fix: PR #42 review feedback (CLI timeout, search asserts, error codes, exceptions)

Author: clean6378-max-it

api/export_api.py

@@ -36,6 +36,14 @@
 # Tests monkeypatch this path; keep in sync with utils.export_state_store.
 _STATE_FILE = EXPORT_STATE_FILE
 
+_EXPORT_ERRORS = (
+    json.JSONDecodeError,
+    KeyError,
+    ValueError,
+    OSError,
+    FileNotFoundError,
+)
+
 
 def _state_lock() -> Any:
     return export_state_lock(_STATE_FILE)
@@ -162,7 +170,7 @@ def bulk_export() -> FlaskReturn:
                     )
                     new_sessions_map[sid] = sess_info.get("modified", 0)
                     count += 1
-                except Exception as e:
+                except _EXPORT_ERRORS as e:
                     current_app.logger.warning(
                         "Failed to export %s: %s", sid[:10], e
                     )
@@ -224,7 +232,7 @@ def bulk_export() -> FlaskReturn:
                         )
                         new_sessions_map[sid] = sess_info.get("modified", 0)
                         count += 1
-                    except Exception as e:
+                    except _EXPORT_ERRORS as e:
                         current_app.logger.warning(
                             "Failed to export %s: %s", sid[:10], e
                         )
@@ -287,7 +295,7 @@ def export_session(project_name: str, session_id: str) -> FlaskReturn:
     fmt = request.args.get("format", "md")
     try:
         session = parse_session(filepath)
-    except Exception:
+    except _EXPORT_ERRORS:
         current_app.logger.exception(
             "Failed to parse session %s for export", session_id
         )
@@ -307,7 +315,7 @@ def export_session(project_name: str, session_id: str) -> FlaskReturn:
 
     try:
         stats = compute_stats(session)
-    except Exception:
+    except _EXPORT_ERRORS:
         current_app.logger.exception(
             "Failed to compute stats for export %s", session_id
         )

api/sessions.py

@@ -1,5 +1,6 @@
 """Session detail and stats endpoints."""
 
+import json
 import os
 
 from flask import Blueprint, current_app
@@ -13,6 +14,14 @@
 
 sessions_bp = Blueprint("sessions", __name__)
 
+_PARSE_ERRORS = (
+    json.JSONDecodeError,
+    KeyError,
+    ValueError,
+    OSError,
+    FileNotFoundError,
+)
+
 
 @sessions_bp.route("/api/sessions/<path:project_name>/<session_id>")
 def get_session(project_name: str, session_id: str) -> FlaskReturn:
@@ -39,7 +48,7 @@ def get_session(project_name: str, session_id: str) -> FlaskReturn:
                 404,
             )
         return json_response(session)
-    except Exception:
+    except _PARSE_ERRORS:
         current_app.logger.exception("Failed to parse session %s", session_id)
         return error_response(
             ErrorCode.PARSE_ERROR,
@@ -65,7 +74,7 @@ def get_session_stats(project_name: str, session_id: str) -> FlaskReturn:
 
     try:
         session = parse_session(filepath)
-    except Exception:
+    except _PARSE_ERRORS:
         current_app.logger.exception("Failed to parse session %s", session_id)
         return error_response(
             ErrorCode.PARSE_ERROR,
@@ -84,7 +93,7 @@ def get_session_stats(project_name: str, session_id: str) -> FlaskReturn:
     try:
         stats = compute_stats(session)
         return json_response(stats)
-    except Exception:
+    except _PARSE_ERRORS:
         current_app.logger.exception("Failed to compute stats for %s", session_id)
         return error_response(
             ErrorCode.INTERNAL_ERROR,

pyproject.toml

@@ -9,12 +9,8 @@ addopts = "--cov=api --cov=utils --cov-report=term-missing --cov-report=xml:cove
 testpaths = ["tests"]
 
 [tool.coverage.run]
-# Exclude untested export/stats modules until Week 3+ adds coverage (see issue #4 follow-up).
 omit = [
     "tests/*",
-    "utils/md_exporter.py",
-    "utils/session_stats.py",
-    "utils/json_exporter.py",
 ]
 
 [tool.coverage.report]

static/js/shared/markdown.test.js

@@ -44,4 +44,13 @@ describe('renderMarkdown', () => {
         const html = renderMarkdown('`code`');
         expect(html).toBe('<code>code</code>');
     });
+
+    it('falls back to escaped output when DOMPurify is unavailable', () => {
+        delete globalThis.DOMPurify;
+        const html = renderMarkdown('Hello **world**');
+        expect(html).toBeDefined();
+        expect(html).toContain('Hello');
+        expect(html).toContain('**world**');
+        expect(html).not.toMatch(/<script/i);
+    });
 });

tests/test_cli_e2e.py

@@ -20,7 +20,12 @@ def _cli_env() -> dict[str, str]:
     return env
 
 
-def _run_cli(argv: list[str], *, env: dict | None = None) -> subprocess.CompletedProcess:
+def _run_cli(
+    argv: list[str],
+    *,
+    env: dict | None = None,
+    timeout: float = 60.0,
+) -> subprocess.CompletedProcess:
     cmd = [sys.executable, str(EXPORT_SCRIPT), *argv]
     merged = _cli_env()
     if env:
@@ -33,6 +38,7 @@ def _run_cli(argv: list[str], *, env: dict | None = None) -> subprocess.Complete
         env=merged,
         encoding="utf-8",
         errors="replace",
+        timeout=timeout,
     )
 
 
@@ -53,7 +59,8 @@ def test_cli_list_exits_zero(tmp_path):
     assert "test-project" in proc.stdout.lower()
 
 
-def test_cli_list_unknown_project_exits_zero_with_message(tmp_path):
+def test_cli_list_nonmatching_project_filter_prints_no_projects(tmp_path):
+    """--project filters by substring; zero matches prints 'No projects found.'"""
     base = _seed_base_dir(tmp_path)
     proc = _run_cli(["list", "--base-dir", str(base), "--project", "does-not-exist"])
     assert proc.returncode == 0

tests/test_error_codes.py

@@ -52,7 +52,7 @@ def test_error_codes_on_endpoints(client, method, path, kwargs, status, code):
     fn = getattr(client, method)
     resp = fn(path, **kwargs)
     assert resp.status_code == status
-    assert_error_response(resp, expected_code=str(code))
+    assert_error_response(resp, expected_code=code)
 
 
 def test_bulk_export_empty_includes_export_nothing_code(client_empty):

tests/test_search.py

@@ -52,6 +52,7 @@ def test_limit_default(client_single):
 def test_limit_whitespace_defaults(client_single):
     resp = client_single.get("/api/search?q=Hello&limit=%20%20%20")
     assert resp.status_code == 200
+    _assert_search_hits(resp.get_json(), max_items=50)
 
 
 def test_limit_zero(client_single):