diff --git a/GitWeb/README.en.md b/GitWeb/README.en.md
index 3c5a825..b07964b 100644
--- a/GitWeb/README.en.md
+++ b/GitWeb/README.en.md
@@ -78,6 +78,7 @@ src/
 - Stash: create, apply, pop, drop — wired into the main navigation.
 - Sync: fetch/pull/push/publish branch that adapts to the ahead/behind/upstream state.
 - Pull Requests: sign in with OAuth Device Flow (GitHub.com) or PAT (GitHub.com or Enterprise), list, create, view files/comments, merge, close/reopen.
+- Collaborators: see who has access, invite by username, cancel invitations, remove people and change permissions (on organization repositories), right in the app.
 - AI chat with tools (create/switch/merge branch, commit, push/pull/fetch, stash, list/create PR) with a human-approval step before each action.
 - Interface, main-process messages and AI answers in Portuguese (Brazil), English or Spanish — following the system language by default, switchable live in Settings.
 - Automatic light/dark themes (from the system preference) and high-contrast support (Windows High Contrast Mode / `prefers-contrast`).
diff --git a/GitWeb/README.es.md b/GitWeb/README.es.md
index 5ef723b..8a5418f 100644
--- a/GitWeb/README.es.md
+++ b/GitWeb/README.es.md
@@ -78,6 +78,7 @@ src/
 - Stash: crear, aplicar, pop, descartar — conectado a la navegación principal.
 - Sincronización: fetch/pull/push/publicar rama que se adapta al estado ahead/behind/upstream.
 - Pull Requests: inicio de sesión con OAuth Device Flow (GitHub.com) o PAT (GitHub.com o Enterprise), listar, crear, ver archivos/comentarios, fusionar, cerrar/reabrir.
+- Colaboradores: ver quién tiene acceso, invitar por usuario, cancelar invitaciones, quitar personas y cambiar permisos (en repositorios de organización), desde la app.
 - Chat de IA con herramientas (crear/cambiar/fusionar rama, commit, push/pull/fetch, stash, listar/crear PR) con aprobación humana antes de cada acción.
 - Interfaz, mensajes del proceso principal y respuestas de la IA en portugués (Brasil), inglés o español — sigue el idioma del sistema por defecto y se puede cambiar al instante en Configuración.
 - Temas claro/oscuro automáticos (según la preferencia del sistema) y soporte de alto contraste (Windows High Contrast Mode / `prefers-contrast`).
diff --git a/GitWeb/README.md b/GitWeb/README.md
index 0520a84..a502351 100644
--- a/GitWeb/README.md
+++ b/GitWeb/README.md
@@ -78,6 +78,7 @@ src/
 - Stash: criar, aplicar, pop, descartar — conectado à navegação principal.
 - Sync: fetch/pull/push/publicar branch adaptativo conforme o estado ahead/behind/upstream.
 - Pull Requests: login com OAuth Device Flow (GitHub.com) ou PAT (GitHub.com ou Enterprise), listar, criar, ver arquivos/comentários, mesclar, fechar/reabrir.
+- Colaboradores: ver quem tem acesso, convidar por username, cancelar convites, remover pessoas e mudar permissões (em repositórios de organização), direto no app.
 - Chat de IA com ferramentas (criar/trocar/mesclar branch, commit, push/pull/fetch, stash, listar/criar PR) com fluxo de aprovação humana antes de cada ação.
 - Interface, mensagens do processo principal e respostas da IA em português (Brasil), inglês ou espanhol — segue o idioma do sistema por padrão e pode ser trocado na hora em Configurações.
 - Temas claro/escuro automáticos (via preferência do sistema) e suporte a alto contraste (Windows High Contrast Mode / `prefers-contrast`).
diff --git a/GitWeb/src/main/githubApi.ts b/GitWeb/src/main/githubApi.ts
index 766bd98..145503e 100644
--- a/GitWeb/src/main/githubApi.ts
+++ b/GitWeb/src/main/githubApi.ts
@@ -3,6 +3,7 @@ import { getSecret, saveSecret, deleteSecret } from './credentials'
 import { httpFetch } from './httpFetch'
 import { tMain } from './i18n'
 import type {
+  AddCollaboratorResult,
   BranchRules,
   CreatePullRequestInput,
   GitHubRepoSummary,
@@ -15,7 +16,10 @@ import type {
   PullRequestReviewSummary,
   PullRequestState,
   PullRequestStatus,
+  RepositoryCollaborators,
+  RepositoryInvitation,
   RepositoryOwner,
+  RepositoryRole,
   ReviewDecision
 } from '../shared/github'
 
@@ -711,3 +715,139 @@ export async function createRepository(
   })
   return { fullName: repo.full_name, htmlUrl: repo.html_url ?? `https://${host}/${repo.full_name}`, cloneUrl: repo.clone_url }
 }
+
+// --- Collaborators ------------------------------------------------------------
+
+interface ApiCollaborator {
+  login: string
+  avatar_url: string
+  role_name: string
+}
+
+interface ApiInvitation {
+  id: number
+  invitee: { login: string; avatar_url?: string } | null
+  permissions: string
+  created_at: string
+  expired?: boolean
+}
+
+// The write endpoint still takes the role names GitHub used before read/write.
+const API_PERMISSION: Record<RepositoryRole, string> = {
+  read: 'pull',
+  triage: 'triage',
+  write: 'push',
+  maintain: 'maintain',
+  admin: 'admin'
+}
+
+function repositoryPath(owner: string, repo: string): string {
+  return `/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}`
+}
+
+function toInvitation(invitation: ApiInvitation): RepositoryInvitation {
+  return {
+    id: invitation.id,
+    login: invitation.invitee?.login ?? null,
+    avatarUrl: invitation.invitee?.avatar_url ?? null,
+    role: invitation.permissions,
+    createdAt: invitation.created_at,
+    expired: Boolean(invitation.expired)
+  }
+}
+
+/**
+ * Who has access and what the signed-in account may do about it. Invitations
+ * are allowed to fail on their own: a list of collaborators without them is
+ * still worth showing.
+ */
+export async function getRepositoryCollaborators(host: string, owner: string, repo: string): Promise<RepositoryCollaborators> {
+  const token = await requireToken(host)
+  const base = repositoryPath(owner, repo)
+  const info = await request<{ owner: { login: string; type: string }; permissions?: { admin?: boolean; push?: boolean } }>(host, base, token)
+  const ownerLogin = info.owner.login
+  const ownerKind = info.owner.type === 'Organization' ? 'org' : 'user'
+  const canAdminister = Boolean(info.permissions?.admin)
+  const canView = canAdminister || Boolean(info.permissions?.push)
+  if (!canView) return { ownerLogin, ownerKind, canView, canAdminister, collaborators: [], invitations: [], invitationsError: null }
+
+  const list = (affiliation: 'all' | 'direct'): Promise<ApiCollaborator[]> =>
+    requestAll<ApiCollaborator>(host, `${base}/collaborators?affiliation=${affiliation}&per_page=100`, token)
+
+  let everyone: ApiCollaborator[]
+  let direct: Set<string> | null = null
+  try {
+    // On a personal repository everyone is direct, so asking twice would only cost a request.
+    const [all, directOnly] = await Promise.all([list('all'), ownerKind === 'org' ? list('direct') : null])
+    everyone = all
+    if (directOnly) direct = new Set(directOnly.map((c) => c.login))
+  } catch (err) {
+    // An organization can refuse this list to a sign-in that works everywhere
+    // else, so a bare "Forbidden" would not say where to go next.
+    if (ownerKind === 'org' && err instanceof GitHubApiError && (err.status === 403 || err.status === 404)) {
+      throw new GitHubApiError(tMain().github.collaboratorsForbidden(err.message), err.status)
+    }
+    throw err
+  }
+
+  let invitations: RepositoryInvitation[] = []
+  let invitationsError: string | null = null
+  if (canAdminister) {
+    try {
+      invitations = (await requestAll<ApiInvitation>(host, `${base}/invitations?per_page=100`, token)).map(toInvitation)
+    } catch (err) {
+      invitationsError = err instanceof Error ? err.message : String(err)
+    }
+  }
+
+  return {
+    ownerLogin,
+    ownerKind,
+    canView,
+    canAdminister,
+    collaborators: everyone
+      .map((c) => ({ login: c.login, avatarUrl: c.avatar_url, role: c.role_name, direct: direct ? direct.has(c.login) : true }))
+      .sort((a, b) => a.login.localeCompare(b.login, undefined, { sensitivity: 'base' })),
+    invitations,
+    invitationsError
+  }
+}
+
+/**
+ * Adds a person, or changes the role of one already there — GitHub has a single
+ * endpoint for both. Without a role GitHub applies its default, and on personal
+ * repositories a role is not accepted at all.
+ */
+export async function addCollaborator(
+  host: string,
+  owner: string,
+  repo: string,
+  username: string,
+  role?: RepositoryRole
+): Promise<AddCollaboratorResult> {
+  const token = await requireToken(host)
+  try {
+    const invitation = await request<ApiInvitation | undefined>(
+      host,
+      `${repositoryPath(owner, repo)}/collaborators/${encodeURIComponent(username)}`,
+      token,
+      { method: 'PUT', body: JSON.stringify(role ? { permission: API_PERMISSION[role] } : {}) }
+    )
+    return invitation ? { kind: 'invited', invitation: toInvitation(invitation) } : { kind: 'added' }
+  } catch (err) {
+    if (err instanceof GitHubApiError && err.status === 404) {
+      throw new GitHubApiError(tMain().github.collaboratorNotFound(username), err.status)
+    }
+    throw err
+  }
+}
+
+export async function removeCollaborator(host: string, owner: string, repo: string, username: string): Promise<void> {
+  const token = await requireToken(host)
+  await request(host, `${repositoryPath(owner, repo)}/collaborators/${encodeURIComponent(username)}`, token, { method: 'DELETE' })
+}
+
+export async function cancelRepositoryInvitation(host: string, owner: string, repo: string, invitationId: number): Promise<void> {
+  const token = await requireToken(host)
+  await request(host, `${repositoryPath(owner, repo)}/invitations/${invitationId}`, token, { method: 'DELETE' })
+}
diff --git a/GitWeb/src/main/ipc.ts b/GitWeb/src/main/ipc.ts
index 15872e7..1fe102d 100644
--- a/GitWeb/src/main/ipc.ts
+++ b/GitWeb/src/main/ipc.ts
@@ -85,7 +85,7 @@ import { saveSecret, getSecret, deleteSecret } from './credentials'
 import { startDeviceFlow, pollDeviceFlow, cancelDeviceFlow, getOAuthAppInfo } from './githubDeviceFlow'
 import * as githubApi from './githubApi'
 import { isAppOrigin } from './security'
-import type { CreatePullRequestInput, MergeMethod, PublishRepositoryInput, PullRequestState } from '../shared/github'
+import type { CreatePullRequestInput, MergeMethod, PublishRepositoryInput, PullRequestState, RepositoryRole } from '../shared/github'
 import { openDirectoryDialog } from './dialogs'
 import {
   addRecentRepositories,
@@ -350,6 +350,19 @@ export function registerIpcHandlers(): void {
     githubApi.listUserReposWithToken(host, token)
   )
 
+  handle('github:getRepositoryCollaborators', (_e, host: string, owner: string, repo: string) =>
+    githubApi.getRepositoryCollaborators(host, owner, repo)
+  )
+  handle('github:addCollaborator', (_e, host: string, owner: string, repo: string, username: string, role?: RepositoryRole) =>
+    githubApi.addCollaborator(host, owner, repo, username, role)
+  )
+  handle('github:removeCollaborator', (_e, host: string, owner: string, repo: string, username: string) =>
+    githubApi.removeCollaborator(host, owner, repo, username)
+  )
+  handle('github:cancelRepositoryInvitation', (_e, host: string, owner: string, repo: string, invitationId: number) =>
+    githubApi.cancelRepositoryInvitation(host, owner, repo, invitationId)
+  )
+
   handle('github:listPullRequests', (_e, host: string, owner: string, repo: string, state: PullRequestState) =>
     githubApi.listPullRequests(host, owner, repo, state)
   )
diff --git a/GitWeb/src/preload/index.d.ts b/GitWeb/src/preload/index.d.ts
index 1abf7fc..02699f5 100644
--- a/GitWeb/src/preload/index.d.ts
+++ b/GitWeb/src/preload/index.d.ts
@@ -52,7 +52,10 @@ import type {
   PullRequestStatus,
   PublishRepositoryInput,
   PublishRepositoryResult,
-  RepositoryOwner
+  AddCollaboratorResult,
+  RepositoryCollaborators,
+  RepositoryOwner,
+  RepositoryRole
 } from '../shared/github'
 import type { UpdateStatus } from '../shared/updates'
 
