still_active 3.1.0 → 3.2.0

data/lib/still_active/github_client.rb

@@ -2,6 +2,7 @@
 
 require "time"
 require "octokit"
+require_relative "errors"
 
 module StillActive
   # Repo signals (archived?, last commit date) for github.com-hosted gems.
@@ -20,19 +21,37 @@ module StillActive
     # object's pushed_at (last push) stands in for the last-commit date: it
     # matches the default-branch commit date to the day in practice, and folding
     # the two signals into one call halves the per-gem GitHub requests. Returns
-    # {} when the repo can't be read, so the caller leaves both signals blank.
+    # {} when GitHub says the repo doesn't exist; raises RepoAccessDenied when it
+    # refuses the token, and RepoSignalsUnavailable when it can't answer (a rate
+    # limit past its short wait, an error status, a network failure).
+    # RepositorySignals decides what to ask next.
     def repo_signals(owner:, name:)
       return {} if owner.nil? || name.nil?
 
       repo = with_rate_limit_retry("repo #{owner}/#{name}") do
         StillActive.config.github_client.repository("#{owner}/#{name}")
       end
-      return {} unless repo
+      raise RepoSignalsUnavailable, "#{owner}/#{name}: rate limited" if repo == :rate_limited
 
       {archived: repo.archived, last_commit_date: as_time(repo.pushed_at, owner, name)}
+    rescue Octokit::NotFound
+      {}
+    # Permanent "don't know", like a 404: a name Octokit refuses up front (an
+    # ArgumentError), a repository GitHub has blocked, or one withheld for legal
+    # reasons. A rerun won't change them, so they're not a failure.
+    rescue Octokit::InvalidRepository, Octokit::RepositoryUnavailable, Octokit::UnavailableForLegalReasons
+      {}
+    # Rate limits are Forbidden subclasses in Octokit (a 403), but they say
+    # nothing about the repository being private, so they don't stop the chain.
+    rescue Octokit::TooManyRequests, Octokit::AbuseDetected, Octokit::TooManyLoginAttempts => e
+      warn("warning: repo signals failed for #{owner}/#{name}: #{e.class}")
+      raise RepoSignalsUnavailable, "#{owner}/#{name}: #{e.class}"
+    rescue Octokit::Unauthorized, Octokit::Forbidden => e
+      warn("warning: repo signals failed for #{owner}/#{name}: #{e.class}")
+      raise RepoAccessDenied, "#{owner}/#{name}: #{e.class}"
     rescue Octokit::Error, Faraday::Error => e
       warn("warning: repo signals failed for #{owner}/#{name}: #{e.class}")
-      {}
+      raise RepoSignalsUnavailable, "#{owner}/#{name}: #{e.class}"
     end
 
     # Commits on the default branch since the latest release's tag: the
@@ -48,7 +67,8 @@ module StillActive
 
       repo = "#{owner}/#{name}"
       ["v#{version}", version.to_s].each do |tag|
-        return with_rate_limit_retry("unreleased-commits #{repo}") { StillActive.config.github_client.compare(repo, tag, "HEAD").ahead_by }
+        ahead = with_rate_limit_retry("unreleased-commits #{repo}") { StillActive.config.github_client.compare(repo, tag, "HEAD").ahead_by }
+        return (ahead == :rate_limited) ? nil : ahead
       rescue Octokit::NotFound
         # this tag form doesn't exist; fall through to try the next one
       end
@@ -60,6 +80,9 @@ module StillActive
 
     private
 
+    # Only an answer that says whether the repo is archived counts: ecosyste.ms
+    # 404s a repo it hasn't crawled, and after GitHub failed that is nobody
+    # answering.
     # Pause-and-retry on a rate-limit response when the reset is near, so a
     # transient secondary/burst limit (which GitHub's concurrent fan-out can
     # trip even with a token) self-heals instead of dropping the gem's signal.
@@ -76,7 +99,7 @@ module StillActive
           # Surface the one actionable hint rather than a generic class name,
           # then return nil so this signal is simply absent for the gem.
           warn("rate limited on #{label}; set GITHUB_TOKEN to raise your limit, or run less often")
-          return
+          return :rate_limited
         end
 
         retried = true

data/lib/still_active/gitlab_client.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "time"
+require_relative "errors"
 require_relative "helpers/http_helper"
 
 module StillActive
@@ -17,10 +18,13 @@ module StillActive
       return {} if owner.nil? || name.nil?
 
       path = "/api/v4/projects/#{encode_project(owner, name)}"
-      body = HttpHelper.get_json(BASE_URI, path, headers: auth_headers)
+      # {} for a 404 (an answer); RepoSignalsUnavailable when GitLab couldn't answer.
+      body = HttpHelper.get_json(BASE_URI, path, headers: auth_headers, strict: true)
       return {} if body.nil?
 
