safekeep 0.4.0__tar.gz → 0.5.1__tar.gz

{safekeep-0.4.0/safekeep.egg-info → safekeep-0.5.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: safekeep
-Version: 0.4.0
+Version: 0.5.1
 Summary: Selective always-on backups for macOS and Linux: fswatch-driven copy of allow-listed files, never deletes
 License-Expression: MIT
 Project-URL: Repository, https://github.com/foxhound87/safekeep
@@ -182,7 +182,7 @@ safekeep <command> [--config PATH] [-v]
 | `run` | daemon: initial reconcile, fswatch loop, event dispatch, 24h timer |
 | `sync-once [--dry-run] [--project PATH] [--prune]` | a single pass: walks the source and copies whatever differs (`--dry-run` only prints what it would copy; `--prune` also removes dest files whose source still exists but is no longer included) |
 | `status` | read-only: config, sources, discovered projects with N rules, destination states |
-| `doctor` | diagnostics: config, fswatch + platform monitor, python, TCC/launchd plist (macOS), inotify limit and systemd unit (Linux) — exits non-zero if a fatal check fails |
+| `doctor [--json]` | diagnostics: config, fswatch + platform monitor, python, TCC/launchd plist (macOS), inotify limit and systemd unit (Linux) — exits non-zero if a fatal check fails; `--json` prints the same checks as one JSON document on stdout with the same exit code, including a structured `permission_errors` count of the last 24h |
 
 ## Tests
 
@@ -190,9 +190,10 @@ safekeep <command> [--config PATH] [-v]
 python3 -m unittest discover -s tests
 ```
 
-Stdlib (`unittest`) suite, zero dependencies: 175 tests covering the matcher,
-config, atomic copy, volumes, daemon, auto-discovery, CLI and the POSIX
-portability layer (platform helper, per-OS fswatch monitor, systemd template).
+Stdlib (`unittest`) suite, zero dependencies: 221 tests covering the matcher,
+config, atomic copy, volumes, daemon, auto-discovery, CLI, the permission-trend
+wrapper and the POSIX portability layer (platform helper, per-OS fswatch
+monitor, systemd template).
 `fswatch` is not needed to run the suite — the few `doctor` checks that talk to
 the real binary are skipped when it's missing — but CI installs it so the
 Linux job exercises the real `inotify` monitor.

{safekeep-0.4.0 → safekeep-0.5.1}/README.md

@@ -157,7 +157,7 @@ safekeep <command> [--config PATH] [-v]
 | `run` | daemon: initial reconcile, fswatch loop, event dispatch, 24h timer |
 | `sync-once [--dry-run] [--project PATH] [--prune]` | a single pass: walks the source and copies whatever differs (`--dry-run` only prints what it would copy; `--prune` also removes dest files whose source still exists but is no longer included) |
 | `status` | read-only: config, sources, discovered projects with N rules, destination states |
-| `doctor` | diagnostics: config, fswatch + platform monitor, python, TCC/launchd plist (macOS), inotify limit and systemd unit (Linux) — exits non-zero if a fatal check fails |
+| `doctor [--json]` | diagnostics: config, fswatch + platform monitor, python, TCC/launchd plist (macOS), inotify limit and systemd unit (Linux) — exits non-zero if a fatal check fails; `--json` prints the same checks as one JSON document on stdout with the same exit code, including a structured `permission_errors` count of the last 24h |
 
 ## Tests
 
@@ -165,9 +165,10 @@ safekeep <command> [--config PATH] [-v]
 python3 -m unittest discover -s tests
 ```
 
-Stdlib (`unittest`) suite, zero dependencies: 175 tests covering the matcher,
-config, atomic copy, volumes, daemon, auto-discovery, CLI and the POSIX
-portability layer (platform helper, per-OS fswatch monitor, systemd template).
+Stdlib (`unittest`) suite, zero dependencies: 221 tests covering the matcher,
+config, atomic copy, volumes, daemon, auto-discovery, CLI, the permission-trend
+wrapper and the POSIX portability layer (platform helper, per-OS fswatch
+monitor, systemd template).
 `fswatch` is not needed to run the suite — the few `doctor` checks that talk to
 the real binary are skipped when it's missing — but CI installs it so the
 Linux job exercises the real `inotify` monitor.

{safekeep-0.4.0 → safekeep-0.5.1}/safekeep/__init__.py

@@ -3,4 +3,4 @@ import logging
 
 logging.getLogger('safekeep').addHandler(logging.NullHandler())
 
-__version__ = '0.4.0'
+__version__ = '0.5.1'

{safekeep-0.4.0 → safekeep-0.5.1}/safekeep/cli.py

@@ -4,17 +4,22 @@ Entry point del package (`safekeep.cli:main`): `bin/safekeep.py` è solo lo
 shim che usano launchd/systemd e i test.
 """
 import argparse
+import json
 import os
+import re
 import shutil
 import subprocess
 import sys
+from datetime import datetime
 
