gphototool 0.1.0__tar.gz

gphototool-0.1.0/.gitignore

@@ -0,0 +1,9 @@
+__pycache__/
+*.pyc
+.venv/
+dist/
+build/
+*.egg-info/
+data/
+*.db
+.env

gphototool-0.1.0/ARCHITECTURE.md

@@ -0,0 +1,47 @@
+# GPhotoTool — Architecture
+
+## What it does
+Upload any file → gp_disguise wraps as MP4 → gpmc uploads via Pixel XL spoof → unlimited storage.
+
+## Stack
+- **Backend**: FastAPI + SQLite (task persistence) + threading (workers)
+- **Frontend**: Single HTML + Tailwind CDN + vanilla JS
+- **Deploy**: nginx (reverse proxy, rate limit, large uploads) + systemd
+
+## Flow
+```
+Browser → POST /api/upload (file + auth_data)
+       → save to /tmp/gpt_{task_id}/
+       → background thread:
+         1. gpd hide -t video → output.mp4
+         2. gpmc output.mp4 → media_key
+       → poll GET /api/status/{task_id}
+       → done: link to Google Photos
+```
+
+## Files
+```
+gphotos-tool/
+├── app.py          # FastAPI backend (API + worker + cleanup)
+├── static/
+│   └── index.html  # SPA frontend
+├── deploy/
+│   ├── nginx.conf  # nginx reverse proxy config
+│   └── gphotos-tool.service  # systemd unit
+├── run.sh          # Dev launcher
+└── README.md
+```
+
+## Security
+- Auth validated client-side only (user's token, not stored)
+- File type whitelist (no .sh, .bat, executables with code)
+- Max 10 GB per file
+- Filenames sanitized (path traversal blocked)
+- Rate limit: 10 uploads/min via nginx
+- No auth logging (token never in logs)
+
+## Limits (ponytail: ship MVP, tune later)
+- Concurrent uploads: 3 (semaphore)
+- Task retention: 6 hours (cleanup thread)
+- No database migrations needed (single table)
+- No WebSocket (polling is fine for upload progress)

gphototool-0.1.0/PKG-INFO

@@ -0,0 +1,84 @@
+Metadata-Version: 2.5
+Name: gphototool
+Version: 0.1.0
+Summary: Convert any file to video → unlimited Google Photos upload
+License-Expression: MIT
+Requires-Python: >=3.11
+Requires-Dist: fastapi
+Requires-Dist: gpmc
+Requires-Dist: python-multipart
+Requires-Dist: uvicorn[standard]
+Provides-Extra: disguise
+Requires-Dist: gp-disguise; extra == 'disguise'
+Description-Content-Type: text/markdown
+
+# GPhotoTool
+
+Convert any file to video → upload **unlimited** to Google Photos.
+
+No storage quota. No server. Runs 100% locally on your machine.
+
+## Install
+
+```bash
+pip install gphototool
+pip install gp_disguise@git+https://github.com/xob0t/gp_disguise.git
+```
+
+Or one-liner:
+```bash
+pip install gphototool && pip install gp_disguise@git+https://github.com/xob0t/gp_disguise.git
+```
+
+## Usage
+
+```bash
+gphototool
+```
+
+Opens browser to `http://localhost:8800`. Drag, drop, done.
+
+## How it works
+
+1. Drop any file (ZIP, PDF, APK, ISO, DOC, MP3, anything)
+2. `gp_disguise` wraps it as an MP4 video
+3. `gpmc` uploads via Pixel XL spoof API — **zero quota charged**
+4. File stays on your machine the whole time
+
+## Auth token (one-time setup)
+
+**Easiest:** Open the expandable help in the web UI — it has step-by-step instructions.
+
+**Or:** Copy the AI-agent prompt from [docs/AUTH_TOKEN.md](docs/AUTH_TOKEN.md) and paste it to Claude/ChatGPT. It will guide you through capturing the token.
+
+**Manual:**
+```bash
+adb logcat -c && adb logcat | grep auth%2Fphotos
+# Open Morphe Photos → tap profile → sign in
+# Copy the androidId=...&Token=... line
+# Save: echo "TOKEN" > ~/.config/gphototool/auth_data && chmod 600 ~/.config/gphototool/auth_data
+```
+
+Token expires in ~24 hours. Re-capture when upload fails with auth error.
+
+## Requirements
+
+- Python 3.11+
+- `gpd` (gp_disguise) — installed automatically
+- `gpmc` — installed automatically
+
+## Architecture
+
+```
+Browser (localhost:8800)
+  ↕ HTTP
+FastAPI server (local)
+  → gpd: file → MP4
+  → gpmc: MP4 → Google Photos (unlimited)
+```
+
+Files never leave your machine. Zero server costs.
+
+## License
+
+MIT

