@preventive/triage 1.0.0-alpha.23 → 1.0.0-alpha.25

package/server-managed/http.ts

@@ -92,6 +92,8 @@ import { handlePublicWorkspace } from './public-workspace.ts'
 import { serveUserTeamFeed } from './team-feed.ts'
 import { hashToken, randomToken } from './crypto.ts'
 import { canDeleteComment, parseCommentBody } from '../common/managed/comments.ts'
+import { ManagedCommitError } from './sql.ts'
+import { ManagedMutationError, reportReferenceSnapshot } from './management.ts'
 
 const SESSION_PATH = '/api/auth/session'
 const AVATAR_PREFIX = '/api/avatar/'
@@ -291,6 +293,7 @@ async function handleUploadPart(req: IncomingMessage, res: ServerResponse, deps:
   try { bytes = await readBodyBytes(req, Math.min(UPLOAD_CHUNK_BYTES, maxBytes)) }
   catch { sendJson(res, 413, { error: 'too-large' }); return }
   if (bytes.length === 0) { sendJson(res, 400, { error: 'empty' }); return }
+  if (await manageMutation(req, res, deps, cookie) == null) return
   await putUploadPart(deps.uploadStore, s.session.id, kind, id, index, bytes)
   sendJson(res, 200, { ok: true })
 }
@@ -462,7 +465,7 @@ async function handleListRepositories(req: IncomingMessage, res: ServerResponse,
 // access (never trust a client-supplied id) and capture the server-derived read
 // context (installation id, default branch). A PRIVATE repo with no installation
 // can't be read server-side → 409. Stores via selectRepo (upsert).
-async function selectRepository(res: ServerResponse, deps: ManagedHttpDeps, user: StoredUser, repoId: number): Promise<void> {
+async function selectRepository(res: ServerResponse, deps: ManagedHttpDeps, user: StoredUser, repoId: number, cookie: string | undefined): Promise<void> {
   if (!canAddRepositories(user)) { sendJson(res, 403, { error: 'forbidden' }); return }
   const userId = user.id
   const token = await ensureUserAccessToken(deps.config, deps.db, userId, Date.now())
@@ -489,6 +492,7 @@ async function selectRepository(res: ServerResponse, deps: ManagedHttpDeps, user
       sendJson(res, 403, { error: 'forbidden' }); return
     }
   }
+  if (await readAdminSession(res, deps, cookie) == null) return
   await connectRepository(res, deps, user, repo)
 }
 
@@ -580,11 +584,12 @@ async function handleSelectRepository(req: IncomingMessage, res: ServerResponse,
   }
   if (!selected) {
     const repo = (await deps.db.listSelectedRepos()).find(row => row.repoId === repoId)
+    if (await readAdminSession(res, deps, cookie) == null) return
     await deps.db.deactivateRepo(repoId)
     if (repo) await activity(deps, s.user, 'repository', 'deactivated a repository', { repo: repo.fullName })
     sendJson(res, 200, { ok: true, selected: false }); return
   }
-  await selectRepository(res, deps, s.user, repoId)
+  await selectRepository(res, deps, s.user, repoId, cookie)
 }
 
 async function repositoryFindingIds(deps: ManagedHttpDeps, reports: { id: string, filename: string }[]): Promise<Set<string>> {
@@ -614,13 +619,15 @@ async function repositoryImpact(deps: ManagedHttpDeps, repoId: number) {
   }
 }
 
-async function repositoryExclusiveTriageIds(deps: ManagedHttpDeps, reports: { id: string, filename: string }[], otherReports: { id: string, filename: string }[]): Promise<string[]> {
+async function repositoryExclusiveTriageIds(deps: ManagedHttpDeps, reports: { id: string, filename: string }[], otherReports: { id: string, filename: string }[], annotationsOnly = true): Promise<string[]> {
   const targetIds = await repositoryFindingIds(deps, reports)
-  const triage = await deps.db.listTriage([...targetIds])
-  const commentIds = await deps.db.listCommentedFindingIds([...targetIds])
-  const annotatedIds = new Set([...triage.map(entry => entry.findingId), ...commentIds])
+  const triage = annotationsOnly ? await deps.db.listTriage([...targetIds]) : []
+  const commentIds = annotationsOnly ? await deps.db.listCommentedFindingIds([...targetIds]) : []
+  // Removal includes every exclusive finding, including annotations created
+  // during the blob scan; impact only needs the currently annotated subset.
+  const annotatedIds = annotationsOnly ? new Set([...triage.map(entry => entry.findingId), ...commentIds]) : targetIds
   if (annotatedIds.size === 0) return []
-  // Only annotated findings need an overlap check.
+  // Impact can skip unannotated findings; deletion must also cover new writes.
   // TODO(managed): Persist finding IDs per report at upload time and maintain
   // the index on report deletion. Use it for repository impact and triage
   // cleanup so overlap checks do not fetch and parse every other report blob.
@@ -661,13 +668,12 @@ async function handleRemoveRepository(req: IncomingMessage, res: ServerResponse,
   const repo = (await deps.db.listAllRepos()).find((candidate) => candidate.repoId === repoId)
   if (repo == null) { sendJson(res, 404, { error: 'no-repo' }); return }
   if (repo.fullName !== fullName) { sendJson(res, 400, { error: 'repo-name-mismatch' }); return }
-  const reports = await deps.db.listReportsForRepo(repoId)
-  const bundles = await deps.db.listBundlesForRepo(repoId)
+  const allReports = deleteTriage ? await deps.db.listReports() : []
   const triageIds = deleteTriage
-    ? await repositoryExclusiveTriageIds(deps, reports, (await deps.db.listReports()).filter((report) => report.repoId !== repoId))
+    ? await repositoryExclusiveTriageIds(deps, allReports.filter(report => report.repoId === repoId), allReports.filter(report => report.repoId !== repoId), false)
     : []
-  const deletedReports = await deps.db.deleteReportsForRepo(repoId)
-  const deletedBundles = await deps.db.deleteBundlesForRepo(repoId)
+  const { reports, bundles, deletedReports, deletedBundles, deletedTriage } = await deps.db.removeRepository(s.session.id, repo,
+    deleteTriage ? { reports: reportReferenceSnapshot(allReports), ids: triageIds } : null)
   // Remove metadata first so a blob-store failure leaves an orphaned blob for
   // later cleanup, rather than a live row pointing at missing report data.
   for (const report of reports) {
@@ -675,15 +681,11 @@ async function handleRemoveRepository(req: IncomingMessage, res: ServerResponse,
     await deps.reportStore.delete(report.id).catch(() => {})
   }
   for (const bundle of bundles) {
-    // Cache cleanup must not interrupt triage/repository removal after the
-    // report rows needed to reconstruct exclusive finding IDs are gone.
+    // Best-effort derivative cleanup follows the committed metadata removal.
     await deps.bundleCache?.delete(bundle.id).catch((err) => { console.warn('managed: bundle cache delete failed:', err) })
     await deps.reportSourcesCache?.deleteBundle(bundle.id).catch((err) => { console.warn('managed: report sources delete failed:', err) })
     await deps.bundleStore.delete(bundle.id).catch(() => {})
   }
-  const deletedTriage = await deps.db.deleteTriage(triageIds)
-  await deps.db.deleteRepo(repoId)
-  await activity(deps, s.user, 'delete', `removed a repository (${deletedReports} reports, ${deletedBundles} bundles, ${deletedTriage} triage entries)`, { repo: repo.fullName })
   sendJson(res, 200, { ok: true, deletedReports, deletedBundles, deletedTriage })
 }
 
