github-search-cli 9.8.0 → 9.8.2

package/src/deepdive.ts

@@ -1,5 +1,6 @@
 /** Repo deep-dive — fetch and format rich repo details. */
 import type { Repo } from "./types";
+import { fetchReadme } from "./readme";
 
 const USER_AGENT = "ghfind/1.0";
 
@@ -56,11 +57,29 @@ export function repoFromRef(fullName: string): Repo {
   };
 }
 
+/** Repo payload as returned by GET /repos/{owner}/{repo}. */
+interface GitHubRepoApi {
+  description: string | null;
+  html_url: string;
+  stargazers_count: number;
+  forks_count: number;
+  subscribers_count?: number;
+  language: string | null;
+  topics?: string[];
+  archived: boolean;
+  fork: boolean;
+  private?: boolean;
+  created_at: string;
+  updated_at: string;
+  pushed_at: string;
+}
+
 /**
  * Resolve a repo ref to a real Repo by fetching canonical metadata from the
- * GitHub API. Returns a stub via repoFromRef when the metadata fetch fails
- * (offline, rate limit) — the ref is still validated first. Deep-dive
- * sub-fetches tolerate missing data either way.
+ * GitHub API. The ref is validated first. Only transport-level failures
+ * (offline, unparseable body) degrade to a stub via repoFromRef — an auth
+ * error or a rate limit is surfaced, because a stub with `stars: 0` is
+ * indistinguishable from a real repo with no data.
  */
 export async function resolveRepoFromRef(
   fullName: string,
@@ -68,58 +87,50 @@ export async function resolveRepoFromRef(
 ): Promise<Repo> {
   const ref = parseRepoRef(fullName); // throws for malformed refs
   const canonical = `${ref.owner}/${ref.name}`;
+
+  let res: Response;
   try {
-    const res = await fetch(`https://api.github.com/repos/${canonical}`, {
+    res = await fetch(`https://api.github.com/repos/${canonical}`, {
       headers: buildHeaders(token),
     });
-    if (res.status === 404) {
-      throw new Error(`Repo not found: ${canonical}`);
-    }
-    if (res.ok) {
-      const api = (await res.json()) as {
-        description: string | null;
-        html_url: string;
-        stargazers_count: number;
-        forks_count: number;
-        subscribers_count?: number;
-        language: string | null;
-        topics?: string[];
-        archived: boolean;
-        fork: boolean;
-        created_at: string;
-        updated_at: string;
-        pushed_at: string;
-      };
-      return {
-        id: 0,
-        fullName: canonical,
-        name: ref.name,
-        owner: ref.owner,
-        description: api.description,
-        url: api.html_url,
-        stars: api.stargazers_count ?? 0,
-        forks: api.forks_count ?? 0,
-        watchers: api.subscribers_count ?? 0,
-        language: api.language,
-        topics: api.topics ?? [],
-        archived: api.archived ?? false,
-        isFork: api.fork ?? false,
-        private: false,
-        createdAt: api.created_at ?? "",
-        updatedAt: api.updated_at ?? "",
-        pushedAt: api.pushed_at ?? "",
-        score: 0,
-      };
-    }
-  } catch (err) {
-    // Let the not-found error propagate; only network/parse failures degrade
-    // to the stub below.
-    if (err instanceof Error && err.message.startsWith("Repo not found")) {
-      throw err;
-    }
-    // Fall through to the stub.
+  } catch {
+    return repoFromRef(canonical);
+  }
+
+  if (res.status === 404) {
+    throw new Error(`Repo not found: ${canonical}`);
+  }
+  if (!res.ok) {
+    throw new Error(`GitHub API error ${res.status} for ${canonical}`);
+  }
+
+  let api: GitHubRepoApi;
+  try {
+    api = (await res.json()) as GitHubRepoApi;
+  } catch {
+    return repoFromRef(canonical);
   }
-  return repoFromRef(canonical);
+
+  return {
+    id: 0,
+    fullName: canonical,
+    name: ref.name,
+    owner: ref.owner,
+    description: api.description,
+    url: api.html_url,
+    stars: api.stargazers_count ?? 0,
+    forks: api.forks_count ?? 0,
+    watchers: api.subscribers_count ?? 0,
+    language: api.language,
+    topics: api.topics ?? [],
+    archived: api.archived ?? false,
+    isFork: api.fork ?? false,
+    private: api.private ?? false,
+    createdAt: api.created_at ?? "",
+    updatedAt: api.updated_at ?? "",
+    pushedAt: api.pushed_at ?? "",
+    score: 0,
+  };
 }
 
