Address code review feedback on the server-mode PR:
Critical fixes:
- Restore CORS whitelist (localhost + gitnexus.vercel.app only)
- Bind to 127.0.0.1 by default; add --host CLI flag for opt-in remote access
- Restore path traversal guard on /api/file (resolve + startsWith check)
- Restore try/catch on all route handlers + global error middleware
- Restore SIGINT/SIGTERM graceful shutdown handlers
Bug fixes:
- Add mutex to core initKuzu to prevent race conditions on concurrent
DB switches (two requests for different repos no longer corrupt state)
- Track ftsLoaded flag and reset on DB switch / close so FTS extension
is reloaded for each new database connection
- Restore input validation on /api/query (cypher required) and
/api/search (query required)
Improvements:
- Add TTL-based cleanup for orphaned MCP sessions (30min idle eviction)
to prevent memory leaks from network drops that skip onclose
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
