nothumanallowed 9.4.13 → 9.4.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nothumanallowed",
-  "version": "9.4.13",
+  "version": "9.4.15",
   "description": "NotHumanAllowed — 38 AI agents + 58 tools + browser automation + web search. Streaming chat, headless Chrome CDP, multi-conversation, export. Gmail, Calendar, Drive, GitHub, Notion, Slack. Zero-dependency CLI.",
   "type": "module",
   "bin": {

package/src/constants.mjs

@@ -5,7 +5,7 @@ import { fileURLToPath } from 'url';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
-export const VERSION = '9.4.13';
+export const VERSION = '9.4.15';
 export const BASE_URL = 'https://nothumanallowed.com/cli';
 export const API_BASE = 'https://nothumanallowed.com/api/v1';
 

package/src/services/tool-executor.mjs

@@ -349,7 +349,8 @@ RULES:
 - The user's timezone is {{TIMEZONE}}.
 - CRITICAL: when creating calendar events, always use LOCAL time in format "YYYY-MM-DDTHH:MM:SS" WITHOUT any Z suffix or timezone offset.
 - LANGUAGE: Respond in {{LANGUAGE}}. All conversational text, explanations, and descriptions must be in {{LANGUAGE}}. Tool names and JSON blocks remain in English.
-- BROWSER TIP: When extracting data from a page, prefer browser_js with simple JavaScript over complex CSS selectors. Example: browser_js with code "document.body.innerText.slice(0, 3000)" to get all visible text, then parse it yourself. This is more reliable than guessing CSS selectors.
+- BROWSER TIP: When extracting data from a page, prefer browser_js with code "document.body.innerText.slice(0, 3000)" to get all visible text. This is more reliable than guessing CSS selectors.
+- API TIP: For npm package info, use fetch_url with the registry API: fetch_url("https://registry.npmjs.org/PACKAGE/latest") for version/description, and fetch_url("https://api.npmjs.org/downloads/point/last-week/PACKAGE") for weekly downloads. These are JSON APIs, much more reliable than scraping the npm website.
 `.trim();
 
 // ── Action Parser ────────────────────────────────────────────────────────────

package/src/services/web-ui.mjs

@@ -435,9 +435,12 @@ function renderMessages(){
   }
   var h='';chatHistory.forEach(function(m){
     var raw=m.content||'';
+    // Strip any raw base64 data that leaked into content (from LLM hallucinations)
+    raw=raw.replace(/data:image\\/[a-z]+;base64,[A-Za-z0-9+\\/=]{200,}/g,'[image]');
+    raw=raw.replace(/[A-Za-z0-9+\\/=]{500,}/g,'');
     var imgs=[];var idx=0;
-    // Match both base64 inline images and /api/screenshots/ URLs
-    var safe=raw.replace(/!\\[([^\\]]*)\\]\\(((?:data:image\\/[a-z]+;base64,[A-Za-z0-9+\\/=]+|\\/api\\/screenshots\\/[a-zA-Z0-9._-]+))\\)/g,function(_,alt,src){var ph='__IMG'+idx+'__';imgs.push({ph:ph,alt:alt,src:src});idx++;return ph;});
+    // Match both /api/screenshots/ URLs and data:image (short ones only, for inline display)
+    var safe=raw.replace(/!\\[([^\\]]*)\\]\\((\\/api\\/screenshots\\/[a-zA-Z0-9._-]+)\\)/g,function(_,alt,src){var ph='__IMG'+idx+'__';imgs.push({ph:ph,alt:alt,src:src});idx++;return ph;});
     var content=esc(safe);
     for(var i=0;i<imgs.length;i++){content=content.replace(imgs[i].ph,'<img class="screenshot-preview" alt="'+esc(imgs[i].alt)+'" src="'+imgs[i].src+'">');}
     h+='<div class="msg msg--'+esc(m.role)+'"><div class="msg__label">'+esc(m.role==='user'?'You':'NHA')+'</div><div class="msg__bubble">'+content+'</div></div>';