webctx 0.2.1

package/internal/app/github_packages_projects.go

@@ -0,0 +1,429 @@
+package app
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/url"
+	"strconv"
+	"strings"
+)
+
+var githubPackageTypes = map[string]struct{}{
+	"container": {}, "docker": {}, "maven": {}, "npm": {}, "nuget": {}, "rubygems": {},
+}
+
+type githubPackage struct {
+	ID           int64      `json:"id"`
+	Name         string     `json:"name"`
+	PackageType  string     `json:"package_type"`
+	HTMLURL      string     `json:"html_url"`
+	Visibility   string     `json:"visibility"`
+	Description  *string    `json:"description"`
+	VersionCount int        `json:"version_count"`
+	CreatedAt    string     `json:"created_at"`
+	UpdatedAt    string     `json:"updated_at"`
+	Owner        githubUser `json:"owner"`
+	Repository   *struct {
+		FullName string `json:"full_name"`
+		HTMLURL  string `json:"html_url"`
+	} `json:"repository"`
+}
+
+type githubPackageVersion struct {
+	ID             int64  `json:"id"`
+	Name           string `json:"name"`
+	URL            string `json:"url"`
+	PackageHTMLURL string `json:"package_html_url"`
+	CreatedAt      string `json:"created_at"`
+	UpdatedAt      string `json:"updated_at"`
+	Metadata       struct {
+		PackageType string `json:"package_type"`
+		Container   struct {
+			Tags []string `json:"tags"`
+		} `json:"container"`
+	} `json:"metadata"`
+}
+
+type githubProjectV2 struct {
+	ID               string
+	Number           int
+	Title            string
+	ShortDescription string
+	URL              string
+	Public           bool
+	Closed           bool
+	CreatedAt        string
+	UpdatedAt        string
+	Items            []githubProjectV2Item
+	MoreItems        bool
+}
+
+type githubProjectV2Item struct {
+	ID         string
+	Type       string
+	Title      string
+	URL        string
+	State      string
+	Repository string
+	Number     int
+	Body       string
+}
+
+func isSupportedGitHubPackageType(packageType string) bool {
+	_, ok := githubPackageTypes[packageType]
+	return ok
+}
+
+func readGitHubPackage(ctx context.Context, client *GitHubClient, target *GitHubTarget) (string, error) {
+	if target.Fragment != "" {
+		return "", fmt.Errorf("GitHub Package fragment %q is not a supported native selector", target.Fragment)
+	}
+	for key := range target.Query {
+		if key != "page" {
+			return "", fmt.Errorf("GitHub Package query parameter %q is not supported by the native reader", key)
+		}
+	}
+	page := target.Query.Get("page")
+	if page != "" {
+		n, err := strconv.Atoi(page)
+		if err != nil || n <= 0 {
+			return "", fmt.Errorf("invalid GitHub Package page %q", page)
+		}
+	}
+	if len(target.Tail) != 2 {
+		return "", fmt.Errorf("GitHub Package target is missing scope/type identity")
+	}
+	scope, packageType := target.Tail[0], target.Tail[1]
+	base, err := githubPackageAPIBase(scope, target.Owner, packageType, target.Name)
+	if err != nil {
+		return "", err
+	}
+	resp, err := client.REST(ctx, http.MethodGet, base, "application/vnd.github+json")
+	if err != nil {
+		return "", err
+	}
+	var pkg githubPackage
+	if err := json.Unmarshal(resp.Body, &pkg); err != nil {
+		return "", fmt.Errorf("decode GitHub Package: %w", err)
+	}
+	q := url.Values{"per_page": []string{strconv.Itoa(githubPageableListSize)}}
+	if page != "" {
+		q.Set("page", page)
+	}
+	versionsResp, err := client.REST(ctx, http.MethodGet, base+"/versions?"+q.Encode(), "application/vnd.github+json")
+	if err != nil {
+		return "", err
+	}
+	var versions []githubPackageVersion
+	if err := json.Unmarshal(versionsResp.Body, &versions); err != nil {
+		return "", fmt.Errorf("decode GitHub Package versions: %w", err)
+	}
