asaihost-nodejs 0.0.6 → 0.0.9

package/dist/asaihost-nodejs.es.js

@@ -399,7 +399,7 @@ var LogBuffer = class _LogBuffer {
   }
 };
 function saveLog($asai, src, logstr) {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     try {
       const bufferKey = `${$asai.id || "default"}_${src}`;
       let logBuffer = logBuffers.get(bufferKey);
@@ -408,7 +408,7 @@ function saveLog($asai, src, logstr) {
         logBuffers.set(bufferKey, logBuffer);
       }
       logBuffer.add(logstr);
-      resolve5();
+      resolve6();
     } catch (err) {
       console.error(err);
       reject(err);
@@ -915,7 +915,7 @@ import * as https from "https";
 import { WebSocketServer } from "ws";
 
 // src/ws/auth.ts
-import { WebSocket } from "ws";
+import { WebSocket as WebSocket2 } from "ws";
 
 // src/utils/userinfo.ts
 function deUserInfoWithAsai(userinfo, $asai) {
@@ -940,6 +940,79 @@ function deUserInfoWithAsai(userinfo, $asai) {
 }
 __name(deUserInfoWithAsai, "deUserInfoWithAsai");
 
+// src/ws/ws-probe.ts
+import { WebSocket } from "ws";
+function isWsStillActive(ws2) {
+  if (!ws2) return false;
+  const state = ws2.readyState;
+  return state === WebSocket.CONNECTING || state === WebSocket.OPEN;
+}
+__name(isWsStillActive, "isWsStillActive");
+function getWsProbeTimeoutMs($asai) {
+  return $asai?.hostconfig?.tm?.d || 3e3;
+}
+__name(getWsProbeTimeoutMs, "getWsProbeTimeoutMs");
+function probeWsAlive($asai, wsclient, timeoutMs) {
+  const waitMs = timeoutMs ?? getWsProbeTimeoutMs($asai);
+  return new Promise((resolve6) => {
+    if (!wsclient || !isWsStillActive(wsclient)) {
+      resolve6(false);
+      return;
+    }
+    let settled = false;
+    const finish = /* @__PURE__ */ __name((alive) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      try {
+        wsclient.off?.("message", onMessage);
+      } catch {
+      }
+      resolve6(alive);
+    }, "finish");
+    const onMessage = /* @__PURE__ */ __name(() => finish(true), "onMessage");
+    const timer = setTimeout(() => finish(false), waitMs);
+    try {
+      wsclient.once?.("message", onMessage);
+      wsclient.send(JSON.stringify({ ty: "publish/web", db: "pong" }));
+    } catch {
+      finish(false);
+    }
+  });
+}
+__name(probeWsAlive, "probeWsAlive");
+function terminateWs(wsclient) {
+  if (!wsclient) return;
+  try {
+    wsclient.terminate?.();
+  } catch {
+  }
+  try {
+    wsclient.close?.();
+  } catch {
+  }
+}
+__name(terminateWs, "terminateWs");
+async function clearStaleWsIfDead($asai, hostdir, us, existingWs) {
+  if (!us || us === "asai") return true;
+  const map = $asai.connectionsws?.[hostdir];
+  if (!existingWs) {
+    if (map?.[us]) delete map[us];
+    return true;
+  }
+  if (!isWsStillActive(existingWs)) {
+    terminateWs(existingWs);
+    if (map?.[us] === existingWs) delete map[us];
+    return true;
+  }
+  const alive = await probeWsAlive($asai, existingWs);
+  if (alive) return false;
+  terminateWs(existingWs);
+  if (map?.[us] === existingWs) delete map[us];
+  return true;
+}
+__name(clearStaleWsIfDead, "clearStaleWsIfDead");
+
 // src/ws/auth.ts
 function getWsUserinfo(req, $asai) {
   try {
@@ -1006,12 +1079,6 @@ async function removeSessionOnWsClose($asai, us, token) {
   }
 }
 __name(removeSessionOnWsClose, "removeSessionOnWsClose");
-function isWsStillActive(ws2) {
-  if (!ws2) return false;
-  const state = ws2.readyState;
-  return state === WebSocket.CONNECTING || state === WebSocket.OPEN;
-}
-__name(isWsStillActive, "isWsStillActive");
 function rejectIncomingWs(ws2, db) {
   const payload = JSON.stringify({ ty: "publish/web", db: { exit: 1, type: "err", ...db } });
   try {
@@ -1029,7 +1096,7 @@ function rejectIncomingWs(ws2, db) {
   }
 }
 __name(rejectIncomingWs, "rejectIncomingWs");
-function isOkWs($asai, hostdir, ws2, _req, hostcfg) {
+async function isOkWs($asai, hostdir, ws2, _req, hostcfg) {
