nothumanallowed 15.1.5 → 15.1.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nothumanallowed",
-  "version": "15.1.5",
+  "version": "15.1.7",
   "description": "NotHumanAllowed — 38 AI agents, 80 tools, Studio (visual agentic workflows). Email, calendar, browser automation, screen capture, canvas, cron/heartbeat, Alexandria E2E messaging, GitHub, Notion, Slack, voice chat, free AI (Liara), 28 languages. Zero-dependency CLI.",
   "type": "module",
   "bin": {

package/src/cli.mjs

@@ -52,12 +52,15 @@ export async function main(argv) {
       }
     }).catch(() => {});
 
-    // npm version check (non-blocking)
+    // npm version check (non-blocking). The one-liner uses --prefer-online to
+    // bypass npm's metadata cache, which is the #1 reason `npm install -g`
+    // appears to "do nothing" — it had stale "latest" in the local cache.
     checkNpmVersion().then(result => {
       if (result?.updateAvailable) {
         console.log('');
         warn(`New NHA version available: ${result.current} → ${result.latest}`);
-        info(`Run "nha update" to upgrade, or: npm cache clean --force && npm install -g nothumanallowed@${result.latest}`);
+        info(`Run "nha update" (recommended — auto-installs npm + agents)`);
+        info(`Or manually: npm cache clean --force && npm install -g nothumanallowed@${result.latest} --prefer-online`);
       }
     }).catch(() => {});
   }

package/src/constants.mjs

@@ -5,7 +5,7 @@ import { fileURLToPath } from 'url';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
-export const VERSION = '15.1.5';
+export const VERSION = '15.1.7';
 export const BASE_URL = 'https://nothumanallowed.com/cli';
 export const API_BASE = 'https://nothumanallowed.com/api/v1';
 

package/src/server/routes/studio.mjs

@@ -11,12 +11,43 @@ import { NHA_DIR, AGENTS_DIR } from '../../constants.mjs';
 import { callLLM, callLLMStream, parseAgentFile } from '../../services/llm.mjs';
 import { webSearch, fetchUrl, fetchUrlRich, headProbe } from '../../services/web-tools.mjs';
 
-// Agents that get web data pre-fetched before their LLM call
+// Agents that get web data pre-fetched (search + URL content) before their LLM call.
+// We err on the side of inclusion: any agent that writes analysis, copy, briefings,
+// or reports benefits from real-time data — without it they hallucinate plausible
+// but generic frameworks. Synthesis-only agents (CanvasAgent, GitHub/Email/Slack
+// connectors) are intentionally excluded.
 const WEB_TOOL_AGENTS = new Set([
-  'WebSearchAgent', 'TravelAgent', 'mercury', 'MERCURY',
-  'athena', 'ATHENA', 'oracle', 'ORACLE', 'cassandra', 'CASSANDRA',
-  'HERALD', 'DataAnalystAgent', 'herald', 'tempest', 'TEMPEST',
-  'epicure', 'EPICURE', 'cartographer', 'CARTOGRAPHER',
+  // Original research/intel set
+  'WebSearchAgent', 'TravelAgent',
+  'MERCURY', 'mercury',
+  'ATHENA',  'athena',
+  'ORACLE',  'oracle',
+  'CASSANDRA', 'cassandra',
+  'HERALD',  'herald',
+  'DataAnalystAgent',
+  'TEMPEST', 'tempest',
+  'EPICURE', 'epicure',
+  'CARTOGRAPHER', 'cartographer',
+  // Analysis & writing — they MUST ground on the target site, not invent.
+  'QUILL', 'quill',
+  'ECHO',  'echo',
+  'MURASAKI', 'murasaki',
+  'SCHEHERAZADE', 'scheherazade',
+  'MUSE', 'muse',
+  // Security / architecture / reasoning — also benefit from grounded context.
+  'FORGE', 'forge',
+  'PROMETHEUS', 'prometheus',
+  'SABER', 'saber',
+  'ADE', 'ade',
+  'ZERO', 'zero',
+  'SAURON', 'sauron',
+  'LOGOS', 'logos',
+  'VERITAS', 'veritas',
+  'LINK', 'link',
+  'NAVI', 'navi',
+  'EDI', 'edi',
+  // Polyglot needs source content to translate accurately.
+  'polyglot',
 ]);
 
 // ── Complete Agent Registry ─────────────────────────────────────────────────
@@ -128,10 +159,142 @@ async function runFetchUrl(url) {
   }
 }
 
