@preventive/triage 1.0.0-alpha.2 → 1.0.0-alpha.21

package/server-managed/import-triage.ts

@@ -0,0 +1,48 @@
+import { createHash } from 'node:crypto'
+import type { ManagedDb } from './db-methods.ts'
+import type { ManagedComment } from '../common/managed/comments.ts'
+import type { TriageEntryPatch } from '../common/managed/triage.ts'
+import { triageWireEntry } from './triage-response.ts'
+
+export interface ImportTriageSnapshot {
+  entry: TriageEntryPatch | null
+  comments: ManagedComment[]
+  version: string
+}
+export interface ImportTriageStore {
+  getImportTriage(ids: readonly string[]): Promise<Record<string, ImportTriageSnapshot>>
+  importTriage(entries: [string, TriageEntryPatch | null][], expected: Record<string, string>, actor: { id: string; login: string }, reportId: string, now: number): Promise<boolean>
+}
+
+// Raw store methods share one transaction for comparison, triage, and comments.
+export function importTriageMethods(store: Pick<ManagedDb, 'listTriage' | 'listComments' | 'setTriageEntries' | 'createComment'>): ImportTriageStore {
+  async function snapshot(ids: readonly string[]) {
+    const rows = new Map((await store.listTriage(ids)).map(row => [row.findingId, row]))
+    const comments = await store.listComments(ids)
+    return Object.fromEntries(ids.map(id => {
+      const row = rows.get(id)
+      const entry = row ? triageWireEntry(row) : null
+      const own = comments.filter(comment => comment.findingId === id)
+      const version = createHash('sha256').update(JSON.stringify([entry, row?.updatedAt, own])).digest('hex')
+      return [id, { entry, comments: own, version }]
+    }))
+  }
+  return {
+    getImportTriage: snapshot,
+    async importTriage(entries, expected, actor, reportId, now) {
+      const current = await snapshot(entries.map(([id]) => id))
+      if (entries.some(([id]) => current[id]!.version !== expected[id])) return false
+      const changes: [string, TriageEntryPatch | null][] = []
+      for (const [id, value] of entries) {
+        const { comment, ...entry } = value ?? {}
+        changes.push([id, Object.keys(entry).length > 0 ? entry : null])
+        if (comment && !current[id]!.comments.some(existing => existing.body === comment)) {
+          await store.createComment({ findingId: id, body: comment, authorId: null, authorLogin: null,
+            actor, createdAt: null, updatedAt: null, reportId }, now)
+        }
+      }
+      await store.setTriageEntries(changes, actor.id, actor.login, now, reportId)
+      return true
+    },
+  }
+}

