[high] Fix cache loss when markdown report write fails

[elhoim]

BLUF — An unwritable --markdown-output path crashes the CLI and throws away the whole run's fresh cache.

• Problem — In main() in bin/cli.py the markdown report write is the only unguarded file I/O and it runs before save_cache, so pointing --markdown-output at a path whose parent directory does not exist raises FileNotFoundError, escapes as a traceback, and discards every freshly fetched cache entry from that run.
• Fix — Moves the cache_dirty and save_cache block to run immediately after the query loop, and wraps the markdown write in try/except OSError, printing an error and returning exit code 1.
• Effect — A bad output path now costs a clear message instead of a crash and re-fetching paid or rate-limited module responses.

Finding 10 (High) — bin/cli.py:1075-1088

Problem

The markdown write is the only unguarded file I/O in main() and runs before save_cache (:1090). --markdown-output /no/such/dir/report.md raises FileNotFoundError, escapes main() as a traceback, and discards every fresh (possibly paid/rate-limited) cache entry from that run.

Fix

Finding #10 (markdown-write-loses-cache, high): in main() of bin/cli.py, the markdown-report file write ran unguarded after the query loop but before save_cache(). An unwritable --markdown-output path (e.g. missing parent directory) raised an unhandled FileNotFoundError that escaped main() as a traceback, discarding every freshly-fetched cache entry from that run (potentially paid/rate-limited module responses). Fix: moved the cache_dirty/save_cache block to run immediately after the query loop, before any markdown output work, and wrapped the markdown file write in try/except OSError so a bad output path now prints an error and returns exit code 1 instead of crashing — and in both cases the cache is now safely persisted first.

Verification

Reproduced against the unmodified code at 9b8c605, then re-checked after the change.

Before

python repro.py (query loop stubbed via monkeypatched fetch_modules/fetch_describe_types/query_module, --markdown-output /no/such/dir/report.md) on commit 9b8c605:
  Traceback (most recent call last):
    File "bin/cli.py", line 1086, in main
      with open(args.markdown_output, "w", encoding="utf-8") as f:
  FileNotFoundError: [Errno 2] No such file or directory: '/no/such/dir/report.md'
  main() RAISED (escaped as traceback)
  === cache file exists? === False   (fresh cache entry from the run was lost)

After

Same repro.py against the fix:
  [!] Unable to write markdown report to /no/such/dir/report.md: [Errno 2] No such file or directory: '/no/such/dir/report.md'
  main() returned 1
  === cache file exists? === True    (cache.json now contains the fresh entry for fake_module/hostname/example.com)

python bin/cli.py --help exits 0 and the module still imports cleanly. Verification was performed offline against the pure functions — no running misp-modules instance is required.

Branched from 9b8c605. This PR addresses only this finding; the other findings from the same review are in separate PRs, so they will need rebasing against each other as they merge.

🤖 Generated with Claude Code