@preventive/triage 1.0.0-alpha.43 → 1.0.0-alpha.45

package/common/managed/agent-tasks.ts

@@ -0,0 +1,292 @@
+// Agents' sessions and their tasks, reconstructed from what each
+// leaves on GitHub (the code viewer's Agents tab, repository-agents.js): a
+// task is a pull request it opened, or a commit it pushed to the default
+// branch without one; a session holds as many as name it, with the branches
+// they are on and the issues they work on. The server reads each artifact's
+// own texts, never others' comments on it (a pull request's body and its
+// head and merge commits' messages, where an agent links its session; a
+// commit's message; a branch's tip commit) for the marks an agent leaves
+// (agentSignals), sending those alone; agentSessions then groups them:
+// those naming one session, a pull request with its branch, a branch with
+// the session its commits name, an issue with the pull requests closing it
+// or a branch named for it. Without a session named, a branch's pull
+// requests are one session, and a commit its own.
+//
+// The agents are Claude and Codex, and those the server knows by their GitHub
+// Apps or accounts (repository-agents.ts APP_AGENTS): each told by its
+// fingerprint, a line of its texts, by the account its work is authored by,
+// or by its branches' prefix, the server's to read, and named to the client
+// by its id, name and avatar (AppAgent). Such an agent names no session:
+// a pull request of its is a session alone, with its branch; Claude's or
+// Codex's marks on its work show those as its tools. A pull request labelled
+// for an agent (labelAgents) is that agent's too, where its own texts and
+// branch name none: the mark one who ran it gives work it left unmarked.
+
+// 'claude', 'codex', or an app agent's id.
+export type Agent = string
+
+// An agent known by its GitHub App or account, as the server names it to the
+// client: its id, its name, and its avatar, its mark (/api/avatar/<avatar>:
+// `app-<id>` a GitHub App's, `user-<id>` a GitHub account's), where the app
+// draws no mark of its own for it (Copilot's, ui/view/repository-tiles.js).
+export interface AppAgent { id: string; name: string; avatar?: string }
+// How the server tells one: its fingerprint, a line of an artifact's texts
+// starting with it; the GitHub account its work is authored by, its id and
+// the logins GitHub names it by; its branches' prefix.
+export interface AppAgentMarks { id: string; fingerprint?: string; account?: { id: number; logins: readonly string[] }; prefix: string }
+// An artifact's author, as GitHub names its account: its login and id.
+export interface AgentAuthor { login: string; id: number }
+
+// What an artifact's texts say of the agents that made it: the Claude Code
+// sessions and Codex tasks they link, whether they carry Claude's marks,
+// its co-author trailer or its "Generated with" line, and Codex's, its
+// co-author trailer, and the app agents whose fingerprints they carry, or
+// whose branch it is.
+export interface AgentSignals { sessions: string[]; tasks: string[]; claude: boolean; codex: boolean; agents: string[] }
+
+// Each by its author's login, and their account's numeric id (`authorId`)
+// where GitHub names it.
+export interface AgentPull { number: number; title: string; state: 'open' | 'merged' | 'closed'; draft: boolean; author: string | null; authorId?: number | null
+  // Its branch, and the owner of the fork it is in, null where it is in the
+  // repository itself.
+  createdAt: number | null; updatedAt: number | null; head: string | null; fork: string | null; additions: number; deletions: number; commits: number
+  closes: number[]; signals: AgentSignals }
+export interface AgentIssue { number: number; title: string; state: 'open' | 'closed'; author: string | null; authorId?: number | null; createdAt: number | null; updatedAt: number | null }
+export interface AgentBranch { name: string; at: number | null; author: string | null; authorId?: number | null; signals: AgentSignals }
+// A commit to the default branch no pull request merged.
+export interface AgentCommit { oid: string; title: string; at: number | null; author: string | null; authorId?: number | null; additions: number; deletions: number
+  signals: AgentSignals }
+
+export interface AgentSession {
+  id: string
+  agents: Agent[]
+  // Where to open it: a Claude Code session or a Codex task.
+  sessions: string[]
+  tasks: string[]
+  title: string
+  authors: string[]
+  startedAt: number | null
+  updatedAt: number | null
+  state: 'open' | 'merged' | 'closed' | 'branch'
+  // Its tasks: the pull requests it opened, and the commits it pushed to
+  // the default branch, the newest first.
+  pulls: Pick<AgentPull, 'number' | 'title' | 'state' | 'draft'>[]
+  commits: Pick<AgentCommit, 'oid' | 'title'>[]
+  issues: Pick<AgentIssue, 'number' | 'title' | 'state'>[]
+  branches: string[]
+  // The commits its pull requests hold, and their lines and its commits'.
+  commitCount: number
+  additions: number
+  deletions: number
+}
+
+const SESSION = /https:\/\/claude\.ai\/code\/(session_[A-Za-z\d]{6,64})\b/gu
+const CODEX_TASK = /https:\/\/chatgpt\.com\/codex\/tasks\/(task_[a-z]_[A-Za-z\d]{6,64})\b/gu
+// Claude's marks on its commits and pull requests: its co-author trailer,
+// its "Generated with" line, its session trailer.
+const CLAUDE_MARK = /^co-authored-by: claude\b|generated with \[claude code\]|^claude-session:/imu
+// Codex's: its co-author trailer, by its address, as Codex names itself
+// co-author of the commits it makes as whoever ran it; a trailer of a text's
+// trailers (trailerBlock), not a line before them that shows one.
+const CODEX_MARK = /^co-authored-by:[ \t]*[^<\n]*<codex@openai\.com>[ \t]*$/imu
+const MAX_LINKS = 8
+
+// A message's trailers, as git reads them (`git interpret-trailers`): its
+// last paragraph, past its subject's, where each of its lines is a trailer
+// (`Key: value`) or goes on with one (indented), or, where it holds git's
+// own `Signed-off-by:`, a quarter of them are; none where it isn't, as
+// lines a description or example holds, fenced or not, are not.