gphototool-0.1.0/README.md

@@ -0,0 +1,70 @@
+# GPhotoTool
+
+Convert any file to video → upload **unlimited** to Google Photos.
+
+No storage quota. No server. Runs 100% locally on your machine.
+
+## Install
+
+```bash
+pip install gphototool
+pip install gp_disguise@git+https://github.com/xob0t/gp_disguise.git
+```
+
+Or one-liner:
+```bash
+pip install gphototool && pip install gp_disguise@git+https://github.com/xob0t/gp_disguise.git
+```
+
+## Usage
+
+```bash
+gphototool
+```
+
+Opens browser to `http://localhost:8800`. Drag, drop, done.
+
+## How it works
+
+1. Drop any file (ZIP, PDF, APK, ISO, DOC, MP3, anything)
+2. `gp_disguise` wraps it as an MP4 video
+3. `gpmc` uploads via Pixel XL spoof API — **zero quota charged**
+4. File stays on your machine the whole time
+
+## Auth token (one-time setup)
+
+**Easiest:** Open the expandable help in the web UI — it has step-by-step instructions.
+
+**Or:** Copy the AI-agent prompt from [docs/AUTH_TOKEN.md](docs/AUTH_TOKEN.md) and paste it to Claude/ChatGPT. It will guide you through capturing the token.
+
+**Manual:**
+```bash
+adb logcat -c && adb logcat | grep auth%2Fphotos
+# Open Morphe Photos → tap profile → sign in
+# Copy the androidId=...&Token=... line
+# Save: echo "TOKEN" > ~/.config/gphototool/auth_data && chmod 600 ~/.config/gphototool/auth_data
+```
+
+Token expires in ~24 hours. Re-capture when upload fails with auth error.
+
+## Requirements
+
+- Python 3.11+
+- `gpd` (gp_disguise) — installed automatically
+- `gpmc` — installed automatically
+
+## Architecture
+
+```
+Browser (localhost:8800)
+  ↕ HTTP
+FastAPI server (local)
+  → gpd: file → MP4
+  → gpmc: MP4 → Google Photos (unlimited)
+```
+
+Files never leave your machine. Zero server costs.
+
+## License
+
+MIT

gphototool-0.1.0/docs/01-specification.md

@@ -0,0 +1,31 @@
+# GPhotoTool — Specification
+
+## What
+CLI tool + browser UI. User runs locally. Converts any file to video → uploads unlimited to Google Photos via Pixel XL spoof API.
+
+## Who
+- Primary: LO (you) — daily use for unlimited backup
+- Secondary: anyone who wants unlimited GPhotos storage
+
+## Requirements
+1. `pip install gphototool` → single command install
+2. `gphototool` → opens browser, starts local server
+3. Drag-and-drop files → disguised as video → uploaded unlimited
+4. Auth token: one-time paste from `adb logcat` (ReVanced/Morphe Photos)
+5. Progress tracking in browser
+6. Works on Linux, macOS, Windows
+
+## Non-requirements (ponytail: YAGNI)
+- No user accounts / auth system
+- No cloud hosting
+- No database
+- No file sharing between users
+- No batch scheduling
+- No Docker
+
+## Constraints
+- Files never leave user's machine (privacy + zero server cost)
+- Max file: 10 GB (Google Photos limit for video)
+- Conversion: gpd (Python, wraps file in MP4 container)
+- Upload: gpmc (Python, hits Google mobile API with Pixel XL spoof)
+- Both tools are Python — bundle in same package

gphototool-0.1.0/docs/02-architecture.md

@@ -0,0 +1,104 @@
+# GPhotoTool — Architecture
+
+## Components
+
+```
+┌─────────────────────────────────────────────┐
+│  User's Machine                             │
+│                                             │
+│  ┌──────────────┐    ┌───────────────────┐  │
+│  │  Browser      │◄──►│  Local Server     │  │
+│  │  (index.html) │    │  (app.py :8800)   │  │
+│  │              │    │                   │  │
+│  │  - Upload UI │    │  - Accept file    │  │
+│  │  - Progress  │    │  - Run gpd        │  │
+│  │  - Results   │    │  - Run gpmc       │  │
+│  └──────────────┘    │  - Cleanup        │  │
+│                      └───────────────────┘  │
+│                                             │
+│  ┌──────────────┐    ┌───────────────────┐  │
+│  │  gpd          │    │  gpmc             │  │
+│  │  (disguise)   │    │  (upload)         │  │
+│  └──────────────┘    └───────────────────┘  │
+└─────────────────────────────────────────────┘
+```
+
+## Data Flow
+
+```
+1. User: gphototool
+   └─ Starts server on :8800
+   └─ Opens browser to localhost:8800
+
+2. User: drops file in browser
+   └─ POST /api/upload (file + auth_data)
+   └─ Server saves to /tmp/gpt_{id}/
+
+3. Server (background thread):
+   └─ Step 1: gpd hide -t video -o out.mp4 file
+   └─ Step 2: gpmc out.mp4 --progress
+   └─ Step 3: return media_key
+
+4. Browser: polls GET /api/status/{id}
+   └─ Shows progress: queued → converting → uploading → done
+
+5. Done:
+   └─ Returns photos_url for Google Photos
+   └─ Cleans up temp files
+```
+
+## File Structure
+
+```
+gphototool/
+├── pyproject.toml          # Package config (pip install)
+├── src/
+│   └── gphototool/
+│       ├── __init__.py     # Version
+│       ├── __main__.py     # Entry point: python -m gphototool
+│       ├── cli.py          # CLI: gphototool command
+│       ├── server.py       # FastAPI server
+│       ├── worker.py       # Background conversion/upload
+│       └── static/
+│           └── index.html  # Web UI
+├── docs/
+│   ├── 01-specification.md
+│   └── 02-architecture.md
+└── README.md
+```
+
+## API
+
+| Method | Path | What |
+|--------|------|------|
+| POST | /api/upload | File + auth_data → task_id |
+| GET | /api/status/{id} | Task status + progress |
+| GET | /api/health | Server health check |
+| GET | / | Web UI |
+
+## Dependencies
+
+| Package | Purpose | Size |
+|---------|---------|------|
+| fastapi | HTTP server | ~2 MB |
+| uvicorn | ASGI server | ~1 MB |
+| python-multipart | File uploads | ~100 KB |
+| gp_disguise | File → video disguise | ~100 KB |
+| gpmc | Unlimited GPhotos upload | ~50 KB |
+
+All bundled in one pip package. No system deps except Python 3.10+.
+
+## Security Model
+
+- No auth system (single user, local only)
+- Auth token: user's Google API token, stored in memory only, never logged
+- CORS: localhost only
+- File type whitelist: known safe extensions
+- Max file: 10 GB
+- Temp files: auto-cleaned after upload
+
+## Deployment
+
+- PyPI: `pip install gphototool`
+- GitHub: source + releases
+- No server hosting needed

