fix: resolve mypy, ruff, and bandit errors in API modules

- Add type ignore for fusion.__version__ import (attr-defined)
- Fix ast.expr type annotation in codebase.py _get_attribute_name
- Add 'from None/e' to exception re-raises (B904)
- Use Annotated[Session, Depends()] pattern to fix B008
- Add type ignore for aiofiles import (import-untyped)
- Add type ignore for Windows subprocess.CREATE_NEW_PROCESS_GROUP
- Add type annotations for variables (Run | None, list[dict])
- Add nosec B110 comments for intentional try/except/pass patterns
- Add nosec B607 comments for Windows system commands
- Remove outdated test_run_gui.py (tests non-existent GUINotSupportedError)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: ryanmccann1024

fusion/api/routes/codebase.py

@@ -59,15 +59,15 @@ def _get_module_description(path: Path) -> str | None:
                 content = init_file.read_text()
                 tree = ast.parse(content)
                 return ast.get_docstring(tree)
-            except Exception:
-                pass
+            except Exception:  # nosec B110
+                pass  # Silently ignore unparseable files
     elif path.suffix == ".py":
         try:
             content = path.read_text()
             tree = ast.parse(content)
             return ast.get_docstring(tree)
-        except Exception:
-            pass
+        except Exception:  # nosec B110
+            pass  # Silently ignore unparseable files
     return None
 
 
@@ -125,9 +125,7 @@ def _count_modules(node: ModuleNode) -> tuple[int, int]:
     return modules, files
 
 
-def _parse_python_file(path: Path) -> tuple[
-    list[ClassInfo], list[FunctionInfo], list[str], str | None
-]:
+def _parse_python_file(path: Path) -> tuple[list[ClassInfo], list[FunctionInfo], list[str], str | None]:
     """Parse a Python file and extract classes, functions, and imports."""
     content = path.read_text()
     tree = ast.parse(content)
@@ -193,8 +191,8 @@ def _parse_python_file(path: Path) -> tuple[
 
 def _get_attribute_name(node: ast.Attribute) -> str:
     """Get the full name of an attribute access."""
-    parts = []
-    current = node
+    parts: list[str] = []
+    current: ast.expr = node
     while isinstance(current, ast.Attribute):
         parts.append(current.attr)
         current = current.value
@@ -288,7 +286,7 @@ def get_file_content(path: str) -> FileContent:
         if not str(file_path).startswith(str(fusion_root.resolve())):
             raise HTTPException(status_code=403, detail="Access denied")
     except Exception:
-        raise HTTPException(status_code=400, detail="Invalid path")
+        raise HTTPException(status_code=400, detail="Invalid path") from None
 
     if not file_path.exists():
         raise HTTPException(status_code=404, detail=f"File not found: {path}")
@@ -325,9 +323,9 @@ def get_file_content(path: str) -> FileContent:
     if suffix == ".py":
         try:
             classes, functions, imports, docstring = _parse_python_file(file_path)
-        except SyntaxError:
+        except SyntaxError:  # nosec B110
             pass  # Invalid Python syntax, just return content
-        except Exception:
+        except Exception:  # nosec B110
             pass  # Other parsing errors
 
     return FileContent(
@@ -373,12 +371,14 @@ def search_codebase(q: str, limit: int = 20) -> list[dict]:
 
             # Match file name
             if query in file.lower():
-                results.append({
-                    "type": "file",
-                    "name": file,
-                    "path": rel_path,
-                    "match": "filename",
-                })
+                results.append(
+                    {
+                        "type": "file",
+                        "name": file,
+                        "path": rel_path,
+                        "match": "filename",
+                    }
+                )
 
             # For Python files, also search classes and functions
             if file.endswith(".py") and len(results) < limit:
@@ -389,24 +389,28 @@ def search_codebase(q: str, limit: int = 20) -> list[dict]:
                     for node in ast.iter_child_nodes(tree):
                         if isinstance(node, ast.ClassDef):
                             if query in node.name.lower():
-                                results.append({
-                                    "type": "class",
-                                    "name": node.name,
-                                    "path": rel_path,
-                                    "line": node.lineno,
-                                    "match": "class",
-                                })
+                                results.append(
+                                    {
+                                        "type": "class",
+                                        "name": node.name,
+                                        "path": rel_path,
+                                        "line": node.lineno,
+                                        "match": "class",
+                                    }
+                                )
                         elif isinstance(node, ast.FunctionDef | ast.AsyncFunctionDef):
                             if query in node.name.lower():
-                                results.append({
-                                    "type": "function",
-                                    "name": node.name,
-                                    "path": rel_path,
-                                    "line": node.lineno,
-                                    "match": "function",
-                                })
-                except Exception:
-                    pass
+                                results.append(
+                                    {
+                                        "type": "function",
+                                        "name": node.name,
+                                        "path": rel_path,
+                                        "line": node.lineno,
+                                        "match": "function",
+                                    }
+                                )
+                except Exception:  # nosec B110
+                    pass  # Skip files that can't be parsed
 
             if len(results) >= limit:
                 break

fusion/api/routes/runs.py

@@ -4,6 +4,8 @@
 Provides CRUD operations for simulation runs and log streaming.
 """
 
+from typing import Annotated
+
 from fastapi import APIRouter, Depends, HTTPException, Query, status
 from sqlalchemy.orm import Session
 from sse_starlette.sse import EventSourceResponse
@@ -14,6 +16,9 @@
 from ..services.progress_watcher import stream_progress
 from ..services.run_manager import RunManager, stream_run_logs
 
+# Type alias for dependency injection
+DBSession = Annotated[Session, Depends(get_db)]
+
 router = APIRouter()
 
