@preventive/triage 1.0.0-alpha.3 → 1.0.0-alpha.30

package/server-managed/repository-browser.ts

@@ -0,0 +1,139 @@
+import type { ManagedConfig } from './config.ts'
+import type { SelectedRepo } from './db.ts'
+import { GithubApiError, githubJson, githubRepoReadPermission, githubUserIdentity, repoAccessToken } from './github-app.ts'
+import { MAX_PACKAGE_BYTES, readPackageEntryPoints } from './package-entry-points.ts'
+import { readSolidityEntryPoints } from './solidity-entry-points.ts'
+
+export interface RepositoryEntry { name: string; path: string; type: 'dir' | 'file' | 'symlink' | 'submodule' }
+
+// Restricted managers can walk the ancestors of their grants, without seeing
+// sibling names or files outside those grants. null means the entire repo.
+export function scopedDirectory(path: string, scopes: (string | null)[]): RepositoryEntry[] | null {
+  if (scopes.some(scope => !scope || path === scope || path.startsWith(scope + '/'))) return null
+  const prefix = path ? path + '/' : ''
+  const names = new Set(scopes.filter((scope): scope is string => !!scope && scope.startsWith(prefix)).map(scope => scope.slice(prefix.length).split('/')[0]!))
+  return [...names].toSorted().map(name => ({ name, path: prefix + name, type: 'dir' }))
+}
+
+export interface RepositoryBrowserUser { githubUserId: number | null; token: string | null }
+type GithubIdentity = Awaited<ReturnType<typeof githubUserIdentity>>
+
+function credentialFailure(err: unknown): err is GithubApiError {
+  return err instanceof GithubApiError && ([401, 404].includes(err.status) || err.message === 'github-status-403')
+}
+
+// Create once per HTTP request. Coalesce concurrent credential lookups without
+// caching repository visibility or permissions, or sharing credentials across users.
+export function createRepositoryBrowser(config: ManagedConfig, user: RepositoryBrowserUser, fetchImpl: typeof fetch = globalThis.fetch) {
+  const tokens = new Map<number, Promise<string | null>>()
+  let identity: Promise<GithubIdentity> | undefined
+  const getIdentity = (fresh = false): Promise<GithubIdentity> => {
+    if (!user.token || user.githubUserId == null) return Promise.reject(new GithubApiError(404, 'no-repository'))
+    if (!identity || fresh) {
+      identity = githubUserIdentity(user.token, fetchImpl).then(value => {
+        if (value.id !== user.githubUserId) throw new GithubApiError(404, 'no-repository')
+        return value
+      })
+    }
+    return identity
+  }
+  return {
+    reader(repo: SelectedRepo) {
+      const installationToken = () => {
+        if (repo.installationId == null) return Promise.resolve(null)
+        const cached = tokens.get(repo.installationId)
+        const token = cached ?? repoAccessToken(config, repo.installationId, fetchImpl).catch((err: unknown) => {
+          if (!credentialFailure(err)) throw err
+          // Stale installations cannot prevent verified public access.
+          return null
+        })
+        if (!cached) tokens.set(repo.installationId, token)
+        return token
+      }
+      return repositoryReader(repo, user.token, installationToken, getIdentity, fetchImpl)
+    },
+  }
+}
+
+async function repositoryReader(repo: SelectedRepo, userToken: string | null, installationToken: () => Promise<string | null>, getIdentity: (fresh?: boolean) => Promise<GithubIdentity>, fetchImpl: typeof fetch) {
+  const base = `https://api.github.com/repos/${repo.fullName.split('/').map(encodeURIComponent).join('/')}`
+  // Public reads can use the signed-in user's quota without repository grants.
+  // Nonpublic reads still require the repository App and the effective-user gate.
+  let token = userToken ?? await installationToken()
+  const read = (suffix: string) => githubJson(base + suffix, token, fetchImpl)
+  const metadata = async () => {
+    try { return await read('') }
+    catch (err) {
+      if (!token || !credentialFailure(err)) throw err
+      const fallback = await installationToken()
+      if (fallback && fallback !== token) {
+        token = fallback
+        try { return await read('') } catch (fallbackError) { if (!credentialFailure(fallbackError)) throw fallbackError }