gphototool-0.1.0/docs/03-pseudocode.md

@@ -0,0 +1,80 @@
+# GPhotoTool — Pseudocode
+
+## cli.py
+```python
+def main():
+    """gphototool entry point"""
+    port = find_free_port(8800)
+    start_browser(f"http://localhost:{port}")
+    uvicorn.run(server.app, host="127.0.0.1", port=port)
+```
+
+## server.py
+```python
+app = FastAPI()
+tasks = {}  # in-memory (single user, no DB needed)
+
+@app.post("/api/upload")
+async def upload(file, auth_data):
+    validate_auth(auth_data)           # must start with androidId=
+    validate_file(file)                # check extension + size
+    task_id = save_file(file)          # save to /tmp/gpt_{id}/
+    spawn_thread(process, task_id)     # background: disguise + upload
+    return {task_id, filename, size}
+
+@app.get("/api/status/{id}")
+def status(id):
+    return tasks[id]  # status, step, media_key, error, etc.
+
+@app.get("/api/health")
+def health():
+    return {gpmc: bool, gpd: bool}
+```
+
+## worker.py
+```python
+def process(task_id, src, auth):
+    # Step 1: Disguise
+    update(task_id, "disguising")
+    run(["gpd", "hide", "-t", "video", "-o", out, src])
+    
+    # Step 2: Upload
+    update(task_id, "uploading")
+    env["GP_AUTH_DATA"] = auth
+    run(["gpmc", out, "--progress", "--timeout", "7200"])
+    
+    # Step 3: Parse result
+    media_key = parse_gpmc_output(output)
+    update(task_id, "done", media_key=media_key)
+    
+    # Cleanup
+    shutil.rmtree(tmp_dir)
+```
+
+## index.html
+```
+- Auth token input
+- Drop zone (drag-and-drop)
+- File info + Upload button
+- Progress bar (polls /api/status every 2s)
+- Result card (Photos link + copy key)
+- Upload history (session only)
+```
+
+## Key Decisions
+
+1. **No DB**: Single-user local tool. In-memory dict is fine. Tasks lost on restart = acceptable.
+
+2. **No WebSocket**: Polling every 2s is simple and works. Progress updates are coarse (queued → disguising → uploading → done) so fine-grained updates unnecessary.
+
+3. **gpd/gpmc as subprocess**: Not importing Python modules directly. Subprocess gives:
+   - Clean process isolation
+   - No import conflicts
+   - Works with uv tool installs
+   - Output capture for progress parsing
+
+4. **Port auto-discovery**: Try 8800, fallback to 8801-8810 if occupied.
+
+5. **Browser auto-open**: `webbrowser.open()` on start. No manual URL copying.
+
+6. **Temp files in system tmpdir**: `/tmp/gpt_*` — OS cleans on reboot. We also clean after upload.

gphototool-0.1.0/docs/AUTH_TOKEN.md

@@ -0,0 +1,80 @@
+# How to Get Your Auth Token
+
+## Quick version (for AI agents)
+
+Copy everything in the code block below and paste it to Claude, ChatGPT, or any AI agent. It will guide you through capturing the token.
+
+```
+I need to capture a Google Photos auth token for gphototool (unlimited upload tool).
+
+My setup:
+- Android phone with ReVanced or Morphe Google Photos installed
+- ReVanced GMS (microG) running with my Google account logged in
+- USB cable connected to PC, ADB enabled
+
+Steps I need help with:
+1. Verify ADB connection: `adb devices`
+2. Clear logcat: `adb logcat -c`
+3. Tell me to open Morphe/ReVanced Google Photos and tap my profile to sign in
+4. Monitor logcat for the auth line: `adb logcat | grep auth%2Fphotos.native`
+5. When the line starting with `androidId=...` appears, extract and save it
+6. Verify the token works by checking it has: androidId, app, Token fields
+7. Save it to ~/.config/gphototool/auth_data (chmod 600)
+
+Do NOT display the full token in chat — just confirm it was captured successfully and show the first 30 chars.
+```
+
+## Manual steps
+
+### Prerequisites
+- Android phone with **ReVanced** or **Morphe** Google Photos (patched APK)
+- **ReVanced GMS** (microG) installed and running
+- Your Google account logged into microG
+- USB cable + ADB on PC
+
+### Capture the token
+
+1. **Connect phone:**
+   ```bash
+   adb devices
+   # Should show your device
+   ```
+
+2. **Start monitoring:**
+   ```bash
+   adb logcat -c  # clear old logs
+   adb logcat | grep "auth%2Fphotos"
+   ```
+
+3. **On your phone:**
+   - Open **Morphe** or **ReVanced Google Photos**
+   - Tap the **profile icon** (top right)
+   - Tap your Google account to sign in
+   - Tap **Get started** if prompted
+
+4. **On your PC**, a line appears:
+   ```
+   D GmsHttpFormClient: androidId=367eac4a...&app=com.google.android.apps.photos&...&Token=aas_et%2FAKppIN...
+   ```
+
+5. **Copy the entire line** starting from `androidId=` to the end
+
+6. **Save it:**
+   ```bash
+   mkdir -p ~/.config/gphototool
+   # Paste the token between the quotes:
+   echo "PASTE_TOKEN_HERE" > ~/.config/gphototool/auth_data
+   chmod 600 ~/.config/gphototool/auth_data
+   ```
+
+### Token expires in ~24 hours
+When uploads fail with auth error, repeat steps 2-6 to get a fresh token.
+
+## Troubleshooting
+
+| Problem | Fix |
+|---------|-----|
+| No auth line in logcat | Make sure ReVanced/Morphe Photos is the patched APK, not stock |
+| `401 Unauthorized` | Token expired — capture fresh one |
+| `adb: unauthorised` | Accept USB debugging prompt on phone |
+| No photos appear in app | Make sure microG has your Google account logged in |

