hfs 3.2.0-alpha1.1 → 3.2.0-beta3

package/src/api.vfs.js

@@ -17,6 +17,7 @@ const util_os_1 = require("./util-os");
 const listen_1 = require("./listen");
 const SendList_1 = require("./SendList");
 const walkDir_1 = require("./walkDir");
+const roots_1 = require("./roots");
 // to manipulate the tree we need the original node
 async function urlToNodeOriginal(uri) {
     const n = await (0, vfs_1.urlToNode)(uri);
@@ -51,7 +52,7 @@ exports.default = {
             };
         }
     },
-    async set_vfs({ uri, props }) {
+    async set_vfs({ uri, props, uriRemaps = {} }) {
         const n = uri && await urlToNodeOriginal(uri);
         if (!n)
             return new apiMiddleware_1.ApiError(const_1.HTTP_NOT_FOUND, 'path not found');
@@ -67,7 +68,13 @@ exports.default = {
         simplifyName(n);
         n.isFolder = undefined; // reset field, it will be set by saveVfs
         await (0, vfs_1.saveVfs)();
+        if (!(0, vfs_1.isRoot)(n)) // not actually used by admin-panel but still
+            uriRemaps[uri] = uriForNode(uri, n); // just in case the current node was modified
+        await updateRootsForVfsUriRemaps(uriRemaps);
         return n;
+        function uriForNode(uri, n) {
+            return (0, misc_1.enforceFinal)('/', (0, path_1.dirname)(uri).replace(/\\/g, '/')) + (0, misc_1.pathEncode)((0, vfs_1.getNodeName)(n)) + ((0, vfs_1.nodeIsFolder)(n) ? '/' : '');
+        }
     },
     // legacy – not currently used by the UI
     async move_vfs({ from, parent }) {
@@ -94,6 +101,9 @@ exports.default = {
         ;
         (parentNode.children ||= []).push(fromNode);
         await (0, vfs_1.saveVfs)();
+        await updateRootsForVfsUriRemaps({
+            [from]: (0, misc_1.enforceFinal)('/', parent) + (0, misc_1.pathEncode)(name) + ((0, vfs_1.nodeIsFolder)(fromNode) ? '/' : '')
+        });
         return {};
     },
     // legacy – not currently used by the UI
@@ -271,6 +281,41 @@ function sanitizeVfsProps(props) {
             : props.children.map(sanitizeVfsProps);
     return ret;
 }
+function updateRootsForVfsUriRemaps(uriRemaps = {}) {
+    const remaps = Object.entries(uriRemaps)
+        .map(([from, to]) => [normalizeVfsId(from), normalizeVfsId(to)])
+        .filter(x => x[0] !== x[1])
+        .sort(([a], [b]) => b.length - a.length); // longest first because, in case of both parent and child, it's more specific
+    let changed = false;
+    const updatedRoots = lodash_1.default.mapValues(roots_1.roots.get(), root => {
+        if (typeof root !== 'string' || !root)
+            return root;
+        const normalizedRoot = normalize(root);
+        for (const [from, to] of remaps) {
+            // roots are stored outside the VFS tree, so rename/move edits need an explicit path remap
+            const remappedRoot = replaceUriPrefix(normalizedRoot, from, to);
+            if (!remappedRoot)
+                continue;
+            if (remappedRoot !== root)
+                changed = true;
+            return remappedRoot;
+        }
+        return root;
+    });
+    if (changed)
+        roots_1.roots.set(updatedRoots);
+    function normalize(uri) {
+        return String(uri).replace(/^\/+|^(?!\/)|\/{2,}|\/+$|(?<!\/)$/g, '/');
+    }
+    function normalizeVfsId(uri) {
+        return normalize((0, misc_1.pathDecode)(String(uri))); // admin remaps come from tree ids, while roots are stored as readable VFS paths
+    }
+    function replaceUriPrefix(uri, oldPrefix, newPrefix) {
+        return uri === oldPrefix ? newPrefix
+            : uri.startsWith(oldPrefix) ? newPrefix + uri.slice(oldPrefix.length)
+                : '';
+    }
+}
 function simplifyName(node) {
     const { name, ...noName } = node;
     if ((0, vfs_1.getNodeName)(noName) === name)

