Silence prune and snapshot removal status under --cron and --quiet (closes #294)

PruneBlobs, CleanupLocalSnapshots, RemoveSnapshot, RemoveAllSnapshots
and snapshot purge wrote their status lines straight to stdout, so
`snapshot create --cron --prune` printed on every successful run and
--quiet did not silence `prune`, `snapshot purge`, `snapshot remove` or
`remote nuke`. Those lines now go through internal/ui, which drops them
under --cron and --quiet; warnings, errors and --json documents still
print.

The confirmation prompts and their "Cancelled" answer still write to
stdout directly, as the `database delete` prompt does. Under --quiet
without --force, the list of snapshots shown before the purge prompt is
now silenced.

The two purge test fixtures gained the UI writer production always sets.

Model: opus-5-5

README.md

@@ -271,17 +271,8 @@ existing file. Created with mode `0600` since it will contain credentials.
 **`config set`**: Set a scalar config value by dotted YAML path
 (e.g. `vaultik config set compression_level 9`,
 `vaultik config set storage_url "file:///mnt/backups"`). Comments and
-formatting in the file are preserved. Missing keys along the path are
-created: as a list when the next path element is a number (so
-`vaultik config set age_recipients.0 age1...` works on a file without
-`age_recipients`), otherwise as a map. If the config loads, a change
-after which it would not, such as `vaultik config set compression_level 99`,
-is refused and the file is left unchanged. A config that does not load,
-such as the one `config init` writes before `storage_url` is set or one
-with a `${ENV:...}` reference to a variable not set in this shell, is
-checked one setting at a time: only a change after which the changed
-setting cannot be read, such as one giving it the wrong type (a single
-value where a list belongs or a word where a number belongs), is refused.
+formatting in the file are preserved; intermediate maps are created as
+needed.
 
 **`snapshot create`**: Perform incremental backup of configured snapshots.
 * Optional snapshot names argument to create specific snapshots (default: all)
@@ -422,12 +413,11 @@ under `blobs/` whose name is not a blob hash is not counted as a blob,
 since `prune` never deletes it.
 * `--json`: Output as JSON
 
-**`remote nuke`**: Delete every object under `metadata/` and `blobs/` on
-the backup destination store, whatever its name, leaving the bucket prefix
-empty. Destructive and irreversible. This is the single supported way to
-wipe the entire destination store. If a listing afterwards still finds
-anything there, the command names each object left and exits non-zero;
-running it again deletes what is left.
+**`remote nuke`**: Delete every snapshot's metadata and every blob from the
+backup destination store, leaving the bucket prefix empty. Destructive and
+irreversible. This is the single supported way to wipe the entire
+destination store. If anything cannot be deleted, the command exits
+non-zero; running it again deletes what is left.
 * `--force`: Required to confirm destruction.
 
 **`database delete`**: Delete the local SQLite state database file
@@ -711,9 +701,8 @@ the `NO_COLOR` environment variable is unset (https://no-color.org/).
   verify`, `snapshot list`) but never the machine-consumed `config get`
   value or the `--json` documents, which a script depends on. The
   confirmation prompts of `database delete`, `prune`, `snapshot purge`
-  and `snapshot remove`, each with what it asks to delete, are also
-  written this way and always shown: they are an interactive exchange
-  the operator must see.
+  and `snapshot remove` are also written this way and always shown:
+  they are an interactive exchange the operator must see.
 
 `internal/ui` writes to stdout; it is the output the user asked for. The
 exceptions are the startup banner and the error a failed command ends

internal/cli/config.go

@@ -8,7 +8,6 @@ import (
 	"os/exec"
 	"path/filepath"
 	"reflect"
-	"slices"
 	"strconv"
 	"strings"
 	"unicode/utf8"
@@ -45,9 +44,6 @@ var (
 	errNeedNumericIndex = errors.New("key is a list; use a numeric index")
 	errIndexOutOfRange  = errors.New("index out of range")
 	errNotMapOrList     = errors.New("key is not a map or list")
-	errWouldNotLoad     = errors.New(
-		"vaultik would not load the config after this change, " +
-			"so the file was not changed")
 )
 
 const defaultConfigTemplate = `# vaultik configuration
@@ -395,17 +391,8 @@ func newConfigSetCommand() *cobra.Command {
 		Use:   "set <key> <value>",
 		Short: "Set a config value by dotted path (e.g. compression_level 5)",
 		Long: `Sets a scalar config value addressed by dotted YAML path and writes
-the file back, preserving comments and formatting. Missing keys along
-the path are created: as a list when the next path element is a
-number, otherwise as a map.
-
-If the config loads, a change after which it would not, such as
-compression_level 99, is refused and the file is left unchanged. A
-config that does not load, such as the one config init writes before
-storage_url is set or one with a ${ENV:...} reference to a variable
-not set here, is checked one setting at a time: only a change after
-which the changed setting cannot be read, such as one giving it the
-wrong type, is refused.
+the file back, preserving comments and formatting. Intermediate maps
+are created as needed.
 
