@preventive/triage 1.0.0-alpha.33 → 1.0.0-alpha.34

package/server-managed/http.ts

@@ -41,13 +41,17 @@
 //   GET  /api/admin/teams        → admin teams (+ members/repos) + pickers | 401/403
 //   POST /api/admin/teams        → admin creates a team | 401/403/409
 //   POST /api/admin/teams/rename → admin renames a team | 401/403/404/409
+//   POST /api/admin/teams/set-hidden → admin hides/restores a team | 401/403/404
 //   POST /api/admin/teams/delete → admin deletes a team | 401/403/404
 //   POST /api/admin/teams/{set,remove}-repo   → admin links/unlinks a repo (+path) | 401/403/404
 //   POST /api/admin/teams/{set,remove}-member → admin links/unlinks a user (+perms) | 401/403/404
 //   POST /api/auth/logout        → same-origin + CSRF, drops the session
+import { mergeLinkGroups } from './link-reports.ts'
+import { backfillFindingIds, reportEntries } from '@preventive/report'
 import type { IncomingMessage, ServerResponse } from 'node:http'
 import { pipeline } from 'node:stream/promises'
 import { ADVISORIES_TIMEOUT_MS, fetchBundleAdvisories } from './bundle-advisories.ts'
+import { auditCache } from './upstream-cache.ts'
 import type { BundleAdvisoryInventory } from './bundle-advisory-inventory.ts'
 import { UPLOAD_CHUNK_BYTES, type UploadKind, deleteUpload, putUploadPart, readUpload, validUpload, validUploadPart } from './uploads.ts'
 import { type BundleCache, type BundleCachePart, MAX_PACKAGE_INVENTORY_BYTES } from './bundle-cache.ts'
@@ -58,9 +62,10 @@ import { Buffer } from 'node:buffer'
 import { createHash, randomUUID } from 'node:crypto'
 import type { AvatarStore } from './avatar-store.ts'
 import type { BlobStore } from './blob-store.ts'
-import { bundleIntegrity, bundleKind, bundleRepo, reportBundleHashes } from './bundle.ts'
+import { bundleFilePrefix, bundleIntegrity, bundleKind, bundleRepo, reportBundleHashes } from './bundle.ts'
+import { resolveRepositoryImportLocation } from './repository-aliases.ts'
 import type { ManagedConfig } from './config.ts'
-import type { ManagedBundle, ManagedDb, ManagedSession, ReportRecord, SelectedRepo, StoredUser, TriageEventRow } from './db.ts'
+import type { BundleBuildConditions, BundleProvenance, BundleReuse, ManagedBundle, ManagedDb, ManagedSession, ReportRecord, SelectedRepo, StoredUser, TriageEventRow } from './db.ts'
 import type { OriginGate } from '../server-common/origin.ts'
 import { isRole, roleAtLeast } from '../common/managed/roles.ts'
 import { VISIBILITY_PERMISSIONS, parseTeamUserPermissions } from '../common/managed/permissions.ts'
@@ -85,9 +90,11 @@ import { acceptsReportMetadata } from './report-response.ts'
 import { TeamReportsError, loadTeamAnnotations, loadTeamReportsResponse, recheckTeam, teamFindingIds, teamSnapshot, teamSourcePaths, teamWorkspaceFindingIds } from './team-reports.ts'
 import { FINDING_CATALOG_PAGE_BYTES, FINDING_CATALOG_PAGE_COUNT, MAX_REPORT_QUERY_BYTES, MAX_REPORT_QUERY_COUNT } from './report-query.ts'
 import { lookupFixes, storedFixUrls } from './github-pulls.ts'
+import { lookupIssueLinks } from './github-issue-links.ts'
+import { visibleManagedIssues } from './managed-issues.ts'
 import { IssueError, MAX_ISSUE_BODY_BYTES, createGithubIssue, parseIssueContext, prepareGithubIssue } from './github-issues.ts'
 import { ISSUE_LOGIN_PATH, isIssueOAuthCallback, issueLoginRedirect, issueOAuthCallback } from './github-issue-oauth.ts'
-import { sendJson, writeResponse } from './http-response.ts'
+import { attachmentDisposition, sendJson, writeResponse } from './http-response.ts'
 import { triageWireEntry } from './triage-response.ts'
 import { handlePublicWorkspace } from './public-workspace.ts'
 import { serveUserTeamFeed } from './team-feed.ts'
@@ -119,6 +126,7 @@ const REPORT_PREFIX = '/api/admin/reports/'
 const ADMIN_BUNDLES_PATH = '/api/admin/bundles'
 const BUNDLE_CREATE_PATH = '/api/admin/bundles/create'
 const BUNDLE_SET_REPO_PATH = '/api/admin/bundles/set-repo'
+const BUNDLE_SET_VISIBLE_PATH = '/api/admin/bundles/set-visible'
 const BUNDLE_PREFIX = '/api/admin/bundles/'
 const MY_TEAMS_PATH = '/api/teams'
 const MY_REPORT_PREFIX = '/api/reports/'
@@ -127,29 +135,39 @@ const MY_REPORT_TRIAGE_HISTORY_SUFFIX = '/triage/history'
 const ADMIN_TEAMS_PATH = '/api/admin/teams'
 const TEAM_DELETE_PATH = '/api/admin/teams/delete'
 const TEAM_RENAME_PATH = '/api/admin/teams/rename'
+const TEAM_SET_HIDDEN_PATH = '/api/admin/teams/set-hidden'
 const TEAM_SET_REPO_PATH = '/api/admin/teams/set-repo'
 const TEAM_REMOVE_REPO_PATH = '/api/admin/teams/remove-repo'
 const TEAM_SET_MEMBER_PATH = '/api/admin/teams/set-member'
 const TEAM_REMOVE_MEMBER_PATH = '/api/admin/teams/remove-member'
 const MAX_TEAM_NAME = 100
 
-async function handleWorkspaceFixes(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, teamId: string): Promise<void> {
+async function handleWorkspaceFixes(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, teamId: string, reportId: string | null): Promise<void> {
   const s = await readWorkspaceSession(res, deps, cookie)
   if (!s) return
-  const snapshot = await teamSnapshot(deps.db, s.session.id, teamId)
+  const snapshot = await teamSnapshot(deps.db, s.session.id, teamId, reportId)
   const ids = [...await teamWorkspaceFindingIds(deps.db, deps.reportStore, snapshot)]
-  const urls = storedFixUrls(await deps.db.listTriage(ids))
+  const manualUrls = storedFixUrls(await deps.db.listTriage(ids))
+  const storedIssues = await deps.db.listManagedIssues(ids)
+  const issues = visibleManagedIssues(storedIssues, snapshot)
+  const visibleIds = new Set(issues.map(issue => issue.findingId))
+  const urls = [...new Set([...manualUrls, ...issues.flatMap(issue => [issue.issueUrl!, ...(issue.autoFixUrl ? [issue.autoFixUrl] : [])])])]
   await recheckTeam(deps.db, s.session.id, snapshot)
-  const fixes = await lookupFixes(deps.config, deps.db, snapshot, urls)
+  const result = issues.length > 0
+    ? await lookupIssueLinks(deps.config, deps.db, snapshot, urls, storedIssues.filter(issue => visibleIds.has(issue.findingId)))
+    : { fixes: await lookupFixes(deps.config, deps.db, snapshot, urls), updates: [] }
   // Cold report reads, token refresh and upstream batches can outlive changes
   // to security/links, team grants, publication, sessions or the Fix links.
