taskops-cli 0.4.2__tar.gz → 0.5.0__tar.gz

{taskops_cli-0.4.2 → taskops_cli-0.5.0}/ARCHITECTURE.md

@@ -1012,7 +1012,8 @@ Both remaining items are done. The migration ran against all four v1 boards
 directory of board logs, so it is `pip install` into a venv and one pm2 entry
 (README, "Deployed"). **The box runs this tree** since 2026-08-09 (tk-df8e64,
 §17), so `https://taskops.bernardocastro.dev/<board>/ui/` answers `410` and one
-sentence, exactly as the trunk does (§16, §17). Re-derivable:
+sentence, exactly as the trunk does (§16, §17) — until a board with a declared
+forge gets its hosted window (§16, "The hosted window"). Re-derivable:
 `curl -s https://taskops.bernardocastro.dev/healthz` and
 `curl -w '%{http_code}' https://taskops.bernardocastro.dev/axion/ui/`
 — measured `{"boards": 4}` (after all four boards had been addressed through
@@ -1505,15 +1506,18 @@ construction and never sniffed per request** (`Mounts(repo=…)`,
 | `taskops serve` | a directory of boards, no checkout | **404 with the reason spelled out**, and nothing faked | **410 and one sentence** |
 
 The `/ui/` column arrived later, and it is the same `repo` deciding both — see
-"API ONLY is now literal" below.
+"API ONLY is now literal" below. Both cells of the `serve` row are narrowed a
+second time by "The hosted window" below: a board that DECLARED a forge may be
+answered from a bare read-only mirror of it, and only then.
 
 A viewer meets that gap whenever this clone cannot answer — a ref not fetched
 yet, a shallow checkout, a commit from before this repo had the branch — and
 there the UI's declared cascade takes over: numstat from the event → patch from
 /git → the forge link if a slug exists → one honest sentence. No dead anchor, no
 empty pane pretending. (The gap used to have a second, worse shape: a browser
-with no clone at all, pointed at the hosted page. There is no hosted page any
-more — see below.)
+with no clone at all, pointed at the hosted page. That page was withdrawn — see
+below — and comes back only standing on a real history: the forge mirror, in
+"The hosted window".)
 
 That cascade is ONE function — `ui/src/links.tsx::cascade`, beside the slug and
 the link templates it already owned — and `ui/src/components/card/Patch.tsx`
@@ -1595,9 +1599,11 @@ doubled separator and the directory itself, and never repairs one: a traversal
 normalised into something acceptable is the bug. Anything outside
 `.taskops/reports/` is a 400 that names the directory, and `tests/test_topology.py`
 walks every shape (a real secret one directory up included, asserting its
-contents appear nowhere in the answer). `taskops serve` still mounts no `/git`
-at all: the switch is `Mounts.repo`, decided once at construction, and a new
-question underneath it opens no door.
+contents appear nowhere in the answer). `taskops serve` mounts no `/git`
+from a checkout it does not have: the switch is `Mounts.repo`, decided once at
+construction, and a new question underneath it opens no door. The hosted-window
+amendment below changes what `repo` may point AT — a bare mirror of the
+declared forge — never the switch itself.
 
 ### The window: `taskops ui` serves locally even for a REMOTE board (2026-08-08)
 
@@ -1636,7 +1642,7 @@ The routes do not change, so the committed bundle is untouched by any of this:
 decision). The server used to serve the bundle too, from a `--ui` flag with a
 packaged default — so the box above answered `/ui/` with a real dashboard, and
 that dashboard could not draw a single patch, because the machine it was served
-from deliberately has no clone. It was a degraded window presented as *the*
+from deliberately had no clone. It was a degraded window presented as *the*
 window; the redirect above merely pointed people at it. **The binary serves the
 window; the server serves the truth.**
 
@@ -1644,7 +1650,9 @@ So: `Mounts.ui` is not a parameter, it is `repo`'s shadow — one construction-t
 switch mounts `/git` AND the bundle, and only a process standing in a checkout
 has either. `/ui/` on a board host answers `static.py::NO_UI` as plain text with
 **410 Gone**, not 404: 404 says "no idea, maybe later", and this page was
-withdrawn on purpose and is never coming back to a host with no clone. Plain
+withdrawn on purpose and is never coming back to a host with no clone — and a
+host holding the board's forge MIRROR is no longer that host ("The hosted
+window", below). Plain
 text and not the JSON envelope because the only reader who reaches that door is
 a human with a browser. The `--ui` flag is REMOVED, not deprecated: there is no
 command line that puts the decision back. The bundle still ships inside the
@@ -1709,6 +1717,66 @@ move a branch under a worktree somebody is sitting in.
 