 /** Language breakdown: { [lang]: bytes } */
@@ -176,21 +187,14 @@ export async function fetchDeepDiveRaw(
     ),
   ]);
 
-  // README with branch fallback: main → master → README.rst
-  let readmeText = "";
-  for (const path of [
-    `${repo.owner}/${repo.name}/main/README.md`,
-    `${repo.owner}/${repo.name}/master/README.md`,
-    `${repo.owner}/${repo.name}/main/README.rst`,
-  ]) {
-    const r = await fetch(`https://raw.githubusercontent.com/${path}`, {
-      headers,
-    });
-    if (r.ok) {
-      readmeText = await r.text();
-      break;
-    }
-  }
+  // README: main → master → README.rst, probed in parallel by fetchReadme.
+  // Public READMEs are served unauthenticated, so the token is only forwarded
+  // to raw.githubusercontent.com when the repo actually needs it.
+  const readme = await fetchReadme(repo.owner, repo.name, {
+    token: repo.private ? token : undefined,
+    private: repo.private,
+  });
+  const readmeText = readme?.text ?? "";
 
   const langEntries: [string, number][] = languagesRes.ok
     ? Object.entries(

package/src/doctor.ts

@@ -11,6 +11,7 @@ import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { homedir, platform, arch } from "node:os";
 import { loadConfig, configPath, stateDir, cacheDir } from "./config";
+import { maskToken } from "./login";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const PKG_DIR = join(__dirname, "..");
@@ -212,8 +213,8 @@ function checkGithubToken(): void {
   const config = loadConfig();
   const token = config.githubToken || process.env.GITHUB_TOKEN;
   if (token) {
-    const preview = token.slice(0, 7);
-    add("PASS", "GitHub token", `Configured (${preview}…).`);
+    const preview = maskToken(token);
+    add("PASS", "GitHub token", `Configured (${preview}).`);
   } else {
     add(
       "WARN",

package/src/error-report.ts

@@ -3,7 +3,8 @@
  * error, print it, and offer to open it in the user's browser.
  *
  * Privacy: never auto-posts. The user sees the URL and decides whether to
- * submit. We redact env vars and only include what the diagnostic needs.
+ * submit. Credentials found in argv or the error text are redacted before
+ * they can reach the URL, and a redacted report is never auto-opened.
  */
 import {
   platform as osPlatform,
@@ -24,6 +25,59 @@ void _osArch;
 const REPO = "codersdfs/search-cli";
 const NEW_ISSUE_URL = `https://github.com/${REPO}/issues/new`;
 
+const SECRET_PLACEHOLDER = "***";
+
+/** Flags whose *next* argument is a credential. */
+const SECRET_FLAGS = /^(?:--token|-t)$/;
+
+/** GitHub credential shapes: classic (ghp_/gho_/ghu_/ghs_/ghr_) and fine-grained. */
+const SECRET_PATTERNS: RegExp[] = [
+  /gh[pousr]_[A-Za-z0-9]{16,}/g,
+  /github_pat_[A-Za-z0-9_]{20,}/g,
+];
+
+/** Replace anything that looks like a token inside a free-form string. */
+export function redactSecrets(text: string): string {
+  let out = text;
+  for (const pattern of SECRET_PATTERNS) {
+    out = out.replace(pattern, SECRET_PLACEHOLDER);
+  }
+  return out;
+}
+
+/**
+ * Redact an argv: the value following a credential flag, `--token=…`/`-t=…`
+ * forms, and any bare argument that looks like a token.
+ */
+export function redactArgv(argv: string[]): string[] {
+  const out: string[] = [];
+  let redactNext = false;
+  for (const arg of argv) {
+    if (redactNext) {
+      out.push(SECRET_PLACEHOLDER);
+      redactNext = false;
+      continue;
+    }
+    if (SECRET_FLAGS.test(arg)) {
+      out.push(arg);
+      redactNext = true;
+      continue;
+    }
+    const eq = arg.indexOf("=");
+    if (eq > 0 && SECRET_FLAGS.test(arg.slice(0, eq))) {
+      out.push(`${arg.slice(0, eq)}=${SECRET_PLACEHOLDER}`);
+      continue;
+    }
+    out.push(redactSecrets(arg));
+  }
+  return out;
+}
+
+/** True when `argv` carries a credential that redaction would remove. */
+function argvHasSecret(argv: string[]): boolean {
+  return redactArgv(argv).some((arg, i) => arg !== argv[i]);
+}
+
 function getPackageVersion(): string {
   return getVersion();
 }
@@ -43,10 +97,12 @@ export function formatErrorBody(
   context: { command: string; argv: string[] },
 ): string {
   const e = err instanceof Error ? err : new Error(String(err));
-  // biome-ignore lint/suspicious/noControlCharactersInRegex: strips ANSI color escapes from stack traces
-  const stack = (e.stack ?? "(no stack)").replace(/\u001b\[[0-9;]*m/g, "");
-  const message = (e.message || "(no message)").slice(0, 500);
-  const cmd = `${context.command} ${context.argv.join(" ")}`.trim();
+  const stack = redactSecrets(
+    // biome-ignore lint/suspicious/noControlCharactersInRegex: strips ANSI color escapes from stack traces
+    (e.stack ?? "(no stack)").replace(/\u001b\[[0-9;]*m/g, ""),
+  );
+  const message = redactSecrets(e.message || "(no message)").slice(0, 500);
+  const cmd = `${context.command} ${redactArgv(context.argv).join(" ")}`.trim();
   const ghfindVersion = getPackageVersion();
 
