pushframe 5.1.4__tar.gz → 5.1.6__tar.gz

pushframe-5.1.6/.github/workflows/tests.yml

@@ -0,0 +1,50 @@
+name: tests
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+
+jobs:
+  offline-suite:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v10.2.0
+        with:
+          enable-cache: true
+
+      - name: Run the offline test suite (no credentials, no network)
+        run: uv run --extra dev pytest -q -m "not live"
+
+  dependency-audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v10.2.0
+        with:
+          enable-cache: true
+
+      # FAIL THE BUILD on any known CVE in the LOCKED dependency tree
+      # (uv.lock — the exact set users install, not pyproject's open
+      # ranges). pip-audit reads the OSV/PyPI advisory DBs. Dependabot
+      # flags and PRs stay the discovery side; this gate makes a known-
+      # vulnerable lockfile unshippable on master, independent of scan
+      # timing (2026-09-30: the push banner fired on a tree that the
+      # merged urllib3 bump had already fixed — stale, but nothing
+      # enforced it). Fails loudly on ANY confirmed vulnerability;
+      #GHSA-withdrawn advisories vanish on their own. If a vulnerability
+      # lands with NO patched release yet, this job blocks master until
+      # one exists or the dep is pinned/removed — that visibility is the
+      # point; use `continue-on-error: true` temporarily ONLY with a
+      # linked issue.
+      - name: Audit the locked dependency tree (pip-audit)
+        run: |
+          set -euo pipefail
+          uv export --format requirements-txt --no-hashes --no-emit-project -o /tmp/reqs.txt
+          grep -v '^#' /tmp/reqs.txt | grep -v '^$' | head -3
+          uvx pip-audit --requirement /tmp/reqs.txt --no-deps --strict

