From ab3c5f520081223ecb2aeaeda99692c63b869aec Mon Sep 17 00:00:00 2001 From: teahubxyz Date: Mon, 19 Oct 2026 03:18:50 +0000 Subject: [PATCH] Sync: a repo's copies on other forges follow its home (GitHub first, for cloud sessions) (#177) Sync: a repo's copies on other forges follow its home (#177) sync.py + time/sync.json + the sync workflow. One home per repo, one writer per branch: main goes out to every copy fast-forward only (a diverged copy is a needs-human issue, never overwritten, unless forced once); a copy's claude/* branches come home as PRs for the council. First copy: github.com/teahubxyz/time, skipped until GITHUB_MIRROR_TOKEN. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_017K4vyY3yUD3GsvoZaAtKkD --- .github/time/sync.py | 197 +++++++++++++++++++++++++++++++++++++ .github/time/test_time.py | 79 +++++++++++++++ .github/workflows/sync.yml | 35 +++++++ CHANGELOG.md | 1 + time/sync.json | 7 ++ 5 files changed, 319 insertions(+) create mode 100644 .github/time/sync.py create mode 100644 .github/workflows/sync.yml create mode 100644 time/sync.json diff --git a/.github/time/sync.py b/.github/time/sync.py new file mode 100644 index 0000000..689a4f8 --- /dev/null +++ b/.github/time/sync.py @@ -0,0 +1,197 @@ +"""Sync: keep a repo's copies on other forges in step with its home (time/sync.json). + + python3 .github/time/sync.py # every repo in time/sync.json; this forge is the home + +One rule keeps it safe: each repo has one home, and every branch has one writer. Two writers on one branch is how work +gets lost, which is why neither of Gitea's own mirrors fits: a push mirror force-pushes every branch (it would delete a +cloud session's branch on the copy), and a pull mirror makes the receiving repo read-only. + +- Out: the home's branches in `out` (default: main) are pushed to every copy, fast-forward only. A copy whose branch + has commits of its own is reported (one issue on this repo), never overwritten. SYNC_FORCE=1 (the workflow's `force` + input) force-pushes once, e.g. to replace an archived copy's old history. +- In: branches on a copy that match its `import` patterns (claude/* for cloud sessions on GitHub) are the copy's to + write. They are pushed to the home under the same name and get a PR there, which Time's council reviews and lands + like any other; the landed work then flows back out with main. A branch already in main, or one whose PR was closed + at the same commit, is left alone. + +time/sync.json: + {"repos": [{"repo": "teahubxyz/time", "out": ["main"], + "copies": [{"name": "github", "url": "https://github.com/teahubxyz/time.git", + "token": "GITHUB_MIRROR_TOKEN", "import": ["claude/*"]}]}]} + +`token` names a secret (an environment variable the workflow passes), never the token itself; a copy whose token isn't +set is skipped with a note. The same script syncs Gitea with Gitea: it runs on the home, so a pair the home can't +reach (hb-5's local Gitea from prod) runs from the side that can reach both, with that side's own sync.json. +""" +from __future__ import annotations + +import base64 +import fnmatch +import importlib.util +import json +import os +import subprocess +import sys +import tempfile +import urllib.parse +from pathlib import Path + +HERE = Path(__file__).resolve().parent +_spec = importlib.util.spec_from_file_location("tm", HERE / "time.py") +tm = importlib.util.module_from_spec(_spec) +_spec.loader.exec_module(tm) +CONFIG = "time/sync.json" +SECRETS: list[str] = [] # every token used this run, scrubbed from anything printed or posted + + +def scrub(text: str) -> str: + for s in SECRETS: + if s: + text = text.replace(s, "***").replace(urllib.parse.quote(s, safe=""), "***") + return text + + +def config() -> list[dict]: + """time/sync.json on the default branch, through the API (the workflow checks out only .github/time).""" + try: + f = tm.gh("GET", f"/repos/{tm.REPO}/contents/{CONFIG}") + except RuntimeError as e: + if "-> 404" in str(e): + return [] + raise + data = json.loads(base64.b64decode(f.get("content") or "").decode() or "{}") + return [r for r in data.get("repos") or [] if isinstance(r, dict)] + + +def authed(url: str, token: str, user: str = "x-access-token") -> str: + """The URL with credentials, for https; file:// and the like as given.""" + p = urllib.parse.urlsplit(url) + if p.scheme not in ("https", "http") or not token: + return url + SECRETS.append(token) + cred = f"{urllib.parse.quote(user, safe='')}:{urllib.parse.quote(token, safe='')}" + return urllib.parse.urlunsplit((p.scheme, f"{cred}@{p.netloc}", p.path, p.query, p.fragment)) + + +def git(*args: str, cwd: str | None = None, check: bool = True) -> subprocess.CompletedProcess: + p = subprocess.run(["git", *args], cwd=cwd, capture_output=True, text=True, timeout=300, + env={**os.environ, "GIT_TERMINAL_PROMPT": "0"}) + if check and p.returncode: + raise RuntimeError(f"git {args[0]} failed: {scrub(p.stderr.strip())[-400:]}") + return p + + +def heads(url: str, cwd: str) -> dict[str, str]: + """{branch: sha} of a remote.""" + out = git("ls-remote", "--heads", url, cwd=cwd).stdout + return {ref.split("refs/heads/", 1)[1]: sha for sha, ref in (line.split("\t") for line in out.splitlines() if "\t" in line)} + + +def push_out(work: str, home: dict[str, str], url: str, branch: str, force: bool) -> str: + """One home branch to one copy: 'up to date', 'pushed', 'forced' or 'diverged' (the copy has commits of its own).""" + if branch not in home: + return "missing on the home" + p = git("push", "--porcelain", url, f"{'+' if force else ''}refs/home/{branch}:refs/heads/{branch}", cwd=work, check=False) + text = p.stdout + p.stderr + if p.returncode == 0: + return "up to date" if "[up to date]" in text else ("forced" if force else "pushed") + if "[rejected]" in text or "non-fast-forward" in text or "fetch first" in text: + return "diverged" + raise RuntimeError(f"push {branch} failed: {scrub(text.strip())[-400:]}") + + +def landed(work: str, ref: str, base: str) -> bool: + return git("merge-base", "--is-ancestor", ref, base, cwd=work, check=False).returncode == 0 + + +def ensure_pr(repo: str, work: str, branch: str, base: str, copy: str, where: str) -> int | None: + """A PR on the home for an imported branch, unless one is open for it, it is already in the base, or a PR for it + was closed at this same commit (a human or the council said no; a new push brings it back).""" + ref = f"refs/copy/{branch}" + if landed(work, ref, f"refs/home/{base}"): + return None + tip = git("rev-parse", ref, cwd=work).stdout.strip() + for p in tm.gh("GET", f"/repos/{repo}/pulls?state=all&limit=50") or []: + head = p.get("head") or {} + if head.get("ref") == branch and (p.get("state") == "open" or head.get("sha") == tip): + return None + log = git("log", "--reverse", "--format=%s%n%n%b%n---", f"refs/home/{base}..{ref}", cwd=work).stdout.strip() + title = (log.splitlines() or [branch])[0][:200] + body = (f"From {copy}: `{branch}` ({where}), brought in by sync.py. Time's council reviews it like any PR.\n\n" + f"Commits:\n\n{log[:6000]}\n\nsync.py: edit this branch on {copy}; it is the copy's to write, and the " + f"next sync brings the change here.") + return tm.gh("POST", f"/repos/{repo}/pulls", {"head": branch, "base": base, "title": title, "body": body})["number"] + + +def sync_repo(entry: dict, home_url: str, force: bool = False) -> dict: + repo = entry.get("repo") or tm.REPO + out = [b for b in entry.get("out") or ["main"] if isinstance(b, str)] + base = out[0] + report: dict = {"repo": repo, "copies": []} + with tempfile.TemporaryDirectory() as work: + git("init", "--bare", "-q", work) + home = heads(home_url, work) + wanted = [b for b in out if b in home] + if wanted: + git("fetch", "-q", home_url, *[f"+refs/heads/{b}:refs/home/{b}" for b in wanted], cwd=work) + for c in entry.get("copies") or []: + name, where = str(c.get("name") or c.get("url")), str(c.get("url") or "") + token = os.environ.get(str(c.get("token") or ""), "") if c.get("token") else "" + r: dict = {"copy": name, "out": {}, "imported": [], "prs": [], "note": ""} + report["copies"].append(r) + if c.get("token") and not token: + r["note"] = f"skipped: the secret {c['token']} isn't set" + continue + url = authed(where, token, str(c.get("user") or "x-access-token")) + for b in out: + r["out"][b] = push_out(work, home, url, b, force) + pats = [p for p in c.get("import") or [] if isinstance(p, str)] + if not pats: + continue + theirs = heads(url, work) + mine = heads(home_url, work) + for branch, sha in sorted(theirs.items()): + if branch in out or not any(fnmatch.fnmatch(branch, p) for p in pats): + continue + git("fetch", "-q", url, f"+refs/heads/{branch}:refs/copy/{branch}", cwd=work) + if mine.get(branch) != sha: # the copy writes this branch: the home takes it as it is + git("push", "-q", "--force", home_url, f"refs/copy/{branch}:refs/heads/{branch}", cwd=work) + r["imported"].append(branch) + n = ensure_pr(repo, work, branch, base, name, where) + if n: + r["prs"].append(n) + return report + + +def flag(repo: str, copy: str, branch: str) -> None: + """One open issue per diverged copy branch, labelled needs-human: whether to force is a human's (or the CEO's) + call, so neither the worker nor the router takes it.""" + title = f"Sync: {copy}'s {branch} has commits of its own ({repo})" + if any(i.get("title") == title for i in tm.issues("state=open")): + return + tm.new_issue(title, f"sync.py pushes `{branch}` from the home to {copy} fast-forward only, and {copy}'s `{branch}` has " + f"commits the home doesn't. Nothing was overwritten. Either bring those commits to the home (a branch " + f"and a PR), or replace {copy}'s history: Actions → sync → Run workflow with `force`.\n\n" + f"DONE: {copy}'s `{branch}` follows the home again and this sync run is green.", ["needs-human"]) + + +def main() -> int: + entries = config() + if not entries: + print(f"sync: no {CONFIG}, nothing to sync") + return 0 + force = (os.environ.get("SYNC_FORCE") or "").lower() in ("1", "true", "yes") + token = os.environ.get("TIME_TOKEN") or os.environ.get("GITHUB_TOKEN") or "" + for e in entries: + repo = e.get("repo") or tm.REPO + rep = sync_repo(e, authed(f"{tm.SERVER}/{repo}.git", token), force) + for c in rep["copies"]: + print(f"sync {repo} -> {c['copy']}: out {c['out']} imported {c['imported']} prs {c['prs']} {c['note']}".rstrip()) + for b, state in c["out"].items(): + if state == "diverged" and repo == tm.REPO: + flag(repo, c["copy"], b) + return 0 + + +if __name__ == "__main__": + sys.exit(main()) diff --git a/.github/time/test_time.py b/.github/time/test_time.py index 3688bd4..30a62cf 100644 --- a/.github/time/test_time.py +++ b/.github/time/test_time.py @@ -1287,6 +1287,85 @@ assert tm.pools() == [] and tm.pool_for("anthropic") is None, "no pools.json: no tm.gh = real_gh82; tm._pools = None print("ALL OK 82") +# 83 sync.py: a repo's copies on other forges follow its home. main goes out fast-forward only (a copy with commits of +# its own is reported, never overwritten, unless forced once); a copy's claude/* branches come back as PRs on the home +import subprocess as _sp83, tempfile as _tf83 +sspec = importlib.util.spec_from_file_location("sync83", Path(__file__).resolve().parent / "sync.py") +sy = importlib.util.module_from_spec(sspec); sspec.loader.exec_module(sy) +root83 = _tf83.mkdtemp() +def g83(*a, cwd=None): + return _sp83.run(["git", "-c", "user.email=t@t", "-c", "user.name=t", "-c", "init.defaultBranch=main", *a], cwd=cwd, + capture_output=True, text=True, check=True).stdout.strip() +def commit83(cwd, name, msg): + Path(cwd, name).write_text(msg); g83("add", "-A", cwd=cwd); g83("commit", "-qm", msg, cwd=cwd) +home83, copy83, wk83, cw83 = (os.path.join(root83, x) for x in ("home.git", "copy.git", "w", "cw")) +g83("init", "--bare", "-q", home83); g83("init", "--bare", "-q", copy83); g83("clone", "-q", home83, wk83) +commit83(wk83, "a.txt", "A"); g83("push", "-q", "origin", "HEAD:main", cwd=wk83) +prs83, made83 = [], [] +def gh83(method, path, body=None, **k): + if path.startswith("/repos/o/r/pulls?"): + return [dict(p) for p in prs83] + if path == "/repos/o/r/pulls" and method == "POST": + made83.append(body); prs83.append({"number": 100 + len(made83), "state": "open", "head": {"ref": body["head"], "sha": "?"}}) + return {"number": 100 + len(made83)} + raise AssertionError((method, path)) +sy.tm.gh = gh83 +entry83 = {"repo": "o/r", "copies": [{"name": "github", "url": "file://" + copy83, "import": ["claude/*"]}]} +sync83 = lambda **k: sy.sync_repo(entry83, "file://" + home83, **k)["copies"][0] +c83 = sync83() +assert c83["out"] == {"main": "pushed"} and c83["imported"] == [] and not made83, c83 +assert g83("rev-parse", "main", cwd=copy83) == g83("rev-parse", "main", cwd=home83) +assert sync83()["out"] == {"main": "up to date"} +# a cloud session's branch on the copy comes home as a PR, its commit messages in the body (so `Closes #N` adopts a card) +g83("clone", "-q", copy83, cw83) +g83("checkout", "-qb", "claude/fix", cwd=cw83); commit83(cw83, "b.txt", "Fix the thing\n\nCloses #5"); g83("push", "-q", "origin", "claude/fix", cwd=cw83) +g83("checkout", "-qb", "other/y", cwd=cw83); commit83(cw83, "c.txt", "Not for the home"); g83("push", "-q", "origin", "other/y", cwd=cw83) +c83 = sync83() +assert c83["imported"] == ["claude/fix"] and c83["prs"] == [101], c83 +assert made83[0]["head"] == "claude/fix" and made83[0]["base"] == "main" and made83[0]["title"] == "Fix the thing" and "Closes #5" in made83[0]["body"] +assert g83("rev-parse", "claude/fix", cwd=home83) == g83("rev-parse", "claude/fix", cwd=copy83) +assert "other/y" not in g83("branch", cwd=home83), "only the copy's import patterns come home" +c83 = sync83() +assert c83["imported"] == [] and c83["prs"] == [] and len(made83) == 1, "nothing new: no second PR" +# the copy rewrites its branch (a rebase): the home takes it as it is, since the copy is that branch's one writer +g83("checkout", "-q", "claude/fix", cwd=cw83); g83("commit", "-q", "--amend", "-m", "Fix the thing, better\n\nCloses #5", cwd=cw83) +g83("push", "-q", "--force", "origin", "claude/fix", cwd=cw83) +assert sync83()["imported"] == ["claude/fix"] and g83("rev-parse", "claude/fix", cwd=home83) == g83("rev-parse", "claude/fix", cwd=copy83) +# landed on the home: main goes out to the copy, and a branch already in main gets no PR +g83("fetch", "-q", "origin", "claude/fix", cwd=wk83); g83("merge", "-q", "--ff-only", "FETCH_HEAD", cwd=wk83); g83("push", "-q", "origin", "HEAD:main", cwd=wk83) +prs83[0]["state"] = "closed" +c83 = sync83() +assert c83["out"] == {"main": "pushed"} and c83["prs"] == [] and g83("rev-parse", "main", cwd=copy83) == g83("rev-parse", "main", cwd=home83) +# a PR closed at the branch's current commit stays closed; a new push to the branch brings it back +g83("checkout", "-qb", "claude/nope", cwd=cw83); g83("fetch", "-q", "origin", cwd=cw83); g83("reset", "-q", "--hard", "origin/main", cwd=cw83) +commit83(cw83, "d.txt", "A bad idea"); g83("push", "-q", "origin", "claude/nope", cwd=cw83) +assert sync83()["prs"] == [102] +prs83[-1].update(state="closed", head={"ref": "claude/nope", "sha": g83("rev-parse", "claude/nope", cwd=copy83)}) +assert sync83()["prs"] == [], "closed at this commit: left alone" +commit83(cw83, "d.txt", "A better idea"); g83("push", "-q", "origin", "claude/nope", cwd=cw83) +assert sync83()["prs"] == [103], "a new commit reopens the question" +# the copy's main has commits of its own: reported, never overwritten, unless forced once +g83("checkout", "-q", "main", cwd=cw83); g83("reset", "-q", "--hard", "origin/main", cwd=cw83) +commit83(cw83, "e.txt", "Written on the copy's main"); g83("push", "-q", "origin", "main", cwd=cw83) +commit83(wk83, "f.txt", "The home moves on"); g83("push", "-q", "origin", "HEAD:main", cwd=wk83) +copy_main83 = g83("rev-parse", "main", cwd=copy83) +assert sync83()["out"] == {"main": "diverged"} and g83("rev-parse", "main", cwd=copy83) == copy_main83 +flagged83 = [] +sy.tm.issues = lambda q: [{"title": t} for t, _, _ in flagged83] +sy.tm.new_issue = lambda title, body, labels: flagged83.append((title, body, labels)) or {"number": 1} +sy.flag("o/r", "github", "main"); sy.flag("o/r", "github", "main") +assert len(flagged83) == 1 and "force" in flagged83[0][1] and flagged83[0][2] == ["needs-human"], "one issue per diverged branch, a human's" +assert sync83(force=True)["out"] == {"main": "forced"} and g83("rev-parse", "main", cwd=copy83) == g83("rev-parse", "main", cwd=home83) +# a copy whose token isn't set is skipped; tokens go in the URL and never into anything printed +c83 = sy.sync_repo({"repo": "o/r", "copies": [{"name": "gh", "url": "https://github.com/o/r.git", "token": "NO_SUCH_TOKEN_83"}]}, + "file://" + home83)["copies"][0] +assert c83["note"] == "skipped: the secret NO_SUCH_TOKEN_83 isn't set" and c83["out"] == {} +assert sy.authed("https://github.com/o/r.git", "t0k/en") == "https://x-access-token:t0k%2Fen@github.com/o/r.git" +assert sy.authed("file:///x", "t0k") == "file:///x" and sy.scrub("https://x-access-token:t0k%2Fen@github.com said t0k/en") == "https://x-access-token:***@github.com said ***" +sy.tm.gh = lambda *a, **k: (_ for _ in ()).throw(RuntimeError("GET x -> 404: not found")) +assert sy.config() == [] and sy.main() == 0, "no sync.json: nothing to sync" +print("ALL OK 83") + # ---------- venture loop lifecycle: these still run against the old GitHub-shaped fake (Pages API, author_association, # per_page); the Gitea shapes are pinned by 79 above. They run only with TIME_TEST_VENTURE=1 until the fake is ported. diff --git a/.github/workflows/sync.yml b/.github/workflows/sync.yml new file mode 100644 index 0000000..88284d4 --- /dev/null +++ b/.github/workflows/sync.yml @@ -0,0 +1,35 @@ +name: sync +# Keeps this repo's copies on other forges in step with it (time/sync.json, .github/time/sync.py). One home, one writer +# per branch: main goes out to every copy, fast-forward only (a copy with commits of its own is reported, never +# overwritten); the branches a copy is told to send back (claude/* from cloud sessions on GitHub) come in as PRs here, +# and Time's council reviews and lands them like any other. Each copy's token is a secret named in sync.json and passed +# below; a copy without one is skipped. On a GitHub copy, turn GitHub Actions off: these workflows must run here only. +on: + push: + branches: [main] + schedule: + - cron: "*/15 * * * *" + workflow_dispatch: + inputs: + force: + description: "Force-push main to the copies once (replaces a copy's own history, e.g. an archived copy's)" + type: boolean + default: false +concurrency: + group: sync + cancel-in-progress: false +jobs: + sync: + runs-on: ubuntu-latest + timeout-minutes: 10 + steps: + - uses: actions/checkout@v5 + with: + sparse-checkout: .github/time + persist-credentials: false + - run: python3 .github/time/sync.py + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + TIME_TOKEN: ${{ secrets.TIME_TOKEN }} # branches and PRs on the home go in as the `time` user + SYNC_FORCE: ${{ inputs.force && '1' || '' }} + GITHUB_MIRROR_TOKEN: ${{ secrets.GITHUB_MIRROR_TOKEN }} # github.com/teahubxyz/time: Contents read/write diff --git a/CHANGELOG.md b/CHANGELOG.md index 9a39df1..ec5065d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -24,6 +24,7 @@ - The second fix round escalates to a different model from the first round: `claude:opus` with the Claude seats (it was `venice:kimi code`, and grok 4.7 before that). `TIME_VENTURE_ESCALATE` overrides it. ### Added +- Sync (`sync.py`, `time/sync.json`, the `sync` workflow): a repo's copies on other forges follow its home, under one rule, one home per repo and one writer per branch. The home's `main` (the `out` branches) goes to every copy fast-forward only; a copy with commits of its own is reported in a `needs-human` issue and never overwritten, unless the `force` dispatch input replaces its history once. A copy's branches matching its `import` patterns (`claude/*` from cloud sessions) are the copy's to write: they come back to the home under the same name with a PR, commit messages in the body (so a `Closes #N` adopts the card), and Time's council reviews and lands them; a branch already in `main`, or one whose PR was closed at the same commit, is left alone. Gitea's own mirrors don't fit: a push mirror force-pushes every branch (it would delete the copy's work branches) and a pull mirror makes the home read-only. Tokens are secrets named in the file, scrubbed from every message. The first copy is `github.com/teahubxyz/time`, so cloud sessions clone a current engine; it is skipped until `GITHUB_MIRROR_TOKEN` is set, and GitHub Actions must be off on it. The same script syncs Gitea with Gitea, run from whichever side can reach both. - Adaptive budget: spend is paced to each capacity pool instead of one fixed daily cap. `time/pools.json` (kept by the operator) lists the pools: `expiring` credit allows `(balance - spent since as_of) / days to resets_at x TIME_PACE` a day (default 1.0), so a quiet day raises tomorrow's share; a `window` pool (`weekly:mon`, `hours:5`) allows `window_usd` per window and refills at its reset; a `balance` pool keeps `TIME_DAILY_USD`. A call is checked against the pool its provider books to, and `TIME_DAILY_USD` is the fallback for a route with no pool; the monthly cap stays global. Ledger rows carry a `pool` field, `doctor` prints each pool's balance, spend, next reset and today's allowance, and Astra's log line reports spend per pool. It ships with an empty `pools.json`, so nothing changes until the operator fills it in. `pools.json` is read through the API once per run, like the ledger, since every workflow checks out only `.github/time`. - The router (time#68, #72; `router.py`, `time/router.json`): the factory picks its own next work across ventures, features, refinements and optimizations. Astra's seat no longer picks cards in prose; it judges every candidate (each open card with a `DONE:` line that isn't a parent, a human's or the venture loop's own, plus "start a new venture") with a kind, a value 1–5 and a size S/M/L, and code ranks them: `weight[kind] × restless(kind) × age × (value + 0.5 × cards waiting on it) / size`. The weights are the owner's dial per kind (all 1, balanced); a kind not picked lately climbs (`restless`, 0.05 a day for up to 10 days) so none starves; an L is ranked but never queued (split it first). The Astra log shows the ranked table. `mode: dry` posts it and touches nothing; `live` queues from the top while the day's money left covers each card's estimated cost (`cost_usd`), writes the seat's new cards unqueued (candidates the next day), and the heartbeat's `promote_next` promotes queued cards in the live ranking's order instead of oldest first. `off`, or no file, is the planner as before. It starts `dry`. The policy is one function, so a bandit policy (Beth, Jev, Fable's maths) can replace it. Astra also reads the last 14 days of its log instead of the thread's first twenty comments. - A signup's Venture field matches the venture's slug, name, home folder or an old slug, ignoring case, spaces and punctuation. The field is typed by a person (Teahub does not prefill it from the link), who writes "Cartridge" or "Loot Drop", not `box-art-night`; those signups were not counted. diff --git a/time/sync.json b/time/sync.json new file mode 100644 index 0000000..a042f4c --- /dev/null +++ b/time/sync.json @@ -0,0 +1,7 @@ +{ + "_about": "Copies of repos on other forges, kept in step by .github/time/sync.py (the sync workflow). Each repo has one home (this forge) and every branch one writer: the `out` branches go from the home to each copy, fast-forward only; a copy's branches matching its `import` patterns come back to the home as PRs. `token` names the secret holding the copy's token, never the token itself; a copy whose secret isn't set is skipped. A GitHub copy needs GitHub Actions turned off, since these workflows must only run here.", + "repos": [ + {"repo": "teahubxyz/time", "out": ["main"], + "copies": [{"name": "github", "url": "https://github.com/teahubxyz/time.git", "token": "GITHUB_MIRROR_TOKEN", "import": ["claude/*"]}]} + ] +}