pushframe 5.1.2__tar.gz → 5.1.3__tar.gz

{pushframe-5.1.2 → pushframe-5.1.3}/CHANGELOG.md

@@ -14,6 +14,33 @@ frames; it is not affiliated with Aura Frames Inc.
 
 ## [Unreleased]
 
+## [5.1.3] — 2026-09-30
+
+### Fixed
+
+- **`pushframe config` — Enter now keeps the stored email, as the banner
+  always promised** (venus, 5.1.2): an empty answer on a configured
+  install aborted with "no email given — aborting" instead of keeping
+  it. With a stored token, Enter-Enter now finishes the wizard with ZERO
+  API calls (the anti-abuse rule: no gratuitous login); typing a new
+  email still re-logins, and a fresh install still aborts named on an
+  empty answer.
+- **Prompt-contract audit — every interactive prompt checked against its
+  banner**, one behavior test per prompt. Two more promised-vs-real gaps
+  fixed alongside the wizard's: the session-path login prompt (expired
+  token refresh) showed NO banner and aborted the login on a bare Enter —
+  it now prints the same "current email — Enter keeps it" banner and
+  keeps it; and the two hard-delete confirmation gates only said "To
+  confirm, type the number…" — now "Verbatim to confirm —", because the
+  y/N reflex answer being silently rejected WAS the contract, just never
+  the wording. google-link's manual Enter prompt reworded to make the
+  AFTER-login gate explicit ("log into Google …, THEN press Enter"); no
+  behavior change there.
+- **The wizard's default-frame question loops on a bad answer**: an
+  out-of-range or non-numeric entry used to be silently treated as a
+  skip — it now re-asks with `invalid choice, pick 1-N or Enter to skip`
+  until a valid number is picked or an explicit Enter skips.
+
 ## [5.1.2] — 2026-09-30
 
 ### Changed (tests)

{pushframe-5.1.2 → pushframe-5.1.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: pushframe
-Version: 5.1.2
+Version: 5.1.3
 Summary: Unofficial community CLI for Aura Frames digital photo frames (sync a local folder or a Google Photos album; not affiliated with Aura Frames Inc.)
 Project-URL: Homepage, https://github.com/coredmp95/pushframe
 Project-URL: Repository, https://github.com/coredmp95/pushframe

{pushframe-5.1.2 → pushframe-5.1.3}/docs/CLI.md

@@ -108,14 +108,34 @@ tokens; safe to repeat; never run it in CI.
 
 ### When the anti-abuse layer refuses your writes
 
-Pushd's anti-abuse layer can refuse writes while reads and login keep
-working (proven venus, 2026-09). The refusal body says
-`"Request Unauthenticated"` — **that is the trip's disguise, not a token
-problem**. pushframe recognizes it and stops on the FIRST refusal (no
-retry, no re-login — both feed the trip). The drill:
+Pushd's anti-abuse layer can refuse writes while reads keep working
+(proven venus, 2026-09). It has two shapes — learn both, the disguised
+one is the trap:
+
+| Surface | Shape | Server body |
+|---|---|---|
+| `login.json` | **HTTP 475** — explicit lockout | "Aura API is rate-limiting or has locked out this account" |
+| everything else — **token included** | **HTTP 401** — the trip in disguise | `{"error": true, "message": "Request Unauthenticated", "logout": true}` |
+
+The 401 arrives on a FRESH token, seconds after a successful login: it
+means "we refuse this client's writes (trip)", not "your token is bad".
+The trip is **account-wide** — not scoped to the session, the endpoint
+that provoked it, or the login that just succeeded — and it can spread
+to more surfaces when provoked (venus: writes-only 401 first; after
+probe activity, `login.json` itself went 475).
+
+**Never re-login, never retry.** Every call that touches a tripped
+surface re-arms the clock, and a fresh login bypasses nothing — the
+trip is not session-scoped. Venus's counter-evidence: 8 doctor probes
+spread over 7 hours, all 475, each one buying another wait — the probes
+were the reason nothing cleared. pushframe already stops on the FIRST
+trip-shaped refusal (`TripDetectedError` — no retry, no re-login); the
+discipline is yours to keep outside the tool.
+
+The drill:
 
