Artifact f384583fd684ac83626fe6740b2706bb8336ad3416fa0c001f70c5cb45fa233c:
- File
CHANGELOG.md
— part of check-in
[ad09ba3d97]
at
2026-07-19 18:27:06
on branch trunk
— fix: give Timeline its own result type so an Ancestry cursor cannot compile into it (#78)
* fix: give Timeline its own result type so an Ancestry cursor cannot compile into it
LogEntry (Ancestry's result type) carried a Cursor field that was always the zero value on Ancestry entries — structurally identical to a legitimate Timeline first-page call. Feeding it into TimelineOpts.After silently paginated from page one forever with no error; documenting the field as invalid on Ancestry entries did nothing to stop it, because the zero cursor cannot be told apart from a valid first-call state even in principle.
Split the shared type instead of adding a runtime guard: LogEntry loses Cursor entirely and remains Ancestry's result type, while a new TimelineEntry (embeds LogEntry, adds Cursor) becomes Timeline's result type. An Ancestry entry's cursor can no longer be obtained at all, so passing one to Timeline is now a compile error rather than a documented hazard. Applied the same split to the internal manifest.LogEntry / manifest.TimelineEntry pair Timeline and Ancestry are built on.
Breaking change; CHANGELOG documents the migration.
* doc: warn against hand-assembling TimelineEntry from an Ancestry LogEntry
Review found the one remaining escape hatch: TimelineEntry{LogEntry: someAncestryEntry} compiles with a zero-value Cursor, which Timeline reads as "start from newest" rather than an error. No library path produces that value — it requires deliberately embedding an Ancestry LogEntry into a hand-built TimelineEntry — but flag it at the type so whoever does that gets the warning where they're typing. (user: [email protected], size: 6329) [annotate] [blame] [check-ins using]
Changelog
All notable changes to this project will be documented in this file.
The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.
[Unreleased]
Changed
- Breaking:
CloneOpts.ProjectCodeandCloneOpts.ServerCodehave been removed. Neither was ever wired to anything —Cloneaccepted both fields but never forwarded them to the internal clone path, so setting either had no effect and gave no error. The internal clone options struct has no matching fields at all, so wiring them would mean designing semantics first (is a caller-supplied code a validation assertion or an identity override?) and no caller has asked for that.CloneResult.ProjectCodeandCloneResult.ServerCodeare unrelated and unaffected — they continue to report both, populated from the remote via the clone protocol negotiation, which is the only place they meaningfully originate. - Breaking:
UpdateOpts.Forcehas been removed. It was never wired to anything —Checkout.Updateaccepted the field but never forwarded it to the internal update path, so setting it had no effect and gave no error. Deleting it is honest about what the API actually does; real forcing semantics forUpdatecan be designed and added later as a new, deliberately-wired field if a caller needs them.ExtractOpts.Forceis unrelated and unaffected — it is fully wired and unchanged. - Breaking:
Checkout.Updatenow returns(UpdateResult, error)instead of a bareerror. The internal 3-way merge already tracked which files were written, removed, and left with conflict markers; the old signature discarded all of it, so a caller could not tell a clean update from one that silently wrote<<<<<<<conflict markers into working-tree files.UpdateResult.Conflictedlists the paths that were merged but not cleanly — this is a successful update (err == nil), not an error; a genuine failure still returns a non-nilerrorwith a zero-valueUpdateResult.Checkout.Extractis unchanged. - Breaking:
Repo.Timelinenow enumerates the repository'seventtable newest-first (every event kind by default, or a single kind viaTimelineOpts.Type), matching canonicalfossil timeline. The previous behavior — a first-parent walk from a required start rid — is preserved under a new, honestly-named method,Repo.Ancestry(LogOpts). The oldRepo.Timeline(LogOpts)was actually an ancestry walk masquerading as an enumeration: it never visited a second parent or a sibling branch head, so it silently omitted any check-in that wasn't a first-parent ancestor of the given start rid. There is no deprecated shim; callers of the oldTimelineshould switch toAncestryif they want the walk, or adopt the newTimeline(TimelineOpts)if they want a full enumeration. LogEntrygains aKindfield (EventKind) identifying which ofevent.type's six kinds (ci,e,f,g,t,w) an entry is.Parentsis only populated forKind == EventKindCheckin.- Breaking:
Repo.Timelineorders by(mtime DESC, rid DESC), a total order with rid as a true tie-break at exact mtime equality — a deliberate improvement over canonical fossil's baremtime DESCwith no tie-break, which can repeat or skip rows at a page boundary. Pagination uses a new opaqueCursortype: take one from a returnedLogEntry.Cursorand pass it back asTimelineOpts.Afterto resume immediately after that entry.TimelineOpts.Before time.TimeandTimelineOpts.After FslIDare deleted, not deprecated — callers constructing either field will fail to compile.Cursor's representation is intentionally hidden — it can only be obtained from aLogEntry, never built from a timestamp and a rid by hand, because a hand-built cursor derived from a roundedtime.Timeis not guaranteed to match its row exactly, which is what reintroduces skipped or duplicated rows at a page boundary in the first place. - Breaking:
LogEntryno longer has aCursorfield, andRepo.Timelinenow returns[]TimelineEntryinstead of[]LogEntry.LogEntryisRepo.Ancestry's result type; its cursor was always the zero value, which is structurally identical to a legitimate Timeline first-page call — so feeding anAncestryentry's cursor intoTimelineOpts.Aftersilently paginated from page one forever with no error, and documenting the field as invalid onAncestryentries did nothing to stop it.TimelineEntry(which embedsLogEntryand addsCursor Cursor) is nowRepo.Timeline's result type, so the cursor lives only on the type that has one to give. Callers that readentry.Cursor,entry.UUID,entry.User, etc. off aRepo.Timelineresult need no source change — those fields are still reachable throughTimelineEntry's embeddedLogEntry. Callers that stored aRepo.Timelineresult as[]LogEntry(rather than letting:=infer the type, or using[]TimelineEntry) will fail to compile.
[0.1.0] - 2026-04-20
Initial open-source release of libfossil, a pure-Go implementation of the
Fossil SCM that reads and writes the same .fossil SQLite repository format.
Added
- Repository lifecycle: create new repos and clone from existing ones.
- Working-tree operations: checkout and checkin.
- Timeline traversal over commits and events.
- Merge and rebase primitives.
- Diff and annotate (blame) over tracked content.
- Manifest parsing and content-addressed blob storage.
- Sync protocol client/server for pulling and pushing between repos.
- Observer interfaces for sync and checkout, allowing external hooks into both network sync events and working-tree state transitions.
- SQLite driver abstraction with support for both
modernc.org/sqlite(pure Go) andncruces/go-sqlite3(cgo-free, wasm-based) backends. - Deterministic simulation test harness with BUGGIFY-style fault injection for exercising concurrency and failure paths.
- OpenTelemetry observer provided as a separate submodule to keep the core dependency footprint small.
wasip1/wasmbuild target for runninglibfossilunder WASI runtimes.