nothumanallowed 15.1.61 → 15.1.63

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nothumanallowed",
-  "version": "15.1.61",
+  "version": "15.1.63",
   "description": "NotHumanAllowed — 38 AI agents, 80 tools, Studio (visual agentic workflows). Email, calendar, browser automation, screen capture, canvas, cron/heartbeat, Alexandria E2E messaging, GitHub, Notion, Slack, voice chat, free AI (Liara), 28 languages. Zero-dependency CLI.",
   "type": "module",
   "bin": {

package/src/constants.mjs

@@ -5,7 +5,7 @@ import { fileURLToPath } from 'url';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
-export const VERSION = '15.1.61';
+export const VERSION = '15.1.63';
 export const BASE_URL = 'https://nothumanallowed.com/cli';
 export const API_BASE = 'https://nothumanallowed.com/api/v1';
 

package/src/services/message-responder.mjs

@@ -9,7 +9,7 @@
  */
 
 import { callAgent, callLLM } from './llm.mjs';
-import { buildSystemPrompt, parseActions, executeTool, TOOL_DEFINITIONS, LIARA_TOOL_DEFINITIONS } from './tool-executor.mjs';
+import { buildSystemPrompt, parseActions, executeTool, TOOL_DEFINITIONS, LIARA_TOOL_DEFINITIONS, DESTRUCTIVE_ACTIONS } from './tool-executor.mjs';
 import https from 'https';
 import http from 'http';
 import { URL } from 'url';
@@ -1045,7 +1045,19 @@ class TelegramResponder {
         // appointments of May". By running the calendar tool server-side, the
         // user always sees REAL data — never fabricated.
         this._lastDirectAuditChatId = chatId;
-        const directFresh = await this._tryDirectFreshCalendarAction(cleanText, this.config);
+        // Run the per-domain direct-action dispatcher. First match wins; falls
+        // through to LLM if no handler claims the message.
+        // Fast-path specialised handlers (regex-driven, lower latency for the
+        // common cases), then the universal dispatcher that covers ALL 50+
+        // mutation tools via a single LLM-NLU+deterministic-execute pass.
+        const directFresh =
+          await this._tryDirectFreshCalendarAction(cleanText, this.config) ||
+          await this._tryDirectFreshEmailAction(cleanText, this.config) ||
+          await this._tryDirectFreshTaskAction(cleanText, this.config) ||
+          await this._tryDirectFreshNoteAction(cleanText, this.config) ||
+          await this._tryDirectFreshReminderAction(cleanText, this.config) ||
+          await this._tryDirectFreshSlackAction(cleanText, this.config) ||
+          await this._tryDirectFreshUniversalAction(cleanText, this.config);
         if (directFresh) {
           this.log(`[Telegram] ${fromUser}: direct-fresh ${directFresh.action} → ${directFresh.success ? 'OK' : 'FAIL'}`);
           const personaName = this.config.responder?.telegram?.botName || this.config.responder?.botName || '';
@@ -1407,6 +1419,429 @@ class TelegramResponder {
     return `${parseInt(m[3], 10)} ${months[parseInt(m[2], 10) - 1]} ${m[1]}`;
   }
 
+  /** Add N minutes to an ISO datetime string. Returns ISO. */
+  _addMinutesIso(isoStart, minutes) {
+    try {
+      const d = new Date(isoStart);
+      d.setMinutes(d.getMinutes() + minutes);
+      return d.toISOString();
+    } catch { return isoStart; }
+  }
+
+  /**
+   * NLU only — extract structured calendar-create params from a natural
+   * language message using a tiny LLM call. We pin output to strict JSON and
+   * accept the result only if the title + start datetime are present.
+   * The LLM NEVER executes anything — it only parses.
+   */
+  async _nluExtractCalendarCreate(userMessage, config) {
+    const todayIso = new Date().toISOString().slice(0, 10);
+    const sysPrompt =
+      `You extract calendar event parameters from natural language.\n` +
+      `Today is ${todayIso}. Output ONLY a JSON object with these keys:\n` +
+      `  - title (string, the event subject, NOT including verbs like "fissa"/"crea")\n` +
+      `  - start (string, ISO datetime "YYYY-MM-DDTHH:MM:00" in local time)\n` +
+      `  - end   (string, ISO datetime same format; if duration unknown, leave null and default 60 min will be applied)\n` +
+      `  - description (string, optional notes)\n` +
+      `Rules: if a field is missing, use null. If the user says "domani" → ${this._addDaysIso(todayIso, 1).slice(0, 10)}. ` +
+      `If "lunedì/martedì/..." resolve to the next occurrence. If no time is given default to 09:00. ` +
+      `Output ONLY the JSON, no prose.`;
+    try {
+      const raw = await callLLM(config, sysPrompt, userMessage, { temperature: 0, maxTokens: 200 });
+      const json = this._extractJsonObject(raw);
+      if (!json) return null;
+      if (!json.title || !json.start) return null;
+      // Sanity: start must look like an ISO datetime.
