heyquilt 0.3.138 → 0.3.141

package/src/relay-upstream.js

@@ -1,889 +0,0 @@
-// Commits pushed to GitHub reach a session through a member's folder (Session.checkUpstream).
-// When no folder that can bring them in is online on a branch (none with git, or only ones
-// that can't: held, diverged, a viewer's, or whose fetch fails) and members still work there
-// (hosted agents over HTTP, chat links, CLI agents or apps without git), nothing would bring
-// them in, and they would work on stale files.
-// So the relay does it for that branch: it learns from members' presence which repository
-// and upstream branch the branch follows, and the last commit a folder on it was at while
-// in step with the session; then, every so often, it asks GitHub whether that upstream
-// moved on, and if it is strictly ahead, merges its files into the branch document the
-// same way a folder would (upstream.js planCatchUp): where both changed the same lines, Quilt
-// combines them itself, the newer edit keeping them, and tells whoever's lines lost
-// (relay-clash.js). Nobody is asked to merge. Never a history merge, never anything written to GitHub.
-//
-// The relay has no git: the commit it records is "the session's files are this commit plus
-// the session's work". A folder that comes back behind its upstream follows it like a
-// member already at that commit (Session.memberAt), moving git without writing files.
-import { DEFAULT_KEY } from './branchdocs.js'
-import { appCredentials } from './relay-github.js'
-import * as Y from 'yjs'
-import { planCatchUp, publishedOf } from './upstream.js'
-import { applyTextDiff } from './textdiff.js'
-import { isDiff } from './branch-view.js'
-import { looksBinary, sha1 } from './fsutil.js'
-import { LARGE_FILE_BYTES, MAX_TEXT_BYTES, makeIgnore, scopeIgnore, isIgnored, isSafeRelPath } from './pathrules.js'
-import { unionMatcher } from './merge3.js'
-import { readTasks, updateTask } from './tasks.js'
-import { HistoryLog } from './history.js'
-import { RELAY_BY, isRelay } from './branches.js'
-
-/** How often the relay asks GitHub about a branch nobody's folder is on (per branch). */
-export const UPSTREAM_CHECK_MS = 10 * 60 * 1000
-/** A branch counts as worked on by hosted agents this long after one of their calls on it. */
-export const HOSTED_RECENT_MS = 30 * 60 * 1000
-/** The longest the relay waits after GitHub says to slow down, and the first wait without a hint. */
-export const MAX_BACKOFF_MS = 6 * 60 * 60 * 1000
-export const FIRST_BACKOFF_MS = 15 * 60 * 1000
-/** GitHub's compare lists at most this many files: more and the relay leaves it to a folder. */
-const COMPARE_FILES = 300
-/** Kept for server.js's settings (an older clash task's assignee was handed on after this long); unused since Quilt merges on its own. */
-export const CLASH_IDLE_MS = 15 * 60 * 1000
-/** quilt_sync_branch asks GitHub at most this often per branch (Room.syncUpstreamNow). */
-export const SYNC_EVERY_MS = 60 * 1000
-/** The same through the relay's git mirror (GitHub as a node), where a look costs no API quota. */
-export const SYNC_EVERY_GIT_MS = 5 * 1000
-/** The most files the relay loads to start a branch from GitHub (loadBranch). */
-export const LOAD_FILES = 1000
-const API = 'https://api.github.com'
-const RAW = 'https://raw.githubusercontent.com'
-const SHA = /^[0-9a-f]{40,64}$/
-export const RELAY_ORIGIN = 'relay-upstream' // transaction origin: not a connection, so never guarded or undone
-const ORIGIN = RELAY_ORIGIN
-// GitHub's tokens: classic and fine-grained (ghp_, github_pat_), app installation (ghs_), and the newer
-// longer ones (an Actions run's GITHUB_TOKEN is a JWT: dots and dashes too). Never spaces or line breaks.
-const TOKEN = /^[A-Za-z0-9_.-]{20,2048}$/
-
-/** Whether `t` looks like a GitHub token (classic ghp_…, fine-grained github_pat_…, or the older bare kind). */
-export const validToken = (t) => typeof t === 'string' && TOKEN.test(t)
-
-/**
- * A git remote URL as host/owner/name, without any user name or password it carried:
- * { host, owner, name, github, slug } or null. https, ssh:// and scp-like git@host:owner/name.
- */
-export function parseRepo (url) {
-  if (typeof url !== 'string' || !url || url.length > 500) return null
-  let host, rest
-  const scp = /^[A-Za-z0-9._-]+@([A-Za-z0-9.-]+):(?!\/)(.+)$/.exec(url)
-  if (scp) { host = scp[1]; rest = scp[2] } else {
-    let u
-    try { u = new URL(url) } catch { return null }
-    if (!['https:', 'http:', 'ssh:', 'git:'].includes(u.protocol)) return null
-    host = u.hostname
-    rest = u.pathname.replace(/^\/+/, '')
-  }
-  const parts = rest.replace(/\/+$/, '').replace(/\.git$/, '').split('/')
-  if (parts.length !== 2 || !parts.every((p) => /^[A-Za-z0-9._-]+$/.test(p) && p !== '.' && p !== '..')) return host ? { host: host.toLowerCase(), owner: null, name: null, github: false, slug: host.toLowerCase() } : null
-  host = host.toLowerCase()
-  const github = host === 'github.com' || host === 'www.github.com'
-  return { host: github ? 'github.com' : host, owner: parts[0], name: parts[1], github, slug: `${github ? 'github.com' : host}/${parts[0]}/${parts[1]}` }
-}
-
-/** The branch on the remote an upstream like "origin/main" names ("main"), given the remote's name when known. */
-export function upstreamRef (name, remote = null) {
-  if (typeof name !== 'string' || !name.includes('/')) return null
-  const ref = remote && name.startsWith(`${remote}/`) ? name.slice(remote.length + 1) : name.slice(name.indexOf('/') + 1)
-  return ref && !ref.startsWith('/') && !ref.includes('..') && ref.length <= 200 ? ref : null
-}
-
-const plural = (k, w) => `${k} ${w}${k === 1 ? '' : 's'}`
-
-/** The room's record of each branch's upstream, as the relay keeps it (meta.upstreams, key -> record). */
-export function upstreamsOf (room) {
-  if (!room.meta.upstreams || typeof room.meta.upstreams !== 'object') room.meta.upstreams = {}
-  return room.meta.upstreams
-}
-
-/** Whether a member (its access on connection `ws`) may change every file: an approved editor with no folder limits, owner included. */
-export function editsAll (room, ws) {
-  if (!room.access || !room.access.get) return true // a stand-in room with no access (unit tests)
-  const a = room.access.get(ws)
-  return !!a && a.role !== 'viewer' && !(Array.isArray(a.scopes) && a.scopes.length) && !(Array.isArray(a.scopesExcept) && a.scopesExcept.length)
-}
-
-/**
- * What members' presence says about each branch's upstream, recorded per branch document:
- * the repository, the upstream branch, and the commit the session's files are (that commit plus
- * the session's work). Only a member who may change every file is trusted with it (a viewer or a
- * member limited to some folders could point the relay at another repository, or at a commit
- * whose files they were refused). Taken only from a folder that isn't behind, diverged, held or
- * clashing; one that is only ahead (commits not pushed yet) gives its upstream's tip, which
- * GitHub has. A newer commit replaces the recorded one only when that folder's git says it
- * descends from it (upstream.past); an older app, which doesn't say, never moves it backwards
- * past what the relay brought in. Returns whether anything changed (the caller saves and tells everyone).
