MetaList 0.7.4__tar.gz → 0.7.5__tar.gz

{metalist-0.7.4 → metalist-0.7.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: metalist
-Version: 0.7.4
+Version: 0.7.5
 Summary: A minimalist single-user note-taking app with SSR, fast in-memory tree operations, and efficient sync.
 Project-URL: Homepage, https://github.com/evolvingstuff/metalist
 Project-URL: Repository, https://github.com/evolvingstuff/metalist
@@ -48,6 +48,11 @@ A minimalist single-user note-taking app focused on server-side rendering (SSR),
 - Multi-tab search contexts with server-persisted scroll/search state (survives browser restarts)
 - Manual namespace backups/restores to a user-selected backup folder with retention controls
 
+## Changes in 0.7.5
+
+- Unexpected API 500 errors now show the exception class and MetaList source line in the browser, without exposing note contents, exception messages, or local filesystem paths.
+- A local release command validates the exact cross-platform CI matrix, publishes only its tested artifacts, then verifies the public PyPI package in a clean installation.
+
 ## Changes in 0.7.4
 
 - Updates use a private, checksum-verified uv release on Windows, macOS, and Linux. The updater does not execute a user-installed uv, and it revalidates both the cached official archive and extracted executable before each use.

{metalist-0.7.4 → metalist-0.7.5}/README.md

@@ -12,6 +12,11 @@ A minimalist single-user note-taking app focused on server-side rendering (SSR),
 - Multi-tab search contexts with server-persisted scroll/search state (survives browser restarts)
 - Manual namespace backups/restores to a user-selected backup folder with retention controls
 
+## Changes in 0.7.5
+
+- Unexpected API 500 errors now show the exception class and MetaList source line in the browser, without exposing note contents, exception messages, or local filesystem paths.
+- A local release command validates the exact cross-platform CI matrix, publishes only its tested artifacts, then verifies the public PyPI package in a clean installation.
+
 ## Changes in 0.7.4
 
 - Updates use a private, checksum-verified uv release on Windows, macOS, and Linux. The updater does not execute a user-installed uv, and it revalidates both the cached official archive and extracted executable before each use.

{metalist-0.7.4 → metalist-0.7.5}/app/main.py

@@ -38,6 +38,7 @@ from app.services.search_history import search_history_store
 from app.services.runtime_hardening import apply_runtime_hardening
 from app.security.encryption import set_encryption_required
 from app.security.http_headers import apply_security_headers
+from app.security.http_error_diagnostics import describe_server_exception
 from app.security.request_boundary import RequestBoundaryMiddleware
 from app.security.request_boundary import resolve_allowed_request_hosts
 from app.security.validation_errors import summarize_validation_errors
@@ -149,6 +150,18 @@ async def request_validation_error(request: Request, exc: RequestValidationError
 async def handle_ontology_parse_error(request: Request, exc: OntologyParseError):
     return JSONResponse(status_code=400, content={"detail": str(exc)})
 
+
+@app.exception_handler(Exception)
+async def handle_unexpected_server_error(request: Request, exc: Exception):
+    return JSONResponse(
+        status_code=500,
+        content={
+            "detail": "Internal server error",
+            "diagnostic": describe_server_exception(exc),
+        },
+        headers={"Cache-Control": "no-store, private", "X-Content-Type-Options": "nosniff"},
+    )
+
 _startup_timing_enabled = True
 
 

metalist-0.7.5/app/security/http_error_diagnostics.py

@@ -0,0 +1,19 @@
+"""Small, data-free diagnostics for unexpected HTTP failures."""
+
+from pathlib import Path
+import traceback
+
+
+_APP_DIRECTORY = Path(__file__).resolve().parents[1]
+_REPOSITORY_DIRECTORY = _APP_DIRECTORY.parent
+
+
+def describe_server_exception(error: Exception) -> dict[str, str]:
+    """Expose the exception class and last application frame, never its message."""
+    location = "external"
+    for frame in reversed(traceback.extract_tb(error.__traceback__)):
+        path = Path(frame.filename).resolve()
+        if path.is_relative_to(_APP_DIRECTORY):
+            location = f"{path.relative_to(_REPOSITORY_DIRECTORY).as_posix()}:{frame.lineno}"
+            break
+    return {"errorType": type(error).__name__, "codeLocation": location}

