python-aidot-cameras 0.11.2__tar.gz → 0.11.3__tar.gz

{python_aidot_cameras-0.11.2/python_aidot_cameras.egg-info → python_aidot_cameras-0.11.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-aidot-cameras
-Version: 0.11.2
+Version: 0.11.3
 Summary: Control AiDot/Leedarson WiFi lights and cameras (WebRTC streaming, two-way audio, PTZ, controls)
 Author-email: cbrightly <chris.brightly@gmail.com>
 License-Expression: MIT
@@ -167,7 +167,7 @@ audio, idle release, the sprop cache path) are documented in
 | `AIDOT_SDES_ADAPTIVE` | Adaptive fast-with-fallback for the SDES keepalive loop: try the fast path first and fall back to the full relay path if a fast attempt delivers no media. A per-device cache skips the fast attempt on later views once it has failed. Truthy value enables. | unset (off) |
 | `AIDOT_SDES_FAST_LIVEPLAY` | Don't block on the `livePlayResp` wait for eligible SDES cameras (~4.5 s faster cold start). Role-reversal models (A001064 PTZ) always excluded for correctness. **On by default**; set to `0`/`false`/`no`/`off` to disable. | enabled (on) |
 | `AIDOT_DTLS_FAST_LIVEPLAY` | The DTLS (A000088) analogue: skip the `livePlayReq`-echo and `livePlayResp` waits (the dominant LAN cold-start cost) while keeping the full ICE/TURN/DTLS handshake, so remote/relay viewing is unaffected. **On by default**; set to `0`/`false`/`no`/`off` to disable. | enabled (on) |
-| `AIDOT_PERSISTENT_MQTT` | Reuse ONE account-level persistent MQTT connection for commands, attribute fetches, and stream-open signaling (matching the official app) instead of connecting per operation. **On by default** (live soak cut SDES NO_MEDIA ~57%->~19%); set to `0`/`false`/`no`/`off` to disable. | enabled (on) |
+| `AIDOT_PERSISTENT_MQTT` | Reuse ONE account-level persistent MQTT connection for commands, attribute fetches, and stream-open signaling (matching the official app) instead of connecting per operation. **On by default** (live soaks cut SDES NO_MEDIA from ~57% to ~11-19%); set to `0`/`false`/`no`/`off` to disable. | enabled (on) |
 | `AIDOT_SERVE_RELAY` | Hold the public stream port via an internal relay that proxies to ffmpeg, so the first (cold) view connects instead of failing while ffmpeg can't pre-bind the port. Set to `0` to serve ffmpeg directly. | `1` (enabled) |
 | `AIDOT_LIVESTREAM_PARAM` | Set to `0` to skip the cloud `liveStreamParam` pre-connect that provisions battery cameras' live-stream sessions before signaling (without it, battery cameras like the L2 models reject streaming with `-50019`). | `1` (enabled) |
 

{python_aidot_cameras-0.11.2 → python_aidot_cameras-0.11.3}/README.md

@@ -137,7 +137,7 @@ audio, idle release, the sprop cache path) are documented in
 | `AIDOT_SDES_ADAPTIVE` | Adaptive fast-with-fallback for the SDES keepalive loop: try the fast path first and fall back to the full relay path if a fast attempt delivers no media. A per-device cache skips the fast attempt on later views once it has failed. Truthy value enables. | unset (off) |
 | `AIDOT_SDES_FAST_LIVEPLAY` | Don't block on the `livePlayResp` wait for eligible SDES cameras (~4.5 s faster cold start). Role-reversal models (A001064 PTZ) always excluded for correctness. **On by default**; set to `0`/`false`/`no`/`off` to disable. | enabled (on) |
 | `AIDOT_DTLS_FAST_LIVEPLAY` | The DTLS (A000088) analogue: skip the `livePlayReq`-echo and `livePlayResp` waits (the dominant LAN cold-start cost) while keeping the full ICE/TURN/DTLS handshake, so remote/relay viewing is unaffected. **On by default**; set to `0`/`false`/`no`/`off` to disable. | enabled (on) |
-| `AIDOT_PERSISTENT_MQTT` | Reuse ONE account-level persistent MQTT connection for commands, attribute fetches, and stream-open signaling (matching the official app) instead of connecting per operation. **On by default** (live soak cut SDES NO_MEDIA ~57%->~19%); set to `0`/`false`/`no`/`off` to disable. | enabled (on) |
+| `AIDOT_PERSISTENT_MQTT` | Reuse ONE account-level persistent MQTT connection for commands, attribute fetches, and stream-open signaling (matching the official app) instead of connecting per operation. **On by default** (live soaks cut SDES NO_MEDIA from ~57% to ~11-19%); set to `0`/`false`/`no`/`off` to disable. | enabled (on) |
 | `AIDOT_SERVE_RELAY` | Hold the public stream port via an internal relay that proxies to ffmpeg, so the first (cold) view connects instead of failing while ffmpeg can't pre-bind the port. Set to `0` to serve ffmpeg directly. | `1` (enabled) |
 | `AIDOT_LIVESTREAM_PARAM` | Set to `0` to skip the cloud `liveStreamParam` pre-connect that provisions battery cameras' live-stream sessions before signaling (without it, battery cameras like the L2 models reject streaming with `-50019`). | `1` (enabled) |
 

