Improve apps logs streaming helpers #3908

ericfeunekes · 2025-11-11T20:01:56Z

Changes

Add the databricks apps logs NAME command, including tail/follow/search/source/output-file flags wired via cmdgroup, file mirroring with 0600 perms, and validation against apps that lack a public URL. (cmd/workspace/apps)
Introduce the reusable libs/logstream helper with token refresh hooks, buffering, search/source filtering, structured error handling, context-driven deadlines, and a comprehensive unit suite so other commands can stream logs without bespoke WebSocket loops.
Refactor databricks auth token to reuse auth.AcquireToken via the new libs/auth/token_loader.go, ensuring persistent auth options and timeouts stay centralized and fully covered by regression tests.

Why

This is a quality of life addition that allows the CLI to tail logs to the CLI. It hooks directly into the token acquisition module so that the tokens don't need to be managed separately.

Tests

go test ./libs/logstream
go test ./cmd/workspace/apps
go test ./cmd/auth

pkosiec

Thank you @ericfeunekes for your contribution! The new app logs command is super helpful. I tested the changes and it works well 👍

Before merge, please take a look at my comments. I can help you implementing the changes if you'd like to - feel free to ping me anytime. Thanks!

pkosiec · 2025-11-12T14:23:34Z

cmd/auth/token.go

+		OAuthArgument:      oauthArgument,
+		Host:               args.authArguments.Host,
+		AccountID:          args.authArguments.AccountID,


If we already pass args.authArguments (which consists of Host and AccountID properties), perhaps it makes sense to:

pass the whole struct args.authArguments as an input argument

do oauthArgument, err := args.authArguments.ToOAuthArgument() inside the auth.AcquireToken()

In that way we'll reduce 3 input args to just one. Does it make sense?

auth.AcquireTokenRequest now carries the entire auth.AuthArguments struct and does the ToOAuthArgument conversion internally, so CLI callers don’t need to juggle host/account IDs or duplicate that logic. cmd/auth token and the new apps logs command just pass the struct plus profile/timeout metadata.

pkosiec · 2025-11-12T14:50:59Z

cmd/auth/token_test.go

 	}
 }
+
+func TestLoadTokenDoesNotMutatePersistentAuthOpts(t *testing.T) {


If I understood correctly, this test verifies those 3 lines:

allOpts := append([]u2m.PersistentAuthOption{}, req.PersistentAuthOpts...) allOpts = append(allOpts, u2m.WithOAuthArgument(req.OAuthArgument)) persistentAuth, err := u2m.NewPersistentAuth(ctx, allOpts...)

Is that correct? So it effectively tests the AcquireToken function, and just that specific part. I'm not really sure if there's enough value in such separate unit test 🤔 I'll ask for a second opinion, but for now we can keep it, however let's move it to libs/auth/token_loader_test.go 👍

pkosiec · 2025-11-12T15:46:50Z

cmd/auth/token_test.go

 			validateToken: validateToken,
 		},
 	}
 	for _, c := range cases {


Shouldn't we move the loadToken tests to libs/auth/token_loader_test.go, and keep just a single happy path for the loadToken itself? Now the core logic is in the AcquireToken and basically that's what the loadToken unit tests test.

pkosiec · 2025-11-12T15:48:36Z

docs/logstream_SKILL.md

I'm not sure if this is the best place to have this skill definition - what do you think about moving it to .claude/skills/logstream.md?

