pushframe 5.1.3__tar.gz → 5.1.5__tar.gz

pushframe-5.1.5/.planning/debug/status-crash-401-trip.md

@@ -0,0 +1,61 @@
+---
+slug: status-crash-401-trip
+status: resolved
+created: 2026-09-30T16:20:00+02:00
+updated: 2026-09-30T16:45:00+02:00
+trigger: pushframe status crashes with a raw httpx traceback when the account's anti-abuse trip is armed (401 logout:true on frames.json)
+---
+
+# Debug: status crashes with raw traceback on tripped-account 401
+
+## Symptoms
+
+- expected: `pushframe status` resumes the stored token session and either lists frames or fails NAMED with a remedy (PRF-02 contract: never a traceback).
+- actual: uncaught `httpx.HTTPStatusError` — a 3-exception chain ending in a raw traceback.
+- error: `401 Unauthorized for https://api.pushd.com/v5/frames.json — server body: {"error": true, "message": "Request Unauthenticated", "logout": true}`
+- timeline: visible since the venus trip (2026-09-30); the client DOES log the body via loguru (`_raise_for_status_with_body:270`) but nothing classifies or catches it on this path.
+- reproduction: `pushframe status` on an account whose trip is armed (venus, live 2026-09-30 16:15).
+
+## Scope decisions (user)
+
+- Fix the status UX crash ONLY — the trip itself is not a pushframe bug (the 24h protocol is documented).
+- Contract: classify the 401 body — trip-shaped (`logout:true` / "Request Unauthenticated") → anti-abuse verdict + wait remedy, exit non-zero; token-shaped → `pushframe config` remedy.
+
+## Current Focus
+
+hypothesis: run_status has no handler around the frames read; the 401 trip classification lives only in the WRITE path (execute_plan) and doctor, so a READ-surface 401 escapes as a raw exception.
+test: read run_status' try/except and the write-path classifier; confirm no read-path catch.
+expecting: no except clause covering HTTPStatusError from get_frames in run_status.
+next_action: gather initial evidence (run_status, classifier, PRF-02 sweep inventory).
+
+## Evidence
+
+- 2026-09-30T16:20:00+02:00: user transcript (venus 16:15) — establish_session SUCCEEDED (resume is offline: headers only), the 401 came from frame_api.get_frames; loguru warning from client.py:270 printed the body, then the exception propagated to the REPL.
+- 2026-09-30T16:35:00+02:00: DECISIVE user experiment — with PUSHFRAME_EMAIL/PASSWORD env set (fresh login each run), `pushframe status` SUCCEEDS: login OK, frames listed (Cadre de Fabrice). Same account, same minutes: token path 401, env path 200.
+- 2026-09-30T16:35:00+02:00: the 14:30 login-475 has LIFTED by ~16:35 (~2h) — the user's env login succeeded with no 475. Lockouts on the login surface clear in hours, not 24h.
+
+## Eliminated
+
+- hypothesis: the anti-abuse trip spread to READS (refuted 16:35) — a fresh login reads frames.json fine; the 401-on-reads with the trip-shaped body was actually a DEAD STORED TOKEN. The 14:30 wave-4 interpretation ("reads refused too") is void: that probe resumed a stale token and never reached a write.
+- hypothesis: account permanently 475-locked (refuted 16:35) — login surface answers again after ~2h.
+
+## Current Focus (updated 16:35)
+
+hypothesis: CONFIRMED for the crash — run_status has no handler around get_frames(); the 401 trip classification lives only in the write path (sync._is_write_trip_body) and doctor. On the READ surface, the logout:true body means STALE TOKEN first (env-login reads green); trip-on-reads only if it recurs on a fresh token.
+test: wrap the frames read; classify trip-shaped body (remedy: refresh token via config; caveat: if it recurs on a fresh login, it is the trip — wait); RateLimitError → wait message; generic → named + config remedy.
+expecting: status exits 1 named, never tracebacks, on all three shapes.
+next_action: implement + tests, then suite.
+
+## Resolution
+
+root_cause: run_status had no handler around the frames read — the 401 trip classification lived only in the write path (sync._is_write_trip_body) and doctor, so a read-surface 401 escaped as a raw 3-exception-chain traceback (PRF-02 violation on the one read command every operator runs first). Root cause of the USER'S alarm was different: the stored token was dead (venus resumptions), while the env path's fresh login read frames fine — proving the trip never reached reads and the 14:30 login-475 had lifted in ~2h.
+fix: run_status wraps get_frames() — trip-shaped 401 body → named message with the refresh-token remedy AND the fresh-token-24h caveat; other 401 → token-rejected remedy; RateLimitError (475/429) → named WAIT (never `pushframe config`); generic → named; all exit 1, zero tracebacks. Tests: 3 new in test_cli_status.py (trip body, token body, 475) — suite 507 passed.
+verification: tests/test_cli_status.py 10/10; full offline suite 507 passed; user's live repro shape covered by the trip-body test.
+files_changed: pushframe/cli.py, tests/test_cli_status.py, CHANGELOG.md, .planning/debug/status-crash-401-trip.md
+addendum (16:50): followed by the one-shot TTY refresh — run_status now offers ONE re-login on a refused stored token and continues in the same run; a refused FRESH login prints the 24h verdict and is never retried; non-TTY fails named. tests/test_cli_status.py 12/12, suite 509 passed. Updated contract test: fresh env creds + trip body = trip-on-reads verdict.
+
+## Lessons
+
+- The wave-4 interpretation "reads refused too" is VOID: that probe resumed a stale token and never reached a write. Trip-on-reads remains UNPROVEN; the 24h protocol now has a concrete re-entry criterion (same body on a FRESH login).
+- The env path logs in fresh EVERY run — during tripped/token-dead periods it is the honest comparison path, but it also means each env `status` costs a login call (do not loop it).
+- Silence clock resets: last pushd contact moved to 16:15–16:3x (status 401 + the user's env login). Next single probe: tomorrow ≥ 16:30, `pushframe status` on the refreshed token.