package/server-managed/index.ts

@@ -0,0 +1,135 @@
+// Managed HTTP app and standalone boot. The combined launcher mounts this
+// same app on e2e's listener; storage, routing and cleanup stay here.
+import { type Server, createServer } from 'node:http'
+import { fileURLToPath } from 'node:url'
+import { createOriginGate } from '../server-common/origin.ts'
+import { managedStorageLines } from '../server-common/storage-log.ts'
+import { runReapers, withReap } from '../server-common/reap.ts'
+import { startServer } from '../server-common/standalone.ts'
+import { initializeApp } from '../server-common/initialize.ts'
+import { type ManagedConfig, loadManagedConfig } from './config.ts'
+import { type ManagedHttpDeps, createManagedRequestHandler } from './http.ts'
+import { loadManagedStatic } from './static.ts'
+import { openManagedStorage } from './storage.ts'
+
+// Expired-session sweep period. Lookups already exclude expired rows
+// (`WHERE expires_at > now`), so this is housekeeping, not a security control.
+const SESSION_GC_INTERVAL_MS = 3_600_000
+
+type ManagedAppOptions = Partial<Pick<ManagedHttpDeps, 'next' | 'serverInfo' | 'isShuttingDown'>>
+
+export async function createManagedApp(config: ManagedConfig, options: ManagedAppOptions = {}) {
+  return await initializeApp(rollback => assembleManagedApp(config, options, rollback))
+}
+
+async function assembleManagedApp(config: ManagedConfig, options: ManagedAppOptions, rollback: AsyncDisposableStack) {
+  const storage = await openManagedStorage(config)
+  const { db, avatarStore, reportStore, bundleStore, bundleCache, reportSourcesCache } = storage
+  rollback.defer(() => db.close())
+  const originGate = createOriginGate(config.host, config.trustProxyEnv)
+
+  let shuttingDown = false
+  const isShuttingDown = () => shuttingDown || options.isShuttingDown?.() === true
+  const inFlight = new Set<Promise<unknown>>()
+  function track(p: Promise<unknown>): void {
+    inFlight.add(p)
+    p.finally(() => inFlight.delete(p)).catch(() => {})
+  }
+
+  const serveStatic = loadManagedStatic(fileURLToPath(new URL('../out/', import.meta.url)), {
+    indexOnly: options.next != null, scanServer: options.serverInfo?.deepviewScanServer ?? null,
+  })
+  const handleRequest = createManagedRequestHandler({
+    ...options, config, db, avatarStore, reportStore, bundleStore, bundleCache, reportSourcesCache, originGate, serveStatic,
+    ...('uploadStore' in storage ? { uploadStore: storage.uploadStore } : {}),
+    isShuttingDown, track,
+  })
+
+  let cleanup: Promise<void> | undefined
+  function reap(): Promise<void> {
+    if (cleanup) return cleanup
+    cleanup = runReapers({
+      sessions: () => db.deleteExpiredSessions(Date.now()),
+      ...('reapUploads' in storage ? { uploads: () => storage.reapUploads() } : {}),
+    }).finally(() => { cleanup = undefined })
+    track(cleanup)
+    return cleanup
+  }
+  const gcTimer = config.serverless ? null : setInterval(() => {
+    void reap().catch(err => console.warn('managed: maintenance failed:', err))
+  }, SESSION_GC_INTERVAL_MS)
+  rollback.defer(stop)
+
+  function stop(): void {
+    shuttingDown = true
+    if (gcTimer) clearInterval(gcTimer)
+  }
+
+  async function close(): Promise<void> {
+    stop()
+    if (inFlight.size > 0) await Promise.allSettled([...inFlight])
+    await db.close()
+  }
+  return { handleRequest, reap, isShuttingDown, stop, close }
+}
+
+export function logManagedStartup(config: ManagedConfig, port: number, mode = 'managed'): void {
+  console.log([
+    `DeepView managed server (${mode}):`,
+    `  HTTP: http://${config.host}:${port}/`,
+    ...managedStorageLines(config),
+  ].join('\n'))
+}
+
+export async function init(config = loadManagedConfig()): Promise<Server> {
+  const app = await createManagedApp(config)
+  const server = createServer(withReap(app.handleRequest, { managed: app.reap }, { isShuttingDown: app.isShuttingDown }))
+  let disposal: Promise<void> | undefined
+  function dispose(): Promise<void> {
+    if (!disposal) {
+      app.stop()
+      disposal = (async () => {
+        try {
+          if (server.listening) {
+            await new Promise<void>((resolve, reject) => {
+              server.close(err => { if (err) reject(err); else resolve() })
+            })
+          }
+        } finally {
+          try { await app.close() }
+          finally {
+            server.off('error', onError)
+            server.off('close', onClose)
+            server.off('listening', onListening)
+          }
+        }
+      })()
+    }
+    return disposal
+  }
+  // Embedding hosts can await full cleanup even when they only copied the
+  // request listener and never bound this server. Repeated disposal is safe.
+  server[Symbol.asyncDispose] = dispose
+
+  function onError(): void { onClose() }
+  function onClose(): void {
+    if (!disposal) void dispose().catch(err => { console.error('Managed server cleanup failed:', err) })
+  }
+  function onListening(): void {
+    const address = server.address()
+    const port = typeof address === 'object' && address ? address.port : config.port
+    logManagedStartup(config, port)
+  }
+  server.on('error', onError)
+  server.once('close', onClose)
+  server.on('listening', onListening)
+  return server
+}
+
+export async function start(): Promise<void> {
+  const config = loadManagedConfig()
+  const server = await init(config)
+  startServer(server, config)
+}
+
+if (import.meta.main) await start()

