fix(mosaic-tools): pass explicit Gitea repo args

docs/scratchpads/t_301e4e3b-pr-merge-gitea-empty-uid.md

@@ -1,31 +0,0 @@
-# Scratchpad: t_301e4e3b pr-merge.sh Gitea empty-uid fallback
-
-## Task
-
-Implement a narrow hardening in `packages/mosaic/framework/tools/git/pr-merge.sh` so Gitea merges recover from the known non-interactive `tea pr merge` identity failure: `user does not exist [uid: 0, name: ]`.
-
-## Constraints
-
-- Preserve Mosaic policy gates: squash-only, base branch `main`, queue guard unless explicitly skipped.
-- Preserve the existing authenticated Gitea API fallback when no tea login exists.
-- Do not fallback on arbitrary tea failures.
-- Do not expose tokens or credential-bearing remotes.
-- Scope is limited to the merge wrapper plus focused test/support/scratchpad files.
-
-## External issue
-
-- Gitea issue #520: Harden pr-merge.sh Gitea empty-uid fallback
-
-## Plan
-
-1. Add a focused shell regression harness with mocked `tea` and `curl` proving the known empty uid/name failure must fall back to Gitea API.
-2. Watch the harness fail on current code.
-3. Implement helper functions in `pr-merge.sh` for redacted command display, known failure classification, and authenticated Gitea API merge fallback.
-4. Keep unknown `tea` failures blocking by replaying stderr and exiting non-zero.
-5. Run syntax, shellcheck if available, focused regression, and repo quality gates before push/PR.
-
-## Session log
-
-- 2026-05-22: Read Kanban context, Mosaic global/repo instructions, created isolated branch `fix/t_301e4e3b-pr-merge-gitea-empty-uid`, and opened Gitea issue #520 using the Mosaic issue wrapper/API fallback.
-- 2026-05-22: Added regression harness and watched it fail on current behavior with `user does not exist [uid: 0, name: ]`; implemented narrow fallback and verified known-empty-identity fallback, arbitrary tea failure blocking, and no-tea-login API fallback paths.
-- 2026-05-22: Validation passed for `bash -n`, `shellcheck -x`, focused shell harness, `pnpm typecheck`, `pnpm lint`, `pnpm format:check`, and `pnpm --filter @mosaicstack/mosaic test`. Full `pnpm test` exposed an out-of-scope gateway DB setup failure (`relation "messages" does not exist`) in `apps/gateway/src/__tests__/cross-user-isolation.test.ts`.

docs/scratchpads/t_5aab9cc8-pr-merge-eval-injection.md

@@ -1,48 +0,0 @@
-# t_5aab9cc8 — pr-merge.sh eval injection remediation
-
-## Objective
-
-Remediate PR #521 review blocker: `packages/mosaic/framework/tools/git/pr-merge.sh` must reject non-numeric PR numbers before metadata lookup/merge and must not use `eval` for GitHub merge execution.
-
-## Scope
-
-- Shell wrapper only: `packages/mosaic/framework/tools/git/pr-merge.sh`
-- Focused regression harness: `packages/mosaic/framework/tools/git/test-pr-merge-gitea-empty-uid.sh`
-- No API/frontend/infra surfaces.
-
-## Acceptance Criteria
-
-- AC1: `PR_NUMBER` is validated as digits-only immediately after required-argument parsing, before metadata lookup.
-- AC2: GitHub merge path uses a quoted argv array, not command-string construction plus `eval`.
-- AC3: Focused tests prove PR-number metacharacters are rejected and cannot execute injected shell commands on GitHub path.
-- AC4: Focused tests prove PR-number metacharacters are rejected on Gitea path before tea/curl merge calls.
-- AC5: Existing Gitea empty-uid fallback behavior remains green.
-- AC6: Syntax, shellcheck where available, focused harness, and relevant repo gates are rerun or absence documented.
-
-## Plan
-
-1. Add failing regression tests for GitHub eval injection and Gitea invalid PR rejection.
-2. Implement fail-closed PR number validation before metadata lookup.
-3. Replace GitHub `eval` command with argv array execution.
-4. Run required validation and update this scratchpad with evidence.
-5. Commit, queue-guard, push branch, update PR #521.
-
-## TDD Log
-
-- RED: `AGENT_WORK_ROOT="$HERMES_KANBAN_WORKSPACE/work" bash packages/mosaic/framework/tools/git/test-pr-merge-gitea-empty-uid.sh` failed on vulnerable code with `Expected GitHub metacharacter PR number to be rejected` and showed the injected PR number reached the GitHub merge path.
-- GREEN: Added digits-only validation before metadata lookup and replaced GitHub `eval` with an argv array. The focused harness now passes and verifies invalid PR numbers are rejected before GitHub `gh` calls and before Gitea `tea`/`curl` calls.
-
-## Validation Evidence
-
-- PASS: `AGENT_WORK_ROOT="$HERMES_KANBAN_WORKSPACE/work" bash -n packages/mosaic/framework/tools/git/pr-merge.sh packages/mosaic/framework/tools/git/test-pr-merge-gitea-empty-uid.sh`
-- PASS: `shellcheck -x packages/mosaic/framework/tools/git/pr-merge.sh packages/mosaic/framework/tools/git/test-pr-merge-gitea-empty-uid.sh`
-- PASS: `AGENT_WORK_ROOT="$HERMES_KANBAN_WORKSPACE/work" bash packages/mosaic/framework/tools/git/test-pr-merge-gitea-empty-uid.sh`
-- PASS: `pnpm --filter @mosaicstack/mosaic... build`
-- PASS: `pnpm --filter @mosaicstack/mosaic lint`
-- PASS: `pnpm --filter @mosaicstack/mosaic typecheck`
-- PASS: `pnpm --filter @mosaicstack/mosaic test` — 32 files / 291 tests passed.
-- REVIEW: `/home/hermes/.config/mosaic/tools/codex/codex-code-review.sh --uncommitted` could not run due Codex 401 Unauthorized. Independent delegate review completed read-only with PASS / no blockers; non-blocking suggestion to assert GitHub mock log remains empty was applied.
-
-## Risks / Blockers
-
-- No active blockers.

