Repository page view: restore no-token repo existence validation

[vultuk]

Repository page view: restore no-token repo existence validation

Summary

Restore fail-closed repository existence validation when the web app does not have a GitHub token so Discofork stops queueing obvious typos and nonexistent repos.

Problem

ensureGitHubRepositoryExists() currently returns early when GH_TOKEN and GITHUB_TOKEN are both absent. In that mode, bogus owner/repo paths can still be queued and inserted into repo_reports, only to fail later in the worker. Users see a queued page for repositories that do not exist, and Discofork wastes queue capacity on work that should have been rejected immediately.

Desired outcome

Discofork should still verify that a public repository exists before queueing it, even when the web tier is running without a GitHub API token.

Requirements

• Restore a tokenless repository existence check before queueing uncached repositories.
• Keep using the existing positive and negative existence cache so repeated requests do not re-probe unnecessarily.
• Do not enqueue or touch queued state for repositories confirmed missing.
• Preserve the current authenticated GitHub API path when a token is configured.

Evals

• Requesting a real public repo without a GitHub token still returns a queueable or cached view successfully.
• Requesting a nonexistent repo without a GitHub token throws RepositoryNotFoundError and does not enqueue or touch queued state.
• Repeating the same nonexistent repo request reuses the cached negative existence result instead of fetching again.
• Deployments with a configured GitHub token keep the current behavior unchanged.

Notes

• This is a regression from the earlier no-token existence validation work; keep the fix scoped to restoring that behavior in the current read/get page-view split.
• Prefer a lightweight public probe rather than introducing a new dependency or broad refactor.

[vultuk]

Implement issue #42: restore no-token repo existence validation

{
"branch": "fix/42-restore-no-token-repo-validation",
"commentId": 4218400397,
"commit": "8e20710ddd3c5ecc9fca4a9bd39f53c4c397b398",
"handoff": {
"commentId": 4218545121,
"status": "posted"
},
"issue": 42,
"issueAuthor": "vultuk",
"lastSyncedAt": "2026-04-09T23:38:23Z",
"mode": "execution",
"planRevision": 2,
"pr": {
"number": 43,
"url": "#43"
},
"repo": "schema-labs-ltd/discofork",
"reviewGate": {
"blockers": [],
"fixesApplied": true,
"reviewedAt": "2026-04-09T23:38:23Z",
"status": "approved",
"summary": "review-changes reviewer-only fallback via codex exec approved the final diff after tightening redirect handling, authenticated fallback over stale anonymous misses, and transient anonymous-probe behavior."
},
"status": "completed",
"validation": {
"commands": [
"npx bun run typecheck",
"npx bun test test/repository-service-page-view.test.ts",
"npx bun test test/repo-api-route.test.ts"
],
"status": "passed",
"summary": "Passed typecheck plus targeted Bun regressions for repository page-view and repo API routes."
}
}

Progress

• EP-001 (2026-04-09T23:38:23Z) Confirm the regression scope in web/src/lib/repository-service.ts, issue Repository page view: restore no-token repo existence validation #42, and prior fix commit cd21e64.
• EP-002 (2026-04-09T23:38:23Z) Restore the no-token GitHub existence probe while preserving the authenticated API path.
• EP-003 (2026-04-09T23:38:23Z) Add regression coverage for tokenless existing/missing repositories, redirect handling, transient anonymous failures, and authenticated fallback in the current page-view/read split.
• EP-004 (2026-04-09T23:38:23Z) Run validation, execute the review gate, and deliver the PR.

Surprises & Discoveries

• The old issue Queueing: Validate repository existence before enqueueing without GH token #3 behavior needed one extra guard in the current codebase: a stale unauthenticated negative cache entry must not block a later authenticated lookup.
• Manual redirect handling was worth restoring explicitly so tokenless validation only accepts the same GitHub repository (case-insensitive) and does not cache renamed-target redirects under the wrong key.
• Running bun test across both relevant files in one process caused Bun mock cross-test interference, so the targeted suites were validated in separate invocations.

Decision Log

• Reintroduced a lightweight unauthenticated HEAD https://github.com/<owner>/<repo> probe for tokenless validation, but only cache definitive outcomes.
• Preserve the authenticated REST API lookup path when a token is present, even if a prior tokenless probe cached a miss.
• Treat transient anonymous probe failures as indeterminate so read/queue flows stay available without caching an incorrect miss.

Outcomes & Retrospective

Discofork once again rejects definite nonexistent repositories before queueing them when the web tier has no GitHub token, while still preserving the token-backed API path and avoiding false positives from redirects or stale anonymous misses. The regression suite now covers the split getRepositoryPageView/readRepositoryView flows directly.

Validation and Acceptance

• npx bun run typecheck ✅
• npx bun test test/repository-service-page-view.test.ts ✅
• npx bun test test/repo-api-route.test.ts ✅
• review-changes reviewer-only fallback ✅ (LGTM)

Audit Evidence

• slice: EP-004
  time: 2026-04-09T23:38:23Z
  kind: validation
  action: npx bun run typecheck; npx bun test test/repository-service-page-view.test.ts; npx bun test test/repo-api-route.test.ts; reviewer-only codex exec review
  cwd:
  result: Passed
  proof: Typecheck and targeted Bun suites passed; review gate returned LGTM and approved the diff.

Delivery Metadata

• Branch: fix/42-restore-no-token-repo-validation
• Commit: 8e20710
• PR: fix: restore no-token repository validation #43
• Reviewer request: skipped because the issue author matches the authenticated GitHub user
• Handoff: posted issue comment 4218545121
• Validation: Passed npx bun run typecheck, npx bun test test/repository-service-page-view.test.ts, and npx bun test test/repo-api-route.test.ts.

[vultuk]

implementation for #42 is complete and ready for review.

• PR: fix: restore no-token repository validation #43
• Branch: fix/42-restore-no-token-repo-validation
• Commit: 8e20710
• Validation: Passed npx bun run typecheck, npx bun test test/repository-service-page-view.test.ts, and npx bun test test/repo-api-route.test.ts.

The managed ExecPlan comment has been updated with the full delivery log.