luckytri 1.0.0

package/server/mind/util.js

@@ -0,0 +1,110 @@
+import { localClock } from "../core/conversation-cues.js";
+
+export const HOUR = 3600000;
+export const DAY = 86400000;
+
+export function parse(value, fallback) {
+  if (value == null) return fallback;
+  if (typeof value !== "string") return value;
+  try {
+    return JSON.parse(value);
+  } catch {
+    return fallback;
+  }
+}
+
+export function clamp(value, min = 0, max = 1) {
+  const n = Number(value);
+  if (!Number.isFinite(n)) return min;
+  return Math.min(max, Math.max(min, n));
+}
+
+export function text(value, max) {
+  return String(value ?? "")
+    .trim()
+    .slice(0, max);
+}
+
+export function normalized(value) {
+  return String(value ?? "")
+    .replace(/[\s\p{P}\p{S}]/gu, "")
+    .toLowerCase();
+}
+
+// Bigram overlap on normalized text: cheap, deterministic, good enough to
+// tell "the same thought again" from a genuinely new one.
+export function similar(a, b, threshold = 0.8) {
+  const left = normalized(a);
+  const right = normalized(b);
+  if (!left || !right) return false;
+  if (left.includes(right) || right.includes(left)) return true;
+  const grams = (s) =>
+    new Set(
+      Array.from({ length: Math.max(0, s.length - 1) }, (_, i) =>
+        s.slice(i, i + 2),
+      ),
+    );
+  const x = grams(left);
+  const y = grams(right);
+  const shared = [...x].filter((g) => y.has(g)).length;
+  return shared / Math.max(1, Math.min(x.size, y.size)) > threshold;
+}
+
+export const CREDENTIAL =
+  /(?:sk-[a-zA-Z0-9_-]{16,}|Bearer\s+\S{12,}|(?:密码|验证码|口令|API.?Key|token|密钥)\s*(?:是|为|[:：=])\s*\S{4,})/i;
+
+export function hasCredential(value) {
+  return CREDENTIAL.test(String(value ?? ""));
+}
+
+export function dayKey(time, timeZone) {
+  return localClock(time, timeZone).local.slice(0, 10);
+}
+
+// "2026-10-02" or "2026-10-02 14:30" as a moment in her time zone.
+export function zonedTime(value, timeZone) {
+  const match = String(value ?? "")
+    .trim()
+    .match(/^(\d{4})-(\d{2})-(\d{2})(?:[ T](\d{2}):(\d{2}))?$/);
+  if (!match) return null;
+  const [, y, mo, d, h = "00", mi = "00"] = match;
+  const guess = Date.UTC(+y, +mo - 1, +d, +h, +mi);
+  if (!Number.isFinite(guess)) return null;
+  const shown = localClock(guess, timeZone).local;
+  const offset = Date.parse(`${shown.replace(" ", "T")}:00Z`) - guess;
+  const time = guess - offset;
+  return localClock(time, timeZone).local === `${y}-${mo}-${d} ${h}:${mi}`
+    ? time
+    : null;
+}
+
+// Exponential return toward a baseline.
+export function relax(value, baseline, elapsed, halfLife) {
+  if (!(elapsed > 0)) return value;
+  return baseline + (value - baseline) * Math.pow(0.5, elapsed / halfLife);
+}
+
+// Evidence is stored as short typed strings so every kind of experience can
+// be cited the same way: "m:<event seq>", "t:<thought id>", "d:<day>",
+// "f:<decision id>", "r:<passage id>", "a:<anticipation id>",
+// "g:<meeting id>" for what a meeting already meant to her,
+// "s:<self thread>" for something she is living for.
+export function evidence(list) {
+  const out = [];
+  for (const item of Array.isArray(list) ? list : []) {
+    if (Number.isSafeInteger(item) && item > 0) out.push(`m:${item}`);
+    else if (
+      typeof item === "string" &&
+      /^[mtdfrasgxoe]:[\w:.-]{1,80}$/.test(item)
+    )
+      out.push(item);
+    else if (/^\d+$/.test(String(item))) out.push(`m:${item}`);
+  }
+  return [...new Set(out)].slice(0, 24);
+}
+
+export function messageSeqs(sources) {
+  return evidence(sources)
+    .filter((s) => s.startsWith("m:"))
+    .map((s) => Number(s.slice(2)));
+}

package/server/mind/view.js

@@ -0,0 +1,273 @@
+import { summarizeGroupStyle } from "../core/group-style.js";
+import { relevantContext, boundMindContext } from "./context-selection.js";
+import { interestTerms } from "./attention.js";
+import { agoLabel, elapsedLabel } from "./clock.js";
+import { describeFace } from "./faces.js";
+import { SELF_KINDS } from "./self.js";
+import { DAY, text } from "./util.js";
+
+const FORGOTTEN = "（很久没想起了）";
+
+// One person's own words. Two people cannot be added together, and a line
+// she already said does not count. A bare string is one utterance.
