[ThomasK33]

Why

ThomasK33 asked to fix and build the open issues of this repo and land them on main. For #587 (a path that is not valid UTF-8 comes back changed in JSON) this is the second of three PRs. It is stacked on #721 (its base is #721's branch) and must not merge before #721. #721 gave the file, diff, blame and grep responses an exact <field>_base64 sibling. This PR does the same for the merge conflict paths. It also ships four follow-ups that the clean-context review of #721 raised.

What changes

Merge conflict responses (a path that is not valid UTF-8 gets a sibling, a valid path gets none, so a conflict on valid names answers the same bytes as before):

Route	New sibling
POST /repos/merge, 409 body	conflict_paths_base64, same length and order as conflict_paths
GET /repos/merge/preview	conflict_paths_base64, and path_base64 in conflicts[] and filtered_conflicts[]

Follow-ups from the review of #721:

1. TestRawPathSiblings/files_paged_and_flat now checks paths_base64 on a flat listing, where a tree entry sits in entries but not in paths. A reviewer's mutant, which encoded every entry instead of the blobs, survived the whole package before. It now fails this test.
2. The path-field guard test is harder to get around. It reads every struct type in the package, also types declared inside a function or a var. It accepts any field type, compares the sibling's type with the field's, and flags an untagged field with a path-like Go name in a struct that has json tags. A synthetic source in the test names each shape. The guard's exemptions shrink to the two request fields (the last PR).
3. docs/reference/http-api.md says that a list sibling repeats the whole list, so an unpaged files listing with one invalid path grows by about the size of paths.
4. docs/explanation/wire-compatibility.md names the siblings in the list of extensions that upstream's spec does not list.

Verification

• go build ./..., go vet ./internal/api/, golangci-lint 2.15.0 on ./internal/api/...: 0 issues. Doc link gate: 0 broken.
• go test ./internal/api/... ./cmd/openstorage/... -tags=openstorage_viewcheck -race -skip '/^pg$': ok (internal/api 173 s, cmd/openstorage 20 s). CI runs both backends.
• 5 mutants of the merge change, each caught by one named test, for example 409 conflict_paths_base64 not set fails TestRawPathMergeConflicts/merge_409, and a removed wmPreviewFiltered.PathBase64 field fails the guard with wmPreviewFiltered.path has no path_base64 sibling.
• Real serve and real git: two branches that conflict on a<0xff>b, a<0xfe>b, plain.txt and big<0xfa>.txt (one side above the 1 MiB inline limit). 409 and merge preview (with and without content) carry the siblings: 6 checks pass, and the ours content of each conflict is read through the raw path.
• A conflict on valid names only (a space, a quote) answers the same bytes as main on all 3 requests, after replacing commit hashes.

Refs #587

---

Generated with xum • Model: anthropic:claude-sonnet-5-5 • Thinking: xhigh

[ThomasK33]

@codex review

[ThomasK33]

@codex security review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-06T09:47:48.729710Z	363cc9f	Manual request
🔒 Security Review	✅ Completed 2026-11-06T09:49:56.643333Z	363cc9f	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 363cc9fd2e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 363cc9fd2e

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.