-/** Extract HTTP/HTTPS URLs from a free-form string, deduplicated, max 6. */
+/**
+ * Extract URLs from free-form text — robust matcher.
+ *
+ * Catches:
+ *   - Fully-qualified URLs: http(s)://example.com/path
+ *   - Bare domains with www: www.example.com
+ *   - Bare domains without www: example.com, example.it, example.co.uk
+ *   - Markdown-wrapped: [label](example.com) — the URL portion is matched
+ *
+ * Rejects:
+ *   - File extensions misread as domains: image.png, doc.pdf, app.js
+ *   - Single-word tokens without a dot
+ *   - Email addresses (the @ rules out the domain match)
+ *
+ * Returns normalized https:// URLs, deduplicated, max 6.
+ */
+const FILE_EXT_BLOCKLIST = new Set([
+  'png','jpg','jpeg','gif','webp','svg','ico','bmp','tiff',
+  'pdf','doc','docx','xls','xlsx','ppt','pptx','csv','txt','zip','tar','gz','rar','7z',
+  'mp3','mp4','wav','ogg','mov','avi','mkv',
+  'js','css','json','xml','yaml','yml','md','html','htm',
+]);
+
 function extractUrlsFromText(text) {
-  const urls = [...(text || '').matchAll(/https?:\/\/[^\s,)<>"'`]+/gi)].map(m => m[0].replace(/[.,;:!?)\]]+$/, ''));
-  return [...new Set(urls)].slice(0, 6);
+  if (!text) return [];
+  const t = String(text);
+  const found = new Set();
+
+  // Full URLs
+  for (const m of t.matchAll(/https?:\/\/[^\s,)<>"'`]+/gi)) {
+    const clean = m[0].replace(/[.,;:!?)\]]+$/, '');
+    found.add(clean);
+  }
+
+  // Bare domains — TLD of 2..24 letters. Accepts 2-label (apple.com),
+  // 3-label (www.apple.com), and N-label domains.
+  const bareRe = /(?<![\/@\w])(?:www\.)?[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*\.([a-z]{2,24})\b(?:\/[^\s,()<>"'`]*)?/gi;
+  for (const m of t.matchAll(bareRe)) {
+    const candidate = m[0].replace(/[.,;:!?)\]]+$/, '');
+    if (candidate.startsWith('http')) continue;
+    const tld = (m[1] || '').toLowerCase();
+    if (FILE_EXT_BLOCKLIST.has(tld)) continue;
+    if (/^\d+(\.\d+)+$/.test(candidate)) continue;
+    found.add('https://' + candidate);
+  }
+
+  // Dedup: if "https://x.com/path" and "https://www.x.com/path" both present,
+  // keep the longer (more specific) one only.
+  const list = [...found];
+  const filtered = list.filter(url => {
+    const stripped = url.replace(/^https?:\/\/(www\.)?/, '');
+    return !list.some(other =>
+      other !== url &&
+      other.replace(/^https?:\/\/(www\.)?/, '') === stripped &&
+      other.length > url.length,
+    );
+  });
+
+  return filtered.slice(0, 6);
+}
+
+/**
+ * Automatic fallback: when the primary fetch fails, try to gather indirect
+ * intelligence about the domain via web search. Looks for:
+ *   - site:domain.com listings (whatever Google has indexed)
+ *   - "<domain> chi è" / "<domain> azienda settore" — public profiles, news
+ *   - Wikipedia / corporate registries
+ *
+ * Returns up to 3 fetched pages with real content, formatted for ground truth.
+ * Returns null if nothing useful was found.
+ */
+async function gatherIndirectIntel(failedUrl, sse) {
+  try {
+    const parsed = new URL(failedUrl);
+    const domain = parsed.hostname.replace(/^www\./, '');
+    const queries = [
+      `site:${domain}`,
+      `"${domain}" azienda settore prodotti`,
+      `${domain} chi è cosa fa`,
+    ];
+
+    if (sse) sse({ token: `[Fallback: ricerco info indirette su ${domain}...]` });
+
+    const allResults = [];
+    for (const q of queries) {
+      try {
+        const r = await webSearch(q, 5);
+        if (!r.error && Array.isArray(r.results)) {
+          for (const item of r.results) {
+            // Skip if the URL is the same failed domain (we already know it's down)
+            try {
+              const u = new URL(item.url);
+              if (u.hostname.replace(/^www\./, '') === domain) continue;
+            } catch { /* skip invalid URLs */ }
+            allResults.push({ ...item, fromQuery: q });
+          }
+        }
+      } catch { /* skip failed query */ }
+    }
+
+    if (allResults.length === 0) return null;
+
+    // Dedupe by URL, take top 4, fetch them
+    const seen = new Set();
+    const unique = allResults.filter(r => {
+      if (seen.has(r.url)) return false;
+      seen.add(r.url);
+      return true;
+    }).slice(0, 4);
+
+    if (sse) sse({ token: `[Fallback: ${unique.length} fonti indirette trovate, recupero contenuto...]` });
+
+    const fetched = await Promise.all(
+      unique.map(async (r) => {
+        try {
+          const full = await fetchUrlRich(r.url, { maxChars: 4_000, timeout: 8_000 });
+          if (full.error) return null;
+          return {
+            url: r.url,
+            title: full.title || r.title || '',
+            snippet: r.snippet || '',
+            content: (full.body || '').slice(0, 3_000),
+            description: full.metadata?.description || '',
+            fromQuery: r.fromQuery,
+          };
+        } catch { return null; }
+      })
+    );
+
+    const good = fetched.filter(Boolean);
+    if (good.length === 0) return null;
+
+    return good;
+  } catch {
+    return null;
+  }
 }
 
 /**
@@ -373,17 +536,52 @@ ${sanitizeAgentOutput(body.proposalContext).slice(0, 12000)}
             const content = (f.content || '').slice(0, 12_000);
             return `### Content from ${f.url}\n${preamble}${content}`;
           }).join('\n\n---\n\n');
-          webDataBlock = `\n\n## FETCHED WEBSITE CONTENT (THIS IS THE GROUND TRUTH — base your analysis EXCLUSIVELY on this. Do NOT invent products, sectors, brands, or facts that are not in this block.):\n\n${okBlock}`;
+          webDataBlock = `
+
+## ✅ DATI REALI RACCOLTI DAL SITO (GROUND TRUTH — usa SOLO questi)
+
+Quanto segue è il contenuto effettivamente estratto dai siti specificati nel task.
+È OBBLIGATORIO basare l'analisi su questi dati e SOLO su questi. È VIETATO:
+- Inventare il settore, i prodotti, il target o il modello di business.
+- Aggiungere "esempi tipici del settore" o "best practice generiche" senza riferirsi ai dati sopra.
+- Scrivere "da verificare" o "supponiamo che" quando il dato è già presente nel blocco.
+
+${okBlock}`;
         }
 
+        // ── Automatic indirect-intel fallback ──
+        // Search the web for info ABOUT each failed domain (registries, news,
+        // Wikipedia, profiles). This gives the agent grounded data even when
+        // the primary site is down, instead of forcing it to invent a framework.
+        let recoveredAny = false;
         if (failedFetches.length > 0) {
           const failBlock = failedFetches.map(f => `- ${f.url}  →  ${f.code}: ${f.reason}`).join('\n');
-          webDataBlock += `\n\n## ❌ URL NON RAGGIUNGIBILI (NON inventare contenuto su questi siti — scrivi esplicitamente "fonte non disponibile" nelle sezioni che li riguardano):\n${failBlock}`;
+          webDataBlock += `\n\n## ⚠ FONTI PRIMARIE NON DISPONIBILI\n${failBlock}`;
           sse({ data_unavailable: failedFetches.map(f => ({ url: f.url, code: f.code, reason: f.reason })) });
+
+          const indirectBlocks = [];
+          for (const f of failedFetches.slice(0, 3)) {
+            const intel = await gatherIndirectIntel(f.url, sse);
+            if (intel && intel.length > 0) {
+              recoveredAny = true;
+              const block = intel.map(i =>
+                `### ${i.title || '(senza titolo)'}\nURL: ${i.url}\nQuery: "${i.fromQuery}"\n${i.description ? `Descrizione: ${i.description}\n` : ''}\n${i.content}`,
+              ).join('\n\n---\n\n');
+              indirectBlocks.push(`#### Info indirette su ${f.url}:\n\n${block}`);
+            }
+          }
+
+          if (indirectBlocks.length > 0) {
+            webDataBlock += `\n\n## 🔎 FONTI INDIRETTE (raccolte automaticamente perché le fonti primarie sono down)\n\nIl sito principale non è raggiungibile, ma queste fonti pubbliche parlano dello stesso dominio/azienda. **Usa queste informazioni come ground truth** — sono dati reali, non inventati.\n\n${indirectBlocks.join('\n\n---\n\n')}`;
+            sse({ token: '[Fallback: recupero indiretto riuscito, procedo con i dati alternativi.]' });
+          } else {
+            webDataBlock += `\n\nNessuna fonte indiretta utile trovata sul web per i domini sopra. Per le sezioni che riguardano questi URL, scrivi esplicitamente "Fonte non raggiungibile — analisi non eseguibile". NON sostituire con framework generici, esempi tipici, o supposizioni basate sul nome del dominio.`;
+          }
         }
 
