hanna/fabrica

feat(git,web,cli): smart-HTTP pack transport and post-receive hook

6055231 · hanna committed on 2026-07-25

Add the read-only smart-HTTP git transport over a single shared spawn
path (git::pack::spawn), used now by HTTP and later by SSH.

- git::pack spawns upload-pack/receive-pack/upload-archive with the §3.3
  isolation env (GIT_DIR, GIT_TERMINAL_PROMPT=0, GIT_CONFIG_NOSYSTEM=1,
  HOME, and the FABRICA_* identity for hooks), piped stdio, kill_on_drop.
- web serves GET .git/info/refs (framed advertisement) and POST
  git-upload-pack: authorize BEFORE spawning; the small request is
  buffered (gunzipped if needed) and the pack response streams from the
  child's stdout, never buffered. Anonymous access to a private repo gets
  401 Basic; an authenticated stranger gets 404. HTTP push returns a
  deliberate 403 naming the SSH URL.
- fabrica hook post-receive updates pushed_at/size_bytes (store gains
  record_push), keyed by the GIT_DIR basename, always exiting 0.

Verified end-to-end: anonymous public clone, 401 private, Basic private
clone, and the 403 push all behave per spec.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

Cargo.lock +4 −0

Cargo.toml +6 −0

crates/cli/src/hook_cmd.rs +96 −0

crates/cli/src/lib.rs +9 −0

crates/git/Cargo.toml +3 −0

crates/git/src/lib.rs +1 −0

crates/git/src/pack.rs +176 −0

crates/store/src/repos.rs +20 −0

crates/web/Cargo.toml +3 −0

crates/web/src/git_http.rs +342 −0

crates/web/src/lib.rs +7 −1

crates/web/src/repo.rs +22 −1

docs/decisions.md +26 −0

  "ssh-key",
  "tempfile",
  "thiserror 2.0.19",
+ "tokio",
+]
 [[package]]
  "auth",
  "axum",
  "axum-extra",
+ "base64",
  "comrak",
  "config",
+ "flate2",
  "git",
  "highlight",
  "mail",
  "thiserror 2.0.19",
  "time",
  "tokio",
+ "tokio-util",
  "tower",
  "tower-http",
  "tracing",

     "net",
     "time",
     "fs",
+    "process",
+    "io-util",
 ] }
 tempfile = "3"
 # Git object model (refs, trees, blobs, commits, diffs, signatures). Linked
 # Markdown rendering (GFM) + HTML sanitization for READMEs and comments.
 comrak = { version = "0.54", default-features = false }
 ammonia = "4"
+# Streaming the pack subprocess stdout into the HTTP response body; gunzip for
+# gzip-encoded upload-pack requests.
+tokio-util = { version = "0.7", features = ["io"] }
+flate2 = "1"
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter", "fmt", "json"] }

