Fast test/migrate.test.ts: chop and rewrite under the budget (1 s a test, 10 s a file) #1283

test/migrate.test.ts now runs in about 6 s, down from 41.9 s, and every test in it is under 1 s (slowest 0.78 s). The 9 migrate tests pass, and test/check-list.test.ts still passes. I couldn't run tsc here: the bun type definitions aren't installed in this sandbox. I haven't run the gate itself.

What changed

• One forge. The second upstream forge is gone. "Upstream" is now a private repo owned by a user octo on the same app, behind the fake forgejo origin.
• No unix socket. The sandbox blocks unix-socket listens, which serve() needs, so the file now serves the app in-process through forgeHttp(app) on a plain TCP port.
• No argon2. Users are created without passwords and requests use session cookies, with a token for octo. The old file paid an argon2 verify on every Basic-auth request, which is where most of the 41.9 s went.
• Shared fixtures. Users, repos, commits and the origin connection are built once in beforeAll. No sleeps and no chromium.
• Faster refusals. Refusal cases call migrateRepo directly. One API call checks the 422 shape.

Invariants kept

• Full history, every ref and the annotated tag arrive, and the default branch is kept.
• The new repo is native, with no origin row and no remote in its config.
• Refused URLs touch nothing, and the canary path stays untouched.
• A failed clone leaves nothing behind.
• A crew put on the repo is on it: on the crew, the repo an app, one issue carrying the brief, autonomy only when asked.
• An origin's credential opens a private repo and never lands in the repo's config.
• The migrate page, its cross-site-post refusal and the job-page access check.
• A pasted private host is an admin's alone.
• A clone follows no redirect.

Dropped or merged

• The real git push to the migrated repo is gone. "Pushes land here and the source never hears" is covered by the no-origin, no-remote check, and receive-pack itself belongs to the push suites. A push needs the hook socket, which this sandbox can't listen on.
• The separate strict-app test is now a temporary flip of migrateFromPrivateHosts on the one app. Bob is refused and alice, the admin, is allowed.
• The brief's wording is asserted only for the autonomous crew migration. The assisted one still checks the title, assignee and autonomy.

Other

• There is no SLOW list in scripts/gate.ts on this branch, so there was no entry to remove. The file is already in GATE. I only updated its recorded time in scripts/test-times.json, from 41.9 to 5.9.
• Nothing in this file needed to move to NIGHTLY.

To try it: bun test test/migrate.test.ts.

🤖 Generated with Claude Code

Closes #1250

I've addressed all five points, but I couldn't run the final version of test/migrate.test.ts. My sandbox refuses the unix socket that serve() listens on (EPERM), the same limit you hit. The forge's check is the first real run of this head.

Before I switched the test to serve(), the file ran here with the earlier in-process server. Every test passed except the push: git cloned and committed, then the push failed with "hook relay failed", because that server has no hook socket.

• Push-stays-here: The "by URL" test is again "…and pushes stay here". It clones bob/fixture over HTTP with bob's token in the URL (no argon2) and pushes HEAD:refs/heads/bobs. It then checks the branch landed in bob's bare repo and that allRefs(sourceDir) is unchanged. To get the hook socket the push needs, the test now starts the server with serve(app) instead of forgeHttp plus Bun.serve.
• Crew test: The brief assertions now run for both the assisted and the autonomous case. Autonomy is still checked through repo.autonomy.
• Token door: The "by URL" migrate call now goes through a Bearer-token helper, apiToken, so the endpoint's non-cookie path is exercised. I used Bearer rather than Basic; both go through the same token check in src/http/server.ts.
• Strict-forge test: I added a comment saying it only means something because migrateRepo reads the flag on every call. The app is built with the flag true, so the private_host refusal would fail if that read were ever cached.
• let fixture: It's now const; the reassignment after updateRepoSettings was dead, so I removed it.
• scripts/test-times.json: I left the 5.9 s figure alone because I can't measure this head. My earlier run of the in-process version took 12–15 s wall time here, but that includes the sandbox and a failing push. Please take the forge check's timing, and I'll update the number if it differs.