gitpane 1.0.0__py3-none-any.whl

gitpane/controller/transport_controller.py

@@ -0,0 +1,813 @@
+"""Exchange branches with the remotes of a repository from its windows."""
+
+from __future__ import annotations
+
+import uuid
+from dataclasses import replace
+from typing import TYPE_CHECKING
+
+from PySide6.QtCore import QObject, QTimer
+from shiboken6 import isValid
+
+from gitpane.account.authentication import transfer_account
+from gitpane.config import LOCAL_PREFIX, TAG_PREFIX, ConsoleOperation, SharedText
+from gitpane.controller.refresh_controller import RefreshScope
+from gitpane.history.file_history import WindowCapability
+from gitpane.operation.diagnostic import Diagnostic
+from gitpane.operation.operation_status import OperationStatus
+from gitpane.operation.repository_operation import NO_LONGER_AUTHORIZED_TEXT, OperationAction, OperationIntent
+from gitpane.preference.preference_store import FETCH_DEFAULT_PREFERENCE_KEY, FetchMode, fetch_mode_preference
+from gitpane.process.process_runner import READ_PROFILE
+from gitpane.reference.reference_edit import reference_signature
+from gitpane.system.path_identity import canonical_path
+from gitpane.transport.branch_exchange import TransportRequest
+from gitpane.transport.push_tracking import PushTrackingChoice, push_tracking_choice, save_push_tracking_choice, tracking_question_applies
+from gitpane.transport.refusal_notice import account_notice, failure_headline, failure_summary, server_refusal_headline
+from gitpane.transport.remote_config import fetch_remote_name
+from gitpane.ui.console.operation_dialog import OperationDialog
+from gitpane.ui.transport.push_dialog import PushDialog
+from gitpane.ui.transport.push_rejection_prompt import PushRejectionPrompt
+from gitpane.ui.transport.push_tracking_question import PushTrackingAnswer, ask_push_tracking
+from gitpane.ui.transport.remote_dialog import RemoteDialog
+from gitpane.ui.window_control.dialog_modality import open_window_modal
+from gitpane.worktree.command_sequence import FileTask, GitCommand
+
+if TYPE_CHECKING:
+    from collections.abc import Callable, Generator, Sequence
+
+    from PySide6.QtWidgets import QMessageBox, QWidget
+
+    from gitpane.account.authentication import AuthenticationService
+    from gitpane.commit.commit_push import CommitPushIntent, CommitPushService
+    from gitpane.commit.commit_write import CommitRequest
+    from gitpane.controller.account_controller import AccountController
+    from gitpane.controller.clone_controller import CloneController
+    from gitpane.controller.console_registry import ConsoleRegistry
+    from gitpane.controller.operation_policy import OperationPolicy
+    from gitpane.controller.reference_read_controller import ReferenceReadController
+    from gitpane.controller.refresh_controller import RefreshController
+    from gitpane.controller.session_registry import SessionRegistry
+    from gitpane.controller.staging_session_registry import StagingSessionRegistry
+    from gitpane.history.repository import GitRepository
+    from gitpane.operation.diagnostic import DiagnosticLog
+    from gitpane.operation.repository_operation import RepositoryOperationService
+    from gitpane.preference.preference_store import PreferenceStore
+    from gitpane.transport.branch_exchange import TransportOutcome, TransportRun, TransportService
+    from gitpane.transport.remote import RemoteService
+    from gitpane.transport.remote_config import RemoteSnapshot
+    from gitpane.ui.transport.push_dialog import PushWindowRequest
+    from gitpane.worktree.staging import StagingSession
+    from gitpane.worktree.worktree_service import WorktreeService
+
+
+class TransportController(QObject):
+    """Fetch, Push and Manage remotes of every repository window: their forms, the consoles of their transfers, the Push a Commit & push hands over, and what the end of a transfer shows and reads again in the windows of the same repository."""
+
+    def __init__(self, *, session_registry_controller: SessionRegistry, operation_policy_controller: OperationPolicy, staging_session_registry_controller: StagingSessionRegistry, console_registry_controller: ConsoleRegistry,
+                 reference_read_controller: ReferenceReadController, refresh_controller: RefreshController, account_controller: AccountController, clone_controller: CloneController, preference: PreferenceStore, repository: GitRepository,
+                 worktree_service: WorktreeService, repository_operation: RepositoryOperationService, remote: RemoteService, authentication: AuthenticationService, transport: TransportService, commit_push: CommitPushService,
+                 diagnostic_log: DiagnosticLog | None, parent: QObject | None = None) -> None:
+        """Receive the services and the lower controllers a transfer works with; the wiring builds it after the staging controller, and the repository windows, the preparation sessions and the commit-and-push service reach it through the wiring."""
+        super().__init__(parent)
+        self.session_registry_controller = session_registry_controller
+        self.operation_policy_controller = operation_policy_controller
+        self.console_registry_controller = console_registry_controller
+        self.reference_read_controller = reference_read_controller
+        self.refresh_controller = refresh_controller
+        self.account_controller = account_controller
+        self.clone_controller = clone_controller
+        self.preference = preference
+        self.repository = repository
+        self.worktree_service = worktree_service
+        self.remote = remote
+        self.authentication = authentication
+        self.transport = transport
+        self.commit_push = commit_push
+        self.diagnostic_log = diagnostic_log
+        self.staging_session_registry_controller = staging_session_registry_controller
+        self.repository_operation = repository_operation
+        self.push_dialog_by_session: dict[str, PushDialog] = {}
+        self.push_rejection_prompt_by_session: dict[str, PushRejectionPrompt] = {}
+        self.push_tracking_question_by_session: dict[str, QMessageBox] = {}
+        self.fetch_read_by_session: dict[str, str] = {}
+        self.remote_dialog_by_session: dict[str, RemoteDialog] = {}
+
+    def prepare_push_target(self, session_id: str, dialog: PushDialog) -> None:
+        """Bind the displayed destination to its current account and tools without contacting it."""
