Merge feat/p2-files-from-filter: files-from/from0/filter/-F/-C

Client-side file-list selection and filter-rule layer (client-only; no wire
change). rsync-consistent inner-first per-dir filter precedence; listed-but-
missing files-from entries hard-error; root '/' scan regression fixed;
Summary recounted (63 implemented / 75 not).
c-review REQUEST CHANGES -> blockers fixed; PR #265.

src/shared/config.c

@@ -2,6 +2,7 @@
 #include "chmod.h"
 #include "delay_updates.h"
 #include "delta.h"
+#include "file_list.h"
 #include "log.h"
 #include "protocol.h"
 #include "utils.h"
@@ -94,7 +95,10 @@ static void config_set_defaults(Config* config) {
   config->max_delete = 0;
   config->filters = NULL;
   config->files_from = NULL;
+  config->files_from_set = NULL;
+  config->from0 = false;
   config->cvs_exclude = false;
+  config->per_dir_filter = false;
   config->prune_empty_dirs = false;
   config->one_file_system = false;
   config->relative = false;
@@ -232,6 +236,7 @@ void config_delete(Config* config) {
   free(config->out_format);
   free(config->log_file_format);
   free(config->files_from);
+  file_list_destroy((FileListSet*)config->files_from_set);
   free(config->rsh_command);
   free(config->rsync_path);
   free(config->temp_dir);

src/shared/config.h

@@ -105,10 +105,14 @@ typedef struct Config {
   bool delete_after;
   int max_delete;
 
-  // Issue #129: Advanced file selection
-  ArrayList* filters;
-  char* files_from;
-  bool cvs_exclude;
+  // Issue #129: Advanced file selection. These fields are CLIENT-ONLY: they are
+  // never serialized to the wire (the receiver must not learn them).
+  ArrayList* filters;   /* --filter=RULE rule strings, in order */
+  char* files_from;     /* --files-from path (may be NULL) */
+  void* files_from_set; /* parsed FileListSet* allow-set, or NULL */
+  bool from0;           /* -0/--from0: NUL-delimited *-from files */
+  bool cvs_exclude;     /* -C/--cvs-exclude: standard CVS ignore set */
+  bool per_dir_filter;  /* -F: apply per-directory .rsync-filter files */
   bool prune_empty_dirs;
   bool one_file_system; /* -x/--one-file-system: do not cross filesystem boundaries */
   bool relative;