@@ -194,6 +197,12 @@ export interface Api {
     publishRepository: (cwd: string, input: PublishRepositoryInput) => Promise<PublishRepositoryResult>
     listUserReposWithToken: (host: string, token: string) => Promise<GitHubRepoSummary[]>
 
+    getRepositoryCollaborators: (host: string, owner: string, repo: string) => Promise<RepositoryCollaborators>
+    /** Invites a person, or changes the role of one already there. */
+    addCollaborator: (host: string, owner: string, repo: string, username: string, role?: RepositoryRole) => Promise<AddCollaboratorResult>
+    removeCollaborator: (host: string, owner: string, repo: string, username: string) => Promise<void>
+    cancelRepositoryInvitation: (host: string, owner: string, repo: string, invitationId: number) => Promise<void>
+
     listPullRequests: (host: string, owner: string, repo: string, state: PullRequestState) => Promise<PullRequest[]>
     getPullRequest: (host: string, owner: string, repo: string, number: number) => Promise<PullRequest>
     getBranchRules: (host: string, owner: string, repo: string, branch: string) => Promise<BranchRules>
diff --git a/GitWeb/src/preload/index.ts b/GitWeb/src/preload/index.ts
index cd8e578..516ccf7 100644
--- a/GitWeb/src/preload/index.ts
+++ b/GitWeb/src/preload/index.ts
@@ -53,7 +53,10 @@ import type {
   PullRequestStatus,
   PublishRepositoryInput,
   PublishRepositoryResult,
-  RepositoryOwner
+  AddCollaboratorResult,
+  RepositoryCollaborators,
+  RepositoryOwner,
+  RepositoryRole
 } from '../shared/github'
 import type { UpdateStatus } from '../shared/updates'
 
@@ -276,6 +279,15 @@ const api = {
     listUserReposWithToken: (host: string, token: string): Promise<GitHubRepoSummary[]> =>
       invoke('github:listUserReposWithToken', host, token),
 
+    getRepositoryCollaborators: (host: string, owner: string, repo: string): Promise<RepositoryCollaborators> =>
+      invoke('github:getRepositoryCollaborators', host, owner, repo),
+    addCollaborator: (host: string, owner: string, repo: string, username: string, role?: RepositoryRole): Promise<AddCollaboratorResult> =>
+      invoke('github:addCollaborator', host, owner, repo, username, role),
+    removeCollaborator: (host: string, owner: string, repo: string, username: string): Promise<void> =>
+      invoke('github:removeCollaborator', host, owner, repo, username),
+    cancelRepositoryInvitation: (host: string, owner: string, repo: string, invitationId: number): Promise<void> =>
+      invoke('github:cancelRepositoryInvitation', host, owner, repo, invitationId),
+
     listPullRequests: (host: string, owner: string, repo: string, state: PullRequestState): Promise<PullRequest[]> =>
       invoke('github:listPullRequests', host, owner, repo, state),
     getPullRequest: (host: string, owner: string, repo: string, number: number): Promise<PullRequest> =>
diff --git a/GitWeb/src/renderer/src/App.tsx b/GitWeb/src/renderer/src/App.tsx
index f5f3f5b..a5ada11 100644
--- a/GitWeb/src/renderer/src/App.tsx
+++ b/GitWeb/src/renderer/src/App.tsx
@@ -13,6 +13,7 @@ import FileInsightPanel from './components/FileInsightPanel'
 import RebasePlannerDialog from './components/RebasePlannerDialog'
 import StashesView from './views/StashesView'
 import PullRequestsView from './views/PullRequestsView'
+import CollaboratorsView from './views/CollaboratorsView'
 import DashboardView from './views/DashboardView'
 import AiChatView from './views/AiChatView'
 import SettingsView from './views/SettingsView'
@@ -310,6 +311,7 @@ function App(): JSX.Element {
           {view === 'history' && <HistoryView />}
           {view === 'stash' && <StashesView />}
           {view === 'pullRequests' && <PullRequestsView />}
+          {view === 'collaborators' && <CollaboratorsView />}
           {view === 'dashboard' && <DashboardView />}
           {view === 'settings' && <SettingsView />}
         </main>
diff --git a/GitWeb/src/renderer/src/browserApiStub.ts b/GitWeb/src/renderer/src/browserApiStub.ts
index 4b4f6a8..c48bc01 100644
--- a/GitWeb/src/renderer/src/browserApiStub.ts
+++ b/GitWeb/src/renderer/src/browserApiStub.ts
@@ -69,6 +69,31 @@ function demoGithub(): boolean {
 
 const DEMO_USER = { login: 'demo-dev', name: 'Demo Dev', avatarUrl: 'https://github.com/github.png' }
 
+// localStorage.demoCollaborators picks which situation the Collaborators screen
+// is designed against: 'org' | 'readOnly' | 'noAccess' | 'denied' (default: a
+// personal repository administered by the demo user).
+function demoCollaboratorVariant(): string | null {
+  try {
+    return localStorage.getItem('demoCollaborators')
+  } catch {
+    return null
+  }
+}
+
+let demoCollaborators = [
+  { login: 'demo', avatarUrl: '', role: 'admin', direct: true },
+  { login: 'demo-dev', avatarUrl: '', role: 'admin', direct: true },
+  { login: 'dependabot', avatarUrl: '', role: 'triage', direct: false },
+  { login: 'hubot', avatarUrl: '', role: 'maintain', direct: false },
+  { login: 'monalisa', avatarUrl: '', role: 'read', direct: true },
+  { login: 'octocat', avatarUrl: '', role: 'write', direct: true }
+]
+
+let demoInvitations = [
+  { id: 2, login: 'torvalds', avatarUrl: null, role: 'write', createdAt: new Date(Date.now() - 3 * 3_600_000).toISOString(), expired: false },
+  { id: 1, login: 'defunkt', avatarUrl: null, role: 'read', createdAt: new Date(Date.now() - 9 * 86_400_000).toISOString(), expired: true }
+]
+
 const hoursAgo = (h: number): string => new Date(Date.now() - h * 3600e3).toISOString()
 
 const DEMO_PRS = [
@@ -517,6 +542,47 @@ function installBrowserApiStub(): void {
         throw new Error(GITHUB_UNAVAILABLE)
       },
 
+      getRepositoryCollaborators: async () => {
+        if (!demoGithub()) throw new Error(GITHUB_UNAVAILABLE)
+        const variant = demoCollaboratorVariant()
+        if (variant === 'denied') throw new Error('GitHub recusou a solicitação (403).')
+        if (variant === 'noAccess') {
+          return { ownerLogin: 'demo', ownerKind: 'user' as const, canView: false, canAdminister: false, collaborators: [], invitations: [], invitationsError: null }
+        }
+        const collaborators =
+          variant === 'org'
+            ? demoCollaborators
+            : demoCollaborators.filter((c) => c.direct).map((c) => (c.role === 'admin' ? c : { ...c, role: 'write' }))
+        return {
+          ownerLogin: 'demo',
+          ownerKind: variant === 'org' ? ('org' as const) : ('user' as const),
+          canView: true,
+          canAdminister: variant !== 'readOnly',
+          collaborators,
+          invitations: variant === 'readOnly' ? [] : demoInvitations,
+          invitationsError: null
+        }
+      },
+      addCollaborator: async (_host, _owner, _repo, username, role) => {
+        if (!demoGithub()) throw new Error(GITHUB_UNAVAILABLE)
+        if (username.toLowerCase() === 'ghost-user') throw new Error(`O GitHub não encontrou ${username}, ou sua conta não pode gerenciar este repositório.`)
+        const existing = demoCollaborators.find((c) => c.login.toLowerCase() === username.toLowerCase())
+        if (existing) {
+          if (role) existing.role = role
+          existing.direct = true
+          return { kind: 'added' as const }
+        }
+        const invitation = { id: Date.now(), login: username, avatarUrl: null, role: role ?? 'write', createdAt: new Date().toISOString(), expired: false }
+        demoInvitations = [invitation, ...demoInvitations]
+        return { kind: 'invited' as const, invitation }
+      },
+      removeCollaborator: async (_host, _owner, _repo, username) => {
+        demoCollaborators = demoCollaborators.filter((c) => c.login !== username)
+      },
+      cancelRepositoryInvitation: async (_host, _owner, _repo, invitationId) => {
+        demoInvitations = demoInvitations.filter((i) => i.id !== invitationId)
+      },
+
       listPullRequests: async (_host, _owner, _repo, state) =>
         demoGithub() ? DEMO_PRS.filter((pr) => state === 'all' || pr.state === state) : [],
       getPullRequest: async (_host, _owner, _repo, number) => {
diff --git a/GitWeb/src/renderer/src/components/Combobox.tsx b/GitWeb/src/renderer/src/components/Combobox.tsx
index 09fab1b..397923c 100644
--- a/GitWeb/src/renderer/src/components/Combobox.tsx
+++ b/GitWeb/src/renderer/src/components/Combobox.tsx
@@ -1,6 +1,7 @@
 import { useEffect, useId, useMemo, useRef, useState } from 'react'
 import { Check, ChevronDown } from 'lucide-react'
 import { useClickOutside } from '../lib/useClickOutside'
+import { opensUpward } from '../lib/dropdownPlacement'
 import { useT } from '../lib/i18n'
 
 export interface ComboboxOption {
@@ -21,6 +22,24 @@ interface ComboboxProps {
   className?: string
 }
 
+// max-h-64 and the height of one option row, for deciding where the list fits.
+const LIST_MAX_HEIGHT = 256
+const OPTION_HEIGHT = 34
+
+/** Room on each side of the element inside whatever clips it, not just the window. */
+function roomAround(element: HTMLElement): { above: number; below: number } {
+  const rect = element.getBoundingClientRect()
+  let top = 0
+  let bottom = window.innerHeight
+  for (let parent = element.parentElement; parent; parent = parent.parentElement) {
+    if (getComputedStyle(parent).overflowY === 'visible') continue
+    const bounds = parent.getBoundingClientRect()
+    top = Math.max(top, bounds.top)
+    bottom = Math.min(bottom, bounds.bottom)
+  }
+  return { above: rect.top - top, below: bottom - rect.bottom }
+}
+
 function Combobox({
   value,
   onChange,
@@ -34,6 +53,7 @@ function Combobox({
   const listboxId = useId()
   const optionIdPrefix = useId()
   const [open, setOpen] = useState(false)
+  const [openUpward, setOpenUpward] = useState(false)
   const [search, setSearch] = useState('')
   const t = useT().ui
   const [highlighted, setHighlighted] = useState(0)
@@ -58,6 +78,11 @@ function Combobox({
     setSearch('')
     const selectedIndex = options.findIndex((o) => o.value === value)
     setHighlighted(Math.max(0, selectedIndex))
+    if (ref.current) {
+      const listHeight = Math.min(LIST_MAX_HEIGHT, options.length * OPTION_HEIGHT + 10)
+      const { above, below } = roomAround(ref.current)
+      setOpenUpward(opensUpward(above, below, listHeight))
+    }
     setOpen(true)
   }
 
