@preventive/triage 1.0.0-alpha.26 → 1.0.0-alpha.28

package/server-managed/http.ts

@@ -31,7 +31,7 @@
 //   DELETE /api/admin/reports/<id> → admin|manage deletes a report | 401/403/404
 //   POST /api/admin/reports/set-repo → admin|manage attaches/detaches a report's repo | 401/403/404
 //   GET  /api/bundles/<id>/{metadata,contents} → authorized encoded bytes | 401/404/422
-//   GET  /api/bundles/<id>/advisories → published npm advisories (security access) | 401/403/404
+//   GET  /api/bundles/<id>/advisories → published dependency advisories (security access) | 401/403/404
 //   GET  /api/bundles/<id>/download → authorized original upload | 401/404
 //   GET  /api/admin/bundles      → admin all bundles; managers own/team bundles | 401/403
 //   POST /api/admin/bundles      → admin|manage uploads a bundle (raw body) | 401/403/413
@@ -47,26 +47,27 @@
 //   POST /api/auth/logout        → same-origin + CSRF, drops the session
 import type { IncomingMessage, ServerResponse } from 'node:http'
 import { pipeline } from 'node:stream/promises'
-import { NPM_ADVISORIES_TIMEOUT_MS, fetchNpmAdvisories } from '../server-common/npm-advisories.ts'
+import { ADVISORIES_TIMEOUT_MS, fetchBundleAdvisories } from './bundle-advisories.ts'
+import type { BundleAdvisoryInventory } from './bundle-advisory-inventory.ts'
 import { UPLOAD_CHUNK_BYTES, type UploadKind, deleteUpload, putUploadPart, readUpload, validUpload, validUploadPart } from './uploads.ts'
 import { type BundleCache, type BundleCachePart, MAX_PACKAGE_INVENTORY_BYTES } from './bundle-cache.ts'
 import { backfillBundleSummaries, bundleSummaries } from './bundle-catalog.ts'
+import { contentAccess } from './content-access.ts'
 import type { BundleStore } from './bundle-store.ts'
 import { Buffer } from 'node:buffer'
 import { createHash, randomUUID } from 'node:crypto'
-import { teamCatalogRevision } from './team-catalog.ts'
 import type { AvatarStore } from './avatar-store.ts'
 import type { BlobStore } from './blob-store.ts'
-import { bundleIntegrity, bundleKind, reportBundleHashes } from './bundle.ts'
+import { bundleIntegrity, bundleKind, bundleRepo, reportBundleHashes } from './bundle.ts'
 import type { ManagedConfig } from './config.ts'
-import type { ManagedDb, ManagedSession, ReportRecord, StoredUser, TriageEventRow } from './db.ts'
+import type { ManagedBundle, ManagedDb, ManagedSession, ReportRecord, SelectedRepo, StoredUser, TriageEventRow } from './db.ts'
 import type { OriginGate } from '../server-common/origin.ts'
 import { isRole, roleAtLeast } from '../common/managed/roles.ts'
 import { VISIBILITY_PERMISSIONS, parseTeamUserPermissions } from '../common/managed/permissions.ts'
 import { filterReportData } from '../common/managed/report-filter.ts'
 import type { TriageEntryPatch } from '../common/managed/triage.ts'
 import { MAX_FINDING_ID, MAX_TRIAGE_BODY_BYTES, MAX_TRIAGE_ENTRIES, MAX_TRIAGE_HISTORY, parseTriageEntryPatch } from '../common/managed/triage.ts'
-import { reportRepoGithub } from '../report/index.js'
+import { reportRepoGithub } from '@preventive/report'
 import { loadManagedFindings, readManagedReport } from '../common/managed/report-content.ts'
 import type { ReportSourcesCache } from './report-sources.ts'
 import { normalizeTeamPath } from './repo-path.ts'
@@ -76,12 +77,12 @@ import { GithubApiError, collectRepos, fetchPublicRepository, installUrl, public
 import type { ConnectedRepo } from './github-app.ts'
 import { canAddAnyPublicRepository, canAddRepositories, passesPublicRepositorySafeguard } from './repository-policy.ts'
 import { RepositoryDiscovery } from './repository-discovery.ts'
-import { createRepositoryBrowser, scopedDirectory } from './repository-browser.ts'
+import { type RepositoryEntry, createRepositoryBrowser, scopedDirectory } from './repository-browser.ts'
 import { CALLBACK_PATH, LOGIN_PATH, OAuthError, buildLoginRedirect, ensureUserAccessToken, handleCallback } from './github-oauth.ts'
 import { clearCookie, endSession, readSession } from './session.ts'
 import type { ActivityContext, ActivityInput } from './activity.ts'
 import { acceptsReportMetadata } from './report-response.ts'
-import { TeamReportsError, loadTeamReports, recheckTeam, teamFindingIds, teamSnapshot, teamSourcePaths, teamWorkspaceFindingIds } from './team-reports.ts'
+import { TeamReportsError, loadTeamAnnotations, loadTeamReportsResponse, recheckTeam, teamFindingIds, teamSnapshot, teamSourcePaths, teamWorkspaceFindingIds } from './team-reports.ts'
 import { FINDING_CATALOG_PAGE_BYTES, FINDING_CATALOG_PAGE_COUNT, MAX_REPORT_QUERY_BYTES, MAX_REPORT_QUERY_COUNT } from './report-query.ts'
 import { lookupFixes, storedFixUrls } from './github-pulls.ts'
 import { IssueError, MAX_ISSUE_BODY_BYTES, createGithubIssue, parseIssueContext, prepareGithubIssue } from './github-issues.ts'
@@ -90,10 +91,10 @@ import { sendJson, writeResponse } from './http-response.ts'
 import { triageWireEntry } from './triage-response.ts'
 import { handlePublicWorkspace } from './public-workspace.ts'
 import { serveUserTeamFeed } from './team-feed.ts'
-import { hashToken, randomToken } from './crypto.ts'
+import { hashToken, randomToken, safeEqual } from './crypto.ts'
 import { canDeleteComment, parseCommentBody } from '../common/managed/comments.ts'
-import { ManagedCommitError } from './sql.ts'
 import { ManagedMutationError, reportReferenceSnapshot } from './management.ts'
+import { BundleBuildError, buildRepositoryBundle, parseBundleBuild, withBundleBuildLease } from './bundle-build.ts'
 
 const SESSION_PATH = '/api/auth/session'
 const AVATAR_PREFIX = '/api/avatar/'
@@ -116,6 +117,7 @@ const REPORT_SET_REPO_PATH = '/api/admin/reports/set-repo'
 const REPORT_SET_VISIBLE_PATH = '/api/admin/reports/set-visible'
 const REPORT_PREFIX = '/api/admin/reports/'
 const ADMIN_BUNDLES_PATH = '/api/admin/bundles'
+const BUNDLE_CREATE_PATH = '/api/admin/bundles/create'
 const BUNDLE_SET_REPO_PATH = '/api/admin/bundles/set-repo'
 const BUNDLE_PREFIX = '/api/admin/bundles/'
 const MY_TEAMS_PATH = '/api/teams'
@@ -318,16 +320,15 @@ async function readJsonBody(req: IncomingMessage, maxBytes = MAX_JSON_BODY_BYTES
   return JSON.parse(buf.toString('utf8') || 'null')
 }
 
