vava-nessa/free-coding-models v0.5.51

on GitHub

Fixed

• 🛡️ Windows path traversal protection — serveWebStaticFile() in src/core/router-daemon.js now uses path.sep instead of a hardcoded / for the path traversal guard. On Windows, path.resolve() returns backslash separators, which made the previous candidate.startsWith(WEB_DIST_DIR + '/') check always fail and serve path_traversal_blocked for every root request. On Linux/macOS, path.sep === '/' so behaviour is unchanged. (Thanks @fan92rus! First contribution 🎉)

Changed

• 📦 Deps: bump @tanstack/react-virtual from 3.14.3 → 3.14.5
• 📦 DevDeps: bump @vitejs/plugin-react from 6.0.2 → 6.0.3

Maintenance

• 🧹 kandown housekeeping: drop stale AGENT.md / AGENT_KANDOWN.md copies, repair install, refresh agent ref
• 🧹 fcm-agent fixes: direct-scanner.js, ranker.js, scan-orchestrator.js, pi-progress-renderer.js, and extensions/index.js refinements (312+/46-)

Contributors

• @fan92rus — Windows path traversal fix (path.sep). Welcome aboard! 🛡️🎉