nothumanallowed 9.2.4 → 9.3.1

package/README.md

@@ -1,10 +1,10 @@
-# NotHumanAllowed (v9.2)
+# NotHumanAllowed (v9.3)
 
 **Tell the AI what you need. It does it.**
 
 Your AI assistant for email, calendar, web search, files, and everything else. Type what you want in plain language — NHA handles it. Read emails, schedule meetings, search the web, manage tasks, analyze documents, browse Google Drive, check GitHub, Slack, Notion — all from one place.
 
-38 AI agents. 50 tools. Web search built in. Streaming chat. Multiple conversations with history and export. Voice chat. Available on **PC, Mac, Linux, and Android**.
+38 AI agents. 58 tools. Web search built in. Streaming chat. Multiple conversations with history and export. Browser automation. Voice chat. Available on **PC, Mac, Linux, and Android**.
 
 100% private — your data never leaves your machine. Zero data on our servers. Free and open source.
 
@@ -26,13 +26,13 @@ nha config set key sk-ant-api03-YOUR_KEY
 # Connect Google (Gmail, Calendar, Drive, Contacts, Tasks)
 nha google auth
 
-# Start chatting — 50 tools available
+# Start chatting — 58 tools available
 nha chat
 ```
 
 ## What You Can Do
 
-### Chat with 50 Tools + Web Search
+### Chat with 58 Tools + Web Search + Browser
 
 ```bash
 nha chat
@@ -62,7 +62,34 @@ NHA: Available 60-min slots:
   3. Wed Apr 9, 02:00 PM - 04:00 PM
 ```
 
-### 50 Tools
+### Browser Automation (Zero Dependencies)
+
+```bash
+nha browse open https://example.com    # Open page in headless Chrome
+nha browse screenshot                   # Capture screenshot
+nha browse extract "h1"                 # Extract content by CSS selector
+nha browse js "document.title"          # Execute JavaScript
+nha browse close                        # Close browser
+```
+
+Control Chrome headless via the Chrome DevTools Protocol — no Puppeteer, no Playwright, no npm dependencies. Pure WebSocket CDP client built from scratch.
+
+All browser tools are also available in `nha chat` and `nha ui`:
+
+```
+You: Open google.com and search for "NHA AI agents"
+NHA: [Browser: google.com] Page loaded: "Google"
+     [Typed: NHA AI agents] into search field
+     [Key: Enter] submitted search
+     [Extracted: results] Found 10 results...
+
+You: Take a screenshot
+NHA: [Screenshot] Captured and saved to ~/nha-screenshot.png
+```
+
+10 browser tools: `browser_open`, `browser_screenshot`, `browser_click`, `browser_type`, `browser_extract`, `browser_js`, `browser_wait`, `browser_scroll`, `browser_key`, `browser_close`. SSRF-protected — blocks localhost and private IPs.
+
+### 58 Tools
 
 | Category | Tools |
 |----------|-------|
@@ -75,6 +102,7 @@ NHA: Available 60-min slots:
 | **Slack** | List channels, read messages, send messages |
 | **Notion** | Search pages/databases, read page content |
 | **Web** | Web search (DuckDuckGo), fetch URL content, deep search with page extraction |
+| **Browser** | Open pages, screenshot, click, type, extract text/HTML, execute JS, wait for elements, scroll, keyboard input, close |
 | **Other** | Maps directions, reminders, file reading |
 
 Every tool is called directly from your machine to the provider's API. NHA servers are never involved.
@@ -109,7 +137,7 @@ nha ask jarvis "Build a REST API for user management"
 nha voice
 ```
 
-Same 50 tools, spoken responses. Opens a local web UI with speech recognition.
+Same 58 tools, spoken responses. Opens a local web UI with speech recognition.
 
 ### Background Daemon
 
@@ -198,7 +226,7 @@ Everything the CLI does, on your phone:
 - **Streaming chat** — see words appear as the AI thinks
 - **Web search** — search the internet and read any webpage, right from chat
 - **Multiple conversations** — save, switch, export your chats
-- **50 tools** — email, calendar, tasks, contacts, Drive, GitHub, Slack, Notion
+- **58 tools** — email, calendar, tasks, contacts, Drive, GitHub, Slack, Notion, browser
 - **38 agents** — tap any agent, ask anything
 - **Voice chat** — talk instead of typing, in 6 languages
 - **Daily plan** — AI analyzes your emails + calendar every morning
@@ -223,7 +251,7 @@ All API calls go directly from your phone to providers. Zero data through NHA se
 Your Machine                     Provider APIs
 ┌──────────────────┐     ┌─────────────────────┐
 │ 38 agents        │────→│ Google (Gmail, Cal,  │
-│ 50 tools         │     │ Drive, Contacts)     │
+│ 58 tools         │     │ Drive, Contacts)     │
 │ Your API keys    │────→│ Your LLM provider   │
 │ Your data        │────→│ GitHub, Slack, Notion│
 │ (encrypted)      │     └─────────────────────┘
@@ -256,6 +284,13 @@ Inside `nha chat`, use slash commands:
 /clear            Clear current conversation
 /help             Show all commands
 /quit             Exit
+
+# Browser (in chat)
+"Open example.com"          → browser_open
+"Take a screenshot"         → browser_screenshot
+"Click the submit button"   → browser_click
+"Type hello in the search"  → browser_type
+"Extract all links"         → browser_extract
 ```
 
 Inline agent routing: `@saber audit this function for SQL injection`
@@ -263,7 +298,7 @@ Inline agent routing: `@saber audit this function for SQL injection`
 ## Commands
 
