fix(ui): allow graph schema through UI RPC

[astandrik]

What does this PR do?

The Graph UI already calls get_graph_schema while loading projects, but the loopback UI RPC allowlist rejected that call with HTTP 403.

This adds only get_graph_schema to the existing list_projects / get_code_snippet allowlist. The regression test now covers all three allowed tools and keeps search_graph, delete_project, manage_adr, ingest_traces, and index_repository blocked. The existing initialize and duplicate params.name checks remain unchanged.

Fixes #1663

Verification

• Reproduce-first HTTPD run: applying the test change alone fails the target allowlist case with HTTP 403.
• scripts/test.sh --suites httpd
• scripts/test.sh
• scripts/lint.sh --ci
• scripts/build.sh --with-ui BUILD_DIR=build/issue1663-ui CC=gcc CXX=g++
• SMOKE_REQUIRE_UI=1 scripts/smoke-local.sh build/issue1663-ui/codebase-memory-mcp ui
• make -j32 -f Makefile.cbm security BUILD_DIR=build/issue1663-security

The full Linux gate passed on the remote builder against the exact commit tree. Windows runtime behavior remains for CI to confirm.

Checklist

• Every commit is signed off (git commit -s) — required, CI rejects unsigned commits (DCO, see CONTRIBUTING.md)
• Tests pass (scripts/test.sh)
• Lint passes (scripts/lint.sh --ci)
• New behavior is covered by a reproduce-first regression test

[github-actions]

Thanks for opening this — it has been seen, and it is queued.

This note is automated, but it is not a brush-off: it exists so you know where your PR stands instead of having to guess from silence.

Current review status: working through a backlog. 0.9.1-rc.1 is out, so the release freeze that held reviews is over — but it left a large queue of open pull requests behind it, and we are reading through them oldest-first. The background is in discussion #1144.

What that means for this PR, concretely:

• It will not be closed for inactivity. No stale bot touches pull requests here.
• It may still sit a while before a human reads it. That is on us, not on you.
• Older PRs are read first, so a recent one is not being skipped — it is behind a queue.

Things that will genuinely speed it up whenever review does happen:

• Keep it rebased on main — the tree is moving quickly right now, and a conflicting branch cannot be reviewed as the diff you intended.
• Get CI green, or say which failures you believe are pre-existing.
• Keep the change to one claim. Bundled features and refactors get split before they get merged, which costs you a round trip.
• Every commit needs a sign-off (git commit -s) — CI enforces DCO.

If this fixes a bug, a reproduction we can run is worth more than a description of the symptom.

Thanks for contributing, and sorry in advance for the wait.

[Copilot]

🟢 Approval recommended

The change is narrowly scoped to an explicit allowlist addition with corresponding regression coverage for both allowed and blocked RPC methods.

Pull request overview

This PR fixes the Graph UI’s failure to fetch per-project graph schema over the loopback JSON-RPC endpoint by expanding the UI RPC allowlist to include get_graph_schema, and updates the HTTPD regression test to validate the expanded allowlist while keeping mutation/search tools blocked.

Changes:

• Allow get_graph_schema through the UI /rpc allowlist alongside list_projects and get_code_snippet.
• Expand the existing HTTPD regression test to assert all allowed tools return HTTP 200 and selected blocked tools still return HTTP 403.
• Add search_graph to the blocked-tool coverage to ensure graph query capabilities remain disallowed via the UI RPC route.

File summaries

File	Description
tests/test_httpd.c	Expands the UI RPC allowlist/denylist regression test to cover get_graph_schema and additional blocked tools.
src/ui/http_server.c	Adds get_graph_schema to the UI RPC allowlist check in rpc_is_allowed_for_ui.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.