src/shared/file_list.c

@@ -0,0 +1,191 @@
+#include "file_list.h"
+#include "log.h"
+#include "utils.h"
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+typedef struct {
+  char** items;
+  int count;
+  int capacity;
+} StringList;
+
+static void string_list_destroy(StringList* list) {
+  if (!list)
+    return;
+  for (int i = 0; i < list->count; i++)
+    free(list->items[i]);
+  free(list->items);
+}
+
+static bool string_list_add(StringList* list, const char* text) {
+  if (list->count == list->capacity) {
+    int new_cap = list->capacity > 0 ? list->capacity * 2 : 16;
+    char** grown = realloc(list->items, (size_t)new_cap * sizeof(char*));
+    if (!grown)
+      return false;
+    list->items = grown;
+    list->capacity = new_cap;
+  }
+  list->items[list->count] = str_dup(text);
+  if (!list->items[list->count])
+    return false;
+  list->count++;
+  return true;
+}
+
+/* Validate and normalize one entry. Returns:
+ *   1 -> added to `out`
+ *   0 -> blank entry, skip
+ *  -1 -> invalid (message set in `err`)
+ * `strip_line_endings` trims a trailing CR/LF (line mode only); NUL mode keeps
+ * the entry bytes verbatim so names ending in CR/LF survive. */
+static int normalize_entry(const char* raw, size_t len, bool strip_line_endings, StringList* out,
+                           char* err, size_t err_size) {
+  if (strip_line_endings) {
+    while (len > 0 && (raw[len - 1] == '\n' || raw[len - 1] == '\r'))
+      len--;
+  }
+  if (len == 0)
+    return 0;
+  if (raw[0] == '/') {
+    snprintf(err, err_size, "absolute path entries are not allowed: '%.*s'", (int)len, raw);
+    return -1;
+  }
+  /* Reject NUL bytes inside a token defensively (NUL-delimited mode splits on
+   * them, so this only guards against embedded garbage). */
+  char* dup = malloc(len + 1);
+  if (!dup) {
+    snprintf(err, err_size, "memory allocation failed");
+    return -1;
+  }
+  memcpy(dup, raw, len);
+  dup[len] = '\0';
+
+  /* Rebuild the path token-by-token: skip '.' and empty segments, reject '..'. */
+  size_t out_len = 0;
+  for (const char* part = dup;;) {
+    const char* slash = strchr(part, '/');
+    size_t part_len = slash ? (size_t)(slash - part) : strlen(part);
+    if (part_len == 1 && part[0] == '.') {
+      /* skip "." segment */
+    } else if (part_len == 2 && part[0] == '.' && part[1] == '.') {
+      snprintf(err, err_size, "path traversal entry is not allowed: '%s'", dup);
+      free(dup);
+      return -1;
+    } else if (part_len > 0) {
+      if (out_len > 0)
+        dup[out_len++] = '/';
+      memmove(dup + out_len, part, part_len);
+      out_len += part_len;
+    }
+    if (!slash)
+      break;
+    part = slash + 1;
+  }
+  dup[out_len] = '\0';
+
+  int result;
+  if (out_len == 0) {
+    /* "." / "./" lists the source root: the whole tree is transferred. */
+    result = string_list_add(out, "") ? 1 : -1;
+    if (result < 0)
+      snprintf(err, err_size, "memory allocation failed");
+  } else {
+    result = string_list_add(out, dup) ? 1 : -1;
+    if (result < 0)
+      snprintf(err, err_size, "memory allocation failed");
+  }
+  free(dup);
+  return result;
+}
+
+static FileListSet* string_list_to_set(StringList* raw, char* err, size_t err_size) {
+  FileListSet* set = malloc(sizeof(FileListSet));
+  if (!set) {
+    snprintf(err, err_size, "memory allocation failed");
+    return NULL;
+  }
+  set->count = raw->count;
+  set->entries = raw->items;
+  raw->items = NULL;
+  raw->count = 0;
+  return set;
+}
+
+FileListSet* file_list_load(const char* path, bool null_separated, char* err, size_t err_size) {
+  if (err && err_size > 0)
+    err[0] = '\0';
+  if (!path || !*path) {
+    snprintf(err, err_size, "no file given");
+    return NULL;
+  }
+  FILE* fp = fopen(path, "r");
+  if (!fp) {
+    char* escaped = output_escape(path, false);
+    snprintf(err, err_size, "could not open '%s': %s", escaped ? escaped : path, strerror(errno));
+    free(escaped);
+    return NULL;
+  }
+
+  StringList raw = {0};
+  char* line = NULL;
+  size_t line_cap = 0;
+  ssize_t n;
+  bool ok = true;
+  char delim = null_separated ? '\0' : '\n';
+  while (ok && (n = getdelim(&line, &line_cap, delim, fp)) != -1) {
+    int r = normalize_entry(line, (size_t)n, !null_separated, &raw, err, err_size);
+    if (r < 0) {
+      ok = false;
+      break;
+    }
+  }
+  free(line);
+  fclose(fp);
+  if (!ok) {
+    string_list_destroy(&raw);
+    return NULL;
+  }
+  FileListSet* set = string_list_to_set(&raw, err, err_size);
+  if (!set)
+    string_list_destroy(&raw);
+  return set;
+}
+
+void file_list_destroy(FileListSet* set) {
+  if (!set)
+    return;
+  for (int i = 0; i < set->count; i++)
+    free(set->entries[i]);
+  free(set->entries);
+  free(set);
+}
+
+static bool path_has_prefix(const char* path, const char* prefix) {
+  size_t plen = strlen(prefix);
+  if (strncmp(path, prefix, plen) != 0)
+    return false;
+  return path[plen] == '/' || path[plen] == '\0';
+}
+
+bool file_list_affects(const FileListSet* set, const char* rel) {
+  if (!set)
+    return true;
+  if (!rel)
+    return false;
+  for (int i = 0; i < set->count; i++) {
+    const char* entry = set->entries[i];
+    if (entry[0] == '\0')
+      return true; /* whole tree listed */
+    if (strcmp(rel, entry) == 0)
+      return true; /* the entry itself is listed */
+    if (path_has_prefix(rel, entry))
+      return true; /* rel lives under a listed directory */
+    if (path_has_prefix(entry, rel))
+      return true; /* rel is an ancestor directory of a listed entry */
+  }
+  return false;
+}

