Merge branch 'main' into improve-agentic-workflow

.opencode/agents/cmake-expert.md

@@ -22,6 +22,10 @@ set(CMAKE_C_STANDARD_REQUIRED ON)
 
 add_compile_options(-Wall -g -O3)
 
+include(FetchContent)
+FetchContent_Declare(xxhash GIT_REPOSITORY https://github.com/Cyan4973/xxHash GIT_TAG v0.8.3 SOURCE_SUBDIR cmake_unofficial)
+FetchContent_MakeAvailable(xxhash)
+
 # Sanitizer option
 set(SANITIZER "none" CACHE STRING "Sanitizer to enable (address, thread, none)")
 set_property(CACHE SANITIZER PROPERTY STRINGS address thread none)
@@ -40,10 +44,6 @@ if(STRICT_WARNINGS)
   add_compile_options(-Wextra -Wpedantic -Werror)
 endif()
 
-include(FetchContent)
-FetchContent_Declare(xxhash GIT_REPOSITORY https://github.com/Cyan4973/xxHash GIT_TAG v0.8.3 SOURCE_SUBDIR cmake_unofficial)
-FetchContent_MakeAvailable(xxhash)
-
 set(THREADS_PREFER_PTHREAD_FLAG ON)
 find_package(Threads REQUIRED)
 
@@ -51,6 +51,7 @@ find_library(ZSTD_LIBRARY zstd)
 if(NOT ZSTD_LIBRARY)
   message(FATAL_ERROR "zstd library not found. Ensure it is in your nix-shell!")
 endif()
+
 find_package(OpenSSL REQUIRED)
 
 file(GLOB SHARED_SRCS "src/shared/*.c")
@@ -76,14 +77,15 @@ target_link_libraries(tests PRIVATE Threads::Threads ${ZSTD_LIBRARY} OpenSSL::SS
 src/shared/    — shared libraries (globbed as SHARED_SRCS)
 src/client/    — client sources (globbed as CLIENT_SRCS)
 src/server/    — server sources (globbed as SERVER_SRCS)
-tests/         — test sources (globbed as TEST_SRCS)
+tests/         — unit test sources (globbed as TEST_SRCS)
+tests/integration/ — Python pytest integration tests
 ```
 
 ### Dependencies
 - **zstd** — found via `find_library(ZSTD_LIBRARY zstd)`
+- **OpenSSL** — found via `find_package(OpenSSL REQUIRED)` (TLS 1.2+ transport)
+- **xxHash** — fetched via `FetchContent` from GitHub (delta transfer hashing, v0.8.3)
 - **pthreads** — found via `find_package(Threads REQUIRED)`
-- **OpenSSL** — found via `find_package(OpenSSL REQUIRED)`
-- **xxhash** — fetched via `FetchContent` from GitHub (v0.8.3)
 - **C11 standard** — required
 - **CMake 3.22+** — minimum version
 
@@ -162,35 +164,23 @@ cmake --build build -j$(nproc)
 ./build/tests
 ```
 
-## When Adding Sanitizer Support to CMakeLists.txt
+## Sanitizer Integration
 
-Use CMake options for cleaner integration:
+The project uses a single `SANITIZER` cache variable in `CMakeLists.txt`:
 ```cmake
-option(ENABLE_ASAN "Enable AddressSanitizer" OFF)
-option(ENABLE_TSAN "Enable ThreadSanitizer" OFF)
-option(ENABLE_UBSAN "Enable UndefinedBehaviorSanitizer" OFF)
-
-if(ENABLE_ASAN)
-  add_compile_options(-fsanitize=address -fno-omit-frame-pointer)
-  add_link_options(-fsanitize=address)
-endif()
-
-if(ENABLE_TSAN)
-  add_compile_options(-fsanitize=thread)
-  add_link_options(-fsanitize=thread)
-endif()
-
-if(ENABLE_UBSAN)
-  add_compile_options(-fsanitize=undefined)
-  add_link_options(-fsanitize=undefined)
-endif()
+set(SANITIZER "none" CACHE STRING "Sanitizer to enable (address, thread, none)")
+set_property(CACHE SANITIZER PROPERTY STRINGS address thread none)
 ```
+Supported values: `address`, `thread`, `none`. Unknown values trigger `FATAL_ERROR`.
 
-Then build with:
+Build with:
 ```bash
-cmake -B build -S . -DENABLE_ASAN=ON
+cmake -B build -S . -DSANITIZER=address
+cmake --build build -j$(nproc)
 ```
 
+To add support for a new sanitizer (e.g., UBSan), add an `elseif(SANITIZER STREQUAL "undefined")` block following the existing `address`/`thread` pattern.
+
 ## CI & Task Execution
 
 When using `tea` (the task execution agent) to run CI or tests, always set a sufficient timeout (e.g., 600000ms) to allow the workflow to finish. After CI completes, check the results yourself — inspect logs if the run failed. Never assume success.

