@preventive/triage 1.0.0-alpha.43 → 1.0.0-alpha.44

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@preventive/triage",
-  "version": "1.0.0-alpha.43",
+  "version": "1.0.0-alpha.44",
   "description": "Client & relay server for triaging of automated reports",
   "license": "MIT OR Apache-2.0",
   "author": {
@@ -108,6 +108,7 @@
     "server-managed/cache-storage.ts",
     "server-managed/cli.js",
     "server-managed/combined.ts",
+    "server-managed/comparison.ts",
     "server-managed/comments.ts",
     "server-managed/config.ts",
     "server-managed/content-access.ts",
@@ -206,6 +207,9 @@
     "common/bundle-commit.d.ts",
     "common/bundle-commit.js",
     "common/bundle-compare-diff.js",
+    "common/bundle-compare-versions.js",
+    "common/bundle-comparison.d.ts",
+    "common/bundle-comparison.js",
     "common/bundle-compare-diff.d.ts",
     "common/bundle-compare-inputs.d.ts",
     "common/bundle-compare-inputs.js",
@@ -352,9 +356,9 @@
   "dependencies": {
     "@exodus/stasis": "1.0.0-beta.9",
     "@exodus/stasis-core": "1.0.0-beta.9",
-    "@preventive/compare": "^1.2.8",
+    "@preventive/compare": "^1.2.10",
     "@preventive/diff": "^1.0.2",
-    "@preventive/lockfile": "1.1.0",
+    "@preventive/lockfile": "1.1.1",
     "@preventive/publishers": "^1.1.0",
     "@preventive/report": "1.0.0-alpha.9",
     "@preventive/sourcemap": "1.0.0-alpha.1",

package/risk/npm/assess.js

@@ -6,7 +6,7 @@ import { npmBaseFilesTell, npmCompareFindings } from './compare.js'
 import { npmCombinedFindings, npmHeldDependencyFindings } from './combined.js'
 import { npmHeldFindings, npmVersionFindings } from './held.js'
 import { npmVersionFileRisk } from './files.js'
-import { npmDependencyChanges, npmFlagDependencyChanges } from './dependencies.js'
+import { npmDependencyChanges, npmFlagDependencyChanges, npmUnusedDependencyCounted } from './dependencies.js'
 import { npmDownloadMonths, npmDownloadTier, npmSettledDownloads, npmTierLevel } from './downloads.js'
 import { NpmRiskError, npmDownloads, npmPackageFacts, npmPackageReleases, npmPublicFacts, npmVersionAdvisories, npmVersionFiles } from './registry.js'
 import { npmMalwareFinding } from './malware.js'
@@ -127,7 +127,8 @@ const MAX_TOLD_DEPENDENCIES = 100
 // from }`), `uncounted` where npm counts none of them, `created` and `gap`
 // where it is new since the version compared with (`published`, when that
 // and the open version were), and for one nothing imports (flagged so, or
-// among `unusedKeys`), the version its spec installs (`installs`,
+// among `unusedKeys`) that risk counts (dependencies.js
+// npmUnusedDependencyCounted), the version its spec installs (`installs`,
 // registry.js npmPublicFacts); `missing` where
 // its package was looked up and npm has none of it for anyone, as once
 // unpublished or taken down; four asked at a time, whether each is the
@@ -139,7 +140,7 @@ async function addedDependencies(added, published, context, owned, unusedKeys =
   let next = 0, taken = 0
   const tell = async row => {
     const downloads = await npmDownloads(row.opens, context)
-    const unused = row.flags.some(flag => flag.check === 'unimported') || unusedKeys.has(keyOf(row))
+    const unused = (row.flags.some(flag => flag.check === 'unimported') || unusedKeys.has(keyOf(row))) && npmUnusedDependencyCounted(row)
     let facts = npmAddedDependency({ downloads, published, unused }, context.now), missing = false
     if (facts.wanted) {
       const listed = await npmPublicFacts(row.opens, context, unused ? row.range : null)
@@ -225,8 +226,9 @@ export async function assessNpm(name, version, { oldVersion = null, fromEmpty =
 const keyOf = row => `${row.kind ?? ''}\0${row.name}`
 
 // The keys of the dependencies a version holds that nothing of it imports
-// (`kept`, npmLastingRisk's: its `held-unused-deps`).
-const unusedKeysOf = kept => new Set((kept.findings.find(({ id }) => id === 'held-unused-deps')?.dependencies ?? []).map(keyOf))
+// (`kept`, npmLastingRisk's: its `held-unused-deps`), those risk counts
+// (dependencies.js npmUnusedDependencyCounted).
+const unusedKeysOf = kept => new Set((kept.findings.find(({ id }) => id === 'held-unused-deps')?.dependencies ?? []).filter(npmUnusedDependencyCounted).map(keyOf))
 
