The localfile (and probably localfiles and localdirectory) field don't take into account a module can be initialized from different path. Subsequently the using the module from a different path causes it to fail on "Invalid local file directory"/files/index.php since that is called from different path.
It seems logical to always consider the lock down path to the relative folder of the root and thus _path["root"] should be added in front of the file path. Note however that this can't be do...
It seems the URLs are created and/or rendered incorrectly. This issue tends to occur when multiple environments use the same database where the hostnames differ. Or rather when in one environment the default project is JAS and in the other it isn't.
The file (and image) field should get an additional field for the MD5 hash. The /files/ would then need a "MD5" variable that would download a "text/plain" file with the hash as content. The filename can be generated based on the original filename and a .md5 suffix (filename.ext.md5).
Note that it's probably wise to add a MD5 property to the file/image fields to allow it to be enabled/disabled.
Currently all protocols (socket, http, smtp, etc), formats (csv, xml, etc) and APIs (data, csv, xmli) all reside in the include folder. They should be moved to the relevant subfolders to keep the include folder somewhat clean.