gitpane 1.0.0__py3-none-any.whl

gitpane/controller/clone_controller.py

@@ -0,0 +1,776 @@
+"""Clone a repository from the welcome window, submodules included."""
+
+from __future__ import annotations
+
+from dataclasses import replace
+from typing import TYPE_CHECKING
+
+from PySide6.QtCore import QObject, Signal
+from shiboken6 import isValid
+
+from gitpane.account.account_choice import clone_account_row
+from gitpane.account.address_owner import address_owner, owner_account_namespace
+from gitpane.account.authentication import check_repository_url, endpoint_origin, transfer_account
+from gitpane.config import AUTHENTICATION_PREFERENCE_KEY, ConsoleOperation
+from gitpane.operation.console_tone import ConsoleTone
+from gitpane.operation.diagnostic import Diagnostic
+from gitpane.operation.operation_status import OperationStatus
+from gitpane.transport.clone import BARE_CLONE_DONE_TEXT, CloneIntent, clipboard_local_repository_candidate, clipboard_repository_url
+from gitpane.transport.git_refusal import authentication_refused
+from gitpane.transport.refusal_notice import CLONE_NOTICE_SUBJECT_TEXT, SUBMODULE_NOTICE_SUBJECT_TEXT, account_notice, failure_headline, failure_summary
+from gitpane.ui.console.operation_dialog import OperationDialog
+from gitpane.ui.setting.account_page import fill_repository_combo
+from gitpane.ui.setting.add_account_dialog import AddAccountDialog, sign_in_result_text
+from gitpane.ui.transport.clone_dialog import CLONE_CANCELLED_PRESERVED_TEXT, CLONE_CANCELLED_TEXT, OPENING_CANCELLED_TEXT, CloneDialog, CloneDialogText
+from gitpane.ui.widget.result_label import ResultTone
+from gitpane.ui.window_control.dialog_modality import open_window_modal
+
+if TYPE_CHECKING:
+    from collections.abc import Callable
+
+    from PySide6.QtWidgets import QApplication, QWidget
+
+    from gitpane.account.account_choice import CloneAccountRow
+    from gitpane.account.authentication import AccountSelection, AuthenticationService, AuthOutcome, SecretLookup
+    from gitpane.controller.account_controller import AccountController
+    from gitpane.controller.operation_policy import OperationPolicy
+    from gitpane.controller.session_registry import SessionRegistry
+    from gitpane.history.repository import GitRepository
+    from gitpane.operation.diagnostic import DiagnosticLog, PreparedDiagnostic
+    from gitpane.preference.preference_store import PreferenceStore
+    from gitpane.transport.clone import BranchList, CloneRun, CloneService
+    from gitpane.transport.refusal_notice import TransferAccount
+
+# Title of the operation console a clone opens as soon as it starts, the same console Fetch and Push use.
+CLONE_CONSOLE_TITLE = "Clone repository output"
+
+
+class CloneController(QObject):
+    """The clone form of each welcome window with its console, its sign-in window and its retries, up to the repository it hands to the opening."""
+
+    # Session of the welcome window, folder of the cloned repository: the opening reads it as if the user had chosen it.
+    open_requested = Signal(str, str)
+    # Session of the welcome window whose opening of the cloned repository is cancelled with the clone.
+    open_cancel_requested = Signal(str)
+
+    def __init__(self, *, session_registry_controller: SessionRegistry, operation_policy_controller: OperationPolicy, account_controller: AccountController, application: QApplication, preference: PreferenceStore, repository: GitRepository,
+                 authentication: AuthenticationService, clone: CloneService, diagnostic_log: DiagnosticLog | None, parent: QObject | None = None) -> None:
+        """Receive the services and the lower controllers a clone works with; the wiring builds it after the accounts controller, and the opening learns from its signals which cloned repository to open or which opening to cancel."""
+        super().__init__(parent)
+        self.session_registry_controller = session_registry_controller
+        self.operation_policy_controller = operation_policy_controller
+        self.account_controller = account_controller
+        self.application = application
+        self.preference = preference
+        self.repository = repository
+        self.authentication = authentication
+        self.clone = clone
+        self.diagnostic_log = diagnostic_log
+        self.clone_output_by_id: dict[str, OperationDialog] = {}
+
+    def show_clone(self, session_id: str) -> CloneDialog | None:
+        """Open a clone form only for a current welcome window."""
+        welcome = self.session_registry_controller.welcome_by_session.get(session_id)
+        if welcome is None or session_id in self.session_registry_controller.identity_by_session:
+            return None
+        previous = self.session_registry_controller.clone_dialog_by_session.get(session_id)
+        if previous is not None:
+            previous.show()
+            previous.raise_()
+            return previous
+        dialog = CloneDialog(welcome)
+        self.session_registry_controller.clone_dialog_by_session[session_id] = dialog
+        dialog.clone_requested.connect(lambda: self._submit_clone(session_id))
+        dialog.cancel_requested.connect(lambda: self.cancel_clone(session_id))
+        dialog.open_requested.connect(lambda: self._retry_clone_open(session_id))
+        dialog.retry_requested.connect(lambda: self._retry_clone_submodules(session_id))
+        dialog.add_account_button.clicked.connect(lambda: self._show_clone_add_account(session_id))
+        dialog.url_edit.textChanged.connect(lambda: self._refresh_clone_endpoint(session_id))
+        dialog.branch_list_requested.connect(lambda: self._list_clone_branches(session_id))
+        dialog.branch_list_outdated.connect(lambda: self._cancel_clone_branch_list(dialog))
+        dialog.finished.connect(lambda: self._cancel_clone_branch_list(dialog))
+        dialog.finished.connect(lambda: self.session_registry_controller.clone_dialog_by_session.pop(session_id, None))
+        self._prefill_clone_form(dialog)
+        open_window_modal(dialog)
+        return dialog
+
+    def _prefill_clone_form(self, dialog: CloneDialog) -> None:
+        """Fill a new clone form with the destinations of the last started clones and with a repository found on the clipboard.
