Refs #1.
`scripts/install-apt.sh` explained the sqv rejection as a malformed MPI
encoding in an Ed25519 key. The registry does not serve one: at
`api/packages/heavy-duty/debian/repository.key`, `gpg --list-packets`
reports `algo 1` (RSA) with a 2048-bit `pkey[0]`. The explanation was
therefore wrong about the only part of itself that was checkable.
The comment now states the measurement and points at #1 for the cause,
rather than naming a mechanism nobody verified. This satisfies #1's
criterion that `git grep -in 25519` return no hits outside test fixtures,
which it now does.
Behaviour is unchanged: this commit edits a comment. The automatic
fallback this file still performs contradicts ruling B and is NOT fixed
here — that work is still owed on !38.
Tokens minted by stoke auth login previously got read/write on every
non-admin scope. Default to the reduced set the common issue/PR/repo
commands need (read/write issue + repository, read user + organization),
add --full-scopes to restore the old behavior and --scopes <csv> for a
custom list, and print the granted scopes after login.
Replaces #12, which committed every generated render into the repo. Rebuilt on
a clean branch because merging the original would have written those blobs into
main's history permanently, even with a later commit deleting them.
What changed from #12:
- Keeps docs/DESIGN.md and assets/logo-mark.svg (1.4 kB of vector text).
- Drops ~23 MB of PNG/MP4. They live in the Figma file, which was already the
source of truth and is linked from the doc. stoke's .git is ~23 MB; those
assets would have doubled it, forever.
- Adds the missing "files" whitelist to package.json. There wasn't one, so
npm pack shipped the whole working directory: measured 23.7 MB with the
assets, and it was already shipping the test suite without them. Now 26.7 kB
across 7 files.
The packaging bug is pre-existing and independent of the design work; the
oversized PR is just what made it visible.
61/61 tests pass; `stoke --version` → 1.3.0.
Clone repositories from the configured Forgejo instance using the stored
session. The token is passed to git through GIT_CONFIG_* environment-based
config (http.<url>.extraHeader) with GIT_TERMINAL_PROMPT=0, so it never
appears in the remote URL, on the command line, in logs, or in the cloned
repository's .git/config. Git streams its own output and its exit status is
forwarded to the caller.
Supports an optional destination directory plus --branch, --depth and
--origin. Adds tests covering destination handling, exit-status
propagation, remote naming, depth validation and credential redaction.
- chmod 0644 every keyring and sources.list entry after writing: tee
inherits the caller's umask, and under e.g. umask 077 apt's
unprivileged _apt user could not read the keyring
- Tests now run the script under umask 077 and assert the 0644 modes
(mutation-checked: dropping the chmod fails a test), and remove their
temp directories on exit
- Refusal error now states that metadata was already refreshed before
concluding the existing nodesource.list is unsuitable
Verified on fresh debian:13 under umask 077: all four files 0644,
install succeeds. npm test 32/32.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Covers the scenarios codex-reviewer recommended: suitable candidate
already present (incl. epoch stripping), missing metadata healed by a
refresh, bootstrap on too-old distro nodejs, bootstrap failure, and the
refuse-to-overwrite branch for a user-managed nodesource.list. Every
scenario runs under a localized LC_ALL with an apt-cache stub that only
emits the English Candidate: label under LC_ALL=C, so locale-safe
parsing is regression-tested (mutation-checked: dropping LC_ALL=C fails
3 tests).
install-apt.sh gains STOKE_APT_ETC to redirect /etc/apt to a throwaway
directory under test, following the script's existing env-override
pattern. Real-container flow re-verified on debian:13.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- pr comment now rejects whitespace-only bodies and preserves raw body.
- pr review accepts request_changes alias in addition to request-changes.
- Add CLI-boundary regression test proving review body-file whitespace is
preserved through the CLI and sent byte-for-byte to the API.
- Update README option help text for the new alias.
- Parse apt-cache policy under LC_ALL=C (Candidate: label is localized)
- Refresh apt metadata (best effort) and re-check before concluding no
suitable nodejs source exists
- Refuse to overwrite an existing /etc/apt/sources.list.d/nodesource.list
instead of silently replacing a user-managed entry
- README: manual path now adds the forge source, then the Node 22 source,
then runs apt-get update && install — in that order
Verified on fresh debian:13: install, idempotent re-run (NodeSource not
re-added), and the refusal branch with a pre-existing user list.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The package depends on nodejs (>= 22.12), but Debian 13 ships Node 20 and
Ubuntu 24.04 ships Node 18, so a fresh container failed apt-get install
with an unmet dependency. install-apt.sh now checks whether any configured
apt source can satisfy the requirement and, if not, adds the NodeSource
Node 22 repository before installing. README documents the behaviour and
the manual equivalent.
Verified on fresh debian:13 and ubuntu:24.04 containers: one-line setup,
apt-get install stoke, stoke --version all succeed.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Map CLI 'approve' to Forgejo's expected 'APPROVED' event.
- Require a non-empty body for request-changes and comment events.
- Update API test expectation and add CLI tests for body validation.
Adds CLI commands for inspecting a pull request, posting a comment, and
submitting an APPROVE/REQUEST_CHANGES/COMMENT review. Includes API client
methods, CLI wiring, and tests.
