nothumanallowed 9.5.1 → 9.6.0

package/src/commands/ui.mjs

@@ -15,7 +15,7 @@ import fs from 'fs';
 import path from 'path';
 import { loadConfig } from '../config.mjs';
 import { detectMailProvider, hasMailProvider, getProviderStatus } from '../services/mail-router.mjs';
-import { callLLM, callLLMStream, callAgent, parseAgentFile } from '../services/llm.mjs';
+import { callLLM, callAgent, parseAgentFile } from '../services/llm.mjs';
 import { getUnreadImportant, getMessage, listMessages, sendEmail, createDraft } from '../services/mail-router.mjs';
 import { getTodayEvents, getUpcomingEvents, createEvent, updateEvent, getEventsForDate } from '../services/mail-router.mjs';
 import {
@@ -28,20 +28,6 @@ import { runPlanningPipeline } from '../services/ops-pipeline.mjs';
 import { AGENTS, AGENTS_DIR, NHA_DIR, VERSION } from '../constants.mjs';
 import { getHTML } from '../services/web-ui.mjs';
 import { loadChatHistory, saveChatHistory, extractMemory, buildMemoryContext } from '../services/memory.mjs';
-import {
-  createConversation,
-  loadConversation,
-  saveConversation,
-  deleteConversation,
-  listConversations,
-  getOrCreateActive,
-  setActiveId,
-  getHistory,
-  addMessages,
-  exportAsMarkdown,
-  exportAsJson,
-  migrateOldHistory,
-} from '../services/conversations.mjs';
 import { info, ok, fail, warn, C, G, D, NC, BOLD } from '../ui.mjs';
 import {
   parseActions,
@@ -92,7 +78,7 @@ function sendJSON(res, statusCode, data) {
   res.writeHead(statusCode, {
     'Content-Type': 'application/json',
     'Access-Control-Allow-Origin': '*',
-    'Access-Control-Allow-Methods': 'GET,POST,PATCH,DELETE,OPTIONS',
+    'Access-Control-Allow-Methods': 'GET,POST,PATCH,OPTIONS',
     'Access-Control-Allow-Headers': 'Content-Type',
     'Cache-Control': 'no-cache',
   });
@@ -165,9 +151,6 @@ export async function cmdUI(args) {
   const config = loadConfig();
   const htmlPage = getHTML(port);
 
-  // Migrate old chat history to multi-conversation format
-  migrateOldHistory();
-
   // Pre-load agent cards once at startup
   const agentCards = loadAgentCards();
 
@@ -190,7 +173,7 @@ export async function cmdUI(args) {
     if (method === 'OPTIONS') {
       res.writeHead(204, {
         'Access-Control-Allow-Origin': '*',
-        'Access-Control-Allow-Methods': 'GET,POST,PATCH,DELETE,OPTIONS',
+        'Access-Control-Allow-Methods': 'GET,POST,PATCH,OPTIONS',
         'Access-Control-Allow-Headers': 'Content-Type',
       });
       res.end();
@@ -233,46 +216,22 @@ export async function cmdUI(args) {
 
       // ── API Routes ────────────────────────────────────────────────────
 
-      // GET /api/screenshots/:filename — serve saved screenshots from disk
+      // GET /api/screenshots/:filename — serve screenshot files
       if (method === 'GET' && pathname.startsWith('/api/screenshots/')) {
-        const ssName = pathname.split('/').pop();
-        if (!ssName || ssName.includes('..') || !ssName.endsWith('.jpg')) {
-          sendJSON(res, 404, { error: 'not found' });
-          logRequest(method, pathname, 404, Date.now() - start);
-          return;
-        }
-        const ssPath = path.join(NHA_DIR, 'screenshots', ssName);
-        if (!fs.existsSync(ssPath)) {
-          sendJSON(res, 404, { error: 'screenshot not found' });
-          logRequest(method, pathname, 404, Date.now() - start);
-          return;
-        }
-        res.writeHead(200, { 'Content-Type': 'image/jpeg', 'Cache-Control': 'public, max-age=86400' });
-        res.end(fs.readFileSync(ssPath));
-        logRequest(method, pathname, 200, Date.now() - start);
-        return;
-      }
-
-      // POST /api/google/auth — trigger Google OAuth flow from web UI
-      if (method === 'POST' && pathname === '/api/google/auth') {
-        try {
-          const { runAuthFlow } = await import('../services/google-oauth.mjs');
-          // Run auth flow in background — opens browser
-          runAuthFlow(config).then(success => {
-            if (success) config._googleConnected = true;
-          }).catch(() => {});
-          sendJSON(res, 200, { ok: true, message: 'OAuth flow started. Check the browser window that opened.' });
-        } catch (e) {
-          sendJSON(res, 500, { error: e.message });
+        const filename = decodeURIComponent(pathname.split('/').pop());
+        // Prevent path traversal
+        if (filename.includes('..') || filename.includes('/')) {
+          res.writeHead(400); res.end('Bad request'); return;
+        }
+        const os = await import('os');
+        const screenshotPath = path.join(os.default.tmpdir(), 'nha-screenshots', filename);
+        if (fs.existsSync(screenshotPath)) {
+          const data = fs.readFileSync(screenshotPath);
+          res.writeHead(200, { 'Content-Type': 'image/png', 'Cache-Control': 'no-cache' });
+          res.end(data);
+        } else {
+          res.writeHead(404); res.end('Not found');
         }
-        logRequest(method, pathname, 200, Date.now() - start);
-        return;
-      }
-
-      // GET /api/health — simple health check
-      if (method === 'GET' && pathname === '/api/health') {
-        sendJSON(res, 200, { ok: true, version: VERSION });
-        logRequest(method, pathname, 200, Date.now() - start);
         return;
       }
 
@@ -350,40 +309,6 @@ export async function cmdUI(args) {
         return;
       }
 
