quak backup writes each original's EXIF, XMP and dimensions into its JSON (closes #167)

Each file's JSON gains imageMetadata, what extractImageMetadata finds in
the stored original (for a live photo, its image), or the reason the
read failed in imageMetadataError; a failed read fails neither the file
nor the run. A video is not read. An original is read when the run
stores it or when its JSON has neither field; otherwise the field is
carried over from that JSON, so a run does not read every original
again. The hand-built JPEG fixtures move to test/exif-jpeg.ts so the
backup tests can use them.

Judgement call: an original with nothing to record gets imageMetadata
{} instead of no field, so it is not read again on every run.

Model: opus-5-5

README.md

@@ -517,8 +517,17 @@ The CLI stores the snapshot at the platform-appropriate data directory via
 `0600`. The key material is stored in cleartext in the JSON; treat this file as
 you would treat the password itself. A missing file is reported as "not logged
 in"; a file that exists but is corrupt is reported as such, naming the bad
-field. Both exit with status 1, except that `quak logout` with no file says
-there is no session and exits 0.
+field. When the refresh a command starts with gets HTTP 401 from the server,
+because it no longer accepts the saved session's token, the command prints one
+line, `quak: the saved session is no longer valid; run "quak login"`, with no
+stack trace. All three exit with status 3, which means the user must run
+`quak login` again. `quak logout` is the exception: with no file it says there
+is no session and exits 0, and it handles a corrupt file or a failed server call
+as described below. `quak backup` meets an expired session on the refresh that
+starts every run, before it touches any file. A session that stops working
+partway through a backup instead fails each remaining file into `failures.json`,
+so that run exits 1 and the next one stops at its refresh with status 3. No
+command but `quak login` ever prompts.
 
 `quak logout` ends the session on the server, so the token in `session.json`
 stops working even in a copy of the file, and then deletes the file. If the
@@ -552,8 +561,9 @@ library. The read commands — `collections`, `files`, `get`, `get-thumb`,
 `helper fix-missing-thumbnails` — force a fresh server round-trip before they
 answer, so they report current account state rather than whatever the cache last
 held. If that round-trip fails, the command prints the error on one line and
-exits 1. `--cache-dir` overrides where the cache lives; without it each account
-gets its own directory under the per-user cache path.
+exits 1, or 3 when the server no longer accepts the saved session (see "Session
+handling"). `--cache-dir` overrides where the cache lives; without it each
+account gets its own directory under the per-user cache path.
 
 `get` and `get-thumb` resolve the file by ID directly, so `--collection` is
 accepted for backward compatibility but ignored. For a live photo, `get` writes
@@ -601,7 +611,8 @@ the smallest does not.
                                     below)
         YYYY-MM-DD.<fileID>.json    the file's basic metadata fields quak
                                     keeps, its update time, its private and
-                                    public magic metadata, and its ML data
+                                    public magic metadata, its ML data, and
+                                    its original's EXIF, XMP and dimensions
         YYYY-MM-DD.<fileID>.livephoto.json
                                     which of a live photo's two files is which
     collections/
@@ -638,6 +649,16 @@ not in the cache gets the reason in `mlDataError` instead and counts as failed,
 and the next run fetches it again. The JSON files are rewritten on every run, so
 ML data that arrived since the last run appears.
 
+A file's JSON holds, as `imageMetadata`, what `backup-metadata --exif` records
+from its original, or from a live photo's image: `format`, `width` and `height`
+for a JPEG, `exif` (or `exifRaw` and `exifError`), and `xmp`. An original with
+none of these gets `{}`. A video gets no `imageMetadata`: reading a whole video
+to look for tags is not worth it. When the original cannot be read, the reason
+is in `imageMetadataError` instead; neither the file nor the run fails. The
+original is read when the run stores it, or when the JSON beside it has neither
+field, as one an earlier version wrote. Otherwise the field is taken from that
+JSON when it is rewritten, so a run does not read every stored original again.
+
 `failures.json` records each failed file with the kind of failure, how many
 times it has been tried and when it was last tried. A file leaves it once it
 succeeds, or once it is no longer in the library or in the backup's scope. The
@@ -895,13 +916,14 @@ photos newest first). `lib.subscribe({ onChange })` delivers a `LibraryChange`
   `fresh()` does, puts every in-scope original not already at its save path
   there as `photo.download()` does (and, with `includeThumbnails`, fetches
   thumbnails) through the content cache, waits for an ML data fetch, and
-  rebuilds the on-disk backup tree, each file's JSON with its ML data, with a
-  durable failure ledger. A fetched original is written straight to its save
-  path and not into the cache, which then counts it as present; one the cache
-  already held is copied from there. `BackupOptions`: `downloadDirectory` (falls
-  back to the library's), `includeOriginals` (default `true`),
-  `includeThumbnails` (default `false`), `onlyAlbumNames`, and `onProgress`. See
-  Backup layout above for the tree it writes.
+  rebuilds the on-disk backup tree, each file's JSON with its ML data and its
+  original's EXIF, XMP and dimensions, with a durable failure ledger. A fetched
+  original is written straight to its save path and not into the cache, which
+  then counts it as present; one the cache already held is copied from there.
+  `BackupOptions`: `downloadDirectory` (falls back to the library's),
+  `includeOriginals` (default `true`), `includeThumbnails` (default `false`),
+  `onlyAlbumNames`, and `onProgress`. See Backup layout above for the tree it
+  writes.
 
 ### Request pools
 

TODO.md

@@ -25,6 +25,25 @@ declares one.
 
