fix: strengthen exception-leak static guard; lift safe_join to module import in export_api

Author: clean6378-max-it

CONTRIBUTING.md

@@ -9,7 +9,7 @@ Thanks for considering a patch. This repo is a small Flask app plus a hash-route
 - **Python 3.12** (matches CI)
 - **Node 20+** (only if you change `static/js/` or run frontend unit tests)
 
-CI runs **`pytest`**, **integration tests**, and **Vitest** on **ubuntu-latest** and **windows-latest** (Python 3.12, Node 20). Type-check (`mypy`) and production install smoke run on Ubuntu only.
+CI runs **`ruff check`**, **`ruff format --check`**, **`pip-audit`**, **`pytest`**, **integration tests**, and **Vitest** on **ubuntu-latest** and **windows-latest** (Python 3.12, Node 20). Type-check (`mypy`) and production install smoke run on Ubuntu only.
 
 ### Bootstrap (Windows PowerShell)
 
@@ -58,6 +58,9 @@ When changing JSON response shapes, update the API reference stability column an
 ### Python
 
 ```bash
+ruff check .                           # lint (E, F, W, I) — same gate as CI
+ruff format --check .                  # formatting gate; run `ruff format .` to fix
+pip-audit -r requirements.txt        # production dependency audit (CI gate)
 pytest -q                              # full suite + coverage (see pyproject.toml)
 pytest tests/test_api_integration.py -v
 pytest tests/test_search.py -v
@@ -85,7 +88,8 @@ npm run test:coverage   # optional
 | **Exception leakage** | `5xx` bodies are generic messages only. Log full tracebacks with `current_app.logger.exception(...)`. Never put `str(e)` or class names in HTTP JSON (issue #25). |
 | **Path safety** | Use `safe_join()` from `utils/session_path.py` for any path built from URL segments. |
 | **Imports** | stdlib → third-party → local, blank line between groups. |
-| **Line length** | ~100 characters; no enforced formatter yet. |
+| **Lint / format** | `ruff check .` and `ruff format --check .` (CI gates). Config in `pyproject.toml`; run `ruff format .` to apply formatting locally. |
+| **Line length** | 100 characters (`line-length` in `pyproject.toml`). |
 
 ## Tests required for common changes
 
@@ -105,9 +109,10 @@ npm run test:coverage   # optional
 - Branch names: `feat/<topic>`, `fix/<topic>`, `test/<topic>`, `chore/<topic>`, `docs/<topic>`.
 - One logical change per PR when possible.
 - PR checklist:
+  - [ ] `ruff check .` and `ruff format --check .` green locally
   - [ ] `pytest -q` green locally
   - [ ] `npm test` green if JS changed
-  - [ ] CI jobs green (`pytest`, `integration-tests`, `js-tests` on Ubuntu + Windows; `mypy`, `prod-install-smoke` on Ubuntu)
+  - [ ] CI jobs green (`lint-and-audit`, `pytest`, `integration-tests`, `js-tests` on Ubuntu + Windows; `mypy`, `prod-install-smoke` on Ubuntu)
   - [ ] PR description includes a **Test plan** section
   - [ ] API changes update [`docs/api-reference.md`](docs/api-reference.md) if behavior or errors change
 

README.md

@@ -157,7 +157,7 @@ npm ci && npm test   # only if you changed static/js/
 
 ## Continuous integration
 
-Every push and pull request runs **`ruff`**, **`pip-audit`**, **`pytest`**, **mypy**, **API integration tests**, and **vitest** on **Ubuntu and Windows** (Python 3.12, Node 20) via [`.github/workflows/ci.yml`](.github/workflows/ci.yml). A separate job verifies that `pip install -r requirements.txt` (production-only) is sufficient to import and boot the app.
+Every push and pull request runs **`ruff check`**, **`ruff format --check`**, **`pip-audit`**, **`pytest`**, **mypy**, **API integration tests**, and **vitest** on **Ubuntu and Windows** (Python 3.12, Node 20) via [`.github/workflows/ci.yml`](.github/workflows/ci.yml). A separate job verifies that `pip install -r requirements.txt` (production-only) is sufficient to import and boot the app.
 
 ## Exported Markdown Format
 

SECURITY.md

@@ -13,7 +13,11 @@ This project is pre-release. Security fixes are applied to the **latest `master`
 
 **Please do not open public GitHub issues for security vulnerabilities.**
 
-Report vulnerabilities privately via [GitHub Security Advisories](https://github.com/cppalliance/claude-code-chat-browser/security/advisories/new). Private vulnerability reporting must be enabled on the repository (Settings → Security → Private vulnerability reporting). If you cannot use that form, contact the repository maintainers through an existing private channel.