-      // POST /api/email/mark-read — mark email as read
-      if (method === 'POST' && pathname === '/api/email/mark-read') {
-        const body = await parseBody(req);
-        if (!body.messageId) {
-          sendJSON(res, 400, { error: 'messageId required' });
-          logRequest(method, pathname, 400, Date.now() - start);
-          return;
-        }
-        try {
-          const gmail = await import('../services/google-gmail.mjs');
-          await gmail.markAsRead(config, body.messageId);
-          sendJSON(res, 200, { ok: true });
-        } catch (e) {
-          sendJSON(res, 200, { ok: false, error: e.message });
-        }
-        logRequest(method, pathname, 200, Date.now() - start);
-        return;
-      }
-
-      // POST /api/email/mark-all-read — mark ALL unread as read
-      if (method === 'POST' && pathname === '/api/email/mark-all-read') {
-        try {
-          const gmail = await import('../services/google-gmail.mjs');
-          const result = await gmail.markAllAsRead(config);
-          // Update local cache
-          dash.emails.forEach(e => { e.isUnread = false; });
-          sendJSON(res, 200, { ok: true, count: result.count });
-        } catch (e) {
-          sendJSON(res, 200, { ok: false, error: e.message });
-        }
-        logRequest(method, pathname, 200, Date.now() - start);
-        return;
-      }
-
       // POST /api/contacts — create contact
       if (method === 'POST' && pathname === '/api/contacts') {
         try {
@@ -596,9 +521,9 @@ export async function cmdUI(args) {
           } else {
             // Show all recent inbox emails (read + unread)
             const gm = await import('../services/google-gmail.mjs');
-            const msgRefs = await gm.listMessages(config, 'in:inbox', 50);
+            const msgRefs = await gm.listMessages(config, 'in:inbox', 30);
             emails = [];
-            for (const ref of msgRefs.slice(0, 50)) {
+            for (const ref of msgRefs.slice(0, 30)) {
               try {
                 const msg = await gm.getMessage(config, ref.id);
                 emails.push(msg);
@@ -720,310 +645,29 @@ export async function cmdUI(args) {
           return;
         }
 