{metalist-0.7.4 → metalist-0.7.5}/app/static/js/modules/api-client.js

@@ -7,6 +7,7 @@ import { computeScrollAnchor } from './mode-manager/services/scroll-anchor-servi
 import { CommandGate } from './mode-manager/services/command-gate-service.js';
 import { buildSessionHeaders } from './session-auth.js';
 import { sanitizeNoteHtmlForStorage } from './note-html-sanitizer.js';
+import { describeApiFailure } from './api-error-diagnostics.js';
 
 function buildAuthHeaders(includeContentType) {
     return buildSessionHeaders(includeContentType);
@@ -125,7 +126,7 @@ export const NotesAPI = {
             if (!response.ok) {
                 // Use centralized error handling
                 ErrorHandler.handleApiError(null, response);
-                throw new HttpRequestError(`API call failed: ${response.status} ${response.statusText}`);
+                throw new HttpRequestError(await describeApiFailure(response));
             }
 
             const data = await response.json();

metalist-0.7.5/app/static/js/modules/api-error-diagnostics.js

@@ -0,0 +1,16 @@
+const ERROR_TYPE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const CODE_LOCATION = /^(?:app(?:\/[A-Za-z_][A-Za-z0-9_]*)+\.py:\d+|external)$/;
+
+export async function describeApiFailure(response) {
+    const base = `API call failed: ${response.status} ${response.statusText}`;
+    if (response.status < 500 || !response.headers.get('content-type')?.includes('application/json')) {
+        return base;
+    }
+
+    const body = await response.json();
+    const diagnostic = body?.diagnostic;
+    if (!ERROR_TYPE.test(diagnostic?.errorType) || !CODE_LOCATION.test(diagnostic?.codeLocation)) {
+        return base;
+    }
+    return `${base} (${diagnostic.errorType} at ${diagnostic.codeLocation})`;
+}

{metalist-0.7.4 → metalist-0.7.5}/app/version.py

@@ -1,3 +1,3 @@
 """Single authoritative MetaList application version."""
 
-__version__ = "0.7.4"
+__version__ = "0.7.5"

{metalist-0.7.4 → metalist-0.7.5}/metalist.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: metalist
-Version: 0.7.4
+Version: 0.7.5
 Summary: A minimalist single-user note-taking app with SSR, fast in-memory tree operations, and efficient sync.
 Project-URL: Homepage, https://github.com/evolvingstuff/metalist
 Project-URL: Repository, https://github.com/evolvingstuff/metalist
@@ -48,6 +48,11 @@ A minimalist single-user note-taking app focused on server-side rendering (SSR),
 - Multi-tab search contexts with server-persisted scroll/search state (survives browser restarts)
 - Manual namespace backups/restores to a user-selected backup folder with retention controls
 
+## Changes in 0.7.5
+
+- Unexpected API 500 errors now show the exception class and MetaList source line in the browser, without exposing note contents, exception messages, or local filesystem paths.
+- A local release command validates the exact cross-platform CI matrix, publishes only its tested artifacts, then verifies the public PyPI package in a clean installation.
+
 ## Changes in 0.7.4
 
 - Updates use a private, checksum-verified uv release on Windows, macOS, and Linux. The updater does not execute a user-installed uv, and it revalidates both the cached official archive and extracted executable before each use.

{metalist-0.7.4 → metalist-0.7.5}/metalist.egg-info/SOURCES.txt

@@ -70,6 +70,7 @@ app/presentation/render/__init__.py
 app/presentation/render/note_renderer.py
 app/security/authenticated_logging.py
 app/security/encryption.py
+app/security/http_error_diagnostics.py
 app/security/http_headers.py
 app/security/note_html.py
 app/security/request_boundary.py
@@ -224,6 +225,7 @@ app/static/js/namespace-deleted.js
 app/static/js/namespace-renamed.js
 app/static/js/modules/activity-tracker.js
 app/static/js/modules/api-client.js
+app/static/js/modules/api-error-diagnostics.js
 app/static/js/modules/api-failure-classification-service.js
 app/static/js/modules/app-update-service.js
 app/static/js/modules/application-state.js

{metalist-0.7.4 → metalist-0.7.5}/pyproject.toml

@@ -77,6 +77,8 @@ app = [
 release = [
     "build==1.6.1",
     "pip-audit==2.10.1",
+    "requests==2.34.2",
+    "rich==14.3.4",
     "setuptools==83.0.0",
     "uv==0.11.23",
     "wheel==0.48.0",