-// Validate a mutation: same-origin gate + an authenticated session whose
-// double-submit CSRF token matches the X-CSRF-Token header. Returns the session,
-// or null after having already sent the 401/403.
+// The router enforces same-origin for every request. A mutation also needs an
+// authenticated session whose CSRF token matches the X-CSRF-Token header.
+// Returns the session, or null after having already sent the 401/403.
 async function checkMutation(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<{ session: ManagedSession; user: StoredUser } | null> {
-  if (!deps.originGate.isOriginAllowed(req)) { sendJson(res, 403, { error: 'origin-denied' }); return null }
   const s = await readSession(deps.config, deps.db, cookie, Date.now())
   if (s == null) { sendJson(res, 401, { error: 'unauthenticated' }); return null }
   const csrf = firstHeader(req.headers['x-csrf-token'])
   if (csrf == null) { sendJson(res, 403, { error: 'csrf-missing' }); return null }
-  if (csrf !== s.session.csrfToken) { sendJson(res, 403, { error: 'csrf-mismatch' }); return null }
+  if (!safeEqual(csrf, s.session.csrfToken)) { sendJson(res, 403, { error: 'csrf-mismatch' }); return null }
   return s
 }
 
@@ -748,12 +749,6 @@ async function resolveUploadRepoId(req: IncomingMessage, res: ServerResponse, de
   return { ok: true, repoId: n }
 }
 
-async function canChangeReportRepo(deps: ManagedHttpDeps, user: StoredUser, reportId: string): Promise<boolean> {
-  if (!roleAtLeast(user.role, 'manage') || !(await canViewReport(deps, user, reportId))) return false
-  const report = await deps.db.getReport(reportId)
-  return report != null && (user.role === 'admin' || report.repoId === null || await deps.db.userCanReadReport(user.id, reportId))
-}
-
 // POST /api/admin/reports/set-repo — attach / detach a stored report's repo
 // + directory link. Mutation: same-origin + CSRF, admin|manage. Body
 // { reportId, repoId, directory }, where repoId is null (detach) or a
@@ -815,18 +810,10 @@ async function handleSetBundleRepo(req: IncomingMessage, res: ServerResponse, de
 // Visible to admin|manage. Read-only, so no CSRF (like /api/admin/users).
 // `maxBytes` lets the page show / pre-check the upload size cap; `repos` feeds
 // the upload repo picker.
-async function handleListReports(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
-  const s = await readManageSession(res, deps, cookie)
-  if (s == null) return
+async function handleListReports(res: ServerResponse, deps: ManagedHttpDeps, session: ManagedSession): Promise<void> {
   sendJson(res, 200, {
-    reports: await Promise.all((await deps.db.listReports(s.user.role === 'admin' ? undefined : s.user.id)).map(async report => {
-      const bundleAllowed = report.bundleId != null && await canAccessBundle(deps, s.user, report.bundleId)
-      return { ...report, canChangeRepo: await canChangeReportRepo(deps, s.user, report.id),
-        bundleId: bundleAllowed ? report.bundleId : null, bundleFilename: bundleAllowed ? report.bundleFilename : null }
-    })),
+    ...await deps.db.getReportCatalog(session.id, Date.now()),
     maxBytes: deps.config.maxReportBytes,
-    repos: selectableRepos(await bundleRepos(deps, s.user)),
-    repoScopes: s.user.role === 'admin' ? null : await deps.db.listRepoScopesForUser(s.user.id),
   })
 }
 
@@ -914,18 +901,22 @@ async function handleUploadReport(req: IncomingMessage, res: ServerResponse, dep
   const id = randomUUID()
   const contentType = (firstHeader(req.headers['content-type']) ?? '').split(';', 1)[0]!.trim() || 'application/json'
   const { bundleId, integrity } = await resolveReportBundle(deps, s.user, bytes)
-  await deps.reportStore.put(id, bytes)
+  const dataKey = await deps.reportStore.put(id, bytes)
   let report: ReportRecord
   try {
     report = await deps.db.insertOrReuseReport({
-      id, filename, contentType, byteSize: bytes.length, sha256,
+      id, filename, contentType, byteSize: bytes.length, sha256, dataKey,
       uploadedBy: s.user.id, uploadedByLogin: s.user.login, repoId: matchedRepo?.repoId ?? null,
       repoDirectory: directory, repoEmbedded, analyzer, visible: false, bundleId, bundleIntegrity: integrity,
     }, Date.now(), s.session.id)
   } catch (err) {
-    // Losing the commit acknowledgement cannot turn primary bytes into garbage.
-    if (!(err instanceof ManagedCommitError)) await deps.reportStore.delete(id).catch(() => {})
-    throw err
+    // A successful COMMIT can lose its acknowledgement. Never delete a file
+    // until a writer-locked read confirms that this candidate did not commit.
+    let committed: ReportRecord | null
+    try { committed = await deps.db.resolveReportUpload(id) }
+    catch (lookup) { throw new AggregateError([err, lookup], 'Report upload reconciliation failed', { cause: lookup }) }
+    if (committed) report = committed
+    else { await deps.reportStore.delete(id).catch(() => {}); throw err }
   }
   if (report.id !== id) await deps.reportStore.delete(id).catch(() => {})
   await sendUploadedReport(req, res, deps, cookie, report, report.id !== id)
@@ -985,15 +976,10 @@ async function canAccessBundle(deps: ManagedHttpDeps, user: StoredUser, id: stri
   return rec.repoId !== null && deps.db.userCanReadRepoPath(user.id, rec.repoId, rec.repoDirectory)
 }
 