+
+        The remembered folders are offered as saved, without looking at the disk: a disconnected network drive must not
+        freeze the form, and the clone itself refuses a folder that no longer exists. A repository URL on the clipboard
+        is filled in at once, after the signals are connected, so the repository name and the account row follow it like
+        a typed URL. An absolute folder path on one line is handed to the form, which checks on a background thread
+        whether a repository is there and only then writes it into the field, if the field is still empty. Nothing is
+        started from the clipboard text.
+        """
+        dialog.set_destination_dirs(self.preference.read_clone_destinations())
+        clipboard_text = self.application.clipboard().text()
+        clipboard_url = clipboard_repository_url(clipboard_text)
+        if clipboard_url:
+            dialog.url_edit.setText(clipboard_url)
+            return
+        local_candidate = clipboard_local_repository_candidate(clipboard_text)
+        if local_candidate:
+            dialog.check_clipboard_repository(local_candidate)
+
+    def _list_clone_branches(self, session_id: str) -> None:
+        """Read the remote branches of the clone form's URL in the background, with the account the clone would use.
+
+        An empty or unfinished URL only keeps the remote HEAD entry. A failure only shows a warning icon beside the list,
+        saying that the branches could not be read: it never opens Settings and never writes to a clone's console, since the user may
+        still be typing. Nothing is read once the form shows a finished clone or the address of a submodule that asked
+        for an account: its URL is then fixed and its account menu describes the submodule's address, not the URL's. After
+        a failure the form may switch itself to the account named like the address's owner, which reads the list again.
+        """
+        dialog = self.session_registry_controller.clone_dialog_by_session.get(session_id)
+        if dialog is None or session_id not in self.session_registry_controller.welcome_by_session or self.session_registry_controller.shutdown_requested:
+            return
+        if dialog.partial or dialog.authentication_endpoint:
+            return
+        self._cancel_clone_branch_list(dialog)
+        url = dialog.repository_url()
+        if not self.clone.accepts_endpoint(url):
+            dialog.show_branches(())
+            return
+        selection = None
+        namespace = dialog.account_choice()
+        if namespace is not None:
+            selection = self._clone_listed_account(dialog, namespace)
+            if selection is None:
+                dialog.show_branch_failure()
+                return
+        dialog.set_branch_loading()
+
+        def complete(branch_list: BranchList) -> None:
+            """Show the answer only in the same form, and only for the last branch list it asked for."""
+            if self.session_registry_controller.clone_dialog_by_session.get(session_id) is not dialog or not isValid(dialog) or dialog.branch_request_id != branch_list.request_id:
+                return
+            dialog.branch_request_id = ""
+            if branch_list.cause:
+                dialog.show_branch_failure()
+                self._choose_owner_account(dialog)
+            else:
+                dialog.show_branches(branch_list.branches)
+
+        dialog.branch_request_id = self.clone.list_remote_branches(url, self.repository.git_filename, selection, complete)
+
+    def _choose_owner_account(self, dialog: CloneDialog) -> None:
+        """Switch the clone form to the account named like the owner written in its address, after the branches could not be read.
+
+        The user often has one account per owner and keeps another as the default, which cannot read a private
+        repository of the first. Only a safe case switches: the user did not pick an account in this form, no clone runs,
+        the form is about the typed URL (not a submodule's address), exactly one listed account of that service address
+        is named like the owner, and it is not already the account in use, the chosen one or the default behind 'Use
+        global default'. The switch reads the branches again once; if they still cannot be read, the owner's account is
+        then the one in use and nothing switches again. The form keeps the owner and the choice made before, so that an
+        address naming another owner puts that choice back and removes the line.
+        """
+        if dialog.account_chosen_by_user or dialog.running or dialog.partial or dialog.authentication_endpoint or not dialog.account_origin:
+            return
+        try:
+            catalogue = self.authentication.catalogue()
+        except (OSError, ValueError, TypeError):
+            return
+        namespace = owner_account_namespace(catalogue.accounts, dialog.repository_url())
+        if namespace is None:
+            return
+        account_in_use = dialog.account_choice() or catalogue.default_namespace_by_origin.get(dialog.account_origin)
+        if account_in_use == namespace:
+            return
+        for selection in catalogue.accounts:
+            if selection.namespace == namespace and selection.origin == dialog.account_origin:
+                dialog.choose_owner_account(namespace, address_owner(dialog.repository_url()), CloneDialogText.OWNER_ACCOUNT_CHOSEN.value.format(label=selection.label))
+                return
+
+    def _cancel_clone_branch_list(self, dialog: CloneDialog) -> None:
+        """Stop the branch list a clone form waits for, when its URL or account changed or when it closed; a late answer is then ignored."""
+        request_id = dialog.branch_request_id
+        if not request_id:
+            return
+        dialog.branch_request_id = ""
+        self.clone.cancel_branch_list(request_id)
+
+    def _submit_clone(self, session_id: str) -> None:
+        """Freeze exact form data and retain the process owner outside the dialog.
