Authentication fixes
I fixed three reported authentication bugs:
- #379: We now accept negative Google session IDs in the browser transport and the page fallback.
- #380: We now recognize Google's signed-out landing page when Google returns HTTP 200 and tell users their session has expired.
- #381: We now reject stale cookies copied from the legacy root cache when the saved default profile has different credentials. Fresh login credentials can still update both stores.
I verified repeated live notebook listing through HTTP and the browser transport, authenticated page refresh, and signed-out error reporting. I also confirmed that working credentials still succeed after a rejected stale-cache overwrite in isolated storage. Google supplied a positive live session ID, so I verified negative IDs with regression tests.
Thanks @alexchaifu-ship-it for #379, and @bradmarshall987 for the detailed reports and reproductions in #380 and #381.
Validation
- 2,549 local tests passed, 40 skipped, and 1 deselected.
- Ruff lint and formatting checks passed.
- All five release version declarations match 0.15.8.
- Built the Python wheel, source package, and desktop extension.
- GitHub CI passed on Windows and Linux, including lint and version alignment.