Distillation

Date: Aug 27, 2026

• 🟡 (14:02) Tool search found GET /repos/{owner}/{repo}/collaborators/{username}/permission in /home/byk/.local/share/opencode/tool-output/tool_043860ce0001dHKJARbna8GGVi at line 1143.
• 🟡 (14:02) User-provided GitHub permissions table in /home/byk/.local/share/opencode/tool-output/tool_043860ce0001dHKJARbna8GGVi:1135-1152 identifies repository permission "Metadata"; GET /repos/{owner}/{repo}/collaborators/{username}/permission requires read, accepts UAT, IAT, and has no additional permissions (✗). The same Metadata table lists GET /orgs/{org}/repos, GET /repos/{owner}/{repo}, collaborator-list/detail endpoints, repository comments/reactions, commit comments, contributors, events, forks, hash algorithm, and issue types as read with UAT, IAT and no additional permissions.
• 🟡 (14:02) A request to https://docs.github.com/en/rest/repos/collaborators#get-repository-permissions-for-a-user returned 404 GET.
• 🟡 (14:02) User-provided GitHub collaborator REST API documentation states GET /repos/{owner}/{repo}/collaborators requires the authenticated user to have write, maintain, or admin repository privileges; for organization-owned repositories the user must be an organization member. OAuth app tokens and classic personal access tokens require read:org and repo scopes. Collaborator responses report base-role permissions and role_name as the highest role across repository, team, organization, and enterprise grants; the endpoint cannot distinguish organization-level from repository-level grants, and child-team members are included.
• 🔴 (14:03) User stated Git HTTP authentication uses the access token as the HTTP password and directed replacing TOKEN with the access token in git clone https://x-access-token:TOKEN@github.com/owner/repo.git.
• 🟡 (14:03) User-provided GitHub App documentation states apps default to no permissions but have implicit public-resource read access when acting on behalf of a user; permissions are repository, organization, enterprise, or account types, and apps should request the minimum required permissions.
• 🟡 (14:03) User-provided GitHub App documentation states user access token API success depends on both the user’s and app’s permissions, while installation access token success depends only on app permissions; insufficient REST API permissions return 403, insufficient GraphQL permissions return 401, and REST responses provide X-Accepted-GitHub-Permissions to identify required permissions.
• 🟡 (14:03) User-provided GitHub App documentation states HTTP-based Git access with installation or user access tokens requires repository "Contents" permission; accessing or editing Actions files in .github/workflows additionally requires repository "Workflows" permission.
• 🟡 (14:03) Assistant concluded that GET /repos/{owner}/{repo}/collaborators/{username}/permission requires GitHub App repository Metadata: read, accepts an installation access token (IAT), and does not require Administration or any additional permission. Assistant noted the installation must access the target repository, public-resource behavior may differ, and GitHub returns the user’s effective highest role across repository, team, organization, and enterprise grants rather than the grant source. Evidence cited: /home/byk/.local/share/opencode/tool-output/tool_043860ce0001dHKJARbna8GGVi:1135-1143 and token definitions at :9-15.