@preventive/triage 1.0.0-alpha.27 → 1.0.0-alpha.28

package/server-managed/db-schema.ts

@@ -45,6 +45,8 @@ CREATE TABLE IF NOT EXISTS managed_selected_repo (
   is_private      INTEGER NOT NULL,
   installation_id INTEGER,
   default_branch  TEXT NOT NULL,
+  -- Live browser hint; independent of the default discovered at selection.
+  cached_default_branch TEXT,
   html_url        TEXT NOT NULL,
   added_by        TEXT REFERENCES managed_user(id) ON DELETE SET NULL,
   added_at        INTEGER NOT NULL,

package/server-managed/db.ts

@@ -6,10 +6,12 @@ import { migrateSlugs } from './slugs.ts'
 import { migrateReportLocations } from './report-migration.ts'
 import { initCommentMethods } from './comments.ts'
 import { initActivityMethods } from './activity.ts'
+import { revisionSchema } from './revisions.ts'
 import { MANAGED_SCHEMA } from './db-schema.ts'
 import { STORAGE_SCHEMA } from './storage-db.ts'
 import { GITHUB_METADATA_SCHEMA, GITHUB_STATE_REASON_COLUMN } from './github-metadata.ts'
 import { MANAGED_ISSUE_SCHEMA } from './managed-issues.ts'
+import { BUNDLE_BUILD_LEASE_SCHEMA } from './bundle-build-leases.ts'
 import { managedTableRenames } from './db-table-names.ts'
 import { type ManagedDb, type ManagedDbOptions, createManagedMethods } from './db-methods.ts'
 import { createSqliteDriver, scopeManagedMethods } from './sql.ts'
@@ -66,7 +68,8 @@ export function openSqliteManagedDb(path: string, options: ManagedDbOptions = {}
     db.exec('PRAGMA synchronous = FULL;')
     db.exec('PRAGMA foreign_keys = ON;')
     migrateManagedTableNames(db)
-    db.exec(MANAGED_SCHEMA + GITHUB_METADATA_SCHEMA + MANAGED_ISSUE_SCHEMA + STORAGE_SCHEMA)
+    db.exec(MANAGED_SCHEMA + GITHUB_METADATA_SCHEMA + MANAGED_ISSUE_SCHEMA + STORAGE_SCHEMA + BUNDLE_BUILD_LEASE_SCHEMA)
+    ensureColumn(db, 'managed_selected_repo', 'cached_default_branch', 'TEXT')
     for (const table of ['managed_report', 'managed_bundle']) {
       ensureColumn(db, table, 'data_key', 'TEXT')
       ensureColumn(db, table, 'storage_encrypted', 'INTEGER NOT NULL DEFAULT 0')
@@ -106,6 +109,7 @@ export function openSqliteManagedDb(path: string, options: ManagedDbOptions = {}
     ensureColumn(db, 'managed_finding_triage_event', 'repo', 'TEXT')
     initCommentMethods(db)
     initActivityMethods(db)
+    db.exec(revisionSchema())
   } catch (err) {
     try { db.close() } catch {}
     throw err

package/server-managed/github-app.ts

@@ -4,8 +4,9 @@
 // permissions. Discovery itself is read-only and skips archived repositories.
 import { Buffer } from 'node:buffer'
 import { createHash, createSign } from 'node:crypto'
+import { createClient } from '@preventive/upstream/github.js'
 import type { ManagedConfig } from './config.ts'
-import { GithubApiError, throwGithubResponseError } from './github-errors.ts'
+import { GithubApiError, throwGithubResponseError, upstreamGithub } from './github-errors.ts'
 
 export { GithubApiError } from './github-errors.ts'
 
