@preventive/triage 1.0.0-alpha.25 → 1.0.0-alpha.27

package/server-managed/import-triage.ts

@@ -11,11 +11,11 @@ export interface ImportTriageSnapshot {
 }
 export interface ImportTriageStore {
   getImportTriage(ids: readonly string[]): Promise<Record<string, ImportTriageSnapshot>>
-  importTriage(entries: [string, TriageEntryPatch | null][], expected: Record<string, string>, actor: { id: string; login: string }, reportId: string | undefined, now: number): Promise<boolean>
+  importTriage(entries: [string, TriageEntryPatch | null][], expected: Record<string, string>, actor: { id: string; login: string }, reportId: string, now: number): Promise<boolean>
 }
 
 // Raw store methods share one transaction for comparison, triage, and comments.
-export function importTriageMethods(store: Pick<ManagedDb, 'listTriage' | 'listComments' | 'setTriageEntries' | 'createComment'>): ImportTriageStore {
+export function importTriageMethods(store: Pick<ManagedDb, 'getReport' | 'listTriage' | 'listComments' | 'setTriageEntries' | 'createComment'>): ImportTriageStore {
   async function snapshot(ids: readonly string[]) {
     const rows = new Map((await store.listTriage(ids)).map(row => [row.findingId, row]))
     const comments = await store.listComments(ids)
@@ -30,6 +30,9 @@ export function importTriageMethods(store: Pick<ManagedDb, 'listTriage' | 'listC
   return {
     getImportTriage: snapshot,
     async importTriage(entries, expected, actor, reportId, now) {
+      // A report deleted after the HTTP membership check must not leave newly
+      // imported annotations behind. Check existence in the write transaction.
+      if (!reportId || !(await store.getReport(reportId))) return false
       const current = await snapshot(entries.map(([id]) => id))
       if (entries.some(([id]) => current[id]!.version !== expected[id])) return false
       const changes: [string, TriageEntryPatch | null][] = []
@@ -38,7 +41,7 @@ export function importTriageMethods(store: Pick<ManagedDb, 'listTriage' | 'listC
         changes.push([id, Object.keys(entry).length > 0 ? entry : null])
         if (comment && !current[id]!.comments.some(existing => existing.body === comment)) {
           await store.createComment({ findingId: id, body: comment, authorId: null, authorLogin: null,
-            actor, createdAt: null, updatedAt: null, reportId: reportId ?? null }, now)
+            actor, createdAt: null, updatedAt: null, reportId }, now)
         }
       }
       await store.setTriageEntries(changes, actor.id, actor.login, now, reportId)

package/server-managed/index.ts

@@ -12,9 +12,10 @@ import { type ManagedHttpDeps, createManagedRequestHandler } from './http.ts'
 import { loadManagedStatic } from './static.ts'
 import { openManagedStorage } from './storage.ts'
 
-// Expired-session sweep period. Lookups already exclude expired rows
-// (`WHERE expires_at > now`), so this is housekeeping, not a security control.
-const SESSION_GC_INTERVAL_MS = 3_600_000
+// Housekeeping runs on ordinary traffic too, including serverless instances
+// without a timer or cron. Failed sweeps retry on later traffic after a minute.
+const REAP_INTERVAL_MS = 3_600_000
+const REAP_RETRY_MS = 60_000
 
 type ManagedAppOptions = Partial<Pick<ManagedHttpDeps, 'next' | 'serverInfo' | 'isShuttingDown'>>
 
@@ -39,25 +40,47 @@ async function assembleManagedApp(config: ManagedConfig, options: ManagedAppOpti
   const serveStatic = loadManagedStatic(fileURLToPath(new URL('../out/', import.meta.url)), {
     indexOnly: options.next != null, scanServer: options.serverInfo?.deepviewScanServer ?? null,
   })
-  const handleRequest = createManagedRequestHandler({
+  const routeRequest = createManagedRequestHandler({
     ...options, config, db, avatarStore, reportStore, bundleStore, bundleCache, reportSourcesCache, originGate, serveStatic,
-    ...('uploadStore' in storage ? { uploadStore: storage.uploadStore } : {}),
+    ...(storage.uploadStore ? { uploadStore: storage.uploadStore } : {}),
     isShuttingDown, track,
   })
 
