pushframe 5.1.2__tar.gz → 5.1.4__tar.gz

pushframe-5.1.4/.planning/debug/status-crash-401-trip.md

@@ -0,0 +1,61 @@
+---
+slug: status-crash-401-trip
+status: resolved
+created: 2026-09-30T16:20:00+02:00
+updated: 2026-09-30T16:45:00+02:00
+trigger: pushframe status crashes with a raw httpx traceback when the account's anti-abuse trip is armed (401 logout:true on frames.json)
+---
+
+# Debug: status crashes with raw traceback on tripped-account 401
+
+## Symptoms
+
+- expected: `pushframe status` resumes the stored token session and either lists frames or fails NAMED with a remedy (PRF-02 contract: never a traceback).
+- actual: uncaught `httpx.HTTPStatusError` — a 3-exception chain ending in a raw traceback.
+- error: `401 Unauthorized for https://api.pushd.com/v5/frames.json — server body: {"error": true, "message": "Request Unauthenticated", "logout": true}`
+- timeline: visible since the venus trip (2026-09-30); the client DOES log the body via loguru (`_raise_for_status_with_body:270`) but nothing classifies or catches it on this path.
+- reproduction: `pushframe status` on an account whose trip is armed (venus, live 2026-09-30 16:15).
+
+## Scope decisions (user)
+
+- Fix the status UX crash ONLY — the trip itself is not a pushframe bug (the 24h protocol is documented).
+- Contract: classify the 401 body — trip-shaped (`logout:true` / "Request Unauthenticated") → anti-abuse verdict + wait remedy, exit non-zero; token-shaped → `pushframe config` remedy.
+
+## Current Focus
+
+hypothesis: run_status has no handler around the frames read; the 401 trip classification lives only in the WRITE path (execute_plan) and doctor, so a READ-surface 401 escapes as a raw exception.
+test: read run_status' try/except and the write-path classifier; confirm no read-path catch.
+expecting: no except clause covering HTTPStatusError from get_frames in run_status.
+next_action: gather initial evidence (run_status, classifier, PRF-02 sweep inventory).
+
+## Evidence
+
+- 2026-09-30T16:20:00+02:00: user transcript (venus 16:15) — establish_session SUCCEEDED (resume is offline: headers only), the 401 came from frame_api.get_frames; loguru warning from client.py:270 printed the body, then the exception propagated to the REPL.
+- 2026-09-30T16:35:00+02:00: DECISIVE user experiment — with PUSHFRAME_EMAIL/PASSWORD env set (fresh login each run), `pushframe status` SUCCEEDS: login OK, frames listed (Cadre de Fabrice). Same account, same minutes: token path 401, env path 200.
+- 2026-09-30T16:35:00+02:00: the 14:30 login-475 has LIFTED by ~16:35 (~2h) — the user's env login succeeded with no 475. Lockouts on the login surface clear in hours, not 24h.
+
+## Eliminated
+
+- hypothesis: the anti-abuse trip spread to READS (refuted 16:35) — a fresh login reads frames.json fine; the 401-on-reads with the trip-shaped body was actually a DEAD STORED TOKEN. The 14:30 wave-4 interpretation ("reads refused too") is void: that probe resumed a stale token and never reached a write.
+- hypothesis: account permanently 475-locked (refuted 16:35) — login surface answers again after ~2h.
+
+## Current Focus (updated 16:35)
+
+hypothesis: CONFIRMED for the crash — run_status has no handler around get_frames(); the 401 trip classification lives only in the write path (sync._is_write_trip_body) and doctor. On the READ surface, the logout:true body means STALE TOKEN first (env-login reads green); trip-on-reads only if it recurs on a fresh token.
+test: wrap the frames read; classify trip-shaped body (remedy: refresh token via config; caveat: if it recurs on a fresh login, it is the trip — wait); RateLimitError → wait message; generic → named + config remedy.
+expecting: status exits 1 named, never tracebacks, on all three shapes.
+next_action: implement + tests, then suite.
+
+## Resolution
+
+root_cause: run_status had no handler around the frames read — the 401 trip classification lived only in the write path (sync._is_write_trip_body) and doctor, so a read-surface 401 escaped as a raw 3-exception-chain traceback (PRF-02 violation on the one read command every operator runs first). Root cause of the USER'S alarm was different: the stored token was dead (venus resumptions), while the env path's fresh login read frames fine — proving the trip never reached reads and the 14:30 login-475 had lifted in ~2h.
+fix: run_status wraps get_frames() — trip-shaped 401 body → named message with the refresh-token remedy AND the fresh-token-24h caveat; other 401 → token-rejected remedy; RateLimitError (475/429) → named WAIT (never `pushframe config`); generic → named; all exit 1, zero tracebacks. Tests: 3 new in test_cli_status.py (trip body, token body, 475) — suite 507 passed.
+verification: tests/test_cli_status.py 10/10; full offline suite 507 passed; user's live repro shape covered by the trip-body test.
+files_changed: pushframe/cli.py, tests/test_cli_status.py, CHANGELOG.md, .planning/debug/status-crash-401-trip.md
+addendum (16:50): followed by the one-shot TTY refresh — run_status now offers ONE re-login on a refused stored token and continues in the same run; a refused FRESH login prints the 24h verdict and is never retried; non-TTY fails named. tests/test_cli_status.py 12/12, suite 509 passed. Updated contract test: fresh env creds + trip body = trip-on-reads verdict.
+
+## Lessons
+
+- The wave-4 interpretation "reads refused too" is VOID: that probe resumed a stale token and never reached a write. Trip-on-reads remains UNPROVEN; the 24h protocol now has a concrete re-entry criterion (same body on a FRESH login).
+- The env path logs in fresh EVERY run — during tripped/token-dead periods it is the honest comparison path, but it also means each env `status` costs a login call (do not loop it).
+- Silence clock resets: last pushd contact moved to 16:15–16:3x (status 401 + the user's env login). Next single probe: tomorrow ≥ 16:30, `pushframe status` on the refreshed token.