 Examples:
   vaultik config set storage_url "file:///mnt/backups"
@@ -435,14 +422,7 @@ func writeConfigSet(out *ui.Writer, path, key, value string) error {
 		return err
 	}
 
-	oldData, err := marshalConfigYAML(root)
-	if err != nil {
-		return fmt.Errorf("marshaling config: %w", err)
-	}
-
-	keys := strings.Split(key, ".")
-
-	err = yamlPathSet(root, keys, value)
+	err = yamlPathSet(root, strings.Split(key, "."), value)
 	if err != nil {
 		return err
 	}
@@ -452,21 +432,6 @@ func writeConfigSet(out *ui.Writer, path, key, value string) error {
 		return fmt.Errorf("marshaling config: %w", err)
 	}
 
-	setting, err := yamlPathOnly(root, keys)
-	if err != nil {
-		return err
-	}
-
-	settingData, err := marshalConfigYAML(setting)
-	if err != nil {
-		return fmt.Errorf("marshaling config: %w", err)
-	}
-
-	err = checkConfigChange(oldData, data, settingData)
-	if err != nil {
-		return fmt.Errorf("%w: %w", errWouldNotLoad, err)
-	}
-
 	err = os.WriteFile(path, data, configFileMode)
 	if err != nil {
 		return fmt.Errorf("writing config file: %w", err)
@@ -488,58 +453,6 @@ func writeConfigSet(out *ui.Writer, path, key, value string) error {
 	return nil
 }
 
-// checkConfigChange returns the reason vaultik would not load newData, the
-// config after a change, if the change brings that failure in. If oldData,
-// the config before it, loads, the new one must load too. A config that
-// does not load, such as one still being filled in or one with a ${...}
-// reference that cannot be filled in here, is checked one setting at a
-// time: settingData, the changed setting on its own, must decode into the
-// config type.
-func checkConfigChange(oldData, newData, settingData []byte) error {
-	oldCfg, err := config.Parse(oldData)
-	if err == nil && oldCfg.Validate() == nil {
-		newCfg, err := config.Parse(newData)
-		if err != nil {
-			return err
-		}
-
-		return newCfg.Validate()
-	}
-
-	_, err = config.Parse(settingData)
-
-	return err
-}
-
-// yamlPathOnly returns a document holding only the value at the dotted key
-// path in root, inside the maps and lists that lead to it there.
-func yamlPathOnly(root *yaml.Node, keys []string) (*yaml.Node, error) {
-	node, err := yamlPathGet(root, keys)
-	if err != nil {
-		return nil, err
-	}
-
-	for i, key := range slices.Backward(keys) {
-		parent, err := yamlPathGet(root, keys[:i])
-		if err != nil {
-			return nil, err
-		}
-
-		if parent.Kind == yaml.SequenceNode {
-			node = &yaml.Node{
-				Kind: yaml.SequenceNode, Content: []*yaml.Node{node},
-			}
-		} else {
-			keyNode := &yaml.Node{Kind: yaml.ScalarNode, Value: key}
-			node = &yaml.Node{
-				Kind: yaml.MappingNode, Content: []*yaml.Node{keyNode, node},
-			}
-		}
-	}
-
-	return &yaml.Node{Kind: yaml.DocumentNode, Content: []*yaml.Node{node}}, nil
-}
-
 // marshalConfigYAML renders a config document tree with 2-space indentation,
 // matching defaultConfigTemplate. yaml.Marshal defaults to 4 spaces, which
 // would reindent the whole file on the first `config set` despite the promise
@@ -646,8 +559,8 @@ func yamlPathGet(root *yaml.Node, keys []string) (*yaml.Node, error) {
 	return node, nil
 }
 
-// yamlPathSet navigates a dotted key path, creating missing keys as needed,
-// and sets the final key to the given scalar value. Numeric path
+// yamlPathSet navigates a dotted key path, creating intermediate maps as
+// needed, and sets the final key to the given scalar value. Numeric path
 // components index into sequences; an index equal to the sequence length
 // appends a new element (e.g. "age_recipients.1" on a 1-element list).
 func yamlPathSet(root *yaml.Node, keys []string, value string) error {
@@ -660,12 +573,12 @@ func yamlPathSet(root *yaml.Node, keys []string, value string) error {
 		node = node.Content[0]
 	}
 
-	for i := range keys {
+	for i, key := range keys {
 		last := i == len(keys)-1
 
 		switch node.Kind {
 		case yaml.MappingNode:
-			node = yamlSetInMapping(node, keys, i, value, last)
+			node = yamlSetInMapping(node, key, value, last)
 		case yaml.SequenceNode:
 			next, err := yamlSetInSequence(node, keys, i, value, last)
 			if err != nil {
@@ -734,16 +647,14 @@ func yamlField(typ reflect.Type, key string) (reflect.StructField, bool) {
 	return reflect.StructField{}, false
 }
 
