fix: filter run_list state candidates by current remote's maintainers

when a repo has multiple nostr:// remotes sharing the same identifier,
relays can return state events authored by maintainers of the other
remote. without filtering, the newest event wins regardless of author,
pointing refs at the wrong commits.

state event candidates in run_list are now filtered to maintainers of
the current remote's repo announcement.

1 files changed, 4 insertions, 0 deletions

diff --git a/src/bin/git_remote_nostr/list.rs b/src/bin/git_remote_nostr/list.rs
index 23b3b98..a17090e 100644
--- a/src/bin/git_remote_nostr/list.rs
+++ b/src/bin/git_remote_nostr/list.rs
@@ -58,10 +58,14 @@ pub async fn run_list(
     //   (b) already available locally.
     // This prevents advertising refs whose git objects haven't been pushed to
     // any server yet, which would cause `git clone` / `git fetch` to fail.
+    //
+    // filter by maintainers to avoid state events from other remotes with the
+    // same identifier being selected when they have a newer created_at
     let mut candidates: Vec<&nostr::Event> = fetch_report
         .state_per_relay
         .values()
         .filter_map(|maybe| maybe.as_ref())
+        .filter(|event| repo_ref.maintainers.contains(&event.pubkey))
         .collect();
     // Sort newest-first (by created_at, then by id for tie-breaking).
     candidates.sort_by(|a, b| {