src/shared/file_list.h

@@ -0,0 +1,35 @@
+#ifndef FILE_LIST_H
+#define FILE_LIST_H
+
+#include <stdbool.h>
+#include <stddef.h>
+
+/* --files-from allow-set. The file lists source paths RELATIVE to the source
+ * root. A listed regular file is transferred; a listed directory transfers its
+ * whole subtree (FastSync's recursion is always on). Blank lines are ignored.
+ *
+ * Entries are normalized: leading "./" and duplicate "/" are removed, an entry
+ * of "." means the whole tree, absolute entries and ".." traversal are
+ * rejected at parse time. The set is immutable and shared read-only across
+ * scanner worker threads.
+ */
+
+typedef struct {
+  char** entries; /* normalized rel paths; "" means the whole tree */
+  int count;
+} FileListSet;
+
+/* Load and validate a --files-from file. When `null_separated` (-0/--from0)
+ * entries are delimited by NUL instead of newlines. Returns NULL with a message
+ * in `err` on open/validation failure. An empty file yields an empty set
+ * (nothing is transferred). */
+FileListSet* file_list_load(const char* path, bool null_separated, char* err, size_t err_size);
+void file_list_destroy(FileListSet* set);
+
+/* True when `rel` (path relative to the source root, "" == root) is a listed
+ * entry, lives under a listed directory, or is an ancestor directory of a
+ * listed entry. Used to prune scanning: directories are descended only when
+ * this returns true, files are transferred only when it returns true. */
+bool file_list_affects(const FileListSet* set, const char* rel);
+
+#endif

