feat(skills): Add gitea_pr_review skill for managing PR review comments

Adds a new Claude Code skill that enables reading PR review comments and
posting replies on Gitea/Forgejo instances. Documents both the REST API
approach for reading reviews and the web endpoint approach for thread
replies, with fallback to top-level comments when thread replies aren't
possible due to authentication limitations.

Implements bead: nixos-configs-vru

home/roles/communication/default.nix

@@ -4,7 +4,6 @@ with lib;
 
 let
   cfg = config.home.roles.communication;
-  isLinux = pkgs.stdenv.isLinux;
 in
 {
   options.home.roles.communication = {
@@ -13,14 +12,14 @@ in
 
   config = mkIf cfg.enable {
     home.packages = [
-      # For logging back into google chat (cross-platform)
+      # Communication apps
-      globalInputs.google-cookie-retrieval.packages.${system}.default
-    ] ++ optionals isLinux [
-      # Linux-only communication apps (Electron apps don't build on Darwin)
       pkgs.element-desktop
       # Re-enabled in 25.11 after security issues were resolved
       pkgs.fluffychat
       pkgs.nextcloud-talk-desktop
+      
+      # For logging back into google chat
+      globalInputs.google-cookie-retrieval.packages.${system}.default
     ];
   };
 }

home/roles/desktop/default.nix

@@ -4,7 +4,6 @@ with lib;
 
 let
   cfg = config.home.roles.desktop;
-  isLinux = pkgs.stdenv.isLinux;
 in
 {
   options.home.roles.desktop = {
@@ -13,29 +12,27 @@ in
 
   config = mkIf cfg.enable {
     home.packages = with pkgs; [
-      # Cross-platform desktop applications
+      # Desktop applications
       bitwarden-desktop
-      keepassxc
-      xdg-utils # XDG utilities for opening files/URLs with default applications
-    ] ++ optionals isLinux [
-      # Linux-only desktop applications
       dunst
+      keepassxc
       unstable.ghostty
       
-      # Linux-only desktop utilities
+      # Desktop utilities
       feh # Image viewer and wallpaper setter for X11
       rofi # Application launcher for X11
       solaar # Logitech management software
       waybar
       wofi # Application launcher for Wayland
+      xdg-utils # XDG utilities for opening files/URLs with default applications
       
-      # Linux-only system utilities with GUI components
+      # System utilities with GUI components
       (snapcast.override { pulseaudioSupport = true; })
       
-      # KDE tiling window management (Linux-only)
+      # KDE tiling window management
       kdePackages.krohnkite  # Dynamic tiling extension for KWin 6
       
-      # KDE PIM applications for email, calendar, and contacts (Linux-only)
+      # KDE PIM applications for email, calendar, and contacts
       kdePackages.kmail
       kdePackages.kmail-account-wizard
       kdePackages.kmailtransport
@@ -43,33 +40,33 @@ in
       kdePackages.kaddressbook
       kdePackages.kontact
       
-      # KDE System components needed for proper integration (Linux-only)
+      # KDE System components needed for proper integration
       kdePackages.kded
       kdePackages.systemsettings
       kdePackages.kmenuedit
       
-      # Desktop menu support (Linux-only)
+      # Desktop menu support
       kdePackages.plasma-desktop # Contains applications.menu
       
-      # KDE Online Accounts support (Linux-only)
+      # KDE Online Accounts support
       kdePackages.kaccounts-integration
       kdePackages.kaccounts-providers
       kdePackages.signond
       
-      # KDE Mapping (Linux-only)
+      # KDE Mapping
       kdePackages.marble  # Virtual globe and world atlas
       
-      # KDE Productivity (Linux-only)
+      # KDE Productivity
       kdePackages.kate        # Advanced text editor with syntax highlighting
       kdePackages.okular      # Universal document viewer (PDF, ePub, etc.)
       kdePackages.spectacle   # Screenshot capture utility
       kdePackages.filelight   # Visual disk usage analyzer
       