 ```bash
-# Chat (50 tools + web search, streaming)
+# Chat (58 tools + web search, streaming)
 nha chat                          # Interactive chat with tools
 nha voice                         # Voice chat with TTS
 
@@ -281,6 +316,13 @@ nha ops start                     # Background daemon
 # Google
 nha google auth                   # Connect Google account
 
+# Browser
+nha browse open <url>         # Open in headless Chrome
+nha browse screenshot         # Save screenshot to ~/
+nha browse extract "selector" # Extract text by CSS selector
+nha browse js "code"          # Execute JavaScript
+nha browse close              # Close browser
+
 # Config
 nha config                        # Show settings
 nha config set provider anthropic # Set LLM provider
@@ -296,7 +338,7 @@ nha mcp                           # Start MCP server
 nha ui
 ```
 
-Opens a local web dashboard on `localhost:3847` with streaming chat, multi-conversation, email, calendar, tasks, contacts, drive, agents, notes, settings — all in your browser. Zero framework, pure HTML/CSS/JS.
+Opens a local web dashboard on `localhost:3847` with streaming chat, multi-conversation, email, calendar, tasks, contacts, drive, agents, notes, settings — all in your browser. Zero framework, pure HTML/CSS/JS. Screenshots from browser automation appear inline in the chat.
 
 ## NHA vs OpenClaw
 
@@ -306,9 +348,10 @@ NHA was built after the [OpenClaw/Moltbook security breach](https://nothumanallo
 |---|---|---|
 | Security | 7 CVEs, no WAF | SENTINEL WAF (Rust), 0 CVEs |
 | Agents | 1 generic | 38 specialists |
-| Tools | Install from hub | 50 built-in + web search |
+| Tools | Install from hub | 58 built-in + web search + browser automation |
 | Knowledge | None | 2.6M facts from 16 datasets |
 | Daily Plan | None | 5-agent analysis |
+| Browser | Chrome instance (heavy, attack surface) | Custom CDP engine, zero deps, SSRF-protected |
 | Dependencies | Electron + Chrome | Zero |
 | Privacy | Moltbook leaked 1.49M records | Zero data on our servers |
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "nothumanallowed",
-  "version": "9.2.4",
-  "description": "NotHumanAllowed — 38 AI agents + 50 tools + web search. Streaming chat, multi-conversation, export. Gmail, Calendar, Drive, GitHub, Notion, Slack. Zero-dependency CLI.",
+  "version": "9.3.1",
+  "description": "NotHumanAllowed — 38 AI agents + 58 tools + browser automation + web search. Streaming chat, headless Chrome CDP, multi-conversation, export. Gmail, Calendar, Drive, GitHub, Notion, Slack. Zero-dependency CLI.",
   "type": "module",
   "bin": {
     "nha": "./bin/nha.mjs",

package/src/cli.mjs

@@ -128,6 +128,10 @@ export async function main(argv) {
     case 'voice':
       return cmdVoice(args);
 
+    case 'browse':
+    case 'browser':
+      return cmdBrowse(args);
+
     case 'plugin':
     case 'plugins':
       return cmdPlugin(args);
@@ -247,6 +251,111 @@ async function cmdResponder(args) {
   }
 }
 
+// ── nha browse ────────────────────────────────────────────────────────────
+async function cmdBrowse(args) {
+  const sub = args[0];
+
+  if (sub === 'open' && args[1]) {
+    const { browserOpen, browserInfo } = await import('./services/browser-engine.mjs');
+    info(`Opening ${args[1]}...`);
+    const result = await browserOpen(args[1]);
+    if (result.error) {
+      fail(result.message);
+      process.exit(1);
+    }
+    ok(`${result.title}`);
+    info(`URL: ${result.url}`);
+
+    // If there are more args, execute them as a sequence
+    if (args.length <= 2) {
+      info('Browser is running. Use "nha browse screenshot", "nha browse extract", etc.');
+      info('Or use "nha chat" — browser tools are available in chat.');
+    }
+    return;
+  }
+
+  if (sub === 'screenshot') {
+    const { browserScreenshot, isBrowserRunning } = await import('./services/browser-engine.mjs');
+    if (!isBrowserRunning()) {
+      fail('No browser open. Run: nha browse open <url>');
+      process.exit(1);
+    }
+    const saveTo = args[1] || path.join(os.homedir(), `nha-screenshot-${Date.now()}.png`);
+    info('Capturing screenshot...');
+    const result = await browserScreenshot({ saveTo });
+    if (result.error) {
+      fail(result.message);
+      process.exit(1);
