@preventive/triage 1.0.0-alpha.32 → 1.0.0-alpha.34

package/server-managed/index.ts

@@ -12,6 +12,7 @@ import { type ManagedConfig, loadManagedConfig } from './config.ts'
 import { type ManagedHttpDeps, createManagedRequestHandler } from './http.ts'
 import { loadManagedStatic } from './static.ts'
 import { openManagedStorage } from './storage.ts'
+import { setCacheDir } from '@preventive/upstream/npm.js'
 
 // Housekeeping runs on ordinary traffic too, including serverless instances
 // without a timer or cron. Failed sweeps retry on later traffic after a minute.
@@ -21,6 +22,9 @@ const REAP_RETRY_MS = 60_000
 type ManagedAppOptions = Partial<Pick<ManagedHttpDeps, 'next' | 'serverInfo' | 'isShuttingDown'>>
 
 export async function createManagedApp(config: ManagedConfig, options: ManagedAppOptions = {}) {
+  // Audits keep upstream's records on disk where the config has a cache
+  // directory; bundle builds set it in their own worker.
+  setCacheDir(config.upstreamCacheDir ?? false)
   // Load the optional peer only for serverless managed deployments. Embedding
   // hosts can discard listener promises, so retain maintenance inside the app.
   const waitUntil = config.serverless ? (await import('@vercel/functions')).waitUntil : undefined