gphototool-0.1.0/pyproject.toml

@@ -0,0 +1,29 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "gphototool"
+version = "0.1.0"
+description = "Convert any file to video → unlimited Google Photos upload"
+readme = "README.md"
+license = "MIT"
+requires-python = ">=3.11"
+dependencies = [
+    "fastapi",
+    "uvicorn[standard]",
+    "python-multipart",
+    "gpmc",
+]
+
+[project.optional-dependencies]
+disguise = ["gp_disguise"]
+
+[project.scripts]
+gphototool = "gphototool.cli:main"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/gphototool"]
+
+[tool.hatch.metadata]
+allow-direct-references = true

gphototool-0.1.0/src/gphototool/__init__.py

@@ -0,0 +1,2 @@
+"""gphototool — unlimited Google Photos upload via file disguise."""
+__version__ = "0.1.0"

gphototool-0.1.0/src/gphototool/__main__.py

@@ -0,0 +1,3 @@
+"""Allow `python -m gphototool`"""
+from gphototool.cli import main
+main()

gphototool-0.1.0/src/gphototool/cli.py

@@ -0,0 +1,48 @@
+"""CLI entry point: gphototool"""
+import sys, socket, webbrowser, argparse
+from pathlib import Path
+
+
+def _free_port(start: int = 8800) -> int:
+    for p in range(start, start + 20):
+        with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
+            try:
+                s.bind(("127.0.0.1", p))
+                return p
+            except OSError:
+                continue
+    print("error: no free port found (8800-8819)", file=sys.stderr)
+    sys.exit(1)
+
+
+def main():
+    ap = argparse.ArgumentParser(prog="gphototool", description="Unlimited Google Photos upload")
+    ap.add_argument("--port", "-p", type=int, default=0, help="Port (default: auto 8800)")
+    ap.add_argument("--no-browser", action="store_true", help="Don't open browser")
+    args = ap.parse_args()
+
+    port = args.port or _free_port()
+    url = f"http://localhost:{port}"
+
+    # Check tools
+    import shutil
+    if not shutil.which("gpd"):
+        print("error: gpd not found — install gp_disguise: pip install gp_disguise", file=sys.stderr)
+        sys.exit(1)
+    if not shutil.which("gpmc"):
+        print("error: gpmc not found — install gpmc: pip install gpmc", file=sys.stderr)
+        sys.exit(1)
+
+    if not args.no_browser:
+        webbrowser.open(url)
+
+    print(f"gphototool running at {url}")
+    print("Press Ctrl+C to stop\n")
+
+    import uvicorn
+    from gphototool.server import app
+    uvicorn.run(app, host="127.0.0.1", port=port, log_level="info")
+
+
+if __name__ == "__main__":
+    main()