pushframe-5.1.6/.planning/debug/gsync-apply-budget-none-crash.md

@@ -0,0 +1,51 @@
+---
+slug: gsync-apply-budget-none-crash
+status: resolved
+created: 2026-09-30T23:05:00+02:00
+updated: 2026-09-30T23:50:00+02:00
+trigger: pushframe google-sync --apply crashes with AttributeError 'NoneType' object has no attribute 'encode' in _build_write_budget after the y confirmation — operator framing: "la gestion de la dualité config env et fichier de conf ne fonctionne pas" (the env-vs-config-file duality is broken)
+---
+
+# Debug: google-sync --apply crashes building the write budget (email None)
+
+## Symptoms
+
+- expected: after the `y` confirmation, the plan applies at write-budget pace (or runs budgetless when the account is not identified), then prints the apply report — never a traceback (PRF-02).
+- actual: raw AttributeError traceback from cli._build_write_budget via gsync.py line 491.
+- error: `AttributeError: 'NoneType' object has no attribute 'encode'` at `budget-{sha1(email.encode())…}` — the email passed is None.
+
+## Environment
+
+- venus (headless server, ssh), pushframe 5.1.5 (installed this evening)
+- config.json: stored token session (email coredmp95@gmail.com) — NO PUSHFRAME_EMAIL/AURA_EMAIL/PASSWORD env in the operator shell
+- command: `pushframe google-sync Cadre --frame "Cadre de Fabrice"` then `y` at the apply gate
+- the SAME dry-run command earlier tonight printed the plan fine; the crash is strictly past the y gate
+
+## Evidence
+
+- 23:10: crash site + mechanism located (this context, no subagents available in this runtime): gsync.py:497 builds the budget from `os.getenv('PUSHFRAME_EMAIL') or os.getenv('AURA_EMAIL')` ONLY — on venus neither env var is set (token-session posture) → email=None → `email.encode()` inside the sha1 → AttributeError. The auth layer (session.establish_session) DOES resolve the stored config email — two different identity resolutions = the operator's "duality" is real.
+- scope audit (this context): same env-only identity read at cli.py:1129 (reconcile — crashes on --remove with no env) and cli.py:1392 (sync/push --apply — crashes with no env). Reconcile has NO --ignore-budget, so it is unreachable on venus until fixed.
+- why tests never caught it: every gsync apply test injects s3_client=…, and the build condition is `budget is None AND s3_client is None` — injection skips the crash line entirely. Same for sync/push tests (exec_kwargs path).
+- why it never crashed before tonight: phase-25 nightly runs were `--pair` DRY-RUN (plan print only — budget built after the gate, never reached). Tonight was the first interactive `--apply` on venus.
+- 23:2x: operator removed ALL env vars from the venus shell (user message) — the crash posture is exactly "stored token session, no env identity". The auth layer resolves that posture (token resumed fine — the plan printed); the budget layer does not (None.encode()). Duality confirmed on both sides.
+
+## Hypotheses
+
+- H1 (CONFIRMED): the write-budget identity is resolved env-ONLY while auth resolves env-then-config — two different resolvers for one identity. Mechanism proven by code read + crash line + operator env removal reproducing.
+
+## Root Cause
+
+`gsync.py:497` / `cli.py:1129` / `cli.py:1392` build the budget email from `os.getenv('PUSHFRAME_EMAIL') or os.getenv('AURA_EMAIL')` ONLY. On a token-session host (venus's intended posture) that is None and `_build_write_budget` calls `email.encode()` → AttributeError. The config store's email (the one auth uses) is never consulted. Fix: ONE resolver — `session.account_email()` (env override first, then stored session) — wired into all three call sites; `_build_write_budget(None)` now returns None (skip pacing) instead of crashing.
+
+## Resolution
+
+root_cause: identity duality — auth resolves env-then-config-store, the write-budget layer resolved env-ONLY (gsync.py:497, cli.py:1129 reconcile, cli.py:1392 sync/push). Token-session host + no env ⇒ email=None ⇒ email.encode() AttributeError AFTER the operator's y confirmation.
+fix: ONE resolver `session.account_email()` (env override, then stored session) wired into all three budget call sites; `_build_write_budget(None)` skips pacing with a named stderr line instead of crashing (a budget is per-account state — with no account named there is nothing to key).
+verification: 6 regression tests (tests/test_budget_identity.py: env-over-store, stored fallback, None never crashes + names the skip, state-file keyed to sha1(email)[:12], direct probe of the gsync crash expression) + sweep case mode-17 reconcile-no-identity (named, never traceback); suite 524 passed, seeded and fixed order. Deployed to venus from the local wheel; existing budget file budget-eeda3bb09fc5.json = sha1('coredmp95@gmail.com')[:12] — continuity preserved.
+files_changed: pushframe/session.py, pushframe/cli.py, pushframe/gsync.py, tests/test_budget_identity.py (new), tests/test_preflight_sweep.py, CHANGELOG.md
+
+## Current Focus
+
+next_action: none — resolved
+
+Note on process: the orchestrator already located the crash site + mechanism before creating this file (gsync.py:497 → cli._build_write_budget email=None; same latent shape at cli.py:1129 reconcile and cli.py:1392 sync/push when the account is unnamed). No subagent dispatch is available in this runtime (established 2026-09-30, session status-crash-401-trip) — the scientific loop runs in this context.

{pushframe-5.1.4 → pushframe-5.1.6}/CHANGELOG.md

@@ -12,7 +12,60 @@ every channel.
 `pushframe` is an unofficial community CLI for Aura Frames digital photo
 frames; it is not affiliated with Aura Frames Inc.
 