package/server-managed/link-reports.ts

@@ -0,0 +1,158 @@
+// Global deduplication reports live entirely in SQL. The payload is authenticated
+// ciphertext bound to its row, using the deployment's existing storage key.
+import { Buffer } from 'node:buffer'
+import { createHash, randomUUID } from 'node:crypto'
+import { type StorageKey, unwrapStorageValue, wrapStorageValue } from '../server-common/storage-crypto.ts'
+import { parseLinkedFindings } from '../client/linked-findings.js'
+import type { ManagedSql } from './sql.ts'
+import { ManagedMutationError } from './management.ts'
+
+export const LINK_REPORT_SCHEMA = `
+CREATE TABLE IF NOT EXISTS managed_link_report (
+  id TEXT PRIMARY KEY, filename TEXT NOT NULL, sha256 TEXT NOT NULL UNIQUE,
+  encrypted_groups TEXT NOT NULL, enabled INTEGER NOT NULL DEFAULT 1,
+  group_count INTEGER NOT NULL, finding_count INTEGER NOT NULL,
+  uploaded_by TEXT REFERENCES managed_user(id) ON DELETE SET NULL,
+  uploaded_by_login TEXT, uploaded_at INTEGER NOT NULL
+) STRICT;
+`
+export interface LinkReport {
+  id: string; filename: string; enabled: boolean; groupCount: number; findingCount: number
+  uploadedByLogin: string | null; uploadedAt: number
+}
+export interface LinkReportStore {
+  listLegacyLinkReports(): Promise<{ id: string; filename: string }[]>
+  migrateLinkReport(id: string, content: string): Promise<boolean>
+  listLinkReports(): Promise<LinkReport[]>
+  getLinkReport(sessionId: string, id: string): Promise<LinkReport & { groups: string[][] }>
+  getLinkRevision(): Promise<string>
+  getEnabledLinkGroups(revision: string): Promise<string[][]>
+  importLinkReport(sessionId: string, filename: string, content: string): Promise<{ report: LinkReport; reused: boolean }>
+  setLinkReportEnabled(sessionId: string, id: string, enabled: boolean): Promise<void>
+}
+const columns = `id, filename, enabled, group_count AS groupCount, finding_count AS findingCount,
+  uploaded_by_login AS uploadedByLogin, uploaded_at AS uploadedAt`
+const identity = (id: string) => `managed_link_report.encrypted_groups:${id}`
+function decryptGroups(key: StorageKey | null, id: string, payload: string): string[][] {
+  if (!key) throw new ManagedMutationError(503, 'storage-encryption-required')
+  const plain = unwrapStorageValue(key, identity(id), payload)
+  try { return JSON.parse(plain.toString('utf8')) as string[][] } finally { plain.fill(0) }
+}
+export async function linkRevision(db: ManagedSql): Promise<string> {
+  const rows = await db.prepare('SELECT id, sha256 FROM managed_link_report WHERE enabled = 1 ORDER BY id').all()
+  return rows.length > 0 ? createHash('sha256').update(JSON.stringify(rows)).digest('base64url') : ''
+}
+function parseLinkReport(content: string) {
+  const parsed = parseLinkedFindings(content)
+  if (parsed) return parsed
+  // Older managed exports may carry the normalized links envelope.
+  try {
+    const data = JSON.parse(content)
+    if (data?.source !== 'links' || !Array.isArray(data.links) || !Array.isArray(data.findings) || data.findings.length > 0) return null
+    return data.links.length === 0 ? { groups: [], skipped: 0 } : parseLinkedFindings(JSON.stringify(data.links))
+  } catch { return null }
+}
+export function linkReportMethods(db: ManagedSql, key: StorageKey | null): LinkReportStore {
+  const map = (row: Omit<LinkReport, 'enabled'> & { enabled: number }): LinkReport => ({ ...row, enabled: row.enabled === 1 })
+  async function authorize(sessionId: string) {
+    const user = await db.prepare(`SELECT u.id, u.login, u.role FROM managed_session s JOIN managed_user u ON u.id = s.user_id
+      WHERE s.id = ? AND s.expires_at > ?`).get(sessionId, Date.now()) as { id: string; login: string; role: string } | undefined
+    if (!user) throw new ManagedMutationError(401, 'unauthenticated')
+    if (user.role !== 'admin') throw new ManagedMutationError(403, 'forbidden')
+    return user
+  }
+  return {
+    async listLegacyLinkReports() {
+      return await db.prepare("SELECT id, filename FROM managed_report WHERE analyzer = 'links' ORDER BY id").all() as { id: string; filename: string }[]
+    },
+    async migrateLinkReport(id, content) {
+      const row = await db.prepare(`SELECT filename, sha256, visible, uploaded_by AS uploadedBy,
+        uploaded_by_login AS uploadedByLogin, uploaded_at AS uploadedAt FROM managed_report WHERE id = ? AND analyzer = 'links'`).get(id) as {
+        filename: string; sha256: string; visible: number; uploadedBy: string | null; uploadedByLogin: string | null; uploadedAt: number
+      } | undefined
+      if (!row) return false
+      if (!key) throw new Error('Managed link reports require MANAGED_STORAGE_ENCRYPTION_KEY')
+      if (createHash('sha256').update(content).digest('base64url') !== row.sha256) throw new Error('Legacy link report content changed')
+      const parsed = parseLinkReport(content)
+      if (!parsed) throw new Error('Invalid legacy link report')
+      const plain = Buffer.from(JSON.stringify(parsed.groups))
+      try {
+        const sha256 = createHash('sha256').update(plain).digest('base64url')
+        await db.prepare(`INSERT INTO managed_link_report
+          (id, filename, sha256, encrypted_groups, enabled, group_count, finding_count, uploaded_by, uploaded_by_login, uploaded_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT(sha256) DO NOTHING`).run(
+          id, row.filename, sha256, wrapStorageValue(key, identity(id), plain), row.visible,
+          parsed.groups.length, new Set(parsed.groups.flat()).size, row.uploadedBy, row.uploadedByLogin, row.uploadedAt)
+        await db.prepare('DELETE FROM managed_report WHERE id = ?').run(id)
+      } finally { plain.fill(0) }
+      return true
+    },
+    async listLinkReports() {
+      return (await db.prepare(`SELECT ${columns} FROM managed_link_report ORDER BY uploaded_at DESC, id`).all() as Parameters<typeof map>[0][]).map(map)
+    },
+    async getLinkReport(sessionId, id) {
+      await authorize(sessionId)
+      const row = await db.prepare(`SELECT ${columns}, encrypted_groups AS payload FROM managed_link_report WHERE id = ?`).get(id) as (Parameters<typeof map>[0] & { payload: string }) | undefined
+      if (!row) throw new ManagedMutationError(404, 'no-link-report')
+      const { payload, ...report } = row
+      return { ...map(report), groups: decryptGroups(key, id, payload) }
+    },
+    getLinkRevision: () => linkRevision(db),
+    async getEnabledLinkGroups(revision) {
+      if (await linkRevision(db) !== revision) throw new ManagedMutationError(409, 'deduplication-changed')
+      const rows = await db.prepare('SELECT id, encrypted_groups AS payload FROM managed_link_report WHERE enabled = 1 ORDER BY id').all() as { id: string; payload: string }[]
+      if (rows.length > 0 && !key) throw new Error('Managed link reports require MANAGED_STORAGE_ENCRYPTION_KEY')
+      return rows.flatMap(row => decryptGroups(key, row.id, row.payload))
+    },
+    async importLinkReport(sessionId, filename, content) {
+      const user = await authorize(sessionId)
+      if (!key) throw new ManagedMutationError(503, 'storage-encryption-required')
+      const parsed = parseLinkReport(content)
+      if (!parsed || parsed.skipped) throw new ManagedMutationError(400, 'invalid-link-report')
+      const plain = Buffer.from(JSON.stringify(parsed.groups))
+      const sha256 = createHash('sha256').update(plain).digest('base64url')
+      try {
+        const existing = await db.prepare(`SELECT ${columns} FROM managed_link_report WHERE sha256 = ?`).get(sha256) as Parameters<typeof map>[0] | undefined
+        if (existing) return { report: map(existing), reused: true }
+        const id = randomUUID(), uploadedAt = Date.now()
+        const findingCount = new Set(parsed.groups.flat()).size, groupCount = parsed.groups.length
+        await db.prepare(`INSERT INTO managed_link_report
+          (id, filename, sha256, encrypted_groups, group_count, finding_count, uploaded_by, uploaded_by_login, uploaded_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(id, filename, sha256, wrapStorageValue(key, identity(id), plain), groupCount, findingCount, user.id, user.login, uploadedAt)
+        return { report: { id, filename, enabled: true, groupCount, findingCount, uploadedByLogin: user.login, uploadedAt }, reused: false }
+      } finally { plain.fill(0) }
+    },
+    async setLinkReportEnabled(sessionId, id, enabled) {
+      await authorize(sessionId)
+      if (!(await db.prepare('UPDATE managed_link_report SET enabled = ? WHERE id = ?').run(+enabled, id)).changes) throw new ManagedMutationError(404, 'no-link-report')
+    },
+  }
+}
+
+// Merge complete components BEFORE projecting them onto the response. An ID
+// absent from every returned report can still bridge two visible findings.
+export function mergeLinkGroups(groups: readonly string[][], present?: ReadonlySet<string>): string[][] {
+  const parents = new Map<string, string>()
+  const root = (id: string): string => {
+    if (!parents.has(id)) parents.set(id, id)
+    let value = id
+    while (parents.get(value) !== value) {
+      parents.set(value, parents.get(parents.get(value)!)!)
+      value = parents.get(value)!
+    }
+    return value
+  }
+  for (const ids of groups) {
+    if (ids.length === 0) continue
+    const first = root(ids[0]!)
+    for (const id of ids.slice(1)) { const other = root(id); if (other !== first) parents.set(other, first) }
+  }
+  const merged = new Map<string, string[]>()
+  for (const id of parents.keys()) {
+    if (present && !present.has(id)) continue
+    const key = root(id)
+    const ids = merged.get(key) ?? []
+    ids.push(id); merged.set(key, ids)
+  }
+  return [...merged.values()].filter(ids => ids.length >= 2)
+}

