nothumanallowed 9.7.2 → 9.8.1

package/src/services/tool-executor.mjs

@@ -7,6 +7,9 @@
  * Zero external dependencies — pure Node.js 22.
  */
 
+import os from 'os';
+import path from 'path';
+
 import {
   listMessages,
   getMessage,
@@ -62,8 +65,6 @@ export const DESTRUCTIVE_ACTIONS = new Set([
   'notify_remind',
   'slack_send',
   'github_create_issue',
-  'cron_add',
-  'cron_remove',
 ]);
 
 // ── Tool Definitions (for system prompt) ─────────────────────────────────────
@@ -74,14 +75,16 @@ export const DESTRUCTIVE_ACTIONS = new Set([
  */
 export const TOOL_DEFINITIONS = `
 You have access to the following tools. When the user's message requires an action,
-output EXACTLY ONE fenced JSON block per action:
+output one or more fenced JSON blocks:
 
 \`\`\`json
 {"action": "<tool_name>", "params": { ... }}
 \`\`\`
 
-You may include conversational text BEFORE or AFTER the JSON block. If no action
-is needed, respond normally without any JSON block.
+You can include multiple JSON blocks in one response for sequential actions.
+You may include conversational text BEFORE, BETWEEN, or AFTER JSON blocks.
+If no action is needed, respond normally without any JSON block.
+CRITICAL: Never output a JSON block as a "suggestion" or "let me try" — every JSON block WILL be executed immediately. Only output a JSON block when you are certain the action should be performed.
 
 TOOLS:
 
@@ -265,42 +268,107 @@ TOOLS:
 46. birthday_add(name: string, date: string)
     Add or update a birthday for a contact. Name is the contact name (must exist in Google Contacts — creates one if not found). Date is MM-DD (e.g. "04-06" for April 6) or YYYY-MM-DD.
 