{pushframe-5.1.3 → pushframe-5.1.5}/CHANGELOG.md

@@ -12,7 +12,58 @@ every channel.
 `pushframe` is an unofficial community CLI for Aura Frames digital photo
 frames; it is not affiliated with Aura Frames Inc.
 
-## [Unreleased]
+## [5.1.5] - 2026-09-30
+
+### Fixed
+
+- **`google-sync` no longer claims "no Google session vault" on a healthy
+  vault** (venus, 2026-09-30): the vault preflight probed the default path
+  WITHOUT `expanduser()` — a literal `~` path never exists, so the check
+  fired on every machine whose vault was perfectly healthy (a
+  `google-link` seconds earlier had saved it) — and its shape check
+  demanded a JSON object while the vault is a JSON list of cookie
+  records, so even the right path would have failed. Two stacked
+  phase-24 bugs, masked until now because CI has no vault either and the
+  scheduled `--pair` branch skips this block entirely. One tell was in
+  every transcript: `google-link` prints "existing Google session found"
+  only when a vault READ succeeds. The preflight now expands the default
+  path, accepts the list shape (dict kept for backward compatibility),
+  and takes a `vault_path` argument; `PUSHFRAME_VAULT_PATH` pins the
+  path for tests. The preflight-sweep suite is now pinned away from the
+  real machine's vault (it silently depended on the bug) and its
+  `gsync_no_creds` case asserts what it always meant to (Aura-side named
+  auth failure).
+
+### Added
+
+- **One-shot TTY token refresh on every frames-reading verb** — `status`,
+  `inspect`, `sync`, `push` and `google-sync` (venus, 2026-09-30): when
+  the stored token is refused (401) and stdin is a terminal, the command
+  offers ONE re-login right there — the new token is persisted and the
+  same run continues (venus proved a fresh login reads green while the
+  stored token was dead). All five verbs share one gate
+  (`session.frames_read_with_refresh`), so the behavior, the failure
+  shapes and the guardrails are byte-identical everywhere. Guardrails:
+  exactly one attempt per process — a refused FRESH login is never
+  retried and prints the 24-hour-silence verdict (that means the
+  anti-abuse trip reached the read surface); non-TTY/scheduled runs
+  never prompt, they fail named with the `pushframe config` remedy; the
+  env-credential path (fresh credentials every run) never prompts.
+  One test per verb proves the contract: 401 once → exactly one
+  wizard-seam login → re-read succeeds → token persisted.
+
+### Fixed
+
+- **`pushframe status` no longer tracebacks on a refused frames read**
+  (venus, debug session status-crash-401-trip): a 401 with the trip's
+  `logout:true` body prints a named diagnosis — the remedy is
+  `pushframe config` (refresh the stored token; a fresh login read frames
+  fine minutes later, so on a READ that body means a dead token first),
+  with the 24h-silence protocol reserved for the case where the same
+  body recurs on a genuinely fresh login. A 475/429 on the read prints a
+  named WAIT (never a re-login suggestion). Every shape exits 1 named —
+  the PRF-02 no-traceback contract now holds on the token path's first
+  authenticated call.
 