 A repo joined to nothing behaves exactly as it did.
 
+### The hosted window: the host may hold a MIRROR of the declared forge (decided 2026-08-30)
+
+The first amendment narrowed "no server reads a repo" to "a host that sits in a
+repo may read it". This one narrows the other clause — *the server deliberately
+has no clone* — and, as before, the change is recorded here rather than quietly
+made:
+
+> **A board host MAY hold a bare, READ-ONLY mirror of the board's DECLARED
+> forge — and only then does it answer `/git` and `/ui/`.** A board with no
+> declared forge is exactly what it was: 404 on `/git`, 410 on `/ui/`, each
+> refusal naming `taskops board forge <owner>/<repo>` as the door.
+
+Why this is not the degraded window "API ONLY" withdrew. That window's flaw was
+never that a server drew a dashboard — it was that the machine drawing it had
+NO git at all, so every diff fell through the whole cascade to a forge link or
+a sentence, a blank presented as *the* window. The mirror removes the flaw, not
+the caution: it is **the same history the forge already holds** — `git clone
+--mirror` of the repo the owner declared with `board forge`, refreshed by ONE
+bounded on-demand fetch when a requested ref is missing, then answered stale
+rather than blocking — so a diff served from it is the diff GitHub would show,
+read by the same `gitwork/diff.py` doors, behind the same visibility rules as
+`/rpc`. And the dev-side story does not move an inch: `taskops ui` still serves
+the window from the checkout it stands in, reading the dev's OWN clone,
+including refs the forge has never seen. The hosted window is for the reader
+who has no clone — the case the local window, by construction, cannot serve.
+
+**Where it lives**: `<root>/<board>/mirror.git`, a bare repo beside the board's
+`events.jsonl` — later cards follow this wording. It is DERIVED and disposable
+in exactly the sense `cache.sqlite` is: delete it and it re-clones from the
+declared forge; nothing in it is truth the forge does not hold. Its ONLY source
+is that forge. It takes no client pushes — the host still exposes no receive
+door of any kind — and it is not a second trunk: nothing lands there, nothing
+is read back into the log from it, and `taskops_merge` still happens in the
+dev's shared checkout.
+
+**The credential story** is §19's, unchanged in kind. A public repo needs no
+credential at all. A private repo is fetched with an **ssh deploy key on the
+host's filesystem** — read-only, minted and installed by the OWNER, revocable
+on the forge like any deploy key — which is the ONE new credential this chapter
+adds, and it is the owner's business exactly as `board forge` itself is. What
+remains banned is what §11 and §19 already ban: a stored GitHub token (the
+mirror's remote is an address, never a token), a write credential in any form,
+GitHub as a second identity system, and any dev credential travelling to the
+host — nobody's `gh auth token` is involved, because the owner already declared
+the repo and the mirror pulls from the outside like any anonymous (or
+deploy-keyed) clone.
+
+**Still banned, spelled out**: client pushes to the host and git replication
+between clones (the mirror replicates FROM the forge, one direction, and no
+clone ever pushes to it); a write credential on the host; a second trunk; a
+`--ui` flag or any per-request sniffing (whether the mirror exists is decided
+at mount time, the same `Mounts.repo` switch, now pointable at `mirror.git`);
+and anonymous writes — a public board's hosted window is a READ, and it leaves
+no `presence` row.
+
+So `static.py::NO_UI` and `gitdoor.py::NO_REPO` change meaning, not words of
+intent: each stops saying "this host never has a repo" and starts saying "this
+BOARD declared no forge, so this host holds no mirror to read from" — a state
+the owner ends with one `taskops board forge`. The refusal still names the door.
+
 ### A concept named by two cards is a seam — the fan-out rule, third notch
 
 `gitwork/remote.py` was born TWICE in one wave: two workers, each over the
@@ -1803,7 +1871,9 @@ request (`http/mounts.py::stores`), so a just-restarted process says `1`, not
 
 **That md5-of-the-served-bundle check is history, not the procedure any more.**
 Since §16's "API ONLY" amendment the host serves no bundle: `/<board>/ui/`
-answers `410` and one sentence, so there is nothing at the domain to md5. The
+answers `410` and one sentence (until the hosted-window chapter deploys a board
+whose forge is declared — §16, "The hosted window"), so there is nothing at the
+domain to md5. The
 wheel is still checked for its markers *before* it ships — it is the same wheel
 teammates install to get `taskops ui` — and the domain is verified by DATA,
 through `/rpc`.

