fix: render bounded webhook credential blockers

scripts/src/platform-infra-gitea-config.test.ts

@@ -83,4 +83,59 @@ describe("platform-infra Gitea repository GitHub credentials", () => {
     expect(stdout).not.toContain('"stack"');
     expect(result.stderr.toString()).not.toContain("platform-infra-gitea.ts:");
   });
+
+  test("renders missing selfmedia webhook status as compact text by default", () => {
+    const result = Bun.spawnSync({
+      cmd: [
+        "bun",
+        "scripts/cli.ts",
+        "platform-infra",
+        "gitea",
+        "mirror",
+        "webhook",
+        "status",
+        "--target",
+        "NC01",
+        "--repo",
+        "selfmedia-nc01",
+      ],
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const stdout = result.stdout.toString();
+
+    expect(stdout).toContain("PLATFORM-INFRA GITEA MIRROR WEBHOOK STATUS");
+    expect(stdout).toContain("SOURCE_REF");
+    expect(stdout).toContain("pikainc-selfmedia-gh-token.txt");
+    expect(stdout).toContain("PERMISSION_RESULT");
+    expect(stdout).toContain("github-upstream:selfmedia-nc01");
+    expect(stdout.trimStart()).not.toStartWith("{");
+    expect(stdout).not.toContain('"stack"');
+    expect(result.stderr.toString()).not.toContain("platform-infra-gitea.ts:");
+  });
+
+  test("matches compact blocker rows to their repository without --repo", () => {
+    const result = Bun.spawnSync({
+      cmd: [
+        "bun",
+        "scripts/cli.ts",
+        "platform-infra",
+        "gitea",
+        "mirror",
+        "webhook",
+        "status",
+        "--target",
+        "NC01",
+      ],
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const stdout = result.stdout.toString();
+
+    expect(stdout).toContain("pikainc/selfmedia");
+    expect(stdout).toContain("pikainc-selfmedia-gh-token.txt");
+    expect(stdout).toContain("github-upstream:selfmedia-nc01");
+    expect(stdout).not.toContain("pikasTech/agentrun");
+    expect(stdout.trimStart()).not.toStartWith("{");
+  });
 });

scripts/src/platform-infra-gitea-render.ts

@@ -107,6 +107,44 @@ export function renderMirrorWebhookApply(result: Record<string, unknown>): Rende
   ]);
 }
 
+export function renderMirrorWebhookCredentialBlocked(result: Record<string, unknown>): RenderedCliResult {
+  const target = record(result.target);
+  const error = record(result.error);
+  const blockerIds = Array.isArray(error.blockers) ? error.blockers.map(String) : [];
+  const repositories = arrayRecords(result.repositories);
+  const credentials = arrayRecords(result.credentials);
+  const rows = blockerIds.map((blocker) => {
+    const credential = credentials.find((item) => stringValue(item.id) === blocker) ?? {};
+    const permissionResult = record(credential.permissionResult);
+    const permissions = record(permissionResult.permissions);
+    const repoKey = blocker.includes(":") ? blocker.slice(blocker.indexOf(":") + 1) : "";
+    const repository = repositories.find((item) => stringValue(item.key) === repoKey) ?? {};
+    const permissionText = [
+      `status=${stringValue(permissionResult.status)}`,
+      `contents=${stringValue(permissions.contents)}`,
+      `metadata=${stringValue(permissions.metadata)}`,
+      `webhooks=${stringValue(permissions.webhooks)}`,
+    ].join(",");
+    return [
+      stringValue(target.id),
+      stringValue(credential.repository, stringValue(repository.upstreamRepository)),
+      stringValue(credential.sourceRef),
+      boolText(credential.present),
+      stringValue(credential.fingerprint),
+      permissionText,
+      blocker,
+      boolText(credential.valuesPrinted),
+    ];
+  });
+  const next = record(result.next);
+  return rendered(result, "platform-infra gitea mirror webhook status", [
+    "PLATFORM-INFRA GITEA MIRROR WEBHOOK STATUS",
+    ...(rows.length === 0 ? ["-"] : table(["TARGET", "REPOSITORY", "SOURCE_REF", "PRESENT", "FINGERPRINT", "PERMISSION_RESULT", "BLOCKER", "VALUES_PRINTED"], rows)),
+    "",
+    `NEXT  ${stringValue(next.webhookStatusFull)}`,
+  ]);
+}
+
 export function renderMirrorWebhookStatus(result: Record<string, unknown>, disclosure: Record<string, unknown>): RenderedCliResult {
   const repos = arrayRecords(result.repositories).map((repo) => {
     const delivery = record(repo.selectedPushDelivery);

scripts/src/platform-infra-gitea.ts

@@ -30,6 +30,7 @@ import {
   renderMirrorStatus,
   renderMirrorSync,
   renderMirrorWebhookApply,
+  renderMirrorWebhookCredentialBlocked,
   renderMirrorWebhookStatus,
   renderPlan,
   renderStatus,
@@ -298,7 +299,7 @@ async function mirrorWebhookCommand(config: UniDeskConfig, args: string[]): Prom
   if (action === "status") {
     const options = parseMirrorWebhookStatusOptions(args.slice(1));
     const result = await mirrorWebhookStatus(config, options);
-    if (result.credentialBlocked === true) return result;
+    if (result.credentialBlocked === true) return options.full || options.raw ? result : renderMirrorWebhookCredentialBlocked(result);
     if (options.raw) return rawMirrorWebhookStatus(result);
     const disclosure = buildMirrorWebhookStatusDisclosure(result, options);
     return options.full ? disclosure : renderMirrorWebhookStatus(result, disclosure);