feat: bidirectional issue sync (GitHub, GitLab, Jira Cloud)

[0xHexE]

Summary

Adds a new bidirectional issue-sync engine that mirrors Multica issues with external trackers (GitHub Issues, GitLab Issues, Jira Cloud). Projects can attach multiple remote containers (GitHub repos, GitLab projects, Jira projects) whose issues sync both ways: title, description, status (with mapping), comments (with attribution), and assignees + labels.

This was a greenfield outbound direction — the existing GitHub/GitLab integrations only mirrored PRs/MRs inbound. No outbound path, no issue sync, no background worker existed before.

Architecture

Inbound: provider webhook → handler normalizes → Engine.ApplyRemote (upsert local issue/comment, ActorType="issue_sync")
Outbound: event-bus listener → issue_sync_outbox row → worker pushes to provider, records content hash

Three-layer echo suppression prevents sync loops:

1. Actor filter — outbound listeners skip events with ActorType == "issue_sync"
2. Connection identity + content hash + bot login — inbound webhooks from the connection's own identity are dropped; inbound content hashing to last_pushed_hash is dropped
3. Stale-replay clock — inbound events older than remote_updated_at are dropped (last-write-wins)

What's included

Backend (server/)

• internal/integrations/issuesync/ — provider-agnostic engine (provider.go interface, engine.go inbound apply + outbound enqueue, outbox.go polling worker with FOR UPDATE SKIP LOCKED + exponential backoff, mapping.go status maps) + three provider impls:
  • github.go — GitHub App installation tokens, reuses existing App credentials
  • gitlab.go — GitLab OAuth token via existing connection + secretbox
  • jira.go + jira_adf.go — Jira Cloud REST + Atlassian Document Format ↔ markdown converter
• Migration 136 — jira_connection, issue_sync_source, external_issue_link, external_comment_link, external_identity, issue_sync_outbox (+ sqlc queries)
• handler/issue_sync.go — sync-source CRUD API, remote-container picker, inbound webhook routing
• handler/jira.go — Jira OAuth 3LO (rotating refresh tokens), connection lifecycle, webhook handler
• cmd/server/issuesync_listeners.go — outbound event-bus listeners (issue/comment/labels → outbox)
• Extended HandleGitHubWebhook + HandleGitLabWebhook with issues/issue_comment and Issue/Note hooks
• Outbox worker + listener registration wired in main.go/router.go
• New gitlab_repo project resource type (alongside existing github_repo)

Frontend (packages/)

• packages/core — types/issue-sync.ts (zod schemas), issue-sync/ hooks (React Query, wsId-scoped keys), WS event invalidation, malformed-response tests
• packages/views — jira-tab.tsx settings tab, project-sync-sources-section.tsx (attach/manage sources), issue-sync-badges.tsx
• i18n — en + zh-Hans + ja + ko keys (locale parity tested)

REST API

Method	Path	Purpose
GET/POST	/api/projects/{id}/sync-sources	List/create sync sources
PUT/DELETE	/api/projects/{id}/sync-sources/{sourceId}	Update/delete a source
GET	/api/workspaces/{id}/sync/{provider}/remote-projects	Remote repo/project picker
GET	/api/workspaces/{id}/jira/connect	Jira OAuth authorize URL
GET	/api/jira/oauth/callback	Jira OAuth callback
POST	/api/webhooks/jira/{connectionId}	Jira webhook ingress
GET/DELETE	/api/workspaces/{id}/jira/connections[/{connectionId}]	Jira connection lifecycle

Testing

• Go: go build ./... ✅ · go vet clean ✅ · 26 issuesync tests pass (engine hash/normalization, GitLab provider httptest, Jira ADF round-trip + refresh-token rotation) · go test ./internal/handler/ passes
• Frontend: pnpm typecheck all 6 packages ✅ · pnpm test (views) 1627 pass ✅ · core 769 pass ✅ · locale parity ✅
• sqlc: regenerates with zero diff

Notes

• Jira Cloud OAuth 3LO uses rotating refresh tokens (the refresh response includes a new refresh token; always persisted — tested)
• Jira dynamic webhooks expire after 30 days (refresh scheduler is stubbed for a follow-up; the webhook handler works today via manual registration)
• The outbox worker is multi-replica safe (FOR UPDATE SKIP LOCKED)
• Per-project push_default source controls where new Multica issues are created remotely (partial unique index enforces one per project)

Migration notes for operators

New optional env vars (all gated — absence disables that provider cleanly):

• MULTICA_JIRA_SECRET_KEY — at-rest encryption for Jira OAuth tokens
• JIRA_OAUTH_CLIENT_ID / JIRA_OAUTH_CLIENT_SECRET — Jira Cloud OAuth app credentials
• Existing MULTICA_GITLAB_SECRET_KEY + GITHUB_APP_ID/GITHUB_APP_PRIVATE_KEY are reused

🤖 Generated with Claude Code