{taskops_cli-0.4.2 → taskops_cli-0.5.0}/CHANGELOG.md

@@ -3,6 +3,49 @@
 The source of truth for release notes — GitHub Releases are extracted from
 here, never written twice.
 
+## 0.5.0 — the hosted window
+
+- **A board can be READ without a clone.** Until now the dashboard was only ever
+  served by `taskops ui`, a binary standing in a checkout: a host running
+  `taskops serve` answered `/git` with a 404 and `/ui/` with a 410, because a
+  dashboard draws DIFFS and the host deliberately had no repository to read them
+  from. Serving a page that could not draw a single patch was a degraded window
+  presented as *the* window, so it was withdrawn. That reasoning had one
+  unexamined premise — that the host can never have git — and this release
+  removes it, argued in ARCHITECTURE §16 ("The hosted window") before a line of
+  code moved.
+- **The host may hold a bare, READ-ONLY mirror of the board's DECLARED forge**,
+  at `<root>/<board>/mirror.git`, and only then does it answer `/git` and
+  `/ui/`. The mirror is derived and disposable in exactly the sense
+  `cache.sqlite` is: delete it and it re-clones; nothing in it is truth the
+  forge does not already hold. Its ONLY source is the repo the owner declared
+  with `taskops board forge` — it takes no client pushes, it is not a second
+  trunk, and nothing is ever read back into the log from it.
+- **A board that declared no forge is exactly what it was**: 404 on `/git`,
+  410 on `/ui/`, and each refusal now names the door — `taskops board forge
+  <owner>/<repo>` — instead of stranding the reader in a sentence about a host
+  they cannot change.
+- **No new credential type.** A public repo is mirrored anonymously; a private
+  one is fetched with an ssh deploy key on the host's filesystem, installed by
+  the OWNER, revocable on the forge — the one new credential this chapter adds,
+  and it is the owner's business exactly as `board forge` itself is. No stored
+  GitHub token, no dev credential travelling, no second identity system.
+- **The page opens on the FACT, never on a clone.** `/ui/` is granted by the
+  declared forge alone: the bundle's bytes come from the installed package, so
+  putting a network clone in front of `index.html` would take a static page down
+  whenever the forge is unreachable. The mirror resolves lazily the moment a
+  diff is actually read — which is where a failure belongs, in the diff pane, in
+  the door's own words.
+- **A missing ref buys exactly ONE bounded fetch**, then answers stale rather
+  than blocking a page on a forge that is down — and only on a mirror. A
+  window's own clone still fetches nothing on the reader's behalf: a background
+  fetch inside a read-only door would move a branch under a worktree somebody is
+  sitting in.
+- **Reads stay reads.** `/ui/` sits behind the credential `/rpc` asks for —
+  a `public` board serves the page to an anonymous reader, a private one refuses
+  with the same join sentence — and an anonymous page load writes nothing at
+  all, not even the invisible write: no presence row.
+
 ## 0.4.2 — the filter that filtered nothing, and the window that stopped signing in
 
