pushframe 5.1.4__tar.gz → 5.1.5__tar.gz

{pushframe-5.1.4 → pushframe-5.1.5}/CHANGELOG.md

@@ -12,7 +12,27 @@ every channel.
 `pushframe` is an unofficial community CLI for Aura Frames digital photo
 frames; it is not affiliated with Aura Frames Inc.
 
-## [5.1.4] - 2026-09-30
+## [5.1.5] - 2026-09-30
+
+### Fixed
+
+- **`google-sync` no longer claims "no Google session vault" on a healthy
+  vault** (venus, 2026-09-30): the vault preflight probed the default path
+  WITHOUT `expanduser()` — a literal `~` path never exists, so the check
+  fired on every machine whose vault was perfectly healthy (a
+  `google-link` seconds earlier had saved it) — and its shape check
+  demanded a JSON object while the vault is a JSON list of cookie
+  records, so even the right path would have failed. Two stacked
+  phase-24 bugs, masked until now because CI has no vault either and the
+  scheduled `--pair` branch skips this block entirely. One tell was in
+  every transcript: `google-link` prints "existing Google session found"
+  only when a vault READ succeeds. The preflight now expands the default
+  path, accepts the list shape (dict kept for backward compatibility),
+  and takes a `vault_path` argument; `PUSHFRAME_VAULT_PATH` pins the
+  path for tests. The preflight-sweep suite is now pinned away from the
+  real machine's vault (it silently depended on the bug) and its
+  `gsync_no_creds` case asserts what it always meant to (Aura-side named
+  auth failure).
 
 ### Added
 

{pushframe-5.1.4 → pushframe-5.1.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: pushframe
-Version: 5.1.4
+Version: 5.1.5
 Summary: Unofficial community CLI for Aura Frames digital photo frames (sync a local folder or a Google Photos album; not affiliated with Aura Frames Inc.)
 Project-URL: Homepage, https://github.com/coredmp95/pushframe
 Project-URL: Repository, https://github.com/coredmp95/pushframe

{pushframe-5.1.4 → pushframe-5.1.5}/pushframe/__init__.py

@@ -1,4 +1,4 @@
 # pushframe — unofficial community CLI for Aura Frames (not affiliated).
 # Version single source for the CLI surface (REL-02); pyproject keeps the
 # packaging metadata version and tests/test_version.py enforces lockstep.
-__version__ = "5.1.4"
+__version__ = "5.1.5"

{pushframe-5.1.4 → pushframe-5.1.5}/pushframe/gsync.py

@@ -215,7 +215,7 @@ def run_google_sync(album_target: str, frame_arg: str, *, apply: bool = False,
                     aura=None, s3_client=None, sqs_client=None, budget=None,
                     workers: int = 4, threshold: float | None = None,
                     input_fn=None, is_interactive: bool | None = None,
-                    list_shared=None, cache_dir=None,
+                    list_shared=None, cache_dir=None, vault_path=None,
                     manifest_path=None, batch_size: int | None = None,
                     pair: str | None = None, run_all: bool = False,
                     scheduled: bool = False) -> int:
@@ -314,7 +314,7 @@ def run_google_sync(album_target: str, frame_arg: str, *, apply: bool = False,
         # with the full remedy (google-link + the headless ssh -X recipe).
         try:
             from pushframe.preflight import require_google_vault
-            require_google_vault()
+            require_google_vault(vault_path)
         except Exception as e:
             print(f'google-sync failed: {e}')
             return 1

{pushframe-5.1.4 → pushframe-5.1.5}/pushframe/preflight.py

@@ -6,6 +6,7 @@ Google cookie vault; sync/push require the source directory to EXIST (D-03:
 hard error) while empty stays the friendly "nothing to do" (not an error —
 looping scripts over sometimes-empty dirs must not break).
 """
+import os
 from pathlib import Path
 
 
@@ -14,11 +15,32 @@ class PreflightError(Exception):
     action; str() renders both."""
 
