feat: add checksum-aware incremental sync

tests/integration/test_features.py

@@ -193,6 +193,26 @@ class TestIncremental:
             content = f.read()
         assert b"modified content" in content, f"Modified content not transferred: {content[:50]}"
 
+    def test_checksum_detects_same_size_and_mtime_change(self, shared_server):
+        clean_dir(DEST_DIR)
+        result, _ = run_client(SOURCE_DIR, DEST_DIR, flags=["-M"], port=shared_server.port)
+        assert result.returncode == 0
+
+        received = get_dest_received_dir(DEST_DIR, SOURCE_DIR)
+        source_file = os.path.join(SOURCE_DIR, "small.txt")
+        received_file = os.path.join(received, "small.txt")
+        source_stat = os.stat(source_file)
+        with open(received_file, "wb") as f:
+            f.write(b"different!\n")
+        os.utime(received_file, (source_stat.st_atime, source_stat.st_mtime))
+
+        result, _ = run_client(SOURCE_DIR, DEST_DIR,
+                               flags=["-M", "--incremental", "--checksum"],
+                               port=shared_server.port)
+        assert result.returncode == 0, f"Checksum sync failed: {result.stderr[:200]}"
+        with open(received_file, "rb") as f:
+            assert f.read() == b"hello world\n"
+
 
 class TestDelete:
     def test_delete_removes_extra_files(self, shared_server):

tests/test_delta.c

@@ -35,6 +35,10 @@ static void test_xxhash32_different_data() {
   EXPECT_TRUE(ha != hb);
 }
 
+static void test_xxhash64_different_data() {
+  EXPECT_TRUE(delta_xxhash64("AAAA", 4) != delta_xxhash64("BBBB", 4));
+}
+
 static void test_signature_roundtrip() {
   char old_data[4096];
   for (int i = 0; i < 4096; i++)
@@ -328,6 +332,7 @@ void test_delta() {
   test_adler32_different_data();
   test_xxhash32_basic();
   test_xxhash32_different_data();
+  test_xxhash64_different_data();
   test_signature_roundtrip();
   test_delta_identical_files();
   test_delta_small_edit();

tests/test_metadata.c

@@ -109,6 +109,19 @@ static void test_metadata_send_null() {
   close(p[1]);
 }
 
+static void test_metadata_rejects_invalid_values() {
+  int p[2];
+  EXPECT_EQ_INT(pipe(p), 0);
+  io_set_fds(p[0], p[1]);
+  int32_t present = 2;
+  EXPECT_TRUE(send_n_data(p[1], &present, sizeof(present)));
+  int ok = 1;
+  EXPECT_NULL(metadata_receive(p[0], &ok));
+  EXPECT_EQ_INT(ok, 0);
+  close(p[0]);
+  close(p[1]);
+}
+
 static void test_file_restore_metadata() {
   const char* path = "temp_meta_restore_test.txt";
   const char* content = "test content";
@@ -137,5 +150,6 @@ void test_metadata() {
   test_metadata_from_buf_null();
   test_metadata_send_receive_roundtrip();
   test_metadata_send_null();
+  test_metadata_rejects_invalid_values();
   test_file_restore_metadata();
 }

tests/test_server.c

@@ -171,10 +171,26 @@ static void test_receive_files_abort() {
   }
 }
 
+static void test_receive_manifest_rejects_traversal() {
+  Config* cfg = config_create();
+  EXPECT_NOT_NULL(cfg);
+  cfg->receive_root_directory = str_dup("/tmp/dst");
+  int p[2];
+  EXPECT_EQ_INT(socketpair(AF_UNIX, SOCK_STREAM, 0, p), 0);
+  io_set_fds(p[0], p[1]);
+  EXPECT_TRUE(send_int(p[1], 1));
+  EXPECT_TRUE(send_str(p[1], "../outside"));
+  EXPECT_EQ_INT(receive_manifest(p[0], cfg, NULL), -1);
+  close(p[0]);
+  close(p[1]);
+  config_delete(cfg);
+}
+
 void test_server() {
   if (!is_running_under_valgrind()) {
     test_receive_files_finished();
     test_receive_files_single_file();
     test_receive_files_abort();
+    test_receive_manifest_rejects_traversal();
   }
 }