A test pins syncing a mirror whose origin has no stored token: it says to reconnect, in words, and never crashes #7186

A new test, test/origin-no-token.test.ts, pins syncing a mirror whose origin has no stored token. The test found the behaviour wrong, so I fixed two modules in this pull. bun x tsc --noEmit is clean. The new test, test/mcp-size.test.ts and the sync, origin and reconnect suites pass.

Test. It mirrors a repository the fake origin reports as private, then blanks the origin's sealed secret (token_enc and refresh_token_enc). It also moves the upstream forward. Three things are checked:

• Syncing through the API (POST …/repos/:owner/:name/sync and POST …/user/origins/:id/sync) returns a status below 500. The body's error says to reconnect.
• MCP sync returns sync_failed with the same words.
• The mirror's main stays at the old commit while the upstream has moved. The settings page shows "this origin needs to be reconnected" and a "Re-authorize octo" link.

Fixes found by the test.

• credentialFor (src/origins/credential.ts): it only answered no_token when the origin row was missing. A blanked secret passed that check and failed later as "credential cannot be read". An empty token now counts as no_token.
• runOrigin (src/origins/sync.ts): the no-credential branch said only "has no usable credential". It now says "this origin has no stored token: reconnect <login> at <host>" and marks the origin as needing reauth, so the settings page shows the reconnect note.

Behaviours to know about.

• The API answers HTTP 200 with the sync report's error field, not a 4xx status. That is how failed syncs were already reported, and I left it.
• After the first failed sync the origin is flagged needing reauth. The settings page and later syncs then show the shorter "this origin needs to be reconnected". The "no stored token" line is shown only on that first sync.
• The upstream repository on the second forge is public, so the mirror's clone needs no credentials. "Private" is the flag the fake origin reports for the repository.

No dependencies added. I did not run the full check.

🤖 Generated with Claude Code

Closes #7177

A new test, test/origin-no-token.test.ts, pins syncing a mirror whose origin has no stored token. The test found the behaviour wrong, so I fixed two modules in this pull. bun x tsc --noEmit is clean. The new test, test/mcp-size.test.ts and the sync, origin and reconnect suites pass.

Test. It mirrors a repository the fake origin reports as private, then blanks the origin's sealed secret (token_enc and refresh_token_enc). It also moves the upstream forward. Three things are checked:

• Syncing through the API (POST …/repos/:owner/:name/sync and POST …/user/origins/:id/sync) returns a status below 500. The body's error says to reconnect.
• MCP sync returns sync_failed with the same words.
• The mirror's main stays at the old commit while the upstream has moved. The settings page shows "this origin needs to be reconnected" and a "Re-authorize octo" link.

Fixes found by the test.

• credentialFor (src/origins/credential.ts): it only answered no_token when the origin row was missing. A blanked secret passed that check and failed later as "credential cannot be read". An empty token now counts as no_token.
• runOrigin (src/origins/sync.ts): the no-credential branch said only "has no usable credential". It now says "this origin has no stored token: reconnect <login> at <host>" and marks the origin as needing reauth, so the settings page shows the reconnect note.

Behaviours to know about.

• The API answers HTTP 200 with the sync report's error field, not a 4xx status. That is how failed syncs were already reported, and I left it.
• After the first failed sync the origin is flagged needing reauth. The settings page and later syncs then show the shorter "this origin needs to be reconnected". The "no stored token" line is shown only on that first sync.
• The upstream repository on the second forge is public, so the mirror's clone needs no credentials. "Private" is the flag the fake origin reports for the repository.

No dependencies added. I did not run the full check.

🤖 Generated with Claude Code