@preventive/triage 1.0.0-alpha.4 → 1.0.0-alpha.41

package/common/save-error-reason.ts

@@ -15,8 +15,11 @@
 //                   `session.error` until `dismissError()`.
 //   `busy`        — per-socket inflight cap dropped the save
 //                   (transport backpressure). Recoverable; the
-//                   client clears `pending` and re-arms
-//                   `pendingSave` for the next natural trigger.
+//                   client clears `pending`, re-arms `pendingSave`,
+//                   and schedules a short timed retry — without the
+//                   timer an idle client (no further edit /
+//                   broadcast / reconnect) would strand its last
+//                   edit unsynced indefinitely.
 //   `stale-base`  — concurrent commit advanced the head past the
 //                   client's claimed base. The server emits the
 //                   typed frame AFTER a `workspace-state` catch-up
@@ -25,11 +28,21 @@
 //                   and this frame's handler then early-returns
 //                   on the missing pending. So `stale-base` is
 //                   NOT in the recoverable set: in the happy path
-//                   the recoverable branch is unreachable; in the
-//                   pathological case where wire order flipped,
-//                   we'd rather mark the session errored (visible
-//                   via UI + recoverable via `dismissError()`)
-//                   than silently swallow a state divergence.
+//                   the recoverable branch is unreachable. When
+//                   `pending` DOES survive to this frame — the
+//                   catch-up was empty (chain gone: wiped /
+//                   migrated DB) or didn't apply (chain rebuilt
+//                   past the client's base) — the client answers
+//                   with ONE full-state-push reset per recovery
+//                   cycle (re-anchor at base=null; safe because
+//                   the server's null-safe head CAS rejects a
+//                   base=null root against any non-empty chain;
+//                   see `staleResetAttempted` in triage-sync.ts).
+//                   A repeat within the cycle marks the session
+//                   errored (visible via UI + recoverable via
+//                   `dismissError()`) rather than looping
+//                   full-state saves against a relay that keeps
+//                   rejecting them.
 
 export type SaveErrorReason = 'too-large' | 'busy' | 'stale-base'
 

package/common/scan-server.ts

@@ -0,0 +1,13 @@
+export const DEFAULT_SCAN_SERVER = 'http://127.0.0.1:3123/'
+
+// Discovery is optional: malformed scan configuration must never prevent
+// opening local data or recognizing the server's sync protocol.
+export function normalizeScanServer(value: unknown): string | null {
+  if (typeof value !== 'string' || !value.trim()) return null
+  try {
+    const url = new URL(value)
+    if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.search || url.hash) return null
+    url.pathname = url.pathname.replace(/\/+$/u, '') + '/'
+    return url.href
+  } catch { return null }
+}

package/common/server-info.ts

@@ -0,0 +1,35 @@
+// The sync-protocol mode a server advertises — shared by the server (which
+// emits it) and the client (which parses + caches it) so a change to the
+// shape surfaces as a compile error on BOTH sides, the same single-source
+// discipline as ./save-error-reason.ts.
+//
+// Delivered to the client as the first `server-info` frame on a sync
+// connection (the WS plane and the SSE+POST fallback share one send path).
+// A client uses it to detect whether a deployment speaks the end-to-end
+// (`e2e`, zero-knowledge) protocol, the trusted `managed` protocol, or both.
+// Combined discovery modes put the default protocol first.
+
+export type ServerMode = 'e2e' | 'managed'
+
+// Managed-mode entry points the server advertises; null for an e2e server.
+export interface ManagedServerInfo {
+  loginPath: string
+  cookieName: string
+  uploadChunkBytes?: number
+  uploadMaxBytes?: { reports: number; bundles: number }
+  allowShare?: boolean
+}
+
+// The `server-info` frame payload (the `type` discriminant is added at the
+// send site). `managed` is null on e2e-only deployments.
+export interface ServerInfo {
+  mode: ServerMode | 'managed+e2e' | 'e2e+managed'
+  managed: ManagedServerInfo | null
+  deepviewScanServer?: string
+  githubNewIssueLabels?: string
+}
+
+// The mode-probe route. A client GETs this to learn a server's protocol up
+// front — a managed server has no WS plane to carry the connect frame — and
+// the response body is the same `ServerInfo` shape emitted as that frame.
+export const CONFIG_PATH = '/api/config'