{pushframe-5.1.2 → pushframe-5.1.4}/CHANGELOG.md

@@ -12,7 +12,65 @@ every channel.
 `pushframe` is an unofficial community CLI for Aura Frames digital photo
 frames; it is not affiliated with Aura Frames Inc.
 
-## [Unreleased]
+## [5.1.4] - 2026-09-30
+
+### Added
+
+- **One-shot TTY token refresh on every frames-reading verb** — `status`,
+  `inspect`, `sync`, `push` and `google-sync` (venus, 2026-09-30): when
+  the stored token is refused (401) and stdin is a terminal, the command
+  offers ONE re-login right there — the new token is persisted and the
+  same run continues (venus proved a fresh login reads green while the
+  stored token was dead). All five verbs share one gate
+  (`session.frames_read_with_refresh`), so the behavior, the failure
+  shapes and the guardrails are byte-identical everywhere. Guardrails:
+  exactly one attempt per process — a refused FRESH login is never
+  retried and prints the 24-hour-silence verdict (that means the
+  anti-abuse trip reached the read surface); non-TTY/scheduled runs
+  never prompt, they fail named with the `pushframe config` remedy; the
+  env-credential path (fresh credentials every run) never prompts.
+  One test per verb proves the contract: 401 once → exactly one
+  wizard-seam login → re-read succeeds → token persisted.
+
+### Fixed
+
+- **`pushframe status` no longer tracebacks on a refused frames read**
+  (venus, debug session status-crash-401-trip): a 401 with the trip's
+  `logout:true` body prints a named diagnosis — the remedy is
+  `pushframe config` (refresh the stored token; a fresh login read frames
+  fine minutes later, so on a READ that body means a dead token first),
+  with the 24h-silence protocol reserved for the case where the same
+  body recurs on a genuinely fresh login. A 475/429 on the read prints a
+  named WAIT (never a re-login suggestion). Every shape exits 1 named —
+  the PRF-02 no-traceback contract now holds on the token path's first
+  authenticated call.
+
+## [5.1.3] — 2026-09-30
+
+### Fixed
+
+- **`pushframe config` — Enter now keeps the stored email, as the banner
+  always promised** (venus, 5.1.2): an empty answer on a configured
+  install aborted with "no email given — aborting" instead of keeping
+  it. With a stored token, Enter-Enter now finishes the wizard with ZERO
+  API calls (the anti-abuse rule: no gratuitous login); typing a new
+  email still re-logins, and a fresh install still aborts named on an
+  empty answer.
+- **Prompt-contract audit — every interactive prompt checked against its
+  banner**, one behavior test per prompt. Two more promised-vs-real gaps
+  fixed alongside the wizard's: the session-path login prompt (expired
+  token refresh) showed NO banner and aborted the login on a bare Enter —
+  it now prints the same "current email — Enter keeps it" banner and
+  keeps it; and the two hard-delete confirmation gates only said "To
+  confirm, type the number…" — now "Verbatim to confirm —", because the
+  y/N reflex answer being silently rejected WAS the contract, just never
+  the wording. google-link's manual Enter prompt reworded to make the
+  AFTER-login gate explicit ("log into Google …, THEN press Enter"); no
+  behavior change there.
+- **The wizard's default-frame question loops on a bad answer**: an
+  out-of-range or non-numeric entry used to be silently treated as a
+  skip — it now re-asks with `invalid choice, pick 1-N or Enter to skip`
+  until a valid number is picked or an explicit Enter skips.
 
