Implement the Gitea extension

The repository was a bare Nova scaffold. This builds it out to match the capabilities of the official Gitea VS Code extension. Sidebar sections: - Current Branch: pull requests and workflow runs for the checked-out branch, with a current/all/pinned branch filter - Workflows: runs grouped by workflow file, expanding into jobs, steps, and artifacts - Pull Requests: open pull requests across repositories, expanding into reviews, review comments, and changed files - Settings: per-instance connection state, plus repository Actions secrets and variables Commands cover run control (re-run, re-run failed jobs, re-run a job, cancel), job logs, artifact download/reveal/open, pull request overview, diff, checkout, creation, merge and close, the full review cycle, and secret and variable management. Multiple instances are supported, routed by git remote host, with tokens held per instance in the Keychain. Nova exposes no webview, diff editor, editor decorations, or extension status bar, so four features are shaped differently from the VS Code original: the pull request timeline renders as Markdown, diffs open as unified .diff documents, review comments are published through an IssueCollection so they appear in the gutter and the Issues sidebar, and a failed run posts a notification. OAuth and insecureSkipVerify have no Nova equivalent and are omitted. README.md records all of this. Endpoints were taken from Gitea's published swagger.v1.json. Servers predating the workflow runs API fall back to /actions/tasks. Tests/ runs the extension's real code under Node against a stubbed Nova runtime and a canned Gitea instance: 88 checks, no install step and no network. Images are generated by Tools/make-icons.py. Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01MQuusXgZC2dzwpJJ1qhtti
2026-08-28 19:55:54 -03:00
commit 694609a3cc
58 changed files with 6231 additions and 0 deletions
@@ -0,0 +1,117 @@
+//
+// "Current Branch" section: the pull requests and workflow runs that belong to
+// the branch checked out in the workspace (or to the configured branch filter).
+//
+
+const builders = require("./builders.js");
+const config = require("../util/config.js");
+const nodes = require("./nodes.js");
+const { NodeProvider } = require("./provider.js");
+
+const { node, message, errorNode } = nodes;
+
+class BranchProvider extends NodeProvider {
+    roots() {
+        const store = this.store;
+
+        if (!store.router.baseUrls.length) {
+            return [message("No Gitea instance configured. Open the extension preferences.")];
+        }
+        if (!store.hasAnyToken) {
+            return [message("No token stored. Run “Gitea → Set Token…” to sign in.")];
+        }
+        if (!store.repos.length) {
+            return [
+                message(
+                    store.loading
+                        ? "Loading…"
+                        : "No repository in this workspace points at a configured Gitea instance.",
+                ),
+            ];
+        }
+
+        const filter = config.branchFilter();
+        const sections = store.repos.map((repo) => this.repoSection(repo, filter));
+        return store.repos.length === 1 ? sections[0].children : sections;
+    }
+
+    repoSection(repo, filter) {
+        const branch = this.store.branchFor(repo);
+        const label =
+            filter.mode === "all"
+                ? "all branches"
+                : branch || "no branch (detached HEAD)";
+
+        return node("repo", repo.fullName, {
+            identifier: `branch-repo-${repo.key}`,
+            description: label,
+            tooltip: `${repo.htmlUrl}\nBranch filter: ${label}`,
+            contextValue: "repo",
+            repo: repo,
+            data: { repoKey: repo.key },
+            expanded: true,
+            children: [this.pullRequestsFolder(repo, branch), this.runsFolder(repo, branch)],
+        });
+    }
+
+    pullRequestsFolder(repo, branch) {
+        const { items, error } = this.store.pullRequestsFor(repo.key);
+        const matching = branch
+            ? items.filter((pull) => pull.head && pull.head.ref === branch)
+            : items;
+
+        let children;
+        if (error) children = [errorNode(error)];
+        else if (!matching.length) {
+            children = [
+                message(
+                    branch
+                        ? `No open pull request from ${branch}.`
+                        : "No open pull requests.",
+                ),
+            ];
+        } else {
+            children = matching.map((pull) => builders.pullRequestNode(this.store, repo, pull));
+        }
+
+        return node("prFolder", "Pull Requests", {
+            identifier: `branch-prs-${repo.key}`,
+            description: matching.length ? String(matching.length) : "",
+            contextValue: "prFolder",
+            repo: repo,
+            expanded: true,
+            children: children,
+        });
+    }
+
+    runsFolder(repo, branch) {
+        const { runs, error, legacy } = this.store.runsFor(repo.key);
+        const matching = branch ? runs.filter((run) => run.head_branch === branch) : runs;
+
+        let children;
+        if (error) children = [errorNode(error)];
+        else if (!matching.length) {
+            children = [
+                message(branch ? `No runs for ${branch}.` : "No workflow runs."),
+            ];
+        } else {
+            children = matching.map((run) =>
+                builders.runNode(this.store, repo, run, { showBranch: !branch }),
+            );
+        }
+
+        return node("runsFolder", legacy ? "Recent Runs" : "Workflow Runs", {
+            identifier: `branch-runs-${repo.key}`,
+            description: matching.length ? String(matching.length) : "",
+            tooltip: legacy
+                ? "This Gitea server predates the workflow runs API; showing recent tasks instead."
