Refuse config keys that no setting has (closes #419)

config.Parse walks the file as written and fails on the first key that
matches no setting, naming its dotted path and line, so a typo in
exclude or prune_grace_period no longer falls back silently. Keys that a
${...} reference brings in are checked once smartconfig has filled it
in, and named without a line. YAML merge keys and a top-level env
section, which smartconfig reads, still load; an anchor that contains
itself is an error, and each anchored map is checked once per type.
config set refuses such a key before writing, with the same error, and
sets a key under env like any other value. The key-to-field lookup
moves from internal/cli to config.SettingType so both use it.

Model: opus-5-5

README.md

@@ -313,12 +313,10 @@ when the next path element is a number (so
 `vaultik config set age_recipients.0 age1...` works on a file without
 `age_recipients`), otherwise as a map. If the config loads, a change after which
 it would not, such as `vaultik config set compression_level 99`, is refused and
-the file is left unchanged. A config that does not load, such as the one
-`config init` writes before `storage_url` is set or one with a `${ENV:...}`
-reference to a variable not set in this shell, is checked one setting at a time:
-only a change after which the changed setting cannot be read, such as one giving
-it the wrong type (a single value where a list belongs or a word where a number
-belongs), is refused.
+the file is left unchanged. A config that does not load is checked one setting
+at a time. Examples are the file `config init` writes before `storage_url` is
+set, and one with a `${ENV:...}` reference to a variable not set in this shell.
+In such a config, an unknown key or a value of the wrong type is refused.
 
 **`snapshot create`**: Perform incremental backup of configured snapshots.
 
@@ -831,8 +829,7 @@ Work planned after 1.0. Loosely ordered by priority.
 
 Every command's user-facing output is governed by `internal/ui`, in one of two
 ways. Color is enabled when the stream written to is a TTY and the `NO_COLOR`
-environment variable is unset (https://no-color.org/). The same rule governs the
-colorized log lines `internal/log` writes to a terminal.
+environment variable is unset (https://no-color.org/).
 
 - **Status, progress, warnings, and errors** go through the `internal/ui`
   message methods below: marker-prefixed, colored on a TTY, and — except

internal/cli/config.go

@@ -443,11 +443,10 @@ number, otherwise as a map.
 
 If the config loads, a change after which it would not, such as
 compression_level 99, is refused and the file is left unchanged. A
-config that does not load, such as the one config init writes before
-storage_url is set or one with a ${ENV:...} reference to a variable
-not set here, is checked one setting at a time: only a change after
-which the changed setting cannot be read, such as one giving it the
-wrong type, is refused.
+config that does not load is checked one setting at a time. Examples
+are the file config init writes before storage_url is set, and one
+with a ${ENV:...} reference to a variable not set in this shell. In
+such a config, an unknown key or a value of the wrong type is refused.
 
 Examples:
   vaultik config set storage_url "file:///mnt/backups"
@@ -484,6 +483,13 @@ func writeConfigSet(out *ui.Writer, path, key, value string) error {
 
 	keys := strings.Split(key, ".")
 
+	if keys[0] != config.EnvSection {
+		_, err = config.SettingType(keys)
+		if err != nil {
+			return err
+		}
+	}
+
 	err = yamlPathSet(root, keys, value)
 	if err != nil {
 		return err
@@ -739,41 +745,11 @@ func yamlPathSet(root *yaml.Node, keys []string, value string) error {
 }
 
 // configKeyIsString reports whether the dotted key names a string in
-// config.Config, following the fields' yaml tags, as s3.access_key_id and
-// snapshots.home.exclude.0 do.
+// config.Config, as s3.access_key_id and snapshots.home.exclude.0 do.
 func configKeyIsString(keys []string) bool {
-	typ := reflect.TypeFor[config.Config]()
+	typ, err := config.SettingType(keys)
 
-	for _, key := range keys {
-		switch {
-		case typ.Kind() == reflect.Map || typ.Kind() == reflect.Slice:
-			// The key is a snapshot name or a list index.
-			typ = typ.Elem()
-		case typ.Kind() == reflect.Struct:
-			field, ok := yamlField(typ, key)
-			if !ok {
-				return false
-			}
-
-			typ = field.Type
-		default:
-			return false
-		}
-	}
-
-	return typ.Kind() == reflect.String
-}
-
-// yamlField returns the field of struct type typ whose yaml tag names key.
-func yamlField(typ reflect.Type, key string) (reflect.StructField, bool) {
-	for field := range typ.Fields() {
-		name, _, _ := strings.Cut(field.Tag.Get("yaml"), ",")
-		if name == key {
-			return field, true
-		}
-	}
-
-	return reflect.StructField{}, false
+	return err == nil && typ.Kind() == reflect.String
 }
 
 // yamlSetInMapping resolves (creating if needed) the value node for the

internal/cli/config_test.go

@@ -225,7 +225,7 @@ func TestConfigSetIndexUnderMissingKey(t *testing.T) {
 // change after which the config would not load, with an error giving the
 // reason, and leaves the file as it was. On the file `config init` writes,
 // which does not load until storage_url is set, and on one that cannot be
-// read here, only a value of the wrong type is refused.
+// read here, only an unknown key or a value of the wrong type is refused.
 func TestConfigSetKeepsFileThatWouldNotLoad(t *testing.T) {
 	t.Parallel()
 
@@ -237,6 +237,14 @@ func TestConfigSetKeepsFileThatWouldNotLoad(t *testing.T) {
 		value  string
 		reason string
 	}{
+		// Keys that no setting has, on a config that loads and on one
+		// that does not.
+		{configWithoutRecipients, "nosuchkey", "1",
+			`unknown config key "nosuchkey"`},
+		{configWithoutRecipients, "snapshots.home.exlude", "/tmp",
+			`unknown config key "snapshots.home.exlude"`},
+		{defaultConfigText(macOS), "compression_lvl", "9",
+			`unknown config key "compression_lvl"`},
 		// Index 1 of the empty list the missing key gives.
 		{configWithoutRecipients, "age_recipients.1", testRecipient,
 			"index out of range"},
@@ -335,6 +343,39 @@ func TestConfigSetRefusesOnlyItsOwnFailure(t *testing.T) {
 	}
 }
 