   let cleanup: Promise<void> | undefined
+  let nextCleanupAt = 0
   function reap(): Promise<void> {
     if (cleanup) return cleanup
+    const startedAt = Date.now()
+    nextCleanupAt = startedAt + REAP_INTERVAL_MS
+    let sessions = 0, uploads = 0
     cleanup = runReapers({
-      sessions: () => db.deleteExpiredSessions(Date.now()),
-      ...('reapUploads' in storage ? { uploads: () => storage.reapUploads() } : {}),
+      sessions: async () => { sessions = await db.deleteExpiredSessions(Date.now()) },
+      ...(storage.reapUploads ? { uploads: async () => { uploads = await storage.reapUploads!() } } : {}),
+      ...('reapStorage' in storage ? { storage: () => storage.reapStorage() } : {}),
+    }).then(() => {
+      nextCleanupAt = Date.now() + REAP_INTERVAL_MS
+      return console.info(`managed-reaper: removed ${sessions} expired session(s), ${uploads} stale upload part(s) in ${Date.now() - startedAt}ms`)
+    }, err => {
+      nextCleanupAt = Date.now() + REAP_RETRY_MS
+      throw err
     }).finally(() => { cleanup = undefined })
     track(cleanup)
     return cleanup
   }
+  function automaticReap(): Promise<void> {
+    if (isShuttingDown() || cleanup || Date.now() < nextCleanupAt) return Promise.resolve()
+    return reap().catch(err => console.warn('managed-reaper: cleanup failed:', err))
+  }
+  async function handleRequest(req: Parameters<typeof routeRequest>[0], res: Parameters<typeof routeRequest>[1]): Promise<void> {
+    const maintenance = automaticReap()
+    // Send the normal response without waiting for storage housekeeping, but
+    // keep the invocation alive until both finish. No detached serverless work.
+    try { await routeRequest(req, res) }
+    finally { await maintenance }
+  }
   const gcTimer = config.serverless ? null : setInterval(() => {
-    void reap().catch(err => console.warn('managed: maintenance failed:', err))
-  }, SESSION_GC_INTERVAL_MS)
+    void automaticReap()
+  }, REAP_INTERVAL_MS)
   rollback.defer(stop)
 