package/server-managed/managed-issues.ts

@@ -1,4 +1,6 @@
 import type { ManagedSql } from './sql.ts'
+import type { TeamReportAccessSnapshot } from './db.ts'
+import { parseGithubPrUrl } from '../common/github-pr.ts'
 
 // One immutable reference per finding, shared across reports and teams. Keep
 // reservations across crashes/uncertain GitHub responses to prevent duplicates.
@@ -10,6 +12,8 @@ CREATE TABLE IF NOT EXISTS managed_finding_issue (
   repository TEXT NOT NULL,
   request_id TEXT NOT NULL,
   issue_url TEXT,
+  auto_fix_url TEXT,
+  auto_fix_checked_at INTEGER,
   created_by TEXT REFERENCES managed_user(id) ON DELETE SET NULL,
   created_at INTEGER NOT NULL
 ) STRICT;
@@ -20,24 +24,48 @@ export interface ManagedIssue {
   repository: string
   requestId: string
   issueUrl: string | null
+  autoFixUrl: string | null
+  autoFixCheckedAt: number | null
   createdBy: string | null
   createdAt: number
 }
 export interface ManagedIssueStore {
   getManagedIssue(findingId: string): Promise<ManagedIssue | null>
-  claimManagedIssue(issue: Omit<ManagedIssue, 'issueUrl'>): Promise<boolean>
+  listManagedIssues(findingIds: readonly string[]): Promise<ManagedIssue[]>
+  claimManagedIssue(issue: Omit<ManagedIssue, 'issueUrl' | 'autoFixUrl' | 'autoFixCheckedAt'>): Promise<boolean>
   finishManagedIssue(findingId: string, requestId: string, url: string): Promise<boolean>
   releaseManagedIssue(findingId: string, requestId: string): Promise<void>
+  setManagedIssueAutoFix(findingId: string, issueUrl: string, previous: string | null, next: string | null, checkedAt: number): Promise<boolean>
+}
+
+// A repeated finding ID never grants access to another team's repository.
+export function visibleManagedIssues(issues: ManagedIssue[], snapshot: TeamReportAccessSnapshot) {
+  if (snapshot.user.id.startsWith('share:')) return []
+  const repos = new Set(snapshot.repositories.map(repo => repo.repoId))
+  const names = new Set(snapshot.repositories.map(repo => repo.github.toLowerCase()))
+  return issues.filter(issue => issue.issueUrl && repos.has(issue.repoId)).map(issue => {
+    const ref = parseGithubPrUrl(issue.autoFixUrl)
+    return { ...issue, autoFixUrl: ref && names.has(ref.repo.toLowerCase()) ? issue.autoFixUrl : null }
+  })
 }
 export function managedIssueMethods(db: ManagedSql): ManagedIssueStore {
-  const get = db.prepare(`SELECT finding_id AS findingId, repo_id AS repoId, repository, request_id AS requestId,
-    issue_url AS issueUrl, created_by AS createdBy, created_at AS createdAt FROM managed_finding_issue WHERE finding_id = ?`)
+  const fields = `finding_id AS findingId, repo_id AS repoId, repository, request_id AS requestId,
+    issue_url AS issueUrl, auto_fix_url AS autoFixUrl, auto_fix_checked_at AS autoFixCheckedAt, created_by AS createdBy, created_at AS createdAt`
+  const get = db.prepare(`SELECT ${fields} FROM managed_finding_issue WHERE finding_id = ?`)
+  const list = db.prepare(`SELECT ${fields} FROM managed_finding_issue WHERE finding_id IN (SELECT value FROM json_each(?)) ORDER BY finding_id`)
+  const autoFix = db.prepare(`UPDATE managed_finding_issue SET auto_fix_url = ?, auto_fix_checked_at = ?
+    WHERE finding_id = ? AND issue_url = ? AND COALESCE(auto_fix_url, '') = COALESCE(?, '')
+      AND (auto_fix_checked_at IS NULL OR auto_fix_checked_at <= ?)`)
   const claim = db.prepare(`INSERT INTO managed_finding_issue (finding_id, repo_id, repository, request_id, created_by, created_at)
     VALUES (?, ?, ?, ?, ?, ?) ON CONFLICT (finding_id) DO NOTHING`)
   const finish = db.prepare(`UPDATE managed_finding_issue SET issue_url = ? WHERE finding_id = ? AND request_id = ? AND issue_url IS NULL`)
   const release = db.prepare(`DELETE FROM managed_finding_issue WHERE finding_id = ? AND request_id = ? AND issue_url IS NULL`)
   return {
     async getManagedIssue(findingId) { return (await get.get(findingId) as ManagedIssue | undefined) ?? null },
+    async listManagedIssues(ids) { return await list.all(JSON.stringify(ids)) as ManagedIssue[] },
+    async setManagedIssueAutoFix(findingId, issueUrl, previous, next, checkedAt) {
+      return Number((await autoFix.run(next, checkedAt, findingId, issueUrl, previous, checkedAt)).changes) > 0
+    },
     async claimManagedIssue(issue) {
       return Number((await claim.run(issue.findingId, issue.repoId, issue.repository, issue.requestId, issue.createdBy, issue.createdAt)).changes) > 0
     },