@@ -124,10 +125,9 @@ export function publicRepositoryName(raw: unknown): string | null {
 // Public additions must be readable by the server without the acting user's
 // credentials. Require explicit public visibility and use GitHub's canonical
 // metadata, never client-supplied ids, installation ids, or branches.
-export async function fetchPublicRepository(fullName: string, fetchImpl: typeof fetch = globalThis.fetch): Promise<ConnectedRepo> {
+export async function fetchPublicRepository(fullName: string): Promise<ConnectedRepo> {
   if (publicRepositoryName(fullName) !== fullName) throw new GithubApiError(400, 'bad-repository')
-  const path = fullName.split('/').map(encodeURIComponent).join('/')
-  const repo = parseRepo(await githubJson(`${GITHUB_API}/repos/${path}`, null, fetchImpl), null)
+  const repo = parseRepo(await upstreamGithub(() => createClient({ token: null, userAgent: USER_AGENT }).getRepo({ repo: fullName })), null)
   if (repo == null || repo.private || repo.visibility !== 'public') throw new GithubApiError(409, 'repo-not-public')
   if (publicRepositoryName(repo.fullName) !== repo.fullName || repo.fullName.toLowerCase() !== fullName.toLowerCase()) throw new GithubApiError(502, 'github-malformed')
   return { ...repo, htmlUrl: `https://github.com/${repo.fullName}` }
@@ -138,17 +138,12 @@ export async function fetchPublicRepository(fullName: string, fetchImpl: typeof
 // List the authenticated user's repositories (GET /user/repos), paginated until
 // a short page, deduped + sorted. With an identity-only token this returns the
 // user's PUBLIC repos. READ-ONLY.
-export async function listUserRepos(accessToken: string, fetchImpl: typeof fetch = globalThis.fetch): Promise<ConnectedRepo[]> {
+export async function listUserRepos(accessToken: string): Promise<ConnectedRepo[]> {
   const byName = new Map<string, ConnectedRepo>()
-  for (let page = 1; ; page++) {
-    const url = `${GITHUB_API}/user/repos?per_page=${PER_PAGE}&page=${page}&sort=full_name`
-    const body = await githubJson(url, accessToken, fetchImpl)
-    if (!Array.isArray(body)) break
-    for (const r of body) {
-      const repo = parseRepo(r, null)
-      if (repo != null) byName.set(repo.fullName, repo)
-    }
-    if (body.length < PER_PAGE) break
+  const body = await upstreamGithub(() => createClient({ token: accessToken, userAgent: USER_AGENT }).listUserRepos())
+  for (const r of body) {
+    const repo = parseRepo(r, null)
+    if (repo != null) byName.set(repo.fullName, repo)
   }
   return [...byName.values()].toSorted((a, b) => a.fullName.localeCompare(b.fullName))
 }
@@ -373,7 +368,7 @@ export async function collectRepos(config: ManagedConfig, userToken: string | nu
   const lists: ConnectedRepo[][] = []
   if (userToken != null) {
     try {
-      lists.push(await listUserRepos(userToken, fetchImpl))
+      lists.push(await listUserRepos(userToken))
     } catch (err) {
       if (err instanceof GithubApiError && err.status === 401) tokenMissing = true
       else console.warn('managed: public repo list failed:', err)

package/server-managed/github-errors.ts

@@ -1,3 +1,5 @@
+import { HttpError } from '@preventive/upstream/github.js'
+
 // A failure carrying the HTTP status the router should surface. 401 passes
 // through so the user-token path can map it to "log in again".
 export class GithubApiError extends Error {
@@ -26,3 +28,22 @@ export async function throwGithubResponseError(res: Response): Promise<never> {
   if (res.status === 404) throw new GithubApiError(404, 'github-not-found')
   throw new GithubApiError(502, `github-status-${res.status}`)
 }
+
+export async function upstreamGithub<T>(request: () => Promise<T>): Promise<T> {
+  try { return await request() } catch (error) {
+    if (error instanceof HttpError) {
+      // The upstream error includes GitHub's response text. Retain managed
+      // status handling, including rate limits, without exposing that text.
+      if (error.status === 401) throw new GithubApiError(401, 'github-unauthorized')
+      if (error.status === 404) throw new GithubApiError(404, 'github-not-found')
+      if (error.status === 429 || (error.status === 403 && /rate limit|abuse detection/iu.test(error.message))) {
+        throw new GithubApiError(429, 'github-rate-limited', 60)
+      }
+      throw new GithubApiError(502, `github-status-${error.status}`)
+    }
+    if (error instanceof Error && (error.name === 'AssertionError' || error.cause instanceof SyntaxError)) {
+      throw new GithubApiError(502, 'github-malformed')
+    }
+    throw new GithubApiError(502, 'github-unreachable')
+  }
+}