+// TestConfigSetWritesEnvSection checks that config set writes a key under
+// the top-level env section, whose keys are not settings, on a config that
+// loads.
+func TestConfigSetWritesEnvSection(t *testing.T) {
+	const name = "VAULTIK_TEST_CONFIG_SET_ENV"
+
+	// Loading the changed config sets the variable; t.Setenv restores it
+	// after the test.
+	t.Setenv(name, "")
+
+	path := filepath.Join(t.TempDir(), "config.yml")
+
+	err := os.WriteFile(path, []byte(configWithoutRecipients), configFileMode)
+	if err != nil {
+		t.Fatalf("write config: %v", err)
+	}
+
+	err = writeConfigSet(ui.NewWithColor(&bytes.Buffer{}, false),
+		path, "env."+name, "value")
+	if err != nil {
+		t.Fatalf("config set env.%s: %v", name, err)
+	}
+
+	data, err := os.ReadFile(path) //nolint:gosec // G304: test-controlled path
+	if err != nil {
+		t.Fatalf("read config: %v", err)
+	}
+
+	if !strings.Contains(string(data), "env:\n  "+name+": value\n") {
+		t.Errorf("config set env.%s wrote:\n%s", name, data)
+	}
+}
+
 // TestConfigSetStringLooksLikeNumber sets string settings to values that
 // YAML reads as numbers or booleans when they are unquoted, and checks that
 // config.Load returns each one unchanged.

internal/cli/database.go

@@ -7,6 +7,7 @@ import (
 	"github.com/spf13/cobra"
 	"sneak.berlin/go/vaultik/internal/config"
 	"sneak.berlin/go/vaultik/internal/log"
+	"sneak.berlin/go/vaultik/internal/vaultik"
 )
 
 // NewDatabaseCommand creates the database command group
@@ -90,12 +91,12 @@ Use --force to skip the confirmation prompt.`,
 
 				var confirm string
 
-				_, err = fmt.Scanln(&confirm)
+				// A failure to read the answer means no confirmation.
+				_, err = fmt.Fscanln(cmd.InOrStdin(), &confirm)
 				if err != nil || confirm != "yes" {
 					_, _ = fmt.Fprintln(w, "Aborted.")
 
-					//nolint:nilerr // a failed/aborted confirmation is a clean abort
-					return nil
+					return vaultik.ErrNotConfirmed
 				}
 			}
 

internal/cli/database_test.go

@@ -0,0 +1,48 @@
+package cli //nolint:testpackage // sets the unexported rootFlags directly
+
+import (
+	"bytes"
+	"errors"
+	"io"
+	"os"
+	"strings"
+	"testing"
+
+	"sneak.berlin/go/vaultik/internal/vaultik"
+)
+
+// TestDatabaseDeleteDeclinedIsError checks that answering anything but
+// "yes" keeps the database and returns ErrNotConfirmed, so the command
+// exits non-zero.
+//
+//nolint:paralleltest // mutates the process-global rootFlags
+func TestDatabaseDeleteDeclinedIsError(t *testing.T) {
+	dir := t.TempDir()
+	dbPath, cfgPath := seedDatabaseDeleteConfig(t, dir)
+
+	setRootFlags(t, RootFlags{ConfigPath: cfgPath})
+
+	var out bytes.Buffer
+
+	cmd := newDatabaseDeleteCommand()
+	cmd.SetOut(&out)
+	cmd.SetErr(io.Discard)
+	cmd.SetIn(strings.NewReader("no\n"))
+	cmd.SetArgs(nil)
+
+	err := cmd.Execute()
+	if !errors.Is(err, vaultik.ErrNotConfirmed) {
+		t.Errorf("declined database delete returned %v, want %v",
+			err, vaultik.ErrNotConfirmed)
+	}
+
+	_, err = os.Stat(dbPath)
+	if err != nil {
+		t.Errorf("declined database delete removed the file: %v", err)
+	}
+
+	if !strings.Contains(out.String(), "Aborted.") {
+		t.Errorf("declined database delete printed %q, want Aborted.",
+			out.String())
+	}
+}

internal/config/config.go

@@ -9,6 +9,7 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"reflect"
 	"sort"
 	"strings"
 	"time"
@@ -286,15 +287,37 @@ func Load(path string) (*Config, error) {
 }
 
 // Parse reads YAML config data as Load does, without validating it. It
-// applies default values for optional fields, fills in ${...} references
-// using smartconfig, and expands ~ in paths.
+// refuses a key that no setting has, applies default values for optional
+// fields, fills in ${...} references using smartconfig, and expands ~ in
+// paths.
 func Parse(data []byte) (*Config, error) {
+	// smartconfig drops line numbers, so keys are checked in the data as
+	// written.
+	var root yaml.Node
+
+	err := yaml.Unmarshal(data, &root)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse config: %w", err)
+	}
+
+	err = checkKeys(&root, reflect.TypeFor[Config](), "",
+		map[*yaml.Node]bool{}, map[nodeAndType]bool{})
+	if err != nil {
+		return nil, err
+	}
+
 	// Load config using smartconfig for interpolation
 	sc, err := smartconfig.NewFromReader(bytes.NewReader(data))
 	if err != nil {
 		return nil, fmt.Errorf("failed to load config file: %w", err)
 	}
 