package/server-managed/public-workspace.ts

@@ -0,0 +1,150 @@
+import type { IncomingMessage, ServerResponse } from 'node:http'
+import { pipeline } from 'node:stream/promises'
+import { Buffer } from 'node:buffer'
+import type { ManagedHttpDeps } from './http.ts'
+import type { ManagedBundle } from './db.ts'
+import type { OpenedBlob } from './blob-store.ts'
+import type { WorkspaceShareSnapshot } from './workspace-shares.ts'
+import { sendJson } from './http-response.ts'
+import { hashToken } from './crypto.ts'
+import { TeamReportsError, loadTeamReports, teamReportVisibility } from './team-reports.ts'
+import { MAX_FINDING_ID, MAX_TRIAGE_HISTORY } from '../common/managed/triage.ts'
+import { triageWireEntry } from './triage-response.ts'
+import { MAX_PACKAGE_INVENTORY_BYTES } from './bundle-cache.ts'
+import { backfillBundleSummaries, bundleSummaries } from './bundle-catalog.ts'
+import { NPM_ADVISORIES_TIMEOUT_MS, fetchNpmAdvisories } from '../server-common/npm-advisories.ts'
+import { serveTeamFeed } from './team-feed.ts'
+
+function json(res: ServerResponse, status: number, body: unknown): void {
+  sendJson(res, status, body, { 'cache-control': 'private, no-store', 'referrer-policy': 'no-referrer' })
+}
+
+// Called before ALL other routing, including OAuth, discovery, static and the
+// combined server fallback. A supplied capability never inherits cookie auth.
+export async function handlePublicWorkspace(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, url: URL): Promise<void> {
+  const token = req.headers['x-deepview-share']
+  if (!deps.config.allowShare || typeof token !== 'string' || !/^[A-Za-z0-9_-]{43}$/u.test(token)) {
+    json(res, 401, { error: 'invalid-share' }); return
+  }
+  const method = req.method ?? 'GET'
+  if (method !== 'GET' && method !== 'HEAD') { json(res, 403, { error: 'share-read-only' }); return }
+  const shareRoute = /^\/api\/shares\/([A-Za-z0-9_-]+)\/workspace$/u.exec(url.pathname)
+  const teamRoute = /^\/api\/teams\/([^/]+)\/(shared|reports|feed)$/u.exec(url.pathname)
+  const reportRoute = /^\/api\/reports\/([^/]+)\/(triage|triage\/history|comments|sources)$/u.exec(url.pathname)
+  const bundleRoute = /^\/api\/bundles\/([^/]+)\/(metadata|contents|download|advisories)$/u.exec(url.pathname)
+  if (!shareRoute && !teamRoute && !reportRoute && !bundleRoute) { json(res, 403, { error: 'share-scope-required' }); return }
+  const tokenHash = hashToken(token)
+  const snapshot = await deps.db.getWorkspaceShare(tokenHash)
+  if (!snapshot) { json(res, 401, { error: 'invalid-share' }); return }
+  const recheck = async () => {
+    const current = deps.config.allowShare && await deps.db.getWorkspaceShare(tokenHash)
+    if (!current || JSON.stringify(current) !== JSON.stringify(snapshot)) throw new TeamReportsError(404, 'workspace-changed')
+  }
+  const send = async (body: unknown) => { await recheck(); json(res, 200, body) }
+  const sendTeam = async () => {
+    const summaries = await bundleSummaries(snapshot.team.bundles, deps.bundleCache)
+    await send({ user: snapshot.user, team: { ...snapshot.team,
+      bundles: snapshot.team.bundles.map(bundle => ({ ...bundle, ...(summaries.get(bundle.integrity) ?? { summary: null, summaryRetryAt: null }) })),
+    } })
+    await backfillBundleSummaries(snapshot.team.bundles, deps.bundleCache)
+  }
+  const stream = async (stored: OpenedBlob, encoding: string | null, contentType = 'application/json') => {
+    try { await recheck() } catch (error) { stored.stream.destroy(); throw error }
+    res.writeHead(200, { 'content-type': contentType, 'cache-control': 'private, no-store',
+      'x-content-type-options': 'nosniff', ...(encoding ? { 'content-encoding': encoding } : {}),
+      ...(stored.size == null ? {} : { 'content-length': String(stored.size) }),
+    })
+    if (method === 'HEAD') { stored.stream.destroy(); res.end(); return }
+    try { await pipeline(stored.stream, res) } catch { res.destroy() }
+  }
+  if (url.searchParams.has('team') && (url.searchParams.getAll('team').length !== 1 || url.searchParams.get('team') !== snapshot.teamId)) {
+    json(res, 404, { error: 'no-team' }); return
+  }
+  if (shareRoute) {
+    // The short hash is a recognizable link ID, never an access grant. Resolve
+    // with the full token so colliding IDs or slugs cannot broaden its scope.
+    // Existing links used the team ID as their fragment prefix.
+    if (shareRoute[1] !== tokenHash.slice(0, 8) && shareRoute[1] !== snapshot.teamId) {
+      json(res, 404, { error: 'no-share' }); return
+    }
+    await sendTeam(); return
+  }
+  if (teamRoute) {
+    if (teamRoute[1] !== snapshot.teamId) { json(res, 404, { error: 'no-team' }); return }
+    if (teamRoute[2] === 'feed') {
+      if (method !== 'GET') { json(res, 405, { error: 'method-not-allowed' }); return }
+      await serveTeamFeed(res, deps, snapshot, recheck); return
+    }