 # Completed Steps
 
+- 2026-10-06: `quak backup` writes each original's EXIF, XMP and dimensions into
+  the file's JSON as `imageMetadata`, what `backup-metadata --exif` records
+  (issue 167): for a live photo from its image, for a video nothing, and `{}`
+  for an original with none of them. A failed read puts the reason in
+  `imageMetadataError` and fails neither the file nor the run. An original is
+  read when the run stores it or when its JSON has neither field; otherwise the
+  field is taken from that JSON. The hand-built JPEGs moved to
+  `test/exif-jpeg.ts`, beside the HEIC.
+
+- 2026-10-06: When the server answers HTTP 401 and that ends a command that
+  loads the saved session, because the server no longer accepts its token, the
+  command prints one line,
+  `quak: the saved session is no longer valid; run "quak login"`, and exits 3
+  (issue 164). `quak backup` meets that 401 on the refresh it starts with,
+  before it touches any file. For the same commands, a missing or corrupt
+  session file keeps its message and also exits 3, so a cron job can tell that
+  the user must log in again. `quak logout` is unchanged. `run` in
+  `src/cli-run.ts` recognises the 401, which reaches it unchanged.
+
 - 2026-10-06: `quak backup` retries a failed request for longer than the other
   commands do (issue 165). `src/retry.ts` exports `UNATTENDED_RETRY_OPTIONS`
   beside the unchanged default: 10 attempts, a 1 s base delay and a 60 s cap, so

src/backup.ts

@@ -11,7 +11,9 @@
 //         YYYY/YYYY-MM/YYYY-MM-DD/
 //             YYYY-MM-DD.<fileID>.<ext>    the decrypted bytes (the save path)
 //             YYYY-MM-DD.<fileID>.json     per-file metadata sidecar, with
-//                                          the file's ML data
+//                                          the file's ML data and its
+//                                          original's EXIF, XMP and
+//                                          dimensions
 //         collections/<name>/<title>       symlink to the original
 //         collections/<name>.json          per-collection metadata
 //         account.json                     the account's email and user ID
@@ -28,7 +30,10 @@
 // no unique state, so they are rebuilt every run; that repairs stale sidecars
 // and missing or broken symlinks left by an earlier crash. A rebuild also
 // removes the symlinks to originals that no longer belong to an album, and the
-// directories of albums that no longer exist.
+// directories of albums that no longer exist. The one thing a sidecar takes
+// from the sidecar it replaces is its original's EXIF, XMP and dimensions (or
+// why they could not be read), so that a run does not read every stored
+// original again; a sidecar without them gets them read from the original.
 //
 // Resilience (issue #8): no per-file condition aborts the run. A failed
 // download, a failed symlink, or ML data missing because the ML data fetch
@@ -53,6 +58,7 @@ import {
     symlinkSync,
     writeFileSync,
 } from "node:fs";
+import { readFile } from "node:fs/promises";
 import { dirname, extname, join, relative, resolve } from "node:path";
 
 import { removeLeftoverTempFiles } from "./download/index.js";
@@ -64,6 +70,7 @@ import {
     storedAtSavePath,
 } from "./library/content.js";
 import { representative } from "./library/records.js";
+import { extractImageMetadata } from "./metadata-backup.js";
 import type { MLData } from "./mldata-fetch.js";
 import type { Collection, EnteFile, FileMetadata } from "./model/types.js";
 
@@ -354,12 +361,53 @@ const saveLedger = (path: string, ledger: Map<number, FailureEntry>): void => {
     );
 };
 
-// The file's JSON: its basic fields, its magic metadata, and its ML data, or
-// the reason the ML data is missing.
+// A file's EXIF, XMP and dimensions as its JSON holds them: what
+// `extractImageMetadata` found in its original, or why the original could not
+// be read.
+interface ImageMetadata {
+    imageMetadata?: Record<string, unknown>;
+    imageMetadataError?: string;
+}
+
+// The image metadata for the file whose original is at `originalPath` (for a
+// live photo, its image) and whose JSON is at `jsonPath`. A video gets none,
+// as `photo.exif()` reads none. An original stored before this run is not read
+// again when its JSON already holds image metadata: that is kept. A failed
+// read gives the reason, and fails neither the file nor the run. An original
+// with no EXIF, XMP or JPEG dimensions gets `{}`, so it is not read again.
+const imageMetadataFor = async (
+    file: EnteFile,
+    originalPath: string,
+    jsonPath: string,
+    storedThisRun: boolean,
+): Promise<ImageMetadata> => {
+    if (file.metadata.fileType === "video") return {};
+    if (!storedThisRun) {
+        try {
+            const { imageMetadata, imageMetadataError } = JSON.parse(
+                readFileSync(jsonPath, "utf-8"),
+            ) as ImageMetadata;
+            if (imageMetadata !== undefined || imageMetadataError !== undefined)
+                return { imageMetadata, imageMetadataError };
+        } catch {
+            // No JSON yet, or one that cannot be parsed: read the original.
+        }
+    }
+    try {
+        const bytes = await readFile(originalPath);
+        return { imageMetadata: extractImageMetadata(bytes) ?? {} };
+    } catch (err) {
+        return { imageMetadataError: errorMessage(err) };
+    }
+};
+
+// The file's JSON: its basic fields, its magic metadata, its ML data or the
+// reason the ML data is missing, and its image metadata.
 const writeSidecar = (
     path: string,
     file: EnteFile,
     ml: { mlData?: MLData; mlDataError?: string },
+    image: ImageMetadata,
 ): void => {
     const meta: Record<string, unknown> = {
         id: file.id,
@@ -372,6 +420,10 @@ const writeSidecar = (
     if (file.pubMagicMetadata) meta.pubMagicMetadata = file.pubMagicMetadata;
     if (ml.mlData) meta.mlData = ml.mlData;
     if (ml.mlDataError) meta.mlDataError = ml.mlDataError;
+    if (image.imageMetadata) meta.imageMetadata = image.imageMetadata;
+    if (image.imageMetadataError) {
+        meta.imageMetadataError = image.imageMetadataError;
+    }
     writeFileSync(path, JSON.stringify(meta, null, 2));
 };
 
