test: HTTP/CLI route matrix and structured API error codes

- Add ErrorCode enum and error_response() helper; migrate api/search,
  api/sessions, and api/export_api error paths to include stable "code"
- Validate search limit query param (400 SEARCH_INVALID_LIMIT; cap at 500)
- Add tests/conftest.py, fixtures, test_api_routes, test_cli_e2e,
  test_error_codes, test_search; extend test_export_api_bulk for codes
- Document error code catalog in README

Author: clean6378-max-it

README.md

@@ -19,7 +19,22 @@ Browse and export Claude Code chat history — Web GUI and CLI.
 - **Smooth transitions** — staggered card/message animations, crossfade content swaps
 - **Scroll-to-top button** in bottom-right corner
 - **Per-model badges** in session header
-- **Bulk export** — download all sessions, incremental updates, or latest-day slice as a zip; if there is nothing to export, the API returns **422** with JSON body `{"error": "Nothing to export", "since": "<mode>"}` (the `since` field echoes your request: `"all"`, `"last"`, or `"incremental"`) instead of an empty zip
+- **Bulk export** — download all sessions, incremental updates, or latest-day slice as a zip; if there is nothing to export, the API returns **422** with JSON body `{"error": "Nothing to export", "code": "EXPORT_NOTHING_TO_EXPORT", "since": "<mode>"}` (the `since` field echoes your request: `"all"`, `"last"`, or `"incremental"`) instead of an empty zip
+
+### API error codes
+
+JSON error responses include a machine-readable `"code"` (stable `UPPER_SNAKE_CASE`) and a human-readable `"error"` message. Common codes:
+
+| Code | Typical HTTP | Meaning |
+|------|--------------|---------|
+| `SEARCH_INVALID_LIMIT` | 400 | Query param `limit` is not a positive integer |
+| `INVALID_PATH` | 400 | Path traversal or unsafe project/session path |
+| `SESSION_NOT_FOUND` | 404 | Session file missing or excluded |
+| `INVALID_REQUEST_BODY` | 400 | POST body is not a JSON object |
+| `INVALID_SINCE_MODE` | 400 | Bulk export `since` is not `all`, `last`, or `incremental` |
+| `EXPORT_NOTHING_TO_EXPORT` | 422 | No sessions matched the export scope |
+| `PARSE_ERROR` | 500 | Session file could not be parsed |
+| `INTERNAL_ERROR` | 500 | Unexpected failure (e.g. stats computation) |
 
 ### CLI Export
 - Standalone script to export all sessions to Markdown with YAML frontmatter

api/error_codes.py

@@ -0,0 +1,29 @@
+"""Stable machine-readable error codes for API JSON error responses."""
+
+from __future__ import annotations
+
+from enum import StrEnum
+
+from flask import Response, jsonify
+
+
+class ErrorCode(StrEnum):
+    SEARCH_INVALID_LIMIT = "SEARCH_INVALID_LIMIT"
+    INVALID_PATH = "INVALID_PATH"
+    SESSION_NOT_FOUND = "SESSION_NOT_FOUND"
+    INVALID_REQUEST_BODY = "INVALID_REQUEST_BODY"
+    INVALID_SINCE_MODE = "INVALID_SINCE_MODE"
+    PARSE_ERROR = "PARSE_ERROR"
+    EXPORT_NOTHING_TO_EXPORT = "EXPORT_NOTHING_TO_EXPORT"
+    INTERNAL_ERROR = "INTERNAL_ERROR"
+
+
+def error_response(
+    code: ErrorCode,
+    message: str,
+    status: int,
+    **extra: object,
+) -> tuple[Response, int]:
+    body: dict[str, object] = {"error": message, "code": str(code)}
+    body.update(extra)
+    return jsonify(body), status