+from safekeep import __version__
 from safekeep.config import ConfigError, discover_projects, parse_sync
 from safekeep.copier import TMP_INFIX
 from safekeep.daemon import Daemon, setup_logging
 from safekeep.platform import (
     INOTIFY_MIN_WATCHES,
     LOG_PATH,
+    daemon_exe,
     fswatch_monitor,
     inotify_limit,
     install_hint,
@@ -58,11 +63,14 @@ def build_parser():
                            'non è più incluso dal matcher (default: mai cancellare)')
     sub.add_parser('status', parents=[common],
                    help='config, progetti e stato delle dest — sola lettura')
-    sub.add_parser('doctor', parents=[common],
-                   help='diagnostica: config, fswatch + monitor di piattaforma, python, '
-                        'errori di permesso recenti nel log, TCC/plist (macOS), '
-                        'inotify/systemd/linger (Linux) — exit ≠ 0 se un check '
-                        'fatale fallisce')
+    doc = sub.add_parser('doctor', parents=[common],
+                         help='diagnostica: config, fswatch + monitor di piattaforma, '
+                              'python, errori di permesso recenti nel log, TCC/plist '
+                              'ed exe del daemon (macOS), inotify/systemd/linger (Linux) '
+                              '— exit ≠ 0 se un check fatale fallisce')
+    doc.add_argument('--json', action='store_true',
+                     help='stessi check, stesso exit code, ma un documento JSON su '
+                          'stdout (SPEC.md §9.1)')
     return parser
 
 
@@ -144,12 +152,28 @@ def check_sync_files(daemon):
 
 
 def cmd_doctor(args):
-    """Un check per riga con esito ✔/✗; exit 1 se almeno un check fatale fallisce."""
+    """Un check per riga con esito ✔/✗; exit 1 se almeno un check fatale fallisce.
+
+    Con `--json` le righe non vengono stampate: la stessa sequenza di check finisce
+    in un documento JSON su stdout, con lo stesso exit code (SPEC.md §9.1)."""
     fatal = False
+    checks, ids = [], {}
 
     def out(ok, msg, is_fatal=False):
         nonlocal fatal
-        print(('✔ ' if ok else '✗ ') + msg)
+        if args.json:
+            # id = slug del messaggio (prefisso fino a ':' o '('), id uguali
+            # ripetuti suffissati _2/_3 così restano chiave usabile (SPEC §9.1)
+            base = re.split(r'[:\(]', msg, maxsplit=1)[0]
+            ident = re.sub(r'[^a-z0-9]+', '_', base.lower()).strip('_') or 'check'
+            ids[ident] = ids.get(ident, 0) + 1
+            if ids[ident] > 1:
+                ident = f'{ident}_{ids[ident]}'
+            checks.append({'id': ident,
+                           'status': 'ok' if ok else ('fail' if is_fatal else 'warn'),
+                           'message': msg})
+        else:
+            print(('✔ ' if ok else '✗ ') + msg)
         if not ok and is_fatal:
             fatal = True
 
@@ -346,7 +370,38 @@ def cmd_doctor(args):
                            'senza login → loginctl enable-linger $USER — '
                            'warning non fatale')
 
-    return 1 if fatal else 0
+    # exe del daemon ancora su disco (SPEC.md §8.4/§14.4, 0.5.1): un processo
+    # può girare su un eseguibile cancellato da un upgrade sotto un daemon vivo
+    # → TCC (Transparency, Consent and Control) non lo identifica più e ogni
+    # copia fallisce con EPERM. Guarda il PROCESSO, non il plist (funziona
+    # anche col plist renderizzato col vecchio default). Non fatale: sintomo
+    # con rimedio manuale di una riga, e doctor deve girare anche in quello stato.
+    if is_darwin():
+        exe = daemon_exe()
+        if exe is None:
+            out(True, 'exe del daemon: processo non determinabile — check saltato')
+        elif os.path.exists(exe):
+            out(True, f'exe del daemon: {exe} presente su disco')
+        else:
+            out(False, f'exe del daemon: {exe} NON esiste su disco — il processo '
+                       'gira su un eseguibile cancellato (upgrade sotto un daemon '
+                       'vivo, SPEC §8.4) → launchctl kickstart -k '
+                       'gui/$(id -u)/com.safekeep.agent — warning non fatale')
+
+    code = 1 if fatal else 0
+    if args.json:
+        count, last = recent if recent is not None else (0, None)
+        print(json.dumps({
+            'safekeep': __version__,
+            'timestamp': datetime.now().isoformat(timespec='seconds'),
+            'exit': code,
+            'checks': checks,
+            'permission_errors': {
+                'count_24h': count,
+                'last': last.strftime('%Y-%m-%d %H:%M:%S') if last else None,
+            },
+        }, ensure_ascii=False, indent=2))
+    return code
 
 
 def main(argv=None):