+      if (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}/.test(json.start)) return null;
+      return json;
+    } catch { return null; }
+  }
+
+  async _nluExtractCalendarMove(userMessage, config) {
+    const todayIso = new Date().toISOString().slice(0, 10);
+    const sysPrompt =
+      `You extract reschedule-event parameters from natural language.\n` +
+      `Today is ${todayIso}. Output ONLY a JSON object:\n` +
+      `  - title (string, the event to find and move)\n` +
+      `  - oldDate (string, original date if mentioned, format "YYYY-MM-DD"; else null)\n` +
+      `  - newStart (string, NEW datetime "YYYY-MM-DDTHH:MM:00")\n` +
+      `  - newEnd (string, optional, same format)\n` +
+      `If "domani" → ${this._addDaysIso(todayIso, 1).slice(0, 10)}. Output JSON only.`;
+    try {
+      const raw = await callLLM(config, sysPrompt, userMessage, { temperature: 0, maxTokens: 200 });
+      const json = this._extractJsonObject(raw);
+      if (!json) return null;
+      if (!json.newStart) return null;
+      if (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}/.test(json.newStart)) return null;
+      return json;
+    } catch { return null; }
+  }
+
+  /** Robust JSON object extractor — strips fences, finds the first balanced {...}. */
+  _extractJsonObject(text) {
+    if (!text) return null;
+    const cleaned = String(text).replace(/```(?:json)?\s*/gi, '').replace(/```/g, '').trim();
+    const start = cleaned.indexOf('{');
+    if (start < 0) return null;
+    let depth = 0, end = -1, inStr = false, esc = false;
+    for (let i = start; i < cleaned.length; i++) {
+      const c = cleaned[i];
+      if (esc) { esc = false; continue; }
+      if (c === '\\' && inStr) { esc = true; continue; }
+      if (c === '"' && !esc) inStr = !inStr;
+      if (inStr) continue;
+      if (c === '{') depth++;
+      else if (c === '}') { depth--; if (depth === 0) { end = i; break; } }
+    }
+    if (end < 0) return null;
+    try { return JSON.parse(cleaned.slice(start, end + 1)); } catch { return null; }
+  }
+
+  _addDaysIso(isoDate, days) {
+    const d = new Date(isoDate + 'T00:00:00');
+    d.setDate(d.getDate() + days);
+    return d.toISOString();
+  }
+
+  // ── Direct fresh EMAIL action (LLM only for NLU, executor server-side) ──
+  // Detects "manda email a X riguardo Y" style requests, extracts recipient
+  // + subject + body via a tiny LLM call, then sends via gmail_send tool.
+  async _tryDirectFreshEmailAction(userMessage, config) {
+    if (!userMessage || typeof userMessage !== 'string') return null;
+    const lower = userMessage.toLowerCase();
+    const isEmailSend = /\b(manda|mand[oa]|invi[oa]|spedis(ci|co)|scriv[io]|send|email\s+to|mail\s+to)\s+(?:un'?\s+)?(email|mail|messaggio|messag|e-?mail)\s+/i.test(lower)
+                     || /\b(invi[oa]r[ea]|mand[ao]|spedire)\s+un'?\s*e[- ]?mail\b/i.test(lower);
+    if (!isEmailSend) return null;
+
+    const parsed = await this._nluExtractEmailSend(userMessage, config);
+    if (!parsed || !parsed.to || !parsed.body) return null;
+
+    const { executeTool } = await import('./tool-executor.mjs');
+    try {
+      const result = await executeTool('gmail_send', {
+        to: parsed.to,
+        subject: parsed.subject || '(no subject)',
+        body: parsed.body,
+      }, config);
+      const ok = typeof result === 'string' && /sent|inviat|✅|message-?id/i.test(result);
+      const message = ok
+        ? `Fatto. Email inviata a ${parsed.to}${parsed.subject ? ` con oggetto "${parsed.subject}"` : ''}.`
+        : `Non sono riuscito a inviare l'email: ${result}`;
+      if (this._lastDirectAuditChatId) {
+        this._recordAudit(this._lastDirectAuditChatId, {
+          tool: 'gmail_send',
+          success: ok,
+          summary: `→ ${parsed.to}${parsed.subject ? ` · "${parsed.subject}"` : ''}`,
+        });
+      }
+      return { action: 'gmail_send', success: ok, message };
+    } catch (e) {
+      return { action: 'gmail_send', success: false, message: `Errore nell'invio: ${e.message}` };
+    }
+  }
+
+  async _nluExtractEmailSend(userMessage, config) {
+    const sysPrompt =
+      `You extract email-send parameters from natural language. Output ONLY a JSON object:\n` +
+      `  - to (string, recipient email or name if email unknown)\n` +
+      `  - subject (string, the email subject; if missing, infer a 2-6 word summary)\n` +
+      `  - body (string, the email body in the same language as the user)\n` +
