Make things 'betterer' across the board (#23)

* Make things 'betterer' across the board

* fix: reorganize struct fields and config parameters for consistency

- [x] Reorder Config struct fields alphabetically and by related functionality
- [x] Reorganize Observation model fields with archival fields grouped together
- [x] Reorder ObservationStore fields to group related members
- [x] Reorder Store struct fields with health check caching grouped
- [x] Reorganize HealthInfo and PoolMetrics struct field order
- [x] Reorder maintenance Service struct fields logically
- [x] Reorganize MCP server handler parameter structs alphabetically
- [x] Reorder pattern detector candidate tracking fields
- [x] Reorganize search Manager struct fields by functionality
- [x] Reorder vector Client struct fields with mutex protections grouped
- [x] Reorganize handler request/response struct fields
- [x] Update handlers_test.go to expect wrapped response format
- [x] Reorder middleware TokenAuth and rate limiter fields
- [x] Reorganize Service struct fields with grouped functionality
- [x] Fix RateLimiter field ordering for clarity
- [x] Reorder CircuitBreaker metrics fields

* fix(security): improve JSON output safety and path traversal protection

- [x] Replace unsafe JSON string formatting with proper json.Marshal in export handler
- [x] Remove escapeJSONString helper function in favor of standard JSON marshaling
- [x] Add safeResolvePath function to validate paths and prevent directory traversal
- [x] Apply path traversal validation in captureFileMtimes operations
- [x] Cap result slice capacity in getRecentSearchQueries to prevent DoS via excessive allocation

* fix(sdk): improve path traversal protection and allocation safety

- [x] Enhance safeResolvePath with stricter validation using filepath.Rel
- [x] Reject paths containing ".." after cleaning to prevent traversal
- [x] Validate absolute paths are within cwd when cwd is specified
- [x] Apply safeResolvePath validation to GetFileContent for consistency
- [x] Add comprehensive test coverage for path traversal protection
- [x] Fix allocation safety in getRecentSearchQueries by using constant capacity

internal/config/config.go

@@ -46,28 +46,32 @@ type Config struct {
 	VectorStorageStrategy     string   `json:"vector_storage_strategy"`
 	ContextObsConcepts        []string `json:"context_obs_concepts"`
 	ContextObsTypes           []string `json:"context_obs_types"`
-	ContextMaxPromptResults   int      `json:"context_max_prompt_results"`
-	RerankingResults          int      `json:"reranking_results"`
+	ContextFullCount          int      `json:"context_full_count"`
+	GraphBranchFactor         int      `json:"graph_branch_factor"`
 	GraphEdgeWeight           float64  `json:"graph_edge_weight"`
 	ContextRelevanceThreshold float64  `json:"context_relevance_threshold"`
 	RerankingCandidates       int      `json:"reranking_candidates"`
 	WorkerPort                int      `json:"worker_port"`
 	RerankingMinImprovement   float64  `json:"reranking_min_improvement"`
 	ContextObservations       int      `json:"context_observations"`
-	ContextFullCount          int      `json:"context_full_count"`
+	ContextMaxPromptResults   int      `json:"context_max_prompt_results"`
 	ContextSessionCount       int      `json:"context_session_count"`
 	MaxConns                  int      `json:"max_conns"`
 	RerankingAlpha            float64  `json:"reranking_alpha"`
 	GraphMaxHops              int      `json:"graph_max_hops"`
-	GraphBranchFactor         int      `json:"graph_branch_factor"`
+	RerankingResults          int      `json:"reranking_results"`
 	GraphRebuildIntervalMin   int      `json:"graph_rebuild_interval_min"`
 	HubThreshold              int      `json:"hub_threshold"`
-	ContextShowLastSummary    bool     `json:"context_show_last_summary"`
-	RerankingEnabled          bool     `json:"reranking_enabled"`
+	ObservationRetentionDays  int      `json:"observation_retention_days"`
+	MaintenanceIntervalHours  int      `json:"maintenance_interval_hours"`
 	ContextShowWorkTokens     bool     `json:"context_show_work_tokens"`
 	ContextShowReadTokens     bool     `json:"context_show_read_tokens"`
 	RerankingPureMode         bool     `json:"reranking_pure_mode"`
 	GraphEnabled              bool     `json:"graph_enabled"`
+	MaintenanceEnabled        bool     `json:"maintenance_enabled"`
+	RerankingEnabled          bool     `json:"reranking_enabled"`
+	ContextShowLastSummary    bool     `json:"context_show_last_summary"`
+	CleanupStaleObservations  bool     `json:"cleanup_stale_observations"`
 }
 
 var (
@@ -93,8 +97,9 @@ func SettingsPath() string {
 }
 
 // EnsureDataDir creates the data directory if it doesn't exist.
+// Uses 0700 permissions (owner-only) for security.
 func EnsureDataDir() error {
-	return os.MkdirAll(DataDir(), 0750)
+	return os.MkdirAll(DataDir(), 0700)
 }
 
 // EnsureSettings creates a default settings file if it doesn't exist.
@@ -161,8 +166,12 @@ func Default() *Config {
 		ContextShowLastSummary:    true,
 		ContextObsTypes:           DefaultObservationTypes,
 		ContextObsConcepts:        DefaultObservationConcepts,
-		ContextRelevanceThreshold: 0.3, // Minimum 30% similarity to include
-		ContextMaxPromptResults:   10,  // Cap at 10 results max (0 = no cap, threshold only)
+		ContextRelevanceThreshold: 0.3,   // Minimum 30% similarity to include
+		ContextMaxPromptResults:   10,    // Cap at 10 results max (0 = no cap, threshold only)
+		MaintenanceEnabled:        true,  // Enable scheduled maintenance
+		MaintenanceIntervalHours:  6,     // Run every 6 hours
+		ObservationRetentionDays:  0,     // 0 = no age-based deletion (keep all)
+		CleanupStaleObservations:  false, // Don't auto-cleanup stale observations
 	}
 }