package/common/utf8.d.ts

@@ -11,3 +11,6 @@
 // narrower declaration is safe.
 export function encodeUtf8(str: string): Uint8Array<ArrayBuffer>
 export function decodeUtf8(bytes: Uint8Array | ArrayBuffer | ArrayBufferView): string
+// Bytes `str` takes in UTF-8, measured without encoding when no character
+// is past \xFF. A lone surrogate counts as the U+FFFD it encodes to.
+export function utf8ByteLength(str: string): number

package/common/utf8.js

@@ -43,6 +43,51 @@ export function encodeUtf8(str) {
   return encoder.encode(str)
 }
 
+// ASCII characters in a row after which the count hands back to the
+// native scan. A jump costs a call and a step does not, so it pays only
+// across a real gap: at 1, alternating text (`aéaé…`) takes a jump per
+// character, and past 2, text with an accent every few words steps
+// through ASCII the scan crosses faster. Measured on 50 MB of each, 2 was
+// never more than 1.5x the best of the thresholds tried, 1 to 32.
+const ASCII_RUN = 2
+
+// The number of bytes `str` takes in UTF-8, without encoding it where
+// that can be helped. A string with no character past \xFF is Latin-1:
+// ASCII takes a byte and \x80-\xFF two, so its size is its length plus
+// its high characters. An engine stores such a string a byte per
+// character, where no character past \xFF can be, so the first test is
+// answered without reading it. Only a string with a wider character is
+// encoded to be measured.
+//
+// The high characters are counted without collecting them: a match array
+// takes an entry apiece, which for Latin-1-heavy text outweighs the
+// encoding this avoids. A native scan jumps to the next one — for ASCII
+// it finds none — and a loop counts on from there while they keep coming,
+// handing back to the scan after a run of ASCII. Sparse text is read
+// natively, dense text by the loop, and neither allocates.
+//
+// This sizes text for display, so unlike `encodeUtf8` it does not refuse
+// a lone surrogate: it counts the U+FFFD that TextEncoder writes for one.
+export function utf8ByteLength(str) {
+  if (typeof str !== 'string') {
+    throw new TypeError(`utf8ByteLength expects a string, got ${typeof str}`)
+  }
+  // Code units, not code points: a `u` regexp reads a two-byte string by
+  // code point, several times slower, and a surrogate is past \xFF either way.
+  // eslint-disable-next-line require-unicode-regexp
+  if (/[\u0100-\uFFFF]/.test(str)) return encoder.encode(str).byteLength
+  const high = /[\u0080-\u00FF]/gu
+  let bytes = str.length
+  while (high.test(str)) {
+    let i = high.lastIndex - 1
+    for (let ascii = 0; i < str.length && ascii < ASCII_RUN; i++) {
+      if (str.codePointAt(i) > 0x7F) { bytes++; ascii = 0 } else ascii++
+    }
+    high.lastIndex = i
+  }
+  return bytes
+}
+
 export function decodeUtf8(bytes) {
   // Reject non-BufferSource so a missed destructure / optional field /
   // misnamed property surfaces here instead of silently defaulting to

package/common/workspace-app.js

@@ -0,0 +1,23 @@
+import { revalidateKindOf } from '@preventive/report'
+import { canLockConfirmed } from './finding-filters.js'
+import { mergeReportGroups } from './workspace-groups.js'
+import { mergeLinkedWorkspaceGroups } from './linked-workspace-groups.js'
+
+function appTabs(group) {
+  if (group.linkedTabs) return group.linkedTabs
+  const app = group.filter((f) => revalidateKindOf(f) === 'revalidation')
+  return app.length > 0 ? app : group
+}
+
+// Evaluate the entire workspace, independent of triage, filters, or the lens
+// left active by another report. Use the same merge and link rules as the view.
+export function workspaceAppMetadata(reports, duplicatesOf = () => []) {
+  const { groups, conflicts } = mergeReportGroups(reports, { hideRuledOut: true })
+  if (conflicts.size > 0) return { appMode: false }
+  const linked = mergeLinkedWorkspaceGroups(groups, duplicatesOf, appTabs)
+  if (!canLockConfirmed(linked, { tabs: appTabs, kindOf: revalidateKindOf, severityMode: 'corrected' })) return { appMode: false }
+  return {
+    appMode: true,
+    appFindings: linked.filter((group) => appTabs(group).some((f) => f.isApp)).length,
+  }
+}