@@ -146,7 +171,7 @@ function Combobox({
         <ul
           id={listboxId}
           role="listbox"
-          className="absolute left-0 top-[calc(100%+4px)] z-30 max-h-64 w-full min-w-max overflow-y-auto rounded-md border border-default-border bg-coal-raised p-1 shadow-floating"
+          className={`absolute left-0 ${openUpward ? 'bottom-[calc(100%+4px)]' : 'top-[calc(100%+4px)]'} z-30 max-h-64 w-full min-w-max overflow-y-auto rounded-md border border-default-border bg-coal-raised p-1 shadow-floating`}
         >
           {filtered.length === 0 && (
             <li className="px-3 py-2 text-caption text-tertiary-text" role="presentation">
diff --git a/GitWeb/src/renderer/src/components/TopBar.tsx b/GitWeb/src/renderer/src/components/TopBar.tsx
index 0315b92..d08fcae 100644
--- a/GitWeb/src/renderer/src/components/TopBar.tsx
+++ b/GitWeb/src/renderer/src/components/TopBar.tsx
@@ -19,7 +19,8 @@ import {
   RefreshCw,
   Settings2,
   Trash2,
-  UploadCloud
+  UploadCloud,
+  Users
 } from 'lucide-react'
 import { basename } from '../lib/path'
 import DeleteBranchDialog from './DeleteBranchDialog'
@@ -743,6 +744,7 @@ function TopBar(): JSX.Element {
     { id: 'history' as const, label: t.tabs.history, icon: Clock },
     { id: 'stash' as const, label: t.tabs.stash, icon: Archive },
     { id: 'pullRequests' as const, label: t.tabs.pullRequests, icon: GitPullRequest },
+    { id: 'collaborators' as const, label: t.tabs.collaborators, icon: Users },
     { id: 'dashboard' as const, label: t.tabs.dashboard, icon: LayoutDashboard },
     { id: 'settings' as const, label: t.tabs.settings, icon: Settings2 }
   ]
diff --git a/GitWeb/src/renderer/src/lib/dropdownPlacement.ts b/GitWeb/src/renderer/src/lib/dropdownPlacement.ts
new file mode 100644
index 0000000..c3d1e71
--- /dev/null
+++ b/GitWeb/src/renderer/src/lib/dropdownPlacement.ts
@@ -0,0 +1,8 @@
+/**
+ * Opening upward is only safe when the whole list fits there: anything above a
+ * scroll container can't be scrolled to, while a list running past the bottom
+ * still can. So it stays below unless that would overflow and above has room.
+ */
+export function opensUpward(above: number, below: number, listHeight: number): boolean {
+  return below < listHeight && above >= listHeight
+}
diff --git a/GitWeb/src/renderer/src/store/collaboratorStore.ts b/GitWeb/src/renderer/src/store/collaboratorStore.ts
new file mode 100644
index 0000000..bab1839
--- /dev/null
+++ b/GitWeb/src/renderer/src/store/collaboratorStore.ts
@@ -0,0 +1,212 @@
+import { create } from 'zustand'
+import type { RemoteInfo } from '../lib/github'
+import {
+  normalizeGitHubUsername,
+  type RepositoryCollaborator,
+  type RepositoryCollaborators,
+  type RepositoryRole
+} from '../../../shared/github'
+import { usePullRequestStore } from './pullRequestStore'
+import { getT } from '../lib/i18n'
+
+interface CollaboratorStoreState {
+  /** The repository and account `data` belongs to, so the view never shows it to anyone else. */
+  sessionKey: string | null
+  data: RepositoryCollaborators | null
+  isLoading: boolean
+  isSaving: boolean
+  /** Only when there is nothing to show; a failed refresh keeps the list and goes to the banner. */
+  loadError: string | null
+  /** Why the username in the form can't be invited; shown next to the field. */
+  fieldError: string | null
+
+  load: () => Promise<void>
+  /** Resolves true when the person was invited or added, so the view can clear the field. */
+  add: (input: string, role?: RepositoryRole) => Promise<boolean>
+  remove: (login: string) => Promise<void>
+  cancelInvitation: (id: number, login: string) => Promise<void>
+  changeRole: (login: string, role: RepositoryRole) => Promise<void>
+  clearFieldError: () => void
+}
+
+/** What one write needs: where it goes, and how to record its outcome once it lands. */
+interface WriteScope {
+  remote: RemoteInfo
+  patch: (change: (data: RepositoryCollaborators) => Partial<RepositoryCollaborators>) => void
+  reportSuccess: (message: string) => void
+}
+
+export function sessionKeyOf(remote: RemoteInfo, login: string): string {
+  return `${remote.host}/${remote.owner}/${remote.repo}:${login}`.toLowerCase()
+}
+
+function describeError(err: unknown): string {
+  return err instanceof Error ? err.message : String(err)
+}
+
+function sameLogin(a: string | null, b: string): boolean {
+  return a?.toLowerCase() === b.toLowerCase()
+}
+
+function byLogin(a: RepositoryCollaborator, b: RepositoryCollaborator): number {
+  return a.login.localeCompare(b.login, undefined, { sensitivity: 'base' })
+}
+
+function currentSessionKey(): string | null {
+  const { remote, user } = usePullRequestStore.getState()
+  return remote && user ? sessionKeyOf(remote, user.login) : null
+}
+
+// A slower answer must not overwrite what came after it: a newer load, or a
+// write, whose result the older list doesn't know about yet.
+let loadGeneration = 0
+
+export const useCollaboratorStore = create<CollaboratorStoreState>((set, get) => {
+  /**
+   * Runs a write against the repository on screen. Outcomes go through the pull
+   * request store because that is what feeds the shell's GitHub banners. The
+   * user may have moved on by the time it lands, so the list is only touched if
+   * it is still this session's, and a banner about another repository names it.
+   */
+  async function save(write: (scope: WriteScope) => Promise<void>): Promise<boolean> {
+    const { remote, user } = usePullRequestStore.getState()
+    if (!remote || !user || get().isSaving) return false
+    const key = sessionKeyOf(remote, user.login)
+    const describe = (message: string): string =>
+      currentSessionKey() === key ? message : `${remote.owner}/${remote.repo}: ${message}`
+
+    loadGeneration++
+    set({ isSaving: true, isLoading: false })
+    usePullRequestStore.setState({ error: null, successMessage: null })
+    try {
+      await write({
+        remote,
+        patch: (change) =>
+          set((state) => (state.sessionKey === key && state.data ? { data: { ...state.data, ...change(state.data) } } : {})),
+        reportSuccess: (message) => usePullRequestStore.setState({ successMessage: describe(message) })
+      })
+      return true
+    } catch (err) {
+      usePullRequestStore.setState({ error: describe(describeError(err)) })
+      return false
+    } finally {
+      set({ isSaving: false })
+    }
+  }
+
+  return {
+    sessionKey: null,
+    data: null,
+    isLoading: false,
+    isSaving: false,
+    loadError: null,
+    fieldError: null,
+
+    load: async () => {
+      const { remote, user } = usePullRequestStore.getState()
+      if (!remote || !user) return
+      const key = sessionKeyOf(remote, user.login)
+      // Whatever a read returns now could predate the write in progress.
+      if (get().isSaving && get().sessionKey === key) return
+      const generation = ++loadGeneration
+      set((state) =>
+        state.sessionKey === key
+          ? { isLoading: true, loadError: null }
+          : { sessionKey: key, data: null, isLoading: true, loadError: null, fieldError: null }
+      )
+      try {
+        const data = await window.api.github.getRepositoryCollaborators(remote.host, remote.owner, remote.repo)
+        if (generation === loadGeneration) set({ data })
+      } catch (err) {
+        if (generation !== loadGeneration) return
+        if (get().data) usePullRequestStore.setState({ error: describeError(err) })
+        else set({ loadError: describeError(err) })
+      } finally {
+        if (generation === loadGeneration) set({ isLoading: false })
+      }
+    },
+
+    add: async (input, role) => {
+      const t = getT().collaborators
+      const login = normalizeGitHubUsername(input)
+      if (!login) {
+        set({ fieldError: input.trim().replace(/^@/, '').includes('@') ? t.emailNotAccepted : t.invalidUsername })
+        return false
+      }
+      // Adding someone already here is a role change on GitHub's side, and the
+      // default role would quietly demote an admin.
+      const { data } = get()
+      if (data?.collaborators.some((c) => c.direct && sameLogin(c.login, login))) {
+        set({ fieldError: t.alreadyCollaborator(login) })
+        return false
+      }
+      if (data?.invitations.some((i) => !i.expired && sameLogin(i.login, login))) {
+        set({ fieldError: t.alreadyInvited(login) })
+        return false
+      }
+
+      set({ fieldError: null })
+      return save(async ({ remote, patch, reportSuccess }) => {
+        const result = await window.api.github.addCollaborator(remote.host, remote.owner, remote.repo, login, role)
+        if (result.kind === 'invited') {
+          // Takes the place of an expired invitation for the same person.
+          patch((current) => ({
+            invitations: [result.invitation, ...current.invitations.filter((i) => i.id !== result.invitation.id && !sameLogin(i.login, login))]
+          }))
+          reportSuccess(t.invited(login))
+          return
+        }
+        // Not read back: a list read right after the write can still show the old state.
+        patch((current) => {
+          const existing = current.collaborators.find((c) => sameLogin(c.login, login))
+          const added: RepositoryCollaborator = {
+            login: existing?.login ?? login,
+            avatarUrl: existing?.avatarUrl ?? '',
+            role: role ?? existing?.role ?? 'write',
+            direct: true
+          }
+          return { collaborators: [...current.collaborators.filter((c) => c !== existing), added].sort(byLogin) }
+        })
+        reportSuccess(t.added(login))
+      })
+    },
+
+    remove: async (login) => {
+      const t = getT().collaborators
+      // On an organization, a team or the org itself can still grant access this call can't see.
+      const isOrg = get().data?.ownerKind === 'org'
+      await save(async ({ remote, patch, reportSuccess }) => {
+        await window.api.github.removeCollaborator(remote.host, remote.owner, remote.repo, login)
+        patch((current) => ({ collaborators: current.collaborators.filter((c) => c.login !== login) }))
+        reportSuccess(isOrg ? t.directAccessRemoved(login) : t.removed(login))
+      })
+    },
+
+    cancelInvitation: async (id, login) => {
+      await save(async ({ remote, patch, reportSuccess }) => {
+        await window.api.github.cancelRepositoryInvitation(remote.host, remote.owner, remote.repo, id)
+        patch((current) => ({ invitations: current.invitations.filter((i) => i.id !== id) }))
+        reportSuccess(getT().collaborators.inviteCancelled(login))
+      })
+    },
+
+    changeRole: async (login, role) => {
+      await save(async ({ remote, patch, reportSuccess }) => {
+        const t = getT().collaborators
+        const result = await window.api.github.addCollaborator(remote.host, remote.owner, remote.repo, login, role)
+        if (result.kind === 'invited') {
+          patch((current) => ({
+            collaborators: current.collaborators.filter((c) => c.login !== login),
+            invitations: [result.invitation, ...current.invitations]
+          }))
+          reportSuccess(t.invited(login))
+        } else {
+          patch((current) => ({ collaborators: current.collaborators.map((c) => (c.login === login ? { ...c, role } : c)) }))
+          reportSuccess(t.roleChanged(login, t.roles[role]))
+        }
+      })
+    },
+
+    clearFieldError: () => set({ fieldError: null })
+  }
+})
diff --git a/GitWeb/src/renderer/src/store/repoStore.ts b/GitWeb/src/renderer/src/store/repoStore.ts
index 56df1e1..5edfb89 100644
--- a/GitWeb/src/renderer/src/store/repoStore.ts
+++ b/GitWeb/src/renderer/src/store/repoStore.ts
@@ -29,7 +29,7 @@ import { directPushBlock } from '../lib/branchProtection'
 import { isInsidePath, joinPath, pathKey } from '../lib/path'
 import { extractHunkPatch, parseFileDiff } from '../../../shared/patch'
 
