Code browsing UI, security hardening, prompt builder fix (v1.5.0)

Replace graph visualization with dedicated Code browsing section:
file list → symbol detail → edges/relations. Security fixes:
upload filename validation, relation schema limits, edges endpoint
encapsulation. Prompt builder: allow toggling empty graphs.

Author: prih

docs/README.md

@@ -65,7 +65,7 @@
 ## UI
 
 - [UI Architecture](ui-architecture.md) — React + MUI + FSD stack, routing, auth flow
-- [UI Features](ui-features.md) — all pages: dashboard, kanban, graph viz, prompt generator, etc.
+- [UI Features](ui-features.md) — all pages: dashboard, kanban, code browser, prompt generator, etc.
 - [UI Patterns](ui-patterns.md) — FSD conventions, page patterns, hooks, state management, WebSocket, ACL
 
 ## Development

docs/api-rest.md

@@ -100,12 +100,11 @@ See [Authentication](authentication.md) for details on auth middleware.
 | GET | `/api/projects/:id/skills/:skillId/attachments/:filename` | Download attachment |
 | DELETE | `/api/projects/:id/skills/:skillId/attachments/:filename` | Delete attachment |
 
-## Search endpoints (docs/code/files)
+## Search endpoints (docs/files)
 
 | Method | Path | Description |
 |--------|------|-------------|
 | GET | `/api/projects/:id/docs/search?q=...` | Search docs |
-| GET | `/api/projects/:id/code/search?q=...` | Search code symbols |
 | GET | `/api/projects/:id/files` | List files (query: `directory`, `extension`, `language`, `filter`, `limit`) |
 | GET | `/api/projects/:id/files/search?q=...` | Search files by path |
 
@@ -115,11 +114,15 @@ See [Authentication](authentication.md) for details on auth middleware.
 |--------|------|-------------|
 | GET | `/api/projects/:id/team` | List team members |
 
-## Graph export
+## Code endpoints
 
 | Method | Path | Description |
 |--------|------|-------------|
-| GET | `/api/projects/:id/graph?scope=...` | Export graph for visualization (scope: `knowledge`, `tasks`, `docs`, `code`, `files`, `skills`, `all`) |
+| GET | `/api/projects/:id/code/files` | List indexed code files |
+| GET | `/api/projects/:id/code/files/:fileId/symbols` | List symbols for a file |
+| GET | `/api/projects/:id/code/symbols/:symbolId` | Get symbol detail |
+| GET | `/api/projects/:id/code/symbols/:symbolId/edges` | Get edges for a symbol (imports, contains, extends, implements) |
+| GET | `/api/projects/:id/code/search?q=...` | Search code symbols |
 
 ## Tools explorer
 

docs/architecture.md

@@ -158,7 +158,6 @@ src/
       docs.ts                # Docs search routes
       code.ts                # Code search routes
       files.ts               # Files REST routes
-      graph.ts               # Graph export endpoint
       tools.ts               # Tools explorer REST routes
       websocket.ts           # WebSocket server
       embed.ts               # POST /api/embed endpoint
@@ -276,7 +275,6 @@ Read-only tools (list, get, search) run without queueing — Graphology's in-mem
 | `react` + `react-dom` | UI framework (v19) |
 | `react-router-dom` | Client-side routing (v7) |
 | `@mui/material` + `@mui/icons-material` | Component library (v7) |
-| `cytoscape` | Graph visualization |
 | `react-markdown` + `remark-gfm` | Markdown rendering |
 | `@uiw/react-md-editor` | Markdown editor |
 | `vite` | Build tool + dev server (v8) |

docs/overview.md

@@ -23,7 +23,7 @@
 | **Multi-project** | One process manages multiple projects with independent graphs |
 | **Workspaces** | Share knowledge/tasks/skills across related projects (e.g. microservices) |
 | **REST API** | Express-based HTTP API for all CRUD operations |
-| **Web UI** | React 19 + MUI 7 dashboard with kanban board, graph visualization, search |
+| **Web UI** | React 19 + MUI 7 dashboard with kanban board, code browsing, search |
 | **Real-time updates** | WebSocket push events on every mutation |
 | **Authentication** | Password-based login with JWT cookies, API keys for programmatic access |
 | **Access control** | 4-level ACL: graph > project > workspace > server > default |

