nothumanallowed 16.0.39 → 16.0.40

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nothumanallowed",
-  "version": "16.0.39",
+  "version": "16.0.40",
   "description": "Local AI assistant: 80 tools (Gmail, Calendar, Drive, GitHub, Slack, browser, code, files), 38 agents, visual workflows (Studio, AWF, WebCraft). Install with `npm i -g nothumanallowed`, run with `nha ui`. Free tier built-in (Liara), no API key required. Your data stays on your PC — OAuth tokens local, no cloud. Open-source MIT.",
   "type": "module",
   "bin": {

package/src/constants.mjs

@@ -5,7 +5,7 @@ import { fileURLToPath } from 'url';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
-export const VERSION = '16.0.39';
+export const VERSION = '16.0.40';
 export const BASE_URL = 'https://nothumanallowed.com/cli';
 export const API_BASE = 'https://nothumanallowed.com/api/v1';
 

package/src/server/routes/webcraft.mjs

@@ -4198,6 +4198,56 @@ function _patchEntry(projectDir, entryFile, shimDir, port) {
     `  } catch(e) {}`,
     `  return _origEnd.apply(this, arguments);`,
     `};`,
+    `// Monkey-patch Express to neutralize next(falsy) — common LLM bug where`,
+    `// middleware calls next(err) with err === undefined for EVERY request,`,
+    `// causing 500 on all routes including static files. Express treats any`,
+    `// truthy first arg as an error; if it's falsy (null/undefined/0/''),`,
+    `// it's semantically equivalent to next() per Express docs. We rewrite.`,
+    `(function() {`,
+    `  const Module = require('module');`,
+    `  const _origLoad = Module._load;`,
+    `  function wrapMiddleware(fn) {`,
+    `    if (typeof fn !== 'function' || fn.length !== 3) return fn;`,
+    `    const wrapped = function(req, res, next) {`,
+    `      const safeNext = function(err) {`,
+    `        if (err === undefined || err === null || err === false || err === 0) return next();`,
+    `        return next(err);`,
+    `      };`,
+    `      try { return fn.call(this, req, res, safeNext); }`,
+    `      catch (e) { return next(e); }`,
+    `    };`,
+    `    wrapped._nhaWrapped = true;`,
+    `    return wrapped;`,
+    `  }`,
+    `  function patchExpressApp(express) {`,
+    `    if (!express || express._nhaPatched) return express;`,
+    `    try {`,
+    `      // express() returns an app; patch app.use to wrap middleware`,
+    `      const _origExpress = express;`,
+    `      const factory = function(...args) {`,
+    `        const app = _origExpress.apply(this, args);`,
+    `        if (app && typeof app.use === 'function' && !app._nhaUseWrapped) {`,
+    `          const _origUse = app.use;`,
+    `          app.use = function(...uArgs) {`,
+    `            const mapped = uArgs.map(a => (typeof a === 'function' && a.length === 3 && !a._nhaWrapped) ? wrapMiddleware(a) : a);`,
+    `            return _origUse.apply(this, mapped);`,
+    `          };`,
+    `          app._nhaUseWrapped = true;`,
+    `        }`,
+    `        return app;`,
+    `      };`,
+    `      // Preserve static props: Router, json(), urlencoded(), etc.`,
+    `      Object.assign(factory, _origExpress);`,
+    `      factory._nhaPatched = true;`,
+    `      return factory;`,
+    `    } catch { return express; }`,
+    `  }`,
+    `  Module._load = function(name, parent, isMain) {`,
+    `    const result = _origLoad.call(this, name, parent, isMain);`,
+    `    if (name === 'express') return patchExpressApp(result);`,
+    `    return result;`,
+    `  };`,
+    `})();`,
     `// Strip headers that break sandbox iframe preview:`,
     `//  - X-Frame-Options: blocks iframe embedding entirely`,
     `//  - X-Content-Type-Options: nosniff: when LLM references /js/*.js files`,