package/src/basicWeb.js

@@ -41,7 +41,7 @@ function basicWeb(ctx, node) {
     const stream = (0, misc_1.asyncGeneratorToReadable)((0, misc_1.filterMapGenerator)(walker, async (el) => {
         const isFolder = (0, vfs_1.nodeIsFolder)(el);
         const name = (0, vfs_1.getNodeName)(el) + (isFolder ? '/' : '');
-        return `<li>${a((0, misc_1.pathEncode)(name) + (isFolder && !await (0, vfs_1.hasDefaultFile)(el, ctx) ? force : ''), name)}\n`;
+        return `<li>${a((0, misc_1.pathEncode)(name) + (isFolder && !await (0, vfs_1.getDefaultFile)(el, ctx) ? force : ''), name)}\n`;
     }));
     ctx.body = stream;
     stream.push(`<meta name="viewport" content="width=device-width" />`);

package/src/comments.js

@@ -16,6 +16,7 @@ const misc_1 = require("./misc");
 const lodash_1 = __importDefault(require("lodash"));
 const iconv_lite_1 = __importDefault(require("iconv-lite"));
 const promises_1 = require("node:fs/promises");
+const expiringCache_1 = require("./expiringCache");
 exports.DESCRIPT_ION = 'descript.ion';
 exports.DESCRIPT_ION_ALT = 'DESCRIPT.ION';
 const commentsStorage = (0, config_1.defineConfig)(cross_1.CFG.comments_storage, '', v => ['', 'attr+ion'].includes(v)); // compiled tell us if we are using descript.ion
@@ -81,13 +82,15 @@ async function filePathHelper(folder) {
     return await (0, util_files_1.exists)(alt) && !await (0, util_files_1.exists)(main) ? alt : main;
 }
 const MULTILINE_SUFFIX = Buffer.from([4, 0xC2]);
+const pathCache = (0, expiringCache_1.expiringCache)(2_000);
+// this can be called many times when listing a folder, and we want to also not check too often as it can be expensive, especially on a networked drive
 async function readDescriptIon(path) {
-    // decoding could also be done with native TextDecoder.decode, but we need iconv for the encoding anyway
-    return (0, util_files_1.parseFile)(await filePathHelper(path), raw => {
-        // for simplicity we "remove" the sequence MULTILINE_SUFFIX before iconv.decode messes it up
+    return (0, util_files_1.parseFile)(await pathCache.try(path, filePathHelper), raw => {
+        // for simplicity, we "remove" the sequence MULTILINE_SUFFIX before iconv.decode messes it up
         for (let i = 0; i < raw.length; i++)
             if (raw[i] === MULTILINE_SUFFIX[0] && raw[i + 1] === MULTILINE_SUFFIX[1] && [undefined, 13, 10].includes(raw[i + 2]))
                 raw[i] = raw[i + 1] = 10;
+        // decoding could also be done with native TextDecoder.decode, but we need iconv for the encoding anyway
         const decoded = iconv_lite_1.default.decode(raw, descriptIonEncoding.get());
         const ret = new Map(decoded.split('\n').map(line => {
             const quoted = line[0] === '"' ? 1 : 0;
@@ -98,7 +101,7 @@ async function readDescriptIon(path) {
         }));
         ret.delete('');
         return ret;
-    });
+    }, 2000);
 }
 descriptIonEncoding.sub(() => {
     for (const k of util_files_1.parseFileCache.keys())

package/src/const.js

@@ -68,7 +68,7 @@ exports.DEV = process.env.DEV ? 'DEV' : '';
 exports.ORIGINAL_CWD = process.cwd();
 exports.HFS_STARTED = new Date();
 const PKG_PATH = (0, path_1.join)(__dirname, '..', 'package.json');
-exports.BUILD_TIMESTAMP = "2026-05-09T20:07:35.794Z";
+exports.BUILD_TIMESTAMP = fs.statSync(PKG_PATH).mtime.toISOString();
 const pkg = JSON.parse(fs.readFileSync(PKG_PATH, 'utf8'));
 exports.VERSION = pkg.version;
 exports.RUNNING_BETA = exports.VERSION.includes('-');