-## [5.1.4] - 2026-09-30
+## [5.1.6] - 2026-09-30
+
+### Fixed
+
+- **`google-sync --apply` (and `sync --apply` / `push --apply` /
+  `reconcile --remove`) no longer crash building the write budget on a
+  token-session host** (venus, 2026-09-30, debug session
+  gsync-apply-budget-none-crash): the budget's account email was read
+  from the ENVIRONMENT only while auth resolves env-then-stored-session
+  — the config/env duality was broken at exactly that layer. With a
+  stored token session and no env vars (venus's intended posture), the
+  run authenticated fine, printed the plan, took the operator's `y`
+  confirmation, then died on `email.encode()` inside the budget state
+  filename. The identity now resolves through ONE helper
+  (`session.account_email()`: env override first, then the stored
+  session) at all three call sites, and a fully identity-less run skips
+  pacing with a named stderr line instead of crashing (a budget is
+  per-account state; with no account named there is nothing to key).
+
+- `google-sync`'s new `vault_path` argument now flows END-TO-END: the
+  preflight AND the actual `GoogleSession.from_vault()` read both use the
+  pinned path (5.1.5 pinned only the preflight — a gap found by CI, whose
+  vault-less runner exposed it; harmless on real machines, which use the
+  default path).
+
+### Removed
+
+- The phase-24 sweep's `gsync_no_creds` case: with the vault gate standing
+  BEFORE the Aura gate by design, a form-valid fake vault pushed the run
+  past the gate onto the REAL Google network with a bogus cookie (the
+  5.1.2 network guard covers pushd, not google.com). The Aura-side
+  no-creds contract stays proven by the `sync`/`inspect` cases; gsync's
+  Google-side named shapes by `gsync_no_vault`, `pair_unknown`,
+  `all_zero_pairs`.
+
+### Fixed
+
+- **`google-sync` no longer claims "no Google session vault" on a healthy
+  vault** (venus, 2026-09-30): the vault preflight probed the default path
+  WITHOUT `expanduser()` — a literal `~` path never exists, so the check
+  fired on every machine whose vault was perfectly healthy (a
+  `google-link` seconds earlier had saved it) — and its shape check
+  demanded a JSON object while the vault is a JSON list of cookie
+  records, so even the right path would have failed. Two stacked
+  phase-24 bugs, masked until now because CI has no vault either and the
+  scheduled `--pair` branch skips this block entirely. One tell was in
+  every transcript: `google-link` prints "existing Google session found"
+  only when a vault READ succeeds. The preflight now expands the default
+  path, accepts the list shape (dict kept for backward compatibility),
+  and takes a `vault_path` argument; `PUSHFRAME_VAULT_PATH` pins the
+  path for tests. The preflight-sweep suite is now pinned away from the
+  real machine's vault (it silently depended on the bug) and its
+  `gsync_no_creds` case asserts what it always meant to (Aura-side named
+  auth failure).
 
 ### Added
 

{pushframe-5.1.4 → pushframe-5.1.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: pushframe
-Version: 5.1.4
+Version: 5.1.6
 Summary: Unofficial community CLI for Aura Frames digital photo frames (sync a local folder or a Google Photos album; not affiliated with Aura Frames Inc.)
 Project-URL: Homepage, https://github.com/coredmp95/pushframe
 Project-URL: Repository, https://github.com/coredmp95/pushframe

{pushframe-5.1.4 → pushframe-5.1.6}/pushframe/__init__.py

@@ -1,4 +1,4 @@
 # pushframe — unofficial community CLI for Aura Frames (not affiliated).
 # Version single source for the CLI surface (REL-02); pyproject keeps the
 # packaging metadata version and tests/test_version.py enforces lockstep.
-__version__ = "5.1.4"
+__version__ = "5.1.6"

{pushframe-5.1.4 → pushframe-5.1.6}/pushframe/cli.py

@@ -1126,7 +1126,8 @@ def run_reconcile(frame_arg: str, *, remove: bool = False, yes: bool = False, me
 
         # D-13: the same account-wide budget as sync/push -- reconcile has
         # no --ignore-budget escape hatch, so this is always False.
-        write_budget = _build_write_budget(os.getenv('PUSHFRAME_EMAIL') or os.getenv('AURA_EMAIL'), False)
+        from pushframe.session import account_email
+        write_budget = _build_write_budget(account_email(), False)
 
         apply_reconciliation(result, aura, frame.id, mechanism=mechanism, budget=write_budget)
 
@@ -1176,6 +1177,17 @@ def _build_write_budget(email: str, ignore_budget: bool) -> 'WriteBudget | None'
     """
     if ignore_budget:
         return None
+    if not email:
+        # venus 2026-09-30 (debug gsync-apply-budget-none-crash): a run with
+        # no resolvable identity (no env, no stored email) previously died
+        # HERE, on email.encode(), AFTER the operator confirmed the apply.
+        # A budget is per-ACCOUNT state; with no account named there is
+        # nothing to key — skip pacing rather than crash. Named debug
+        # output on stderr keeps this observable, never silent.
+        import sys as _sys
+        print('write-budget: no account identity (env or stored session) '
+              '— pacing skipped for this run', file=_sys.stderr)
+        return None
     state_path = AURA_STATE_DIR / f'budget-{hashlib.sha1(email.encode()).hexdigest()[:12]}.json'
     return WriteBudget.load(
         state_path, capacity=AURA_WRITE_BUDGET_CAPACITY, refill_per_min=AURA_WRITE_BUDGET_REFILL_PER_MIN,
@@ -1389,7 +1401,8 @@ def run_sync(dir_arg: str, frame_arg: str, apply: bool = False, yes: bool = Fals
         # protection by default with zero new flags. Only `--ignore-budget`
         # (push-only) omits `budget`; `write_budget`/`geo_check` being
         # `None` is exec_kwargs's signal to omit the corresponding kwarg.
-        write_budget = _build_write_budget(os.getenv('PUSHFRAME_EMAIL') or os.getenv('AURA_EMAIL'), ignore_budget)
+        from pushframe.session import account_email
+        write_budget = _build_write_budget(account_email(), ignore_budget)
         geo_check = _build_geo_check(country)
 