+      `Rules: if any field is genuinely missing AND impossible to infer, use null. ` +
+      `Keep body short and natural. Output JSON only, no markdown.`;
+    try {
+      const raw = await callLLM(config, sysPrompt, userMessage, { temperature: 0, maxTokens: 400 });
+      const json = this._extractJsonObject(raw);
+      if (!json || !json.to || !json.body) return null;
+      return json;
+    } catch { return null; }
+  }
+
+  // ── Direct fresh TASK action (add / complete) ──────────────────────────
+  async _tryDirectFreshTaskAction(userMessage, config) {
+    if (!userMessage || typeof userMessage !== 'string') return null;
+    const lower = userMessage.toLowerCase();
+    const isTaskAdd = /\b(aggiung|cre[oai]|fiss|segn|metti|add|create)\w*\s+.*\b(task|attivit[àa]|cosa\s+da\s+fare|todo|to[- ]?do|promemoria\s+da\s+fare)/i.test(lower);
+    const isTaskDone = /\b(complet|fatt[oa]|done|fini[stct]|chiud|spunt|tick|mark\s+as\s+done)\w*\s+.*\b(task|attivit[àa]|todo|to[- ]?do)/i.test(lower);
+    const { executeTool } = await import('./tool-executor.mjs');
+    if (isTaskAdd) {
+      const parsed = await this._nluExtractTaskAdd(userMessage, config);
+      if (!parsed?.title) return null;
+      try {
+        const r = await executeTool('task_add', { title: parsed.title, due: parsed.due || null, priority: parsed.priority || 'medium' }, config);
+        const ok = typeof r === 'string' && !/error/i.test(r);
+        if (this._lastDirectAuditChatId) this._recordAudit(this._lastDirectAuditChatId, { tool: 'task_add', success: ok, summary: `"${parsed.title}"${parsed.due ? ` (entro ${parsed.due})` : ''}` });
+        return { action: 'task_add', success: ok, message: ok ? `Fatto. Ho aggiunto il task "${parsed.title}"${parsed.due ? ` con scadenza ${parsed.due}` : ''}.` : `Errore: ${r}` };
+      } catch (e) { return { action: 'task_add', success: false, message: `Errore: ${e.message}` }; }
+    }
+    if (isTaskDone) {
+      const parsed = await this._nluExtractTaskRef(userMessage, config);
+      if (!parsed?.title) return null;
+      try {
+        const r = await executeTool('task_complete', { title: parsed.title }, config);
+        const ok = typeof r === 'string' && !/error|not found/i.test(r);
+        if (this._lastDirectAuditChatId) this._recordAudit(this._lastDirectAuditChatId, { tool: 'task_complete', success: ok, summary: `"${parsed.title}"` });
+        return { action: 'task_complete', success: ok, message: ok ? `Fatto. Task "${parsed.title}" segnato come completato.` : `Errore: ${r}` };
+      } catch (e) { return { action: 'task_complete', success: false, message: `Errore: ${e.message}` }; }
+    }
+    return null;
+  }
+
+  // ── Direct fresh NOTE add ───────────────────────────────────────────────
+  async _tryDirectFreshNoteAction(userMessage, config) {
+    if (!userMessage || typeof userMessage !== 'string') return null;
+    const lower = userMessage.toLowerCase();
+    const isNoteAdd = /\b(crea|nuov[oa]|aggiung|salv|prend|scriv|appunt|new|add|save)\w*\s+(?:una\s+)?\b(nota|note|appunt)/i.test(lower);
+    if (!isNoteAdd) return null;
+    const parsed = await this._nluExtractNoteAdd(userMessage, config);
+    if (!parsed?.title) return null;
+    const { executeTool } = await import('./tool-executor.mjs');
+    try {
+      const r = await executeTool('note_add', { title: parsed.title, content: parsed.content || '' }, config);
+      const ok = typeof r === 'string' && !/error/i.test(r);
+      if (this._lastDirectAuditChatId) this._recordAudit(this._lastDirectAuditChatId, { tool: 'note_add', success: ok, summary: `"${parsed.title}"` });
+      return { action: 'note_add', success: ok, message: ok ? `Fatto. Nota "${parsed.title}" salvata.` : `Errore: ${r}` };
+    } catch (e) { return { action: 'note_add', success: false, message: `Errore: ${e.message}` }; }
+  }
+
+  // ── Direct fresh REMINDER create ────────────────────────────────────────
+  async _tryDirectFreshReminderAction(userMessage, config) {
+    if (!userMessage || typeof userMessage !== 'string') return null;
+    const lower = userMessage.toLowerCase();
+    const isReminder = /\b(ricordami|reminder|promemoria|ricord[aoo]|notificami|avvisami|remind)\b/i.test(lower);
+    if (!isReminder) return null;
+    const parsed = await this._nluExtractReminder(userMessage, config);
+    if (!parsed?.message || !parsed?.when) return null;
+    const { executeTool } = await import('./tool-executor.mjs');
+    try {
+      const r = await executeTool('reminder_create', { message: parsed.message, when: parsed.when }, config);