api/export_api.py

@@ -8,6 +8,7 @@
 
 from flask import Blueprint, current_app, jsonify, request, send_file
 
+from api.error_codes import ErrorCode, error_response
 from utils.export_state_store import (
     EXPORT_STATE_FILE,
     atomic_write_export_state,
@@ -80,11 +81,20 @@ def bulk_export():
     if body is None:
         body = {}
     if not isinstance(body, dict):
-        return jsonify({"error": "Invalid request body"}), 400
+        return error_response(
+            ErrorCode.INVALID_REQUEST_BODY,
+            "Invalid request body",
+            400,
+        )
 
     since = body.get("since", "all")
     if since not in ("all", "last", "incremental"):
-        return jsonify({"error": "Invalid since mode", "since": since}), 400
+        return error_response(
+            ErrorCode.INVALID_SINCE_MODE,
+            "Invalid since mode",
+            400,
+            since=since,
+        )
 
     base = (
         current_app.config.get("CLAUDE_PROJECTS_DIR")
@@ -226,14 +236,11 @@ def bulk_export():
         _write_state(new_sessions_map, count)
 
     if count == 0:
-        return (
-            jsonify(
-                {
-                    "error": "Nothing to export",
-                    "since": since,
-                }
-            ),
+        return error_response(
+            ErrorCode.EXPORT_NOTHING_TO_EXPORT,
+            "Nothing to export",
             422,
+            since=since,
         )
 
     buf.seek(0)
@@ -267,16 +274,24 @@ def export_session(project_name, session_id):
     try:
         filepath = safe_join(base, project_name, f"{session_id}.jsonl")
     except ValueError:
-        return jsonify({"error": "Invalid path"}), 400
+        return error_response(ErrorCode.INVALID_PATH, "Invalid path", 400)
 
     if not os.path.isfile(filepath):
-        return jsonify({"error": "Session not found"}), 404
+        return error_response(
+            ErrorCode.SESSION_NOT_FOUND,
+            "Session not found",
+            404,
+        )
 
     fmt = request.args.get("format", "md")
     session = parse_session(filepath)
     rules = current_app.config.get("EXCLUSION_RULES") or []
     if is_session_excluded(rules, session, project_name):
-        return jsonify({"error": "Session not found"}), 404
+        return error_response(
+            ErrorCode.SESSION_NOT_FOUND,
+            "Session not found",
+            404,
+        )
     stats = compute_stats(session)
     title_slug = slugify(session["title"], default="session")
 

api/search.py

@@ -4,20 +4,45 @@
 
 from flask import Blueprint, current_app, jsonify, request
 
+from api.error_codes import ErrorCode, error_response
 from utils.session_path import get_claude_projects_dir, list_projects, list_sessions
 from utils.jsonl_parser import parse_session
 from utils.exclusion_rules import is_session_excluded
 
 search_bp = Blueprint("search", __name__)
 
+_DEFAULT_LIMIT = 50
+_MAX_LIMIT = 500
+
+
+def _parse_limit(raw: str | None) -> int:
+    """Parse positive integer limit query param; raise ValueError if invalid."""
+    if raw is None or raw.strip() == "":
+        return _DEFAULT_LIMIT
+    try:
+        n = int(raw.strip())
+    except ValueError as exc:
+        raise ValueError("limit must be a positive integer") from exc
+    if n < 1:
+        raise ValueError("limit must be a positive integer")
+    return min(n, _MAX_LIMIT)
+
 
 @search_bp.route("/api/search")
 def search():
     query = request.args.get("q", "").strip().lower()
     if not query:
         return jsonify([])
 
-    max_results = int(request.args.get("limit", 50))
+    try:
+        max_results = _parse_limit(request.args.get("limit"))
+    except ValueError:
+        return error_response(
+            ErrorCode.SEARCH_INVALID_LIMIT,
+            "Invalid limit: must be a positive integer",
+            400,
+        )
+
     base = current_app.config.get("CLAUDE_PROJECTS_DIR") or get_claude_projects_dir()
     projects = list_projects(base)
 