package/server-managed/management.ts

@@ -1,4 +1,4 @@
-import type { AdminReport, ManagedBundle, ManagedDb, ManagedRepo, RepoDataItem, RepoReportItem, ReportRecord, StoredUser } from './db-methods.ts'
+import type { AdminReport, BundleReuse, ManagedBundle, ManagedDb, ManagedRepo, RepoDataItem, RepoReportItem, ReportRecord, StoredUser } from './db-methods.ts'
 import { roleAtLeast } from '../common/managed/roles.ts'
 
 export class ManagedMutationError extends Error {
@@ -6,20 +6,23 @@ export class ManagedMutationError extends Error {
   constructor(status: number, message: string) { super(message); this.status = status }
 }
 
-export type ContentMutation = { type: 'delete' } | { type: 'repo'; repoId: number | null; directory: string }
-export type ReportMutation = ContentMutation | { type: 'visibility'; visible: boolean }
+export type ContentMutation = { type: 'delete' } | { type: 'repo'; repoId: number | null; directory: string } | { type: 'visibility'; visible: boolean }
+export type ReportMutation = ContentMutation
 type RemovalRepo = Pick<ManagedRepo, 'repoId' | 'fullName' | 'addedAt'>
 type RemovalAnnotations = { reports: string; ids: string[] }
 export interface ManagementStore {
   mutateReport(sessionId: string, id: string, change: ReportMutation): Promise<{ report: ReportRecord; user: StoredUser }>
   mutateBundle(sessionId: string, id: string, change: ContentMutation): Promise<{ bundle: ManagedBundle; user: StoredUser }>
+  // A repeated upload/build of stored bytes (see reuseBundle). Renames need the
+  // access other bundle mutations need; a server build labels the row anyway.
+  reuseBundleUpload(sessionId: string, id: string, reuse: Omit<BundleReuse, 'rename'>): Promise<boolean>
   removeRepository(sessionId: string, expected: RemovalRepo, annotations: RemovalAnnotations | null): Promise<{
     reports: RepoReportItem[]; bundles: RepoDataItem[]; deletedReports: number; deletedBundles: number; deletedTriage: number
   }>
 }
 type ManagementDb = Pick<ManagedDb, 'sessionWithUser' | 'getReport' | 'getBundle' | 'listReports' | 'listReportsForRepo'
   | 'listBundlesForRepo' | 'listAllRepos' | 'listSelectedRepos' | 'userCanReadReport' | 'userCanReadBundle' | 'userCanReadRepoPath'
-  | 'deleteReport' | 'setReportRepo' | 'setReportVisible' | 'deleteBundle' | 'setBundleRepo'
+  | 'deleteReport' | 'setReportRepo' | 'setReportVisible' | 'deleteBundle' | 'setBundleRepo' | 'setBundleVisible' | 'reuseBundle'
   | 'deleteReportsForRepo' | 'deleteBundlesForRepo' | 'deleteRepo' | 'deleteTriage' | 'recordActivity'>
 
 // Only immutable bytes/format and repository membership affect the overlap
@@ -63,9 +66,19 @@ export function managementMethods(db: ManagementDb): ManagementStore {
       if (user.role !== 'admin' && bundle.repoId !== null && !await db.userCanReadRepoPath(user.id, bundle.repoId, bundle.repoDirectory)) throw new ManagedMutationError(403, 'repo-forbidden')
       await destination(user, change)
       if (change.type === 'delete') await db.deleteBundle(id)
+      else if (change.type === 'visibility') await db.setBundleVisible(id, change.visible)
       else await db.setBundleRepo(id, change.repoId, change.directory)
       return { bundle, user }
     },
+    async reuseBundleUpload(sessionId: string, id: string, reuse: Omit<BundleReuse, 'rename'>) {
+      const user = await authorize(sessionId, 'manage')
+      const bundle = await db.getBundle(id)
+      if (!bundle) return false
+      const rename = user.role === 'admin' || (await db.userCanReadBundle(user.id, id)
+        && (bundle.repoId === null || await db.userCanReadRepoPath(user.id, bundle.repoId, bundle.repoDirectory)))
+      if (!rename && reuse.provenance !== 'build') return false
+      return db.reuseBundle(id, { ...reuse, rename })
+    },
     async removeRepository(sessionId: string, expected: RemovalRepo, annotations: RemovalAnnotations | null) {
       const user = await authorize(sessionId, 'admin')
       const repo = (await db.listAllRepos()).find(r => r.repoId === expected.repoId)

package/server-managed/object-storage-disk.ts

@@ -1,5 +1,5 @@
 import { randomUUID } from 'node:crypto'
-import { lstat, mkdir, open, readdir, rename, rm, rmdir, stat } from 'node:fs/promises'
+import { link, lstat, mkdir, open, readdir, rename, rm, rmdir, stat } from 'node:fs/promises'
 import { dirname, join } from 'node:path'
 import { type ObjectPage, type RawObjectStorage, objectPath } from './object-storage.ts'
 
