gitea-cli-skill 0.3.1 → 0.4.0

package/assets/SKILL.md

@@ -15,7 +15,8 @@ Resolve `gitea-cli` to the platform binary in skill directory `~/.claude/skills/
 # Linux / macOS
 SKILL_DIR="$HOME/.claude/skills/gitea-cli"
 OS="$(uname -s | tr '[:upper:]' '[:lower:]')"
-ARCH="$(uname -m)" && [[ "$ARCH" == "x86_64" ]] && ARCH="amd64" && [[ "$ARCH" == "aarch64" || "$ARCH" == "arm64" ]] && ARCH="arm64"
+ARCH="$(uname -m)"
+case "$ARCH" in x86_64) ARCH="amd64" ;; aarch64|arm64) ARCH="arm64" ;; esac
 GITEA_CLI="$SKILL_DIR/scripts/${OS}-${ARCH}/gitea-cli"
 # Windows: %USERPROFILE%\.claude\skills\gitea-cli\scripts\windows-amd64\gitea-cli.exe
 ```
@@ -61,7 +62,7 @@ webhook list/get/create/update/delete/test — Webhooks
 
 ## Common Workflows
 
-When performing a task, follow the matching workflow. Read `REFERENCE.md` in the same skill directory for full command details and flags.
+When performing a task, follow the matching workflow. Read `references/command-reference.md` in the same skill directory for full command details and flags.
 
 **Issue** — `issue list` → `issue get <n>` → `comment create <n>` → `issue close <n>`
 **PR** — `branch create <name> --from <base>` → `pr create` → `actions run list` → `pr merge <idx>`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gitea-cli-skill",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "Install gitea-cli as a Claude Code skill",
   "bin": {
     "gitea-cli-skill": "src/index.js"

package/src/index.js

@@ -4,7 +4,8 @@
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
-const { execSync } = require('child_process');
+const crypto = require('crypto');
+const { execFileSync, execSync } = require('child_process');
 
 // ── Config ──────────────────────────────────────────────────────────────────
 
@@ -62,7 +63,6 @@ function resolveSkillDir(platformName, targetPath) {
   if (platformName && PLATFORMS[platformName]) {
     return path.join(os.homedir(), PLATFORMS[platformName].dir, SKILL_NAME);
   }
-  // Default: claude
   return path.join(os.homedir(), PLATFORMS.claude.dir, SKILL_NAME);
 }
 
@@ -75,38 +75,34 @@ function findGiteaCliBin(platformName, targetPath) {
   return path.join(skillDir, 'scripts', `${osArch.os}-${osArch.arch}`, binaryName);
 }
 
-// ── HTTP via curl (robust cross-platform) ───────────────────────────────────
+// ── HTTP via curl (execFileSync — no shell injection) ────────────────────────
 
-function curlGet(url, token) {
-  const args = ['-sS', '-f', '-k', '-H', 'User-Agent: gitea-cli-skill-installer'];
-  if (token) {
-    args.push('-H', `Authorization: token ${token}`);
-  }
+function curlGet(url, token, insecure) {
+  const args = ['-sS', '-f', '-H', 'User-Agent: gitea-cli-skill-installer'];
+  if (insecure) args.push('-k');
+  if (token) args.push('-H', `Authorization: token ${token}`);
   args.push(url);
-  return execSync(`curl ${args.map((a) => `"${a}"`).join(' ')}`, { encoding: 'utf-8', timeout: 30000 });
+  return execFileSync('curl', args, { encoding: 'utf-8', timeout: 30000 });
 }
 
-function curlDownload(url, destPath, token) {
-  const args = ['-sS', '-f', '-k', '-L', '-o', destPath, '-H', 'User-Agent: gitea-cli-skill-installer'];
-  if (token) {
-    args.push('-H', `Authorization: token ${token}`);
-  }
+function curlDownload(url, destPath, token, insecure) {
+  const args = ['-sS', '-f', '-L', '-o', destPath, '-H', 'User-Agent: gitea-cli-skill-installer'];
+  if (insecure) args.push('-k');
+  if (token) args.push('-H', `Authorization: token ${token}`);
   args.push(url);
-  execSync(`curl ${args.map((a) => `"${a}"`).join(' ')}`, { encoding: 'utf-8', timeout: 120000 });
+  execFileSync('curl', args, { encoding: 'utf-8', timeout: 120000 });
 }
 
 // ── Gitea API ────────────────────────────────────────────────────────────────
 
-function getLatestRelease(host, owner, repo, token) {
-  // Try /latest first
+function getLatestRelease(host, owner, repo, token, insecure) {
   try {
-    const data = curlGet(`${host}/api/v1/repos/${owner}/${repo}/releases/latest`, token);
+    const data = curlGet(`${host}/api/v1/repos/${owner}/${repo}/releases/latest`, token, insecure);