 1. `pushframe doctor` before any sync (GO = the write surface is open NOW)
-2. Trip detected → wait **60+ min** from the stop, then `pushframe doctor` again
+2. Trip detected → wait **60+ min** from the stop, then `pushframe doctor` again — **once**. A second tripped doctor is the signal to stop doctoring (every probe re-arms the clock) and escalate to the 24-hour protocol below.
 3. If doctor passes but a sync still trips immediately, lower the per-batch
    volume — the trip keys on batch size (a 1-item write may pass where a
    50-item chunk is refused):
@@ -123,6 +143,26 @@ retry, no re-login — both feed the trip). The drill:
    pushframe google-sync Cadre --frame "Cadre de Fabrice" --apply --yes --batch-size 10
    ```
 
+#### The 24-hour probe protocol (escalated recovery)
+
+When 60+ minutes does not clear the trip (venus, 2026-09-30: still
+tripped after a ~5-hour silence), stop probing and switch to days:
+
+1. **Total silence.** No pushframe command of any kind against the
+   account — and nothing automated either: a timer or a loop probing
+   hourly keeps the account tripped indefinitely.
+2. **After 24h+ of silence, ONE probe — a read, never a doctor.**
+   `pushframe status` resumes the stored token session (no login call,
+   no write). Doctor is the WRONG first probe here: its write attempt
+   re-arms the clock even while it tells you the truth.
+3. **Probe green** (reads answer) → ONE `pushframe doctor` as the single
+   write probe. GO → run the sync with a lowered batch size (step 3
+   above). Probe trips → back to step 1; next probe in another 24h.
+
+Never two probes in one 24h bucket. The wait has no measured shape —
+what is measured is only that hours do not cut it, and every premature
+call restarts it.
+
 **Client identity matters.** Pushd's anti-abuse layer also fingerprints
 the client itself: a years-stale `Aura/4.7.790` user agent and the
 all-zeros `0000000000000000` device identifier shared by every pushframe
@@ -196,12 +236,17 @@ the file is `~/.config/pushframe/config.json`, mode `0600`, written atomically.
 
 ### The wizard (`pushframe config`)
 
-Asks for your email, then your password (**hidden input**), then **verifies the
-login against the real Aura API before writing anything** — a failed login writes
-nothing. On success it stores the email plus the session `auth_token` (not the
-password; a stored token is silently refreshed at re-login), then offers the
-optional questions (country for the geo guard, budget tuning) with current
-effective values as defaults.
+On a fresh install it asks for your email, then your password (**hidden
+input**), then **verifies the login against the real Aura API before writing
+anything** — a failed login writes nothing. On an install that already has an
+email stored, **pressing Enter keeps the stored email** — the banner says so and
+means it: with a stored session token, a second Enter reuses the token and the
+wizard finishes WITHOUT any API call (the anti-abuse rule: no gratuitous
+login); only typing a NEW email moves to the password question. On success it
+stores the email plus the session `auth_token` (not the password; a stored
+token is silently refreshed at re-login), then offers the optional questions
+(country for the geo guard, budget tuning) with current effective values as
+defaults.
 
 Refuses to run when stdin is not a terminal — scheduled jobs have nothing to
 interact with; feed them the environment or the config file instead.
@@ -769,6 +814,12 @@ affects uploads, hides and deletes alike.
 **There is no automatic retry yet.** If an apply reports 401 failures, simply run it again.
 The operation is safe to repeat: uploads dedupe by md5, and hides are idempotent.
 
