From 50b5cea2cb311849208a637fbdbbee3afcef3212 Mon Sep 17 00:00:00 2001
From: openhands <openhands@all-hands.dev>
Date: Wed, 25 Mar 2026 13:34:58 +0000
Subject: [PATCH] fix: tea_relabel uses edit subcommand, add sha256 checksum
 for tea binary (#666)

- tea_relabel: use `tea issues edit` instead of `tea issues labels`
  (the latter is the list subcommand and ignores --labels)
- Dockerfile: verify tea binary sha256 after download

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 docker/agents/Dockerfile | 2 ++
 lib/tea-helpers.sh       | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/docker/agents/Dockerfile b/docker/agents/Dockerfile
index 236b4ad..b7641c1 100644
--- a/docker/agents/Dockerfile
+++ b/docker/agents/Dockerfile
@@ -5,7 +5,9 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     && rm -rf /var/lib/apt/lists/*
 
 # tea CLI — official Gitea/Forgejo CLI for issue/label/comment operations
+# Checksum from https://dl.gitea.com/tea/0.9.2/tea-0.9.2-linux-amd64.sha256
 RUN curl -sL https://dl.gitea.com/tea/0.9.2/tea-0.9.2-linux-amd64 -o /usr/local/bin/tea \
+    && echo "be10cdf9a619e3c0f121df874960ed19b53e62d1c7036cf60313a28b5227d54d  /usr/local/bin/tea" | sha256sum -c - \
     && chmod +x /usr/local/bin/tea
 
 # Claude CLI is mounted from the host via docker-compose volume.
diff --git a/lib/tea-helpers.sh b/lib/tea-helpers.sh
index 33b4dfc..0292742 100644
--- a/lib/tea-helpers.sh
+++ b/lib/tea-helpers.sh
@@ -55,7 +55,7 @@ tea_relabel() {
   local IFS=','
   local labels="$*"
 
-  tea issues labels "$issue_num" --login "$TEA_LOGIN" --repo "$FORGE_REPO" \
+  tea issues edit "$issue_num" --login "$TEA_LOGIN" --repo "$FORGE_REPO" \
     --labels "$labels"
 }