 ## [5.1.3] — 2026-09-30
 

{pushframe-5.1.3 → pushframe-5.1.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: pushframe
-Version: 5.1.3
+Version: 5.1.5
 Summary: Unofficial community CLI for Aura Frames digital photo frames (sync a local folder or a Google Photos album; not affiliated with Aura Frames Inc.)
 Project-URL: Homepage, https://github.com/coredmp95/pushframe
 Project-URL: Repository, https://github.com/coredmp95/pushframe

{pushframe-5.1.3 → pushframe-5.1.5}/docs/CLI.md

@@ -282,10 +282,15 @@ it is the value a command would actually use).
 
 ```
 usage: pushframe status [-h]
-```
-
-The first command to run. It checks your credentials are present, logs in, and lists your
-frames. Nothing is ever written.
+```The first command to run. With env credentials it logs in fresh; with a
+stored token session it resumes it (no login call) and lists your frames.
+Nothing is ever written except a session token: if the stored token is
+refused (HTTP 401), an interactive run offers ONE re-login right there and
+continues — a refused fresh login is never retried (that shape is the
+anti-abuse trip on reads: 24-hour silence); a non-interactive run fails
+named with the `pushframe config` remedy instead of prompting. `inspect`,
+`sync`, `push` and `google-sync` read frames through the same gate, so
+this contract holds on every frames-reading verb.
 
 ```bash
 uv run pushframe status

{pushframe-5.1.3 → pushframe-5.1.5}/pushframe/__init__.py

@@ -1,4 +1,4 @@
 # pushframe — unofficial community CLI for Aura Frames (not affiliated).
 # Version single source for the CLI surface (REL-02); pyproject keeps the
 # packaging metadata version and tests/test_version.py enforces lockstep.
-__version__ = "5.1.3"
+__version__ = "5.1.5"

{pushframe-5.1.3 → pushframe-5.1.5}/pushframe/cli.py

@@ -12,6 +12,8 @@ from tqdm import tqdm
 from pushframe.aura import Aura
 from pushframe.aws.s3client import S3Client
 from pushframe.aws.sqsclient import SQSClient
+import httpx
+
 from pushframe.client import RateLimitError
 from pushframe.google.bootstrap import BootstrapError, PROFILE_ENV_VAR, default_bootstrap
 from pushframe.google.client import GoogleSession
@@ -609,6 +611,7 @@ def run_status(aura=None, debug: bool = False, google_session=None) -> int:
     # and before login/get_frames (the HTTP calls that trigger them).
     _configure_cli_logging(debug)
 
+    stored = None  # the token-refresh seam only exists on the stored path
     if session[0] == 'env':
         try:
             aura.login()
@@ -625,7 +628,18 @@ def run_status(aura=None, debug: bool = False, google_session=None) -> int:
                             user_id=stored.get('user_id'))
         who = stored['email']
 
-    frames = aura.frame_api.get_frames()
+    # The frames read is the FIRST authenticated call of the token path —
+    # its failure modes are operator-relevant and must never traceback
+    # (PRF-02). Key lesson of 2026-09-30 (debug/status-crash-401-trip): on
+    # a READ, the trip-shaped logout:true body means a STALE STORED TOKEN
+    # first — a fresh login read frames fine minutes later — so the remedy
+    # is ONE TTY re-login right here (venus: the env path proved a fresh
+    # login reads green); the 24h wait is only the answer if a FRESH token
+    # is refused too. Never more than ONE refresh attempt per run, never a
+    # prompt off-TTY (scheduled runs fail named instead).
+    frames = _read_frames_with_refresh(aura, who, stored)
+    if frames is None:
+        return 1  # named failure already printed by the helper
     print(f'Logged in as {who}')
     print(f'{len(frames)} frames:')
     for frame in frames:
@@ -639,6 +653,14 @@ def run_status(aura=None, debug: bool = False, google_session=None) -> int:
     return 0
 
 
+def _read_frames_with_refresh(aura, who, stored):
+    """Thin wrapper over the shared gate (session.frames_read_with_refresh)
+    — status, inspect, sync/push and google-sync all read frames through
+    the same named-failure + one-shot-refresh contract."""
+    from pushframe.session import frames_read_with_refresh
+    return frames_read_with_refresh(aura, who, stored)
+
+
 def _google_status_section(google_session=None) -> list[str]:
     """Build the `Google:` section lines for `status` (LGS-03/D-02).
 