packages/mosaic/framework/tools/git/detect-platform.sh

@@ -74,6 +74,16 @@ get_repo_name() {
     echo "${repo_info##*/}"
 }
 
+get_repo_slug() {
+    get_repo_info
+}
+
+get_gitea_repo_args() {
+    local repo
+    repo=$(get_repo_slug) || return 1
+    printf -- '--repo %q --login %q' "$repo" "${GITEA_LOGIN:-mosaicstack}"
+}
+
 get_remote_host() {
     local remote_url
     remote_url=$(git remote get-url origin 2>/dev/null || true)

packages/mosaic/framework/tools/git/issue-comment.sh

@@ -53,7 +53,7 @@ if [[ "$PLATFORM" == "github" ]]; then
     gh issue comment "$ISSUE_NUMBER" --body "$COMMENT"
     echo "Added comment to GitHub issue #$ISSUE_NUMBER"
 elif [[ "$PLATFORM" == "gitea" ]]; then
-    tea issue comment "$ISSUE_NUMBER" "$COMMENT"
+    tea issue comment "$ISSUE_NUMBER" "$COMMENT" $(get_gitea_repo_args)
     echo "Added comment to Gitea issue #$ISSUE_NUMBER"
 else
     echo "Error: Unknown platform"

packages/mosaic/framework/tools/git/issue-create.sh

@@ -112,20 +112,22 @@ PLATFORM=$(detect_platform)
 
 case "$PLATFORM" in
     github)
-        CMD="gh issue create --title \"$TITLE\""
+        CMD=(gh issue create --title "$TITLE")
-        [[ -n "$BODY" ]] && CMD="$CMD --body \"$BODY\""
+        [[ -n "$BODY" ]] && CMD+=(--body "$BODY")
-        [[ -n "$LABELS" ]] && CMD="$CMD --label \"$LABELS\""
+        [[ -n "$LABELS" ]] && CMD+=(--label "$LABELS")
-        [[ -n "$MILESTONE" ]] && CMD="$CMD --milestone \"$MILESTONE\""
+        [[ -n "$MILESTONE" ]] && CMD+=(--milestone "$MILESTONE")
-        eval "$CMD"
+        "${CMD[@]}"
         ;;
     gitea)
         if command -v tea >/dev/null 2>&1; then
-            CMD="tea issue create --title \"$TITLE\""
+            REPO_SLUG=$(get_repo_slug)
-            [[ -n "$BODY" ]] && CMD="$CMD --description \"$BODY\""
+            REPO_ARGS=(--repo "$REPO_SLUG" --login "${GITEA_LOGIN:-mosaicstack}")
-            [[ -n "$LABELS" ]] && CMD="$CMD --labels \"$LABELS\""
+            CMD=(tea issue create "${REPO_ARGS[@]}" --title "$TITLE")
+            [[ -n "$BODY" ]] && CMD+=(--description "$BODY")
+            [[ -n "$LABELS" ]] && CMD+=(--labels "$LABELS")
             # tea accepts milestone by name directly (verified 2026-02-05)
-            [[ -n "$MILESTONE" ]] && CMD="$CMD --milestone \"$MILESTONE\""
+            [[ -n "$MILESTONE" ]] && CMD+=(--milestone "$MILESTONE")
-            if eval "$CMD"; then
+            if "${CMD[@]}"; then
                 exit 0
             fi
             echo "Warning: tea issue create failed, trying Gitea API fallback..." >&2