-      # KDE Multimedia (Linux-only)
+      # KDE Multimedia
       kdePackages.gwenview    # Image viewer and basic editor
       kdePackages.elisa       # Music player
       
-      # KDE System Utilities (Linux-only)
+      # KDE System Utilities  
       kdePackages.ark         # Archive manager (zip, tar, 7z, etc.)
       kdePackages.yakuake     # Drop-down terminal emulator
     ];
@@ -80,56 +77,51 @@ in
 
     programs.spotify-player.enable = true;
 
-    # Linux-only: GNOME keyring service
+    services.gnome-keyring = {
-    services.gnome-keyring = mkIf isLinux {
       enable = true;
     };
 
-    # Linux-only: systemd user services for rbw vault unlock
+    # rbw vault unlock on login and resume from suspend
-    systemd.user.services = mkIf isLinux {
+    systemd.user.services.rbw-unlock-on-login = {
-      # rbw vault unlock on login
+      Unit = {
-      rbw-unlock-on-login = {
+        Description = "Unlock rbw vault at login";
-        Unit = {
+        After = [ "graphical-session.target" ];
-          Description = "Unlock rbw vault at login";
-          After = [ "graphical-session.target" ];
-        };
-        Service = {
-          Type = "oneshot";
-          ExecStart = "${pkgs.rbw}/bin/rbw unlock";
-          Environment = "RBW_AGENT=${pkgs.rbw}/bin/rbw-agent";
-          # KillMode = "process" prevents systemd from killing the rbw-agent daemon
-          # when this oneshot service completes. The agent is spawned by rbw unlock
-          # and needs to persist after the service exits.
-          KillMode = "process";
-        };
-        Install = {
-          WantedBy = [ "graphical-session.target" ];
-        };
       };
-
+      Service = {
-      # rbw vault unlock on resume from suspend
+        Type = "oneshot";
-      rbw-unlock-on-resume = {
+        ExecStart = "${pkgs.rbw}/bin/rbw unlock";
-        Unit = {
+        Environment = "RBW_AGENT=${pkgs.rbw}/bin/rbw-agent";
-          Description = "Unlock rbw vault after resume from suspend";
+        # KillMode = "process" prevents systemd from killing the rbw-agent daemon
-          After = [ "suspend.target" ];
+        # when this oneshot service completes. The agent is spawned by rbw unlock
-        };
+        # and needs to persist after the service exits.
-        Service = {
+        KillMode = "process";
-          Type = "oneshot";
+      };
-          ExecStart = "${pkgs.rbw}/bin/rbw unlock";
+      Install = {
-          Environment = "RBW_AGENT=${pkgs.rbw}/bin/rbw-agent";
+        WantedBy = [ "graphical-session.target" ];
-          # KillMode = "process" prevents systemd from killing the rbw-agent daemon
-          # when this oneshot service completes. The agent is spawned by rbw unlock
-          # and needs to persist after the service exits.
-          KillMode = "process";
-        };
-        Install = {
-          WantedBy = [ "suspend.target" ];
-        };
       };
     };
 
-    # Linux-only: KDE environment variables for proper integration
+    systemd.user.services.rbw-unlock-on-resume = {
-    home.sessionVariables = mkIf isLinux {
+      Unit = {
+        Description = "Unlock rbw vault after resume from suspend";
+        After = [ "suspend.target" ];
+      };
+      Service = {
+        Type = "oneshot";
+        ExecStart = "${pkgs.rbw}/bin/rbw unlock";
+        Environment = "RBW_AGENT=${pkgs.rbw}/bin/rbw-agent";
+        # KillMode = "process" prevents systemd from killing the rbw-agent daemon
+        # when this oneshot service completes. The agent is spawned by rbw unlock
+        # and needs to persist after the service exits.
+        KillMode = "process";
+      };
+      Install = {
+        WantedBy = [ "suspend.target" ];
+      };
+    };
+
+    # KDE environment variables for proper integration
+    home.sessionVariables = {
       QT_QPA_PLATFORMTHEME = "kde";
       KDE_SESSION_VERSION = "6";
     };
@@ -149,14 +141,13 @@ in
           "x-scheme-handler/https" = "firefox.desktop";
         };
         defaultApplications = {
-          # Web browsers (cross-platform)
+          # Web browsers
           "text/html" = "firefox.desktop";
           "x-scheme-handler/http" = "firefox.desktop";
           "x-scheme-handler/https" = "firefox.desktop";
           "x-scheme-handler/about" = "firefox.desktop";
           "x-scheme-handler/unknown" = "firefox.desktop";
-        } // optionalAttrs isLinux {
+          
-          # Linux-only: KDE application associations
           # Documents
           "application/pdf" = "okular.desktop";
           "text/plain" = "kate.desktop";
@@ -199,11 +190,9 @@ in
       };
     };
 
