feat: config & onboarding — each teammate connects their own Gitea (Phase A)

The foundation for a shareable team build. Replaces the .env.local-only dev config
with a real, per-teammate connection flow.

main:
- config-store.ts: token encrypted at rest via Electron safeStorage (OS keychain),
  config JSON in userData. Token lives only in main; renderer gets everything but.
- resolveConfig: saved config > .env.local (dev) > null; ignored under COMMITEA_E2E.
  pm-state repo defaults to `${repo}-pm-state`. resetClients() re-reads on change so
  saving config takes effect without a restart. gitea:status gains `demo` (e2e).
- IPC: config:get (no token), config:test (authed read validates token+repo),
  config:set (encrypt+save+reset), config:clear. Model bridge reads config.modelUrl
  and probes reachability — chat is "configured" only if a model actually answers;
  localhost default is dev-only (app.isPackaged gate).

renderer:
- ConnectScreen: real onboarding form (URL/owner/repo/PAT/optional model) → test →
  save. AppShell gates on it: demo → shell (fixtures/e2e); configured → shell (real);
  else → connect. Settings Connection card is real (repo/url/model/sidecar) with
  Reconfigure + Disconnect. Chat cleanly disables with a "no model" state instead of
  the scripted canned reply.

Verified: main + desktop typecheck clean, 14 fixture e2e green (demo mode unchanged),
live onboarding e2e: fresh app → connect form → validated PAT → real board (24 done /
10 open). COMMITEA_NO_ENV_LOCAL + COMMITEA_USERDATA are test hooks for the onboarding path.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/desktop/src/main/gitea.ts

@@ -13,6 +13,7 @@ import { dirname, join } from 'node:path'
 import {
   appendDirective,
   createGiteaClient,
+  GiteaApiError,
   type DirectiveEntry,
   type GiteaClient,
   type GiteaConfig,
@@ -28,6 +29,7 @@ import {
 } from '@commitea/core'
 import { ipcMain } from 'electron'
 
+import { type AppConfig, clearConfig, loadConfig, publicConfig, saveConfig } from './config-store.js'
 import { loadSnapshot, saveSnapshot } from './snapshot-store.js'
 
 /** Walk up from cwd looking for a .env.local with a GITEA_TOKEN (dev convenience). */
@@ -48,9 +50,15 @@ function loadEnvLocalToken(): string | undefined {
   return undefined
 }
 
-function resolveConfig(): GiteaConfig | null {
+/** Saved config wins (team build); a `.env.local` is the dev fallback; e2e uses fixtures. */
+export function resolveConfig(): GiteaConfig | null {
   // E2E runs against fixtures — never hit the network from the test harness.
   if (process.env.COMMITEA_E2E === '1') return null
+  const saved = loadConfig()
+  if (saved) return { baseUrl: saved.baseUrl, token: saved.token, owner: saved.owner, repo: saved.repo }
+  // COMMITEA_NO_ENV_LOCAL forces the onboarding path (no .env.local fallback) for testing.
+  if (process.env.COMMITEA_NO_ENV_LOCAL === '1') return null
+  // dev fallback — .env.local / env vars
   const token = process.env.GITEA_TOKEN ?? loadEnvLocalToken()
   if (!token) return null
   return {
@@ -61,8 +69,23 @@ function resolveConfig(): GiteaConfig | null {
   }
 }
 
-// Memoized client so both the gitea and model bridges share one instance.
+/** The pm-state repo name: configured, else `${repo}-pm-state`, else the env override. */
+function pmStateRepoName(config: GiteaConfig): string {
+  return loadConfig()?.pmStateRepo ?? process.env.COMMITEA_PMSTATE_REPO ?? `${config.repo}-pm-state`
+}
+
+// Memoized clients; reset via resetClients() when the config changes.
 let sharedClient: GiteaClient | null | undefined
+let pmStateClient: GiteaClient | null | undefined
+
+/** Drop the cached clients + snapshot so the next call re-reads the new config. */
+export function resetClients(): void {
+  sharedClient = undefined
+  pmStateClient = undefined
+  labelCache = null
+  invalidateSnapshot()
+}
+
 export function getGiteaClient(): GiteaClient | null {
   if (sharedClient === undefined) {
     const config = resolveConfig()
@@ -73,13 +96,10 @@ export function getGiteaClient(): GiteaClient | null {
 
 // The pm-state repo holds machine-derived state (the directive ledger). Same
 // token/host as the work repo, a different repo (the purity split, decisions D4).
-let pmStateClient: GiteaClient | null | undefined
 export function getPmStateClient(): GiteaClient | null {
   if (pmStateClient === undefined) {
     const config = resolveConfig()
-    pmStateClient = config
-      ? createGiteaClient({ ...config, repo: process.env.COMMITEA_PMSTATE_REPO ?? 'commitea-pm-state' }, fetch)
-      : null
+    pmStateClient = config ? createGiteaClient({ ...config, repo: pmStateRepoName(config) }, fetch) : null
   }
   return pmStateClient
 }
@@ -192,20 +212,38 @@ export function bootSnapshot(): (Snapshot & { savedAt: string }) | null {
 /** Agent tool calls tolerate a slightly stale snapshot (seconds) to stay responsive. */
 export const AGENT_SNAPSHOT_TTL_MS = 30_000
 