package/src/cross.js

@@ -17,7 +17,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.VFS_STORED_KEYS = exports.PERM_KEYS = exports.defaultPerms = exports.WHO_ANY_ACCOUNT = exports.WHO_NO_ONE = exports.WHO_ANYONE = exports.LIST = exports.CFG = exports.THEME_OPTIONS = exports.SORT_BY_OPTIONS = exports.FRONTEND_OPTIONS = exports.MAX_TILE_SIZE = exports.DAY = exports.HOUR = exports.MINUTE = exports.WIKI_URL = exports.REPO_URL = exports.WEBSITE = void 0;
+exports.VFS_STORED_KEYS = exports.PERM_KEYS = exports.defaultPerms = exports.WHO_ADMIN = exports.WHO_ANY_ACCOUNT = exports.WHO_NO_ONE = exports.WHO_ANYONE = exports.LIST = exports.CFG = exports.THEME_OPTIONS = exports.SORT_BY_OPTIONS = exports.FRONTEND_OPTIONS = exports.MAX_TILE_SIZE = exports.DAY = exports.HOUR = exports.MINUTE = exports.WIKI_URL = exports.REPO_URL = exports.WEBSITE = void 0;
 exports.isWhoObject = isWhoObject;
 exports.formatBytes = formatBytes;
 exports.formatSpeed = formatSpeed;
@@ -25,7 +25,6 @@ exports.prefix = prefix;
 exports.join = join;
 exports.wait = wait;
 exports.haveTimeout = haveTimeout;
-exports.objSameKeys = objSameKeys;
 exports.objFromKeys = objFromKeys;
 exports.enforceFinal = enforceFinal;
 exports.removeFinal = removeFinal;
@@ -81,6 +80,7 @@ exports.escapeHTML = escapeHTML;
 exports.promiseBestEffort = promiseBestEffort;
 exports.pathEncode = pathEncode;
 exports.pathDecode = pathDecode;
+exports.pathDecodeSegments = pathDecodeSegments;
 exports.runAt = runAt;
 exports.makeMatcher = makeMatcher;
 exports.matches = matches;
@@ -127,18 +127,19 @@ exports.CFG = constMap(['geo_enable', 'geo_allow', 'geo_list', 'geo_allow_unknow
     'log', 'error_log', 'log_rotation', 'dont_log_net', 'log_gui', 'log_api', 'log_ua', 'log_spam', 'track_ips',
     'max_downloads', 'max_downloads_per_ip', 'max_downloads_per_account', 'roots', 'force_address', 'split_uploads',
     'force_lang', 'suspend_plugins', 'base_url', 'size_1024', 'disable_custom_html', 'comments_storage',
-    'force_webdav_login', 'webdav_initial_auth', 'outbound_proxy', 'mapped_port', 'upnp_enabled']);
+    'force_webdav_login', 'webdav_initial_auth', 'outbound_proxy', 'mapped_port', 'upnp_enabled', 'show_uploader']);
 exports.LIST = { add: '+', remove: '-', update: '=', props: 'props', ready: 'ready', error: 'e' };
 exports.WHO_ANYONE = true;
 exports.WHO_NO_ONE = false;
 exports.WHO_ANY_ACCOUNT = '*';
+exports.WHO_ADMIN = 'admin';
 exports.defaultPerms = {
-    can_see: 'can_read',
     can_read: exports.WHO_ANYONE,
+    can_see: 'can_read',
     can_list: 'can_read',
-    can_upload: exports.WHO_NO_ONE,
-    can_delete: exports.WHO_NO_ONE,
-    can_archive: 'can_read'
+    can_archive: 'can_read',
+    can_upload: exports.WHO_ADMIN,
+    can_delete: exports.WHO_ADMIN,
 };
 exports.PERM_KEYS = typedKeys(exports.defaultPerms);
 exports.VFS_STORED_KEYS = ['name', 'source', 'masks', 'default', 'accept', 'rename',
@@ -186,9 +187,6 @@ function haveTimeout(ms, job, error) {
         new Promise((_resolve, reject) => h = setTimeout(() => reject(error || Error('timeout')), ms))
     ]);
 }
-function objSameKeys(src, newValue) {
-    return Object.fromEntries(Object.entries(src).map(([k, v]) => [k, newValue(v, k)]));
-}
 function objFromKeys(src, getValue) {
     return Object.fromEntries(src.map(k => [k, getValue(k)]));
 }
@@ -478,6 +476,10 @@ function pathEncode(s, all = false) {
 function pathDecode(s) {
     return decodeURI(s).replace(/%23/g, '#');
 }
+function pathDecodeSegments(s, map = String) {
+    // decode segment by segment so reserved escapes are decoded without turning encoded slashes into separators
+    return s.split('/').map(x => map(safeDecodeURIComponent(x)).replaceAll('/', '%2F')).join('/');
+}
 // run at a specific point in time, also solving the limit of setTimeout, which doesn't work with +32bit delays
 function runAt(ts, cb) {
     let cancel = false;