+--- WEB SEARCH & FETCH ---
+
+47. web_search(query: string, deep?: boolean, screenshot?: boolean)
+    Search the web using DuckDuckGo. Returns titles, URLs, and snippets.
+    Set deep=true to also fetch and extract the top 3 pages' full content (slower but more detailed).
+    Set screenshot=true when the user asks for a screenshot/image of the results — this renders results as a visual page and captures a screenshot. ALWAYS set screenshot=true if the user mentions "screenshot", "screen", "immagine", "foto", "mostra", or "vedi" in relation to search results.
+    ALWAYS use this for ANY web search request ("search for X", "find X", "look up X", "cerca X").
+    Do NOT open Google/Bing in the browser for searches — use this tool instead. It's faster and never gets blocked.
+
+48. fetch_url(url: string)
+    Fetch a web page and extract its text content. SSRF-protected (blocks private IPs, localhost).
+    Returns: title, excerpt, and body text (max 8000 chars). Only fetches text/html/json/xml.
+    Use this when the user provides a specific URL to read, summarize, or analyze.
+
+--- BROWSER AUTOMATION ---
+
+49. browser_open(url: string, waitForLoad?: boolean)
+    Open a URL in a headless Chrome browser. Launches Chrome automatically on first use.
+    SSRF-protected (blocks private IPs, localhost). Renders JavaScript, SPAs, and dynamic pages.
+    Use this when you need to interact with a page (click, type, screenshot) or when fetch_url fails on JS-rendered content.
+    WARNING: Do NOT use this to search the web — use web_search instead. Google/Bing block automated browsers with CAPTCHAs.
+
+50. browser_screenshot(saveTo?: string)
+    Capture a screenshot of the current browser viewport (what's visible on screen).
+    saveTo saves to a file path (e.g. "~/screenshot.png"). Returns base64-encoded image.
+    ALWAYS use viewport screenshots (the default). Do NOT pass fullPage=true — it produces oversized images.
+    Screenshots are automatically compressed as JPEG for efficiency.
+
+51. browser_click(text?: string, selector?: string, x?: number, y?: number)
+    Click an element on the page by visible text, CSS selector, or x/y coordinates.
+    PREFERRED: use text="Rifiuta tutto" or text="Submit" to click buttons/links by their visible label (case-insensitive partial match).
+    CSS selector: selector="#submit-btn", selector="a.nav-link"
+    Coordinates: x=500, y=300 for precise clicking.
+    Always try text first — it works for buttons, links, and any clickable element regardless of CSS structure.
+
+52. browser_type(text: string, selector?: string, clear?: boolean, delay?: number)
+    Type text into an input field. If selector is provided, clicks the element first to focus it.
+    clear=true clears existing content before typing. delay=50 types with 50ms delay between keys.
+
+53. browser_extract(selector?: string, mode?: "text"|"html"|"value"|"attribute", attribute?: string, all?: boolean)
+    Extract content from the page. Default: extract all text from body.
+    selector="h1" extracts the first h1 text. all=true extracts from ALL matching elements.
+    mode="value" gets input values. mode="attribute" with attribute="href" gets link URLs.
+    mode="html" gets raw HTML of the element.
+
+54. browser_js(code: string)
+    Execute arbitrary JavaScript in the browser page context and return the result.
+    The code runs inside the page — you have access to document, window, fetch, etc.
+    Example: "document.querySelectorAll('.item').length" returns the count of items.
+    Use for complex interactions, form filling, or data extraction that other tools can't handle.
+
+55. browser_wait(selector: string, timeout?: number, visible?: boolean)
+    Wait for an element to appear on the page. Default timeout: 10 seconds.
+    visible=true (default) waits for the element to be visible, not just in DOM.
+    Use after clicking or navigating to wait for dynamic content to load.
+
+56. browser_scroll(direction?: "up"|"down"|"top"|"bottom", amount?: number)
+    Scroll the page. direction="down" (default) scrolls down 500px. "top"/"bottom" go to extremes.
+    amount=1000 scrolls 1000px instead of default 500.
+
+57. browser_key(key: string, ctrl?: boolean, shift?: boolean, alt?: boolean)
+    Press a keyboard key. Keys: Enter, Tab, Escape, Backspace, Delete, ArrowUp, ArrowDown, ArrowLeft, ArrowRight, Space.
+    ctrl=true holds Ctrl (or Cmd on Mac). Example: key="Enter" to submit a form.
+
+58. browser_close()
+    Close the browser. Frees resources. Browser auto-closes when NHA exits.
+
 --- SCHEDULED TASKS ---
 
-47. cron_add(schedule: string, prompt: string, agent?: string)
+59. cron_add(schedule: string, prompt: string, agent?: string)
     Create a recurring background task. The daemon executes it automatically.
     Schedule formats: "every 5m", "every 2h", "every monday 9am", "daily 8:30", "at 14:00", "hourly".
-    Example: cron_add("every monday 9am", "check open PRs on my GitHub repos", "forge")
 
-48. cron_list()
+60. cron_list()
     List all scheduled background tasks with their status, run count, and last result.
 
-49. cron_remove(index: number)
+61. cron_remove(index: number)
     Remove a scheduled task by its number (1-based, from cron_list).
 
 --- SCREEN & VISION ---
 
-50. screen_capture(monitor?: number)
+62. screen_capture(monitor?: number)
     Capture a screenshot of the user's desktop screen. Returns the image for visual analysis.
-    Use this when the user asks you to look at their screen, analyze what's visible, help with something on screen, etc.
-    Optional: monitor number (default 1, for multi-monitor setups).
+    Use when the user asks to look at their screen or analyze something visible.
 
-51. screen_analyze(question: string)
-    Capture the screen AND analyze it with a specific question. Combines capture + vision in one call.
-    Example: screen_analyze("what error is shown in the terminal?")
+63. screen_analyze(question: string)
+    Capture the screen AND analyze it with vision. Combines capture + question.
 
