@foss.global/gitmanager 2.11.0 → 2.11.1

package/changelog.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 2026-11-15 - 2.11.1
+
+### Fixes
+
+- decide a Smart HTTP push by its whole body even when the bytes after the pack exceed Git's input pipe (receive gate)
+  - A complete pack followed by more trailing bytes than Git's stdin pipe holds now gets `413` when the body is over `maxRequestBodyBytes` and is admitted when it is within it, decided as soon as the body ends. It used to wait for the pre-receive hook's 30 s timeout and answer `200` "pre-receive hook declined"; no ref moved in either case.
+  - Trailing bytes that arrive more than 30 s after the pack still get `503` and move no ref.
+
 ## 2026-11-14 - 2.11.0
 
 ### Features

package/dist_rust/rustgitmanager_linux_amd64.tsrust-build.json

@@ -1,12 +1,12 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "bc92d2c0e56b9a43002daedda0cf8bd44aad75ce3795c2651b244a88fcada7c4",
+  "binarySha256": "c2188d359a9ddef107475f7a4df7a7a5763f63df9af03abc3fd99ae51d806d87",
   "buildInfo": {
     "projectName": "@foss.global/gitmanager",
-    "projectVersion": "2.11.0",
-    "gitCommit": "67c07c2381e43b72be7323999e218889c150c83f",
+    "projectVersion": "2.11.1",
+    "gitCommit": "9178fc8e3ad6cd064bacc2e553bc9f1a34288122",
     "gitDirty": false,
-    "builtAt": "2026-11-14T22:26:45.001Z",
+    "builtAt": "2026-11-15T00:09:51.411Z",
     "tsrustVersion": "1.3.1",
     "binary": "rustgitmanager",
     "target": "linux_amd64"

package/dist_rust/rustgitmanager_linux_arm64.tsrust-build.json

@@ -1,12 +1,12 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "fc1a730064fa24113094e6d6c155ce84dbf05ede4ee87c9f16b8283345c2b306",
+  "binarySha256": "3ed7212e93ea72e2487ec26ea9531af9e4c16bd8a740d82b9d39f51e85ac66ee",
   "buildInfo": {
     "projectName": "@foss.global/gitmanager",
-    "projectVersion": "2.11.0",
-    "gitCommit": "67c07c2381e43b72be7323999e218889c150c83f",
+    "projectVersion": "2.11.1",
+    "gitCommit": "9178fc8e3ad6cd064bacc2e553bc9f1a34288122",
     "gitDirty": false,
-    "builtAt": "2026-11-14T22:29:54.525Z",
+    "builtAt": "2026-11-15T00:11:36.993Z",
     "tsrustVersion": "1.3.1",
     "binary": "rustgitmanager",
     "target": "linux_arm64"

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@foss.global/gitmanager',
-    version: '2.11.0',
+    version: '2.11.1',
     description: 'Headless Git manager for the foss.global Git platform, with a TypeScript API and Rust engine.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx5QkFBeUI7SUFDL0IsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLCtGQUErRjtDQUM3RyxDQUFBIn0=

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foss.global/gitmanager",
-  "version": "2.11.0",
+  "version": "2.11.1",
   "private": false,
   "description": "Headless Git manager for the foss.global Git platform, with a TypeScript API and Rust engine.",
   "exports": {

package/readme.md

@@ -327,7 +327,7 @@ All numeric options must be integers.
 - `gracefulShutdownMs`: `10,000`; accepted range 100–60,000.
 - `privateRead.trustedIngressToken`: required when trusted private reads are enabled; 32–512 non-whitespace characters.
 - `receivePack.trustedIngressToken`: required when receive-pack is enabled; 32–512 non-whitespace characters.
-- `receivePack.maxRequestBodyBytes`: 4 GiB; accepted range 1 KiB–16 TiB. Request bodies are streamed and counted. A declared `Content-Length` above the limit is answered with `413` before Git starts. A streamed body that exceeds it is answered with `413` as well: the response status is decided only after the request body has reached Git completely, the Git process tree is killed at once, and the private pre-receive hook admits ref updates only after the transfer supervisor confirmed the complete body within the limit. An over-limit push therefore never updates a ref, even when Git has already read a complete pack before the excess bytes arrive. The rest of a rejected body is read for up to 1 MiB or 2 seconds so the client receives the `413`.
+- `receivePack.maxRequestBodyBytes`: 4 GiB; accepted range 1 KiB–16 TiB. Request bodies are streamed and counted. A declared `Content-Length` above the limit is answered with `413` before Git starts. A streamed body that exceeds it is answered with `413` as well: the response status is decided only after the whole request body has been read and counted (Git reads no more of it once its pre-receive hook runs, so the rest is counted without passing it to Git, however large it is), the Git process tree is killed at once, and the private pre-receive hook admits ref updates only after the transfer supervisor confirmed the complete body within the limit. An over-limit push therefore never updates a ref, even when Git has already read a complete pack before the excess bytes arrive. The rest of a rejected body is read for up to 1 MiB or 2 seconds so the client receives the `413`.
 