@@ -941,8 +963,15 @@ def run_inspect(frame_arg: str, aura=None, debug: bool = False) -> int:
         print(f'Login failed: {e}')
         return 1
 
+    from pushframe.session import auto_refresh_stored
+    stored = auto_refresh_stored()
+    frames = _read_frames_with_refresh(
+        aura, who=(stored or {}).get('email')
+        or os.getenv('PUSHFRAME_EMAIL') or os.getenv('AURA_EMAIL'),
+        stored=stored)
+    if frames is None:
+        return 1
     try:
-        frames = aura.frame_api.get_frames()
         resolved = resolve_frame(frame_arg, frames)
 
         if resolved.status == 'ambiguous':
@@ -1225,8 +1254,15 @@ def run_sync(dir_arg: str, frame_arg: str, apply: bool = False, yes: bool = Fals
         print(f'Login failed: {e}')
         return 1
 
+    from pushframe.session import auto_refresh_stored
+    stored = auto_refresh_stored()
+    frames = _read_frames_with_refresh(
+        aura, who=(stored or {}).get('email')
+        or os.getenv('PUSHFRAME_EMAIL') or os.getenv('AURA_EMAIL'),
+        stored=stored)
+    if frames is None:
+        return 1
     try:
-        frames = aura.frame_api.get_frames()
         resolved = resolve_frame(frame_arg, frames)
 
         if resolved.status == 'ambiguous':

{pushframe-5.1.3 → pushframe-5.1.5}/pushframe/gsync.py

@@ -215,7 +215,7 @@ def run_google_sync(album_target: str, frame_arg: str, *, apply: bool = False,
                     aura=None, s3_client=None, sqs_client=None, budget=None,
                     workers: int = 4, threshold: float | None = None,
                     input_fn=None, is_interactive: bool | None = None,
-                    list_shared=None, cache_dir=None,
+                    list_shared=None, cache_dir=None, vault_path=None,
                     manifest_path=None, batch_size: int | None = None,
                     pair: str | None = None, run_all: bool = False,
                     scheduled: bool = False) -> int:
@@ -314,7 +314,7 @@ def run_google_sync(album_target: str, frame_arg: str, *, apply: bool = False,
         # with the full remedy (google-link + the headless ssh -X recipe).
         try:
             from pushframe.preflight import require_google_vault
-            require_google_vault()
+            require_google_vault(vault_path)
         except Exception as e:
             print(f'google-sync failed: {e}')
             return 1
@@ -382,7 +382,12 @@ def run_google_sync(album_target: str, frame_arg: str, *, apply: bool = False,
             print(f'Login failed: {e}')
             return 1
 
-    frames = aura.frame_api.get_frames()
+    from pushframe.session import auto_refresh_stored, frames_read_with_refresh
+    _stored = auto_refresh_stored()
+    frames = frames_read_with_refresh(
+        aura, who=(_stored or {}).get('email'), stored=_stored)
+    if frames is None:
+        return 2
     frame_res = resolve_frame(frame_arg, frames)
     if frame_res.status == 'ambiguous':
         print(f"'{frame_arg}' matches more than one frame:")

{pushframe-5.1.3 → pushframe-5.1.5}/pushframe/preflight.py

@@ -6,6 +6,7 @@ Google cookie vault; sync/push require the source directory to EXIST (D-03:
 hard error) while empty stays the friendly "nothing to do" (not an error —
 looping scripts over sometimes-empty dirs must not break).
 """
+import os
 from pathlib import Path
 
 
@@ -14,11 +15,32 @@ class PreflightError(Exception):
     action; str() renders both."""
 
