feat(tools/git): explain tea's misleading user does not exist error (stale token, not a missing account) (#1086)

packages/mosaic/framework/tools/git/detect-platform.sh

@@ -246,6 +246,21 @@ PY
     } >&2
 }
 
+# Explain tea's most misleading failure. `user does not exist [uid: 0, name: ]` reads
+# as a missing account; it almost always means a REVOKED OR STALE TOKEN. `tea login`
+# keeps its OWN COPY of the token, so rotating the credential store does not update it.
+# Diagnostic only -- stderr, no control flow, no exit.
+explain_tea_user_does_not_exist() {
+    cat >&2 <<'MSG'
+NOTE: `user does not exist [uid: 0, name: ]` from tea usually means a REVOKED OR STALE TOKEN,
+      not a missing account. A `tea login` stores its OWN COPY of the token; rotating the
+      credential store does NOT update it.
+      CHECK: the login's cached copy (`tea login list` -- read the FULL table, never `| head`),
+             then re-register that login against the current token.
+      DO NOT probe capability with a mutating request; a POST is the action, not a check.
+MSG
+}
+
 get_gitea_login_for_host() {
     local host="${1:-}"
     local login

packages/mosaic/framework/tools/git/issue-create.sh

@@ -156,6 +156,7 @@ case "$PLATFORM" in
                 exit 0
             fi
             echo "Warning: tea issue create failed, trying Gitea API fallback..." >&2
+            { declare -F explain_tea_user_does_not_exist >/dev/null && explain_tea_user_does_not_exist; } || true
         fi
         gitea_issue_create_api
         ;;

packages/mosaic/framework/tools/git/issue-view.sh

@@ -71,6 +71,7 @@ elif [[ "$PLATFORM" == "gitea" ]]; then
             exit 0
         fi
         echo "Warning: tea issue view failed, trying Gitea API fallback..." >&2
+        { declare -F explain_tea_user_does_not_exist >/dev/null && explain_tea_user_does_not_exist; } || true
     fi
     gitea_issue_view_api
 else

packages/mosaic/framework/tools/git/pr-create.sh

@@ -219,6 +219,7 @@ case "$PLATFORM" in
             exit 0
         fi
         echo "Warning: tea pr create failed, trying Gitea API fallback..." >&2
+        { declare -F explain_tea_user_does_not_exist >/dev/null && explain_tea_user_does_not_exist; } || true
         gitea_pr_create_api
         ;;
     *)

packages/mosaic/framework/tools/git/test-explain-diagnostic-status-neutral.sh

@@ -0,0 +1,64 @@
+#!/bin/bash
+# Regression: the tea-failure diagnostic must be STATUS-NEUTRAL.
+#
+# Found by be-coder-08 reviewing PR #1086. At all three call sites the diagnostic is emitted
+# immediately BEFORE the Gitea API fallback. Written as the last command of an && list:
+#     declare -F explain_... >/dev/null && explain_...
+# under `set -e` a FAILING diagnostic exits and the fallback never runs -- a diagnostic that
+# suppresses the recovery path it exists to explain. It misbehaves ONLY when the helper is
+# PRESENT, so the helper-absent path (pre-#1086 behaviour) keeps working and reads as a
+# passing control.
+#
+# TWO DEFECTS IN THE FIRST VERSION OF THIS TEST, both found by be-coder-08:
+#   1. `out=$( ... ) 2>"$errto"` applies the redirection to the ASSIGNMENT, not to the
+#      command substitution, so the probe's stderr was never actually pointed at /dev/full
+#      and the /dev/full rows proved nothing. Verified: `out=$(echo x >&2) 2>/dev/full`
+#      leaks to the terminal and returns 0; the redirect must be INSIDE the substitution.
+#   2. `eval "$CONSTRUCT"` changes `set -e` semantics for a bare && list, so the probe did
+#      not exercise the construct as the shipped file executes it. It now writes the line
+#      into a real script and runs it -- same parse, same set -e rules, no eval.
+# The construct is still LIFTED FROM THE SHIPPED FILE: retyping the fixed form makes the
+# probe pass on a build whose real call sites still carry the bare && form.
+set -uo pipefail
+fail=0
+GIT_DIR_UNDER_TEST="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
+
+probe() { # $1=present|absent  $2=stderr target  $3=source file  -> "rc:fallback"
+    local helper="$1" errto="$2" src="$3" construct script out rc
+    construct=$(grep -m1 'explain_tea_user_does_not_exist' "$GIT_DIR_UNDER_TEST/$src" | sed 's/^[[:space:]]*//')
+    [ -n "$construct" ] || { printf 'no-construct:no'; return; }
+    script="$TMP/probe.sh"
+    {
+        echo '#!/bin/bash'
+        echo 'set -e'
+        echo 'explain_tea_user_does_not_exist() { echo "diagnostic" >&2; }'
+        [ "$helper" = absent ] && echo 'unset -f explain_tea_user_does_not_exist'
+        echo "$construct"                # the shipped line, parsed by a real shell
+        echo 'echo FALLBACK_REACHED'
+    } > "$script"
+    # redirect INSIDE the substitution so the subshell's stderr really is $errto
+    out=$( bash "$script" 2>"$errto" ); rc=$?
+    printf '%s:%s' "$rc" "$(grep -q FALLBACK_REACHED <<<"$out" && echo yes || echo no)"
+}
+
+check() { if [ "$2" = "$3" ]; then echo "  PASS  $1 ($2)"; else echo "  FAIL  $1: got $2, want $3"; fail=1; fi; }
+
+echo "== diagnostic must not alter exit status or skip the fallback =="
+# /dev/full makes every stderr write fail -- the real-world shape is a closed or full fd.
+for src in pr-create.sh issue-view.sh issue-create.sh; do
+    check "$src stderr OK      / helper present" "$(probe present /dev/null "$src")" "0:yes"
+    check "$src stderr OK      / helper absent " "$(probe absent  /dev/null "$src")" "0:yes"
+    check "$src stderr FAILING / helper present" "$(probe present /dev/full "$src")" "0:yes"
+    check "$src stderr FAILING / helper absent " "$(probe absent  /dev/full "$src")" "0:yes"
+done
+
+echo "== all three call sites use the status-neutral form =="
+for f in pr-create.sh issue-view.sh issue-create.sh; do
+    p="$GIT_DIR_UNDER_TEST/$f"
+    grep -q '{ declare -F explain_tea_user_does_not_exist >/dev/null && explain_tea_user_does_not_exist; } || true' "$p" \
+        && echo "  PASS  $f guarded" || { echo "  FAIL  $f: diagnostic is not status-neutral"; fail=1; }
+done
+
+[ "$fail" -eq 0 ] && echo "OK  diagnostic is status-neutral" || echo "FAILED"
+exit "$fail"