-async function canChangeBundleRepo(deps: ManagedHttpDeps, user: StoredUser, repoId: number | null, directory: string) {
-  return roleAtLeast(user.role, 'manage') && (user.role === 'admin' || repoId === null || await deps.db.userCanReadRepoPath(user.id, repoId, directory))
-}
-
 async function bundleRepos(deps: ManagedHttpDeps, user: StoredUser) {
   const repos = await deps.db.listSelectedRepos()
-  if (user.role === 'admin') return repos
-  const allowed = await Promise.all(repos.map(repo => deps.db.userCanReadRepo(user.id, repo.repoId)))
-  return repos.filter((_, index) => allowed[index])
+  const access = await contentAccess(deps.db, user)
+  return repos.filter(access.bundle)
 }
 
 async function repositoryBrowserUser(deps: ManagedHttpDeps, userId: string) {
@@ -1011,6 +997,40 @@ async function handleBrowsableRepositories(res: ServerResponse, deps: ManagedHtt
   sendJson(res, 200, { repos: selectableRepos(await bundleRepos(deps, s.user)) })
 }
 
+type RepositoryReader = Awaited<ReturnType<ReturnType<typeof createRepositoryBrowser>['reader']>>
+type RepositoryContents = Awaited<ReturnType<typeof readRepositoryContents>>
+type RepositoryRefs = Awaited<ReturnType<RepositoryReader['refs']>> & { defaultContents?: RepositoryContents | null }
+
+async function readRepositoryContents(reader: RepositoryReader, ref: string, path: string, virtualEntries: RepositoryEntry[] | null) {
+  const commit = await reader.commit(ref)
+  const contents = virtualEntries ? { entries: virtualEntries, limited: false } : await reader.directory(path, commit)
+  return { ...contents, path, commit }
+}
+
+async function readRepositoryRefs(db: ManagedDb, reader: RepositoryReader, repo: SelectedRepo, withDefault: boolean, virtualEntries: RepositoryEntry[] | null): Promise<RepositoryRefs> {
+  // Wait for both, including failures: a deleted cached branch must not prevent
+  // a successful live default lookup from recovering the initial directory.
+  const [refs, contents] = await Promise.allSettled([
+    reader.refs(),
+    withDefault && repo.cachedDefaultBranch ? readRepositoryContents(reader, `heads/${repo.cachedDefaultBranch}`, '', virtualEntries) : Promise.resolve(null),
+  ])
+  if (refs.status === 'rejected') throw refs.reason
+  const defaultBranch = refs.value.defaultBranch || null
+  const changed = defaultBranch !== repo.cachedDefaultBranch
+  if (changed) await db.cacheRepoDefaultBranch(repo, defaultBranch)
+  if (!withDefault) return refs.value
+  if (!defaultBranch) return { ...refs.value, defaultContents: null }
+  if (changed) return { ...refs.value, defaultContents: await readRepositoryContents(reader, `heads/${defaultBranch}`, '', virtualEntries) }
+  if (contents.status === 'rejected') throw contents.reason
+  return { ...refs.value, defaultContents: contents.value }
+}
+
+function scopeRepositoryContents(contents: RepositoryContents | null, virtualEntries: RepositoryEntry[] | null) {
+  return contents && { ...contents, ...(virtualEntries ? {
+    entries: virtualEntries, limited: false, packageEntryPoints: [], solidityEntryPoints: [], soliditySuggestionsLimited: false,
+  } : {}) }
+}
+
 // Recheck repository/path grants after upstream reads, before returning names.
 async function handleRepositoryBrowser(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams, refs: boolean): Promise<void> {
   const repoId = Number(query.get('repoId'))
@@ -1019,7 +1039,8 @@ async function handleRepositoryBrowser(res: ServerResponse, deps: ManagedHttpDep
   if (!Number.isSafeInteger(repoId) || repoId <= 0 || !normalized.ok || ref.length > 1024 || /\p{Cc}/u.test(ref)) {
     sendJson(res, 400, { error: 'bad-request' }); return
   }
-  const path = normalized.path ?? ''
+  const withDefault = refs && query.get('withDefault') === 'true'
+  const path = refs ? '' : normalized.path ?? ''
   const authorize = async () => {
     const s = await readManageSession(res, deps, cookie)
     if (!s) return null
@@ -1027,7 +1048,7 @@ async function handleRepositoryBrowser(res: ServerResponse, deps: ManagedHttpDep
     if (!repo) { sendJson(res, 404, { error: 'no-repository' }); return null }
     const scopes = s.user.role === 'admin' ? [null] : (await deps.db.listRepoScopesForUser(s.user.id)).filter(scope => scope.repoId === repoId).map(scope => scope.path)
     const virtualEntries = scopedDirectory(path, scopes)
-    if (!refs && virtualEntries?.length === 0) { sendJson(res, 404, { error: 'no-directory' }); return null }
+    if ((!refs || withDefault) && virtualEntries?.length === 0) { sendJson(res, 404, { error: 'no-directory' }); return null }
     return { repo, virtualEntries, user: s.user }
   }
   const access = await authorize()
@@ -1035,16 +1056,19 @@ async function handleRepositoryBrowser(res: ServerResponse, deps: ManagedHttpDep
   try {
     const browser = createRepositoryBrowser(deps.config, await repositoryBrowserUser(deps, access.user.id))
     const reader = await browser.reader(access.repo)
-    const commit = refs ? '' : await reader.commit(ref)
-    const result = refs ? await reader.refs() : access.virtualEntries
-      ? { entries: access.virtualEntries, limited: false } : await reader.directory(path, commit)
+    const revisions = refs ? await readRepositoryRefs(deps.db, reader, access.repo, withDefault, access.virtualEntries) : null
+    const contents = refs ? null : await readRepositoryContents(reader, ref, path, access.virtualEntries)
     await reader.recheckAccess()
     const current = await authorize()
     if (!current) return
-    if (JSON.stringify(current.repo) !== JSON.stringify(access.repo)) { sendJson(res, 409, { error: 'repository-changed' }); return }
-    sendJson(res, 200, refs ? result : {
-      ...result, ...(current.virtualEntries ? { entries: current.virtualEntries, limited: false, packageEntryPoints: [] } : {}), path, commit,
-    })
+    // This request (or another reader) may have refreshed the shared hint. It
+    // does not change repository identity, credentials, or managed grants.
+    if (JSON.stringify({ ...current.repo, cachedDefaultBranch: access.repo.cachedDefaultBranch }) !== JSON.stringify(access.repo)) {
+      sendJson(res, 409, { error: 'repository-changed' }); return
+    }
+    sendJson(res, 200, refs ? { ...revisions, ...(withDefault ? {
+      defaultContents: scopeRepositoryContents(revisions?.defaultContents ?? null, current.virtualEntries),
+    } : {}) } : scopeRepositoryContents(contents, current.virtualEntries))
   } catch (err) {
     if (err instanceof GithubApiError) {
       sendJson(res, err.status === 401 ? 502 : err.status, { error: err.message }, err.retryAfter == null ? {} : { 'retry-after': String(err.retryAfter) })
@@ -1064,19 +1088,18 @@ function prebuildBundle(deps: ManagedHttpDeps, id: string) {
 