package/common/workspace-groups.js

@@ -0,0 +1,176 @@
+import { revalidateKindOf } from '@preventive/report'
+import { mergeReportDuplicateFields } from './finding-duplicates.js'
+import { splitRevalidationInputs } from './revalidation-input-groups.js'
+
+// Reports retain their original rows. Merge only this derived view, so two
+// application findings that refer to the same source issue keep their own
+// context, verdicts, and tabs. Code mode removes pass findings BEFORE deciding
+// which rows may merge; imports from other analyzers remain App findings.
+export function mergeReportGroups(reports, { showRevalidation = true, upstreamOnly = false, hideRuledOut = false, merges = [] } = {}) {
+  const rows = []
+  const ruledOutIds = new Set()
+  for (let reportIndex = 0; reportIndex < reports.length; reportIndex++) {
+    const report = reports[reportIndex]
+    for (const original of report.groups) {
+      for (const finding of original) {
+        if (finding.id && ['refuted', 'unreachable'].includes(revalidateKindOf(finding))) ruledOutIds.add(finding.id)
+      }
+      // Visibility precedes merging: a hidden answer from another app must
+      // neither cause a conflict nor gap-fill the answer the reader will see.
+      const kept = upstreamOnly
+        ? original.filter((f) => f.isUpstream && revalidateKindOf(f) !== 'revalidation').map(withoutRevalidation)
+        : showRevalidation
+        ? hideRuledOut
+          ? original.filter((f) => !['refuted', 'unreachable'].includes(revalidateKindOf(f)))
+          : original
+        : original.filter((f) => revalidateKindOf(f) !== 'revalidation').map(withoutRevalidation)
+      const group = kept.length === original.length && kept.every((f, i) => f === original[i]) ? original : kept
+      if (group.length > 0) rows.push({ group, sourceGroup: original, reportIndex, reportName: report.fileName ?? '', hasApp: group.some((f) => f.isApp) })
+    }
+  }
+  const parent = rows.map((_, i) => i)
+  const hasApp = rows.map((r) => r.hasApp)
+  const find = (i) => {
+    let root = i
+    while (parent[root] !== root) root = parent[root]
+    while (parent[i] !== root) { const next = parent[i]; parent[i] = root; i = next }
+    return root
+  }
+  const union = (a, b) => {
+    a = find(a); b = find(b)
+    if (a === b) return
+    parent[b] = a
+    hasApp[a] ||= hasApp[b]
+  }
+  const byId = new Map()
+  for (let i = 0; i < rows.length; i++) {
+    for (const f of rows[i].group) {
+      if (!f.id) continue
+      if (!byId.has(f.id)) byId.set(f.id, [])
+      byId.get(f.id).push({ index: i, app: f.isApp })
+    }
+  }
+  // App identities and within-report overlaps establish their components first.
+  // Otherwise a source-only row could bridge two App rows through another report.
+  for (const occurrences of byId.values()) {
+    const ownReports = new Map()
+    const app = occurrences.find((entry) => entry.app)
+    for (const { index } of occurrences) {
+      if (app) union(app.index, index)
+      const reportIndex = rows[index].reportIndex
+      if (ownReports.has(reportIndex)) union(ownReports.get(reportIndex), index)
+      else ownReports.set(reportIndex, index)
+    }
+  }
+  for (const occurrences of byId.values()) {
+    let first = null
+    for (const { index } of occurrences) {
+      if (hasApp[find(index)]) continue
+      if (first === null) first = index
+      else union(first, index)
+    }
+  }
+  // Explicit hints are retained for callers supplying already-deduplicated rows.
+  // Normal report loading no longer needs them: all original rows are retained.
+  for (const merge of merges) {
+    let first = null
+    for (const id of merge) {
+      for (const { index } of byId.get(id) ?? []) {
+        if (first === null) first = index
+        else union(first, index)
+      }
+    }
+  }
+  const components = new Map()
+  for (let i = 0; i < rows.length; i++) {
+    const root = find(i)
+    if (!components.has(root)) components.set(root, [])
+    components.get(root).push(rows[i])