- */
-export function noteFolders (room, log = () => {}) {
-  const recs = upstreamsOf(room)
-  const states = room.awareness.getStates()
-  let changed = false
-  const told = new Set() // branches a folder just said the repository of
-  for (const [ws, ids] of room.conns) {
-    const key = ws.branch
-    if (!key || !room.meta.branches[key] || !editsAll(room, ws)) continue
-    for (const id of ids) {
-      const g = states.get(id)?.git
-      if (!g || typeof g !== 'object' || typeof g.branch !== 'string') continue
-      // Mid-switch, a folder's git can be on another branch than the document its connection is on:
-      // its word then is about that other branch, never this record's.
-      if (key !== DEFAULT_KEY && typeof g.key === 'string' && g.key !== key && !(room.resolveKey && room.resolveKey(g.key) === room.resolveKey(key))) continue
-      const u = g.upstream && typeof g.upstream === 'object' ? g.upstream : null
-      const rec = recs[key] || {}
-      const next = { ...rec }
-      // A folder whose origin is this relay's git (relay-githttp.js, /git/<room>.git) says nothing about which repository the session follows.
-      const viaRelay = u && typeof u.url === 'string' && new RegExp(`/git/${room.name.replace(/[^A-Za-z0-9_-]/g, '')}\\.git/?$`).test(u.url)
-      if (u && typeof u.name === 'string' && !viaRelay) {
-        const repo = parseRepo(u.url)
-        const ref = upstreamRef(u.name, typeof u.remote === 'string' ? u.remote : null)
-        if (repo && ref) {
-          // A folder whose origin still names a repository's old name (renamed or moved on GitHub: relay-repo-moves.js) means the new one.
-          const slug = room.repoMoves ? room.repoMoves.resolve(repo.slug) : repo.slug
-          if (rec.repo && rec.repo !== slug) {
-            log(`[${room.name}] ${key}: the relay follows ${slug} now (was ${rec.repo}), as ${(room.names && room.names.get(ws)) || 'a member'}'s folder says`)
-            delete next.github // another repository: the GitHub connection is asked about again at once (noteConnections)
-          }
-          if (slug !== repo.slug) next.was = [...new Set([...(Array.isArray(next.was) ? next.was : []), repo.slug])].slice(-5)
-          next.repo = slug; next.name = u.name.slice(0, 200); next.ref = ref
-          told.add(key)
-        }
-      }
-      const head = typeof g.sha === 'string' && SHA.test(g.sha) ? g.sha : null
-      const tip = u && typeof u.sha === 'string' && SHA.test(u.sha) ? u.sha : null
-      // A newer app says which head its upstream's facts were found for (at): one that moved since is looked at again first.
-      const inStep = head && !g.held && u && !u.diverged && !(u.behind > 0) && !(u.conflicts > 0) && u.fetchOk !== false && (typeof u.at !== 'string' || u.at === head)
-      // The commit the session's files are at. A folder's head when it is on the upstream (a newer app
-      // says so: headPushed), else the upstream's tip, which GitHub has: a local commit not pushed yet
-      // (or dropped later) recorded here would be one nobody can descend from, and the record would never move again.
-      const local = !!u && (u.headPushed === false || u.ahead > 0)
-      const sha = !inStep ? null : local && tip ? tip : head
-      if (sha && sha !== rec.sha) {
-        const tells = 'past' in u // a newer app says whether its upstream descends from the recorded commit
-        // A fetched folder that doesn't have the recorded commit at all: the upstream never had it (a local
-        // commit of some folder, dropped since). Nobody can descend from it, so this folder's word stands.
-        // A commit the relay knows is GitHub's (it pushed it, brought it in, or measures the session from it) is GitHub's:
-        // a folder that hasn't fetched it yet says nothing about it.
-        const st = room.meta.sync && room.meta.sync[key]
-        const githubs = (rec.relayHead && rec.relayHead === rec.sha) || (st && (st.base === rec.sha || st.pushed === rec.sha))
-        const dead = tells && u.relayKnown === false && u.fetchOk !== false && !!tip && !githubs
-        const descends = !rec.sha || dead || (tells ? u.past === rec.sha : !rec.relayHead || sha === rec.relayHead || (tip && tip === rec.head))
-        if (dead) log(`[${room.name}] ${key}: ${String(rec.sha).slice(0, 7)} isn't on ${u.name}, as ${(room.names && room.names.get(ws)) || 'a member'}'s folder says; following its ${sha.slice(0, 7)}`)
-        if (descends) {
-          next.sha = sha
-          // The commit of GitHub's the folder is on, from the same report: what the session is measured from if `sha` turns out to be the folder's own (relay-sync.js).
-          if (tip) next.tip = tip; else delete next.tip
-          delete next.relayHead // folders are at or past what the relay brought in
-          if (rec.clash && rec.clash.sha === sha) delete next.clash // a folder landed that clash's merge
-        }
-      } else if (sha && sha === rec.relayHead) delete next.relayHead
-      if (JSON.stringify(next) !== JSON.stringify(rec)) { recs[key] = next; changed = true }
-    }
-  }
-  if (followMove(room, told, log)) changed = true
-  return changed
-}
-
-/**
- * A repository moved to another owner on GitHub (transferred): the default branch's folders say its
- * new name, and the session's other branches of it, with no folder on them to say, follow too
- * (an agent's old branch, say), their GitHub connection asked again. A folder's own word stands.
- */
-function followMove (room, told, log) {
-  const recs = upstreamsOf(room)
-  const main = (room.defaultKey && recs[room.defaultKey]) || recs[DEFAULT_KEY]
-  const to = main && main.repo
-  if (!to) return false
-  const [host, owner, name] = to.split('/')
-  let changed = false
-  for (const [key, rec] of Object.entries(recs)) {
-    if (!rec || !rec.repo || rec.repo === to || told.has(key)) continue
-    const [h, o, n] = rec.repo.split('/')
-    if (h !== host || !n || n.toLowerCase() !== String(name || '').toLowerCase() || o.toLowerCase() === String(owner || '').toLowerCase()) continue
-    log(`[${room.name}] ${key}: the relay follows ${to} now (was ${rec.repo}), as the default branch does`)
-    const next = { ...rec, repo: to }
-    delete next.github
-    recs[key] = next
-    changed = true
-  }
-  return changed
-}
-
-/** A hold this long (busy or settling, not switching branches) no longer keeps the relay out of a branch. */
-export const LONG_HOLD_MS = 30 * 60 * 1000
-
-/** Since when the relay has seen each connected folder held (kind and time, its own clock), kept up from presence. */
-export function noteHolds (room, now = Date.now()) {
-  if (!room.heldSince) room.heldSince = new WeakMap()
-  const states = room.awareness.getStates()
-  for (const [ws, ids] of room.conns) {
-    let held = null
-    for (const id of ids) { const g = states.get(id)?.git; if (g && typeof g === 'object' && g.held) held = String(g.held) }
-    const was = room.heldSince.get(ws)
-    if (!held) room.heldSince.delete(ws)
-    else if (!was || was.kind !== held) room.heldSince.set(ws, { kind: held, since: now })
-  }
-}
-
-/**
- * Whether a member's folder (its presence `g` on connection `ws`) keeps the relay out of its
- * branch: git on a branch with an upstream, its last fetch worked, and its member may change
- * files. A folder that is held (git at work: a pull, a merge being resolved, a branch switch) or
- * diverged still does: its own git is under way, and the relay writing into the branch would
- * collide with it. Only a hold the relay has seen for over 30 minutes (never a branch switch) lets it in.