         total = len(plan.to_upload) + len(plan.to_delete)

{pushframe-5.1.4 → pushframe-5.1.6}/pushframe/gsync.py

@@ -215,7 +215,7 @@ def run_google_sync(album_target: str, frame_arg: str, *, apply: bool = False,
                     aura=None, s3_client=None, sqs_client=None, budget=None,
                     workers: int = 4, threshold: float | None = None,
                     input_fn=None, is_interactive: bool | None = None,
-                    list_shared=None, cache_dir=None,
+                    list_shared=None, cache_dir=None, vault_path=None,
                     manifest_path=None, batch_size: int | None = None,
                     pair: str | None = None, run_all: bool = False,
                     scheduled: bool = False) -> int:
@@ -314,12 +314,18 @@ def run_google_sync(album_target: str, frame_arg: str, *, apply: bool = False,
         # with the full remedy (google-link + the headless ssh -X recipe).
         try:
             from pushframe.preflight import require_google_vault
-            require_google_vault()
+            require_google_vault(vault_path)
         except Exception as e:
             print(f'google-sync failed: {e}')
             return 1
         try:
-            session = GoogleSession.from_vault()
+            # The pinned path flows END-TO-END (2026-09-30 CI lesson: pinning
+            # the preflight alone left this read on the default path — on a
+            # vault-less machine the run died 'bootstrap first' before ever
+            # reaching its intended failure, and a test pinning only the
+            # preflight could push the DEFAULT read onto the network).
+            session = (GoogleSession.from_vault(path=str(vault_path))
+                       if vault_path else GoogleSession.from_vault())
         except CookieVaultError as e:
             print(f'google-sync failed: {e}')
             return 1
@@ -488,7 +494,12 @@ def run_google_sync(album_target: str, frame_arg: str, *, apply: bool = False,
     if debug:
         _configure_cli_logging(True)
     if budget is None and s3_client is None:
-        budget = _build_write_budget(_os.getenv('PUSHFRAME_EMAIL') or _os.getenv('AURA_EMAIL'), ignore_budget=False)
+        # venus 2026-09-30 (debug gsync-apply-budget-none-crash): resolve the
+        # account through session.account_email (env override THEN stored
+        # session) — the bare getenv read got None on this token-session host
+        # and crashed on email.encode() after the y confirmation.
+        from pushframe.session import account_email
+        budget = _build_write_budget(account_email(), ignore_budget=False)
 
     staged_by_id = staged.staged_by_id
     confirmed_paths: list[str] = []

{pushframe-5.1.4 → pushframe-5.1.6}/pushframe/preflight.py

@@ -6,6 +6,7 @@ Google cookie vault; sync/push require the source directory to EXIST (D-03:
 hard error) while empty stays the friendly "nothing to do" (not an error —
 looping scripts over sometimes-empty dirs must not break).
 """
+import os
 from pathlib import Path
 
 
@@ -14,11 +15,32 @@ class PreflightError(Exception):
     action; str() renders both."""
 