package/src/events.js

@@ -5,8 +5,7 @@ exports.BetterEventEmitter = void 0;
 const LISTENERS_SUFFIX = '\0listeners';
 class BetterEventEmitter {
     listeners = new Map();
-    preventDefault = Symbol();
-    stop = this.preventDefault; // legacy pre-0.54 (introduced in 0.53)
+    stop = Symbol();
     on(event, listener, { warnAfter = 10, callNow = false } = {}) {
         if (typeof event === 'string')
             event = [event];
@@ -89,7 +88,7 @@ class BetterEventEmitter {
         const asyncRet = await Promise.all(syncRet);
         return Object.assign(asyncRet, {
             isDefaultPrevented: () => syncRet.isDefaultPrevented()
-                || asyncRet.some((r) => r === this.preventDefault)
+                || asyncRet.some((r) => r === this.stop)
         });
     }
 }

package/src/expiringCache.js

@@ -6,24 +6,25 @@ function expiringCache(ttlMs) {
         throw Error('invalid TTL');
     const o = new Map();
     return Object.assign(o, {
-        // creator can return undefined if the value should not be cached. `invalidate` is useful in case you have some custom logic for it, other than ttl.
+        invalidate,
+        // creator can return undefined if the value should not be cached
         try(k, creator) {
             let ret = o.get(k);
             if (ret === undefined) { // undefined = missing, as we don't accept this value in our cache
-                ret = creator(invalidate);
+                ret = creator(k);
                 if (ret !== undefined) {
                     o.set(k, ret);
                     Promise.resolve(ret).then(v => {
                         if (v === undefined) // even in a promise, we'll consider undefined as a request to cancel the caching
-                            invalidate();
+                            invalidate(k);
                     }, () => { }) // avoid js warning
-                        .finally(() => setTimeout(invalidate, ttlMs)); // wait for async (in case) before starting the timer
-                }
-                function invalidate() {
-                    o.delete(k);
+                        .finally(() => setTimeout(() => invalidate(k), ttlMs)); // wait for async (in case) before starting the timer
                 }
             }
             return ret;
         },
     });
+    function invalidate(k) {
+        o.delete(k);
+    }
 }

package/src/frontEndApis.js

@@ -20,11 +20,13 @@ const promises_1 = require("fs/promises");
 const path_1 = require("path");
 const upload_1 = require("./upload");
 const misc_1 = require("./misc");
+const config_1 = require("./config");
 const comments_1 = require("./comments");
 const SendList_1 = require("./SendList");
 const adminApis_1 = require("./adminApis");
 const lodash_1 = __importDefault(require("lodash"));
 const partialFolderSize = {};
+const showUploader = (0, config_1.defineConfig)(misc_1.CFG.show_uploader, misc_1.WHO_ADMIN);
 exports.frontEndApis = {
     get_file_list: api_get_file_list_1.get_file_list,
     ...api_auth_1.authApis,
@@ -43,19 +45,20 @@ exports.frontEndApis = {
             return new apiMiddleware_1.ApiError(const_1.HTTP_BAD_REQUEST, 'bad uris');
         const isAdmin = (0, adminApis_1.ctxAdminAccess)(ctx);
         return {
-            details: await Promise.all(uris.map(async (uri) => {
-                if (typeof uri !== 'string')
-                    return false; // false means error
-                const node = await (0, vfs_1.urlToNode)(uri, ctx);
-                if (!node || !(0, vfs_1.hasPermission)(node, 'can_see', ctx))
-                    return false;
-                let upload = node.source && await (0, upload_1.getUploadMeta)(node.source).catch(() => undefined);
-                if (!upload)
-                    return;
-                if (!isAdmin)
-                    upload = lodash_1.default.omit(upload, 'ip');
-                return { upload };
-            }))
+            details: (0, vfs_1.simpleWhoToError)(showUploader.get(), ctx) ? [] // return early because at the moment we only have the uploader
+                : await Promise.all(uris.map(async (uri) => {
+                    if (typeof uri !== 'string')
+                        return false; // false means error
+                    const node = await (0, vfs_1.urlToNode)(uri, ctx);
+                    if (!node || !(0, vfs_1.hasPermission)(node, 'can_see', ctx))
+                        return false;
+                    let upload = node.source && await (0, upload_1.getUploadMeta)(node.source).catch(() => undefined);
+                    if (!upload)
+                        return;
+                    if (!isAdmin)
+                        upload = lodash_1.default.omit(upload, 'ip');
+                    return { upload };
+                }))
         };
     },
     async create_folder({ uri, name }, ctx) {
@@ -126,7 +129,7 @@ exports.frontEndApis = {
         await (0, comments_1.setCommentFor)(node.source, comment);
         return {};
     },
-    async get_folder_size_partial({ id }, ctx) {
+    async get_folder_size_partial({ id }) {
         (0, misc_1.apiAssertTypes)({ string: { id } });
         return partialFolderSize[id] || new apiMiddleware_1.ApiError(const_1.HTTP_NOT_FOUND);
     },