+        if dialog.loading or dialog.snapshot is None or dialog.closed or not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE):
+            return
+        endpoint = dialog.chosen_endpoint()
+        name = dialog.remote_selector.currentData() if dialog.remote_radio.isChecked() else ""
+        dialog.push_target = None
+        dialog.target_error = ""
+        try:
+            dialog.push_target = self.transport.capture_push_target(dialog.snapshot, name or "", endpoint)
+        except (ValueError, OSError, RuntimeError) as error:
+            dialog.target_error = str(error)
+        dialog.update_action()
+
+    def read_push(self, session_id: str, dialog: PushDialog) -> None:
+        """Read local sources and effective destinations without contacting a remote server."""
+        if not isValid(dialog) or dialog.closed or dialog.busy or not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE):
+            return
+        session = self.session_registry_controller.session_by_id[session_id]
+        generation = self.session_registry_controller.generation_by_session[session_id]
+        git_filename = self.repository.git_filename
+        dialog.loading = True
+        read_id = uuid.uuid4().hex
+        dialog.read_id = read_id
+        dialog.update_action()
+
+        def read() -> Generator:
+            """Capture actual HEAD and tags alongside the remote configuration."""
+            reference_state = yield FileTask(lambda: reference_signature(session.repository_context))
+            head = yield GitCommand(["symbolic-ref", "--quiet", "HEAD"], accepted_codes=(0, 1), profile=READ_PROFILE)
+            tags = yield GitCommand(["for-each-ref", "--format=%(refname)%00%(objectname)", TAG_PREFIX], profile=READ_PROFILE)
+            snapshot = yield from self.remote.capture(session.repository_context, git_filename, generation)
+            if reference_state != snapshot.reference_state:
+                raise ValueError("References changed while reading Push. Reread destination.")
+            tag_oid_by_ref = {}
+            for record in tags.splitlines():
+                full_ref, oid = record.decode("utf-8", "surrogateescape").split("\0")
+                tag_oid_by_ref[full_ref] = oid
+            return snapshot, head.decode("utf-8", "surrogateescape").strip(), tag_oid_by_ref
+
+        def complete(value: object, error: Exception | None) -> None:
+            """Discard closed or stale responses while retaining a recoverable visible draft."""
+            if not isValid(dialog) or dialog.closed or dialog.read_id != read_id or not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE):
+                return
+            if generation != self.session_registry_controller.generation_by_session.get(session_id):
+                dialog.needs_reread = True
+                dialog.show_error("The repository view changed. Reread destination before sending.")
+                return
+            if error is not None:
+                dialog.needs_reread = True
+                dialog.show_error(str(error))
+                return
+            dialog.populate(*value)
+            self.prepare_push_target(session_id, dialog)
+
+        self.worktree_service.run(session.repository_context, git_filename, read(), complete)
+
+    def _reread_push_windows(self, common_git_dir: str) -> None:
+        """Reread every idle Push window of a repository after a Fetch, so its remote branches and fetched state are current.
+
+        After a refused push, the user fetches from the rejection prompt and pushes again from the same window.
+        """
+        for session_id, dialog in tuple(self.push_dialog_by_session.items()):
+            session = self.session_registry_controller.session_by_id.get(session_id)
+            if session is None or session.is_closed or not isValid(dialog) or dialog.closed or dialog.busy:
+                continue
+            if canonical_path(session.repository_context.common_git_dir) == common_git_dir:
+                self.read_push(session_id, dialog)
+
+    def _start_push(self, session_id: str, request: TransportRequest) -> TransportRun:
+        """Send one Push request and show its console, which Abort can stop like Fetch."""
+        operation = request.operation
+        run = self.transport.push(request)
+        output_dialog = OperationDialog(run.trace, "Push", self.session_registry_controller.window_by_session[session_id], preference=self.preference, console_operation=ConsoleOperation.PUSH)
+        self.console_registry_controller.transport_dialog_by_id[operation.operation_id] = output_dialog
+        output_dialog.abort_requested.connect(lambda: self.transport.cancel(operation.operation_id))
+        output_dialog.finished.connect(run.trace.close)
+        output_dialog.set_running()
+        open_window_modal(output_dialog, keeps_window_buttons=True)
+        return run
+
+    def _show_push_rejection(self, run: TransportRun, outcome: TransportOutcome) -> None:
+        """Explain a Push refused because the server branch holds commits it would replace, and offer Fetch or Force push with lease.
+
+        The prompt opens after every other reaction to the result (console, Push window, Commit & push follow-up), so it
+        is the newest window and answers first. A new refusal replaces an older prompt of the same repository window.
+        Whatever the answer (Force push with lease, Fetch, Cancel, Escape or the title-bar close), the refused push
+        console has done its job, so it is settled and closes unless Keep dialog open is checked.
+        """
+        session_id = run.request.operation.session_id
+        if outcome.rejection is None or not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE):
+            return
+        previous = self.push_rejection_prompt_by_session.get(session_id)
+        if previous is not None and isValid(previous):
+            previous.reject()
+        prompt = PushRejectionPrompt(outcome.rejection, self.session_registry_controller.window_by_session[session_id])
+        remote_name = outcome.rejection.remote_name
+        prompt.fetch_requested.connect(lambda: self.fetch(session_id, (FetchMode.FETCH, remote_name, None)))
+        prompt.force_requested.connect(lambda: self._force_push_with_lease(run))
+        prompt.finished.connect(lambda _result: self.console_registry_controller.settle_answered_console(run.request.operation.operation_id))
+        self.push_rejection_prompt_by_session[session_id] = prompt
+        open_window_modal(prompt)
+
+    def _force_push_with_lease(self, run: TransportRun) -> None:
+        """Send a refused branch again as a force push with lease on the last fetched state, chosen from the rejection prompt.
+
+        The local capture is read again first; the transport then checks that the branch and destination did not change.
+        A Commit & push keeps going through its own service so the created commit is never committed twice. The tracking
+        answer given before the refused Push is kept without asking again, so the branch is linked only if that answer
+        asked for it and the forced Push is verified.
