From 917c0b6b524d1b09de4dc84d2f85d047ce03300b Mon Sep 17 00:00:00 2001
From: Codex <codex@local>
Date: Mon, 13 Jul 2026 15:01:22 +0200
Subject: [PATCH 1/2] =?UTF-8?q?docs:=20=E8=B7=9F=E8=B8=AA=20Gitea=20mirror?=
 =?UTF-8?q?=20plan=20=E5=9B=9E=E5=BD=92?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 docs/MDTODO/github-gitea-durable-source-authority.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/docs/MDTODO/github-gitea-durable-source-authority.md b/docs/MDTODO/github-gitea-durable-source-authority.md
index 1e63233d..a2236b36 100644
--- a/docs/MDTODO/github-gitea-durable-source-authority.md
+++ b/docs/MDTODO/github-gitea-durable-source-authority.md
@@ -49,3 +49,7 @@
 ### R3.3
 
 依赖 R3.2，覆盖仓库缺失、ref 缺失、重复 delivery、controller 重启、retry exhaustion 与恢复测试；只用修复 PR merge 产生的新自动事件验收 resource bundle 获取成功，禁止人工 mirror、sync、flush、trigger 或 direct GitHub 补洞，完成任务后将详细报告写入[任务报告](./details/github-gitea-durable-source-authority/R3.3_Task_Report.md)。
+
+## R4 [in_progress]
+
+修复 [UniDesk #1933](https://github.com/pikasTech/unidesk/issues/1933) 暴露的 Gitea mirror 默认只读 plan 回归：恢复 repository-scoped targetRepos 计算，保持 mutation authority 不变，补充最小回归验证并由独立 Artificer PR 交付，完成任务后将详细报告写入[任务报告](./details/github-gitea-durable-source-authority/R4_Task_Report.md)。

From e3214917de130c5a8f897b286abae4323bae662d Mon Sep 17 00:00:00 2001
From: Codex <codex@local>
Date: Mon, 13 Jul 2026 15:15:38 +0200
Subject: [PATCH 2/2] fix: restore repository-scoped Gitea mirror plan

---
 scripts/src/cicd-delivery-authority.test.ts | 10 ++++++++--
 scripts/src/platform-infra-gitea.ts         |  3 ++-
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/scripts/src/cicd-delivery-authority.test.ts b/scripts/src/cicd-delivery-authority.test.ts
index fc9a06c8..1a2cc73d 100644
--- a/scripts/src/cicd-delivery-authority.test.ts
+++ b/scripts/src/cicd-delivery-authority.test.ts
@@ -498,9 +498,13 @@ describe("migrated CLI 执行 guard 与提示清理", () => {
   });
 
   test("Gitea 与 mirror 默认 plan 只返回只读 Next", async () => {
+    const giteaPlan = await runPlatformInfraGiteaCommand({} as never, ["plan", "--target", "NC01", "--raw"]) as Record<string, unknown>;
+    const nc01MirrorPlan = await runPlatformInfraGiteaCommand({} as never, ["mirror", "plan", "--target", "NC01", "--raw"]) as Record<string, unknown>;
+    const jd01MirrorPlan = await runPlatformInfraGiteaCommand({} as never, ["mirror", "plan", "--target", "JD01", "--raw"]) as Record<string, unknown>;
     const plans = [
-      await runPlatformInfraGiteaCommand({} as never, ["plan", "--target", "NC01", "--raw"]),
-      await runPlatformInfraGiteaCommand({} as never, ["mirror", "plan", "--target", "NC01", "--raw"]),
+      giteaPlan,
+      nc01MirrorPlan,
+      jd01MirrorPlan,
     ] as Record<string, unknown>[];
     for (const plan of plans) {
       expect(plan.mutation).toBe(false);
@@ -508,6 +512,8 @@ describe("migrated CLI 执行 guard 与提示清理", () => {
       expect(JSON.stringify(plan.next)).toContain("status");
       expect(JSON.stringify(plan.next)).toContain(PAC_AUTOMATIC_DELIVERY_REFERENCE);
     }
+    expect(JSON.stringify(nc01MirrorPlan.credentials)).toContain("github-upstream:selfmedia-nc01");
+    expect(JSON.stringify(jd01MirrorPlan.credentials)).not.toContain("github-upstream:selfmedia-nc01");
   });
 
   test("PaC history detail 只按唯一 consumer 生成 Next，四类前缀无默认 consumer 回退", () => {
diff --git a/scripts/src/platform-infra-gitea.ts b/scripts/src/platform-infra-gitea.ts
index 0f01c99b..5cfb4e25 100644
--- a/scripts/src/platform-infra-gitea.ts
+++ b/scripts/src/platform-infra-gitea.ts
@@ -314,6 +314,7 @@ async function mirrorWebhookCommand(config: UniDeskConfig, args: string[]): Prom
 function mirrorPlan(options: CommonOptions): Record<string, unknown> {
   const gitea = readGiteaConfig();
   const target = resolveCommandTarget(gitea, options.targetId);
+  const targetRepos = repositoriesForTarget(gitea, target);
   return {
     ok: true,
     action: "platform-infra-gitea-mirror-plan",
@@ -321,7 +322,7 @@ function mirrorPlan(options: CommonOptions): Record<string, unknown> {
     target: targetSummary(target),
     sourceAuthority: sourceAuthoritySummary(gitea, target),
     responsibilities: gitea.sourceAuthority.responsibilities.map(responsibilitySummary),
-    repositories: repositoriesForTarget(gitea, target).map((repo) => repositorySummary(gitea, repo)),
+    repositories: targetRepos.map((repo) => repositorySummary(gitea, repo)),
     credentials: credentialSummaries(gitea, targetRepos),
     next: mirrorReadOnlyNextCommands(target.id),
   };