+	return renderGitHubPackage(target, pkg, versions, versionsResp.Links()), nil
+}
+
+func githubPackageAPIBase(scope, owner, packageType, name string) (string, error) {
+	prefix := ""
+	switch scope {
+	case "org":
+		prefix = "/orgs/" + url.PathEscape(owner)
+	case "user":
+		prefix = "/users/" + url.PathEscape(owner)
+	default:
+		return "", fmt.Errorf("unsupported GitHub Package scope %q", scope)
+	}
+	return fmt.Sprintf("%s/packages/%s/%s", prefix, url.PathEscape(packageType), url.PathEscape(name)), nil
+}
+
+func renderGitHubPackage(target *GitHubTarget, pkg githubPackage, versions []githubPackageVersion, links GitHubLinkRelations) string {
+	return renderGitHubPackageWithLimit(target, pkg, versions, links, len(versions))
+}
+
+func renderGitHubPackageWithLimit(target *GitHubTarget, pkg githubPackage, versions []githubPackageVersion, links GitHubLinkRelations, limit int) string {
+	limit = minInt(limit, len(versions))
+	page := target.Query.Get("page")
+	if page == "" {
+		page = "1"
+	}
+	lines := []string{
+		"---",
+		"owner: " + yamlScalar(target.Owner),
+		"package: " + yamlScalar(pkg.Name),
+		"package_type: " + yamlScalar(pkg.PackageType),
+		"visibility: " + yamlScalar(pkg.Visibility),
+		fmt.Sprintf("version_count: %d", pkg.VersionCount),
+		"versions_page: " + page,
+		fmt.Sprintf("versions_returned: %d", len(versions)),
+		fmt.Sprintf("versions_indexed: %d", limit),
+		fmt.Sprintf("versions_local_omitted: %d", len(versions)-limit),
+	}
+	if pkg.Repository != nil && pkg.Repository.FullName != "" {
+		lines = append(lines, "repository: "+yamlScalar(pkg.Repository.FullName))
+	}
+	if pkg.CreatedAt != "" {
+		lines = append(lines, "created: "+yamlScalar(pkg.CreatedAt))
+	}
+	if pkg.UpdatedAt != "" {
+		lines = append(lines, "updated: "+yamlScalar(pkg.UpdatedAt))
+	}
+	if pkg.HTMLURL != "" {
+		lines = append(lines, "url: "+yamlScalar(pkg.HTMLURL))
+	}
+	lines = append(lines, "---", "", "# Package: "+pkg.Name, "")
+	if pkg.Description != nil && strings.TrimSpace(*pkg.Description) != "" {
+		preview, truncated := githubOverviewPreview(stripInvisibleHTMLComments(*pkg.Description), 1200)
+		lines = append(lines, preview, "")
+		if truncated && pkg.HTMLURL != "" {
+			lines = append(lines, "> Package description preview locally truncated. Full package: "+pkg.HTMLURL, "")
+		}
+	}
+	lines = append(lines, "## Versions", "")
+	if len(versions) == 0 {
+		lines = append(lines, "_No package versions returned on this page._")
+	}
+	for _, version := range versions[:limit] {
+		name := version.Name
+		if name == "" {
+			name = fmt.Sprintf("version %d", version.ID)
+		}
+		namePreview, truncated := githubOverviewInlinePreview(name, 120)
+		if truncated {
+			namePreview += "…"
+		}
+		line := "- " + namePreview
+		if len(version.Metadata.Container.Tags) > 0 {
+			tags := make([]string, 0, minInt(5, len(version.Metadata.Container.Tags)))
+			for _, tag := range version.Metadata.Container.Tags[:minInt(5, len(version.Metadata.Container.Tags))] {
+				tagPreview, tagTruncated := githubOverviewInlinePreview(tag, 80)
+				if tagTruncated {
+					tagPreview += "…"
+				}
+				tags = append(tags, tagPreview)
+			}
+			line += " — tags: " + githubOverviewLabelList(tags, 5)
+			if len(version.Metadata.Container.Tags) > 5 {
+				line += fmt.Sprintf(" (+%d more)", len(version.Metadata.Container.Tags)-5)
+			}
+		}
+		if version.UpdatedAt != "" {
+			line += " — updated " + version.UpdatedAt
+		}
+		if version.PackageHTMLURL != "" {
+			line += " — " + version.PackageHTMLURL
+		}
+		lines = append(lines, line)
+	}
+	if nav := renderGitHubUIPageNavigation(target, links); len(nav) > 0 {
+		lines = append(lines, "", "## Version navigation", "")
+		lines = append(lines, nav...)