-        // Fail-fast: primary research agent and ALL declared URLs failed → abort.
-        if (isPrimaryResearch && okFetches.length === 0 && taskUrls.length > 0) {
+        // Fail-fast: only abort if primary research has NO data AT ALL —
+        // neither primary fetches nor indirect intel recovered anything.
+        if (isPrimaryResearch && okFetches.length === 0 && !recoveredAny && taskUrls.length > 0) {
           clearInterval(keepalive);
           sse({
             aborted: true,

package/src/ui-dist/assets/{index-Chhxajp8.js → index-1ka48YcO.js}

@@ -574,13 +574,13 @@ ${m}
 ${h}
 <div class="footer">NHA Studio · nothumanallowed.com · ${new Date().getFullYear()}</div>
 </body></html>`}function it(e){try{localStorage.setItem(`nha_studio_sessions`,JSON.stringify(e.slice(0,20)))}catch{}}function at(){try{return JSON.parse(localStorage.getItem(`nha_studio_sessions`)??`[]`)}catch{return[]}}var ot=`nha_studio_active`;function st(e){try{sessionStorage.setItem(ot,JSON.stringify(e))}catch{}}function ct(){try{let e=sessionStorage.getItem(ot);return e?JSON.parse(e):null}catch{return null}}function lt(e){let t=[];return{clean:e.replace(/```json\s*\n?\s*\{[^`]*"action"\s*:\s*"canvas_render"[^`]*\}\s*```/g,e=>{try{let n=JSON.parse(e.replace(/```json\s*|\s*```/g,``).trim());n?.params?.html&&t.push(n.params.html)}catch{}return``}).replace(/\{"action"\s*:\s*"canvas_render"[^}]*"html"\s*:\s*"((?:[^"\\]|\\.)*)"/g,e=>{try{let n=JSON.parse(e+`}`);n?.params?.html&&t.push(n.params.html)}catch{try{let n=e.match(/"html"\s*:\s*"((?:[^"\\]|\\.)*?)"/);n&&t.push(JSON.parse(`"`+n[1]+`"`))}catch{}}return``}).trim(),canvasBlocks:t}}function ut(){return T.getState().apiBase}async function dt(e,t,n,r){let i=await fetch(ut()+e,{method:`POST`,headers:{"Content-Type":`application/json`,"x-nha-client":`web-ui`},body:JSON.stringify(t),signal:r});if(!i.ok||!i.body)throw Error(`HTTP ${i.status}`);let a=i.body.getReader(),o=new TextDecoder,s=``;for(;;){let{done:e,value:t}=await a.read();if(e)break;s+=o.decode(t,{stream:!0});let r=s.split(`
-`);s=r.pop()??``;for(let e of r){if(!e.startsWith(`data: `))continue;let t=e.slice(6).trim();if(t===`[DONE]`)return;try{n(JSON.parse(t))}catch{}}}}function ft({label:e,value:t}){let n=Math.round(t*100),r=n>=60?`#22c55e`:n>=30?`#f59e0b`:`#ef4444`;return(0,k.jsxs)(`div`,{className:P.convRow,children:[(0,k.jsx)(`span`,{className:P.convLabel,children:e}),(0,k.jsx)(`div`,{className:P.convTrack,children:(0,k.jsx)(`div`,{className:P.convFill,style:{width:`${n}%`,background:r}})}),(0,k.jsxs)(`span`,{className:P.convPct,style:{color:r},children:[n,`%`]})]})}function pt({council:e}){let[t,n]=(0,_.useState)(null);if(e.skipped)return(0,k.jsxs)(`div`,{className:P.councilSkipped,children:[(0,k.jsx)(`span`,{className:P.councilSkipIcon,children:`🏛️`}),(0,k.jsxs)(`span`,{children:[`Council skipped — `,e.skipReason??`fewer than 2 eligible agents`]})]});let r=e.phase===`r2`?`⚡ Cross-reading & Refinement (Round 2)…`:e.phase===`r3`?`🏛️ HERALD Mediation (Round 3)…`:e.phase===`done`?`✅ Council Consensus Reached`:`🏛️ Council…`,i=e.converged?(0,k.jsx)(`span`,{className:P.councilConvergedBadge,children:`CONSENSUS`}):(0,k.jsx)(`span`,{className:P.councilDivergedBadge,children:`MEDIATED`});return(0,k.jsxs)(`div`,{className:P.councilPanel,children:[(0,k.jsxs)(`div`,{className:P.councilHeader,children:[(0,k.jsxs)(`div`,{className:P.councilHeaderLeft,children:[(0,k.jsx)(`span`,{className:P.councilIcon,children:`🏛️`}),(0,k.jsx)(`span`,{className:P.councilTitle,children:`Council · Geth Consensus`}),e.phase===`done`&&i]}),(0,k.jsx)(`div`,{className:P.councilHeaderRight,children:e.phase!