0032git-upload-pack /project.git\0host=example.com\0
0000

func ParsePktLine(r io.Reader) ([]byte, error) {
    lenBuf := make([]byte, 4)
    _, err := io.ReadFull(r, lenBuf)
    if err != nil {
        return nil, err
    }
    
    lenStr := string(lenBuf)
    if lenStr == "0000" {
        return nil, nil // flush packet
    }
    
    length, err := strconv.ParseInt(lenStr, 16, 32)
    if err != nil {
        return nil, fmt.Errorf("invalid pkt-line length: %s", lenStr)
    }
    
    // Read data (length - 4 bytes for the length prefix)
    dataLen := int(length) - 4
    data := make([]byte, dataLen)
    _, err = io.ReadFull(r, data)
    return data, err
}

func AnonymizeCommits(r *git.Repository, targetSHA string) (string, error) {
    targetHash := plumbing.NewHash(targetSHA)
    targetCommit, err := r.CommitObject(targetHash)
    
    // Get all commits that already exist in origin/main (base commits)
    baseCommits := make(map[plumbing.Hash]bool)
    originMain, err := r.Reference(plumbing.NewRemoteReferenceName("origin", "main"), true)
    if err == nil {
        // Mark all base commits (don't rewrite these)
        iter, _ := r.Log(&git.LogOptions{From: originMain.Hash()})
        iter.ForEach(func(c *object.Commit) error {
            baseCommits[c.Hash] = true
            return nil
        })
    }
    
    // Rewrite only new commits
    commitMap := make(map[plumbing.Hash]plumbing.Hash)
    newHash, err := rewriteCommit(r, targetCommit, commitMap, baseCommits)
    
    // Update HEAD to the anonymized commit
    ref := plumbing.NewHashReference(plumbing.HEAD, newHash)
    r.Storer.SetReference(ref)
    
    return newHash.String(), nil
}

func rewriteCommit(r *git.Repository, commit *object.Commit, commitMap map[plumbing.Hash]plumbing.Hash, baseCommits map[plumbing.Hash]bool) (plumbing.Hash, error) {
    // Already rewritten? Return cached result
    if newHash, exists := commitMap[commit.Hash]; exists {
        return newHash, nil
    }
    
    // Base commit (from origin/main)? Don't rewrite
    if baseCommits[commit.Hash] {
        return commit.Hash, nil
    }
    
    // Rewrite parent commits first (depth-first)
    var newParents []plumbing.Hash
    for _, parentHash := range commit.ParentHashes {
        parentCommit, err := r.CommitObject(parentHash)
        if err != nil {
            // Parent doesn't exist (shallow clone?), use original hash
            newParents = append(newParents, parentHash)
            continue
        }
        newParentHash, err := rewriteCommit(r, parentCommit, commitMap, baseCommits)
        newParents = append(newParents, newParentHash)
    }
    
    // Create new commit with anonymized signature
    anonSignature := object.Signature{
        Name:  "@gitgost-anonymous",
        Email: "anonymous@gitgost.local",
        When:  time.Now(), // Current timestamp (obfuscates when you actually worked)
    }
    
    newCommit := &object.Commit{
        Author:       anonSignature,
        Committer:    anonSignature,
        Message:      commit.Message, // Preserve commit message
        TreeHash:     commit.TreeHash, // Preserve file contents
        ParentHashes: newParents,
    }
    
    // Encode and store the new commit
    obj := r.Storer.NewEncodedObject()
    newCommit.Encode(obj)
    newHash, err := r.Storer.SetEncodedObject(obj)
    
    // Cache the mapping
    commitMap[commit.Hash] = newHash
    return newHash, nil
}

func ForkRepo(owner, repo string) (string, error) {
    token := os.Getenv("GITHUB_TOKEN")
    
    // Get the bot's username
    userURL := "https://api.github.com/user"
    req, _ := http.NewRequest("GET", userURL, nil)
    req.Header.Set("Authorization", "token "+token)
    resp, _ := http.DefaultClient.Do(req)
    
    var user map[string]interface{}
    json.NewDecoder(resp.Body).Decode(&user)
    forkOwner := user["login"].(string) // e.g., "gitgost-anonymous"
    
    // Check if fork already exists
    forkURL := fmt.Sprintf("https://api.github.com/repos/%s/%s", forkOwner, repo)
    req, _ = http.NewRequest("GET", forkURL, nil)
    req.Header.Set("Authorization", "token "+token)
    resp, _ = http.DefaultClient.Do(req)
    
    if resp.StatusCode == 200 {
        // Fork exists, reuse it
        return forkOwner, nil
    }
    
    // Create new fork
    url := fmt.Sprintf("https://api.github.com/repos/%s/%s/forks", owner, repo)
    req, _ = http.NewRequest("POST", url, nil)
    req.Header.Set("Authorization", "token "+token)
    resp, _ = http.DefaultClient.Do(req)
    
    return forkOwner, nil
}

func PushToGitHub(owner, repo, tempDir, forkOwner, targetBranch string) (string, error) {
    token := os.Getenv("GITHUB_TOKEN")
    