+        """
+        request = run.request
+        session_id = request.operation.session_id
+        if not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE):
+            return
+        session = self.session_registry_controller.session_by_id[session_id]
+        generation = self.session_registry_controller.generation_by_session[session_id]
+        git_filename = self.repository.git_filename
+        intent = self.commit_push.intent_by_push_id.get(request.operation.operation_id)
+
+        def refused(message: str) -> None:
+            """Show why the force push could not start, in the Push window when it is open, else in the status bar."""
+            dialog = self.push_dialog_by_session.get(session_id)
+            if dialog is not None and isValid(dialog) and not dialog.closed:
+                dialog.show_error(message)
+                return
+            window = self.session_registry_controller.window_by_session.get(session_id)
+            if window is not None and isValid(window):
+                window.statusBar().showMessage(message)
+
+        def captured(snapshot: RemoteSnapshot | None, error: Exception | None) -> None:
+            """Start the force push under the current authority, or explain why it cannot start."""
+            if not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE):
+                return
+            if generation != self.session_registry_controller.generation_by_session.get(session_id):
+                refused("The repository view changed. Push again to choose Force push with lease.")
+                return
+            if error is not None:
+                refused(str(error))
+                return
+            try:
+                target = self.transport.capture_push_target(snapshot, request.remote_name, request.endpoint)
+            except (ValueError, OSError, RuntimeError) as failure:
+                refused(str(failure))
+                return
+            if intent is not None:
+                forced = self.commit_push.retry_push(intent, snapshot, request.remote_name, request.endpoint, request.destination_ref, target, True, add_tracking=request.add_tracking)
+            else:
+                operation = OperationIntent.capture(uuid.uuid4().hex, snapshot.context, snapshot.git_filename, generation=snapshot.generation, session_id=session_id,
+                                                    operation="Push", action=OperationAction.REMOTE_WRITE, targets=(request.source_ref, request.destination_ref, request.endpoint))
+                forced = self._start_push(session_id, TransportRequest(operation, remote_name=request.remote_name, snapshot=snapshot, mode="push", source_ref=request.source_ref,
+                                                                       source_oid=request.source_oid, destination_ref=request.destination_ref, endpoint=request.endpoint,
+                                                                       force=True, push_target=target, add_tracking=request.add_tracking))
+            if forced is None:
+                refused("This commit's repository is no longer authorized for Push.")
+                return
+            dialog = self.push_dialog_by_session.get(session_id)
+            if dialog is not None and isValid(dialog) and not dialog.closed:
+                dialog.follow_operation(forced.request.operation.operation_id)
+
+        self.worktree_service.run(session.repository_context, git_filename, self.remote.capture(session.repository_context, git_filename, generation), captured)
+
+    def fetch(self, session_id: str, choice: tuple | None = None) -> OperationDialog | None:
+        """Capture a management intention and show all preparation and Fetch output.
+
+        ``choice`` is the Fetch mode, the remote and its capture picked in a menu; without it the saved default mode is used.
+        """
+        if not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE):
+            return None
+        session = self.session_registry_controller.session_by_id[session_id]
+        for operation_id, run in self.transport.run_by_id.items():
+            if run.request.operation.common_git_dir == canonical_path(session.repository_context.common_git_dir) and operation_id not in self.transport.outcome_by_id:
+                return self.console_registry_controller.transport_dialog_by_id.get(operation_id)
+        if session_id in self.fetch_read_by_session:
+            return None
+        mode, remote_name, snapshot = choice if choice is not None else (fetch_mode_preference(self.preference.read(FETCH_DEFAULT_PREFERENCE_KEY)), "", None)
+        if mode == FetchMode.FETCH and snapshot is None and not remote_name:
+            self.read_fetch_choice(session_id, launch=True)
+            return None
+        if mode == FetchMode.FETCH and not remote_name:
+            return None
+        operation = OperationIntent.capture(uuid.uuid4().hex, session.repository_context, self.repository.git_filename,
+                                            session_id=session_id, generation=self.session_registry_controller.generation_by_session[session_id], operation="Fetch", action=OperationAction.REMOTE_WRITE)
+        run = self.transport.fetch(TransportRequest(operation, mode == FetchMode.PRUNE_ALL, remote_name, snapshot))
+        dialog = OperationDialog(run.trace, "Fetch", self.session_registry_controller.window_by_session[session_id], preference=self.preference, console_operation=ConsoleOperation.FETCH)
+        self.console_registry_controller.transport_dialog_by_id[operation.operation_id] = dialog
+        dialog.abort_requested.connect(lambda: self.transport.cancel(operation.operation_id))
+        dialog.finished.connect(run.trace.close)
+        dialog.set_running()
+        open_window_modal(dialog, keeps_window_buttons=True)
+        for related_window in self.session_registry_controller.window_by_session.values():
+            if canonical_path(related_window.context.common_git_dir) == operation.common_git_dir:
+                related_window.set_fetch_busy(True)
+        return dialog
+
+    def fetch_busy_for(self, common_git_dir: str) -> bool:
+        """Tell whether a Fetch or another transport that has not finished yet runs on this repository.
+
+        Every window of the repository blocks a second primary Fetch while one runs, including a window that has just
+        moved to it from another repository.
+        """
+        canonical_git_dir = canonical_path(common_git_dir)
+        for operation_id, run in self.transport.run_by_id.items():
+            if run.request.operation.common_git_dir == canonical_git_dir and operation_id not in self.transport.outcome_by_id:
+                return True
+        return False
+
+    def read_fetch_choice(self, session_id: str, *, launch: bool = False) -> None:
+        """Read destinations without network activity and bind later clicks to the displayed capture."""
