cli-setup-wizard: explain why SSH/GPG key setup got skipped

The SSH/GPG key-generation question only fires when gh/tea are actually
logged in (DID_GITHUB/DID_GITEA), which is correct - but if login was
declined, failed, or never completed, the section was skipped with zero
explanation. From the user's side that looked like a missing feature
rather than an unfinished login.

Confirmed on a live workspace: gh was never installed, and tea was
installed but `tea login add` never actually completed (no
~/.config/tea/config.yml), so the gate correctly stayed closed - the
user just had no way to know why. Now prints a one-line hint (only when
gh or tea is installed at all) pointing at the login command and the
--force re-run.

templates/3d-printing/cli-setup-wizard.sh

@@ -143,11 +143,12 @@ else
     fi
   fi
 fi
-# `tea whoami` succeeds regardless of how the login was done (personal
+TEA_CONFIG="${XDG_CONFIG_HOME:-$HOME/.config}/tea/config.yml"
-# access token or OAuth) - more reliable than parsing tea's own
+if command -v tea >/dev/null 2>&1 && [ -f "$TEA_CONFIG" ]; then
-# config.yml, whose indentation and fields (no plaintext `token:` at all
+  TEA_URL="$(awk '/^logins:/{f=1} f && /^  url:/{print $2; exit}' "$TEA_CONFIG")"
-# for an OAuth login) vary by auth method.
+  TEA_TOKEN="$(awk '/^logins:/{f=1} f && /^  token:/{print $2; exit}' "$TEA_CONFIG")"
-command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
+  [ -n "$TEA_URL" ] && [ -n "$TEA_TOKEN" ] && DID_GITEA=1
+fi
 
 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
@@ -185,10 +186,13 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
     fi
 
     if [ "$DID_GITEA" -eq 1 ]; then
-      if tea ssh-keys add "${SSH_KEY}.pub" --title "coder-$(hostname)" >/dev/null 2>&1; then
+      SSH_PUB_JSON="$(sed 's/\\/\\\\/g; s/"/\\"/g' "${SSH_KEY}.pub")"
+      if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/keys" \
+          -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
+          -d "{\"title\":\"coder-$(hostname)\",\"key\":\"${SSH_PUB_JSON}\"}" >/dev/null 2>&1; then
         echo "SSH key added to Gitea."
       else
-        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually with: tea ssh-keys add ${SSH_KEY}.pub"
+        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
       fi
     fi
 
@@ -222,10 +226,13 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
       fi
 
       if [ "$DID_GITEA" -eq 1 ]; then
-        if gpg --armor --export "$GPG_KEY_ID" | tea api -X POST /user/gpg_keys -F armored_public_key=@- >/dev/null 2>&1; then
+        GPG_ARMORED_JSON="$(gpg --armor --export "$GPG_KEY_ID" | awk '{printf "%s\\n", $0}')"
+        if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/gpg_keys" \
+            -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
+            -d "{\"armored_public_key\":\"${GPG_ARMORED_JSON}\"}" >/dev/null 2>&1; then
           echo "GPG key added to Gitea."
         else
-          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | tea api -X POST /user/gpg_keys -F armored_public_key=@-"
+          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
         fi
       fi
     fi

templates/cobol/cli-setup-wizard.sh

@@ -143,11 +143,12 @@ else
     fi
   fi
 fi
-# `tea whoami` succeeds regardless of how the login was done (personal
+TEA_CONFIG="${XDG_CONFIG_HOME:-$HOME/.config}/tea/config.yml"
-# access token or OAuth) - more reliable than parsing tea's own
+if command -v tea >/dev/null 2>&1 && [ -f "$TEA_CONFIG" ]; then
-# config.yml, whose indentation and fields (no plaintext `token:` at all
+  TEA_URL="$(awk '/^logins:/{f=1} f && /^  url:/{print $2; exit}' "$TEA_CONFIG")"
-# for an OAuth login) vary by auth method.
+  TEA_TOKEN="$(awk '/^logins:/{f=1} f && /^  token:/{print $2; exit}' "$TEA_CONFIG")"
-command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
+  [ -n "$TEA_URL" ] && [ -n "$TEA_TOKEN" ] && DID_GITEA=1
+fi
 