+      }
+      // Anonymous fallback is only for unavailable credentials, never rate
+      // limits, network errors, or GitHub outages.
+      token = null
+      return read('')
+    }
+  }
+  const checkAccess = async (freshIdentity = false) => {
+    // Stored visibility can be stale (or internal with private=false). Require
+    // current, explicit public visibility or the caller's effective permission.
+    const data = await metadata() as { id?: unknown; full_name?: unknown; private?: unknown; visibility?: unknown; default_branch?: unknown }
+    if (data?.id !== repo.repoId || typeof data.full_name !== 'string' || data.full_name.toLowerCase() !== repo.fullName.toLowerCase()) {
+      throw new GithubApiError(404, 'no-repository')
+    }
+    if (data.private === false && data.visibility === 'public') return data
+    if (!token) throw new GithubApiError(404, 'no-repository')
+    const appToken = await installationToken()
+    if (!appToken) throw new GithubApiError(404, 'no-repository')
+    if (!(await githubRepoReadPermission(repo.fullName, appToken, await getIdentity(freshIdentity), fetchImpl))) {
+      throw new GithubApiError(404, 'no-repository')
+    }
+    token = appToken
+    return data
+  }
+  const current = await checkAccess()
+  const defaultBranch = typeof current.default_branch === 'string' ? current.default_branch : ''
+  return {
+    recheckAccess: () => checkAccess(true),
+    // Server-only credential, selected by the same live visibility/permission
+    // gate as directory browsing. Never included in an HTTP response.
+    readToken: () => token,
+    async refs() {
+      // Suggestions are bounded; the input also accepts any branch or tag name.
+      const results = await Promise.all(['branches', 'tags'].map(async kind => {
+        const data = await read(`/${kind}?per_page=100`)
+        if (!Array.isArray(data)) throw new GithubApiError(502, 'github-malformed')
+        return data.flatMap(item => typeof item?.name === 'string' ? [item.name] : [])
+      }))
+      return { defaultBranch, branches: results[0], tags: results[1] }
+    },
+    async commit(ref: string) {
+      if (/^[a-f\d]{40}$/iu.test(ref)) return ref
+      const data = await read(`/commits/${encodeURIComponent(ref || (defaultBranch ? `heads/${defaultBranch}` : 'HEAD'))}`) as { sha?: unknown }
+      if (typeof data?.sha !== 'string' || !/^[a-f\d]{40}$/iu.test(data.sha)) throw new GithubApiError(502, 'github-malformed')
+      return data.sha
+    },
+    async directory(path: string, commit: string) {
+      const data = await read(`/contents/${path.split('/').map(encodeURIComponent).join('/')}?ref=${encodeURIComponent(commit)}`)
+      if (!Array.isArray(data)) throw new GithubApiError(400, 'not-a-directory')
+      const entries: RepositoryEntry[] = []
+      for (const item of data) {
+        if (typeof item?.name !== 'string' || item.name.includes('/') || item.name === '.' || item.name === '..') continue
+        const expectedPath = path ? `${path}/${item.name}` : item.name
+        if (item.path !== expectedPath) continue
+        const type = item.submodule_git_url ? 'submodule' : item.type
+        if (['dir', 'file', 'symlink', 'submodule'].includes(type)) entries.push({ name: item.name, path: expectedPath, type })
+      }
+      const manifestPath = path ? `${path}/package.json` : 'package.json'
+      const manifest = data.find(item => item?.path === manifestPath && item.name === 'package.json' && item.type === 'file' && !item.submodule_git_url
+        && typeof item.size === 'number' && item.size >= 0 && item.size <= MAX_PACKAGE_BYTES && typeof item.sha === 'string' && /^[a-f\d]{40}$/iu.test(item.sha))
+      const packageEntryPoints = manifest ? await readPackageEntryPoints(manifest.sha, path, read) : undefined
+      const solidity = await readSolidityEntryPoints(path, data, read)
+      return { entries, limited: data.length >= 1000, ...(packageEntryPoints ? { packageEntryPoints } : {}),
+        ...(solidity.paths.length > 0 || solidity.limited ? { solidityEntryPoints: solidity.paths, soliditySuggestionsLimited: solidity.limited } : {}),
+      }
+    },
+  }
+}