@@ -39,7 +64,6 @@ def search():
             for msg in session["messages"]:
                 text = msg.get("text", "") or msg.get("content", "")
                 if query in text.lower():
-                    # Find the matching snippet
                     idx = text.lower().index(query)
                     start = max(0, idx - 80)
                     end = min(len(text), idx + len(query) + 80)

api/sessions.py

@@ -2,8 +2,9 @@
 
 import os
 
-from flask import Blueprint, current_app, jsonify, abort
+from flask import Blueprint, current_app, jsonify
 
+from api.error_codes import ErrorCode, error_response
 from utils.session_path import get_claude_projects_dir, safe_join
 from utils.jsonl_parser import parse_session
 from utils.session_stats import compute_stats
@@ -18,25 +19,32 @@ def get_session(project_name, session_id):
     try:
         filepath = safe_join(base, project_name, f"{session_id}.jsonl")
     except ValueError:
-        return jsonify({"error": "Invalid path"}), 400
+        return error_response(ErrorCode.INVALID_PATH, "Invalid path", 400)
 
     if not os.path.isfile(filepath):
-        return jsonify({"error": f"Session {session_id} not found"}), 404
+        return error_response(
+            ErrorCode.SESSION_NOT_FOUND,
+            f"Session {session_id} not found",
+            404,
+        )
 
     try:
         session = parse_session(filepath)
         rules = current_app.config.get("EXCLUSION_RULES") or []
         if is_session_excluded(rules, session, project_name):
-            return jsonify({"error": "Session not found"}), 404
+            return error_response(
+                ErrorCode.SESSION_NOT_FOUND,
+                "Session not found",
+                404,
+            )
         return jsonify(session)
     except Exception:
-        # Full traceback (class name, message, stack) goes to the server log
-        # via logger.exception. The HTTP body returns a stable, generic
-        # message — never the class name or `e` itself, which would leak
-        # internal field names, file paths, and user values to any client
-        # (issue #25).
         current_app.logger.exception("Failed to parse session %s", session_id)
-        return jsonify({"error": "Failed to parse session"}), 500
+        return error_response(
+            ErrorCode.PARSE_ERROR,
+            "Failed to parse session",
+            500,
+        )
 
 
 @sessions_bp.route("/api/sessions/<path:project_name>/<session_id>/stats")
@@ -45,17 +53,23 @@ def get_session_stats(project_name, session_id):
     try:
         filepath = safe_join(base, project_name, f"{session_id}.jsonl")
     except ValueError:
-        return jsonify({"error": "Invalid path"}), 400
+        return error_response(ErrorCode.INVALID_PATH, "Invalid path", 400)
 
     if not os.path.isfile(filepath):
-        return jsonify({"error": f"Session {session_id} not found"}), 404
+        return error_response(
+            ErrorCode.SESSION_NOT_FOUND,
+            f"Session {session_id} not found",
+            404,
+        )
 
     try:
         session = parse_session(filepath)
         stats = compute_stats(session)
         return jsonify(stats)
     except Exception:
-        # Same pattern as get_session above — full detail to the server log,
-        # generic message in the HTTP body (issue #25).
         current_app.logger.exception("Failed to compute stats for %s", session_id)
-        return jsonify({"error": "Failed to compute session stats"}), 500
+        return error_response(
+            ErrorCode.INTERNAL_ERROR,
+            "Failed to compute session stats",
+            500,
+        )

