nothumanallowed 3.1.0 → 3.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nothumanallowed",
-  "version": "3.1.0",
+  "version": "3.2.0",
   "description": "NotHumanAllowed — 38 AI agents for security, code, DevOps, data & daily ops. Ask agents directly, plan your day with 5 specialist agents, manage tasks, connect Gmail + Calendar.",
   "type": "module",
   "bin": {

package/src/commands/ui.mjs

@@ -268,7 +268,9 @@ function sendJSON(res, statusCode, data) {
 function sendHTML(res, html) {
   res.writeHead(200, {
     'Content-Type': 'text/html; charset=utf-8',
-    'Cache-Control': 'no-cache',
+    'Cache-Control': 'no-store, no-cache, must-revalidate, max-age=0',
+    'Pragma': 'no-cache',
+    'Expires': '0',
   });
   res.end(html);
 }
@@ -658,7 +660,7 @@ export async function cmdUI(args) {
     console.log('');
 
     if (!noBrowser) {
-      openBrowser(url);
+      openBrowser(localUrl);
     }
   });
 

package/src/services/ops-pipeline.mjs

@@ -99,7 +99,7 @@ export async function runPlanningPipeline(config, opts = {}) {
   if (emails.length > 0) {
     parallelPromises.push(
       callAgent(config, 'saber',
-        `Scan these emails for security threats. For each email, classify as SAFE or FLAGGED with reason.\n\nEMAILS:\n${emailContext}\n\nRespond with a JSON object: { "safe": [indices], "flagged": [{ "index": N, "reason": "..." }], "risk_notes": ["..."] }`,
+        `Analyze these emails for REAL security threats. Be smart — distinguish between:\n- LEGITIMATE notifications (Google login alerts from the user's own devices, npm publish confirmations, GitHub 2FA, password change confirmations the user initiated) → these are SAFE\n- ACTUAL threats (phishing links, spoofed senders, social engineering, urgent money requests, unknown login locations, credential harvesting) → these are FLAGGED\n\nDo NOT flag routine service notifications as threats. Only flag emails that require the user's immediate security attention.\n\nEMAILS:\n${emailContext}\n\nRespond with a JSON object: { "safe": [indices], "flagged": [{ "index": N, "reason": "..." }], "risk_notes": ["..."] }`,
       ).then(r => { agentResults.saber = r; ok('SABER: Email security scan complete'); })
        .catch(e => { warn(`SABER failed: ${e.message}`); agentResults.saber = '{"safe":[],"flagged":[],"risk_notes":["scan failed"]}'; })
     );
@@ -141,7 +141,13 @@ export async function runPlanningPipeline(config, opts = {}) {
   // ── Phase 6: CONDUCTOR — Synthesize daily plan ─────────────────────────
   info('Phase 6: CONDUCTOR synthesizing daily plan...');
 
-  const conductorPrompt = `You are the NHA Daily Planner. Synthesize intelligence from 4 specialist agents into a structured daily plan.
+  const conductorPrompt = `You are the NHA Daily Planner. Synthesize intelligence from 4 specialist agents into a structured, practical daily plan.
+
+IMPORTANT GUIDELINES:
+- Be PRACTICAL, not alarmist. Routine notifications (Google login alerts from your own devices, npm publish confirmations, GitHub security notices) are NOT security incidents.
+- Only escalate to "security_alerts" if there is a GENUINE, actionable threat (unknown logins from strange locations, actual phishing, credential leaks).
+- Focus on making the user's day productive, not on creating false urgency.
+- Suggest realistic time blocks based on the actual task complexity.
 
 AGENT REPORTS:
 ${agentResults.saber ? `\n[SABER — Security Scan]\n${agentResults.saber}` : ''}