pjdev-gitlab 5.1.9__tar.gz → 5.1.10__tar.gz

{pjdev_gitlab-5.1.9 → pjdev_gitlab-5.1.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pjdev-gitlab
-Version: 5.1.9
+Version: 5.1.10
 Project-URL: Documentation, https://gitlab.purplejay.io/keystone/python/-/tree/main/pjdev-gitlab/README.md
 Project-URL: Issues, https://gitlab.purplejay.io/keystone/python/-/issues
 Project-URL: Source, https://gitlab.purplejay.io/keystone/python
@@ -80,6 +80,23 @@ The OAuth application must be registered as a non-confidential (PKCE) app with
 is sent as `Authorization: Bearer <token>`; the default `private-token` scheme
 sends `PRIVATE-TOKEN` for personal/project/group access tokens.
 
+#### `pjdev-gitlab-auth` console script
+
+The same flow is exposed as a console script, so shell callers (e.g. skills) can
+mint a token without embedding any Python. It prints only the token to stdout and
+status to stderr:
+
+```bash
+TOKEN="$(uvx --from 'pjdev-gitlab' pjdev-gitlab-auth \
+  --gitlab-url https://gitlab.example.com --client-id <client-id>)"
+```
+
+The library is instance-agnostic: `--client-id` (or `GL_OAUTH_CLIENT_ID`) is
+required and the host defaults to `https://gitlab.com` (override with
+`--gitlab-url` / `GL_GITLAB_URL`). Other flags: `--client-secret`,
+`--redirect-port`, `--scopes`, `--force` (each with a `GL_OAUTH_*` env
+equivalent).
+
 ### Recommended: 1Password + `op run`
 
 On a developer laptop, keep the token in 1Password and inject it into the host

{pjdev_gitlab-5.1.9 → pjdev_gitlab-5.1.10}/README.md

@@ -52,6 +52,23 @@ The OAuth application must be registered as a non-confidential (PKCE) app with
 is sent as `Authorization: Bearer <token>`; the default `private-token` scheme
 sends `PRIVATE-TOKEN` for personal/project/group access tokens.
 
+#### `pjdev-gitlab-auth` console script
+
+The same flow is exposed as a console script, so shell callers (e.g. skills) can
+mint a token without embedding any Python. It prints only the token to stdout and
+status to stderr:
+
+```bash
+TOKEN="$(uvx --from 'pjdev-gitlab' pjdev-gitlab-auth \
+  --gitlab-url https://gitlab.example.com --client-id <client-id>)"
+```
+
+The library is instance-agnostic: `--client-id` (or `GL_OAUTH_CLIENT_ID`) is
+required and the host defaults to `https://gitlab.com` (override with
+`--gitlab-url` / `GL_GITLAB_URL`). Other flags: `--client-secret`,
+`--redirect-port`, `--scopes`, `--force` (each with a `GL_OAUTH_*` env
+equivalent).
+
 ### Recommended: 1Password + `op run`
 
 On a developer laptop, keep the token in 1Password and inject it into the host

{pjdev_gitlab-5.1.9 → pjdev_gitlab-5.1.10}/pyproject.toml

@@ -27,6 +27,9 @@ dependencies = [
   "pydantic>=2.12.5",
 ]
 
+[project.scripts]
+pjdev-gitlab-auth = "pjdev_gitlab.oauth_cli:main"
+
 [project.optional-dependencies]
 dev = [
     "ruff",

{pjdev_gitlab-5.1.9 → pjdev_gitlab-5.1.10}/src/pjdev_gitlab/__about__.py

@@ -1,4 +1,4 @@
 # SPDX-FileCopyrightText: 2026-present Chris O'Neill <chris@purplejay.io>
 #
 # SPDX-License-Identifier: MIT
-__version__ = "5.1.9"
+__version__ = "5.1.10"

{pjdev_gitlab-5.1.9 → pjdev_gitlab-5.1.10}/src/pjdev_gitlab/__init__.py

@@ -12,6 +12,7 @@ __all__ = [
     "issues_service",
     "merge_requests_service",
     "models",
+    "oauth_cli",
     "oauth_service",
     "packages_service",
     "repo_files_service",