+                : "",
+            contextValue: "runsFolder",
+            repo: repo,
+            expanded: true,
+            children: children,
+        });
+    }
+}
+
+exports.BranchProvider = BranchProvider;
@@ -0,0 +1,286 @@
+//
+// Node builders shared by the Current Branch, Workflows, and Pull Requests
+// sections so the same run, job, and pull request rows behave identically
+// wherever they appear.
+//
+
+const nodes = require("./nodes.js");
+const time = require("../util/time.js");
+const { isActiveRun } = require("../store.js");
+
+const { node, message } = nodes;
+
+function stepNode(step, index) {
+    const state = nodes.runState(step);
+    return node("step", `${nodes.glyphFor(state)}  ${step.name || `Step ${index + 1}`}`, {
+        identifier: `step-${step.number || index}`,
+        description: time.duration(step.started_at, step.completed_at),
+        tooltip: `${step.name || ""}\nStatus: ${state}`,
+        contextValue: "step",
+    });
+}
+
+function jobNode(store, repo, run, job) {
+    const state = nodes.runState(job);
+    const steps = Array.isArray(job.steps) ? job.steps : [];
+
+    return node("job", `${nodes.glyphFor(state)}  ${job.name || `Job ${job.id}`}`, {
+        identifier: `job-${repo.key}-${job.id}`,
+        description: nodes.timingText(job),
+        tooltip: [
+            job.name,
+            `Status: ${state}`,
+            job.runner_name ? `Runner: ${job.runner_name}` : null,
+            "Double-click to open logs",
+        ]
+            .filter(Boolean)
+            .join("\n"),
+        contextValue: "job",
+        command: "gitea.viewJobLogs",
+        repo: repo,
+        data: { job: job, run: run, repoKey: repo.key },
+        children: steps.length ? steps.map(stepNode) : null,
+    });
+}
+
+function artifactNode(store, repo, run, artifact) {
+    const size = artifact.size_in_bytes ? formatBytes(artifact.size_in_bytes) : "";
+    const expired = artifact.expired ? " · expired" : "";
+
+    return node("artifact", `⬇  ${artifact.name}`, {
+        identifier: `artifact-${repo.key}-${artifact.id}`,
+        description: `${size}${expired}`,
+        tooltip: [
+            artifact.name,
+            size ? `Size: ${size}` : null,
+            artifact.expired ? "This artifact has expired." : null,
+            "Double-click to download",
+        ]
+            .filter(Boolean)
+            .join("\n"),
+        contextValue: "artifact",
+        command: "gitea.downloadArtifact",
+        repo: repo,
+        data: { artifact: artifact, run: run, repoKey: repo.key },
+    });
+}
+
+function formatBytes(bytes) {
+    const units = ["B", "KB", "MB", "GB"];
+    let value = Number(bytes);
+    let unit = 0;
+    while (value >= 1024 && unit < units.length - 1) {
+        value /= 1024;
+        unit += 1;
+    }
+    return `${value >= 10 || unit === 0 ? Math.round(value) : value.toFixed(1)} ${units[unit]}`;
+}
+
+/** A run row. Jobs and artifacts load only when the row is expanded. */
+function runNode(store, repo, run, { showBranch = true } = {}) {
+    const state = nodes.runState(run);
+    const subtitle = [];
+    if (showBranch && run.head_branch) subtitle.push(run.head_branch);
+    if (run.event) subtitle.push(run.event);
+    const timing = nodes.timingText(run);
+    if (timing) subtitle.push(timing);
+
+    return node("run", `${nodes.glyphFor(state)}  ${nodes.runTitle(run)}`, {
+        identifier: `run-${repo.key}-${run.id}`,
+        description: subtitle.join(" · "),
+        tooltip: [
+            nodes.runTitle(run),
+            `Status: ${state}`,
+            run.head_branch ? `Branch: ${run.head_branch}` : null,
+            run.head_sha ? `Commit: ${String(run.head_sha).slice(0, 8)}` : null,
+            run.run_number ? `Run #${run.run_number}` : null,
+            run.actor && run.actor.login ? `Actor: ${run.actor.login}` : null,
+        ]
+            .filter(Boolean)
+            .join("\n"),
+        contextValue: "run",
+        repo: repo,
+        data: { run: run, repoKey: repo.key },