+      const ok = typeof r === 'string' && !/error/i.test(r);
+      if (this._lastDirectAuditChatId) this._recordAudit(this._lastDirectAuditChatId, { tool: 'reminder_create', success: ok, summary: `"${parsed.message}" @ ${parsed.when}` });
+      return { action: 'reminder_create', success: ok, message: ok ? `Fatto. Promemoria impostato: "${parsed.message}" per ${parsed.when}.` : `Errore: ${r}` };
+    } catch (e) { return { action: 'reminder_create', success: false, message: `Errore: ${e.message}` }; }
+  }
+
+  // ── Direct fresh SLACK send ─────────────────────────────────────────────
+  async _tryDirectFreshSlackAction(userMessage, config) {
+    if (!userMessage || typeof userMessage !== 'string') return null;
+    const lower = userMessage.toLowerCase();
+    const isSlackSend = /\b(manda|invi[ao]|posta|scriv[io]|send|post)\s+.*\b(slack|canale|channel|#)/i.test(lower)
+                     || /\bsu\s+slack\b/i.test(lower);
+    if (!isSlackSend) return null;
+    const parsed = await this._nluExtractSlackSend(userMessage, config);
+    if (!parsed?.channel || !parsed?.text) return null;
+    const { executeTool } = await import('./tool-executor.mjs');
+    try {
+      const r = await executeTool('slack_send', { channel: parsed.channel, text: parsed.text }, config);
+      const ok = typeof r === 'string' && !/error|not found/i.test(r);
+      if (this._lastDirectAuditChatId) this._recordAudit(this._lastDirectAuditChatId, { tool: 'slack_send', success: ok, summary: `→ ${parsed.channel}: "${parsed.text.slice(0, 60)}"` });
+      return { action: 'slack_send', success: ok, message: ok ? `Fatto. Messaggio inviato a ${parsed.channel}.` : `Errore: ${r}` };
+    } catch (e) { return { action: 'slack_send', success: false, message: `Errore: ${e.message}` }; }
+  }
+
+  // ── NLU extractors (LLM-driven JSON parsing only, never tool execution) ──
+  async _nluExtractTaskAdd(userMessage, config) {
+    const todayIso = new Date().toISOString().slice(0, 10);
+    const sys = `Today is ${todayIso}. Extract task params from the message. Output ONLY JSON:\n` +
+      `  - title (string, the task description)\n` +
+      `  - due (string, "YYYY-MM-DD" if mentioned, else null)\n` +
+      `  - priority ("low" | "medium" | "high" | null)`;
+    try { return this._extractJsonObject(await callLLM(config, sys, userMessage, { temperature: 0, maxTokens: 200 })); } catch { return null; }
+  }
+  async _nluExtractTaskRef(userMessage, config) {
+    const sys = `Extract which task to mark completed. Output ONLY JSON:\n  - title (string)`;
+    try { return this._extractJsonObject(await callLLM(config, sys, userMessage, { temperature: 0, maxTokens: 150 })); } catch { return null; }
+  }
+  async _nluExtractNoteAdd(userMessage, config) {
+    const sys = `Extract a new-note request. Output ONLY JSON:\n  - title (string)\n  - content (string, can be empty)`;
+    try { return this._extractJsonObject(await callLLM(config, sys, userMessage, { temperature: 0, maxTokens: 400 })); } catch { return null; }
+  }
+  async _nluExtractReminder(userMessage, config) {
+    const todayIso = new Date().toISOString().slice(0, 10);
+    const sys = `Today is ${todayIso}. Extract reminder params. Output ONLY JSON:\n` +
+      `  - message (string, what to remind)\n  - when (string, ISO datetime "YYYY-MM-DDTHH:MM:00")`;
+    try { return this._extractJsonObject(await callLLM(config, sys, userMessage, { temperature: 0, maxTokens: 200 })); } catch { return null; }
+  }
+  async _nluExtractSlackSend(userMessage, config) {
+    const sys = `Extract Slack-send params. Output ONLY JSON:\n` +
+      `  - channel (string, with "#" prefix for channels or "@user" for DMs)\n  - text (string, message body)`;
+    try { return this._extractJsonObject(await callLLM(config, sys, userMessage, { temperature: 0, maxTokens: 300 })); } catch { return null; }
+  }
+
+  // ════════════════════════════════════════════════════════════════════════
+  // UNIVERSAL DIRECT-ACTION DISPATCHER
+  // ════════════════════════════════════════════════════════════════════════
+  // Covers ALL 22 mutation tools in `DESTRUCTIVE_ACTIONS` (gmail, imap,
+  // calendar, contacts, tasks, slack, github, file, drive, notify).
+  // The LLM is used ONLY to (a) decide if the message maps to a tool and
+  // (b) extract the params as JSON. Tool execution is then deterministic
+  // server-side. No tool block is parsed from natural language by the
+  // model — the model can never "say done" without us actually doing it.