+const TRAILER_LINE = /^[A-Za-z\d-]+[ \t]*:/u
+export function trailerBlock(text: string): string {
+  const paragraphs = text.replaceAll('\r\n', '\n').trim().split(/\n[ \t]*\n/u)
+  const block = paragraphs.length > 1 ? paragraphs.at(-1)! : ''
+  const lines = block.split('\n')
+  const trailers = lines.filter(line => TRAILER_LINE.test(line)).length
+  const others = lines.filter((line, at) => !TRAILER_LINE.test(line) && !(at > 0 && /^[ \t]/u.test(line))).length
+  return others === 0 || (lines.some(line => /^signed-off-by[ \t]*:/iu.test(line)) && trailers * 3 >= others) ? block : ''
+}
+
+// The agents of those whose ids are `ids` that `labels` name (a pull
+// request's): a label an agent's id, regardless of case, alone or after
+// `agent:` or `agent/` (`Codex`, `agent: claude`).
+const LABEL = /^(?:agent[:/] ?)?([a-z][a-z\d-]*)$/u
+export function labelAgents(labels: unknown[], ids: readonly string[]): Agent[] {
+  return [...new Set(labels.flatMap(label => {
+    const id = typeof label === 'string' ? LABEL.exec(label.trim().toLowerCase())?.[1] : undefined
+    return id !== undefined && ids.includes(id) ? [id] : []
+  }))]
+}
+
+// The sessions and tasks `texts` link, whether they carry Claude's marks and
+// Codex's, and the agents of `apps` whose fingerprints start a line of them
+// (not one a text quotes, as one describing it may), whose account `author`
+// is, by its id and login both, or whose prefix the branch `branch` is under;
+// Claude, Codex or the agents of `apps` its `labels` name (labelAgents).
+export function agentSignals(texts: unknown[], apps: readonly AppAgentMarks[] = [], branch: string | null = null,
+  author: AgentAuthor | null = null, labels: unknown[] = []): AgentSignals {
+  const strings = texts.filter((text): text is string => typeof text === 'string')
+  const found = (pattern: RegExp) => [...new Set(strings.flatMap(text => [...text.matchAll(pattern)].map(match => match[1]!)))].slice(0, MAX_LINKS)
+  const lines = strings.flatMap(text => text.split('\n').map(line => line.trimStart()))
+  const login = author?.login.toLowerCase()
+  const authored = ({ account }: AppAgentMarks) => author !== null && account !== undefined && account.id === author.id
+    && account.logins.some(name => name.toLowerCase() === login)
+  const labelled = labelAgents(labels, ['claude', 'codex', ...apps.map(app => app.id)])
+  return { sessions: found(SESSION), tasks: found(CODEX_TASK), claude: labelled.includes('claude') || strings.some(text => CLAUDE_MARK.test(text)),
+    codex: labelled.includes('codex') || strings.some(text => CODEX_MARK.test(trailerBlock(text))),
+    agents: apps.filter(app => (app.fingerprint && lines.some(line => line.startsWith(app.fingerprint!)))
+      || authored(app) || branch?.startsWith(app.prefix) || labelled.includes(app.id)).map(app => app.id) }
+}
+
+// The agent a branch's name says made it, and the issue or pull request the
+// Claude GitHub App names its branch for (`claude/issue-12-…`).
+export function agentBranch(name: string | null): { agent: Agent | null; issue: number | null; pull: number | null } {
+  const agent = name?.startsWith('claude/') ? 'claude' : name?.startsWith('codex/') ? 'codex' : null
+  const named = agent === 'claude' ? /^claude\/(issue|pr)-([1-9]\d{0,9})-/u.exec(name!) : null
+  return { agent, issue: named?.[1] === 'issue' ? Number(named[2]) : null, pull: named?.[1] === 'pr' ? Number(named[2]) : null }
+}
+
+// A pull request's branch, as GitHub names one in a fork: `owner:branch`;
+// two forks' of one name, or a fork's and the repository's, are two.
+const headName = (pull: AgentPull) => pull.head && pull.fork ? `${pull.fork}:${pull.head}` : pull.head
+
+const signalAgents = (signals: AgentSignals): Agent[] => [...signals.agents, ...signals.sessions.length > 0 || signals.claude ? ['claude'] : [],
+  ...signals.tasks.length > 0 || signals.codex ? ['codex'] : []]
+const TOOLS = new Set(['claude', 'codex'])
+
+type Artifacts = { pulls?: AgentPull[]; commits?: AgentCommit[]; issues?: AgentIssue[]; branches?: AgentBranch[] }
+type Group = { agents: Set<Agent>; keys: string[] }
+
+// The artifacts joined (`pull:<n>`, `commit:<oid>`, `branch:<name>`,
+// `session:<id>`, `task:<id>`), each set with the agents whose marks are on
+// them: by the sessions and tasks they link and the branches pull requests
+// are from. An app agent's join none by what they link, and a pull request
+// of its its branch alone, where no pull request newer is from it, an app
+// agent's or another's: one a session.
+function artifactGroups({ pulls = [], commits = [], branches = [] }: Artifacts): Group[] {
+  const parent = new Map<string, string>()
+  const find = (key: string): string => {
+    let root = key
+    while (parent.has(root) && parent.get(root) !== root) root = parent.get(root)!
+    parent.set(key, root)
+    return root
+  }
+  const join = (a: string, b: string) => {
+    const [x, y] = [find(a), find(b)]
+    if (x !== y) parent.set(y, x)
+  }
+  const agentsOf = new Map<string, Set<Agent>>()
+  const mark = (key: string, agents: Agent[]) => { for (const agent of agents) agentsOf.set(key, new Set([...agentsOf.get(key) ?? [], agent])) }
+  const linked = (key: string, signals: AgentSignals) => {
+    find(key)
+    if (signals.agents.length === 0) for (const session of signals.sessions) join(key, `session:${session}`)
+    if (signals.agents.length === 0) for (const task of signals.tasks) join(key, `task:${task}`)
+    mark(key, signalAgents(signals))
+  }
+  const branchNames = new Set(branches.map(branch => branch.name))
+  for (const branch of branches) {
+    const key = `branch:${branch.name}`
+    linked(key, branch.signals)
+    const { agent } = agentBranch(branch.name)
+    if (agent) mark(key, [agent])
+  }
+  // The newest pull request read from each branch, by its number, as GitHub
+  // numbers them as they are opened: they are read as they were updated.
+  const newest = new Map<string, number>()
+  for (const pull of pulls) {
+    const head = headName(pull)
+    if (head !== null && pull.number > (newest.get(head) ?? 0)) newest.set(head, pull.number)
