v1.0.7

Highlights

• Dumps are now staged privately on the server and verified before import: the remote stages the dump in a dedicated ddev-dumps folder (mode 700, dump file mode 600) inside the alias's tmp, and on success writes a completion marker carrying the byte size. The host downloads the marker with the dump and checks the size before importing — a partial dump from a failed run is removed on the server and can never be imported as if it were whole.
• Sanitize can no longer fail quietly: if sanitize is on (the default) but nothing could be applied for the detected platform, the run ends with a prominent error and a non-zero exit after the import, instead of a success banner over live production data.

Fixed

• Default dump dir: ~/sql-sync — the built-in default and the shipped example's dir: — resolved to a literal ~/ folder inside the home directory. ~ and ~/ prefixes now expand properly.
• Alias parsing strips YAML inline comments from unquoted values on every key, including the database: block, so copying the README's example block no longer produces garbage ssh targets; quoted values keep their #.
• WordPress sanitize uses the site's actual table prefix — read from wp-config.php and passed through by the remote, or detected from the imported tables on --no-dump runs — instead of assuming wp_.
• WP-CLI is also probed in ~/bin, ~/.local/bin and /usr/local/bin before falling back to mysqldump, so an install outside the ssh session's minimal PATH is no longer missed.
• A gzipped dump (for example from a custom dump: command) is detected by its magic bytes and imported as .sql.gz. The remote copy is deleted only after a successful import; a failed import leaves it in place and prints where, with the --no-dump retry.
• A failed dump step stops the run immediately with a clear message, instead of the error scrolling past inside later rsync output.
• Duplicate alias definitions are a hard error naming the alias, instead of silently using the first one.
• The disk-space check is no longer silently absent: when the database size cannot be estimated — including the dump: strategy, which now estimates whenever credentials resolve from the alias or the platform — a normal run says the check was skipped.
• .env parsing accepts export -prefixed lines and strips inline comments from unquoted values; quoted values are untouched.
• The installed aliases.yml no longer describes itself as the example file.
• README: the "Testing safely" ladder describes --no-sync truthfully (the dump is created on the server; nothing is downloaded until a later --no-dump run), the Drupal sanitize precedence is documented as shipped (an alias sanitize: file wins over drush sql-sanitize), the dry-run section notes the one transient temp file in the Drupal credential path, and the quoted strategy messages match the real output.