snapshot remove accepts a remote-only snapshot's remote key (closes #400)

A host with no local index could remove a remote-only snapshot only by
its plain snapshot ID, which it does not have. snapshot remove passed
its argument through RemoteSnapshotKey, rehashing a remote key so it
never matched. It now resolves a remote key, or an unambiguous leading
part of it, with the same resolveSnapshotRemoteKey that verify and
restore use. The prompt, the dry run and the warning after a failed
remote delete name the snapshot it resolved to: its ID when known,
otherwise its full remote key. Under --json, snapshot_id holds the ID
only when it is known, and remote_key holds the full key.

Model: deepseek-v4-pro (change); opus-5-5 (rebase onto next, rework)

README.md

@@ -171,7 +171,6 @@ vaultik [--config <path>] config get <key>
 vaultik [--config <path>] config set <key> <value>
 vaultik [--config <path>] snapshot create [snapshot-names...] [--cron] [--prune] [--keep-newer-than <duration>]
 vaultik [--config <path>] snapshot list [--json]                  # alias: ls
-vaultik [--config <path>] snapshot files <snapshot-id> [path] [--json]
 vaultik [--config <path>] snapshot verify <snapshot-id> [--deep] [--json]
 vaultik [--config <path>] snapshot purge [--keep-latest | --older-than <duration>] [--snapshot <name>...] [--force]
 vaultik [--config <path>] snapshot remove <snapshot-id> [--dry-run] [--force] [--local-only] [--json]  # alias: rm
@@ -224,12 +223,12 @@ the backup can delete it; the new snapshot then cannot be restored.
 `remote nuke` deletes everything regardless. To not depend on the grace period,
 give each host or user its own prefix (or directory) on the destination.
 
-Read-only commands — `info`, `snapshot list`, `snapshot files`,
-`snapshot verify`, and `remote info` — do not take the lock and are never
-blocked, so they run even while a backup is in progress. `snapshot restore` does
-not take the lock either: it writes only to the target directory you name, not
-the local index or the destination store. `config`, `database delete`,
-`completion`, and `version` do not take the lock.
+Read-only commands — `info`, `snapshot list`, `snapshot verify`, and
+`remote info` — do not take the lock and are never blocked, so they run even
+while a backup is in progress. `snapshot restore` does not take the lock either:
+it writes only to the target directory you name, not the local index or the
+destination store. `config`, `database delete`, `completion`, and `version` do
+not take the lock.
 
 ### stdout and stderr
 
@@ -262,9 +261,9 @@ work as written.
 ### environment variables
 
 - `VAULTIK_AGE_SECRET_KEY`: Age private key for decryption (required for
-  `snapshot restore`, `snapshot files` and `snapshot verify --deep`). May hold
-  the whole `age-keygen` file — comments and every identity in it are accepted.
-  Set it from the file, e.g.
+  `snapshot restore` and `snapshot verify --deep`). May hold the whole
+  `age-keygen` file — comments and every identity in it are accepted. Set it
+  from the file, e.g.
   `export VAULTIK_AGE_SECRET_KEY="$(cat vaultik_backup_private_key.txt)"`, so
   the key is not typed into your shell history.
 - `VAULTIK_CONFIG`: Path to config file (overridden by `--config`)
@@ -409,17 +408,6 @@ point behind.
   truncated listing all go to stderr through the logger, so stdout stays a
   single parseable document.
 
-**`snapshot files`**: List the files in a snapshot without restoring it. Each
-row of the table shows mode, size in bytes, modification time and path, sorted
-by path.
-
-- Requires `VAULTIK_AGE_SECRET_KEY`: the file list is only in the snapshot's
-  encrypted database, which the command downloads and decrypts.
-- Accepts the same identifiers as `snapshot restore`.
-- An optional path limits the list to that path and what is under it. A path
-  that matches nothing in the snapshot is an error.
-- `--json`: Output an array of objects with `path`, `size`, `mode` and `mtime`.
-
 **`snapshot verify`**: Verify snapshot integrity.
 
 - Default (shallow): checks that every blob the manifest lists is present in
@@ -460,6 +448,8 @@ remove the snapshot's metadata from it (`vaultik prune` does not). For a
 snapshot that is only on the destination store, that failure is an error. To
 wipe everything on the destination in one go, use `vaultik remote nuke --force`.
 
+- Accepts a snapshot ID, or — for a snapshot only on the destination store — its
+  remote key (or an unambiguous leading part of it) as shown by `snapshot list`.
 - `--local-only`: Skip remote cleanup; only touch the local index
 - `--dry-run`: Show what would be deleted without deleting
 - `--force`: Skip confirmation prompt
@@ -734,7 +724,7 @@ annotated example also lives in
 | Field                | Default                         | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 | -------------------- | ------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `age_recipients`     | (required by `snapshot create`) | Age public keys for encryption. Other commands run without one, so a machine that only restores can leave it empty                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| `age_secret_key`     | (unset)                         | Age private key for decryption (`snapshot restore`, `snapshot files`, `snapshot verify --deep`). Setting it in the config file places the private key on the backed-up host, defeating the public-key-only design (see "why" above). Prefer the `VAULTIK_AGE_SECRET_KEY` environment variable, supplied only on the machine you restore from.                                                                                                                                                                                                                                                                                                                    |
+| `age_secret_key`     | (unset)                         | Age private key for decryption (`snapshot restore`, `snapshot verify --deep`). Setting it in the config file places the private key on the backed-up host, defeating the public-key-only design (see "why" above). Prefer the `VAULTIK_AGE_SECRET_KEY` environment variable, supplied only on the machine you restore from.                                                                                                                                                                                                                                                                                                                                      |
 | `snapshots`          | (required)                      | Named snapshot definitions with paths and excludes                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
 | `storage_url`        |                                 | Storage backend URL (`s3://`, `file://`, `rclone://`)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
 | `s3.*`               |                                 | Legacy S3 configuration (endpoint, bucket, credentials)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
@@ -852,14 +842,14 @@ environment variable is unset (https://no-color.org/).
 - **The data a command exists to produce** is written plain, with no marker and
   no color, because a marker would corrupt a table or a parsed document. This
   covers the `version`, `info`, `remote info` and `snapshot verify` reports, the
-  `snapshot list` and `snapshot files` tables, `config get` values, and every
-  `--json` document. `--quiet` silences the human reports and tables (`version`,
-  `info`, `remote info`, `snapshot verify`, `snapshot list`, `snapshot files`)
-  but never the machine-consumed `config get` value or the `--json` documents,
-  which a script depends on. The confirmation prompts of `database delete`,
-  `prune`, `snapshot purge` and `snapshot remove`, each with what it asks to
-  delete, are also written this way and always shown: they are an interactive
-  exchange the operator must see.
+  `snapshot list` table, `config get` values, and every `--json` document.
+  `--quiet` silences the human reports and tables (`version`, `info`,
+  `remote info`, `snapshot verify`, `snapshot list`) but never the
+  machine-consumed `config get` value or the `--json` documents, which a script
+  depends on. The confirmation prompts of `database delete`, `prune`,
+  `snapshot purge` and `snapshot remove`, each with what it asks to delete, are
+  also written this way and always shown: they are an interactive exchange the
+  operator must see.
 
 `internal/ui` writes to stdout; it is the output the user asked for. The
 exceptions are the startup banner and the error a failed command ends with,

internal/cli/app.go

@@ -337,7 +337,7 @@ func runVaultikApp(
 		},
 		Mode: mode,
 	}, op, func(err error) {
-		log.Info(failMsg, "error", err)
+		log.Error(failMsg, "error", err)
 		ReportErrorf("%s: %v", failMsg, err)
 	})
 }

internal/cli/entry.go

@@ -85,10 +85,6 @@ func emitStartupBanner(args []string, w io.Writer) {
 // 🛑 ERROR: format. Use it from goroutine error paths (where returning
 // an error to cobra isn't an option) and anywhere else a CLI command
 // must surface a failure outside the normal RunE return path.
-//
-// This line is the one report of the failure. A caller that also logs
-// the failure logs it at info level, so the record appears only under
-// --verbose or --debug and the error is not printed twice.
 func ReportErrorf(format string, args ...any) {
 	ui.New(os.Stderr).Errorf(format, args...)
 }