 While the service is running, access can be replaced atomically:
 
@@ -572,7 +572,7 @@ pnpm run test:rust
 pnpm run build
 ```
 
-`pnpm test` runs the `pretest` hook first, which builds the Rust binaries with `rsrepo`, and then runs lifecycle, bounded readiness, local mirror/read API, raw upload-pack/receive-pack preparation, clone/fetch denial, trusted receive-pack denial, explicit policy initialization, protected create/delete/non-fast-forward enforcement, inherited self-test hardening, restart replay, and real push tests through `smartrust`. `test/test.refinventory.node.ts` covers every ref namespace, peeled and nested tags, symbolic and dangling symbolic refs, unborn HEAD, prefix selection and exact lookup, ref names that are not valid UTF-8, pagination of 1,001 refs, stale and foreign cursors, 50,000 loose and packed refs, and a bundle round trip across namespaces. `test/test.pushlimits.node.ts` covers fixed-length and chunked Smart HTTP pushes over the limit, a complete pack followed by late excess bytes, an over-limit SSH-style receive-pack, an SSH-style receive-pack cut after Git already moved a ref (the update stays), and a bounded `stop()` while a service's output is never read, the rejected cases proving the refs unchanged, no Git or hook process left, no uncaught stream error, the engine serving, and a later push succeeding. `test/test.repositorybundles.node.ts` covers bundles of a repository whose only refs are notes and of one without its default branch (restored with HEAD on the unborn default branch), the refusal of a repository without refs, `bundleLimitExceeded` leaving no file, `replaceRepository()` with a bundle and without one, and a failed replacement that keeps the live repository and leaves no scratch. `test/test.protectedrefs.node.ts` covers `evaluateProtectedRefUpdates()` for every rule, unprotected refs, missing old objects and invalid requests, names the one protected ref among 1,003 updates and counts the engine's Git processes through a PATH wrapper (3 for one protected update, 66 for 64 protected updates on a 2,000-commit history with 500 tags), pins the pre-receive hook's decline messages over Smart HTTP, shows that the hook refuses an update and a deletion naming a missing old object even where the rule allows force pushes and deletions, and renames a default branch in one atomic Smart HTTP push after `setDefaultBranch()` with `allowUnborn` (refused while HEAD names the deleted branch, HEAD left unborn by a declined push and recovered without the flag, a missing branch still refused without it). `test/test.ancestry.node.ts` covers ancestors, the reverse direction, siblings, merges, unrelated histories, the same commit, invalid, missing and non-commit objects, a budget exceeded on a 20,000-commit history next to the exact answer, and a stalled walk whose Git process is killed. `test/test.remotetransfer.node.ts` serves fixtures through `git http-backend` over HTTPS with a private CA and over plain HTTP on `127.0.0.1` and `[::1]`, and covers credentialed mirror imports and refreshes, the source default branch on import and refresh, `setDefaultBranch()`, the push URL policy, atomic creates, updates and deletes, stale leases that change no ref, a remote without the `atomic` capability, 5,000 creates and 5,000 deletes in one receive-pack request with no command line naming a ref, a stale lease on the last of 1,500 updates that changes no ref, a pre-receive hook that declines a push and an update hook that declines one ref (the others failing as collateral), with their `remoteMessages`, the `reason` of every ref that is not `ok`, and the credential staying out of every command line, error and file. Its fixture can hold or refuse a receive-pack request, which covers a ref that moves between the listing and the push (the remote fails all 1,500 updates) and a `413` answer (`remoteLimitExceeded`, no ref changed). It can also withhold pack requests to stall a transfer midway, which covers aborting an import (no repository or scratch left), a refresh (refs and HEAD unchanged) and a push, a push aborted before it sends its updates that changes nothing, other commands and transfers completing while transfers stall, `repositoryBusy` (including `replaceRepository()`) and the Smart HTTP `503` while a mirror refreshes, an