v0.9.1 - A Review Release: `gc` and `push` Can No Longer Lose a Ref Silently, Tokens Stay Where They Belong, and Nested Repositories Are Captured

What's Changed in v0.9.1

Three independent reviews (Opus, GLM-5.3, Gemini) went over the Git remote helper. Every finding that
reproduced is fixed here, each with a test that fails without the fix. The snapshot tool changes below
were not part of those reviews. The full suite is 987 tests; the helper changes were also run on Linux
(Debian under WSL) and against a real Seafile server (CE 13.0.28) in a scratch library.

The two that could lose data

• gc deleted the commits of a branch it did not see. The compactor mirrored each remote ref as a
  loose file in a scratch repository, so refs whose names collide on the local filesystem (Feature and
  feature on Windows and macOS, NUL, a trailing dot) became one file; the branch that lost had its
  objects pruned and its old packs deleted, and gc exited 0. A ref whose read came back 404 was dropped
  the same way. The mirror is now one packed-refs file, git must read back exactly the refs written,
  and an unreadable ref stops gc with nothing deleted.
• A push could write a ref that names objects the remote does not have. The pack left out what the
  refs read before the lock reached; a branch deleted (and gc run) in that window took its commits
  away while main was written pointing at them. The refs are read again under the lock, the pack
  directory is listed after the upload and checked at size, and the lease is verified before every ref.

Credentials

• A returned transfer link could choose who received the Seafile token (http://other\@api-host/:
  the origin check and the connection parsed it differently). It is compared with the connection's parser,
  and an ambiguous authority is refused.
• Transfer tokens no longer appear in connection-error text, and a URL password is masked in the four
  messages that printed it.

The smaller ones

• A remote named gc, test or unlock ran that subcommand (git fetch gc ran a compaction).
• A remote pack named as the uppercase twin of a local one overwrote it on Windows; a backslash in a
  seafile:// path bypassed the working-tree collision guard.
• Windows scratch directories (grs-push-*) were never removed and were counted as removed.
• A landed push could be reported remote rejected; a lock that could not be renewed warned on every
  16 KiB block; the conflict-copy warning missed refs with a dot; --dry-run said ok to deleting a
  ref that is not there; ref, HEAD and lock files were read with no size bound.

Snapshot tool

• Nested git repositories are captured as their files (ignored files too, --exclude and payload
  mode apply); their .git is not. --no-embedded-repos keeps the old commit-id-only record.
• The payload hash cache's racy rule uses the share's own clock on a network filesystem (a probe file
  measures it; a local tree is never written to). A same-size edit within one timestamp granule on a share
  whose clock ran behind used to keep its stale hash.
• Long Windows paths: core.longpaths on the vault and on a restored clone, extended-length paths for
  restored payload files.
• A report-only --payload-gc summary after a run that pushes, at most every --payload-report-days
  (default 7, 0 off). It never deletes.
• Manifest growth at 100,000 files is measured: about 10 kB per snapshot at 0.1% changed, 110 kB at 1%.

Upgrading from 0.9.0

• gc is stricter: it stops, deleting nothing, when a ref or a refs directory cannot be read. Re-run it.
• A push makes two more requests (refs under the lock, a pack directory listing).
• A vault whose source holds a nested git repository gets its files on the next snapshot; add
  --no-embedded-repos to keep the old record.
• Pack names must be lowercase and a seafile:// path may not contain a backslash.
• Set the library's history to a few days (USER_GUIDE 8.0.1).
• No file format changed; 0.9.0 vaults and remotes are read as before.

Known gaps

• --force-with-lease is not supported (documented; it was rejected as non-fast-forward without a reason).
• macOS network mounts are not detected by the clock probe; --payload-rehash is the audit.
• The nested repository's history, and git-tracked files' timestamps, are not restored.

The full list, with measurements, is in CHANGELOG.md.

---

Full Changelog: v0.9.0...v0.9.1