+        load: async () => {
+            // Reuse cached jobs so a periodic tree reload does not refetch every
+            // expanded run; a run that is still going always refreshes.
+            const cachedJobs = store.jobsFor(repo.key, run.id);
+            const active = isActiveRun(run);
+            const detail =
+                cachedJobs && !active
+                    ? { jobs: cachedJobs, artifacts: store.artifactsFor(repo.key, run.id) || [] }
+                    : await store.loadRunDetail(repo, run);
+            if (!detail) return [message("Unable to load run details.")];
+
+            const children = detail.jobs.map((job) => jobNode(store, repo, run, job));
+            if (!children.length) children.push(message("No jobs reported."));
+
+            if (detail.artifacts.length) {
+                children.push(
+                    node("artifactsFolder", "Artifacts", {
+                        identifier: `artifacts-${repo.key}-${run.id}`,
+                        description: String(detail.artifacts.length),
+                        contextValue: "artifactsFolder",
+                        repo: repo,
+                        children: detail.artifacts.map((artifact) =>
+                            artifactNode(store, repo, run, artifact),
+                        ),
+                    }),
+                );
+            }
+            return children;
+        },
+    });
+}
+
+function reviewCommentNode(store, repo, pull, comment) {
+    const author = (comment.user && comment.user.login) || "someone";
+    const location = comment.path
+        ? `${comment.path}${comment.position ? `:${comment.position}` : ""}`
+        : "";
+    const resolved = comment.resolver && comment.resolver.login ? "✓ " : "";
+
+    return node("comment", `${resolved}${author}: ${firstLine(comment.body)}`, {
+        identifier: `comment-${comment.id}`,
+        description: location,
+        tooltip: [location, comment.body, comment.diff_hunk].filter(Boolean).join("\n\n"),
+        contextValue: "comment",
+        repo: repo,
+        command: "gitea.openReviewComment",
+        data: { comment: comment, pull: pull, repoKey: repo.key },
+    });
+}
+
+function reviewNode(store, repo, pull, review, comments) {
+    const author = (review.user && review.user.login) || "someone";
+    const own = comments.filter((comment) => comment.pull_request_review_id === review.id);
+
+    return node("review", `${nodes.reviewGlyph(review.state)}  ${author}`, {
+        identifier: `review-${review.id}`,
+        description: `${String(review.state || "").toLowerCase()} · ${time.relative(
+            review.submitted_at || review.updated_at,
+        )}`,
+        tooltip: [review.body, `State: ${review.state}`].filter(Boolean).join("\n\n"),
+        contextValue: "review",
+        repo: repo,
+        data: { review: review, pull: pull, repoKey: repo.key },
+        children: own.length
+            ? own.map((comment) => reviewCommentNode(store, repo, pull, comment))
+            : null,
+    });
+}
+
+function changedFileNode(store, repo, pull, file) {
+    const marker =
+        file.status === "added" ? "+" : file.status === "deleted" ? "−" : file.status === "renamed" ? "→" : "±";
+
+    return node("prFile", `${marker}  ${file.filename}`, {
+        identifier: `prfile-${pull.number}-${file.filename}`,
+        description: `+${file.additions || 0} −${file.deletions || 0}`,
+        tooltip: `${file.filename}\nStatus: ${file.status}`,
+        contextValue: "prFile",
+        repo: repo,
+        command: "gitea.openChangedFile",
+        data: { file: file, pull: pull, repoKey: repo.key },
+    });
+}
+
+/** A pull request row; reviews, comments, and files load on expand. */
+function pullRequestNode(store, repo, pull, { showRepo = false } = {}) {
+    const subtitle = [];
+    if (showRepo) subtitle.push(repo.fullName);
+    if (pull.head && pull.head.ref) subtitle.push(`${pull.head.ref} → ${pull.base.ref}`);
+    subtitle.push(time.relative(pull.updated_at));
+