@@ -100,11 +100,15 @@ export function createDiskObjectStorage(dir: string): RawObjectStorage {
         await file.writeFile(bytes, signal ? { signal } : {})
         await file.sync(); await file.close()
         signal?.throwIfAborted()
-        if (expected !== undefined) {
+        if (expected === null) {
+          try { await link(temp, target) }
+          catch (err) { if ((err as NodeJS.ErrnoException).code === 'EEXIST') return false; throw err }
+        } else if (expected === undefined) await rename(temp, target)
+        else {
           try { if (version(await stat(target)) !== expected) return false }
           catch (err) { if (missing(err)) return false; throw err }
+          await rename(temp, target)
         }
-        await rename(temp, target)
         await syncDirectory(dirname(target))
         return true
       } finally { await file.close(); await rm(temp, { force: true }) }

package/server-managed/object-storage-vercel.ts

@@ -6,7 +6,7 @@ import { type RawObjectStorage, objectPath } from './object-storage.ts'
 export async function openVercelObjectStorage(token: string, sdk?: VercelBlobSdk): Promise<RawObjectStorage> {
   const blobs = sdk ?? await loadVercelBlobSdk()
   const path = (key: string) => `.managed/${objectPath(key)}`
-  return {
+  const storage: RawObjectStorage = {
     async head(key, signal) {
       try {
         const meta = await blobs.head(path(key), { token, ...(signal ? { abortSignal: signal } : {}) })
@@ -32,11 +32,14 @@ export async function openVercelObjectStorage(token: string, sdk?: VercelBlobSdk
     },
     async put(key, bytes, signal, expected, sizeHint) {
       const multipart = (sizeHint ?? (Buffer.isBuffer(bytes) ? bytes.length : Infinity)) >= 5 * 1024 * 1024
-      try { await blobs.put(path(key), bytes, { token, access: 'private', addRandomSuffix: false, allowOverwrite: true,
+      try { await blobs.put(path(key), bytes, { token, access: 'private', addRandomSuffix: false, allowOverwrite: expected !== null,
         ...(expected ? { ifMatch: expected } : {}), multipart, contentType: 'application/octet-stream', cacheControlMaxAge: 60, ...(signal ? { abortSignal: signal } : {}) })
         return true
       } catch (err) {
         if (blobs.BlobPreconditionFailedError && err instanceof blobs.BlobPreconditionFailedError) return false
+        // The SDK uses a generic error for an occupied pathname. Reconcile a
+        // create-only failure against storage; the caller verifies the winner.
+        if (expected === null && await storage.head(key, signal)) return false
         throw err
       }
     },
@@ -60,4 +63,5 @@ export async function openVercelObjectStorage(token: string, sdk?: VercelBlobSdk
       cursor: page.hasMore ? page.cursor! : null }
     },
   }
+  return storage
 }

package/server-managed/object-storage.ts

@@ -18,7 +18,8 @@ export interface RawObjectStorage {
   // A plaintext size hint selects multipart uploads without buffering streams.
   // Publish atomically only after consuming the body through clean EOF; a body
   // error must preserve the existing object (migration verifies while streaming).
-  put(key: string, bytes: Buffer | Readable, signal?: AbortSignal, expected?: string, sizeHint?: number): Promise<boolean>
+  // A null expected version creates only if absent, without replacing a winner.
+  put(key: string, bytes: Buffer | Readable, signal?: AbortSignal, expected?: string | null, sizeHint?: number): Promise<boolean>
   // Return false if the original version changed; do not delete its replacement.
   delete(key: string, version?: string, signal?: AbortSignal): Promise<boolean>
   list(prefix: string, cursor: string | null, limit: number, signal?: AbortSignal): Promise<ObjectPage>
@@ -27,7 +28,7 @@ export interface ObjectStorage {
   open(key: string): Promise<OpenedBlob | null>
   get(key: string): Promise<Buffer | null>
   exists(key: string): Promise<boolean>
-  put(key: string, bytes: Buffer): Promise<string | null>
+  put(key: string, bytes: Buffer, options?: { replaceReport?: boolean }): Promise<string | null>
   delete(key: string): Promise<void>
   deletePrefix(prefix: string): Promise<void>
 }

package/server-managed/public-workspace.ts

@@ -12,6 +12,7 @@ import { triageWireEntry } from './triage-response.ts'
 import { MAX_PACKAGE_INVENTORY_BYTES } from './bundle-cache.ts'
 import { backfillBundleSummaries, bundleSummaries } from './bundle-catalog.ts'
 import { ADVISORIES_TIMEOUT_MS, fetchBundleAdvisories } from './bundle-advisories.ts'
+import { auditCache } from './upstream-cache.ts'
 import { serveTeamFeed } from './team-feed.ts'
 