       {archived: body["archived"] == true, last_commit_date: parse_time(body["last_activity_at"], owner, name)}
+    rescue HttpHelper::Unavailable => e
+      raise RepoSignalsUnavailable, e.message
     end
 
     private

data/lib/still_active/go_toolchain.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+require_relative "osv_client"
+require_relative "helpers/endoflife_helper"
+
+module StillActive
+  # The Go toolchain, which Syft emits as the module `stdlib` (pkg:golang/stdlib@1.27.1).
+  # It is a runtime, and deps.dev can't serve it: it keys versions `go1.27.1` so the
+  # purl's version 404s, its index stops at go1.25.5, and its advisory list is the same
+  # for every version (verified 2026-09-24). So the release lines come from
+  # endoflife.date and the advisories from OSV by version, the sources the Ruby
+  # runtime check already trusts.
+  module GoToolchain
+    extend self
+
+    MODULE = "stdlib"
+
+    def toolchain?(ecosystem, name)
+      ecosystem == :go && name == MODULE
+    end
+
+    # Syft writes 1.27.1, a component version often go1.27.1, Trivy v1.27.1.
+    def release(version)
+      version.to_s.delete_prefix("go").delete_prefix("v")
+    end
+
+    # The same { info:, default:, vulnerabilities:, vulnerabilities_checked:,
+    # project_id:, version_unresolved: }
+    # EcosystemLens builds from deps.dev for any other package.
+    def signals(version:)
+      release = release(version)
+      cycles = EndoflifeHelper.fetch_cycles("/api/go.json")
+      cycles = nil unless cycles.is_a?(Array) && cycles.all?(Hash) && !cycles.empty?
+      latest = cycles&.first
+      cycle = cycles&.find { |c| c["cycle"] == release.split(".").first(2).join(".") }
+      # Only a plain release (1.20 and earlier shipped as go1.20): OSV writes Go
+      # prereleases as 1.27.0-rc.1, so a `1.27rc1` query would come back empty and
+      # read as clean.
+      vulnerabilities = OsvClient.advisories(ecosystem: :go, name: MODULE, version: release) if release.match?(/\A\d+\.\d+(\.\d+)?\z/)
+      warn("warning: go/#{MODULE}@#{release} advisories not checked (not a plain release, or OSV gave no complete answer); treat it as unknown, not clean") if vulnerabilities.nil?
+
+      {
+        info: cycle && {published_at: release_date(cycle, release), licenses: [], **end_of_life(cycle, latest)},
+        default: latest && {version: latest["latest"], published_at: latest["latestReleaseDate"]},
+        vulnerabilities: vulnerabilities || [],
+        vulnerabilities_checked: !vulnerabilities.nil?,
+        project_id: nil,
+        # The feed is up but doesn't know this release line.
+        version_unresolved: !cycles.nil? && cycle.nil?
+      }
+    end
+
+    private
+
+    # The feed dates each line's first and latest release only.
+    def release_date(cycle, release)
+      if release == cycle["latest"]
+        cycle["latestReleaseDate"]
+      elsif [cycle["cycle"], "#{cycle["cycle"]}.0"].include?(release)
+        cycle["releaseDate"]
+      end
+    end
+
+    # Go supports its two newest lines. Past that the Go team has said a line gets no
+    # more fixes, which is the maintainer's deprecation this field already carries.
+    def end_of_life(cycle, latest)
+      return {deprecated: false, deprecation_reason: nil} unless EndoflifeHelper.eol_reached?(cycle["eol"])
+
+      # Worded as what the Go team did, since output labels it the maintainer's note.
+      on = EndoflifeHelper.parse_eol(cycle["eol"])&.strftime(" on %Y-%m-%d")
+      upgrade = latest && " Upgrade to #{latest["latest"]}."
+      {deprecated: true, deprecation_reason: "The Go team ended the #{cycle["cycle"]} release line#{on}; it gets no further security fixes.#{upgrade}"}
+    end
+  end
+end