+
+        'Use global default' gives no selection: the clone then resolves the address's default and nothing is saved for
+        the new repository. An explicit account is used by the clone and saved for the new repository once it opens.
+        """
+        dialog = self.session_registry_controller.clone_dialog_by_session.get(session_id)
+        if dialog is None or dialog.running or dialog.partial or session_id not in self.session_registry_controller.welcome_by_session:
+            return
+        if self._clone_form_signing_in(dialog):
+            dialog.status_label.show_failure("Finish signing in successfully before cloning.")
+            return
+        selection = None
+        namespace = dialog.account_choice()
+        if namespace is not None:
+            selection = self._clone_listed_account(dialog, namespace)
+            if selection is None:
+                dialog.status_label.show_failure("Choose a confirmed account for this repository before cloning.")
+                return
+        generation = self.session_registry_controller.clone_generation_by_session.get(session_id, 0) + 1
+        self.session_registry_controller.clone_generation_by_session[session_id] = generation
+        intent = CloneIntent(dialog.repository_url(), dialog.destination_dir(), dialog.subdirectory_name(), session_id, generation, selection, options=dialog.clone_options())
+        dialog.set_running(True)
+        run = self.clone.submit(intent, self.repository.git_filename)
+        dialog.operation_id = run.operation_id
+        if run.clone_status != "running":
+            # Refused before Git ran (invalid URL, existing destination): there is no output to show, and the form
+            # shows the cause once the refusal is published.
+            return
+        self._open_clone_console(session_id, run, dialog)
+        self._remember_clone_destination(intent.parent_dir)
+
+    def _remember_clone_destination(self, parent_dir: str) -> None:
+        """Put the parent folder of a clone that really started at the front of the next clone forms' Destination list.
+
+        A refused write only costs the suggestion, so it goes to the --log file and never interrupts the clone.
+        """
+        try:
+            self.preference.remember_clone_destination(parent_dir)
+        except (OSError, ValueError, TypeError) as error:
+            diagnostic = Diagnostic("Save clone destination", "", "", [], str(error)).prepare()
+            if self.diagnostic_log is not None:
+                self.diagnostic_log.write(diagnostic)
+
+    def _clone_form_signing_in(self, dialog: CloneDialog) -> bool:
+        """Tell whether the clone form's sign-in window is still waiting for a sign-in result."""
+        add_dialog = dialog.add_account_dialog
+        return add_dialog is not None and isValid(add_dialog) and bool(add_dialog.operation_id)
+
+    def _clone_listed_account(self, dialog: CloneDialog, namespace: str) -> AccountSelection | None:
+        """Find the connected account chosen in the clone form, for the form's address only.
+
+        None means the account is no longer listed, or the list could not be read (the cause is then shown under the menu).
+        """
+        try:
+            accounts = self.authentication.catalogue().accounts
+        except (OSError, ValueError, TypeError) as error:
+            dialog.show_account_status(Diagnostic("Clone authentication", "", "", [], str(error)).prepare().cause)
+            return None
+        for selection in accounts:
+            if selection.namespace == namespace and selection.origin == dialog.account_origin:
+                return selection
+        return None
+
+    def _refresh_clone_endpoint(self, session_id: str) -> None:
+        """Show the account row of the address the clone will contact, never the last opened repository's.
+
+        The address comes from a failed submodule when one asked for authentication, otherwise from the URL. Without an
+        HTTPS address (nothing typed yet, SSH, local folder) the row stays in place, greyed with the reason, and a
+        running sign-in is cancelled and its window closed. An address on another service, or the first HTTPS address
+        after none, cancels a running sign-in, closes its window and starts again from 'Use global default'; another
+        address on the same service keeps the running sign-in, which learns the repository to test. After the form
+        switched itself to the account of the address's owner, an address naming another owner on the same service puts
+        back the choice made before the switch and removes the line that said so; another repository of the same owner
+        keeps the owner's account. The choice made before the switch only comes back while the user has chosen no
+        account in this form, by the menu or by a sign-in: an account the user chose is never replaced by that earlier
+        choice.
+        """
+        dialog = self.session_registry_controller.clone_dialog_by_session.get(session_id)
+        if dialog is None:
+            return
+        account_row = self._read_clone_account_row(dialog)
+        if account_row is None or not account_row.origin:
+            self._close_clone_add_account(session_id)
+            dialog.account_origin = ""
+            if account_row is not None:
+                dialog.show_account_status("")
+                dialog.show_account_state(account_row.disabled_text, account_row.add_account_enabled)
+            return
+        selected_namespace = dialog.account_choice()
+        if account_row.origin != dialog.account_origin:
+            self._close_clone_add_account(session_id)
+            dialog.account_origin = account_row.origin
+            dialog.show_account_status("")
+            dialog.account_chosen_by_user = False
+            dialog.forget_owner_switch()
+            selected_namespace = None
+        if (not dialog.account_chosen_by_user and dialog.owner_switch_namespace and dialog.owner_switch_namespace == selected_namespace
+                and address_owner(dialog.repository_url()).casefold() != dialog.owner_switch_owner):
+            selected_namespace = dialog.account_before_owner_switch
+            dialog.forget_owner_switch()
+        add_dialog = dialog.add_account_dialog
+        if add_dialog is not None and isValid(add_dialog) and not add_dialog.closed:
+            add_dialog.set_known_check_url(account_row.origin, self._clone_check_url(dialog))
+        self._show_clone_account_row(dialog, account_row, selected_namespace)
+
+    def _read_clone_account_row(self, dialog: CloneDialog) -> CloneAccountRow | None:
+        """Read the connected accounts and describe the clone form's Account row, or say under the row why they could not be read.
