fix(login): delete OAuth token using the stored login name

- Pass the stored login name to DeleteOAuthToken instead of the
  CLI-provided one: the login lookup is case-insensitive but credstore
  keys are exact-match, so deleting with different casing left the
  encrypted token orphaned in the credential store

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/release-nightly.yml

@@ -8,16 +8,28 @@ jobs:
   goreleaser:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
       - run: git fetch --force --tags
-      - uses: actions/setup-go@v6
+      # Custom publishers (the R2 mirror below) run as the very last
+      # step of goreleaser's publish pipeline, after the Gitea release
+      # has already been created and every artifact already uploaded
+      # to S3. Fail here instead, before anything is built or
+      # published, if the R2 secrets are missing.
+      - name: check R2 configuration
+        run: sh scripts/upload-r2.sh --check-config
+        env:
+          R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
+          R2_BUCKET: ${{ secrets.R2_BUCKET }}
+          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
+          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version-file: "go.mod"
       - name: import gpg
         id: import_gpg
-        uses: crazy-max/ghaction-import-gpg@v7
+        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7
         with:
           gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
           passphrase: ${{ secrets.GPGSIGN_PASSPHRASE }}
@@ -25,10 +37,10 @@ jobs:
         id: sdk_version
         run: echo "version=$(go list -f '{{.Version}}' -m gitea.dev/sdk)" >> "$GITHUB_OUTPUT"
       - name: goreleaser
-        uses: goreleaser/goreleaser-action@v7
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
         with:
             distribution: goreleaser-pro
-            version: "~> v1"
+            version: "~> v2"
             args: release --nightly
         env:
           SDK_VERSION: ${{ steps.sdk_version.outputs.version }}
@@ -38,6 +50,10 @@ jobs:
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           S3_REGION: ${{ secrets.AWS_REGION }}
           S3_BUCKET: ${{ secrets.AWS_BUCKET }}
+          R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
+          R2_BUCKET: ${{ secrets.R2_BUCKET }}
+          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
+          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
           GORELEASER_FORCE_TOKEN: 'gitea'
           GPGSIGN_PASSPHRASE: ${{ secrets.GPGSIGN_PASSPHRASE }}
           GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
@@ -49,24 +65,24 @@ jobs:
       DOCKER_LATEST: nightly
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0 # all history for all branches and tags
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
 
       - name: Set up Docker BuildX
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
 
       - name: Login to DockerHub
-        uses: docker/login-action@v4
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
       - name: Build and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
         env:
           ACTIONS_RUNTIME_TOKEN: '' # See https://gitea.com/gitea/act_runner/issues/119
         with:

.gitea/workflows/release-tag.yml

@@ -9,16 +9,28 @@ jobs:
   goreleaser:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
       - run: git fetch --force --tags
-      - uses: actions/setup-go@v6
+      # Custom publishers (the R2 mirror below) run as the very last
+      # step of goreleaser's publish pipeline, after the Gitea release
+      # has already been created and every artifact already uploaded
+      # to S3. Fail here instead, before anything is built or
+      # published, if the R2 secrets are missing.
+      - name: check R2 configuration
+        run: sh scripts/upload-r2.sh --check-config
+        env:
+          R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
+          R2_BUCKET: ${{ secrets.R2_BUCKET }}
+          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
+          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version-file: 'go.mod'
       - name: import gpg
         id: import_gpg
-        uses: crazy-max/ghaction-import-gpg@v7
+        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7
         with:
           gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
           passphrase: ${{ secrets.GPGSIGN_PASSPHRASE }}
@@ -26,10 +38,10 @@ jobs:
         id: sdk_version
         run: echo "version=$(go list -f '{{.Version}}' -m gitea.dev/sdk)" >> "$GITHUB_OUTPUT"
       - name: goreleaser
-        uses: goreleaser/goreleaser-action@v7
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
         with:
             distribution: goreleaser-pro
-            version: "~> v1"
+            version: "~> v2"
             args: release
         env:
           SDK_VERSION: ${{ steps.sdk_version.outputs.version }}
@@ -39,6 +51,10 @@ jobs:
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           S3_REGION: ${{ secrets.AWS_REGION }}
           S3_BUCKET: ${{ secrets.AWS_BUCKET }}
+          R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
+          R2_BUCKET: ${{ secrets.R2_BUCKET }}
+          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
+          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
           GORELEASER_FORCE_TOKEN: 'gitea'
           GPGSIGN_PASSPHRASE: ${{ secrets.GPGSIGN_PASSPHRASE }}
           GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
@@ -50,18 +66,18 @@ jobs:
       DOCKER_LATEST: nightly
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0 # all history for all branches and tags
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
 
       - name: Set up Docker BuildX
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
 
       - name: Login to DockerHub
-        uses: docker/login-action@v4
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
@@ -71,7 +87,7 @@ jobs:
         run: echo "VERSION=${GITHUB_REF#refs/tags/v}" >> $GITHUB_ENV
 
       - name: Build and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
         env:
           ACTIONS_RUNTIME_TOKEN: '' # See https://gitea.com/gitea/act_runner/issues/119
         with:

.gitea/workflows/test-pr.yml

@@ -16,8 +16,8 @@ jobs:
     name: Lint Build And Unit Coverage
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version-file: 'go.mod'
       - name: lint and build
@@ -41,17 +41,28 @@ jobs:
       GITEA_TEA_TEST_USERNAME: "test01"
       GITEA_TEA_TEST_PASSWORD: "test01"
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version-file: 'go.mod'
-      - run: curl --noproxy "*" http://gitea:3000/api/v1/version # verify connection to instance
+      - name: wait for the gitea instance to be ready
+        run: |
+          for i in $(seq 1 30); do
+            if curl --noproxy "*" -sf http://gitea:3000/api/v1/version; then
+              echo "gitea is ready after ${i} attempt(s)"
+              exit 0
+            fi
+            echo "waiting for gitea, attempt ${i}/30"
+            sleep 2
+          done
+          echo "::error::gitea did not become ready within 60s"
+          exit 1
       - name: integration test
         run: |
           make integration-test
     services:
       gitea:
-        image: docker.gitea.com/gitea:1.26.2
+        image: docker.gitea.com/gitea:1.27.0
         cmd:
           - bash
           - -c

.goreleaser.yaml

@@ -1,3 +1,5 @@
+version: 2
+
 before:
   hooks:
     - go mod tidy
@@ -79,11 +81,50 @@ blobs:
     provider: s3
     bucket: "{{ .Env.S3_BUCKET }}"
     region: "{{ .Env.S3_REGION }}"
-    folder: "tea/{{.Version}}"
+    directory: "tea/{{.Version}}"
     extra_files:
       - glob: ./**.xz
       - glob: ./**.sha256
 
+# Mirrors the S3 `blobs:` upload above into Cloudflare R2 during the
+# parallel S3+R2 period (S3 will be removed once migration completes).
+# A second `blobs:` entry is impossible here since the blob pipe
+# authenticates from the global AWS_* env with no per-entry
+# credentials; `publishers:` supports per-entry `env:` instead, so
+# it's used to invoke scripts/upload-r2.sh once per artifact. Custom
+# publishers inherit almost nothing from the environment, hence the
+# explicit R2_* forwarding below.
+#
+# This publisher fires more than once per distinct key because
+# goreleaser's release pipe already registers `release.extra_files`
+# (./**.xz and ./**.xz.sha256, see the `release:` block below) as
+# UploadableFile artifacts, and `internal/exec`'s filterArtifacts
+# appends this block's own extra_files with no de-duplication. It
+# can't be globbed away, since gobwas/glob (via goreleaser/fileglob)
+# has no substring-exclusion matcher. It's harmless: PUT is
+# idempotent, and the `./**.xz` glob below is kept deliberately so
+# this publisher declares its own complete file set rather than
+# implicitly depending on the `release:` block's globs.
+#
+# checksum: true mirrors goreleaser's generated checksums.txt;
+# signature: true additionally mirrors checksums.txt.sig, which the
+# `signs:` block below produces by GPG-signing that checksum file.
+# Without signature: true, artifacts downloaded from the R2 mirror
+# would have no signature file to verify against.
+publishers:
+  - name: cloudflare-r2
+    checksum: true
+    signature: true
+    extra_files:
+      - glob: ./**.xz
+      - glob: ./**.sha256
+    cmd: sh scripts/upload-r2.sh {{ abs .ArtifactPath }} tea/{{ .Version }}/{{ .ArtifactName }}
+    env:
+      - R2_ENDPOINT={{ index .Env "R2_ENDPOINT" }}
+      - R2_BUCKET={{ index .Env "R2_BUCKET" }}
+      - R2_ACCESS_KEY_ID={{ index .Env "R2_ACCESS_KEY_ID" }}
+      - R2_SECRET_ACCESS_KEY={{ index .Env "R2_SECRET_ACCESS_KEY" }}
+
 archives:
   - format: binary
     name_template: "{{ .Binary }}"
@@ -104,10 +145,10 @@ signs:
     args: ["--batch", "-u", "{{ .Env.GPG_FINGERPRINT }}", "--output", "${signature}", "--detach-sign", "${artifact}"]
 
 snapshot:
-  name_template: "{{ .Branch }}-devel"
+  version_template: "{{ .Branch }}-devel"
 
 nightly:
-  name_template: "{{ .Branch }}"
+  version_template: "{{ .Branch }}"
 
 gitea_urls:
   api: https://gitea.com/api/v1

cmd/comments/add.go

@@ -7,7 +7,6 @@ import (
 	stdctx "context"
 	"errors"
 	"fmt"
-	"io"
 	"strings"
 
 	gitea "gitea.dev/sdk"
@@ -32,7 +31,13 @@ var CmdCommentsAdd = cli.Command{
 	Description: "Add a comment to an issue or pull request.",
 	ArgsUsage:   "<issue / pr index> [<comment body>]",
 	Action:      RunCommentsAdd,
-	Flags:       flags.AllDefaultFlags,
+	Flags: append([]cli.Flag{
+		&cli.StringFlag{
+			Name:    "description",
+			Aliases: []string{"d"},
+			Usage:   "comment body (alternative to the positional argument)",
+		},
+	}, flags.AllDefaultFlags...),
 }
 
 // RunCommentsAdd creates a new comment.
@@ -54,18 +59,12 @@ func RunCommentsAdd(requestCtx stdctx.Context, cmd *cli.Command) error {
 		return err
 	}
 
-	body := strings.Join(ctx.Args().Tail(), " ")
-	// Only consume stdin if no positional body was given. interact.IsStdinPiped()
-	// is true for any non-TTY stdin (CI, subshells, agent harnesses) — not just
-	// piped data — so reading unconditionally would block forever in those
-	// contexts when the body is supplied via args.
-	if len(body) == 0 && interact.IsStdinPiped() {
-		if bodyStdin, err := io.ReadAll(ctx.Reader); err != nil {
+	stdinPiped := interact.IsStdinPiped()
+	body, err := resolveBody(strings.Join(ctx.Args().Tail(), " "), ctx.String("description"), stdinPiped, ctx.Reader)
+	if err != nil {
 		return err
-		} else if len(bodyStdin) != 0 {
-			body = string(bodyStdin)
 	}
-	} else if len(body) == 0 {
+	if len(body) == 0 && !stdinPiped {
 		if err := huh.NewForm(
 			huh.NewGroup(
 				huh.NewText().

cmd/comments/body.go

@@ -0,0 +1,37 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package comments
+
+import "io"
+
+// resolveBody picks the comment body from the non-interactive sources, in
+// precedence order:
+//
+//  1. the positional argument (kept first for back-compat with the historical
+//     'tea comment <idx> "<body>"' shorthand),
+//  2. the -d/--description flag (mirrors the body flag on 'issue create',
+//     'issue edit' and 'pr create'),
+//  3. piped stdin.
+//
+// stdin is only read when stdinPiped is true (a non-TTY stdin, e.g. CI,
+// subshells or agent harnesses) and no body was supplied otherwise, so the
+// command never blocks reading an interactive terminal when a body is already
+// given. An empty result means the caller should fall back to the editor (when
+// interactive) or error out.
+func resolveBody(positional, description string, stdinPiped bool, stdin io.Reader) (string, error) {
+	if len(positional) != 0 {
+		return positional, nil
+	}
+	if len(description) != 0 {
+		return description, nil
+	}
+	if stdinPiped {
+		stdinBytes, err := io.ReadAll(stdin)
+		if err != nil {
+			return "", err
+		}
+		return string(stdinBytes), nil
+	}
+	return "", nil
+}

cmd/comments/body_test.go

@@ -0,0 +1,101 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package comments
+
+import (
+	"io"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestResolveBody(t *testing.T) {
+	testCases := []struct {
+		name        string
+		positional  string
+		description string
+		stdinPiped  bool
+		stdin       string
+		expected    string
+	}{
+		{
+			name:       "positional only",
+			positional: "from positional",
+			expected:   "from positional",
+		},
+		{
+			name:        "description flag only",
+			description: "from -d",
+			expected:    "from -d",
+		},
+		{
+			name:        "positional wins over description for back-compat",
+			positional:  "from positional",
+			description: "from -d",
+			expected:    "from positional",
+		},
+		{
+			name:        "description wins over piped stdin",
+			description: "from -d",
+			stdinPiped:  true,
+			stdin:       "from stdin",
+			expected:    "from -d",
+		},
+		{
+			name:       "piped stdin used when nothing else given",
+			stdinPiped: true,
+			stdin:      "from stdin",
+			expected:   "from stdin",
+		},
+		{
+			name:       "stdin ignored when not piped (interactive terminal)",
+			stdinPiped: false,
+			stdin:      "should never be read",
+			expected:   "",
+		},
+		{
+			name:       "empty when no source provided",
+			stdinPiped: false,
+			expected:   "",
+		},
+		{
+			name:       "piped but empty stdin yields empty body",
+			stdinPiped: true,
+			stdin:      "",
+			expected:   "",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			body, err := resolveBody(tc.positional, tc.description, tc.stdinPiped, strings.NewReader(tc.stdin))
+			require.NoError(t, err)
+			assert.Equal(t, tc.expected, body)
+		})
+	}
+}
+
+// TestResolveBodyDoesNotReadStdinWhenBodyGiven guards the original bug: when a
+// body is supplied positionally (or via -d), stdin must not be consumed, so the
+// command can never block on a non-TTY stdin under CI / agent harnesses.
+func TestResolveBodyDoesNotReadStdinWhenBodyGiven(t *testing.T) {
+	reader := &trackingReader{}
+
+	body, err := resolveBody("positional body", "", true, reader)
+	require.NoError(t, err)
+	assert.Equal(t, "positional body", body)
+	assert.False(t, reader.read, "stdin must not be read when a body is supplied")
+}
+
+// trackingReader records whether Read was ever called.
+type trackingReader struct {
+	read bool
+}
+
+func (r *trackingReader) Read(p []byte) (int, error) {
+	r.read = true
+	return 0, io.EOF
+}

cmd/comments/edit.go

@@ -7,7 +7,6 @@ import (
 	stdctx "context"
 	"errors"
 	"fmt"
-	"io"
 	"strings"
 
 	gitea "gitea.dev/sdk"
@@ -31,10 +30,16 @@ var CmdCommentsEdit = cli.Command{
 	Usage:   "Edit the body of an existing comment",
 	Description: `Edit the body of an existing comment by its comment ID. Use 'tea comments list <issue>' to find IDs.
 
-The new body can be supplied as a positional argument, piped on stdin, or (if neither is given and stdin is a terminal) entered in your $EDITOR.`,
+The new body can be supplied as a positional argument, via -d/--description, piped on stdin, or (if none is given and stdin is a terminal) entered in your $EDITOR.`,
 	ArgsUsage: "<comment id> [<new body>]",
 	Action:    RunCommentsEdit,
-	Flags:     flags.AllDefaultFlags,
+	Flags: append([]cli.Flag{
+		&cli.StringFlag{
+			Name:    "description",
+			Aliases: []string{"d"},
+			Usage:   "new comment body (alternative to the positional argument)",
+		},
+	}, flags.AllDefaultFlags...),
 }
 
 // RunCommentsEdit updates the body of an existing comment.
@@ -56,14 +61,12 @@ func RunCommentsEdit(requestCtx stdctx.Context, cmd *cli.Command) error {
 		return fmt.Errorf("invalid comment id %q: %s", ctx.Args().First(), err)
 	}
 
-	body := strings.Join(ctx.Args().Tail(), " ")
-	if len(body) == 0 && interact.IsStdinPiped() {
-		if bodyStdin, err := io.ReadAll(ctx.Reader); err != nil {
+	stdinPiped := interact.IsStdinPiped()
+	body, err := resolveBody(strings.Join(ctx.Args().Tail(), " "), ctx.String("description"), stdinPiped, ctx.Reader)
+	if err != nil {
 		return err
-		} else if len(bodyStdin) != 0 {
-			body = string(bodyStdin)
 	}
-	} else if len(body) == 0 {
+	if len(body) == 0 && !stdinPiped {
 		// Fetch current body to pre-populate the editor.
 		client := ctx.Login.Client()
 		current, _, fetchErr := client.Issues.GetIssueComment(requestCtx, ctx.Owner, ctx.Repo, id)

cmd/flags/issue_pr.go

@@ -177,10 +177,18 @@ func GetIssuePRCreateFlags(requestCtx stdctx.Context, ctx *context.TeaContext) (
 
 // IssuePREditFlags defines flags for editing properties of issues and PRs
 var IssuePREditFlags = append([]cli.Flag{
+	&cli.StringFlag{
+		Name:  "set-assignees",
+		Usage: "Clear all existing assignees and assign comma-separated list of usernames. Takes precedence over --add-assignees and --remove-assignees",
+	},
 	&cli.StringFlag{
 		Name:    "add-assignees",
 		Aliases: []string{"a"},
-		Usage:   "Comma-separated list of usernames to assign",
+		Usage:   "Comma-separated list of usernames to assign. Takes precedence over --remove-assignees",
+	},
+	&cli.StringFlag{
+		Name:  "remove-assignees",
+		Usage: "Comma-separated list of usernames to remove",
 	},
 	&cli.StringFlag{
 		Name:    "add-labels",
@@ -224,17 +232,25 @@ func GetIssuePREditFlags(ctx *context.TeaContext) (*task.EditIssueOption, error)
 			opts.Deadline = &t
 		}
 	}
+	if ctx.IsSet("set-assignees") {
+		val := ctx.String("set-assignees")
+		opts.SetAssignees = strings.Split(strings.ReplaceAll(val, " ", ""), ",")
+	}
 	if ctx.IsSet("add-assignees") {
 		val := ctx.String("add-assignees")
-		opts.AddAssignees = strings.Split(val, ",")
+		opts.AddAssignees = strings.Split(strings.ReplaceAll(val, " ", ""), ",")
+	}
+	if ctx.IsSet("remove-assignees") {
+		val := ctx.String("remove-assignees")
+		opts.RemoveAssignees = strings.Split(strings.ReplaceAll(val, " ", ""), ",")
 	}
 	if ctx.IsSet("add-labels") {
 		val := ctx.String("add-labels")
-		opts.AddLabels = strings.Split(val, ",")
+		opts.AddLabels = strings.Split(strings.ReplaceAll(val, " ", ""), ",")
 	}
 	if ctx.IsSet("remove-labels") {
 		val := ctx.String("remove-labels")
-		opts.RemoveLabels = strings.Split(val, ",")
+		opts.RemoveLabels = strings.Split(strings.ReplaceAll(val, " ", ""), ",")
 	}
 	return &opts, nil
 }

cmd/issues/list_test.go

@@ -0,0 +1,115 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package issues
+
+import (
+	stdctx "context"
+	"crypto/ed25519"
+	"crypto/rand"
+	"crypto/x509"
+	"encoding/pem"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"gitea.dev/tea/modules/config"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/urfave/cli/v3"
+	"golang.org/x/crypto/ssh"
+)
+
+func TestRunIssuesListWithSSHPubkeyLoginDoesNotDeadlock(t *testing.T) {
+	t.Parallel()
+
+	sshKeyPath, fingerprint := writeTestSSHKey(t)
+
+	var versionRequests atomic.Int32
+	var issueRequests atomic.Int32
+	var signedVersionRequests atomic.Int32
+	var signedIssueRequests atomic.Int32
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/api/v1/version":
+			versionRequests.Add(1)
+			if r.Header.Get("Signature") != "" {
+				signedVersionRequests.Add(1)
+			}
+			w.Header().Set("Content-Type", "application/json")
+			_, _ = w.Write([]byte(`{"version":"1.26.4"}`))
+		case "/api/v1/repos/gitea/tea/issues":
+			issueRequests.Add(1)
+			if r.Header.Get("Signature") != "" {
+				signedIssueRequests.Add(1)
+			}
+			w.Header().Set("Content-Type", "application/json")
+			_, _ = w.Write([]byte(`[]`))
+		default:
+			t.Errorf("unexpected path %s", r.URL.Path)
+			w.WriteHeader(http.StatusNotFound)
+		}
+	}))
+	defer server.Close()
+
+	config.SetConfigForTesting(config.LocalConfig{
+		Logins: []config.Login{{
+			Name:              "ssh-login",
+			URL:               server.URL,
+			SSHKey:            sshKeyPath,
+			SSHKeyFingerprint: fingerprint,
+			VersionCheck:      true,
+			Default:           true,
+		}},
+	})
+
+	cmd := cli.Command{
+		Name:  CmdIssuesList.Name,
+		Flags: CmdIssuesList.Flags,
+	}
+	require.NoError(t, cmd.Set("login", "ssh-login"))
+	require.NoError(t, cmd.Set("repo", "gitea/tea"))
+	require.NoError(t, cmd.Set("output", "json"))
+
+	done := make(chan error, 1)
+	go func() {
+		done <- RunIssuesList(stdctx.Background(), &cmd)
+	}()
+
+	select {
+	case err := <-done:
+		require.NoError(t, err)
+	case <-time.After(2 * time.Second):
+		t.Fatal("RunIssuesList deadlocked while bootstrapping the server version for HTTPSign authentication")
+	}
+
+	assert.EqualValues(t, 1, versionRequests.Load())
+	assert.EqualValues(t, 0, signedVersionRequests.Load())
+	assert.EqualValues(t, 1, issueRequests.Load())
+	assert.EqualValues(t, 1, signedIssueRequests.Load())
+}
+
+func writeTestSSHKey(t *testing.T) (string, string) {
+	t.Helper()
+
+	_, privateKey, err := ed25519.GenerateKey(rand.Reader)
+	require.NoError(t, err)
+
+	pkcs8, err := x509.MarshalPKCS8PrivateKey(privateKey)
+	require.NoError(t, err)
+
+	pemBytes := pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: pkcs8})
+	sshKeyPath := filepath.Join(t.TempDir(), "id_ed25519")
+	require.NoError(t, os.WriteFile(sshKeyPath, pemBytes, 0o600))
+
+	signer, err := ssh.NewSignerFromKey(privateKey)
+	require.NoError(t, err)
+
+	return sshKeyPath, ssh.FingerprintSHA256(signer.PublicKey())
+}

cmd/notifications/list.go

@@ -63,12 +63,12 @@ func listNotifications(requestCtx stdctx.Context, cmd *cli.Command, status []git
 	var news []*gitea.NotificationThread
 	var err error
 