    // Generate unique branch name (or use provided one for updates)
    branch := targetBranch
    if branch == "" {
        timestamp := time.Now().Unix()
        branch = fmt.Sprintf("gitgost-%d", timestamp) // e.g., gitgost-1709654321
    }
    
    r, _ := git.PlainOpen(tempDir)
    
    // Add fork as remote
    forkURL := fmt.Sprintf("https://github.com/%s/%s.git", forkOwner, repo)
    r.CreateRemote(&config.RemoteConfig{
        Name: "fork",
        URLs: []string{forkURL},
    })
    
    // Push to fork (force if updating existing branch)
    refSpec := fmt.Sprintf("HEAD:refs/heads/%s", branch)
    if targetBranch != "" {
        refSpec = "+" + refSpec // Force push for updates
    }
    
    r.Push(&git.PushOptions{
        RemoteName: "fork",
        RefSpecs:   []config.RefSpec{config.RefSpec(refSpec)},
        Auth: &http.BasicAuth{
            Username: "x-access-token",
            Password: token,
        },
        Force: targetBranch != "",
    })
    
    return branch, nil
}

func CreatePR(owner, repo, branch, forkOwner, commitMessage string) (string, error) {
    token := os.Getenv("GITHUB_TOKEN")
    url := fmt.Sprintf("https://api.github.com/repos/%s/%s/pulls", owner, repo)
    
    // Use commit message as PR description
    prBody := fmt.Sprintf(
        "%s\n\n---\n\n*This is an anonymous contribution made via [gitGost](https://gitgost.leapcell.app).*\n\n*The original author's identity has been anonymized to protect their privacy.*",
        commitMessage,
    )
    
    data := map[string]interface{}{
        "title": "Anonymous contribution via gitGost",
        "head":  fmt.Sprintf("%s:%s", forkOwner, branch), // e.g., "gitgost-anonymous:gitgost-1709654321"
        "base":  "main",
        "body":  prBody,
    }
    
    jsonData, _ := json.Marshal(data)
    req, _ := http.NewRequest("POST", url, bytes.NewBuffer(jsonData))
    req.Header.Set("Authorization", "token "+token)
    req.Header.Set("Content-Type", "application/json")
    
    resp, _ := http.DefaultClient.Do(req)
    
    var result map[string]interface{}
    json.NewDecoder(resp.Body).Decode(&result)
    prURL := result["html_url"].(string)
    
    return prURL, nil
}

fix: correct spelling in README

Fixed 'recieve' → 'receive' in installation section.

---

*This is an anonymous contribution made via [gitGost](https://gitgost.leapcell.app).*

*The original author's identity has been anonymized to protect their privacy.*

func GeneratePRHash(owner, repo, branch string) string {
    input := fmt.Sprintf("%s/%s/%s", owner, repo, branch)
    sum := sha256.Sum256([]byte(input))
    return hex.EncodeToString(sum[:])[:8] // First 8 characters
}

func checkRateLimit(ip string) bool {
    now := time.Now()
    rateLimitMu.Lock()
    times := rateLimitStore[ip]
    
    // Keep only timestamps within the 1-hour window
    valid := times[:0]
    for _, t := range times {
        if now.Sub(t) < time.Hour {
            valid = append(valid, t)
        }
    }
    valid = append(valid, now)
    rateLimitStore[ip] = valid
    count := len(valid)
    rateLimitMu.Unlock()
    
    return count > 5 // Max 5 PRs per hour per IP
}

func recordGlobalBurst(ip string) {
    now := time.Now()
    globalBurstMu.Lock()
    defer globalBurstMu.Unlock()
    
    // Slide 60-second window
    cutoff := now.Add(-60 * time.Second)
    newTimes := globalBurstTimes[:0]
    newIPs := globalBurstIPs[:0]
    for i, t := range globalBurstTimes {
        if t.After(cutoff) {
            newTimes = append(newTimes, t)
            newIPs = append(newIPs, globalBurstIPs[i])
        }
    }
    newTimes = append(newTimes, now)
    newIPs = append(newIPs, ip)
    
    total := len(newTimes)
    distinctIPs := len(seenIPs(newIPs))
    
    // Alert if > 20 pushes or > 10 distinct IPs in 60 seconds
    if total >= 20 || distinctIPs >= 10 {
        notifyAdminGlobalBurst(total, distinctIPs)
    }
}

func isPanicMode() bool {
    panicMu.Lock()
    defer panicMu.Unlock()
    return panicMode
}

func ReceivePackHandler(c *gin.Context) {
    // Check panic mode first
    if isPanicMode() {
        WriteSidebandLine(&errResp, 2, "remote: SERVICE TEMPORARILY SUSPENDED")
        WriteSidebandLine(&errResp, 2, "remote: The panic button has been activated.")
        return
    }
    // ... rest of handler
}