+
+        None means the accounts could not be read: the row is then greyed without any entry, since nothing can be offered.
+        """
+        try:
+            return clone_account_row(self.authentication.catalogue(), self._clone_contacted_url(dialog))
+        except (OSError, ValueError, TypeError) as error:
+            dialog.show_account_state("", False)
+            dialog.show_account_status(Diagnostic("Clone authentication", "", "", [], str(error)).prepare().cause)
+            return None
+
+    def _show_clone_account_row(self, dialog: CloneDialog, account_row: CloneAccountRow, selected_namespace: str | None) -> None:
+        """Fill the clone form's menu like a This repository row ('Use global default — …' first, then the address's accounts), or grey it with its reason."""
+        if account_row.disabled_text or account_row.row is None:
+            dialog.show_account_state(account_row.disabled_text, account_row.add_account_enabled)
+        else:
+            fill_repository_combo(dialog.account_combo, account_row.row, selected_namespace)
+            dialog.add_account_button.setEnabled(account_row.add_account_enabled)
+        if account_row.row is not None:
+            dialog.account_combo.setToolTip(account_row.row.title)
+
+    def _clone_contacted_url(self, dialog: CloneDialog) -> str:
+        """Return the URL the clone form is about: the refused submodule's when one asked for authentication, else the typed repository URL."""
+        return dialog.authentication_endpoint or dialog.repository_url()
+
+    def _clone_check_url(self, dialog: CloneDialog) -> str:
+        """Return the repository on which an account added from the clone form is tested: the URL the form contacts, without its credentials part.
+
+        A URL the test cannot use is passed as typed, so the account service refuses it with its own reason instead of
+        the window asking for another repository.
+        """
+        url = self._clone_contacted_url(dialog).strip()
+        try:
+            return check_repository_url(url, dialog.account_origin)
+        except ValueError:
+            return url
+
+    def refresh_clone_account(self, session_id: str, selected_namespace: str | None) -> None:
+        """Show the clone form's menu again after the accounts changed, for the address it already shows, with this account chosen.
+
+        None as the choice follows 'Use global default'. A form whose address changed meanwhile is left to its own refresh.
+        """
+        dialog = self.session_registry_controller.clone_dialog_by_session.get(session_id)
+        if dialog is None or not dialog.account_origin:
+            return
+        account_row = self._read_clone_account_row(dialog)
+        if account_row is None or account_row.origin != dialog.account_origin:
+            return
+        self._show_clone_account_row(dialog, account_row, selected_namespace)
+
+    def _show_clone_add_account(self, session_id: str) -> None:
+        """Open the shared sign-in window with the address fixed to the one the clone will contact.
+
+        A username + password on that address is tested on the repository being cloned, or on the refused submodule,
+        so the window names that URL instead of asking for one.
+        """
+        dialog = self.session_registry_controller.clone_dialog_by_session.get(session_id)
+        if dialog is None or dialog.running or not dialog.account_origin or session_id not in self.session_registry_controller.welcome_by_session:
+            return
+        existing = dialog.add_account_dialog
+        if existing is not None and isValid(existing) and not existing.closed:
+            existing.showNormal()
+            existing.raise_()
+            existing.activateWindow()
+            return
+        add_dialog = AddAccountDialog(dialog, locked_origin=dialog.account_origin, service_name_by_origin=self.account_controller.service_name_by_origin(),
+                                      known_check_url_by_origin={dialog.account_origin: self._clone_check_url(dialog)},
+                                      browser_timeout_ms=self.authentication.browser_timeout_ms)
+        dialog.add_account_dialog = add_dialog
+
+        def finished() -> None:
+            """Forget the closed window so the next Add account… opens a fresh one."""
+            if isValid(dialog) and dialog.add_account_dialog is add_dialog:
+                dialog.add_account_dialog = None
+            add_dialog.deleteLater()
+
+        add_dialog.sign_in_requested.connect(lambda token_mode: self._start_clone_account_sign_in(session_id, dialog, add_dialog, token_mode))
+        add_dialog.cancel_requested.connect(lambda: self.account_controller.cancel_account_sign_in(add_dialog))
+        add_dialog.finished.connect(finished)
+        add_dialog.show()
+
+    def _start_clone_account_sign_in(self, session_id: str, dialog: CloneDialog, add_dialog: AddAccountDialog, token_mode: bool) -> None:
+        """Start a sign-in whose result is accepted only while the same clone form still shows the same address.
+
+        When a failed submodule asked for the sign-in, the result also needs the same partial clone, the same failed
+        submodule and an unchanged destination. The address sent is the fixed one, never the full URL, so a user name
+        written in the URL is not used as a sign-in hint. A username + password is tested on the URL the form contacts
+        at the moment of the click; a refused test leaves the partial clone as it is and retries nothing.
+        """
+        if dialog.running:
+            add_dialog.show_refusal("Wait until the clone stops before signing in.")
+            return
+        origin = dialog.account_origin
+        add_dialog.set_known_check_url(origin, self._clone_check_url(dialog))
+        run = self.clone.run_by_id.get(dialog.operation_id) if dialog.operation_id is not None else None
+        target = run.authentication_target if run is not None else None
+        clone_intent = run.intent if run is not None else None
+
+        def owner_is_current() -> bool:
+            """Accept a sign-in result only for its still-visible clone form and address."""
