System Stability Patch: Fix trust proxy, chainable NeDB models, absolute upload paths, and sentinel stack safety

backend/models/Announcement.js

@@ -2,7 +2,8 @@ const { db } = require('../db');
 
 class Announcement {
   static findOne(query) {
-    return {
+    const chain = {
+      _sort: null,
       sort: function(sortQuery) {
         this._sort = sortQuery;
         return this;
@@ -16,8 +17,12 @@ class Announcement {
             else res(docs[0] || null);
           });
         }).then(resolve, reject);
+      },
+      catch: function(reject) {
+        return this.then(null, reject);
       }
     };
+    return chain;
   }
 
   static async create(annData) {
@@ -31,4 +36,4 @@ class Announcement {
   }
 }
 
-module.exports = Announcement;
+module.exports = Announcement;

backend/models/ChatSession.js

@@ -1,13 +1,28 @@
 const { db } = require('../db');
 
 class ChatSession {
-  static async find(query) {
-    return new Promise((resolve, reject) => {
-      db.sessions.find(query).sort({ updatedAt: -1 }).exec((err, docs) => {
-        if (err) reject(err);
-        else resolve(docs);
-      });
-    });
+  static find(query) {
+    const chain = {
+      _sort: null,
+      sort: function(sortQuery) {
+        this._sort = sortQuery;
+        return this;
+      },
+      then: function(resolve, reject) {
+        return new Promise((res, rej) => {
+          let q = db.sessions.find(query);
+          if (this._sort) q = q.sort(this._sort);
+          q.exec((err, docs) => {
+            if (err) rej(err);
+            else res(docs);
+          });
+        }).then(resolve, reject);
+      },
+      catch: function(reject) {
+        return this.then(null, reject);
+      }
+    };
+    return chain;
   }
 
   static async findById(id) {
@@ -40,4 +55,4 @@ class ChatSession {
   }
 }
 
-module.exports = ChatSession;
+module.exports = ChatSession;

backend/models/Message.js

@@ -21,6 +21,9 @@ class Message {
             else res(docs);
           });
         }).then(resolve, reject);
+      },
+      catch: function(reject) {
+        return this.then(null, reject);
       }
     };
     return chain;

backend/routes/ai.js

@@ -9,7 +9,9 @@ const router = express.Router();
 // Setup Multer for file uploads
 const storage = multer.diskStorage({
   destination: function (req, file, cb) {
-    cb(null, 'uploads/')
+    const uploadPath = path.join(__dirname, '../uploads');
+    if (!fs.existsSync(uploadPath)) fs.mkdirSync(uploadPath, { recursive: true });
+    cb(null, uploadPath)
   },
   filename: function (req, file, cb) {
     cb(null, file.fieldname + '-' + Date.now() + path.extname(file.originalname))

backend/server.js

@@ -38,6 +38,9 @@ const users = require('./routes/users');
 
 const app = express();
 
+// Trust first proxy (Hugging Face / Cloudflare)
+app.set('trust proxy', 1);
+
 // --- SENTINEL PRIORITY INTERCEPTOR ---
 app.use((req, res, next) => {
   const originalSend = res.send;

backend/services/sentinelService.js

@@ -61,7 +61,11 @@ exports.performSurgery = async (errorStack, originalUrl) => {
   addLog(`Breach detected in Node: ${originalUrl}`, "error");
   
   // Identify the likely file from the error stack
-  const stackLines = errorStack.split('\n');
+  const stackLines = errorStack ? errorStack.split('\n') : [];
+  if (stackLines.length < 2) {
+    addLog("Stack trace too short to identify faulty module.", "warning");
+    return;
+  }
   const fileMatch = stackLines[1].match(/at (.*):(\d+):(\d+)/) || stackLines[1].match(/\((.*):(\d+):(\d+)\)/);
   
   if (!fileMatch) {