The HTTP access log (log_message) and the --log-requests REQUEST/RESPONSE
lines wrote to the rebindable sys.stderr, so a concurrent card-free request
(the 2s /api/status poll) dropped its log line into the StringIO a card
command was capturing - corrupting file content read during a snapshot scan
(the access-log line appeared inside the file hex).
- Add _log_stderr(): write the request/access log to fd 2 directly (the same
bypass the APDU tracer already uses), so it can never enter a capture.
Route log_message, _log_req and _log_resp through it.
- Add _capture_app_output() context manager and deduplicate the six handlers
(cardinfo/command/help/read/write/tree) that did the inline
app.stdout/sys.stderr = out save/restore dance.
Bumps VERSION to 3.40.5 and the SW cache to simple-v491.
catarrh
011de4ae82