+    }
+    ok(`Screenshot saved: ${result.savedTo}`);
+    return;
+  }
+
+  if (sub === 'extract') {
+    const { browserExtract, isBrowserRunning } = await import('./services/browser-engine.mjs');
+    if (!isBrowserRunning()) {
+      fail('No browser open. Run: nha browse open <url>');
+      process.exit(1);
+    }
+    const selector = args[1] || 'body';
+    const result = await browserExtract({ selector, mode: 'text' });
+    if (result.error) {
+      fail(result.message);
+      process.exit(1);
+    }
+    console.log(result.content);
+    return;
+  }
+
+  if (sub === 'js' && args[1]) {
+    const { browserEval, isBrowserRunning } = await import('./services/browser-engine.mjs');
+    if (!isBrowserRunning()) {
+      fail('No browser open. Run: nha browse open <url>');
+      process.exit(1);
+    }
+    const code = args.slice(1).join(' ');
+    const result = await browserEval(code);
+    if (result.error) {
+      fail(result.message);
+      process.exit(1);
+    }
+    console.log(result.result);
+    return;
+  }
+
+  if (sub === 'close') {
+    const { browserClose } = await import('./services/browser-engine.mjs');
+    const result = await browserClose();
+    ok(result.message);
+    return;
+  }
+
+  // Help
+  console.log(`
+  ${BOLD}${C}NHA Browser${NC}  ${D}— Headless Chrome automation${NC}
+
+  ${C}Usage:${NC}
+    nha browse open <url>       Open a page in headless Chrome
+    nha browse screenshot       Save screenshot to ~/
+    nha browse screenshot out.png  Save to specific path
+    nha browse extract          Extract all text from page
+    nha browse extract "h1"     Extract text from CSS selector
+    nha browse js "code"        Execute JavaScript in page
+    nha browse close            Close the browser
+
+  ${C}In Chat:${NC}  All browser tools are available in ${W}nha chat${NC}:
+    "Open google.com and search for NHA"
+    "Take a screenshot of the page"
+    "Click the submit button"
+    "Fill the email field with test@example.com"
+    "Extract all links from the page"
+
+  ${D}Requires Chrome or Chromium installed. Set CHROME_PATH to override.${NC}
+  ${D}SSRF-protected — blocks localhost and private IPs.${NC}
+  ${D}Zero npm dependencies — pure CDP WebSocket.${NC}
+`);
+}
+
 // ── nha run ────────────────────────────────────────────────────────────────
 async function cmdRun(args) {
   if (args.length === 0) {
@@ -568,6 +677,14 @@ function cmdHelp() {
   console.log(`    run "prompt"          Multi-agent collaboration (server-routed)`);
   console.log(`    run "prompt" ${D}--agents saber,zero${NC}   Collaborate with specific agents\n`);
 
+  console.log(`  ${C}Browser Automation${NC}  ${D}(headless Chrome, zero dependencies)${NC}`);
+  console.log(`    browse open <url>     Open page in headless Chrome (CDP)`);
+  console.log(`    browse screenshot     Capture screenshot to file`);
+  console.log(`    browse extract        Extract page text (CSS selector)`);
+  console.log(`    browse js "code"      Execute JavaScript in page`);
+  console.log(`    browse close          Close browser`);
+  console.log(`    ${D}Also available as tools in nha chat (browser_open, browser_click, etc.)${NC}\n`);
+
   console.log(`  ${C}Daily Operations${NC}  ${D}(Gmail + Calendar + Tasks)${NC}`);
   console.log(`    ui                    Open local web dashboard (http://localhost:3847)`);
   console.log(`    ui --lan              Access from phone/tablet on the same Wi-Fi`);

package/src/commands/chat.mjs

@@ -22,7 +22,7 @@ import { AGENTS_DIR, AGENTS } from '../constants.mjs';
 import { callLLMStream, parseAgentFile } from '../services/llm.mjs';
 
 import { extractMemory } from '../services/memory.mjs';
-import { fail, info, ok, warn, C, G, Y, D, W, BOLD, NC, R } from '../ui.mjs';
+import { fail, info, ok, warn, C, G, Y, D, W, BOLD, NC, R, M } from '../ui.mjs';
 import {
   DESTRUCTIVE_ACTIONS,
   parseActions,
@@ -433,6 +433,26 @@ function formatToolLabel(action, params) {
       return `Searching the web for "${params.query || '...'}"...`;
     case 'fetch_url':
       return `Fetching ${params.url || 'URL'}...`;
+    case 'browser_open':
+      return `Opening ${params.url || 'page'} in browser...`;
+    case 'browser_screenshot':
+      return `Taking screenshot...`;