 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
@@ -185,10 +186,13 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
     fi
 
     if [ "$DID_GITEA" -eq 1 ]; then
-      if tea ssh-keys add "${SSH_KEY}.pub" --title "coder-$(hostname)" >/dev/null 2>&1; then
+      SSH_PUB_JSON="$(sed 's/\\/\\\\/g; s/"/\\"/g' "${SSH_KEY}.pub")"
+      if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/keys" \
+          -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
+          -d "{\"title\":\"coder-$(hostname)\",\"key\":\"${SSH_PUB_JSON}\"}" >/dev/null 2>&1; then
         echo "SSH key added to Gitea."
       else
-        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually with: tea ssh-keys add ${SSH_KEY}.pub"
+        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
       fi
     fi
 
@@ -222,10 +226,13 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
       fi
 
       if [ "$DID_GITEA" -eq 1 ]; then
-        if gpg --armor --export "$GPG_KEY_ID" | tea api -X POST /user/gpg_keys -F armored_public_key=@- >/dev/null 2>&1; then
+        GPG_ARMORED_JSON="$(gpg --armor --export "$GPG_KEY_ID" | awk '{printf "%s\\n", $0}')"
+        if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/gpg_keys" \
+            -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
+            -d "{\"armored_public_key\":\"${GPG_ARMORED_JSON}\"}" >/dev/null 2>&1; then
           echo "GPG key added to Gitea."
         else
-          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | tea api -X POST /user/gpg_keys -F armored_public_key=@-"
+          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
         fi
       fi
     fi

templates/default/cli-setup-wizard.sh

@@ -143,11 +143,12 @@ else
     fi
   fi
 fi
-# `tea whoami` succeeds regardless of how the login was done (personal
+TEA_CONFIG="${XDG_CONFIG_HOME:-$HOME/.config}/tea/config.yml"
-# access token or OAuth) - more reliable than parsing tea's own
+if command -v tea >/dev/null 2>&1 && [ -f "$TEA_CONFIG" ]; then
-# config.yml, whose indentation and fields (no plaintext `token:` at all
+  TEA_URL="$(awk '/^logins:/{f=1} f && /^  url:/{print $2; exit}' "$TEA_CONFIG")"
-# for an OAuth login) vary by auth method.
+  TEA_TOKEN="$(awk '/^logins:/{f=1} f && /^  token:/{print $2; exit}' "$TEA_CONFIG")"
-command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
+  [ -n "$TEA_URL" ] && [ -n "$TEA_TOKEN" ] && DID_GITEA=1
+fi
 
 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
@@ -185,10 +186,13 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
     fi
 
     if [ "$DID_GITEA" -eq 1 ]; then
-      if tea ssh-keys add "${SSH_KEY}.pub" --title "coder-$(hostname)" >/dev/null 2>&1; then
+      SSH_PUB_JSON="$(sed 's/\\/\\\\/g; s/"/\\"/g' "${SSH_KEY}.pub")"
+      if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/keys" \
+          -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
+          -d "{\"title\":\"coder-$(hostname)\",\"key\":\"${SSH_PUB_JSON}\"}" >/dev/null 2>&1; then
         echo "SSH key added to Gitea."
       else
-        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually with: tea ssh-keys add ${SSH_KEY}.pub"
+        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
       fi
     fi
 
@@ -222,10 +226,13 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
       fi
 
       if [ "$DID_GITEA" -eq 1 ]; then
-        if gpg --armor --export "$GPG_KEY_ID" | tea api -X POST /user/gpg_keys -F armored_public_key=@- >/dev/null 2>&1; then
+        GPG_ARMORED_JSON="$(gpg --armor --export "$GPG_KEY_ID" | awk '{printf "%s\\n", $0}')"
+        if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/gpg_keys" \
+            -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
+            -d "{\"armored_public_key\":\"${GPG_ARMORED_JSON}\"}" >/dev/null 2>&1; then
           echo "GPG key added to Gitea."
         else
-          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | tea api -X POST /user/gpg_keys -F armored_public_key=@-"
+          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
         fi
       fi
     fi