+  }
+  for (const pull of pulls) {
+    const key = `pull:${pull.number}`
+    linked(key, pull.signals)
+    const { agent, pull: named } = agentBranch(pull.head)
+    if (agent) mark(key, [agent])
+    // Its branch, an agent's or its own, read or not; a fork's its own.
+    const head = headName(pull)
+    if (pull.signals.agents.length > 0) {
+      if (head !== null && newest.get(head) === pull.number) join(key, `branch:${head}`)
+      continue
+    }
+    if (head && (agent || signalAgents(pull.signals).length > 0 || branchNames.has(head))) join(key, `branch:${head}`)
+    if (named) join(key, `pull:${named}`)
+  }
+  for (const commit of commits) linked(`commit:${commit.oid}`, commit.signals)
+
+  const groups = new Map<string, Group>()
+  for (const key of parent.keys()) {
+    const root = find(key)
+    const group = groups.get(root) ?? { agents: new Set(), keys: [] }
+    group.keys.push(key)
+    for (const agent of agentsOf.get(key) ?? []) group.agents.add(agent)
+    groups.set(root, group)
+  }
+  return [...groups.values()]
+}
+
+const byTime = <T>(time: (item: T) => number | null) => (a: T, b: T) => (time(a) ?? 0) - (time(b) ?? 0)
+
+// The session a group of artifacts is, its tasks and what they touched; null
+// for one no agent left marks on, or holding none read.
+function sessionOf({ agents, keys }: Group, { pulls, commits, issues, branches }: {
+  pulls: Map<number, AgentPull>; commits: Map<string, AgentCommit>; issues: Map<number, AgentIssue>; branches: Map<string, AgentBranch> }): AgentSession | null {
+  if (agents.size === 0) return null
+  const of = (prefix: string) => keys.filter(key => key.startsWith(prefix)).map(key => key.slice(prefix.length))
+  const taskPulls = of('pull:').flatMap(number => pulls.get(Number(number)) ?? []).toSorted(byTime(pull => pull.createdAt))
+  const taskCommits = of('commit:').flatMap(oid => commits.get(oid) ?? []).toSorted(byTime(commit => commit.at))
+  const names = [...new Set([...of('branch:'), ...taskPulls.flatMap(pull => headName(pull) ?? [])])]
+  // The issues its pull requests close, and those its branches are named
+  // for, by a pull request's own name for its branch, a fork's too.
+  const issueNumbers = new Set([...taskPulls.flatMap(pull => pull.closes),
+    ...taskPulls.flatMap(pull => agentBranch(pull.head).issue ?? []), ...of('branch:').flatMap(name => agentBranch(name).issue ?? [])])
+  const taskIssues = [...issueNumbers].flatMap(number => issues.get(number) ?? []).toSorted(byTime(issue => issue.createdAt))
+  const taskBranches = names.flatMap(name => branches.get(name) ?? [])
+  const items = [...taskPulls, ...taskCommits, ...taskIssues, ...taskBranches]
+  if (items.length === 0) return null
+  const [codexTasks, sessions] = [of('task:'), of('session:')]
+  const started = items.flatMap(item => ('createdAt' in item ? item.createdAt : item.at) ?? [])
+  const updated = items.flatMap(item => ('updatedAt' in item ? item.updatedAt : item.at) ?? [])
+  const states = new Set(taskPulls.map(pull => pull.state))
+  // Its first task names it: the earliest of its pull requests and commits.
+  const first = [...taskPulls.map(pull => ({ at: pull.createdAt, title: pull.title })), ...taskCommits.map(commit => ({ at: commit.at, title: commit.title }))]
+    .toSorted(byTime(task => task.at))[0]
+  const landed = [...taskPulls, ...taskCommits]
+  return {
+    id: sessions[0] ?? codexTasks[0] ?? (taskPulls[0] ? `pull-${taskPulls[0].number}` : taskCommits[0]?.oid ?? names[0] ?? ''),
+    // An app agent's first, the one whose session it is, then the tools it
+    // used, Claude's or Codex's.
+    agents: [...[...agents].filter(agent => !TOOLS.has(agent)), ...['claude', 'codex'].filter(agent => agents.has(agent))],
+    sessions, tasks: codexTasks,
+    title: first?.title ?? taskIssues[0]?.title ?? names[0] ?? '',
+    authors: [...new Set(items.flatMap(item => item.author ?? []))],
+    startedAt: started.length > 0 ? Math.min(...started) : null,
+    updatedAt: updated.length > 0 ? Math.max(...updated) : null,
+    state: states.has('open') ? 'open' : states.has('merged') || taskCommits.length > 0 ? 'merged' : states.has('closed') ? 'closed' : 'branch',
+    pulls: taskPulls.map(({ number, title, state, draft }) => ({ number, title, state, draft })).toReversed(),
+    commits: taskCommits.map(({ oid, title }) => ({ oid, title })).toReversed(),
+    issues: taskIssues.map(({ number, title, state }) => ({ number, title, state })),
+    branches: names,
+    commitCount: taskPulls.reduce((sum, pull) => sum + pull.commits, 0) + taskCommits.length,
+    additions: landed.reduce((sum, item) => sum + item.additions, 0),
+    deletions: landed.reduce((sum, item) => sum + item.deletions, 0),
+  }
+}
+
+// The sessions `pulls`, `commits`, `issues` and `branches` make, the most
+// recently updated first: each a set of them, joined by the sessions and
+// tasks they link and the branches pull requests are from, with the issues
+// a pull request closes or a branch is named for.
+// Artifacts no agent left marks on belong to none. Where pull requests
+// updated before `branchesSince` are yet to be read, a session of branches
+// alone older than that waits for them: its pull request may be among them.
+export function agentSessions(artifacts: Artifacts, { branchesSince = null }: { branchesSince?: number | null } = {}): AgentSession[] {
+  const lookups = {
+    pulls: new Map((artifacts.pulls ?? []).map(pull => [pull.number, pull])),
+    commits: new Map((artifacts.commits ?? []).map(commit => [commit.oid, commit])),
+    issues: new Map((artifacts.issues ?? []).map(issue => [issue.number, issue])),
+    branches: new Map((artifacts.branches ?? []).map(branch => [branch.name, branch])),
+  }
+  const waiting = (session: AgentSession) => branchesSince !== null && session.pulls.length === 0 && session.commits.length === 0
+    && (session.updatedAt ?? 0) < branchesSince
+  return artifactGroups(artifacts).flatMap(group => sessionOf(group, lookups) ?? []).filter(session => !waiting(session))
+    .toSorted(byTime(session => session.updatedAt)).toReversed()
+}