+    if (teamRoute[2] === 'shared') { await sendTeam(); return }
+    await send({ reports: await loadTeamReports(deps.db, deps.reportStore, snapshot) }); return
+  }
+  if (reportRoute) {
+    const id = reportRoute[1]!, part = reportRoute[2]!
+    if (!snapshot.reports.some(report => report.id === id)) { json(res, 404, { error: 'no-report' }); return }
+    const visible = await teamReportVisibility(deps.db, deps.reportStore, snapshot, id)
+    await recheck()
+    if (part === 'sources') { await sources(res, deps, snapshot, id, visible.sourcePaths, recheck, stream); return }
+    if (part === 'comments') { await send({ comments: await deps.db.listComments([...visible.ids]) }); return }
+    if (part === 'triage/history') {
+      const finding = url.searchParams.get('finding') ?? ''
+      if (!finding || finding.length > MAX_FINDING_ID) { json(res, 400, { error: 'bad-request' }); return }
+      if (!visible.ids.has(finding)) { json(res, 404, { error: 'no-finding' }); return }
+      const events = (await deps.db.listTriageHistory(finding, MAX_TRIAGE_HISTORY)).map(row => ({
+        seq: row.seq, at: row.at, actorLogin: row.actorLogin, batchId: row.batchId, entry: triageWireEntry(row, true),
+      }))
+      await send({ finding, events }); return
+    }
+    const entries = Object.fromEntries((await deps.db.listTriage([...visible.ids])).map(row => [row.findingId, triageWireEntry(row)]))
+    await send({ entries }); return
+  }
+  const bundle = snapshot.bundles.find(item => item.id === bundleRoute![1])
+  if (!bundle) { json(res, 404, { error: 'no-bundle' }); return }
+  if (bundleRoute![2] === 'advisories' && !snapshot.permissions.security) { json(res, 403, { error: 'security-access-required' }); return }
+  await serveBundle(res, deps, bundle, bundleRoute![2]!, url, recheck, stream)
+}
+
+async function serveBundle(res: ServerResponse, deps: ManagedHttpDeps, bundle: ManagedBundle, part: string, url: URL,
+  recheck: () => Promise<void>, stream: (stored: OpenedBlob, encoding: string | null, contentType?: string) => Promise<void>) {
+  if (part === 'download') {
+    const stored = await deps.bundleStore.open(bundle.id, bundle.kind)
+    if (!stored) { json(res, 503, { error: 'unavailable' }); return }
+    await stream(stored, bundle.kind === 'sourcemap' ? 'br' : null, 'application/octet-stream'); return
+  }
+  if (!deps.bundleCache) { json(res, 503, { error: 'unavailable' }); return }
+  if (part === 'advisories') {
+    if (bundle.kind !== 'stasis') { json(res, 422, { error: 'unsupported-bundle' }); return }
+    const packages = await deps.bundleCache.packageVersions(bundle, url.searchParams.get('reason') ?? '')
+    await recheck()
+    if (packages === null) { json(res, 413, { error: 'payload-too-large' }); return }
+    if (packages === undefined) { json(res, 400, { error: 'unknown-reason' }); return }
+    const body = Buffer.from(JSON.stringify(packages))
+    if (body.length > MAX_PACKAGE_INVENTORY_BYTES) { json(res, 413, { error: 'payload-too-large' }); return }
+    const result = Object.keys(packages).length === 0 ? { status: 200, body: {} }
+      : await fetchNpmAdvisories(body, AbortSignal.timeout(NPM_ADVISORIES_TIMEOUT_MS), deps.config.debug)
+    await recheck()
+    json(res, result.status, result.status === 200 ? { packages, advisories: result.body } : result.body); return
+  }
+  let cached
+  try { cached = await deps.bundleCache.open(bundle, part as 'metadata' | 'contents') }
+  catch { json(res, 422, { error: 'bundle-unavailable' }); return }
+  await stream(cached, 'br')
+}
+
+async function sources(res: ServerResponse, deps: ManagedHttpDeps, snapshot: WorkspaceShareSnapshot,
+  id: string, paths: Set<string>, recheck: () => Promise<void>, stream: (stored: OpenedBlob, encoding: string | null) => Promise<void>) {
+  const report = await deps.db.getReport(id)
+  const bundle = report?.bundleId ? await deps.db.getBundle(report.bundleId) : null
+  const empty = async () => { await recheck(); res.writeHead(204, { 'cache-control': 'private, no-store' }); res.end() }
+  if (!report || !bundle || !['stasis', 'sourcemap'].includes(bundle.kind ?? '') || bundle.repoId !== report.repoId) { await empty(); return }
+  if (!deps.reportSourcesCache) { json(res, 503, { error: 'unavailable' }); return }
+  let cached
+  try { cached = await deps.reportSourcesCache.open(report, bundle, snapshot.permissions, paths) }
+  catch { await empty(); return }
+  if (!cached) { await empty(); return }
+  const current = await deps.db.getReport(id), currentBundle = await deps.db.getBundle(bundle.id)
+  if (JSON.stringify(current) !== JSON.stringify(report) || JSON.stringify(currentBundle) !== JSON.stringify(bundle)
+      || snapshot.reports.find(item => item.id === id)?.repo.github !== cached.repo.github) {
+    cached.stream.destroy(); throw new TeamReportsError(404, 'workspace-changed')
+  }
+  await stream(cached, 'gzip')
+}