{safekeep-0.4.0 → safekeep-0.5.1}/safekeep/copier.py

@@ -20,6 +20,36 @@ MTIME_TOLERANCE = 1.0      # secondi: tolleranza mtime per volumi a risoluzione
 TMP_INFIX = '.safekeep.tmp.'
 # errori che dicono "questa dest non è usabile adesso" → pending + backoff (§8.3)
 MOUNT_ERRNOS = (errno.ENODEV, errno.EBUSY, errno.ENOSPC)
+# throttle delle copie fallite (SPEC.md §10.1, 0.5.1): stessa (path, errno) →
+# una riga + `— ripetuto N volte` ogni THROTTLE_INTERVAL, non una riga a fallimento
+THROTTLE_INTERVAL = 300.0       # secondi
+_copy_errors = {}               # (src, errno) → [ultimo log monotonic, non loggati]
+
+
+def log_copy_error(src, dst, e, now=None):
+    """`copia fallita src → dst: e` con dedup per **(path, errno)** (SPEC.md §10.1).
+
+    Prima occorrenza: riga storica invariata. Poi al massimo una riga ogni
+    `THROTTLE_INTERVAL` per chiave, col suffisso `— ripetuto N volte` (N =
+    fallimenti non loggati da quell'ultima riga). `recent_permission_errors`
+    (§14.4) somma N+1 su queste righe: `count_24h` resta il conteggio vero,
+    sono solo le righe sul file a essere di meno. I conteggi in memoria
+    (`stats['errati']`, `sync-once`) non leggono da qui.
+    """
+    if now is None:
+        now = time.monotonic()
+    key = (src, e.errno)
+    entry = _copy_errors.get(key)
+    if entry is None or now - entry[0] >= THROTTLE_INTERVAL:
+        pending = 0 if entry is None else entry[1]
+        if pending:
+            log.error('copia fallita %s → %s: %s — ripetuto %d volte',
+                      src, dst, e, pending)
+        else:
+            log.error('copia fallita %s → %s: %s', src, dst, e)
+        _copy_errors[key] = [now, 0]
+    else:
+        entry[1] += 1
 
 
 def _tmp_path(dst):
@@ -215,7 +245,7 @@ def reconcile_project(source_root, dest_root, matcher, layout, dest_path_fn,
             log.error('errore di mount su %s → %s: %s: la dest va in pending',
                       src, dst, e)
             return True
-        log.error('copia fallita %s → %s: %s', src, dst, e)
+        log_copy_error(src, dst, e)
         return False
 
     for dirpath, dirnames, filenames in os.walk(root):

{safekeep-0.4.0 → safekeep-0.5.1}/safekeep/daemon.py

@@ -25,7 +25,14 @@ from .config import (
     source_root_for,
     validate_dests,
 )
-from .copier import MOUNT_ERRNOS, copy_one, needs_copy, prune_project, reconcile_project
+from .copier import (
+    MOUNT_ERRNOS,
+    copy_one,
+    log_copy_error,
+    needs_copy,
+    prune_project,
+    reconcile_project,
+)
 from .matcher import BUILTIN_RULES, Matcher, _glob, parse_rule
 from .platform import LOG_PATH, fswatch_monitor, init_system
 from .volumes import backoff_schedule, dest_state, partition_dests
@@ -629,7 +636,7 @@ class Daemon:
                                 src, dst, e)
                     self.mark_pending(project, dest)
                 else:
-                    log.error('copia fallita %s → %s: %s', src, dst, e)
+                    log_copy_error(src, dst, e)
 
     def walk_dir(self, dirpath, project):
         """Mini-walk: i figli di una directory appena creata potrebbero non

{safekeep-0.4.0 → safekeep-0.5.1}/safekeep/platform.py

@@ -15,6 +15,7 @@ import os
 import platform as _platform
 import re
 import shutil
+import subprocess
 import sys
 from datetime import datetime
 
@@ -26,6 +27,9 @@ SYSTEMD_RUN_PATH = '/run/systemd/system'            # assente su WSL1/systemd of
 # EPERM (Errno 1) / EACCES (Errno 13) come li scrive il logger: codice errno
 # + testo del kernel (SPEC.md §14.4)
 PERM_ERR_RE = re.compile(r'\[Errno (?:1|13)\]|Operation not permitted|Permission denied')
+# suffisso del throttle (SPEC.md §10.1, 0.5.1): la riga rappresenta se stessa
+# + i N fallimenti compressi → count_24h la conta come N+1, non 1 (onesto)
+REPEAT_RE = re.compile(r'ripetuto (\d+) volte')
 
 
 def is_darwin():
@@ -75,7 +79,10 @@ def recent_permission_errors(path=None, now=None, window=86400):
     (SPEC.md §14.4: check non fatale, finestra 24h — segue l'incidente EPERM).
 
     Il timestamp è il prefisso `%(asctime)s` della riga (`YYYY-MM-DD HH:MM:SS`,
-    prime 19 posizioni). **Limite dichiarato**: una riga senza timestamp
+    prime 19 posizioni). Le righe col suffisso del throttle `— ripetuto N volte`
+    (§10.1) valgono **N + 1**: la riga stessa + i N fallimenti compressi, così
+    il conteggio resta il numero vero di errori anche con le righe throttolate.
+    **Limite dichiarato**: una riga senza timestamp
     parsificabile o fuori dalla finestra (clock skew incluso) non viene contata —
     non essendo sicuri che sia recente, non la contiamo: il conteggio è un minimo."""
     if path is None:
@@ -95,7 +102,8 @@ def recent_permission_errors(path=None, now=None, window=86400):
                 age = (now - ts).total_seconds()
                 if not 0 <= age <= window:
                     continue        # troppo vecchio (o nel futuro: clock skew)
-                count += 1
+                rep = REPEAT_RE.search(line)
+                count += 1 + (int(rep.group(1)) if rep else 0)
                 if last is None or ts > last:
                     last = ts
     except OSError:
@@ -103,6 +111,38 @@ def recent_permission_errors(path=None, now=None, window=86400):
     return count, last
 