-// yamlSetInMapping resolves (creating if needed) the value node for the
-// path element keys[i] within a mapping node, setting it to value when it
-// is the final path element, and returns the node to descend into.
-func yamlSetInMapping(
-	node *yaml.Node, keys []string, i int, value string, last bool,
-) *yaml.Node {
+// yamlSetInMapping resolves (creating if needed) the value node for key
+// within a mapping node, setting it to value when it is the final path
+// element, and returns the node to descend into.
+func yamlSetInMapping(node *yaml.Node, key, value string, last bool) *yaml.Node {
 	var valueNode *yaml.Node
 
 	for j := 0; j+1 < len(node.Content); j += 2 {
-		if node.Content[j].Value == keys[i] {
+		if node.Content[j].Value == key {
 			valueNode = node.Content[j+1]
 
 			break
@@ -751,8 +662,13 @@ func yamlSetInMapping(
 	}
 
 	if valueNode == nil {
-		keyNode := &yaml.Node{Kind: yaml.ScalarNode, Value: keys[i]}
-		valueNode = newPathNode(keys, i, value)
+		keyNode := &yaml.Node{Kind: yaml.ScalarNode, Value: key}
+
+		valueNode = &yaml.Node{Kind: yaml.MappingNode}
+		if last {
+			valueNode = &yaml.Node{Kind: yaml.ScalarNode, Value: value}
+		}
+
 		node.Content = append(node.Content, keyNode, valueNode)
 	} else if last {
 		setScalar(valueNode, value)
@@ -780,7 +696,12 @@ func yamlSetInSequence(
 	}
 
 	if idx == len(node.Content) {
-		node.Content = append(node.Content, newPathNode(keys, i, value))
+		newNode := &yaml.Node{Kind: yaml.MappingNode}
+		if last {
+			newNode = &yaml.Node{Kind: yaml.ScalarNode, Value: value}
+		}
+
+		node.Content = append(node.Content, newNode)
 	} else if last {
 		setScalar(node.Content[idx], value)
 	}
@@ -788,22 +709,6 @@ func yamlSetInSequence(
 	return node.Content[idx], nil
 }
 
-// newPathNode returns the node to create for the missing path element
-// keys[i]: the value when it is the final path element, otherwise an empty
-// list when the next path element is a number and an empty map when not.
-func newPathNode(keys []string, i int, value string) *yaml.Node {
-	if i == len(keys)-1 {
-		return &yaml.Node{Kind: yaml.ScalarNode, Value: value}
-	}
-
-	_, err := strconv.Atoi(keys[i+1])
-	if err == nil {
-		return &yaml.Node{Kind: yaml.SequenceNode}
-	}
-
-	return &yaml.Node{Kind: yaml.MappingNode}
-}
-
 // setScalar overwrites a node in place with a plain scalar value.
 func setScalar(n *yaml.Node, value string) {
 	n.Kind = yaml.ScalarNode

internal/cli/config_test.go

@@ -58,17 +58,14 @@ func TestDefaultConfigTemplateParses(t *testing.T) {
 	}
 }
 
-// testRecipient is a valid age public key.
-const testRecipient = "age1278m9q7dp3chsh2dcy82qk27v047zywyvtxwnj4cvt0z65jw6a7q5dqhfj"
-
 // TestConfigSetRecipientOnFreshConfig follows the README quickstart: on the
 // file `config init` writes, `config set age_recipients.0` and
 // `config set storage_url` give a config that loads with that recipient.
-// Neither is refused, although the config does not load until both are set;
-// once it loads, a recipient that is not a valid key is.
 func TestConfigSetRecipientOnFreshConfig(t *testing.T) {
 	t.Parallel()
 
+	const recipient = "age1278m9q7dp3chsh2dcy82qk27v047zywyvtxwnj4cvt0z65jw6a7q5dqhfj"
+
 	path := filepath.Join(t.TempDir(), "config.yml")
 
 	err := os.WriteFile(path, []byte(defaultConfigTemplate), configFileMode)
@@ -78,7 +75,7 @@ func TestConfigSetRecipientOnFreshConfig(t *testing.T) {
 
 	out := ui.NewWithColor(&bytes.Buffer{}, false)
 
-	err = writeConfigSet(out, path, "age_recipients.0", testRecipient)
+	err = writeConfigSet(out, path, "age_recipients.0", recipient)
 	if err != nil {
 		t.Fatalf("config set age_recipients.0: %v", err)
 	}
@@ -93,211 +90,8 @@ func TestConfigSetRecipientOnFreshConfig(t *testing.T) {
 		t.Fatalf("config.Load: %v", err)
 	}
 