package/server-managed/repo-path.ts

@@ -0,0 +1,21 @@
+const MAX_TEAM_PATH = 500
+
+// Canonicalize only equivalent Git paths: '/' separates components and empty
+// or '.' components do not change the directory. Reject ambiguous input rather
+// than deleting characters from directory names used for authorization.
+// `{ ok:false }` makes the handler 400; `{ path:null }` means the whole repo.
+export function normalizeTeamPath(raw: unknown): { ok: true; path: string | null } | { ok: false } {
+  if (typeof raw !== 'string') return { ok: true, path: null }
+  // Spaces and backslashes can be literal parts of Git directory names.
+  // Neither trimming nor treating '\\' as a separator preserves that identity.
+  if (/\p{Cc}/u.test(raw) || raw.includes('\\') || raw !== raw.trim()) return { ok: false }
+  const segments: string[] = []
+  for (const seg of raw.split('/')) {
+    if (seg === '' || seg === '.') continue
+    if (seg === '..' || seg !== seg.trim()) return { ok: false }
+    segments.push(seg)
+  }
+  const path = segments.join('/')
+  if (path.length > MAX_TEAM_PATH) return { ok: false }
+  return { ok: true, path: path === '' ? null : path }
+}

package/server-managed/report-migration.ts

@@ -0,0 +1,35 @@
+// SQLite deployments store report blobs beside the database. Recover location
+// metadata before introducing directory-based team access. Schema and data move
+// together so a missing/corrupt blob leaves the migration retryable after repair.
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import type { DatabaseSync } from 'node:sqlite'
+import { reportRepoGithub } from '../report/index.js'
+import { readManagedReport } from '../common/managed/report-content.ts'
+import { normalizeTeamPath } from './repo-path.ts'
+
+export function migrateReportLocations(db: DatabaseSync, reportDir: string): void {
+  const columns = db.prepare('PRAGMA table_info(managed_report)').all() as { name: string }[]
+  if (columns.some((column) => column.name === 'repo_directory')) return
+  db.exec('BEGIN IMMEDIATE')
+  try {
+    db.exec("ALTER TABLE managed_report ADD COLUMN repo_directory TEXT NOT NULL DEFAULT ''")
+    const update = db.prepare('UPDATE managed_report SET repo_directory = ?, repo_embedded = ? WHERE id = ?')
+    const reports = db.prepare('SELECT id, filename FROM managed_report').all() as { id: string, filename: string }[]
+    for (const { id, filename } of reports) {
+      // Same opaque UUID boundary as the blob store; never splice arbitrary
+      // database text into a filesystem path during an upgrade.
+      if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/u.test(id)) throw new Error(`Invalid legacy report id: ${id}`)
+      const { data } = readManagedReport(readFileSync(join(reportDir, id), 'utf8'), filename)
+      if (data == null) throw new Error(`Cannot migrate location of unreadable report ${id}`)
+      const embedded = reportRepoGithub(data) != null
+      const directory = normalizeTeamPath(data.repo?.directory)
+      if (!directory.ok) throw new Error(`Cannot migrate invalid directory of report ${id}`)
+      update.run(directory.path ?? '', embedded ? 1 : 0, id)
+    }
+    db.exec('COMMIT')
+  } catch (err) {
+    db.exec('ROLLBACK')
+    throw err
+  }
+}

package/server-managed/report-query.ts

@@ -0,0 +1,4 @@
+// Large workspaces remain a single request. Bound both the stored input and
+// the encoded response, independently of the per-upload size limit.
+export const MAX_REPORT_QUERY_COUNT = 4096
+export const MAX_REPORT_QUERY_BYTES = 1024 * 1024 * 1024