+  async _tryDirectFreshUniversalAction(userMessage, config) {
+    if (!userMessage || typeof userMessage !== 'string' || userMessage.length < 3) return null;
+
+    const todayIso = new Date().toISOString().slice(0, 10);
+    const sys =
+      `You are a tool-routing classifier. Given a user message in any language, decide whether it ` +
+      `requests a state-changing action that maps to ONE of these tools, and extract the params.\n\n` +
+      `ALLOWED TOOLS (you MUST pick one of these OR return null):\n` +
+      // Calendar
+      `- calendar_create(summary, start, end, description?)    — start/end ISO "YYYY-MM-DDTHH:MM:00"\n` +
+      `- calendar_move(eventId? OR title, newStart, newEnd?)   — if no eventId, title is used to find it\n` +
+      `- calendar_update(eventId? OR title, summary?, start?, end?, description?)\n` +
+      `- calendar_delete(eventId? OR title, date?)\n` +
+      // Email Gmail
+      `- gmail_send(to, subject, body)                         — primary email account\n` +
+      `- gmail_reply(messageId? OR threadHint, body)\n` +
+      `- gmail_delete(messageId? OR query)\n` +
+      `- gmail_mark_read(messageId, isRead?)\n` +
+      `- gmail_mark_starred(messageId, starred?)\n` +
+      `- gmail_archive(messageId)\n` +
+      // Email IMAP
+      `- imap_send(accountId?, to, subject, body)              — custom IMAP account\n` +
+      `- imap_reply(accountId?, messageId, body)\n` +
+      `- imap_trash(messageId)\n` +
+      `- imap_mark_read(messageId, isRead?)\n` +
+      `- imap_draft(accountId?, to, subject, body)\n` +
+      // Contacts
+      `- contact_add(name, email?, phone?, company?, address?)\n` +
+      `- contact_update(query, email?, phone?, company?, address?)\n` +
+      `- contact_delete(query)\n` +
+      // Tasks
+      `- task_add(title, priority?, due?)\n` +
+      `- task_done(title)\n` +
+      `- task_delete(title)\n` +
+      // Google Tasks
+      `- gtask_add(title, notes?, due?)\n` +
+      `- gtask_complete(title)\n` +
+      // Notes
+      `- note_add(title, content?)\n` +
+      // Reminders
+      `- notify_remind(message, when)                          — when = ISO datetime\n` +
+      `- reminder_create(message, when)\n` +
+      // Slack
+      `- slack_send(channel, text, threadTs?)                  — channel "#name"\n` +
+      `- slack_dm(user, text)                                  — user = name, id, or email\n` +
+      `- slack_react(channel, ts, emoji)\n` +
+      `- slack_mark_read(channel, ts)\n` +
+      // Notion
+      `- notion_page(title, content)                           — create a new Notion page\n` +
+      // GitHub
+      `- github_create_issue(repo, title, body?, labels?)      — repo "owner/name"\n` +
+      // File system (local to user)
+      `- file_write(path, content)\n` +
+      `- file_move(from, to)\n` +
+      `- file_delete(path)\n` +
+      `- file_mkdir(path)\n` +
+      // Google Drive
+      `- drive_upload(name, content, mimeType?)                — Google Drive\n` +
+      `- drive_update(fileId, content)\n` +
+      `- drive_delete(fileId? OR name)\n` +
+      `- drive_move(fileId, newParentFolderId? OR newName?)\n` +
+      `- drive_share(fileId, email, role?)                     — role = "reader"|"writer"|"commenter"\n` +
+      // Birthdays
+      `- birthday_add(name, date)                              — date "YYYY-MM-DD" or "MM-DD"\n` +
+      `- birthday_delete(name)\n` +
+      // Alexandria E2E
+      `- alexandria_send(channel, message)\n` +
+      // Cron
+      `- cron_create(name, schedule, command)                  — schedule = cron expression\n` +
+      `- cron_delete(name)\n\n` +
+      `Today is ${todayIso}. Relative dates: "domani" = ${this._addDaysIso(todayIso, 1).slice(0, 10)}, ` +
+      `"dopodomani" = ${this._addDaysIso(todayIso, 2).slice(0, 10)}, "lunedì/martedì/..." resolve to next occurrence.\n\n` +
+      `OUTPUT FORMAT (strict JSON, no markdown, no prose, no fences):\n` +
+      `{"tool": "tool_name" | null, "params": { ... }}\n\n` +
+      `If the message is a READ/LIST/QUERY operation (e.g. "mostra…", "che ho oggi", "leggi email", "trova"), ` +
+      `OR is conversational chat (greetings, questions, opinions) OR is ambiguous → return {"tool": null}.\n` +
+      `If a required param is genuinely missing AND not inferable → return {"tool": null}.\n` +
+      `Never invent emails, eventIds, or recipient addresses.`;
+
+    let raw;
+    try {
+      raw = await callLLM(config, sys, userMessage, { temperature: 0, maxTokens: 400 });
+    } catch (e) {
+      this.log(`[direct-universal] LLM call failed: ${e.message}`);
+      return null;
+    }
+    const parsed = this._extractJsonObject(raw);
+    if (!parsed || !parsed.tool || !DESTRUCTIVE_ACTIONS.has(parsed.tool)) return null;
+    if (!parsed.params || typeof parsed.params !== 'object') return null;
+
+    // Per-tool param normalization (matches the executor's accepted shapes).