-	if len(cfg.AgeRecipients) != 1 || cfg.AgeRecipients[0] != testRecipient {
-		t.Errorf("age_recipients = %v, want [%s]", cfg.AgeRecipients, testRecipient)
-	}
-
-	err = writeConfigSet(out, path, "age_recipients.0", "notakey")
-	if err == nil || !strings.Contains(err.Error(), "not a valid recipient") {
-		t.Errorf("config set age_recipients.0 notakey gives error %v, "+
-			"want one saying it is not a valid recipient", err)
-	}
-
-	_, err = config.Load(path)
-	if err != nil {
-		t.Errorf("config.Load after the refused change: %v", err)
-	}
-}
-
-// configWithoutRecipients loads, but has no age_recipients key and no
-// snapshot named work.
-const configWithoutRecipients = `storage_url: file:///mnt/backups
-snapshots:
-  home:
-    paths:
-      - "~"
-`
-
-// configWithUnsetReference loads only where VAULTIK_TEST_UNSET_SECRET is
-// set, as a backup job's environment might set it. No test sets it.
-const configWithUnsetReference = configWithoutRecipients + `s3:
-  secret_access_key: ${ENV:VAULTIK_TEST_UNSET_SECRET}
-`
-
-// configWithLevelReference returns configWithoutRecipients with a ${FILE:...}
-// reference on compression_level to a file holding 9, so that the config
-// loads once the reference is filled in.
-func configWithLevelReference(t *testing.T) string {
-	t.Helper()
-
-	levelPath := filepath.Join(t.TempDir(), "level")
-
-	err := os.WriteFile(levelPath, []byte("9"), configFileMode)
-	if err != nil {
-		t.Fatalf("write level: %v", err)
-	}
-
-	return configWithoutRecipients +
-		"compression_level: ${FILE:" + levelPath + "}\n"
-}
-
-// TestConfigSetIndexUnderMissingKey checks that a list index under a key
-// the file does not have creates a list, and that the result loads.
-func TestConfigSetIndexUnderMissingKey(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		key   string
-		value string
-		field func(cfg *config.Config) []string
-	}{
-		{"age_recipients.0", testRecipient,
-			func(cfg *config.Config) []string { return cfg.AgeRecipients }},
-		{"snapshots.work.paths.0", "/srv/work",
-			func(cfg *config.Config) []string { return cfg.Snapshots["work"].Paths }},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.key, func(t *testing.T) {
-			t.Parallel()
-
-			path := filepath.Join(t.TempDir(), "config.yml")
-
-			err := os.WriteFile(path, []byte(configWithoutRecipients), configFileMode)
-			if err != nil {
-				t.Fatalf("write config: %v", err)
-			}
-
-			err = writeConfigSet(ui.NewWithColor(&bytes.Buffer{}, false),
-				path, tt.key, tt.value)
-			if err != nil {
-				t.Fatalf("config set %s: %v", tt.key, err)
-			}
-
-			cfg, err := config.Load(path)
-			if err != nil {
-				t.Fatalf("config.Load: %v", err)
-			}
-
-			got := tt.field(cfg)
-			if len(got) != 1 || got[0] != tt.value {
-				t.Errorf("%s gives %v, want [%s]", tt.key, got, tt.value)
-			}
-		})
-	}
-}
-
-// TestConfigSetKeepsFileThatWouldNotLoad checks that config set refuses a
-// change after which the config would not load, with an error giving the
-// reason, and leaves the file as it was. On the file `config init` writes,
-// which does not load until storage_url is set, and on one that cannot be
-// read here, only a value of the wrong type is refused.
-func TestConfigSetKeepsFileThatWouldNotLoad(t *testing.T) {
-	t.Parallel()
-
-	levelReference := configWithLevelReference(t)
-
-	tests := []struct {
-		config string
-		key    string
-		value  string
-		reason string
-	}{
-		// Index 1 of the empty list the missing key gives.
-		{configWithoutRecipients, "age_recipients.1", testRecipient,
-			"index out of range"},
-		// A list set to a single value.
-		{configWithoutRecipients, "snapshots.home.paths", "/srv",
-			"into []string"},
-		{configWithoutRecipients, "chunk_size", "fast",
-			"invalid size format"},
-		// Values of the right type that fail validation.
-		{configWithoutRecipients, "compression_level", "99",
-			"compression_level must be between 1 and 19"},
-		{configWithoutRecipients, "chunk_size", "1KB",
-			"chunk_size must be at least 1MB"},
-		// With its reference filled in, the config loads.
-		{levelReference, "blob_size_limit", "1MB",
-			"blob_size_limit must be at least"},
-		// The type check on a config that does not load yet.
-		{defaultConfigTemplate, "snapshots.apps.paths", "/srv",
-			"into []string"},
-		// The type check on a config that cannot be read here.
-		{configWithUnsetReference, "snapshots.home.paths", "/x",
-			"cannot unmarshal !!str `/x`"},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.key+" "+tt.value, func(t *testing.T) {
-			t.Parallel()
-
-			path := filepath.Join(t.TempDir(), "config.yml")
-
-			err := os.WriteFile(path, []byte(tt.config), configFileMode)
-			if err != nil {
-				t.Fatalf("write config: %v", err)
-			}
-
-			err = writeConfigSet(ui.NewWithColor(&bytes.Buffer{}, false),
-				path, tt.key, tt.value)
-			if err == nil || !strings.Contains(err.Error(), tt.reason) {
-				t.Errorf("config set %s %s gives error %v, want one saying %q",
-					tt.key, tt.value, err, tt.reason)
-			}
-
-			data, err := os.ReadFile(path) //nolint:gosec // G304: test-controlled path
-			if err != nil {
-				t.Fatalf("read config: %v", err)
-			}
-
-			if string(data) != tt.config {
-				t.Errorf("config set %s changed the file to:\n%s",
-					tt.key, data)
-			}
-		})
-	}
-}
-
-// TestConfigSetRefusesOnlyItsOwnFailure checks that setting another key
-// works on a config with a ${...} reference on compression_level, which
-// loads because loading fills the reference in, on one whose
-// compression_level already fails to load, and on one with a reference
-// that cannot be filled in here.
-func TestConfigSetRefusesOnlyItsOwnFailure(t *testing.T) {
-	t.Parallel()
-
-	configs := map[string]string{
-		"reference":       configWithLevelReference(t),
-		"failing":         configWithoutRecipients + "compression_level: fast\n",
-		"unset reference": configWithUnsetReference,
-	}
-
-	for name, configYAML := range configs {
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			path := filepath.Join(t.TempDir(), "config.yml")
-
-			err := os.WriteFile(path, []byte(configYAML), configFileMode)
-			if err != nil {
-				t.Fatalf("write config: %v", err)
-			}
-
-			err = writeConfigSet(ui.NewWithColor(&bytes.Buffer{}, false),
-				path, "hostname", "myhost")
-			if err != nil {
-				t.Fatalf("config set hostname: %v", err)
-			}
-
-			data, err := os.ReadFile(path) //nolint:gosec // G304: test-controlled path
-			if err != nil {
-				t.Fatalf("read config: %v", err)
-			}
-
-			if !strings.Contains(string(data), "hostname: myhost") {
-				t.Errorf("config set hostname wrote:\n%s", data)
-			}
-		})
+	if len(cfg.AgeRecipients) != 1 || cfg.AgeRecipients[0] != recipient {
+		t.Errorf("age_recipients = %v, want [%s]", cfg.AgeRecipients, recipient)
 	}
 }
 

