@gitkraken/core-gitlens 0.9.0 → 0.9.1

package/CHANGELOG.md

@@ -6,6 +6,16 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/) and this p
 
 ## [Unreleased]
 
+## [0.9.1] - 2026-09-29
+
+### Added
+
+- Adds GitHub and GitHub Enterprise to the refusals `resolveRepository` names. An organization with OAuth App access restrictions that has not approved the OAuth app a token belongs to hides its private repositories from every listing and search without an error, and GraphQL answers a lookup of one exactly as it answers a missing repository, so such a repository resolved as `not-found`, indistinguishable from a deleted one. A GitHub miss is now confirmed over REST (the new `GitHubApi.getRepositoryAccess`), which refuses such a repository with a `403` saying why; the resolution is then `unauthorized` with a warning scoped to the repository (`scope.repositoryId`) and, once the credential is confirmed with a profile read (the new GitHub `validateCredential`), `cause: { reason: 'oauth-app-not-allowed', remedyUrl }`, where `remedyUrl` is the app's page in the user's authorized OAuth apps, addressed by the client id GitHub reports in `X-OAuth-Client-Id`. A REST read that cannot confirm either way keeps the `not-found`, and any other `403` stays scoped with GitHub's own words and no cause. Neither the confirming read nor the credential check raises the reauthentication prompt (`GitHubApi.getCurrentAccount` takes `silent`). A refusal's facts now also read Octokit's `{ status, headers, data }` response, and carry the refused token's OAuth client id (plus/integrations, plus/git-github)
+
+### Changed
+
+- Changes `resolveRepository`'s `unauthorized` on Azure DevOps, Azure DevOps Server, Bitbucket and Bitbucket Data Center: a `401`/`403` for the repository now settles as a batch read's refused target does, so once the credential checks out, the warning is scoped to that repository (and, on Azure DevOps, named by its `cause`) instead of reported for the connection. GitLab, which has no credential check, is unchanged. Also, a GitHub batch read whose every target is refused now checks the credential once and, when it passes, publishes each refusal scoped to its repository, spending no strike and keeping the session, instead of failing as the connection's (plus/integrations)
+
 ## [0.9.0] - 2026-09-29
 
 ### Added
@@ -447,7 +457,8 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/) and this p
 
 - Initial release. Bundles `@gitlens/utils`, `@gitlens/git`, `@gitlens/git-cli`, `@gitlens/ai`, and `@gitlens/git-github` into a single core npm package with subpath exports.
 
-[unreleased]: https://github.com/gitkraken/vscode-gitlens/compare/releases/core/v0.9.0...HEAD
+[unreleased]: https://github.com/gitkraken/vscode-gitlens/compare/releases/core/v0.9.1...HEAD
+[0.9.1]: https://github.com/gitkraken/vscode-gitlens/compare/releases/core/v0.9.0...gitkraken:releases/core/v0.9.1
 [0.9.0]: https://github.com/gitkraken/vscode-gitlens/compare/releases/core/v0.8.0...gitkraken:releases/core/v0.9.0
 [0.8.0]: https://github.com/gitkraken/vscode-gitlens/compare/releases/core/v0.7.2...gitkraken:releases/core/v0.8.0
 [0.7.2]: https://github.com/gitkraken/vscode-gitlens/compare/releases/core/v0.7.1...gitkraken:releases/core/v0.7.2

package/dist/plus/git-github/api/github.d.ts

@@ -81,6 +81,7 @@ export declare class GitHubApi {
   getCurrentAccount(provider: Provider, token: GitHubTokenInfo, options?: {
     baseUrl?: string;
     avatarSize?: number;
+    silent?: boolean;
   }): Promise<Account | undefined>;
   getAccountForCommit(provider: Provider, token: GitHubTokenInfo, owner: string, repo: string, rev: string, options?: {
     baseUrl?: string;
@@ -169,6 +170,18 @@ export declare class GitHubApi {
   getTagsWithCommit(token: GitHubTokenInfo, owner: string, repo: string, ref: string, date: Date): Promise<string[]>;
   getNextCommitRefs(token: GitHubTokenInfo, owner: string, repo: string, ref: string, path: string, sha: string): Promise<string[]>;
   private getCommitDate;
+  /**
+   * Whether this credential can read the repository, asked of REST rather than GraphQL. GraphQL answers a
+   * repository hidden by its organization's OAuth App access restrictions exactly as it answers one that does not
+   * exist (`NOT_FOUND`), while REST answers `403` and says why, so this is how a GraphQL miss is told apart from
+   * one. Resolves `false` on a `404`; a refusal throws `AuthenticationError` carrying GitHub's response.
+   *
+   * Silent: the refusal it exists to surface is one organization's policy, which reauthenticating cannot fix, so it
+   * must not raise the reauthentication prompt a failed read otherwise raises.
+   */
+  getRepositoryAccess(provider: Provider | undefined, token: GitHubTokenInfo, owner: string, repo: string, options?: {
+    baseUrl?: string;
+  }): Promise<boolean>;
   getContributors(token: GitHubTokenInfo, owner: string, repo: string): Promise<GitHubContributor[]>;
   getUserSshSigningKeys(provider: Provider | undefined, token: GitHubTokenInfo, username: string, options?: {
     baseUrl?: string;