+**Primary path (always works):** Contact a [repository maintainer](https://github.com/cppalliance/claude-code-chat-browser/graphs/contributors) through a private channel you already use with the project (for example a direct message or private email). Include steps to reproduce, affected version/commit, and impact.
+
+**GitHub Security Advisories (when enabled):** Once **Private vulnerability reporting** is turned on for this repository (Settings → Security → Private vulnerability reporting), external researchers may use the [private advisory form](https://github.com/cppalliance/claude-code-chat-browser/security/advisories/new). If that link returns 404 or the form is unavailable, use the primary path above — the advisory URL only works when the setting is enabled.
+
+**Repository admins:** Enable private vulnerability reporting before merge if you want the advisory form to be the default reporter path; until then, maintainers should treat the primary path as authoritative.
 
 ## Response Timeline
 

api/export_api.py

@@ -22,7 +22,7 @@
 from utils.json_exporter import session_to_json
 from utils.jsonl_parser import parse_session
 from utils.md_exporter import session_to_markdown
-from utils.session_path import get_claude_projects_dir, list_projects
+from utils.session_path import get_claude_projects_dir, list_projects, safe_join
 from utils.session_stats import compute_stats
 from utils.slugify import slugify
 
@@ -155,8 +155,6 @@ def _on_export_error(sid: str, exc: Exception) -> None:
 
 @export_bp.route("/api/export/session/<path:project_name>/<session_id>")
 def export_session(project_name: str, session_id: str) -> FlaskReturn:
-    from utils.session_path import safe_join
-
     base = current_app.config.get("CLAUDE_PROJECTS_DIR") or get_claude_projects_dir()
     try:
         filepath = safe_join(base, project_name, f"{session_id}.jsonl")

tests/test_error_propagation.py

@@ -21,6 +21,7 @@ class names from a defensive blocklist.
 from __future__ import annotations
 
 import json
+import re
 import sys
 from pathlib import Path
 
@@ -210,21 +211,29 @@ def _boom(*args, **kwargs):
 
 
 class TestNoExceptionInterpolationInSource:
-    """Static guard: any future PR that re-introduces the
-    `f"...{type(e).__name__}: {e}..."` pattern in api/ fails this test."""
+    """Static guard: any future PR that re-introduces exception interpolation
+    in api/ response bodies fails this test.
+
+    Patterns caught:
+    - type(e).__name__         — explicit class-name expose
+    - {e}  with any common    — f-string that embeds the exception value directly
+      trailing character       (closing quote, comma, paren, space, closing brace)
+    - {str(e)} / {repr(e)}    — wrapped but still leaks message content
+    """
+
+    _LEAK_RE = re.compile(
+        r"type\(e\)\.__name__"  # explicit class name
+        r"|\{e[\"',)\s}]"  # {e} followed by: quote, comma, paren, space, closing brace
+        r"|\{str\(e\)"  # {str(e)} — still leaks message
+        r"|\{repr\(e\)",  # {repr(e)} — still leaks message
+    )
 
     def test_api_files_dont_interpolate_exception_in_jsonify(self):
         api_dir = REPO_ROOT / "api"
         for py_file in api_dir.glob("*.py"):
             src = py_file.read_text(encoding="utf-8")
-            # Look for the specific footgun: jsonify(...) with f-string that
-            # contains both `type(e)` or `{e}` AND the word "error".
-            offending_patterns = [
-                "type(e).__name__",  # the class-name expose
-                '{e}"',  # bare {e} ending an f-string
-                "{e},",  # bare {e} in a dict-value f-string
-            ]
-            for pat in offending_patterns:
-                assert pat not in src, (
-                    f"{py_file.name} contains forbidden pattern {pat!r} — see issue #25"
-                )
+            m = self._LEAK_RE.search(src)
+            assert m is None, (
+                f"{py_file.name} contains forbidden exception-interpolation pattern "
+                f"{m.group(0)!r} at position {m.start()} — see issue #25"
+            )