@@ -733,15 +735,6 @@ async function resolveUploadRepoId(req: IncomingMessage, res: ServerResponse, de
   return { ok: true, repoId: n }
 }
 
-// True iff `repoId` may be linked to a report / bundle: null (detach) or a
-// currently-selected repo id (so the FK can't dangle and you can only attach to
-// a managed repo).
-async function repoIdAllowed(deps: ManagedHttpDeps, repoId: unknown): Promise<boolean> {
-  if (repoId == null) return true
-  if (typeof repoId !== 'number' || !Number.isSafeInteger(repoId)) return false
-  return (await deps.db.listSelectedRepos()).some((r) => r.repoId === repoId)
-}
-
 async function canChangeReportRepo(deps: ManagedHttpDeps, user: StoredUser, reportId: string): Promise<boolean> {
   if (!roleAtLeast(user.role, 'manage') || !(await canViewReport(deps, user, reportId))) return false
   const report = await deps.db.getReport(reportId)
@@ -761,18 +754,12 @@ async function handleSetReportRepo(req: IncomingMessage, res: ServerResponse, de
   const repoId = (body as { repoId?: unknown } | null)?.repoId ?? null
   const directory = (body as { directory?: unknown } | null)?.directory ?? ''
   if (typeof reportId !== 'string') { sendJson(res, 400, { error: 'bad-request' }); return }
-  if (!(await canViewReport(deps, s.user, reportId))) { sendJson(res, 404, { error: 'no-report' }); return }
-  const report = await deps.db.getReport(reportId)
-  if (report == null) { sendJson(res, 404, { error: 'no-report' }); return }
-  if (!(await canChangeReportRepo(deps, s.user, reportId))) { sendJson(res, 403, { error: 'repo-forbidden' }); return }
-  if (report.repoEmbedded) { sendJson(res, 409, { error: 'repo-in-report' }); return }
-  if (!(await repoIdAllowed(deps, repoId))) { sendJson(res, 400, { error: 'bad-repo' }); return }
+  if (repoId !== null && (typeof repoId !== 'number' || !Number.isSafeInteger(repoId))) { sendJson(res, 400, { error: 'bad-repo' }); return }
   const normalized = normalizeTeamPath(directory)
   if (!normalized.ok) { sendJson(res, 400, { error: 'bad-directory' }); return }
-  if (repoId !== null && s.user.role !== 'admin' && !(await deps.db.userCanReadRepoPath(s.user.id, repoId as number, normalized.path ?? ''))) { sendJson(res, 403, { error: 'repo-forbidden' }); return }
-  if (!(await deps.db.setReportRepo(reportId, repoId as number | null, normalized.path ?? ''))) { sendJson(res, 404, { error: 'no-report' }); return }
+  const { report, user } = await deps.db.mutateReport(s.session.id, reportId, { type: 'repo', repoId, directory: normalized.path ?? '' })
   if (report.repoId !== repoId || report.repoDirectory !== (repoId == null ? '' : normalized.path ?? '')) {
-    await activity(deps, s.user, 'repository', repoId == null ? 'detached a report from its repository' : `assigned a report to repository path ${normalized.path || '/'}`, { reportId, report: report.filename, repo: await repositoryName(deps, (repoId as number | null) ?? report.repoId) })
+    await activity(deps, user, 'repository', repoId == null ? 'detached a report from its repository' : `assigned a report to repository path ${normalized.path || '/'}`, { reportId, report: report.filename, repo: await repositoryName(deps, repoId ?? report.repoId) })
   }
   sendJson(res, 200, { ok: true, repoId, repoDirectory: normalized.path ?? '' })
 }
@@ -787,12 +774,8 @@ async function handleSetReportVisible(req: IncomingMessage, res: ServerResponse,
   const reportId = (body as { reportId?: unknown } | null)?.reportId
   const visible = (body as { visible?: unknown } | null)?.visible
   if (typeof reportId !== 'string' || typeof visible !== 'boolean') { sendJson(res, 400, { error: 'bad-request' }); return }
-  if (!(await canViewReport(deps, s.user, reportId))) { sendJson(res, 404, { error: 'no-report' }); return }
-  if (!(await canChangeReportRepo(deps, s.user, reportId))) { sendJson(res, 403, { error: 'repo-forbidden' }); return }
-  const report = await deps.db.getReport(reportId)
-  if (report == null) { sendJson(res, 404, { error: 'no-report' }); return }
-  if (!(await deps.db.setReportVisible(reportId, visible))) { sendJson(res, 404, { error: 'no-report' }); return }
-  if (report.visible !== visible) await activity(deps, s.user, 'visibility', visible ? 'published a report' : 'hid a report', { reportId, report: report.filename, repo: await repositoryName(deps, report.repoId) })
+  const { report, user } = await deps.db.mutateReport(s.session.id, reportId, { type: 'visibility', visible })
+  if (report.visible !== visible) await activity(deps, user, 'visibility', visible ? 'published a report' : 'hid a report', { reportId, report: report.filename, repo: await repositoryName(deps, report.repoId) })
   sendJson(res, 200, { ok: true, visible })
 }
 
