@preventive/triage 1.0.0-alpha.33 → 1.0.0-alpha.35

package/client/linked-findings.js

@@ -1,7 +1,8 @@
 // The "links" file — a small JSON document that says which findings
 // are the SAME finding, reported twice:
 //
-//   [[{"id":"a"},{"id":"b"}], [{"id":"c"},{"id":"d"},{"id":"e"}]]
+//   [["a", "b"], ["c", "d", "e"]]
+// Entries may also be objects such as {"id":"a"}, for existing exports.
 //
 // One inner array per link. Every finding named in it is a duplicate
 // of every other one in that array, and the file says nothing else:
@@ -30,11 +31,11 @@ import { isLinkableFindingId } from './finding-link.js'
 // here, never from a document's own content.
 export const LINKS_KIND = 'links'
 
-// Is this one entry of an inner array — `{"id": "…"}` — as the format
-// spells it? Extra fields are allowed and ignored: an exporter that
+// Read a string ID or an existing object entry — `{"id": "…"}`. Extra fields are allowed and ignored: an exporter that
 // writes the title or the report alongside the id is writing a
 // superset of this format, not a different one.
 function entryId(entry) {
+  if (typeof entry === 'string') return entry.length > 0 ? entry : null
   if (!entry || typeof entry !== 'object' || Array.isArray(entry)) return null
   const { id } = entry
   return typeof id === 'string' && id.length > 0 ? id : null
@@ -50,7 +51,7 @@ function entryId(entry) {
 //
 // Recognition is on SHAPE, and it is strict, because this parser runs
 // against every dropped file before the report readers get their turn:
-// a top-level array, holding only arrays, holding only objects with a
+// a top-level array, holding only arrays, holding string IDs or objects with a
 // string `id`. Nothing else this app reads is a bare JSON array, so
 // nothing else can be mistaken for one — and an empty top-level array
 // is refused rather than claimed, since `[]` is every empty JSON list

package/common/bundle-metadata.js

@@ -12,7 +12,8 @@ import { bundleFileSizes, bundleSourcesAsMap, bundleUnsizedFiles } from './bundl
 // out. Either way its sizes are not file sizes, so it is read for its
 // hashes alone and rebuilt on open.
 // Version 3 also retains the bundle's repository and package origin metadata.
-export const BUNDLE_METADATA_VERSION = 3
+// Version 4 retains dependency repositories as well.
+export const BUNDLE_METADATA_VERSION = 4
 const INDEX_VERSION = BUNDLE_METADATA_VERSION
 const hashJobs = new WeakMap()
 const SOURCE_TABS = new Set(['terminal', 'code', 'search', 'compare'])
@@ -86,7 +87,7 @@ export async function createBundleMetadata(details) {
       for (const [dir, info] of b.modules) {
         const target = dir.split('/').includes('node_modules') ? modules : sources
         Object.defineProperty(target, dir, { enumerable: true, value: {
-          name: info.name, version: info.version, ecosystem: info.ecosystem,
+          name: info.name, version: info.version, ecosystem: info.ecosystem, repo: info.repo,
           files: Object.fromEntries(Object.keys(info.files).map((path) => [path, null])),
         } })
       }
@@ -115,7 +116,7 @@ export function createBundleSummary(details, metadata) {
 // answer report lookups, but an open rebuilds it for current sizes, line
 // counts and origin metadata.
 export function parseBundleMetadata(data, integrity) {
-  if (![1, 2, INDEX_VERSION].includes(data?.version) || data.integrity !== integrity || !['stasis', 'sourcemap'].includes(data.kind)
+  if (![1, 2, 3, INDEX_VERSION].includes(data?.version) || data.integrity !== integrity || !['stasis', 'sourcemap'].includes(data.kind)
       || !Number.isSafeInteger(data.size) || data.size < 0 || !Array.isArray(data.files)) throw new Error('Invalid bundle metadata')
   const stale = data.version !== INDEX_VERSION
   const legacySizes = data.version === 1

package/common/bundle-source-links.d.ts

@@ -1,5 +1,6 @@
 import type { BundleDetails } from './bundle-metadata.js'
 
