Fail restore for a requested path that matches nothing (closes #309)

snapshot restore said nothing about a requested path that matched no
entry in the snapshot (a typo, a relative path, or a path through a
configured snapshot path that is a symlink, whose entries are stored
under the resolved directory) and exited 0, also when nothing matched
at all. Each such path is now named in a warning, and restore returns
an error after restoring the paths that do match.

Making a path through a symlink match is not part of this change.
Judgement call: when files also fail to restore, that error is the one
returned; the unmatched paths are still named.

Model: opus-5-5

README.md

@@ -372,7 +372,9 @@ on the destination in one go, use `vaultik remote nuke --force`.
   store — its remote key (or an unambiguous leading part of it) as shown
   by `snapshot list`. See
   [restoring on another machine](#restoring-on-another-machine).
-* Optional path arguments to restore specific files/directories (default: all)
+* Optional path arguments to restore specific files/directories (default: all).
+  A path that matches nothing in the snapshot is named in a warning, and the
+  command exits non-zero after restoring the paths that match
 * Preserves file permissions, timestamps, ownership (ownership requires root),
   symlinks, and empty directories
 * `--verify`: After restoring, verify every file's chunk hashes match
@@ -433,10 +435,7 @@ object store. Credentials are read from `s3.access_key_id` and
 `s3.secret_access_key` in the config file.
 
 **Local filesystem** (`file:///path/to/backup`): Stores blobs and metadata on
-a local or mounted filesystem. Useful for testing or backing up to a NAS. The
+a local or mounted filesystem. Useful for testing or backing up to a NAS.
-path must be absolute; a relative one is refused when the config loads.
-Percent-escapes in the path are decoded, so `my%20stick` and `my stick` name
-the same directory.
 
 **Rclone** (`rclone://remote/path`): Uses rclone's 70+ supported cloud
 providers. Requires rclone to be configured separately (`rclone config`).

internal/blob/packer.go

@@ -245,17 +245,6 @@ func (p *Packer) Flush(ctx context.Context) error {
 	return nil
 }
 
-// DiscardCurrentBlob closes and removes the temp file of the blob being
-// packed, if any, and drops that blob. A caller that stops before Flush
-// must call it, or the temp file is left behind. Thread-safe.
-func (p *Packer) DiscardCurrentBlob() {
-	p.mu.Lock()
-	defer p.mu.Unlock()
-
-	p.cleanupTempFile()
-	p.currentBlob = nil
-}
-
 // FinalizeBlob finalizes the current blob being assembled.
 // This compresses the accumulated chunks, encrypts the result, and computes
 // the content-addressed hash. The finalized blob is either passed to the

internal/cli/config.go

@@ -251,12 +251,6 @@ func NewConfigCommand() *cobra.Command {
 		Use:   "config",
 		Short: "Manage the configuration file",
 		Long:  "Commands for creating, editing, and querying the vaultik config file.",
-		// cobra checks Args only on a command that has a Run: without
-		// one, a mistyped subcommand printed help and exited 0.
-		Args: cobra.NoArgs,
-		Run: func(cmd *cobra.Command, _ []string) {
-			_ = cmd.Help()
-		},
 	}
 
 	cmd.AddCommand(newConfigInitCommand())

internal/cli/database.go

@@ -15,12 +15,6 @@ func NewDatabaseCommand() *cobra.Command {
 		Use:   "database",
 		Short: "Manage the local state database",
 		Long:  `Commands for managing the local SQLite state database.`,
-		// cobra checks Args only on a command that has a Run: without
-		// one, a mistyped subcommand printed help and exited 0.
-		Args: cobra.NoArgs,
-		Run: func(cmd *cobra.Command, _ []string) {
-			_ = cmd.Help()
-		},
 	}
 
 	cmd.AddCommand(

internal/cli/entry_unknown_subcommand_test.go

@@ -1,43 +0,0 @@
-package cli //nolint:testpackage // shares runEntry and the command-word constants
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-// TestEntryGroupRejectsUnknownSubcommand runs each group command with a
-// mistyped subcommand, as a crontab line might carry one. It must fail
-// with exit 1 and name the word, as `vaultik bogus` does at the top
-// level, instead of printing the group's help and exiting 0 having done
-// nothing. The group name alone still prints its help.
-//
-//nolint:paralleltest // replaces os.Args, os.Stdout and os.Stderr
-func TestEntryGroupRejectsUnknownSubcommand(t *testing.T) {
-	for _, testCase := range []struct {
-		group    string
-		mistyped string
-	}{
-		{group: cmdSnapshot, mistyped: "craete"},
-		{group: "config", mistyped: "inti"},
-		{group: cmdRemote, mistyped: "ifno"},
-		{group: "database", mistyped: "delte"},
-		{group: "completion", mistyped: "nosuchshell"},
-	} {
-		t.Run(testCase.group, func(t *testing.T) {
-			code, stdout, stderr := runEntry(t,
-				testCase.group, testCase.mistyped)
-
-			assert.Equal(t, 1, code)
-			assert.Empty(t, stdout)
-			assert.Contains(t, stderr,
-				`unknown command "`+testCase.mistyped+`"`)
-
-			code, stdout, _ = runEntry(t, testCase.group)
-
-			assert.Equal(t, 0, code)
-			assert.Contains(t, stdout,
-				programName+" "+testCase.group+" [command]")
-		})
-	}
-}

internal/cli/remote.go

@@ -18,12 +18,6 @@ func NewRemoteCommand() *cobra.Command {
 		Use:   "remote",
 		Short: "Remote storage management commands",
 		Long:  "Commands for inspecting and managing remote storage",
-		// cobra checks Args only on a command that has a Run: without
-		// one, a mistyped subcommand printed help and exited 0.
-		Args: cobra.NoArgs,
-		Run: func(cmd *cobra.Command, _ []string) {
-			_ = cmd.Help()
-		},
 	}
 
 	// Add subcommands

internal/cli/root.go

@@ -74,21 +74,6 @@ on the source system.`,
 		NewDatabaseCommand(),
 	)
 
-	// cobra adds the completion command only when Execute runs, and with
-	// no Run, so it skipped its own cobra.NoArgs and a mistyped shell name
-	// printed help and exited 0. Adding it here lets it have a Run. Its
-	// scripts go to os.Stdout as it is now: a later SetOut does not
-	// redirect them.
-	cmd.InitDefaultCompletionCmd()
-
-	for _, sub := range cmd.Commands() {
-		if sub.Name() == "completion" {
-			sub.Run = func(completion *cobra.Command, _ []string) {
-				_ = completion.Help()
-			}
-		}
-	}
-
 	return cmd
 }
 

internal/cli/snapshot.go

@@ -41,12 +41,6 @@ func NewSnapshotCommand() *cobra.Command {
 		Use:   "snapshot",
 		Short: "Snapshot management commands",
 		Long:  "Commands for creating, listing, and managing snapshots",
-		// cobra checks Args only on a command that has a Run: without
-		// one, a mistyped subcommand printed help and exited 0.
-		Args: cobra.NoArgs,
-		Run: func(cmd *cobra.Command, _ []string) {
-			_ = cmd.Help()
-		},
 	}
 
 	// Add subcommands

internal/cli/snapshot_restore.go

@@ -30,6 +30,8 @@ This command will restore files from the specified snapshot to the
 target directory.
 If no paths are specified, all files are restored.
 If paths are specified, only matching files/directories are restored.
+A path that matches nothing in the snapshot is named in a warning, and
+the command exits non-zero after restoring the paths that match.
 