package/common/managed/github-agents.ts

@@ -0,0 +1,92 @@
+// Agents by their own GitHub accounts, where a repository's activity names
+// them: each its name, and how the app draws it, by its mark, as the Agents
+// tab does (ui/view/provider-icons.js), or by its avatar, which
+// /api/avatar/<avatar> serves (server-managed/repository-agents.ts
+// APP_AGENTS, the Agents tab's marks); its accounts, each by the logins GitHub's REST and GraphQL APIs
+// name it by and its numeric id where known, which GitHub never gives
+// another; and the names its commits carry where GitHub names no account for
+// them. Claude Code's commits are authored as Claude <noreply@anthropic.com>,
+// which GitHub names `claude`; the Claude GitHub App's as `claude[bot]`.
+// Codex's GitHub connector's are its own; Codex otherwise commits as whoever
+// ran it, and those commits are theirs, with a
+// `Co-authored-by: Codex <codex@openai.com>` trailer, an address GitHub
+// names someone else's account for, so Codex is known by the address, not
+// that account. Copilot's coding agent authors its commits as its account,
+// Copilot; Copilot's code review reviews as another, its bot, which GitHub
+// names Copilot as well where it is asked to review and in its threads, and
+// `copilot-pull-request-reviewer` (`[bot]` to GitHub's REST API) on its
+// reviews, the accounts' ids telling the two apart: a login may so be more
+// than one account's. Dependabot, its GitHub App, as its bot,
+// `dependabot` to GitHub's GraphQL API, `dependabot[bot]` to its REST API and
+// in its address. GitHub's Agentic Workflows (gh-aw) post, and approve or
+// review pull requests, as GitHub Actions' bot, `github-actions` (41898282,
+// `[bot]` to the REST API), its mark the GitHub Actions App's avatar; other
+// workflows the bot runs are as much its own. Cursor's agents commit as whoever ran them, with a
+// `Co-authored-by: Cursor Agent <cursoragent@cursor.com>` trailer; the app
+// has no mark of Cursor's, and draws it by its name's letter. Each by the
+// addresses (`emails`) its commits name it by, as author or co-author.
+export interface GithubAgentAccount { id?: number; logins: readonly string[] }
+export interface GithubAgent { name: string; mark?: 'anthropic' | 'openai' | 'github-copilot'; avatar?: string; accounts: readonly GithubAgentAccount[]; names: readonly string[]
+  emails?: readonly string[] }
+
+export const GITHUB_AGENTS = {
+  claude: { name: 'Claude', mark: 'anthropic', accounts: [{ id: 81847, logins: ['claude'] }, { logins: ['claude[bot]'] }], names: ['Claude'], emails: ['noreply@anthropic.com'] },
+  codex: { name: 'Codex', mark: 'openai', accounts: [{ id: 199175422, logins: ['chatgpt-codex-connector', 'chatgpt-codex-connector[bot]'] }], names: ['Codex'],
+    emails: ['codex@openai.com'] },
+  copilot: { name: 'Copilot', mark: 'github-copilot', accounts: [{ id: 198982749, logins: ['Copilot', 'copilot-swe-agent'] },
+    { id: 175728472, logins: ['Copilot', 'copilot-pull-request-reviewer', 'copilot-pull-request-reviewer[bot]'] }], names: ['Copilot'] },
+  dependabot: { name: 'Dependabot', avatar: 'app-29110', accounts: [{ id: 49699333, logins: ['dependabot', 'dependabot[bot]'] }], names: ['dependabot[bot]'] },
+  actions: { name: 'GitHub Actions', avatar: 'app-15368', accounts: [{ id: 41898282, logins: ['github-actions', 'github-actions[bot]'] }], names: ['github-actions[bot]'] },
+  cursor: { name: 'Cursor', accounts: [], names: ['Cursor Agent'], emails: ['cursoragent@cursor.com'] },
+} as const satisfies Record<string, GithubAgent>
+export type GithubAgentId = keyof typeof GITHUB_AGENTS
+
+const agents = Object.entries(GITHUB_AGENTS) as [GithubAgentId, GithubAgent][]
+// Each login's agent, and the ids of the accounts it names, undefined for
+// one whose id the app doesn't know.
+const byLogin = new Map<string, { agent: GithubAgentId; ids: (number | undefined)[] }>()
+for (const [agent, { accounts }] of agents) {
+  for (const { id, logins } of accounts) {
+    for (const login of logins) byLogin.set(login.toLowerCase(), { agent, ids: [...byLogin.get(login.toLowerCase())?.ids ?? [], id] })
+  }
+}
+const byName = new Map(agents.flatMap(([agent, { names }]) => names.map(name => [name.toLowerCase(), agent] as const)))
+const byEmail = new Map(agents.flatMap(([agent, { emails = [] }]) => emails.map(email => [email, agent] as const)))
+
+// The agent whose address `email` is, GitHub matching addresses regardless of
+// case; null for anyone else's.
+export const emailAgent = (email: unknown): GithubAgentId | null => typeof email === 'string' ? byEmail.get(email.trim().toLowerCase()) ?? null : null
+
+// The agent an author is: by their login, GitHub matching logins regardless
+// of case, their account's id the agent's where both are known, so another
+// account GitHub names by the same login (a user's, the bot's GraphQL login
+// may be) is not; for an author GitHub names no account for, by the name
+// they carry. Null for anyone else: a human's account is theirs, whatever
+// their commits name them.
+export function githubAgent(login: string | null, account: number | null = null, name: string | null = null): GithubAgentId | null {
+  if (typeof login !== 'string') return typeof name === 'string' ? byName.get(name.trim().toLowerCase()) ?? null : null
+  const known = byLogin.get(login.toLowerCase())
+  return known && (account === null || known.ids.includes(undefined) || known.ids.includes(account)) ? known.agent : null
+}
+
+// Whether the accounts `ids` a login is named by are all one agent's, as
+// Copilot's coding agent's and its code review's, both named Copilot, are:
+// the login is that agent's whichever it is, rather than no one's.
+export function oneAgent(login: string, ids: Iterable<number>): boolean {
+  const theirs = new Set([...ids].map(id => githubAgent(login, id)))
+  return theirs.size === 1 && !theirs.has(null)
+}
+
+// The accounts agents work as, a person's to GitHub, as the app is told of
+// them, each by its id and logins: the pull requests they open and the
+// commits they push to a branch directly are agents' (the Pulse's,
+// server-managed/agent-merges.ts agentMerges, repository-pulse.ts
+// commitStats), whatever their branches and labels, the rest of what they do
+// theirs. Christopher Turing's.
+export const AGENT_OPERATED = [{ id: 188797125, logins: ['ChristopherTuring'] }] as const satisfies readonly GithubAgentAccount[]
+
+// Whether an author is an account agents work as (AGENT_OPERATED): by its id
+// where GitHub gives it, whatever it is renamed to, else by its login,
+// regardless of case.
+export const agentOperated = (login: string | null, id: number | null = null): boolean => AGENT_OPERATED.some(account => id === null
+  ? typeof login === 'string' && account.logins.some(name => name.toLowerCase() === login.toLowerCase()) : account.id === id)

