- Fix GitHub Enterprise regression: dispatcher now probes for Gitea only
on non-github.com hosts and falls back to the GitHub path for unknown
hosts, preserving GHE support that the earlier strict github.com match
broke.
- Refactor readUrlSkillImports into a flat dispatcher with a sibling
readGitHubUrlSkillImports helper, mirroring readGiteaUrlSkillImports.
- Add SSRF guard (isPrivateOrLoopbackHost + assertPublicHost) in
gitea-fetch; short-circuit probeGiteaHost and reject parseGiteaSourceUrl
for loopback / RFC1918 / link-local literal IPs.
- Throw on fetchGiteaTreeBlobPaths cap-hit instead of silently returning a
partial blob listing (would hide SKILL.md files).
- Validate non-empty repo in parseGiteaSourceUrl after .git strip.
- Remove dead resolveGiteaCommitSha + GiteaCommitResponse (unused since
the branches-endpoint follow-up).
- Tests updated and extended.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Chris Farhood
33ab4f8cdd