   const currentUrls = storedFixUrls(await deps.db.listTriage(ids))
   if (await readWorkspaceSession(res, deps, cookie) == null) return
   await recheckTeam(deps.db, s.session.id, snapshot)
-  if (JSON.stringify(currentUrls) !== JSON.stringify(urls)) {
+  if (JSON.stringify(currentUrls) !== JSON.stringify(manualUrls)) {
     sendJson(res, 404, { error: 'workspace-changed' }); return
   }
-  sendJson(res, 200, { fixes })
+  if (result.updates.length > 0 && !await deps.db.applyManagedIssueFixes(s.session.id, snapshot, result.updates)) {
+    sendJson(res, 404, { error: 'workspace-changed' }); return
+  }
+  sendJson(res, 200, { fixes: result.fixes })
 }
 
 async function handleWorkspaceIssue(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps,
@@ -787,6 +805,19 @@ async function handleSetReportVisible(req: IncomingMessage, res: ServerResponse,
   sendJson(res, 200, { ok: true, visible })
 }
 
+async function handleSetBundleVisible(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
+  const s = await manageMutation(req, res, deps, cookie)
+  if (s == null) return
+  let body: unknown
+  try { body = await readJsonBody(req) } catch { sendJson(res, 400, { error: 'bad-body' }); return }
+  const bundleId = (body as { bundleId?: unknown } | null)?.bundleId
+  const visible = (body as { visible?: unknown } | null)?.visible
+  if (typeof bundleId !== 'string' || typeof visible !== 'boolean') { sendJson(res, 400, { error: 'bad-request' }); return }
+  const { bundle, user } = await deps.db.mutateBundle(s.session.id, bundleId, { type: 'visibility', visible })
+  if (bundle.visible !== visible) await activity(deps, user, 'visibility', visible ? 'published a bundle' : 'hid a bundle', { bundleId, report: bundle.filename, repo: await repositoryName(deps, bundle.repoId) })
+  sendJson(res, 200, { ok: true, visible })
+}
+
 // POST /api/admin/bundles/set-repo — attach / detach a stored bundle's repo link
 // and directory (same shape as reports). Body { bundleId, repoId, directory }.
 async function handleSetBundleRepo(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
@@ -870,7 +901,22 @@ async function handleUploadReport(req: IncomingMessage, res: ServerResponse, dep
   if (bytes.length === 0) { sendJson(res, 400, { error: 'empty' }); return }
   const filename = sanitizeFilename(firstHeader(req.headers['x-report-filename']), 'report.json')
   const parsed = readManagedReport(bytes.toString('utf8'), filename)
-  const repoGithub = parsed.data == null ? null : reportRepoGithub(parsed.data)
+  if (parsed.data == null) {
+    sendJson(res, 400, { error: 'invalid-report', reason: parsed.reason ?? 'Unrecognized report format' })
+    return
+  }
+  if (parsed.format === 'links' || parsed.data.source === 'links') {
+    const result = await deps.db.importLinkReport(s.session.id, filename, bytes.toString('utf8'))
+    sendJson(res, result.reused ? 200 : 201, { ...result.report, kind: 'links', deduped: result.reused })
+    return
+  }
+  const repoGithub = reportRepoGithub(parsed.data)
+  // The browser splits these documents before upload. Enforce that boundary
+  // for direct API clients too: one stored record has only one repo's ACL.
+  if (parsed.format === 'markdown-generic' && repoGithub == null) {
+    sendJson(res, 400, { error: 'invalid-report', reason: 'Multi-product Markdown must be split into one report per product before upload.' })
+    return
+  }
   const repoEmbedded = repoGithub != null
   const rawHeaderDirectory = firstHeader(req.headers['x-repo-directory']) ?? ''
   let headerDirectory = rawHeaderDirectory
@@ -880,23 +926,26 @@ async function handleUploadReport(req: IncomingMessage, res: ServerResponse, dep
   const requestedDirectory = repoEmbedded ? parsed.data?.repo?.directory : headerDirectory
   const normalizedDirectory = normalizeTeamPath(requestedDirectory)
   if (!normalizedDirectory.ok) { sendJson(res, 400, { error: 'bad-directory' }); return }
-  const directory = normalizedDirectory.path ?? ''
-  const analyzer = parsed.data != null && typeof parsed.data.source === 'string' ? parsed.data.source : null
-  const selected = await deps.db.listSelectedRepos()
-  let matchedRepo = repoGithub == null ? null : selected.find((repo) => repo.fullName.toLocaleLowerCase() === repoGithub.toLocaleLowerCase())
-  if (repoGithub != null && matchedRepo == null) { sendJson(res, 400, { error: 'repo-not-connected', repo: repoGithub }); return }
+  let directory = normalizedDirectory.path ?? ''
+  const analyzer = typeof parsed.data.source === 'string' ? parsed.data.source : null
+  const sha256 = createHash('sha256').update(bytes).digest('base64url')
+  // Reuploads retain their stored location, including after an alias changes.