+	// A ${...} reference can bring in keys that are not in the file.
+	err = checkFilledKeys(sc.Data())
+	if err != nil {
+		return nil, err
+	}
+
 	cfg := &Config{
 		// Set defaults
 		BlobSizeLimit:    defaultBlobSizeLimit,

internal/config/keys.go

@@ -0,0 +1,214 @@
+package config
+
+import (
+	"errors"
+	"fmt"
+	"reflect"
+	"strconv"
+	"strings"
+
+	"gopkg.in/yaml.v3"
+)
+
+// yamlMergeTag is the tag YAML gives a merge key (<<), which adds the keys
+// of the map it names to the map it sits in.
+const yamlMergeTag = "!!merge"
+
+// EnvSection is the top-level key of a map of environment variables that
+// smartconfig sets while it loads the config. It is not a vaultik setting,
+// so its keys are not checked.
+const EnvSection = "env"
+
+var (
+	errUnknownKey           = errors.New("unknown config key")
+	errAnchorContainsItself = errors.New("anchor contains itself")
+)
+
+// nodeAndType is a node of a parsed config and the setting type it is
+// checked against.
+type nodeAndType struct {
+	node *yaml.Node
+	typ  reflect.Type
+}
+
+// SettingType returns the type of the setting that the dotted key names in
+// Config, following the fields' yaml tags, as for s3.bucket or
+// snapshots.home.exclude.0. A snapshot name or a list index may be any
+// word. It returns an unknown key error when no setting has that key.
+func SettingType(keys []string) (reflect.Type, error) {
+	typ := reflect.TypeFor[Config]()
+
+	for _, key := range keys {
+		switch {
+		case typ.Kind() == reflect.Map || typ.Kind() == reflect.Slice:
+			typ = typ.Elem()
+		case typ.Kind() == reflect.Struct:
+			field, ok := yamlField(typ, key)
+			if !ok {
+				return nil, fmt.Errorf("%w %q", errUnknownKey, strings.Join(keys, "."))
+			}
+
+			typ = field.Type
+		default:
+			return nil, fmt.Errorf("%w %q", errUnknownKey, strings.Join(keys, "."))
+		}
+	}
+
+	return typ, nil
+}
+
+// yamlField returns the field of struct type typ whose yaml tag names key.
+func yamlField(typ reflect.Type, key string) (reflect.StructField, bool) {
+	for field := range typ.Fields() {
+		name, _, _ := strings.Cut(field.Tag.Get("yaml"), ",")
+		if name == key && name != "-" {
+			return field, true
+		}
+	}
+
+	return reflect.StructField{}, false
+}
+
+// checkKeys returns an error naming the first key in node, a parsed config
+// or part of one at the dotted path, that no setting in typ has. The error
+// gives the key's line in the file, when it has one. A value of the wrong
+// type is left for the YAML decoder to report. following holds the aliases
+// the walk is inside. Meeting one of them again means its anchor contains
+// itself, which is an error. checked holds each anchored node the walk has
+// checked completely, with the type it was checked against. An alias to
+// that node is not followed again for that type.
+func checkKeys(node *yaml.Node, typ reflect.Type, path string,
+	following map[*yaml.Node]bool, checked map[nodeAndType]bool,
+) error {
+	switch node.Kind {
+	case yaml.DocumentNode:
+		for _, child := range node.Content {
+			err := checkKeys(child, typ, path, following, checked)
+			if err != nil {
+				return err
+			}
+		}
+	case yaml.AliasNode:
+		if following[node] {
+			return fmt.Errorf("%w: %q on line %d",
+				errAnchorContainsItself, node.Value, node.Line)
+		}
+
+		target := nodeAndType{node.Alias, typ}
+		if checked[target] {
+			return nil
+		}
+
+		following[node] = true
+		defer delete(following, node)
+
+		err := checkKeys(node.Alias, typ, path, following, checked)
+		if err != nil {
+			return err
+		}
+
+		checked[target] = true
+	case yaml.SequenceNode:
+		if typ.Kind() != reflect.Slice {
+			return nil
+		}
+
+		for i, child := range node.Content {
+			err := checkKeys(child, typ.Elem(), joinKey(path, strconv.Itoa(i)),
+				following, checked)
+			if err != nil {
+				return err
+			}
+		}
+	case yaml.MappingNode:
+		return checkMappingKeys(node, typ, path, following, checked)
+	case yaml.ScalarNode:
+		// A scalar has no keys.
+	}
+
+	return nil
+}
+
+// checkFilledKeys is checkKeys for data, the config after smartconfig has
+// filled in its ${...} references. A key that a reference brings in is not
+// in the file, and the copy that Encode makes has no line numbers.
+func checkFilledKeys(data map[string]any) error {
+	var filled yaml.Node
+
+	err := filled.Encode(data)
+	if err != nil {
+		return fmt.Errorf("failed to marshal config data: %w", err)
+	}
+
+	return checkKeys(&filled, reflect.TypeFor[Config](), "",
+		map[*yaml.Node]bool{}, map[nodeAndType]bool{})
+}
+
+// checkMappingKeys is checkKeys for a map.
+func checkMappingKeys(node *yaml.Node, typ reflect.Type, path string,
+	following map[*yaml.Node]bool, checked map[nodeAndType]bool,
+) error {
+	for i := 0; i+1 < len(node.Content); i += 2 {
+		key, value := node.Content[i], node.Content[i+1]
+
+		if key.Tag == yamlMergeTag {
+			// The value is one map or a list of maps.
+			merged := []*yaml.Node{value}
+			if value.Kind == yaml.SequenceNode {
+				merged = value.Content
+			}
+
+			for _, m := range merged {
+				err := checkKeys(m, typ, path, following, checked)
+				if err != nil {
+					return err
+				}
+			}
+
+			continue
+		}
+
+		keyPath := joinKey(path, key.Value)
+		if keyPath == EnvSection {
+			continue
+		}
+
+		var valueType reflect.Type
+
+		switch {
+		case typ.Kind() == reflect.Map:
+			valueType = typ.Elem()
+		case typ.Kind() == reflect.Struct:
+			field, ok := yamlField(typ, key.Value)
+			if !ok && key.Line == 0 {
+				// A key that a ${...} reference brought in has no line.
+				return fmt.Errorf("%w %q", errUnknownKey, keyPath)
+			}
+
+			if !ok {
+				return fmt.Errorf("%w %q on line %d",
+					errUnknownKey, keyPath, key.Line)
+			}
+
+			valueType = field.Type
+		default:
+			return nil
+		}
+
+		err := checkKeys(value, valueType, keyPath, following, checked)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// joinKey appends key to the dotted path.
+func joinKey(path, key string) string {
+	if path == "" {
+		return key
+	}
+
+	return path + "." + key
+}

