wlc 2.2.0__tar.gz → 2.2.1__tar.gz

wlc-2.2.0/CHANGES.rst → wlc-2.2.1/CHANGES.md

@@ -1,8 +1,20 @@
-2.2.0
------
+# Changelog
+
+## 2.2.1
+
+* Released on 24th September 2026.
+* Prevented API keys from appearing in CLI request errors and rejected API keys
+  containing line breaks.
+* Fixed component downloads when a slug contains `repository` and avoided
+  relisting an already resolved component.
+* Reported local filesystem failures as CLI errors and validated component
+  download output paths before fetching data.
+* Updated development dependencies, CI actions, and Docker base images.
+
+## 2.2.0
 
 * Released on 1st September 2026.
-* Hardened authentication by disabling automatic ``netrc`` credentials,
+* Hardened authentication by disabling automatic `netrc` credentials,
   rejecting credentials embedded in URLs, and redacting credentials from HTTP
   failure logs.
 * Scoped insecure HTTP and TLS exceptions to explicitly trusted origins and
@@ -14,8 +26,7 @@
 * Added a threat model and clarified configuration discovery and precedence.
 * Updated development dependencies, CI actions, and Docker base images.
 
-2.1.1
------
+## 2.1.1
 
 * Released on 25th July 2026.
 * Prevented URL parser differential SSRF in server-provided URLs by validating
@@ -23,80 +34,71 @@
 * Improved type annotations.
 * Updated development dependencies, CI actions, and Docker base images.
 
-2.1.0
------
+## 2.1.0
 
 * Released on 30th June 2026.
-* Refuse sending API keys over non-local ``http://`` URLs by default, while
+* Refuse sending API keys over non-local `http://` URLs by default, while
   keeping loopback HTTP supported for local development and adding explicit
-  opt-in via ``--allow-insecure-http``, ``WLC_ALLOW_INSECURE_HTTP``, or trusted
+  opt-in via `--allow-insecure-http`, `WLC_ALLOW_INSECURE_HTTP`, or trusted
   configuration.
 * Fixed paginated listings with query parameters to avoid duplicating
-  parameters from API-provided ``next`` URLs.
-* Updated minimum supported ``requests`` and ``urllib3`` versions.
+  parameters from API-provided `next` URLs.
+* Updated minimum supported `requests` and `urllib3` versions.
 * Improved inline API documentation and output handling internals.
 * Updated development dependencies, CI actions, and Docker base images.
 
-2.0.1
------
+## 2.0.1
 
 * Released on 26th June 2026.
 * Require explicit URL pinning for unscoped API keys when the API URL comes
-  from automatically discovered project configuration: ``WLC_KEY`` requires
-  ``WLC_URL`` and ``--key`` requires ``--url``.
-* Removed ``TRACE`` from the default retryable HTTP methods.
+  from automatically discovered project configuration: `WLC_KEY` requires
+  `WLC_URL` and `--key` requires `--url`.
+* Removed `TRACE` from the default retryable HTTP methods.
 * Added package and container provenance attestations and SBOM publishing for
   release artifacts.
 * Updated development dependencies, CI actions, and Docker base images.
 
-2.0.0
------
+## 2.0.0
 
 * Released on 21st April 2026.
 * Possibly breaking changes:
 