+        if not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE) or session_id in self.fetch_read_by_session:
+            return
+        window = self.session_registry_controller.window_by_session[session_id]
+        if window.fetch_busy:
+            return
+        session = self.session_registry_controller.session_by_id[session_id]
+        generation = self.session_registry_controller.generation_by_session[session_id]
+        git_filename = self.repository.git_filename
+        request_id = uuid.uuid4().hex
+        self.fetch_read_by_session[session_id] = request_id
+        branch_ref = window.branch_selector.currentData()
+        reference_snapshot = self.reference_read_controller.reference_snapshot_by_session.get(session_id)
+        if branch_ref is None and reference_snapshot is not None:
+            branch_ref = reference_snapshot.head_ref
+        window.show_fetch_choice(None, "", "Reading remotes…")
+        window.fetch_choice_action_by_mode[FetchMode.FETCH].setEnabled(False)
+        window.set_fetch_busy(True)
+
+        def complete(snapshot: RemoteSnapshot | None, error: Exception | None) -> None:
+            """Keep stale or closed menu reads from selecting another repository or launching later."""
+            if self.fetch_read_by_session.get(session_id) != request_id:
+                return
+            self.fetch_read_by_session.pop(session_id, None)
+            if not isValid(window) or not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE):
+                return
+            window.set_fetch_busy(self.fetch_busy_for(window.context.common_git_dir))
+            if self.session_registry_controller.generation_by_session.get(session_id) != generation:
+                window.show_fetch_choice(None, "", "The repository view changed. Open the Fetch menu again.")
+                return
+            if error is not None:
+                diagnostic = Diagnostic("Read Fetch remotes", window.context.repository_dir, self.repository.git_filename, [], str(error)).prepare()
+                window.show_fetch_choice(None, "", diagnostic.cause)
+                return
+            name = fetch_remote_name(snapshot, branch_ref)
+            window.show_fetch_choice(snapshot, name)
+            if not launch:
+                return
+            if name:
+                self.fetch(session_id, (FetchMode.FETCH, name, snapshot))
+            else:
+                window.fetch_remote_menu.popup(window.fetch_button.mapToGlobal(window.fetch_button.rect().bottomLeft()))
+
+        def read() -> Generator:
+            """Resolve an initial loading toolbar from native HEAD before capturing its remotes."""
+            nonlocal branch_ref
+            if branch_ref is None:
+                output = yield GitCommand(["symbolic-ref", "--quiet", "HEAD"], accepted_codes=(0, 1), profile=READ_PROFILE)
+                branch_ref = output.decode("utf-8", "surrogateescape").strip() or None
+            return (yield from self.remote.capture(session.repository_context, git_filename, generation))
+
+        self.worktree_service.run(session.repository_context, git_filename, read(), complete)
+
+    def save_fetch_default(self, session_id: str, mode: FetchMode) -> None:
+        """Publish a non-secret default across windows only after its storage sync succeeds; the file receives the mode's saved word."""
+        if not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE):
+            return
+        window = self.session_registry_controller.window_by_session[session_id]
+        try:
+            self.preference.update({FETCH_DEFAULT_PREFERENCE_KEY: mode.value})
+        except (OSError, ValueError, TypeError) as error:
+            diagnostic = Diagnostic("Save Fetch default", window.context.repository_dir, "", [], str(error)).prepare()
+            window.statusBar().showMessage(diagnostic.cause)
+            if self.diagnostic_log is not None:
+                self.diagnostic_log.write(diagnostic)
+        window.apply_fetch_preference(self.preference.value_by_key)
+
+    def transport_finished(self, outcome: object) -> None:
+        """Publish terminal output and refresh related management views without losing reading state."""
+        run = self.transport.run_by_id[outcome.operation_id]
+        for window in self.session_registry_controller.window_by_session.values():
+            if canonical_path(window.context.common_git_dir) == run.request.operation.common_git_dir:
+                busy = any(active.request.operation.common_git_dir == run.request.operation.common_git_dir and operation_id not in self.transport.outcome_by_id
+                           for operation_id, active in self.transport.run_by_id.items())
+                window.set_fetch_busy(busy)
+                window.statusBar().showMessage(run.request.operation.operation + ": " + outcome.status.value)
+        account = transfer_account(outcome.selection, outcome.endpoint, self.authentication.missing_secret_namespace_set)
+        push_dialog = self.push_dialog_by_session.get(run.request.operation.session_id)
+        if push_dialog is not None and isValid(push_dialog) and not push_dialog.closed and push_dialog.operation_id == outcome.operation_id:
+            push_dialog.show_outcome(outcome, account)
+        if run.request.mode == "push" and outcome.rejection is not None:
+            QTimer.singleShot(0, self, lambda: self._show_push_rejection(run, outcome))
+        dialog = self.console_registry_controller.transport_dialog_by_id.get(outcome.operation_id)
+        failed = outcome.status != OperationStatus.SUCCESS and outcome.diagnostic is not None
+        if dialog is not None and isValid(dialog):
+            failure_text = failure_summary(outcome.diagnostic) if failed else ""
+            # The same first sentence as the Push window: the server's own refusal when there is one, else the account one.
+            headline = (server_refusal_headline(outcome.server_refusals, outcome.diagnostic.stderr) or failure_headline(outcome.diagnostic, account)) if failed else ""
+            dialog.show_result(outcome.status, failure_text=failure_text, failure_headline=headline, stays_open=outcome.upstream_not_linked)
+        # Workaround: a refused Commit & push push reopens its Push window from this same signal, after this handler. Qt
+        # only lets the newest modal window take input, so Settings or the install window opened here, before the Push
+        # window, would be locked out by it (on macOS the Push window is modal for the whole application). Both open on
+        # the next turn of the event loop instead, above the Push window, in the same order as for any other refusal.
+        reopens_push_window = outcome.operation_id in self.commit_push.intent_by_push_id
+        if failed:
+            self.clone_controller.lookup_refused_account(outcome.selection, outcome.diagnostic, lambda: self._show_transport_needs_reconnect(run, outcome))
+            # After the console and the Push window show their red failure, which stays; Settings only comes in addition.
+            notice = account_notice(outcome.diagnostic, account, outcome.remote_name or (account.address if account is not None else ""))
+            if notice is not None:
+                # Bound now: the deferred call must open Settings for the refused repository, whatever window opened since.