 --- CANVAS ---
 
-52. canvas_render(html: string, title?: string)
-    Render HTML content in the web dashboard's canvas panel. Use this to show charts, tables, diagrams,
-    dashboards, formatted reports, or any visual content to the user. The HTML is rendered in an isolated iframe.
-    You can use inline CSS and JavaScript. External libraries (Chart.js, Mermaid, etc.) can be loaded via CDN.
-    Example: canvas_render("<h1>Sales Report</h1><canvas id='chart'></canvas><script src='https://cdn.jsdelivr.net/npm/chart.js'></script>")
+64. canvas_render(html: string, title?: string)
+    Render HTML in the web UI canvas panel. Show charts, tables, diagrams, reports.
+    Can use Chart.js, Mermaid, or any CDN library via script tags.
 
-53. canvas_clear()
+65. canvas_clear()
     Clear the canvas panel.
 
 RULES:
+- ABSOLUTE RULE: NEVER LIE. NEVER fabricate, invent, or guess information. If you do not know, say "I don't know." If a tool fails, say it failed. If you cannot see something, say so. Honesty is MORE important than being helpful.
+- CRITICAL: For web searches, ALWAYS use web_search — NEVER open Google/Bing/DuckDuckGo in the browser.
+- CRITICAL: For web searches ("search for X", "find X online", "look up X"), ALWAYS use web_search — NEVER open Google/Bing/DuckDuckGo in the browser. web_search is faster, more reliable, and doesn't get blocked by CAPTCHAs. Only use browser_open for interacting with specific websites (filling forms, clicking buttons, taking screenshots of specific pages).
 - For search/read operations, execute immediately and present results conversationally.
 - For write/send/delete operations (gmail_send, gmail_reply, gmail_delete, calendar_create, calendar_move, calendar_update, contact_delete, task_done, notify_remind), DESCRIBE what you're about to do and include the JSON block so the system can ask the user for confirmation.
 - For schedule_meeting and schedule_draft_email, execute immediately — these are read operations that suggest slots.
@@ -312,6 +380,9 @@ RULES:
 - Dates: today is {{TODAY}}. Infer relative dates from this.
 - The user's timezone is {{TIMEZONE}}.
 - CRITICAL: when creating calendar events, always use LOCAL time in format "YYYY-MM-DDTHH:MM:SS" WITHOUT any Z suffix or timezone offset.
+- LANGUAGE: Respond in {{LANGUAGE}}. All conversational text, explanations, and descriptions must be in {{LANGUAGE}}. Tool names and JSON blocks remain in English.
+- BROWSER TIP: When extracting data from a page, prefer browser_js with code "document.body.innerText.slice(0, 3000)" to get all visible text. This is more reliable than guessing CSS selectors.
+- API TIP: For npm package info, use fetch_url with the registry API: fetch_url("https://registry.npmjs.org/PACKAGE/latest") for version/description, and fetch_url("https://api.npmjs.org/downloads/point/last-week/PACKAGE") for weekly downloads. These are JSON APIs, much more reliable than scraping the npm website.
 `.trim();
 
 // ── Action Parser ────────────────────────────────────────────────────────────
@@ -463,9 +534,23 @@ export function buildSystemPrompt(persona, personaDescription, config, initialCo
   const today = new Date().toISOString().split('T')[0];
   const tz = Intl.DateTimeFormat().resolvedOptions().timeZone;
 
+  // Detect system language from locale
+  const locale = Intl.DateTimeFormat().resolvedOptions().locale || 'en';
+  const langCode = locale.split('-')[0];
+  const LANG_MAP = {
+    en: 'English', it: 'Italian', es: 'Spanish', fr: 'French', de: 'German',
+    pt: 'Portuguese', nl: 'Dutch', pl: 'Polish', ru: 'Russian', ja: 'Japanese',
+    ko: 'Korean', zh: 'Chinese', ar: 'Arabic', hi: 'Hindi', tr: 'Turkish',
+    sv: 'Swedish', da: 'Danish', no: 'Norwegian', fi: 'Finnish', cs: 'Czech',
+    ro: 'Romanian', hu: 'Hungarian', el: 'Greek', th: 'Thai', vi: 'Vietnamese',
+    uk: 'Ukrainian', he: 'Hebrew', id: 'Indonesian', ms: 'Malay',
+  };
+  const language = config?.language || LANG_MAP[langCode] || 'English';
+
   let prompt = TOOL_DEFINITIONS
     .replace('{{TODAY}}', today)
-    .replace('{{TIMEZONE}}', tz);
+    .replace('{{TIMEZONE}}', tz)
+    .replace(/\{\{LANGUAGE\}\}/g, language);
 
   prompt += `\n\n${personaDescription}`;
 