+This covers the *transient* 401s — the no-special-body failures. If the
+body says `"Request Unauthenticated"`, that is the anti-abuse trip, not
+a transient failure: do NOT run it again, do NOT re-login — see [When
+the anti-abuse layer refuses your
+writes](#when-the-anti-abuse-layer-refuses-your-writes).
+
 ### A frame's asset count disagrees with its listing
 
 `inspect` can report e.g. `Assets: 172` while listing `154`. The frame's own counter and the

{pushframe-5.1.2 → pushframe-5.1.3}/pushframe/__init__.py

@@ -1,4 +1,4 @@
 # pushframe — unofficial community CLI for Aura Frames (not affiliated).
 # Version single source for the CLI surface (REL-02); pyproject keeps the
 # packaging metadata version and tests/test_version.py enforces lockstep.
-__version__ = "5.1.2"
+__version__ = "5.1.3"

{pushframe-5.1.2 → pushframe-5.1.3}/pushframe/cli.py

@@ -385,6 +385,11 @@ def run_config(wizard_args=None, stdin_isatty: bool | None = None) -> int:
     else:
         print('configuring pushframe — credentials are login-tested now, stored after.')
     email = input('Aura email: ').strip()
+    if not email and existing.get('email'):
+        # The banner promised "Enter keeps it" — keep that promise. With a
+        # stored token this path finishes with ZERO API calls (anti-abuse:
+        # a gratuitous login is exactly what the trip punishes).
+        email = existing['email']
     if not email:
         print('no email given — aborting, nothing written.')
         return 1
@@ -415,7 +420,12 @@ def run_config(wizard_args=None, stdin_isatty: bool | None = None) -> int:
         for i, f in enumerate(frames, 1):
             print(f'  {i}. {f["name"]}')
         choice = input('default frame number (Enter to skip): ').strip()
-        if choice.isdigit() and 1 <= int(choice) <= len(frames):
+        # Prompt-contract audit fix: an out-of-range or non-numeric answer
+        # used to be silently treated as a skip — re-ask until a valid
+        # number or an explicit Enter.
+        while choice and not (choice.isdigit() and 1 <= int(choice) <= len(frames)):
+            choice = input(f'invalid choice, pick 1-{len(frames)} or Enter to skip: ').strip()
+        if choice:
             data['default_frame'] = frames[int(choice) - 1]['name']
     debug = input('enable debug logging by default? [y/N] ').strip().lower()
     if debug in ('y', 'yes'):
@@ -1073,7 +1083,7 @@ def run_reconcile(frame_arg: str, *, remove: bool = False, yes: bool = False, me
                 count = len(result.stuck)
                 print(f'IRREVERSIBLE: {count} row(s) will be permanently destroyed '
                       f'account-wide via hard-delete. This cannot be undone.')
-                answer = input(f'To confirm, type the number of rows to hard-delete ({count}): ')
+                answer = input(f'Verbatim to confirm — type the number of rows to hard-delete ({count}): ')
                 if answer.strip() != str(count):
                     print('Aborted.')
                     return 0
@@ -1321,7 +1331,7 @@ def run_sync(dir_arg: str, frame_arg: str, apply: bool = False, yes: bool = Fals
                 count = len(plan.to_delete)
                 print(f'IRREVERSIBLE: {count} photo(s) will be permanently destroyed '
                       f'account-wide, not just removed from this frame. This cannot be undone.')
-                answer = input(f'To confirm, type the number of photos to hard-delete ({count}): ')
+                answer = input(f'Verbatim to confirm — type the number of photos to hard-delete ({count}): ')
                 if answer.strip() != str(count):
                     print('Aborted.')
                     return 0

{pushframe-5.1.2 → pushframe-5.1.3}/pushframe/google/bootstrap.py

@@ -84,12 +84,25 @@ def _require_profile() -> Path:
     return path
 
 
+def _enter_after_login(context, *, input_fn=input):
+    """Manual-mode harvest close: the Enter comes AFTER the login in the
+    opened window and only closes the harvest — the cookie check after it
+    (not the Enter itself) decides success. Seam for offline tests."""
+    input_fn("…log into Google in the opened window, THEN press Enter "
+             "here to finish the harvest> ")
+    cookies = context.cookies()
+    context.close()
+    return cookies
+
+
 def run_bootstrap(*, auto: bool = False) -> dict:
     """Open the dedicated-profile browser, harvest cookies, save the vault.
 