+            if target is not None:
+                try:
+                    run.destination.verify()
+                except (OSError, ValueError):
+                    return False
+                if run.authentication_target is not target or run.intent is not clone_intent or not self.operation_policy_controller.clone_is_current(clone_intent):
+                    return False
+            return (self.session_registry_controller.clone_dialog_by_session.get(session_id) is dialog and session_id in self.session_registry_controller.welcome_by_session and not self.session_registry_controller.shutdown_requested
+                    and dialog.account_origin == origin)
+
+        self.account_controller.start_account_sign_in(add_dialog, token_mode, owner_is_current, lambda outcome: self._clone_account_signed_in(session_id, outcome))
+
+    def _clone_account_signed_in(self, session_id: str, outcome: AuthOutcome) -> None:
+        """Show the new account in the clone form: through 'Use global default' when it became the default, else chosen explicitly.
+
+        After a submodule asked for authentication, the new account is always chosen explicitly for that submodule and
+        the submodules are retried at once; it is saved for that submodule only, after the retry succeeds. Otherwise the
+        branch list is read again, since the menu was changed by the program and the new account may see the branches
+        the last list could not read. The account signed in from the form is the user's choice: the form then forgets
+        its own switch to the account of the address's owner, so that no later address puts back the choice made before
+        that switch; the line saying how the sign-in went stays. A refusal notice an open Settings window shows for the
+        same address is cleared, as when the account is added from Settings itself.
+        """
+        dialog = self.session_registry_controller.clone_dialog_by_session.get(session_id)
+        if dialog is None or outcome.selection is None:
+            return
+        run = self.clone.run_by_id.get(dialog.operation_id) if dialog.operation_id is not None else None
+        for_submodule = run is not None and run.authentication_target is not None
+        selected_namespace = None if outcome.became_default and not for_submodule else outcome.selection.namespace
+        self.refresh_clone_account(session_id, selected_namespace)
+        dialog.show_account_status(sign_in_result_text(outcome, reconnect=False))
+        account = transfer_account(outcome.selection)
+        setting_dialog = self.session_registry_controller.setting_dialog
+        if account is not None and setting_dialog is not None and isValid(setting_dialog):
+            setting_dialog.account_page.clear_account_notice(account.address)
+        if for_submodule:
+            run.child_selection = outcome.selection
+            self._retry_clone_submodules(session_id)
+            return
+        dialog.account_chosen_by_user = True
+        dialog.forget_owner_switch()
+        dialog.restart_branch_list()
+
+    def _cancel_clone_authentication(self, session_id: str) -> None:
+        """Stop only the sign-in started from this clone form; its late result is then ignored."""
+        dialog = self.session_registry_controller.clone_dialog_by_session.get(session_id)
+        if dialog is None:
+            return
+        if self._clone_form_signing_in(dialog):
+            self.account_controller.cancel_account_sign_in(dialog.add_account_dialog)
+
+    def _close_clone_add_account(self, session_id: str) -> None:
+        """Cancel the clone form's sign-in and close its window, whose fixed address no longer matches the form."""
+        self._cancel_clone_authentication(session_id)
+        dialog = self.session_registry_controller.clone_dialog_by_session.get(session_id)
+        if dialog is None:
+            return
+        add_dialog = dialog.add_account_dialog
+        if add_dialog is not None and isValid(add_dialog) and not add_dialog.closed:
+            add_dialog.reject()
+
+    def clone_finished(self, run: CloneRun) -> None:
+        """Finish the clone's console whatever became of its form, then publish only current terminal clones in the form."""
+        output = self.clone_output_by_id.get(run.operation_id)
+        if output is not None and isValid(output):
+            failure_text, headline = self._clone_console_failure(run)
+            output.show_result(OperationStatus(run.recursive_status), failure_text=failure_text, failure_headline=headline)
+        dialog = self.session_registry_controller.clone_dialog_by_session.get(run.intent.session_id)
+        if run.cancelled and dialog is not None and dialog.operation_id == run.operation_id:
+            cause = CLONE_CANCELLED_TEXT
+            if run.destination is not None and not run.destination_removed:
+                cause = CLONE_CANCELLED_PRESERVED_TEXT + run.destination.destination_dir
+            if run.incomplete_repository:
+                dialog.show_partial_submodules(cause, run.validation_status == OperationStatus.SUCCESS.value, cancelled=True)
+            else:
+                dialog.show_cancelled(cause, partial=run.clone_status == OperationStatus.SUCCESS.value)
+            return
+        if run.cancelled or not self.operation_policy_controller.clone_is_current(run.intent):
+            return
+        dialog = self.session_registry_controller.clone_dialog_by_session[run.intent.session_id]
+        if run.recursive_status == OperationStatus.SUCCESS.value:
+            if run.validation_status == OperationStatus.SUCCESS.value and run.intent.options.bare:
+                self._finish_bare_clone(run, dialog)
+            elif run.validation_status == OperationStatus.SUCCESS.value:
+                self._open_clone(run.intent.session_id)
+            else:
+                # Opening is offered again only for a repository with a working tree; a bare clone is never opened.
+                dialog.show_failure(failure_summary(run.diagnostic) if run.diagnostic is not None else "Repository validation failed.", partial=not run.intent.options.bare)
+        elif run.incomplete_repository:
+            partial_cause = failure_summary(run.diagnostic, self._submodule_transfer_account(run)) if run.diagnostic else run.recursive_status
+            dialog.show_partial_submodules(partial_cause, run.validation_status == OperationStatus.SUCCESS.value, explained=bool(run.checkout_refusal_text))
+            if run.authentication_target is not None:
+                if dialog.authentication_endpoint != run.authentication_target.endpoint:
+                    # Forgetting the shown address makes the refresh below treat the submodule's address as new: any
+                    # sign-in is cancelled and the row starts again from 'Use global default'.
