@preventive/triage 1.0.0-alpha.23 → 1.0.0-alpha.26

package/server-managed/package-entry-points.ts

@@ -0,0 +1,51 @@
+import { Buffer } from 'node:buffer'
+import { normalizeTeamPath } from './repo-path.ts'
+
+export const MAX_PACKAGE_BYTES = 256 * 1024
+const MAX_ENTRY_POINTS = 100
+
+// Declared paths, not a Node resolver: never guess defaults, expand export
+// patterns, or execute package code. Keep every suggestion in its package.
+export function packageEntryPoints(manifest: unknown, directory: string): string[] {
+  if (!manifest || typeof manifest !== 'object' || Array.isArray(manifest)) return []
+  const pkg = manifest as { main?: unknown; exports?: unknown; bin?: unknown }
+  const paths = new Set<string>()
+  const add = (value: unknown) => {
+    if (typeof value !== 'string' || value.startsWith('/') || value.endsWith('/') || /[*?]|^[a-z][a-z\d+.-]*:/iu.test(value)) return
+    const normalized = normalizeTeamPath(value)
+    if (!normalized.ok || !normalized.path || normalized.path === 'package.json') return
+    const path = directory ? `${directory}/${normalized.path}` : normalized.path
+    if (path.length <= 500 && paths.size < MAX_ENTRY_POINTS) paths.add(path)
+  }
+  add(pkg.main)
+  const pending = [pkg.exports]
+  for (let visited = 0; pending.length > 0 && visited < 4096; visited++) {
+    const value = pending.pop()
+    if (typeof value === 'string') { if (value.startsWith('./')) add(value); continue }
+    if (Array.isArray(value)) pending.push(...value.slice(0, 4096 - visited).toReversed())
+    else if (value && typeof value === 'object') {
+      const entries = Object.entries(value).filter(([key]) => key !== 'types' && !key.startsWith('types@'))
+      pending.push(...entries.slice(0, 4096 - visited).toReversed().map(([, target]) => target))
+    }
+  }
+  if (typeof pkg.bin === 'string') add(pkg.bin)
+  else if (pkg.bin && typeof pkg.bin === 'object' && !Array.isArray(pkg.bin)) Object.values(pkg.bin).forEach(add)
+  return [...paths]
+}
+
+// Use the immutable blob from the authorized listing, never download_url or a
+// resolved symlink target. Malformed or oversized manifests are optional.
+export async function readPackageEntryPoints(sha: string, directory: string, read: (suffix: string) => Promise<unknown>): Promise<string[]> {
+  try {
+    const blob = await read(`/git/blobs/${sha}`) as { encoding?: unknown; content?: unknown; size?: unknown }
+    if (blob?.encoding !== 'base64' || typeof blob.content !== 'string' || typeof blob.size !== 'number'
+      || blob.size < 0 || blob.size > MAX_PACKAGE_BYTES || blob.content.length > MAX_PACKAGE_BYTES * 2) return []
+    const bytes = Buffer.from(blob.content, 'base64')
+    if (bytes.length !== blob.size || bytes.length > MAX_PACKAGE_BYTES) return []
+    return packageEntryPoints(JSON.parse(bytes.toString('utf8')), directory)
+  } catch {
+    // Suggestions must not prevent browsing. The handler still rechecks
+    // GitHub and managed access after this optional upstream read.
+    return []
+  }
+}

