Refactor: finish trimming app.py into a stable composition layer

[techmore]

Summary

This issue is still valid, but it is now a composition-layer cleanup issue rather than an "everything lives in app.py" problem.

The codex/runtime-contract-fixes branch moved a large amount of runtime logic out of app.py. The file is now roughly 786 lines and mostly acts as runtime composition plus a smaller set of app-owned adapters.

What Changed

The refactor branch moved major responsibilities into shared modules, including:

• bootstrap/runtime startup policy
• auth-hardened Socket.IO registration
• client state handling
• runtime-info handlers
• core routes
• scan job handlers
• connection replay handling
• scanning helpers
• auto-scan execution
• reporting helpers
• workflow context builders
• validation and networking helpers

Remaining Work

What remains is narrower architectural work:

• keep trimming app-specific wiring where module boundaries are already stable
• decide whether more runtime composition should move into factories/builders
• preserve clarity so startup/runtime behavior is still easy to trace
• avoid reintroducing helper wrappers or duplicate orchestration paths

Recommendation

Keep this issue open as a low-to-medium priority cleanup item behind the higher-value runtime, reporting, and CI tickets tracked in #108.

[techmore]

Another #81 composition-layer cleanup landed on codex/runtime-contract-fixes.

What changed:

• moved IdleStateManager out of app.py into nmapui/idle_state.py
• app.py now imports and instantiates the shared idle-state manager instead of carrying the class definition inline
• added runtime contract coverage so app.py stays on the shared module

Verification:

• ./.venv/bin/python -m pytest -q /Users/techmore/projects/NmapUI/tests/test_runtime_contract.py -> 38 passed
• ./.venv/bin/python -m pytest -q -> 135 passed

Commit: 4bcd3a0 Extract idle state manager

[techmore]

Added another #81 cleanup on codex/runtime-contract-fixes.

What changed:

• moved the scan-workflow runner and broadcast fanout logic out of app.py into nmapui/scan_runtime.py
• app.py now delegates scan task execution to the shared runtime helper instead of building the scan workflow context inline
• runtime contract coverage now pins that module boundary

Verification:

• ./.venv/bin/python -m pytest -q /Users/techmore/projects/NmapUI/tests/test_runtime_contract.py -> 38 passed
• ./.venv/bin/python -m pytest -q -> 135 passed
• ./.venv/bin/python -m py_compile /Users/techmore/projects/NmapUI/app.py /Users/techmore/projects/NmapUI/nmapui/scan_runtime.py

Commit: 0ce3aaa Extract scan runtime runner

[techmore]

Added another #81 cleanup on codex/runtime-contract-fixes.

What changed:

• moved report-generation runtime wiring out of app.py into nmapui/report_runtime.py
• app.py now delegates both the main report-generation path and the saved-PDF path to the shared report runtime helper
• runtime contract coverage now pins the new report_runtime boundary

Verification:

• ./.venv/bin/python -m pytest -q /Users/techmore/projects/NmapUI/tests/test_runtime_contract.py -> 38 passed
• ./.venv/bin/python -m pytest -q -> 135 passed
• ./.venv/bin/python -m py_compile /Users/techmore/projects/NmapUI/app.py /Users/techmore/projects/NmapUI/nmapui/report_runtime.py

Commit: d94a4ac Extract report runtime wiring

[techmore]

Added another #81 cleanup on codex/runtime-contract-fixes.

What changed:

• moved the remaining app-level startup/auto-scan wrapper functions into nmapui/app_runtime.py
• app.py now delegates auto-scan execution, startup checks, and auto-scan thread startup to the shared runtime helper instead of assembling those wrappers inline
• runtime contract coverage now pins the new app_runtime boundary

Verification:

• ./.venv/bin/python -m pytest -q /Users/techmore/projects/NmapUI/tests/test_runtime_contract.py -> 38 passed
• ./.venv/bin/python -m pytest -q -> 135 passed
• ./.venv/bin/python -m py_compile /Users/techmore/projects/NmapUI/app.py /Users/techmore/projects/NmapUI/nmapui/app_runtime.py

Commit: 3ada89b Extract app runtime wrappers

[techmore]

Added another #81 cleanup on codex/runtime-contract-fixes.

What changed:

• moved the traceroute dependency bundle and runtime wrapper out of app.py into nmapui/traceroute_runtime.py
• app.py now builds traceroute deps through the shared runtime helper and uses that helper for both direct startup traceroute and runtime-info handler wiring
• runtime contract coverage now pins the new traceroute_runtime boundary

Verification:

• ./.venv/bin/python -m pytest -q /Users/techmore/projects/NmapUI/tests/test_runtime_contract.py -> 38 passed
• ./.venv/bin/python -m pytest -q -> 135 passed
• ./.venv/bin/python -m py_compile /Users/techmore/projects/NmapUI/app.py /Users/techmore/projects/NmapUI/nmapui/traceroute_runtime.py

Commit: cf8888f Extract traceroute runtime wiring