Question 1

How to fix audio or video errors in Leon AI when using Google Cloud TTS/STT?

Accepted Answer

Incorrect provider names in the `.env` file cause audio/video failures. Set them explicitly:

```bash
LEON_TTS_PROVIDER=google-cloud-tts
LEON_STT_PROVIDER=google-cloud-stt
```

Also confirm `GOOGLE_APPLICATION_CREDENTIALS` points to your service account key file.

Question 2

How to fix npm 'ENOENT package.json', 'missing script: postinstall', and 'No module named tinydb' when installing Leon on Windows?

Accepted Answer

These errors mean you are running npm in a folder that does not contain Leon's real `package.json`, or you skipped the dependency installation. Running `npm init` only creates an empty package and does not add Leon's `postinstall` script.

1. Re-download/clone the latest Leon version and open its root folder:
```sh
cd A:\Lexa\Lexa-Test
git clone https://github.com/leon-ai/leon.git leon-latest
cd leon-latest
```
2. Confirm that Leon's `package.json` exists:
```sh
dir package.json
```
3. Install dependencies from the project root. This also runs Leon's `postinstall` and installs the Python dependencies needed by Pipenv:
```sh
npm install
```
4. Run the check again:
```sh
npm run check
```

Do not use the blank `package.json` created by `npm init`; delete it or re-clone if it replaced Leon's file. If `tinydb` is still missing, install the Python dependencies directly:
```sh
cd bridges\python
pipenv sync
cd ..\..
npm run check
```
Use `pipenv install` instead of `pipenv sync` if no `Pipfile.lock` exists.

Question 3

How to fix 'TypeError: Invalid Version: 3.7.6rc1' when installing Leon AI on Windows 10?

Accepted Answer

This error occurs because the semver npm package cannot parse Python's release candidate version string (e.g., `3.7.6rc1`). To resolve:

1. Install a stable Python release (e.g., 3.7.6 or 3.8.1) and ensure it's used by pipenv.
2. Alternatively, switch to the `develop` branch where the issue may be fixed:
```bash
git checkout develop
npm install
npm run check
```
3. For a quick start without local setup, use Gitpod:
[https://gitpod.io/#https://github.com/leon-ai/leon](https://gitpod.io/#https://github.com/leon-ai/leon)

Question 4

How to fix the path traversal vulnerability in Leon's /download model command (arbitrary file write)?

Accepted Answer

The flaw is in `getModelFileNameFromURL()` in `server/src/built-in-command/commands/download-command/download-command.ts`: it runs `decodeURIComponent(path.basename(parsedURL.pathname))`, so `basename` sees only the percent-encoded string and misses encoded separators like `%2f` and `..`. Patch it by decoding before extracting the basename and stripping directory references, e.g. `const fileName = path.basename(decodeURIComponent(parsedURL.pathname))`, and ideally also validate the result against a whitelist (e.g. `/^[a-zA-Z0-9._-]+$/`) and verify with `path.resolve` that the final destination stays inside the models directory. Until you upgrade to a fixed release: (1) never expose the Leon server to untrusted users/networks since the `/download model <url>` command is the attack surface, (2) only pass trusted model URLs to the command, (3) run Leon under a low-privilege user or in a container with a read-only/restricted filesystem so arbitrary file writes and automatic parent-directory creation (`mkdir recursive`) are limited.

Leon

Core Features

What It Can't Do

Use Cases

Tags

Getting Started

Similar Projects