     auto=True polls the context for completed Google auth (SAPISID-family
     cookies) instead of waiting for an Enter in the terminal — for runs
-    launched from a non-interactive shell. Returns an identity summary dict:
+    launched from a non-interactive shell. In manual mode the Enter comes
+    AFTER the login and only closes the harvest — the cookie check below
+    still decides success. Returns an identity summary dict:
     {vault_path, cookie_count, auth_markers} — never cookie values.
     """
     profile_dir = _require_profile()
@@ -181,9 +194,7 @@ def run_bootstrap(*, auto: bool = False) -> dict:
             cookies = context.cookies()
             context.close()
         else:
-            input("…press Enter here AFTER logging in on the opened window> ")
-            cookies = context.cookies()
-            context.close()
+            cookies = _enter_after_login(context, input_fn=input)
 
     if not any(c["name"] in ("SID", "SAPISID", "__Secure-1PSID") for c in cookies):
         raise BootstrapError(

{pushframe-5.1.2 → pushframe-5.1.3}/pushframe/session.py

@@ -71,7 +71,18 @@ def _prompt_login(aura, stdin_isatty: bool):
             'stored session expired and stdin is not a terminal — re-run '
             '`pushframe config` once interactively (or set PUSHFRAME_EMAIL/'
             'PUSHFRAME_PASSWORD for this run)')
+    stored_email = config_store.load().get('email')
+    if stored_email:
+        print(f"configuring pushframe (current email: {stored_email} — Enter keeps it)")
     email = input('Aura email: ').strip()
+    if not email and stored_email:
+        # Same contract as the wizard's prompt (fixed in 5.1.2): the banner
+        # promised "Enter keeps it" — an empty answer keeps the stored email
+        # instead of feeding an empty email to the login.
+        email = stored_email
+    if not email:
+        print('no email given — aborting, nothing stored.')
+        return None
     password = getpass.getpass('Aura password (input hidden): ')
     result = _wizard_login(email, password)
     _store_token(result['email'], result['auth_token'], result.get('user_id'))
@@ -79,6 +90,18 @@ def _prompt_login(aura, stdin_isatty: bool):
     return aura
 
 
+def _prompt_login_or_fail(aura, stdin_isatty):
+    """_prompt_login may abort (empty email on a never-configured host);
+    establish_session must surface that as the named no-credentials error
+    instead of returning None where an Aura was expected."""
+    result = _prompt_login(aura, stdin_isatty)
+    if result is None:
+        raise NoCredentialsError(
+            'login aborted (no email given) — no session stored; '
+            're-run the command to retry')
+    return result
+
+
 def establish_session(aura=None, *, stdin_isatty: bool | None = None,
                       do_prompt: bool = True):
     """Return an authenticated Aura. See module docstring for precedence.
@@ -120,11 +143,11 @@ def establish_session(aura=None, *, stdin_isatty: bool | None = None,
                     f'terminal — re-run `pushframe config` once '
                     f'interactively') from e
             print('stored session expired — one re-login to refresh it:')
-            return _prompt_login(aura, stdin_isatty)
+            return _prompt_login_or_fail(aura, stdin_isatty)
 
     # 3. interactive first-time setup (same ONE prompt)
     if do_prompt and stdin_isatty:
-        return _prompt_login(aura, stdin_isatty)
+        return _prompt_login_or_fail(aura, stdin_isatty)
 
     # 4. nothing available — named, with the remedy
     raise NoCredentialsError(

{pushframe-5.1.2 → pushframe-5.1.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pushframe"
-version = "5.1.2"
+version = "5.1.3"
 description = "Unofficial community CLI for Aura Frames digital photo frames (sync a local folder or a Google Photos album; not affiliated with Aura Frames Inc.)"
 readme = "README.md"
 requires-python = ">=3.14"

