nothumanallowed 16.0.7 → 16.0.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nothumanallowed",
-  "version": "16.0.7",
+  "version": "16.0.9",
   "description": "NotHumanAllowed — 38 AI agents, 80 tools, Studio (visual agentic workflows). Email, calendar, browser automation, screen capture, canvas, cron/heartbeat, Alexandria E2E messaging, GitHub, Notion, Slack, voice chat, free AI (Liara), 28 languages. Zero-dependency CLI.",
   "type": "module",
   "bin": {

package/src/constants.mjs

@@ -5,7 +5,7 @@ import { fileURLToPath } from 'url';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
-export const VERSION = '16.0.7';
+export const VERSION = '16.0.9';
 export const BASE_URL = 'https://nothumanallowed.com/cli';
 export const API_BASE = 'https://nothumanallowed.com/api/v1';
 

package/src/server/routes/google-auth.mjs

@@ -11,6 +11,14 @@ export function register(router) {
   router.post('/api/google/auth', async (req, res) => {
     try {
       const { buildAuthUrl } = await import('../../services/google-oauth.mjs');
+      // Wipe out any cached refresh_token BEFORE starting a new flow.
+      // Otherwise Google can return a fresh access_token with the OLD scopes
+      // (using the still-valid refresh_token) and the user never gets the
+      // new permissions even after re-authorizing.
+      try {
+        const { deleteTokens } = await import('../../services/token-store.mjs');
+        deleteTokens('google');
+      } catch {}
       const config = loadConfig();
       const host = req.headers['host'] || 'localhost:3847';
       const redirectUri = `http://${host}/api/google/callback`;
@@ -20,6 +28,37 @@ export function register(router) {
     } catch (e) { sendError(res, 500, e.message); }
   });
 
+  // GET /api/google/status — diagnostic: what scopes does the current token
+  // actually have? Used by the Settings UI to highlight missing scopes.
+  router.get('/api/google/status', async (_req, res) => {
+    try {
+      const { loadTokens } = await import('../../services/token-store.mjs');
+      const tokens = loadTokens('google');
+      if (!tokens) return sendJSON(res, 200, { authenticated: false });
+      const scopeStr = tokens.scope || '';
+      const scopes = scopeStr.split(/\s+/).filter(Boolean);
+      const required = {
+        'gmail.modify':         scopes.includes('https://www.googleapis.com/auth/gmail.modify'),
+        'gmail.send':           scopes.includes('https://www.googleapis.com/auth/gmail.send'),
+        'calendar.events':      scopes.includes('https://www.googleapis.com/auth/calendar.events'),
+        'drive.readonly':       scopes.includes('https://www.googleapis.com/auth/drive.readonly'),
+        'drive.file':           scopes.includes('https://www.googleapis.com/auth/drive.file'),
+        'contacts':             scopes.includes('https://www.googleapis.com/auth/contacts'),
+        'tasks':                scopes.includes('https://www.googleapis.com/auth/tasks'),
+      };
+      const missing = Object.entries(required).filter(([, v]) => !v).map(([k]) => k);
+      sendJSON(res, 200, {
+        authenticated: true,
+        email: tokens.email,
+        scopes,
+        scopeCheck: required,
+        missing,
+        canWriteDrive: required['drive.file'],
+        expiresAt: tokens.expires_at,
+      });
+    } catch (e) { sendError(res, 500, e.message); }
+  });
+
   router.get('/api/google/callback', async (req, res) => {
     const url = new URL(req.url, 'http://localhost');
     const code = url.searchParams.get('code');

package/src/services/google-drive.mjs

@@ -207,6 +207,14 @@ export async function uploadFile(config, name, content, mimeType = 'text/plain',
 
   if (!res.ok) {
     const err = await res.text();
+    // Translate the 403 "insufficient scopes" mess into a clear instruction.
+    if (res.status === 403 && /insufficient/i.test(err)) {
+      throw new Error(
+        'Permessi Google Drive non sufficienti per scrivere file. ' +
+        'Riautorizza con: `nha google auth` (Settings → Google → Authorize). ' +
+        'Da v16.0.8 chiediamo anche lo scope drive.file per creare i file.'
+      );
+    }
     throw new Error(`Drive upload ${res.status}: ${err.slice(0, 200)}`);
   }
 

package/src/services/google-oauth.mjs

@@ -23,6 +23,10 @@ const SCOPES = [
   'https://www.googleapis.com/auth/calendar.events',
   'https://www.googleapis.com/auth/drive.readonly',
   'https://www.googleapis.com/auth/drive.metadata.readonly',
+  // drive.file: app può CREARE/MODIFICARE/ELIMINARE solo i file generati
+  // dall'app stessa. Principio del privilegio minimo, raccomandato da Google.
+  // Necessario per action_drive (workflow AWF), webhook automatic upload, etc.
+  'https://www.googleapis.com/auth/drive.file',
   'https://www.googleapis.com/auth/contacts',
   'https://www.googleapis.com/auth/tasks',
   'https://www.googleapis.com/auth/userinfo.email',