internal/cli/entry_failure_once_test.go

@@ -1,205 +0,0 @@
-package cli //nolint:testpackage // shares the fixtures and capture helpers
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"io"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"filippo.io/age"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"sneak.berlin/go/vaultik/internal/database"
-	"sneak.berlin/go/vaultik/internal/ui"
-)
-
-const (
-	// errorLinePrefix starts the final line that reports a failed command.
-	errorLinePrefix = "ERROR: "
-
-	flagVerbose = "--verbose"
-	cmdRestore  = "restore"
-
-	// blobsDir is the directory of a destination store that holds the
-	// blobs.
-	blobsDir = "blobs"
-)
-
-// TestEntryFailureIsPrintedOnce runs commands that fail after startup
-// against a destination they cannot use. `info` is not among them: it
-// cannot fail after startup.
-//
-//nolint:paralleltest // replaces os.Args, os.Stdout, os.Stderr and the xdg globals
-func TestEntryFailureIsPrintedOnce(t *testing.T) {
-	for _, command := range [][]string{
-		{cmdSnapshot, cmdCreate},
-		{cmdSnapshot, cmdRemove, someSnapshotID},
-		{cmdSnapshot, cmdVerify, someSnapshotID},
-		{cmdRemote, cmdInfo},
-		{cmdPrune, flagJSON},
-	} {
-		for _, verbose := range []bool{false, true} {
-			name := fmt.Sprintf("%s verbose=%t", strings.Join(command, " "), verbose)
-
-			t.Run(name, func(t *testing.T) {
-				requireErrorPrintedOnce(t, verbose, append([]string{flagConfig,
-					writeUnusableDestinationConfig(t)}, command...)...)
-			})
-		}
-	}
-}
-
-// TestEntryBlobUploadFailureIsPrintedOnce backs up to a destination
-// whose blobs directory is a file, so the blob upload fails.
-//
-//nolint:paralleltest // replaces os.Args, os.Stdout, os.Stderr and the xdg globals
-func TestEntryBlobUploadFailureIsPrintedOnce(t *testing.T) {
-	for _, verbose := range []bool{false, true} {
-		t.Run(fmt.Sprintf("verbose=%t", verbose), func(t *testing.T) {
-			configPath, storeDir := writeBackupConfig(t)
-
-			require.NoError(t, os.WriteFile(
-				filepath.Join(storeDir, blobsDir), nil, 0o600))
-
-			requireErrorPrintedOnce(t, verbose,
-				flagConfig, configPath, cmdSnapshot, cmdCreate)
-		})
-	}
-}
-
-// TestEntryBlobDownloadFailureIsPrintedOnce backs up, deletes the blobs
-// from the destination, and restores, so the blob download fails.
-//
-//nolint:paralleltest // replaces os.Args, os.Stdout, os.Stderr and the xdg globals
-func TestEntryBlobDownloadFailureIsPrintedOnce(t *testing.T) {
-	for _, verbose := range []bool{false, true} {
-		t.Run(fmt.Sprintf("verbose=%t", verbose), func(t *testing.T) {
-			configPath, storeDir := writeBackupConfigWithPrivateKey(t)
-
-			code, _, _ := runEntry(t,
-				flagConfig, configPath, cmdSnapshot, cmdCreate)
-			require.Equal(t, 0, code)
-
-			require.NoError(t, os.RemoveAll(filepath.Join(storeDir, blobsDir)))
-
-			requireErrorPrintedOnce(t, verbose, flagConfig, configPath,
-				cmdSnapshot, cmdRestore, onlySnapshotID(t, configPath), t.TempDir())
-		})
-	}
-}
-
-// requireErrorPrintedOnce runs Entry with args, adding --verbose when
-// verbose is set. The command must fail, and stderr must carry its error
-// once, as the final ERROR: line. A log record carrying the same error
-// appears only under --verbose.
-func requireErrorPrintedOnce(t *testing.T, verbose bool, args ...string) {
-	t.Helper()
-
-	if verbose {
-		args = append(args, flagVerbose)
-	}
-
-	code, _, stderr := runEntry(t, args...)
-	require.Equal(t, 1, code)
-
-	errorLine, records := failureOutput(t, stderr)
-
-	if !verbose {
-		assert.Zero(t, records,
-			"without --verbose no log record repeats the error:\n%s", stderr)
-
-		return
-	}
-
-	assert.NotZero(t, records,
-		"--verbose must keep the log record of %q", errorLine)
-}
-
-// failureOutput requires stderr to hold exactly one ERROR: line and
-// returns it, with the number of log records whose error attribute is
-// the error that line reports. stderr is a pipe here, so every log
-// record is a JSON object on its own line.
-func failureOutput(t *testing.T, stderr string) (string, int) {
-	t.Helper()
-
-	var (
-		errorLines []string
-		records    []map[string]any
-	)
-
-	for line := range strings.Lines(stderr) {
-		var record map[string]any
-		if json.Unmarshal([]byte(line), &record) == nil {
-			records = append(records, record)
-
-			continue
-		}
-
-		if strings.Contains(line, errorLinePrefix) {
-			errorLines = append(errorLines, strings.TrimSpace(line))
-		}
-	}
-
-	require.Len(t, errorLines, 1,
-		"the error must be printed once as an ERROR: line:\n%s", stderr)
-
-	// An error can run over several lines; the ERROR: line holds the
-	// first of them.
-	repeats := 0
-
-	for _, record := range records {
-		failure, ok := record["error"].(string)
-		firstLine, _, _ := strings.Cut(failure, "\n")
-
-		if ok && strings.Contains(errorLines[0], firstLine) {
-			repeats++
-		}
-	}
-
-	return errorLines[0], repeats
-}
-
-// writeBackupConfigWithPrivateKey builds what writeBackupConfig builds,
-// with a generated key pair in place of its recipient. The config also
-// holds the private key, so that restore can decrypt the backup. Returns
-// the config path and the store directory.
-func writeBackupConfigWithPrivateKey(t *testing.T) (string, string) {
-	t.Helper()
-
-	configPath, storeDir := writeBackupConfig(t)
-
-	identity, err := age.GenerateX25519Identity()
-	require.NoError(t, err)
-
-	out := ui.NewWithColor(io.Discard, false)
-
-	require.NoError(t, writeConfigSet(out, configPath,
-		"age_recipients.0", identity.Recipient().String()))
-	require.NoError(t, writeConfigSet(out, configPath,
-		"age_secret_key", identity.String()))
-
-	return configPath, storeDir
-}
-
-// onlySnapshotID returns the ID of the one snapshot in the local index
-// that writeBackupConfig puts beside the config file.
-func onlySnapshotID(t *testing.T, configPath string) string {
-	t.Helper()
-
-	ctx := context.Background()
-
-	db, err := database.New(ctx,
-		filepath.Join(filepath.Dir(configPath), "index.sqlite"))
-	require.NoError(t, err)
-
-	defer func() { require.NoError(t, db.Close()) }()
-
-	backedUp, err := database.NewRepositories(db).Snapshots.GetOnlySnapshot(ctx)
-	require.NoError(t, err)
-
-	return backedUp.ID.String()
-}

internal/cli/entry_snapshot_create_prune_test.go

@@ -61,8 +61,8 @@ func TestEntrySnapshotCreateRejectsKeepNewerThanBeforeBackup(t *testing.T) {
 
 // TestEntrySnapshotCreateReportsPostBackupPruneFailure makes the
 // post-backup prune fail after a good backup, by planting a manifest
-// that cannot be decoded, and checks that the failure is reported once,
-// as the prune's and not as a failed snapshot creation.
+// that cannot be decoded, and checks that the failure is reported as the
+// prune's and not as a failed snapshot creation.
 //
 //nolint:paralleltest // replaces os.Args, os.Stdout, os.Stderr and the xdg globals
 func TestEntrySnapshotCreateReportsPostBackupPruneFailure(t *testing.T) {
@@ -83,9 +83,6 @@ func TestEntrySnapshotCreateReportsPostBackupPruneFailure(t *testing.T) {
 	assert.Contains(t, stderr, "Backup completed, but post-backup prune failed")
 	assert.NotContains(t, stderr, "Snapshot creation failed")
 
-	_, repeats := failureOutput(t, stderr)
-	assert.Zero(t, repeats, "no log record may repeat the error:\n%s", stderr)
-
 	snapshots, err := os.ReadDir(filepath.Join(storeDir, "metadata"))
 	require.NoError(t, err)
 	assert.Len(t, snapshots, 2,
@@ -96,8 +93,7 @@ func TestEntrySnapshotCreateReportsPostBackupPruneFailure(t *testing.T) {
 // empties the source directory, as a volume that is not mounted leaves
 // its mount point, and runs `snapshot create --prune`. The command exits
 // non-zero and reports the backup as completed, not as a failed snapshot
-// creation. The error is printed once. See
-// https://git.eeqj.de/sneak/vaultik/issues/388.
+// creation. See https://git.eeqj.de/sneak/vaultik/issues/388.
 //
 //nolint:paralleltest // replaces os.Args, os.Stdout, os.Stderr and the xdg globals
 func TestEntrySnapshotCreatePruneExitsNonZeroWhenSourceIsEmpty(t *testing.T) {
@@ -118,9 +114,6 @@ func TestEntrySnapshotCreatePruneExitsNonZeroWhenSourceIsEmpty(t *testing.T) {
 		"Backup completed, but 1 source path(s) were empty")
 	assert.NotContains(t, stderr, "Snapshot creation failed")
 
