coospo-cli 0.1.0__tar.gz → 0.2.0__tar.gz

coospo_cli-0.2.0/MANIFEST.in

@@ -0,0 +1,3 @@
+include PROTOCOL.md
+recursive-include contrib *
+recursive-include tools *.py

{coospo_cli-0.1.0 → coospo_cli-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: coospo-cli
-Version: 0.1.0
+Version: 0.2.0
 Summary: Command-line tool for COOSPO CS500/CS600 bike computers: device info, battery, memory usage and FIT file download over Bluetooth LE
 License-Expression: GPL-3.0-or-later
 Project-URL: Homepage, https://github.com/blshkv/coospo-cli
@@ -14,7 +14,7 @@ Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3
 Classifier: Topic :: System :: Hardware
 Classifier: Topic :: Utilities
-Requires-Python: >=3.9
+Requires-Python: >=3.13
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: bleak>=0.22
@@ -28,7 +28,7 @@ CoospoRide app.
 
 ```
 $ coospo info
-Searching for CS500 or CS600...
+Searching for Coospo compatible device...
 Connected to CS500-1234567
 Model:     CS500
 Serial:    1234567
@@ -53,7 +53,7 @@ If you own a CS600 or another model, please report whether it works in an
 
 ## Installation
 
-Requires Python 3.9+ and a Bluetooth LE adapter. It uses [bleak](https://github.com/hbldh/bleak), so
+Requires Python 3.13+ and a Bluetooth LE adapter. It uses [bleak](https://github.com/hbldh/bleak), so
 it should run on Linux (BlueZ), Windows and macOS; so far it's been tested on Linux.
 
 ```
@@ -120,6 +120,31 @@ what the official app does:
 your location, device addresses and ride history. Describe what you did and share the relevant
 frames instead.
 
