fix(git-protocol): frame receive-pack bodies by pkt-line structure

ceres/src/application/api_service/mono/sync.rs

@@ -207,9 +207,12 @@ impl MonoApiService {
             .git_receive_pack_stream(
                 &state,
                 commands,
-                into_pack_byte_stream(tokio_stream::once(Ok::<Bytes, std::convert::Infallible>(
+                Some(into_pack_byte_stream(tokio_stream::once(Ok::<
+                    Bytes,
+                    std::convert::Infallible,
+                >(
                     Bytes::from(pack_data),
-                ))),
+                )))),
             )
             .await
             .map_err(|e| MegaError::Other(format!("{e}")))?;

ceres/src/application/code_edit/post_receive/import.rs

@@ -28,9 +28,27 @@ pub async fn dispatch_import_receive_pack_finalized(
     unpack_redlock: Arc<RedLock>,
     extra_timings: Arc<Mutex<Vec<(String, u128)>>>,
 ) -> Result<(), MegaError> {
-    let commit_id = match commands.iter().find(|c| c.ref_type == RefTypeEnum::Branch) {
+    // The attach commit is sourced from the pushed branch tip; deletions carry
+    // the zero id and resolve no commit. A push whose branch commands are all
+    // deletions has no content to attach (the repo is necessarily attached
+    // already, or its refs would not exist), so just apply the deletions.
+    // Commands already rejected by the protocol layer keep their ng status and
+    // are excluded here; their report lines were already emitted upstream.
+    let branch_cmds: Vec<&RefCommand> = commands
+        .iter()
+        .filter(|c| c.ref_type == RefTypeEnum::Branch && c.status == "ok")
+        .collect();
+    let attach_source = branch_cmds
+        .iter()
+        .find(|c| c.command_type != CommandType::Delete);
+    let commit_id = match attach_source {
         Some(cmd) => cmd.new_id.clone(),
-        None => return Ok(()),
+        None => {
+            if branch_cmds.is_empty() {
+                return Ok(());
+            }
+            return apply_branch_deletions(&storage, repo_id, &branch_cmds).await;
+        }
     };
 
     let mono_storage = storage.mono_storage();
@@ -83,10 +101,7 @@ pub async fn dispatch_import_receive_pack_finalized(
 
         let txn = storage.begin_db_transaction().await?;
         let git_db = storage.git_db_storage();
-        for cmd in &commands {
-            if cmd.ref_type != RefTypeEnum::Branch {
-                continue;
-            }
+        for &cmd in &branch_cmds {
             match cmd.command_type {
                 CommandType::Create => {
                     git_db
@@ -192,3 +207,20 @@ pub async fn dispatch_import_receive_pack_finalized(
         "attach_to_monorepo_parent: exceeded retry limit for concurrent root updates".into(),
     ))
 }
+
+/// Applies deletion-only branch commands. The monorepo root ref is untouched,
+/// so the root update lock and attach-retry loop are not needed.
+async fn apply_branch_deletions(
+    storage: &Storage,
+    repo_id: i64,
+    deletions: &[&RefCommand],
+) -> Result<(), MegaError> {
+    let txn = storage.begin_db_transaction().await?;
+    let git_db = storage.git_db_storage();
+    for cmd in deletions {
+        git_db
+            .remove_ref_in_txn(repo_id, &cmd.ref_name, &txn)
+            .await?;
+    }
+    txn.commit().await.map_err(MegaError::Db)
+}

ceres/src/transport/pack/monorepo.rs

@@ -39,7 +39,7 @@ use crate::{
     infra::cache::GitObjectCache,
     transport::{
         pack::RepoHandler,
-        protocol::import_refs::{RefCommand, Refs},
+        protocol::import_refs::{CommandType, RefCommand, Refs},
     },
 };
 
@@ -479,7 +479,7 @@ impl MonoRepo {
             .clone();
         let txn = self.storage.begin_db_transaction().await?;
         for cmd in &cmds {
-            if cmd.ref_type == RefTypeEnum::Branch {
+            if cmd.ref_type == RefTypeEnum::Branch && cmd.command_type != CommandType::Delete {
                 self.apply_cl_mega_ref_for_push_command(cmd, Some(&txn))
                     .await?;
             }

ceres/src/transport/protocol/mod.rs

@@ -11,7 +11,7 @@ use common::{
     errors::{MegaError, ProtocolError},
     utils::nested_import_repo_conflict_message,
 };
-use import_refs::RefCommand;
+use import_refs::{CommandType, RefCommand};
 use jupiter::redis::lock::RedLock;
 use repo::Repo;
 use tokio::sync::RwLock;
@@ -201,6 +201,28 @@ impl SmartSession {
                 }
             };
 
+            // Deleting the current default branch would leave the repository
+            // with a dangling HEAD: ref discovery advertises a zero id and
+            // import APIs unwrap the now-missing default ref. Reject before
+            // any persistence (tags included) happens.
+            if let Some(default_ref) = storage
+                .get_ref(repo.repo_id)
+                .await
+                .map_err(|e| ProtocolError::InvalidInput(format!("failed to load refs: {e}")))?
+                .into_iter()
+                .find(|r| r.default_branch)
+                && commands.iter().any(|c| {
+                    c.ref_type == RefTypeEnum::Branch
+                        && c.command_type == CommandType::Delete
+                        && c.ref_name == default_ref.ref_name
+                })
+            {
+                return Err(ProtocolError::InvalidInput(format!(
+                    "cannot delete the current default branch {}",
+                    default_ref.ref_name
+                )));
+            }
+
             let unpack_redlock = Arc::new(RedLock::new(
                 state.git_object_cache.connection.clone(),
                 // Serialize monorepo root mega_refs update across concurrent import attaches.
@@ -231,7 +253,13 @@ impl SmartSession {
                 username: self.auth.username.clone(),
                 command_list: Mutex::new(commands.clone()),
             };
-            if let Some(command) = commands.iter().find(|x| x.ref_type == RefTypeEnum::Branch) {
+            // Metadata must describe a surviving change: a deletion's zero
+            // new_id would otherwise flow into finalize events even when the
+            // deletion itself is rejected and other updates land.
+            if let Some(command) = commands
+                .iter()
+                .find(|x| x.ref_type == RefTypeEnum::Branch && x.command_type != CommandType::Delete)
+            {
                 res.from_hash = command.old_id.clone();
                 res.to_hash = command.new_id.clone();
                 res.base_branch = command

