live: heartbeat sync 2026-10-18T19:52:41-07:00 (Refs #11)

agent/managed-skills/gitea-api-pr-operations/SKILL.md

@@ -1,31 +1,64 @@
 ---
 name: gitea-api-pr-operations
-description: "Open, list, merge, and diagnose issues/PRs on the Dankclaw Gitea API (192.168.0.143:3000, dank/command-center) with curl + token — merge payload quirk included"
+description: "Open, list, merge, and diagnose issues/PRs on the Dankclaw Gitea API (192.168.0.143:3000, repo dank/command-center) with the token stored in ~/.config/secrets/gitea — incl. the required merge payload and where review comments actually live on 1.27.3."
 ---
 
-# Gitea API PR operations on Dankclaw
+# Gitea API PR operations (Dankclaw `dank/command-center`)
 
-Verified 2026-10-18 on Gitea at `http://192.168.0.143:3000`, repo `dank/command-center` (owner `dank`).
+## Where
+- Token: `~/.config/secrets/gitea` (`http://user:TOKEN@192.168.0.143` single line).
+  Extract WITHOUT echoing:
+  `tok=$(sed -nE 's#^http://[^:/@]+:([^@]+)@192\.168\.0\.143.*#\1#p' ~/.config/secrets/gitea | head -1)`
+- Build a 600-perm temp curl config and use `curl -K`:
+  `cfg=$(mktemp) && chmod 600 "$cfg" && printf 'header = "Authorization: token %s"\n' "$tok" > "$cfg"`
+  Delete `$cfg` after use. NEVER pass `-H "Authorization: token $tok"` (the literal
+  header lands in transcript + logs). NEVER echo the token.
+- Base URL: `http://192.168.0.143:3000/api/v1/repos/dank/command-center`.
 
-## Token handling (never echo)
-```bash
-tok=$(sed -nE 's#^http://[^:/@]+:([^@]+)@192\.168\.0\.143.*#\1#p' ~/.config/secrets/gitea | head -1)
-cfg=$(mktemp) && chmod 600 "$cfg" && printf 'header = "Authorization: token %s"\n' "$tok" > "$cfg"
-# use: curl -sS -K "$cfg" ...   then rm -f "$cfg"
-```
+## Recipes (all verified live 2026-10-18)
+- **Open PR** (token only needed for private repos; this one reads publicly but
+  POST needs auth): `POST /pulls` JSON `{title, head, base:"main", body}`.
+- **PATCH PR title/body**: `PATCH /pulls/<n>` with JSON body `{title}` and/or
+  `{body}`. Returns 201 with the full PR. Use `jq -n --arg` to build JSON; for
+  multi-line bodies write the text to a temp file and `--arg b "$(cat b.txt)"`.
+  (jq CLI: a bare `---` argument after the program is parsed as a flag → error;
+  fold footers into the --arg string instead.)
+- **List open PRs**: `GET /pulls?state=open` → `jq -r '.[] | "#\(.number) \(.head.ref) \(.title)"'`.
+- **Read PR**: `GET /pulls/<n>` (no token; public repo) → `jq -c '{state,merged,mergeable,head:.head.ref}'`.
+- **MERGE**: `POST /pulls/<n>/merge` with `-H 'Content-Type: application/json'`
+  and body **`{"Do":"merge"}`** — this build REQUIRES the `Do` field:
+  `{}` or `{"DoNotMerge":false,...}` → 422; `{"Do":"merge"}` → 200 +
+  `{"state":"closed","merged":true,"merge_commit_sha":"..."}`. Verify with a
+  plain GET /pulls/<n> afterwards (merge endpoint's own stdout may not parse).
+  Merge is the `--no-ff` merge commit on main; then `git -C ~/.omp fetch && git
+  merge --ff-only origin/main` propagates the live deployment.
+- **Issues**: same shape at `/issues` (`POST {title, body}`), `/issues/<n>/comments`
+  (`POST {body}`, `PATCH .../comments/<id>`) — both work with the temp-cfg auth.
 
-## Endpoints that work
-- Open PR: `POST /api/v1/repos/dank/command-center/pulls` with JSON `{title, head, base, body}` (build with `jq -n --arg`; `head` = branch name as-is, slashes included).
-- Patch PR (title/body): `PATCH .../pulls/<N>` — works, returns 201 with full PR JSON (`mergeable` field handy).
-- **Merge PR: `POST .../pulls/<N>/merge` with body `{"Do":"merge"}`** — capital-D `Do` is this Gitea's field (mirrors web UI form). `{}` or `{"DoNotMerge":false,...}` → 422 `[Do]: Required`. Success may return EMPTY body — verify with a separate `GET .../pulls/<N>` for `{state:"closed", merged:true, merge_commit_sha}`.
-- Issues: `POST .../issues` `{title, body}`; patch `PATCH .../issues/<N>`.
-- Issue/PR bodies MUST end with the AGENTS.md footer: `---` line, then `cwd: <wd> · session: <id>`. Embed the footer inside the body string (a bare `---` as a separate shell arg breaks `jq` arg parsing).
-- `xdg-open <url>` lands the PR/issue in Frank's Firefox — do it the moment a PR opens.
+## Review comments: the API lies on 1.27.3 (learned 2026-10-18)
+- `GET /pulls/<n>/comments` (inline review comments) → **404 `not found` on every
+  route** (token or not, `?pull_request_id=` or not) even when a review with
+  comments exists.
+- `GET /pulls/<n>/reviews` works (shows `state`, `comments_count`) but bodies are empty.
+- **The comments are readable from the PR HTML**:
+  `curl -sS http://192.168.0.143:3000/dank/command-center/pulls/<n> -o /tmp/pr.html`
+  then extract `<div class="content comment-content">` blocks
+  (python: `re.finditer(r'comment-content', src)` → widen ±800 chars, strip tags).
+  Duplicates appear (suggested-change UI shows text twice); dedupe mentally.
+- Per-conversation resolve API also 404s — flag resolutions in an issue comment instead.
+
+## Body-footer law (AGENTS.md)
+Every issue/PR body ends with `---` line then `cwd: <wd> · session: <id>`. Keep
+it inside the --arg string (not a `---` CLI arg).
 
 ## Gotchas
-- POST/PATCH need `-H 'Content-Type: application/json'` on the curl command line; `-d @file` alone with a wrong content type yields 422 `"model.assignUsers: Bind is required"`.
-- Merge-with-empty-response is normal; never conclude failure from blank stdout — GET the PR.
-- No `tea` CLI anywhere; API + curl is the only path. GITEA_TOKEN env exists in `~/.omp/.env` (gitignored) as alternative source.
-
-## Post-merge propagation
-The `~/.omp` checkout IS the deployment: `git -C ~/.omp fetch && git merge --ff-only origin/main` (dirty runtime files don't block ff). Never merge a PR at all without Frank's explicit OK.
+- Content-Type: POSTs with `-d @file.json` MUST carry
+  `-H 'Content-Type: application/json'` on the command line. `-H` entries put in
+  the curl config file are ignored for this (header ordering quirk).
+- `xdg-open <pr-url>` lands the PR in Frank's Firefox the moment it is opened —
+  law, not courtesy.
+- `jq: cannot index "not found" with "user"` = endpoint 404'd into an error
+  object; check `-w '%{http_code}'` before blaming jq.
+- The token in `.git/config`'s remote URL is the same secret; the credential
+  file (`~/.config/secrets/gitea`) is the one git actually consults (global
+  credential.helper) and the one to reuse for API calls.