-  * Renamed the retry configuration option from ``method_whitelist`` to ``allowed_methods``.
-  * Tightened configuration loading: explicit ``--config`` is authoritative, missing explicit config files fail, and project discovery uses the nearest config file.
+  * Renamed the retry configuration option from `method_whitelist` to `allowed_methods`.
+  * Tightened configuration loading: explicit `--config` is authoritative, missing explicit config files fail, and project discovery uses the nearest config file.
   * Tightened URL, download, and output safety: invalid or cross-origin URLs are rejected, binary downloads to terminals are refused, and text, CSV, and HTML output is escaped.
-
-* Added ``WLC_URL`` and ``WLC_KEY`` environment variable support.
+* Added `WLC_URL` and `WLC_KEY` environment variable support.
 * Added unit-level CLI commands.
 * Updated models and statistics for the current Weblate API while preserving older statistics responses.
 * Fixed retry configuration and request adapter wiring.
-* Escaped generated HTML output (`GHSA-gx2m-mcc2-r4p3 <https://github.com/WeblateOrg/wlc/security/advisories/GHSA-gx2m-mcc2-r4p3>`__), hardened CSV and terminal output, and redacted authorization headers from debug logs.
+* Escaped generated HTML output ([GHSA-gx2m-mcc2-r4p3](https://github.com/WeblateOrg/wlc/security/advisories/GHSA-gx2m-mcc2-r4p3)), hardened CSV and terminal output, and redacted authorization headers from debug logs.
 * Improved nested category handling, unit editing, help texts, and error messages.
 * Split implementation modules, moved tests out of the installed package, and updated packaging, dependencies, Docker images, and CI.
 
-1.17.2
-------
+## 1.17.2
 
 * Released on 16th January 2026.
 * Fixes path traversal: Unsanitized API slugs in download command (CVE-2026-23535).
 
-1.17.1
-------
+## 1.17.1
 
 * Released on 13th January 2026.
-* Unscoped ``key`` in configuration triggers error.
+* Unscoped `key` in configuration triggers error.
 
-1.17.0
-------
+## 1.17.0
 
 * Released on 12th January 2026.
-* Configuration change might be needed to move API keys to a new location, see https://docs.weblate.org/en/latest/wlc.html#legacy-configuration.
-* Dropped support for unscoped ``key`` in configuration (CVE-2026-22251).
+* Configuration change might be needed to move API keys to a new location, see <https://docs.weblate.org/en/latest/wlc.html#legacy-configuration>.
+* Dropped support for unscoped `key` in configuration (CVE-2026-22251).
 * Tightened hostname-based SSL verification skip (CVE-2026-22250).
 * Modernized packaging.
 * Improved type annotations.
 
-1.16.1
-------
+## 1.16.1
 
 * Released on 10th October 2025.
 * Fixed packages publishing.
 
-1.16
-----
+## 1.16
 
 * Released on 10th October 2025.
 * Fixed downloading components based on configuration.
@@ -105,14 +107,12 @@
 * Dropped support for Python 3.8 and 3.9.
 * Added support for Python 3.13 and 3.14.
 
-1.15
-----
+## 1.15
 
 * Released on 3rd September 2024.
 * Fixed installation on certain filesystems.
 
-1.14
-----
+## 1.14
 
 * Released on 23rd February 2024.
 * Dropped support for Python 3.6 and 3.7.
@@ -120,8 +120,7 @@
 * Added support for categories.
 * Added support for the linked_component field.
 
-1.13
-----
+## 1.13
 
 * Released on 24th March 2022.
 * Support all wlc upload methods.
@@ -129,23 +128,20 @@
 * Allow uploading files when creating a component.
 * Allow downloading at component, project, and site level.
 
-1.12
-----
+## 1.12
 
 * Released on 19th May 2021.
 * Improved error messages when permission was denied.
 * Added type hints to the codebase.
 
-1.11
-----
+## 1.11
 
 * Released on 17th March 2021.
 * Fixed long filenames in test fixtures.
 * Updated base docker image.
 * Add support for specifying format when uploading files.
 
-1.10
-----
+## 1.10
 
 * Released on 11th February 2021.
 * Added ability to create new projects, components, and translations
@@ -158,46 +154,39 @@
 * Using requests.session to keep a single http request open instead of reinitializing them.
 * Added timeout config variable
 
-1.9
----
+## 1.9
 
 * Released on 21st December 2020.
 * Added Docker image published as weblate/wlc on Docker Hub.
 
-1.8
----
+## 1.8
 
 * Released on 11th September 2020.
 * Compatibility with Weblate 4.3 which moves source language from component to a project.
 
-1.7
----
+## 1.7
 
 * Released on 3rd September 2020.
 * Fixed installation of wlc command-line.
 