   function stop(): void {

package/server-managed/object-storage-disk.ts

@@ -0,0 +1,144 @@
+import { randomUUID } from 'node:crypto'
+import { lstat, mkdir, open, readdir, rename, rm, rmdir, stat } from 'node:fs/promises'
+import { dirname, join } from 'node:path'
+import { type ObjectPage, type RawObjectStorage, objectPath } from './object-storage.ts'
+
+function missing(err: unknown): boolean { return (err as NodeJS.ErrnoException).code === 'ENOENT' }
+function version(info: { dev: number; ino: number; size: number; mtimeMs: number; ctimeMs: number }): string {
+  return JSON.stringify([info.dev, info.ino, info.size, info.mtimeMs, info.ctimeMs])
+}
+
+async function syncDirectory(dir: string): Promise<void> {
+  try {
+    const directory = await open(dir, 'r')
+    try { await directory.sync() } finally { await directory.close() }
+  } catch (err) {
+    // Windows and some mounted filesystems cannot open/fsync directories.
+    // Preserve real I/O failures; file fsync remains mandatory on every write.
+    if (!['EINVAL', 'ENOTSUP', 'EOPNOTSUPP', 'ENOSYS', 'EISDIR', 'EBADF', 'EPERM'].includes((err as NodeJS.ErrnoException).code ?? '')) throw err
+  }
+}
+
+// Keyset pagination survives concurrent file creation/deletion. A final sweep
+// catches objects inserted before the cursor during migration.
+async function listFiles(dir: string, prefix: string, cursor: string | null, limit: number, signal?: AbortSignal): Promise<ObjectPage> {
+  const objects: ObjectPage['objects'] = []
+  async function visit(key: string): Promise<void> {
+    signal?.throwIfAborted()
+    let entries
+    try {
+      if (!(await lstat(join(dir, key))).isDirectory()) {
+        console.warn('managed-storage: skipping unsupported directory', JSON.stringify(key))
+        return
+      }
+      entries = await readdir(join(dir, key), { withFileTypes: true })
+    }
+    catch (err) { if (missing(err)) return; throw err }
+    const order = (entry: typeof entries[number]) => `${entry.name}${entry.isDirectory() ? '/' : ''}`
+    entries.sort((a, b) => order(a) < order(b) ? -1 : order(a) > order(b) ? 1 : 0)
+    for (const entry of entries) {
+      signal?.throwIfAborted()
+      const child = `${key}${entry.name}`
+      if (entry.isSymbolicLink() || (!entry.isDirectory() && !entry.isFile())) {
+        console.warn('managed-storage: skipping unsupported entry', JSON.stringify(child))
+        continue
+      }
+      try { objectPath(child) }
+      catch { console.warn('managed-storage: skipping invalid entry', JSON.stringify(child)); continue }
+      if (entry.isDirectory()) {
+        const folder = `${child}/`
+        if (cursor && folder < cursor && !cursor.startsWith(folder)) continue
+        await visit(folder)
+        if (objects.length > limit) return
+      }
+      else if (entry.isFile() && (!cursor || child > cursor)) {
+        try { objects.push({ key: objectPath(child), modifiedAt: (await stat(join(dir, child))).mtimeMs }) }
+        catch (err) { if (!missing(err)) throw err }
+        if (objects.length > limit) return
+      }
+    }
+    // Another migration worker can observe an unlink before its writer has
+    // synced the directory. Persist those observed removals before an empty
+    // inventory can mark the shared migration complete.
+    try { await syncDirectory(join(dir, key)) } catch (err) { if (!missing(err)) throw err }
+  }
+  if (!prefix.endsWith('/') || !Number.isInteger(limit) || limit < 1) throw new Error('Invalid storage page')
+  objectPath(`${prefix}validate`)
+  await visit(prefix)
+  return { objects: objects.slice(0, limit), cursor: objects.length > limit ? objects[limit - 1]!.key : null }
+}
+
+export function createDiskObjectStorage(dir: string): RawObjectStorage {
+  const path = (key: string) => join(dir, objectPath(key))
+  return {
+    async head(key, signal) {
+      signal?.throwIfAborted()
+      try {
+        const info = await stat(path(key))
+        return { size: info.size, version: version(info), modifiedAt: info.mtimeMs }
+      } catch (err) { if (missing(err)) return null; throw err }
+    },
+    async open(key, signal) {
+      signal?.throwIfAborted()
+      let file
+      try { file = await open(path(key), 'r') }
+      catch (err) { if (missing(err)) return null; throw err }
+      try {
+        const info = await file.stat()
+        return { size: info.size, version: version(info), modifiedAt: info.mtimeMs,
+          stream: file.createReadStream(signal ? { signal } : {}) }
+      } catch (err) { await file.close(); throw err }
+    },
+    async put(key, bytes, signal, expected) {
+      const target = path(key)
+      // Temp-file + rename makes replacement atomic to readers. Concurrent
+      // migrations use the same persisted data key and immutable plaintext.
+      const temp = `${target}.${randomUUID()}.tmp`
+      await mkdir(dirname(target), { recursive: true })
+      const file = await open(temp, 'wx', 0o600)
+      try {
+        await file.writeFile(bytes, signal ? { signal } : {})
+        await file.sync(); await file.close()
+        signal?.throwIfAborted()
+        if (expected !== undefined) {
+          try { if (version(await stat(target)) !== expected) return false }
+          catch (err) { if (missing(err)) return false; throw err }
+        }
+        await rename(temp, target)
+        await syncDirectory(dirname(target))
+        return true
+      } finally { await file.close(); await rm(temp, { force: true }) }
+    },
+    async delete(key, expected, signal) {
+      signal?.throwIfAborted()
+      try {
+        if (expected !== undefined && version(await stat(path(key))) !== expected) return false
+        await rm(path(key), { force: true })
+        // Persist plaintext removal before migration checkpoints completion.
+        // Otherwise a crash could restore the directory entry after SQL has
+        // durably disabled further plaintext inventory sweeps.
+        await syncDirectory(dirname(path(key)))
+        return true
+      } catch (err) { if (missing(err)) return true; throw err }
+    },
+    async sync(key, signal) { signal?.throwIfAborted(); await syncDirectory(dirname(path(key))) },
+    async prune(prefix, signal) {
+      if (!prefix.endsWith('/')) throw new Error('Invalid storage prefix')
+      objectPath(`${prefix}validate`)
+      async function visit(folder: string): Promise<void> {
+        signal?.throwIfAborted()
+        let entries
+        try {
+          if (!(await lstat(folder)).isDirectory()) return
+          entries = await readdir(folder, { withFileTypes: true })
+        }
+        catch (err) { if (missing(err)) return; throw err }
+        for (const entry of entries) if (entry.isDirectory()) await visit(join(folder, entry.name))
+        try { await rmdir(folder); await syncDirectory(dirname(folder)) }
+        catch (err) { if (!['ENOENT', 'ENOTEMPTY', 'EEXIST'].includes((err as NodeJS.ErrnoException).code ?? '')) throw err }
+      }
+      await visit(join(dir, prefix))
+    },
+    list: (prefix, cursor, limit, signal) => listFiles(dir, prefix, cursor, limit, signal),
+  }
+}