@@ -468,6 +520,7 @@ export const runBackup = async (
 
     const errors: BackupError[] = [];
     const failedThisRun = new Set<number>();
+    const storedThisRun = new Set<number>();
     let downloaded = 0;
     let skipped = 0;
 
@@ -516,6 +569,7 @@ export const runBackup = async (
                 await placeOriginal(downloadDirectory, file, (dest) =>
                     lib.original(fileID, dest),
                 );
+                storedThisRun.add(fileID);
                 downloaded++;
             } catch (err) {
                 log(
@@ -549,9 +603,10 @@ export const runBackup = async (
 
     // Phase 2: rebuild the derived views from the model. Sidecars first, for
     // every present original (this repairs stale ones), each with the file's
-    // ML data once an ML data fetch has completed. When the fetch fails, a
-    // file with no cached ML data gets the reason instead and is recorded as
-    // failed. The next run fetches its ML data again because none is cached.
+    // ML data once an ML data fetch has completed, and its image metadata.
+    // When the fetch fails, a file with no cached ML data gets the reason
+    // instead and is recorded as failed. The next run fetches its ML data
+    // again because none is cached.
     if (includeOriginals) {
         let mlDataError: string | undefined;
         try {
@@ -562,23 +617,28 @@ export const runBackup = async (
             log(`FAILED ML data: ${mlDataError}`);
         }
         for (const file of distinct.values()) {
-            if (storedAtSavePath(downloadDirectory, file) === undefined) {
-                continue;
-            }
+            const stored = storedAtSavePath(downloadDirectory, file);
+            if (stored === undefined) continue;
             const path = withExtension(
                 savePath(downloadDirectory, file),
                 ".json",
             );
+            const image = await imageMetadataFor(
+                file,
+                stored.path,
+                path,
+                storedThisRun.has(file.id),
+            );
             const mlData = await lib.mlData(file.id);
             if (mlData === undefined && mlDataError !== undefined) {
-                writeSidecar(path, file, { mlDataError });
+                writeSidecar(path, file, { mlDataError }, image);
                 recordFailure(
                     file,
                     collectionName.get(file.collectionID) ?? "",
                     new Error(`ML data: ${mlDataError}`),
                 );
             } else {
-                writeSidecar(path, file, { mlData });
+                writeSidecar(path, file, { mlData }, image);
             }
         }
     }

src/cli-commands.ts

@@ -73,7 +73,9 @@ export const saveSession = (
     );
 };
 
-// The saved client, or undefined after telling the user why there is none.
+// The saved client, or undefined after telling the user why there is none. The
+// command then exits 3, the code for "log in again", as `run` in `cli-run.ts`
+// does when the server no longer accepts the saved session.
 const requireSession = (ctx: CliContext): Client | undefined => {
     let client: Client | null;
     try {
@@ -150,7 +152,7 @@ export const loginCommand = async (ctx: CliContext): Promise<number> => {
 export const whoamiCommand = async (ctx: CliContext): Promise<number> => {
     await init();
     const client = requireSession(ctx);
-    if (!client) return 1;
+    if (!client) return 3;
     const info = client.whoami();
     ctx.stdout.write(JSON.stringify(info) + "\n");
     return 0;
@@ -201,7 +203,7 @@ export const collectionsCommand = async (
 ): Promise<number> => {
     await init();
     const client = requireSession(ctx);
-    if (!client) return 1;
+    if (!client) return 3;
     const lib = await openReadLibrary(ctx, client);
     try {
         // Force a server round-trip and list in enumeration order (issue #36
@@ -243,7 +245,7 @@ export const filesCommand = async (
 ): Promise<number> => {
     await init();
     const client = requireSession(ctx);
-    if (!client) return 1;
+    if (!client) return 3;
     const collectionID = Number(opts.collection);
     if (!Number.isFinite(collectionID)) {
         ctx.stderr.write("Invalid collection ID\n");
@@ -285,7 +287,7 @@ export const getCommand = async (
 ): Promise<number> => {
     await init();
     const client = requireSession(ctx);
-    if (!client) return 1;
+    if (!client) return 3;
     const fileID = Number(fileIDStr);
     if (!Number.isFinite(fileID)) {
         ctx.stderr.write("Invalid file ID\n");
@@ -343,7 +345,7 @@ export const getThumbCommand = async (
 ): Promise<number> => {
     await init();
     const client = requireSession(ctx);
-    if (!client) return 1;
+    if (!client) return 3;
     const fileID = Number(fileIDStr);
     if (!Number.isFinite(fileID)) {
         ctx.stderr.write("Invalid file ID\n");
@@ -380,7 +382,7 @@ export const backupMetadataCommand = async (
 ): Promise<number> => {
     await init();
     const client = requireSession(ctx);
-    if (!client) return 1;
+    if (!client) return 3;
     const lib = await openReadLibrary(ctx, client);
     try {
         // Refresh first so the dump holds current account state, not what the
@@ -403,7 +405,7 @@ export const backupCommand = async (
 ): Promise<number> => {
     await init();
     const client = requireSession(ctx);
-    if (!client) return 1;
+    if (!client) return 3;
 
     ctx.stderr.write("Starting backup...\n");
     // The precache is off: the backup fetches what it needs, and must not
@@ -453,7 +455,7 @@ export const listMissingThumbnailsCommand = async (
 ): Promise<number> => {
     await init();
     const client = requireSession(ctx);
-    if (!client) return 1;
+    if (!client) return 3;
     const lib = await openReadLibrary(ctx, client);
     try {
         // Refresh first so files added since the cache was written are
@@ -491,7 +493,7 @@ export const fixMissingThumbnailsCommand = async (
 ): Promise<number> => {
     await init();
     const client = requireSession(ctx);
-    if (!client) return 1;
+    if (!client) return 3;
     const lib = await openReadLibrary(ctx, client);
     try {
         // Refresh first so files added since the cache was written are found;

src/cli-run.ts

@@ -1,12 +1,15 @@
 // Runs one CLI command for `bin/quak.ts` and exits with its code.
 