{python_aidot_cameras-0.11.2 → python_aidot_cameras-0.11.3}/aidot/__main__.py

@@ -59,6 +59,7 @@ import logging
 import os
 import signal
 import sys
+import tempfile
 
 import aiohttp
 
@@ -85,10 +86,25 @@ def _read_token_file(path: str) -> dict:
 
 
 def _write_token_file(path: str, data: dict) -> None:
-    """Blocking write of login_info to ``path`` with 0600 perms."""
-    with open(path, "w", encoding="utf-8") as fh:
-        json.dump(data, fh)
-    os.chmod(path, 0o600)
+    """Atomic, 0600-secure write of login_info to ``path``.
+
+    Serialize into a temp file in the same directory (mkstemp creates it 0600,
+    closing the world-readable window os.chmod-after-write leaves) and only then
+    os.replace it over ``path`` - so a serialization failure never truncates the
+    previously-valid token. On any error the temp file is removed and re-raised.
+    """
+    directory = os.path.dirname(path) or "."
+    fd, tmp = tempfile.mkstemp(dir=directory, prefix=".token-", suffix=".tmp")
+    try:
+        with os.fdopen(fd, "w", encoding="utf-8") as fh:
+            json.dump(data, fh)
+        os.replace(tmp, path)
+    except BaseException:
+        try:
+            os.unlink(tmp)
+        except OSError:
+            pass
+        raise
 
 
 def _install_token_cache(client: AidotClient, path: str) -> None:
@@ -133,10 +149,17 @@ async def _make_client(session: aiohttp.ClientSession) -> AidotClient:
     password = os.environ.get("AIDOT_PASSWORD")
 
     if token_file and os.path.exists(token_file):
-        token = await loop.run_in_executor(None, _read_token_file, token_file)
-        client = AidotClient(session=session, token=token)
-        _install_token_cache(client, token_file)
-        return client
+        try:
+            token = await loop.run_in_executor(None, _read_token_file, token_file)
+        except (OSError, ValueError) as exc:
+            # ValueError covers json.JSONDecodeError (empty/partial/corrupt
+            # cache). Fall through to the username/password path rather than
+            # crash CLI startup.
+            _LOGGER.warning("ignoring unreadable token cache %s: %s", token_file, exc)
+        else:
+            client = AidotClient(session=session, token=token)
+            _install_token_cache(client, token_file)
+            return client
 
     if not username or not password:
         sys.exit(

{python_aidot_cameras-0.11.2 → python_aidot_cameras-0.11.3}/aidot/camera/client.py

@@ -695,7 +695,9 @@ class CameraMixin(_CameraControlsMixin, _WebRTCOpenMixin, _SdesOpenMixin):
         self._motion_active: bool = False
         self._motion_cb: Optional[Callable] = None
         self._motion_task: Optional["asyncio.Task[None]"] = None
-        self._motion_seen: set = set()
+        # Insertion-ordered set (dict keys) so the memory-bound trim can evict
+        # the OLDEST uids deterministically rather than arbitrary ones.
+        self._motion_seen: dict = {}
         self._motion_interval: float = 30.0
 