package/server-managed/repository-discovery.ts

@@ -0,0 +1,82 @@
+import { createHash } from 'node:crypto'
+import type { ManagedConfig } from './config.ts'
+import { GithubApiError, filterInstalledRepos, listInstalledRepos, listUserRepos } from './github-app.ts'
+import type { ConnectedRepo, RepoListing } from './github-app.ts'
+
+const CACHE_MS = 60_000
+const MAX_ENTRIES = 100
+interface Entry {
+  expires: number
+  pending: boolean
+  value: Promise<ConnectedRepo[]>
+}
+
+// One directory per HTTP handler. Searches/pages reuse discovery, but selected
+// flags still come from the database on every request. User results are scoped
+// to both the managed identity and its current GitHub credential. This cache is
+// only for discovery; connecting a repo still verifies fresh installation access.
+export class RepositoryDiscovery {
+  private readonly cache = new Map<string, Entry>()
+  private readonly config: ManagedConfig
+  private readonly fetchImpl: typeof fetch
+  private readonly now: () => number
+
+  constructor(config: ManagedConfig, fetchImpl: typeof fetch = (...args) => globalThis.fetch(...args), now: () => number = Date.now) {
+    this.config = config
+    this.fetchImpl = fetchImpl
+    this.now = now
+  }
+
+  private read(key: string, load: () => Promise<ConnectedRepo[]>): Promise<ConnectedRepo[]> {
+    const cached = this.cache.get(key)
+    if (cached && (cached.pending || cached.expires > this.now())) return cached.value
+    this.cache.delete(key)
+    while (this.cache.size >= MAX_ENTRIES) this.cache.delete(this.cache.keys().next().value!)
+    const entry: Entry = { expires: 0, pending: true, value: Promise.resolve([]) }
+    entry.value = load().then(repos => {
+      entry.expires = this.now() + CACHE_MS
+      entry.pending = false
+      return repos
+    }, (err: unknown) => {
+      if (this.cache.get(key) === entry) this.cache.delete(key)
+      throw err
+    })
+    this.cache.set(key, entry)
+    return entry.value
+  }
+
+  async list(scope: 'installed' | 'public', userId: string, token: string | null, showAll = false, refresh = false): Promise<RepoListing> {
+    // Invalidate derived user results along with the installation catalogue.
+    // An older in-flight read cannot repopulate this map after refresh.
+    if (refresh) this.cache.clear()
+    const installed = () => this.read('installed', () => listInstalledRepos(this.config, this.fetchImpl))
+    if (scope === 'installed' && showAll) return { repositories: await installed(), tokenMissing: false }
+    const publicInstalled = async (): Promise<ConnectedRepo[]> => (await installed()).filter(repo => repo.visibility === 'public')
+    if (token == null) return { repositories: scope === 'installed' ? await publicInstalled() : [], tokenMissing: true }
+    const credential = createHash('sha256').update(token).digest('hex')
+    const key = JSON.stringify([scope, userId, credential])
+    try {
+      if (scope === 'installed') {
+        const repositories = await this.read(key, async () => filterInstalledRepos(this.config, await installed(), token, this.fetchImpl))
+        return { repositories, tokenMissing: false }
+      }
+      // Installations only deduplicate the public picker. Their failure must
+      // not block otherwise readable public repos or look like a stale login.
+      // Cache the two sources separately so failed installation discovery is
+      // retried without caching a degraded combined list for another minute.
+      const [userRepos, installedRepos] = await Promise.all([
+        this.read(key, () => listUserRepos(token)),
+        installed().catch((err: unknown) => {
+          console.warn('managed: installed repo deduplication failed:', err)
+          return []
+        }),
+      ])
+      const installedIds = new Set(installedRepos.map(repo => repo.id))
+      const repositories = userRepos.filter(repo => repo.visibility === 'public' && !installedIds.has(repo.id))
+      return { repositories, tokenMissing: false }
+    } catch (err) {
+      if (!(err instanceof GithubApiError) || err.status !== 401) throw err
+      return { repositories: scope === 'installed' ? await publicInstalled() : [], tokenMissing: true }
+    }
+  }
+}

package/server-managed/repository-policy.ts

@@ -0,0 +1,27 @@
+import type { StoredUser } from './db.ts'
+
+const WHITEHAT = [
+  291301, // ChALkeR
+  259122746, // exo-nikita
+  247161625, // ex0sec
+]
+const whitehatIds = new Set(WHITEHAT)
+
+// (1) Server permission to add repositories. Keep this independent of GitHub
+// identity and ecosystem exceptions if other install modes broaden it later.
+export function canAddRepositories(user: StoredUser): boolean {
+  return user.role === 'admin'
+}
+
+// (3b) Only the ecosystem safeguard for public repositories is bypassed by
+// WHITEHAT. Callers must separately establish (0) server readability, (1) add
+// permission, and (2) server admin or GitHub access to this repository.
+export function passesPublicRepositorySafeguard(githubUserId: number | null, involved: boolean): boolean {
+  return involved || (githubUserId != null && whitehatIds.has(githubUserId))
+}
+
+// Arbitrary public repositories have no involvement evidence, so (2) requires
+// admin even if (1) expands in the future. This capability is also the UI gate.
+export function canAddAnyPublicRepository(user: StoredUser, githubUserId: number | null): boolean {
+  return canAddRepositories(user) && user.role === 'admin' && passesPublicRepositorySafeguard(githubUserId, false)
+}