   const [us, , tk] = ws2.Userinfo || [];
   if (!us) {
     ws2.close();
@@ -1053,12 +1120,16 @@ function isOkWs($asai, hostdir, ws2, _req, hostcfg) {
       delete $asai.connectionsws[hostdir][us];
       return true;
     }
-    rejectIncomingWs(ws2, {
-      lang: "logged",
-      langpm: `${us}`,
-      con: `${us} logged in!`
-    });
-    return false;
+    const cleared = await clearStaleWsIfDead($asai, hostdir, us, existingWs);
+    if (!cleared) {
+      rejectIncomingWs(ws2, {
+        lang: "logged",
+        langpm: `${us}`,
+        con: `${us} logged in!`
+      });
+      return false;
+    }
+    return true;
   }
   if (us !== "asai") {
     const connections = $asai.connectionsws[hostdir] || {};
@@ -1109,13 +1180,13 @@ function loginWs($asai, hostdir, ws2, req, hostcfg, wsWorkHandler, logWsMessage)
     if (us && token && !isUserOnlineOnWs($asai, us, hostdir)) {
       void removeSessionOnWsClose($asai, us, String(token));
     }
-    if (ws2.readyState !== WebSocket.CLOSED && ws2.readyState !== WebSocket.CLOSING) ws2.close();
+    if (ws2.readyState !== WebSocket2.CLOSED && ws2.readyState !== WebSocket2.CLOSING) ws2.close();
   });
 }
 __name(loginWs, "loginWs");
 
 // src/ws/message.ts
-import { WebSocket as WebSocket2 } from "ws";
+import { WebSocket as WebSocket3 } from "ws";
 function clearWsServerTasks($asai, hostdir) {
   const tasks = $asai.tasksws[hostdir];
   if (tasks && typeof tasks === "object") {
@@ -1140,7 +1211,7 @@ function attachWssHelpers(wss, $asai) {
     const data = resWsMsg(msg, $asai);
     if (type) {
       wss.clients.forEach((client) => {
-        if ((type === 2 || client !== curws) && client.readyState === WebSocket2.OPEN) {
+        if ((type === 2 || client !== curws) && client.readyState === WebSocket3.OPEN) {
           client.send(data);
         }
       });
@@ -1151,7 +1222,7 @@ function attachWssHelpers(wss, $asai) {
   wss.broadws = (msg) => {
     const data = resWsMsg(msg, $asai);
     wss.clients.forEach((client) => {
-      if (client?.readyState === WebSocket2.OPEN) client.send(data);
+      if (client?.readyState === WebSocket3.OPEN) client.send(data);
     });
   };
 }
@@ -1331,12 +1402,14 @@ function createWSHost($asai, hostdir) {
         ws2.send(wsmsg, () => ws2.close(1013, "Server busy"));
         return;
       }
-      const isOpen = !hostcfg.ckws || isOkWs($asai, hostdir, ws2, req, hostcfg);
-      if (isOpen) {
-        loginWs($asai, hostdir, ws2, req, hostcfg, wsWorkHandler, logWsMessage);
-      } else {
-        ws2.close();
-      }
+      void (async () => {
+        const isOpen = !hostcfg.ckws || await isOkWs($asai, hostdir, ws2, req, hostcfg);
+        if (isOpen) {
+          loginWs($asai, hostdir, ws2, req, hostcfg, wsWorkHandler, logWsMessage);
+        } else {
+          ws2.close();
+        }
+      })();
     });
     $asai.serversws[hostdir] = wss;
   } catch (err) {
@@ -1460,11 +1533,11 @@ function createSkipChecker($asai) {
   }
   if (exact.size === 0 && prefixes.length === 0) return () => false;
   return (url) => {
-    const path7 = normalizeRequestPath(url);
-    if (!path7) return false;
-    if (exact.has(path7)) return true;
+    const path8 = normalizeRequestPath(url);
+    if (!path8) return false;
+    if (exact.has(path8)) return true;
     for (let i = 0; i < prefixes.length; i++) {
-      if (path7.startsWith(prefixes[i])) return true;
+      if (path8.startsWith(prefixes[i])) return true;
     }
     return false;
   };
@@ -2382,11 +2455,11 @@ function getSecurityConfig($asai) {
   return $asai?.hostconfig?.security || {};
 }
 __name(getSecurityConfig, "getSecurityConfig");
-function pathMatchesPattern(path7, pattern) {
+function pathMatchesPattern(path8, pattern) {
   if (pattern.endsWith("*")) {
-    return path7.startsWith(pattern.slice(0, -1));
+    return path8.startsWith(pattern.slice(0, -1));
   }
-  return path7 === pattern;