- */
-export function canBringIn (room, ws, g, now = Date.now()) {
-  if (!g || typeof g !== 'object' || typeof g.branch !== 'string' || !g.branch) return false
-  const u = g.upstream && typeof g.upstream === 'object' ? g.upstream : null
-  if (!u || typeof u.name !== 'string' || !u.name || u.fetchOk === false) return false
-  const a = room.access && room.access.get ? room.access.get(ws) : null
-  if (a && a.role === 'viewer') return false
-  if (g.held && g.held !== 'switching') {
-    const h = room.heldSince && room.heldSince.get(ws)
-    if (h && now - h.since > LONG_HOLD_MS) return false
-  }
-  return true
-}
-
-/** Whether `name` (a member, or one of its AI sessions) is connected on branch `key`. */
-export function connectedAs (room, key, name) {
-  if (!name) return false
-  const states = room.awareness.getStates()
-  for (const [ws, ids] of room.conns) {
-    if (ws.branch !== key) continue
-    if (room.names && room.names.get(ws) === name) return true
-    for (const id of ids) for (const p of (states.get(id)?.personas || [])) if (p && p.name === name) return true
-  }
-  return false
-}
-
-/** The member whose folder on branch `key` brings commits in itself (canBringIn), or null. */
-export function folderAble (room, key) {
-  const states = room.awareness.getStates()
-  for (const [ws, ids] of room.conns) {
-    if (ws.branch !== key) continue
-    for (const id of ids) {
-      const st = states.get(id)
-      if (st && canBringIn(room, ws, st.git)) return (room.names && room.names.get(ws)) || st.name || 'a member'
-    }
-  }
-  return null
-}
-
-/** Whether a folder that can bring commits in is connected on branch `key` (then the relay leaves it to that folder). */
-export function folderOn (room, key) { return folderAble(room, key) !== null }
-
-/** What a folder waiting for another member to bring commits in says (session.js CATCHER_WAITING): not stuck. */
-const OLD_CATCHER_WAITING = 'another member is bringing these commits in'
-
-/**
- * The member whose folder on branch `key` brings GitHub's commits in itself even where the relay does (an app
- * older than 0.3.65, which doesn't say followsRelay), or null. The relay then leaves bringing commits in to it,
- * as before: both bringing in the same commit at once would share it twice (the session's document keeps both
- * copies of every change).
- */
-export function catcherAble (room, key) {
-  const states = room.awareness.getStates()
-  for (const [ws, ids] of room.conns) {
-    if (ws.branch !== key) continue
-    for (const id of ids) {
-      const st = states.get(id)
-      // Only one that can bring them in now: a folder diverged from GitHub (its own commits not pushed), stopped by
-      // a clash, or waiting on something of its own never brings them in, and the session would never get them.
-      const u = st && st.git && st.git.upstream
-      const stuck = !u || u.diverged || u.conflicts > 0 || (u.waiting && u.waiting !== OLD_CATCHER_WAITING)
-      if (st && st.git && st.git.followsRelay !== 1 && !stuck && canBringIn(room, ws, st.git)) return (room.names && room.names.get(ws)) || st.name || 'a member'
-    }
-  }
-  return null
-}
-
-/** Whether any member's app or CLI is connected on branch `key` (with or without git). */
-export function connectedOn (room, key) {
-  for (const ws of room.conns.keys()) if (ws.branch === key) return true
-  return false
-}
-
-/** Hosted agents on branch `key` right now: [{ id, name, seen, role, scopes, scopesExcept, chat? }], the most recently active first. */
-export function hostedOn (room, key) {
-  return room.hostedOnline()
-    .filter((h) => room.hostedBranch(h.id) === key)
-    .map((h) => ({ ...h, ...(room.meta.members[h.id] || {}), name: h.name, seen: h.seen }))
-    .sort((a, b) => b.seen - a.seen || (a.name < b.name ? -1 : 1))
-}
-
-/**
- * Whether the relay should look at branch `key` now: members work there (hosted agents now or in
- * the last 30 minutes, chat links, or apps and CLI agents connected on it) and no folder on it
- * can bring commits in itself (folderAble).
- */
-export function relayLooks (room, key, now = Date.now()) {
-  if (!room.exists || room.ended || !room.meta.branches[key]) return false
-  const rec = upstreamsOf(room)[key]
-  if (!rec || !rec.repo) return false
-  // GitHub as a node (relay-sync.js): the relay is the master node and brings commits in for every
-  // branch anyone is on; folders follow its commits (session.js memberAt) instead of pulling themselves.
-  // Except while an older app's folder there brings them in itself (catcherAble): then only files the relay holds
-  // (for a claim, or a clash) are looked at, as nobody else brings their change in.
-  const holds = !!(room.meta.sync && room.meta.sync[key] && (room.meta.sync[key].held || []).length)
-  if (room.cfg && room.cfg.gitSync && room.mirrors) return (holds || !catcherAble(room, key)) && (folderOn(room, key) || connectedOn(room, key) || hostedOn(room, key).length > 0 || now - (rec.hostedAt || 0) < HOSTED_RECENT_MS)
-  if (folderOn(room, key)) return false
-  return connectedOn(room, key) || hostedOn(room, key).length > 0 || now - (rec.hostedAt || 0) < HOSTED_RECENT_MS
-}
-
-/** The branches due a look (only `keys` when given): looked at by the relay, last checked `everyMs` ago or more, and not told to wait by GitHub. */
-export function dueBranches (room, { now = Date.now(), everyMs = UPSTREAM_CHECK_MS, keys = null } = {}) {
-  const recs = upstreamsOf(room)
-  return Object.keys(recs).filter((key) => (!keys || keys.includes(key)) && !recs[key].gone && relayLooks(room, key, now) && now - Math.max(recs[key].checkedAt || 0, recs[key].webhookAt || 0) >= everyMs && !(recs[key].backoffUntil > now))
-}
-
-/**
- * GitHub says repository `from` is now `to` (renamed, or moved to another owner): each branch of the
- * room that follows it follows `to`, remembers `from` (members' apps point their folders' origin at
- * the new name: Session.followRepoMove), and its GitHub connection is asked about again. Returns the
- * keys of the branches that moved.
