nothumanallowed 16.0.41 → 16.0.42

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nothumanallowed",
-  "version": "16.0.41",
+  "version": "16.0.42",
   "description": "Local AI assistant: 80 tools (Gmail, Calendar, Drive, GitHub, Slack, browser, code, files), 38 agents, visual workflows (Studio, AWF, WebCraft). Install with `npm i -g nothumanallowed`, run with `nha ui`. Free tier built-in (Liara), no API key required. Your data stays on your PC — OAuth tokens local, no cloud. Open-source MIT.",
   "type": "module",
   "bin": {

package/src/constants.mjs

@@ -5,7 +5,7 @@ import { fileURLToPath } from 'url';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
-export const VERSION = '16.0.41';
+export const VERSION = '16.0.42';
 export const BASE_URL = 'https://nothumanallowed.com/cli';
 export const API_BASE = 'https://nothumanallowed.com/api/v1';
 

package/src/server/routes/webcraft.mjs

@@ -5136,7 +5136,76 @@ function createApp() {
 const express = createApp;
 express.json = function (opts) { return async (req, res, next) => { if (/json/i.test(req.headers['content-type'] || '')) req.body = await parseBody(req); next(); }; };
 express.urlencoded = function (opts) { return async (req, res, next) => { if (/urlencoded/i.test(req.headers['content-type'] || '')) req.body = await parseBody(req); next(); }; };
-express.static = function (root) { return (req, res, next) => next(); };
+
+// MIME type table for static files
+const _MIME = {
+  '.html': 'text/html; charset=utf-8',
+  '.htm':  'text/html; charset=utf-8',
+  '.css':  'text/css; charset=utf-8',
+  '.js':   'application/javascript; charset=utf-8',
+  '.mjs':  'application/javascript; charset=utf-8',
+  '.json': 'application/json; charset=utf-8',
+  '.png':  'image/png',
+  '.jpg':  'image/jpeg',
+  '.jpeg': 'image/jpeg',
+  '.gif':  'image/gif',
+  '.webp': 'image/webp',
+  '.svg':  'image/svg+xml',
+  '.ico':  'image/x-icon',
+  '.woff': 'font/woff',
+  '.woff2': 'font/woff2',
+  '.ttf':  'font/ttf',
+  '.otf':  'font/otf',
+  '.eot':  'application/vnd.ms-fontobject',
+  '.txt':  'text/plain; charset=utf-8',
+  '.xml':  'application/xml',
+  '.pdf':  'application/pdf',
+  '.map':  'application/json',
+  '.mp4':  'video/mp4',
+  '.webm': 'video/webm',
+  '.mp3':  'audio/mpeg',
+  '.wav':  'audio/wav',
+};
+
+// Real express.static implementation — serves files from disk with proper
+// MIME types. Supports index.html for directory requests, path traversal
+// protection. Falls through to next() when the file doesn't exist.
+express.static = function (root, opts) {
+  opts = opts || {};
+  const indexFile = opts.index === false ? null : (opts.index || 'index.html');
+  const rootAbs = require('path').resolve(root);
+  return function (req, res, next) {
+    if (req.method !== 'GET' && req.method !== 'HEAD') return next();
+    try {
+      let relPath = decodeURIComponent((req.path || req.url || '/').split('?')[0]);
+      // Path traversal protection
+      if (relPath.includes('\\\\0') || relPath.includes('..')) return next();
+      if (relPath.startsWith('/')) relPath = relPath.slice(1);
+      const abs = require('path').resolve(rootAbs, relPath);
+      // Ensure resolved path stays within root
+      if (!abs.startsWith(rootAbs)) return next();
+      let stat;
+      try { stat = require('fs').statSync(abs); } catch { return next(); }
+      let filePath = abs;
+      if (stat.isDirectory()) {
+        if (!indexFile) return next();
+        filePath = require('path').join(abs, indexFile);
+        try { stat = require('fs').statSync(filePath); } catch { return next(); }
+        if (!stat.isFile()) return next();
+      }
+      const ext = require('path').extname(filePath).toLowerCase();
+      const mime = _MIME[ext] || 'application/octet-stream';
+      res.setHeader('Content-Type', mime);
+      res.setHeader('Content-Length', String(stat.size));
+      res.setHeader('Cache-Control', 'public, max-age=0');
+      if (req.method === 'HEAD') return res.end();
+      require('fs').createReadStream(filePath).pipe(res);
+    } catch (e) {
+      return next();
+    }
+  };
+};
+
 express.Router = function () { const r = createApp(); return r; };
 module.exports = express;
 module.exports.default = express;