 ## [5.1.2] — 2026-09-30
 

{pushframe-5.1.2 → pushframe-5.1.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: pushframe
-Version: 5.1.2
+Version: 5.1.4
 Summary: Unofficial community CLI for Aura Frames digital photo frames (sync a local folder or a Google Photos album; not affiliated with Aura Frames Inc.)
 Project-URL: Homepage, https://github.com/coredmp95/pushframe
 Project-URL: Repository, https://github.com/coredmp95/pushframe

{pushframe-5.1.2 → pushframe-5.1.4}/docs/CLI.md

@@ -108,14 +108,34 @@ tokens; safe to repeat; never run it in CI.
 
 ### When the anti-abuse layer refuses your writes
 
-Pushd's anti-abuse layer can refuse writes while reads and login keep
-working (proven venus, 2026-09). The refusal body says
-`"Request Unauthenticated"` — **that is the trip's disguise, not a token
-problem**. pushframe recognizes it and stops on the FIRST refusal (no
-retry, no re-login — both feed the trip). The drill:
+Pushd's anti-abuse layer can refuse writes while reads keep working
+(proven venus, 2026-09). It has two shapes — learn both, the disguised
+one is the trap:
+
+| Surface | Shape | Server body |
+|---|---|---|
+| `login.json` | **HTTP 475** — explicit lockout | "Aura API is rate-limiting or has locked out this account" |
+| everything else — **token included** | **HTTP 401** — the trip in disguise | `{"error": true, "message": "Request Unauthenticated", "logout": true}` |
+
+The 401 arrives on a FRESH token, seconds after a successful login: it
+means "we refuse this client's writes (trip)", not "your token is bad".
+The trip is **account-wide** — not scoped to the session, the endpoint
+that provoked it, or the login that just succeeded — and it can spread
+to more surfaces when provoked (venus: writes-only 401 first; after
+probe activity, `login.json` itself went 475).
+
+**Never re-login, never retry.** Every call that touches a tripped
+surface re-arms the clock, and a fresh login bypasses nothing — the
+trip is not session-scoped. Venus's counter-evidence: 8 doctor probes
+spread over 7 hours, all 475, each one buying another wait — the probes
+were the reason nothing cleared. pushframe already stops on the FIRST
+trip-shaped refusal (`TripDetectedError` — no retry, no re-login); the
+discipline is yours to keep outside the tool.
+
+The drill:
 
 1. `pushframe doctor` before any sync (GO = the write surface is open NOW)
-2. Trip detected → wait **60+ min** from the stop, then `pushframe doctor` again
+2. Trip detected → wait **60+ min** from the stop, then `pushframe doctor` again — **once**. A second tripped doctor is the signal to stop doctoring (every probe re-arms the clock) and escalate to the 24-hour protocol below.
 3. If doctor passes but a sync still trips immediately, lower the per-batch
    volume — the trip keys on batch size (a 1-item write may pass where a
    50-item chunk is refused):
@@ -123,6 +143,26 @@ retry, no re-login — both feed the trip). The drill:
    pushframe google-sync Cadre --frame "Cadre de Fabrice" --apply --yes --batch-size 10
    ```
 