+                refused_session_id = run.request.operation.session_id
+                if reopens_push_window:
+                    QTimer.singleShot(0, self, lambda refused_session_id=refused_session_id, notice=notice: self.account_controller.offer_account_after_refusal(refused_session_id, notice))
+                else:
+                    self.account_controller.offer_account_after_refusal(refused_session_id, notice)
+        # The console and the Push window keep their red line; the install window only comes in addition, even for a
+        # partial Fetch, since its HTTPS remote was stopped.
+        if outcome.credential_manager_refusal is not None:
+            if reopens_push_window:
+                QTimer.singleShot(0, self, lambda: self._offer_transport_credential_manager_install(run, outcome))
+            else:
+                self._offer_transport_credential_manager_install(run, outcome)
+        if not self.operation_policy_controller.allows(run.request.operation.session_id, WindowCapability.MANAGE):
+            run.trace.close()
+        if outcome.snapshot is None:
+            return
+        if not outcome.refresh_required:
+            # The transport proved that neither the server nor the repository changed: the views already show the
+            # truth, so nothing is read again. A refresh the user asked for meanwhile keeps its own course.
+            return
+        # Fetch, Push and remote deletion change remote-tracking and local references only; a HEAD that moved
+        # meanwhile still makes the refresh read everything.
+        for related_session_id, session in tuple(self.session_registry_controller.session_by_id.items()):
+            if (not session.is_closed and WindowCapability.MANAGE in session.capabilities
+                    and canonical_path(session.repository_context.common_git_dir) == run.request.operation.common_git_dir):
+                self.refresh_controller.checkout_refresh_session_set.add(related_session_id)
+                self.refresh_controller.refresh(related_session_id, scope=RefreshScope.REFERENCES)
+        # After the refresh, which starts a new view generation that an earlier read would not belong to.
+        if run.request.mode == "fetch":
+            self._reread_push_windows(run.request.operation.common_git_dir)
+
+    def _offer_transport_credential_manager_install(self, run: TransportRun, outcome: TransportOutcome) -> None:
+        """Open the install window for a transport stopped by the credential manager search, over its console while that console is shown."""
+        dialog = self.console_registry_controller.transport_dialog_by_id.get(outcome.operation_id)
+        parent = dialog if dialog is not None and isValid(dialog) and dialog.isVisible() else self.session_registry_controller.window_by_session.get(run.request.operation.session_id)
+        self.account_controller.offer_credential_manager_install(outcome.credential_manager_refusal, parent)
+
+    def _show_transport_needs_reconnect(self, run: TransportRun, outcome: TransportOutcome) -> None:
+        """Say that the refused account needs a reconnect in the console of this transfer and in the Push window, while each still shows its failure.
+
+        A console belongs to one transfer; a Push window only counts while its last send is still this transfer.
+        """
+        account = transfer_account(outcome.selection, outcome.endpoint, self.authentication.missing_secret_namespace_set)
+        dialog = self.console_registry_controller.transport_dialog_by_id.get(outcome.operation_id)
+        if dialog is not None and isValid(dialog) and not dialog.running:
+            dialog.show_failure_text(failure_summary(outcome.diagnostic), failure_headline(outcome.diagnostic, account))
+        push_dialog = self.push_dialog_by_session.get(run.request.operation.session_id)
+        if push_dialog is not None and isValid(push_dialog) and not push_dialog.closed and not push_dialog.busy and push_dialog.operation_id == outcome.operation_id:
+            push_dialog.show_outcome(outcome, account)
+
+    def open_push(self, session_id: str) -> PushDialog | None:
+        """Open a read-only Push draft for the actual management repository."""
+        if not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE):
+            return None
+        existing = self.push_dialog_by_session.get(session_id)
+        if existing is not None and not existing.closed:
+            existing.raise_()
+            return existing
+        session = self.session_registry_controller.session_by_id[session_id]
+        common_git_dir = canonical_path(session.repository_context.common_git_dir)
+        dialog = PushDialog(session.repository_context.repository_dir, self.session_registry_controller.window_by_session[session_id],
+                            is_available=lambda: not any(operation.common_git_dir == common_git_dir for operation in self.repository_operation.active_by_id.values()))
+        self.push_dialog_by_session[session_id] = dialog
+        # A bound method of the dialog: Qt drops the connection when the dialog is destroyed, and a closed dialog ignores the call.
+        self.repository_operation.changed.connect(dialog.check_availability)
+        dialog.push_requested.connect(lambda request: self.submit_push(session_id, dialog, request))
+        dialog.reread_requested.connect(lambda: self.read_push(session_id, dialog))
+        dialog.destination_changed.connect(lambda: self.prepare_push_target(session_id, dialog))
+
+        def manage() -> None:
+            """Reconcile the invoking draft after editing the same repository's remotes."""
+            remote_dialog = self.open_remote(session_id)
+            if remote_dialog is not None:
+                remote_dialog.finished.connect(lambda: self.read_push(session_id, dialog))
+
+        dialog.remote_requested.connect(manage)
+        open_window_modal(dialog)
+        self.read_push(session_id, dialog)
+        return dialog
+
+    def commit_push_requested(self, staging: StagingSession, request: CommitRequest) -> None:
+        """Bind the staging intention to a live managing window before committing once."""
+        if not staging.busy or request is not staging.pending_commit_push_request or self.staging_session_registry_controller.staging_by_key.get(staging.key) is not staging:
+            return
+        session_id = staging.commit_push_session_id
+        if not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE) or self.session_registry_controller.session_by_id[session_id].repository_context != staging.context:
+            staging.finish_commit_action(request.operation_id)
+            staging.busy = False
+            staging.pending_commit_push_request = None
+            staging.diagnostic = Diagnostic("Commit & push", staging.context.repository_dir, staging.git_filename, [], NO_LONGER_AUTHORIZED_TEXT).prepare()
+            staging._show()
+            return
+        operation = OperationIntent.capture(request.operation_id, staging.context, staging.git_filename, session_id=session_id,
+                                            generation=self.session_registry_controller.generation_by_session[session_id], operation="Commit & push", action=OperationAction.COMMIT_PUSH)
+
+        def captured(intent: CommitPushIntent | None, error: Exception | None) -> None:
+            """Submit the original request once after capture or release its refused preparation."""