 // The dependencies nothing of a version imports (`held-unused-deps`), each
 // graded by what risk tells of its package fresh (`told`, as
@@ -236,13 +238,16 @@ const unusedKeysOf = kept => new Set((kept.findings.find(({ id }) => id === 'hel
 // version compared with where there was one (`compared`) and it named it as
 // the same kind of dependency by the same spec: not one marked new, nor
 // `added` (its kind and name new, as one moved from another kind is), nor
-// `changed` (each said with the spec it had, `was`). The finding as its most severe.
+// `changed` (each said with the spec it had, `was`); one risk doesn't count
+// (dependencies.js npmUnusedDependencyCounted) a notice, told all the same.
+// The finding as its most severe.
 function unusedGraded(finding, told, compared, { added, changed }) {
   const facts = new Map(told.map(row => [keyOf(row), row])), was = new Map(changed.map(row => [keyOf(row), row.from]))
   const anew = new Set(added.map(keyOf))
   const dependencies = finding.dependencies.map(row => {
     const of = facts.get(keyOf(row))
-    return { ...row, ...was.has(keyOf(row)) ? { was: was.get(keyOf(row)) } : {}, severity: npmUnusedDependencySeverity(of, compared && !row.added && !anew.has(keyOf(row)) && !was.has(keyOf(row))),
+    return { ...row, ...was.has(keyOf(row)) ? { was: was.get(keyOf(row)) } : {}, severity: npmUnusedDependencyCounted(row)
+      ? npmUnusedDependencySeverity(of, compared && !row.added && !anew.has(keyOf(row)) && !was.has(keyOf(row))) : 'notice',
       ...of?.level ? { tier: of.tier, level: of.level } : {}, ...of?.created ? { created: of.created, gap: of.gap } : {}, ...of?.installs ? { installs: of.installs } : {},
       ...of?.missing ? { missing: true } : {} }
   })

package/risk/npm/dependencies.js

@@ -125,6 +125,17 @@ export function npmDependencyUnimported(details, { name, kind, range, to }) {
     && !commands.some(command => commandNames(command, name))
 }
 
+// Whether a dependency nothing of a version imports (`{ name, range }`,
+// npmDependencyUnimported) counts toward its risk (assess.js): not lodash,
+// which packages keep naming long after their code stopped importing it, nor
+// Babel's own presets (`@babel/preset-*`), which a config names by a string
+// (an ESLint config's parser options); each where npm installs that package
+// from its registry (installsAs), not another under its name.
+export function npmUnusedDependencyCounted({ name, range }) {
+  const installs = installsAs(name, range)
+  return !(name === 'lodash' && installs === 'lodash') && !(name.startsWith('@babel/preset-') && installs?.startsWith('@babel/preset-'))
+}
+
 // Where a source takes a dependency from, in a sentence.
 const SOURCE_NAMES = new Map([['URL', 'a URL'], ['git', 'a git repository']])
 

package/server-managed/comparison.ts

@@ -0,0 +1,41 @@
+// Compare's comparison of two managed bundles or two versions of an npm
+// package (GET /api/bundles/:id/comparison?other=, GET /api/npm/comparison):
+// their files paired, at one path or renamed, with the sizes, resolutions,
+// dependency versions and line counts its Overview and Code read beside them,
+// as common/bundle-comparison.js prepareComparison works them out. The viewer
+// of a managed bundle or a package has every comparison worked out here and
+// loads none of the pairing itself. Answered as Brotli-encoded JSON, its
+// `files.basePaths` (a Map) as `[path, as laid out]` pairs where the two
+// sides' roots differ and none else, as the viewer reads none then. Access is
+// the caller's to check.
+import { Buffer } from 'node:buffer'
+import { Readable } from 'node:stream'
+import { prepareComparison } from '../common/bundle-comparison.js'
+import type { BundleDetails } from '../common/bundle-metadata.js'
+import type { OpenedBlob } from './blob-store.ts'
+import { encodeBrotli } from './brotli.ts'
+import { type NpmPackageFile, npmFileRows } from './npm-packages.ts'
+
+// A side with no files, as Review compares a package's first version with:
+// one for each comparison, as working one out keeps its line counts on it.
+export const emptySide = (): BundleDetails => ({ integrity: '(empty)', kind: 'sourcemap', size: 0, json: { version: 3, sources: [], sourcesContent: [] } })
+
+// A version's files as the viewer reads them for a comparison (ui/view/npm-package.js
+// npmPackageDetails): its texts, and those that are not text by their size and digest.
+export function npmComparedSide(integrity: string, files: NpmPackageFile[]): BundleDetails & { npmBinaries: Map<string, { size: number; digest: string }> } {
+  const rows = npmFileRows(files)
+  return {
+    integrity, kind: 'sourcemap', size: 0,
+    json: { version: 3, sources: rows.map(([path]) => path), sourcesContent: rows.map(([, , text]) => text) },
+    npmBinaries: new Map(rows.flatMap(([path, size, text, digest]) => (text === null ? [[path, { size, digest: digest! }] as const] : []))),
+  }
+}
+
+// The comparison of `base` with `other`, within a reason `scope` where given, as sent.
+export async function comparisonBody(base: BundleDetails, other: BundleDetails, scope = ''): Promise<OpenedBlob> {
+  const comparison = prepareComparison(base, other, scope)
+  const { files } = comparison
+  const json = JSON.stringify({ ...comparison, files: { ...files, basePaths: files.root ? [...files.basePaths] : [] } })
+  const body = await encodeBrotli(Buffer.from(json))
+  return { size: body.byteLength, stream: Readable.from([body]) }
+}