-        const msg = body.message.trim();
-
-        // ── Slash commands ───────────────────────────────────────
-        if (msg === '/agents') {
-          const custom = agentCards.filter(a => a.category === 'custom').map(a => a.name);
-          const builtIn = agentCards.filter(a => a.category !== 'custom').map(a => a.name);
-          sendJSON(res, 200, { response: `**Available agents (${agentCards.length}):**\n\nBuilt-in: ${builtIn.join(', ')}\n${custom.length ? `\nCustom: ${custom.join(', ')}` : ''}\n\nUse \`@agent your message\` to route to a specific agent.\nUse \`/agent <name>\` to switch all messages.\nUse \`/agent off\` to return to NHA Chat.` });
-          logRequest(method, pathname, 200, Date.now() - start);
-          return;
-        }
-
-        if (msg.startsWith('/agent ')) {
-          const agentName = msg.slice(7).trim().toLowerCase();
-          if (agentName === 'off' || agentName === 'reset') {
-            config._chatAgent = null;
-            sendJSON(res, 200, { response: 'Switched back to NHA Chat.' });
-          } else {
-            const found = agentCards.find(a => a.name === agentName);
-            const agentFile = path.join(AGENTS_DIR, `${agentName}.mjs`);
-            let sysPrompt = `You are the ${agentName} AI agent. Be expert and helpful.`;
-            if (fs.existsSync(agentFile)) {
-              const src = fs.readFileSync(agentFile, 'utf-8');
-              const parsed = parseAgentFile(src, agentName);
-              if (parsed.systemPrompt) sysPrompt = parsed.systemPrompt;
-            }
-            config._chatAgent = { name: agentName, systemPrompt: sysPrompt };
-            sendJSON(res, 200, { response: `Now chatting with **${agentName.toUpperCase()}**${found ? ` (${found.tagline})` : ''}.\nAll messages will be routed to this agent.\nType \`/agent off\` to return to NHA Chat.` });
-          }
-          logRequest(method, pathname, 200, Date.now() - start);
-          return;
-        }
-
-        if (msg === '/create-agent' || msg.startsWith('/create-agent ')) {
-          const parts = msg.slice(14).trim();
-          if (!parts) {
-            sendJSON(res, 200, { response: '**Create Custom Agent**\n\nUsage:\n```\n/create-agent mybot "Short description" "You are an expert in..."\n```\n\nExample:\n```\n/create-agent chef "Italian cooking expert" "You are a master Italian chef. Always suggest authentic recipes."\n```' });
-            logRequest(method, pathname, 200, Date.now() - start);
-            return;
-          }
-          const nameMatch = parts.match(/^(\S+)\s+(.*)/s);
-          if (!nameMatch) {
-            sendJSON(res, 200, { response: 'Usage: `/create-agent <name> "<tagline>" "<system prompt>"`' });
-            logRequest(method, pathname, 200, Date.now() - start);
-            return;
-          }
-          const agentName = nameMatch[1].toLowerCase().replace(/[^a-z0-9_-]/g, '');
-          const rest = nameMatch[2];
-          const quoteParts = rest.match(/"([^"]*)"/g);
-          let tagline = '', sysPrompt = '';
-          if (quoteParts && quoteParts.length >= 2) {
-            tagline = quoteParts[0].replace(/"/g, '');
-            sysPrompt = quoteParts[1].replace(/"/g, '');
-          } else {
-            tagline = rest.replace(/"/g, '').trim();
-            sysPrompt = tagline;
-          }
-          if (!agentName || !tagline) {
-            sendJSON(res, 200, { response: 'All fields required. Usage: `/create-agent name "tagline" "system prompt"`' });
-            logRequest(method, pathname, 200, Date.now() - start);
-            return;
-          }
-          const agentFile = path.join(AGENTS_DIR, `${agentName}.mjs`);
-          if (fs.existsSync(agentFile)) {
-            sendJSON(res, 200, { response: `Agent "${agentName}" already exists. Delete it first with \`/delete-agent ${agentName}\`` });
-            logRequest(method, pathname, 200, Date.now() - start);
-            return;
-          }
-          const content = `// NHA Custom Agent: ${agentName}\n// Created: ${new Date().toISOString()}\n\nexport const CARD = {\n  name: '${agentName}',\n  displayName: '${agentName.toUpperCase()}',\n  category: 'custom',\n  tagline: '${tagline.replace(/'/g, "\\'")}',\n};\n\nexport const SYSTEM_PROMPT = \`${sysPrompt.replace(/`/g, '\\`')}\`;\n`;
-          if (!fs.existsSync(AGENTS_DIR)) fs.mkdirSync(AGENTS_DIR, { recursive: true });
-          fs.writeFileSync(agentFile, content, 'utf-8');
-          // Reload agent cards
-          agentCards.push({ name: agentName, displayName: agentName.toUpperCase(), category: 'custom', tagline });
-          sendJSON(res, 200, { response: `Agent **${agentName.toUpperCase()}** created!\n\nSwitch to it: \`/agent ${agentName}\`\nOr use inline: \`@${agentName} your question\`` });
-          logRequest(method, pathname, 200, Date.now() - start);
-          return;
-        }
-
-        if (msg.startsWith('/delete-agent ')) {
-          const agentName = msg.slice(14).trim().toLowerCase();
-          const agentFile = path.join(AGENTS_DIR, `${agentName}.mjs`);
-          if (!fs.existsSync(agentFile)) {
-            sendJSON(res, 200, { response: `Agent "${agentName}" not found.` });
-          } else {
-            fs.unlinkSync(agentFile);
-            const idx = agentCards.findIndex(a => a.name === agentName);
-            if (idx >= 0) agentCards.splice(idx, 1);
-            sendJSON(res, 200, { response: `Agent "${agentName}" deleted.` });
-          }
-          logRequest(method, pathname, 200, Date.now() - start);
-          return;
-        }
-
-        if (msg === '/help') {
-          sendJSON(res, 200, { response: '**Chat Commands**\n\n`/agents` — List all agents\n`/agent <name>` — Switch chat to agent\n`/agent off` — Return to NHA Chat\n`/create-agent name "tagline" "prompt"` — Create custom agent\n`/delete-agent name` — Delete agent\n`@agent message` — Route single message to agent\n`/help` — Show this help' });
-          logRequest(method, pathname, 200, Date.now() - start);
-          return;
-        }
-
-        // ── Direct intent handlers (bypass LLM for reliability) ──
-        const msgLower = msg.toLowerCase();
-
-        // Mark all emails as read
-        if (msgLower.match(/segna.*tutt.*lett|mark.*all.*read|tutte.*lett[ae]|read.*all.*email|segna.*email.*lett/)) {
-          try {
-            const gmail = await import('../services/google-gmail.mjs');
-            const result = await gmail.markAllAsRead(config);
-            const count = result.count || 0;
-            sendJSON(res, 200, { response: count > 0 ? `Done! ${count} email${count !== 1 ? 's' : ''} marked as read.` : 'All emails are already read.', toolResults: [{ action: 'gmail_mark_read', result: `${count} marked` }] });
-          } catch (e) {
-            sendJSON(res, 200, { response: `Error marking emails as read: ${e.message}` });
-          }
-          logRequest(method, pathname, 200, Date.now() - start);
-          return;
-        }
-
-        // ── @agent inline routing ────────────────────────────────
-        let effectiveSystemPrompt = config._chatAgent?.systemPrompt || null;
-        const atMatch = msg.match(/^@(\w+)\s+([\s\S]*)/);
-        if (atMatch) {
-          const inlineAgent = atMatch[1].toLowerCase();
-          body.message = atMatch[2];
-          const agentFile = path.join(AGENTS_DIR, `${inlineAgent}.mjs`);
-          if (fs.existsSync(agentFile)) {
-            const src = fs.readFileSync(agentFile, 'utf-8');
-            const parsed = parseAgentFile(src, inlineAgent);
-            if (parsed.systemPrompt) effectiveSystemPrompt = parsed.systemPrompt;
-          } else {
-            effectiveSystemPrompt = `You are the ${inlineAgent} AI agent. Be expert, concise, and helpful.`;
-          }
-        }
-
         if (!config.llm.apiKey) {
           sendJSON(res, 200, { response: 'No API key configured. Run: nha config set key YOUR_KEY', error: 'no_api_key' });
           logRequest(method, pathname, 200, Date.now() - start);
           return;
         }
 
-        // Build message with rolling context (same strategy as streaming path)
-        const requestHistory = (body.history || []).map(h => ({
-          role: h.role,
-          content: (h.content || '').replace(/!\[Screenshot\]\(data:image\/[^)]+\)/g, '[Screenshot taken]'),
-        }));
-        const RECENT = 6;
+        // Build message with history (merge persisted + request history)
+        const requestHistory = body.history || [];
         const parts = [];
-        if (requestHistory.length > RECENT) {
-          const older = requestHistory.slice(0, -RECENT);
-          const sLines = [];
-          for (let i = 0; i < older.length; i += 2) {
-            const u = older[i]?.content?.slice(0, 150)?.replace(/\n/g, ' ') || '';
-            const a = older[i + 1]?.content?.slice(0, 200)?.replace(/\n/g, ' ') || '';
-            if (u) sLines.push(`- User: "${u.trim()}${u.length >= 150 ? '...' : ''}" → ${a.trim()}${a.length >= 200 ? '...' : ''}`);
-          }
-          if (sLines.length > 0) parts.push(`[CONTEXT — ${sLines.length} earlier exchanges]\n${sLines.join('\n')}\n[END CONTEXT]`);
-        }
-        for (const turn of requestHistory.slice(-RECENT)) {
-          parts.push(`${turn.role === 'user' ? '[User]' : '[Assistant]'} ${turn.content.slice(0, 2000)}`);
+        for (const turn of requestHistory) {
+          const prefix = turn.role === 'user' ? '[User]' : '[Assistant]';
+          parts.push(`${prefix} ${turn.content}`);
         }
         parts.push(`[User] ${body.message}`);
-        let userMessage = parts.join('\n\n');
+        const userMessage = parts.join('\n\n');
 
