diff --git a/scripts/ssh/ssh-connect.php b/scripts/ssh/ssh-connect.php
index 03e1caa77a..f02bafb936 100755
--- a/scripts/ssh/ssh-connect.php
+++ b/scripts/ssh/ssh-connect.php
@@ -1,57 +1,43 @@
 #!/usr/bin/env php
 <?php
 
 // This is a wrapper script for Git, Mercurial, and Subversion. It primarily
 // serves to inject "-o StrictHostKeyChecking=no" into the SSH arguments.
 
 $root = dirname(dirname(dirname(__FILE__)));
 require_once $root.'/scripts/__init_script__.php';
 
-$target_name = getenv('PHABRICATOR_SSH_TARGET');
-if (!$target_name) {
-  throw new Exception(pht("No 'PHABRICATOR_SSH_TARGET' in environment!"));
-}
-
-$viewer = PhabricatorUser::getOmnipotentUser();
-
-$repository = id(new PhabricatorRepositoryQuery())
-  ->setViewer($viewer)
-  ->withCallsigns(array($target_name))
-  ->executeOne();
-if (!$repository) {
-  throw new Exception(pht('No repository with callsign "%s"!', $target_name));
-}
-
 $pattern = array();
 $arguments = array();
 
 $pattern[] = 'ssh';
 
 $pattern[] = '-o';
 $pattern[] = 'StrictHostKeyChecking=no';
 
-$credential_phid = $repository->getCredentialPHID();
+$credential_phid = getenv('PHABRICATOR_CREDENTIAL');
 if ($credential_phid) {
+  $viewer = PhabricatorUser::getOmnipotentUser();
   $key = PassphraseSSHKey::loadFromPHID($credential_phid, $viewer);
 
   $pattern[] = '-l %P';
   $arguments[] = $key->getUsernameEnvelope();
   $pattern[] = '-i %P';
   $arguments[] = $key->getKeyfileEnvelope();
 }
 
 $pattern[] = '--';
 
 $passthru_args = array_slice($argv, 1);
 foreach ($passthru_args as $passthru_arg) {
   $pattern[] = '%s';
   $arguments[] = $passthru_arg;
 }
 
 $pattern = implode(' ', $pattern);
 array_unshift($arguments, $pattern);
 
 $err = newv('PhutilExecPassthru', $arguments)
   ->execute();
 
 exit($err);
diff --git a/src/applications/repository/daemon/PhabricatorRepositoryPullLocalDaemon.php b/src/applications/repository/daemon/PhabricatorRepositoryPullLocalDaemon.php
index 88c708ac20..8d84a8be5f 100644
--- a/src/applications/repository/daemon/PhabricatorRepositoryPullLocalDaemon.php
+++ b/src/applications/repository/daemon/PhabricatorRepositoryPullLocalDaemon.php
@@ -1,805 +1,853 @@
 <?php
 
 /**
  * Run pull commands on local working copies to keep them up to date. This
  * daemon handles all repository types.
  *
  * By default, the daemon pulls **every** repository. If you want it to be
  * responsible for only some repositories, you can launch it with a list of
  * PHIDs or callsigns:
  *
  *   ./phd launch repositorypulllocal -- X Q Z
  *
  * You can also launch a daemon which is responsible for all //but// one or
  * more repositories:
  *
  *   ./phd launch repositorypulllocal -- --not A --not B
  *
  * If you have a very large number of repositories and some aren't being pulled
  * as frequently as you'd like, you can either change the pull frequency of
  * the less-important repositories to a larger number (so the daemon will skip
  * them more often) or launch one daemon for all the less-important repositories
  * and one for the more important repositories (or one for each more important
  * repository).
  *
  * @task pull   Pulling Repositories
  * @task git    Git Implementation
  * @task hg     Mercurial Implementation
  */
 final class PhabricatorRepositoryPullLocalDaemon
   extends PhabricatorDaemon {
 
   private $commitCache = array();
   private $repair;
   private $discoveryEngines = array();
 
   public function setRepair($repair) {
     $this->repair = $repair;
     return $this;
   }
 
 
 /* -(  Pulling Repositories  )----------------------------------------------- */
 
 
   /**
    * @task pull
    */
   public function run() {
     $argv = $this->getArgv();
     array_unshift($argv, __CLASS__);
     $args = new PhutilArgumentParser($argv);
     $args->parse(
       array(
         array(
           'name'      => 'no-discovery',
           'help'      => 'Pull only, without discovering commits.',
         ),
         array(
           'name'      => 'not',
           'param'     => 'repository',
           'repeat'    => true,
           'help'      => 'Do not pull __repository__.',
         ),
         array(
           'name'      => 'repositories',
           'wildcard'  => true,
           'help'      => 'Pull specific __repositories__ instead of all.',
         ),
       ));
 
     $no_discovery   = $args->getArg('no-discovery');
     $repo_names     = $args->getArg('repositories');
     $exclude_names  = $args->getArg('not');
 
     // Each repository has an individual pull frequency; after we pull it,
     // wait that long to pull it again. When we start up, try to pull everything
     // serially.
     $retry_after = array();
 
     $min_sleep = 15;
 
     while (true) {
       $repositories = $this->loadRepositories($repo_names);
       if ($exclude_names) {
         $exclude = $this->loadRepositories($exclude_names);
         $repositories = array_diff_key($repositories, $exclude);
       }
 
       // Shuffle the repositories, then re-key the array since shuffle()
       // discards keys. This is mostly for startup, we'll use soft priorities
       // later.
       shuffle($repositories);
       $repositories = mpull($repositories, null, 'getID');
 
       // If any repositories have the NEEDS_UPDATE flag set, pull them
       // as soon as possible.
       $type_need_update = PhabricatorRepositoryStatusMessage::TYPE_NEEDS_UPDATE;
       $need_update_messages = id(new PhabricatorRepositoryStatusMessage())
         ->loadAllWhere('statusType = %s', $type_need_update);
       foreach ($need_update_messages as $message) {
         $retry_after[$message->getRepositoryID()] = time();
       }
 
       // If any repositories were deleted, remove them from the retry timer map
       // so we don't end up with a retry timer that never gets updated and
       // causes us to sleep for the minimum amount of time.
       $retry_after = array_select_keys(
         $retry_after,
         array_keys($repositories));
 
       // Assign soft priorities to repositories based on how frequently they
       // should pull again.
       asort($retry_after);
       $repositories = array_select_keys(
         $repositories,
         array_keys($retry_after)) + $repositories;
 
       foreach ($repositories as $id => $repository) {
         $after = idx($retry_after, $id, 0);
         if ($after > time()) {
           continue;
         }
 
         $tracked = $repository->isTracked();
         if (!$tracked) {
           continue;
         }
 
         $callsign = $repository->getCallsign();
 
         try {
           $this->log("Updating repository '{$callsign}'.");
 
           id(new PhabricatorRepositoryPullEngine())
             ->setRepository($repository)
             ->pullRepository();
 
           if (!$no_discovery) {
             // TODO: It would be nice to discover only if we pulled something,
             // but this isn't totally trivial. It's slightly more complicated
             // with hosted repositories, too.
 