 
+def default_vault_path() -> Path:
+    """The vault path google-sync's preflight probes: PUSHFRAME_VAULT_PATH
+    when set (tests and power users pin it — a suite must never depend on
+    the real machine's vault), else the production path expanded per-user."""
+    from pushframe.google.vault import DEFAULT_VAULT_PATH as _default
+    override = os.getenv("PUSHFRAME_VAULT_PATH")
+    return Path(override).expanduser() if override else _default.expanduser()
+
+
 def require_google_vault(vault_path: Path | None = None) -> Path:
-    """google-sync's vault check (PRF-01): present + non-empty JSON object."""
+    """google-sync's vault check (PRF-01): present + parseable JSON holding
+    at least one cookie record.
+
+    Two 2026-09-30 live-proven bugs fixed here (venus: link saves fine,
+    google-sync claims 'no vault' anyway):
+    - the default path was probed WITHOUT expanduser(): a literal `~` path
+      never exists, so this preflight always fired on machines whose vault
+      was perfectly healthy (phase-24 regression, masked on CI — CI has no
+      vault either — and on scheduled runs, whose --pair branch skips this
+      block entirely);
+    - the shape check demanded a JSON OBJECT while vault.save() writes a
+      JSON LIST of cookie records — a healthy vault would have failed the
+      'unreadable' branch even with the right path.
+    """
     import json
-    from pushframe.google.vault import DEFAULT_VAULT_PATH as _default
-    path = vault_path or _default
+    path = Path(vault_path).expanduser() if vault_path else default_vault_path()
     if not path.exists():
         raise PreflightError(
             f'no Google session vault at {path} — google-sync needs a linked '
@@ -27,7 +49,9 @@ def require_google_vault(vault_path: Path | None = None) -> Path:
             f'window can open; the 0600 vault survives logouts).')
     try:
         data = json.loads(path.read_text())
-        if not isinstance(data, dict) or not data:
+        healthy = (isinstance(data, list) and len(data) > 0) or \
+                  (isinstance(data, dict) and len(data) > 0)
+        if not healthy:
             raise ValueError('empty or malformed vault')
     except (ValueError, OSError) as e:
         raise PreflightError(

{pushframe-5.1.3 → pushframe-5.1.5}/pushframe/session.py

@@ -42,6 +42,145 @@ def _is_auth_failure(exc: Exception) -> bool:
     return '401' in str(exc) and 'unauthorized' in str(exc).lower()
 