internal/config/keys_test.go

@@ -0,0 +1,163 @@
+package config //nolint:testpackage // checks the unexported errUnknownKey
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"slices"
+	"strconv"
+	"strings"
+	"testing"
+)
+
+// keysTestConfig loads; each case below adds one line to it.
+const keysTestConfig = "storage_url: file:///tmp/vaultik-test-storage\n" +
+	"s3:\n" +
+	"  region: us-east-1\n" +
+	"snapshots:\n" +
+	"  test:\n" +
+	"    paths: [/tmp/vaultik-test-source]\n"
+
+// TestParseRefusesUnknownKey checks that a key no setting has, at any
+// depth, fails the parse with an error naming the key and its line. A key
+// that a ${...} reference brings in is not in the file, so its error gives
+// no line.
+func TestParseRefusesUnknownKey(t *testing.T) {
+	t.Parallel()
+
+	snapshotPath := filepath.Join(t.TempDir(), "snapshot.yml")
+
+	err := os.WriteFile(snapshotPath, []byte("other:\n"+
+		"  paths: [/tmp/vaultik-test-source]\n"+
+		"  exlude: [/tmp/cache]\n"), 0o600)
+	if err != nil {
+		t.Fatalf("write snapshot: %v", err)
+	}
+
+	tests := []struct {
+		name string
+		yaml string
+		want string
+	}{
+		{"top level", keysTestConfig + "compression_lvl: 9\n",
+			`unknown config key "compression_lvl" on line 7`},
+		{"in a snapshot", keysTestConfig + "    exlude: [/tmp/cache]\n",
+			`unknown config key "snapshots.test.exlude" on line 7`},
+		{"in s3", strings.Replace(keysTestConfig, "  region:",
+			"  bukcet: b\n  region:", 1),
+			`unknown config key "s3.bukcet" on line 3`},
+		{"from a reference",
+			keysTestConfig + "  other: ${YAML:" + snapshotPath + ":other}\n",
+			`unknown config key "snapshots.other.exlude"`},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			_, err := Parse([]byte(tt.yaml))
+			if !errors.Is(err, errUnknownKey) {
+				t.Fatalf("Parse() error = %v, want errUnknownKey", err)
+			}
+
+			if err.Error() != tt.want {
+				t.Errorf("Parse() error = %q, want %q", err.Error(), tt.want)
+			}
+		})
+	}
+}
+
+// TestParseRefusesAnchorThatContainsItself checks that a YAML merge key (<<)
+// naming the anchor of the map it sits in fails the parse with an error.
+func TestParseRefusesAnchorThatContainsItself(t *testing.T) {
+	t.Parallel()
+
+	data := strings.Replace(keysTestConfig, "  test:", "  test: &test", 1) +
+		"    <<: *test\n"
+
+	_, err := Parse([]byte(data))
+	if !errors.Is(err, errAnchorContainsItself) {
+		t.Fatalf("Parse() error = %v, want errAnchorContainsItself", err)
+	}
+
+	want := `anchor contains itself: "test" on line 7`
+	if err.Error() != want {
+		t.Errorf("Parse() error = %q, want %q", err.Error(), want)
+	}
+}
+
+// TestParseRefusesExcessiveAliasing checks that Parse returns an error for
+// a file whose merge keys (<<) fan out. Each of eight snapshots merges the
+// one before it ten times. A key check that followed every alias would walk
+// the first snapshot over 10^8 times and run past the package's test
+// timeout.
+func TestParseRefusesExcessiveAliasing(t *testing.T) {
+	t.Parallel()
+
+	const snapshots, merges = 8, 10
+
+	var data strings.Builder
+
+	data.WriteString(strings.Replace(keysTestConfig, "  test:", "  test: &s0", 1))
+
+	for i := 1; i <= snapshots; i++ {
+		aliases := slices.Repeat([]string{"*s" + strconv.Itoa(i-1)}, merges)
+		fmt.Fprintf(&data, "  s%d: &s%d\n    <<: [%s]\n",
+			i, i, strings.Join(aliases, ", "))
+	}
+
+	_, err := Parse([]byte(data.String()))
+	if err == nil {
+		t.Fatal("Parse() returned no error")
+	}
+}
+
+// TestParseAcceptsKnownKeys checks that a config with a ${...} reference
+// and a YAML merge key (<<) still parses.
+func TestParseAcceptsKnownKeys(t *testing.T) {
+	t.Parallel()
+
+	levelPath := filepath.Join(t.TempDir(), "level")
+
+	err := os.WriteFile(levelPath, []byte("9"), 0o600)
+	if err != nil {
+		t.Fatalf("write level: %v", err)
+	}
+
+	data := strings.Replace(keysTestConfig, "  test:", "  test: &test", 1) +
+		"  other:\n" +
+		"    <<: *test\n" +
+		"    exclude: [/tmp/vaultik-test-source/cache]\n" +
+		"compression_level: ${FILE:" + levelPath + "}\n"
+
+	cfg, err := Parse([]byte(data))
+	if err != nil {
+		t.Fatalf("Parse() unexpected error: %v", err)
+	}
+
+	if cfg.CompressionLevel != 9 {
+		t.Errorf("compression_level = %d, want 9", cfg.CompressionLevel)
+	}
+
+	other := cfg.Snapshots["other"]
+	if len(other.Paths) != 1 || len(other.Exclude) != 1 {
+		t.Errorf("snapshot other = %+v, want the paths of test and one exclude",
+			other)
+	}
+}
+
+// TestParseAcceptsEnvSection checks that a config with a top-level env
+// section still parses. smartconfig sets the environment variables it
+// lists, so its keys are not settings.
+func TestParseAcceptsEnvSection(t *testing.T) {
+	const name = "VAULTIK_TEST_ENV_SECTION"
+
+	// Parse sets the variable; t.Setenv restores it after the test.
+	t.Setenv(name, "")
+
+	_, err := Parse([]byte(keysTestConfig + "env:\n  " + name + ": set\n"))
+	if err != nil {
+		t.Fatalf("Parse() unexpected error: %v", err)
+	}
+}

internal/log/tty_handler.go

@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"io"
 	"log/slog"
-	"os"
 	"strconv"
 	"strings"
 	"sync"
@@ -61,12 +60,6 @@ type TTYHandler struct {
 	mu   *sync.Mutex
 	out  io.Writer
 