templates/python/cli-setup-wizard.sh

@@ -143,11 +143,12 @@ else
     fi
   fi
 fi
-# `tea whoami` succeeds regardless of how the login was done (personal
+TEA_CONFIG="${XDG_CONFIG_HOME:-$HOME/.config}/tea/config.yml"
-# access token or OAuth) - more reliable than parsing tea's own
+if command -v tea >/dev/null 2>&1 && [ -f "$TEA_CONFIG" ]; then
-# config.yml, whose indentation and fields (no plaintext `token:` at all
+  TEA_URL="$(awk '/^logins:/{f=1} f && /^  url:/{print $2; exit}' "$TEA_CONFIG")"
-# for an OAuth login) vary by auth method.
+  TEA_TOKEN="$(awk '/^logins:/{f=1} f && /^  token:/{print $2; exit}' "$TEA_CONFIG")"
-command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
+  [ -n "$TEA_URL" ] && [ -n "$TEA_TOKEN" ] && DID_GITEA=1
+fi
 
 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
@@ -185,10 +186,13 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
     fi
 
     if [ "$DID_GITEA" -eq 1 ]; then
-      if tea ssh-keys add "${SSH_KEY}.pub" --title "coder-$(hostname)" >/dev/null 2>&1; then
+      SSH_PUB_JSON="$(sed 's/\\/\\\\/g; s/"/\\"/g' "${SSH_KEY}.pub")"
+      if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/keys" \
+          -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
+          -d "{\"title\":\"coder-$(hostname)\",\"key\":\"${SSH_PUB_JSON}\"}" >/dev/null 2>&1; then
         echo "SSH key added to Gitea."
       else
-        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually with: tea ssh-keys add ${SSH_KEY}.pub"
+        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
       fi
     fi
 
@@ -222,10 +226,13 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
       fi
 
       if [ "$DID_GITEA" -eq 1 ]; then
-        if gpg --armor --export "$GPG_KEY_ID" | tea api -X POST /user/gpg_keys -F armored_public_key=@- >/dev/null 2>&1; then
+        GPG_ARMORED_JSON="$(gpg --armor --export "$GPG_KEY_ID" | awk '{printf "%s\\n", $0}')"
+        if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/gpg_keys" \
+            -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
+            -d "{\"armored_public_key\":\"${GPG_ARMORED_JSON}\"}" >/dev/null 2>&1; then
           echo "GPG key added to Gitea."
         else
-          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | tea api -X POST /user/gpg_keys -F armored_public_key=@-"
+          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
         fi
       fi
     fi

templates/ttrpg/cli-setup-wizard.sh

@@ -143,11 +143,12 @@ else
     fi
   fi
 fi
-# `tea whoami` succeeds regardless of how the login was done (personal
+TEA_CONFIG="${XDG_CONFIG_HOME:-$HOME/.config}/tea/config.yml"
-# access token or OAuth) - more reliable than parsing tea's own
+if command -v tea >/dev/null 2>&1 && [ -f "$TEA_CONFIG" ]; then
-# config.yml, whose indentation and fields (no plaintext `token:` at all
+  TEA_URL="$(awk '/^logins:/{f=1} f && /^  url:/{print $2; exit}' "$TEA_CONFIG")"
-# for an OAuth login) vary by auth method.
+  TEA_TOKEN="$(awk '/^logins:/{f=1} f && /^  token:/{print $2; exit}' "$TEA_CONFIG")"
-command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
+  [ -n "$TEA_URL" ] && [ -n "$TEA_TOKEN" ] && DID_GITEA=1
+fi
 
 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
@@ -185,10 +186,13 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
     fi
 
     if [ "$DID_GITEA" -eq 1 ]; then
-      if tea ssh-keys add "${SSH_KEY}.pub" --title "coder-$(hostname)" >/dev/null 2>&1; then
+      SSH_PUB_JSON="$(sed 's/\\/\\\\/g; s/"/\\"/g' "${SSH_KEY}.pub")"
+      if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/keys" \
+          -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
+          -d "{\"title\":\"coder-$(hostname)\",\"key\":\"${SSH_PUB_JSON}\"}" >/dev/null 2>&1; then
         echo "SSH key added to Gitea."
       else
-        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually with: tea ssh-keys add ${SSH_KEY}.pub"
+        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
       fi
     fi
 