package/server-managed/github-issues.ts

@@ -4,7 +4,7 @@ import type { BlobStore } from './blob-store.ts'
 import type { ManagedIssue } from './managed-issues.ts'
 import { randomToken } from './crypto.ts'
 import { githubIssueClosedReason } from '../common/github-pr.ts'
-import { reportEntries, reportRepoGithub } from '../report/index.js'
+import { reportEntries, reportRepoGithub } from '@preventive/report'
 import { newIssueLabels } from '../common/github-issue-labels.js'
 import { appJwt, githubAppConfigured, installUrl, publicRepositoryName } from './github-app.ts'
 import { ISSUE_LOGIN_PATH, issueUserToken } from './github-issue-oauth.ts'

package/server-managed/github-metadata.ts

@@ -12,15 +12,24 @@ export interface GithubMetadata {
   fetchedAt: number
   attemptedAt: number | null
 }
+export interface GithubRepositoryVisibility {
+  repoId: number
+  github: string
+  public: boolean
+  checkedAt: number
+}
 export interface GithubMetadataStore {
   listGithubMetadata(keys: readonly string[]): Promise<GithubMetadata[]>
   setGithubMetadata(entries: readonly Omit<GithubMetadata, 'attemptedAt'>[]): Promise<void>
   recordGithubMetadataAttempts(keys: readonly string[], attemptedAt: number): Promise<void>
+  listGithubRepositoryVisibility(repoIds: readonly number[]): Promise<GithubRepositoryVisibility[]>
+  setGithubRepositoryVisibility(entries: readonly GithubRepositoryVisibility[]): Promise<void>
 }
 
 // Successful GitHub reads are shared and retained without eviction. The stable
 // repository ID in the key survives renames, but is never an access grant.
-// Callers must authorize the current user -> team -> repo before every read.
+// Callers must verify current user -> team -> repo grants plus either recently
+// verified public visibility or the viewer's live GitHub access with their token.
 export const GITHUB_STATE_REASON_COLUMN = "TEXT CHECK (state_reason IN ('completed', 'not_planned', 'duplicate', 'unknown'))"
 export const GITHUB_METADATA_SCHEMA = `
 CREATE TABLE IF NOT EXISTS managed_github_metadata (
@@ -32,6 +41,12 @@ CREATE TABLE IF NOT EXISTS managed_github_metadata (
   fetched_at INTEGER NOT NULL,
   attempted_at INTEGER
 ) STRICT;
+CREATE TABLE IF NOT EXISTS managed_github_repository_visibility (
+  repo_id INTEGER PRIMARY KEY,
+  github TEXT NOT NULL,
+  is_public INTEGER NOT NULL CHECK (is_public IN (0, 1)),
+  checked_at INTEGER NOT NULL
+) STRICT;
 `
 