package/server-managed/report-response.ts

@@ -0,0 +1,16 @@
+import { MIMEType } from 'node:util'
+
+// The metadata envelope is opt-in. Wildcards keep the legacy raw report;
+// an explicit, acceptable application/json range requests the envelope.
+export function acceptsReportMetadata(accept: string | undefined): boolean {
+  // Commas inside quoted media-type parameters do not separate ranges.
+  for (const range of accept?.match(/(?:[^",]|"(?:\\.|[^"\\])*")+/gu) ?? []) {
+    try {
+      const media = new MIMEType(range.trim())
+      if (media.essence !== 'application/json') continue
+      const quality = media.params.get('q') ?? '1'
+      if (/^(?:0(?:\.\d{0,3})?|1(?:\.0{0,3})?)$/u.test(quality) && Number(quality) > 0) return true
+    } catch { /* Ignore malformed media ranges. */ }
+  }
+  return false
+}

package/server-managed/report-sources.ts

@@ -0,0 +1,154 @@
+import { Buffer } from 'node:buffer'
+import { createHash } from 'node:crypto'
+import { extname } from 'node:path'
+import { promisify } from 'node:util'
+import { gzip } from 'node:zlib'
+import { bundleSourcesAsMap } from '../common/bundle-sources.js'
+import { loadManagedFindings, managedFindingSourcePaths } from '../common/managed/report-content.ts'
+import { type ViewerPermissions, filterReportContent } from '../common/managed/report-filter.ts'
+import type { CacheStorage } from './cache-storage.ts'
+import { readBundleDetails } from './bundle-cache.ts'
+import type { BlobStore } from './blob-store.ts'
+import type { BundleStore } from './bundle-store.ts'
+import type { ManagedBundle, ManagedDb, ReportRecord } from './db.ts'
+
+const compress = promisify(gzip)
+const reportFormat = (filename: string) => extname(filename).toLowerCase()
+
+function bundleDirectory(id: string) {
+  if (!/^[a-f\d-]{36}$/iu.test(id)) throw new Error('Invalid bundle id')
+  return id
+}
+function reportDirectory(bundleId: string, sha256: string) {
+  return `${bundleDirectory(bundleId)}/v1-${createHash('sha256').update(sha256).digest('hex')}`
+}
+function formatDirectory(bundleId: string, sha256: string, name: string) {
+  return `${reportDirectory(bundleId, sha256)}/${createHash('sha256').update(reportFormat(name)).digest('hex')}`
+}
+function sourceCacheFilename(report: ReportRecord, bundle: ManagedBundle, permissions: ViewerPermissions, repo: { github: string | null }, sourcePaths?: Set<string>) {
+  const key = createHash('sha256').update(JSON.stringify([
+    'finding-access-v4', sourcePaths ? [...sourcePaths].toSorted() : null, bundle.integrity, bundle.kind, permissions.dependencies, permissions.security, repo,
+  ])).digest('hex')
+  return `${formatDirectory(bundle.id, report.sha256, report.filename)}/${key}.json.gz`
+}
+
+// Match the report's spelling exactly, then an unambiguous path suffix. Never
+// guess between duplicate basenames or treat a bundle path as a disk pathname.
+function selectSources(sourcePaths: Set<string>, sources: Map<string, string>) {
+  const byBasename = new Map<string, string[]>()
+  for (const file of sources.keys()) {
+    const basename = file.split('/').at(-1)!
+    const candidates = byBasename.get(basename) ?? []
+    candidates.push(file)
+    byBasename.set(basename, candidates)
+  }
+  const files = new Map<string, string>(), paths = new Map<string, string>()
+  function add(path: unknown) {
+    if (typeof path !== 'string' || !path || paths.has(path)) return
+    let file = sources.has(path) ? path : null
+    if (file === null) {
+      const suffix = path.startsWith('/') ? path : `/${path}`
+      const matches = byBasename.get(path.split('/').at(-1)!)?.filter(candidate => candidate.endsWith(suffix)) ?? []
+      if (matches.length === 1) file = matches[0]!
+    }
+    if (file === null) return
+    paths.set(path, file)
+    files.set(file, sources.get(file)!)
+  }
+  for (const path of sourcePaths) add(path)
+  return { files: [...files], paths: [...paths] }
+}
+
+// Immutable report hashes share a derivative across duplicate uploads. Bundle
+// identity and visibility are part of the key: a broader viewer's sources must
+// never populate a restricted response. Group derivatives by hash and filename
+// format so each format's permissions can be removed after its last deletion.
+export function createReportSourcesCache(storage: CacheStorage, db: ManagedDb, reports: BlobStore, bundles: BundleStore) {
+  const pending = new Map<string, { reportId: string; job: Promise<boolean> }>()
+  let queue = Promise.resolve()
+  function enqueue<T>(work: () => Promise<T>): Promise<T> {
+    const job = queue.then(work)
+    queue = job.then(() => undefined, () => undefined)
+    return job
+  }
+  async function referenced(report: ReportRecord, bundle: ManagedBundle) {