+  const existing = await deps.db.getReportByHash(sha256, analyzer)
+  let repoId: number | null = null
+  if (repoGithub != null) {
+    const location = existing ? { repoId: existing.repoId, directory: existing.repoDirectory }
+      : await deps.db.getRepositoryImportLocation(repoGithub, directory)
+    repoId = location.repoId; directory = location.directory
+    if (!existing && repoId == null) { sendJson(res, 400, { error: 'repo-not-connected', repo: repoGithub }); return }
+  }
   // When the report has no repository header, X-Repo-Id lets the managed uploader
   // assign it at upload time. Clients may omit it and attach the report later.
   if (repoGithub == null) {
     const legacyRepo = await resolveUploadRepoId(req, res, deps)
     if (!legacyRepo.ok) return
-    matchedRepo = legacyRepo.repoId == null ? null : selected.find((repo) => repo.repoId === legacyRepo.repoId) ?? null
+    repoId = legacyRepo.repoId
   }
-  if (matchedRepo && s.user.role !== 'admin' && !(await deps.db.userCanReadRepoPath(s.user.id, matchedRepo.repoId, directory))) { sendJson(res, 403, { error: 'repo-forbidden' }); return }
-  const sha256 = createHash('sha256').update(bytes).digest('base64url')
-  // The analyzer also distinguishes a CSV from the same bytes previously
-  // uploaded under a filename that did not identify it as a report.
-  const existing = await deps.db.getReportByHash(sha256, analyzer)
+  if (repoId != null && s.user.role !== 'admin' && !(await deps.db.userCanReadRepoPath(s.user.id, repoId, directory))) { sendJson(res, 403, { error: 'repo-forbidden' }); return }
   if (existing) { await sendUploadedReport(req, res, deps, cookie, existing, true); return }
   const id = randomUUID()
   const contentType = (firstHeader(req.headers['content-type']) ?? '').split(';', 1)[0]!.trim() || 'application/json'
@@ -906,7 +955,7 @@ async function handleUploadReport(req: IncomingMessage, res: ServerResponse, dep
   try {
     report = await deps.db.insertOrReuseReport({
       id, filename, contentType, byteSize: bytes.length, sha256, dataKey,
-      uploadedBy: s.user.id, uploadedByLogin: s.user.login, repoId: matchedRepo?.repoId ?? null,
+      uploadedBy: s.user.id, uploadedByLogin: s.user.login, repoId,
       repoDirectory: directory, repoEmbedded, analyzer, visible: false, bundleId, bundleIntegrity: integrity,
     }, Date.now(), s.session.id)
   } catch (err) {
@@ -938,13 +987,10 @@ async function handleGetReport(res: ServerResponse, deps: ManagedHttpDeps, cooki
   if (bytes == null) { sendJson(res, 503, { error: 'unavailable' }); return }
   const current = await readSession(deps.config, deps.db, cookie, Date.now())
   if (!current || !roleAtLeast(current.user.role, 'manage') || !(await canViewReport(deps, current.user, id))) { sendJson(res, 404, { error: 'no-report' }); return }
-  // The stored filename is already control-/path-stripped (sanitizeReportFilename
-  // at upload); only a double-quote could break the quoted Content-Disposition.
-  const dispoName = rec.filename.replaceAll('"', '')
   res.writeHead(200, {
     'content-type': rec.contentType,
     'content-length': String(bytes.length),
-    'content-disposition': `attachment; filename="${dispoName}"`,
+    'content-disposition': attachmentDisposition(rec.filename),
     'x-content-type-options': 'nosniff',
     'cache-control': 'no-store',
   })
@@ -973,7 +1019,7 @@ async function canAccessBundle(deps: ManagedHttpDeps, user: StoredUser, id: stri
   if (!rec) return false
   if (user.role === 'admin') return true
   if (user.role === 'manage') return deps.db.userCanReadBundle(user.id, id)
-  return rec.repoId !== null && deps.db.userCanReadRepoPath(user.id, rec.repoId, rec.repoDirectory)
+  return rec.visible && rec.repoId !== null && deps.db.userCanReadRepoPath(user.id, rec.repoId, rec.repoDirectory)
 }
 
 async function bundleRepos(deps: ManagedHttpDeps, user: StoredUser) {
@@ -1115,7 +1161,7 @@ async function handleBundleCache(req: IncomingMessage, res: ServerResponse, deps
 
 // Published dependency advisories require security access, independently of access to
 // unpublished dependency findings. Managers retain their normal bundle access.
-async function handleBundleAdvisories(res: ServerResponse, deps: ManagedHttpDeps, session: ManagedSession, id: string, teamId: string | null, reason: string, repoAdvisories: boolean) {
+async function handleBundleAdvisories(res: ServerResponse, deps: ManagedHttpDeps, session: ManagedSession, id: string, teamId: string | null, reason: string, repoAdvisories: boolean, details: boolean) {
   const authorize = async () => {
     const access = await deps.db.getBundleAccessSnapshot(session.id, Date.now(), id, teamId)
     if (!access) { sendJson(res, 401, { error: 'unauthenticated' }); return null }
@@ -1147,7 +1193,9 @@ async function handleBundleAdvisories(res: ServerResponse, deps: ManagedHttpDeps
       ...init, signal: init?.signal ? AbortSignal.any([controller.signal, init.signal]) : controller.signal,
     })) : null
     if (res.destroyed || (needsGithub && !(await authorize()))) return
-    const result = await fetchBundleAdvisories(inventory.packages, controller.signal, { debug: deps.config.debug, repoAdvisories, githubToken })
+    const result = await fetchBundleAdvisories(inventory.packages, controller.signal, {
+      debug: deps.config.debug, repoAdvisories, details, githubToken, cache: auditCache(deps.config.upstreamCacheDir, deps.db, controller.signal, deps.config.debug),
+    })
     if (res.destroyed || !(await authorize())) return
     // Return just inventory and public advisories, never source or report data.