 export function githubMetadataMethods(db: ManagedSql): GithubMetadataStore {
@@ -49,6 +64,16 @@ export function githubMetadataMethods(db: ManagedSql): GithubMetadataStore {
   // The monotonic guard preserves a newer attempt recorded by another reader.
   const attempt = db.prepare(`UPDATE managed_github_metadata SET attempted_at = ?
     WHERE cache_key IN (SELECT value FROM json_each(?)) AND (attempted_at IS NULL OR attempted_at < ?)`)
+  const visibility = db.prepare(`SELECT repo_id AS repoId, github, is_public AS public, checked_at AS checkedAt
+    FROM managed_github_repository_visibility WHERE repo_id IN (SELECT CAST(value AS BIGINT) FROM json_each(?))`)
+  const setVisibility = db.prepare(`INSERT INTO managed_github_repository_visibility (repo_id, github, is_public, checked_at)
+    SELECT CAST(json_extract(e.value, '$.repoId') AS BIGINT), json_extract(e.value, '$.github'),
+      CAST(json_extract(e.value, '$.public') AS BIGINT), CAST(json_extract(e.value, '$.checkedAt') AS BIGINT)
+    FROM json_each(:contexts) e WHERE 1 = 1
+    ON CONFLICT (repo_id) DO UPDATE SET github = excluded.github, is_public = excluded.is_public, checked_at = excluded.checked_at
+    WHERE managed_github_repository_visibility.checked_at < excluded.checked_at
+      OR (managed_github_repository_visibility.checked_at = excluded.checked_at
+        AND (managed_github_repository_visibility.is_public = 1 OR excluded.is_public = 0))`)
   return {
     async listGithubMetadata(keys) {
       if (keys.length === 0) return []
@@ -61,5 +86,13 @@ export function githubMetadataMethods(db: ManagedSql): GithubMetadataStore {
     async recordGithubMetadataAttempts(keys, attemptedAt) {
       if (keys.length > 0) await attempt.run(attemptedAt, JSON.stringify(keys), attemptedAt)
     },
+    async listGithubRepositoryVisibility(repoIds) {
+      if (repoIds.length === 0) return []
+      const rows = await visibility.all(JSON.stringify(repoIds)) as (Omit<GithubRepositoryVisibility, 'public'> & { public: number })[]
+      return rows.map(row => ({ ...row, public: row.public === 1 }))
+    },
+    async setGithubRepositoryVisibility(entries) {
+      if (entries.length > 0) await setVisibility.run({ contexts: JSON.stringify(entries.map(entry => ({ ...entry, public: entry.public ? 1 : 0 }))) })
+    },
   }
 }

package/server-managed/github-pulls.ts

@@ -1,25 +1,115 @@
 import { type GithubFixRef, type GithubFixResult, type GithubFixStatus, githubIssueClosedReason, isGithubRepoName, parseGithubFixUrl } from '../common/github-pr.ts'
 import type { ManagedConfig } from './config.ts'
 import type { ManagedDb, TeamReportAccessSnapshot } from './db.ts'
-import type { GithubMetadata } from './github-metadata.ts'
+import type { GithubMetadata, GithubRepositoryVisibility } from './github-metadata.ts'
 import { ensureUserAccessToken } from './github-oauth.ts'
 