src/shared/filter.c

@@ -0,0 +1,427 @@
+#include "filter.h"
+#include "log.h"
+#include "utils.h"
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+/* ---- Single rule parsing ---- */
+
+static bool rule_text_is_unsupported_word(const char* p, size_t len) {
+  static const char* const words[] = {"merge",   "dir-merge", "hide", "show",
+                                      "protect", "risk",      "clear"};
+  for (size_t i = 0; i < sizeof(words) / sizeof(words[0]); i++) {
+    size_t wl = strlen(words[i]);
+    if (len == wl && strncmp(p, words[i], wl) == 0)
+      return true;
+  }
+  return false;
+}
+
+/* rsync include/exclude rule modifiers we do NOT implement. A rule whose +/- is
+ * immediately followed by one of these is rejected instead of being silently
+ * parsed as a literal pattern. */
+static bool is_unsupported_rule_modifier(char c) {
+  return c == '!' || c == 'C' || c == 's' || c == 'r' || c == 'p' || c == 'x';
+}
+
+FilterRule* filter_rule_parse(const char* line, char* err, size_t err_size) {
+  if (err && err_size > 0)
+    err[0] = '\0';
+  if (!line)
+    return NULL;
+  char* text = str_dup(line);
+  if (!text) {
+    if (err)
+      snprintf(err, err_size, "memory allocation failed");
+    return NULL;
+  }
+  size_t len = strlen(text);
+  while (len > 0 && (text[len - 1] == '\n' || text[len - 1] == '\r'))
+    text[--len] = '\0';
+
+  const char* p = text;
+  while (*p == ' ' || *p == '\t')
+    p++;
+  if (*p == '\0') {
+    snprintf(err, err_size, "empty filter rule");
+    free(text);
+    return NULL;
+  }
+
+  FilterAction action = FILTER_ACTION_EXCLUDE;
+  if (*p == '+' || *p == '-') {
+    action = *p == '+' ? FILTER_ACTION_INCLUDE : FILTER_ACTION_EXCLUDE;
+    p++;
+    /* rsync attaches rule modifiers directly to the +/- (e.g. "-s foo"). Only
+     * the '/' anchor modifier is supported; anything else is a clear error
+     * rather than a silently-ignored literal. */
+    if (*p != ' ' && *p != '\t' && *p != '\0' && is_unsupported_rule_modifier(*p)) {
+      snprintf(err, err_size,
+               "filter rule modifier '%c' is not supported (only the '/' anchor after +/- "
+               "is implemented; put a space between +/- and the pattern)",
+               *p);
+      free(text);
+      return NULL;
+    }
+    while (*p == ' ' || *p == '\t')
+      p++;
+  } else {
+    /* ':' (dir-merge) and '.' (merge) are rsync filter-rule shorthands. At the
+     * start of a rule they mean "merge this file", so reject them instead of
+     * silently turning them into inert exclude patterns. */
+    if (*p == ':' || *p == '.' || *p == '!') {
+      snprintf(err, err_size,
+               "filter rule starting with '%c' is not supported (merge/dir-merge/list-clear "
+               "shorthands are not implemented; use +/- include/exclude rules)",
+               *p);
+      free(text);
+      return NULL;
+    }
+    const char* sp = p;
+    while (*sp != '\0' && *sp != ' ' && *sp != '\t')
+      sp++;
+    size_t word_len = (size_t)(sp - p);
+    if (rule_text_is_unsupported_word(p, word_len)) {
+      snprintf(err, err_size,
+               "'%.*s' filter directives are not supported (only +/- include/exclude rules "
+               "with an optional '/' anchor and trailing '/' dir marker)",
+               (int)word_len, p);
+      free(text);
+      return NULL;
+    }
+    if (word_len == strlen("include") && strncmp(p, "include", word_len) == 0) {
+      action = FILTER_ACTION_INCLUDE;
+      p = sp;
+    } else if (word_len == strlen("exclude") && strncmp(p, "exclude", word_len) == 0) {
+      action = FILTER_ACTION_EXCLUDE;
+      p = sp;
+    }
+    while (*p == ' ' || *p == '\t')
+      p++;
+  }
+
+  if (*p == '\0') {
+    snprintf(err, err_size, "filter rule has no pattern");
+    free(text);
+    return NULL;
+  }
+
+  /* A pattern beginning with '/' is anchored (either as "-/foo" or "- /foo"). */
+  bool anchored = false;
+  if (*p == '/') {
+    anchored = true;
+    p++;
+    while (*p == ' ' || *p == '\t')
+      p++;
+  }
+  if (*p == '\0') {
+    snprintf(err, err_size, "filter rule has no pattern after '/' anchor");
+    free(text);
+    return NULL;
+  }
+
+  /* Pattern runs to the end of the rule; a single trailing '/' marks dir-only. */
+  size_t pat_len = strlen(p);
+  bool dir_only = false;
+  if (pat_len > 1 && p[pat_len - 1] == '/') {
+    dir_only = true;
+    pat_len--;
+  } else if (pat_len == 1 && p[0] == '/') {
+    /* "//" anchored with nothing after: meaningless. */
+    snprintf(err, err_size, "filter rule has no pattern");
