stack/docs/scratchpads/536-wrapper-login-pin.md

Issue 536 Wrapper Login Pin Scratchpad

Metadata

• Date: 2026-06-12
• Worktree: /home/hermes/agent-work/536-wrapper-audit
• Branch: fix/536-wrapper-login-pin
• Coordinator: mos-claude
• Issue: mosaicstack/stack#536
• Scope: Audit and fix Gitea git wrappers that hardcode or incorrectly inherit tea login/instance selection.

Objective

Fix the framework git wrappers so Gitea issue/PR operations resolve the tea login from the target repository host instead of pinning mosaicstack. The fix must cover the class of bug across packages/mosaic/framework/tools/git/, not only issue-close.sh.

Acceptance Criteria

1. issue-close.sh no longer uses --login mosaicstack for non-mosaic hosts.
2. All wrappers in packages/mosaic/framework/tools/git/ avoid hardcoded Gitea login fallback where host-specific resolution is available.
3. Host-specific resolution works for git.mosaicstack.dev and git.uscllc.com using configured credentials / tea login data.
4. Read-only verification runs against both Gitea instances where possible.
5. Queue guard passes before push, PR is opened referencing #536, and merge is left to the coordinator.

Progress Log

• Read required Mosaic hard-gate docs and coordinator briefing.
• Read issue #536 via Gitea API with mosaicstack credentials.
• Initial audit found hardcoded ${GITEA_LOGIN:-mosaicstack} in issue and PR wrappers, plus shared get_gitea_repo_args.
• Added host-aware Gitea login resolution in detect-platform.sh, including exact host matching for tea login list entries and HTTPS remotes with embedded credentials.
• Updated Gitea issue, PR, milestone, and CI wrappers to use resolved host-specific tea login arguments instead of defaulting to mosaicstack.
• Added authenticated API fallbacks for close/reopen paths so wrappers can still operate when a matching tea login is absent but token credentials are available.
• Added regression coverage for stale GITEA_LOGIN, exact host matching, --repo override flows, USC issue close routing, mosaicstack API fallback, and PR metadata/merge fallbacks.
• Delta after PR #538 review: extended host-aware login/repo resolution to PowerShell wrappers, Bash milestone wrappers, and API-only --repo fallback paths.
• Delta after live USC pr-create.sh repro: tightened GITEA_LOGIN trust so stale login names are ignored unless the tea login itself matches the target host, and added USC API fallback coverage for pr-create.sh.

Verification

• bash -n packages/mosaic/framework/tools/git/*.sh
• packages/mosaic/framework/tools/git/test-gitea-login-resolution.sh
• packages/mosaic/framework/tools/git/test-pr-metadata-gitea.sh
• packages/mosaic/framework/tools/git/test-pr-merge-gitea-empty-uid.sh
• pwsh -NoProfile parse check for all packages/mosaic/framework/tools/git/*.ps1
• pnpm typecheck
• pnpm lint
• pnpm format:check
• pnpm --filter @mosaicstack/mosaic test -- src/commands/git-wrapper-redirects.spec.ts
• pnpm test progressed past wrapper redirect assertions; local run then stopped on apps/gateway Postgres connection refused at localhost:5433, which CI provides as a service.
• Live read-only: direct Gitea API read of mosaicstack/stack#536 with User-Agent: curl/8.
• Live read-only: USC temporary repo remote to https://git.uscllc.com/USC/uconnect.git; issue-list.sh -n 1 resolved the USC login and returned USC issues.
• Independent Codex review final verdict: approve, no findings.