Merge branch 'feat/w9-dryrun' into fix/w9-integration

src/shared/config.c

@@ -21,7 +21,6 @@ static void config_set_defaults(Config* config) {
   config->scanner_threads = 0;
   config->metadata_explicitly_disabled = false;
   config->show_progress = false;
-  config->dry_run = false;
   config->compression_threads = 0;
   config->ssh_port = 22;
   config->transport = TRANSPORT_TCP;
@@ -42,6 +41,8 @@ static void config_set_defaults(Config* config) {
   config->tls_ca = NULL;
   config->server_host = str_dup("127.0.0.1");
   config->server_port = 8080;
+  config->server_port_set = false;
+  config->server_host_set = false;
   /* 0 means "--timeout not given": the transport keeps its own built-in 30 s
    * socket timeout (tcp_set_timeouts ignores non-positive values) and the
    * protocol layer keeps its built-in 60 s per-message deadline.  A positive
@@ -190,11 +191,11 @@ static bool validate_received_config(const Config* config) {
          valid_wire_bool(config->delay_updates) && valid_wire_bool(config->mkpath) &&
          valid_wire_bool(config->partial) && valid_wire_bool(config->delete_before) &&
          valid_wire_bool(config->checksum) && valid_wire_bool(config->eight_bit_output) &&
-         checksum_algo_valid(config->checksum_algo) && identity_wire_valid(config) &&
-         valid_wire_bool(config->preserve_atimes) && valid_wire_bool(config->preserve_crtimes) &&
-         valid_wire_bool(config->omit_dir_times) && valid_wire_bool(config->omit_link_times) &&
-         valid_wire_bool(config->munge_links) && valid_wire_bool(config->keep_dirlinks) &&
-         valid_wire_bool(config->fake_super) &&
+         valid_wire_bool(config->dry_run) && checksum_algo_valid(config->checksum_algo) &&
+         identity_wire_valid(config) && valid_wire_bool(config->preserve_atimes) &&
+         valid_wire_bool(config->preserve_crtimes) && valid_wire_bool(config->omit_dir_times) &&
+         valid_wire_bool(config->omit_link_times) && valid_wire_bool(config->munge_links) &&
+         valid_wire_bool(config->keep_dirlinks) && valid_wire_bool(config->fake_super) &&
          (!config->copy_as_set || (config->copy_as_uid >= 0 && config->copy_as_gid >= 0)) &&
          (!config->use_compression ||
           (config->compression_level >= 1 && config->compression_level <= 22)) &&

src/shared/config.h

@@ -109,6 +109,11 @@ typedef enum SuperMode { SUPER_MODE_AUTO = 0, SUPER_MODE_ON = 1, SUPER_MODE_OFF
  * =========================================================================== */
 #define CONFIG_WIRE_HEADER_FIELDS(X) X(version, char*, str_dup(PROTOCOL_VERSION), STR)
 
+/* dry_run (--dry-run) is CLIENT-INTENT that now CROSSES the wire (protocol
+ * 2.21.0): the receiver needs it to answer what WOULD transfer/skip without
+ * touching disk.  The client-only launch behavior (no server contact for a
+ * local destination) is decided separately in client_send.c before the frame
+ * is ever sent. */
 #define CONFIG_WIRE_CORE_FIELDS(X)                                                                 \
   X(eight_bit_output, bool, false, BOOL_8BIT)                                                      \
   X(max_alloc, unsigned long long, DEFAULT_MAX_ALLOC, RAW_MAXALLOC)                                \
@@ -122,7 +127,8 @@ typedef enum SuperMode { SUPER_MODE_AUTO = 0, SUPER_MODE_ON = 1, SUPER_MODE_OFF
   X(use_executability, bool, false, BOOL)                                                          \
   X(compression_level, int, 5, INT)                                                                \
   X(chunk_size, unsigned long long, DEFAULT_CHUNK_SIZE, RAW)                                       \
-  X(use_sendfile, bool, false, BOOL)
+  X(use_sendfile, bool, false, BOOL)                                                               \
+  X(dry_run, bool, false, BOOL)
 
