Nytimes-games

Fixed

- Source distributions include the whole test tree (`tests/__init__.py`,
`support.py`, `conftest.py` and the fixtures), the scripts the tests load,
and the docs and contributor files, so an extracted sdist runs its own
offline tests. CI and the publish workflow check that with
`scripts/check_sdist.sh`, which builds a wheel from the extracted sdist
and runs its tests away from the checkout. (66)
- A `Retry-After` longer than 60 seconds is no longer cut short. The client
waits as long as NYT asks, up to 5 minutes; for a longer wait it raises
the error at once instead of retrying early, with
`NYTGamesRateLimitError.retry_after` set. The exponential backoff is still
capped at 60 seconds, and a `Retry-After` that isn't a finite number of
seconds or a date is ignored. (64)

- `nytg archive --overwrite` keeps the saved puzzle if writing its update
fails. It used to move the file into `revisions/` first, so a failed write
left it missing; now the old file is copied to `revisions/` and replaced
only once the new one is completely written. `manifest.json` is written
the same way, so an interrupted run leaves the previous complete manifest.
A file that's on disk but missing from the manifest, as after an
interrupted run, is added to the manifest as it is the next time. (61)
- Saving `config.ini`, which holds your cookies, is atomic. It used to be
truncated and rewritten in place, so a failed or interrupted save could
lose your profiles. The new contents go to a private (0600) temporary file
that replaces the config only once complete, and the config stays 0600
even if it had been made readable by others. `active_profile` is written
atomically too. (68)
- Crossword exports with your saved progress skip saved entries that don't
name a square of the grid. A negative index used to fill a square from the
end (`-1` filled the last one), and a large negative or non-numeric one
raised `IndexError` or `ValueError`. Revealed and penciled squares are
checked the same way. (67)

Fixed

- The temporary file used to replace a file with `overwrite` is private
(0600) from the moment it's created. In 0.11.3 it started out readable
under your umask and was made private just before the data was written,
so a reader that opened it in that moment could still read the data. A
new file's permissions now come from an empty file created and removed
to find what your umask allows. (56)

Fixed

- When a crossword export or `nytg ... --save` replaced a file with
`overwrite`, the new content sat in a temporary file readable under your
umask (often 0644) until it was moved into place, even when the file being
replaced was private. The temporary file is now private (0600) while it
holds the data; the final file's permissions are unchanged. (56)

Fixed

- `NYTGamesParseError` messages no longer include dictionary keys taken from
NYT's response, which could be private too. Field paths keep the models'
own field names and list indexes, and show anything else as `*`, as in
`average.*: float_type`. (44)
- A crossword exported with `overwrite` (or saved with `nytg ... --save`) to
a new file got 0644 permissions even under a stricter umask, such as 077.
New files now get the permissions your umask allows with or without
`overwrite`, and a replaced file keeps its own. (46)

Fixed

- The `mcp` and `cli` extras install `tzdata` on every platform. Without a
system time zone database (Windows, slim containers), `nytg-mcp` failed to
start and `nytg` failed on Linux, with `ZoneInfoNotFoundError`. CI now
installs each extra alone, on Linux and Windows, and checks New York time
without a system database. (47)
- The REST API passes only the `NYT-S` login cookie on to NYT. It used to
forward every cookie sent to it, so mounted in an app with its own session
cookie, it sent that cookie to NYT too. A cookie that can't be sent is now
a 400 instead of a 500. If you relied on other cookies reaching NYT,
override `get_client`. (45)
- The MCP server's `export_crossword` never replaces a file unless
`overwrite` is set. It checked for the file before fetching the puzzle, so
a file created in the meantime was overwritten anyway; the file is now
created exclusively, and symlinks are never followed. With `overwrite`,
the new file is written next to the old one and moved into place, so a
failed write keeps the old file. `nytg ... --save` replaces files the same
way. (46)
- `export_crossword` is marked destructive in its MCP annotations, since
`overwrite` replaces files. (46)
- A response from NYT that's valid JSON but the wrong shape raises
`NYTGamesParseError`, as documented. It used to escape as Pydantic's
`ValidationError` or a `TypeError`, so the REST API answered 500 instead
of 502. If you caught those, catch `NYTGamesParseError` (a `ValueError`)
instead. (44)
- Errors never include NYT's response values, which can be your saved games.
`NYTGamesParseError` names the model, fields and error types only; the
models hide input values in validation errors; and the MCP server, CLI and
live check report these errors without them. The live check reports other
unexpected errors by type and location only, since its failures are
published in GitHub issues. (44)

Changed

- **Breaking:** both clients now use [httpx](https://www.python-httpx.org/),
and `requests` and `urllib3` are no longer dependencies. The HTTP layer
matches atlantic-games's:
- `NYTGamesClient(session=...)` is now `NYTGamesClient(http_client=...)`
and takes an `httpx.Client`. As before, your client is used as is and not
closed, but the client's retries now apply to it too.
- The `NYTGamesClient.session` and `AsyncNYTGamesClient.http_client`
attributes are gone; keep a reference to the client you pass in if you
need it.
- `NYTGamesHTTPError` no longer subclasses `requests.HTTPError`. It has
`.status_code`, and `.response` is an `httpx.Response`. Catch
`NYTGamesHTTPError` instead of `requests.HTTPError`, and
`httpx.HTTPError` instead of `requests.RequestException` for connection
errors.
- Error messages read `HTTP 404 for <url>`.
- `NYTGamesClient` has `close()` and works as a context manager, like
`AsyncNYTGamesClient`.
- The `async` extra is no longer needed, since httpx is a core dependency.
It's kept, empty, so existing installs still work.

Fixed

- The REST API closes its NYT client after each request instead of leaving
the connection pool to garbage collection.
- The nightly live check expected 32 dailies in December 2022, but NYT no
longer serves 2022-12-31's Supermega. It now checks that two months of
dailies, more than one request's worth, come back with none dropped.