+            if staging.pending_commit_push_request is not request or self.staging_session_registry_controller.staging_by_key.get(staging.key) is not staging:
+                return
+            staging.pending_commit_push_request = None
+            if error is not None:
+                staging.finish_commit_action(request.operation_id)
+                staging.busy = False
+                staging.diagnostic = Diagnostic("Commit & push", staging.context.repository_dir, staging.git_filename, [], str(error)).prepare()
+                staging._show()
+                return
+            staging.commit_service.submit(intent.commit_request)
+
+        self.commit_push.capture(operation, request, captured)
+
+    def commit_push_started(self, run: TransportRun) -> None:
+        """Show the actual Push operation after its local commit has already succeeded."""
+        operation = run.request.operation
+        parent = self.session_registry_controller.window_by_session.get(operation.session_id)
+        dialog = OperationDialog(run.trace, "Push", parent, preference=self.preference, console_operation=ConsoleOperation.PUSH)
+        self.console_registry_controller.transport_dialog_by_id[operation.operation_id] = dialog
+        dialog.abort_requested.connect(lambda: self.transport.cancel(operation.operation_id))
+        dialog.finished.connect(run.trace.close)
+        dialog.set_running()
+        open_window_modal(dialog, keeps_window_buttons=True)
+
+    def commit_push_decide_tracking(self, intent: CommitPushIntent) -> None:
+        """Decide the tracking reference of a Commit & push's created commit, asking over the repository window when nothing decides it, then hand the Push back to the service.
+
+        The decision reads the capture taken before the commit, whose configuration the service checks again after the
+        answer. Yes or a kept Always add pushes and then links the branch, No or a kept Never add pushes without a link;
+        once the answer comes, the service checks the authority and the captured commit again, and reads the
+        configuration, HEAD and destination again right before the Push. Cancel sends nothing, keeps the created commit
+        and says so in the status bar of the repository window. A window that lost its management authority, before
+        the question or while it was open, gets no Push and says so in its status bar; a window that is gone has
+        nothing to say it in.
+        """
+        session_id = intent.operation.session_id
+        window = self.session_registry_controller.window_by_session.get(session_id)
+        if window is None or not isValid(window):
+            return
+
+        def show(text: SharedText) -> None:
+            """Tell in the repository window, while it is still there, what became of the created commit."""
+            if isValid(window):
+                window.statusBar().showMessage(text.value)
+
+        if not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE):
+            show(SharedText.COMMIT_PUSH_NOT_SENT)
+            return
+        destination = intent.destination
+        self._decide_push_tracking(session_id, window, intent.snapshot, destination.remote_name, intent.source_ref, destination.destination_ref, (),
+                                   send=lambda add_tracking: self.commit_push.push_after_decision(intent, add_tracking, lambda: show(SharedText.COMMIT_PUSH_NOT_SENT)),
+                                   cancel=lambda: show(SharedText.COMMIT_PUSH_CANCELLED))
+
+    def commit_push_choose(self, intent: CommitPushIntent, message: str) -> None:
+        """Keep the created commit visible when default routing needs an explicit choice, with its push console still usable."""
+        dialog = self.open_push(intent.operation.session_id)
+        if dialog is not None:
+            dialog.pin_commit(intent, message)
+            if dialog.needs_reread:
+                self.read_push(intent.operation.session_id, dialog)
+            self._keep_push_consoles_over(intent, dialog)
+
+    def _keep_push_consoles_over(self, intent: CommitPushIntent, push_dialog: PushDialog) -> None:
+        """Keep the open push consoles of this Commit & push in front of its Push window and able to take clicks.
+
+        Workaround: the console opens before the Push window, both modal, and Qt lets only the newest modal window take
+        input, so the Push window shut the console out until Push was closed. Making the Push window the console's owner
+        window keeps the console above it and lets it take clicks again; Push stays usable too. This holds on Windows and
+        Linux, where both block the repository window, and on macOS, where both block the whole application.
+        """
+        push_handle = push_dialog.windowHandle()
+        if push_handle is None:
+            return
+        for push_id, pushed_intent in tuple(self.commit_push.intent_by_push_id.items()):
+            if pushed_intent.commit_request.operation_id != intent.commit_request.operation_id:
+                continue
+            console = self.console_registry_controller.transport_dialog_by_id.get(push_id)
+            if console is None or not isValid(console) or not console.isVisible() or console.windowHandle() is None:
+                continue
+            console.windowHandle().setTransientParent(push_handle)
+            console.raise_()
+            console.activateWindow()
+
+    def submit_push(self, session_id: str, dialog: PushDialog, request: PushWindowRequest) -> None:
+        """Capture the form's branch or tag objects under the current management authority."""
+        if not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE) or dialog.closed or request != dialog.request or not dialog.busy:
+            return
+        snapshot, remote_name, _endpoint, source_ref, destination_ref, force, _push_target, tag_refs = request
+        if dialog.created_tag is not None and tag_refs != dialog.created_tag.selection():
+            dialog.show_error("Push must contain only the captured created tag. Close Push and review the tag before sending.")
+            return
+        if (snapshot.context != self.session_registry_controller.session_by_id[session_id].repository_context or snapshot.git_filename != self.repository.git_filename
+                or snapshot.generation != self.session_registry_controller.generation_by_session.get(session_id)):
+            dialog.needs_reread = True
+            dialog.show_error("The repository capture changed. Reread destination before sending.")
+            return
+        if dialog.commit_push_intent is not None and (tag_refs or source_ref != (dialog.commit_push_intent.source_ref or dialog.commit_push_intent.created_oid)):
+            dialog.show_error("Choose a destination for the captured commit.")