-	_, repeats := failureOutput(t, stderr)
-	assert.Zero(t, repeats, "no log record may repeat the error:\n%s", stderr)
-
 	snapshots, err := os.ReadDir(filepath.Join(storeDir, "metadata"))
 	require.NoError(t, err)
 	assert.Len(t, snapshots, 2, "the older snapshot is kept")
@@ -131,8 +124,7 @@ func TestEntrySnapshotCreatePruneExitsNonZeroWhenSourceIsEmpty(t *testing.T) {
 // directory as a mount point, and runs `snapshot create --prune`, which
 // does not find it as one. The command exits non-zero, reports the
 // backup as completed, not as a failed snapshot creation, and keeps the
-// older snapshot. The error is printed once. See
-// https://git.eeqj.de/sneak/vaultik/issues/395.
+// older snapshot. See https://git.eeqj.de/sneak/vaultik/issues/395.
 //
 //nolint:paralleltest // replaces os.Args, os.Stdout, os.Stderr and the xdg globals
 func TestEntrySnapshotCreatePruneExitsNonZeroWhenMountPointIsMissing(
@@ -167,9 +159,6 @@ func TestEntrySnapshotCreatePruneExitsNonZeroWhenMountPointIsMissing(
 		"an earlier snapshot recorded were not found")
 	assert.NotContains(t, stderr, "Snapshot creation failed")
 
-	_, repeats := failureOutput(t, stderr)
-	assert.Zero(t, repeats, "no log record may repeat the error:\n%s", stderr)
-
 	snapshots, err := os.ReadDir(filepath.Join(storeDir, "metadata"))
 	require.NoError(t, err)
 	assert.Len(t, snapshots, 2, "the older snapshot is kept")

internal/cli/info.go

@@ -39,7 +39,7 @@ func NewInfoCommand() *cobra.Command {
 			}, func(v *vaultik.Vaultik) error {
 				return v.ShowInfo()
 			}, func(err error) {
-				log.Info("Failed to show info", "error", err)
+				log.Error("Failed to show info", "error", err)
 				ReportErrorf("Failed to show info: %v", err)
 			})
 		},

internal/cli/prune.go

@@ -60,7 +60,7 @@ referenced.`,
 			}, func(v *vaultik.Vaultik) error {
 				return v.Prune(opts)
 			}, func(err error) {
-				log.Info("Prune operation failed", "error", err)
+				log.Error("Prune operation failed", "error", err)
 				ReportErrorf("Prune failed: %v", err)
 			})
 		},

internal/cli/remote.go

@@ -98,7 +98,7 @@ func newRemoteInfoCommand() *cobra.Command {
 			}, func(v *vaultik.Vaultik) error {
 				return v.RemoteInfo(jsonOutput)
 			}, func(err error) {
-				log.Info("Failed to get remote info", "error", err)
+				log.Error("Failed to get remote info", "error", err)
 				ReportErrorf("Failed to get remote info: %v", err)
 			})
 		},

internal/cli/snapshot.go

@@ -9,10 +9,6 @@ import (
 	"sneak.berlin/go/vaultik/internal/vaultik"
 )
 
-// filesMaxArgs is the maximum positional argument count of
-// `snapshot files <snapshot-id> [path]`.
-const filesMaxArgs = 2
-
 var (
 	errSnapshotIDRequired  = errors.New("snapshot ID required")
 	errWrongArgCount       = errors.New("wrong argument count")
@@ -56,7 +52,6 @@ func NewSnapshotCommand() *cobra.Command {
 	// Add subcommands
 	cmd.AddCommand(newSnapshotCreateCommand())
 	cmd.AddCommand(newSnapshotListCommand())
-	cmd.AddCommand(newSnapshotFilesCommand())
 	cmd.AddCommand(newSnapshotPurgeCommand())
 	cmd.AddCommand(newSnapshotVerifyCommand())
 	cmd.AddCommand(newSnapshotRemoveCommand())
@@ -114,7 +109,7 @@ on Linux), then /etc/vaultik/config.yml.`,
 				return v.CreateSnapshot(opts)
 			}, func(err error) {
 				if errors.Is(err, vaultik.ErrPostBackupPruneFailed) {
-					log.Info("Post-backup prune failed", "error", err)
+					log.Error("Post-backup prune failed", "error", err)
 					ReportErrorf("Backup completed, but %v", err)
 
 					return
@@ -123,13 +118,13 @@ on Linux), then /etc/vaultik/config.yml.`,
 				if errors.Is(err, vaultik.ErrFilesUnreadable) ||
 					errors.Is(err, vaultik.ErrSourcePathEmpty) ||
 					errors.Is(err, vaultik.ErrVolumeNotMounted) {
-					log.Info("Backup completed with an error", "error", err)
+					log.Error("Backup completed with an error", "error", err)
 					ReportErrorf("Backup completed, but %v", err)
 
 					return
 				}
 
-				log.Info("Snapshot creation failed", "error", err)
+				log.Error("Snapshot creation failed", "error", err)
 				ReportErrorf("Snapshot creation failed: %v", err)
 			})
 		},
@@ -177,44 +172,6 @@ func newSnapshotListCommand() *cobra.Command {
 	return cmd
 }
 
-// newSnapshotFilesCommand creates the 'snapshot files' subcommand
-func newSnapshotFilesCommand() *cobra.Command {
-	var jsonOutput bool
-
-	cmd := &cobra.Command{
-		Use:   "files <snapshot-id> [path]",
-		Short: "List the files in a snapshot",
-		Long: `Lists the path, size, mode and modification time of every file in a
-snapshot, without restoring it. With a path, lists only that path and
-what is under it; a path that matches nothing is an error.
-
-The snapshot may be named by its ID or, on a host with no local index,
-by the remote key that 'snapshot list' prints for a remote-only snapshot
-(an unambiguous leading part is enough).
-
-The file list is only in the snapshot's encrypted database, so this
-downloads and decrypts it, and requires the age private key in the
-VAULTIK_AGE_SECRET_KEY environment variable, as 'snapshot restore' does.`,
-		Args: cobra.RangeArgs(1, filesMaxArgs),
-		RunE: func(cmd *cobra.Command, args []string) error {
-			path := ""
-			if len(args) == filesMaxArgs {
-				path = args[1]
-			}
-
-			return runVaultikApp(cmd, readOnly, jsonOutput,
-				"Failed to list snapshot files",
-				func(v *vaultik.Vaultik) error {
-					return v.ListSnapshotFiles(args[0], path, jsonOutput)
-				})
-		},
-	}
-
-	cmd.Flags().BoolVar(&jsonOutput, "json", false, "Output in JSON format")
-
-	return cmd
-}
-
 // newSnapshotPurgeCommand creates the 'snapshot purge' subcommand
 func newSnapshotPurgeCommand() *cobra.Command {
 	opts := &vaultik.SnapshotPurgeOptions{}
@@ -301,7 +258,7 @@ func newSnapshotVerifyCommand() *cobra.Command {
 					return
 				}
 
-				log.Info("Verification failed", "error", err)
+				log.Error("Verification failed", "error", err)
 				ReportErrorf("Verification failed: %v", err)
 			})
 		},
@@ -331,6 +288,10 @@ know about), which is what 'vaultik prune' does. The command prints the
 'vaultik prune' invocation to run as a follow-up only when it removed the
 snapshot's metadata from the destination store, and never under --json.
 
+The snapshot may be named by its ID or, on a host with no local index, by
+the remote key that 'snapshot list' prints for a remote-only snapshot (an
+unambiguous leading part is enough).
+
 An ID that names no snapshot in the local index or on the destination
 store is an error.
 

internal/cli/snapshot_restore.go

@@ -104,7 +104,7 @@ func runRestore(cmd *cobra.Command, args []string, opts *RestoreOptions) error {
 			SkipErrors: rootFlags.SkipErrors,
 		})
 	}, func(err error) {
-		log.Info("Restore operation failed", "error", err)
+		log.Error("Restore operation failed", "error", err)
 		ReportErrorf("Restore failed: %v", err)
 	})
 }

internal/config/config.go

@@ -396,8 +396,6 @@ func Parse(data []byte) (*Config, error) {
 //     never the value. An empty list is accepted, because only snapshot
 //     create needs a recipient and it checks for one itself
 //   - At least one snapshot must be configured with at least one path
-//   - Every exclude pattern, global or in a snapshot, must compile; errors
-//     name the setting and quote the pattern
 //   - Storage must be configured (either storage_url or s3.* fields)
 //   - The index path must be absolute: a relative one would resolve against
 //     the working directory, so each directory would get its own index
@@ -418,18 +416,18 @@ func (c *Config) Validate() error {
 		}
 	}
 
-	err := c.validateSnapshots()
-	if err != nil {
-		return err
+	if len(c.Snapshots) == 0 {
+		return errNoSnapshots
 	}
 
-	err = c.validateExcludes()
-	if err != nil {
-		return err
+	for name, snap := range c.Snapshots {
+		if len(snap.Paths) == 0 {
+			return fmt.Errorf("%w: %q", errSnapshotNoPaths, name)
+		}
 	}
 