-	ctx, err := context.InitCommand(cmd)
+	all := cmd.Bool("mine")
+	ctx, err := context.InitCommandWithOptions(cmd, context.InitOptions{SkipLocalRepo: all})
 	if err != nil {
 		return err
 	}
 	client := ctx.Login.Client()
-	all := ctx.Bool("mine")
 
 	// This enforces pagination (see https://github.com/go-gitea/gitea/issues/16733)
 	listOpts := flags.GetListOptions(cmd)

cmd/notifications/list_test.go

@@ -0,0 +1,55 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package notifications
+
+import (
+	stdctx "context"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"runtime"
+	"testing"
+
+	"gitea.dev/tea/modules/config"
+	"github.com/stretchr/testify/require"
+	"github.com/urfave/cli/v3"
+)
+
+func TestRunNotificationsListMineDoesNotProbeGitRepository(t *testing.T) {
+	gitPath := filepath.Join(t.TempDir(), "git")
+	gitScript := "#!/bin/sh\necho 'git should not be called' >&2\nexit 1\n"
+	if runtime.GOOS == "windows" {
+		gitPath += ".bat"
+		gitScript = "@echo git should not be called 1>&2\r\nexit /b 1\r\n"
+	}
+	require.NoError(t, os.WriteFile(gitPath, []byte(gitScript), 0o755))
+	t.Setenv("PATH", filepath.Dir(gitPath))
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		require.Equal(t, "/api/v1/notifications", r.URL.Path)
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`[]`))
+	}))
+	defer server.Close()
+
+	config.SetConfigForTesting(config.LocalConfig{
+		Logins: []config.Login{{
+			Name:    "default",
+			URL:     server.URL,
+			Token:   "token",
+			User:    "user",
+			Default: true,
+		}},
+	})
+
+	cmd := cli.Command{
+		Name:  CmdNotificationsList.Name,
+		Flags: CmdNotificationsList.Flags,
+	}
+	require.NoError(t, cmd.Set("mine", "true"))
+	require.NoError(t, cmd.Set("output", "json"))
+
+	require.NoError(t, RunNotificationsList(stdctx.Background(), &cmd))
+}

cmd/notifications/mark_as.go

@@ -24,7 +24,7 @@ var CmdNotificationsMarkRead = cli.Command{
 	ArgsUsage:   "[all | <notification id>]",
 	Flags:       flags.NotificationFlags,
 	Action: func(requestCtx stdctx.Context, cmd *cli.Command) error {
-		ctx, err := context.InitCommand(cmd)
+		ctx, err := context.InitCommandWithOptions(cmd, context.InitOptions{SkipLocalRepo: cmd.Bool("mine")})
 		if err != nil {
 			return err
 		}
@@ -48,7 +48,7 @@ var CmdNotificationsMarkUnread = cli.Command{
 	ArgsUsage:   "[all | <notification id>]",
 	Flags:       flags.NotificationFlags,
 	Action: func(requestCtx stdctx.Context, cmd *cli.Command) error {
-		ctx, err := context.InitCommand(cmd)
+		ctx, err := context.InitCommandWithOptions(cmd, context.InitOptions{SkipLocalRepo: cmd.Bool("mine")})
 		if err != nil {
 			return err
 		}
@@ -72,7 +72,7 @@ var CmdNotificationsMarkPinned = cli.Command{
 	ArgsUsage:   "[all | <notification id>]",
 	Flags:       flags.NotificationFlags,
 	Action: func(requestCtx stdctx.Context, cmd *cli.Command) error {
-		ctx, err := context.InitCommand(cmd)
+		ctx, err := context.InitCommandWithOptions(cmd, context.InitOptions{SkipLocalRepo: cmd.Bool("mine")})
 		if err != nil {
 			return err
 		}
@@ -95,7 +95,7 @@ var CmdNotificationsUnpin = cli.Command{
 	ArgsUsage:   "[all | <notification id>]",
 	Flags:       flags.NotificationFlags,
 	Action: func(requestCtx stdctx.Context, cmd *cli.Command) error {
-		ctx, err := context.InitCommand(cmd)
+		ctx, err := context.InitCommandWithOptions(cmd, context.InitOptions{SkipLocalRepo: cmd.Bool("mine")})
 		if err != nil {
 			return err
 		}

cmd/pulls.go

@@ -78,6 +78,7 @@ var CmdPulls = cli.Command{
 		&pulls.CmdPullsApprove,
 		&pulls.CmdPullsReject,
 		&pulls.CmdPullsMerge,
+		&pulls.CmdPullsReply,
 		&pulls.CmdPullsReviewComments,
 		&pulls.CmdPullsResolve,
 		&pulls.CmdPullsUnresolve,

cmd/pulls/reply.go

@@ -0,0 +1,29 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package pulls
+
+import (
+	stdctx "context"
+
+	"gitea.dev/tea/cmd/flags"
+	"gitea.dev/tea/modules/context"
+
+	"github.com/urfave/cli/v3"
+)
+
+// CmdPullsReply replies to a review comment on a pull request.
+var CmdPullsReply = cli.Command{
+	Name:        "reply",
+	Usage:       "Reply to a pull request review comment",
+	Description: "Reply to a pull request review comment",
+	ArgsUsage:   "<pull index> <comment id> [<reply>]",
+	Action: func(requestCtx stdctx.Context, cmd *cli.Command) error {
+		ctx, err := context.InitCommand(cmd)
+		if err != nil {
+			return err
+		}
+		return runPullReviewReply(requestCtx, ctx)
+	},
+	Flags: flags.AllDefaultFlags,
+}

cmd/pulls/reply_test.go

@@ -0,0 +1,70 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package pulls
+
+import (
+	"context"
+	"testing"
+
+	"gitea.dev/tea/modules/config"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestReply(t *testing.T) {
+	config.SetConfigForTesting(config.LocalConfig{
+		Logins: []config.Login{{
+			Name:    "testLogin",
+			URL:     "https://gitea.example.com",
+			Token:   "test-token",
+			User:    "testUser",
+			Default: true,
+		}},
+	})
+	t.Cleanup(func() {
+		config.SetConfigForTesting(config.LocalConfig{})
+	})
+
+	tests := []struct {
+		name        string
+		args        []string
+		wantErr     bool
+		errContains string
+	}{
+		{
+			name:        "no arguments",
+			args:        []string{},
+			wantErr:     true,
+			errContains: "pull request index and comment ID are required",
+		},
+		{
+			name:        "missing comment id",
+			args:        []string{"1"},
+			wantErr:     true,
+			errContains: "pull request index and comment ID are required",
+		},
+		{
+			name:        "pull index and comment id",
+			args:        []string{"1", "2"},
+			wantErr:     true,
+			errContains: "no reply content provided",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cmd := CmdPullsReply
+			args := append([]string{"reply"}, tt.args...)
+			args = append(args, "--login", "testLogin", "--repo", "user/repo")
+			err := cmd.Run(context.Background(), args)
+			if tt.wantErr {
+				assert.Error(t, err)
+				if tt.errContains != "" {
+					assert.Contains(t, err.Error(), tt.errContains)
+				}
+				return
+			}
+		})
+	}
+}

cmd/pulls/review_helpers.go

@@ -5,14 +5,21 @@ package pulls
 
 import (
 	stdctx "context"
+	"errors"
 	"fmt"
+	"io"
 	"strings"
 
 	gitea "gitea.dev/sdk"
 
+	"gitea.dev/tea/modules/config"
 	"gitea.dev/tea/modules/context"
+	"gitea.dev/tea/modules/interact"
 	"gitea.dev/tea/modules/task"
+	"gitea.dev/tea/modules/theme"
 	"gitea.dev/tea/modules/utils"
+
+	"charm.land/huh/v2"
 )
 
 // runPullReview handles the common logic for approving/rejecting pull requests
@@ -60,3 +67,62 @@ func runResolveComment(requestCtx stdctx.Context, ctx *context.TeaContext, actio
 
 	return action(requestCtx, ctx, commentID)
 }
+
+// runPullReviewReply handles replying to a specific review comment on a pull request.
+func runPullReviewReply(requestCtx stdctx.Context, ctx *context.TeaContext) error {
+	if err := ctx.Ensure(context.CtxRequirement{RemoteRepo: true}); err != nil {
+		return err
+	}
+
+	if ctx.Args().Len() < 2 {
+		return fmt.Errorf("pull request index and comment ID are required")
+	}
+
+	idx, err := utils.ArgToIndex(ctx.Args().First())
+	if err != nil {
+		return err
+	}
+
+	commentID, err := utils.ArgToIndex(ctx.Args().Get(1))
+	if err != nil {
+		return err
+	}
+
+	body, err := getCommentBody(ctx, ctx.Args().Slice()[2:], "Reply(markdown):", "reply")
+	if err != nil {
+		return err
+	}
+
+	return task.ReplyToPullReviewComment(requestCtx, ctx, idx, commentID, body)
+}
+
+func getCommentBody(ctx *context.TeaContext, extraArgs []string, promptTitle, noun string) (string, error) {
+	body := strings.Join(extraArgs, " ")
+	if interact.IsStdinPiped() {
+		bodyStdin, err := io.ReadAll(ctx.Reader)
+		if err != nil {
+			return "", err
+		}
+		if len(bodyStdin) != 0 {
+			body = strings.Join([]string{body, string(bodyStdin)}, "\n\n")
+		}
+	} else if len(body) == 0 {
+		if err := huh.NewForm(
+			huh.NewGroup(
+				huh.NewText().
+					Title(promptTitle).
+					ExternalEditor(config.GetPreferences().Editor).
+					EditorExtension("md").
+					Value(&body),
+			),
+		).WithTheme(theme.GetTheme()).Run(); err != nil {
+			return "", err
+		}
+	}
+
+	if len(strings.TrimSpace(body)) == 0 {
+		return "", errors.New("no " + noun + " content provided")
+	}
+
+	return body, nil
+}

docs/CLI.md

@@ -239,7 +239,7 @@ Create an issue on repository
 
 Edit one or more issues
 
-**--add-assignees, -a**="": Comma-separated list of usernames to assign
+**--add-assignees, -a**="": Comma-separated list of usernames to assign. Takes precedence over --remove-assignees
 
 **--add-labels, -L**="": Comma-separated list of labels to assign. Takes precedence over --remove-labels
 
@@ -255,10 +255,14 @@ Edit one or more issues
 
 **--remote, -R**="": Discover Gitea login from remote. Optional
 
+**--remove-assignees**="": Comma-separated list of usernames to remove
+
 **--remove-labels**="": Comma-separated list of labels to remove
 
 **--repo, -r**="": Override local repository path or gitea repository slug to interact with. Optional
 
+**--set-assignees**="": Clear all existing assignees and assign comma-separated list of usernames. Takes precedence over --add-assignees and --remove-assignees
+
 **--title, -t**="": 
 
 ### reopen, open
@@ -423,7 +427,7 @@ Change state of one or more pull requests to 'open'
 
 Edit one or more pull requests
 
-**--add-assignees, -a**="": Comma-separated list of usernames to assign
+**--add-assignees, -a**="": Comma-separated list of usernames to assign. Takes precedence over --remove-assignees
 
 **--add-labels, -L**="": Comma-separated list of labels to assign. Takes precedence over --remove-labels
 
@@ -445,12 +449,16 @@ Edit one or more pull requests
 
 **--remote, -R**="": Discover Gitea login from remote. Optional
 
+**--remove-assignees**="": Comma-separated list of usernames to remove
+
 **--remove-labels**="": Comma-separated list of labels to remove
 
 **--remove-reviewers**="": Comma-separated list of usernames to remove from reviewers
 
 **--repo, -r**="": Override local repository path or gitea repository slug to interact with. Optional
 
+**--set-assignees**="": Clear all existing assignees and assign comma-separated list of usernames. Takes precedence over --add-assignees and --remove-assignees
+
 **--title, -t**="": 
 
 ### review
@@ -507,6 +515,18 @@ Merge a pull request
 
 **--title, -t**="": Merge commit title
 
+### reply
+
+Reply to a pull request review comment
+
+**--login, -l**="": Use a different Gitea Login. Optional
+
+**--output, -o**="": Output format. (simple, table, csv, tsv, yaml, json)
+
+**--remote, -R**="": Discover Gitea login from remote. Optional
+
+**--repo, -r**="": Override local repository path or gitea repository slug to interact with. Optional
+
 ### review-comments, rc
 
 List review comments on a pull request
@@ -1915,6 +1935,8 @@ Update a webhook
 
 Manage comments on issues and pull requests
 
+**--description, -d**="": comment body (alternative to the positional argument)
+
 **--login, -l**="": Use a different Gitea Login. Optional
 
 **--output, -o**="": Output format. (simple, table, csv, tsv, yaml, json)
@@ -1927,6 +1949,8 @@ Manage comments on issues and pull requests
 
 Add a comment to an issue or pull request
 
+**--description, -d**="": comment body (alternative to the positional argument)
+
 **--login, -l**="": Use a different Gitea Login. Optional
 
 **--output, -o**="": Output format. (simple, table, csv, tsv, yaml, json)
@@ -1955,6 +1979,8 @@ List comments on an issue or pull request
 
 Edit the body of an existing comment
 
+**--description, -d**="": new comment body (alternative to the positional argument)
+
 **--login, -l**="": Use a different Gitea Login. Optional
 
 **--output, -o**="": Output format. (simple, table, csv, tsv, yaml, json)

go.mod

@@ -5,24 +5,24 @@ go 1.26
 require (
 	charm.land/glamour/v2 v2.0.1
 	charm.land/huh/v2 v2.0.3
-	charm.land/lipgloss/v2 v2.0.4
+	charm.land/lipgloss/v2 v2.0.5
 	code.gitea.io/gitea-vet v0.2.3
 	gitea.com/noerw/unidiff-comments v0.0.0-20220822113322-50f4daa0e35c
-	gitea.dev/sdk v1.1.0
+	gitea.dev/sdk v1.2.0
 	github.com/adrg/xdg v0.5.3
 	github.com/araddon/dateparse v0.0.0-20210429162001-6b43995a97de
 	github.com/enescakir/emoji v1.0.0
-	github.com/go-authgate/sdk-go v0.14.0
 	github.com/muesli/termenv v0.16.0
 	github.com/olekukonko/tablewriter v1.1.4
 	github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966
 	github.com/stretchr/testify v1.11.1
 	github.com/urfave/cli-docs/v3 v3.1.0
-	github.com/urfave/cli/v3 v3.10.0
-	golang.org/x/crypto v0.53.0
+	github.com/urfave/cli/v3 v3.10.1
+	github.com/zalando/go-keyring v0.2.8
+	golang.org/x/crypto v0.54.0
 	golang.org/x/oauth2 v0.36.0
-	golang.org/x/sys v0.46.0
-	golang.org/x/term v0.44.0
+	golang.org/x/sys v0.47.0
+	golang.org/x/term v0.45.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
@@ -56,10 +56,8 @@ require (
 	github.com/fatih/color v1.19.0 // indirect
 	github.com/goccy/go-json v0.10.6 // indirect
 	github.com/godbus/dbus/v5 v5.2.2 // indirect
-	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/gorilla/css v1.0.1 // indirect
 	github.com/hashicorp/go-version v1.9.0 // indirect
-	github.com/kr/pretty v0.3.1 // indirect
 	github.com/lucasb-eyer/go-colorful v1.4.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.22 // indirect
@@ -72,18 +70,15 @@ require (
 	github.com/olekukonko/ll v0.1.8 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
-	github.com/rogpeppe/go-internal v1.14.1 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	github.com/yuin/goldmark v1.8.2 // indirect
 	github.com/yuin/goldmark-emoji v1.0.6 // indirect
-	github.com/zalando/go-keyring v0.2.8 // indirect
 	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect
-	golang.org/x/net v0.55.0 // indirect
-	golang.org/x/sync v0.21.0 // indirect
-	golang.org/x/text v0.38.0 // indirect
-	golang.org/x/tools v0.45.0 // indirect
-	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
+	golang.org/x/net v0.56.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/text v0.40.0 // indirect
+	golang.org/x/tools v0.47.0 // indirect
 )
 