+            return
+        self._decide_push_tracking(session_id, dialog, snapshot, remote_name, source_ref, destination_ref, tag_refs,
+                                   send=lambda add_tracking: self._send_push(session_id, dialog, request, add_tracking),
+                                   cancel=lambda: self._cancel_push_send(dialog, request, force))
+
+    def _decide_push_tracking(self, session_id: str, parent: QWidget, snapshot: RemoteSnapshot, remote_name: str, source_ref: str, destination_ref: str, tag_refs: Sequence[tuple[str, str]],
+                              send: Callable[[bool], None], cancel: Callable[[], None]) -> None:
+        """Decide whether a Push also links its branch to the remote branch, asking the user only when nothing decides it already.
+
+        A branch that already has an upstream, a tag push, a typed address, an inactive remote or a destination no Fetch
+        refspec maps to a remote-tracking branch is sent without a link. Otherwise the choice kept for the repository
+        decides; without one, the question is asked before anything is sent, and ``send`` receives whether to link, or
+        ``cancel`` runs when the user pushes nothing. Don't ask again keeps Yes as Always add and No as Never add for the
+        repository before sending; with Cancel it keeps nothing.
+        """
+        if not tracking_question_applies(snapshot, remote_name, source_ref, destination_ref, tag_refs):
+            send(False)
+            return
+        choice = push_tracking_choice(self.preference, snapshot.context.common_git_dir)
+        if choice == PushTrackingChoice.ALWAYS_ADD:
+            send(True)
+            return
+        if choice == PushTrackingChoice.NEVER_ADD:
+            send(False)
+            return
+        previous = self.push_tracking_question_by_session.get(session_id)
+        if previous is not None and isValid(previous):
+            previous.reject()
+        box: QMessageBox | None = None
+
+        def answered(answer: PushTrackingAnswer, dont_ask_again: bool) -> None:
+            """Keep the answer when asked to, then send with or without the link, or push nothing, as the user answered."""
+            if self.push_tracking_question_by_session.get(session_id) is box:
+                del self.push_tracking_question_by_session[session_id]
+            if answer == PushTrackingAnswer.YES:
+                if dont_ask_again:
+                    self._remember_push_tracking(session_id, snapshot.context.common_git_dir, PushTrackingChoice.ALWAYS_ADD)
+                send(True)
+            elif answer == PushTrackingAnswer.NO:
+                if dont_ask_again:
+                    self._remember_push_tracking(session_id, snapshot.context.common_git_dir, PushTrackingChoice.NEVER_ADD)
+                send(False)
+            else:
+                cancel()
+
+        box = ask_push_tracking(parent, source_ref.removeprefix(LOCAL_PREFIX), destination_ref.removeprefix(LOCAL_PREFIX), answered)
+        self.push_tracking_question_by_session[session_id] = box
+
+    def _remember_push_tracking(self, session_id: str, common_git_dir: str, choice: PushTrackingChoice) -> None:
+        """Keep the tracking answer for the repository in the preferences file, and say in the repository window when it cannot be written.
+
+        The check box only spares the question next time, so a write that fails never stops the Push the user asked for.
+        """
+        try:
+            save_push_tracking_choice(self.preference, common_git_dir, choice)
+        except (OSError, ValueError, TypeError) as error:
+            window = self.session_registry_controller.window_by_session.get(session_id)
+            repository_dir = window.context.repository_dir if window is not None and isValid(window) else ""
+            diagnostic = Diagnostic(SharedText.SAVE_TRACKING_CHOICE.value, repository_dir, "", [], str(error)).prepare()
+            if window is not None and isValid(window):
+                window.statusBar().showMessage(SharedText.PUSH_TRACKING_NOT_SAVED.value.format(cause=diagnostic.cause))
+            if self.diagnostic_log is not None:
+                self.diagnostic_log.write(diagnostic)
+
+    def _send_push(self, session_id: str, dialog: PushDialog, request: PushWindowRequest, add_tracking: bool) -> None:
+        """Start the Push the form asked for, checking again what may have changed while the tracking question was open.
+
+        A window holding a Commit & push's created commit sends that commit through its service, so it is never
+        committed twice.
+        """
+        if (not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE) or not isValid(dialog) or dialog.closed or request is not dialog.request
+                or not dialog.busy):
+            return
+        snapshot, remote_name, endpoint, source_ref, destination_ref, force, push_target, tag_refs = request
+        if (snapshot.context != self.session_registry_controller.session_by_id[session_id].repository_context or snapshot.git_filename != self.repository.git_filename
+                or snapshot.generation != self.session_registry_controller.generation_by_session.get(session_id)):
+            dialog.needs_reread = True
+            dialog.show_error("The repository capture changed. Reread destination before sending.")
+            return
+        if dialog.commit_push_intent is not None:
+            run = self.commit_push.retry_push(dialog.commit_push_intent, snapshot, remote_name, endpoint, destination_ref, push_target, force, add_tracking=add_tracking)
+            if run is None:
+                dialog.show_error("This commit's repository is no longer authorized for Push.")
+                return
+            dialog.operation_id = run.request.operation.operation_id
+            return
+        targets = []
+        for full_ref, oid in tag_refs:
+            targets.extend((full_ref, oid))
+        operation = OperationIntent.capture(uuid.uuid4().hex, snapshot.context, snapshot.git_filename, generation=snapshot.generation,
+                                            session_id=session_id, operation="Push", action=OperationAction.REMOTE_WRITE, targets=(*targets, endpoint) if tag_refs else (source_ref, destination_ref, endpoint),
+                                            from_form=True)
+        dialog.operation_id = operation.operation_id
+        self._start_push(session_id, TransportRequest(operation, remote_name=remote_name, snapshot=snapshot, mode="push", source_ref=source_ref,
+                                                      source_oid=snapshot.tracking_by_ref[source_ref].oid if source_ref else "", destination_ref=destination_ref,
+                                                      endpoint=endpoint, force=force, push_target=push_target, tag_refs=tag_refs, add_tracking=add_tracking))
+
+    def _cancel_push_send(self, dialog: PushDialog, request: PushWindowRequest, force: bool) -> None:
+        """Give the Push window its draft back after Cancel, unless it was closed or sent another draft meanwhile."""
