fix: make autoMirrorStarred actually trigger auto-mirror (fixes #278) (#281)

The "Auto-mirror new starred repositories" checkbox in the GitHub settings
was a filter layered on top of scheduleConfig.autoMirror, which itself is
only settable via the AUTO_MIRROR_REPOS env var (no UI). So users who
checked the box saw their starred repos auto-imported but never mirrored.

Treat autoMirror and autoMirrorStarred as independent triggers in the
scheduler: autoMirror covers owned (and self-starred) repos, autoMirrorStarred
covers repos starred from other owners. Either flag on its own is enough
to enter the auto-mirror phase, and the filter scopes the work accordingly.

Also normalize the owner comparison to lowercase since GitHub usernames are
case-insensitive — previously a self-starred repo whose stored owner casing
differed from the configured owner would be misclassified as a third-party
star.

Behavior change worth flagging in release notes: anyone who currently has
the starred checkbox on (broken state) will start getting starred repos
mirrored on upgrade. AUTO_MIRROR_REPOS=true users see no change.

package.json

@@ -1,7 +1,7 @@
 {
   "name": "gitea-mirror",
   "type": "module",
-  "version": "3.15.5",
+  "version": "3.15.7",
   "engines": {
     "bun": ">=1.2.9"
   },

src/components/config/GiteaConfigForm.tsx

@@ -6,7 +6,9 @@ import {
   CardHeader,
   CardTitle,
 } from "@/components/ui/card";
-import { giteaApi } from "@/lib/api";
+import { Alert, AlertDescription, AlertTitle } from "@/components/ui/alert";
+import { AlertTriangle } from "lucide-react";
+import { giteaApi, type GiteaServerInfo } from "@/lib/api";
 import type { GiteaConfig, MirrorStrategy } from "@/types/config";
 import { toast } from "sonner";
 import { OrganizationStrategy } from "./OrganizationStrategy";
@@ -23,6 +25,7 @@ interface GiteaConfigFormProps {
 
 export function GiteaConfigForm({ config, setConfig, onAutoSave, isAutoSaving, githubUsername }: GiteaConfigFormProps) {
   const [isLoading, setIsLoading] = useState(false);
+  const [serverInfo, setServerInfo] = useState<GiteaServerInfo | null>(null);
   
   // Derive the mirror strategy from existing config for backward compatibility
   const getMirrorStrategy = (): MirrorStrategy => {
@@ -128,13 +131,16 @@ export function GiteaConfigForm({ config, setConfig, onAutoSave, isAutoSaving, g
     try {
       const result = await giteaApi.testConnection(config.url, config.token);
       if (result.success) {
+        setServerInfo(result.serverInfo ?? null);
         toast.success("Successfully connected to Gitea!");
       } else {
+        setServerInfo(null);
         toast.error(
           "Failed to connect to Gitea. Please check your URL and token."
         );
       }
     } catch (error) {
+      setServerInfo(null);
       toast.error(
         error instanceof Error ? error.message : "An unknown error occurred"
       );
@@ -162,6 +168,31 @@ export function GiteaConfigForm({ config, setConfig, onAutoSave, isAutoSaving, g
       </CardHeader>
 
       <CardContent className="flex flex-col gap-y-6 flex-1">
+        {serverInfo?.type === "forgejo" && serverInfo.hasMirrorCredBug && (
+          <Alert variant="warning">
+            <AlertTriangle className="h-4 w-4" />
+            <AlertTitle>
+              Forgejo {serverInfo.version} has a known mirror-credential bug
+            </AlertTitle>
+            <AlertDescription>
+              <p>
+                Pull-mirror credentials sent via Forgejo's migrate API aren't persisted on this version, so subsequent syncs of private repos fail with <code className="text-xs font-mono bg-amber-100 dark:bg-amber-900/40 px-1 py-0.5 rounded">terminal prompts disabled</code>. Fixed in Forgejo 15.0.0 (
+                <a
+                  href="https://codeberg.org/forgejo/forgejo/pulls/11909"
+                  target="_blank"
+                  rel="noopener noreferrer"
+                  className="underline underline-offset-2"
+                >
+                  PR #11909
+                </a>
+                ).
+              </p>
+              <p>
+                Upgrade Forgejo to 15.0.0 or later, then delete and re-mirror affected repos — or open each repo's Settings → Mirror Settings in Forgejo and re-enter the GitHub token once.
+              </p>
+            </AlertDescription>
+          </Alert>
+        )}
         <div>
           <label
             htmlFor="gitea-username"