+## Automatic sync
+
+`coospo sync` downloads the activities the index (`~/.local/state/coospo/index.db`) does not know
+yet. `coospo watch` does the same whenever the device comes into range, at most once per `--interval`
+(default 10 minutes). Both can pass each new activity to a command, e.g. an uploader:
+
+```
+coospo init                                  # once: ignore the rides already on the device
+coospo watch --post-sync ~/bin/strava-upload
+```
+
+`contrib/strava-upload` is such an uploader for Strava (standard library only). Create an API
+application at strava.com/settings/api with the callback domain `localhost`, copy the script to
+`~/bin`, and run `strava-upload auth` once.
+
+- The command is run as `CMD FILE`, with `COOSPO_FILE`, `COOSPO_SERIAL` and `COOSPO_ACTIVITY_TIME`
+  in the environment. If it exits non-zero it is retried with growing delays (1 min up to 6 h).
+- Downloaded files are deleted once the command succeeds. With `--output DIR` they are kept there.
+  Without `--post-sync`, files are always kept (default `~/.local/share/coospo/fit_files`).
+- A file that is still being recorded is not a complete FIT file; it is skipped and fetched again later.
+- Settings can go in `~/.config/coospo/config.toml` (or `$XDG_CONFIG_HOME/coospo/config.toml`, or
+  the file given with `-c`): `name`, `address`, `scan_timeout`, `output`, `post_sync`, `interval`.
+  See `contrib/config.toml` for a commented sample.
+- `contrib/` has a systemd user unit and an OpenRC init script that run `coospo watch`.
+
 ## Development
 
 ```

coospo_cli-0.2.0/PROTOCOL.md

@@ -0,0 +1,236 @@
+# COOSPO CS500 BLE file-transfer protocol
+
+Reverse-engineered notes for downloading files (FIT activities, `filelist.txt`, `Setting.json`) from a
+COOSPO CS500 bike computer over Bluetooth LE, without the CoospoRide app.
+
+- Source: an Android HCI snoop log of CoospoRide syncing with the device, plus live tests with
+  [bleak](https://github.com/hbldh/bleak) on Linux/BlueZ.
+- Tested device: CS500, hardware V1.41, firmware V1.5.0.
+- Reference implementation: the `coospo` package in this repository (`src/coospo/`, Python 3.9+,
+  bleak).
+- All example frames below are re-encoded with made-up values (serial number, timestamps, file names),
+  but they have valid lengths and CRCs.
+
+Status legend: **confirmed** = seen in the capture and exercised by the reference implementation;
+**observed** = seen in the capture only; **unknown** = not understood yet.
+
+## 1. GATT layout
+
+The device advertises as `CS500-<serial>`. It does **not** expose the Nordic UART service
+(`6e400001-b5a3-f393-e0a9-e50e24dcca9e`) used by XOSS/Cycplus/older COOSPO devices, and it does not
+answer their YMODEM-style commands.
+
+| Service | Characteristic | Properties | Use |
+|---|---|---|---|
+| `0xFDA0` | `fda1` | write, write-no-rsp, notify | requests / responses |
+| `0xFDA0` | `fda2` | write, write-no-rsp, notify | commands and their acks |
+| `0xFDA0` | `fda3` | write, write-no-rsp, notify | device events and their acks |
+| `0xFDA0` | `fda4` | write, write-no-rsp, notify | raw file data (device → app) |
+| `0xFD00` | `fd09` / `fd0a` | notify / write-no-rsp | separate protocol, see §7 |
+| `0x180A`, `0x180F` | standard | read | Device Information, Battery |
+
+The app enables notifications on `fda1`–`fda4` and `fd09`, then writes all frames with
+write-without-response. The protocol works at any ATT MTU; data packets simply get shorter at
+smaller MTUs.
+
+### 1.1 Link layer — observed
+
+What the CoospoRide session (Android phone as central) showed below the GATT level:
+
+| Item | Observed |
+|---|---|
+| ATT MTU | the **device** starts the MTU exchange requesting 200; the phone offers 517, so 200 is used |
+| LE features of the device | mask `0x4925`: LE Data Packet Length Extension, LE 2M PHY and LE Coded PHY are supported |
+| Data Length Extension | requested by the phone; afterwards max 199 bytes phone → device and 204 bytes device → phone |
+| PHY | never changed: no LE Set PHY or PHY Update Complete in the capture, so the link stays on 1M |
+| Preferred connection parameters (GAP `0x2A04`) | interval 20–40 ms, latency 0, supervision timeout 4 s |
+| Connection parameters used | 18.75 ms at connection; 48.75 ms with latency 5 during the file transfers |
+