- */
-export function applyRepoMove (room, from, to) {
-  const moved = []
-  for (const [key, rec] of Object.entries(upstreamsOf(room))) {
-    if (!rec || typeof rec.repo !== 'string' || rec.repo.toLowerCase() !== String(from).toLowerCase()) continue
-    rec.was = [...new Set([...(Array.isArray(rec.was) ? rec.was : []), rec.repo])].slice(-5)
-    rec.repo = to
-    delete rec.github
-    moved.push(key)
-  }
-  return moved
-}
-
-/** What members see of the relay's record in the branch list (never the token, an ETag or a URL with credentials). */
-export function relayEntry (rec) {
-  if (!rec || !rec.sha) return null
-  return {
-    sha: rec.sha,
-    // Whether agents can commit here through a member's GitHub connection (noteConnection): { state, login } or null (not asked yet).
-    github: rec.github ? { state: rec.github.state, login: rec.github.login || '' } : null,
-    upstream: rec.name || null,
-    repo: rec.repo || null,
-    // The repository's earlier names (it was renamed or moved): a folder whose origin is one of them points it at `repo`.
-    ...(Array.isArray(rec.was) && rec.was.length ? { was: rec.was } : {}),
-    checkedAt: rec.checkedAt || 0,
-    brought: rec.brought ? { count: rec.brought.count || 0, files: rec.brought.files || 0, at: rec.brought.at || 0 } : null,
-    problem: rec.problem || null,
-    clashTask: rec.clash ? rec.clash.task : null
-  }
-}
-
-/**
- * Asks whether a member's GitHub connection lets the relay write to the repository branch `key`
- * follows (relay-github.js), and keeps the answer on the record for the branch list: 'ok',
- * 'not-connected', 'not-installed', 'no-access' (with the login asked), or 'not-github'. `force`
- * forgets a remembered "no" first (someone just connected). Resolves whether it changed.
- */
-export async function noteConnection (room, key, { force = false } = {}) {
-  const rec = upstreamsOf(room)[key]
-  if (!rec || !rec.repo) return false
-  const repo = parseRepo(`https://${rec.repo}`)
-  const next = { at: Date.now() }
-  // Each check is numbered: one that started earlier and answers later (the API slow at the room's load) is old news.
-  if (!room.connectionChecks) room.connectionChecks = new Map()
-  const n = (room.connectionChecks.get(key) || 0) + 1
-  room.connectionChecks.set(key, n)
-  if (!repo || !repo.github) Object.assign(next, { state: 'not-github' })
-  else {
-    const full = `${repo.owner}/${repo.name}`
-    if (force && room.appTokens) for (const k of [...room.appTokens.keys()]) if (k.split('\0')[1] === full.toLowerCase() && !room.appTokens.get(k).token) room.appTokens.delete(k) // keys: access, repo, who it is for
-    const r = await appCredentials(room, full, { access: 'write', fresh: force })
-    Object.assign(next, r.token ? { state: 'ok', login: r.login || '' } : { state: r.state === 'off' ? 'not-connected' : r.state, login: r.login || '' })
-  }
-  if (room.connectionChecks.get(key) !== n) return false
-  const was = rec.github
-  rec.github = next
-  return !was || was.state !== next.state || (was.login || '') !== (next.login || '')
-}
-
-/** An HTTP failure from GitHub, with what the back-off needs. */
-class GitHubError extends Error {
-  constructor (status, headers, what) {
-    super(`GitHub answered ${status} for ${what}`)
-    this.status = status
-    this.headers = headers
-  }
-}
-
-// GitHub's API allows 60 requests an hour per IP without a token (5000 with one), shared by every
-// session on this relay: one budget for the whole process, kept under the limit with headroom, and
-// paused for everyone when GitHub says the limit is nearly spent. raw.githubusercontent.com isn't counted.
-const HOUR = 60 * 60 * 1000
-const HEADROOM = 10
-const budgets = new Map() // 'anon' | sha1(token) -> { used: [ts], pausedUntil }
-let anonPerHour = 50
-/** Sets how many API requests an hour the relay makes without a token (tests raise it). */
-export function configureGithubBudget ({ anonPerHour: n } = {}) { if (Number.isFinite(n) && n > 0) anonPerHour = n }
-/** Forgets what was spent (tests). */
-export function resetGithubBudgets () { budgets.clear() }
-function budgetOf (token) {
-  const k = token ? sha1(Buffer.from(token, 'utf8')) : 'anon'
-  if (!budgets.has(k)) budgets.set(k, { used: [], pausedUntil: 0 })
-  return budgets.get(k)
-}
-/** Spends one API request, or throws a 429-like GitHubError saying how long to wait. */
-function spend (token, now = Date.now()) {
-  const b = budgetOf(token)
-  const wait = (until) => new GitHubError(429, new Headers({ 'retry-after': String(Math.max(1, Math.ceil((until - now) / 1000))) }), 'the relay\'s own GitHub budget')
-  if (b.pausedUntil > now) throw wait(b.pausedUntil)
-  while (b.used.length && b.used[0] <= now - HOUR) b.used.shift()
-  if (!token && b.used.length >= anonPerHour) { b.pausedUntil = b.used[0] + HOUR; throw wait(b.pausedUntil) }
-  b.used.push(now)
-}
-/** What GitHub said is left: nearly spent pauses every room until its reset. */
-function heard (token, headers) {
-  const rem = Number(headers && headers.get && headers.get('x-ratelimit-remaining'))
-  const reset = Number(headers && headers.get && headers.get('x-ratelimit-reset'))
-  if (headers && headers.get && headers.get('x-ratelimit-remaining') !== null && Number.isFinite(rem) && rem <= HEADROOM && Number.isFinite(reset)) budgetOf(token).pausedUntil = reset * 1000
-}
-/** A 403 or 429 that is GitHub's rate limit (back off), not a refusal to read (no access). */
-const rateLimited = (err) => err.status === 429 || (err.status === 403 && !!err.headers && !!err.headers.get && (err.headers.get('x-ratelimit-remaining') === '0' || err.headers.get('retry-after') !== null))
-
-/** The few GitHub calls the relay makes, read only. The token (when set) goes in a header, never a URL. */
-function github ({ fetch, token, owner, name }) {
-  const auth = token ? { authorization: `Bearer ${token}` } : {}
-  const base = { 'user-agent': 'quilt-relay', 'x-github-api-version': '2022-11-28', ...auth }
-  const enc = (p) => p.split('/').map(encodeURIComponent).join('/')
-  const get = async (url, headers, what) => {
-    spend(token)
-    const res = await fetch(url, { headers: { ...base, ...headers }, redirect: 'follow' })
-    heard(token, res.headers)
-    if (res.status === 304) return { res, notModified: true }
-    if (!res.ok) throw new GitHubError(res.status, res.headers, what)
-    return { res }
-  }
-  return {
-    /** The ref's head commit, conditional on the ETag from last time: { sha, etag } (sha null: unchanged). */
-    async head (ref, etag) {
-      const { res, notModified } = await get(`${API}/repos/${owner}/${name}/commits/${enc(ref)}`, { accept: 'application/vnd.github.sha', ...(etag ? { 'if-none-match': etag } : {}) }, `${owner}/${name} ${ref}`)
-      if (notModified) return { sha: null, etag }
-      const sha = (await res.text()).trim()
-      if (!SHA.test(sha)) throw new Error(`GitHub gave no commit for ${ref}`)