+function speakerCues(cue) {
+  const groups = new Map();
+  let anon = 0;
+  for (const item of cue || []) {
+    if (item && typeof item === "object") {
+      if (item.role === "assistant") continue;
+      const id = String(item.userId || item.speaker || "");
+      if (!id) continue;
+      const texts = groups.get(id) || [];
+      texts.push(String(item.text || ""));
+      groups.set(id, texts);
+    } else groups.set(`\0${anon++}`, [String(item ?? "")]);
+  }
+  return [...groups.values()]
+    .map((texts) => interestTerms(texts))
+    .filter((terms) => terms.size);
+}
+
+const FEEDBACK = {
+  too_long: "太长了",
+  too_formal: "太端着",
+  too_meme: "梗太多",
+  natural: "挺自然",
+};
+
+// The way a room talks is read as of `now`, not as of the wall clock: a replay
+// or a test that moves the clock must see the room as it was at that moment.
+function groupStyle(mind, session, now) {
+  try {
+    const rows = mind.db
+      .prepare(
+        "SELECT * FROM (SELECT * FROM messages WHERE session_id=? AND is_demo=0 AND time<=? ORDER BY id DESC LIMIT 200) ORDER BY id",
+      )
+      .all(session, now + 60000);
+    const ids = rows.map((row) => row.event_id).filter(Boolean);
+    const away = ids.length
+      ? new Set(
+          mind.db
+            .prepare(
+              `SELECT e.event_id FROM core_events e JOIN mind_unlived u ON u.seq=e.seq WHERE e.event_id IN (${ids.map(() => "?").join(",")})`,
+            )
+            .all(...ids)
+            .map((row) => row.event_id),
+        )
+      : new Set();
+    const profile = summarizeGroupStyle(
+      away.size ? rows.filter((row) => !away.has(row.event_id)) : rows,
+      now,
+    );
+    return profile.ready ? profile.summary : "";
+  } catch {
+    return "";
+  }
+}
+
+function feedback(mind, session, now) {
+  return mind.db
+    .prepare(
+      "SELECT f.tag,d.reply FROM reply_feedback f JOIN decisions d ON d.id=f.decision_id WHERE d.session_id=? AND d.is_demo=0 AND f.time>? AND f.time<=? ORDER BY f.time DESC LIMIT 2",
+    )
+    .all(session, now - 3 * DAY, now)
+    .filter((row) => FEEDBACK[row.tag] && row.tag !== "natural")
+    .map(
+      (row) => `有人觉得我说的「${text(row.reply, 30)}」${FEEDBACK[row.tag]}`,
+    );
+}
+
+// Who she is right now, in a few hundred tokens. `self` changes a few times a
+// day and sits in the cached head of the prompt; `inner` changes every turn,
+// so anything this batch of messages brings back to mind belongs there.