 
+def _tty() -> bool:
+    import sys
+    return sys.stdin.isatty()
+
+
+def _run_login_prompt(aura, email):
+    """ONE interactive re-login on the wizard seam; persists the new token.
+    Returns the Aura with fresh auth headers; None on an empty-email abort
+    (only possible when nothing is stored)."""
+    print('refused — one re-login to refresh the stored token:')
+    result = _prompt_login(aura, _tty())
+    if result is None:
+        raise NoCredentialsError(
+            'login aborted (no email given) — no session stored; '
+            're-run the command to retry')
+    return result
+
+
+def auto_refresh_stored():
+    """The stored dict when the auto-refresh case is even possible (a stored
+    token session, no env override) — None otherwise. Shared by every verb's
+    frames-read gate."""
+    import os
+    from pushframe import config_store
+    if ((os.getenv('PUSHFRAME_EMAIL') or os.getenv('AURA_EMAIL'))
+            and (os.getenv('PUSHFRAME_PASSWORD') or os.getenv('AURA_PASSWORD'))):
+        return None  # env override: credentials are fresh every run
+    return config_store.load()
+
+
+def frames_read_with_refresh(aura, who, stored):
+    """THE shared frames-read gate (status, inspect, sync/push, google-sync):
+    the ONE-shot TTY token refresh plus the named, never-a-traceback failure
+    shapes (PRF-02). Returns the frames list, or None after printing a named
+    failure (caller returns non-zero).
+
+    Refresh fires only via refresh_if_auto (stored session, no env override,
+    TTY) — exactly once per process. A FRESH login still refused with the
+    trip's logout:true body prints the 24-hour-silence verdict; other 401s
+    name the `pushframe config` remedy; 475/429 name the WAIT.
+    """
+    import httpx
+    from pushframe.client import RateLimitError
+    from pushframe.sync import _is_write_trip_body
+    while True:
+        try:
+            return aura.frame_api.get_frames()
+        except httpx.HTTPStatusError as e:
+            if e.response.status_code == 401 and stored and refresh_if_auto(aura, stored):
+                continue  # exactly one re-read, on the fresh token
+            if e.response.status_code == 401:
+                fresh = stored is None  # env path: credentials were already fresh
+                print(f'Logged in as {who}')
+                if _is_write_trip_body(str(e)):
+                    print('frames read refused — HTTP 401 with the trip\'s '
+                          'signature body on a READ.')
+                    if fresh:
+                        print('FRESH credentials were refused with the '
+                              'trip\'s body: this is the anti-abuse trip on '
+                              'the read surface — total silence 24h, one '
+                              'probe after. Do not loop.')
+                    else:
+                        print('The stored token is dead OR the trip reached '
+                              'reads — refresh once via `pushframe config` '
+                              '(Enter keeps the email). If a FRESH login is '
+                              'refused too, that is the trip on reads: '
+                              'total silence 24h, one probe after.')
+                else:
+                    print(f'frames read refused — HTTP 401: {e}')
+                    print('The stored session looks rejected: run '
+                          '`pushframe config` to refresh the token (Enter '
+                          'keeps the email), then re-run.')
+                return None
+            print(f'frames read failed: {e}')
+            return None
+        except RateLimitError as e:
+            print(f'Logged in as {who}')
+            print(f'rate-limited or locked out while reading frames — {e}')
+            print('Wait before retrying; do NOT loop this command (each call '
+                  'extends the lockout).')
+            return None
+
+
+def refresh_if_auto(aura, stored) -> bool:
+    """Refresh ONLY when the refusal is the auto-refresh case: a stored
+    token session (no env creds) on an interactive terminal — that is, when
+    `pushframe config` could fix it without the operator typing anything
+    new. Returns True when the aura was refreshed and the caller may retry
+    its first authenticated read ONCE; False when the caller must fail the
+    named way (no stored session, env override, or non-TTY).
+
+    Guardrails (venus anti-abuse contract, 2026-09-30): exactly one attempt
+    per process, a refused FRESH login is never retried (its SessionExpired
+    error carries the 24h-silence verdict), non-TTY never prompts.
+    """
+    import os
+    import sys
+    if stored is None or not stored.get('email') or not stored.get('auth_token'):
+        return False
+    if (os.getenv('PUSHFRAME_EMAIL') or os.getenv('AURA_EMAIL')) and \
+            (os.getenv('PUSHFRAME_PASSWORD') or os.getenv('AURA_PASSWORD')):
+        return False  # env override: creds are already fresh every run
+    if not sys.stdin.isatty():
+        return False
+    try:
+        refresh_token_once(aura, stored)
+    except Exception:
+        return False
+    return True
+
+
+def refresh_token_once(aura, stored: dict):
+    """The anti-abuse-bounded token refresh (venus, 2026-09-30): on a 401
+    refusal of the STORED token, a TTY run gets ONE re-login prompt instead
+    of failing. ONE attempt per process — a refused FRESH login is never
+    retried (retrying a tripped surface feeds the trip), and non-TTY runs
+    (scheduled) never prompt at all: they raise SessionExpiredError, named.
+
+    Returns the authenticated Aura, or raises (SessionExpiredError /
+    NoCredentialsError). The caller's 401 message travels in the exception
+    chain for the trip-vs-token classification downstream.
+    """
+    import sys
+    if not sys.stdin.isatty():
+        raise SessionExpiredError(
+            'stored token refused and stdin is not a terminal — re-run '
+            '`pushframe config` once interactively to refresh it')
+    print(f'stored token refused (current email: {stored["email"]})')
+    try:
+        return _run_login_prompt(aura, stored['email'])
+    except Exception as e:
+        if _is_auth_failure(e):
+            raise SessionExpiredError(
+                'the FRESH login was refused too — this is not a stale '
+                'token: total silence (no command, no re-login) and one '
+                'probe after 24h (the anti-abuse protocol); do NOT loop.') from e
+        raise
+
+
 def _store_token(email: str, auth_token: str, user_id: str | None) -> None:
     """Persist the session facts — token only, never the password (SEC-01)."""
     data = {'email': email, 'auth_token': auth_token}

{pushframe-5.1.3 → pushframe-5.1.5}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pushframe"
-version = "5.1.3"
+version = "5.1.5"
 description = "Unofficial community CLI for Aura Frames digital photo frames (sync a local folder or a Google Photos album; not affiliated with Aura Frames Inc.)"
 readme = "README.md"
 requires-python = ">=3.14"