{pjdev_gitlab-5.1.9 → pjdev_gitlab-5.1.10}/src/pjdev_gitlab/api_utilities.py

@@ -2,7 +2,7 @@ import asyncio
 import ssl
 from contextlib import asynccontextmanager
 from functools import wraps
-from typing import Any, AsyncIterator, Callable, Dict, List, Optional
+from typing import Any, AsyncIterator, Dict, List, Optional
 from urllib.parse import quote
 
 import httpx

pjdev_gitlab-5.1.10/src/pjdev_gitlab/oauth_cli.py

@@ -0,0 +1,122 @@
+"""Command-line entry point: authenticate to GitLab and print an OAuth token.
+
+Installed as the ``pjdev-gitlab-auth`` console script (see ``[project.scripts]``
+in ``pyproject.toml``). Thin CLI over
+:func:`pjdev_gitlab.oauth_service.get_access_token` that runs the OAuth 2.0
+Authorization Code + PKCE browser flow so API writes are attributed to the human
+invoking it rather than a shared bot. Prints ONLY the access token to stdout;
+status goes to stderr. Tokens are cached + silently refreshed per host under
+``~/.config/pjdev-gitlab/tokens/``, so most runs need no interaction.
+
+The library is instance-agnostic: the OAuth application's client id must be
+supplied per call (there is no built-in default), and the GitLab host defaults to
+``https://gitlab.com``. Callers targeting another instance pass ``--gitlab-url``
+(or ``GL_GITLAB_URL``) and ``--client-id`` (or ``GL_OAUTH_CLIENT_ID``).
+
+Usage::
+
+    pjdev-gitlab-auth --gitlab-url https://gitlab.example.com --client-id <id>
+    # or, equivalently, via the environment:
+    GL_GITLAB_URL=https://gitlab.example.com GL_OAUTH_CLIENT_ID=<id> pjdev-gitlab-auth
+
+The registered OAuth application must be a non-confidential (PKCE) app with the
+requested scope (default ``api``) and Redirect URI exactly
+``http://localhost:<redirect-port>/callback``.
+"""
+
+from __future__ import annotations
+
+import argparse
+import os
+import sys
+
+from pjdev_gitlab.oauth_service import (
+    DEFAULT_REDIRECT_PORT,
+    DEFAULT_SCOPES,
+    OAuthError,
+    get_access_token,
+)
+
+DEFAULT_GITLAB_URL = "https://gitlab.com"
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(
+        prog="pjdev-gitlab-auth",
+        description="Authenticate to GitLab via OAuth and print a short-lived access token.",
+    )
+    parser.add_argument(
+        "--gitlab-url",
+        default=None,
+        help="GitLab base URL (or GL_GITLAB_URL; default https://gitlab.com)",
+    )
+    parser.add_argument(
+        "--client-id",
+        default=None,
+        help="registered OAuth app client id (or GL_OAUTH_CLIENT_ID) -- required",
+    )
+    parser.add_argument(
+        "--client-secret",
+        default=None,
+        help="only for a confidential app (or GL_OAUTH_CLIENT_SECRET)",
+    )
+    parser.add_argument(
+        "--redirect-port",
+        type=int,
+        default=None,
+        help=f"loopback redirect port (or GL_OAUTH_REDIRECT_PORT; default {DEFAULT_REDIRECT_PORT})",
+    )
+    parser.add_argument(
+        "--scopes",
+        default=None,
+        help=f'space-separated scopes (or GL_OAUTH_SCOPES; default "{DEFAULT_SCOPES}")',
+    )
+    parser.add_argument(
+        "--force",
+        action="store_true",
+        help="ignore any cached token and run the browser flow",
+    )
+    args = parser.parse_args()
+
+    gitlab_url = args.gitlab_url or os.environ.get("GL_GITLAB_URL") or DEFAULT_GITLAB_URL
+    client_id = args.client_id or os.environ.get("GL_OAUTH_CLIENT_ID")
+    if not client_id:
+        print(
+            "no OAuth client id: pass --client-id or set GL_OAUTH_CLIENT_ID to the "
+            "registered application's client id.",
+            file=sys.stderr,
+        )
+        return 2
+    client_secret = args.client_secret or os.environ.get("GL_OAUTH_CLIENT_SECRET") or None
+    scopes = args.scopes or os.environ.get("GL_OAUTH_SCOPES") or DEFAULT_SCOPES
+
+    port_raw = (
+        args.redirect_port
+        if args.redirect_port is not None
+        else os.environ.get("GL_OAUTH_REDIRECT_PORT", DEFAULT_REDIRECT_PORT)
+    )
+    try:
+        redirect_port = int(port_raw)
+    except (TypeError, ValueError):
+        print("redirect port must be an integer", file=sys.stderr)
+        return 2
+
+    try:
+        token = get_access_token(
+            gitlab_url=gitlab_url,
+            client_id=client_id,
+            client_secret=client_secret,
+            redirect_port=redirect_port,
+            scopes=scopes,
+            force=args.force,
+        )
+    except OAuthError as exc:
+        print(str(exc), file=sys.stderr)
+        return 1
+
+    print(token)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