package/server-managed/public-workspace.ts

@@ -8,7 +8,6 @@ import type { WorkspaceShareSnapshot } from './workspace-shares.ts'
 import { sendJson } from './http-response.ts'
 import { hashToken } from './crypto.ts'
 import { TeamReportsError, loadTeamReports, teamReportVisibility } from './team-reports.ts'
-import { MAX_FINDING_ID, MAX_TRIAGE_HISTORY } from '../common/managed/triage.ts'
 import { triageWireEntry } from './triage-response.ts'
 import { MAX_PACKAGE_INVENTORY_BYTES } from './bundle-cache.ts'
 import { backfillBundleSummaries, bundleSummaries } from './bundle-catalog.ts'
@@ -30,7 +29,7 @@ export async function handlePublicWorkspace(req: IncomingMessage, res: ServerRes
   if (method !== 'GET' && method !== 'HEAD') { json(res, 403, { error: 'share-read-only' }); return }
   const shareRoute = /^\/api\/shares\/([A-Za-z0-9_-]+)\/workspace$/u.exec(url.pathname)
   const teamRoute = /^\/api\/teams\/([^/]+)\/(shared|reports|feed)$/u.exec(url.pathname)
-  const reportRoute = /^\/api\/reports\/([^/]+)\/(triage|triage\/history|comments|sources)$/u.exec(url.pathname)
+  const reportRoute = /^\/api\/reports\/([^/]+)\/(triage|comments|sources)$/u.exec(url.pathname)
   const bundleRoute = /^\/api\/bundles\/([^/]+)\/(metadata|contents|download|advisories)$/u.exec(url.pathname)
   if (!shareRoute && !teamRoute && !reportRoute && !bundleRoute) { json(res, 403, { error: 'share-scope-required' }); return }
   const tokenHash = hashToken(token)
@@ -85,15 +84,6 @@ export async function handlePublicWorkspace(req: IncomingMessage, res: ServerRes
     await recheck()
     if (part === 'sources') { await sources(res, deps, snapshot, id, visible.sourcePaths, recheck, stream); return }
     if (part === 'comments') { await send({ comments: await deps.db.listComments([...visible.ids]) }); return }
-    if (part === 'triage/history') {
-      const finding = url.searchParams.get('finding') ?? ''
-      if (!finding || finding.length > MAX_FINDING_ID) { json(res, 400, { error: 'bad-request' }); return }
-      if (!visible.ids.has(finding)) { json(res, 404, { error: 'no-finding' }); return }
-      const events = (await deps.db.listTriageHistory(finding, MAX_TRIAGE_HISTORY)).map(row => ({
-        seq: row.seq, at: row.at, actorLogin: row.actorLogin, batchId: row.batchId, entry: triageWireEntry(row, true),
-      }))
-      await send({ finding, events }); return
-    }
     const entries = Object.fromEntries((await deps.db.listTriage([...visible.ids])).map(row => [row.findingId, triageWireEntry(row)]))
     await send({ entries }); return
   }

package/server-managed/report-query.ts

@@ -2,3 +2,9 @@
 // the encoded response, independently of the per-upload size limit.
 export const MAX_REPORT_QUERY_COUNT = 4096
 export const MAX_REPORT_QUERY_BYTES = 1024 * 1024 * 1024
+
+// The import catalog scans a bounded page, not the whole installation. A
+// report larger than the byte target occupies a page by itself; upload limits
+// still bound that single report and the cursor must always make progress.
+export const FINDING_CATALOG_PAGE_COUNT = 128
+export const FINDING_CATALOG_PAGE_BYTES = 32 * 1024 * 1024

package/server-managed/repository-browser.ts

@@ -1,6 +1,7 @@
 import type { ManagedConfig } from './config.ts'
 import type { SelectedRepo } from './db.ts'
 import { GithubApiError, githubJson, githubRepoReadPermission, githubUserIdentity, repoAccessToken } from './github-app.ts'
+import { MAX_PACKAGE_BYTES, readPackageEntryPoints } from './package-entry-points.ts'
 
 export interface RepositoryEntry { name: string; path: string; type: 'dir' | 'file' | 'symlink' | 'submodule' }
 
@@ -121,7 +122,11 @@ async function repositoryReader(repo: SelectedRepo, userToken: string | null, in
         const type = item.submodule_git_url ? 'submodule' : item.type
         if (['dir', 'file', 'symlink', 'submodule'].includes(type)) entries.push({ name: item.name, path: expectedPath, type })
       }
-      return { entries, limited: data.length >= 1000 }
+      const manifestPath = path ? `${path}/package.json` : 'package.json'
+      const manifest = data.find(item => item?.path === manifestPath && item.name === 'package.json' && item.type === 'file' && !item.submodule_git_url
+        && typeof item.size === 'number' && item.size >= 0 && item.size <= MAX_PACKAGE_BYTES && typeof item.sha === 'string' && /^[a-f\d]{40}$/iu.test(item.sha))
+      const packageEntryPoints = manifest ? await readPackageEntryPoints(manifest.sha, path, read) : undefined
+      return { entries, limited: data.length >= 1000, ...(packageEntryPoints ? { packageEntryPoints } : {}) }
     },
   }
 }

package/server-managed/sql.ts

@@ -4,6 +4,11 @@ import type { DatabaseSync, SQLInputValue } from 'node:sqlite'
 import type { ManagedDb } from './db-methods.ts'
 
 type MaybePromise<T> = T | Promise<T>
+// A failed COMMIT acknowledgement (or connection close after COMMIT) does not
+// establish rollback. Callers must retain primary bytes until reconciled.
+export class ManagedCommitError extends Error {
+  constructor(cause: unknown) { super('Managed commit outcome is uncertain', { cause }) }
+}
 export interface ManagedSql {
   prepare(sql: string): {
     get(...params: unknown[]): MaybePromise<unknown>

package/server-managed/uploads.ts

@@ -7,6 +7,8 @@ import type { IncomingMessage } from 'node:http'
 import type { BlobStore } from './blob-store.ts'
 
 export const UPLOAD_CHUNK_BYTES = 3 * 1024 * 1024
+export const MAX_UPLOAD_BYTES = 1024 * 1024 * 1024
+const MAX_UPLOAD_PARTS = Math.ceil(MAX_UPLOAD_BYTES / UPLOAD_CHUNK_BYTES)
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/u
 export type UploadKind = 'reports' | 'bundles'
 