+With MTU 200, one data notification is 3 (ATT header) + 197 bytes, which plus the 4-byte L2CAP
+header is exactly 204 bytes, so each `fda4` data packet travels in a single link-layer packet.
+It's not visible in the log who requested the change to 48.75 ms: the device sent no L2CAP
+connection parameter update request.
+
+## 2. Frame format (`fda1`, `fda2`, `fda3`) — confirmed
+
+```
+7e | ctl | len (2, BE) | cmd (2, BE) | payload | crc (2, BE) | 7f
+```
+
+| Field | Description |
+|---|---|
+| `7e` / `7f` | start / end delimiters |
+| `ctl` | high nibble = frame type (§3), low nibble = sequence number 0–15 |
+| `len` | length of the **unescaped** frame **without** the `7e`/`7f` delimiters |
+| `cmd` | command id (§4); absent in ack frames |
+| `payload` | usually a protobuf message (§5); may be empty |
+| `crc` | CRC-16/CCITT-FALSE (poly `0x1021`, init `0xFFFF`, no reflection, xorout 0) over `ctl` … end of `payload` |
+
+**Escaping:** inside the frame (between the delimiters, including the CRC), the bytes `7d`, `7e` and
+`7f` are sent as `7d 01`, `7d 02` and `7d 03`. `len` and `crc` are computed over the unescaped bytes.
+Because `7f` only ever appears as the end delimiter, frames split across notifications can be
+reassembled by buffering until `7f`.
+
+**Ack frames** carry only `ctl`, `len = 0005` and the CRC.
+
+Examples:
+
+```
+7e 00 00 07 00 01 84 bd 7f                     request, seq 0, cmd 0x0001, no payload
+7e 20 00 05 1a ff 7f                           ack of response seq 0
+7e 05 00 0c 00 29 0a 03 61 7d 01 62 0c dc 7f   payload "a}b": the 7d byte is escaped as 7d 01
+```
+
+## 3. Frame types and channels — confirmed
+
+| Type (`ctl & 0xF0`) | Direction | Characteristic | Meaning |
+|---|---|---|---|
+| `0x00` | app → device | `fda1` | request |
+| `0x10` | device → app | `fda1` | response (same seq as the request) |
+| `0x20` | app → device | `fda1` | app acks a response (same seq) |
+| `0x40` | app → device | `fda2` (SET_TIME: `fda1`) | command |
+| `0x60` | device → app | `fda2` | device acks a command (same seq) |
+| `0x80` | device → app | `fda3` | event |
+| `0xA0` | app → device | `fda3` | app acks an event (same seq) |
+
+- The app uses **one** sequence counter for request (`0x0_`) and command (`0x4_`) frames. It wraps at
+  16 and starts at 0 on each connection.
+- The device's event counter (`0x8_`) is independent and was **not** reset on reconnection. Acks
+  simply echo whatever seq the device sent.
+- The app acks every response and every event immediately.
+
+## 4. Commands
+
+| cmd | Frame | Request payload | Response / ack | Status |
+|---|---|---|---|---|
+| `0x0001` | request | – | device info, §5.1 | confirmed |
+| `0x0002` | command | set time, §5.2 | ack | observed |
+| `0x0004` | request | – | `{1:1, 3:1, 4:1, 5:1, 6:1, 9:1, 10:1, 11:1}` (capability flags?) | unknown |
+| `0x0029` | request | fetch file `{1: filename}` | `{1: 1}` when accepted | confirmed |
+| `0x002b` | event (download), command (upload) | file header `{1: filename, 2: sint64 size}` | – | confirmed for download |
+| `0x002c` | command | upload data chunk, §6.2 | ack | observed |
+| `0x002e` | event | end of download, no payload | – | confirmed |
+| `0x002f` | command | `{1: 1}` = download received OK | ack | confirmed |
+| `0x0032` | request | – | empty (status / idle check) | confirmed |
+| `0x0033` | request | – | storage `{1: free, 2: total}` in 512-byte blocks, e.g. `{1: 3384, 2: 55168}` = 25.3M/26.9M used (93%) | confirmed |
+| `0x0036` | request | – | GNSS/AGPS info, §5.3 | observed |
+
+## 5. Payloads
+
+Payloads are protobuf wire format with no length prefix. Field numbers are listed below; names are
+guesses.
+
+### 5.1 Device info (`0x0001` response) — confirmed
+
+| Field | Type | Example | Guess |
+|---|---|---|---|
+| 1 | varint | 2 | ? |
+| 2 | varint | 3 | ? |
+| 3 | string | `V1.41` | hardware revision |
+| 4 | string | `V1.5.0` | firmware revision |
+| 5 | string | `1234567` | serial number (also in the advertised name) |
+| 6 | string | `V1.0` | ? |
+| 7 | varint | 200 | ATT MTU? (matches the MTU the device requests, §1.1) |
+
+```
+7e 10 00 2c 00 01 08 02 10 03 1a 05 56 31 2e 34 31 22 06 56 31 2e 35 2e 30
+   2a 07 31 32 33 34 35 36 37 32 04 56 31 2e 30 38 c8 01 51 f9 7f
+```
+
+### 5.2 Set time (`0x0002`) — observed
+