{pjdev_gitlab-5.1.9 → pjdev_gitlab-5.1.10}/test_report_pjdev-gitlab.txt

@@ -5,65 +5,70 @@ rootdir: /builds/keystone/python/pjdev-gitlab
 configfile: pyproject.toml
 plugins: asyncio-1.4.0, respx-0.23.1, anyio-4.14.1
 asyncio: mode=Mode.AUTO, debug=False, asyncio_default_fixture_loop_scope=None, asyncio_default_test_loop_scope=function
-collecting ... collected 58 items
+collecting ... collected 63 items
 
 tests/tests_for_api_utilities.py::test_build_auth_defaults_to_private_token PASSED [  1%]
 tests/tests_for_api_utilities.py::test_build_auth_selects_bearer_for_oauth PASSED [  3%]
-tests/tests_for_api_utilities.py::test_bearer_scheme_sends_authorization_header PASSED [  5%]
+tests/tests_for_api_utilities.py::test_bearer_scheme_sends_authorization_header PASSED [  4%]
 tests/tests_for_api_utilities.py::test_encode_path_segment PASSED        [  6%]
-tests/tests_for_api_utilities.py::test_paginate_consumes_x_next_page PASSED [  8%]
-tests/tests_for_api_utilities.py::test_async_retry_http_aborts_on_ignored_status PASSED [ 10%]
-tests/tests_for_api_utilities.py::test_async_retry_http_retries_on_5xx PASSED [ 12%]
-tests/tests_for_api_utilities.py::test_upload_to_project_returns_markdown PASSED [ 13%]
-tests/tests_for_issues_service.py::test_search_issues_paginates PASSED   [ 15%]
-tests/tests_for_issues_service.py::test_create_issue_with_image_uploads_first_then_creates PASSED [ 17%]
-tests/tests_for_issues_service.py::test_set_issue_state PASSED           [ 18%]
-tests/tests_for_issues_service.py::test_set_issue_labels_modes PASSED    [ 20%]
-tests/tests_for_issues_service.py::test_aggregate_issues_by_label PASSED [ 22%]
-tests/tests_for_issues_service.py::test_comment_on_issue PASSED          [ 24%]
-tests/tests_for_merge_requests_service.py::test_get_merge_request PASSED [ 25%]
-tests/tests_for_merge_requests_service.py::test_comment_on_merge_request PASSED [ 27%]
-tests/tests_for_merge_requests_service.py::test_inline_diff_comment_payload_shape PASSED [ 29%]
-tests/tests_for_merge_requests_service.py::test_approve_and_unapprove PASSED [ 31%]
-tests/tests_for_models.py::test_config_api_base_url_strips_trailing_slash PASSED [ 32%]
-tests/tests_for_models.py::test_issue_extra_fields_ignored PASSED        [ 34%]
-tests/tests_for_models.py::test_merge_request_basic PASSED               [ 36%]
-tests/tests_for_models.py::test_config_env_loading PASSED                [ 37%]
-tests/tests_for_oauth_service.py::test_make_pkce_challenge_is_s256_of_verifier PASSED [ 39%]
-tests/tests_for_oauth_service.py::test_cache_path_is_per_host_and_private PASSED [ 41%]
-tests/tests_for_oauth_service.py::test_token_if_valid_expiry PASSED      [ 43%]
-tests/tests_for_oauth_service.py::test_store_token_response_roundtrip PASSED [ 44%]
-tests/tests_for_oauth_service.py::test_store_token_response_requires_access_token PASSED [ 46%]
-tests/tests_for_oauth_service.py::test_refresh_access_token_success PASSED [ 48%]
-tests/tests_for_oauth_service.py::test_refresh_access_token_returns_none_on_error PASSED [ 50%]
-tests/tests_for_oauth_service.py::test_get_access_token_reuses_valid_cache PASSED [ 51%]
-tests/tests_for_oauth_service.py::test_get_access_token_refreshes_expired_cache PASSED [ 53%]
-tests/tests_for_oauth_service.py::test_get_access_token_requires_client_id PASSED [ 55%]
-tests/tests_for_packages_service.py::test_upload_generic_package_url_shape PASSED [ 56%]
-tests/tests_for_packages_service.py::test_download_generic_package PASSED [ 58%]
-tests/tests_for_packages_service.py::test_list_packages PASSED           [ 60%]
-tests/tests_for_repo_files_service.py::test_get_file_url_encoded PASSED  [ 62%]