@@ -1059,63 +1144,303 @@ export async function executeTool(action, params, config) {
       return `Birthday set for ${contact.name}: ${monthName} ${day}. It will appear in the Birthdays tab.`;
     }
 
-    // ── Screen Capture + Vision ────────────────────────────────────────
-    case 'screen_capture':
-    case 'screen_analyze': {
-      const { captureScreen } = await import('./screen-capture.mjs');
-      const result = captureScreen({ monitor: params.monitor || 1 });
-      if (!result.ok) return `Screen capture failed: ${result.error}`;
+    // ── Browser Automation ────────────────────────────────────────────
+    case 'browser_open': {
+      const url = params.url;
+      if (!url) return 'A URL is required.';
+
+      // Intercept search engine URLs — redirect to web_search tool
+      const searchEngines = /^https?:\/\/(www\.)?(google|bing|duckduckgo|yahoo|baidu|yandex)\.(com|it|co\.uk|de|fr|es|org|net)/i;
+      if (searchEngines.test(url)) {
+        // Extract search query if present in URL
+        try {
+          const u = new URL(url);
+          const q = u.searchParams.get('q') || u.searchParams.get('query') || u.searchParams.get('p');
+          if (q) {
+            return `REDIRECT: Use web_search instead. Search engines block automated browsers. Executing web_search for "${q}"...\n\n` +
+              await executeTool('web_search', { query: q }, config);
+          }
+        } catch {}
+        return 'Do NOT open search engines in the browser — they block automated access with CAPTCHAs. Use the web_search tool instead: {"action": "web_search", "params": {"query": "your search terms"}}';
+      }
+
+      const be = await import('./browser-engine.mjs');
+      const result = await be.browserOpen(url, {
+        waitForLoad: params.waitForLoad !== false,
+      });
+      if (result.error) return `Browser error: ${result.message}`;
 
-      // Return structured result — the chat layer intercepts __screenshot to send as vision
-      const question = params.question || 'Describe EXACTLY and ONLY what you see in this screenshot. Do NOT invent or guess anything.';
-      return {
-        __screenshot: true,
-        path: result.path,
-        base64: result.base64,
-        question,
-        displayText: `[SCREENSHOT_FILE]${result.path}[/SCREENSHOT_FILE]`,
-      };
+      return `Page loaded: "${result.title}"\nURL: ${result.url}`;
     }
 
-    // ── Canvas ───────────────────────────────────────────────────────────
-    case 'canvas_render': {
-      const html = params.html;
-      const title = params.title || 'Canvas';
-      if (!html) return 'Error: html parameter is required.';
-      // Return a marker that the UI layer will intercept to render in the canvas panel
-      return `[CANVAS_RENDER]${JSON.stringify({ html, title })}[/CANVAS_RENDER]\nRendered "${title}" in the canvas panel.`;
+    case 'browser_screenshot': {
+      const be = await import('./browser-engine.mjs');
+      if (!be.isBrowserRunning()) return 'No browser open. Use browser_open first.';
+
+      // Scroll to top before screenshot so user sees the most important content
+      await be.browserScroll({ direction: 'top' });
+      await new Promise(r => setTimeout(r, 300));
+
+      const saveTo = params.saveTo
+        ? params.saveTo.replace(/^~/, os.homedir())
+        : null;
+
+      // Always use JPEG for efficiency (smaller base64, faster rendering in web UI)
+      const result = await be.browserScreenshot({
+        fullPage: false, // Always viewport — fullPage produces oversized images
+        format: 'jpeg',
+        quality: 75,
+        saveTo,
+      });
+      if (result.error) return `Screenshot error: ${result.message}`;
+
+      if (result.savedTo) {
+        return `Screenshot saved to: ${result.savedTo} (${Math.round(result.size / 1024)}KB base64)`;
+      }
+
+      // Return base64 for LLM vision analysis
+      return `Screenshot captured (${Math.round(result.size / 1024)}KB base64 PNG).\n[Base64 data available — use browser_js or browser_extract to analyze page content instead]`;
     }
 