package/server-managed/http.ts

@@ -3,7 +3,8 @@
 // server doesn't speak the e2e sync protocol yet). Every handler is async; the
 // boot's `track()` keeps in-flight requests drainable on shutdown.
 //
-//   GET  /api/config             → { mode:'managed', managed:{ loginPath, cookieName } }  (public)
+//   GET  /api/config             → { mode:'managed', managed:{ loginPath, cookieName }, session }  (public;
+//        `session` is /api/auth/session's answer, null signed out, absent when it could not be read)
 //   GET  /api/oauth/github/login → 302 to GitHub (+ state cookie)
 //   GET  /api/oauth/github/callback → the OAuth hook (see github-oauth.ts)
 //   GET  /api/auth/session       → { user, csrfToken } | 401
@@ -120,7 +121,7 @@ import { findingsRepository, loadManagedFindings, ownFileDirectory, readManagedR
 import type { ReportSourcesCache } from './report-sources.ts'
 import { normalizeTeamPath } from './repo-path.ts'
 import { DEFAULT_MANAGED_SCAN_MODEL, MANAGED_SCAN_MODELS } from '../common/managed/scan-models.ts'
-import { CONFIG_PATH, type ServerInfo } from '../common/server-info.ts'
+import { CONFIG_PATH, type ManagedSessionInfo, type ServerInfo } from '../common/server-info.ts'
 import { bundleCommitHash } from '../common/bundle-commit.js'
 import { GithubApiError, collectRepos, fetchPublicRepository, installUrl, publicRepositoryName, repositoryInstallation } from './github-app.ts'
 import { upstreamGithub } from './github-errors.ts'
@@ -146,7 +147,7 @@ import { attachmentDisposition, sendJson, sendLines, writeResponse } from './htt
 import { triageWireEntry } from './triage-response.ts'
 import { handlePublicWorkspace } from './public-workspace.ts'
 import { serveUserTeamFeed } from './team-feed.ts'
-import { teamAppKey, teamAppStates } from './team-app.ts'
+import { teamAppKey, teamAppStates, withWorkspaceSummary } from './team-app.ts'
 import { hashToken, randomToken, safeEqual } from './crypto.ts'
 import { canDeleteComment, parseCommentBody } from '../common/managed/comments.ts'
 import { ManagedMutationError, reportReferenceSnapshot } from './management.ts'
@@ -163,6 +164,7 @@ import { NpmRiskError } from '../risk/index.js'
 import { type PrettyCache, PrettyError, type PrettyRequest, compared, prettyRequest, prettyText } from './pretty-print.ts'
 import { renameDiffOf, renameDiffRequest, renamedPairs } from './rename-diff.ts'
 import { typeOnlyFiles } from './type-only.ts'
+import { comparisonBody, emptySide, npmComparedSide } from './comparison.ts'
 import { isNpmPackageName, isNpmPackageSpec, npmPackageScope } from '../common/managed/npm-packages.js'
 
 const SESSION_PATH = '/api/auth/session'
@@ -216,6 +218,7 @@ const NPM_PROVENANCE_PATH = '/api/npm/provenance'
 const NPM_PRETTY_PATH = '/api/npm/pretty'
 const NPM_RENAME_DIFF_PATH = '/api/npm/rename-diff'
 const NPM_TYPE_ONLY_PATH = '/api/npm/type-only'
+const NPM_COMPARISON_PATH = '/api/npm/comparison'
 const NPM_RISK_PATH = '/api/npm/risk'
 // What risk's errors (risk/npm/registry.js NpmRiskError) are answered as: npm
 // having no such package or version, or a tarball unpacking past risk's
@@ -229,7 +232,7 @@ function sendRiskError(res: ServerResponse, err: NpmRiskError) {
   sendJson(res, status, { error: err.code })
 }
 const NPM_PATHS = new Set([NPM_PACKAGE_PATH, NPM_VERSIONS_PATH, NPM_DOWNLOAD_PATH, NPM_STATS_PATH, NPM_ADVISORIES_PATH, NPM_TAGS_PATH, NPM_SOCKET_PATH, NPM_PROVENANCE_PATH, NPM_PRETTY_PATH,
-  NPM_RENAME_DIFF_PATH, NPM_TYPE_ONLY_PATH, NPM_RISK_PATH])
+  NPM_RENAME_DIFF_PATH, NPM_TYPE_ONLY_PATH, NPM_RISK_PATH, NPM_COMPARISON_PATH])
 // How long an npm response may go unread before its connection is dropped.
 const NPM_RESPONSE_IDLE_MS = 60_000
 const MAX_TEAM_NAME = 100
@@ -581,6 +584,24 @@ async function readWorkspaceSession(res: ServerResponse, deps: ManagedHttpDeps,
   return s
 }
 
+// Who am I? While an admin views as another user, that user, plus the admin
+// as `viewer`. A view that has ended (with the admin's session or role, or the
+// viewed account) is cleared, returning to the own session. Null signed out.
+async function currentSession(config: ManagedConfig, db: ManagedDb, cookie: string | undefined): Promise<{ body: ManagedSessionInfo | null; headers: Record<string, string> }> {
+  const now = Date.now()
+  let s = await readSession(config, db, cookie, now)
+  const ended = s == null && viewToken(config, cookie) != null
+  if (ended) s = await readSession(config, db, cookie, now, { own: true })
+  return {
+    body: s && {
+      user: { id: s.user.id, login: s.user.login, name: s.user.name, role: s.user.role },
+      csrfToken: s.session.csrfToken,
+      ...(s.session.viewer ? { viewer: s.session.viewer } : {}),
+    },
+    headers: ended ? { 'set-cookie': clearViewCookie(config) } : {},
+  }
+}
+
 // GET /api/admin/scan/models — the server's canonical scan model ids and effort
 // levels. Names are intentionally absent; the client derives them from ids.
 async function handleListModels(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
@@ -1515,18 +1536,25 @@ async function handleBundleCache(req: IncomingMessage, res: ServerResponse, deps
   await sendEncoded(req, res, cached, contentType, headers)
 }
 