 The snapshot may be named by its ID or, when restoring on a host with no
 local index, by the remote key that 'snapshot list' prints for a

internal/config/config.go

@@ -61,9 +61,6 @@ var (
 	errBadS3PartSize    = errors.New("s3.part_size must be between 5MiB and 5GiB")
 	errBadStorageScheme = errors.New(
 		"storage_url must start with s3://, file://, or rclone://")
-	errFileURLNotAbsolute = errors.New(
-		"a file:// storage_url needs an absolute path, " +
-			"as in file:///path/to/backup")
 	errStorageNotConfigured = errors.New(
 		"storage not configured; set storage_url or provide s3.endpoint + " +
 			"s3.bucket + credentials")
@@ -464,18 +461,11 @@ func (c *Config) validateStorage() error {
 
 // validateStorageURL validates URL-based storage configuration. File and
 // rclone URLs need no credentials; S3 URLs require the legacy s3.*
-// credential fields. A file URL must name an absolute path: a relative one
+// credential fields.
-// would resolve against the working directory, so the destination would
-// move with it.
 func (c *Config) validateStorageURL() error {
 	switch {
 	case strings.HasPrefix(c.StorageURL, "file://"):
-		// storage.ParseStorageURL applies the same rule, but config
+		// File storage doesn't need S3 credentials
-		// cannot import storage, which imports config.
-		if !strings.HasPrefix(c.StorageURL, "file:///") {
-			return errFileURLNotAbsolute
-		}
-
 		return nil
 	case strings.HasPrefix(c.StorageURL, "rclone://"):
 		// Rclone storage uses rclone's own config

internal/config/config_test.go

@@ -337,35 +337,6 @@ func TestLoadS3PartSize(t *testing.T) {
 	})
 }
 
-// TestLoadRejectsRelativeFileURL checks that a file:// storage_url with a
-// relative path fails at load. Accepted, it would resolve against the
-// working directory, so a backup run from another directory would write
-// to a different destination and still succeed.
-func TestLoadRejectsRelativeFileURL(t *testing.T) {
-	t.Parallel()
-
-	const relativeConfig = "snapshots:\n" +
-		"  test:\n" +
-		"    paths: [/tmp/vaultik-test-source]\n" +
-		"storage_url: file://dest\n"
-
-	path := filepath.Join(t.TempDir(), "config.yml")
-
-	err := os.WriteFile(path, []byte(relativeConfig), 0o600)
-	if err != nil {
-		t.Fatalf("write config: %v", err)
-	}
-
-	_, err = Load(path)
-	if !errors.Is(err, errFileURLNotAbsolute) {
-		t.Fatalf("Load() error = %v, want errFileURLNotAbsolute", err)
-	}
-
-	if !strings.Contains(err.Error(), "absolute path") {
-		t.Errorf("error %q does not say to use an absolute path", err.Error())
-	}
-}
-
 // TestValidateAgeRecipients checks that recipients are parsed at config load
 // (a bad entry fails immediately, not mid-backup) and that no invalid entry —
 // least of all a pasted secret key — is echoed in the error. An empty list

internal/database/repositories.go

@@ -3,7 +3,6 @@ package database
 import (
 	"context"
 	"database/sql"
-	"errors"
 	"fmt"
 )
 
@@ -61,24 +60,22 @@ func (r *Repositories) WithTx(ctx context.Context, fn TxFunc) error {
 
 	defer func() {
 		if p := recover(); p != nil {
-			// The panic is the failure to report, so a rollback error
+			rollbackErr := tx.Rollback()
-			// is dropped.
+			if rollbackErr != nil {
-			_ = tx.Rollback()
+				Fatalf("failed to rollback transaction: %v", rollbackErr)
+			}
 
 			panic(p)
+		} else if err != nil {
+			rollbackErr := tx.Rollback()
+			if rollbackErr != nil {
+				Fatalf("failed to rollback transaction: %v", rollbackErr)
+			}
 		}
 	}()
 
 	err = fn(ctx, tx)
 	if err != nil {
-		// Once ctx is cancelled, database/sql rolls the transaction
-		// back itself and Rollback returns sql.ErrTxDone.
-		rollbackErr := tx.Rollback()
-		if rollbackErr != nil && !errors.Is(rollbackErr, sql.ErrTxDone) {
-			return fmt.Errorf("%w; rolling back transaction: %w",
-				err, rollbackErr)
-		}
-
 		return err
 	}
 

internal/database/repositories_test.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"database/sql"
 	"errors"
-	"strings"
 	"testing"
 	"time"
 
@@ -236,125 +235,6 @@ func TestRepositoriesTransactionRollback(t *testing.T) {
 	}
 }
 
-// When the context is cancelled during the body, database/sql rolls the
-// transaction back itself, so WithTx's own rollback finds it already
-// done. WithTx must return the body's error alone, without that rollback.
-func TestRepositoriesTransactionContextCancelled(t *testing.T) {
-	t.Parallel()
-
-	db, cleanup := setupTestDB(t)
-	defer cleanup()
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	repos := database.NewRepositories(db)
-
-	err := repos.WithTx(ctx, func(ctx context.Context, tx *sql.Tx) error {
-		file := &database.File{
-			Path:  "/test/cancelled_file.txt",
-			MTime: time.Now().Truncate(time.Second),
-			Size:  1024,
-			Mode:  0644,
-			UID:   1000,
-			GID:   1000,
-		}
-
-		err := repos.Files.Create(ctx, tx, file)
-		if err != nil {
-			return err
-		}
-
-		cancel()
-
-		// database/sql rolls back from a goroutine of its own; wait
-		// until it has, so the test does not depend on that race.
-		for {
-			_, err = tx.ExecContext(context.WithoutCancel(ctx), "SELECT 1")
-			if errors.Is(err, sql.ErrTxDone) {
-				return ctx.Err()
-			}
-
-			time.Sleep(time.Millisecond)
-		}
-	})
-	if !errors.Is(err, context.Canceled) {
-		t.Fatalf("expected context.Canceled, got: %v", err)
-	}
-
-	if errors.Is(err, sql.ErrTxDone) {
-		t.Fatalf("the already-done rollback was reported: %v", err)
-	}
-
-	file, err := repos.Files.GetByPath(
-		context.Background(), "/test/cancelled_file.txt",
-	)
-	if err != nil {
-		t.Fatalf("error checking for file: %v", err)
-	}
-
-	if file != nil {
-		t.Error("file should not exist after the cancelled transaction")
-	}
-}
-
-// A body that ends the transaction itself with ROLLBACK makes WithTx's
-// own rollback fail. WithTx must return that failure together with the
-// body's error.
-func TestRepositoriesTransactionRollbackFails(t *testing.T) {
-	t.Parallel()
-
-	db, cleanup := setupTestDB(t)
-	defer cleanup()
-
-	ctx := context.Background()
-	repos := database.NewRepositories(db)
-
-	err := repos.WithTx(ctx, func(ctx context.Context, tx *sql.Tx) error {
-		_, err := tx.ExecContext(ctx, "ROLLBACK")
-		if err != nil {
-			return err
-		}
-
-		return errIntentionalRollback
-	})
-	if !errors.Is(err, errIntentionalRollback) {
-		t.Fatalf("expected the body's error, got: %v", err)
-	}
-
-	if !strings.Contains(err.Error(), "rolling back transaction") {
-		t.Errorf("expected the failed rollback in the error, got: %v", err)
-	}
-}
-
-// When the body ends the transaction itself with ROLLBACK and then
-// panics, WithTx's own rollback fails; the panic must still reach the
-// caller.
-func TestRepositoriesTransactionPanicRollbackFails(t *testing.T) {
-	t.Parallel()
-
-	db, cleanup := setupTestDB(t)
-	defer cleanup()
-
-	ctx := context.Background()
-	repos := database.NewRepositories(db)
-
-	defer func() {
-		if recover() == nil {
-			t.Error("expected the body's panic to reach the caller")
-		}
-	}()
-
-	_ = repos.WithTx(ctx, func(ctx context.Context, tx *sql.Tx) error {
-		_, err := tx.ExecContext(ctx, "ROLLBACK")
-		if err != nil {
-			return err
-		}
-
-		panic(errIntentionalRollback)
-	})
-}
-
 func TestRepositoriesReadTransaction(t *testing.T) {
 	t.Parallel()
 