+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+//! `fabrica hook post-receive` — the git hook entry point (internal, hidden).
+//!
+//! Invoked by the `post-receive` hook the server installs at repo init. It updates
+//! `pushed_at` and `size_bytes` for the pushed repo. A hook failure **must not**
+//! reject a push git already accepted, so this always exits `0`, logging loudly on
+//! error.
+use std::io::Read as _;
+use std::path::{Path, PathBuf};
+use std::process::ExitCode;
+use clap::Subcommand;
+use crate::context::{block_on, open_store};
+/// Actions under the hidden `fabrica hook` group.
+#[derive(Debug, Subcommand)]
+pub(crate) enum HookCommand {
+    /// Run after a push is accepted.
+    PostReceive,
+}
+/// Dispatch a hook subcommand. Always exits successfully.
+pub(crate) fn run(command: &HookCommand) -> ExitCode {
+    match command {
+        HookCommand::PostReceive => {
+            if let Err(err) = post_receive() {
+                // Loud, but non-fatal: the push has already been accepted.
+                eprintln!("fabrica hook post-receive: {err:#}");
+            }
+            ExitCode::SUCCESS
+        }
+    }
+}
+/// The fallible body of `post-receive`.
+fn post_receive() -> anyhow::Result<()> {
+    // Drain stdin (`<old> <new> <ref>` lines) so git does not see a broken pipe,
+    // even though we do not currently act per-ref.
+    let mut input = String::new();
+    std::io::stdin().read_to_string(&mut input)?;
+    let git_dir = std::env::var_os("GIT_DIR")
+        .map(PathBuf::from)
+        .or_else(|| std::env::current_dir().ok())
+        .ok_or_else(|| anyhow::anyhow!("cannot determine GIT_DIR"))?;
+    // The bare repo dir is `{id}.git`; the stem is the repo's ULID.
+    let Some(repo_id) = git_dir
+        .file_name()
+        .and_then(|n| n.to_str())
+        .and_then(|n| n.strip_suffix(".git"))
+        .filter(|id| id.len() == 26)
+    else {
+        // Not a fabrica-managed repository; nothing to do.
+        return Ok(());
+    };
+    let repo_id = repo_id.to_string();
+    let config_path = std::env::var_os("FABRICA_CONFIG").map(PathBuf::from);
+    let size = dir_size(&git_dir);
+    block_on(async move {
+        let (_config, store) = open_store(config_path.as_deref()).await?;
+        store.record_push(&repo_id, size).await?;
+        anyhow::Ok(())
+    })
+}
+/// Sum the sizes of every regular file under `dir` (an approximate on-disk size).
+fn dir_size(dir: &Path) -> i64 {
+    fn walk(dir: &Path, total: &mut u64) {
+        let Ok(entries) = std::fs::read_dir(dir) else {
+            return;
+        };
+        for entry in entries.flatten() {
+            let path = entry.path();
+            match entry.file_type() {
+                Ok(ft) if ft.is_dir() => walk(&path, total),
+                Ok(ft) if ft.is_file() => {
+                    if let Ok(meta) = entry.metadata() {
+                        *total += meta.len();
+                    }
+                }
+                _ => {}
+            }
+        }
+    }
+    let mut total = 0u64;
+    walk(dir, &mut total);
+    i64::try_from(total).unwrap_or(i64::MAX)
+}

 mod config_cmd;
 mod context;
 mod group_cmd;
+mod hook_cmd;
 mod key_cmd;
 mod prompt;
 mod repo_cmd;
         #[arg(long)]
         quiet: bool,
     },
+    /// Internal git-hook entry points (invoked by installed hooks).
+    #[command(hide = true)]
+    Hook {
+        /// The hook to run.
+        #[command(subcommand)]
+        command: hook_cmd::HookCommand,
+    },
+}
 /// The parsed request to run `fabrica serve`, handed to the serve callback the
         Command::Token { command } => token_cmd::run(command, cli.config.as_deref(), cli.json),
         Command::Migrate => admin_cmd::migrate(cli.config.as_deref()),
         Command::Doctor { quiet } => admin_cmd::doctor(cli.config.as_deref(), *quiet),
+        Command::Hook { command } => Ok(hook_cmd::run(command)),
+    }
+}

 moka = { workspace = true }
 ssh-key = { workspace = true }
 pgp = { workspace = true }
+# Async subprocess spawning for pack transport (clone/fetch/push). One code path
+# shared by the HTTP (web) and SSH transports.
+tokio = { workspace = true }
 thiserror = { workspace = true }
 # Pin the libgit2 bindings to a build that requires libgit2 <= the version
 # nixpkgs ships (1.9.4). git2 0.20's default libgit2-sys (0.18.7, bundling 1.9.6)

 //! name→path authority; [`repo_path`] is the one place that mapping is computed.
 mod attributes;
+pub mod pack;
 mod pubkey;
 mod repo;
 mod signature;