-type ViewName = 'changes' | 'history' | 'stash' | 'pullRequests' | 'dashboard' | 'settings' | 'about'
+type ViewName = 'changes' | 'history' | 'stash' | 'pullRequests' | 'collaborators' | 'dashboard' | 'settings' | 'about'
 
 interface SelectedFile {
   path: string
diff --git a/GitWeb/src/renderer/src/views/CollaboratorsView.tsx b/GitWeb/src/renderer/src/views/CollaboratorsView.tsx
new file mode 100644
index 0000000..2af43df
--- /dev/null
+++ b/GitWeb/src/renderer/src/views/CollaboratorsView.tsx
@@ -0,0 +1,386 @@
+import { useEffect, useId, useState, type FormEvent, type ReactNode } from 'react'
+import { AlertCircle, AlertTriangle, Clock, Loader2, Lock, RefreshCw, UserMinus, UserPlus, Users, X } from 'lucide-react'
+import ConfirmDialog from '../components/ConfirmDialog'
+import Combobox from '../components/Combobox'
+import { Avatar, LoginForm } from './PullRequestsView'
+import { usePullRequestStore } from '../store/pullRequestStore'
+import { sessionKeyOf, useCollaboratorStore } from '../store/collaboratorStore'
+import { useLocale, useT } from '../lib/i18n'
+import { relativeTime } from '../lib/relativeTime'
+import type { GitHubUser, RemoteInfo } from '../lib/github'
+import { canManageCollaborator, REPOSITORY_ROLES, type RepositoryRole } from '../../../shared/github'
+
+type PendingAction =
+  | { kind: 'remove'; login: string }
+  | { kind: 'cancel'; id: number; login: string }
+  | { kind: 'role'; login: string; role: RepositoryRole }
+
+const AVATAR_SIZE = 32
+
+function isStandardRole(role: string): role is RepositoryRole {
+  return (REPOSITORY_ROLES as readonly string[]).includes(role)
+}
+
+/** The same pill the pull request list uses to mark the current branch. */
+function NameBadge({ children }: { children: ReactNode }): JSX.Element {
+  return (
+    <span className="inline-flex shrink-0 items-center rounded-pill bg-command-blue-soft px-2 py-px text-label font-medium text-command-blue">
+      {children}
+    </span>
+  )
+}
+
+/** Full-pane message for when there is no list to show. */
+function PaneMessage({ icon, title, children }: { icon: ReactNode; title: string; children?: ReactNode }): JSX.Element {
+  return (
+    <div className="rise-in flex flex-col items-center gap-3 py-12 text-center">
+      <span className="empty-medallion">{icon}</span>
+      <h2 className="text-body font-medium text-primary-text">{title}</h2>
+      {children}
+    </div>
+  )
+}
+
+function CollaboratorsPanel({ remote, user }: { remote: RemoteInfo; user: GitHubUser }): JSX.Element {
+  const sessionKey = useCollaboratorStore((s) => s.sessionKey)
+  const storedData = useCollaboratorStore((s) => s.data)
+  const isLoading = useCollaboratorStore((s) => s.isLoading)
+  const isSaving = useCollaboratorStore((s) => s.isSaving)
+  const storedLoadError = useCollaboratorStore((s) => s.loadError)
+  const fieldError = useCollaboratorStore((s) => s.fieldError)
+  const load = useCollaboratorStore((s) => s.load)
+  const add = useCollaboratorStore((s) => s.add)
+  const remove = useCollaboratorStore((s) => s.remove)
+  const cancelInvitation = useCollaboratorStore((s) => s.cancelInvitation)
+  const changeRole = useCollaboratorStore((s) => s.changeRole)
+  const clearFieldError = useCollaboratorStore((s) => s.clearFieldError)
+
+  const [username, setUsername] = useState('')
+  const [newRole, setNewRole] = useState<RepositoryRole>('write')
+  const [pending, setPending] = useState<PendingAction | null>(null)
+  const baseId = useId()
+  const t = useT().collaborators
+  const locale = useLocale()
+
+  useEffect(() => {
+    void load()
+  }, [load])
+
+  // Between mounting and the first load the store still holds the previous repository or account.
+  const current = sessionKey === sessionKeyOf(remote, user.login)
+  const data = current ? storedData : null
+  const loadError = current ? storedLoadError : null
+  const shownFieldError = current ? fieldError : null
+  const repoName = `${remote.owner}/${remote.repo}`
+  const isOrg = data?.ownerKind === 'org'
+
+  const roleLabel = (role: string): string => (isStandardRole(role) ? t.roles[role] : role)
+  const roleOptions = (extra?: string): { value: string; label: string }[] => [
+    ...REPOSITORY_ROLES.map((value) => ({ value, label: t.roles[value] })),
+    // A custom role isn't in the list, and the field must not claim someone holds another one.
+    ...(extra && !isStandardRole(extra) ? [{ value: extra, label: extra }] : [])
+  ]
+
+  async function handleAdd(event: FormEvent): Promise<void> {
+    event.preventDefault()
+    if (await add(username, isOrg ? newRole : undefined)) setUsername('')
+  }
+
+  function confirmPending(): void {
+    if (!pending) return
+    if (pending.kind === 'remove') void remove(pending.login)
+    else if (pending.kind === 'cancel') void cancelInvitation(pending.id, pending.login)
+    else void changeRole(pending.login, pending.role)
+    setPending(null)
+  }
+
+  return (
+    <div className="h-full overflow-y-auto">
+      <div className="mx-auto flex w-full max-w-2xl flex-col gap-6 p-6">
+        <header className="flex items-start justify-between gap-3">
+          <div className="flex min-w-0 flex-col gap-1">
+            <h1 className="flex items-center gap-2 text-title font-semibold text-primary-text">
+              {t.title}
+              {data && data.collaborators.length > 0 && <span className="count-badge">{data.collaborators.length}</span>}
+            </h1>
+            <p className="truncate text-caption text-secondary-text">{repoName}</p>
+          </div>
+          <button
+            type="button"
+            onClick={() => void load()}
+            disabled={isLoading || isSaving}
+            className="btn-ghost size-8 shrink-0 px-0"
+            aria-label={t.refreshAria}
+            title={t.refresh}
+          >
+            <RefreshCw size={14} className={isLoading ? 'animate-spin' : undefined} aria-hidden />
+          </button>
+        </header>
+
+        {loadError ? (
+          <PaneMessage icon={<AlertCircle size={20} className="text-danger-red" aria-hidden />} title={t.loadFailedTitle}>
+            <p role="alert" className="max-w-md break-words text-caption text-secondary-text">
+              {loadError}
+            </p>
+            <button type="button" onClick={() => void load()} disabled={isLoading} className="btn-secondary mt-1">
+              {t.retry}
+            </button>
+          </PaneMessage>
+        ) : !data ? (
+          <p role="status" className="flex items-center justify-center gap-2 py-12 text-body text-secondary-text">
+            <Loader2 size={14} className="animate-spin" aria-hidden />
+            {t.loading}
+          </p>
+        ) : !data.canView ? (
+          <PaneMessage icon={<Lock size={20} aria-hidden />} title={t.noAccessTitle}>
+            <p className="max-w-sm text-caption text-secondary-text">{t.noAccess}</p>
+          </PaneMessage>
+        ) : (
+          <>
+            {data.canAdminister ? (
+              <section className="flex flex-col gap-2.5" aria-labelledby={`${baseId}-add`}>
+                <h2 id={`${baseId}-add`} className="settings-heading">
+                  {t.addTitle}
+                </h2>
+                {/* Visible overflow: the group would clip the permission list otherwise. */}
+                <form onSubmit={(event) => void handleAdd(event)} className="settings-group overflow-visible">
+                  <div className="settings-row flex flex-col gap-2.5">
+                    <div className="flex flex-wrap items-end gap-2.5">
+                      <div className="min-w-48 flex-1">
+                        <label htmlFor={`${baseId}-username`} className="block text-caption text-secondary-text">
+                          {t.usernameLabel}
+                        </label>
+                        <input
+                          id={`${baseId}-username`}
+                          type="text"
+                          value={username}
+                          onChange={(e) => {
+                            setUsername(e.target.value)
+                            if (shownFieldError) clearFieldError()
+                          }}
+                          placeholder={t.usernamePlaceholder}
+                          autoComplete="off"
+                          spellCheck={false}
+                          aria-invalid={shownFieldError ? true : undefined}
+                          aria-describedby={`${baseId}-hint`}
+                          className="field mt-1.5 h-[34px] w-full py-0"
+                        />
+                      </div>
+                      {isOrg && (
+                        <div className="w-40">
+                          <p className="text-caption text-secondary-text">{t.roleLabel}</p>
+                          <Combobox
+                            value={newRole}
+                            onChange={(value) => setNewRole(value as RepositoryRole)}
+                            options={roleOptions()}
+                            ariaLabel={t.roleLabel}
+                            disabled={isSaving}
+                            className="mt-1.5"
+                          />
+                        </div>
+                      )}
+                      <button type="submit" disabled={!username.trim() || isSaving} className="btn-primary shrink-0">
+                        {isSaving ? <Loader2 size={14} className="animate-spin" aria-hidden /> : <UserPlus size={14} aria-hidden />}
+                        {t.invite}
+                      </button>
+                    </div>
+                    {shownFieldError ? (
+                      <p id={`${baseId}-hint`} role="alert" className="flex items-center gap-1.5 text-caption text-danger-red">
+                        <AlertTriangle size={12} className="shrink-0" aria-hidden />
+                        {shownFieldError}
+                      </p>
+                    ) : (
+                      <p id={`${baseId}-hint`} className="text-caption text-tertiary-text">
+                        {t.addHint}
+                      </p>
+                    )}
+                  </div>
+                </form>
+              </section>
+            ) : (
+              <div className="settings-group">
+                <div className="settings-row flex items-center gap-3">
+                  <span className="settings-icon">
+                    <Lock size={15} aria-hidden />
+                  </span>
+                  <p className="min-w-0 text-caption text-secondary-text">{t.readOnly}</p>
+                </div>
+              </div>
+            )}
+
+            {data.invitationsError && (
+              <p role="alert" className="flex items-start gap-1.5 text-caption text-warning-amber">
+                <AlertTriangle size={12} className="mt-0.5 shrink-0" aria-hidden />
+                <span className="min-w-0 break-words">{t.invitationsFailed(data.invitationsError)}</span>
+              </p>
+            )}
+
+            {data.invitations.length > 0 && (
+              <section className="flex flex-col gap-2.5" aria-labelledby={`${baseId}-pending`}>
+                <h2 id={`${baseId}-pending`} className="settings-heading">
+                  {t.pendingTitle}
+                  <span className="count-badge">{data.invitations.length}</span>
+                </h2>
+                <ul className="settings-group">
+                  {data.invitations.map((invitation) => {
+                    const name = invitation.login ?? t.unknownInvitee
+                    return (
+                      <li key={invitation.id} className="settings-row flex flex-wrap items-center gap-x-3 gap-y-2">
+                        <Avatar login={invitation.login ?? ''} src={invitation.avatarUrl} size={AVATAR_SIZE} />
+                        <div className="min-w-32 flex-1">
+                          <p className="truncate text-body font-medium text-primary-text">{name}</p>
+                          <p className="truncate text-caption text-tertiary-text">
+                            {roleLabel(invitation.role)} · {t.invitedAt(relativeTime(locale, invitation.createdAt))}
+                          </p>
+                        </div>
+                        <div className="flex shrink-0 items-center gap-2">
+                          <span className={invitation.expired ? 'chip-danger' : 'chip-attention'}>
+                            <Clock size={11} aria-hidden />
+                            {invitation.expired ? t.expiredChip : t.pendingChip}
+                          </span>
+                          <button
+                            type="button"
+                            onClick={() => setPending({ kind: 'cancel', id: invitation.id, login: name })}
+                            disabled={isSaving}
+                            aria-label={t.cancelInviteAria(name)}
+                            className="section-action is-danger"
+                          >
+                            <X size={13} aria-hidden />
+                            {t.cancelInvite}
+                          </button>
+                        </div>
+                      </li>
+                    )
+                  })}
+                </ul>
+              </section>
+            )}
+
+            <section className="flex flex-col gap-2.5" aria-labelledby={`${baseId}-people`}>
+              <h2 id={`${baseId}-people`} className="settings-heading">
+                {t.peopleTitle}
+              </h2>
+              {data.collaborators.length === 0 ? (
+                <PaneMessage icon={<Users size={20} aria-hidden />} title={t.empty} />
+              ) : (
+                <ul className="settings-group overflow-visible">
+                  {data.collaborators.map((collaborator) => {
+                    const { login, role, direct } = collaborator
+                    const manageable = canManageCollaborator(collaborator, {
+                      canAdminister: data.canAdminister,
+                      owner: data.ownerLogin,
+                      viewer: user.login
+                    })
+                    const roleEditable = manageable && isOrg
+                    const details = [roleEditable ? null : roleLabel(role), isOrg ? (direct ? t.direct : t.inherited) : null]
+                      .filter(Boolean)
+                      .join(' · ')
+                    return (
+                      <li key={login} className="settings-row flex flex-wrap items-center gap-x-3 gap-y-2">
+                        <Avatar login={login} src={collaborator.avatarUrl} size={AVATAR_SIZE} />
+                        <div className="min-w-32 flex-1">
+                          <p className="flex min-w-0 items-center gap-1.5">
+                            <span className="truncate text-body font-medium text-primary-text">{login}</span>
+                            {login.toLowerCase() === user.login.toLowerCase() && <NameBadge>{t.you}</NameBadge>}
+                            {login.toLowerCase() === data.ownerLogin.toLowerCase() && <NameBadge>{t.owner}</NameBadge>}
+                          </p>
+                          <p className="truncate text-caption text-tertiary-text" title={direct ? undefined : t.inheritedTitle}>
+                            {details}
+                          </p>
+                        </div>
+                        {manageable && (
+                          <div className="flex shrink-0 items-center gap-2">
+                            {roleEditable && (
+                              <Combobox
+                                value={role}
+                                onChange={(value) => {
+                                  if (value !== role && isStandardRole(value)) setPending({ kind: 'role', login, role: value })
+                                }}
+                                options={roleOptions(role)}
+                                ariaLabel={t.roleAria(login)}
+                                disabled={isSaving}
+                                className="w-36"
+                              />
+                            )}
+                            <button
+                              type="button"
+                              onClick={() => setPending({ kind: 'remove', login })}
+                              disabled={isSaving}
+                              aria-label={t.removeAria(login)}
+                              className="section-action is-danger"
+                            >
+                              <UserMinus size={13} aria-hidden />
+                              {t.remove}
+                            </button>
+                          </div>
+                        )}
+                      </li>
+                    )
+                  })}
+                </ul>
+              )}
+            </section>
+          </>
+        )}
+      </div>
+
+      <ConfirmDialog
+        open={pending?.kind === 'remove'}
+        danger
+        title={t.removeDialogTitle}
+        message={pending?.kind === 'remove' ? t.removeDialogMessage(pending.login, repoName) : ''}
+        confirmLabel={t.removeConfirm}
+        onConfirm={confirmPending}
+        onCancel={() => setPending(null)}
+      />
+      <ConfirmDialog
+        open={pending?.kind === 'cancel'}
+        danger
+        title={t.cancelDialogTitle}
+        message={pending?.kind === 'cancel' ? t.cancelDialogMessage(pending.login) : ''}
+        confirmLabel={t.cancelConfirm}
+        cancelLabel={t.keepInvite}
+        onConfirm={confirmPending}
+        onCancel={() => setPending(null)}
+      />
+      <ConfirmDialog
+        open={pending?.kind === 'role'}
+        title={t.roleDialogTitle}
+        message={pending?.kind === 'role' ? t.roleDialogMessage(pending.login, t.roles[pending.role]) : ''}
+        confirmLabel={t.roleConfirm}
+        onConfirm={confirmPending}
+        onCancel={() => setPending(null)}
+      />
+    </div>
+  )
+}
+
+function CollaboratorsView(): JSX.Element {
+  const remote = usePullRequestStore((s) => s.remote)
+  const user = usePullRequestStore((s) => s.user)
+  const t = useT().collaborators
+
+  if (!remote) {
+    return (
+      <div className="flex h-full flex-col items-center justify-center gap-3 p-6 text-center text-secondary-text">
+        <h1 className="sr-only">{t.title}</h1>
+        <Users size={32} aria-hidden />
+        <p>{t.noRemote}</p>
+      </div>
+    )
+  }
+
+  if (!user) {
+    return (
+      <div className="flex h-full items-center justify-center p-6">
+        <h1 className="sr-only">{t.title}</h1>
+        <LoginForm hint={t.loginHint} />
+      </div>
+    )
+  }
+
+  // Keyed so a half-typed username or an open dialog never carries over to another repository.
+  return <CollaboratorsPanel key={sessionKeyOf(remote, user.login)} remote={remote} user={user} />
+}
+
+export default CollaboratorsView
diff --git a/GitWeb/src/renderer/src/views/PullRequestsView.tsx b/GitWeb/src/renderer/src/views/PullRequestsView.tsx
index 3aa3cf8..5720603 100644
--- a/GitWeb/src/renderer/src/views/PullRequestsView.tsx
+++ b/GitWeb/src/renderer/src/views/PullRequestsView.tsx
@@ -157,7 +157,7 @@ function MergeMethodHint({ method }: { method: MergeMethod }): JSX.Element {
   )
 }
 