packages/mosaic/framework/tools/git/issue-list.sh

@@ -80,7 +80,8 @@ case "$PLATFORM" in
         eval "$CMD"
         ;;
     gitea)
-        CMD="tea issues list --state $STATE --limit $LIMIT"
+        REPO_ARGS=$(get_gitea_repo_args)
+        CMD="tea issues list $REPO_ARGS --state $STATE --limit $LIMIT"
         [[ -n "$LABEL" ]] && CMD="$CMD --labels \"$LABEL\""
         [[ -n "$MILESTONE" ]] && CMD="$CMD --milestones \"$MILESTONE\""
         # Note: tea may not support assignee filter directly

packages/mosaic/framework/tools/git/issue-reopen.sh

@@ -52,9 +52,9 @@ if [[ "$PLATFORM" == "github" ]]; then
     echo "Reopened GitHub issue #$ISSUE_NUMBER"
 elif [[ "$PLATFORM" == "gitea" ]]; then
     if [[ -n "$COMMENT" ]]; then
-        tea issue comment "$ISSUE_NUMBER" "$COMMENT"
+        tea issue comment "$ISSUE_NUMBER" "$COMMENT" $(get_gitea_repo_args)
     fi
-    tea issue reopen "$ISSUE_NUMBER"
+    tea issue reopen "$ISSUE_NUMBER" $(get_gitea_repo_args)
     echo "Reopened Gitea issue #$ISSUE_NUMBER"
 else
     echo "Error: Unknown platform"

packages/mosaic/framework/tools/git/issue-view.sh

@@ -67,7 +67,7 @@ if [[ "$PLATFORM" == "github" ]]; then
     gh issue view "$ISSUE_NUMBER"
 elif [[ "$PLATFORM" == "gitea" ]]; then
     if command -v tea >/dev/null 2>&1; then
-        if tea issue "$ISSUE_NUMBER"; then
+        if tea issue "$ISSUE_NUMBER" $(get_gitea_repo_args); then
             exit 0
         fi
         echo "Warning: tea issue view failed, trying Gitea API fallback..." >&2

packages/mosaic/framework/tools/git/pr-close.sh

@@ -52,9 +52,9 @@ if [[ "$PLATFORM" == "github" ]]; then
     echo "Closed GitHub PR #$PR_NUMBER"
 elif [[ "$PLATFORM" == "gitea" ]]; then
     if [[ -n "$COMMENT" ]]; then
-        tea pr comment "$PR_NUMBER" "$COMMENT"
+        tea pr comment "$PR_NUMBER" "$COMMENT" $(get_gitea_repo_args)
     fi
-    tea pr close "$PR_NUMBER"
+    tea pr close "$PR_NUMBER" $(get_gitea_repo_args)
     echo "Closed Gitea PR #$PR_NUMBER"
 else
     echo "Error: Unknown platform"

packages/mosaic/framework/tools/git/pr-create.sh

@@ -17,6 +17,51 @@ MILESTONE=""
 DRAFT=false
 ISSUE=""
 
+# get_remote_host, get_gitea_token, get_repo_info, and get_gitea_repo_args are provided by detect-platform.sh
+
+gitea_pr_create_api() {
+    local host repo token url payload
+    host=$(get_remote_host) || {
+        echo "Error: could not determine remote host for API fallback" >&2
+        return 1
+    }
+    repo=$(get_repo_info) || {
+        echo "Error: could not determine repo owner/name for API fallback" >&2
+        return 1
+    }
+    token=$(get_gitea_token "$host") || {
+        echo "Error: Gitea token not found for API fallback (set GITEA_TOKEN or configure ~/.git-credentials)" >&2
+        return 1
+    }
+
+    if [[ -n "$LABELS" || -n "$MILESTONE" || "$DRAFT" == true ]]; then
+        echo "Warning: API fallback applies title/body/head/base only; labels/milestone/draft require authenticated tea setup." >&2
+    fi
+
+    payload=$(TITLE="$TITLE" BODY="$BODY" HEAD_BRANCH="$HEAD_BRANCH" BASE_BRANCH="$BASE_BRANCH" python3 - <<'PY'
+import json
+import os
+
+payload = {
+    "title": os.environ["TITLE"],
+    "head": os.environ["HEAD_BRANCH"],
+    "base": os.environ["BASE_BRANCH"] or "main",
+}
+body = os.environ.get("BODY", "")
+if body:
+    payload["body"] = body
+print(json.dumps(payload))
+PY
+)
+
+    url="https://${host}/api/v1/repos/${repo}/pulls"
+    curl -fsS -X POST \
+      -H "Authorization: token ${token}" \
+      -H "Content-Type: application/json" \
+      -d "$payload" \
+      "$url"
+}
+
 usage() {
     cat <<EOF
 Usage: $(basename "$0") [OPTIONS]
@@ -118,33 +163,37 @@ PLATFORM=$(detect_platform)
 