 
+DAEMON_LABEL = 'com.safekeep.agent'          # label launchd dell'agent (§8.1)
+
+
+def daemon_exe(label=DAEMON_LABEL):
+    """→ eseguibile assoluto del processo launchd `label`, o None se non
+    determinabile (SPEC.md §8.4/§14.4, 0.5.1: job non caricato, processo non
+    trovato, `launchctl`/`ps` assenti o falliti, non-Darwin). Solo lettura.
+
+    Serve al check `doctor` (§14.4): un processo può girare su un eseguibile
+    **cancellato** da un upgrade sotto un daemon vivo (brew upgrade → path
+    Cellar sparito → TCC non identifica il processo → EPERM su ogni copia).
+    """
+    if not is_darwin():
+        return None
+    try:
+        job = subprocess.run(
+            ['launchctl', 'print', f'gui/{os.getuid()}/{label}'],
+            capture_output=True, text=True, timeout=10)
+    except (OSError, subprocess.SubprocessError):
+        return None
+    pid = re.search(r'^\s*pid = (\d+)', job.stdout, re.M)
+    if job.returncode != 0 or pid is None:
+        return None                      # job non caricato o senza processo
+    try:
+        ps = subprocess.run(['ps', '-p', pid.group(1), '-o', 'comm='],
+                            capture_output=True, text=True, timeout=10)
+    except (OSError, subprocess.SubprocessError):
+        return None
+    exe = ps.stdout.strip().splitlines()[0].strip() if ps.stdout.strip() else ''
+    return exe if ps.returncode == 0 and exe else None
+
+
 def linger_enabled(user=None, linger_dir=None):
     """`True`/`False` se l'utente è in `/var/lib/systemd/linger/`, None se la
     directory non c'è (niente systemd → non determinabile, SPEC.md §14.4).

{safekeep-0.4.0 → safekeep-0.5.1/safekeep.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: safekeep
-Version: 0.4.0
+Version: 0.5.1
 Summary: Selective always-on backups for macOS and Linux: fswatch-driven copy of allow-listed files, never deletes
 License-Expression: MIT
 Project-URL: Repository, https://github.com/foxhound87/safekeep
@@ -182,7 +182,7 @@ safekeep <command> [--config PATH] [-v]
 | `run` | daemon: initial reconcile, fswatch loop, event dispatch, 24h timer |
 | `sync-once [--dry-run] [--project PATH] [--prune]` | a single pass: walks the source and copies whatever differs (`--dry-run` only prints what it would copy; `--prune` also removes dest files whose source still exists but is no longer included) |
 | `status` | read-only: config, sources, discovered projects with N rules, destination states |
-| `doctor` | diagnostics: config, fswatch + platform monitor, python, TCC/launchd plist (macOS), inotify limit and systemd unit (Linux) — exits non-zero if a fatal check fails |
+| `doctor [--json]` | diagnostics: config, fswatch + platform monitor, python, TCC/launchd plist (macOS), inotify limit and systemd unit (Linux) — exits non-zero if a fatal check fails; `--json` prints the same checks as one JSON document on stdout with the same exit code, including a structured `permission_errors` count of the last 24h |
 
