ynab-api-cli 0.1.0__tar.gz → 0.1.1__tar.gz

ynab_api_cli-0.1.1/.github/workflows/live.yml

@@ -0,0 +1,35 @@
+name: Read-only live YNAB tests
+
+# Environment secrets must be configured by the repository owner separately.
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ynab-live
+  cancel-in-progress: false
+
+jobs:
+  live:
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    environment: ynab-e2e
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          enable-cache: false
+      - name: Install reviewed locked dependencies without YNAB secrets
+        run: uv sync --locked --no-editable
+      - name: Run read-only probes with step-scoped secrets
+        env:
+          YNAB_ACCESS_TOKEN: ${{ secrets.YNAB_ACCESS_TOKEN }}
+          YNAB_TEST_PLAN_ID: ${{ secrets.YNAB_TEST_PLAN_ID }}
+        run: |
+          ulimit -c 0
+          .venv/bin/python -m ynab_api_cli.ci_live

ynab_api_cli-0.1.1/.github/workflows/release.yml

@@ -0,0 +1,47 @@
+name: Release (legacy ynab-api-cli)
+# Publishes the final, deprecated ynab-api-cli release from the legacy/ynab-api-cli branch.
+# The maintained package is codapact-ynab, released from main.
+on:
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: release-legacy
+  cancel-in-progress: false
+jobs:
+  build:
+    if: github.ref == 'refs/heads/legacy/ynab-api-cli'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      - run: uv sync --locked
+      - run: uv run poe check
+      - run: uv build
+      - run: uvx --from twine==6.2.0 twine check --strict dist/*.whl dist/*.tar.gz
+      - run: uv run poe distribution-check
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: python-distributions
+          path: |
+            dist/*.whl
+            dist/*.tar.gz
+          if-no-files-found: error
+
+  publish-pypi:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/project/ynab-api-cli/
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: python-distributions
+          path: dist/
+      - name: Publish through trusted publishing
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2

{ynab_api_cli-0.1.0 → ynab_api_cli-0.1.1}/PKG-INFO

@@ -1,18 +1,25 @@
 Metadata-Version: 2.3
 Name: ynab-api-cli
-Version: 0.1.0
-Summary: Complete contract-driven REST CLI for YNAB
+Version: 0.1.1
+Summary: DEPRECATED: use codapact-ynab. Contract-driven REST CLI for YNAB
 Author: Mike Hill
+Classifier: Development Status :: 7 - Inactive
 Requires-Dist: httpx>=0.28.1
 Requires-Dist: jsonschema[format]>=4.26.0
 Requires-Dist: pydantic>=2.14.1
 Requires-Dist: pyyaml>=6.0.3
 Requires-Python: >=3.12
-Project-URL: Homepage, https://github.com/mikejhill/ynab-api-cli
-Project-URL: Repository, https://github.com/mikejhill/ynab-api-cli
-Project-URL: Issues, https://github.com/mikejhill/ynab-api-cli/issues
+Project-URL: Homepage, https://github.com/mikejhill/codapact-ynab
+Project-URL: Repository, https://github.com/mikejhill/codapact-ynab
+Project-URL: Issues, https://github.com/mikejhill/codapact-ynab/issues
 Description-Content-Type: text/markdown
 
+> [!WARNING]
+> **Deprecated.** `ynab-api-cli` receives no further updates. Use
+> [`codapact-ynab`](https://pypi.org/project/codapact-ynab/) instead:
+> `uv tool install codapact-ynab`, then run `ynab --help`.
+> Source: https://github.com/mikejhill/codapact-ynab
+
 # YNAB API CLI
 
 Complete, synchronous REST CLI for the reviewed YNAB API contract. The official SDK is not a dependency. Generated, strictly typed endpoint classes and models are included for Python callers.
@@ -74,6 +81,8 @@ The contract snapshot, reviewed operation catalog, and provenance are packaged r
 
 See [maintenance](docs/maintenance.md) for reviewed upgrades, test coverage, and CI. See [live testing](docs/live-testing.md) before enabling writes against a dedicated test plan.
 