+    return node("pr", `${nodes.pullRequestGlyph(pull)}  #${pull.number} ${pull.title}`, {
+        identifier: `pr-${repo.key}-${pull.number}`,
+        description: subtitle.filter(Boolean).join(" · "),
+        tooltip: [
+            `#${pull.number} ${pull.title}`,
+            pull.user ? `Author: ${pull.user.login}` : null,
+            pull.head && pull.base ? `${pull.head.label} → ${pull.base.label}` : null,
+            pull.mergeable === false ? "Has conflicts" : null,
+            pull.draft ? "Draft" : null,
+        ]
+            .filter(Boolean)
+            .join("\n"),
+        contextValue: "pr",
+        repo: repo,
+        data: { pull: pull, repoKey: repo.key },
+        load: async () => {
+            // Cached detail is reused until the pull request itself changes.
+            const cached = store.detailFor(repo.key, pull.number);
+            const fresh =
+                cached && cached.loadedAt >= new Date(pull.updated_at || 0) ? cached : null;
+            const detail = fresh || (await store.loadPullRequestDetail(repo, pull));
+            if (!detail) return [message("Unable to load pull request details.")];
+
+            const children = [];
+
+            if (detail.reviews.length) {
+                children.push(
+                    node("reviewsFolder", "Reviews", {
+                        identifier: `reviews-${repo.key}-${pull.number}`,
+                        description: String(detail.reviews.length),
+                        contextValue: "reviewsFolder",
+                        repo: repo,
+                        children: detail.reviews.map((review) =>
+                            reviewNode(store, repo, pull, review, detail.comments),
+                        ),
+                    }),
+                );
+            }
+
+            const orphans = detail.comments.filter(
+                (comment) =>
+                    !detail.reviews.some(
+                        (review) => review.id === comment.pull_request_review_id,
+                    ),
+            );
+            if (orphans.length) {
+                children.push(
+                    node("commentsFolder", "Comments", {
+                        identifier: `comments-${repo.key}-${pull.number}`,
+                        description: String(orphans.length),
+                        contextValue: "commentsFolder",
+                        repo: repo,
+                        children: orphans.map((comment) =>
+                            reviewCommentNode(store, repo, pull, comment),
+                        ),
+                    }),
+                );
+            }
+
+            if (detail.files.length) {
+                children.push(
+                    node("filesFolder", "Changed Files", {
+                        identifier: `files-${repo.key}-${pull.number}`,
+                        description: String(detail.files.length),
+                        contextValue: "filesFolder",
+                        repo: repo,
+                        children: detail.files.map((file) =>
+                            changedFileNode(store, repo, pull, file),
+                        ),
+                    }),
+                );
+            }
+
+            return children.length ? children : [message("No reviews or changed files.")];
+        },
+    });
+}
+
+function firstLine(text) {
+    const line = String(text || "").split("\n").find((entry) => entry.trim());
+    if (!line) return "(empty comment)";
+    return line.length > 80 ? `${line.slice(0, 77)}…` : line.trim();
+}
+
+exports.runNode = runNode;
+exports.jobNode = jobNode;
+exports.artifactNode = artifactNode;
+exports.pullRequestNode = pullRequestNode;
+exports.reviewCommentNode = reviewCommentNode;
+exports.changedFileNode = changedFileNode;
+exports.formatBytes = formatBytes;
+exports.firstLine = firstLine;
@@ -0,0 +1,135 @@
+//
+// Node model shared by every sidebar section. Nova's TreeItem has no badge or
+// status colour, so run state is carried by a leading glyph in the item name
+// and by descriptive text on the trailing edge.