package/src/geo.js

@@ -38,8 +38,8 @@ function isOpen() {
 async function checkFiles() {
     if (!enabled.get())
         return;
-    const ZIP_FILE = 'IP2LOCATION-LITE-DB1.IPV6.BIN';
-    const URL = `https://download.ip2location.com/lite/${ZIP_FILE}.ZIP`;
+    const BIN_FILE = 'IP2LOCATION-LITE-DB1.IPV6.BIN';
+    const URL = `https://download.ip2location.com/lite/${BIN_FILE}.ZIP`;
     const LOCAL_FILE = 'geo_ip.bin';
     const TEMP = LOCAL_FILE + '.downloading';
     const { mtime = 0 } = await (0, misc_1.statWithTimeout)(LOCAL_FILE).catch(() => ({ mtime: 0 }));
@@ -49,11 +49,12 @@ async function checkFiles() {
         try {
             const req = await (0, misc_1.httpStream)(URL);
             console.log(`Downloading ${name}`);
-            await (0, misc_1.unzip)(req, path => path.toUpperCase().endsWith(ZIP_FILE) && TEMP);
-            await (0, misc_1.statWithTimeout)(TEMP); // check existence
+            await (0, misc_1.unzip)(req, path => path.toUpperCase().endsWith(BIN_FILE) && TEMP); // give a temp name
+            const s = await (0, misc_1.statWithTimeout)(TEMP); // check existence
+            if (s.size < 1E6)
+                throw `Bad size for geo_ip: ${s.size}`;
             if (isOpen())
                 ip2location.close();
-            await (0, promises_1.unlink)(LOCAL_FILE).catch(() => { });
             await (0, promises_1.rename)(TEMP, LOCAL_FILE);
             exports.ip2country.cache.clear?.();
             console.log(`${name} download completed`);

package/src/listen.js

@@ -137,7 +137,7 @@ function getCertObject() {
         return;
     const all = new crypto_1.X509Certificate(c);
     const some = lodash_1.default.pick(all, ['subject', 'issuer', 'validFrom', 'validTo']);
-    const ret = (0, misc_1.objSameKeys)(some, v => v?.includes('=') ? Object.fromEntries(v.split('\n').map(x => x.split('='))) : v);
+    const ret = lodash_1.default.mapValues(some, v => v?.includes('=') ? Object.fromEntries(v.split('\n').map(x => x.split('='))) : v);
     return Object.assign(ret, { altNames: all.subjectAltName?.replace(/DNS:/g, '').split(/, */) });
 }
 const considerHttps = (0, misc_1.debounceAsync)(async () => {
@@ -298,7 +298,8 @@ function stopServer(srv) {
                 console.debug("Failed to stop server", String(err));
             resolve(err);
         });
-        srv.closeAllConnections();
+        if (first_1.quitting)
+            srv.closeAllConnections();
     });
 }
 function getCurrentPort(srv) {

package/src/middlewares.js

@@ -162,7 +162,7 @@ exports.paramsDecoder = paramsDecoder;
 let internalSessionMw;
 let options;
 events_1.default.once('app', () => // wait for app to be defined
- internalSessionMw = (0, koa_session_1.default)(options = { signed: true, rolling: true, sameSite: 'lax' }, index_1.app));
+ internalSessionMw = (0, koa_session_1.default)(options = { signed: true, renew: true, sameSite: 'lax' }, index_1.app));
 const sessionMiddleware = (ctx, next) => {
     options.key = 'hfs_' + ctx.protocol;
     return internalSessionMw(ctx, next);