-function LoginForm(): JSX.Element {
+export function LoginForm({ hint }: { hint?: string }): JSX.Element {
   const remote = usePullRequestStore((s) => s.remote)
   const isBusy = usePullRequestStore((s) => s.isBusy)
   const loginWithToken = usePullRequestStore((s) => s.loginWithToken)
@@ -173,7 +173,7 @@ function LoginForm(): JSX.Element {
       </span>
       <p className="mb-4 text-body text-secondary-text">
         {t.remoteDetected} <strong className="text-primary-text">{remote?.owner}/{remote?.repo}</strong> {t.remoteOn}{' '}
-        <span className="text-tertiary-text">{remote?.host}</span>. {t.loginHint}
+        <span className="text-tertiary-text">{remote?.host}</span>. {hint ?? t.loginHint}
       </p>
 
       <button
@@ -312,7 +312,7 @@ function PrStatePill({ pr }: { pr: PullRequest }): JSX.Element {
 }
 
 /** GitHub serves every account's avatar at github.com/<login>.png; a failed load just hides it. */
-function Avatar({ login, size = 20 }: { login: string; size?: number }): JSX.Element {
+export function Avatar({ login, size = 20, src }: { login: string; size?: number; src?: string | null }): JSX.Element {
   const [failed, setFailed] = useState(false)
   if (failed || !login) {
     return (
@@ -323,7 +323,7 @@ function Avatar({ login, size = 20 }: { login: string; size?: number }): JSX.Ele
   }
   return (
     <img
-      src={`https://github.com/${encodeURIComponent(login)}.png?size=${size * 2}`}
+      src={src || `https://github.com/${encodeURIComponent(login)}.png?size=${size * 2}`}
       alt=""
       width={size}
       height={size}
diff --git a/GitWeb/src/shared/github.ts b/GitWeb/src/shared/github.ts
index a9bbddf..081607a 100644
--- a/GitWeb/src/shared/github.ts
+++ b/GitWeb/src/shared/github.ts
@@ -147,6 +147,78 @@ export function sanitizeRepositoryName(value: string): string {
     .slice(0, 100)
 }
 
+/** GitHub's five standard repository roles, as `role_name` spells them. */
+export const REPOSITORY_ROLES = ['read', 'triage', 'write', 'maintain', 'admin'] as const
+export type RepositoryRole = (typeof REPOSITORY_ROLES)[number]
+
+export interface RepositoryCollaborator {
+  login: string
+  avatarUrl: string
+  /** A standard role, or the name of a custom role defined by the organization. */
+  role: string
+  /** False when access only comes from the organization or a team, which this repository cannot take away. */
+  direct: boolean
+}
+
+export interface RepositoryInvitation {
+  id: number
+  /** Null when the invitation went to an e-mail address with no account behind it. */
+  login: string | null
+  avatarUrl: string | null
+  role: string
+  createdAt: string
+  expired: boolean
+}
+
+export interface RepositoryCollaborators {
+  /** As GitHub reports it: the remote URL can still name the owner from before a transfer or rename. */
+  ownerLogin: string
+  ownerKind: 'user' | 'org'
+  /** GitHub only lists collaborators to accounts with write access or higher. */
+  canView: boolean
+  canAdminister: boolean
+  collaborators: RepositoryCollaborator[]
+  invitations: RepositoryInvitation[]
+  /** Set when the invitations could not be read — an empty list then means "unknown", not "none". */
+  invitationsError: string | null
+}
+
+/** 201 means GitHub sent an invitation; 204 means access changed right away. */
+export type AddCollaboratorResult = { kind: 'invited'; invitation: RepositoryInvitation } | { kind: 'added' }
+
+/**
+ * The login in whatever the user typed or pasted (`@octocat`, a profile URL),
+ * or null when it cannot be one, such as an e-mail address. Underscores are
+ * legal only for Enterprise Managed Users, but those are real logins.
+ */
+export function normalizeGitHubUsername(input: string): string | null {
+  const login = input
+    .trim()
+    .replace(/^(?:https?:\/\/[^/]+|(?:[a-z\d-]+\.)+[a-z]{2,}(?::\d+)?)\//i, '')
+    .replace(/[?#].*$/, '')
+    .replace(/\/+$/, '')
+    .replace(/^@/, '')
+  return /^[a-z\d](?:[a-z\d_-]{0,37}[a-z\d_])?$/i.test(login) ? login : null
+}
+
+/**
+ * Whether this person's access can be changed from here. The owner cannot lose
+ * access, inherited access is not this repository's to remove, and an admin
+ * changing their own access could lock themselves out with no way back.
+ */
+export function canManageCollaborator(
+  collaborator: RepositoryCollaborator,
+  context: { canAdminister: boolean; owner: string; viewer: string }
+): boolean {
+  const login = collaborator.login.toLowerCase()
+  return (
+    context.canAdminister &&
+    collaborator.direct &&
+    login !== context.owner.toLowerCase() &&
+    login !== context.viewer.toLowerCase()
+  )
+}
+
 export type PullRequestReviewEvent = 'APPROVE' | 'REQUEST_CHANGES' | 'COMMENT'
 