+See [secure live CI](docs/live-ci.md) for the separate, manually approved read-only workflow. Ordinary CI requires no YNAB credentials. No local token is uploaded automatically.
+
 ## Supplementary Codex skill
 
 ```text

{ynab_api_cli-0.1.0 → ynab_api_cli-0.1.1}/README.md

@@ -1,3 +1,9 @@
+> [!WARNING]
+> **Deprecated.** `ynab-api-cli` receives no further updates. Use
+> [`codapact-ynab`](https://pypi.org/project/codapact-ynab/) instead:
+> `uv tool install codapact-ynab`, then run `ynab --help`.
+> Source: https://github.com/mikejhill/codapact-ynab
+
 # YNAB API CLI
 
 Complete, synchronous REST CLI for the reviewed YNAB API contract. The official SDK is not a dependency. Generated, strictly typed endpoint classes and models are included for Python callers.
@@ -59,6 +65,8 @@ The contract snapshot, reviewed operation catalog, and provenance are packaged r
 
 See [maintenance](docs/maintenance.md) for reviewed upgrades, test coverage, and CI. See [live testing](docs/live-testing.md) before enabling writes against a dedicated test plan.
 
+See [secure live CI](docs/live-ci.md) for the separate, manually approved read-only workflow. Ordinary CI requires no YNAB credentials. No local token is uploaded automatically.
+
 ## Supplementary Codex skill
 