+    free(text);
+    return NULL;
+  }
+
+  FilterRule* rule = calloc(1, sizeof(FilterRule));
+  if (!rule) {
+    snprintf(err, err_size, "memory allocation failed");
+    free(text);
+    return NULL;
+  }
+  rule->pattern = malloc(pat_len + 1);
+  if (!rule->pattern) {
+    free(rule);
+    snprintf(err, err_size, "memory allocation failed");
+    free(text);
+    return NULL;
+  }
+  memcpy(rule->pattern, p, pat_len);
+  rule->pattern[pat_len] = '\0';
+  rule->action = action;
+  rule->anchored = anchored;
+  rule->dir_only = dir_only;
+  rule->owner = NULL;
+  free(text);
+  return rule;
+}
+
+void filter_rule_free(FilterRule* rule) {
+  if (!rule)
+    return;
+  free(rule->pattern);
+  free(rule->owner);
+  free(rule);
+}
+
+/* ---- Ordered rule lists ---- */
+
+FilterRuleList* filter_rule_list_create(void) {
+  return calloc(1, sizeof(FilterRuleList));
+}
+
+bool filter_rule_list_add(FilterRuleList* list, FilterRule* rule) {
+  if (!list || !rule)
+    return false;
+  if (list->count == list->capacity) {
+    int new_cap = list->capacity > 0 ? list->capacity * 2 : 8;
+    FilterRule** grown = realloc(list->items, (size_t)new_cap * sizeof(FilterRule*));
+    if (!grown)
+      return false;
+    list->items = grown;
+    list->capacity = new_cap;
+  }
+  list->items[list->count++] = rule;
+  return true;
+}
+
+bool filter_rule_list_parse_append(FilterRuleList* list, const char* line, char* err,
+                                   size_t err_size) {
+  FilterRule* rule = filter_rule_parse(line, err, err_size);
+  if (!rule)
+    return false;
+  if (!filter_rule_list_add(list, rule)) {
+    filter_rule_free(rule);
+    snprintf(err, err_size, "memory allocation failed");
+    return false;
+  }
+  return true;
+}
+
+void filter_rule_list_free(FilterRuleList* list) {
+  if (!list)
+    return;
+  for (int i = 0; i < list->count; i++)
+    filter_rule_free(list->items[i]);
+  free(list->items);
+  free(list);
+}
+
+static bool set_rule_owner(FilterRule* rule, const char* owner) {
+  char* dup = str_dup(owner ? owner : "");
+  if (!dup)
+    return false;
+  free(rule->owner);
+  rule->owner = dup;
+  return true;
+}
+
+/* ---- CVS default excludes (-C) ---- */
+
+typedef struct {
+  const char* pattern;
+  bool dir_only;
+} CvsDefaultRule;
+
+static const CvsDefaultRule CVS_DEFAULTS[] = {
+    {"RCS", false},         {"SCCS", false},         {"CVS", false},   {"CVS.adm", false},
+    {"RCSLOG", false},      {"cvslog.*", false},     {"tags", false},  {"TAGS", false},
+    {".make.state", false}, {".nse_depinfo", false}, {"*~", false},    {"#*", false},
+    {".#*", false},         {",*", false},           {"_$*", false},   {"*$", false},
+    {"*.old", false},       {"*.bak", false},        {"*.BAK", false}, {"*.orig", false},
+    {"*.rej", false},       {".del-*", false},       {"*.a", false},   {"*.olb", false},
+    {"*.o", false},         {"*.obj", false},        {"*.so", false},  {"*.exe", false},
+    {"*.Z", false},         {"*.elc", false},        {"*.ln", false},  {"core", false},
+    {".svn/", true},        {".git/", true},         {".hg/", true},   {".bzr/", true},
+};
+
+static bool cvs_rule_list_append(FilterRuleList* list) {
+  for (size_t i = 0; i < sizeof(CVS_DEFAULTS) / sizeof(CVS_DEFAULTS[0]); i++) {
+    FilterRule* rule = calloc(1, sizeof(FilterRule));
+    if (!rule)
+      return false;
+    rule->action = FILTER_ACTION_EXCLUDE;
+    rule->dir_only = CVS_DEFAULTS[i].dir_only;
+    size_t plen = strlen(CVS_DEFAULTS[i].pattern);
+    if (rule->dir_only && plen > 0 && CVS_DEFAULTS[i].pattern[plen - 1] == '/')
+      plen--; /* keep the cleaned pattern, matching filter_rule_parse */
+    rule->pattern = malloc(plen + 1);
+    if (!rule->pattern) {
+      free(rule);
+      return false;
+    }
+    memcpy(rule->pattern, CVS_DEFAULTS[i].pattern, plen);
+    rule->pattern[plen] = '\0';
+    if (!set_rule_owner(rule, "")) {
+      filter_rule_free(rule);
+      return false;
+    }
+    if (!filter_rule_list_add(list, rule)) {
+      filter_rule_free(rule);
+      return false;
+    }
+  }
+  return true;
+}
+
+FilterRuleList* filter_base_build(const char* const* rule_texts, int rule_count, bool cvs_exclude,
+                                  char* err, size_t err_size) {
+  if (err && err_size > 0)
+    err[0] = '\0';
+  FilterRuleList* list = filter_rule_list_create();
+  if (!list) {
+    snprintf(err, err_size, "memory allocation failed");
+    return NULL;
+  }
+  for (int i = 0; i < rule_count; i++) {
+    if (!rule_texts || !rule_texts[i])