+  return path8 === pattern;
 }
 __name(pathMatchesPattern, "pathMatchesPattern");
 function isAuthSkipped($asai, pathname) {
@@ -2535,7 +2608,7 @@ __name(isApiCorsAllowed, "isApiCorsAllowed");
 
 // src/common/server/Api.ts
 function readRequestBody(req, maxBody) {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     const chunks = [];
     let received = 0;
     let settled = false;
@@ -2543,7 +2616,7 @@ function readRequestBody(req, maxBody) {
       if (settled) return;
       settled = true;
       if (err) reject(err);
-      else resolve5(data ?? "");
+      else resolve6(data ?? "");
     }, "finish");
     req.on("data", (chunk) => {
       if (settled) return;
@@ -2673,83 +2746,95 @@ var Api_default = /* @__PURE__ */ __name(($asai, opt = {}) => {
       const isTextPost = req.method === "POST" && req.url.indexOf("binary") === -1;
       const bodyPromise = isTextPost ? readRequestBody(req, maxBody) : null;
       void (async () => {
-        let authResult;
-        let rawBody = "";
         try {
-          [authResult, rawBody] = await Promise.all([
-            validateHttpAuthAsync(req, $asai, pathname),
-            bodyPromise ?? Promise.resolve("")
-          ]);
-        } catch (err) {
-          releaseSlot();
-          if (err?.message === "PAYLOAD_TOO_LARGE") {
-            return sendError(res, 413, "Payload Too Large");
-          }
-          return sendError(res, 400, err?.message || "Bad Request");
-        }
-        if (!authResult.ok) {
-          releaseSlot();
-          return sendAuthError(res, authResult);
-        }
-        let apiFn = $asai.hostserverapi[apiHandlerKey]?.($asai, query);
-        if (!apiFn) {
-          return sendError(res, 501, "Not Implemented");
-        }
-        res.setHeader("Content-Type", "application/json; charset=utf-8");
-        $asai.$log("API", req.method, urlParse.pathname, query);
-        let qrdata;
-        let postdata;
-        if (req.url.indexOf("binary") === -1) {
-          qrdata = query;
-          if (req.method === "POST") {
-            try {
-              const processed = processPostPayload($asai, req, rawBody, pm);
-              postdata = processed.postdata;
-              pm = processed.pm;
-              isAes = processed.isAes;
-            } catch {
-              return sendError(res, 400, "AES decrypt failed");
-            }
-            if (apiFn?.post && typeof apiFn?.post === "function") {
-              const optTmp = { qrdata, data: postdata, pm };
-              if (isAes || $asai.$lib.aesfns?.allaes) {
-                optTmp.resAES = $asai.$lib.aesfns?.resAES;
-              }
-              apiFn.post(req, res, hostdir, optTmp);
-            } else {
-              res.end(typeof postdata === "string" ? postdata : JSON.stringify(postdata ?? ""));
-            }
-          } else if (req.method === "GET") {
-            if (apiFn?.get && typeof apiFn?.get === "function") {
-              const optTmp = { qrdata, data: qrdata, pm };
-              if (isAes || $asai.$lib.aesfns?.allaes) {
-                optTmp.resAES = $asai.$lib.aesfns?.resAES;
-              }
-              apiFn.get(req, res, hostdir, optTmp);
-            } else {
-              res.end(JSON.stringify(qrdata));
+          let authResult;
+          let rawBody = "";
+          try {
+            [authResult, rawBody] = await Promise.all([
+              validateHttpAuthAsync(req, $asai, pathname),
+              bodyPromise ?? Promise.resolve("")
+            ]);
+          } catch (err) {
+            releaseSlot();
+            if (err?.message === "PAYLOAD_TOO_LARGE") {
+              return sendError(res, 413, "Payload Too Large");
             }
+            return sendError(res, 400, err?.message || "Bad Request");
           }
-        } else {
-          if (Object.keys(query)?.length) {
-            qrdata = query;
+          if (!authResult.ok) {