gphototool-0.1.0/src/gphototool/server.py

@@ -0,0 +1,199 @@
+"""FastAPI server — local only, single user."""
+import uuid, time, hashlib, threading, json, logging
+from pathlib import Path
+from fastapi import FastAPI, UploadFile, File, Form, HTTPException
+from fastapi.responses import JSONResponse, FileResponse
+from fastapi.staticfiles import StaticFiles
+from fastapi.middleware.cors import CORSMiddleware
+
+from gphototool.worker import process_file
+
+log = logging.getLogger("gphototool")
+
+# ── Config ───────────────────────────────────────────────────────────────
+MAX_SIZE = 10 * 1024 * 1024 * 1024  # 10 GB
+AUTH_FILE = Path.home() / ".config" / "gphototool" / "auth_data"
+
+EXT = {
+    ".zip", ".tar", ".gz", ".bz2", ".xz", ".7z", ".rar", ".zst",
+    ".pdf", ".doc", ".docx", ".xls", ".xlsx", ".ppt", ".pptx", ".odt",
+    ".txt", ".csv", ".json", ".xml", ".yaml", ".yml", ".toml",
+    ".exe", ".msi", ".deb", ".rpm", ".apk", ".ipa",
+    ".iso", ".img", ".bin", ".dat",
+    ".mp3", ".wav", ".flac", ".aac", ".ogg",
+    ".mp4", ".mkv", ".avi", ".mov", ".webm",  # pre-disguised or direct upload
+    ".psd", ".ai", ".sketch",
+    ".py", ".js", ".ts", ".go", ".rs", ".c", ".cpp", ".java",
+    ".db", ".sqlite", ".sqlite3",
+}
+
+# ── State (single user, in-memory is fine) ──────────────────────────────
+import tempfile
+UPLOAD_DIR = Path(tempfile.mkdtemp(prefix="gpt_"))
+tasks: dict[str, dict] = {}
+lock = threading.Lock()
+
+
+def _save(t: dict):
+    with lock:
+        tasks[t["id"]] = t
+
+
+def _get(task_id: str) -> dict | None:
+    with lock:
+        return tasks.get(task_id)
+
+
+# ── FastAPI ──────────────────────────────────────────────────────────────
+app = FastAPI(title="GPhotoTool", docs_url=None, redoc_url=None)
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=["http://localhost", "http://127.0.0.1"],
+    allow_methods=["*"],
+    allow_headers=["*"],
+)
+
+
+@app.exception_handler(Exception)
+async def _err(req, exc):
+    log.error("%s %s — %s", req.method, req.url.path, exc)
+    return JSONResponse({"error": "internal error"}, status_code=500)
+
+
+@app.post("/api/upload")
+async def upload(
+    file: UploadFile = File(...),
+    auth_data: str = Form(""),
+    mode: str = Form("both"),
+):
+    """mode: disguise | upload | both"""
+    if mode not in ("disguise", "upload", "both"):
+        raise HTTPException(400, "mode must be: disguise, upload, or both")
+
+    # Auth required for upload modes
+    if mode in ("upload", "both"):
+        if not auth_data:
+            raise HTTPException(400, "Auth token required for upload")
+        if not auth_data.startswith("androidId="):
+            raise HTTPException(400, "Invalid auth_data — must start with androidId=")
+        if "&Token=" not in auth_data:
+            raise HTTPException(400, "Invalid auth_data — missing Token field. Capture fresh token from logcat.")
+        if len(auth_data) > 5000:
+            raise HTTPException(400, "auth_data too long")
+
+    # Validate file
+    fname = Path(file.filename or "upload").name.strip(". ") or "upload"
+    if len(fname) > 200:
+        fname = fname[:190] + Path(fname).suffix
+    ext = Path(fname).suffix.lower()
+    if ext not in EXT:
+        raise HTTPException(400, f"Unsupported: {ext}")
+
+    # Save
+    task_id = uuid.uuid4().hex[:12]
+    task_dir = UPLOAD_DIR / task_id
+    task_dir.mkdir(exist_ok=True)
+    src = task_dir / fname
+
+    size = 0
+    try:
+        with open(src, "wb") as f:
+            while chunk := await file.read(1024 * 1024):
+                size += len(chunk)
+                if size > MAX_SIZE:
+                    src.unlink(missing_ok=True)
+                    raise HTTPException(413, "Max 10 GB")
+                f.write(chunk)
+    except HTTPException:
+        raise
+    except Exception as e:
+        src.unlink(missing_ok=True)
+        raise HTTPException(500, str(e))
+
+    if size == 0:
+        src.unlink(missing_ok=True)
+        raise HTTPException(400, "Empty file")
+
+    # Create task
+    t = {
+        "id": task_id, "filename": fname, "size": size,
+        "status": "queued", "step": "Queued", "mode": mode,
+        "media_key": None, "photos_url": None, "error": None,
+        "disguised_size": None, "elapsed": None,
+        "converted_file": None,
+        "created": time.time(),
+    }
+    _save(t)
+    threading.Thread(target=process_file, args=(t, src, auth_data, UPLOAD_DIR, mode), daemon=True).start()
+    log.info("queued %s (%d bytes, mode=%s)", fname, size, mode)
+
+    return {"task_id": task_id, "filename": fname, "size": size, "mode": mode}
+
+
+@app.get("/api/status/{task_id}")
+def status(task_id: str):
+    t = _get(task_id)
+    if not t:
+        raise HTTPException(404)
+    d = {k: t[k] for k in (
+        "status", "step", "filename", "size", "mode",
+        "media_key", "photos_url", "error",
+        "disguised_size", "elapsed",
+    )}
+    # Add download link for disguise mode
+    if t["mode"] == "disguise" and t["status"] == "done":
+        d["download_url"] = f"/api/download/{task_id}"
+    return d
+
+
+@app.get("/api/download/{task_id}")
+def download(task_id: str):
+    """Download converted MP4 file (disguise mode)."""
+    t = _get(task_id)
+    if not t:
+        raise HTTPException(404)
+    if t["mode"] != "disguise" or t["status"] != "done":
+        raise HTTPException(400, "Download only available for disguise mode after completion")
+
+    # Find the MP4 file
+    task_dir = UPLOAD_DIR / task_id
+    mp4_files = list(task_dir.glob("*.mp4"))
+    if not mp4_files:
+        raise HTTPException(404, "Converted file not found — may have been cleaned up")
+
+    mp4 = mp4_files[0]
+    download_name = f"{Path(t['filename']).stem}.mp4"
+    return FileResponse(mp4, filename=download_name, media_type="video/mp4")
+
+
+@app.get("/api/health")
+def health():
+    import shutil
+    return {"gpmc": bool(shutil.which("gpmc")), "gpd": bool(shutil.which("gpd"))}
+
+
+@app.get("/api/auth")
+def get_auth():
+    """Return saved auth token (first 30 chars) or empty if none."""
+    if AUTH_FILE.exists():
+        token = AUTH_FILE.read_text().strip()
+        if token.startswith("androidId="):
+            return {"saved": True, "preview": token[:30] + "..."}
+    return {"saved": False, "preview": ""}
+
+
+@app.post("/api/auth")
+def save_auth(auth_data: str = Form(...)):
+    """Save auth token to disk for next session."""
+    if not auth_data.startswith("androidId=") or "&Token=" not in auth_data:
+        raise HTTPException(400, "Invalid auth token")
+    AUTH_FILE.parent.mkdir(parents=True, exist_ok=True)
+    AUTH_FILE.write_text(auth_data)
+    AUTH_FILE.chmod(0o600)
+    return {"saved": True}
+
+
+# Serve static
+_STATIC = Path(__file__).parent / "static"
+if _STATIC.exists():
+    app.mount("/", StaticFiles(directory=_STATIC, html=True), name="static")