{pushframe-5.1.2 → pushframe-5.1.3}/tests/test_cli_apply.py

@@ -501,6 +501,28 @@ def test_hard_delete_with_yes_skips_the_gate(tmp_path, monkeypatch, capsys):
     assert len(calls) == 1
 
 
+def test_hard_delete_prompt_states_the_verbatim_rule(tmp_path, monkeypatch, capsys):
+    """Prompt-contract audit: the gate's prompt now SAYS the verbatim rule —
+    a reflex 'y' was always rejected; the wording finally admits it."""
+    monkeypatch.setattr(cli.sys.stdin, 'isatty', lambda: True)
+    prompts = []
+
+    def fake_input(prompt=''):
+        prompts.append(prompt)
+        return 'y'  # the reflex answer
+
+    monkeypatch.setattr('builtins.input', fake_input)
+
+    rc, calls = _run_apply(tmp_path, monkeypatch,
+                           _assets_response_with_settings(_removal_candidate()),
+                           yes=False, removal_mode='hard_delete')
+
+    assert rc == 0
+    assert 'Verbatim to confirm' in prompts[-1]
+    assert 'Aborted.' in capsys.readouterr().out
+    assert calls == []
+
+
 def test_reshow_is_reported_in_plan_and_summary(tmp_path, monkeypatch, capsys):
     """A photo present locally but hidden on the frame is a re-show, and gets
     its own line rather than being folded into unchanged (D-08)."""

{pushframe-5.1.2 → pushframe-5.1.3}/tests/test_cli_google_link.py

@@ -97,6 +97,37 @@ def test_google_link_bootstrap_error_exits_nonzero(monkeypatch, capsys):
     assert "no auth cookies detected" in capsys.readouterr().out
 
 
+def test_manual_enter_prompt_states_the_login_before_enter_contract(monkeypatch, capsys):
+    """Prompt-contract audit: the manual-mode Enter prompt reads as
+    "log in, THEN press Enter" — the Enter closes the harvest, the login
+    is a Google-window action BEFORE it, and the cookie check after the
+    Enter — not the Enter itself — decides success."""
+    from pushframe.google import bootstrap as bs
+
+    class _FakeContext:
+        def cookies(self):
+            return [{"name": "SID", "value": "x", "domain": ".google.com", "path": "/"},
+                    {"name": "SAPISID", "value": "y", "domain": ".google.com", "path": "/"}]
+
+        def close(self):
+            pass
+
+    entered = []
+
+    def fake_input(prompt=""):
+        entered.append(prompt)
+        return ""
+
+    cookies = bs._enter_after_login(_FakeContext(), input_fn=fake_input)
+
+    assert len(entered) == 1
+    prompt = entered[0]
+    low = prompt.lower()
+    assert "log into google" in low and "then press enter" in low
+    # the harvest closed with the typed Enter; cookies came back from it
+    assert {c["name"] for c in cookies} == {"SID", "SAPISID"}
+
+
 def test_google_link_never_prints_cookie_values(monkeypatch, capsys):
     """Even the fake bootstrap's summary dict is value-free; if a cookie
     VALUE ever leaked into the flow, this grep would catch it."""

