fix: use resolved config path in warning/error messages and patch build_opener in no-network test

Agent-Logs-Url: https://github.com/github/spec-kit/sessions/86df9557-54f1-4fe4-a25f-9501cb2356cf

Co-authored-by: mnriem <15701806+mnriem@users.noreply.github.com>

Author: Copilot

src/specify_cli/__init__.py

@@ -1721,6 +1721,7 @@ def _fetch_latest_release_tag() -> tuple[str | None, str | None]:
     On anything else — including a malformed response body — the exception
     propagates; there is no catch-all (research D-006).
     """
+    from .authentication.config import _default_config_path as _auth_config_path
     from .authentication.http import open_url
 
     try:
@@ -1737,7 +1738,9 @@ def _fetch_latest_release_tag() -> tuple[str | None, str | None]:
     except urllib.error.HTTPError as e:
         # Order matters: HTTPError is a subclass of URLError.
         if e.code == 403:
-            return None, "rate limited (try setting GH_TOKEN and configuring ~/.specify/auth.json)"
+            return None, (
+                f"rate limited (configure {_auth_config_path()} with a GitHub token)"
+            )
         return None, f"HTTP {e.code}"
     except (urllib.error.URLError, OSError):
         return None, "offline or timeout"

src/specify_cli/authentication/http.py

@@ -17,7 +17,7 @@
 from urllib.parse import urlparse
 
 from . import get_provider
-from .config import AuthConfigEntry, find_entries_for_url, load_auth_config
+from .config import AuthConfigEntry, _default_config_path, find_entries_for_url, load_auth_config
 
 
 _config_override: list[AuthConfigEntry] | None = None
@@ -31,8 +31,9 @@ def _load_config() -> list[AuthConfigEntry]:
         return load_auth_config()
     except (ValueError, OSError) as exc:
         import warnings
+        config_path = _default_config_path()
         warnings.warn(
-            f"Failed to load ~/.specify/auth.json: {exc}. "
+            f"Failed to load {config_path}: {exc}. "
             "All requests will be unauthenticated.",
             UserWarning,
             stacklevel=2,

tests/test_upgrade.py

@@ -23,6 +23,7 @@
     _normalize_tag,
     app,
 )
+from specify_cli.authentication.config import _default_config_path
 
 from tests.conftest import strip_ansi
 
@@ -31,6 +32,10 @@
 SENTINEL_GH_TOKEN = "SENTINEL-GH-TOKEN-VALUE"
 SENTINEL_GITHUB_TOKEN = "SENTINEL-GITHUB-TOKEN-VALUE"
 
+_RATE_LIMITED_REASON = (
+    f"rate limited (configure {_default_config_path()} with a GitHub token)"
+)
+
 
 def _mock_urlopen_response(payload: dict) -> MagicMock:
     body = json.dumps(payload).encode("utf-8")
@@ -66,11 +71,20 @@ def test_prints_exactly_three_lines_and_exits_zero(self):
         ]
 
     def test_stub_makes_no_network_call(self):
-        # If the stub ever starts calling urllib, this patch's side_effect
-        # would fire and the assertion below would fail.
-        with patch(
-            "specify_cli.authentication.http.urllib.request.urlopen",
-            side_effect=AssertionError("stub must not hit the network"),
+        # The stub must not hit the network via either urllib path:
+        # unauthenticated requests use urlopen() directly; authenticated ones
+        # go through build_opener(...).open().  Both are patched so that any
+        # accidental network call raises immediately.
+        network_error = AssertionError("stub must not hit the network")
+        with (
+            patch(
+                "specify_cli.authentication.http.urllib.request.urlopen",
+                side_effect=network_error,
+            ),
+            patch(
+                "specify_cli.authentication.http.urllib.request.build_opener",
+                side_effect=network_error,
+            ),
         ):
             result = runner.invoke(app, ["self", "upgrade"])
         assert result.exit_code == 0
@@ -223,7 +237,7 @@ def test_403_maps_to_rate_limited(self):
         ):
             tag, reason = _fetch_latest_release_tag()
         assert tag is None
-        assert reason == "rate limited (try setting GH_TOKEN and configuring ~/.specify/auth.json)"
+        assert reason == _RATE_LIMITED_REASON
 
     @pytest.mark.parametrize("code", [404, 500, 502])
     def test_other_http_uses_code_string(self, code):
@@ -247,7 +261,7 @@ def test_generic_exception_propagates(self):
 
 _FAILURE_CASES = [
     ("offline or timeout", urllib.error.URLError("down")),
-    ("rate limited (try setting GH_TOKEN and configuring ~/.specify/auth.json)", _http_error(403)),
+    (_RATE_LIMITED_REASON, _http_error(403)),
     ("HTTP 500", _http_error(500)),
 ]
 
@@ -263,9 +277,8 @@ def test_failure_prints_installed_plus_one_line_reason(
             result = runner.invoke(app, ["self", "check"])
         output = strip_ansi(result.output)
         assert "Installed: 0.7.4" in output
-        if expected_reason == "rate limited (try setting GH_TOKEN and configuring ~/.specify/auth.json)":
+        if expected_reason == _RATE_LIMITED_REASON:
             assert "Could not check latest release: rate limited" in output
-            assert "GH_TOKEN" in output
             assert "auth.json" in output
         else:
             assert f"Could not check latest release: {expected_reason}" in output