 export interface PullRequestReviewCommentInput {
diff --git a/GitWeb/src/shared/i18n/index.ts b/GitWeb/src/shared/i18n/index.ts
index 6a1e9db..069ab9b 100644
--- a/GitWeb/src/shared/i18n/index.ts
+++ b/GitWeb/src/shared/i18n/index.ts
@@ -13,6 +13,7 @@ import pullRequests from './messages/pullRequests'
 import publish from './messages/publish'
 import aiSettings from './messages/aiSettings'
 import clone from './messages/clone'
+import collaborators from './messages/collaborators'
 import githubLogin from './messages/githubLogin'
 import graph from './messages/graph'
 import graphTools from './messages/graphTools'
@@ -30,6 +31,7 @@ const namespaces = {
   aiSettings,
   changes,
   clone,
+  collaborators,
   common,
   dashboard,
   githubLogin,
diff --git a/GitWeb/src/shared/i18n/messages/collaborators.ts b/GitWeb/src/shared/i18n/messages/collaborators.ts
new file mode 100644
index 0000000..7d022f2
--- /dev/null
+++ b/GitWeb/src/shared/i18n/messages/collaborators.ts
@@ -0,0 +1,203 @@
+const ptBR = {
+  title: 'Colaboradores',
+  loginHint: 'Entre com o GitHub para ver e gerenciar quem tem acesso a este repositório.',
+  noRemote: 'Este repositório não tem um remote do GitHub configurado (origin).',
+  refresh: 'Atualizar',
+  refreshAria: 'Atualizar colaboradores',
+  retry: 'Tentar de novo',
+  loading: 'Carregando colaboradores…',
+  addTitle: 'Adicionar pessoa',
+  usernameLabel: 'Username no GitHub',
+  usernamePlaceholder: 'username',
+  roleLabel: 'Permissão',
+  invite: 'Convidar',
+  addHint: 'Quem ainda não tem acesso recebe um convite do GitHub e só entra depois de aceitar.',
+  invalidUsername: 'Esse não é um username válido do GitHub.',
+  emailNotAccepted: 'Digite o username do GitHub. Convite por e-mail não é aceito aqui.',
+  readOnly: 'Só administradores do repositório podem convidar, remover ou mudar permissões.',
+  noAccessTitle: 'Sem acesso à lista',
+  noAccess: 'O GitHub só mostra os colaboradores para quem tem permissão de escrita neste repositório.',
+  loadFailedTitle: 'Não foi possível carregar os colaboradores',
+  pendingTitle: 'Convites pendentes',
+  invitationsFailed: (reason: string) => `Não foi possível ler os convites pendentes: ${reason}`,
+  invitedAt: (when: string) => `Convite enviado ${when}`,
+  expiredChip: 'Expirado',
+  pendingChip: 'Pendente',
+  unknownInvitee: 'Convite sem conta no GitHub',
+  cancelInvite: 'Cancelar convite',
+  cancelInviteAria: (login: string) => `Cancelar convite de ${login}`,
+  peopleTitle: 'Pessoas com acesso',
+  empty: 'Nenhum colaborador encontrado.',
+  you: 'Você',
+  owner: 'Dono',
+  direct: 'Acesso direto',
+  inherited: 'Via organização',
+  inheritedTitle: 'O acesso vem da organização ou de um time, e não pode ser retirado por este repositório.',
+  roleAria: (login: string) => `Permissão de ${login}`,
+  remove: 'Remover',
+  removeAria: (login: string) => `Remover ${login}`,
+  roles: {
+    read: 'Leitura',
+    triage: 'Triagem',
+    write: 'Escrita',
+    maintain: 'Manutenção',
+    admin: 'Administrador'
+  },
+  removeDialogTitle: 'Remover colaborador?',
+  removeDialogMessage: (login: string, repo: string) =>
+    `${login} perde o acesso direto a ${repo}. Para voltar, precisará de um novo convite.`,
+  removeConfirm: 'Remover',
+  cancelDialogTitle: 'Cancelar convite?',
+  cancelDialogMessage: (login: string) => `O link de convite enviado a ${login} deixa de funcionar.`,
+  cancelConfirm: 'Cancelar convite',
+  keepInvite: 'Manter convite',
+  roleDialogTitle: 'Mudar permissão?',
+  roleDialogMessage: (login: string, role: string) => `${login} passa a ter a permissão ${role} neste repositório.`,
+  roleConfirm: 'Mudar permissão',
+  alreadyCollaborator: (login: string) => `${login} já tem acesso direto a este repositório.`,
+  alreadyInvited: (login: string) => `${login} já tem um convite pendente.`,
+  invited: (login: string) => `Convite enviado para ${login}. O acesso começa quando a pessoa aceitar.`,
+  added: (login: string) => `${login} agora tem acesso a este repositório.`,
+  removed: (login: string) => `${login} foi removido do repositório.`,
+  directAccessRemoved: (login: string) =>
+    `O acesso direto de ${login} foi removido. Se a pessoa estiver em um time ou na organização, esse acesso continua.`,
+  inviteCancelled: (login: string) => `Convite de ${login} cancelado.`,
+  roleChanged: (login: string, role: string) =>
+    `A permissão direta de ${login} agora é ${role}. Um time ou a organização ainda pode dar um acesso maior.`
+}
+
+type M = typeof ptBR
+
+const en: M = {
+  title: 'Collaborators',
+  loginHint: 'Sign in with GitHub to see and manage who has access to this repository.',
+  noRemote: 'This repository has no GitHub remote configured (origin).',
+  refresh: 'Refresh',
+  refreshAria: 'Refresh collaborators',
+  retry: 'Try again',
+  loading: 'Loading collaborators…',
+  addTitle: 'Add a person',
+  usernameLabel: 'GitHub username',
+  usernamePlaceholder: 'username',
+  roleLabel: 'Permission',
+  invite: 'Invite',
+  addHint: 'Anyone without access yet gets an invitation from GitHub and joins after accepting it.',
+  invalidUsername: 'That is not a valid GitHub username.',
+  emailNotAccepted: 'Enter the GitHub username. Invitations by e-mail are not accepted here.',
+  readOnly: 'Only repository administrators can invite, remove, or change permissions.',
+  noAccessTitle: 'No access to this list',
+  noAccess: 'GitHub only shows collaborators to people with write permission on this repository.',
+  loadFailedTitle: 'Could not load the collaborators',
+  pendingTitle: 'Pending invitations',
+  invitationsFailed: (reason) => `Could not read the pending invitations: ${reason}`,
+  invitedAt: (when) => `Invited ${when}`,
+  expiredChip: 'Expired',
+  pendingChip: 'Pending',
+  unknownInvitee: 'Invitation without a GitHub account',
+  cancelInvite: 'Cancel invitation',
+  cancelInviteAria: (login) => `Cancel invitation for ${login}`,
+  peopleTitle: 'People with access',
+  empty: 'No collaborators found.',
+  you: 'You',
+  owner: 'Owner',
+  direct: 'Direct access',
+  inherited: 'Via organization',
+  inheritedTitle: 'Access comes from the organization or a team, and cannot be taken away from this repository.',
+  roleAria: (login) => `Permission for ${login}`,
+  remove: 'Remove',
+  removeAria: (login) => `Remove ${login}`,
+  roles: {
+    read: 'Read',
+    triage: 'Triage',
+    write: 'Write',
+    maintain: 'Maintain',
+    admin: 'Admin'
+  },
+  removeDialogTitle: 'Remove collaborator?',
+  removeDialogMessage: (login, repo) => `${login} loses direct access to ${repo}. Coming back will take a new invitation.`,
+  removeConfirm: 'Remove',
+  cancelDialogTitle: 'Cancel invitation?',
+  cancelDialogMessage: (login) => `The invitation link sent to ${login} stops working.`,
+  cancelConfirm: 'Cancel invitation',
+  keepInvite: 'Keep invitation',
+  roleDialogTitle: 'Change permission?',
+  roleDialogMessage: (login, role) => `${login} will have the ${role} permission on this repository.`,
+  roleConfirm: 'Change permission',
+  alreadyCollaborator: (login) => `${login} already has direct access to this repository.`,
+  alreadyInvited: (login) => `${login} already has a pending invitation.`,
+  invited: (login) => `Invitation sent to ${login}. Access starts once they accept it.`,
+  added: (login) => `${login} now has access to this repository.`,
+  removed: (login) => `${login} was removed from the repository.`,
+  directAccessRemoved: (login) =>
+    `Direct access for ${login} was removed. Access through a team or the organization still applies.`,
+  inviteCancelled: (login) => `Invitation for ${login} cancelled.`,
+  roleChanged: (login, role) => `The direct permission for ${login} is now ${role}. A team or the organization can still grant more.`
+}
+
+const es: M = {
+  title: 'Colaboradores',
+  loginHint: 'Inicia sesión con GitHub para ver y gestionar quién tiene acceso a este repositorio.',
+  noRemote: 'Este repositorio no tiene un remote de GitHub configurado (origin).',
+  refresh: 'Actualizar',
+  refreshAria: 'Actualizar colaboradores',
+  retry: 'Intentar de nuevo',
+  loading: 'Cargando colaboradores…',
+  addTitle: 'Añadir persona',
+  usernameLabel: 'Usuario de GitHub',
+  usernamePlaceholder: 'usuario',
+  roleLabel: 'Permiso',
+  invite: 'Invitar',
+  addHint: 'Quien aún no tiene acceso recibe una invitación de GitHub y entra después de aceptarla.',
+  invalidUsername: 'Ese no es un usuario válido de GitHub.',
+  emailNotAccepted: 'Escribe el usuario de GitHub. Aquí no se aceptan invitaciones por correo.',
+  readOnly: 'Solo los administradores del repositorio pueden invitar, quitar o cambiar permisos.',
+  noAccessTitle: 'Sin acceso a la lista',
+  noAccess: 'GitHub solo muestra los colaboradores a quienes tienen permiso de escritura en este repositorio.',
+  loadFailedTitle: 'No se pudieron cargar los colaboradores',
+  pendingTitle: 'Invitaciones pendientes',
+  invitationsFailed: (reason) => `No se pudieron leer las invitaciones pendientes: ${reason}`,
+  invitedAt: (when) => `Invitación enviada ${when}`,
+  expiredChip: 'Caducada',
+  pendingChip: 'Pendiente',
+  unknownInvitee: 'Invitación sin cuenta de GitHub',
+  cancelInvite: 'Cancelar invitación',
+  cancelInviteAria: (login) => `Cancelar la invitación de ${login}`,
+  peopleTitle: 'Personas con acceso',
+  empty: 'No se encontraron colaboradores.',
+  you: 'Tú',
+  owner: 'Propietario',
+  direct: 'Acceso directo',
+  inherited: 'Vía organización',
+  inheritedTitle: 'El acceso viene de la organización o de un equipo, y no se puede quitar desde este repositorio.',
+  roleAria: (login) => `Permiso de ${login}`,
+  remove: 'Quitar',
+  removeAria: (login) => `Quitar a ${login}`,
+  roles: {
+    read: 'Lectura',
+    triage: 'Triaje',
+    write: 'Escritura',
+    maintain: 'Mantenimiento',
+    admin: 'Administrador'
+  },
+  removeDialogTitle: '¿Quitar colaborador?',
+  removeDialogMessage: (login, repo) => `${login} pierde el acceso directo a ${repo}. Para volver, necesitará una nueva invitación.`,
+  removeConfirm: 'Quitar',
+  cancelDialogTitle: '¿Cancelar invitación?',
+  cancelDialogMessage: (login) => `El enlace de invitación enviado a ${login} deja de funcionar.`,
+  cancelConfirm: 'Cancelar invitación',
+  keepInvite: 'Mantener invitación',
+  roleDialogTitle: '¿Cambiar permiso?',
+  roleDialogMessage: (login, role) => `${login} pasará a tener el permiso ${role} en este repositorio.`,
+  roleConfirm: 'Cambiar permiso',
+  alreadyCollaborator: (login) => `${login} ya tiene acceso directo a este repositorio.`,
+  alreadyInvited: (login) => `${login} ya tiene una invitación pendiente.`,
+  invited: (login) => `Invitación enviada a ${login}. El acceso empieza cuando la acepte.`,
+  added: (login) => `${login} ahora tiene acceso a este repositorio.`,
+  removed: (login) => `${login} fue quitado del repositorio.`,
+  directAccessRemoved: (login) =>
+    `Se quitó el acceso directo de ${login}. Si está en un equipo o en la organización, ese acceso continúa.`,
+  inviteCancelled: (login) => `Invitación de ${login} cancelada.`,
+  roleChanged: (login, role) => `El permiso directo de ${login} ahora es ${role}. Un equipo o la organización aún puede dar más acceso.`
+}
+
+export default { 'pt-BR': ptBR, en, es } as const
diff --git a/GitWeb/src/shared/i18n/messages/main.ts b/GitWeb/src/shared/i18n/messages/main.ts
index c6345eb..bacdeac 100644
--- a/GitWeb/src/shared/i18n/messages/main.ts
+++ b/GitWeb/src/shared/i18n/messages/main.ts
@@ -137,6 +137,10 @@ const ptBR = {
     notAuthenticated: (host: string) => `Você não está autenticado em ${host}. Entre com o GitHub e tente de novo.`,
     requestRejected: (status: number) => `GitHub recusou a solicitação (${status}).`,
     checkRunsTruncated: (shown: number, total: number) => `só os primeiros ${shown} de ${total} check runs foram lidos`,
+    collaboratorNotFound: (username: string) =>
+      `O GitHub não encontrou ${username}, ou sua conta não pode gerenciar este repositório.`,
+    collaboratorsForbidden: (reason: string) =>
+      `A organização não liberou a lista de colaboradores para este login. Peça a um administrador da organização para aprovar o app ou, se você entrou com um token, confira o acesso dele. (${reason})`,