package/server-managed/revisions.ts

@@ -0,0 +1,35 @@
+// Internal invalidation counters. Never expose these global values to clients:
+// feeds still publish only the existing user/visibility-scoped revisions.
+const catalogTables = ['managed_team', 'managed_team_user', 'managed_team_repo', 'managed_report', 'managed_bundle', 'managed_selected_repo']
+const annotationTables = ['managed_finding_triage', 'managed_finding_triage_event', 'managed_finding_comment']
+export function revisionSchema(postgres = false): string {
+  let sql = `CREATE TABLE IF NOT EXISTS managed_maintenance_lease (
+    id INTEGER PRIMARY KEY, owner TEXT NOT NULL, expires_at INTEGER NOT NULL
+  ); CREATE TABLE IF NOT EXISTS managed_change_revision (
+    id INTEGER PRIMARY KEY, catalog INTEGER NOT NULL, annotations INTEGER NOT NULL
+  ); INSERT INTO managed_change_revision VALUES (1, 0, 0) ON CONFLICT(id) DO NOTHING;`
+  for (const [column, tables] of [['catalog', catalogTables], ['annotations', annotationTables]] as const) {
+    const update = `UPDATE managed_change_revision SET ${column} = ${column} + 1 WHERE id = 1;`
+    if (postgres) {
+      sql += `CREATE OR REPLACE FUNCTION managed_${column}_changed() RETURNS trigger LANGUAGE plpgsql AS $$
+        BEGIN IF EXISTS (SELECT 1 FROM managed_revision_rows) THEN ${update} END IF; RETURN NULL; END $$;`
+    }
+    for (const table of tables) {
+      if (postgres) {
+        sql += `DROP TRIGGER IF EXISTS ${table}_revision ON ${table};`
+        for (const event of ['INSERT', 'UPDATE', 'DELETE']) {
+          sql += `DROP TRIGGER IF EXISTS ${table}_revision_${event} ON ${table};
+            CREATE TRIGGER ${table}_revision_${event} AFTER ${event} ON ${table}
+            REFERENCING ${event === 'DELETE' ? 'OLD' : 'NEW'} TABLE AS managed_revision_rows
+            FOR EACH STATEMENT EXECUTE FUNCTION managed_${column}_changed();`
+        }
+      } else {
+        for (const event of ['INSERT', 'UPDATE', 'DELETE']) {
+          sql += `CREATE TRIGGER IF NOT EXISTS ${table}_revision_${event}
+            AFTER ${event} ON ${table} BEGIN ${update} END;`
+        }
+      }
+    }
+  }
+  return sql
+}

package/server-managed/session.ts

@@ -0,0 +1,78 @@
+// Session + cookie plumbing for the managed auth server. The raw session
+// token lives ONLY in the cookie; the DB row id is its SHA-256 (see crypto.ts)
+// so a DB read can't reconstruct a live cookie. A double-submit CSRF token is
+// minted per session and returned to the client (echoed back on mutations).
+//
+// Async throughout — the store (db.ts) is async so a future non-SQLite
+// backend slots in without touching these helpers.
+import type { ManagedConfig } from './config.ts'
+import type { ManagedDb, ManagedSession, ManagedUser, StoredUser } from './db.ts'
+import { hashToken, randomToken } from './crypto.ts'
+
+// Base name for the short-lived OAuth-state cookie; `__Host-` is prefixed via
+// `cookieName` when cookies are Secure.
+export const STATE_COOKIE = 'dvstate'
+
+// `__Host-`-prefix the base name when cookies are Secure (the prefix mandates
+// Secure + Path=/ + no Domain, which `buildCookie` already emits).
+export function cookieName(config: ManagedConfig, base: string): string {
+  return config.cookieSecure ? `__Host-${base}` : base
+}
+
+export function buildCookie(
+  name: string, value: string,
+  opts: { maxAgeS: number; secure: boolean; sameSite?: 'Lax' | 'Strict' },
+): string {
+  const parts = [`${name}=${value}`, 'Path=/', 'HttpOnly', `SameSite=${opts.sameSite ?? 'Lax'}`, `Max-Age=${opts.maxAgeS}`]
+  if (opts.secure) parts.push('Secure')
+  return parts.join('; ')
+}
+
+// Expire a cookie now (Max-Age=0).
+export function clearCookie(name: string, secure: boolean): string {
+  return buildCookie(name, '', { maxAgeS: 0, secure })
+}
+
+export function parseCookies(header: string | undefined): Map<string, string> {
+  const out = new Map<string, string>()
+  if (!header) return out
+  for (const part of header.split(';')) {
+    const eq = part.indexOf('=')
+    if (eq < 0) continue
+    const k = part.slice(0, eq).trim()
+    if (k) out.set(k, part.slice(eq + 1).trim())
+  }
+  return out
+}
+
+// Mint a session for a freshly-authenticated user. Upserts the identity, then
+// stores the session keyed by the cookie token's hash. Returns the cookie to
+// set and the CSRF token (also persisted on the row).
+export async function createSession(
+  config: ManagedConfig, db: ManagedDb, user: ManagedUser, now: number,
+): Promise<{ setCookie: string; csrfToken: string; userId: string }> {
+  const token = randomToken()
+  const csrfToken = randomToken()
+  const userId = await db.upsertUser(user, now, config.initialAdminGithubId)
+  await db.createSession({ id: hashToken(token), userId, csrfToken, expiresAt: now + config.sessionTtlMs }, now)
+  const setCookie = buildCookie(config.sessionCookieName, token, {
+    maxAgeS: Math.floor(config.sessionTtlMs / 1000), secure: config.cookieSecure, sameSite: 'Lax',
+  })
+  return { setCookie, csrfToken, userId }
+}
+
+// Resolve the current session (+ user) from the request's cookies, or null.
+export function readSession(
+  config: ManagedConfig, db: ManagedDb, cookieHeader: string | undefined, now: number,
+): Promise<{ session: ManagedSession; user: StoredUser } | null> {
+  const token = parseCookies(cookieHeader).get(config.sessionCookieName)
+  if (token == null || token === '') return Promise.resolve(null)
+  return db.sessionWithUser(hashToken(token), now)
+}
+
+// Drop the session named by the request's cookie (logout). The caller also
+// clears the cookie client-side.
+export async function endSession(config: ManagedConfig, db: ManagedDb, cookieHeader: string | undefined): Promise<void> {
+  const token = parseCookies(cookieHeader).get(config.sessionCookieName)
+  if (token != null && token !== '') await db.deleteSession(hashToken(token))
+}

package/server-managed/slugs.ts

@@ -0,0 +1,38 @@
+import type { DatabaseSync } from 'node:sqlite'
+
+// Legacy non-UUID IDs stay intact. Production IDs are UUIDs; only their final
+// component is proposed as a slug, never an arbitrary prefix or abbreviation.
+export function preferredSlug(id: string): string {
+  return /^[a-f\d]{8}(?:-[a-f\d]{4}){3}-([a-f\d]{12})$/iu.exec(id)?.[1] ?? id
+}
+
+export function allocateMissingSlugs(rows: { id: string; slug: string | null }[]): { id: string; slug: string }[] {
+  // Reserve legacy IDs before UUID suffixes can claim them.
+  const used = new Set(rows.flatMap(row => row.slug == null ? [row.id] : [row.id, row.slug]))
+  const allocated = []
+  for (const row of rows) {
+    if (row.slug != null) continue
+    const candidate = preferredSlug(row.id)
+    const slug = used.has(candidate) ? row.id : candidate
+    allocated.push({ id: row.id, slug })
+    used.add(slug)
+  }
+  return allocated
+}
+
+// Allocate once, across the entire namespace rather than a viewer's teams.
+// Keep existing slugs stable when names, memberships, or collisions change.
+export function migrateSlugs(db: DatabaseSync): void {
+  db.exec('BEGIN IMMEDIATE')
+  try {
+    for (const table of ['managed_team', 'managed_report', 'managed_bundle']) {
+      const columns = db.prepare(`PRAGMA table_info(${table})`).all() as { name: string }[]
+      if (!columns.some(column => column.name === 'slug')) db.exec(`ALTER TABLE ${table} ADD COLUMN slug TEXT`)
+      const rows = db.prepare(`SELECT id, slug FROM ${table} ORDER BY id`).all() as { id: string; slug: string | null }[]
+      const update = db.prepare(`UPDATE ${table} SET slug = ? WHERE id = ?`)
+      for (const row of allocateMissingSlugs(rows)) update.run(row.slug, row.id)
+      db.exec(`CREATE UNIQUE INDEX IF NOT EXISTS ${table}_slug_idx ON ${table}(slug)`)
+    }
+    db.exec('COMMIT')
+  } catch (err) { db.exec('ROLLBACK'); throw err }
+}

package/server-managed/solidity-entry-points.ts

@@ -0,0 +1,69 @@
+import { normalizeTeamPath } from './repo-path.ts'
+
+const MAX_SUGGESTIONS = 100
+const EXCLUDED_DIRECTORIES = new Set(['test', 'tests', 'script', 'scripts', 'mock', 'mocks', 'node_modules', 'vendor', 'out', 'artifacts', 'cache', 'build', 'dist', 'broadcast'])
+
+function sourcePath(value: unknown): value is string {
+  if (typeof value !== 'string' || !value.endsWith('.sol') || /\.(?:t|s|test|spec)\.sol$/iu.test(value)) return false
+  const normalized = normalizeTeamPath(value)
+  const directories = value.split('/').slice(0, -1).map(part => part.toLowerCase())
+  const sourceRoot = directories.findIndex(part => part === 'src' || part === 'contracts')
+  return normalized.ok && normalized.path === value && !directories.some((part, index) =>
+    EXCLUDED_DIRECTORIES.has(part) || (part === 'lib' && (sourceRoot < 0 || index < sourceRoot)))
+}
+
+type ListingEntry = { name?: unknown; path?: unknown; type?: unknown; sha?: unknown; submodule_git_url?: unknown }
+
+// Maintain the alphabetically first 100 unique candidates even when GitHub's
+// input is unordered. Return whether a unique candidate exceeds the capacity.
+export function addSoliditySuggestion(paths: string[], path: string): boolean {
+  let start = 0
+  let end = paths.length
+  while (start < end) {
+    const middle = Math.floor((start + end) / 2)
+    if (paths[middle]! < path) start = middle + 1
+    else end = middle
+  }
+  if (paths[start] === path) return false
+  const full = paths.length === MAX_SUGGESTIONS
+  if (start < MAX_SUGGESTIONS) {
+    // Evict before inserting, so retained candidates never exceed the cap.
+    if (full) paths.pop()
+    paths.splice(start, 0, path)
+  }
+  return full
+}
+
+// Suggestions from filenames, not deployability or import analysis. Read at
+// most two source trees, using SHAs from the authorized pinned directory.
+export async function readSolidityEntryPoints(directory: string, listing: unknown[], read: (suffix: string) => Promise<unknown>) {
+  const prefix = directory ? directory + '/' : ''
+  const entries = listing.filter((entry): entry is ListingEntry => !!entry && typeof entry === 'object').filter(entry =>
+    typeof entry.name === 'string' && !entry.name.includes('/') && entry.path === prefix + entry.name && !entry.submodule_git_url)
+  const hasFramework = entries.some(entry => entry.type === 'file' && typeof entry.name === 'string'
+    && (entry.name === 'foundry.toml' || /^hardhat\.config\.(?:[cm]?js|ts)$/u.test(entry.name)))
+  const roots = entries.filter(entry => entry.type === 'dir' && (entry.name === 'contracts' || (hasFramework && entry.name === 'src'))
+    && typeof entry.sha === 'string' && /^[a-f\d]{40}$/iu.test(entry.sha)).slice(0, 2)
+  const paths: string[] = []
+  let limited = false
+  for (const entry of entries) {
+    if (entry.type === 'file' && sourcePath(entry.path) && addSoliditySuggestion(paths, entry.path)) limited = true
+  }
+  for (const root of roots) {
+    if (!sourcePath(`${root.path}/Contract.sol`)) continue
+    try {
+      const data = await read(`/git/trees/${root.sha}?recursive=1`) as { tree?: unknown; truncated?: unknown }
+      if (!Array.isArray(data?.tree)) continue
+      limited ||= data.truncated === true
+      for (const entry of data.tree) {
+        if (entry?.type !== 'blob' || !['100644', '100755'].includes(entry.mode) || typeof entry.path !== 'string') continue
+        const path = `${root.path}/${entry.path}`
+        if (sourcePath(path) && addSoliditySuggestion(paths, path)) limited = true
+      }
+    } catch {
+      // Optional suggestions must not block browsing. The request handler
+      // rechecks GitHub access and local path grants after all reads.
+    }
+  }
+  return { paths, limited }
+}