 type Metadata = Pick<GithubMetadata, 'title' | 'description' | 'status' | 'stateReason'>
 const MAX_GITHUB_LOOKUPS = 200
 const GITHUB_LOOKUP_TIMEOUT_MS = 10_000
 const GITHUB_METADATA_TTL_MS = 60_000
+const GITHUB_PUBLIC_VISIBILITY_TTL_MS = 60_000
+const GITHUB_PRIVATE_REPOSITORIES_URL = 'https://api.github.com/user/repos?visibility=private&per_page=100&page=1'
+
+type Repository = TeamReportAccessSnapshot['repositories'][number]
+type RepositoryPayload = { id?: unknown; full_name?: unknown; private?: unknown; visibility?: unknown; permissions?: { pull?: unknown } }
+type RepositoryChecks = { remaining: number; verified: Set<string> }
+type RepositoryAccessContext = {
+  db: ManagedDb
+  visibility: GithubRepositoryVisibility[]
+  publicRepos: Set<string>
+  token: string | null
+  signal: AbortSignal
+  fetchImpl: typeof fetch
+  checks: RepositoryChecks
+  includePrivateList?: boolean
+}
+
+function githubRequest(token: string | null): RequestInit {
+  return {
+    headers: {
+      ...(token ? { authorization: `Bearer ${token}` } : {}), accept: 'application/vnd.github+json',
+      'user-agent': 'deepview-triage', 'x-github-api-version': '2022-11-28',
+    },
+    redirect: 'error',
+  }
+}
+
+function repositoryMatches(repo: Repository, body: RepositoryPayload | null): boolean {
+  return body?.id === repo.repoId && typeof body.full_name === 'string' && body.full_name.toLowerCase() === repo.github.toLowerCase()
+}
+
+async function listPrivateRepositories(token: string, signal: AbortSignal, fetchImpl: typeof fetch): Promise<(RepositoryPayload | null)[]> {
+  try {
+    const response = await fetchImpl(GITHUB_PRIVATE_REPOSITORIES_URL, githubRequest(token))
+    if (!response.ok) return []
+    const body = await response.json() as (RepositoryPayload | null)[] | null
+    return Array.isArray(body) && body.length <= 100 && !signal.aborted ? body : []
+  } catch { return [] } // A failed list is unknown access; direct checks can still verify it.
+}
+
+// Public visibility can be reused briefly across users. Private access stays
+// request-local: one page of the viewer's own repo list grants matching repos,
+// then direct checks cover omissions, pagination and failed list requests.
+async function readableRepositories(repositories: Repository[], { db, visibility, publicRepos, token, signal, fetchImpl, checks, includePrivateList = true }: RepositoryAccessContext): Promise<Set<string>> {
+  const readable = new Set(publicRepos)
+  const byId = new Map(repositories.map(repo => [repo.repoId, repo]))
+  const unverified = repositories.filter(repo => !readable.has(repo.github))
+  const updates = new Map<number, GithubRepositoryVisibility>()
+  const grant = (repo: Repository, body: RepositoryPayload, checkedAt: number) => {
+    const isPublic = body.private === false && body.visibility === 'public'
+    readable.add(repo.github)
+    checks.verified.add(repo.github)
+    if (isPublic) publicRepos.add(repo.github)
+    updates.set(repo.repoId, { repoId: repo.repoId, github: repo.github, public: isPublic, checkedAt })
+  }
+  if (includePrivateList && token && unverified.length > 0 && !signal.aborted) {
+    const checkedAt = Date.now()
+    for (const entry of await listPrivateRepositories(token, signal, fetchImpl)) {
+      const repo = typeof entry?.id === 'number' ? byId.get(entry.id) : undefined
+      if (repo && !readable.has(repo.github) && repositoryMatches(repo, entry) && entry?.permissions?.pull === true) grant(repo, entry, checkedAt)
+    }
+  }
+  const formerlyPublic = new Set(visibility.filter(entry => entry.public
+    && byId.get(entry.repoId)?.github.toLowerCase() === entry.github.toLowerCase()).map(entry => entry.repoId))
+  const pending = unverified.filter(repo => !readable.has(repo.github) && (token || formerlyPublic.has(repo.repoId))).slice(0, checks.remaining)
+  checks.remaining -= pending.length
+  for (let i = 0; i < pending.length && !signal.aborted; i += 4) {
+    await Promise.all(pending.slice(i, i + 4).map(async repo => {
+      if (signal.aborted) return
+      const checkedAt = Date.now()
+      try {
+        const response = await fetchImpl(`https://api.github.com/repos/${repo.github}`, githubRequest(token))
+        if (!response.ok) return
+        const body = await response.json() as RepositoryPayload | null
+        if (!signal.aborted && body && repositoryMatches(repo, body)
+          && (token || (body.private === false && body.visibility === 'public'))) grant(repo, body, checkedAt)
+      } catch { /* Unverified access must never expose cached metadata. */ }
+    }))
+  }
+  if (updates.size > 0) await db.setGithubRepositoryVisibility([...updates.values()])
+  return readable
+}
+
+async function verifyPublicRefreshes(config: ManagedConfig, userId: string, repositories: Repository[], context: RepositoryAccessContext): Promise<string | null> {
+  // Cached public metadata needs no credentials. New content uses a viewer
+  // token only after a live check, so privatization cannot publish private data
+  // under an old public grant. Anonymous reads remain available without a token.
+  const { db, publicRepos } = context
+  const token = context.token ?? await ensureUserAccessToken(config, db, userId, Date.now(), context.fetchImpl)
+  if (token) {
+    const currentPublic = new Set<string>()
+    const readable = await readableRepositories(repositories, { ...context, publicRepos: currentPublic, token, includePrivateList: false })
+    for (const repo of repositories) if (readable.has(repo.github) && !currentPublic.has(repo.github)) publicRepos.delete(repo.github)
+  }
+  return token
+}
 