internal/log/tty_handler.go

@@ -10,8 +10,6 @@ import (
 	"sync"
 	"time"
 	"unicode"
-
-	"github.com/dustin/go-humanize"
 )
 
 // groupSeparator joins an open group path to an attribute key. This
@@ -306,13 +304,18 @@ func formatDuration(d time.Duration) string {
 	}
 }
 
-// formatBytes formats a byte count with humanize.Bytes, as every command
+// formatBytes formats bytes in a human-readable way
-// prints one. humanize.Bytes takes no negative count, so one is printed
-// as it is.
 func formatBytes(b int64) string {
-	if b < 0 {
+	const unit = 1024
+	if b < unit {
 		return fmt.Sprintf("%d B", b)
 	}
 
-	return humanize.Bytes(uint64(b))
+	div, exp := int64(unit), 0
+	for n := b / unit; n >= unit; n /= unit {
+		div *= unit
+		exp++
+	}
+
+	return fmt.Sprintf("%.1f %cB", float64(b)/float64(div), "KMGTPE"[exp])
 }

internal/log/tty_handler_test.go

@@ -200,8 +200,7 @@ func TestTTYHandlerWithGroupQualifiesKeys(t *testing.T) {
 func TestTTYHandlerByteFormattingSurvivesGrouping(t *testing.T) {
 	t.Parallel()
 
-	// Printed as "1.0 MB", in powers of 1000 like every other byte count.
+	const oneAndAHalfKiB = 1536
-	const oneMegabyte = 1_000_000
 
 	for name, testCase := range map[string]struct {
 		derive func(*slog.Logger) *slog.Logger
@@ -224,13 +223,13 @@ func TestTTYHandlerByteFormattingSurvivesGrouping(t *testing.T) {
 			var buf bytes.Buffer
 
 			logger := slog.New(log.NewTTYHandler(&buf, debugHandlerOptions()))
-			testCase.derive(logger).Info("uploaded", "bytes", oneMegabyte)
+			testCase.derive(logger).Info("uploaded", "bytes", oneAndAHalfKiB)
 
 			line := ansiEscape.ReplaceAllString(buf.String(), "")
 
-			assert.Contains(t, line, testCase.key+"=1.0 MB",
+			assert.Contains(t, line, testCase.key+"=1.5 KB",
 				"a byte count must be human-readable however it is qualified")
-			assert.NotContains(t, line, strconv.Itoa(oneMegabyte),
+			assert.NotContains(t, line, strconv.Itoa(oneAndAHalfKiB),
 				"the raw number must not survive the formatting")
 		})
 	}

internal/snapshot/exclude_test.go

@@ -531,50 +531,3 @@ func TestExcludePatterns_UnanchoredPatternFile(t *testing.T) {
 	require.Equal(t, 1, result.FilesScanned,
 		"Unanchored pattern for file should match anywhere")
 }
-
-func TestExcludePatterns_DoubleStarDirectoryAtEveryDepth(t *testing.T) {
-	t.Parallel()
-
-	// As in gitignore, a leading **/ also matches directly under the source dir
-	fs := setupAnchoredTestFS(t)
-
-	scanner, repos, cleanup := createTestScanner(t, fs, []string{"**/projectname"})
-	defer cleanup()
-
-	ctx := context.Background()
-	createSnapshotRecord(ctx, t, repos, "test-snapshot")
-
-	result, err := scanner.Scan(ctx, "/backup", "test-snapshot")
-	require.NoError(t, err)
-
-	// **/projectname should exclude BOTH:
-	// - /backup/projectname/file.txt
-	// - /backup/otherproject/projectname/file.txt
-	// Total files: 4, excluded: 2
-	require.Equal(t, 2, result.FilesScanned,
-		"**/ directory pattern should match at the top level and nested")
-}
-
-func TestExcludePatterns_DoubleStarFileAtEveryDepth(t *testing.T) {
-	t.Parallel()
-
-	// As in gitignore, a leading **/ also matches directly under the source dir
-	fs := setupAnchoredTestFS(t)
-
-	scanner, repos, cleanup := createTestScanner(t, fs, []string{"**/*.txt"})
-	defer cleanup()
-
-	ctx := context.Background()
-	createSnapshotRecord(ctx, t, repos, "test-snapshot")
-
-	result, err := scanner.Scan(ctx, "/backup", "test-snapshot")
-	require.NoError(t, err)
-
-	// **/*.txt should exclude ALL .txt files:
-	// - /backup/file.txt
-	// - /backup/projectname/file.txt
-	// - /backup/otherproject/projectname/file.txt
-	// Total files: 4, excluded: 3
-	require.Equal(t, 1, result.FilesScanned,
-		"**/ file pattern should match at the top level and nested")
-}

internal/snapshot/scanner.go

@@ -1295,11 +1295,6 @@ func (s *Scanner) batchAddFilesToSnapshot(
 func (s *Scanner) processPhase(
 	ctx context.Context, filesToProcess []*FileToProcess, result *ScanResult,
 ) error {
-	// On an error or cancellation the blob being packed is never
-	// finalized, so its temp file must be removed here. After a
-	// successful flush there is no such blob and this does nothing.
-	defer s.packer.DiscardCurrentBlob()
-
 	// Calculate total bytes to process
 	var totalBytes int64
 	for _, f := range filesToProcess {
@@ -2018,14 +2013,6 @@ func compileExcludePatterns(patterns []string) []compiledPattern {
 		// Remove trailing slash if present (directory indicator)
 		pattern = strings.TrimSuffix(pattern, "/")
 