     sendJson(res, result.status, result.status === 200 ? { ...inventory, advisories: result.body } : result.body)
@@ -1176,10 +1224,18 @@ async function handleListBundles(res: ServerResponse, deps: ManagedHttpDeps, ses
 }
 
 type UploadedBundle = Pick<ManagedBundle, 'id' | 'slug' | 'integrity' | 'filename' | 'byteSize' | 'repoId' | 'repoDirectory'>
-async function sendUploadedBundle(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, bundle: UploadedBundle, deduped: boolean): Promise<void> {
+// `reuse` describes a repeated upload/build of an existing row (see reuseBundle).
+async function sendUploadedBundle(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined,
+  bundle: UploadedBundle, reuse?: Omit<BundleReuse, 'rename'>): Promise<void> {
   const s = await manageMutation(req, res, deps, cookie)
   if (!s) return
-  if (deduped && !(await canAccessBundle(deps, s.user, bundle.id))) { sendJson(res, 409, { error: 'bundle-conflict' }); return }
+  const deduped = reuse != null
+  if (deduped) {
+    // Authorized in the same transaction as the rename. A server build labels
+    // even a row the caller cannot see: the bytes are this server's own output.
+    if (await deps.db.reuseBundleUpload(s.session.id, bundle.id, reuse)) bundle = await deps.db.getBundle(bundle.id) ?? bundle
+    if (!(await canAccessBundle(deps, s.user, bundle.id))) { sendJson(res, 409, { error: 'bundle-conflict' }); return }
+  }
   const { id, slug, integrity, filename, byteSize, repoId, repoDirectory } = bundle
   // Re-uploading also repairs reports uploaded while the bundle was inaccessible.
   await deps.db.linkReportsToBundle(integrity, id, s.user.role === 'admin' ? undefined : s.user.id)
@@ -1214,6 +1270,7 @@ async function handleCreateBundle(req: IncomingMessage, res: ServerResponse, dep
       signal.throwIfAborted()
       const built = await buildRepositoryBundle(access.user.id, {
         input, github: access.repo.fullName, token: reader.readToken(), maxBytes: deps.config.maxBundleBytes, scopes: access.scopes,
+        cacheDir: deps.config.upstreamCacheDir ?? null,
       }, signal)
       signal.throwIfAborted()
       await reader.recheckAccess()
@@ -1223,7 +1280,9 @@ async function handleCreateBundle(req: IncomingMessage, res: ServerResponse, dep
         throw new BundleBuildError(409, 'repository-changed')
       }
       signal.throwIfAborted()
-      await storeUploadedBundle(req, res, deps, cookie, current, Buffer.from(built.bytes), input.repoId, built.directory, built.filename)
+      const bytes = Buffer.from(built.bytes)
+      await storeUploadedBundle(req, res, deps, cookie, current, bytes, input.repoId, built.directory, built.filename, 'build',
+        bundleIntegrity(bytes), input.conditions)
     })
   } catch (error) {
     if (res.destroyed || controller.signal.aborted) return
@@ -1241,7 +1300,8 @@ async function handleCreateBundle(req: IncomingMessage, res: ServerResponse, dep
 // X-Repo-Directory assign a repository location; Stasis repo headers default
 // to a matching connected repository within the uploader's access, otherwise
 // the bundle stays unattached. Its identity is its content hash (sha512), UNIQUE — a
-// re-upload of identical bytes dedupes to the existing row (no second copy).
+// re-upload of identical bytes dedupes to the existing row (no second copy) and
+// renames it, unless the row was built on this server.
 // After storing, any reports that declared this integrity but weren't linked yet
 // get attached (auto-link). 413 over the cap, 400 on empty.
 async function handleUploadBundle(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
@@ -1275,12 +1335,18 @@ async function handleUploadBundle(req: IncomingMessage, res: ServerResponse, dep
   if (!existing && repo.repoId == null && kind === 'stasis') {
     const embedded = await bundleRepo(bytes)
     const github = reportRepoGithub({ repo: embedded })
-    const selected = github == null ? null : (await deps.db.listSelectedRepos())
-      .find(candidate => candidate.fullName.toLowerCase() === github.toLowerCase())
-    if (selected) {
-      repo.repoId = selected.repoId
+    const embeddedDirectory = normalizeTeamPath(embedded?.directory)
+    // Invalid optional metadata must not reject an otherwise unattached bundle.
+    // Only repository-wide aliases/direct connections can resolve without a
+    // valid directory; do not decode file paths or match directory aliases.