Also, do you have any use case for the CLI that could use your skill? I'm wondering if we need it at all 🤔

I think the comment above was missed, please move this file to .claude/skills/logstream.md 🙏

pkosiec · 2025-11-12T15:54:21Z

cmd/workspace/apps/logs.go

+			oauthArg, err := authArgs.ToOAuthArgument()
+			if err != nil {
+				return err
+			}
+


(As noted in the first comment, once it is applied, this would be moved to the auth.AcquireTokenRequest)

pkosiec · 2025-11-12T17:28:17Z

libs/logstream/streamer.go

+	var closeErr *websocket.CloseError
+	if errors.As(err, &closeErr) {
+		switch closeErr.Code {
+		case 4401, 4403:


Could you define consts for the error codes please?

pkosiec · 2025-11-12T18:26:47Z

libs/logstream/streamer.go

+		if err := waitForBackoff(ctx, timer, backoff); err != nil {
+			return err
+		}
+		backoff = min(backoff*2, 5*time.Second)


Please add 5*time.Second to consts 👍

pkosiec · 2025-11-12T18:48:29Z

libs/apps/logstream/streamer.go

+	userAgent     string
+}
+
+func (s *logStreamer) Run(ctx context.Context) error {


Can we split the Run and consume methods to increase readability please? 🙏

pkosiec · 2025-11-12T19:09:53Z

libs/logstream/streamer.go

+
+		backoff = time.Second
+		err = s.consume(ctx, conn)
+		_ = conn.Close()


The refactoring (splitting the method to multiple ones) would be helpful as then we could follow the best practices and add defer conn.Close() right after a successful connection:

conn, resp, err := s.dialer.DialContext(ctx, s.url, headers) if err != nil { // err handling } defer conn.Close() // <-- here

and also, within the same function, we could move the goroutine:

go func() { select { case <-ctx.Done(): _ = conn.WriteControl(websocket.CloseMessage, websocket.FormatCloseMessage(websocket.CloseNormalClosure, "context canceled"), time.Now().Add(time.Second)) _ = conn.Close() case <-closeCh: } }()

Also, currently the connection is closed two times and in case of timeouted context, second call would return an error (connection already closed). Could we use sync.Once to solve it?

pkosiec · 2025-11-12T19:22:35Z

libs/apps/logstream/streamer.go

+	userAgent     string
+}
+
+func (s *logStreamer) Run(ctx context.Context) error {


I'd add a comment that this method isn't thread-safe, just to make sure no one runs a single logStreamer instance concurrently 👍

This reverts commit 402e72743d9a9bd6dbdc7c24f1f20d62cededf11.

ericfeunekes · 2025-11-13T19:55:29Z

@pkosiec I think I've addressed each of your issues and tried to keep them on separate commits to make it easier to review

pkosiec

Thanks a lot for implementing the comments, including the logs color formatting!

We're almost there - I put some minor comments. There's one small issue with -f and -tail-lines flags, but other than that I don't see any major blockers 👍