+export function innerView(
+  mind,
+  { session, kind = "group", people = [], cue = [], now = Date.now() },
+) {
+  const nature = mind.nature.current(now);
+  const affect = mind.affect.state(now, { nature, room: session });
+  const face = mind.faces.current(session, now);
+  const living = mind.self.living({ before: now, now, room: session });
+  const cues = speakerCues(cue);
+  const carries = (thread) => mind.meetings.stays(thread, session, now);
+  const visibleThreads = relevantContext(
+    mind.self
+      .annotated({ before: now, now })
+      .filter((t) => !t.faded && carries(t)),
+    { cues, limit: 6, pinned: (t) => t.core || t.thread === living?.thread },
+  );
+  const shownLiving = living && carries(living) ? living : null;
+  const reminded = [
+    ...mind.self
+      .reminded({ before: now, now, cues, limit: 2 })
+      .filter(carries)
+      .map((t) => `${SELF_KINDS[t.kind]}：${text(t.content, 80)}${FORGOTTEN}`),
+    ...mind.thoughts
+      .reminded({ now, cues, session, limit: 1 })
+      .filter((t) => mind.meetings.sayable(t.content, session))
+      .map(
+        (t) =>
+          `${elapsedLabel(t.created, now, mind.timeZone())}想到：${text(t.content, 110)}${FORGOTTEN}`,
+      ),
+    ...mind.meetings
+      .reminded({ session, now, cues, limit: 1 })
+      .filter((line) => mind.meetings.sayable(line, session))
+      .map((line) => `${line}${FORGOTTEN}`),
+  ];
+  const diary = mind.db
+    .prepare(
+      "SELECT day,content FROM mind_diary WHERE created<=? ORDER BY created DESC LIMIT 1",
+    )
+    .get(now);
+  const diaryHere =
+    diary &&
+    !mind.meetings.privateBeyond(diary.day, session, now) &&
+    mind.meetings.sayable(diary.content, session)
+      ? `${diary.day}：${text(diary.content, 110)}`
+      : "";
+  const read = mind.reading
+    .recent({ now, limit: 2 })
+    .filter((r) => r.created > now - 7 * DAY);
+  const room = kind === "group" ? groupStyle(mind, session, now) : "";
+  const spoken = (value) =>
+    value && mind.meetings.sayable(value, session) ? value : "";
+  const self = {
+    ...(face
+      ? {
+          here: describeFace({
+            ...face,
+            role: spoken(face.role),
+            tone: spoken(face.tone),
+            aspiration: spoken(face.aspiration),
+            content: spoken(face.content),
+          }),
+        }
+      : {}),
+    ...(visibleThreads.length
+      ? {
+          threads: visibleThreads.map(
+            (t) =>
+              `${SELF_KINDS[t.kind]}：${text(t.content, 80)}${t.status === "emerging" ? "（刚开始有这种感觉）" : ""}`,
+          ),
+        }
+      : {}),
+    ...(shownLiving ? { livingFor: text(shownLiving.content, 80) } : {}),
+    ...(diaryHere ? { lastDiary: diaryHere } : {}),
+    ...(read.length
+      ? {
+          readLately: read.map((r) => {
+            const note =
+              r.note && mind.meetings.sayable(r.note, session)
+                ? text(r.note, 60)
+                : "";
+            return `读过《${r.title}》第 ${r.ordinal + 1} 段${note ? `：${note}` : ""}`;
+          }),
+        }
+      : {}),
+  };
+  if (!self.here) delete self.here;
+  const persons = [];
+  for (const id of [...new Set(people.map(String))].slice(0, 6)) {
+    const bond = mind.bonds.person(id, now, { room: session });
+    // A recorded feeling counts even before anyone has spoken. Merely being
+    // seen does not.
+    if (
+      !bond ||
+      (!bond.interactions &&
+        !bond.impression &&
+        !bond.lastChange &&
+        bond.tension < 0.15)
+    )
+      continue;
+    persons.push({
+      id,
+      name: bond.name,
+      feel: bond.feel,
+      ...(bond.impression && mind.meetings.sayable(bond.impression, session)
+        ? { impression: bond.impression }
+        : {}),
+      // Someone coming back after days away, or someone who has been around
+      // without talking with her for a while.
+      ...(bond.awayDays >= 3
+        ? { away: `上次见到是 ${agoLabel(now - bond.seenAt)}` }
+        : bond.absentDays >= 7
+          ? { lastTalked: `上次说上话是 ${agoLabel(now - bond.lastTalkedAt)}` }
+          : {}),
+    });
+  }
+  const group = kind === "group" ? mind.bonds.group(session, now) : null;
+  const thoughts = relevantContext(
+    mind.thoughts
+      .open({ now, limit: 400, session })
+      .filter((t) => mind.meetings.sayable(t.content, session)),
+    { cues, limit: 3 },
+  );
+  const heard = feedback(mind, session, now);
+  const continuity = mind.continuity.recall({ session, people, cue, now });
+  const expecting = mind.anticipations
+    .upcoming({ now, people, session, limit: 3 })
+    .map((a) => a.text);
+  const withWhom = mind.meetings.recall({
+    session,
+    people,
+    cue,
+    now,
+    limit: 2,
+  });
+  const wills = mind.meetings.traces({ session, before: now, limit: 2 });
+  const will = wills
+    .map((row) =>
+      row.living ? row.text : `${text(row.content, 28)}：${row.text}`,
+    )
+    .join("；");
+  const stood = mind.meetings.stood({
+    session,
+    people,
+    cue,
+    now,
+    limit: 2,
+  });
+  const cause =
+    affect.cause && mind.meetings.sayable(affect.cause, session)
+      ? text(affect.cause, 40)
+      : "";
+  const withLines = withWhom.filter((line) =>
+    mind.meetings.sayable(line, session),
+  );
+  const expectingLines = expecting.filter((line) =>
+    mind.meetings.sayable(line, session),
+  );
+  const senses = mind.senses?.lines({ kind, now }) || [];
+  const body = (mind.body?.({ kind, now }) || [])
+    .map((line) => text(line, 80))
+    .filter(Boolean)
+    .slice(0, 8);
+  return boundMindContext({
+    self,
+    affect: cause ? affect : { ...affect, cause: "" },
+    inner: {
+      currentLife: mind.time.view({ session, now, cue }),
+      state: `${affect.phaseLabel}，精力${affect.energyLabel}，心情${affect.mood}${cause ? `（${cause}）` : ""}${affect.lately ? `，${affect.lately}` : ""}`,
+      ...(persons.length ? { people: persons } : {}),
+      ...(continuity ? { continuity } : {}),
+      ...(group ? { thisGroup: group.feel } : {}),
+      ...(thoughts.length
+        ? {
+            onMind: thoughts.map(
+              (t) =>
+                `${elapsedLabel(t.created, now, mind.timeZone())}想到：${text(t.content, 110)}`,
+            ),
+          }
+        : {}),
+      ...(expectingLines.length ? { expecting: expectingLines } : {}),
+      ...(withLines.length ? { with: withLines } : {}),
+      ...(will ? { will } : {}),
+      ...(stood.length ? { stood } : {}),
+      ...(reminded.length ? { reminded } : {}),
+      ...(room ? { room } : {}),
+      ...(heard.length ? { heard } : {}),
+      ...(senses.length ? { senses } : {}),
+      ...(body.length ? { body } : {}),
+    },
+  });
+}

package/server/paths.js

@@ -0,0 +1,102 @@
+import { existsSync, realpathSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+
+// Code and static assets belong to the package; all mutable state belongs to
+// an instance. Neither is ever resolved against the caller's working directory.
+export const PACKAGE_ROOT = fileURLToPath(new URL("../", import.meta.url));
+export const SOURCE_CHECKOUT = existsSync(join(PACKAGE_ROOT, ".git"));
+
+export function defaultHome({
+  platform = process.platform,
+  env = process.env,
+  userHome = homedir(),
+} = {}) {
+  if (platform === "win32")
+    return join(
+      env.LOCALAPPDATA && isAbsolute(env.LOCALAPPDATA)
+        ? env.LOCALAPPDATA
+        : join(userHome, "AppData", "Local"),
+      "LuckyTri",
+    );
+  if (platform === "darwin")
+    return join(userHome, "Library", "Application Support", "LuckyTri");
+  return join(
+    env.XDG_DATA_HOME && isAbsolute(env.XDG_DATA_HOME)
+      ? env.XDG_DATA_HOME
+      : join(userHome, ".local", "share"),
+    "luckytri",
+  );
+}
+
+function inside(file, directory) {
+  const part = relative(directory, file);
+  return (
+    !part ||
+    (part !== ".." && !part.startsWith(`..${sep}`) && !isAbsolute(part))
+  );
+}
+
+// Resolve through existing ancestors as well: a symlink must not route user
+// data back into node_modules, where an npm update would delete it.
+function canonical(file) {
+  if (existsSync(file)) return realpathSync(file);
+  const parent = dirname(file);
+  return parent === file
+    ? file
+    : join(canonical(parent), relative(parent, file));
+}
+
+export function runtimePaths(env = process.env) {
+  if (env.LUCKYTRI_HOME && !isAbsolute(env.LUCKYTRI_HOME))
+    throw Error(
+      "LUCKYTRI_HOME / --home 必须是绝对路径 (must be an absolute path)",
+    );
+  const home = canonical(
+    resolve(
+      env.LUCKYTRI_HOME ||
+        (SOURCE_CHECKOUT ? PACKAGE_ROOT : defaultHome({ env })),
+    ),
+  );
+  const data = canonical(join(home, "data"));
+  const config = canonical(join(home, ".env"));
+  const log = canonical(join(data, "launcher.log"));
+  const knowledge = canonical(join(data, "knowledge"));
+  const plugins = canonical(join(data, "plugins"));
+  const database =
+    env.DB_PATH === ":memory:"
+      ? ":memory:"
+      : canonical(resolve(home, env.DB_PATH || join("data", "friend.db")));
+  const backups = canonical(
+    resolve(home, env.BACKUP_DIR || join(dirname(database), "backups")),
+  );
+  if (!SOURCE_CHECKOUT) {
+    for (const file of [
+      home,
+      config,
+      data,
+      database,
+      backups,
+      log,
+      knowledge,
+      plugins,
+    ])
+      if (file !== ":memory:" && inside(file, canonical(PACKAGE_ROOT)))
+        throw Error(
+          "用户数据不能存放在 npm 安装目录内 (user data cannot live inside the npm package)",
+        );
+  }
+  return {
+    package: PACKAGE_ROOT,
+    home,
+    config,
+    data,
+    database,
+    backups,
+    log,
+    knowledge,
+    plugins,
+    public: join(PACKAGE_ROOT, "public"),
+  };
+}

package/server/plugins/api.js

@@ -0,0 +1,204 @@
+import { createReadStream, existsSync, statSync } from "node:fs";
+import { join, normalize } from "node:path";
+import { PERMISSIONS } from "./permissions.js";
+
+const SANDBOX =
+  "sandbox allow-scripts allow-forms; default-src 'none'; img-src data: https:; style-src 'unsafe-inline' *; script-src 'unsafe-inline' *; connect-src 'none'";
+
+function safeFile(root, requestPath) {
+  const relative = normalize(requestPath).replace(/^(\.\.[/\\])+/, "");
+  const file = join(root, relative);
+  if (!file.startsWith(root) || !existsSync(file) || !statSync(file).isFile())
+    return "";
+  return file;
+}
+
+export function mountPlugins(app, plugins) {
+  if (!plugins) return;
+  app.get("/api/plugins", (req, res) => {
+    res.json({ plugins: plugins.list(), permissions: PERMISSIONS });
+  });
+  app.get("/api/plugins/market", async (req, res) => {
+    try {
+      res.json(await plugins.install.catalog());
+    } catch (error) {
+      res.status(400).json({ error: error.message });
+    }
+  });
+  app.post("/api/plugins/market/stage", async (req, res) => {
+    try {
+      res.json(await plugins.install.stageRegistry(req.body));
+    } catch (error) {
+      res.status(400).json({ error: error.message });
+    }
+  });
+  app.post("/api/plugins/import/url", async (req, res) => {
+    try {
+      res.json(await plugins.install.stageUrl(req.body));
+    } catch (error) {
+      res.status(400).json({ error: error.message });
+    }
+  });
+  app.post("/api/plugins/import/github", async (req, res) => {
+    try {
+      res.json(await plugins.install.stageGithub(req.body.repository));
+    } catch (error) {
+      res.status(400).json({ error: error.message });
+    }
+  });
+  app.post("/api/plugins/import/dir", (req, res) => {
+    try {
+      res.json(plugins.install.stageDir(req.body.dir));
+    } catch (error) {
+      res.status(400).json({ error: error.message });
+    }
+  });
+  app.post("/api/plugins/import/commit", (req, res) => {
+    try {
+      res.json(plugins.install.commit(req.body.token));
+    } catch (error) {
+      res.status(400).json({ error: error.message });
+    }
+  });
+  app.post("/api/plugins/sources", (req, res) => {
+    try {
+      plugins.install.saveRegistry(req.body.url);
+      res.json({ ok: true });
+    } catch (error) {
+      res.status(400).json({ error: error.message });
+    }
+  });
+  app.delete("/api/plugins/sources/:source", (req, res) => {
+    plugins.install.removeRegistry(req.params.source);
+    res.json({ ok: true });
+  });
+  app.post("/api/plugins/:id/rollback", (req, res) => {
+    try {