 - **"All chapters" is an ARGUMENT now, and it really shows every chapter.** The

{taskops_cli-0.4.2 → taskops_cli-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: taskops-cli
-Version: 0.4.2
+Version: 0.5.0
 Summary: A shared work board for teams of coding agents, with a human who decides.
 Project-URL: Repository, https://github.com/bernatch22/taskops
 License-Expression: MIT
@@ -70,7 +70,7 @@ importable leaves commits un-stamped, silently.
 taskops init                              a local board in this repo
 taskops join [<name>] [--invite <id>]     join a board, install the hooks
 taskops remote add <url>                  the host this checkout operates, like git's origin
-taskops serve                             host boards — an events API, no dashboard
+taskops serve                             host boards — /ui and /git open per declared forge
 taskops server init                       bootstrap THIS host: its owner and their ssh key
 taskops board create|ls|push|pull|rm      the boards on a host
 taskops board visibility|forge            who may read one · which repo's team is enrolled
@@ -383,9 +383,11 @@ to bytes that are not in history yet is a pointer to nothing.
 ```
 
 Then `taskops ui` lists it under the chapter's **Reports** tab and renders it
-full width, read out of **your own clone** at that sha — the dashboard never
-asks the server for the bytes, and there is nothing to serve: a host running
-`taskops serve` answers `/git` with a 404, whole.
+full width, read out of **your own clone** at that sha — the local dashboard
+never asks the server for the bytes. A host running `taskops serve` answers
+`/git` too, from a bare read-only mirror of the board's DECLARED forge — the
+hosted window, for the reader with no clone. A board that never declared one
+refuses with a sentence naming `taskops board forge <owner>/<repo>`.
 
 **Reading one, from the other side.** Everything above is the author's half; a
 reader needs no ceremony at all. Three doors onto the same bytes:

{taskops_cli-0.4.2 → taskops_cli-0.5.0}/README.md

@@ -58,7 +58,7 @@ importable leaves commits un-stamped, silently.
 taskops init                              a local board in this repo
 taskops join [<name>] [--invite <id>]     join a board, install the hooks
 taskops remote add <url>                  the host this checkout operates, like git's origin
-taskops serve                             host boards — an events API, no dashboard
+taskops serve                             host boards — /ui and /git open per declared forge
 taskops server init                       bootstrap THIS host: its owner and their ssh key
 taskops board create|ls|push|pull|rm      the boards on a host
 taskops board visibility|forge            who may read one · which repo's team is enrolled
@@ -371,9 +371,11 @@ to bytes that are not in history yet is a pointer to nothing.
 ```
 
 Then `taskops ui` lists it under the chapter's **Reports** tab and renders it
-full width, read out of **your own clone** at that sha — the dashboard never
-asks the server for the bytes, and there is nothing to serve: a host running
-`taskops serve` answers `/git` with a 404, whole.
+full width, read out of **your own clone** at that sha — the local dashboard
+never asks the server for the bytes. A host running `taskops serve` answers
+`/git` too, from a bare read-only mirror of the board's DECLARED forge — the
+hosted window, for the reader with no clone. A board that never declared one
+refuses with a sentence naming `taskops board forge <owner>/<repo>`.
 
 **Reading one, from the other side.** Everything above is the author's half; a
 reader needs no ceremony at all. Three doors onto the same bytes:

{taskops_cli-0.4.2 → taskops_cli-0.5.0}/src/taskops/_version.py

@@ -1,4 +1,4 @@
 from __future__ import annotations
 
 __title__ = "taskops"
-__version__ = "0.4.2"  # single source of truth; pyproject reads it dynamically
+__version__ = "0.5.0"  # single source of truth; pyproject reads it dynamically