+| Field | Type | Meaning |
+|---|---|---|
+| 1 | fixed32 | Unix time (UTC) |
+| 2 | float | timezone offset in hours |
+
+The app sends it once per connection, **on `fda1`** with command type `0x4_`; the device acks it on
+`fda2`. Example for 2026-01-01 00:00:00 UTC, UTC+0:
+
+```
+7e 44 00 11 00 02 0d 00 b9 55 69 15 00 00 00 00 c5 b4 7f
+```
+
+### 5.3 GNSS info (`0x0036` response) — observed
+
+`{3: "UBX 10", 4: fixed32 Unix time, 5: varint, 6: {1: varint, 2: float latitude, 3: float longitude}}`.
+This looks like the GNSS receiver model plus the last position/time, probably used for AGPS. Not
+needed for file transfer.
+
+## 6. File transfer
+
+### 6.1 Download (device → app) — confirmed
+
+```
+fda1  → 7e 01 00 07 00 32 28 dc 7f                        STATUS request
+fda1  ← 7e 11 00 07 00 32 2c 86 7f                        STATUS response
+fda1  → 7e 21 00 05 …                                     ack
+fda1  → 7e 02 00 15 00 29 0a 0c "filelist.txt" 6f ca 7f  FETCH_FILE {1: "filelist.txt"}
+fda1  ← 7e 12 00 09 00 29 08 01 8f f5 7f                  accepted {1: 1}
+fda1  → 7e 22 00 05 …                                     ack
+fda3  ← 7e 80 00 18 00 2b 0a 0c "filelist.txt" 10 88 2d a5 f8 7f
+                                                          FILE_HEADER {1: name, 2: 5768 → size 2884}
+fda3  → 7e a0 00 05 21 a5 7f                              ack
+fda4  ← data packets 0, 1, 2, …
+fda3  ← 7e 81 00 07 00 2e d9 b1 7f                        FILE_DONE
+fda3  → 7e a1 00 05 …                                     ack
+fda2  → 7e 43 00 09 00 2f 08 01 6f a3 7f                  FILE_CONFIRM {1: 1}
+fda2  ← 7e 63 00 05 5e 02 7f                              ack
+```
+
+- **File size:** field 2 of FILE_HEADER is a zigzag-encoded (`sint`) varint, so the raw value is
+  twice the size. `5768` → `2884` bytes.
+- **Data packets on `fda4`:** they are not framed or escaped:
+
+  ```
+  index (4, BE, starting at 0) | data | checksum (1)
+  ```
+
+  `checksum = sum(index + data) & 0xFF`. With MTU 200 each packet carries 192 data bytes; the last
+  one is shorter. Concatenating the data of all packets gives exactly the header size. No per-packet
+  acks or retransmission were observed; the device streams the whole file.
+- The file list is plain text, one `YYYYMMDDhhmmss.fit <size>` entry per line, separated by CRLF.
+  FIT files are fetched by these names with the same sequence.
+- FILE_CONFIRM does not appear to delete anything: a fetched FIT file is still listed afterwards.
+  What happens without FILE_CONFIRM, or with `{1: 0}`, is unknown.
+
+Reference transfers:
+- CoospoRide (Android): `Setting.json` (14.6 KB) streamed in about 2 s, roughly 60 kbit/s of file
+  data, at a 48.75 ms connection interval with DLE and 1M PHY (§1.1). The connection interval
+  probably limits this more than the packet size does.
+- coospo-cli (Linux/BlueZ): an 82 KB FIT file took about 8 s, including scanning and connecting.
+
+### 6.2 Upload (app → device) — partially observed, not implemented
+
+The app uploaded a short `Setting.json` fragment that sets the timezone. For
+`{"time_profile":{"time_zone":0}}` (32 bytes) the frames would be:
+
+```
+fda2  → command 0x002b {1: "Setting.json", 2: 64 (zigzag → 32)}   ← ack on fda2
+fda2  → command 0x002c payload: 00 03 + raw JSON bytes (not protobuf)  ← ack on fda2
+```
+
+The meaning of the 2-byte prefix `00 03` is unknown, as is how larger files are chunked.
+
+## 7. Service `0xFD00` (`fd0a` → `fd09`) — observed
+
+This service uses a separate, simpler framing:
+
+```
+lead (a2 app → device, d2 device → app) | total length (1) | cmd (1) | data | sum8 of all preceding bytes
+```
+
+The app sent two queries:
+
+```
+fd0a → a2 04 80 26          fd09 ← d2 0b 80 00 <6-byte address> <sum>
+fd0a → a2 04 82 28          fd09 ← d2 0a 82 "COOSPO" 31
+```
+
+Its purpose is unclear (possibly bootloader or OTA related). File transfer doesn't need it.
+
+## 8. Other notes
+
+- The device's `Setting.json` contains `"display_profile": {"version": "BC600_V1.3", …}`, which
+  suggests other current COOSPO models (e.g. the BC600) may share this protocol. Not tested.
+- The device stops advertising while another central (e.g. the phone app) is connected to it.

{coospo_cli-0.1.0 → coospo_cli-0.2.0}/README.md

@@ -6,7 +6,7 @@ CoospoRide app.
 
