feat(embedding,vision): candle embeddings with offline fallback, on-demand clipboard vision capture, and concurrency audit

server/src/handlers/logs.rs

@@ -25,7 +25,8 @@ impl McpTool for WatchProcessLogsHandler {
     async fn execute(&self, args: Value, _state: Arc<MemoryState>) -> crate::error::Result<String> {
         let tool_args: WatchProcessLogsTool =
             serde_json::from_value(args).map_err(|e| e.to_string())?;
-        if !std::path::Path::new(&tool_args.file_path).exists() {
+        let safe_path = crate::handlers::utils::validate_safe_path(&tool_args.file_path)?;
+        if !safe_path.exists() {
             return Err(crate::error::AppError::Internal(format!(
                 "File does not exist: {}",
                 tool_args.file_path
@@ -53,9 +54,10 @@ impl McpTool for GetRecentLogsHandler {
     async fn execute(&self, args: Value, _state: Arc<MemoryState>) -> crate::error::Result<String> {
         let tool_args: GetRecentLogsTool =
             serde_json::from_value(args).map_err(|e| e.to_string())?;
+        let safe_path = crate::handlers::utils::validate_safe_path(&tool_args.file_path)?;
 
         let result = tokio::task::spawn_blocking(move || -> crate::error::Result<String> {
-            let mut file = File::open(&tool_args.file_path).map_err(|e| {
+            let mut file = File::open(&safe_path).map_err(|e| {
                 crate::error::AppError::Internal(format!("Failed to open file: {}", e))
             })?;
             let len = file.metadata().map_err(|e| e.to_string())?.len();