Fix token file permissions, 4xx error queueing, and heartbeat silent failure

Author: PunchPlay

script.punchplay/api.py

@@ -54,7 +54,8 @@ def _get_or_create_device_id(self) -> str:
             if device_id:
                 return device_id
         device_id = str(uuid.uuid4())
-        with open(self._device_id_file, "w") as f:
+        fd = os.open(self._device_id_file, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+        with os.fdopen(fd, "w") as f:
             f.write(device_id)
         return device_id
 
@@ -69,7 +70,8 @@ def _load_tokens(self) -> dict[str, str]:
 
     def _save_tokens(self, tokens: dict[str, str]) -> None:
         self._tokens = tokens
-        with open(self._token_file, "w") as f:
+        fd = os.open(self._token_file, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+        with os.fdopen(fd, "w") as f:
             json.dump(tokens, f, indent=2)
 
     def _headers(self) -> dict[str, str]:
@@ -168,11 +170,19 @@ def post(self, path: str, payload: dict[str, Any]) -> dict[str, Any] | None:
                 self._cache.enqueue_scrobble(path, payload)
             return None
         except urllib.error.HTTPError as exc:
-            xbmc.log(
-                f"[PunchPlay] HTTP {exc.code} on {path} — queuing", xbmc.LOGWARNING
-            )
-            if self._cache is not None:
-                self._cache.enqueue_scrobble(path, payload)
+            if 500 <= exc.code < 600:
+                # Transient server error — queue for retry.
+                xbmc.log(
+                    f"[PunchPlay] HTTP {exc.code} on {path} — queuing", xbmc.LOGWARNING
+                )
+                if self._cache is not None:
+                    self._cache.enqueue_scrobble(path, payload)
+            else:
+                # Permanent client error (4xx) — drop, retrying won't help.
+                xbmc.log(
+                    f"[PunchPlay] HTTP {exc.code} on {path} — dropping (permanent error)",
+                    xbmc.LOGWARNING,
+                )
             return None
 
     # ------------------------------------------------------------------

script.punchplay/player.py

@@ -168,7 +168,12 @@ def _heartbeat_loop(self) -> None:
                 self._api.post("/api/scrobble/progress", payload)
 
             except Exception as exc:
-                xbmc.log(f"[PunchPlay] Heartbeat error: {exc}", xbmc.LOGDEBUG)
+                xbmc.log(f"[PunchPlay] Heartbeat error: {exc}", xbmc.LOGWARNING)
+                # If the player is no longer valid, stop the heartbeat loop
+                # rather than spinning silently.
+                if not self.isPlayingVideo():
+                    xbmc.log("[PunchPlay] Heartbeat stopping — player no longer active", xbmc.LOGINFO)
+                    return
 
     # ------------------------------------------------------------------
     # Playback events