refactor(server): replace custom remote clients with macro-based implementation

- Replaced manual remote client functions with remote_client! macro for archive, blame, branch, commit, and diff services
- Simplified remote client creation logic using declarative macro approach
- Maintained same functionality while reducing code duplication across services

security(bare): enhance path traversal protection with comprehensive validation

- Added early relative_path validation to prevent path traversal attacks
- Implemented unified path validation to avoid TOCTOU race conditions
- Enhanced canonicalization checks for both existing and non-existent paths
- Added detailed logging for path traversal detection attempts

feat(cache): migrate from CLruCache to Moka with TTL and invalidation support

- Replaced clru dependency with moka for improved caching capabilities
- Added 300-second time-to-live for cache entries
- Implemented repository-specific cache invalidation mechanism
- Enhanced cache operations with thread-safe async support

refactor(commit): improve security validation for commit operations

- Added ref name validation to prevent command injection in cherry_pick_commit
- Implemented revision validation for commit selectors
- Added comprehensive input validation for create_commit parameters
- Enhanced file path validation to prevent traversal

commit/cherry_pick_commit.rs

@@ -9,9 +9,13 @@ impl GitBare {
         request: CherryPickCommitRequest,
     ) -> GitResult<CreateCommitResponse> {
         let target_branch = request.branch.clone();
+        crate::sanitize::validate_ref_name(&target_branch)?;
         let cp_revision = match request.commit.and_then(|s| s.selector) {
             Some(crate::pb::object_selector::Selector::Oid(oid)) => oid.hex,
-            Some(crate::pb::object_selector::Selector::Revision(name)) => name.revision,
+            Some(crate::pb::object_selector::Selector::Revision(name)) => {
+                crate::sanitize::validate_revision(&name.revision)?;
+                name.revision
+            }
             None => return Err(GitError::InvalidArgument("commit is required".into())),
         };
 

commit/compare_commits.rs

@@ -2,7 +2,8 @@ use crate::bare::GitBare;
 use crate::commit::list_commits::read_commit_from_repo;
 use crate::diff::get_diff_stats::diff_stats_for_range;
 use crate::error::{GitError, GitResult};
-use crate::pb::{CommitStats, CompareCommitsRequest, CompareCommitsResponse, object_selector};
+use crate::pb::{CommitStats, CompareCommitsRequest, CompareCommitsResponse};
+use crate::resolve_revision;
 
 impl GitBare {
     pub fn compare_commits(
@@ -10,16 +11,8 @@ impl GitBare {
         request: CompareCommitsRequest,
     ) -> GitResult<CompareCommitsResponse> {
         let repo = self.gix_repo()?;
-        let base = match request.base.clone().and_then(|s| s.selector) {
-            Some(object_selector::Selector::Oid(oid)) => oid.hex,
-            Some(object_selector::Selector::Revision(name)) => name.revision,
-            None => "HEAD".into(),
-        };
-        let head = match request.head.clone().and_then(|s| s.selector) {
-            Some(object_selector::Selector::Oid(oid)) => oid.hex,
-            Some(object_selector::Selector::Revision(name)) => name.revision,
-            None => "HEAD".into(),
-        };
+        let base = resolve_revision!(request.base.clone());
+        let head = resolve_revision!(request.head.clone());
 
         let base_id = repo.rev_parse_single(base.as_str())?;
         let head_id = repo.rev_parse_single(head.as_str())?;

commit/create_commit.rs

@@ -8,6 +8,19 @@ use crate::pb::{
 
 impl GitBare {
     pub fn create_commit(&self, request: CreateCommitRequest) -> GitResult<CreateCommitResponse> {
+        // Validate branch name to prevent command injection
+        crate::sanitize::validate_ref_name(&request.branch)?;
+        // Validate start_revision if provided
+        if let Some(rev) = request.start_revision.as_ref() {
+            match rev.selector.as_ref() {
+                Some(object_selector::Selector::Revision(name)) => {
+                    crate::sanitize::validate_revision(&name.revision)?;
+                }
+                Some(object_selector::Selector::Oid(_)) => {} // OID is always safe
+                None => {} // will use branch name, already validated
+            }
+        }
+
         let repo = self.gix_repo()?;
         let branch = request.branch.clone();
         tracing::debug!(
@@ -21,15 +34,15 @@ impl GitBare {
             Some(object_selector::Selector::Revision(name)) => name.revision,
             None => request.branch.clone(),
         };
-        let parent_id = repo
-            .rev_parse_single(start_rev.as_str())
-            .ok()
-            .map(|id| id.to_string());
-        let current_branch_tip = repo
-            .find_reference(format!("refs/heads/{}", request.branch).as_str())
-            .ok()
-            .and_then(|mut r| r.peel_to_id().ok())
-            .map(|id| id.to_string());
+        let parent_id = match repo.rev_parse_single(start_rev.as_str()) {
+            Ok(id) => Some(id.to_string()),
+            Err(_) => None, // branch/revision does not exist yet — will create initial commit
+        };
+        let current_branch_tip =
+            match repo.find_reference(format!("refs/heads/{}", request.branch).as_str()) {
+                Ok(mut r) => r.peel_to_id().ok().map(|id| id.to_string()),
+                Err(_) => None, // branch does not exist yet
+            };
 
         let tree_id = if request.actions.is_empty() {
             let Some(parent) = parent_id.as_ref() else {
@@ -91,9 +104,11 @@ impl GitBare {
         parent_id: Option<&str>,
         actions: &[crate::pb::CreateCommitAction],
     ) -> GitResult<String> {
+        // Use system temp directory instead of bare_dir to avoid clutter
+        // and ensure proper cleanup even if process crashes
         let tmp_index = tempfile::Builder::new()
             .prefix("gitks-index-")
-            .tempfile_in(&self.bare_dir)
+            .tempfile()
             .map_err(GitError::Io)?;
         let tmp_index_path = tmp_index.path().to_string_lossy().into_owned();
 
@@ -140,6 +155,14 @@ impl GitBare {
         index_path: &str,
         action: &crate::pb::CreateCommitAction,
     ) -> GitResult<()> {
+        // Validate file paths to prevent command injection / traversal
+        if !action.file_path.is_empty() {
+            crate::sanitize::validate_file_path(&action.file_path)?;
+        }
+        if !action.previous_path.is_empty() {
+            crate::sanitize::validate_file_path(&action.previous_path)?;
+        }
+
         let action_type = create_commit_action::Action::try_from(action.action)
             .unwrap_or(create_commit_action::Action::CreateCommitActionUnspecified);
         match action_type {

commit/get_commit.rs

@@ -1,15 +1,12 @@
 use crate::bare::GitBare;
 use crate::error::{GitError, GitResult};
-use crate::pb::{Commit, GetCommitRequest, object_selector};
+use crate::pb::{Commit, GetCommitRequest};
+use crate::resolve_revision;
 
 impl GitBare {
     pub fn get_commit(&self, request: GetCommitRequest) -> GitResult<Commit> {
         let repo = self.gix_repo()?;
-        let revision = match request.revision.and_then(|s| s.selector) {
-            Some(object_selector::Selector::Oid(oid)) => oid.hex,
-            Some(object_selector::Selector::Revision(name)) => name.revision,
-            None => "HEAD".into(),
-        };
+        let revision = resolve_revision!(request.revision);
         let id = repo.rev_parse_single(revision.as_str())?;
         let commit = id
             .object()?

commit/list_commits.rs

@@ -1,14 +1,11 @@
 use crate::bare::GitBare;
 use crate::error::{GitError, GitResult};
-use crate::pb::{Commit, ListCommitsRequest, ListCommitsResponse, object_selector};
+use crate::pb::{Commit, ListCommitsRequest, ListCommitsResponse};
+use crate::resolve_revision;
 
 impl GitBare {
     pub fn list_commits(&self, request: ListCommitsRequest) -> GitResult<ListCommitsResponse> {
-        let revision = match request.revision.clone().and_then(|s| s.selector) {
-            Some(object_selector::Selector::Oid(oid)) => oid.hex,
-            Some(object_selector::Selector::Revision(name)) => name.revision,
-            None => "HEAD".into(),
-        };
+        let revision = resolve_revision!(request.revision.clone());
 
         let base_args = build_rev_list_args(self, &request, &revision);
 

commit/revert_commit.rs

@@ -6,9 +6,13 @@ use crate::pb::{CreateCommitResponse, GetCommitRequest, RevertCommitRequest};
 impl GitBare {
     pub fn revert_commit(&self, request: RevertCommitRequest) -> GitResult<CreateCommitResponse> {
         let target_branch = request.branch.clone();
+        crate::sanitize::validate_ref_name(&target_branch)?;
         let revert_revision = match request.commit.and_then(|s| s.selector) {
             Some(crate::pb::object_selector::Selector::Oid(oid)) => oid.hex,
-            Some(crate::pb::object_selector::Selector::Revision(name)) => name.revision,
+            Some(crate::pb::object_selector::Selector::Revision(name)) => {
+                crate::sanitize::validate_revision(&name.revision)?;
+                name.revision
+            }
             None => return Err(GitError::InvalidArgument("commit is required".into())),
         };