package/dist/plus/git-github/api/github.js

@@ -341,6 +341,7 @@ var GitHubApi = class {
 	}
 	async getCurrentAccount(provider, token, options) {
 		const scope = getScopedLogger();
+		const { silent, ...variables } = options ?? {};
 		try {
 			const rsp = await this.graphql(provider, token, `query getCurrentAccount($avatarSize: Int) {
 	viewer {
@@ -350,7 +351,7 @@ var GitHubApi = class {
 		login
 		avatarUrl(size: $avatarSize)
 	}
-}`, { ...options }, scope);
+}`, variables, scope);
 			if (rsp?.viewer?.login == null) return void 0;
 			return {
 				provider,
@@ -362,7 +363,7 @@ var GitHubApi = class {
 			};
 		} catch (ex) {
 			if (ex instanceof RequestNotFoundError) return void 0;
-			throw this.handleException(ex, provider, scope);
+			throw this.handleException(ex, provider, scope, silent);
 		}
 	}
 	async getAccountForCommit(provider, token, owner, repo, rev, options) {
@@ -1354,6 +1355,29 @@ var GitHubApi = class {
 			throw this.handleException(ex, void 0, scope);
 		}
 	}
+	/**
+	* Whether this credential can read the repository, asked of REST rather than GraphQL. GraphQL answers a
+	* repository hidden by its organization's OAuth App access restrictions exactly as it answers one that does not
+	* exist (`NOT_FOUND`), while REST answers `403` and says why, so this is how a GraphQL miss is told apart from
+	* one. Resolves `false` on a `404`; a refusal throws `AuthenticationError` carrying GitHub's response.
+	*
+	* Silent: the refusal it exists to surface is one organization's policy, which reauthenticating cannot fix, so it
+	* must not raise the reauthentication prompt a failed read otherwise raises.
+	*/
+	async getRepositoryAccess(provider, token, owner, repo, options) {
+		const scope = getScopedLogger();
+		try {
+			await this.request(provider, token, "GET /repos/{owner}/{repo}", {
+				owner,
+				repo,
+				...options
+			}, scope, void 0, true);
+			return true;
+		} catch (ex) {
+			if (ex instanceof RequestNotFoundError) return false;
+			throw this.handleException(ex, provider, scope, true);
+		}
+	}
 	async getContributors(token, owner, repo) {
 		const scope = getScopedLogger();
 		try {
@@ -1806,8 +1830,8 @@ var GitHubApi = class {
 		promise.then(cleanup, cleanup);
 		return promise;
 	}
-	async request(provider, token, route, options, scope, cancellation) {
-		return await this.requestCore(provider, token, route, options, scope, cancellation);
+	async request(provider, token, route, options, scope, cancellation, deferFailure) {
+		return await this.requestCore(provider, token, route, options, scope, cancellation, deferFailure);
 	}
 	/**
 	* REST call for routes `@octokit/types` doesn't describe yet — currently the stacked-pull-request
@@ -1817,7 +1841,7 @@ var GitHubApi = class {
 	async requestPreview(provider, token, route, options, scope, cancellation) {
 		return await this.requestCore(provider, token, route, options, scope, cancellation);
 	}
-	async requestCore(provider, token, route, options, scope, cancellation) {
+	async requestCore(provider, token, route, options, scope, cancellation, deferFailure) {
 		const { accessToken } = token;
 		try {
 			let signal;
@@ -1836,7 +1860,7 @@ var GitHubApi = class {
 			const retryable = method === "GET" || method === "HEAD";
 			return await this.requestWithRetries(() => this.config.wrapForForcedInsecureSSL(provider?.getIgnoreSSLErrors() ?? false, () => this.getDefaults(accessToken, request)(route, options)), retryable, signal, scope);
 		} catch (ex) {
-			if (ex instanceof RequestError || ex.name === "AbortError") this.handleRequestError(provider, token, ex, scope, void 0);
+			if (ex instanceof RequestError || ex.name === "AbortError") this.handleRequestError(provider, token, ex, scope, deferFailure);
 			else if (_logger.isDebugging) this.config.onDebugError?.(`GitHub request failed: ${ex.message}`);
 			throw ex;
 		}
@@ -3138,6 +3162,12 @@ __decorate([trace({ args: (token, owner, repo, ref, path, sha) => ({
 	path,
 	sha
 }) })], GitHubApi.prototype, "getNextCommitRefs", null);
+__decorate([trace({ args: (provider, token, owner, repo) => ({
+	provider: provider?.name,
+	token: `<token:${token.microHash}>`,
+	owner,
+	repo
+}) })], GitHubApi.prototype, "getRepositoryAccess", null);
 __decorate([trace({ args: (token, owner, repo) => ({
 	token: `<token:${token.microHash}>`,
 	owner,