v0.22.38
Changes
- Validate Git and SSH advertisement frame lengths before allocating payload buffers. Lengths 1–3 fail without underflow; flush, empty payload and maximum-size frames retain their behavior.
- Classify incomplete required headers and payloads using the shared, downcastable
PktLineError. Fixed protocol diagnostics do not include remote frame bytes. Ordinary IO errors and idle timeouts keep their existing treatment. - Keep concrete TCP and SSH child-stdout callers on the same private reader loops; generic AsyncRead inputs let regression tests exercise those loops directly.
- Sync clone/fetch/pull EN, zh-CN, developer and website documentation, compatibility notes and the Cargo-only integration index.
Validation
- Initial Claude review found an omitted reachable Git object-fetch code/hint change. R2 documents that behavior, adds transport regression assertions inside the original ten named gates, and passes independent Claude and Codex reviews with no remaining P0/P1; the initial FAIL is retained.
- All ten required new gates compiled uniquely. Related protocol modules passed 38/38, preserving all 28 prior cases. The cases inspect actual typed reader errors and public CliError classification, including both clients' partial-header/payload EOF, ConnectionReset and real duplex idle timeouts. Three existing gates also perform42 real localhost TCP object-fetch advertisement calls and verify the public fetch/clone/pull code and hint conversions.
- 15/15 compatibility/document guards passed. Both focused sets have zero failures/errors/retries. Cargo check, nightly fmt, scoped Clippy with
-D warnings, semantic docs and plan structure checks passed; source hashes remained unchanged during execution. - Post-bump unfiltered default suite: 10144/10144 passed, 231 binaries, zero failures/errors/retries, run
6872ff68-c832-45ca-9f10-a78e9270acfb. The case set exactly equals v0.22.37's 10,134 cases plus ten new gates. The three original ignored cases remain unchanged. - Cargo refreshed the lockfile with only Libra's 37-to-38 version change; all six version surfaces agree. Website docs generation and typecheck passed on the final three documents, with a signed documentation commit accompanying this release.
- Multi-platform distribution, Homebrew sentinel and signed-manifest proof are verified separately for this exact tag and commit.
Scope
This release implements PKT-08 on v0.22.37. Tests cover reader loops plus real local TCP object-fetch advertisements and public error conversions; they do not execute complete commands. Git object-fetch advertisements already return LBR-NET-002 through fetch/clone/pull, including zero-byte advertisements, with the protocol hint. Outer Git/SSH discovery and SSH object-fetch/push wrappers may still return LBR-NET-001, and SSH error collection retains its existing process-wait behavior until later cards. Header ASCII-hex checks are also later work. New per-frame checks are constant work; existing total advertisement accumulation is unchanged. The complete plan and final aggregation remain in progress.