-export function registerGiteaIpc(): void {
-  const client = getGiteaClient()
-  const repo = client ? `${process.env.GITEA_OWNER ?? 'christian'}/${process.env.GITEA_REPO ?? 'commitea'}` : null
+// Label cache is reset with the clients (module-level so resetClients can clear it).
+let labelCache: GiteaLabel[] | null = null
+async function resolveLabelIds(client: GiteaClient, names: string[]): Promise<number[]> {
+  const lookup = () => new Map(labelCache!.map((l) => [l.name, l.id]))
+  if (!labelCache) labelCache = await client.listLabels()
+  let byName = lookup()
+  if (names.some((n) => !byName.has(n))) {
+    labelCache = await client.listLabels() // a name we don't know — refetch once
+    byName = lookup()
+  }
+  return names.map((n) => byName.get(n)).filter((id): id is number => id != null)
+}
 
-  ipcMain.handle('gitea:status', () => ({ configured: !!client, repo }))
+export function registerGiteaIpc(): void {
+  ipcMain.handle('gitea:status', () => {
+    const cfg = resolveConfig()
+    return {
+      configured: !!cfg,
+      repo: cfg ? `${cfg.owner}/${cfg.repo}` : null,
+      demo: process.env.COMMITEA_E2E === '1',
+    }
+  })
 
   // Instant boot: the last persisted snapshot, shown before the fresh reconcile lands.
   ipcMain.handle('gitea:boot', () => {
-    if (!client) return { configured: false }
+    if (!getGiteaClient()) return { configured: false }
     const persisted = bootSnapshot()
     return persisted ? { configured: true, cached: true, ...persisted } : { configured: true, cached: false }
   })
 
   ipcMain.handle('gitea:reconcile', async () => {
+    const client = getGiteaClient()
     if (!client) return { configured: false, issues: [], milestones: [], deps: [], timelines: {} }
     try {
       // explicit UI sync — force fresh, and warm the cache for agent tool calls
@@ -220,32 +258,20 @@ export function registerGiteaIpc(): void {
   })
 
   ipcMain.handle('gitea:getIssue', async (_event, index: number) => {
+    const client = getGiteaClient()
     if (!client) return null
     return client.getIssue(index)
   })
 
-  // Cached label list for name→id resolution; refreshed on demand if a name misses.
-  let labelCache: GiteaLabel[] | null = null
-  async function resolveLabelIds(names: string[]): Promise<number[]> {
-    if (!client) return []
-    const lookup = () => new Map(labelCache!.map((l) => [l.name, l.id]))
-    if (!labelCache) labelCache = await client.listLabels()
-    let byName = lookup()
-    if (names.some((n) => !byName.has(n))) {
-      labelCache = await client.listLabels() // a name we don't know — refetch once
-      byName = lookup()
-    }
-    return names.map((n) => byName.get(n)).filter((id): id is number => id != null)
-  }
-
   // The write path (apply_changes). Additive label swaps, applied only after the
   // renderer's propose-approve. Returns the plan + the freshly-read issue.
   ipcMain.handle('gitea:applyChange', async (_event, change: IssueChange) => {
+    const client = getGiteaClient()
     if (!client) return { ok: false as const, reason: 'unconfigured' as const }
     const current = await client.getIssue(change.issue)
     const plan = planIssueChange(current.labels, change)
     if (plan.noop) return { ok: true as const, plan, issue: current }
-    const ids = await resolveLabelIds(plan.labels)
+    const ids = await resolveLabelIds(client, plan.labels)
     await client.setIssueLabels(change.issue, ids)
     const issue = await client.getIssue(change.issue)
     invalidateSnapshot() // the board + forecast must reflect the label change
@@ -257,11 +283,12 @@ export function registerGiteaIpc(): void {
   ipcMain.handle(
     'gitea:createIssues',
     async (_event, issues: { title: string; body?: string; estimate?: string; priority?: string }[]) => {
+      const client = getGiteaClient()
       if (!client) return { ok: false as const, reason: 'unconfigured' as const }
       const created: { number: number; title: string }[] = []
       for (const it of issues) {
         const names = [it.estimate, it.priority].filter((n): n is string => !!n)
-        const labelIds = await resolveLabelIds(names)
+        const labelIds = await resolveLabelIds(client, names)
         const issue = await client.createIssue({ title: it.title, body: it.body, labelIds })
         created.push({ number: issue.number, title: issue.title })
       }
@@ -291,4 +318,33 @@ export function registerGiteaIpc(): void {
       return { ok: true as const, members: [] }
     }
   })
+
+  // ---- config (team onboarding) ----
+  ipcMain.handle('config:get', () => publicConfig())
+
+  ipcMain.handle('config:set', (_event, cfg: AppConfig) => {
+    saveConfig(cfg)
+    resetClients() // new config takes effect without a restart
+    return { ok: true as const }
+  })
+
+  ipcMain.handle('config:clear', () => {
+    clearConfig()
+    resetClients()
+    return { ok: true as const }
+  })
+
+  // Validate a token + repo before saving: any authed read on the repo proves access.
+  ipcMain.handle('config:test', async (_event, cfg: AppConfig) => {
+    try {
+      const c = createGiteaClient(
+        { baseUrl: cfg.baseUrl.replace(/\/+$/, ''), owner: cfg.owner.trim(), repo: cfg.repo.trim(), token: cfg.token },
+        fetch,
+      )
+      await c.listLabels()
+      return { ok: true as const }
+    } catch (e) {
+      return { ok: false as const, error: e instanceof GiteaApiError ? `${e.status}` : e instanceof Error ? e.message : String(e) }
+    }
+  })
 }