 
+def default_vault_path() -> Path:
+    """The vault path google-sync's preflight probes: PUSHFRAME_VAULT_PATH
+    when set (tests and power users pin it — a suite must never depend on
+    the real machine's vault), else the production path expanded per-user."""
+    from pushframe.google.vault import DEFAULT_VAULT_PATH as _default
+    override = os.getenv("PUSHFRAME_VAULT_PATH")
+    return Path(override).expanduser() if override else _default.expanduser()
+
+
 def require_google_vault(vault_path: Path | None = None) -> Path:
-    """google-sync's vault check (PRF-01): present + non-empty JSON object."""
+    """google-sync's vault check (PRF-01): present + parseable JSON holding
+    at least one cookie record.
+
+    Two 2026-09-30 live-proven bugs fixed here (venus: link saves fine,
+    google-sync claims 'no vault' anyway):
+    - the default path was probed WITHOUT expanduser(): a literal `~` path
+      never exists, so this preflight always fired on machines whose vault
+      was perfectly healthy (phase-24 regression, masked on CI — CI has no
+      vault either — and on scheduled runs, whose --pair branch skips this
+      block entirely);
+    - the shape check demanded a JSON OBJECT while vault.save() writes a
+      JSON LIST of cookie records — a healthy vault would have failed the
+      'unreadable' branch even with the right path.
+    """
     import json
-    from pushframe.google.vault import DEFAULT_VAULT_PATH as _default
-    path = vault_path or _default
+    path = Path(vault_path).expanduser() if vault_path else default_vault_path()
     if not path.exists():
         raise PreflightError(
             f'no Google session vault at {path} — google-sync needs a linked '
@@ -27,7 +49,9 @@ def require_google_vault(vault_path: Path | None = None) -> Path:
             f'window can open; the 0600 vault survives logouts).')
     try:
         data = json.loads(path.read_text())
-        if not isinstance(data, dict) or not data:
+        healthy = (isinstance(data, list) and len(data) > 0) or \
+                  (isinstance(data, dict) and len(data) > 0)
+        if not healthy:
             raise ValueError('empty or malformed vault')
     except (ValueError, OSError) as e:
         raise PreflightError(

{pushframe-5.1.4 → pushframe-5.1.6}/pushframe/session.py

@@ -72,6 +72,26 @@ def auto_refresh_stored():
     return config_store.load()
 
 
+def account_email() -> str | None:
+    """THE one account-identity resolver (venus 2026-09-30, debug
+    gsync-apply-budget-none-crash): env override first, else the stored
+    session's email. Every consumer that only needs the ACCOUNT NAME (the
+    budget state-file key, `who` display strings) must resolve through
+    here — a bare os.getenv read is the bug that crashed google-sync
+    --apply: auth resolved the stored-session email and logged in fine,
+    then the budget layer read env-only, got None, and died on
+    email.encode() after the operator had already confirmed the plan.
+    Returns None only when the run has no identity at all — callers must
+    handle that named (skip/budgetless), never crash.
+    """
+    import os
+    env_email = os.getenv('PUSHFRAME_EMAIL') or os.getenv('AURA_EMAIL')
+    if env_email:
+        return env_email
+    stored = auto_refresh_stored()
+    return (stored or {}).get('email') or None
+
+
 def frames_read_with_refresh(aura, who, stored):
     """THE shared frames-read gate (status, inspect, sync/push, google-sync):
     the ONE-shot TTY token refresh plus the named, never-a-traceback failure

{pushframe-5.1.4 → pushframe-5.1.6}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pushframe"
-version = "5.1.4"
+version = "5.1.6"
 description = "Unofficial community CLI for Aura Frames digital photo frames (sync a local folder or a Google Photos album; not affiliated with Aura Frames Inc.)"
 readme = "README.md"
 requires-python = ">=3.14"