{pushframe-5.1.3 → pushframe-5.1.5}/tests/test_cli_status.py

@@ -30,6 +30,134 @@ def _reset_loguru(monkeypatch):
     logger.remove()
 
 
+FRAME_401_TRIP_BODY = httpx.Response(
+    401, json={"error": True, "message": "Request Unauthenticated", "logout": True})
+FRAME_401_TOKEN_BODY = httpx.Response(
+    401, json={"error": True, "message": "invalid session token"})
+
+
+def test_status_fresh_creds_refused_with_trip_body_means_the_trip(monkeypatch, capsys):
+    """Debug session status-crash-401-trip, updated contract: on the env
+    path the credentials are ALREADY fresh — a trip-shaped 401 body there
+    is the anti-abuse trip on reads: 24h-silence verdict, no re-login
+    suggestion, never a traceback."""
+    monkeypatch.setenv('AURA_EMAIL', 'you@example.invalid')
+    monkeypatch.setenv('AURA_PASSWORD', 'super-secret-pw')
+
+    aura = offline_aura(overrides={'/v5/frames.json': FRAME_401_TRIP_BODY})
+    rc = run_status(aura=aura)
+
+    assert rc == 1
+    out = capsys.readouterr().out
+    assert 'HTTP 401' in out
+    assert 'FRESH credentials' in out
+    assert '24h' in out
+    assert 'Traceback' not in out
+
+
+def test_status_stale_token_401_non_tty_fails_named_without_refresh(monkeypatch, capsys, tmp_path):
+    """Scheduled/no-TTY runs NEVER prompt: the refresh guard raises the
+    named SessionExpiredError and status surfaces it with the config
+    remedy — exit 1, zero tracebacks."""
+    from pushframe.utils import settings
+    monkeypatch.setattr(settings, 'CONFIG_PATH', tmp_path / 'config.json')
+    from pushframe import config_store
+    config_store.update(email='vaulted@example.invalid', auth_token='tok-dead',
+                        user_id='u-1')
+    monkeypatch.delenv('AURA_EMAIL', raising=False)
+    monkeypatch.delenv('AURA_PASSWORD', raising=False)
+    monkeypatch.setattr('sys.stdin.isatty', lambda: False)
+
+    aura = offline_aura(overrides={'/v5/frames.json': FRAME_401_TOKEN_BODY})
+    rc = run_status(aura=aura)
+
+    assert rc == 1
+    out = capsys.readouterr().out
+    assert 'refresh' in out and 'pushframe config' in out
+    assert 'Traceback' not in out
+
+
+def test_status_stale_token_401_tty_refreshes_once_and_succeeds(monkeypatch, capsys, tmp_path):
+    """The venus story, automated: stored token refused → ONE TTY re-login
+    prompt → new token persisted → the SAME run lists the frames. Never a
+    second attempt: the login is called exactly once."""
+    from pushframe.utils import settings
+    monkeypatch.setattr(settings, 'CONFIG_PATH', tmp_path / 'config.json')
+    from pushframe import config_store
+    config_store.update(email='vaulted@example.invalid', auth_token='tok-dead',
+                        user_id='u-1')
+    monkeypatch.delenv('AURA_EMAIL', raising=False)
+    monkeypatch.delenv('AURA_PASSWORD', raising=False)
+    monkeypatch.setattr('sys.stdin.isatty', lambda: True)
+
+    logins = []
+
+    import getpass as gp
+    monkeypatch.setattr(gp, 'getpass', lambda *a: 'typed-pw')  # noqa: S105
+    monkeypatch.setattr('builtins.input', lambda *a: 'vaulted@example.invalid')
+
+    def fake_wizard_login(email, password):
+        logins.append((email, password))
+        return {'email': email, 'auth_token': 'fresh-tok',  # noqa: S105
+                'user_id': 'u-1', 'frames': []}
+
+    monkeypatch.setattr('pushframe.cli._wizard_login', fake_wizard_login)
+
+    # frames.json: the trip-shaped 401 once (dead token), then the normal
+    # fixture listing after the refresh.
+    state = {'calls': 0}
+    from tests.offline import FIXTURES_DIR
+    frames_fixture = (FIXTURES_DIR / 'frames.json').read_text()
+
+    def frames_route(request):
+        state['calls'] += 1
+        if state['calls'] == 1:
+            return FRAME_401_TRIP_BODY
+        return httpx.Response(200, content=frames_fixture)
+
+    aura = offline_aura(overrides={'/v5/frames.json': frames_route})
+
+    rc = run_status(aura=aura)
+
+    assert rc == 0
+    out = capsys.readouterr().out
+    assert 'Fake Frame' in out
+    assert logins == [('vaulted@example.invalid', 'typed-pw')]  # noqa: S105 — exactly ONE
+    assert state['calls'] == 2  # refused once, re-read once after refresh
+    assert config_store.load()['auth_token'] == 'fresh-tok'  # noqa: S105
+
+
+def test_status_token_shaped_401_names_the_config_remedy(monkeypatch, capsys):
+    monkeypatch.setenv('AURA_EMAIL', 'you@example.invalid')
+    monkeypatch.setenv('AURA_PASSWORD', 'super-secret-pw')
+
+    aura = offline_aura(overrides={'/v5/frames.json': FRAME_401_TOKEN_BODY})
+    rc = run_status(aura=aura)
+
+    assert rc == 1
+    out = capsys.readouterr().out
+    assert 'HTTP 401' in out and 'pushframe config' in out
+    assert 'Traceback' not in out
+
+
+def test_status_rate_limit_475_named_wait_message(monkeypatch, capsys):
+    """A 475 on the frames read is classified by the client layer itself
+    (_raise_if_rate_limited): status must surface it as a named WAIT, never
+    a traceback."""
+    monkeypatch.setenv('AURA_EMAIL', 'you@example.invalid')
+    monkeypatch.setenv('AURA_PASSWORD', 'super-secret-pw')
+
+    aura = offline_aura(overrides={'/v5/frames.json': httpx.Response(
+        475, text='The Aura API is rate-limiting or has locked out this account.')})
+    rc = run_status(aura=aura)
+
+    assert rc == 1
+    out = capsys.readouterr().out
+    assert 'rate-limited or locked out' in out
+    assert 'pushframe config' not in out  # a 475 is a WAIT, not a token fix
+    assert 'Traceback' not in out
+
+
 def test_status_missing_creds_exits_nonzero_no_network(monkeypatch, capsys):
     monkeypatch.delenv('AURA_EMAIL', raising=False)
     monkeypatch.delenv('AURA_PASSWORD', raising=False)

