deriveCanonicalSkillKey only emitted the owner/repo-based key for
github and skills_sh sources, so Gitea skills fell through to the
generic company/{companyId}/{slug} branch. Add gitea to the
sourceType / sourceKind clause so a Gitea skill at
git.example.com/owner/repo gets key owner/repo/{slug}, matching the
GitHub format. Existing imports keep their old keys until re-imported.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Fix GitHub Enterprise regression: dispatcher now probes for Gitea only
on non-github.com hosts and falls back to the GitHub path for unknown
hosts, preserving GHE support that the earlier strict github.com match
broke.
- Refactor readUrlSkillImports into a flat dispatcher with a sibling
readGitHubUrlSkillImports helper, mirroring readGiteaUrlSkillImports.
- Add SSRF guard (isPrivateOrLoopbackHost + assertPublicHost) in
gitea-fetch; short-circuit probeGiteaHost and reject parseGiteaSourceUrl
for loopback / RFC1918 / link-local literal IPs.
- Throw on fetchGiteaTreeBlobPaths cap-hit instead of silently returning a
partial blob listing (would hide SKILL.md files).
- Validate non-empty repo in parseGiteaSourceUrl after .git strip.
- Remove dead resolveGiteaCommitSha + GiteaCommitResponse (unused since
the branches-endpoint follow-up).
- Tests updated and extended.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Gitea's /repos/{o}/{r}/commits/{ref} only resolves 40-hex SHAs —
a branch name like "main" returns 404 even when the branch exists.
GitHub's API is more lenient and resolves branch names server-side.
resolveGiteaPinnedRef was calling /commits/{ref} and 404ing on
branch refs, so the entire import path failed before it could
read the tree. updateStatus already used the branches endpoint
correctly; this aligns resolveGiteaPinnedRef with it.
resolveGiteaCommitSha is now a SHA-only helper that refuses to
make the API call for non-SHA refs (matches Gitea's contract).
Test mocks updated to return the branch response shape.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Reintroduce Gitea/Forgejo as a skill import source on dev only, since
the fork deploys against git.farh.net. Pasting a Gitea/Forgejo repo
URL into the skills sidebar mirrors the existing GitHub experience:
pin to a commit SHA, check for updates, read repo files.
Server: new gitea-fetch.ts (URL builders, probe-cache helpers) and
gitea-skills.ts (parse, probe, pin, tree, text, branch). Dispatch in
readUrlSkillImports probes /api/v1/version and routes non-github.com
hosts into the new readGiteaUrlSkillImports branch. updateStatus and
readFile get a gitea arm alongside the github/skills_sh arm. Audit
falls through to "remote not supported" the same way github does.
UI: Server icon, Gitea source label, gitea in the "external" source
class, Pin/Update UI gate widened to sourceType === "gitea". CLI help
text updated. Existing github code is left byte-for-byte unchanged
(wrapped in isGitHubDotCom) so dev <-> master syncs stay clean.
PAT support, gitea portability descriptors, and gitea audit are
deliberate follow-ups. Detection requires /api/v1/version to return
Gitea-shaped JSON; the per-host result is cached for process lifetime
with FIFO eviction at 1024 entries. Non-Gitea hosts fall through to
the existing raw-markdown url branch.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Chris Farhood