 // GET /api/bundles/:id/{metadata,contents}. Source/cache bytes are already encoded;
 // the browser's HTTP stack decompresses them without a Brotli JS dependency.
-async function handleBundleCache(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, id: string, part: BundleCachePart) {
-  const s = await readSession(deps.config, deps.db, cookie, Date.now())
-  if (!s) { sendJson(res, 401, { error: 'unauthenticated' }); return }
-  if (!(await canAccessBundle(deps, s.user, id))) { sendJson(res, 404, { error: 'no-bundle' }); return }
-  const rec = await deps.db.getBundle(id)
+async function handleBundleCache(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, session: ManagedSession, id: string, part: BundleCachePart) {
+  const access = await deps.db.getBundleAccessSnapshot(session.id, Date.now(), id)
+  if (!access) { sendJson(res, 401, { error: 'unauthenticated' }); return }
+  const rec = access.bundle
   if (!rec) { sendJson(res, 404, { error: 'no-bundle' }); return }
   if (!deps.bundleCache) { sendJson(res, 503, { error: 'unavailable' }); return }
   let cached
   try { cached = await deps.bundleCache.open(rec, part) }
   catch { sendJson(res, 422, { error: 'bundle-unavailable' }); return }
   // A cold build can outlast a session or membership change.
-  const current = await readSession(deps.config, deps.db, cookie, Date.now())
-  if (!current || !(await canAccessBundle(deps, current.user, id))) {
+  const current = await deps.db.getBundleAccessSnapshot(session.id, Date.now(), id)
+  if (!current?.bundle) {
     cached.stream.destroy()
     sendJson(res, current ? 404 : 401, { error: current ? 'no-bundle' : 'unauthenticated' })
     return
@@ -1090,42 +1113,44 @@ async function handleBundleCache(req: IncomingMessage, res: ServerResponse, deps
   try { await pipeline(cached.stream, res) } catch { res.destroy() }
 }
 