+// Two bundles a reader asks about together, where they may read both, else
+// null, told as 401 or 404: asked before what is worked out of them and
+// again before it is sent.
+function bothBundles(res: ServerResponse, deps: ManagedHttpDeps, session: ManagedSession, id: string, otherId: string) {
+  return async () => {
+    const [base, other] = await Promise.all([id, otherId].map(bundle => deps.db.getBundleAccessSnapshot(session.id, Date.now(), bundle)))
+    if (!base || !other) { sendJson(res, 401, { error: 'unauthenticated' }); return null }
+    if (!base.bundle || !other.bundle) { sendJson(res, 404, { error: 'no-bundle' }); return null }
+    return [base.bundle, other.bundle] as const
+  }
+}
+
 // GET /api/bundles/:id/rename-diff: one of its JavaScript files diffed with
 // one of the `other` bundle's, both pretty-printed, renamed names hidden
 // (rename-diff.ts), for a reader of both, checked again once it is worked out.
 async function handleBundleRenameDiff(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, session: ManagedSession, id: string, params: URLSearchParams) {
   const otherId = params.get('other') ?? '', request = renameDiffRequest(params)
   if (!request || !/^[a-f\d-]{36}$/iu.test(otherId)) { sendJson(res, 400, { error: 'bad-file' }); return }
-  const readable = async () => {
-    const [base, other] = await Promise.all([id, otherId].map(bundle => deps.db.getBundleAccessSnapshot(session.id, Date.now(), bundle)))
-    if (!base || !other) { sendJson(res, 401, { error: 'unauthenticated' }); return null }
-    if (!base.bundle || !other.bundle) { sendJson(res, 404, { error: 'no-bundle' }); return null }
-    return [base.bundle, other.bundle] as const
-  }
+  const readable = bothBundles(res, deps, session, id, otherId)
   const records = await readable()
   if (!records) return
   const { prettyCache } = deps
@@ -1542,6 +1570,25 @@ async function handleBundleRenameDiff(req: IncomingMessage, res: ServerResponse,
   else diff.stream.destroy()
 }
 
+// GET /api/bundles/:id/comparison?other=: its files paired with the `other`
+// bundle's as Compare pairs them, with what its Overview reads beside them
+// (comparison.ts), within a reason `scope` where given; for a reader of
+// both, checked again once it is worked out.
+async function handleBundleComparison(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, session: ManagedSession, id: string, params: URLSearchParams) {
+  const otherId = params.get('other') ?? ''
+  if (!/^[a-f\d-]{36}$/iu.test(otherId)) { sendJson(res, 400, { error: 'bad-bundle' }); return }
+  const readable = bothBundles(res, deps, session, id, otherId)
+  const records = await readable()
+  if (!records) return
+  const { prettyCache } = deps
+  if (!prettyCache) { sendJson(res, 503, { error: 'unavailable' }); return }
+  let body
+  try { body = await comparisonBody(await prettyCache.bundleDetails(records[0]), await prettyCache.bundleDetails(records[1]), params.get('scope') ?? '') }
+  catch (err) { sendJson(res, err instanceof PrettyError ? err.status : 422, { error: err instanceof PrettyError ? err.message : 'bundle-unavailable' }); return }
+  if (await readable()) await sendEncoded(req, res, body, 'application/json')
+  else body.stream.destroy()
+}
+
 // GET /api/bundles/:id/pretty?other=: the files that changed between it and
 // the `other` bundle, both sides' pretty-printed (pretty-print.ts compared), a
 // line each as it is found kept or formatted; GET
@@ -1898,7 +1945,7 @@ async function handleMyTeams(res: ServerResponse, deps: ManagedHttpDeps, session
   // The revision sent is the reloaded catalog's, so classify what changed now.
   const apps = await teamAppStates(deps.db, deps.reportStore, session.id, teams, classified)
   sendJson(res, 200, {
-    teams: teams.map(team => ({ ...team, app: apps.get(teamAppKey(team)) ?? null,
+    teams: teams.map(team => ({ ...withWorkspaceSummary(team, apps.get(teamAppKey(team))),
       bundles: team.bundles.map(bundle => ({ ...bundle, ...(summaries.get(bundle.integrity) ?? { summary: null, summaryRetryAt: null }),
         commitInfo: commits.commitInfo(bundle) })) })),
     revision,
@@ -2854,7 +2901,7 @@ async function handleNpmReviews(req: IncomingMessage, res: ServerResponse, deps:
   } finally { res.off('close', onClose) }
 }
 