+        if not isValid(dialog) or dialog.closed or request is not dialog.request:
+            return
+        dialog.cancel_send(force)
+
+    def open_remote(self, session_id: str) -> RemoteDialog | None:
+        """Open the remote editor only for a live repository management window."""
+        if not self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE):
+            return None
+        existing = self.remote_dialog_by_session.get(session_id)
+        if existing is not None and not existing.closed:
+            existing.raise_()
+            return existing
+        session = self.session_registry_controller.session_by_id[session_id]
+        generation = session.generation
+        dialog = RemoteDialog(session_id, self.session_registry_controller.window_by_session[session_id])
+        self.remote_dialog_by_session[session_id] = dialog
+        dialog.finished.connect(lambda: self.remote_dialog_by_session.pop(session_id, None) if self.remote_dialog_by_session.get(session_id) is dialog else None)
+
+        def is_current() -> bool:
+            """Reject late reads and queued writes after the originating view changes."""
+            return (isValid(dialog) and not dialog.closed and not session.is_closed and session.generation == generation
+                    and self.session_registry_controller.generation_by_session.get(session_id) == generation
+                    and self.operation_policy_controller.allows(session_id, WindowCapability.MANAGE))
+
+        def complete(snapshot: object, error: Exception | None) -> None:
+            """Publish only the captured repository's complete current configuration."""
+            if not is_current():
+                return
+            if error is not None:
+                diagnostic = Diagnostic("Read remotes", session.repository_context.repository_dir, self.repository.git_filename, [], str(error)).prepare()
+                dialog.show_error(diagnostic.cause)
+                return
+            dialog.populate(snapshot)
+
+        def submit(request: tuple, action: str = "save") -> None:
+            """Bind remote changes to the exact live form until their native completion."""
+            if not is_current() or request != dialog.request or not dialog.busy:
+                if isValid(dialog) and not dialog.closed and request == dialog.request:
+                    dialog.request = None
+                    dialog.show_error("The repository view changed. Reopen Manage remotes before making another change.")
+                return
+            snapshot, name, changes = request
+            if snapshot.context != session.repository_context or snapshot.generation != generation or snapshot.git_filename != self.repository.git_filename:
+                dialog.request = None
+                dialog.show_error("The remote capture changed. Reopen Manage remotes before making another change.")
+                return
+            operation_id = uuid.uuid4().hex
+
+            def finished(outcome: object) -> None:
+                """Publish each field result without silently changing the editor generation."""
+                nonlocal generation
+                if outcome.operation_id != operation_id:
+                    return
+                self.repository_operation.finished.disconnect(finished)
+                self.remote.outcome_by_id[operation_id] = outcome
+                if is_current():
+                    dialog.show_outcome(outcome)
+                if outcome.diagnostic is not None and self.diagnostic_log is not None:
+                    self.diagnostic_log.write(outcome.diagnostic)
+                if outcome.status != OperationStatus.REFUSED:
+                    references_changed = any(step.operation in ("Name", "Remove remote") and step.status in (OperationStatus.SUCCESS, OperationStatus.UNKNOWN) for step in outcome.steps)
+                    for current_id, current_session in tuple(self.session_registry_controller.session_by_id.items()):
+                        if not current_session.is_closed and canonical_path(current_session.repository_context.common_git_dir) == canonical_path(snapshot.context.common_git_dir):
+                            if not references_changed:
+                                self.reference_read_controller.read_references(current_id)
+                                continue
+                            current_form = current_id == session_id and is_current()
+                            already_refreshing = current_session.refresh_active
+                            self.refresh_controller.refresh(current_id, scope=RefreshScope.REFERENCES)
+                            if current_form and not already_refreshing:
+                                # The editor's own ref change refreshes the graph; retain its exact config
+                                # capture while advancing only the generation that this refresh owns.
+                                generation = current_session.generation
+                                if dialog.snapshot is not None:
+                                    dialog.snapshot = replace(dialog.snapshot, generation=generation)
+                            elif current_form:
+                                dialog.uncertain = True
+                                dialog.show_error("Remote saved. The repository is refreshing; reopen Manage remotes before making another change.")
+                                dialog.save_button.setEnabled(False)
+
+            self.repository_operation.finished.connect(finished)
+            if action == "active":
+                self.remote.set_active(snapshot, name, changes, session_id=session_id, is_current=is_current, operation_id=operation_id)
+            elif action == "remove":
+                self.remote.remove(snapshot, name, session_id=session_id, is_current=is_current, operation_id=operation_id)
+            elif action == "tracking":
+                self.remote.set_tracking(snapshot, name, changes, session_id=session_id, is_current=is_current, operation_id=operation_id)
+            else:
+                self.remote.save(snapshot, name, changes, session_id=session_id, is_current=is_current, operation_id=operation_id)
+
+        def reread_tracking() -> None:
+            """Refresh the same branch editor only after an explicit reread request."""
+            if not is_current():
+                if isValid(dialog) and not dialog.closed:
+                    dialog.show_error("The repository view changed. Reopen Manage remotes to read its current tracking.")
+                return
+
+            def read_complete(snapshot: object, error: Exception | None) -> None:
+                """Accept fresh tracking only while the requesting form remains current."""
+                if not is_current():
+                    return
+                if error is not None:
+                    diagnostic = Diagnostic("Read tracking", session.repository_context.repository_dir, self.repository.git_filename, [], str(error)).prepare()
+                    dialog.show_error(diagnostic.cause)
+                    return
+                dialog.tracking_reloaded(snapshot)
+
+            self.remote.read(session.repository_context, self.repository.git_filename, generation, read_complete)
+
+        dialog.save_requested.connect(submit)
+        dialog.active_requested.connect(lambda request: submit(request, "active"))
+        dialog.remove_requested.connect(lambda request: submit(request, "remove"))
+        dialog.tracking_requested.connect(lambda request: submit(request, "tracking"))
+        dialog.tracking_reload_requested.connect(reread_tracking)
+        open_window_modal(dialog)
+        self.remote.read(session.repository_context, self.repository.git_filename, generation, complete)
+        return dialog