         // Inject episodic memory context into the system prompt
-        const basePrompt = effectiveSystemPrompt || chatSystemPrompt;
-        let enrichedSystemPrompt = basePrompt;
+        let enrichedSystemPrompt = chatSystemPrompt;
         try {
           const memCtx = buildMemoryContext('chat', body.message);
-          if (memCtx) enrichedSystemPrompt = basePrompt + memCtx;
+          if (memCtx) enrichedSystemPrompt = chatSystemPrompt + memCtx;
         } catch { /* memory unavailable */ }
 
-        // Handle image attachment — vision API
-        if (body.imageBase64 && body.imageMimeType) {
-          try {
-            const provider = config.llm.provider || 'anthropic';
-            const apiKey = config.llm.apiKey;
-            const model = config.llm.model;
-            const imagePrompt = body.message || 'Describe this image in detail. Extract any text or important information.';
-            let visionResponse = '';
-
-            if (provider === 'anthropic') {
-              const r = await fetch('https://api.anthropic.com/v1/messages', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json', 'x-api-key': apiKey, 'anthropic-version': '2023-06-01' },
-                body: JSON.stringify({
-                  model: model || 'claude-sonnet-4-20250514', max_tokens: 4096, system: enrichedSystemPrompt,
-                  messages: [{ role: 'user', content: [
-                    { type: 'image', source: { type: 'base64', media_type: body.imageMimeType, data: body.imageBase64 } },
-                    { type: 'text', text: imagePrompt },
-                  ]}],
-                }),
-              });
-              if (!r.ok) throw new Error(`Anthropic ${r.status}`);
-              const d = await r.json();
-              visionResponse = d.content?.[0]?.text || '';
-            } else if (provider === 'openai') {
-              const r = await fetch('https://api.openai.com/v1/chat/completions', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${apiKey}` },
-                body: JSON.stringify({
-                  model: model || 'gpt-4o-mini', max_tokens: 4096,
-                  messages: [
-                    { role: 'system', content: enrichedSystemPrompt },
-                    { role: 'user', content: [
-                      { type: 'image_url', image_url: { url: `data:${body.imageMimeType};base64,${body.imageBase64}` } },
-                      { type: 'text', text: imagePrompt },
-                    ]},
-                  ],
-                }),
-              });
-              if (!r.ok) throw new Error(`OpenAI ${r.status}`);
-              const d = await r.json();
-              visionResponse = d.choices?.[0]?.message?.content || '';
-            } else if (provider === 'gemini') {
-              const m = model || 'gemini-2.0-flash';
-              const r = await fetch(`https://generativelanguage.googleapis.com/v1beta/models/${m}:generateContent?key=${apiKey}`, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                  system_instruction: { parts: [{ text: enrichedSystemPrompt }] },
-                  contents: [{ parts: [
-                    { inline_data: { mime_type: body.imageMimeType, data: body.imageBase64 } },
-                    { text: imagePrompt },
-                  ]}],
-                  generationConfig: { maxOutputTokens: 4096 },
-                }),
-              });
-              if (!r.ok) throw new Error(`Gemini ${r.status}`);
-              const d = await r.json();
-              visionResponse = d.candidates?.[0]?.content?.parts?.[0]?.text || '';
-            } else {
-              visionResponse = `Vision not supported for provider "${provider}". Use anthropic, openai, or gemini.`;
-            }
-
-            sendJSON(res, 200, { response: visionResponse });
-            logRequest(method, pathname, 200, Date.now() - start);
-            return;
-          } catch (e) {
-            sendJSON(res, 200, { response: null, error: e.message });
-            logRequest(method, pathname, 200, Date.now() - start);
-            return;
-          }
-        }
-
-        // Handle PDF attachment — send as document to Claude (native PDF support)
-        if (body.pdfBase64 && body.pdfName) {
-          try {
-            const provider = config.llm.provider || 'anthropic';
-            const apiKey = config.llm.apiKey;
-            const model = config.llm.model;
-            const pdfPrompt = body.message || `Read and analyze this PDF document "${body.pdfName}". Extract all text content, summarize key information.`;
-            let pdfResponse = '';
-
-            if (provider === 'anthropic') {
-              const r = await fetch('https://api.anthropic.com/v1/messages', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json', 'x-api-key': apiKey, 'anthropic-version': '2023-06-01' },
-                body: JSON.stringify({
-                  model: model || 'claude-sonnet-4-20250514', max_tokens: 8192, system: enrichedSystemPrompt,
-                  messages: [{ role: 'user', content: [
-                    { type: 'document', source: { type: 'base64', media_type: 'application/pdf', data: body.pdfBase64 } },
-                    { type: 'text', text: pdfPrompt },
-                  ]}],
-                }),
-              });
-              if (!r.ok) throw new Error(`Anthropic ${r.status}: ${(await r.text()).slice(0, 200)}`);
-              const d = await r.json();
-              pdfResponse = d.content?.[0]?.text || '';
-            } else if (provider === 'gemini') {
-              const m = model || 'gemini-2.0-flash';
-              const r = await fetch(`https://generativelanguage.googleapis.com/v1beta/models/${m}:generateContent?key=${apiKey}`, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                  system_instruction: { parts: [{ text: enrichedSystemPrompt }] },
-                  contents: [{ parts: [
-                    { inline_data: { mime_type: 'application/pdf', data: body.pdfBase64 } },
-                    { text: pdfPrompt },
-                  ]}],
-                  generationConfig: { maxOutputTokens: 8192 },
-                }),
-              });
-              if (!r.ok) throw new Error(`Gemini ${r.status}`);
-              const d = await r.json();
-              pdfResponse = d.candidates?.[0]?.content?.parts?.[0]?.text || '';
-            } else {
-              pdfResponse = `PDF reading requires Anthropic (Claude) or Gemini. Your provider "${provider}" does not support native PDF documents.`;
-            }
-
-            sendJSON(res, 200, { response: pdfResponse });
-            logRequest(method, pathname, 200, Date.now() - start);
-            return;
-          } catch (e) {
-            sendJSON(res, 200, { response: null, error: `PDF error: ${e.message}` });
-            logRequest(method, pathname, 200, Date.now() - start);
-            return;
-          }
-        }
-
-        // Handle text file attachment
-        if (body.fileContent && body.fileName) {
-          const filePrompt = body.message
-            ? `User asks about file "${body.fileName}": ${body.message}\n\nFile content:\n${body.fileContent.slice(0, 8000)}`
-            : `Analyze this file "${body.fileName}":\n\n${body.fileContent.slice(0, 8000)}`;
-          userMessage = filePrompt;
-        }
-
         try {
           const response = await callLLM(config, enrichedSystemPrompt, userMessage);
           const { textParts, actions } = parseActions(response);
@@ -1043,11 +687,8 @@ export async function cmdUI(args) {
           let fullResponse;
           if (toolResults.length > 0) {
             // Second LLM call with real tool results — forces the LLM to use actual data
-            const toolContext = toolResults.map(t => {
-              let clean = t.result.replace(/\[Screenshot[^\]]*\]/g, '').replace(/!\[.*?\]\(data:image[^)]+\)/g, '').slice(0, 3000);
-              return `[${t.action} result]: ${clean.trim()}`;
-            }).join('\n\n');
-            const followUp = `The user asked: "${body.message}"\n\nI executed these tools and got REAL results:\n\n${toolContext}\n\nNow respond conversationally based ONLY on the REAL data above. Do NOT output any JSON blocks, base64, or image markdown — just natural text.`;
+            const toolContext = toolResults.map(t => `[${t.action} result]: ${t.result}`).join('\n\n');
+            const followUp = `The user asked: "${body.message}"\n\nI executed these tools and got REAL results:\n\n${toolContext}\n\nNow respond to the user based ONLY on the REAL data above. Do NOT invent or fabricate any information. Present the actual results clearly.`;
             try {
               fullResponse = await callLLM(config, enrichedSystemPrompt, followUp);
             } catch {
@@ -1075,334 +716,6 @@ export async function cmdUI(args) {
         return;
       }
 