 #define CONFIG_WIRE_DELTA_FIELDS(X)                                                                \
   X(use_delete, bool, false, BOOL)                                                                 \
@@ -261,7 +267,6 @@ typedef struct Config {
   int scanner_threads;
   bool metadata_explicitly_disabled;
   bool show_progress;
-  bool dry_run;
   int compression_threads;
   int ssh_port;
   TransportType transport;
@@ -281,6 +286,18 @@ typedef struct Config {
   bool use_tls;
   char* server_host;
   int server_port;
+  /* True when --server-port/--port was explicitly given.  CLIENT-ONLY (never
+   * serialized): --dry-run uses it to decide whether a real server handshake
+   * was requested, so a plain local destination (no explicit port) keeps the
+   * existing client-side dry-run behavior instead of dialing the default
+   * 127.0.0.1:8080. */
+  bool server_port_set;
+  /* True when --server-host was explicitly given.  CLIENT-ONLY (never
+   * serialized), and distinct from the "127.0.0.1" default: --dry-run uses it
+   * to route an explicit remote target to the server so it reports receiver
+   * state exactly like a real run, instead of silently running the client-side
+   * manifest. */
+  bool server_host_set;
   char* tls_cert;
   char* tls_key;
   char* tls_ca;
@@ -758,19 +775,35 @@ typedef struct Config {
  * mixed 2.19/2.20 deployment.  The chunk codec, which already used the packed
  * metadata_to_buf()/metadata_from_buf() form, is unchanged.
  *
- * Error-Detail Wave: 2.20.0 -> 2.21.0.
+ * Error-Detail + Server-contacting Dry-run Wave: 2.20.0 -> 2.21.0.
  *
- * WHY the bump, grounded in the wire: a server may now answer a rejected
- * operation with STATUS_ERROR_DETAIL followed by a bounded (<=
- * MAX_ERROR_DETAIL_BYTES) length-prefixed string instead of a bare
- * STATUS_ERROR (see protocol.h).  The config-frame LAYOUT is unchanged, but the
- * FRAME STREAM gains a new framed body after a status, so a 2.20 peer that does
- * not consume it would desynchronize on the following exchange.  The strict
- * same-version handshake (config_receive rejects a mismatched version before
- * parsing anything else) is what keeps a 2.21 client and a 2.20 server from ever
- * reaching that state.  receive_status() transparently maps STATUS_ERROR_DETAIL
- * back to STATUS_ERROR for every existing call site and captures the reason into
- * a thread-local buffer consulted via protocol_last_error(). */
+ * WHY the bump, grounded in the wire: this release combines two changes on the
+ * same lockstep version.
+ *
+ * (1) Error detail: a server may now answer a rejected operation with
+ * STATUS_ERROR_DETAIL followed by a bounded (<= MAX_ERROR_DETAIL_BYTES)
+ * length-prefixed string instead of a bare STATUS_ERROR (see protocol.h).  The
+ * config-frame LAYOUT is unchanged, but the FRAME STREAM gains a new framed
+ * body after a status, so a 2.20 peer that does not consume it would
+ * desynchronize on the following exchange.  receive_status() transparently maps
+ * STATUS_ERROR_DETAIL back to STATUS_ERROR for every existing call site and
+ * captures the reason into a thread-local buffer consulted via
+ * protocol_last_error().
+ *
+ * (2) --dry-run: --dry-run now contacts the receiver and reports exactly what
+ * WOULD change.  The binary config frame gains one serialized bool
+ * (Config->dry_run) appended to CONFIG_WIRE_CORE_FIELDS after use_sendfile, and
+ * the frame stream gains one terminal status (STATUS_DRY_RUN_TRANSFER) sent in
+ * reply to a per-file STATUS_CHECK when the file is not already up to date.
+ * The receiver performs the normal read-only incremental decision but no
+ * mutation; the sender then skips the data.
+ *
+ * Any config-frame layout or frame-sequence change must bump the protocol
+ * version: a 2.20 peer would desynchronize on the extra trailing byte, the
+ * unknown status, or the unconsumed detail body, and the strict same-version
+ * handshake (config_receive rejects a mismatched version before parsing
+ * anything else) is what keeps a 2.21 client and a 2.20 server from ever
+ * reaching that state. */
 #define PROTOCOL_VERSION "2.21.0"
 #define DEFAULT_CHUNK_SIZE (10 * 1024 * 1024)
 /* Upper bound on total basis-dir entries (rsync caps --link-dest at 20). */

src/shared/file_receive.c

@@ -569,6 +569,13 @@ static FileSaveResult file_save_write_device(const char* root_directory, const F
 
