v0.1.10 — Security Hardening + Flow Builder

Security Hardening (4-round Opus review)

• SQL injection prevention — Centralized VARCHAR[] escaping, ILIKE ESCAPE clause, INTERVAL bind parameters
• Input validation — Zod schemas on all endpoints, clampInt(), parseId(), agent name regex
• XSS prevention — HTML entity escaping on sidebar innerHTML
• Optional API auth — Bearer token on all routes
• Project data isolation — project_id required on all list endpoints

Features

• Flow Builder — DB + 5 CRUD APIs + Mermaid live preview Web UI + VSCode Extension integration
• Skills & Curation pages — Web UI for skill browsing and mark curation
• Infinite scroll on Marks page
• Swarm improvements — Auto-kick agents, agent polling, tmux socket handling

Reliability

• runMigration() with _migrations table + idempotent parameter
• Transaction wrapping on deleteTask, deleteAgent, deleteProject
• Embedding concurrency dedup (embeddingInFlight Set)
• Explicit backfill timer lifecycle (startBackfill/stopBackfill)
• WAL auto-recovery, zombie agent reaper
• Token refresh cache clearing in VSCode Extension

Tests

• 189 tests across 16 files (all passing)
• New searchObservations ILIKE wildcard escaping tests

Full Changelog: v0.1.6...v0.1.10