Local folder jobs are now refused with 403 unless the server runs with
SHOW_LOCAL=true, and job kinds other than local or github are rejected.
/api/health reports localFolders so the frontend can hide the option.
Tests enable it explicitly where they index local folders.
Deep blue-black theme with a violet-to-cyan accent, frosted floating
panels, self-hosted Inter, a welcome screen with a call to action, a
card-style inspector, accent tabs and toggles, animated progress, and
a restyled open dialog. In 3D the WebGL walls are now lit per side
with a darker foot so buildings read as solids, and the canvas clears
to transparent over the new background. Renamed to CodeNavigator.
The stream used to close after three minutes, which a job queued behind
other users could exceed. It now runs until the job completes or the
client disconnects, sending a keep-alive comment every 15 seconds so
nginx does not time out an idle stream.
A background sweep every minute drops snapshots unused for an hour,
finished jobs, and uploads never committed, deleting their workspaces.
At most 8 snapshots are held; the least recently used is evicted.
Indexing used to discard every existing snapshot, so concurrent users
wiped out each other's landscapes. Only the same session's previous
snapshot and workspace are replaced now.
An HttpOnly, SameSite=Lax session cookie is issued when a job is
created. Job and snapshot routes return 404 to any other session, so
indexed source is only readable by the browser that loaded it.
Implements the API routes (jobs, progress events, snapshots, search,
entities, source delivery with release) to net/http and serves the
static frontend from the same binary on the same origin.
Andy Dixon