+	}
+	return strings.TrimSpace(strings.Join(lines, "\n"))
+}
+
+func readGitHubProjectV2(ctx context.Context, client *GitHubClient, target *GitHubTarget) (string, error) {
+	if target.Fragment != "" || len(target.Query) > 0 {
+		return "", fmt.Errorf("GitHub Projects v2 query/fragment selectors are not part of the native project contract")
+	}
+	if len(target.Tail) != 1 || (target.Tail[0] != "org" && target.Tail[0] != "user") {
+		return "", fmt.Errorf("GitHub Projects v2 target is missing owner scope")
+	}
+	project, err := fetchGitHubProjectV2(ctx, client, target)
+	if err != nil {
+		return "", err
+	}
+	return renderGitHubProjectV2(target, project), nil
+}
+
+func fetchGitHubProjectV2(ctx context.Context, client *GitHubClient, target *GitHubTarget) (githubProjectV2, error) {
+	prefix := "/orgs/" + url.PathEscape(target.Owner)
+	if target.Tail[0] == "user" {
+		prefix = "/users/" + url.PathEscape(target.Owner)
+	}
+	base := fmt.Sprintf("%s/projectsV2/%d", prefix, target.Number)
+	projectResp, err := client.RESTPublic(ctx, http.MethodGet, base, "application/vnd.github+json")
+	if err != nil {
+		return githubProjectV2{}, err
+	}
+	var raw struct {
+		ID               int64   `json:"id"`
+		Number           int     `json:"number"`
+		Title            string  `json:"title"`
+		Description      *string `json:"description"`
+		ShortDescription *string `json:"short_description"`
+		Public           bool    `json:"public"`
+		State            string  `json:"state"`
+		CreatedAt        string  `json:"created_at"`
+		UpdatedAt        string  `json:"updated_at"`
+	}
+	if err := json.Unmarshal(projectResp.Body, &raw); err != nil {
+		return githubProjectV2{}, fmt.Errorf("decode GitHub Project v2: %w", err)
+	}
+	description := ""
+	if raw.ShortDescription != nil {
+		description = strings.TrimSpace(*raw.ShortDescription)
+	}
+	if description == "" && raw.Description != nil {
+		description = strings.TrimSpace(*raw.Description)
+	}
+	project := githubProjectV2{
+		ID:               strconv.FormatInt(raw.ID, 10),
+		Number:           raw.Number,
+		Title:            raw.Title,
+		ShortDescription: description,
+		URL:              target.OriginalURL,
+		Public:           raw.Public,
+		Closed:           strings.EqualFold(raw.State, "closed"),
+		CreatedAt:        raw.CreatedAt,
+		UpdatedAt:        raw.UpdatedAt,
+	}
+	itemsResp, err := client.RESTPublic(ctx, http.MethodGet, base+"/items?per_page=50", "application/vnd.github+json")
+	if err != nil {
+		return githubProjectV2{}, err
+	}
+	var rawItems []struct {
+		ID          int64           `json:"id"`
+		ContentType string          `json:"content_type"`
+		Content     json.RawMessage `json:"content"`
+	}
+	if err := json.Unmarshal(itemsResp.Body, &rawItems); err != nil {
+		return githubProjectV2{}, fmt.Errorf("decode GitHub Project v2 items: %w", err)
+	}
+	project.MoreItems = strings.TrimSpace(itemsResp.Links()["next"]) != ""
+	for _, rawItem := range rawItems {
+		item := githubProjectV2Item{ID: strconv.FormatInt(rawItem.ID, 10), Type: rawItem.ContentType}
+		if len(rawItem.Content) > 0 && string(rawItem.Content) != "null" {
+			var content struct {
+				Number        int    `json:"number"`
+				Title         string `json:"title"`