-		// A leading "**/" demands a "/" before the name and so misses an
-		// entry directly under the source path. An unanchored pattern
-		// already matches at every depth, so drop the prefix: as in
-		// gitignore, "**/x" then also matches a top-level "x".
-		if !anchored {
-			pattern = strings.TrimPrefix(pattern, "**/")
-		}
-
 		// Compile the glob pattern
 		// For patterns without path separators, we need to match them as components
 		// e.g., ".git" should match ".git" anywhere in the path

internal/snapshot/skip_errors_test.go

@@ -381,60 +381,3 @@ func TestScannerCancelStopsSkipErrorsRun(t *testing.T) {
 		})
 	}
 }
-
-// TestScannerRemovesBlobTempFileWhenRunStops checks that a run stopped
-// part-way, by a file it cannot read or by a cancellation, removes the
-// temp file of the blob it was packing.
-func TestScannerRemovesBlobTempFileWhenRunStops(t *testing.T) {
-	t.Parallel()
-
-	// a.txt is backed up first and starts a blob; the run stops at b.txt.
-	const target = "/source/b.txt"
-
-	tests := []struct {
-		name  string
-		newFs func(cancel context.CancelFunc) afero.Fs
-	}{
-		{
-			name: "file cannot be read",
-			newFs: func(context.CancelFunc) afero.Fs {
-				return &readFailFs{Fs: afero.NewMemMapFs(), target: target}
-			},
-		},
-		{
-			name: "cancelled",
-			newFs: func(cancel context.CancelFunc) afero.Fs {
-				return &cancelOnOpenFs{
-					Fs: afero.NewMemMapFs(), target: target, cancel: cancel,
-				}
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
-
-			fs := tt.newFs(cancel)
-			writeSkipErrorTestFile(t, fs, "/source/a.txt", "first file content")
-			writeSkipErrorTestFile(t, fs, target, "second file content")
-
-			_, err := runSkipErrorScan(ctx, t, fs, "/source", false, nil)
-			if err == nil {
-				t.Fatal("expected the scan to stop with an error, got nil")
-			}
-
-			left, err := afero.Glob(fs, filepath.Join(os.TempDir(), "vaultik-blob-*"))
-			if err != nil {
-				t.Fatalf("listing blob temp files: %v", err)
-			}
-
-			if len(left) != 0 {
-				t.Fatalf("expected no blob temp file left, got %v", left)
-			}
-		})
-	}
-}

internal/storage/url.go

@@ -17,10 +17,8 @@ const (
 
 // Sentinel errors for storage URL parsing.
 var (
-	ErrEmptyStorageURL  = errors.New("storage URL is empty")
+	ErrEmptyStorageURL   = errors.New("storage URL is empty")
-	ErrEmptyFilePath    = errors.New("file URL path is empty")
+	ErrEmptyFilePath     = errors.New("file URL path is empty")
-	ErrRelativeFilePath = errors.New(
-		"file URL needs an absolute path, as in file:///path/to/backup")
 	ErrMissingBucket     = errors.New("s3 URL missing bucket name")
 	ErrMissingRemote     = errors.New("rclone URL missing remote name")
 	ErrUnsupportedScheme = errors.New(
@@ -29,10 +27,7 @@ var (
 	ErrURLCredentials     = errors.New(
 		"storage URL must not carry credentials; " +
 			"set s3.access_key_id and s3.secret_access_key in the config instead")
-	ErrURLUnknownParam    = errors.New("unknown query parameter in storage URL")
+	ErrURLUnknownParam = errors.New("unknown query parameter in storage URL")
-	ErrRcloneRemoteParams = errors.New(
-		"rclone URL must not carry parameters in the remote name; " +
-			"set them on the remote with rclone config instead")
 )
 
 // URL represents a parsed storage URL.
@@ -56,8 +51,17 @@ func ParseStorageURL(rawURL string) (*URL, error) {
 		return nil, ErrEmptyStorageURL
 	}
 
+	// Handle file:// URLs
 	if after, ok := strings.CutPrefix(rawURL, "file://"); ok {
-		return parseFileURL(after)
+		path := after
+		if path == "" {
+			return nil, ErrEmptyFilePath
+		}
+
+		return &URL{
+			Scheme: schemeFile,
+			Prefix: path,
+		}, nil
 	}
 
 	if strings.HasPrefix(rawURL, "s3://") {
@@ -71,31 +75,9 @@ func ParseStorageURL(rawURL string) (*URL, error) {
 	return nil, ErrUnsupportedScheme
 }
 
-// parseFileURL parses the path that follows file://. The path must be
-// absolute: a relative one would resolve against the working directory,
-// so the destination would move with it. Percent-escapes are decoded, so
-// my%20stick names the directory "my stick"; a literal space is kept.
-func parseFileURL(rawPath string) (*URL, error) {
-	if rawPath == "" {
-		return nil, ErrEmptyFilePath
-	}
-
-	if !strings.HasPrefix(rawPath, "/") {
-		return nil, ErrRelativeFilePath
-	}
-
-	path, err := url.PathUnescape(rawPath)
-	if err != nil {
-		return nil, fmt.Errorf("invalid file URL path: %w", err)
-	}
-
-	return &URL{Scheme: schemeFile, Prefix: path}, nil
-}
-
 // parseS3URL parses an s3://bucket/prefix URL. It rejects credentials in
-// the userinfo or in the endpoint parameter's userinfo, and any query
+// the userinfo and any query parameter other than endpoint, region and
-// parameter other than endpoint, region and ssl, so a credential-bearing
+// ssl, so a credential-bearing URL is never stored or echoed.
-// URL is never stored or echoed.
 func parseS3URL(rawURL string) (*URL, error) {
 	u, err := url.Parse(rawURL)
 	if err != nil {
@@ -118,14 +100,6 @@ func parseS3URL(rawURL string) (*URL, error) {
 		return nil, err
 	}
 
-	// A host name never contains "@", so one in an endpoint, with or
-	// without a scheme, can only introduce userinfo.
-	for _, endpoint := range query["endpoint"] {
-		if strings.Contains(endpoint, "@") {
-			return nil, ErrURLCredentials
-		}
-	}
-
 	return &URL{
 		Scheme:   schemeS3,
 		Bucket:   bucket,
@@ -137,23 +111,9 @@ func parseS3URL(rawURL string) (*URL, error) {
 }
 