     const release = JSON.parse(data);
     if (release.assets && release.assets.length > 0) return release;
   } catch { /* fall through */ }
 
-  // List all releases, find latest with assets
-  const data = curlGet(`${host}/api/v1/repos/${owner}/${repo}/releases?limit=10`, token);
+  const data = curlGet(`${host}/api/v1/repos/${owner}/${repo}/releases?limit=10`, token, insecure);
   const releases = JSON.parse(data);
   for (const r of releases) {
     if (r.assets && r.assets.length > 0) return r;
@@ -120,14 +116,41 @@ function findAsset(release, osArch) {
   return release.assets.find((a) => a.name.endsWith(pattern) && !a.name.includes('checksum'));
 }
 
+function findChecksumAsset(release) {
+  return release.assets.find((a) => a.name.includes('checksums'));
+}
+
+// ── Checksum verification ────────────────────────────────────────────────────
+
+function verifyChecksum(archivePath, checksumContent, filename) {
+  for (const line of checksumContent.split('\n')) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    const parts = trimmed.split(/\s+/);
+    if (parts.length < 2) continue;
+    const [hash, name] = parts;
+    if (name === filename || path.basename(name) === filename) {
+      const actual = crypto.createHash('sha256').update(fs.readFileSync(archivePath)).digest('hex');
+      if (actual !== hash) {
+        throw new Error(`Checksum mismatch for ${filename}: expected ${hash}, got ${actual}`);
+      }
+      console.log('  Checksum verified (SHA256).');
+      return;
+    }
+  }
+  console.warn('  ⚠ Checksum entry not found for ${filename}, skipping verification.');
+}
+
 // ── Archive extraction ──────────────────────────────────────────────────────
 
 function extractArchive(archivePath, destDir, osArch) {
   fs.mkdirSync(destDir, { recursive: true });
   if (osArch.os === 'windows') {
-    execSync(`powershell -Command "Expand-Archive -Path '${archivePath}' -DestinationPath '${destDir}' -Force"`, { stdio: 'pipe' });
+    execFileSync('powershell', [
+      '-Command', 'Expand-Archive', '-Path', archivePath, '-DestinationPath', destDir, '-Force',
+    ], { stdio: 'pipe' });
   } else {
-    execSync(`tar -xzf "${archivePath}" -C "${destDir}"`, { stdio: 'pipe' });
+    execFileSync('tar', ['-xzf', archivePath, '-C', destDir], { stdio: 'pipe' });
   }
 
   const binaryName = osArch.os === 'windows' ? 'gitea-cli.exe' : 'gitea-cli';
@@ -147,7 +170,6 @@ function extractArchive(archivePath, destDir, osArch) {
 function configureContext({ giteaCliBin, host, token, contextName, defaultOwner, defaultRepo }) {
   const ctxName = contextName || 'default';
   const cmdArgs = [
-    `"${giteaCliBin}"`,
     'config', 'set',
     '--name', ctxName,
     '--host', host.replace(/\/$/, ''),
@@ -156,7 +178,11 @@ function configureContext({ giteaCliBin, host, token, contextName, defaultOwner,
   if (defaultOwner) cmdArgs.push('--default-owner', defaultOwner);
   if (defaultRepo) cmdArgs.push('--default-repo', defaultRepo);
 
-  execSync(cmdArgs.join(' '), { stdio: 'inherit', timeout: 10000 });
+  execFileSync(giteaCliBin, cmdArgs, {
+    stdio: 'inherit',
+    timeout: 10000,
+    env: { ...process.env }, // token passed via CLI flag, not env
+  });
 }
 
 // ── Version consistency check ────────────────────────────────────────────────
@@ -164,8 +190,7 @@ function configureContext({ giteaCliBin, host, token, contextName, defaultOwner,
 function checkVersionConsistency(binaryPath) {
   if (!fs.existsSync(binaryPath)) return;
   try {
-    const raw = execSync(`"${binaryPath}" --version`, { encoding: 'utf-8', timeout: 5000 }).trim();
-    // Parse version from output like "gitea-cli version 0.3.0" or just "0.3.0"
+    const raw = execFileSync(binaryPath, ['--version'], { encoding: 'utf-8', timeout: 5000 }).trim();
     const match = raw.match(/(\d+\.\d+\.\d+)/);
     if (!match) return;
     const binVersion = match[1];
@@ -179,7 +204,7 @@ function checkVersionConsistency(binaryPath) {
 // ── Install command ─────────────────────────────────────────────────────────
 