pkosiec · 2025-11-14T13:32:46Z

libs/auth/token_loader_test.go

+func TestAcquireTokenRefreshFailureWithProfileShowsLoginHint(t *testing.T) {
+	_, err := AcquireToken(context.Background(), AcquireTokenRequest{
+		AuthArguments: &AuthArguments{
+			Host:      "https://accounts.cloud.databricks.com",
+			AccountID: "expired",
+		},
+		ProfileName: "expired",
+		PersistentAuthOpts: []u2m.PersistentAuthOption{
+			u2m.WithTokenCache(newTokenCache()),
+			u2m.WithOAuthEndpointSupplier(&mockOAuthEndpointSupplier{}),
+			u2m.WithHttpClient(&http.Client{Transport: fixtures.SliceTransport{refreshFailureTokenResponse}}),
+		},
+	})
+	require.EqualError(t, err, `A new access token could not be retrieved because the refresh token is invalid. To reauthenticate, run the following command:
+  $ databricks auth login --profile expired`)
+}
+
+func TestAcquireTokenRefreshFailureWithHostShowsLoginHint(t *testing.T) {
+	_, err := AcquireToken(context.Background(), AcquireTokenRequest{
+		AuthArguments: &AuthArguments{
+			Host:      "https://accounts.cloud.databricks.com",
+			AccountID: "expired",
+		},
+		PersistentAuthOpts: []u2m.PersistentAuthOption{
+			u2m.WithTokenCache(newTokenCache()),
+			u2m.WithOAuthEndpointSupplier(&mockOAuthEndpointSupplier{}),
+			u2m.WithHttpClient(&http.Client{Transport: fixtures.SliceTransport{refreshFailureTokenResponse}}),
+		},
+	})
+	require.EqualError(t, err, `A new access token could not be retrieved because the refresh token is invalid. To reauthenticate, run the following command:
+  $ databricks auth login --host https://accounts.cloud.databricks.com --account-id expired`)
+}
+
+func TestAcquireTokenInvalidRefreshResponseShowsHelp(t *testing.T) {
+	_, err := AcquireToken(context.Background(), AcquireTokenRequest{
+		AuthArguments: &AuthArguments{
+			Host:      "https://accounts.cloud.databricks.com",
+			AccountID: "active",
+		},
+		ProfileName: "active",
+		PersistentAuthOpts: []u2m.PersistentAuthOption{
+			u2m.WithTokenCache(newTokenCache()),
+			u2m.WithOAuthEndpointSupplier(&mockOAuthEndpointSupplier{}),
+			u2m.WithHttpClient(&http.Client{Transport: fixtures.SliceTransport{refreshFailureInvalidResponse}}),
+		},
+	})
+	require.EqualError(t, err, "token refresh: oauth2: cannot parse json: invalid character 'N' looking for beginning of value. Try logging in again with `databricks auth login --profile active` before retrying. If this fails, please report this issue to the Databricks CLI maintainers at https://github.com/databricks/cli/issues/new")
+}
+
+func TestAcquireTokenOtherErrorShowsHelp(t *testing.T) {
+	_, err := AcquireToken(context.Background(), AcquireTokenRequest{
+		AuthArguments: &AuthArguments{
+			Host:      "https://accounts.cloud.databricks.com",
+			AccountID: "active",
+		},
+		ProfileName: "active",
+		PersistentAuthOpts: []u2m.PersistentAuthOption{
+			u2m.WithTokenCache(newTokenCache()),
+			u2m.WithOAuthEndpointSupplier(&mockOAuthEndpointSupplier{}),
+			u2m.WithHttpClient(&http.Client{Transport: fixtures.SliceTransport{refreshFailureOtherError}}),
+		},
+	})
+	require.EqualError(t, err, "token refresh: Databricks is down (error code: other_error). Try logging in again with `databricks auth login --profile active` before retrying. If this fails, please report this issue to the Databricks CLI maintainers at https://github.com/databricks/cli/issues/new")
+}
+
+func TestAcquireTokenSuccessReturnsAccessToken(t *testing.T) {
+	token, err := AcquireToken(context.Background(), AcquireTokenRequest{
+		AuthArguments: &AuthArguments{
+			Host:      "https://accounts.cloud.databricks.com",
+			AccountID: "active",
+		},
+		ProfileName: "active",
+		PersistentAuthOpts: []u2m.PersistentAuthOption{
+			u2m.WithTokenCache(newTokenCache()),
+			u2m.WithOAuthEndpointSupplier(&mockOAuthEndpointSupplier{}),
+			u2m.WithHttpClient(&http.Client{Transport: fixtures.SliceTransport{refreshSuccessTokenResponse}}),
+		},
+	})
+	require.NoError(t, err)
+	assert.Equal(t, "new-access-token", token.AccessToken)
+	assert.Equal(t, "Bearer", token.TokenType)
+}


Those are moved tests from the token_test.go, correct? Could you please keep them defined as table tests? It's much easier to maintain such cases in table test format. Thanks!

pkosiec · 2025-11-14T13:38:18Z

libs/auth/token_loader.go

+var persistentAuthFactory = func(ctx context.Context, opts ...u2m.PersistentAuthOption) (persistentAuth, error) {
+	return u2m.NewPersistentAuth(ctx, opts...)
+}


If I understand correctly, this is defined purely for a single unit test that checks if the PersistentAuthOpts aren't mutated, correct?