+    const params = { ...parsed.params };
+    if (parsed.tool === 'calendar_create' && !params.summary) params.summary = params.title || params.name || params.subject;
+    if (parsed.tool === 'calendar_create' && params.start && !params.end) params.end = this._addMinutesIso(params.start, 60);
+
+    try {
+      const result = await executeTool(parsed.tool, params, config);
+      const resultStr = typeof result === 'string' ? result : JSON.stringify(result);
+      const ok = !/error|failed|not\s+found|invalid|does\s+not\s+exist|placeholder/i.test(resultStr);
+
+      if (this._lastDirectAuditChatId) {
+        this._recordAudit(this._lastDirectAuditChatId, {
+          tool: parsed.tool,
+          success: ok,
+          summary: this._summarizeParamsForAudit(parsed.tool, params),
+        });
+      }
+      const message = ok
+        ? this._formatActionResultIT(parsed.tool, params, resultStr)
+        : `Non sono riuscito a eseguire ${parsed.tool}: ${resultStr.slice(0, 240)}`;
+      return { action: parsed.tool, success: ok, message };
+    } catch (e) {
+      return { action: parsed.tool, success: false, message: `Errore durante ${parsed.tool}: ${e.message}` };
+    }
+  }
+
+  /** Natural-language Italian summary for the audit log entry. */
+  _summarizeParamsForAudit(tool, params) {
+    if (tool.startsWith('calendar_')) {
+      const t = params.summary || params.title || '';
+      const s = params.start ? this._formatDateIT(String(params.start).slice(0, 10)) + ` ${String(params.start).slice(11, 16)}` : '';
+      return `"${t}"${s ? ` · ${s}` : ''}`;
+    }
+    if (tool === 'gmail_send' || tool === 'imap_send') return `→ ${params.to || '?'} · "${(params.subject || '').slice(0, 60)}"`;
+    if (tool === 'gmail_reply' || tool === 'imap_reply') return `reply → ${params.to || params.messageId || '?'}`;
+    if (tool === 'slack_send') return `→ ${params.channel || '?'} · "${(params.text || '').slice(0, 60)}"`;
+    if (tool === 'notify_remind') return `"${params.message || ''}" @ ${params.when || '?'}`;
+    if (tool === 'github_create_issue') return `${params.repo || '?'}: "${params.title || ''}"`;
+    if (tool === 'file_write') return `${params.path || '?'} (${(params.content || '').length} chars)`;
+    if (tool === 'drive_upload') return `${params.name || '?'} (${(params.content || '').length} chars)`;
+    if (tool === 'task_done' || tool === 'task_delete' || tool === 'contact_delete') return `"${params.title || params.name || '?'}"`;
+    return JSON.stringify(params).slice(0, 80);
+  }
+
+  /** Italian-language natural response for a successful action. */
+  _formatActionResultIT(tool, params, result) {
+    switch (tool) {
+      case 'calendar_create': {
+        const t = params.summary || params.title || 'evento';
+        const when = params.start ? `${this._formatDateIT(String(params.start).slice(0, 10))} alle ${String(params.start).slice(11, 16)}` : '';
+        return `Fatto. Ho creato l'appuntamento "${t}"${when ? ` il ${when}` : ''}.`;
+      }
+      case 'calendar_move':   return `Fatto. Appuntamento spostato.`;
+      case 'calendar_update': return `Fatto. Appuntamento aggiornato.`;
+      case 'calendar_delete': return `Fatto. Appuntamento cancellato.`;
+      case 'gmail_send':
+      case 'imap_send':       return `Fatto. Email inviata a ${params.to}.`;
+      case 'gmail_reply':
+      case 'imap_reply':      return `Fatto. Risposta inviata.`;
+      case 'gmail_delete':    return `Fatto. Email eliminata.`;
+      case 'imap_trash':      return `Fatto. Email spostata nel cestino.`;
+      case 'contact_delete':  return `Fatto. Contatto "${params.name || ''}" cancellato.`;
+      case 'task_done':       return `Fatto. Task "${params.title || ''}" completato.`;
+      case 'task_delete':     return `Fatto. Task "${params.title || ''}" cancellato.`;
+      case 'task_clear':      return `Fatto. Task list pulita.`;
+      case 'notify_remind':   return `Promemoria impostato: "${params.message || ''}" per ${params.when || ''}.`;
+      case 'slack_send':      return `Fatto. Messaggio inviato a ${params.channel || ''}.`;
+      case 'github_create_issue': return `Issue creata su ${params.repo}: "${params.title}".`;
+      case 'file_write':      return `Fatto. File ${params.path} scritto (${(params.content || '').length} caratteri).`;
+      case 'drive_upload':    return `Fatto. "${params.name}" caricato su Google Drive.`;
+      case 'drive_update':    return `Fatto. File Drive aggiornato.`;
+      case 'drive_delete':    return `Fatto. File Drive eliminato.`;
+      default: return `Fatto. ${result.slice(0, 200)}`;
+    }
+  }
+
   // ── Direct fresh calendar action (no LLM) ─────────────────────────────────
   // Detects DELETE / LIST_MONTH / LIST_WEEK / LIST_DAY / LIST_TODAY /
   // LIST_TOMORROW intents from a fresh user message and runs the proper tool
@@ -1432,6 +1867,14 @@ class TelegramResponder {
     // a date or title reference. We answer FACTUALLY by re-querying the
     // calendar — never by apologizing in the abstract.