 case "$PLATFORM" in
     github)
-        CMD="gh pr create --title \"$TITLE\""
+        CMD=(gh pr create --title "$TITLE")
-        [[ -n "$BODY" ]] && CMD="$CMD --body \"$BODY\""
+        [[ -n "$BODY" ]] && CMD+=(--body "$BODY")
-        [[ -n "$BASE_BRANCH" ]] && CMD="$CMD --base \"$BASE_BRANCH\""
+        [[ -n "$BASE_BRANCH" ]] && CMD+=(--base "$BASE_BRANCH")
-        [[ -n "$HEAD_BRANCH" ]] && CMD="$CMD --head \"$HEAD_BRANCH\""
+        [[ -n "$HEAD_BRANCH" ]] && CMD+=(--head "$HEAD_BRANCH")
-        [[ -n "$LABELS" ]] && CMD="$CMD --label \"$LABELS\""
+        [[ -n "$LABELS" ]] && CMD+=(--label "$LABELS")
-        [[ -n "$MILESTONE" ]] && CMD="$CMD --milestone \"$MILESTONE\""
+        [[ -n "$MILESTONE" ]] && CMD+=(--milestone "$MILESTONE")
-        [[ "$DRAFT" == true ]] && CMD="$CMD --draft"
+        [[ "$DRAFT" == true ]] && CMD+=(--draft)
-        eval "$CMD"
+        "${CMD[@]}"
         ;;
     gitea)
-        # tea pull create syntax
+        # tea pull create syntax. Always pass --repo because tea repo inference
-        CMD="tea pr create --title \"$TITLE\""
+        # is unreliable in Mosaic worktrees/profile shells. Use arrays instead
-        [[ -n "$BODY" ]] && CMD="$CMD --description \"$BODY\""
+        # of eval so markdown backticks/body content are not shell-executed.
-        [[ -n "$BASE_BRANCH" ]] && CMD="$CMD --base \"$BASE_BRANCH\""
+        REPO_SLUG=$(get_repo_slug)
-        [[ -n "$HEAD_BRANCH" ]] && CMD="$CMD --head \"$HEAD_BRANCH\""
+        REPO_ARGS=(--repo "$REPO_SLUG" --login "${GITEA_LOGIN:-mosaicstack}")
+        CMD=(tea pr create "${REPO_ARGS[@]}" --title "$TITLE")
+        [[ -n "$BODY" ]] && CMD+=(--description "$BODY")
+        [[ -n "$BASE_BRANCH" ]] && CMD+=(--base "$BASE_BRANCH")
+        [[ -n "$HEAD_BRANCH" ]] && CMD+=(--head "$HEAD_BRANCH")
 
         # Handle labels for tea
         if [[ -n "$LABELS" ]]; then
             # tea may use --labels flag
-            CMD="$CMD --labels \"$LABELS\""
+            CMD+=(--labels "$LABELS")
         fi
 
         # Handle milestone for tea
         if [[ -n "$MILESTONE" ]]; then
-            MILESTONE_ID=$(tea milestones list 2>/dev/null | grep -E "^\s*[0-9]+" | grep "$MILESTONE" | awk '{print $1}' | head -1)
+            MILESTONE_ID=$(tea milestones list "${REPO_ARGS[@]}" 2>/dev/null | grep -E "^\s*[0-9]+" | grep "$MILESTONE" | awk '{print $1}' | head -1)
             if [[ -n "$MILESTONE_ID" ]]; then
-                CMD="$CMD --milestone $MILESTONE_ID"
+                CMD+=(--milestone "$MILESTONE_ID")
             else
                 echo "Warning: Could not find milestone '$MILESTONE', creating without milestone" >&2
             fi
@@ -155,7 +204,11 @@ case "$PLATFORM" in
             echo "Note: Draft PR may not be supported by your tea version" >&2
         fi
 
-        eval "$CMD"
+        if "${CMD[@]}"; then
+            exit 0
+        fi
+        echo "Warning: tea pr create failed, trying Gitea API fallback..." >&2
+        gitea_pr_create_api
         ;;
     *)
         echo "Error: Could not detect git platform" >&2

packages/mosaic/framework/tools/git/pr-list.sh

@@ -74,7 +74,8 @@ case "$PLATFORM" in
         ;;
     gitea)
         # tea pr list - note: tea uses 'pulls' subcommand in some versions
-        CMD="tea pr list --state $STATE --limit $LIMIT"
+        REPO_ARGS=$(get_gitea_repo_args)
+        CMD="tea pr list $REPO_ARGS --state $STATE --limit $LIMIT"
 
