Keep the progress line of a multi-path snapshot within 100% (closes #271)

One progress reporter spans every path of a snapshot. Its counts of
files and bytes processed run across all the paths, while the totals
they were divided by were reset to each path's own, so a second path
smaller than the first showed more than 100% and an ETA of `unknown`.
The totals now add up over the paths scanned so far. The rate behind
the ETA is measured from the bytes processed since the current path's
scan phase ended, so a later path's scan phase does not lower it.
SetTotalSize is renamed AddTotalSize because it now adds.

The issue says the ETA went negative; it was computed negative and
printed as `unknown`.

Model: opus-5-5

README.md

@@ -359,7 +359,8 @@ on the destination in one go, use `vaultik remote nuke --force`.
 * `--local-only`: Skip remote cleanup; only touch the local index
 * `--dry-run`: Show what would be deleted without deleting
 * `--force`: Skip confirmation prompt
-* `--json`: Output result as JSON
+* `--json`: Output result as JSON. Also skips the confirmation prompt, as
+  `--force` does.
 
 **`snapshot restore`**: Restore files from a backup snapshot.
 * Requires `VAULTIK_AGE_SECRET_KEY` environment variable
@@ -383,7 +384,8 @@ manifests — network cost scales with the number of snapshots. `snapshot
 create --prune` runs the same cleanup automatically; this is the
 manual entry point for the same work.
 * `--force`: Skip confirmation prompt
-* `--json`: Output stats as JSON
+* `--json`: Output stats as JSON. Also skips the confirmation prompt, as
+  `--force` does.
 
 **`info`**: Display system configuration, storage settings, encryption
 recipients, and local database statistics.

TODO.md

@@ -28,8 +28,9 @@ the tag exists and is exercised; what is left is merging `next` to
   bytes and files processed counted every path, but the totals they
   were divided by held only the current path's, so a second path
   smaller than the first showed more than 100% and an ETA of `unknown`.
-  The totals now add up over the paths scanned so far, and the rate is
-  measured from when the first path's processing started.
+  The totals now add up over the paths scanned so far, and the rate
+  behind the ETA covers the current path's processing only, so a later
+  path's scan phase does not lower it.
 
 - 2026-10-08: Made a second `snapshot create` of one name succeed when
   it starts in the same second as the first
@@ -39,6 +40,14 @@ the tag exists and is exercised; what is left is merging `next` to
   snapshots.id`. When the local index already has a snapshot with the
   ID, the create now waits a second and takes a new timestamp.
 
+- 2026-10-07: Documented that `--json` skips the confirmation prompt of
+  `snapshot remove` and `prune`
+  ([issue #268](https://git.eeqj.de/sneak/vaultik/issues/268)). Both
+  commands delete without asking under `--json`, since a prompt on stdout
+  would break the JSON document, but the help and the README described
+  only `--force` as skipping it. The `--json` help of both commands and
+  their README entries now say so.
+
 - 2026-10-07: Made a symlink whose target cannot be read stop the backup
   ([issue #269](https://git.eeqj.de/sneak/vaultik/issues/269)). It was
   left out of the snapshot with only a debug log line, even without

internal/cli/json_help_test.go

@@ -0,0 +1,24 @@
+package cli //nolint:testpackage // exercises the unexported command constructor
+
+import (
+	"testing"
+
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/assert"
+)
+
+// TestJSONHelpSaysConfirmationPromptIsSkipped checks that the --json help
+// of `snapshot remove` and `prune` says the flag skips the confirmation
+// prompt. Both delete without asking under --json, since a prompt on
+// stdout would break the JSON document.
+func TestJSONHelpSaysConfirmationPromptIsSkipped(t *testing.T) {
+	t.Parallel()
+
+	for _, cmd := range []*cobra.Command{
+		newSnapshotRemoveCommand(),
+		NewPruneCommand(),
+	} {
+		assert.Contains(t, cmd.Flags().Lookup("json").Usage,
+			"skips the confirmation prompt", cmd.Name())
+	}
+}

internal/cli/prune.go

@@ -57,7 +57,8 @@ referenced.`,
 	}
 
 	cmd.Flags().BoolVar(&opts.Force, "force", false, "Skip confirmation prompt")
-	cmd.Flags().BoolVar(&opts.JSON, "json", false, "Output pruning stats as JSON")
+	cmd.Flags().BoolVar(&opts.JSON, "json", false,
+		"Output pruning stats as JSON; skips the confirmation prompt, as --force does")
 