 ```text

ynab_api_cli-0.1.1/docs/live-ci.md

@@ -0,0 +1,41 @@
+# Live tests without publishing credentials
+
+The ordinary PR, push, scheduled contract, and release checks do not use YNAB credentials. The separate `live.yml` workflow is manual, restricted to main, and read-only. It checks the explicit disposable plan, validates available responses against the reviewed contract, and reports operation names and gaps. It does not print plan IDs, journal paths, response bodies, or fixture IDs.
+
+## Security boundary
+
+GitHub encrypts environment secrets, but the approved runner and application necessarily receive the plaintext token in memory. Secret masking is not an exfiltration barrier: malicious workflow code, actions, or dependencies can steal a token. If your requirement is that the token never leaves this computer, keep live tests local and do not configure a GitHub secret. See [GitHub's secret guidance](https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/use-secrets).
+
+YNAB personal access tokens are account credentials. Selecting a dummy plan in the CLI does not restrict the token's API permissions. For CI, use a dedicated test account containing only disposable data where possible; a separately issued token on the same account is independently revocable but still has account access. See [YNAB authentication](https://api.ynab.com/#personal-access-tokens).
+
+## Configure the protected environment before enabling the workflow
+
+1. Open repository **Settings → Environments → New environment**, and name it `ynab-e2e`. Do not reuse `pypi`.
+2. Add a trusted maintainer as a required reviewer. For a single-maintainer repository, allow that maintainer to review their own manual run; preventing self-review requires another reviewer. Restrict deployment branches to the selected branch `main`, and prevent bypassing protection rules where available.
+3. Protect main through branch rules, require code review, and review changes to `live.yml`, `ci_live.py`, `live.py`, transport code, actions, and `uv.lock` before approving a live job. Pin actions to reviewed commit SHAs.
+4. Create environment secrets `YNAB_ACCESS_TOKEN` and `YNAB_TEST_PLAN_ID`. The latter must be the explicit dummy-plan UUID. The plan name must begin `YNAB API CLI TEST`.
+
+Use GitHub's environment-secret UI or hidden local GitHub CLI prompts:
+
+```text
+gh secret set YNAB_ACCESS_TOKEN --repo mikejhill/ynab-api-cli --env ynab-e2e
+gh secret set YNAB_TEST_PLAN_ID --repo mikejhill/ynab-api-cli --env ynab-e2e
+```
+
+Enter each value only at its local prompt. Do not use `--body TOKEN`, shell literals, command substitution that could echo it, chat, or a committed file. This setup sends the token to GitHub's encrypted secret store; it does not keep the token exclusively local.
+
+5. After merging the reviewed workflow into main, open **Actions → Read-only live YNAB tests → Run workflow**, choose main, inspect the exact commit and changes, then approve its environment deployment. [Environment protection rules](https://docs.github.com/en/actions/reference/workflows-and-actions/deployments-and-environments) gate when environment secrets become available.
+
+The workflow has no PR trigger, no `pull_request_target`, no user-selected checkout ref, no artifact uploads, and no dependency caching. Dependency installation runs before the token-bearing step. Only that step receives the secrets. The helper consumes them from its process environment, creates a permission-protected temporary auth file, and removes its temporary files on success or failure. The job uses a fresh GitHub-hosted runner. Reports contain only fixed status fields, reviewed operation names, and capability gaps. Do not enable shell tracing, HTTP/debug logging, step debugging, core dumps, response uploads, or caches containing configuration.
+
+Account-wide plan listing and user reads are excluded. This reduces application scope; it does not reduce token permissions. Read-only CI intentionally reports missing write and fixture-dependent operations, so success does not mean all-feature live coverage.
+
+## Keep mutation tests local
+
+The full runner creates reusable accounts, a category group, a category, and a payee, and exercises transaction and budgeting changes. Some fixtures cannot be deleted through the API. It persists private mutation intents and stops on uncertain outcomes. Keep that journal outside the repository and reconcile uncertain writes before rerunning.
+
+Write tests are deliberately absent from `live.yml`. Ephemeral CI journals disappear when a job ends; blindly rerunning a failed write job can duplicate an uncertain mutation. Adding CI writes requires a reviewed design for durable private journal storage, restoration before every run, concurrency, reconciliation, retention, and cleanup. Do not upload an auth file or mutation journal as a public workflow artifact.
+
+## Rotation and incident response
+
+Revoke the CI token in YNAB Developer Settings and replace the environment secret to rotate it. Remove the secret and disable the live workflow when no longer needed. If a token may have appeared in output or an untrusted runner, revoke it immediately; deleting logs alone is insufficient. No local token is uploaded automatically by this project.

{ynab_api_cli-0.1.0 → ynab_api_cli-0.1.1}/docs/live-testing.md

@@ -25,3 +25,11 @@ Before each mutation, the runner writes a private intent journal. An uncertain o
 Payee-location reads require location fixtures. Direct Import needs a linked bank account; manual test accounts cannot verify actual bank imports. The report lists these gaps and never claims full live coverage when they remain.
 
 No live account connection is provisioned by installing this project. Supply credentials and a designated plan explicitly to run these tests.
+
+## Verified live run, 2026-10-18
+
+An explicitly designated disposable plan passed the real read/write lifecycle run: 43 of 44 operations completed. The run covered accounts, categories, payees, transaction creation and bulk updates, duplicate import IDs, splits, transfers, scheduled transactions, budgeting, and deletion checks. The missing operation was `getPayeeLocationById` because no suitable location fixture existed. The import endpoint completed, but actual bank import remains unverified for manual accounts.
+
+Subsequent reads confirmed that both fixture account balances returned to zero, and the private journal had no unresolved mutation. Reusable accounts, category group, category, and payee remain in the disposable plan. No token, plan UUID, account data, or response bodies are included in this report.
+
+The proposed CI-specific read-only probe also passed 15 selected-plan operations against that plan. See [secure live CI](live-ci.md) before putting credentials on a remote runner. These results do not claim full live coverage.