-// Published npm advisories require security access, independently of access to
+// Published dependency advisories require security access, independently of access to
 // unpublished dependency findings. Managers retain their normal bundle access.
-async function handleBundleAdvisories(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, id: string, teamId: string | null, reason: string) {
+async function handleBundleAdvisories(res: ServerResponse, deps: ManagedHttpDeps, session: ManagedSession, id: string, teamId: string | null, reason: string, repoAdvisories: boolean) {
   const authorize = async () => {
-    const session = await readSession(deps.config, deps.db, cookie, Date.now())
-    if (!session) { sendJson(res, 401, { error: 'unauthenticated' }); return false }
-    if (!(await canAccessBundle(deps, session.user, id))) { sendJson(res, 404, { error: 'no-bundle' }); return false }
-    if (!roleAtLeast(session.user.role, 'manage') && !(await deps.db.userCanReadBundleAdvisories(session.user.id, id, teamId))) {
-      sendJson(res, 403, { error: 'security-access-required' }); return false
+    const access = await deps.db.getBundleAccessSnapshot(session.id, Date.now(), id, teamId)
+    if (!access) { sendJson(res, 401, { error: 'unauthenticated' }); return null }
+    if (!access.bundle) { sendJson(res, 404, { error: 'no-bundle' }); return null }
+    if (!access.canReadAdvisories) {
+      sendJson(res, 403, { error: 'security-access-required' }); return null
     }
-    return true
+    return access.bundle
   }
-  if (!(await authorize())) return
-  const record = await deps.db.getBundle(id)
-  if (!record) { sendJson(res, 404, { error: 'no-bundle' }); return }
+  const record = await authorize()
+  if (!record) return
   if (record.kind !== 'stasis') { sendJson(res, 422, { error: 'unsupported-bundle' }); return }
   if (!deps.bundleCache) { sendJson(res, 503, { error: 'unavailable' }); return }
-  let packages: Record<string, string[]> | null | undefined
-  try { packages = await deps.bundleCache.packageVersions(record, reason) }
+  let inventory: BundleAdvisoryInventory | null | undefined
+  try { inventory = await deps.bundleCache.advisoryInventory(record, reason) }
   catch { sendJson(res, 422, { error: 'bundle-unavailable' }); return }
   if (!(await authorize())) return
-  if (packages === null) { sendJson(res, 413, { error: 'payload-too-large' }); return }
-  if (packages === undefined) { sendJson(res, 400, { error: 'unknown-reason' }); return }
-  const body = Buffer.from(JSON.stringify(packages))
-  if (body.length > MAX_PACKAGE_INVENTORY_BYTES) { sendJson(res, 413, { error: 'payload-too-large' }); return }
+  if (inventory === null) { sendJson(res, 413, { error: 'payload-too-large' }); return }
+  if (inventory === undefined) { sendJson(res, 400, { error: 'unknown-reason' }); return }
+  if (Buffer.byteLength(JSON.stringify(inventory)) > MAX_PACKAGE_INVENTORY_BYTES) { sendJson(res, 413, { error: 'payload-too-large' }); return }
   const controller = new AbortController()
   const onClose = () => { if (!res.writableEnded) controller.abort() }
   res.on('close', onClose)
-  const timer = setTimeout(() => controller.abort(), NPM_ADVISORIES_TIMEOUT_MS)
+  const timer = setTimeout(() => controller.abort(), ADVISORIES_TIMEOUT_MS)
   try {
     if (res.destroyed) return
-    const result = Object.keys(packages).length === 0 ? { status: 200, body: {} }
-      : await fetchNpmAdvisories(body, controller.signal, deps.config.debug)
+    const needsGithub = inventory.packages.some(pkg => repoAdvisories || pkg.ecosystem === 'github' || pkg.ecosystem === 'soldeer')
+    const githubToken = needsGithub ? await ensureUserAccessToken(deps.config, deps.db, session.userId, Date.now(), (url, init) => fetch(url, {
+      ...init, signal: init?.signal ? AbortSignal.any([controller.signal, init.signal]) : controller.signal,
+    })) : null
+    if (res.destroyed || (needsGithub && !(await authorize()))) return
+    const result = await fetchBundleAdvisories(inventory.packages, controller.signal, { debug: deps.config.debug, repoAdvisories, githubToken })
     if (res.destroyed || !(await authorize())) return
     // Return just inventory and public advisories, never source or report data.
-    sendJson(res, result.status, result.status >= 200 && result.status < 300 ? { packages, advisories: result.body } : result.body)
+    sendJson(res, result.status, result.status === 200 ? { ...inventory, advisories: result.body } : result.body)
   } finally {
     clearTimeout(timer)
     res.off('close', onClose)
@@ -1135,29 +1160,87 @@ async function handleBundleAdvisories(res: ServerResponse, deps: ManagedHttpDeps
 // GET /api/admin/bundles — the uploaded bundles for the "Manage bundles" page.
 // admin|manage, read-only (no CSRF). `maxBytes` is the upload cap; `repos` feeds
 // the upload repo picker.
-async function handleListBundles(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
-  let s = await readManageSession(res, deps, cookie)
-  if (s == null) return
-  const summaries = await bundleSummaries(await deps.db.listBundles(s.user.role === 'admin' ? undefined : s.user.id), deps.bundleCache)
+async function handleListBundles(res: ServerResponse, deps: ManagedHttpDeps, session: ManagedSession): Promise<void> {
+  const before = await deps.db.getBundleCatalog(session.id, Date.now())
+  const summaries = await bundleSummaries(before.bundles, deps.bundleCache)
   // Even cached storage reads may outlast changes to access or locations.
-  s = await readManageSession(res, deps, cookie)
-  if (s == null) return
-  const bundles = await deps.db.listBundles(s.user.role === 'admin' ? undefined : s.user.id)
+  const catalog = await deps.db.getBundleCatalog(session.id, Date.now())
   sendJson(res, 200, {
-    bundles: await Promise.all(bundles.map(async bundle => ({
+    ...catalog,
+    bundles: catalog.bundles.map(bundle => ({
       ...bundle, ...(summaries.get(bundle.integrity) ?? { summary: null, summaryRetryAt: null }),
-      canChangeRepo: await canChangeBundleRepo(deps, s.user, bundle.repoId, bundle.repoDirectory),
-    }))),
+    })),
     maxBytes: deps.config.maxBundleBytes,
-    repos: selectableRepos(await bundleRepos(deps, s.user)),
-    repoScopes: s.user.role === 'admin' ? null : await deps.db.listRepoScopesForUser(s.user.id),
   })
-  await backfillBundleSummaries(bundles, deps.bundleCache)
+  await backfillBundleSummaries(catalog.bundles, deps.bundleCache)
+}
+
+type UploadedBundle = Pick<ManagedBundle, 'id' | 'integrity' | 'filename' | 'byteSize' | 'repoId' | 'repoDirectory'>
+async function sendUploadedBundle(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, bundle: UploadedBundle, deduped: boolean): Promise<void> {
+  const s = await manageMutation(req, res, deps, cookie)
+  if (!s) return
+  if (deduped && !(await canAccessBundle(deps, s.user, bundle.id))) { sendJson(res, 409, { error: 'bundle-conflict' }); return }
+  const { id, integrity, filename, byteSize, repoId, repoDirectory } = bundle
+  // Re-uploading also repairs reports uploaded while the bundle was inaccessible.
+  await deps.db.linkReportsToBundle(integrity, id, s.user.role === 'admin' ? undefined : s.user.id)
+  prebuildBundle(deps, id)
+  sendJson(res, deduped ? 200 : 201, { id, integrity, filename, repoId, repoDirectory, ...(deduped ? { deduped: true } : { byteSize }) })
+}
+
+async function handleCreateBundle(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
+  const initial = await manageMutation(req, res, deps, cookie)
+  if (!initial) return
+  const controller = new AbortController()
+  const onClose = () => controller.abort()
+  res.on('close', onClose)
+  try {
+    let body: unknown
+    try { body = await readJsonBody(req, 128 * 1024) } catch { throw new BundleBuildError(400, 'bad-body') }
+    const input = parseBundleBuild(body)
+    const authorize = async (directory: string) => {
+      const session = await manageMutation(req, res, deps, cookie)
+      if (!session) return null
+      const repo = (await bundleRepos(deps, session.user)).find(item => item.repoId === input.repoId)
+      if (!repo) throw new BundleBuildError(404, 'no-repository')
+      const scopes = session.user.role === 'admin' ? [null]
+        : (await deps.db.listRepoScopesForUser(session.user.id)).filter(scope => scope.repoId === input.repoId).map(scope => scope.path)
+      if (scopedDirectory(directory, scopes) !== null) throw new BundleBuildError(403, 'build-scope')
+      return { ...session, repo, scopes }
+    }
+    const access = await authorize(input.directory)
+    if (!access) return
+    await withBundleBuildLease(deps.db, access.user.id, controller.signal, async signal => {
+      const reader = await createRepositoryBrowser(deps.config, await repositoryBrowserUser(deps, access.user.id)).reader(access.repo)
+      signal.throwIfAborted()
+      const built = await buildRepositoryBundle(access.user.id, {
+        input, github: access.repo.fullName, token: reader.readToken(), maxBytes: deps.config.maxBundleBytes, scopes: access.scopes,
+      }, signal)
+      signal.throwIfAborted()
+      await reader.recheckAccess()
+      const current = await authorize(built.directory)
+      if (!current) return
+      if (JSON.stringify({ ...current.repo, cachedDefaultBranch: access.repo.cachedDefaultBranch }) !== JSON.stringify(access.repo)) {
+        throw new BundleBuildError(409, 'repository-changed')
+      }
+      signal.throwIfAborted()
+      await storeUploadedBundle(req, res, deps, cookie, current, Buffer.from(built.bytes), input.repoId, built.directory, built.filename)
+    })
+  } catch (error) {
+    if (res.destroyed || controller.signal.aborted) return
+    if (error instanceof BundleBuildError) { sendJson(res, error.status, { error: error.code }); return }
+    if (error instanceof GithubApiError) {
+      sendJson(res, error.status === 401 ? 502 : error.status, { error: error.message }, error.retryAfter == null ? {} : { 'retry-after': String(error.retryAfter) })
+      return
+    }
+    throw error
+  } finally { res.off('close', onClose) }
 }
 