-	// color reports whether records are written with ANSI color. It is
-	// false when NO_COLOR is set, matching internal/ui's shouldColor
-	// test; the caller already chose this handler for a terminal, so
-	// TTY-ness is not re-checked here.
-	color bool
-
 	// attrs are the attributes accumulated through WithAttrs, emitted
 	// ahead of each record's own attributes. Their keys already carry
 	// the group path that was open when they were added, so no
@@ -79,19 +72,16 @@ type TTYHandler struct {
 	groups []string
 }
 
-// NewTTYHandler creates a new TTY handler. Color is enabled unless the
-// NO_COLOR environment variable is set to a non-empty value, the same
-// test internal/ui applies to status lines.
+// NewTTYHandler creates a new TTY handler with colored output.
 func NewTTYHandler(out io.Writer, opts *slog.HandlerOptions) *TTYHandler {
 	if opts == nil {
 		opts = &slog.HandlerOptions{}
 	}
 
 	return &TTYHandler{
-		out:   out,
-		opts:  *opts,
-		mu:    &sync.Mutex{},
-		color: os.Getenv("NO_COLOR") == "",
+		out:  out,
+		opts: *opts,
+		mu:   &sync.Mutex{},
 	}
 }
 
@@ -134,10 +124,10 @@ func (h *TTYHandler) Handle(_ context.Context, r slog.Record) error {
 	// are written around it: it can carry text from an untrusted source
 	// (a storage error, for one), and a raw control character would
 	// otherwise reach the terminal.
-	_, _ = fmt.Fprintf(h.out, "%s %s %s",
-		h.paint(colorGray, timestamp),
-		h.paint(levelColor, level),
-		h.paint(colorBold, sanitize(r.Message)))
+	_, _ = fmt.Fprintf(h.out, "%s%s%s %s%s%s %s%s%s",
+		colorGray, timestamp, colorReset,
+		levelColor, level, colorReset,
+		colorBold, sanitize(r.Message), colorReset)
 
 	// Attributes carried by the handler come first, then the record's
 	// own. Handler attributes were qualified when they were added; the
@@ -246,7 +236,6 @@ func (h *TTYHandler) clone() *TTYHandler {
 		opts:   h.opts,
 		mu:     h.mu,
 		out:    h.out,
-		color:  h.color,
 		attrs:  make([]slog.Attr, len(h.attrs), len(h.attrs)+1),
 		groups: make([]string, len(h.groups), len(h.groups)+1),
 	}
@@ -284,19 +273,9 @@ func (h *TTYHandler) writeAttr(a slog.Attr) {
 	// the snapshot database — so a control character in one of them must
 	// be rendered as an escape sequence rather than reaching the terminal,
 	// where it could move the cursor or inject its own colours.
-	_, _ = fmt.Fprintf(h.out, " %s=%s",
-		h.paint(colorCyan, sanitize(a.Key)),
-		h.paint(colorBlue, sanitize(value)))
-}
-
-// paint wraps s in the given ANSI color when color is enabled, and
-// returns s unchanged otherwise.
-func (h *TTYHandler) paint(color, s string) string {
-	if !h.color {
-		return s
-	}
-
-	return color + s + colorReset
+	_, _ = fmt.Fprintf(h.out, " %s%s%s=%s%s%s",
+		colorCyan, sanitize(a.Key), colorReset,
+		colorBlue, sanitize(value), colorReset)
 }
 
 // sanitize returns s unchanged when every rune in it is printable, and a

internal/log/tty_handler_test.go

@@ -421,44 +421,3 @@ func TestTTYHandlerEmptyGroupAndAttrsAreNoOps(t *testing.T) {
 	assert.Contains(t, plain, "kept=yes")
 	assert.NotContains(t, plain, " =")
 }
-
-// TestTTYHandlerRespectsNoColor checks that only a non-empty NO_COLOR
-// turns color off, matching internal/ui's shouldColor test. The handler
-// is only ever chosen for a terminal, so this is the one remaining
-// condition that can still leave color in log output.
-func TestTTYHandlerRespectsNoColor(t *testing.T) {
-	cases := []struct {
-		name    string
-		noColor string
-		colored bool
-	}{
-		{
-			name:    "NO_COLOR turns color off",
-			noColor: "1",
-		},
-		{
-			name:    "empty NO_COLOR keeps color on",
-			noColor: "",
-			colored: true,
-		},
-	}
-
-	for _, testCase := range cases {
-		t.Run(testCase.name, func(t *testing.T) {
-			t.Setenv("NO_COLOR", testCase.noColor)
-
-			var buf bytes.Buffer
-
-			logger := slog.New(log.NewTTYHandler(&buf, debugHandlerOptions()))
-			logger.Info("hello", "key", "value")
-
-			if testCase.colored {
-				assert.Contains(t, buf.String(), "\x1b[",
-					"an empty NO_COLOR must leave ANSI color in log output")
-			} else {
-				assert.NotContains(t, buf.String(), "\x1b[",
-					"NO_COLOR must suppress every ANSI escape in log output")
-			}
-		})
-	}
-}

internal/vaultik/missing_destination_test.go

@@ -7,6 +7,7 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"sync"
 	"testing"
 
 	"github.com/spf13/afero"
@@ -24,19 +25,28 @@ import (
 // that is not plugged in, cannot be listed. It is not an empty store, so
 // no command may conclude from it that the local snapshots are gone.
 