-      // ── Conversations API ────────────────────────────────────────────
-
-      // GET /api/conversations — list all
-      if (method === 'GET' && pathname === '/api/conversations') {
-        const convs = listConversations();
-        sendJSON(res, 200, { conversations: convs });
-        logRequest(method, pathname, 200, Date.now() - start);
-        return;
-      }
-
-      // POST /api/conversations — create new
-      if (method === 'POST' && pathname === '/api/conversations') {
-        const conv = createConversation();
-        setActiveId(conv.id);
-        sendJSON(res, 201, { conversation: conv });
-        logRequest(method, pathname, 201, Date.now() - start);
-        return;
-      }
-
-      // GET /api/conversations/:id
-      if (method === 'GET' && pathname.match(/^\/api\/conversations\/[a-z0-9-]+$/)) {
-        const id = pathname.split('/')[3];
-        const conv = loadConversation(id);
-        if (!conv) { sendJSON(res, 404, { error: 'Conversation not found' }); }
-        else { sendJSON(res, 200, { conversation: conv }); }
-        logRequest(method, pathname, conv ? 200 : 404, Date.now() - start);
-        return;
-      }
-
-      // DELETE /api/conversations/:id
-      if (method === 'DELETE' && pathname.match(/^\/api\/conversations\/[a-z0-9-]+$/)) {
-        const id = pathname.split('/')[3];
-        const ok = deleteConversation(id);
-        sendJSON(res, ok ? 200 : 404, { ok });
-        logRequest(method, pathname, ok ? 200 : 404, Date.now() - start);
-        return;
-      }
-
-      // PATCH /api/conversations/:id — rename
-      if (method === 'PATCH' && pathname.match(/^\/api\/conversations\/[a-z0-9-]+$/)) {
-        const id = pathname.split('/')[3];
-        const body = await parseBody(req);
-        const conv = loadConversation(id);
-        if (!conv) { sendJSON(res, 404, { error: 'Not found' }); }
-        else {
-          if (body.title) conv.title = body.title;
-          saveConversation(conv);
-          sendJSON(res, 200, { conversation: conv });
-        }
-        logRequest(method, pathname, conv ? 200 : 404, Date.now() - start);
-        return;
-      }
-
-      // GET /api/conversations/:id/export?format=md|json
-      if (method === 'GET' && pathname.match(/^\/api\/conversations\/[a-z0-9-]+\/export$/)) {
-        const id = pathname.split('/')[3];
-        const conv = loadConversation(id);
-        if (!conv) { sendJSON(res, 404, { error: 'Not found' }); logRequest(method, pathname, 404, Date.now() - start); return; }
-        const url = new URL(req.url, `http://${req.headers.host}`);
-        const format = url.searchParams.get('format') || 'md';
-        if (format === 'json') {
-          const exported = exportAsJson(conv);
-          res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Disposition': `attachment; filename="nha-chat-${id}.json"` });
-          res.end(exported);
-        } else {
-          const exported = exportAsMarkdown(conv);
-          res.writeHead(200, { 'Content-Type': 'text/markdown', 'Content-Disposition': `attachment; filename="nha-chat-${id}.md"` });
-          res.end(exported);
-        }
-        logRequest(method, pathname, 200, Date.now() - start);
-        return;
-      }
-
-      // ── Streaming Chat API ─────────────────────────────────────────────
-
-      // POST /api/chat/stream — SSE streaming chat with conversation persistence
-      if (method === 'POST' && pathname === '/api/chat/stream') {
-        const body = await parseBody(req);
-        if (!body.message) { sendJSON(res, 400, { error: 'message required' }); logRequest(method, pathname, 400, Date.now() - start); return; }
-        if (!config.llm.apiKey) { sendJSON(res, 200, { error: 'no_api_key' }); logRequest(method, pathname, 200, Date.now() - start); return; }
-
-        const msg = body.message.trim();
-        const convId = body.conversationId;
-
-        // Build system prompt
-        let effectiveSystemPrompt = config._chatAgent?.systemPrompt || null;
-        let effectiveMsg = msg;
-        const atMatch = msg.match(/^@(\w+)\s+([\s\S]*)/);
-        if (atMatch) {
-          const inlineAgent = atMatch[1].toLowerCase();
-          effectiveMsg = atMatch[2];
-          const agentFile = path.join(AGENTS_DIR, `${inlineAgent}.mjs`);
-          if (fs.existsSync(agentFile)) {
-            const src = fs.readFileSync(agentFile, 'utf-8');
-            const parsed = parseAgentFile(src, inlineAgent);
-            if (parsed.systemPrompt) effectiveSystemPrompt = parsed.systemPrompt;
-          }
-        }
-
-        const basePrompt = effectiveSystemPrompt || chatSystemPrompt;
-        let enrichedPrompt = basePrompt;
-        try { const m = buildMemoryContext('chat', effectiveMsg); if (m) enrichedPrompt = basePrompt + m; } catch {}
-
-        // Build message with rolling context window:
-        // - Recent messages (last 6): full content up to 2000 chars
-        // - Older messages: compressed to 1-line summaries preserving full context
-        const rawHistory = (body.history || []).map(h => ({
-          role: h.role,
-          content: (h.content || '').replace(/!\[Screenshot\]\(data:image\/[^)]+\)/g, '[Screenshot taken]'),
-        }));
-
-        const RECENT_COUNT = 6;
-        const parts = [];
-
-        if (rawHistory.length > RECENT_COUNT) {
-          // Compress older messages into a conversation summary
-          const older = rawHistory.slice(0, -RECENT_COUNT);
-          const summaryLines = [];
-          for (let i = 0; i < older.length; i += 2) {
-            const userMsg = older[i]?.content?.slice(0, 150)?.replace(/\n/g, ' ') || '';