package/server-managed/object-storage-vercel.ts

@@ -0,0 +1,60 @@
+import { Readable } from 'node:stream'
+import { Buffer } from 'node:buffer'
+import { type VercelBlobSdk, isNotFound, loadVercelBlobSdk } from '../server-common/vercel-blob.ts'
+import { type RawObjectStorage, objectPath } from './object-storage.ts'
+
+export async function openVercelObjectStorage(token: string, sdk?: VercelBlobSdk): Promise<RawObjectStorage> {
+  const blobs = sdk ?? await loadVercelBlobSdk()
+  const path = (key: string) => `.managed/${objectPath(key)}`
+  return {
+    async head(key, signal) {
+      try {
+        const meta = await blobs.head(path(key), { token, ...(signal ? { abortSignal: signal } : {}) })
+        if (!meta.etag) throw new Error('Missing object version')
+        return { size: meta.size, version: meta.etag, modifiedAt: new Date(meta.uploadedAt ?? Date.now()).getTime() }
+      } catch (err) { if (isNotFound(err, blobs)) return null; throw err }
+    },
+    async open(key, signal) {
+      try {
+        const result = await blobs.get(path(key), { token, access: 'private', useCache: false, ...(signal ? { abortSignal: signal } : {}) })
+        if (!result) return null
+        if (result.statusCode !== 200 || !result.stream || !result.blob.etag) {
+          await result.stream?.cancel()
+          throw new Error('Unexpected blob response or missing object version')
+        }
+        return { size: result.blob.size === 0 ? null : result.blob.size, version: result.blob.etag,
+          modifiedAt: new Date(result.blob.uploadedAt ?? Date.now()).getTime(),
+          stream: Readable.fromWeb(result.stream as Parameters<typeof Readable.fromWeb>[0]) }
+      } catch (err) { if (isNotFound(err, blobs)) return null; throw err }
+    },
+    async put(key, bytes, signal, expected, sizeHint) {
+      const multipart = (sizeHint ?? (Buffer.isBuffer(bytes) ? bytes.length : Infinity)) >= 5 * 1024 * 1024
+      try { await blobs.put(path(key), bytes, { token, access: 'private', addRandomSuffix: false, allowOverwrite: true,
+        ...(expected ? { ifMatch: expected } : {}), multipart, contentType: 'application/octet-stream', cacheControlMaxAge: 60, ...(signal ? { abortSignal: signal } : {}) })
+        return true
+      } catch (err) {
+        if (blobs.BlobPreconditionFailedError && err instanceof blobs.BlobPreconditionFailedError) return false
+        throw err
+      }
+    },
+    async delete(key, version, signal) {
+      signal?.throwIfAborted()
+      try { await blobs.del(path(key), { token, ...(version ? { ifMatch: version } : {}), ...(signal ? { abortSignal: signal } : {}) }); return true }
+      catch (err) {
+        if (isNotFound(err, blobs)) return true
+        if (blobs.BlobPreconditionFailedError && err instanceof blobs.BlobPreconditionFailedError) return false
+        throw err
+      }
+    },
+    async list(prefix, cursor, limit, signal) {
+      signal?.throwIfAborted()
+      if (!prefix.endsWith('/') || !Number.isInteger(limit) || limit < 1) throw new Error('Invalid storage page')
+      objectPath(`${prefix}validate`)
+      const page = await blobs.list({ prefix: `.managed/${prefix}`, token, limit, ...(cursor ? { cursor } : {}), ...(signal ? { abortSignal: signal } : {}) })
+      if (page.hasMore && (!page.cursor || page.cursor === cursor)) throw new Error('Invalid blob pagination')
+      return { objects: page.blobs.filter(blob => blob.pathname.startsWith(`.managed/${prefix}`)).map(blob => ({ key: blob.pathname.slice('.managed/'.length),
+        modifiedAt: new Date(blob.uploadedAt ?? Date.now()).getTime() })),
+      cursor: page.hasMore ? page.cursor! : null }
+    },
+  }
+}