tests/conftest.py

@@ -0,0 +1,63 @@
+"""Shared pytest fixtures for API and integration tests."""
+
+from __future__ import annotations
+
+import shutil
+from pathlib import Path
+
+import pytest
+
+from app import create_app
+
+FIXTURES = Path(__file__).parent / "fixtures"
+
+
+def assert_error_response(resp, *, expected_code: str | None = None):
+    """Assert JSON error body has error + code; optionally match code string."""
+    assert resp.status_code >= 400
+    body = resp.get_json()
+    assert body is not None
+    assert "error" in body
+    assert isinstance(body["error"], str)
+    assert "code" in body
+    if expected_code is not None:
+        assert body["code"] == expected_code
+
+
+@pytest.fixture
+def export_state_file(tmp_path, monkeypatch):
+    """Isolate export state JSON to tmp_path for full-app export tests."""
+    path = tmp_path / "export_state.json"
+    monkeypatch.setattr("api.export_api._STATE_FILE", str(path))
+    return path
+
+
+@pytest.fixture
+def client(tmp_path, export_state_file):
+    """Flask test client with two seeded sessions in test-project."""
+    project_dir = tmp_path / "test-project"
+    project_dir.mkdir(parents=True)
+    shutil.copy(FIXTURES / "session_minimal.jsonl", project_dir / "session_abc123.jsonl")
+    shutil.copy(FIXTURES / "session_with_tools.jsonl", project_dir / "session_def456.jsonl")
+    app = create_app(base_dir=str(tmp_path))
+    app.config["TESTING"] = True
+    return app.test_client()
+
+
+@pytest.fixture
+def client_single(tmp_path, export_state_file):
+    """Flask test client with one session — for search/limit tests."""
+    project_dir = tmp_path / "test-project"
+    project_dir.mkdir(parents=True)
+    shutil.copy(FIXTURES / "session_minimal.jsonl", project_dir / "session_abc123.jsonl")
+    app = create_app(base_dir=str(tmp_path))
+    app.config["TESTING"] = True
+    return app.test_client()
+
+
+@pytest.fixture
+def client_empty(tmp_path, export_state_file):
+    """Flask test client with an empty projects directory."""
+    app = create_app(base_dir=str(tmp_path))
+    app.config["TESTING"] = True
+    return app.test_client()

tests/fixtures/session_minimal.jsonl

@@ -0,0 +1,2 @@
+{"type": "user", "uuid": "user-hello-001", "sessionId": "session_abc123", "timestamp": "2026-05-19T10:00:00.000Z", "cwd": "/home/user/test-project", "message": {"role": "user", "content": [{"type": "text", "text": "Hello"}]}}
+{"type": "assistant", "uuid": "asst-hello-001", "parentUuid": "user-hello-001", "sessionId": "session_abc123", "timestamp": "2026-05-19T10:00:01.000Z", "message": {"role": "assistant", "model": "claude-opus-4-5", "content": [{"type": "text", "text": "Hi there!"}], "stop_reason": "end_turn", "usage": {"input_tokens": 10, "output_tokens": 5, "cache_read_input_tokens": 0, "cache_creation_input_tokens": 0}}}

tests/fixtures/session_with_tools.jsonl

@@ -0,0 +1,3 @@
+{"type": "user", "uuid": "user-tools-001", "sessionId": "session_def456", "timestamp": "2026-05-19T11:00:00.000Z", "cwd": "/home/user/test-project", "message": {"role": "user", "content": [{"type": "text", "text": "Run a command"}]}}
+{"type": "assistant", "uuid": "asst-tools-001", "parentUuid": "user-tools-001", "sessionId": "session_def456", "timestamp": "2026-05-19T11:00:02.000Z", "message": {"role": "assistant", "model": "claude-opus-4-5", "content": [{"type": "tool_use", "id": "toolu_01", "name": "Bash", "input": {"command": "echo hello"}}], "stop_reason": "tool_use", "usage": {"input_tokens": 20, "output_tokens": 10, "cache_read_input_tokens": 0, "cache_creation_input_tokens": 0}}}
+{"type": "user", "uuid": "user-tools-002", "parentUuid": "asst-tools-001", "sessionId": "session_def456", "timestamp": "2026-05-19T11:00:03.000Z", "message": {"role": "user", "content": [{"type": "tool_result", "tool_use_id": "toolu_01", "content": "hello\n"}]}}