Security hardening, test suite, and quality-of-life features from the review

[adamXbot]

Implements everything from the security/functionality/management review, in order of severity. Five commits, each self-contained; a test suite lands in the first and every later change ships with coverage. 83 assertions, all green, run under macOS sh, Debian dash and Alpine busybox ash.

1. Data loss: backup archives matched by prefix (c045cc0)

Archive names had no separator between app and date (vault2026-08-04.tar.bz2), and both restore and BACKUP_KEEP pruning used the glob ${app}[0-9]*.tar.bz2. With apps vault and vault2:

• pruning for vault deleted vault2's archives — silent data loss in the backup tool;
• restore vault picked vault2's newer archive (it then failed the layout check, but with a baffling error).

All archive lookups now go through list_archives, which validates the complete filename — exact app name, then a separator or the legacy no-separator form, then exactly a date with optional _HHMMSS. New archives are written vault_2026-08-04.tar.bz2; old names still restore.

2. Security: /tmp hardening + lock self-healing (c045cc0)

• Step log: was a single mktemp'd file that the interactive menu's per-command cleanup deleted — freeing a /tmp name another local user had already seen. A symlink planted there would have the next root-run step truncate whatever it pointed at. All scratch files now live in a mktemp -d 0700 directory that survives menu commands.
• Run lock: was a predictable name in world-writable /tmp, so any local user could pre-create it and (thanks to sticky /tmp) permanently lock you out of your own tool. It now lives in the managed folder itself (.dockerdance.lock), records the owning pid, and a lock whose process is gone clears itself — a crashed run or reboot no longer demands manual lock removal. doctor reports whether a held lock is live or stale.

3. Test suite in the repo, run by CI (c045cc0)

tests/run-tests.sh + a stub docker (no daemon needed): each case builds a sandbox of fake apps and asserts on exit codes, output, and the exact STOP/UP/pull actions taken. Covers the stopped-policy matrix, carrying on past failures, backup/restore roundtrips (real tar), the vault/vault2 collision, legacy archive names, both lock behaviours, prune, restore-by-date, --backup-first, doctor, and the unhealthy bucket. Run against the pre-fix script it fails 6 assertions — it detects the bugs it guards. CI runs it on every push/PR alongside shellcheck (which now also lints the tests).

4. Webhook/JSON + supply chain (8534dc1)

• notify() escaped nothing, so a quote or backslash in an app name or error broke (or rewrote) the JSON payload. Content is escaped now; payload validated as JSON in test.
• Releases publish manage.sh.sha256; update-self verifies the download against it before installing (sha256sum/shasum/openssl, whichever exists; pre-0.4.1 releases without the asset install as before).
• update-self reads the API error body: an exhausted GitHub rate limit now says so instead of "Are you online?".
• actions/checkout pinned to a commit SHA in both workflows.

5. Features (4acf7f1, 566b7aa, 2f511dc)

• prune command + --prune / PRUNE_AFTER_UPDATE=1: reclaims the dangling images updates leave behind (30 apps updating weekly is a disk quietly filling); reports space freed. Dangling only — tagged/shared images untouched.
• Restore by date: ./manage.sh restore linkace 2026-08-01 reaches any archive BACKUP_KEEP retains; a wrong date lists what exists; bare restore still takes the newest and mentions how many older archives are available.
• Unhealthy bucket: an app that starts but never reports healthy within HEALTH_TIMEOUT used to count as a success — the tally now reads Updated 27 of 30 apps - 1 failed, 1 unhealthy, 1 skipped, names listed, non-zero exit. Kept separate from failed because the remedy differs: failed apps didn't complete the command; unhealthy ones run on the new image but their healthcheck disagrees.
• update --backup-first: archives every app on the way through. The backup flow already ends each app on the freshly pulled image, so this composes the two existing paths rather than adding a third.
• doctor: reports free disk space where backups are written, and warns when manage.conf is group/other-writable (it's sourced as shell — write access is code execution).
• manage.conf.example documents STOPPED_POLICY and PRUNE_AFTER_UPDATE; README covers all of the above; completions (bash/zsh/fish) know prune.

Review corrections

Two things I claimed in the review that turned out wrong, for the record: manage.conf.example does exist (it just lacked the new settings), and the rate-limit fix landed in commit 4 rather than as a standalone.

Verification

• shellcheck clean across manage.sh, completions, tests and stub (CI's own image).
• sh -n (macOS) and dash -n (Debian) pass.
• 83 test assertions green on macOS sh, Debian dash (with bzip2), and the harness itself fails fast with a clear message where bzip2 is missing.
• Both workflows parse as YAML; every run: block passes sh -n.

🤖 Generated with Claude Code