+#### The 24-hour probe protocol (escalated recovery)
+
+When 60+ minutes does not clear the trip (venus, 2026-09-30: still
+tripped after a ~5-hour silence), stop probing and switch to days:
+
+1. **Total silence.** No pushframe command of any kind against the
+   account — and nothing automated either: a timer or a loop probing
+   hourly keeps the account tripped indefinitely.
+2. **After 24h+ of silence, ONE probe — a read, never a doctor.**
+   `pushframe status` resumes the stored token session (no login call,
+   no write). Doctor is the WRONG first probe here: its write attempt
+   re-arms the clock even while it tells you the truth.
+3. **Probe green** (reads answer) → ONE `pushframe doctor` as the single
+   write probe. GO → run the sync with a lowered batch size (step 3
+   above). Probe trips → back to step 1; next probe in another 24h.
+
+Never two probes in one 24h bucket. The wait has no measured shape —
+what is measured is only that hours do not cut it, and every premature
+call restarts it.
+
 **Client identity matters.** Pushd's anti-abuse layer also fingerprints
 the client itself: a years-stale `Aura/4.7.790` user agent and the
 all-zeros `0000000000000000` device identifier shared by every pushframe
@@ -196,12 +236,17 @@ the file is `~/.config/pushframe/config.json`, mode `0600`, written atomically.
 
 ### The wizard (`pushframe config`)
 
-Asks for your email, then your password (**hidden input**), then **verifies the
-login against the real Aura API before writing anything** — a failed login writes
-nothing. On success it stores the email plus the session `auth_token` (not the
-password; a stored token is silently refreshed at re-login), then offers the
-optional questions (country for the geo guard, budget tuning) with current
-effective values as defaults.
+On a fresh install it asks for your email, then your password (**hidden
+input**), then **verifies the login against the real Aura API before writing
+anything** — a failed login writes nothing. On an install that already has an
+email stored, **pressing Enter keeps the stored email** — the banner says so and
+means it: with a stored session token, a second Enter reuses the token and the
+wizard finishes WITHOUT any API call (the anti-abuse rule: no gratuitous
+login); only typing a NEW email moves to the password question. On success it
+stores the email plus the session `auth_token` (not the password; a stored
+token is silently refreshed at re-login), then offers the optional questions
+(country for the geo guard, budget tuning) with current effective values as
+defaults.
 
 Refuses to run when stdin is not a terminal — scheduled jobs have nothing to
 interact with; feed them the environment or the config file instead.
@@ -237,10 +282,15 @@ it is the value a command would actually use).
 
 ```
 usage: pushframe status [-h]
-```
-
-The first command to run. It checks your credentials are present, logs in, and lists your
-frames. Nothing is ever written.
+```The first command to run. With env credentials it logs in fresh; with a
+stored token session it resumes it (no login call) and lists your frames.
+Nothing is ever written except a session token: if the stored token is
+refused (HTTP 401), an interactive run offers ONE re-login right there and
+continues — a refused fresh login is never retried (that shape is the
+anti-abuse trip on reads: 24-hour silence); a non-interactive run fails
+named with the `pushframe config` remedy instead of prompting. `inspect`,
+`sync`, `push` and `google-sync` read frames through the same gate, so
+this contract holds on every frames-reading verb.
 
 ```bash
 uv run pushframe status
@@ -769,6 +819,12 @@ affects uploads, hides and deletes alike.
 **There is no automatic retry yet.** If an apply reports 401 failures, simply run it again.
 The operation is safe to repeat: uploads dedupe by md5, and hides are idempotent.
 
+This covers the *transient* 401s — the no-special-body failures. If the
+body says `"Request Unauthenticated"`, that is the anti-abuse trip, not
+a transient failure: do NOT run it again, do NOT re-login — see [When
+the anti-abuse layer refuses your
+writes](#when-the-anti-abuse-layer-refuses-your-writes).
+
 ### A frame's asset count disagrees with its listing
 
 `inspect` can report e.g. `Assets: 172` while listing `154`. The frame's own counter and the

{pushframe-5.1.2 → pushframe-5.1.4}/pushframe/__init__.py

@@ -1,4 +1,4 @@
 # pushframe — unofficial community CLI for Aura Frames (not affiliated).
 # Version single source for the CLI surface (REL-02); pyproject keeps the
 # packaging metadata version and tests/test_version.py enforces lockstep.
-__version__ = "5.1.2"
+__version__ = "5.1.4"