atomic refresh that prunes nothing when one ref update fails, a refresh that times out inside its ref transaction without leaving lock files, a refresh refused during a Smart HTTP push, the receive-pack guard ticket (refused while held, admitted after release, idempotent release, released by `stop()`, released when its preparation times out on the bridge after the engine issued it), a bounded `stop()` during a stalled transfer, and a credentialed loopback `http` push that never reaches the `http_proxy`, `all_proxy` and `ALL_PROXY` set in the engine's environment. `test/test.sshpush.node.ts` needs `/usr/sbin/sshd`, `ssh`, `ssh-keygen` and `git-shell`: it starts an unprivileged `sshd` on `127.0.0.1` whose authorized keys run `git-shell`, and records every `ssh` and `git` command line through PATH wrappers. It pins the OpenSSH client texts the engine classifies against the system `ssh`, and covers an accepted push with the key only as a `0600` file in a `0700` directory that is gone afterwards, leased updates and deletes, a stale lease and an up-to-date ref decided without `send-pack`, a PEM RSA key, a declining hook (`hook-declined` with the nonce in `remoteMessages`), the bounds, truncation marker and redaction of `remoteMessages`, `sshHostKeyMismatch` before the key is offered, an unoffered host key type, `sshAuthenticationFailed`, `remoteConnectionRefused`, `remoteProtocolError` for a missing repository, `atomicPushUnsupported`, the refusals of URLs, users, hosts, paths, keys and transport mismatches before `ssh` runs, an abort while `ssh` runs (directory removed), the startup sweep of a stale key directory, and no key text in any command line, error or engine log. `test/test.archiveinspection.node.ts` runs every ci-spec archive conformance vector through `inspectArchive()` as bytes and as a chunked stream, the compressed limit at its boundary, an 8 MiB streamed archive, an early refusal that closes the source, and abort, source failure and `stop()` during an inspection.
+`pnpm test` runs the `pretest` hook first, which builds the Rust binaries with `rsrepo`, and then runs lifecycle, bounded readiness, local mirror/read API, raw upload-pack/receive-pack preparation, clone/fetch denial, trusted receive-pack denial, explicit policy initialization, protected create/delete/non-fast-forward enforcement, inherited self-test hardening, restart replay, and real push tests through `smartrust`. `test/test.refinventory.node.ts` covers every ref namespace, peeled and nested tags, symbolic and dangling symbolic refs, unborn HEAD, prefix selection and exact lookup, ref names that are not valid UTF-8, pagination of 1,001 refs, stale and foreign cursors, 50,000 loose and packed refs, and a bundle round trip across namespaces. `test/test.pushlimits.node.ts` covers fixed-length and chunked Smart HTTP pushes over the limit, a complete pack followed by late excess bytes, a complete pack followed by more bytes than Git's input pipe holds (`413` over the limit, admitted within it, both decided as soon as the body ends), an over-limit SSH-style receive-pack, an SSH-style receive-pack cut after Git already moved a ref (the update stays), and a bounded `stop()` while a service's output is never read, the rejected cases proving the refs unchanged, no Git or hook process left, no uncaught stream error, the engine serving, and a later push succeeding. `test/test.repositorybundles.node.ts` covers bundles of a repository whose only refs are notes and of one without its default branch (restored with HEAD on the unborn default branch), the refusal of a repository without refs, `bundleLimitExceeded` leaving no file, `replaceRepository()` with a bundle and without one, and a failed replacement that keeps the live repository and leaves no scratch. `test/test.protectedrefs.node.ts` covers `evaluateProtectedRefUpdates()` for every rule, unprotected refs, missing old objects and invalid requests, names the one protected ref among 1,003 updates and counts the engine's Git processes through a PATH wrapper (3 for one protected update, 66 for 64 protected updates on a 2,000-commit history with 500 tags), pins the pre-receive hook's decline messages over Smart HTTP, shows that the hook refuses an update and a deletion naming a missing old object even where the rule allows