@@ -809,16 +792,9 @@ async function handleSetBundleRepo(req: IncomingMessage, res: ServerResponse, de
   if (!normalized.ok) { sendJson(res, 400, { error: 'bad-directory' }); return }
   const directory = repoId == null ? '' : normalized.path ?? ''
   if (typeof bundleId !== 'string') { sendJson(res, 400, { error: 'bad-request' }); return }
-  if (!(await canAccessBundle(deps, s.user, bundleId))) { sendJson(res, 404, { error: 'no-bundle' }); return }
-  const bundle = await deps.db.getBundle(bundleId)
-  if (bundle == null) { sendJson(res, 404, { error: 'no-bundle' }); return }
-  if (!(await canChangeBundleRepo(deps, s.user, bundle.repoId, bundle.repoDirectory))) { sendJson(res, 403, { error: 'repo-forbidden' }); return }
-  if (!(await repoIdAllowed(deps, repoId))) { sendJson(res, 400, { error: 'bad-repo' }); return }
-  if (repoId !== null && s.user.role !== 'admin' && !(await deps.db.userCanReadRepoPath(s.user.id, repoId as number, directory))) {
-    sendJson(res, 403, { error: 'forbidden' }); return
-  }
-  if (!(await deps.db.setBundleRepo(bundleId, repoId as number | null, directory))) { sendJson(res, 404, { error: 'no-bundle' }); return }
-  if (bundle.repoId !== repoId || bundle.repoDirectory !== directory) await activity(deps, s.user, 'repository', repoId == null ? 'detached a bundle from its repository' : `assigned a bundle to repository path ${directory || '/'}`, { bundleId, report: bundle.filename, repo: await repositoryName(deps, (repoId as number | null) ?? bundle.repoId) })
+  if (repoId !== null && (typeof repoId !== 'number' || !Number.isSafeInteger(repoId))) { sendJson(res, 400, { error: 'bad-repo' }); return }
+  const { bundle, user } = await deps.db.mutateBundle(s.session.id, bundleId, { type: 'repo', repoId, directory })
+  if (bundle.repoId !== repoId || bundle.repoDirectory !== directory) await activity(deps, user, 'repository', repoId == null ? 'detached a bundle from its repository' : `assigned a bundle to repository path ${directory || '/'}`, { bundleId, report: bundle.filename, repo: await repositoryName(deps, repoId ?? bundle.repoId) })
   sendJson(res, 200, { ok: true, repoId, repoDirectory: directory })
 }
 
@@ -873,8 +849,9 @@ async function sendUploadedReport(req: IncomingMessage, res: ServerResponse, dep
 // headers when the report has no repository metadata. The bundle link is
 // auto-resolved from the report's bundleHashes. New reports start hidden until
 // published. Identical content reuses its stored identity and metadata. Bytes
-// are written first (keyed by a fresh uuid) then the metadata row — a failed
-// insert or concurrent duplicate drops the orphan blob. 413 over the cap, 400 on empty.
+// are written first (keyed by a fresh uuid) then the metadata row. A definite
+// insert failure or concurrent duplicate drops the orphan blob; an uncertain
+// commit retains it. 413 over the cap, 400 on empty.
 async function handleUploadReport(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
   let s = await checkMutation(req, res, deps, cookie)
   if (s == null) return
@@ -931,9 +908,10 @@ async function handleUploadReport(req: IncomingMessage, res: ServerResponse, dep
       id, filename, contentType, byteSize: bytes.length, sha256,
       uploadedBy: s.user.id, uploadedByLogin: s.user.login, repoId: matchedRepo?.repoId ?? null,
       repoDirectory: directory, repoEmbedded, analyzer, visible: false, bundleId, bundleIntegrity: integrity,
-    }, Date.now())
+    }, Date.now(), s.session.id)
   } catch (err) {
-    await deps.reportStore.delete(id).catch(() => {})
+    // Losing the commit acknowledgement cannot turn primary bytes into garbage.
+    if (!(err instanceof ManagedCommitError)) await deps.reportStore.delete(id).catch(() => {})
     throw err
   }
   if (report.id !== id) await deps.reportStore.delete(id).catch(() => {})
@@ -976,15 +954,10 @@ async function handleDeleteReport(req: IncomingMessage, res: ServerResponse, dep
   const s = await checkMutation(req, res, deps, cookie)
   if (s == null) return
   if (!requireManageRole(res, s.user)) return
-  if (!(await canViewReport(deps, s.user, id))) { sendJson(res, 404, { error: 'no-report' }); return }
-  if (!(await canChangeReportRepo(deps, s.user, id))) { sendJson(res, 403, { error: 'repo-forbidden' }); return }
-  const report = await deps.db.getReport(id)
-  if (report == null) { sendJson(res, 404, { error: 'no-report' }); return }
-  const existed = await deps.db.deleteReport(id)
+  const { report, user } = await deps.db.mutateReport(s.session.id, id, { type: 'delete' })
   await deps.reportSourcesCache?.deleteReport(report).catch((err) => { console.warn('managed: report sources delete failed:', err) })
   await deps.reportStore.delete(id).catch((err) => { console.warn('managed: report bytes delete failed:', err) })
-  if (!existed) { sendJson(res, 404, { error: 'no-report' }); return }
-  await activity(deps, s.user, 'delete', 'deleted a report', { repoId: report.repoId, repoDirectory: report.repoDirectory, reportId: id, report: report.filename, repo: await repositoryName(deps, report.repoId) })
+  await activity(deps, user, 'delete', 'deleted a report', { repoId: report.repoId, repoDirectory: report.repoDirectory, reportId: id, report: report.filename, repo: await repositoryName(deps, report.repoId) })
   sendJson(res, 200, { ok: true })
 }
 