 retract v1.3.3 // accidental release, tag deleted

go.sum

@@ -6,14 +6,14 @@ charm.land/glamour/v2 v2.0.1 h1:xl+r00A4aJWU0z8fgwKd9fQQ4rsphqGUzuEiXZP5n+c=
 charm.land/glamour/v2 v2.0.1/go.mod h1:jo9z8XqVKPeEFMVdvCRLGk++RyJ3CdUwgNr7EvXLw3k=
 charm.land/huh/v2 v2.0.3 h1:2cJsMqEPwSywGHvdlKsJyQKPtSJLVnFKyFbsYZTlLkU=
 charm.land/huh/v2 v2.0.3/go.mod h1:93eEveeeqn47MwiC3tf+2atZ2l7Is88rAtmZNZ8x9Wc=
-charm.land/lipgloss/v2 v2.0.4 h1:lcPeVtcp23SNra7lHy8iYE4UC2aIipVQ47sbGyyxR5Q=
-charm.land/lipgloss/v2 v2.0.4/go.mod h1:0653x8epbZSzdDfO/XPS1a/uYPOBeSsCssOpJOqDzik=
+charm.land/lipgloss/v2 v2.0.5 h1:kbNxgeeUOYv5J0YdpxFjfvf3dFvqH8Aci4zB6xqFtrY=
+charm.land/lipgloss/v2 v2.0.5/go.mod h1:9oqhxt4yxIMe6q5A4kHr44DremZk7J9UNh74GlWa5nc=
 code.gitea.io/gitea-vet v0.2.3 h1:gdFmm6WOTM65rE8FUBTRzeQZYzXePKSSB1+r574hWwI=
 code.gitea.io/gitea-vet v0.2.3/go.mod h1:zcNbT/aJEmivCAhfmkHOlT645KNOf9W2KnkLgFjGGfE=
 gitea.com/noerw/unidiff-comments v0.0.0-20220822113322-50f4daa0e35c h1:8fTkq2UaVkLHZCF+iB4wTxINmVAToe2geZGayk9LMbA=
 gitea.com/noerw/unidiff-comments v0.0.0-20220822113322-50f4daa0e35c/go.mod h1:Fc8iyPm4NINRWujeIk2bTfcbGc4ZYY29/oMAAGcr4qI=
-gitea.dev/sdk v1.1.0 h1:wLlz03WkLEiXa2bQpO1JQBTlYf7tQI2neYtZK1kU+TE=
-gitea.dev/sdk v1.1.0/go.mod h1:Zfl+EZXdsGGCLkryDfsmvYrQo6GKMl4U3BJA8Beu+cs=
+gitea.dev/sdk v1.2.0 h1:avRtJl/nKCGispgSalo9czoZM9Rto1awnE0caNAoXGo=
+gitea.dev/sdk v1.2.0/go.mod h1:rfh5oNdIK24cbCREwIn1tqWKQW+IICXFGWJyebuOAOE=
 github.com/42wim/httpsig v1.2.4 h1:mI5bH0nm4xn7K18fo1K3okNDRq8CCJ0KbBYWyA6r8lU=
 github.com/42wim/httpsig v1.2.4/go.mod h1:yKsYfSyTBEohkPik224QPFylmzEBtda/kjyIAJjh3ps=
 github.com/MakeNowJust/heredoc v1.0.0 h1:cXCdzVdstXyiTqTvfqk9SDHpKNjxuom+DOlyEeQ4pzQ=
@@ -72,7 +72,6 @@ github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJ
 github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
 github.com/cpuguy83/go-md2man/v2 v2.0.7 h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=
 github.com/cpuguy83/go-md2man/v2 v2.0.7/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
-github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
 github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
 github.com/danieljoos/wincred v1.2.3 h1:v7dZC2x32Ut3nEfRH+vhoZGvN72+dQ/snVXo/vMFLdQ=
@@ -90,27 +89,18 @@ github.com/enescakir/emoji v1.0.0 h1:W+HsNql8swfCQFtioDGDHCHri8nudlK1n5p2rHCJoog
 github.com/enescakir/emoji v1.0.0/go.mod h1:Bt1EKuLnKDTYpLALApstIkAjdDrS/8IAgTkKp+WKFD0=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
-github.com/go-authgate/sdk-go v0.14.0 h1:s1i/UCX2Edf3A1pKDW6oXv+oACQfTroxiGY52eqKx+4=
-github.com/go-authgate/sdk-go v0.14.0/go.mod h1:sa0ige5wtayj2WcnXlxa8wGuyi5z/c/chc0mXPJTl/Q=
 github.com/goccy/go-json v0.10.6 h1:p8HrPJzOakx/mn/bQtjgNjdTcN+/S6FcG2CTtQOrHVU=
 github.com/goccy/go-json v0.10.6/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
 github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ=
 github.com/godbus/dbus/v5 v5.2.2/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c=
-github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
-github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/gorilla/css v1.0.1 h1:ntNaBIghp6JmvWnxbZKANoLyuXTPZ4cAMlo6RyhlbO8=
 github.com/gorilla/css v1.0.1/go.mod h1:BvnYkspnSzMmwRK+b8/xgNPLiIuNZr6vbZBTPQ2A3b0=
 github.com/hashicorp/go-version v1.9.0 h1:CeOIz6k+LoN3qX9Z0tyQrPtiB1DFYRPfCIBtaXPSCnA=
 github.com/hashicorp/go-version v1.9.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
 github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
-github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
-github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
-github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
-github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
-github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
-github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/lucasb-eyer/go-colorful v1.4.0 h1:UtrWVfLdarDgc44HcS7pYloGHJUjHV/4FwW4TvVgFr4=
 github.com/lucasb-eyer/go-colorful v1.4.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
@@ -136,15 +126,11 @@ github.com/olekukonko/ll v0.1.8 h1:ysHCJRGHYKzmBSdz9w5AySztx7lG8SQY+naTGYUbsz8=
 github.com/olekukonko/ll v0.1.8/go.mod h1:RPRC6UcscfFZgjo1nulkfMH5IM0QAYim0LfnMvUuozw=
 github.com/olekukonko/tablewriter v1.1.4 h1:ORUMI3dXbMnRlRggJX3+q7OzQFDdvgbN9nVWj1drm6I=
 github.com/olekukonko/tablewriter v1.1.4/go.mod h1:+kedxuyTtgoZLwif3P1Em4hARJs+mVnzKxmsCL/C5RY=
-github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
-github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
-github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
-github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/scylladb/termtables v0.0.0-20191203121021-c4c0b6d42ff4/go.mod h1:C1a7PQSMz9NShzorzCiG2fk9+xuCgLkPeCvMHYR2OWg=
@@ -160,8 +146,8 @@ github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/urfave/cli-docs/v3 v3.1.0 h1:Sa5xm19IpE5gpm6tZzXdfjdFxn67PnEsE4dpXF7vsKw=
 github.com/urfave/cli-docs/v3 v3.1.0/go.mod h1:59d+5Hz1h6GSGJ10cvcEkbIe3j233t4XDqI72UIx7to=
-github.com/urfave/cli/v3 v3.10.0 h1:0aU8yOObVDMkM13Cj4G+zb4P0PdeJMec65f81Ak1ioM=
-github.com/urfave/cli/v3 v3.10.0/go.mod h1:ysVLtOEmg2tOy6PknnYVhDoouyC/6N42TMeoMzskhso=
+github.com/urfave/cli/v3 v3.10.1 h1:7Kx9H50hrHbRbyxgO1KP6/BcbiGRz0uYh5YyQ30JEEY=
+github.com/urfave/cli/v3 v3.10.1/go.mod h1:ysVLtOEmg2tOy6PknnYVhDoouyC/6N42TMeoMzskhso=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
 github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
@@ -174,48 +160,47 @@ github.com/zalando/go-keyring v0.2.8/go.mod h1:tsMo+VpRq5NGyKfxoBVjCuMrG47yj8cma
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20210513164829-c07d793c2f9a/go.mod h1:P+XmwS30IXTQdn5tA2iutPOUgjI07+tq3H3K9MVA1s8=
-golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
-golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
+golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
+golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4=
-golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ=
+golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
+golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
-golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
+golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
+golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
-golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
-golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc=
-golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y=
+golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
-golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
+golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
+golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200325010219-a49f79bcc224/go.mod h1:Sl4aGygMT6LrqrWclx+PTx3U+LnKx/seiNR+3G19Ar8=
-golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8=
-golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0=
+golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
+golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

modules/api/client.go

@@ -31,9 +31,7 @@ func NewClient(login *config.Login) *Client {
 	}
 
 	httpClient := &http.Client{
-		Transport: httputil.WrapTransport(&http.Transport{
-			TLSClientConfig: &tls.Config{InsecureSkipVerify: login.Insecure},
-		}),
+		Transport: httputil.WrapTransport(&tls.Config{InsecureSkipVerify: login.Insecure}),
 	}
 
 	return &Client{

modules/auth/oauth.go

@@ -201,9 +201,7 @@ func performBrowserOAuthFlow(ctx context.Context, opts OAuthOptions) (serverURL
 // createHTTPClient creates an HTTP client with optional insecure setting
 func createHTTPClient(insecure bool) *http.Client {
 	return &http.Client{
-		Transport: httputil.WrapTransport(&http.Transport{
-			TLSClientConfig: &tls.Config{InsecureSkipVerify: insecure},
-		}),
+		Transport: httputil.WrapTransport(&tls.Config{InsecureSkipVerify: insecure}),
 	}
 }
 
@@ -412,16 +410,11 @@ func createLoginFromToken(ctx context.Context, name, serverURL string, token *oa
 	}
 	login.SSHHost = parsedURL.Host
 
-	// Add login to config
-	if err := config.AddLogin(&login); err != nil {
+	// Save tokens and add login to config
+	if err := config.AddOAuthLogin(&login, token.AccessToken, token.RefreshToken, token.Expiry); err != nil {
 		return err
 	}
 
-	// Save tokens to credstore
-	if err := config.SaveOAuthToken(login.Name, token.AccessToken, token.RefreshToken, token.Expiry); err != nil {
-		return fmt.Errorf("failed to save token to secure store: %s", err)
-	}
-
 	fmt.Printf("Login as %s on %s successful. Added this login as %s\n", login.User, login.URL, login.Name)
 	return nil
 }

modules/config/credstore.go

@@ -8,14 +8,27 @@ import (
 	"sync"
 	"time"
 
+	"gitea.dev/tea/modules/credstore"
+
 	"github.com/adrg/xdg"
-	"github.com/go-authgate/sdk-go/credstore"
 	"golang.org/x/oauth2"
 )
 
 var (
 	tokenStore     *credstore.SecureStore[credstore.Token]
 	tokenStoreOnce sync.Once
+
+	saveOAuthTokenToStore = func(loginName, accessToken, refreshToken string, expiresAt time.Time) error {
+		return getTokenStore().Save(loginName, credstore.Token{
+			AccessToken:  accessToken,
+			RefreshToken: refreshToken,
+			ExpiresAt:    expiresAt,
+			ClientID:     loginName,
+		})
+	}
+	deleteOAuthTokenFromStore = func(loginName string) error {
+		return getTokenStore().Delete(loginName)
+	}
 )
 
 func getTokenStore() *credstore.SecureStore[credstore.Token] {
@@ -37,17 +50,12 @@ func LoadOAuthToken(loginName string) (*credstore.Token, error) {
 
 // SaveOAuthToken saves OAuth tokens to the secure store.
 func SaveOAuthToken(loginName, accessToken, refreshToken string, expiresAt time.Time) error {
-	return getTokenStore().Save(loginName, credstore.Token{
-		AccessToken:  accessToken,
-		RefreshToken: refreshToken,
-		ExpiresAt:    expiresAt,
-		ClientID:     loginName,
-	})
+	return saveOAuthTokenToStore(loginName, accessToken, refreshToken, expiresAt)
 }
 
 // DeleteOAuthToken removes tokens from the secure store.
 func DeleteOAuthToken(loginName string) error {
-	return getTokenStore().Delete(loginName)
+	return deleteOAuthTokenFromStore(loginName)
 }
 
 // SaveOAuthTokenFromOAuth2 saves an oauth2.Token to credstore, falling back to

modules/config/login.go

@@ -240,11 +240,14 @@ func DeleteLogin(name string) error {
 		}
 
 		isOAuth := config.Logins[idx].IsOAuth()
+		// Use the stored login name, not the CLI-provided one: the lookup above
+		// is case-insensitive, but credstore keys are exact-match.
+		storedName := config.Logins[idx].Name
 		config.Logins = append(config.Logins[:idx], config.Logins[idx+1:]...)
 
 		// Clean up credstore tokens for OAuth logins
 		if isOAuth {
-			_ = DeleteOAuthToken(name)
+			_ = DeleteOAuthToken(storedName)
 		}
 
 		return saveConfigUnsafe()
@@ -269,6 +272,34 @@ func AddLogin(login *Login) error {
 	})
 }
 
+// AddOAuthLogin saves the OAuth token and login profile as one operation.
+// The profile is only written after secure token storage succeeds.
+func AddOAuthLogin(login *Login, accessToken, refreshToken string, expiresAt time.Time) error {
+	return withConfigLock(func() error {
+		// Check for duplicate login names before touching credential storage.
+		for _, existing := range config.Logins {
+			if strings.EqualFold(existing.Name, login.Name) {
+				return fmt.Errorf("login name '%s' already exists", login.Name)
+			}
+		}
+
+		if err := SaveOAuthToken(login.Name, accessToken, refreshToken, expiresAt); err != nil {
+			return fmt.Errorf("failed to save token to secure store: %w", err)
+		}
+
+		config.Logins = append(config.Logins, *login)
+		if err := saveConfigUnsafe(); err != nil {
+			config.Logins = config.Logins[:len(config.Logins)-1]
+			if deleteErr := DeleteOAuthToken(login.Name); deleteErr != nil {
+				return errors.Join(err, fmt.Errorf("failed to clean up OAuth token after config save failure: %w", deleteErr))
+			}
+			return err
+		}
+
+		return nil
+	})
+}
+
 // SaveLoginTokens updates the token fields for an existing login.
 // This is used after browser-based re-authentication to save new tokens.
 func SaveLoginTokens(login *Login) error {
@@ -390,9 +421,7 @@ func doOAuthRefresh(ctx context.Context, l *Login) (*oauth2.Token, error) {
 	}
 
 	httpClient := &http.Client{
-		Transport: httputil.WrapTransport(&http.Transport{
-			TLSClientConfig: &tls.Config{InsecureSkipVerify: l.Insecure},
-		}),
+		Transport: httputil.WrapTransport(&tls.Config{InsecureSkipVerify: l.Insecure}),
 	}
 	ctx = context.WithValue(ctx, oauth2.HTTPClient, httpClient)
 
@@ -420,15 +449,19 @@ func (l *Login) Client(options ...gitea.ClientOption) *gitea.Client {
 		os.Exit(1)
 	}
 
-	httpClient := &http.Client{}
+	// Configure transport-level timeouts so a stalled or unresponsive server
+	// fails fast instead of hanging forever. These bound connection setup and
+	// time-to-first-response-byte only, so slow-but-progressing transfers (e.g.
+	// large attachment uploads) are unaffected.
+	httpClient := &http.Client{
+		Transport: httputil.WrapTransport(nil),
+	}
 	if l.Insecure {
 		cookieJar, _ := cookiejar.New(nil) // New with nil options never returns an error
 
 		httpClient = &http.Client{
 			Jar:       cookieJar,
-			Transport: &http.Transport{
-				TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
-			},
+			Transport: httputil.WrapTransport(&tls.Config{InsecureSkipVerify: true}),
 		}
 	}
 
@@ -437,6 +470,10 @@ func (l *Login) Client(options ...gitea.ClientOption) *gitea.Client {
 		options = append([]gitea.ClientOption{gitea.SetGiteaVersion("")}, options...)
 	}
 
+	// SetUserAgent is intentionally redundant with the User-Agent the WrapTransport
+	// transport already sets: this is the SDK's own guarantee, so the UA survives
+	// even if the client is ever given a transport that didn't come from WrapTransport.
+	// Both resolve to httputil.UserAgent(), so the duplicate Header.Set is a no-op.
 	options = append(options, gitea.SetToken(l.GetAccessToken()), gitea.SetHTTPClient(httpClient), gitea.SetUserAgent(httputil.UserAgent()))
 	if debug.IsDebug() {
 		options = append(options, gitea.SetDebugMode())

modules/config/login_test.go

@@ -0,0 +1,110 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package config
+
+import (
+	"context"
+	"crypto/ed25519"
+	"crypto/rand"
+	"crypto/x509"
+	"encoding/pem"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	gitea "gitea.dev/sdk"
+	"golang.org/x/crypto/ssh"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestLoginClientWithSSHPubkeyDoesNotDeadlockOnFirstRequest(t *testing.T) {
+	t.Parallel()
+
+	sshKeyPath, fingerprint := writeTestSSHKey(t)
+
+	var versionRequests atomic.Int32
+	var issueRequests atomic.Int32
+	var signedVersionRequests atomic.Int32
+	var signedIssueRequests atomic.Int32
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/api/v1/version":
+			versionRequests.Add(1)
+			if r.Header.Get("Signature") != "" {
+				signedVersionRequests.Add(1)
+			}
+			w.Header().Set("Content-Type", "application/json")
+			_, _ = w.Write([]byte(`{"version":"1.26.4"}`))
+		case "/api/v1/repos/gitea/tea/issues":
+			issueRequests.Add(1)
+			if r.Header.Get("Signature") != "" {
+				signedIssueRequests.Add(1)
+			}
+			w.Header().Set("Content-Type", "application/json")
+			_, _ = w.Write([]byte(`[]`))
+		default:
+			t.Errorf("unexpected path %s", r.URL.Path)
+			w.WriteHeader(http.StatusNotFound)
+		}
+	}))
+	defer server.Close()
+
+	login := &Login{
+		Name:              "ssh-login",
+		URL:               server.URL,
+		SSHKey:            sshKeyPath,
+		SSHKeyFingerprint: fingerprint,
+		VersionCheck:      true,
+	}
+
+	type result struct {
+		issues []*gitea.Issue
+		err    error
+	}
+
+	done := make(chan result, 1)
+	go func() {
+		issues, _, err := login.Client().Issues.ListRepoIssues(context.Background(), "gitea", "tea", gitea.ListIssueOption{})
+		done <- result{issues: issues, err: err}
+	}()
+
+	select {
+	case res := <-done:
+		require.NoError(t, res.err)
+		assert.Empty(t, res.issues)
+	case <-time.After(2 * time.Second):
+		t.Fatal("ListRepoIssues deadlocked while bootstrapping the server version for SSH-signed requests")
+	}
+
+	assert.EqualValues(t, 1, versionRequests.Load())
+	assert.EqualValues(t, 0, signedVersionRequests.Load())
+	assert.EqualValues(t, 1, issueRequests.Load())
+	assert.EqualValues(t, 1, signedIssueRequests.Load())
+}
+
+func writeTestSSHKey(t *testing.T) (string, string) {
+	t.Helper()
+
+	_, privateKey, err := ed25519.GenerateKey(rand.Reader)
+	require.NoError(t, err)
+
+	pkcs8, err := x509.MarshalPKCS8PrivateKey(privateKey)
+	require.NoError(t, err)
+
+	pemBytes := pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: pkcs8})
+	sshKeyPath := filepath.Join(t.TempDir(), "id_ed25519")
+	require.NoError(t, os.WriteFile(sshKeyPath, pemBytes, 0o600))
+
+	signer, err := ssh.NewSignerFromKey(privateKey)
+	require.NoError(t, err)
+
+	return sshKeyPath, ssh.FingerprintSHA256(signer.PublicKey())
+}

modules/context/context.go

@@ -37,6 +37,12 @@ type TeaContext struct {
 	LocalRepo *git.TeaRepo  // is set if flags specified a local repo via --repo, or if $PWD is a git repo
 }
 
+// InitOptions controls which optional sources InitCommand may inspect.
+type InitOptions struct {
+	// SkipLocalRepo avoids probing the current directory for a git repository.
+	SkipLocalRepo bool
+}
+
 // GetRemoteRepoHTMLURL returns the web-ui url of the remote repo,
 // after ensuring a remote repo is present in the context.
 func (ctx *TeaContext) GetRemoteRepoHTMLURL() (string, error) {
@@ -61,6 +67,12 @@ func shouldPromptFallbackLogin(login *config.Login, canPrompt bool) bool {
 // the remotes of the .git repo specified in repoFlag or $PWD, and using overrides from
 // command flags. If a local git repo can't be found, repo slug values are unset.
 func InitCommand(cmd *cli.Command) (*TeaContext, error) {
+	return InitCommandWithOptions(cmd, InitOptions{})
+}
+
+// InitCommandWithOptions resolves the application context like InitCommand, with
+// optional controls for commands that do not need repository context.
+func InitCommandWithOptions(cmd *cli.Command, opts InitOptions) (*TeaContext, error) {
 	// these flags are used as overrides to the context detection via local git repo
 	repoFlag := cmd.String("repo")
 	loginFlag := cmd.String("login")
@@ -76,7 +88,7 @@ func InitCommand(cmd *cli.Command) (*TeaContext, error) {
 	)
 
 	// check if repoFlag can be interpreted as path to local repo.
-	if len(repoFlag) != 0 {
+	if len(repoFlag) != 0 && !opts.SkipLocalRepo {
 		if repoFlagPathExists, err = utils.DirExists(repoFlag); err != nil {
 			return nil, err
 		}
@@ -85,6 +97,8 @@ func InitCommand(cmd *cli.Command) (*TeaContext, error) {
 		} else {
 			c.RepoSlug = repoFlag
 		}
+	} else if len(repoFlag) != 0 {
+		c.RepoSlug = repoFlag
 	}
 
 	if len(remoteFlag) == 0 {
@@ -101,6 +115,7 @@ func InitCommand(cmd *cli.Command) (*TeaContext, error) {
 		extraLogins = append(extraLogins, *envLogin)
 	}
 
+	if !opts.SkipLocalRepo {
 		// try to read local git repo & extract context: if repoFlag specifies a valid path, read repo in that dir,
 		// otherwise attempt PWD. if no repo is found, continue with default login
 		if repoPath == "" {
@@ -120,6 +135,7 @@ func InitCommand(cmd *cli.Command) (*TeaContext, error) {
 		if c.RepoSlug == "" && localSlug != "" {
 			c.RepoSlug = localSlug
 		}
+	}
 