-1.6
----
+## 1.6
 
 * Released on 1st September 2020.
 * Post payload as JSON to allow handling complex data structures.
 * Added support for finding configuration file on Windows in AppData dir.
 * Improved error reporting.
 
-1.5
----
+## 1.5
 
 * Released on 19th June 2020.
 * Fixed compatibility of some API calls with Weblate 4.1.
 
-1.4
----
+## 1.4
 
 * Released on 3rd June 2020.
 * Fixed compatibility of some API calls with Weblate 4.1.
 
-1.3
----
+## 1.3
 
 * Released on 6th May 2020.
 * Mark Python 3.8 as supported, dropped support for Python 3.5.
@@ -207,8 +196,7 @@
 * Added support for filtering components and translations.
 * Better report errors when accessing API.
 
-1.2
----
+## 1.2
 
 * Released on 15th October 2019.
 * Fix stats invocation.
@@ -216,42 +204,36 @@
 * Added support for replace upload.
 * Added support for project, component and translation removal.
 
-1.1
----
+## 1.1
 
 * Released on 1st February, 2019.
 * Fixed listing of language objects.
 
-1.0
----
+## 1.0
 
 * Released on 31st January, 2019.
 * Added support for more parameters on file upload.
 
-0.10
-----
+## 0.10
 
 * Released on 21th October, 2018.
 * Fixed POST operations in the API.
 * Added --debug parameter to diagnose HTTP problems.
 
-0.9
----
+## 0.9
 
 * Released on 17th October, 2018.
 * Switched to requests
 * Added support for cleanup command.
 * Added support for upload command.
 
-0.8
----
+## 0.8
 
 * Released on 3rd March, 2017.
 * Various code cleanups.
 * Tested with Python 3.6.
 
-0.7
----
+## 0.7
 
 * Released on 16th December, 2016.
 * Added reset operation.
@@ -259,27 +241,23 @@
 * Added changes listing.
 * Added file downloads.
 
-0.6
----
+## 0.6
 
 * Released on 20th September, 2016.
 * Fixed error when invoked without command.
 * Tested on Windows and OS X (in addition to Linux).
 
-0.5
----
+## 0.5
 
 * Released on 11th July, 2016.
 * Added locking commands.
 
-0.4
----
+## 0.4
 
 * Released on 8th July, 2016.
 * Moved Git repository.
 
-0.3
----
+## 0.3
 
 * Released on 19th May, 2016.
 * First version for general usage.

{wlc-2.2.0 → wlc-2.2.1}/MANIFEST.in

@@ -4,7 +4,7 @@ include SECURITY.md
 include LICENSE
 include wl
 recursive-include LICENSES *
-include CHANGES.rst
+include CHANGES.md
 include MANIFEST.in
 include completion/wlc
 graft tests

{wlc-2.2.0 → wlc-2.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: wlc
-Version: 2.2.0
+Version: 2.2.1
 Summary: A command-line utility for Weblate, translation tool with tight version control integration
 Author-email: Michal Čihař <michal@weblate.org>
 License-Expression: GPL-3.0-or-later

{wlc-2.2.0 → wlc-2.2.1}/THREAT_MODEL.md

@@ -2,11 +2,11 @@
 
 Project: wlc (Weblate command-line client and Python API client)
 
-Last reviewed for wlc 2.2.0 at base commit
-`1e63ad96951734ba26ba240f1ccfa80be4a8c645`, including the accompanying
-changes in this revision.
+Last reviewed for wlc 2.2.1 at base commit
+`b61361bc7854f084b3b91081e8c1279d1ee057b0`, including the accompanying
+release changes in this revision.
 
-Date: 2026-09-01.
+Date: 2026-09-24.
 
 Status: Accepted, 2026-09-01.
 