package/server-managed/object-storage.ts

@@ -0,0 +1,71 @@
+import type { Buffer } from 'node:buffer'
+import type { Readable } from 'node:stream'
+import type { OpenedBlob } from './blob-store.ts'
+import { validateCacheKey } from './cache-storage.ts'
+
+export const ENCRYPTED_CACHE_PREFIX = 'cache-encrypted-v1/'
+const STORAGE_PREFIXES = ['reports/', 'bundles/', 'avatars/', 'uploads/', 'cache/', ENCRYPTED_CACHE_PREFIX]
+export interface RawObject extends OpenedBlob { version: string; modifiedAt: number }
+type ObjectMetadata = Omit<RawObject, 'stream'>
+interface ListedObject { key: string; modifiedAt: number }
+export interface ObjectPage { objects: ListedObject[]; cursor: string | null }
+export interface RawObjectStorage {
+  open(key: string, signal?: AbortSignal): Promise<RawObject | null>
+  head(key: string, signal?: AbortSignal): Promise<ObjectMetadata | null>
+  prune?(prefix: string, signal?: AbortSignal): Promise<void>
+  // Persist an observed disk replacement before its SQL migration checkpoint.
+  sync?(key: string, signal?: AbortSignal): Promise<void>
+  // A plaintext size hint selects multipart uploads without buffering streams.
+  put(key: string, bytes: Buffer | Readable, signal?: AbortSignal, expected?: string, sizeHint?: number): Promise<boolean>
+  // Return false if the original version changed; do not delete its replacement.
+  delete(key: string, version?: string, signal?: AbortSignal): Promise<boolean>
+  list(prefix: string, cursor: string | null, limit: number, signal?: AbortSignal): Promise<ObjectPage>
+}
+export interface ObjectStorage {
+  open(key: string): Promise<OpenedBlob | null>
+  get(key: string): Promise<Buffer | null>
+  exists(key: string): Promise<boolean>
+  put(key: string, bytes: Buffer): Promise<string | null>
+  delete(key: string): Promise<void>
+  deletePrefix(prefix: string): Promise<void>
+}
+
+export function isBlobId(value: string): boolean {
+  return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/u.test(value)
+}
+
+export function objectPath(key: string): string {
+  validateCacheKey(key)
+  if (!STORAGE_PREFIXES.some(prefix => key.startsWith(prefix))) throw new Error('Invalid managed storage namespace')
+  return key
+}
+
+// Hash verification and migration may consume a stream before it can be used.
+// Reopen only the same object version, closing any concurrent replacement.
+export async function openObjectVersion(raw: RawObjectStorage, key: string, version: string, signal?: AbortSignal): Promise<RawObject | null> {
+  const current = await raw.open(key, signal)
+  if (current?.version === version) return current
+  current?.stream.destroy()
+  return null
+}
+
+export async function deleteObjects(raw: RawObjectStorage, prefix: string, signal: AbortSignal, before?: number): Promise<number> {
+  const eligible = (modifiedAt: number) => before === undefined || modifiedAt < before
+  // Finish listing before deleting: provider cursors may be offset-based.
+  const cursors = new Set<string>(), keys = new Set<string>()
+  let cursor: string | null = null
+  do {
+    const page = await raw.list(prefix, cursor, 100, signal)
+    for (const object of page.objects) if (eligible(object.modifiedAt)) keys.add(object.key)
+    cursor = page.cursor
+    if (cursor !== null && cursors.has(cursor)) throw new Error('Invalid blob pagination')
+    if (cursor !== null) cursors.add(cursor)
+  } while (cursor !== null)
+  let removed = 0
+  for (const key of keys) {
+    const stored = await raw.head(key, signal)
+    // Ignore stale listings and preserve concurrent replacements.
+    if (stored && eligible(stored.modifiedAt) && await raw.delete(key, stored.version, signal)) removed++
+  }
+  return removed
+}