 	// If env vars are set, always use the env login (but repo slug was already
 	// resolved by contextFromLocalRepo with the env login in the match list)
@@ -150,7 +166,7 @@ and then run your command again`)
 		if shouldPromptFallbackLogin(c.Login, canPrompt) {
 			fallback := false
 			if err := huh.NewConfirm().
-				Title(fmt.Sprintf("NOTE: no gitea login detected, whether falling back to login '%s'?", c.Login.Name)).
+				Title(fmt.Sprintf("NOTE: no login matched this repository. Fall back to login '%s'?", c.Login.Name)).
 				Value(&fallback).
 				WithTheme(theme.GetTheme()).
 				Run(); err != nil {
@@ -160,7 +176,7 @@ and then run your command again`)
 				return nil, ErrCommandCanceled
 			}
 		} else if !c.Login.Default {
-			fmt.Fprintf(os.Stderr, "NOTE: no gitea login detected, falling back to login '%s' in non-interactive mode.\n", c.Login.Name)
+			fmt.Fprintf(os.Stderr, "NOTE: no login matched this repository, falling back to login '%s' in non-interactive mode.\n", c.Login.Name)
 		}
 	}
 

modules/credstore/codec.go

@@ -0,0 +1,49 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package credstore
+
+import (
+	"encoding/json"
+	"fmt"
+)
+
+// Codec handles encoding/decoding values to/from strings for storage.
+type Codec[T any] interface {
+	Encode(v T) (string, error)
+	Decode(s string) (T, error)
+}
+
+// JSONCodec encodes T as JSON.
+type JSONCodec[T any] struct{}
+
+// Encode marshals v to a JSON string.
+func (JSONCodec[T]) Encode(v T) (string, error) {
+	data, err := json.Marshal(v)
+	if err != nil {
+		return "", fmt.Errorf("failed to marshal data: %w", err)
+	}
+	return string(data), nil
+}
+
+// Decode unmarshals a JSON string into T.
+func (JSONCodec[T]) Decode(s string) (T, error) {
+	var v T
+	if err := json.Unmarshal([]byte(s), &v); err != nil {
+		return v, fmt.Errorf("failed to unmarshal data: %w", err)
+	}
+	return v, nil
+}
+
+// StringCodec is the identity codec for plain strings.
+type StringCodec struct{}
+
+// Encode returns the string as-is.
+func (StringCodec) Encode(v string) (string, error) {
+	return v, nil
+}
+
+// Decode returns the string as-is.
+func (StringCodec) Decode(s string) (string, error) {
+	return s, nil
+}

modules/credstore/doc.go

@@ -0,0 +1,8 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+// Package credstore provides secure storage for OAuth tokens. Values are
+// AES-256-GCM-encrypted into a JSON file while only the 32-byte master key
+// lives in the OS keyring; when the keyring is unavailable the store falls
+// back to plaintext file storage.
+package credstore

modules/credstore/encrypted_store.go

@@ -0,0 +1,259 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package credstore
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"strings"
+	"sync"
+)
+
+// masterKeySize is the AES-256 key length in bytes.
+const masterKeySize = 32
+
+// masterKeyUser is the keyring account name under which the master key is
+// stored. It must never change: installations hold their master key under
+// this exact name.
+const masterKeyUser = "__tea_master_key__"
+
+// sealedPrefix versions the on-disk encrypted value format so a future
+// algorithm change can be detected instead of guessed at.
+const sealedPrefix = "v1:"
+
+// masterKey manages a per-service AES-256 key held in the OS keyring and
+// caches the derived AEAD in memory. See EncryptedFileStore for why only the
+// key lives in the keyring.
+type masterKey struct {
+	store *KeyringStore[string]
+
+	mu   sync.Mutex
+	aead cipher.AEAD // cached after the first successful load or create
+}
+
+// loadLocked returns the cached or keyring-held AEAD. It returns ErrNotFound
+// unwrapped when no key exists yet so callers can distinguish "no key" from
+// "keyring unavailable". m.mu must be held.
+func (m *masterKey) loadLocked() (cipher.AEAD, error) {
+	if m.aead != nil {
+		return m.aead, nil
+	}
+
+	encoded, err := m.store.Load(masterKeyUser)
+	if err != nil {
+		if errors.Is(err, ErrNotFound) {
+			return nil, err
+		}
+		// e.g. Linux headless without Secret Service, or keyring locked.
+		return nil, fmt.Errorf("failed to read master key: %w", err)
+	}
+
+	key, decodeErr := base64.StdEncoding.DecodeString(encoded)
+	if decodeErr != nil || len(key) != masterKeySize {
+		return nil, errors.New("corrupted master key in keyring")
+	}
+	return m.cacheLocked(key)
+}
+
+// cacheLocked builds the AEAD for key and caches it. m.mu must be held.
+func (m *masterKey) cacheLocked(key []byte) (cipher.AEAD, error) {
+	aead, err := newGCM(key)
+	if err != nil {
+		return nil, err
+	}
+	m.aead = aead
+	return aead, nil
+}
+
+// load returns the AEAD without ever creating a key, so decryption paths
+// cannot mint a key that has no chance of opening existing ciphertext.
+func (m *masterKey) load() (cipher.AEAD, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	return m.loadLocked()
+}
+
+// get returns the AEAD, generating and persisting a new key on first use.
+func (m *masterKey) get() (cipher.AEAD, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	aead, err := m.loadLocked()
+	if err == nil {
+		return aead, nil
+	}
+	if !errors.Is(err, ErrNotFound) {
+		return nil, err
+	}
+
+	// First use: generate and persist a new key.
+	key := make([]byte, masterKeySize)
+	if _, err := rand.Read(key); err != nil {
+		return nil, fmt.Errorf("failed to generate master key: %w", err)
+	}
+	if err := m.store.Save(masterKeyUser, base64.StdEncoding.EncodeToString(key)); err != nil {
+		return nil, fmt.Errorf("failed to store master key: %w", err)
+	}
+	return m.cacheLocked(key)
+}
+
+// available reports whether the keyring can serve the master key without
+// creating one: a cached or stored valid key counts, and so does a clean
+// not-found (the key is generated lazily on first Save). A corrupted key or
+// an unreachable keyring does not.
+func (m *masterKey) available() bool {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	_, err := m.loadLocked()
+	return err == nil || errors.Is(err, ErrNotFound)
+}
+
+// newGCM creates an AES-256-GCM AEAD for the given key.
+func newGCM(key []byte) (cipher.AEAD, error) {
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create cipher: %w", err)
+	}
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create GCM: %w", err)
+	}
+	return gcm, nil
+}
+
+// sealValue encrypts plaintext with AES-256-GCM and returns
+// "v1:" + base64(nonce || ciphertext).
+func sealValue(aead cipher.AEAD, plaintext string) (string, error) {
+	nonce := make([]byte, aead.NonceSize())
+	if _, err := rand.Read(nonce); err != nil {
+		return "", fmt.Errorf("failed to generate nonce: %w", err)
+	}
+	// Seal appends ciphertext+tag to nonce, so the stored value is self-contained.
+	sealed := aead.Seal(nonce, nonce, []byte(plaintext), nil)
+	return sealedPrefix + base64.StdEncoding.EncodeToString(sealed), nil
+}
+
+// openValue decrypts a value produced by sealValue.
+func openValue(aead cipher.AEAD, encoded string) (string, error) {
+	rest, ok := strings.CutPrefix(encoded, sealedPrefix)
+	if !ok {
+		return "", errors.New("unrecognized encrypted value format")
+	}
+	data, err := base64.StdEncoding.DecodeString(rest)
+	if err != nil {
+		return "", fmt.Errorf("failed to decode encrypted value: %w", err)
+	}
+	if len(data) < aead.NonceSize() {
+		return "", errors.New("encrypted value too short")
+	}
+	nonce, ciphertext := data[:aead.NonceSize()], data[aead.NonceSize():]
+	plaintext, err := aead.Open(nil, nonce, ciphertext, nil)
+	if err != nil {
+		// Wrong key or tampered value — GCM authentication failed.
+		return "", fmt.Errorf("failed to decrypt value (key mismatch or tampering): %w", err)
+	}
+	return string(plaintext), nil
+}
+
+// encryptedCodec wraps an inner codec with AES-256-GCM encryption using a
+// keyring-held master key.
+type encryptedCodec[T any] struct {
+	inner Codec[T]
+	key   *masterKey
+}
+
+// Encode encodes v with the inner codec and encrypts the result.
+func (c encryptedCodec[T]) Encode(v T) (string, error) {
+	aead, err := c.key.get()
+	if err != nil {
+		return "", err
+	}
+	plaintext, err := c.inner.Encode(v)
+	if err != nil {
+		return "", err
+	}
+	return sealValue(aead, plaintext)
+}
+
+// Decode decrypts s and decodes the plaintext with the inner codec.
+func (c encryptedCodec[T]) Decode(s string) (T, error) {
+	var zero T
+	aead, err := c.key.load()
+	if err != nil {
+		if errors.Is(err, ErrNotFound) {
+			// Deliberately not wrapping ErrNotFound: the value exists but
+			// cannot be decrypted, which must not read as "no data stored".
+			return zero, errors.New("cannot decrypt stored value: master key not found in keyring")
+		}
+		return zero, err
+	}
+	plaintext, err := openValue(aead, s)
+	if err != nil {
+		return zero, err
+	}
+	return c.inner.Decode(plaintext)
+}
+
+// EncryptedFileStore stores values encrypted with AES-256-GCM in a JSON file,
+// keeping only the 32-byte master key in the OS keyring. The keyring payload
+// is a constant 44 bytes (base64) regardless of value size, so it never hits
+// the Windows Credential Manager 2560-byte blob limit or the macOS/Linux
+// keyring item size limits. The values themselves (which can be several KB
+// for tokens with groups claims) are encrypted into a file with 0600
+// permissions, file locking, and atomic writes.
+//
+// EncryptedFileStore implements Store[T] and Prober.
+type EncryptedFileStore[T any] struct {
+	file *FileStore[T]
+	key  *masterKey
+}
+
+// NewEncryptedFileStore creates an EncryptedFileStore. serviceName is the
+// keyring service under which the master key is stored; filePath is the
+// encrypted data file. Panics if codec is nil.
+func NewEncryptedFileStore[T any](
+	serviceName, filePath string,
+	codec Codec[T],
+) *EncryptedFileStore[T] {
+	if codec == nil {
+		panic("credstore: NewEncryptedFileStore called with nil codec")
+	}
+	key := &masterKey{store: NewStringKeyringStore(serviceName)}
+	return &EncryptedFileStore[T]{
+		file: NewFileStore[T](filePath, encryptedCodec[T]{inner: codec, key: key}),
+		key:  key,
+	}
+}
+
+// Probe reports whether the OS keyring can serve the master key. It is
+// read-only: the key itself is generated lazily on the first Save. Once the
+// key is cached in memory, Probe keeps reporting true even if the keyring
+// later becomes unavailable, because the store remains operational with the
+// cached key.
+func (e *EncryptedFileStore[T]) Probe() bool {
+	return e.key.available()
+}
+
+// Load loads and decrypts data for the given client ID.
+func (e *EncryptedFileStore[T]) Load(clientID string) (T, error) {
+	return e.file.Load(clientID)
+}
+
+// Save encrypts and saves data for the given client ID.
+func (e *EncryptedFileStore[T]) Save(clientID string, data T) error {
+	return e.file.Save(clientID, data)
+}
+
+// Delete removes data for the given client ID from the file.
+func (e *EncryptedFileStore[T]) Delete(clientID string) error {
+	return e.file.Delete(clientID)
+}
+
+// String returns a description of this store.
+func (e *EncryptedFileStore[T]) String() string {
+	return "encrypted-file: " + e.file.filePath
+}

modules/credstore/encrypted_store_test.go

@@ -0,0 +1,140 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package credstore
+
+import (
+	"encoding/base64"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/zalando/go-keyring"
+)
+
+// newLargeTestToken builds a token whose access token is several KB,
+// mimicking real JWTs with large groups claims that exceed the Windows
+// Credential Manager 2560-byte blob limit.
+func newLargeTestToken(clientID string) Token {
+	return Token{
+		AccessToken:  "header." + strings.Repeat("groups-claim-payload-", 300) + ".sig",
+		RefreshToken: "test-refresh-token",
+		TokenType:    "Bearer",
+		ExpiresAt:    time.Now().Add(1 * time.Hour).Truncate(time.Second),
+		ClientID:     clientID,
+	}
+}
+
+func newTestEncryptedStore(t *testing.T) (*EncryptedFileStore[Token], string) {
+	t.Helper()
+	keyring.MockInit()
+	path := filepath.Join(t.TempDir(), "tokens.enc")
+	return NewEncryptedFileStore[Token]("test-service", path, JSONCodec[Token]{}), path
+}
+
+func TestEncryptedFileStoreSaveAndLoad(t *testing.T) {
+	store, _ := newTestEncryptedStore(t)
+
+	tok := newLargeTestToken("test-client")
+	require.NoError(t, store.Save(tok.ClientID, tok))
+
+	loaded, err := store.Load("test-client")
+	require.NoError(t, err)
+	assert.Equal(t, tok.AccessToken, loaded.AccessToken)
+	assert.Equal(t, tok.RefreshToken, loaded.RefreshToken)
+	assert.True(t, tok.ExpiresAt.Equal(loaded.ExpiresAt))
+}
+
+func TestEncryptedFileStoreFileContainsNoPlaintext(t *testing.T) {
+	store, path := newTestEncryptedStore(t)
+
+	tok := newLargeTestToken("test-client")
+	require.NoError(t, store.Save(tok.ClientID, tok))
+
+	raw, err := os.ReadFile(path)
+	require.NoError(t, err)
+	assert.NotContains(t, string(raw), "groups-claim-payload")
+	assert.NotContains(t, string(raw), tok.RefreshToken)
+}
+
+func TestEncryptedFileStoreKeyringHoldsOnlySmallMasterKey(t *testing.T) {
+	store, _ := newTestEncryptedStore(t)
+
+	tok := newLargeTestToken("test-client")
+	require.NoError(t, store.Save(tok.ClientID, tok))
+
+	// The token itself must not be in the keyring.
+	_, err := keyring.Get("test-service", "test-client")
+	assert.ErrorIs(t, err, keyring.ErrNotFound)
+
+	// Only the 44-byte base64 master key may live in the keyring —
+	// well under the Windows Credential Manager 2560-byte blob limit.
+	encoded, err := keyring.Get("test-service", masterKeyUser)
+	require.NoError(t, err)
+	assert.Len(t, encoded, 44)
+	key, err := base64.StdEncoding.DecodeString(encoded)
+	require.NoError(t, err)
+	assert.Len(t, key, 32)
+}
+
+func TestEncryptedFileStoreLoadNotFound(t *testing.T) {
+	store, _ := newTestEncryptedStore(t)
+
+	_, err := store.Load("nonexistent")
+	assert.ErrorIs(t, err, ErrNotFound)
+}
+
+func TestEncryptedFileStoreDelete(t *testing.T) {
+	store, _ := newTestEncryptedStore(t)
+
+	tok := newLargeTestToken("test-client")
+	require.NoError(t, store.Save(tok.ClientID, tok))
+	require.NoError(t, store.Delete("test-client"))
+
+	_, err := store.Load("test-client")
+	assert.ErrorIs(t, err, ErrNotFound)
+}
+
+func TestEncryptedFileStoreSaveEmptyClientID(t *testing.T) {
+	store, _ := newTestEncryptedStore(t)
+
+	err := store.Save("", newLargeTestToken("x"))
+	assert.ErrorIs(t, err, ErrEmptyClientID)
+}
+
+func TestEncryptedFileStoreProbe(t *testing.T) {
+	store, _ := newTestEncryptedStore(t)
+
+	assert.True(t, store.Probe())
+}
+
+func TestEncryptedFileStoreCorruptMasterKeyFailsLoad(t *testing.T) {
+	store, _ := newTestEncryptedStore(t)
+
+	tok := newLargeTestToken("test-client")
+	require.NoError(t, store.Save(tok.ClientID, tok))
+
+	// A fresh store whose keyring holds a corrupted key must fail to decrypt
+	// rather than return garbage or mint a new key.
+	require.NoError(t, keyring.Set("test-service", masterKeyUser, "not-base64!"))
+	fresh := NewEncryptedFileStore[Token]("test-service", store.file.filePath, JSONCodec[Token]{})
+	assert.False(t, fresh.Probe())
+	_, err := fresh.Load("test-client")
+	require.Error(t, err)
+	assert.NotErrorIs(t, err, ErrNotFound)
+}
+
+func TestEncryptedFileStoreNilCodecPanics(t *testing.T) {
+	assert.Panics(t, func() {
+		NewEncryptedFileStore[string]("svc", "path", nil)
+	})
+}
+
+func TestEncryptedFileStoreString(t *testing.T) {
+	store, path := newTestEncryptedStore(t)
+	assert.Equal(t, "encrypted-file: "+path, store.String())
+}

modules/credstore/file_store.go

@@ -0,0 +1,171 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package credstore
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"gitea.dev/tea/modules/filelock"
+)
+
+// storageMap manages encoded values for multiple clients.
+type storageMap struct {
+	Data map[string]string `json:"data"` // clientID -> encoded value
+}
+
+// FileStore stores values in a JSON file with file locking and atomic writes.
+type FileStore[T any] struct {
+	filePath string
+	codec    Codec[T]
+}
+
+// NewFileStore creates a new FileStore with the given codec.
+// Panics if codec is nil.
+func NewFileStore[T any](filePath string, codec Codec[T]) *FileStore[T] {
+	if codec == nil {
+		panic("credstore: NewFileStore called with nil codec")
+	}
+	return &FileStore[T]{filePath: filePath, codec: codec}
+}
+
+// readStorageMap reads and unmarshals the storage map from the file.
+// Returns an empty initialized map if the file does not exist.
+func (f *FileStore[T]) readStorageMap() (storageMap, error) {
+	var m storageMap
+	data, err := os.ReadFile(f.filePath)
+	if err != nil {
+		if os.IsNotExist(err) {
+			m.Data = make(map[string]string)
+			return m, nil
+		}
+		return m, fmt.Errorf("failed to read file %q: %w", f.filePath, err)
+	}
+
+	if err := json.Unmarshal(data, &m); err != nil {
+		return m, fmt.Errorf("failed to parse file %q: %w", f.filePath, err)
+	}
+	if m.Data == nil {
+		m.Data = make(map[string]string)
+	}
+	return m, nil
+}
+
+// ensureDir creates the parent directory of the store file if it does not exist.
+func (f *FileStore[T]) ensureDir() error {
+	if err := os.MkdirAll(filepath.Dir(f.filePath), 0o700); err != nil {
+		return fmt.Errorf("failed to create store directory: %w", err)
+	}
+	return nil
+}
+
+// writeStorageMap marshals and atomically writes the storage map to the file.
+func (f *FileStore[T]) writeStorageMap(m storageMap) error {
+	data, err := json.MarshalIndent(m, "", "  ")
+	if err != nil {
+		return err
+	}
+
+	tempFile := f.filePath + ".tmp"
+	if err := os.WriteFile(tempFile, data, 0o600); err != nil {
+		return fmt.Errorf("failed to write temp file: %w", err)
+	}
+	// WriteFile only applies the mode when creating the file; enforce it in
+	// case a stale temp file with looser permissions was left behind.
+	if err := os.Chmod(tempFile, 0o600); err != nil {
+		_ = os.Remove(tempFile)
+		return fmt.Errorf("failed to set temp file permissions: %w", err)
+	}
+
+	if err := os.Rename(tempFile, f.filePath); err != nil {
+		_ = os.Remove(tempFile)
+		return fmt.Errorf("failed to rename temp file: %w", err)
+	}
+
+	return nil
+}
+
+// withFileLock acquires an exclusive cross-process lock on filePath+".lock",
+// runs fn, and releases the lock. The kernel-level lock (flock/LockFileEx via
+// modules/filelock) is released automatically if the process dies, so no
+// stale-lock heuristics are needed. The .lock file itself remains on disk.
+func (f *FileStore[T]) withFileLock(fn func() error) error {
+	return filelock.New(f.filePath+".lock", filelock.DefaultTimeout).WithLock(fn)
+}
+
+// Load loads data from the file for the given client ID.
+// No file lock is needed: Save uses atomic rename, so reads always see a
+// consistent snapshot on POSIX systems.
+func (f *FileStore[T]) Load(clientID string) (T, error) {
+	var zero T
+	m, err := f.readStorageMap()
+	if err != nil {
+		return zero, err
+	}
+
+	encoded, ok := m.Data[clientID]
+	if !ok {
+		return zero, ErrNotFound
+	}
+
+	decoded, err := f.codec.Decode(encoded)
+	if err != nil {
+		return zero, fmt.Errorf("failed to decode value from %q: %w", f.filePath, err)
+	}
+	return decoded, nil
+}
+
+// Save saves data to the file for the given client ID.
+// Uses file locking to prevent race conditions.
+// Automatically creates parent directories if they do not exist.
+func (f *FileStore[T]) Save(clientID string, data T) error {
+	if clientID == "" {
+		return ErrEmptyClientID
+	}
+
+	encoded, err := f.codec.Encode(data)
+	if err != nil {
+		return fmt.Errorf("failed to encode value for storage: %w", err)
+	}
+
+	if err := f.ensureDir(); err != nil {
+		return err
+	}
+
+	return f.withFileLock(func() error {
+		m, err := f.readStorageMap()
+		if err != nil {
+			return err
+		}
+
+		m.Data[clientID] = encoded
+
+		return f.writeStorageMap(m)
+	})
+}
+
+// Delete removes data for the given client ID from the file.
+func (f *FileStore[T]) Delete(clientID string) error {
+	return f.withFileLock(func() error {
+		m, err := f.readStorageMap()
+		if err != nil {
+			return err
+		}
+
+		if _, ok := m.Data[clientID]; !ok {
+			return nil
+		}
+
+		delete(m.Data, clientID)
+
+		return f.writeStorageMap(m)
+	})
+}
+
+// String returns a description of this store.
+func (f *FileStore[T]) String() string {
+	return "file: " + f.filePath
+}

