zit 0.3.22

zit 0.3.22 reads a private repository. clone and pull authenticate the way push and sync already did, and a clone learns to sign its login the way fossil's does.

No artifact, tag namespace, sync message, or on-disk repository format changed. Two verbs gained --user and --password; a user@ in a remote URL now counts for every verb that syncs.

clone and pull send a login card

Only push and sync derived a shared secret and signed a login card. clone and pull sent nothing, so a private repository on a forge that gates reads was unreadable by the account that owned it. The forge's answer to an anonymous read of a private repository is a deliberate 404, since a 403 would confirm the repository exists, so the operator saw "not found" for a repository they administer, with nothing pointing at credentials. A stored login from an earlier push sat on disk while the next pull read anonymously.

The login is now resolved the same way for all four verbs, in this order: --user, the user@ component of the remote URL (given or saved), then the login a previous authenticated round stored in the repository. None of the three means anonymous, as before. The password comes from --password, $ZIT_PASSWORD, or a no-echo prompt on a terminal; a stored login needs none. A freshly derived secret is stored only after the peer accepted it.

A clone signs from round one, after a refusal

A clone cannot sign its first request: the shared secret is derived from the project code, and the project code is what the first reply teaches. fossil's client therefore sends no login on a clone's first round, and its server, refusing an anonymous read, still answers with the project code and an error card. The fossil client discards that error on round zero, derives the secret from the code it was just taught, and sends the clone card again with a login.

zit's clone now does the same. It holds the name and password until the round-zero reply names the project code, then signs every later round. A refused round zero that taught the project code is the retry point rather than a failure; a refused round zero with no login to retry with is still the failure it was, reported as the peer's words. The login the peer accepted is stored in the new repository, so the next pull or push from that clone authenticates without being told.

Verification

• Parser tests for --user and --password on pull and clone, and for the user@ extraction, which never yields a URL password.
• Sync-core tests: a clone with a pending login sends no round-zero card and a login card on the next round; a refused anonymous round zero that taught the project code is retried with the login, and without a login it aborts.
• A new fossil interop smoke scenario: a fossil repository with read stripped from nobody and anonymous refuses an anonymous zit clone, serves one with --user, and a bare zit pull from that clone reuses the stored login. Seventeen scenarios now run against a real fossil.

Compatibility

• No on-disk repository or wire format changed; Fossil RFC revision 00 remains the target.
• A repository that stores a login is written owner-only, as a push already did.
• Anonymous clone and pull behave exactly as before when no user is given, no user@ is in the URL, and no login is stored.

Qualification

zig fmt --check, zig build test, e2e, smoke, muscle, git-import-e2e, git-export-e2e, dst, and cross, plus the three-runner CI battery.