 FileSaveResult file_save_to_disk_full(const char* root_directory, const File* file,
                                       const Config* config) {
+  /* Central no-mutation guard: a server-contacting --dry-run (or a local batch
+     apply that somehow carries dry_run) must never touch the destination, no
+     matter which caller reached this primitive.  The per-caller guards remain,
+     but this is the last line of defense for every save path.  Report SKIPPED
+     so a --remove-source-files sender correctly keeps its source. */
+  if (config && config->dry_run)
+    return FILE_SAVE_SKIPPED;
   /* Backups are incompatible with ignore-existing: moving the entry first
      would make a concurrent no-replace commit overwrite its old name. */
   bool backup_enabled = config && config->backup && !config->ignore_existing;
@@ -1651,12 +1658,15 @@ static File* receive_full_file(int fd, const Config* config, const char* path) {
  * receive_incremental_check() decomposition.
  *
  * The per-file STATUS_CHECK fast path is split into the small helpers below,
- * called in order by a short linear orchestrator.  Each helper owns one
- * decision: request validation, secure destination open, metadata-only skip,
+ * called in order by a short linear orchestrator (receive_incremental_check_ex).
+ * Each helper owns one decision: request validation, secure destination open,
+ * metadata-only skip, server-contacting --dry-run no-mutation short-circuit,
  * alternate-basis match, --append tail resume, block delta, --fuzzy basis, and
  * the final "send the whole file" fallback.  Every protocol send/receive and
- * every resource cleanup is preserved exactly; the wire is byte-for-byte
- * unchanged.
+ * every resource cleanup is preserved exactly; the non-dry-run wire is
+ * byte-for-byte unchanged.  receive_incremental_check_ex additionally exposes a
+ * `would_transfer` out-param for the dry-run caller; the 3-arg
+ * receive_incremental_check wrapper passes NULL.
  * ------------------------------------------------------------------------- */
 
 /* Owned state threaded through the helpers below. */
@@ -1681,6 +1691,7 @@ typedef enum {
   INCREMENTAL_CONTINUE, /* proceed to the next helper */
   INCREMENTAL_ERROR,    /* protocol/validation failure: return NULL */
   INCREMENTAL_SKIP,     /* up to date: *skipped = true, return NULL */
+  INCREMENTAL_DRY_RUN,  /* --dry-run resolved: flags set, return NULL */
   INCREMENTAL_FILE,     /* a File* was produced (out_file) */
 } IncrementalCheckOutcome;
 
@@ -1845,6 +1856,42 @@ static IncrementalCheckOutcome incremental_check_quick_skip(IncrementalCheckStat
   return INCREMENTAL_CONTINUE;
 }
 
+/* Server-contacting --dry-run no-mutation short-circuit.  Runs after the
+   quick-skip decision and before any path that could touch the destination.
+   When dry_run is set and the file is not already up to date the receiver must
+   materialize nothing (no basis link/copy, no append/delta/full transfer) and
+   the sender must send no data, so answer STATUS_DRY_RUN_TRANSFER and stop.
+   The one exception is a --compare-dest exact hit with no destination copy: a
+   real run would suppress the data without changing the destination, so it
+   reports as a skip (STATUS_OK) exactly as the full basis path below would.
+   Everything read here (destination file, basis candidates) is read-only. */
+static IncrementalCheckOutcome incremental_check_dry_run_shortcut(IncrementalCheckState* state,
+                                                                  bool* skipped,
+                                                                  bool* would_transfer) {
+  const Config* config = state->config;
+  if (!config->dry_run)
+    return INCREMENTAL_CONTINUE;
+
+  bool skip_via_compare = false;
+  if (config_has_basis(config) && !config->ignore_times) {
+    BasisMatch basis;
+    basis_match_find(config, state->check_path, state->check_size, (time_t)state->check_mtime,
+                     (long)state->check_mtime_nsec, state->check_digest, state->check_digest_len,
+                     false, &basis);
+    if (basis.hit && basis.type == BASIS_DEST_COMPARE && !state->has_old_file)
+      skip_via_compare = true;
+    basis_match_free(&basis);
+  }
+  Status reply = skip_via_compare ? STATUS_OK : STATUS_DRY_RUN_TRANSFER;
+  if (!send_status(state->fd, reply))
+    return INCREMENTAL_ERROR;
+  if (skip_via_compare)
+    *skipped = true;
+  else if (would_transfer)
+    *would_transfer = true;
+  return INCREMENTAL_DRY_RUN;
+}
+
 /* Alternate basis directories (--compare-dest/--copy-dest/--link-dest): a hit
    either suppresses the transfer (compare-dest) or materializes the file from
    the basis without a data frame. */
@@ -2133,7 +2180,14 @@ static File* incremental_check_receive_full(IncrementalCheckState* state) {
   return receive_full_file(state->fd, state->config, state->check_path);
 }
 