@@ -276,12 +276,13 @@ code, Python runtime, or operating system. *(maintainer)*
 | Server-provided request targets remain on the configured API origin after normalization by the parser used by the HTTP transport. | The request goes through the `Weblate` client. Origin means scheme, normalized host, and effective port. | Pagination, refresh, repository, upload, download, or another response-derived URL causes a request to a different origin. | High when credentials or user data are sent; otherwise Medium. | *(documented)* (source: [client implementation](wlc/client.py), [URL tests](tests/test_urls.py)) |
 | HTTP redirects are not followed automatically. | The request goes through the `Weblate` client. | A 3xx response causes a follow-up request, or is accepted as a successful API response. | High when credentials or user data cross a boundary; otherwise Medium. | *(documented)* (source: [client implementation](wlc/client.py), [URL tests](tests/test_urls.py)) |
 | API keys are not sent over non-loopback cleartext HTTP by default. | A key is present and no trusted source explicitly enabled insecure HTTP. The request goes through the `Weblate` client. | The client sends the key to a non-loopback `http://` destination. | High. | *(documented)* (source: [client implementation](wlc/client.py), [HTTP tests](tests/test_insecure_http.py)) |
+| API keys containing carriage returns or line feeds are rejected before HTTP request construction. | The request goes through the `Weblate` client. | A key containing a line break reaches Requests header processing. | High. | *(documented)* (source: [client implementation](wlc/client.py), [client tests](tests/test_wlc.py), [CLI tests](tests/test_main.py)) |
 | TLS certificates are verified by default and verification exceptions are scoped to the selected origin. | The destination is HTTPS and no trusted source supplied a matching origin or explicit transient exception under the configuration rules. | Verification is disabled for an unrelated origin, or without an explicit trusted opt-in. | High. | *(documented)* (source: [configuration implementation](wlc/config.py), [client implementation](wlc/client.py), [TLS tests](tests/test_insecure_ssl.py)) |
 | Automatically discovered project configuration cannot enable authenticated insecure HTTP, disable TLS verification, or supply insecure origin entries. | The project file is discovered automatically rather than supplied as explicit configuration. | A project-only setting weakens HTTP or TLS transport, or a CLI/environment exception is accepted without a URL from the same source. | High. | *(documented)* (source: [configuration implementation](wlc/config.py), [configuration tests](tests/test_config.py)) |
 | An unscoped CLI or environment key cannot be paired with a project-selected URL unless that same source also pins the URL. | Automatic project discovery supplied the otherwise-effective URL. | `--key` is accepted without `--url`, or `WLC_KEY` is accepted without `WLC_URL`. | High. | *(documented)* (source: [configuration implementation](wlc/config.py), [configuration tests](tests/test_config.py)) |
 | Authentication is accepted only from configured API-key sources; Requests does not automatically add credentials from `.netrc` or the file named by `NETRC`, and credentials embedded in URLs are rejected. | The request goes through the `Weblate` client. | A repository-selected host causes Requests to add or replace authentication using a netrc file, or a URL containing userinfo produces an HTTP request. | High. | *(documented)* (source: [configuration documentation][configuration-docs], [client implementation](wlc/client.py), [client tests](tests/test_wlc.py), [URL tests](tests/test_urls.py)) |
 | An explicit `--config` file prevents automatic user and project configuration discovery. | The CLI successfully reads the explicit file. CLI/environment overrides still apply normally. | Settings from a discovered user or project file affect the configuration. | Medium. | *(documented)* (source: [configuration implementation](wlc/config.py), [configuration tests](tests/test_config.py)) |
-| wlc debug logging redacts authorization and proxy-authorization headers, scrubs their values from request-failure messages, and does not log request bodies or uploaded file contents. | Logging uses wlc's debug helpers. Parameter values can still be logged and must not be used for secrets. | A generated debug entry contains an API token, JSON/body values, or uploaded contents supplied only through the corresponding request fields. | High for credentials; otherwise Medium. | *(documented)* (source: [debug implementation](wlc/http_debug.py), [debug tests](tests/test_errors.py), [CLI debug tests](tests/test_main.py)) |
+| wlc CLI request errors and debug logging redact authorization values, and debug logging does not include request bodies or uploaded file contents. | Requests use the `Weblate` client and errors are rendered by the wlc CLI or debug helpers. Parameter values can still be logged and must not be used for secrets. | A CLI request error or generated debug entry contains an API token, JSON/body values, or uploaded contents supplied only through the corresponding request fields. | High for credentials; otherwise Medium. | *(documented)* (source: [CLI implementation](wlc/main.py), [debug implementation](wlc/http_debug.py), [debug tests](tests/test_errors.py), [CLI tests](tests/test_main.py)) |
 | Automatically generated component archive filenames cannot use server-provided slugs for path traversal. | wlc chooses the project/component download filename inside a user-selected directory. | A server-provided project or component slug writes outside that directory. | High. | *(documented)* (source: [filename helper](wlc/utils.py), [CLI implementation](wlc/main.py), [download tests](tests/test_download.py)) |
 | Download writes do not follow destination symlinks or overwrite non-regular or multiply linked targets, and destination replacement is checked against races. | The CLI writes a downloaded translation or automatically named archive through its download helper. The containing directory remains under local-user control. | A preplanted or racing symlink, hard link, changed inode, or non-regular destination redirects downloaded bytes to another file or device. | High. | *(documented)* (source: [CLI implementation](wlc/main.py), [download tests](tests/test_download.py)) |
 | Raw translation bytes are not written to an interactive terminal. | A translation download would use standard output and that stream reports itself as a TTY. | Binary translation data is emitted to the interactive terminal instead of being refused. | Medium. | *(documented)* (source: [CLI implementation](wlc/main.py), [CLI tests](tests/test_main.py)) |
@@ -308,7 +309,8 @@ code, Python runtime, or operating system. *(maintainer)*
 - Debug output is diagnostic data rather than a supported structured renderer.
   Header and request-body redaction does not imply terminal-control escaping or
   secrecy for request parameter values, URLs, response reason phrases, or error
-  messages included in diagnostics. *(maintainer)*
+  messages included in diagnostics other than configured authorization values.
+  *(maintainer)*
 - wlc does not enforce a response-size, pagination-count, aggregate-time,
   memory, disk-usage, or retry-cost limit against the selected server. The
   configured per-request timeout and retry policy are operational controls, not