{pushframe-5.1.2 → pushframe-5.1.4}/pushframe/cli.py

@@ -12,6 +12,8 @@ from tqdm import tqdm
 from pushframe.aura import Aura
 from pushframe.aws.s3client import S3Client
 from pushframe.aws.sqsclient import SQSClient
+import httpx
+
 from pushframe.client import RateLimitError
 from pushframe.google.bootstrap import BootstrapError, PROFILE_ENV_VAR, default_bootstrap
 from pushframe.google.client import GoogleSession
@@ -385,6 +387,11 @@ def run_config(wizard_args=None, stdin_isatty: bool | None = None) -> int:
     else:
         print('configuring pushframe — credentials are login-tested now, stored after.')
     email = input('Aura email: ').strip()
+    if not email and existing.get('email'):
+        # The banner promised "Enter keeps it" — keep that promise. With a
+        # stored token this path finishes with ZERO API calls (anti-abuse:
+        # a gratuitous login is exactly what the trip punishes).
+        email = existing['email']
     if not email:
         print('no email given — aborting, nothing written.')
         return 1
@@ -415,7 +422,12 @@ def run_config(wizard_args=None, stdin_isatty: bool | None = None) -> int:
         for i, f in enumerate(frames, 1):
             print(f'  {i}. {f["name"]}')
         choice = input('default frame number (Enter to skip): ').strip()
-        if choice.isdigit() and 1 <= int(choice) <= len(frames):
+        # Prompt-contract audit fix: an out-of-range or non-numeric answer
+        # used to be silently treated as a skip — re-ask until a valid
+        # number or an explicit Enter.
+        while choice and not (choice.isdigit() and 1 <= int(choice) <= len(frames)):
+            choice = input(f'invalid choice, pick 1-{len(frames)} or Enter to skip: ').strip()
+        if choice:
             data['default_frame'] = frames[int(choice) - 1]['name']
     debug = input('enable debug logging by default? [y/N] ').strip().lower()
     if debug in ('y', 'yes'):
@@ -599,6 +611,7 @@ def run_status(aura=None, debug: bool = False, google_session=None) -> int:
     # and before login/get_frames (the HTTP calls that trigger them).
     _configure_cli_logging(debug)
 
+    stored = None  # the token-refresh seam only exists on the stored path
     if session[0] == 'env':
         try:
             aura.login()
@@ -615,7 +628,18 @@ def run_status(aura=None, debug: bool = False, google_session=None) -> int:
                             user_id=stored.get('user_id'))
         who = stored['email']
 
-    frames = aura.frame_api.get_frames()
+    # The frames read is the FIRST authenticated call of the token path —
+    # its failure modes are operator-relevant and must never traceback
+    # (PRF-02). Key lesson of 2026-09-30 (debug/status-crash-401-trip): on
+    # a READ, the trip-shaped logout:true body means a STALE STORED TOKEN
+    # first — a fresh login read frames fine minutes later — so the remedy
+    # is ONE TTY re-login right here (venus: the env path proved a fresh
+    # login reads green); the 24h wait is only the answer if a FRESH token
+    # is refused too. Never more than ONE refresh attempt per run, never a
+    # prompt off-TTY (scheduled runs fail named instead).
+    frames = _read_frames_with_refresh(aura, who, stored)
+    if frames is None:
+        return 1  # named failure already printed by the helper
     print(f'Logged in as {who}')
     print(f'{len(frames)} frames:')
     for frame in frames:
@@ -629,6 +653,14 @@ def run_status(aura=None, debug: bool = False, google_session=None) -> int:
     return 0
 
 
+def _read_frames_with_refresh(aura, who, stored):
+    """Thin wrapper over the shared gate (session.frames_read_with_refresh)
+    — status, inspect, sync/push and google-sync all read frames through
+    the same named-failure + one-shot-refresh contract."""
+    from pushframe.session import frames_read_with_refresh
+    return frames_read_with_refresh(aura, who, stored)
+
+
 def _google_status_section(google_session=None) -> list[str]:
     """Build the `Google:` section lines for `status` (LGS-03/D-02).
 
@@ -931,8 +963,15 @@ def run_inspect(frame_arg: str, aura=None, debug: bool = False) -> int:
         print(f'Login failed: {e}')
         return 1
 
