gitea: the app — repos, code, issues, pulls, notifications

Replicates what Gitea's own web UI offers, on top of the sidecar's /_api pass-through.

Repository browsing (tree, file view with the FileViewer's shiki renderer, README), commits,
branches, tags, releases, issues and pull requests both per-repo and cross-repo, notifications,
explore/search and organizations. Routes are /gitea/:section plus /gitea/repo/:owner/:name/:tab/:item,
all real Links with the URL as the source of truth — no selection channel.

Markdown is rendered client-side (react-markdown + remark-gfm + rehype-sanitize, rehype-raw
deliberately absent) rather than through the instance's /api/v1/markdown, because consuming that
means dangerouslySetInnerHTML and there is no DOMPurify in the tree with installs frozen. The cost
is Gitea's #123 and @mention cross-references; relative links and images are resolved instead.
The /markdown and /markup allow-list entries stay, so that door is open when a sanitiser lands.

retargetUrls rebases instance-minted URLs onto a browser-reachable origin, IN ONE DIRECTION ONLY.
This instance answers with two: /user and /repos build from its configured ROOT_URL
(http://localhost:9004), /contents from the public host. An unconditional rewrite onto the
connection URL therefore broke the second set to match the first, turning working https links into
dead loopback ones. Only a private/loopback URL is rewritten now, and only when the target is
itself public; when the connection URL is a dial address nothing is touched and the connection
screen says why avatars will not load.

Also carries the frontend half of the one-instance-many-tokens model: the connection form draws a
URL field only for the owner and sends no url key at all for anyone else, ServiceConnection.url is
string | null to match officerdb, and the rebase origin comes from the resolved instanceUrl rather
than connection.url, which is null for a member.

Not verified: no runtime pass since the last four changes, the issues and pull views have never
rendered a row (the instance has none), and the member path has never executed (one account).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/api/gitea/router.ts

@@ -0,0 +1,16 @@
+import { createSidecarProxy } from '../../sidecar/create-proxy';
+
+// /api/gitea/* — auth, then forward to officer-gitea. No routes of its own and no Gitea knowledge:
+// this file must never grow app logic.
+//
+// The sidecar owns the Gitea contract and holds the personal access token. The platform knows neither.
+
+const proxy = createSidecarProxy({
+  name: 'gitea',
+  prefix: '/api/gitea',
+});
+
+export const giteaRouter = proxy.router;
+
+/** Base URL of the sidecar's HTTP server, or null if it hasn't reported in yet. */
+export const getGiteaServerUrl = proxy.getHttpUrl;

src/servers/hono.ts

@@ -33,6 +33,7 @@ import { vpnRouter } from './api/vpn/router';
 import { terminalRouter } from './api/terminal/sidecar-server';
 import { caldavRouter } from './api/dav/sidecar-server';
 import { memosRouter } from './api/memos/router';
+import { giteaRouter } from './api/gitea/router';
 import { davSyncRouter } from './api/dav/sync-router';
 import { davRouter } from './api/dav/router';
 import { claimIosProfile } from './api/dav/ios-profile';
@@ -164,6 +165,7 @@ protectedRouter.route('/music', musicRouter);
 protectedRouter.route('/slskd', slskdRouter);
 protectedRouter.route('/terminal', terminalRouter);
 protectedRouter.route('/memos', memosRouter);
+protectedRouter.route('/gitea', giteaRouter);
 protectedRouter.route('/caldav', caldavRouter); // the JSON door for Officer's own calendar/contacts UI
 protectedRouter.route('/dav', davRouter); // app-password management (the sync door is /dav, top-level)
 protectedRouter.route('/notify', notifyRouter);

src/servers/sidecar/gitea/index.ts

@@ -54,6 +54,11 @@ const API_URL = process.env.API_URL ?? `ws://127.0.0.1:${process.env.PORT ?? '50
 const ALLOWED = [
   /^\/api\/v1\/version(\/|$|\?)/,
   /^\/api\/v1\/user(\/|$|\?)/,
+  // Public profile data. Note this prefix also covers `/users/{name}/tokens`, which lists and CREATES
+  // access tokens — a token-minting door if it were reachable. It is not: Gitea requires basic auth there
+  // precisely to stop a token escalating its own scopes, and answers `401 auth required` to the
+  // `Authorization: token …` this sidecar sends. Verified against 1.27.0 on 2026-08-06. That protection is
+  // GITEA's, not ours, so if this ever needs re-checking on an upgrade, that is the endpoint to re-check.
   /^\/api\/v1\/users(\/|$|\?)/,
   /^\/api\/v1\/orgs(\/|$|\?)/,
   /^\/api\/v1\/org(\/|$|\?)/,

src/servers/sidecar/protocol.ts

@@ -77,6 +77,8 @@ export type SidecarEvent =
   | { type: 'photos:server'; port: number }
   // Memos — the sidecar reports where its HTTP server is listening (random port) on connect
   | { type: 'memos:server'; port: number }
+  // Gitea — the sidecar reports where its HTTP server is listening (random port) on connect
+  | { type: 'gitea:server'; port: number }
   // CalDAV/CardDAV — the sidecar reports where its HTTP server is listening (random port) on connect.
   // One port serves both doors: /dav (forwarded to Radicale) and /_officer (JSON for Officer's UI).
   | { type: 'caldav:server'; port: number }