{ynab_api_cli-0.1.0 → ynab_api_cli-0.1.1}/pyproject.toml

@@ -1,7 +1,8 @@
 [project]
 name = "ynab-api-cli"
-version = "0.1.0"
-description = "Complete contract-driven REST CLI for YNAB"
+version = "0.1.1"
+description = "DEPRECATED: use codapact-ynab. Contract-driven REST CLI for YNAB"
+classifiers = ["Development Status :: 7 - Inactive"]
 readme = "README.md"
 requires-python = ">=3.12"
 dependencies = [
@@ -18,9 +19,9 @@ name = "Mike Hill"
 ynab-api-cli = "ynab_api_cli.__main__:Application.main"
 
 [project.urls]
-Homepage = "https://github.com/mikejhill/ynab-api-cli"
-Repository = "https://github.com/mikejhill/ynab-api-cli"
-Issues = "https://github.com/mikejhill/ynab-api-cli/issues"
+Homepage = "https://github.com/mikejhill/codapact-ynab"
+Repository = "https://github.com/mikejhill/codapact-ynab"
+Issues = "https://github.com/mikejhill/codapact-ynab/issues"
 
 [build-system]
 requires = ["uv_build>=0.11.32,<0.12.0"]

{ynab_api_cli-0.1.0 → ynab_api_cli-0.1.1}/pyproject.toml.orig

@@ -1,7 +1,8 @@
 [project]
 name = "ynab-api-cli"
-version = "0.1.0"
-description = "Complete contract-driven REST CLI for YNAB"
+version = "0.1.1"
+description = "DEPRECATED: use codapact-ynab. Contract-driven REST CLI for YNAB"
+classifiers = ["Development Status :: 7 - Inactive"]
 readme = "README.md"
 authors = [
     { name = "Mike Hill" }
@@ -18,9 +19,9 @@ dependencies = [
 ynab-api-cli = "ynab_api_cli.__main__:Application.main"
 
 [project.urls]
-Homepage = "https://github.com/mikejhill/ynab-api-cli"
-Repository = "https://github.com/mikejhill/ynab-api-cli"
-Issues = "https://github.com/mikejhill/ynab-api-cli/issues"
+Homepage = "https://github.com/mikejhill/codapact-ynab"
+Repository = "https://github.com/mikejhill/codapact-ynab"
+Issues = "https://github.com/mikejhill/codapact-ynab/issues"
 
 [build-system]
 requires = ["uv_build>=0.11.32,<0.12.0"]

ynab_api_cli-0.1.1/src/ynab_api_cli/__init__.py

@@ -0,0 +1,16 @@
+"""Deprecated: use codapact-ynab (https://pypi.org/project/codapact-ynab/)."""
+
+from __future__ import annotations
+
+import sys
+import warnings
+from pathlib import Path
+
+# The console script prints its own notice; warn library importers only.
+if Path(sys.argv[0] if sys.argv else "").stem != "ynab-api-cli":
+    warnings.warn(
+        "ynab-api-cli is deprecated; switch to codapact-ynab "
+        "(import codapact_ynab, command `ynab`): https://pypi.org/project/codapact-ynab/",
+        DeprecationWarning,
+        stacklevel=2,
+    )

{ynab_api_cli-0.1.0 → ynab_api_cli-0.1.1}/src/ynab_api_cli/__main__.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import getpass
+import io
 import json
 import logging
 import shutil
@@ -24,6 +25,12 @@ from ynab_api_cli.types import JsonCodec, JsonValue, RequestValues
 
 logger = logging.getLogger(__name__)
 
