Document that --json skips the confirmation prompt (closes #268)

snapshot remove and prune delete without asking under --json, because a
prompt on stdout would break the JSON document. Their --json help and
README entries named only --force as skipping the prompt. Both now say
--json skips it too. A test checks the --json help of both commands.

Model: opus-5-5

README.md

@@ -360,7 +360,8 @@ on the destination in one go, use `vaultik remote nuke --force`.
 * `--dry-run`: Show what would be deleted without deleting
 * `--force`: Skip confirmation prompt
 * `--json`: Output result as JSON. Also skips the confirmation prompt, as
-  `--force` does.
+  `--force` does, so `snapshot remove --json <snapshot-id>` removes without
+  asking.
 
 **`snapshot restore`**: Restore files from a backup snapshot.
 * Requires `VAULTIK_AGE_SECRET_KEY` environment variable
@@ -385,7 +386,7 @@ create --prune` runs the same cleanup automatically; this is the
 manual entry point for the same work.
 * `--force`: Skip confirmation prompt
 * `--json`: Output stats as JSON. Also skips the confirmation prompt, as
-  `--force` does.
+  `--force` does, so `prune --json` deletes unreferenced blobs without asking.
 
 **`info`**: Display system configuration, storage settings, encryption
 recipients, and local database statistics.

TODO.md

@@ -30,13 +30,6 @@ the tag exists and is exercised; what is left is merging `next` to
   only `--force` as skipping it. The `--json` help of both commands and
   their README entries now say so.
 
-- 2026-10-07: Made a symlink whose target cannot be read stop the backup
-  ([issue #269](https://git.eeqj.de/sneak/vaultik/issues/269)). It was
-  left out of the snapshot with only a debug log line, even without
-  `--skip-errors`. It now aborts the run, or with `--skip-errors` is
-  skipped with the `Failed to access` error line that any other entry
-  the scan cannot read gets.
-
 - 2026-10-07: Stopped a killed rclone upload from leaving a truncated
   object under its key
   ([issue #266](https://git.eeqj.de/sneak/vaultik/issues/266)). The

internal/snapshot/scanner.go

@@ -889,10 +889,9 @@ func (s *Scanner) scanPhase(
 		}
 
 		// Handle symlinks and directories
-		handled, err := s.recordSpecialEntry(
+		if handled := s.recordSpecialEntry(
-			filePath, info, existingFiles, collector, result)
+			filePath, info, existingFiles, collector, result); handled {
-		if handled {
+			return nil
-			return err
 		}
 
 		// Skip other non-regular files (devices, sockets, etc.)
@@ -934,25 +933,22 @@ func (s *Scanner) scanPhase(
 }
 
 // recordSpecialEntry records symlinks and directories (which have no
-// data to chunk) and reports whether it handled the entry. For a symlink
+// data to chunk) and reports whether it handled the entry.
-// whose target cannot be read it returns handleWalkError's result.
 func (s *Scanner) recordSpecialEntry(
 	filePath string, info os.FileInfo,
 	existingFiles map[string]struct{},
 	collector *scanCollector, result *ScanResult,
-) (bool, error) {
+) bool {
 	// Handle symlinks
 	if info.Mode()&os.ModeSymlink != 0 {
-		file, err := s.buildSymlinkEntry(filePath, info)
+		file := s.buildSymlinkEntry(filePath, info)
-		if err != nil {
+		if file != nil {
-			return true, s.handleWalkError(filePath, err)
+			existingFiles[filePath] = struct{}{}
+			collector.addToProcess(filePath, info, file)
+			s.updateScanEntryStats(result, true, info)
 		}
 
-		existingFiles[filePath] = struct{}{}
+		return true
-		collector.addToProcess(filePath, info, file)
-		s.updateScanEntryStats(result, true, info)
-
-		return true, nil
 	}
 
 	// Handle directories (record for permission/ownership preservation
@@ -962,10 +958,10 @@ func (s *Scanner) recordSpecialEntry(
 		existingFiles[filePath] = struct{}{}
 		collector.addToProcess(filePath, info, file)
 
-		return true, nil
+		return true
 	}
 
-	return false, nil
+	return false
 }
 
 // handleWalkError deals with a filesystem error surfaced by the walk:
@@ -1115,12 +1111,13 @@ func (s *Scanner) printScanProgressLine(
 }
 