         # tea filtering may be limited
         if [[ -n "$LABEL" ]]; then

packages/mosaic/framework/tools/git/pr-merge.sh

@@ -2,10 +2,9 @@
 # pr-merge.sh - Merge pull requests on Gitea or GitHub
 # Usage: pr-merge.sh -n PR_NUMBER [-m squash] [-d] [--skip-queue-guard]
 
-set -euo pipefail
+set -e
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=packages/mosaic/framework/tools/git/detect-platform.sh
 source "$SCRIPT_DIR/detect-platform.sh"
 
 # Default values
@@ -70,11 +69,6 @@ if [[ -z "$PR_NUMBER" ]]; then
     usage
 fi
 
-if [[ ! "$PR_NUMBER" =~ ^[0-9]+$ ]]; then
-    echo "Error: Invalid PR number '$PR_NUMBER'. PR number must contain digits only." >&2
-    exit 1
-fi
-
 if [[ "$MERGE_METHOD" != "squash" ]]; then
     echo "Error: Mosaic policy enforces squash merge only. Received '$MERGE_METHOD'." >&2
     exit 1
@@ -98,138 +92,21 @@ PLATFORM=$(detect_platform)
 OWNER=$(get_repo_owner)
 REPO=$(get_repo_name)
 
-find_tea_login_for_host() {
-    local host="$1"
-    local logins_json
-
-    command -v tea >/dev/null 2>&1 || return 1
-    logins_json=$(tea login list --output json 2>/dev/null) || return 1
-    TEA_LOGINS_JSON="$logins_json" python3 - "$host" <<'PY'
-import json
-import os
-import sys
-
-host = sys.argv[1]
-try:
-    logins = json.loads(os.environ.get("TEA_LOGINS_JSON", "[]"))
-except Exception:
-    raise SystemExit(1)
-
-for login in logins if isinstance(logins, list) else []:
-    url = str(login.get("url") or login.get("URL") or "")
-    name = str(login.get("name") or login.get("Name") or "")
-    if url.rstrip("/").endswith(host) and name:
-        print(name)
-        raise SystemExit(0)
-
-raise SystemExit(1)
-PY
-}
-
-is_known_tea_empty_identity_failure() {
-    local error_file="$1"
-
-    python3 - "$error_file" <<'PY'
-import re
-import sys
-
-with open(sys.argv[1], encoding="utf-8", errors="replace") as handle:
-    error = handle.read()
-
-known_empty_identity = re.search(
-    r"user does not exist.*\[.*uid:\s*0,\s*name:\s*\]",
-    error,
-    flags=re.IGNORECASE | re.DOTALL,
-)
-raise SystemExit(0 if known_empty_identity else 1)
-PY
-}
-
-merge_gitea_with_api() {
-    local host="$1"
-    local api_url="https://${host}/api/v1/repos/${OWNER}/${REPO}/pulls/${PR_NUMBER}/merge"
-    local token body_file payload
-
-    token=$(get_gitea_token "$host" || true)
-    if [[ -z "$token" ]]; then
-        echo "Error: No Gitea API token available for authenticated merge fallback on $host." >&2
-        return 1
-    fi
-
-    mkdir -p "${AGENT_WORK_ROOT:-/home/hermes/agent-work}"
-    body_file=$(mktemp "${AGENT_WORK_ROOT:-/home/hermes/agent-work}/pr-merge-api-response.XXXXXX")
-    payload='{"Do":"squash"}'
-
-    if curl -fsS \
-        -X POST \
-        -H "Authorization: token $token" \
-        -H 'Content-Type: application/json' \
-        -d "$payload" \
-        "$api_url" > "$body_file"; then
-        rm -f "$body_file"
-        return 0
-    fi
-
-    python3 - "$body_file" <<'PY' >&2
-import json
-import sys
-
-path = sys.argv[1]
-try:
-    with open(path, encoding="utf-8", errors="replace") as handle:
-        raw = handle.read(500)
-    data = json.loads(raw) if raw else {}
-    message = data.get("message") or data.get("error") or raw or "empty response"
-except Exception:
-    try:
-        with open(path, encoding="utf-8", errors="replace") as handle:
-            message = handle.read(500) or "empty response"
-    except Exception:
-        message = "unreadable response"
-
-print(f"Error: Gitea API merge fallback failed: {message}")
-PY
-    rm -f "$body_file"
-    return 1
-}
-
 case "$PLATFORM" in
     github)
-        cmd=(gh pr merge "$PR_NUMBER" --squash)
+        CMD="gh pr merge $PR_NUMBER --squash"
-        [[ "$DELETE_BRANCH" == true ]] && cmd+=(--delete-branch)
+        [[ "$DELETE_BRANCH" == true ]] && CMD="$CMD --delete-branch"
-        "${cmd[@]}"
+        eval "$CMD"
         ;;
     gitea)
-        HOST=$(get_remote_host) || {
+        CMD="tea pr merge $PR_NUMBER --style squash --repo $OWNER/$REPO --login ${GITEA_LOGIN:-mosaicstack}"
-            echo "Error: Cannot determine host from origin remote URL" >&2
-            exit 1
-        }
-        TEA_LOGIN="${GITEA_LOGIN:-$(find_tea_login_for_host "$HOST" || true)}"
 