+    const names = await db.listReportFilenamesWithBundleHash(bundle.id, report.sha256)
+    return names.some(name => reportFormat(name) === reportFormat(report.filename)) && await db.getBundle(bundle.id) != null
+  }
+  async function build(target: string, report: ReportRecord, bundle: ManagedBundle, permissions: ViewerPermissions, repo: { github: string | null }, sourcePaths?: Set<string>) {
+    // Team requests supply paths from their already-filtered members. Reopening
+    // the original report by ID would conflate visible and hidden occurrences.
+    if (!sourcePaths) {
+      const bytes = await reports.get(report.id)
+      if (!bytes) return false
+      const parsed = await loadManagedFindings(filterReportContent(bytes.toString('utf8'), permissions, report.filename, repo), report.filename)
+      if (!parsed) return false
+      sourcePaths = managedFindingSourcePaths(parsed.findings)
+    }
+    const details = await readBundleDetails(bundle, bundles)
+    if (!details) return false
+    const selection = selectSources(sourcePaths, bundleSourcesAsMap(details))
+    const body = await compress(Buffer.from(JSON.stringify({ integrity: bundle.integrity, ...selection })), { level: 6 })
+    // A duplicate with the same hash AND format can use these parsed bytes.
+    // Another format must not keep a deleted variant's late build alive.
+    if (!(await referenced(report, bundle))) return false
+    await storage.put(target, body)
+    // Another instance may finish deletion while this write is in flight.
+    // Recheck after publishing so a late builder cannot resurrect its cache.
+    if (!(await referenced(report, bundle))) {
+      await storage.delete(formatDirectory(bundle.id, report.sha256, report.filename))
+      return false
+    }
+    return true
+  }
+  async function ensure(target: string, report: ReportRecord, bundle: ManagedBundle, permissions: ViewerPermissions, repo: { github: string | null }, sourcePaths?: Set<string>): Promise<boolean> {
+    const existing = pending.get(target)
+    if (existing) {
+      const ready = await existing.job
+      if (ready || existing.reportId === report.id) return ready
+      // Deletion can also win before the initiator reads its blob. Retry with
+      // this request's row instead of caching that other row's miss as 204.
+      const initiator = await db.getReport(existing.reportId)
+      if (initiator?.bundleId === bundle.id && initiator.sha256 === report.sha256) return false
+      if (pending.get(target) === existing) pending.delete(target)
+      return ensure(target, report, bundle, permissions, repo, sourcePaths)
+    }
+    const job = (async () => {
+      if (await storage.exists(target)) return true
+      // Serial cold builds bound peak decompression/parsing memory.
+      return enqueue(() => build(target, report, bundle, permissions, repo, sourcePaths))
+    })()
+    const entry = { reportId: report.id, job }
+    pending.set(target, entry)
+    try { return await job } finally { if (pending.get(target) === entry) pending.delete(target) }
+  }
+  return {
+    async open(report: ReportRecord, bundle: ManagedBundle, permissions: ViewerPermissions, sourcePaths?: Set<string>) {
+      const repo = { github: (await db.listAllRepos()).find(entry => entry.repoId === report.repoId)?.fullName ?? null }
+      const target = sourceCacheFilename(report, bundle, permissions, repo, sourcePaths)
+      if (!(await ensure(target, report, bundle, permissions, repo, sourcePaths))) return null
+      const opened = await storage.open(target)
+      return { ...opened, repo }
+    },
+    async deleteBundle(id: string) {
+      const prefix = `${bundleDirectory(id)}/`
+      await Promise.allSettled([...pending].filter(([key]) => key.startsWith(prefix)).map(([, entry]) => entry.job))
+      await storage.delete(bundleDirectory(id))
+    },
+    async deleteReport(report: Pick<ReportRecord, 'bundleId' | 'sha256' | 'filename'>) {
+      const { bundleId, sha256 } = report
+      if (bundleId === null) return
+      // Called after metadata deletion. Serialize with builders so a cold
+      // request cannot recreate a derivative after its cleanup has finished.
+      await enqueue(async () => {
+        const names = await db.listReportFilenamesWithBundleHash(bundleId, sha256)
+        if (names.length === 0) {
+          await storage.delete(reportDirectory(bundleId, sha256))
+        } else if (!names.some(name => reportFormat(name) === reportFormat(report.filename))) {
+          await storage.delete(formatDirectory(bundleId, sha256, report.filename))
+        }
+      })
+    },
+  }
+}
+export type ReportSourcesCache = ReturnType<typeof createReportSourcesCache>