-    # Linux-only: Fix for KDE applications.menu file issue on Plasma 6
+    # Fix for KDE applications.menu file issue on Plasma 6
     # KDE still looks for applications.menu but Plasma 6 renamed it to plasma-applications.menu
-    xdg.configFile."menus/applications.menu" = mkIf isLinux {
+    xdg.configFile."menus/applications.menu".source = "${pkgs.kdePackages.plasma-workspace}/etc/xdg/menus/plasma-applications.menu";
-      source = "${pkgs.kdePackages.plasma-workspace}/etc/xdg/menus/plasma-applications.menu";
-    };
 
     # Note: modules must be imported at top-level home config
   };

home/roles/development/skills/gitea_pr_review.md

@@ -0,0 +1,244 @@
+---
+description: Manage and respond to Gitea/Forgejo PR review comments
+---
+
+# Gitea PR Review Comments
+
+This skill enables reading PR review comments and posting inline thread replies on Gitea/Forgejo instances.
+
+## Prerequisites
+
+- `tea` CLI configured with a Gitea/Forgejo instance
+- Access token from tea config: `~/.config/tea/config.yml`
+- Repository must be a Gitea/Forgejo remote (not GitHub)
+
+## Configuration
+
+Get the Gitea instance URL and token from tea config:
+
+```bash
+# Get the default login URL and token
+yq -r '.logins[] | select(.name == "default") | .url' ~/.config/tea/config.yml
+yq -r '.logins[] | select(.name == "default") | .token' ~/.config/tea/config.yml
+```
+
+Or if you have a specific login name:
+```bash
+yq -r '.logins[] | select(.name == "YOUR_LOGIN") | .url' ~/.config/tea/config.yml
+yq -r '.logins[] | select(.name == "YOUR_LOGIN") | .token' ~/.config/tea/config.yml
+```
+
+## Commands
+
+### 1. List PR Review Comments
+
+Fetch all reviews and their comments for a PR:
+
+```bash
+# Set environment variables
+GITEA_URL="https://git.johnogle.info"
+TOKEN="<your-token>"
+OWNER="<repo-owner>"
+REPO="<repo-name>"
+PR_NUMBER="<pr-number>"
+
+# Get all reviews for the PR
+curl -s -H "Authorization: token $TOKEN" \
+  "$GITEA_URL/api/v1/repos/$OWNER/$REPO/pulls/$PR_NUMBER/reviews" | jq
+
+# Get comments for a specific review
+REVIEW_ID="<review-id>"
+curl -s -H "Authorization: token $TOKEN" \
+  "$GITEA_URL/api/v1/repos/$OWNER/$REPO/pulls/$PR_NUMBER/reviews/$REVIEW_ID/comments" | jq
+```
+
+### 2. View All Review Comments (Combined)
+
+```bash
+# Get all reviews and their comments in one view
+curl -s -H "Authorization: token $TOKEN" \
+  "$GITEA_URL/api/v1/repos/$OWNER/$REPO/pulls/$PR_NUMBER/reviews" | \
+  jq -r '.[] | "Review \(.id) by \(.user.login): \(.state)\n  Body: \(.body)"'
+
+# For each review, show inline comments
+for REVIEW_ID in $(curl -s -H "Authorization: token $TOKEN" \
+  "$GITEA_URL/api/v1/repos/$OWNER/$REPO/pulls/$PR_NUMBER/reviews" | jq -r '.[].id'); do
+  echo "=== Review $REVIEW_ID comments ==="
+  curl -s -H "Authorization: token $TOKEN" \
+    "$GITEA_URL/api/v1/repos/$OWNER/$REPO/pulls/$PR_NUMBER/reviews/$REVIEW_ID/comments" | \
