fix: resolve stats logging and vendor directory conflicts

Fix multiple issues with stats command and development workflow by
addressing logging permissions and Go vendoring conflicts.

Changes:
- Rename vendor/js to assets/js to avoid Go vendor detection
  - Prevents "inconsistent vendoring" errors in task dev
  - Updates all references in main.go, index.html, Taskfile, Dockerfile
  - JavaScript assets now in assets/js/ (embedded via go:embed)

- Fix stats command logging in Docker environments
  - Convert logCommand to server method using s.logfile
  - Fixes disconnect between global logFile and server.logfile
  - Add directory auto-creation with proper error handling
  - Add startup logging message showing logfile path

- Configure Air for live development
  - Add .air.toml with -mod=mod flag for Go builds
  - Exclude assets/ directory from hot reload watching

- Fix Docker volume permissions for distroless (UID 65532)
  - Add chmod 777 logs to docker-run and docker-compose-up tasks
  - Document permission requirements in README and docker-compose.yaml
  - Add troubleshooting section for Coolify deployments

- Update .gitignore
  - Add logs/, build-errors.log, access.log
  - Ensure Air and runtime files are ignored

Fixes:
- Stats command now works in Docker/docker-compose
- task dev no longer fails with vendor directory errors
- Proper error messages when log file doesn't exist yet
- Automatic log directory creation with proper permissions

Security:
- Maintains distroless security (no shell, UID 65532)
- Documents permission requirements clearly
- Auto-fixes permissions in task commands

Author: puria

.github/DOCKER.md

@@ -93,7 +93,7 @@ docker-compose up
 ### Trade-offs
 - ❌ **No debugging** - Can't `docker exec` into container (no shell)
 - ❌ **No healthcheck command** - Platforms must use external health checks
-- ⚠️ **Permission setup** - Volumes must be writable by UID 65532
+- ⚠️ **Permission setup** - Volumes must be writable by UID 65532 (especially `/logs` for stats)
 
 ### Volumes
 - `/data` - Directory for serving files

.gitignore

@@ -2,3 +2,6 @@ lsget
 tmp
 .lsgetignore
 files
+logs
+build-errors.log
+access.log

Dockerfile

@@ -10,14 +10,14 @@ WORKDIR /build
 COPY go.mod go.sum ./
 RUN go mod download
 
-# Copy source code and vendored dependencies
+# Copy source code and assets
 COPY . .
 
 # Build arguments
 ARG VERSION=dev
 
 # Build the application with version info
-# Static binary with embedded assets (vendor/ only used for JS, not Go)
+# Static binary with embedded assets (JS dependencies in assets/js/)
 RUN CGO_ENABLED=0 GOOS=linux go build \
     -mod=mod \
     -ldflags="-w -s -X main.version=${VERSION}" \

README.md

@@ -230,28 +230,34 @@ The Docker image uses **Google's Distroless base** for maximum security:
 
 **Permission Setup for Volumes:**
 
-Since the container runs as UID 65532 (`nonroot` user), mounted volumes must be writable:
+⚠️ **IMPORTANT**: Since the container runs as UID 65532 (`nonroot` user), mounted volumes **must be writable** for:
+- `/data` - Serving files (read access sufficient)
+- `/logs` - **Writing access logs** (required for `stats` command to work)
 
 ```bash
 # Create directories with proper permissions
 mkdir -p files logs
 
-# Option 1: World-writable (simple, less secure)
-chmod 777 files logs
+# Option 1: World-writable (simplest, works everywhere)
+chmod 777 logs
+chmod 755 files  # Read-only is fine for serving files
 
 # Option 2: Specific ownership (more secure)
 sudo chown -R 65532:65532 files logs
 
 # Option 3: Your user + group write (best for dev)
 sudo chown -R $(id -u):$(id -g) files logs
-chmod 775 files logs
+chmod 775 logs  # Needs write for access.log
+chmod 755 files
 ```
 
 **For Coolify/Platform Deployments:**
 
-Most platforms handle permissions automatically. If you encounter issues:
-- Coolify: Volume permissions are usually handled by the platform
-- Ensure the deployment user has write access to mount paths
+⚠️ If `stats` command shows "no activity logged yet":
+1. **Check volume permissions** - Logs directory must be writable by UID 65532
+2. **Coolify**: Volumes are usually auto-mounted, but check persistent storage settings
+3. **Manual fix**: SSH into the server and run `chmod 777 /path/to/mounted/logs`
+4. **Verify**: Check server logs for "Logging to: /logs/access.log" message on startup
 