 // buildSymlinkEntry creates a File record for a symlink.
-func (s *Scanner) buildSymlinkEntry(
+// Returns nil if the link target cannot be read.
-	path string, info os.FileInfo,
+func (s *Scanner) buildSymlinkEntry(path string, info os.FileInfo) *database.File {
-) (*database.File, error) {
 	target, err := os.Readlink(path)
 	if err != nil {
-		return nil, err
+		log.Debug("Cannot read symlink target", "path", path, "error", err)
+
+		return nil
 	}
 
 	var uid, gid uint32
@@ -1139,7 +1136,7 @@ func (s *Scanner) buildSymlinkEntry(
 		UID:        uid,
 		GID:        gid,
 		LinkTarget: types.FilePath(target),
-	}, nil
+	}
 }
 
 // buildDirectoryEntry creates a File record for a directory.

internal/snapshot/skip_errors_test.go

@@ -3,7 +3,6 @@ package snapshot_test
 import (
 	"context"
 	"errors"
-	"io"
 	"os"
 	"path/filepath"
 	"strings"
@@ -14,7 +13,6 @@ import (
 	"github.com/spf13/afero"
 	"sneak.berlin/go/vaultik/internal/database"
 	"sneak.berlin/go/vaultik/internal/snapshot"
-	"sneak.berlin/go/vaultik/internal/ui"
 )
 
 // errSimTempFail is the one-time temp-file creation failure blobTempFailFs
@@ -82,30 +80,6 @@ func (f *readFailFs) Open(name string) (afero.File, error) {
 	return file, nil
 }
 
-// linkRemovedAfterLstatFs is the real filesystem, except that the symlink at
-// target is removed right after the walk lstats it, as happens when a link is
-// deleted during a backup. The scanner's readlink of it then fails.
-type linkRemovedAfterLstatFs struct {
-	afero.OsFs
-
-	t      *testing.T
-	target string
-}
-
-func (f *linkRemovedAfterLstatFs) LstatIfPossible(
-	name string,
-) (os.FileInfo, bool, error) {
-	info, lstatCalled, err := f.OsFs.LstatIfPossible(name)
-	if err == nil && name == f.target {
-		rmErr := os.Remove(name)
-		if rmErr != nil {
-			f.t.Errorf("removing %s: %v", name, rmErr)
-		}
-	}
-
-	return info, lstatCalled, err
-}
-
 // writeSkipErrorTestFile writes one file into fs with a fixed mtime.
 func writeSkipErrorTestFile(t *testing.T, fs afero.Fs, path, content string) {
 	t.Helper()
@@ -128,11 +102,10 @@ func writeSkipErrorTestFile(t *testing.T, fs afero.Fs, path, content string) {
 	}
 }
 
-// runSkipErrorScan scans source on fs with the given skip-errors setting,
+// runSkipErrorScan scans /source on fs with the given skip-errors setting and
-// printing user-facing messages to uiw (nil discards them), and returns the
+// returns the repositories (for inspection) and the scan error.
-// repositories (for inspection) and the scan error.
 func runSkipErrorScan(
-	t *testing.T, fs afero.Fs, source string, skipErrors bool, uiw *ui.Writer,
+	t *testing.T, fs afero.Fs, skipErrors bool,
 ) (*database.Repositories, error) {
 	t.Helper()
 
@@ -157,7 +130,6 @@ func runSkipErrorScan(
 		MaxBlobSize:      int64(1024 * 1024),
 		CompressionLevel: 3,
 		AgeRecipients:    []string{testAgePublicKey},
-		UI:               uiw,
 		SkipErrors:       skipErrors,
 	})
 
@@ -165,7 +137,7 @@ func runSkipErrorScan(
 	snapshotID := "test-snapshot-skip-errors"
 	createTestSnapshotRecord(ctx, t, repos, snapshotID)
 
-	_, err = scanner.Scan(ctx, source, snapshotID)
+	_, err = scanner.Scan(ctx, "/source", snapshotID)
 
 	return repos, err
 }
@@ -185,7 +157,7 @@ func TestScannerPackingFailureAbortsUnderSkipErrors(t *testing.T) {
 	writeSkipErrorTestFile(t, fs, "/source/file1.txt", "first file content")
 	writeSkipErrorTestFile(t, fs, "/source/file2.txt", "second file content")
 
-	repos, err := runSkipErrorScan(t, fs, "/source", true, nil)
+	repos, err := runSkipErrorScan(t, fs, true)
 	if err == nil {
 		t.Fatal("expected scan to abort on the packer error, got nil")
 	}
@@ -212,7 +184,7 @@ func TestScannerReadErrorAbortsWithoutSkipErrors(t *testing.T) {
 	fs := &readFailFs{Fs: afero.NewMemMapFs(), target: target}
 	writeSkipErrorTestFile(t, fs, target, "content that cannot be read")
 