 ## Tests
 
@@ -190,9 +190,10 @@ safekeep <command> [--config PATH] [-v]
 python3 -m unittest discover -s tests
 ```
 
-Stdlib (`unittest`) suite, zero dependencies: 175 tests covering the matcher,
-config, atomic copy, volumes, daemon, auto-discovery, CLI and the POSIX
-portability layer (platform helper, per-OS fswatch monitor, systemd template).
+Stdlib (`unittest`) suite, zero dependencies: 221 tests covering the matcher,
+config, atomic copy, volumes, daemon, auto-discovery, CLI, the permission-trend
+wrapper and the POSIX portability layer (platform helper, per-OS fswatch
+monitor, systemd template).
 `fswatch` is not needed to run the suite — the few `doctor` checks that talk to
 the real binary are skipped when it's missing — but CI installs it so the
 Linux job exercises the real `inotify` monitor.

{safekeep-0.4.0 → safekeep-0.5.1}/safekeep.egg-info/SOURCES.txt

@@ -20,4 +20,5 @@ tests/test_copier.py
 tests/test_daemon.py
 tests/test_matcher.py
 tests/test_platform.py
+tests/test_trend.py
 tests/test_volumes.py

{safekeep-0.4.0 → safekeep-0.5.1}/tests/test_cli.py

@@ -6,6 +6,7 @@ import argparse
 import contextlib
 import getpass
 import io
+import json
 import os
 import shutil
 import subprocess
@@ -110,7 +111,7 @@ class DoctorTest(CliTestCase):
         """SPEC.md §14.4: su Linux il limite di watch basso è informativo —
         doctor esce 0, non 1. I rami Linux si esercitano patchando l'helper,
         senza girare su Linux."""
-        args = argparse.Namespace(config=self.cfg, v=False)
+        args = argparse.Namespace(config=self.cfg, v=False, json=False)
         buf = io.StringIO()
         with mock.patch.object(cli, 'is_linux', return_value=True), \
                 mock.patch.object(cli, 'is_darwin', return_value=False), \
@@ -146,6 +147,42 @@ class DoctorTest(CliTestCase):
             self.assertEqual(r.returncode, 0, r.stdout)
 
 
+class DoctorExeDaemonTest(CliTestCase):
+    """SPEC.md §8.4/§14.4 (0.5.1): exe del processo launchd su disco —
+    esistente ✔, cancellato ✗ **non fatale**, non determinabile → saltato."""
+
+    def doctor_darwin(self, exe):
+        args = argparse.Namespace(config=self.cfg, v=False, json=False)
+        buf = io.StringIO()
+        with mock.patch.object(cli, 'is_darwin', return_value=True), \
+                mock.patch.object(cli, 'daemon_exe', return_value=exe), \
+                contextlib.redirect_stdout(buf):
+            code = cli.cmd_doctor(args)
+        line = next((l for l in buf.getvalue().splitlines()
+                     if 'exe del daemon' in l), '')
+        return code, buf.getvalue(), line
+
+    def test_exe_esistente_verde(self):
+        code, _, line = self.doctor_darwin(sys.executable)
+        self.assertTrue(line.startswith('✔'), line)
+        self.assertIn('presente su disco', line)
+        self.assertEqual(code, 0)
+
+    def test_exe_cancellato_warning_non_fatale(self):
+        exe = os.path.join(self.tmp, 'Cellar', 'python@3.14', '3.14.6', 'Python')
+        code, _, line = self.doctor_darwin(exe)          # non creato: inesistente
+        self.assertTrue(line.startswith('✗'), line)
+        for needle in ('NON esiste su disco', 'kickstart', 'warning non fatale'):
+            self.assertIn(needle, line)
+        self.assertEqual(code, 0, 'sintomo con rimedio manuale: NON fatale')
+
+    def test_non_determinabile_check_saltato(self):
+        code, _, line = self.doctor_darwin(None)
+        self.assertTrue(line.startswith('✔'), line)
+        self.assertIn('check saltato', line)
+        self.assertEqual(code, 0)
+
+
 class AutoDiscoveryCliTest(CliTestCase):
     """Config SENZA `source:` → modalità auto-discovery (SPEC.md §6)."""
 
@@ -329,7 +366,7 @@ class DoctorLingerTest(CliTestCase):
         self.addCleanup(shutil.rmtree, linger_dir, ignore_errors=True)
         for name in linger:
             open(os.path.join(linger_dir, name), 'w').close()
-        args = argparse.Namespace(config=self.cfg, v=False)
+        args = argparse.Namespace(config=self.cfg, v=False, json=False)
         buf = io.StringIO()
         with mock.patch.dict(os.environ, {'HOME': self.home}), \
                 mock.patch.object(cli, 'is_linux', return_value=True), \
@@ -368,7 +405,7 @@ class DoctorWslTest(CliTestCase):
 
     def doctor_wsl(self, distro='Ubuntu', systemd=False, dest='/mnt/c/backup'):
         cfg = write(os.path.join(self.tmp, 'wsl.cfg'), f'dest: {dest}\n')
-        args = argparse.Namespace(config=cfg, v=False)
+        args = argparse.Namespace(config=cfg, v=False, json=False)
         buf = io.StringIO()
         with mock.patch.dict(os.environ, {'HOME': self.home}), \
                 mock.patch.object(cli, 'is_wsl', return_value=True), \
@@ -426,5 +463,81 @@ class DoctorWslTest(CliTestCase):
         self.assertNotIn('drvfs', r.stdout)
 
 
+class DoctorJsonTest(CliTestCase):
+    """SPEC.md §9.1: `doctor --json` — stessi check, stesso ordine, stesso exit
+    code della modalità normale, tutto in un documento JSON su stdout."""
+
+    def json_doctor(self, *args):
+        r = self.cli('doctor', '--json', *args)
+        # json.loads sul stdout intero: basta una riga di log mista e cade qui
+        return r, json.loads(r.stdout)
+
+    @staticmethod
+    def righe(stdout):
+        """`(status_atteso, message)` di ogni riga della modalità normale."""
+        out = []