internal/config/config.go

@@ -4,7 +4,6 @@
 package config
 
 import (
-	"bytes"
 	"errors"
 	"fmt"
 	"os"
@@ -234,48 +233,14 @@ func New(path Path) (*Config, error) {
 	return cfg, nil
 }
 
-// Load reads the configuration file at path, parses it with Parse, warns
-// when others can read the file, and validates the configuration.
-// Returns an error if the file cannot be read, parsed, or if validation
-// fails.
+// Load reads and parses the configuration file from the specified path.
+// It applies default values for optional fields, performs environment variable
+// substitution using smartconfig, and validates the configuration.
+// The configuration file should be in YAML format. Returns an error if the file
+// cannot be read, parsed, or if validation fails.
 func Load(path string) (*Config, error) {
-	data, err := os.ReadFile(path) //nolint:gosec // G304: config path is operator-supplied
-	if err != nil {
-		return nil, fmt.Errorf("failed to load config file: %w", err)
-	}
-
-	cfg, err := Parse(data)
-	if err != nil {
-		return nil, err
-	}
-
-	// Check config file permissions (warn if world or group readable)
-	//nolint:gosec // G703: config path is operator-supplied by design
-	info, statErr := os.Stat(path)
-	if statErr == nil {
-		mode := info.Mode().Perm()
-		if mode&0044 != 0 { // group or world readable
-			log.Warn(cfg.readableByOthersWarning(),
-				"path", path,
-				"mode", fmt.Sprintf("%04o", mode),
-				"recommendation", "chmod 600 "+path)
-		}
-	}
-
-	err = cfg.Validate()
-	if err != nil {
-		return nil, fmt.Errorf("invalid config: %w", err)
-	}
-
-	return cfg, nil
-}
-
-// Parse reads YAML config data as Load does, without validating it. It
-// applies default values for optional fields, fills in ${...} references
-// using smartconfig, and expands ~ in paths.
-func Parse(data []byte) (*Config, error) {
 	// Load config using smartconfig for interpolation
-	sc, err := smartconfig.NewFromReader(bytes.NewReader(data))
+	sc, err := smartconfig.NewFromConfigPath(path)
 	if err != nil {
 		return nil, fmt.Errorf("failed to load config file: %w", err)
 	}
@@ -337,6 +302,24 @@ func Parse(data []byte) (*Config, error) {
 		cfg.S3.Region = "us-east-1"
 	}
 
