nothumanallowed 15.1.48 → 15.1.49

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nothumanallowed",
-  "version": "15.1.48",
+  "version": "15.1.49",
   "description": "NotHumanAllowed — 38 AI agents, 80 tools, Studio (visual agentic workflows). Email, calendar, browser automation, screen capture, canvas, cron/heartbeat, Alexandria E2E messaging, GitHub, Notion, Slack, voice chat, free AI (Liara), 28 languages. Zero-dependency CLI.",
   "type": "module",
   "bin": {

package/src/constants.mjs

@@ -5,7 +5,7 @@ import { fileURLToPath } from 'url';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
-export const VERSION = '15.1.48';
+export const VERSION = '15.1.49';
 export const BASE_URL = 'https://nothumanallowed.com/cli';
 export const API_BASE = 'https://nothumanallowed.com/api/v1';
 

package/src/server/routes/chat.mjs

@@ -425,10 +425,29 @@ export function register(router) {
         const synthesisPrompt = `${enrichedPrompt}\n\n## DATA FROM TOOLS:\n${toolContext}\n\n## STRICT OUTPUT RULES:\n- Write ONLY plain prose or markdown (headers, bullets, bold)\n- NEVER use \`\`\`json, \`\`\`data, or any fenced code block containing data\n- NEVER output raw JSON, arrays, or objects\n- Format numbers/prices as plain text (e.g. "Bitcoin: $103,000")\n- Be concise and human-readable`;
         const synthesisMsg = `${effectiveMsg}\n\nAnswer using ONLY the data above. Plain text/markdown only — zero JSON, zero code blocks.`;
         sse('tool_synthesis', {});
-        fullResponse = '';
-        fullResponse = await callLLMStream(config, synthesisPrompt, synthesisMsg, (chunk) => {
-          sse('token', { content: chunk });
-        });
+        // Keep the pre-synthesis prose around. If the synthesis call returns
+        // empty (provider error, content filter, model bailed), we fall back
+        // to "first-round prose + raw tool output" so the user never sees a
+        // blank message and can still read what the tools returned.
+        const preSynthesis = fullResponse;
+        let synthesized = '';
+        try {
+          synthesized = await callLLMStream(config, synthesisPrompt, synthesisMsg, (chunk) => {
+            sse('token', { content: chunk });
+          });
+        } catch (synthErr) {
+          sse('error', { message: `Synthesis failed: ${synthErr.message}` });
+        }
+        if (synthesized && synthesized.trim()) {
+          fullResponse = synthesized;
+        } else {
+          // Fallback: stream the raw tool context so the user gets the data
+          // even when the LLM round failed silently.
+          const fallback = (preSynthesis && preSynthesis.trim() ? preSynthesis.trim() + '\n\n' : '') +
+            toolResults.map(t => `**${t.action}**\n${cleanResult(t.action, t.result)}`).join('\n\n');
+          sse('token', { content: fallback });
+          fullResponse = fallback;
+        }
       }
 
       // Strip orphan tool-fence blocks that the LLM may have emitted as

package/src/services/tool-executor.mjs

@@ -455,7 +455,15 @@ TOOLS:
     Only call this if you need to refresh or the section is missing.
 
 66. imap_read(messageId: string)
-    Read a full email message from the local DB by its id. Returns subject, from, to, body_text, body_html, attachments.
+    Read a full email message from the local DB by its id. Returns subject, from, to, body_text, body_html, and a numbered ATTACHMENTS list.
+    If the email has attachments, follow up with imap_attachment_read to read each one's content.
+
+66b. imap_attachment_read(messageId: string, filename?: string, index?: number, attachmentId?: string)
+    Download and parse an attachment of a given email. messageId is required; pick the attachment by filename (substring match,
+    case-insensitive), 1-based index, or attachmentId (exact). Returns extracted text for PDF (text-based POs/quotes/invoices),
+    DOCX (Word), and any text/* type. For image-based PDFs or unsupported binary types, returns metadata and instructs the
+    user to share the relevant section as text. Use this whenever the user says "leggi l'allegato", "read the attachment",
+    "estrai dati dall'allegato", "what's in the PDF", etc.
 