 export function bundleSourceImports(details: BundleDetails, sources?: Map<string, string>): Map<string, Map<string, string | null>>
-export function sourceLinkResolver(sources: Map<string, string>, parent: string, imports?: Map<string, Map<string, string | null>> | null): (specifier: string) => string | null
+export function bundleSourceLinkImports(details: BundleDetails, sources?: Map<string, string>): Map<string, Map<string, string | null>>
+export function sourceLinkResolver(sources: Map<string, string>, parent: string, imports?: Map<string, Map<string, string | null>> | null, packageFiles?: Map<string, unknown>, packageDirs?: Map<string, string> | null): (specifier: string) => string | null
 export function bundleSourceLinkResolver(details: BundleDetails, parent: string): (specifier: string) => string | null

package/common/bundle-source-links.js

@@ -1,6 +1,7 @@
-import { bundleSourcesAsMap } from './bundle-sources.js'
+import { bundleFilesAsMap, bundlePackageDirs, bundleSourcesAsMap } from './bundle-sources.js'
 
 const indexes = new WeakMap()
+const manifests = new WeakMap()
 
 // Normalize only path segments. Keep sourcemap URL roots (webpack:/// etc.)
 // and leading ../ segments, and never guess extensions or basename matches.
@@ -30,6 +31,102 @@ function buildIndex(sources) {
   return paths
 }
 
+function packageScope(sources, index, parent, packageDir) {
+  const normalized = normalizePath(parent)
+  if (normalized === null) return null
+  const boundary = typeof packageDir === 'string' ? normalizePath(`${packageDir}/package.json`) : null
+  let directory = normalized.slice(0, normalized.lastIndexOf('/') + 1)
+  let cache = manifests.get(sources)
+  if (!cache) { cache = new Map(); manifests.set(sources, cache) }
+  for (;;) {
+    // A dependency without a captured manifest cannot inherit the app's imports.
+    if (directory.endsWith('node_modules/')) return null
+    const path = `${directory}package.json`
+    if (index.has(path)) {
+      if (!cache.has(path)) {
+        const content = sources.get(index.get(path))
+        let imports = null
+        try { imports = typeof content === 'string' ? JSON.parse(content.replace(/^\uFEFF/u, ''))?.imports ?? null : null } catch {}
+        cache.set(path, imports && typeof imports === 'object' && !Array.isArray(imports) ? imports : null)
+      }
+      // The nearest package defines the scope, including absent/invalid imports.
+      return { directory, imports: cache.get(path) }
+    }
+    // Recorded module roots are package boundaries even without a manifest.
+    if (path === boundary) return null
+    if (!directory || directory === '/' || directory.endsWith('../') || /^[a-z][a-z\d+.-]*:\/\/[^/]*\/?$/iu.test(directory)) return null
+    const trimmed = directory.slice(0, -1)
+    directory = trimmed.slice(0, trimmed.lastIndexOf('/') + 1)
+  }
+}
+
+function importMapping(imports, specifier) {
+  if (!imports) return null
+  if (Object.hasOwn(imports, specifier) && !specifier.includes('*')) return { value: imports[specifier], wildcard: null }
+  let best = null
+  for (const pattern of Object.keys(imports)) {
+    const star = pattern.indexOf('*')
+    if (!pattern.startsWith('#') || star === -1 || pattern.indexOf('*', star + 1) !== -1) continue
+    const prefix = pattern.slice(0, star), suffix = pattern.slice(star + 1)
+    if (specifier.length <= prefix.length + suffix.length || !specifier.startsWith(prefix) || !specifier.endsWith(suffix)) continue
+    // Node's pattern precedence: longest prefix, then longest complete key.
+    if (!best || star > best.star || star === best.star && pattern.length > best.pattern.length) best = { pattern, star, suffix }
+  }
+  return best ? { value: imports[best.pattern], wildcard: specifier.slice(best.star, specifier.length - best.suffix.length) } : null
+}
+
+function importTargets(value, wildcard, depth = 0) {
+  if (depth > 16) return [null]
+  if (typeof value === 'string') return [wildcard === null ? value : value.replaceAll('*', wildcard)]
+  // The viewer combines recorded conditions. Conditional/array mappings link
+  // only when every possible target agrees; a blocked branch stays blocked.
+  if (value && typeof value === 'object') return Object.values(value).flatMap(target => importTargets(target, wildcard, depth + 1))
+  return [null]
+}
+
+function mappedSource(target, scope, sources, index, recorded, directory) {
+  if (typeof target !== 'string' || /[\\\p{Cc}]/u.test(target) || /%2f|%5c/iu.test(target)) return null
+  const relative = target.startsWith('./')
+  let file = null
+  if (relative) {
+    let decoded
+    try { decoded = decodeURIComponent(target.slice(2)) } catch { return null }
+    if (/[\\\p{Cc}]/u.test(decoded) || decoded.split('/').some(part => ['.', '..', 'node_modules'].includes(part.toLowerCase()))) return null
+    file = normalizePath(scope.directory + decoded)
+  } else if (target.startsWith('../') || target.startsWith('/') || target.startsWith('#') || target.includes(':')) return null
+  const keys = new Set([target])
+  // Captures may retain the package-relative rewritten spelling or express
+  // that same path relative to a nested importing file.
+  if (relative) {
+    for (const key of recorded?.keys() ?? []) {
+      if ((key.startsWith('./') || key.startsWith('../')) && normalizePath(directory + key) === file) keys.add(key)
+    }
+  }
+  let found = false, resolved = null
+  for (const key of keys) {
+    if (!recorded?.has(key)) continue
+    const current = recorded.get(key)
+    if (typeof current !== 'string' || !sources.has(current) || found && current !== resolved) return null
+    found = true
+    resolved = current
+  }
+  // Exact captured files are useful too, but never guess an extension/index.
+  return found ? resolved : relative ? index.get(file) ?? null : null
+}
+
+function resolvePackageImport(scope, specifier, sources, index, recorded, directory) {
+  const mapping = importMapping(scope?.imports, specifier)
+  if (!mapping) return null
+  const targets = importTargets(mapping.value, mapping.wildcard)
+  let result = null
+  for (const target of targets) {
+    const resolved = mappedSource(target, scope, sources, index, recorded, directory)
+    if (!resolved || result && resolved !== result) return null
+    result = resolved
+  }
+  return result
+}
+
 // Merge conditions before linking. When exporting a restricted source set,
 // include only visible parents and replace every unavailable target with null:
 // its path must not leak, and relative fallback must still remain blocked.
@@ -53,17 +150,44 @@ export function bundleSourceImports(details, sources = bundleSourcesAsMap(detail
   return imports
 }
 