+//
+
+const time = require("../util/time.js");
+
+const RUN_GLYPHS = {
+    success: "✓",
+    failure: "✗",
+    failed: "✗",
+    error: "✗",
+    timed_out: "✗",
+    cancelled: "⊘",
+    canceled: "⊘",
+    skipped: "⊝",
+    running: "●",
+    in_progress: "●",
+    queued: "◌",
+    waiting: "◌",
+    pending: "◌",
+    blocked: "◌",
+};
+
+function glyphFor(statusOrConclusion) {
+    const key = String(statusOrConclusion || "").toLowerCase();
+    return RUN_GLYPHS[key] || "•";
+}
+
+/** A completed run reports state via `conclusion`; a live one via `status`. */
+function runState(run) {
+    const conclusion = String(run.conclusion || "").toLowerCase();
+    if (conclusion) return conclusion;
+    return String(run.status || "").toLowerCase() || "unknown";
+}
+
+function pullRequestGlyph(pull) {
+    if (pull.merged) return "⤳";
+    if (pull.state === "closed") return "⊘";
+    if (pull.draft) return "◌";
+    return "◆";
+}
+
+function reviewGlyph(state) {
+    const key = String(state || "").toUpperCase();
+    if (key === "APPROVED") return "✓";
+    if (key === "REQUEST_CHANGES" || key === "CHANGES_REQUESTED") return "✗";
+    if (key === "PENDING") return "◌";
+    return "◆";
+}
+
+let counter = 0;
+
+/**
+ * Builds a tree node. `children` is a resolved array; `load` is an async
+ * producer used for rows that fetch on expand.
+ */
+function node(kind, name, options = {}) {
+    counter += 1;
+    const value = {
+        kind: kind,
+        name: name,
+        identifier: options.identifier || `${kind}-${counter}`,
+        descriptiveText: options.description || "",
+        tooltip: options.tooltip || "",
+        image: options.image || null,
+        contextValue: options.contextValue || kind,
+        command: options.command || null,
+        path: options.path || null,
+        data: options.data || null,
+        repo: options.repo || null,
+        children: options.children || null,
+        load: options.load || null,
+        expanded: options.expanded === true,
+        parent: null,
+    };
+
+    if (value.children) {
+        for (const child of value.children) child.parent = value;
+    }
+    return value;
+}
+
+function message(text, kind = "message") {
+    return node(kind, text, { contextValue: "message" });
+}
+
+function errorNode(text) {
+    return node("error", `⚠ ${text}`, { contextValue: "message", tooltip: text });
+}
+
+/** Formats "12s · 3m ago" style trailing text for a run or job. */
+function timingText(entity) {
+    const parts = [];
+    const length = time.duration(entity.started_at, entity.completed_at);
+    if (length) parts.push(length);
+    const when = time.relative(entity.started_at || entity.created_at || entity.updated_at);
+    if (when) parts.push(when);
+    return parts.join(" · ");
+}
+
+function runTitle(run) {
+    return (
+        run.display_title ||
+        run.title ||
+        run.name ||
+        (run.path ? run.path.split("/").pop() : null) ||
+        `Run #${run.run_number || run.id}`
+    );
+}
+
+/** Groups runs by their workflow file, falling back to the run's own name. */
+function workflowKey(run) {
+    if (run.path) return run.path;
+    if (run.workflow_id) return String(run.workflow_id);
+    return run.name || "Workflow";
+}
+
+function workflowLabel(run) {
+    if (run.path) return run.path.split("/").pop();
+    return run.name || "Workflow";
+}
+
+exports.node = node;
+exports.message = message;
+exports.errorNode = errorNode;
+exports.glyphFor = glyphFor;
+exports.runState = runState;
+exports.pullRequestGlyph = pullRequestGlyph;
+exports.reviewGlyph = reviewGlyph;
+exports.timingText = timingText;
+exports.runTitle = runTitle;
+exports.workflowKey = workflowKey;
+exports.workflowLabel = workflowLabel;
@@ -0,0 +1,79 @@
+//
+// Generic TreeDataProvider over the node model. Subclasses only implement
+// roots(); everything else — lazy children, TreeItem mapping — happens here.