{wlc-2.2.0 → wlc-2.2.1}/pyproject.toml

@@ -4,19 +4,19 @@ requires = ["setuptools>=78.0.2"]
 
 [dependency-groups]
 dev = [
-  {include-group = "lint"},
-  {include-group = "test"},
-  {include-group = "types"}
+  { include-group = "lint" },
+  { include-group = "test" },
+  { include-group = "types" }
 ]
 lint = [
-  {include-group = "pre-commit"},
-  {include-group = "pylint"}
+  { include-group = "pre-commit" },
+  { include-group = "pylint" }
 ]
 pre-commit = [
-  "prek==0.5.0"
+  "prek==0.5.3"
 ]
 pylint = [
-  "pylint==4.0.8"
+  "pylint==4.0.9"
 ]
 test = [
   "pytest-cov==7.1.0",
@@ -25,11 +25,11 @@ test = [
   "responses==0.26.3"
 ]
 types = [
-  "ty==0.0.77",
+  "ty==0.0.83",
   "mypy==2.3.1",
   "types-pyxdg==0.28.0.20260518",
   "types-python-dateutil==2.9.0.20260807",
-  "types-requests==2.33.0.20260712"
+  "types-requests==2.33.0.20260906"
 ]
 
 [project]
@@ -105,7 +105,7 @@ ignore = [
 
 [tool.check-wheel-contents]
 ignore = [
-  "W002"  # Triggered by API mocks
+  "W002" # Triggered by API mocks
 ]
 