-    case 'canvas_clear': {
-      return '[CANVAS_CLEAR]Canvas cleared.[/CANVAS_CLEAR]';
+    case 'browser_click': {
+      const be = await import('./browser-engine.mjs');
+      if (!be.isBrowserRunning()) return 'No browser open. Use browser_open first.';
+
+      const result = await be.browserClick({
+        text: params.text,
+        selector: params.selector,
+        x: params.x,
+        y: params.y,
+      });
+      if (result.error) return `Click error: ${result.message}`;
+
+      return `Clicked: ${result.selector} at (${result.x}, ${result.y})`;
+    }
+
+    case 'browser_type': {
+      const be = await import('./browser-engine.mjs');
+      if (!be.isBrowserRunning()) return 'No browser open. Use browser_open first.';
+
+      if (!params.text) return 'Text is required.';
+
+      const result = await be.browserType({
+        text: params.text,
+        selector: params.selector,
+        clear: params.clear || false,
+        delay: params.delay || 0,
+      });
+      if (result.error) return `Type error: ${result.message}`;
+
+      return `Typed ${result.length} chars into ${result.selector}`;
+    }
+
+    case 'browser_extract': {
+      const be = await import('./browser-engine.mjs');
+      if (!be.isBrowserRunning()) return 'No browser open. Use browser_open first.';
+
+      const result = await be.browserExtract({
+        selector: params.selector || 'body',
+        mode: params.mode || 'text',
+        attribute: params.attribute,
+        all: params.all || false,
+      });
+      if (result.error) return `Extract error: ${result.message}`;
+
+      return `[${result.selector}] (${result.length} chars):\n${result.content}`;
+    }
+
+    case 'browser_js': {
+      const be = await import('./browser-engine.mjs');
+      if (!be.isBrowserRunning()) return 'No browser open. Use browser_open first.';
+
+      if (!params.code) return 'JavaScript code is required.';
+
+      const result = await be.browserEval(params.code);
+      if (result.error) return `JS error: ${result.message}`;
+
+      return `[${result.type}] ${result.result}`;
+    }
+
+    case 'browser_wait': {
+      const be = await import('./browser-engine.mjs');
+      if (!be.isBrowserRunning()) return 'No browser open. Use browser_open first.';
+
+      if (!params.selector) return 'A CSS selector is required.';
+
+      const result = await be.browserWaitFor(params.selector, {
+        timeout: params.timeout || 10000,
+        visible: params.visible !== false,
+      });
+      if (result.error) return `Wait failed: ${result.message}`;
+
+      return `Element found: ${result.selector} (${result.elapsed}ms)`;
+    }
+
+    case 'browser_scroll': {
+      const be = await import('./browser-engine.mjs');
+      if (!be.isBrowserRunning()) return 'No browser open. Use browser_open first.';
+
+      const result = await be.browserScroll({
+        direction: params.direction || 'down',
+        amount: params.amount || 500,
+      });
+      if (result.error) return `Scroll error: ${result.message}`;
+
+      return `Scrolled ${result.direction}`;
+    }
+
+    case 'browser_key': {
+      const be = await import('./browser-engine.mjs');
+      if (!be.isBrowserRunning()) return 'No browser open. Use browser_open first.';
+
+      if (!params.key) return 'A key name is required (e.g. Enter, Tab, Escape).';
+
+      const result = await be.browserKeyPress(params.key, {
+        ctrl: params.ctrl,
+        shift: params.shift,
+        alt: params.alt,
+      });
+      if (result.error) return `Key error: ${result.message}`;
+
+      return `Pressed: ${result.key}`;
+    }
+
+    case 'browser_close': {
+      const be = await import('./browser-engine.mjs');
+      const result = await be.browserClose();
+      return result.message;
+    }
+
+    // ── Web Search & Fetch ──────────────────────────────────────────────
+    case 'web_search': {
+      const wt = await import('./web-tools.mjs');
+      const query = params.query;
+      if (!query) return 'A search query is required.';
+
+      if (params.deep) {
+        const result = await wt.webSearchDeep(query, 3);
+        if (result.error) return `Search error: ${result.message}`;
+        if (result.results.length === 0) return `No results found for "${query}".`;