 	// Validate storage configuration
-	err = c.validateStorage()
+	err := c.validateStorage()
 	if err != nil {
 		return err
 	}
@@ -468,22 +466,6 @@ func (c *Config) Validate() error {
 	return nil
 }
 
-// validateSnapshots refuses a config with no snapshot or with a snapshot
-// that has no path.
-func (c *Config) validateSnapshots() error {
-	if len(c.Snapshots) == 0 {
-		return errNoSnapshots
-	}
-
-	for name, snap := range c.Snapshots {
-		if len(snap.Paths) == 0 {
-			return fmt.Errorf("%w: %q", errSnapshotNoPaths, name)
-		}
-	}
-
-	return nil
-}
-
 // validateAgeRecipient parses one age_recipients entry with the age library
 // and returns a value-free error on failure. A recipient string can be
 // sensitive (an operator may paste a secret key by mistake), so neither the

internal/config/exclude.go

@@ -1,39 +0,0 @@
-package config
-
-import (
-	"fmt"
-
-	"sneak.berlin/go/vaultik/internal/exclude"
-)
-
-// validateExcludes refuses an exclude pattern, global or in a snapshot,
-// that does not compile, naming the setting and quoting the pattern.
-func (c *Config) validateExcludes() error {
-	err := validateExcludeList("exclude", c.Exclude)
-	if err != nil {
-		return err
-	}
-
-	for _, name := range c.SnapshotNames() {
-		err = validateExcludeList("snapshots."+name+".exclude",
-			c.Snapshots[name].Exclude)
-		if err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
-// validateExcludeList refuses the first pattern in patterns that does not
-// compile. setting is the name of the list, as in "exclude".
-func validateExcludeList(setting string, patterns []string) error {
-	for i, pattern := range patterns {
-		_, _, err := exclude.Compile(pattern)
-		if err != nil {
-			return fmt.Errorf("%s[%d]: %w", setting, i, err)
-		}
-	}
-
-	return nil
-}

internal/config/exclude_test.go

@@ -1,65 +0,0 @@
-package config_test
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"sneak.berlin/go/vaultik/internal/config"
-)
-
-// TestLoadRefusesBadExcludePattern checks that an exclude pattern that does
-// not compile, global or in a snapshot, fails at load with the setting and
-// the pattern named, rather than the backup storing what it meant to leave
-// out.
-func TestLoadRefusesBadExcludePattern(t *testing.T) {
-	t.Parallel()
-
-	const storage = "storage_url: file:///tmp/vaultik-test-storage\n"
-
-	tests := []struct {
-		name    string
-		config  string
-		wantErr string
-	}{
-		{
-			name: "global",
-			config: "exclude: ['*.tmp', '.cache', 'build[']\n" +
-				"snapshots:\n" +
-				"  home:\n" +
-				"    paths: [/tmp/vaultik-test-source]\n" + storage,
-			wantErr: `exclude[2]: "build[" is not a valid exclude pattern`,
-		},
-		{
-			name: "snapshot",
-			config: "snapshots:\n" +
-				"  home:\n" +
-				"    paths: [/tmp/vaultik-test-source]\n" +
-				"    exclude: ['/a/**/x[']\n" + storage,
-			wantErr: `snapshots.home.exclude[0]: "/a/**/x[" is not a valid exclude pattern`,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			path := filepath.Join(t.TempDir(), "config.yml")
-
-			err := os.WriteFile(path, []byte(tt.config), 0o600)
-			if err != nil {
-				t.Fatalf("write config: %v", err)
-			}
-
-			_, err = config.Load(path)
-			if err == nil {
-				t.Fatalf("Load() returned nil, want an error containing %q", tt.wantErr)
-			}
-
-			if !strings.Contains(err.Error(), tt.wantErr) {
-				t.Fatalf("Load() error = %q, want it to contain %q", err, tt.wantErr)
-			}
-		})
-	}
-}

internal/exclude/exclude.go

@@ -1,77 +0,0 @@
-// Package exclude compiles exclude patterns into globs.
-package exclude
-
-import (
-	"errors"
-	"fmt"
-	"strings"
-
-	"github.com/gobwas/glob"
-)
-
-var errBadExcludePattern = errors.New("is not a valid exclude pattern")
-
-// Compile compiles one exclude pattern into the globs that match it.
-// anchored reports whether the pattern matches only from the root of the
-// source directory. An empty pattern yields no globs. Config.Validate and
-// the scanner both compile patterns with it, so a pattern that loads is one
-// the scanner can use.
-func Compile(pattern string) ([]glob.Glob, bool, error) {
-	if pattern == "" {
-		return nil, false, nil
-	}
-
-	// A leading "/" anchors the pattern to the source directory.
-	trimmed, anchored := strings.CutPrefix(pattern, "/")
-
-	// A trailing "/" marks a directory and is not matched.
-	trimmed = strings.TrimSuffix(trimmed, "/")
-
-	// A leading "**/" demands a "/" before the name and so misses an
-	// entry directly under the source path. It means "at every depth",
-	// which is what an unanchored pattern already does, so drop the
-	// prefix and match unanchored: as in gitignore, "**/x" and
-	// "/**/x" then also match a top-level "x".
-	if rest, found := strings.CutPrefix(trimmed, "**/"); found {
-		trimmed = rest
-		anchored = false
-	}
-
-	// Likewise "/**/" inside a pattern demands two slashes, so
-	// "a/**/*.log" misses "a/x.log". As in gitignore it stands for
-	// zero or more directories, so also compile the pattern with it
-	// made a single "/". The glob library's {a,b} is no help: with a
-	// "**" inside it in mid-pattern, it misses paths it should match.
-	var globs []glob.Glob
-
-	for _, variant := range doubleStarVariants(trimmed) {
-		g, err := glob.Compile(variant, '/')
-		if err != nil {
-			return nil, false, fmt.Errorf("%q %w: %w",
-				pattern, errBadExcludePattern, err)
-		}
-
-		globs = append(globs, g)
-	}
-
-	return globs, anchored, nil
-}
-
-// doubleStarVariants returns pattern once for every way of keeping each
-// "/**/" in it or making it a single "/".
-func doubleStarVariants(pattern string) []string {
-	const doubleStar = "/**/"
-
-	before, after, found := strings.Cut(pattern, doubleStar)
-	if !found {
-		return []string{pattern}
-	}
-
-	var variants []string
-
-	for _, rest := range doubleStarVariants(after) {
-		variants = append(variants, before+doubleStar+rest, before+"/"+rest)
-	}
-
-	return variants
-}

internal/exclude/exclude_test.go

@@ -1,73 +0,0 @@
-package exclude_test
-
-import (
-	"slices"
-	"strings"
-	"testing"
-
-	"github.com/gobwas/glob"
-	"sneak.berlin/go/vaultik/internal/exclude"
-)
-
-// TestCompile checks the error, the anchoring and the globs that Compile
-// returns for one exclude pattern.
-func TestCompile(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name         string
-		pattern      string
-		wantErr      string
-		wantAnchored bool
-		// wantMatches lists paths that one of the globs must match. When
-		// it is empty, Compile must return no globs.
-		wantMatches []string
-	}{
-		{name: "does not compile", pattern: "build[",
-			wantErr: `"build[" is not a valid exclude pattern`},
-		{name: "empty", pattern: ""},
-		{name: "leading slash anchors", pattern: "/build",
-			wantAnchored: true, wantMatches: []string{"build"}},
-		{name: "double star after the slash clears anchoring",
-			pattern: "/**/build", wantMatches: []string{"build"}},
-		{name: "double star in the middle", pattern: "a/**/*.log",
-			wantMatches: []string{"a/x.log", "a/b/x.log"}},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			globs, anchored, err := exclude.Compile(tt.pattern)
-			if tt.wantErr == "" && err != nil {
-				t.Fatalf("Compile(%q) error = %v, want none", tt.pattern, err)
-			}
-
-			if tt.wantErr != "" &&
-				(err == nil || !strings.HasPrefix(err.Error(), tt.wantErr)) {
-				t.Fatalf("Compile(%q) error = %v, want one starting with %q",
-					tt.pattern, err, tt.wantErr)
-			}
-
-			if anchored != tt.wantAnchored {
-				t.Errorf("Compile(%q) anchored = %t, want %t",
-					tt.pattern, anchored, tt.wantAnchored)
-			}
-
-			if len(tt.wantMatches) == 0 && len(globs) != 0 {
-				t.Errorf("Compile(%q) returned %d globs, want none",
-					tt.pattern, len(globs))
-			}
-
-			for _, path := range tt.wantMatches {
-				matched := slices.ContainsFunc(globs, func(g glob.Glob) bool {
-					return g.Match(path)
-				})
-				if !matched {
-					t.Errorf("Compile(%q) globs do not match %q",
-						tt.pattern, path)
-				}
-			}
-		})
-	}
-}

internal/snapshot/scanner.go

@@ -20,7 +20,6 @@ import (
 	"sneak.berlin/go/vaultik/internal/blob"
 	"sneak.berlin/go/vaultik/internal/chunker"
 	"sneak.berlin/go/vaultik/internal/database"
-	"sneak.berlin/go/vaultik/internal/exclude"
 	"sneak.berlin/go/vaultik/internal/log"
 	"sneak.berlin/go/vaultik/internal/storage"
 	"sneak.berlin/go/vaultik/internal/types"
@@ -222,12 +221,8 @@ func NewScanner(cfg ScannerConfig) *Scanner {
 		progress = NewProgressReporter()
 	}
 