+    const location = github == null ? null : embeddedDirectory.ok
+      ? await resolveRepositoryImportLocation(deps.db, github, embeddedDirectory.path ?? '', () => bundleFilePrefix(bytes))
+      : await deps.db.getRepositoryImportLocation(github, '')
+    if (location?.repoId != null) {
+      repo.repoId = location.repoId
       if (req.headers['x-repo-directory'] == null) {
-        rawDirectory = embedded?.directory ?? ''
+        if (!embeddedDirectory.ok) { sendJson(res, 400, { error: 'bad-directory' }); return }
+        rawDirectory = location.directory
         inferredLocation = true
       }
     }
@@ -1297,19 +1363,21 @@ async function handleUploadBundle(req: IncomingMessage, res: ServerResponse, dep
     repo.repoId = null
     directory = ''
   }
-  await storeUploadedBundle(req, res, deps, cookie, s, bytes, repo.repoId, directory, filename, integrity)
+  await storeUploadedBundle(req, res, deps, cookie, s, bytes, repo.repoId, directory, filename, 'upload', integrity)
 }
 
 async function storeUploadedBundle(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined,
-  s: { session: ManagedSession; user: StoredUser }, bytes: Buffer, repoId: number | null, directory: string, filename: string, integrity = bundleIntegrity(bytes)): Promise<void> {
+  s: { session: ManagedSession; user: StoredUser }, bytes: Buffer, repoId: number | null, directory: string, filename: string,
+  provenance: BundleProvenance, integrity = bundleIntegrity(bytes), buildConditions: BundleBuildConditions | null = null): Promise<void> {
+  const kind = bundleKind(filename)
+  const reuse = { provenance, filename, kind, buildConditions }
   const existing = await deps.db.getBundleByIntegrity(integrity)
-  if (existing) { await sendUploadedBundle(req, res, deps, cookie, existing, true); return }
+  if (existing) { await sendUploadedBundle(req, res, deps, cookie, existing, reuse); return }
   const id = randomUUID()
-  const kind = bundleKind(filename)
   const dataKey = await deps.bundleStore.put(id, bytes, kind)
   try {
     await deps.db.insertBundle({
-      id, integrity, filename, kind, dataKey,
+      id, integrity, filename, kind, dataKey, provenance, buildConditions,
       byteSize: bytes.length, uploadedBy: s.user.id, uploadedByLogin: s.user.login, repoId, repoDirectory: directory,
     }, Date.now(), s.session.id)
   } catch (err) {
@@ -1324,12 +1392,12 @@ async function storeUploadedBundle(req: IncomingMessage, res: ServerResponse, de
     if (raced?.id !== id) await deps.bundleStore.delete(id).catch(() => {})
     if (err instanceof ManagedMutationError) throw err
     if (!raced) throw err
-    if (raced.id !== id) { await sendUploadedBundle(req, res, deps, cookie, raced, true); return }
+    if (raced.id !== id) { await sendUploadedBundle(req, res, deps, cookie, raced, reuse); return }
     // Our insert committed: continue with the ordinary creation response.
   }
   const stored = await deps.db.getBundle(id)
   if (!stored) { sendJson(res, 404, { error: 'no-bundle' }); return }
-  await sendUploadedBundle(req, res, deps, cookie, stored, false)
+  await sendUploadedBundle(req, res, deps, cookie, stored)
 }
 
 // GET /api/admin/bundles/<id> — download a stored bundle (admin|manage). Bytes
@@ -1348,12 +1416,11 @@ async function handleGetBundle(req: IncomingMessage, res: ServerResponse, deps:
     stored.stream.destroy()
     sendJson(res, current ? 404 : 401, { error: 'no-bundle' }); return
   }
-  const dispoName = rec.filename.replaceAll('"', '')
   res.writeHead(200, {
     'content-type': 'application/octet-stream',
     ...(rec.kind === 'sourcemap' ? { 'content-encoding': 'br' } : {}),
     ...(stored.size == null ? {} : { 'content-length': String(stored.size) }),
-    'content-disposition': `attachment; filename="${dispoName}"`,
+    'content-disposition': attachmentDisposition(rec.filename),
     'x-content-type-options': 'nosniff',
     'cache-control': 'no-store',
   })
@@ -1470,6 +1537,73 @@ async function handleReportSources(req: IncomingMessage, res: ServerResponse, de
   try { await pipeline(cached.stream, res) } catch { res.destroy() }
 }
 
+async function reportIds(data: unknown): Promise<Set<string>> {
+  const findings = (reportEntries(data) ?? []).flat().filter((f): f is Record<string, unknown> => f !== null && typeof f === 'object' && !Array.isArray(f))
+  await backfillFindingIds(findings)
+  return new Set(findings.flatMap(f => typeof f['id'] === 'string' ? [f['id']] : []))
+}
+
+async function handleDeduplication(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, id?: string): Promise<void> {
+  const method = req.method ?? 'GET'
+  if (!(id ? ['GET', 'PATCH'] : ['GET', 'POST']).includes(method)) { send405(res, id ? 'GET, PATCH' : 'GET, POST'); return }
+  const s = method === 'GET' ? await readSession(deps.config, deps.db, cookie, Date.now()) : await checkMutation(req, res, deps, cookie)
+  if (!s) { if (method === 'GET') sendJson(res, 401, { error: 'unauthenticated' }); return }
+  if (s.user.role !== 'admin') { sendJson(res, 403, { error: 'forbidden' }); return }
+  if (method === 'GET') { sendJson(res, 200, id ? await deps.db.getLinkReport(s.session.id, id) : { reports: await deps.db.listLinkReports() }); return }
+  if (id) {
+    let body
+    try { body = await readJsonBody(req, 1024) } catch { sendJson(res, 400, { error: 'bad-body' }); return }
+    const enabled = (body as { enabled?: unknown } | null)?.enabled
+    if (typeof enabled !== 'boolean') { sendJson(res, 400, { error: 'bad-enabled' }); return }
+    await deps.db.setLinkReportEnabled(s.session.id, id, enabled)
+    sendJson(res, 200, { ok: true }); return
+  }
+  let bytes: Buffer
+  try { bytes = await readBodyBytes(req, deps.config.maxReportBytes) }
+  catch (error) { const large = error instanceof Error && error.message === 'too-large'; sendJson(res, large ? 413 : 400, { error: large ? 'too-large' : 'bad-body' }); return }
+  const filename = sanitizeFilename(firstHeader(req.headers['x-report-filename']), 'report.link.json')
+  const result = await deps.db.importLinkReport(s.session.id, filename, bytes.toString('utf8'))
+  sendJson(res, result.reused ? 200 : 201, { ...result.report, deduped: result.reused })
+}
+
+async function handleRepositoryAliases(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, id?: string): Promise<void> {
+  const method = req.method ?? 'GET'
+  if (!(id ? ['PATCH', 'DELETE'] : ['GET', 'POST']).includes(method)) { send405(res, id ? 'PATCH, DELETE' : 'GET, POST'); return }
+  const s = method === 'GET' ? await readAdminSession(res, deps, cookie) : await checkMutation(req, res, deps, cookie)
+  if (!s) return
+  if (s.user.role !== 'admin') { sendJson(res, 403, { error: 'forbidden' }); return }
+  if (method === 'GET') {
+    sendJson(res, 200, { aliases: await deps.db.listRepositoryAliases(), repos: await deps.db.listAllRepos() }); return
+  }
+  if (method === 'DELETE') {
+    await deps.db.deleteRepositoryAlias(s.session.id, id!)
