test: remove node-static dependency

This library appears to be unmaintained and has transitive dependencies
that have security advisories, which in turn trigger security advisories
in https://github.com/clangd/node-clangd/security/dependabot. Thus
replace it with a tiny HTTP handler and remove the bad dependencies.

Author: tamird

package-lock.json

@@ -36,13 +36,11 @@
   "devDependencies": {
     "@types/node": "^24.1.0",
     "@types/node-fetch": "^2.6.11",
-    "@types/node-static": "^0.7.11",
     "@types/semver": "^7.5.8",
     "@types/tape": "^5.6.4",
     "@types/tmp": "^0.2.6",
     "@types/unzipper": "^0.10.11",
     "@types/which": "^3.0.4",
-    "node-static": "^0.7.11",
     "prettier": "^3.3.3",
     "tap-spec": "^5.0.0",
     "tape": "^5.8.1",

package.json

@@ -1,6 +1,5 @@
 import * as fs from 'fs';
 import * as http from 'http';
-import * as nodeStatic from 'node-static';
 import * as os from 'os';
 import * as path from 'path';
 import tape from 'tape';
@@ -96,12 +95,43 @@ function test(
     tmp.withDir(
       async (dir) => {
         const ui = new FakeUI(dir.path);
-        const files = new nodeStatic.Server('test/assets/');
         return new Promise((resolve, _reject) => {
           const server = http
-            .createServer((req, res) => {
+            .createServer(async (req, res) => {
               console.log('Fake github:', req.method, req.url);
-              req.on('end', () => files.serve(req, res)).resume();
+              if (!req.url) {
+                res.statusCode = 400;
+                res.end();
+                return;
+              }
+
+              req.resume();
+
+              const {pathname} = new URL(req.url, 'http://localhost');
+              const filePath = path.resolve(assetsRoot, '.' + pathname);
+              if (!filePath.startsWith(assetsRoot + path.sep)) {
+                res.statusCode = 400;
+                res.end();
+                return;
+              }
+
+              try {
+                const handle = await fs.promises.open(filePath, 'r');
+                const stat = await handle.stat();
+                res.setHeader('Content-Length', stat.size);
+                const stream = fs.createReadStream(filePath, {
+                  fd: handle,
+                  autoClose: true,
+                });
+                stream.on('error', (err: Error) => {
+                  res.statusCode = 500;
+                  res.end(String(err));
+                });
+                stream.pipe(res);
+              } catch (err) {
+                res.statusCode = 500;
+                res.end(String(err));
+              }
             })
             .listen(9999, '::', async () => {
               console.log('Fake github serving...');