 // parseRcloneURL parses an rclone://remote/path URL. rclone:// takes no
-// query parameters, so credentials in the userinfo, parameters in the
+// query parameters, so credentials in the userinfo and any parameter at
-// remote name and any query parameter at all are rejected rather than
+// all are rejected rather than silently ignored.
-// silently ignored.
 func parseRcloneURL(rawURL string) (*URL, error) {
-	// The remote name runs up to the first "/", "?" or "#". It never
-	// contains a comma; one starts rclone's remote,param=value form,
-	// whose values can be credentials. This is checked before url.Parse,
-	// whose error for such a name can print part of it.
-	remote := strings.TrimPrefix(rawURL, "rclone://")
-	if end := strings.IndexAny(remote, "/?#"); end >= 0 {
-		remote = remote[:end]
-	}
-
-	if strings.Contains(remote, ",") {
-		return nil, ErrRcloneRemoteParams
-	}
-
 	u, err := url.Parse(rawURL)
 	if err != nil {
 		return nil, wrapParseError(err)
@@ -163,7 +123,7 @@ func parseRcloneURL(rawURL string) (*URL, error) {
 		return nil, ErrURLCredentials
 	}
 
-	remote = u.Host
+	remote := u.Host
 	if remote == "" {
 		return nil, ErrMissingRemote
 	}

internal/storage/url_parse_test.go

@@ -14,10 +14,7 @@ import (
 func TestParseStorageURLValid(t *testing.T) {
 	t.Parallel()
 
-	const (
+	const bucket = "mybucket"
-		bucket     = "mybucket"
-		fileScheme = "file"
-	)
 
 	cases := []struct {
 		name string
@@ -27,17 +24,7 @@ func TestParseStorageURLValid(t *testing.T) {
 		{
 			name: "file absolute path",
 			raw:  "file:///var/backups/vaultik",
-			want: &storage.URL{Scheme: fileScheme, Prefix: "/var/backups/vaultik"},
+			want: &storage.URL{Scheme: "file", Prefix: "/var/backups/vaultik"},
-		},
-		{
-			name: "file percent-escaped path is decoded",
-			raw:  "file:///Volumes/my%20stick/backup",
-			want: &storage.URL{Scheme: fileScheme, Prefix: "/Volumes/my stick/backup"},
-		},
-		{
-			name: "file path with a literal space",
-			raw:  "file:///Volumes/my stick/backup",
-			want: &storage.URL{Scheme: fileScheme, Prefix: "/Volumes/my stick/backup"},
 		},
 		{
 			name: "s3 bucket and prefix, ssl defaults on",
@@ -103,7 +90,6 @@ func TestParseStorageURLErrors(t *testing.T) {
 	}{
 		{"empty url", "", storage.ErrEmptyStorageURL},
 		{"file empty path", "file://", storage.ErrEmptyFilePath},
-		{"file relative path", "file://dest", storage.ErrRelativeFilePath},
 		{"s3 missing bucket", "s3://", storage.ErrMissingBucket},
 		{"s3 missing bucket with path", "s3:///justprefix", storage.ErrMissingBucket},
 		{"rclone missing remote", "rclone://", storage.ErrMissingRemote},
@@ -150,19 +136,6 @@ func TestParseStorageURLRejectsCredentials(t *testing.T) {
 			wantErr: storage.ErrURLCredentials,
 			secrets: []string{key, secret, "mybucket"},
 		},
-		{
-			name: "s3 userinfo in endpoint",
-			raw: "s3://mybucket?endpoint=https://" +
-				key + ":" + secret + "@minio.example.com",
-			wantErr: storage.ErrURLCredentials,
-			secrets: []string{key, secret},
-		},
-		{
-			name:    "s3 userinfo in endpoint without scheme",
-			raw:     "s3://mybucket?endpoint=" + key + ":" + secret + "@minio.example.com",
-			wantErr: storage.ErrURLCredentials,
-			secrets: []string{key, secret},
-		},
 		{
 			name:    "s3 unknown query param",
 			raw:     "s3://mybucket?access_key=" + key + "&secret=" + secret,
@@ -216,54 +189,6 @@ func TestParseStorageURLRejectsCredentials(t *testing.T) {
 	}
 }
 
-// TestParseStorageURLRejectsRcloneRemoteParams checks that an rclone
-// remote name carrying parameters (rclone's "remote,param=value" form,
-// which can hold a credential) is rejected without echoing the value,
-// including the URLs that url.Parse itself refuses.
-func TestParseStorageURLRejectsRcloneRemoteParams(t *testing.T) {
-	t.Parallel()
-
-	cases := []struct {
-		name    string
-		raw     string
-		secrets []string // must not appear in the error message
-	}{
-		{
-			name:    "configured remote",
-			raw:     "rclone://gdrive,client_secret=topsecret/backups",
-			secrets: []string{"topsecret"},
-		},
-		{
-			name:    "remote defined inline",
-			raw:     "rclone://:s3,access_key_id=KEY,secret_access_key=SECRET/bucket",
-			secrets: []string{"KEY", "SECRET"},
-		},
-		{
-			name:    "colon in a parameter value",
-			raw:     "rclone://gdrive,client_secret=ab:cd/backups",
-			secrets: []string{"cd"},
-		},
-	}
-
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			_, err := storage.ParseStorageURL(tc.raw)
-			if !errors.Is(err, storage.ErrRcloneRemoteParams) {
-				t.Fatalf("ParseStorageURL(%q) error = %v, want %v",
-					tc.raw, err, storage.ErrRcloneRemoteParams)
-			}
-
-			for _, secret := range tc.secrets {
-				if strings.Contains(err.Error(), secret) {
-					t.Errorf("error message leaked %q: %v", secret, err.Error())
-				}
-			}
-		})
-	}
-}
-
 // TestParseStorageURLParseFailureHidesURL checks that when url.Parse
 // itself fails, the wrapped error carries only the inner cause, not the
 // *url.Error whose text embeds the raw (possibly credential-bearing) URL.

internal/vaultik/blob_fetch.go

@@ -103,8 +103,6 @@ func (v *Vaultik) FetchAndDecryptBlob(
 }
 
 // FetchBlob downloads a blob and returns a reader for the encrypted data.
-// The reader is closed as soon as ctx is cancelled, which ends a read
-// blocked inside it.
 func (v *Vaultik) FetchBlob(
 	ctx context.Context, blobHash string,
 ) (io.ReadCloser, error) {
@@ -122,47 +120,5 @@ func (v *Vaultik) FetchBlob(
 		return nil, fmt.Errorf("downloading blob %s: %w", shortHash(blobHash), err)
 	}
 
-	return newCloseOnCancelReader(ctx, rc), nil
+	return rc, nil
-}
-
-// closeOnCancelReader closes the reader it wraps when ctx is cancelled.
-// Not every backend's reader stops on cancel by itself (the file
-// backend's does not), and a read stalled on a slow or hung source would
-// otherwise outlast the shutdown timeout, so the process would exit
-// before restore or deep verify removed its decrypted temporary files.
-type closeOnCancelReader struct {
-	io.ReadCloser
-
-	ctx  context.Context //nolint:containedctx // Read reports its error
-	stop func() bool
-}
-
-func newCloseOnCancelReader(
-	ctx context.Context, rc io.ReadCloser,
-) *closeOnCancelReader {
-	return &closeOnCancelReader{
-		ReadCloser: rc,
-		ctx:        ctx,
-		stop:       context.AfterFunc(ctx, func() { _ = rc.Close() }),
-	}
-}
-
-// Read returns the context's error, not the closed reader's, once ctx
-// has been cancelled.
-func (r *closeOnCancelReader) Read(p []byte) (int, error) {
-	n, err := r.ReadCloser.Read(p)
-	if err != nil && r.ctx.Err() != nil {
-		return n, r.ctx.Err()
-	}
-
-	return n, err
-}
-
-// Close closes the wrapped reader, unless the cancel already closed it.
-func (r *closeOnCancelReader) Close() error {
-	if !r.stop() {
-		return nil
-	}
-
-	return r.ReadCloser.Close()
 }

internal/vaultik/helpers.go

@@ -89,6 +89,22 @@ type SnapshotInfo struct {
 	RemotePresent    *bool            `json:"remote_present"`
 }
 