==`idle`&&(0,k.jsx)(`span`,{className:`${P.councilPhaseTag} ${e.phase===`done`?P.councilPhaseDone:P.councilPhaseActive}`,children:r})})]}),(e.r1Convergence>0||e.r2Convergence>0)&&(0,k.jsxs)(`div`,{className:P.councilMetrics,children:[e.r1Convergence>0&&(0,k.jsx)(ft,{label:`Round 1`,value:e.r1Convergence}),e.r2Convergence>0&&(0,k.jsx)(ft,{label:`Round 2`,value:e.r2Convergence})]}),e.r2Nodes.length>0&&(0,k.jsxs)(`div`,{className:P.councilNodes,children:[(0,k.jsx)(`div`,{className:P.councilSectionTitle,children:`Refined Positions (Round 2)`}),e.r2Nodes.map(e=>(0,k.jsxs)(`div`,{className:P.councilNode,children:[(0,k.jsxs)(`button`,{className:P.councilNodeHeader,onClick:()=>n(t===e.agent?null:e.agent),children:[(0,k.jsx)(`span`,{className:P.councilNodeIcon,children:e.icon}),(0,k.jsx)(`span`,{className:P.councilNodeLabel,children:e.label}),(0,k.jsx)(`span`,{className:P.councilNodeToggle,children:t===e.agent?`▲`:`▼`})]}),t===e.agent&&(0,k.jsx)(`div`,{className:P.councilNodeBody,dangerouslySetInnerHTML:{__html:Se(e.output)}})]},e.agent))]}),e.synthesis&&(0,k.jsxs)(`div`,{className:P.councilSynthesis,children:[(0,k.jsxs)(`div`,{className:P.councilSynthesisHeader,children:[(0,k.jsx)(`span`,{className:P.heraldIcon,children:`📰`}),(0,k.jsx)(`span`,{className:P.heraldLabel,children:`HERALD — Final Synthesis`}),e.phase===`r3`&&(0,k.jsx)(`span`,{className:P.heraldStreaming,children:(0,k.jsx)(`span`,{className:`studio-cursor`})})]}),(0,k.jsx)(`div`,{className:P.councilSynthesisBody,dangerouslySetInnerHTML:{__html:Se(e.synthesis)+(e.phase===`r3`?`<span class="studio-cursor"></span>`:``)}})]})]})}function mt(){let e=T(e=>e.setView),t=ct(),[n,r]=(0,_.useState)(t?.task??``),[i,a]=(0,_.useState)(t?.nodes??[]),[o,s]=(0,_.useState)(t?.log??[]),[c,l]=(0,_.useState)(t?.result??``),[u,d]=(0,_.useState)(!1),[f,p]=(0,_.useState)(at),[m,h]=(0,_.useState)(!1),[g,v]=(0,_.useState)(null),[y,b]=(0,_.useState)({in:0,out:0}),[x,S]=(0,_.useState)(t?.canvasHtml??``),[C,w]=(0,_.useState)(t?.council??null),[ee,te]=(0,_.useState)(!1),[ne,E]=(0,_.useState)([]),[D,re]=(0,_.useState)(!1),[ie,O]=(0,_.useState)(`canvas`),[ae,A]=(0,_.useState)(``),[oe,se]=(0,_.useState)(null),ce=(0,_.useRef)(null),le=(0,_.useRef)(null),ue=(0,_.useRef)(null),de=(0,_.useRef)(t?.canvasHtml??``),j=(0,_.useRef)(t?.council??null),M=(0,_.useRef)([]),fe=(0,_.useRef)(null);(0,_.useEffect)(()=>{st({task:n,nodes:i,log:o,result:c,canvasHtml:x,council:C})},[n,i,o,c,x,C]),(0,_.useEffect)(()=>{le.current&&(le.current.scrollTop=le.current.scrollHeight)},[o]),(0,_.useEffect)(()=>{u&&ue.current&&(ue.current.scrollTop=ue.current.scrollHeight)},[i,u]),(0,_.useEffect)(()=>{if(!m)return;let e=e=>{fe.current&&!fe.current.contains(e.target)&&h(!1)};return document.addEventListener(`mousedown`,e),()=>document.removeEventListener(`mousedown`,e)},[m]);let pe=(0,_.useCallback)((e,t,n,r=`agent`)=>{let i=new Date().toLocaleTimeString(`en`,{hour:`2-digit`,minute:`2-digit`,second:`2-digit`,hour12:!1});s(a=>[...a,{agent:e,icon:t,text:n,time:i,type:r}])},[]),me=e=>{if(!e)return;let t=e.name.toLowerCase();if(!t.endsWith(`.pdf`)&&!/\.(png|jpe?g|gif|webp)$/i.test(t)){alert(`Supported: PDF, PNG, JPG, GIF, WEBP`);return}let n=new FileReader;n.onload=t=>v({name:e.name,data:t.target?.result}),n.readAsDataURL(e)},he=async()=>{if(!n.trim()||u)return;d(!0),a([]),s([]),l(``),w(null),j.current=null,b({in:0,out:0}),de.current=``,S(``);let e=new AbortController;ce.current=e;try{let t=[...n.matchAll(/https?:\/\/[^\s,)<>"'`]+/gi)].map(e=>e[0].replace(/[.,;:!?)\]]+$/,``)),r=[...new Set(t)];if(r.length>0){pe(`Studio`,`🩺`,`Smoke-test: ${r.length} URL — verifico raggiungibilità...`,`system`);try{let t=await fetch(ut()+`/api/studio/smoke-test`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({urls:r}),signal:e.signal});if(t.ok){let{probes:e}=await t.json(),n=e.filter(e=>!e.ok);if(n.length>0){pe(`Studio`,`⛔`,`URL non raggiungibili — workflow interrotto:\n${n.map(e=>`• ${e.url} → ${e.status||`NET`} ${e.reason}`).join(`