 ```
 $ coospo info
-Searching for CS500 or CS600...
+Searching for Coospo compatible device...
 Connected to CS500-1234567
 Model:     CS500
 Serial:    1234567
@@ -31,7 +31,7 @@ If you own a CS600 or another model, please report whether it works in an
 
 ## Installation
 
-Requires Python 3.9+ and a Bluetooth LE adapter. It uses [bleak](https://github.com/hbldh/bleak), so
+Requires Python 3.13+ and a Bluetooth LE adapter. It uses [bleak](https://github.com/hbldh/bleak), so
 it should run on Linux (BlueZ), Windows and macOS; so far it's been tested on Linux.
 
 ```
@@ -98,6 +98,31 @@ what the official app does:
 your location, device addresses and ride history. Describe what you did and share the relevant
 frames instead.
 
+## Automatic sync
+
+`coospo sync` downloads the activities the index (`~/.local/state/coospo/index.db`) does not know
+yet. `coospo watch` does the same whenever the device comes into range, at most once per `--interval`
+(default 10 minutes). Both can pass each new activity to a command, e.g. an uploader:
+
+```
+coospo init                                  # once: ignore the rides already on the device
+coospo watch --post-sync ~/bin/strava-upload
+```
+
+`contrib/strava-upload` is such an uploader for Strava (standard library only). Create an API
+application at strava.com/settings/api with the callback domain `localhost`, copy the script to
+`~/bin`, and run `strava-upload auth` once.
+
+- The command is run as `CMD FILE`, with `COOSPO_FILE`, `COOSPO_SERIAL` and `COOSPO_ACTIVITY_TIME`
+  in the environment. If it exits non-zero it is retried with growing delays (1 min up to 6 h).
+- Downloaded files are deleted once the command succeeds. With `--output DIR` they are kept there.
+  Without `--post-sync`, files are always kept (default `~/.local/share/coospo/fit_files`).
+- A file that is still being recorded is not a complete FIT file; it is skipped and fetched again later.
+- Settings can go in `~/.config/coospo/config.toml` (or `$XDG_CONFIG_HOME/coospo/config.toml`, or
+  the file given with `-c`): `name`, `address`, `scan_timeout`, `output`, `post_sync`, `interval`.
+  See `contrib/config.toml` for a commented sample.
+- `contrib/` has a systemd user unit and an OpenRC init script that run `coospo watch`.
+
 ## Development
 
 ```

coospo_cli-0.2.0/contrib/config.toml

@@ -0,0 +1,22 @@
+# Sample coospo config. Copy it to ~/.config/coospo/config.toml
+# ($XDG_CONFIG_HOME/coospo/config.toml if that variable is set), or pass another file with -c.
+# Every setting is optional; command-line options override the file.
+
+# Connect to the device whose Bluetooth name contains this (default: any CS500 or CS600).
+# name = "CS500-1234567"
+
+# Connect to this Bluetooth address instead.
+# address = "AA:BB:CC:DD:EE:FF"
+
+# Seconds to search for the device (default: 30).
+# scan_timeout = 30
+
+# Keep downloaded activities in this directory. Without it, files are deleted once post_sync
+# succeeds, and kept in ~/.local/share/coospo/fit_files if there is no post_sync.
+# output = "~/rides"
+
+# Command run as "CMD FILE" for every new activity, e.g. an uploader. Run `coospo init` first.
+# post_sync = "/home/me/bin/strava-upload"
+
+# `coospo watch`: minimum seconds between two syncs of the same device (default: 600).
+# interval = 600