data/lib/still_active/helpers/alternatives_helper.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require "gems"
+require_relative "../rubygems_client"
 
 module StillActive
   # Turns a gem's catalog siblings into ranked "leads" -- the most-downloaded
@@ -33,7 +33,7 @@ module StillActive
     private
 
     def downloads(gem_name)
-      info = Gems.info(gem_name)
+      info = RubygemsClient.info(gem_name)
       info && info["downloads"]
     rescue
       nil

data/lib/still_active/helpers/cyclonedx_helper.rb

@@ -6,6 +6,7 @@ require "time"
 require_relative "activity_helper"
 require_relative "status_helper"
 require_relative "vulnerability_helper"
+require_relative "repository_check"
 
 module StillActive
   # Renders a still_active workflow result as a CycloneDX SBOM. Emits 1.6 by
@@ -152,6 +153,12 @@ module StillActive
         "still_active:archived" => boolean_property(data[:archived]),
         "still_active:deprecated" => boolean_property(data[:deprecated]),
         "still_active:deprecation_reason" => data[:deprecation_reason],
+        # An empty vulnerabilities list reads as clean downstream; this says whether
+        # anything was actually looked up.
+        "still_active:vulnerabilities_checked" => boolean_property(data[:vulnerabilities_checked]),
+        # Present only when no service answered: a blank archived flag here is
+        # "unknown", not "no".
+        "still_active:repository_check" => (RepositoryCheck.unanswered?(data) ? data[:repository_check] : nil),
         "still_active:scorecard_score" => data[:scorecard_score]&.to_s,
         "still_active:libyear" => data[:libyear]&.to_s,
         "still_active:last_commit_date" => iso8601(data[:last_commit_date])

data/lib/still_active/helpers/diff_markdown_helper.rb

@@ -12,6 +12,7 @@ module StillActive
 
     BUMP_KIND_LABELS = {
       closed_vulns: "closed vulns",
+      advisories_unchecked: "advisories UNCHECKED",
       introduced_vulns: "INTRODUCED vulns",
       fresher: "fresher",
       older_relative: "older relative to latest",
@@ -149,6 +150,10 @@ module StillActive
           "- #{name} — scorecard #{MarkdownEscape.inline(ch[:from])} → #{MarkdownEscape.inline(ch[:to])}#{note}"
         when :version_yanked
           "- #{name} — version yanked from rubygems"
+        when :advisories_unchecked
+          "- #{name} — advisories could not be checked"
+        when :repository_unchecked
+          "- #{name} — repository no longer checked (#{MarkdownEscape.inline(ch[:check])}; may be archived)"
         when :libyear_worsened
           "- #{name} — libyear #{MarkdownEscape.inline(ch[:from])} → #{MarkdownEscape.inline(ch[:to])} (+#{ch[:delta]}y; same pinned version)"
         end

data/lib/still_active/helpers/emoji_helper.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "activity_helper"
+require_relative "repository_check"
 
 module StillActive
   module EmojiHelper
@@ -8,7 +9,7 @@ module StillActive
 
     def inactive_gem_emoji(result_hash)
       case ActivityHelper.activity_level(result_hash)
-      when :ok then ""
+      when :ok then RepositoryCheck.unanswered?(result_hash) ? StillActive.config.unsure_emoji : ""
       when :stale then StillActive.config.warning_emoji
       when :archived, :critical then StillActive.config.critical_warning_emoji
       when :unknown then StillActive.config.unsure_emoji

data/lib/still_active/helpers/endoflife_helper.rb

@@ -87,12 +87,13 @@ module StillActive
       end
     end
 
-    private
-
+    # The feed's raw cycles, newest first, or nil when it's unavailable.
     def fetch_cycles(feed_path)
       HttpHelper.get_json(ENDOFLIFE_URI, feed_path)
     end
 