force pushes and deletions, and renames a default branch in one atomic Smart HTTP push after `setDefaultBranch()` with `allowUnborn` (refused while HEAD names the deleted branch, HEAD left unborn by a declined push and recovered without the flag, a missing branch still refused without it). `test/test.ancestry.node.ts` covers ancestors, the reverse direction, siblings, merges, unrelated histories, the same commit, invalid, missing and non-commit objects, a budget exceeded on a 20,000-commit history next to the exact answer, and a stalled walk whose Git process is killed. `test/test.remotetransfer.node.ts` serves fixtures through `git http-backend` over HTTPS with a private CA and over plain HTTP on `127.0.0.1` and `[::1]`, and covers credentialed mirror imports and refreshes, the source default branch on import and refresh, `setDefaultBranch()`, the push URL policy, atomic creates, updates and deletes, stale leases that change no ref, a remote without the `atomic` capability, 5,000 creates and 5,000 deletes in one receive-pack request with no command line naming a ref, a stale lease on the last of 1,500 updates that changes no ref, a pre-receive hook that declines a push and an update hook that declines one ref (the others failing as collateral), with their `remoteMessages`, the `reason` of every ref that is not `ok`, and the credential staying out of every command line, error and file. Its fixture can hold or refuse a receive-pack request, which covers a ref that moves between the listing and the push (the remote fails all 1,500 updates) and a `413` answer (`remoteLimitExceeded`, no ref changed). It can also withhold pack requests to stall a transfer midway, which covers aborting an import (no repository or scratch left), a refresh (refs and HEAD unchanged) and a push, a push aborted before it sends its updates that changes nothing, other commands and transfers completing while transfers stall, `repositoryBusy` (including `replaceRepository()`) and the Smart HTTP `503` while a mirror refreshes, an atomic refresh that prunes nothing when one ref update fails, a refresh that times out inside its ref transaction without leaving lock files, a refresh refused during a Smart HTTP push, the receive-pack guard ticket (refused while held, admitted after release, idempotent release, released by `stop()`, released when its preparation times out on the bridge after the engine issued it), a bounded `stop()` during a stalled transfer, and a credentialed loopback `http` push that never reaches the `http_proxy`, `all_proxy` and `ALL_PROXY` set in the engine's environment. `test/test.sshpush.node.ts` needs `/usr/sbin/sshd`, `ssh`, `ssh-keygen` and `git-shell`: it starts an unprivileged `sshd` on `127.0.0.1` whose authorized keys run `git-shell`, and records every `ssh` and `git` command line through PATH wrappers. It pins the OpenSSH client texts the engine classifies against the system `ssh`, and covers an accepted push with the key only as a `0600` file in a `0700` directory that is gone afterwards, leased updates and deletes, a stale lease and an up-to-date ref decided without `send-pack`, a PEM RSA key, a declining hook (`hook-declined` with the nonce in `remoteMessages`), the bounds, truncation marker and redaction of `remoteMessages`, `sshHostKeyMismatch` before the key is offered, an unoffered host key type, `sshAuthenticationFailed`, `remoteConnectionRefused`, `remoteProtocolError` for a missing repository, `atomicPushUnsupported`, the refusals of URLs, users, hosts, paths, keys and transport mismatches before `ssh` runs, an abort while `ssh` runs (directory removed), the startup sweep of a stale key directory, and no key text in any command line, error or engine log. `test/test.archiveinspection.node.ts` runs every ci-spec archive conformance vector through `inspectArchive()` as bytes and as a chunked stream, the compressed limit at its boundary, an 8 MiB streamed archive, an early refusal that closes the source, and abort, source failure and `stop()` during an inspection.
 
 ## License and Legal Information
 

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@foss.global/gitmanager',
-  version: '2.11.0',
+  version: '2.11.1',
   description: 'Headless Git manager for the foss.global Git platform, with a TypeScript API and Rust engine.'
 }