fix(programs): manual Refresh now actually re-fetches from H1/BC/IT (+ 429 retry)

Two bugs around the user expectation "click Refresh, get fresh scope":

1) The top-right ↻ Refresh button on the Programs page called loadPrograms() (no
   force=true), which only re-read the cached payload from disk. Result: clicking
   Refresh did NOT trigger a backend warmer rebuild, so stale scope (e.g. Ryan-BBP
   added new assets today but AutoAR's view didn't reflect it) stayed stale. Wire
   refreshCurrentView() for the Programs view through ProgramsPage.refreshNow(),
   which triggers /api/scope/programs?refresh=true → forces the warmer rebuild.

2) Even with that fix, the warmer was bailing out on rate-limited programs.
   fetchH1ScopeSummary now retries up to 3 times with exponential backoff on 429
   (2s, then 4s), and honors a sensible Retry-After header (≤30s) when H1
   provides one. So the warmer doesn't routinely leave hundreds of programs with
   stale empty scope when the H1 token is being hammered.

Net effect: clicking Refresh on the Programs page kicks off a real rebuild, and
the rebuild is far more likely to actually capture the current scope for every
program — which means the scope-update watch sees Ryan's new asset on the next
refresh and fires the Discord alert.

Verified: go build/vet/node --check clean.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: h0tak88r

internal/api/programs_api.go

@@ -504,26 +504,48 @@ func enrichH1ScopeCounts(programs []ProgramSummary, auth string) {
 // request fails or H1 returns a non-200 (e.g. 429 rate-limit / 403) — the caller must
 // NOT cache a !ok result, otherwise a transient failure would hide a program's real
 // scope (showing "—") for the whole cache TTL.
+//
+// 429s are retried with exponential backoff (honoring Retry-After when supplied) so
+// the warmer doesn't routinely leave hundreds of programs with stale empty scopes.
 func fetchH1ScopeSummary(handle, auth string) (ProgramSummary, bool) {
 	url := fmt.Sprintf("https://api.hackerone.com/v1/hackers/programs/%s/structured_scopes?page%%5Bsize%%5D=100", handle)
-	req, err := http.NewRequest("GET", url, nil)
-	if err != nil {
-		return ProgramSummary{}, false
-	}
-	req.Header.Set("Accept", "application/json")
-	req.Header.Set("Authorization", "Basic "+auth)
-
 	client := &http.Client{Timeout: 15 * time.Second}
-	resp, err := client.Do(req)
-	if err != nil {
-		return ProgramSummary{}, false
+
+	var body []byte
+	var statusCode int
+	const maxAttempts = 3
+	backoff := 2 * time.Second
+	for attempt := 0; attempt < maxAttempts; attempt++ {
+		req, err := http.NewRequest("GET", url, nil)
+		if err != nil {
+			return ProgramSummary{}, false
+		}
+		req.Header.Set("Accept", "application/json")
+		req.Header.Set("Authorization", "Basic "+auth)
+
+		resp, err := client.Do(req)
+		if err != nil {
+			return ProgramSummary{}, false
+		}
+		body, _ = io.ReadAll(resp.Body)
+		statusCode = resp.StatusCode
+		// Honor an explicit Retry-After (seconds) if H1 sent one.
+		retryAfter := backoff
+		if ra := resp.Header.Get("Retry-After"); ra != "" {
+			if secs, err := strconv.Atoi(strings.TrimSpace(ra)); err == nil && secs > 0 && secs < 30 {
+				retryAfter = time.Duration(secs) * time.Second
+			}
+		}
+		resp.Body.Close()
+
+		if statusCode != http.StatusTooManyRequests || attempt == maxAttempts-1 {
+			break // 200 (success), 4xx that isn't 429 (auth/permission), or out of retries
+		}
+		time.Sleep(retryAfter)
+		backoff *= 2
 	}
-	body, _ := io.ReadAll(resp.Body)
-	resp.Body.Close()
 
-	if resp.StatusCode != http.StatusOK {
-		// 429 (rate-limited by hammering the API), 403, 401, etc. — signal failure so
-		// the empty result isn't cached and the next refresh retries.
+	if statusCode != http.StatusOK {
 		return ProgramSummary{}, false
 	}
 

internal/api/ui/pages/polling.js

@@ -44,7 +44,12 @@
       case 'domains': window.loadDomains(); break;
       case 'subdomains': window.loadSubdomains(); break;
       case 'targets': window.loadTargetsPlatforms(); break;
-      case 'programs': window.ProgramsPage.loadPrograms(); break;
+      case 'programs':
+        // Manual Refresh on Programs should actually pull fresh scope from the
+        // platforms — not just re-read the cached payload. refreshNow() triggers a
+        // backend warmer rebuild, then re-renders the table once it's done.
+        window.ProgramsPage.refreshNow();
+        break;
       case 'monitor': window.loadMonitor(); break;
       case 'keyhacks': window.loadKeyhacks(); break;
       case 'report-templates': window.renderReportTemplates(); break;