+// formatBytes formats bytes in a human-readable format
+func formatBytes(bytes int64) string {
+	const unit = 1024
+	if bytes < unit {
+		return fmt.Sprintf("%d B", bytes)
+	}
+
+	div, exp := int64(unit), 0
+	for n := bytes / unit; n >= unit; n /= unit {
+		div *= unit
+		exp++
+	}
+
+	return fmt.Sprintf("%.1f %cB", float64(bytes)/float64(div), "KMGTPE"[exp])
+}
+
 // parseSnapshotTimestamp extracts the timestamp from a snapshot ID
 // Format: hostname_snapshotname_2026-01-12T14:41:15Z
 func parseSnapshotTimestamp(snapshotID string) (time.Time, error) {

internal/vaultik/restore.go

@@ -27,6 +27,7 @@ import (
 // Sentinel errors for restore failures.
 var (
 	errFilesFailedRestore    = errors.New("file(s) failed to restore")
+	errPathsNotInSnapshot    = errors.New("requested path(s) not in the snapshot")
 	errFilesFailedVerify     = errors.New("files failed verification")
 	errDecryptionKeyRequired = errors.New(
 		"decryption key required for restore\n\n" +
@@ -149,7 +150,7 @@ func (v *Vaultik) Restore(opts *RestoreOptions) error {
 	repos := database.NewRepositories(tempDB)
 
 	// Step 2: Get list of files to restore
-	files, err := v.getFilesToRestore(v.ctx, repos, opts.Paths)
+	files, unmatched, err := v.getFilesToRestore(v.ctx, repos, opts.Paths)
 	if err != nil {
 		return fmt.Errorf("getting files to restore: %w", err)
 	}
@@ -158,7 +159,7 @@ func (v *Vaultik) Restore(opts *RestoreOptions) error {
 		log.Warn("No files found to restore")
 		v.UI.Warningf("No files found to restore.")
 
-		return nil
+		return v.reportUnmatchedPaths(unmatched)
 	}
 
 	log.Info("Found files to restore", "count", len(files))
@@ -198,14 +199,16 @@ func (v *Vaultik) Restore(opts *RestoreOptions) error {
 		v.UI.Duration(result.Duration),
 	)
 
-	return v.finishRestore(repos, files, opts, result)
+	return v.finishRestore(repos, files, unmatched, opts, result)
 }
 
 // finishRestore emits the post-restore warnings, runs optional
-// verification, and converts any failed-file count into an error.
+// verification, and converts any failed-file count or requested path
+// that matched nothing into an error.
 func (v *Vaultik) finishRestore(
 	repos *database.Repositories,
 	files []*database.File,
+	unmatched []string,
 	opts *RestoreOptions,
 	result *RestoreResult,
 ) error {
@@ -223,6 +226,8 @@ func (v *Vaultik) finishRestore(
 		}
 	}
 
+	unmatchedErr := v.reportUnmatchedPaths(unmatched)
+
 	// Run verification if requested
 	if opts.Verify {
 		err := v.handleRestoreVerification(repos, files, opts, result)
@@ -235,7 +240,23 @@ func (v *Vaultik) finishRestore(
 		return fmt.Errorf("%d %w", result.FilesFailed, errFilesFailedRestore)
 	}
 
-	return nil
+	return unmatchedErr
+}
+
+// reportUnmatchedPaths warns, by name, about each requested path that
+// matched nothing in the snapshot, and returns an error counting them,
+// or nil when there are none.
+func (v *Vaultik) reportUnmatchedPaths(unmatched []string) error {
+	if len(unmatched) == 0 {
+		return nil
+	}
+
+	for _, path := range unmatched {
+		log.Warn("Requested path matches nothing in the snapshot", "path", path)
+		v.UI.Warningf("%s matches nothing in the snapshot.", v.UI.Path(path))
+	}
+
+	return fmt.Errorf("%d %w", len(unmatched), errPathsNotInSnapshot)
 }
 
 // restoreIdentities parses the configured age secret key once into every
@@ -812,27 +833,34 @@ func (v *Vaultik) materializeSnapshotDB(
 	return db, tempDir, nil
 }
 
-// getFilesToRestore returns the list of files to restore based on path filters
+// getFilesToRestore returns the list of files to restore based on path
+// filters, and the filters, as given, that matched no file.
 func (v *Vaultik) getFilesToRestore(
 	ctx context.Context, repos *database.Repositories, pathFilters []string,
-) ([]*database.File, error) {
+) ([]*database.File, []string, error) {
 	// If no filters, get all files
 	if len(pathFilters) == 0 {
-		return repos.Files.ListAll(ctx)
+		files, err := repos.Files.ListAll(ctx)
+
+		return files, nil, err
 	}
 
 	// Get files matching the path filters
-	var result []*database.File
+	var (
+		result    []*database.File
+		unmatched []string
+	)
 
 	seen := make(map[string]bool)
 
 	for _, filter := range pathFilters {
-		// Normalize the filter path
+		files, err := repos.Files.ListUnderPath(ctx, filepath.Clean(filter))
-		filter = filepath.Clean(filter)
-
-		files, err := repos.Files.ListUnderPath(ctx, filter)
 		if err != nil {
-			return nil, fmt.Errorf("listing files under %s: %w", filter, err)
+			return nil, nil, fmt.Errorf("listing files under %s: %w", filter, err)
+		}
+
+		if len(files) == 0 {
+			unmatched = append(unmatched, filter)
 		}
 
 		for _, file := range files {
@@ -843,7 +871,7 @@ func (v *Vaultik) getFilesToRestore(
 		}
 	}
 
-	return result, nil
+	return result, unmatched, nil
 }
 
 // buildChunkToBlobMap creates a mapping from chunk hash to blob information

internal/vaultik/restore_interrupt_test.go

@@ -142,14 +142,14 @@ func TestRestoreCleansTempDirOnInterrupt(t *testing.T) {
 }
 