 **Example 1: Simple setup (no baseurl needed):**
 

Taskfile.yml

@@ -30,10 +30,10 @@ tasks:
   vendor:
     desc: "Vendor JavaScript dependencies to reduce supply chain attacks"
     cmds:
-      - mkdir -p vendor/js
-      - curl -fsSL "https://cdn.jsdelivr.net/npm/marked/marked.min.js" -o vendor/js/marked.min.js
-      - curl -fsSL "https://cdn.jsdelivr.net/gh/starfederation/datastar@main/bundles/datastar.js" -o vendor/js/datastar.js
-      - echo "JavaScript dependencies vendored to ./vendor/js/"
+      - mkdir -p assets/js
+      - curl -fsSL "https://cdn.jsdelivr.net/npm/marked/marked.min.js" -o assets/js/marked.min.js
+      - curl -fsSL "https://cdn.jsdelivr.net/gh/starfederation/datastar@main/bundles/datastar.js" -o assets/js/datastar.js
+      - echo "JavaScript dependencies vendored to ./assets/js/"
   docker-build:
     desc: "Build Docker image locally for testing"
     cmds:
@@ -44,7 +44,9 @@ tasks:
     deps: [docker-build]
     cmds:
       - mkdir -p files logs
+      - chmod 777 logs  # Container runs as UID 65532, needs write access
       - echo "Starting lsget container on http://localhost:8080"
+      - echo "Log file ./logs/access.log"
       - docker run --rm -it -p 8080:8080 -v $(pwd)/files:/data -v $(pwd)/logs:/logs -e LSGET_ADDR=0.0.0.0:8080 -e LSGET_DIR=/data -e LSGET_LOGFILE=/logs/access.log lsget:local
   docker-test:
     desc: "Build and test Docker image (version check)"
@@ -56,6 +58,7 @@ tasks:
     desc: "Start services with docker-compose"
     cmds:
       - mkdir -p files logs
+      - chmod 777 logs  # Container runs as UID 65532, needs write access
       - docker-compose up -d
       - echo "Services started. Access at http://localhost:8080"
       - echo "View logs with task docker-compose-logs"

vendor/js/datastar.js assets/js/datastar.jsvendor/js/datastar.js renamed to assets/js/datastar.js

@@ -2,6 +2,8 @@ services:
   lsget:
     build: .
     container_name: lsget
+    # IMPORTANT: Volumes must be writable by UID 65532 (nonroot user)
+    # Before first run: mkdir -p files logs && chmod 777 logs
     volumes:
       - ./files:/data
       - ./logs:/logs

vendor/js/marked.min.js assets/js/marked.min.jsvendor/js/marked.min.js renamed to assets/js/marked.min.js

@@ -252,12 +252,12 @@
       };
     </script>
 
-    <script src="/vendor/js/marked.min.js"></script>
+    <script src="/assets/js/marked.min.js"></script>
 
     <!-- Datastar: Alpine-like data-* reactivity -->
     <script
       type="module"
-      src="/vendor/js/datastar.js"
+      src="/assets/js/datastar.js"
     ></script>
 
     <style>

docker-compose.yaml

@@ -311,10 +311,10 @@ func readDocFile(dir string) (string, string) {
 //go:embed index.html
 var embeddedIndex []byte
 
-//go:embed vendor/js/marked.min.js
+//go:embed assets/js/marked.min.js
 var embeddedMarkedJS []byte
 
-//go:embed vendor/js/datastar.js
+//go:embed assets/js/datastar.js
 var embeddedDatastarJS []byte
 
 // ===== Server state =====
@@ -599,15 +599,21 @@ func getClientIP(r *http.Request) string {
 }
 
 // logCommand writes a command execution to the log file
-func logCommand(cmd, filePath, ip string) {
-	if logFile == "" {
+func (s *server) logCommand(cmd, filePath, ip string) {
+	if s.logfile == "" {
 		return
 	}
 
 	logMutex.Lock()
 	defer logMutex.Unlock()
 