-export function sourceLinkResolver(sources, parent, imports = null) {
+// Managed previews receive only report-selected bodies, often without the
+// owning manifest. Resolve their quoted # aliases using the full manifest
+// inventory, but export only visible targets (or null), never manifest data.
+// These are candidate strings; Prism still decides which tokens become links.
+export function bundleSourceLinkImports(details, sources = bundleSourcesAsMap(details)) {
+  const imports = bundleSourceImports(details, sources)
+  if (details?.kind !== 'stasis') return imports
+  const packageDirs = bundlePackageDirs(details), packageFiles = bundleFilesAsMap(details)
+  for (const [parent, content] of sources) {
+    const resolve = sourceLinkResolver(sources, parent, imports, packageFiles, packageDirs)
+    let targets = imports.get(parent)
+    // Look ahead so a template containing a quoted alias cannot hide that
+    // inner candidate. Escaped/multiline strings are not portable paths.
+    for (const [, , specifier] of content.matchAll(/(?=(["'`])(#[^\\\r\n]*?)\1)/gu)) {
+      if (targets?.has(specifier)) continue
+      const target = resolve(specifier)
+      if (!targets) { targets = new Map(); imports.set(parent, targets) }
+      targets.set(specifier, target)
+    }
+  }
+  return imports
+}
+
+export function sourceLinkResolver(sources, parent, imports = null, packageFiles = sources, packageDirs = null) {
   let index = indexes.get(sources)
   if (!index) { index = buildIndex(sources); indexes.set(sources, index) }
+  let packageIndex = indexes.get(packageFiles)
+  if (!packageIndex) { packageIndex = buildIndex(packageFiles); indexes.set(packageFiles, packageIndex) }
   const recorded = imports?.get(parent)
   const directory = parent.slice(0, parent.lastIndexOf('/') + 1)
+  const scope = imports ? packageScope(packageFiles, packageIndex, parent, packageDirs?.get(parent)) : null
   return (specifier) => {
     if (typeof specifier !== 'string' || /\p{Cc}/u.test(specifier)) return null
     if (recorded?.has(specifier)) {
       const target = recorded.get(specifier)
       return typeof target === 'string' && sources.has(target) ? target : null
     }
+    if (specifier.startsWith('#')) return resolvePackageImport(scope, specifier, sources, index, recorded, directory)
     if (!specifier.startsWith('./') && !specifier.startsWith('../')) return null
     const name = specifier.slice(specifier.lastIndexOf('/') + 1)
     const dot = name.lastIndexOf('.')
@@ -72,11 +196,14 @@ export function sourceLinkResolver(sources, parent, imports = null) {
   }
 }
 