 // scratchEntries returns the vaultik blob-cache and snapshot-database
-// scratch entries (restore's and deep verify's) currently present in dir.
+// scratch entries currently present in dir.
 func scratchEntries(t *testing.T, dir string) []string {
 	t.Helper()
 
 	var matches []string
 
 	for _, pattern := range []string{
-		"vaultik-blobcache-*", "vaultik-restore-*", "vaultik-verify-*",
+		"vaultik-blobcache-*", "vaultik-restore-*",
 	} {
 		found, err := filepath.Glob(filepath.Join(dir, pattern))
 		require.NoError(t, err)
@@ -206,119 +206,3 @@ func TestRestoreSkipErrorsCancelDuringBlobDownload(t *testing.T) {
 	assert.NotContains(t, out.String(), srcPath,
 		"the cancel was reported as a failed file")
 }
-
-// stallingBlobStorer wraps a Storer so that every blob download hands
-// over the first half of the blob and then stalls, ignoring the context,
-// as a file:// blob on a hung USB stick or network share does. Only
-// closing the returned reader ends the stall.
-type stallingBlobStorer struct {
-	storage.Storer
-
-	once    sync.Once
-	stalled chan struct{}
-}
-
-func newStallingBlobStorer(inner storage.Storer) *stallingBlobStorer {
-	return &stallingBlobStorer{Storer: inner, stalled: make(chan struct{})}
-}
-
-func (s *stallingBlobStorer) Get(
-	ctx context.Context, key string,
-) (io.ReadCloser, error) {
-	rc, err := s.Storer.Get(ctx, key)
-	if err != nil || !strings.HasPrefix(key, "blobs/") {
-		return rc, err
-	}
-
-	blob, err := io.ReadAll(rc)
-	_ = rc.Close()
-
-	if err != nil {
-		return nil, err
-	}
-
-	// The writer is never closed, so once the first half has been read
-	// the next Read blocks until the reader is closed.
-	pr, pw := io.Pipe()
-
-	go func() {
-		_, _ = pw.Write(blob[:len(blob)/2])
-
-		s.once.Do(func() { close(s.stalled) })
-	}()
-
-	return pr, nil
-}
-
-// TestInterruptDuringStalledBlobReadCleansTempDir stops a restore and a
-// deep verify while a blob read is stalled on a source that ignores the
-// context. Stopping must end that read, so the operation unwinds and
-// removes its decrypted scratch files well within the shutdown timeout
-// (issue #325).
-//
-// Not parallel: it points TMPDIR at a private directory (via t.Setenv)
-// so it can assert on exactly the scratch files the operation created.
-func TestInterruptDuringStalledBlobReadCleansTempDir(t *testing.T) {
-	log.Initialize(log.Config{})
-
-	operations := map[string]func(v *Vaultik, snapshotID, targetDir string) error{
-		"restore": func(v *Vaultik, snapshotID, targetDir string) error {
-			return v.Restore(&RestoreOptions{
-				SnapshotID: snapshotID,
-				TargetDir:  targetDir,
-			})
-		},
-		"deep verify": func(v *Vaultik, snapshotID, _ string) error {
-			return v.RunDeepVerify(snapshotID, &VerifyOptions{Deep: true})
-		},
-	}
-
-	for name, op := range operations {
-		t.Run(name, func(t *testing.T) {
-			fs := afero.NewOsFs()
-			root := t.TempDir()
-
-			// Random content, so the blob stays large enough to stall
-			// part-way through its compressed, encrypted body.
-			cfg, storer, snapshotID, _ := backupOneFile(context.Background(),
-				t, fs, root, "a.bin", randomBytes(t, 256*1024), 0o644)
-
-			scratch := filepath.Join(root, "scratch")
-			require.NoError(t, fs.MkdirAll(scratch, 0o755))
-			t.Setenv("TMPDIR", scratch)
-
-			stalling := newStallingBlobStorer(storer)
-
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
-
-			v := newRestoreVaultik(ctx, cfg, stalling, fs)
-			v.cancel = cancel
-
-			var opErr error
-
-			stop := v.StartOperation(func() {
-				opErr = op(v, snapshotID, filepath.Join(root, "restored"))
-			})
-
-			select {
-			case <-stalling.stalled:
-			case <-time.After(30 * time.Second):
-				t.Fatal("the operation never reached a blob read")
-			}
-
-			require.NotEmpty(t, scratchEntries(t, scratch),
-				"expected decrypted scratch files to exist mid-read")
-
-			stopCtx, stopCancel := context.WithTimeout(
-				context.Background(), 10*time.Second)
-			defer stopCancel()
-
-			require.True(t, stop(stopCtx),
-				"stop timed out; the stalled blob read was not interrupted")
-			require.ErrorIs(t, opErr, context.Canceled)
-			require.Empty(t, scratchEntries(t, scratch),
-				"decrypted scratch files remained after the interrupt")
-		})
-	}
-}