     tokenRequired: 'Informe um token.',
     deviceFlowGithubOnly:
       'OAuth Device Flow só é suportado em github.com. Para GitHub Enterprise, use um Personal Access Token.',
@@ -290,6 +294,9 @@ const en: MainMessages = {
     notAuthenticated: (host) => `You are not signed in to ${host}. Sign in with GitHub and try again.`,
     requestRejected: (status) => `GitHub rejected the request (${status}).`,
     checkRunsTruncated: (shown, total) => `only the first ${shown} of ${total} check runs were read`,
+    collaboratorNotFound: (username) => `GitHub could not find ${username}, or your account cannot manage this repository.`,
+    collaboratorsForbidden: (reason) =>
+      `The organization did not allow this sign-in to read the collaborator list. Ask an organization admin to approve the app or, if you signed in with a token, check its access. (${reason})`,
     tokenRequired: 'Enter a token.',
     deviceFlowGithubOnly:
       'OAuth Device Flow is only supported on github.com. For GitHub Enterprise, use a Personal Access Token.',
@@ -442,6 +449,9 @@ const es: MainMessages = {
     notAuthenticated: (host) => `No has iniciado sesión en ${host}. Inicia sesión con GitHub e inténtalo de nuevo.`,
     requestRejected: (status) => `GitHub rechazó la solicitud (${status}).`,
     checkRunsTruncated: (shown, total) => `solo se leyeron los primeros ${shown} de ${total} check runs`,
+    collaboratorNotFound: (username) => `GitHub no encontró a ${username}, o tu cuenta no puede gestionar este repositorio.`,
+    collaboratorsForbidden: (reason) =>
+      `La organización no permitió a este inicio de sesión leer la lista de colaboradores. Pide a un administrador de la organización que apruebe la app o, si entraste con un token, revisa su acceso. (${reason})`,
     tokenRequired: 'Introduce un token.',
     deviceFlowGithubOnly:
       'OAuth Device Flow solo es compatible con github.com. Para GitHub Enterprise, usa un Personal Access Token.',
diff --git a/GitWeb/src/shared/i18n/messages/topBar.ts b/GitWeb/src/shared/i18n/messages/topBar.ts
index c674e3d..a4ad099 100644
--- a/GitWeb/src/shared/i18n/messages/topBar.ts
+++ b/GitWeb/src/shared/i18n/messages/topBar.ts
@@ -87,6 +87,7 @@ const ptBR = {
     history: 'Histórico',
     stash: 'Stash',
     pullRequests: 'Pull Requests',
+    collaborators: 'Colaboradores',
     dashboard: 'Dashboard',
     settings: 'Configurações'
   },
@@ -183,6 +184,7 @@ const en: M = {
     history: 'History',
     stash: 'Stash',
     pullRequests: 'Pull Requests',
+    collaborators: 'Collaborators',
     dashboard: 'Dashboard',
     settings: 'Settings'
   },
@@ -277,6 +279,7 @@ const es: M = {
     history: 'Historial',
     stash: 'Stash',
     pullRequests: 'Pull Requests',
+    collaborators: 'Colaboradores',
     dashboard: 'Panel',
     settings: 'Configuración'
   },
diff --git a/GitWeb/test/collaboratorStore.test.ts b/GitWeb/test/collaboratorStore.test.ts
new file mode 100644
index 0000000..0ad4d0a
--- /dev/null
+++ b/GitWeb/test/collaboratorStore.test.ts
@@ -0,0 +1,259 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { getMessages } from '../src/shared/i18n'
+import type { RepositoryCollaborators } from '../src/shared/github'
+
+const github = {
+  getRepositoryCollaborators: vi.fn(),
+  addCollaborator: vi.fn(),
+  removeCollaborator: vi.fn(),
+  cancelRepositoryInvitation: vi.fn()
+}
+vi.stubGlobal('window', { api: { github } })
+
+const { usePullRequestStore } = await import('../src/renderer/src/store/pullRequestStore')
+const { sessionKeyOf, useCollaboratorStore } = await import('../src/renderer/src/store/collaboratorStore')
+
+const t = getMessages('pt-BR').collaborators
+
+const REPO_A = { host: 'github.com', apiBase: 'https://api.github.com', owner: 'acme', repo: 'a' }
+const REPO_B = { ...REPO_A, repo: 'b' }
+const ME = { login: 'me', name: null, avatarUrl: '' }
+
+function snapshot(change: Partial<RepositoryCollaborators> = {}): RepositoryCollaborators {
+  return {
+    ownerLogin: 'acme',
+    ownerKind: 'org',
+    canView: true,
+    canAdminister: true,
+    collaborators: [
+      { login: 'alice', avatarUrl: '', role: 'write', direct: true },
+      { login: 'team-only', avatarUrl: '', role: 'maintain', direct: false }
+    ],
+    invitations: [],
+    invitationsError: null,
+    ...change
+  }
+}
+
+const store = (): ReturnType<typeof useCollaboratorStore.getState> => useCollaboratorStore.getState()
+const logins = (): string[] | undefined => store().data?.collaborators.map((c) => c.login)
+const banners = (): { error: string | null; success: string | null } => {
+  const { error, successMessage } = usePullRequestStore.getState()
+  return { error, success: successMessage }
+}
+
+function deferred<T>(): { promise: Promise<T>; resolve: (value: T) => void; reject: (reason: Error) => void } {
+  let resolve!: (value: T) => void
+  let reject!: (reason: Error) => void
+  const promise = new Promise<T>((res, rej) => {
+    resolve = res
+    reject = rej
+  })
+  return { promise, resolve, reject }
+}
+
+beforeEach(() => {
+  vi.resetAllMocks()
+  usePullRequestStore.setState({ remote: REPO_A, user: ME, error: null, successMessage: null })
+  useCollaboratorStore.setState({
+    sessionKey: sessionKeyOf(REPO_A, ME.login),
+    data: snapshot(),
+    isLoading: false,
+    isSaving: false,
+    loadError: null,
+    fieldError: null
+  })
+})
+
+describe('whose data the store holds', () => {
+  it('does not keep one account\'s list for the next account on the same repository', async () => {
+    usePullRequestStore.setState({ user: { ...ME, login: 'someone-else' } })
+    const answer = deferred<RepositoryCollaborators>()
+    github.getRepositoryCollaborators.mockReturnValue(answer.promise)
+
+    const loading = store().load()
+
+    expect(store().data).toBeNull()
+    expect(store().sessionKey).toBe(sessionKeyOf(REPO_A, 'someone-else'))
+    answer.resolve(snapshot({ canAdminister: false }))
+    await loading
+    expect(store().data?.canAdminister).toBe(false)
+  })
+
+  it('ignores a slower answer about the previous repository', async () => {
+    const slow = deferred<RepositoryCollaborators>()
+    github.getRepositoryCollaborators.mockReturnValueOnce(slow.promise).mockResolvedValueOnce(snapshot({ ownerLogin: 'for-b' }))
+
+    const first = store().load()
+    usePullRequestStore.setState({ remote: REPO_B })
+    await store().load()
+    slow.resolve(snapshot({ ownerLogin: 'for-a' }))
+    await first
+
+    expect(store().data?.ownerLogin).toBe('for-b')
+    expect(store().isLoading).toBe(false)
+  })
+})
+
+describe('a write that lands after the user moved on', () => {
+  it('leaves the new repository\'s list alone and names its own repository in the banner', async () => {
+    const write = deferred<void>()
+    github.removeCollaborator.mockReturnValue(write.promise)
+    github.getRepositoryCollaborators.mockResolvedValue(snapshot())
+
+    const removing = store().remove('alice')
+    usePullRequestStore.setState({ remote: REPO_B })
+    await store().load()
+    write.resolve()
+    await removing
+
+    expect(logins()).toContain('alice')
+    expect(banners().success).toBe(`acme/a: ${t.directAccessRemoved('alice')}`)
+  })
+
+  it('does the same for a failure, which must not look like it happened here', async () => {
+    const write = deferred<void>()
+    github.removeCollaborator.mockReturnValue(write.promise)
+
+    const removing = store().remove('alice')
+    usePullRequestStore.setState({ remote: REPO_B })
+    write.reject(new Error('Forbidden'))
+    await removing
+
+    expect(banners().error).toBe('acme/a: Forbidden')
+  })
+})
+
+describe('reads and writes overlapping', () => {
+  it('does not let a load already in flight bring back someone just removed', async () => {
+    const list = deferred<RepositoryCollaborators>()
+    github.getRepositoryCollaborators.mockReturnValue(list.promise)
+    github.removeCollaborator.mockResolvedValue(undefined)
+
+    const loading = store().load()
+    await store().remove('alice')
+    list.resolve(snapshot())
+    await loading
+
+    expect(logins()).toEqual(['team-only'])
+    expect(store().isLoading).toBe(false)
+  })
+
+  it('does not start a read of the same repository during a write', async () => {
+    const write = deferred<void>()
+    github.removeCollaborator.mockReturnValue(write.promise)
+
+    const removing = store().remove('alice')
+    await store().load()
+    write.resolve()
+    await removing
+
+    expect(github.getRepositoryCollaborators).not.toHaveBeenCalled()
+  })
+})
+
+describe('refreshing', () => {
+  it('keeps the list on screen and reports through the banner when it fails', async () => {
+    github.getRepositoryCollaborators.mockRejectedValue(new Error('offline'))
+    await store().load()
+    expect(logins()).toEqual(['alice', 'team-only'])
+    expect(store().loadError).toBeNull()
+    expect(banners().error).toBe('offline')
+  })
+
+  it('shows the error in place of the list when there is no list yet', async () => {
+    useCollaboratorStore.setState({ data: null })
+    github.getRepositoryCollaborators.mockRejectedValue(new Error('offline'))
+    await store().load()
+    expect(store().loadError).toBe('offline')
+    expect(banners().error).toBeNull()
+  })
+})
+
+describe('add', () => {
+  it('shows someone added right away without reading the list back', async () => {
+    github.addCollaborator.mockResolvedValue({ kind: 'added' })
+    await expect(store().add('bruno', 'read')).resolves.toBe(true)
+    expect(github.getRepositoryCollaborators).not.toHaveBeenCalled()
+    expect(logins()).toEqual(['alice', 'bruno', 'team-only'])
+    expect(store().data?.collaborators[1]).toMatchObject({ role: 'read', direct: true })
+    expect(banners().success).toBe(t.added('bruno'))
+  })
+
+  it('turns inherited access into direct access instead of listing the person twice', async () => {
+    github.addCollaborator.mockResolvedValue({ kind: 'added' })
+    await store().add('TEAM-ONLY', 'admin')
+    expect(logins()).toEqual(['alice', 'team-only'])
+    expect(store().data?.collaborators[1]).toMatchObject({ role: 'admin', direct: true })
+  })
+
+  it('refuses someone with direct access, since the call would change their role', async () => {
+    await expect(store().add('@ALICE')).resolves.toBe(false)
+    expect(github.addCollaborator).not.toHaveBeenCalled()
+    expect(store().fieldError).toBe(t.alreadyCollaborator('ALICE'))
+  })
+
+  it('refuses a second invitation while one is pending', async () => {
+    useCollaboratorStore.setState({
+      data: snapshot({ invitations: [{ id: 1, login: 'bruno', avatarUrl: null, role: 'write', createdAt: '', expired: false }] })
+    })
+    await expect(store().add('bruno')).resolves.toBe(false)
+    expect(store().fieldError).toBe(t.alreadyInvited('bruno'))
+  })
+
+  it('lets an expired invitation be replaced by a new one', async () => {
+    useCollaboratorStore.setState({
+      data: snapshot({ invitations: [{ id: 1, login: 'bruno', avatarUrl: null, role: 'write', createdAt: '', expired: true }] })
+    })
+    const invitation = { id: 2, login: 'bruno', avatarUrl: null, role: 'write', createdAt: '', expired: false }
+    github.addCollaborator.mockResolvedValue({ kind: 'invited', invitation })
+
+    await expect(store().add('bruno')).resolves.toBe(true)
+
+    expect(store().data?.invitations).toEqual([invitation])
+  })
+
+  it('tells an e-mail address apart from a username that is simply invalid', async () => {
+    await store().add('someone@example.com')
+    expect(store().fieldError).toBe(t.emailNotAccepted)
+    await store().add('not valid')
+    expect(store().fieldError).toBe(t.invalidUsername)
+    expect(github.addCollaborator).not.toHaveBeenCalled()
+  })
+
+  it('sends only the login out of a pasted profile link', async () => {
+    github.addCollaborator.mockResolvedValue({ kind: 'added' })
+    await store().add('github.com/bruno?tab=repositories')
+    expect(github.addCollaborator).toHaveBeenCalledWith('github.com', 'acme', 'a', 'bruno', undefined)
+  })
+})
+
+describe('what the banner claims after a removal or role change', () => {
+  it('only claims the direct access on an organization, where a team can still grant more', async () => {