 import type { Writable } from "node:stream";
+import { ApiError } from "./api/client.js";
 
 // Run a command and exit with its code once stdout/stderr have drained.
 // Exiting before the drain can truncate piped output, and the library can keep
 // the event loop alive after a command returns, so a plain return could hang.
 // An error the command throws is printed as one `quak: MESSAGE` line, without
-// the stack trace, and exits 1.
+// the stack trace, and exits 1. A 401 from the server means it no longer
+// accepts the saved session: that prints one line saying to log in again and
+// exits 3, as a missing or corrupt session file does.
 export const run = async (
     command: Promise<number>,
     stdout: Writable,
@@ -17,10 +20,17 @@ export const run = async (
     try {
         code = await command;
     } catch (err) {
-        stderr.write(
-            `quak: ${err instanceof Error ? err.message : String(err)}\n`,
-        );
-        code = 1;
+        if (err instanceof ApiError && err.status === 401) {
+            stderr.write(
+                `quak: the saved session is no longer valid; run "quak login"\n`,
+            );
+            code = 3;
+        } else {
+            stderr.write(
+                `quak: ${err instanceof Error ? err.message : String(err)}\n`,
+            );
+            code = 1;
+        }
     }
     const pending = [stdout, stderr].filter((s) => s.writableLength > 0);
     if (pending.length === 0) {

test/cli/backup.test.ts

@@ -33,6 +33,7 @@
  */
 
 import {
+    chmodSync,
     existsSync,
     lstatSync,
     mkdirSync,
@@ -53,12 +54,16 @@ import { runBackup, type BackupLibrary } from "../../src/backup.js";
 import { Library } from "../../src/library/index.js";
 import type { ContentSource } from "../../src/library/content.js";
 import type { CollectionsPage, FilesPage } from "../../src/client.js";
+import { extractImageMetadata } from "../../src/metadata-backup.js";
 import type { MLData } from "../../src/mldata-fetch.js";
 import type { Collection, EnteFile } from "../../src/model/types.js";
+import { HEIC_WITH_EXIF } from "../exif-heic.js";
+import { JPEG_WITH_EXIF } from "../exif-jpeg.js";
 import {
     asLivePhoto,
     cdnSource,
     IMAGE,
+    livePhotoHash,
     livePhotoZip,
     VIDEO,
 } from "../live-photo.js";
@@ -1018,6 +1023,179 @@ describe("account and album records", () => {
     });
 });
 