             $lock_name = get_class($this).':'.$callsign;
             $lock = PhabricatorGlobalLock::newLock($lock_name);
             $lock->lock();
 
             $repository->writeStatusMessage(
               PhabricatorRepositoryStatusMessage::TYPE_NEEDS_UPDATE,
               null);
 
             try {
               $this->discoverRepository($repository);
               $repository->writeStatusMessage(
                 PhabricatorRepositoryStatusMessage::TYPE_FETCH,
                 PhabricatorRepositoryStatusMessage::CODE_OKAY);
             } catch (Exception $ex) {
               $repository->writeStatusMessage(
                 PhabricatorRepositoryStatusMessage::TYPE_FETCH,
                 PhabricatorRepositoryStatusMessage::CODE_ERROR,
                 array(
                   'message' => pht(
                     'Error updating working copy: %s', $ex->getMessage()),
                 ));
               $lock->unlock();
               throw $ex;
             }
 
             $lock->unlock();
           }
 
           $sleep_for = $repository->getDetail('pull-frequency', $min_sleep);
           $retry_after[$id] = time() + $sleep_for;
         } catch (PhutilLockException $ex) {
           $retry_after[$id] = time() + $min_sleep;
           $this->log("Failed to acquire lock.");
         } catch (Exception $ex) {
           $retry_after[$id] = time() + $min_sleep;
 
           $proxy = new PhutilProxyException(
             "Error while fetching changes to the '{$callsign}' repository.",
             $ex);
           phlog($proxy);
         }
 
         $this->stillWorking();
       }
 
       if ($retry_after) {
         $sleep_until = max(min($retry_after), time() + $min_sleep);
       } else {
         $sleep_until = time() + $min_sleep;
       }
 
       $this->sleep($sleep_until - time());
     }
   }
 
 
   /**
    * @task pull
    */
   protected function loadRepositories(array $names) {
     $query = id(new PhabricatorRepositoryQuery())
       ->setViewer($this->getViewer());
 
     if ($names) {
       $query->withCallsigns($names);
     }
 
     $repos = $query->execute();
 
     if ($names) {
       $by_callsign = mpull($repos, null, 'getCallsign');
       foreach ($names as $name) {
         if (empty($by_callsign[$name])) {
           throw new Exception(
             "No repository exists with callsign '{$name}'!");
         }
       }
     }
 
     return $repos;
   }
 
   public function discoverRepository(PhabricatorRepository $repository) {
     $vcs = $repository->getVersionControlSystem();
 
     $result = null;
     $refs = null;
     switch ($vcs) {
       case PhabricatorRepositoryType::REPOSITORY_TYPE_GIT:
         $result = $this->executeGitDiscover($repository);
         break;
       case PhabricatorRepositoryType::REPOSITORY_TYPE_SVN:
       case PhabricatorRepositoryType::REPOSITORY_TYPE_MERCURIAL:
         $refs = $this->getDiscoveryEngine($repository)
           ->discoverCommits();
         break;
       default:
         throw new Exception("Unknown VCS '{$vcs}'!");
     }
 
     if ($refs !== null) {
       foreach ($refs as $ref) {
         $this->recordCommit(
           $repository,
           $ref->getIdentifier(),
           $ref->getEpoch(),
           $ref->getBranch());
       }
     }
 
     $this->checkIfRepositoryIsFullyImported($repository);
 
+    try {
+      $this->pushToMirrors($repository);
+    } catch (Exception $ex) {
+      // TODO: We should report these into the UI properly, but for
+      // now just complain. These errors are much less severe than
+      // pull errors.
+      phlog($ex);
+    }
+
     if ($refs !== null) {
       return (bool)count($refs);
     } else {
       return $result;
     }
   }
 
   private function getDiscoveryEngine(PhabricatorRepository $repository) {
     $id = $repository->getID();
     if (empty($this->discoveryEngines[$id])) {
       $engine = id(new PhabricatorRepositoryDiscoveryEngine())
           ->setRepository($repository)
           ->setVerbose($this->getVerbose())
           ->setRepairMode($this->repair);
 
       $this->discoveryEngines[$id] = $engine;
     }
     return $this->discoveryEngines[$id];
   }
 
   private function isKnownCommit(
     PhabricatorRepository $repository,
     $target) {
 
     if ($this->getCache($repository, $target)) {
       return true;
     }
 
     if ($this->repair) {
       // In repair mode, rediscover the entire repository, ignoring the
       // database state. We can hit the local cache above, but if we miss it
       // stop the script from going to the database cache.
       return false;
     }
 
     $commit = id(new PhabricatorRepositoryCommit())->loadOneWhere(
       'repositoryID = %d AND commitIdentifier = %s',
       $repository->getID(),
       $target);
 
     if (!$commit) {
       return false;
     }
 
     $this->setCache($repository, $target);
     while (count($this->commitCache) > 2048) {
       array_shift($this->commitCache);
     }
 
     return true;
   }
 
   private function isKnownCommitOnAnyAutocloseBranch(
     PhabricatorRepository $repository,
     $target) {
 
     $commit = id(new PhabricatorRepositoryCommit())->loadOneWhere(
       'repositoryID = %d AND commitIdentifier = %s',
       $repository->getID(),
       $target);
 
     if (!$commit) {
       $callsign = $repository->getCallsign();
 
       $console = PhutilConsole::getConsole();
       $console->writeErr(
         "WARNING: Repository '%s' is missing commits ('%s' is missing from ".
         "history). Run '%s' to repair the repository.\n",
         $callsign,
         $target,
         "bin/repository discover --repair {$callsign}");
 
       return false;
     }
 
     $data = $commit->loadCommitData();
     if (!$data) {
       return false;
     }
 
     if ($repository->shouldAutocloseCommit($commit, $data)) {
       return true;
     }
 
     return false;
   }
 
   private function recordCommit(
     PhabricatorRepository $repository,
     $commit_identifier,
     $epoch,
     $branch = null) {
 
     $commit = new PhabricatorRepositoryCommit();
     $commit->setRepositoryID($repository->getID());
     $commit->setCommitIdentifier($commit_identifier);
     $commit->setEpoch($epoch);
 
     $data = new PhabricatorRepositoryCommitData();
     if ($branch) {
       $data->setCommitDetail('seenOnBranches', array($branch));
     }
 
     try {
       $commit->openTransaction();
         $commit->save();
         $data->setCommitID($commit->getID());
         $data->save();
       $commit->saveTransaction();
 
       $this->insertTask($repository, $commit);
 
       queryfx(
         $repository->establishConnection('w'),
         'INSERT INTO %T (repositoryID, size, lastCommitID, epoch)
           VALUES (%d, 1, %d, %d)
           ON DUPLICATE KEY UPDATE
             size = size + 1,
             lastCommitID =
               IF(VALUES(epoch) > epoch, VALUES(lastCommitID), lastCommitID),
             epoch = IF(VALUES(epoch) > epoch, VALUES(epoch), epoch)',
         PhabricatorRepository::TABLE_SUMMARY,
         $repository->getID(),
         $commit->getID(),
         $epoch);
 
       if ($this->repair) {
         // Normally, the query should throw a duplicate key exception. If we
         // reach this in repair mode, we've actually performed a repair.
         $this->log("Repaired commit '{$commit_identifier}'.");
       }
 
       $this->setCache($repository, $commit_identifier);
 
       PhutilEventEngine::dispatchEvent(
         new PhabricatorEvent(
           PhabricatorEventType::TYPE_DIFFUSION_DIDDISCOVERCOMMIT,
           array(
             'repository'  => $repository,
             'commit'      => $commit,
           )));
 