@@ -1057,7 +1030,7 @@ async function handleRepositoryBrowser(res: ServerResponse, deps: ManagedHttpDep
     if (!current) return
     if (JSON.stringify(current.repo) !== JSON.stringify(access.repo)) { sendJson(res, 409, { error: 'repository-changed' }); return }
     sendJson(res, 200, refs ? result : {
-      ...result, ...(current.virtualEntries ? { entries: current.virtualEntries, limited: false } : {}), path, commit,
+      ...result, ...(current.virtualEntries ? { entries: current.virtualEntries, limited: false, packageEntryPoints: [] } : {}), path, commit,
     })
   } catch (err) {
     if (err instanceof GithubApiError) {
@@ -1206,6 +1179,8 @@ async function handleUploadBundle(req: IncomingMessage, res: ServerResponse, dep
   const filename = sanitizeFilename(firstHeader(req.headers['x-bundle-filename']), 'bundle')
   const existing = await deps.db.getBundleByIntegrity(integrity)
   if (existing != null) {
+    s = await manageMutation(req, res, deps, cookie)
+    if (!s) return
     if (!(await canAccessBundle(deps, s.user, existing.id))) { sendJson(res, 409, { error: 'bundle-conflict' }); return }
     // Reports uploaded while this bundle was inaccessible retain only its
     // integrity. An authorized re-upload repairs those pending links too.
@@ -1221,14 +1196,18 @@ async function handleUploadBundle(req: IncomingMessage, res: ServerResponse, dep
     await deps.db.insertBundle({
       id, integrity, filename, kind,
       byteSize: bytes.length, uploadedBy: s.user.id, uploadedByLogin: s.user.login, repoId: repo.repoId, repoDirectory: directory,
-    }, Date.now())
+    }, Date.now(), s.session.id)
   } catch (err) {
-    await deps.bundleStore.delete(id).catch(() => {})
+    // A committed row may already point here even though insertion rejected.
+    if (!(err instanceof ManagedCommitError)) await deps.bundleStore.delete(id).catch(() => {})
+    if (err instanceof ManagedMutationError) throw err
     // A concurrent upload of identical bytes can insert this integrity (UNIQUE)
     // between our dedup check and this insert — treat that as a dedup, not a 500.
     // Any other failure rethrows.
     const raced = await deps.db.getBundleByIntegrity(integrity)
     if (raced != null) {
+      s = await manageMutation(req, res, deps, cookie)
+      if (!s) return
       if (!(await canAccessBundle(deps, s.user, raced.id))) { sendJson(res, 409, { error: 'bundle-conflict' }); return }
       await deps.db.linkReportsToBundle(integrity, raced.id, s.user.role === 'admin' ? undefined : s.user.id)
       prebuildBundle(deps, raced.id)
@@ -1236,6 +1215,8 @@ async function handleUploadBundle(req: IncomingMessage, res: ServerResponse, dep
     throw err
   }
   // Auto-link reports that declared this integrity before the bundle existed.
+  s = await manageMutation(req, res, deps, cookie)
+  if (!s) return
   await deps.db.linkReportsToBundle(integrity, id, s.user.role === 'admin' ? undefined : s.user.id)
   prebuildBundle(deps, id)
   sendJson(res, 201, { id, integrity, filename, byteSize: bytes.length, repoId: repo.repoId, repoDirectory: directory })
@@ -1279,16 +1260,11 @@ async function handleDeleteBundle(req: IncomingMessage, res: ServerResponse, dep
   const s = await checkMutation(req, res, deps, cookie)
   if (s == null) return
   if (!requireManageRole(res, s.user)) return
-  if (!(await canAccessBundle(deps, s.user, id))) { sendJson(res, 404, { error: 'no-bundle' }); return }
-  const bundle = await deps.db.getBundle(id)
-  if (bundle == null) { sendJson(res, 404, { error: 'no-bundle' }); return }
-  if (!(await canChangeBundleRepo(deps, s.user, bundle.repoId, bundle.repoDirectory))) { sendJson(res, 403, { error: 'repo-forbidden' }); return }
-  const existed = await deps.db.deleteBundle(id)
+  const { bundle, user } = await deps.db.mutateBundle(s.session.id, id, { type: 'delete' })
   await deps.bundleCache?.delete(id).catch((err) => { console.warn('managed: bundle cache delete failed:', err) })
   await deps.reportSourcesCache?.deleteBundle(id).catch((err) => { console.warn('managed: report sources delete failed:', err) })
   await deps.bundleStore.delete(id).catch((err) => { console.warn('managed: bundle bytes delete failed:', err) })
-  if (!existed) { sendJson(res, 404, { error: 'no-bundle' }); return }
-  await activity(deps, s.user, 'delete', 'deleted a bundle', { repoId: bundle.repoId, repoDirectory: bundle.repoDirectory, bundleId: id, report: bundle.filename, repo: await repositoryName(deps, bundle.repoId) })
+  await activity(deps, user, 'delete', 'deleted a bundle', { repoId: bundle.repoId, repoDirectory: bundle.repoDirectory, bundleId: id, report: bundle.filename, repo: await repositoryName(deps, bundle.repoId) })
   sendJson(res, 200, { ok: true })
 }
 