-      return { sha, etag: res.headers.get('etag') || null }
-    },
-    /** The repository itself: whether it can be read at all (a 404 on a branch: no such branch, or no access). */
-    async repo () {
-      const { res } = await get(`${API}/repos/${owner}/${name}`, { accept: 'application/vnd.github+json' }, `${owner}/${name}`)
-      return res.json()
-    },
-    /** Every file at a commit: { tree: [{ path, type, mode, size }], truncated }. */
-    async tree (sha) {
-      const { res } = await get(`${API}/repos/${owner}/${name}/git/trees/${sha}?recursive=1`, { accept: 'application/vnd.github+json' }, `${owner}/${name} tree`)
-      return res.json()
-    },
-    async compare (base, head) {
-      const { res } = await get(`${API}/repos/${owner}/${name}/compare/${base}...${head}`, { accept: 'application/vnd.github+json' }, `${owner}/${name} compare`)
-      return res.json()
-    },
-    /** The latest merged pull request from branch `ref` of this repository: { number, mergedAt, base, sha } or null. */
-    async mergedPull (ref) {
-      const { res } = await get(`${API}/repos/${owner}/${name}/pulls?state=closed&per_page=20&head=${encodeURIComponent(`${owner}:${ref}`)}`, { accept: 'application/vnd.github+json' }, `${owner}/${name} pull requests`)
-      const list = await res.json()
-      const merged = (Array.isArray(list) ? list : []).filter((p) => p && p.merged_at && p.head && p.head.ref === ref)
-        .map((p) => ({ number: p.number, mergedAt: Date.parse(p.merged_at) || 0, base: p.base && p.base.ref, sha: p.merge_commit_sha || null }))
-        .sort((a, b) => b.mergedAt - a.mergedAt)
-      return merged[0] || null
-    },
-    /** When commit `sha` was made: ms since 1970 (its committer's date). */
-    async committedAt (sha) {
-      const { res } = await get(`${API}/repos/${owner}/${name}/commits/${sha}`, { accept: 'application/vnd.github+json' }, `${owner}/${name} commit`)
-      const c = await res.json()
-      return Date.parse(c && c.commit && c.commit.committer && c.commit.committer.date) || 0
-    },
-    /** A file at a commit: its bytes, null when it isn't there, or { tooLarge } past `max` bytes. */
-    async file (sha, path, max) {
-      const url = token ? `${API}/repos/${owner}/${name}/contents/${enc(path)}?ref=${sha}` : `${RAW}/${owner}/${name}/${sha}/${enc(path)}`
-      if (token) spend(token)
-      const res = await fetch(url, { headers: { ...base, accept: 'application/vnd.github.raw' }, redirect: 'follow' })
-      if (token) heard(token, res.headers)
-      if (res.status === 404) return null
-      if (!res.ok) throw new GitHubError(res.status, res.headers, `${path} at ${sha.slice(0, 7)}`)
-      const len = Number(res.headers.get('content-length'))
-      if (Number.isFinite(len) && len > max) return { tooLarge: true }
-      const buf = Buffer.from(await res.arrayBuffer())
-      return buf.length > max ? { tooLarge: true } : buf
-    }
-  }
-}
-
-/**
- * A GitHub reader for the session's repository `repoStr` ('github.com/owner/name'), signed in the way
- * checkBranch is (the owner's token, the session's GitHub connection, else `fallbackToken`), or null
- * when it isn't on GitHub. Has compare(base, head), committedAt(sha) and mergedPull(ref) (which needs
- * `access` 'write': the app's read token can't see pull requests).
- */
-export async function githubReader (room, repoStr, { fetch, fallbackToken = null, access = 'read' } = {}) {
-  const repo = parseRepo(`https://${repoStr}`)
-  if (!repo || !repo.github) return null
-  const own = validToken(room.meta.githubToken) ? room.meta.githubToken : ((await appCredentials(room, `${repo.owner}/${repo.name}`, { access, fresh: false })).token || null)
-  return github({ fetch, token: own || (validToken(fallbackToken) ? fallbackToken : null), owner: repo.owner, name: repo.name })
-}
-
-/** How long GitHub asked to wait: Retry-After, the rate limit's reset, or twice the last wait. */
-export function backoffFor (err, rec, now = Date.now()) {
-  const h = err.headers
-  const after = Number(h && h.get && h.get('retry-after'))
-  if (Number.isFinite(after) && after > 0) return Math.min(after * 1000, MAX_BACKOFF_MS)
-  const reset = Number(h && h.get && h.get('x-ratelimit-reset'))
-  if (h && h.get && h.get('x-ratelimit-remaining') === '0' && Number.isFinite(reset) && reset * 1000 > now) return Math.min(reset * 1000 - now + 1000, MAX_BACKOFF_MS)
-  return Math.min(Math.max((rec.backoffMs || 0) * 2, FIRST_BACKOFF_MS), MAX_BACKOFF_MS)
-}
-
-/** A file in the branch document as planCatchUp keys it: text, "bin:<sha1>", null when absent, undefined for a stored large file. */
-export function docKey (e, rel) {
-  const t = e.files.get(rel)
-  if (t) return t.toString()
-  const b = e.blobs.get(rel)
-  if (b) return b.stored ? undefined : `bin:${b.hash}`
-  return null
-}
-
-export const fingerprint = (k) => k === null ? 'none' : k === undefined ? 'unread' : sha1(Buffer.from(k, 'utf8'))
-export const hasMarkers = (k) => typeof k === 'string' && !k.startsWith('bin:') && k.split('\n').some((l) => /^(<{7}|>{7})( |$)/.test(l))
-
-const IGNORE_NAMES = ['.gitignore', '.quiltignore', '.cowoveignore']
-const isIgnoreFile = (rel) => IGNORE_NAMES.some((n) => rel === n || rel.endsWith(`/${n}`))
-const dirOf = (rel) => rel.includes('/') ? rel.slice(0, rel.lastIndexOf('/')) : ''
-
-/**
- * What the session doesn't sync: Quilt's built-ins, the project's .gitignore files as the branch
- * document has them, and `extra`: [[path, text]] of ignore files read from the commit itself. A
- * .quiltignore never syncs (it is a built-in ignore), so a committed one is read from GitHub.
- */
-export function ignoreOf (e, extra = []) {
-  const texts = []
-  for (const [rel, t] of e ? e.files : []) if (isIgnoreFile(rel)) texts.push(scopeIgnore(t.toString(), dirOf(rel)))
-  for (const [rel, t] of extra) if (typeof t === 'string') texts.push(scopeIgnore(t, dirOf(rel)))
-  return makeIgnore(texts)
-}
-
-/** The .quiltignore a commit has at its root, and any other .quiltignore the change list names: [[path, text]]. */
-async function quiltignoresAt (gh, sha, list) {
-  const paths = new Set(['.quiltignore'])
-  for (const f of list) if (f && typeof f.filename === 'string' && /(^|\/)\.(quilt|cowove)ignore$/.test(f.filename) && isSafeRelPath(f.filename)) paths.add(f.filename)
-  const out = []
-  for (const rel of paths) {
-    const r = await gh.file(sha, rel, 64 * 1024)
-    if (r && !r.tooLarge) out.push([rel, r.toString('utf8')])
-  }
-  return out
-}
-
-/**
- * One look at branch `key` (the caller checked relayLooks). Asks GitHub for the upstream's
- * head; when it is strictly ahead of the recorded commit, reads every changed file at both
- * ends and merges them into the branch document, combining what both sides changed (the
- * newer edit keeps the lines both changed: the newest compared commit's time against the
- * session's last edit of the file). Returns what happened: { state, ... } for tests and the
- * log. Never throws.