package/server-managed/report-query.ts

@@ -2,3 +2,9 @@
 // the encoded response, independently of the per-upload size limit.
 export const MAX_REPORT_QUERY_COUNT = 4096
 export const MAX_REPORT_QUERY_BYTES = 1024 * 1024 * 1024
+
+// The import catalog scans a bounded page, not the whole installation. A
+// report larger than the byte target occupies a page by itself; upload limits
+// still bound that single report and the cursor must always make progress.
+export const FINDING_CATALOG_PAGE_COUNT = 128
+export const FINDING_CATALOG_PAGE_BYTES = 32 * 1024 * 1024

package/server-managed/repository-browser.ts

@@ -2,6 +2,7 @@ import type { ManagedConfig } from './config.ts'
 import type { SelectedRepo } from './db.ts'
 import { GithubApiError, githubJson, githubRepoReadPermission, githubUserIdentity, repoAccessToken } from './github-app.ts'
 import { MAX_PACKAGE_BYTES, readPackageEntryPoints } from './package-entry-points.ts'
+import { readSolidityEntryPoints } from './solidity-entry-points.ts'
 
 export interface RepositoryEntry { name: string; path: string; type: 'dir' | 'file' | 'symlink' | 'submodule' }
 
@@ -126,7 +127,10 @@ async function repositoryReader(repo: SelectedRepo, userToken: string | null, in
       const manifest = data.find(item => item?.path === manifestPath && item.name === 'package.json' && item.type === 'file' && !item.submodule_git_url
         && typeof item.size === 'number' && item.size >= 0 && item.size <= MAX_PACKAGE_BYTES && typeof item.sha === 'string' && /^[a-f\d]{40}$/iu.test(item.sha))
       const packageEntryPoints = manifest ? await readPackageEntryPoints(manifest.sha, path, read) : undefined
-      return { entries, limited: data.length >= 1000, ...(packageEntryPoints ? { packageEntryPoints } : {}) }
+      const solidity = await readSolidityEntryPoints(path, data, read)
+      return { entries, limited: data.length >= 1000, ...(packageEntryPoints ? { packageEntryPoints } : {}),
+        ...(solidity.paths.length > 0 || solidity.limited ? { solidityEntryPoints: solidity.paths, soliditySuggestionsLimited: solidity.limited } : {}),
+      }
     },
   }
 }