-const bundleImports = new WeakMap()
+const bundleLinks = new WeakMap()
 
 export function bundleSourceLinkResolver(details, parent) {
   const sources = bundleSourcesAsMap(details)
-  let imports = bundleImports.get(sources)
-  if (!imports) { imports = bundleSourceImports(details, sources); bundleImports.set(sources, imports) }
-  return sourceLinkResolver(sources, parent, imports)
+  let links = bundleLinks.get(sources)
+  if (!links) {
+    links = { imports: bundleSourceImports(details, sources), packageDirs: bundlePackageDirs(details) }
+    bundleLinks.set(sources, links)
+  }
+  return sourceLinkResolver(sources, parent, links.imports, bundleFilesAsMap(details), links.packageDirs)
 }

package/common/bundle-sources.d.ts

@@ -1,3 +1,5 @@
 import type { BundleDetails } from './bundle-metadata.js'
 export function bundleSourcesAsMap(details: BundleDetails): Map<string, string>
+export function bundleFilesAsMap(details: BundleDetails): Map<string, string | { format: 'base64'; data: string }>
+export function bundlePackageDirs(details: BundleDetails): Map<string, string> | null
 export function bundlePackageVersions(details: BundleDetails, paths?: Iterable<string> | null): Map<string, Set<string>>

package/common/bundle-sources.js

@@ -233,10 +233,8 @@ export function bundleSourceSizes(details) {
 //
 // The package views (overview, treemap, graph) otherwise classify
 // paths with `bundlePkgOf`'s string heuristic, which only knows
-// `node_modules/`/`dependencies/` and buckets everything else by
-// top-level dir — collapsing sibling workspace packages under their
-// shared parent (`vendor/aws/aws-crt-php` + `vendor/aws/aws-sdk-php`
-// both fall under `vendor`). Feeding each path's dir into
+// `node_modules/`/`dependencies/` and treats everything else as own
+// source. Feeding each path's recorded module directory into
 // `bundlePkgOf` (`packageDir` option) keeps those packages separate.
 //
 // Returns null for sourcemap bundles (and anything without parsed