+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+//! Pack transport: the single code path that spawns `git upload-pack` /
+//! `git receive-pack` / `git upload-archive`.
+//!
+//! libgit2 has no server side of the pack protocol, so clone/fetch/push are served
+//! by spawning the `git` binary (§3.1). Both the HTTP (web) and SSH transports call
+//! [`spawn`]. **Authorization happens before the spawn — the subprocess never makes
+//! an access decision** — and both directions stream; the pack is never buffered by
+//! the transport. The child is `kill_on_drop` so a dropped request reaps it.
+use std::path::{Path, PathBuf};
+use std::process::Stdio;
+use tokio::process::{Child, Command};
+/// The git service to run.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Service {
+    /// `git upload-pack` — serves clone/fetch (read).
+    UploadPack,
+    /// `git receive-pack` — serves push (write).
+    ReceivePack,
+    /// `git upload-archive` — serves `git archive --remote`.
+    UploadArchive,
+}
+impl Service {
+    /// The `git` subcommand name.
+    fn subcommand(self) -> &'static str {
+        match self {
+            Self::UploadPack => "upload-pack",
+            Self::ReceivePack => "receive-pack",
+            Self::UploadArchive => "upload-archive",
+        }
+    }
+}
+/// Environment applied to every pack subprocess: isolation for git, plus the
+/// identity fields hooks consume.
+#[derive(Debug, Clone, Default)]
+pub struct PackEnv {
+    /// `HOME` for the child (a scratch dir under `data_dir`), so git never reads a
+    /// real user's global config.
+    pub home: PathBuf,
+    /// The client's `Git-Protocol` value, passed through as `GIT_PROTOCOL` when v2
+    /// was negotiated.
+    pub protocol: Option<String>,
+    /// Config path for `fabrica hook post-receive` to load (`FABRICA_CONFIG`).
+    pub config_path: Option<String>,
+    /// The authenticated user's id (`FABRICA_USER_ID`).
+    pub user_id: Option<String>,
+    /// The authenticated user's name (`FABRICA_USER_NAME`).
+    pub user_name: Option<String>,
+    /// The repository id (`FABRICA_REPO_ID`).
+    pub repo_id: Option<String>,
+    /// The SSH key id used to authenticate (`FABRICA_KEY_ID`).
+    pub key_id: Option<String>,
+}
+/// Spawn a pack service against `repo_path` with piped stdio.
+///
+/// `extra_args` are inserted before the repository path (e.g. `--stateless-rpc`,
+/// `--advertise-refs` for smart HTTP). The caller must have already authorized the
+/// request. Never interpolates into a shell — args are explicit.
+///
+/// # Errors
+///
+/// Returns the [`std::io::Error`] from spawning if the `git` binary cannot be run.
+pub fn spawn(
+    binary: &str,
+    service: Service,
+    extra_args: &[&str],
+    repo_path: &Path,
+    env: &PackEnv,
+) -> std::io::Result<Child> {
+    let mut cmd = Command::new(binary);
+    cmd.arg(service.subcommand());
+    cmd.args(extra_args);
+    cmd.arg(repo_path);
+    // Isolation (§3.3).
+    cmd.env("GIT_DIR", repo_path);
+    cmd.env("GIT_TERMINAL_PROMPT", "0");
+    cmd.env("GIT_CONFIG_NOSYSTEM", "1");
+    cmd.env("HOME", &env.home);
+    // Do not leak the parent's git environment into the child.
+    cmd.env_remove("GIT_ALTERNATE_OBJECT_DIRECTORIES");
+    cmd.env_remove("GIT_OBJECT_DIRECTORY");
+    if let Some(protocol) = &env.protocol {
+        cmd.env("GIT_PROTOCOL", protocol);
+    }
+    for (key, value) in [
+        ("FABRICA_CONFIG", &env.config_path),
+        ("FABRICA_USER_ID", &env.user_id),
+        ("FABRICA_USER_NAME", &env.user_name),
+        ("FABRICA_REPO_ID", &env.repo_id),
+        ("FABRICA_KEY_ID", &env.key_id),
+    ] {
+        if let Some(value) = value {
+            cmd.env(key, value);
+        }
+    }
+    cmd.stdin(Stdio::piped());
+    cmd.stdout(Stdio::piped());
+    cmd.stderr(Stdio::piped());
+    cmd.kill_on_drop(true);
+    cmd.spawn()
+}
+/// Encode `payload` as a single git pkt-line (`{len:04x}{payload}`). Used to frame
+/// the smart-HTTP service advertisement.
+#[must_use]
+pub fn pkt_line(payload: &str) -> String {
+    format!("{:04x}{payload}", payload.len() + 4)
+}
+/// The pkt-line flush packet.
+pub const FLUSH_PKT: &str = "0000";
+#[cfg(test)]
+mod tests {
+    #![allow(clippy::unwrap_used, clippy::expect_used)]
+    use super::*;
+    #[test]
+    fn pkt_line_frames_length() {
+        // "# service=git-upload-pack\n" is 26 bytes; framed length is 26 + 4 = 30.
+        assert_eq!(
+            pkt_line("# service=git-upload-pack\n"),
+            "001e# service=git-upload-pack\n"
+        );
+        assert_eq!(pkt_line("a"), "0005a");
+    }
+    #[tokio::test]
+    async fn spawn_upload_pack_advertises_refs_on_a_real_repo() {
+        use std::path::Path;
+        use crate::create_bare;
+        // git must be present; skip cleanly otherwise (matches the test policy).
+        if Command::new("git").arg("--version").output().await.is_err() {
+            eprintln!("skipping: git not on PATH");
+            return;
+        }
+        let dir = tempfile::tempdir().expect("tempdir");
+        let id = "01hzxk9m2n8p7q6r5s4t3v2w1x";
+        create_bare(dir.path(), id, "main", Path::new("/usr/bin/fabrica")).expect("create bare");
+        let repo_path = crate::repo_path(dir.path(), id).expect("repo path");
+        let env = PackEnv {
+            home: dir.path().to_path_buf(),
+            ..PackEnv::default()
+        };
+        let child = spawn(
+            "git",
+            Service::UploadPack,
+            &["--stateless-rpc", "--advertise-refs"],
+            &repo_path,
+            &env,
+        )
+        .expect("spawn upload-pack");
+        let output = child.wait_with_output().await.expect("wait");
+        // A fresh repo advertises capabilities even with no refs; the output is
+        // valid pkt-line data (or empty for an unborn HEAD), and the process
+        // succeeds.
+        assert!(output.status.success(), "upload-pack should exit cleanly");
+    }
+}