+        for line in stdout.splitlines():
+            if not line.strip():
+                continue
+            status = 'ok' if line.startswith('✔') else 'fail-o-warn'
+            out.append((status, line[2:]))
+        return out
+
+    def test_checks_1a1_con_la_modalita_normale(self):
+        normale = self.cli('doctor', '--config', self.cfg)
+        r, doc = self.json_doctor('--config', self.cfg)
+        attese = self.righe(normale.stdout)
+        self.assertEqual([c['message'] for c in doc['checks']],
+                         [msg for _, msg in attese],
+                         'stessi check, stesso ordine della modalità normale')
+        for (atteso, _), check in zip(attese, doc['checks']):
+            if atteso == 'ok':
+                self.assertEqual(check['status'], 'ok', check)
+            else:                                   # riga ✗: warn o fail
+                self.assertIn(check['status'], ('warn', 'fail'), check)
+        self.assertEqual(len({c['id'] for c in doc['checks']}),
+                         len(doc['checks']), 'id duplicati')
+        self.assertEqual(r.returncode, normale.returncode, 'stesso exit code')
+        self.assertEqual(doc['exit'], r.returncode)
+
+    def test_header_e_campi_decisionali(self):
+        _, doc = self.json_doctor('--config', self.cfg)
+        self.assertEqual(doc['safekeep'], cli.__version__)
+        datetime.fromisoformat(doc['timestamp'])            # ISO 8601 valido
+        self.assertIsInstance(doc['checks'], list)
+        self.assertTrue(doc['checks'])
+        for check in doc['checks']:
+            self.assertEqual(set(check), {'id', 'status', 'message'})
+            self.assertIn(check['status'], ('ok', 'warn', 'fail'))
+        self.assertEqual(set(doc['permission_errors']), {'count_24h', 'last'})
+
+    def test_permission_errors_strutturati_sul_log_recente(self):
+        log = os.path.join(self.home, '.local/state/safekeep/safekeep.log')
+        stamp = (datetime.now() - timedelta(hours=3)).strftime('%Y-%m-%d %H:%M:%S')
+        write(log, f'{stamp},000 ERROR copia fallita: [Errno 1] Operation not permitted\n')
+        r, doc = self.json_doctor('--config', self.cfg)
+        perm = doc['permission_errors']
+        self.assertEqual(perm['count_24h'], 1)
+        self.assertEqual(perm['last'], stamp)               # ultimo timestamp
+        check = next(c for c in doc['checks']
+                     if 'errori di permesso' in c['message'])
+        self.assertEqual(check['status'], 'warn')           # warning, NON fatale
+        self.assertEqual(r.returncode, 0, r.stdout)
+
+    def test_log_assente_count_zero_last_null(self):
+        _, doc = self.json_doctor('--config', self.cfg)     # HOME finto: niente log
+        self.assertEqual(doc['permission_errors'],
+                         {'count_24h': 0, 'last': None})
+
+    @unittest.skipUnless(shutil.which('fswatch'), 'fswatch non installato')
+    def test_check_fatale_esce_1_e_lo_dichiara(self):
+        bad = write(os.path.join(self.tmp, 'bad.cfg'), 'riga nuda invalida\n')
+        r, doc = self.json_doctor('--config', bad)
+        self.assertEqual(r.returncode, 1, r.stdout)
+        self.assertEqual(doc['exit'], 1)
+        self.assertTrue(any(c['status'] == 'fail' for c in doc['checks']),
+                        'il check fatale deve comparire come fail')
+
+
 if __name__ == '__main__':
     unittest.main()

{safekeep-0.4.0 → safekeep-0.5.1}/tests/test_copier.py

@@ -296,6 +296,27 @@ class ErroriPerFileTest(CopierTestCase):
         self.assertFalse(os.path.exists(self.dst_root),
                          'il walk si ferma: niente scritture a metà')
 
+    def test_reconcile_ripetuti_stessi_errori_pochissime_righe(self):
+        """SPEC.md §10.1 (0.5.1): 5 reconcile con gli stessi 3 file negati
+        (EPERM) → 3 righe di log (una per (path, errno)), non 15. I conteggi
+        in memoria restano intatti: 3 errori per passata."""
+        copier._copy_errors.clear()
+        self.addCleanup(copier._copy_errors.clear)
+
+        def boom(*args, **kwargs):
+            raise OSError(1, 'Operation not permitted')
+
+        with mock.patch.object(copier, 'copy_one', new=boom), \
+                mock.patch.object(copier.log, 'error') as errlog:
+            for _ in range(5):
+                stats = {}
+                reconcile_project(stats=stats, **self.kwargs)
+                self.assertEqual(stats['errati'], 3,
+                                 'il conteggio non passa dal log')
+        self.assertEqual(errlog.call_count, 3,
+                         'una riga per (path, errno), le 4 passate successive '
+                         'rientrano nell\'intervallo di throttle')
+
 
 class PruneTest(CopierTestCase):
     """`sync-once --prune`: cancellazione solo certa e solo sotto il prefisso."""
@@ -332,5 +353,51 @@ class PruneTest(CopierTestCase):
         self.assertTrue(os.path.exists(os.path.join(self.dst_root, 'proj/old.txt')))
 
 
+class ThrottleLogTest(CopierTestCase):
+    """SPEC.md §10.1 (0.5.1): stessa (path, errno) → ≤1 riga ogni
+    THROTTLE_INTERVAL con `— ripetuto N volte`, non una riga a fallimento."""
+
+    def setUp(self):
+        super().setUp()
+        copier._copy_errors.clear()
+        self.addCleanup(copier._copy_errors.clear)
+
+    @staticmethod
+    def err(no=1):
+        return OSError(no, 'Operation not permitted')
+
+    def test_50_failimenti_stesso_path_una_sola_riga(self):
+        with self.assertLogs(LOGGER, 'ERROR') as cm:
+            for _ in range(50):
+                copier.log_copy_error('/s/a', '/d/a', self.err(), now=1000.0)
+        self.assertEqual(len(cm.output), 1, cm.output)
+        self.assertNotIn('ripetuto', cm.output[0], 'nessun suffisso sulla 1ª riga')
+
+    def test_dopo_intervallo_una_riga_con_il_conteggio(self):
+        now = 1000.0
+        copier.log_copy_error('/s/a', '/d/a', self.err(), now=now)
+        with mock.patch.object(copier.log, 'error') as errlog:   # 9 dentro la finestra
+            for _ in range(9):
+                copier.log_copy_error('/s/a', '/d/a', self.err(), now=now)
+            errlog.assert_not_called()
+        with self.assertLogs(LOGGER, 'ERROR') as cm:             # finestra scaduta
+            copier.log_copy_error('/s/a', '/d/a', self.err(),
+                                  now=now + copier.THROTTLE_INTERVAL + 1)
+            for _ in range(5):                                   # poi di nuovo silenzio
+                copier.log_copy_error('/s/a', '/d/a', self.err(),
+                                      now=now + copier.THROTTLE_INTERVAL + 1)
+        self.assertEqual(len(cm.output), 1, cm.output)
+        self.assertIn('ripetuto 9 volte', cm.output[0])
+
+    def test_chiavi_distinte_indipendenti(self):
+        now = 1000.0
+        with self.assertLogs(LOGGER, 'ERROR') as cm:
+            copier.log_copy_error('/s/a', '/d/a', self.err(1), now=now)
+            copier.log_copy_error('/s/a', '/d/a', self.err(1), now=now)
+            copier.log_copy_error('/s/b', '/d/b', self.err(1), now=now)
+            copier.log_copy_error('/s/a', '/d/a', self.err(13), now=now)
+        self.assertEqual(len(cm.output), 3, cm.output)      # (a,1) una + b + (a,13)
+
+
 if __name__ == '__main__':
     unittest.main()

{safekeep-0.4.0 → safekeep-0.5.1}/tests/test_platform.py

@@ -146,6 +146,21 @@ class AgentTemplateTest(unittest.TestCase):
         for needle in ('RunAtLoad', 'KeepAlive', '__REPO__', '__PYTHON__'):
             self.assertIn(needle, text, needle)
 
+    def test_install_sh_interprete_stabile(self):
+        """SPEC.md §8.4 (0.5.1): il default renderizzato è lo shim di sistema
+        /usr/bin/python3, MAI un path Cellar di Homebrew — un `brew upgrade`
+        cancella il Cellar sotto il processo vivo e TCC non lo identifica più."""
+        with open(os.path.join(REPO, 'install.sh'), encoding='utf-8') as fh:
+            text = fh.read()
+        self.assertIn('SAFEKEEP_PYTHON:-/usr/bin/python3', text)
+        self.assertNotIn('/opt/homebrew/bin/python3', text,
+                         'il default non deve più puntare al Cellar di brew')
+        self.assertIn('py_ok', text, "validazione ≥ 3.9 dell'interprete")
+        for name in ('com.safekeep.agent.plist', 'com.safekeep.trend.plist'):
+            with open(os.path.join(REPO, 'launchd', name), encoding='utf-8') as fh:
+                tpl = fh.read()
+            self.assertIn('default: /usr/bin/python3', tpl, name)
+
 
 class RecentPermissionErrorsTest(unittest.TestCase):
     """SPEC.md §14.4: errori di permesso recenti nel log, finestra 24h,
@@ -199,6 +214,78 @@ class RecentPermissionErrorsTest(unittest.TestCase):
                 self.assertIsNotNone(plat.PERM_ERR_RE.search(riga))
         self.assertIsNone(plat.PERM_ERR_RE.search('INFO reconcile: 0 copie'))
 
+    def test_suffisso_ripetuto_del_throttle_contato_come_N_piu_1(self):
+        """SPEC.md §10.1/§14.4 (0.5.1): una riga `— ripetuto N volte`
+        rappresenta se stessa + i N fallimenti compressi → count_24h resta il
+        numero VERO di errori anche con le righe throttolate."""
+        text = (
+            f'{self._stamp(self.NOW - timedelta(hours=2))} ERROR copia fallita '
+            "a → b: [Errno 1] Operation not permitted: '/x.tmp.1'\n"
+            f'{self._stamp(self.NOW - timedelta(hours=1))} ERROR copia fallita '
+            "a → b: [Errno 1] Operation not permitted: '/x.tmp.1' — ripetuto 49 volte\n"
+        )
+        count, last = plat.recent_permission_errors(self._log(text), now=self.NOW)
+        self.assertEqual(count, 1 + 1 + 49, 'riga base + (riga suffisso + 49)')
+        self.assertEqual(last, self.NOW - timedelta(hours=1))
+
+    def test_riga_senza_suffisso_restano_una_ciascuna(self):
+        text = (f'{self._stamp(self.NOW - timedelta(hours=2))} ERROR copia fallita '
+                "a → b: [Errno 1] Operation not permitted: '/x'\n"
+                f'{self._stamp(self.NOW - timedelta(hours=1))} ERROR copia fallita '
+                "a → b: [Errno 1] Operation not permitted: '/y'\n")
+        count, _ = plat.recent_permission_errors(self._log(text), now=self.NOW)
+        self.assertEqual(count, 2)
+
+
+class DaemonExeTest(unittest.TestCase):
+    """SPEC.md §14.4 (0.5.1): exe del processo launchd, None se non
+    determinabile — Darwin-only, solo lettura, casi finti."""
+
+    LAUNCHCTL_OK = subprocess.CompletedProcess(
+        [], 0, stdout='\tstate = running\n\tpid = 4242\n', stderr='')
+    PS_OK = subprocess.CompletedProcess(
+        [], 0, stdout='/opt/shim/python3\n', stderr='')
+
+    def run_mock(self, results):
+        with mock.patch('sys.platform', 'darwin'), \
+                mock.patch.object(plat.subprocess, 'run',