gphototool-0.1.0/src/gphototool/static/index.html

@@ -0,0 +1,230 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>GPhotoTool</title>
+<script src="https://cdn.tailwindcss.com"></script>
+</head>
+<body class="bg-gray-950 text-gray-100 min-h-screen flex flex-col">
+<header class="border-b border-gray-800 px-4 py-3">
+  <div class="max-w-xl mx-auto flex items-center justify-between">
+    <h1 class="text-lg font-bold">📸 GPhotoTool</h1>
+    <span class="text-xs text-gray-600" id="status-dot">● connected</span>
+  </div>
+</header>
+
+<main class="flex-1 max-w-xl mx-auto w-full px-4 py-6">
+
+  <!-- Auth -->
+  <div class="mb-5">
+    <label class="block text-xs text-gray-500 mb-1">Auth Token</label>
+    <input id="auth" type="password" placeholder="androidId=...&app=...&Token=..."
+      class="w-full bg-gray-900 border border-gray-700 rounded-lg px-3 py-2.5 text-sm font-mono focus:outline-none focus:border-blue-500 placeholder-gray-600">
+    <div class="flex items-center gap-3 mt-1.5">
+      <button onclick="saveAuth()" class="text-xs text-blue-500 hover:text-blue-400">Save token</button>
+      <span id="auth-status" class="text-xs text-gray-600"></span>
+    </div>
+    <details class="mt-1.5">
+      <summary class="text-xs text-gray-500 cursor-pointer hover:text-gray-400">How to get this token</summary>
+      <div class="mt-2 text-xs text-gray-500 space-y-1.5 bg-gray-900/50 rounded-lg p-3">
+        <p><strong class="text-gray-400">Prerequisites:</strong> ReVanced or Morphe Google Photos installed on Android + ReVanced GMS (microG)</p>
+        <p><strong class="text-gray-400">Steps:</strong></p>
+        <ol class="list-decimal list-inside space-y-1">
+          <li>Connect phone via USB, enable ADB</li>
+          <li>Run: <code class="bg-gray-800 px-1 rounded">adb logcat | grep auth%2Fphotos</code></li>
+          <li>Open Morphe/ReVanced Photos → tap profile → sign in to your Google account</li>
+          <li>A line starting with <code class="bg-gray-800 px-1 rounded">androidId=...</code> appears — copy the full line</li>
+          <li>Paste it above</li>
+        </ol>
+        <p class="text-yellow-500/80">⚠ Token expires in ~24 hours. Re-capture when upload fails with auth error.</p>
+      </div>
+    </details>
+  </div>
+
+  <!-- Drop -->
+  <div id="drop" class="border-2 border-dashed border-gray-700 rounded-xl p-8 text-center cursor-pointer hover:border-gray-500 transition">
+    <div class="text-3xl mb-2">📁</div>
+    <p class="font-medium">Drop files here</p>
+    <p class="text-sm text-gray-500">or click to browse</p>
+    <p class="text-xs text-gray-600 mt-2">ZIP · PDF · APK · ISO · DOC · MP3 · anything</p>
+    <input id="fi" type="file" class="hidden">
+  </div>
+
+  <!-- File + Mode -->
+  <div id="file" class="hidden mt-3 bg-gray-900 rounded-xl p-4">
+    <div class="flex items-center justify-between gap-3 mb-3">
+      <div class="min-w-0">
+        <p id="fname" class="font-medium truncate"></p>
+        <p id="fsize" class="text-sm text-gray-400"></p>
+      </div>
+    </div>
+    <div class="flex gap-2">
+      <button onclick="run('both')"
+        class="flex-1 bg-blue-600 hover:bg-blue-500 px-3 py-2.5 rounded-lg text-sm font-medium transition disabled:opacity-50">
+        Convert + Upload
+      </button>
+      <button onclick="run('disguise')"
+        class="flex-1 bg-gray-700 hover:bg-gray-600 px-3 py-2.5 rounded-lg text-sm font-medium transition disabled:opacity-50">
+        Convert Only
+      </button>
+      <button onclick="run('upload')"
+        class="flex-1 bg-gray-700 hover:bg-gray-600 px-3 py-2.5 rounded-lg text-sm font-medium transition disabled:opacity-50">
+        Upload Only
+      </button>
+    </div>
+    <p class="text-xs text-gray-600 mt-2">
+      <strong>Convert + Upload:</strong> wraps file in video → unlimited GPhotos upload<br>
+      <strong>Convert Only:</strong> wraps file in video → download the MP4<br>
+      <strong>Upload Only:</strong> skips conversion, uploads file directly (for pre-disguised files)
+    </p>
+  </div>
+
+  <!-- Progress -->
+  <div id="prog" class="hidden mt-3 bg-gray-900 rounded-xl p-4">
+    <div class="flex items-center gap-2 mb-2">
+      <div class="w-4 h-4 border-2 border-gray-600 border-t-blue-500 rounded-full animate-spin"></div>
+      <span id="pstep" class="text-sm font-medium"></span>
+    </div>
+    <div class="w-full bg-gray-800 rounded-full h-1.5">
+      <div id="pbar" class="bg-blue-500 h-1.5 rounded-full transition-all duration-300" style="width:0%"></div>
+    </div>
+    <p id="ppct" class="text-xs text-gray-500 mt-1 text-right"></p>
+  </div>
+
+  <!-- Result -->
+  <div id="result" class="hidden mt-3 rounded-xl p-4"></div>
+
+  <!-- History -->
+  <div id="hist" class="hidden mt-6">
+    <p class="text-xs text-gray-500 mb-2">This session</p>
+    <div id="hlist" class="space-y-1.5"></div>
+  </div>
+
+</main>
+
+<footer class="border-t border-gray-800 px-4 py-2 text-center text-xs text-gray-700">
+  runs locally · files never leave your machine
+</footer>
+
+<script>
+const $=s=>document.getElementById(s);
+let file=null,hist=[];
+
+// Drop
+const dz=$('drop');
+dz.onclick=()=>$('fi').click();