   return [
@@ -88,7 +144,9 @@ export function buildIssueUrl(
   context: { command: string; argv: string[] },
 ): string {
   const e = err instanceof Error ? err : new Error(String(err));
-  const title = e.message.slice(0, 80).replace(/[\r\n]+/g, " ");
+  const title = redactSecrets(e.message)
+    .slice(0, 80)
+    .replace(/[\r\n]+/g, " ");
   const body = formatErrorBody(err, context);
   const params = new URLSearchParams({
     title: `[bug] ${title || "Unhandled error"}`,
@@ -138,15 +196,27 @@ export function reportError(
     argv: process.argv.slice(2),
   },
 ): string {
-  const url = buildIssueUrl(err, context);
+  const hadSecret = argvHasSecret(context.argv);
+  // Build the URL from the scrubbed argv, never the raw one.
+  const url = buildIssueUrl(err, {
+    command: context.command,
+    argv: redactArgv(context.argv),
+  });
   console.error("");
   console.error("  ⚠  ghfind encountered an unexpected error.");
   console.error("");
-  console.error("  Help us fix it by opening a bug report with the");
-  console.error("  details pre-filled. Your browser will open the new-issue");
-  console.error("  page; review and submit (or close the tab to skip).");
+  if (hadSecret) {
+    console.error("  A token was found in the command line and has been");
+    console.error("  redacted. Your browser will NOT be opened — review the");
+    console.error("  scrubbed URL below before sharing it anywhere.");
+  } else {
+    console.error("  Help us fix it by opening a bug report with the");
+    console.error("  details pre-filled. Your browser will open the new-issue");
+    console.error("  page; review and submit (or close the tab to skip).");
+  }
   console.error("");
-  const opened = tryOpenUrl(url);
+  // Never auto-open a report that contained a credential.
+  const opened = hadSecret ? false : tryOpenUrl(url);
   if (opened) {
     console.error(`  → Opened: ${url}`);
   } else {

package/src/errors.ts

@@ -4,7 +4,6 @@ export class SearchCliError extends Error {
   constructor(
     message: string,
     public readonly userMessage: string,
-    public readonly recoverable: boolean = true,
   ) {
     super(message);
     this.name = "SearchCliError";

package/src/history.ts

@@ -31,13 +31,10 @@ export function readHistory(): HistoryEntry[] {
 export function deleteHistoryEntry(index: number): void {
   const entries = readHistory();
   if (index < 0 || index >= entries.length) return;
-  const removed = entries[index];
-  const remaining = entries.filter(
-    (e) => e.timestamp !== removed.timestamp || e.query !== removed.query,
-  );
+  entries.splice(index, 1);
   writeRaw(
     HISTORY_FILE,
-    `${remaining
+    `${entries
       .reverse()
       .map((e) => JSON.stringify(e))
       .join("\n")}\n`,

package/src/image-loader.ts

@@ -33,8 +33,37 @@ const RASTER_EXT = /\.(png|jpe?g|webp|gif|bmp|avif|heic|tiff?)(?:[?#]|$)/i;
 /** Cap on memoised downloads — a long session can open many READMEs. */
 const CACHE_LIMIT = 24;
 
+/**
+ * How many image downloads may be in flight at once. A README can reference
+ * dozens of images; firing them all at the same time makes them compete for
+ * bandwidth so the first one lands later, not sooner.
+ */
+export const MAX_CONCURRENT_IMAGE_FETCHES = 4;
+
 const cache = new Map<string, Promise<Uint8Array | null>>();
 
+let activeFetches = 0;
+const waiting: Array<() => void> = [];
+
+/** Hand the next queued caller its turn, if the cap allows it. */
+function releaseSlot(): void {
+  activeFetches--;
+  waiting.shift()?.();
+}
+
+/** Run `job` as soon as fewer than the cap are already running. */
+async function withSlot<T>(job: () => Promise<T>): Promise<T> {
+  if (activeFetches >= MAX_CONCURRENT_IMAGE_FETCHES) {
+    await new Promise<void>((resolve) => waiting.push(resolve));
+  }
+  activeFetches++;
+  try {
+    return await job();
+  } finally {
+    releaseSlot();
+  }
+}
+
 /** Drop memoised image downloads (used by tests). */
 export function clearImageByteCache(): void {
   cache.clear();
@@ -169,7 +198,7 @@ export async function fetchImageBytes(
 ): Promise<Uint8Array | null> {
   const cached = cache.get(url);
   if (cached) return cached;
-  const pending = loadImageBytes(url, opts);
+  const pending = withSlot(() => loadImageBytes(url, opts));
   cache.set(url, pending);
   // Map iteration order is insertion order, so the first key is the oldest.
   while (cache.size > CACHE_LIMIT) {

package/src/init.ts

@@ -4,7 +4,7 @@
  * ponytail: simple stdin prompts, no curses/readline UI.
  */
 import { createInterface } from "node:readline";
-import { saveConfig } from "./config";
+import { saveConfig, configPath } from "./config";
 import { isLikelyGithubToken } from "./login";
 import { listThemes } from "./themes";
 import type { Config, SortStrategy } from "./types";
@@ -53,7 +53,6 @@ export async function runInitWizard(): Promise<void> {
   if (token) config.githubToken = token;
 
   saveConfig(config);
-  const { configPath } = await import("./config.ts");
   console.log(`  ✓ Config saved to ${configPath()}`);
   console.log("  Run 'ghfind' to start browsing!");
   console.log("");

package/src/markdown-view.ts

@@ -35,6 +35,10 @@ import {
 /** Tallest inline image, in terminal cells. */
 export const MAX_IMAGE_ROWS = 24;
 
+/** Cap on memoised rasters — a resize session re-keys on width, so this
+ *  would otherwise grow without bound. */
+const RASTER_CACHE_LIMIT = 32;
+
 export interface MarkdownViewOptions {
   renderer: CliRenderer;
   /** Theme palette (see src/themes.ts). */
@@ -182,6 +186,13 @@ export function createMarkdownView(opts: MarkdownViewOptions): MarkdownView {
       });
     })();
     rasterCache.set(key, pending);
+    // Map iteration order is insertion order, so the first key is the oldest.
+    // Unbounded growth would re-rasterize every image on every resize.
+    while (rasterCache.size > RASTER_CACHE_LIMIT) {
+      const oldest = rasterCache.keys().next().value;
+      if (oldest === undefined) break;
+      rasterCache.delete(oldest);
+    }
     return pending;
   };
 
@@ -200,9 +211,6 @@ export function createMarkdownView(opts: MarkdownViewOptions): MarkdownView {
 
     void rasterize(url).then(
       (cells) => {
-        console.error(
-          `[dbg] image resolved: cells=${cells ? `${cells.cols}x${cells.rows}` : "null"} destroyed=${container.isDestroyed} parent=${!!container.parent} enabled=${imagesEnabled}`,
-        );
         // The document may have been replaced (or the overlay closed) while
         // the image was downloading.
         if (container.isDestroyed || !container.parent) return;
@@ -223,7 +231,8 @@ export function createMarkdownView(opts: MarkdownViewOptions): MarkdownView {
         renderable.requestRender();
       },
       (err) => {
-        console.error("[dbg] image promise rejected:", err);
+        // Swallow: a failed image should not crash the view.
+        void err;
       },
     );
     return container;
@@ -288,6 +297,13 @@ export function createMarkdownView(opts: MarkdownViewOptions): MarkdownView {
       renderable.fg = text();
       renderable.bg = bg();
       renderable.content = markdown;
+      // Finalize streaming so the last tokens are no longer marked unstable.
+      // Without this, OpenTUI keeps the trailing 2 blocks perpetually
+      // unstable in streaming mode, which recreates image render nodes (and
+      // their pending fetch promises) on every render cycle — the promise
+      // resolves after the loop idles and never settles.
+      renderable.streaming = false;
+      renderable.requestRender();
     },
     setImagesEnabled(enabled: boolean) {
       if (imagesEnabled === enabled) return;

package/src/mcp-server.ts

@@ -17,6 +17,7 @@
  *   ghfind_deep_dive            deepdive.ts
  *   ghfind_bookmarked_releases  releases.ts + bookmarks.ts (read-only)
  *   ghfind_skill                agent-skill.ts
+ *   ghfind_skill_search         skill-finder.ts (local scan | skills.sh HTTP)
  *
  * Only the tools capability is declared (no prompts/resources yet), so those
  * methods fall through to "Method not found".
@@ -47,6 +48,12 @@ import { getBookmarks } from "./bookmarks";
 import { appendHistory } from "./history";
 import { loadConfig } from "./config";
 import { ensureBuiltinSkill, getSkill } from "./agent-skill";
+import {
+  formatSkillSearchText,
+  searchSkills,
+  type SkillSearchResult,
+  type SkillSource,
+} from "./skill-finder";
 import { getVersion } from "./version";
 
 // ─── Protocol constants ────────────────────────────────────────────────
@@ -212,6 +219,8 @@ const TRENDING_QUERY = { keywords: [], qualifiers: [], raw: "trending" };
 // ─── Tool registry ─────────────────────────────────────────────────────
 
 const REPO_SORTS = ["best-match", "stars", "updated", "forks"] as const;
+/** Skill search sources: this machine, or the public skills.sh ecosystem. */
+const SKILL_SOURCES = ["local", "registry"] as const;
 const TRENDING_SINCE = ["daily", "weekly", "monthly"] as const;
 const PKG_SORTS = ["best-match", "score", "downloads", "name"] as const;
 
@@ -501,19 +510,14 @@ const TOOLS: ToolDefinition[] = [
         throw new McpToolError("repos must contain 2-5 repo fullNames.");
       }
       const token = resolveToken(state, args.token);
-      const provider = createGitHubSearch(undefined, token ? [token] : []);
       const found: Repo[] = [];
       const missing: string[] = [];
       for (const fullName of names) {
-        const res = await provider.search(parseQuery(fullName), {
-          limit: 1,
-          sort: "stars",
-          json: false,
-          verbose: false,
-          token,
-        });
-        if (res.repos.length > 0) found.push(res.repos[0]);
-        else missing.push(fullName);
+        try {
+          found.push(await resolveRepoFromRef(fullName, token));
+        } catch {
+          missing.push(fullName);
+        }
       }
       if (found.length < 2) {
         throw new McpToolError(
@@ -599,6 +603,56 @@ const TOOLS: ToolDefinition[] = [
       };
     },
   },
+  {
+    name: "ghfind_skill_search",
+    title: "Search agent skills",
+    description:
+      "Search installed agent skills (SKILL.md files under the user's skill directories) or the public skills.sh ecosystem by keyword, and return matching skills with their descriptions. Read-only: it never installs anything - registry hits include the `npx skills add` command for the user to run deliberately. Use when the user asks to find a skill for a task, or asks what skills are available.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        query: {
+          type: "string",
+          description:
+            'Keyword to match against skill names and descriptions, e.g. "changelog" or "testing" (2+ characters).',
+        },
+        source: {
+          type: "string",
+          description:
+            "Where to search: 'local' for skills installed on this machine (default), 'registry' for the public skills.sh ecosystem.",
+          enum: [...SKILL_SOURCES],
+        },
+        limit: {
+          type: "number",
+          description: "Max results, 1-100 (default 20).",
+          minimum: 1,
+          maximum: 100,
+        },
+      },
+      required: ["query"],
+    },
+    async run(args) {
+      const source = coerceEnum<SkillSource>(
+        args.source,
+        SKILL_SOURCES,
+        "local",
+      );
+      const limit = coerceInt(args.limit, 20, 1, 100);
+      const result: SkillSearchResult = await searchSkills(
+        String(args.query ?? ""),
+        { source, limit },
+      );
+      const where =
+        result.source === "local"
+          ? "installed skills on this machine"
+          : "the public skills.sh ecosystem";
+      const header = `${result.count} match(es) for "${result.query}" in ${where}:`;
+      return {
+        text: `${header}\n\n${formatSkillSearchText(result)}`,
+        data: { ...result },
+      };
+    },
+  },
 ];
 
 /** Tools/list payload (name, title, description, inputSchema only). */
@@ -737,6 +791,7 @@ export async function processServerLine(
           },
           instructions:
             "ghfind gives agents GitHub search: repositories, trending, npm packages, org/user profiles, repo comparison and deep-dives. " +
+            "ghfind_skill_search finds agent skills, either installed on this machine or in the public skills.sh ecosystem. " +
             "Call ghfind_skill for the full CLI guide. Unauthenticated requests are rate-limited to 60/hr; pass a token or set GITHUB_TOKEN for 5,000/hr.",
         }),
       );

package/src/notifications.ts

@@ -12,10 +12,14 @@ export interface Notification {
 
 let nextId = 1;
 let notifs: Notification[] = [];
+let loaded = false;
 const MAX_NOTIFS = 50;
 const FILE = "notifications.json";
 
-function load(): void {
+/** Load once per process: re-reading on an empty list would reissue ids. */
+function ensureLoaded(): void {
+  if (loaded) return;
+  loaded = true;
   notifs = readJSON<Notification[]>(FILE, []);
   nextId = Math.max(...notifs.map((n) => n.id), 0) + 1;
 }
@@ -28,7 +32,7 @@ export function addNotification(
   type: Notification["type"],
   message: string,
 ): Notification {
-  if (notifs.length === 0) load();
+  ensureLoaded();
   const n: Notification = {
     id: nextId++,
     type,
@@ -60,16 +64,18 @@ function iconFor(type: Notification["type"]): string {
 }
 
 export function getNotifications(): Notification[] {
-  if (notifs.length === 0) load();
+  ensureLoaded();
   return [...notifs];
 }
 
 export function dismissNotification(id: number): void {
+  ensureLoaded();
   notifs = notifs.filter((n) => n.id !== id);
   save();
 }
 
 export function dismissAll(): void {
+  ensureLoaded();
   notifs = [];
   save();
 }

package/src/org.ts

@@ -171,20 +171,21 @@ export async function fetchOrgProfile(
   if (orgPayload.public_repos > 0) {
     const perPage = Math.min(limit, 100);
     const maxPages = Math.ceil(limit / perPage);
-    for (let page = 1; page <= maxPages; page++) {
-      const url =
-        `https://api.github.com/orgs/${encodeURIComponent(name)}/repos` +
-        `?per_page=${perPage}&sort=pushed&page=${page}`;
-      const res = await fetch(url, { headers: apiHeaders(token) });
-      if (!res.ok) {
-        // Org metadata succeeded; degraded summary beats a hard failure.
-        break;
-      }
-      const items = (await res.json()) as GitHubRepoPayload[];
-      if (!Array.isArray(items)) break; // unexpected shape — degrade gracefully
-      repos.push(...items);
-      if (repos.length >= limit || items.length < perPage) break;
-    }
+    const pages = await Promise.all(
+      Array.from({ length: maxPages }, (_, i) => i + 1).map(async (page) => {
+        const url =
+          `https://api.github.com/orgs/${encodeURIComponent(name)}/repos` +
+          `?per_page=${perPage}&sort=pushed&page=${page}`;
+        const res = await fetch(url, { headers: apiHeaders(token) });
+        if (!res.ok) {
+          // Org metadata succeeded; degraded summary beats a hard failure.
+          return [];
+        }
+        const items = (await res.json()) as GitHubRepoPayload[];
+        return Array.isArray(items) ? items : []; // unexpected shape — skip
+      }),
+    );
+    repos.push(...pages.flat());
   }
 
   return normalizeOrg(orgPayload, repos.slice(0, limit));