+      continue;
+    FilterRule* rule = filter_rule_parse(rule_texts[i], err, err_size);
+    if (!rule) {
+      filter_rule_list_free(list);
+      return NULL;
+    }
+    if (!set_rule_owner(rule, "")) {
+      filter_rule_free(rule);
+      filter_rule_list_free(list);
+      snprintf(err, err_size, "memory allocation failed");
+      return NULL;
+    }
+    if (!filter_rule_list_add(list, rule)) {
+      filter_rule_free(rule);
+      filter_rule_list_free(list);
+      snprintf(err, err_size, "memory allocation failed");
+      return NULL;
+    }
+  }
+  if (cvs_exclude && !cvs_rule_list_append(list)) {
+    filter_rule_list_free(list);
+    snprintf(err, err_size, "memory allocation failed");
+    return NULL;
+  }
+  return list;
+}
+
+/* ---- Per-directory .rsync-filter files ---- */
+
+FilterRuleList* filter_file_read(const char* dir_path, const char* owner_rel, bool* exists,
+                                 char* err, size_t err_size) {
+  if (err && err_size > 0)
+    err[0] = '\0';
+  if (exists)
+    *exists = false;
+  char* filter_path = path_cat(dir_path, ".rsync-filter");
+  if (!filter_path) {
+    snprintf(err, err_size, "memory allocation failed");
+    return NULL;
+  }
+  FILE* fp = fopen(filter_path, "r");
+  free(filter_path);
+  if (!fp) {
+    if (errno == ENOENT || errno == ENOTDIR)
+      return filter_rule_list_create();
+    log_message(LOG_LEVEL_WARNING, "Could not read .rsync-filter in %s: %s", dir_path,
+                strerror(errno));
+    return filter_rule_list_create();
+  }
+  if (exists)
+    *exists = true;
+  FilterRuleList* list = filter_rule_list_create();
+  if (!list) {
+    fclose(fp);
+    snprintf(err, err_size, "memory allocation failed");
+    return NULL;
+  }
+  char* line = NULL;
+  size_t line_cap = 0;
+  ssize_t n;
+  bool ok = true;
+  while ((n = getline(&line, &line_cap, fp)) != -1) {
+    const char* p = line;
+    while (*p == ' ' || *p == '\t')
+      p++;
+    if (*p == '\0' || *p == '\n' || *p == '\r' || *p == '#')
+      continue;
+    FilterRule* rule = filter_rule_parse(p, err, err_size);
+    if (!rule) {
+      ok = false;
+      break;
+    }
+    if (!set_rule_owner(rule, owner_rel)) {
+      filter_rule_free(rule);
+      snprintf(err, err_size, "memory allocation failed");
+      ok = false;
+      break;
+    }
+    if (!filter_rule_list_add(list, rule)) {
+      filter_rule_free(rule);
+      snprintf(err, err_size, "memory allocation failed");
+      ok = false;
+      break;
+    }
+  }
+  free(line);
+  fclose(fp);
+  if (!ok) {
+    filter_rule_list_free(list);
+    return NULL;
+  }
+  return list;
+}
+
+/* ---- Rule matching ---- */
+
+/* Match a pattern that contains '/' (non-anchored) against the end of the
+ * relative path, starting at any path-component boundary. */
+static bool glob_suffix_match(const char* pattern, const char* str) {
+  if (glob_match(pattern, str))
+    return true;
+  for (const char* slash = strchr(str, '/'); slash; slash = strchr(slash + 1, '/')) {
+    if (glob_match(pattern, slash + 1))
+      return true;
+  }
+  return false;
+}
+
+static FilterAction rule_matches(const FilterRule* rule, const char* rel_path, const char* leaf,
+                                 bool is_dir) {
+  if (!rule || !rule->pattern)
+    return FILTER_ACTION_NONE;
+  if (rule->dir_only && !is_dir)
+    return FILTER_ACTION_NONE;
+  /* A rule applies only to entries below its owner directory. */
+  const char* rel2 = rel_path;
+  if (rule->owner && rule->owner[0] != '\0') {
+    size_t owner_len = strlen(rule->owner);
+    if (strncmp(rule->owner, rel_path, owner_len) != 0)
+      return FILTER_ACTION_NONE;
+    if (rel_path[owner_len] != '/')
+      return FILTER_ACTION_NONE;
+    rel2 = rel_path + owner_len + 1;
+  }
+  if (rel2[0] == '\0')
+    return FILTER_ACTION_NONE;
+  bool matched;
+  if (rule->anchored) {
+    matched = glob_match(rule->pattern, rel2);
+  } else if (strchr(rule->pattern, '/') != NULL) {
+    matched = glob_suffix_match(rule->pattern, rel2);
+  } else {
+    matched = glob_match(rule->pattern, leaf);
+  }
+  return matched ? rule->action : FILTER_ACTION_NONE;
+}
+
+FilterAction filter_rules_apply(const FilterRuleList* list, const char* rel_path, const char* leaf,
+                                bool is_dir) {
+  if (!list)
+    return FILTER_ACTION_NONE;
+  for (int i = 0; i < list->count; i++) {
+    FilterAction action = rule_matches(list->items[i], rel_path, leaf, is_dir);
+    if (action != FILTER_ACTION_NONE)
+      return action;
+  }
+  return FILTER_ACTION_NONE;
+}