     } catch (AphrontQueryDuplicateKeyException $ex) {
       $commit->killTransaction();
       // Ignore. This can happen because we discover the same new commit
       // more than once when looking at history, or because of races or
       // data inconsistency or cosmic radiation; in any case, we're still
       // in a good state if we ignore the failure.
       $this->setCache($repository, $commit_identifier);
     }
   }
 
   private function updateCommit(
     PhabricatorRepository $repository,
     $commit_identifier,
     $branch) {
 
     $commit = id(new PhabricatorRepositoryCommit())->loadOneWhere(
       'repositoryID = %d AND commitIdentifier = %s',
       $repository->getID(),
       $commit_identifier);
 
     if (!$commit) {
       // This can happen if the phabricator DB doesn't have the commit info,
       // or the commit is so big that phabricator couldn't parse it. In this
       // case we just ignore it.
       return;
     }
 
     $data = id(new PhabricatorRepositoryCommitData())->loadOneWhere(
       'commitID = %d',
       $commit->getID());
     if (!$data) {
       $data = new PhabricatorRepositoryCommitData();
       $data->setCommitID($commit->getID());
     }
     $branches = $data->getCommitDetail('seenOnBranches', array());
     $branches[] = $branch;
     $data->setCommitDetail('seenOnBranches', $branches);
     $data->save();
 
     $this->insertTask(
       $repository,
       $commit,
       array(
         'only' => true
       ));
   }
 
   private function insertTask(
     PhabricatorRepository $repository,
     PhabricatorRepositoryCommit $commit,
     $data = array()) {
 
     $vcs = $repository->getVersionControlSystem();
     switch ($vcs) {
       case PhabricatorRepositoryType::REPOSITORY_TYPE_GIT:
         $class = 'PhabricatorRepositoryGitCommitMessageParserWorker';
         break;
       case PhabricatorRepositoryType::REPOSITORY_TYPE_SVN:
         $class = 'PhabricatorRepositorySvnCommitMessageParserWorker';
         break;
       case PhabricatorRepositoryType::REPOSITORY_TYPE_MERCURIAL:
         $class = 'PhabricatorRepositoryMercurialCommitMessageParserWorker';
         break;
       default:
         throw new Exception("Unknown repository type '{$vcs}'!");
     }
 
     $data['commitID'] = $commit->getID();
 
     PhabricatorWorker::scheduleTask($class, $data);
   }
 
 
   private function setCache(
     PhabricatorRepository $repository,
     $commit_identifier) {
 
     $key = $this->getCacheKey($repository, $commit_identifier);
     $this->commitCache[$key] = true;
   }
 
   private function getCache(
     PhabricatorRepository $repository,
     $commit_identifier) {
 
     $key = $this->getCacheKey($repository, $commit_identifier);
     return idx($this->commitCache, $key, false);
   }
 
   private function getCacheKey(
     PhabricatorRepository $repository,
     $commit_identifier) {
 
     return $repository->getID().':'.$commit_identifier;
   }
 
   private function checkIfRepositoryIsFullyImported(
     PhabricatorRepository $repository) {
 
     // Check if the repository has the "Importing" flag set. We want to clear
     // the flag if we can.
     $importing = $repository->getDetail('importing');
     if (!$importing) {
       // This repository isn't marked as "Importing", so we're done.
       return;
     }
 
     // Look for any commit which hasn't imported.
     $unparsed_commit = queryfx_one(
       $repository->establishConnection('r'),
       'SELECT * FROM %T WHERE repositoryID = %d AND importStatus != %d
         LIMIT 1',
       id(new PhabricatorRepositoryCommit())->getTableName(),
       $repository->getID(),
       PhabricatorRepositoryCommit::IMPORTED_ALL);
     if ($unparsed_commit) {
       // We found a commit which still needs to import, so we can't clear the
       // flag.
       return;
     }
 
     // Clear the "importing" flag.
     $repository->openTransaction();
       $repository->beginReadLocking();
         $repository = $repository->reload();
         $repository->setDetail('importing', false);
         $repository->save();
       $repository->endReadLocking();
     $repository->saveTransaction();
   }
 
 /* -(  Git Implementation  )------------------------------------------------- */
 
 
   /**
    * @task git
    */
   private function executeGitDiscover(
     PhabricatorRepository $repository) {
 
     if (!$repository->isHosted()) {
       $this->verifyOrigin($repository);
     }
 
     $refs = id(new DiffusionLowLevelGitRefQuery())
       ->setRepository($repository)
       ->withIsOriginBranch(true)
       ->execute();
 
     $branches = mpull($refs, 'getCommitIdentifier', 'getShortName');
 
     if (!$branches) {
       // This repository has no branches at all, so we don't need to do
       // anything. Generally, this means the repository is empty.
       return;
     }
 
     $callsign = $repository->getCallsign();
 
     $tracked_something = false;
 
     $this->log("Discovering commits in repository '{$callsign}'...");
     foreach ($branches as $name => $commit) {
       $this->log("Examining branch '{$name}', at {$commit}.");
       if (!$repository->shouldTrackBranch($name)) {
         $this->log("Skipping, branch is untracked.");
         continue;
       }
 
       $tracked_something = true;
 
       if ($this->isKnownCommit($repository, $commit)) {
         $this->log("Skipping, HEAD is known.");
         continue;
       }
 
       $this->log("Looking for new commits.");
       $this->executeGitDiscoverCommit($repository, $commit, $name, false);
     }
 
     if (!$tracked_something) {
       $repo_name = $repository->getName();
       $repo_callsign = $repository->getCallsign();
       throw new Exception(
         "Repository r{$repo_callsign} '{$repo_name}' has no tracked branches! ".
         "Verify that your branch filtering settings are correct.");
     }
 
 
     $this->log("Discovering commits on autoclose branches...");
     foreach ($branches as $name => $commit) {
       $this->log("Examining branch '{$name}', at {$commit}'.");
       if (!$repository->shouldTrackBranch($name)) {
         $this->log("Skipping, branch is untracked.");
         continue;
       }
 
       if (!$repository->shouldAutocloseBranch($name)) {
         $this->log("Skipping, branch is not autoclose.");
         continue;
       }
 
       if ($this->isKnownCommitOnAnyAutocloseBranch($repository, $commit)) {
         $this->log("Skipping, commit is known on an autoclose branch.");
         continue;
       }
 
       $this->log("Looking for new autoclose commits.");
       $this->executeGitDiscoverCommit($repository, $commit, $name, true);
     }
   }
 
 
   /**
    * @task git
    */
   private function executeGitDiscoverCommit(
     PhabricatorRepository $repository,
     $commit,
     $branch,
     $autoclose) {
 
     $discover = array($commit);
     $insert = array($commit);
 
     $seen_parent = array();
 
     $stream = new PhabricatorGitGraphStream($repository, $commit);
 
     while (true) {
       $target = array_pop($discover);
       $parents = $stream->getParents($target);
       foreach ($parents as $parent) {
         if (isset($seen_parent[$parent])) {
           // We end up in a loop here somehow when we parse Arcanist if we
           // don't do this. TODO: Figure out why and draw a pretty diagram
           // since it's not evident how parsing a DAG with this causes the
           // loop to stop terminating.
           continue;
         }
         $seen_parent[$parent] = true;
         if ($autoclose) {
           $known = $this->isKnownCommitOnAnyAutocloseBranch(
             $repository,
             $parent);
         } else {
           $known = $this->isKnownCommit($repository, $parent);
         }
         if (!$known) {
           $this->log("Discovered commit '{$parent}'.");
           $discover[] = $parent;
           $insert[] = $parent;
         }
       }
       if (empty($discover)) {
         break;
       }
     }
 
