- [x] Add handleGraphStats endpoint for knowledge graph visualization
- [x] Add handleVectorMetrics endpoint for vector database dashboard
- [x] Improve update check error handling with JSON response
- [x] Register new API routes for graph and vector metrics
- [x] Migrate Font Awesome to npm package from CDN
- [x] Fix observations API response type handling
- [x] Update package version to v0.10.5-15-g385d05a
- [x] Enhance safeResolvePath with stricter validation using filepath.Rel
- [x] Reject paths containing ".." after cleaning to prevent traversal
- [x] Validate absolute paths are within cwd when cwd is specified
- [x] Apply safeResolvePath validation to GetFileContent for consistency
- [x] Add comprehensive test coverage for path traversal protection
- [x] Fix allocation safety in getRecentSearchQueries by using constant capacity
- [x] Replace unsafe JSON string formatting with proper json.Marshal in export handler
- [x] Remove escapeJSONString helper function in favor of standard JSON marshaling
- [x] Add safeResolvePath function to validate paths and prevent directory traversal
- [x] Apply path traversal validation in captureFileMtimes operations
- [x] Cap result slice capacity in getRecentSearchQueries to prevent DoS via excessive allocation
Resolved conflicts in:
- internal/config/config.go: Combined new bool fields with maintenance settings
- internal/db/gorm/models.go: Merged field reordering with archival fields
- internal/mcp/server.go: Merged field reordering with maintenanceService
- internal/search/manager.go: Updated Metadata field to use 'any' type
- internal/worker/handlers.go: Kept HEAD version
- internal/worker/sdk/processor.go: Combined circuit breaker/dedup with claude path
- internal/worker/service.go: Kept HEAD version
- ui/src/components/Sidebar.vue: Combined new components with useGraphMetrics
- ui/src/utils/api.ts: Combined new APIs with graph/vector metrics