+    jq -r '.[] | "[\(.path):\(.line)] \(.body)"'
+done
+```
+
+### 3. Reply to Review Comments (Web Endpoint Method)
+
+The Gitea REST API does not support replying to review comment threads. The web UI uses a different endpoint:
+
+```
+POST /{owner}/{repo}/pulls/{pr_number}/files/reviews/comments
+Content-Type: multipart/form-data
+```
+
+**Required form fields:**
+- `reply`: Review ID to reply to
+- `content`: The reply message
+- `path`: File path
+- `line`: Line number
+- `side`: `proposed` or `original`
+- `single_review`: `true`
+- `origin`: `timeline`
+- `_csrf`: CSRF token (required for web endpoint)
+
+**Authentication Challenge:**
+This endpoint requires session-based authentication, not API tokens. Options:
+
+#### Option A: Use Browser Session (Recommended)
+
+1. Log in to Gitea in your browser
+2. Open browser developer tools and copy cookies
+3. Use the session cookies with curl
+
+```bash
+# First, get CSRF token from the PR page
+CSRF=$(curl -s -c cookies.txt -b cookies.txt \
+  "$GITEA_URL/$OWNER/$REPO/pulls/$PR_NUMBER/files" | \
+  grep -oP 'name="_csrf" value="\K[^"]+')
+
+# Post the reply
+curl -s -b cookies.txt \
+  -F "reply=$REVIEW_ID" \
+  -F "content=Your reply message here" \
+  -F "path=$FILE_PATH" \
+  -F "line=$LINE_NUMBER" \
+  -F "side=proposed" \
+  -F "single_review=true" \
+  -F "origin=timeline" \
+  -F "_csrf=$CSRF" \
+  "$GITEA_URL/$OWNER/$REPO/pulls/$PR_NUMBER/files/reviews/comments"
+```
+
+#### Option B: Create Top-Level Comment (Fallback)
+
+If thread replies are not critical, use the API to create a top-level comment:
+
+```bash
+# Create a top-level comment mentioning the review context
+curl -s -X POST \
+  -H "Authorization: token $TOKEN" \
+  -H "Content-Type: application/json" \
+  -d "{\"body\": \"Re: @reviewer's comment on $FILE_PATH:$LINE_NUMBER\n\nYour reply here\"}" \
+  "$GITEA_URL/api/v1/repos/$OWNER/$REPO/issues/$PR_NUMBER/comments"
+```
+
+Or use tea CLI:
+```bash
+tea comment $PR_NUMBER "Re: @reviewer's comment on $FILE_PATH:$LINE_NUMBER
+
+Your reply here"
+```
+
+### 4. Submit a New Review
+
+Create a new review with inline comments:
+
+```bash
+curl -s -X POST \
+  -H "Authorization: token $TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "body": "Overall review comments",
+    "event": "COMMENT",
+    "comments": [
+      {
+        "path": "path/to/file.py",
+        "body": "Comment on this line",
+        "new_position": 10
+      }
+    ]
+  }' \
+  "$GITEA_URL/api/v1/repos/$OWNER/$REPO/pulls/$PR_NUMBER/reviews"
+```
+
+Event types: `COMMENT`, `APPROVE`, `REQUEST_CHANGES`
+
+## Workflow Example
+
+### Reading and Responding to Reviews
+
+1. **Set up environment**:
+   ```bash
+   export GITEA_URL=$(yq -r '.logins[] | select(.name == "default") | .url' ~/.config/tea/config.yml)
+   export TOKEN=$(yq -r '.logins[] | select(.name == "default") | .token' ~/.config/tea/config.yml)
+   export OWNER="johno"
