fix: suppress stack trace exposure in worker status page

[GeiserX]

Summary

Fixes CodeQL alert #2 — CWE-209/CWE-497 stack trace information exposure.

The raw exception message from failed heartbeats (str(exc)) was stored in _last_error and rendered directly in the worker HTML status page. This could leak internal implementation details (file paths, hostnames, connection strings) to anyone viewing the worker status page.

Change

Replace _last_error = str(exc) with _last_error = "connection failed". Full exception details remain in server logs via logger.warning().

Test plan

• CI passes (ruff, tests, CodeQL)
• CodeQL alert docker: bump python from 3.12-alpine to 3.14-alpine #2 resolves after merge

Summary by CodeRabbit

• Bug Fixes
  • Status page now displays a standardized "connection failed" message when heartbeat transmission fails, providing clearer error reporting to users.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: d5268d48-d964-401b-a49a-c54dd7dcdf1c

📥 Commits

Reviewing files that changed from the base of the PR and between b9b3d61 and efa82df.

📒 Files selected for processing (1)

• app/worker_api.py

---

📝 Walkthrough

Walkthrough

The _send_heartbeat error handler in app/worker_api.py now assigns a constant string "connection failed" to _last_error instead of capturing the actual exception message. This modifies the error state displayed on the status page while preserving existing warning log and connection state behaviors.

Changes

Cohort / File(s)	Summary
Heartbeat Error Handling app/worker_api.py	Modified _send_heartbeat exception handling to store constant "connection failed" string instead of actual exception message in _last_error.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~5 minutes

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: replacing exception message exposure with a generic error string to prevent stack trace leakage in the worker status page.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/codeql-stack-trace-exposure

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}