@@ -16,7 +18,24 @@ function partId(session: string, kind: UploadKind, id: string, index: number): s
 }
 
 export function validUploadPart(id: string, index: number, maxBytes: number): boolean {
-  return UUID.test(id) && Number.isSafeInteger(index) && index >= 0 && index < Math.ceil(maxBytes / UPLOAD_CHUNK_BYTES)
+  return UUID.test(id) && Number.isSafeInteger(index) && index >= 0 && index < Math.ceil(Math.min(maxBytes, MAX_UPLOAD_BYTES) / UPLOAD_CHUNK_BYTES)
+}
+
+export function validUpload(id: string, count: number): boolean {
+  return UUID.test(id) && Number.isSafeInteger(count) && count > 0
+}
+
+// Limit cleanup to indices that any configured server could have accepted,
+// even if the request advertises an enormous count or the limit was lowered.
+export async function deleteUpload(store: BlobStore, session: string, kind: UploadKind, id: string, count: number): Promise<void> {
+  if (!validUpload(id, count)) throw new Error('bad-upload')
+  const end = Math.min(count, MAX_UPLOAD_PARTS), errors = []
+  for (let start = 0; start < end; start += 8) {
+    const results = await Promise.allSettled(Array.from({ length: Math.min(8, end - start) },
+      (_, index) => store.delete(partId(session, kind, id, start + index))))
+    for (const result of results) if (result.status === 'rejected') errors.push(result.reason)
+  }
+  if (errors.length > 0) throw new AggregateError(errors, 'Upload cleanup failed')
 }
 
 export function putUploadPart(store: BlobStore, session: string, kind: UploadKind, id: string, index: number, bytes: Buffer): Promise<void> {
@@ -26,14 +45,13 @@ export function putUploadPart(store: BlobStore, session: string, kind: UploadKin
 export async function readUpload(store: BlobStore, req: IncomingMessage, session: string, kind: UploadKind, maxBytes: number): Promise<Buffer> {
   const id = req.headers['x-upload-id']
   const count = Number(req.headers['x-upload-parts']), size = Number(req.headers['x-upload-size'])
-  if (typeof id !== 'string' || !UUID.test(id) || !Number.isSafeInteger(size) || size <= 0
-    || !Number.isSafeInteger(count) || count !== Math.ceil(size / UPLOAD_CHUNK_BYTES)) throw new Error('bad-upload')
-  if (size > maxBytes) throw new Error('too-large')
-  const ids = Array.from({ length: count }, (_, index) => partId(session, kind, id, index))
-  const parts: Buffer[] = []
+  if (typeof id !== 'string' || !validUpload(id, count)) throw new Error('bad-upload')
   try {
-    for (const [index, key] of ids.entries()) {
-      const bytes = await store.get(key)
+    if (!Number.isSafeInteger(size) || size <= 0 || count !== Math.ceil(size / UPLOAD_CHUNK_BYTES)) throw new Error('bad-upload')
+    if (size > maxBytes || size > MAX_UPLOAD_BYTES) throw new Error('too-large')
+    const parts: Buffer[] = []
+    for (let index = 0; index < count; index++) {
+      const bytes = await store.get(partId(session, kind, id, index))
       const expected = Math.min(UPLOAD_CHUNK_BYTES, size - index * UPLOAD_CHUNK_BYTES)
       if (!bytes || bytes.length !== expected) throw new Error('bad-upload')
       parts.push(bytes)
@@ -41,7 +59,7 @@ export async function readUpload(store: BlobStore, req: IncomingMessage, session
     return Buffer.concat(parts, size)
   } finally {
     // These bytes can no longer be finalized. Failed/abandoned chunk uploads
-    // are also covered by the daily staging sweep.
-    for (const key of ids) await store.delete(key).catch(err => console.warn('managed: upload cleanup failed:', err))
+    // are also covered by automatic staging maintenance.
+    await deleteUpload(store, session, kind, id, count).catch(err => console.warn('managed: upload cleanup failed:', err))
   }
 }