v0.7.2

Summary

Introduces intelligent local model diagnostics and CLI typo suggestions, week-by-default news search recency with empty-feed guidance, comprehensive Security Audit #5 hardening, simplified Llama GUI model recommendations, and dynamic token budgeting up to 128k context.

Changes

• News Recency Defaults & Guidance (srz news): Defaults news search recency to week (past 7 days) across CLI options and natural queries to prevent empty feeds on niche topics, and adds actionable diagnostic tips suggesting -t month or -t all when feeds return no results.
• Local Model Diagnostics & Command Typo Guidance (src/engine/llm.rs, src/config/cli.rs): Replaces raw JSON dumps with clear 'Local model not detected' diagnostics on model mismatch, suggests closest available models from the backend via string similarity, and offers command typo suggestions (e.g. srz doctur -> doctor).
• Security Audit #5 Hardening (Findings 26–31): Enforces input bounds across JSON responses, syndication feeds, and config files; neutralizes dangerous URI schemes in markdown; sanitizes control codes in terminal outputs; and adds symlink guards to database initialization.
• Static Analysis & Session ID Disambiguation (src/commands/ask.rs): Disambiguated chat session IDs to clear CodeQL rust/cleartext-logging false positives.
• Dual Model Naming Strategy (srz recommend, src/config/cli.rs): Retains full verbose model IDs (ggml-org/gemma-4-E4B-it-GGUF:Q8_0) for CLI defaults, configuration templates, and backend API requests while providing concise Llama GUI model cards (gemma-4 with E4B / 26B-A4B badges and Q8_0 quant) in srz recommend and diagnostic tips.
• Dynamic Token Budget Precision (format_untrusted_section): Honors dynamic token budgets (e.g., 28k–56k on 32k–64k servers) up to 128k context rather than clamping to legacy 16,000 token limits.
• Storage & Ingestion Deduplication (src/storage/, src/system/, src/sources/): Centralized URL helpers, unified DuckDB query constants, optimized feed parsing, and consolidated LLM retry paths.