+            releaseSlot();
+            return sendAuthError(res, authResult);
           }
-          if (req.method === "POST") {
-            $asai.$lib.AsNodeTool.upBinary(req).then((postdata2) => {
+          let apiFn = $asai.hostserverapi[apiHandlerKey]?.($asai, query);
+          if (!apiFn) {
+            return sendError(res, 501, "Not Implemented");
+          }
+          res.setHeader("Content-Type", "application/json; charset=utf-8");
+          $asai.$log("API", req.method, urlParse.pathname, query);
+          let qrdata;
+          let postdata;
+          if (req.url.indexOf("binary") === -1) {
+            qrdata = query;
+            if (req.method === "POST") {
+              try {
+                const processed = processPostPayload($asai, req, rawBody, pm);
+                postdata = processed.postdata;
+                pm = processed.pm;
+                isAes = processed.isAes;
+              } catch {
+                return sendError(res, 400, "AES decrypt failed");
+              }
               if (apiFn?.post && typeof apiFn?.post === "function") {
-                apiFn.post(req, res, hostdir, {
-                  qrdata,
-                  data: postdata2
-                });
+                const optTmp = { qrdata, data: postdata, pm };
+                if (isAes || $asai.$lib.aesfns?.allaes) {
+                  optTmp.resAES = $asai.$lib.aesfns?.resAES;
+                }
+                apiFn.post(req, res, hostdir, optTmp);
               } else {
-                res.end(postdata2);
+                res.end(typeof postdata === "string" ? postdata : JSON.stringify(postdata ?? ""));
               }
-            }).catch((err) => {
-              return sendError(res, 400, "Invalid content type");
-            });
+            } else if (req.method === "GET") {
+              if (apiFn?.get && typeof apiFn?.get === "function") {
+                const optTmp = { qrdata, data: qrdata, pm };
+                if (isAes || $asai.$lib.aesfns?.allaes) {
+                  optTmp.resAES = $asai.$lib.aesfns?.resAES;
+                }
+                apiFn.get(req, res, hostdir, optTmp);
+              } else {
+                res.end(JSON.stringify(qrdata));
+              }
+            }
+          } else {
+            if (Object.keys(query)?.length) {
+              qrdata = query;
+            }
+            if (req.method === "POST") {
+              $asai.$lib.AsNodeTool.upBinary(req).then((postdata2) => {
+                if (apiFn?.post && typeof apiFn?.post === "function") {
+                  apiFn.post(req, res, hostdir, {
+                    qrdata,
+                    data: postdata2
+                  });
+                } else {
+                  res.end(postdata2);
+                }
+              }).catch((err) => {
+                return sendError(res, 400, "Invalid content type");
+              });
+            }
+          }
+        } catch (err) {
+          releaseSlot();
+          if (!res.headersSent) {
+            return sendError(res, 500, err?.message || "Internal Server Error");
           }
         }
-      })();
+      })().catch((err) => {
+        releaseSlot();
+        if (!res.headersSent) {
+          sendError(res, 500, err?.message || "Internal Server Error");
+        }
+      });
     } else {
       $asai.$log("API", req.method, req.url);
     }
@@ -2883,27 +2968,28 @@ var Sys_default = /* @__PURE__ */ __name(($asai, opt = {}) => {
     }
     const urlPath = (req.url || "").split("?")[0];
     void (async () => {
-      const authResult = await validateHttpAuthAsync(req, $asai, urlPath);
-      if (!authResult.ok) {
-        return sendAuthError(res, authResult);
-      }
-      const handler = $asai.hostserversys[handlerKey]?.($asai);
-      if (!handler) {
-        return sendError(res, 500, "Handler Initialization Failed");