-	compiledExclude, err := compileExcludePatterns(cfg.Exclude)
-	if err != nil {
-		log.Error("Failed to compile exclude patterns", "error", err)
-
-		return nil
-	}
+	// Compile exclude patterns
+	compiledExclude := compileExcludePatterns(cfg.Exclude)
 
 	uiw := cfg.UI
 	if uiw == nil {
@@ -1880,12 +1875,10 @@ func (s *Scanner) uploadBlobIfNeeded(
 	err = s.storage.PutWithProgress(ctx, blobPath, blobWithReader.Reader,
 		finishedBlob.Compressed, progressCallback)
 	if err != nil {
-		// The record is at info level: the returned error ends the backup
-		// and is printed as its ERROR: line. Only an interrupt cancels
-		// ctx, and the user is told about it, so an upload it stopped is
-		// not logged as a storage failure.
+		// Only an interrupt cancels ctx, and the user is told about it,
+		// so an upload it stopped is not logged as a storage failure.
 		if ctx.Err() == nil {
-			log.Info("Failed to upload blob", "hash", finishedBlob.Hash, "error", err)
+			log.Error("Failed to upload blob", "hash", finishedBlob.Hash, "error", err)
 		}
 
 		return 0, false, fmt.Errorf("uploading blob to storage: %w", err)
@@ -2323,18 +2316,51 @@ func wrapPermissionError(path string, err error) error {
 		"with --skip-errors to continue past unreadable files)", path, err)
 }
 
-// compileExcludePatterns compiles the exclude patterns into glob matchers.
-// Config.Validate has already refused a pattern that does not compile.
-func compileExcludePatterns(patterns []string) ([]compiledPattern, error) {
+// compileExcludePatterns compiles the exclude patterns into glob matchers
+func compileExcludePatterns(patterns []string) []compiledPattern {
 	var compiled []compiledPattern
 
 	for _, p := range patterns {
-		globs, anchored, err := exclude.Compile(p)
-		if err != nil {
-			return nil, err
+		if p == "" {
+			continue
 		}
 
-		for _, g := range globs {
+		// Check if pattern is anchored (starts with /)
+		anchored := strings.HasPrefix(p, "/")
+
+		pattern := p
+		if anchored {
+			pattern = p[1:] // Remove leading /
+		}
+
+		// Remove trailing slash if present (directory indicator)
+		pattern = strings.TrimSuffix(pattern, "/")
+
+		// A leading "**/" demands a "/" before the name and so misses an
+		// entry directly under the source path. It means "at every depth",
+		// which is what an unanchored pattern already does, so drop the
+		// prefix and match unanchored: as in gitignore, "**/x" and
+		// "/**/x" then also match a top-level "x".
+		if rest, found := strings.CutPrefix(pattern, "**/"); found {
+			pattern = rest
+			anchored = false
+		}
+
+		// Likewise "/**/" inside a pattern demands two slashes, so
+		// "a/**/*.log" misses "a/x.log". As in gitignore it stands for
+		// zero or more directories, so also compile the pattern with it
+		// made a single "/". The glob library's {a,b} is no help: with a
+		// "**" inside it in mid-pattern, it misses paths it should match.
+		for _, variant := range doubleStarVariants(pattern) {
+			// For patterns without path separators, we need to match them as components
+			// e.g., ".git" should match ".git" anywhere in the path
+			g, err := glob.Compile(variant, '/')
+			if err != nil {
+				log.Warn("Invalid exclude pattern, skipping", "pattern", p, "error", err)
+
+				break
+			}
+
 			compiled = append(compiled, compiledPattern{
 				pattern:  g,
 				anchored: anchored,
@@ -2343,7 +2369,26 @@ func compileExcludePatterns(patterns []string) ([]compiledPattern, error) {
 		}
 	}
 
-	return compiled, nil
+	return compiled
+}
+
+// doubleStarVariants returns pattern once for every way of keeping each
+// "/**/" in it or making it a single "/".
+func doubleStarVariants(pattern string) []string {
+	const doubleStar = "/**/"
+
+	before, after, found := strings.Cut(pattern, doubleStar)
+	if !found {
+		return []string{pattern}
+	}
+
+	var variants []string
+
+	for _, rest := range doubleStarVariants(after) {
+		variants = append(variants, before+doubleStar+rest, before+"/"+rest)
+	}
+
+	return variants
 }
 
 // shouldExclude checks if a path should be excluded based on exclude patterns

internal/snapshot/upload_cancel_log_test.go

@@ -37,9 +37,9 @@ func uploadTestBlob(ctx context.Context, store storage.Storer) error {
 }
 
 // captureLog runs fn and returns what the logger wrote to stderr
-// meanwhile, at the --verbose level. The logger writes to the os.Stderr
-// it finds when it is initialized, so os.Stderr is pointed at a file
-// first. Not parallel-safe: os.Stderr and the logger are process-global.
+// meanwhile. The logger writes to the os.Stderr it finds when it is
+// initialized, so os.Stderr is pointed at a file first. Not
+// parallel-safe: os.Stderr and the logger are process-global.
 func captureLog(t *testing.T, fn func()) string {
 	t.Helper()
 
@@ -53,7 +53,7 @@ func captureLog(t *testing.T, fn func()) string {
 	previous := os.Stderr
 	os.Stderr = stderrFile
 
-	log.Initialize(log.Config{Verbose: true})
+	log.Initialize(log.Config{})
 
 	fn()
 
@@ -107,10 +107,10 @@ func TestInterruptedUploadIsNotLoggedAsError(t *testing.T) {
 	}
 }
 
-// An upload that fails for any other reason is still logged.
+// An upload that fails for any other reason is still logged as an error.
 //
 //nolint:paralleltest // captureLog replaces os.Stderr
-func TestFailedUploadIsLogged(t *testing.T) {
+func TestFailedUploadIsLoggedAsError(t *testing.T) {
 	inner, err := storage.NewFileStorer(t.TempDir())
 	if err != nil {
 		t.Fatal(err)

internal/vaultik/remove_snapshot_test.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"context"
 	"database/sql"
+	"encoding/json"
 	"io"
 	"strings"
 	"sync"
@@ -472,6 +473,171 @@ func TestRemoveSnapshot_NotInLocalIndex(t *testing.T) {
 	assert.Contains(t, out, "Removed snapshot metadata from remote storage")
 }
 