     $n = count($insert);
     if ($autoclose) {
       $this->log("Found {$n} new autoclose commits on branch '{$branch}'.");
     } else {
       $this->log("Found {$n} new commits on branch '{$branch}'.");
     }
 
     while (true) {
       $target = array_pop($insert);
       $epoch = $stream->getCommitDate($target);
       $epoch = trim($epoch);
 
       if ($autoclose) {
         $this->updateCommit($repository, $target, $branch);
       } else {
         $this->recordCommit($repository, $target, $epoch, $branch);
       }
 
       if (empty($insert)) {
         break;
       }
     }
   }
 
 
   /**
    * Verify that the "origin" remote exists, and points at the correct URI.
    *
    * This catches or corrects some types of misconfiguration, and also repairs
    * an issue where Git 1.7.1 does not create an "origin" for `--bare` clones.
    * See T4041.
    *
    * @param   PhabricatorRepository Repository to verify.
    * @return  void
    */
   private function verifyOrigin(PhabricatorRepository $repository) {
     list($remotes) = $repository->execxLocalCommand(
       'remote show -n origin');
 
     $matches = null;
     if (!preg_match('/^\s*Fetch URL:\s*(.*?)\s*$/m', $remotes, $matches)) {
       throw new Exception(
         "Expected 'Fetch URL' in 'git remote show -n origin'.");
     }
 
     $remote_uri = $matches[1];
     $expect_remote = $repository->getRemoteURI();
 
     if ($remote_uri == "origin") {
       // If a remote does not exist, git pretends it does and prints out a
       // made up remote where the URI is the same as the remote name. This is
       // definitely not correct.
 
       // Possibly, we should use `git remote --verbose` instead, which does not
       // suffer from this problem (but is a little more complicated to parse).
       $valid = false;
       $exists = false;
     } else {
       $valid = self::isSameGitOrigin($remote_uri, $expect_remote);
       $exists = true;
     }
 
     if (!$valid) {
       if (!$exists) {
         // If there's no "origin" remote, just create it regardless of how
         // strongly we own the working copy. There is almost no conceivable
         // scenario in which this could do damage.
         $this->log(
           pht(
             'Remote "origin" does not exist. Creating "origin", with '.
             'URI "%s".',
             $expect_remote));
         $repository->execxLocalCommand(
           'remote add origin %s',
           $expect_remote);
 
         // NOTE: This doesn't fetch the origin (it just creates it), so we won't
         // know about origin branches until the next "pull" happens. That's fine
         // for our purposes, but might impact things in the future.
       } else {
         if ($repository->canDestroyWorkingCopy()) {
           // Bad remote, but we can try to repair it.
           $this->log(
             pht(
               'Remote "origin" exists, but is pointed at the wrong URI, "%s". '.
               'Resetting origin URI to "%s.',
               $remote_uri,
               $expect_remote));
           $repository->execxLocalCommand(
             'remote set-url origin %s',
             $expect_remote);
         } else {
           // Bad remote and we aren't comfortable repairing it.
           $message = pht(
             'Working copy at "%s" has a mismatched origin URI, "%s". '.
             'The expected origin URI is "%s". Fix your configuration, or '.
             'set the remote URI correctly. To avoid breaking anything, '.
             'Phabricator will not automatically fix this.',
             $repository->getLocalPath(),
             $remote_uri,
             $expect_remote);
           throw new Exception($message);
         }
       }
     }
   }
 
 
 
   /**
    * @task git
    */
   public static function isSameGitOrigin($remote, $expect) {
     $remote_path = self::getPathFromGitURI($remote);
     $expect_path = self::getPathFromGitURI($expect);
 
     $remote_match = self::executeGitNormalizePath($remote_path);
     $expect_match = self::executeGitNormalizePath($expect_path);
 
     return ($remote_match == $expect_match);
   }
 
   private static function getPathFromGitURI($raw_uri) {
     $uri = new PhutilURI($raw_uri);
     if ($uri->getProtocol()) {
       return $uri->getPath();
     }
 
     $uri = new PhutilGitURI($raw_uri);
     if ($uri->getDomain()) {
       return $uri->getPath();
     }
 
     return $raw_uri;
   }
 
 
   /**
    * @task git
    */
   private static function executeGitNormalizePath($path) {
     // Strip away "/" and ".git", so similar paths correctly match.
 
     $path = trim($path, '/');
     $path = preg_replace('/\.git$/', '', $path);
     return $path;
   }
 
 
+  private function pushToMirrors(PhabricatorRepository $repository) {
+    if (!$repository->canMirror()) {
+      return;
+    }
+
+    $mirrors = id(new PhabricatorRepositoryMirrorQuery())
+      ->setViewer($this->getViewer())
+      ->withRepositoryPHIDs(array($repository->getPHID()))
+      ->execute();
+
+    // TODO: This is a little bit janky, but we don't have first-class
+    // infrastructure for running remote commands against an arbitrary remote
+    // right now. Just make an emphemeral copy of the repository and muck with
+    // it a little bit. In the medium term, we should pull this command stuff
+    // out and use it here and for "Land to ...".
+
+    $proxy = clone $repository;
+    $proxy->makeEphemeral();
+
+    $proxy->setDetail('hosting-enabled', false);
+    foreach ($mirrors as $mirror) {
+      $proxy->setDetail('remote-uri', $mirror->getRemoteURI());
+      $proxy->setCredentialPHID($mirror->getCredentialPHID());
+
+      $this->log(pht('Pushing to remote "%s"...', $mirror->getRemoteURI()));
+
+      if (!$proxy->isGit()) {
+        throw new Exception('Unsupported VCS!');
+      }
+
+      $future = $proxy->getRemoteCommandFuture(
+        'push --verbose --mirror -- %s',
+        $proxy->getRemoteURI());
+
+      $future
+        ->setCWD($proxy->getLocalPath())
+        ->resolvex();
+    }
+  }
 }
diff --git a/src/applications/repository/storage/PhabricatorRepository.php b/src/applications/repository/storage/PhabricatorRepository.php
index 3bbaa9901b..40665be51a 100644
--- a/src/applications/repository/storage/PhabricatorRepository.php
+++ b/src/applications/repository/storage/PhabricatorRepository.php
@@ -1,1018 +1,1018 @@
 <?php
 
 /**
  * @task uri Repository URI Management
  */
 final class PhabricatorRepository extends PhabricatorRepositoryDAO
   implements
     PhabricatorPolicyInterface,
     PhabricatorFlaggableInterface,
     PhabricatorMarkupInterface {
 
   /**
    * Shortest hash we'll recognize in raw "a829f32" form.
    */
   const MINIMUM_UNQUALIFIED_HASH = 7;
 