+    sendJson(res, 200, { ok: true }); return
+  }
+  let body
+  try { body = await readJsonBody(req, 8192) } catch { sendJson(res, 400, { error: 'bad-body' }); return }
+  const alias = await deps.db.saveRepositoryAlias(s.session.id, id ?? null, body)
+  sendJson(res, id ? 200 : 201, alias)
+}
+
+// Live suggestions do not mutate archived content or its stored assignment.
+// Managers can resolve only destinations their current repository grants cover.
+async function handleRepositorySuggestion(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
+  if (req.method !== 'GET') { send405(res, 'GET'); return }
+  if (!await readManageSession(res, deps, cookie)) return
+  const params = new URL(req.url!, 'http://localhost').searchParams
+  const github = reportRepoGithub({ repo: { github: params.get('repo') } })
+  const directory = normalizeTeamPath(params.get('directory'))
+  const filePrefix = normalizeTeamPath(params.get('filePrefix'))
+  if (!github || !directory.ok || !filePrefix.ok) { sendJson(res, 400, { error: 'bad-location' }); return }
+  const location = await deps.db.getRepositoryImportLocation(github, directory.path ?? '', filePrefix.path ?? '')
+  const repo = location.repoId == null ? null : (await deps.db.listSelectedRepos()).find(row => row.repoId === location.repoId)
+  const s = await readManageSession(res, deps, cookie)
+  if (!s) return
+  const allowed = repo && (s.user.role === 'admin' || await deps.db.userCanReadRepoPath(s.user.id, repo.repoId, location.directory))
+  sendJson(res, 200, { location: allowed ? { repoId: repo.repoId, github: repo.fullName, directory: location.directory,
+    mapped: github.toLowerCase() !== repo.fullName.toLowerCase() || (directory.path ?? '') !== location.directory } : null })
+}
+
 // GET /api/reports/<id> — admin/manager preview, within management access.
 // Accept: application/json includes parsed, filtered data and the server's repo
 // assignment. Other callers retain the raw text/plain response. The
@@ -1479,32 +1613,33 @@ async function handleReportSources(req: IncomingMessage, res: ServerResponse, de
 async function handleViewReport(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, id: string): Promise<void> {
   const s = await readManageSession(res, deps, cookie)
   if (s == null) return
-  if (!(await canViewReport(deps, s.user, id))) { sendJson(res, 404, { error: 'no-report' }); return }
+  const snapshot = await deps.db.getReportAccessSnapshot(s.session.id, Date.now(), [id])
+  const access = snapshot?.reports[0]
+  if (!snapshot || !access || !roleAtLeast(snapshot.user.role, 'manage')) { sendJson(res, 404, { error: 'no-report' }); return }
   const bytes = await deps.reportStore.get(id)
   if (bytes == null) { sendJson(res, 503, { error: 'unavailable' }); return }
-  const current = await readSession(deps.config, deps.db, cookie, Date.now())
-  if (!current || !roleAtLeast(current.user.role, 'manage') || !(await canViewReport(deps, current.user, id))) { sendJson(res, 404, { error: 'no-report' }); return }
-  if (acceptsReportMetadata(req.headers.accept)) {
-    const report = await deps.db.getReport(id)
-    if (report == null) { sendJson(res, 404, { error: 'no-report' }); return }
-    const repo = { github: await repositoryName(deps, report.repoId), directory: report.repoDirectory }
-    const { data } = readManagedReport(bytes.toString('utf8'), report.filename)
+  const metadata = acceptsReportMetadata(req.headers.accept)
+  let envelope
+  if (metadata) {
+    const { data } = readManagedReport(bytes.toString('utf8'), access.filename)
     if (data == null) { sendJson(res, 422, { error: 'unreadable-report' }); return }
-    sendJson(res, 200, {
-      data,
-      repo,
-    }, { vary: 'Accept', 'x-content-type-options': 'nosniff' })
-    return
+    const links = mergeLinkGroups(snapshot.linkRevision ? await deps.db.getEnabledLinkGroups(snapshot.linkRevision) : [], await reportIds(data))
+    envelope = { data, repo: access.repo, ...(links.length > 0 ? { links } : {}) }
+  }
+  // Link decryption and finding-ID backfill can outlast access or link changes.
+  const current = await deps.db.getReportAccessSnapshot(s.session.id, Date.now(), [id])
+  if (!current || current.user.id !== snapshot.user.id || current.user.role !== snapshot.user.role
+    || current.linkRevision !== snapshot.linkRevision || JSON.stringify(current.reports) !== JSON.stringify(snapshot.reports)) {
+    sendJson(res, 404, { error: 'no-report' }); return
+  }
+  if (metadata) {
+    sendJson(res, 200, envelope, { vary: 'Accept', 'x-content-type-options': 'nosniff' }); return
   }
-  const out = bytes
   res.writeHead(200, {
-    'content-type': 'text/plain; charset=utf-8',
-    'content-length': String(out.length),
-    'x-content-type-options': 'nosniff',
-    'cache-control': 'no-store',
-    vary: 'Accept',
+    'content-type': 'text/plain; charset=utf-8', 'content-length': String(bytes.length),
+    'x-content-type-options': 'nosniff', 'cache-control': 'no-store', vary: 'Accept',
   })
-  writeResponse(res, out)
+  writeResponse(res, bytes)
 }
 
 // A read-only POST avoids URL-length limits when a workspace has many reports.