+	// Check config file permissions (warn if world or group readable)
+	//nolint:gosec // G703: config path is operator-supplied by design
+	info, statErr := os.Stat(path)
+	if statErr == nil {
+		mode := info.Mode().Perm()
+		if mode&0044 != 0 { // group or world readable
+			log.Warn(cfg.readableByOthersWarning(),
+				"path", path,
+				"mode", fmt.Sprintf("%04o", mode),
+				"recommendation", "chmod 600 "+path)
+		}
+	}
+
+	err = cfg.Validate()
+	if err != nil {
+		return nil, fmt.Errorf("invalid config: %w", err)
+	}
+
 	return cfg, nil
 }
 

internal/vaultik/nuke_remote_test.go

@@ -18,8 +18,7 @@ import (
 // TestNukeRemoteLeavesNoFiles checks that remote nuke leaves no file
 // under a file:// destination, including the `.partial` files uploads
 // killed part-way leave next to a snapshot's metadata and next to where a
-// blob would have been, a snapshot's database whose manifest was never
-// uploaded, and a file under blobs/ whose name is not a blob hash.
+// blob would have been.
 func TestNukeRemoteLeavesNoFiles(t *testing.T) {
 	log.Initialize(log.Config{})
 	t.Parallel()
@@ -39,9 +38,6 @@ func TestNukeRemoteLeavesNoFiles(t *testing.T) {
 			"db.zst.age-123456.partial"),
 		filepath.Join(storeDir, "blobs", hash[:2], hash[2:4],
 			hash+"-123456.partial"),
-		filepath.Join(storeDir, "metadata",
-			snapshot.RemoteSnapshotKey("no-manifest"), "db.zst.age"),
-		filepath.Join(storeDir, "blobs", "0b", "01", ".DS_Store"),
 	}
 
 	for _, leftover := range leftovers {
@@ -104,34 +100,6 @@ func TestNukeRemoteFailsWhenADeleteFails(t *testing.T) {
 	}
 }
 
-// TestNukeRemoteNamesWhatIsLeft checks that remote nuke, when an object
-// it does not recognise cannot be deleted, does not report the store
-// empty but names that object and fails.
-func TestNukeRemoteNamesWhatIsLeft(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	ctx := context.Background()
-	storeDir := filepath.Join(t.TempDir(), "store")
-	v, _, out := backUpToFileDestination(ctx, t, storeDir)
-
-	const leftKey = "blobs/0b/01/.DS_Store"
-
-	leftPath := filepath.Join(storeDir, filepath.FromSlash(leftKey))
-	require.NoError(t, os.MkdirAll(filepath.Dir(leftPath), 0o750))
-	require.NoError(t, os.WriteFile(leftPath, []byte("finder"), 0o600))
-
-	store := faultstore.New(v.Storage)
-	store.OnDelete = func(key string) bool { return key == leftKey }
-	v.Storage = store
-
-	require.Error(t, v.NukeRemote(true))
-
-	assert.Contains(t, out.String(), leftKey)
-	assert.NotContains(t, out.String(), "now empty")
-	assert.Contains(t, out.String(), "vaultik remote nuke --force")
-}
-
 // TestNukeRemoteRefusesAnotherDestinationWithoutRetryAdvice checks that
 // remote nuke, when the local index belongs to a different destination
 // than the configured one, fails without advising to run nuke again:

internal/vaultik/prune.go

@@ -22,11 +22,6 @@ var errNukeRequiresForce = errors.New(
 // errBlobDeleteFailed reports unreferenced blobs prune could not delete.
 var errBlobDeleteFailed = errors.New("blob(s) could not be deleted")
 
-// errObjectsLeft reports objects remote nuke still finds on the backup
-// destination store after deleting.
-var errObjectsLeft = errors.New(
-	"object(s) still on the backup destination store")
-
 // nukeCommandHint is the command suggested when a remote nuke could not
 // delete everything: running it again deletes what is left, which
 // `vaultik prune` does not do for snapshot metadata.
@@ -40,11 +35,10 @@ const metadataDirName = "metadata"
 // (blobs/<aa>/<bb>/<hash>).
 const blobKeyParts = 4
 
-// NukeRemote deletes every object under metadata/ and blobs/ in remote
-// storage, whatever its name, along with any object an upload cut off
-// part-way left under a temporary `.partial` name. It returns
-// successfully only when a listing afterwards finds nothing left there,
-// and the next backup then starts from scratch.
+// NukeRemote deletes every snapshot's metadata and every blob from remote
+// storage, along with any object an upload cut off part-way left under a
+// temporary `.partial` name. After this returns successfully the bucket
+// prefix is empty and the next backup starts from scratch.
 //
 // Refuses to run unless force is true. The caller is responsible for
 // confirming with the user.
@@ -74,8 +68,7 @@ func (v *Vaultik) NukeRemote(force bool) error {
 }
 
 // emptyDestinationStore does the deleting for NukeRemote and stops at
-// the first step that fails. It also fails when objects are still
-// listed at the end, naming each one.
+// the first step that fails.
 func (v *Vaultik) emptyDestinationStore() error {
 	v.UI.Beginf("Removing all snapshot metadata from backup destination store.")
 