+dz.ondragover=e=>{e.preventDefault();dz.classList.add('border-green-500')};
+dz.ondragleave=()=>dz.classList.remove('border-green-500');
+dz.ondrop=e=>{e.preventDefault();dz.classList.remove('border-green-500');if(e.dataTransfer.files[0])pick(e.dataTransfer.files[0])};
+$('fi').onchange=()=>{if($('fi').files[0])pick($('fi').files[0])};
+
+function fmt(b){for(const u of['B','KB','MB','GB']){if(b<1024)return(b===Math.floor(b)?b:b.toFixed(1))+' '+u;b/=1024}return b.toFixed(1)+' TB'}
+
+function pick(f){
+  file=f;$('fname').textContent=f.name;$('fsize').textContent=fmt(f.size);
+  $('file').classList.remove('hidden');$('prog').classList.add('hidden');$('result').classList.add('hidden');
+}
+
+async function run(mode){
+  const auth=$('auth').value.trim();
+  if(mode!=='disguise'&&!auth)return alert('Paste auth token');
+  if(mode!=='disguise'&&!auth.startsWith('androidId='))return alert('Token must start with androidId=');
+  if(!file)return alert('Select a file');
+
+  $('prog').classList.remove('hidden');$('result').classList.add('hidden');
+
+  const fd=new FormData();fd.append('file',file);fd.append('mode',mode);
+  if(mode!=='disguise')fd.append('auth_data',auth);
+
+  const labels={disguise:'Converting to video...',upload:'Uploading...',both:'Converting + uploading...'};
+
+  try{
+    setProg(labels[mode]||'Working...',5);
+    const r=await fetch('/api/upload',{method:'POST',body:fd});
+    if(!r.ok){const e=await r.json();throw new Error(e.detail||'Failed')}
+    const data=await r.json();
+    setMode(mode);poll(data.task_id);
+  }catch(e){setProg('Error: '+e.message,0,true)}
+}
+
+let currentMode='both';
+function setMode(m){currentMode=m}
+
+async function poll(id){
+  try{
+    const d=await(await fetch('/api/status/'+id)).json();
+    if(d.status==='queued')setProg('Queued...',5);
+    else if(d.status==='disguising')setProg(d.step||'Converting...',25);
+    else if(d.status==='uploading')setProg('Uploading to Google Photos...',55);
+    else if(d.status==='done'){showDone(d);return}
+    else if(d.status==='error'){setProg(d.error||'Failed',0,true);return}
+    setTimeout(()=>poll(id),2000);
+  }catch{setTimeout(()=>poll(id),3000)}
+}
+
+function setProg(s,p,err){
+  $('pstep').textContent=s;$('pbar').style.width=p+'%';$('ppct').textContent=Math.round(p)+'%';
+  if(err)$('pbar').className='bg-red-500 h-1.5 rounded-full transition-all duration-300';
+}
+
+function showDone(d){
+  $('prog').classList.add('hidden');
+  const r=$('result');r.classList.remove('hidden');
+  r.className='mt-3 rounded-xl p-4 bg-green-900/20 border border-green-800';
+
+  let html=`<p class="font-medium text-green-400 mb-1">✅ Done</p>
+    <p class="text-sm text-gray-400 mb-3">${d.filename} ${d.elapsed?'('+d.elapsed+'s)':''}</p>`;
+
+  if(currentMode==='disguise'){
+    html+=`<div class="flex flex-wrap gap-2">
+      <a href="${d.download_url}" class="bg-green-700 hover:bg-green-600 px-4 py-1.5 rounded-lg text-sm transition">⬇ Download MP4</a>
+      <p class="text-xs text-gray-500 w-full mt-1">File wrapped as MP4 — upload with any tool, or paste to "Upload Only"</p>
+    </div>`;
+  }else{
+    html+=`<div class="flex flex-wrap gap-2">
+      <a href="${d.photos_url}" target="_blank" class="bg-green-700 hover:bg-green-600 px-4 py-1.5 rounded-lg text-sm transition">Open in Photos →</a>
+      <button onclick="navigator.clipboard.writeText('${d.media_key}')" class="bg-gray-700 hover:bg-gray-600 px-4 py-1.5 rounded-lg text-sm transition">Copy key</button>
+    </div>`;
+  }
+
+  r.innerHTML=html;
+  $('pbar').className='bg-blue-500 h-1.5 rounded-full transition-all duration-300';
+  hist.unshift({...d,mode:currentMode});showHist();
+}
+
+function showHist(){
+  $('hist').classList.remove('hidden');
+  $('hlist').innerHTML=hist.map(h=>{
+    const badges={both:'⬆',disguise:'🎬',upload:'☁️'};
+    const badge=badges[h.mode]||'';
+    return `<div class="bg-gray-900 rounded-lg px-3 py-2 flex items-center justify-between text-sm">
+      <span class="truncate mr-2">${badge} ${h.filename}</span>
+      <div class="shrink-0 flex gap-2">
+        ${h.download_url?`<a href="${h.download_url}" class="text-green-400 hover:text-green-300">⬇</a>`:''}
+        ${h.photos_url?`<a href="${h.photos_url}" target="_blank" class="text-blue-400 hover:text-blue-300">View →</a>`:''}
+      </div>
+    </div>`;
+  }).join('');
+}
+
+// Health + saved auth
+Promise.all([fetch('/api/health').then(r=>r.json()), fetch('/api/auth').then(r=>r.json())])
+.then(([h,a])=>{
+  if(h.gpmc&&h.gpd)$('status-dot').textContent='● ready';
+  else{$('status-dot').textContent='● missing tools';$('status-dot').className='text-red-500'}
+  if(a.saved){$('auth').value=a.preview;$('auth').title='Saved token loaded — paste fresh if expired'}
+});
+
+async function saveAuth(){
+  const v=$('auth').value.trim();
+  if(!v)return alert('Paste a token first');
+  if(!v.startsWith('androidId=')||!v.includes('&Token='))return alert('Invalid token format');
+  const fd=new FormData();fd.append('auth_data',v);
+  const r=await fetch('/api/auth',{method:'POST',body:fd});
+  if(r.ok)$('auth-status').textContent='✓ Saved';
+  else $('auth-status').textContent='✗ Failed';
+}
+</script>
+</body>
+</html>