 // ref.repo is always the canonical name from managed_selected_repo, never an
 // owner/repo/path taken from a Fix URL. Redirects cannot move the user token.
-async function fetchMetadata(ref: GithubFixRef, token: string, fetchImpl: typeof fetch): Promise<Metadata | null> {
+async function fetchMetadata(ref: GithubFixRef, token: string | null, fetchImpl: typeof fetch): Promise<Metadata | null> {
   try {
-    const response = await fetchImpl(`https://api.github.com/repos/${ref.repo}/${ref.kind === 'pull' ? 'pulls' : 'issues'}/${ref.number}`, {
-      headers: {
-        authorization: `Bearer ${token}`, accept: 'application/vnd.github+json',
-        'user-agent': 'deepview-triage', 'x-github-api-version': '2022-11-28',
-      },
-      redirect: 'error',
-    })
+    const response = await fetchImpl(`https://api.github.com/repos/${ref.repo}/${ref.kind === 'pull' ? 'pulls' : 'issues'}/${ref.number}`, githubRequest(token))
     if (!response.ok) return null
     const body = await response.json() as { number?: unknown; title?: unknown; body?: unknown; state?: unknown; merged?: unknown;
       draft?: unknown; base?: { repo?: { full_name?: unknown } }; repository_url?: unknown; pull_request?: unknown; state_reason?: unknown } | null
@@ -43,8 +133,8 @@ async function fetchMetadata(ref: GithubFixRef, token: string, fetchImpl: typeof
 }
 