         # Delete branch after merge if requested
         if [[ "$DELETE_BRANCH" == true ]]; then
             echo "Note: Branch deletion after merge may need to be done separately with tea" >&2
         fi
 
-        if [[ -n "$TEA_LOGIN" ]]; then
+        eval "$CMD"
-            mkdir -p "${AGENT_WORK_ROOT:-/home/hermes/agent-work}"
-            TEA_ERROR_FILE=$(mktemp "${AGENT_WORK_ROOT:-/home/hermes/agent-work}/pr-merge-tea-error.XXXXXX")
-            if tea pr merge "$PR_NUMBER" --style squash --repo "$OWNER/$REPO" --login "$TEA_LOGIN" 2> "$TEA_ERROR_FILE"; then
-                rm -f "$TEA_ERROR_FILE"
-            elif is_known_tea_empty_identity_failure "$TEA_ERROR_FILE"; then
-                cat "$TEA_ERROR_FILE" >&2
-                echo "Known tea empty identity failure detected; using authenticated Gitea API merge fallback." >&2
-                rm -f "$TEA_ERROR_FILE"
-                merge_gitea_with_api "$HOST"
-            else
-                cat "$TEA_ERROR_FILE" >&2
-                rm -f "$TEA_ERROR_FILE"
-                exit 1
-            fi
-        else
-            echo "No tea login configured for $HOST; using authenticated Gitea API merge fallback." >&2
-            merge_gitea_with_api "$HOST"
-        fi
         ;;
     *)
         echo "Error: Could not detect git platform" >&2

packages/mosaic/framework/tools/git/pr-review.sh

@@ -85,7 +85,7 @@ if [[ "$PLATFORM" == "github" ]]; then
 elif [[ "$PLATFORM" == "gitea" ]]; then
     case $ACTION in
         approve)
-            tea pr approve "$PR_NUMBER" ${COMMENT:+--comment "$COMMENT"}
+            tea pr approve "$PR_NUMBER" $(get_gitea_repo_args) ${COMMENT:+--comment "$COMMENT"}
             echo "Approved Gitea PR #$PR_NUMBER"
             ;;
         request-changes)
@@ -93,7 +93,7 @@ elif [[ "$PLATFORM" == "gitea" ]]; then
                 echo "Error: Comment required for request-changes"
                 exit 1
             fi
-            tea pr reject "$PR_NUMBER" --comment "$COMMENT"
+            tea pr reject "$PR_NUMBER" $(get_gitea_repo_args) --comment "$COMMENT"
             echo "Requested changes on Gitea PR #$PR_NUMBER"
             ;;
         comment)
@@ -101,7 +101,7 @@ elif [[ "$PLATFORM" == "gitea" ]]; then
                 echo "Error: Comment required"
                 exit 1
             fi
-            tea pr comment "$PR_NUMBER" "$COMMENT"
+            tea pr comment "$PR_NUMBER" "$COMMENT" $(get_gitea_repo_args)
             echo "Added comment to Gitea PR #$PR_NUMBER"
             ;;
         *)

packages/mosaic/framework/tools/git/pr-view.sh

@@ -41,7 +41,7 @@ detect_platform
 if [[ "$PLATFORM" == "github" ]]; then
     gh pr view "$PR_NUMBER"
 elif [[ "$PLATFORM" == "gitea" ]]; then
-    tea pr "$PR_NUMBER"
+    tea pr "$PR_NUMBER" $(get_gitea_repo_args)
 else
     echo "Error: Unknown platform"
     exit 1