-File* receive_incremental_check(int fd, const Config* config, bool* skipped) {
+/* Core implementation.  `would_transfer` (may be NULL) is set true only on the
+ * server-contacting --dry-run path, when the file is not up to date and the
+ * receiver answered STATUS_DRY_RUN_TRANSFER; the caller then knows no File is
+ * returned and nothing was stored. */
+File* receive_incremental_check_ex(int fd, const Config* config, bool* skipped,
+                                   bool* would_transfer) {
+  if (would_transfer)
+    *would_transfer = false;
   if (!config || !skipped) {
     send_status(fd, STATUS_ERROR);
     return NULL;
@@ -2163,6 +2217,13 @@ File* receive_incremental_check(int fd, const Config* config, bool* skipped) {
     goto done;
   }
 
+  /* Dry-run resolves here (no mutation) or falls through to the normal path. */
+  outcome = incremental_check_dry_run_shortcut(&state, skipped, would_transfer);
+  if (outcome == INCREMENTAL_ERROR)
+    goto done;
+  if (outcome != INCREMENTAL_CONTINUE)
+    goto done;
+
   outcome = incremental_check_try_basis(&state, &result);
   if (outcome == INCREMENTAL_ERROR)
     goto done;
@@ -2198,6 +2259,10 @@ done:
   return result;
 }
 
+File* receive_incremental_check(int fd, const Config* config, bool* skipped) {
+  return receive_incremental_check_ex(fd, config, skipped, NULL);
+}
+
 File* file_receive(const Config* config, int file_descriptor) {
   char* path = receive_wire_str(file_descriptor);
   if (path == NULL)
@@ -2909,6 +2974,11 @@ bool manifest_delete_missing_args(const Config* config, DeleteManifest* manifest
 bool manifest_delete_all(const Config* config, DeleteManifest* manifest) {
   if (!config || !manifest)
     return false;
+  /* Central no-mutation guard: a dry-run never deletes.  No manifest is sent on
+     the dry-run path, but a hostile/buggy peer could; treat it as a no-op so
+     the receiver can never remove anything. */
+  if (config->dry_run)
+    return true;
   if (config->delete_missing_args && !manifest_delete_missing_args(config, manifest))
     return false;
   if (config->use_delete && !manifest_delete_extras(config, manifest))

src/shared/file_receive.h

@@ -24,6 +24,13 @@ File* file_receive_symlink(int file_descriptor, const Config* config);
 File* file_receive_special(int file_descriptor);
 bool file_special_rdev_valid(int32_t major, int32_t minor, mode_t mode);
 File* receive_incremental_check(int fd, const Config* config, bool* skipped);
+/* Extended variant used by the receiver.  `would_transfer` (may be NULL) is set
+ * true only on the server-contacting --dry-run path when the file is not up to
+ * date: the receiver has already sent STATUS_DRY_RUN_TRANSFER and returns NULL
+ * without storing anything.  On that path `*skipped` is true for an up-to-date
+ * (STATUS_OK) file and both flags are false for a genuine error. */
+File* receive_incremental_check_ex(int fd, const Config* config, bool* skipped,
+                                   bool* would_transfer);
 
 /* P7 Wave D directory-time accumulator.  The receiver collects the metadata of
  * every directory it creates/receives (STATUS_MKDIR with metadata and/or the

src/shared/protocol.c

@@ -466,6 +466,8 @@ static const char* status_to_string(Status status) {
     return "AUTH_FAILED";
   case STATUS_ERROR_DETAIL:
     return "ERROR_DETAIL";
+  case STATUS_DRY_RUN_TRANSFER:
+    return "DRY_RUN_TRANSFER";
   default:
     return "UNKNOWN";
   }

src/shared/protocol.h

@@ -145,8 +145,17 @@ enum NET_STATUS {
    * of a bare STATUS_ERROR.  receive_status() consumes the string and maps the
    * status back to STATUS_ERROR, so every pre-2.21 call site keeps working;
    * callers that want the human-readable reason consult protocol_last_error().
-   * Appended last so the existing wire values never move. */
-  STATUS_ERROR_DETAIL
+   * Appended immediately after STATUS_AUTH_FAILED so the existing wire values
+   * never move. */
+  STATUS_ERROR_DETAIL,
+  /* Server-contacting --dry-run (protocol 2.21.0).  Sent by the receiver in
+   * response to a per-file STATUS_CHECK when the wire config carries
+   * dry_run=true and the file is NOT already up to date: it tells the sender
+   * the file WOULD be transferred, and the sender must NOT transmit any data
+   * (the receiver reads none in dry-run).  STATUS_OK keeps its meaning in this
+   * path ("already up to date / nothing to do").  Appended after
+   * STATUS_ERROR_DETAIL so no existing status is renumbered. */
+  STATUS_DRY_RUN_TRANSFER
 };
 
 void io_set_fds(int read_fd, int write_fd);