fix: persist Gitea credentials across AI sessions

tests/test_credential_probe.py

@@ -0,0 +1,41 @@
+import importlib.util
+from pathlib import Path
+import unittest
+from unittest.mock import patch
+from urllib.error import HTTPError
+
+SCRIPT = Path(__file__).resolve().parents[1] / "skills" / "updating-gitea-repositories" / "scripts" / "credential_probe.py"
+spec = importlib.util.spec_from_file_location("credential_probe", SCRIPT)
+credential_probe = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(credential_probe)
+
+
+class ProbeTests(unittest.TestCase):
+    def test_rejects_different_or_credential_bearing_remote(self):
+        for remote in ("https://other.invalid/a/b.git", "https://user:fake-secret@gitea.invalid/a/b.git", "https://gitea.invalid/a/b.git?token=fake-secret"):
+            with self.subTest(case=remote.split("@")[0]):
+                with self.assertRaises(credential_probe.ProbeError):
+                    credential_probe.git_read_url("https://gitea.invalid", remote)
+
+    def test_redirect_is_not_followed(self):
+        handler = credential_probe.NoRedirect()
+        self.assertIsNone(handler.redirect_request(None, None, 302, "", {}, "https://other.invalid"))
+
+    def test_unauthorized_is_reported_without_credentials(self):
+        class RejectingOpener:
+            def open(self, request, timeout):
+                raise HTTPError(request.full_url, 401, "unauthorized", {}, None)
+        result = credential_probe.check_requests("https://gitea.invalid", "fictional-alice", b"fictional-secret", "https://gitea.invalid/team/repo.git", RejectingOpener())
+        self.assertEqual(result, ("http_401", "http_401"))
+        self.assertNotIn("fictional-secret", str(result))
+
+    def test_different_account_is_rejected_before_network(self):
+        class Helper:
+            def get(self, request):
+                return {"username": b"different", "password": b"fictional-secret"}
+        with self.assertRaises(credential_probe.ProbeError):
+            credential_probe.load_credential("https://gitea.invalid", "fictional-alice", Helper())
+
+
+if __name__ == "__main__":
+    unittest.main()