packages/mosaic/framework/tools/git/test-pr-merge-gitea-empty-uid.sh

@@ -1,216 +0,0 @@
-#!/bin/bash
-# Regression harness for pr-merge.sh Gitea non-interactive tea empty identity fallback.
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-WORK_ROOT="${AGENT_WORK_ROOT:-/home/hermes/agent-work}"
-SANDBOX="$WORK_ROOT/pr-merge-empty-uid-test-$$"
-MOCK_BIN="$SANDBOX/bin"
-REPO_DIR="$SANDBOX/repo"
-LOG_FILE="$SANDBOX/mock.log"
-
-cleanup() {
-    rm -rf "$SANDBOX"
-}
-trap cleanup EXIT
-
-mkdir -p "$MOCK_BIN" "$REPO_DIR"
-: > "$LOG_FILE"
-
-cat > "$MOCK_BIN/tea" <<'EOF'
-#!/bin/bash
-set -euo pipefail
-printf 'tea %q ' "$@" >> "$PR_MERGE_TEST_LOG"
-printf '\n' >> "$PR_MERGE_TEST_LOG"
-if [[ "$*" == *"pr merge"* ]]; then
-    echo 'user does not exist [uid: 0, name: ]' >&2
-    exit 1
-fi
-exit 0
-EOF
-chmod +x "$MOCK_BIN/tea"
-
-cat > "$MOCK_BIN/curl" <<'EOF'
-#!/bin/bash
-set -euo pipefail
-printf 'curl %q ' "$@" >> "$PR_MERGE_TEST_LOG"
-printf '\n' >> "$PR_MERGE_TEST_LOG"
-args=" $* "
-if [[ "$args" == *"/api/v1/repos/mosaicstack/stack/pulls/123"* && "$args" != *"/api/v1/repos/mosaicstack/stack/pulls/123/merge"* ]]; then
-    cat <<'JSON'
-{"number":123,"title":"mock","state":"open","user":{"login":"tester"},"head":{"ref":"feature/mock"},"base":{"ref":"main"},"labels":[],"assignees":[],"html_url":"https://git.mosaicstack.dev/mosaicstack/stack/pulls/123","mergeable":true}
-JSON
-    exit 0
-fi
-if [[ "$args" == *"-X POST"* && "$args" == *"/api/v1/repos/mosaicstack/stack/pulls/123/merge"* ]]; then
-    cat <<'JSON'
-{"merged":true,"message":"mock merge complete"}
-JSON
-    exit 0
-fi
-echo "unexpected curl invocation: $*" >&2
-exit 97
-EOF
-chmod +x "$MOCK_BIN/curl"
-
-cd "$REPO_DIR"
-git init -q
-git remote add origin https://git.mosaicstack.dev/mosaicstack/stack.git
-
-export PATH="$MOCK_BIN:$PATH"
-export PR_MERGE_TEST_LOG="$LOG_FILE"
-export GITEA_LOGIN="git.mosaicstack.dev"
-export GITEA_TOKEN="redacted-test-token"
-
-OUTPUT="$SANDBOX/output.log"
-if ! "$SCRIPT_DIR/pr-merge.sh" -n 123 -m squash --skip-queue-guard > "$OUTPUT" 2>&1; then
-    echo "Expected pr-merge.sh to recover via Gitea API fallback." >&2
-    echo "--- output ---" >&2
-    sed 's/redacted-test-token/***REDACTED***/g' "$OUTPUT" >&2
-    echo "--- mock log ---" >&2
-    sed 's/redacted-test-token/***REDACTED***/g' "$LOG_FILE" >&2
-    exit 1
-fi
-
-if ! grep -q '/api/v1/repos/mosaicstack/stack/pulls/123/merge' "$LOG_FILE"; then
-    echo "Expected authenticated Gitea merge API endpoint to be called." >&2
-    sed 's/redacted-test-token/***REDACTED***/g' "$LOG_FILE" >&2
-    exit 1
-fi
-
-if grep -q 'redacted-test-token' "$OUTPUT"; then
-    echo "Token leaked to pr-merge.sh output." >&2
-    exit 1
-fi
-
-cat > "$MOCK_BIN/tea" <<'EOF'
-#!/bin/bash
-set -euo pipefail
-printf 'tea %q ' "$@" >> "$PR_MERGE_TEST_LOG"
-printf '\n' >> "$PR_MERGE_TEST_LOG"
-if [[ "$*" == *"pr merge"* ]]; then
-    echo 'tea network timeout' >&2
-    exit 2
-fi
-exit 0
-EOF
-chmod +x "$MOCK_BIN/tea"
-: > "$LOG_FILE"
-if "$SCRIPT_DIR/pr-merge.sh" -n 123 -m squash --skip-queue-guard > "$OUTPUT" 2>&1; then
-    echo "Expected arbitrary tea failure to remain blocking." >&2
-    exit 1
-fi
-if grep -q '/api/v1/repos/mosaicstack/stack/pulls/123/merge' "$LOG_FILE"; then
-    echo "Arbitrary tea failure unexpectedly used Gitea API merge fallback." >&2
-    sed 's/redacted-test-token/***REDACTED***/g' "$LOG_FILE" >&2
-    exit 1
-fi
-if ! grep -q 'tea network timeout' "$OUTPUT"; then
-    echo "Expected arbitrary tea error to be preserved in output." >&2