+    from pushframe.session import auto_refresh_stored
+    stored = auto_refresh_stored()
+    frames = _read_frames_with_refresh(
+        aura, who=(stored or {}).get('email')
+        or os.getenv('PUSHFRAME_EMAIL') or os.getenv('AURA_EMAIL'),
+        stored=stored)
+    if frames is None:
+        return 1
     try:
-        frames = aura.frame_api.get_frames()
         resolved = resolve_frame(frame_arg, frames)
 
         if resolved.status == 'ambiguous':
@@ -1073,7 +1112,7 @@ def run_reconcile(frame_arg: str, *, remove: bool = False, yes: bool = False, me
                 count = len(result.stuck)
                 print(f'IRREVERSIBLE: {count} row(s) will be permanently destroyed '
                       f'account-wide via hard-delete. This cannot be undone.')
-                answer = input(f'To confirm, type the number of rows to hard-delete ({count}): ')
+                answer = input(f'Verbatim to confirm — type the number of rows to hard-delete ({count}): ')
                 if answer.strip() != str(count):
                     print('Aborted.')
                     return 0
@@ -1215,8 +1254,15 @@ def run_sync(dir_arg: str, frame_arg: str, apply: bool = False, yes: bool = Fals
         print(f'Login failed: {e}')
         return 1
 
+    from pushframe.session import auto_refresh_stored
+    stored = auto_refresh_stored()
+    frames = _read_frames_with_refresh(
+        aura, who=(stored or {}).get('email')
+        or os.getenv('PUSHFRAME_EMAIL') or os.getenv('AURA_EMAIL'),
+        stored=stored)
+    if frames is None:
+        return 1
     try:
-        frames = aura.frame_api.get_frames()
         resolved = resolve_frame(frame_arg, frames)
 
         if resolved.status == 'ambiguous':
@@ -1321,7 +1367,7 @@ def run_sync(dir_arg: str, frame_arg: str, apply: bool = False, yes: bool = Fals
                 count = len(plan.to_delete)
                 print(f'IRREVERSIBLE: {count} photo(s) will be permanently destroyed '
                       f'account-wide, not just removed from this frame. This cannot be undone.')
-                answer = input(f'To confirm, type the number of photos to hard-delete ({count}): ')
+                answer = input(f'Verbatim to confirm — type the number of photos to hard-delete ({count}): ')
                 if answer.strip() != str(count):
                     print('Aborted.')
                     return 0

{pushframe-5.1.2 → pushframe-5.1.4}/pushframe/google/bootstrap.py

@@ -84,12 +84,25 @@ def _require_profile() -> Path:
     return path
 
 
+def _enter_after_login(context, *, input_fn=input):
+    """Manual-mode harvest close: the Enter comes AFTER the login in the
+    opened window and only closes the harvest — the cookie check after it
+    (not the Enter itself) decides success. Seam for offline tests."""
+    input_fn("…log into Google in the opened window, THEN press Enter "
+             "here to finish the harvest> ")
+    cookies = context.cookies()
+    context.close()
+    return cookies
+
+
 def run_bootstrap(*, auto: bool = False) -> dict:
     """Open the dedicated-profile browser, harvest cookies, save the vault.
 
     auto=True polls the context for completed Google auth (SAPISID-family
     cookies) instead of waiting for an Enter in the terminal — for runs
-    launched from a non-interactive shell. Returns an identity summary dict:
+    launched from a non-interactive shell. In manual mode the Enter comes
+    AFTER the login and only closes the harvest — the cookie check below
+    still decides success. Returns an identity summary dict:
     {vault_path, cookie_count, auth_markers} — never cookie values.
     """
     profile_dir = _require_profile()
@@ -181,9 +194,7 @@ def run_bootstrap(*, auto: bool = False) -> dict:
             cookies = context.cookies()
             context.close()
         else:
-            input("…press Enter here AFTER logging in on the opened window> ")
-            cookies = context.cookies()
-            context.close()
+            cookies = _enter_after_login(context, input_fn=input)
 
     if not any(c["name"] in ("SID", "SAPISID", "__Secure-1PSID") for c in cookies):
         raise BootstrapError(

{pushframe-5.1.2 → pushframe-5.1.4}/pushframe/gsync.py

@@ -382,7 +382,12 @@ def run_google_sync(album_target: str, frame_arg: str, *, apply: bool = False,
             print(f'Login failed: {e}')
             return 1
 
-    frames = aura.frame_api.get_frames()
+    from pushframe.session import auto_refresh_stored, frames_read_with_refresh
+    _stored = auto_refresh_stored()
+    frames = frames_read_with_refresh(
+        aura, who=(_stored or {}).get('email'), stored=_stored)
+    if frames is None:
+        return 2
     frame_res = resolve_frame(frame_arg, frames)
     if frame_res.status == 'ambiguous':
         print(f"'{frame_arg}' matches more than one frame:")