package/server-managed/sql-postgres.ts

@@ -0,0 +1,31 @@
+// The small SQL dialect used by the shared store. Parameter values never pass
+// through these rewrites; only our own SQL does. Keep aliases case-sensitive.
+export function postgresSql(source: string): { sql: string; names: string[] } {
+  const names: string[] = []
+  let position = 0
+  let sql = source.replaceAll('json_each(:contexts)', 'jsonb_array_elements(:contexts::jsonb)')
+    .replaceAll("CAST(unixepoch('subsec') * 1000 AS INTEGER)", 'CAST(EXTRACT(EPOCH FROM clock_timestamp()) * 1000 AS BIGINT)')
+    .replaceAll(/json_extract\((\w+\.value), '\$\.(\w+)'\)/gu, "($1->>'$2')")
+    .replaceAll('json_each(?)', 'jsonb_array_elements_text(?::jsonb)')
+    .replaceAll('INSERT OR IGNORE INTO', 'INSERT INTO')
+    .replaceAll('CROSS JOIN', 'JOIN')
+    .replaceAll(/\binstr\(/gu, 'strpos(')
+  // Quoted literals (including ':') are never placeholders or identifiers.
+  sql = sql.split(/('(?:''|[^'])*')/u).map((part, i) => i % 2 ? part : part
+    .replaceAll(/\?|(?<!:):([a-zA-Z]\w*)/gu, (_match, name: string | undefined) => {
+      if (!name) return `$${++position}`
+      let index = names.indexOf(name)
+      if (index < 0) { index = names.length; names.push(name) }
+      return `$${index + 1}`
+    })
+    .replaceAll(/\b[a-z]+[A-Z]\w*\b/gu, name => `"${name}"`)
+  ).join('')
+  sql = sql.replaceAll(/(\$\d+) IS NULL/gu, '$1::text IS NULL')
+  if (source.includes('INSERT OR IGNORE')) sql += ' ON CONFLICT DO NOTHING'
+  return { sql, names }
+}
+
+export function postgresSchema(sql: string): string {
+  return sql.replaceAll(') STRICT;', ');').replaceAll(/\bINTEGER\b/gu, 'BIGINT')
+    .replaceAll(/seq\s+BIGINT PRIMARY KEY/gu, 'seq BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY')
+}

package/server-managed/sql.ts

@@ -0,0 +1,72 @@
+// Each public store operation owns a transaction. SQLite serializes access to
+// its single connection across awaits; Neon can reuse a request-owned connection.
+import type { DatabaseSync, SQLInputValue } from 'node:sqlite'
+import type { ManagedDb } from './db-methods.ts'
+
+type MaybePromise<T> = T | Promise<T>
+export interface ManagedSql {
+  prepare(sql: string): {
+    get(...params: unknown[]): MaybePromise<unknown>
+    all(...params: unknown[]): MaybePromise<unknown[]>
+    run(...params: unknown[]): MaybePromise<{ changes: number | bigint }>
+  }
+  close(): MaybePromise<void>
+}
+export interface ManagedSqlDriver extends ManagedSql {
+  scope<T>(write: boolean, work: () => Promise<T>, options?: { lock?: boolean; statement?: boolean }): Promise<T>
+}
+
+// These operations execute exactly one SQL statement. Postgres already gives
+// that statement an atomic snapshot; an explicit BEGIN/COMMIT adds only trips.
+// Lease writes coordinate through their conditional UPSERT/UPDATE alone.
+const SINGLE_STATEMENTS = new Set(['getReport', 'getBundle', 'getStorageRow', 'getStorageEncryption',
+  'listReports', 'listBundles', 'listReadableBundleIds', 'listAllRepos', 'listSelectedRepos', 'listRepoScopesForUser', 'listTriage',
+  'getFeedState', 'getWorkspaceShareFeedState', 'claimMaintenanceLease', 'finishMaintenanceLease', 'cacheRepoDefaultBranch', 'releaseBundleBuildLease'])
+
+export function scopeManagedMethods(methods: ManagedDb, driver: ManagedSqlDriver): ManagedDb {
+  const entries = Object.entries(methods).map(([name, method]) => {
+    if (name === 'close') return [name, async () => { await driver.close() }]
+    const write = !/^(?:get|list|userCanRead|reportPermissionsFor)/u.test(name)
+    return [name, (...args: unknown[]) => driver.scope(write, () => method(...args), {
+      // Presence writes only one user's timestamp; they need no application
+      // writer lock. Keep the session/user read and timestamp in one transaction.
+      lock: write && name !== 'sessionWithUser', statement: SINGLE_STATEMENTS.has(name),
+    })]
+  })
+  return Object.fromEntries(entries) as ManagedDb
+}
+
+export function createSqliteDriver(db: DatabaseSync): ManagedSqlDriver {
+  let queue = Promise.resolve()
+  let closed = false
+  function enqueue<T>(work: () => Promise<T>): Promise<T> {
+    const result = queue.then(work)
+    queue = result.then(() => undefined, () => undefined)
+    return result
+  }
+  return {
+    prepare(sql) {
+      const stmt = db.prepare(sql)
+      return {
+        get: (...args) => stmt.get(...args as SQLInputValue[]),
+        all: (...args) => stmt.all(...args as SQLInputValue[]),
+        run: (...args) => stmt.run(...args as SQLInputValue[]),
+      }
+    },
+    scope(write, work) {
+      if (closed) return Promise.reject(new Error('Managed database is closed'))
+      return enqueue(async () => {
+        db.exec(write ? 'BEGIN IMMEDIATE' : 'BEGIN')
+        try {
+          const result = await work()
+          db.exec('COMMIT')
+          return result
+        } catch (err) {
+          db.exec('ROLLBACK')
+          throw err
+        }
+      })
+    },
+    async close() { closed = true; await queue; db.close() },
+  }
+}