{pushframe-5.1.2 → pushframe-5.1.3}/tests/test_cli_reconcile.py

@@ -310,3 +310,83 @@ def test_run_reconcile_remove_yes_end_to_end_removes_stuck_rows(monkeypatch, cap
     assert rc == 0
     out = capsys.readouterr().out
     assert 'Removed: 3 succeeded, 0 failed' in out
+
+
+def test_run_reconcile_hard_delete_interactive_gate_rejects_everything_but_the_count(monkeypatch, capsys):
+    """Prompt-contract audit: the hard-delete gate demands the VERBATIM row
+    count — the prompt says so, the reflex 'y' is rejected, any other text
+    too, and NO write path is touched on any wrong answer."""
+    monkeypatch.setenv('AURA_EMAIL', 'you@example.invalid')
+    monkeypatch.setenv('AURA_PASSWORD', 'super-secret-pw')
+    monkeypatch.setattr('sys.stdin.isatty', lambda: True)
+
+    aura = offline_aura(overrides={ASSETS_PATH: _placeholder_assets_response()})
+
+    for wrong in ('y', '12', ''):  # 3 stuck rows in the fixture; none of these is '3'
+        prompts = []
+
+        def fake_input(prompt='', _p=prompts):
+            _p.append(prompt)
+            return wrong
+
+        monkeypatch.setattr('builtins.input', fake_input)
+        rc = run_reconcile('Fake', aura=aura, remove=True, yes=False,
+                           mechanism='hard-delete')
+        assert rc == 0
+        assert 'Verbatim to confirm' in prompts[-1]
+        assert '(3)' in prompts[-1]
+        assert 'Aborted.' in capsys.readouterr().out
+        assert _write_paths_hit(aura) == []
+
+
+def test_run_reconcile_hard_delete_proceeds_on_the_exact_count(monkeypatch, capsys):
+    monkeypatch.setenv('AURA_EMAIL', 'you@example.invalid')
+    monkeypatch.setenv('AURA_PASSWORD', 'super-secret-pw')
+    monkeypatch.setattr('sys.stdin.isatty', lambda: True)
+    monkeypatch.setattr(cli_module, '_build_write_budget', lambda email, ignore_budget: None)
+    monkeypatch.setattr('builtins.input', lambda *_: '3')  # exactly the fixture's stuck count
+    # The offline router has no canned DELETE /v5/assets/{id} route — prove
+    # the GATE lets the exact count through by observing the primitive's
+    # calls instead (the endpoint's own behavior is covered in test_reconcile).
+    import pushframe.reconcile as reconcile_mod
+    sent = []
+
+    def _fake_hard_delete(aura_, frame_id, chunk):
+        sent.extend(asset.id for asset in chunk)
+        return [object()] * len(chunk)
+
+    monkeypatch.setitem(reconcile_mod._RECONCILE_PRIMITIVE, 'hard-delete',
+                        _fake_hard_delete)
+
+    aura = offline_aura(overrides={ASSETS_PATH: _placeholder_assets_response()})
+
+    rc = run_reconcile('Fake', aura=aura, remove=True, yes=False,
+                       mechanism='hard-delete')
+
+    assert rc == 0
+    assert len(sent) == 3
+
+
+def test_run_reconcile_remove_interactive_y_n_gate(monkeypatch, capsys):
+    """Prompt-contract audit: the default (remove) mechanism's interactive
+    gate is a real y/N — the prompt says so, a non-y answer aborts before
+    any write."""
+    monkeypatch.setenv('AURA_EMAIL', 'you@example.invalid')
+    monkeypatch.setenv('AURA_PASSWORD', 'super-secret-pw')
+    monkeypatch.setattr('sys.stdin.isatty', lambda: True)
+    prompts = []
+
+    def fake_input(prompt=''):
+        prompts.append(prompt)
+        return 'n'
+
+    monkeypatch.setattr('builtins.input', fake_input)
+
+    aura = offline_aura(overrides={ASSETS_PATH: _placeholder_assets_response()})
+
+    rc = run_reconcile('Fake', aura=aura, remove=True, yes=False, mechanism='remove')
+
+    assert rc == 0
+    assert 'Proceed? [y/N]' in prompts[-1]
+    assert 'Aborted.' in capsys.readouterr().out
+    assert _write_paths_hit(aura) == []

{pushframe-5.1.2 → pushframe-5.1.3}/tests/test_config_wizard.py

@@ -105,6 +105,83 @@ def test_wizard_provisioning_keeps_sibling_settings(cfg_path, monkeypatch, fake_
     assert st["DEVICE_IDENTIFIER"] != "0000000000000000"
 
