[Bug] Sub-Store page routes return NotFoundError when the data directory is under .config

Environment

• Operating system: Linux (NixOS 26.05)
• Clash Party version: 2.0.2, upstream revision ec8bfc542aa1f196e1da9bce0c308089911108e9
• Relevant dependencies: Express 5.2.1, send 1.2.1, serve-static 2.2.1

Description

The bundled Sub-Store frontend returns HTTP 404 with NotFoundError: Not Found when opening or reloading routes such as /subs and /collections. The frontend files exist, and / and /index.html both return HTTP 200.

The failure occurs when the frontend directory is beneath a hidden directory, for example ~/.config/mihomo-party/work/sub-store-frontend.

Steps to reproduce

1. Run Clash Party on Linux with its data directory under ~/.config/.
2. Enable the bundled Sub-Store frontend and allow its assets to download.
3. Open http://127.0.0.1:14122/ and confirm that it loads. If another frontend port was selected, substitute that port below.
4. Open or reload http://127.0.0.1:14122/subs or /collections directly.

Expected: the frontend server serves index.html, allowing the client-side router to handle the route.

Actual: HTTP 404 with NotFoundError: Not Found from Express's sendFile path. Direct access to /index.html still works.

Cause and suggested fix

The fallback in startSubStoreFrontendServer() passes an absolute path to res.sendFile():

res.sendFile(path.join(frontendDir, 'index.html'))

With the default dotfiles: 'ignore' behavior, the send dependency rejects the .config component of that absolute path. This happens before the file is served, even though index.html itself is not hidden.

Passing the filename relative to an explicit serving root fixes the problem:

- res.sendFile(path.join(frontendDir, 'index.html'))
+ res.sendFile('index.html', { root: frontendDir })

This keeps the default dotfile policy while excluding the serving root's parent directories from the requested relative path. See the Express sendFile documentation.

Verification

The original v2.0.2 frontend server function was reproduced in isolation with its packaged Express dependencies and an index.html fixture beneath a .config directory. The corrected function was checked using the same fixture:

After rebuilding the application with this change, the running bundled frontend also returned HTTP 200 for /subs, /collections, and /my.

As of September 13, 2026, the same fallback remains in smart_core at 5e07e31, line 106, with the same relevant dependency versions. This development revision was inspected at source level; the runtime reproduction above used v2.0.2.