@@ -84,62 +77,25 @@ func (v *Vaultik) emptyDestinationStore() error {
 		return fmt.Errorf("removing all snapshots: %w", err)
 	}
 
-	v.UI.Beginf("Removing everything still present in backup destination store.")
+	v.UI.Beginf("Removing any blobs still present in backup destination store.")
 
-	var left []string
+	err = v.PruneBlobs(&PruneOptions{Force: true})
+	if err != nil {
+		return fmt.Errorf("pruning blobs: %w", err)
+	}
 
+	// The file and rclone listings skip `.partial` objects, so the two
+	// steps above never delete them.
 	for _, prefix := range []string{"metadata/", "blobs/"} {
-		keys, err := v.deleteEverythingUnder(prefix)
+		err = v.Storage.DeletePartialUploads(v.ctx, prefix)
 		if err != nil {
-			return err
+			return fmt.Errorf("deleting partial uploads: %w", err)
 		}
-
-		left = append(left, keys...)
-	}
-
-	for _, key := range left {
-		v.UI.Warningf("Still on the backup destination store: %s", key)
-	}
-
-	if len(left) > 0 {
-		return fmt.Errorf("%d %w", len(left), errObjectsLeft)
 	}
 
 	return nil
 }
 
-// deleteEverythingUnder deletes every object under prefix, whatever its
-// name, and returns the keys a listing afterwards still finds. A delete
-// that fails is logged and the others still run; that object then
-// shows up in the listing afterwards.
-func (v *Vaultik) deleteEverythingUnder(prefix string) ([]string, error) {
-	keys, err := v.Storage.List(v.ctx, prefix)
-	if err != nil {
-		return nil, fmt.Errorf("listing %s: %w", prefix, err)
-	}
-
-	for _, key := range keys {
-		err = v.Storage.Delete(v.ctx, key)
-		if err != nil {
-			log.Error("Failed to delete object", "key", key, "error", err)
-		}
-	}
-
-	// The file and rclone listings skip `.partial` objects, so the
-	// deletes above never reach them.
-	err = v.Storage.DeletePartialUploads(v.ctx, prefix)
-	if err != nil {
-		return nil, fmt.Errorf("deleting partial uploads: %w", err)
-	}
-
-	left, err := v.Storage.List(v.ctx, prefix)
-	if err != nil {
-		return nil, fmt.Errorf("listing %s: %w", prefix, err)
-	}
-
-	return left, nil
-}
-
 // PruneBlobsResult contains the result of a blob prune operation
 //
 //nolint:tagliatelle // snake_case is the established JSON output format
@@ -212,17 +168,14 @@ func (v *Vaultik) PruneBlobs(opts *PruneOptions) error {
 	log.Info("Found unreferenced blobs",
 		"count", len(unreferencedBlobs), "total_size", ubytes(totalSize))
 
-	if opts.Force && !opts.JSON {
+	if !opts.JSON {
 		v.UI.Infof("Found %d unreferenced blob(s) totaling %s.",
 			len(unreferencedBlobs), ubytes(totalSize))
 	}
 
 	if !opts.Force && !opts.JSON {
-		// The count, the prompt and its answer bypass the UI: they are an
-		// interactive exchange the operator must see, so --quiet does not
-		// silence them.
-		v.stdoutf("Found %d unreferenced blob(s) totaling %s.\n",
-			len(unreferencedBlobs), ubytes(totalSize))
+		// The prompt and its answer bypass the UI: they are an interactive
+		// exchange the operator must see, so --quiet does not silence them.
 		v.stdoutf("\nDelete %d unreferenced blob(s)? [y/N] ", len(unreferencedBlobs))
 
 		var confirm string

internal/vaultik/remove_quiet_test.go

@@ -38,53 +38,6 @@ func TestPurgeSnapshots_QuietSuppressesReport(t *testing.T) {
 	assert.Empty(t, out.String())
 }
 
