config: emit blake3sum_command for sftp so --hash blake3 syncs work

config/config_test.go

@@ -560,6 +560,7 @@ password2 = "obscured-salt"
 type = sftp
 host = host.example
 user = u
+blake3sum_command = b3sum
 password = transport-pw
 
 [offsite-crypt]
@@ -575,6 +576,36 @@ password2 = obscured-salt
 	}
 }
 
+// TestRcloneSectionSFTPEmitsBlake3sumCommand pins that every sftp section
+// carries a blake3sum_command. rclone never autodetects one, so without it
+// squirrel's `--hash blake3` syncs fail with "hash type not supported". The
+// line is sftp-only: backends with a fixed provider checksum must not get it.
+func TestRcloneSectionSFTPEmitsBlake3sumCommand(t *testing.T) {
+	p := writeConfig(t, `
+[destinations.nas]
+type = "sftp"
+host = "h"
+user = "u"
+root = "/r"
+
+[destinations.s3]
+type     = "s3"
+provider = "AWS"
+bucket   = "b"
+root     = "/r"
+`)
+	cfg, err := Load(p)
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if got := cfg.Destinations["nas"].RcloneSection(); !strings.Contains(got, "blake3sum_command = b3sum") {
+		t.Fatalf("sftp section missing blake3sum_command:\n%s", got)
+	}
+	if got := cfg.Destinations["s3"].RcloneSection(); strings.Contains(got, "blake3sum_command") {
+		t.Fatalf("non-sftp section should not carry blake3sum_command:\n%s", got)
+	}
+}
+
 // TestRcloneSectionCryptOmitsEmptySalt: password2 is optional, mirroring
 // rclone's own crypt config, and an absent salt renders no password2 line.
 func TestRcloneSectionCryptOmitsEmptySalt(t *testing.T) {

config/destinations.go

@@ -435,8 +435,15 @@ func (d *Destination) RcloneSection() string {
 			fmt.Fprintf(&b, "%s = %s\n", key, v)
 		}
 	}
-	if d.Type == "sftp" && d.HashAlgo != "" {
-		fmt.Fprintf(&b, "hashes = %s\n", d.HashAlgo)
+	if d.Type == "sftp" {
+		// rclone's sftp backend only autodetects md5sum/sha1sum, so BLAKE3
+		// must be named explicitly or squirrel's `--hash blake3` syncs abort
+		// with "hash type not supported". b3sum is the canonical BLAKE3 CLI
+		// and must be on the remote's PATH.
+		fmt.Fprintf(&b, "blake3sum_command = b3sum\n")
+		if d.HashAlgo != "" {
+			fmt.Fprintf(&b, "hashes = %s\n", d.HashAlgo)
+		}
 	}
 	for _, key := range sortedSubset(schema.secretFields) {
 		if v, ok := d.Params[key]; ok {

sync/rclone_test.go

@@ -325,6 +325,7 @@ password2 = "obscured-salt"
 type = sftp
 host = host.example
 user = u
+blake3sum_command = b3sum
 password = transport-pw
 
 [offsite-crypt]