         Ok(updated > 0)
+    }
+    /// Record that a repository was just pushed to: stamp `pushed_at` and refresh
+    /// `size_bytes`. Called by `fabrica hook post-receive`.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn record_push(&self, repo_id: &str, size_bytes: i64) -> Result<bool, StoreError> {
+        let now = now_ms();
+        let updated = sqlx::query(
+            "UPDATE repos SET pushed_at = $1, size_bytes = $2, updated_at = $1 WHERE id = $3",
+        )
+        .bind(now)
+        .bind(size_bytes)
+        .bind(repo_id)
+        .execute(&self.pool)
+        .await?
+        .rows_affected();
+        Ok(updated > 0)
+    }
     /// Delete a repository row (cascading to collaborators). The caller is
     /// responsible for the on-disk directory — moving it to trash, or purging it.
     /// Returns `true` if a row was removed.

 mime_guess = { workspace = true }
 comrak = { workspace = true }
 ammonia = { workspace = true }
+tokio-util = { workspace = true }
+flate2 = { workspace = true }
+base64 = { workspace = true }
 time = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }

+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+//! The smart-HTTP git transport (read-only).
+//!
+//! Only clone/fetch (`upload-pack`) is served; push (`receive-pack`) returns a
+//! deliberate `403` pointing at the SSH URL (§3.3). Authorization happens **before**
+//! the `git` subprocess is spawned. The refs advertisement is small and buffered;
+//! the pack response streams straight from the child's stdout so it is never held
+//! in memory. Dumb HTTP is not implemented.
+use axum::body::Body;
+use axum::extract::{Path, State};
+use axum::http::{HeaderMap, StatusCode, header};
+use axum::response::{IntoResponse, Response};
+use axum_extra::extract::cookie::CookieJar;
+use base64::Engine as _;
+use model::{Repo, User};
+use tokio::io::AsyncWriteExt as _;
+use tokio_util::io::ReaderStream;
+use crate::AppState;
+/// Split `"repo/path.git/service..."` into the repo path and the trailing service
+/// path (`info/refs`, `git-upload-pack`, `git-receive-pack`). Also accepts the
+/// forms without `.git` is *not* supported here — callers strip that themselves.
+#[must_use]
+pub fn split_git(rest: &str) -> Option<(&str, &str)> {
+    let idx = rest.find(".git/")?;
+    Some((&rest[..idx], &rest[idx + ".git/".len()..]))
+}
+/// Handle a GET under a `.git/` path — only `info/refs?service=git-upload-pack`.
+pub async fn http_get(
+    state: &AppState,
+    jar: &CookieJar,
+    headers: &HeaderMap,
+    owner: &str,
+    repo_path: &str,
+    tail: &str,
+    service: Option<&str>,
+) -> Response {
+    if tail != "info/refs" {
+        return StatusCode::NOT_FOUND.into_response();
+    }
+    match service {
+        Some("git-upload-pack") => {}
+        Some("git-receive-pack") => return push_disabled(state, owner, repo_path),
+        _ => return StatusCode::FORBIDDEN.into_response(),
+    }
+    let repo = match authorize(state, jar, headers, owner, repo_path).await {
+        Ok(repo) => repo,
+        Err(response) => return response,
+    };
+    info_refs(state, &repo, headers).await
+}
+/// Handle a POST under a `.git/` path — `git-upload-pack` (served) or
+/// `git-receive-pack` (403).
+pub async fn pack_rpc(
+    State(state): State<AppState>,
+    jar: CookieJar,
+    headers: HeaderMap,
+    Path((owner, rest)): Path<(String, String)>,
+    body: Body,
+) -> Response {
+    let Some((repo_path, tail)) = split_git(&rest) else {
+        return StatusCode::NOT_FOUND.into_response();
+    };
+    match tail {
+        "git-upload-pack" => {}
+        "git-receive-pack" => return push_disabled(&state, &owner, repo_path),
+        _ => return StatusCode::NOT_FOUND.into_response(),
+    }
+    let repo = match authorize(&state, &jar, &headers, &owner, repo_path).await {
+        Ok(repo) => repo,
+        Err(response) => return response,
+    };
+    upload_pack_rpc(&state, &repo, &headers, body).await
+}
+/// Spawn `upload-pack --advertise-refs`, frame the output as a smart-HTTP service
+/// advertisement, and return it.
+async fn info_refs(state: &AppState, repo: &Repo, headers: &HeaderMap) -> Response {
+    let repo_dir = match git::repo_path(&state.config.storage.repo_dir, &repo.id) {