 async function install(args) {
-  const { token: explicitToken, host: explicitHost, platform: platformName, target: targetPath, local: localDir, force, name: contextName, 'default-owner': defaultOwner, 'default-repo': defaultRepo } = args;
+  const { token: explicitToken, host: explicitHost, platform: platformName, target: targetPath, local: localDir, force, name: contextName, 'default-owner': defaultOwner, 'default-repo': defaultRepo, insecure } = args;
   const giteaHost = explicitHost || GITEA_HOST;
   const token = explicitToken || process.env.GITEA_TOKEN || null;
   const osArch = detectOSArch();
@@ -189,26 +214,7 @@ async function install(args) {
   console.log(`Installing gitea-cli skill (${osArch.os}-${osArch.arch}) to ${skillDir}...`);
 
   // 1. Copy SKILL.md and references/
-  fs.mkdirSync(skillDir, { recursive: true });
-  const srcSkill = path.resolve(__dirname, '..', 'assets', 'SKILL.md');
-  const destSkill = path.join(skillDir, 'SKILL.md');
-  fs.copyFileSync(srcSkill, destSkill);
-  console.log(`  SKILL.md -> ${destSkill}`);
-
-  const srcRef = path.resolve(__dirname, '..', 'assets', 'references', 'command-reference.md');
-  const destRef = path.join(skillDir, 'references', 'command-reference.md');
-  if (fs.existsSync(srcRef)) {
-    fs.mkdirSync(path.dirname(destRef), { recursive: true });
-    fs.copyFileSync(srcRef, destRef);
-    console.log(`  references/command-reference.md -> ${destRef}`);
-  }
-
-  // Cleanup: remove legacy REFERENCE.md from old location
-  const legacyRef = path.join(skillDir, 'REFERENCE.md');
-  if (fs.existsSync(legacyRef)) {
-    fs.unlinkSync(legacyRef);
-    console.log('  Removed legacy REFERENCE.md');
-  }
+  copySkillFiles(skillDir);
 
   // 2. Check existing binary
   const binaryName = osArch.os === 'windows' ? 'gitea-cli.exe' : 'gitea-cli';
@@ -217,11 +223,9 @@ async function install(args) {
   if (fs.existsSync(destBinary) && !force) {
     console.log(`  Binary already exists: ${destBinary} (use --force to overwrite)`);
   } else if (localDir) {
-    // --local: copy from local directory
     installFromLocal(localDir, scriptsDir, destBinary, osArch);
   } else {
-    // Download from Gitea releases
-    await installFromRelease(giteaHost, token, scriptsDir, destBinary, osArch);
+    await installFromRelease(giteaHost, token, scriptsDir, destBinary, osArch, insecure);
   }
 
   // 3. Configure context if token provided
@@ -246,26 +250,48 @@ async function install(args) {
   console.log(`\nDone!`);
 }
 
+// ── Shared: copy SKILL.md + references + cleanup legacy ─────────────────────
+
+function copySkillFiles(skillDir) {
+  fs.mkdirSync(skillDir, { recursive: true });
+
+  const srcSkill = path.resolve(__dirname, '..', 'assets', 'SKILL.md');
+  const destSkill = path.join(skillDir, 'SKILL.md');
+  fs.copyFileSync(srcSkill, destSkill);
+  console.log(`  SKILL.md -> ${destSkill}`);
+
+  const srcRef = path.resolve(__dirname, '..', 'assets', 'references', 'command-reference.md');
+  const destRef = path.join(skillDir, 'references', 'command-reference.md');
+  if (fs.existsSync(srcRef)) {
+    fs.mkdirSync(path.dirname(destRef), { recursive: true });
+    fs.copyFileSync(srcRef, destRef);
+    console.log(`  references/command-reference.md -> ${destRef}`);
+  }
+
+  // Cleanup legacy file
+  const legacyRef = path.join(skillDir, 'REFERENCE.md');
+  if (fs.existsSync(legacyRef)) {
+    fs.unlinkSync(legacyRef);
+    console.log('  Removed legacy REFERENCE.md');
+  }
+}
+
 // ── Install from local goreleaser dist ───────────────────────────────────────
 
 function installFromLocal(localDir, scriptsDir, destBinary, osArch) {
-  // Goreleaser dist structure: dist/gitea-cli_<version>_<os>_<arch>/gitea-cli[.exe]
   const ext = osArch.os === 'windows' ? 'zip' : 'tar.gz';
-
   const resolvedDir = localDir.replace(/^~/, os.homedir());
 
-  // Try to find archive in dist/
   const files = fs.readdirSync(resolvedDir);
   const extRe = ext === 'tar.gz' ? 'tar\\.gz' : 'zip';
   const pattern = new RegExp('gitea-cli_\\d+\\.\\d+\\.\\d+(-\\w+)?_' + osArch.os + '_' + osArch.arch + '\\.' + extRe + '$');