     const isVerify = /\b(non\s+(vedo|c'è|esiste)|c'è\s+(ancora|sempre)|è\s+ancora|stai\s+sbagliand|hai\s+sbagliat|in\s+realt[àa]|sei\s+sicur|davvero|inaffidabil|controlla|verifica|conferma\b|guarda)\b/.test(lower);
+    // CREATE event intent — action verb + event noun. Robust enough to catch
+    // "fissami un appuntamento dal dentista venerdì alle 10", "crea evento
+    // ortocheratologia 18 maggio 10-11", "segna riunione con Marco lunedì 14:30".
+    const isCreate = /\b(fiss|cre[oai]|aggiung|inserisc|programm|segn|prenoti?|impost|metti|registr|set\s+up|create|add|schedule|book)\w*\s+/.test(lower)
+                  && /\b(appuntament|evento|event\b|meeting|riunion|incontro|chiamat|call\b|webinar|memo|reminder|promemoria|task|impegn)/i.test(lower);
+    // MOVE intent — reschedule/postpone an existing event.
+    const isMove = /\b(spost[ao]|rimand|rinvi|riprogramm|move|reschedule|postpone|cambia\s+(?:data|ora|orari))\w*/.test(lower)
+                && /\b(appuntament|evento|event\b|meeting|riunion|incontro|chiamat|call\b)/i.test(lower);
 
     const { executeTool } = await import('./tool-executor.mjs');
 
@@ -1491,8 +1934,108 @@ class TelegramResponder {
       // No date/title to verify — fall through to LIST/DELETE detection.
     }
 
+    // ─── CREATE intent ─────────────────────────────────────────────────────
+    // We use a tiny LLM call ONLY to extract structured params from natural
+    // language (NLU). Tool execution stays deterministic server-side. This
+    // is the enterprise pattern: LLM for understanding + rendering, NEVER
+    // for state-changing actions.
+    if (isCreate && !isDelete && !isVerify) {
+      const parsed = await this._nluExtractCalendarCreate(userMessage, config);
+      if (parsed && parsed.title && parsed.start) {
+        try {
+          const result = await executeTool('calendar_create', {
+            summary: parsed.title,
+            start: parsed.start,
+            end: parsed.end || this._addMinutesIso(parsed.start, 60),
+            description: parsed.description || '',
+          }, config);
+          const ok = typeof result === 'string' && /created|event\s+"|eventId/i.test(result);
+          const startLabel = `${this._formatDateIT(parsed.start.slice(0, 10))} alle ${parsed.start.slice(11, 16)}`;
+          const message = ok
+            ? `Fatto. Ho creato l'appuntamento "${parsed.title}" il ${startLabel}.`
+            : `Non sono riuscito a creare l'appuntamento: ${result}`;
+          if (this._lastDirectAuditChatId) {
+            this._recordAudit(this._lastDirectAuditChatId, {
+              tool: 'calendar_create',
+              success: ok,
+              summary: `"${parsed.title}" il ${startLabel}`,
+            });
+          }
+          return { action: 'calendar_create', success: ok, message };
+        } catch (e) {
+          return { action: 'calendar_create', success: false, message: `Errore durante la creazione: ${e.message}` };
+        }
+      }
+      // Couldn't extract title/date with confidence → let the LLM ask the user.
+      // Fall through.
+    }
+
+    // ─── MOVE intent ───────────────────────────────────────────────────────
+    if (isMove && !isDelete && !isVerify && !isCreate) {
+      const parsed = await this._nluExtractCalendarMove(userMessage, config);
+      if (parsed && (parsed.title || parsed.oldDate) && parsed.newStart) {
+        // Find the source event.
+        let candidates = [];
+        try {
+          if (parsed.oldDate) {
+            const r = await executeTool('calendar_date', { date: parsed.oldDate }, config);
+            candidates = this._parseEventsFromToolOutput(r);
+          }
+          if (candidates.length === 0 && parsed.title) {
+            const r = await executeTool('calendar_find', { query: parsed.title, daysAhead: 60 }, config);
+            candidates = this._parseEventsFromToolOutput(r);
+          }
+        } catch (e) {
+          return { action: 'calendar_move', success: false, message: `Errore nella ricerca dell'evento: ${e.message}` };
+        }
+        // Match by title token overlap, same heuristic as DELETE.