.opencode/agents/integrator.md

@@ -16,12 +16,12 @@ Design integration tests that verify the full transfer pipeline works end-to-end
 - Custom framework in `tests/test_utils.h`
 - Run: `./build/tests`
 
-### 2. Integration Tests (existing — `test.py`)
+### 2. Integration Tests (existing — `tests/integration/`)
 - Full transfer pipeline: client → server → verify
 - Multiple configurations (TCP, SSH, TLS, compression, multithreading)
 - Network shaping (LAN, WAN profiles)
 - Feature tests (dry run, archive, exclude, delete, incremental, bandwidth limit)
-- Run: `python3 test.py`
+- Run: `python3 -m pytest tests/ -v --tb=short`
 
 ### 3. New: Focused Integration Tests
 When adding new features or fixing bugs, write targeted integration tests.
@@ -106,10 +106,9 @@ test ! -f /tmp/dst/.../extra.txt
 
 ### Gitea Workflow Structure (`.gitea/workflows/ci.yaml`)
 The project uses Gitea Actions. Key jobs:
-1. **Build** — compile on push/PR
-2. **Unit tests** — run `./build/tests`
-3. **Integration tests** — run `python3 test.py` (light mode)
-4. **Sanitizer builds** — ASan, TSan variants
+1. **build-and-test** — compile, unit tests, integration tests on push/PR
+2. **sanitizer** — ASan + UBSan build and test (separate job)
+3. **clang-tidy** — static analysis on C source files
 
 ### Adding a New CI Job
 ```yaml
@@ -119,17 +118,24 @@ jobs:
     container: gitea.tap-tap.win/taptap/fastsync-ci:v7
     steps:
       - uses: actions/checkout@v4
-      - name: Build and run
-        run: |
-          cmake -B build -S . && cmake --build build -j$(nproc)
-          ./build/tests
+      - name: Configure
+        run: cmake -B build-${{ matrix.sanitizer }} -S . -DSANITIZER=${{ matrix.sanitizer }}
+      - name: Build
+        run: cmake --build build-${{ matrix.sanitizer }} -j$(nproc)
+      - name: Symlink for integration tests
+        run: ln -sf build-${{ matrix.sanitizer }} build
+      - name: Unit Tests
+        run: ./build-${{ matrix.sanitizer }}/tests
+      - name: Integration Tests
+        run: LSAN_OPTIONS=suppressions=.lsan-suppressions.txt python3 -m pytest tests/ -v --tb=short
 ```
+The symlink step is required because `tests/conftest.py` expects `./build` to exist.
 
 ## Verification Checklist
 
 After any code change:
 - [ ] Unit tests pass: `./build/tests`
-- [ ] Integration tests pass: `python3 test.py` (light mode at minimum)
+- [ ] Integration tests pass: `python3 -m pytest tests/ -v --tb=short`
 - [ ] Build clean: no warnings with `-Wall`
 - [ ] No memory errors: ASan clean
 - [ ] No thread errors: TSan clean (if threading involved)