@@ -1589,25 +1565,29 @@ async function handleGetReportTriage(res: ServerResponse, deps: ManagedHttpDeps,
 }
 
 // GET /api/reports/<id>/triage/history?finding=<fid> — one finding's triage
-// trail (newest first, capped), gated exactly like the entries: the caller
-// may view the report, and the finding is one their visibility permissions
+// trail (newest first, capped). The caller must have at least triage access
+// to the report, and the finding is one their visibility permissions
 // keep in it (a stripped or foreign id 404s without revealing whether it
 // exists). Each event is the entry as written then (null = a clear), who
 // wrote it and when; "what changed" is the diff against the next-older event.
 async function handleGetReportTriageHistory(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, id: string, query: URLSearchParams, teamId: string | null): Promise<void> {
   const s = await readSession(deps.config, deps.db, cookie, Date.now())
   if (s == null) { sendJson(res, 401, { error: 'unauthenticated' }); return }
-  if (!(await canViewReport(deps, s.user, id))) { sendJson(res, 404, { error: 'no-report' }); return }
+  if (!(await canTriageReport(deps, s.user, id))) { sendJson(res, 404, { error: 'no-report' }); return }
   const finding = query.get('finding') ?? ''
   if (finding === '' || finding.length > MAX_FINDING_ID) { sendJson(res, 400, { error: 'bad-request' }); return }
   await visibleFindingIds(deps, s.user, id, s.session.id, teamId)
   const current = await readSession(deps.config, deps.db, cookie, Date.now())
-  if (!current || !(await canViewReport(deps, current.user, id)) || current.user.role !== s.user.role) { sendJson(res, 404, { error: 'no-report' }); return }
+  if (!current || !(await canTriageReport(deps, current.user, id)) || current.user.role !== s.user.role) { sendJson(res, 404, { error: 'no-report' }); return }
   const visible = await visibleFindingIds(deps, current.user, id, current.session.id, teamId)
   if (!visible.has(finding)) { sendJson(res, 404, { error: 'no-finding' }); return }
   const events = (await deps.db.listTriageHistory(finding, MAX_TRIAGE_HISTORY)).map((row: TriageEventRow) => ({
     seq: row.seq, at: row.at, actorLogin: row.actorLogin, batchId: row.batchId, entry: triageWireEntry(row, true),
   }))
+  // A database read can outlive a role, membership, or visibility change.
+  const latest = await readSession(deps.config, deps.db, cookie, Date.now())
+  if (!latest || latest.user.role !== current.user.role || !(await canTriageReport(deps, latest.user, id))) { sendJson(res, 404, { error: 'no-report' }); return }
+  if (!(await visibleFindingIds(deps, latest.user, id, latest.session.id, teamId)).has(finding)) { sendJson(res, 404, { error: 'no-finding' }); return }
   sendJson(res, 200, { finding, events })
 }
 
@@ -1654,7 +1634,7 @@ async function handleSetReportTriage(req: IncomingMessage, res: ServerResponse,
 
 // Admin imports compare the exact snapshot shown by the conflict dialog before
 // writing. The store commits shared finding triage and imported comments together.
-async function handleImportReportTriage(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, id: string): Promise<void> {
+async function handleImportTriage(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, id?: string): Promise<void> {
   const s = await adminMutation(req, res, deps, cookie)
   if (!s) return
   let body: { findingIds?: unknown; entries?: unknown; expected?: unknown }
@@ -1678,10 +1658,15 @@ async function handleImportReportTriage(req: IncomingMessage, res: ServerRespons
       parsed.push([findingId, patch])
     }
   }
-  if (!(await deps.db.getReport(id))) { sendJson(res, 404, { error: 'no-report' }); return }
-  const visible = await visibleFindingIds(deps, s.user, id, s.session.id, null)
+  // Workspace imports remain report-scoped. Standalone local triage can be
+  // imported before its reports; only administrators have this global access.
+  let visible: Set<string> | undefined
+  if (id !== undefined) {
+    if (!(await deps.db.getReport(id))) { sendJson(res, 404, { error: 'no-report' }); return }
+    visible = await visibleFindingIds(deps, s.user, id, s.session.id, null)
+  }
   if (await readAdminSession(res, deps, cookie) == null) return
-  if (ids.some(findingId => !visible.has(findingId))) { sendJson(res, 404, { error: 'no-finding' }); return }
+  if (visible && ids.some(findingId => !visible.has(findingId))) { sendJson(res, 404, { error: 'no-finding' }); return }
   if (reading) { sendJson(res, 200, { snapshots: await deps.db.getImportTriage(ids) }); return }
   const applied = await deps.db.importTriage(parsed, expected!, { id: s.user.id, login: s.user.login }, id, Date.now())
   sendJson(res, applied ? 200 : 409, { ok: applied })
@@ -2079,10 +2064,14 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
       if (method !== 'POST') { send405(res, 'POST'); return }
       await handleSetReportVisible(req, res, deps, cookie); return
     }
+    if (path === '/api/admin/import-triage') {
+      if (method !== 'POST') { send405(res, 'POST'); return }
+      await handleImportTriage(req, res, deps, cookie); return
+    }
     const importTriage = /^\/api\/admin\/reports\/([a-f\d-]{36})\/import-triage$/iu.exec(path)
     if (importTriage) {
       if (method !== 'POST') { send405(res, 'POST'); return }
-      await handleImportReportTriage(req, res, deps, cookie, importTriage[1]!); return
+      await handleImportTriage(req, res, deps, cookie, importTriage[1]!); return
     }
     if (path.startsWith(REPORT_PREFIX)) {
       const id = path.slice(REPORT_PREFIX.length)
@@ -2204,7 +2193,7 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
   return (req, res) => {
     if (isShuttingDown()) { sendJson(res, 503, { error: 'shutting-down' }, { connection: 'close' }); return }
     const work = route(req, res).catch((err) => {
-      if ((err instanceof TeamReportsError || err instanceof IssueError || err instanceof OAuthError) && !res.headersSent) { sendJson(res, err.status, { error: err.message }); return }
+      if ((err instanceof TeamReportsError || err instanceof IssueError || err instanceof OAuthError || err instanceof ManagedMutationError) && !res.headersSent) { sendJson(res, err.status, { error: err.message }); return }
       console.warn('managed: request handler error:', err)
       if (res.headersSent) { try { res.destroy() } catch {} }
       else sendJson(res, 500, { error: 'internal' })