+DEPRECATION_NOTICE = (
+    "ynab-api-cli is deprecated and receives no further updates. "
+    "Switch to codapact-ynab: `uv tool install codapact-ynab`, then run `ynab`. "
+    "https://pypi.org/project/codapact-ynab/"
+)
+
 
 class Application:
     """Coordinate connection setup and reviewed typed operation dispatch."""
@@ -38,6 +45,9 @@ class Application:
     @classmethod
     def main(cls, argv: Sequence[str] | None = None) -> None:
         """Run the console entry point and return its documented exit status."""
+        if isinstance(sys.stdout, io.TextIOWrapper):
+            sys.stdout.reconfigure(encoding="utf-8")
+        sys.stderr.write(f"warning: {DEPRECATION_NOTICE}\n")
         sys.exit(cls().run(argv))
 
     def run(self, argv: Sequence[str] | None = None) -> int:

ynab_api_cli-0.1.1/src/ynab_api_cli/ci_live.py

@@ -0,0 +1,74 @@
+"""Run read-only CI probes with temporary credentials and sanitized output."""
+
+from __future__ import annotations
+
+import json
+import logging
+import os
+import sys
+import tempfile
+from collections.abc import MutableMapping
+from pathlib import Path
+from uuid import UUID
+
+import httpx
+
+from ynab_api_cli.config import ConfigStore
+from ynab_api_cli.live import LiveOptions, LiveRunner
+from ynab_api_cli.transport import Connection, Transport
+from ynab_api_cli.types import JsonValue
+
+logger = logging.getLogger(__name__)
+
+
+class Application:
+    """Consume CI secrets once and expose only operation-level test results."""
+
+    @classmethod
+    def main(cls, client: httpx.Client | None = None) -> None:
+        """Run the probe without emitting exception details or API payloads."""
+        logging.basicConfig(level=logging.WARNING)
+        try:
+            report = cls.run(os.environ, client)
+        except KeyboardInterrupt:
+            raise SystemExit(130) from None
+        except Exception:  # noqa: BLE001 - redact unexpected failures at the process boundary.
+            logger.error(  # noqa: TRY400 - tracebacks may expose credentials.
+                "Live CI probe failed; no response or credential details logged."
+            )
+            raise SystemExit(1) from None
+        sys.stdout.write(json.dumps(report, indent=2) + "\n")
+
+    @staticmethod
+    def run(
+        environment: MutableMapping[str, str], client: httpx.Client | None = None
+    ) -> dict[str, JsonValue]:
+        """Use explicit environment secrets and remove private files on all exits."""
+        token = environment.pop("YNAB_ACCESS_TOKEN", "")
+        plan = environment.pop("YNAB_TEST_PLAN_ID", "")
+        connection = Connection(token, str(UUID(plan)))
+        with tempfile.TemporaryDirectory(prefix="ynab-api-cli-live-") as temporary:
+            root = Path(temporary)
+            store = ConfigStore(root / "config")
+            store.configure(connection.token)
+            options = LiveOptions(
+                plan_id=connection.plan_id or "",
+                auth_file=store.root / "auth.json",
+                state_directory=root / "state",
+                enable_writes=False,
+                account_reads=False,
+            )
+            runner = LiveRunner(options, Transport(connection, client=client))
+            result = runner.run()
+        return {
+            "ok": True,
+            "mode": "read-only",
+            "completed_operations": result["completed_operations"],
+            "missing_operations": result["missing_operations"],
+            "gaps": result["gaps"],
+            "complete_live_coverage": False,
+        }
+
+
+if __name__ == "__main__":
+    Application.main()

{ynab_api_cli-0.1.0 → ynab_api_cli-0.1.1}/src/ynab_api_cli/live.py

@@ -30,6 +30,7 @@ class LiveOptions:
     auth_file: Path
     state_directory: Path
     enable_writes: bool
+    account_reads: bool = True
 
 
 class LiveRunner:
@@ -405,6 +406,12 @@ class LiveRunner:
         for operation in self.contract.operations.values():
             if operation.write or operation.identifier in self.completed:
                 continue
+            if not self.options.account_reads and operation.identifier in {
+                "getPlans",
+                "getUser",
+            }:
+                self.gaps.append(operation.identifier + ": account-wide read excluded")
+                continue
             required = {
                 str(param["name"])
                 for param in self.contract.parameters(operation)

