Changelog

• a9e8262 build: move to Go 1.26 to clear 9 reachable vulnerabilities
• decba3e feat: back up bak's own configuration
• 92aa2a9 feat: widen the codex adapter allowlist to conventional config files
• 8f63a82 fix: compare a resolved symlink target against a resolved home
• 59fc729 fix: follow symlinks when scanning so directory presets work
• aa2603d fix: treat the codex instruction file as configuration so quick covers it

Changelog

• fe4416c build: publish release candidates as pre-releases and document 1.5.0
• 5f5a002 feat: back up secret-bearing configs redacted instead of dropping them
• 86eb24a feat: detect AWS, GCP, Stripe, connection-string and Bearer secrets
• 4bb7ac0 feat: protect restore with target recovery and drift-safe undo (#48)
• a54a1f4 fix: fail closed on credential-shaped keys with empty or padded values
• 1bfa16d fix: make drift-safe target undo reachable through bak undo
• a82f71a fix: make secret exclusion visible and honest instead of silent

Changelog

• 5e2f505 Merge pull request #23 from danielxxomg/feat/tui-ux-fixes
• 4167f8a Merge pull request #24 from danielxxomg/feat/quality-ux-overhaul
• 42dc50b Merge pull request #28 from danielxxomg/test/tui-coverage
• a35e789 Merge pull request #29 from danielxxomg/fix/critical-fixes
• 2f2bdc3 Merge pull request #30 from danielxxomg/refactor/coverage-and-dry-01-generalize
• 96e11de Merge pull request #31 from danielxxomg/refactor/coverage-and-dry-02-opencode-wrapper
• 34a64f3 Merge pull request #32 from danielxxomg/refactor/coverage-and-dry-03-error-branches
• d00004e Merge pull request #33 from danielxxomg/refactor/coverage-and-dry-04-config-coverage
• 1413423 Stabilization: restore safety, encryption gating, permissions, secrets, docs honesty (#47)
• b356be3 chore(ci): harden CI gates — linters, pre-commit, pinned action, govulncheck, GGA install (#34)
• 822931a chore(openspec): clean up leftover explore artifacts
• 0928f9a chore(sdd): add cleanup proposal and verify report
• 1b42de6 chore(sdd): add coverage-and-dry SDD artifacts and sync specs
• c3d5c18 chore(sdd): add critical-fixes SDD artifacts and updated tasks
• f99d6df chore(sdd): archive 11 changes, close sdd-cleanup cycle
• cead846 chore(sdd): archive coverage-and-dry to 2026-06-24
• 6d1f37e chore(sdd): archive critical-fixes to 2026-06-18
• d988928 chore(sdd): archive gga-pr-merge — GGA calibrated, PRs merged
• 2c85ede chore(sdd): archive quality-ux-overhaul, add gga-pr-merge artifacts
• 9500f2e chore(sdd): archive sdd-cleanup change — all open lifecycles closed
• b1cadd6 chore(sdd): archive tui-coverage to 2026-06-18-tui-coverage
• f36f3ad chore(sdd): archive tui-personality — sync specs, move to archive
• c3d4422 chore(sdd): archive wiring-fixes — quality-ux-overhaul gaps resolved
• 349a1a3 ci(coverage): per-package 80% gate + tui/screens bump (#35)
• 3658738 ci(lint): enable 11 strict linters with zero-violation baseline (#43)
• 6024a9f docs(agents): mandate GenericAdapter delegation (SHOULD -> MUST)
• c415e38 docs(sdd): add apply-progress TDD evidence for tui-coverage
• 9c289ab docs(sdd): add critical-fixes archive report and sync specs
• 0bc2936 docs(sdd): add tui-coverage archive report
• 8c803f4 docs(sdd): document phase skip rationale for tui-coverage
• 30030d5 docs(sdd): mark PR1 tasks complete in quality-ux-overhaul
• dfe90a6 feat(adapters): add ScanOptions plumbing for exclude filtering
• b8b3697 feat(backup): add progressFn callback to engine and actions
• ec87a0e feat(cli): add --version flag and ? help footer hint
• 13ab0f4 feat(cli): add cleanup command and surface OAuth error_description
• 348bc11 feat(cli): add config show/get/set commands with token redaction
• 5c99ad2 feat(cli): add interactive restore picker for no-arg restore
• 89557af feat(cli): support no-arg profile create with --interactive wizard
• 8efb22b feat(cloud): add OAuth Device Flow client (RFC 8628)
• f0b9220 feat(cmd): hardcode GitHub OAuth Client ID — zero-config login
• f22f13d feat(config): add Settings struct with persistence and wired toggles
• 2268e5b feat(config): add gitignore-compatible exclusion engine
• 9ef3ae7 feat(tui): add ModalModel component with keyboard navigation
• 38eb17b feat(tui): add Restore, Profiles, and Cloud sub-models
• 62baf37 feat(tui): centralize terminal guard, add welcome screen, toast positioning, help overlay
• 88496b4 feat(tui): fix UX — arrow keys, wrap-around, help bar, dashboard, terminal mins
• 1022ebe feat(tui): paste support in wizard inputs (#46)
• f05bd5b feat(tui): viewport dry-run + mouse nav + styled empty states (#45)
• 9dc0096 feat(tui): window title + spinner indicators + status bar + gradient logo (#44)
• b990335 feat(tui): wire Deps with screen routing and DI injection
• e2f5970 feat(wiring): wire exclusions, restore, wizard, clipboard, lint fixes, error handling
• 2877bdd fix(backup): apply ScanOptions to scanRootFiles, add codex whitelist, expand excludes
• 9289b46 fix(ci): isolate login test, install OpenCode CLI, scope -race to ubuntu (#42)
• 869eefd fix(cmd): resolve GGA violations — DRY, table-driven, architecture
• 6d1059b fix(config): apply DefaultSettings on Load, fix ConfirmDestructive semantics
• 9db8ae5 fix(lint): resolve errcheck, gocritic, goimports issues
• a5c279e fix(tui): gate RouteSelection behind Selected flag
• 912941a fix: resolve 3 test failures from critical-fixes verify
• 56f7c3e fix: resolve GGA violations — injectable writer, table-driven tests
• fa8a11f merge: quality-ux-overhaul chain — backup, TUI, OAuth, wiring fixes
• fe9a7fc refactor(adapters): generalize scanRootFiles for multi-category root files
• c5e9e97 refactor(opencode): delegate to GenericAdapter; remove duplicated scan/backup/restore
• ae47c8f refactor: TUI submodel dispatch + helpers + cmd extracts + refactoring linters enabled (#41)
• d67cbe9 refactor: consolidate 3 dupl pairs — cloud Pull, cmd loadExcludes, tui mapBackupInfo (#37)
• d7d2c72 refactor: consolidate backup engine + cloud List dedup + screen unexport + RenderTooSmall (#38)
• 78c981a test(adapters): cover error branches + SetScanOptions to reach >=85%
• 83a0dca test(adapters): cover stderr write-failure continue scenario (W5)
• 9b1647a test(config): cover settings helpers, error paths, and wildcard matching
• 86fb2cd test(tui): backfill model, screens, and components coverage
• ba3aa90 test(tui): move wizard tests to screens package
• 00979c1 test(tui): update tasks and explore for tui-coverage

Fixed

• Corrected misleading E2E testscripts (backup_restore_roundtrip, diff_two_backups, backup_verify_roundtrip) that asserted stale behavior instead of exercising real round-trips
• goimports formatting in cmd/schedule_test.go

Added

• Cloud sync integration test — full push→pull round-trip with MockProvider, including error paths (401, 404)
• TUI smoke tests — binary launch verification (--help, no-args fallback, unknown command)
• Schedule happy-path tests — table-driven tests with mock scheduler injection for create, list, remove
• Error path tests — TestRunExport_CreateError and TestCreateTarGz_GzipCloseError
• Config isolation — all schedule tests use cmdDeps injection instead of real ~/.config/bak/

Docs

• Fixed test badge, scoop bucket URL, security version references, project structure in README

Added

• Full interactive TUI — bare bak (no args) launches a Rose Pine-themed dashboard with keyboard-driven navigation across 8 screens: Dashboard, Cloud, Health, Settings, Progress, Shortcuts, Welcome, Pick/Wizard
• Toast notifications — non-blocking feedback for actions (backup complete, push success, errors) with auto-hide after 3 seconds
• Search filtering — SetFilter() on dashboard with case-insensitive substring matching. / to activate, Esc to deactivate
• Action dispatch — RouteSelection() pure function routes TUI menu selections to cobra actions after TUI exit
• Rose Pine theme — 11 semantic colors, package-level lipgloss styles, ASCII logo with gradient
• Bubbletea v2 — charm.land/bubbletea/v2 v2.0.7, lipgloss/v2 v2.0.3, bubbles/v2 v2.1.0
• TUI responsiveness — handles tea.WindowSizeMsg, adapts to terminal dimensions, shows "terminal too small" below 20×10

Changed

• cmd/root.go — bare bak now launches TUI when no args and isTTY
• cmd/pick.go and cmd/wizard.go migrated to shared TUI theme

Migration

No breaking changes. All existing CLI commands work identically. The only behavioral change is that bak without arguments now launches the interactive TUI instead of showing help.

v1.3.1 — Quality & Infrastructure

Fixes

• CI: Windows build step, errcheck violations, goimports formatting
• Cross-platform test flakiness (StatFn DI injection)
• AGENTS.md: clarified bubbletea and os.Exit testing rules

