npm - nothumanallowed - Versions diffs - 16.0.27 → 16.0.28 - Mend

nothumanallowed 16.0.27 → 16.0.28

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (3) hide show

package/package.json +1 -1
package/src/constants.mjs +1 -1
package/src/server/routes/webcraft.mjs +74 -8

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "nothumanallowed",
-  "version": "16.0.27",
+  "version": "16.0.28",
   "description": "Local AI assistant: 80 tools (Gmail, Calendar, Drive, GitHub, Slack, browser, code, files), 38 agents, visual workflows (Studio, AWF, WebCraft). Install with `npm i -g nothumanallowed`, run with `nha ui`. Free tier built-in (Liara), no API key required. Your data stays on your PC — OAuth tokens local, no cloud. Open-source MIT.",
   "type": "module",
   "bin": {

package/src/constants.mjs CHANGED Viewed

@@ -5,7 +5,7 @@ import { fileURLToPath } from 'url';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
-export const VERSION = '16.0.27';
+export const VERSION = '16.0.28';
 export const BASE_URL = 'https://nothumanallowed.com/cli';
 export const API_BASE = 'https://nothumanallowed.com/api/v1';

package/src/server/routes/webcraft.mjs CHANGED Viewed

@@ -183,6 +183,23 @@ class SandboxManager {
     }
     emit({ type: 'status', msg: `Entry point: ${entryFile}` });
+    // Pre-flight: validate entry file with acorn. If the file content was
+    // corrupted by a partial LLM stream (HTTP error leaked as code), quarantine
+    // it with a minimal stub so the sandbox can still boot. The user sees a
+    // clear "re-generate from chat" message instead of a SyntaxError crash.
+    const entryAbs = path.join(projectDir, entryFile);
+    if (fs.existsSync(entryAbs)) {
+      try {
+        const entryContent = fs.readFileSync(entryAbs, 'utf-8');
+        const sanitized = _sanitizeGeneratedFile(entryFile, entryContent, path.basename(projectDir));
+        if (sanitized !== entryContent) {
+          emit({ type: 'warn', msg: `Entry file ${entryFile} was corrupted (likely partial stream / HTTP error leaked into content). Auto-quarantined — re-generate from chat.` });
+          fs.writeFileSync(entryAbs + '.corrupt-' + Date.now(), entryContent, 'utf-8');
+          fs.writeFileSync(entryAbs, sanitized, 'utf-8');
+        }
+      } catch {}
+    }
     // ── Phase 2: Dependencies (pre-scan + batch install) ──────────────────
     // Pre-scan the project source files for require()/import statements and
     // diff against package.json + node_modules. Install everything missing in
@@ -3484,17 +3501,27 @@ function _patchEntry(projectDir, entryFile, shimDir, port) {
 // file content. Those strings are short, don't start with valid syntax for
 // the file type, and contain specific marker phrases.
 const _LLM_ERROR_MARKERS = [
+  // "Access denied" / "Access temporarily denied"
   /^\s*Access (temporarily )?denied/i,
-  /^\s*Rate ?limit(ed)?/i,
+  // "Service Temporarily Unavailable", "Server Temporarily Unavailable",
+  // "Temporarily Unavailable" — common nginx/cloudflare/CDN 503 responses
+  /^\s*(Service |Server )?Temporarily Unavailable/i,
   /^\s*Service Unavailable/i,
+  /^\s*Rate ?limit(ed)?/i,
   /^\s*Internal Server Error/i,
   /^\s*Too Many Requests/i,
   /^\s*Bad Gateway/i,
   /^\s*Gateway Timeout/i,
+  /^\s*Request Timeout/i,
+  /^\s*Not Found/i,
+  /^\s*Forbidden\b/i,
+  /^\s*Unauthorized\b/i,
   /^\s*<!DOCTYPE html.*Cloudflare/is,
-  /^\s*<html.*<title>.*(Access|Forbidden|Error)/is,
-  /^\s*\{?\s*"error"\s*:\s*"(rate.?limit|quota|unauthorized)"/i,
+  /^\s*<html.*<title>.*(Access|Forbidden|Error|Unavailable|Cloudflare)/is,
+  /^\s*\{?\s*"error"\s*:\s*"(rate.?limit|quota|unauthorized|temporarily)"/i,
   /^\s*error code:\s*\d{3,4}/i,
+  // Standalone HTTP status phrase at the start of a code file is suspicious