src/shared/filter.h

@@ -0,0 +1,83 @@
+#ifndef FILTER_H
+#define FILTER_H
+
+#include <stdbool.h>
+#include <stddef.h>
+
+/* rsync-style filter rule engine (client-side file selection).
+ *
+ * Supported rule syntax (documented subset):
+ *   [+|-] [anchored '/' prefix] pattern [trailing '/' for dir-only]
+ *
+ *   "+ PATTERN"   include rule (first match wins)
+ *   "- PATTERN"   exclude rule
+ *   "PATTERN"     implicit exclude rule (rsync default)
+ *   "include PATTERN" / "exclude PATTERN"  word forms
+ *   leading '/' after the +/- anchors the pattern to its owner directory
+ *     (the transfer root for command-line/-C rules, the directory that
+ *      contains a .rsync-filter file for per-directory rules)
+ *   a trailing '/' makes the rule match directories only
+ *
+ * Rejected explicitly (no silent no-ops): the rsync merge/dir-merge/list-clear
+ * shorthands written as a rule that starts with ':' or '.' or '!', the
+ * merge/dir-merge/hide/show/protect/risk/clear words, and every include/exclude
+ * rule modifier other than '/' (! C s r p x). The pattern must be separated
+ * from +/- by a space (or a single '/' anchor), exactly like rsync's
+ * "-s foo"/"-p ..." modifier syntax is refused.
+ */
+
+typedef enum {
+  FILTER_ACTION_NONE = 0, /* no rule matched */
+  FILTER_ACTION_EXCLUDE = -1,
+  FILTER_ACTION_INCLUDE = 1
+} FilterAction;
+
+typedef struct {
+  FilterAction action;
+  bool anchored; /* pattern anchored to the rule's owner directory */
+  bool dir_only; /* pattern had a trailing '/': matches directories only */
+  char* owner;   /* owning directory rel path ("" == transfer root) */
+  char* pattern; /* cleaned glob pattern (no leading '/', no trailing '/') */
+} FilterRule;
+
+typedef struct {
+  FilterRule** items; /* owned array of rule pointers */
+  int count;
+  int capacity;
+} FilterRuleList;
+
+/* Parse a single filter-rule line (no trailing newline required). Returns an
+ * owned rule, or NULL on unsupported/invalid syntax with a message in `err`. */
+FilterRule* filter_rule_parse(const char* line, char* err, size_t err_size);
+void filter_rule_free(FilterRule* rule);
+
+FilterRuleList* filter_rule_list_create(void);
+/* Append a fully-parsed rule (takes ownership). Returns false on OOM. */
+bool filter_rule_list_add(FilterRuleList* list, FilterRule* rule);
+/* Parse `line` and append it. Returns false and fills `err` on bad syntax. */
+bool filter_rule_list_parse_append(FilterRuleList* list, const char* line, char* err,
+                                   size_t err_size);
+void filter_rule_list_free(FilterRuleList* list);
+
+/* Build the command-line filter set: `rule_texts` (--filter=RULE in the order
+ * given, 0..rule_count) followed by the -C CVS default excludes when
+ * cvs_exclude is true. All rules are owned by "" (the transfer root).
+ * Returns NULL on unsupported rule text (message in `err`). */
+FilterRuleList* filter_base_build(const char* const* rule_texts, int rule_count, bool cvs_exclude,
+                                  char* err, size_t err_size);
+
+/* Read "<dir_path>/.rsync-filter" and return its rules, each owned by
+ * `owner_rel`. A missing file yields an empty list with *exists=false; an
+ * unreadable file is treated as missing. Returns NULL only on parse or
+ * allocation failure (message in `err`). */
+FilterRuleList* filter_file_read(const char* dir_path, const char* owner_rel, bool* exists,
+                                 char* err, size_t err_size);
+
+/* Evaluate an entry against one ordered rule list. Returns FILTER_ACTION_NONE
+ * when no rule matched, otherwise the first matching rule's action.
+ * `rel_path` is the entry's path relative to the transfer root ("" == root),
+ * `leaf` its final name, `is_dir` whether it is a directory. */
+FilterAction filter_rules_apply(const FilterRuleList* list, const char* rel_path, const char* leaf,
+                                bool is_dir);
+
+#endif