-            const assistantMsg = older[i + 1]?.content?.slice(0, 200)?.replace(/\n/g, ' ') || '';
-            if (userMsg) summaryLines.push(`- User asked: "${userMsg.trim()}${userMsg.length >= 150 ? '...' : ''}" → Assistant: ${assistantMsg.trim()}${assistantMsg.length >= 200 ? '...' : ''}`);
-          }
-          if (summaryLines.length > 0) {
-            parts.push(`[CONVERSATION CONTEXT — ${summaryLines.length} earlier exchanges]\n${summaryLines.join('\n')}\n[END CONTEXT]`);
-          }
-        }
-
-        // Recent messages in full
-        const recent = rawHistory.slice(-RECENT_COUNT);
-        for (const turn of recent) {
-          const prefix = turn.role === 'user' ? '[User]' : '[Assistant]';
-          parts.push(`${prefix} ${turn.content.slice(0, 2000)}`);
-        }
-
-        parts.push(`[User] ${effectiveMsg}`);
-        const userMessage = parts.join('\n\n');
-
-        // Handle file/image/pdf attachments — fall back to non-streaming
-        if (body.imageBase64 || body.pdfBase64 || body.fileContent) {
-          // Redirect to regular /api/chat for attachment handling
-          sendJSON(res, 200, { error: 'attachments_use_regular', redirect: '/api/chat' });
-          logRequest(method, pathname, 200, Date.now() - start);
-          return;
-        }
-
-        // SSE headers
-        res.writeHead(200, {
-          'Content-Type': 'text/event-stream',
-          'Cache-Control': 'no-cache',
-          'Connection': 'keep-alive',
-          'Access-Control-Allow-Origin': '*',
-        });
-
-        const sendSSE = (event, data) => {
-          res.write(`event: ${event}\ndata: ${JSON.stringify(data)}\n\n`);
-        };
-
-        sendSSE('processing', {});
-
-        try {
-          let fullResponse = '';
-          fullResponse = await callLLMStream(config, enrichedPrompt, userMessage, (chunk) => {
-            sendSSE('token', { content: chunk });
-          });
-
-          // Parse and execute tools
-          const { textParts, actions } = parseActions(fullResponse);
-          const toolResults = [];
-
-          // Auto-detect search + screenshot intent from user message
-          const wantsScreenshot = /screenshot|screen\s*shot|schermo|cattura|foto|immagine/i.test(msg);
-          const wantsSearch = /\b(cerca|search|find|look\s*up|ricerca|cercare)\b/i.test(msg);
-
-          // If user asked to search but LLM didn't call web_search, force it
-          if (wantsSearch && !actions.some(a => a.action === 'web_search')) {
-            // Extract search query from message (remove action words)
-            const searchQuery = msg.replace(/\b(cerca|search|find|look\s*up|ricerca|cercare|e\s+fai|and\s+take|screenshot|screen\s*shot|schermo|cattura|foto|immagine|dei|dei\s+risultati|of\s+the\s+results|risultati|results)\b/gi, '').replace(/["""]/g, '').trim();
-            if (searchQuery.length > 2) {
-              actions.push({ action: 'web_search', params: { query: searchQuery, screenshot: wantsScreenshot } });
-            }
-          }
-
-          for (const { action, params } of actions) {
-            // Force screenshot=true on web_search if user asked for screenshot
-            if (action === 'web_search' && wantsScreenshot && !params.screenshot) {
-              params.screenshot = true;
-            }
-
-            sendSSE('tool', { action, status: 'executing' });
-            try {
-              // For browser_screenshot in web UI: capture and send base64 image
-              if (action === 'browser_screenshot') {
-                const be = await import('../services/browser-engine.mjs');
-                if (!be.isBrowserRunning()) {
-                  toolResults.push({ action, result: 'No browser open. Use browser_open first.' });
-                  sendSSE('tool', { action, status: 'error', error: 'No browser open' });
-                  continue;
-                }
-                // Scroll to top for best viewport
-                await be.browserScroll({ direction: 'top' });
-                await new Promise(r => setTimeout(r, 300));
-                const ssResult = await be.browserScreenshot({
-                  fullPage: false, // Always viewport
-                  format: 'jpeg',
-                  quality: 75,
-                });
-                if (!ssResult.error) {
-                  // Save screenshot to disk for persistence across sessions
-                  const ssDir = path.join(NHA_DIR, 'screenshots');
-                  fs.mkdirSync(ssDir, { recursive: true });
-                  const ssFilename = `ss-${Date.now()}.jpg`;
-                  fs.writeFileSync(path.join(ssDir, ssFilename), Buffer.from(ssResult.base64, 'base64'));
-
-                  sendSSE('screenshot', { base64: ssResult.base64, format: 'jpeg', filename: ssFilename });
-                  toolResults.push({ action, result: `Screenshot captured (${Math.round(ssResult.size / 1024)}KB) [file: ${ssFilename}]` });
-                  // Store screenshot ref for persistence
-                  if (!res._screenshotFiles) res._screenshotFiles = [];
-                  res._screenshotFiles.push(ssFilename);
-                  sendSSE('tool', { action, status: 'done', result: 'Screenshot captured' });
-                } else {
-                  toolResults.push({ action, result: `Error: ${ssResult.message}` });
-                  sendSSE('tool', { action, status: 'error', error: ssResult.message });
-                }
-                continue;
-              }
-
-              const result = await executeTool(action, params, config);
-              const resultStr = typeof result === 'object' ? JSON.stringify(result) : String(result);