taskops_cli-0.5.0/src/taskops/gitwork/mirror.py

@@ -0,0 +1,132 @@
+"""The board's bare mirror — the forge's history, held so a host can answer.
+
+ARCHITECTURE §16 ("The hosted window") decided this on 2026-08-30: a board
+host MAY hold `<root>/<board>/mirror.git`, a bare `git clone --mirror` of the
+forge the owner declared with `board forge` — and only then does it answer
+`/git` and `/ui/`. The mirror is DERIVED and disposable in exactly the sense
+`cache.sqlite` is: delete it and `ensure` re-clones; nothing in it is truth
+the forge does not hold. Its ONLY source is that forge — it takes no client
+pushes, it is not a second trunk, and nothing here ever writes to it beyond
+what `clone` and `fetch` are.
+
+**The address is derived, never a credential.** The default remote is
+`https://<host>/<repo>.git`, spelled straight out of the declared fact
+(`core/forge.py` owns that shape) — an anonymous clone, which is all a public
+repo needs. A private repo is the owner's business: they point the mirror at
+an ssh remote backed by a deploy key on the host's filesystem (`url=` at
+clone time, or `git remote set-url` in a mirror that already exists), and
+this module neither knows nor stores anything about it. What §11 bans stays
+banned: no stored token, no write credential, no dev credential travelling.
+
+**Failures return None/False, never raise into a request.** These functions
+sit behind HTTP doors serving readers who cannot fix the host's network; a
+mirror that cannot answer is a stale page, not a 500. The same reasoning
+gave `remote.py::push` its 10-second budget, and `fetch` inherits the number:
+a refresh is never a gate, so it may never cost more than a moment. The one
+bounded on-demand fetch lives in `refresh_if_missing` — a requested ref that
+is absent buys exactly one fetch, then the answer is whatever is true, stale
+included. Answering stale beats blocking a page on a forge that is down.
+
+All subprocess goes through `run.py`, the one module allowed to import it —
+and `run.git` RAISES on a timeout (right for workers, wrong for a request),
+so the catch here is part of the contract, not belt-and-braces.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from . import run
+from ..core import forge as forge_facts
+from .._errors import TaskopsError
+
+__all__ = ["ensure", "fetch", "refresh_if_missing"]
+
+MIRROR = "mirror.git"
+"""§16's wording, verbatim: `<root>/<board>/mirror.git`, beside events.jsonl."""
+
+FETCH_TIMEOUT = 10.0
+"""`remote.py::PUSH_TIMEOUT`'s argument, pointing the other way: a refresh is
+never a gate. Worst case a reader waits ten seconds ONCE and gets the truth
+about this disk — which is what `gitdoor` answers anyway."""
+
+CLONE_TIMEOUT = 120.0
+"""A first clone moves the whole history, once, at mount time — not per
+request — so it gets `run.TIMEOUT`'s patience rather than `fetch`'s."""
+
+
+def _url(forge: object) -> str:
+    """The declared fact → the anonymous https remote, or "".
+
+    `forge_facts.understood` already collapses absent, cleared and
+    unintelligible to None, so an https URL is only ever built from a fact a
+    door would also act on. No token, no user@ — the address IS the whole
+    credential story for a public repo.
+    """
+    fact = forge_facts.understood(forge)
+    if fact is None:
+        return ""
+    return f"https://{fact['host']}/{fact['repo']}.git"
+
+
+def ensure(board_dir: Path, forge: object, *, url: str = "") -> Path | None:
+    """The mirror's path — cloning it into existence if this is the first ask.
+
+    An EXISTING `mirror.git` is returned untouched, whatever remote it holds:
+    that is how an owner's ssh remote (a deploy key's address) survives every
+    later call. `url=` overrides the derived address at clone time — the same
+    owner's move, and how tests clone from a local fixture instead of the
+    network. No forge and no url means no mirror, which is the state every
+    board is born in; a clone that fails leaves nothing behind, so the next
+    ask is a clean retry rather than a corpse mistaken for a mirror.
+    """
+    dest = board_dir / MIRROR
+    if dest.is_dir():
+        return dest
+    remote = url or _url(forge)
+    if not remote:
+        return None
+    try:
+        result = run.git("clone", "--mirror", remote, str(dest), timeout=CLONE_TIMEOUT)
+    except TaskopsError:
+        result = None  # timeout, or no git at all — a request never hears it
+    if result is None or not result.ok:
+        return None
+    return dest
+
+
+def fetch(mirror: Path) -> bool:
+    """One bounded fetch from the mirror's own remote. True means it ran clean.
+
+    A `--mirror` clone's fetch refspec already maps every ref one-to-one, so
+    plain `git fetch` IS the whole refresh — no refspec spelled here that
+    could drift from what clone configured. False covers everything a reader
+    cannot fix: a dead remote, a timeout, a directory that stopped being a
+    repo. The caller answers with what it has.
+    """
+    try:
+        return run.git("fetch", cwd=mirror, timeout=FETCH_TIMEOUT).ok
+    except TaskopsError:  # timeout, or no git at all — never the reader's problem
+        return False
+
+
+def _has(mirror: Path, ref: str) -> bool:
+    """`^{commit}` is load-bearing: bare `rev-parse --verify <40-hex>` answers
+    ok for ANY well-formed sha, present or not — a ref arriving as a full sha
+    (which is what a diff door holds) would always read as here."""
+    return run.git("rev-parse", "--verify", "--quiet", f"{ref}^{{commit}}", cwd=mirror).ok
+
+
+def refresh_if_missing(mirror: Path, ref: str) -> bool:
+    """Is `ref` here — after at most ONE fetch if it was not?
+
+    §16's exact promise: a missing ref triggers one bounded on-demand fetch
+    before answering stale. A ref already present costs nothing — no network
+    touched, so a page over known history never waits on a forge. A ref still
+    absent after the fetch is answered False, truthfully: "not here" is the
+    truth about this disk, and the door already knows how to say so.
+    """
+    if _has(mirror, ref):
+        return True
+    fetch(mirror)
+    return _has(mirror, ref)

