[qiansc]

Background

public_read=false only hid a repository from anonymous callers. Every signed-in user and every personal API key (website, HTTP and MCP) could still list, search and read it, so there was no way to keep a repository private.

This change implements private repositories (public_read=false):

Caller	Can see a private repository?
Anonymous (website, HTTP, MCP without a key)	No
Ordinary user (session or own personal key)	Only repositories they created or manage
Site administrator signed in on the website	All
Site administrator's personal key	Same as an ordinary user
Deployment credential	All

Repositories registered before public_read existed stay public.

Changes

• internal/identity: ReadsAllRepositories — administrator sessions, the deployment credential and background work without a request identity are not narrowed.
• internal/service/visibility.go: one visible rule; Repo and Catalog filter by caller, shared by the website, HTTP and MCP. Hidden repositories answer the same 404 REPOSITORY_NOT_FOUND ("Repository is not registered.") as unregistered names.
• Statistics: callers without site-wide read keep only registered repositories they can see plus _overflow; unregistered, deleted and hidden names are all omitted, so a guessed name cannot be probed.
• prepare_access.go: an administrator's personal key prepares only repositories it can see.
• Registering a taken name still returns 409 REPOSITORY_EXISTS, now with the registrant in creator (id/name/email/department); the website asks the user to contact them to be added as a manager, or a site administrator when no registrant is recorded.
• Website: the "allow anonymous" checkbox becomes "Public repository", explaining who can see a private one.
• Docs: new "Repository visibility" section in docs/interfaces.md.

Risks

• Repositories with public_read=false that signed-in users could read before become invisible to anyone who is not their creator, a manager or an administrator. Add those users as managers or make the repository public.
• Catalog and statistics calls by non-administrators page through the registry; fine at current sizes, database-side filtering is the follow-up for large registries.
• Background synchronization, indexing and cleanup are not affected.

Backward compatibility

• Public and legacy repositories behave as before; anonymous reading still follows the site-wide switch.
• No API fields removed; 409 REPOSITORY_EXISTS gains an optional creator.
• No data migration or configuration change.

Testing

• bun run check, go test ./... -count=1 and bun run build pass.
• internal/service/visibility_test.go: catalog and lookup for ten kinds of caller, administrator-key prepare, the statistics allow-list including a guessed name.
• internal/httpserver/private_repository_test.go: real personal keys end to end over the website, HTTP and MCP for every row above; search/read/list/diff/resolve/plugins/commits/prepare answer hidden callers exactly like an unregistered name; a taken name returns 409 with its registrant.
• Restoring the old rule makes the "other user" and "administrator key" cases fail.

🤖 Generated with Claude Code