release.sh: read the Forgejo token from ../../.forgejo-token when FORGEJO_TOKEN isn't set

A catch-all command listener stops it before any handler, so CSS's
missing-permission message isn't sent either.

AdminStealth.cs

@@ -23,7 +23,7 @@ namespace AdminStealth;
 public class AdminStealth : BasePlugin
 {
     public override string ModuleName => "AdminStealth";
-    public override string ModuleVersion => "0.3.14";
+    public override string ModuleVersion => "0.3.15";
     public override string ModuleAuthor => "astra";
     public override string ModuleDescription => "Makes CS2-SimpleAdmin's css_hide look like leaving, and keeps it";
 
@@ -66,6 +66,9 @@ public class AdminStealth : BasePlugin
         // without ever calling us.
         foreach (var alias in _hideAliases)
             AddCommandListener(alias, (player, command) => OnHideTyped(player, command));
+        // Players who may not hide get no reply at all, not even CSS's missing-permission one. Only
+        // a catch-all listener runs before every plugin's command handler, for console and chat.
+        AddCommandListener(null, OnAnyCommand);
         // Joining any team, spectators included, would make SimpleAdmin unhide them.
         AddCommandListener("jointeam", (player, command) => OnJoinTeam(player, command));
         AddCommandListener("spectate", (player, command) => OnJoinTeam(player, command));
@@ -123,6 +126,14 @@ public class AdminStealth : BasePlugin
         return player == null ? HookResult.Continue : HookResult.Stop;
     }
 
+    private HookResult OnAnyCommand(CCSPlayerController? player, CommandInfo command)
+    {
+        if (player is not { IsValid: true, IsBot: false } ||
+            !_hideAliases.Contains(command.GetArg(0), StringComparer.OrdinalIgnoreCase) || CanHide(player))
+            return HookResult.Continue;
+        return HookResult.Stop;
+    }
+
     private HookResult OnHideTyped(CCSPlayerController? player, CommandInfo command)
     {
         if (player is { IsValid: true } && !_restoring.Contains(player.Slot))

README.md

@@ -24,6 +24,8 @@ admin off the scoreboard. This plugin makes it look like they left the server:
   does (with `sv_disable_teamselect_menu` on around it), which closes it. The team events aren't
   broadcast; for about 0.15 s they're on the spectator list of anyone looking at the scoreboard.
 - Restoring runs `css_hide` at most once: it toggles, so a second run could unhide them.
+- Players who may not use `css_hide` (or its aliases) get no reply at all when they try it, from
+  console or chat: not even CSS's missing-permission message.
 
 Needs our SimpleAdmin fork (1.8.2b-zio2 or later), where moving to spectators doesn't unhide a
 hidden admin. Never hot-reload CS2-SimpleAdmin while this runs: CSS keeps handing out the old

release.sh

@@ -19,8 +19,13 @@ set -euo pipefail
 FORGEJO_URL="https://git.zio.sh"
 OWNER="cs2"
 REPO="AdminStealth"
-# Placeholder - replace, or set FORGEJO_TOKEN in the environment instead. Needs write:repository.
-# Only uploading needs it; downloading from the public repo doesn't. Don't commit a real token.
+# Needs write:repository. Only uploading needs it; downloading from the public repo doesn't. From the
+# environment, or else from .forgejo-token in the cs2/ folder above every plugin (outside their
+# repos, mode 600). Don't commit a real token.
+TOKEN_FILE="$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")/../../.forgejo-token"
+if [[ -z "${FORGEJO_TOKEN:-}" && -r "$TOKEN_FILE" ]]; then
+    FORGEJO_TOKEN="$(tr -d '[:space:]' < "$TOKEN_FILE")"
+fi
 FORGEJO_TOKEN="${FORGEJO_TOKEN:-CHANGE_ME_FORGEJO_TOKEN}"
 
 # Only these ship from the publish output. CounterStrikeSharp.API.dll is excluded by the csproj
@@ -37,7 +42,7 @@ if [[ -z "$TAG" ]]; then
     exit 1
 fi
 if [[ "$FORGEJO_TOKEN" == "CHANGE_ME_FORGEJO_TOKEN" ]]; then
-    echo "Set FORGEJO_TOKEN (edit release.sh or export it) first." >&2
+    echo "Set FORGEJO_TOKEN (export it, or put it in $TOKEN_FILE) first." >&2
     exit 1
 fi
 for tool in podman jq curl git; do