{taskops_cli-0.4.2 → taskops_cli-0.5.0}/src/taskops/http/gitdoor.py

@@ -11,12 +11,14 @@ there is no second credential system, and `server.py` checks the credential
 before this module is reached.
 
 **Whether the door exists at all is decided ONCE, at construction**, never
-re-derived per request: `Mounts` carries `repo: Path | None`. `taskops ui` sits
+re-derived per request (`http/repos.py` resolves it per board). `taskops ui` sits
 inside a repo (its root is `<repo>/.taskops`) and passes it; `taskops serve`
-sits in a boards directory and passes nothing, so every /git request there is a
-404 whose message SAYS which case it is — the UI reads those words and falls
-through its cascade (numstat → /git → the forge link → an honest sentence)
-rather than showing a dead pane. ARCHITECTURE.md §16.
+sits in a boards directory and passes nothing FOR A BOARD WITH NO DECLARED
+FORGE, so /git there is a 404 whose message says which case it is — the UI falls
+through its cascade rather than a dead pane. A declared forge may instead mount
+a bare read-only mirror (`<root>/<board>/mirror.git` — §16, "The hosted
+window"): `NO_REPO` means "no checkout here and no mirror for this board",
+never "this host can never read git".
 
 This module only routes and refuses. Everything about git is `gitwork/diff.py`,
 which is where the ref validation lives.
@@ -39,6 +41,7 @@ from typing import Any
 from pathlib import Path
 from urllib.parse import unquote
 
+from . import stale
 from ..core import reports
 from .._errors import NotFound, BadRequest
 from ..gitwork import diff, patch
@@ -46,26 +49,12 @@ from ..gitwork import diff, patch
 NO_REPO = (
     "this host serves boards, not a repository — it was started outside a "
     "checkout (taskops serve), so there is no clone here to read a diff from. "
-    "A host that sits in a repo (taskops ui) answers /git."
+    "A host that sits in a repo (taskops ui) answers /git; a board with a "
+    "declared forge answers from its mirror when the host can hold one."
 )
 
 SEPARATOR = "..."
 
-STALE = (
-    "{refs} not in your clone yet — `{fetch}` brings {them}. The board is shared and "
-    "the code is not: a card's branch reaches origin when it closes, and this "
-    "window reads only the checkout it stands in. Nothing is fetched for you."
-)
-"""The MISSING-REF case, in its own words. It is not an error and must not read
-like one: on a shared board most refs belong to somebody else's card, and until
-you fetch, "not here yet" is simply the truth about your disk. Naming the exact
-command is this codebase's habit — every refusal names the call that works —
-and it is also the reason nothing fetches on the reader's behalf: a background
-`git fetch` inside a read-only door would move a branch under a worktree
-somebody is sitting in."""
-
-SHA = "0123456789abcdef"
-
 NOT_A_REPORT = (
     "{path} is not a report. This door serves committed files under "
     f"{reports.DIR} and nothing else — it is not a file server, and a read "
@@ -97,24 +86,34 @@ TEXT = "text/plain"
 MARKDOWN = "text/markdown"
 