package/common/managed/github-logins.ts

@@ -0,0 +1,49 @@
+// The GitHub accounts an answer about a repository's activity names (its
+// commits', issues', pull requests', agents' and pulse's): as an author, one
+// who merged or a contributor, by login, and by the account's numeric id
+// where the answer names it beside the login. The server resolves them to the
+// app's users and agents (server-managed/github-users.ts), and the client
+// keeps those it answered with in place of what it held for them
+// (ui/view/github-users.js).
+import { oneAgent } from './github-agents.ts'
+
+// Where answers name a login, each with where the account's id is named
+// beside it.
+const LOGIN_KEYS = new Map([['author', 'authorId'], ['authorLogin', 'authorId'], ['mergedBy', 'mergedById'], ['login', 'id']])
+const LOGIN = /^[A-Za-z\d][A-Za-z\d-]{0,38}(?:\[bot\])?$/u
+const MAX_DEPTH = 8
+const accountId = (value: unknown) => Number.isSafeInteger(value) && (value as number) > 0 ? value as number : null
+
+// The logins `answer` names, each once, with the numeric id of the account
+// named beside them (null where none is, or where those named are all one
+// agent's, oneAgent); `ambiguous` where a login, GitHub matching logins
+// regardless of case, is named beside more than one: by an account GitHub
+// named by it once, as what was kept of the history says, and one it names by
+// it now, which is no telling whose each is.
+export function namedAccounts(answer: unknown): Map<string, number | 'ambiguous' | null> {
+  const named = new Map<string, Set<number>>()
+  collect(answer, named, 0)
+  const ids = new Map<string, Set<number>>()
+  for (const [login, theirs] of named) ids.set(login.toLowerCase(), new Set([...ids.get(login.toLowerCase()) ?? [], ...theirs]))
+  return new Map([...named.keys()].map((login): [string, number | 'ambiguous' | null] => {
+    const theirs = ids.get(login.toLowerCase())!
+    if (theirs.size <= 1) return [login, [...theirs][0] ?? null]
+    return [login, oneAgent(login, theirs) ? null : 'ambiguous']
+  }))
+}
+
+function collect(answer: unknown, named: Map<string, Set<number>>, depth: number): void {
+  if (depth > MAX_DEPTH || answer === null || typeof answer !== 'object') return
+  if (Array.isArray(answer)) {
+    for (const value of answer) collect(value, named, depth + 1)
+    return
+  }
+  const fields = answer as Record<string, unknown>
+  for (const [key, value] of Object.entries(fields)) {
+    const idKey = LOGIN_KEYS.get(key)
+    if (idKey && typeof value === 'string' && LOGIN.test(value)) {
+      const id = accountId(fields[idKey])
+      named.set(value, new Set([...named.get(value) ?? [], ...id === null ? [] : [id]]))
+    } else collect(value, named, depth + 1)
+  }
+}

package/common/managed/roles.ts

@@ -26,3 +26,10 @@ export function roleAtLeast(role: Role, min: Role): boolean {
   const r = ROLES.indexOf(role)
   return r !== -1 && r <= ROLES.indexOf(min)
 }
+
+// Who reads connected repositories' code (the code viewer): a team member,
+// view or above, the server reading only what their team grants reach and
+// their own GitHub account may read. A public link reads none.
+export function canReadRepositoryCode(session: { role: Role; publicShare?: boolean } | null | undefined): boolean {
+  return session != null && !session.publicShare && roleAtLeast(session.role, 'view')
+}

package/common/managed/routes.js

@@ -28,6 +28,13 @@ export const MANAGED_PAGES = Object.freeze({
   'manage-history': '/manage/history',
 })
 
+// A team's lists, each at /team/<slug>/<what it lists>; its dependencies'
+// sub-tabs past the first at /team/<slug>/dependencies/<tab>.
+const WORKSPACE_CONTENT_VIEWS = new Set(['workspace-reports', 'workspace-bundles', 'workspace-repositories', 'workspace-dependencies'])
+export const DEPENDENCY_TABS = new Set(['pulls', 'versions', 'branch', 'reviews'])
+// A route's `dependencyTab` field, where it names one.
+const dependencyTabField = route => route.view === 'workspace-dependencies' && route.dependencyTab != null ? { dependencyTab: route.dependencyTab } : {}
+
 // Dot-only path components are normalised away by URL parsers, even escaped.
 function findingPath(id) {
   if (!isLinkableFindingId(id) || id === '.' || id === '..') return null
@@ -38,9 +45,13 @@ export function managedRoutePath(route) {
   if (!route) return null
   if (route.view === 'home') return '/'
   if (route.view === 'reviews') return '/my/reviews'
+  if (route.view === 'profile') return '/my/profile'
   if (route.view === 'npm') return npmPackagePath(route)
-  if (route.view === 'workspace-reports' || route.view === 'workspace-bundles') {
-    return /^[A-Za-z0-9_-]+$/u.test(route.teamSlug ?? '') ? `/team/${route.teamSlug}/${route.view.slice(10)}` : null
+  if (route.view === 'repository-code') return repositoryCodePath(route)
+  if (WORKSPACE_CONTENT_VIEWS.has(route.view)) {
+    const tab = dependencyTabField(route).dependencyTab ?? 'pulls'
+    if (!/^[A-Za-z0-9_-]+$/u.test(route.teamSlug ?? '') || !DEPENDENCY_TABS.has(tab)) return null
+    return `/team/${route.teamSlug}/${route.view.slice(10)}${tab === 'pulls' ? '' : `/${tab}`}`
   }
   if (route.view === 'bundles') {
     if (!/^[A-Za-z0-9_-]+$/u.test(route.bundleSlug ?? '')
@@ -82,11 +93,11 @@ export function managedRoutePath(route) {
 }
 
