33e967e · a9120e7 · 0910e28 · 3cc127b
@@ -460,6 +460,50 @@
repository), the agent — is refused in words before the repository exists;
what is left for the job is the network. A clone that fails removes the
empty repository it made, so the name is free to try again.
**One click from GitHub.** `/migrate` carries its own "Your accounts"
card: **Connect GitHub** runs the device flow above (no token pasted; it
needs the forge's GitHub application, `FORGE_GITHUB_CLIENT_ID`) and comes
back to `/migrate`, and each connected account has a **Disconnect** that
comes back too. The return is the fixed word `then=migrate`, never a path a
form can choose. Every repository the account can see (owned and its orgs')
is a row — name, a `private` mark, its size as the origin reports it (KiB,
shown in KiB/MiB/GiB), its description — filtered by `?q=` on the server and
live as you type. A row's button is the form's submitter (`name="pick"`), so
one click migrates it with the destination and crew fields as they stand;
the first agent is picked by default, "Nobody" is one choice away.
**The branch the app lives on.** A fork often keeps the upstream's tree on
`main` and the person's app on a branch of their own, so the source's default
is not always the app. A row's **Branches** link (`/migrate?source=…&branches=1`) draws
that repository's branches, each with its last commit — subject, author,
date — read through the origin's API (the first 30 branches' commits; the
rest by name), remembered a minute per account and repository so a reload or
a refused form spends nothing at the origin; a plain visit asks for none of it. The one selected is the branch whose last commit is the
person's and newest (an account login the origin resolved, a GitHub noreply
address with their login, their forge email, or an author name that is one
of their logins), else the source's default. A one-click row with no branch
chosen gets the same rule in the job, over the clone's own tips
(`git for-each-ref`) and the origin's logins (`origins/work-branch.ts`).
That branch becomes the default branch here, the job says which and why,
and the crew's brief names it: start from it, open the pull against it.
**The conversations come too** — from a connected origin, not a pasted URL
(`origins/carry.ts`). Labels; every issue, open and closed, with its comments
and labels, under its original number; and the open pull requests as pulls
here, on the branches the clone brought — native ones (`origin_head_repo`
cleared), so they review and merge like any other. A pull whose head lived
in a fork is a stranger's code: its head is fetched into `refs/pull/<n>/head`
(the forge's own namespace — no push event, no branch the clone brought is
touched), it keeps `origin_head_repo`, and its check and preview wait for a
writer's **Approve to run here**, exactly as a mirror's do. The job's message
says how many wait. Closed pulls stay behind: their work is in
the history or was turned down. Each body opens with
`> Migrated from [owner/name#n](<original>) by @login on GitHub.` — the link
only when it is http(s), the login reduced to login characters — and the
author also travels in `origin_author`, so every page marks it as theirs on
the origin. One `repo.imported` event (`via: "migrate"`) says so, not one per
row. A refusal part-way keeps what arrived and says so in the job's detail.
**Put a crew on it.** Name an agent and, after the clone, the same job puts
it on the crew, makes the repository an app, sets it autonomous when asked,
and `tell`s the crew one thing: make it run here. The brief is the
@@ -486,8 +530,9 @@
the person still presses Migrate (POST, same-origin checked).
The clone runs as a job in the mirror's registry (`origins/jobs.ts`, kind
`migrate`, owned by whoever started it — anyone else's is `not_found`).
`/migrate/jobs/:job` refreshes until it stops, then lands on the repository
with what happened as the flash.
`/migrate/jobs/:job` follows its stages — clone, issues, pull requests, the
app and the crew's first run — and then lands on the repository, which is
the app's page, with what happened as the flash.
## API
@@ -536,7 +581,7 @@
GET    /api/v1/user/pins  PUT/DELETE /api/v1/user/pins/:owner/:name
POST   /api/v1/migrate                         {source: {url} | {originId, fullName},
                                                owner?, name?, visibility?,
                                                crew?: {agent, autonomous}}
                                                branch?, crew?: {agent, autonomous}}
                                               → 202 {repo, job}
GET    /api/v1/migrate/:job                    poll one migration (its starter only)
GET    /api/v1/migrate/:job/stream             SSE: migrate.<stage>, ends on done
@@ -551,7 +596,7 @@
credential, which is the same authority as spending it. Repo-level sync and
pins take the ordinary `rw` floor; so does a migration from a URL, while one
from an origin takes `admin` — it spends the origin's credential. Its
refusals are 422 `{ error, message }`: `invalid_url`, `no_such_origin`,
`unreachable`, `no_such_agent`, and the new-repository codes (`name_taken`,
`unreachable`, `no_such_agent`, `invalid_branch`, and the new-repository codes (`name_taken`,
`invalid_name`, `forbidden_owner`).
A contribute answers 201 with
@@ -11,6 +11,13 @@
 * environment, scoped to the origin's host — never argv, never the URL. A
 * pasted URL is cloned anonymously: public repositories only.
 *
 * From a connected origin the conversations come too (`origins/carry.ts`):
 * every issue with its comments and labels, and the open pull requests as
 * pulls here, on the branches the clone brought — each opening with a link
 * back to the original; one from a fork has its head under
 * `refs/pull/<n>/head` and waits for a writer to approve it to run. A
 * pasted URL brings the history alone.
 *
 * The clone runs as a job (`origins/jobs.ts`, the mirror's registry), so a
 * page can watch it. With a crew asked for, the same job then puts the
 * agent on the crew, makes the repository an app, and tells the crew one
@@ -30,9 +37,16 @@
import { isSafeRef } from "../git/guard.ts";
import { repoDir } from "../git/repos.ts";
import { type Resolve, vetHost } from "../kernel/outbound.ts";
import { err, ok, type Result } from "../kernel/result.ts";
import { carryConversations, plural } from "../origins/carry.ts";
import { providerForOrigin } from "../origins/credential.ts";
import { redact, safeRemoteUrl, secretsIn } from "../origins/credentials.ts";
import { MIRROR_REFSPECS, snapshotRefs } from "../origins/git-mirror.ts";
import {
  localTips,
  pickWorkBranch,
  remoteTips,
  type Who,
} from "../origins/work-branch.ts";
import {
  advance,
  createJob,
@@ -40,6 +54,7 @@
import {
  runningJob,
  type MirrorJob,
} from "../origins/jobs.ts";
import type { Provider } from "../origins/types.ts";
import { requireUser } from "./access.ts";
import { enableApp } from "./apps.ts";
import { addToCrew } from "./crew.ts";
@@ -70,6 +85,12 @@
export interface MigrateInput {
  readonly name?: string;
  /** @default "private" */
  readonly visibility?: "public" | "private";
  /**
   * The branch the app lives on — the default branch here and the one the
   * crew is pointed at. Left out, the branch with the person's newest
   * commits (`origins/work-branch.ts`), else the source's default.
   */
  readonly branch?: string;
  /** Put an agent on it: the crew makes it run here. */
  readonly crew?: { readonly agent: string; readonly autonomous: boolean };
  /** Name → addresses, for the private-address check. Tests inject it. */
@@ -89,6 +110,7 @@
export type MigrateError =
  | "private_host"
  | "no_such_origin"
  | "unreachable"
  | "invalid_branch"
  | "no_such_agent";
/** What the clone reads from, resolved: where, and how to authenticate. */
@@ -100,6 +122,18 @@
interface Resolved {
  readonly name: string;
  readonly description: string;
  readonly authEnv: () => Promise<Record<string, string>>;
  /** A connected origin's adapter: what issues and pulls are read through. */
  readonly provider?: Provider;
  /** The person, as the source's commits may name them. */
  readonly who: Who;
}
/** Why the work branch is the one it is: said in the job and the brief. */
type WorkReason = "picked" | "newest" | "default";
interface WorkBranch {
  readonly name: string;
  readonly reason: WorkReason;
}
/**
@@ -121,6 +155,8 @@
export async function migrateRepo(
  if (!source.ok) return source;
  if (input.crew !== undefined && !getAgentByName(app.db, input.crew.agent))
    return err("no_such_agent");
  const branch = (input.branch ?? "").trim();
  if (branch !== "" && !isSafeRef(branch)) return err("invalid_branch");
  // A double-click joins the migration already under way rather than
  // failing the second one on the name the first just took.
@@ -150,7 +186,11 @@
export async function migrateRepo(
    actorId: user.value.id,
  });
  advance(job.id, { stage: "creating", repo });
  void runMigration(app, user.value, repo, source.value, input.crew, job.id);
  void runMigration(app, user.value, repo, source.value, {
    branch: branch === "" ? undefined : branch,
    crew: input.crew,
    jobId: job.id,
  });
  return ok({ repo, job: getJob(job.id) ?? job });
}
@@ -188,6 +228,8 @@
export function migrateMessage(error: MigrateError, limit = "at the repositories
      return "The origin could not be reached. Try again, or reconnect it under Settings → Origins.";
    case "no_such_agent":
      return "That agent is not on this forge.";
    case "invalid_branch":
      return "That is not a branch name git would take.";
    case "name_taken":
      return "That owner already has a repository by that name. Pick another name.";
    case "invalid_name":
@@ -354,6 +396,7 @@
async function resolveSource(
      name: nameFromUrl(url),
      description: "",
      authEnv: () => Promise.resolve({}),
      who: { logins: [user.username], emails: [user.email] },
    });
  }
  const origin = getOriginFor(app.db, user.id, source.originId);
@@ -376,6 +419,8 @@
async function resolveSource(
    // Only the header: the origin's credential reaches this one git
    // invocation scoped to its host, and the repository never learns it.
    authEnv: () => provider.value.gitAuthEnv(url),
    provider: provider.value,
    who: { logins: [origin.login, user.username], emails: [user.email] },
  });
}
@@ -385,9 +430,13 @@
async function runMigration(
  user: User,
  repo: Repo,
  source: Resolved,
  crew: MigrateInput["crew"],
  jobId: string,
  asked: {
    readonly branch: string | undefined;
    readonly crew: MigrateInput["crew"];
    readonly jobId: string;
  },
): Promise<void> {
  const { crew, jobId } = asked;
  const fail = async (error: string): Promise<void> => {
    // An empty repository nobody asked for is clutter, and it holds the
    // name a retry wants: a clone that did not happen leaves nothing.
@@ -398,23 +447,65 @@
async function runMigration(
    advance(jobId, { stage: "fetching", detail: "every branch and tag" });
    const cloned = await cloneInto(app, repo, source);
    if (!cloned.ok) return await fail(cloned.error);
    storageStale(app, repo.ownerId);
    let current = getRepoById(app.db, repo.id) ?? repo;
    // The source's default branch is kept; a source that never said which
    // keeps the forge's own, or the branch it plainly meant.
    const branches = [...cloned.value.refs.keys()]
    // The conversations, when an origin can be asked for them. A refusal
    // part-way keeps what arrived and says so; the history is the move.
    let conversations = "";
    const refs = cloned.value.refs;
    if (source.provider !== undefined) {
      advance(jobId, { stage: "issues", detail: "reading issues" });
      const carried = await carryConversations({
        db: app.db,
        provider: source.provider,
        fullName: source.label,
        repoId: current.id,
        actorId: user.id,
        report: (stage, detail) => advance(jobId, { stage, detail }),
      });
      // A fork's head is fetched where the forge keeps pull heads, not as
      // a branch: no push event runs it, and no branch the clone brought
      // is overwritten. Its pull waits for a writer to approve it to run.
      await fetchForkHeads(
        app,
        current,
        source,
      
        sentinelcrew
        24d ago
        outdated
      
      A stranger's fork head becomes a native branch and pull here, and the push event then runs checks and previews on it. Consider keeping fork pulls read-only until the owner adopts one.
    
        carried.forkPulls.map((p) => p.number),
      );
      const forks = carried.forkPulls.length;
      conversations = `; ${plural(carried.issues, "issue")}, ${plural(carried.pulls, "open pull request")}${forks === 0 ? "" : ` (${forks} from forks, waiting for your approval to run here)`}, ${plural(carried.comments, "comment")}${carried.error === "" ? "" : ` (the origin stopped part-way: ${redact(carried.error)})`}`;
      app.bus.append({
        kind: "repo.imported",
        repoId: current.id,
        actorId: user.id,
        payload: {
          fullName: source.label,
          issues: carried.issues,
          pulls: carried.pulls,
          comments: carried.comments,
          via: "migrate",
        },
      });
    }
    storageStale(app, repo.ownerId);
    // The default branch here is the work branch: the one picked, else
    // the one with the person's newest commits, else the source's default
    // — and a source that never said which keeps the forge's own, or the
    // branch it plainly meant.
    const branches = [...refs.keys()]
      .filter((ref) => ref.startsWith("refs/heads/"))
      .map((ref) => ref.slice("refs/heads/".length));
    const wanted = [
    const fallback = [
      cloned.value.head,
      current.defaultBranch,
      "master",
      ...branches.sort(),
    ].find((b) => b !== undefined && branches.includes(b));
    if (wanted !== undefined && wanted !== current.defaultBranch) {
    const work = await workBranch(app, current, source, asked.branch, branches, fallback);
    if (work !== undefined && work.name !== current.defaultBranch) {
      const moved = await updateRepoSettings(app, user, current, {
        defaultBranch: wanted,
        defaultBranch: work.name,
      });
      if (moved.ok) current = moved.value;
    }
@@ -422,13 +513,13 @@
async function runMigration(
    // The history arrived without a push, so nothing downstream heard it.
    // One event, shaped like a push, says so — the feed, webhooks and the
    // default branch's check see what landed.
    if (cloned.value.refs.size > 0) {
    if (refs.size > 0) {
      app.bus.append({
        kind: "push",
        repoId: current.id,
        actorId: user.id,
        payload: {
          updates: [...cloned.value.refs].map(([ref, newOid]) => ({
          updates: [...refs].map(([ref, newOid]) => ({
            ref,
            oldOid: "0".repeat(40),
            newOid,
@@ -440,10 +531,12 @@
async function runMigration(
    }
    const where = `${current.ownerName}/${current.name}`;
    let detail = `migrated as ${where} — ${plural(branches.length, "branch", "branches")}, ${plural(cloned.value.refs.size - branches.length, "tag")}`;
    let detail = `migrated as ${where} — ${plural(branches.length, "branch", "branches")}, ${plural(refs.size - branches.length, "tag")}${conversations}`;
    if (work !== undefined)
      detail += `. Working on ${work.name}, ${reasonWords(work.reason)}${asked.branch !== undefined && work.reason !== "picked" ? ` (${asked.branch} did not come with the clone)` : ""}`;
    if (crew !== undefined) {
      advance(jobId, { stage: "crew", detail: `putting ${crew.agent} on it` });
      detail += `. ${await putCrewOn(app, user, current, source, crew)}`;
      detail += `. ${await putCrewOn(app, user, current, source, crew, work)}`;
    }
    advance(jobId, {
      stage: "done",
@@ -518,6 +611,86 @@
async function cloneInto(
  return ok({ head, refs });
}
/**
 * Which branch the app lives on. A picked branch that arrived wins; else
 * the newest branch tip that is the person's — by the clone's authors, and
 * by the origin's account logins when there is an origin to ask — else the
 * fallback.
 */
async function workBranch(
  app: App,
  repo: Repo,
  source: Resolved,
  picked: string | undefined,
  branches: readonly string[],
  fallback: string | undefined,
): Promise<WorkBranch | undefined> {
  if (picked !== undefined && branches.includes(picked))
    return { name: picked, reason: "picked" };
  const dir = repoDir(app.reposRoot, repo.ownerName, repo.name);
  let tips = await localTips(dir, source.who);
  if (source.provider !== undefined) {
    const remote = await remoteTips(source.provider, source.label, source.who);
    const theirs = new Set(
      (remote ?? []).filter((t) => t.mine).map((t) => `${t.name}\0${t.oid}`),
    );
    tips = tips.map((t) =>
      theirs.has(`${t.name}\0${t.oid}`) ? { ...t, mine: true } : t,
    );
  }
  const name = pickWorkBranch(tips, fallback);
  if (name === undefined) return undefined;
  return {
    name,
    reason: tips.some((t) => t.mine && t.name === name) ? "newest" : "default",
  };
}
function reasonWords(reason: WorkReason): string {
  switch (reason) {
    case "picked":
      return "the branch picked";
    case "newest":
      return "the branch with your newest commits";
    case "default":
      return "the source's default branch";
  }
}
/**
 * Bring the heads of pulls opened from forks: the origin serves each as
 * `refs/pull/<n>/head` (GitHub and Forgejo alike), and it lands under the
 * same name here — the forge's own namespace for pull heads, which a push
 * cannot write and the clone never brings. One fetch; a fetch that fails
 * leaves those pulls showing the head the origin reported, still waiting.
 */
async function fetchForkHeads(
  app: App,
  repo: Repo,
  source: Resolved,
  numbers: readonly number[],
): Promise<void> {
  if (numbers.length === 0) return;
  const dir = repoDir(app.reposRoot, repo.ownerName, repo.name);
  const authEnv = await source.authEnv();
  await runGitCapture(
    [
      "fetch",
      "--no-write-fetch-head",
      "--no-recurse-submodules",
      "--quiet",
      "--",
      source.url,
      ...numbers.map((n) => `+refs/pull/${n}/head:refs/pull/${n}/head`),
    ],
    {
      cwd: dir,
      env: remoteGitEnv(authEnv, undefined, ALLOWED_PROTOCOL),
      timeoutMs: MIGRATE_TIMEOUT_MS,
    },
  );
}
/**
 * The crew half: the agent joins, the repository becomes an app, autonomy
 * is set when asked, and the crew is told the one thing it is there for.
@@ -529,6 +702,7 @@
async function putCrewOn(
  repo: Repo,
  source: Resolved,
  crew: NonNullable<MigrateInput["crew"]>,
  work: WorkBranch | undefined,
): Promise<string> {
  const said: string[] = [];
  const added = addToCrew(app, user, repo, crew.agent);
@@ -547,7 +721,7 @@
async function putCrewOn(
    });
    if (!set.ok) said.push("Autonomy could not be turned on.");
  }
  const told = await tell(app, user, repo, importerBrief(repo, source.label));
  const told = await tell(app, user, repo, importerBrief(repo, source.label, work));
  said.unshift(told.ok ? toldWords(told.value) : "The crew could not be told.");
  return said.join(" ");
}
@@ -557,11 +731,24 @@
async function putCrewOn(
 * contract (docs/APPS.md), from the other side: someone else's project,
 * made to run here with the smallest diff that does it.
 */
export function importerBrief(repo: Repo, from: string): string {
export function importerBrief(
  repo: Repo,
  from: string,
  work?: WorkBranch,
): string {
  const branch = work?.name ?? repo.defaultBranch;
  const why =
    work?.reason === "picked"
      ? "the branch the person who migrated it picked"
      : work?.reason === "newest"
        ? "the branch with the newest commits of the person who migrated it"
        : "the source's default branch";
  return `Make ${repo.name} run here
${repo.name} was migrated to this forge from ${from} — every branch and tag, its history intact. It is someone else's project. Make it run here as an app without changing what it does.
The app is on the branch \`${branch}\` — ${why}, and the default branch here. Start from \`${branch}\` and open your pull against it; the other branches are history, not the app.
Adapt, don't rewrite:
- Read before you write: the language, how it starts today, how it reads its port and configuration, where it keeps state, how it installs and tests.
@@ -576,6 +763,3 @@
Adapt, don't rewrite:
Done means the pull's preview starts, answers its \`health\` path, and does what the original did.`;
}
function plural(n: number, one: string, many = `${one}s`): string {
  return `${n} ${n === 1 ? one : many}`;
}
@@ -0,0 +1,6 @@
// The migrate picker shows each repository's size before it is cloned
// (#3264). Both forges report `size` in KiB on a listing; additive, and 0
// reads as "the origin did not say".
export default `
  ALTER TABLE origin_repo ADD COLUMN size_kb INTEGER NOT NULL DEFAULT 0;
  `;
@@ -323,6 +323,8 @@
export interface OriginRepoRow {
  readonly openIssues: number;
  readonly openPulls: number;
  readonly openIssuesIncludingPulls: boolean;
  /** KiB, as the origin last reported it; 0 when unknown. */
  readonly sizeKb: number;
}
const REPO_SELECT = `
@@ -348,6 +350,7 @@
interface RawOriginRepo {
  open_issues: number;
  open_pulls: number;
  counts_include_pulls: number;
  size_kb: number;
  mirrored_id: string | null;
}
@@ -369,6 +372,7 @@
const toOriginRepo = (row: RawOriginRepo): OriginRepoRow => ({
  openIssues: row.open_issues,
  openPulls: row.open_pulls,
  openIssuesIncludingPulls: row.counts_include_pulls === 1,
  sizeKb: row.size_kb,
});
/**
@@ -379,8 +383,8 @@
const UPSERT_ORIGIN_REPO = `
  INSERT INTO origin_repo
    (origin_id, remote_id, full_name, description, private, fork,
     default_branch, clone_url, html_url, pushed_at, can_push, seen_at,
     open_issues, open_pulls, counts_include_pulls, fork_of)
  VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12, ?13, ?14, ?15, ?16)
     open_issues, open_pulls, counts_include_pulls, fork_of, size_kb)
  VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12, ?13, ?14, ?15, ?16, ?17)
  ON CONFLICT (origin_id, remote_id) DO UPDATE SET
    full_name = excluded.full_name,
    description = excluded.description,
@@ -395,6 +399,7 @@
const UPSERT_ORIGIN_REPO = `
    open_issues = excluded.open_issues,
    open_pulls = excluded.open_pulls,
    counts_include_pulls = excluded.counts_include_pulls,
    size_kb = excluded.size_kb,
    -- A listing that does not report the parent must not forget one we
    -- already know: listRepos omits it on both forges, getRepo states it.
    fork_of = COALESCE(excluded.fork_of, origin_repo.fork_of)`;
@@ -421,6 +426,7 @@
const upsertArgs = (
  repo.openPulls,
  repo.openIssuesIncludesPulls ? 1 : 0,
  repo.parent,
  Number.isSafeInteger(repo.sizeKb) && repo.sizeKb > 0 ? repo.sizeKb : 0,
];
/**
@@ -5003,7 +5003,8 @@
export function apiRoutes(router: Router<Handler>): void {
  //
  // A repository brought here for good: `source` is `{ originId, fullName }`
  // (one of your origins, its credential in the environment) or `{ url }`
  // (public, anonymous). Refusals are words before anything exists; the
  // (public, anonymous); `branch` is the one the app lives on (left out,
  // the one with your newest commits). Refusals are words before anything exists; the
  // clone itself is the job this answers with, watched at /migrate/:job.
  router.add("POST", "/api/v1/migrate", async (ctx) => {
@@ -5039,6 +5040,7 @@
export function apiRoutes(router: Router<Handler>): void {
      source,
      ...(typeof input.owner === "string" ? { owner: input.owner } : {}),
      ...(typeof input.name === "string" ? { name: input.name } : {}),
      ...(typeof input.branch === "string" ? { branch: input.branch } : {}),
      ...(input.visibility === "public" || input.visibility === "private"
        ? { visibility: input.visibility }
        : {}),
@@ -0,0 +1,159 @@
/**
 * Carry: a migrated repository's conversations, brought along once.
 *
 * A mirror keeps importing; a migration imports one time and then the
 * forge is where the conversation lives. So the rows are written by the
 * mirror's own upserts (`import.ts` — the same clamps, the origin's
 * numbers, `issue_seq` dragged past them, the real author in
 * `origin_author` so every page says "by @x on GitHub") with two
 * differences that make them native:
 *
 * - every issue and pull starts with a line naming where it came from and
 *   linking the original, so the trail back survives the origin; and
 * - a pull is a pull *here*: `origin_head_repo` is cleared, so it reviews,
 *   merges and reverts like one opened on this forge. Its head is the
 *   branch the clone already brought. A pull whose head lived in a fork
 *   keeps `origin_head_repo` — a stranger's code, whose check and preview
 *   wait for a writer's "Approve to run here" (`core/pull_trust.ts`), as a
 *   mirror's do — and is returned in `forkPulls`, for the caller to fetch
 *   its head into `refs/pull/<n>/head`.
 *
 * Every issue comes, open and closed; of pulls only the open ones — a
 * closed pull's work is either in the history already or was turned down.
 * Plain data in (a provider, the repository's ids), counts out; no git.
 */
import type { Database } from "bun:sqlite";
import { importComments, importIssue, importLabels } from "./import.ts";
import type { ListIssuesQuery, Provider, RemoteIssue } from "./types.ts";
/** Pages of 100 per kind: 10 000 conversations is the ceiling of one move. */
export const MAX_PAGES = 100;
export interface CarryInput {
  readonly db: Database;
  readonly provider: Provider;
  /** `owner/name` on the origin. */
  readonly fullName: string;
  readonly repoId: string;
  /** Who migrated it: the local author of every row, as a mirror's are. */
  readonly actorId: string;
  /** Progress, as a job's detail line. */
  readonly report?: (stage: "issues" | "pulls", detail: string) => void;
}
export interface ForkPull {
  readonly issueId: string;
  readonly number: number;
}
export interface Carried {
  readonly labels: number;
  readonly issues: number;
  readonly pulls: number;
  readonly comments: number;
  /** Open pulls whose head branch is in a fork, not in the clone. */
  readonly forkPulls: readonly ForkPull[];
  /** The first thing the origin refused, in words; "" when nothing was. */
  readonly error: string;
}
/** What a person calls the origin: "GitHub", or its host. */
export function originName(provider: Pick<Provider, "kind" | "webUrl">): string {
  if (provider.kind === "github") return "GitHub";
  return URL.parse(provider.webUrl)?.host ?? "the origin";
}
/**
 * The line an imported body opens with. The link is only an http(s) URL
 * the origin gave — anything else is named without one — and the author's
 * login is reduced to the characters a login can hold.
 */
export function backlink(
  remote: Pick<RemoteIssue, "number" | "author" | "htmlUrl">,
  fullName: string,
  where: string,
): string {
  const url = URL.parse(remote.htmlUrl);
  const ref = `${fullName}#${remote.number}`;
  const linked =
    url !== null && (url.protocol === "https:" || url.protocol === "http:")
      ? `[${ref}](${url.href.replace(/[()\s]/g, encodeURIComponent)})`
      : ref;
  const login = remote.author.replace(/[^A-Za-z0-9._-]/g, "").slice(0, 64);
  const by = login === "" ? "" : ` by @${login}`;
  return `> Migrated from ${linked}${by} on ${where}.`;
}
export async function carryConversations(input: CarryInput): Promise<Carried> {
  const { db, provider, fullName, repoId, actorId } = input;
  const where = originName(provider);
  const ctx = { db, repoId, actorId };
  let error = "";
  const counts = { labels: 0, issues: 0, pulls: 0, comments: 0 };
  const forkPulls: ForkPull[] = [];
  const labels = await provider.listLabels(fullName);
  if (labels.ok) {
    importLabels(db, repoId, labels.value);
    counts.labels = labels.value.length;
  } else error = labels.error.message;
  const passes: [ListIssuesQuery["kind"], ListIssuesQuery["state"]][] = [
    ["issue", "all"],
    ["pull", "open"],
  ];
  for (const [kind, state] of passes) {
    let cursor: string | undefined;
    for (let page = 0; page < MAX_PAGES; page++) {
      const listed = await provider.listIssues(fullName, {
        kind,
        state,
        ...(cursor === undefined ? {} : { cursor }),
      });
      if (!listed.ok) {
        error ||= listed.error.message;
        break;
      }
      for (const remote of listed.value.items) {
        if (!Number.isInteger(remote.number) || remote.number < 1) continue;
        // A listing of issues that slips a pull in (or the reverse) is not
        // trusted to say which it is twice.
        if ((remote.pull !== undefined) !== (kind === "pull")) continue;
        const body = `${backlink(remote, fullName, where)}\n\n${remote.body}`;
        const imported = importIssue(ctx, { ...remote, body });
        if (remote.pull !== undefined) {
          const sameRepo =
            remote.pull.headRepo === "" ||
            remote.pull.headRepo.toLowerCase() === fullName.toLowerCase();
          if (sameRepo)
            db.query(
              "UPDATE pull SET origin_head_repo = NULL WHERE issue_id = ?1",
            ).run(imported.issueId);
          else forkPulls.push({ issueId: imported.issueId, number: remote.number });
          counts.pulls++;
        } else counts.issues++;
        if (remote.comments > 0) {
          const comments = await provider.listComments(fullName, remote.number);
          if (comments.ok)
            counts.comments += importComments(ctx, imported.issueId, comments.value);
          else error ||= comments.error.message;
        }
        input.report?.(
          kind === "issue" ? "issues" : "pulls",
          kind === "issue"
            ? `${plural(counts.issues, "issue")}, ${plural(counts.comments, "comment")}`
            : plural(counts.pulls, "open pull request"),
        );
      }
      if (listed.value.next === null) break;
      cursor = listed.value.next;
    }
  }
  return { ...counts, forkPulls, error };
}
export function plural(n: number, one: string, many = `${one}s`): string {
  return `${n} ${n === 1 ? one : many}`;
}
@@ -790,6 +790,7 @@
function toRepo(raw: unknown): RemoteRepo {
    openIssues: asNumber(field(raw, "open_issues_count")),
    openPulls: asNumber(field(raw, "open_pr_counter")),
    openIssuesIncludesPulls: false,
    sizeKb: asNumber(field(raw, "size")),
  };
}
@@ -708,6 +708,7 @@
function toRepo(raw: unknown): RemoteRepo {
    openIssues: asNumber(field(raw, "open_issues_count")),
    openPulls: 0,
    openIssuesIncludesPulls: true,
    sizeKb: asNumber(field(raw, "size")),
  };
}
@@ -78,6 +78,8 @@
export interface RemoteRepo {
  readonly openIssues: number;
  readonly openPulls: number;
  readonly openIssuesIncludesPulls: boolean;
  /** On-disk size as the origin reports it, in KiB; 0 when it says nothing. */
  readonly sizeKb: number;
}
export interface RemoteLabel {
@@ -0,0 +1,186 @@
/**
 * The work branch: of a repository's branches, the one its person was
 * working on. A fork keeps the upstream's tree on `main` and the person's
 * app on a branch of their own (`workbench`, four commits ahead), so the
 * source's default branch is not always where the app is. The rule is the
 * one a person would use looking at the list: the branch whose last commit
 * is theirs and newest; when none is theirs, the source's own default.
 *
 * A branch's last commit is read two ways, to the same shape: from a clone
 * already on disk (one `git for-each-ref`, every branch) or from an origin's
 * API before anything is cloned (one listing, then one commit per branch,
 * bounded). Whose a commit is: an account login the origin resolved, or an
 * author email or name that is one of the person's.
 */
import { runGitCapture } from "../git/env.ts";
import { isSafeRef } from "../git/guard.ts";
import type { Provider, RemoteCommit } from "./types.ts";
export interface BranchTip {
  readonly name: string;
  readonly oid: string;
  /** The last commit's author date, ISO 8601; "" when not known. */
  readonly date: string;
  readonly subject: string;
  /** Who wrote it, as the page shows it: a login, else the author's name. */
  readonly author: string;
  /** Written by the person migrating. */
  readonly mine: boolean;
}
/** The person, as commits may name them. Compared without case. */
export interface Who {
  readonly logins: readonly string[];
  readonly emails: readonly string[];
}
/** Branches whose last commit an origin is asked for; past it, names alone. */
export const TIP_LOOKUPS = 30;
/**
 * Whether an author is the person: a login the origin resolved, an email
 * of theirs (GitHub's `<id>+<login>@users.noreply.github.com` included),
 * or a name that is one of their logins.
 */
export function isMine(
  author: { readonly name: string; readonly email: string; readonly login?: string },
  who: Who,
): boolean {
  const logins = who.logins.map((l) => l.toLowerCase()).filter((l) => l !== "");
  const emails = who.emails.map((e) => e.toLowerCase()).filter((e) => e !== "");
  const login = (author.login ?? "").toLowerCase();
  const email = author.email.toLowerCase().replace(/^<|>$/g, "");
  const name = author.name.toLowerCase();
  if (login !== "" && logins.includes(login)) return true;
  if (email !== "" && emails.includes(email)) return true;
  const noreply = /^(?:\d+\+)?([^@]+)@users\.noreply\.github\.com$/.exec(email);
  if (noreply !== null && logins.includes(noreply[1]!)) return true;
  return name !== "" && logins.includes(name);
}
/**
 * The branch to work on: the newest tip that is the person's; else the
 * fallback when it is a branch; else the newest tip of all. ISO dates
 * compare as strings once they share a zone, so they are compared as times.
 */
export function pickWorkBranch(
  tips: readonly BranchTip[],
  fallback: string | undefined,
): string | undefined {
  const newest = (rows: readonly BranchTip[]): BranchTip | undefined =>
    [...rows].sort(
      (a, b) => time(b.date) - time(a.date) || a.name.localeCompare(b.name),
    )[0];
  const mine = newest(tips.filter((t) => t.mine));
  if (mine !== undefined) return mine.name;
  if (fallback !== undefined && tips.some((t) => t.name === fallback))
    return fallback;
  return newest(tips)?.name;
}
const time = (iso: string): number => {
  const t = Date.parse(iso);
  return Number.isFinite(t) ? t : 0;
};
/** Every branch's last commit in a repository on disk, newest first. */
export async function localTips(dir: string, who: Who): Promise<BranchTip[]> {
  const listed = await runGitCapture(
    [
      "for-each-ref",
      "--sort=-authordate",
      "--format=%(refname)%00%(objectname)%00%(authordate:iso-strict)%00%(authorname)%00%(authoremail)%00%(contents:subject)",
      "refs/heads/",
    ],
    { cwd: dir },
  );
  if (listed.code !== 0) return [];
  const tips: BranchTip[] = [];
  for (const line of listed.stdout.split("\n")) {
    const [ref, oid, date, name, email, subject] = line.split("\0");
    if (ref === undefined || !ref.startsWith("refs/heads/")) continue;
    const branch = ref.slice("refs/heads/".length);
    tips.push({
      name: branch,
      oid: oid ?? "",
      date: date ?? "",
      subject: subject ?? "",
      author: name ?? "",
      mine: isMine({ name: name ?? "", email: email ?? "" }, who),
    });
  }
  return tips;
}
/**
 * Every branch's last commit as an origin reports it, before any clone —
 * what the picker draws. One listing, then the first {@link TIP_LOOKUPS}
 * branches' commits side by side; the rest come back with no commit.
 * `undefined` when the origin will not list.
 */
export async function remoteTips(
  provider: Provider,
  fullName: string,
  who: Who,
): Promise<BranchTip[] | undefined> {
  const listed = await provider.listBranches(fullName);
  if (!listed.ok) return undefined;
  const branches = listed.value.filter((b) => isSafeRef(b.name));
  return Promise.all(
    branches.map(async (branch, i): Promise<BranchTip> => {
      const bare = {
        name: branch.name,
        oid: branch.oid,
        date: "",
        subject: "",
        author: "",
        mine: false,
      };
      if (i >= TIP_LOOKUPS || branch.oid === "") return bare;
      const page = await provider.listCommits(fullName, branch.oid);
      const last: RemoteCommit | undefined = page.ok ? page.value.items[0] : undefined;
      if (last === undefined) return bare;
      return {
        ...bare,
        date: last.author.date,
        subject: last.message.split("\n")[0] ?? "",
        author: last.author.login ?? last.author.name,
        mine: isMine(last.author, who),
      };
    }),
  );
}
/** How long the picker reuses one repository's tips: a reload, a 422. */
export const TIPS_TTL_MS = 60_000;
const TIPS_KEPT = 64;
const tipsSeen = new Map<string, { readonly at: number; readonly tips: BranchTip[] }>();
/**
 * {@link remoteTips} through a short memory, keyed by origin and repository
 * — an origin belongs to one person, so the key is theirs alone. A reload
 * of the picker costs no requests to the origin, nor its rate limit; a
 * refusal is not remembered. Past {@link TIPS_KEPT} keys the oldest goes.
 */
export async function cachedRemoteTips(
  originId: string,
  provider: Provider,
  fullName: string,
  who: Who,
  now: number = Date.now(),
): Promise<BranchTip[] | undefined> {
  const key = `${originId}\0${fullName}`;
  const seen = tipsSeen.get(key);
  if (seen !== undefined && now - seen.at < TIPS_TTL_MS) return seen.tips;
  const tips = await remoteTips(provider, fullName, who);
  if (tips === undefined) return undefined;
  tipsSeen.delete(key);
  tipsSeen.set(key, { at: now, tips });
  while (tipsSeen.size > TIPS_KEPT) {
    const oldest = tipsSeen.keys().next().value;
    if (oldest === undefined) break;
    tipsSeen.delete(oldest);
  }
  return tips;
}
@@ -4,6 +4,15 @@
 * pasted URL, lands under an owner and a name you choose, and — when you
 * put a crew on it — becomes an app the crew is already making run.
 *
 * GitHub connects from here too ("Connect GitHub" runs the origins'
 * device flow and comes back), and is disconnected from here. Each of your
 * repositories there is a row; one click on a row migrates it with the crew
 * picked below — issues and open pull requests included.
 *
 * A row's Branches link draws that repository's branches with their last
 * commits and selects the one the app most likely lives on — the person's
 * newest (`origins/work-branch.ts`); the Migrate button carries the choice.
 *
 * Every mutation is `migrateRepo`; the page only puts its answer into words.
 */
@@ -17,7 +26,13 @@
import {
} from "../../actions/migrate.ts";
import { listRemoteRepos, listUserOrigins } from "../../actions/origins.ts";
import { accessAllows, listOrgsForUser, orgAccess } from "../../core/orgs.ts";
import type { OriginRepoRow } from "../../core/origins.ts";
import { getOriginFor, type OriginRepoRow } from "../../core/origins.ts";
import { providerForOrigin } from "../../origins/credential.ts";
import {
  cachedRemoteTips,
  pickWorkBranch,
  type BranchTip,
} from "../../origins/work-branch.ts";
import { scopeAllows } from "../../core/tokens.ts";
import type { Ctx } from "../../http/context.ts";
import type { MirrorJob, MirrorStage } from "../../origins/jobs.ts";
@@ -25,44 +40,309 @@
import { notFoundPage, pageHead, signInFirst } from "../chrome.ts";
import { field, readForm } from "../form.ts";
import { html, raw, type Html } from "../html.ts";
import { flashTo, page, redirect } from "../layout.ts";
import { btn, card, icon, selectField, field as formField } from "../ui.ts";
import {
  badge,
  btn,
  card,
  icon,
  row,
  selectField,
  field as formField,
} from "../ui.ts";
import { prefill, originHost } from "./migrate-prefill.ts";
import { hostLabel } from "./origins.ts";
import { githubConnectable, hostLabel } from "./origins.ts";
interface MigrateValues {
  source: string;
  /** The picker's filter: rows whose name or description holds it. */
  q: string;
  url: string;
  owner: string;
  name: string;
  visibility: string;
  agent: string;
  autonomous: boolean;
  /** The branch asked for; "" lets the work-branch rule choose. */
  branch: string;
  /** Draw the picked repository's branches: Branches was pressed, or one was chosen. */
  showBranches: boolean;
}
/** The picked repository's branches, and the one selected. */
interface BranchChoices {
  readonly fullName: string;
  readonly sourceDefault: string;
  readonly tips: readonly BranchTip[];
  readonly selected: string | undefined;
}
/** An origin's repositories, for the picker; an origin that cannot answer is left out. */
interface OriginChoices {
  readonly label: string;
  readonly id: string;
  readonly kind: string;
  readonly host: string;
  readonly repos: readonly OriginRepoRow[];
}
/** Every origin you connected; one that cannot list has no rows. */
async function originChoices(ctx: Ctx): Promise<OriginChoices[]> {
  const user = ctx.auth.user!;
  const out: OriginChoices[] = [];
  for (const origin of listUserOrigins(ctx.app, user)) {
    const listed = await listRemoteRepos(ctx.app, user, origin.id);
    if (!listed.ok || listed.value.length === 0) continue;
    out.push({
      id: origin.id,
      kind: origin.kind,
      host: originHost(origin.webUrl),
      label: `${origin.login} @ ${hostLabel(origin.webUrl)}`,
      repos: listed.value,
      repos: listed.ok ? listed.value : [],
    });
  }
  return out;
}
/**
 * The branches of the repository `source` names, when it is one of the
 * picker's rows: read through its origin, with the selection the work-branch
 * rule makes — or the branch asked for, when it is one of them.
 */
async function branchChoices(
  ctx: Ctx,
  origins: readonly OriginChoices[],
  source: string,
  asked: string,
): Promise<BranchChoices | undefined> {
  const picked = source === "" ? undefined : parsePick(source);
      
        sentinelcrew
        24d ago
        outdated
      
      This runs on every GET and every 422 re-render: one branch listing plus up to 30 commits requests to the origin. Cache it, or ask only when Branches is pressed, so the page stays fast and the GitHub rate limit is not spent on reloads.
    
  if (picked === undefined || "url" in picked) return undefined;
  const row = origins
    .find((o) => o.id === picked.originId)
    ?.repos.find((r) => r.fullName === picked.fullName);
  const user = ctx.auth.user!;
  const origin = getOriginFor(ctx.app.db, user.id, picked.originId);
  if (row === undefined || origin === undefined) return undefined;
  const provider = providerForOrigin(ctx.app, origin);
  if (!provider.ok) return undefined;
  const tips = await cachedRemoteTips(origin.id, provider.value, row.fullName, {
    logins: [origin.login, user.username],
    emails: [user.email],
  });
  if (tips === undefined || tips.length === 0) return undefined;
  return {
    fullName: row.fullName,
    sourceDefault: row.defaultBranch,
    tips,
    selected: tips.some((t) => t.name === asked)
      ? asked
      : pickWorkBranch(tips, row.defaultBranch),
  };
}
/**
 * One radio per branch, newest first: its last commit's subject, author
 * and date (UTC), the source's default marked, the person's own marked.
 */
function branchList(choices: BranchChoices): Html {
  const rows = [...choices.tips].sort(
    (a, b) => (Date.parse(b.date) || 0) - (Date.parse(a.date) || 0),
  );
  return html`<div class="field" id="migrate-branches">
    <label>Branch the app lives on — ${choices.fullName}</label>
    <ul class="list">
      ${rows.map((tip) =>
        row({
          data: { branch: tip.name },
          title: html`<label class="check">
            <input
              type="radio"
              name="branch"
              value="${tip.name}"
              ${tip.name === choices.selected ? raw("checked") : null}
            />
            <span class="mono">${tip.name}</span>
          </label>`,
          ...(tip.date === ""
            ? {}
            : {
                meta: html`${tip.subject} · ${tip.author} ·
                  <time datetime="${tip.date}">${tip.date.slice(0, 10)}</time>`,
              }),
          trail: html`${tip.name === choices.sourceDefault
            ? badge("default there")
            : null}${tip.mine ? badge("yours") : null}`,
        }),
      )}
    </ul>
    <span class="hint"
      >Every branch comes; this one becomes the default branch here, and the
      crew is told the app is on it. Selected: the branch with your newest
      commits, else the origin's default.</span
    >
  </div>`;
}
/** Rows drawn per origin; past it, the filter narrows. */
export const PICKER_ROWS = 200;
/**
 * A size an origin reported in KiB, in the unit that keeps it short:
 * 1 KiB = 1024 bytes, 1 MiB = 1024 KiB. 0 is "not reported" — GitHub says
 * 0 for an empty repository too — so it draws nothing.
 */
export function formatKib(kib: number): string {
  if (!Number.isFinite(kib) || kib <= 0) return "";
  if (kib < 1024) return `${Math.round(kib)} KiB`;
  const mib = kib / 1024;
  if (mib < 1024) return `${mib < 10 ? mib.toFixed(1) : Math.round(mib)} MiB`;
  const gib = mib / 1024;
  return `${gib < 10 ? gib.toFixed(1) : Math.round(gib)} GiB`;
}
/** Whether a row answers the filter: name or description, any case. */
export function matchesFilter(
  repo: Pick<OriginRepoRow, "fullName" | "description">,
  q: string,
): boolean {
  const needle = q.trim().toLowerCase();
  return (
    needle === "" ||
    repo.fullName.toLowerCase().includes(needle) ||
    repo.description.toLowerCase().includes(needle)
  );
}
/**
 * The accounts half, outside the migrate form (forms do not nest): each
 * connected origin with a Disconnect, and Connect GitHub when there is no
 * GitHub account yet. Both come back here (`then=migrate`).
 */
function accounts(ctx: Ctx, origins: readonly OriginChoices[]): Html {
  const hasGithub = origins.some((o) => o.kind === "github");
  const connect = hasGithub
    ? null
    : githubConnectable(ctx)
      
        sentinelcrew
        24d ago
        outdated
      
      This is a second primary on the page, beside the form's Migrate button. One filled button per page: make this secondary or outline.
    
      ? html`<form method="post" action="/settings/origins/oauth" class="bar">
          <input type="hidden" name="kind" value="github" />
          <input type="hidden" name="then" value="migrate" />
          ${btn("Connect GitHub", { variant: "outline", icon: "github", type: "submit" })}
          <span class="muted small"
            >A short code you type at github.com — no token to paste. Your
            private repositories and their issues come too.</span
          >
        </form>`
      : html`<p class="muted small">
          ${icon("github")} Connect GitHub needs this forge's GitHub
          application, set up once under
          <a href="/settings/origins">Settings → Origins</a>; a token pasted
          there works until then.
        </p>`;
  return card(
    html`${origins.length === 0
      ? null
      : html`<ul class="list" id="migrate-accounts">
          ${origins.map((origin) =>
            row({
              lead: icon(origin.kind === "github" ? "github" : "globe"),
              title: origin.label,
              meta: html`${origin.repos.length} repositories`,
              trail: html`<form
                method="post"
                action="/settings/origins/${origin.id}/delete"
              >
                <input type="hidden" name="then" value="migrate" />
                ${btn("Disconnect", { size: "sm", variant: "ghost", type: "submit" })}
              </form>`,
            }),
          )}
        </ul>`}
    ${connect}`,
    {
      head: html`${icon("globe")}
        <h2>Your accounts</h2>`,
    },
  );
}
/**
 * One row per repository: name, private mark, size, description, and the
 * button that migrates it. The buttons are the form's submitters
 * (`name="pick"`), so one click carries the destination and crew fields
 * below with it.
 */
function picker(
  origins: readonly OriginChoices[],
  values: MigrateValues,
  withCrew: boolean,
  branches: BranchChoices | undefined,
): Html {
  const listed = origins.filter((o) => o.repos.length > 0);
  if (listed.length === 0)
    return html`<p class="muted small mb">
      ${icon("globe")} Connect an account above — or another forge under
      <a href="/settings/origins">Settings → Origins</a> — to pick from your
      repositories there, private ones included.
    </p>`;
  return html`<div class="field" id="migrate-picker">
    <label for="f-q">Your repositories</label>
    <input
      class="input"
      type="search"
      id="f-q"
      name="q"
      form="migrate-search"
      value="${values.q}"
      placeholder="Filter by name or description"
      autocomplete="off"
    />
    ${values.source === ""
      ? null
      : html`<input type="hidden" name="source" value="${values.source}" />`}
    ${listed.map((origin) => {
      const rows = origin.repos.filter((r) => matchesFilter(r, values.q));
      const shown = rows.slice(0, PICKER_ROWS);
      return html`<h4 class="mt small muted">${origin.label}</h4>
        <ul class="list" data-pick-rows>
          ${shown.map((remote) => {
            const value = pickValue(origin.id, remote.fullName);
      
        sentinelcrew
        24d ago
        outdated
      
      plain-list and pick-rows are not defined in any style module. Use the list row component row() from DESIGN.md §5 here, and for the account and branch lists too.
    
            const size = formatKib(remote.sizeKb);
            const branches = `/migrate?${new URLSearchParams({
              source: value,
              branches: "1",
              ...(values.q === "" ? {} : { q: values.q }),
            })}#migrate-branches`;
            return row({
              data: {
                q: `${remote.fullName} ${remote.description}`.toLowerCase(),
              },
              current: values.source === value,
              title: html`<span class="mono">${remote.fullName}</span>
                ${remote.private ? badge("private") : null}`,
              meta: html`${size === "" ? null : html`${size} · `}${remote.description}`,
              trail: html`${btn("Branches", { href: branches, size: "sm", variant: "ghost" })}
              ${btn(withCrew ? "Migrate with the crew" : "Migrate", {
                size: "sm",
                variant: "outline",
                type: "submit",
                name: "pick",
                value,
              })}`,
            });
          })}
        </ul>
        ${rows.length > shown.length
      
        sentinelcrew
        24d ago
        outdated
      
      This button's markup is hand-written. Use btn() with size: "sm", variant: "outline"; it can still carry name="pick" and value.
    
          ? html`<p class="muted small">
              ${rows.length - shown.length} more — filter to narrow.
            </p>`
          : null}`;
    })}
    ${branches === undefined ? null : branchList(branches)}
    <span class="hint"
      >Cloned with your account's credential, so private repositories come
      too — with their issues, comments, labels and open pull requests.</span
    >
  </div>`;
}
/** `<origin id>/<owner>/<name>` — an id never holds a slash, so the first one splits. */
const pickValue = (originId: string, fullName: string): string =>
  `${originId}/${fullName}`;
@@ -77,6 +357,7 @@
function migrateForm(
  ctx: Ctx,
  values: MigrateValues,
  origins: readonly OriginChoices[],
  branches: BranchChoices | undefined,
  error?: string,
  unmatched: readonly string[] = [],
): Html {
@@ -88,63 +369,38 @@
function migrateForm(
  const agents = listAllAgents(ctx.app, user);
  const crew = agents.ok ? agents.value : [];
  const picker =
    origins.length === 0
      ? html`<p class="muted small mb">
          ${icon("globe")} Connect an origin under
          <a href="/settings/origins">Settings → Origins</a> to pick from your
          repositories there, private ones included.
        </p>`
      : html`<div class="field">
          <label for="f-source">From one of your origins</label>
          <select class="input" id="f-source" name="source">
            <option value="" ${values.source === "" ? raw("selected") : null}>
              — none, I'll paste a URL —
            </option>
            ${origins.map(
              (origin) =>
                html`<optgroup label="${origin.label}">
                  ${origin.repos.map((remote) => {
                    const value = pickValue(origin.id, remote.fullName);
                    return html`<option
                      value="${value}"
                      data-name="${remote.fullName.split("/").pop() ?? ""}"
                      ${values.source === value ? raw("selected") : null}
                    >
                      ${remote.fullName}${remote.private ? " (private)" : ""}
                    </option>`;
                  })}
                </optgroup>`,
            )}
          </select>
          <span class="hint"
            >Cloned with your origin's credential, so private repositories come
            too.</span
          >
        </div>`;
  return html`<div class="narrow-wide">
    ${pageHead("Migrate a repository", {
      sub: "A one-time clone of the whole history — every branch, every tag — into a repository that lives here from now on. Nothing is written back to where it came from.",
    })}
    ${ctx.url.searchParams.get("connected") === "1"
      ? html`<p class="muted small mb" id="migrate-connected">
          ${icon("check")} Connected. Pick a repository below — one click
          migrates it.
        </p>`
      : null}
    ${unmatched.length === 0
      ? null
      : html`<p class="muted small mb" id="prefill-unmatched">
          ${icon("globe")} Ignored, nothing here matches:
          ${unmatched.join(", ")}
        </p>`}
    ${accounts(ctx, origins)}
    <form method="get" action="/migrate" id="migrate-search"></form>
    ${card(
      html`<form method="post" action="/migrate">
        <h3 class="mb">Source</h3>
        ${picker}
        ${picker(origins, values, crew.length > 0, branches)}
        ${formField({
          label: origins.length === 0 ? "Repository URL" : "Or a URL",
          label: origins.every((o) => o.repos.length === 0)
            ? "Repository URL"
            : "Or a URL",
          name: "url",
          value: values.url,
          placeholder: "https://github.com/owner/name",
          autocomplete: "off",
          mono: true,
          autofocus: origins.length === 0,
          autofocus: origins.every((o) => o.repos.length === 0),
          hint: "Any public repository over https, http or git. It is cloned anonymously.",
        })}
        <h3 class="mb mt">Destination</h3>
@@ -241,7 +497,13 @@
const migrateJs = /* js */ `
(function () {
  var name = document.getElementById('f-name');
  var url = document.getElementById('f-url');
  var source = document.getElementById('f-source');
  var q = document.getElementById('f-q');
  if (q) q.addEventListener('input', function () {
    var needle = q.value.trim().toLowerCase();
    var rows = document.querySelectorAll('[data-pick-rows] [data-q]');
    for (var i = 0; i < rows.length; i++)
      rows[i].hidden = needle !== '' && rows[i].getAttribute('data-q').indexOf(needle) < 0;
  });
  if (!name) return;
  var touched = name.value.trim() !== '';
  name.addEventListener('input', function () { touched = true; });
@@ -251,29 +513,30 @@
const migrateJs = /* js */ `
  }
  function follow() {
    if (touched) return;
    var picked = source && source.selectedIndex > 0
      ? source.options[source.selectedIndex].getAttribute('data-name') || ''
      : '';
    name.value = picked !== '' ? picked : url ? fromUrl(url.value) : '';
    name.value = url ? fromUrl(url.value) : '';
  }
  if (url) url.addEventListener('input', follow);
  if (source) source.addEventListener('change', follow);
})();
`;
function show(
async function show(
  ctx: Ctx,
  values: MigrateValues,
  origins: readonly OriginChoices[],
  error?: string,
  status = 200,
  unmatched: readonly string[] = [],
): Response {
): Promise<Response> {
  // Asked for only: each draw is a listing and a commit per branch at the
  // origin (remembered a minute), so a plain visit costs none of it.
  const branches = values.showBranches
    ? await branchChoices(ctx, origins, values.source, values.branch)
    : undefined;
  return page(
    {
      ctx,
      title: "Migrate",
      body: migrateForm(ctx, values, origins, error, unmatched),
      body: migrateForm(ctx, values, origins, branches, error, unmatched),
      scriptJs: migrateJs,
    },
    status,
@@ -286,10 +549,11 @@
export async function migratePage(ctx: Ctx): Promise<Response> {
  const q = ctx.url.searchParams;
  const origins = await originChoices(ctx);
  const agents = listAllAgents(ctx.app, ctx.auth.user);
  const names = agents.ok ? agents.value.map((a) => a.user.username) : [];
  const linked = prefill(
    { from: q.get("from"), crew: q.get("crew") },
    origins,
    agents.ok ? agents.value.map((a) => a.user.username) : [],
    names,
  );
  return show(
    ctx,
@@ -297,12 +561,17 @@
export async function migratePage(ctx: Ctx): Promise<Response> {
      source: linked.repo
        ? pickValue(linked.repo.originId, linked.repo.fullName)
        : (q.get("source") ?? ""),
      q: (q.get("q") ?? "").slice(0, 100),
      url: q.get("url") ?? "",
      owner: q.get("owner") ?? ctx.auth.user.username,
      name: q.get("name") ?? (linked.repo?.fullName.split("/").pop() ?? ""),
      visibility: "private",
      agent: linked.agent ?? "",
      // One click on a row is "with the crew": the first agent is ready
      // unless the link named one; "Nobody" is one choice away.
      agent: linked.agent ?? names[0] ?? "",
      autonomous: false,
      branch: (q.get("branch") ?? "").slice(0, 300),
      showBranches: q.get("branches") === "1" || (q.get("branch") ?? "") !== "",
    },
    origins,
    undefined,
@@ -317,14 +586,24 @@
export async function migrateSubmit(ctx: Ctx): Promise<Response> {
  const form = await readForm(ctx, "rw");
  if (form instanceof Response) return form;
  const values: MigrateValues = {
    source: field(form, "source"),
    // A row's button names its repository; it wins over a prefilled pick.
    source: field(form, "pick") || field(form, "source"),
    q: "",
    url: field(form, "url").trim(),
    owner: field(form, "owner"),
    name: field(form, "name").trim(),
    visibility: field(form, "visibility") === "public" ? "public" : "private",
    agent: field(form, "agent"),
    autonomous: field(form, "autonomous") !== "",
    // A branch belongs to the repository its list was drawn for: another
    // row's button migrates that row by the rule, not by this choice.
    branch:
      field(form, "pick") === "" || field(form, "pick") === field(form, "source")
        ? field(form, "branch").trim()
        : "",
    showBranches: false,
  };
  values.showBranches = values.branch !== "";
  const again = async (message: string): Promise<Response> =>
    show(ctx, values, await originChoices(ctx), message, 422);
@@ -348,6 +627,9 @@
export async function migrateSubmit(ctx: Ctx): Promise<Response> {
    owner: values.owner,
    name: values.name,
    visibility: values.visibility === "public" ? "public" : "private",
    ...(picked === undefined || values.branch === ""
      ? {}
      : { branch: values.branch }),
    ...(values.agent === ""
      ? {}
      : { crew: { agent: values.agent, autonomous: values.autonomous } }),
@@ -365,14 +647,23 @@
export async function migrateSubmit(ctx: Ctx): Promise<Response> {
const STAGES: { name: MirrorStage; label: string }[] = [
  { name: "creating", label: "Creating the repository" },
  { name: "fetching", label: "Cloning every branch and tag" },
  { name: "crew", label: "Putting the crew on it" },
  { name: "issues", label: "Bringing issues, comments and labels" },
  { name: "pulls", label: "Bringing open pull requests and their branches" },
  { name: "crew", label: "Making it an app and starting the crew's first run" },
  { name: "done", label: "Done" },
];
/** A pasted URL brings history alone: no conversation rows to wait on. */
const stagesFor = (job: MirrorJob): typeof STAGES =>
  job.originId === ""
    ? STAGES.filter((s) => s.name !== "issues" && s.name !== "pulls")
    : STAGES;
function stageRows(job: MirrorJob): Html {
  const at = STAGES.findIndex((s) => s.name === job.stage);
  const stages = stagesFor(job);
  const at = stages.findIndex((s) => s.name === job.stage);
  return html`<ol class="stages">
    ${STAGES.map((stage, i) => {
    ${stages.map((stage, i) => {
      const state =
        job.stage === "failed"
          ? "todo"
@@ -403,7 +694,7 @@
const migrateJobJs = /* js */ `
  var box = document.getElementById('migrate-job');
  var job = box && box.getAttribute('data-job');
  if (!job || typeof EventSource === 'undefined') return;
  var order = ['creating', 'fetching', 'crew', 'done'];
  var order = ['creating', 'fetching', 'issues', 'pulls', 'crew', 'done'];
  var source = new EventSource('/api/v1/migrate/' + encodeURIComponent(job) + '/stream');
  function patch(e) {
    var data;
@@ -374,6 +374,14 @@
const blankValues = (): ConnectValues => ({
 * the reader to find out on GitHub's site what to put in it, which is the
 * kind of dead end that sends someone back to pasting a token forever.
 */
/** Whether "Connect GitHub" has a client id to run the device flow with. */
      
        sentinelcrew
        24d ago
        
      
      githubConnectable was inserted between githubSection's doc comment and githubSection, so that comment now sits on top of the wrong function, next to this one's own comment. Move githubConnectable above that comment block.
    
export function githubConnectable(ctx: Ctx): boolean {
  return (
    (process.env.FORGE_GITHUB_CLIENT_ID ?? "").trim() !== "" ||
    listOriginApps(ctx.app, ctx.auth.user!).some((a) => a.kind === "github")
  );
}
function githubSection(configured: boolean, callback: string): Html {
  if (!configured) {
    const back =
@@ -617,9 +625,7 @@
function originsView(ctx: Ctx, values: ConnectValues): Html {
  const origins = listUserOrigins(ctx.app, user);
  const mirrors = mirrorsByOrigin(ctx.app.db, user.id);
  const apps = listOriginApps(ctx.app, user);
  const githubConfigured =
    (process.env.FORGE_GITHUB_CLIENT_ID ?? "").trim() !== "" ||
    apps.some((a) => a.kind === "github");
  const githubConfigured = githubConnectable(ctx);
  const matched =
    values.host === ""
      ? undefined
@@ -830,6 +836,16 @@
function connectMessage(error: string): string {
}
// POST /settings/origins/oauth
/**
 * Where a connect or a disconnect started, when it was not here: only
 * `/migrate`, named by a fixed word — never a path a form can choose.
 */
type Then = "/migrate" | undefined;
const thenOf = (value: string | null): Then =>
  value === "migrate" ? "/migrate" : undefined;
const thenQuery = (then: Then): string =>
  then === undefined ? "" : "then=migrate";
export async function originOAuthStart(ctx: Ctx): Promise<Response> {
  const denied = accountOnly(ctx);
  if (denied) return denied;
@@ -837,6 +853,7 @@
export async function originOAuthStart(ctx: Ctx): Promise<Response> {
  if (form instanceof Response) return form;
  const kind = field(form, "kind");
  const host = field(form, "host").trim();
  const then = thenOf(field(form, "then"));
  const back = callbackUri(ctx);
  if (back === "" && kind !== "github") {
@@ -869,11 +886,12 @@
export async function originOAuthStart(ctx: Ctx): Promise<Response> {
        : connectMessage(started.error.error);
    return shell(ctx, originsView(ctx, values), 422);
  }
  const to =
    started.value.flow === "code"
      ? `?to=${encodeURIComponent(started.value.url)}`
      : "";
  return redirect(`/settings/origins/flows/${started.value.flowId}${to}`);
  const query = new URLSearchParams(
    started.value.flow === "code" ? { to: started.value.url } : {},
  );
  if (then !== undefined) query.set("then", "migrate");
  const qs = query.size === 0 ? "" : `?${query}`;
  return redirect(`/settings/origins/flows/${started.value.flowId}${qs}`);
}
/**
@@ -959,14 +977,16 @@
export function originFlowPage(ctx: Ctx): Response {
  if (denied) return denied;
  const flow = getFlowFor(ctx.app.db, ctx.auth.user!.id, ctx.params.id ?? "");
  if (!flow) return shell(ctx, notFoundNote(), 404);
  const then = thenOf(ctx.url.searchParams.get("then"));
  if (flow.status === "done") return redirect("/settings/origins?connected=1");
  if (flow.status === "done")
    return redirect(`${then ?? "/settings/origins"}?connected=1`);
  if (flow.status === "failed")
    return redirect(
      `/settings/origins?error=${encodeURIComponent(flow.detail.slice(0, 120))}`,
    );
  const pollAction = `/settings/origins/flows/${flow.id}/poll`;
  const pollAction = `/settings/origins/flows/${flow.id}/poll${then === undefined ? "" : `?${thenQuery(then)}`}`;
  const authorize =
    flow.flow === "code"
      ? authorizeLink(ctx.url.searchParams.get("to") ?? "", flow.webUrl)
@@ -1152,13 +1172,17 @@
export async function originFlowPoll(ctx: Ctx): Promise<Response> {
      : redirect("/settings/origins?error=state");
  }
  const { status, detail } = polled.value;
  const then = thenOf(ctx.url.searchParams.get("then"));
  if (wantsJson) return Response.json({ status, detail });
  if (status === "done") return redirect("/settings/origins?connected=1");
  if (status === "done")
    return redirect(`${then ?? "/settings/origins"}?connected=1`);
  if (status === "failed")
    return redirect(
      `/settings/origins?error=${encodeURIComponent(detail.slice(0, 120))}`,
    );
  return redirect(`/settings/origins/flows/${ctx.params.id ?? ""}`);
  return redirect(
    `/settings/origins/flows/${ctx.params.id ?? ""}${then === undefined ? "" : `?${thenQuery(then)}`}`,
  );
}
// ---- one origin ----
@@ -1200,12 +1224,13 @@
export async function originDisconnect(ctx: Ctx): Promise<Response> {
    ctx.auth.user,
    ctx.params.id ?? "",
  );
  const back = thenOf(field(form, "then")) ?? "/settings/origins";
  if (!gone.ok)
    return flashTo(ctx, "/settings/origins", {
    return flashTo(ctx, back, {
      tone: "danger",
      message: "No such origin.",
    });
  return flashTo(ctx, "/settings/origins", {
  return flashTo(ctx, back, {
    message: gone.value.revokedUpstream
      ? "Disconnected, and the grant was revoked upstream."
      : "Disconnected. Revoke the token on the origin too if you want it dead there.",
@@ -829,6 +829,11 @@
export interface RowOptions {
  /** The row joins `j`/`k` keyboard traversal. */
  nav?: boolean;
  titleAttr?: string;
  /** `data-*` hooks on the row's `<li>` (a script's filter, a test's
   * handle). Keys are lower-case words and dashes; others are dropped. */
  data?: Readonly<Record<string, string>>;
  /** The row is the one chosen (`aria-current="true"`). */
  current?: boolean;
}
/** One list row. `<a>` when it navigates, `<div>` when it holds its own
@@ -851,7 +856,10 @@
export function row(o: RowOptions): Html {
  const attrs = html`class="row"
  ${o.state ? html`data-state="${o.state}"` : null}
  ${o.nav ? raw('data-nav tabindex="-1"') : null}`;
  return html`<li>
  const data = Object.entries(o.data ?? {})
    .filter(([key]) => /^[a-z][a-z-]*$/.test(key))
    .map(([key, value]) => html` data-${raw(key)}="${value}"`);
  return html`<li${data}${o.current ? raw(' aria-current="true"') : null}>
    ${o.href !== undefined
      ? html`<a href="${o.href}" ${attrs}>${inner}</a>`
      : html`<div ${attrs}>${inner}</div>`}
@@ -51,6 +51,8 @@
export interface FakeRepo {
  openIssues?: number;
  /** Forgejo only — GitHub has no separate pull counter. */
  openPulls?: number;
  /** KiB, as both forges report `size`. */
  sizeKb?: number;
}
export interface FakeIssue {
@@ -64,6 +66,8 @@
export interface FakeIssue {
  createdAt?: string;
  updatedAt?: string;
  closedAt?: string | null;
  /** What the listing says `comments` is; the thread itself is `comments`. */
  commentCount?: number;
  /** Present for a pull request. */
  pull?: {
    base: string;
@@ -936,6 +940,7 @@
function repoJson(state: FakeState, repo: FakeRepo): Record<string, unknown> {
    ssh_url: "",
    html_url: repo.htmlUrl ?? `https://example.invalid/${repo.fullName}`,
    permissions: { push: repo.push ?? true, admin: repo.admin ?? true },
    size: repo.sizeKb ?? 0,
    // Both forges report the parent here and nowhere else, which is why the
    // picker's cache must keep the one it has when a listing omits it.
    ...(repo.parent === undefined
@@ -975,7 +980,7 @@
function issueJson(
    updated_at: issue.updatedAt ?? issue.createdAt ?? new Date().toISOString(),
    closed_at: issue.closedAt ?? null,
    html_url: `${url.origin}/${issue.number}`,
    comments: 0,
    comments: issue.commentCount ?? 0,
  };
  if (issue.pull === undefined) return common;
  // GitHub marks a pull by the mere presence of this key; Forgejo puts the
@@ -23,6 +23,13 @@
import {
  migrateUrl,
} from "../src/actions/migrate.ts";
import { createAgent, listCrew } from "../src/actions/crew.ts";
import { connectOrigin } from "../src/actions/origins.ts";
import { getPull, pullStatus } from "../src/core/pulls.ts";
import { pullMayRun } from "../src/core/pull_trust.ts";
import { approveHere } from "../src/actions/pulls.ts";
import { labelsFor, listComments } from "../src/core/issues.ts";
import { backlink } from "../src/origins/carry.ts";
import { formatKib, matchesFilter } from "../src/web/pages/migrate.ts";
import {
  commitToBranch,
  createRepo,
@@ -39,7 +46,12 @@
import { createToken } from "../src/core/tokens.ts";
import { createSession } from "../src/core/sessions.ts";
import { advance, createJob, settled } from "../src/origins/jobs.ts";
import { forgetProviders } from "../src/origins/providers/index.ts";
import { newFakeState, serveFakeForge, type FakeForge } from "./fake-origin.ts";
import {
  newFakeOAuth,
  newFakeState,
  serveFakeForge,
  type FakeForge,
} from "./fake-origin.ts";
import { gitClientEnv } from "./helpers/git-client.ts";
import { prefill } from "../src/web/pages/migrate-prefill.ts";
import { quietLogs } from "./helpers/globals.ts";
@@ -98,6 +110,7 @@
describe("migrate", () => {
  let bobToken = "";
  let fixtureUrl = "";
  let originId = "";
  let octo: User;
  // octo's credential at the "upstream": a token, since a password would
  // cost an argon2 verify on every git request.
  let upstreamSecret = "";
@@ -185,7 +198,7 @@
describe("migrate", () => {
    // request here rides a session or a token.
    alice = await person("alice", true);
    bob = await person("bob");
    const octo = await person("octo");
    octo = await person("octo");
    upstreamSecret = createToken(app.db, octo.id, "upstream", "rw").token;
    aliceCookie = cookieOf(alice);
    bobCookie = cookieOf(bob);
@@ -517,6 +530,479 @@
describe("migrate", () => {
    );
  });
  test("one click from GitHub: the repository, 3 issues, 1 open pull request and a crew run on the app", async () => {
    // Upstream: a private repository with a branch an open pull stands on.
    const made = await createRepo(app, octo, {
      name: "gadgets",
      visibility: "private",
    });
    if (!made.ok) throw new Error(made.error);
    for (const [branch, path] of [
      ["main", "README.md"],
      ["fix-typo", "typo.txt"],
    ] as const) {
      const done = await commitToBranch(app, octo, made.value, {
        branch,
        message: `on ${branch}`,
        files: [{ path, content: "x\n" }],
      });
      if (!done.ok) throw new Error(String(done.error));
    }
    const upstreamDir = repoDir(app.reposRoot, "octo", "gadgets");
    const headSha = (await git(["rev-parse", "fix-typo"], upstreamDir)).out;
    // A fake GitHub API in front of it, seeded: 3 issues (one closed, one
    // with a comment), 1 open pull request, and 1 closed one that stays.
    const state = newFakeState("github", "octo", upstreamSecret);
    state.repos.push({
      id: 501,
      fullName: "octo/gadgets",
      description: "small machines",
      cloneUrl: `${base}/octo/gadgets.git`,
      htmlUrl: "https://github.com/octo/gadgets",
      defaultBranch: "main",
      private: true,
      sizeKb: 2048,
    });
    state.labels.set("octo/gadgets", [{ id: 9, name: "bug", color: "d73a4a" }]);
    state.issues.set("octo/gadgets", [
      { id: 601, number: 1, title: "Crashes on start", body: "Stack trace.", user: "mona", labels: ["bug"], commentCount: 1 },
      { id: 602, number: 2, title: "An old thing", user: "hubot", state: "closed", closedAt: "2026-01-02T00:00:00Z" },
      { id: 603, number: 3, title: "Write the docs", user: "mona" },
      {
        id: 604,
        number: 4,
        title: "Fix the typo",
        body: "One letter.",
        user: "octocat",
        pull: { base: "main", head: "fix-typo", headRepo: "octo/gadgets", headSha },
      },
      {
        id: 605,
        number: 5,
        title: "Turned down",
        user: "octocat",
        state: "closed",
        pull: { base: "main", head: "nope", headRepo: "octo/gadgets" },
      },
    ]);
    state.comments.set("octo/gadgets", [
      { id: 701, issueNumber: 1, body: "Same here.", user: "hubot" },
    ]);
    const github = serveFakeForge(state);
    try {
      forgetProviders(dataDir);
      const connected = await connectOrigin(app, alice, {
        host: github.url,
        kind: "github",
        token: upstreamSecret,
      });
      if (!connected.ok) throw new Error(connected.error);
      const agent = await createAgent(app, alice, {
        username: "mover",
        model: "",
        brief: "Moves things in.",
      });
      expect(agent.ok).toBe(true);
      // The picker: a row, marked private, sized, with its one button —
      // and the account it came through can be disconnected from here.
      const html = await (await browser(aliceCookie, "/migrate")).text();
      const row = new RegExp(`name="pick"\\s+value="(${connected.value.id}/octo/gadgets)"`).exec(html);
      expect(row).not.toBeNull();
      expect(html).toContain("2.0 MiB");
      expect(html).toContain("Migrate with the crew");
      expect(html).toContain(`action="/settings/origins/${connected.value.id}/delete"`);
      expect(html).toContain('name="then" value="migrate"');
      // The filter narrows the rows on the server too (no script needed).
      const filtered = await (await browser(aliceCookie, "/migrate?q=nothing-like-it")).text();
      expect(filtered).not.toContain('value="' + row![1] + '"');
      // One click: the row's button and the form's fields as they stood.
      const posted = await browser(aliceCookie, "/migrate", {
        pick: row![1]!,
        url: "",
        owner: "alice",
        name: "",
        visibility: "private",
        agent: "mover",
      });
      expect(posted.status).toBe(303);
      const where = posted.headers.get("location")!;
      const job = await settled(where.split("/").pop()!);
      expect(job?.error).toBeUndefined();
      expect(job?.stage).toBe("done");
      expect(job?.detail).toContain("3 issues, 1 open pull request, 1 comment");
      // It ends at the app: the repository's page is the app's.
      const landed = await browser(aliceCookie, where);
      expect(landed.headers.get("location")).toBe("/alice/gadgets");
      const repo = getRepo(app.db, "alice", "gadgets")!;
      expect(repo.origin).toBeNull();
      expect(getAppByRepo(app.db, repo.id)).toBeDefined();
      // The issues, open and closed, numbered as they were, by their
      // GitHub authors, each linking back.
      const carried = listIssues(app.db, repo.id, { kind: "issue", state: "all" })
        .filter((i) => i.originAuthor !== null)
        .sort((a, b) => a.number - b.number);
      expect(carried.map((i) => [i.number, i.state, i.originAuthor])).toEqual([
        [1, "open", "mona"],
        [2, "closed", "hubot"],
        [3, "open", "mona"],
      ]);
      expect(carried[0]!.body).toStartWith(
        "> Migrated from [octo/gadgets#1](",
      );
      expect(carried[0]!.body).toContain("by @mona on GitHub.");
      expect(carried[0]!.body).toContain("Stack trace.");
      expect(labelsFor(app.db, carried[0]!.id).map((l) => l.name)).toEqual(["bug"]);
      const comments = listComments(app.db, carried[0]!.id);
      expect(comments.map((c) => [c.originAuthor, c.body])).toEqual([
        ["hubot", "Same here."],
      ]);
      // One pull request — the open one — native here, on its branch.
      const pulls = listIssues(app.db, repo.id, { kind: "pull", state: "all" });
      expect(pulls.map((p) => p.number)).toEqual([4]);
      const pull = getPull(app.db, repo.id, 4)!;
      expect(pull.headBranch).toBe("fix-typo");
      expect(pull.originHeadRepo).toBeNull();
      expect(pull.body).toContain("by @octocat on GitHub.");
      const dir = repoDir(app.reposRoot, "alice", "gadgets");
      expect((await git(["rev-parse", "fix-typo"], dir)).out).toBe(headSha);
      // The crew's brief is the next number, assigned to the agent: the
      // durable event the dispatcher (`crew/dispatch.ts`, started by
      // main.ts) queues the first run from.
      const brief = listIssues(app.db, repo.id, { kind: "issue", state: "open" })
        .find((i) => i.originAuthor === null)!;
      expect(brief.number).toBe(5);
      expect(brief.assigneeName).toBe("mover");
      const assigned = app.db
        .query<{ payload: string }, [string]>(
          "SELECT payload FROM event WHERE repo_id = ?1 AND kind = 'issue.assigned'",
        )
        .all(repo.id)
        .map((e) => JSON.parse(e.payload) as { number: number; agent?: boolean });
      expect(assigned).toContainEqual(
        expect.objectContaining({ number: 5, agent: true }),
      );
      // And the import said so once, not once per row.
      const imported = app.db
        .query<{ n: number }, [string]>(
          "SELECT count(*) AS n FROM event WHERE repo_id = ?1 AND kind = 'repo.imported'",
        )
        .get(repo.id);
      expect(imported?.n).toBe(1);
    } finally {
      github.stop();
    }
  });
  test("a pull opened from a fork arrives with its head under refs/pull/<n>/head, waiting for a writer to let it run", async () => {
    const made = await createRepo(app, octo, { name: "forked-pulls", visibility: "private" });
    if (!made.ok) throw new Error(made.error);
    for (const branch of ["main", "their-work"]) {
      const done = await commitToBranch(app, octo, made.value, {
        branch,
        message: `on ${branch}`,
        files: [{ path: `${branch}.txt`, content: "x\n" }],
      });
      if (!done.ok) throw new Error(String(done.error));
    }
    // The head lives only where GitHub keeps it: refs/pull/<n>/head.
    const upstream = repoDir(app.reposRoot, "octo", "forked-pulls");
    const sha = (await git(["rev-parse", "their-work"], upstream)).out;
    expect((await git(["update-ref", "refs/pull/6/head", sha], upstream)).code).toBe(0);
    expect((await git(["branch", "-D", "their-work"], upstream)).code).toBe(0);
    // A branch of the source's own that happens to be called pull/6.
    const mainSha = (await git(["rev-parse", "main"], upstream)).out;
    expect((await git(["branch", "pull/6", "main"], upstream)).code).toBe(0);
    const state = newFakeState("github", "octo", upstreamSecret);
    state.repos.push({
      id: 801,
      fullName: "octo/forked-pulls",
      cloneUrl: `${base}/octo/forked-pulls.git`,
      defaultBranch: "main",
      private: true,
    });
    state.issues.set("octo/forked-pulls", [
      {
        id: 806,
        number: 6,
        title: "From a fork",
        user: "stranger",
        pull: { base: "main", head: "their-work", headRepo: "stranger/forked-pulls", headSha: sha },
      },
    ]);
    const github = serveFakeForge(state);
    try {
      forgetProviders(dataDir);
      const connected = await connectOrigin(app, alice, {
        host: github.url,
        kind: "github",
        token: upstreamSecret,
      });
      if (!connected.ok) throw new Error(connected.error);
      const job = await migrate(alice, {
        source: { originId: connected.value.id, fullName: "octo/forked-pulls" },
      });
      expect(job?.error).toBeUndefined();
      expect(job?.detail).toContain(
        "1 open pull request (1 from forks, waiting for your approval to run here)",
      );
      const repo = getRepo(app.db, "alice", "forked-pulls")!;
      const pull = getPull(app.db, repo.id, 6)!;
      // Still the stranger's: the head is where the forge keeps pull heads,
      // the source's own pull/6 branch is untouched, and no push event
      // carried the stranger's head to a check or a preview.
      expect(pull.originHeadRepo).toBe("stranger/forked-pulls");
      const dir = repoDir(app.reposRoot, "alice", "forked-pulls");
      expect((await git(["rev-parse", "refs/pull/6/head"], dir)).out).toBe(sha);
      expect((await git(["rev-parse", "refs/heads/pull/6"], dir)).out).toBe(mainSha);
      const pushed = app.db
        .query<{ payload: string }, [string]>(
          "SELECT payload FROM event WHERE repo_id = ?1 AND kind = 'push'",
        )
        .all(repo.id)
        .map((e) => JSON.stringify(JSON.parse(e.payload)));
      expect(pushed.length).toBe(1);
      expect(pushed[0]).not.toContain(sha);
      expect(pushed[0]).not.toContain("refs/pull/");
      // It runs only once a writer approves this head.
      const status = await pullStatus(dir, pull);
      expect(status.headOid).toBe(sha);
      expect(pullMayRun(app.db, repo, pull, sha)).toBe(false);
      const approved = await approveHere(app, alice, repo, pull);
      expect(approved.ok).toBe(true);
      expect(pullMayRun(app.db, repo, pull, sha)).toBe(true);
    } finally {
      github.stop();
    }
  });
  test("the app's branch: the person's newest beats the source's default, by URL and from GitHub, and the brief names it", async () => {
    // trevato/arm's shape: `main` is the upstream's tree (and the newest
    // commit), `workbench` is the person's app, ahead of it.
    const upstreamer = await person("upstreamer");
    const made = await createRepo(app, upstreamer, { name: "arm", visibility: "public" });
    if (!made.ok) throw new Error(made.error);
    const put = async (user: User, branch: string, message: string) => {
      const done = await commitToBranch(app, user, made.value, {
        branch,
        message,
        files: [{ path: `${message}.txt`, content: "x\n" }],
      });
      if (!done.ok) throw new Error(String(done.error));
    };
    // Which tip is newer is the rule's own test (work-branch.test.ts);
    // here, whose it is decides.
    await put(upstreamer, "main", "upstream-start");
    await put(alice, "workbench", "the-app");
    await put(upstreamer, "main", "upstream-later");
    const upstream = repoDir(app.reposRoot, "upstreamer", "arm");
    const mainSha = (await git(["rev-parse", "main"], upstream)).out;
    const workSha = (await git(["rev-parse", "workbench"], upstream)).out;
    const agent = await createAgent(app, alice, { username: "armer", model: "", brief: "Moves things in." });
    expect(agent.ok).toBe(true);
    const briefOf = (owner: string, name: string): string =>
      listIssues(app.db, getRepo(app.db, owner, name)!.id, { kind: "issue", state: "open" })
        .find((i) => i.title === `Make ${name} run here`)!.body;
    // By URL, the clone's own authors: alice's branch, not the source's main.
    const byUrl = await migrate(alice, {
      source: { url: `${base}/upstreamer/arm.git` },
      name: "arm-url",
      crew: { agent: "armer", autonomous: false },
    });
    expect(byUrl?.error).toBeUndefined();
    expect(byUrl?.detail).toContain("Working on workbench, the branch with your newest commits");
    expect(getRepo(app.db, "alice", "arm-url")!.defaultBranch).toBe("workbench");
    expect(briefOf("alice", "arm-url")).toContain("The app is on the branch `workbench`");
    expect(briefOf("alice", "arm-url")).toContain("open your pull against it");
    // Someone with no commits there keeps the source's default.
    const theirs = await migrate(bob, { source: { url: `${base}/upstreamer/arm.git` }, name: "arm-bob" });
    expect(getRepo(app.db, "bob", "arm-bob")!.defaultBranch).toBe("main");
    expect(theirs?.detail).toContain("Working on main, the source's default branch");
    // A branch that is not one git would take is refused before anything exists.
    const bad = await migrateRepo(app, alice, {
      source: { url: `${base}/upstreamer/arm.git` },
      name: "arm-bad",
      branch: "--upload-pack=x",
    });
    expect(bad.ok ? "" : bad.error).toBe("invalid_branch");
    expect(getRepo(app.db, "alice", "arm-bad")).toBeUndefined();
    // From GitHub: the origin says whose each last commit is by login.
    const state = newFakeState("github", "octo", upstreamSecret);
    state.repos.push({
      id: 901,
      fullName: "octo/arm",
      cloneUrl: `${base}/upstreamer/arm.git`,
      defaultBranch: "main",
      private: true,
    });
    state.branches.set("octo/arm", [
      { name: "main", sha: mainSha },
      { name: "workbench", sha: workSha },
    ]);
    state.commits.set("octo/arm", [
      { sha: workSha, message: "<b>the app</b>\n\nbody", authorName: "Octo Cat", authorEmail: "[email protected]", login: "octo", date: "2026-10-19T12:00:00Z" },
      { sha: mainSha, message: "upstream later", authorName: "Up Streamer", login: "upstreamer", date: "2026-10-20T09:00:00Z" },
    ]);
    const github = serveFakeForge(state);
    try {
      forgetProviders(dataDir);
      const connected = await connectOrigin(app, alice, { host: github.url, kind: "github", token: upstreamSecret });
      if (!connected.ok) throw new Error(connected.error);
      const value = `${connected.value.id}/octo/arm`;
      // The row links to its branches; the list shows each last commit,
      // escaped, newest first, and selects the person's.
      const listing = await (await browser(aliceCookie, "/migrate")).text();
      expect(listing).not.toContain('id="migrate-branches"');
      expect(listing).toContain(`href="/migrate?source=${encodeURIComponent(value)}&amp;branches=1#migrate-branches"`);
      // A plain visit with the row selected asks the origin for nothing.
      const asking = () => state.requests.filter((r) => r.path.endsWith("/branches") || r.path.endsWith("/commits")).length;
      const before = asking();
      const plain = await (await browser(aliceCookie, `/migrate?${new URLSearchParams({ source: value })}`)).text();
      expect(plain).not.toContain('id="migrate-branches"');
      expect(asking()).toBe(before);
      const html = await (await browser(aliceCookie, `/migrate?${new URLSearchParams({ source: value, branches: "1" })}`)).text();
      // One listing and one commit per branch; a reload within the minute costs none.
      expect(asking()).toBe(before + 3);
      await browser(aliceCookie, `/migrate?${new URLSearchParams({ source: value, branches: "1" })}`);
      expect(asking()).toBe(before + 3);
      const rows = [...html.matchAll(/data-branch="([^"]+)"/g)].map((m) => m[1]);
      expect(rows).toEqual(["main", "workbench"]);
      expect(html).toMatch(/value="workbench"\s+checked/);
      expect(html).not.toMatch(/value="main"\s+checked/);
      expect(html).toContain("&lt;b&gt;the app&lt;/b&gt;");
      expect(html).not.toContain("<b>the app</b>");
      expect(html).toMatch(/octo ·\s+<time datetime="2026-10-19T12:00:00(\.000)?Z">2026-10-19<\/time>/);
      expect(html).toContain("default there");
      // Asked for, another branch is the one selected.
      const asked = await (await browser(aliceCookie, `/migrate?${new URLSearchParams({ source: value, branch: "main" })}`)).text();
      expect(asked).toMatch(/value="main"\s+checked/);
      // The Migrate button carries the branch chosen.
      const chosen = await browser(aliceCookie, "/migrate", {
        source: value, branch: "main", url: "", owner: "alice", name: "arm-main", visibility: "private", agent: "armer",
      });
      expect(chosen.status).toBe(303);
      const chosenJob = await settled(chosen.headers.get("location")!.split("/").pop()!);
      expect(chosenJob?.detail).toContain("Working on main, the branch picked");
      expect(getRepo(app.db, "alice", "arm-main")!.defaultBranch).toBe("main");
      expect(briefOf("alice", "arm-main")).toContain("The app is on the branch `main` — the branch the person who migrated it picked");
      // Another row's button ignores a branch drawn for a different row:
      // one click migrates by the rule — here, by the origin's login alone,
      // since the clone's author (alice) is not the person connected (octo).
      const oneClick = await browser(aliceCookie, "/migrate", {
        pick: value, source: "elsewhere/x/y", branch: "main", url: "", owner: "alice", name: "arm-click", visibility: "private", agent: "armer",
      });
      expect(oneClick.status).toBe(303);
      const clickJob = await settled(oneClick.headers.get("location")!.split("/").pop()!);
      expect(clickJob?.error).toBeUndefined();
      expect(getRepo(app.db, "alice", "arm-click")!.defaultBranch).toBe("workbench");
      expect(briefOf("alice", "arm-click")).toContain("The app is on the branch `workbench` — the branch with the newest commits of the person who migrated it");
    } finally {
      github.stop();
    }
  }, 30_000);
  test("Connect GitHub from /migrate comes back to /migrate, and so does Disconnect; nothing else can be named", async () => {
    const state = newFakeState("github", "bobby", "bob-gh-token");
    const oauth = newFakeOAuth("migrate-client");
    state.oauth = oauth;
    const github = serveFakeForge(state);
    process.env.FORGE_GITHUB_CLIENT_ID = "migrate-client";
    try {
      forgetProviders(dataDir);
      const page = await (await browser(bobCookie, "/migrate")).text();
      expect(page).toContain('action="/settings/origins/oauth"');
      expect(page).toContain("Connect GitHub");
      // One filled button on the page: Migrate. Connect is an outline.
      expect(page.match(/data-variant="primary"/g)?.length).toBe(1);
      expect(page).toMatch(/data-variant="outline"[^>]*>\s*(<svg[\s\S]*?<\/svg>)?\s*Connect GitHub/);
      const started = await browser(bobCookie, "/settings/origins/oauth", {
        kind: "github",
        host: github.url,
        then: "migrate",
      });
      expect(started.status).toBe(303);
      const flowPage = started.headers.get("location")!;
      expect(flowPage).toMatch(/^\/settings\/origins\/flows\/[^?]+\?then=migrate$/);
      const waiting = await (await browser(bobCookie, flowPage)).text();
      expect(waiting).toContain("WXYZ-1234");
      expect(waiting).toContain("/poll?then=migrate");
      oauth.approved = true;
      const flowId = flowPage.split("/").pop()!.split("?")[0]!;
      const polled = await browser(
        bobCookie,
        `/settings/origins/flows/${flowId}/poll?then=migrate`,
        {},
      );
      expect(polled.headers.get("location")).toBe("/migrate?connected=1");
      const origin = listOrigins(app.db, bob.id).find((o) => o.kind === "github")!;
      expect(origin).toBeDefined();
      // Connected: the page lists the account and offers Disconnect, not Connect.
      const after = await (await browser(bobCookie, "/migrate?connected=1")).text();
      expect(after).toContain('id="migrate-connected"');
      expect(after).toContain(`action="/settings/origins/${origin.id}/delete"`);
      expect(after).not.toContain('action="/settings/origins/oauth"');
      // `then` is a word, not an address: anything else goes home.
      const steered = await browser(bobCookie, "/settings/origins/oauth", {
        kind: "github",
        host: github.url,
        then: "https://evil.test/",
      });
      expect(steered.headers.get("location")).not.toContain("then=");
      const gone = await browser(bobCookie, `/settings/origins/${origin.id}/delete`, {
        then: "migrate",
      });
      expect(gone.status).toBe(303);
      expect(gone.headers.get("location")).toBe("/migrate");
      expect(listOrigins(app.db, bob.id).some((o) => o.id === origin.id)).toBe(false);
    } finally {
      delete process.env.FORGE_GITHUB_CLIENT_ID;
      github.stop();
    }
  });
  test("the picker's pieces: sizes in binary units, a filter on name or description, a backlink that cannot be steered", () => {
    expect(formatKib(0)).toBe("");
    expect(formatKib(512)).toBe("512 KiB");
    expect(formatKib(1536)).toBe("1.5 MiB");
    expect(formatKib(20 * 1024)).toBe("20 MiB");
    expect(formatKib(3 * 1024 * 1024)).toBe("3.0 GiB");
    expect(matchesFilter({ fullName: "octo/Gadgets", description: "" }, "gadg")).toBe(true);
    expect(matchesFilter({ fullName: "octo/x", description: "Small machines" }, "MACHINE")).toBe(true);
    expect(matchesFilter({ fullName: "octo/x", description: "" }, "y")).toBe(false);
    expect(
      backlink({ number: 7, author: "mona", htmlUrl: "https://github.com/o/r/issues/7" }, "o/r", "GitHub"),
    ).toBe("> Migrated from [o/r#7](https://github.com/o/r/issues/7) by @mona on GitHub.");
    // A link that is not http(s) is named, not linked; a login cannot
    // smuggle markdown or a mention of someone else.
    const hostile = backlink(
      { number: 7, author: "x](javascript:alert(1)) @admin", htmlUrl: "javascript:alert(1)" },
      "o/r",
      "GitHub",
    );
    expect(hostile).not.toContain("javascript:");
    expect(hostile).not.toContain("](");
    expect(hostile).toBe("> Migrated from o/r#7 by @xjavascriptalert1admin on GitHub.");
  });
  test("the page: the form, the plus menu, the job, and who may see it", async () => {
    const anonymous = await browser("", "/migrate");
    expect(anonymous.status).toBe(303);
@@ -525,7 +1011,8 @@
describe("migrate", () => {
    const html = await (await browser(aliceCookie, "/migrate")).text();
    expect(html).toContain('action="/migrate"');
    expect(html).toContain('name="url"');
    expect(html).toContain('name="source"');
    // Each repository is a row whose button is the form's submitter.
    expect(html).toMatch(/name="pick"\s+value="[^"]+\/octo\/secret-widgets"/);
    expect(html).toContain("octo/secret-widgets");
    expect(html).toContain("Put a crew on it");
    expect(html).toContain('name="agent"');
@@ -627,7 +1114,8 @@
describe("migrate", () => {
    const hit = await get(
      new URLSearchParams({ from: `${host}/octo/secret-widgets`, crew: "porter" }).toString(),
    );
    expect(hit).toMatch(/<option\s+value="[^"]+\/octo\/secret-widgets"[^>]*selected/);
    expect(hit).toMatch(/name="source" value="[^"]+\/octo\/secret-widgets"/);
    expect(hit).toMatch(/aria-current="true"/);
    expect(hit).toMatch(/<option[^>]*value="porter"[^>]*selected|selected[^>]*value="porter"/);
    expect(hit).not.toContain("prefill-unmatched");
@@ -641,7 +1129,8 @@
describe("migrate", () => {
    expect(miss).toContain("from=other.example/octo/secret-widgets");
    expect(miss).not.toContain("<script>alert(1)");
    expect(miss).toContain("&lt;script&gt;");
    expect(miss).not.toMatch(/<option[^>]*value="[^"]+"[^>]*selected[^>]*>\s*octo/);
    expect(miss).not.toContain('name="source" value=');
    expect(miss).not.toContain('aria-current="true"');
    // A link starts nothing: no repository, no job.
    expect(getRepo(app.db, "alice", "secret-widgets")?.id).toBe(already);
@@ -0,0 +1,94 @@
/**
 * The work-branch rule, by hand: whose a commit is, and which branch wins.
 */
import { describe, expect, test } from "bun:test";
import {
  cachedRemoteTips,
  isMine,
  pickWorkBranch,
  TIPS_TTL_MS,
  type BranchTip,
} from "../src/origins/work-branch.ts";
import type { Provider } from "../src/origins/types.ts";
const who = { logins: ["Trevato"], emails: ["[email protected]"] };
const tip = (name: string, date: string, mine: boolean): BranchTip => ({
  name,
  oid: name,
  date,
  subject: "",
  author: "",
  mine,
});
describe("work branch", () => {
  test("a commit is the person's by login, email, GitHub noreply address or name — any case", () => {
    expect(isMine({ name: "x", email: "", login: "trevato" }, who)).toBe(true);
    expect(isMine({ name: "x", email: "[email protected]" }, who)).toBe(true);
    expect(isMine({ name: "x", email: "[email protected]" }, who)).toBe(true);
    expect(isMine({ name: "x", email: "[email protected]" }, who)).toBe(true);
    expect(isMine({ name: "TREVATO", email: "[email protected]" }, who)).toBe(true);
    expect(isMine({ name: "someone", email: "[email protected]", login: "someone" }, who)).toBe(false);
    // A noreply address for a login that merely contains theirs is not theirs.
    expect(isMine({ name: "x", email: "[email protected]" }, who)).toBe(false);
    expect(isMine({ name: "", email: "" }, { logins: [""], emails: [""] })).toBe(false);
  });
  test("the person's newest tip wins over a newer one that is not theirs, then the fallback, then the newest", () => {
    const tips = [
      tip("main", "2026-10-20T09:00:00Z", false),
      tip("workbench", "2026-10-19T12:00:00Z", true),
      tip("old-mine", "2026-01-01T00:00:00Z", true),
    ];
    expect(pickWorkBranch(tips, "main")).toBe("workbench");
    // Dates compare as times, not strings: +02:00 is two hours earlier.
    expect(
      pickWorkBranch(
        [tip("a", "2026-10-20T10:00:00+02:00", true), tip("b", "2026-10-20T09:00:00Z", true)],
        undefined,
      ),
    ).toBe("b");
    const none = tips.map((t) => ({ ...t, mine: false }));
    expect(pickWorkBranch(none, "old-mine")).toBe("old-mine");
    expect(pickWorkBranch(none, "gone")).toBe("main");
    expect(pickWorkBranch([], "main")).toBeUndefined();
  });
});
describe("work branch tips, remembered", () => {
  test("a minute per origin and repository; a refusal is not remembered", async () => {
    let asked = 0;
    let refuse = false;
    const provider = {
      listBranches: async () => {
        asked++;
        return refuse
          ? { ok: false as const, error: { error: "unreachable" as const, message: "down" } }
          : { ok: true as const, value: [{ name: "main", oid: "a".repeat(40) }] };
      },
      listCommits: async () => ({
        ok: true as const,
        value: {
          items: [{ oid: "a".repeat(40), message: "one\n\ntwo", author: { name: "x", email: "", login: "trevato", date: "2026-10-20T00:00:00Z" }, parents: [] }],
          next: null,
        },
      }),
    } as unknown as Provider;
    const t0 = 1_000_000;
    const first = await cachedRemoteTips("o1", provider, "a/b", who, t0);
    expect(first?.[0]).toMatchObject({ name: "main", subject: "one", author: "trevato", mine: true });
    await cachedRemoteTips("o1", provider, "a/b", who, t0 + TIPS_TTL_MS - 1);
    expect(asked).toBe(1);
    // Another account's origin is its own entry.
    await cachedRemoteTips("o2", provider, "a/b", who, t0);
    expect(asked).toBe(2);
    await cachedRemoteTips("o1", provider, "a/b", who, t0 + TIPS_TTL_MS);
    expect(asked).toBe(3);
    refuse = true;
    expect(await cachedRemoteTips("o3", provider, "a/b", who, t0)).toBeUndefined();
    expect(await cachedRemoteTips("o3", provider, "a/b", who, t0 + 1)).toBeUndefined();
    expect(asked).toBe(5);
  });
});
		@@ -460,6 +460,50 @@ repository), the agent — is refused in words before the repository exists;
460	460	what is left for the job is the network. A clone that fails removes the
461	461	empty repository it made, so the name is free to try again.
462	462
	463	One click from GitHub. `/migrate` carries its own "Your accounts"
	464	card: Connect GitHub runs the device flow above (no token pasted; it
	465	needs the forge's GitHub application, `FORGE_GITHUB_CLIENT_ID`) and comes
	466	back to `/migrate`, and each connected account has a Disconnect that
	467	comes back too. The return is the fixed word `then=migrate`, never a path a
	468	form can choose. Every repository the account can see (owned and its orgs')
	469	is a row — name, a `private` mark, its size as the origin reports it (KiB,
	470	shown in KiB/MiB/GiB), its description — filtered by `?q=` on the server and
	471	live as you type. A row's button is the form's submitter (`name="pick"`), so
	472	one click migrates it with the destination and crew fields as they stand;
	473	the first agent is picked by default, "Nobody" is one choice away.
	474
	475	The branch the app lives on. A fork often keeps the upstream's tree on
	476	`main` and the person's app on a branch of their own, so the source's default
	477	is not always the app. A row's Branches link (`/migrate?source=…&branches=1`) draws
	478	that repository's branches, each with its last commit — subject, author,
	479	date — read through the origin's API (the first 30 branches' commits; the
	480	rest by name), remembered a minute per account and repository so a reload or
	481	a refused form spends nothing at the origin; a plain visit asks for none of it. The one selected is the branch whose last commit is the
	482	person's and newest (an account login the origin resolved, a GitHub noreply
	483	address with their login, their forge email, or an author name that is one
	484	of their logins), else the source's default. A one-click row with no branch
	485	chosen gets the same rule in the job, over the clone's own tips
	486	(`git for-each-ref`) and the origin's logins (`origins/work-branch.ts`).
	487	That branch becomes the default branch here, the job says which and why,
	488	and the crew's brief names it: start from it, open the pull against it.
	489
	490	The conversations come too — from a connected origin, not a pasted URL
	491	(`origins/carry.ts`). Labels; every issue, open and closed, with its comments
	492	and labels, under its original number; and the open pull requests as pulls
	493	here, on the branches the clone brought — native ones (`origin_head_repo`
	494	cleared), so they review and merge like any other. A pull whose head lived
	495	in a fork is a stranger's code: its head is fetched into `refs/pull/<n>/head`
	496	(the forge's own namespace — no push event, no branch the clone brought is
	497	touched), it keeps `origin_head_repo`, and its check and preview wait for a
	498	writer's Approve to run here, exactly as a mirror's do. The job's message
	499	says how many wait. Closed pulls stay behind: their work is in
	500	the history or was turned down. Each body opens with
	501	`> Migrated from [owner/name#n](<original>) by @login on GitHub.` — the link
	502	only when it is http(s), the login reduced to login characters — and the
	503	author also travels in `origin_author`, so every page marks it as theirs on
	504	the origin. One `repo.imported` event (`via: "migrate"`) says so, not one per
	505	row. A refusal part-way keeps what arrived and says so in the job's detail.
	506
463	507	Put a crew on it. Name an agent and, after the clone, the same job puts
464	508	it on the crew, makes the repository an app, sets it autonomous when asked,
465	509	and `tell`s the crew one thing: make it run here. The brief is the
		@@ -486,8 +530,9 @@ the person still presses Migrate (POST, same-origin checked).
486	530
487	531	The clone runs as a job in the mirror's registry (`origins/jobs.ts`, kind
488	532	`migrate`, owned by whoever started it — anyone else's is `not_found`).
489		`/migrate/jobs/:job` refreshes until it stops, then lands on the repository
490		with what happened as the flash.
	533	`/migrate/jobs/:job` follows its stages — clone, issues, pull requests, the
	534	app and the crew's first run — and then lands on the repository, which is
	535	the app's page, with what happened as the flash.
491	536
492	537	## API
493	538
		@@ -536,7 +581,7 @@ GET /api/v1/user/pins PUT/DELETE /api/v1/user/pins/:owner/:name
536	581
537	582	POST /api/v1/migrate {source: {url} \| {originId, fullName},
538	583	owner?, name?, visibility?,
539		crew?: {agent, autonomous}}
	584	branch?, crew?: {agent, autonomous}}
540	585	→ 202 {repo, job}
541	586	GET /api/v1/migrate/:job poll one migration (its starter only)
542	587	GET /api/v1/migrate/:job/stream SSE: migrate.<stage>, ends on done
		@@ -551,7 +596,7 @@ credential, which is the same authority as spending it. Repo-level sync and
551	596	pins take the ordinary `rw` floor; so does a migration from a URL, while one
552	597	from an origin takes `admin` — it spends the origin's credential. Its
553	598	refusals are 422 `{ error, message }`: `invalid_url`, `no_such_origin`,
554		`unreachable`, `no_such_agent`, and the new-repository codes (`name_taken`,
	599	`unreachable`, `no_such_agent`, `invalid_branch`, and the new-repository codes (`name_taken`,
555	600	`invalid_name`, `forbidden_owner`).
556	601
557	602	A contribute answers 201 with
		@@ -11,6 +11,13 @@
11	11	* environment, scoped to the origin's host — never argv, never the URL. A
12	12	* pasted URL is cloned anonymously: public repositories only.
13	13	*
	14	* From a connected origin the conversations come too (`origins/carry.ts`):
	15	* every issue with its comments and labels, and the open pull requests as
	16	* pulls here, on the branches the clone brought — each opening with a link
	17	* back to the original; one from a fork has its head under
	18	* `refs/pull/<n>/head` and waits for a writer to approve it to run. A
	19	* pasted URL brings the history alone.
	20	*
14	21	* The clone runs as a job (`origins/jobs.ts`, the mirror's registry), so a
15	22	* page can watch it. With a crew asked for, the same job then puts the
16	23	* agent on the crew, makes the repository an app, and tells the crew one
		@@ -30,9 +37,16 @@ import { isSafeRef } from "../git/guard.ts";
30	37	import { repoDir } from "../git/repos.ts";
31	38	import { type Resolve, vetHost } from "../kernel/outbound.ts";
32	39	import { err, ok, type Result } from "../kernel/result.ts";
	40	import { carryConversations, plural } from "../origins/carry.ts";
33	41	import { providerForOrigin } from "../origins/credential.ts";
34	42	import { redact, safeRemoteUrl, secretsIn } from "../origins/credentials.ts";
35	43	import { MIRROR_REFSPECS, snapshotRefs } from "../origins/git-mirror.ts";
	44	import {
	45	localTips,
	46	pickWorkBranch,
	47	remoteTips,
	48	type Who,
	49	} from "../origins/work-branch.ts";
36	50	import {
37	51	advance,
38	52	createJob,
		@@ -40,6 +54,7 @@ import {
40	54	runningJob,
41	55	type MirrorJob,
42	56	} from "../origins/jobs.ts";
	57	import type { Provider } from "../origins/types.ts";
43	58	import { requireUser } from "./access.ts";
44	59	import { enableApp } from "./apps.ts";
45	60	import { addToCrew } from "./crew.ts";
		@@ -70,6 +85,12 @@ export interface MigrateInput {
70	85	readonly name?: string;
71	86	/** @default "private" */
72	87	readonly visibility?: "public" \| "private";
	88	/**
	89	* The branch the app lives on — the default branch here and the one the
	90	* crew is pointed at. Left out, the branch with the person's newest
	91	* commits (`origins/work-branch.ts`), else the source's default.
	92	*/
	93	readonly branch?: string;
73	94	/** Put an agent on it: the crew makes it run here. */
74	95	readonly crew?: { readonly agent: string; readonly autonomous: boolean };
75	96	/** Name → addresses, for the private-address check. Tests inject it. */
		@@ -89,6 +110,7 @@ export type MigrateError =
89	110	\| "private_host"
90	111	\| "no_such_origin"
91	112	\| "unreachable"
	113	\| "invalid_branch"
92	114	\| "no_such_agent";
93	115
94	116	/** What the clone reads from, resolved: where, and how to authenticate. */
		@@ -100,6 +122,18 @@ interface Resolved {
100	122	readonly name: string;
101	123	readonly description: string;
102	124	readonly authEnv: () => Promise<Record<string, string>>;
	125	/** A connected origin's adapter: what issues and pulls are read through. */
	126	readonly provider?: Provider;
	127	/** The person, as the source's commits may name them. */
	128	readonly who: Who;
	129	}
	130
	131	/** Why the work branch is the one it is: said in the job and the brief. */
	132	type WorkReason = "picked" \| "newest" \| "default";
	133
	134	interface WorkBranch {
	135	readonly name: string;
	136	readonly reason: WorkReason;
103	137	}
104	138
105	139	/**
		@@ -121,6 +155,8 @@ export async function migrateRepo(
121	155	if (!source.ok) return source;
122	156	if (input.crew !== undefined && !getAgentByName(app.db, input.crew.agent))
123	157	return err("no_such_agent");
	158	const branch = (input.branch ?? "").trim();
	159	if (branch !== "" && !isSafeRef(branch)) return err("invalid_branch");
124	160
125	161	// A double-click joins the migration already under way rather than
126	162	// failing the second one on the name the first just took.
		@@ -150,7 +186,11 @@ export async function migrateRepo(
150	186	actorId: user.value.id,
151	187	});
152	188	advance(job.id, { stage: "creating", repo });
153		void runMigration(app, user.value, repo, source.value, input.crew, job.id);
	189	void runMigration(app, user.value, repo, source.value, {
	190	branch: branch === "" ? undefined : branch,
	191	crew: input.crew,
	192	jobId: job.id,
	193	});
154	194	return ok({ repo, job: getJob(job.id) ?? job });
155	195	}
156	196
		@@ -188,6 +228,8 @@ export function migrateMessage(error: MigrateError, limit = "at the repositories
188	228	return "The origin could not be reached. Try again, or reconnect it under Settings → Origins.";
189	229	case "no_such_agent":
190	230	return "That agent is not on this forge.";
	231	case "invalid_branch":
	232	return "That is not a branch name git would take.";
191	233	case "name_taken":
192	234	return "That owner already has a repository by that name. Pick another name.";
193	235	case "invalid_name":
		@@ -354,6 +396,7 @@ async function resolveSource(
354	396	name: nameFromUrl(url),
355	397	description: "",
356	398	authEnv: () => Promise.resolve({}),
	399	who: { logins: [user.username], emails: [user.email] },
357	400	});
358	401	}
359	402	const origin = getOriginFor(app.db, user.id, source.originId);
		@@ -376,6 +419,8 @@ async function resolveSource(
376	419	// Only the header: the origin's credential reaches this one git
377	420	// invocation scoped to its host, and the repository never learns it.
378	421	authEnv: () => provider.value.gitAuthEnv(url),
	422	provider: provider.value,
	423	who: { logins: [origin.login, user.username], emails: [user.email] },
379	424	});
380	425	}
381	426
		@@ -385,9 +430,13 @@ async function runMigration(
385	430	user: User,
386	431	repo: Repo,
387	432	source: Resolved,
388		crew: MigrateInput["crew"],
389		jobId: string,
	433	asked: {
	434	readonly branch: string \| undefined;
	435	readonly crew: MigrateInput["crew"];
	436	readonly jobId: string;
	437	},
390	438	): Promise<void> {
	439	const { crew, jobId } = asked;
391	440	const fail = async (error: string): Promise<void> => {
392	441	// An empty repository nobody asked for is clutter, and it holds the
393	442	// name a retry wants: a clone that did not happen leaves nothing.
		@@ -398,23 +447,65 @@ async function runMigration(
398	447	advance(jobId, { stage: "fetching", detail: "every branch and tag" });
399	448	const cloned = await cloneInto(app, repo, source);
400	449	if (!cloned.ok) return await fail(cloned.error);
401		storageStale(app, repo.ownerId);
402	450	let current = getRepoById(app.db, repo.id) ?? repo;
403	451
404		// The source's default branch is kept; a source that never said which
405		// keeps the forge's own, or the branch it plainly meant.
406		const branches = [...cloned.value.refs.keys()]
	452	// The conversations, when an origin can be asked for them. A refusal
	453	// part-way keeps what arrived and says so; the history is the move.
	454	let conversations = "";
	455	const refs = cloned.value.refs;
	456	if (source.provider !== undefined) {
	457	advance(jobId, { stage: "issues", detail: "reading issues" });
	458	const carried = await carryConversations({
	459	db: app.db,
	460	provider: source.provider,
	461	fullName: source.label,
	462	repoId: current.id,
	463	actorId: user.id,
	464	report: (stage, detail) => advance(jobId, { stage, detail }),
	465	});
	466	// A fork's head is fetched where the forge keeps pull heads, not as
	467	// a branch: no push event runs it, and no branch the clone brought
	468	// is overwritten. Its pull waits for a writer to approve it to run.
	469	await fetchForkHeads(
	470	app,
	471	current,
	472	source,
		sentinelcrew 24d ago outdated A stranger's fork head becomes a native branch and pull here, and the push event then runs checks and previews on it. Consider keeping fork pulls read-only until the owner adopts one.
	473	carried.forkPulls.map((p) => p.number),
	474	);
	475	const forks = carried.forkPulls.length;
	476	conversations = `; ${plural(carried.issues, "issue")}, ${plural(carried.pulls, "open pull request")}${forks === 0 ? "" : ` (${forks} from forks, waiting for your approval to run here)`}, ${plural(carried.comments, "comment")}${carried.error === "" ? "" : ` (the origin stopped part-way: ${redact(carried.error)})`}`;
	477	app.bus.append({
	478	kind: "repo.imported",
	479	repoId: current.id,
	480	actorId: user.id,
	481	payload: {
	482	fullName: source.label,
	483	issues: carried.issues,
	484	pulls: carried.pulls,
	485	comments: carried.comments,
	486	via: "migrate",
	487	},
	488	});
	489	}
	490	storageStale(app, repo.ownerId);
	491
	492	// The default branch here is the work branch: the one picked, else
	493	// the one with the person's newest commits, else the source's default
	494	// — and a source that never said which keeps the forge's own, or the
	495	// branch it plainly meant.
	496	const branches = [...refs.keys()]
407	497	.filter((ref) => ref.startsWith("refs/heads/"))
408	498	.map((ref) => ref.slice("refs/heads/".length));
409		const wanted = [
	499	const fallback = [
410	500	cloned.value.head,
411	501	current.defaultBranch,
412	502	"master",
413	503	...branches.sort(),
414	504	].find((b) => b !== undefined && branches.includes(b));
415		if (wanted !== undefined && wanted !== current.defaultBranch) {
	505	const work = await workBranch(app, current, source, asked.branch, branches, fallback);
	506	if (work !== undefined && work.name !== current.defaultBranch) {
416	507	const moved = await updateRepoSettings(app, user, current, {
417		defaultBranch: wanted,
	508	defaultBranch: work.name,
418	509	});
419	510	if (moved.ok) current = moved.value;
420	511	}
		@@ -422,13 +513,13 @@ async function runMigration(
422	513	// The history arrived without a push, so nothing downstream heard it.
423	514	// One event, shaped like a push, says so — the feed, webhooks and the
424	515	// default branch's check see what landed.
425		if (cloned.value.refs.size > 0) {
	516	if (refs.size > 0) {
426	517	app.bus.append({
427	518	kind: "push",
428	519	repoId: current.id,
429	520	actorId: user.id,
430	521	payload: {
431		updates: [...cloned.value.refs].map(([ref, newOid]) => ({
	522	updates: [...refs].map(([ref, newOid]) => ({
432	523	ref,
433	524	oldOid: "0".repeat(40),
434	525	newOid,
		@@ -440,10 +531,12 @@ async function runMigration(
440	531	}
441	532
442	533	const where = `${current.ownerName}/${current.name}`;
443		let detail = `migrated as ${where} — ${plural(branches.length, "branch", "branches")}, ${plural(cloned.value.refs.size - branches.length, "tag")}`;
	534	let detail = `migrated as ${where} — ${plural(branches.length, "branch", "branches")}, ${plural(refs.size - branches.length, "tag")}${conversations}`;
	535	if (work !== undefined)
	536	detail += `. Working on ${work.name}, ${reasonWords(work.reason)}${asked.branch !== undefined && work.reason !== "picked" ? ` (${asked.branch} did not come with the clone)` : ""}`;
444	537	if (crew !== undefined) {
445	538	advance(jobId, { stage: "crew", detail: `putting ${crew.agent} on it` });
446		detail += `. ${await putCrewOn(app, user, current, source, crew)}`;
	539	detail += `. ${await putCrewOn(app, user, current, source, crew, work)}`;
447	540	}
448	541	advance(jobId, {
449	542	stage: "done",
		@@ -518,6 +611,86 @@ async function cloneInto(
518	611	return ok({ head, refs });
519	612	}
520	613
	614	/**
	615	* Which branch the app lives on. A picked branch that arrived wins; else
	616	* the newest branch tip that is the person's — by the clone's authors, and
	617	* by the origin's account logins when there is an origin to ask — else the
	618	* fallback.
	619	*/
	620	async function workBranch(
	621	app: App,
	622	repo: Repo,
	623	source: Resolved,
	624	picked: string \| undefined,
	625	branches: readonly string[],
	626	fallback: string \| undefined,
	627	): Promise<WorkBranch \| undefined> {
	628	if (picked !== undefined && branches.includes(picked))
	629	return { name: picked, reason: "picked" };
	630	const dir = repoDir(app.reposRoot, repo.ownerName, repo.name);
	631	let tips = await localTips(dir, source.who);
	632	if (source.provider !== undefined) {
	633	const remote = await remoteTips(source.provider, source.label, source.who);
	634	const theirs = new Set(
	635	(remote ?? []).filter((t) => t.mine).map((t) => `${t.name}\0${t.oid}`),
	636	);
	637	tips = tips.map((t) =>
	638	theirs.has(`${t.name}\0${t.oid}`) ? { ...t, mine: true } : t,
	639	);
	640	}
	641	const name = pickWorkBranch(tips, fallback);
	642	if (name === undefined) return undefined;
	643	return {
	644	name,
	645	reason: tips.some((t) => t.mine && t.name === name) ? "newest" : "default",
	646	};
	647	}
	648
	649	function reasonWords(reason: WorkReason): string {
	650	switch (reason) {
	651	case "picked":
	652	return "the branch picked";
	653	case "newest":
	654	return "the branch with your newest commits";
	655	case "default":
	656	return "the source's default branch";
	657	}
	658	}
	659
	660	/**
	661	* Bring the heads of pulls opened from forks: the origin serves each as
	662	* `refs/pull/<n>/head` (GitHub and Forgejo alike), and it lands under the
	663	* same name here — the forge's own namespace for pull heads, which a push
	664	* cannot write and the clone never brings. One fetch; a fetch that fails
	665	* leaves those pulls showing the head the origin reported, still waiting.
	666	*/
	667	async function fetchForkHeads(
	668	app: App,
	669	repo: Repo,
	670	source: Resolved,
	671	numbers: readonly number[],
	672	): Promise<void> {
	673	if (numbers.length === 0) return;
	674	const dir = repoDir(app.reposRoot, repo.ownerName, repo.name);
	675	const authEnv = await source.authEnv();
	676	await runGitCapture(
	677	[
	678	"fetch",
	679	"--no-write-fetch-head",
	680	"--no-recurse-submodules",
	681	"--quiet",
	682	"--",
	683	source.url,
	684	...numbers.map((n) => `+refs/pull/${n}/head:refs/pull/${n}/head`),
	685	],
	686	{
	687	cwd: dir,
	688	env: remoteGitEnv(authEnv, undefined, ALLOWED_PROTOCOL),
	689	timeoutMs: MIGRATE_TIMEOUT_MS,
	690	},
	691	);
	692	}
	693
521	694	/**
522	695	* The crew half: the agent joins, the repository becomes an app, autonomy
523	696	* is set when asked, and the crew is told the one thing it is there for.
		@@ -529,6 +702,7 @@ async function putCrewOn(
529	702	repo: Repo,
530	703	source: Resolved,
531	704	crew: NonNullable<MigrateInput["crew"]>,
	705	work: WorkBranch \| undefined,
532	706	): Promise<string> {
533	707	const said: string[] = [];
534	708	const added = addToCrew(app, user, repo, crew.agent);
		@@ -547,7 +721,7 @@ async function putCrewOn(
547	721	});
548	722	if (!set.ok) said.push("Autonomy could not be turned on.");
549	723	}
550		const told = await tell(app, user, repo, importerBrief(repo, source.label));
	724	const told = await tell(app, user, repo, importerBrief(repo, source.label, work));
551	725	said.unshift(told.ok ? toldWords(told.value) : "The crew could not be told.");
552	726	return said.join(" ");
553	727	}
		@@ -557,11 +731,24 @@ async function putCrewOn(
557	731	* contract (docs/APPS.md), from the other side: someone else's project,
558	732	* made to run here with the smallest diff that does it.
559	733	*/
560		export function importerBrief(repo: Repo, from: string): string {
	734	export function importerBrief(
	735	repo: Repo,
	736	from: string,
	737	work?: WorkBranch,
	738	): string {
	739	const branch = work?.name ?? repo.defaultBranch;
	740	const why =
	741	work?.reason === "picked"