-              toolResults.push({ action, result: resultStr });
-              sendSSE('tool', { action, status: 'done', result: typeof resultStr === 'string' ? resultStr.slice(0, 500) : '' });
-
-              // Send live browser frame after browser actions (low-quality thumbnail for viewer)
-              if (action.startsWith('browser_') && action !== 'browser_close') {
-                try {
-                  const be = await import('../services/browser-engine.mjs');
-                  if (be.isBrowserRunning()) {
-                    const frame = await be.browserScreenshot({ fullPage: false, format: 'jpeg', quality: 30 });
-                    if (!frame.error) {
-                      const info = await be.browserInfo();
-                      sendSSE('browser_frame', { base64: frame.base64, format: 'jpeg', url: (info.url || '').slice(0, 80) });
-                    }
-                  }
-                } catch { /* frame capture failed, non-critical */ }
-              }
-
-              // If the tool produced a screenshot (web_search with screenshot=true), send it via SSE
-              if (resultStr.includes('[Screenshot of results captured')) {
-                try {
-                  const fileMatch = resultStr.match(/file:(ss-\d+\.jpg)/);
-                  console.log(`  [screenshot] file match: ${fileMatch?.[1] || 'NONE'}`);
-                  if (fileMatch) {
-                    const ssFilename = fileMatch[1];
-                    const ssPath = path.join(NHA_DIR, 'screenshots', ssFilename);
-                    const exists = fs.existsSync(ssPath);
-                    console.log(`  [screenshot] path: ${ssPath}, exists: ${exists}`);
-                    if (exists) {
-                      const ssBase64 = fs.readFileSync(ssPath).toString('base64');
-                      console.log(`  [screenshot] sending SSE, base64 size: ${ssBase64.length}`);
-                      sendSSE('screenshot', { base64: ssBase64, format: 'jpeg', filename: ssFilename });
-                      sendSSE('browser_frame', { base64: ssBase64, format: 'jpeg', url: 'Search results' });
-                      if (!res._screenshotFiles) res._screenshotFiles = [];
-                      res._screenshotFiles.push(ssFilename);
-                    }
-                  }
-                } catch (ssErr) { console.log(`  [screenshot] ERROR: ${ssErr.message}`); }
-              }
-            } catch (e) {
-              toolResults.push({ action, result: `Error: ${e.message}` });
-              sendSSE('tool', { action, status: 'error', error: e.message });
-            }
-          }
-
-          // If tools were executed, make a second LLM call with results
-          let finalResponse = fullResponse;
-          if (toolResults.length > 0) {
-            const toolContext = toolResults.map(t => {
-              // Strip screenshot file references and base64 from tool results — the screenshot was already sent to the UI
-              let clean = t.result.replace(/\[Screenshot[^\]]*\]/g, '').replace(/!\[.*?\]\(data:image[^)]+\)/g, '').slice(0, 3000);
-              return `[${t.action} result]: ${clean.trim()}`;
-            }).join('\n\n');
-            const followUp = `The user asked: "${msg}"\n\nI executed these tools and got REAL results:\n\n${toolContext}\n\nNow respond to the user conversationally based ONLY on the REAL data above. Present the results clearly. Do NOT output any JSON blocks, any base64 data, or any image markdown — just natural text. If a screenshot was taken, just mention "Screenshot captured" without embedding it.`;
-            sendSSE('tool_synthesis', {});
-            try {
-              finalResponse = await callLLMStream(config, enrichedPrompt, followUp, (chunk) => {
-                sendSSE('token', { content: chunk });
-              });
-              // Strip any JSON blocks and base64 the LLM might have emitted
-              finalResponse = finalResponse
-                .replace(/```json[\s\S]*?```/g, '')
-                .replace(/!\[.*?\]\(data:image\/[^)]+\)/g, '')
-                .replace(/data:image\/[a-z]+;base64,[A-Za-z0-9+/=]{100,}/g, '[image]')
-                .trim();
-            } catch {
-              finalResponse = toolResults.map(t => `${t.action}: ${t.result}`).join('\n\n');
-            }
-          }
-
-          // Persist to conversation (append screenshot references so they survive reload)
-          if (convId) {
-            try {
-              let persistedResponse = finalResponse;
-              const ssFiles = res._screenshotFiles || [];
-              if (ssFiles.length > 0) {
-                const ssRefs = ssFiles.map(f => `\n![Screenshot](/api/screenshots/${f})`).join('');
-                persistedResponse = finalResponse + ssRefs;
-              }
-              const conv = loadConversation(convId);
-              if (conv) {
-                addMessages(conv, msg, persistedResponse);
-              }
-            } catch {}
-          }
-
-          // Extract memory
-          try { extractMemory('chat', msg, finalResponse); } catch {}
-
-          const ssFiles = res._screenshotFiles || [];
-          sendSSE('done', { content: finalResponse, screenshotFiles: ssFiles });
-        } catch (e) {
-          sendSSE('error', { message: e.message });
-        }
-
-        res.end();
-        logRequest(method, pathname, 200, Date.now() - start);
-        return;
-      }
-
       // GET /api/agents
       if (method === 'GET' && pathname === '/api/agents') {
         sendJSON(res, 200, { agents: agentCards });
@@ -1410,91 +723,6 @@ export async function cmdUI(args) {
         return;
       }
 
