v2.4.1

First usable release of the 2.4.x line — 2.4.0 was yanked due to a clean-install startup crash (see Fixed below). Install 2.4.1.

Headline change — differentiated CLI exit codes ⚠️ behavior change

Previously every error exited 1. wbox now distinguishes failure classes:

• 1 — validation / user errors and non-auth 4xx (e.g. 404, 422)
• 2 — authentication errors (401 / 403)
• 3 — server errors (5xx)

Click usage errors (unknown flags, missing args) still exit 2, as before. Scripts that branched on a specific non-zero code for auth or server failures should be updated.

Added

• WBOX_DEBUG=1 — print the full traceback to stderr alongside the friendly error message (the mapped exit code is unchanged, so it's safe in scripts).
• Documented the existing WBOX_BRIEF / --brief output mode (strips *_html duplicate fields to cut response size).

Fixed (2.4.1)

• Startup crash (ModuleNotFoundError: No module named 'click') on clean installs that lack click. The import click in cli/_factory.py (used only in annotations) is now guarded by TYPE_CHECKING. This regression is why 2.4.0 was yanked.

Security

• Token config file and rate-limit state file are written with 0600 permissions on POSIX.
• Malformed Retry-After response headers are truncated before logging.

Internal

• src/ is now mypy --strict clean (0 errors, 0 ignores). New typecheck and smoke (clean-install, no dev deps) CI jobs gate publish.
• Windows CI test leg (3.12); coverage floor (--cov-fail-under=91); changelog/version consistency gate; Dependabot; .pre-commit-config.yaml.
• cli/_util.py split into _client/_format/_resolve/_factory; six resource command groups now generate from a shared factory (contacts stays hand-written). No change to the CLI surface.

Full changelog: https://github.com/massive-value/wealthbox-cli/blob/main/CHANGELOG.md

Binaries built by release-binaries.yml; PyPI wheel published by ci.yml.