modules/credstore/file_store_test.go

@@ -0,0 +1,220 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package credstore
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"runtime"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func newTestFileStore(t *testing.T) (*FileStore[Token], string) {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), "tokens.json")
+	return NewFileStore[Token](path, JSONCodec[Token]{}), path
+}
+
+func TestFileStoreSaveAndLoad(t *testing.T) {
+	store, _ := newTestFileStore(t)
+
+	tok := Token{
+		AccessToken:  "test-access-token",
+		RefreshToken: "test-refresh-token",
+		TokenType:    "Bearer",
+		ExpiresAt:    time.Now().Add(1 * time.Hour).Truncate(time.Second),
+		ClientID:     "test-client",
+	}
+	require.NoError(t, store.Save(tok.ClientID, tok))
+
+	loaded, err := store.Load("test-client")
+	require.NoError(t, err)
+	assert.Equal(t, tok.AccessToken, loaded.AccessToken)
+	assert.Equal(t, tok.RefreshToken, loaded.RefreshToken)
+	assert.Equal(t, tok.ClientID, loaded.ClientID)
+}
+
+func TestFileStoreLoadNotFound(t *testing.T) {
+	store, _ := newTestFileStore(t)
+
+	_, err := store.Load("nonexistent")
+	assert.ErrorIs(t, err, ErrNotFound)
+}
+
+func TestFileStoreLoadFromExistingFileNotFound(t *testing.T) {
+	store, _ := newTestFileStore(t)
+
+	require.NoError(t, store.Save("client-1", Token{AccessToken: "token-1", ClientID: "client-1"}))
+
+	_, err := store.Load("client-2")
+	assert.ErrorIs(t, err, ErrNotFound)
+}
+
+func TestFileStoreDelete(t *testing.T) {
+	store, _ := newTestFileStore(t)
+
+	require.NoError(t, store.Save("test-client", Token{AccessToken: "test-token", ClientID: "test-client"}))
+	require.NoError(t, store.Delete("test-client"))
+
+	_, err := store.Load("test-client")
+	assert.ErrorIs(t, err, ErrNotFound)
+}
+
+func TestFileStoreDeleteNonexistent(t *testing.T) {
+	store, _ := newTestFileStore(t)
+
+	// Should not error when deleting from nonexistent file
+	assert.NoError(t, store.Delete("nonexistent"))
+}
+
+func TestFileStoreDeletePreservesOtherClients(t *testing.T) {
+	store, _ := newTestFileStore(t)
+
+	for _, id := range []string{"client-1", "client-2"} {
+		require.NoError(t, store.Save(id, Token{AccessToken: "token-" + id, ClientID: id}))
+	}
+
+	require.NoError(t, store.Delete("client-1"))
+
+	loaded, err := store.Load("client-2")
+	require.NoError(t, err)
+	assert.Equal(t, "token-client-2", loaded.AccessToken)
+}
+
+func TestFileStoreConcurrentWrites(t *testing.T) {
+	store, _ := newTestFileStore(t)
+
+	const goroutines = 10
+	var wg sync.WaitGroup
+
+	wg.Add(goroutines)
+	for i := range goroutines {
+		go func(id int) {
+			defer wg.Done()
+
+			tok := Token{
+				AccessToken: fmt.Sprintf("access-token-%d", id),
+				ClientID:    fmt.Sprintf("client-%d", id),
+			}
+			assert.NoError(t, store.Save(tok.ClientID, tok))
+		}(i)
+	}
+	wg.Wait()
+
+	// Verify all tokens were saved by loading each one
+	for i := range goroutines {
+		clientID := fmt.Sprintf("client-%d", i)
+		loaded, err := store.Load(clientID)
+		require.NoError(t, err)
+		assert.Equal(t, fmt.Sprintf("access-token-%d", i), loaded.AccessToken)
+	}
+
+	// The kernel lock is released after the saves: the lock file (which
+	// legitimately remains on disk with flock-style locking) must be
+	// immediately re-lockable without hitting the timeout.
+	require.NoError(t, store.withFileLock(func() error { return nil }))
+}
+
+func TestFileStoreSaveEmptyClientID(t *testing.T) {
+	store, _ := newTestFileStore(t)
+
+	err := store.Save("", Token{AccessToken: "tok"})
+	assert.ErrorIs(t, err, ErrEmptyClientID)
+}
+
+func TestFileStoreFilePermissions(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("file permission test is not applicable on Windows")
+	}
+
+	store, path := newTestFileStore(t)
+
+	require.NoError(t, store.Save("c1", Token{AccessToken: "tok", ClientID: "c1"}))
+
+	info, err := os.Stat(path)
+	require.NoError(t, err)
+	assert.Equal(t, os.FileMode(0o600), info.Mode().Perm())
+}
+
+func TestFileStoreSaveCreatesParentDirectories(t *testing.T) {
+	nestedPath := filepath.Join(t.TempDir(), "a", "b", "c", "tokens.json")
+	store := NewFileStore[Token](nestedPath, JSONCodec[Token]{})
+
+	require.NoError(t, store.Save("c1", Token{AccessToken: "tok", ClientID: "c1"}))
+
+	loaded, err := store.Load("c1")
+	require.NoError(t, err)
+	assert.Equal(t, "tok", loaded.AccessToken)
+}
+
+func TestFileStoreInvalidJSON(t *testing.T) {
+	store, path := newTestFileStore(t)
+	require.NoError(t, os.WriteFile(path, []byte("{invalid"), 0o600))
+
+	_, err := store.Load("any")
+	assert.Error(t, err)
+}
+
+func TestFileStoreNullDataField(t *testing.T) {
+	store, path := newTestFileStore(t)
+	require.NoError(t, os.WriteFile(path, []byte(`{"data": null}`), 0o600))
+
+	// A null data map must read as empty, not crash.
+	_, err := store.Load("any")
+	assert.ErrorIs(t, err, ErrNotFound)
+	require.NoError(t, store.Save("c1", Token{AccessToken: "tok", ClientID: "c1"}))
+}
+
+func TestFileStoreWithFileLockPropagatesErrorAndReleases(t *testing.T) {
+	store, _ := newTestFileStore(t)
+
+	sentinel := fmt.Errorf("sentinel failure")
+	err := store.withFileLock(func() error { return sentinel })
+	assert.ErrorIs(t, err, sentinel)
+
+	// The lock must have been released despite the error: re-acquiring
+	// immediately must succeed without hitting the timeout.
+	assert.NoError(t, store.withFileLock(func() error { return nil }))
+}
+
+func TestFileStoreSaveLeavesNoTempFile(t *testing.T) {
+	store, path := newTestFileStore(t)
+
+	require.NoError(t, store.Save("c1", Token{AccessToken: "tok", ClientID: "c1"}))
+
+	_, err := os.Stat(path + ".tmp")
+	assert.True(t, os.IsNotExist(err), "temp file left behind after successful save")
+}
+
+func TestFileStoreDeleteAbsentKeyDoesNotRewriteFile(t *testing.T) {
+	store, path := newTestFileStore(t)
+
+	require.NoError(t, store.Save("c1", Token{AccessToken: "tok", ClientID: "c1"}))
+	before, err := os.ReadFile(path)
+	require.NoError(t, err)
+
+	// Deleting a key that is not present must be a no-op write-wise:
+	// other clients' data stays byte-identical on disk.
+	require.NoError(t, store.Delete("absent"))
+	after, err := os.ReadFile(path)
+	require.NoError(t, err)
+	assert.Equal(t, string(before), string(after))
+}
+
+func TestFileStoreString(t *testing.T) {
+	store := NewFileStore[Token]("/path/to/tokens.json", JSONCodec[Token]{})
+	assert.Equal(t, "file: /path/to/tokens.json", store.String())
+}
+
+func TestFileStoreNilCodecPanics(t *testing.T) {
+	assert.Panics(t, func() {
+		NewFileStore[string]("path", nil)
+	})
+}

modules/credstore/keyring_store.go

@@ -0,0 +1,76 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package credstore
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/zalando/go-keyring"
+)
+
+// KeyringStore stores values in the OS keyring (macOS Keychain, Linux Secret Service, Windows Credential Manager).
+type KeyringStore[T any] struct {
+	serviceName string
+	codec       Codec[T]
+}
+
+// NewKeyringStore creates a new KeyringStore with the given codec.
+// Panics if codec is nil.
+func NewKeyringStore[T any](serviceName string, codec Codec[T]) *KeyringStore[T] {
+	if codec == nil {
+		panic("credstore: NewKeyringStore called with nil codec")
+	}
+	return &KeyringStore[T]{serviceName: serviceName, codec: codec}
+}
+
+// Load loads data from the keyring for the given client ID.
+func (k *KeyringStore[T]) Load(clientID string) (T, error) {
+	var zero T
+	data, err := keyring.Get(k.serviceName, clientID)
+	if err != nil {
+		if errors.Is(err, keyring.ErrNotFound) {
+			return zero, ErrNotFound
+		}
+		return zero, fmt.Errorf("failed to read from keyring: %w", err)
+	}
+
+	decoded, err := k.codec.Decode(data)
+	if err != nil {
+		return zero, fmt.Errorf("failed to decode keyring data: %w", err)
+	}
+	return decoded, nil
+}
+
+// Save saves data to the keyring for the given client ID.
+func (k *KeyringStore[T]) Save(clientID string, data T) error {
+	if clientID == "" {
+		return ErrEmptyClientID
+	}
+
+	encoded, err := k.codec.Encode(data)
+	if err != nil {
+		return fmt.Errorf("failed to encode data for keyring: %w", err)
+	}
+
+	if err := keyring.Set(k.serviceName, clientID, encoded); err != nil {
+		return fmt.Errorf("failed to save to keyring: %w", err)
+	}
+
+	return nil
+}
+
+// Delete removes data for the given client ID from the keyring.
+func (k *KeyringStore[T]) Delete(clientID string) error {
+	err := keyring.Delete(k.serviceName, clientID)
+	if err != nil && !errors.Is(err, keyring.ErrNotFound) {
+		return fmt.Errorf("failed to delete from keyring: %w", err)
+	}
+	return nil
+}
+
+// String returns a description of this store.
+func (k *KeyringStore[T]) String() string {
+	return "keyring: " + k.serviceName
+}

modules/credstore/keyring_store_test.go

@@ -0,0 +1,81 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package credstore
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/zalando/go-keyring"
+)
+
+func TestKeyringStoreSaveAndLoad(t *testing.T) {
+	keyring.MockInit()
+	store := NewStringKeyringStore("test-service")
+
+	require.NoError(t, store.Save("my-client", "eyJhbGciOiJSUzI1NiJ9"))
+
+	loaded, err := store.Load("my-client")
+	require.NoError(t, err)
+	assert.Equal(t, "eyJhbGciOiJSUzI1NiJ9", loaded)
+}
+
+func TestKeyringStoreLoadNotFound(t *testing.T) {
+	keyring.MockInit()
+	store := NewStringKeyringStore("test-service")
+
+	_, err := store.Load("nonexistent")
+	assert.ErrorIs(t, err, ErrNotFound)
+}
+
+func TestKeyringStoreDelete(t *testing.T) {
+	keyring.MockInit()
+	store := NewStringKeyringStore("test-service")
+
+	require.NoError(t, store.Save("test-client", "test-token"))
+	require.NoError(t, store.Delete("test-client"))
+
+	_, err := store.Load("test-client")
+	assert.ErrorIs(t, err, ErrNotFound)
+}
+
+func TestKeyringStoreDeleteNonexistent(t *testing.T) {
+	keyring.MockInit()
+	store := NewStringKeyringStore("test-service")
+
+	// Should not error when deleting nonexistent key
+	assert.NoError(t, store.Delete("nonexistent"))
+}
+
+func TestKeyringStoreOverwriteExisting(t *testing.T) {
+	keyring.MockInit()
+	store := NewStringKeyringStore("test-service")
+
+	require.NoError(t, store.Save("test-client", "token-v1"))
+	require.NoError(t, store.Save("test-client", "token-v2"))
+
+	loaded, err := store.Load("test-client")
+	require.NoError(t, err)
+	assert.Equal(t, "token-v2", loaded)
+}
+
+func TestKeyringStoreSaveEmptyClientID(t *testing.T) {
+	keyring.MockInit()
+	store := NewStringKeyringStore("test-service")
+
+	err := store.Save("", "tok")
+	assert.ErrorIs(t, err, ErrEmptyClientID)
+}
+
+func TestKeyringStoreString(t *testing.T) {
+	store := NewStringKeyringStore("my-service")
+	assert.Equal(t, "keyring: my-service", store.String())
+}
+
+func TestKeyringStoreNilCodecPanics(t *testing.T) {
+	assert.Panics(t, func() {
+		NewKeyringStore[string]("svc", nil)
+	})
+}

modules/credstore/secure_store.go

@@ -0,0 +1,58 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package credstore
+
+// Prober is an optional interface that a Store can implement to test
+// whether its backend is available.
+type Prober interface {
+	Probe() bool
+}
+
+// DefaultSecureStore creates a SecureStore with the given codec and sensible defaults.
+// The primary backend is an EncryptedFileStore writing to filePath+".enc"
+// with its master key in the OS keyring; see EncryptedFileStore for why only
+// the key lives there. When the keyring is unavailable, it falls back to
+// plaintext file storage at filePath.
+func DefaultSecureStore[T any](serviceName, filePath string, codec Codec[T]) *SecureStore[T] {
+	return NewSecureStore[T](
+		NewEncryptedFileStore[T](serviceName, filePath+".enc", codec),
+		NewFileStore[T](filePath, codec))
+}
+
+// SecureStore is a composite Store that uses the keyring-backed primary
+// store when the keyring is available and falls back to file-based storage
+// otherwise. The active backend is chosen once at construction time.
+type SecureStore[T any] struct {
+	active Store[T]
+}
+
+// NewSecureStore creates a SecureStore. If kr implements Prober and the probe
+// succeeds, kr is used as the active store. Otherwise, file is used as the
+// fallback.
+func NewSecureStore[T any](kr, file Store[T]) *SecureStore[T] {
+	if p, ok := kr.(Prober); ok && p.Probe() {
+		return &SecureStore[T]{active: kr}
+	}
+	return &SecureStore[T]{active: file}
+}
+
+// Load loads data from the active store.
+func (s *SecureStore[T]) Load(clientID string) (T, error) {
+	return s.active.Load(clientID)
+}
+
+// Save saves data to the active store.
+func (s *SecureStore[T]) Save(clientID string, data T) error {
+	return s.active.Save(clientID, data)
+}
+
+// Delete removes data from the active store.
+func (s *SecureStore[T]) Delete(clientID string) error {
+	return s.active.Delete(clientID)
+}
+
+// String returns a description of the active store.
+func (s *SecureStore[T]) String() string {
+	return s.active.String()
+}

modules/credstore/secure_store_test.go

@@ -0,0 +1,242 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package credstore
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/zalando/go-keyring"
+)
+
+// mockStore is a simple mock implementing Store[T] for testing.
+type mockStore[T any] struct {
+	data map[string]T
+	name string
+}
+
+func newMockStore[T any](name string) *mockStore[T] {
+	return &mockStore[T]{
+		data: make(map[string]T),
+		name: name,
+	}
+}
+
+func (m *mockStore[T]) Load(clientID string) (T, error) {
+	data, ok := m.data[clientID]
+	if !ok {
+		var zero T
+		return zero, ErrNotFound
+	}
+	return data, nil
+}
+
+func (m *mockStore[T]) Save(clientID string, data T) error {
+	m.data[clientID] = data
+	return nil
+}
+
+func (m *mockStore[T]) Delete(clientID string) error {
+	delete(m.data, clientID)
+	return nil
+}
+
+func (m *mockStore[T]) String() string {
+	return m.name
+}
+
+// mockProberStore implements both Store[T] and Prober.
+type mockProberStore[T any] struct {
+	mockStore[T]
+	probeResult bool
+}
+
+func newMockProberStore[T any](name string, probeResult bool) *mockProberStore[T] {
+	return &mockProberStore[T]{
+		mockStore:   mockStore[T]{data: make(map[string]T), name: name},
+		probeResult: probeResult,
+	}
+}
+
+func (m *mockProberStore[T]) Probe() bool {
+	return m.probeResult
+}
+
+func TestSecureStoreUsesKeyringWhenProbeSucceeds(t *testing.T) {
+	kr := newMockProberStore[Token]("keyring: test", true)
+	file := newMockStore[Token]("file: test")
+
+	store := NewSecureStore[Token](kr, file)
+
+	tok := Token{
+		AccessToken: "test-token",
+		ClientID:    "test-client",
+		ExpiresAt:   time.Now().Add(1 * time.Hour),
+	}
+	require.NoError(t, store.Save(tok.ClientID, tok))
+
+	// Should be in keyring, not file
+	assert.Contains(t, kr.data, "test-client")
+	assert.NotContains(t, file.data, "test-client")
+
+	loaded, err := store.Load("test-client")
+	require.NoError(t, err)
+	assert.Equal(t, "test-token", loaded.AccessToken)
+	assert.Equal(t, "keyring: test", store.String())
+}
+
+func TestSecureStoreFallsBackToFileWhenProbeFails(t *testing.T) {
+	kr := newMockProberStore[Token]("keyring: test", false)
+	file := newMockStore[Token]("file: test")
+
+	store := NewSecureStore[Token](kr, file)
+
+	tok := Token{
+		AccessToken: "test-token",
+		ClientID:    "test-client",
+		ExpiresAt:   time.Now().Add(1 * time.Hour),
+	}
+	require.NoError(t, store.Save(tok.ClientID, tok))
+
+	// Should be in file, not keyring
+	assert.Contains(t, file.data, "test-client")
+	assert.NotContains(t, kr.data, "test-client")
+	assert.Equal(t, "file: test", store.String())
+}
+
+func TestSecureStoreFallsBackWhenKrNotProber(t *testing.T) {
+	// kr does not implement Prober, should fall back to file
+	kr := newMockStore[Token]("keyring: test")
+	file := newMockStore[Token]("file: test")
+
+	store := NewSecureStore[Token](kr, file)
+
+	assert.Equal(t, "file: test", store.String())
+}
+
+func TestSecureStoreDelete(t *testing.T) {
+	kr := newMockProberStore[Token]("keyring: test", true)
+	file := newMockStore[Token]("file: test")
+	store := NewSecureStore[Token](kr, file)
+
+	tok := Token{
+		AccessToken: "test-token",
+		ClientID:    "test-client",
+	}
+	require.NoError(t, store.Save(tok.ClientID, tok))
+	require.NoError(t, store.Delete("test-client"))
+
+	_, err := store.Load("test-client")
+	assert.ErrorIs(t, err, ErrNotFound)
+}
+
+// TestDefaultTokenSecureStoreRoundTrip verifies the happy path: with a working
+// keyring, Save writes AES-256-GCM ciphertext (v1: prefix) to filePath+".enc",
+// Load returns the identical token, and Delete makes Load return ErrNotFound.
+func TestDefaultTokenSecureStoreRoundTrip(t *testing.T) {
+	keyring.MockInit() // avoid touching the real OS keyring
+	plainPath := filepath.Join(t.TempDir(), "credentials.json")
+	store := DefaultTokenSecureStore("test-service", plainPath)
+
+	tok := Token{
+		AccessToken:  "secret-access-token",
+		RefreshToken: "secret-refresh-token",
+		TokenType:    "Bearer",
+		ExpiresAt:    time.Now().Add(1 * time.Hour).Truncate(time.Second),
+		ClientID:     "test-client",
+	}
+	require.NoError(t, store.Save(tok.ClientID, tok))
+
+	loaded, err := store.Load("test-client")
+	require.NoError(t, err)
+	assert.Equal(t, tok.AccessToken, loaded.AccessToken)
+	assert.Equal(t, tok.RefreshToken, loaded.RefreshToken)
+	assert.Equal(t, tok.TokenType, loaded.TokenType)
+	assert.Equal(t, tok.ClientID, loaded.ClientID)
+	assert.True(t, tok.ExpiresAt.Equal(loaded.ExpiresAt))
+
+	// The encrypted file must exist and contain only v1:-prefixed ciphertext.
+	raw, err := os.ReadFile(plainPath + ".enc")
+	require.NoError(t, err)
+	assert.Contains(t, string(raw), `"v1:`)
+	assert.NotContains(t, string(raw), "secret-access-token")
+	assert.NotContains(t, string(raw), "secret-refresh-token")
+
+	// No plaintext fallback file may be created.
+	_, err = os.Stat(plainPath)
+	assert.ErrorIs(t, err, os.ErrNotExist)
+
+	require.NoError(t, store.Delete("test-client"))
+	_, err = store.Load("test-client")
+	assert.ErrorIs(t, err, ErrNotFound)
+}
+
+// TestDefaultTokenSecureStoreFallbackWithoutKeyring verifies the CI/headless
+// path: when the OS keyring is unavailable, the store falls back to the
+// plaintext file and Save/Load still succeed.
+func TestDefaultTokenSecureStoreFallbackWithoutKeyring(t *testing.T) {
+	keyring.MockInitWithError(errors.New("keyring unavailable"))
+	t.Cleanup(keyring.MockInit) // restore a working mock for later tests
+
+	plainPath := filepath.Join(t.TempDir(), "credentials.json")
+	store := DefaultTokenSecureStore("test-service", plainPath)
+
+	tok := Token{
+		AccessToken: "fallback-token",
+		ClientID:    "test-client",
+	}
+	require.NoError(t, store.Save(tok.ClientID, tok))
+	assert.Equal(t, "file: "+plainPath, store.String())
+
+	loaded, err := store.Load("test-client")
+	require.NoError(t, err)
+	assert.Equal(t, "fallback-token", loaded.AccessToken)
+
+	// Plaintext file exists, encrypted file does not.
+	raw, err := os.ReadFile(plainPath)
+	require.NoError(t, err)
+	assert.True(t, strings.Contains(string(raw), "fallback-token"))
+	_, err = os.Stat(plainPath + ".enc")
+	assert.ErrorIs(t, err, os.ErrNotExist)
+}
+
+// Format-stability fixture: a fixed master key and a credentials.json.enc
+// file in the "v1:" AES-256-GCM format. They must remain decryptable so
+// users do not lose their stored tokens when upgrading tea.
+const (
+	fixtureMasterKeyB64 = "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8="
+	fixtureEncFile      = `{
+  "data": {
+    "fixture-login": "v1:KallKg6+rJ3Sbxf6Kz1E5yF9bRgqq0Of00ZSctEY2Dem6qpm2wt9RdpCqSMdoX9AQ6/u9ujuC4a0LPb1n3ryXm0EJGrFpXHff0ukpatB1OZhdYlgcbuA8EFpPF/rSgN1hMXOXYQFn64r3iIEaXkgW69s887RNLbaxXALy3o7qvzmEWXuTPtEy3x+J4O6pmbDusvqgVWrOLPT9A1fSJnXWcViUcG13JF0X36NFPc149hsf1S0OUB2Uwn3hVl8jIISaw=="
+  }
+}`
+)
+
+// TestDefaultTokenSecureStoreReadsFixtureData verifies on-disk format
+// compatibility: the AES-256-GCM "v1:" ciphertext format (as produced by the
+// original SDK implementation) with the master key in the keyring is
+// decrypted correctly.
+func TestDefaultTokenSecureStoreReadsFixtureData(t *testing.T) {
+	keyring.MockInit()
+	require.NoError(t, keyring.Set("tea-cli", masterKeyUser, fixtureMasterKeyB64))
+
+	plainPath := filepath.Join(t.TempDir(), "credentials.json")
+	require.NoError(t, os.WriteFile(plainPath+".enc", []byte(fixtureEncFile), 0o600))
+
+	store := DefaultTokenSecureStore("tea-cli", plainPath)
+
+	loaded, err := store.Load("fixture-login")
+	require.NoError(t, err)
+	assert.Equal(t, "fixture-access-token", loaded.AccessToken)
+	assert.Equal(t, "fixture-refresh-token", loaded.RefreshToken)
+	assert.Equal(t, "Bearer", loaded.TokenType)
+	assert.Equal(t, "fixture-login", loaded.ClientID)
+	assert.True(t, loaded.ExpiresAt.Equal(time.Date(2027, 1, 2, 3, 4, 5, 0, time.UTC)))
+}