-// GET /api/npm/{package,versions,download,stats,advisories,tags,socket,provenance,pretty,rename-diff,type-only}. Only readers with private access
+// GET /api/npm/{package,versions,download,stats,advisories,tags,socket,provenance,pretty,rename-diff,type-only,risk,comparison}. Only readers with private access
 // (canReadPrivateNpm) can be answered from the server's npm token; the rest get
 // what the registry answers anonymously, every time (see npm-packages.ts).
 // Access is checked again after the registry's answer.
@@ -2864,14 +2911,17 @@ async function handleNpm(req: IncomingMessage, res: ServerResponse, deps: Manage
   // All but the package's own (its versions, figures and advisories) are a version's.
   const versioned = path !== NPM_VERSIONS_PATH && path !== NPM_STATS_PATH && path !== NPM_ADVISORIES_PATH
   const otherSpec = params.get('otherVersion') ?? ''
-  if (!isNpmPackageName(name) || (versioned && !isNpmPackageSpec(spec)) || ((path === NPM_RENAME_DIFF_PATH || path === NPM_TYPE_ONLY_PATH) && !isNpmPackageSpec(otherSpec))
+  // The package a comparison's other side is a version of, another where Review compares a dependency replaced.
+  const otherName = path === NPM_COMPARISON_PATH ? params.get('otherName') ?? name : name
+  if (!isNpmPackageName(name) || !isNpmPackageName(otherName) || (versioned && !isNpmPackageSpec(spec)) || ((path === NPM_RENAME_DIFF_PATH || path === NPM_TYPE_ONLY_PATH) && !isNpmPackageSpec(otherSpec))
     || (path === NPM_PRETTY_PATH && otherSpec !== '' && !isNpmPackageSpec(otherSpec))
-    || (path === NPM_RISK_PATH && otherSpec !== '' && otherSpec !== '(empty)' && !isNpmPackageSpec(otherSpec))) {
+    || (path === NPM_RISK_PATH && otherSpec !== '' && otherSpec !== '(empty)' && !isNpmPackageSpec(otherSpec))
+    || (path === NPM_COMPARISON_PATH && otherSpec !== '(empty)' && !isNpmPackageSpec(otherSpec))) {
     sendJson(res, 400, { error: 'bad-package' }); return
   }
   const diffed = path === NPM_RENAME_DIFF_PATH && params.has('path') ? renameDiffRequest(params) : null
   if (path === NPM_RENAME_DIFF_PATH && params.has('path') && !diffed) { sendJson(res, 400, { error: 'bad-file' }); return }
-  const reader = await npmReader(deps, cookie, [name])
+  const reader = await npmReader(deps, cookie, otherName === name ? [name] : [name, otherName])
   if (reader == null) { sendJson(res, 401, { error: 'unauthenticated' }); return }
   const controller = new AbortController()
   const onClose = () => { if (!res.writableEnded) controller.abort() }
@@ -2970,6 +3020,28 @@ async function handleNpm(req: IncomingMessage, res: ServerResponse, deps: Manage
       return
     }
     if (path === NPM_PROVENANCE_PATH) { await reply(doc.private, { name, version: doc.version, provenance: await provenanceOf() }); return }
+    // Its files paired with those of `otherVersion` (of `otherName`, else the
+    // same package), as Compare and Review pair them, with what their
+    // Overview reads beside them (comparison.ts): the version shown against
+    // the one compared with, or `(empty)`, none, as Review reads a first
+    // version. Read of both, each package's access checked again once worked out.
+    if (path === NPM_COMPARISON_PATH) {
+      const old = otherSpec === '(empty)' ? null : found(await readNpmVersion(otherName, otherSpec, canReadPrivateNpm(reader, otherName), controller.signal, keptVersions))
+      res.setTimeout(NPM_RESPONSE_IDLE_MS, () => res.destroy())
+      const loads = [doc, ...old ? [old] : []].map(loadNpmFiles)
+      let body
+      try {
+        const [files, oldFiles] = await Promise.all(loads.map(load => load.result))
+        body = await comparisonBody(old ? npmComparedSide(old.dist.integrity, oldFiles!) : emptySide(), npmComparedSide(doc.dist.integrity, files!))
+      } finally { for (const load of loads) load.release() }
+      const current = await npmReader(deps, cookie, otherName === name ? [name] : [name, otherName])
+      if (current == null) { body.stream.destroy(); sendJson(res, 401, { error: 'unauthenticated' }); return }
+      if ((doc.private && !canReadPrivateNpm(current, name)) || (old?.private && !canReadPrivateNpm(current, otherName))) {
+        body.stream.destroy(); sendJson(res, 404, { error: 'package-not-found' }); return
+      }
+      if (!res.destroyed) await sendEncoded(req, res, body, 'application/json')
+      return
+    }
     // Every one of its files that needs it pretty-printed (pretty-print.ts
     // npmAll), or, against another version, the files that changed between
     // them, both sides' (compared), a line each as it is formatted, or found
@@ -3110,13 +3182,16 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
     }
 