@@ -1533,6 +1668,7 @@ async function handleQueryReports(req: IncomingMessage, res: ServerResponse, dep
   // Overlap remote blob reads, retaining only each report's encoded response
   // after processing. Check actual bytes too if storage and metadata disagree.
   const parts = [Buffer.from('{"reports":[')]
+  const findingIds = new Set<string>()
   let inputBytes = 0, outputBytes = parts[0]!.length + 2
   let next = 0, stopped = false
   let inFlightBytes = 0
@@ -1562,6 +1698,7 @@ async function handleQueryReports(req: IncomingMessage, res: ServerResponse, dep
           if (inputBytes > MAX_REPORT_QUERY_BYTES) return fail(413, 'batch-too-large')
           const { data } = readManagedReport(bytes.toString('utf8'), access.filename)
           if (!data) return fail(422, 'unreadable-report')
+          for (const findingId of await reportIds(data)) findingIds.add(findingId)
           const part = Buffer.from(`${index > 0 ? ',' : ''}${JSON.stringify({ id, data: filterReportData(data, access.permissions, access.repo), repo: access.repo })}`)
           outputBytes += part.length
           if (outputBytes > MAX_REPORT_QUERY_BYTES) return fail(413, 'batch-too-large')
@@ -1586,23 +1723,27 @@ async function handleQueryReports(req: IncomingMessage, res: ServerResponse, dep
     if (result.status === 'rejected') throw result.reason
     if (result.value) { sendJson(res, result.value.status, { error: result.value.error }); return }
   }
+  const links = mergeLinkGroups(snapshot.linkRevision ? await deps.db.getEnabledLinkGroups(snapshot.linkRevision) : [], findingIds)
   // Access to an earlier report may change while a later blob is fetched.
   // Reject the whole answer if any content/access/assignment snapshot changed.
   const current = await deps.db.getReportAccessSnapshot(s.session.id, Date.now(), ids)
   if (!current || current.user.id !== snapshot.user.id) { sendJson(res, 401, { error: 'unauthenticated' }); return }
-  if (current.user.role !== snapshot.user.role || current.reports.length !== reports.size
+  if (current.linkRevision !== snapshot.linkRevision || current.user.role !== snapshot.user.role || current.reports.length !== reports.size
     || current.reports.some(report => JSON.stringify(report) !== JSON.stringify(reports.get(report.id)))) {
     sendJson(res, 404, { error: 'no-report' }); return
   }
-  parts.push(Buffer.from(']}'))
+  const suffix = Buffer.from(links.length > 0 ? `],"links":${JSON.stringify(links)}}` : ']}')
+  outputBytes += suffix.length - 2
+  if (outputBytes > MAX_REPORT_QUERY_BYTES) { sendJson(res, 413, { error: 'batch-too-large' }); return }
+  parts.push(suffix)
   res.writeHead(200, { 'content-type': 'application/json', 'cache-control': 'no-store', 'x-content-type-options': 'nosniff' })
   writeResponse(res, Buffer.concat(parts, outputBytes))
 }
 
-// The server selects the complete workspace; clients cannot omit a report
-// or links file to evade classification through the rest of their team.
-async function handleTeamReports(res: ServerResponse, deps: ManagedHttpDeps, session: ManagedSession, teamId: string): Promise<void> {
-  const snapshot = await teamSnapshot(deps.db, session.id, teamId)
+// The server selects the complete published workspace for classification.
+// Privileged hidden-report previews are independently scoped and bounded.
+async function handleTeamReports(res: ServerResponse, deps: ManagedHttpDeps, session: ManagedSession, teamId: string, reportId: string | null): Promise<void> {
+  const snapshot = await teamSnapshot(deps.db, session.id, teamId, reportId)
   const body = await loadTeamReportsResponse(deps.db, deps.reportStore, snapshot)
   await recheckTeam(deps.db, session.id, snapshot)
   res.writeHead(200, { 'content-type': 'application/json', 'cache-control': 'no-store', 'x-content-type-options': 'nosniff' })
@@ -1900,6 +2041,22 @@ async function handleRenameTeam(req: IncomingMessage, res: ServerResponse, deps:
   sendJson(res, 200, { ok: true, name })
 }
 
+// Hidden teams retain their configuration but grant no access or sidebar presence.
+async function handleSetTeamHidden(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
+  const s = await adminMutation(req, res, deps, cookie)
+  if (s == null) return
+  let body: unknown
+  try { body = await readJsonBody(req) } catch { sendJson(res, 400, { error: 'bad-body' }); return }
+  const teamId = (body as { teamId?: unknown } | null)?.teamId
+  const hidden = (body as { hidden?: unknown } | null)?.hidden
+  if (typeof teamId !== 'string' || typeof hidden !== 'boolean') { sendJson(res, 400, { error: 'bad-request' }); return }
+  const team = await deps.db.getTeam(teamId)
+  if (await readAdminSession(res, deps, cookie) == null) return
+  if (!(await deps.db.setTeamHidden(teamId, hidden, Date.now()))) { sendJson(res, 404, { error: 'no-team' }); return }
+  if (team?.hidden !== hidden) await activity(deps, s.user, 'access', `${hidden ? 'hid' : 'restored'} team ${team?.name ?? teamId}`)
+  sendJson(res, 200, { ok: true, hidden })
+}
+
 // POST /api/admin/teams/delete — drop a team (its links cascade). Body { teamId }.