   /**
    * Shortest hash we'll recognize in qualified "rXab7ef2f8" form.
    */
   const MINIMUM_QUALIFIED_HASH = 5;
 
   const TABLE_PATH = 'repository_path';
   const TABLE_PATHCHANGE = 'repository_pathchange';
   const TABLE_FILESYSTEM = 'repository_filesystem';
   const TABLE_SUMMARY = 'repository_summary';
   const TABLE_BADCOMMIT = 'repository_badcommit';
   const TABLE_LINTMESSAGE = 'repository_lintmessage';
 
   const SERVE_OFF = 'off';
   const SERVE_READONLY = 'readonly';
   const SERVE_READWRITE = 'readwrite';
 
   protected $name;
   protected $callsign;
   protected $uuid;
   protected $viewPolicy;
   protected $editPolicy;
   protected $pushPolicy;
 
   protected $versionControlSystem;
   protected $details = array();
   protected $credentialPHID;
 
   private $commitCount = self::ATTACHABLE;
   private $mostRecentCommit = self::ATTACHABLE;
 
   public static function initializeNewRepository(PhabricatorUser $actor) {
     $app = id(new PhabricatorApplicationQuery())
       ->setViewer($actor)
       ->withClasses(array('PhabricatorApplicationDiffusion'))
       ->executeOne();
 
     $view_policy = $app->getPolicy(DiffusionCapabilityDefaultView::CAPABILITY);
     $edit_policy = $app->getPolicy(DiffusionCapabilityDefaultEdit::CAPABILITY);
     $push_policy = $app->getPolicy(DiffusionCapabilityDefaultPush::CAPABILITY);
 
     return id(new PhabricatorRepository())
       ->setViewPolicy($view_policy)
       ->setEditPolicy($edit_policy)
       ->setPushPolicy($push_policy);
   }
 
   public function getConfiguration() {
     return array(
       self::CONFIG_AUX_PHID => true,
       self::CONFIG_SERIALIZATION => array(
         'details' => self::SERIALIZATION_JSON,
       ),
     ) + parent::getConfiguration();
   }
 
   public function generatePHID() {
     return PhabricatorPHID::generateNewPHID(
       PhabricatorRepositoryPHIDTypeRepository::TYPECONST);
   }
 
   public function toDictionary() {
     return array(
       'name'        => $this->getName(),
       'phid'        => $this->getPHID(),
       'callsign'    => $this->getCallsign(),
       'vcs'         => $this->getVersionControlSystem(),
       'uri'         => PhabricatorEnv::getProductionURI($this->getURI()),
       'remoteURI'   => (string)$this->getPublicRemoteURI(),
       'tracking'    => $this->getDetail('tracking-enabled'),
       'description' => $this->getDetail('description'),
     );
   }
 
   public function getDetail($key, $default = null) {
     return idx($this->details, $key, $default);
   }
 
   public function getHumanReadableDetail($key, $default = null) {
     $value = $this->getDetail($key, $default);
 
     switch ($key) {
       case 'branch-filter':
       case 'close-commits-filter':
         $value = array_keys($value);
         $value = implode(', ', $value);
         break;
     }
 
     return $value;
   }
 
   public function setDetail($key, $value) {
     $this->details[$key] = $value;
     return $this;
   }
 
   public function attachCommitCount($count) {
     $this->commitCount = $count;
     return $this;
   }
 
   public function getCommitCount() {
     return $this->assertAttached($this->commitCount);
   }
 
   public function attachMostRecentCommit(
     PhabricatorRepositoryCommit $commit = null) {
     $this->mostRecentCommit = $commit;
     return $this;
   }
 
   public function getMostRecentCommit() {
     return $this->assertAttached($this->mostRecentCommit);
   }
 
   public function getDiffusionBrowseURIForPath(
     PhabricatorUser $user,
     $path,
     $line = null,
     $branch = null) {
 
     $drequest = DiffusionRequest::newFromDictionary(
       array(
         'user' => $user,
         'repository' => $this,
         'path' => $path,
         'branch' => $branch,
       ));
 
     return $drequest->generateURI(
       array(
         'action' => 'browse',
         'line'   => $line,
       ));
   }
 
   public function getLocalPath() {
     return $this->getDetail('local-path');
   }
 
   public function getSubversionBaseURI($commit = null) {
     $subpath = $this->getDetail('svn-subpath');
     if (!strlen($subpath)) {
       $subpath = null;
     }
     return $this->getSubversionPathURI($subpath, $commit);
   }
 
   public function getSubversionPathURI($path = null, $commit = null) {
     $vcs = $this->getVersionControlSystem();
     if ($vcs != PhabricatorRepositoryType::REPOSITORY_TYPE_SVN) {
       throw new Exception("Not a subversion repository!");
     }
 
     if ($this->isHosted()) {
       $uri = 'file://'.$this->getLocalPath();
     } else {
       $uri = $this->getDetail('remote-uri');
     }
 
     $uri = rtrim($uri, '/');
 
     if (strlen($path)) {
       $path = rawurlencode($path);
       $path = str_replace('%2F', '/', $path);
       $uri = $uri.'/'.ltrim($path, '/');
     }
 
     if ($path !== null || $commit !== null) {
       $uri .= '@';
     }
 
     if ($commit !== null) {
       $uri .= $commit;
     }
 
     return $uri;
   }
 
 
 /* -(  Remote Command Execution  )------------------------------------------- */
 
 
   public function execRemoteCommand($pattern /* , $arg, ... */) {
     $args = func_get_args();
     return $this->newRemoteCommandFuture($args)->resolve();
   }
 
   public function execxRemoteCommand($pattern /* , $arg, ... */) {
     $args = func_get_args();
     return $this->newRemoteCommandFuture($args)->resolvex();
   }
 
   public function getRemoteCommandFuture($pattern /* , $arg, ... */) {
     $args = func_get_args();
     return $this->newRemoteCommandFuture($args);
   }
 
   public function passthruRemoteCommand($pattern /* , $arg, ... */) {
     $args = func_get_args();
     return $this->newRemoteCommandPassthru($args)->execute();
   }
 
   private function newRemoteCommandFuture(array $argv) {
     $argv = $this->formatRemoteCommand($argv);
     $future = newv('ExecFuture', $argv);
     $future->setEnv($this->getRemoteCommandEnvironment());
     return $future;
   }
 
   private function newRemoteCommandPassthru(array $argv) {
     $argv = $this->formatRemoteCommand($argv);
     $passthru = newv('PhutilExecPassthru', $argv);
     $passthru->setEnv($this->getRemoteCommandEnvironment());
     return $passthru;
   }
 
 
 /* -(  Local Command Execution  )-------------------------------------------- */
 
 
   public function execLocalCommand($pattern /* , $arg, ... */) {
     $args = func_get_args();
     return $this->newLocalCommandFuture($args)->resolve();
   }
 
   public function execxLocalCommand($pattern /* , $arg, ... */) {
     $args = func_get_args();
     return $this->newLocalCommandFuture($args)->resolvex();
   }
 
   public function getLocalCommandFuture($pattern /* , $arg, ... */) {
     $args = func_get_args();
     return $this->newLocalCommandFuture($args);
   }
 
   public function passthruLocalCommand($pattern /* , $arg, ... */) {
     $args = func_get_args();
     return $this->newLocalCommandPassthru($args)->execute();
   }
 
   private function newLocalCommandFuture(array $argv) {
     $this->assertLocalExists();
 