modules/credstore/store.go

@@ -0,0 +1,57 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package credstore
+
+import (
+	"errors"
+	"time"
+)
+
+// ErrNotFound indicates that no data was found for the given client ID.
+var ErrNotFound = errors.New("not found")
+
+// ErrEmptyClientID is returned when an empty client ID is passed to Save.
+var ErrEmptyClientID = errors.New("client ID cannot be empty")
+
+// Store defines the interface for loading, saving, and deleting data by client ID.
+type Store[T any] interface {
+	Load(clientID string) (T, error)
+	Save(clientID string, data T) error
+	Delete(clientID string) error
+	String() string
+}
+
+// Token represents saved tokens for a specific client.
+type Token struct {
+	AccessToken  string    `json:"access_token"`
+	RefreshToken string    `json:"refresh_token"`
+	TokenType    string    `json:"token_type"`
+	Scope        string    `json:"scope,omitempty"`
+	IDToken      string    `json:"id_token,omitempty"`
+	ExpiresAt    time.Time `json:"expires_at"`
+	ClientID     string    `json:"client_id"`
+}
+
+// IsExpired reports whether the token has expired.
+// Returns false if ExpiresAt is zero (token has no expiry).
+func (t *Token) IsExpired() bool {
+	return !t.ExpiresAt.IsZero() && time.Now().After(t.ExpiresAt)
+}
+
+// IsValid reports whether the token has a non-empty access token and is not expired.
+func (t *Token) IsValid() bool {
+	return t.AccessToken != "" && !t.IsExpired()
+}
+
+// NewStringKeyringStore creates a KeyringStore for plain string values.
+func NewStringKeyringStore(serviceName string) *KeyringStore[string] {
+	return NewKeyringStore[string](serviceName, StringCodec{})
+}
+
+// DefaultTokenSecureStore creates a SecureStore for Token values with sensible defaults.
+// Tokens are AES-256-GCM-encrypted to filePath+".enc" with the master key in
+// the OS keyring; see DefaultSecureStore for details.
+func DefaultTokenSecureStore(serviceName, filePath string) *SecureStore[Token] {
+	return DefaultSecureStore[Token](serviceName, filePath, JSONCodec[Token]{})
+}

modules/credstore/store_test.go

@@ -0,0 +1,89 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package credstore
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestTokenIsExpired(t *testing.T) {
+	tests := []struct {
+		name      string
+		expiresAt time.Time
+		want      bool
+	}{
+		{
+			name:      "expired token",
+			expiresAt: time.Now().Add(-1 * time.Hour),
+			want:      true,
+		},
+		{
+			name:      "not expired token",
+			expiresAt: time.Now().Add(1 * time.Hour),
+			want:      false,
+		},
+		{
+			name:      "zero expiry (no expiry)",
+			expiresAt: time.Time{},
+			want:      false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			token := &Token{
+				AccessToken: "test-token",
+				ExpiresAt:   tt.expiresAt,
+			}
+			assert.Equal(t, tt.want, token.IsExpired())
+		})
+	}
+}
+
+func TestTokenIsValid(t *testing.T) {
+	tests := []struct {
+		name        string
+		accessToken string
+		expiresAt   time.Time
+		want        bool
+	}{
+		{
+			name:        "valid token with future expiry",
+			accessToken: "test-token",
+			expiresAt:   time.Now().Add(1 * time.Hour),
+			want:        true,
+		},
+		{
+			name:        "valid token with zero expiry",
+			accessToken: "test-token",
+			expiresAt:   time.Time{},
+			want:        true,
+		},
+		{
+			name:        "expired token",
+			accessToken: "test-token",
+			expiresAt:   time.Now().Add(-1 * time.Hour),
+			want:        false,
+		},
+		{
+			name:        "empty access token",
+			accessToken: "",
+			expiresAt:   time.Now().Add(1 * time.Hour),
+			want:        false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			token := &Token{
+				AccessToken: tt.accessToken,
+				ExpiresAt:   tt.expiresAt,
+			}
+			assert.Equal(t, tt.want, token.IsValid())
+		})
+	}
+}

modules/git/cli_backend.go

@@ -164,7 +164,20 @@ func (r *cliRepository) CreateTrackingBranch(localBranchName, remoteBranchName,
 }
 
 func (r *cliRepository) Checkout(ref ReferenceName) error {
-	_, err := r.git(nil, nil, "checkout", ref.String())
+	args := []string{"checkout"}
+	switch {
+	case ref.IsBranch():
+		// `git checkout refs/heads/<branch>` detaches HEAD, while the short branch
+		// name switches to the local branch as intended.
+		args = append(args, ref.Short())
+	case ref.IsRemote():
+		// Be explicit about detached HEAD when checking out a remote-tracking ref.
+		args = append(args, "--detach", ref.String())
+	default:
+		args = append(args, ref.String())
+	}
+
+	_, err := r.git(nil, nil, args...)
 	return err
 }
 

modules/httputil/httputil.go

@@ -4,6 +4,7 @@
 package httputil
 
 import (
+	"crypto/tls"
 	"fmt"
 	"net/http"
 	"runtime"
@@ -20,12 +21,14 @@ func UserAgent() string {
 	return ua
 }
 
-// WrapTransport wraps an http.RoundTripper to add the User-Agent header.
-func WrapTransport(base http.RoundTripper) http.RoundTripper {
-	if base == nil {
-		base = http.DefaultTransport
-	}
-	return &userAgentTransport{base: base}
+// WrapTransport returns tea's standard HTTP transport: an *http.Transport
+// preset with tea's connection / response-header timeouts (see timeoutTransport)
+// and decorated to add the User-Agent header on every request. The supplied
+// tlsConfig is attached as-is (nil is fine); callers use it for insecure /
+// skip-verify logins. This is the single entry point for building a tea HTTP
+// client transport, so the timeouts can't be accidentally omitted.
+func WrapTransport(tlsConfig *tls.Config) http.RoundTripper {
+	return &userAgentTransport{base: timeoutTransport(tlsConfig)}
 }
 
 type userAgentTransport struct {
@@ -33,6 +36,11 @@ type userAgentTransport struct {
 }
 
 func (t *userAgentTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	// Set the UA at the transport so every client built from WrapTransport
+	// identifies itself, including the non-SDK clients (oauth2 flow, token
+	// refresh) that never pass through the SDK's own SetUserAgent. For SDK
+	// clients this overlaps gitea.SetUserAgent; both use httputil.UserAgent(),
+	// so the duplicate Header.Set is a no-op.
 	req.Header.Set("User-Agent", UserAgent())
 	return t.base.RoundTrip(req)
 }

modules/httputil/transport.go

@@ -0,0 +1,57 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package httputil
+
+import (
+	"crypto/tls"
+	"net"
+	"net/http"
+	"time"
+)
+
+// Timeout values applied to every Gitea API request. These are deliberately
+// connection-establishment and time-to-first-response-byte timeouts, NOT an
+// overall request deadline: a large release-attachment upload can legitimately
+// run for minutes, and as long as bytes keep flowing none of these fire. They
+// only trip when a server accepts the connection but never (or far too slowly)
+// starts responding — the "hangs forever" case from a stalled or unresponsive
+// server (issue #1018).
+const (
+	// DialTimeout bounds establishing the TCP connection.
+	DialTimeout = 10 * time.Second
+	// TLSHandshakeTimeout bounds completing the TLS handshake.
+	TLSHandshakeTimeout = 10 * time.Second
+	// ResponseHeaderTimeout bounds the wait, after the request is written, for
+	// the server to begin sending response headers. This is the only timeout
+	// that protects against a server which accepts the connection but then goes
+	// silent — the originally reported #1018 symptom; DialTimeout/
+	// TLSHandshakeTimeout do not, because the connection already succeeded.
+	//
+	// The value must clear Gitea's legitimate synchronous pre-response work.
+	// Profiling a self-hosted Gitea 1.24.6 (on hardware slower than gitea.com)
+	// showed creating a pull request that triggers conflict detection across
+	// ~1500 changed files takes ~10s before the first byte (3 runs: 10.06 /
+	// 10.08 / 10.24s); clean-diff PR creation was ~1s and large attachment
+	// uploads ~9ms. 120s is ~12x that measured worst case, leaving generous
+	// headroom for larger repos and busier servers while still failing in two
+	// minutes instead of hanging forever.
+	ResponseHeaderTimeout = 120 * time.Second
+)
+
+// timeoutTransport returns an *http.Transport configured with tea's standard
+// timeouts. The supplied tlsConfig is attached as-is (callers use it for
+// insecure / skip-verify logins). It is a clone of http.DefaultTransport so
+// connection pooling, proxy support and HTTP/2 keep working. Callers obtain it
+// through WrapTransport, which also adds the User-Agent header.
+func timeoutTransport(tlsConfig *tls.Config) *http.Transport {
+	t := http.DefaultTransport.(*http.Transport).Clone()
+	t.DialContext = (&net.Dialer{
+		Timeout:   DialTimeout,
+		KeepAlive: 30 * time.Second,
+	}).DialContext
+	t.TLSHandshakeTimeout = TLSHandshakeTimeout
+	t.ResponseHeaderTimeout = ResponseHeaderTimeout
+	t.TLSClientConfig = tlsConfig
+	return t
+}

modules/httputil/transport_stall_test.go

@@ -0,0 +1,91 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package httputil
+
+import (
+	"net"
+	"net/http"
+	"testing"
+	"time"
+)
+
+// TestWrapTransportTimeouts verifies the transport returned by WrapTransport
+// carries tea's standard timeout values, so a stalled server can't make tea
+// hang forever (issue #1018).
+func TestWrapTransportTimeouts(t *testing.T) {
+	rt := WrapTransport(nil)
+	uat, ok := rt.(*userAgentTransport)
+	if !ok {
+		t.Fatalf("WrapTransport returned %T, want *userAgentTransport", rt)
+	}
+	tr, ok := uat.base.(*http.Transport)
+	if !ok {
+		t.Fatalf("underlying base is %T, want *http.Transport", uat.base)
+	}
+	if tr.TLSHandshakeTimeout != TLSHandshakeTimeout {
+		t.Errorf("TLSHandshakeTimeout = %v, want %v", tr.TLSHandshakeTimeout, TLSHandshakeTimeout)
+	}
+	if tr.ResponseHeaderTimeout != ResponseHeaderTimeout {
+		t.Errorf("ResponseHeaderTimeout = %v, want %v", tr.ResponseHeaderTimeout, ResponseHeaderTimeout)
+	}
+	if tr.DialContext == nil {
+		t.Error("DialContext is nil, want a dialer with DialTimeout")
+	}
+}
+
+// newStallListener returns a listener that accepts connections, reads the
+// request, then goes silent without ever sending response headers — the
+// "server accepts the connection but never responds" case ResponseHeaderTimeout
+// guards against. The returned closer stops the listener.
+func newStallListener(t *testing.T) (addr string, closer func()) {
+	t.Helper()
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	done := make(chan struct{})
+	go func() {
+		for {
+			conn, err := ln.Accept()
+			if err != nil {
+				return
+			}
+			go func(c net.Conn) {
+				buf := make([]byte, 4096)
+				_, _ = c.Read(buf) // drain the request, then never respond
+				<-done             // hold the connection open until the test ends
+				c.Close()
+			}(conn)
+		}
+	}()
+	return ln.Addr().String(), func() {
+		close(done)
+		ln.Close()
+	}
+}
+
+// TestResponseHeaderTimeoutFires proves a request to a server that accepts the
+// connection and request but never sends response headers aborts via
+// ResponseHeaderTimeout rather than hanging. It builds the transport the same
+// way WrapTransport does, with a short ResponseHeaderTimeout so the test is fast.
+func TestResponseHeaderTimeoutFires(t *testing.T) {
+	addr, closer := newStallListener(t)
+	defer closer()
+
+	tr := timeoutTransport(nil)
+	tr.ResponseHeaderTimeout = 2 * time.Second
+	client := &http.Client{Transport: &userAgentTransport{base: tr}}
+
+	start := time.Now()
+	_, err := client.Get("http://" + addr + "/")
+	elapsed := time.Since(start)
+
+	if err == nil {
+		t.Fatal("expected a timeout error from stalled server, got nil")
+	}
+	if elapsed > 10*time.Second {
+		t.Errorf("request took %v; ResponseHeaderTimeout did not fire", elapsed)
+	}
+	t.Logf("request failed as expected after %v: %v", elapsed, err)
+}

modules/interact/issue_edit.go

@@ -8,6 +8,7 @@ import (
 	"slices"
 	"strings"
 
+	gitea "gitea.dev/sdk"
 	"gitea.dev/tea/modules/config"
 	"gitea.dev/tea/modules/context"
 	"gitea.dev/tea/modules/task"
@@ -40,9 +41,10 @@ func EditIssue(requestCtx stdctx.Context, ctx context.TeaContext, index int64) (
 		Deadline: i.Deadline,
 	}
 
+	i.Assignees = cleanAssignees(i.Assignees)
 	if len(i.Assignees) != 0 {
 		for _, a := range i.Assignees {
-			opts.AddAssignees = append(opts.AddAssignees, a.UserName)
+			opts.SetAssignees = append(opts.SetAssignees, a.UserName)
 		}
 	}
 
@@ -109,7 +111,7 @@ func promptIssueEditProperties(requestCtx stdctx.Context, ctx *context.TeaContex
 		return nil
 	}
 
-	currAssignees := o.AddAssignees
+	currAssignees := o.SetAssignees
 	newAssignees := selectables.Assignees
 
 	for _, c := range currAssignees {
@@ -119,10 +121,14 @@ func promptIssueEditProperties(requestCtx stdctx.Context, ctx *context.TeaContex
 	}
 
 	// assignees
-	if o.AddAssignees, err = promptMultiSelect("Add Assignees:", newAssignees, "[other]"); err != nil {
+	if currAssignees, err = promptMultiSelectWithPreselect("Set Assignees:", currAssignees, newAssignees, "[other]"); err != nil {
 		return err
 	}
-	printTitleAndContent("Assignees:", strings.Join(o.AddAssignees, "\n"))
+	if len(currAssignees) == 0 && len(o.SetAssignees) > 0 {
+		o.RemoveAssignees = o.SetAssignees
+	}
+	o.SetAssignees = currAssignees
+	printTitleAndContent("Assignees:", strings.Join(o.SetAssignees, "\n"))
 
 	// milestone
 	if len(selectables.MilestoneList) != 0 {
@@ -175,3 +181,13 @@ func promptIssueEditProperties(requestCtx stdctx.Context, ctx *context.TeaContex
 
 	return nil
 }
+
+func cleanAssignees(list []*gitea.User) []*gitea.User {
+	out := make([]*gitea.User, 0, len(list))
+	for _, a := range list {
+		if strings.TrimSpace(a.UserName) != "" {
+			out = append(out, a)
+		}
+	}
+	return out
+}

modules/interact/print.go

@@ -5,7 +5,6 @@ package interact
 
 import (
 	"fmt"
-	"os"
 
 	"gitea.dev/tea/modules/theme"
 
@@ -14,7 +13,7 @@ import (
 
 // printTitleAndContent prints a title and content with the gitea theme
 func printTitleAndContent(title, content string) {
-	hasDarkBG := lipgloss.HasDarkBackground(os.Stdin, os.Stdout)
+	hasDarkBG := theme.HasDarkBackground()
 	style := lipgloss.NewStyle().
 		Foreground(theme.GetTheme().Theme(hasDarkBG).Blurred.Title.GetForeground()).Bold(true).
 		Padding(0, 1)

modules/interact/prompts.go

@@ -92,10 +92,26 @@ func promptDatetime(prompt string) (val *time.Time, err error) {
 
 // promptSelect creates a generic multiselect prompt, with processing of custom values.
 func promptMultiSelect(prompt string, options []string, customVal string) ([]string, error) {
+	opts := huh.NewOptions(makeSelectOpts(options, customVal, "")...)
+	return runMultiSelect(prompt, opts, customVal)
+}
+
+// promptMultiSelectWithPreselect creates a generic multiselect prompt with preselected values and processing of custom values.
+func promptMultiSelectWithPreselect(prompt string, selected []string, options []string, customVal string) ([]string, error) {
+	opts := make([]huh.Option[string], 0, len(selected)+len(options)+1)
+	for _, name := range selected {
+		opts = append(opts, huh.NewOption(name, name).Selected(true))
+	}
+	opts = append(opts, huh.NewOptions(makeSelectOpts(options, customVal, "")...)...)
+
+	return runMultiSelect(prompt, opts, customVal)
+}
+
+func runMultiSelect(prompt string, opts []huh.Option[string], customVal string) ([]string, error) {
 	var selection []string
 	if err := huh.NewMultiSelect[string]().
 		Title(prompt).
-		Options(huh.NewOptions(makeSelectOpts(options, customVal, "")...)...).
+		Options(opts...).
 		Value(&selection).
 		WithTheme(theme.GetTheme()).
 		Run(); err != nil {

modules/task/assignees.go

@@ -0,0 +1,49 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package task
+
+import (
+	stdctx "context"
+	"fmt"
+	"strings"
+
+	gitea "gitea.dev/sdk"
+)
+
+// ResolveAssigneeOpts resolves assignee names to IssueAssigneesOption. Returns nil if names is empty.
+func ResolveAssigneeOpts(names []string) *gitea.IssueAssigneesOption {
+	names = cleanAssignees(names)
+	if len(names) == 0 {
+		return nil
+	}
+
+	return &gitea.IssueAssigneesOption{Assignees: names}
+}
+
+// ApplyAssigneeChanges adds and removes assignees on an issue or pull request.
+func ApplyAssigneeChanges(requestCtx stdctx.Context, client *gitea.Client, owner, repo string, index int64, add, rm *gitea.IssueAssigneesOption) error {
+	if rm != nil {
+		_, _, err := client.Issues.DeleteIssueAssignees(requestCtx, owner, repo, index, *rm)
+		if err != nil {
+			return fmt.Errorf("could not remove assignees: %s", err)
+		}
+	}
+	if add != nil {
+		_, _, err := client.Issues.AddIssueAssignees(requestCtx, owner, repo, index, *add)
+		if err != nil {
+			return fmt.Errorf("could not add assignees: %s", err)
+		}
+	}
+	return nil
+}
+
+func cleanAssignees(list []string) []string {
+	out := make([]string, 0, len(list))
+	for _, a := range list {
+		if strings.TrimSpace(a) != "" {
+			out = append(out, a)
+		}
+	}
+	return out
+}

modules/task/issue_edit.go

@@ -23,23 +23,26 @@ type EditIssueOption struct {
 	Deadline        *time.Time
 	AddLabels       []string
 	RemoveLabels    []string
+	SetAssignees    []string
 	AddAssignees    []string
+	RemoveAssignees []string
 	AddReviewers    []string
 	RemoveReviewers []string
-	// RemoveAssignees []string // NOTE: with the current go-sdk, clearing assignees is not possible.
 }
 