pushframe-5.1.6/tests/test_budget_identity.py

@@ -0,0 +1,89 @@
+"""The account-identity duality (venus 2026-09-30, debug
+gsync-apply-budget-none-crash): auth resolves env-then-stored-session,
+while the write-budget layer read env-ONLY — a token-session host (venus:
+no env vars) crashed `google-sync --apply` on `email.encode()` AFTER the
+operator confirmed the plan. The fix is ONE resolver
+(`session.account_email()`) wired into every budget call site, and a
+never-crash `_build_write_budget(None)`.
+
+Regression shape (must NEVER reproduce): the crash happened after the
+interactive confirmation, with a valid stored session and an empty
+environment — the exact intended venus posture.
+"""
+import hashlib
+import json
+
+import pytest
+
+from pushframe.utils import settings
+
+
+@pytest.fixture
+def token_session_no_env(tmp_path, monkeypatch):
+    """The venus posture: stored session, zero env identity, state dir
+    pinned under tmp (the budget file must land there, not in $HOME)."""
+    monkeypatch.setattr(settings, "CONFIG_PATH", tmp_path / "config.json")
+    from pushframe import config_store
+    config_store.update(email="coredmp95@gmail.com", auth_token="tok-x",
+                        user_id="u-1")
+    for var in ("PUSHFRAME_EMAIL", "AURA_EMAIL",
+                "PUSHFRAME_PASSWORD", "AURA_PASSWORD"):
+        monkeypatch.delenv(var, raising=False)
+    import pushframe.cli as cli_mod
+    monkeypatch.setattr(cli_mod, "AURA_STATE_DIR", tmp_path / "state")
+    return tmp_path
+
+
+def test_account_email_resolves_stored_session(token_session_no_env):
+    from pushframe.session import account_email
+    assert account_email() == "coredmp95@gmail.com"
+
+
+def test_account_email_env_overrides_stored(token_session_no_env, monkeypatch):
+    monkeypatch.setenv("PUSHFRAME_EMAIL", "override@example.invalid")
+    from pushframe.session import account_email
+    assert account_email() == "override@example.invalid"
+
+
+def test_account_email_none_without_any_identity(token_session_no_env, monkeypatch):
+    from pushframe import config_store
+    import os
+    config_store.update(email=None) if hasattr(config_store, "update") else None
+    # remove the stored email by rewriting the config without it
+    cfg = json.loads((token_session_no_env / "config.json").read_text())
+    cfg.pop("email", None)
+    (token_session_no_env / "config.json").write_text(json.dumps(cfg))
+    from pushframe.session import account_email
+    assert account_email() is None
+
+
+def test_build_write_budget_none_email_skips_never_crashes(token_session_no_env,
+                                                           capsys):
+    """The crash line itself: email=None must SKIP pacing (named on stderr),
+    never raise — the operator has already confirmed the apply at that
+    point."""
+    from pushframe.cli import _build_write_budget
+    budget = _build_write_budget(None, ignore_budget=False)
+    assert budget is None
+    assert 'no account identity' in capsys.readouterr().err
+
+
+def test_build_write_budget_email_keys_state_file(token_session_no_env):
+    from pushframe.cli import _build_write_budget
+    budget = _build_write_budget("coredmp95@gmail.com", ignore_budget=False)
+    assert budget is not None
+    expected = hashlib.sha1(b"coredmp95@gmail.com").hexdigest()[:12]
+    # load() does not create the file until the first save — the PATH is
+    # the keyed contract:
+    assert budget.path.parent == token_session_no_env / "state"
+    assert budget.path.name == f"budget-{expected}.json"
+
+
+def test_gsync_apply_budget_line_survives_no_env(token_session_no_env):
+    """Direct probe of the gsync crash expression, post-fix: the resolver
+    feeds a real email from the stored session — no AttributeError path."""
+    from pushframe.session import account_email
+    from pushframe.cli import _build_write_budget
+    # Exactly what gsync.py's apply path now runs:
+    budget = _build_write_budget(account_email(), ignore_budget=False)
+    assert budget is not None  # identity exists → pacing active, keyed

{pushframe-5.1.4 → pushframe-5.1.6}/tests/test_preflight_sweep.py

@@ -7,6 +7,16 @@ inventory entry + one parametrize case, nowhere else.
 
 The contract per case: handler returns non-zero, captured output contains
 the named marker AND the remedy substring, and NO 'Traceback' anywhere.
+
+2026-09-30 (venus live + CI): there is deliberately NO `gsync_no_creds`
+case — the Google gate stands BEFORE the Aura gate by design, so a vault-less
+gsync run fails Google-side named long before any Aura credential check,
+and a form-valid fake vault pushes the run past the gate onto the REAL
+Google network with a bogus cookie (the 5.1.2 network guard covers pushd,
+not google.com). The Aura-side no-creds contract is proven by
+`sync_dir_no_creds` / `inspect_no_creds` (same establish_session surface);
+gsync's Google-side named shapes by `gsync_no_vault`, `pair_unknown`,
+`all_zero_pairs`.
 """
 import json
 
