main() is one call into internal/cli (closes #160)

cmd/netwatch-server/main.go parsed the command line, ran the check-cidr
and prepare-data-dir subcommands and built the fx application itself;
the Go style guide puts all of that in internal/ or pkg/. The new
package internal/cli does it, with the same arguments, messages and
exit codes. main() is now os.Exit(cli.Main(os.Stderr, Appname, Version,
os.Args[1:], cli.RunServer)): Main takes the writer for errors and the
function that runs the server, so its tests give it a buffer and a
function that fails them. Appname and Version stay in main, where the
build sets Version. The function behind prepare-data-dir also takes the
volume and the user's name, so its own tests give it a temporary
directory and the user they run as.

Model: opus-5-5

.dockerignore

@@ -73,12 +73,9 @@
 
 # This repository's own entries, after the shared content above: the
 # frontend build, the viewport test's output, the binary `make build`
-# writes and the reports `make run` stores, and Go test binaries,
-# coverage output and log files at the root.
+# writes and the reports `make run` stores, and log files at the root.
 /dist
 /tmp
 /netwatch-server
 /data
-/*.test
-/*.out
 /*.log

.editorconfig

@@ -11,8 +11,7 @@ insert_final_newline = true
 [Makefile]
 indent_style = tab
 
+# This repository's own entries, after the shared content above.
+
 [*.go]
 indent_style = tab
-
-# This repository's own sections, such as one for another language it
-# uses, go below this comment, and a re-vendor keeps them.

.gitignore

@@ -27,7 +27,7 @@ node_modules/
 # Environment files. `*.env` covers bare `.env` and the `prod.env`
 # convention. Only the templates `example.env` and `sample.env` are
 # re-included below. A repository that commits any other template adds
-# its own negation at the end of this file, for example `!.env.example`.
+# its own negation after these lines, for example `!.env.example`.
 *.[eE][nN][vV]
 .[eE][nN][vV].*
 .[eE][nN][vV][rR][cC]
@@ -46,9 +46,7 @@ node_modules/
 [iI][dD]_[eE][dD]25519
 [iI][dD]_[eE][dD]25519_[sS][kK]
 
-# This repository's own entries, such as its build outputs, go below
-# this comment, and a re-vendor keeps them. Anchor a binary built at the
-# root: `/myapp`, never `myapp`, which also ignores `cmd/myapp/`.
+# This repository's own entries, after the shared content above.
 
 # Build output
 dist/

.golangci.yml

@@ -25,8 +25,6 @@ linters:
     # silenced by disabling that name, not by enabling the successor.
     - wsl              # Deprecated, replaced by wsl_v5
     - gomodguard       # Deprecated, replaced by gomodguard_v2
-    # Misses findings at random in v2.14.0; back once a pinned release fixes it
-    - canonicalheader
   settings:
     lll:
       line-length: 88

README.md

@@ -55,8 +55,7 @@ either one is broken. We provide:
 - `script/build` — build the frontend for production into `dist/`, then the
   static `netwatch-server` binary into the repo root with its version stamped
   in: `VERSION` from the environment, or when that is unset or empty,
-  `git describe --tags --always --dirty` inside a git checkout, as
-  `script/docker` does, then `dev`
+  `git describe` inside a git checkout, then `dev`
 - `script/run` — build with `script/build`, then run `netwatch-server` with its
   defaults (see [Settings](#settings))
 - `script/clean` — remove what `script/build` writes
@@ -220,8 +219,7 @@ packages are in `internal/`:
 
 - **`cli`**: Runs `netwatch-server` from its command line: the `check-cidr` and
   `prepare-data-dir` subcommands, which `bin/entrypoint.sh` runs before it
-  starts the server, and, given no arguments, the server, with the `fx` wiring.
-  It refuses any other arguments with a usage message and exit code 2.
+  starts the server, and otherwise the server, with the `fx` wiring.
 - **`config`**: Loads configuration from environment variables and config files
   via Viper.
 - **`handlers`**: HTTP request handlers for the API (health check, report

TODO.md

@@ -9,12 +9,11 @@
 
 # Status
 
-pre-1.0. Release candidates are tagged on `next`, the first being `v1.0.0-rc1`;
-`git tag --merged origin/next` lists them. `main` is the stable branch and
-`next` the development branch, which every PR targets. The frontend and the Go
-backend ship as one Docker image, and the Gitea workflow
-`.gitea/workflows/check.yml` runs `script/cibuild` on every push, and cancels
-the older run on the same branch. Working toward 1.0.0.
+pre-1.0. No git tags. `main` is the stable branch and `next` the development
+branch, which every PR targets. The frontend and the Go backend ship as one
+Docker image, and the Gitea workflow `.gitea/workflows/check.yml` runs
+`script/cibuild` on every push, and cancels the older run on the same branch.
+Working toward 1.0.0.
 