+                    dialog.account_origin = ""
+                    run.child_selection = None
+                dialog.authentication_endpoint = run.authentication_target.endpoint
+                self._refresh_clone_endpoint(run.intent.session_id)
+                dialog.account_section.setEnabled(True)
+                cause = "Authentication required for submodule: " + run.authentication_target.entry.path + "\n" + run.authentication_target.endpoint
+                dialog.show_account_status(Diagnostic("Submodule authentication", "", "", [], cause).prepare().cause)
+                if run.diagnostic is not None:
+                    subject = SUBMODULE_NOTICE_SUBJECT_TEXT.format(path=run.authentication_target.entry.path)
+                    notice = account_notice(run.diagnostic, self._submodule_transfer_account(run), subject)
+                    if notice is not None:
+                        self.account_controller.offer_account_after_refusal(None, notice)
+            # Read after the account row above is refreshed, so the check and its later rewrite name the same account.
+            try:
+                submodule_selection = self._submodule_account_selection(run)
+            except ValueError:
+                submodule_selection = None
+            self.lookup_refused_account(submodule_selection, run.diagnostic, lambda: self._show_partial_clone_needs_reconnect(run, dialog))
+        elif run.diagnostic is None:
+            dialog.show_failure(run.clone_status)
+        else:
+            account = transfer_account(run.selection, run.intent.endpoint, self.authentication.missing_secret_namespace_set)
+            dialog.show_failure(failure_summary(run.diagnostic, account), explained=bool(failure_headline(run.diagnostic, account)))
+            self.lookup_refused_account(run.selection, run.diagnostic, lambda: self._show_clone_needs_reconnect(run, dialog))
+            notice = account_notice(run.diagnostic, account, CLONE_NOTICE_SUBJECT_TEXT)
+            if notice is not None:
+                self.account_controller.offer_account_after_refusal(None, notice)
+        # The form keeps the refusal as its red cause; the install window comes on top of it, and the user clicks Clone
+        # or Retry submodules again once the credential manager is installed.
+        if run.credential_manager_refusal is not None:
+            self.account_controller.offer_credential_manager_install(run.credential_manager_refusal, dialog)
+
+    def _finish_bare_clone(self, run: CloneRun, dialog: CloneDialog) -> None:
+        """End a successful bare clone without opening it: a bare repository has no working tree to show in a repository window.
+
+        The console says where the repository was written and stays on screen, the form closes without cancelling
+        anything, and the recent list is left as it was since nothing was opened.
+        """
+        run.trace.append_event(run.operation_id, "status", BARE_CLONE_DONE_TEXT + run.destination.destination_dir, ConsoleTone.SUCCESS)
+        welcome = self.session_registry_controller.welcome_by_session.get(run.intent.session_id)
+        if welcome is not None:
+            # A successful result closes the console by itself unless Keep dialog open is checked, and here the path it
+            # shows is the only answer the user gets, so it is shown again.
+            self.keep_clone_console(run.operation_id, welcome, show=True)
+        dialog.accept()
+
+    def _show_clone_needs_reconnect(self, run: CloneRun, dialog: CloneDialog) -> None:
+        """Say that the refused account needs a reconnect in the clone's console and in the clone form, while each still shows the failure of that same clone."""
+        output = self.clone_output_by_id.get(run.operation_id)
+        if output is not None and isValid(output) and not output.running:
+            failure_text, headline = self._clone_console_failure(run)
+            output.show_failure_text(failure_text, headline)
+        if (self.session_registry_controller.clone_dialog_by_session.get(run.intent.session_id) is not dialog or not isValid(dialog) or dialog.running or dialog.operation_id != run.operation_id
+                or dialog.status_label.tone is not ResultTone.FAILURE):
+            return
+        account = transfer_account(run.selection, run.intent.endpoint, self.authentication.missing_secret_namespace_set)
+        dialog.show_failure(failure_summary(run.diagnostic, account), explained=True)
+
+    def _show_partial_clone_needs_reconnect(self, run: CloneRun, dialog: CloneDialog) -> None:
+        """Say that the account refused for a submodule needs a reconnect, in the clone's console and in the clone form.
+
+        The form keeps its partial state (Retry submodules, Open repository) and is only rewritten while it still shows
+        that same partial clone.
+        """
+        output = self.clone_output_by_id.get(run.operation_id)
+        if output is not None and isValid(output) and not output.running:
+            failure_text, headline = self._clone_console_failure(run)
+            output.show_failure_text(failure_text, headline)
+        if (self.session_registry_controller.clone_dialog_by_session.get(run.intent.session_id) is not dialog or not isValid(dialog) or dialog.running or dialog.operation_id != run.operation_id
+                or not dialog.partial or dialog.status_label.tone is not ResultTone.FAILURE or run.diagnostic is None):
+            return
+        dialog.show_partial_submodules(failure_summary(run.diagnostic, self._submodule_transfer_account(run)), run.validation_status == OperationStatus.SUCCESS.value,
+                                       explained=bool(run.checkout_refusal_text))
+
+    def keep_clone_console(self, operation_id: str, owner: QWidget, *, show: bool) -> None:
+        """Move a clone's console under the window that stays on screen once the clone form closes.
