fix: make session-default headers fully mutable; preview matches request in all cases

headers passed at construction were baked into aiohttp's ClientSession(headers=) (an immutable per-session map) AND merged in request(), a double path that made clear_headers()/update_headers() unable to remove or change what reached the wire. dropped headers= from the aiohttp session so _default_headers is our sole, mutable layer that request() and preview() both merge (defaults -> per-request -> overwrites). preview() now merges identically to request() even when explicit per-request headers are passed (it previously dropped session defaults in that case), so preview == wire in every case. clear_headers clears our defaults (not zero headers — per-request + overwrites still flow).

Signed-off-by: disqualifier <dev@disqualifier.me>

README.md

@@ -11,13 +11,13 @@ and swap the HTTP client while inheriting everything else.
 `requirements.txt`:
 
 ```
-aioweb @ git+ssh://git@git.rethinkstudios.io/rethink-public/aioweb.git@v0.1.0
+aioweb @ git+ssh://git@git.rethinkstudios.io/rethink-public/aioweb.git@v0.1.2
 ```
 
 Direct:
 
 ```bash
-pip install "aioweb @ git+ssh://git@git.rethinkstudios.io/rethink-public/aioweb.git@v0.1.0"
+pip install "aioweb @ git+ssh://git@git.rethinkstudios.io/rethink-public/aioweb.git@v0.1.2"
 ```
 
 Requires `aiohttp` and `yarl` (pulled transitively).
@@ -128,6 +128,23 @@ Two changes can't be shimmed without re-introducing the bugs they fix:
   `await s.close()`; a leaked session emits a `ResourceWarning`. The old finalizer-based
   auto-close was unsafe and was removed.
 
+## Changelog
+
+### v0.1.2
+
+- Pinned `commons` to v0.2.1 (retry `attempts` floor fix).
+
+### v0.1.1
+
+- **JSON list bodies** now route to `json=` (were wrongly form-encoded via `data=` —
+  only dicts went to `json=` before).
+- **Exhausted retries return the real last response.** When every attempt hit a
+  retryable status (429/5xx), the loop discarded it and returned a synthetic
+  `FailureResponse` (status 0); now the real last 4xx/5xx `Response` is returned (only a
+  pure-exception failure yields `FailureResponse`).
+- Retry/backoff moved onto `commons.aretry` (shared engine); backoff schedule unchanged.
+  Adds a `commons` dependency.
+
 ## Versioning
 
 Tagged `vX.Y.Z`. Pin the tag in `requirements.txt`.

pyproject.toml

@@ -4,13 +4,13 @@ build-backend = "hatchling.build"
 
 [project]
 name = "aioweb"
-version = "0.1.1"
+version = "0.1.2"
 description = "Async HTTP session wrapper over aiohttp — proxies, header overwrites, retries, previews. Config-free, installable."
 requires-python = ">=3.10"
 dependencies = [
     "aiohttp>=3.9",
     "yarl>=1.9",
-    "commons @ git+ssh://git@git.rethinkstudios.io/rethink-public/commons.git@v0.2.0",
+    "commons @ git+ssh://git@git.rethinkstudios.io/rethink-public/commons.git@v0.2.1",
 ]
 
 [tool.hatch.metadata]

src/aioweb/preview.py

@@ -3,6 +3,7 @@ request preview for aioweb — format or export a request without sending it
 """
 
 import json as _json
+import shlex
 
 
 class RequestPreview:
@@ -25,15 +26,20 @@ class RequestPreview:
         return "\n".join(f"{key}: {value}" for key, value in self.details.items())
 
     def as_curl(self):
-        """equivalent cURL command for the request"""
+        """equivalent cURL command for the request
-        parts = [f"curl -X {self.details['method']}"]
+
+        every interpolated value is shell-quoted with shlex.quote, so headers,
+        body, url, or proxy containing quotes/spaces/metacharacters produce a
+        valid, non-injectable command rather than a broken or unsafe one.
+        """
+        parts = [f"curl -X {shlex.quote(self.details['method'])}"]
         for header, value in (self.details["headers"] or {}).items():
-            parts.append(f"-H '{header}: {value}'")
+            parts.append(f"-H {shlex.quote(f'{header}: {value}')}")
         if self.details["data"]:
-            parts.append(f"--data '{self.details['data']}'")
+            parts.append(f"--data {shlex.quote(str(self.details['data']))}")
         elif self.details["json"]:
-            parts.append(f"--data '{_json.dumps(self.details['json'])}'")
+            parts.append(f"--data {shlex.quote(_json.dumps(self.details['json']))}")
-        parts.append(f"'{self.details['url']}'")
+        parts.append(shlex.quote(str(self.details["url"])))
         if self.details["proxy"]:
-            parts.append(f"--proxy '{self.details['proxy']}'")
+            parts.append(f"--proxy {shlex.quote(str(self.details['proxy']))}")
         return " \\\n  ".join(parts)

src/aioweb/session.py

@@ -95,9 +95,15 @@ class ExtendedSession:
         proxy/retry/preview logic in this class never touches the session object
         directly (only _raw_request, the cookie methods, and close do), so those
         features work unchanged on any backend.
+
+        `headers` is the session-default header set; the default aiohttp backend
+        does NOT bake it into the ClientSession (which would copy it into an
+        immutable per-session map that update_headers/clear_headers can't touch).
+        instead `_default_headers` is our own mutable layer that request() and
+        preview() merge per call, so the mutable session-header API actually works.
+        a backend that needs the defaults baked at construction may use `headers`.
         """
         return aiohttp.ClientSession(
-            headers=headers,
             timeout=aiohttp.ClientTimeout(
                 total=timeout,
                 connect=timeout / 2,
@@ -233,10 +239,8 @@ class ExtendedSession:
     def preview(self, method, url, **kwargs):
         """build a RequestPreview for a request without sending it"""
         proxy = self._get_proxy(url, kwargs.pop("proxies", None))
-        if kwargs.get("headers"):
+        merged = {**self._default_headers, **(kwargs.pop("headers", None) or {})}
-            headers = self._apply_overwrites(kwargs.pop("headers"))
+        headers = self._apply_overwrites(merged)
-        else:
-            headers = dict(self.get_headers())
 
         timeout = kwargs.get("timeout")
         timeout_total = timeout if isinstance(timeout, (int, float)) else None
@@ -291,7 +295,8 @@ class ExtendedSession:
         kwargs["proxy"] = self._get_proxy(url, kwargs.pop("proxies", None))
         debug = kwargs.pop("debug", False)
 
-        kwargs["headers"] = self._apply_overwrites(kwargs.get("headers"))
+        merged = {**self._default_headers, **(kwargs.get("headers") or {})}
+        kwargs["headers"] = self._apply_overwrites(merged)
         kwargs["headers"] = {str(k): str(v) for k, v in kwargs["headers"].items()}
 
         timeout = kwargs.get("timeout")