1

package.json

@@ -14,6 +14,7 @@
     "html-to-text": "^9.0.5",
     "ws": "^8.16.0",
     "openai": "^6.29.0",
-    "node-fetch": "^3.3.2"
+    "node-fetch": "^3.3.2",
+    "express-rate-limit": "8.3.2"
   }
 }

server/index.js

@@ -125,27 +125,33 @@ function getMimeType(filePath){
   }
 }
 
-// --- Hybrid serving ---
+// Hybrid serving: everything via latest SHA (auto-refresh / manual refresh)
 app.get('*', async (req,res)=>{
   if(req.path.startsWith('/api/')) return res.status(404).send('Not found');
 
-  const dynamicPages = ['/index.html','/oauth-callback.html','/'];
-  const filePath = dynamicPages.includes(req.path)?(req.path==='/'?'/index.html':req.path):req.path;
-  const url = dynamicPages.includes(req.path)?`${CDN_BASE}@${latestSHA}${filePath}`:`${CDN_BASE}@main${filePath}`;
+  // All client files are fetched from latest SHA
+  const filePath = req.path === '/' ? '/index.html' : req.path;
+  const url = `${CDN_BASE}@${latestSHA}${filePath}`;
 
   try{
     const response = await fetch(url);
     if(!response.ok) return res.status(404).send('File not found');
+
     const mimeType = getMimeType(filePath);
-    res.setHeader('Content-Type',mimeType);
+    res.setHeader('Content-Type', mimeType);
 
-    if(mimeType.startsWith('text') || mimeType==='application/javascript'|| mimeType==='application/json'){
+    // Stream text files; redirect others (images/fonts) optional
+    if(mimeType.startsWith('text') || mimeType==='application/javascript' || mimeType==='application/json'){
       const text = await response.text();
       res.send(text);
-    }else{
-      res.redirect(url);
+    } else {
+      const buffer = await response.arrayBuffer();
+      res.send(Buffer.from(buffer));
     }
-  }catch(e){ console.error('Error fetching from CDN:',e); res.status(500).send('Server error');}
+  }catch(e){
+    console.error('Error fetching from CDN:',e);
+    res.status(500).send('Server error');
+  }
 });
 
 // --- WebSocket ---