+                                  side_effect=results) as run:
+            return plat.daemon_exe(), run
+
+    def test_non_darwin_ritorna_none_senza_lanciare_niente(self):
+        with mock.patch('sys.platform', 'linux'), \
+                mock.patch.object(plat.subprocess, 'run') as run:
+            self.assertIsNone(plat.daemon_exe())
+            run.assert_not_called()
+
+    def test_job_non_caricato_o_senza_pid(self):
+        for result in (subprocess.CompletedProcess([], 1, stdout='slot absent', stderr=''),
+                       subprocess.CompletedProcess([], 0, stdout='state = not running\n',
+                                                   stderr='')):
+            with self.subTest(result=result.stdout):
+                exe, run = self.run_mock([result])
+                self.assertIsNone(exe)
+        # job ok ma `ps` fallito → non determinabile
+        exe, _ = self.run_mock([self.LAUNCHCTL_OK,
+                                subprocess.CompletedProcess([], 1, stdout='', stderr='x')])
+        self.assertIsNone(exe)
+
+    def test_launchctl_o_ps_assenti(self):
+        exe, run = self.run_mock([OSError('launchctl mancante')])
+        self.assertIsNone(exe)
+
+    def test_eseguibile_letto_da_ps(self):
+        exe, run = self.run_mock([self.LAUNCHCTL_OK, self.PS_OK])
+        self.assertEqual(exe, '/opt/shim/python3')
+        self.assertEqual(run.call_args_list[1].args[0][:4],
+                         ['ps', '-p', '4242', '-o'])
+
+    def test_ps_senza_output(self):
+        exe, _ = self.run_mock([self.LAUNCHCTL_OK,
+                                subprocess.CompletedProcess([], 0, stdout='\n',
+                                                            stderr='')])
+        self.assertIsNone(exe)
+
 
 class LingerTest(unittest.TestCase):
     """SPEC.md §14.4: linger systemd, directory finta al posto di

safekeep-0.5.1/tests/test_trend.py

@@ -0,0 +1,80 @@
+"""SPEC.md §9.2: `bin/safekeep-trend.sh` — wrapper trend errori di permesso.
+
+Ogni run è un subprocess con HOME finto: niente scritture nella home reale e
+niente tocco ai log reali. Copre: header scritto una sola volta (idempotente),
+riga parseabile a 4 campi, riga appendata anche quando `doctor` esce 1, override
+del path CSV via env.
+"""
+import os
+import shutil
+import subprocess
+import tempfile
+import unittest
+
+REPO = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+TREND = os.path.join(REPO, 'bin', 'safekeep-trend.sh')
+HEADER = 'timestamp,exit,count_24h,last'
+
+
+@unittest.skipUnless(shutil.which('bash'), 'bash non disponibile')
+class TrendTestCase(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.mkdtemp()
+        self.addCleanup(shutil.rmtree, self.tmp, ignore_errors=True)
+        self.home = os.path.join(self.tmp, 'home')        # HOME finto
+        os.makedirs(self.home)
+        self.csv = os.path.join(self.home, '.local', 'state', 'safekeep',
+                                'permission-trend.csv')
+
+    def trend(self, *args, csv=None):
+        env = dict(os.environ, HOME=self.home)
+        if csv is not None:
+            env['SAFEKEEP_TREND_CSV'] = csv
+        return subprocess.run(['bash', TREND, *args], capture_output=True,
+                              text=True, env=env, cwd=REPO, timeout=120)
+
+    def lines(self, path=None):
+        with open(path or self.csv, encoding='utf-8') as fh:
+            return fh.read().splitlines()
+
+    def test_header_e_riga_parseabile(self):
+        r = self.trend()
+        self.assertEqual(r.returncode, 0, r.stderr)
+        lines = self.lines()
+        self.assertEqual(lines[0], HEADER)
+        self.assertEqual(len(lines), 2)                   # header + 1 run
+        row = lines[1].split(',')
+        self.assertEqual(len(row), 4)                     # split campi, niente quoting
+        self.assertEqual(row[1], '0')                     # exit di doctor (JSON §9.1)
+        self.assertEqual(int(row[2]), int(row[2]))        # count_24h intero
+        self.assertTrue(row[0].startswith('20'))          # timestamp ISO 8601
+
+    def test_run_multipla_non_duplica_header(self):
+        self.assertEqual(self.trend().returncode, 0)
+        self.assertEqual(self.trend().returncode, 0)
+        lines = self.lines()
+        self.assertEqual(len(lines), 3)                   # header + 2 run
+        self.assertEqual(lines.count(HEADER), 1)          # header una sola volta
+        self.assertEqual(lines[0], HEADER)
+
+    def test_doctor_exit_1_genera_comunque_riga(self):
+        # config inesistente passata esplicitamente → check fatale → exit 1,
+        # ma l'exit code è un dato: la riga va scritta (SPEC §9.2)
+        missing = os.path.join(self.tmp, 'non-esiste.cfg')
+        r = self.trend('--config', missing)
+        self.assertEqual(r.returncode, 0, r.stderr)
+        row = self.lines()[1].split(',')
+        self.assertEqual(row[1], '1')
+        self.assertEqual(int(row[2]), int(row[2]))
+
+    def test_override_csv_path(self):
+        alt = os.path.join(self.tmp, 'alt', 'trend.csv')
+        r = self.trend(csv=alt)
+        self.assertEqual(r.returncode, 0, r.stderr)
+        self.assertTrue(os.path.exists(alt))
+        self.assertFalse(os.path.exists(self.csv))        # default non toccato
+        self.assertEqual(self.lines(alt)[0], HEADER)
+
+
+if __name__ == '__main__':
+    unittest.main()