internal/vaultik/restore_unmatched_path_test.go

@@ -0,0 +1,142 @@
+package vaultik_test
+
+import (
+	"bytes"
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/spf13/afero"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"sneak.berlin/go/vaultik/internal/config"
+	"sneak.berlin/go/vaultik/internal/database"
+	"sneak.berlin/go/vaultik/internal/log"
+	"sneak.berlin/go/vaultik/internal/storage"
+	"sneak.berlin/go/vaultik/internal/ui"
+	"sneak.berlin/go/vaultik/internal/vaultik"
+)
+
+// These tests cover https://git.eeqj.de/sneak/vaultik/issues/309: a path
+// given to restore that matches nothing in the snapshot is named in a
+// warning and makes the restore fail, after the paths that do match are
+// restored.
+
+func TestRestoreNamesUnmatchedPathAndRestoresTheMatchingOne(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	fs := afero.NewOsFs()
+	tempDir := t.TempDir()
+	dataDir := filepath.Join(tempDir, "src")
+	storeDir := filepath.Join(tempDir, "remote")
+	restoreDir := filepath.Join(tempDir, "restored")
+	dbPath := filepath.Join(tempDir, "index.sqlite")
+
+	ctx := context.Background()
+	cfg := faultTestConfig()
+	files := writeFaultSourceTree(t, fs, dataDir)
+
+	store, err := storage.NewFileStorer(storeDir)
+	require.NoError(t, err)
+
+	db, err := database.New(ctx, dbPath)
+	require.NoError(t, err)
+
+	id := fullFaultBackup(ctx, t, fs, store, cfg,
+		database.NewRepositories(db), dataDir, dbPath, "unmatched")
+	require.NoError(t, db.Close())
+
+	matched := filepath.Join(dataDir, "small.txt")
+	unmatched := filepath.Join(dataDir, "typo.txt")
+
+	var out bytes.Buffer
+
+	v := newReaderVaultik(ctx, cfg, store, nil, fs)
+	v.UI = ui.NewWithColor(&out, false)
+
+	err = v.Restore(&vaultik.RestoreOptions{
+		SnapshotID: id,
+		TargetDir:  restoreDir,
+		Paths:      []string{matched, unmatched},
+	})
+
+	require.Error(t, err, "a path that matches nothing must fail the restore")
+	assert.Contains(t, out.String(), unmatched,
+		"the path that matches nothing must be named")
+	assert.NotContains(t, out.String(), matched,
+		"the path that matches must not be reported")
+
+	got, err := afero.ReadFile(fs, filepath.Join(restoreDir, matched))
+	require.NoError(t, err, "the path that matches must still be restored")
+	assert.Equal(t, files[matched], got)
+}
+
+// When no requested path matches, nothing is restored and each path is
+// named. One path is relative. The other goes through the symlink that
+// is the snapshot's configured path, while the entries are stored under
+// the directory the symlink points to.
+func TestRestoreNamesEveryPathWhenNothingMatches(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	const snapshotName = "linked"
+
+	fs := afero.NewOsFs()
+	tempDir := t.TempDir()
+	dataDir := filepath.Join(tempDir, "src")
+	linkDir := filepath.Join(tempDir, "srclink")
+	storeDir := filepath.Join(tempDir, "remote")
+	restoreDir := filepath.Join(tempDir, "restored")
+	dbPath := filepath.Join(tempDir, "index.sqlite")
+
+	ctx := context.Background()
+	writeFaultSourceTree(t, fs, dataDir)
+	require.NoError(t, os.Symlink(dataDir, linkDir))
+
+	cfg := faultTestConfig()
+	cfg.IndexPath = dbPath
+	cfg.ChunkSize = config.Size(faultChunkSize)
+	cfg.Snapshots = map[string]config.SnapshotConfig{
+		snapshotName: {Paths: []string{linkDir}},
+	}
+
+	store, err := storage.NewFileStorer(storeDir)
+	require.NoError(t, err)
+
+	db, err := database.New(ctx, dbPath)
+	require.NoError(t, err)
+
+	repos := database.NewRepositories(db)
+	v := newBackupVaultik(ctx, cfg, store, repos, db, fs)
+
+	require.NoError(t, backUp(v, snapshotName))
+
+	id := localSnapshotID(ctx, t, repos, snapshotName)
+	require.NoError(t, db.Close())
+
+	throughLink := filepath.Join(linkDir, "sub")
+	relative := strings.TrimPrefix(filepath.Join(dataDir, "small.txt"), "/")
+
+	var out bytes.Buffer
+
+	reader := newReaderVaultik(ctx, cfg, store, nil, fs)
+	reader.UI = ui.NewWithColor(&out, false)
+
+	err = reader.Restore(&vaultik.RestoreOptions{
+		SnapshotID: id,
+		TargetDir:  restoreDir,
+		Paths:      []string{throughLink, relative},
+	})
+
+	require.Error(t, err, "a restore that matches nothing must fail")
+	assert.Contains(t, out.String(), throughLink,
+		"the path through the symlink must be named")
+	assert.Contains(t, out.String(), relative,
+		"the relative path must be named")
+
+	_, err = fs.Stat(restoreDir)
+	assert.True(t, os.IsNotExist(err), "nothing must be restored")
+}

internal/vaultik/snapshot.go

@@ -633,7 +633,7 @@ func (v *Vaultik) confirmAndExecutePurge(
 			v.stdoutf("  %s (%s, %s)\n",
 				snap.ID,
 				snap.Timestamp.Format("2006-01-02 15:04:05"),
-				ubytes(snap.CompressedSize))
+				formatBytes(snap.CompressedSize))
 		}
 	}
 

internal/vaultik/snapshot_list.go

@@ -553,8 +553,8 @@ func (v *Vaultik) printSnapshotTable(snapshots []SnapshotInfo) error {
 
 		if snap.LocallyTracked {
 			id = snap.ID.String()
-			uncompressed = ubytes(snap.UncompressedSize)
+			uncompressed = formatBytes(snap.UncompressedSize)
-			newChunks = ubytes(snap.NewChunkSize)
+			newChunks = formatBytes(snap.NewChunkSize)
 		} else {
 			id = formatRemoteOnlyID(snap.RemoteKey)
 			uncompressed = remoteOnlyCell
@@ -564,7 +564,7 @@ func (v *Vaultik) printSnapshotTable(snapshots []SnapshotInfo) error {
 		_, err = fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%s\n",
 			id,
 			snap.Timestamp.Format("2006-01-02 15:04:05"),
-			ubytes(snap.CompressedSize),
+			formatBytes(snap.CompressedSize),
 			uncompressed,
 			newChunks)
 		if err != nil {

internal/vaultik/snapshot_list_test.go

@@ -212,8 +212,8 @@ const (
 	listConfiguredName = "home"
 	listLocalID        = "testhost_home_2026-03-01T10:00:00Z"
 	listRemoteID       = "otherhost_media_2026-03-02T11:22:33Z"
-	// fiveMegabytes is printed as "5.0 MB" by every command.
+	// fiveMegabytes formats as "5.0 MB" through formatBytes.
-	fiveMegabytes = 5_000_000
+	fiveMegabytes = 5 * 1024 * 1024
 )
 
 // TestListSnapshots_RemoteWithoutSecretKey is the regression guard for
@@ -306,48 +306,6 @@ func TestListSnapshots_RemoteOnlyRowRendering(t *testing.T) {
 		"are not in the local index")
 }
 
-// TestSnapshotListAndPurgePrintSizesLikeRemoteInfo checks that the
-// `snapshot list` table and the purge listing print a byte count the way
-// `remote info` does: in powers of 1000, as the MB label says.
-func TestSnapshotListAndPurgePrintSizesLikeRemoteInfo(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	const wantSize = "5.0 MB" // fiveMegabytes
-
-	env := newListEnv(t)
-
-	// A remote-only snapshot: `snapshot list` and `remote info` both take
-	// its size from the manifest.
-	remoteKey := env.addRemote(t, listRemoteID,
-		time.Date(2026, 3, 2, 11, 22, 33, 0, time.UTC))
-
-	// A locally tracked snapshot of the same size for the purge to list.
-	// The purge prints the snapshot's blob size, the last argument here.
-	start := time.Date(2026, 3, 1, 10, 0, 0, 0, time.UTC)
-	env.addLocal(t, listLocalID, start)
-	env.addRemote(t, listLocalID, start)
-	require.NoError(t, env.v.Repositories.Snapshots.UpdateCounts(
-		context.Background(), nil, listLocalID, 0, 0, 0, 0, fiveMegabytes))
-
-	require.NoError(t, env.v.RemoteInfo(false))
-	assert.Contains(t, findTableRow(t, env.stdout.String(), remoteKey[:16]),
-		wantSize, "remote info")
-
-	env.stdout.Reset()
-	require.NoError(t, env.v.ListSnapshots(false))
-	assert.Contains(t, findTableRow(t, env.stdout.String(),
-		"<remote only:"+remoteKey[:12]+">"), wantSize, "snapshot list")
-
-	// Without --force and with nothing on stdin the purge lists what it
-	// would delete, reads no confirmation, and deletes nothing.
-	env.stdout.Reset()
-	require.NoError(t, env.v.PurgeSnapshotsWithOptions(
-		&vaultik.SnapshotPurgeOptions{OlderThan: "1d"}))
-	assert.Contains(t, findTableRow(t, env.stdout.String(), listLocalID),
-		wantSize, "snapshot purge")
-}
-
 // findTableRow returns the single output line containing needle.
 func findTableRow(t *testing.T, out, needle string) string {
 	t.Helper()