     // Public mode probe — lets a client detect the managed protocol up front.
+    // It also sends the session, sparing the client's GET /api/auth/session;
+    // a failed read leaves that request to the client, never failing the probe.
     if (path === CONFIG_PATH) {
       if (method !== 'GET') { send405(res, 'GET'); return }
       const info = deps.serverInfo ?? { mode: 'managed', managed: { loginPath: LOGIN_PATH, cookieName: config.sessionCookieName } }
+      const current = await currentSession(config, db, cookie).catch((err) => { console.warn('managed: config session read failed:', err); return null })
       sendJson(res, 200, { ...info, ...(config.githubNewIssueLabels ? { githubNewIssueLabels: config.githubNewIssueLabels } : {}),
         managed: { ...info.managed, ...(config.allowShare ? { allowShare: true } : {}), ...(deps.uploadStore ? {
           uploadChunkBytes: UPLOAD_CHUNK_BYTES, uploadMaxBytes: { reports: config.maxReportBytes, bundles: config.maxBundleBytes },
-        } : {}) } })
+        } : {}) }, ...(current ? { session: current.body } : {}) }, current?.headers)
       return
     }
     if (viewing && underPrefix(path, VIEW_PREFIXES) && !viewAllows(method, path)) { sendViewOnly(res); return }
@@ -3159,22 +3234,11 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
       res.writeHead(302, { location: result.location, 'set-cookie': result.setCookie, 'cache-control': 'no-store' })
       res.end(); return
     }
-    // Who am I? While an admin views as another user, that user, plus the
-    // admin as `viewer`. A view that has ended (with the admin's session or
-    // role, or the viewed account) is cleared, returning to the own session.
     if (path === SESSION_PATH) {
       if (method !== 'GET') { send405(res, 'GET'); return }
-      const now = Date.now()
-      let s = await readSession(config, db, cookie, now)
-      const ended = s == null && viewing
-      if (ended) s = await readSession(config, db, cookie, now, { own: true })
-      const headers: Record<string, string> = ended ? { 'set-cookie': clearViewCookie(config) } : {}
-      if (s == null) { sendJson(res, 401, { error: 'unauthenticated' }, headers); return }
-      sendJson(res, 200, {
-        user: { id: s.user.id, login: s.user.login, name: s.user.name, role: s.user.role },
-        csrfToken: s.session.csrfToken,
-        ...(s.session.viewer ? { viewer: s.session.viewer } : {}),
-      }, headers)
+      const { body, headers } = await currentSession(config, db, cookie)
+      if (body == null) { sendJson(res, 401, { error: 'unauthenticated' }, headers); return }
+      sendJson(res, 200, body, headers)
       return
     }
     if (path === VIEW_AS_PATH) { await handleViewAs(req, res, deps, cookie); return }
@@ -3302,9 +3366,13 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
       await handleBundleAdvisories(res, deps, workspaceSession!.session, bundleAdvisories[1]!, url.searchParams.get('team'), url.searchParams.get('reason') ?? '', url.searchParams.get('repoAdvisories') === 'true', url.searchParams.get('details') === 'true')
       return
     }
-    const bundleRead = /^\/api\/bundles\/([a-f\d-]{36})\/(metadata|contents|download|pretty|rename-diff|type-only)$/iu.exec(path)
+    const bundleRead = /^\/api\/bundles\/([a-f\d-]{36})\/(metadata|contents|download|pretty|rename-diff|type-only|comparison)$/iu.exec(path)
     if (bundleRead) {
       const id = bundleRead[1]!, part = bundleRead[2]!, { session } = workspaceSession!, { bundleCache, prettyCache } = deps
+      if (part === 'comparison') {
+        if (method !== 'GET') { send405(res, 'GET'); return }
+        await handleBundleComparison(req, res, deps, session, id, url.searchParams); return
+      }
       if (part === 'rename-diff' || part === 'type-only' || (part === 'pretty' && url.searchParams.has('other'))) {
         if (method !== 'GET') { send405(res, 'GET'); return }
         if (part === 'rename-diff' && url.searchParams.has('path')) { await handleBundleRenameDiff(req, res, deps, session, id, url.searchParams); return }

package/server-managed/locked-packages.ts

@@ -95,3 +95,14 @@ export function lockedPackages(format: LockfileFormat, text: string): LockedPack
   }
   return [...found.values()]
 }
+
+// Whether a lockfile at `path` is a test's fixture or example: under a
+// directory of tests (`test`, `tests`, `__tests__` and such), in one of
+// fixtures or examples (`fixture`, `fixtures`, `example`, `examples`) inside
+// it, as a test may keep one its readers refuse on purpose.
+const FIXTURES_DIR = /^(?:fixture|example)s?$/u, TESTS_DIR = /^_*tests?_*$/u
+export function isTestFixture(path: string) {
+  const dirs = path.split('/').slice(0, -1)
+  const tests = dirs.findIndex(dir => TESTS_DIR.test(dir))
+  return tests !== -1 && dirs.slice(tests + 1).some(dir => FIXTURES_DIR.test(dir))
+}

package/server-managed/pretty-print.ts

@@ -250,18 +250,21 @@ export function stalePrettyRemover(npm: CacheStorage): (signal?: AbortSignal) =>
   }
 }
 
+// A bundle's details, from its bytes in `store`: bundles are read one at a
+// time, as reading one decodes all of it.
+function detailsReader(store: BundleStore) {
+  const enqueue = serial()
+  return (record: ManagedBundle) => enqueue(async () => {
+    const details = await readBundleDetails(record, store)
+    if (!details) throw new PrettyError(422, 'bundle-unavailable')
+    return details
+  })
+}
+
 export function createPrettyCache(bundles: BundleCacheStorage, npm: CacheStorage, db: Pick<ManagedDb, 'getBundle'>, store: BundleStore) {
   // Copies being made; readers asking for one meanwhile share it.
   const shared = sharing<Buffer>()
-  // Bundles are read one at a time: reading one decodes all of it.
-  const enqueue = serial()
-  function bundleDetails(record: ManagedBundle) {
-    return enqueue(async () => {
-      const details = await readBundleDetails(record, store)
-      if (!details) throw new PrettyError(422, 'bundle-unavailable')
-      return details
-    })
-  }
+  const bundleDetails = detailsReader(store)
   // A bundle's file pretty-printed from the text `read` reads, and kept in
   // its cache.
   function bundleCopy(record: ManagedBundle, request: PrettyRequest, read: () => Promise<string>): Promise<Buffer> {
@@ -341,6 +344,8 @@ export function createPrettyCache(bundles: BundleCacheStorage, npm: CacheStorage
         made: async (request, text) => opened(await bundleCopy(record, request, () => Promise.resolve(text))) })
       return [await sideOf(base, 'base'), await sideOf(other, 'other')]
     },
+    // A bundle's details, read in its turn, as Compare pairs them (comparison.ts).
+    bundleDetails,
     async npmSides(base: NpmVersionDocument, other: NpmVersionDocument): Promise<[ComparedSide, ComparedSide]> {
       const sideOf = async (doc: NpmVersionDocument, side: Side): Promise<ComparedSide> => ({ side, ...await sideFiles(await npmFiles(doc)), packageDirs: null,
         kept: request => (doc.private ? Promise.resolve(null) : kept(() => npm.open(prettyFile(request)))),