+//
+
+const log = require("../util/log.js");
+const { message } = require("./nodes.js");
+
+class NodeProvider {
+    constructor(store) {
+        this.store = store;
+        this._roots = null;
+    }
+
+    /** Subclasses return an array of nodes (or a Promise of one). */
+    roots() {
+        return [];
+    }
+
+    /** Drops memoised roots so the next getChildren rebuilds from the store. */
+    invalidate() {
+        this._roots = null;
+    }
+
+    async getChildren(element) {
+        try {
+            if (!element) {
+                if (!this._roots) {
+                    this._roots = await this.roots();
+                    // A section may hoist a repository's children to the top
+                    // level; those nodes must not keep a parent Nova cannot see.
+                    for (const root of this._roots) root.parent = null;
+                }
+                return this._roots;
+            }
+
+            if (element.children) return element.children;
+
+            if (element.load) {
+                const children = await element.load();
+                element.children = children || [];
+                for (const child of element.children) child.parent = element;
+                return element.children;
+            }
+
+            return [];
+        } catch (error) {
+            log.error("tree build failed", String(error && error.stack ? error.stack : error));
+            return [message(`⚠ ${error.message || error}`)];
+        }
+    }
+
+    getParent(element) {
+        return element ? element.parent : null;
+    }
+
+    getTreeItem(element) {
+        const collapsible =
+            element.children || element.load
+                ? element.expanded
+                    ? TreeItemCollapsibleState.Expanded
+                    : TreeItemCollapsibleState.Collapsed
+                : TreeItemCollapsibleState.None;
+
+        const item = new TreeItem(element.name, collapsible);
+        item.identifier = element.identifier;
+        item.contextValue = element.contextValue;
+
+        if (element.descriptiveText) item.descriptiveText = element.descriptiveText;
+        if (element.tooltip) item.tooltip = element.tooltip;
+        if (element.image) item.image = element.image;
+        if (element.path) item.path = element.path;
+        if (element.command) item.command = element.command;
+
+        return item;
+    }
+}
+
+exports.NodeProvider = NodeProvider;
@@ -0,0 +1,48 @@
+//
+// "Pull Requests" section: open pull requests across every discovered
+// repository, each expanding into its reviews, comments, and changed files.
+//
+
+const builders = require("./builders.js");
+const nodes = require("./nodes.js");
+const { NodeProvider } = require("./provider.js");
+
+const { node, message, errorNode } = nodes;
+
+class PullRequestsProvider extends NodeProvider {
+    roots() {
+        const store = this.store;
+
+        if (!store.hasAnyToken) {
+            return [message("No token stored. Run “Gitea → Set Token…” to sign in.")];
+        }
+        if (!store.repos.length) {
+            return [message(store.loading ? "Loading…" : "No Gitea repositories found.")];
+        }
+
+        const sections = store.repos.map((repo) => this.repoSection(repo));
+        return store.repos.length === 1 ? sections[0].children : sections;
+    }
+
+    repoSection(repo) {
+        const { items, error } = this.store.pullRequestsFor(repo.key);
+
+        let children;
+        if (error) children = [errorNode(error)];
+        else if (!items.length) children = [message("No open pull requests.")];
+        else children = items.map((pull) => builders.pullRequestNode(this.store, repo, pull));
+
+        return node("repo", repo.fullName, {
+            identifier: `pr-repo-${repo.key}`,
+            description: items.length ? String(items.length) : "",
+            tooltip: repo.htmlUrl,
+            contextValue: "repo",
+            repo: repo,
+            data: { repoKey: repo.key },
+            expanded: true,
+            children: children,
+        });
+    }
+}
+
+exports.PullRequestsProvider = PullRequestsProvider;
@@ -0,0 +1,158 @@
+//
+// "Settings" section: instance connection state plus per-repository Actions
+// secrets and variables. Secrets and variables load only when expanded, since
+// both endpoints need scopes a read-only token may not carry.