package/server-managed/repository-discovery.ts

@@ -0,0 +1,82 @@
+import { createHash } from 'node:crypto'
+import type { ManagedConfig } from './config.ts'
+import { GithubApiError, filterInstalledRepos, listInstalledRepos, listUserRepos } from './github-app.ts'
+import type { ConnectedRepo, RepoListing } from './github-app.ts'
+
+const CACHE_MS = 60_000
+const MAX_ENTRIES = 100
+interface Entry {
+  expires: number
+  pending: boolean
+  value: Promise<ConnectedRepo[]>
+}
+
+// One directory per HTTP handler. Searches/pages reuse discovery, but selected
+// flags still come from the database on every request. User results are scoped
+// to both the managed identity and its current GitHub credential. This cache is
+// only for discovery; connecting a repo still verifies fresh installation access.
+export class RepositoryDiscovery {
+  private readonly cache = new Map<string, Entry>()
+  private readonly config: ManagedConfig
+  private readonly fetchImpl: typeof fetch
+  private readonly now: () => number
+
+  constructor(config: ManagedConfig, fetchImpl: typeof fetch = (...args) => globalThis.fetch(...args), now: () => number = Date.now) {
+    this.config = config
+    this.fetchImpl = fetchImpl
+    this.now = now
+  }
+
+  private read(key: string, load: () => Promise<ConnectedRepo[]>): Promise<ConnectedRepo[]> {
+    const cached = this.cache.get(key)
+    if (cached && (cached.pending || cached.expires > this.now())) return cached.value
+    this.cache.delete(key)
+    while (this.cache.size >= MAX_ENTRIES) this.cache.delete(this.cache.keys().next().value!)
+    const entry: Entry = { expires: 0, pending: true, value: Promise.resolve([]) }
+    entry.value = load().then(repos => {
+      entry.expires = this.now() + CACHE_MS
+      entry.pending = false
+      return repos
+    }, (err: unknown) => {
+      if (this.cache.get(key) === entry) this.cache.delete(key)
+      throw err
+    })
+    this.cache.set(key, entry)
+    return entry.value
+  }
+
+  async list(scope: 'installed' | 'public', userId: string, token: string | null, showAll = false, refresh = false): Promise<RepoListing> {
+    // Invalidate derived user results along with the installation catalogue.
+    // An older in-flight read cannot repopulate this map after refresh.
+    if (refresh) this.cache.clear()
+    const installed = () => this.read('installed', () => listInstalledRepos(this.config, this.fetchImpl))
+    if (scope === 'installed' && showAll) return { repositories: await installed(), tokenMissing: false }
+    const publicInstalled = async (): Promise<ConnectedRepo[]> => (await installed()).filter(repo => repo.visibility === 'public')
+    if (token == null) return { repositories: scope === 'installed' ? await publicInstalled() : [], tokenMissing: true }
+    const credential = createHash('sha256').update(token).digest('hex')
+    const key = JSON.stringify([scope, userId, credential])
+    try {
+      if (scope === 'installed') {
+        const repositories = await this.read(key, async () => filterInstalledRepos(this.config, await installed(), token, this.fetchImpl))
+        return { repositories, tokenMissing: false }
+      }
+      // Installations only deduplicate the public picker. Their failure must
+      // not block otherwise readable public repos or look like a stale login.
+      // Cache the two sources separately so failed installation discovery is
+      // retried without caching a degraded combined list for another minute.
+      const [userRepos, installedRepos] = await Promise.all([
+        this.read(key, () => listUserRepos(token, this.fetchImpl)),
+        installed().catch((err: unknown) => {
+          console.warn('managed: installed repo deduplication failed:', err)
+          return []
+        }),
+      ])
+      const installedIds = new Set(installedRepos.map(repo => repo.id))
+      const repositories = userRepos.filter(repo => repo.visibility === 'public' && !installedIds.has(repo.id))
+      return { repositories, tokenMissing: false }
+    } catch (err) {
+      if (!(err instanceof GithubApiError) || err.status !== 401) throw err
+      return { repositories: scope === 'installed' ? await publicInstalled() : [], tokenMissing: true }
+    }
+  }
+}