3 Commits

Include renames

Author	SHA1	Message	Date
clawbot	4193ced1f6	Report blobs shallow verify could not check apart from missing ones (closes #318) ... Shallow snapshot verify counted every error from checking a blob or the encrypted database as "missing" and printed the error nowhere, so a permission error or an S3 403 read as data loss. Now only a not-found answer from storage counts as missing. Any other error is reported as could not be checked, with the error storage returned, in the text report and under --json (the new unchecked list and database_check_error field), and the run fails. Under --quiet, which drops the report, each of those errors is logged as a warning on stderr. The database check moved into its own small function because the verify function was at the linter's length limit. Model: opus-5-5	2026-10-13 18:50:48 +02:00
clawbot	34f61fb408	Make remote nuke delete leftover .partial uploads (closes #281) ... The file and rclone listings skip an object whose name ends in `.partial`, the temporary name a `file://` or rclone upload writes before moving the object into place. `remote nuke` deletes only what the listings return, so it left the `.partial` objects killed uploads leave behind and still reported the destination store empty. Storer gains DeletePartialUploads. The file and rclone backends remove every `.partial` object under the prefix; S3 has none to remove, since it shows an object only once its upload completes. `remote nuke` calls it for `metadata/` and `blobs/` as its last step. Empty directories under a `file://` destination are still left behind. Model: opus-5-5	2026-10-08 14:17:20 +02:00
clawbot	82c51a5337	Validate blob hashes, offsets and lengths from the destination (closes #155) ... A blob hash read back from the downloaded snapshot database or the store listing was trusted unchecked. A hostile remote could set a hash such as "aa/../../etc" and have a decrypted blob written outside the cache directory, or feed a short or negative value that panicked a command. blobDiskCache.path now refuses any key with a path separator, and ReadAt rejects a negative offset or length, bounding so a sum cannot overflow past the check. A new isBlobHash helper gates FetchBlob, shallow and deep verify, and restore: buildBlobIndexes rejects every hash from the snapshot database before any fetch. The blobs/ and metadata/ listings skip a non-conforming name, and short-hash prefixes in log and error text go through a panic-safe shortHash helper. Model: opus-4-8	2026-09-22 16:11:28 +02:00