{pushframe-5.1.3 → pushframe-5.1.5}/tests/test_preflight_sweep.py

@@ -34,7 +34,7 @@ CASES = [
         id="mode-8-inspect-no-creds"),
     pytest.param(
         "gsync_no_creds", {"album": "Cadre", "frame": "Fabrice"},
-        "google-sync failed", "google-link",
+        "not authenticated", "pushframe config",
         id="mode-8-gsync-no-creds"),
     pytest.param(
         "sync_dir_no_creds", {"dir": "."},
@@ -68,6 +68,10 @@ def no_creds(tmp_path, monkeypatch):
     for var in ("PUSHFRAME_EMAIL", "AURA_EMAIL",
                 "PUSHFRAME_PASSWORD", "AURA_PASSWORD"):
         monkeypatch.delenv(var, raising=False)
+    # The vault preflight is pinned AWAY from the real machine's vault: after
+    # the 2026-09-30 path fix this suite would otherwise depend on whether
+    # the dev box happens to hold a healthy vault (venus live-proven bug).
+    monkeypatch.setenv("PUSHFRAME_VAULT_PATH", str(tmp_path / "no-vault.json"))
 
 
 # --- callables ---------------------------------------------------------------
@@ -109,10 +113,10 @@ def gsync_no_creds(capsys, no_creds, album, frame):
     # named because no credentials of any kind are available.
     vault = settings.CONFIG_PATH.parent / "google-cookies.json"
     vault.parent.mkdir(parents=True, exist_ok=True)
-    vault.write_text(json.dumps({"SID": "x"}))  # minimal-looking vault
+    vault.write_text(json.dumps([{"name": "SID", "value": "x"}]))  # list shape (vault.save's)
     from pushframe.gsync import run_google_sync
     return run_google_sync(album, frame, apply=False, yes=True,
-                           is_interactive=False)
+                           is_interactive=False, vault_path=str(vault))
 
 
 class _MuteAura: