ework-web 0.10.71 → 0.10.72

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ework-web",
-  "version": "0.10.71",
+  "version": "0.10.72",
   "type": "module",
   "description": "ework-web — standalone multi-project issue tracker. Local SQLite-backed, no external API dependency. Bun + TypeScript + SSR HTML.",
   "license": "MIT",

package/src/db.ts

@@ -134,6 +134,17 @@ function migrateIssuesTable(db: Database): void {
   if (!have.has("model")) {
     db.exec(applyPrefix("ALTER TABLE {{issues}} ADD COLUMN model TEXT NOT NULL DEFAULT ''"));
   }
+  if (!have.has("upstream_issue_number")) {
+    db.exec(applyPrefix("ALTER TABLE {{issues}} ADD COLUMN upstream_issue_number INTEGER"));
+  }
+}
+
+function migrateCommentsTable(db: Database): void {
+  const have = tableColumns(db, "comments");
+  if (have.size === 0) return;
+  if (!have.has("upstream_comment_id")) {
+    db.exec(applyPrefix("ALTER TABLE {{comments}} ADD COLUMN upstream_comment_id INTEGER"));
+  }
 }
 
 function migrateLabelsTable(db: Database): void {
@@ -242,6 +253,7 @@ class SqliteDriver implements AsyncDatabase {
   migratePatTable(db);
   migrateProjectsTable(db);
   migrateIssuesTable(db);
+  migrateCommentsTable(db);
   migrateLabelsTable(db);
   migrateAddSurrogateId(db);
     db.exec(applyPrefix(readFileSync(join(import.meta.dir, "schema.sql"), "utf8")));
@@ -360,25 +372,41 @@ async function migrateMysqlProjectsVisibility(pool: Pool): Promise<void> {
   }
 }
 
-async function migrateMysqlIssuesAiStatus(pool: Pool): Promise<void> {
-  const [cols] = await pool.query(
-    applyPrefix("SELECT COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = '{{issues}}' AND COLUMN_NAME = 'ai_status'")
-  );
-  if (Array.isArray(cols) && cols.length > 0) return;
+async function migrateMysqlColumn(pool: Pool, table: string, column: string, ddl: string): Promise<void> {
   try {
-    await pool.query(applyPrefix("ALTER TABLE {{issues}} ADD COLUMN ai_status VARCHAR(32) NOT NULL DEFAULT ''"));
+    const [cols] = await pool.query(
+      `SELECT COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = ? AND COLUMN_NAME = ?`,
+      [DB_PREFIX + table, column]
+    );
+    if (Array.isArray(cols) && cols.length > 0) return;
+    await pool.query(applyPrefix(`ALTER TABLE {{${table}}} ADD COLUMN ${ddl}`));
   } catch (e) {
-    console.warn("[db] MySQL issues ai_status column add failed:", (e as Error).message);
+    console.warn(`[db] MySQL ${table}.${column} column add failed:`, (e as Error).message);
   }
-  try {
-    const [mcols] = await pool.query(
-      applyPrefix("SELECT COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = '{{issues}}' AND COLUMN_NAME = 'model'")
-    );
-    if (!(Array.isArray(mcols) && mcols.length > 0)) {
-      await pool.query(applyPrefix("ALTER TABLE {{issues}} ADD COLUMN model VARCHAR(128) NOT NULL DEFAULT ''"));
+}
+
+async function migrateMysqlIssuesAiStatus(pool: Pool): Promise<void> {
+  await migrateMysqlColumn(pool, "issues", "ai_status", "ai_status VARCHAR(32) NOT NULL DEFAULT ''");
+  await migrateMysqlColumn(pool, "issues", "model", "model VARCHAR(128) NOT NULL DEFAULT ''");
+  await migrateMysqlColumn(pool, "issues", "upstream_issue_number", "upstream_issue_number INT DEFAULT NULL");
+  await migrateMysqlColumn(pool, "comments", "upstream_comment_id", "upstream_comment_id BIGINT DEFAULT NULL");
+  const indexes: Array<[string, string]> = [
+    ["uq_issues_project_upstream", applyPrefix("CREATE UNIQUE INDEX uq_issues_project_upstream ON {{issues}} (project_id, upstream_issue_number)")],
+    ["uq_comments_upstream", applyPrefix("CREATE UNIQUE INDEX uq_comments_upstream ON {{comments}} (upstream_comment_id)")],
+  ];
+  for (const [name, sql] of indexes) {
+    try {
+      const [rows] = await pool.query(
+        `SELECT INDEX_NAME FROM INFORMATION_SCHEMA.STATISTICS WHERE TABLE_SCHEMA = DATABASE() AND INDEX_NAME = ? LIMIT 1`,
+        [name]
+      );
+      if (Array.isArray(rows) && rows.length > 0) continue;
+      await pool.query(sql);
+    } catch (e) {
+      const errno = (e as { errno?: number }).errno;
+      if (errno === 1061 || errno === 30000) continue;
+      console.warn(`[db] MySQL index ${name} create failed:`, (e as Error).message);
     }
-  } catch (e) {
-    console.warn("[db] MySQL issues model column add failed:", (e as Error).message);
   }
 }
 

package/src/index.ts

@@ -75,9 +75,11 @@ import {
   deleteLabel,
   setIssueLabels,
   listAllProjectIds,
+  getUpstreamSync,
   type ProjectRole,
   type UserRow,
 } from "./store";
+import { startUpstreamSyncPoller } from "./upstream-sync";
 import {
   newAttachmentUUID,
   saveAttachmentBlob,
@@ -106,7 +108,12 @@ import { buildWebhooksPage } from "./views/webhooks";
 import { buildWebhookDeliveriesPage } from "./views/webhookDeliveries";
 import { browseRemoteFile, proxyFileSince, RemoteFileError } from "./remote-file";
 import { buildProjectMembersPage } from "./views/projectMembers";
-import { buildProjectUpstreamsPage, trySetUpstreamUrls } from "./views/projectUpstreams";
+import {
+  buildProjectUpstreamsPage,
+  parseUpstreamSyncForm,
+  trySetUpstreamSync,
+  trySetUpstreamUrls,
+} from "./views/projectUpstreams";
 import { buildProjectLabelsPage } from "./views/projectLabels";
 import { buildProjectModelPage } from "./views/projectModel";
 import { buildProjectAiPage } from "./views/projectAi";
@@ -137,6 +144,8 @@ async function refreshOpencodeClient(): Promise<void> {
 await refreshOpencodeClient();
 setInterval(refreshOpencodeClient, 10_000);
 
+startUpstreamSyncPoller(cfg);
+
 async function autoWireDaemon(projectId: number, origin: string): Promise<void> {
   if (!cfg.autowireActive) {
     log.info("autoWireDaemon: skipped (WORK_AUTOWIRE_ACTIVE=false)", { projectId });
@@ -380,6 +389,7 @@ const REPO_DISPATCH_RE = /^\/([^/]+)\/([^/]+)\/settings\/dispatch$/;
 const REPO_HALT_ALL_RE = /^\/([^/]+)\/([^/]+)\/settings\/ai\/halt-all$/;
 const SETTINGS_DISPATCH_RE = /^\/settings\/dispatch$/;
 const REPO_UPSTREAMS_RE = /^\/([^/]+)\/([^/]+)\/settings\/upstreams$/;
+const REPO_UPSTREAM_SYNC_RE = /^\/([^/]+)\/([^/]+)\/settings\/upstream-sync$/;
 const REPO_MODEL_RE = /^\/([^/]+)\/([^/]+)\/settings\/model$/;
 const REPO_AI_RE = /^\/([^/]+)\/([^/]+)\/settings\/ai$/;
 const REPO_LABELS_RE = /^\/([^/]+)\/([^/]+)\/settings\/labels$/;
@@ -2105,6 +2115,28 @@ async function handle(req: Request, url: URL, ip: string, ctx: { authed: boolean
       return Response.redirect(`${back}?err=${encodeURIComponent(result.msg)}`, 303);
     }
 
+    const syncSave = url.pathname.match(REPO_UPSTREAM_SYNC_RE);
+    if (syncSave) {
+      const [, owner, repo] = syncSave;
+      if (!(owner && repo)) return html(errorPage("bad path", ""), 400);
+      const project = await getProject(owner, repo);
+      if (!project) return html(errorPage("项目不存在", ""), 404);
+      const back = `${url.origin}/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/settings/upstreams`;
+      if (!(await canAdminProject(project.id, ctx.user))) {
+        return Response.redirect(`${back}?err=${encodeURIComponent("无权限")}`, 303);
+      }
+      const form = await req.formData().catch(() => new FormData());
+      const input = parseUpstreamSyncForm(form);
+      const result = await trySetUpstreamSync(project.id, input);
+      if (result.ok) {
+        return Response.redirect(
+          `${back}?ok=1&ok_msg=${encodeURIComponent(input.enabled ? "同步配置已保存并启用" : "同步配置已保存（未启用）")}`,
+          303,
+        );
+      }
+      return Response.redirect(`${back}?err=${encodeURIComponent(result.msg)}`, 303);
+    }
+
     const modelSave = url.pathname.match(REPO_MODEL_RE);
     if (modelSave) {
       const [, owner, repo] = modelSave;
@@ -2320,7 +2352,7 @@ async function handle(req: Request, url: URL, ip: string, ctx: { authed: boolean
     const flashKind = url.searchParams.get("ok") === "1" ? "ok" : url.searchParams.get("err") ? "err" : null;
     const flashMsg = flashKind === "ok" ? (url.searchParams.get("ok_msg") ?? "") : (url.searchParams.get("err") ?? "");
     const flash = flashKind ? { kind: flashKind as "ok" | "err", msg: flashMsg } : null;
-    return html(buildProjectUpstreamsPage(ctx.user!, project, flash));
+    return html(buildProjectUpstreamsPage(ctx.user!, project, flash, await getUpstreamSync(project.id)));
   }
 
   const labelsPage = url.pathname.match(REPO_LABELS_RE);

package/src/schema-mysql.sql

@@ -55,7 +55,9 @@ CREATE TABLE IF NOT EXISTS {{issues}} (
   closed_at  VARCHAR(40) DEFAULT NULL,
   ai_status  VARCHAR(32) NOT NULL DEFAULT '',
   model      VARCHAR(128) NOT NULL DEFAULT '',
+  upstream_issue_number INT DEFAULT NULL,
   UNIQUE (project_id, number),
+  UNIQUE uq_issues_project_upstream (project_id, upstream_issue_number),
   CONSTRAINT {{fk_issues_project}} FOREIGN KEY (project_id) REFERENCES {{projects}}(id) ON DELETE CASCADE,
   CONSTRAINT {{fk_issues_author}} FOREIGN KEY (author)     REFERENCES {{users}}(login)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
@@ -72,12 +74,33 @@ CREATE TABLE IF NOT EXISTS {{comments}} (
   body       TEXT NOT NULL,
   created_at VARCHAR(40) NOT NULL,
   updated_at VARCHAR(40) NOT NULL DEFAULT '',
+  upstream_comment_id BIGINT DEFAULT NULL,
+  UNIQUE uq_comments_upstream (upstream_comment_id),
   CONSTRAINT {{fk_comments_issue}} FOREIGN KEY (issue_id) REFERENCES {{issues}}(id) ON DELETE CASCADE,
   CONSTRAINT {{fk_comments_author}} FOREIGN KEY (author)  REFERENCES {{users}}(login)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
 CREATE INDEX comments_issue_created ON {{comments}} (issue_id, created_at);
 CREATE INDEX comments_author ON {{comments}} (author);
 
+CREATE TABLE IF NOT EXISTS {{upstream_sync}} (
+  id               BIGINT AUTO_INCREMENT PRIMARY KEY,
+  project_id       BIGINT NOT NULL,
+  base_url         VARCHAR(512) NOT NULL,
+  upstream_owner   VARCHAR(255) NOT NULL,
+  upstream_repo    VARCHAR(255) NOT NULL,
+  token            VARCHAR(512) NOT NULL DEFAULT '',
+  enabled          TINYINT NOT NULL DEFAULT 0,
+  poll_interval_ms INT NOT NULL DEFAULT 60000,
+  issue_cursor     VARCHAR(40) DEFAULT NULL,
+  comment_cursor   VARCHAR(40) DEFAULT NULL,
+  last_poll_at     VARCHAR(40) DEFAULT NULL,
+  last_error       TEXT,
+  created_at       VARCHAR(40) NOT NULL,
+  updated_at       VARCHAR(40) NOT NULL,
+  UNIQUE (project_id),
+  CONSTRAINT {{fk_upsync_project}} FOREIGN KEY (project_id) REFERENCES {{projects}}(id) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
 CREATE TABLE IF NOT EXISTS {{labels}} (
   id          BIGINT AUTO_INCREMENT PRIMARY KEY,
   project_id  BIGINT NOT NULL,

package/src/schema.sql

@@ -67,12 +67,16 @@ CREATE TABLE IF NOT EXISTS {{issues}} (
   ai_status  TEXT NOT NULL DEFAULT '',
   -- Resolved "provider/model" for this issue. Empty = inherit project/global default.
   model      TEXT NOT NULL DEFAULT '',
+  -- Upstream Gitea issue number this row was imported from (NULL = native).
+  upstream_issue_number INTEGER,
   UNIQUE (project_id, number)
 );
 CREATE INDEX IF NOT EXISTS issues_project_state_updated
   ON {{issues}} (project_id, state, updated_at DESC);
 CREATE INDEX IF NOT EXISTS issues_state_updated
   ON {{issues}} (state, updated_at DESC);
+CREATE UNIQUE INDEX IF NOT EXISTS issues_project_upstream
+  ON {{issues}} (project_id, upstream_issue_number) WHERE upstream_issue_number IS NOT NULL;
 
 CREATE TABLE IF NOT EXISTS {{comments}} (
   id         INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -80,10 +84,31 @@ CREATE TABLE IF NOT EXISTS {{comments}} (
   author     TEXT NOT NULL REFERENCES {{users}}(login),
   body       TEXT NOT NULL,
   created_at TEXT NOT NULL,
-  updated_at TEXT NOT NULL DEFAULT ''
+  updated_at TEXT NOT NULL DEFAULT '',
+  upstream_comment_id INTEGER
 );
 CREATE INDEX IF NOT EXISTS comments_issue_created
   ON {{comments}} (issue_id, created_at);
+CREATE UNIQUE INDEX IF NOT EXISTS comments_upstream
+  ON {{comments}} (upstream_comment_id) WHERE upstream_comment_id IS NOT NULL;
+
+CREATE TABLE IF NOT EXISTS {{upstream_sync}} (
+  id               INTEGER PRIMARY KEY AUTOINCREMENT,
+  project_id       INTEGER NOT NULL REFERENCES {{projects}}(id) ON DELETE CASCADE,
+  base_url         TEXT NOT NULL,
+  upstream_owner   TEXT NOT NULL,
+  upstream_repo    TEXT NOT NULL,
+  token            TEXT NOT NULL DEFAULT '',
+  enabled          INTEGER NOT NULL DEFAULT 0,
+  poll_interval_ms INTEGER NOT NULL DEFAULT 60000,
+  issue_cursor     TEXT,
+  comment_cursor   TEXT,
+  last_poll_at     TEXT,
+  last_error       TEXT,
+  created_at       TEXT NOT NULL,
+  updated_at       TEXT NOT NULL,
+  UNIQUE (project_id)
+);
 
 CREATE TABLE IF NOT EXISTS {{labels}} (
   id          INTEGER PRIMARY KEY AUTOINCREMENT,

package/src/store.ts

@@ -452,6 +452,7 @@ export interface CreateIssueOpts {
   state?: "open" | "closed";
   closedAt?: string | null;
   model?: string;
+  upstreamIssueNumber?: number;
 }
 
 function isoOr(value: string | undefined, fallback: string): string {
@@ -482,8 +483,8 @@ export async function createIssue(
       "SELECT COALESCE(MAX(number), 0) + 1 AS n FROM {{issues}} WHERE project_id = ?", [projectId]
     ))!;
     const info = await getDB().run(
-      "INSERT INTO {{issues}} (project_id, number, title, body, state, author, created_at, updated_at, closed_at, model) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
-      [projectId, next.n, title, body, state, author, createdAt, updatedAt, closedAt, opts.model ?? ""]
+      "INSERT INTO {{issues}} (project_id, number, title, body, state, author, created_at, updated_at, closed_at, model, upstream_issue_number) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
+      [projectId, next.n, title, body, state, author, createdAt, updatedAt, closedAt, opts.model ?? "", opts.upstreamIssueNumber ?? null]
     );
     await getDB().run("UPDATE {{projects}} SET updated_at = ? WHERE id = ?", [updatedAt, projectId]);
     return (await getIssueById(info.insertId))!;
@@ -523,6 +524,107 @@ export async function updateIssueModel(issueId: number, model: string): Promise<
   await getDB().run("UPDATE {{issues}} SET model = ?, updated_at = ? WHERE id = ?", [clean, now(), issueId]);
 }
 
+export interface UpstreamSyncRow {
+  id: number;
+  project_id: number;
+  base_url: string;
+  upstream_owner: string;
+  upstream_repo: string;
+  token: string;
+  enabled: number;
+  poll_interval_ms: number;
+  issue_cursor: string | null;
+  comment_cursor: string | null;
+  last_poll_at: string | null;
+  last_error: string | null;
+  created_at: string;
+  updated_at: string;
+}
+
+export interface UpsertUpstreamSyncOpts {
+  baseUrl: string;
+  upstreamOwner: string;
+  upstreamRepo: string;
+  token?: string;
+  enabled?: boolean;
+  pollIntervalMs?: number;
+}
+
+export async function getUpstreamSync(projectId: number): Promise<UpstreamSyncRow | null> {
+  return await getDB().get<UpstreamSyncRow>("SELECT * FROM {{upstream_sync}} WHERE project_id = ?", [projectId]);
+}
+
+export async function listEnabledUpstreamSyncs(): Promise<UpstreamSyncRow[]> {
+  return await getDB().all<UpstreamSyncRow>("SELECT * FROM {{upstream_sync}} WHERE enabled = 1");
+}
+
+export async function upsertUpstreamSync(projectId: number, opts: UpsertUpstreamSyncOpts): Promise<UpstreamSyncRow> {
+  const baseUrl = opts.baseUrl
+    .trim()
+    .replace(/\/+$/, "")
+    .replace(/\/api\/v1$/i, "");
+  if (!/^https?:\/\//.test(baseUrl)) throw new StoreError(400, "上游地址必须是 http(s) URL");
+  const owner = opts.upstreamOwner.trim();
+  const repo = opts.upstreamRepo.trim();
+  if (!owner || !repo) throw new StoreError(400, "上游 owner/repo 不能为空");
+  const interval = opts.pollIntervalMs ?? 60_000;
+  if (!Number.isFinite(interval) || interval < 10_000) throw new StoreError(400, "轮询间隔不能小于 10 秒");
+  const existing = await getUpstreamSync(projectId);
+  const token = opts.token !== undefined ? opts.token.trim() : existing?.token ?? "";
+  const enabled = opts.enabled ?? (existing?.enabled === 1);
+  const ts = now();
+  if (existing) {
+    await getDB().run(
+      "UPDATE {{upstream_sync}} SET base_url = ?, upstream_owner = ?, upstream_repo = ?, token = ?, enabled = ?, poll_interval_ms = ?, updated_at = ? WHERE project_id = ?",
+      [baseUrl, owner, repo, token, enabled ? 1 : 0, Math.floor(interval), ts, projectId]
+    );
+  } else {
+    await getDB().run(
+      "INSERT INTO {{upstream_sync}} (project_id, base_url, upstream_owner, upstream_repo, token, enabled, poll_interval_ms, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",
+      [projectId, baseUrl, owner, repo, token, enabled ? 1 : 0, Math.floor(interval), ts, ts]
+    );
+  }
+  return (await getUpstreamSync(projectId))!;
+}
+
+export async function updateUpstreamSyncState(
+  projectId: number,
+  patch: { issueCursor?: string | null; commentCursor?: string | null; lastError?: string | null }
+): Promise<void> {
+  const sets: string[] = [];
+  const args: (string | number | null)[] = [];
+  if (patch.issueCursor !== undefined) {
+    sets.push("issue_cursor = ?");
+    args.push(patch.issueCursor);
+  }
+  if (patch.commentCursor !== undefined) {
+    sets.push("comment_cursor = ?");
+    args.push(patch.commentCursor);
+  }
+  if (patch.lastError !== undefined) {
+    sets.push("last_error = ?");
+    args.push(patch.lastError);
+  }
+  if (sets.length === 0) return;
+  sets.push("last_poll_at = ?", "updated_at = ?");
+  args.push(now(), now(), projectId);
+  await getDB().run(`UPDATE {{upstream_sync}} SET ${sets.join(", ")} WHERE project_id = ?`, args);
+}
+
+export async function getIssueByUpstreamNumber(projectId: number, upstreamNumber: number): Promise<IssueRow | null> {
+  return await getDB().get<IssueRow>(
+    "SELECT * FROM {{issues}} WHERE project_id = ? AND upstream_issue_number = ?",
+    [projectId, upstreamNumber]
+  );
+}
+
+export async function getCommentByUpstreamId(upstreamCommentId: number): Promise<CommentRow | null> {
+  return await getDB().get<CommentRow>(
+    "SELECT * FROM {{comments}} WHERE upstream_comment_id = ?",
+    [upstreamCommentId]
+  );
+}
+
 export interface IssuePatch {
   title?: string;
   body?: string;
@@ -621,6 +723,7 @@ export async function listCommentsForIssue(issueId: number): Promise<CommentRow[
 export interface CreateCommentOpts {
   createdAt?: string;
   updatedAt?: string;
+  upstreamCommentId?: number;
 }
 
 export async function postComment(
@@ -636,8 +739,8 @@ export async function postComment(
   const updatedAt = opts.updatedAt ? isoOr(opts.updatedAt, createdAt) : createdAt;
   return await getDB().transaction(async () => {
     const info = await getDB().run(
-      "INSERT INTO {{comments}} (issue_id, author, body, created_at, updated_at) VALUES (?, ?, ?, ?, ?)",
-      [issueId, author, body, createdAt, updatedAt]
+      "INSERT INTO {{comments}} (issue_id, author, body, created_at, updated_at, upstream_comment_id) VALUES (?, ?, ?, ?, ?, ?)",
+      [issueId, author, body, createdAt, updatedAt, opts.upstreamCommentId ?? null]
     );
     await getDB().run("UPDATE {{issues}} SET updated_at = ? WHERE id = ?", [updatedAt, issueId]);
     const row = await getDB().get<{ project_id: number }>("SELECT project_id FROM {{issues}} WHERE id = ?", [issueId]);

package/src/upstream-sync.ts

@@ -0,0 +1,270 @@
+import {
+  type UpstreamSyncRow,
+  type ProjectRow,
+  type IssueRow,
+  getProjectById,
+  getIssueByUpstreamNumber,
+  getCommentByUpstreamId,
+  createIssue,
+  postComment,
+  editIssue,
+  updateUpstreamSyncState,
+  listEnabledUpstreamSyncs,
+} from "./store";
+import { emitIssueEvent, emitCommentEvent } from "./webhooks";
+import { log } from "./logger";
+import type { Config } from "./config";
+
+interface GiteaIssue {
+  number: number;
+  title: string;
+  body: string | null;
+  state: string;
+  user: { login: string } | null;
+  created_at: string;
+  updated_at: string;
+}
+
+interface GiteaComment {
+  id: number;
+  body: string | null;
+  user: { login: string } | null;
+  created_at: string;
+  updated_at: string;
+  issue_url?: string;
+}
+
+export interface UpstreamSyncPollResult {
+  issuesImported: number;
+  issuesUpdated: number;
+  commentsImported: number;
+}
+
+const GITEA_COMMENT_ISSUE_RE = /\/issues\/(\d+)$/;
+
+function upstreamIssueNumberFromComment(gc: GiteaComment): number | null {
+  const m = (gc.issue_url ?? "").match(GITEA_COMMENT_ISSUE_RE);
+  return m ? Number(m[1]) : null;
+}
+
+export function syncOrigin(cfg: Config): string {
+  const first = cfg.publicOrigins[0];
+  if (first) return first.replace(/\/+$/, "");
+  return `http://127.0.0.1:${cfg.port}`;
+}
+
+export class UpstreamSync {
+  private readonly sync: UpstreamSyncRow;
+  private readonly project: ProjectRow;
+  private readonly origin: string;
+
+  constructor(sync: UpstreamSyncRow, project: ProjectRow, origin: string) {
+    this.sync = sync;
+    this.project = project;
+    this.origin = origin;
+  }
+
+  private headers(): Record<string, string> {
+    const h: Record<string, string> = { Accept: "application/json" };
+    if (this.sync.token) h.Authorization = `token ${this.sync.token}`;
+    return h;
+  }
+
+  private api(path: string): string {
+    return `${this.sync.base_url}/api/v1/repos/${this.sync.upstream_owner}/${this.sync.upstream_repo}${path}`;
+  }
+
+  private async fetchJson<T>(path: string): Promise<T | null> {
+    const resp = await fetch(this.api(path), { headers: this.headers(), signal: AbortSignal.timeout(15_000) });
+    if (resp.status === 404) return null;
+    if (!resp.ok) throw new Error(`upstream ${path} -> ${resp.status}`);
+    return (await resp.json()) as T;
+  }
+
+  // First run (null issue cursor) is a backfill: import open issues + their
+  // comments silently so the AI isn't woken by a flood of historical entries.
+  // Live polls (cursor set) emit webhooks so new upstream activity reaches
+  // the daemon exactly like locally-created content.
+  private get isBackfill(): boolean {
+    return this.sync.issue_cursor === null;
+  }
+
+  private async importIssue(gi: GiteaIssue, emit: boolean): Promise<void> {
+    await createIssue(
+      this.project.id,
+      gi.title || `#${gi.number}`,
+      gi.body ?? "",
+      gi.user?.login ?? "upstream",
+      {
+        createdAt: gi.created_at,
+        updatedAt: gi.updated_at,
+        state: gi.state === "closed" ? "closed" : "open",
+        upstreamIssueNumber: gi.number,
+      }
+    );
+    if (emit) {
+      const created = await getIssueByUpstreamNumber(this.project.id, gi.number);
+      if (created) void emitIssueEvent(this.project.id, created.id, "opened", this.origin);
+    }
+  }
+
+  private async syncIssueState(existing: IssueRow, gi: GiteaIssue, emit: boolean): Promise<boolean> {
+    const target: "open" | "closed" = gi.state === "closed" ? "closed" : "open";
+    if (existing.state === target) return false;
+    await editIssue(existing.id, { state: target });
+    if (emit) {
+      void emitIssueEvent(this.project.id, existing.id, target === "closed" ? "closed" : "reopened", this.origin);
+    }
+    return true;
+  }
+
+  private async importIssueComments(gi: GiteaIssue, emit: boolean): Promise<number> {
+    const comments = await this.fetchJson<GiteaComment[]>(`/issues/${gi.number}/comments?limit=50&order=asc`);
+    if (!comments) return 0;
+    const local = await getIssueByUpstreamNumber(this.project.id, gi.number);
+    if (!local) return 0;
+    let n = 0;
+    for (const gc of comments) {
+      if (await getCommentByUpstreamId(gc.id)) continue;
+      const row = await postComment(local.id, gc.body ?? "", gc.user?.login ?? "upstream", {
+        createdAt: gc.created_at,
+        updatedAt: gc.updated_at,
+        upstreamCommentId: gc.id,
+      });
+      if (emit) void emitCommentEvent(this.project.id, local.id, row.id, this.origin);
+      n++;
+    }
+    return n;
+  }
+
+  private async backfillOnce(): Promise<UpstreamSyncPollResult> {
+    const result: UpstreamSyncPollResult = { issuesImported: 0, issuesUpdated: 0, commentsImported: 0 };
+    let cursor: string | null = null;
+    for (let page = 1; page <= 20; page++) {
+      const issues = await this.fetchJson<GiteaIssue[]>(
+        `/issues?state=open&type=issues&limit=50&page=${page}&sort=created&order=asc`
+      );
+      if (!issues || issues.length === 0) break;
+      for (const gi of issues) {
+        if (!(await getIssueByUpstreamNumber(this.project.id, gi.number))) {
+          await this.importIssue(gi, false);
+          result.issuesImported++;
+        }
+        result.commentsImported += await this.importIssueComments(gi, false);
+        if (gi.updated_at && (!cursor || gi.updated_at > cursor)) cursor = gi.updated_at;
+      }
+      if (issues.length < 50) break;
+    }
+    await updateUpstreamSyncState(this.project.id, {
+      issueCursor: cursor ?? new Date().toISOString(),
+      commentCursor: cursor ?? new Date().toISOString(),
+      lastError: null,
+    });
+    return result;
+  }
+
+  private async liveOnce(): Promise<UpstreamSyncPollResult> {
+    const result: UpstreamSyncPollResult = { issuesImported: 0, issuesUpdated: 0, commentsImported: 0 };
+    const issues = await this.fetchJson<GiteaIssue[]>(
+      `/issues?state=all&type=issues&limit=30&sort=updated&order=desc`
+    );
+    let issueCursor = this.sync.issue_cursor;
+    if (issues) {
+      for (const gi of issues) {
+        if (this.sync.issue_cursor && gi.updated_at <= this.sync.issue_cursor) continue;
+        const existing = await getIssueByUpstreamNumber(this.project.id, gi.number);
+        if (!existing) {
+          await this.importIssue(gi, true);
+          result.issuesImported++;
+          result.commentsImported += await this.importIssueComments(gi, true);
+        } else if (await this.syncIssueState(existing, gi, true)) {
+          result.issuesUpdated++;
+        }
+        if (gi.updated_at && (!issueCursor || gi.updated_at > issueCursor)) issueCursor = gi.updated_at;
+      }
+    }
+
+    let commentCursor = this.sync.comment_cursor;
+    const comments = await this.fetchJson<GiteaComment[]>(
+      `/issues/comments?limit=50&sort=updated&order=asc${
+        this.sync.comment_cursor ? `&since=${encodeURIComponent(this.sync.comment_cursor)}` : ""
+      }`
+    );
+    if (comments) {
+      for (const gc of comments) {
+        if (await getCommentByUpstreamId(gc.id)) continue;
+        const upstreamNumber = upstreamIssueNumberFromComment(gc);
+        if (!upstreamNumber) continue;
+        const local = await getIssueByUpstreamNumber(this.project.id, upstreamNumber);
+        if (!local) continue;
+        const row = await postComment(local.id, gc.body ?? "", gc.user?.login ?? "upstream", {
+          createdAt: gc.created_at,
+          updatedAt: gc.updated_at,
+          upstreamCommentId: gc.id,
+        });
+        void emitCommentEvent(this.project.id, local.id, row.id, this.origin);
+        result.commentsImported++;
+      }
+      const last = comments[comments.length - 1];
+      if (last?.updated_at && (!commentCursor || last.updated_at > commentCursor)) commentCursor = last.updated_at;
+    }
+
+    await updateUpstreamSyncState(this.project.id, {
+      issueCursor: issueCursor ?? undefined,
+      commentCursor: commentCursor ?? undefined,
+      lastError: null,
+    });
+    return result;
+  }
+
+  async pollOnce(): Promise<UpstreamSyncPollResult> {
+    return this.isBackfill ? await this.backfillOnce() : await this.liveOnce();
+  }
+}
+
+let tickTimer: ReturnType<typeof setInterval> | null = null;
+const inFlight = new Set<number>();
+
+async function tick(cfg: Config): Promise<void> {
+  const rows = await listEnabledUpstreamSyncs();
+  for (const row of rows) {
+    if (inFlight.has(row.project_id)) continue;
+    const interval = Math.max(10_000, row.poll_interval_ms);
+    if (row.last_poll_at && Date.now() - Date.parse(row.last_poll_at) < interval) continue;
+    inFlight.add(row.project_id);
+    void (async () => {
+      try {
+        const project = await getProjectById(row.project_id);
+        if (!project) return;
+        const sync = new UpstreamSync(row, project, syncOrigin(cfg));
+        const r = await sync.pollOnce();
+        if (r.issuesImported || r.issuesUpdated || r.commentsImported) {
+          log.info("upstream-sync: polled", {
+            project: `${project.owner}/${project.name}`,
+            imported: r.issuesImported,
+            updated: r.issuesUpdated,
+            comments: r.commentsImported,
+          });
+        }
+      } catch (e) {
+        log.warn(`upstream-sync: poll failed for project ${row.project_id}: ${(e as Error).message}`);
+        await updateUpstreamSyncState(row.project_id, { lastError: (e as Error).message }).catch(() => {});
+      } finally {
+        inFlight.delete(row.project_id);
+      }
+    })();
+  }
+}
+
+export function startUpstreamSyncPoller(cfg: Config): void {
+  if (tickTimer) return;
+  tickTimer = setInterval(() => {
+    void tick(cfg);
+  }, 15_000);
+  log.info("upstream-sync: poller started (tick=15s)");
+}
+
+export function stopUpstreamSyncPoller(): void {
+  if (tickTimer) clearInterval(tickTimer);
+  tickTimer = null;
+}

package/src/views/projectUpstreams.ts

@@ -3,8 +3,10 @@ import {
   getDefaultUpstreamUrl,
   getProjectUpstreamUrls,
   setProjectUpstreamUrls,
+  upsertUpstreamSync,
   StoreError,
   type ProjectRow,
+  type UpstreamSyncRow,
   type UserRow,
 } from "../store";
 
@@ -56,10 +58,59 @@ function urlRowHtml(url: string, idx: number): string {
   </tr>`;
 }
 
+function fmtDate(iso: string | null): string {
+  if (!iso) return "—";
+  const t = Date.parse(iso);
+  return Number.isNaN(t) ? "—" : new Date(t).toLocaleString("zh-CN", { hour12: false });
+}
+
+function syncCardHtml(project: ProjectRow, sync: UpstreamSyncRow | null): string {
+  const action = `/${encodeURIComponent(project.owner)}/${encodeURIComponent(project.name)}/settings/upstream-sync`;
+  const enabled = sync?.enabled === 1;
+  const statusHtml = sync
+    ? `<table>
+<thead><tr><th>状态</th><th>最近轮询</th><th>进度游标</th></tr></thead>
+<tbody><tr>
+<td>${enabled ? '<span class="badge default">运行中</span>' : "已停用"}</td>
+<td>${escapeHtml(fmtDate(sync.last_poll_at))}${sync.last_error ? `<div class="err-text">⚠️ ${escapeHtml(sync.last_error)}</div>` : ""}</td>
+<td>issue #${sync.issue_cursor ? String(sync.issue_cursor).slice(0, 10) : "未同步"} · 评论 #${sync.comment_cursor ? String(sync.comment_cursor).slice(0, 10) : "未同步"}</td>
+</tr></tbody></table>`
+    : `<div class="hint">尚未配置。填写下方表单后，web 会定时从上游 Gitea 拉取 issue/评论（单向同步：上游 → 本地），首次会静默回填全部开放 issue，之后新事件按正常消息分发。</div>`;
+  const baseUrl = sync?.base_url ?? guessUpstreamBase(project) ?? "";
+  return `<form class="card" method="POST" action="${escapeAttr(action)}">
+<h2>🔄 上游 Gitea 同步（单向拉取）</h2>
+${statusHtml}
+<div class="form-grid">
+<div><label for="s-base">上游地址（Gitea 根地址，如 http://host:3000）</label>
+<input id="s-base" name="base_url" type="url" placeholder="http://192.168.10.96:3300" value="${escapeAttr(baseUrl)}" required></div>
+<div><label for="s-owner">上游 owner</label>
+<input id="s-owner" name="upstream_owner" value="${escapeAttr(sync?.upstream_owner ?? project.owner)}" required></div>
+<div><label for="s-repo">上游 repo</label>
+<input id="s-repo" name="upstream_repo" value="${escapeAttr(sync?.upstream_repo ?? project.name)}" required></div>
+<div><label for="s-token">访问 token（留空保持不变）</label>
+<input id="s-token" name="token" type="password" placeholder="${sync?.token ? "已保存（留空不变）" : "可选，私有仓库必填"}"></div>
+<div><label for="s-interval">轮询间隔（秒，最小 10）</label>
+<input id="s-interval" name="poll_interval" type="number" min="10" step="1" value="${sync ? Math.round(sync.poll_interval_ms / 1000) : 60}"></div>
+</div>
+<label class="check"><input type="checkbox" name="enabled" value="1"${enabled ? " checked" : ""}> 启用同步</label>
+<div class="hint">注意：上游需为 Gitea。地址填站点根地址即可（带不带 <code>/api/v1</code> 都可以，会自动归一）。回填阶段不触发 AI；之后的 opened/评论 事件会按正常策略唤醒 AI。</div>
+<button class="primary" type="submit">保存同步配置</button>
+</form>`;
+}
+
+// Heuristic: http(s) clone URL → Gitea host root; null otherwise.
+function guessUpstreamBase(project: ProjectRow): string | null {
+  const url = getDefaultUpstreamUrl(project);
+  if (!url) return null;
+  const m = url.match(/^(https?:\/\/[^\/]+)\//i);
+  return m && m[1] ? m[1] : null;
+}
+
 export function buildProjectUpstreamsPage(
   _viewer: UserRow,
   project: ProjectRow,