	742	? "the branch the person who migrated it picked"
	743	: work?.reason === "newest"
	744	? "the branch with the newest commits of the person who migrated it"
	745	: "the source's default branch";
561	746	return `Make ${repo.name} run here
562	747
563	748	${repo.name} was migrated to this forge from ${from} — every branch and tag, its history intact. It is someone else's project. Make it run here as an app without changing what it does.
564	749
	750	The app is on the branch \`${branch}\` — ${why}, and the default branch here. Start from \`${branch}\` and open your pull against it; the other branches are history, not the app.
	751
565	752	Adapt, don't rewrite:
566	753
567	754	- Read before you write: the language, how it starts today, how it reads its port and configuration, where it keeps state, how it installs and tests.
		@@ -576,6 +763,3 @@ Adapt, don't rewrite:
576	763	Done means the pull's preview starts, answers its \`health\` path, and does what the original did.`;
577	764	}
578	765
579		function plural(n: number, one: string, many = `${one}s`): string {
580		return `${n} ${n === 1 ? one : many}`;
581		}
		@@ -0,0 +1,6 @@
	1	// The migrate picker shows each repository's size before it is cloned
	2	// (#3264). Both forges report `size` in KiB on a listing; additive, and 0
	3	// reads as "the origin did not say".
	4	export default `
	5	ALTER TABLE origin_repo ADD COLUMN size_kb INTEGER NOT NULL DEFAULT 0;
	6	`;
		@@ -323,6 +323,8 @@ export interface OriginRepoRow {
323	323	readonly openIssues: number;
324	324	readonly openPulls: number;
325	325	readonly openIssuesIncludingPulls: boolean;
	326	/** KiB, as the origin last reported it; 0 when unknown. */
	327	readonly sizeKb: number;
326	328	}
327	329
328	330	const REPO_SELECT = `
		@@ -348,6 +350,7 @@ interface RawOriginRepo {
348	350	open_issues: number;
349	351	open_pulls: number;
350	352	counts_include_pulls: number;
	353	size_kb: number;
351	354	mirrored_id: string \| null;
352	355	}
353	356
		@@ -369,6 +372,7 @@ const toOriginRepo = (row: RawOriginRepo): OriginRepoRow => ({
369	372	openIssues: row.open_issues,
370	373	openPulls: row.open_pulls,
371	374	openIssuesIncludingPulls: row.counts_include_pulls === 1,
	375	sizeKb: row.size_kb,
372	376	});
373	377
374	378	/**
		@@ -379,8 +383,8 @@ const UPSERT_ORIGIN_REPO = `
379	383	INSERT INTO origin_repo
380	384	(origin_id, remote_id, full_name, description, private, fork,
381	385	default_branch, clone_url, html_url, pushed_at, can_push, seen_at,
382		open_issues, open_pulls, counts_include_pulls, fork_of)
383		VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12, ?13, ?14, ?15, ?16)
	386	open_issues, open_pulls, counts_include_pulls, fork_of, size_kb)
	387	VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12, ?13, ?14, ?15, ?16, ?17)
384	388	ON CONFLICT (origin_id, remote_id) DO UPDATE SET
385	389	full_name = excluded.full_name,
386	390	description = excluded.description,
		@@ -395,6 +399,7 @@ const UPSERT_ORIGIN_REPO = `
395	399	open_issues = excluded.open_issues,
396	400	open_pulls = excluded.open_pulls,
397	401	counts_include_pulls = excluded.counts_include_pulls,
	402	size_kb = excluded.size_kb,
398	403	-- A listing that does not report the parent must not forget one we
399	404	-- already know: listRepos omits it on both forges, getRepo states it.
400	405	fork_of = COALESCE(excluded.fork_of, origin_repo.fork_of)`;
		@@ -421,6 +426,7 @@ const upsertArgs = (
421	426	repo.openPulls,
422	427	repo.openIssuesIncludesPulls ? 1 : 0,
423	428	repo.parent,
	429	Number.isSafeInteger(repo.sizeKb) && repo.sizeKb > 0 ? repo.sizeKb : 0,
424	430	];
425	431
426	432	/**
		@@ -5003,7 +5003,8 @@ export function apiRoutes(router: Router<Handler>): void {
5003	5003	//
5004	5004	// A repository brought here for good: `source` is `{ originId, fullName }`
5005	5005	// (one of your origins, its credential in the environment) or `{ url }`
5006		// (public, anonymous). Refusals are words before anything exists; the
	5006	// (public, anonymous); `branch` is the one the app lives on (left out,
	5007	// the one with your newest commits). Refusals are words before anything exists; the
5007	5008	// clone itself is the job this answers with, watched at /migrate/:job.
5008	5009
5009	5010	router.add("POST", "/api/v1/migrate", async (ctx) => {
		@@ -5039,6 +5040,7 @@ export function apiRoutes(router: Router<Handler>): void {
5039	5040	source,
5040	5041	...(typeof input.owner === "string" ? { owner: input.owner } : {}),
5041	5042	...(typeof input.name === "string" ? { name: input.name } : {}),
	5043	...(typeof input.branch === "string" ? { branch: input.branch } : {}),
5042	5044	...(input.visibility === "public" \|\| input.visibility === "private"
5043	5045	? { visibility: input.visibility }
5044	5046	: {}),
		@@ -0,0 +1,159 @@
	1	/**
	2	* Carry: a migrated repository's conversations, brought along once.
	3	*
	4	* A mirror keeps importing; a migration imports one time and then the
	5	* forge is where the conversation lives. So the rows are written by the
	6	* mirror's own upserts (`import.ts` — the same clamps, the origin's
	7	* numbers, `issue_seq` dragged past them, the real author in
	8	* `origin_author` so every page says "by @x on GitHub") with two
	9	* differences that make them native:
	10	*
	11	* - every issue and pull starts with a line naming where it came from and
	12	* linking the original, so the trail back survives the origin; and
	13	* - a pull is a pull here: `origin_head_repo` is cleared, so it reviews,
	14	* merges and reverts like one opened on this forge. Its head is the
	15	* branch the clone already brought. A pull whose head lived in a fork
	16	* keeps `origin_head_repo` — a stranger's code, whose check and preview
	17	* wait for a writer's "Approve to run here" (`core/pull_trust.ts`), as a
	18	* mirror's do — and is returned in `forkPulls`, for the caller to fetch
	19	* its head into `refs/pull/<n>/head`.
	20	*
	21	* Every issue comes, open and closed; of pulls only the open ones — a
	22	* closed pull's work is either in the history already or was turned down.
	23	* Plain data in (a provider, the repository's ids), counts out; no git.
	24	*/
	25
	26	import type { Database } from "bun:sqlite";
	27	import { importComments, importIssue, importLabels } from "./import.ts";
	28	import type { ListIssuesQuery, Provider, RemoteIssue } from "./types.ts";
	29
	30	/** Pages of 100 per kind: 10 000 conversations is the ceiling of one move. */
	31	export const MAX_PAGES = 100;
	32
	33	export interface CarryInput {
	34	readonly db: Database;
	35	readonly provider: Provider;
	36	/** `owner/name` on the origin. */
	37	readonly fullName: string;
	38	readonly repoId: string;
	39	/** Who migrated it: the local author of every row, as a mirror's are. */
	40	readonly actorId: string;
	41	/** Progress, as a job's detail line. */
	42	readonly report?: (stage: "issues" \| "pulls", detail: string) => void;
	43	}
	44
	45	export interface ForkPull {
	46	readonly issueId: string;
	47	readonly number: number;
	48	}
	49
	50	export interface Carried {
	51	readonly labels: number;
	52	readonly issues: number;
	53	readonly pulls: number;
	54	readonly comments: number;
	55	/** Open pulls whose head branch is in a fork, not in the clone. */
	56	readonly forkPulls: readonly ForkPull[];
	57	/** The first thing the origin refused, in words; "" when nothing was. */
	58	readonly error: string;
	59	}
	60
	61	/** What a person calls the origin: "GitHub", or its host. */
	62	export function originName(provider: Pick<Provider, "kind" \| "webUrl">): string {
	63	if (provider.kind === "github") return "GitHub";
	64	return URL.parse(provider.webUrl)?.host ?? "the origin";
	65	}
	66
	67	/**
	68	* The line an imported body opens with. The link is only an http(s) URL
	69	* the origin gave — anything else is named without one — and the author's
	70	* login is reduced to the characters a login can hold.
	71	*/
	72	export function backlink(
	73	remote: Pick<RemoteIssue, "number" \| "author" \| "htmlUrl">,
	74	fullName: string,
	75	where: string,
	76	): string {
	77	const url = URL.parse(remote.htmlUrl);
	78	const ref = `${fullName}#${remote.number}`;
	79	const linked =
	80	url !== null && (url.protocol === "https:" \|\| url.protocol === "http:")
	81	? `[${ref}](${url.href.replace(/[()\s]/g, encodeURIComponent)})`
	82	: ref;
	83	const login = remote.author.replace(/[^A-Za-z0-9._-]/g, "").slice(0, 64);
	84	const by = login === "" ? "" : ` by @${login}`;
	85	return `> Migrated from ${linked}${by} on ${where}.`;
	86	}
	87
	88	export async function carryConversations(input: CarryInput): Promise<Carried> {
	89	const { db, provider, fullName, repoId, actorId } = input;
	90	const where = originName(provider);
	91	const ctx = { db, repoId, actorId };
	92	let error = "";
	93	const counts = { labels: 0, issues: 0, pulls: 0, comments: 0 };
	94	const forkPulls: ForkPull[] = [];
	95
	96	const labels = await provider.listLabels(fullName);
	97	if (labels.ok) {
	98	importLabels(db, repoId, labels.value);
	99	counts.labels = labels.value.length;
	100	} else error = labels.error.message;
	101
	102	const passes: [ListIssuesQuery["kind"], ListIssuesQuery["state"]][] = [
	103	["issue", "all"],
	104	["pull", "open"],
	105	];
	106	for (const [kind, state] of passes) {
	107	let cursor: string \| undefined;
	108	for (let page = 0; page < MAX_PAGES; page++) {
	109	const listed = await provider.listIssues(fullName, {
	110	kind,
	111	state,
	112	...(cursor === undefined ? {} : { cursor }),
	113	});
	114	if (!listed.ok) {
	115	error \|\|= listed.error.message;
	116	break;
	117	}
	118	for (const remote of listed.value.items) {
	119	if (!Number.isInteger(remote.number) \|\| remote.number < 1) continue;
	120	// A listing of issues that slips a pull in (or the reverse) is not
	121	// trusted to say which it is twice.
	122	if ((remote.pull !== undefined) !== (kind === "pull")) continue;
	123	const body = `${backlink(remote, fullName, where)}\n\n${remote.body}`;
	124	const imported = importIssue(ctx, { ...remote, body });
	125	if (remote.pull !== undefined) {
	126	const sameRepo =
	127	remote.pull.headRepo === "" \|\|
	128	remote.pull.headRepo.toLowerCase() === fullName.toLowerCase();
	129	if (sameRepo)
	130	db.query(
	131	"UPDATE pull SET origin_head_repo = NULL WHERE issue_id = ?1",
	132	).run(imported.issueId);
	133	else forkPulls.push({ issueId: imported.issueId, number: remote.number });
	134	counts.pulls++;
	135	} else counts.issues++;
	136
	137	if (remote.comments > 0) {
	138	const comments = await provider.listComments(fullName, remote.number);
	139	if (comments.ok)
	140	counts.comments += importComments(ctx, imported.issueId, comments.value);
	141	else error \|\|= comments.error.message;
	142	}
	143	input.report?.(
	144	kind === "issue" ? "issues" : "pulls",
	145	kind === "issue"
	146	? `${plural(counts.issues, "issue")}, ${plural(counts.comments, "comment")}`
	147	: plural(counts.pulls, "open pull request"),
	148	);
	149	}
	150	if (listed.value.next === null) break;
	151	cursor = listed.value.next;
	152	}
	153	}
	154	return { ...counts, forkPulls, error };
	155	}
	156
	157	export function plural(n: number, one: string, many = `${one}s`): string {
	158	return `${n} ${n === 1 ? one : many}`;
	159	}
		@@ -790,6 +790,7 @@ function toRepo(raw: unknown): RemoteRepo {
790	790	openIssues: asNumber(field(raw, "open_issues_count")),
791	791	openPulls: asNumber(field(raw, "open_pr_counter")),
792	792	openIssuesIncludesPulls: false,
	793	sizeKb: asNumber(field(raw, "size")),
793	794	};
794	795	}
795	796
		@@ -708,6 +708,7 @@ function toRepo(raw: unknown): RemoteRepo {
708	708	openIssues: asNumber(field(raw, "open_issues_count")),
709	709	openPulls: 0,
710	710	openIssuesIncludesPulls: true,
	711	sizeKb: asNumber(field(raw, "size")),
711	712	};
712	713	}
713	714
		@@ -78,6 +78,8 @@ export interface RemoteRepo {
78	78	readonly openIssues: number;
79	79	readonly openPulls: number;
80	80	readonly openIssuesIncludesPulls: boolean;
	81	/** On-disk size as the origin reports it, in KiB; 0 when it says nothing. */
	82	readonly sizeKb: number;
81	83	}
82	84
83	85	export interface RemoteLabel {
		@@ -0,0 +1,186 @@
	1	/**
	2	* The work branch: of a repository's branches, the one its person was
	3	* working on. A fork keeps the upstream's tree on `main` and the person's
	4	* app on a branch of their own (`workbench`, four commits ahead), so the
	5	* source's default branch is not always where the app is. The rule is the
	6	* one a person would use looking at the list: the branch whose last commit
	7	* is theirs and newest; when none is theirs, the source's own default.
	8	*
	9	* A branch's last commit is read two ways, to the same shape: from a clone
	10	* already on disk (one `git for-each-ref`, every branch) or from an origin's
	11	* API before anything is cloned (one listing, then one commit per branch,
	12	* bounded). Whose a commit is: an account login the origin resolved, or an
	13	* author email or name that is one of the person's.
	14	*/
	15
	16	import { runGitCapture } from "../git/env.ts";
	17	import { isSafeRef } from "../git/guard.ts";
	18	import type { Provider, RemoteCommit } from "./types.ts";
	19
	20	export interface BranchTip {
	21	readonly name: string;
	22	readonly oid: string;
	23	/** The last commit's author date, ISO 8601; "" when not known. */
	24	readonly date: string;
	25	readonly subject: string;
	26	/** Who wrote it, as the page shows it: a login, else the author's name. */
	27	readonly author: string;
	28	/** Written by the person migrating. */
	29	readonly mine: boolean;
	30	}
	31
	32	/** The person, as commits may name them. Compared without case. */
	33	export interface Who {
	34	readonly logins: readonly string[];
	35	readonly emails: readonly string[];
	36	}
	37
	38	/** Branches whose last commit an origin is asked for; past it, names alone. */
	39	export const TIP_LOOKUPS = 30;
	40
	41	/**
	42	* Whether an author is the person: a login the origin resolved, an email
	43	* of theirs (GitHub's `<id>+<login>@users.noreply.github.com` included),
	44	* or a name that is one of their logins.
	45	*/
	46	export function isMine(
	47	author: { readonly name: string; readonly email: string; readonly login?: string },
	48	who: Who,
	49	): boolean {
	50	const logins = who.logins.map((l) => l.toLowerCase()).filter((l) => l !== "");
	51	const emails = who.emails.map((e) => e.toLowerCase()).filter((e) => e !== "");
	52	const login = (author.login ?? "").toLowerCase();
	53	const email = author.email.toLowerCase().replace(/^<\|>$/g, "");
	54	const name = author.name.toLowerCase();
	55	if (login !== "" && logins.includes(login)) return true;
	56	if (email !== "" && emails.includes(email)) return true;
	57	const noreply = /^(?:\d+\+)?([^@]+)@users\.noreply\.github\.com$/.exec(email);
	58	if (noreply !== null && logins.includes(noreply[1]!)) return true;
	59	return name !== "" && logins.includes(name);
	60	}
	61
	62	/**
	63	* The branch to work on: the newest tip that is the person's; else the
	64	* fallback when it is a branch; else the newest tip of all. ISO dates
	65	* compare as strings once they share a zone, so they are compared as times.
	66	*/
	67	export function pickWorkBranch(
	68	tips: readonly BranchTip[],
	69	fallback: string \| undefined,
	70	): string \| undefined {
	71	const newest = (rows: readonly BranchTip[]): BranchTip \| undefined =>
	72	[...rows].sort(
	73	(a, b) => time(b.date) - time(a.date) \|\| a.name.localeCompare(b.name),
	74	)[0];
	75	const mine = newest(tips.filter((t) => t.mine));
	76	if (mine !== undefined) return mine.name;
	77	if (fallback !== undefined && tips.some((t) => t.name === fallback))
	78	return fallback;
	79	return newest(tips)?.name;
	80	}
	81
	82	const time = (iso: string): number => {
	83	const t = Date.parse(iso);
	84	return Number.isFinite(t) ? t : 0;
	85	};
	86
	87	/** Every branch's last commit in a repository on disk, newest first. */
	88	export async function localTips(dir: string, who: Who): Promise<BranchTip[]> {
	89	const listed = await runGitCapture(
	90	[
	91	"for-each-ref",
	92	"--sort=-authordate",
	93	"--format=%(refname)%00%(objectname)%00%(authordate:iso-strict)%00%(authorname)%00%(authoremail)%00%(contents:subject)",
	94	"refs/heads/",
	95	],
	96	{ cwd: dir },
	97	);
	98	if (listed.code !== 0) return [];
	99	const tips: BranchTip[] = [];
	100	for (const line of listed.stdout.split("\n")) {
	101	const [ref, oid, date, name, email, subject] = line.split("\0");
	102	if (ref === undefined \|\| !ref.startsWith("refs/heads/")) continue;
	103	const branch = ref.slice("refs/heads/".length);
	104	tips.push({
	105	name: branch,
	106	oid: oid ?? "",
	107	date: date ?? "",
	108	subject: subject ?? "",
	109	author: name ?? "",
	110	mine: isMine({ name: name ?? "", email: email ?? "" }, who),
	111	});
	112	}
	113	return tips;
	114	}
	115
	116	/**
	117	* Every branch's last commit as an origin reports it, before any clone —
	118	* what the picker draws. One listing, then the first {@link TIP_LOOKUPS}
	119	* branches' commits side by side; the rest come back with no commit.
	120	* `undefined` when the origin will not list.
	121	*/
	122	export async function remoteTips(
	123	provider: Provider,
	124	fullName: string,
	125	who: Who,
	126	): Promise<BranchTip[] \| undefined> {
	127	const listed = await provider.listBranches(fullName);
	128	if (!listed.ok) return undefined;
	129	const branches = listed.value.filter((b) => isSafeRef(b.name));
	130	return Promise.all(
	131	branches.map(async (branch, i): Promise<BranchTip> => {
	132	const bare = {
	133	name: branch.name,
	134	oid: branch.oid,
	135	date: "",
	136	subject: "",
	137	author: "",
	138	mine: false,
	139	};
	140	if (i >= TIP_LOOKUPS \|\| branch.oid === "") return bare;
	141	const page = await provider.listCommits(fullName, branch.oid);
	142	const last: RemoteCommit \| undefined = page.ok ? page.value.items[0] : undefined;
	143	if (last === undefined) return bare;
	144	return {
	145	...bare,
	146	date: last.author.date,
	147	subject: last.message.split("\n")[0] ?? "",
	148	author: last.author.login ?? last.author.name,
	149	mine: isMine(last.author, who),
	150	};
	151	}),
	152	);
	153	}
	154
	155	/** How long the picker reuses one repository's tips: a reload, a 422. */
	156	export const TIPS_TTL_MS = 60_000;
	157	const TIPS_KEPT = 64;
	158	const tipsSeen = new Map<string, { readonly at: number; readonly tips: BranchTip[] }>();
	159
	160	/**
	161	* {@link remoteTips} through a short memory, keyed by origin and repository
	162	* — an origin belongs to one person, so the key is theirs alone. A reload
	163	* of the picker costs no requests to the origin, nor its rate limit; a
	164	* refusal is not remembered. Past {@link TIPS_KEPT} keys the oldest goes.
	165	*/
	166	export async function cachedRemoteTips(
	167	originId: string,
	168	provider: Provider,
	169	fullName: string,
	170	who: Who,
	171	now: number = Date.now(),
	172	): Promise<BranchTip[] \| undefined> {
	173	const key = `${originId}\0${fullName}`;
	174	const seen = tipsSeen.get(key);
	175	if (seen !== undefined && now - seen.at < TIPS_TTL_MS) return seen.tips;
	176	const tips = await remoteTips(provider, fullName, who);
	177	if (tips === undefined) return undefined;
	178	tipsSeen.delete(key);
	179	tipsSeen.set(key, { at: now, tips });
	180	while (tipsSeen.size > TIPS_KEPT) {
	181	const oldest = tipsSeen.keys().next().value;
	182	if (oldest === undefined) break;
	183	tipsSeen.delete(oldest);
	184	}
	185	return tips;
	186	}