GitoxideLabs/gitoxide gitoxide-core-v0.63.0

gitoxide-core v0.63.0

on GitHub

New Features

• make trace output independently configurable

  Quick review only, as it's mostly about tracing and gix which both aren't super
  important, and are seemingly working well. An extra agent-review couldn't
  find anything either.

  Replace the old boolean trace switch with a bounded -t/--trace counter:
  forest INFO and DEBUG at one or two occurrences, then flat DEBUG and TRACE at
  three or four. Keep --threads long-only and route tracing independently of
  verbose and progress rendering, including commands with bespoke execution paths
  and corpus runs.

  Initialize display tracing once before repository discovery, buffer it outside
  prodash, and emit it after command and progress teardown. Format forest and
  flat output with ANSI, then adapt the final stderr write so terminals get color
  while pipes and NO_COLOR remain plain.

  Corpus worker subscribers share that sink while retaining their complete
  JSON trace storage, and flat modes include completed spans. gix tix remains
  delegated to Tix so it installs only one subscriber.

Bug Fixes

• confine organized repositories to their destination

  ein tool organize --execute used a repository's origin URL to construct a
  move destination without resolving parent components or checking containment.
  It was demonstrated percent-decoded path traversal moving a repository
  outside the user-selected root.

  Resolve the completed destination with the existing gix::path::realpath()
  helper, which handles existing symlinks and missing leaf components, then reject
  paths outside the canonical destination before creating directories or moving
  anything. The subsequent self-nesting check now also receives a resolved path.

  Disposable isolated repositories reproduce HTTP percent-encoded traversal, a
  parent-directory hostname, SSH traversal, and an existing symlink escaping the
  destination. A control retains the ordinary host/owner/repository layout and
  .git suffix handling. Both escape regressions fail before the fix.

  Git reference: urlmatch.c::url_normalize() at d38352cd43ab also normalizes dot
  segments; organizing repositories is gitoxide-specific and additionally needs
  filesystem confinement.
  Validation: all three focused organizer tests pass with the organize feature.

• support SHA-256 in query path tracing

  ein tool query . trace-path file failed on SHA-256 repositories because
  path history rows were decoded as [u8; 20], although SQLite stores the
  full 32-byte commit IDs.

  Decode the blob into Vec<u8> and use ObjectId::try_from() to select the
  hash kind from its length while rejecting unsupported lengths. Add an
  isolated journey test for SHA-1 and SHA-256 that checks the traced path,
  diff statistics, and full commit ID against Git.

Commit Statistics

• 15 commits contributed to the release over the course of 13 calendar days.
• 13 days passed between releases.
• 3 commits were understood as conventional.
• 0 issues like '(#ID)' were seen in commit messages

Commit Details