 function json(res: ServerResponse, status: number, body: unknown): void {
@@ -114,8 +115,10 @@ async function serveBundle(res: ServerResponse, deps: ManagedHttpDeps, bundle: M
     if (inventory === null) { json(res, 413, { error: 'payload-too-large' }); return }
     if (inventory === undefined) { json(res, 400, { error: 'unknown-reason' }); return }
     if (Buffer.byteLength(JSON.stringify(inventory)) > MAX_PACKAGE_INVENTORY_BYTES) { json(res, 413, { error: 'payload-too-large' }); return }
-    const result = await fetchBundleAdvisories(inventory.packages, AbortSignal.timeout(ADVISORIES_TIMEOUT_MS), {
-      debug: deps.config.debug, repoAdvisories: url.searchParams.get('repoAdvisories') === 'true',
+    const signal = AbortSignal.timeout(ADVISORIES_TIMEOUT_MS)
+    const result = await fetchBundleAdvisories(inventory.packages, signal, {
+      debug: deps.config.debug, repoAdvisories: url.searchParams.get('repoAdvisories') === 'true', details: url.searchParams.get('details') === 'true',
+      cache: auditCache(deps.config.upstreamCacheDir, deps.db, signal, deps.config.debug),
     })
     await recheck()
     json(res, result.status, result.status === 200 ? { ...inventory, advisories: result.body } : result.body); return

package/server-managed/report-sources.ts

@@ -3,8 +3,8 @@ import { createHash } from 'node:crypto'
 import { extname } from 'node:path'
 import { promisify } from 'node:util'
 import { gzip } from 'node:zlib'
-import { bundleSourcesAsMap } from '../common/bundle-sources.js'
-import { bundleSourceImports } from '../common/bundle-source-links.js'
+import { bundlePackageDirs, bundleSourcesAsMap } from '../common/bundle-sources.js'
+import { bundleSourceLinkImports } from '../common/bundle-source-links.js'
 import type { BundleDetails } from '../common/bundle-metadata.js'
 import { loadManagedFindings, managedFindingSourcePaths } from '../common/managed/report-content.ts'
 import { type ViewerPermissions, filterReportContent } from '../common/managed/report-filter.ts'
@@ -29,7 +29,7 @@ function formatDirectory(bundleId: string, sha256: string, name: string) {
 }
 function sourceCacheFilename(report: ReportRecord, bundle: ManagedBundle, permissions: ViewerPermissions, repo: { github: string | null }, sourcePaths?: Set<string>) {
   const key = createHash('sha256').update(JSON.stringify([
-    'finding-access-v6', sourcePaths ? [...sourcePaths].toSorted() : null, bundle.integrity, bundle.kind, permissions.dependencies, permissions.security, repo,
+    'finding-access-v8', sourcePaths ? [...sourcePaths].toSorted() : null, bundle.integrity, bundle.kind, permissions.dependencies, permissions.security, repo,
   ])).digest('hex')
   return `${formatDirectory(bundle.id, report.sha256, report.filename)}/${key}.json.gz`
 }
@@ -63,10 +63,11 @@ function selectSources(sourcePaths: Set<string>, sources: Map<string, string>) {
 
 function encodeSources(integrity: string, details: BundleDetails, selection: ReturnType<typeof selectSources>) {
   const sources = new Map(selection.files)
-  const imports = [...bundleSourceImports(details, sources)].map(([parent, targets]) => [parent, [...targets]])
+  const imports = [...bundleSourceLinkImports(details, sources)].map(([parent, targets]) => [parent, [...targets]])
   const bundle = details.kind === 'stasis' ? details.bundle as { formats: Map<string, string> } : null
   const formats = [...(bundle?.formats ?? [])].filter(([file]) => sources.has(file))
-  return compress(Buffer.from(JSON.stringify({ integrity, ...selection, imports, formats })), { level: 6 })
+  const packageDirs = [...(bundlePackageDirs(details) ?? [])].filter(([file]) => sources.has(file))
+  return compress(Buffer.from(JSON.stringify({ integrity, ...selection, imports, formats, packageDirs })), { level: 6 })
 }
 