gphototool-0.1.0/src/gphototool/worker.py

@@ -0,0 +1,149 @@
+"""Background worker — disguise + upload."""
+import subprocess, os, time, shutil, logging, ast
+from pathlib import Path
+
+log = logging.getLogger("gphototool")
+
+MAX_CONCURRENT = 3
+import threading
+sem = threading.Semaphore(MAX_CONCURRENT)
+
+
+def _run(cmd, env=None, timeout=3600):
+    try:
+        r = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout, env=env or os.environ)
+        return r.returncode, r.stdout + r.stderr
+    except subprocess.TimeoutExpired:
+        return -1, "timeout"
+    except Exception as e:
+        return -2, str(e)
+
+
+def is_already_disguised(path: Path) -> bool:
+    """Check if file is already a gpd-disguised MP4 by trying extract."""
+    code, _ = _run(["gpd", "extract", str(path), "-o", "/dev/null"], timeout=30)
+    return code == 0
+
+
+def disguise_file(src: Path, out_dir: Path, size: int) -> tuple[Path | None, str]:
+    """Disguise src as MP4. Returns (output_path, error_msg)."""
+    out_mp4 = out_dir / f"{src.stem}.mp4"
+    timeout = max(300, size // (1024 * 1024))
+    code, out = _run(["gpd", "hide", "-t", "video", "-o", str(out_mp4), str(src)], timeout=timeout)
+
+    if code != 0 or not out_mp4.exists():
+        if "ffmpeg" in out.lower() or "not found" in out.lower():
+            return None, "ffmpeg not found. Install it: apt install ffmpeg / brew install ffmpeg"
+        return None, f"Conversion failed: {out[-200:]}"
+    return out_mp4, ""
+
+
+def upload_file(mp4: Path, auth: str) -> tuple[str | None, str]:
+    """Upload MP4 to GPhotos. Returns (media_key, error_msg)."""
+    env = {**os.environ, "GP_AUTH_DATA": auth}
+    code, out = _run(
+        ["gpmc", str(mp4), "--progress", "--timeout", "7200", "--log-level", "WARNING"],
+        env=env, timeout=7200,
+    )
+
+    if code != 0:
+        err = out.strip().split("\n")[-1][:300] if out.strip() else "unknown error"
+        if "401" in err or "Unauthorized" in err or "auth" in err.lower():
+            err = "Auth token expired. Capture a fresh token from adb logcat."
+        elif "403" in err or "Forbidden" in err:
+            err = "Account may be banned or rate-limited. Wait 24h and try fresh token."
+        elif "timeout" in err.lower():
+            err = "Upload timed out. File may be too large or connection slow."
+        return None, f"Upload failed: {err}"
+
+    # Parse media key — gpmc outputs Python dict with single quotes, not JSON
+    media_key = None
+    for line in out.strip().split("\n"):
+        if "AF1Qip" in line:
+            brace = line.rfind("{")
+            if brace >= 0:
+                try:
+                    d = ast.literal_eval(line[brace:].rstrip())
+                    media_key = list(d.values())[0]
+                except Exception:
+                    pass
+
+    if not media_key:
+        return None, "No media key in gpmc output"
+    return media_key, ""
+
+
+def process_file(t: dict, src: Path, auth: str, upload_dir: Path, mode: str):
+    """Run disguise/upload in background thread. mode: disguise|upload|both"""
+    sem.acquire()
+    try:
+        _process_inner(t, src, auth, upload_dir, mode)
+    finally:
+        sem.release()
+        if mode != "disguise":
+            d = upload_dir / t["id"]
+            if d.exists():
+                shutil.rmtree(d, ignore_errors=True)
+
+
+def _process_inner(t: dict, src: Path, auth: str, upload_dir: Path, mode: str):
+    task_id = t["id"]
+    out_dir = upload_dir / task_id
+    out_dir.mkdir(exist_ok=True)
+
+    mp4_to_upload = src  # may be src itself if already disguised
+
+    # ── Disguise step (skip if already disguised or mode=upload) ──
+    if mode != "upload":
+        # Check if already disguised
+        if is_already_disguised(src):
+            t["status"] = "disguising"
+            t["step"] = "Already disguised — skipping conversion"
+            _save(t)
+            log.info("[%s] already disguised, skipping", task_id)
+            mp4_to_upload = src
+        else:
+            t["status"] = "disguising"
+            t["step"] = "Converting to video..."
+            _save(t)
+            log.info("[%s] disguising %s", task_id, t["filename"])
+
+            mp4_path, err = disguise_file(src, out_dir, t["size"])
+            if err:
+                t["status"] = "error"
+                t["error"] = err
+                _save(t)
+                return
+            mp4_to_upload = mp4_path
+
+        t["disguised_size"] = mp4_to_upload.stat().st_size
+
+    # ── Upload step (skip if mode=disguise) ──
+    if mode != "disguise":
+        t["status"] = "uploading"
+        t["step"] = "Uploading to Google Photos..."
+        _save(t)
+        log.info("[%s] uploading %s", task_id, t["filename"])
+
+        media_key, err = upload_file(mp4_to_upload, auth)
+        if err:
+            t["status"] = "error"
+            t["error"] = err
+            _save(t)
+            return
+
+        t["media_key"] = media_key
+        t["photos_url"] = f"https://photos.google.com/share/{media_key}"
+
+    # ── Done ──
+    t["status"] = "done"
+    t["step"] = "Complete"
+    t["elapsed"] = round(time.time() - t["created"], 1)
+    _save(t)
+    log.info("[%s] done (mode=%s)", task_id, mode)
+
+
+def _save(t: dict):
+    from gphototool.server import tasks, lock
+    with lock:
+        tasks[t["id"]] = t