Files API lists phantom entries no route can serve (+ release delete errors)

Overview Files Skills Discover Packages Releases Dependencies Issues2 Breadcrumbs Pull Requests Activity

Closed general

Drew Owens · 6d ago ·closed by Colby Knox

Two server-side oddities found while fixing package installs, filed together:

1. Phantom file entries. /api/v1/pages/adom-glb2png/files lists adom-glb2png (102,751,875 bytes) — but the blob route 404s, files/{path} 404s, and a repo clone doesn't contain it. A file the API lists but no route serves breaks any tool that trusts the listing (installers, checksum gates, backfill scripts). Likely an asset-layer bookkeeping row whose object is gone, or a registry-tarball artifact leaking into the files merge. Same phantom class as the extensionless <slug> entries (size null) that appear beside <slug>.glb on molecule pages — users read those as duplicate files.

2. release delete errors. adom-wiki release delete <slug> <ver> --confirm returns a bare error (an empty release created during the above investigation can't be removed). Either the verb or the endpoint is broken; delete-asset untested.

Repro for both is exactly the commands above against adom-glb2png (release 1.0.1 is the orphan). Neither is blocking anything current — filed so they're tracked.

1 Reply

Colby Knox · 4h ago

Closing — both halves resolved.

Release delete "bare error" — root cause found and fixed in adom-wiki-cli 1.0.50. It was not a broken verb. The /api/packages/<owner>/<slug>/... routes require an owner, and a bare slug does not 404 cleanly there — it shifts the path segments, so the server reads the slug as the owner and the next literal as the slug:

release delete adom-glb2png 1.0.1
-> DELETE /api/packages/adom-glb2png/releases/1.0.1
-> "Package not found: adom-glb2png/releases"

which reads as "this package does not exist" when the real problem is a missing owner. (The package is kyle/adom-glb2png, not adom/ — owner-qualified, the same call answers correctly: "Version 9.9.9 not found for this package".) Easy to miss because SOME package routes are bare-tolerant, e.g. /api/packages/<slug>/versions, which publish uses. As of 1.0.50 the owner-required release verbs (upload/download/assets/notes/platform/delete-asset/delete) fail early with an actionable message naming the fix; the page-scoped ones (create/list/view/edit) still take a bare slug.

Phantom file entries — no longer reproduce. /api/v1/pages/adom-glb2png/files now lists 7 real entries; the 102 MB phantom is gone. The only size: null left is the docs directory, which is normal.

One server-side note, not blocking: those release 404s carry no code, so the CLI hint pipeline can only render a generic NOT_FOUND. Coding them (RELEASE_NOT_FOUND / PACKAGE_NOT_FOUND) would let the CLI say something specific. Worth a wiki-side issue if you want it.