sneak
156fe871e8
All checks were successful
check / check (push) Successful in 23s
The image build reported a green it had not earned. `script/cibuild` is a bare `docker build .`, and with `COPY . .` followed by `RUN make check`, an unchanged tree served that layer from cache: the suite never ran and the build still exited 0, while the script's header comment asserted the opposite. CHECK_EPOCH, passed by `script/cibuild` and `script/docker`, changes the cache key of the check and build layers on every invocation. It is guarded, because an unset ARG is the empty string and therefore a stable key: without the guard a plain `docker build .` — the command the policy names, and the one anyone debugging types — would still get the false green. A missing argument is now a hard failure rather than a silent degradation to the behaviour the epoch was added to prevent. The Dockerfile is now two stages: `fmt-check` and `lint` run first, and the check stage takes a `COPY --from=lint` dependency on them, so a formatting mistake fails the build in seconds instead of racing the suite to the finish. Both stages stay pinned to the same digest. The remaining fixes are one-liners that had made the target unusable: `script/projectname` still printed the pre-rename name, so `make docker` tagged its image after a name this project dropped in May; `script/bootstrap` installed without fetching apt's package lists, which cannot work on a Debian base; and `.dockerignore` had drifted far enough from `.gitignore` to ship a ~100 MB compiled binary and any agent worktree under `.claude/` into the build context. The second of those is a correctness problem, not a size one — vitest globs a copied worktree's tests alongside the real ones and runs the suite twice over. `.gitignore` itself stays in the context, because prettier reads it as a default ignore file and dropping it would change what `make fmt-check` sees.
76 lines
3.7 KiB
Markdown
76 lines
3.7 KiB
Markdown
# Workflow
|
|
|
|
- branch (from `main`)
|
|
- do the work in Next Step
|
|
- move Next Step to the top of Completed Steps
|
|
- move the top item of Future Steps into Next Step
|
|
- commit (`TODO.md` changes in the same commit as the work)
|
|
- merge to `main` if the branch is not protected, otherwise open a PR
|
|
- push
|
|
|
|
# Status
|
|
|
|
pre-1.0
|
|
|
|
# Next Step
|
|
|
|
Update the README API reference section to match the current implementation.
|
|
|
|
# Completed Steps
|
|
|
|
- 2026-08-09: Made `make docker` green and policy-conformant. Multi-stage
|
|
Dockerfile: a lint stage runs `make fmt-check` and `make lint`, and the check
|
|
stage takes a `COPY --from=lint` dependency on it before running `make check`
|
|
and `make build`. `CHECK_EPOCH` and a fail-closed guard stop Docker serving
|
|
those two layers from cache, which is what let a build report success without
|
|
running the suite. `script/projectname` says `quak`, so the image is tagged
|
|
`quak`; `script/bootstrap` updates apt lists before installing, so a Debian
|
|
base works; `.dockerignore` no longer ships the compiled binary, the caches or
|
|
agent worktrees into the build context, and keeps `.gitignore` in it for
|
|
prettier.
|
|
- 2026-08-09: Fixed the TypeScript build. `rootDir` is the repo root, so `bin/`
|
|
compiles alongside `src/` instead of failing with TS6059; output is
|
|
`dist/src/` and `dist/bin/`, which is where `main`, `types` and `bin.quak` now
|
|
point. `script/build` verifies the declared entrypoints exist after the
|
|
compiler runs and makes the CLI executable, the Dockerfile runs `make build`
|
|
as well as `make check`, and a `quak` script makes the README's
|
|
`yarn quak <command>` examples work.
|
|
- 2026-08-09: Retry policy: no retry on 4xx (except `408` and `429`),
|
|
exponential backoff with full jitter on 5xx, transport failures and truncated
|
|
transfers, under per-attempt deadlines that cover the response body as well as
|
|
the request. Downloads retry request, stream consumption and decryption as one
|
|
unit; `postJSON` and `putJSON` are replayed only when the connection was never
|
|
established.
|
|
- 2026-08-09: Downloads verify the secretstream terminated on `TAG_FINAL` and
|
|
write output atomically: a truncated body is rejected instead of landing on
|
|
disk as a short file, and plaintext is staged in a sibling temp file and
|
|
renamed into place, so a failed download leaves the destination untouched.
|
|
- 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints, Makefile
|
|
shims, README Entrypoints section
|
|
- 2026-06-10: Decrypted collections shared by other users (sealed-box keys);
|
|
listCollections drops deleted-collection tombstones.
|
|
- 2026-06-10: Login hardening: dual-2FA empty-string fields handled, TOTP
|
|
preferred when a passkey is also enrolled, interactive input via
|
|
@inquirer/prompts.
|
|
- 2026-06-10: Replaced sharp with pure JS (jpeg-js + exif-reader); added
|
|
single-binary bun build and make install.
|
|
- 2026-06-09: Added backup-metadata command (ML data always included, --exif
|
|
opt-in); rewrote README to match the implementation; added thumbnail helper
|
|
tests.
|
|
- 2026-05-13: Full CLI surface: login, backup with dedup symlink layout,
|
|
collections, files, get, get-thumb, thumbnail repair helpers.
|
|
- 2026-05-13: Client OO API with literate usage tests; file download and
|
|
decryption; all three metadata layers decrypted and persisted; renamed quack
|
|
to quak.
|
|
- 2026-05-11: SRP login flow (email OTP + TOTP) and ApiClient.
|
|
|
|
# Future Steps
|
|
|
|
- Tag v1.0.0.
|
|
- Future desktop client, separate repo:
|
|
- Electron app skeleton consuming this library.
|
|
- Local SQLite cache keyed on (collectionID, fileID, updationTime).
|
|
- Background sync worker streaming new files into the cache.
|
|
- Gallery UI: thumbnails, full-image view, basic search.
|
|
- Upload, delete, and share operations in the library.
|