 
+def default_vault_path() -> Path:
+    """The vault path google-sync's preflight probes: PUSHFRAME_VAULT_PATH
+    when set (tests and power users pin it — a suite must never depend on
+    the real machine's vault), else the production path expanded per-user."""
+    from pushframe.google.vault import DEFAULT_VAULT_PATH as _default
+    override = os.getenv("PUSHFRAME_VAULT_PATH")
+    return Path(override).expanduser() if override else _default.expanduser()
+
+
 def require_google_vault(vault_path: Path | None = None) -> Path:
-    """google-sync's vault check (PRF-01): present + non-empty JSON object."""
+    """google-sync's vault check (PRF-01): present + parseable JSON holding
+    at least one cookie record.
+
+    Two 2026-09-30 live-proven bugs fixed here (venus: link saves fine,
+    google-sync claims 'no vault' anyway):
+    - the default path was probed WITHOUT expanduser(): a literal `~` path
+      never exists, so this preflight always fired on machines whose vault
+      was perfectly healthy (phase-24 regression, masked on CI — CI has no
+      vault either — and on scheduled runs, whose --pair branch skips this
+      block entirely);
+    - the shape check demanded a JSON OBJECT while vault.save() writes a
+      JSON LIST of cookie records — a healthy vault would have failed the
+      'unreadable' branch even with the right path.
+    """
     import json
-    from pushframe.google.vault import DEFAULT_VAULT_PATH as _default
-    path = vault_path or _default
+    path = Path(vault_path).expanduser() if vault_path else default_vault_path()
     if not path.exists():
         raise PreflightError(
             f'no Google session vault at {path} — google-sync needs a linked '
@@ -27,7 +49,9 @@ def require_google_vault(vault_path: Path | None = None) -> Path:
             f'window can open; the 0600 vault survives logouts).')
     try:
         data = json.loads(path.read_text())
-        if not isinstance(data, dict) or not data:
+        healthy = (isinstance(data, list) and len(data) > 0) or \
+                  (isinstance(data, dict) and len(data) > 0)
+        if not healthy:
             raise ValueError('empty or malformed vault')
     except (ValueError, OSError) as e:
         raise PreflightError(

{pushframe-5.1.4 → pushframe-5.1.5}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pushframe"
-version = "5.1.4"
+version = "5.1.5"
 description = "Unofficial community CLI for Aura Frames digital photo frames (sync a local folder or a Google Photos album; not affiliated with Aura Frames Inc.)"
 readme = "README.md"
 requires-python = ">=3.14"

{pushframe-5.1.4 → pushframe-5.1.5}/tests/test_preflight_sweep.py

@@ -34,7 +34,7 @@ CASES = [
         id="mode-8-inspect-no-creds"),
     pytest.param(
         "gsync_no_creds", {"album": "Cadre", "frame": "Fabrice"},
-        "google-sync failed", "google-link",
+        "not authenticated", "pushframe config",
         id="mode-8-gsync-no-creds"),
     pytest.param(
         "sync_dir_no_creds", {"dir": "."},
@@ -68,6 +68,10 @@ def no_creds(tmp_path, monkeypatch):
     for var in ("PUSHFRAME_EMAIL", "AURA_EMAIL",
                 "PUSHFRAME_PASSWORD", "AURA_PASSWORD"):
         monkeypatch.delenv(var, raising=False)
+    # The vault preflight is pinned AWAY from the real machine's vault: after
+    # the 2026-09-30 path fix this suite would otherwise depend on whether
+    # the dev box happens to hold a healthy vault (venus live-proven bug).
+    monkeypatch.setenv("PUSHFRAME_VAULT_PATH", str(tmp_path / "no-vault.json"))
 
 
 # --- callables ---------------------------------------------------------------
@@ -109,10 +113,10 @@ def gsync_no_creds(capsys, no_creds, album, frame):
     # named because no credentials of any kind are available.
     vault = settings.CONFIG_PATH.parent / "google-cookies.json"
     vault.parent.mkdir(parents=True, exist_ok=True)
-    vault.write_text(json.dumps({"SID": "x"}))  # minimal-looking vault
+    vault.write_text(json.dumps([{"name": "SID", "value": "x"}]))  # list shape (vault.save's)
     from pushframe.gsync import run_google_sync
     return run_google_sync(album, frame, apply=False, yes=True,
-                           is_interactive=False)
+                           is_interactive=False, vault_path=str(vault))
 
 
 class _MuteAura:

pushframe-5.1.5/tests/test_preflight_vault.py

@@ -0,0 +1,78 @@
+"""google-sync's vault preflight (PRF-01) — the venus live-proven bugs.
+
+2026-09-30, venus: `pushframe google-link` saved a perfectly healthy vault
+(28 cookie records) yet `pushframe google-sync` answered "no Google session
+vault". Two stacked bugs in require_google_vault:
+
+1. the default path was probed WITHOUT expanduser() — `Path("~/.config/…")
+   .exists()` compares a literal `~` directory on disk and never matches,
+   so the preflight fired on every healthy machine (masked on CI: no vault
+   there either; masked on scheduled runs: the --pair branch skips the
+   block — exactly the path the nightly uses);
+2. the shape check demanded a JSON OBJECT while vault.save() writes a JSON
+   LIST of cookie records — with the path fixed, a healthy vault would have
+   landed in the "unreadable — re-link" branch anyway.
+
+The tell was in the transcript: google-link prints "existing Google session
+found" only when from_vault() (a vault READ) succeeds — the vault was
+there; the preflight was the liar.
+"""
+import json
+
+import pytest
+
+from pushframe.preflight import PreflightError, require_google_vault
+
+
+@pytest.fixture
+def vault_root(tmp_path, monkeypatch):
+    """Pinned vault env: default path under tmp, isolated from the machine."""
+    monkeypatch.setenv("PUSHFRAME_VAULT_PATH", str(tmp_path / "v.json"))
+    return tmp_path / "v.json"
+
+
+def _healthy_vault(path):
+    path.write_text(json.dumps([
+        {"name": "SID", "value": "x", "domain": ".google.com"},
+        {"name": "SAPISID", "value": "y", "domain": ".google.com"},
+    ]))
+
+
+def test_healthy_list_vault_passes(vault_root):
+    """The exact venus shape: vault.save()'s JSON list of records."""
+    _healthy_vault(vault_root)
+    assert require_google_vault() == vault_root.expanduser()
+
+
+def test_missing_vault_fails_named_with_remedy(vault_root):
+    with pytest.raises(PreflightError) as e:
+        require_google_vault()
+    assert 'no Google session vault' in str(e.value)
+    assert 'google-link' in str(e.value)
+
+
+def test_literal_tilde_default_path_never_probed(monkeypatch):
+    """The regression itself: without PUSHFRAME_VAULT_PATH the default must
+    be EXPANDED (probe the real per-user path, not a literal `~` file).
+    Pure assertions — this test must never write near the machine's real
+    vault (the first draft did a write+unlink there; unacceptable)."""
+    monkeypatch.delenv("PUSHFRAME_VAULT_PATH", raising=False)
+    from pushframe.preflight import default_vault_path
+    from pushframe.google.vault import DEFAULT_VAULT_PATH
+    real = default_vault_path()
+    assert real == DEFAULT_VAULT_PATH.expanduser()
+    assert '~' not in str(real)
+
+
+def test_dict_vault_still_accepted_backward_compat(vault_root):
+    vault_root.write_text(json.dumps({"SID": "x"}))
+    assert require_google_vault() == vault_root.expanduser()
+
+
+def test_empty_shapes_fail_named(vault_root):
+    for payload in ("[]", "{}", "not json at all"):
+        vault_root.write_text(payload)
+        with pytest.raises(PreflightError) as e:
+            require_google_vault()
+        assert 'unreadable' in str(e.value)
+        assert 'google-link' in str(e.value)

{pushframe-5.1.4 → pushframe-5.1.5}/tests/test_version.py

@@ -19,7 +19,7 @@ PYPROJECT = Path(__file__).resolve().parent.parent / "pyproject.toml"
 def test_version_is_first_distribution_release():
     """The current distribution release (moved off 0.1.0 at 5.0.0; page
     metadata fix shipped in 5.0.4)."""
-    assert __version__ == "5.1.4"
+    assert __version__ == "5.1.5"
 
 
 def test_version_matches_pyproject_single_source():

{pushframe-5.1.4 → pushframe-5.1.5}/uv.lock

@@ -432,7 +432,7 @@ wheels = [
 
 [[package]]
 name = "pushframe"
-version = "5.1.4"
+version = "5.1.5"
 source = { editable = "." }
 dependencies = [
     { name = "boto3" },