+      res.json(plugins.install.rollback(req.params.id));
+    } catch (error) {
+      res.status(400).json({ error: error.message });
+    }
+  });
+  app.delete("/api/plugins/:id", async (req, res) => {
+    try {
+      res.json(
+        await plugins.install.remove(req.params.id, { data: !!req.body?.data }),
+      );
+    } catch (error) {
+      res.status(400).json({ error: error.message });
+    }
+  });
+  app.post("/api/plugins/:id/grant", (req, res) => {
+    try {
+      res.json(plugins.grant(req.params.id, req.body.permissions || []));
+    } catch (error) {
+      res.status(400).json({ error: error.message });
+    }
+  });
+  app.post("/api/plugins/:id/enable", async (req, res) => {
+    try {
+      res.json(await plugins.enable(req.params.id));
+    } catch (error) {
+      res.status(400).json({ error: error.message });
+    }
+  });
+  app.post("/api/plugins/:id/disable", async (req, res) => {
+    try {
+      res.json(await plugins.disable(req.params.id));
+    } catch (error) {
+      res.status(400).json({ error: error.message });
+    }
+  });
+  app.get("/api/plugins/:id/settings", (req, res) => {
+    try {
+      res.json(plugins.settings(req.params.id));
+    } catch (error) {
+      res.status(404).json({ error: error.message });
+    }
+  });
+  app.put("/api/plugins/:id/settings", (req, res) => {
+    try {
+      res.json(
+        plugins.saveSettings(req.params.id, req.body.values || req.body),
+      );
+    } catch (error) {
+      res.status(400).json({ error: error.message });
+    }
+  });
+  app.get("/api/plugins/:id/log", (req, res) => {
+    const rows = plugins.db
+      .prepare(
+        "SELECT id,time,kind,level,message FROM plugin_events WHERE plugin_id=? ORDER BY id DESC LIMIT 80",
+      )
+      .all(req.params.id);
+    res.json({ events: rows });
+  });
+  app.get("/api/plugins/actions/pending", (req, res) => {
+    res.json({ actions: plugins.chat.capabilities.pending() });
+  });
+  app.post("/api/plugins/actions/:action/approve", async (req, res) => {
+    try {
+      res.json(await plugins.chat.capabilities.approve(req.params.action));
+    } catch (error) {
+      res.status(400).json({ error: error.message });
+    }
+  });
+  app.post("/api/plugins/actions/:action/reject", (req, res) => {
+    try {
+      res.json(
+        plugins.chat.capabilities.reject(req.params.action, req.body.reason),
+      );
+    } catch (error) {
+      res.status(400).json({ error: error.message });
+    }
+  });
+  app.use("/api/plugins/:id/x", async (req, res) => {
+    try {
+      const path = req.path && req.path !== "/" ? req.path : "/";
+      const result = await plugins.handleHttp(
+        req.params.id,
+        req.method,
+        path,
+        req.body,
+      );
+      if (result == null)
+        return res.status(404).json({ error: "插件接口不存在" });
+      res.json(result && typeof result === "object" ? result : { result });
+    } catch (error) {
+      res.status(400).json({ error: error.message });
+    }
+  });
+  app.use("/hook/:id", async (req, res) => {
+    try {
+      const path = req.path && req.path !== "/" ? req.path : "/";
+      const route = plugins.routes.find(
+        (item) => item.id === req.params.id && item.open && item.path === path,
+      );
+      if (!route) return res.status(404).end();
+      const result = await plugins.handleHttp(
+        req.params.id,
+        req.method,
+        path,
+        req.body || {},
+      );
+      res.json(result && typeof result === "object" ? result : { result });
+    } catch {
+      res.status(400).end();
+    }
+  });
+  app.use("/plugin-ui/:id", (req, res) => {
+    const row = plugins.list().find((item) => item.id === req.params.id);
+    const page = row?.manifest.contributes?.page;
+    if (!row?.enabled || !page) return res.status(404).end();
+    const root = join(row.path, "ui");
+    const relative = req.path.replace(/^\//, "") || "index.html";
+    const file = safeFile(root, relative);
+    if (!file) return res.status(404).end();
+    if (file.endsWith(".html")) {
+      res.setHeader("Content-Security-Policy", SANDBOX);
+      res.setHeader("Cache-Control", "no-store");
+    }
+    res.setHeader("Access-Control-Allow-Origin", "*");
+    createReadStream(file).pipe(res);
+  });
+}