Fix review findings: sitemap Content-Type and search DOM injection

- P2: the FastAPI catch-all wrapped every route() response in
  HTMLResponse, discarding AppResponse.headers — deployed /sitemap.xml
  shipped as text/html. The catch-all now preserves headers when the
  route sets them. Regression tests exercise the handler through the
  stubbed-main harness (extracted MainModuleHarness) and fail when the
  fix is reverted.
- P3: search results were rendered via innerHTML with interpolated
  catalog fields. Result nodes are now built with createElement/
  textContent and replaceChildren, the slug is URI-encoded in the href,
  and the ranking check asserts search.js contains no innerHTML use.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012tBECRGRPmM2dj5b3FFJGo

Author: claude

public/search.7f410703da25.js public/search.ab0effeac6ce.jspublic/search.7f410703da25.js renamed to public/search.ab0effeac6ce.js

@@ -50,24 +50,41 @@ function wireSearch() {
 
   function hideResults() {
     results.hidden = true;
-    results.innerHTML = '';
+    results.replaceChildren();
+  }
+
+  // Result nodes are built with textContent so catalog fields can never
+  // be parsed as markup.
+  function resultNode(entry) {
+    const item = document.createElement('li');
+    const link = document.createElement('a');
+    link.href = `/examples/${encodeURIComponent(entry.slug)}`;
+    const title = document.createElement('strong');
+    title.textContent = entry.title;
+    const meta = document.createElement('span');
+    meta.className = 'meta';
+    meta.textContent = ` · ${entry.section}`;
+    link.append(title, meta);
+    item.appendChild(link);
+    return item;
   }
 
   function renderResults() {
     if (!entries) return;
     const matches = rankExamples(input.value, entries);
     if (!matches.length) {
       if (input.value.trim()) {
-        results.innerHTML = '<li class="search-empty">No matching examples.</li>';
+        const empty = document.createElement('li');
+        empty.className = 'search-empty';
+        empty.textContent = 'No matching examples.';
+        results.replaceChildren(empty);
         results.hidden = false;
       } else {
         hideResults();
       }
       return;
     }
-    results.innerHTML = matches
-      .map((entry) => `<li><a href="/examples/${entry.slug}"><strong>${entry.title}</strong><span class="meta"> · ${entry.section}</span></a></li>`)
-      .join('');
+    results.replaceChildren(...matches.map(resultNode));
     results.hidden = false;
   }
 

public/search.js

@@ -50,24 +50,41 @@ function wireSearch() {
 
   function hideResults() {
     results.hidden = true;
-    results.innerHTML = '';
+    results.replaceChildren();
+  }
+
+  // Result nodes are built with textContent so catalog fields can never
+  // be parsed as markup.
+  function resultNode(entry) {
+    const item = document.createElement('li');
+    const link = document.createElement('a');
+    link.href = `/examples/${encodeURIComponent(entry.slug)}`;
+    const title = document.createElement('strong');
+    title.textContent = entry.title;
+    const meta = document.createElement('span');
+    meta.className = 'meta';
+    meta.textContent = ` · ${entry.section}`;
+    link.append(title, meta);
+    item.appendChild(link);
+    return item;
   }
 
   function renderResults() {
     if (!entries) return;
     const matches = rankExamples(input.value, entries);
     if (!matches.length) {
       if (input.value.trim()) {
-        results.innerHTML = '<li class="search-empty">No matching examples.</li>';
+        const empty = document.createElement('li');
+        empty.className = 'search-empty';
+        empty.textContent = 'No matching examples.';
+        results.replaceChildren(empty);
         results.hidden = false;
       } else {
         hideResults();
       }
       return;
     }
-    results.innerHTML = matches
-      .map((entry) => `<li><a href="/examples/${entry.slug}"><strong>${entry.title}</strong><span class="meta"> · ${entry.section}</span></a></li>`)
-      .join('');
+    results.replaceChildren(...matches.map(resultNode));
     results.hidden = false;
   }
 

scripts/check_search_ranking.mjs

@@ -14,6 +14,11 @@ function expect(condition, message) {
   if (!condition) failures.push(message);
 }
 