src/lib/api.ts

@@ -87,12 +87,22 @@ export const githubApi = {
 };
 
 // Gitea API
+export interface GiteaServerInfo {
+  type: "forgejo" | "gitea";
+  version: string;
+  raw: string;
+  hasMirrorCredBug: boolean;
+}
+
 export const giteaApi = {
   testConnection: (url: string, token: string) =>
-    apiRequest<{ success: boolean }>("/gitea/test-connection", {
-      method: "POST",
-      body: JSON.stringify({ url, token }),
-    }),
+    apiRequest<{ success: boolean; serverInfo?: GiteaServerInfo; message?: string }>(
+      "/gitea/test-connection",
+      {
+        method: "POST",
+        body: JSON.stringify({ url, token }),
+      }
+    ),
 };
 
 // Health API

src/lib/gitea-mirror-failure-recovery.test.ts

@@ -0,0 +1,132 @@
+/**
+ * Regression test for issue #268.
+ *
+ * `let migrateSucceeded = false;` was declared *inside* the try block
+ * of mirrorGithubRepoToGitea and mirrorGitHubRepoToGiteaOrg, but the
+ * catch block referenced it. `let` is block-scoped to the try, so any
+ * error inside try made the catch crash with `ReferenceError:
+ * migrateSucceeded is not defined` before reaching the DB update that
+ * marks the repo "failed". Result: repos stuck in "mirroring" forever
+ * with no entry in the activity log (see issue logs).
+ *
+ * This test asserts the declaration is hoisted above the try block in
+ * both functions. It deliberately reads the source rather than calling
+ * the functions, because behavioral tests for these functions require
+ * heavy module mocks that pollute other test files (bun's mock.module
+ * is process-wide and persists across files).
+ */
+import { describe, test, expect } from "bun:test";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+const SOURCE = readFileSync(
+  join(import.meta.dir, "gitea.ts"),
+  "utf8"
+);
+
+/**
+ * Locate the body of a function declaration by name. Walks from the
+ * declaration, balances parens to skip the parameter list (which can
+ * contain destructured object literals with their own braces), then
+ * finds the body's opening brace and its matching close.
+ */
+function extractFunctionBody(source: string, declarationStart: RegExp): string {
+  const match = source.match(declarationStart);
+  if (!match) {
+    throw new Error(`Could not locate declaration ${declarationStart}`);
+  }
+  let i = match.index! + match[0].length;
+  // Skip whitespace until the opening paren of the parameter list.
+  while (i < source.length && source[i] !== "(") i++;
+  if (source[i] !== "(") {
+    throw new Error(`No '(' after ${declarationStart}`);
+  }
+  // Balance parens to find the end of the parameter list. Braces inside
+  // the parameter list (e.g. destructured `{ foo, bar }`) are allowed
+  // and ignored.
+  let parenDepth = 0;
+  for (; i < source.length; i++) {
+    if (source[i] === "(") parenDepth++;
+    else if (source[i] === ")") {
+      parenDepth--;
+      if (parenDepth === 0) {
+        i++;
+        break;
+      }
+    }
+  }
+  // Skip return-type annotation, => arrow, whitespace, until the body's `{`.
+  while (i < source.length && source[i] !== "{") i++;
+  if (source[i] !== "{") {
+    throw new Error(`No body '{' for ${declarationStart}`);
+  }
+  // Balance braces for the body.
+  let braceDepth = 0;
+  const startIdx = i;
+  for (; i < source.length; i++) {