ceres/src/transport/protocol/smart.rs

@@ -15,7 +15,7 @@ use crate::{
         pack::PackByteStream,
         protocol::{
             Capability, ServiceType, SideBind, SmartSession, TransportProtocol, ZERO_ID,
-            import_refs::RefCommand,
+            import_refs::{CommandType, RefCommand},
         },
     },
 };
@@ -226,7 +226,7 @@ impl SmartSession {
         &mut self,
         state: &TransportRuntime,
         commands: Vec<RefCommand>,
-        data_stream: PackByteStream,
+        pack_stream: Option<PackByteStream>,
     ) -> Result<Bytes, ProtocolError> {
         let t0 = Instant::now();
         let mut timings_ms: BTreeMap<String, u128> = BTreeMap::new();
@@ -238,21 +238,60 @@ impl SmartSession {
             .repo_handler_with_commands(state, commands.clone())
             .await?;
         let is_monorepo = repo_handler.is_monorepo();
-        //1. unpack progress
+        // A deletion's new id is the zero id and monorepo state only advances
+        // through CL merges, so there is no commit to materialize a ref update
+        // from. Reject such commands up front (import repos do support
+        // deletion) instead of failing later with opaque zero-id lookup errors.
+        if is_monorepo {
+            for command in commands.iter_mut() {
+                if command.command_type == CommandType::Delete {
+                    command.failed(format!(
+                        "deleting {} is not supported on monorepo",
+                        command.ref_name
+                    ));
+                }
+            }
+        }
+        // A pack-less push carries no objects, so any surviving non-deletion
+        // command must target an object the server already stores; real git
+        // clients never send otherwise ("everything up-to-date" sends no
+        // request at all). Fail such commands here rather than letting
+        // finalization trip over the missing object later.
+        if pack_stream.is_none() {
+            for command in commands.iter_mut() {
+                if command.command_type != CommandType::Delete && command.status == "ok" {
+                    let exists = repo_handler.check_commit_exist(&command.new_id).await;
+                    if !exists {
+                        command.failed(format!("target object {} not found", command.new_id));
+                    }
+                }
+            }
+        }
+        // 1. unpack progress. Pack-less pushes (e.g. ref deletions) carry no packfile
+        //    after the command flush, so unpack is skipped entirely.
         let t_unpack = Instant::now();
-        let receiver = repo_handler
-            .unpack_stream(&state.storage.config().pack, data_stream)
-            .await?;
+        let receiver = match pack_stream {
+            Some(stream) => Some(
+                repo_handler
+                    .unpack_stream(&state.storage.config().pack, stream)
+                    .await?,
+            ),
+            None => None,
+        };
         timings_ms.insert(
             "unpack_stream_ms".to_string(),
             t_unpack.elapsed().as_millis(),
         );
 
         let t_receiver = Instant::now();
-        let unpack_result = repo_handler
-            .clone()
-            .receiver_handler(receiver.0, receiver.1)
-            .await;
+        let unpack_result = if let Some((receiver, rx_pack_id)) = receiver {
+            repo_handler
+                .clone()
+                .receiver_handler(receiver, rx_pack_id)
+                .await
+        } else {
+            Ok(())
+        };
         timings_ms.insert(
             "receiver_handler_ms".to_string(),
             t_receiver.elapsed().as_millis(),
@@ -269,7 +308,11 @@ impl SmartSession {
         //    mono and import both persist branch refs inside `finalize_receive_pack`.
         for command in commands.iter_mut() {
             if command.ref_type == RefTypeEnum::Tag {
-                // just update if refs type is tag
+                // Already-rejected commands (e.g. monorepo deletions) keep
+                // their up-front failure reason instead of being re-processed.
+                if command.status != "ok" {
+                    continue;
+                }
                 if let Err(e) = repo_handler.update_refs(command).await {
                     command.failed(e.to_string());
                 }
@@ -299,7 +342,15 @@ impl SmartSession {
 
         let mut finalize_ms: Option<u128> = None;
         let mut bind_ms: Option<u128> = None;
-        if !unpack_failed {
+        // Skip finalize when nothing survives to finalize: every command
+        // rejected up front (e.g. delete-only monorepo pushes), or a monorepo
+        // push carrying only tag mutations — monorepo finalize events describe
+        // a branch tip and fail against an empty one. Import finalization is
+        // safe without branches (its dispatch returns early) and keeps running.
+        let has_branch_work = commands
+            .iter()
+            .any(|c| c.ref_type == RefTypeEnum::Branch && c.status == "ok");
+        if !unpack_failed && (!is_monorepo || has_branch_work) {
             let t_finalize = Instant::now();
             if let Err(e) = repo_handler.finalize_receive_pack().await {
                 let msg = e.to_string();