 // Immutable report hashes share a derivative across duplicate uploads. Bundle

package/server-managed/report-store.ts

@@ -0,0 +1,47 @@
+// Compress before the object-storage encryption boundary. Separate paths let
+// legacy arbitrary report bytes remain readable without format sniffing.
+import { Buffer } from 'node:buffer'
+import { Readable } from 'node:stream'
+import { pipeline } from 'node:stream/promises'
+import { createBrotliDecompress } from 'node:zlib'
+import type { BlobStore, OpenedBlob } from './blob-store.ts'
+import { encodeBrotli } from './brotli.ts'
+
+async function readBytes(stored: OpenedBlob): Promise<Buffer> {
+  const parts: Buffer[] = []
+  try {
+    for await (const part of stored.stream) parts.push(Buffer.from(part))
+    return Buffer.concat(parts)
+  } finally { stored.stream.destroy() }
+}
+
+export function createReportStore(legacy: BlobStore, compressed: BlobStore,
+  replaceLegacy: (id: string, bytes: Buffer) => Promise<unknown>): BlobStore {
+  async function open(id: string): Promise<OpenedBlob | null> {
+    // Keep the original available until conversion succeeds. Concurrent reads
+    // can finish using an already-open stream while another reader converts it.
+    const original = await legacy.open(id)
+    if (original) {
+      const bytes = await readBytes(original)
+      await replaceLegacy(id, await encodeBrotli(bytes, 9))
+      return { size: bytes.length, stream: Readable.from([bytes]) }
+    }
+    const stored = await compressed.open(id)
+    if (!stored) return null
+    const stream = createBrotliDecompress()
+    // pipeline carries storage/authentication errors into the decoded stream
+    // and closes the stored source when a reader leaves before EOF.
+    void pipeline(stored.stream, stream).catch(() => {})
+    return { size: null, stream }
+  }
+  return {
+    put: async (id, bytes) => compressed.put(id, await encodeBrotli(bytes, 9)),
+    open,
+    async get(id) {
+      const stored = await open(id)
+      if (!stored) return null
+      return readBytes(stored)
+    },
+    async delete(id) { await Promise.all([compressed.delete(id), legacy.delete(id)]) },
+  }
+}

package/server-managed/repository-aliases.ts

@@ -0,0 +1,91 @@
+import { randomUUID } from 'node:crypto'
+import { reportRepoGithub } from '@preventive/report'
+import { type RepositoryAliasInput, matchRepositoryAlias, repositoryAliasNeedsFilePrefix } from '../common/managed/repository-alias.ts'
+import type { ManagedDb } from './db.ts'
+import { ManagedMutationError } from './management.ts'
+import { normalizeTeamPath } from './repo-path.ts'
+import type { ManagedSql } from './sql.ts'
+
+export const REPOSITORY_ALIAS_SCHEMA = `
+CREATE TABLE IF NOT EXISTS managed_repository_alias (
+  id TEXT PRIMARY KEY,
+  old_repo TEXT NOT NULL,
+  old_path TEXT NOT NULL DEFAULT '',
+  repo_id INTEGER NOT NULL REFERENCES managed_selected_repo(repo_id) ON DELETE CASCADE,
+  new_path TEXT NOT NULL DEFAULT '',
+  UNIQUE(old_repo, old_path)
+) STRICT;
+`
+export interface RepositoryAlias extends RepositoryAliasInput { id: string }
+export interface RepositoryAliasStore {
+  listRepositoryAliases(): Promise<RepositoryAlias[]>
+  saveRepositoryAlias(sessionId: string, id: string | null, input: unknown): Promise<RepositoryAlias>
+  deleteRepositoryAlias(sessionId: string, id: string): Promise<void>
+  getRepositoryImportLocation(github: string, directory: string, filePrefix?: string): Promise<{ repoId: number | null; directory: string }>
+}
+
+// Keep expensive inventory reads outside database transactions and skip them
+// unless a currently connected alias can use the bundle's existing paths.
+export async function resolveRepositoryImportLocation(db: ManagedDb, github: string, directory: string, loadFilePrefix: () => Promise<string>) {
+  const aliases = await db.listRepositoryAliases()
+  let filePrefix = ''
+  if (repositoryAliasNeedsFilePrefix(github, directory, aliases)) {
+    const active = new Set((await db.listSelectedRepos()).map(repo => repo.repoId))
+    if (repositoryAliasNeedsFilePrefix(github, directory, aliases.filter(alias => active.has(alias.repoId)))) filePrefix = await loadFilePrefix()
+  }
+  return db.getRepositoryImportLocation(github, directory, filePrefix)
+}
+
+function parseAlias(input: unknown): RepositoryAliasInput {
+  if (!input || typeof input !== 'object') throw new ManagedMutationError(400, 'bad-alias')
+  const { oldRepo, oldPath, repoId, newPath } = input as RepositoryAliasInput
+  const github = typeof oldRepo === 'string' ? reportRepoGithub({ repo: { github: oldRepo.trim() } }) : null
+  if (!github) throw new ManagedMutationError(400, 'bad-old-repo')
+  if (typeof oldPath !== 'string' || typeof newPath !== 'string') throw new ManagedMutationError(400, 'bad-directory')
+  const old = normalizeTeamPath(oldPath), target = normalizeTeamPath(newPath)
+  if (!old.ok || !target.ok) throw new ManagedMutationError(400, 'bad-directory')
+  if (!Number.isSafeInteger(repoId) || repoId <= 0) throw new ManagedMutationError(400, 'bad-repo')
+  return { oldRepo: github.toLowerCase(), oldPath: old.path ?? '', repoId, newPath: target.path ?? '' }
+}
+
+export function repositoryAliasMethods(db: ManagedSql): RepositoryAliasStore {
+  async function authorize(sessionId: string) {
+    const user = await db.prepare(`SELECT u.role FROM managed_session s JOIN managed_user u ON u.id = s.user_id
+      WHERE s.id = ? AND s.expires_at > ?`).get(sessionId, Date.now()) as { role: string } | undefined
+    if (!user) throw new ManagedMutationError(401, 'unauthenticated')
+    if (user.role !== 'admin') throw new ManagedMutationError(403, 'forbidden')
+  }
+  async function listRepositoryAliases() {
+    return await db.prepare(`SELECT id, old_repo AS oldRepo, old_path AS oldPath, repo_id AS repoId, new_path AS newPath
+      FROM managed_repository_alias ORDER BY old_repo, old_path, id`).all() as RepositoryAlias[]
+  }
+  return {
+    listRepositoryAliases,
+    async saveRepositoryAlias(sessionId, id, input) {
+      await authorize(sessionId)
+      const alias = parseAlias(input)
+      if (!await db.prepare('SELECT repo_id FROM managed_selected_repo WHERE repo_id = ? AND active = 1').get(alias.repoId)) throw new ManagedMutationError(400, 'bad-repo')
+      if (id && !await db.prepare('SELECT id FROM managed_repository_alias WHERE id = ?').get(id)) throw new ManagedMutationError(404, 'no-alias')
+      const duplicate = await db.prepare('SELECT id FROM managed_repository_alias WHERE old_repo = ? AND old_path = ?').get(alias.oldRepo, alias.oldPath) as { id: string } | undefined
+      if (duplicate && duplicate.id !== id) throw new ManagedMutationError(409, 'alias-exists')
+      const key = id ?? randomUUID()
+      await db.prepare(`INSERT INTO managed_repository_alias (id, old_repo, old_path, repo_id, new_path) VALUES (?, ?, ?, ?, ?)
+        ON CONFLICT(id) DO UPDATE SET old_repo = excluded.old_repo, old_path = excluded.old_path, repo_id = excluded.repo_id, new_path = excluded.new_path`)
+        .run(key, alias.oldRepo, alias.oldPath, alias.repoId, alias.newPath)
+      return { id: key, ...alias }
+    },
+    async deleteRepositoryAlias(sessionId, id) {
+      await authorize(sessionId)
+      if (!(await db.prepare('DELETE FROM managed_repository_alias WHERE id = ?').run(id)).changes) throw new ManagedMutationError(404, 'no-alias')
+    },
+    async getRepositoryImportLocation(github, directory, filePrefix = '') {
+      const alias = matchRepositoryAlias(github, directory, await listRepositoryAliases(), filePrefix)
+      const normalized = normalizeTeamPath(alias?.directory ?? directory)
+      if (!normalized.ok) throw new ManagedMutationError(400, 'bad-directory')
+      const repo = await (alias
+        ? db.prepare('SELECT repo_id AS repoId FROM managed_selected_repo WHERE active = 1 AND repo_id = ?').get(alias.repoId)
+        : db.prepare('SELECT repo_id AS repoId FROM managed_selected_repo WHERE active = 1 AND LOWER(full_name) = ?').get(github.toLowerCase())) as { repoId: number } | undefined
+      return { repoId: repo?.repoId ?? null, directory: normalized.path ?? '' }
+    },
+  }
+}

