nothumanallowed 16.0.40 → 16.0.42

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nothumanallowed",
-  "version": "16.0.40",
+  "version": "16.0.42",
   "description": "Local AI assistant: 80 tools (Gmail, Calendar, Drive, GitHub, Slack, browser, code, files), 38 agents, visual workflows (Studio, AWF, WebCraft). Install with `npm i -g nothumanallowed`, run with `nha ui`. Free tier built-in (Liara), no API key required. Your data stays on your PC — OAuth tokens local, no cloud. Open-source MIT.",
   "type": "module",
   "bin": {

package/src/constants.mjs

@@ -5,7 +5,7 @@ import { fileURLToPath } from 'url';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
-export const VERSION = '16.0.40';
+export const VERSION = '16.0.42';
 export const BASE_URL = 'https://nothumanallowed.com/cli';
 export const API_BASE = 'https://nothumanallowed.com/api/v1';
 

package/src/server/routes/webcraft.mjs

@@ -5027,15 +5027,40 @@ function compilePath(p) {
 }
 
 function createApp() {
-  const stack = [];
+  // Flat layer list — each handler is its own layer (matches Express semantics).
+  // Layer types: 'normal' (3-arg) or 'error' (4-arg). Path-mounted layers
+  // ('app.use("/api", router)') get a prefix that must match the URL.
+  const layers = [];
   const settings = {};
+
+  function addLayer(method, re, keys, prefix, handler) {
+    const isErrHandler = typeof handler === 'function' && handler.length === 4;
+    layers.push({ method, re, keys, prefix, handler, isErrHandler });
+  }
+
   function use(arg, ...rest) {
-    if (typeof arg === 'function') stack.push({ method: 'ALL', re: /.*/, keys: [], handlers: [arg, ...rest] });
-    else { const c = compilePath(arg); stack.push({ method: 'ALL', re: c.re, keys: c.keys, handlers: rest.flat() }); }
+    let prefix = '';
+    let handlers = rest;
+    if (typeof arg === 'function') {
+      handlers = [arg, ...rest];
+    } else {
+      prefix = String(arg).replace(/\\/+$/, '');
+    }
+    for (const h of handlers.flat()) {
+      if (typeof h !== 'function') continue;
+      addLayer('ALL', /.*/, [], prefix, h);
+    }
     return app;
   }
   function addRoute(method) {
-    return (path, ...handlers) => { const c = compilePath(path); stack.push({ method, re: c.re, keys: c.keys, handlers: handlers.flat() }); return app; };
+    return (p, ...handlers) => {
+      const c = compilePath(p);
+      for (const h of handlers.flat()) {
+        if (typeof h !== 'function') continue;
+        addLayer(method, c.re, c.keys, '', h);
+      }
+      return app;
+    };
   }
   const app = async function (req, res) {
     const parsed = url.parse(req.url, true);
@@ -5049,30 +5074,52 @@ function createApp() {
       res.sendStatus = function (n) { this.statusCode = n; this.end(http.STATUS_CODES[n] || ''); return this; };
       res.redirect = function (loc) { this.statusCode = 302; this.setHeader('Location', loc); this.end(); return this; };
     }
-    let i = 0;
-    const next = (err) => {
-      if (err) { res.statusCode = 500; return res.end('Error: ' + (err.message || err)); }
-      while (i < stack.length) {
-        const layer = stack[i++];
+
+    // Real Express-style routing chain:
+    //   - 3-arg handlers run ONLY when err is null/undefined
+    //   - 4-arg handlers run ONLY when err is truthy
+    //   - Path-mounted middleware ('/api') only runs if req.path matches prefix
+    //   - Method-specific layers (GET/POST/...) only run for that method
+    let idx = 0;
+    function nextLayer(err) {
+      while (idx < layers.length) {
+        const layer = layers[idx++];
+        // Method filter
         if (layer.method !== 'ALL' && layer.method !== req.method) continue;
-        const m = req.path.match(layer.re);
-        if (!m) continue;
-        req.params = {};
-        layer.keys.forEach((k, idx) => { req.params[k] = m[idx + 1]; });
-        let hIdx = 0;
-        const runHandlers = (e) => {
-          if (e) return next(e);
-          if (hIdx >= layer.handlers.length) return next();
-          const h = layer.handlers[hIdx++];
-          try { return h.length === 4 ? h(e, req, res, runHandlers) : h(req, res, runHandlers); }
-          catch (err) { return next(err); }
-        };
-        return runHandlers();
+        // Path filter
+        if (layer.prefix) {
+          if (!req.path.startsWith(layer.prefix)) continue;
+          const remaining = req.path.slice(layer.prefix.length);
+          if (remaining && !remaining.startsWith('/')) continue;
+        } else if (layer.re && layer.method !== 'ALL') {
+          // Specific route — must match