+        const norm = (s) => String(s || '').toLowerCase()
+          .normalize('NFD').replace(/[̀-ͯ]/g, '')
+          .replace(/[^a-z0-9\s]/g, ' ')
+          .split(/\s+/).filter(t => t.length > 2);
+        let match = null;
+        if (parsed.title) {
+          const titleTokens = norm(parsed.title);
+          const scored = candidates.map(c => {
+            const summaryTokens = new Set(norm(c.summary));
+            const score = titleTokens.filter(t => summaryTokens.has(t)).length;
+            return { c, score };
+          }).sort((a, b) => b.score - a.score);
+          const top = scored[0];
+          if (top && top.score >= Math.max(1, Math.ceil(titleTokens.length * 0.5))) match = top.c;
+        }
+        if (!match && candidates.length === 1) match = candidates[0];
+        if (!match || !match.eventId) {
+          return { action: 'calendar_move', success: false,
+            message: `Non ho trovato l'appuntamento "${parsed.title || ''}" da spostare. Verifica titolo o data originale.` };
+        }
+        try {
+          const result = await executeTool('calendar_move', {
+            eventId: match.eventId,
+            newStart: parsed.newStart,
+            newEnd: parsed.newEnd || this._addMinutesIso(parsed.newStart, 60),
+          }, config);
+          const ok = typeof result === 'string' && /rescheduled|moved|spostat/i.test(result);
+          const newLabel = `${this._formatDateIT(parsed.newStart.slice(0, 10))} alle ${parsed.newStart.slice(11, 16)}`;
+          const message = ok
+            ? `Fatto. Ho spostato "${match.summary}" al ${newLabel}.`
+            : `Non sono riuscito a spostare l'appuntamento: ${result}`;
+          if (this._lastDirectAuditChatId) {
+            this._recordAudit(this._lastDirectAuditChatId, {
+              tool: 'calendar_move',
+              success: ok,
+              summary: `"${match.summary}" → ${newLabel} (eventId ${match.eventId.slice(0, 16)}…)`,
+            });
+          }
+          return { action: 'calendar_move', success: ok, message };
+        } catch (e) {
+          return { action: 'calendar_move', success: false, message: `Errore nello spostamento: ${e.message}` };
+        }
+      }
+    }
+
     // ─── LIST intents ──────────────────────────────────────────────────────
-    if (isList && !isDelete && !isVerify) {
+    if (isList && !isDelete && !isVerify && !isCreate && !isMove) {
       // "appuntamenti di oggi"
       if (/\b(oggi|today)\b/.test(lower)) {
         try {

package/src/services/tool-executor.mjs

@@ -63,30 +63,39 @@ function getTsxPath() {
 
 /** Actions that mutate external state and require user confirmation. */
 export const DESTRUCTIVE_ACTIONS = new Set([
-  'gmail_send',
-  'gmail_send_attach',
-  'gmail_reply',
-  'gmail_delete',
-  'imap_send',
-  'imap_reply',
-  'imap_bulk_send',
-  'imap_send_template',
-  'imap_trash',
-  'calendar_create',
-  'calendar_move',
-  'calendar_update',
-  'calendar_delete',
-  'contact_delete',
-  'task_done',
-  'task_delete',
-  'task_clear',
-  'notify_remind',
-  'slack_send',
-  'github_create_issue',
-  'file_write',
-  'drive_upload',
-  'drive_update',
-  'drive_delete',
+  // Gmail
+  'gmail_send', 'gmail_send_attach', 'gmail_reply', 'gmail_delete',
+  'gmail_mark_read', 'gmail_mark_starred', 'gmail_archive', 'gmail_trash',
+  // IMAP (custom email accounts)
+  'imap_send', 'imap_reply', 'imap_bulk_send', 'imap_send_template',
+  'imap_trash', 'imap_mark_read', 'imap_mark_starred', 'imap_draft',
+  // Calendar
+  'calendar_create', 'calendar_move', 'calendar_update', 'calendar_delete',
+  // Contacts
+  'contact_add', 'contact_update', 'contact_delete',
+  // Tasks (local) + Google Tasks
+  'task_add', 'task_done', 'task_delete', 'task_clear',
+  'gtask_add', 'gtask_complete', 'gtask_delete',
+  // Notes
+  'note_add',
+  // Reminders / notifications
+  'notify_remind', 'reminder_create',
+  // Slack
+  'slack_send', 'slack_dm', 'slack_react', 'slack_mark_read',
+  // Notion
+  'notion_page', 'notion_update',
+  // GitHub
+  'github_create_issue', 'github_comment',
+  // File system (local)
+  'file_write', 'file_move', 'file_delete', 'file_mkdir',
+  // Google Drive
+  'drive_upload', 'drive_update', 'drive_delete', 'drive_move', 'drive_share',
+  // Birthdays
+  'birthday_add', 'birthday_update', 'birthday_delete',
+  // Alexandria messaging
+  'alexandria_send',
+  // Cron / scheduling
+  'cron_create', 'cron_delete',
 ]);
 
 // ── Tool Definitions (for system prompt) ─────────────────────────────────────