-// newFileDestinationVaultik returns a Vaultik that backs up the
-// snapshot named "first" to a file:// destination at storeDir.
+// newFileDestinationVaultik writes the fault source tree and returns a
+// Vaultik that backs it up to a file:// destination at storeDir.
 func newFileDestinationVaultik(
 	ctx context.Context, t *testing.T, storeDir string,
 ) (*vaultik.Vaultik, *database.Repositories) {
 	t.Helper()
 
-	osFs := afero.NewOsFs()
 	tempDir := t.TempDir()
 	dataDir := filepath.Join(tempDir, "src")
-	dbPath := filepath.Join(tempDir, "index.sqlite")
+	writeFaultSourceTree(t, afero.NewOsFs(), dataDir)
 
-	writeFaultSourceTree(t, osFs, dataDir)
+	return openFileDestinationVaultik(ctx, t, storeDir, dataDir,
+		filepath.Join(tempDir, "index.sqlite"))
+}
+
+// openFileDestinationVaultik returns a Vaultik that backs up dataDir to a
+// file:// destination at storeDir, with its local index at dbPath. The
+// index is closed when the test ends.
+func openFileDestinationVaultik(
+	ctx context.Context, t *testing.T, storeDir, dataDir, dbPath string,
+) (*vaultik.Vaultik, *database.Repositories) {
+	t.Helper()
 
 	store, err := storage.NewFileStorer(storeDir)
 	require.NoError(t, err)
@@ -48,22 +58,84 @@ func newFileDestinationVaultik(
 	repos := database.NewRepositories(db)
 	cfg := changedFileConfig(dataDir, dbPath)
 
-	return newBackupVaultik(ctx, cfg, store, repos, db, osFs), repos
+	return newBackupVaultik(ctx, cfg, store, repos, db, afero.NewOsFs()), repos
+}
+
+// firstBackup is one backup of the snapshot named "first" to a file://
+// destination. dir holds its source tree in src, its store in store and
+// its closed local index in index/index.sqlite. The first test that
+// needs it makes it, and TestMain removes it. Every test that copies it
+// backs up the same source tree, so no test may change that tree.
+//
+//nolint:gochecknoglobals // made once and shared by the tests that copy it
+var firstBackup struct {
+	once  sync.Once
+	dir   string
+	ready bool
+}
+
+// TestMain removes firstBackup once every test has run.
+func TestMain(m *testing.M) {
+	code := m.Run()
+
+	_ = os.RemoveAll(firstBackup.dir)
+
+	os.Exit(code)
+}
+
+// makeFirstBackup writes the fault source tree and backs it up as the
+// snapshot named "first", all in a new directory that it records in
+// firstBackup.
+func makeFirstBackup(ctx context.Context, t *testing.T) {
+	t.Helper()
+
+	dir, err := os.MkdirTemp("", "vaultik-first-backup-")
+	require.NoError(t, err)
+
+	firstBackup.dir = dir
+	storeDir := filepath.Join(dir, "store")
+	dataDir := filepath.Join(dir, "src")
+	indexDir := filepath.Join(dir, "index")
+
+	require.NoError(t, os.Mkdir(storeDir, 0o750))
+	require.NoError(t, os.Mkdir(indexDir, 0o750))
+	writeFaultSourceTree(t, afero.NewOsFs(), dataDir)
+
+	v, _ := openFileDestinationVaultik(ctx, t, storeDir, dataDir,
+		filepath.Join(indexDir, "index.sqlite"))
+	require.NoError(t, backUp(v, "first"))
+	require.NoError(t, v.DB.Close())
+
+	firstBackup.ready = true
 }
 
 // backUpToFileDestination creates the directory storeDir, as a user must
-// before the first backup, and backs up the snapshot named "first" to a
-// file:// destination there. Everything the returned Vaultik prints
-// after the backup goes to the returned buffer.
+// before the first backup, and returns a Vaultik whose file://
+// destination there holds a backup of the snapshot named "first". The
+// store and the local index are copies of firstBackup's, which is faster
+// than backing up in every test. The returned Vaultik backs up a source
+// tree shared with every other caller, so no test may change that tree.
+// Everything the returned Vaultik prints after the backup goes to the
+// returned buffer.
 func backUpToFileDestination(
 	ctx context.Context, t *testing.T, storeDir string,
 ) (*vaultik.Vaultik, *database.Repositories, *bytes.Buffer) {
 	t.Helper()
 
-	require.NoError(t, os.MkdirAll(storeDir, 0o750))
+	firstBackup.once.Do(func() { makeFirstBackup(ctx, t) })
+	require.True(t, firstBackup.ready, "another test failed to make firstBackup")
 
-	v, repos := newFileDestinationVaultik(ctx, t, storeDir)
-	require.NoError(t, backUp(v, "first"))
+	require.NoError(t, os.MkdirAll(storeDir, 0o750))
+	require.NoError(t, os.CopyFS(storeDir,
+		os.DirFS(filepath.Join(firstBackup.dir, "store"))))
+
+	indexDir := t.TempDir()
+	require.NoError(t, os.CopyFS(indexDir,
+		os.DirFS(filepath.Join(firstBackup.dir, "index"))))
+
+	v, repos := openFileDestinationVaultik(ctx, t, storeDir,
+		filepath.Join(firstBackup.dir, "src"),
+		filepath.Join(indexDir, "index.sqlite"))
 
 	out := &bytes.Buffer{}
 	v.Stdout = out

internal/vaultik/prune.go

@@ -267,7 +267,7 @@ func (v *Vaultik) PruneBlobs(opts *PruneOptions) error {
 
 	if !v.confirmPrune(opts, len(unreferencedBlobs), totalSize,
 		dirsWithoutManifest) {
-		return nil
+		return ErrNotConfirmed
 	}
 
 	v.deleteUnreferencedBlobs(unreferencedBlobs, allBlobs, result)

internal/vaultik/prune_metadata_dir_test.go

@@ -176,7 +176,8 @@ func TestPruneDeclinedKeepsMetadataDirWithoutManifest(t *testing.T) {
 
 	env.v.Stdin = strings.NewReader("n\n")
 
-	require.NoError(t, env.v.PruneBlobs(&vaultik.PruneOptions{}))
+	require.ErrorIs(t, env.v.PruneBlobs(&vaultik.PruneOptions{}),
+		vaultik.ErrNotConfirmed)
 
 	assert.True(t, env.store.hasKey(leftDB),
 		"a declined prune must keep the directory")

internal/vaultik/remove_quiet_test.go

@@ -54,9 +54,10 @@ func TestPurgeSnapshots_QuietPromptListsSnapshots(t *testing.T) {
 	v.UI.SetQuiet(true)
 