 // Normalizes the options into parameters that can be passed to the sdk.
 // the returned value will be nil, when no change to this part of the issue is requested.
-func (o EditIssueOption) toSdkOptions(requestCtx stdctx.Context, ctx *context.TeaContext, client *gitea.Client) (*gitea.EditIssueOption, *gitea.IssueLabelsOption, *gitea.IssueLabelsOption, error) {
+func (o EditIssueOption) toSdkOptions(requestCtx stdctx.Context, ctx *context.TeaContext, client *gitea.Client) (*gitea.EditIssueOption, *gitea.IssueLabelsOption, *gitea.IssueLabelsOption, *gitea.IssueAssigneesOption, *gitea.IssueAssigneesOption, error) {
 	addLabelOpts, err := ResolveLabelOpts(requestCtx, client, ctx.Owner, ctx.Repo, o.AddLabels)
 	if err != nil {
-		return nil, nil, nil, err
+		return nil, nil, nil, nil, nil, err
 	}
 	rmLabelOpts, err := ResolveLabelOpts(requestCtx, client, ctx.Owner, ctx.Repo, o.RemoveLabels)
 	if err != nil {
-		return nil, nil, nil, err
+		return nil, nil, nil, nil, nil, err
 	}
+	addAssigneeOpts := ResolveAssigneeOpts(o.AddAssignees)
+	rmAssigneeOpts := ResolveAssigneeOpts(o.RemoveAssignees)
 
 	issueOpts := gitea.EditIssueOption{}
 	var issueOptsDirty bool
@@ -58,7 +61,7 @@ func (o EditIssueOption) toSdkOptions(requestCtx stdctx.Context, ctx *context.Te
 	if o.Milestone != nil {
 		id, err := ResolveMilestoneID(requestCtx, client, ctx.Owner, ctx.Repo, *o.Milestone)
 		if err != nil {
-			return nil, nil, nil, err
+			return nil, nil, nil, nil, nil, err
 		}
 		issueOpts.Milestone = gitea.OptionalInt64(id)
 		issueOptsDirty = true
@@ -70,15 +73,16 @@ func (o EditIssueOption) toSdkOptions(requestCtx stdctx.Context, ctx *context.Te
 			issueOpts.RemoveDeadline = gitea.OptionalBool(true)
 		}
 	}
-	if len(o.AddAssignees) != 0 {
-		issueOpts.Assignees = o.AddAssignees
+	o.SetAssignees = cleanAssignees(o.SetAssignees)
+	if len(o.SetAssignees) != 0 {
+		issueOpts.Assignees = o.SetAssignees
 		issueOptsDirty = true
 	}
 
 	if issueOptsDirty {
-		return &issueOpts, addLabelOpts, rmLabelOpts, nil
+		return &issueOpts, addLabelOpts, rmLabelOpts, addAssigneeOpts, rmAssigneeOpts, nil
 	}
-	return nil, addLabelOpts, rmLabelOpts, nil
+	return nil, addLabelOpts, rmLabelOpts, addAssigneeOpts, rmAssigneeOpts, nil
 }
 
 // EditIssue edits an issue and returns the updated issue.
@@ -87,7 +91,7 @@ func EditIssue(requestCtx stdctx.Context, ctx *context.TeaContext, client *gitea
 		client = ctx.Login.Client()
 	}
 
-	issueOpts, addLabelOpts, rmLabelOpts, err := opts.toSdkOptions(requestCtx, ctx, client)
+	issueOpts, addLabelOpts, rmLabelOpts, addAssigneeOpts, rmAssigneeOpts, err := opts.toSdkOptions(requestCtx, ctx, client)
 	if err != nil {
 		return nil, err
 	}
@@ -96,6 +100,10 @@ func EditIssue(requestCtx stdctx.Context, ctx *context.TeaContext, client *gitea
 		return nil, err
 	}
 
+	if err := ApplyAssigneeChanges(requestCtx, client, ctx.Owner, ctx.Repo, opts.Index, addAssigneeOpts, rmAssigneeOpts); err != nil {
+		return nil, err
+	}
+
 	var issue *gitea.Issue
 	if issueOpts != nil {
 		issue, _, err = client.Issues.EditIssue(requestCtx, ctx.Owner, ctx.Repo, opts.Index, *issueOpts)

modules/task/pull_checkout.go

@@ -77,9 +77,9 @@ func doPRFetch(
 	localRemote *local_git.Remote,
 	callback func(string) (string, error),
 ) (string, error) {
+	_ = callback
 	localRemoteName := localRemote.Config().Name
 	localBranchName := pr.Head.Ref
-	// get auth & fetch remote via its configured protocol
 	url, err := localRepo.TeaRemoteURL(localRemoteName)
 	if err != nil {
 		return "", err

modules/task/pull_edit.go

@@ -25,6 +25,8 @@ func EditPull(requestCtx stdctx.Context, ctx *context.TeaContext, client *gitea.
 	if err != nil {
 		return nil, err
 	}
+	addAssigneeOpts := ResolveAssigneeOpts(opts.AddAssignees)
+	rmAssigneeOpts := ResolveAssigneeOpts(opts.RemoveAssignees)
 
 	prOpts := gitea.EditPullRequestOption{}
 	var prOptsDirty bool
@@ -51,8 +53,9 @@ func EditPull(requestCtx stdctx.Context, ctx *context.TeaContext, client *gitea.
 			prOpts.RemoveDeadline = gitea.OptionalBool(true)
 		}
 	}
-	if len(opts.AddAssignees) != 0 {
-		prOpts.Assignees = opts.AddAssignees
+	opts.SetAssignees = cleanAssignees(opts.SetAssignees)
+	if len(opts.SetAssignees) != 0 {
+		prOpts.Assignees = opts.SetAssignees
 		prOptsDirty = true
 	}
 
@@ -60,6 +63,10 @@ func EditPull(requestCtx stdctx.Context, ctx *context.TeaContext, client *gitea.
 		return nil, err
 	}
 
+	if err := ApplyAssigneeChanges(requestCtx, client, ctx.Owner, ctx.Repo, opts.Index, addAssigneeOpts, rmAssigneeOpts); err != nil {
+		return nil, err
+	}
+
 	if err := ApplyReviewerChanges(requestCtx, client, ctx.Owner, ctx.Repo, opts.Index, opts.AddReviewers, opts.RemoveReviewers); err != nil {
 		return nil, err
 	}

modules/task/pull_review_comment.go

@@ -56,6 +56,21 @@ func ResolvePullReviewComment(requestCtx stdctx.Context, ctx *context.TeaContext
 	return nil
 }
 
+// ReplyToPullReviewComment replies to a review comment on a pull request.
+func ReplyToPullReviewComment(requestCtx stdctx.Context, ctx *context.TeaContext, idx, commentID int64, body string) error {
+	c := ctx.Login.Client()
+
+	comment, _, err := c.PullRequests.CreatePullReviewCommentReply(requestCtx, ctx.Owner, ctx.Repo, idx, commentID, gitea.CreatePullReviewCommentReplyOptions{
+		Body: body,
+	})
+	if err != nil {
+		return err
+	}
+
+	fmt.Println(comment.HTMLURL)
+	return nil
+}
+
 // UnresolvePullReviewComment unresolves a review comment
 func UnresolvePullReviewComment(requestCtx stdctx.Context, ctx *context.TeaContext, commentID int64) error {
 	c := ctx.Login.Client()

modules/theme/background.go

@@ -0,0 +1,31 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package theme
+
+import (
+	"os"
+
+	"charm.land/lipgloss/v2"
+	"golang.org/x/term"
+)
+
+// defaultDarkBackground is the background to assume when we cannot detect one. It
+// matches the default lipgloss falls back to.
+const defaultDarkBackground = true
+
+// HasDarkBackground reports whether the terminal has a dark background.
+//
+// It only asks the terminal when stdin and stdout are both terminals. Detection
+// works by writing an escape sequence to the output and waiting for the terminal
+// to answer on the input, and nothing answers when stdio is redirected, so asking
+// means waiting on a reply that never comes. On Windows that wait is unbounded:
+// lipgloss opens the console directly rather than giving up, which is why tea used
+// to hang at start-up under a service or a CI runner.
+func HasDarkBackground() bool {
+	if !term.IsTerminal(int(os.Stdin.Fd())) || !term.IsTerminal(int(os.Stdout.Fd())) {
+		return defaultDarkBackground
+	}
+
+	return lipgloss.HasDarkBackground(os.Stdin, os.Stdout)
+}

modules/theme/theme.go

@@ -6,7 +6,6 @@ package theme
 import (
 	"charm.land/huh/v2"
 	"charm.land/lipgloss/v2"
-	"charm.land/lipgloss/v2/compat"
 )
 
 // TeaTheme implements the huh.Theme interface with tea-cli styling.
@@ -16,7 +15,8 @@ type TeaTheme struct{}
 func (t TeaTheme) Theme(isDark bool) *huh.Styles {
 	theme := huh.ThemeCharm(isDark)
 
-	title := compat.AdaptiveColor{Light: lipgloss.Color("#02BA84"), Dark: lipgloss.Color("#02BF87")}
+	lightDark := lipgloss.LightDark(isDark)
+	title := lightDark(lipgloss.Color("#02BA84"), lipgloss.Color("#02BF87"))
 	theme.Focused.Title = theme.Focused.Title.Foreground(title).Bold(true)
 	theme.Blurred = theme.Focused
 	return theme

modules/theme/theme_test.go

@@ -0,0 +1,64 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package theme
+
+import (
+	"os/exec"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// compatPkg detects the terminal background from package-level vars, so importing
+// it anywhere makes tea query the terminal before main() runs. On Windows that
+// query can block forever when stdio is redirected, which hung every tea command,
+// including tea --version.
+//
+// lipgloss.LightDark covers what we need without the package-level detection, so
+// nothing in tea should depend on compat again.
+const compatPkg = "charm.land/lipgloss/v2/compat"
+
+func TestBinaryDoesNotImportLipglossCompat(t *testing.T) {
+	if _, err := exec.LookPath("go"); err != nil {
+		t.Skip("go is not on PATH")
+	}
+
+	out, err := exec.Command("go", "list", "-deps", "gitea.dev/tea").Output()
+	require.NoError(t, err, "go list -deps")
+
+	imported := slices.Contains(strings.Fields(string(out)), compatPkg)
+	assert.False(t, imported,
+		"%s is back in tea's import graph. It detects the terminal background from "+
+			"package-level vars, so tea queries the terminal before main() runs, and on "+
+			"Windows that hangs at start-up when stdio is redirected.", compatPkg)
+}
+
+// Under go test neither stdin nor stdout is a terminal, so HasDarkBackground must
+// take the default and return, rather than querying and waiting for an answer.
+func TestHasDarkBackgroundDoesNotBlockWithoutTTY(t *testing.T) {
+	done := make(chan bool, 1)
+	go func() {
+		done <- HasDarkBackground()
+	}()
+
+	select {
+	case got := <-done:
+		assert.Equal(t, defaultDarkBackground, got)
+	case <-time.After(5 * time.Second):
+		t.Fatal("HasDarkBackground blocked when stdio is not a terminal")
+	}
+}
+
+// The title color has to come from the isDark we are handed. It used to come from
+// a process-wide value that compat detected at init, which ignored this argument.
+func TestThemeHonorsIsDark(t *testing.T) {
+	dark := GetTheme().Theme(true).Focused.Title.GetForeground()
+	light := GetTheme().Theme(false).Focused.Title.GetForeground()
+
+	assert.NotEqual(t, dark, light, "Theme ignored isDark when picking the title color")
+}

scripts/upload-r2.sh

@@ -0,0 +1,112 @@
+#!/bin/sh
+# Copyright 2026 The Gitea Authors. All rights reserved.
+# SPDX-License-Identifier: MIT
+#
+# upload-r2.sh uploads a single local file to a single object key in a
+# Cloudflare R2 bucket, using curl's built-in AWS SigV4 signer (R2 is
+# S3-API compatible).
+#
+# This is the R2 half of the release process's parallel S3+R2 upload
+# period: goreleaser's `blobs:` pipe still uploads every release
+# artifact to AWS S3, and this script is invoked once per artifact
+# (via a goreleaser `publishers:` entry) to mirror the same artifact
+# into R2. Once the migration away from S3 is complete, the `blobs:`
+# block and the AWS_* secrets can be dropped without touching this
+# script.
+#
+# Usage:
+#   upload-r2.sh <local-file> <remote-key>
+#   upload-r2.sh --check-config
+#
+# The second form only validates that the required environment
+# variables below are set (it does not touch the network or the
+# filesystem beyond that), and is meant to be run as an early
+# preflight step in CI: goreleaser custom publishers run as the very
+# last step of the publish pipeline, so without a preflight check a
+# missing R2_* secret would only be discovered after the Gitea release
+# has already been created and every artifact already uploaded to S3.
+#
+# Required environment variables:
+#   R2_ENDPOINT          Base URL of the R2 endpoint, e.g.
+#                        https://<account>.r2.cloudflarestorage.com
+#   R2_BUCKET            Destination bucket name.
+#   R2_ACCESS_KEY_ID     R2 access key id.
+#   R2_SECRET_ACCESS_KEY R2 secret access key.
+
+set -eu
+
+# check_env validates that all required R2_* environment variables are
+# set and non-empty, printing a single "missing required environment
+# variable(s): ..." message and exiting non-zero otherwise. Used by
+# both the normal upload mode and --check-config, so the validation
+# logic only exists in one place.
+check_env() {
+  missing=""
+
+  if [ -z "${R2_ENDPOINT:-}" ]; then
+    missing="$missing R2_ENDPOINT"
+  fi
+  if [ -z "${R2_BUCKET:-}" ]; then
+    missing="$missing R2_BUCKET"
+  fi
+  if [ -z "${R2_ACCESS_KEY_ID:-}" ]; then
+    missing="$missing R2_ACCESS_KEY_ID"
+  fi
+  if [ -z "${R2_SECRET_ACCESS_KEY:-}" ]; then
+    missing="$missing R2_SECRET_ACCESS_KEY"
+  fi
+
+  if [ -n "$missing" ]; then
+    echo "upload-r2.sh: missing required environment variable(s):$missing" >&2
+    exit 1
+  fi
+}
+
+if [ "$#" -eq 1 ] && [ "$1" = "--check-config" ]; then
+  check_env
+  echo "upload-r2.sh: R2 configuration OK"
+  exit 0
+fi
+
+if [ "$#" -ne 2 ]; then
+  echo "usage: upload-r2.sh <local-file> <remote-key>" >&2
+  echo "       upload-r2.sh --check-config" >&2
+  exit 1
+fi
+
+local_file="$1"
+remote_key="$2"
+
+if [ ! -f "$local_file" ]; then
+  echo "upload-r2.sh: local file not found: $local_file" >&2
+  exit 1
+fi
+
+check_env
+
+# Strip a single trailing slash from the endpoint, if present, so that
+# building the path-style URL below never produces a double slash.
+endpoint="${R2_ENDPOINT%/}"
+url="$endpoint/$R2_BUCKET/$remote_key"
+
+# Credentials are passed to curl through a config file read from
+# stdin rather than as a command-line argument, so they never show up
+# in `ps` output.
+#
+# --fail-with-body (instead of plain --fail) still exits non-zero on
+# HTTP errors, but also prints R2's XML error body, which is where the
+# actual error code lives (SignatureDoesNotMatch, NoSuchBucket,
+# AccessDenied, ...); with plain --fail that body is discarded and the
+# failure is silent. --retry 3 (without --retry-all-errors) still
+# retries the transient cases (5xx, 408, 429, connection failures);
+# --retry-all-errors would additionally retry permanent 4xx responses
+# three times with backoff, which only delays an inevitable failure.
+printf 'user = "%s:%s"\n' "$R2_ACCESS_KEY_ID" "$R2_SECRET_ACCESS_KEY" | curl \
+  --config - \
+  --fail-with-body \
+  --silent \
+  --show-error \
+  --retry 3 \
+  --aws-sigv4 "aws:amz:auto:s3" \
+  --upload-file "$local_file" \
+  "$url"

tests/integration/git_branch_test.go

@@ -0,0 +1,98 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package integration
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	teagit "gitea.dev/tea/modules/git"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestTeaCheckoutRemoteReferenceKeepsWorktreeClean(t *testing.T) {
+	clonePath := setupGitCheckoutTestRepo(t)
+	t.Chdir(clonePath)
+
+	repo, err := teagit.RepoFromPath(clonePath)
+	require.NoError(t, err)
+
+	err = repo.TeaCheckout(teagit.NewRemoteReferenceName("origin", "feature/test-branch"))
+	require.NoError(t, err)
+
+	assert.Empty(t, gitOutput(t, clonePath, "status", "--porcelain"))
+	assert.Equal(t, "HEAD", gitOutput(t, clonePath, "rev-parse", "--abbrev-ref", "HEAD"))
+}
+
+func TestTeaCreateBranchTracksRemoteBranch(t *testing.T) {
+	clonePath := setupGitCheckoutTestRepo(t)
+	t.Chdir(clonePath)
+
+	repo, err := teagit.RepoFromPath(clonePath)
+	require.NoError(t, err)
+
+	err = repo.TeaCreateBranch("pulls/123", "feature/test-branch", "origin")
+	require.NoError(t, err)
+
+	err = repo.TeaCheckout(teagit.NewBranchReferenceName("pulls/123"))
+	require.NoError(t, err)
+
+	assert.Empty(t, gitOutput(t, clonePath, "status", "--porcelain"))
+	assert.Equal(t, "origin", gitOutput(t, clonePath, "config", "--get", "branch.pulls/123.remote"))
+	assert.Equal(t, "refs/heads/feature/test-branch", gitOutput(t, clonePath, "config", "--get", "branch.pulls/123.merge"))
+	assert.Equal(t, "pulls/123", gitOutput(t, clonePath, "rev-parse", "--abbrev-ref", "HEAD"))
+}
+
+func setupGitCheckoutTestRepo(t *testing.T) string {
+	t.Helper()
+
+	tmpDir := t.TempDir()
+	remotePath := filepath.Join(tmpDir, "remote.git")
+	seedPath := filepath.Join(tmpDir, "seed")
+	clonePath := filepath.Join(tmpDir, "clone")
+
+	runGit(t, tmpDir, "init", "--bare", remotePath)
+	runGit(t, tmpDir, "init", seedPath)
+	runGit(t, seedPath, "config", "user.email", "test@example.com")
+	runGit(t, seedPath, "config", "user.name", "Test User")
+
+	require.NoError(t, os.WriteFile(filepath.Join(seedPath, "README.md"), []byte("# Test Repo\n"), 0o644))
+	runGit(t, seedPath, "add", "README.md")
+	runGit(t, seedPath, "commit", "-m", "Initial commit")
+	runGit(t, seedPath, "branch", "-M", "main")
+	runGit(t, seedPath, "remote", "add", "origin", remotePath)
+	runGit(t, seedPath, "push", "-u", "origin", "main")
+
+	runGit(t, seedPath, "checkout", "-b", "feature/test-branch")
+	require.NoError(t, os.WriteFile(filepath.Join(seedPath, "feature.txt"), []byte("feature\n"), 0o644))
+	runGit(t, seedPath, "add", "feature.txt")
+	runGit(t, seedPath, "commit", "-m", "Add feature")
+	runGit(t, seedPath, "push", "-u", "origin", "feature/test-branch")
+
+	runGit(t, tmpDir, "clone", remotePath, clonePath)
+	return clonePath
+}
+
+func runGit(t *testing.T, dir string, args ...string) {
+	t.Helper()
+
+	cmd := exec.Command("git", args...)
+	cmd.Dir = dir
+	output, err := cmd.CombinedOutput()
+	require.NoErrorf(t, err, "git %s failed: %s", strings.Join(args, " "), strings.TrimSpace(string(output)))
+}
+
+func gitOutput(t *testing.T, dir string, args ...string) string {
+	t.Helper()
+
+	cmd := exec.Command("git", args...)
+	cmd.Dir = dir
+	output, err := cmd.CombinedOutput()
+	require.NoErrorf(t, err, "git %s failed: %s", strings.Join(args, " "), strings.TrimSpace(string(output)))
+	return strings.TrimSpace(string(output))
+}