-	_, err := runSkipErrorScan(t, fs, "/source", false, nil)
+	_, err := runSkipErrorScan(t, fs, false)
 	if err == nil {
 		t.Fatal("expected scan to fail on the read error, got nil")
 	}
@@ -228,7 +200,7 @@ func TestScannerReadErrorSkippedWithSkipErrors(t *testing.T) {
 	fs := &readFailFs{Fs: afero.NewMemMapFs(), target: target}
 	writeSkipErrorTestFile(t, fs, target, "content that cannot be read")
 
-	repos, err := runSkipErrorScan(t, fs, "/source", true, nil)
+	repos, err := runSkipErrorScan(t, fs, true)
 	if err != nil {
 		t.Fatalf("expected scan to complete with --skip-errors, got %v", err)
 	}
@@ -242,63 +214,3 @@ func TestScannerReadErrorSkippedWithSkipErrors(t *testing.T) {
 		t.Fatalf("expected unreadable file skipped, got %d chunks", len(chunks))
 	}
 }
-
-// writeSymlinkSource creates a source directory on disk holding one symlink
-// and returns the directory and the symlink's path.
-func writeSymlinkSource(t *testing.T) (string, string) {
-	t.Helper()
-
-	sourceDir := t.TempDir()
-	linkPath := filepath.Join(sourceDir, "link")
-
-	err := os.Symlink("target.txt", linkPath)
-	if err != nil {
-		t.Fatalf("creating symlink: %v", err)
-	}
-
-	return sourceDir, linkPath
-}
-
-// TestScannerUnreadableSymlinkAbortsWithoutSkipErrors checks that a symlink
-// whose target cannot be read aborts the run when --skip-errors is not set.
-func TestScannerUnreadableSymlinkAbortsWithoutSkipErrors(t *testing.T) {
-	t.Parallel()
-
-	sourceDir, linkPath := writeSymlinkSource(t)
-	fs := &linkRemovedAfterLstatFs{t: t, target: linkPath}
-
-	_, err := runSkipErrorScan(t, fs, sourceDir, false, nil)
-	if !errors.Is(err, os.ErrNotExist) {
-		t.Fatalf("expected scan to fail on the removed symlink, got %v", err)
-	}
-}
-
-// TestScannerUnreadableSymlinkSkippedWithSkipErrors checks that a symlink
-// whose target cannot be read is skipped with an error line, and the run
-// completes, when --skip-errors is set.
-func TestScannerUnreadableSymlinkSkippedWithSkipErrors(t *testing.T) {
-	t.Parallel()
-
-	sourceDir, linkPath := writeSymlinkSource(t)
-	fs := &linkRemovedAfterLstatFs{t: t, target: linkPath}
-	uiw := ui.NewWithColor(io.Discard, false)
-
-	repos, err := runSkipErrorScan(t, fs, sourceDir, true, uiw)
-	if err != nil {
-		t.Fatalf("expected scan to complete with --skip-errors, got %v", err)
-	}
-
-	if uiw.ErrorCount() != 1 {
-		t.Fatalf("expected one error line for the symlink, got %d",
-			uiw.ErrorCount())
-	}
-
-	file, err := repos.Files.GetByPath(context.Background(), linkPath)
-	if err != nil {
-		t.Fatalf("getting %s: %v", linkPath, err)
-	}
-
-	if file != nil {
-		t.Fatalf("expected %s not to be recorded", linkPath)
-	}
-}

internal/vaultik/prune_json_test.go

@@ -1,40 +0,0 @@
-package vaultik_test
-
-import (
-	"encoding/json"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"sneak.berlin/go/vaultik/internal/log"
-	"sneak.berlin/go/vaultik/internal/vaultik"
-)
-
-// TestPruneBlobs_JSONDeletesWithoutAsking checks that prune with --json
-// and without --force deletes an unreferenced blob without the
-// confirmation prompt. Stdin is empty, so a prompt would read no answer
-// and cancel, and its text would come before the JSON document.
-func TestPruneBlobs_JSONDeletesWithoutAsking(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	env := newListEnv(t)
-
-	// The store holds no manifest, so nothing references this blob.
-	addBlob(t, env.store.testStorer, testBlobHashA)
-
-	err := env.v.PruneBlobs(&vaultik.PruneOptions{JSON: true})
-	require.NoError(t, err)
-
-	blobKey := "blobs/" + testBlobHashA[:2] + "/" + testBlobHashA[2:4] +
-		"/" + testBlobHashA
-	assert.False(t, env.store.hasKey(blobKey),
-		"the unreferenced blob must be deleted")
-
-	var result vaultik.PruneBlobsResult
-
-	require.NoError(t, json.Unmarshal(env.stdout.Bytes(), &result),
-		"stdout must hold only the JSON document, got:\n%s",
-		env.stdout.String())
-	assert.Equal(t, 1, result.BlobsDeleted)
-}