-`)}`,`error`),pe(`Studio`,`💡`,`Riprova tra qualche minuto, oppure rimuovi l'URL dal task se vuoi un'analisi generale.`,`system`),d(!1);return}pe(`Studio`,`✅`,`Smoke-test: tutti gli URL rispondono.`,`system`)}}catch(e){pe(`Studio`,`⚠`,`Smoke-test non eseguibile: ${e.message}. Continuo, ma potrei trovare URL irraggiungibili durante il run.`,`system`)}}pe(`Studio`,`🎬`,`Planning workflow…`,`system`);let i={task:n.trim()};g&&(i[g.name.endsWith(`.pdf`)?`pdfBase64`:`imageBase64`]=g.data,g.name.endsWith(`.pdf`)&&(i.pdfName=g.name));let o=[];try{let t=await fetch(ut()+`/api/studio/plan`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify(i),signal:e.signal});if(t.ok){let e=await t.json();o=e.steps??e.nodes??[]}}catch{}o.length||(o=[{icon:`🤖`,agent:`general`,label:`Assistant`,status:`waiting`,output:``}]);let s=o.map(e=>({...e,status:`waiting`,output:``}));a(s),pe(`Studio`,`📋`,`${s.length} agents planned: ${s.map(e=>e.label).join(` → `)}`,`system`);let c=``,u=!1,f=[...s],m=[],h=e=>{let t=m.filter(t=>t.agent!==e);return t.length===0?``:t.map(e=>`### ${e.icon} ${e.label} (${e.agent}) ha proposto:\n${e.output.slice(0,6e3)}`).join(`
+`);s=r.pop()??``;for(let e of r){if(!e.startsWith(`data: `))continue;let t=e.slice(6).trim();if(t===`[DONE]`)return;try{n(JSON.parse(t))}catch{}}}}function ft({label:e,value:t}){let n=Math.round(t*100),r=n>=60?`#22c55e`:n>=30?`#f59e0b`:`#ef4444`;return(0,k.jsxs)(`div`,{className:P.convRow,children:[(0,k.jsx)(`span`,{className:P.convLabel,children:e}),(0,k.jsx)(`div`,{className:P.convTrack,children:(0,k.jsx)(`div`,{className:P.convFill,style:{width:`${n}%`,background:r}})}),(0,k.jsxs)(`span`,{className:P.convPct,style:{color:r},children:[n,`%`]})]})}function pt({council:e}){let[t,n]=(0,_.useState)(null);if(e.skipped)return(0,k.jsxs)(`div`,{className:P.councilSkipped,children:[(0,k.jsx)(`span`,{className:P.councilSkipIcon,children:`🏛️`}),(0,k.jsxs)(`span`,{children:[`Council skipped — `,e.skipReason??`fewer than 2 eligible agents`]})]});let r=e.phase===`r2`?`⚡ Cross-reading & Refinement (Round 2)…`:e.phase===`r3`?`🏛️ HERALD Mediation (Round 3)…`:e.phase===`done`?`✅ Council Consensus Reached`:`🏛️ Council…`,i=e.converged?(0,k.jsx)(`span`,{className:P.councilConvergedBadge,children:`CONSENSUS`}):(0,k.jsx)(`span`,{className:P.councilDivergedBadge,children:`MEDIATED`});return(0,k.jsxs)(`div`,{className:P.councilPanel,children:[(0,k.jsxs)(`div`,{className:P.councilHeader,children:[(0,k.jsxs)(`div`,{className:P.councilHeaderLeft,children:[(0,k.jsx)(`span`,{className:P.councilIcon,children:`🏛️`}),(0,k.jsx)(`span`,{className:P.councilTitle,children:`Council · Geth Consensus`}),e.phase===`done`&&i]}),(0,k.jsx)(`div`,{className:P.councilHeaderRight,children:e.phase!==`idle`&&(0,k.jsx)(`span`,{className:`${P.councilPhaseTag} ${e.phase===`done`?P.councilPhaseDone:P.councilPhaseActive}`,children:r})})]}),(e.r1Convergence>0||e.r2Convergence>0)&&(0,k.jsxs)(`div`,{className:P.councilMetrics,children:[e.r1Convergence>0&&(0,k.jsx)(ft,{label:`Round 1`,value:e.r1Convergence}),e.r2Convergence>0&&(0,k.jsx)(ft,{label:`Round 2`,value:e.r2Convergence})]}),e.r2Nodes.length>0&&(0,k.jsxs)(`div`,{className:P.councilNodes,children:[(0,k.jsx)(`div`,{className:P.councilSectionTitle,children:`Refined Positions (Round 2)`}),e.r2Nodes.map(e=>(0,k.jsxs)(`div`,{className:P.councilNode,children:[(0,k.jsxs)(`button`,{className:P.councilNodeHeader,onClick:()=>n(t===e.agent?null:e.agent),children:[(0,k.jsx)(`span`,{className:P.councilNodeIcon,children:e.icon}),(0,k.jsx)(`span`,{className:P.councilNodeLabel,children:e.label}),(0,k.jsx)(`span`,{className:P.councilNodeToggle,children:t===e.agent?`▲`:`▼`})]}),t===e.agent&&(0,k.jsx)(`div`,{className:P.councilNodeBody,dangerouslySetInnerHTML:{__html:Se(e.output)}})]},e.agent))]}),e.synthesis&&(0,k.jsxs)(`div`,{className:P.councilSynthesis,children:[(0,k.jsxs)(`div`,{className:P.councilSynthesisHeader,children:[(0,k.jsx)(`span`,{className:P.heraldIcon,children:`📰`}),(0,k.jsx)(`span`,{className:P.heraldLabel,children:`HERALD — Final Synthesis`}),e.phase===`r3`&&(0,k.jsx)(`span`,{className:P.heraldStreaming,children:(0,k.jsx)(`span`,{className:`studio-cursor`})})]}),(0,k.jsx)(`div`,{className:P.councilSynthesisBody,dangerouslySetInnerHTML:{__html:Se(e.synthesis)+(e.phase===`r3`?