+        Ok(p) => p,
+        Err(e) => return internal(&e.to_string()),
+    };
+    let env = pack_env(state, headers, repo);
+    let child = git::pack::spawn(
+        &state.config.git.binary,
+        git::pack::Service::UploadPack,
+        &["--stateless-rpc", "--advertise-refs"],
+        &repo_dir,
+        &env,
+    );
+    let output = match child {
+        Ok(child) => match child.wait_with_output().await {
+            Ok(out) => out,
+            Err(e) => return internal(&e.to_string()),
+        },
+        Err(e) => return internal(&e.to_string()),
+    };
+    let mut framed = git::pack::pkt_line("# service=git-upload-pack\n").into_bytes();
+    framed.extend_from_slice(git::pack::FLUSH_PKT.as_bytes());
+    framed.extend_from_slice(&output.stdout);
+    (
+        [
+            (
+                header::CONTENT_TYPE,
+                "application/x-git-upload-pack-advertisement",
+            ),
+            (header::CACHE_CONTROL, "no-cache"),
+        ],
+        framed,
+    )
+        .into_response()
+}
+/// Spawn `upload-pack --stateless-rpc`, feed it the (buffered, possibly gunzipped)
+/// request, and stream its stdout back as the response body.
+async fn upload_pack_rpc(
+    state: &AppState,
+    repo: &Repo,
+    headers: &HeaderMap,
+    body: Body,
+) -> Response {
+    let repo_dir = match git::repo_path(&state.config.storage.repo_dir, &repo.id) {
+        Ok(p) => p,
+        Err(e) => return internal(&e.to_string()),
+    };
+    // The upload-pack request (the client's "wants") is small; buffer it, and
+    // decompress if the client gzipped it. The large pack is the *response*, which
+    // is streamed below.
+    let Ok(raw) = axum::body::to_bytes(body, 16 * 1024 * 1024).await else {
+        return (StatusCode::BAD_REQUEST, "request body too large").into_response();
+    };
+    let request = if header_eq(headers, header::CONTENT_ENCODING, "gzip") {
+        match gunzip(&raw) {
+            Ok(data) => data,
+            Err(_) => return (StatusCode::BAD_REQUEST, "invalid gzip body").into_response(),
+        }
+    } else {
+        raw.to_vec()
+    };
+    let env = pack_env(state, headers, repo);
+    let mut child = match git::pack::spawn(
+        &state.config.git.binary,
+        git::pack::Service::UploadPack,
+        &["--stateless-rpc"],
+        &repo_dir,
+        &env,
+    ) {
+        Ok(child) => child,
+        Err(e) => return internal(&e.to_string()),
+    };
+    let (Some(mut stdin), Some(stdout)) = (child.stdin.take(), child.stdout.take()) else {
+        return internal("failed to capture pack subprocess stdio");
+    };
+    // Feed the request, then own the child until it exits (or the client
+    // disconnects, closing stdout and making upload-pack exit on write).
+    tokio::spawn(async move {
+        let _ = stdin.write_all(&request).await;
+        let _ = stdin.shutdown().await;
+        drop(stdin);
+        let _ = child.wait().await;
+    });
+    let stream = ReaderStream::new(stdout);
+    (
+        [(header::CONTENT_TYPE, "application/x-git-upload-pack-result")],
+        Body::from_stream(stream),
+    )
+        .into_response()
+}
+/// Resolve and authorize a repo for pack access. On failure returns the response
+/// to send: `401` (anonymous, credentials needed) or `404` (missing, or an
+/// authenticated stranger — no existence leak).
+#[allow(clippy::result_large_err)] // the Err is a ready-to-send Response by design.
+async fn authorize(
+    state: &AppState,
+    jar: &CookieJar,
+    headers: &HeaderMap,
+    owner: &str,
+    repo_path: &str,
+) -> Result<Repo, Response> {
+    let owner_user = state.store.user_by_username(owner).await.ok().flatten();
+    let repo = match owner_user {
+        Some(ref u) => state
+            .store
+            .repo_by_owner_path(&u.id, repo_path)
+            .await
+            .ok()
+            .flatten(),
+        None => None,
+    };
+    let Some(repo) = repo else {
+        return Err(StatusCode::NOT_FOUND.into_response());
+    };
+    let viewer = authenticate(state, jar, headers).await;
+    let viewer_id = viewer.as_ref().map(|u| auth::Viewer {
+        id: u.id.clone(),
+        is_admin: u.is_admin,
+    });