+   export REPO="nixos-configs"
+   export PR_NUMBER="5"
+   ```
+
+2. **List all pending review comments**:
+   ```bash
+   # Get reviews
+   curl -s -H "Authorization: token $TOKEN" \
+     "$GITEA_URL/api/v1/repos/$OWNER/$REPO/pulls/$PR_NUMBER/reviews" | \
+     jq -r '.[] | select(.state == "REQUEST_CHANGES" or .state == "COMMENT") |
+       "Review \(.id) by \(.user.login) (\(.state)):\n\(.body)\n"'
+   ```
+
+3. **Get detailed comments for a review**:
+   ```bash
+   REVIEW_ID="2"
+   curl -s -H "Authorization: token $TOKEN" \
+     "$GITEA_URL/api/v1/repos/$OWNER/$REPO/pulls/$PR_NUMBER/reviews/$REVIEW_ID/comments" | \
+     jq -r '.[] | "File: \(.path):\(.line)\nComment: \(.body)\nID: \(.id)\n---"'
+   ```
+
+4. **Respond using top-level comment** (most reliable):
+   ```bash
+   tea comment $PR_NUMBER "Addressing review feedback:
+
+   - File \`path/to/file.py\` line 10: Fixed the issue by...
+   - File \`other/file.py\` line 25: Updated as suggested..."
+   ```
+
+## API Reference
+
+### Endpoints
+
+| Action | Method | Endpoint |
+|--------|--------|----------|
+| List reviews | GET | `/api/v1/repos/{owner}/{repo}/pulls/{index}/reviews` |
+| Get review | GET | `/api/v1/repos/{owner}/{repo}/pulls/{index}/reviews/{id}` |
+| Get review comments | GET | `/api/v1/repos/{owner}/{repo}/pulls/{index}/reviews/{id}/comments` |
+| Create review | POST | `/api/v1/repos/{owner}/{repo}/pulls/{index}/reviews` |
+| Submit review | POST | `/api/v1/repos/{owner}/{repo}/pulls/{index}/reviews/{id}` |
+| Delete review | DELETE | `/api/v1/repos/{owner}/{repo}/pulls/{index}/reviews/{id}` |
+| Create issue comment | POST | `/api/v1/repos/{owner}/{repo}/issues/{index}/comments` |
+
+### Review States
+
+- `PENDING` - Draft review not yet submitted
+- `COMMENT` - General comment without approval/rejection
+- `APPROVE` - Approving the changes
+- `REQUEST_CHANGES` - Requesting changes before merge
+
+## Limitations
+
+1. **Thread replies**: The Gitea REST API does not support replying directly to review comment threads. This is a known limitation. Workarounds:
+   - Use top-level comments with context
+   - Use the web UI manually for thread replies
+   - Implement session-based authentication to use the web endpoint
+
+2. **CSRF tokens**: The web endpoint for thread replies requires CSRF tokens, which expire and need to be fetched from the page.
+
+3. **Session auth**: API tokens work for REST API but not for web endpoints that require session cookies.
+
+## Tips
+
+- Always quote file paths and line numbers when responding via top-level comments
+- Use `tea pr view $PR_NUMBER --comments` to see all comments
+- Use `tea open pulls/$PR_NUMBER` to open the PR in browser for manual thread replies
+- Consider using `tea pr approve $PR_NUMBER` after addressing all comments
+
+## See Also
+
+- Gitea API Documentation: https://docs.gitea.com/api/1.20/
+- `tea` CLI: https://gitea.com/gitea/tea