 // The npm viewer: its lookup page, or a package version's Overview, Code,
-// Compare or Treemap tab, `/npm/<name>[@<version or dist-tag>][/<tab>…]`. Code names
+// Search, Compare or Treemap tab, `/npm/<name>[@<version or dist-tag>][/<tab>…]`. Code names
 // its file by number and its lines in the fragment, as a bundle's Code
 // does: `/code/<file>#L4`. Compare names the version compared with, then
 // its mode past the Overview: `/compare/<version>/code` or `/diff`.
-export const NPM_TABS = new Set(['overview', 'code', 'compare', 'review', 'treemap'])
+export const NPM_TABS = new Set(['overview', 'code', 'search', 'compare', 'review', 'treemap'])
 function npmPackagePath(route) {
   if (route.packageName == null) return '/npm'
   const tab = route.bundleTab ?? 'overview'
@@ -114,7 +125,7 @@ function parseNpmRoute(path, hash) {
     return { view: 'npm', packageName: review[1], packageSpec: review[2] ?? null, bundleTab: 'review',
       ...(review[3] ? { reviewPackage: versionOnly ? review[1] : review[3], reviewSpec: versionOnly ? review[3] : review[4] ?? null } : {}) }
   }
-  const match = /^\/npm(?:\/((?:@[^/@]+\/)?[^/@]+)(?:@([^/]+))?(?:\/(code|compare|treemap)(?:\/([^/]+)(?:\/([a-z]+))?)?)?)?$/u.exec(path)
+  const match = /^\/npm(?:\/((?:@[^/@]+\/)?[^/@]+)(?:@([^/]+))?(?:\/(code|search|compare|treemap)(?:\/([^/]+)(?:\/([a-z]+))?)?)?)?$/u.exec(path)
   if (!match) return undefined
   if (match[1] == null) return { view: 'npm' }
   if (!isNpmPackageName(match[1]) || (match[2] != null && !isNpmPackageSpec(match[2]))) return null
@@ -128,6 +139,66 @@ function parseNpmRoute(path, hash) {
   return !match[5] && /^[1-9]\d*$/u.test(match[4]) && Number.isSafeInteger(file) ? { ...route, file, ...codeLines(hash) } : null
 }
 