+    let collaborator = match &viewer {
+        Some(u) => state
+            .store
+            .collaborator_permission(&repo.id, &u.id)
+            .await
+            .ok()
+            .flatten()
+            .and_then(|p| auth::Permission::parse(&p)),
+        None => None,
+    };
+    let access = auth::access(
+        viewer_id.as_ref(),
+        &repo,
+        collaborator,
+        state.config.instance.allow_anonymous,
+    );
+    if access >= auth::Access::Read {
+        Ok(repo)
+    } else if viewer.is_none() {
+        Err(unauthorized())
+    } else {
+        // An authenticated stranger: 404, not 403, so existence never leaks.
+        Err(StatusCode::NOT_FOUND.into_response())
+    }
+}
+/// Authenticate a pack request via the session cookie or HTTP Basic (username +
+/// password). Returns the user, or `None` for anonymous.
+async fn authenticate(state: &AppState, jar: &CookieJar, headers: &HeaderMap) -> Option<User> {
+    if let Some(cookie) = jar.get(&state.config.auth.cookie_name)
+        && let Ok(Some(user)) = state
+            .store
+            .user_for_session(&auth::session_id(cookie.value()))
+            .await
+    {
+        return Some(user);
+    }
+    let (username, password) = parse_basic(headers)?;
+    let user = state
+        .store
+        .user_by_username(&username)
+        .await
+        .ok()
+        .flatten()?;
+    if user.disabled_at.is_none()
+        && user.password_hash.is_some()
+        && auth::verify_password(&password, user.password_hash.as_deref())
+    {
+        Some(user)
+    } else {
+        None
+    }
+}
+/// Parse an HTTP Basic `Authorization` header into `(username, password)`.
+fn parse_basic(headers: &HeaderMap) -> Option<(String, String)> {
+    let value = headers.get(header::AUTHORIZATION)?.to_str().ok()?;
+    let encoded = value.strip_prefix("Basic ")?;
+    let decoded = base64::engine::general_purpose::STANDARD
+        .decode(encoded.trim())
+        .ok()?;
+    let text = String::from_utf8(decoded).ok()?;
+    let (user, pass) = text.split_once(':')?;
+    Some((user.to_string(), pass.to_string()))
+}
+/// Build the subprocess environment for a pack spawn.
+fn pack_env(state: &AppState, headers: &HeaderMap, repo: &Repo) -> git::pack::PackEnv {
+    git::pack::PackEnv {
+        home: state.config.storage.data_dir.join("tmp"),
+        protocol: headers
+            .get("git-protocol")
+            .and_then(|v| v.to_str().ok())
+            .map(str::to_string),
+        repo_id: Some(repo.id.clone()),
+        ..git::pack::PackEnv::default()
+    }
+}
+/// The `403` push-over-HTTPS-disabled response, naming the SSH remote.
+fn push_disabled(state: &AppState, owner: &str, repo_path: &str) -> Response {
+    let host = &state.config.ssh.clone_host;
+    let port = state.config.ssh.clone_port;
+    let ssh_url = if port == 22 {
+        format!("git@{host}:{owner}/{repo_path}.git")
+    } else {
+        format!("ssh://git@{host}:{port}/{owner}/{repo_path}.git")
+    };
+    (
+        StatusCode::FORBIDDEN,
+        format!("Pushing over HTTPS is disabled. Push over SSH instead:\n\n    {ssh_url}\n"),
+    )
+        .into_response()
+}
+/// The `401` challenge for anonymous access to a private repo.
+fn unauthorized() -> Response {
+    (
+        StatusCode::UNAUTHORIZED,
+        [(header::WWW_AUTHENTICATE, "Basic realm=\"fabrica\"")],
+        "Authentication required.\n",
+    )
+        .into_response()
+}
+/// A `500` for an internal transport failure (detail logged, not shown).
+fn internal(detail: &str) -> Response {
+    tracing::error!(error.detail = %detail, "pack transport error");
+    (StatusCode::INTERNAL_SERVER_ERROR, "internal error\n").into_response()
+}
+/// Whether a header equals a value (ASCII case-insensitive).
+fn header_eq(headers: &HeaderMap, name: header::HeaderName, value: &str) -> bool {
+    headers
+        .get(name)
+        .and_then(|v| v.to_str().ok())
+        .is_some_and(|v| v.eq_ignore_ascii_case(value))
+}
+/// Decompress a gzip body.
+fn gunzip(data: &[u8]) -> std::io::Result<Vec<u8>> {
+    use std::io::Read as _;
+    let mut decoder = flate2::read::GzDecoder::new(data);
+    let mut out = Vec::new();
+    decoder.read_to_end(&mut out)?;
+    Ok(out)
+}