- */
-export async function checkBranch (room, key, { fetch, now = () => Date.now(), log = () => {}, fallbackToken = null } = {}) {
-  const recs = upstreamsOf(room)
-  const rec = recs[key]
-  if (!rec || !rec.repo || !rec.ref || !rec.sha) return { state: 'unknown' }
-  const started = now()
-  rec.checkedAt = started
-  const said = (problem) => {
-    if (problem && rec.problem !== problem) log(`[${room.name}] ${key}: ${problem}`)
-    if (problem) rec.problem = problem; else delete rec.problem
-  }
-  const done = (out) => { if (!room.destroyed) { room.saveMeta(); room.broadcastBranches() } return out }
-  const repo = parseRepo(`https://${rec.repo}`)
-  if (!repo || !repo.github) { said(`the relay only brings in commits from GitHub, and ${rec.repo.split('/')[0]} isn't GitHub: a member's folder on ${key} brings them in`); return done({ state: 'not-github' }) }
-  // The owner's token, else the relay's own (public repositories only), else none.
-  // The owner's token, or the owner's GitHub connection (relay-github.js): either reads a private repository.
-  const own = validToken(room.meta.githubToken) ? room.meta.githubToken : ((await appCredentials(room, `${repo.owner}/${repo.name}`, { access: 'read', fresh: false })).token || null)
-  const token = own || (validToken(fallbackToken) ? fallbackToken : null)
-  const gh = github({ fetch, token, owner: repo.owner, name: repo.name })
-  const base = rec.sha
-  let head, cmp
-  const files = new Map() // path -> { base, head } as planCatchUp keys them, with binaries' bytes
-  const bins = new Map() // "bin:<sha1>" -> bytes
-  const tooLarge = new Set()
-  try {
-    const h = await gh.head(rec.ref, rec.head ? rec.etag : null)
-    head = h.sha || rec.head
-    rec.head = head
-    rec.etag = h.etag
-    delete rec.backoffMs
-    delete rec.backoffUntil
-    if (!head) return done({ state: 'unknown' })
-    if (head === base) {
-      said(null)
-      closeLanded(room, key, rec, `Brought in at ${head.slice(0, 7)}: the session on ${key} is at ${rec.name} ${head.slice(0, 7)}.`)
-      return done({ state: 'up-to-date', head })
-    }
-    cmp = await gh.compare(base, head)
-    if (cmp.status !== 'ahead') {
-      said(cmp.status === 'diverged'
-        ? `${rec.name} was rewritten or moved apart from ${base.slice(0, 7)} (the session's commit on ${key}): a member's folder on ${key} has to bring it in`
-        : null)
-      return done({ state: cmp.status || 'unknown', head })
-    }
-    const list = Array.isArray(cmp.files) ? cmp.files : []
-    if (list.length >= COMPARE_FILES) {
-      said(`${rec.name} changed ${COMPARE_FILES} files or more since ${base.slice(0, 7)}: too many for the relay; a member's folder on ${key} brings them in`)
-      return done({ state: 'too-many', head })
-    }
-    const e = room.branchDoc(key)
-    // A diff branch (branch-view.js) is brought in through the relay's git mirror only (relay-sync.js), never over REST.
-    if (isDiff(e)) { said(null); return done({ state: 'mirror-only', head }) }
-    const ig = ignoreOf(e, await quiltignoresAt(gh, head, list))
-    const want = (rel) => typeof rel === 'string' && isSafeRelPath(rel) && !isIgnored(ig, rel)
-    const changes = new Map()
-    for (const f of list) {
-      if (!f || typeof f.filename !== 'string') continue
-      const st = f.status
-      if (st === 'renamed' && typeof f.previous_filename === 'string') {
-        if (want(f.previous_filename)) changes.set(f.previous_filename, 'D')
-        if (want(f.filename)) changes.set(f.filename, 'A')
-      } else if (want(f.filename)) changes.set(f.filename, st === 'added' || st === 'copied' ? 'A' : st === 'removed' ? 'D' : 'M')
-    }
-    const read = async (sha, rel) => {
-      const r = await gh.file(sha, rel, MAX_TEXT_BYTES)
-      if (r === null) return null
-      if (r.tooLarge) { tooLarge.add(rel); return undefined }
-      if (looksBinary(r)) {
-        if (r.length > LARGE_FILE_BYTES) { tooLarge.add(rel); return undefined }
-        const k = `bin:${sha1(r)}`
-        bins.set(k, r)
-        return k
-      }
-      return r.toString('utf8')
-    }
-    const all = [...changes]
-    for (let i = 0; i < all.length; i += 8) {
-      await Promise.all(all.slice(i, i + 8).map(async ([rel, kind]) => {
-        const [b, t] = await Promise.all([kind === 'A' ? null : read(base, rel), kind === 'D' ? null : read(head, rel)])
-        files.set(rel, { base: b, head: t, kind })
-      }))
-    }
-  } catch (err) {
-    if (err instanceof GitHubError && rateLimited(err)) {
-      const wait = backoffFor(err, rec, now())
-      rec.backoffMs = wait
-      rec.backoffUntil = now() + wait
-      said(`GitHub asked the relay to slow down; it looks at ${rec.name} again after ${new Date(rec.backoffUntil).toISOString().slice(11, 16)} UTC`)
-      return done({ state: 'backoff', wait })
-    }
-    if (err instanceof GitHubError && (err.status === 404 || err.status === 401 || err.status === 403)) {
-      // A public repository answers this without a token: then the commit or branch is what's missing, not access.
-      let open = false
-      try { await github({ fetch, token: null, owner: repo.owner, name: repo.name }).repo(); open = true } catch {}
-      if (open) {
-        if (head && head !== base) {
-          // The branch is there but the recorded commit isn't: a folder's local commit that was never
-          // pushed (and may be gone). Nobody can descend from it, so the record would never move:
-          // follow the branch's head instead. Nothing is brought in from a commit the relay can't
-          // read; the session's files stay as they are, and folders bring real changes in as always.
-          rec.sha = head
-          delete rec.relayHead
-          rec.recoveredAt = now()
-          said(null) // healed: nothing to show members
-          log(`[${room.name}] ${key}: ${base.slice(0, 7)} (the commit the session's files were measured from) isn't on GitHub; following ${rec.name} at ${head.slice(0, 7)} now`)
-          return done({ state: 'recovered', head })
-        }
-        if (!head && key !== room.resolveKey?.(DEFAULT_KEY) && key !== room.defaultKey) {
-          // The branch itself is gone from GitHub (deleted after its merge, as an agent's branch is): nothing more to bring in.
-          // The branch stays in the session; a folder that reports it again (recreated) brings the record back (noteFolders).