coospo_cli-0.2.0/contrib/openrc/coospo

@@ -0,0 +1,24 @@
+#!/sbin/openrc-run
+# Install: cp contrib/openrc/coospo /etc/init.d/ && rc-update add coospo default
+# OpenRC has no user services, so this runs as a normal user. Set the user in
+# /etc/conf.d/coospo (see coospo.confd); that user must be in the bluetooth group and
+# must have run `coospo init` and have ~/.config/coospo/config.toml.
+
+description="Sync the COOSPO bike computer when it is in range"
+
+: ${coospo_user:=root}
+
+command="/usr/bin/coospo"
+command_args="watch"
+command_user="${coospo_user}"
+command_background=true
+pidfile="/run/${RC_SVCNAME}.pid"
+output_log="/var/log/${RC_SVCNAME}.log"
+error_log="/var/log/${RC_SVCNAME}.log"
+supervisor=supervise-daemon
+respawn_delay=30
+respawn_max=0   # never give up: the watcher should keep waiting for the device
+
+depend() {
+	need bluetooth
+}

coospo_cli-0.2.0/contrib/openrc/coospo.confd

@@ -0,0 +1,4 @@
+# Install as /etc/conf.d/coospo
+# The user `coospo watch` runs as. It needs to be in the bluetooth group, and `coospo init` and
+# ~/.config/coospo/config.toml belong to this user's home directory.
+coospo_user="alice"