 // POST /api/admin/bundles — upload a bundle. Mutation: same-origin + CSRF,
 // admin|manage. Raw bytes; X-Bundle-Filename names it, optional X-Repo-Id and
-// X-Repo-Directory assign a repository location. The bundle's identity is its content hash (sha512), UNIQUE — a
+// X-Repo-Directory assign a repository location; Stasis repo headers default
+// to a matching connected repository within the uploader's access, otherwise
+// the bundle stays unattached. Its identity is its content hash (sha512), UNIQUE — a
 // re-upload of identical bytes dedupes to the existing row (no second copy).
 // After storing, any reports that declared this integrity but weren't linked yet
 // get attached (auto-link). 413 over the cap, 400 on empty.
@@ -1179,76 +1262,87 @@ async function handleUploadBundle(req: IncomingMessage, res: ServerResponse, dep
   if (bytes.length === 0) { sendJson(res, 400, { error: 'empty' }); return }
   const repo = await resolveUploadRepoId(req, res, deps)
   if (!repo.ok) return
-  let rawDirectory
+  const filename = sanitizeFilename(firstHeader(req.headers['x-bundle-filename']), 'bundle')
+  const kind = bundleKind(filename)
+  // Explicit locations override embedded defaults. Reuploads keep their
+  // stored location, so only new bundles need their origin header decoded.
+  const integrity = bundleIntegrity(bytes)
+  const existing = await deps.db.getBundleByIntegrity(integrity)
+  let inferredLocation = false
+  let rawDirectory: unknown
   try { rawDirectory = decodeURIComponent(firstHeader(req.headers['x-repo-directory']) ?? '') }
   catch { sendJson(res, 400, { error: 'bad-directory' }); return }
+  if (!existing && repo.repoId == null && kind === 'stasis') {
+    const embedded = await bundleRepo(bytes)
+    const github = reportRepoGithub({ repo: embedded })
+    const selected = github == null ? null : (await deps.db.listSelectedRepos())
+      .find(candidate => candidate.fullName.toLowerCase() === github.toLowerCase())
+    if (selected) {
+      repo.repoId = selected.repoId
+      if (req.headers['x-repo-directory'] == null) {
+        rawDirectory = embedded?.directory ?? ''
+        inferredLocation = true
+      }
+    }
+    s = await checkMutation(req, res, deps, cookie)
+    if (!s || !requireManageRole(res, s.user)) return
+  }
   const normalized = normalizeTeamPath(rawDirectory)
   if (!normalized.ok) { sendJson(res, 400, { error: 'bad-directory' }); return }
-  const directory = repo.repoId == null ? '' : normalized.path ?? ''
+  let directory = repo.repoId == null ? '' : normalized.path ?? ''
   if (repo.repoId !== null && s.user.role !== 'admin' && !(await deps.db.userCanReadRepoPath(s.user.id, repo.repoId, directory))) {
-    sendJson(res, 403, { error: 'forbidden' }); return
+    if (!inferredLocation) { sendJson(res, 403, { error: 'forbidden' }); return }
+    // A bundle's own stamp is a default, not a required destination. Retain
+    // it in the archive while letting the uploader assign an allowed location.
+    repo.repoId = null
+    directory = ''
   }
-  const integrity = bundleIntegrity(bytes)
-  const filename = sanitizeFilename(firstHeader(req.headers['x-bundle-filename']), 'bundle')
+  await storeUploadedBundle(req, res, deps, cookie, s, bytes, repo.repoId, directory, filename, integrity)
+}
+
+async function storeUploadedBundle(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined,
+  s: { session: ManagedSession; user: StoredUser }, bytes: Buffer, repoId: number | null, directory: string, filename: string, integrity = bundleIntegrity(bytes)): Promise<void> {
   const existing = await deps.db.getBundleByIntegrity(integrity)
-  if (existing != null) {
-    s = await manageMutation(req, res, deps, cookie)
-    if (!s) return
-    if (!(await canAccessBundle(deps, s.user, existing.id))) { sendJson(res, 409, { error: 'bundle-conflict' }); return }
-    // Reports uploaded while this bundle was inaccessible retain only its
-    // integrity. An authorized re-upload repairs those pending links too.
-    await deps.db.linkReportsToBundle(integrity, existing.id, s.user.role === 'admin' ? undefined : s.user.id)
-    prebuildBundle(deps, existing.id)
-    sendJson(res, 200, { id: existing.id, integrity, filename: existing.filename, repoId: existing.repoId, repoDirectory: existing.repoDirectory, deduped: true })
-    return
-  }
+  if (existing) { await sendUploadedBundle(req, res, deps, cookie, existing, true); return }
   const id = randomUUID()
   const kind = bundleKind(filename)
-  await deps.bundleStore.put(id, bytes, kind)
+  const dataKey = await deps.bundleStore.put(id, bytes, kind)
   try {
     await deps.db.insertBundle({
-      id, integrity, filename, kind,
-      byteSize: bytes.length, uploadedBy: s.user.id, uploadedByLogin: s.user.login, repoId: repo.repoId, repoDirectory: directory,
+      id, integrity, filename, kind, dataKey,
+      byteSize: bytes.length, uploadedBy: s.user.id, uploadedByLogin: s.user.login, repoId, repoDirectory: directory,
     }, Date.now(), s.session.id)
   } catch (err) {
-    // A committed row may already point here even though insertion rejected.
-    if (!(err instanceof ManagedCommitError)) await deps.bundleStore.delete(id).catch(() => {})
-    if (err instanceof ManagedMutationError) throw err
     // A concurrent upload of identical bytes can insert this integrity (UNIQUE)
     // between our dedup check and this insert — treat that as a dedup, not a 500.
     // Any other failure rethrows.
-    const raced = await deps.db.getBundleByIntegrity(integrity)
-    if (raced != null) {
-      s = await manageMutation(req, res, deps, cookie)
-      if (!s) return
-      if (!(await canAccessBundle(deps, s.user, raced.id))) { sendJson(res, 409, { error: 'bundle-conflict' }); return }
-      await deps.db.linkReportsToBundle(integrity, raced.id, s.user.role === 'admin' ? undefined : s.user.id)
-      prebuildBundle(deps, raced.id)
-      sendJson(res, 200, { id: raced.id, integrity, filename: raced.filename, repoId: raced.repoId, repoDirectory: raced.repoDirectory, deduped: true }); return }
-    throw err
+    let raced: ManagedBundle | null
+    try { raced = await deps.db.resolveBundleUpload(integrity) }
+    catch (lookup) { throw new AggregateError([err, lookup], 'Bundle upload reconciliation failed', { cause: lookup }) }
+    // Preserve a committed candidate after a lost acknowledgement. If this
+    // read fails too, leave the bytes for later reconciliation.
+    if (raced?.id !== id) await deps.bundleStore.delete(id).catch(() => {})
+    if (err instanceof ManagedMutationError) throw err
+    if (!raced) throw err
+    if (raced.id !== id) { await sendUploadedBundle(req, res, deps, cookie, raced, true); return }
+    // Our insert committed: continue with the ordinary creation response.
   }
-  // Auto-link reports that declared this integrity before the bundle existed.
-  s = await manageMutation(req, res, deps, cookie)
-  if (!s) return
-  await deps.db.linkReportsToBundle(integrity, id, s.user.role === 'admin' ? undefined : s.user.id)
-  prebuildBundle(deps, id)
-  sendJson(res, 201, { id, integrity, filename, byteSize: bytes.length, repoId: repo.repoId, repoDirectory: directory })
+  await sendUploadedBundle(req, res, deps, cookie, { id, integrity, filename, byteSize: bytes.length, repoId, repoDirectory: directory }, false)
 }
 
 // GET /api/admin/bundles/<id> — download a stored bundle (admin|manage). Bytes
 // are opaque archives, so served as application/octet-stream. Sourcemaps use
 // HTTP Brotli decoding to restore the uploaded .map bytes. 404 no such
 // bundle; 503 row-without-bytes (store desync).
-async function handleGetBundle(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, id: string): Promise<void> {
-  const s = await readSession(deps.config, deps.db, cookie, Date.now())
-  if (s == null) { sendJson(res, 401, { error: 'unauthenticated' }); return }
-  if (!(await canAccessBundle(deps, s.user, id))) { sendJson(res, 404, { error: 'no-bundle' }); return }
-  const rec = await deps.db.getBundle(id)
+async function handleGetBundle(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, session: ManagedSession, id: string): Promise<void> {
+  const access = await deps.db.getBundleAccessSnapshot(session.id, Date.now(), id)
+  if (!access) { sendJson(res, 401, { error: 'unauthenticated' }); return }
+  const rec = access.bundle
   if (rec == null) { sendJson(res, 404, { error: 'no-bundle' }); return }
   const stored = await deps.bundleStore.open(id, rec.kind)
   if (stored == null) { sendJson(res, 503, { error: 'unavailable' }); return }
-  const current = await readSession(deps.config, deps.db, cookie, Date.now())
-  if (!current || !(await canAccessBundle(deps, current.user, id))) {
+  const current = await deps.db.getBundleAccessSnapshot(session.id, Date.now(), id)
+  if (!current?.bundle) {
     stored.stream.destroy()
     sendJson(res, current ? 404 : 401, { error: 'no-bundle' }); return
   }
@@ -1302,17 +1396,22 @@ async function adminMutation(req: IncomingMessage, res: ServerResponse, deps: Ma
 // GET /api/teams — the CURRENT user's teams, each with the reports and bundles
 // attached to the team's repos, for the sidebar's per-user Teams section. Any approved
 // user (not just admin|manage); a user only ever sees their own teams.
-async function handleMyTeams(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
-  let s = await readSession(deps.config, deps.db, cookie, Date.now())
-  if (s == null) { sendJson(res, 401, { error: 'unauthenticated' }); return }
-  const summaries = await bundleSummaries(s.user.role === 'none' ? [] : (await deps.db.listTeamsForUser(s.user.id)).flatMap(team => team.bundles), deps.bundleCache)
-  s = await readSession(deps.config, deps.db, cookie, Date.now())
-  if (s == null) { sendJson(res, 401, { error: 'unauthenticated' }); return }
-  const teams = s.user.role === 'none' ? [] : await deps.db.listTeamsForUser(s.user.id)
+async function handleMyTeams(res: ServerResponse, deps: ManagedHttpDeps, session: ManagedSession): Promise<void> {
+  let snapshot = await deps.db.getUserTeamFeedSnapshot(session.id, Date.now())
+  if (!snapshot) { sendJson(res, 401, { error: 'unauthenticated' }); return }
+  const summaries = await bundleSummaries(snapshot.teams.flatMap(team => team.bundles), deps.bundleCache)
+  const current = await deps.db.getFeedState(session.id, Date.now())
+  if (!current) { sendJson(res, 401, { error: 'unauthenticated' }); return }
+  // Keep the post-storage authorization fence, but reload the catalog only
+  // when a concurrent mutation actually invalidated its consistent snapshot.
+  if (current.user.id !== snapshot.user.id || current.user.role !== snapshot.user.role || current.catalog !== snapshot.catalog) {
+    snapshot = await deps.db.getUserTeamFeedSnapshot(session.id, Date.now())
+    if (!snapshot) { sendJson(res, 401, { error: 'unauthenticated' }); return }
+  }
+  const { teams, revision } = snapshot
   sendJson(res, 200, {
     teams: teams.map(team => ({ ...team, bundles: team.bundles.map(bundle => ({ ...bundle, ...(summaries.get(bundle.integrity) ?? { summary: null, summaryRetryAt: null }) })) })),
-    // Derivatives do not change the catalog revision used by the live feed.
-    revision: teamCatalogRevision(teams),
+    revision,
   })
   await backfillBundleSummaries(teams.flatMap(team => team.bundles), deps.bundleCache)
 }
@@ -1500,17 +1599,12 @@ async function handleQueryReports(req: IncomingMessage, res: ServerResponse, dep
 
 // The server selects the complete workspace; clients cannot omit a report
 // or links file to evade classification through the rest of their team.
-async function handleTeamReports(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, teamId: string): Promise<void> {
-  const s = await readSession(deps.config, deps.db, cookie, Date.now())
-  if (!s) { sendJson(res, 401, { error: 'unauthenticated' }); return }
-  const snapshot = await teamSnapshot(deps.db, s.session.id, teamId)
-  const reports = await loadTeamReports(deps.db, deps.reportStore, snapshot)
-  await recheckTeam(deps.db, s.session.id, snapshot)
-  const parts = [Buffer.from('{"reports":[')]
-  for (const [index, report] of reports.entries()) parts.push(Buffer.from(`${index ? ',' : ''}${JSON.stringify(report)}`))
-  parts.push(Buffer.from(']}'))
+async function handleTeamReports(res: ServerResponse, deps: ManagedHttpDeps, session: ManagedSession, teamId: string): Promise<void> {
+  const snapshot = await teamSnapshot(deps.db, session.id, teamId)
+  const body = await loadTeamReportsResponse(deps.db, deps.reportStore, snapshot)
+  await recheckTeam(deps.db, session.id, snapshot)
   res.writeHead(200, { 'content-type': 'application/json', 'cache-control': 'no-store', 'x-content-type-options': 'nosniff' })
-  writeResponse(res, Buffer.concat(parts))
+  writeResponse(res, body)
 }
 