-tests/tests_for_repo_files_service.py::test_download_file_writes_to_dest PASSED [ 63%]
-tests/tests_for_repo_files_service.py::test_download_directory_walks_tree PASSED [ 65%]
-tests/tests_for_work_items_service.py::test_make_work_item_gid_passthrough_and_coerce PASSED [ 67%]
-tests/tests_for_work_items_service.py::test_work_item_from_node_flattens_widgets PASSED [ 68%]
-tests/tests_for_work_items_service.py::test_graphql_raises_on_errors PASSED [ 70%]
-tests/tests_for_work_items_service.py::test_paginate_graphql_follows_end_cursor PASSED [ 72%]
-tests/tests_for_work_items_service.py::test_get_work_item_by_global_id PASSED [ 74%]
-tests/tests_for_work_items_service.py::test_get_work_item_by_project_path_and_iid_uses_namespace_lookup PASSED [ 75%]
-tests/tests_for_work_items_service.py::test_get_work_item_missing_raises PASSED [ 77%]
-tests/tests_for_work_items_service.py::test_search_work_items_paginates_and_translates_state PASSED [ 79%]
-tests/tests_for_work_items_service.py::test_search_work_items_group_scope_uses_group_field PASSED [ 81%]
-tests/tests_for_work_items_service.py::test_search_work_items_requires_one_scope PASSED [ 82%]
-tests/tests_for_work_items_service.py::test_set_work_item_state_closes_via_workItemUpdate PASSED [ 84%]
-tests/tests_for_work_items_service.py::test_set_work_item_state_mutation_errors_raise PASSED [ 86%]
-tests/tests_for_work_items_service.py::test_list_work_item_notes_filters_system_notes PASSED [ 87%]
-tests/tests_for_work_items_service.py::test_comment_on_work_item_creates_note PASSED [ 89%]
-tests/tests_for_work_items_service.py::test_reply_to_work_item_discussion_threads_via_discussion_id PASSED [ 91%]
+tests/tests_for_api_utilities.py::test_paginate_consumes_x_next_page PASSED [  7%]
+tests/tests_for_api_utilities.py::test_async_retry_http_aborts_on_ignored_status PASSED [  9%]
+tests/tests_for_api_utilities.py::test_async_retry_http_retries_on_5xx PASSED [ 11%]
+tests/tests_for_api_utilities.py::test_upload_to_project_returns_markdown PASSED [ 12%]
+tests/tests_for_issues_service.py::test_search_issues_paginates PASSED   [ 14%]
+tests/tests_for_issues_service.py::test_create_issue_with_image_uploads_first_then_creates PASSED [ 15%]
+tests/tests_for_issues_service.py::test_set_issue_state PASSED           [ 17%]
+tests/tests_for_issues_service.py::test_set_issue_labels_modes PASSED    [ 19%]
+tests/tests_for_issues_service.py::test_aggregate_issues_by_label PASSED [ 20%]
+tests/tests_for_issues_service.py::test_comment_on_issue PASSED          [ 22%]
+tests/tests_for_merge_requests_service.py::test_get_merge_request PASSED [ 23%]
+tests/tests_for_merge_requests_service.py::test_comment_on_merge_request PASSED [ 25%]
+tests/tests_for_merge_requests_service.py::test_inline_diff_comment_payload_shape PASSED [ 26%]
+tests/tests_for_merge_requests_service.py::test_approve_and_unapprove PASSED [ 28%]
+tests/tests_for_models.py::test_config_api_base_url_strips_trailing_slash PASSED [ 30%]
+tests/tests_for_models.py::test_issue_extra_fields_ignored PASSED        [ 31%]
+tests/tests_for_models.py::test_merge_request_basic PASSED               [ 33%]
+tests/tests_for_models.py::test_config_env_loading PASSED                [ 34%]
+tests/tests_for_oauth_cli.py::test_missing_client_id_errors PASSED       [ 36%]
+tests/tests_for_oauth_cli.py::test_success_prints_only_token PASSED      [ 38%]
+tests/tests_for_oauth_cli.py::test_reads_config_from_env PASSED          [ 39%]
+tests/tests_for_oauth_cli.py::test_bad_redirect_port_errors PASSED       [ 41%]