   flash: Flash | null,
+  sync: UpstreamSyncRow | null = null,
 ): string {
   const urls = getProjectUpstreamUrls(project);
   const rowsHtml = urls.length
@@ -101,6 +152,11 @@ td.idx{width:60px;color:var(--text-muted);white-space:nowrap}
 label{display:block;font-size:12px;color:var(--text-muted);margin:0 0 .25rem}
 textarea{width:100%;box-sizing:border-box;padding:.5rem .65rem;border:1px solid var(--border);border-radius:6px;background:var(--bg);color:var(--text);font:inherit;font-family:ui-monospace,monospace;font-size:13px;margin-bottom:.7rem;min-height:120px;resize:vertical}
 button.primary{padding:.5rem 1rem;border:0;border-radius:6px;background:var(--accent);color:#fff;font-size:13px;cursor:pointer}
+.form-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(200px,1fr));gap:.6rem;margin:.6rem 0}
+.form-grid label{margin:0 0 .25rem}
+input[type=url],input[type=text],input[type=password],input[type=number]{width:100%;box-sizing:border-box;padding:.45rem .6rem;border:1px solid var(--border);border-radius:6px;background:var(--bg);color:var(--text);font:inherit;font-size:13px}
+label.check{display:flex;align-items:center;gap:.4rem;font-size:13px;color:var(--text);margin:.4rem 0 .6rem}
+.err-text{color:#f85149;font-size:12px;margin-top:.3rem;word-break:break-all}
 </style></head><body>
 <header class="topbar"><span style="font-weight:600">🔗 ${escapeHtml(project.owner)}/${escapeHtml(project.name)} · 上游</span></header>
 ${tabNavHTML("projects")}
@@ -121,6 +177,8 @@ ${rowsHtml}
 <div class="hint">支持协议：<code>http(s)://</code>、<code>ssh://</code>、<code>git@host:owner/repo</code>。最多 10 个。空行会被忽略，重复会被去重。</div>
 <button class="primary" type="submit">保存</button>
 </form>
+
+${syncCardHtml(project, sync)}
 </main></body></html>`;
 }
 
@@ -131,6 +189,46 @@ export function parseUpstreamUrlsForm(text: string): string[] {
     .filter((line) => line.length > 0);
 }
 
+export interface UpstreamSyncFormInput {
+  baseUrl: string;
+  upstreamOwner: string;
+  upstreamRepo: string;
+  token?: string;
+  enabled: boolean;
+  pollIntervalMs: number;
+}
+
+export function parseUpstreamSyncForm(form: { get(name: string): string | File | null }): UpstreamSyncFormInput {
+  const val = (name: string): string => {
+    const v = form.get(name);
+    return typeof v === "string" ? v.trim() : "";
+  };
+  const intervalRaw = Number.parseInt(val("poll_interval") || "60", 10);
+  const intervalSec = Number.isFinite(intervalRaw) && intervalRaw >= 10 ? intervalRaw : 60;
+  const token = val("token");
+  return {
+    baseUrl: val("base_url"),
+    upstreamOwner: val("upstream_owner"),
+    upstreamRepo: val("upstream_repo"),
+    token: token.length ? token : undefined,
+    enabled: val("enabled") === "1",
+    pollIntervalMs: intervalSec * 1000,
+  };
+}
+
+export async function trySetUpstreamSync(
+  projectId: number,
+  input: UpstreamSyncFormInput,
+): Promise<{ ok: true } | { ok: false; msg: string }> {
+  try {
+    await upsertUpstreamSync(projectId, input);
+    return { ok: true };
+  } catch (e) {
+    const msg = e instanceof StoreError ? e.message : e instanceof Error ? e.message : "保存失败";
+    return { ok: false, msg };
+  }
+}
+
 export async function trySetUpstreamUrls(
   projectId: number,
   raw: string,