 
@@ -52,7 +57,7 @@ def _run_to_response(run: Run) -> RunResponse:
 @router.post("", response_model=RunResponse, status_code=status.HTTP_201_CREATED)
 def create_run(
     data: RunCreate,
-    db: Session = Depends(get_db),
+    db: DBSession,
 ) -> RunResponse:
     """
     Create and start a new simulation run.
@@ -65,17 +70,17 @@ def create_run(
     try:
         run = manager.create_run(data)
     except ValueError as e:
-        raise HTTPException(status_code=400, detail=str(e))
+        raise HTTPException(status_code=400, detail=str(e)) from e
 
     return _run_to_response(run)
 
 
 @router.get("", response_model=RunListResponse)
 def list_runs(
+    db: DBSession,
     status_filter: str | None = Query(None, alias="status"),
     limit: int = Query(50, ge=1, le=100),
     offset: int = Query(0, ge=0),
-    db: Session = Depends(get_db),
 ) -> RunListResponse:
     """
     List all runs with optional filtering.
@@ -104,7 +109,7 @@ def list_runs(
 
 
 @router.get("/{run_id}", response_model=RunResponse)
-def get_run(run_id: str, db: Session = Depends(get_db)) -> RunResponse:
+def get_run(run_id: str, db: DBSession) -> RunResponse:
     """
     Get details for a specific run.
 
@@ -119,7 +124,7 @@ def get_run(run_id: str, db: Session = Depends(get_db)) -> RunResponse:
 
 
 @router.delete("/{run_id}", response_model=RunResponse)
-def cancel_run(run_id: str, db: Session = Depends(get_db)) -> RunResponse:
+def cancel_run(run_id: str, db: DBSession) -> RunResponse:
     """
     Cancel a running job or delete a completed one.
 
@@ -137,8 +142,8 @@ def cancel_run(run_id: str, db: Session = Depends(get_db)) -> RunResponse:
 @router.get("/{run_id}/logs")
 async def stream_logs(
     run_id: str,
+    db: DBSession,
     from_start: bool = Query(True, description="Whether to send existing content"),
-    db: Session = Depends(get_db),
 ) -> EventSourceResponse:
     """
     Stream logs via Server-Sent Events.
@@ -158,7 +163,7 @@ async def stream_logs(
 @router.get("/{run_id}/progress")
 async def stream_run_progress(
     run_id: str,
-    db: Session = Depends(get_db),
+    db: DBSession,
 ) -> EventSourceResponse:
     """
     Stream progress events via Server-Sent Events.

fusion/api/routes/system.py

@@ -25,7 +25,7 @@ def get_version() -> dict:
     Returns the current API version and FUSION version.
     """
     try:
-        from fusion import __version__ as fusion_version
+        from fusion import __version__ as fusion_version  # type: ignore[attr-defined]
     except ImportError:
         fusion_version = "unknown"
 

fusion/api/services/progress_watcher.py

@@ -10,7 +10,7 @@
 from collections.abc import AsyncGenerator
 from pathlib import Path
 
-import aiofiles
+import aiofiles  # type: ignore[import-untyped]
 
 from ..config import settings
 from ..db.database import SessionLocal
@@ -121,7 +121,7 @@ def parse_progress_file(progress_path: Path) -> list[dict]:
     :param progress_path: Path to the progress.jsonl file.
     :returns: List of progress event dictionaries.
     """
-    events = []
+    events: list[dict] = []
     if not progress_path.exists():
         return events
 

fusion/api/services/run_manager.py

@@ -23,7 +23,7 @@
 from datetime import datetime
 from pathlib import Path
 
-import aiofiles
+import aiofiles  # type: ignore[import-untyped]
 from sqlalchemy.orm import Session
 
 from ..config import settings
@@ -92,7 +92,8 @@ def get_run(self, run_id: str) -> Run | None:
         :param run_id: The run identifier.
         :returns: The Run object or None if not found.
         """
-        return self.db.query(Run).filter(Run.id == run_id).first()
+        result: Run | None = self.db.query(Run).filter(Run.id == run_id).first()
+        return result
 
     def cancel_or_delete(self, run_id: str) -> Run | None:
         """
@@ -101,7 +102,7 @@ def cancel_or_delete(self, run_id: str) -> Run | None:
         :param run_id: The run identifier.
         :returns: The Run object or None if not found.
         """
-        run = self.db.query(Run).filter(Run.id == run_id).first()
+        run: Run | None = self.db.query(Run).filter(Run.id == run_id).first()
         if not run:
             return None
 
@@ -152,7 +153,7 @@ def _start_process(self, run: Run, config_path: Path) -> None:
                     cmd,
                     stdout=log_file,
                     stderr=subprocess.STDOUT,
-                    creationflags=subprocess.CREATE_NEW_PROCESS_GROUP,
+                    creationflags=subprocess.CREATE_NEW_PROCESS_GROUP,  # type: ignore[attr-defined]
                 )
                 run.pgid = None  # Windows doesn't use pgid
             else:
@@ -183,7 +184,7 @@ def _kill_process(self, run: Run) -> None:
         try:
             if platform.system() == "Windows":
                 # Windows: use taskkill to kill process tree
-                subprocess.run(
+                subprocess.run(  # nosec B607
                     ["taskkill", "/T", "/F", "/PID", str(run.pid)],
                     capture_output=True,
                 )
@@ -262,7 +263,7 @@ def _is_process_alive(pid: int | None, pgid: int | None) -> bool:
     if platform.system() == "Windows":
         # Windows: check if process exists
         try:
-            subprocess.run(
+            subprocess.run(  # nosec B607
                 ["tasklist", "/FI", f"PID eq {pid}"],
                 capture_output=True,
                 check=True,