-    sed 's/redacted-test-token/***REDACTED***/g' "$OUTPUT" >&2
-    exit 1
-fi
-
-cat > "$MOCK_BIN/tea" <<'EOF'
-#!/bin/bash
-set -euo pipefail
-printf 'tea %q ' "$@" >> "$PR_MERGE_TEST_LOG"
-printf '\n' >> "$PR_MERGE_TEST_LOG"
-if [[ "$*" == *"login list"* ]]; then
-    echo '[]'
-    exit 0
-fi
-if [[ "$*" == *"pr merge"* ]]; then
-    echo 'tea merge should not run without a configured host login' >&2
-    exit 99
-fi
-exit 0
-EOF
-chmod +x "$MOCK_BIN/tea"
-unset GITEA_LOGIN
-: > "$LOG_FILE"
-if ! "$SCRIPT_DIR/pr-merge.sh" -n 123 -m squash --skip-queue-guard > "$OUTPUT" 2>&1; then
-    echo "Expected missing tea login to use authenticated Gitea API fallback." >&2
-    sed 's/redacted-test-token/***REDACTED***/g' "$OUTPUT" >&2
-    sed 's/redacted-test-token/***REDACTED***/g' "$LOG_FILE" >&2
-    exit 1
-fi
-if ! grep -q '/api/v1/repos/mosaicstack/stack/pulls/123/merge' "$LOG_FILE"; then
-    echo "Expected missing tea login path to call Gitea API merge endpoint." >&2
-    sed 's/redacted-test-token/***REDACTED***/g' "$LOG_FILE" >&2
-    exit 1
-fi
-
-SENTINEL="$SANDBOX/injected-sentinel"
-INJECTION="123; touch $SENTINEL #"
-
-cat > "$MOCK_BIN/gh" <<'EOF'
-#!/bin/bash
-set -euo pipefail
-printf 'gh %q ' "$@" >> "$PR_MERGE_TEST_LOG"
-printf '\n' >> "$PR_MERGE_TEST_LOG"
-if [[ "$*" == *"pr view"* ]]; then
-    cat <<'JSON'
-{"number":123,"title":"mock","baseRefName":"main","headRefName":"feature/mock"}
-JSON
-    exit 0
-fi
-if [[ "$*" == *"pr merge"* ]]; then
-    exit 0
-fi
-echo "unexpected gh invocation: $*" >&2
-exit 98
-EOF
-chmod +x "$MOCK_BIN/gh"
-
-cd "$REPO_DIR"
-git remote set-url origin https://github.com/mosaicstack/stack.git
-: > "$LOG_FILE"
-rm -f "$SENTINEL"
-if "$SCRIPT_DIR/pr-merge.sh" -n "$INJECTION" -m squash --skip-queue-guard > "$OUTPUT" 2>&1; then
-    echo "Expected GitHub metacharacter PR number to be rejected." >&2
-    sed 's/redacted-test-token/***REDACTED***/g' "$OUTPUT" >&2
-    exit 1
-fi
-if [[ -e "$SENTINEL" ]]; then
-    echo "GitHub metacharacter PR number executed injected shell command." >&2
-    exit 1
-fi
-if [[ -s "$LOG_FILE" ]]; then
-    echo "GitHub metacharacter PR number should be rejected before gh calls." >&2
-    sed 's/redacted-test-token/***REDACTED***/g' "$LOG_FILE" >&2
-    exit 1
-fi
-if ! grep -q 'Invalid PR number' "$OUTPUT"; then
-    echo "Expected invalid PR number error for GitHub metacharacter input." >&2
-    sed 's/redacted-test-token/***REDACTED***/g' "$OUTPUT" >&2
-    exit 1
-fi
-
-cd "$REPO_DIR"
-git remote set-url origin https://git.mosaicstack.dev/mosaicstack/stack.git
-export GITEA_LOGIN="git.mosaicstack.dev"
-: > "$LOG_FILE"
-rm -f "$SENTINEL"
-if "$SCRIPT_DIR/pr-merge.sh" -n "$INJECTION" -m squash --skip-queue-guard > "$OUTPUT" 2>&1; then
-    echo "Expected Gitea metacharacter PR number to be rejected." >&2
-    sed 's/redacted-test-token/***REDACTED***/g' "$OUTPUT" >&2
-    exit 1
-fi
-if [[ -e "$SENTINEL" ]]; then
-    echo "Gitea metacharacter PR number executed injected shell command." >&2
-    exit 1
-fi
-if [[ -s "$LOG_FILE" ]]; then
-    echo "Gitea metacharacter PR number should be rejected before tea/curl calls." >&2
-    sed 's/redacted-test-token/***REDACTED***/g' "$LOG_FILE" >&2
-    exit 1
-fi
-if ! grep -q 'Invalid PR number' "$OUTPUT"; then
-    echo "Expected invalid PR number error for Gitea metacharacter input." >&2
-    sed 's/redacted-test-token/***REDACTED***/g' "$OUTPUT" >&2
-    exit 1
-fi
-
-echo "pr-merge.sh Gitea fallback regression passed"