+// The code viewer: a directory of a repository at a commit, on its Code,
+// Search, Treemap, Compare, Commits, Issues, Pull requests, Agents, Pulse
+// or Replay tab, `/repo/<repo id>/<commit>[/<tab>…][?path=<directory>]`,
+// the repository's root where it names no directory. Code, the tab a bare
+// link opens, names its file by number and its lines in the fragment, as a
+// bundle's Code does: `/code/<file>#L4`. Compare names the commit compared
+// with, then its mode past the Overview, as an npm version's does:
+// `/compare/<commit>/code`. Without a commit,
+// `/repo/<repo id>[?path=<directory>]`, it opens on the default
+// branch's head, or on the revision a route held in memory names (`ref`),
+// and its route then names the commit it opened. Links from before it moved
+// name it under `/manage/code/`, and open the same.
+export const REPOSITORY_CODE_TABS = new Set(['code', 'search', 'treemap', 'compare', 'commits', 'issues', 'pulls', 'agents', 'pulse', 'replay'])
+// The tabs reading none of the directory's files, which a directory at a
+// commit shows alone.
+export const REPOSITORY_FILELESS_TABS = new Set(['commits', 'issues', 'pulls', 'agents', 'pulse', 'replay'])
+const COMMIT = /^[a-f\d]{40}$/u
+const MAX_DIRECTORY = 500
+const isRepoId = value => Number.isSafeInteger(value) && value > 0
+
+// A directory as the server takes one (server-managed/repo-path.ts), in its
+// canonical form: `''` the root, else names with no empty, `.` or `..` one
+// among them, nor control characters, backslashes or spaces around one.
+export function isRepositoryDirectory(path) {
+  return typeof path === 'string' && (path === '' || path.length <= MAX_DIRECTORY && !/[\p{Cc}\\]/u.test(path)
+    && path.split('/').every(part => part !== '' && part !== '.' && part !== '..' && part === part.trim()))
+}
+
+function repositoryCodePath(route) {
+  const tab = route.bundleTab ?? 'code'
+  const path = route.path ?? ''
+  if (!isRepoId(route.repoId) || (route.commit != null && !COMMIT.test(route.commit)) || !isRepositoryDirectory(path) || !REPOSITORY_CODE_TABS.has(tab)
+      || (route.compareCommit != null && !COMMIT.test(route.compareCommit))) return null
+  const directory = path ? `?path=${path.split('/').map(encodeURIComponent).join('/')}` : ''
+  if (route.commit == null) return `/repo/${route.repoId}${directory}`
+  const file = tab === 'code' && isLineNumber(route.file) ? `/code/${route.file}` : tab === 'code' ? '' : `/${tab}`
+  const compare = tab === 'compare' && route.compareCommit != null ? `/${route.compareCommit}${compareModeSuffix(route.compareMode)}` : ''
+  const lines = tab === 'code' && isLineNumber(route.file) && isLineNumber(route.line)
+    ? `#L${route.line}${isLineNumber(route.endLine) && route.endLine > route.line ? `-L${route.endLine}` : ''}` : ''
+  return `/repo/${route.repoId}/${route.commit}${file}${compare}${directory}${lines}`
+}
+
+function parseRepositoryCodeRoute(url) {
+  const match = /^\/(?:repo|manage\/code)\/([1-9]\d*)(?:\/([a-f\d]{40})(?:\/(code|search|treemap|compare|commits|history|issues|pulls|agents|pulse|replay)(?:\/([^/]+)(?:\/([a-z]+))?)?)?)?$/u
+    .exec(url.pathname.replace(/\/$/u, ''))
+  if (!match) return undefined
+  const repoId = Number(match[1])
+  const path = url.searchParams.get('path') ?? ''
+  // Commits' tab was History's, `/history`, which links still name.
+  const tab = match[3] === 'history' ? 'commits' : match[3] ?? 'code'
+  if (!isRepoId(repoId) || !isRepositoryDirectory(path)) return null
+  const route = { view: 'repository-code', repoId, commit: match[2] ?? null, path, bundleTab: tab }
+  if (match[4] == null) return route
+  if (tab === 'compare') {
+    return COMMIT.test(match[4]) && (match[5] == null || COMPARE_MODES.has(match[5])) ? { ...route, compareCommit: match[4], ...compareModeField(match[5]) } : null
+  }
+  const file = Number(match[4])
+  return tab === 'code' && match[5] == null && /^[1-9]\d*$/u.test(match[4]) && Number.isSafeInteger(file) ? { ...route, file, ...codeLines(url.hash) } : null
