refactor(server): replace custom remote clients with macro-based implementation

- Replaced manual remote client functions with remote_client! macro for archive, blame, branch, commit, and diff services
- Simplified remote client creation logic using declarative macro approach
- Maintained same functionality while reducing code duplication across services

security(bare): enhance path traversal protection with comprehensive validation

- Added early relative_path validation to prevent path traversal attacks
- Implemented unified path validation to avoid TOCTOU race conditions
- Enhanced canonicalization checks for both existing and non-existent paths
- Added detailed logging for path traversal detection attempts

feat(cache): migrate from CLruCache to Moka with TTL and invalidation support

- Replaced clru dependency with moka for improved caching capabilities
- Added 300-second time-to-live for cache entries
- Implemented repository-specific cache invalidation mechanism
- Enhanced cache operations with thread-safe async support

refactor(commit): improve security validation for commit operations

- Added ref name validation to prevent command injection in cherry_pick_commit
- Implemented revision validation for commit selectors
- Added comprehensive input validation for create_commit parameters
- Enhanced file path validation to prevent traversal

merge/check_merge.rs

@@ -1,19 +1,12 @@
 use crate::bare::GitBare;
 use crate::error::GitResult;
 use crate::pb::{CheckMergeRequest, MergeResult, merge_result};
+use crate::resolve_revision;
 
 impl GitBare {
     pub fn check_merge(&self, request: CheckMergeRequest) -> GitResult<MergeResult> {
-        let target = match request.target.and_then(|s| s.selector) {
-            Some(crate::pb::object_selector::Selector::Oid(oid)) => oid.hex,
-            Some(crate::pb::object_selector::Selector::Revision(name)) => name.revision,
-            None => "HEAD".into(),
-        };
-        let source = match request.source.and_then(|s| s.selector) {
-            Some(crate::pb::object_selector::Selector::Oid(oid)) => oid.hex,
-            Some(crate::pb::object_selector::Selector::Revision(name)) => name.revision,
-            None => "HEAD".into(),
-        };
+        let target = resolve_revision!(request.target);
+        let source = resolve_revision!(request.source);
 
         let repo = self.gix_repo()?;
         let target_id = repo.rev_parse_single(target.as_str())?;

merge/do_merge.rs

@@ -5,9 +5,13 @@ use crate::pb::{MergeRequest, MergeResult, merge_result};
 impl GitBare {
     pub fn merge(&self, request: MergeRequest) -> GitResult<MergeResult> {
         let target_branch = request.target_branch.clone();
+        crate::sanitize::validate_ref_name(&target_branch)?;
         let source_revision = match request.source.and_then(|s| s.selector) {
             Some(crate::pb::object_selector::Selector::Oid(oid)) => oid.hex.clone(),
-            Some(crate::pb::object_selector::Selector::Revision(name)) => name.revision.clone(),
+            Some(crate::pb::object_selector::Selector::Revision(name)) => {
+                crate::sanitize::validate_revision(&name.revision)?;
+                name.revision.clone()
+            }
             None => return Err(GitError::InvalidArgument("source is required".into())),
         };
         tracing::info!(

merge/list_merge_conflicts.rs

@@ -10,12 +10,18 @@ impl GitBare {
     ) -> GitResult<ListMergeConflictsResponse> {
         let target = match request.target.and_then(|s| s.selector) {
             Some(crate::pb::object_selector::Selector::Oid(oid)) => oid.hex,
-            Some(crate::pb::object_selector::Selector::Revision(name)) => name.revision,
+            Some(crate::pb::object_selector::Selector::Revision(name)) => {
+                crate::sanitize::validate_revision(&name.revision)?;
+                name.revision
+            }
             None => return Err(GitError::InvalidArgument("target is required".into())),
         };
         let source = match request.source.and_then(|s| s.selector) {
             Some(crate::pb::object_selector::Selector::Oid(oid)) => oid.hex,
-            Some(crate::pb::object_selector::Selector::Revision(name)) => name.revision,
+            Some(crate::pb::object_selector::Selector::Revision(name)) => {
+                crate::sanitize::validate_revision(&name.revision)?;
+                name.revision
+            }
             None => return Err(GitError::InvalidArgument("source is required".into())),
         };
 

merge/rebase.rs

@@ -6,9 +6,13 @@ use crate::pb::{RebaseRequest, RebaseResult, rebase_result};
 impl GitBare {
     pub fn rebase(&self, request: RebaseRequest) -> GitResult<RebaseResult> {
         let branch = request.branch.clone();
+        crate::sanitize::validate_ref_name(&branch)?;
         let upstream_revision = match request.upstream.and_then(|s| s.selector) {
             Some(crate::pb::object_selector::Selector::Oid(oid)) => oid.hex,
-            Some(crate::pb::object_selector::Selector::Revision(name)) => name.revision,
+            Some(crate::pb::object_selector::Selector::Revision(name)) => {
+                crate::sanitize::validate_revision(&name.revision)?;
+                name.revision
+            }
             None => return Err(GitError::InvalidArgument("upstream is required".into())),
         };
 

merge/resolve_merge_conflicts.rs

@@ -9,9 +9,13 @@ impl GitBare {
         request: ResolveMergeConflictsRequest,
     ) -> GitResult<MergeResult> {
         let target_branch = request.target_branch.clone();
+        crate::sanitize::validate_ref_name(&target_branch)?;
         let source_revision = match request.source.and_then(|s| s.selector) {
             Some(crate::pb::object_selector::Selector::Oid(oid)) => oid.hex,
-            Some(crate::pb::object_selector::Selector::Revision(name)) => name.revision,
+            Some(crate::pb::object_selector::Selector::Revision(name)) => {
+                crate::sanitize::validate_revision(&name.revision)?;
+                name.revision
+            }
             None => return Err(GitError::InvalidArgument("source is required".into())),
         };