+				Body          string `json:"body"`
+				State         string `json:"state"`
+				HTMLURL       string `json:"html_url"`
+				RepositoryURL string `json:"repository_url"`
+				Repository    *struct {
+					FullName      string `json:"full_name"`
+					NameWithOwner string `json:"nameWithOwner"`
+				} `json:"repository"`
+			}
+			if err := json.Unmarshal(rawItem.Content, &content); err != nil {
+				return githubProjectV2{}, fmt.Errorf("decode GitHub Project v2 item content: %w", err)
+			}
+			item.Title, item.URL, item.State, item.Number, item.Body = content.Title, content.HTMLURL, content.State, content.Number, content.Body
+			if content.Repository != nil {
+				item.Repository = content.Repository.FullName
+				if item.Repository == "" {
+					item.Repository = content.Repository.NameWithOwner
+				}
+			}
+			if item.Repository == "" && content.RepositoryURL != "" {
+				if parsed, parseErr := url.Parse(content.RepositoryURL); parseErr == nil {
+					parts := splitGitHubPath(parsed.Path)
+					if len(parts) >= 3 && parts[0] == "repos" {
+						item.Repository = parts[1] + "/" + parts[2]
+					}
+				}
+			}
+		}
+		project.Items = append(project.Items, item)
+	}
+	return project, nil
+}
+
+func renderGitHubProjectV2(target *GitHubTarget, project githubProjectV2) string {
+	return githubBoundedOverviewList(len(project.Items), 20, func(limit int) string {
+		return renderGitHubProjectV2WithLimit(target, project, limit)
+	})
+}
+
+func renderGitHubProjectV2WithLimit(target *GitHubTarget, project githubProjectV2, limit int) string {
+	limit = minInt(limit, len(project.Items))
+	titlePreview, titleTruncated := githubOverviewInlinePreview(project.Title, 180)
+	if titleTruncated {
+		titlePreview += "…"
+	}
+	lines := []string{
+		"---",
+		"owner: " + yamlScalar(target.Owner),
+		fmt.Sprintf("project: %d", project.Number),
+		"title: " + yamlScalar(titlePreview),
+		fmt.Sprintf("public: %t", project.Public),
+		fmt.Sprintf("closed: %t", project.Closed),
+		fmt.Sprintf("items_returned: %d", len(project.Items)),
+		fmt.Sprintf("items_indexed: %d", limit),
+		fmt.Sprintf("items_local_omitted: %d", len(project.Items)-limit),
+		fmt.Sprintf("more_items_available: %t", project.MoreItems),
+	}
+	if project.CreatedAt != "" {
+		lines = append(lines, "created: "+yamlScalar(project.CreatedAt))
+	}
+	if project.UpdatedAt != "" {
+		lines = append(lines, "updated: "+yamlScalar(project.UpdatedAt))
+	}
+	if project.URL != "" {
+		lines = append(lines, "url: "+yamlScalar(project.URL))
+	}
+	lines = append(lines, "---", "", "# "+titlePreview, "")
+	if strings.TrimSpace(project.ShortDescription) != "" {
+		preview, truncated := githubOverviewPreview(stripInvisibleHTMLComments(project.ShortDescription), 1000)
+		lines = append(lines, preview, "")
+		if truncated && project.URL != "" {
+			lines = append(lines, "> Project description preview locally truncated. Full project: "+project.URL, "")
+		}
+	}
+	lines = append(lines, "## Items", "")
+	if len(project.Items) == 0 {
+		lines = append(lines, "_No Project items returned._")
+	}
+	for _, item := range project.Items[:limit] {
+		label := item.Title
+		if label == "" {
+			label = item.Type
+		}
+		line := "- "