@@ -32,10 +42,6 @@ CASES = [
         "inspect_no_creds", {},
         "not authenticated", "pushframe config",
         id="mode-8-inspect-no-creds"),
-    pytest.param(
-        "gsync_no_creds", {"album": "Cadre", "frame": "Fabrice"},
-        "google-sync failed", "google-link",
-        id="mode-8-gsync-no-creds"),
     pytest.param(
         "sync_dir_no_creds", {"dir": "."},
         "not authenticated", "pushframe config",
@@ -57,6 +63,10 @@ CASES = [
         "pair_duplicate", {"name": "dup", "album": "A", "frame": "F"},
         "already exists", "remove it first",
         id="mode-16-pair-duplicate"),
+    pytest.param(
+        "reconcile_no_identity", {"frame": "ghost-frame"},
+        "not authenticated", "pushframe config",
+        id="mode-17-reconcile-no-identity"),
 ]
 
 
@@ -68,6 +78,10 @@ def no_creds(tmp_path, monkeypatch):
     for var in ("PUSHFRAME_EMAIL", "AURA_EMAIL",
                 "PUSHFRAME_PASSWORD", "AURA_PASSWORD"):
         monkeypatch.delenv(var, raising=False)
+    # The vault preflight is pinned AWAY from the real machine's vault: after
+    # the 2026-09-30 path fix this suite would otherwise depend on whether
+    # the dev box happens to hold a healthy vault (venus live-proven bug).
+    monkeypatch.setenv("PUSHFRAME_VAULT_PATH", str(tmp_path / "no-vault.json"))
 
 
 # --- callables ---------------------------------------------------------------
@@ -104,17 +118,6 @@ def inspect_no_creds(capsys, no_creds):
     return run_inspect("whatever")
 
 
-def gsync_no_creds(capsys, no_creds, album, frame):
-    # vault exists (mode 5 covered separately) — the Aura session then fails
-    # named because no credentials of any kind are available.
-    vault = settings.CONFIG_PATH.parent / "google-cookies.json"
-    vault.parent.mkdir(parents=True, exist_ok=True)
-    vault.write_text(json.dumps({"SID": "x"}))  # minimal-looking vault
-    from pushframe.gsync import run_google_sync
-    return run_google_sync(album, frame, apply=False, yes=True,
-                           is_interactive=False)
-
-
 class _MuteAura:
     """Aura stub good enough to reach the dir preflight (which fails first)."""
 
@@ -145,6 +148,18 @@ def schedule_no_systemd(capsys, no_creds):
         mp.undo()
 
 
+def reconcile_no_identity(capsys, no_creds, frame):
+    """venus 2026-09-30 (gsync-apply-budget-none-crash): reconcile --remove
+    built the write budget from an env-ONLY email read — on a token-session
+    host it crashed on email.encode() AFTER the confirmation. The identity
+    resolver now falls back to the stored session, and a fully identity-less
+    run must fail NAMED here (no config), never traceback."""
+    from pushframe.cli import run_reconcile
+    # no injected aura: establish_session must fail NAMED (empty config,
+    # no env) before any network — that IS the identity-less path.
+    return run_reconcile(frame, remove=True, yes=True)
+
+
 def pair_duplicate(capsys, no_creds, name, album, frame):
     from pushframe import pairs as pairs_mod
     pairs_mod.pair_add(name, album=album, frame=frame)