-          rec.gone = now()
-          said(`${rec.name} isn't on GitHub any more (deleted after its merge?): nothing more comes in; the branch stays in the session as it is`)
-          return done({ state: 'gone' })
-        }
-        said(`${rec.name} or ${base.slice(0, 7)} (the commit the session's files on ${key} are at) isn't on GitHub (not pushed yet, or the branch is gone): the relay waits for a member's folder on ${key} at a pushed commit`)
-        return done({ state: 'not-on-github' })
-      }
-      said(own ? tokenRefused(rec.repo) : noToken(rec.repo))
-      return done({ state: own ? 'token-refused' : 'private' })
-    }
-    said(`the relay couldn't reach GitHub for ${rec.name} (${String(err.message).slice(0, 120)}); it tries again later`)
-    return done({ state: 'error' })
-  }
-  // Everything is read: from here on nothing waits, so the document can't change under the plan.
-  if (room.ended || room.destroyed || !room.meta.branches[key] || recs[key] !== rec || rec.sha !== base || folderOn(room, key)) return done({ state: 'moved-on' })
-  const e = room.branchDoc(key)
-  const behind = Number.isFinite(cmp.ahead_by) ? cmp.ahead_by : Number.isFinite(cmp.total_commits) ? cmp.total_commits : 0
-  const changes = new Map([...files].map(([rel, f]) => [rel, f.kind]))
-  const baseMap = new Map([...files].map(([rel, f]) => [rel, f.base]))
-  const theirs = new Map([...files].map(([rel, f]) => [rel, f.head]))
-  const disk = (rel) => docKey(e, rel)
-  // Which edit is newer, for the lines both sides changed: the session's last edit of the file against GitHub's newest commit here.
-  const commits = Array.isArray(cmp.commits) ? cmp.commits : []
-  const newest = commits.at(-1) || null
-  const ghAt = newest && newest.commit ? Date.parse((newest.commit.committer && newest.commit.committer.date) || (newest.commit.author && newest.commit.author.date) || '') || 0 : 0
-  const ghSide = newest ? { name: (newest.commit && newest.commit.author && newest.commit.author.name) || (newest.author && newest.author.login) || rec.name, sha: newest.sha || head, ts: ghAt } : null
-  const parties = new Map()
-  const partyOf = (rel) => { if (!parties.has(rel)) parties.set(rel, lastEditor(e, rel)); return parties.get(rel) }
-  const oursNewer = (rel) => ((partyOf(rel) || {}).ts || 0) > ghAt + 999 // a commit's whole second is its own
-  const union = unionOf(e)
-  const plan = planCatchUp({ changes, base: baseMap, theirs, disk, published: publishedOf(room.doc), oursNewer, union })
-  if (plan.conflicts.length) {
-    // Files the relay can't read (too large for it): nothing comes in until a member's folder brings them in (all or nothing: one commit is recorded).
-    const list = plan.conflicts.map((c) => c.path)
-    said(`${rec.name} changes ${list.slice(0, 4).join(', ')}${list.length > 4 ? ' and more' : ''}, too large for the relay to read: a member's folder on ${key} brings ${list.length === 1 ? 'it' : 'them'} in`)
-    return done({ state: 'too-large', head, files: list })
-  }
-  // A file someone holds is never written under them (as a folder's bring-in waits, Session.bringIn):
-  // only the clash's files, held for its merge. The bring-in waits until they let go of it.
-  for (const rel of plan.writes.keys()) {
-    const c = room.claimFor ? room.claimFor(rel, key) : null
-    if (c) {
-      said(`${c.by} holds ${rel}${c.pattern && c.pattern !== rel ? ` (their claim on ${c.pattern})` : ''}: the relay brings ${rec.name} in once they let go of it (quilt release ${c.pattern || rel}, or quilt_handoff)`)
-      rec.waitingOn = { path: rel, by: c.by, pattern: c.pattern } // looked at again as soon as that claim goes (Room.noteClaimsChanged)
-      return done({ state: 'waiting', head, held: rel, by: c.by })
-    }
-  }
-  delete rec.waitingOn
-  // Clean: the whole bring-in in one transaction from the relay, with one line in the activity log.
-  const history = e.historyLog || (e.historyLog = new HistoryLog(e.doc, e.doc.getArray('history'), { origin: ORIGIN }))
-  let written = 0
-  e.doc.transact(() => {
-    for (const [rel, k] of plan.writes) {
-      const before = e.files.get(rel)?.toString()
-      const existed = e.files.has(rel) || e.blobs.has(rel)
-      if (k === null) {
-        e.files.delete(rel)
-        e.blobs.delete(rel)
-        history.record({ by: RELAY_BY, path: rel, kind: 'deleted', before, after: '', pulled: true })
-      } else if (k.startsWith('bin:')) {
-        const buf = bins.get(k)
-        e.files.delete(rel)
-        e.blobs.set(rel, { hash: k.slice(4), data: buf.toString('base64') })
-        history.record({ by: RELAY_BY, path: rel, kind: existed ? 'edited' : 'created', detail: `${buf.length} bytes`, pulled: true })
-      } else {
-        e.blobs.delete(rel)
-        let y = e.files.get(rel)
-        if (!y) { y = new Y.Text(); e.files.set(rel, y) }
-        applyTextDiff(y, k)
-        history.record({ by: RELAY_BY, path: rel, kind: existed ? 'edited' : 'created', before: before ?? '', after: k, pulled: true })
-      }
-      written++
-    }
-  }, ORIGIN)
-  const detail = `${plural(behind, 'commit')} from ${rec.name} · ${plural(written, 'file')}`
-  room.doc.transact(() => {
-    room.activity.push([{ by: RELAY_BY, path: '', kind: 'brought', detail, branch: key, ts: now() }])
-    if (room.activity.length > 300) room.activity.delete(0, room.activity.length - 300)
-  }, ORIGIN)
-  log(`[${room.name}] ${key}: ${RELAY_BY} brought in ${detail} (${base.slice(0, 7)}..${head.slice(0, 7)}; no folder on it is online)`)
-  rec.sha = head
-  rec.relayHead = head
-  rec.brought = { count: behind, files: written, at: now(), head }
-  // Whoever's lines lost is told: a direct message for the session's, the activity log for GitHub's (relay-clash.js).