-      }
-      if (handler?.show && typeof handler?.show === "function") {
-        handler.show(req, res, hostdir);
-      } else {
-        res.end("postdata");
+      try {
+        const authResult = await validateHttpAuthAsync(req, $asai, urlPath);
+        if (!authResult.ok) {
+          return sendAuthError(res, authResult);
+        }
+        const handler = $asai.hostserversys[handlerKey]?.($asai);
+        if (!handler) {
+          return sendError(res, 500, "Handler Initialization Failed");
+        }
+        if (handler?.show && typeof handler?.show === "function") {
+          handler.show(req, res, hostdir);
+        } else {
+          res.end("postdata");
+        }
+      } catch (err) {
+        return sendError(res, 500, err?.message || "Internal Server Error");
       }
-      if (!handler) {
-        res.writeHead(404, {
-          "Content-Type": "application/json; charset=utf-8"
-        });
-        res.end(req.url);
-      } else {
+    })().catch((err) => {
+      if (!res.headersSent) {
+        sendError(res, 500, err?.message || "Internal Server Error");
       }
-    })();
+    });
   }
   __name(sysWork, "sysWork");
   return { sysWork };
@@ -2922,7 +3008,7 @@ var WsClient_default = /* @__PURE__ */ __name(($asai, wsname) => {
   }
   __name(getKeyByData, "getKeyByData");
   function clientwsInit() {
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve6, reject) => {
       $asai.clientws[wsname].socket = new $asai.asaiWs(
         $asai.command.commandconfig.clientws[wsname]
       );
@@ -2952,7 +3038,7 @@ var WsClient_default = /* @__PURE__ */ __name(($asai, wsname) => {
           `${wsname}=${$asai.command.commandconfig.clientws[wsname]} is open.`
         );
         $asai.clientws[wsname].open = 1;
-        resolve5();
+        resolve6();
       };
     });
   }
@@ -2982,7 +3068,7 @@ var WsClient_default = /* @__PURE__ */ __name(($asai, wsname) => {
   }
   __name(clientwsOnmessage, "clientwsOnmessage");
   function clientwsApi(messageData) {
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve6, reject) => {
       if ($asai.clientws[wsname].open) {
         try {
           const taskOpt = {};
@@ -2994,7 +3080,7 @@ var WsClient_default = /* @__PURE__ */ __name(($asai, wsname) => {
             getKeyByData(messageData),
             {
               callback: /* @__PURE__ */ __name((res) => {
-                resolve5(res);
+                resolve6(res);
               }, "callback"),
               ...messageData,
               ...taskOpt
@@ -4140,8 +4226,14 @@ var login_default = /* @__PURE__ */ __name(($asai) => {
         const policy = getPasswordPolicy($asai);
         const mustChange = !!user.mustChangePassword || isPasswordExpired(user.passwordChangedAt, policy.maxAgeDays);
         const hostcfg = $asai.getHost?.(hostdir) || {};
-        if (hostcfg.ckws && isUserOnlineOnWs($asai, us, hostdir)) {
-          kickUserWs($asai, us, hostdir);
+        if (hostcfg.ckws) {
+          const existingWs = $asai.connectionsws?.[hostdir]?.[us];
+          if (existingWs) {
+            const cleared = await clearStaleWsIfDead($asai, hostdir, us, existingWs);
+            if (!cleared) {
+              kickUserWs($asai, us, hostdir);
+            }
+          }
         }
         const quotaCheck = await canLogin($asai, us, hostdir);
         if (!quotaCheck.ok) {
@@ -4543,10 +4635,10 @@ var As_default = {
     return absPath;
   },
   makeDir(fs11, filePaths) {
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve6, reject) => {
       try {
         const newPath = this.ensureDir(fs11, filePaths);
-        resolve5(newPath);
+        resolve6(newPath);
       } catch (err) {
         reject(err);
       }
@@ -5142,6 +5234,7 @@ var AsDb_default = /* @__PURE__ */ __name(($asai, cfg) => {
 }, "default");
 
 // src/sysserver/lib/common/reqWork.ts
+import * as path4 from "path";