 	return cmd
 }

internal/cli/snapshot.go

@@ -280,7 +280,8 @@ nuke --force' — it is the single supported entry point for that.`,
 	cmd.Flags().BoolVarP(&opts.Force, "force", "f", false, "Skip confirmation prompt")
 	cmd.Flags().BoolVar(&opts.DryRun, "dry-run", false,
 		"Show what would be removed without removing")
-	cmd.Flags().BoolVar(&opts.JSON, "json", false, "Output result as JSON")
+	cmd.Flags().BoolVar(&opts.JSON, "json", false,
+		"Output result as JSON; skips the confirmation prompt, as --force does")
 	cmd.Flags().BoolVar(&opts.LocalOnly, "local-only", false,
 		"Skip remote cleanup; only touch the local index")
 

internal/snapshot/progress.go

@@ -69,11 +69,15 @@ type ProgressStats struct {
 	CurrentFile    atomic.Value // stores string
 	TotalSize      atomic.Int64 // Size to process in the paths scanned so far
 	TotalFiles     atomic.Int64 // Files to process in the paths scanned so far
-	ProcessStartTime atomic.Value // stores time.Time; set by the first path
 	StartTime      time.Time
 	mu             sync.RWMutex
 	lastDetailTime time.Time
 
+	// Guarded by mu: when the current path's processing started, and
+	// BytesProcessed at that moment.
+	processStartTime  time.Time
+	processStartBytes int64
+
 	// Upload tracking
 	CurrentUpload    atomic.Value // stores *UploadInfo
 	lastChunkingTime time.Time    // Track when we last showed chunking progress
@@ -149,16 +153,35 @@ func (pr *ProgressReporter) GetStats() *ProgressStats {
 }
 
 // AddTotalSize adds the size one path of the snapshot has to process to
-// the total, once that path's scan phase is done. The processed counts
-// run across every path, so the total does too, and the processing start
-// time, which the rate is measured from, is the first path's.
+// the total, once that path's scan phase is done, and starts measuring
+// the processing rate again. The processed counts run across every path,
+// so the total does too. The rate covers the current path's processing
+// only, so that the scan phase of a later path, which processes nothing,
+// does not lower it.
 func (pr *ProgressReporter) AddTotalSize(size int64) {
 	pr.stats.TotalSize.Add(size)
 
-	_, started := pr.stats.ProcessStartTime.Load().(time.Time)
-	if !started {
-		pr.stats.ProcessStartTime.Store(time.Now().UTC())
+	pr.stats.mu.Lock()
+	defer pr.stats.mu.Unlock()
+
+	pr.stats.processStartTime = time.Now().UTC()
+	pr.stats.processStartBytes = pr.stats.BytesProcessed.Load()
 }
+
+// processRate returns the bytes processed per second since the current
+// path's processing started, or 0 before the first path's scan phase is
+// done.
+func (s *ProgressStats) processRate() float64 {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	if s.processStartTime.IsZero() {
+		return 0
+	}
+
+	processed := s.BytesProcessed.Load() - s.processStartBytes
+
+	return float64(processed) / time.Since(s.processStartTime).Seconds()
 }
 
 // Helper functions
@@ -364,20 +387,13 @@ func (pr *ProgressReporter) printSummaryStatus() {
 	// Calculate ETA if we have total size and are processing
 	etaStr := ""
 
-	if totalSize > 0 && bytesProcessed > 0 {
-		processStart, ok := pr.stats.ProcessStartTime.Load().(time.Time)
-		if ok && !processStart.IsZero() {
-			processElapsed := time.Since(processStart)
-
-			rate := float64(bytesProcessed) / processElapsed.Seconds()
-			if rate > 0 {
+	processRate := pr.stats.processRate()
+	if totalSize > 0 && processRate > 0 {
 		remainingBytes := totalSize - bytesProcessed
-				remainingSeconds := float64(remainingBytes) / rate
+		remainingSeconds := float64(remainingBytes) / processRate
 		eta := time.Duration(remainingSeconds * float64(time.Second))
 		etaStr = " | ETA: " + formatDuration(eta)
 	}
-		}
-	}
 
 	rate := float64(bytesScanned+bytesSkipped) / elapsed.Seconds()
 