+// What a file's JSON holds as `imageMetadata` for an original of `bytes`.
+const imageMetadataOf = (bytes: Uint8Array): unknown =>
+    JSON.parse(JSON.stringify(extractImageMetadata(bytes)));
+
+describe("image metadata in each file's JSON", () => {
+    // Serves `files` in the Vacation album and nothing in Work.
+    class FilesClient extends MockClient {
+        constructor(private readonly files: EnteFile[]) {
+            super();
+        }
+        override async filesSince(args: {
+            collectionID: number;
+        }): Promise<FilesPage> {
+            return {
+                files: args.collectionID === 1 ? this.files : [],
+                deleted: [],
+                cursor: 1,
+            };
+        }
+    }
+
+    // Writes `originals.get(fileID)` as each file's original, looked up at
+    // each fetch, so a test can change it between runs.
+    const bytesSource = (
+        originals: Map<number, Uint8Array>,
+    ): ContentSource => ({
+        original: async ({ file: f, destination }) => {
+            const bytes = originals.get(f.id)!;
+            writeFileSync(destination, bytes);
+            return { bytesWritten: bytes.length };
+        },
+        thumbnail: async () => {
+            throw new Error("no thumbnails in this source");
+        },
+    });
+
+    // A JPEG, a HEIC, a video, and a file holding no image metadata. The
+    // video's bytes are the JPEG's, so reading it would find EXIF.
+    const clip = file(602, 1, "clip.mov");
+    const files = [
+        file(600, 1, "photo.jpg"),
+        file(601, 1, "photo.heic"),
+        { ...clip, metadata: { ...clip.metadata, fileType: "video" as const } },
+        file(603, 1, "notes.png"),
+    ];
+    const originals = (): Map<number, Uint8Array> =>
+        new Map([
+            [600, JPEG_WITH_EXIF],
+            [601, HEIC_WITH_EXIF],
+            [602, JPEG_WITH_EXIF],
+            [603, new TextEncoder().encode("not an image")],
+        ]);
+    const open = (bytes = originals()): Promise<Library> =>
+        openLibrary(bytesSource(bytes), new FilesClient(files));
+
+    // Rewrite the JSON of `fileID` without its image metadata, as an earlier
+    // version of quak wrote it.
+    const dropImageMetadata = (outDir: string, fileID: number): void => {
+        const json = fileJSON(outDir, fileID);
+        delete json.imageMetadata;
+        writeFileSync(saved(outDir, `${fileID}.json`), JSON.stringify(json));
+    };
+
+    it("writes each new original's image metadata, and none for a video", async () => {
+        const lib = await open();
+        const outDir = join(root, "backup");
+
+        const result = await lib.backup({ downloadDirectory: outDir });
+
+        expect(result).toMatchObject({ downloaded: 4, failed: 0 });
+        expect(fileJSON(outDir, 600).imageMetadata).toEqual(
+            imageMetadataOf(JPEG_WITH_EXIF),
+        );
+        expect(fileJSON(outDir, 601).imageMetadata).toEqual(
+            imageMetadataOf(HEIC_WITH_EXIF),
+        );
+        expect(fileJSON(outDir, 602)).not.toHaveProperty("imageMetadata");
+        expect(fileJSON(outDir, 602)).not.toHaveProperty("imageMetadataError");
+        // Empty, so that the next run does not read it again.
+        expect(fileJSON(outDir, 603).imageMetadata).toEqual({});
+        await lib.close();
+    });
+
+    it("reads a live photo's image", async () => {
+        const { file: live, body } = await asLivePhoto(
+            file(500, 1, "IMG_0500.HEIC"),
+            livePhotoZip({ "image.heic": HEIC_WITH_EXIF, "video.mov": VIDEO }),
+            livePhotoHash(HEIC_WITH_EXIF, VIDEO),
+        );
+        const lib = await openLibrary(
+            cdnSource(new Map([[500, body]])),
+            new FilesClient([live]),
+        );
+        const outDir = join(root, "backup");
+
+        await lib.backup({ downloadDirectory: outDir });
+
+        expect(fileJSON(outDir, 500).imageMetadata).toEqual(
+            imageMetadataOf(HEIC_WITH_EXIF),
+        );
+        await lib.close();
+    });
+
+    it("keeps the image metadata of an original stored by an earlier run without reading it again", async () => {
+        const lib = await open();
+        const outDir = join(root, "backup");
+        await lib.backup({ downloadDirectory: outDir });
+        // A read of the original now would give the HEIC's.
+        writeFileSync(saved(outDir, "600.jpg"), HEIC_WITH_EXIF);
+
+        const second = await lib.backup({ downloadDirectory: outDir });
+
+        expect(second).toMatchObject({ downloaded: 0, failed: 0 });
+        expect(fileJSON(outDir, 600).imageMetadata).toEqual(
+            imageMetadataOf(JPEG_WITH_EXIF),
+        );
+        await lib.close();
+    });
+
+    it("reads an original stored by an earlier version, whose JSON has no image metadata", async () => {
+        const lib = await open();
+        const outDir = join(root, "backup");
+        await lib.backup({ downloadDirectory: outDir });
+        dropImageMetadata(outDir, 600);
+
+        const second = await lib.backup({ downloadDirectory: outDir });
+
+        expect(second).toMatchObject({ downloaded: 0, failed: 0 });
+        expect(fileJSON(outDir, 600).imageMetadata).toEqual(
+            imageMetadataOf(JPEG_WITH_EXIF),
+        );
+        await lib.close();
+    });
+
+    it("reads an original the run stores again, though its JSON has image metadata", async () => {
+        const bytes = originals();
+        const lib = await open(bytes);
+        const outDir = join(root, "backup");
+        await lib.backup({ downloadDirectory: outDir });
+        rmSync(saved(outDir, "600.jpg"));
+        bytes.set(600, HEIC_WITH_EXIF);
+
+        const second = await lib.backup({ downloadDirectory: outDir });
+
+        expect(second).toMatchObject({ downloaded: 1, failed: 0 });
+        expect(fileJSON(outDir, 600).imageMetadata).toEqual(
+            imageMetadataOf(HEIC_WITH_EXIF),
+        );
+        await lib.close();
+    });
+
+    // Root ignores file permissions, so this fails when run as root. The
+    // `test` phase of the `Dockerfile` runs as the `node` user.
+    it("gives the reason an original could not be read, failing neither the file nor the run", async () => {
+        const lib = await open();
+        const outDir = join(root, "backup");
+        await lib.backup({ downloadDirectory: outDir });
+        dropImageMetadata(outDir, 600);
+        const original = saved(outDir, "600.jpg");
+        chmodSync(original, 0o000);
+
+        const second = await lib
+            .backup({ downloadDirectory: outDir })
+            .finally(() => chmodSync(original, 0o600));
+
+        expect(second).toMatchObject({ failed: 0, errors: [] });
+        expect(existsSync(join(outDir, "failures.json"))).toBe(false);
+        expect(fileJSON(outDir, 600)).not.toHaveProperty("imageMetadata");
+        expect(fileJSON(outDir, 600).imageMetadataError).toMatch(/EACCES/);
+        await lib.close();
+    });
+});
+
 // Every entry under collections/, one level of directories deep, with each
 // symlink's target.
 const tree = (outDir: string): string[] => {

test/cli/commands.test.ts

@@ -230,20 +230,30 @@ describe("session file", () => {
         expect(JSON.parse(readFileSync(path, "utf-8"))).toEqual(snapshot);
     });
 
-    it("a missing session exits 1 with 'Not logged in'", async () => {
+    it("a missing session exits 3 with 'Not logged in' from every command that needs one", async () => {
         const ctx = { ...context(), loadSession };
-        expect(await whoamiCommand(ctx)).toBe(1);
-        expect(stderr.text).toBe(
+        const dir = join(root, "backup");
+        expect(await whoamiCommand(ctx)).toBe(3);
+        expect(await collectionsCommand(ctx, {})).toBe(3);
+        expect(await filesCommand(ctx, { collection: "1" })).toBe(3);
+        expect(await getCommand(ctx, "100", {})).toBe(3);
+        expect(await getThumbCommand(ctx, "100", {})).toBe(3);
+        expect(await backupMetadataCommand(ctx, dir, {})).toBe(3);
+        expect(await backupCommand(ctx, dir, {})).toBe(3);
+        expect(await listMissingThumbnailsCommand(ctx, {})).toBe(3);
+        expect(await fixMissingThumbnailsCommand(ctx, {})).toBe(3);
+        const notLoggedIn =
             `Not logged in. Run "quak login" first.\n` +
-                `Session file: ${join(ctx.sessionDir, "session.json")}\n`,
-        );
+            `Session file: ${join(ctx.sessionDir, "session.json")}\n`;
+        expect(stderr.text).toBe(notLoggedIn.repeat(9));
         expect(stdout.text).toBe("");
+        expect(existsSync(dir)).toBe(false);
     });
 
