Dev-environment fix, dependency security cleanup, and doc improvements (PR #23):
- Fixed a dev-server startup race: opening the browser right after
npm run devcould hit the backend before it finished compiling, leaving the session store unhandled-rejected and the app silently half-initialized.initSessionStorenow retries briefly instead of failing hard. - Resolved all
npm auditfindings (3 critical, 13 high, 6 moderate, 2 low → 0), including a major-version bump of@fastify/static(verified SPA fallback, static asset serving, and path-traversal handling still behave correctly). The published Docker image inherits the same fix. - Clarified in
AGENTS.md/backend-data/README.mdthatbackend-data/holds irreplaceable local dev state (not disposable, despite being gitignored). - Added a pre-release vulnerability check (
npm audit+ a Trivy scan of the built Docker image) to the release checklist indocs/RELEASING.md.
Also includes the mcpscope-chat-template announcement link (PR #22).