+tests/tests_for_oauth_cli.py::test_oauth_error_returns_one PASSED        [ 42%]
+tests/tests_for_oauth_service.py::test_make_pkce_challenge_is_s256_of_verifier PASSED [ 44%]
+tests/tests_for_oauth_service.py::test_cache_path_is_per_host_and_private PASSED [ 46%]
+tests/tests_for_oauth_service.py::test_token_if_valid_expiry PASSED      [ 47%]
+tests/tests_for_oauth_service.py::test_store_token_response_roundtrip PASSED [ 49%]
+tests/tests_for_oauth_service.py::test_store_token_response_requires_access_token PASSED [ 50%]
+tests/tests_for_oauth_service.py::test_refresh_access_token_success PASSED [ 52%]
+tests/tests_for_oauth_service.py::test_refresh_access_token_returns_none_on_error PASSED [ 53%]
+tests/tests_for_oauth_service.py::test_get_access_token_reuses_valid_cache PASSED [ 55%]
+tests/tests_for_oauth_service.py::test_get_access_token_refreshes_expired_cache PASSED [ 57%]
+tests/tests_for_oauth_service.py::test_get_access_token_requires_client_id PASSED [ 58%]
+tests/tests_for_packages_service.py::test_upload_generic_package_url_shape PASSED [ 60%]
+tests/tests_for_packages_service.py::test_download_generic_package PASSED [ 61%]
+tests/tests_for_packages_service.py::test_list_packages PASSED           [ 63%]
+tests/tests_for_repo_files_service.py::test_get_file_url_encoded PASSED  [ 65%]
+tests/tests_for_repo_files_service.py::test_download_file_writes_to_dest PASSED [ 66%]
+tests/tests_for_repo_files_service.py::test_download_directory_walks_tree PASSED [ 68%]
+tests/tests_for_work_items_service.py::test_make_work_item_gid_passthrough_and_coerce PASSED [ 69%]
+tests/tests_for_work_items_service.py::test_work_item_from_node_flattens_widgets PASSED [ 71%]
+tests/tests_for_work_items_service.py::test_graphql_raises_on_errors PASSED [ 73%]
+tests/tests_for_work_items_service.py::test_paginate_graphql_follows_end_cursor PASSED [ 74%]
+tests/tests_for_work_items_service.py::test_get_work_item_by_global_id PASSED [ 76%]
+tests/tests_for_work_items_service.py::test_get_work_item_by_project_path_and_iid_uses_namespace_lookup PASSED [ 77%]
+tests/tests_for_work_items_service.py::test_get_work_item_missing_raises PASSED [ 79%]
+tests/tests_for_work_items_service.py::test_search_work_items_paginates_and_translates_state PASSED [ 80%]
+tests/tests_for_work_items_service.py::test_search_work_items_group_scope_uses_group_field PASSED [ 82%]
+tests/tests_for_work_items_service.py::test_search_work_items_requires_one_scope PASSED [ 84%]
+tests/tests_for_work_items_service.py::test_set_work_item_state_closes_via_workItemUpdate PASSED [ 85%]
+tests/tests_for_work_items_service.py::test_set_work_item_state_mutation_errors_raise PASSED [ 87%]
+tests/tests_for_work_items_service.py::test_list_work_item_notes_filters_system_notes PASSED [ 88%]
+tests/tests_for_work_items_service.py::test_comment_on_work_item_creates_note PASSED [ 90%]
+tests/tests_for_work_items_service.py::test_reply_to_work_item_discussion_threads_via_discussion_id PASSED [ 92%]
 tests/tests_for_work_items_service.py::test_set_work_item_labels_add_passes_addLabelIds PASSED [ 93%]
-tests/tests_for_work_items_service.py::test_set_work_item_labels_remove_passes_removeLabelIds PASSED [ 94%]
+tests/tests_for_work_items_service.py::test_set_work_item_labels_remove_passes_removeLabelIds PASSED [ 95%]
 tests/tests_for_work_items_service.py::test_list_labels_for_project_includes_ancestor_groups PASSED [ 96%]
 tests/tests_for_work_items_service.py::test_create_label_passes_project_path_color_and_description PASSED [ 98%]
 tests/tests_for_work_items_service.py::test_create_label_group_scope_passes_group_path PASSED [100%]
 