     # -- Pre-0.6 core API, kept for existing consumers ----------------------- #
@@ -1020,9 +1022,12 @@ class CameraMixin(_CameraControlsMixin, _WebRTCOpenMixin, _SdesOpenMixin):
             if not mqtt_host:
                 # Fall back to the regional MQTT broker URL known to work from
                 # the AiDot web client: wss://{region}-mqtt.arnoo.com:8443/mqtt
+                # Redacted: `data`/`body` carries mqttPassword; log only the
+                # non-sensitive key names present, mirroring the hasPwd-style
+                # redaction of the debug log below.
                 _LOGGER.warning(
                     "getServerUrlConfig returned no mqttServerUrl; "
-                    "using regional fallback. body=%s", body
+                    "using regional fallback. keys=%s", sorted(data)
                 )
                 mqtt_host = f"wss://{self._region}-mqtt.arnoo.com:8443/mqtt"
 
@@ -2116,11 +2121,16 @@ class CameraMixin(_CameraControlsMixin, _WebRTCOpenMixin, _SdesOpenMixin):
                     return
             frame_event.set()
 
-        session = await self.async_open_webrtc_stream(
-            on_frame=_on_frame,
-            timeout=timeout,
-            status_callback=status_callback,
-        )
+        try:
+            session = await self.async_open_webrtc_stream(
+                on_frame=_on_frame,
+                timeout=timeout,
+                status_callback=status_callback,
+            )
+        except Exception as _snap_exc:
+            _LOGGER.error(
+                "async_snapshot DTLS failed for %s: %s", self.device_id, _snap_exc)
+            return False
         try:
             try:
                 await _asyncio.wait_for(frame_event.wait(), timeout=timeout)
@@ -2243,7 +2253,7 @@ class CameraMixin(_CameraControlsMixin, _WebRTCOpenMixin, _SdesOpenMixin):
         if self._motion_task is not None and not self._motion_task.done():
             return
         self._motion_active = True
-        self._motion_seen = set()
+        self._motion_seen = {}
         self._motion_task = asyncio.ensure_future(self._motion_poll_loop(lookback_s))
 
     async def async_stop_motion_polling(self) -> None:
@@ -2273,7 +2283,7 @@ class CameraMixin(_CameraControlsMixin, _WebRTCOpenMixin, _SdesOpenMixin):
                     uid = it.get("eventUuid") or it.get("eventId") or it.get("recordId")
                     if not uid or uid in self._motion_seen:
                         continue
-                    self._motion_seen.add(uid)
+                    self._motion_seen[uid] = None
                     fresh.append(it)
                 if primed and fresh and self._motion_cb is not None:
                     for it in sorted(fresh, key=lambda x: x.get("eventTime") or 0):
@@ -2285,7 +2295,9 @@ class CameraMixin(_CameraControlsMixin, _WebRTCOpenMixin, _SdesOpenMixin):
                             _LOGGER.debug("motion callback raised", exc_info=True)
                 primed = True
                 if len(self._motion_seen) > 1000:  # bound memory
-                    self._motion_seen = set(list(self._motion_seen)[-400:])
+                    # Keep the 400 most-recent uids (insertion order), evicting
+                    # the oldest so still-in-window events stay deduplicated.
+                    self._motion_seen = dict.fromkeys(list(self._motion_seen)[-400:])
             except asyncio.CancelledError:
                 return
             except Exception as exc:

{python_aidot_cameras-0.11.2 → python_aidot_cameras-0.11.3}/aidot/camera/lan_control.py

@@ -309,6 +309,10 @@ class CameraLanClient:
                                      "attr": [], "channel": "tcp", "ascNumber": asc},
                          "tst": int(time.time() * 1000), "deviceId": self.device_id})]
         replies = await self._session(build)
+        if not replies:
+            raise CameraLanError(
+                f"{self.device_id}: no reply to attribute query"
+            )
         return (replies[0].get("payload") or {}).get("attr") or {}
 
     async def async_set_attributes(self, attr: dict) -> bool:

{python_aidot_cameras-0.11.2 → python_aidot_cameras-0.11.3}/aidot/camera/playback.py

@@ -193,15 +193,18 @@ class CloudPlaybackSession:
             )
         except TimeoutError:
             _LOGGER.error("Cloud playback: login response timed out")
+            await self._cleanup()
             return False
         except Exception as exc:
             _LOGGER.error("Cloud playback: login read error: %s", exc)
+            await self._cleanup()
             return False
 
         if hdr["cmd"] != _CMD_LOGIN_RES:
             _LOGGER.error(
                 "Cloud playback: unexpected login response cmd=0x%04x", hdr["cmd"]
             )
+            await self._cleanup()
             return False
 
         try:
@@ -211,6 +214,7 @@ class CloudPlaybackSession:
                     "Cloud playback: login rejected code=%s body=%s",
                     body_obj.get("code"), body_obj,
                 )
+                await self._cleanup()
                 return False
         except (json.JSONDecodeError, ValueError):
             pass  # some firmware sends no JSON body - treat as success
@@ -292,6 +296,13 @@ class CloudPlaybackSession:
             else:
                 _LOGGER.warning("Cloud playback: unexpected stream result=%d", result)
 