 67. imap_send(accountId: string, to: string, subject: string, bodyHtml: string, cc?: string, inReplyTo?: string)
     Send an email via SMTP from a configured IMAP account. ALWAYS confirm with user before sending.
@@ -946,6 +954,83 @@ export function stripOrphanFences(text) {
 /**
  * Format an ISO timestamp into a human-readable time string.
  */
+// ── Attachment Parsers (zero-deps, best-effort) ────────────────────────────
+
+/**
+ * Extract text from a PDF buffer using a naïve pattern scan. Catches text
+ * inside `BT ... (text) Tj ... ET` blocks of uncompressed content streams.
+ * Won't work on PDFs whose content streams are FlateDecode-compressed — those
+ * need a real parser (pdfjs-dist). For typical ERP-generated POs/quotes the
+ * content stream is usually plain enough that this catches the line items.
+ */
+function _naivePdfText(buf) {
+  if (!Buffer.isBuffer(buf)) return '';
+  // PDFs can store text in (...) strings, sometimes split across multiple Tj
+  // calls. We collect them all, decode the basic escapes, and join with spaces.
+  const raw = buf.toString('latin1');
+  const out = [];
+  // BT ... ET text blocks. Inside: (text) Tj or [(a)(b)] TJ.
+  const blockRe = /BT[\s\S]*?ET/g;
+  let m;
+  while ((m = blockRe.exec(raw))) {
+    const block = m[0];
+    const strRe = /\(((?:\\.|[^\\)])*)\)/g;
+    let sm;
+    const parts = [];
+    while ((sm = strRe.exec(block))) {
+      const s = sm[1]
+        .replace(/\\n/g, '\n').replace(/\\r/g, '\r').replace(/\\t/g, '\t')
+        .replace(/\\\(/g, '(').replace(/\\\)/g, ')').replace(/\\\\/g, '\\')
+        .replace(/\\([0-7]{1,3})/g, (_, oct) => String.fromCharCode(parseInt(oct, 8)));
+      parts.push(s);
+    }
+    if (parts.length) out.push(parts.join(' '));
+  }
+  // Cleanup: collapse whitespace, drop control chars.
+  return out.join('\n').replace(/[\x00-\x08\x0b\x0c\x0e-\x1f]/g, '').replace(/[ \t]+/g, ' ').trim();
+}
+
+/**
+ * Extract text from a DOCX buffer. DOCX = zip with `word/document.xml`. We
+ * use Node's built-in zlib to decompress the central directory, find the
+ * document.xml entry, decompress it, and pull <w:t>...</w:t> text runs.
+ */
+async function _naiveDocxText(buf) {
+  if (!Buffer.isBuffer(buf)) return '';
+  const zlib = await import('zlib');
+  const { promisify } = await import('util');
+  const inflateRaw = promisify(zlib.inflateRaw);
+  // ZIP local file headers start with 0x504b0304. We scan for them and pick
+  // out the entry whose filename is "word/document.xml".
+  let i = 0;
+  while (i < buf.length - 30) {
+    if (buf.readUInt32LE(i) !== 0x04034b50) { i++; continue; }
+    const compMethod = buf.readUInt16LE(i + 8);
+    const compSize = buf.readUInt32LE(i + 18);
+    const nameLen = buf.readUInt16LE(i + 26);
+    const extraLen = buf.readUInt16LE(i + 28);
+    const name = buf.slice(i + 30, i + 30 + nameLen).toString('utf8');
+    const dataStart = i + 30 + nameLen + extraLen;
+    if (name === 'word/document.xml') {
+      const compData = buf.slice(dataStart, dataStart + compSize);
+      let xml = '';
+      try {
+        if (compMethod === 0) xml = compData.toString('utf8');
+        else if (compMethod === 8) xml = (await inflateRaw(compData)).toString('utf8');
+        else return '';
+      } catch { return ''; }
+      // Extract <w:t>...</w:t> runs (and the xml: space="preserve" variant).
+      const parts = [];
+      const re = /<w:t[^>]*>([\s\S]*?)<\/w:t>/g;
+      let m;
+      while ((m = re.exec(xml))) parts.push(m[1].replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&amp;/g, '&').replace(/&quot;/g, '"').replace(/&apos;/g, "'"));
+      return parts.join(' ').replace(/[ \t]+/g, ' ').trim();
+    }
+    i = dataStart + compSize;
+  }
+  return '';
+}
+
 export function formatTime(isoStr) {
   try {
     const d = new Date(isoStr);
@@ -1352,7 +1437,76 @@ export async function executeTool(action, params, config) {
       imapMarkRead(params.messageId, true);
       const to = (() => { try { const a = JSON.parse(msg.to_addresses || '[]'); return a.map(x => x.address || x).join(', '); } catch { return msg.to_addresses || ''; } })();
       const body = msg.body_reply_only || msg.body_text || msg.body_preview || '(empty)';
-      return `Subject: ${msg.subject}\nFrom: ${msg.from_name ? msg.from_name + ' <' + msg.from_address + '>' : msg.from_address}\nTo: ${to}\nDate: ${msg.internal_date}\n\n${body.slice(0, 3000)}`;