+  }
+  const conflicts = new Map(), groups = []
+  for (const component of components.values()) {
+    const original = component[0].group
+    const ids = original.map((f) => f.id).filter(Boolean)
+    if (component.length === 1 && new Set(ids).size === ids.length && merges.length === 0) {
+      const app = reports.length > 1 && original.find((f) => f.isApp)
+      if (app) {
+        const group = [...original]
+        group.workspaceKey = app.id ?? String(app._id)
+        groups.push(...splitOutput(component, group, showRevalidation, upstreamOnly))
+      } else groups.push(...splitOutput(component, original, showRevalidation, upstreamOnly))
+      continue
+    }
+    const rowConflicts = new Map()
+    const copies = new Map()
+    const findings = []
+    for (const { group, reportName } of component) {
+      for (const f of group) {
+        if (f.id && copies.has(f.id)) {
+          mergeReportDuplicateFields(copies.get(f.id), f, reportName, rowConflicts)
+        } else {
+          // Only the derived copy receives gap fills and per-report variants.
+          const copy = { ...f, _reportName: f._reportName ?? reportName }
+          if (f.id) copies.set(f.id, copy)
+          findings.push(copy)
+        }
+      }
+    }
+    // Combined rows carry the author's order; singleton load order does not.
+    const canonical = new Set()
+    for (const merge of merges) for (const id of merge) if (copies.has(id)) canonical.add(id)
+    for (const { group } of component) {
+      if (group.length > 1) for (const f of group) if (f.id) canonical.add(f.id)
+    }
+    const group = [...canonical].map((id) => copies.get(id))
+    for (const f of findings) if (!canonical.has(f.id)) group.push(f)
+    // Separate App rows can begin with the SAME source id. Give each row its
+    // App identity so Lit keys, selection, and popup close targets stay unique.
+    if (reports.length > 1) {
+      const app = group.find((f) => f.isApp)
+      if (app) group.workspaceKey = app.id ?? String(app._id)
+    }
+    groups.push(...splitOutput(component, group, showRevalidation, upstreamOnly))
+    for (const [id, conflict] of rowConflicts) {
+      const previous = conflicts.get(id)
+      conflicts.set(id, previous
+        ? { finding: previous.finding, copies: [...previous.copies, ...conflict.copies] }
+        : conflict)
+    }
+  }
+  Object.defineProperty(groups, 'ruledOutIds', { value: ruledOutIds, configurable: true })
+  return { groups, conflicts }
+}
+
+function splitOutput(component, group, keepAppLayer, upstreamOnly) {
+  if (keepAppLayer) return [group]
+  if (upstreamOnly) {
+    // Upstream projection removes the App and own-source members before this
+    // function runs. Reconstruct the complete source component first so an
+    // App's inputs outside the upstream lens still determine its partition.
+    const complete = component.flatMap((row) => row.sourceGroup)
+    const partitions = splitRevalidationInputs(complete)
+    if (partitions.length === 1) return [group]
+    const projected = []
+    const covered = new Set()
+    for (const partition of partitions) {
+      const ids = new Set(partition.filter((f) => !f.isApp && f.id).map((f) => f.id))
+      const visible = group.filter((f) => ids.has(f.id))
+      if (visible.length > 0) {
+        projected.push(visible)
+        for (const finding of visible) covered.add(finding.id)
+      }
+    }
+    const groupIds = new Set(group.map((f) => f.id).filter(Boolean))
+    return covered.size === groupIds.size ? projected : [group]
+  }
+  const appFindings = component.flatMap((row) => row.sourceGroup.filter((f) => f.isApp))
+  return splitRevalidationInputs(group, appFindings)
+}
+
+function withoutRevalidation(finding) {
+  const fields = Object.keys(finding).filter((key) => key.startsWith('revalidate') || key === '_revalidationCopies')
+  if (fields.length === 0) return finding
+  const copy = { ...finding }
+  for (const field of fields) delete copy[field]
+  return copy
+}