 
+def test_wizard_enter_keeps_existing_email(cfg_path, monkeypatch, capsys):
+    """CLI contract (venus, 5.1.2): the banner promises "Enter keeps it"
+    and Enter must keep it — an empty answer on a configured install keeps
+    the stored email and offers the stored token (Enter again finishes the
+    wizard with ZERO API calls). A fresh install (no stored email) still
+    aborts named on an empty answer."""
+    from pushframe.cli import run_config
+    config_store.update(email='coredmp95@gmail.com', auth_token='tok-keep')  # noqa: S105
+
+    _feed(monkeypatch, ['', ''])  # Enter email → Enter keep-token → done
+    assert run_config(wizard_args=[], stdin_isatty=True) == 0
+    data = json.loads(cfg_path.read_text())
+    assert data['email'] == 'coredmp95@gmail.com'
+    assert data['auth_token'] == 'tok-keep'  # noqa: S105
+    assert 'config saved' in capsys.readouterr().out
+
+    # fresh install: no stored email — empty Enter aborts, writes no session
+    cfg_path.unlink()
+    _feed(monkeypatch, [''])
+    assert run_config(wizard_args=[], stdin_isatty=True) == 1
+    data = json.loads(cfg_path.read_text())
+    assert 'email' not in data and 'auth_token' not in data  # noqa: S105
+    assert 'no email given' in capsys.readouterr().out
+
+
+def test_wizard_frame_number_enter_skips_prompt_contract(cfg_path, monkeypatch, fake_login_ok, capsys):
+    """Prompt-contract audit: 'default frame number (Enter to skip)' — a
+    bare Enter must skip and store NO default_frame; a valid index selects
+    the frame."""
+    from pushframe.cli import run_config
+
+    # Enter skips: no default_frame lands in the file
+    _feed(monkeypatch, ['me@example.invalid', 's3cret', '', ''])  # noqa: S105
+    assert run_config(wizard_args=[], stdin_isatty=True) == 0
+    data = json.loads(cfg_path.read_text())
+    assert 'default_frame' not in data
+
+    # a valid index selects the frame
+    cfg_path.unlink()
+    _feed(monkeypatch, ['me@example.invalid', 's3cret', '1', ''])  # noqa: S105
+    assert run_config(wizard_args=[], stdin_isatty=True) == 0
+    assert json.loads(cfg_path.read_text())['default_frame'] == 'Cadre de Fabrice'
+
+
+def test_wizard_frame_number_out_of_range_re_asked_until_valid_or_skip(cfg_path, monkeypatch, fake_login_ok, capsys):
+    """The loop (wart fix): an out-of-range or non-numeric answer is
+    RE-ASKED with the named remedy — 'invalid choice, pick 1-N or Enter to
+    skip' — until a valid number is picked or an explicit Enter skips."""
+    from pushframe.cli import run_config
+
+    # invalid '9' → re-ask → '1' selected
+    prompts = []
+    answers = iter(['me@example.invalid', '9', '1', ''])
+
+    def fake_input(prompt=''):
+        prompts.append(prompt)
+        return next(answers)
+
+    monkeypatch.setattr('builtins.input', fake_input)
+    monkeypatch.setattr('getpass.getpass', lambda *a: 's3cret')  # noqa: S105
+    assert run_config(wizard_args=[], stdin_isatty=True) == 0
+    data = json.loads(cfg_path.read_text())
+    assert data['default_frame'] == 'Cadre de Fabrice'
+    assert prompts.count('invalid choice, pick 1-1 or Enter to skip: ') == 1
+    assert any(p.endswith('default frame number (Enter to skip): ')
+               for p in prompts)
+
+    # invalid '0' → re-ask → explicit Enter skips (session still saved)
+    cfg_path.unlink()
+    prompts.clear()
+    answers = iter(['me@example.invalid', '0', '', ''])
+    assert run_config(wizard_args=[], stdin_isatty=True) == 0
+    data = json.loads(cfg_path.read_text())
+    assert 'default_frame' not in data and data['auth_token']  # noqa: S105
+    assert prompts.count('invalid choice, pick 1-1 or Enter to skip: ') == 1
+
+
 def test_show_warns_on_all_zeros_device_identity(cfg_path, capsys, monkeypatch):
     """Identity hygiene (5.1.1): config show names the shared all-zeros
     device id with its remedy; a provisioned or explicit id silences it."""