+//
+
+const credentials = require("../gitea/credentials.js");
+const nodes = require("./nodes.js");
+const time = require("../util/time.js");
+const { NodeProvider } = require("./provider.js");
+
+const { node, message, errorNode } = nodes;
+
+class SettingsProvider extends NodeProvider {
+    roots() {
+        const store = this.store;
+        const baseUrls = store.router.baseUrls;
+
+        if (!baseUrls.length) {
+            return [message("No Gitea instance configured. Open the extension preferences.")];
+        }
+
+        const instances = baseUrls.map((baseUrl) => this.instanceNode(baseUrl));
+        if (!store.repos.length) return instances;
+
+        return [
+            ...instances,
+            node("reposFolder", "Repositories", {
+                identifier: "settings-repos",
+                description: String(store.repos.length),
+                contextValue: "reposFolder",
+                expanded: true,
+                children: store.repos.map((repo) => this.repoNode(repo)),
+            }),
+        ];
+    }
+
+    instanceNode(baseUrl) {
+        const status = this.store.instanceStatus.get(baseUrl);
+        const hasToken = credentials.hasToken(baseUrl);
+
+        let glyph = "◌";
+        let description = "not checked";
+        if (status && status.ok) {
+            glyph = "✓";
+            description = [status.user ? `@${status.user}` : null, `v${status.version}`]
+                .filter(Boolean)
+                .join(" · ");
+        } else if (status) {
+            glyph = hasToken ? "✗" : "○";
+            description = hasToken ? "error" : "signed out";
+        }
+
+        const children = [];
+        if (status && status.error) children.push(errorNode(status.error));
+        if (!hasToken) {
+            children.push(
+                node("action", "Set Token…", {
+                    identifier: `settings-settoken-${baseUrl}`,
+                    contextValue: "message",
+                    command: "gitea.setToken",
+                    data: { baseUrl: baseUrl },
+                }),
+            );
+        }
+
+        return node("instance", `${glyph}  ${baseUrl.replace(/^https?:\/\//, "")}`, {
+            identifier: `settings-instance-${baseUrl}`,
+            description: description,
+            tooltip: `${baseUrl}\n${
+                status && status.ok
+                    ? `Connected as ${status.user || "unknown"} (Gitea ${status.version})`
+                    : status && status.error
+                      ? status.error
+                      : "Not checked yet"
+            }`,
+            contextValue: "instance",
+            data: { baseUrl: baseUrl },
+            children: children.length ? children : null,
+        });
+    }
+
+    repoNode(repo) {
+        return node("repo", repo.fullName, {
+            identifier: `settings-repo-${repo.key}`,
+            description: repo.baseUrl.replace(/^https?:\/\//, ""),
+            tooltip: [repo.htmlUrl, repo.dir ? `Local: ${repo.dir}` : null]
+                .filter(Boolean)
+                .join("\n"),
+            contextValue: "repo",
+            repo: repo,
+            data: { repoKey: repo.key },
+            children: [this.secretsFolder(repo), this.variablesFolder(repo)],
+        });
+    }
+
+    secretsFolder(repo) {
+        const cached = this.store.secrets.get(repo.key);
+
+        return node("secretsFolder", "Secrets", {
+            identifier: `settings-secrets-${repo.key}`,
+            description: cached && !cached.error ? String(cached.items.length) : "",
+            contextValue: "secretsFolder",
+            repo: repo,
+            data: { repoKey: repo.key },
+            load: async () => {
+                if (!this.store.secrets.has(repo.key)) await this.store.loadSecrets(repo);
+                const entry = this.store.secrets.get(repo.key);
+                if (!entry) return [message("Unavailable.")];
+                if (entry.error) return [errorNode(entry.error)];
+                if (!entry.items.length) return [message("No secrets defined.")];
+
+                return entry.items.map((secret) =>
+                    node("secret", `🔒  ${secret.name}`, {
+                        identifier: `secret-${repo.key}-${secret.name}`,
+                        description: time.relative(secret.created_at),
+                        tooltip: secret.description || secret.name,
+                        contextValue: "secret",
+                        repo: repo,
+                        data: { secret: secret, repoKey: repo.key },
+                    }),
+                );
+            },
+        });
+    }
+
+    variablesFolder(repo) {
+        const cached = this.store.variables.get(repo.key);
+
+        return node("variablesFolder", "Variables", {
+            identifier: `settings-variables-${repo.key}`,
+            description: cached && !cached.error ? String(cached.items.length) : "",
+            contextValue: "variablesFolder",
+            repo: repo,
+            data: { repoKey: repo.key },
+            load: async () => {
+                if (!this.store.variables.has(repo.key)) await this.store.loadVariables(repo);
+                const entry = this.store.variables.get(repo.key);
+                if (!entry) return [message("Unavailable.")];
+                if (entry.error) return [errorNode(entry.error)];
+                if (!entry.items.length) return [message("No variables defined.")];
+
+                return entry.items.map((variable) =>
+                    node("variable", variable.name, {
+                        identifier: `variable-${repo.key}-${variable.name}`,
+                        description: variable.data || variable.value || "",
+                        tooltip: variable.description || variable.name,
+                        contextValue: "variable",
+                        repo: repo,
+                        data: { variable: variable, repoKey: repo.key },
+                    }),
+                );
+            },
+        });
+    }
+}
+
+exports.SettingsProvider = SettingsProvider;
@@ -0,0 +1,73 @@
+//
+// "Workflows" section: every run in the repository, grouped by workflow file.
+// Servers without the workflow runs API fall back to a flat "Recent Runs" list.
+//
+
+const builders = require("./builders.js");
+const nodes = require("./nodes.js");
+const { NodeProvider } = require("./provider.js");
+
+const { node, message, errorNode } = nodes;
+
+class WorkflowsProvider extends NodeProvider {
+    roots() {
+        const store = this.store;
+
+        if (!store.hasAnyToken) {
+            return [message("No token stored. Run “Gitea → Set Token…” to sign in.")];
+        }
+        if (!store.repos.length) {
+            return [message(store.loading ? "Loading…" : "No Gitea repositories found.")];
+        }
+
+        const sections = store.repos.map((repo) => this.repoSection(repo));
+        return store.repos.length === 1 ? sections[0].children : sections;
+    }
+
+    repoSection(repo) {
+        const { runs, error, legacy } = this.store.runsFor(repo.key);
+
+        let children;
+        if (error) children = [errorNode(error)];
+        else if (!runs.length) children = [message("No workflow runs.")];
+        else if (legacy) children = runs.map((run) => builders.runNode(this.store, repo, run));
+        else children = this.groupByWorkflow(repo, runs);
+
+        return node("repo", repo.fullName, {
+            identifier: `wf-repo-${repo.key}`,
+            description: legacy ? "recent runs" : `${runs.length} runs`,
+            tooltip: repo.htmlUrl,
+            contextValue: "repo",
+            repo: repo,
+            data: { repoKey: repo.key },
+            expanded: true,
+            children: children,
+        });
+    }
+
+    groupByWorkflow(repo, runs) {
+        const groups = new Map();
+        for (const run of runs) {
+            const key = nodes.workflowKey(run);
+            if (!groups.has(key)) {
+                groups.set(key, { label: nodes.workflowLabel(run), runs: [] });
+            }
+            groups.get(key).runs.push(run);
+        }
+
+        return [...groups.entries()].map(([key, group]) => {
+            const latest = group.runs[0];
+            return node("workflow", group.label, {
+                identifier: `wf-${repo.key}-${key}`,
+                description: `${nodes.glyphFor(nodes.runState(latest))} ${group.runs.length}`,
+                tooltip: `${key}\nMost recent: ${nodes.runTitle(latest)}`,
+                contextValue: "workflow",
+                repo: repo,
+                data: { workflowPath: key, run: latest, repoKey: repo.key },
+                children: group.runs.map((run) => builders.runNode(this.store, repo, run)),
+            });
+        });
+    }
+}
+
+exports.WorkflowsProvider = WorkflowsProvider;