     $argv = $this->formatLocalCommand($argv);
     $future = newv('ExecFuture', $argv);
     $future->setEnv($this->getLocalCommandEnvironment());
 
     if ($this->usesLocalWorkingCopy()) {
       $future->setCWD($this->getLocalPath());
     }
 
     return $future;
   }
 
   private function newLocalCommandPassthru(array $argv) {
     $this->assertLocalExists();
 
     $argv = $this->formatLocalCommand($argv);
     $future = newv('PhutilExecPassthru', $argv);
     $future->setEnv($this->getLocalCommandEnvironment());
 
     if ($this->usesLocalWorkingCopy()) {
       $future->setCWD($this->getLocalPath());
     }
 
     return $future;
   }
 
 
 /* -(  Command Infrastructure  )--------------------------------------------- */
 
 
   private function getSSHWrapper() {
     $root = dirname(phutil_get_library_root('phabricator'));
     return $root.'/bin/ssh-connect';
   }
 
   private function getCommonCommandEnvironment() {
     $env = array(
       // NOTE: Force the language to "C", which overrides locale settings.
       // This makes stuff print in English instead of, e.g., French, so we can
       // parse the output of some commands, error messages, etc.
       'LANG' => 'C',
     );
 
     switch ($this->getVersionControlSystem()) {
       case PhabricatorRepositoryType::REPOSITORY_TYPE_SVN:
         break;
       case PhabricatorRepositoryType::REPOSITORY_TYPE_GIT:
         // NOTE: See T2965. Some time after Git 1.7.5.4, Git started fataling if
         // it can not read $HOME. For many users, $HOME points at /root (this
         // seems to be a default result of Apache setup). Instead, explicitly
         // point $HOME at a readable, empty directory so that Git looks for the
         // config file it's after, fails to locate it, and moves on. This is
         // really silly, but seems like the least damaging approach to
         // mitigating the issue.
 
         $root = dirname(phutil_get_library_root('phabricator'));
         $env['HOME'] = $root.'/support/empty/';
         break;
       case PhabricatorRepositoryType::REPOSITORY_TYPE_MERCURIAL:
         // NOTE: This overrides certain configuration, extensions, and settings
         // which make Mercurial commands do random unusual things.
         $env['HGPLAIN'] = 1;
         break;
       default:
         throw new Exception("Unrecognized version control system.");
     }
 
     return $env;
   }
 
   private function getLocalCommandEnvironment() {
     return $this->getCommonCommandEnvironment();
   }
 
   private function getRemoteCommandEnvironment() {
     $env = $this->getCommonCommandEnvironment();
 
     if ($this->shouldUseSSH()) {
       // NOTE: This is read by `bin/ssh-connect`, and tells it which credentials
       // to use.
-      $env['PHABRICATOR_SSH_TARGET'] = $this->getCallsign();
+      $env['PHABRICATOR_CREDENTIAL'] = $this->getCredentialPHID();
       switch ($this->getVersionControlSystem()) {
         case PhabricatorRepositoryType::REPOSITORY_TYPE_SVN:
           // Force SVN to use `bin/ssh-connect`.
           $env['SVN_SSH'] = $this->getSSHWrapper();
           break;
         case PhabricatorRepositoryType::REPOSITORY_TYPE_GIT:
           // Force Git to use `bin/ssh-connect`.
           $env['GIT_SSH'] = $this->getSSHWrapper();
           break;
         case PhabricatorRepositoryType::REPOSITORY_TYPE_MERCURIAL:
           // We force Mercurial through `bin/ssh-connect` too, but it uses a
           // command-line flag instead of an environmental variable.
           break;
         default:
           throw new Exception("Unrecognized version control system.");
       }
     }
 
     return $env;
   }
 
   private function formatRemoteCommand(array $args) {
     $pattern = $args[0];
     $args = array_slice($args, 1);
 
     switch ($this->getVersionControlSystem()) {
       case PhabricatorRepositoryType::REPOSITORY_TYPE_SVN:
         if ($this->shouldUseHTTP() || $this->shouldUseSVNProtocol()) {
           $flags = array();
           $flag_args = array();
           $flags[] = '--non-interactive';
           $flags[] = '--no-auth-cache';
           if ($this->shouldUseHTTP()) {
             $flags[] = '--trust-server-cert';
           }
 
           $credential_phid = $this->getCredentialPHID();
           if ($credential_phid) {
             $key = PassphrasePasswordKey::loadFromPHID(
               $credential_phid,
               PhabricatorUser::getOmnipotentUser());
             $flags[] = '--username %P';
             $flags[] = '--password %P';
             $flag_args[] = $key->getUsernameEnvelope();
             $flag_args[] = $key->getPasswordEnvelope();
           }
 
           $flags = implode(' ', $flags);
           $pattern = "svn {$flags} {$pattern}";
           $args = array_mergev(array($flag_args, $args));
         } else {
           $pattern = "svn --non-interactive {$pattern}";
         }
         break;
       case PhabricatorRepositoryType::REPOSITORY_TYPE_GIT:
         $pattern = "git {$pattern}";
         break;
       case PhabricatorRepositoryType::REPOSITORY_TYPE_MERCURIAL:
         if ($this->shouldUseSSH()) {
           $pattern = "hg --config ui.ssh=%s {$pattern}";
           array_unshift(
             $args,
             $this->getSSHWrapper());
         } else {
           $pattern = "hg {$pattern}";
         }
         break;
       default:
         throw new Exception("Unrecognized version control system.");
     }
 
     array_unshift($args, $pattern);
 
     return $args;
   }
 
   private function formatLocalCommand(array $args) {
     $pattern = $args[0];
     $args = array_slice($args, 1);
 
     switch ($this->getVersionControlSystem()) {
       case PhabricatorRepositoryType::REPOSITORY_TYPE_SVN:
         $pattern = "svn --non-interactive {$pattern}";
         break;
       case PhabricatorRepositoryType::REPOSITORY_TYPE_GIT:
         $pattern = "git {$pattern}";
         break;
       case PhabricatorRepositoryType::REPOSITORY_TYPE_MERCURIAL:
         $pattern = "hg {$pattern}";
         break;
       default:
         throw new Exception("Unrecognized version control system.");
     }
 
     array_unshift($args, $pattern);
 
     return $args;
   }
 
   public function getSSHLogin() {
     return $this->getDetail('ssh-login');
   }
 
   public function getURI() {
     return '/diffusion/'.$this->getCallsign().'/';
   }
 
   public function isTracked() {
     return $this->getDetail('tracking-enabled', false);
   }
 
   public function getDefaultBranch() {
     $default = $this->getDetail('default-branch');
     if (strlen($default)) {
       return $default;
     }
 
     $default_branches = array(
       PhabricatorRepositoryType::REPOSITORY_TYPE_GIT        => 'master',
       PhabricatorRepositoryType::REPOSITORY_TYPE_MERCURIAL  => 'default',
     );
 
     return idx($default_branches, $this->getVersionControlSystem());
   }
 
   public function getDefaultArcanistBranch() {
     return coalesce($this->getDefaultBranch(), 'svn');
   }
 
   private function isBranchInFilter($branch, $filter_key) {
     $vcs = $this->getVersionControlSystem();
 
     $is_git = ($vcs == PhabricatorRepositoryType::REPOSITORY_TYPE_GIT);
 
     $use_filter = ($is_git);
 
     if ($use_filter) {
       $filter = $this->getDetail($filter_key, array());
       if ($filter && empty($filter[$branch])) {
         return false;
       }
     }
 