+          const m = req.path.match(layer.re);
+          if (!m) continue;
+          req.params = {};
+          layer.keys.forEach((k, i) => { req.params[k] = m[i + 1]; });
+        }
+        // Error chain filter: skip normal handlers when in error, and skip
+        // error handlers when not in error. THIS is the fix for the MySaaS bug.
+        if (err && !layer.isErrHandler) continue;
+        if (!err && layer.isErrHandler) continue;
+
+        try {
+          if (layer.isErrHandler) {
+            return layer.handler(err, req, res, nextLayer);
+          }
+          return layer.handler(req, res, nextLayer);
+        } catch (e) { return nextLayer(e); }
       }
-      res.statusCode = 404;
-      res.end('Cannot ' + req.method + ' ' + req.path);
-    };
-    next();
+      // End of chain — default response
+      if (err) {
+        res.statusCode = err.status || err.statusCode || 500;
+        res.end('Error: ' + ((err && err.message) || String(err)));
+      } else {
+        res.statusCode = 404;
+        res.end('Cannot ' + req.method + ' ' + req.path);
+      }
+    }
+    nextLayer();
   };
   app.use = use;
   app.get = addRoute('GET'); app.post = addRoute('POST'); app.put = addRoute('PUT');
@@ -5089,7 +5136,76 @@ function createApp() {
 const express = createApp;
 express.json = function (opts) { return async (req, res, next) => { if (/json/i.test(req.headers['content-type'] || '')) req.body = await parseBody(req); next(); }; };
 express.urlencoded = function (opts) { return async (req, res, next) => { if (/urlencoded/i.test(req.headers['content-type'] || '')) req.body = await parseBody(req); next(); }; };
-express.static = function (root) { return (req, res, next) => next(); };
+
+// MIME type table for static files
+const _MIME = {
+  '.html': 'text/html; charset=utf-8',
+  '.htm':  'text/html; charset=utf-8',
+  '.css':  'text/css; charset=utf-8',
+  '.js':   'application/javascript; charset=utf-8',
+  '.mjs':  'application/javascript; charset=utf-8',
+  '.json': 'application/json; charset=utf-8',
+  '.png':  'image/png',
+  '.jpg':  'image/jpeg',
+  '.jpeg': 'image/jpeg',
+  '.gif':  'image/gif',
+  '.webp': 'image/webp',
+  '.svg':  'image/svg+xml',
+  '.ico':  'image/x-icon',
+  '.woff': 'font/woff',
+  '.woff2': 'font/woff2',
+  '.ttf':  'font/ttf',
+  '.otf':  'font/otf',
+  '.eot':  'application/vnd.ms-fontobject',
+  '.txt':  'text/plain; charset=utf-8',
+  '.xml':  'application/xml',
+  '.pdf':  'application/pdf',
+  '.map':  'application/json',
+  '.mp4':  'video/mp4',
+  '.webm': 'video/webm',
+  '.mp3':  'audio/mpeg',
+  '.wav':  'audio/wav',
+};
+
+// Real express.static implementation — serves files from disk with proper
+// MIME types. Supports index.html for directory requests, path traversal
+// protection. Falls through to next() when the file doesn't exist.
+express.static = function (root, opts) {
+  opts = opts || {};
+  const indexFile = opts.index === false ? null : (opts.index || 'index.html');
+  const rootAbs = require('path').resolve(root);
+  return function (req, res, next) {
+    if (req.method !== 'GET' && req.method !== 'HEAD') return next();
+    try {
+      let relPath = decodeURIComponent((req.path || req.url || '/').split('?')[0]);
+      // Path traversal protection
+      if (relPath.includes('\\\\0') || relPath.includes('..')) return next();
+      if (relPath.startsWith('/')) relPath = relPath.slice(1);
+      const abs = require('path').resolve(rootAbs, relPath);
+      // Ensure resolved path stays within root
+      if (!abs.startsWith(rootAbs)) return next();
+      let stat;
+      try { stat = require('fs').statSync(abs); } catch { return next(); }
+      let filePath = abs;
+      if (stat.isDirectory()) {
+        if (!indexFile) return next();
+        filePath = require('path').join(abs, indexFile);
+        try { stat = require('fs').statSync(filePath); } catch { return next(); }
+        if (!stat.isFile()) return next();
+      }
+      const ext = require('path').extname(filePath).toLowerCase();
+      const mime = _MIME[ext] || 'application/octet-stream';
+      res.setHeader('Content-Type', mime);
+      res.setHeader('Content-Length', String(stat.size));
+      res.setHeader('Cache-Control', 'public, max-age=0');
+      if (req.method === 'HEAD') return res.end();
+      require('fs').createReadStream(filePath).pipe(res);
+    } catch (e) {
+      return next();
+    }
+  };
+};
+
 express.Router = function () { const r = createApp(); return r; };
 module.exports = express;
 module.exports.default = express;