[Bug] Triage Fails Silently for Private Repositories When Token Lacks Scope

[anshul23102]

Summary

When isscope is configured with a GitHub token that lacks the repo scope (only public_repo), triaging a private repository returns a generic error with no guidance. Users do not know what permission is missing.

Current Behavior

A 404 response from the GitHub API on a private repository returns a toast: "Repository not found." The actual cause (missing repo token scope) is not communicated.

Expected Behavior

The error message should detect the 404 on a known-private repository and explain that the configured token needs the repo scope to access private repositories, with a link to GitHub's token settings page.

Proposed Fix

async function fetchIssue(owner: string, repo: string, number: number) {
  const res = await fetch(`https://api.github.com/repos/${owner}/${repo}/issues/${number}`, {
    headers: { Authorization: `Bearer ${token}` }
  });

  if (res.status === 404) {
    const scopeHeader = res.headers.get('x-oauth-scopes') ?? '';
    const hasRepoScope = scopeHeader.split(',').map(s => s.trim()).includes('repo');

    if (!hasRepoScope) {
      throw new PermissionError(
        'Private repository access requires the `repo` OAuth scope. ' +
        'Update your token at https://github.com/settings/tokens.'
      );
    }
    throw new NotFoundError('Repository or issue not found.');
  }
}

Show the PermissionError in a persistent banner (not a dismissable toast) with a "Update token" link.

Acceptance Criteria

• Triaging a private repo with a token missing repo scope shows the permission error banner.
• The banner includes a direct link to the GitHub token settings page.
• The banner persists until the user dismisses it or updates the token.
• Public 404 errors still show the generic "not found" message.
• A unit test mocks the 404 response with both scope scenarios.

[anshul23102]

Hi @vee1e, I'd like to work on this. Plan: detect when a token lacks sufficient scope for a private repo up front and surface a clear error/warning instead of silently failing the triage run. Requesting assignment under GSSoC 2026.

/assign
/claim

[anshul23102]

@vee1e Looking into this, it appears this was already fixed on master in commit 1af4c74 ("fix: handle private repos when GitHub token lacks repo scope"). GitHubPermissionError in src/lib/api/github.ts detects the missing repo scope on a 404, PermissionErrorBanner renders it as a persistent banner with a link to the token settings page, and src/lib/api/github.test.ts covers both scope scenarios. All acceptance criteria in this issue are satisfied by that commit. Closing this out on my end since there's no remaining work — let me know if I'm missing something.