+// TestRemoveSnapshot_RemoteOnlyByRemoteKey checks that a snapshot only
+// on the destination store, on a host with no local index, is removed by
+// the remote key that 'snapshot list' prints for such a snapshot, and by
+// an unambiguous leading part of it — the same identifiers verify and
+// restore accept.
+func TestRemoveSnapshot_RemoteOnlyByRemoteKey(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	remoteKey := snapshot.RemoteSnapshotKey("snapshot-001")
+
+	identifiers := map[string]string{
+		"full key":     remoteKey,
+		"leading part": remoteKey[:8],
+	}
+
+	for name, identifier := range identifiers {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			store := newTestStorer()
+			addManifest(t, store, "snapshot-001", nil)
+
+			// No local index: a host that sees the snapshot only remotely.
+			tv := vaultik.NewForTesting(store)
+			tv.Repositories = newLocalIndex(t)
+
+			result, err := tv.RemoveSnapshot(identifier,
+				&vaultik.RemoveOptions{Force: true})
+
+			require.NoError(t, err)
+			assert.True(t, result.RemoteRemoved)
+			assert.False(t, store.hasKey(remoteKeyPath("snapshot-001")))
+
+			out := tv.Stdout.String()
+			assert.NotContains(t, out, "from local database")
+			assert.Contains(t, out, "Removed snapshot metadata from remote storage")
+		})
+	}
+}
+
+// TestRemoveSnapshot_LocalIndexByRemoteKey checks that a remote key (or
+// its unambiguous leading part) that names a snapshot the local index
+// holds removes that snapshot's local row and its remote metadata
+// together. `snapshot list --json` prints a remote key for every
+// snapshot, including local ones.
+func TestRemoveSnapshot_LocalIndexByRemoteKey(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	remoteKey := snapshot.RemoteSnapshotKey("snapshot-001")
+
+	identifiers := map[string]string{
+		"full key":     remoteKey,
+		"leading part": remoteKey[:8],
+	}
+
+	for name, identifier := range identifiers {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			store := newTestStorer()
+			addManifest(t, store, "snapshot-001", nil)
+
+			// A backup wrote to this destination, so it carries the
+			// marker, and the local index holds the snapshot.
+			require.NoError(t, store.Put(context.Background(), markerFile,
+				bytes.NewReader(nil)))
+
+			tv := vaultik.NewForTesting(store)
+			repos := newLocalIndex(t, "snapshot-001")
+			tv.Repositories = repos
+
+			result, err := tv.RemoveSnapshot(identifier,
+				&vaultik.RemoveOptions{Force: true})
+
+			require.NoError(t, err)
+			assert.True(t, result.RemoteRemoved)
+			assert.False(t, store.hasKey(remoteKeyPath("snapshot-001")))
+
+			row, err := repos.Snapshots.GetByID(
+				context.Background(), "snapshot-001")
+			require.NoError(t, err)
+			assert.Nil(t, row)
+
+			out := tv.Stdout.String()
+			assert.Contains(t, out,
+				"Removed snapshot 'snapshot-001' from local database")
+			assert.Contains(t, out, "Removed snapshot metadata from remote storage")
+		})
+	}
+}
+
+// TestRemoveSnapshot_DryRunByLeadingPart checks that a dry run by a
+// leading part of a remote key names the snapshot that part resolved to:
+// by its ID when the local index holds the snapshot, otherwise by its
+// full remote key.
+func TestRemoveSnapshot_DryRunByLeadingPart(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	remoteKey := snapshot.RemoteSnapshotKey("snapshot-001")
+
+	for name, tc := range map[string]struct {
+		localIDs []string
+		shown    string
+	}{
+		"in local index": {localIDs: []string{"snapshot-001"}, shown: "snapshot-001"},
+		"remote only":    {localIDs: nil, shown: remoteKey},
+	} {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			store := newTestStorer()
+			addManifest(t, store, "snapshot-001", nil)
+
+			// A backup wrote to this destination, so it carries the marker.
+			require.NoError(t, store.Put(context.Background(), markerFile,
+				bytes.NewReader(nil)))
+
+			tv := vaultik.NewForTesting(store)
+			tv.Repositories = newLocalIndex(t, tc.localIDs...)
+
+			_, err := tv.RemoveSnapshot(remoteKey[:8],
+				&vaultik.RemoveOptions{DryRun: true})
+
+			require.NoError(t, err)
+			assert.Contains(t, tv.Stdout.String(),
+				"Would remove snapshot: "+tc.shown+".")
+			assert.True(t, store.hasKey(remoteKeyPath("snapshot-001")))
+		})
+	}
+}
+
+// TestRemoveSnapshot_JSONDryRunByLeadingPart checks that a JSON dry run
+// by a leading part of a remote key prints the ID and the full remote key
+// of the snapshot that part resolved to.
+func TestRemoveSnapshot_JSONDryRunByLeadingPart(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	remoteKey := snapshot.RemoteSnapshotKey("snapshot-001")
+
+	store := newTestStorer()
+	addManifest(t, store, "snapshot-001", nil)
+
+	// A backup wrote to this destination, so it carries the marker.
+	require.NoError(t, store.Put(context.Background(), markerFile,
+		bytes.NewReader(nil)))
+
+	tv := vaultik.NewForTesting(store)
+	tv.Repositories = newLocalIndex(t, "snapshot-001")
+
+	_, err := tv.RemoveSnapshot(remoteKey[:8],
+		&vaultik.RemoveOptions{DryRun: true, JSON: true})
+	require.NoError(t, err)
+
+	var printed map[string]any
+
+	require.NoError(t, json.Unmarshal(tv.Stdout.Bytes(), &printed))
+	assert.Equal(t, "snapshot-001", printed["snapshot_id"])
+	assert.Equal(t, remoteKey, printed["remote_key"])
+	assert.True(t, store.hasKey(remoteKeyPath("snapshot-001")))
+}
+
 // TestRemoveSnapshot_NotInLocalIndexDeleteFails checks that removing a
 // snapshot only the destination store holds fails when its metadata
 // cannot be deleted there, under --force and under --json: nothing was
@@ -506,6 +672,38 @@ func TestRemoveSnapshot_NotInLocalIndexDeleteFails(t *testing.T) {
 	}
 }
 
+// TestRemoveSnapshot_LocalIndexByLeadingPartDeleteFails checks the
+// warning when a snapshot the local index holds is removed by a leading
+// part of its remote key and the delete on the destination store fails.
+// The warning names the snapshot by its ID, not by the part given.
+func TestRemoveSnapshot_LocalIndexByLeadingPartDeleteFails(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	store := newTestStorer()
+	addManifest(t, store, "snapshot-001", nil)
+
+	// A backup wrote to this destination, so it carries the marker.
+	require.NoError(t, store.Put(context.Background(), markerFile,
+		bytes.NewReader(nil)))
+
+	faulty := faultstore.New(store)
+	faulty.OnDelete = func(string) bool { return true }
+
+	tv := vaultik.NewForTesting(faulty)
+	tv.Repositories = newLocalIndex(t, "snapshot-001")
+
+	result, err := tv.RemoveSnapshot(
+		snapshot.RemoteSnapshotKey("snapshot-001")[:8],
+		&vaultik.RemoveOptions{Force: true})
+
+	require.NoError(t, err)
+	assert.False(t, result.RemoteRemoved)
+	assert.True(t, store.hasKey(remoteKeyPath("snapshot-001")))
+	assert.Contains(t, tv.Stdout.String(),
+		"Run 'vaultik snapshot remove snapshot-001' again")
+}
+
 func TestRemoveAllSnapshots_RequiresForce(t *testing.T) {
 	log.Initialize(log.Config{})
 	t.Parallel()

internal/vaultik/restore.go

@@ -31,7 +31,7 @@ var (
 	errPathsNotInSnapshot    = errors.New("requested path(s) not in the snapshot")
 	errFilesFailedVerify     = errors.New("files failed verification")
 	errDecryptionKeyRequired = errors.New(
-		"decryption key required\n\n" +
+		"decryption key required for restore\n\n" +
 			"Set the VAULTIK_AGE_SECRET_KEY environment variable to your " +
 			"age private key file:\n" +
 			"  export VAULTIK_AGE_SECRET_KEY=\"$(cat vaultik_backup_private_key.txt)\"")
@@ -153,7 +153,18 @@ func (v *Vaultik) Restore(opts *RestoreOptions) error {
 		return fmt.Errorf("downloading snapshot database: %w", err)
 	}
 
-	defer v.closeSnapshotDB(tempDB, tempDir)
+	defer func() {
+		err := tempDB.Close()
+		if err != nil {
+			log.Debug("Failed to close temp database", "error", err)
+		}
+		// Remove the whole private directory, so the decrypted database
+		// and any SQLite side files it produced are gone on every path.
+		err = v.Fs.RemoveAll(tempDir)
+		if err != nil {
+			log.Debug("Failed to remove temp database directory", "error", err)
+		}
+	}()
 
 	repos := database.NewRepositories(tempDB)
 
@@ -656,19 +667,19 @@ func (v *Vaultik) restoreProgressTick(
 
 // handleRestoreFileError records a per-file restore failure: fatal unless
 // --skip-errors is set, in which case the file is counted as failed and
-// dropped from the plan. A fatal failure is not logged here: the returned
-// error is printed as the command's ERROR: line.
+// dropped from the plan.
 func (v *Vaultik) handleRestoreFileError(
 	plan *restorePlan, opts *RestoreOptions, result *RestoreResult,
 	file *database.File, fileID types.FileID, err error,
 ) error {
+	log.Error("Failed to restore file", "path", file.Path, "error", err)
+
 	if !opts.SkipErrors {
 		return fmt.Errorf(
 			"restoring %s: %w (pass --skip-errors to continue past "+
 				"restore failures)", file.Path, err)
 	}
 
-	log.Error("Failed to restore file", "path", file.Path, "error", err)
 	v.UI.Errorf("Failed to restore %s: %v. Skipping (--skip-errors).",
 		v.UI.Path(file.Path.String()), err)
 

internal/vaultik/snapshot.go

@@ -1424,11 +1424,14 @@ type RemoveOptions struct {
 	LocalOnly bool // Skip remote cleanup; only touch the local index
 }
 