 
-def answer(repo: Path | None, tail: str, query: str) -> dict[str, Any]:
-    """The whole door. `tail` is the path after `<board>/git/`."""
+def answer(
+    repo: Path | None, tail: str, query: str, *, mirrored: bool = False
+) -> dict[str, Any]:
+    """The whole door. `tail` is the path after `<board>/git/`. `mirrored`
+    says the repo is the board's mirror (`http/repos.py`), which is the one
+    case a missing ref buys a bounded fetch (`http/stale.py`)."""
     if repo is None:
         raise NotFound(NO_REPO)
     kind, _, rest = tail.partition("/")
     path = _param(query, "path") or None
     if kind == "file" and rest:
-        return _file(repo, unquote(rest), path or "")
+        return _file(repo, unquote(rest), path or "", mirrored)
     if kind == "commit" and rest:
         ref = unquote(rest)
         found = diff.commit_range(repo, ref)
+        if found is None and stale.refreshed(repo, mirrored, [ref]):
+            found = diff.commit_range(repo, ref)
         if found is None:
-            raise NotFound(_stale(ref))
+            raise NotFound(stale.sentence(ref))
     elif kind == "compare" and SEPARATOR in rest:
         left, _, right = unquote(rest).partition(SEPARATOR)
         found = diff.compare_range(repo, left, right)
         if found is None:
-            raise NotFound(_stale(*(r for r in (left, right) if not diff.resolve(repo, r))))
+            missing = [r for r in (left, right) if not diff.resolve(repo, r)]
+            if stale.refreshed(repo, mirrored, missing):
+                found = diff.compare_range(repo, left, right)
+            if found is None:
+                raise NotFound(stale.sentence(*missing))
     else:
         raise BadRequest(
             "git/commit/<ref>, git/compare/<a>...<b>, or git/file/<rev>?path=<file>"
@@ -122,7 +121,7 @@ def answer(repo: Path | None, tail: str, query: str) -> dict[str, Any]:
     return patch.between(repo, found[0], found[1], path)
 
 
-def _file(repo: Path, rev: str, wanted: str) -> dict[str, Any]:
+def _file(repo: Path, rev: str, wanted: str, mirrored: bool) -> dict[str, Any]:
     """One committed file at a rev — read-only, shape-guarded, capped.
 
     Three walls, in this order: the path is a REPORT path (`under()`, which
@@ -144,8 +143,10 @@ def _file(repo: Path, rev: str, wanted: str) -> dict[str, Any]:
     if not diff.usable(path):
         raise BadRequest(ODD_SHAPE.format(path=path, dir=reports.DIR))
     sha = diff.resolve(repo, rev)
+    if sha is None and stale.refreshed(repo, mirrored, [rev]):
+        sha = diff.resolve(repo, rev)
     if sha is None:
-        raise NotFound(_stale(rev))
+        raise NotFound(stale.sentence(rev))
     got = patch.show(repo, sha, path)
     if got is None:
         raise NotFound(ABSENT.format(path=path, sha=sha[:12]))
@@ -160,26 +161,6 @@ def _file(repo: Path, rev: str, wanted: str) -> dict[str, Any]:
     }
 
 
-def _stale(*refs: str) -> str:
-    """Which refs are missing, and the one command that brings them.
-
-    A sha is asked for WITHOUT a refspec — `git fetch origin <40 hex>` is
-    refused by most servers unless they allow it — while a branch is named, so
-    the reader can paste the line and get exactly what the pane wanted."""
-    names = [ref for ref in refs if ref] or ["that ref"]
-    branches = [ref for ref in names if not _looks_like_a_sha(ref)]
-    many = len(names) > 1
-    return STALE.format(
-        refs=f"{' and '.join(names)} {'are' if many else 'is'}",
-        fetch=" ".join(["git fetch origin", *branches]),
-        them="them" if many else "it",
-    )
-
-
-def _looks_like_a_sha(ref: str) -> bool:
-    return len(ref) >= 7 and all(char in SHA for char in ref.lower())
-
-
 def _param(query: str, key: str) -> str:
     for part in query.split("&"):
         name, _, value = part.partition("=")

{taskops_cli-0.4.2 → taskops_cli-0.5.0}/src/taskops/http/handler.py

@@ -67,7 +67,7 @@ class Handler(BaseHTTPRequestHandler):
         elif tail.startswith("git/"):
             self._git(board, tail[4:])
         elif tail.startswith("ui"):
-            self._static(tail[2:])
+            self._static(board, tail[2:])
         elif (page := static.at_root(self.mounts.ui, self.path)) is not None:
             self._send(200, *page)  # a WINDOW serves its page at the ROOT
         else:
@@ -121,14 +121,35 @@ class Handler(BaseHTTPRequestHandler):
         self._answer(lambda _: self._diff(board, rest))
 