-    it("a corrupt session exits 1 and says it is corrupt", async () => {
+    it("a corrupt session exits 3 and says it is corrupt", async () => {
         const ctx = { ...context(), loadSession };
         saveSession(ctx.sessionDir, snapshot);
-        expect(await collectionsCommand(ctx, {})).toBe(1);
+        expect(await collectionsCommand(ctx, {})).toBe(3);
         expect(stderr.text).toContain("is corrupt");
         expect(stderr.text).toContain(
             `Run "quak logout" and then "quak login" to replace it.\n`,
@@ -748,15 +758,12 @@ describe("backup", () => {
         );
     });
 
-    it("exits 1 with the error on one line when the refresh fails", async () => {
-        const client = {
-            ...fakeClient(),
-            collectionsSince: async () => {
-                throw new Error("HTTP 401 from server");
-            },
-        } as unknown as Client;
-        const dir = join(root, "backup");
-        // Through `run`, as `bin/quak.ts` does, which prints a thrown error.
+    // Runs `backup` through `run`, as `bin/quak.ts` does, which prints a thrown
+    // error; returns the exit code and what `run` printed.
+    const backupThroughRun = async (
+        ctx: CliContext,
+        dir: string,
+    ): Promise<{ code: number; runText: string }> => {
         const runStderr = new PassThrough();
         let runText = "";
         runStderr.on("data", (chunk: Buffer) => {
@@ -764,14 +771,57 @@ describe("backup", () => {
         });
         const code = await new Promise<number>((resolve) => {
             void run(
-                backupCommand(context(client), dir, {}),
+                backupCommand(ctx, dir, {}),
                 new PassThrough(),
                 runStderr,
                 resolve,
             );
         });
+        return { code, runText };
+    };
+
+    it("exits 1 with the error on one line when the refresh fails", async () => {
+        const client = {
+            ...fakeClient(),
+            collectionsSince: async () => {
+                throw new Error("HTTP 503 from server");
+            },
+        } as unknown as Client;
+        const dir = join(root, "backup");
+        const { code, runText } = await backupThroughRun(context(client), dir);
         expect(code).toBe(1);
-        expect(runText).toBe("quak: HTTP 401 from server\n");
+        expect(runText).toBe("quak: HTTP 503 from server\n");
+        expect(stderr.text).toBe("Starting backup...\nRefreshing library...\n");
+        expect(existsSync(dir)).toBe(false);
+    });
+
+    // A real saved session, read back by `loadSession`, whose server answers
+    // every request with 401, as it does once it no longer accepts the token.
+    // The context's prompts throw, so a prompt would end the run with another
+    // line and exit 1.
+    it("exits 3 with one line saying to log in again when the server answers 401", async () => {
+        const key = toBase64(new Uint8Array(32));
+        saveSession(join(root, "session"), {
+            email: "cli@example.com",
+            userID: USER_ID,
+            token: "expired",
+            masterKey: key,
+            secretKey: key,
+            publicKey: key,
+        });
+        const unauthorized = async (): Promise<Response> =>
+            new Response(null, { status: 401 });
+        const ctx = {
+            ...context(),
+            loadSession: (path: string) =>
+                loadSession(path, { fetch: unauthorized }),
+        };
+        const dir = join(root, "backup");
+        const { code, runText } = await backupThroughRun(ctx, dir);
+        expect(code).toBe(3);
+        expect(runText).toBe(
+            `quak: the saved session is no longer valid; run "quak login"\n`,
+        );
         expect(stderr.text).toBe("Starting backup...\nRefreshing library...\n");
         expect(existsSync(dir)).toBe(false);
     });

test/cli/run.test.ts

@@ -5,6 +5,7 @@
 import { PassThrough } from "node:stream";
 import { describe, it, expect } from "vitest";
 
+import { ApiError } from "../../src/api/client.js";
 import { run } from "../../src/cli-run.js";
 
 // A stream whose written text is kept in `text`; writes finish at once, so
@@ -55,4 +56,26 @@ describe("run", () => {
             stderr: "quak: offline\n",
         });
     });
+
+    it("on a 401 from the server says to run quak login, on one line, and exits 3", async () => {
+        const result = await runToExit(
+            Promise.reject(new ApiError("unauthorized", 401)),
+        );
+        expect(result).toEqual({
+            code: 3,
+            stdout: "",
+            stderr: `quak: the saved session is no longer valid; run "quak login"\n`,
+        });
+    });
+
+    it("prints another HTTP error as it is and exits 1", async () => {
+        const result = await runToExit(
+            Promise.reject(new ApiError("forbidden", 403)),
+        );
+        expect(result).toEqual({
+            code: 1,
+            stdout: "",
+            stderr: "quak: forbidden\n",
+        });
+    });
 });