   const match = files.find((f) => pattern.test(f));
   if (!match) {
-    // Try finding extracted binary directly
     const binaryName = osArch.os === 'windows' ? 'gitea-cli.exe' : 'gitea-cli';
     const subDirs = files.filter((f) => f.includes(`${osArch.os}_${osArch.arch}`) && fs.statSync(path.join(resolvedDir, f)).isDirectory());
     for (const d of subDirs) {
       const candidate = path.join(resolvedDir, d, binaryName);
-      if (fs.existsSync(candidate)) {
+      if (fs.existsSync(candidate) && fs.statSync(candidate).isFile()) {
         fs.mkdirSync(scriptsDir, { recursive: true });
         fs.copyFileSync(candidate, destBinary);
         if (osArch.os !== 'windows') fs.chmodSync(destBinary, 0o755);
@@ -292,12 +318,12 @@ function installFromLocal(localDir, scriptsDir, destBinary, osArch) {
 
 // ── Install from Gitea release ───────────────────────────────────────────────
 
-async function installFromRelease(giteaHost, token, scriptsDir, destBinary, osArch) {
+async function installFromRelease(giteaHost, token, scriptsDir, destBinary, osArch, insecure) {
   console.log(`  Fetching latest release from ${giteaHost}...`);
 
   let release;
   try {
-    release = getLatestRelease(giteaHost, GITEA_OWNER, GITEA_REPO, token);
+    release = getLatestRelease(giteaHost, GITEA_OWNER, GITEA_REPO, token, insecure);
   } catch (err) {
     if (!token) {
       console.error(`  Failed to fetch release without token: ${err.message}`);
@@ -322,7 +348,21 @@ async function installFromRelease(giteaHost, token, scriptsDir, destBinary, osAr
   const tmpArchive = path.join(tmpDir, asset.name);
 
   try {
-    curlDownload(asset.browser_download_url, tmpArchive, token);
+    curlDownload(asset.browser_download_url, tmpArchive, token, insecure);
+
+    // Verify checksum if available
+    const checksumAsset = findChecksumAsset(release);
+    if (checksumAsset) {
+      try {
+        const tmpChecksum = path.join(tmpDir, checksumAsset.name);
+        curlDownload(checksumAsset.browser_download_url, tmpChecksum, token, insecure);
+        const checksumContent = fs.readFileSync(tmpChecksum, 'utf-8');
+        verifyChecksum(tmpArchive, checksumContent, asset.name);
+      } catch (err) {
+        console.warn(`  ⚠ Checksum verification skipped: ${err.message}`);
+      }
+    }
+
     console.log('  Extracting...');
     const binaryPath = extractArchive(tmpArchive, path.join(tmpDir, 'extracted'), osArch);
     fs.mkdirSync(scriptsDir, { recursive: true });
@@ -363,8 +403,9 @@ async function addContext(args) {
 // ── Update command ────────────────────────────────────────────────────────────
 
 async function update(args) {
-  const { host: explicitHost, platform: platformName, target: targetPath, local: localDir } = args;
+  const { token: explicitToken, host: explicitHost, platform: platformName, target: targetPath, local: localDir, insecure } = args;
   const giteaHost = explicitHost || GITEA_HOST;
+  const token = explicitToken || process.env.GITEA_TOKEN || null;
   const osArch = detectOSArch();
   const skillDir = resolveSkillDir(platformName, targetPath);
   const scriptsDir = path.join(skillDir, 'scripts', `${osArch.os}-${osArch.arch}`);
@@ -372,28 +413,7 @@ async function update(args) {
   console.log(`Updating gitea-cli skill (${osArch.os}-${osArch.arch}) at ${skillDir}...`);
 
   // 1. Refresh SKILL.md and references/
-  const srcSkill = path.resolve(__dirname, '..', 'assets', 'SKILL.md');
-  const destSkill = path.join(skillDir, 'SKILL.md');
-  if (fs.existsSync(srcSkill)) {
-    fs.mkdirSync(skillDir, { recursive: true });
-    fs.copyFileSync(srcSkill, destSkill);
-    console.log(`  SKILL.md -> ${destSkill}`);
-  }
-
-  const srcRef = path.resolve(__dirname, '..', 'assets', 'references', 'command-reference.md');
-  const destRef = path.join(skillDir, 'references', 'command-reference.md');
-  if (fs.existsSync(srcRef)) {
-    fs.mkdirSync(path.dirname(destRef), { recursive: true });
-    fs.copyFileSync(srcRef, destRef);
-    console.log(`  references/command-reference.md -> ${destRef}`);