+    private
+
     def normalize_cycle(cycle)
       version = cycle["cycle"]
       return unless version && Gem::Version.correct?(version)

data/lib/still_active/helpers/http_cache.rb

@@ -0,0 +1,109 @@
+# frozen_string_literal: true
+
+require "digest"
+require "fileutils"
+require "json"
+
+module StillActive
+  # An on-disk cache of public sources' JSON answers, so a rerun, or the baseline
+  # and current audits of one CI job, don't ask for the same thing twice. Only the
+  # hosts and paths in RULES are cached, each for as long as that data can be
+  # trusted to hold: an answer that carries advisories for an hour, so a new CVE
+  # is at most an hour late (--no-cache for none), a published version's record
+  # for a week, since it doesn't change. Nothing credentialed is cached: those
+  # hosts aren't listed, and a request with an Authorization header is skipped
+  # whatever its host. Failures and 404s aren't cached, only answers.
+  #
+  # OSV's version query is deliberately absent. It is the arbiter that drops a
+  # deps.dev finding the version isn't affected by, so it must never be older
+  # than the deps.dev record it judges; cached separately, it could be, and would
+  # drop an advisory published after it was cached.
+  module HttpCache
+    extend self
+
+    HOUR = 60 * 60
+    DAY = 24 * HOUR
+    WEEK = 7 * DAY
+
+    # [host, path pattern, seconds], first match wins.
+    RULES = [
+      ["api.deps.dev", %r{\A/v3alpha/systems/[^/]+/packages/[^/]+/versions/[^/]+:requirements\z}, WEEK],
+      ["api.deps.dev", %r{\A/v3alpha/systems/[^/]+/packages/[^/]+/versions/}, HOUR], # carries advisoryKeys
+      ["api.deps.dev", %r{\A/v3alpha/systems/[^/]+/packages/[^/]+\z}, 6 * HOUR], # latest version
+      ["api.deps.dev", %r{\A/v3alpha/advisories/}, 6 * HOUR], # CVSS, which the severity gates read
+      ["api.deps.dev", %r{\A/v3alpha/projects/}, DAY],
+      ["api.osv.dev", %r{\A/v1/vulns/}, 6 * HOUR], # severity and fixed versions
+      ["rubygems.org", %r{\A/api/v1/versions/}, 6 * HOUR],
+      ["rubygems.org", %r{\A/api/v1/gems/}, DAY],
+      ["pypi.org", %r{\A/pypi/[^/]+/[^/]+/json\z}, WEEK], # one published version
+      ["packages.ecosyste.ms", %r{/versions/}, WEEK], # one published version's declared deps
+      ["repos.ecosyste.ms", %r{\A/api/v1/hosts/}, DAY],
+      ["endoflife.date", %r{\A/api/}, DAY]
+    ].freeze
+
+    # Entries older than any rule allows are deleted when the cache is first used.
+    MAX_AGE = WEEK
+
+    # Seconds to cache this request's answer for, or nil to not cache it.
+    def ttl(uri, headers)
+      return unless StillActive.config.http_cache
+      return if headers.keys.any? { _1.to_s.casecmp?("Authorization") }
+
+      RULES.find { |host, pattern, _| uri.host == host && uri.path.match?(pattern) }&.last
+    end
+
+    # The cached answer, or :miss.
+    def read(key, ttl)
+      path = path_for(key)
+      return :miss unless File.exist?(path)
+
+      entry = JSON.parse(File.read(path))
+      age = Time.now.to_f - entry.fetch("stored_at")
+      # A future stamp (clock skew, a cache restored from another machine) would
+      # otherwise never expire.
+      return :miss if age.negative? || age > ttl
+
+      entry.fetch("body")
+    rescue JSON::ParserError, KeyError, TypeError, SystemCallError
+      :miss
+    end
+
+    # Best-effort: a cache that can't be written is just a cache miss next time.
+    def write(key, body)
+      sweep_once
+      path = path_for(key)
+      FileUtils.mkdir_p(File.dirname(path))
+      temp = "#{path}.#{Process.pid}.#{rand(1 << 32)}.tmp"
+      File.write(temp, JSON.generate({"stored_at" => Time.now.to_f, "body" => body}))
+      File.rename(temp, path)
+    rescue SystemCallError, IOError
+      File.delete(temp) if temp && File.exist?(temp)
+    end
+
+    def key(method, uri)
+      Digest::SHA256.hexdigest("#{method}\n#{uri}")
+    end
+
+    def directory
+      base = ENV["XDG_CACHE_HOME"]
+      base = File.join(Dir.home, ".cache") if base.nil? || base.empty?
+      File.join(base, "still_active", "http")
+    end
+
+    private
+
+    def path_for(key)
+      File.join(directory, key[0, 2], "#{key}.json")
+    end
+
+    def sweep_once
+      return if @swept
+
+      @swept = true
+      cutoff = Time.now - MAX_AGE
+      Dir.glob(File.join(directory, "*", "*.{json,tmp}")).each { File.delete(_1) if File.mtime(_1) < cutoff }
+    rescue SystemCallError
+      nil
+    end
+  end
+end

data/lib/still_active/helpers/http_helper.rb

@@ -3,10 +3,11 @@
 require "net/http"
 require "openssl"
 require "json"
+require_relative "http_cache"
 
 module StillActive
   module HttpHelper
-    TRUSTED_HOSTS = ["github.com", "gitlab.com", "codeberg.org", "api.deps.dev", "api.osv.dev", "endoflife.date", "rubygems.pkg.github.com", "repos.ecosyste.ms", "packages.ecosyste.ms", "pypi.org"].freeze
+    TRUSTED_HOSTS = ["github.com", "gitlab.com", "codeberg.org", "api.deps.dev", "api.osv.dev", "endoflife.date", "rubygems.org", "rubygems.pkg.github.com", "repos.ecosyste.ms", "packages.ecosyste.ms", "pypi.org"].freeze
     # Transport-level failures ("host unreachable / connection broke", not an HTTP
     # error status). Every network entry point degrades to a safe empty result on
     # these rather than letting one escape and vanish a gem from the audit.
@@ -22,6 +23,11 @@ module StillActive
       EOFError
     ].freeze
     MAX_REDIRECTS = 3
+    # A 429 or 503 that says when to come back gets one retry, if that's soon.
+    MAX_RETRY_AFTER_SECONDS = 10
+    # Idle connections kept per host. The fan-out runs 10 at a time, so more than
+    # that would only ever sit idle.
+    MAX_IDLE_PER_HOST = 10
     # Ceiling on a single response body. These are metadata endpoints (version
     # lists, scorecards, advisories); legitimate responses are well under this.
     # A source URL is lockfile-derived and a `*.jfrog.io` host is attacker-
@@ -30,16 +36,33 @@ module StillActive
     # gem with thousands of versions while bounding worst-case memory.
     MAX_BODY_BYTES = 16 * 1024 * 1024
     JSON_PARSER = ->(body) { JSON.parse(body) }
+    # Raised in strict mode when the source couldn't answer: a transport error, a
+    # non-404 error status, a refused redirect, an oversized or garbled body. A 404
+    # is an answer ("no such record") and still returns nil. A caller that must not
+    # read a failure as "nothing there", like an advisory lookup, asks for strict.
+    Unavailable = Class.new(StandardError)
     IDENTITY = ->(body) { body }
 
     extend self
 
-    def get_json(base_uri, path, headers: {}, params: {})
+    # Close and forget every pooled connection. Specs call it between examples,
+    # since a pooled connection holds WebMock's fake socket.
+    def reset_connections!
+      pool.each_value { |idle| idle.each { close(_1) } }
+      @pool = nil
+    end
+
+    # `cache: false` skips the disk cache (a canary has to see the source as it is
+    # now); `cache_if` decides whether an answer is sound enough to keep, so a
+    # garbled one isn't reread for its whole TTL.
+    def get_json(base_uri, path, headers: {}, params: {}, strict: false, cache: true, cache_if: nil)
       uri = base_uri.dup
       uri.path = path
       uri.query = URI.encode_www_form(params) unless params.empty?
 
-      request_json(uri, headers) { |target| Net::HTTP::Get.new(target) }
+      cached(HttpCache.key("GET", uri), uri, headers, enabled: cache, cache_if: cache_if) do
+        request_json(uri, headers, strict: strict) { |target| Net::HTTP::Get.new(target) }
+      end
     end
 
     # As get_json, but for endpoints that answer in plain text (the RubyGems
@@ -52,11 +75,13 @@ module StillActive
       request_json(uri, headers, parse: IDENTITY) { |target| Net::HTTP::Get.new(target) }
     end
 
-    def post_json(base_uri, path, body:, headers: {})
+    # Never cached: the POSTs this tool makes (OSV's version query, deps.dev's
+    # batch, Artifactory's AQL) each have to be fresh, or aren't public.
+    def post_json(base_uri, path, body:, headers: {}, strict: false)
       uri = base_uri.dup
       uri.path = path
 
-      request_json(uri, headers) do |target|
+      request_json(uri, headers, strict: strict) do |target|
         request = Net::HTTP::Post.new(target)
         request.body = body
         request
@@ -65,6 +90,18 @@ module StillActive
 
     private
 
+    # A cached answer when there's a fresh one; otherwise asks, and caches a
+    # non-nil answer. nil is a 404 or a failure, neither of which is kept.
+    def cached(key, uri, headers, enabled:, cache_if: nil)
+      ttl = enabled && HttpCache.ttl(uri, headers)
+      return yield unless ttl
+
+      hit = HttpCache.read(key, ttl)
+      return hit unless hit == :miss
+
+      yield.tap { |body| HttpCache.write(key, body) if !body.nil? && (cache_if.nil? || cache_if.call(body)) }
+    end
+
     # Two URIs share an origin when scheme, host, and port all match. URI fills
     # in the default port (443 for https), so the bare and explicit forms of the
     # same origin compare equal.
@@ -76,40 +113,54 @@ module StillActive
     # and returns the parsed body (or nil), where `parse` decides JSON vs text.
     # The block is yielded each URI and returns the request object, so GET and
     # POST share the redirect/auth/cap logic.
-    def request_json(uri, headers, parse: JSON_PARSER)
-      MAX_REDIRECTS.times do
-        http = Net::HTTP.new(uri.host, uri.port)
-        http.use_ssl = true
-        http.open_timeout = 10
-        http.read_timeout = 10
-
+    def request_json(uri, headers, parse: JSON_PARSER, strict: false)
+      retried = false
+      # The Retry-After retry repeats a pass rather than spending one of these.
+      passes = 0
+      while (passes += 1) <= MAX_REDIRECTS
         request = yield(uri)
         headers.each { |key, value| request[key] = value }
 
-        outcome, payload = perform(http, request, uri, parse)
+        outcome, payload = with_connection(uri) { |http| perform(http, request, uri, parse) }
         case outcome
+        when :retry_after
+          if retried
+            warn("warning: #{uri.host}#{uri.path} is still rate limited after one retry")
+            return unavailable(strict, uri)
+          end
+          warn("warning: #{uri.host}#{uri.path} returned HTTP #{payload[:code]}, retrying in #{payload[:seconds]}s as it asked")
+          sleep(payload[:seconds])
+          retried = true
+          passes -= 1
+          next
         when :done
-          return payload
-        when :stop
+          # A 404 is how a source says "no record"; a 200 of `null` says nothing.
+          return payload unless payload.nil? && strict
+
+          warn("warning: #{uri.host}#{uri.path} returned an empty (null) body")
+          return unavailable(strict, uri)
+        when :not_found
           return
+        when :stop
+          return unavailable(strict, uri)
         when :redirect
           location = payload["Location"]
           if location.nil? || location.empty?
             warn("warning: #{uri.host}#{uri.path} returned HTTP #{payload.code} with no Location header")
-            return
+            return unavailable(strict, uri)
           end
 
           redirect_uri = uri + location
           unless TRUSTED_HOSTS.include?(redirect_uri.host)
             warn("warning: #{uri.host}#{uri.path} redirected to untrusted host #{redirect_uri.host}, skipping")
-            return
+            return unavailable(strict, uri)
           end
           # We dial every request over TLS (use_ssl = true). A redirect that
           # downgrades to http is either a misconfiguration or a downgrade
           # attempt; refuse it rather than silently dialing http-over-TLS.
           unless redirect_uri.scheme == "https"
             warn("warning: #{uri.host}#{uri.path} redirected to non-https #{redirect_uri.scheme} target, skipping")
-            return
+            return unavailable(strict, uri)
           end
           warn("warning: #{uri.host}#{uri.path} redirected to #{redirect_uri.host}#{redirect_uri.path} (stale metadata?)")
           # Auth is scoped to an origin (scheme + host + port), not just a host:
@@ -120,42 +171,111 @@ module StillActive
       end
 
       warn("warning: #{uri.host}#{uri.path} too many redirects")
-      nil
+      unavailable(strict, uri)
     rescue *TRANSPORT_ERRORS => e
       warn("warning: #{uri.host}#{uri.path} failed: #{e.class} (#{e.message})")
-      nil
+      unavailable(strict, uri)
     rescue JSON::ParserError => e
       warn("warning: #{uri.host}#{uri.path} returned invalid JSON: #{e.message}")
-      nil
+      unavailable(strict, uri)
     rescue URI::InvalidURIError => e
       warn("warning: #{uri.host}#{uri.path} returned an invalid redirect Location: #{e.message}")
-      nil
+      unavailable(strict, uri)
+    end
+
+    # Every failure has already warned; strict callers also get told.
+    def unavailable(strict, uri)
+      raise Unavailable, "#{uri.host}#{uri.path}" if strict
     end
 