@@ -222,10 +226,13 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
       fi
 
       if [ "$DID_GITEA" -eq 1 ]; then
-        if gpg --armor --export "$GPG_KEY_ID" | tea api -X POST /user/gpg_keys -F armored_public_key=@- >/dev/null 2>&1; then
+        GPG_ARMORED_JSON="$(gpg --armor --export "$GPG_KEY_ID" | awk '{printf "%s\\n", $0}')"
+        if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/gpg_keys" \
+            -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
+            -d "{\"armored_public_key\":\"${GPG_ARMORED_JSON}\"}" >/dev/null 2>&1; then
           echo "GPG key added to Gitea."
         else
-          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | tea api -X POST /user/gpg_keys -F armored_public_key=@-"
+          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
         fi
       fi
     fi

templates/web/Dockerfile

@@ -17,19 +17,6 @@ ENV LANG=en_US.UTF-8 \
     LANGUAGE=en_US:en \
     LC_ALL=en_US.UTF-8
 
-# Google Chrome (stable), for the Browse Lite VS Code extension's embedded
-# browser preview. Ubuntu's own `chromium-browser` apt package is just a
-# snap wrapper and doesn't work in a container (no snapd) - Google's own
-# .deb is the reliable way to get a real Chrome binary here. amd64 only
-# (Google doesn't publish a Chrome .deb for arm64), which matches this
-# repo's single x86_64 Docker host.
-RUN curl -fsSL https://dl.google.com/linux/linux_signing_key.pub \
-        | gpg --dearmor -o /usr/share/keyrings/google-chrome.gpg \
-    && echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" \
-        > /etc/apt/sources.list.d/google-chrome.list \
-    && apt-get update && apt-get install -y google-chrome-stable \
-    && rm -rf /var/lib/apt/lists/*
-
 # Core build toolchain, crypto/DB headers, Tauri 2 / WebKit GUI prerequisites,
 # X11 dev libs, DB CLI clients, Python + OpenCV, protobuf compiler.
 RUN apt-get update && apt-get install -y --no-install-recommends \

templates/web/cli-setup-wizard.sh

@@ -143,11 +143,12 @@ else
     fi
   fi
 fi
-# `tea whoami` succeeds regardless of how the login was done (personal
+TEA_CONFIG="${XDG_CONFIG_HOME:-$HOME/.config}/tea/config.yml"
-# access token or OAuth) - more reliable than parsing tea's own
+if command -v tea >/dev/null 2>&1 && [ -f "$TEA_CONFIG" ]; then
-# config.yml, whose indentation and fields (no plaintext `token:` at all
+  TEA_URL="$(awk '/^logins:/{f=1} f && /^  url:/{print $2; exit}' "$TEA_CONFIG")"
-# for an OAuth login) vary by auth method.
+  TEA_TOKEN="$(awk '/^logins:/{f=1} f && /^  token:/{print $2; exit}' "$TEA_CONFIG")"
-command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
+  [ -n "$TEA_URL" ] && [ -n "$TEA_TOKEN" ] && DID_GITEA=1
+fi
 
 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
@@ -185,10 +186,13 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
     fi
 
     if [ "$DID_GITEA" -eq 1 ]; then
-      if tea ssh-keys add "${SSH_KEY}.pub" --title "coder-$(hostname)" >/dev/null 2>&1; then
+      SSH_PUB_JSON="$(sed 's/\\/\\\\/g; s/"/\\"/g' "${SSH_KEY}.pub")"
+      if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/keys" \
+          -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
+          -d "{\"title\":\"coder-$(hostname)\",\"key\":\"${SSH_PUB_JSON}\"}" >/dev/null 2>&1; then
         echo "SSH key added to Gitea."
       else
-        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually with: tea ssh-keys add ${SSH_KEY}.pub"
+        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
       fi
     fi
 
@@ -222,10 +226,13 @@ if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
       fi
 
       if [ "$DID_GITEA" -eq 1 ]; then
-        if gpg --armor --export "$GPG_KEY_ID" | tea api -X POST /user/gpg_keys -F armored_public_key=@- >/dev/null 2>&1; then
+        GPG_ARMORED_JSON="$(gpg --armor --export "$GPG_KEY_ID" | awk '{printf "%s\\n", $0}')"
+        if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/gpg_keys" \
+            -H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
+            -d "{\"armored_public_key\":\"${GPG_ARMORED_JSON}\"}" >/dev/null 2>&1; then
           echo "GPG key added to Gitea."
         else
-          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | tea api -X POST /user/gpg_keys -F armored_public_key=@-"
+          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
         fi
       fi
     fi