Code quality: pin dependencies, sanitize SQL, refresh tests, remove dead code

README.md

@@ -89,9 +89,7 @@ carrie/
 │   │   └── streaming_agent.py    # OpenAI agent for answers
 │   ├── actions/
 │   │   ├── transcribe_youtube.py # YouTube transcription + embedding
-│   │   ├── process_slides.py     # PDF slide extraction
-│   │   ├── embed.py              # Embedding generation
-│   │   └── bundle.py             # Embedding bundling (legacy)
+│   │   └── process_slides.py     # PDF slide extraction
 │   ├── clients/
 │   │   ├── openai.py             # Async OpenAI client
 │   │   └── supabase.py           # Async Supabase client

backend/README.md

@@ -173,10 +173,10 @@ OPENAI_API_KEY=sk-...
 
 ## Error Responses
 
-**404 Not Found** - No bundled embeddings found:
+**404 Not Found** - Source data not found:
 ```json
 {
-  "detail": "No bundled embeddings found. Run actions/bundle.py to create one."
+  "detail": "No source data available for the requested query."
 }
 ```
 

backend/requirements.txt

@@ -11,4 +11,4 @@ httpx==0.28.1
 youtube-transcript-api==1.2.3
 supabase==2.24.0
 langfuse==3.10.5
-openinference-instrumentation-openai-agents
+openinference-instrumentation-openai-agents==0.1.14

backend/services/rag_service.py

@@ -3,6 +3,11 @@
 from clients import get_supabase, get_embedding
 
 
+def escape_sql_wildcards(text: str) -> str:
+    """Escape wildcard characters for LIKE/ILIKE clauses."""
+    return text.replace("\\", "\\\\").replace("%", "\\%").replace("_", "\\_")
+
+
 class RAGService:
     """Service for RAG operations: embedding and search"""
 
@@ -21,7 +26,8 @@ async def list_sessions(self, filter_term: str = None) -> List[Dict]:
         query = supabase.table("sources").select("session_info, chunk_count, processed_at").order("processed_at", desc=True)
 
         if filter_term:
-            query = query.ilike("session_info", f"%{filter_term}%")
+            sanitized_filter = escape_sql_wildcards(filter_term)
+            query = query.ilike("session_info", f"%{sanitized_filter}%")
 
         results = await query.execute()
 
@@ -56,7 +62,7 @@ async def search_meeting_notes(self, query: str, top_k: int = 5, session_filter:
             "match_count": top_k
         }
         if session_filter:
-            rpc_params["session_filter"] = session_filter
+            rpc_params["session_filter"] = escape_sql_wildcards(session_filter)
 
         # Use Supabase RPC for vector similarity search
         results = await supabase.rpc("match_embeddings", rpc_params).execute()

backend/tests/test_backend.py

@@ -1,53 +1,14 @@
-#!/usr/bin/env python3
-"""Quick test script for the backend API"""
-
-import sys
 from pathlib import Path
+import sys
 
-# Add backend directory to path
-sys.path.insert(0, str(Path(__file__).resolve().parent))
-
-from services.rag_service import RAGService
-
-def test_rag_service():
-    """Test the RAG service functionality"""
-    print("Testing RAG Service...")
-    print("=" * 50)
 
+def test_app_import_smoke():
+    """Smoke test that the FastAPI app module imports and exposes `app`."""
+    backend_dir = Path(__file__).resolve().parents[1]
+    sys.path.insert(0, str(backend_dir))
     try:
-        # Initialize service
-        service = RAGService()
-        print("✓ RAG Service initialized")
-
-        # Test search
-        test_query = "What is AI?"
-        print(f"\nSearching for: '{test_query}'")
-        results = service.search_meeting_notes(test_query, top_k=3)
-        print(f"✓ Found {len(results)} results")
-
-        if results:
-            print("\nTop result:")
-            print(f"  Year/Month: {results[0]['year']}/{results[0]['month']}")
-            print(f"  Slide: {results[0]['slide']}")
-            print(f"  Score: {results[0]['score']:.4f}")
-            print(f"  Text: {results[0]['text'][:100]}...")
-
-        print("\n" + "=" * 50)
-        print("✓ All tests passed!")
-        return True
-
-    except FileNotFoundError as e:
-        print(f"\n✗ Error: {e}")
-        print("\nMake sure you have:")
-        print("1. Run 'python -m backend.actions.bundle' to create bundled embeddings")
-        print("2. Set OPENAI_API_KEY in your .env file")
-        return False
-    except Exception as e:
-        print(f"\n✗ Unexpected error: {e}")
-        import traceback
-        traceback.print_exc()
-        return False
+        from app import app
+    finally:
+        sys.path.pop(0)
 
-if __name__ == "__main__":
-    success = test_rag_service()
-    sys.exit(0 if success else 1)
+    assert app is not None