 mod assets;
 mod diff;
 mod error;
+mod git_http;
 mod layout;
 mod markdown;
 mod pages;
         .route("/theme/{file}", get(serve_assets::theme_named))
         .route("/assets/{*path}", get(serve_assets::assets))
         // Repository browsing. Variable-length paths split on `/-/` in the handler.
+        // The same catch-all serves smart-HTTP pack transport: GET handles
+        // `….git/info/refs` inside the dispatcher; POST is the pack RPC.
         .route("/{owner}", get(repo::user_page))
-        .route("/{owner}/{*rest}", get(repo::dispatch))
+        .route(
+            "/{owner}/{*rest}",
+            get(repo::dispatch).post(git_http::pack_rpc),
+        )
         .layer(
             ServiceBuilder::new()
                 .layer(SetRequestIdLayer::new(

 use std::path::Path as FsPath;
 use axum::extract::{Path, Query, State};
-use axum::http::{Uri, header};
+use axum::http::{HeaderMap, Uri, header};
 use axum::response::{Html, IntoResponse, Response};
 use axum_extra::extract::cookie::{Cookie, CookieJar, SameSite};
 use maud::{Markup, html};
     from: Option<u32>,
     /// The 1-based last line of the context window.
     to: Option<u32>,
+    /// The smart-HTTP service, for `….git/info/refs?service=`.
+    service: Option<String>,
+}
 /// The candidate README filenames, in lookup order.
     State(state): State<AppState>,
     MaybeUser(viewer): MaybeUser,
     jar: CookieJar,
+    headers: HeaderMap,
     uri: Uri,
     Query(dq): Query<DiffQuery>,
     Path((owner_name, rest)): Path<(String, String)>,
 ) -> AppResult<Response> {
+    // Smart-HTTP pack transport: `{owner}/{path}.git/info/refs`. Guarded so a blob
+    // path that merely contains ".git/" is never misrouted (those carry "/-/").
+    if !rest.contains("/-/")
+        && let Some((repo_path, tail)) = crate::git_http::split_git(&rest)
+        && matches!(tail, "info/refs" | "git-upload-pack" | "git-receive-pack")
+    {
+        return Ok(crate::git_http::http_get(
+            &state,
+            &jar,
+            &headers,
+            &owner_name,
+            repo_path,
+            tail,
+            dq.service.as_deref(),
+        )
+        .await);
+    }
     if let Some((repo_path, view)) = rest.split_once("/-/") {
         let ctx = resolve(&state, &owner_name, repo_path, viewer.as_ref())
             .await?