coospo_cli-0.2.0/contrib/strava-upload

@@ -0,0 +1,200 @@
+#!/usr/bin/env python3
+"""Upload a FIT file to Strava; meant to be used as `coospo watch --post-sync`.
+
+  strava-upload auth        one-time: authorize this script (opens the browser)
+  strava-upload test        check the credentials by refreshing the access token
+  strava-upload FILE        upload FILE; exit 0 on success and when Strava already has the activity
+
+Setup: create an API application at https://www.strava.com/settings/api with the authorization
+callback domain "localhost", then run `strava-upload auth` and enter its client ID and secret.
+Tokens are kept in ~/.config/coospo/strava.json (readable by you only; see contrib/strava.json
+for the layout, normally written by `auth`). The activity gets
+Strava's default name; the file name is sent as external_id so Strava can spot duplicates.
+Only the Python standard library is used.
+"""
+
+import http.server
+import json
+import mimetypes
+import os
+import sys
+import time
+import urllib.error
+import urllib.parse
+import urllib.request
+import uuid
+import webbrowser
+
+API = os.environ.get('STRAVA_API', 'https://www.strava.com')   # overridable for testing
+TOKEN_FILE = os.path.join(os.environ.get('XDG_CONFIG_HOME') or os.path.expanduser('~/.config'),
+                          'coospo', 'strava.json')
+POLL_SECONDS = 120   # how long to wait for Strava to process an upload
+
+
+def fail(message, code=1):
+    print(f"strava-upload: {message}", file=sys.stderr)
+    sys.exit(code)
+
+
+def request(method, url, data=None, headers=None):
+    '''Return (status, parsed JSON or {}); network errors exit 1 so the caller retries later.'''
+    req = urllib.request.Request(url, data=data, headers=headers or {}, method=method)
+    try:
+        with urllib.request.urlopen(req, timeout=60) as response:
+            status, body = response.status, response.read()
+    except urllib.error.HTTPError as e:
+        status, body = e.code, e.read()
+    except OSError as e:
+        fail(f"cannot reach Strava: {e}")
+    try:
+        return status, json.loads(body)
+    except ValueError:
+        return status, {}
+
+
+def load_tokens():
+    try:
+        with open(TOKEN_FILE) as file:
+            return json.load(file)
+    except FileNotFoundError:
+        fail(f"{TOKEN_FILE} not found; run 'strava-upload auth' first", 2)
+
+
+def save_tokens(tokens):
+    os.makedirs(os.path.dirname(TOKEN_FILE), exist_ok=True)
+    tmp = TOKEN_FILE + '.tmp'
+    with open(os.open(tmp, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600), 'w') as file:
+        json.dump(tokens, file, indent=2)
+    os.replace(tmp, TOKEN_FILE)
+
+
+def token_request(tokens, **fields):
+    '''POST to the OAuth token endpoint and store the credentials it returns.'''
+    fields.update(client_id=tokens['client_id'], client_secret=tokens['client_secret'])
+    status, reply = request('POST', f'{API}/oauth/token', urllib.parse.urlencode(fields).encode())
+    if status != 200 or 'access_token' not in reply:
+        fail(f"token request failed ({status}): {reply.get('message', reply)}")
+    for key in ('access_token', 'refresh_token', 'expires_at'):
+        tokens[key] = reply[key]
+    save_tokens(tokens)
+
+
+def authorize():
+    client_id = input('Client ID: ').strip()
+    client_secret = input('Client secret: ').strip()
+
+    class Callback(http.server.BaseHTTPRequestHandler):
+        def do_GET(self):
+            query = urllib.parse.parse_qs(urllib.parse.urlparse(self.path).query)
+            if 'code' in query or 'error' in query:   # not for favicon requests and the like
+                self.server.query = query
+            self.send_response(200)
+            self.send_header('Content-Type', 'text/plain')
+            self.end_headers()
+            self.wfile.write(b'strava-upload is authorized; you can close this tab.\n')
+
+        def log_message(self, *args):
+            pass
+
+    server = http.server.HTTPServer(('127.0.0.1', 0), Callback)
+    server.timeout = 5
+    server.query = None
+    redirect = f'http://localhost:{server.server_port}/'
+    url = f'{API}/oauth/authorize?' + urllib.parse.urlencode({
+        'client_id': client_id, 'response_type': 'code', 'redirect_uri': redirect,
+        'approval_prompt': 'auto', 'scope': 'activity:write'})
+    print(f"Open this URL if the browser does not start:\n{url}")
+    webbrowser.open(url)
+    deadline = time.monotonic() + 300
+    while server.query is None:
+        if time.monotonic() > deadline:
+            fail("no answer from the browser after 5 minutes")
+        server.handle_request()
+    query = server.query
+    if 'code' not in query:
+        fail(f"authorization refused: {query.get('error', ['no code'])[0]}")
+    if 'activity:write' not in query.get('scope', ['activity:write'])[0]:
+        fail("the activity:write permission was not granted; run auth again and keep it ticked")
+    token_request({'client_id': client_id, 'client_secret': client_secret},
+                  code=query['code'][0], grant_type='authorization_code')
+    print(f"Done. Tokens saved to {TOKEN_FILE}")
+
+
+def test():
+    tokens = load_tokens()
+    token_request(tokens, grant_type='refresh_token', refresh_token=tokens['refresh_token'])
+    expires = time.strftime('%Y-%m-%d %H:%M:%S', time.localtime(tokens['expires_at']))
+    print(f"Strava accepted the credentials; the new access token is valid until {expires}.")
+
+
+def access_token():
+    tokens = load_tokens()
+    if tokens['expires_at'] < time.time() + 60:
+        token_request(tokens, grant_type='refresh_token', refresh_token=tokens['refresh_token'])
+    return tokens['access_token']
+
+
+def multipart(fields, file_field, path):
+    boundary = uuid.uuid4().hex
+    parts = [f'--{boundary}\r\nContent-Disposition: form-data; name="{k}"\r\n\r\n{v}\r\n'.encode()
+             for k, v in fields.items()]
+    with open(path, 'rb') as file:
+        content = file.read()
+    mime = mimetypes.guess_type(path)[0] or 'application/octet-stream'
+    parts.append(f'--{boundary}\r\nContent-Disposition: form-data; name="{file_field}"; '
+                 f'filename="{os.path.basename(path)}"\r\nContent-Type: {mime}\r\n\r\n'.encode()
+                 + content + b'\r\n')
+    parts.append(f'--{boundary}--\r\n'.encode())
+    return b''.join(parts), f'multipart/form-data; boundary={boundary}'
+
+
+def is_duplicate(error):
+    return bool(error) and 'duplicate' in error.lower()
+
+
+def upload(path):
+    token = access_token()
+    auth = {'Authorization': f'Bearer {token}'}
+    name = os.path.basename(path)
+    body, content_type = multipart({'data_type': 'fit', 'external_id': name}, 'file', path)
+    status, reply = request('POST', f'{API}/api/v3/uploads', body, dict(auth, **{'Content-Type': content_type}))
+    if status == 429 or status >= 500:
+        fail(f"Strava is busy or unavailable ({status}); will retry")
+    if status >= 400:
+        if is_duplicate(reply.get('error')) or any(is_duplicate(e.get('code')) or is_duplicate(e.get('field'))
+                                                   for e in reply.get('errors', [])):
+            print(f"{name}: Strava already has this activity")
+            return
+        fail(f"upload of {name} rejected ({status}): {reply.get('message', reply)}")
+
+    deadline = time.monotonic() + POLL_SECONDS
+    while True:
+        if is_duplicate(reply.get('error')):
+            print(f"{name}: Strava already has this activity")
+            return
+        if reply.get('error'):
+            fail(f"{name}: {reply['error']}")
+        if reply.get('activity_id'):
+            print(f"{name}: https://www.strava.com/activities/{reply['activity_id']}")
+            return
+        if time.monotonic() > deadline:
+            fail(f"{name}: still processing after {POLL_SECONDS} s; will retry")
+        time.sleep(2)
+        status, reply = request('GET', f"{API}/api/v3/uploads/{reply['id']}", headers=auth)
+        if status != 200:
+            fail(f"checking the upload failed ({status})")
+
+
+def main(argv):
+    if argv == ['auth']:
+        authorize()
+    elif argv == ['test']:
+        test()
+    elif len(argv) == 1 and not argv[0].startswith('-'):
+        upload(argv[0])
+    else:
+        fail("usage: strava-upload auth | test | FILE", 2)
+
+
+if __name__ == '__main__':
+    main(sys.argv[1:])