 // The workspace handler checks user -> team membership and finding visibility.
-// Every shared cache read is additionally restricted to that team’s repositories,
-// including for admins; cached metadata is never itself an access grant.
+// Shared private metadata also requires this viewer's live GitHub access,
+// including for admins. Only recently verified public repos skip that check.
 export async function lookupFixes(config: ManagedConfig, db: ManagedDb, snapshot: TeamReportAccessSnapshot, urls: string[], fetchImpl: typeof fetch = globalThis.fetch): Promise<GithubFixResult[]> {
   const allowed = new Map(snapshot.repositories.filter(repo => isGithubRepoName(repo.github)).map(repo => [repo.github.toLowerCase(), repo]))
   const parsed = urls.map(parseGithubFixUrl)
@@ -56,13 +146,34 @@ export async function lookupFixes(config: ManagedConfig, db: ManagedDb, snapshot
     jobs.set(key, { ...ref, repo: repo.github })
     return key
   })
-  const metadata = new Map((await db.listGithubMetadata([...jobs.keys()])).map(entry => [entry.key, entry]))
+  if (jobs.size === 0) return []
   const now = Date.now()
+  const signal = AbortSignal.timeout(GITHUB_LOOKUP_TIMEOUT_MS)
+  const fetchWithinDeadline: typeof fetch = (input, init) => {
+    signal.throwIfAborted()
+    return fetchImpl(input, { ...init, signal })
+  }
+  const repositories = [...new Map([...jobs.values()].map(ref => {
+    const repo = allowed.get(ref.repo.toLowerCase())!
+    return [repo.repoId, repo] as const
+  })).values()]
+  const visibility = await db.listGithubRepositoryVisibility(repositories.map(repo => repo.repoId))
+  const byId = new Map(repositories.map(repo => [repo.repoId, repo]))
+  const publicRepos = new Set(visibility.filter(entry => entry.public && entry.checkedAt <= now
+    && entry.checkedAt + GITHUB_PUBLIC_VISIBILITY_TTL_MS > now
+    && byId.get(entry.repoId)?.github.toLowerCase() === entry.github.toLowerCase()).map(entry => byId.get(entry.repoId)!.github))
+  let token = repositories.some(repo => !publicRepos.has(repo.github))
+    ? await ensureUserAccessToken(config, db, snapshot.user.id, now, fetchWithinDeadline) : null
+  const checks: RepositoryChecks = { remaining: MAX_GITHUB_LOOKUPS, verified: new Set() }
+  const context = { db, visibility, publicRepos, token, signal, fetchImpl: fetchWithinDeadline, checks }
+  const readable = await readableRepositories(repositories, context)
+  const authorized = [...jobs.entries()].filter(([, ref]) => readable.has(ref.repo))
+  const metadata = new Map((await db.listGithubMetadata(authorized.map(([key]) => key))).map(entry => [entry.key, entry]))
   const lastCheckedAt = (key: string) => {
     const cached = metadata.get(key)
     return Math.max(cached?.fetchedAt ?? 0, cached?.attemptedAt ?? 0)
   }
-  const pending = [...jobs.entries()].filter(([key, ref]) => {
+  const pending = authorized.filter(([key, ref]) => {
     const cached = metadata.get(key)
     // Backfill closed issues cached before closure reasons existed, within the
     // same authorized/capped queue. Even an unknown reason completes backfill.
@@ -72,25 +183,18 @@ export async function lookupFixes(config: ManagedConfig, db: ManagedDb, snapshot
   // Only stale/missing, distinct, authorized entries consume the request budget.
   // Prioritize missing/oldest entries so a large workspace makes progress.
   if (pending.length > 0) {
-    const signal = AbortSignal.timeout(GITHUB_LOOKUP_TIMEOUT_MS)
-    const fetchWithinDeadline: typeof fetch = (input, init) => {
-      signal.throwIfAborted()
-      return fetchImpl(input, { ...init, signal })
-    }
-    const token = await ensureUserAccessToken(config, db, snapshot.user.id, now, fetchWithinDeadline)
+    const publicRefreshes = new Set(pending.filter(([, ref]) => publicRepos.has(ref.repo) && !checks.verified.has(ref.repo)).map(([, ref]) => ref.repo))
+    if (publicRefreshes.size > 0) token = await verifyPublicRefreshes(config, snapshot.user.id, repositories.filter(repo => publicRefreshes.has(repo.github)), context)
     const fresh: Omit<GithubMetadata, 'attemptedAt'>[] = []
     const attempted: string[] = []
-    if (token) {
-      // Token refresh and all waves share one deadline, with at most four
-      // upstream calls in flight. Failure retains even stale cached metadata.
-      for (let i = 0; i < pending.length && !signal.aborted; i += 4) {
-        await Promise.all(pending.slice(i, i + 4).map(async ([key, ref]) => {
-          if (signal.aborted) return
-          if (metadata.has(key)) attempted.push(key)
-          const result = await fetchMetadata(ref, token, fetchWithinDeadline)
-          if (result) fresh.push({ key, ...result, fetchedAt: Date.now() })
-        }))
-      }
+    // All waves and access checks share one deadline and four-call limit.
+    for (let i = 0; i < pending.length && !signal.aborted; i += 4) {
+      await Promise.all(pending.slice(i, i + 4).map(async ([key, ref]) => {
+        if (signal.aborted) return
+        if (metadata.has(key)) attempted.push(key)
+        const result = await fetchMetadata(ref, publicRepos.has(ref.repo) && !checks.verified.has(ref.repo) ? null : token, fetchWithinDeadline)
+        if (result) fresh.push({ key, ...result, fetchedAt: Date.now() })
+      }))
     }
     // Only started cached reads rotate. Missing entries retain priority, and
     // jobs skipped by the cap, deadline or absent token keep their place.
@@ -101,6 +205,14 @@ export async function lookupFixes(config: ManagedConfig, db: ManagedDb, snapshot
       for (const entry of await db.listGithubMetadata(fresh.map(row => row.key))) metadata.set(entry.key, entry)
     }
   }
+  if (publicRepos.size > 0) {
+    // Another request may already have discovered a public -> private change
+    // and written new private metadata. Honor that newer visibility observation.
+    const current = await db.listGithubRepositoryVisibility(repositories.filter(repo => publicRepos.has(repo.github)).map(repo => repo.repoId))
+    const stillPublic = new Set(current.filter(entry => entry.public
+      && byId.get(entry.repoId)?.github.toLowerCase() === entry.github.toLowerCase()).map(entry => byId.get(entry.repoId)!.github))
+    for (const [key, ref] of authorized) if (publicRepos.has(ref.repo) && !stillPublic.has(ref.repo)) metadata.delete(key)
+  }
   // The handler rechecks workspace access and saved Fix links before returning.
   return urls.flatMap((url, index): GithubFixResult[] => {
     const key = keys[index]