+      // Surface attachments in the tool response so the LLM can decide whether
+      // to follow up with imap_attachment_read. Without this it has no way to
+      // know an attachment exists.
+      const atts = (msg.attachments || []).map((a, i) =>
+        `[${i + 1}] "${a.filename || 'unnamed'}" — ${a.content_type || 'application/octet-stream'} — ${Math.round((a.size_bytes || 0) / 1024)} KB — id:${a.id}`
+      ).join('\n');
+      const attBlock = atts
+        ? `\n\n--- ATTACHMENTS (${msg.attachments.length}) ---\n${atts}\n\nTo read the content of an attachment, call: imap_attachment_read with messageId="${msg.id}" and either filename or index.`
+        : '';
+      return `Subject: ${msg.subject}\nFrom: ${msg.from_name ? msg.from_name + ' <' + msg.from_address + '>' : msg.from_address}\nTo: ${to}\nDate: ${msg.internal_date}\n\n${body.slice(0, 3000)}${attBlock}`;
+    }
+
+    case 'imap_attachment_read': {
+      if (!params.messageId) return 'messageId required. Use imap_read first to get the messageId and the list of attachments.';
+      const { getMessage: imapGetMsgForAtt } = await import('./email-db.mjs');
+      const msg = imapGetMsgForAtt(params.messageId);
+      if (!msg) return 'Message not found.';
+      const attachments = msg.attachments || [];
+      if (!attachments.length) return 'This message has no attachments.';
+      // Resolution: explicit attachmentId > filename match > index > first
+      let chosen = null;
+      if (params.attachmentId) {
+        chosen = attachments.find(a => a.id === params.attachmentId);
+      } else if (params.filename) {
+        const needle = String(params.filename).toLowerCase();
+        chosen = attachments.find(a => (a.filename || '').toLowerCase().includes(needle));
+      } else if (typeof params.index === 'number') {
+        chosen = attachments[Math.max(0, params.index - 1)] || null;
+      }
+      if (!chosen) chosen = attachments[0];
+      if (!chosen) return 'Could not resolve which attachment to read.';
+      const { fetchAttachmentContent } = await import('./email-imap.mjs');
+      let result;
+      try {
+        result = await fetchAttachmentContent(msg.account_id, msg.imap_folder_path, msg.uid, chosen.part_id);
+      } catch (e) {
+        return `Failed to fetch attachment "${chosen.filename}" from server: ${e.message}`;
+      }
+      if (!result?.buffer) return `Attachment "${chosen.filename}" returned no content.`;
+      const buf = result.buffer;
+      const ct = (chosen.content_type || result.contentType || '').toLowerCase();
+      const head = `Attachment: ${chosen.filename}\nType: ${ct || 'unknown'}\nSize: ${Math.round(buf.length / 1024)} KB\n\n`;
+
+      // Text-ish — return up to 10k chars of UTF-8.
+      if (/^text\/|application\/(json|xml|csv|x-yaml)/i.test(ct) || /\.(txt|csv|json|xml|log|md|html)$/i.test(chosen.filename || '')) {
+        return head + buf.toString('utf8').slice(0, 10000);
+      }
+
+      // PDF — naïve text extraction from the raw stream. Catches text-based
+      // PDFs (invoices, purchase orders, quotes generated by ERP software).
+      // Doesn't handle scanned/OCR PDFs — for those the model gets a clear
+      // "image-based PDF" hint so it can ask the user.
+      if (/pdf/i.test(ct) || /\.pdf$/i.test(chosen.filename || '')) {
+        const text = _naivePdfText(buf);
+        if (text && text.length > 30) {
+          return head + `--- Extracted text (best-effort, ${text.length} chars) ---\n${text.slice(0, 10000)}`;
+        }
+        return head + `PDF appears to be image-based or compressed (no extractable text found). ` +
+          `Tell the user the PDF can't be auto-read — they can open it manually or share the relevant section as text.`;
+      }
+
+      // DOCX — minimal text extraction from word/document.xml inside the zip.
+      if (/wordprocessingml|msword/i.test(ct) || /\.docx?$/i.test(chosen.filename || '')) {
+        const text = await _naiveDocxText(buf);
+        if (text) return head + `--- Extracted text (${text.length} chars) ---\n${text.slice(0, 10000)}`;
+        return head + 'Could not extract text from DOCX (possibly malformed or password-protected).';
+      }
+
+      // Unsupported — return metadata only.
+      return head + `Tipo "${ct}" non supportato per lettura automatica. Allegato disponibile nella casella email; chiedi all'utente di condividere il contenuto rilevante come testo.`;
     }
 
     case 'imap_send': {