 [tool.coverage.paths]
@@ -155,30 +155,30 @@ docstring-code-format = true
 [tool.ruff.lint]
 future-annotations = true
 ignore = [
-  "D10",  # TODO: we are missing many docstrings
-  "incorrect-blank-line-before-class",  # CONFIG: incompatible with D211
-  "multi-line-summary-first-line",  # CONFIG: incompatible with D213
-  "line-too-long",  # CONFIG: formatter
-  "non-imperative-mood",  # TODO: many strings need rephrasing
-  "print",  # WONTFIX: using print() (maybe add noqa)
-  "raise-vanilla-args",  # WONTFIX: Avoid specifying long messages outside the exception class
-  "too-many-arguments",  # WONTFIX: Too many arguments to function call
-  "magic-value-comparison",  # TODO: Magic value used in comparison, consider replacing 201 with a constant variable
-  "docstring-missing-returns",  # WONTFIX
-  "docstring-missing-yields",  # WONTFIX
-  "docstring-missing-exception",  # WONTFIX
-  "too-many-statements-in-try-clause",  # TODO
-  "subclass-builtin",  # TODO
-  "no-self-use",  # TODO
-  "too-many-public-methods",  # TODO
-  "read-whole-file",  # TODO
-  "COM",  # CONFIG: No trailing commas
-  "PT",  # CONFIG: Not using pytest
-  "PTH",  # TODO: Not using pathlib
-  "EM",  # TODO: Exception strings
-  "FBT",  # TODO: Boolean in function definition
-  "ANN",  # TODO: type annotations
-  "error-suffix-on-exception-name"  # TODO: exception naming
+  "D10", # TODO: we are missing many docstrings
+  "incorrect-blank-line-before-class", # CONFIG: incompatible with D211
+  "multi-line-summary-first-line", # CONFIG: incompatible with D213
+  "line-too-long", # CONFIG: formatter
+  "non-imperative-mood", # TODO: many strings need rephrasing
+  "print", # WONTFIX: using print() (maybe add noqa)
+  "raise-vanilla-args", # WONTFIX: Avoid specifying long messages outside the exception class
+  "too-many-arguments", # WONTFIX: Too many arguments to function call
+  "magic-value-comparison", # TODO: Magic value used in comparison, consider replacing 201 with a constant variable
+  "docstring-missing-returns", # WONTFIX
+  "docstring-missing-yields", # WONTFIX
+  "docstring-missing-exception", # WONTFIX
+  "too-many-statements-in-try-clause", # TODO
+  "subclass-builtin", # TODO
+  "no-self-use", # TODO
+  "too-many-public-methods", # TODO
+  "read-whole-file", # TODO
+  "COM", # CONFIG: No trailing commas
+  "PT", # CONFIG: Not using pytest
+  "PTH", # TODO: Not using pathlib
+  "EM", # TODO: Exception strings
+  "FBT", # TODO: Boolean in function definition
+  "ANN", # TODO: type annotations
+  "error-suffix-on-exception-name" # TODO: exception naming
 ]
 preview = true
 select = ["ALL"]

{wlc-2.2.0 → wlc-2.2.1}/tests/test_base.py

@@ -197,10 +197,10 @@ def register_uri(
 
 
 def raise_error(request) -> NoReturn:
-    """Raise IOError."""
+    """Raise an expected request error or an unexpected programming error."""
     if "/io" in request.path_url:
         raise RequestException("Some error")
-    raise FileNotFoundError("Bug")
+    raise RuntimeError("Bug")
 
 
 def register_error(

{wlc-2.2.0 → wlc-2.2.1}/tests/test_download.py

@@ -13,16 +13,20 @@ from pathlib import Path
 from tempfile import TemporaryDirectory
 from unittest.mock import patch
 
+from wlc import WeblateException
+
 from .test_main import CLITestBase
 
 
 class TestDownloadSecurity(CLITestBase):
     """Download destination security tests."""
 