{pushframe-5.1.2 → pushframe-5.1.3}/tests/test_session.py

@@ -171,3 +171,53 @@ def test_resume_401_propagates_into_the_tty_path():
     assert session_mod._is_auth_failure(RuntimeError(
         "Client error '401 Unauthorized' for url '...'"))
     assert not session_mod._is_auth_failure(ValueError("corrupt config"))
+
+
+def test_prompt_login_bare_enter_keeps_stored_email(cfg_path, monkeypatch, capsys):
+    """Prompt-contract audit: the session-path login prompt shows the same
+    "current email — Enter keeps it" banner as the wizard, and a bare Enter
+    KEEPS it — exactly one login call, none with an empty email."""
+    _clear_creds(monkeypatch)
+    _store_session(cfg_path, email="vaulted@example.invalid")
+
+    from pushframe import session as session_mod
+    logins = []
+
+    def _fake_login(e, p):
+        logins.append((e, p))
+        return {"email": e, "auth_token": "fresh-tok",  # noqa: S105
+                "user_id": "u-1", "frames": []}
+
+    monkeypatch.setattr(session_mod, "_wizard_login", _fake_login)
+    monkeypatch.setattr("builtins.input", lambda *a: "")  # bare Enter
+    import getpass as gp
+    monkeypatch.setattr(gp, "getpass", lambda *a: "typed-pw")  # noqa: S105
+
+    aura = session_mod._prompt_login(_RecordingAura(), True)
+
+    out = capsys.readouterr().out
+    assert "current email: vaulted@example.invalid" in out
+    assert "Enter keeps it" in out
+    assert logins == [("vaulted@example.invalid", "typed-pw")]  # noqa: S105
+    assert aura is not None
+    assert json.loads(cfg_path.read_text())["auth_token"] == "fresh-tok"  # noqa: S105
+
+
+def test_prompt_login_empty_email_on_fresh_install_aborts_named(cfg_path, monkeypatch, capsys):
+    """The other branch of the same contract: with NO stored email, a bare
+    Enter aborts named BEFORE the password question and before any login —
+    establish_session surfaces it as the named no-credentials error."""
+    _clear_creds(monkeypatch)
+
+    from pushframe import session as session_mod
+    from pushframe.session import NoCredentialsError
+
+    monkeypatch.setattr(
+        session_mod, "_wizard_login",
+        lambda *a, **k: pytest.fail("no login call with an empty email"))
+    monkeypatch.setattr("builtins.input", lambda *a: "")
+
+    with pytest.raises(NoCredentialsError) as exc:
+        session_mod._prompt_login_or_fail(_RecordingAura(), True)
+    assert "no email given" in capsys.readouterr().out
+    assert "login aborted" in str(exc.value)

{pushframe-5.1.2 → pushframe-5.1.3}/tests/test_version.py

@@ -19,7 +19,7 @@ PYPROJECT = Path(__file__).resolve().parent.parent / "pyproject.toml"
 def test_version_is_first_distribution_release():
     """The current distribution release (moved off 0.1.0 at 5.0.0; page
     metadata fix shipped in 5.0.4)."""
-    assert __version__ == "5.1.2"
+    assert __version__ == "5.1.3"
 
 
 def test_version_matches_pyproject_single_source():

{pushframe-5.1.2 → pushframe-5.1.3}/uv.lock

@@ -432,7 +432,7 @@ wheels = [
 
 [[package]]
 name = "pushframe"
-version = "5.1.2"
+version = "5.1.3"
 source = { editable = "." }
 dependencies = [
     { name = "boto3" },