package/server-managed/solidity-entry-points.ts

@@ -0,0 +1,69 @@
+import { normalizeTeamPath } from './repo-path.ts'
+
+const MAX_SUGGESTIONS = 100
+const EXCLUDED_DIRECTORIES = new Set(['test', 'tests', 'script', 'scripts', 'mock', 'mocks', 'node_modules', 'vendor', 'out', 'artifacts', 'cache', 'build', 'dist', 'broadcast'])
+
+function sourcePath(value: unknown): value is string {
+  if (typeof value !== 'string' || !value.endsWith('.sol') || /\.(?:t|s|test|spec)\.sol$/iu.test(value)) return false
+  const normalized = normalizeTeamPath(value)
+  const directories = value.split('/').slice(0, -1).map(part => part.toLowerCase())
+  const sourceRoot = directories.findIndex(part => part === 'src' || part === 'contracts')
+  return normalized.ok && normalized.path === value && !directories.some((part, index) =>
+    EXCLUDED_DIRECTORIES.has(part) || (part === 'lib' && (sourceRoot < 0 || index < sourceRoot)))
+}
+
+type ListingEntry = { name?: unknown; path?: unknown; type?: unknown; sha?: unknown; submodule_git_url?: unknown }
+
+// Maintain the alphabetically first 100 unique candidates even when GitHub's
+// input is unordered. Return whether a unique candidate exceeds the capacity.
+export function addSoliditySuggestion(paths: string[], path: string): boolean {
+  let start = 0
+  let end = paths.length
+  while (start < end) {
+    const middle = Math.floor((start + end) / 2)
+    if (paths[middle]! < path) start = middle + 1
+    else end = middle
+  }
+  if (paths[start] === path) return false
+  const full = paths.length === MAX_SUGGESTIONS
+  if (start < MAX_SUGGESTIONS) {
+    // Evict before inserting, so retained candidates never exceed the cap.
+    if (full) paths.pop()
+    paths.splice(start, 0, path)
+  }
+  return full
+}
+
+// Suggestions from filenames, not deployability or import analysis. Read at
+// most two source trees, using SHAs from the authorized pinned directory.
+export async function readSolidityEntryPoints(directory: string, listing: unknown[], read: (suffix: string) => Promise<unknown>) {
+  const prefix = directory ? directory + '/' : ''
+  const entries = listing.filter((entry): entry is ListingEntry => !!entry && typeof entry === 'object').filter(entry =>
+    typeof entry.name === 'string' && !entry.name.includes('/') && entry.path === prefix + entry.name && !entry.submodule_git_url)
+  const hasFramework = entries.some(entry => entry.type === 'file' && typeof entry.name === 'string'
+    && (entry.name === 'foundry.toml' || /^hardhat\.config\.(?:[cm]?js|ts)$/u.test(entry.name)))
+  const roots = entries.filter(entry => entry.type === 'dir' && (entry.name === 'contracts' || (hasFramework && entry.name === 'src'))
+    && typeof entry.sha === 'string' && /^[a-f\d]{40}$/iu.test(entry.sha)).slice(0, 2)
+  const paths: string[] = []
+  let limited = false
+  for (const entry of entries) {
+    if (entry.type === 'file' && sourcePath(entry.path) && addSoliditySuggestion(paths, entry.path)) limited = true
+  }
+  for (const root of roots) {
+    if (!sourcePath(`${root.path}/Contract.sol`)) continue
+    try {
+      const data = await read(`/git/trees/${root.sha}?recursive=1`) as { tree?: unknown; truncated?: unknown }
+      if (!Array.isArray(data?.tree)) continue
+      limited ||= data.truncated === true
+      for (const entry of data.tree) {
+        if (entry?.type !== 'blob' || !['100644', '100755'].includes(entry.mode) || typeof entry.path !== 'string') continue
+        const path = `${root.path}/${entry.path}`
+        if (sourcePath(path) && addSoliditySuggestion(paths, path)) limited = true
+      }
+    } catch {
+      // Optional suggestions must not block browsing. The request handler
+      // rechecks GitHub access and local path grants after all reads.
+    }
+  }
+  return { paths, limited }
+}

package/server-managed/sql.ts

@@ -4,11 +4,6 @@ import type { DatabaseSync, SQLInputValue } from 'node:sqlite'
 import type { ManagedDb } from './db-methods.ts'
 
 type MaybePromise<T> = T | Promise<T>
-// A failed COMMIT acknowledgement (or connection close after COMMIT) does not
-// establish rollback. Callers must retain primary bytes until reconciled.
-export class ManagedCommitError extends Error {
-  constructor(cause: unknown) { super('Managed commit outcome is uncertain', { cause }) }
-}
 export interface ManagedSql {
   prepare(sql: string): {
     get(...params: unknown[]): MaybePromise<unknown>

package/server-managed/storage-command.ts

@@ -0,0 +1,16 @@
+import { loadManagedConfig } from './config.ts'
+import { openManagedStorageDb } from './storage.ts'
+
+// Require the deployment mode: DB_PATH belongs to e2e in combined deployments.
+// Read the database requirement without opening bytes or enabling encryption.
+export async function storageCommand(mode: string | undefined): Promise<void> {
+  if (mode !== 'managed' && mode !== 'managed-e2e' && mode !== 'e2e-managed') throw new Error('Storage status requires a deployment mode: --storage-encryption-status managed|managed-e2e|e2e-managed')
+  const db = await openManagedStorageDb(loadManagedConfig({ combined: mode !== 'managed' }))
+  try {
+    const status = await db.getStorageEncryption()
+    console.log(JSON.stringify(status ? {
+      encryption: 'chacha20-poly1305', complete: status.complete === 1, cleanupComplete: status.cleanupComplete === 1,
+      migrated: status.migrated, cursor: status.cursor,
+    } : { encryption: 'disabled' }))
+  } finally { await db.close() }
+}