     def _diff(self, board: str, rest: str) -> dict[str, Any]:
-        """Mounted from the LOCAL clone whether the board is local or remote —
-        that is the whole point of serving the window here (§16)."""
+        """A window answers from its own LOCAL clone; a serve-mode host from
+        the board's forge mirror — `repos.py` decides which, per board (§16)."""
         self.mounts.check(board)
         self._credential(board, "read")
-        return gitdoor.answer(self.mounts.repo, rest, self.path.partition("?")[2])
-
-    def _static(self, rest: str) -> None:  # `static.py` owns what it answers, and why
-        self._send(*static.answer(self.mounts.ui, rest))
+        repo, mirrored = self.mounts.repos.for_board(board)
+        return gitdoor.answer(repo, rest, self.path.partition("?")[2], mirrored=mirrored)
+
+    def _static(self, board: str, rest: str) -> None:
+        """The /ui door. A WINDOW serves its bundle to whoever reaches the port,
+        unchanged. A serve-mode HOST serves the SAME packaged bundle for a board
+        whose owner declared a forge (`repos.backed` — the fact, never a clone),
+        behind the credential /rpc asks for: public board, anonymous READ;
+        private board, the join refusal. The 410 comes BEFORE the credential on
+        purpose — it says nothing about the board a login would guard, and the
+        no-forge sentence predates keys on this door. A GET here runs no verb,
+        so an anonymous page load writes nothing — no presence row (§11)."""
+        if self.mounts.ui is not None:
+            self._send(*static.answer(self.mounts.ui, rest))
+            return
+        try:
+            self.mounts.check(board)
+            if not self.mounts.repos.backed(board):
+                self._send(*static.answer(None, rest))
+                return
+            self._credential(board, "read")
+        except TaskopsError as err:
+            self._fail(rpc.status_for(rpc.failure(err)), err)
+            return
+        self._send(*static.answer(static.PACKAGED, rest))
 
     # ── plumbing ────────────────────────────────────────────────────────────
 

{taskops_cli-0.4.2 → taskops_cli-0.5.0}/src/taskops/http/mounts.py

@@ -11,9 +11,10 @@ import re
 from pathlib import Path
 from threading import Lock
 
-from . import feed, watcher
+from . import feed, static, watcher
 from .. import verbs, _clock
 from .login import Host
+from .repos import Repos
 from ..verbs import project
 from .._errors import NotFound, BadRequest
 from .upstream import Upstream, seq_of
@@ -22,8 +23,6 @@ from ..store.stores import Stores
 
 NAME = re.compile(r"^[a-z0-9][a-z0-9-]{0,39}$")
 
-_PACKAGED_UI = Path(__file__).resolve().parent.parent / "ui"
-
 class Mounts:
     """The boards this process serves, opened once and kept.
 
@@ -45,16 +44,16 @@ class Mounts:
     ) -> None:
         self.root = root
         self.upstream = upstream
-        # The ONE place that decides whether this process can read a repo, and
-        # it is decided by the CALLER at construction, never sniffed per
-        # request (`gitdoor.py` carries the rest).
+        # Whether this process can read a repo is decided by the CALLER at
+        # construction — a window's own checkout — or, on a serve-mode host,
+        # per BOARD from its declared forge's mirror (`repos.py` carries it).
         self.repo = repo
-        # ONE switch, not two: the same `repo` that mounts /git mounts the bundle. A
-        # dashboard needs the viewer's CLONE to draw a diff, so a process with no clone
-        # has no business serving one — see `static.py` for the whole post-mortem. The
-        # bundle still ships inside the wheel; what went away is the server-side mount
-        # and the `--ui` flag that configured it.
-        self.ui = _PACKAGED_UI if repo is not None else None
+        self.repos = Repos(root, repo, self.stores)
+        # ONE switch, not two: the same `repo` that mounts /git mounts the bundle at
+        # the WINDOW's root. On a serve-mode host `ui` stays None and the /ui door asks
+        # `repos.backed()` per board instead — the forge fact, the same one that opens
+        # /git — see `static.py` and `repos.py` for the whole argument.
+        self.ui = static.PACKAGED if repo is not None else None
         self.credentials = Credentials(root / "live.sqlite")
         # The HOST's own identity, and it opens NOTHING until a login asks
         # (`login.py::Host` says why lazily is a rule here, not a taste).