+        # Loop exited on end-of-stream or a receive error/timeout (not via an
+        # external stop(), which cancels this task and owns its own teardown).
+        # Tear down here so the heartbeat loop wakes to a closed writer and
+        # exits, and the socket is not left open until stop() is called.
+        self._running = False
+        await self._cleanup()
+
     async def start(self) -> bool:
         self._running = True
         if not await self._connect_and_login():
@@ -326,12 +337,19 @@ class CloudPlaybackSession:
                     pass
         self._hb_task = None
         self._rx_task = None
+        await self._cleanup()
+
+    async def _cleanup(self) -> None:
+        # Close the TCP writer and drop the reader/writer refs. Nulling the
+        # writer makes a subsequent stop() (or a second call) a safe no-op, so
+        # this is the single teardown path shared by the login-failure returns,
+        # the receive-loop exit, and stop().
         if self._writer is not None:
             try:
                 self._writer.close()
                 await self._writer.wait_closed()
             except Exception:
-                _LOGGER.debug("swallowed exception in %s", 'stop', exc_info=True)
+                _LOGGER.debug("swallowed exception in %s", '_cleanup', exc_info=True)
             self._writer = None
             self._reader = None
 

{python_aidot_cameras-0.11.2 → python_aidot_cameras-0.11.3}/aidot/camera/sdes_open.py

@@ -672,6 +672,15 @@ class _SdesOpenMixin:
                 # proceed rather than abort on a code we can't classify as terminal
                 # (genuine terminal rejects are still caught on the webrtcResp ack).
                 if _lp_on_sdes == 0:
+                    # Match the sibling raises: close the reserved sockets and
+                    # signal the MQTT thread before propagating.  (No sdp_path
+                    # unlink here - it is not created until later, below.)
+                    for _rsock in (_audio_sock, _video_sock):
+                        try:
+                            _rsock.close()
+                        except Exception:
+                            _LOGGER.debug("camera %s: swallowed exception in %s", getattr(self, "device_id", "?"), '_bridge_fn', exc_info=True)
+                    outgoing_q.put_nowait(None)   # stop MQTT thread
                     raise RuntimeError(
                         f"livePlay refused by camera (livePlay=0, code={_lp_code_sdes})")
                 elif _lp_code_sdes not in (0, 200):
@@ -3604,6 +3613,12 @@ class _SdesOpenMixin:
                             stdout=subprocess.DEVNULL,
                             stderr=subprocess.PIPE,
                         )
+                        # Point the shared holder at the live proc immediately.
+                        # The bridge thread polls _proc_holder[0]; if it still
+                        # sees the terminated old proc it logs "stream ended",
+                        # breaks, and closes the loopback sockets - starving the
+                        # restarted ffmpeg (0-frame stream).
+                        _proc_holder[0] = proc
                         _status("ffmpeg restarted with camera's SRTP keys")
         except TimeoutError:
             if _cam_echo_received:

{python_aidot_cameras-0.11.2 → python_aidot_cameras-0.11.3}/aidot/camera/webrtc_open.py

@@ -1156,6 +1156,7 @@ class _WebRTCOpenMixin:
                     # transient on battery cameras and recover via ICE; abort
                     # there would spuriously kill otherwise-good streams.
                     if _lp_on == 0:
+                        outgoing_q.put_nowait(None)   # stop MQTT thread (avoid orphan)
                         raise RuntimeError(
                             f"livePlay refused by camera (livePlay=0, code={_lp_code})"
                         )
@@ -1207,6 +1208,7 @@ class _WebRTCOpenMixin:
                     _lp_code2 = int(_lp_resp2.get("code", 200))
                     _lp_on2   = int(_lp_resp2.get("livePlay", 1))
                     if _lp_on2 == 0:
+                        outgoing_q.put_nowait(None)   # stop MQTT thread (avoid orphan)
                         raise RuntimeError(
                             f"livePlay refused by camera (livePlay=0, code={_lp_code2})"
                         )
@@ -3210,6 +3212,7 @@ class _WebRTCOpenMixin:
                 # encoder is still cold.  Tear down and raise so the serve loop
                 # fast-retries in a bounded burst instead of letting DTLS
                 # co-fail into the full 15s-gated generic retry.
+                outgoing_q.put_nowait(None)   # stop MQTT thread (avoid orphan)
                 try:
                     await pc.close()
                 except Exception:

{python_aidot_cameras-0.11.2 → python_aidot_cameras-0.11.3}/aidot/client.py

@@ -38,6 +38,8 @@ from .const import (
     SUPPORTED_COUNTRYS,
     DEFAULT_COUNTRY_CODE,
     CONF_IS_OWNER,
+    LOGIN_INFO_PERSISTENT_MQTT_KEY,
+    LOGIN_INFO_PERSISTENT_MQTT_LOCK_KEY,
     RUNTIME_ONLY_LOGIN_INFO_KEYS,
     ServerErrorCode,
 )
@@ -567,7 +569,12 @@ class AidotClient:
         # Close the account-shared persistent MQTT connection, if one was opened
         # (AIDOT_PERSISTENT_MQTT). Stored on the shared login_info by the camera
         # command/attr paths; closing here stops its background paho loop.
-        pm = self.login_info.pop("_persistent_mqtt", None) if isinstance(self.login_info, dict) else None
+        pm = None
+        if isinstance(self.login_info, dict):
+            pm = self.login_info.pop(LOGIN_INFO_PERSISTENT_MQTT_KEY, None)
+            # Also drop the lock so the asyncio.Lock does not linger on the
+            # account-shared login_info after close.
+            self.login_info.pop(LOGIN_INFO_PERSISTENT_MQTT_LOCK_KEY, None)
         if pm is not None:
             try:
                 pm.close()

{python_aidot_cameras-0.11.2 → python_aidot_cameras-0.11.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "python-aidot-cameras"
-version = "0.11.2"
+version = "0.11.3"
 description = "Control AiDot/Leedarson WiFi lights and cameras (WebRTC streaming, two-way audio, PTZ, controls)"
 readme = "README.md"
 license = "MIT"

{python_aidot_cameras-0.11.2 → python_aidot_cameras-0.11.3/python_aidot_cameras.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-aidot-cameras
-Version: 0.11.2
+Version: 0.11.3
 Summary: Control AiDot/Leedarson WiFi lights and cameras (WebRTC streaming, two-way audio, PTZ, controls)
 Author-email: cbrightly <chris.brightly@gmail.com>
 License-Expression: MIT
@@ -167,7 +167,7 @@ audio, idle release, the sprop cache path) are documented in
 | `AIDOT_SDES_ADAPTIVE` | Adaptive fast-with-fallback for the SDES keepalive loop: try the fast path first and fall back to the full relay path if a fast attempt delivers no media. A per-device cache skips the fast attempt on later views once it has failed. Truthy value enables. | unset (off) |
 | `AIDOT_SDES_FAST_LIVEPLAY` | Don't block on the `livePlayResp` wait for eligible SDES cameras (~4.5 s faster cold start). Role-reversal models (A001064 PTZ) always excluded for correctness. **On by default**; set to `0`/`false`/`no`/`off` to disable. | enabled (on) |
 | `AIDOT_DTLS_FAST_LIVEPLAY` | The DTLS (A000088) analogue: skip the `livePlayReq`-echo and `livePlayResp` waits (the dominant LAN cold-start cost) while keeping the full ICE/TURN/DTLS handshake, so remote/relay viewing is unaffected. **On by default**; set to `0`/`false`/`no`/`off` to disable. | enabled (on) |
-| `AIDOT_PERSISTENT_MQTT` | Reuse ONE account-level persistent MQTT connection for commands, attribute fetches, and stream-open signaling (matching the official app) instead of connecting per operation. **On by default** (live soak cut SDES NO_MEDIA ~57%->~19%); set to `0`/`false`/`no`/`off` to disable. | enabled (on) |
+| `AIDOT_PERSISTENT_MQTT` | Reuse ONE account-level persistent MQTT connection for commands, attribute fetches, and stream-open signaling (matching the official app) instead of connecting per operation. **On by default** (live soaks cut SDES NO_MEDIA from ~57% to ~11-19%); set to `0`/`false`/`no`/`off` to disable. | enabled (on) |
 | `AIDOT_SERVE_RELAY` | Hold the public stream port via an internal relay that proxies to ffmpeg, so the first (cold) view connects instead of failing while ffmpeg can't pre-bind the port. Set to `0` to serve ffmpeg directly. | `1` (enabled) |
 | `AIDOT_LIVESTREAM_PARAM` | Set to `0` to skip the cloud `liveStreamParam` pre-connect that provisions battery cameras' live-stream sessions before signaling (without it, battery cameras like the L2 models reject streaming with `-50019`). | `1` (enabled) |
 