+
+        const lines = [`Web search: "${query}" — ${result.resultCount} results, ${result.deepFetched} pages fetched\n`];
+
+        // Deep results first (with content)
+        for (const dr of result.deepResults) {
+          lines.push(`--- ${dr.title} ---`);
+          lines.push(`URL: ${dr.url}`);
+          lines.push(dr.content.slice(0, 2000));
+          lines.push('');
+        }
+
+        // Remaining results (snippets only)
+        const deepUrls = new Set(result.deepResults.map(d => d.url));
+        for (const r of result.results.filter(r => !deepUrls.has(r.url))) {
+          lines.push(`${r.title}`);
+          lines.push(`  ${r.url}`);
+          if (r.snippet) lines.push(`  ${r.snippet}`);
+        }
+
+        return lines.join('\n');
+      }
+
+      const result = await wt.webSearch(query);
+      if (result.error) return `Search error: ${result.message}`;
+      if (result.results.length === 0) return `No results found for "${query}".`;
+
+      const textResult = `Web search: "${query}" — ${result.resultCount} results\n\n` +
+        result.results.map((r, i) =>
+          `${i + 1}. ${r.title}\n   ${r.url}\n   ${r.snippet}`
+        ).join('\n\n');
+
+      // If screenshot requested, render results as HTML in browser and capture
+      if (params.screenshot) {
+        try {
+          const be = await import('./browser-engine.mjs');
+          // Ensure browser is running
+          if (!be.isBrowserRunning()) {
+            await be.browserOpen('https://example.com', { waitForLoad: true });
+          }
+          // Build search results HTML
+          const esc = (s) => (s || '').replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;');
+          const htmlItems = result.results.map((r, i) =>
+            `<div style="margin-bottom:24px;padding-bottom:16px;border-bottom:1px solid #3c4043"><div style="font-size:18px;color:#8ab4f8;margin-bottom:4px;font-weight:600">${i + 1}. ${esc(r.title)}</div><div style="font-size:13px;color:#bdc1c6;margin-bottom:6px">${esc(r.url)}</div><div style="font-size:14px;color:#969ba1;line-height:1.5">${esc(r.snippet)}</div></div>`
+          ).join('');
+          const fullHtml = `<html><head><style>body{background:#202124;color:#e8eaed;font-family:Arial,Helvetica,sans-serif;padding:24px 40px;max-width:800px;margin:0 auto}h1{font-size:22px;color:#8ab4f8;margin-bottom:24px;border-bottom:2px solid #3c4043;padding-bottom:12px}</style></head><body><h1>Search results: "${esc(query)}"</h1>${htmlItems}<div style="color:#5f6368;font-size:12px;margin-top:16px">Powered by NHA web_search — ${result.resultCount} results via DuckDuckGo</div></body></html>`;
+          // Render by injecting HTML into current page via JS
+          await be.browserEval(`document.open();document.write(${JSON.stringify(fullHtml)});document.close();`);
+          await new Promise(r => setTimeout(r, 300));
+          const ss = await be.browserScreenshot({ fullPage: false, format: 'jpeg', quality: 75 });
+          if (!ss.error) {
+            // Save to disk for persistence
+            const ssDir = path.join(os.homedir(), '.nha', 'screenshots');
+            const fsMod = await import('fs');
+            fsMod.mkdirSync(ssDir, { recursive: true });
+            const ssFilename = `ss-${Date.now()}.jpg`;
+            fsMod.writeFileSync(path.join(ssDir, ssFilename), Buffer.from(ss.base64, 'base64'));
+            return textResult + `\n\n[Screenshot of results captured (${Math.round(ss.size / 1024)}KB) file:${ssFilename}]`;
+          }
+        } catch { /* screenshot failed */ }
+      }
+
+      return textResult;
+    }
+
+    case 'fetch_url': {
+      const wt = await import('./web-tools.mjs');
+      const url = params.url;
+      if (!url) return 'A URL is required.';
+
+      const result = await wt.fetchUrl(url);
+      if (result.error) return `Fetch error: ${result.message}`;
+
+      const lines = [];
+      if (result.title) lines.push(`Title: ${result.title}`);
+      lines.push(`URL: ${result.url || url}`);
+      lines.push(`Status: ${result.status}`);
+      if (result.truncated) lines.push('[Content was truncated due to size limits]');
+      lines.push('');
+      lines.push(result.body);
+
+      return lines.join('\n');
     }
 