package/server-managed/import-triage.ts

@@ -11,7 +11,7 @@ export interface ImportTriageSnapshot {
 }
 export interface ImportTriageStore {
   getImportTriage(ids: readonly string[]): Promise<Record<string, ImportTriageSnapshot>>
-  importTriage(entries: [string, TriageEntryPatch | null][], expected: Record<string, string>, actor: { id: string; login: string }, reportId: string, now: number): Promise<boolean>
+  importTriage(entries: [string, TriageEntryPatch | null][], expected: Record<string, string>, actor: { id: string; login: string }, reportId: string | undefined, now: number): Promise<boolean>
 }
 
 // Raw store methods share one transaction for comparison, triage, and comments.
@@ -38,7 +38,7 @@ export function importTriageMethods(store: Pick<ManagedDb, 'listTriage' | 'listC
         changes.push([id, Object.keys(entry).length > 0 ? entry : null])
         if (comment && !current[id]!.comments.some(existing => existing.body === comment)) {
           await store.createComment({ findingId: id, body: comment, authorId: null, authorLogin: null,
-            actor, createdAt: null, updatedAt: null, reportId }, now)
+            actor, createdAt: null, updatedAt: null, reportId: reportId ?? null }, now)
         }
       }
       await store.setTriageEntries(changes, actor.id, actor.login, now, reportId)

package/server-managed/management.ts

@@ -0,0 +1,86 @@
+import type { AdminReport, ManagedBundle, ManagedDb, ManagedRepo, RepoDataItem, RepoReportItem, ReportRecord, StoredUser } from './db-methods.ts'
+import { roleAtLeast } from '../common/managed/roles.ts'
+
+export class ManagedMutationError extends Error {
+  status: number
+  constructor(status: number, message: string) { super(message); this.status = status }
+}
+
+export type ContentMutation = { type: 'delete' } | { type: 'repo'; repoId: number | null; directory: string }
+export type ReportMutation = ContentMutation | { type: 'visibility'; visible: boolean }
+type RemovalRepo = Pick<ManagedRepo, 'repoId' | 'fullName' | 'addedAt'>
+type RemovalAnnotations = { reports: string; ids: string[] }
+export interface ManagementStore {
+  mutateReport(sessionId: string, id: string, change: ReportMutation): Promise<{ report: ReportRecord; user: StoredUser }>
+  mutateBundle(sessionId: string, id: string, change: ContentMutation): Promise<{ bundle: ManagedBundle; user: StoredUser }>
+  removeRepository(sessionId: string, expected: RemovalRepo, annotations: RemovalAnnotations | null): Promise<{
+    reports: RepoReportItem[]; bundles: RepoDataItem[]; deletedReports: number; deletedBundles: number; deletedTriage: number
+  }>
+}
+type ManagementDb = Pick<ManagedDb, 'sessionWithUser' | 'getReport' | 'getBundle' | 'listReports' | 'listReportsForRepo'
+  | 'listBundlesForRepo' | 'listAllRepos' | 'listSelectedRepos' | 'userCanReadReport' | 'userCanReadBundle' | 'userCanReadRepoPath'
+  | 'deleteReport' | 'setReportRepo' | 'setReportVisible' | 'deleteBundle' | 'setBundleRepo'
+  | 'deleteReportsForRepo' | 'deleteBundlesForRepo' | 'deleteRepo' | 'deleteTriage' | 'recordActivity'>
+
+// Only immutable bytes/format and repository membership affect the overlap
+// scan. Ignore publication, user display names, and unrelated bundle links.
+export function reportReferenceSnapshot(reports: readonly Pick<AdminReport, 'id' | 'sha256' | 'filename' | 'repoId'>[]): string {
+  return JSON.stringify(reports.map(r => [r.id, r.sha256, r.filename, r.repoId]).toSorted((a, b) => String(a[0]).localeCompare(String(b[0]))))
+}
+
+// These methods are wrapped by scopeManagedMethods: authorization, comparison,
+// metadata changes (and repository-removal audit) share the writer transaction. Blob reads
+// and deletes stay outside it. Use the raw store here, never nested scopes.
+export function managementMethods(db: ManagementDb): ManagementStore {
+  async function authorize(sessionId: string, role: 'admin' | 'manage') {
+    const s = await db.sessionWithUser(sessionId, Date.now())
+    if (!s) throw new ManagedMutationError(401, 'unauthenticated')
+    if (!roleAtLeast(s.user.role, role)) throw new ManagedMutationError(403, 'forbidden')
+    return s.user
+  }
+  async function destination(user: { id: string; role: string }, change: ContentMutation) {
+    if (change.type !== 'repo' || change.repoId === null) return
+    if (!(await db.listSelectedRepos()).some(repo => repo.repoId === change.repoId)) throw new ManagedMutationError(400, 'bad-repo')
+    if (user.role !== 'admin' && !await db.userCanReadRepoPath(user.id, change.repoId, change.directory)) throw new ManagedMutationError(403, 'repo-forbidden')
+  }
+  return {
+    async mutateReport(sessionId: string, id: string, change: ReportMutation) {
+      const user = await authorize(sessionId, 'manage')
+      const report = await db.getReport(id)
+      if (!report || (user.role !== 'admin' && report.uploadedBy !== user.id && !await db.userCanReadReport(user.id, id))) throw new ManagedMutationError(404, 'no-report')
+      if (user.role !== 'admin' && report.repoId !== null && !await db.userCanReadReport(user.id, id)) throw new ManagedMutationError(403, 'repo-forbidden')
+      if (change.type === 'repo' && report.repoEmbedded) throw new ManagedMutationError(409, 'repo-in-report')
+      if (change.type !== 'visibility') await destination(user, change)
+      if (change.type === 'delete') await db.deleteReport(id)
+      else if (change.type === 'visibility') await db.setReportVisible(id, change.visible)
+      else await db.setReportRepo(id, change.repoId, change.directory)
+      return { report, user }
+    },
+    async mutateBundle(sessionId: string, id: string, change: ContentMutation) {
+      const user = await authorize(sessionId, 'manage')
+      const bundle = await db.getBundle(id)
+      if (!bundle || (user.role !== 'admin' && !await db.userCanReadBundle(user.id, id))) throw new ManagedMutationError(404, 'no-bundle')
+      if (user.role !== 'admin' && bundle.repoId !== null && !await db.userCanReadRepoPath(user.id, bundle.repoId, bundle.repoDirectory)) throw new ManagedMutationError(403, 'repo-forbidden')
+      await destination(user, change)
+      if (change.type === 'delete') await db.deleteBundle(id)
+      else await db.setBundleRepo(id, change.repoId, change.directory)
+      return { bundle, user }
+    },
+    async removeRepository(sessionId: string, expected: RemovalRepo, annotations: RemovalAnnotations | null) {
+      const user = await authorize(sessionId, 'admin')
+      const repo = (await db.listAllRepos()).find(r => r.repoId === expected.repoId)
+      if (!repo) throw new ManagedMutationError(404, 'no-repo')
+      if (repo.fullName !== expected.fullName || repo.addedAt !== expected.addedAt) throw new ManagedMutationError(409, 'repository-changed')
+      if (annotations && reportReferenceSnapshot(await db.listReports()) !== annotations.reports) throw new ManagedMutationError(409, 'repository-changed')
+      const reports = await db.listReportsForRepo(repo.repoId)
+      const bundles = await db.listBundlesForRepo(repo.repoId)
+      const deletedReports = await db.deleteReportsForRepo(repo.repoId)
+      const deletedBundles = await db.deleteBundlesForRepo(repo.repoId)
+      const deletedTriage = await db.deleteTriage(annotations?.ids ?? [])
+      await db.deleteRepo(repo.repoId)
+      await db.recordActivity({ kind: 'delete', actor: user.login, actorId: user.id, repo: repo.fullName,
+        action: `removed a repository (${deletedReports} reports, ${deletedBundles} bundles, ${deletedTriage} triage entries)` }, Date.now())
+      return { reports, bundles, deletedReports, deletedBundles, deletedTriage }
+    },
+  }
+}