{python_aidot_cameras-0.11.2 → python_aidot_cameras-0.11.3}/python_aidot_cameras.egg-info/SOURCES.txt

@@ -117,5 +117,6 @@ tests/test_stream_idle.py
 tests/test_stream_teardown.py
 tests/test_talk.py
 tests/test_terminal_ack.py
+tests/test_token_file_robustness.py
 tests/test_token_refresh.py
 tests/test_wait_or_event.py

{python_aidot_cameras-0.11.2 → python_aidot_cameras-0.11.3}/tests/test_lan_control.py

@@ -80,3 +80,23 @@ def test_network_helpers_are_callable():
     assert inspect.iscoroutinefunction(discover_subnet)
     sig = inspect.signature(discover_subnet)
     assert list(sig.parameters) == ["cidr24", "timeout", "concurrency"]
+
+
+def test_get_attributes_empty_replies_raises_lanerror():
+    # If the camera accepts login but never answers getDevAttrReq (read timeout),
+    # _session returns [] - async_get_attributes must raise CameraLanError (the
+    # contract callers rely on for cloud fallback), not an unguarded IndexError.
+    import asyncio
+
+    c = CameraLanClient(DEVICE, USER, ip="192.0.2.10")
+
+    async def _empty(_build):
+        return []
+
+    c._session = _empty
+
+    async def _go():
+        with pytest.raises(CameraLanError):
+            await c.async_get_attributes()
+
+    asyncio.run(_go())

{python_aidot_cameras-0.11.2 → python_aidot_cameras-0.11.3}/tests/test_motion_poll.py

@@ -24,7 +24,7 @@ class _FakeDC:
         self._call = 0
         self._motion_active = True
         self._motion_cb = None
-        self._motion_seen = set()
+        self._motion_seen: dict = {}  # insertion-ordered set (dict keys); see CameraMixin
         self._motion_interval = 0.01  # fast for the test
 
     async def async_get_cloud_recordings(self, *a, **k):

python_aidot_cameras-0.11.3/tests/test_token_file_robustness.py

@@ -0,0 +1,43 @@
+"""Tests for the standalone CLI's token-cache read/write robustness.
+
+Covers the 0.11.3 fixes: the token file is written atomically at 0600 (a
+serialization failure must not truncate a previously-valid token), and a
+corrupt/partial cache is a caught ValueError (so _make_client can fall back
+to username/password login instead of crashing).
+"""
+import os
+import stat
+
+import pytest
+
+from aidot.__main__ import _read_token_file, _write_token_file
+
+
+def test_write_token_file_round_trips_and_is_0600(tmp_path):
+    p = tmp_path / "token.json"
+    _write_token_file(str(p), {"accessToken": "abc", "id": "u1"})
+    assert _read_token_file(str(p)) == {"accessToken": "abc", "id": "u1"}
+    assert stat.S_IMODE(os.stat(p).st_mode) == 0o600
+
+
+def test_write_token_file_preserves_previous_on_serialization_failure(tmp_path):
+    p = tmp_path / "token.json"
+    _write_token_file(str(p), {"accessToken": "good"})  # seed a valid token
+
+    # A set is not JSON-serializable, so json.dump raises mid-write. The atomic
+    # temp-then-replace write must leave the previously-valid token untouched.
+    with pytest.raises(TypeError):
+        _write_token_file(str(p), {"broken": {1, 2, 3}})
+
+    assert _read_token_file(str(p)) == {"accessToken": "good"}
+    # And it must not leave a stray temp file behind.
+    assert [f for f in os.listdir(tmp_path) if f.startswith(".token-")] == []
+
+
+def test_read_token_file_raises_valueerror_on_corrupt(tmp_path):
+    p = tmp_path / "token.json"
+    p.write_text("{ not valid json", encoding="utf-8")
+    # json.JSONDecodeError is a subclass of ValueError - the exact type
+    # _make_client catches to fall back to password login rather than crash.
+    with pytest.raises(ValueError):
+        _read_token_file(str(p))