Graph UI stats panel broken in v0.10.5: /rpc returns 403 for get_graph_schema ('UI RPC method is not allowed')

[ShugokiFable]

Environment

• Windows 11, v0.10.5 (exe install), UI at http://127.0.0.1:9749
• Agents connected via MCP (Claude Code, Codex, Hermes)

Symptom

The Projects tab's summary tiles show Projects: 45, nodes: 0, edges: 0 and each project row shows 0 nodes / 0 edges. The general/stats panel previously showed correct totals and language counts. The MCP channel is fully functional: list_projects returns per-project node/edge counts, and index_status reports ready for every project.

Root cause

The SPA (served from the same binary, assets/index-*.js) fetches the projects list and then calls, per project:

POST /rpc
{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_graph_schema","arguments":{"project":"<name>"}}}

The server responds 403 with:

{"jsonrpc":"2.0","error":{"code":-32601,"message":"UI RPC method is not allowed"},"id":null}

Only list_projects is permitted over the HTTP /rpc route; get_graph_schema and get_code_snippet are both rejected. The SPA swallows the failure (schema: null → contributes 0), so the panel sums to zero without any visible error.

Repro

curl -s -X POST http://127.0.0.1:9749/rpc -H "Content-Type: application/json"   -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_graph_schema","arguments":{"project":"<any indexed project>"}}}'
# -> HTTP 403, "UI RPC method is not allowed"

# same request with "list_projects" -> 200 OK

Notes

• config list exposes only auto_index / auto_index_limit / auto_watch / ui-lang / ui_enabled / ui_port — no allowlist or auth knob.
• If the HTTP-rpc lockdown is intentional loopback hardening (the UI listener replies with Access-Control-Allow-Origin: *), the UI still needs a sanctioned path for its own stats queries — either allow get_graph_schema/read-only graph tools on loopback, or serve the aggregate through a dedicated /api endpoint.
• This regressed between v0.9.0 (panel worked) and v0.10.5.