+  /^\s*(HTTP\/[\d.]+\s+)?[45]\d{2}\s+/,
 ];
 function _looksLikeLLMError(content) {
@@ -3517,17 +3544,25 @@ function _fallbackPackageJson(projectName) {
 }
 // Sanitize content before writing to disk. Rejects LLM error responses,
-// repairs corrupt JSON manifests, and falls back to a minimal template when
-// content is unsalvageable. This is the LAST line of defense between the LLM
-// API and the user's filesystem.
+// repairs corrupt JSON manifests, validates JS/TS with acorn, and falls back
+// to a safe placeholder when content is unsalvageable. This is the LAST line
+// of defense between the LLM API and the user's filesystem.
 function _sanitizeGeneratedFile(name, content, projectName) {
-  const isJson = /\.json$/i.test(name) || name.endsWith('package.json');
+  const ext = (name.split('.').pop() || '').toLowerCase();
+  const isJson = ext === 'json' || name.endsWith('package.json');
   const isPkg = name === 'package.json' || name.endsWith('/package.json');
+  const isCode = ['js', 'mjs', 'cjs', 'jsx', 'ts', 'tsx'].includes(ext);
+  // Layer A: detect HTTP error responses leaked as file content
   if (_looksLikeLLMError(content)) {
     if (isPkg) return _fallbackPackageJson(projectName);
-    return '/* nha-webcraft: file content from LLM looked like an HTTP error response and was discarded. Re-generate from chat. */';
+    if (isCode) {
+      return `// nha-webcraft: this file's content from the LLM looked like an HTTP error response\n// (status leaked into stream — likely '${_extractLLMErrorHint(content)}').\n// File quarantined to keep the sandbox bootable. Re-generate from chat.\nmodule.exports = {};\n`;
+    }
+    return '<!-- nha-webcraft: LLM error response detected, content discarded. Re-generate from chat. -->';
   }
+  // Layer B: validate JSON files
   if (isJson) {
     try { JSON.parse(content); }
     catch {
@@ -3543,9 +3578,40 @@ function _sanitizeGeneratedFile(name, content, projectName) {
       }
     }
   }
+  // Layer C: validate JS/JSX/TS files with acorn — catches partial streams
+  // that ended mid-token, leftover HTML/error text mixed with code, etc.
+  if (isCode && content && content.trim()) {
+    try {
+      const parser = ext === 'jsx' || ext === 'tsx' ? acorn.Parser.extend(acornJsx()) : acorn;
+      parser.parse(content, {
+        ecmaVersion: 'latest',
+        sourceType: ['mjs'].includes(ext) ? 'module' : (/\bimport\s+|\bexport\s+/.test(content) ? 'module' : 'script'),
+        allowReturnOutsideFunction: true,
+        allowAwaitOutsideFunction: true,
+        allowHashBang: true,
+      });
+    } catch (parseErr) {
+      // Only quarantine if the error is at the VERY START of the file —
+      // this signals "the whole file is junk" (HTTP error / partial stream)
+      // rather than a normal bug at line 50 that user can fix.
+      const lineMatch = parseErr.message.match(/\((\d+):(\d+)\)/);
+      const startsAtTop = !lineMatch || parseInt(lineMatch[1]) <= 2;
+      if (startsAtTop && content.length < 5000) {
+        return `// nha-webcraft: this file failed to parse near the start (${parseErr.message}).\n// Likely a partial/corrupted stream from the LLM. Quarantined to keep sandbox bootable.\n// Re-generate from chat.\nmodule.exports = {};\n`;
+      }
+      // Otherwise let it through — it's a real code bug, the user will see it
+    }
+  }
   return content;
 }
+function _extractLLMErrorHint(content) {
+  const head = content.slice(0, 200).replace(/\n/g, ' ').replace(/\s+/g, ' ').trim();
+  return head.slice(0, 80) + (head.length > 80 ? '...' : '');
+}
 // Authoritative list of modules covered by our offline-safe shims.
 // Used by both the pre-scan (to skip them from npm install) and the Tier 1
 // retry (to detect "missing module" stderr that's already covered by a shim).