 // Triage requires both a writing role and access to the report itself.
@@ -2013,7 +2107,8 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
     // every managed data route before reading bodies or looking up resources.
     const managedDataPath = ['/api/admin', '/api/reports', '/api/bundles', '/api/teams', '/api/avatar', '/api/github']
       .some(prefix => path === prefix || path.startsWith(prefix + '/'))
-    if (managedDataPath && await readWorkspaceSession(res, deps, cookie) == null) return
+    const workspaceSession = managedDataPath ? await readWorkspaceSession(res, deps, cookie) : null
+    if (managedDataPath && !workspaceSession) return
     const issueRoute = /^\/api\/teams\/([^/]+)\/issues$/u.exec(path)
     if (issueRoute) {
       await handleWorkspaceIssue(req, res, deps, cookie, decodeURIComponent(issueRoute[1]!), url.searchParams); return
@@ -2083,7 +2178,7 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
     // Reports: list / upload on the exact path, download / delete per-id on the
     // prefix. Method-dispatched here since each path carries two verbs.
     if (path === ADMIN_REPORTS_PATH) {
-      if (method === 'GET') { await handleListReports(res, deps, cookie); return }
+      if (method === 'GET') { await handleListReports(res, deps, workspaceSession!.session); return }
       if (method === 'POST') { await handleUploadReport(req, res, deps, cookie); return }
       send405(res, 'GET, POST'); return
     }
@@ -2117,19 +2212,23 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
     const bundleAdvisories = /^\/api\/bundles\/([a-f\d-]{36})\/advisories$/iu.exec(path)
     if (bundleAdvisories) {
       if (method !== 'GET') { send405(res, 'GET'); return }
-      await handleBundleAdvisories(res, deps, cookie, bundleAdvisories[1]!, url.searchParams.get('team'), url.searchParams.get('reason') ?? '')
+      await handleBundleAdvisories(res, deps, workspaceSession!.session, bundleAdvisories[1]!, url.searchParams.get('team'), url.searchParams.get('reason') ?? '', url.searchParams.get('repoAdvisories') === 'true')
       return
     }
     const bundleRead = /^\/api\/bundles\/([a-f\d-]{36})\/(metadata|contents|download)$/iu.exec(path)
     if (bundleRead) {
       if (method !== 'GET' && method !== 'HEAD') { send405(res, 'GET, HEAD'); return }
       const id = bundleRead[1]!
-      if (bundleRead[2] === 'download') await handleGetBundle(req, res, deps, cookie, id)
-      else await handleBundleCache(req, res, deps, cookie, id, bundleRead[2] as BundleCachePart)
+      if (bundleRead[2] === 'download') await handleGetBundle(req, res, deps, workspaceSession!.session, id)
+      else await handleBundleCache(req, res, deps, workspaceSession!.session, id, bundleRead[2] as BundleCachePart)
       return
     }
+    if (path === BUNDLE_CREATE_PATH) {
+      if (method !== 'POST') { send405(res, 'POST'); return }
+      await handleCreateBundle(req, res, deps, cookie); return
+    }
     if (path === ADMIN_BUNDLES_PATH) {
-      if (method === 'GET') { await handleListBundles(res, deps, cookie); return }
+      if (method === 'GET') { await handleListBundles(res, deps, workspaceSession!.session); return }
       if (method === 'POST') { await handleUploadBundle(req, res, deps, cookie); return }
       send405(res, 'GET, POST'); return
     }
@@ -2139,7 +2238,7 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
     }
     if (path.startsWith(BUNDLE_PREFIX)) {
       const id = path.slice(BUNDLE_PREFIX.length)
-      if (method === 'GET') { await handleGetBundle(req, res, deps, cookie, id); return }
+      if (method === 'GET') { await handleGetBundle(req, res, deps, workspaceSession!.session, id); return }
       if (method === 'DELETE') { await handleDeleteBundle(req, res, deps, cookie, id); return }
       send405(res, 'GET, DELETE'); return
     }
@@ -2157,10 +2256,18 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
       if (method !== 'GET') { send405(res, 'GET'); return }
       await handleWorkspaceFixes(res, deps, cookie, teamFixes[1]!); return
     }
+    const teamAnnotations = /^\/api\/teams\/([^/]+)\/annotations$/u.exec(path)
+    if (teamAnnotations) {
+      if (method !== 'GET') { send405(res, 'GET'); return }
+      const snapshot = await teamSnapshot(db, workspaceSession!.session.id, teamAnnotations[1]!)
+      const annotations = await loadTeamAnnotations(db, deps.reportStore, snapshot, url.searchParams.get('reportId'))
+      await recheckTeam(db, workspaceSession!.session.id, snapshot)
+      sendJson(res, 200, annotations); return
+    }
     const teamReports = /^\/api\/teams\/([^/]+)\/reports$/u.exec(path)
     if (teamReports) {
       if (method !== 'GET') { send405(res, 'GET'); return }
-      await handleTeamReports(res, deps, cookie, teamReports[1]!); return
+      await handleTeamReports(res, deps, workspaceSession!.session, teamReports[1]!); return
     }
     if (path === '/api/reports/query') {
       if (method !== 'POST') { send405(res, 'POST'); return }
@@ -2198,7 +2305,7 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
     // The signed-in user's own team memberships (any approved user).
     if (path === MY_TEAMS_PATH) {
       if (method !== 'GET') { send405(res, 'GET'); return }
-      await handleMyTeams(res, deps, cookie); return
+      await handleMyTeams(res, deps, workspaceSession!.session); return
     }
     // Teams: list / create on the exact path; the link mutations are POST-only
     // action sub-paths (each carries its ids in the JSON body).
@@ -2225,7 +2332,11 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
 
   return (req, res) => {
     if (isShuttingDown()) { sendJson(res, 503, { error: 'shutting-down' }, { connection: 'close' }); return }
-    const work = route(req, res).catch((err) => {
+    if (!deps.originGate.isOriginAllowed(req)) { sendJson(res, 403, { error: 'origin-denied' }); return }
+    // Feeds lease a connection per poll, never across streaming sleeps. This
+    // also covers capability-authenticated feeds handled by public-workspace.
+    const feed = /^\/api\/teams(?:\/[^/?]+)?\/feed(?:\?|$)/u.test(req.url ?? '')
+    const work = (db.withRequest && !feed ? db.withRequest(() => route(req, res)) : route(req, res)).catch((err) => {
       if ((err instanceof TeamReportsError || err instanceof IssueError || err instanceof OAuthError || err instanceof ManagedMutationError) && !res.headersSent) { sendJson(res, err.status, { error: err.message }); return }
       console.warn('managed: request handler error:', err)
       if (res.headersSent) { try { res.destroy() } catch {} }