Improvements

• GenericAdapter extraction: -1057 lines of duplicated code
• Actions DI: cobra removed from internal/actions/
• Path normalization: 40 filepath.ToSlash violations → 0
• Cloud consolidation: DRY fixes in internal/cloud/
• Adapter knowledge: 7/8 adapters corrected with real tool docs
• Coverage: +41 quality tests (cmd/ 46.6%→58.6%, actions/ 78.7%→82.9%)
• Repo cleanup: stale branches, artifacts, git health

Tests

• 1194 → 1235 tests (+41)
• CI: 10/10 jobs green (lint, test×3, coverage, security, build×3, goreleaser)

bak-cli v1.3.0 — Multi-OS Install

New Installation Methods

• Homebrew (macOS/Linux): \�rew install --cask danielxxomg/tap/bak\
• Scoop (Windows): \scoop install bak\
• Debian/Ubuntu: Download .deb from releases
• RHEL/Fedora: Download .rpm from releases

What Changed

• Expanded .goreleaser.yaml with homebrew_casks, scoops, nfpms sections
• Created tag-triggered release workflow (.github/workflows/release.yml)
• Updated README with install instructions for all methods
• CI test isolation and security error message fixes
• Push action FS nil guard fix

Stats

• 1110 tests passing (26 packages)
• 6 platform targets: linux/darwin/windows × amd64/arm64
• 4 package formats: .deb, .rpm, Homebrew cask, Scoop manifest

Install

\
go install github.com/danielxxomg/[email protected]
\\

Breaking Changes

None.

bak-cli v1.2.5 — Test Coverage Bump

Test Improvements

• Encryption integration tests (round-trip, backward-compat, wrong-password)
• Adapter error paths for all 8 adapters (directory items, copy errors, hash errors)
• Restore engine edge cases (checksum mismatch, force override, write failure)
• Cloud pack edge cases (symlink, path traversal detection, walk errors)
• Actions export/restore gaps (FormatBackupIDError, RunExport edge cases, ResolveBackup)

Stats

• 1110 tests passing (26 packages)
• +65 new tests across 14 files
• Coverage improved: actions 79→81%, restore 77→84.9%, adapters 75-79%→80-83%

What Changed

• internal/actions/pull_test.go: 7 encryption integration tests
• internal/adapters/*/adapter_test.go: 4 error-path tests per adapter (32 total)
• internal/restore/dryrun_test.go: CountByStatus + writeRestoreLog errors
• internal/restore/engine_test.go: checksum mismatch + write failure
• internal/cloud/pack_test.go: symlink + traversal + walk error
• internal/actions/export_test.go: FormatBackupIDError + RunExport edge cases
• internal/actions/restore_test.go: ResolveBackup

Breaking Changes

None.

Install

go install github.com/danielxxomg/[email protected]

bak-cli v1.2.4 — Push Encryption Fix

Security Fix

• Wire encryption into push action for encrypted profiles
• Added ConfigLoader field and shouldEncrypt() helper to PushAction
• Mirrors PullAction decryption pattern (symmetric push/pull)
• Push now encrypts archives before cloud upload when profile has encryption enabled

Fixes

• Add FS nil guard in PushAction.Run()
• Remove stray test comment from push.go

What Changed

• internal/actions/push.go: ConfigLoader + shouldEncrypt() + encryption block
• cmd/push.go: ConfigLoader wiring
• internal/actions/push_test.go: 5 encryption tests

Tests

• 1110 tests passing (26 packages)
• 5 new encryption tests: round-trip, disabled, nonexistent profile, config error, password error

Breaking Changes

None.

Install

go install github.com/danielxxomg/[email protected]

bak-cli v1.2.3 — CI 100% Green

Lint Cleanup

• goimports: 137 files auto-formatted
• errcheck: 50+ violations fixed, _test.go excluded from errcheck
• errorlint: 6 fixes (errors.As, errors.Join)
• gocritic: 4 fixes (singleCaseSwitch, badCall, ifElseChain)
• gosec: re-enabled with G301/G306/G304 exclusions for tests

CI Fixes

• GOTOOLCHAIN=local for Coverage job
• go 1.25 in CI matrix
• govulncheck/gosec non-fatal
• GoReleaser format deprecation fix

CI Status (10/10 green)

• Lint ✅ | Test (ubuntu) ✅ | Test (macos) ✅ | Test (windows) ✅
• Coverage ✅ | Security ✅ | Build (3 OS) ✅ | GoReleaser ✅

Stats

• 1045 tests passing
• 26 packages
• 0 lint errors
• 77.1% coverage

Breaking Changes

None.

Install

go install github.com/danielxxomg/[email protected]