 var reqWork_default = /* @__PURE__ */ __name(($asai) => {
   function hostDefault2(mod) {
     if (mod && typeof mod === "object" && "default" in mod) {
@@ -5157,6 +5250,19 @@ var reqWork_default = /* @__PURE__ */ __name(($asai) => {
       throw new Error("Missing path");
     }
     const decoded = decodeURIComponent(String(rawPath));
+    if (path4.isAbsolute(decoded)) {
+      return path4.normalize(decoded);
+    }
+    const rel = decoded.replace(/^\.(\/)?/, "");
+    const serverRoot = $asai?.serverRoot;
+    if (serverRoot && rel) {
+      const absRoot = path4.resolve(serverRoot);
+      const abs = path4.resolve(absRoot, rel);
+      const relCheck = path4.relative(absRoot, abs);
+      if (relCheck === "" || !relCheck.startsWith("..") && !path4.isAbsolute(relCheck)) {
+        return abs;
+      }
+    }
     const roots = $asai?.asaihost?.getHostAllowedRoots?.($asai?.hostconfig) || [];
     if (!roots.length) {
       const fallback = $asai?.serverRoot || process.cwd();
@@ -5214,17 +5320,17 @@ __export(AsFs_exports, {
   writeJson: () => writeJson
 });
 import fs9 from "fs/promises";
-import path4 from "path";
+import path5 from "path";
 async function ensureFile(filePath) {
-  const normalized = path4.normalize(filePath);
-  await fs9.mkdir(path4.dirname(normalized), { recursive: true });
+  const normalized = path5.normalize(filePath);
+  await fs9.mkdir(path5.dirname(normalized), { recursive: true });
   const fh = await fs9.open(normalized, "a");
   await fh.close();
 }
 __name(ensureFile, "ensureFile");
 async function pathExists(filePath) {
   try {
-    await fs9.access(path4.normalize(filePath));
+    await fs9.access(path5.normalize(filePath));
     return true;
   } catch {
     return false;
@@ -5232,7 +5338,7 @@ async function pathExists(filePath) {
 }
 __name(pathExists, "pathExists");
 async function readJson(filePath) {
-  const raw = await fs9.readFile(path4.normalize(filePath), "utf8");
+  const raw = await fs9.readFile(path5.normalize(filePath), "utf8");
   return JSON.parse(raw);
 }
 __name(readJson, "readJson");
@@ -5243,26 +5349,26 @@ function resolvePathUnderBase(baseDir, relPath) {
   if (relPath.includes("\0")) {
     throw new Error("Invalid path");
   }
-  const base = path4.resolve(baseDir);
-  const target = path4.resolve(base, relPath.replace(/\\/g, "/"));
-  const rel = path4.relative(base, target);
-  if (rel.startsWith("..") || path4.isAbsolute(rel)) {
+  const base = path5.resolve(baseDir);
+  const target = path5.resolve(base, relPath.replace(/\\/g, "/"));
+  const rel = path5.relative(base, target);
+  if (rel.startsWith("..") || path5.isAbsolute(rel)) {
     throw new Error("Path not allowed");
   }
   return target;
 }
 __name(resolvePathUnderBase, "resolvePathUnderBase");
 async function readLogDir(dir) {
-  const resolved = path4.resolve(dir);
+  const resolved = path5.resolve(dir);
   const stats = await fs9.stat(resolved);
   if (!stats.isDirectory()) {
     throw new Error("Not a directory");
   }
-  const dirName = path4.basename(resolved);
+  const dirName = path5.basename(resolved);
   const entries = await fs9.readdir(resolved, { withFileTypes: true });
   const children = await Promise.all(
     entries.map(async (entry) => {
-      const fullPath = path4.join(resolved, entry.name);
+      const fullPath = path5.join(resolved, entry.name);
       const st = await fs9.stat(fullPath);
       const dot = entry.name.lastIndexOf(".");
       const type = entry.isDirectory() ? "dir" : dot > -1 ? entry.name.substring(dot) : "file";
@@ -5270,7 +5376,7 @@ async function readLogDir(dir) {
         name: entry.name,
         size: st.size,
         time: st.mtime.toISOString(),
-        path: path4.normalize(fullPath),
+        path: path5.normalize(fullPath),
         type,
         created: st.birthtime.toISOString(),
         permissions: st.mode.toString(8).slice(-3)
@@ -5281,7 +5387,7 @@ async function readLogDir(dir) {
     name: dirName,
     size: stats.size,
     time: stats.mtime.toISOString(),
-    path: path4.normalize(resolved),
+    path: path5.normalize(resolved),
     type: "dir",
     created: stats.birthtime.toISOString(),
     permissions: stats.mode.toString(8).slice(-3),
@@ -5291,7 +5397,7 @@ async function readLogDir(dir) {
 __name(readLogDir, "readLogDir");
 async function removeFile(filePath) {
   try {
-    await fs9.unlink(path4.normalize(filePath));
+    await fs9.unlink(path5.normalize(filePath));
   } catch (err) {
     if (err?.code !== "ENOENT") throw err;
   }
@@ -5299,13 +5405,13 @@ async function removeFile(filePath) {
 __name(removeFile, "removeFile");
 var remove = removeFile;
 async function write(filePath, content) {
-  const normalized = path4.normalize(filePath);
-  await fs9.mkdir(path4.dirname(normalized), { recursive: true });
+  const normalized = path5.normalize(filePath);
+  await fs9.mkdir(path5.dirname(normalized), { recursive: true });
   await fs9.writeFile(normalized, content, "utf8");
 }
 __name(write, "write");
 async function read(filePath) {
-  return fs9.readFile(path4.normalize(filePath), "utf8");
+  return fs9.readFile(path5.normalize(filePath), "utf8");
 }
 __name(read, "read");
 async function writeJson(filePath, data) {
@@ -5341,19 +5447,19 @@ __export(common_exports, {
   toSetObject: () => toSetObject,
   toWherePairs: () => toWherePairs
 });
-import * as path5 from "path";
+import * as path6 from "path";
 function promisifySqlDb(query, sql) {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     query(sql, (err, result) => {
       if (err) {
         reject(err);
         return;
       }
       if (!result || Array.isArray(result) && result.length === 0) {
-        resolve5("");
+        resolve6("");
         return;
       }
-      resolve5(result);
+      resolve6(result);
     });
   });
 }
@@ -5406,11 +5512,11 @@ function toInsertRows(sql) {
 }
 __name(toInsertRows, "toInsertRows");
 function isPathInside(baseDir, targetPath) {
-  const base = path5.resolve(baseDir);
-  const target = path5.resolve(targetPath);
-  const relative4 = path5.relative(base, target);
-  if (!relative4) return true;
-  return !relative4.startsWith("..") && !path5.isAbsolute(relative4);
+  const base = path6.resolve(baseDir);
+  const target = path6.resolve(targetPath);
+  const relative5 = path6.relative(base, target);
+  if (!relative5) return true;
+  return !relative5.startsWith("..") && !path6.isAbsolute(relative5);
 }
 __name(isPathInside, "isPathInside");
 function joinTablePath(table, ...segments) {
@@ -5592,7 +5698,7 @@ var Sql_default = {
 
 // src/sysserver/db/src/file/Index.ts
 import * as fs10 from "fs";
-import * as path6 from "path";
+import * as path7 from "path";
 function dbDriver(opt = {}) {
   const { Sql, DbCommon } = opt;
   const { isPathInside: isPathInside2, joinTablePath: joinTablePath2 } = DbCommon;
@@ -5606,7 +5712,7 @@ function dbDriver(opt = {}) {
       this.fileDel = (config.del || 0) !== 0;
       this.createDir = config.create || false;
       const root = config.$asai?.serverRoot || getPrimaryServerRoot();
-      this.baseDirAbs = path6.resolve(root, config.dir);
+      this.baseDirAbs = path7.resolve(root, config.dir);
     }
     dbLog(...args) {
       (this.config?.$asai?.$log || console.log)("FILE", ...args);
@@ -5619,9 +5725,9 @@ function dbDriver(opt = {}) {
       if (!relPath) {
         return this.baseDirAbs;
       }
-      const abs = path6.isAbsolute(relPath) ? path6.normalize(relPath) : path6.resolve(this.baseDirAbs, relPath);
+      const abs = path7.isAbsolute(relPath) ? path7.normalize(relPath) : path7.resolve(this.baseDirAbs, relPath);
       if (!isPathInside2(this.baseDirAbs, abs)) {
-        return this.baseDirAbs;
+        throw new Error("Path not allowed");
       }
       return abs;
     }