home/roles/email/default.nix

@@ -4,7 +4,6 @@ with lib;
 
 let
   cfg = config.home.roles.email;
-  isLinux = pkgs.stdenv.isLinux;
 in
 {
   options.home.roles.email = {
@@ -90,38 +89,34 @@ in
       account default : proton
     '';
 
-    # Linux-only: Systemd service for mail sync (Darwin uses launchd instead)
+    # Systemd service for mail sync
-    systemd.user.services = mkIf isLinux {
+    systemd.user.services.mbsync = {
-      mbsync = {
+      Unit = {
-        Unit = {
+        Description = "Mailbox synchronization service";
-          Description = "Mailbox synchronization service";
+        After = [ "network-online.target" ];
-          After = [ "network-online.target" ];
+        Wants = [ "network-online.target" ];
-          Wants = [ "network-online.target" ];
+      };
-        };
+      Service = {
-        Service = {
+        Type = "oneshot";
-          Type = "oneshot";
+        ExecStart = "${pkgs.bash}/bin/bash -c 'mkdir -p ~/Mail && ${pkgs.isync}/bin/mbsync -a && (${pkgs.mu}/bin/mu info >/dev/null 2>&1 || ${pkgs.mu}/bin/mu init --maildir ~/Mail --personal-address=john@ogle.fyi) && ${pkgs.mu}/bin/mu index'";
-          ExecStart = "${pkgs.bash}/bin/bash -c 'mkdir -p ~/Mail && ${pkgs.isync}/bin/mbsync -a && (${pkgs.mu}/bin/mu info >/dev/null 2>&1 || ${pkgs.mu}/bin/mu init --maildir ~/Mail --personal-address=john@ogle.fyi) && ${pkgs.mu}/bin/mu index'";
+        Environment = "PATH=${pkgs.rbw}/bin:${pkgs.coreutils}/bin";
-          Environment = "PATH=${pkgs.rbw}/bin:${pkgs.coreutils}/bin";
+        StandardOutput = "journal";
-          StandardOutput = "journal";
+        StandardError = "journal";
-          StandardError = "journal";
-        };
       };
     };
 
-    # Linux-only: Systemd timer for automatic sync
+    # Systemd timer for automatic sync
-    systemd.user.timers = mkIf isLinux {
+    systemd.user.timers.mbsync = {
-      mbsync = {
+      Unit = {
-        Unit = {
+        Description = "Mailbox synchronization timer";
-          Description = "Mailbox synchronization timer";
+      };
-        };
+      Timer = {
-        Timer = {
+        OnBootSec = "2min";
-          OnBootSec = "2min";
+        OnUnitActiveSec = "5min";
-          OnUnitActiveSec = "5min";
+        Unit = "mbsync.service";
-          Unit = "mbsync.service";
+      };
-        };
+      Install = {
-        Install = {
+        WantedBy = [ "timers.target" ];
-          WantedBy = [ "timers.target" ];
-        };
       };
     };
   };

home/roles/kdeconnect/default.nix

@@ -4,15 +4,13 @@ with lib;
 
 let
   cfg = config.home.roles.kdeconnect;
-  isLinux = pkgs.stdenv.isLinux;
 in
 {
   options.home.roles.kdeconnect = {
     enable = mkEnableOption "Enable KDE Connect for device integration";
   };
 
-  # KDE Connect services are Linux-only (requires D-Bus and systemd)
+  config = mkIf cfg.enable {
-  config = mkIf (cfg.enable && isLinux) {
     services.kdeconnect = {
       enable = true;
       indicator = true;

home/roles/sync/default.nix

@@ -4,7 +4,6 @@ with lib;
 
 let
   cfg = config.home.roles.sync;
-  isLinux = pkgs.stdenv.isLinux;
 in
 {
   options.home.roles.sync = {
@@ -12,10 +11,9 @@ in
   };
 
   config = mkIf cfg.enable {
-    # Linux-only: syncthingtray requires system tray support
+    home.packages = with pkgs; [
-    home.packages = optionals isLinux (with pkgs; [
       syncthingtray
-    ]);
+    ];
 
     services.syncthing = {
       enable = true;