ynab_api_cli-0.1.1/tests/test_ci_live.py

@@ -0,0 +1,166 @@
+"""Network-boundary tests for CI confinement, redaction, and credential cleanup."""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+import tempfile
+from enum import StrEnum
+from pathlib import Path
+from uuid import UUID
+
+import httpx
+import pytest
+from tests.support import Server
+
+from ynab_api_cli.ci_live import Application
+from ynab_api_cli.contract import Contract
+from ynab_api_cli.exceptions import AppError
+
+
+class Failure(StrEnum):
+    """Adversarial API outcomes that must not disclose request secrets."""
+
+    NONE = "none"
+    STATUS = "status"
+    MALFORMED = "malformed"
+    NETWORK = "network"
+    UNEXPECTED = "unexpected"
+    PLAN_NAME = "plan-name"
+
+
+class LiveServer:
+    """Serve reviewed response schemas at an observable HTTP boundary."""
+
+    def __init__(self, contract: Contract, *, failure: Failure = Failure.NONE) -> None:
+        self._contract = contract
+        self._failure = failure
+        self.requests: list[httpx.Request] = []
+
+    def handle(self, request: httpx.Request) -> httpx.Response:
+        """Return representative responses or deliberately secret-bearing failures."""
+        self.requests.append(request)
+        secret = request.headers["Authorization"]
+        if self._failure == Failure.STATUS:
+            return httpx.Response(502, json={"detail": secret})
+        if self._failure == Failure.MALFORMED:
+            return httpx.Response(200, text=secret)
+        if self._failure == Failure.NETWORK:
+            raise httpx.ReadTimeout(secret)
+        if self._failure == Failure.UNEXPECTED:
+            raise ValueError(secret)
+        path = request.url.path.removeprefix("/v1")
+        operation = next(
+            item
+            for item in self._contract.operations.values()
+            if item.method == request.method
+            and re.fullmatch(re.sub(r"\{[^}]+\}", "[^/]+", item.path), path)
+        )
+        response = Server(self._contract, operation.identifier).handle(request)
+        if operation.identifier != "getPlanById":
+            return response
+        data = response.json()
+        data["data"]["plan"]["name"] = (
+            "ordinary plan"
+            if self._failure == Failure.PLAN_NAME
+            else "YNAB API CLI TEST synthetic"
+        )
+        return httpx.Response(response.status_code, json=data)
+
+
+class TestApplication:
+    """Exercise real orchestration while replacing only the HTTP boundary."""
+
+    CREDENTIAL = "synthetic-ci-secret-do-not-log"
+    PLAN = str(UUID(int=123))
+
+    def environment(self, monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+        """Supply fake step secrets and confine temporary files to the test."""
+        monkeypatch.setenv("YNAB_ACCESS_TOKEN", self.CREDENTIAL)
+        monkeypatch.setenv("YNAB_TEST_PLAN_ID", self.PLAN)
+        monkeypatch.setattr(tempfile, "tempdir", str(tmp_path))
+
+    def test_read_only_scope_and_summary(
+        self,
+        contract: Contract,
+        monkeypatch: pytest.MonkeyPatch,
+        tmp_path: Path,
+        capsys: pytest.CaptureFixture[str],
+    ) -> None:
+        """CI submits only selected-plan GETs and exports no private record data."""
+        self.environment(monkeypatch, tmp_path)
+        server = LiveServer(contract)
+        with httpx.Client(transport=httpx.MockTransport(server.handle)) as client:
+            Application.main(client)
+
+        output = capsys.readouterr().out
+        report = json.loads(output)
+        assert report["ok"] is True
+        assert report["mode"] == "read-only"
+        assert report["complete_live_coverage"] is False
+        assert "getPlanById" in report["completed_operations"]
+        assert "getPlans" not in report["completed_operations"]
+        assert "getUser" not in report["completed_operations"]
+        assert all(request.method == "GET" for request in server.requests)
+        assert all(
+            request.url.path.startswith("/v1/plans/" + self.PLAN)
+            for request in server.requests
+        )
+        assert self.CREDENTIAL not in output
+        assert self.PLAN not in output
+        assert "YNAB_ACCESS_TOKEN" not in os.environ
+        assert "YNAB_TEST_PLAN_ID" not in os.environ
+        assert not list(tmp_path.rglob("auth.json"))
+        assert not list(tmp_path.iterdir())
+
+    @pytest.mark.parametrize(
+        "failure", [item for item in Failure if item != Failure.NONE]
+    )
+    def test_failure_redaction_and_cleanup(
+        self,
+        monkeypatch: pytest.MonkeyPatch,
+        tmp_path: Path,
+        capsys: pytest.CaptureFixture[str],
+        caplog: pytest.LogCaptureFixture,
+        failure: Failure,
+    ) -> None:
+        """API payloads, nested exception details, and credentials stay out of logs."""
+        self.environment(monkeypatch, tmp_path)
+        server = LiveServer(Contract(), failure=failure)
+        with (
+            httpx.Client(transport=httpx.MockTransport(server.handle)) as client,
+            pytest.raises(SystemExit) as caught,
+        ):
+            Application.main(client)
+
+        captured = capsys.readouterr()
+        assert caught.value.code == 1
+        assert self.CREDENTIAL not in captured.out + captured.err + caplog.text
+        assert self.PLAN not in captured.out + captured.err + caplog.text
+        assert captured.out == ""
+        assert "Live CI probe failed" in caplog.text
+        assert not list(tmp_path.iterdir())
+
+    @pytest.mark.parametrize(
+        ("token", "plan"),
+        [
+            ("", PLAN),
+            ("contains whitespace", PLAN),
+            (CREDENTIAL, ""),
+            (CREDENTIAL, "default"),
+        ],
+    )
+    def test_invalid_settings_prevent_network(
+        self, contract: Contract, token: str, plan: str
+    ) -> None:
+        """Missing secrets, invalid headers, and implicit plan aliases fail locally."""
+        environment = {"YNAB_ACCESS_TOKEN": token, "YNAB_TEST_PLAN_ID": plan}
+        server = LiveServer(contract)
+        with (
+            httpx.Client(transport=httpx.MockTransport(server.handle)) as client,
+            pytest.raises((ValueError, AppError)),
+        ):
+            Application.run(environment, client)
+        assert environment == {}
+        assert server.requests == []