+// Result nodes must be built with textContent, never innerHTML, so
+// catalog fields can never be parsed as markup (DOM injection guard).
+const searchSource = readFileSync(path.join(root, 'public', 'search.js'), 'utf8');
+expect(!searchSource.includes('innerHTML'), 'search.js must not use innerHTML');
+
 const closures = rankExamples('closures', entries);
 expect(closures[0]?.slug === 'closures', `exact title should rank first, got ${closures[0]?.slug}`);
 

src/asset_manifest.py

@@ -1,3 +1,3 @@
 # Generated by scripts/fingerprint_assets.py. Do not edit by hand.
-ASSET_PATHS = {'SITE_CSS': '/site.8804b14e63bc.css', 'SYNTAX_JS': '/syntax-highlight.305edd86ffcd.js', 'EDITOR_JS': '/editor.bbf94cd1abda.js', 'SEARCH_JS': '/search.7f410703da25.js', 'SEARCH_INDEX': '/search-index.f08e8599474a.json'}
-HTML_CACHE_VERSION = '43f8ba99437d'
+ASSET_PATHS = {'SITE_CSS': '/site.8804b14e63bc.css', 'SYNTAX_JS': '/syntax-highlight.305edd86ffcd.js', 'EDITOR_JS': '/editor.bbf94cd1abda.js', 'SEARCH_JS': '/search.ab0effeac6ce.js', 'SEARCH_INDEX': '/search-index.f08e8599474a.json'}
+HTML_CACHE_VERSION = '1a58594ea2d2'

src/main.py

@@ -390,6 +390,10 @@ def provide_worker_code():
 @app.get("/{path:path}")
 async def not_found(path: str, request: Request):
     response = route(str(request.url), method="GET")
+    # Non-HTML routes (such as /sitemap.xml) set their own Content-Type;
+    # wrapping them in HTMLResponse would discard it.
+    if response.headers:
+        return Response(response.body, status_code=response.status, headers=response.headers)
     return _html(response.body, response.status)
 
 

tests/test_main_observability.py

@@ -10,7 +10,13 @@
 SRC = ROOT / "src"
 
 
-class MainObservabilityTests(unittest.TestCase):
+class MainModuleHarness(unittest.TestCase):
+    """Imports src/main.py with stubbed FastAPI/Workers modules.
+
+    Subclass this to test main.py handlers directly; the stub Response
+    classes record content, status, and headers for assertions.
+    """
+
     def setUp(self):
         self.saved_modules = {
             name: sys.modules.get(name)
@@ -83,8 +89,11 @@ class RequestValidationError(Exception):
         fastapi_responses = types.ModuleType("fastapi.responses")
 
         class Response:
-            def __init__(self, *args, **kwargs):
-                pass
+            def __init__(self, content=None, status_code=200, headers=None, media_type=None, **kwargs):
+                self.content = content
+                self.status_code = status_code
+                self.headers = headers or {}
+                self.media_type = media_type
 
         class HTMLResponse(Response):
             pass
@@ -129,6 +138,8 @@ def import_main(self):
         sys.modules.pop("main", None)
         return importlib.import_module("main")
 
+
+class MainObservabilityTests(MainModuleHarness):
     def test_run_example_marks_dynamic_worker_http_500_as_worker_error(self):
         main = self.import_main()
         destroyed = []

tests/test_main_routes.py

@@ -0,0 +1,39 @@
+import asyncio
+from types import SimpleNamespace
+
+from tests.test_main_observability import MainModuleHarness
+
+
+class CatchAllResponseHeaderTests(MainModuleHarness):
+    """The FastAPI catch-all must preserve route()'s response headers.
+
+    /sitemap.xml is served through the catch-all; wrapping every
+    response in HTMLResponse would discard its XML Content-Type.
+    """
+
+    def request(self, url):
+        return SimpleNamespace(url=url)
+
+    def test_sitemap_keeps_xml_content_type_through_the_catch_all(self):
+        main = self.import_main()
+        response = asyncio.run(
+            main.not_found("sitemap.xml", self.request("https://example.test/sitemap.xml"))
+        )
+        self.assertEqual(response.headers["Content-Type"], "application/xml; charset=utf-8")
+        self.assertIn("<urlset", response.content)
+        self.assertEqual(response.status_code, 200)
+
+    def test_journey_pages_stay_html_through_the_catch_all(self):
+        main = self.import_main()
+        response = asyncio.run(
+            main.not_found("journeys", self.request("https://example.test/journeys"))
+        )
+        self.assertTrue(response.headers["Content-Type"].startswith("text/html"))
+        self.assertEqual(response.status_code, 200)
+
+    def test_unknown_paths_fall_back_to_html(self):
+        main = self.import_main()
+        response = asyncio.run(
+            main.not_found("no-such-page", self.request("https://example.test/no-such-page"))
+        )
+        self.assertEqual(response.status_code, 404)