@@ -5633,11 +5739,11 @@ function dbDriver(opt = {}) {
       if (!relPath) {
         return "";
       }
-      return path6.isAbsolute(relPath) ? path6.relative(this.baseDirAbs, relPath) : relPath;
+      return path7.isAbsolute(relPath) ? path7.relative(this.baseDirAbs, relPath) : relPath;
     }
     ensureDir(relPath) {
-      const relative4 = this.normalizeRelPath(relPath);
-      const dirPath = path6.dirname(relative4);
+      const relative5 = this.normalizeRelPath(relPath);
+      const dirPath = path7.dirname(relative5);
       const absDir = this.resolvePath(dirPath === "." ? "" : dirPath);
       if (this.createDir && !fs10.existsSync(absDir)) {
         this.dbLog("mkdir", "[MKDIR]", absDir);
@@ -5663,9 +5769,9 @@ function dbDriver(opt = {}) {
       this.dbLog("delete", "[RMDIR]", absPath);
       const entries = fs10.readdirSync(absPath, { withFileTypes: true });
       for (const entry of entries) {
-        const current = path6.join(absPath, entry.name);
+        const current = path7.join(absPath, entry.name);
         if (entry.isDirectory()) {
-          this.deldir(path6.join(relativePath, entry.name));
+          this.deldir(path7.join(relativePath, entry.name));
         } else {
           this.dbLog("delete", "[UNLINK]", current);
           fs10.unlinkSync(current);
@@ -5676,8 +5782,8 @@ function dbDriver(opt = {}) {
     getReadPath(file, sql) {
       const candidates = [];
       if (sql?.filename) {
-        candidates.push({ dir: path6.join(file, sql.filename) });
-        candidates.push({ dir: path6.join(file + ".delete" + this.fileExt, sql.filename) });
+        candidates.push({ dir: path7.join(file, sql.filename) });
+        candidates.push({ dir: path7.join(file + ".delete" + this.fileExt, sql.filename) });
       } else {
         candidates.push({ dir: file });
         candidates.push({ dir: file + this.fileExt + ".delete" });
@@ -5696,13 +5802,13 @@ function dbDriver(opt = {}) {
         return { path: "", dir: read2.dir };
       }
       if (sql?.filename) {
-        return { path: path6.dirname(read2.path), dir: path6.dirname(read2.dir) };
+        return { path: path7.dirname(read2.path), dir: path7.dirname(read2.dir) };
       }
       return { path: read2.path, dir: read2.dir };
     }
     getNewPath(file, sql) {
       if (sql?.filename) {
-        return this.getAbsPath(path6.join(file, sql.filename), true);
+        return this.getAbsPath(path7.join(file, sql.filename), true);
       }
       return this.getAbsPath(file, true);
     }
@@ -5795,7 +5901,7 @@ function dbDriver(opt = {}) {
           const isDelete = fileName.endsWith(deleteSuffix);
           const baseName = isDelete ? fileName.slice(0, -deleteSuffix.length) : fileName;
           if (this.fileExt && !baseName.endsWith(this.fileExt)) continue;
-          const fullPath = path6.join(absDir, fileName);
+          const fullPath = path7.join(absDir, fileName);
           try {
             const data = fs10.readFileSync(fullPath, "utf8");
             const entryData = { data, file: baseName };
@@ -5824,7 +5930,7 @@ function dbDriver(opt = {}) {
       return String(raw ?? "");
     }
     sqlDb(sql) {
-      return new Promise((resolve5, reject) => {
+      return new Promise((resolve6, reject) => {
         try {
           let result;
           const tableDir = this.tableFilePath(sql.table);
@@ -5953,7 +6059,7 @@ function dbDriver(opt = {}) {
             }
           }
           if (result !== void 0) {
-            resolve5(result);
+            resolve6(result);
           } else {
             reject("");
           }
@@ -6563,7 +6669,7 @@ var initAsaiHostNodejs2 = {
   createTransportDataHandler,
   wireTransportConnectionLogs
 };
-var PLUGIN_VERSION = true ? "0.0.6" : "0.0.1";
+var PLUGIN_VERSION = true ? "0.0.9" : "0.0.1";
 var index_default = initAsaiHostNodejs2;
 export {
   Index_default as AsaiCommon,