 # Next Step
 
@@ -23,36 +22,6 @@ Run `make frontend-viewport-test` in CI as its own step; it is not part of
 
 # Completed Steps
 
-- 2026-10-19: the server's `OnStart` hook in `internal/server/server.go` starts
-  `listenAndServe` with `go func() { s.listenAndServe() }()`, as the Go style
-  guide asks ([#162](https://git.eeqj.de/sneak/netwatch/issues/162)); it was
-  `go s.listenAndServe()`. No other `go` statement in the Go code called a
-  function directly. Nothing the server does changed
-- 2026-10-19: `.gitignore`, `.editorconfig` and `.golangci.yml` are the
-  sneak/prompts copies at `0653579`
-  ([#174](https://git.eeqj.de/sneak/netwatch/issues/174)). `.gitignore` is the
-  standard file followed by this repository's own entries; `.editorconfig` is
-  the standard file alone, which now carries the `[*.go]` section.
-  `.golangci.yml` disables `canonicalheader`, as the canonical copy does,
-  because golangci-lint v2.14.0 misses its findings at random
-- 2026-10-19: `package.json` has no `version` field and is marked
-  `"private": true` ([#158](https://git.eeqj.de/sneak/netwatch/issues/158)). It
-  said `1.0.0`, a release that has not been made, and nothing read it; the git
-  tag is the one version, which the image and `make build` take from
-  `git describe --tags`. The package is never published
-- 2026-10-19: Status names `v1.0.0-rc1`, the first release candidate, and says
-  release candidates are tagged on `next`, where it said there were no git tags
-  ([#157](https://git.eeqj.de/sneak/netwatch/issues/157)). The rest of Status
-  matches the tree
-- 2026-10-19: `netwatch-server` starts the server only when given no arguments
-  ([#179](https://git.eeqj.de/sneak/netwatch/issues/179)). `check-cidr CIDR` and
-  `prepare-data-dir DATA_DIR` behave as before; any other arguments, such as a
-  subcommand with no value or two, or a misspelt one, print a one-line usage
-  message naming both forms to stderr and exit 2. They used to start the server.
-  Unit tests call `cli.Main` with no arguments and check that it starts the
-  server, and with each subcommand given no value and two values and with a
-  misspelt subcommand, and check the exit code, the message and that the server
-  does not start
 - 2026-10-19: `main()` in `cmd/netwatch-server/main.go` is one call into a new
   package, `internal/cli`, as the Go style guide asks
   ([#160](https://git.eeqj.de/sneak/netwatch/issues/160)). `internal/cli` runs
@@ -67,20 +36,6 @@ Run `make frontend-viewport-test` in CI as its own step; it is not part of
   the error from looking up the `netwatch` user, which the test image does not
   have. Others give the functions behind the subcommands input they take and
   input they refuse, and check the exit code and what they write to stderr
-- 2026-10-19: when `VERSION` is unset or empty, `script/build` stamps the
-  version from `git describe --tags --always --dirty`, as `script/docker` does
-  ([#156](https://git.eeqj.de/sneak/netwatch/issues/156)). Without `--tags` it
-  skipped lightweight tags, so `make run` could report a commit where the image
-  built from the same tree reported the tag. Checked once with a lightweight tag
-  on a scratch clone: `make build` stamped it
-- 2026-10-19: `.dockerignore` keeps Go test binaries and coverage output at the
-  root out of the build context, with `/*.test` and `/*.out` in the repository's
-  own section ([#155](https://git.eeqj.de/sneak/netwatch/issues/155)). Such
-  files went into the build context of every `docker build` in `script/` and
-  were copied into the lint, test and build stages. Checked with a probe image
-  that copies the whole context: `x.test` and `x.out` planted at the root no
-  longer land in it, and nothing else changed. The entries match only at the
-  root, so the same files in a subdirectory still reach the image
 - 2026-10-19: `.gitea/workflows/check.yml` is the sneak/prompts copy at
   `0653579` ([#153](https://git.eeqj.de/sneak/netwatch/issues/153)). Its
   checkout step sets `fetch-depth: 0`, so CI clones all history and tags, and

internal/cli/cli.go

@@ -1,7 +1,7 @@
 // Package cli runs netwatch-server from its command line: the
 // check-cidr and prepare-data-dir subcommands, which bin/entrypoint.sh
-// runs before it starts the server, and, given no arguments, the
-// server, with the fx wiring.
+// runs before it starts the server, and otherwise the server, with the
+// fx wiring.
 package cli
 
 import (
@@ -22,21 +22,16 @@ import (
 	"go.uber.org/fx/fxevent"
 )
 