I'd get rid of this as we don't need to do that. Please check my next comment for more details 👍

pkosiec · 2025-11-14T13:39:36Z

libs/auth/token_loader_test.go

+	defaultFactory := persistentAuthFactory
+	t.Cleanup(func() {
+		persistentAuthFactory = defaultFactory
+	})
+
+	opts := []u2m.PersistentAuthOption{
+		func(pa *u2m.PersistentAuth) {},
+		func(pa *u2m.PersistentAuth) {},
+	}
+	initialLen := len(opts)
+	factoryCalls := 0
+
+	persistentAuthFactory = func(ctx context.Context, providedOpts ...u2m.PersistentAuthOption) (persistentAuth, error) {
+		factoryCalls++
+		require.Len(t, providedOpts, initialLen+1)
+		require.Len(t, opts, initialLen) // original slice must not change
+		return &fakePersistentAuth{
+			token: &oauth2.Token{
+				AccessToken: "token",
+			},
+		}, nil
+	}


I'd just skip that part, and use the mockOAuthEndpointSupplier, and then check the length of the opts, without counting the calls etc. 👍 No need for it IMO.

pkosiec · 2025-11-14T13:40:15Z

docs/logstream_SKILL.md

I think the comment above was missed, please move this file to .claude/skills/logstream.md 🙏

pkosiec · 2025-11-14T13:41:19Z

libs/logstream/streamer.go

+const handshakeErrorBodyLimit = 4 * 1024
+const defaultUserAgent = "databricks-cli logstream"
+const initialReconnectBackoff = 200 * time.Millisecond
+const maxReconnectBackoff = 5 * time.Second
+const closeCodeUnauthorized = 4401
+const closeCodeForbidden = 4403


Suggested change

const handshakeErrorBodyLimit = 4 * 1024

const defaultUserAgent = "databricks-cli logstream"

const initialReconnectBackoff = 200 * time.Millisecond

const maxReconnectBackoff = 5 * time.Second

const closeCodeUnauthorized = 4401

const closeCodeForbidden = 4403

const (

handshakeErrorBodyLimit = 4 * 1024

defaultUserAgent = "databricks-cli logstream"

initialReconnectBackoff = 200 * time.Millisecond

maxReconnectBackoff = 5 * time.Second

closeCodeUnauthorized = 4401

closeCodeForbidden = 4403

)

pkosiec · 2025-11-14T14:31:17Z

libs/logstream/streamer.go

+	}
+
+	backoff := initialReconnectBackoff
+	timer := time.NewTimer(time.Hour)


We stop the timer immediately in the next line - shouldn't we have just var timer time.Timer?

libs/apps/logstream/streamer.go

pkosiec · 2025-11-14T14:52:19Z

libs/logstream/streamer.go

+
+	stopWatch := watchContext(ctx, conn)
+	defer stopWatch()
+	defer conn.Close()


Do I understand correctly that we don't need to do that as the stopWatch will close the connection? If so, then we can remove that line (that was my original intention of one of the previous comments - ensure the connection is closed only once)

pkosiec · 2025-11-14T14:56:16Z

libs/apps/logstream/streamer.go

+	return line
+}
+
+type tailBuffer struct {


nit (for later): Later (in a follow-up PR) we could move tailBuffer, formatting-related helpers to separate files. But let's do that later 👍

pkosiec · 2025-11-14T14:58:03Z

libs/logstream/streamer.go

+func stopTimer(timer *time.Timer) {
+	if timer == nil {
+		return
+	}
+	if !timer.Stop() {
+		drainTimer(timer)
+	}
+}
+
+func resetTimer(timer *time.Timer, d time.Duration) {
+	if timer == nil {
+		return
+	}
+	if !timer.Stop() {
+		drainTimer(timer)
+	}
+	timer.Reset(d)
+}


those functions look super similar, can't we have just one, stopTimer? resetTimer is called only once and it could use stopTimer with another line timer.Reset(d).

pkosiec · 2025-11-17T07:56:22Z

cmd/workspace/apps/apps.go

 	cmd.AddCommand(newStop())
 	cmd.AddCommand(newUpdate())
 	cmd.AddCommand(newUpdatePermissions())
+	cmd.AddCommand(newLogsCommand())


Apologies, I know I put a comment to add the command as a part of the file but now I realized it is generated from API files in one of our internal repositories.