-  const { tellAutoMerge } = await import('./relay-clash.js')
-  for (const m of plan.merged) tellAutoMerge(room, key, { path: m.path, lost: m.lost, deleted: m.deleted || null, session: partyOf(m.path), github: ghSide, upstream: rec.name, head, now: now() })
-  said(null)
-  closeLanded(room, key, rec, `Brought in at ${head.slice(0, 7)}: ${RELAY_BY} merged ${plural(behind, 'commit')} from ${rec.name} into ${key}.`)
-  return done({ state: 'brought', head, count: behind, files: written, merged: plan.merged.map((m) => ({ path: m.path, lost: m.lost.length ? m.lost[0].side : null, ...(m.deleted ? { deleted: m.deleted } : {}) })) })
-}
-
-/** The relay's clash task on `key` is done: the session is at or past its commit. */
-export function closeLanded (room, key, rec, verified) {
-  if (!rec.clash) return
-  const t = readTasks(room.tasks).find((x) => x.id === rec.clash.task)
-  if (t && t.column !== 'done') {
-    try { updateTask(room.doc, room.tasks, { id: t.id, column: 'done', verified }, ORIGIN) } catch {}
-  }
-  delete rec.clash
-}
-
-/** The member who last changed `rel` on a branch document (not the relay, not a pull): { name, ts }, or null. */
-function lastEditor (e, rel) {
-  let best = null
-  for (const h of e.doc.getArray('history').toArray()) if (h && h.path === rel && !h.pulled && !h.seed && h.by && !isRelay(h.by) && (!best || (h.ts || 0) >= best.ts)) best = { name: h.by, ts: h.ts || 0 }
-  return best
-}
-
-/** The merge=union matcher from the session's .gitattributes files. */
-function unionOf (e) {
-  const texts = []
-  for (const [rel, t] of e.files) if (rel === '.gitattributes' || rel.endsWith('/.gitattributes')) texts.push([rel.includes('/') ? rel.slice(0, rel.lastIndexOf('/')) : '', t.toString()])
-  return unionMatcher(texts)
-}
-
-/** What a hosted agent (or a member's AI) is told when the relay can't read a private repository. */
-export const noToken = (repo) => `the relay can't read ${repo}: ask the session owner to add a read-only GitHub token (session settings, or quilt_github_token)`
-export const tokenRefused = (repo) => `the relay's GitHub token can't read ${repo}: ask the session owner to give it read access to that repository's contents (session settings, or quilt_github_token)`
-
-const ago = (ts, now = Date.now()) => {
-  const s = Math.max(0, Math.round((now - ts) / 1000))
-  return s < 60 ? `${s}s ago` : s < 3600 ? `${Math.round(s / 60)}m ago` : `${Math.round(s / 3600)}h ago`
-}
-
-/**
- * What one look at branch `key` (checkBranch's result `r`) means, for an AI that asked for it
- * (quilt_sync_branch): in the words describeBranchSync uses for a folder.
- */
-export function describeRelayCheck (r, rec, key, room = null) {
-  const up = (rec && rec.name) || 'its upstream'
-  if (!r) return `The relay didn't look at ${up} for \`${key}\`.`
-  if (r.state === 'brought') {
-    const lost = (r.merged || []).filter((m) => m.lost)
-    return `Brought ${plural(r.count, 'commit')} from ${up} into \`${key}\` (${plural(r.files, 'file')}), merged with the session's uncommitted work${lost.length ? `; where both changed the same lines of ${lost.map((m) => m.path).slice(0, 4).join(', ')}, the newer edit was kept (the other lines are in the file's history)` : ''}. \`${key}\` is up to date with ${up} (${r.head.slice(0, 7)}).`
-  }
-  if (r.state === 'up-to-date') return `\`${key}\`: up to date with ${up} (${r.head.slice(0, 7)}).`
-  if (r.state === 'too-large') return `Nothing brought in yet: ${up} (${r.head.slice(0, 7)}) changes ${(r.files || []).join(', ')}, too large for the relay to read; a member's folder on \`${key}\` brings ${(r.files || []).length === 1 ? 'it' : 'them'} in. Nothing to merge by hand.`
-  if (r.state === 'moved-on') return `A folder on \`${key}\` that brings commits in itself came online, so the relay left it to that folder.`
-  if (r.state === 'recovered') return `The commit the session's files on \`${key}\` were measured from wasn't on GitHub (a folder's local commit, since dropped); the relay follows ${up} at ${r.head.slice(0, 7)} now. Nothing to bring in from a commit it can't read; the session's files stay as they are.`
-  if (r.state === 'gone') return `Nothing brought in: ${up} isn't on GitHub any more (deleted after its merge?). \`${key}\` stays in the session as it is.`
-  if (rec && rec.problem) return `Nothing brought in: ${rec.problem}.`
-  return `The relay couldn't tell where ${up} is now; it looks again by itself.`
-}
-
-/**
- * The files of `ref` on GitHub at its head, for starting a session branch from it (a hosted
- * agent's quilt_switch_branch). Ignored paths (built-ins, the commit's .gitignore and
- * .quiltignore files) and unsafe ones are left out, and so are files too large for the relay.
- * Returns { state: 'loaded', head, texts: Map, blobs: Map, skipped: [path], bytes } or
- * { state: 'no-branch' | 'private' | 'token-refused' | 'too-many' | 'backoff' | 'error', ... }.
- */
-export async function loadBranch ({ repo, ref, token = null, fetch, maxFiles = LOAD_FILES }) {
-  const r = parseRepo(`https://${repo}`)
-  if (!r || !r.github) return { state: 'not-github' }
-  const gh = github({ fetch, token, owner: r.owner, name: r.name })
-  try {
-    let head
-    try { head = (await gh.head(ref)).sha } catch (err) {
-      if (!(err instanceof GitHubError) || (err.status !== 404 && err.status !== 422)) throw err
-      try { await gh.repo() } catch (e2) {
-        if (e2 instanceof GitHubError && (e2.status === 404 || e2.status === 401)) return { state: token ? 'token-refused' : 'private' }
-        throw e2
-      }
-      return { state: 'no-branch' }
-    }
-    const tree = await gh.tree(head)
-    const all = (Array.isArray(tree.tree) ? tree.tree : []).filter((x) => x && x.type === 'blob' && typeof x.path === 'string' && x.mode !== '120000' && isSafeRelPath(x.path))
-    if (tree.truncated || all.length > maxFiles) return { state: 'too-many', head, count: all.length }
-    const ignores = []
-    for (const x of all) {
-      if (!isIgnoreFile(x.path)) continue
-      const b = await gh.file(head, x.path, 64 * 1024)
-      if (b && !b.tooLarge) ignores.push([x.path, b.toString('utf8')])
-    }
-    const ig = ignoreOf(null, ignores)
-    const wanted = all.filter((x) => !isIgnored(ig, x.path))
-    const texts = new Map()
-    const blobs = new Map()
-    const skipped = []
-    let bytes = 0
-    for (let i = 0; i < wanted.length; i += 8) {
-      await Promise.all(wanted.slice(i, i + 8).map(async (x) => {
-        if (Number.isFinite(x.size) && x.size > MAX_TEXT_BYTES) { skipped.push(x.path); return }
-        const buf = await gh.file(head, x.path, MAX_TEXT_BYTES)
-        if (!buf) return
-        if (buf.tooLarge) { skipped.push(x.path); return }
-        if (looksBinary(buf)) {
-          if (buf.length > LARGE_FILE_BYTES) { skipped.push(x.path); return }
-          blobs.set(x.path, { hash: sha1(buf), data: buf.toString('base64') })
-        } else texts.set(x.path, buf.toString('utf8'))
-        bytes += buf.length
-      }))
-    }
-    return { state: 'loaded', head, texts, blobs, skipped: skipped.sort(), bytes }
-  } catch (err) {
-    if (err instanceof GitHubError && rateLimited(err)) return { state: 'backoff' }
-    if (err instanceof GitHubError && (err.status === 404 || err.status === 401 || err.status === 403)) return { state: token ? 'token-refused' : 'private' }
-    return { state: 'error', message: String(err.message).slice(0, 160) }
-  }
-}