feat: update webui extensions, models, and agent config

.pi/agent/extensions/webui/backend/http/server.ts

@@ -2,6 +2,7 @@ import { createServer, type IncomingMessage, type ServerResponse } from "node:ht
 import { applyCorsHeaders } from "./cors.ts";
 import { serveStatic } from "./static.ts";
 import { handleChatRoute } from "../routes/chat.ts";
+import { handleExtensionUiRoute } from "../routes/extension-ui.ts";
 import { handleCommandsRoute } from "../routes/commands.ts";
 import { handleModelsRoute } from "../routes/models.ts";
 import { handleSessionsRoute } from "../routes/sessions.ts";
@@ -24,6 +25,7 @@ export function createWebUiServer(ctx: WebUiContext) {
 		}
 
 		if (handleChatRoute(req, res, ctx, pathname)) return;
+		if (handleExtensionUiRoute(req, res, ctx, pathname)) return;
 		if (handleSessionsRoute(req, res, ctx, pathname)) return;
 		if (handleModelsRoute(req, res, ctx, pathname)) return;
 		if (handleWebuiConfigRoute(req, res, ctx, pathname, url)) return;

.pi/agent/extensions/webui/backend/http/static.ts

@@ -1,7 +1,8 @@
 import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
+import { join, resolve } from "node:path";
 import { gzipSync } from "node:zlib";
 import type { ServerResponse, IncomingMessage } from "node:http";
+import { isPathInsideRoot } from "../utils/paths.ts";
 
 const MIME: Record<string, string> = {
 	".html": "text/html; charset=utf-8",
@@ -40,7 +41,9 @@ export function serveStatic(
 ): void {
 	const file = urlPath === "/" ? "/index.html" : urlPath;
 	const full = join(publicDir, file);
-	if (!full.startsWith(publicDir)) {
+	const resolvedPublic = resolve(publicDir);
+	const resolvedFull = resolve(full);
+	if (!isPathInsideRoot(resolvedPublic, resolvedFull) && resolvedFull !== resolvedPublic) {
 		res.writeHead(403);
 		res.end("Forbidden");
 		return;