Could we please revert the changes in ffe6e3d? 🙏 I can do that, if you'd like to 👍 Thank you!

(For a later follow-up PR)
@fjakobs @pietern The /logz and /logz/stream endpoints don't seem to be part of the public API. Should we keep it as it is (after the revert of the mentioned commit) or should I include the endpoints in our proto files in the universe repo?

You can move this into overrides.go in the same directory.

See cmdOverrides.

@pkosiec The endpoints are not public APIs at the platform level, they are specific to the apps runtime.

That's why they are not documented in the platform level API docs.

pietern

Hi @ericfeunekes, thanks for the PR!

The token changes (cmd/auth/token_* and libs/auth/token_*) are not necessary. You can use the TokenSource function on the SDK configuration directly to get a fresh OAuth token. I confirmed that the following patch works: https://gist.github.com/pietern/41d02acc2907416244789c7408fb232f

Please move logstream to libs/apps to make it clearer that it is specific to apps.

pietern · 2025-11-17T10:09:23Z

cmd/workspace/apps/apps.go

 	cmd.AddCommand(newStop())
 	cmd.AddCommand(newUpdate())
 	cmd.AddCommand(newUpdatePermissions())
+	cmd.AddCommand(newLogsCommand())


You can move this into overrides.go in the same directory.

See cmdOverrides.

pietern · 2025-11-17T10:27:40Z

Btw, when I stop an app during tail, the logs command doesn't stop or error.

pietern · 2025-11-17T15:20:17Z

@ericfeunekes I forgot an important detail in the previous message.

Contributing to CLI requires a signed CLA, if that's something you're willing to do, please reach out with a request to sign CLA to [email protected] and we will take it from there.

Thanks!

@pietern

Replace custom token acquisition logic with SDK's built-in TokenSource function as suggested by @pietern. This simplifies the implementation by delegating token lifecycle management to the SDK configuration. Changes: - Use cfg.GetTokenSource() instead of auth.AcquireToken() - Remove custom token_loader abstraction (libs/auth/token_loader.go) - Revert cmd/auth/token.go to original implementation - Remove tokenAcquireTimeout constant (handled by SDK) This addresses review feedback from @pietern on Nov 17, 2025. Reference: https://gist.github.com/pietern/41d02acc2907416244789c7408fb232f 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]>

@pietern

Relocate logstream from libs/logstream to libs/apps/logstream to make it clearer that this package is specific to Databricks Apps functionality. Changes: - Move libs/logstream/streamer.go to libs/apps/logstream/streamer.go - Move libs/logstream/streamer_test.go to libs/apps/logstream/streamer_test.go - Update import in cmd/workspace/apps/logs.go This addresses review feedback from @pietern on Nov 17, 2025. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]>

@pkosiec

Group individual const declarations into a single const block for better code organization and readability. Changes: - Convert six individual const declarations to const block - Apply alignment formatting This addresses review feedback from @pkosiec on Nov 14, 2025. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]>

@pkosiec

When using --tail-lines with -f (follow), the buffer was flushing too early, showing all historical logs instead of just the last N lines. The tail buffer maintains a rolling window of the last N lines, but it was flushing as soon as it reached N lines when following, rather than waiting for the prefetch window to collect all historical logs first. Fix: Always respect the flush deadline (prefetch window) regardless of follow mode. This allows historical logs to stream in and the rolling buffer to maintain only the truly last N lines before flushing. Example with --tail-lines 10 -f: - Before: Shows lines 1-10, then 11-1000+ (all logs) - After: Shows lines 991-1000, then new logs (correct) This addresses review feedback from @pkosiec on Nov 14, 2025. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]>