     // ── Cron / Heartbeat ───────────────────────────────────────────────
     case 'cron_add': {
       const { addCronJob } = await import('./ops-daemon.mjs');
       const result = addCronJob(params.schedule, params.prompt, { agent: params.agent || null });
-      if (result.ok) {
-        return `Scheduled task created: "${params.schedule}" → "${params.prompt}". The daemon will execute it automatically. Start daemon with \`nha ops start\` if not running.`;
-      }
-      return `Failed to create scheduled task: ${result.error}`;
+      if (result.ok) return `Scheduled task created: "${params.schedule}" → "${params.prompt}". Start daemon with \`nha ops start\` if not running.`;
+      return `Failed: ${result.error}`;
     }
-
     case 'cron_list': {
       const { listCronJobs } = await import('./ops-daemon.mjs');
       const jobs = listCronJobs();
       if (jobs.length === 0) return 'No scheduled tasks configured.';
-      return jobs.map((j, i) =>
-        `${i + 1}. [${j.enabled ? 'active' : 'paused'}] ${j.schedule} → ${j.prompt} (runs: ${j.runCount}, last: ${j.lastRun ? new Date(j.lastRun).toLocaleString() : 'never'})`
-      ).join('\n');
+      return jobs.map((j, i) => `${i + 1}. [${j.enabled ? 'active' : 'paused'}] ${j.schedule} → ${j.prompt} (runs: ${j.runCount}, last: ${j.lastRun ? new Date(j.lastRun).toLocaleString() : 'never'})`).join('\n');
     }
-
     case 'cron_remove': {
       const { removeCronJob } = await import('./ops-daemon.mjs');
       const result = removeCronJob(params.index || params.id);
-      if (result.ok) {
-        return `Removed scheduled task: "${result.removed.schedule}" → "${result.removed.prompt}"`;
-      }
-      return `Failed to remove: ${result.error}`;
+      if (result.ok) return `Removed: "${result.removed.schedule}" → "${result.removed.prompt}"`;
+      return `Failed: ${result.error}`;
+    }
+
+    // ── Screen Capture + Vision ──────────────────────────────────────────
+    case 'screen_capture':
+    case 'screen_analyze': {
+      const { captureScreen } = await import('./screen-capture.mjs');
+      const result = captureScreen({ monitor: params.monitor || 1 });
+      if (!result.ok) return `Screen capture failed: ${result.error}`;
+      const question = params.question || 'Describe EXACTLY and ONLY what you see in this screenshot.';
+      return { __screenshot: true, path: result.path, base64: result.base64, question };
+    }
+
+    // ── Canvas ───────────────────────────────────────────────────────────
+    case 'canvas_render': {
+      if (!params.html) return 'Error: html parameter is required.';
+      return `[CANVAS_RENDER]${JSON.stringify({ html: params.html, title: params.title || 'Canvas' })}[/CANVAS_RENDER]\nRendered in canvas panel.`;
+    }
+    case 'canvas_clear': {
+      return '[CANVAS_CLEAR]Canvas cleared.[/CANVAS_CLEAR]';
     }
 
     default: