feat: update webui extensions, models, and agent config

.pi/agent/extensions/webui/backend/http/static.ts

@@ -1,7 +1,8 @@
 import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
+import { join, resolve } from "node:path";
 import { gzipSync } from "node:zlib";
 import type { ServerResponse, IncomingMessage } from "node:http";
+import { isPathInsideRoot } from "../utils/paths.ts";
 
 const MIME: Record<string, string> = {
 	".html": "text/html; charset=utf-8",
@@ -40,7 +41,9 @@ export function serveStatic(
 ): void {
 	const file = urlPath === "/" ? "/index.html" : urlPath;
 	const full = join(publicDir, file);
-	if (!full.startsWith(publicDir)) {
+	const resolvedPublic = resolve(publicDir);
+	const resolvedFull = resolve(full);
+	if (!isPathInsideRoot(resolvedPublic, resolvedFull) && resolvedFull !== resolvedPublic) {
 		res.writeHead(403);
 		res.end("Forbidden");
 		return;