-      // POST /api/agents — create custom agent
-      if (method === 'POST' && pathname === '/api/agents') {
-        const body = await parseBody(req);
-        const name = (body.name || '').toLowerCase().replace(/[^a-z0-9_-]/g, '');
-        const tagline = body.tagline || '';
-        const systemPrompt = body.systemPrompt || '';
-        if (!name || !tagline || !systemPrompt) {
-          sendJSON(res, 400, { error: 'name, tagline, and systemPrompt required' });
-          logRequest(method, pathname, 400, Date.now() - start);
-          return;
-        }
-        const agentFile = path.join(AGENTS_DIR, `${name}.mjs`);
-        const content = `// NHA Custom Agent: ${name}\n// Created: ${new Date().toISOString()}\n\nexport const CARD = {\n  name: '${name}',\n  displayName: '${name.toUpperCase()}',\n  category: 'custom',\n  tagline: '${tagline.replace(/'/g, "\\'")}',\n};\n\nexport const SYSTEM_PROMPT = \`${systemPrompt.replace(/`/g, '\\`')}\`;\n`;
-        if (!fs.existsSync(AGENTS_DIR)) fs.mkdirSync(AGENTS_DIR, { recursive: true });
-        fs.writeFileSync(agentFile, content, 'utf-8');
-        const existingIdx = agentCards.findIndex(a => a.name === name);
-        if (existingIdx >= 0) {
-          agentCards[existingIdx] = { name, displayName: name.toUpperCase(), category: 'custom', tagline };
-        } else {
-          agentCards.push({ name, displayName: name.toUpperCase(), category: 'custom', tagline });
-        }
-        sendJSON(res, 201, { ok: true, agent: { name, category: 'custom', tagline } });
-        logRequest(method, pathname, 201, Date.now() - start);
-        return;
-      }
-
-      // PUT /api/agents/:name — edit agent
-      if (method === 'PUT' && pathname.startsWith('/api/agents/')) {
-        const name = pathname.split('/')[3];
-        const body = await parseBody(req);
-        const agentFile = path.join(AGENTS_DIR, `${name}.mjs`);
-        if (!fs.existsSync(agentFile)) {
-          sendJSON(res, 404, { error: `Agent "${name}" not found` });
-          logRequest(method, pathname, 404, Date.now() - start);
-          return;
-        }
-        const tagline = body.tagline || '';
-        const systemPrompt = body.systemPrompt || '';
-        if (!tagline || !systemPrompt) {
-          sendJSON(res, 400, { error: 'tagline and systemPrompt required' });
-          logRequest(method, pathname, 400, Date.now() - start);
-          return;
-        }
-        const content = `// NHA Custom Agent: ${name}\n// Updated: ${new Date().toISOString()}\n\nexport const CARD = {\n  name: '${name}',\n  displayName: '${name.toUpperCase()}',\n  category: '${body.category || 'custom'}',\n  tagline: '${tagline.replace(/'/g, "\\'")}',\n};\n\nexport const SYSTEM_PROMPT = \`${systemPrompt.replace(/`/g, '\\`')}\`;\n`;
-        fs.writeFileSync(agentFile, content, 'utf-8');
-        const idx = agentCards.findIndex(a => a.name === name);
-        if (idx >= 0) { agentCards[idx].tagline = tagline; }
-        sendJSON(res, 200, { ok: true });
-        logRequest(method, pathname, 200, Date.now() - start);
-        return;
-      }
-
-      // DELETE /api/agents/:name — delete agent
-      if (method === 'DELETE' && pathname.startsWith('/api/agents/')) {
-        const name = pathname.split('/')[3];
-        const agentFile = path.join(AGENTS_DIR, `${name}.mjs`);
-        if (!fs.existsSync(agentFile)) {
-          sendJSON(res, 404, { error: `Agent "${name}" not found` });
-          logRequest(method, pathname, 404, Date.now() - start);
-          return;
-        }
-        fs.unlinkSync(agentFile);
-        const idx = agentCards.findIndex(a => a.name === name);
-        if (idx >= 0) agentCards.splice(idx, 1);
-        sendJSON(res, 200, { ok: true });
-        logRequest(method, pathname, 200, Date.now() - start);
-        return;
-      }
-
-      // GET /api/agents/:name — get agent details (system prompt)
-      if (method === 'GET' && pathname.startsWith('/api/agents/') && pathname.split('/').length === 4) {
-        const name = pathname.split('/')[3];
-        const agentFile = path.join(AGENTS_DIR, `${name}.mjs`);
-        if (!fs.existsSync(agentFile)) {
-          sendJSON(res, 404, { error: `Agent "${name}" not found` });
-          logRequest(method, pathname, 404, Date.now() - start);
-          return;
-        }
-        const src = fs.readFileSync(agentFile, 'utf-8');
-        const parsed = parseAgentFile(src, name);
-        sendJSON(res, 200, { name, category: parsed.card?.category || 'custom', tagline: parsed.card?.tagline || '', systemPrompt: parsed.systemPrompt || '' });
-        logRequest(method, pathname, 200, Date.now() - start);
-        return;
-      }
-
       // POST /api/ask — agent call with personal context (email, calendar, tasks)
       if (method === 'POST' && pathname === '/api/ask') {
         const body = await parseBody(req);
@@ -1510,9 +738,7 @@ export async function cmdUI(args) {
           return;
         }
 
-        // Allow both built-in and custom agents
-        const agentFile = path.join(AGENTS_DIR, `${body.agent}.mjs`);
-        if (!AGENTS.includes(body.agent) && !fs.existsSync(agentFile)) {
+        if (!AGENTS.includes(body.agent)) {
           sendJSON(res, 400, { error: `Unknown agent: ${body.agent}` });
           logRequest(method, pathname, 400, Date.now() - start);
           return;