 never be cut off, so timeouts (if any) belong per-route on non-git paths, added in
 the polish phase. The theme picker is a real GET form (works without JS) that sets
 a `fabrica_theme` cookie; `SIGHUP` re-scans `themes_dir` via an `RwLock<Assets>`.
+## 2026-07-25 — Pack transport: 401 (not 404) for anonymous, buffered request
+**Decision:** Smart-HTTP pack routes return **401** with
+`WWW-Authenticate: Basic` for anonymous access to a repo they can't read (so git
+prompts for credentials), whereas an authenticated stranger gets **404** (no
+existence leak). This differs from the browse UI, which always 404s. The
+upload-pack **request** (client wants, small) is buffered — decompressing gzip when
+present — while the **response** pack streams straight from the child's stdout via
+`ReaderStream`, never buffered. Push over HTTP (`git-receive-pack`) returns a
+deliberate 403 naming the SSH URL.
+**Alternatives:** 404 for anonymous too (no credential prompt, breaking
+`git clone` of private repos); stream the request as well.
+**Rationale:** git's HTTP client only sends Basic credentials after a 401
+challenge, so a private clone is impossible without it — the spec mandates the 401.
+The authenticated-stranger 404 preserves the no-leak invariant for logged-in users.
+The upload-pack request is a few KB of wants, so buffering it (and handling
+`Content-Encoding: gzip`) is simpler than streaming and violates no memory
+constraint; the pack that must never be buffered is the response, which is
+streamed. HTTP auth is username+password (or session cookie); API-token Basic auth
+lands with the API phase. `fabrica hook post-receive` derives the repo id from the
+`GIT_DIR` basename and loads config from `FABRICA_CONFIG` (set by the SSH/HTTP
+server on the child) or the default location; a local push with neither set no-ops
+cleanly, and it always exits 0 so a hook error never rejects an accepted push.