-============================== 58 passed in 1.76s ==============================
+============================== 63 passed in 1.91s ==============================

pjdev_gitlab-5.1.10/tests/tests_for_oauth_cli.py

@@ -0,0 +1,85 @@
+import sys
+
+import pytest
+
+from pjdev_gitlab import oauth_cli
+from pjdev_gitlab.oauth_service import OAuthError
+
+
+@pytest.fixture(autouse=True)
+def _clear_oauth_env(monkeypatch):
+    for key in (
+        "GL_GITLAB_URL",
+        "GL_OAUTH_CLIENT_ID",
+        "GL_OAUTH_CLIENT_SECRET",
+        "GL_OAUTH_REDIRECT_PORT",
+        "GL_OAUTH_SCOPES",
+    ):
+        monkeypatch.delenv(key, raising=False)
+
+
+def _run(monkeypatch, argv):
+    monkeypatch.setattr(sys, "argv", ["pjdev-gitlab-auth", *argv])
+    return oauth_cli.main()
+
+
+def test_missing_client_id_errors(monkeypatch, capsys):
+    rc = _run(monkeypatch, ["--gitlab-url", "https://gitlab.example.com"])
+    assert rc == 2
+    out = capsys.readouterr()
+    assert out.out == ""  # never print a partial/empty token
+    assert "client id" in out.err.lower()
+
+
+def test_success_prints_only_token(monkeypatch, capsys):
+    captured = {}
+
+    def fake_get(**kwargs):
+        captured.update(kwargs)
+        return "TOK123"
+
+    monkeypatch.setattr(oauth_cli, "get_access_token", fake_get)
+    rc = _run(
+        monkeypatch,
+        ["--gitlab-url", "https://gitlab.example.com", "--client-id", "cid", "--force"],
+    )
+    assert rc == 0
+    out = capsys.readouterr()
+    assert out.out.strip() == "TOK123"
+    assert captured["gitlab_url"] == "https://gitlab.example.com"
+    assert captured["client_id"] == "cid"
+    assert captured["force"] is True
+    assert captured["scopes"] == "api"
+
+
+def test_reads_config_from_env(monkeypatch, capsys):
+    monkeypatch.setenv("GL_GITLAB_URL", "https://env.example.com")
+    monkeypatch.setenv("GL_OAUTH_CLIENT_ID", "env-cid")
+    captured = {}
+    monkeypatch.setattr(
+        oauth_cli, "get_access_token", lambda **k: captured.update(k) or "ENVTOK"
+    )
+    rc = _run(monkeypatch, [])
+    assert rc == 0
+    assert capsys.readouterr().out.strip() == "ENVTOK"
+    assert captured["gitlab_url"] == "https://env.example.com"
+    assert captured["client_id"] == "env-cid"
+
+
+def test_bad_redirect_port_errors(monkeypatch):
+    # argparse rejects a non-int --redirect-port with SystemExit(2).
+    with pytest.raises(SystemExit) as exc:
+        _run(monkeypatch, ["--client-id", "cid", "--redirect-port", "notaport"])
+    assert exc.value.code == 2
+
+
+def test_oauth_error_returns_one(monkeypatch, capsys):
+    def boom(**_kwargs):
+        raise OAuthError("nope")
+
+    monkeypatch.setattr(oauth_cli, "get_access_token", boom)
+    rc = _run(monkeypatch, ["--client-id", "cid"])
+    assert rc == 1
+    out = capsys.readouterr()
+    assert out.out == ""
+    assert "nope" in out.err