-    def create_symlink(self, target: str | Path, link: Path) -> None:
+    def create_symlink(
+        self, target: str | Path, link: Path, *, target_is_directory: bool = False
+    ) -> None:
         """Create a symlink or skip on Windows without symlink privileges."""
         try:
-            link.symlink_to(target)
+            link.symlink_to(target, target_is_directory=target_is_directory)
         except OSError:
             if os.name == "nt":
                 self.skipTest("Symlink creation is not permitted")
@@ -80,6 +84,92 @@ class TestDownloadSecurity(CLITestBase):
             )
             self.assertTrue(destination.is_dir())
 
+    def test_rejects_component_output_file_before_download(self) -> None:
+        with TemporaryDirectory() as tmpdirname:
+            output = Path(tmpdirname) / "out.zip"
+            output.touch()
+
+            with patch("wlc.models.Component.download") as download:
+                error = self.execute(
+                    ["download", "hello/weblate", "--output", str(output)],
+                    expected=1,
+                )
+
+            self.assertEqual(
+                f"Error: Output path is not a directory: {output}\n", error
+            )
+            download.assert_not_called()
+
+    def test_rejects_dangling_component_output_symlink_before_download(self) -> None:
+        with TemporaryDirectory() as tmpdirname:
+            output = Path(tmpdirname) / "output"
+            self.create_symlink("missing", output)
+
+            with patch("wlc.models.Component.download") as download:
+                error = self.execute(
+                    ["download", "hello/weblate", "--output", str(output)],
+                    expected=1,
+                )
+
+            self.assertEqual(
+                f"Error: Output path is not a directory: {output}\n", error
+            )
+            download.assert_not_called()
+
+    def test_accepts_component_output_directory_symlink(self) -> None:
+        with TemporaryDirectory() as tmpdirname:
+            root = Path(tmpdirname)
+            output_directory = root / "output"
+            output_directory.mkdir()
+            output = root / "output-link"
+            self.create_symlink("output", output, target_is_directory=True)
+
+            self.execute(["download", "hello/weblate", "--output", str(output)])
+
+            self.assertTrue((output_directory / "hello-weblate.zip").is_file())
+
+    def test_reports_component_output_permission_error(self) -> None:
+        with TemporaryDirectory() as tmpdirname:
+            output_directory = Path(tmpdirname) / "protected"
+            permission_error = PermissionError(
+                errno.EACCES, "Permission denied", str(output_directory)
+            )
+
+            with patch.object(Path, "mkdir", side_effect=permission_error):
+                output = self.execute(
+                    [
+                        "download",
+                        "hello/weblate",
+                        "--output",
+                        str(output_directory),
+                    ],
+                    expected=1,
+                )
+
+            self.assertEqual(f"Error: {permission_error}\n", output)
+
+    def test_partial_project_download_reports_completed_component(self) -> None:
+        with TemporaryDirectory() as tmpdirname:
+            output_directory = Path(tmpdirname)
+            with patch(
+                "wlc.models.Component.download",
+                side_effect=(b"archive", WeblateException("download failed")),
+            ):
+                output = self.execute(
+                    ["download", "hello", "--output", str(output_directory)],
+                    expected=1,
+                )
+
+            self.assertIn(
+                "downloaded translations for component: hello/hi/android", output
+            )
+            self.assertIn("Error: download failed", output)
+            self.assertNotIn("downloaded translations for project", output)
+            self.assertEqual(
+                [path.name for path in output_directory.iterdir()],
+                ["hello-android.zip"],
+            )
+
     def test_does_not_follow_racing_symlink(self) -> None:
         with TemporaryDirectory() as tmpdirname:
             root = Path(tmpdirname)
@@ -241,20 +331,19 @@ class TestDownloadSecurity(CLITestBase):
     def test_failure_cleans_temporary_file(self) -> None:
         with TemporaryDirectory() as tmpdirname:
             output_directory = Path(tmpdirname)
-            with (
-                patch(
-                    "wlc.main._replace_download_file",
-                    side_effect=OSError("replace failed"),
-                ),
-                self.assertRaisesRegex(OSError, "replace failed"),
+            with patch(
+                "wlc.main._replace_download_file",
+                side_effect=OSError("replace failed"),
             ):
-                self.execute(
+                output = self.execute(
                     [
                         "download",
                         "hello/weblate",
                         "--output",
                         str(output_directory),
-                    ]
+                    ],
+                    expected=1,
                 )
 
+            self.assertEqual("Error: replace failed\n", output)
             self.assertEqual(list(output_directory.iterdir()), [])