-// TestPurgeSnapshots_QuietPromptListsSnapshots checks that `snapshot
-// purge --keep-latest` without --force still lists the snapshots its
-// prompt asks to delete under --quiet.
-func TestPurgeSnapshots_QuietPromptListsSnapshots(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	v := setupPurgeTest(t, snapHostname, []string{snapHomeT0, snapHomeT1})
-
-	var out bytes.Buffer
-
-	v.Stdout = &out
-	v.UI = ui.NewWithColor(&out, false)
-	v.UI.SetQuiet(true)
-
-	// Stdin is empty, so the prompt reads no answer and cancels.
-	require.NoError(t, v.PurgeSnapshotsWithOptions(&vaultik.SnapshotPurgeOptions{
-		KeepLatest: true,
-	}))
-
-	assert.Contains(t, out.String(), snapHomeT0)
-	assert.Contains(t, out.String(), "Delete 1 snapshot(s)? [y/N]")
-	assert.Len(t, listRemainingSnapshots(t, v), 2)
-}
-
-// TestPruneBlobs_QuietPromptShowsBlobTotal checks that `prune` without
-// --force still states the count and total size of the blobs its prompt
-// asks to delete under --quiet.
-func TestPruneBlobs_QuietPromptShowsBlobTotal(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	env := newListEnv(t)
-	env.v.UI.SetQuiet(true)
-
-	// The store holds no manifest, so nothing references this blob.
-	addBlob(t, env.store.testStorer, testBlobHashA)
-
-	// Stdin is empty, so the prompt reads no answer and cancels.
-	require.NoError(t, env.v.PruneBlobs(&vaultik.PruneOptions{}))
-
-	assert.Contains(t, env.stdout.String(),
-		"Found 1 unreferenced blob(s) totaling")
-	assert.Contains(t, env.stdout.String(),
-		"Delete 1 unreferenced blob(s)? [y/N]")
-}
-
 // TestRemoveSnapshot_QuietSuppressesReport checks that `snapshot remove`
 // under --quiet prints nothing with --dry-run or with --force, and that
 // the --json document still prints.

internal/vaultik/remove_snapshot_test.go

@@ -350,7 +350,7 @@ func TestRemoveSnapshot_DryRun(t *testing.T) {
 	assert.True(t, store.hasKey("blobs/aa/aa/"+blobA))
 	assert.True(t, store.hasKey(remoteKeyPath("snapshot-001")))
 
-	assert.Contains(t, tv.Stdout.String(), "Dry run: no changes made.")
+	assert.Contains(t, tv.Stdout.String(), "[Dry run - no changes made]")
 }
 
 // TestRemoveSnapshot_UnknownIDIsError checks that an ID naming no
@@ -504,7 +504,7 @@ func TestRemoveAllSnapshots_DryRun(t *testing.T) {
 
 	assert.Equal(t, initialCount, store.keyCount())
 
-	assert.Contains(t, tv.Stdout.String(), "Dry run: no changes made.")
+	assert.Contains(t, tv.Stdout.String(), "[Dry run - no changes made]")
 }
 
 func TestRemoveAllSnapshots_NoSnapshots(t *testing.T) {

internal/vaultik/snapshot.go

@@ -631,19 +631,21 @@ func selectSnapshotsToPurge(
 func (v *Vaultik) confirmAndExecutePurge(
 	toDelete []SnapshotInfo, force, quiet bool,
 ) error {
-	// Confirm unless --force is used. The list, the prompt and its answer
-	// bypass the UI: they are an interactive exchange the operator must
-	// see, so --quiet does not silence them.
-	if !force {
-		v.stdoutf("The following snapshots will be deleted:\n\n")
+	if !quiet {
+		v.UI.Infof("The following snapshots will be deleted:")
 
 		for _, snap := range toDelete {
-			v.stdoutf("  %s (%s, %s)\n",
-				snap.ID,
-				snap.Timestamp.Format(time.DateTime),
+			v.UI.Detailf("%s (%s, %s)",
+				v.UI.Snapshot(snap.ID.String()),
+				snap.Timestamp.Format("2006-01-02 15:04:05"),
 				ubytes(snap.CompressedSize))
 		}
+	}
 
+	// Confirm unless --force is used. The prompt and its answer bypass the
+	// UI: they are an interactive exchange the operator must see, so
+	// --quiet does not silence them.
+	if !force {
 		v.stdoutf("\nDelete %d snapshot(s)? [y/N] ", len(toDelete))
 
 		var confirm string
@@ -661,15 +663,6 @@ func (v *Vaultik) confirmAndExecutePurge(
 			return nil
 		}
 	} else if !quiet {
-		v.UI.Infof("The following snapshots will be deleted:")
-
-		for _, snap := range toDelete {
-			v.UI.Detailf("%s (%s, %s)",
-				v.UI.Snapshot(snap.ID.String()),
-				snap.Timestamp.Format(time.DateTime),
-				ubytes(snap.CompressedSize))
-		}
-
 		v.UI.Infof("Deleting %d snapshot(s) (--force specified).", len(toDelete))
 	}
 
@@ -1352,7 +1345,7 @@ func (v *Vaultik) removeSnapshotDryRun(
 			"remote storage (blobs untouched).")
 	}
 
-	v.UI.Noticef("Dry run: no changes made.")
+	v.UI.Noticef("[Dry run - no changes made]")
 
 	return result, nil
 }
@@ -1592,7 +1585,7 @@ func (v *Vaultik) handleRemoveAllDryRun(
 			}
 		}
 
-		v.UI.Noticef("Dry run: no changes made.")
+		v.UI.Noticef("[Dry run - no changes made]")
 	}
 
 	if opts.JSON {