-	f, err := os.OpenFile(logFile, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
+	// Ensure log directory exists
+	logDir := filepath.Dir(s.logfile)
+	if err := os.MkdirAll(logDir, 0755); err != nil {
+		return
+	}
+
+	f, err := os.OpenFile(s.logfile, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
 	if err != nil {
 		return
 	}
@@ -1439,13 +1445,13 @@ func (s *server) handleExec(w http.ResponseWriter, r *http.Request) {
 			}
 			if len(files) == 1 {
 				// Single file, download directly
-				logCommand("get", files[0].virtualPath, ip)
+				s.logCommand("get", files[0].virtualPath, ip)
 				url := "/api/download?path=" + urlEscapeVirtual(files[0].virtualPath)
 				_ = json.NewEncoder(w).Encode(execResp{Output: "", Download: url})
 				return
 			}
 			// Multiple files, create zip
-			logCommand("get", "(pattern match)", ip)
+			s.logCommand("get", "(pattern match)", ip)
 			url := "/api/download?pattern=" + urlQueryEscape(pattern) + "&cwd=" + urlEscapeVirtual(sess.cwd)
 			_ = json.NewEncoder(w).Encode(execResp{Output: fmt.Sprintf("Downloading %d files as archive.zip", len(files)), Download: url})
 			return
@@ -1476,14 +1482,14 @@ func (s *server) handleExec(w http.ResponseWriter, r *http.Request) {
 				return
 			}
 			dirName := filepath.Base(rp)
-			logCommand("get", vp+" (dir)", ip)
+			s.logCommand("get", vp+" (dir)", ip)
 			url := "/api/download?dir=" + urlEscapeVirtual(vp)
 			_ = json.NewEncoder(w).Encode(execResp{Output: fmt.Sprintf("Downloading directory '%s' with %d files as %s.zip", dirName, len(files), dirName), Download: url})
 			return
 		}
 
 		// Single file download
-		logCommand("get", vp, ip)
+		s.logCommand("get", vp, ip)
 		url := "/api/download?path=" + urlEscapeVirtual(vp)
 		_ = json.NewEncoder(w).Encode(execResp{Output: "", Download: url})
 		return
@@ -1648,7 +1654,7 @@ func (s *server) handleExec(w http.ResponseWriter, r *http.Request) {
 		}
 
 		// Log the share command
-		logCommand(cmd, vp, getClientIP(r))
+		s.logCommand(cmd, vp, getClientIP(r))
 
 		// Return the URL with clipboard instruction
 		_ = json.NewEncoder(w).Encode(execResp{
@@ -1795,7 +1801,7 @@ func (s *server) handleExec(w http.ResponseWriter, r *http.Request) {
 		sha256Sum := hex.EncodeToString(sha256Hash.Sum(nil))
 
 		// Log the checksum command
-		logCommand(cmd, vp, getClientIP(r))
+		s.logCommand(cmd, vp, getClientIP(r))
 
 		output := fmt.Sprintf("MD5:    %s\nSHA256: %s", md5Sum, sha256Sum)
 		_ = json.NewEncoder(w).Encode(execResp{Output: output})
@@ -1809,7 +1815,11 @@ func (s *server) handleExec(w http.ResponseWriter, r *http.Request) {
 
 		stats, err := parseLogStats(s.logfile)
 		if err != nil {
-			_ = json.NewEncoder(w).Encode(execResp{Output: fmt.Sprintf("stats: error reading log file: %v", err)})
+			if os.IsNotExist(err) {
+				_ = json.NewEncoder(w).Encode(execResp{Output: fmt.Sprintf("stats: no activity logged yet\nLog file: %s\nStatistics will be available once files are shared, downloaded, or checksummed.", s.logfile)})
+			} else {
+				_ = json.NewEncoder(w).Encode(execResp{Output: fmt.Sprintf("stats: error reading log file: %v", err)})
+			}
 			return
 		}
 
@@ -2989,11 +2999,16 @@ func main() {
 	mux.HandleFunc("/api/static/", s.handleStaticFile)
 	mux.HandleFunc("/sitemap.xml", s.handleSitemap)
 	// Vendored JavaScript dependencies
-	mux.HandleFunc("/vendor/js/marked.min.js", s.handleVendoredMarked)
-	mux.HandleFunc("/vendor/js/datastar.js", s.handleVendoredDatastar)
+	mux.HandleFunc("/assets/js/marked.min.js", s.handleVendoredMarked)
+	mux.HandleFunc("/assets/js/datastar.js", s.handleVendoredDatastar)
 	mux.HandleFunc("/", s.handleIndex) // Catch-all route must be last
 
 	fmt.Printf("Serving %s on http://%s  (cat max = %d bytes)\n", rootAbs, *addr, *catMax)
+	if s.logfile != "" {
+		fmt.Printf("Logging to: %s\n", s.logfile)
+	} else {
+		fmt.Println("Logging disabled (use -logfile or LSGET_LOGFILE to enable)")
+	}
 	srv := &http.Server{
 		Addr:              *addr,
 		Handler:           logRequests(mux),
@@ -3099,6 +3114,10 @@ func logRequests(next http.Handler) http.Handler {
 		// Write to log file if specified
 		if logFile != "" {
 			logMutex.Lock()
+			// Ensure log directory exists
+			if logDir := filepath.Dir(logFile); logDir != "" {
+				_ = os.MkdirAll(logDir, 0755)
+			}
 			f, err := os.OpenFile(logFile, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
 			if err == nil {
 				_, _ = f.WriteString(logLine)