     # Issues the request in streaming form so the body is read against a size
     # cap rather than buffered whole. Returns one of:
     #   [:redirect, response]  a 3xx, for the caller to follow
-    #   [:stop, nil]           non-success (warns unless 404), or body over cap
+    #   [:not_found, nil]      a 404, which is an answer, not a failure
+    #   [:stop, nil]           any other non-success (warns), or body over cap
     #   [:done, parsed]        a 2xx with the parsed body (JSON or text)
-    # Redirect and non-success bodies are never read: returning from the block
-    # unwinds through Net::HTTP, which closes the connection without draining
-    # the body, so a huge error/redirect body can't OOM us either.
+    # Redirect and error bodies are never read: returning from the block unwinds
+    # through Net::HTTP without draining the body, so a huge one can't OOM us, and
+    # with_connection closes that connection. A success or a 404 is read to the end
+    # and the block finishes normally, so Net::HTTP does its end-of-request
+    # bookkeeping: it honours Connection: close and records the time for its idle
+    # check, which is what makes the connection safe to pool. Returning from inside
+    # skipped both, and a POST on a connection the server had closed then failed.
     def perform(http, request, uri, parse)
+      body = nil
       http.request(request) do |response|
         return [:redirect, response] if response.is_a?(Net::HTTPRedirection)
 
+        if response.is_a?(Net::HTTPNotFound)
+          return [:stop, nil] if read_capped_body(response, uri).nil?
+
+          next
+        end
+
+        if (seconds = retry_after(response))
+          return [:retry_after, {code: response.code, seconds: seconds}]
+        end
+
         unless response.is_a?(Net::HTTPSuccess)
-          warn("warning: #{uri.host}#{uri.path} returned HTTP #{response.code}") unless response.is_a?(Net::HTTPNotFound)
+          warn("warning: #{uri.host}#{uri.path} returned HTTP #{response.code}")
           return [:stop, nil]
         end
 
         body = read_capped_body(response, uri)
         return [:stop, nil] if body.nil?
+      end
+      body.nil? ? [:not_found, nil] : [:done, parse.call(body)]
+    end
+
+    # The seconds a 429 or 503 asks us to wait, when it gives a number of them and
+    # the wait is short enough to be worth it; nil otherwise. The HTTP-date form is
+    # read as "not soon", since the sources we call send seconds.
+    def retry_after(response)
+      return unless response.code == "429" || response.code == "503"
+
+      value = response["Retry-After"].to_s.strip
+      return unless value.match?(/\A\d+\z/)
+
+      value.to_i if value.to_i <= MAX_RETRY_AFTER_SECONDS
+    end
 
-        return [:done, parse.call(body)]
+    # One started connection per host, reused across requests. Only a success or a
+    # 404, read to the end with Net::HTTP's request finished normally, goes back
+    # (see perform); anything else may have unread bytes and is closed. On reuse,
+    # Net::HTTP reconnects a connection the server closed or that sat idle past
+    # its keep-alive timeout.
+    def with_connection(uri)
+      http = pool[[uri.host, uri.port]].pop || open_connection(uri)
+      outcome = nil
+      begin
+        outcome = yield(http)
+      ensure
+        if [:done, :not_found].include?(outcome&.first) && pool[[uri.host, uri.port]].size < MAX_IDLE_PER_HOST
+          pool[[uri.host, uri.port]] << http
+        else
+          close(http)
+        end
       end
     end
 
+    def open_connection(uri)
+      http = Net::HTTP.new(uri.host, uri.port)
+      http.use_ssl = true
+      http.open_timeout = 10
+      http.read_timeout = 10
+      http.start
+    end
+
+    def close(http)
+      http.finish if http.started?
+    rescue IOError
+      nil
+    end
+
+    def pool
+      @pool ||= Hash.new { |hash, key| hash[key] = [] }
+    end
+
     # Reads the body in chunks, abandoning the read (returns nil) as soon as it
     # exceeds MAX_BODY_BYTES so an oversized body is never fully materialized.
     def read_capped_body(response, uri)