+    github.removeCollaborator.mockResolvedValue(undefined)
+    await store().remove('alice')
+    expect(banners().success).toBe(t.directAccessRemoved('alice'))
+  })
+
+  it('says the person was removed on a personal repository, where direct access is all there is', async () => {
+    useCollaboratorStore.setState({ data: snapshot({ ownerKind: 'user' }) })
+    github.removeCollaborator.mockResolvedValue(undefined)
+    await store().remove('alice')
+    expect(banners().success).toBe(t.removed('alice'))
+  })
+
+  it('describes a role change as the direct permission', async () => {
+    github.addCollaborator.mockResolvedValue({ kind: 'added' })
+    await store().changeRole('alice', 'read')
+    expect(store().data?.collaborators[0].role).toBe('read')
+    expect(banners().success).toBe(t.roleChanged('alice', t.roles.read))
+  })
+
+  it('leaves everything as it was when GitHub refuses, and says why', async () => {
+    github.removeCollaborator.mockRejectedValue(new Error('Must have admin rights'))
+    await store().remove('alice')
+    expect(logins()).toContain('alice')
+    expect(banners()).toEqual({ error: 'Must have admin rights', success: null })
+    expect(store().isSaving).toBe(false)
+  })
+})
diff --git a/GitWeb/test/collaborators.test.ts b/GitWeb/test/collaborators.test.ts
new file mode 100644
index 0000000..2042a0e
--- /dev/null
+++ b/GitWeb/test/collaborators.test.ts
@@ -0,0 +1,221 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { canManageCollaborator, normalizeGitHubUsername } from '../src/shared/github'
+import { getMessages } from '../src/shared/i18n'
+
+vi.mock('../src/main/credentials', () => ({ getSecret: vi.fn(async () => 'token'), saveSecret: vi.fn(), deleteSecret: vi.fn() }))
+vi.mock('../src/main/httpFetch', () => ({ httpFetch: vi.fn() }))
+
+const { httpFetch } = await import('../src/main/httpFetch')
+const { addCollaborator, cancelRepositoryInvitation, getRepositoryCollaborators, removeCollaborator } = await import(
+  '../src/main/githubApi'
+)
+
+type Route = { status: number; body?: unknown }
+
+function serve(routes: Record<string, Route>): void {
+  vi.mocked(httpFetch).mockImplementation(async (url: string) => {
+    const { pathname, search } = new URL(url)
+    const route = routes[pathname + search] ?? routes[pathname] ?? { status: 404, body: { message: 'Not Found' } }
+    return new Response(route.body === undefined ? null : JSON.stringify(route.body), { status: route.status })
+  })
+}
+
+function requestedUrls(): string[] {
+  return vi.mocked(httpFetch).mock.calls.map(([url]) => String(url))
+}
+
+const person = (login: string, role_name = 'write'): object => ({ login, avatar_url: `https://a/${login}`, role_name })
+const repo = (type: string, permissions: object): Route => ({ status: 200, body: { owner: { login: 'current-owner', type }, permissions } })
+
+const ALL = '/repos/o/r/collaborators?affiliation=all&per_page=100'
+const DIRECT = '/repos/o/r/collaborators?affiliation=direct&per_page=100'
+const INVITATIONS = '/repos/o/r/invitations?per_page=100'
+
+beforeEach(() => {
+  vi.mocked(httpFetch).mockReset()
+})
+
+describe('getRepositoryCollaborators', () => {
+  it('treats everyone on a personal repository as direct, without asking twice', async () => {
+    serve({
+      '/repos/o/r': repo('User', { admin: true, push: true }),
+      [ALL]: { status: 200, body: [person('zed'), person('Ana', 'admin')] },
+      [INVITATIONS]: { status: 200, body: [] }
+    })
+    const result = await getRepositoryCollaborators('github.com', 'o', 'r')
+    expect(result.ownerKind).toBe('user')
+    expect(result.ownerLogin).toBe('current-owner')
+    expect(result.collaborators.map((c) => [c.login, c.role, c.direct])).toEqual([
+      ['Ana', 'admin', true],
+      ['zed', 'write', true]
+    ])
+    expect(requestedUrls().some((url) => url.includes('affiliation=direct'))).toBe(false)
+  })
+
+  it('marks organization access that only comes from a team or the org as inherited', async () => {
+    serve({
+      '/repos/o/r': repo('Organization', { admin: true, push: true }),
+      [ALL]: { status: 200, body: [person('direct-one'), person('via-team', 'maintain')] },
+      [DIRECT]: { status: 200, body: [person('direct-one')] },
+      [INVITATIONS]: { status: 200, body: [] }
+    })
+    const { collaborators } = await getRepositoryCollaborators('github.com', 'o', 'r')
+    expect(collaborators.map((c) => [c.login, c.direct])).toEqual([
+      ['direct-one', true],
+      ['via-team', false]
+    ])
+  })
+
+  it('does not ask for a list GitHub would refuse to an account without write access', async () => {
+    serve({ '/repos/o/r': repo('User', { admin: false, push: false }) })
+    const result = await getRepositoryCollaborators('github.com', 'o', 'r')
+    expect(result).toMatchObject({ canView: false, canAdminister: false, collaborators: [] })
+    expect(requestedUrls()).toHaveLength(1)
+  })
+
+  it('only reads invitations for admins, since they are the ones GitHub lists them to', async () => {
+    serve({
+      '/repos/o/r': repo('User', { admin: false, push: true }),
+      [ALL]: { status: 200, body: [person('me')] }
+    })
+    const result = await getRepositoryCollaborators('github.com', 'o', 'r')
+    expect(result).toMatchObject({ canView: true, canAdminister: false, invitations: [] })
+    expect(requestedUrls().some((url) => url.includes('/invitations'))).toBe(false)
+  })
+
+  it('still shows the collaborators when only the invitations fail', async () => {
+    serve({
+      '/repos/o/r': repo('User', { admin: true }),
+      [ALL]: { status: 200, body: [person('me')] },
+      [INVITATIONS]: { status: 403, body: { message: 'Resource not accessible by personal access token' } }
+    })
+    const result = await getRepositoryCollaborators('github.com', 'o', 'r')
+    expect(result.collaborators).toHaveLength(1)
+    expect(result.invitationsError).toBe('Resource not accessible by personal access token')
+  })
+
+  it('explains an organization refusing the list, keeping GitHub\'s reason', async () => {
+    serve({
+      '/repos/o/r': repo('Organization', { admin: true }),
+      [ALL]: { status: 403, body: { message: 'Forbidden' } },
+      [DIRECT]: { status: 403, body: { message: 'Forbidden' } }
+    })
+    await expect(getRepositoryCollaborators('github.com', 'o', 'r')).rejects.toThrow(
+      getMessages('pt-BR').main.github.collaboratorsForbidden('Forbidden')
+    )
+  })
+})
+
+describe('addCollaborator', () => {
+  it('reports a 201 as a pending invitation', async () => {
+    serve({
+      '/repos/o/r/collaborators/new-person': {
+        status: 201,
+        body: { id: 7, invitee: { login: 'new-person', avatar_url: 'https://a/new-person' }, permissions: 'write', created_at: '2026-11-06T10:00:00Z', expired: false }
+      }
+    })
+    await expect(addCollaborator('github.com', 'o', 'r', 'new-person')).resolves.toEqual({
+      kind: 'invited',
+      invitation: { id: 7, login: 'new-person', avatarUrl: 'https://a/new-person', role: 'write', createdAt: '2026-11-06T10:00:00Z', expired: false }
+    })
+  })
+
+  it('reports a 204 as access changed right away', async () => {
+    serve({ '/repos/o/r/collaborators/member': { status: 204 } })
+    await expect(addCollaborator('github.com', 'o', 'r', 'member', 'maintain')).resolves.toEqual({ kind: 'added' })
+  })
+
+  it('translates the role to the name the endpoint expects, and sends none when there is none', async () => {
+    serve({ '/repos/o/r/collaborators/member': { status: 204 } })
+    await addCollaborator('github.com', 'o', 'r', 'member', 'read')
+    await addCollaborator('github.com', 'o', 'r', 'member', 'write')
+    await addCollaborator('github.com', 'o', 'r', 'member')
+    const bodies = vi.mocked(httpFetch).mock.calls.map(([, init]) => init?.body)
+    expect(bodies).toEqual(['{"permission":"pull"}', '{"permission":"push"}', '{}'])
+    expect(vi.mocked(httpFetch).mock.calls[0][1]?.method).toBe('PUT')
+  })
+
+  it('names the person when GitHub answers 404', async () => {
+    serve({})
+    await expect(addCollaborator('github.com', 'o', 'r', 'ghost')).rejects.toThrow(
+      getMessages('pt-BR').main.github.collaboratorNotFound('ghost')
+    )
+  })
+
+  it('passes along why GitHub refused', async () => {
+    serve({ '/repos/o/r/collaborators/x': { status: 403, body: { message: 'Must have admin rights to Repository.' } } })
+    await expect(addCollaborator('github.com', 'o', 'r', 'x')).rejects.toThrow('Must have admin rights to Repository.')
+  })
+})
+
+describe('removal', () => {
+  it('deletes the collaborator and the invitation on their own endpoints', async () => {
+    serve({ '/repos/o/r/collaborators/someone': { status: 204 }, '/repos/o/r/invitations/9': { status: 204 } })
+    await removeCollaborator('github.com', 'o', 'r', 'someone')
+    await cancelRepositoryInvitation('github.com', 'o', 'r', 9)
+    expect(vi.mocked(httpFetch).mock.calls.map(([url, init]) => [new URL(String(url)).pathname, init?.method])).toEqual([
+      ['/repos/o/r/collaborators/someone', 'DELETE'],
+      ['/repos/o/r/invitations/9', 'DELETE']
+    ])
+  })
+
+  it('cannot be aimed at another path through the username', async () => {
+    serve({})
+    await removeCollaborator('github.com', 'o', 'r', '../../../user').catch(() => undefined)
+    expect(requestedUrls()[0]).toContain('/collaborators/..%2F..%2F..%2Fuser')
+  })
+})
+
+describe('normalizeGitHubUsername', () => {
+  it.each([
+    ['octocat', 'octocat'],
+    ['  octocat  ', 'octocat'],
+    ['@octocat', 'octocat'],
+    ['https://github.com/octocat', 'octocat'],
+    ['https://github.com/octocat/', 'octocat'],
+    ['https://github.com/octocat?tab=repositories', 'octocat'],
+    ['https://github.com/octocat#readme', 'octocat'],
+    ['github.com/octocat', 'octocat'],
+    ['www.github.com/octocat/', 'octocat'],
+    ['https://github.example.com:8443/octocat', 'octocat'],
+    ['octo-cat', 'octo-cat'],
+    ['octo_corp', 'octo_corp'],
+    ['a', 'a']
+  ])('reads %j as %j', (input, expected) => {
+    expect(normalizeGitHubUsername(input)).toBe(expected)
+  })
+
+  it.each(['', '   ', 'someone@example.com', '-octocat', 'octocat-', 'two words', 'octocat/repo', 'github.com/octocat/repo', 'github.com', 'a'.repeat(40)])(
+    'rejects %j',
+    (input) => {
+      expect(normalizeGitHubUsername(input)).toBeNull()
+    }
+  )
+})
+
+describe('canManageCollaborator', () => {
+  const context = { canAdminister: true, owner: 'Owner', viewer: 'Me' }
+  const collaborator = (login: string, direct = true): { login: string; avatarUrl: string; role: string; direct: boolean } => ({
+    login,
+    avatarUrl: '',
+    role: 'write',
+    direct
+  })
+
+  it('allows a direct collaborator for an admin', () => {
+    expect(canManageCollaborator(collaborator('someone'), context)).toBe(true)
+  })
+
+  it('never offers the owner or the signed-in account, whatever the casing', () => {
+    expect(canManageCollaborator(collaborator('owner'), context)).toBe(false)
+    expect(canManageCollaborator(collaborator('ME'), context)).toBe(false)
+  })
+
+  it('leaves inherited access alone', () => {
+    expect(canManageCollaborator(collaborator('via-team', false), context)).toBe(false)
+  })
+
+  it('offers nothing to someone who is not an admin', () => {
+    expect(canManageCollaborator(collaborator('someone'), { ...context, canAdminister: false })).toBe(false)
+  })
+})
diff --git a/GitWeb/test/dropdownPlacement.test.ts b/GitWeb/test/dropdownPlacement.test.ts
new file mode 100644
index 0000000..5178c7b
--- /dev/null
+++ b/GitWeb/test/dropdownPlacement.test.ts
@@ -0,0 +1,17 @@
+import { describe, expect, it } from 'vitest'
+import { opensUpward } from '../src/renderer/src/lib/dropdownPlacement'
+
+describe('opensUpward', () => {
+  it('stays below whenever the list fits there', () => {
+    expect(opensUpward(500, 256, 256)).toBe(false)
+  })
+
+  it('opens upward at the bottom of the pane when the whole list fits above', () => {
+    expect(opensUpward(600, 40, 175)).toBe(true)
+  })
+
+  it('stays below when it fits on neither side, since overflow above could not be scrolled to', () => {
+    // A long list in the minimum 600px window: the case that used to end up behind the top bar.
+    expect(opensUpward(230, 236, 256)).toBe(false)
+  })
+})