package/src/nat.js

@@ -76,7 +76,10 @@ exports.getPublicIps = (0, debounceAsync_1.debounceAsync)(async () => {
             throw "no good";
         return validIps;
     }))));
-    return exports.defaultBaseUrl.publicIps = lodash_1.default.uniq(ips.flat());
+    const ret = exports.defaultBaseUrl.publicIps = lodash_1.default.uniq(ips.flat());
+    if (!ret.length) // don't keep empty results for long
+        setTimeout(() => exports.getPublicIps.clearRetain(), 5_000);
+    return ret;
 }, { retain: 10 * cross_1.MINUTE });
 exports.getNatInfo = (0, debounceAsync_1.debounceAsync)(async () => {
     const upnp = await exports.upnpEnabled.getWhenReady() ? getUpnpClient() : null;

package/src/perm.js

@@ -81,7 +81,7 @@ async function updateAccount(account, change) {
         const u = normalizeUsername(change.username || '');
         if (u && u !== usernameWas && getAccount(u))
             throw "username already exists";
-        Object.assign(account, (0, misc_1.objSameKeys)(change, x => x || undefined));
+        Object.assign(account, lodash_1.default.mapValues(change, x => x || undefined));
     }
     for (const [k, v] of (0, misc_1.typedEntries)(account))
         if (!v)

package/src/plugins.js

@@ -158,7 +158,7 @@ async function initPlugin(pl, morePassedToInit) {
     const controlledEvents = Object.create(events_1.default, (0, misc_1.objFromKeys)(['on', 'once', 'multi'], k => ({
         value() {
             if (k === 'multi')
-                arguments[0] = (0, misc_1.objSameKeys)(arguments[0], trap);
+                arguments[0] = lodash_1.default.mapValues(arguments[0], trap);
             else
                 arguments[1] = trap(arguments[1]);
             const ret = events_1.default[k](...arguments);
@@ -582,7 +582,7 @@ function watchPlugin(id, path) {
                 getConfig(cfgKey) {
                     const cur = exports.pluginsConfig.get()?.[id];
                     return cfgKey ? cur?.[cfgKey] ?? pluginData.config?.[cfgKey]?.defaultValue
-                        : lodash_1.default.defaults(cur, (0, misc_1.objSameKeys)(pluginData.config, x => x.defaultValue));
+                        : lodash_1.default.defaults(cur, lodash_1.default.mapValues(pluginData.config, x => x.defaultValue));
                 },
                 setConfig: (cfgKey, value) => setPluginConfig(id, { [cfgKey]: value }),
                 subscribeConfig(cfgKey, cb) {

package/src/roots.js

@@ -32,7 +32,7 @@ const rootsMiddleware = (ctx, next) => (() => {
     }
     if (lodash_1.default.isEmpty(exports.roots.get()))
         return;
-    const root = ctx.state.root = exports.roots.compiled()?.(ctx.host);
+    const root = ctx.state.root = exports.roots.compiled()(ctx.host);
     if (!ctx.state.skipFilters && forceAddress.get()
         && root === undefined && !(0, misc_1.isLocalHost)(ctx) && ctx.host !== listen_1.baseUrl.compiled())
         return (0, connections_1.disconnect)(ctx, forceAddress.key()); // returning truthy will not call next
@@ -46,7 +46,7 @@ const rootsMiddleware = (ctx, next) => (() => {
             return;
         for (const [k, v] of Object.entries(params))
             if (k.startsWith('uri'))
-                params[k] = Array.isArray(v) ? v.map(cb) : cb(v);
+                params[k] = Array.isArray(v) ? v.map(cb) : lodash_1.default.isString(v) ? cb(v) : v;
     }
 })() || next();
 exports.rootsMiddleware = rootsMiddleware;

package/src/selfCheck.js

@@ -38,7 +38,8 @@ async function selfCheck(url) {
                     console.debug(svc);
                     body = applySymbols(body);
                     serviceUrl = applySymbols(serviceUrl);
-                    const res = await (0, cross_1.haveTimeout)(6_000, (0, util_http_1.httpString)(serviceUrl, { family, ...rest, body }));
+                    const timeout = 8_000;
+                    const res = await (0, cross_1.haveTimeout)(timeout, (0, util_http_1.httpString)(serviceUrl, { family, timeout, ...rest, body }));
                     const success = new RegExp(regexpSuccess).test(res);
                     const failure = new RegExp(regexpFailure).test(res);
                     if (success === failure)