-  }
-
-  // Cleanup: remove legacy REFERENCE.md from old location
-  const legacyRef = path.join(skillDir, 'REFERENCE.md');
-  if (fs.existsSync(legacyRef)) {
-    fs.unlinkSync(legacyRef);
-    console.log('  Removed legacy REFERENCE.md');
-  }
+  copySkillFiles(skillDir);
 
   // 2. Re-download / re-copy binary (always overwrite)
   const binaryName = osArch.os === 'windows' ? 'gitea-cli.exe' : 'gitea-cli';
@@ -402,8 +422,7 @@ async function update(args) {
   if (localDir) {
     installFromLocal(localDir, scriptsDir, destBinary, osArch);
   } else {
-    const token = process.env.GITEA_TOKEN || null;
-    await installFromRelease(giteaHost, token, scriptsDir, destBinary, osArch);
+    await installFromRelease(giteaHost, token, scriptsDir, destBinary, osArch, insecure);
   }
 
   // 3. Version consistency check
@@ -415,11 +434,12 @@ async function update(args) {
 // ── CLI ──────────────────────────────────────────────────────────────────────
 
 function parseArgs(argv) {
-  const args = { token: null, host: null, platform: null, target: null, local: null, force: false, command: null, subcommand: null, name: null, 'default-owner': null, 'default-repo': null };
+  const args = { token: null, host: null, platform: null, target: null, local: null, force: false, insecure: false, command: null, subcommand: null, name: null, 'default-owner': null, 'default-repo': null };
 
   for (let i = 2; i < argv.length; i++) {
     const arg = argv[i];
-    if (arg === '--token' && i + 1 < argv.length) args.token = argv[++i];
+    if (arg === '--') break; // end of options
+    else if (arg === '--token' && i + 1 < argv.length) args.token = argv[++i];
     else if (arg === '--host' && i + 1 < argv.length) args.host = argv[++i];
     else if (arg === '--platform' && i + 1 < argv.length) args.platform = argv[++i];
     else if (arg === '--target' && i + 1 < argv.length) args.target = argv[++i];
@@ -428,6 +448,8 @@ function parseArgs(argv) {
     else if (arg === '--default-owner' && i + 1 < argv.length) args['default-owner'] = argv[++i];
     else if (arg === '--default-repo' && i + 1 < argv.length) args['default-repo'] = argv[++i];
     else if (arg === '--force' || arg === '-f') args.force = true;
+    else if (arg === '--insecure') args.insecure = true;
+    else if (arg === '--version' || arg === '-v') { console.log(`gitea-cli-skill v${PKG_VERSION}`); process.exit(0); }
     else if (arg === '--help' || arg === '-h') { printHelp(); process.exit(0); }
     else if (!arg.startsWith('-') && !args.command) args.command = arg;
     else if (!arg.startsWith('-') && args.command && !args.subcommand) args.subcommand = arg;
@@ -440,7 +462,7 @@ function printHelp() {
     .map(([k, v]) => `    ${k.padEnd(10)} ${v.desc}`)
     .join('\n');
 
-  console.log(`gitea-cli-skill - Install gitea-cli as an AI agent skill
+  console.log(`gitea-cli-skill v${PKG_VERSION} - Install gitea-cli as an AI agent skill
 
 Usage:
   npx gitea-cli-skill init [flags]                          # Install + configure
@@ -464,6 +486,7 @@ Flags (init):
   --force                  Overwrite existing binary
 
 Flags (update):
+  --token <t>              Gitea API token (overrides GITEA_TOKEN env var)
   --host <url>             Gitea host URL (default: ${GITEA_HOST})
   --local <dir>            Update from local goreleaser dist directory (skip download)
   --platform <name>        Target AI platform (default: claude)
@@ -479,6 +502,8 @@ Flags (add context):
 
 Global:
   -h, --help               Show this help
+  -v, --version            Show version
+  --insecure               Skip SSL certificate verification (not recommended)
 
 Platforms:
 ${platformList}
@@ -516,7 +541,6 @@ async function main() {
   if (!args.command) { printHelp(); process.exit(0); }
 
   if (args.command === 'init') {
-    // Validate platform name
     if (args.platform && !PLATFORMS[args.platform] && !args.target) {
       console.error(`Unknown platform: ${args.platform}`);
       console.error(`Available: ${Object.keys(PLATFORMS).join(', ')}, or use --target for custom path.`);