     // By default, all branches pass.
     return true;
   }
 
   public function shouldTrackBranch($branch) {
     return $this->isBranchInFilter($branch, 'branch-filter');
   }
 
   public function shouldAutocloseBranch($branch) {
     if ($this->isImporting()) {
       return false;
     }
 
     if ($this->getDetail('disable-autoclose', false)) {
       return false;
     }
 
     return $this->isBranchInFilter($branch, 'close-commits-filter');
   }
 
   public function shouldAutocloseCommit(
     PhabricatorRepositoryCommit $commit,
     PhabricatorRepositoryCommitData $data) {
 
     if ($this->getDetail('disable-autoclose', false)) {
       return false;
     }
 
     switch ($this->getVersionControlSystem()) {
       case PhabricatorRepositoryType::REPOSITORY_TYPE_SVN:
         return true;
       case PhabricatorRepositoryType::REPOSITORY_TYPE_GIT:
         break;
       case PhabricatorRepositoryType::REPOSITORY_TYPE_MERCURIAL:
         return true;
       default:
         throw new Exception("Unrecognized version control system.");
     }
 
     $branches = $data->getCommitDetail('seenOnBranches', array());
     foreach ($branches as $branch) {
       if ($this->shouldAutocloseBranch($branch)) {
         return true;
       }
     }
 
     return false;
   }
 
   public function formatCommitName($commit_identifier) {
     $vcs = $this->getVersionControlSystem();
 
     $type_git = PhabricatorRepositoryType::REPOSITORY_TYPE_GIT;
     $type_hg = PhabricatorRepositoryType::REPOSITORY_TYPE_MERCURIAL;
 
     $is_git = ($vcs == $type_git);
     $is_hg = ($vcs == $type_hg);
     if ($is_git || $is_hg) {
       $short_identifier = substr($commit_identifier, 0, 12);
     } else {
       $short_identifier = $commit_identifier;
     }
 
     return 'r'.$this->getCallsign().$short_identifier;
   }
 
   public function isImporting() {
     return (bool)$this->getDetail('importing', false);
   }
 
 /* -(  Repository URI Management  )------------------------------------------ */
 
 
   /**
    * Get the remote URI for this repository.
    *
    * @return string
    * @task uri
    */
   public function getRemoteURI() {
     return (string)$this->getRemoteURIObject();
   }
 
 
   /**
    * Get the remote URI for this repository, without authentication information.
    *
    * @return string Repository URI.
    * @task uri
    */
   public function getPublicRemoteURI() {
     $uri = $this->getRemoteURIObject();
 
     // Make sure we don't leak anything if this repo is using HTTP Basic Auth
     // with the credentials in the URI or something zany like that.
 
     // If repository is not accessed over SSH we remove both username and
     // password.
     if (!$this->shouldUseSSH()) {
       $uri->setUser(null);
       $uri->setPass(null);
     }
 
     return (string)$uri;
   }
 
 
   /**
    * Get the protocol for the repository's remote.
    *
    * @return string Protocol, like "ssh" or "git".
    * @task uri
    */
   public function getRemoteProtocol() {
     $uri = $this->getRemoteURIObject();
 
     if ($uri instanceof PhutilGitURI) {
       return 'ssh';
     } else {
       return $uri->getProtocol();
     }
   }
 
 
   /**
    * Get a parsed object representation of the repository's remote URI. This
    * may be a normal URI (returned as a @{class@libphutil:PhutilURI}) or a git
    * URI (returned as a @{class@libphutil:PhutilGitURI}).
    *
    * @return wild A @{class@libphutil:PhutilURI} or
    *              @{class@libphutil:PhutilGitURI}.
    * @task uri
    */
   public function getRemoteURIObject() {
     $raw_uri = $this->getDetail('remote-uri');
     if (!$raw_uri) {
       return new PhutilURI('');
     }
 
     if (!strncmp($raw_uri, '/', 1)) {
       return new PhutilURI('file://'.$raw_uri);
     }
 
     $uri = new PhutilURI($raw_uri);
     if ($uri->getProtocol()) {
       if ($this->isSSHProtocol($uri->getProtocol())) {
         if ($this->getSSHLogin()) {
           $uri->setUser($this->getSSHLogin());
         }
       }
       return $uri;
     }
 
     $uri = new PhutilGitURI($raw_uri);
     if ($uri->getDomain()) {
       if ($this->getSSHLogin()) {
         $uri->setUser($this->getSSHLogin());
       }
       return $uri;
     }
 
     throw new Exception("Remote URI '{$raw_uri}' could not be parsed!");
   }
 
 
   /**
    * Determine if we should connect to the remote using SSH flags and
    * credentials.
    *
    * @return bool True to use the SSH protocol.
    * @task uri
    */
   private function shouldUseSSH() {
     if ($this->isHosted()) {
       return false;
     }
 
     $protocol = $this->getRemoteProtocol();
     if ($this->isSSHProtocol($protocol)) {
       $key = $this->getDetail('ssh-key');
       $keyfile = $this->getDetail('ssh-keyfile');
       if ($key || $keyfile) {
         return true;
       }
     }
 
     return false;
   }
 
 
   /**
    * Determine if we should connect to the remote using HTTP flags and
    * credentials.
    *
    * @return bool True to use the HTTP protocol.
    * @task uri
    */
   private function shouldUseHTTP() {
     if ($this->isHosted()) {
       return false;
     }
 
     $protocol = $this->getRemoteProtocol();
     return ($protocol == 'http' || $protocol == 'https');
   }
 
 
   /**
    * Determine if we should connect to the remote using SVN flags and
    * credentials.
    *
    * @return bool True to use the SVN protocol.
    * @task uri
    */
   private function shouldUseSVNProtocol() {
     if ($this->isHosted()) {
       return false;
     }
 
     $protocol = $this->getRemoteProtocol();
     return ($protocol == 'svn');
   }
 
 
   /**
    * Determine if a protocol is SSH or SSH-like.
    *
    * @param string A protocol string, like "http" or "ssh".
    * @return bool True if the protocol is SSH-like.
    * @task uri
    */
   private function isSSHProtocol($protocol) {
     return ($protocol == 'ssh' || $protocol == 'svn+ssh');
   }
 
   public function delete() {
     $this->openTransaction();
 
       $paths = id(new PhabricatorOwnersPath())
         ->loadAllWhere('repositoryPHID = %s', $this->getPHID());
       foreach ($paths as $path) {
         $path->delete();
       }
 
       $projects = id(new PhabricatorRepositoryArcanistProject())
         ->loadAllWhere('repositoryID = %d', $this->getID());
       foreach ($projects as $project) {
         // note each project deletes its PhabricatorRepositorySymbols
         $project->delete();
       }
 
       $commits = id(new PhabricatorRepositoryCommit())
         ->loadAllWhere('repositoryID = %d', $this->getID());
       foreach ($commits as $commit) {
         // note PhabricatorRepositoryAuditRequests and
         // PhabricatorRepositoryCommitData are deleted here too.
         $commit->delete();
       }
 
       $mirrors = id(new PhabricatorRepositoryMirror())
         ->loadAllWhere('repositoryPHID = %s', $this->getPHID());
       foreach ($mirrors as $mirror) {
         $mirror->delete();
       }
 