-// RemoveResult contains the result of a snapshot removal
+// RemoveResult contains the result of a snapshot removal. For a single
+// snapshot, SnapshotID is its ID, empty when the ID is not known, and
+// RemoteKey is the full remote key of its metadata.
 //
 //nolint:tagliatelle // snake_case is the established JSON output format
 type RemoveResult struct {
 	SnapshotID       string   `json:"snapshot_id,omitempty"`
+	RemoteKey        string   `json:"remote_key,omitempty"`
 	SnapshotsRemoved []string `json:"snapshots_removed,omitempty"`
 	RemoteRemoved    bool     `json:"remote_removed,omitempty"`
 	DryRun           bool     `json:"dry_run,omitempty"`
@@ -1458,25 +1461,35 @@ const snapshotRemoveCommandHint = "vaultik snapshot remove"
 func (v *Vaultik) RemoveSnapshot(
 	snapshotID string, opts *RemoveOptions,
 ) (*RemoveResult, error) {
-	result := &RemoveResult{
-		SnapshotID: snapshotID,
-	}
+	result := &RemoveResult{}
 
 	err := v.checkStorageBinding()
 	if err != nil {
 		return result, err
 	}
 
-	inLocalIndex, err := v.checkSnapshotExists(snapshotID, opts.LocalOnly)
+	inLocalIndex, resolvedID, remoteKey, err := v.findSnapshotToRemove(
+		snapshotID, opts.LocalOnly)
 	if err != nil {
 		return result, err
 	}
 
-	if opts.DryRun {
-		return v.removeSnapshotDryRun(result, snapshotID, opts)
+	result.SnapshotID = resolvedID
+	result.RemoteKey = remoteKey
+
+	// The dry run, the prompt and removeSnapshotRemote name the snapshot
+	// that snapshotID resolved to: by its ID, or by its full remote key
+	// when the ID is not known.
+	shown := resolvedID
+	if shown == "" {
+		shown = remoteKey
 	}
 
-	if !v.confirmRemoveSnapshot(snapshotID, opts) {
+	if opts.DryRun {
+		return v.removeSnapshotDryRun(result, shown, opts)
+	}
+
+	if !v.confirmRemoveSnapshot(shown, opts) {
 		return result, ErrNotConfirmed
 	}
 
@@ -1489,16 +1502,16 @@ func (v *Vaultik) RemoveSnapshot(
 	}
 
 	if inLocalIndex {
-		log.Info("Removing snapshot from local database", "snapshot_id", snapshotID)
+		log.Info("Removing snapshot from local database", "snapshot_id", resolvedID)
 
-		err = v.deleteSnapshotFromLocalDB(snapshotID)
+		err = v.deleteSnapshotFromLocalDB(resolvedID)
 		if err != nil {
 			return result, fmt.Errorf("removing from local database: %w", err)
 		}
 	}
 
 	result.RemoteRemoved, err = v.removeSnapshotRemote(
-		snapshotID, inLocalIndex, markerErr, opts)
+		shown, remoteKey, inLocalIndex, markerErr, opts)
 	if err != nil {
 		return result, err
 	}
@@ -1517,7 +1530,7 @@ func (v *Vaultik) RemoveSnapshot(
 
 	if inLocalIndex {
 		v.UI.Infof("Removed snapshot '%s' from local database.",
-			v.UI.Snapshot(snapshotID))
+			v.UI.Snapshot(resolvedID))
 	}
 
 	if result.RemoteRemoved {
@@ -1530,6 +1543,52 @@ func (v *Vaultik) RemoveSnapshot(
 	return result, nil
 }
 
+// findSnapshotToRemove finds the snapshot that identifier names. It
+// returns whether the local index holds that snapshot, its snapshot ID,
+// and the remote key of its metadata on the destination store. The ID is
+// known when identifier is a snapshot ID or the local index holds the
+// snapshot; otherwise it is empty.
+//
+// A snapshot ID is looked up by checkSnapshotExists. Under localOnly the
+// store is not consulted, so every identifier is looked up that way and
+// a remote key is not found. Otherwise a remote key, or a leading part
+// of one, is resolved by resolveSnapshotRemoteKey, as restore and verify
+// do. That fails with errSnapshotKeyNotFound or errSnapshotKeyAmbiguous
+// when the identifier matches no snapshot on the store, or more than
+// one. The store is listed only after checkDestinationMarker passes, as
+// in checkSnapshotExists. The local row is the one whose snapshot ID
+// hashes to the resolved key, as in RemoveAllSnapshots, so removing by
+// remote key removes that row too.
+func (v *Vaultik) findSnapshotToRemove(
+	identifier string, localOnly bool,
+) (bool, string, string, error) {
+	if localOnly || !isRemoteKeyOrPrefix(identifier) {
+		inLocalIndex, err := v.checkSnapshotExists(identifier, localOnly)
+		if err != nil {
+			return false, "", "", err
+		}
+
+		return inLocalIndex, identifier, snapshot.RemoteSnapshotKey(identifier), nil
+	}
+
+	err := v.checkDestinationMarker()
+	if err != nil {
+		return false, "", "", err
+	}
+
+	remoteKey, err := v.resolveSnapshotRemoteKey(identifier)
+	if err != nil {
+		return false, "", "", err
+	}
+
+	localID, err := v.localSnapshotIDForRemoteKey(remoteKey)
+	if err != nil {
+		return false, "", "", err
+	}
+
+	return localID != "", localID, remoteKey, nil
+}
+
 // checkSnapshotExists returns errSnapshotNotFound when the local index
 // has no row for snapshotID and, unless localOnly is set, the
 // destination store has no metadata for it either. inLocalIndex reports
@@ -1639,19 +1698,22 @@ func (v *Vaultik) confirmRemoveSnapshot(snapshotID string, opts *RemoveOptions)
 }
 
 // removeSnapshotRemote strips the snapshot's metadata from the
-// destination store. It returns true only when the delete finished
-// without an error and removed at least one object; under LocalOnly it
-// does nothing. markerErr is the result of checkDestinationMarker; when
-// it is set, nothing is deleted and it is the failure. When the snapshot
-// is only on the destination store, a failure is returned as an error,
-// because that removal is all the command does. When the snapshot was in
-// the local index, its removal there has already happened, so a failure
-// is only a warning telling the user to run `vaultik snapshot remove`
-// for the snapshot again once the destination store is reachable
-// (`vaultik prune` never removes snapshot metadata that has its
-// manifest).
+// destination store. remoteKey is the resolved metadata directory name
+// to delete, as returned by findSnapshotToRemove. shown names the
+// snapshot in the log records and the warning: its ID, or its full
+// remote key when the ID is not known. It returns true only when the
+// delete finished without an error and removed at least one object;
+// under LocalOnly it does nothing. markerErr is the result of
+// checkDestinationMarker; when it is set, nothing is deleted and it is
+// the failure. When the snapshot is only on the destination store, a
+// failure is returned as an error, because that removal is all the
+// command does. When the snapshot was in the local index, its removal
+// there has already happened, so a failure is only a warning telling
+// the user to run `vaultik snapshot remove` for the snapshot again once
+// the destination store is reachable (`vaultik prune` never removes
+// snapshot metadata that has its manifest).
 func (v *Vaultik) removeSnapshotRemote(
-	snapshotID string, inLocalIndex bool, markerErr error,
+	shown, remoteKey string, inLocalIndex bool, markerErr error,
 	opts *RemoveOptions,
 ) (bool, error) {
 	if opts.LocalOnly {
@@ -1659,14 +1721,13 @@ func (v *Vaultik) removeSnapshotRemote(
 	}
 
 	log.Info("Removing snapshot metadata from remote storage",
-		"snapshot_id", snapshotID)
+		"snapshot_id", shown)
 
 	var deleted int
 
 	err := markerErr
 	if err == nil {
-		deleted, err = v.deleteRemoteSnapshotByKey(
-			snapshot.RemoteSnapshotKey(snapshotID))
+		deleted, err = v.deleteRemoteSnapshotByKey(remoteKey)
 	}
 
 	if err != nil && !inLocalIndex {
@@ -1678,14 +1739,14 @@ func (v *Vaultik) removeSnapshotRemote(
 		log.Warn("Could not remove snapshot metadata from remote storage; "+
 			"run '"+snapshotRemoveCommandHint+"' with the snapshot's ID "+
 			"again once the remote is reachable",
-			"snapshot_id", snapshotID, "error", err)
+			"snapshot_id", shown, "error", err)
 
 		// The UI writes to stdout, which under --json holds only the
 		// document; the log record above is the warning on stderr.
 		if v.UI != nil && !opts.JSON {
 			v.UI.Warningf("Could not remove snapshot metadata from remote: "+
 				"%v. Run '%s %s' again once the remote is reachable.",
-				err, snapshotRemoveCommandHint, snapshotID)
+				err, snapshotRemoveCommandHint, shown)
 		}
 
 		return false, nil
@@ -1780,6 +1841,23 @@ func (v *Vaultik) localSnapshotIDs() ([]string, error) {
 	return ids, nil
 }
 