+		labelPreview, truncated := githubOverviewInlinePreview(label, 140)
+		if truncated {
+			labelPreview += "…"
+		}
+		if item.URL != "" {
+			line += "[" + escapeMarkdownLinkText(labelPreview) + "](" + item.URL + ")"
+		} else {
+			line += labelPreview
+		}
+		meta := []string{}
+		if item.Repository != "" {
+			repository, truncated := githubOverviewInlinePreview(item.Repository, 120)
+			if truncated {
+				repository += "…"
+			}
+			meta = append(meta, repository)
+		}
+		if item.Number > 0 {
+			meta = append(meta, fmt.Sprintf("#%d", item.Number))
+		}
+		if item.State != "" {
+			state, truncated := githubOverviewInlinePreview(item.State, 40)
+			if truncated {
+				state += "…"
+			}
+			meta = append(meta, state)
+		}
+		if item.Type != "" {
+			itemType, truncated := githubOverviewInlinePreview(item.Type, 40)
+			if truncated {
+				itemType += "…"
+			}
+			meta = append(meta, itemType)
+		}
+		if len(meta) > 0 {
+			line += " — " + strings.Join(meta, " · ")
+		}
+		lines = append(lines, line)
+	}
+	if note := githubLocalOmissionNote("Project items returned by GitHub", len(project.Items)-limit); note != "" {
+		lines = append(lines, "", note)
+	}
+	if project.MoreItems {
+		lines = append(lines, "", "> More Project items exist upstream. This native long-tail Project view intentionally returns the first 50 items rather than expanding an unbounded project into context.")
+	}
+	return strings.TrimSpace(strings.Join(lines, "\n"))
+}

package/internal/app/github_packages_projects_test.go

@@ -0,0 +1,168 @@
+package app
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync/atomic"
+	"testing"
+)
+
+func TestParsePackageProjectTargetsAndLongTailFallback(t *testing.T) {
+	for _, tt := range []struct {
+		raw    string
+		kind   GitHubTargetKind
+		owner  string
+		name   string
+		number int
+		tail   []string
+	}{
+		{raw: "https://github.com/orgs/acme/packages/container/package/widget", kind: GitHubTargetPackage, owner: "acme", name: "widget", tail: []string{"org", "container"}},
+		{raw: "https://github.com/users/alice/packages/npm/package/pkg", kind: GitHubTargetPackage, owner: "alice", name: "pkg", tail: []string{"user", "npm"}},
+		{raw: "https://github.com/orgs/acme/projects/7", kind: GitHubTargetProjectV2, owner: "acme", number: 7, tail: []string{"org"}},
+		{raw: "https://github.com/users/alice/projects/3", kind: GitHubTargetProjectV2, owner: "alice", number: 3, tail: []string{"user"}},
+	} {
+		target := parseGitHubTarget(tt.raw)
+		if target == nil || target.Kind != tt.kind || target.Owner != tt.owner || target.Name != tt.name || target.Number != tt.number || strings.Join(target.Tail, ",") != strings.Join(tt.tail, ",") {
+			t.Fatalf("target %s => %#v", tt.raw, target)
+		}
+	}
+	for _, raw := range []string{
+		"https://github.com/orgs/acme/packages",
+		"https://github.com/users/alice/packages/container",
+		"https://github.com/orgs/acme/packages/unknown/package/widget",
+		"https://github.com/o/r/wiki",
+		"https://github.com/o/r/settings",
+		"https://github.com/o/r/security",
+		"https://github.com/o/r/archive/refs/heads/main.zip",
+	} {
+		if target := parseGitHubTarget(raw); target != nil {
+			t.Fatalf("excluded/unproven long-tail route was claimed: %s => %#v", raw, target)
