespace, drop control chars.
+  return out.join('\n').replace(/[\x00-\x08\x0b\x0c\x0e-\x1f]/g, '').replace(/[ \t]+/g, ' ').trim();
+}
+
+/**
+ * Extract text from a DOCX buffer. DOCX = zip with `word/document.xml`. We
+ * use Node's built-in zlib to decompress the central directory, find the
+ * document.xml entry, decompress it, and pull <w:t>...</w:t> text runs.
+ */
+async function _naiveDocxText(buf) {
+  if (!Buffer.isBuffer(buf)) return '';
+  const zlib = await import('zlib');
+  const { promisify } = await import('util');
+  const inflateRaw = promisify(zlib.inflateRaw);
+  // ZIP local file headers start with 0x504b0304. We scan for them and pick
+  // out the entry whose filename is "word/document.xml".
+  let i = 0;
+  while (i < buf.length - 30) {
+    if (buf.readUInt32LE(i) !== 0x04034b50) { i++; continue; }
+    const compMethod = buf.readUInt16LE(i + 8);
+    const compSize = buf.readUInt32LE(i + 18);
+    const nameLen = buf.readUInt16LE(i + 26);
+    const extraLen = buf.readUInt16LE(i + 28);
+    const name = buf.slice(i + 30, i + 30 + nameLen).toString('utf8');
+    const dataStart = i + 30 + nameLen + extraLen;
+    if (name === 'word/document.xml') {
+      const compData = buf.slice(dataStart, dataStart + compSize);
+      let xml = '';
+      try {
+        if (compMethod === 0) xml = compData.toString('utf8');
+        else if (compMethod === 8) xml = (await inflateRaw(compData)).toString('utf8');
+        else return '';
+      } catch { return ''; }
+      // Extract <w:t>...</w:t> runs (and the xml: space="preserve" variant).
+      const parts = [];
+      const re = /<w:t[^>]*>([\s\S]*?)<\/w:t>/g;
+      let m;
+      while ((m = re.exec(xml))) parts.push(m[1].replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&amp;/g, '&').replace(/&quot;/g, '"').replace(/&apos;/g, "'"));
+      return parts.join(' ').replace(/[ \t]+/g, ' ').trim();
+    }
+    i = dataStart + compSize;
+  }
+  return '';
+}
+
 export function formatTime(isoStr) {
   try {
     const d = new Date(isoStr);
@@ -1325,7 +1437,76 @@ export async function executeTool(action, params, config) {
       imapMarkRead(params.messageId, true);
       const to = (() => { try { const a = JSON.parse(msg.to_addresses || '[]'); return a.map(x => x.address || x).join(', '); } catch { return msg.to_addresses || ''; } })();
       const body = msg.body_reply_only || msg.body_text || msg.body_preview || '(empty)';
-      return `Subject: ${msg.subject}\nFrom: ${msg.from_name ? msg.from_name + ' <' + msg.from_address + '>' : msg.from_address}\nTo: ${to}\nDate: ${msg.internal_date}\n\n${body.slice(0, 3000)}`;
+      // Surface attachments in the tool response so the LLM can decide whether
+      // to follow up with imap_attachment_read. Without this it has no way to
+      // know an attachment exists.
+      const atts = (msg.attachments || []).map((a, i) =>
+        `[${i + 1}] "${a.filename || 'unnamed'}" — ${a.content_type || 'application/octet-stream'} — ${Math.round((a.size_bytes || 0) / 1024)} KB — id:${a.id}`
+      ).join('\n');
+      const attBlock = atts
+        ? `\n\n--- ATTACHMENTS (${msg.attachments.length}) ---\n${atts}\n\nTo read the content of an attachment, call: imap_attachment_read with messageId="${msg.id}" and either filename or index.`
+        : '';
+      return `Subject: ${msg.subject}\nFrom: ${msg.from_name ? msg.from_name + ' <' + msg.from_address + '>' : msg.from_address}\nTo: ${to}\nDate: ${msg.internal_date}\n\n${body.slice(0, 3000)}${attBlock}`;
+    }
+
+    case 'imap_attachment_read': {
+      if (!params.messageId) return 'messageId required. Use imap_read first to get the messageId and the list of attachments.';
+      const { getMessage: imapGetMsgForAtt } = await import('./email-db.mjs');
+      const msg = imapGetMsgForAtt(params.messageId);
+      if (!msg) return 'Message not found.';
+      const attachments = msg.attachments || [];
+      if (!attachments.length) return 'This message has no attachments.';
+      // Resolution: explicit attachmentId > filename match > index > first
+      let chosen = null;
+      if (params.attachmentId) {
+        chosen = attachments.find(a => a.id === params.attachmentId);
+      } else if (params.filename) {
+        const needle = String(params.filename).toLowerCase();
+        chosen = attachments.find(a => (a.filename || '').toLowerCase().includes(needle));
+      } else if (typeof params.index === 'number') {
+        chosen = attachments[Math.max(0, params.index - 1)] || null;
+      }
+      if (!chosen) chosen = attachments[0];
+      if (!chosen) return 'Could not resolve which attachment to read.';
+      const { fetchAttachmentContent } = await import('./email-imap.mjs');
+      let result;
+      try {
+        result = await fetchAttachmentContent(msg.account_id, msg.imap_folder_path, msg.uid, chosen.part_id);
+      } catch (e) {
+        return `Failed to fetch attachment "${chosen.filename}" from server: ${e.message}`;
+      }
+      if (!result?.buffer) return `Attachment "${chosen.filename}" returned no content.`;
+      const buf = result.buffer;
+      const ct = (chosen.content_type || result.contentType || '').toLowerCase();
+      const head = `Attachment: ${chosen.filename}\nType: ${ct || 'unknown'}\nSize: ${Math.round(buf.length / 1024)} KB\n\n`;
+
+      // Text-ish — return up to 10k chars of UTF-8.
+      if (/^text\/|application\/(json|xml|csv|x-yaml)/i.test(ct) || /\.(txt|csv|json|xml|log|md|html)$/i.test(chosen.filename || '')) {
+        return head + buf.toString('utf8').slice(0, 10000);
+      }
+
+      // PDF — naïve text extraction from the raw stream. Catches text-based
+      // PDFs (invoices, purchase orders, quotes generated by ERP software).
+      // Doesn't handle scanned/OCR PDFs — for those the model gets a clear
+      // "image-based PDF" hint so it can ask the user.
+      if (/pdf/i.test(ct) || /\.pdf$/i.test(chosen.filename || '')) {
+        const text = _naivePdfText(buf);
+        if (text && text.length > 30) {
+          return head + `--- Extracted text (best-effort, ${text.length} chars) ---\n${text.slice(0, 10000)}`;
+        }
+        return head + `PDF appears to be image-based or compressed (no extractable text found). ` +
+          `Tell the user the PDF can't be auto-read — they can open it manually or share the relevant section as text.`;
+      }
+
+      // DOCX — minimal text extraction from word/document.xml inside the zip.
+      if (/wordprocessingml|msword/i.test(ct) || /\.docx?$/i.test(chosen.filename || '')) {
+        const text = await _naiveDocxText(buf);
+        if (text) return head + `--- Extracted text (${text.length} chars) ---\n${text.slice(0, 10000)}`;
+        return head + 'Could not extract text from DOCX (possibly malformed or password-protected).';
+      }
+
+      // Unsupported — return metadata only.
+      return head + `Tipo "${ct}" non supportato per lettura automatica. Allegato disponibile nella casella email; chiedi all'utente di condividere il contenuto rilevante come testo.`;
     }
 
     case 'imap_send': {