+    if (source[i] === "{") braceDepth++;
+    else if (source[i] === "}") {
+      braceDepth--;
+      if (braceDepth === 0) {
+        return source.slice(startIdx, i + 1);
+      }
+    }
+  }
+  throw new Error(`Unterminated body for ${declarationStart}`);
+}
+
+/**
+ * Confirm that within a function body, the first `let migrateSucceeded`
+ * declaration occurs BEFORE the function's outermost `try {`.
+ *
+ * If the declaration is inside the try block, the catch block can't see
+ * it (ReferenceError in production = repo stuck mirroring).
+ */
+function assertMigrateSucceededDeclaredBeforeTry(body: string, label: string) {
+  const declIdx = body.indexOf("let migrateSucceeded");
+  expect(declIdx, `${label}: 'let migrateSucceeded' should exist`).toBeGreaterThanOrEqual(0);
+
+  // The function's outermost try is the first standalone `try {` in
+  // the body — assignments and inner try/catches don't share its name.
+  const tryIdx = body.search(/\btry\s*\{/);
+  expect(tryIdx, `${label}: outermost 'try {' should exist`).toBeGreaterThanOrEqual(0);
+
+  expect(
+    declIdx,
+    `${label}: 'let migrateSucceeded' must be declared BEFORE the try block ` +
+      `so the catch block can read it. If declared inside try, it's block-scoped ` +
+      `and the catch will throw ReferenceError, leaving repos stuck in 'mirroring'. ` +
+      `See issue #268.`
+  ).toBeLessThan(tryIdx);
+
+  // And it should still be assigned to true after the migrate call —
+  // otherwise the catch can't tell whether to clear mirroredLocation.
+  expect(
+    body.includes("migrateSucceeded = true"),
+    `${label}: 'migrateSucceeded = true' assignment should exist after the migrate call`
+  ).toBe(true);
+
+  // And the catch must read it.
+  expect(
+    body.includes("if (!migrateSucceeded)"),
+    `${label}: catch block should read 'migrateSucceeded' to decide whether to clear mirroredLocation`
+  ).toBe(true);
+}
+
+describe("issue #268 — migrateSucceeded scoping regression", () => {
+  test("mirrorGithubRepoToGitea declares migrateSucceeded outside try", () => {
+    const body = extractFunctionBody(
+      SOURCE,
+      /export const mirrorGithubRepoToGitea = async\b/
+    );
+    assertMigrateSucceededDeclaredBeforeTry(body, "mirrorGithubRepoToGitea");
+  });
+
+  test("mirrorGitHubRepoToGiteaOrg declares migrateSucceeded outside try", () => {
+    const body = extractFunctionBody(
+      SOURCE,
+      /export async function mirrorGitHubRepoToGiteaOrg\b/
+    );
+    assertMigrateSucceededDeclaredBeforeTry(body, "mirrorGitHubRepoToGiteaOrg");
+  });
+});

src/lib/gitea.ts

@@ -539,6 +539,11 @@ export const mirrorGithubRepoToGitea = async ({
   repository: Repository;
   config: Partial<Config>;
 }): Promise<any> => {
+  // Declared here (not inside try) so the catch block can read it.
+  // `let` is block-scoped — declaring inside try makes it inaccessible
+  // from catch, which previously caused a ReferenceError that swallowed
+  // the real error and left repos stuck in "mirroring" state.
+  let migrateSucceeded = false;
   try {
     if (!config.userId || !config.githubConfig || !config.giteaConfig) {
       throw new Error("github config and gitea config are required.");
@@ -837,10 +842,6 @@ export const mirrorGithubRepoToGitea = async ({
       );
     }
 