 	// Stdin is empty, so the prompt reads no answer and cancels.
-	require.NoError(t, v.PurgeSnapshotsWithOptions(&vaultik.SnapshotPurgeOptions{
+	err := v.PurgeSnapshotsWithOptions(&vaultik.SnapshotPurgeOptions{
 		KeepLatest: true,
-	}))
+	})
+	require.ErrorIs(t, err, vaultik.ErrNotConfirmed)
 
 	assert.Contains(t, out.String(), snapHomeT0)
 	assert.Contains(t, out.String(), "Delete 1 snapshot(s)? [y/N]")
@@ -77,7 +78,8 @@ func TestPruneBlobs_QuietPromptShowsBlobTotal(t *testing.T) {
 	addBlob(t, env.store.testStorer, testBlobHashA)
 
 	// Stdin is empty, so the prompt reads no answer and cancels.
-	require.NoError(t, env.v.PruneBlobs(&vaultik.PruneOptions{}))
+	require.ErrorIs(t, env.v.PruneBlobs(&vaultik.PruneOptions{}),
+		vaultik.ErrNotConfirmed)
 
 	assert.Contains(t, env.stdout.String(),
 		"Found 1 unreferenced blob(s) totaling")

internal/vaultik/remove_snapshot_test.go

@@ -337,6 +337,27 @@ func TestRemoveSnapshot_DefaultRemovesMetadataNotBlobs(t *testing.T) {
 	assert.Contains(t, out, "vaultik prune")
 }
 
+// TestRemoveSnapshot_DeclinedIsError checks that answering no to the
+// prompt keeps the snapshot and returns ErrNotConfirmed, so the command
+// exits non-zero.
+func TestRemoveSnapshot_DeclinedIsError(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	store := newTestStorer()
+	addManifest(t, store, "snapshot-001", nil)
+
+	tv := vaultik.NewForTesting(store)
+	tv.Repositories = newLocalIndex(t, "snapshot-001")
+	tv.Stdin.WriteString("n\n")
+
+	_, err := tv.RemoveSnapshot("snapshot-001", &vaultik.RemoveOptions{})
+
+	require.ErrorIs(t, err, vaultik.ErrNotConfirmed)
+	assert.True(t, store.hasKey(remoteKeyPath("snapshot-001")))
+	assert.Contains(t, tv.Stdout.String(), "Cancelled")
+}
+
 func TestRemoveSnapshot_DryRun(t *testing.T) {
 	log.Initialize(log.Config{})
 	t.Parallel()

internal/vaultik/restore_locality_test.go

@@ -46,11 +46,11 @@ import (
 //     slice out a few KB — currently the dominant cost in restore.
 //
 // The test deliberately constructs an adversarial scenario: three
-// blobs A/B/C of ~6 MB each, nine files distributed across them, and
-// path-ordered names that interleave the blobs (a1, b1, c1, a2, b2,
-// c2, …) so naive path-order processing would touch every blob before
-// finishing any of them.
-// localitySource is one 1 MiB fixture file used by the locality test.
+// blobs A/B/C of five 64 KiB chunks each, nine files distributed across
+// them, and path-ordered names that interleave the blobs (a1, b1, c1,
+// a2, b2, c2, …) so naive path-order processing would touch every blob
+// before finishing any of them.
+// localitySource is one 64 KiB fixture file used by the locality test.
 type localitySource struct {
 	path string
 	data []byte
@@ -65,10 +65,10 @@ type localityCopy struct {
 
 // localitySourceBytes is the size of each source file of the locality
 // fixture.
-const localitySourceBytes = 1024 * 1024
+const localitySourceBytes = 64 * 1024
 
 // buildLocalityFixture writes the adversarial source layout described
-// in TestRestoreLocalityAndReadAt: 15 sources of 1 MiB each (which the
+// in TestRestoreLocalityAndReadAt: 15 sources of 64 KiB each (which the
 // backup packs into 3 blobs of 5 chunks) plus 9 interleaved-name copies
 // (3 per blob group).
 func buildLocalityFixture(

internal/vaultik/restore_sweeper_integration_test.go

@@ -27,10 +27,10 @@ import (
 // TestRestoreSweeperEvictsBlobs exercises the reference-counted blob
 // disk cache eviction during restore.
 //
-// The scenario: 30 unique 1 MB random files plus 10 duplicates of those
-// (40 files total, 30 MB of unique content) get backed up with a 10 MB
-// blob_size_limit. After backup the snapshot's encrypted blobs are
-// restored through Vaultik.Restore, and per-key Get counts on the
+// The scenario: 30 unique 128 KiB random files plus 10 duplicates of
+// those (40 files total, 3.75 MiB of unique content) get backed up with
+// a 1 MiB blob_size_limit. After backup the snapshot's encrypted blobs
+// are restored through Vaultik.Restore, and per-key Get counts on the
 // storage layer are recorded. Each blob in the snapshot MUST be
 // downloaded exactly once — re-downloads would mean the sweeper either
 // evicted a blob that was still needed (LRU regression) or that the
@@ -41,7 +41,7 @@ import (
 // original AND every duplicate referencing its chunks have been
 // restored.
 // buildSweeperFixture writes the source layout for the sweeper test: 30
-// unique 1 MB random files plus 10 duplicates of a random subset. The
+// unique 128 KiB random files plus 10 duplicates of a random subset. The
 // PRNG seed is fixed so failures are reproducible; the entropy is what
 // matters here — the FastCDC chunker needs realistic-looking data to
 // pick chunk boundaries naturally. Returns the expected content by
@@ -51,7 +51,7 @@ func buildSweeperFixture(
 ) map[string][]byte {
 	t.Helper()
 
-	const fileSize = 1 * 1024 * 1024
+	const fileSize = 128 * 1024
 
 	rng := rand.New(rand.NewSource(42)) //nolint:gosec // G404: fixture data only
 
@@ -159,7 +159,7 @@ func runSweeperBackup(
 	require.NoError(t, err)
 	require.Equal(t, uniqueFiles+duplicateFiles, scanResult.FilesScanned)
 	require.Greater(t, scanResult.BlobsCreated, 1,
-		"30 MB of unique data at 10 MB blob size should yield multiple blobs")
+		"3.75 MiB of unique data at 1 MiB blob size should yield multiple blobs")
 
 	require.NoError(t, sm.CompleteSnapshot(ctx, snapshotID))
 	require.NoError(t, sm.ExportSnapshotMetadata(ctx, dbPath, snapshotID))
@@ -199,8 +199,8 @@ func TestRestoreSweeperEvictsBlobs(t *testing.T) {
 
 	expected := buildSweeperFixture(t, fs, dataDir, uniqueFiles, duplicateFiles)
 