+		}
+	}
+}
+
+func TestPackageDetailAndBoundedVersions(t *testing.T) {
+	var server *httptest.Server
+	server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		switch r.URL.Path {
+		case "/orgs/acme/packages/container/widget":
+			_, _ = io.WriteString(w, `{"id":1,"name":"widget","package_type":"container","html_url":"https://github.com/orgs/acme/packages/container/package/widget","visibility":"public","description":"demo package","version_count":50,"created_at":"2026-01-01T00:00:00Z","updated_at":"2026-08-01T00:00:00Z","repository":{"full_name":"acme/widget","html_url":"https://github.com/acme/widget"}}`)
+		case "/orgs/acme/packages/container/widget/versions":
+			if r.URL.Query().Get("per_page") != "8" || r.URL.Query().Get("page") != "2" {
+				t.Fatalf("version pagination lost: %s", r.URL.RawQuery)
+			}
+			w.Header().Set("Link", fmt.Sprintf(`<%s/orgs/acme/packages/container/widget/versions?per_page=8&page=1>; rel="prev", <%s/orgs/acme/packages/container/widget/versions?per_page=8&page=3>; rel="next"`, server.URL, server.URL))
+			_, _ = io.WriteString(w, `[{"id":11,"name":"sha256:abc","package_html_url":"https://github.com/orgs/acme/packages/container/widget/11","updated_at":"2026-08-01T00:00:00Z","metadata":{"package_type":"container","container":{"tags":["latest","v1"]}}}]`)
+		default:
+			t.Fatalf("unexpected package request %s", r.URL.Path)
+		}
+	}))
+	defer server.Close()
+	out, err := readGitHubPackage(context.Background(), testGitHubClient(server.URL, server.URL, ""), parseGitHubTarget("https://github.com/orgs/acme/packages/container/package/widget?page=2"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, want := range []string{`package: "widget"`, `package_type: "container"`, "version_count: 50", "versions_page: 2", "demo package", "sha256:abc", "tags: latest, v1", "Previous", "page=1", "Next", "page=3"} {
+		if !strings.Contains(out, want) {
+			t.Fatalf("package output missing %q:\n%s", want, out)
+		}
+	}
+}
+
+func TestPublicOrganizationProjectV2UsesRESTWithoutTokenAndBoundsItems(t *testing.T) {
+	var server *httptest.Server
+	server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Header.Get("Authorization") != "" {
+			t.Fatalf("anonymous public Project unexpectedly sent auth")
+		}
+		w.Header().Set("Content-Type", "application/json")
+		switch r.URL.Path {
+		case "/orgs/acme/projectsV2/7":
+			_, _ = io.WriteString(w, `{"id":71,"number":7,"title":"Roadmap","short_description":"Ship it","public":true,"state":"open","created_at":"2026-01-01T00:00:00Z","updated_at":"2026-08-01T00:00:00Z"}`)
+		case "/orgs/acme/projectsV2/7/items":
+			if r.URL.Query().Get("per_page") != "50" {
+				t.Fatalf("Project items are not bounded: %s", r.URL.RawQuery)
+			}
+			w.Header().Set("Link", fmt.Sprintf(`<%s/orgs/acme/projectsV2/7/items?per_page=50&after=cursor>; rel="next"`, server.URL))
+			_, _ = io.WriteString(w, `[{"id":101,"content_type":"Issue","content":{"number":12,"title":"Feature","html_url":"https://github.com/acme/r/issues/12","state":"open","repository_url":"https://api.github.com/repos/acme/r"}},{"id":102,"content_type":"DraftIssue","content":{"title":"Draft task","body":"details"}}]`)
+		default:
+			t.Fatalf("unexpected Project REST path %s", r.URL.Path)
+		}
+	}))
+	defer server.Close()
+	out, err := readGitHubProjectV2(context.Background(), testGitHubClient(server.URL, server.URL, ""), parseGitHubTarget("https://github.com/orgs/acme/projects/7"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, want := range []string{`project: 7`, `title: "Roadmap"`, "items_returned: 2", "more_items_available: true", "Ship it", "[Feature](https://github.com/acme/r/issues/12)", "acme/r", "#12", "Draft task", "first 50 items"} {
+		if !strings.Contains(out, want) {
+			t.Fatalf("Project output missing %q:\n%s", want, out)
+		}
+	}
+}
+
+func TestPublicProjectV2RetriesWithoutNarrowFineGrainedToken(t *testing.T) {
+	var authCalls, anonymousCalls int32
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		if r.Header.Get("Authorization") != "" {
+			atomic.AddInt32(&authCalls, 1)
+			w.WriteHeader(http.StatusForbidden)
+			_, _ = io.WriteString(w, `{"message":"Resource not accessible by personal access token"}`)
+			return
+		}
+		atomic.AddInt32(&anonymousCalls, 1)
+		switch r.URL.Path {
+		case "/orgs/acme/projectsV2/7":
+			_, _ = io.WriteString(w, `{"id":71,"number":7,"title":"Public roadmap","public":true,"state":"open"}`)
+		case "/orgs/acme/projectsV2/7/items":
+			_, _ = io.WriteString(w, `[]`)
+		default:
+			t.Fatalf("unexpected Project REST path %s", r.URL.Path)
+		}
+	}))
+	defer server.Close()
+	out, err := readGitHubProjectV2(context.Background(), testGitHubClient(server.URL, server.URL, "fake-token"), parseGitHubTarget("https://github.com/orgs/acme/projects/7"))
+	if err != nil || !strings.Contains(out, "# Public roadmap") {
+		t.Fatalf("fine-grained public Project fallback failed err=%v:\n%s", err, out)
+	}
+	if atomic.LoadInt32(&authCalls) != 2 || atomic.LoadInt32(&anonymousCalls) != 2 {
+		t.Fatalf("Project auth/anonymous retry counts auth=%d anon=%d", authCalls, anonymousCalls)
+	}
+}
+
+func TestUserProjectV2UsesUserRESTPath(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		switch r.URL.Path {
+		case "/users/alice/projectsV2/3":
+			_, _ = io.WriteString(w, `{"id":31,"number":3,"title":"Personal","public":true,"state":"open"}`)
+		case "/users/alice/projectsV2/3/items":
+			_, _ = io.WriteString(w, `[]`)
+		default:
+			t.Fatalf("unexpected User Project path %s", r.URL.Path)
+		}
+	}))
+	defer server.Close()
+	out, err := readGitHubProjectV2(context.Background(), testGitHubClient(server.URL, server.URL, ""), parseGitHubTarget("https://github.com/users/alice/projects/3"))
+	if err != nil || !strings.Contains(out, "# Personal") {
+		t.Fatalf("User Project failed err=%v:\n%s", err, out)
+	}
+}
+
+func TestPackageProjectProviderFailuresStayNative(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusNotFound)
+		_, _ = io.WriteString(w, `{"message":"private body"}`)
+	}))
+	defer server.Close()
+	result := readGitHubNativeWithClient(context.Background(), parseGitHubTarget("https://github.com/orgs/acme/packages/container/package/widget"), testGitHubClient(server.URL, server.URL, ""))
+	if result.Outcome != GitHubNativeFailure || result.Err == nil || strings.Contains(result.Err.Error(), "private body") {
+		t.Fatalf("Package native failure boundary wrong: %#v", result)
+	}
+}