command-center/agent/managed-skills/gitea-token-from-http-credential-store/SKILL.md

name, description

name	description
gitea-token-from-http-credential-store	Extract the Dankclaw Gitea token from ~/.config/secrets/gitea (a URL-line credential store using http:// and %3a-encoded port) without the empty-token 401; covers the https-only extraction trap and the $$..$$ shell-expansion trap.

Gitea token out of the HTTP credential store

~/.config/secrets/gitea is a git credential-store file, not a bare token file. On the Dank boxes it reads:

http://dank:b7caa2f689cdc00841854b85cd0173386f707d86@192.168.0.143%3a3000

Three traps, all of which produce a silent 401 Unauthorized rather than a parse error:

1. Scheme is http://, not https://. An extraction pattern written s#^https://…# matches nothing and yields an empty token. GNU BRE has no ? quantifier — use the http[s]*:// form or Python https?://:

   TOK=$(sed -n 's#^http[s]*://[^:]*:\([^@]*\)@.*#\1#p' ~/.config/secrets/gitea)
   test -n "$TOK" || echo "extraction failed"   # never ship an unasserted capture
   

   tok = re.search(r"https?://[^:]*:([^@]+)@", pathlib.Path.home().joinpath(".config/secrets/gitea").read_text()).group(1)
   

   Always assert non-empty (test -n) or print ${#TOK} once: a correct token here is 40 chars, and the length check catches a wrong pattern without echoing the secret.

2. The token body contains $$…$$. An omp output token inside a file is inert, but pasted literally into a shell script line it expands ($$ = shell PID). Keep it in a variable or read it from the file — never inline it in command text.

3. Port is percent-encoded (%3a3000). Don't rebuild the API URL from that line; the working endpoints are http://192.168.0.143:3000/api/v1/... and https://gitea.franksdank.cloud/api/v1/... — both serve the same API, so a host/port mismatch looks like an auth failure.

Auth header for every call: Authorization: token $TOK (the token keyword is required; a bare value 401s too).

Never print the token. Extract into a variable, then use $TOK; read the file with read path=...:raw only when you must inspect the format.

Related: gitea-pr-api-cycle (POST/PATCH body shapes), gitea-merge-form-encoded (merge needs do=merge&merge_style=no-ff, answers 200 with an empty body — verify by fetching the PR, not by reading the response), gitea-credential-store-url-format.