package/server-managed/static.ts

@@ -0,0 +1,28 @@
+import { type StaticHandler, loadStatic } from '../server-e2e/static.ts'
+import { parseManagedRoute } from '../common/managed/routes.js'
+
+// A deep page URL must still resolve every asset at the app root. Preload
+// headers resolve against the request URL, so their hrefs must be absolute too.
+export function managedPageHtml(html: string): string {
+  return html.replaceAll(/(href|src)="\.\//gu, '$1="/')
+}
+
+export function loadManagedStatic(staticDir: string, { indexOnly = false, scanServer = null }: { indexOnly?: boolean, scanServer?: string | null } = {}): StaticHandler {
+  const serve = loadStatic(staticDir, scanServer, { transformIndex: managedPageHtml, indexOnly })
+  return (req, res) => {
+    if (!req.url?.startsWith('/') || req.url.startsWith('//')) return false
+    const url = new URL(req.url, 'http://localhost')
+    let path
+    try { path = decodeURIComponent(url.pathname) } catch { return false }
+    // No API request, including an unknown API route, may receive app HTML.
+    if (path === '/api' || path.startsWith('/api/')) return false
+    if (serve(req, res)) return true
+    if (req.method !== 'GET' && req.method !== 'HEAD') return false
+    // Finding IDs can contain dots (including URL-shaped IDs). Recognised
+    // pages still receive HTML; missing assets retain a 404.
+    if (path.split('/').at(-1)?.includes('.') && !parseManagedRoute(url)) return false
+    const original = req.url
+    req.url = '/'
+    try { return serve(req, res) } finally { req.url = original }
+  }
+}

package/server-managed/storage-command.ts

@@ -0,0 +1,16 @@
+import { loadManagedConfig } from './config.ts'
+import { openManagedStorageDb } from './storage.ts'
+
+// Require the deployment mode: DB_PATH belongs to e2e in combined deployments.
+// Read the database requirement without opening bytes or enabling encryption.
+export async function storageCommand(mode: string | undefined): Promise<void> {
+  if (mode !== 'managed' && mode !== 'managed-e2e' && mode !== 'e2e-managed') throw new Error('Storage status requires a deployment mode: --storage-encryption-status managed|managed-e2e|e2e-managed')
+  const db = await openManagedStorageDb(loadManagedConfig({ combined: mode !== 'managed' }))
+  try {
+    const status = await db.getStorageEncryption()
+    console.log(JSON.stringify(status ? {
+      encryption: 'chacha20-poly1305', complete: status.complete === 1, cleanupComplete: status.cleanupComplete === 1,
+      migrated: status.migrated, cursor: status.cursor,
+    } : { encryption: 'disabled' }))
+  } finally { await db.close() }
+}