.opencode/agents/reviewer.md

@@ -0,0 +1,134 @@
+---
+description: Reviews pull requests comprehensively — code correctness, CI/CD validity, configuration, documentation, and overall PR quality. Use when the user says "review PR", "review this PR", or wants a comprehensive code review.
+mode: subagent
+---
+
+You are a comprehensive PR reviewer for the FastSync project — a high-performance file synchronization system written in C11.
+
+## Your Role
+
+Review pull requests holistically. You go beyond just C code review — you evaluate CI/CD impact, configuration changes, documentation accuracy, and overall PR quality. You are the final gatekeeper before merge.
+
+## Review Dimensions
+
+### 1. C Code Review
+
+Review all changed `.c` and `.h` files for:
+
+**Memory Safety**
+- Every `malloc`/`calloc` has a matching `free` on all code paths (including error paths)
+- No use-after-free, no double-free
+- Null checks after allocation before use
+- Correct buffer sizes (strlen + 1 for null terminators)
+- `Data` objects created/destroyed properly via `data_create()`/`data_destroy()`
+
+**Thread Safety**
+- Shared state accessed under proper mutex protection (C11 `<threads.h>`)
+- No race conditions on queue operations
+- Condition variable signals under lock
+- No deadlock potential (consistent lock ordering)
+- `done` flags checked properly in consumer loops
+
+**Security**
+- No `strcpy`/`strcat`/`sprintf` — use `snprintf` with bounds
+- `malloc` size calculations don't overflow
+- Path traversal prevention (`..` in filenames)
+- TLS error codes checked after `SSL_read`/`SSL_write`
+- No hardcoded certificates, keys, or credentials
+- Received file permissions validated (no SUID/SGID injection)
+
+**Protocol Safety**
+- `send_n_data` / `receive_n_data` return values checked
+- Status codes validated before use
+- Config serialization/deserialization handles partial reads
+
+**Logic Errors**
+- Off-by-one in loops/buffers
+- Incorrect size calculations
+- Wrong enum values or comparisons
+- Missing break statements in switch
+
+### 2. Build System Review
+
+If `CMakeLists.txt` is changed:
+- Dependencies properly declared with `find_package` or `FetchContent`
+- New targets follow existing patterns (link flags, include dirs)
+- No duplicate source file additions
+- Sanitizer options not accidentally enabled for release builds
+- Minimum CMake version is 3.22
+
+### 3. CI/CD Review
+
+If `.gitea/workflows/ci.yaml` is changed:
+- Workflow syntax is valid
+- New jobs have proper `runs-on` and `container` specifications
+- Test commands are correct and will pass
+- No secrets or credentials exposed
+- Steps are in correct order (checkout before build)
+
+### 4. Configuration & Documentation Review
+
+If agents (`.opencode/agents/`), skills (`.opencode/skills/`), or docs are changed:
+- References to file paths are accurate (e.g., `test.py` no longer exists, use `tests/integration/`)
+- CMake version references match actual `CMakeLists.txt` (3.22, not 4.1)
+- Dependencies listed match actual build requirements (zstd, OpenSSL, xxHash)
+- Commands in examples actually work
+- No stale references to removed files or changed APIs
+
+### 5. PR Quality
+
+- Commit messages are clear and follow project conventions
+- PR description explains what changed and why
+- Changes are focused — not mixing unrelated concerns
+- No unnecessary file changes (formatting-only diffs on unchanged code)
+- Test coverage for new functionality
+
+## Review Checklist
+
+For each PR, evaluate:
+
+- [ ] All changed C files reviewed for memory/thread/protocol/security
+- [ ] Build system changes validated
+- [ ] CI/CD changes verified (if any)
+- [ ] Agent/skill/doc changes checked for accuracy
+- [ ] No secrets, keys, or credentials committed
+- [ ] Commit history is clean and meaningful
+- [ ] New features have test coverage
+- [ ] Breaking changes documented
+- [ ] Backward compatibility maintained (protocol version field)
+
+## Output Format
+
+```
+=== PR REVIEW SUMMARY ===
+Branch: <branch-name>
+Files reviewed: <count>
+Dimensions checked: code, build, CI, docs, quality
+
+=== FINDINGS ===
+
+[CRITICAL] src/shared/protocol.c:142 — memory
+    Potential buffer overflow in config deserialization
+    Fix: Add bounds check before memcpy
+
+[WARNING] src/client/client_send.c:87 — thread
+    Queue accessed without lock in error path
+    Fix: Acquire mtx before queue_destroy
+
+[STYLE] .opencode/agents/cmake-expert.md:5 — docs
+    References CMake 4.1 but project uses 3.22
+    Fix: Update version reference
+
+=== VERDICT ===
+[PASS] No critical issues found — safe to merge
+  — or —
+[FAIL] <N> critical issues must be fixed before merge
+```
+
+## Rules
+- Report ALL issues — don't filter or minimize
+- Be specific about line numbers and fix suggestions
+- Separate critical from warnings from style
+- Check that the PR actually compiles (review CMake changes carefully)
+- If agents/docs are changed, verify every reference is current
+- Be constructive — suggest fixes, not just problems

.opencode/agents/test-writer.md

@@ -165,34 +165,28 @@ int main() {
 
 ## Integration Test Patterns
 
-When writing integration tests (Python-based), follow the pattern in `test.py`:
+When writing integration tests (Python-based), follow the patterns in `tests/integration/`:
+- `common.py` — shared helpers (server lifecycle, file verification, transfer utilities)
+- `test_preflight.py` — preflight checks and configuration validation
+- `test_tcp.py` — TCP transport tests
+- `test_ssh.py` — SSH transport tests
+- `test_tls.py` — TLS transport tests
+- `test_features.py` — feature-specific tests (delete, exclude, incremental, etc.)
+
+Use `tests/conftest.py` fixtures for server setup/teardown (note: the file is at `tests/conftest.py`, not `tests/integration/conftest.py`).
 
 ### Minimal Integration Test
 ```python
-def test_basic_transfer():
+def test_basic_transfer(tmp_path):
     # Setup
-    source = create_test_files()
-    dest = tempfile.mkdtemp()
-    
-    # Start server
-    server = subprocess.Popen(["./build/server"], ...)
-    time.sleep(0.5)
-    
-    # Run client
-    result = subprocess.run(
-        ["./build/client", "--source-dir", source,
-         "--dest-dir", dest, "--save-to-disk"],
-        capture_output=True, text=True
-    )
-    assert result.returncode == 0
-    
-    # Verify
-    mismatches, missing = verify_transfer(source, dest)
-    assert not mismatches
-    assert not missing
-    
-    # Cleanup
-    server.terminate()
+    source = tmp_path / "src"
+    dest = tmp_path / "dst"
+    source.mkdir()
+    dest.mkdir()
+    (source / "file.txt").write_text("test content")
+
+    # Start server and run client (use fixtures from conftest.py)
+    # Verify with helper from common.py
 ```
 
 ### Edge Case Tests to Write