Source: PR #1292, triaged at head be03f33dcdd403680b17bca1a6d9fbda7684cb20 (review round 2 residual finding 6).
Severity: LOW.
Location
hypaware-core/plugins-workspace/github/src/capture.js:88: resolveRepos (which reaches client.listViewerRepos() when inventory is all_visible) runs outside the per-repo try/catch at capture.js:123
Observed behavior
Before the origin pin, enumeration pagination could not throw on a Link header; now a foreign Link during all_visible enumeration throws github_foreign_origin, the throw escapes captureRepos entirely, and no repository is captured that tick. It surfaces at src/source.js:60-68 as github.poll_tick_failed with the error kind. The design intent (per the function's own doc comment) was per-repo isolation: one bad repo never kills a whole tick.
Why deferral is safe
The enumeration has no durable cursor, so the outage is one tick and self-heals on the next. It is reachable only with a hostile proxy in front of api.github.com on a non-default all_visible inventory; at the merge base the same proxy receives the bearer token instead. The failure is attributable (error_kind: github_foreign_origin on the tick-failure log line).
Acceptance condition
A listViewerRepos() failure during all_visible enumeration degrades rather than aborting: repositories already known (or none, with a per-source error recorded) are still captured that tick, or the enumeration error is caught and reported without escaping captureRepos, with a test in which enumeration throws github_foreign_origin and the tick still completes with the error recorded.
Source: PR #1292, triaged at head
be03f33dcdd403680b17bca1a6d9fbda7684cb20(review round 2 residual finding 6).Severity: LOW.
Location
hypaware-core/plugins-workspace/github/src/capture.js:88:resolveRepos(which reachesclient.listViewerRepos()wheninventoryisall_visible) runs outside the per-repotry/catchatcapture.js:123Observed behavior
Before the origin pin, enumeration pagination could not throw on a Link header; now a foreign
Linkduringall_visibleenumeration throwsgithub_foreign_origin, the throw escapescaptureReposentirely, and no repository is captured that tick. It surfaces atsrc/source.js:60-68asgithub.poll_tick_failedwith the error kind. The design intent (per the function's own doc comment) was per-repo isolation: one bad repo never kills a whole tick.Why deferral is safe
The enumeration has no durable cursor, so the outage is one tick and self-heals on the next. It is reachable only with a hostile proxy in front of
api.github.qkg1.topon a non-defaultall_visibleinventory; at the merge base the same proxy receives the bearer token instead. The failure is attributable (error_kind: github_foreign_originon the tick-failure log line).Acceptance condition
A
listViewerRepos()failure duringall_visibleenumeration degrades rather than aborting: repositories already known (or none, with a per-source error recorded) are still captured that tick, or the enumeration error is caught and reported without escapingcaptureRepos, with a test in which enumeration throwsgithub_foreign_originand the tick still completes with the error recorded.