       $conn_w = $this->establishConnection('w');
 
       queryfx(
         $conn_w,
         'DELETE FROM %T WHERE repositoryID = %d',
         self::TABLE_FILESYSTEM,
         $this->getID());
 
       queryfx(
         $conn_w,
         'DELETE FROM %T WHERE repositoryID = %d',
         self::TABLE_PATHCHANGE,
         $this->getID());
 
       queryfx(
         $conn_w,
         'DELETE FROM %T WHERE repositoryID = %d',
         self::TABLE_SUMMARY,
         $this->getID());
 
       $result = parent::delete();
 
     $this->saveTransaction();
     return $result;
   }
 
   public function isGit() {
     $vcs = $this->getVersionControlSystem();
     return ($vcs == PhabricatorRepositoryType::REPOSITORY_TYPE_GIT);
   }
 
   public function isSVN() {
     $vcs = $this->getVersionControlSystem();
     return ($vcs == PhabricatorRepositoryType::REPOSITORY_TYPE_SVN);
   }
 
   public function isHg() {
     $vcs = $this->getVersionControlSystem();
     return ($vcs == PhabricatorRepositoryType::REPOSITORY_TYPE_MERCURIAL);
   }
 
   public function isHosted() {
     return (bool)$this->getDetail('hosting-enabled', false);
   }
 
   public function setHosted($enabled) {
     return $this->setDetail('hosting-enabled', $enabled);
   }
 
   public function getServeOverHTTP() {
     if ($this->isSVN()) {
       return self::SERVE_OFF;
     }
     $serve = $this->getDetail('serve-over-http', self::SERVE_OFF);
     return $this->normalizeServeConfigSetting($serve);
   }
 
   public function setServeOverHTTP($mode) {
     return $this->setDetail('serve-over-http', $mode);
   }
 
   public function getServeOverSSH() {
     $serve = $this->getDetail('serve-over-ssh', self::SERVE_OFF);
     return $this->normalizeServeConfigSetting($serve);
   }
 
   public function setServeOverSSH($mode) {
     return $this->setDetail('serve-over-ssh', $mode);
   }
 
   public static function getProtocolAvailabilityName($constant) {
     switch ($constant) {
       case self::SERVE_OFF:
         return pht('Off');
       case self::SERVE_READONLY:
         return pht('Read Only');
       case self::SERVE_READWRITE:
         return pht('Read/Write');
       default:
         return pht('Unknown');
     }
   }
 
   private function normalizeServeConfigSetting($value) {
     switch ($value) {
       case self::SERVE_OFF:
       case self::SERVE_READONLY:
         return $value;
       case self::SERVE_READWRITE:
         if ($this->isHosted()) {
           return self::SERVE_READWRITE;
         } else {
           return self::SERVE_READONLY;
         }
       default:
         return self::SERVE_OFF;
     }
   }
 
 
   /**
    * Raise more useful errors when there are basic filesystem problems.
    */
   private function assertLocalExists() {
     if (!$this->usesLocalWorkingCopy()) {
       return;
     }
 
     $local = $this->getLocalPath();
     Filesystem::assertExists($local);
     Filesystem::assertIsDirectory($local);
     Filesystem::assertReadable($local);
   }
 
   /**
    * Determine if the working copy is bare or not. In Git, this corresponds
    * to `--bare`. In Mercurial, `--noupdate`.
    */
   public function isWorkingCopyBare() {
     switch ($this->getVersionControlSystem()) {
       case PhabricatorRepositoryType::REPOSITORY_TYPE_SVN:
       case PhabricatorRepositoryType::REPOSITORY_TYPE_MERCURIAL:
         return false;
       case PhabricatorRepositoryType::REPOSITORY_TYPE_GIT:
         $local = $this->getLocalPath();
         if (Filesystem::pathExists($local.'/.git')) {
           return false;
         } else {
           return true;
         }
     }
   }
 
   public function usesLocalWorkingCopy() {
     switch ($this->getVersionControlSystem()) {
       case PhabricatorRepositoryType::REPOSITORY_TYPE_SVN:
         return $this->isHosted();
       case PhabricatorRepositoryType::REPOSITORY_TYPE_GIT:
       case PhabricatorRepositoryType::REPOSITORY_TYPE_MERCURIAL:
         return true;
     }
   }
 
   public function canDestroyWorkingCopy() {
     if ($this->isHosted()) {
       // Never destroy hosted working copies.
       return false;
     }
 
     $default_path = PhabricatorEnv::getEnvConfig(
       'repository.default-local-path');
     return Filesystem::isDescendant($this->getLocalPath(), $default_path);
   }
 
   public function canMirror() {
     if (!$this->isHosted()) {
       return false;
     }
 
     if ($this->isGit()) {
       return true;
     }
 
     return false;
   }
 
   public function writeStatusMessage(
     $status_type,
     $status_code,
     array $parameters = array()) {
 
     $table = new PhabricatorRepositoryStatusMessage();
     $conn_w = $table->establishConnection('w');
     $table_name = $table->getTableName();
 
     if ($status_code === null) {
       queryfx(
         $conn_w,
         'DELETE FROM %T WHERE repositoryID = %d AND statusType = %s',
         $table_name,
         $this->getID(),
         $status_type);
     } else {
       queryfx(
         $conn_w,
         'INSERT INTO %T
           (repositoryID, statusType, statusCode, parameters, epoch)
           VALUES (%d, %s, %s, %s, %d)
           ON DUPLICATE KEY UPDATE
             statusCode = VALUES(statusCode),
             parameters = VALUES(parameters),
             epoch = VALUES(epoch)',
         $table_name,
         $this->getID(),
         $status_type,
         $status_code,
         json_encode($parameters),
         time());
     }
 
     return $this;
   }
 
 
 /* -(  PhabricatorPolicyInterface  )----------------------------------------- */
 
 
   public function getCapabilities() {
     return array(
       PhabricatorPolicyCapability::CAN_VIEW,
       PhabricatorPolicyCapability::CAN_EDIT,
       DiffusionCapabilityPush::CAPABILITY,
     );
   }
 
   public function getPolicy($capability) {
     switch ($capability) {
       case PhabricatorPolicyCapability::CAN_VIEW:
         return $this->getViewPolicy();
       case PhabricatorPolicyCapability::CAN_EDIT:
         return $this->getEditPolicy();
       case DiffusionCapabilityPush::CAPABILITY:
         return $this->getPushPolicy();
     }
   }
 
   public function hasAutomaticCapability($capability, PhabricatorUser $user) {
     return false;
   }
 
   public function describeAutomaticCapability($capability) {
     return null;
   }
 
 
 
 /* -(  PhabricatorMarkupInterface  )----------------------------------------- */
 
 
   public function getMarkupFieldKey($field) {
     $hash = PhabricatorHash::digestForIndex($this->getMarkupText($field));
     return "repo:{$hash}";
   }
 
   public function newMarkupEngine($field) {
     return PhabricatorMarkupEngine::newMarkupEngine(array());
   }
 
   public function getMarkupText($field) {
     return $this->getDetail('description');
   }
 
   public function didMarkupText(
     $field,
     $output,
     PhutilMarkupEngine $engine) {
     require_celerity_resource('phabricator-remarkup-css');
     return phutil_tag(
       'div',
       array(
         'class' => 'phabricator-remarkup',
       ),
       $output);
   }
 
   public function shouldUseMarkupCache($field) {
     return true;
   }
 
 }