package/common/managed/repository-alias.ts

@@ -0,0 +1,65 @@
+export interface RepositoryAliasInput {
+  oldRepo: string
+  oldPath: string
+  repoId: number
+  newPath: string
+}
+
+function containsPath(parent: string, path: string) {
+  return !parent || path === parent || path.startsWith(`${parent}/`)
+}
+
+function aliasLocation(alias: RepositoryAliasInput, directory: string) {
+  if (containsPath(alias.oldPath, directory)) {
+    const suffix = directory.slice(alias.oldPath.length).replace(/^\//u, '')
+    return { directory: [alias.newPath, suffix].filter(Boolean).join('/'), filePrefix: '' }
+  }
+  if (!containsPath(directory, alias.oldPath)) return null
+  const filePrefix = alias.oldPath.slice(directory.length).replace(/^\//u, '')
+  // This suffix is already in every file path. The destination must preserve
+  // it, so mapping needs only a new directory, never a file-path rewrite.
+  if (alias.newPath === filePrefix) return { directory: '', filePrefix }
+  if (!alias.newPath.endsWith(`/${filePrefix}`)) return null
+  return { directory: alias.newPath.slice(0, -filePrefix.length - 1), filePrefix }
+}
+
+// Match directory boundaries, keeping any subdirectory below the alias. A
+// shared file prefix can prove a more specific alias applies without changing
+// those files. The most specific applicable source wins, once, never chained.
+export function matchRepositoryAlias(github: string, directory: string, aliases: readonly RepositoryAliasInput[], filePrefix = '') {
+  let match: { repoId: number; directory: string } | null = null, specificity = -1
+  for (const alias of aliases) {
+    if (alias.oldRepo.toLowerCase() !== github.toLowerCase()) continue
+    const location = aliasLocation(alias, directory)
+    if (!location || !containsPath(location.filePrefix, filePrefix) || alias.oldPath.length <= specificity) continue
+    match = { repoId: alias.repoId, directory: location.directory }
+    specificity = alias.oldPath.length
+  }
+  return match
+}
+
+// Run before decoding a bundle's inventory: unrelated repos/directories and
+// mappings without the required common suffix cannot benefit from its paths.
+export function repositoryAliasNeedsFilePrefix(github: string, directory: string, aliases: readonly RepositoryAliasInput[]) {
+  return aliases.some(alias => alias.oldRepo.toLowerCase() === github.toLowerCase()
+    && Boolean(aliasLocation(alias, directory)?.filePrefix))
+}
+
+// Whole directory segments only; no source bodies, hashing, or path rewriting.
+// A single file still proves its parent prefix. Stop as soon as none is shared.
+export function commonFileDirectory(paths: Iterable<string>): string {
+  let prefix: string[] | undefined
+  for (const path of paths) {
+    const parts = path.split('/')
+    if (parts.some(part => !part || part === '.' || part === '..') || path.includes('\\')) return ''
+    parts.pop()
+    if (prefix === undefined) prefix = parts
+    else {
+      let length = 0
+      while (length < prefix.length && length < parts.length && prefix[length] === parts[length]) length++
+      prefix.length = length
+    }
+    if (prefix.length === 0) return ''
+  }
+  return prefix?.join('/') ?? ''
+}

package/common/managed/routes.js

@@ -12,6 +12,7 @@ export const MANAGED_PAGES = Object.freeze({
   'manage-teams': '/manage/team',
   'manage-import': '/manage/import',
   'manage-links': '/manage/links',
+  'manage-deduplication': '/manage/deduplication',
   'manage-history': '/manage/history',
 })
 