package/server-managed/revisions.ts

@@ -1,7 +1,7 @@
 // Internal invalidation counters. Never expose these global values to clients:
 // feeds still publish only the existing user/visibility-scoped revisions.
-const catalogTables = ['managed_team', 'managed_team_user', 'managed_team_repo', 'managed_report', 'managed_bundle', 'managed_selected_repo']
-const annotationTables = ['managed_finding_triage', 'managed_finding_triage_event', 'managed_finding_comment']
+const catalogTables = ['managed_link_report', 'managed_team', 'managed_team_user', 'managed_team_repo', 'managed_report', 'managed_bundle', 'managed_selected_repo']
+const annotationTables = ['managed_finding_triage', 'managed_finding_triage_event', 'managed_finding_comment', 'managed_finding_issue']
 export function revisionSchema(postgres = false): string {
   let sql = `CREATE TABLE IF NOT EXISTS managed_maintenance_lease (
     id INTEGER PRIMARY KEY, owner TEXT NOT NULL, expires_at INTEGER NOT NULL

package/server-managed/sql.ts

@@ -18,10 +18,11 @@ export interface ManagedSqlDriver extends ManagedSql {
 
 // These operations execute exactly one SQL statement. Postgres already gives
 // that statement an atomic snapshot; an explicit BEGIN/COMMIT adds only trips.
-// Lease writes coordinate through their conditional UPSERT/UPDATE alone.
+// Lease and cache writes coordinate through their conditional UPSERT/UPDATE alone.
 const SINGLE_STATEMENTS = new Set(['getReport', 'getBundle', 'getStorageRow', 'getStorageEncryption',
   'listReports', 'listBundles', 'listReadableBundleIds', 'listAllRepos', 'listSelectedRepos', 'listRepoScopesForUser', 'listTriage',
-  'getFeedState', 'getWorkspaceShareFeedState', 'claimMaintenanceLease', 'finishMaintenanceLease', 'cacheRepoDefaultBranch', 'releaseBundleBuildLease'])
+  'getFeedState', 'getWorkspaceShareFeedState', 'claimMaintenanceLease', 'finishMaintenanceLease', 'cacheRepoDefaultBranch', 'releaseBundleBuildLease',
+  'getUpstreamCacheEntry', 'setUpstreamCacheEntry'])
 
 export function scopeManagedMethods(methods: ManagedDb, driver: ManagedSqlDriver): ManagedDb {
   const entries = Object.entries(methods).map(([name, method]) => {