test/exif-heic.ts

@@ -1,7 +1,7 @@
 /**
  * `exif.heic`, beside this file: a real 64x64 HEIC whose EXIF holds the same
- * values as the hand-built JPEG in `library/content-library.test.ts`, for the
- * tests of `exif()` and `backup-metadata --exif`.
+ * values as the hand-built JPEG in `exif-jpeg.ts`, for the tests of `exif()`,
+ * `backup-metadata --exif` and the image metadata `quak backup` records.
  *
  * It was made once, in a throwaway node:22-alpine container (Alpine 3.23.3),
  * with libheif 1.23.0 and exiftool 13.55:

test/exif-jpeg.ts

@@ -0,0 +1,89 @@
+/**
+ * Hand-built JPEGs for the tests of `exif()` and of the image metadata
+ * `quak backup` records: one whose EXIF holds the same values as `exif.heic`
+ * (see `exif-heic.ts`), and one whose EXIF cannot be parsed.
+ */
+
+// Big-endian bytes for the hand-built JPEG below.
+const u16 = (n: number): number[] => [n >> 8, n & 0xff];
+const u32 = (n: number): number[] => [...u16(n >>> 16), ...u16(n & 0xffff)];
+const ascii = (s: string): number[] => [...new TextEncoder().encode(s), 0];
+const rational = (num: number, den: number): number[] => [
+    ...u32(num),
+    ...u32(den),
+];
+// One IFD entry: tag, type (1 BYTE, 2 ASCII, 3 SHORT, 4 LONG, 5 RATIONAL),
+// count, then the value when it fits in 4 bytes, else its offset.
+const entry = (
+    tag: number,
+    type: number,
+    count: number,
+    value: number[],
+): number[] => [...u16(tag), ...u16(type), ...u32(count), ...value];
+
+// The TIFF block of a JPEG's EXIF segment, holding every field `Photo`'s typed
+// methods return: the camera in the first IFD, the exposure in the Exif IFD,
+// and a GPS position of 40°26'46" N, 79°58'56" W, 12.5 m below sea level.
+// Offsets count from the start of this block.
+const TIFF = [
+    ...[0x4d, 0x4d, 0x00, 0x2a], // big-endian TIFF
+    ...u32(8), // the first IFD's offset
+    // The first IFD, at 8: five entries, then no next IFD.
+    ...u16(5),
+    ...entry(0x010f, 2, 6, u32(74)), // Make
+    ...entry(0x0110, 2, 7, u32(80)), // Model
+    ...entry(0x0112, 3, 1, [...u16(6), 0, 0]), // Orientation
+    ...entry(0x8769, 4, 1, u32(88)), // the Exif IFD's offset
+    ...entry(0x8825, 4, 1, u32(246)), // the GPS IFD's offset
+    ...u32(0),
+    ...ascii("Canon"), // at 74
+    ...ascii("EOS R5"), // at 80
+    0, // a pad byte
+    // The Exif IFD, at 88: seven entries, then no next IFD.
+    ...u16(7),
+    ...entry(0x829a, 5, 1, u32(178)), // ExposureTime
+    ...entry(0x829d, 5, 1, u32(186)), // FNumber
+    ...entry(0x8827, 3, 1, [...u16(400), 0, 0]), // ISOSpeedRatings
+    ...entry(0x9003, 2, 20, u32(194)), // DateTimeOriginal
+    ...entry(0x9011, 2, 7, u32(214)), // OffsetTimeOriginal
+    ...entry(0x920a, 5, 1, u32(222)), // FocalLength
+    ...entry(0xa434, 2, 16, u32(230)), // LensModel
+    ...u32(0),
+    ...rational(1, 250), // at 178
+    ...rational(28, 10), // at 186
+    ...ascii("2021:07:15 14:30:00"), // at 194
+    ...ascii("+02:00"), // at 214
+    0, // a pad byte
+    ...rational(50, 1), // at 222
+    ...ascii("RF50mm F1.8 STM"), // at 230
+    // The GPS IFD, at 246: six entries, then no next IFD.
+    ...u16(6),
+    ...entry(0x0001, 2, 2, [...ascii("N"), 0, 0]), // GPSLatitudeRef
+    ...entry(0x0002, 5, 3, u32(324)), // GPSLatitude
+    ...entry(0x0003, 2, 2, [...ascii("W"), 0, 0]), // GPSLongitudeRef
+    ...entry(0x0004, 5, 3, u32(348)), // GPSLongitude
+    ...entry(0x0005, 1, 1, [1, 0, 0, 0]), // GPSAltitudeRef: below sea level
+    ...entry(0x0006, 5, 1, u32(372)), // GPSAltitude
+    ...u32(0),
+    ...[...rational(40, 1), ...rational(26, 1), ...rational(46, 1)], // at 324
+    ...[...rational(79, 1), ...rational(58, 1), ...rational(56, 1)], // at 348
+    ...rational(25, 2), // at 372
+];
+
+export const JPEG_WITH_EXIF = new Uint8Array([
+    ...[0xff, 0xd8], // start of image
+    ...[0xff, 0xe1, ...u16(2 + 6 + TIFF.length)], // APP1 and its length
+    ...[...ascii("Exif"), 0], // "Exif\0\0"
+    ...TIFF,
+    ...[0xff, 0xda, 0x00, 0x02], // start of scan
+]);
+
+// A JPEG whose EXIF segment is laid out correctly but holds "XX" where the TIFF
+// byte order belongs, so exifreader cannot parse it.
+export const JPEG_WITH_BAD_EXIF = new Uint8Array([
+    ...[0xff, 0xd8], // start of image
+    ...[0xff, 0xe1, ...u16(2 + 6 + 2)], // APP1 and its length
+    ...[...ascii("Exif"), 0], // "Exif\0\0"
+    ...[0x58, 0x58], // "XX"
+    ...[0xff, 0xda, 0x00, 0x02], // start of scan
+]);

test/library/content-library.test.ts

@@ -29,6 +29,7 @@ import type { CollectionsPage, FilesPage } from "../../src/client.js";
 import type { Collection, EnteFile } from "../../src/model/types.js";
 import { readPhotoExif, type PhotoExif } from "../../src/exif.js";
 import { HEIC_WITH_EXIF } from "../exif-heic.js";
+import { JPEG_WITH_BAD_EXIF, JPEG_WITH_EXIF } from "../exif-jpeg.js";
 import {
     asLivePhoto,
     cdnSource,
@@ -256,90 +257,6 @@ describe("Library content wiring", () => {
     });
 });
 