@@ -24,6 +25,9 @@ function findingPath(id) {
 export function managedRoutePath(route) {
   if (!route) return null
   if (route.view === 'home') return '/'
+  if (route.view === 'workspace-reports' || route.view === 'workspace-bundles') {
+    return /^[A-Za-z0-9_-]+$/u.test(route.teamSlug ?? '') ? `/team/${route.teamSlug}/${route.view.slice(10)}` : null
+  }
   if (route.view === 'bundles') {
     if (!/^[A-Za-z0-9_-]+$/u.test(route.bundleSlug ?? '')
         || (route.teamSlug != null && !/^[A-Za-z0-9_-]+$/u.test(route.teamSlug))) return null
@@ -34,7 +38,9 @@ export function managedRoutePath(route) {
   }
   if (Object.hasOwn(MANAGED_PAGES, route.view)) {
     const path = MANAGED_PAGES[route.view]
+    if (route.view === 'manage-deduplication' && route.linkId) return `${path}?report=${encodeURIComponent(route.linkId)}`
     if (route.view === 'manage-bundles' && Number.isSafeInteger(route.createRepoId) && route.createRepoId > 0) return `${path}?createRepo=${route.createRepoId}`
+    if (route.view === 'manage-scans' && route.scanMode === 'link') return `${path}?mode=link`
     if (route.view === 'manage-scans' && route.bundleId) return `${path}?bundle=${encodeURIComponent(route.bundleId)}`
     return route.view === 'manage-history' && route.actor ? `${path}?actor=${encodeURIComponent(route.actor)}` : path
   }
@@ -56,9 +62,11 @@ export function parseManagedRoute(url) {
   if (view) {
     const createRepoId = Number(url.searchParams.get('createRepo'))
     return { view,
+      ...(view === 'manage-deduplication' && url.searchParams.get('report') ? { linkId: url.searchParams.get('report') } : {}),
       ...(view === 'manage-bundles' && Number.isSafeInteger(createRepoId) && createRepoId > 0 ? { createRepoId } : {}),
       ...(view === 'manage-history' && url.searchParams.get('actor') ? { actor: url.searchParams.get('actor') } : {}),
-      ...(view === 'manage-scans' && url.searchParams.get('bundle') ? { bundleId: url.searchParams.get('bundle') } : {}),
+      ...(view === 'manage-scans' ? url.searchParams.get('mode') === 'link' ? { scanMode: 'link' }
+        : url.searchParams.get('bundle') ? { bundleId: url.searchParams.get('bundle') } : {} : {}),
     }
   }
   const bundle = /^(?:\/team\/([A-Za-z0-9_-]+)|\/manage)\/bundle\/([A-Za-z0-9_-]+)(?:\/([a-z]+))?$/u.exec(path)
@@ -66,6 +74,8 @@ export function parseManagedRoute(url) {
     const bundleTab = bundle[3] ?? 'overview'
     return BUNDLE_TABS.has(bundleTab) ? { view: 'bundles', teamSlug: bundle[1] ?? null, bundleSlug: bundle[2], bundleTab } : null
   }
+  const contentList = /^\/team\/([A-Za-z0-9_-]+)\/(reports|bundles)$/u.exec(path)
+  if (contentList) return { view: `workspace-${contentList[2]}`, teamSlug: contentList[1] }
   const match = /^\/team\/([^/]+)(?:\/report\/([^/]+))?(?:\/(files)|\/finding\/([^/]+))?$/u.exec(path)
   if (!match) return null
   try {
@@ -82,6 +92,10 @@ export function parseManagedRoute(url) {
 // URL tokens are exact server-assigned slugs. Application state and API calls
 // continue to use UUIDs; never guess IDs from suffixes or accept ID aliases.
 export function resolveManagedRoute(route, teams, adminBundles = []) {
+  if (route.view === 'workspace-reports' || route.view === 'workspace-bundles') {
+    const matches = teams.filter(team => team.slug === route.teamSlug)
+    return matches.length === 1 ? { view: route.view, teamId: matches[0].id } : null
+  }
   if (route.view === 'bundles') {
     const { teamSlug, bundleSlug, ...rest } = route
     const matches = teamSlug == null ? [] : teams.filter(team => team.slug === teamSlug)
@@ -105,6 +119,11 @@ export function resolveManagedRoute(route, teams, adminBundles = []) {
 }
 
 export function managedRouteForIds(route, teams, adminBundles = []) {
+  if (route.view === 'workspace-reports' || route.view === 'workspace-bundles') {
+    const team = teams.find(entry => entry.id === route.teamId)
+    const result = { view: route.view, teamSlug: team?.slug }
+    return team?.slug && resolveManagedRoute(result, teams) ? result : null
+  }
   if (route.view === 'bundles') {
     const { teamId, bundleId, ...rest } = route
     const team = teams.find(entry => entry.id === teamId)

package/common/managed/triage.ts

@@ -8,9 +8,9 @@
 // fields below, or is null for a cleared entry (the server's tombstone); the
 // client's `ignoredReports` deliberately does NOT ride this wire — the
 // per-report ignore is a client-local concept keyed by report name.
-export type TriageBucket = 'inprogress' | 'fixed' | 'invalid' | 'deleted'
+export type TriageBucket = 'inprogress' | 'fixed' | 'invalid' | 'deleted' | 'ignored'
 
-export const TRIAGE_BUCKETS: readonly TriageBucket[] = ['inprogress', 'fixed', 'invalid', 'deleted']
+export const TRIAGE_BUCKETS: readonly TriageBucket[] = ['inprogress', 'fixed', 'invalid', 'deleted', 'ignored']
 
 // One finding's server-side triage entry (also the write shape — writes
 // replace the whole entry). Absent fields are unset; `flagged` is tri-state: