From bddbe8b5ba4f2e360ddb2dfb3deeb4792260e7ca Mon Sep 17 00:00:00 2001
From: AI Bot <bot@example.com>
Date: Sat, 6 Jun 2026 19:26:18 +0800
Subject: [PATCH] fix: mark backup snapshots without metadata invalid

---
 src/lib/boss-state-backups.ts     | 2 +-
 tests/admin-backups-route.test.ts | 9 +++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/src/lib/boss-state-backups.ts b/src/lib/boss-state-backups.ts
index 382eba2..499aa11 100644
--- a/src/lib/boss-state-backups.ts
+++ b/src/lib/boss-state-backups.ts
@@ -372,7 +372,7 @@ export async function listBossStateBackups(limit = 20): Promise<BossStateBackupS
           fileName,
           absolutePath,
           bytes: typeof meta.bytes === "number" ? meta.bytes : stat.size,
-          sha256: typeof meta.sha256 === "string" ? meta.sha256 : createHash("sha256").update(text).digest("hex"),
+          sha256: typeof meta.sha256 === "string" ? meta.sha256 : "",
           createdAt: typeof meta.createdAt === "string" ? meta.createdAt : stat.mtime.toISOString(),
           actorAccount: typeof meta.actorAccount === "string" ? meta.actorAccount : undefined,
           reason: typeof meta.reason === "string" ? meta.reason : undefined,
diff --git a/tests/admin-backups-route.test.ts b/tests/admin-backups-route.test.ts
index 09e7f3e..2e9871f 100644
--- a/tests/admin-backups-route.test.ts
+++ b/tests/admin-backups-route.test.ts
@@ -234,6 +234,15 @@ test("backup actions reject snapshots with missing or mismatched metadata", asyn
   assert.equal(missingMetaPayload.verification.ok, false);
   assert.equal(missingMetaPayload.verification.message, "snapshot metadata is missing");
 
+  const listAfterMissingMeta = await getBackups(await requestFor("owner@boss.com", "highest_admin"));
+  assert.equal(listAfterMissingMeta.status, 200);
+  const listAfterMissingMetaPayload = await listAfterMissingMeta.json();
+  const missingMetaListedSnapshot = listAfterMissingMetaPayload.snapshots.find(
+    (snapshot: { snapshotId: string }) => snapshot.snapshotId === snapshotId,
+  );
+  assert.equal(missingMetaListedSnapshot.verification.ok, false);
+  assert.equal(missingMetaListedSnapshot.status, "error");
+
   const missingMetaPreview = await postBackups(
     await requestFor("owner@boss.com", "highest_admin", {
       method: "POST",