coospo_cli-0.2.0/contrib/strava.json

@@ -0,0 +1,7 @@
+{
+  "client_id": "12345",
+  "client_secret": "0123456789abcdef0123456789abcdef01234567",
+  "access_token": "fedcba9876543210fedcba9876543210fedcba98",
+  "refresh_token": "89abcdef0123456789abcdef0123456789abcdef",
+  "expires_at": 0
+}

coospo_cli-0.2.0/contrib/systemd/coospo.service

@@ -0,0 +1,15 @@
+# Install as a user service:
+#   cp contrib/systemd/coospo.service ~/.config/systemd/user/
+#   systemctl --user enable --now coospo
+# Run `coospo init` once first, and put post_sync etc. into ~/.config/coospo/config.toml.
+[Unit]
+Description=Sync the COOSPO bike computer when it is in range
+After=bluetooth.target
+
+[Service]
+ExecStart=%h/.local/bin/coospo watch
+Restart=on-failure
+RestartSec=30
+
+[Install]
+WantedBy=default.target

{coospo_cli-0.1.0 → coospo_cli-0.2.0}/pyproject.toml

@@ -4,12 +4,12 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "coospo-cli"
-version = "0.1.0"
+version = "0.2.0"
 description = "Command-line tool for COOSPO CS500/CS600 bike computers: device info, battery, memory usage and FIT file download over Bluetooth LE"
 readme = "README.md"
 license = "GPL-3.0-or-later"
 license-files = ["LICENSE"]
-requires-python = ">=3.9"
+requires-python = ">=3.13"
 dependencies = ["bleak>=0.22"]
 keywords = ["coospo", "cs500", "cs600", "bike computer", "cycling", "fit", "bluetooth", "ble"]
 classifiers = [