Merge origin/main into feature/assign-archetypes-to-tasks-ui

Resolved conflicts:
- .gitignore: kept both bd.sock.startlock and .beadboard/ entries
- package.json: kept feature branch test script (explicit enumeration)
- API routes: kept dynamic export + isValidProjectRoot from main
- globals.css: kept HEAD slideInFromRight animation
- use-beads-subscription.ts: kept HEAD onopen handler
- realtime.ts: kept main console.log in emit()
- snapshot-differ.ts: kept main type-aware dependency diff

Blue colors preserved from feature branch.

src/app/api/activity/route.ts

@@ -1,11 +1,40 @@
+import { NextResponse } from 'next/server';
+import path from 'node:path';
 import { activityEventBus } from '../../../lib/realtime';
 
 export const dynamic = 'force-dynamic';
 
+function isValidProjectRoot(root: string): boolean {
+  try {
+    const resolved = path.resolve(root);
+    if (!path.isAbsolute(resolved)) {
+      return false;
+    }
+    // Prevent path traversal by ensuring resolved path stays within the project root
+    const allowedBase = process.cwd();
+    const relative = path.relative(allowedBase, resolved);
+    // If "resolved" is outside "allowedBase", "relative" will start with ".."
+    if (relative.startsWith('..') || path.isAbsolute(relative)) {
+      return false;
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 export async function GET(request: Request): Promise<Response> {
   const url = new URL(request.url);
-  const projectRoot = url.searchParams.get('projectRoot') || undefined;
+  const projectRootParam = url.searchParams.get('projectRoot');
+  
+  if (projectRootParam && !isValidProjectRoot(projectRootParam)) {
+    return NextResponse.json(
+      { error: 'Invalid projectRoot path' },
+      { status: 400 }
+    );
+  }
 
+  const projectRoot = projectRootParam || undefined;
   const history = activityEventBus.getHistory(projectRoot);
 
   return Response.json(history);