 async function handleDeleteTeam(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
   const s = await adminMutation(req, res, deps, cookie)
@@ -2115,6 +2272,11 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
     if (issueRoute) {
       await handleWorkspaceIssue(req, res, deps, cookie, decodeURIComponent(issueRoute[1]!), url.searchParams); return
     }
+    const deduplication = /^\/api\/admin\/deduplication(?:\/([a-f\d-]{36}))?$/iu.exec(path)
+    if (deduplication) { await handleDeduplication(req, res, deps, cookie, deduplication[1]); return }
+    const repositoryAliases = /^\/api\/admin\/repositories\/aliases(?:\/([a-f\d-]{36}))?$/iu.exec(path)
+    if (repositoryAliases) { await handleRepositoryAliases(req, res, deps, cookie, repositoryAliases[1]); return }
+    if (path === '/api/admin/repositories/resolve') { await handleRepositorySuggestion(req, res, deps, cookie); return }
     if (path === '/api/admin/links') {
       if (!config.allowShare) { sendJson(res, 404, { error: 'sharing-disabled' }); return }
       if (method !== 'GET') { send405(res, 'GET'); return }
@@ -2214,7 +2376,7 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
     const bundleAdvisories = /^\/api\/bundles\/([a-f\d-]{36})\/advisories$/iu.exec(path)
     if (bundleAdvisories) {
       if (method !== 'GET') { send405(res, 'GET'); return }
-      await handleBundleAdvisories(res, deps, workspaceSession!.session, bundleAdvisories[1]!, url.searchParams.get('team'), url.searchParams.get('reason') ?? '', url.searchParams.get('repoAdvisories') === 'true')
+      await handleBundleAdvisories(res, deps, workspaceSession!.session, bundleAdvisories[1]!, url.searchParams.get('team'), url.searchParams.get('reason') ?? '', url.searchParams.get('repoAdvisories') === 'true', url.searchParams.get('details') === 'true')
       return
     }
     const bundleRead = /^\/api\/bundles\/([a-f\d-]{36})\/(metadata|contents|download)$/iu.exec(path)
@@ -2238,6 +2400,10 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
       if (method !== 'POST') { send405(res, 'POST'); return }
       await handleSetBundleRepo(req, res, deps, cookie); return
     }
+    if (path === BUNDLE_SET_VISIBLE_PATH) {
+      if (method !== 'POST') { send405(res, 'POST'); return }
+      await handleSetBundleVisible(req, res, deps, cookie); return
+    }
     if (path.startsWith(BUNDLE_PREFIX)) {
       const id = path.slice(BUNDLE_PREFIX.length)
       if (method === 'GET') { await handleGetBundle(req, res, deps, workspaceSession!.session, id); return }
@@ -2250,18 +2416,19 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
       const s = await readWorkspaceSession(res, deps, cookie)
       if (!s) return
       const teamId = teamFeed?.[1] ?? null
-      if (teamId) await teamSnapshot(db, s.session.id, teamId)
-      await serveUserTeamFeed(res, deps, s.session.id, s.user, teamId); return
+      const reportId = url.searchParams.get('reportId')
+      if (teamId) await teamSnapshot(db, s.session.id, teamId, reportId)
+      await serveUserTeamFeed(res, deps, s.session.id, s.user, teamId, { reportId }); return
     }
     const teamFixes = /^\/api\/teams\/([^/]+)\/fixes$/u.exec(path)
     if (teamFixes) {
       if (method !== 'GET') { send405(res, 'GET'); return }
-      await handleWorkspaceFixes(res, deps, cookie, teamFixes[1]!); return
+      await handleWorkspaceFixes(res, deps, cookie, teamFixes[1]!, url.searchParams.get('reportId')); return
     }
     const teamAnnotations = /^\/api\/teams\/([^/]+)\/annotations$/u.exec(path)
     if (teamAnnotations) {
       if (method !== 'GET') { send405(res, 'GET'); return }
-      const snapshot = await teamSnapshot(db, workspaceSession!.session.id, teamAnnotations[1]!)
+      const snapshot = await teamSnapshot(db, workspaceSession!.session.id, teamAnnotations[1]!, url.searchParams.get('reportId'))
       const annotations = await loadTeamAnnotations(db, deps.reportStore, snapshot, url.searchParams.get('reportId'))
       await recheckTeam(db, workspaceSession!.session.id, snapshot)
       sendJson(res, 200, annotations); return
@@ -2269,7 +2436,7 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
     const teamReports = /^\/api\/teams\/([^/]+)\/reports$/u.exec(path)
     if (teamReports) {
       if (method !== 'GET') { send405(res, 'GET'); return }
-      await handleTeamReports(res, deps, workspaceSession!.session, teamReports[1]!); return
+      await handleTeamReports(res, deps, workspaceSession!.session, teamReports[1]!, url.searchParams.get('reportId')); return
     }
     if (path === '/api/reports/query') {
       if (method !== 'POST') { send405(res, 'POST'); return }
@@ -2316,11 +2483,12 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
       if (method === 'POST') { await handleCreateTeam(req, res, deps, cookie); return }
       send405(res, 'GET, POST'); return
     }
-    if (path === TEAM_DELETE_PATH || path === TEAM_RENAME_PATH || path === TEAM_SET_REPO_PATH || path === TEAM_REMOVE_REPO_PATH
+    if (path === TEAM_DELETE_PATH || path === TEAM_RENAME_PATH || path === TEAM_SET_HIDDEN_PATH || path === TEAM_SET_REPO_PATH || path === TEAM_REMOVE_REPO_PATH
       || path === TEAM_SET_MEMBER_PATH || path === TEAM_REMOVE_MEMBER_PATH) {
       if (method !== 'POST') { send405(res, 'POST'); return }
       if (path === TEAM_DELETE_PATH) { await handleDeleteTeam(req, res, deps, cookie); return }
       if (path === TEAM_RENAME_PATH) { await handleRenameTeam(req, res, deps, cookie); return }
+      if (path === TEAM_SET_HIDDEN_PATH) { await handleSetTeamHidden(req, res, deps, cookie); return }
       if (path === TEAM_SET_REPO_PATH) { await handleSetTeamRepo(req, res, deps, cookie); return }
       if (path === TEAM_REMOVE_REPO_PATH) { await handleRemoveTeamRepo(req, res, deps, cookie); return }
       if (path === TEAM_SET_MEMBER_PATH) { await handleSetTeamMember(req, res, deps, cookie); return }