-// usageExitCode is what Main returns for a command line it does not
-// understand, the usual exit code for a usage error.
-const usageExitCode = 2
-
 // Main runs netwatch-server with args, its command line after the
-// program's name, and returns the exit code. With no args, Main runs
-// the server by calling serve with appname and version, the name and
-// version the server logs and reports. With "check-cidr CIDR" or
-// "prepare-data-dir DATA_DIR" it runs that subcommand, which writes its
-// errors to stderr. Any other args get a one-line usage message on
-// stderr and exit code 2. main passes os.Stderr and RunServer; the
-// tests pass a buffer and a function of their own, so that no test
-// starts the server. When serve is RunServer and the server fails to
-// start, to listen or to stop, fx's Run exits the process with status 1
-// and Main never returns.
+// program's name, and returns the exit code; the subcommands write
+// their errors to stderr. Unless args are "check-cidr CIDR" or
+// "prepare-data-dir DATA_DIR", Main runs the server by calling serve
+// with appname and version, the name and version the server logs and
+// reports. main passes os.Stderr and RunServer; the tests pass a
+// buffer and a function that fails them, so that no test starts the
+// server. When serve is RunServer and the server fails to start, to
+// listen or to stop, fx's Run exits the process with status 1 and Main
+// never returns.
 func Main(
 	stderr io.Writer,
 	appname, version string,
@@ -58,15 +53,6 @@ func Main(
 		return prepareDataDir(stderr, "/data", args[1], "netwatch")
 	}
 
-	// Any other command line is refused, so that a mistyped one does
-	// not start the server.
-	if len(args) > 0 {
-		_, _ = fmt.Fprintln(stderr,
-			"usage: netwatch-server [check-cidr CIDR | prepare-data-dir DATA_DIR]")
-
-		return usageExitCode
-	}
-
 	serve(appname, version)
 
 	return 0

internal/cli/cli_test.go

@@ -61,61 +61,6 @@ func TestMainRunsPrepareDataDir(t *testing.T) {
 	}
 }
 
-// TestMainRunsServerWithNoArguments: Main given no arguments starts the
-// server with the name and version it was given, writes nothing and
-// returns 0.
-func TestMainRunsServerWithNoArguments(t *testing.T) {
-	t.Parallel()
-
-	var (
-		stderr                 bytes.Buffer
-		gotAppname, gotVersion string
-	)
-
-	code := cli.Main(&stderr, "netwatch", "test", []string{},
-		func(appname, version string) {
-			gotAppname, gotVersion = appname, version
-		})
-	if code != 0 || stderr.Len() != 0 {
-		t.Errorf("exit %d, stderr %q; want exit 0 and no output",
-			code, stderr.String())
-	}
-
-	if gotAppname != "netwatch" || gotVersion != "test" {
-		t.Errorf("server started with %q %q; want %q %q",
-			gotAppname, gotVersion, "netwatch", "test")
-	}
-}
-
-// TestMainRefusesOtherCommandLines: Main given a subcommand with too
-// few or too many values, or a misspelt subcommand, writes the usage
-// message to stderr, returns 2 and does not start the server.
-func TestMainRefusesOtherCommandLines(t *testing.T) {
-	t.Parallel()
-
-	want := "usage: netwatch-server " +
-		"[check-cidr CIDR | prepare-data-dir DATA_DIR]\n"
-
-	for _, commandLine := range []string{
-		"netwatch-server check-cidr",
-		"netwatch-server check-cidr 192.0.2.0/24 198.51.100.0/24",
-		"netwatch-server prepare-data-dir",
-		"netwatch-server prepare-data-dir /data/reports /data/other",
-		"netwatch-server check-cdir 192.0.2.0/24",
-	} {
-		var stderr bytes.Buffer
-
-		// Main takes the command line after the program's name.
-		args := strings.Fields(commandLine)[1:]
-
-		code := cli.Main(&stderr, "netwatch", "test", args, failIfServerStarts(t))
-		if code != 2 || stderr.String() != want {
-			t.Errorf("%q: exit %d, stderr %q; want exit 2 and %q",
-				commandLine, code, stderr.String(), want)
-		}
-	}
-}
-
 // TestCheckCIDRTakesCIDR: check-cidr exits 0, writing nothing, for a
 // CIDR the server takes in its TRUSTED_PROXIES.
 func TestCheckCIDRTakesCIDR(t *testing.T) {

internal/server/server.go

@@ -79,7 +79,7 @@ func New(
 			s.SetupRoutes()
 			s.httpServer = s.newHTTPServer()
 
-			go func() { s.listenAndServe() }()
+			go s.listenAndServe()
 
 			return nil
 		},

package.json

@@ -1,6 +1,6 @@
 {
     "name": "netwatch",
-    "private": true,
+    "version": "1.0.0",
     "description": "Real-time network latency monitor SPA",
     "type": "module",
     "scripts": {

script/build

@@ -10,10 +10,9 @@ main() {
     cd "$ROOT"
     "$ROOT/script/yarn" build
 
-    # VERSION comes from the environment. Unset or empty, it is
-    # `git describe --tags --always --dirty`, as in script/docker, or
-    # "dev" where there is no git or no repository history.
-    version="${VERSION:-$(git describe --tags --always --dirty 2>/dev/null || echo dev)}"
+    # VERSION comes from the environment. Unset or empty, it is git
+    # describe, or "dev" where there is no git or no repository history.
+    version="${VERSION:-$(git describe --always --dirty 2>/dev/null || echo dev)}"
 
     CGO_ENABLED=0 go build -trimpath \
         -ldflags "-s -w -X main.Version=$version" \