package/server-managed/public-workspace.ts

@@ -17,7 +17,8 @@ import { serveTeamFeed } from './team-feed.ts'
 import { type ComparedSide, PrettyError, compared, prettyRequest, prettyText } from './pretty-print.ts'
 import { renameDiffOf, renameDiffRequest, renamedPairs } from './rename-diff.ts'
 import { typeOnlyFiles } from './type-only.ts'
-import { sharedTeamApp } from './team-app.ts'
+import { comparisonBody } from './comparison.ts'
+import { sharedTeamApp, withWorkspaceSummary } from './team-app.ts'
 
 function json(res: ServerResponse, status: number, body: unknown): void {
   sendJson(res, status, body, { 'cache-control': 'private, no-store', 'referrer-policy': 'no-referrer' })
@@ -35,7 +36,7 @@ export async function handlePublicWorkspace(req: IncomingMessage, res: ServerRes
   const shareRoute = /^\/api\/shares\/([A-Za-z0-9_-]+)\/workspace$/u.exec(url.pathname)
   const teamRoute = /^\/api\/teams\/([^/]+)\/(shared|reports|feed|annotations)$/u.exec(url.pathname)
   const reportRoute = /^\/api\/reports\/([^/]+)\/(triage|comments|sources)$/u.exec(url.pathname)
-  const bundleRoute = /^\/api\/bundles\/([^/]+)\/(metadata|contents|download|advisories|pretty|rename-diff|type-only)$/u.exec(url.pathname)
+  const bundleRoute = /^\/api\/bundles\/([^/]+)\/(metadata|contents|download|advisories|pretty|rename-diff|type-only|comparison)$/u.exec(url.pathname)
   if (!shareRoute && !teamRoute && !reportRoute && !bundleRoute) { json(res, 403, { error: 'share-scope-required' }); return }
   const tokenHash = hashToken(token)
   const snapshot = await deps.db.getWorkspaceShare(tokenHash)
@@ -46,8 +47,8 @@ export async function handlePublicWorkspace(req: IncomingMessage, res: ServerRes
   }
   const send = async (body: unknown) => { await recheck(); json(res, 200, body) }
   const sendTeam = async () => {
-    const [summaries, app] = await Promise.all([bundleSummaries(snapshot.team.bundles, deps.bundleCache), sharedTeamApp(deps.db, deps.reportStore, snapshot)])
-    await send({ user: snapshot.user, team: { ...snapshot.team, app,
+    const [summaries, workspace] = await Promise.all([bundleSummaries(snapshot.team.bundles, deps.bundleCache), sharedTeamApp(deps.db, deps.reportStore, snapshot)])
+    await send({ user: snapshot.user, team: { ...withWorkspaceSummary(snapshot.team, workspace),
       bundles: snapshot.team.bundles.map(bundle => ({ ...bundle, ...(summaries.get(bundle.integrity) ?? { summary: null, summaryRetryAt: null }) })),
     } })
     await backfillBundleSummaries(snapshot.team.bundles, deps.bundleCache)
@@ -101,7 +102,7 @@ export async function handlePublicWorkspace(req: IncomingMessage, res: ServerRes
   const bundle = snapshot.bundles.find(item => item.id === bundleRoute![1])
   if (!bundle) { json(res, 404, { error: 'no-bundle' }); return }
   if (bundleRoute![2] === 'advisories' && !snapshot.permissions.security) { json(res, 403, { error: 'security-access-required' }); return }
-  if (bundleRoute![2] === 'rename-diff' || bundleRoute![2] === 'type-only' || (bundleRoute![2] === 'pretty' && url.searchParams.has('other'))) {
+  if (bundleRoute![2] === 'rename-diff' || bundleRoute![2] === 'type-only' || bundleRoute![2] === 'comparison' || (bundleRoute![2] === 'pretty' && url.searchParams.has('other'))) {
     if (method !== 'GET') { json(res, 405, { error: 'method-not-allowed' }); return }
     await serveCompared(res, deps, bundle, snapshot.bundles.find(item => item.id === url.searchParams.get('other')), bundleRoute![2], url, recheck, stream); return
   }
@@ -109,11 +110,12 @@ export async function handlePublicWorkspace(req: IncomingMessage, res: ServerRes
 }
 
 // What a bundle is compared with `other`, another of the link's bundles, by:
-// one of their JavaScript files diffed with renamed names hidden, or the
-// files that changed between them, or the pairs of those, or those that
-// changed in types alone, a line each.
+// their files paired, as one comparison; one of their JavaScript files diffed
+// with renamed names hidden; or the files that changed between them, or the
+// pairs of those, or those that changed in types alone, a line each.
 function serveCompared(res: ServerResponse, deps: ManagedHttpDeps, bundle: ManagedBundle, other: ManagedBundle | undefined, part: string, url: URL,
   recheck: () => Promise<void>, stream: (stored: OpenedBlob, encoding: string | null, contentType?: string) => Promise<void>) {
+  if (part === 'comparison') return serveComparison(res, deps, bundle, other, url, stream)
   if (part === 'rename-diff' && url.searchParams.has('path')) return serveRenameDiff(res, deps, bundle, other, url, stream)
   return serveChanges(res, deps, bundle, other, recheck, part === 'pretty' ? compared : part === 'type-only' ? typeOnlyFiles : renamedPairs,
     part === 'pretty' ? '' : url.searchParams.get('scope') ?? '')
@@ -139,6 +141,22 @@ async function serveRenameDiff(res: ServerResponse, deps: ManagedHttpDeps, bundl
   await stream(diff, 'br')
 }
 