+    case 'browser_click':
+      return `Clicking ${params.selector || `(${params.x}, ${params.y})`}...`;
+    case 'browser_type':
+      return `Typing into ${params.selector || 'field'}...`;
+    case 'browser_extract':
+      return `Extracting content from ${params.selector || 'page'}...`;
+    case 'browser_js':
+      return `Executing JavaScript...`;
+    case 'browser_wait':
+      return `Waiting for ${params.selector || 'element'}...`;
+    case 'browser_scroll':
+      return `Scrolling ${params.direction || 'down'}...`;
+    case 'browser_key':
+      return `Pressing ${params.key || 'key'}...`;
+    case 'browser_close':
+      return `Closing browser...`;
     case 'gmail_list':
       return `Searching emails...`;
     case 'gmail_read':
@@ -476,6 +496,28 @@ function formatToolResult(action, params, result) {
       const domain = (params.url || '').replace(/^https?:\/\//, '').split('/')[0];
       return `${C}[Fetched: ${domain}]${NC}`;
     }
+    case 'browser_open': {
+      const domain = (params.url || '').replace(/^https?:\/\//, '').split('/')[0];
+      return `${M}[Browser: ${domain}]${NC}`;
+    }
+    case 'browser_screenshot':
+      return `${M}[Screenshot]${NC}`;
+    case 'browser_click':
+      return `${M}[Click: ${params.selector || `(${params.x}, ${params.y})`}]${NC}`;
+    case 'browser_type':
+      return `${M}[Typed: ${(params.text || '').slice(0, 30)}${(params.text || '').length > 30 ? '...' : ''}]${NC}`;
+    case 'browser_extract':
+      return `${M}[Extracted: ${params.selector || 'page'}]${NC}`;
+    case 'browser_js':
+      return `${M}[JS executed]${NC}`;
+    case 'browser_wait':
+      return `${M}[Found: ${params.selector}]${NC}`;
+    case 'browser_scroll':
+      return `${M}[Scrolled ${params.direction || 'down'}]${NC}`;
+    case 'browser_key':
+      return `${M}[Key: ${params.key}]${NC}`;
+    case 'browser_close':
+      return `${M}[Browser closed]${NC}`;
     case 'gmail_list':
     case 'gmail_read':
     case 'gmail_send':

package/src/commands/ui.mjs

@@ -1164,6 +1164,30 @@ export async function cmdUI(args) {
           for (const { action, params } of actions) {
             sendSSE('tool', { action, status: 'executing' });
             try {
+              // For browser_screenshot in web UI: capture and send base64 image
+              if (action === 'browser_screenshot') {
+                const be = await import('../services/browser-engine.mjs');
+                if (!be.isBrowserRunning()) {
+                  toolResults.push({ action, result: 'No browser open. Use browser_open first.' });
+                  sendSSE('tool', { action, status: 'error', error: 'No browser open' });
+                  continue;
+                }
+                const ssResult = await be.browserScreenshot({
+                  fullPage: params.fullPage || false,
+                  format: params.format || 'png',
+                  quality: params.quality,
+                });
+                if (!ssResult.error) {
+                  sendSSE('screenshot', { base64: ssResult.base64, format: params.format || 'png' });
+                  toolResults.push({ action, result: `Screenshot captured (${Math.round(ssResult.size / 1024)}KB)` });
+                  sendSSE('tool', { action, status: 'done', result: 'Screenshot captured' });
+                } else {
+                  toolResults.push({ action, result: `Error: ${ssResult.message}` });
+                  sendSSE('tool', { action, status: 'error', error: ssResult.message });
+                }
+                continue;
+              }
+
               const result = await executeTool(action, params, config);
               toolResults.push({ action, result: typeof result === 'object' ? JSON.stringify(result) : String(result) });
               sendSSE('tool', { action, status: 'done', result: typeof result === 'string' ? result.slice(0, 500) : '' });

package/src/constants.mjs

@@ -5,7 +5,7 @@ import { fileURLToPath } from 'url';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
-export const VERSION = '9.2.4';
+export const VERSION = '9.3.1';
 export const BASE_URL = 'https://nothumanallowed.com/cli';
 export const API_BASE = 'https://nothumanallowed.com/api/v1';