pushframe-5.1.6/tests/test_preflight_vault.py

@@ -0,0 +1,78 @@
+"""google-sync's vault preflight (PRF-01) — the venus live-proven bugs.
+
+2026-09-30, venus: `pushframe google-link` saved a perfectly healthy vault
+(28 cookie records) yet `pushframe google-sync` answered "no Google session
+vault". Two stacked bugs in require_google_vault:
+
+1. the default path was probed WITHOUT expanduser() — `Path("~/.config/…")
+   .exists()` compares a literal `~` directory on disk and never matches,
+   so the preflight fired on every healthy machine (masked on CI: no vault
+   there either; masked on scheduled runs: the --pair branch skips the
+   block — exactly the path the nightly uses);
+2. the shape check demanded a JSON OBJECT while vault.save() writes a JSON
+   LIST of cookie records — with the path fixed, a healthy vault would have
+   landed in the "unreadable — re-link" branch anyway.
+
+The tell was in the transcript: google-link prints "existing Google session
+found" only when from_vault() (a vault READ) succeeds — the vault was
+there; the preflight was the liar.
+"""
+import json
+
+import pytest
+
+from pushframe.preflight import PreflightError, require_google_vault
+
+
+@pytest.fixture
+def vault_root(tmp_path, monkeypatch):
+    """Pinned vault env: default path under tmp, isolated from the machine."""
+    monkeypatch.setenv("PUSHFRAME_VAULT_PATH", str(tmp_path / "v.json"))
+    return tmp_path / "v.json"
+
+
+def _healthy_vault(path):
+    path.write_text(json.dumps([
+        {"name": "SID", "value": "x", "domain": ".google.com"},
+        {"name": "SAPISID", "value": "y", "domain": ".google.com"},
+    ]))
+
+
+def test_healthy_list_vault_passes(vault_root):
+    """The exact venus shape: vault.save()'s JSON list of records."""
+    _healthy_vault(vault_root)
+    assert require_google_vault() == vault_root.expanduser()
+
+
+def test_missing_vault_fails_named_with_remedy(vault_root):
+    with pytest.raises(PreflightError) as e:
+        require_google_vault()
+    assert 'no Google session vault' in str(e.value)
+    assert 'google-link' in str(e.value)
+
+
+def test_literal_tilde_default_path_never_probed(monkeypatch):
+    """The regression itself: without PUSHFRAME_VAULT_PATH the default must
+    be EXPANDED (probe the real per-user path, not a literal `~` file).
+    Pure assertions — this test must never write near the machine's real
+    vault (the first draft did a write+unlink there; unacceptable)."""
+    monkeypatch.delenv("PUSHFRAME_VAULT_PATH", raising=False)
+    from pushframe.preflight import default_vault_path
+    from pushframe.google.vault import DEFAULT_VAULT_PATH
+    real = default_vault_path()
+    assert real == DEFAULT_VAULT_PATH.expanduser()
+    assert '~' not in str(real)
+
+
+def test_dict_vault_still_accepted_backward_compat(vault_root):
+    vault_root.write_text(json.dumps({"SID": "x"}))
+    assert require_google_vault() == vault_root.expanduser()
+
+
+def test_empty_shapes_fail_named(vault_root):
+    for payload in ("[]", "{}", "not json at all"):
+        vault_root.write_text(payload)
+        with pytest.raises(PreflightError) as e:
+            require_google_vault()
+        assert 'unreadable' in str(e.value)
+        assert 'google-link' in str(e.value)

{pushframe-5.1.4 → pushframe-5.1.6}/tests/test_version.py

@@ -19,7 +19,7 @@ PYPROJECT = Path(__file__).resolve().parent.parent / "pyproject.toml"
 def test_version_is_first_distribution_release():
     """The current distribution release (moved off 0.1.0 at 5.0.0; page
     metadata fix shipped in 5.0.4)."""
-    assert __version__ == "5.1.4"
+    assert __version__ == "5.1.6"
 
 
 def test_version_matches_pyproject_single_source():

{pushframe-5.1.4 → pushframe-5.1.6}/uv.lock

@@ -432,7 +432,7 @@ wheels = [
 
 [[package]]
 name = "pushframe"
-version = "5.1.4"
+version = "5.1.6"
 source = { editable = "." }
 dependencies = [
     { name = "boto3" },
@@ -663,11 +663,11 @@ wheels = [
 
 [[package]]
 name = "urllib3"
-version = "2.7.0"
+version = "2.8.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/53/0c/06f8b233b8fd13b9e5ee11424ef85419ba0d8ba0b3138bf360be2ff56953/urllib3-2.7.0.tar.gz", hash = "sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c", size = 433602, upload-time = "2026-05-07T16:13:18.596Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/e3/05/b17359e1cefb4f909b5e40b1b90a496d987258916dbbf88e842c729f510e/urllib3-2.8.0.tar.gz", hash = "sha256:63bf2ead4c879426ebf22ef2a781eeb4aa3b4ae798a0435506f8687fd5bb9b63", size = 458972, upload-time = "2026-09-15T19:29:36.253Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/7f/3e/5db95bcf282c52709639744ca2a8b149baccf648e39c8cc87553df9eae0c/urllib3-2.7.0-py3-none-any.whl", hash = "sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897", size = 131087, upload-time = "2026-05-07T16:13:17.151Z" },
+    { url = "https://files.pythonhosted.org/packages/92/9d/c4e665119135114480843e7ab388fa94d8480650450e6f8e26b70d323a4c/urllib3-2.8.0-py3-none-any.whl", hash = "sha256:0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3", size = 135717, upload-time = "2026-09-15T19:29:34.577Z" },
 ]
 
 [[package]]