@@ -428,13 +444,8 @@ func (pr *ProgressReporter) printDetailedStatus() {
 	log.Info("Elapsed time", "duration", formatDuration(elapsed))
 
 	// Calculate and show ETA if we have data
-	if totalSize > 0 && bytesProcessed > 0 {
-		processStart, ok := pr.stats.ProcessStartTime.Load().(time.Time)
-		if ok && !processStart.IsZero() {
-			processElapsed := time.Since(processStart)
-
-			processRate := float64(bytesProcessed) / processElapsed.Seconds()
-			if processRate > 0 {
+	processRate := pr.stats.processRate()
+	if totalSize > 0 && processRate > 0 {
 		remainingBytes := totalSize - bytesProcessed
 		remainingSeconds := float64(remainingBytes) / processRate
 		eta := time.Duration(remainingSeconds * float64(time.Second))
@@ -446,8 +457,6 @@ func (pr *ProgressReporter) printDetailedStatus() {
 			"rate", humanize.Bytes(uint64(processRate))+"/s",
 			"eta", formatDuration(eta))
 	}
-		}
-	}
 
 	log.Info("Files processed",
 		"scanned", filesScanned,

internal/snapshot/progress_rate_test.go

@@ -0,0 +1,54 @@
+//nolint:testpackage // exercises the unexported processRate helper
+package snapshot
+
+import (
+	"testing"
+	"time"
+)
+
+// TestProcessRateNotLoweredByLaterScanPhase feeds the reporter two paths
+// that each take 10 seconds to process, the second after a 30-second scan
+// phase. That scan phase processes nothing, so the rate while the second
+// path is processed must be that path's own.
+func TestProcessRateNotLoweredByLaterScanPhase(t *testing.T) {
+	t.Parallel()
+
+	const (
+		pathSize       = 1000
+		processingTime = 10 * time.Second
+		scanTime       = 30 * time.Second
+	)
+
+	// Never started, but Stop releases its tickers and signal handler.
+	progress := NewProgressReporter()
+	defer progress.Stop()
+
+	stats := progress.GetStats()
+
+	// Moves the processing start time back instead of sleeping.
+	elapse := func(d time.Duration) {
+		stats.mu.Lock()
+		defer stats.mu.Unlock()
+
+		stats.processStartTime = stats.processStartTime.Add(-d)
+	}
+
+	progress.AddTotalSize(pathSize)
+	stats.BytesProcessed.Add(pathSize)
+	elapse(processingTime)
+
+	elapse(scanTime)
+	progress.AddTotalSize(pathSize)
+	stats.BytesProcessed.Add(pathSize)
+	elapse(processingTime)
+
+	want := pathSize / processingTime.Seconds()
+	got := stats.processRate()
+
+	// The test's own run time adds to the elapsed time, so got is a hair
+	// under want.
+	if got > want || got < want*0.99 {
+		t.Errorf("rate while the second path is processed is %.1f bytes/s, "+
+			"want %.1f", got, want)
+	}
+}

internal/vaultik/prune_json_test.go

@@ -0,0 +1,40 @@
+package vaultik_test
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"sneak.berlin/go/vaultik/internal/log"
+	"sneak.berlin/go/vaultik/internal/vaultik"
+)
+
+// TestPruneBlobs_JSONDeletesWithoutAsking checks that prune with --json
+// and without --force deletes an unreferenced blob without the
+// confirmation prompt. Stdin is empty, so a prompt would read no answer
+// and cancel, and its text would come before the JSON document.
+func TestPruneBlobs_JSONDeletesWithoutAsking(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	env := newListEnv(t)
+
+	// The store holds no manifest, so nothing references this blob.
+	addBlob(t, env.store.testStorer, testBlobHashA)
+
+	err := env.v.PruneBlobs(&vaultik.PruneOptions{JSON: true})
+	require.NoError(t, err)
+
+	blobKey := "blobs/" + testBlobHashA[:2] + "/" + testBlobHashA[2:4] +
+		"/" + testBlobHashA
+	assert.False(t, env.store.hasKey(blobKey),
+		"the unreferenced blob must be deleted")
+
+	var result vaultik.PruneBlobsResult
+
+	require.NoError(t, json.Unmarshal(env.stdout.Bytes(), &result),
+		"stdout must hold only the JSON document, got:\n%s",
+		env.stdout.String())
+	assert.Equal(t, 1, result.BlobsDeleted)
+}