`<span class="studio-cursor"></span>`:``)}})]})]})}function mt(){let e=T(e=>e.setView),t=ct(),[n,r]=(0,_.useState)(t?.task??``),[i,a]=(0,_.useState)(t?.nodes??[]),[o,s]=(0,_.useState)(t?.log??[]),[c,l]=(0,_.useState)(t?.result??``),[u,d]=(0,_.useState)(!1),[f,p]=(0,_.useState)(at),[m,h]=(0,_.useState)(!1),[g,v]=(0,_.useState)(null),[y,b]=(0,_.useState)({in:0,out:0}),[x,S]=(0,_.useState)(t?.canvasHtml??``),[C,w]=(0,_.useState)(t?.council??null),[ee,te]=(0,_.useState)(!1),[ne,E]=(0,_.useState)([]),[D,re]=(0,_.useState)(!1),[ie,O]=(0,_.useState)(`canvas`),[ae,A]=(0,_.useState)(``),[oe,se]=(0,_.useState)(null),ce=(0,_.useRef)(null),le=(0,_.useRef)(null),ue=(0,_.useRef)(null),de=(0,_.useRef)(t?.canvasHtml??``),j=(0,_.useRef)(t?.council??null),M=(0,_.useRef)([]),fe=(0,_.useRef)(null);(0,_.useEffect)(()=>{st({task:n,nodes:i,log:o,result:c,canvasHtml:x,council:C})},[n,i,o,c,x,C]),(0,_.useEffect)(()=>{le.current&&(le.current.scrollTop=le.current.scrollHeight)},[o]),(0,_.useEffect)(()=>{u&&ue.current&&(ue.current.scrollTop=ue.current.scrollHeight)},[i,u]),(0,_.useEffect)(()=>{if(!m)return;let e=e=>{fe.current&&!fe.current.contains(e.target)&&h(!1)};return document.addEventListener(`mousedown`,e),()=>document.removeEventListener(`mousedown`,e)},[m]);let pe=(0,_.useCallback)((e,t,n,r=`agent`)=>{let i=new Date().toLocaleTimeString(`en`,{hour:`2-digit`,minute:`2-digit`,second:`2-digit`,hour12:!1});s(a=>[...a,{agent:e,icon:t,text:n,time:i,type:r}])},[]),me=e=>{if(!e)return;let t=e.name.toLowerCase();if(!t.endsWith(`.pdf`)&&!/\.(png|jpe?g|gif|webp)$/i.test(t)){alert(`Supported: PDF, PNG, JPG, GIF, WEBP`);return}let n=new FileReader;n.onload=t=>v({name:e.name,data:t.target?.result}),n.readAsDataURL(e)},he=async()=>{if(!n.trim()||u)return;d(!0),a([]),s([]),l(``),w(null),j.current=null,b({in:0,out:0}),de.current=``,S(``);let e=new AbortController;ce.current=e;try{let t=new Set([`png`,`jpg`,`jpeg`,`gif`,`webp`,`svg`,`ico`,`pdf`,`doc`,`docx`,`xls`,`xlsx`,`zip`,`mp3`,`mp4`,`js`,`css`,`json`,`xml`,`html`,`htm`,`md`,`txt`]),r=new Set;for(let e of n.matchAll(/https?:\/\/[^\s,)<>"'`]+/gi))r.add(e[0].replace(/[.,;:!?)\]]+$/,``));for(let e of n.matchAll(/(?<![\/@\w])(?:www\.)?[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*\.([a-z]{2,24})\b(?:\/[^\s,()<>"'`]*)?/gi)){let n=e[0].replace(/[.,;:!?)\]]+$/,``);if(n.startsWith(`http`))continue;let i=(e[1]||``).toLowerCase();t.has(i)||/^\d+(\.\d+)+$/.test(n)||r.add(`https://`+n)}let i=[...r];if(i.length>0){pe(`Studio`,`🩺`,`Smoke-test: ${i.length} URL — verifico raggiungibilità...`,`system`);try{let t=await fetch(ut()+`/api/studio/smoke-test`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({urls:i}),signal:e.signal});if(t.ok){let{probes:e}=await t.json(),n=e.filter(e=>!e.ok);n.length>0?pe(`Studio`,`⚠`,`URL primari non raggiungibili — proverò fonti indirette via web_search:\n${n.map(e=>`• ${e.url} → ${e.status||`NET`} ${e.reason}`).join(`
+`)}`,`system`):pe(`Studio`,`✅`,`Smoke-test: tutti gli URL rispondono.`,`system`)}}catch(e){pe(`Studio`,`⚠`,`Smoke-test non eseguibile: ${e.message}. Procedo comunque — il backend gestirà i fetch falliti con fallback indiretto.`,`system`)}}pe(`Studio`,`🎬`,`Planning workflow…`,`system`);let o={task:n.trim()};g&&(o[g.name.endsWith(`.pdf`)?`pdfBase64`:`imageBase64`]=g.data,g.name.endsWith(`.pdf`)&&(o.pdfName=g.name));let s=[];try{let t=await fetch(ut()+`/api/studio/plan`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify(o),signal:e.signal});if(t.ok){let e=await t.json();s=e.steps??e.nodes??[]}}catch{}s.length||(s=[{icon:`🤖`,agent:`general`,label:`Assistant`,status:`waiting`,output:``}]);let c=s.map(e=>({...e,status:`waiting`,output:``}));a(c),pe(`Studio`,`📋`,`${c.length} agents planned: ${c.map(e=>e.label).join(` → `)}`,`system`);let u=``,d=!1,f=[...c],m=[],h=e=>{let t=m.filter(t=>t.agent!==e);return t.length===0?``:t.map(e=>`### ${e.icon} ${e.label} (${e.agent}) ha proposto:\n${e.output.slice(0,6e3)}`).join(`
 