package/server-managed/package-entry-points.ts

@@ -0,0 +1,51 @@
+import { Buffer } from 'node:buffer'
+import { normalizeTeamPath } from './repo-path.ts'
+
+export const MAX_PACKAGE_BYTES = 256 * 1024
+const MAX_ENTRY_POINTS = 100
+
+// Declared paths, not a Node resolver: never guess defaults, expand export
+// patterns, or execute package code. Keep every suggestion in its package.
+export function packageEntryPoints(manifest: unknown, directory: string): string[] {
+  if (!manifest || typeof manifest !== 'object' || Array.isArray(manifest)) return []
+  const pkg = manifest as { main?: unknown; exports?: unknown; bin?: unknown }
+  const paths = new Set<string>()
+  const add = (value: unknown) => {
+    if (typeof value !== 'string' || value.startsWith('/') || value.endsWith('/') || /[*?]|^[a-z][a-z\d+.-]*:/iu.test(value)) return
+    const normalized = normalizeTeamPath(value)
+    if (!normalized.ok || !normalized.path || normalized.path === 'package.json') return
+    const path = directory ? `${directory}/${normalized.path}` : normalized.path
+    if (path.length <= 500 && paths.size < MAX_ENTRY_POINTS) paths.add(path)
+  }
+  add(pkg.main)
+  const pending = [pkg.exports]
+  for (let visited = 0; pending.length > 0 && visited < 4096; visited++) {
+    const value = pending.pop()
+    if (typeof value === 'string') { if (value.startsWith('./')) add(value); continue }
+    if (Array.isArray(value)) pending.push(...value.slice(0, 4096 - visited).toReversed())
+    else if (value && typeof value === 'object') {
+      const entries = Object.entries(value).filter(([key]) => key !== 'types' && !key.startsWith('types@'))
+      pending.push(...entries.slice(0, 4096 - visited).toReversed().map(([, target]) => target))
+    }
+  }
+  if (typeof pkg.bin === 'string') add(pkg.bin)
+  else if (pkg.bin && typeof pkg.bin === 'object' && !Array.isArray(pkg.bin)) Object.values(pkg.bin).forEach(add)
+  return [...paths]
+}
+
+// Use the immutable blob from the authorized listing, never download_url or a
+// resolved symlink target. Malformed or oversized manifests are optional.
+export async function readPackageEntryPoints(sha: string, directory: string, read: (suffix: string) => Promise<unknown>): Promise<string[]> {
+  try {
+    const blob = await read(`/git/blobs/${sha}`) as { encoding?: unknown; content?: unknown; size?: unknown }
+    if (blob?.encoding !== 'base64' || typeof blob.content !== 'string' || typeof blob.size !== 'number'
+      || blob.size < 0 || blob.size > MAX_PACKAGE_BYTES || blob.content.length > MAX_PACKAGE_BYTES * 2) return []
+    const bytes = Buffer.from(blob.content, 'base64')
+    if (bytes.length !== blob.size || bytes.length > MAX_PACKAGE_BYTES) return []
+    return packageEntryPoints(JSON.parse(bytes.toString('utf8')), directory)
+  } catch {
+    // Suggestions must not prevent browsing. The handler still rechecks
+    // GitHub and managed access after this optional upstream read.
+    return []
+  }
+}

package/server-managed/public-workspace.ts

@@ -8,7 +8,6 @@ import type { WorkspaceShareSnapshot } from './workspace-shares.ts'
 import { sendJson } from './http-response.ts'
 import { hashToken } from './crypto.ts'
 import { TeamReportsError, loadTeamReports, teamReportVisibility } from './team-reports.ts'
-import { MAX_FINDING_ID, MAX_TRIAGE_HISTORY } from '../common/managed/triage.ts'
 import { triageWireEntry } from './triage-response.ts'
 import { MAX_PACKAGE_INVENTORY_BYTES } from './bundle-cache.ts'
 import { backfillBundleSummaries, bundleSummaries } from './bundle-catalog.ts'
@@ -30,7 +29,7 @@ export async function handlePublicWorkspace(req: IncomingMessage, res: ServerRes
   if (method !== 'GET' && method !== 'HEAD') { json(res, 403, { error: 'share-read-only' }); return }
   const shareRoute = /^\/api\/shares\/([A-Za-z0-9_-]+)\/workspace$/u.exec(url.pathname)
   const teamRoute = /^\/api\/teams\/([^/]+)\/(shared|reports|feed)$/u.exec(url.pathname)
-  const reportRoute = /^\/api\/reports\/([^/]+)\/(triage|triage\/history|comments|sources)$/u.exec(url.pathname)
+  const reportRoute = /^\/api\/reports\/([^/]+)\/(triage|comments|sources)$/u.exec(url.pathname)
   const bundleRoute = /^\/api\/bundles\/([^/]+)\/(metadata|contents|download|advisories)$/u.exec(url.pathname)
   if (!shareRoute && !teamRoute && !reportRoute && !bundleRoute) { json(res, 403, { error: 'share-scope-required' }); return }
   const tokenHash = hashToken(token)
@@ -85,15 +84,6 @@ export async function handlePublicWorkspace(req: IncomingMessage, res: ServerRes
     await recheck()
     if (part === 'sources') { await sources(res, deps, snapshot, id, visible.sourcePaths, recheck, stream); return }
     if (part === 'comments') { await send({ comments: await deps.db.listComments([...visible.ids]) }); return }
-    if (part === 'triage/history') {
-      const finding = url.searchParams.get('finding') ?? ''
-      if (!finding || finding.length > MAX_FINDING_ID) { json(res, 400, { error: 'bad-request' }); return }
-      if (!visible.ids.has(finding)) { json(res, 404, { error: 'no-finding' }); return }
-      const events = (await deps.db.listTriageHistory(finding, MAX_TRIAGE_HISTORY)).map(row => ({
-        seq: row.seq, at: row.at, actorLogin: row.actorLogin, batchId: row.batchId, entry: triageWireEntry(row, true),
-      }))
-      await send({ finding, events }); return
-    }
     const entries = Object.fromEntries((await deps.db.listTriage([...visible.ids])).map(row => [row.findingId, triageWireEntry(row)]))
     await send({ entries }); return
   }

package/server-managed/repository-browser.ts

@@ -1,6 +1,7 @@
 import type { ManagedConfig } from './config.ts'
 import type { SelectedRepo } from './db.ts'
 import { GithubApiError, githubJson, githubRepoReadPermission, githubUserIdentity, repoAccessToken } from './github-app.ts'
+import { MAX_PACKAGE_BYTES, readPackageEntryPoints } from './package-entry-points.ts'
 
 export interface RepositoryEntry { name: string; path: string; type: 'dir' | 'file' | 'symlink' | 'submodule' }
 
@@ -121,7 +122,11 @@ async function repositoryReader(repo: SelectedRepo, userToken: string | null, in
         const type = item.submodule_git_url ? 'submodule' : item.type
         if (['dir', 'file', 'symlink', 'submodule'].includes(type)) entries.push({ name: item.name, path: expectedPath, type })
       }
-      return { entries, limited: data.length >= 1000 }
+      const manifestPath = path ? `${path}/package.json` : 'package.json'
+      const manifest = data.find(item => item?.path === manifestPath && item.name === 'package.json' && item.type === 'file' && !item.submodule_git_url
+        && typeof item.size === 'number' && item.size >= 0 && item.size <= MAX_PACKAGE_BYTES && typeof item.sha === 'string' && /^[a-f\d]{40}$/iu.test(item.sha))
+      const packageEntryPoints = manifest ? await readPackageEntryPoints(manifest.sha, path, read) : undefined
+      return { entries, limited: data.length >= 1000, ...(packageEntryPoints ? { packageEntryPoints } : {}) }
     },
   }
 }

package/server-managed/sql.ts

@@ -4,6 +4,11 @@ import type { DatabaseSync, SQLInputValue } from 'node:sqlite'
 import type { ManagedDb } from './db-methods.ts'
 
 type MaybePromise<T> = T | Promise<T>
+// A failed COMMIT acknowledgement (or connection close after COMMIT) does not
+// establish rollback. Callers must retain primary bytes until reconciled.
+export class ManagedCommitError extends Error {
+  constructor(cause: unknown) { super('Managed commit outcome is uncertain', { cause }) }
+}
 export interface ManagedSql {
   prepare(sql: string): {
     get(...params: unknown[]): MaybePromise<unknown>