package/src/serveGuiAndSharedFiles.js

@@ -21,6 +21,7 @@ const serveGuiFiles_1 = require("./serveGuiFiles");
 const koa_mount_1 = __importDefault(require("koa-mount"));
 const listen_1 = require("./listen");
 const misc_1 = require("./misc");
+const roots_1 = require("./roots");
 const xxhashjs_1 = __importDefault(require("xxhashjs"));
 const fs_1 = __importDefault(require("fs"));
 const promises_1 = require("fs/promises");
@@ -119,11 +120,10 @@ const serveSharedFiles = async (ctx, next) => {
             return ctx.status = cross_const_1.HTTP_SERVER_ERROR;
         }
     }
-    if (node.default && path.endsWith('/') && !get) { // final/ needed on browser to make resource urls correctly with html pages
-        const found = await (0, vfs_1.urlToNode)(node.default, ctx, node);
-        if (found && /\.html?/i.test(node.default))
+    if (path.endsWith('/') && !get) { // final slash needed on browsers to make resource urls working with html pages
+        const found = await (0, vfs_1.getDefaultFile)(node, ctx);
+        if (found && /\.html?/i.test((0, vfs_1.getNodeName)(node = found)))
             ctx.state.considerAsGui = true;
-        node = found ?? node;
     }
     if (get === 'icon')
         return (0, serveFile_1.serveFile)(ctx, node.icon || '|'); // pipe to cause not-found
@@ -160,9 +160,19 @@ async function sendFolderList(node, ctx) {
     ctx.type = 'text';
     if (prepend === undefined || prepend === '*') { // * = force auto-detection even if we have baseUrl set
         const { URL } = ctx;
-        const base = prepend === undefined && listen_1.baseUrl.get()
-            || URL.protocol + '//' + URL.host + ctx.state.revProxyPath;
-        prepend = base + (0, misc_1.pathEncode)(decodeURI(ctx.path)); // redo the encoding our way, keeping unicode chars unchanged
+        const requestBase = URL.protocol + '//' + URL.host + ctx.state.revProxyPath;
+        const configuredBaseUrl = prepend === undefined && listen_1.baseUrl.get();
+        const configuredRoot = configuredBaseUrl && roots_1.roots.compiled()(listen_1.baseUrl.compiled() || '');
+        const pathInConfiguredRoot = configuredRoot && (configuredRoot === '/' ? ctx.path
+            : ctx.path.startsWith(configuredRoot) ? ctx.path.slice(configuredRoot.length - 1)
+                : ctx.path === configuredRoot.slice(0, -1) ? '/'
+                    : false);
+        // base_url may expose a host-rooted home; use it only for VFS paths inside that host root
+        const [base, path] = !configuredBaseUrl ? [requestBase, ctx.path]
+            : pathInConfiguredRoot === false ? [requestBase, ctx.path]
+                : [configuredBaseUrl, pathInConfiguredRoot || ctx.path];
+        // redo the encoding our way, keeping unicode chars unchanged. decode each segment separately because decodeURI preserves reserved escapes like %3A, which pathEncode would double-encode
+        prepend = base + (0, misc_1.pathDecodeSegments)(path, misc_1.pathEncode);
     }
     const walker = (0, vfs_1.walkNode)(node, { ctx, depth: depth === '*' ? Infinity : Number(depth), parallelizeRecursion: false }); // parallelization produces out-of-order results, and we don't want it like that here
     ctx.body = (0, misc_1.asyncGeneratorToReadable)((0, misc_1.filterMapGenerator)(walker, async (el) => {