tests/integration/git_repo_test.go

@@ -29,6 +29,8 @@ func TestRepoFromPath_Worktree(t *testing.T) {
 	assert.NoError(t, cmd.Run())
 	cmd = exec.Command("git", "-C", mainRepoPath, "config", "user.name", "Test User")
 	assert.NoError(t, cmd.Run())
+	cmd = exec.Command("git", "-C", mainRepoPath, "config", "commit.gpgsign", "false")
+	assert.NoError(t, cmd.Run())
 
 	cmd = exec.Command("git", "-C", mainRepoPath, "remote", "add", "origin", "https://gitea.com/owner/repo.git")
 	assert.NoError(t, cmd.Run())

tests/integration/pulls_reply_test.go

@@ -0,0 +1,114 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package integration
+
+import (
+	"context"
+	"encoding/base64"
+	"fmt"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"gitea.dev/tea/cmd/pulls"
+
+	gitea "gitea.dev/sdk"
+	"github.com/stretchr/testify/require"
+	"github.com/urfave/cli/v3"
+)
+
+func TestPullsReply(t *testing.T) {
+	login := createIntegrationLogin(t)
+	client := login.Client()
+	timestamp := time.Now().UnixNano()
+	repoName := fmt.Sprintf("tea-pr-reply-%d", timestamp)
+	featureBranch := fmt.Sprintf("reply-test-%d", timestamp)
+	replyBody := fmt.Sprintf("Thanks for the review %d", timestamp)
+
+	repo, _, err := client.Repositories.CreateRepo(t.Context(), gitea.CreateRepoOption{
+		Name:          repoName,
+		AutoInit:      true,
+		DefaultBranch: "main",
+	})
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		if _, delErr := client.Repositories.DeleteRepo(t.Context(), login.User, repoName); delErr != nil {
+			t.Logf("failed to delete integration test repo %q: %v", repoName, delErr)
+		}
+	})
+
+	baseBranch := repo.DefaultBranch
+	if baseBranch == "" {
+		baseBranch = "main"
+	}
+
+	_, _, err = client.Repositories.CreateFile(t.Context(), login.User, repoName, "review.txt", gitea.CreateFileOptions{
+		FileOptions: gitea.FileOptions{
+			Message:       "add review target",
+			BranchName:    baseBranch,
+			NewBranchName: featureBranch,
+		},
+		Content: base64.StdEncoding.EncodeToString([]byte("line for review\n")),
+	})
+	require.NoError(t, err)
+
+	pr, _, err := client.PullRequests.CreatePullRequest(t.Context(), login.User, repoName, gitea.CreatePullRequestOption{
+		Base:  baseBranch,
+		Head:  featureBranch,
+		Title: "Integration test for pr reply",
+		Body:  "Adds a file so we can reply to a review comment.",
+	})
+	require.NoError(t, err)
+
+	review, _, err := client.PullRequests.CreatePullReview(t.Context(), login.User, repoName, pr.Index, gitea.CreatePullReviewOptions{
+		State: gitea.ReviewStateComment,
+		Body:  "Please take another look.",
+		Comments: []gitea.CreatePullReviewComment{{
+			Path:       "review.txt",
+			Body:       "Could you clarify this line?",
+			NewLineNum: 1,
+		}},
+	})
+	require.NoError(t, err)
+
+	comments, _, err := client.PullRequests.ListPullReviewComments(t.Context(), login.User, repoName, pr.Index, review.ID)
+	require.NoError(t, err)
+	require.Len(t, comments, 1)
+
+	pullsCmd := &cli.Command{
+		Name:     "pulls",
+		Commands: []*cli.Command{&pulls.CmdPullsReply},
+	}
+
+	err = pullsCmd.Run(context.Background(), []string{
+		"pulls",
+		"reply",
+		strconv.FormatInt(pr.Index, 10),
+		strconv.FormatInt(comments[0].ID, 10),
+		replyBody,
+		"--login",
+		login.Name,
+		"--repo",
+		repo.FullName,
+	})
+	if err != nil && strings.Contains(err.Error(), "unknown API error: 405") {
+		t.Skip("pull review comment replies are not supported by this integration Gitea instance")
+	}
+	require.NoError(t, err)
+
+	require.Eventually(t, func() bool {
+		reviewComments, _, listErr := client.PullRequests.ListPullReviewComments(t.Context(), login.User, repoName, pr.Index, review.ID)
+		if listErr != nil {
+			t.Logf("failed to list review comments: %v", listErr)
+			return false
+		}
+		for _, reviewComment := range reviewComments {
+			if reviewComment.Body == replyBody && reviewComment.ReviewID == review.ID {
+				return true
+			}
+		}
+		return false
+	}, 10*time.Second, 500*time.Millisecond)
+}

tests/integration/task_issue_test.go

@@ -0,0 +1,131 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package integration
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	gitea "gitea.dev/sdk"
+	"gitea.dev/tea/cmd"
+	"github.com/stretchr/testify/require"
+)
+
+func TestEditIssue_ModifiesAssignees(t *testing.T) {
+	// This test verifies that EditIssue correctly modifies assignees of an issue via set, add, and remove.
+	// It sets up a test repository and organization with known users, then calls EditIssue and checks the results.
+	login := createIntegrationLogin(t)
+	client := login.Client()
+	orgName := fmt.Sprintf("issue-org-%d", time.Now().UnixNano()%1_000_000)
+	orgRepoName := fmt.Sprintf("issue-repo-%d", time.Now().UnixNano()%1_000_000)
+	ctx := context.Background()
+
+	// Clean up any existing test data that might interfere with the test.
+	_, _ = client.Repositories.DeleteRepo(ctx, orgName, orgRepoName)
+	_, _ = client.Organizations.DeleteOrg(ctx, orgName)
+	_, _ = client.Admin.DeleteUser(ctx, "user1")
+	_, _ = client.Admin.DeleteUser(ctx, "user2")
+
+	_, _, err := client.Admin.CreateOrg(ctx, integrationUsername, gitea.CreateOrgOption{Name: orgName})
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		if _, delErr := client.Organizations.DeleteOrg(ctx, orgName); delErr != nil {
+			t.Logf("failed to delete integration test org %q: %v", orgName, delErr)
+		}
+	})
+
+	orgRepo, _, err := client.Repositories.CreateOrgRepo(ctx, orgName, gitea.CreateRepoOption{Name: orgRepoName})
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		if _, delErr := client.Repositories.DeleteRepo(ctx, orgName, orgRepoName); delErr != nil {
+			t.Logf("failed to delete integration test repo %q: %v", orgRepoName, delErr)
+		}
+	})
+
+	user1, _, err := client.Admin.CreateUser(ctx, gitea.CreateUserOption{Username: "user1", Password: "user1!1234", Email: "user1@test.com"})
+	require.NoError(t, err)
+	user2, _, err := client.Admin.CreateUser(ctx, gitea.CreateUserOption{Username: "user2", Password: "user2!1234", Email: "user2@test.com"})
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		_, _ = client.Admin.DeleteUser(ctx, "user1")
+		_, _ = client.Admin.DeleteUser(ctx, "user2")
+	})
+
+	permission := gitea.AccessModeOwner
+	team, _, err := client.Organizations.CreateTeam(ctx, orgName, gitea.CreateTeamOption{Name: "writers", Permission: permission})
+	require.NoError(t, err)
+	_, err = client.Organizations.AddTeamMember(ctx, team.ID, "user1")
+	require.NoError(t, err)
+	_, err = client.Organizations.AddTeamMember(ctx, team.ID, "user2")
+	require.NoError(t, err)
+	_, err = client.Organizations.AddTeamRepository(ctx, team.ID, orgName, orgRepoName)
+	require.NoError(t, err)
+	assigneeValid, _, err := client.Repositories.CheckRepoIssueAssignee(ctx, orgName, orgRepoName, user1.UserName)
+	require.NoError(t, err)
+	require.True(t, assigneeValid)
+	assigneeValid, _, err = client.Repositories.CheckRepoIssueAssignee(ctx, orgName, orgRepoName, user2.UserName)
+	require.NoError(t, err)
+	require.True(t, assigneeValid)
+
+	orgIssue, _, err := client.Issues.CreateIssue(ctx, orgName, orgRepoName, gitea.CreateIssueOption{Title: "issue_integration_test", Assignees: []string{integrationUsername}, Closed: false})
+	require.NoError(t, err)
+	require.Equal(t, integrationUsername, orgIssue.Assignees[0].UserName)
+	curUser, _, err := client.Users.GetMyUserInfo(ctx)
+	require.NoError(t, err)
+
+	getNames := func(issue *gitea.Issue) []string {
+		names := make([]string, len(issue.Assignees))
+		for i, u := range issue.Assignees {
+			names[i] = u.UserName
+		}
+		return names
+	}
+
+	checkAssignees := func(expected []string) {
+		updatedIssue, _, err := client.Issues.GetIssue(ctx, orgName, orgRepoName, orgIssue.Index)
+		require.NoError(t, err)
+		require.ElementsMatch(t, getNames(updatedIssue), expected)
+	}
+
+	app := cmd.App()
+	// test set overwrites add and remove
+	err = app.Run(ctx, []string{"tea", "i", "edit", "1", "--set-assignees", "user1", "--add-assignees", "user2", "--remove-assignees", integrationUsername, "--repo", orgRepo.FullName})
+	require.NoError(t, err)
+	checkAssignees([]string{user1.UserName})
+	err = app.Run(ctx, []string{"tea", "i", "edit", "1", "--set-assignees", "user2," + integrationUsername, "--add-assignees", "user1", "--repo", orgRepo.FullName})
+	require.NoError(t, err)
+	checkAssignees([]string{user2.UserName, curUser.UserName})
+	err = app.Run(ctx, []string{"tea", "i", "edit", "1", "--set-assignees", "user1", "--remove-assignees", integrationUsername, "--repo", orgRepo.FullName})
+	require.NoError(t, err)
+	checkAssignees([]string{user1.UserName})
+
+	// test remove one assignee
+	err = app.Run(ctx, []string{"tea", "i", "edit", "1", "--remove-assignees", "user1", "--repo", orgRepo.FullName})
+	require.NoError(t, err)
+	checkAssignees([]string{})
+
+	// test add multiple assignees and overwrites remove
+	err = app.Run(ctx, []string{"tea", "i", "edit", "1", "--add-assignees", "user1," + integrationUsername, "--remove-assignees", integrationUsername, "--repo", orgRepo.FullName})
+	require.NoError(t, err)
+	checkAssignees([]string{curUser.UserName, user1.UserName})
+
+	// test add one assignee
+	err = app.Run(ctx, []string{"tea", "i", "edit", "1", "--add-assignees", "user2", "--repo", orgRepo.FullName})
+	require.NoError(t, err)
+	checkAssignees([]string{curUser.UserName, user1.UserName, user2.UserName})
+
+	// test remove multiple assignees
+	err = app.Run(ctx, []string{"tea", "i", "edit", "1", "--remove-assignees", "user1,user2," + integrationUsername, "--repo", orgRepo.FullName})
+	require.NoError(t, err)
+	checkAssignees([]string{})
+
+	err = app.Run(ctx, []string{"tea", "i", "edit", "1", "--set-assignees", "user_not_exists"})
+	require.Error(t, err)
+	err = app.Run(ctx, []string{"tea", "i", "edit", "1", "--add-assignees", "user_not_exists"})
+	require.Error(t, err)
+	err = app.Run(ctx, []string{"tea", "i", "edit", "1", "--remove-assignees", "user_not_exists"})
+	require.Error(t, err)
+}

tests/integration/task_labels_test.go

@@ -80,7 +80,7 @@ func TestResolveLabelNames_ReturnsRepoAndOrgLabels(t *testing.T) {
 	runGit("commit", "--allow-empty", "-m", "Initial commit")
 	runGit("push", "-u", "origin", "HEAD:branch-with-labels")
 
-	waitForBranches(t, orgRepo.FullName)
+	waitForBranches(t, orgRepo.FullName, "branch-with-labels")
 	_ = runTeaCommand(
 		t, "pr", "create", "--repo", orgRepo.FullName,
 		"--login", login.Name, "--base", "main", "--head", "branch-with-labels",
@@ -94,7 +94,7 @@ func TestResolveLabelNames_ReturnsRepoAndOrgLabels(t *testing.T) {
 	require.ElementsMatch(t, labels, []*gitea.Label{orgLabel, repoLabel})
 }
 
-func waitForBranches(t *testing.T, repoFullName string) {
+func waitForBranches(t *testing.T, repoFullName string, branchName string) {
 	t.Helper()
 	url := fmt.Sprintf("%s/api/v1/repos/%s/branches", os.Getenv("GITEA_TEA_TEST_URL"), repoFullName)
 
@@ -112,7 +112,7 @@ func waitForBranches(t *testing.T, repoFullName string) {
 				for _, b := range branches {
 					have[b.Name] = true
 				}
-				if have["main"] && have["branch-with-labels"] {
+				if have["main"] && have[branchName] {
 					return
 				}
 			}

tests/integration/task_pull_test.go

@@ -0,0 +1,156 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package integration
+
+import (
+	"context"
+	"fmt"
+	"os/exec"
+	"strings"
+	"testing"
+	"time"
+
+	gitea "gitea.dev/sdk"
+	"gitea.dev/tea/cmd"
+	"github.com/stretchr/testify/require"
+)
+
+func TestEditPull_ModifiesAssignees(t *testing.T) {
+	// This test verifies that EditPull correctly modifies assignees of an pull request via set, add, and remove.
+	// It sets up a test repository and organization with known users, then calls EditPull and checks the results.
+	login := createIntegrationLogin(t)
+	client := login.Client()
+	orgName := fmt.Sprintf("pull-org-%d", time.Now().UnixNano()%1_000_000)
+	orgRepoName := fmt.Sprintf("pull-repo-%d", time.Now().UnixNano()%1_000_000)
+	ctx := context.Background()
+
+	// Clean up any existing test data that might interfere with the test.
+	_, _ = client.Repositories.DeleteRepo(ctx, orgName, orgRepoName)
+	_, _ = client.Organizations.DeleteOrg(ctx, orgName)
+	_, _ = client.Admin.DeleteUser(ctx, "user1")
+	_, _ = client.Admin.DeleteUser(ctx, "user2")
+
+	_, _, err := client.Admin.CreateOrg(ctx, integrationUsername, gitea.CreateOrgOption{Name: orgName})
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		if _, delErr := client.Organizations.DeleteOrg(ctx, orgName); delErr != nil {
+			t.Logf("failed to delete integration test org %q: %v", orgName, delErr)
+		}
+	})
+
+	orgRepo, _, err := client.Repositories.CreateOrgRepo(ctx, orgName, gitea.CreateRepoOption{Name: orgRepoName})
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		if _, delErr := client.Repositories.DeleteRepo(ctx, orgName, orgRepoName); delErr != nil {
+			t.Logf("failed to delete integration test repo %q: %v", orgRepoName, delErr)
+		}
+	})
+
+	user1, _, err := client.Admin.CreateUser(ctx, gitea.CreateUserOption{Username: "user1", Password: "user1!1234", Email: "user1@test.com"})
+	require.NoError(t, err)
+	user2, _, err := client.Admin.CreateUser(ctx, gitea.CreateUserOption{Username: "user2", Password: "user2!1234", Email: "user2@test.com"})
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		_, _ = client.Admin.DeleteUser(ctx, "user1")
+		_, _ = client.Admin.DeleteUser(ctx, "user2")
+	})
+
+	permission := gitea.AccessModeOwner
+	team, _, err := client.Organizations.CreateTeam(ctx, orgName, gitea.CreateTeamOption{Name: "writers", Permission: permission})
+	require.NoError(t, err)
+	_, err = client.Organizations.AddTeamMember(ctx, team.ID, "user1")
+	require.NoError(t, err)
+	_, err = client.Organizations.AddTeamMember(ctx, team.ID, "user2")
+	require.NoError(t, err)
+	_, err = client.Organizations.AddTeamRepository(ctx, team.ID, orgName, orgRepoName)
+	require.NoError(t, err)
+	assigneeValid, _, err := client.Repositories.CheckRepoIssueAssignee(ctx, orgName, orgRepoName, user1.UserName)
+	require.NoError(t, err)
+	require.True(t, assigneeValid)
+	assigneeValid, _, err = client.Repositories.CheckRepoIssueAssignee(ctx, orgName, orgRepoName, user2.UserName)
+	require.NoError(t, err)
+	require.True(t, assigneeValid)
+
+	tmpDir := t.TempDir()
+	runGit := func(args ...string) {
+		cmd := exec.Command("git", args...)
+		cmd.Dir = tmpDir
+		require.NoError(t, cmd.Run())
+	}
+
+	runGit("init")
+	runGit("config", "user.email", "test@test.com")
+	runGit("config", "user.name", "test")
+	httpsURL := fmt.Sprintf("%s/%s.git", login.URL, orgRepo.FullName)
+	httpsURL = strings.Replace(httpsURL, "://", fmt.Sprintf("://%s:%s@", login.Name, login.Token), 1)
+
+	runGit("remote", "add", "origin", httpsURL)
+
+	runGit("checkout", "-b", "main")
+	runGit("commit", "--allow-empty", "-m", "Initial commit")
+	runGit("push", "-u", "origin", "HEAD:main")
+
+	runGit("checkout", "-b", "branch-with-assignees")
+	runGit("commit", "--allow-empty", "-m", "Initial commit")
+	runGit("push", "-u", "origin", "HEAD:branch-with-assignees")
+
+	waitForBranches(t, orgRepo.FullName, "branch-with-assignees")
+	getNames := func(pr *gitea.PullRequest) []string {
+		names := make([]string, len(pr.Assignees))
+		for i, u := range pr.Assignees {
+			names[i] = u.UserName
+		}
+		return names
+	}
+	checkAssignees := func(expected []string) {
+		updatedPr, _, err := client.PullRequests.GetPullRequest(ctx, orgName, orgRepoName, 1)
+		require.NoError(t, err)
+		require.ElementsMatch(t, getNames(updatedPr), expected)
+	}
+
+	app := cmd.App()
+	err = app.Run(ctx, []string{"tea", "pr", "create", "--repo", orgRepo.FullName, "--base", "main", "--head", "branch-with-assignees", "--a", integrationUsername})
+	require.NoError(t, err)
+	checkAssignees([]string{integrationUsername})
+	curUser, _, err := client.Users.GetMyUserInfo(ctx)
+	require.NoError(t, err)
+
+	// test set overwrites add and remove
+	err = app.Run(ctx, []string{"tea", "pr", "edit", "1", "--set-assignees", "user1", "--add-assignees", "user2", "--remove-assignees", integrationUsername, "--repo", orgRepo.FullName})
+	require.NoError(t, err)
+	checkAssignees([]string{user1.UserName})
+	err = app.Run(ctx, []string{"tea", "pr", "edit", "1", "--set-assignees", "user2," + integrationUsername, "--add-assignees", "user1", "--repo", orgRepo.FullName})
+	require.NoError(t, err)
+	checkAssignees([]string{user2.UserName, curUser.UserName})
+	err = app.Run(ctx, []string{"tea", "pr", "edit", "1", "--set-assignees", "user1", "--remove-assignees", integrationUsername, "--repo", orgRepo.FullName})
+	require.NoError(t, err)
+	checkAssignees([]string{user1.UserName})
+
+	// test remove one assignee
+	err = app.Run(ctx, []string{"tea", "pr", "edit", "1", "--remove-assignees", "user1", "--repo", orgRepo.FullName})
+	require.NoError(t, err)
+	checkAssignees([]string{})
+
+	// test add multiple assignees and overwrites remove
+	err = app.Run(ctx, []string{"tea", "pr", "edit", "1", "--add-assignees", "user1," + integrationUsername, "--remove-assignees", integrationUsername, "--repo", orgRepo.FullName})
+	require.NoError(t, err)
+	checkAssignees([]string{curUser.UserName, user1.UserName})
+
+	// test add one assignee
+	err = app.Run(ctx, []string{"tea", "pr", "edit", "1", "--add-assignees", "user2", "--repo", orgRepo.FullName})
+	require.NoError(t, err)
+	checkAssignees([]string{curUser.UserName, user1.UserName, user2.UserName})
+
+	// test remove multiple assignees
+	err = app.Run(ctx, []string{"tea", "pr", "edit", "1", "--remove-assignees", "user1,user2," + integrationUsername, "--repo", orgRepo.FullName})
+	require.NoError(t, err)
+	checkAssignees([]string{})
+
+	err = app.Run(ctx, []string{"tea", "pr", "edit", "1", "--set-assignees", "user_not_exists"})
+	require.Error(t, err)
+	err = app.Run(ctx, []string{"tea", "pr", "edit", "1", "--add-assignees", "user_not_exists"})
+	require.Error(t, err)
+	err = app.Run(ctx, []string{"tea", "pr", "edit", "1", "--remove-assignees", "user_not_exists"})
+	require.Error(t, err)
+}