fix(mosaic-tools): pass explicit Gitea repo args

packages/mosaic/framework/tools/git/issue-create.sh

@@ -112,21 +112,22 @@ PLATFORM=$(detect_platform)
 
 case "$PLATFORM" in
     github)
-        CMD="gh issue create --title \"$TITLE\""
-        [[ -n "$BODY" ]] && CMD="$CMD --body \"$BODY\""
-        [[ -n "$LABELS" ]] && CMD="$CMD --label \"$LABELS\""
-        [[ -n "$MILESTONE" ]] && CMD="$CMD --milestone \"$MILESTONE\""
-        eval "$CMD"
+        CMD=(gh issue create --title "$TITLE")
+        [[ -n "$BODY" ]] && CMD+=(--body "$BODY")
+        [[ -n "$LABELS" ]] && CMD+=(--label "$LABELS")
+        [[ -n "$MILESTONE" ]] && CMD+=(--milestone "$MILESTONE")
+        "${CMD[@]}"
         ;;
     gitea)
         if command -v tea >/dev/null 2>&1; then
-            REPO_ARGS=$(get_gitea_repo_args)
-            CMD="tea issue create $REPO_ARGS --title \"$TITLE\""
-            [[ -n "$BODY" ]] && CMD="$CMD --description \"$BODY\""
-            [[ -n "$LABELS" ]] && CMD="$CMD --labels \"$LABELS\""
+            REPO_SLUG=$(get_repo_slug)
+            REPO_ARGS=(--repo "$REPO_SLUG" --login "${GITEA_LOGIN:-mosaicstack}")
+            CMD=(tea issue create "${REPO_ARGS[@]}" --title "$TITLE")
+            [[ -n "$BODY" ]] && CMD+=(--description "$BODY")
+            [[ -n "$LABELS" ]] && CMD+=(--labels "$LABELS")
             # tea accepts milestone by name directly (verified 2026-02-05)
-            [[ -n "$MILESTONE" ]] && CMD="$CMD --milestone \"$MILESTONE\""
-            if eval "$CMD"; then
+            [[ -n "$MILESTONE" ]] && CMD+=(--milestone "$MILESTONE")
+            if "${CMD[@]}"; then
                 exit 0
             fi
             echo "Warning: tea issue create failed, trying Gitea API fallback..." >&2

packages/mosaic/framework/tools/git/pr-create.sh

@@ -163,35 +163,37 @@ PLATFORM=$(detect_platform)
 
 case "$PLATFORM" in
     github)
-        CMD="gh pr create --title \"$TITLE\""
-        [[ -n "$BODY" ]] && CMD="$CMD --body \"$BODY\""
-        [[ -n "$BASE_BRANCH" ]] && CMD="$CMD --base \"$BASE_BRANCH\""
-        [[ -n "$HEAD_BRANCH" ]] && CMD="$CMD --head \"$HEAD_BRANCH\""
-        [[ -n "$LABELS" ]] && CMD="$CMD --label \"$LABELS\""
-        [[ -n "$MILESTONE" ]] && CMD="$CMD --milestone \"$MILESTONE\""
-        [[ "$DRAFT" == true ]] && CMD="$CMD --draft"
-        eval "$CMD"
+        CMD=(gh pr create --title "$TITLE")
+        [[ -n "$BODY" ]] && CMD+=(--body "$BODY")
+        [[ -n "$BASE_BRANCH" ]] && CMD+=(--base "$BASE_BRANCH")
+        [[ -n "$HEAD_BRANCH" ]] && CMD+=(--head "$HEAD_BRANCH")
+        [[ -n "$LABELS" ]] && CMD+=(--label "$LABELS")
+        [[ -n "$MILESTONE" ]] && CMD+=(--milestone "$MILESTONE")
+        [[ "$DRAFT" == true ]] && CMD+=(--draft)
+        "${CMD[@]}"
         ;;
     gitea)
         # tea pull create syntax. Always pass --repo because tea repo inference
-        # is unreliable in Mosaic worktrees/profile shells.
-        REPO_ARGS=$(get_gitea_repo_args)
-        CMD="tea pr create $REPO_ARGS --title \"$TITLE\""
-        [[ -n "$BODY" ]] && CMD="$CMD --description \"$BODY\""
-        [[ -n "$BASE_BRANCH" ]] && CMD="$CMD --base \"$BASE_BRANCH\""
-        [[ -n "$HEAD_BRANCH" ]] && CMD="$CMD --head \"$HEAD_BRANCH\""
+        # is unreliable in Mosaic worktrees/profile shells. Use arrays instead
+        # of eval so markdown backticks/body content are not shell-executed.
+        REPO_SLUG=$(get_repo_slug)
+        REPO_ARGS=(--repo "$REPO_SLUG" --login "${GITEA_LOGIN:-mosaicstack}")
+        CMD=(tea pr create "${REPO_ARGS[@]}" --title "$TITLE")
+        [[ -n "$BODY" ]] && CMD+=(--description "$BODY")
+        [[ -n "$BASE_BRANCH" ]] && CMD+=(--base "$BASE_BRANCH")
+        [[ -n "$HEAD_BRANCH" ]] && CMD+=(--head "$HEAD_BRANCH")
 
         # Handle labels for tea
         if [[ -n "$LABELS" ]]; then
             # tea may use --labels flag
-            CMD="$CMD --labels \"$LABELS\""
+            CMD+=(--labels "$LABELS")
         fi
 
         # Handle milestone for tea
         if [[ -n "$MILESTONE" ]]; then
-            MILESTONE_ID=$(tea milestones list $REPO_ARGS 2>/dev/null | grep -E "^\s*[0-9]+" | grep "$MILESTONE" | awk '{print $1}' | head -1)
+            MILESTONE_ID=$(tea milestones list "${REPO_ARGS[@]}" 2>/dev/null | grep -E "^\s*[0-9]+" | grep "$MILESTONE" | awk '{print $1}' | head -1)
             if [[ -n "$MILESTONE_ID" ]]; then
-                CMD="$CMD --milestone $MILESTONE_ID"
+                CMD+=(--milestone "$MILESTONE_ID")
             else
                 echo "Warning: Could not find milestone '$MILESTONE', creating without milestone" >&2
             fi
@@ -202,7 +204,11 @@ case "$PLATFORM" in
             echo "Note: Draft PR may not be supported by your tea version" >&2
         fi
 
-        eval "$CMD"
+        if "${CMD[@]}"; then
+            exit 0
+        fi
+        echo "Warning: tea pr create failed, trying Gitea API fallback..." >&2
+        gitea_pr_create_api
         ;;
     *)
         echo "Error: Could not detect git platform" >&2