+
+        The console is a child of the clone form, and the form goes away with its Open repository window: left there,
+        the console and the clone's output would disappear with them. It keeps its own window flags so it stays a
+        separate window. ``setParent`` hides a window, so a console that was on screen is shown again, and so is one the
+        caller asks to show.
+        """
+        output = self.clone_output_by_id.get(operation_id)
+        if output is None or not isValid(output):
+            return
+        visible = output.isVisible()
+        output.setParent(owner, output.windowFlags())
+        if not visible and not show:
+            return
+        output.show()
+        output.raise_()
+
+    def _open_clone_console(self, session_id: str, run: CloneRun, dialog: CloneDialog) -> None:
+        """Open the standard operation console live for a clone or its submodule retry, as Fetch and Push do.
+
+        A retry reuses the clone's console, even one the user already closed, since the retry writes to the same trace.
+        The clone service closes that trace itself once nothing can write to it anymore, so the console does not.
+        """
+        output = self.clone_output_by_id.get(run.operation_id)
+        if output is None or not isValid(output):
+            output = OperationDialog(run.trace, CLONE_CONSOLE_TITLE, dialog, preference=self.preference, console_operation=ConsoleOperation.CLONE)
+            self.clone_output_by_id[run.operation_id] = output
+            operation_id = run.operation_id
+            output.abort_requested.connect(lambda: self._abort_clone_console(session_id, operation_id))
+        output.set_running()
+        open_window_modal(output, keeps_window_buttons=True)
+
+    def _abort_clone_console(self, session_id: str, operation_id: str) -> None:
+        """Stop a clone from its console's Abort exactly as the form's Cancel clone does, or directly once no form shows it."""
+        dialog = self.session_registry_controller.clone_dialog_by_session.get(session_id)
+        if dialog is not None and dialog.operation_id == operation_id:
+            self.cancel_clone(session_id)
+            return
+        self.clone.cancel(operation_id)
+
+    def _clone_console_failure(self, run: CloneRun) -> tuple[str, str]:
+        """Return the explanation and the headline the clone's console shows in bold red, both empty when there is no failure to explain.
+
+        As for Fetch and Push, the headline names the address and the account used: the clone's own, or for a partial
+        clone the account used for the submodule that could not be fetched.
+        """
+        if run.cancelled or run.diagnostic is None or run.recursive_status == OperationStatus.SUCCESS.value:
+            return "", ""
+        if run.incomplete_repository:
+            account = self._submodule_transfer_account(run)
+        else:
+            account = transfer_account(run.selection, run.intent.endpoint, self.authentication.missing_secret_namespace_set)
+        return failure_summary(run.diagnostic), failure_headline(run.diagnostic, account)
+
+    def lookup_refused_account(self, selection: AccountSelection | None, diagnostic: PreparedDiagnostic | None, show_needs_reconnect: Callable[[], None]) -> None:
+        """After a transfer an account's authentication was refused for, check in the background whether that account's secret is gone.
+
+        Git and Git Credential Manager erase a refused secret by themselves. When the check finds it gone,
+        ``show_needs_reconnect`` rewrites the views still showing that failure; an open Settings window is marked either way.
+        Nothing is checked without an account or for another kind of failure.
+        """
+        if selection is None or diagnostic is None or not authentication_refused(diagnostic):
+            return
+
+        def answered(lookup: SecretLookup) -> None:
+            """Mark the account in Settings, and in the failure message once its secret is known to be gone."""
+            self.account_controller.show_account_status(lookup)
+            if selection.namespace in lookup.missing_namespace_set:
+                show_needs_reconnect()
+
+        self.authentication.lookup_secrets((selection,), answered)
+
+    def _submodule_account_selection(self, run: CloneRun) -> AccountSelection | None:
+        """Return the account used for the submodule a partial clone could not fetch, or None when no submodule asked for authentication or no account was used.
+
+        A retry uses the account the user chose for the submodule. A first attempt used the account Git was given for
+        that address: the parent's account for the same address, otherwise the service default. Raises ValueError when
+        that default account can no longer be read.
+        """
+        target = run.authentication_target
+        if target is None:
+            return None
+        if run.child_selection is not None:
+            return run.child_selection
+        if run.selection is not None and endpoint_origin(target.endpoint) == run.selection.origin:
+            return run.selection
+        return self.authentication.account_for_endpoint(target.endpoint)
+
+    def _submodule_transfer_account(self, run: CloneRun) -> TransferAccount | None:
+        """Name the address and account used for the submodule a partial clone could not fetch, or None when no submodule asked for authentication.
+
+        The account is marked as needing a reconnect once a check found its secret gone. When that account can no
+        longer be read, nothing is claimed rather than saying no account is connected.
+        """
+        target = run.authentication_target
+        if target is None:
+            return None
+        try:
+            selection = self._submodule_account_selection(run)
+        except ValueError:
+            return None
+        return transfer_account(selection, target.endpoint, self.authentication.missing_secret_namespace_set)
+
+    def _retry_clone_submodules(self, session_id: str) -> None:
+        """Resume the captured partial clone without asking for another URL or destination."""
+        dialog = self.session_registry_controller.clone_dialog_by_session.get(session_id)
+        if dialog is None or dialog.running or dialog.operation_id is None or session_id not in self.session_registry_controller.welcome_by_session:
+            return
+        run = self.clone.run_by_id[dialog.operation_id]
+        if self._clone_form_signing_in(dialog):
+            dialog.status_label.show_failure("Finish signing in successfully before retrying submodules.")