{ynab_api_cli-0.1.0 → ynab_api_cli-0.1.1}/tests/test_cli.py

@@ -4,6 +4,9 @@ from __future__ import annotations
 
 import io
 import json
+import os
+import subprocess
+import sys
 from pathlib import Path
 from unittest.mock import Mock
 
@@ -22,6 +25,28 @@ from ynab_api_cli.transport import Transport
 class TestApplication:
     """Exercise the public process behavior with isolated settings and HTTP."""
 
+    def test_utf8_redirected_output(self, tmp_path: Path) -> None:
+        """A real CLI subprocess emits Unicode JSON through a legacy-encoded pipe."""
+        xdg = tmp_path / "home-\U0001f3e0"
+        store = ConfigStore(xdg / "ynab-api-cli")
+        store.configure("synthetic-subprocess-credential")
+        environment = dict(os.environ)
+        environment.update({"XDG_CONFIG_HOME": str(xdg), "PYTHONIOENCODING": "cp1252"})
+
+        result = subprocess.run(
+            [sys.executable, "-m", "ynab_api_cli", "doctor", "--offline"],
+            cwd=tmp_path,
+            env=environment,
+            capture_output=True,
+            check=False,
+        )
+
+        assert result.returncode == 0
+        report = json.loads(result.stdout.decode("utf-8"))
+        assert report["ok"] is True
+        assert report["api_checked"] is False
+        assert report["directory"] == str(store.root)
+
     @pytest.mark.parametrize(
         "argv",
         [