 ---
 
-`)},_=e=>e.replace(/<think>[\s\S]*?<\/think>/gi,``).replace(/<tool[^>]*>[\s\S]*?<\/tool>/gi,``).replace(/<scratch[^>]*>[\s\S]*?<\/scratch>/gi,``).replace(/\[(?:Searching|Fetching|GET|POST|Raccolta dati web)[^\]]*\]\s*/gi,``).trim(),v=f.findIndex(e=>/WebSearch|Travel|HERALD|MERCURY|ATHENA|ORACLE|CASSANDRA|TEMPEST|EPICURE|CARTOGRAPHER|DataAnalyst/i.test(e.agent));for(let t=0;t<f.length&&!(e.signal.aborted||u);t++){let r=f[t],i=t===v||v===-1&&t===0;f[t]={...r,status:`running`,output:``,isPrimaryResearch:i},a([...f]),pe(r.label,r.icon,`Running ${r.label}…`,`agent`);let o=``,s,l=null,d=h(r.agent);try{if(await dt(`/api/studio/run`,{stepIdx:t,agent:r.agent,task:n.trim(),stepDef:{prompt:r.reason,isPrimaryResearch:i},isPrimaryResearch:i,context:c.length>12e4?c.slice(-12e4):c,proposalContext:d||void 0,...t===0&&g?g.name.endsWith(`.pdf`)?{pdfBase64:g.data,pdfName:g.name}:{imageBase64:g.data}:{}},e=>{if(e.aborted){l={reason:String(e.reason??`UNKNOWN`),message:String(e.message??`Pipeline interrotta dal backend.`)};return}if(e.data_unavailable){let t=e.data_unavailable;for(let e of t)pe(r.label,`⚠`,`Fonte non raggiungibile: ${e.url} → ${e.code} ${e.reason}`,`error`)}e.done&&e.dataQuality&&(s=e.dataQuality);let n=e.token??e.content??``;n&&(n.startsWith(`[`)&&n.trimEnd().endsWith(`]`)&&!n.includes(`
-`)&&!n.includes(`*`)&&!n.includes(`#`)?(f[t]={...f[t],statusLine:n.replace(/^\[|\]\s*$/g,``)},a([...f])):(f[t]={...f[t],output:(f[t].output||``)+n,statusLine:void 0},o=f[t].output,a([...f])))},e.signal),l){let e=l;f[t]={...f[t],status:`aborted`,output:e.message},a([...f]),pe(r.label,`⛔`,`${e.reason}: ${e.message}`,`error`),i&&(pe(`Studio`,`⛔`,`Primary research fallita — pipeline interrotta per evitare contenuto inventato.`,`error`),u=!0);continue}let{clean:p,canvasBlocks:h}=lt(o),v=p||`(no output)`;f[t]={...f[t],status:`done`,output:v,dataQuality:s},a([...f]);let y=_(v);c+=`\n\n[${r.label}]:\n${y}`,m.push({agent:r.agent,label:r.label,icon:r.icon,output:y});let b=s?.label?` · quality:${s.label}(${Math.round(s.score*100)}%)`:``;if(pe(r.label,r.icon,`Done (${v.length} chars)${b}`,`agent`),i&&s&&s.label===`low`&&s.score<.3&&(pe(`Studio`,`⛔`,`Primary research score ${Math.round(s.score*100)}% — pipeline interrotta. Le sezioni a valle non riceveranno dati attendibili.`,`error`),u=!0),h.length>0){let e=h[h.length-1];de.current=e,S(e),re(!0),O(`canvas`),pe(r.label,r.icon,`Canvas render captured`,`system`)}}catch(n){if(e.signal.aborted)break;f[t]={...f[t],status:`error`,output:n.message??`Error`},a([...f]),pe(r.label,r.icon,`Error: ${n.message}`,`error`)}}let y=f.filter(e=>e.status===`done`&&e.output&&e.output!==`(no output)`&&![`CanvasAgent`,`GitHubAgent`,`EmailAgent`,`CalendarAgent`].includes(e.agent)&&(!e.dataQuality||e.dataQuality.label!==`low`));!u&&y.length>=2?(M.current=y,E(y),pe(`Consiglio`,`🏛️`,`${y.length} agenti — avvio deliberazione automatica (cross-reading + sintesi)`,`system`),await _e()):u?pe(`Consiglio`,`ℹ️`,`Deliberazione saltata — pipeline interrotta prima del completamento`,`system`):pe(`Studio`,`ℹ️`,`Deliberazione saltata — meno di 2 agenti specialisti con dati attendibili`,`system`);let b=j.current,x=f.filter(e=>e.output&&e.output!==`(no output)`).map(e=>`## ${e.icon} ${e.label}\n\n${e.output}`).join(`
+`)},_=e=>e.replace(/<think>[\s\S]*?<\/think>/gi,``).replace(/<tool[^>]*>[\s\S]*?<\/tool>/gi,``).replace(/<scratch[^>]*>[\s\S]*?<\/scratch>/gi,``).replace(/\[(?:Searching|Fetching|GET|POST|Raccolta dati web)[^\]]*\]\s*/gi,``).trim(),v=f.findIndex(e=>/WebSearch|Travel|HERALD|MERCURY|ATHENA|ORACLE|CASSANDRA|TEMPEST|EPICURE|CARTOGRAPHER|DataAnalyst/i.test(e.agent));for(let t=0;t<f.length&&!(e.signal.aborted||d);t++){let r=f[t],i=t===v||v===-1&&t===0;f[t]={...r,status:`running`,output:``,isPrimaryResearch:i},a([...f]),pe(r.label,r.icon,`Running ${r.label}…`,`agent`);let o=``,s,c=null,l=h(r.agent);try{if(await dt(`/api/studio/run`,{stepIdx:t,agent:r.agent,task:n.trim(),stepDef:{prompt:r.reason,isPrimaryResearch:i},isPrimaryResearch:i,context:u.length>12e4?u.slice(-12e4):u,proposalContext:l||void 0,...t===0&&g?g.name.endsWith(`.pdf`)?{pdfBase64:g.data,pdfName:g.name}:{imageBase64:g.data}:{}},e=>{if(e.aborted){c={reason:String(e.reason??`UNKNOWN`),message:String(e.message??`Pipeline interrotta dal backend.`)};return}if(e.data_unavailable){let t=e.data_unavailable;for(let e of t)pe(r.label,`⚠`,`Fonte non raggiungibile: ${e.url} → ${e.code} ${e.reason}`,`error`)}e.done&&e.dataQuality&&(s=e.dataQuality);let n=e.token??e.content??``;n&&(n.startsWith(`[`)&&n.trimEnd().endsWith(`]`)&&!n.includes(`
+`)&&!n.includes(`*`)&&!n.includes(`#`)?(f[t]={...f[t],statusLine:n.replace(/^\[|\]\s*$/g,``)},a([...f])):(f[t]={...f[t],output:(f[t].output||``)+n,statusLine:void 0},o=f[t].output,a([...f])))},e.signal),c){let e=c;f[t]={...f[t],status:`aborted`,output:e.message},a([...f]),pe(r.label,`⛔`,`${e.reason}: ${e.message}`,`error`),i&&(pe(`Studio`,`⛔`,`Primary research fallita — pipeline interrotta per evitare contenuto inventato.`,`error`),d=!0);continue}let{clean:p,canvasBlocks:h}=lt(o),v=p||`(no output)`;f[t]={...f[t],status:`done`,output:v,dataQuality:s},a([...f]);let y=_(v);u+=`\n\n[${r.label}]:\n${y}`,m.push({agent:r.agent,label:r.label,icon:r.icon,output:y});let b=s?.label?` · quality:${s.label}(${Math.round(s.score*100)}%)`:``;if(pe(r.label,r.icon,`Done (${v.length} chars)${b}`,`agent`),i&&s&&s.label===`low`&&s.score<.3&&(pe(`Studio`,`⛔`,`Primary research score ${Math.round(s.score*100)}% — pipeline interrotta. Le sezioni a valle non riceveranno dati attendibili.`,`error`),d=!0),h.length>0){let e=h[h.length-1];de.current=e,S(e),re(!0),O(`canvas`),pe(r.label,r.icon,`Canvas render captured`,`system`)}}catch(n){if(e.signal.aborted)break;f[t]={...f[t],status:`error`,output:n.message??`Error`},a([...f]),pe(r.label,r.icon,`Error: ${n.message}`,`error`)}}let y=f.filter(e=>e.status===`done`&&e.output&&e.output!==`(no output)`&&![`CanvasAgent`,`GitHubAgent`,`EmailAgent`,`CalendarAgent`].includes(e.agent)&&(!e.dataQuality||e.dataQuality.label!==`low`));!d&&y.length>=2?(M.current=y,E(y),pe(`Consiglio`,`🏛️`,`${y.length} agenti — avvio deliberazione automatica (cross-reading + sintesi)`,`system`),await _e()):d?pe(`Consiglio`,`ℹ️`,`Deliberazione saltata — pipeline interrotta prima del completamento`,`system`):pe(`Studio`,`ℹ️`,`Deliberazione saltata — meno di 2 agenti specialisti con dati attendibili`,`system`);let b=j.current,x=f.filter(e=>e.output&&e.output!==`(no output)`).map(e=>`## ${e.icon} ${e.label}\n\n${e.output}`).join(`
 