-    // Track whether the Gitea migrate call succeeded so the catch block
-    // knows whether to clear mirroredLocation (only safe before migrate succeeds)
-    let migrateSucceeded = false;
-
     const response = await httpPost(
       apiUrl,
       migratePayload,
@@ -1321,6 +1322,9 @@ export async function mirrorGitHubRepoToGiteaOrg({
   giteaOrgId: number;
   orgName: string;
 }) {
+  // Declared here (not inside try) so the catch block can read it.
+  // See note in mirrorGithubRepoToGitea for the scoping bug this prevents.
+  let migrateSucceeded = false;
   try {
     if (
       !config.giteaConfig?.url ||
@@ -1528,8 +1532,6 @@ export async function mirrorGitHubRepoToGiteaOrg({
       );
     }
 
-    let migrateSucceeded = false;
-
     const migrateRes = await httpPost(
       apiUrl,
       migratePayload,

src/lib/scheduler-service.test.ts

@@ -58,6 +58,51 @@ describe("Scheduler Service - Ignored Repository Handling", () => {
     expect(shouldMirrorRepository(oldSyncedRepo)).toBe(true);
   });
 
+  test("auto-mirror filter respects autoMirror and autoMirrorStarred independently", () => {
+    // Mirrors the inline filter at scheduler-service.ts L228-233 / L609-614:
+    // a repo is "starred from another owner" iff isStarred && owner !== githubOwner.
+    // Such repos are gated by autoMirrorStarred; everything else is gated by autoMirror.
+    const githubOwner = "Alice".toLowerCase();
+    const filterRepos = (
+      repos: Array<{ name: string; isStarred: boolean; owner: string }>,
+      autoMirror: boolean,
+      autoMirrorStarred: boolean,
+    ) =>
+      repos.filter(repo => {
+        const isStarredFromOther = repo.isStarred && repo.owner.toLowerCase() !== githubOwner;
+        return isStarredFromOther ? autoMirrorStarred : autoMirror;
+      });
+
+    // "ALICE" tests case-insensitive owner match — GitHub usernames are case-insensitive,
+    // so a self-starred repo stored with different casing must still count as owned.
+    const repos = [
+      { name: "owned-repo", isStarred: false, owner: "alice" },
+      { name: "self-starred", isStarred: true, owner: "ALICE" },
+      { name: "starred-from-bob", isStarred: true, owner: "bob" },
+    ];
+
+    // Both off: nothing mirrors
+    expect(filterRepos(repos, false, false).map(r => r.name)).toEqual([]);
+
+    // Only autoMirror: owned + self-starred, not third-party stars
+    expect(filterRepos(repos, true, false).map(r => r.name)).toEqual([
+      "owned-repo",
+      "self-starred",
+    ]);
+
+    // Only autoMirrorStarred: just third-party stars (the bug fix — used to be empty)
+    expect(filterRepos(repos, false, true).map(r => r.name)).toEqual([
+      "starred-from-bob",
+    ]);
+
+    // Both on: everything
+    expect(filterRepos(repos, true, true).map(r => r.name)).toEqual([
+      "owned-repo",
+      "self-starred",
+      "starred-from-bob",
+    ]);
+  });
+
   test("should validate all repository status enum values", () => {
     const validStatuses = [
       "imported",

src/lib/scheduler-service.ts

@@ -203,10 +203,14 @@ async function runScheduledSync(config: any): Promise<void> {
       }
     }
     
-    // Auto-mirror: Mirror imported/pending/failed repositories if enabled
-    if (scheduleConfig.autoMirror) {
+    // Auto-mirror: Mirror imported/pending/failed repositories if enabled.
+    // autoMirror covers owned repos; autoMirrorStarred covers starred repos from other owners.
+    // Either flag on its own is enough to enter this phase.
+    const autoMirrorOwned = !!scheduleConfig.autoMirror;
+    const autoMirrorStarred = !!config.githubConfig?.autoMirrorStarred;
+    if (autoMirrorOwned || autoMirrorStarred) {
       try {
-        console.log(`[Scheduler] Auto-mirror enabled - checking for repositories to mirror for user ${userId}...`);
+        console.log(`[Scheduler] Auto-mirror enabled (owned=${autoMirrorOwned}, starred=${autoMirrorStarred}) - checking for repositories to mirror for user ${userId}...`);
         let reposNeedingMirror = await db
           .select()
           .from(repositories)
@@ -221,17 +225,16 @@ async function runScheduledSync(config: any): Promise<void> {
             )
           );
 
-        // Filter out starred repos from auto-mirror when autoMirrorStarred is disabled
-        if (!config.githubConfig?.autoMirrorStarred) {
-          const githubOwner = config.githubConfig?.owner || '';
-          const beforeCount = reposNeedingMirror.length;
-          reposNeedingMirror = reposNeedingMirror.filter(
-            repo => !repo.isStarred || repo.owner === githubOwner
-          );
-          const skippedCount = beforeCount - reposNeedingMirror.length;
-          if (skippedCount > 0) {
-            console.log(`[Scheduler] Skipped ${skippedCount} starred repositories from auto-mirror (autoMirrorStarred is disabled)`);
-          }
+        const githubOwner = (config.githubConfig?.owner || '').toLowerCase();
+        const beforeCount = reposNeedingMirror.length;
+        reposNeedingMirror = reposNeedingMirror.filter(repo => {
+          // GitHub usernames are case-insensitive; lowercase both sides to avoid misclassifying self-starred repos.
+          const isStarredFromOther = repo.isStarred && repo.owner.toLowerCase() !== githubOwner;
+          return isStarredFromOther ? autoMirrorStarred : autoMirrorOwned;
+        });
+        const skippedCount = beforeCount - reposNeedingMirror.length;
+        if (skippedCount > 0) {
+          console.log(`[Scheduler] Skipped ${skippedCount} repositories from auto-mirror (autoMirror=${autoMirrorOwned}, autoMirrorStarred=${autoMirrorStarred})`);
         }
 
         if (reposNeedingMirror.length > 0) {
@@ -574,10 +577,12 @@ async function performInitialAutoStart(): Promise<void> {
           continue;
         }
         
-        // Step 2: Trigger mirror for all repositories that need mirroring
-        // Only auto-mirror if autoMirror is enabled in schedule config
-        if (!config.scheduleConfig?.autoMirror) {
-          console.log(`[Scheduler] Step 2: Skipping initial mirror - autoMirror is disabled for user ${config.userId}`);
+        // Step 2: Trigger mirror for all repositories that need mirroring.
+        // autoMirror covers owned repos; autoMirrorStarred covers starred repos from other owners.
+        const autoMirrorOwned = !!config.scheduleConfig?.autoMirror;
+        const autoMirrorStarred = !!config.githubConfig?.autoMirrorStarred;
+        if (!autoMirrorOwned && !autoMirrorStarred) {
+          console.log(`[Scheduler] Step 2: Skipping initial mirror - autoMirror and autoMirrorStarred are both disabled for user ${config.userId}`);
 
           // Still update schedule config timestamps
           const currentTime2 = new Date();
@@ -587,7 +592,7 @@ async function performInitialAutoStart(): Promise<void> {
           continue;
         }
 
-        console.log(`[Scheduler] Step 2: Triggering mirror for repositories that need mirroring...`);
+        console.log(`[Scheduler] Step 2: Triggering mirror for repositories that need mirroring (owned=${autoMirrorOwned}, starred=${autoMirrorStarred})...`);
         let reposNeedingMirror = await db
           .select()
           .from(repositories)
@@ -602,17 +607,16 @@ async function performInitialAutoStart(): Promise<void> {
             )
           );
 
-        // Filter out starred repos from auto-mirror when autoMirrorStarred is disabled
-        if (!config.githubConfig?.autoMirrorStarred) {
-          const githubOwner = config.githubConfig?.owner || '';
-          const beforeCount = reposNeedingMirror.length;
-          reposNeedingMirror = reposNeedingMirror.filter(
-            repo => !repo.isStarred || repo.owner === githubOwner
-          );
-          const skippedCount = beforeCount - reposNeedingMirror.length;
-          if (skippedCount > 0) {
-            console.log(`[Scheduler] Skipped ${skippedCount} starred repositories from initial auto-mirror (autoMirrorStarred is disabled)`);
-          }
+        const githubOwner = (config.githubConfig?.owner || '').toLowerCase();
+        const beforeCount = reposNeedingMirror.length;
+        reposNeedingMirror = reposNeedingMirror.filter(repo => {
+          // GitHub usernames are case-insensitive; lowercase both sides to avoid misclassifying self-starred repos.
+          const isStarredFromOther = repo.isStarred && repo.owner.toLowerCase() !== githubOwner;
+          return isStarredFromOther ? autoMirrorStarred : autoMirrorOwned;
+        });
+        const skippedCount = beforeCount - reposNeedingMirror.length;
+        if (skippedCount > 0) {
+          console.log(`[Scheduler] Skipped ${skippedCount} repositories from initial auto-mirror (autoMirror=${autoMirrorOwned}, autoMirrorStarred=${autoMirrorStarred})`);
         }
 
         if (reposNeedingMirror.length > 0) {

src/pages/api/gitea/test-connection.ts

@@ -2,6 +2,25 @@ import type { APIRoute } from 'astro';
 import { httpGet, HttpError } from '@/lib/http-client';
 import { createSecureErrorResponse } from '@/lib/utils';
 
+// Forgejo reports `15.0.0+gitea-1.22.0`; pure Gitea reports just `1.22.0`.
+// Forgejo < 15.0.0 has a known bug where pull-mirror credentials sent via
+// /api/v1/repos/migrate are not persisted, so subsequent sync of private
+// repos fails with `terminal prompts disabled`. Fixed upstream in v15.0.0
+// via PR #11909 (codeberg.org/forgejo/forgejo/pulls/11909).
+function parseServerInfo(versionString: string) {
+  const forgejoMatch = versionString.match(/^(\d+)\.(\d+)\.(\d+)\+gitea-/);
+  if (forgejoMatch) {
+    const major = Number(forgejoMatch[1]);
+    return {
+      type: 'forgejo' as const,
+      version: `${forgejoMatch[1]}.${forgejoMatch[2]}.${forgejoMatch[3]}`,
+      raw: versionString,
+      hasMirrorCredBug: major < 15,
+    };
+  }
+  return { type: 'gitea' as const, version: versionString, raw: versionString, hasMirrorCredBug: false };
+}
+
 export const POST: APIRoute = async ({ request }) => {
   try {
     const body = await request.json();
@@ -49,7 +68,18 @@ export const POST: APIRoute = async ({ request }) => {
       );
     }
 
-    // Return success response with user data
+    let serverInfo: ReturnType<typeof parseServerInfo> | undefined;
+    try {
+      const versionResp = await httpGet(`${baseUrl}/api/v1/version`, {
+        'Accept': 'application/json',
+      });
+      if (typeof versionResp.data?.version === 'string') {
+        serverInfo = parseServerInfo(versionResp.data.version);
+      }
+    } catch {
+      // Version probe is best-effort; older or non-standard servers may not expose it.
+    }
+
     return new Response(
       JSON.stringify({
         success: true,
@@ -59,6 +89,7 @@ export const POST: APIRoute = async ({ request }) => {
           name: data.full_name,
           avatar_url: data.avatar_url,
         },
+        serverInfo,
       }),
       {
         status: 200,