feat: enhance symlink detection and cache invalidation

- Add `_entry_is_symlink` method to detect symlinks and Windows junctions
- Include first-level symlinks in fingerprint for better cache invalidation
- Re-enable preview path validation for security
- Update tests to verify retargeted symlinks trigger rescan

py/config.py

@@ -223,6 +223,20 @@ class Config:
             logger.error(f"Error checking link status for {path}: {e}")
             return False
 
+    def _entry_is_symlink(self, entry: os.DirEntry) -> bool:
+        """Check if a directory entry is a symlink, including Windows junctions."""
+        if entry.is_symlink():
+            return True
+        if platform.system() == 'Windows':
+            try:
+                import ctypes
+                FILE_ATTRIBUTE_REPARSE_POINT = 0x400
+                attrs = ctypes.windll.kernel32.GetFileAttributesW(entry.path)
+                return attrs != -1 and (attrs & FILE_ATTRIBUTE_REPARSE_POINT)
+            except Exception:
+                pass
+        return False
+
     def _normalize_path(self, path: str) -> str:
         return os.path.normpath(path).replace(os.sep, '/')
 
@@ -241,8 +255,32 @@ class Config:
     def _build_symlink_fingerprint(self) -> Dict[str, object]:
         roots = [self._normalize_path(path) for path in self._symlink_roots() if path]
         unique_roots = sorted(set(roots))
-        # Fingerprint now only contains the root paths to avoid sensitivity to folder content changes.
-        return {"roots": unique_roots}
+
+        # Include first-level symlinks in fingerprint for change detection.
+        # This ensures new symlinks under roots trigger a cache invalidation.
+        # Use lists (not tuples) for JSON serialization compatibility.
+        direct_symlinks: List[List[str]] = []
+        for root in unique_roots:
+            try:
+                if os.path.isdir(root):
+                    with os.scandir(root) as it:
+                        for entry in it:
+                            if self._entry_is_symlink(entry):
+                                try:
+                                    target = os.path.realpath(entry.path)
+                                    direct_symlinks.append([
+                                        self._normalize_path(entry.path),
+                                        self._normalize_path(target)
+                                    ])
+                                except OSError:
+                                    pass
+            except (OSError, PermissionError):
+                pass
+
+        return {
+            "roots": unique_roots,
+            "direct_symlinks": sorted(direct_symlinks)
+        }
 
     def _initialize_symlink_mappings(self) -> None:
         start = time.perf_counter()
@@ -362,10 +400,9 @@ class Config:
                 with os.scandir(current_display) as it:
                     for entry in it:
                         try:
-                            # 1. High speed detection using dirent data (is_symlink)
-                            is_link = entry.is_symlink()
-                            
-                            # On Windows, is_symlink handles reparse points
+                            # 1. Detect symlinks including Windows junctions
+                            is_link = self._entry_is_symlink(entry)
+
                             if is_link:
                                 # Only resolve realpath when we actually find a link
                                 target_path = os.path.realpath(entry.path)

py/routes/handlers/preview_handlers.py

@@ -41,10 +41,8 @@ class PreviewHandler:
             raise web.HTTPBadRequest(text="Unable to resolve preview path") from exc
 
         resolved_str = str(resolved)
-        # TODO: Temporarily disabled path validation due to issues #772 and #774
-        # Re-enable after fixing preview root path handling
-        # if not self._config.is_preview_path_allowed(resolved_str):
-        #     raise web.HTTPForbidden(text="Preview path is not within an allowed directory")
+        if not self._config.is_preview_path_allowed(resolved_str):
+            raise web.HTTPForbidden(text="Preview path is not within an allowed directory")
 
         if not resolved.is_file():
             logger.debug("Preview file not found at %s", resolved_str)