-	chunkSize := int64(64 * 1024)
-	maxBlobSize := int64(10 * 1024 * 1024)
+	chunkSize := int64(16 * 1024)
+	maxBlobSize := int64(1024 * 1024)
 
 	storer, err := storage.NewFileStorer(storeDir)
 	require.NoError(t, err)

internal/vaultik/snapshot.go

@@ -881,17 +881,12 @@ func (v *Vaultik) confirmAndExecutePurge(
 
 		var confirm string
 
+		// A failure to read the answer means no confirmation.
 		_, err := v.scanStdin(&confirm)
-		if err != nil {
+		if err != nil || strings.ToLower(confirm) != "y" {
 			v.printlnStdout("Cancelled")
 
-			return nil //nolint:nilerr // treat EOF or read error as "no"
-		}
-
-		if strings.ToLower(confirm) != "y" {
-			v.printlnStdout("Cancelled")
-
-			return nil
+			return ErrNotConfirmed
 		}
 	} else if !quiet {
 		v.UI.Infof("The following snapshots will be deleted:")
@@ -1490,7 +1485,7 @@ func (v *Vaultik) RemoveSnapshot(
 	}
 
 	if !v.confirmRemoveSnapshot(snapshotID, opts) {
-		return result, nil
+		return result, ErrNotConfirmed
 	}
 
 	// Checked before the local record is deleted: it may be the last

internal/vaultik/snapshot_list_test.go

@@ -187,6 +187,17 @@ func (e *listEnv) addRemoteRawTimestamp(
 	t.Helper()
 
 	remoteKey := snapshot.RemoteSnapshotKey(snapshotID)
+	e.putRemoteManifest(t, remoteKey,
+		encodeRemoteManifest(t, remoteKey, timestamp))
+
+	return remoteKey
+}
+
+// encodeRemoteManifest returns the encoded manifest of a one-blob
+// snapshot whose remote key is remoteKey.
+func encodeRemoteManifest(t *testing.T, remoteKey, timestamp string) []byte {
+	t.Helper()
+
 	manifest := &snapshot.Manifest{
 		// Note: the hashed key, never the human ID. That is precisely
 		// why a remote-only snapshot cannot be named.
@@ -202,11 +213,17 @@ func (e *listEnv) addRemoteRawTimestamp(
 	data, err := snapshot.EncodeManifest(manifest, 3)
 	require.NoError(t, err)
 
-	err = e.store.Put(context.Background(),
+	return data
+}
+
+// putRemoteManifest stores an encoded manifest on the destination store
+// under remoteKey.
+func (e *listEnv) putRemoteManifest(t *testing.T, remoteKey string, data []byte) {
+	t.Helper()
+
+	err := e.store.Put(context.Background(),
 		"metadata/"+remoteKey+"/manifest.json.zst", bytes.NewReader(data))
 	require.NoError(t, err)
-
-	return remoteKey
 }
 
 // Fixtures shared across the listing tests.
@@ -345,8 +362,9 @@ func TestSnapshotListAndPurgePrintSizesLikeRemoteInfo(t *testing.T) {
 	// Without --force and with nothing on stdin the purge lists what it
 	// would delete, reads no confirmation, and deletes nothing.
 	env.stdout.Reset()
-	require.NoError(t, env.v.PurgeSnapshotsWithOptions(
-		&vaultik.SnapshotPurgeOptions{OlderThan: "1d"}))
+	require.ErrorIs(t, env.v.PurgeSnapshotsWithOptions(
+		&vaultik.SnapshotPurgeOptions{OlderThan: "1d"}),
+		vaultik.ErrNotConfirmed)
 	assert.Contains(t, findTableRow(t, env.stdout.String(), listLocalID),
 		wantSize, "snapshot purge")
 }
@@ -791,9 +809,17 @@ func TestListSnapshots_JSONReportsTruncation(t *testing.T) {
 
 	timestamp := time.Date(2026, 3, 2, 11, 22, 33, 0, time.UTC)
 
-	// One past the cap, so exactly one snapshot is omitted.
+	// One past the cap, so exactly one snapshot is omitted. The listing
+	// names a snapshot by the key its manifest is stored under, never by
+	// the manifest's own ID. So all of them share one encoded manifest:
+	// encoding 1001 took seconds.
+	data := encodeRemoteManifest(t,
+		snapshot.RemoteSnapshotKey("otherhost_bulk"),
+		timestamp.Format(time.RFC3339))
+
 	for i := range maxRemoteOnlyRowsForTest + 1 {
-		env.addRemote(t, fmt.Sprintf("otherhost_bulk_%04d", i), timestamp)
+		env.putRemoteManifest(t, snapshot.RemoteSnapshotKey(
+			fmt.Sprintf("otherhost_bulk_%04d", i)), data)
 	}
 
 	stderr := captureProcessStderr(t, func() {

internal/vaultik/vaultik.go

@@ -5,6 +5,7 @@ package vaultik
 import (
 	"bytes"
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -184,6 +185,12 @@ func (v *Vaultik) printlnStdout(args ...any) {
 	_, _ = fmt.Fprintln(v.Stdout, args...)
 }
 
+// ErrNotConfirmed is returned when a confirmation prompt gets any answer
+// but the one it asks for (`y` or `Y`, or `yes` for `database delete`), or
+// stdin ends first. Nothing the prompt asked about is deleted, and the
+// command exits non-zero.
+var ErrNotConfirmed = errors.New("deletion not confirmed")
+
 // scanStdin reads a line of input from stdin.
 func (v *Vaultik) scanStdin(a ...any) (int, error) {
 	return fmt.Fscanln(v.Stdin, a...)