docs/ui-architecture.md

@@ -9,7 +9,6 @@
 | React | 19 | UI framework |
 | Material UI (MUI) | 7 | Component library |
 | React Router DOM | 7 | Client-side routing |
-| Cytoscape.js | 3.33 | Graph visualization |
 | Vite | 8 | Build tool + dev server |
 | react-markdown + remark-gfm | — | Markdown rendering |
 | @uiw/react-md-editor | — | Markdown editor |
@@ -29,10 +28,10 @@ ui/src/
 │   ├── tasks/                    # Kanban board + drag-drop + detail/edit/new
 │   ├── skills/                   # Skill management + triggers + usage
 │   ├── docs/                     # Browse documentation + detail view
+│   ├── code/                     # Code browser + symbol detail
 │   ├── files/                    # File browser + search + detail
 │   ├── prompts/                  # AI prompt generator
 │   ├── search/                   # Cross-graph unified search
-│   ├── graph/                    # Cytoscape.js visualization
 │   ├── tools/                    # MCP tools explorer
 │   ├── help/                     # Searchable documentation
 │   └── login/                    # Email + password login
@@ -50,7 +49,6 @@ ui/src/
 │   ├── file/                     # FileInfo type, API
 │   ├── doc/                      # searchDocs API
 │   ├── code/                     # searchCode API
-│   └── graph/                    # GraphNode, GraphEdge, exportGraph API
 ├── content/
 │   ├── help/                     # Help articles (markdown, bundled via ?raw)
 │   └── prompts/                  # Prompt templates (roles, styles, scenarios, graphs)
@@ -90,10 +88,11 @@ All routes are scoped to a project: `/:projectId/...`
 | `/:projectId/skills` | SkillsPage |
 | `/:projectId/skills/:skillId` | Skill detail |
 | `/:projectId/docs` | DocsPage |
+| `/:projectId/code` | CodePage |
+| `/:projectId/code/:symbolId` | CodeDetailPage |
 | `/:projectId/files` | FilesPage |
 | `/:projectId/prompts` | PromptsPage |
 | `/:projectId/search` | SearchPage |
-| `/:projectId/graph` | GraphPage |
 | `/:projectId/tools` | ToolsPage |
 | `/:projectId/help` | HelpPage |
 

docs/ui-features.md

@@ -9,10 +9,10 @@
 | **Tasks** | Kanban board with drag-drop |
 | **Skills** | Recipe/procedure management |
 | **Docs** | Browse indexed documentation |
+| **Code** | Code browser with symbol navigation |
 | **Files** | File browser with search |
 | **Prompts** | AI prompt generator |
 | **Search** | Cross-graph unified search |
-| **Graph** | Interactive graph visualization |
 | **Tools** | MCP tools explorer |
 | **Help** | Built-in documentation |
 | **Login** | Email + password authentication |
@@ -58,10 +58,17 @@ Stats cards showing counts for each graph (notes, tasks, skills, docs, code, fil
 ## Docs
 
 - **File list** — browse all indexed markdown files
-- **Table of contents** — heading hierarchy for each file
+- **Table of contents** — heading hierarchy for each file with content snippets
 - **Detail view** — rendered markdown content with syntax highlighting
 - **Search** — semantic search across documentation
 
+## Code
+
+- **File list** — browse indexed code files with symbol counts per file
+- **Expandable symbols** — each file expands to show symbols with kind chips (function, class, interface, etc.) and signature snippets
+- **Semantic search** — hybrid search across code symbols
+- **Detail page** — view source code, relations, and edges (imports, contains, extends, implements)
+
 ## Files
 
 - **Directory navigation** — breadcrumb path, click to navigate
@@ -89,16 +96,6 @@ Unified semantic search across all 6 graphs:
 - Score-based ranking within each group
 - Click results to navigate to detail views
 
-## Graph
-
-Interactive force-directed graph visualization using Cytoscape.js:
-
-- **Scope filter** — view knowledge, tasks, skills, docs, code, files, or all
-- **Force-directed layout** — nodes automatically position based on connections
-- **Node inspector** — click a node to see its details
-- **Zoom/pan** — mouse wheel zoom, drag to pan
-- **Color coding** — different colors per graph type
-
 ## Tools
 
 MCP tools explorer for testing and debugging:
@@ -145,7 +142,6 @@ All data pages react to WebSocket events:
 - **Tasks** — kanban board updates on create/update/delete/move
 - **Skills** — skill list updates on create/update/delete
 - **Dashboard** — stats and recent activity refresh
-- **Graph** — visualization updates when indexer processes files
 
 ## Responsive design
 

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@graphmemory/server",
-  "version": "1.4.1",
+  "version": "1.5.0",
   "description": "MCP server for semantic graph memory from markdown files",
   "main": "dist/cli/index.js",
   "bin": {

package.json

@@ -31,7 +31,7 @@ Graph Memory is an [MCP (Model Context Protocol)](https://modelcontextprotocol.i
 | **Hybrid search** | BM25 keyword + vector cosine similarity with graph expansion |
 | **Real-time** | File watching + WebSocket push to UI |
 | **Multi-project** | One process manages multiple projects from a single config |
-| **Web UI** | Dashboard, kanban board, graph visualization, search, prompt builder |
+| **Web UI** | Dashboard, kanban board, code browser, search, prompt builder |
 
 ## How it works
 

site/docs/getting-started/index.md

@@ -85,4 +85,4 @@ Graph Memory creates six interconnected graphs from your project:
 
 - [Configuration](./configuration) — customize with `graph-memory.yaml`
 - [MCP Tools](/docs/mcp-tools) — explore all 58 tools
-- [Web UI](/docs/web-ui) — dashboard, kanban, graph visualization
+- [Web UI](/docs/web-ui) — dashboard, kanban, code browser, search