+}
+
 function isLineNumber(value) {
   return Number.isSafeInteger(value) && value > 0
 }
@@ -144,6 +215,12 @@ export function parseManagedRoute(url) {
   const path = url.pathname.replace(/\/$/u, '') || '/'
   if (path === '/' || path === '/index.html') return { view: 'home' }
   if (path === '/my/reviews') return { view: 'reviews' }
+  // Linking an account lands here, naming why GitHub's answer was refused,
+  // which the page shows once: the address it settles on drops it.
+  if (path === '/my/profile') {
+    const linkError = url.searchParams.get('link-error')
+    return { view: 'profile', ...(linkError && /^[a-z-]{1,64}$/u.test(linkError) ? { linkError } : {}) }
+  }
   const view = Object.keys(MANAGED_PAGES).find(key => MANAGED_PAGES[key] === path)
   if (view) {
     const createRepoId = Number(url.searchParams.get('createRepo'))
@@ -169,8 +246,12 @@ export function parseManagedRoute(url) {
   }
   const npm = parseNpmRoute(path, url.hash)
   if (npm !== undefined) return npm
-  const contentList = /^\/team\/([A-Za-z0-9_-]+)\/(reports|bundles)$/u.exec(path)
+  const code = parseRepositoryCodeRoute(url)
+  if (code !== undefined) return code
+  const contentList = /^\/team\/([A-Za-z0-9_-]+)\/(reports|bundles|repositories|dependencies)$/u.exec(path)
   if (contentList) return { view: `workspace-${contentList[2]}`, teamSlug: contentList[1] }
+  const dependencies = /^\/team\/([A-Za-z0-9_-]+)\/dependencies\/([a-z]+)$/u.exec(path)
+  if (dependencies) return DEPENDENCY_TABS.has(dependencies[2]) ? { view: 'workspace-dependencies', teamSlug: dependencies[1], dependencyTab: dependencies[2] } : null
   const match = /^\/team\/([^/]+)(?:\/report\/([^/]+))?(?:\/(files)|\/finding\/([^/]+))?$/u.exec(path)
   if (!match) return null
   try {
@@ -187,9 +268,9 @@ export function parseManagedRoute(url) {
 // URL tokens are exact server-assigned slugs. Application state and API calls
 // continue to use UUIDs; never guess IDs from suffixes or accept ID aliases.
 export function resolveManagedRoute(route, teams, adminBundles = []) {
-  if (route.view === 'workspace-reports' || route.view === 'workspace-bundles') {
+  if (WORKSPACE_CONTENT_VIEWS.has(route.view)) {
     const matches = teams.filter(team => team.slug === route.teamSlug)
-    return matches.length === 1 ? { view: route.view, teamId: matches[0].id } : null
+    return matches.length === 1 ? { view: route.view, teamId: matches[0].id, ...dependencyTabField(route) } : null
   }
   if (route.view === 'bundles') {
     const { teamSlug, bundleSlug, compareSlug, compareMode, ...rest } = route
@@ -220,9 +301,9 @@ export function resolveManagedRoute(route, teams, adminBundles = []) {
 }
 
 export function managedRouteForIds(route, teams, adminBundles = []) {
-  if (route.view === 'workspace-reports' || route.view === 'workspace-bundles') {
+  if (WORKSPACE_CONTENT_VIEWS.has(route.view)) {
     const team = teams.find(entry => entry.id === route.teamId)
-    const result = { view: route.view, teamSlug: team?.slug }
+    const result = { view: route.view, teamSlug: team?.slug, ...dependencyTabField(route) }
     return team?.slug && resolveManagedRoute(result, teams) ? result : null
   }
   if (route.view === 'bundles') {

package/common/managed/team-app.d.ts

@@ -1,2 +1,5 @@
-export type TeamAppMetadata = { appMode: true; appFindings: number } | { appMode: false }
-export function managedTeamAppMetadata(workspace: readonly { filename: string; data: unknown }[] & { links?: readonly (readonly string[])[] }): TeamAppMetadata
+// Set for a team that is not App: `findings`, its rows (with `countFindings`),
+// and `appReports`, set by the managed catalog: how many reports open in App mode alone.
+export type TeamAppMetadata = { appMode: true; appFindings: number } | { appMode: false; appReports?: number; findings?: number }
+export function managedTeamAppMetadata(workspace: readonly { filename: string; data: unknown }[] & { links?: readonly (readonly string[])[] },
+  options?: { countFindings?: boolean }): TeamAppMetadata