 ---
 

package/src/ui-dist/index.html

@@ -8,7 +8,7 @@
     <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>NHA — NotHumanAllowed</title>
-    <script type="module" crossorigin src="/assets/index-Chhxajp8.js"></script>
+    <script type="module" crossorigin src="/assets/index-1ka48YcO.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-DnJMrYkq.css">
   </head>
   <body>

package/src/updater.mjs

@@ -87,17 +87,95 @@ function compareSemver(a, b) {
 }
 
 /**
- * Full update: re-download core files + agents.
+ * Detect whether the current `nha` binary is reachable from multiple PATH
+ * locations. This is the classic "I ran npm install -g but nothing changed"
+ * trap on macOS where a system-wide /usr/local/bin/nha shadows a user-space
+ * ~/.npm-global/bin/nha (or vice versa).
+ */
+async function detectDuplicateInstall() {
+  try {
+    const { execSync } = await import('child_process');
+    const out = execSync('which -a nha 2>/dev/null', { encoding: 'utf-8' });
+    const paths = out.split('\n').map(s => s.trim()).filter(Boolean);
+    return paths.length > 1 ? paths : null;
+  } catch { return null; }
+}
+
+/**
+ * Run `npm install -g nothumanallowed@latest` from inside the CLI itself.
+ * Uses --prefer-online to defeat npm's metadata cache, which is the usual
+ * culprit when the user already ran "npm install -g nothumanallowed" but got
+ * an older version because the manifest in cache was stale.
+ */
+async function npmSelfInstall(targetVersion) {
+  const { spawn } = await import('child_process');
+  return new Promise((resolve) => {
+    info(`Installing nothumanallowed@${targetVersion} via npm (this may take 10-30s)...`);
+    const args = [
+      'install', '-g', `nothumanallowed@${targetVersion}`,
+      '--registry=https://registry.npmjs.org/',
+      '--prefer-online',
+      '--no-fund',
+      '--no-audit',
+    ];
+    const child = spawn('npm', args, { stdio: 'inherit' });
+    child.on('exit', (code) => resolve(code === 0));
+    child.on('error', (err) => {
+      warn(`npm spawn failed: ${err.message}`);
+      resolve(false);
+    });
+  });
+}
+
+/**
+ * Full update: re-download core files + agents + self-upgrade the npm package.
  */
 export async function runUpdate() {
   info('Checking for updates...');
 
+  // ── npm package self-update ────────────────────────────────────────────
+  // Done FIRST so the freshly installed version applies on the next invocation.
+  // We bypass npm's metadata cache (--prefer-online) because that's the
+  // single most common reason "I just installed and it's still old".
+  let npmUpdated = false;
+  const npmCheck = await checkNpmVersion();
+  if (npmCheck?.updateAvailable) {
+    info(`npm package: ${npmCheck.current} → ${npmCheck.latest}`);
+    // Clean the local manifest cache first — defeats the stale-cache trap.
+    try {
+      const { execSync } = await import('child_process');
+      execSync('npm cache clean --force', { stdio: 'pipe' });
+    } catch { /* non-fatal */ }
+
+    const ok2 = await npmSelfInstall(npmCheck.latest);
+    if (ok2) {
+      ok(`npm package upgraded to ${npmCheck.latest}`);
+      npmUpdated = true;
+
+      // Detect duplicate global installs — common on macOS.
+      const dups = await detectDuplicateInstall();
+      if (dups && dups.length > 1) {
+        warn('Multiple nha installations detected on PATH:');
+        for (const p of dups) console.log(`    ${p}`);
+        warn('Only the FIRST in PATH is what your shell will run. If the version still');
+        warn('appears unchanged, remove the older one (e.g. `sudo rm /usr/local/bin/nha`)');
+        warn('or reorder your PATH so the newer install is found first.');
+      }
+    } else {
+      warn('npm install failed. Run manually:');
+      console.log(`    npm cache clean --force && npm install -g nothumanallowed@${npmCheck.latest} --prefer-online`);
+    }
+  } else if (npmCheck) {
+    ok(`npm package nothumanallowed@${npmCheck.current} (up to date)`);
+  }
+
+  // ── Agents + Legion + PIF (downloaded from website, not npm) ───────────
   const res = await fetch(`${BASE_URL}/versions.json`, {
     signal: AbortSignal.timeout(15000),
     headers: { 'User-Agent': 'nha-cli/1.0.0' },
   });
   if (!res.ok) {
-    warn('Could not reach nothumanallowed.com');
+    warn('Could not reach nothumanallowed.com for agent updates.');
     return;
   }
 
@@ -112,7 +190,7 @@ export async function runUpdate() {
   const pifCurrent = local['pif']?.latest ?? '?';
   const pifLatest = remote['pif']?.latest ?? '?';
 
-  let updated = false;
+  let updated = npmUpdated;
 
   // Update Legion
   if (legionCurrent !== legionLatest) {