-// Big-endian bytes for the hand-built JPEG below.
-const u16 = (n: number): number[] => [n >> 8, n & 0xff];
-const u32 = (n: number): number[] => [...u16(n >>> 16), ...u16(n & 0xffff)];
-const ascii = (s: string): number[] => [...new TextEncoder().encode(s), 0];
-const rational = (num: number, den: number): number[] => [
-    ...u32(num),
-    ...u32(den),
-];
-// One IFD entry: tag, type (1 BYTE, 2 ASCII, 3 SHORT, 4 LONG, 5 RATIONAL),
-// count, then the value when it fits in 4 bytes, else its offset.
-const entry = (
-    tag: number,
-    type: number,
-    count: number,
-    value: number[],
-): number[] => [...u16(tag), ...u16(type), ...u32(count), ...value];
-
-// The TIFF block of a JPEG's EXIF segment, holding every field `Photo`'s typed
-// methods return: the camera in the first IFD, the exposure in the Exif IFD,
-// and a GPS position of 40°26'46" N, 79°58'56" W, 12.5 m below sea level.
-// Offsets count from the start of this block.
-const TIFF = [
-    ...[0x4d, 0x4d, 0x00, 0x2a], // big-endian TIFF
-    ...u32(8), // the first IFD's offset
-    // The first IFD, at 8: five entries, then no next IFD.
-    ...u16(5),
-    ...entry(0x010f, 2, 6, u32(74)), // Make
-    ...entry(0x0110, 2, 7, u32(80)), // Model
-    ...entry(0x0112, 3, 1, [...u16(6), 0, 0]), // Orientation
-    ...entry(0x8769, 4, 1, u32(88)), // the Exif IFD's offset
-    ...entry(0x8825, 4, 1, u32(246)), // the GPS IFD's offset
-    ...u32(0),
-    ...ascii("Canon"), // at 74
-    ...ascii("EOS R5"), // at 80
-    0, // a pad byte
-    // The Exif IFD, at 88: seven entries, then no next IFD.
-    ...u16(7),
-    ...entry(0x829a, 5, 1, u32(178)), // ExposureTime
-    ...entry(0x829d, 5, 1, u32(186)), // FNumber
-    ...entry(0x8827, 3, 1, [...u16(400), 0, 0]), // ISOSpeedRatings
-    ...entry(0x9003, 2, 20, u32(194)), // DateTimeOriginal
-    ...entry(0x9011, 2, 7, u32(214)), // OffsetTimeOriginal
-    ...entry(0x920a, 5, 1, u32(222)), // FocalLength
-    ...entry(0xa434, 2, 16, u32(230)), // LensModel
-    ...u32(0),
-    ...rational(1, 250), // at 178
-    ...rational(28, 10), // at 186
-    ...ascii("2021:07:15 14:30:00"), // at 194
-    ...ascii("+02:00"), // at 214
-    0, // a pad byte
-    ...rational(50, 1), // at 222
-    ...ascii("RF50mm F1.8 STM"), // at 230
-    // The GPS IFD, at 246: six entries, then no next IFD.
-    ...u16(6),
-    ...entry(0x0001, 2, 2, [...ascii("N"), 0, 0]), // GPSLatitudeRef
-    ...entry(0x0002, 5, 3, u32(324)), // GPSLatitude
-    ...entry(0x0003, 2, 2, [...ascii("W"), 0, 0]), // GPSLongitudeRef
-    ...entry(0x0004, 5, 3, u32(348)), // GPSLongitude
-    ...entry(0x0005, 1, 1, [1, 0, 0, 0]), // GPSAltitudeRef: below sea level
-    ...entry(0x0006, 5, 1, u32(372)), // GPSAltitude
-    ...u32(0),
-    ...[...rational(40, 1), ...rational(26, 1), ...rational(46, 1)], // at 324
-    ...[...rational(79, 1), ...rational(58, 1), ...rational(56, 1)], // at 348
-    ...rational(25, 2), // at 372
-];
-
-const JPEG_WITH_EXIF = new Uint8Array([
-    ...[0xff, 0xd8], // start of image
-    ...[0xff, 0xe1, ...u16(2 + 6 + TIFF.length)], // APP1 and its length
-    ...[...ascii("Exif"), 0], // "Exif\0\0"
-    ...TIFF,
-    ...[0xff, 0xda, 0x00, 0x02], // start of scan
-]);
-
-// A JPEG whose EXIF segment is laid out correctly but holds "XX" where the TIFF
-// byte order belongs, so exifreader cannot parse it.
-const JPEG_WITH_BAD_EXIF = new Uint8Array([
-    ...[0xff, 0xd8], // start of image
-    ...[0xff, 0xe1, ...u16(2 + 6 + 2)], // APP1 and its length
-    ...[...ascii("Exif"), 0], // "Exif\0\0"
-    ...[0x58, 0x58], // "XX"
-    ...[0xff, 0xda, 0x00, 0x02], // start of scan
-]);
-
 describe("Photo save path, local copy, content and EXIF", () => {
     // The same account, with `files` in its album instead.
     class FilesClient extends MockClient {