+            return
+        if run.authentication_target is not None:
+            namespace = dialog.account_choice()
+            child_selection = None
+            if namespace is not None:
+                child_selection = self._clone_listed_account(dialog, namespace)
+                if child_selection is None:
+                    dialog.status_label.show_failure("Choose a confirmed account for this submodule before retrying.")
+                    return
+            run.child_selection = child_selection
+        generation = self.session_registry_controller.clone_generation_by_session.get(session_id, 0) + 1
+        self.session_registry_controller.clone_generation_by_session[session_id] = generation
+        run.intent = replace(run.intent, generation=generation)
+        run.cancelled = False
+        dialog.set_running(True)
+        # The retry writes to the clone's own trace, so its output continues below the clone's in the same console.
+        self._open_clone_console(session_id, run, dialog)
+        self.clone.retry_submodules(run, self.repository.git_filename)
+
+    def _retry_clone_open(self, session_id: str) -> None:
+        """Capture a fresh explicit retry for the same completed clone without repeating Git clone."""
+        dialog = self.session_registry_controller.clone_dialog_by_session.get(session_id)
+        if dialog is None or dialog.running or dialog.operation_id is None or session_id not in self.session_registry_controller.welcome_by_session:
+            return
+        run = self.clone.run_by_id[dialog.operation_id]
+        generation = self.session_registry_controller.clone_generation_by_session.get(session_id, 0) + 1
+        self.session_registry_controller.clone_generation_by_session[session_id] = generation
+        run.intent = replace(run.intent, generation=generation)
+        run.cancelled = False
+        run.validation_status = "not_started"
+        self._open_clone(session_id)
+
+    def _open_clone(self, session_id: str) -> None:
+        """Pass a completed owned destination through the existing repository reader.
+
+        A bare clone is never opened: it has no working tree to show in a repository window.
+        """
+        dialog = self.session_registry_controller.clone_dialog_by_session.get(session_id)
+        if dialog is None or dialog.operation_id is None:
+            return
+        run = self.clone.run_by_id[dialog.operation_id]
+        if run.intent.options.bare or (run.clone_status != OperationStatus.SUCCESS.value and not run.incomplete_repository) or run.cancelled or not self.operation_policy_controller.clone_is_current(run.intent):
+            return
+        try:
+            run.destination.verify()
+        except (OSError, ValueError) as error:
+            diagnostic = Diagnostic("Open repository", run.destination.destination_dir, self.repository.git_filename, [], str(error)).prepare()
+            self.clone.open_result(run.operation_id, False, diagnostic)
+            dialog.show_failure(failure_summary(diagnostic), partial=True)
+            return
+        if run.validation_status != OperationStatus.SUCCESS.value:
+            dialog.set_running(True)
+
+            def validated() -> None:
+                """Retry readiness checks without repeating the native clone command."""
+                if run.cancelled and self.session_registry_controller.clone_dialog_by_session.get(session_id) is dialog:
+                    dialog.show_cancelled(OPENING_CANCELLED_TEXT, partial=True)
+                    return
+                if not self.operation_policy_controller.clone_is_current(run.intent) or run.cancelled:
+                    return
+                if run.validation_status == OperationStatus.SUCCESS.value:
+                    self._open_clone(session_id)
+                else:
+                    dialog.show_failure(failure_summary(run.diagnostic), partial=True)
+
+            self.clone.validate_repository(run, self.repository.git_filename, validated)
+            return
+        run.open_status = "running"
+        dialog.set_running(True)
+        dialog.status_label.setText("Repository cloned. Opening repository…" if run.recursive_status == OperationStatus.SUCCESS.value else "Opening preserved repository; some submodules are still incomplete…")
+        self.open_requested.emit(session_id, run.destination.destination_dir)
+
+    def cancel_clone(self, session_id: str) -> None:
+        """Invalidate the form immediately and stop its native process without deleting files."""
+        self._cancel_clone_authentication(session_id)
+        self.session_registry_controller.clone_generation_by_session[session_id] = self.session_registry_controller.clone_generation_by_session.get(session_id, 0) + 1
+        dialog = self.session_registry_controller.clone_dialog_by_session.get(session_id)
+        if dialog is not None and dialog.operation_id is not None:
+            run = self.clone.run_by_id[dialog.operation_id]
+            # Read before cancelling: a clone still waiting in the queue finishes inside cancel() and shows its own
+            # cancellation text, which the opening-cancelled text must not replace.
+            clone_was_running = run.has_running_step()
+            self.clone.cancel(dialog.operation_id)
+            if not clone_was_running:
+                dialog.show_cancelled(OPENING_CANCELLED_TEXT, partial=run.clone_status == OperationStatus.SUCCESS.value)
+        if session_id in self.session_registry_controller.welcome_by_session and session_id in self.session_registry_controller.identity_by_session:
+            self.open_cancel_requested.emit(session_id)
+
+    def preference_changed_for_clone_forms(self, changed_value_by_key: dict[str, object]) -> None:
+        """Show again, in every open clone form, the account choice a change of the shared preferences touched."""
+        # A sign-in, a block save or another window may have changed the accounts; every clone form shows them without
+        # losing what the user chose.
+        if AUTHENTICATION_PREFERENCE_KEY in changed_value_by_key:
+            for session_id, clone_dialog in tuple(self.session_registry_controller.clone_dialog_by_session.items()):
+                self.refresh_clone_account(session_id, clone_dialog.account_choice())