+// A bundle's files paired with `other`'s, another of the link's bundles, as
+// Compare pairs them (comparison.ts), within a reason `scope` where given.
+async function serveComparison(res: ServerResponse, deps: ManagedHttpDeps, bundle: ManagedBundle, other: ManagedBundle | undefined, url: URL,
+  stream: (stored: OpenedBlob, encoding: string | null, contentType?: string) => Promise<void>) {
+  if (!other) { json(res, 404, { error: 'no-bundle' }); return }
+  const { prettyCache } = deps
+  if (!prettyCache) { json(res, 503, { error: 'unavailable' }); return }
+  let body
+  try { body = await comparisonBody(await prettyCache.bundleDetails(bundle), await prettyCache.bundleDetails(other), url.searchParams.get('scope') ?? '') }
+  catch (err) {
+    if (err instanceof PrettyError) { json(res, err.status, { error: err.message }); return }
+    throw err
+  }
+  await stream(body, 'br')
+}
+
 // The files that changed between a bundle and `other`, another of the link's
 // bundles, both sides' pretty-printed (pretty-print.ts compared), or the pairs
 // of them its viewer diffs with renamed names hidden (rename-diff.ts

package/server-managed/repository-risk.ts

@@ -28,7 +28,7 @@ import type { NpmVersionDocument } from './npm-packages.ts'
 import { type Lru, lru } from './lru.ts'
 import type { KeptStore } from './npm-kept.ts'
 import { MAX_SPARE_ASSESSMENTS } from './npm-risk.ts'
-import { type LockedPackage, lockedPackages } from './locked-packages.ts'
+import { type LockedPackage, isTestFixture, lockedPackages } from './locked-packages.ts'
 import { type Queue, queue } from './queue.ts'
 import { type DownloadsSource, readyingDownloads } from './scan-downloads.ts'
 import { type AssessedPackage, type Assessment, BUSY_RETRIES, BUSY_WAIT_MS, RISK_KEPT_MS, type RiskFailure, assessPackage, failureOf, isBusy } from './repository-risk-assess.ts'
@@ -334,33 +334,35 @@ async function readAdvisories(scan: Scan, { repo, path, format, packages }: Lock
 // A repository's line, its lockfiles or why they couldn't be listed, and
 // then its lockfiles', and their advisories: told once they are all read
 // and access to the repository is checked again, as GitHub may have
-// withdrawn it meanwhile.
+// withdrawn it meanwhile. A test's fixture or example its reader refuses
+// (isTestFixture) isn't told at all, as a test may keep one so on purpose.
 async function readRepository(scan: Scan, repo: RepositoryRiskRepo) {
   const listed = await listLockfiles(scan, repo)
   if (!listed) return
-  const lockfiles: LockfileLine[] = []
+  const lockfiles: { sha: string; line: LockfileLine }[] = []
   for (const lockfile of listed.lockfiles) {
     if (scan.signal.aborted) return
-    lockfiles.push(await readLockfile(scan, repo.repoId, listed.opened, lockfile))
+    const line = await readLockfile(scan, repo.repoId, listed.opened, lockfile)
+    if (!('error' in line && line.error === 'lockfile-unreadable' && isTestFixture(line.path))) lockfiles.push({ sha: lockfile.sha, line })
   }
   try { await listed.opened.recheck() } catch (error) {
     if (!scan.signal.aborted) scan.lines.add({ type: 'repo', id: repo.repoId, ...failureOf(error, 'checking access to it again') })
     return
   }
   if (scan.signal.aborted) return
-  scan.lines.add({ type: 'repo', id: repo.repoId, commit: listed.opened.commit, lockfiles: listed.lockfiles.map(({ path, format }) => ({ path, format })) })
-  for (const line of lockfiles) {
+  scan.lines.add({ type: 'repo', id: repo.repoId, commit: listed.opened.commit, lockfiles: lockfiles.map(({ line: { path, format } }) => ({ path, format })) })
+  for (const { line } of lockfiles) {
     scan.lines.add(line)
     if ('packages' in line) assessLater(scan, line.packages)
   }
-  for (const [at, line] of lockfiles.entries()) {
+  for (const { sha, line } of lockfiles) {
     if (scan.signal.aborted) return
-    const advisories = 'packages' in line ? await readAdvisories(scan, line, listed.lockfiles[at]!.sha) : null
+    const advisories = 'packages' in line ? await readAdvisories(scan, line, sha) : null
     if (advisories) scan.lines.add(advisories)
   }
   if (scan.signal.aborted) return
   scan.told.set(repo.repoId, { id: repo.repoId, name: repo.fullName, paths: repo.paths ?? null,
-    lockfiles: lockfiles.flatMap((line, at) => 'packages' in line ? [`${line.format}\0${listed.lockfiles[at]!.sha}`] : []) })
+    lockfiles: lockfiles.flatMap(({ sha, line }) => 'packages' in line ? [`${line.format}\0${sha}`] : []) })
 }
 
 // Whether an earlier part told `repo` whole, by its name and a team's