refactor(docker): optimize Docker build process and update configurations

- Replace direct Rust build with cargo-chef multi-stage build pattern
- Switch base image from debian:bookworm-slim to ubuntu:26.04
- Add .codegraph to .dockerignore and data to .gitignore
- Introduce Dockerfile.fast for faster builds without optimization
- Add comprehensive .env configuration file with cluster settings
- Create docker-compose.yaml for multi-node cluster setup
- Add cluster routing test case for distributed operations
- Remove unnecessary success status checks in repository maintenance
- Fix error handling in git command executions by properly propagating errors
- Add repository move protection to prevent self-destruct operations
- Simplify conditional logic in actor message validation
- Update remote pack client calls with proper error handling parameters

server/mod.rs

@@ -451,6 +451,7 @@ pub(crate) fn git_cmd(gb: &GitBare, args: &[&str]) -> Result<std::process::Outpu
             stderr = %stderr.trim(),
             "git subprocess exited with non-zero status"
         );
+        return Err(tonic::Status::internal(stderr.trim().to_string()));
     }
     Ok(result)
 }

server/pack.rs

@@ -155,7 +155,7 @@ impl pack_service_server::PackService for GitksService {
             Ok(gb) => gb,
             Err(err) if err.code() == tonic::Code::NotFound => {
                 if let Some(mut client) =
-                    remote_pack_client(self, first.repository.as_ref(), false).await?
+                    remote_pack_client(self, first.repository.as_ref(), true).await?
                 {
                     m.record("ok");
                     let (tx, rx) = tokio::sync::mpsc::channel(16);

server/repository.rs

@@ -207,12 +207,7 @@ impl repository_service_server::RepositoryService for GitksService {
             Err(err) => return Err(err),
         };
         let refname = format!("refs/heads/{}", inner.name);
-        let out = git_cmd(&gb, &["symbolic-ref", "HEAD", &refname])?;
-        if !out.status.success() {
-            return Err(tonic::Status::internal(
-                String::from_utf8_lossy(&out.stderr).trim().to_string(),
-            ));
-        }
+        git_cmd(&gb, &["symbolic-ref", "HEAD", &refname])?;
         tracing::info!(%repo, %name, "default branch set");
         self.notify_ref_update(&repo, &refname, "", "");
         Ok(tonic::Response::new(()))
@@ -241,11 +236,6 @@ impl repository_service_server::RepositoryService for GitksService {
         let mut entries = Vec::new();
         if inner.keys.is_empty() {
             let out = git_cmd(&gb, &["config", "--list"])?;
-            if !out.status.success() {
-                return Err(tonic::Status::internal(
-                    String::from_utf8_lossy(&out.stderr).trim().to_string(),
-                ));
-            }
             for line in String::from_utf8_lossy(&out.stdout).lines() {
                 if let Some((k, v)) = line.split_once('=') {
                     entries.push(RepositoryConfigEntry {
@@ -259,18 +249,16 @@ impl repository_service_server::RepositoryService for GitksService {
                 crate::sanitize::validate_config_key(key)
                     .map_err(|e| tonic::Status::invalid_argument(e.to_string()))?;
                 let out = git_cmd(&gb, &["config", "--get-all", key])?;
-                if out.status.success() {
-                    let vals: Vec<String> = String::from_utf8_lossy(&out.stdout)
-                        .lines()
-                        .map(|l| l.trim().to_string())
-                        .filter(|l| !l.is_empty())
-                        .collect();
-                    if !vals.is_empty() {
-                        entries.push(RepositoryConfigEntry {
-                            key: key.clone(),
-                            values: vals,
-                        });
-                    }
+                let vals: Vec<String> = String::from_utf8_lossy(&out.stdout)
+                    .lines()
+                    .map(|l| l.trim().to_string())
+                    .filter(|l| !l.is_empty())
+                    .collect();
+                if !vals.is_empty() {
+                    entries.push(RepositoryConfigEntry {
+                        key: key.clone(),
+                        values: vals,
+                    });
                 }
             }
         }
@@ -305,12 +293,12 @@ impl repository_service_server::RepositoryService for GitksService {
             if entry.values.is_empty() {
                 git_cmd(&gb, &["config", "--unset-all", &entry.key])?;
             } else {
-                let _ = git_cmd(
+                git_cmd(
                     &gb,
                     &["config", "--replace-all", &entry.key, &entry.values[0]],
-                );
+                )?;
                 for v in entry.values.iter().skip(1) {
-                    let _ = git_cmd(&gb, &["config", "--add", &entry.key, v]);
+                    git_cmd(&gb, &["config", "--add", &entry.key, v])?;
                 }
             }
         }
@@ -627,11 +615,17 @@ impl repository_service_server::RepositoryService for GitksService {
 
         let gb = self.resolve(inner.source_repository.as_ref())?;
 
+        let target_path = self.resolve_for_init(inner.target_repository.as_ref())?;
+        // Prevent accidental self-move that would destroy the source repository.
+        if target_path == gb.bare_dir {
+            return Err(tonic::Status::invalid_argument(
+                "source and target repository paths are the same",
+            ));
+        }
+
         let bundle_data = crate::snapshot::ops::create_snapshot(&gb)
             .map_err(|e| tonic::Status::internal(e.to_string()))?;
 
-        let target_path = self.resolve_for_init(inner.target_repository.as_ref())?;
-
         let target_gb = crate::bare::GitBare::new(target_path.clone());
         target_gb
             .init_repository(true)

server/repository_maint.rs

@@ -4,7 +4,7 @@ use super::git_cmd;
 
 pub(crate) fn maintenance_response(out: std::process::Output) -> RepositoryMaintenanceResponse {
     RepositoryMaintenanceResponse {
-        ok: out.status.success(),
+        ok: true,
         stdout: String::from_utf8_lossy(&out.stdout).into_owned(),
         stderr: String::from_utf8_lossy(&out.stderr).into_owned(),
     }
@@ -112,7 +112,7 @@ pub(crate) fn check_health(
         }
     }
     Ok(RepositoryHealthResponse {
-        ok: out.status.success(),
+        ok: true,
         warnings,
         errors,
         statistics: None,