+// localSnapshotIDForRemoteKey returns the human snapshot ID of the local
+// index row whose RemoteSnapshotKey is key, or "" when no row has it.
+func (v *Vaultik) localSnapshotIDForRemoteKey(key string) (string, error) {
+	ids, err := v.localSnapshotIDs()
+	if err != nil {
+		return "", fmt.Errorf("listing local snapshots: %w", err)
+	}
+
+	for _, id := range ids {
+		if snapshot.RemoteSnapshotKey(id) == key {
+			return id, nil
+		}
+	}
+
+	return "", nil
+}
+
 // listAllRemoteSnapshotKeys collects the hashed remote keys
 // (subdirectories under metadata/) currently present in the
 // destination store. Returns (nil, err) when the store cannot be

internal/vaultik/snapshot_files.go

@@ -1,134 +0,0 @@
-package vaultik
-
-import (
-	"encoding/json"
-	"errors"
-	"fmt"
-	"os"
-	"path/filepath"
-	"text/tabwriter"
-	"time"
-
-	"sneak.berlin/go/vaultik/internal/database"
-	"sneak.berlin/go/vaultik/internal/log"
-)
-
-// errPathNotInSnapshot is returned when the path given to `snapshot files`
-// matches nothing in the snapshot.
-var errPathNotInSnapshot = errors.New("path matches nothing in the snapshot")
-
-// SnapshotFile is one entry printed by `snapshot files`. Mode is the Go
-// file mode string, which shows the entry type and the permission bits
-// (for example -rw-r--r-- or drwxr-xr-x).
-type SnapshotFile struct {
-	Path  string    `json:"path"`
-	Size  int64     `json:"size"`
-	Mode  string    `json:"mode"`
-	MTime time.Time `json:"mtime"`
-}
-
-// ListSnapshotFiles prints the path, size, mode and modification time of
-// every file the snapshot holds at or under path, or of every file when
-// path is empty. The file list is only in the snapshot's encrypted
-// database, so this downloads and decrypts it as restore does, and needs
-// the private key.
-func (v *Vaultik) ListSnapshotFiles(snapshotID, path string, jsonOutput bool) error {
-	identities, err := v.restoreIdentities()
-	if err != nil {
-		return err
-	}
-
-	remoteKey, err := v.resolveSnapshotRemoteKey(snapshotID)
-	if err != nil {
-		return err
-	}
-
-	db, tempDir, err := v.downloadSnapshotDB(snapshotID, remoteKey, identities)
-	if errors.Is(err, errWrongPrivateKey) {
-		return err
-	}
-
-	if err != nil {
-		return fmt.Errorf("downloading snapshot database: %w", err)
-	}
-
-	defer v.closeSnapshotDB(db, tempDir)
-
-	repos := database.NewRepositories(db)
-
-	var files []*database.File
-
-	if path == "" {
-		files, err = repos.Files.ListAll(v.ctx)
-	} else {
-		files, err = repos.Files.ListUnderPath(v.ctx, filepath.Clean(path))
-	}
-
-	if err != nil {
-		return fmt.Errorf("listing files: %w", err)
-	}
-
-	if path != "" && len(files) == 0 {
-		return fmt.Errorf("%w: %s", errPathNotInSnapshot, path)
-	}
-
-	entries := make([]SnapshotFile, 0, len(files))
-
-	for _, file := range files {
-		entries = append(entries, SnapshotFile{
-			Path:  file.Path.String(),
-			Size:  file.Size,
-			Mode:  os.FileMode(file.Mode).String(),
-			MTime: file.MTime,
-		})
-	}
-
-	if jsonOutput {
-		encoder := json.NewEncoder(v.Stdout)
-		encoder.SetIndent("", "  ")
-
-		return encoder.Encode(entries)
-	}
-
-	if v.UI.Quiet() {
-		return nil
-	}
-
-	return v.printSnapshotFileTable(entries)
-}
-
-// printSnapshotFileTable writes the entries as a plain table to stdout.
-func (v *Vaultik) printSnapshotFileTable(entries []SnapshotFile) error {
-	w := tabwriter.NewWriter(v.Stdout, 0, 0, tabPadding, ' ', 0)
-
-	_, err := fmt.Fprintln(w, "MODE\tSIZE\tMODIFIED\tPATH")
-	if err != nil {
-		return err
-	}
-
-	for _, entry := range entries {
-		_, err = fmt.Fprintf(w, "%s\t%d\t%s\t%s\n",
-			entry.Mode, entry.Size,
-			entry.MTime.Format(time.RFC3339), entry.Path)
-		if err != nil {
-			return err
-		}
-	}
-
-	return w.Flush()
-}
-
-// closeSnapshotDB closes a database returned by downloadSnapshotDB and
-// removes its private directory, so the decrypted database and any SQLite
-// side files it produced are gone.
-func (v *Vaultik) closeSnapshotDB(db *database.DB, tempDir string) {
-	err := db.Close()
-	if err != nil {
-		log.Debug("Failed to close temp database", "error", err)
-	}
-
-	err = v.Fs.RemoveAll(tempDir)
-	if err != nil {
-		log.Debug("Failed to remove temp database directory", "error", err)
-	}
-}

internal/vaultik/snapshot_files_test.go

@@ -1,140 +0,0 @@
-package vaultik_test
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/spf13/afero"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"sneak.berlin/go/vaultik/internal/database"
-	"sneak.berlin/go/vaultik/internal/log"
-	"sneak.berlin/go/vaultik/internal/storage"
-	"sneak.berlin/go/vaultik/internal/vaultik"
-)
-
-// These tests cover https://git.eeqj.de/sneak/vaultik/issues/435:
-// `snapshot files` lists what a snapshot holds without restoring it.
-
-// backUpForFileListing backs up the fault source tree and returns a
-// reader whose stdout is out, the snapshot ID, and the source directory.
-func backUpForFileListing(
-	t *testing.T, out *bytes.Buffer,
-) (*vaultik.Vaultik, string, string) {
-	t.Helper()
-
-	fs := afero.NewOsFs()
-	tempDir := t.TempDir()
-	dataDir := filepath.Join(tempDir, "src")
-	dbPath := filepath.Join(tempDir, "index.sqlite")
-
-	ctx := context.Background()
-	cfg := faultTestConfig()
-
-	writeFaultSourceTree(t, fs, dataDir)
-
-	store, err := storage.NewFileStorer(t.TempDir())
-	require.NoError(t, err)
-
-	db, err := database.New(ctx, dbPath)
-	require.NoError(t, err)
-
-	id := fullFaultBackup(ctx, t, fs, store, cfg,
-		database.NewRepositories(db), dataDir, dbPath, "files")
-	require.NoError(t, db.Close())
-
-	v := newReaderVaultik(ctx, cfg, store, nil, fs)
-	v.Stdout = out
-
-	return v, id, dataDir
-}
-
-func TestSnapshotFilesJSONListsEveryFileWithItsMetadata(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	var out bytes.Buffer
-
-	v, id, dataDir := backUpForFileListing(t, &out)
-
-	require.NoError(t, v.ListSnapshotFiles(id, "", true))
-
-	var entries []vaultik.SnapshotFile
-
-	require.NoError(t, json.Unmarshal(out.Bytes(), &entries))
-
-	byPath := make(map[string]vaultik.SnapshotFile, len(entries))
-	for _, entry := range entries {
-		byPath[entry.Path] = entry
-	}
-
-	for _, rel := range []string{"small.txt", "a.bin", "sub", "sub/b.bin", "sub/c.bin"} {
-		path := filepath.Join(dataDir, rel)
-
-		entry, ok := byPath[path]
-		require.True(t, ok, "%s must be listed", path)
-
-		info, err := afero.NewOsFs().Stat(path)
-		require.NoError(t, err)
-
-		assert.Equal(t, info.Mode().String(), entry.Mode, path)
-		assert.True(t, info.ModTime().Equal(entry.MTime),
-			"%s: mtime %v, listed %v", path, info.ModTime(), entry.MTime)
-
-		if !info.IsDir() {
-			assert.Equal(t, info.Size(), entry.Size, path)
-		}
-	}
-}
-
-func TestSnapshotFilesListsOnlyWhatIsUnderThePath(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	var out bytes.Buffer
-
-	v, id, dataDir := backUpForFileListing(t, &out)
-
-	require.NoError(t, v.ListSnapshotFiles(id, filepath.Join(dataDir, "sub"), false))
-
-	text := out.String()
-	assert.Contains(t, text, filepath.Join(dataDir, "sub", "b.bin"))
-	assert.Contains(t, text, filepath.Join(dataDir, "sub", "c.bin"))
-	assert.NotContains(t, text, filepath.Join(dataDir, "small.txt"))
-	assert.True(t, strings.HasPrefix(text, "MODE"), "the table must have a header")
-}
-
-func TestSnapshotFilesFailsOnAPathThatMatchesNothing(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	var out bytes.Buffer
-
-	v, id, dataDir := backUpForFileListing(t, &out)
-	missing := filepath.Join(dataDir, "typo.txt")
-
-	err := v.ListSnapshotFiles(id, missing, false)
-
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), missing, "the error must name the path")
-	assert.Empty(t, out.String(), "nothing must be printed")
-}
-
-func TestSnapshotFilesRequiresThePrivateKey(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	var out bytes.Buffer
-
-	v, id, _ := backUpForFileListing(t, &out)
-	v.Config.AgeSecretKey = ""
-
-	err := v.ListSnapshotFiles(id, "", false)
-
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "VAULTIK_AGE_SECRET_KEY")
-}