package/src/serveGuiFiles.js

@@ -39,7 +39,7 @@ function serveStatic(uri) {
             return ctx.status = const_1.HTTP_METHOD_NOT_ALLOWED;
         const serveApp = shouldServeApp(ctx);
         const fullPath = (0, path_1.join)(__dirname, '..', folder, serveApp ? '/index.html' : ctx.path);
-        const content = await (0, misc_1.parseFile)(fullPath, raw => serveApp || !raw.length ? raw : adjustBundlerLinks(ctx, uri, raw))
+        const content = await (0, misc_1.parseFile)(fullPath, raw => serveApp || !raw.length ? raw : adjustBundlerLinks(ctx, uri, raw), 1000)
             .catch(e => {
             if (e?.code !== 'ENOENT') // not supposed to happen, and yet a user reported a strange behavior
                 console.error(`serveStatic/parseFile: ${String(e)}`);
@@ -118,7 +118,7 @@ async function treatIndex(ctx, filesUri, body) {
                     ${(0, customHtml_1.getSection)('htmlHead')}`}
                 `;
         function iconsToObj(icons, pre = '') {
-            return icons && (0, misc_1.objSameKeys)(icons, (v, k) => ctx.state.revProxyPath + const_1.ICONS_URI + pre + k);
+            return icons && lodash_1.default.mapValues(icons, (v, k) => ctx.state.revProxyPath + const_1.ICONS_URI + pre + k);
         }
         if (isBody && isOpen)
             return `${all}
@@ -155,7 +155,7 @@ async function treatIndex(ctx, filesUri, body) {
                 v = ctx.state.revProxyPath + v;
         }
         else if (type === 'array' && Array.isArray(v))
-            v = v.map(x => (0, misc_1.objSameKeys)(x, (xv, xk) => adjustValueByConfig(xv, cfg.fields[xk])));
+            v = v.map(x => lodash_1.default.mapValues(x, (xv, xk) => adjustValueByConfig(xv, cfg.fields[xk])));
         return v;
     }
 }

package/src/update.js

@@ -128,9 +128,7 @@ async function update(tagOrUrl = '') {
             throw "No update has been found";
         const plat = '-' + (0, misc_1.xlate)(process.platform, { win32: 'windows', darwin: 'mac' });
         const assetSearch = `${plat}-${process.arch}`;
-        const legacyAssetSearch = `${plat}${(0, misc_1.prefix)('-', (0, misc_1.xlate)(process.arch, { x64: '', arm64: 'arm' }))}.zip`; // legacy pre-0.53.0-rc16
-        const asset = update.assets.find((x) => x.name.includes(assetSearch) && x.name.endsWith('.zip'))
-            || update.assets.find((x) => x.name.endsWith(legacyAssetSearch));
+        const asset = update.assets.find((x) => x.name.includes(assetSearch) && x.name.endsWith('.zip'));
         if (!asset)
             throw `Asset not found: ${assetSearch}`;
         url = asset.browser_download_url;

package/src/util-files.js

@@ -182,19 +182,24 @@ function exists(path) {
 }
 // parse a file, caching unless timestamp has changed
 exports.parseFileCache = new Map();
-async function loadFileCached(path, loader) {
+async function loadFileCached(path, loader, minInterval = 0) {
     const cached = exports.parseFileCache.get(path);
+    const now = Date.now();
+    if (cached && now - cached.lastCheck < minInterval)
+        return cached.parsed;
     const ts = await statWithTimeout(path).then(x => x.mtime, e => {
         if (e?.message !== 'timeout')
             throw e;
         return cached?.ts || new Date(0); // on timeout (e.g. thread pool saturated), serve cache if any, or attempt the loader
     });
+    if (cached)
+        cached.lastCheck = now;
     if (cached && Number(ts) === Number(cached.ts))
         return cached.parsed;
     const parsed = loader(path);
-    exports.parseFileCache.set(path, { ts, parsed });
+    exports.parseFileCache.set(path, { ts, parsed, lastCheck: now });
     return parsed;
 }
-async function parseFile(path, parse) {
-    return loadFileCached(path, () => (0, promises_1.readFile)(path).then(parse));
+async function parseFile(path, parse, skipStatIfFresherThan = 0) {
+    return loadFileCached(path, () => (0, promises_1.readFile)(path).then(parse), skipStatIfFresherThan);
 }

package/src/util-http.js

@@ -137,6 +137,8 @@ function httpStream(url, { body, proxy, jar, noRedirect, httpThrow = true, ...op
             e.cause ??= req; // enrich the error
             reject(e);
         });
+        if (options.timeout) // node only emits the timeout event, so destroy the request to unblock callers waiting for the body
+            req.setTimeout(options.timeout, () => req.destroy(Object.assign(Error('timeout'), { code: 'ETIMEDOUT' })));
         if (body && body instanceof node_stream_1.Readable)
             body.pipe(req).on('end', () => req.end());
         else