@pkosiec

Replace magic number (30 seconds) with defaultHandshakeTimeout constant for better code maintainability. Changes: - Add defaultHandshakeTimeout = 30 * time.Second to const block - Use constant in newLogStreamDialer instead of inline value This addresses review feedback from @pkosiec on Nov 12/14, 2025. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]>

@pietern

When following app logs (--follow) and the app stops or is deleted, the logs command now detects this and exits gracefully instead of retrying indefinitely. Implementation: - Added AppStatusChecker callback to logstream.Config - Check app status before each reconnect attempt in follow mode - Also check when connection closes normally during follow - Exit with clear error message when app is stopped/deleting/error state This addresses @pietern's comment about the command not stopping when the app is stopped during tail. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]>

github-actions · 2025-11-18T16:45:50Z

An authorized user can trigger integration tests manually by following the instructions below:

Trigger:
go/deco-tests-run/cli

Inputs:

PR number: 3908
Commit SHA: ce50048dcd5743ec1931ccc58c4666669ee24245

Checks will be approved automatically on success.

Improve apps logs streaming helpers

afcf5c7

ericfeunekes requested review from andrewnester, anton-107, denik, pietern and shreyas-goenka as code owners November 11, 2025 20:01

pkosiec reviewed Nov 12, 2025

View reviewed changes

Eric Feunekes added 21 commits November 13, 2025 15:25

Refactor AcquireToken arguments

33c6895

Move persistent auth opts test to libs

19775b8

Relocate loadToken tests to libs

7a2043c

Move logstream skill under claude directory

31db09e

Use constants for log source filters

a70d8fe

Register apps logs command in apps.go

ffe6e3d

Clarify --source flag help text

2cd2b33

Validate log source filters against allowed list

2f40c0a

Add helper tests for apps logs command

debef2f

Combine log stream dialer tests

d3b910c

Document apps logs command inline

b2ecdfb

Remove leftover logstream skill file

5e2d7d7

Extract log stream backoff constants

5183ce4

Name websocket close codes for auth refresh

03f93ba

Extract connectAndConsume helper for logstream run loop

e84c113

Defer websocket close and move context watcher

6b4b1bc

Guard websocket close with sync.Once

d884d94

Document logStreamer.Run thread-safety

837071b

Add colorized output to apps logs command

294883c

Revert "Add colorized output to apps logs command"

0992110

This reverts commit 402e72743d9a9bd6dbdc7c24f1f20d62cededf11.

Add colorized output to apps logs command

6644d36

pkosiec self-assigned this Nov 14, 2025

pkosiec reviewed Nov 14, 2025

View reviewed changes

pkosiec reviewed Nov 17, 2025

View reviewed changes

pietern reviewed Nov 17, 2025

View reviewed changes

pietern added the cla-required label Nov 17, 2025

Eric Feunekes and others added 9 commits November 18, 2025 09:43

apps: register logs via overrides instead of generated file

bb3fa8b

apps: refine logstream backoff, timers, and connection closing

33dd48f

apps: make logstream backoff timer safe for zero value

2faeea0

apps: document logstream backoff timer initialization

d79e5d9

ericfeunekes requested a review from a team as a code owner November 18, 2025 15:05

Improve apps logs streaming helpers #3908

Are you sure you want to change the base?

Improve apps logs streaming helpers #3908

Uh oh!

Conversation

ericfeunekes commented Nov 11, 2025

Changes

Why

Tests

Uh oh!

pkosiec left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ericfeunekes commented Nov 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pkosiec left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pkosiec Nov 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pietern left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pietern commented Nov 17, 2025

Uh oh!

pietern commented Nov 17, 2025

ericfeunekes commented Nov 13, 2025 •

edited

Loading

pkosiec Nov 17, 2025 •

edited

Loading