@preventive/triage 1.0.0-alpha.43 → 1.0.0-alpha.45

package/risk/npm/tarball.js

@@ -1,74 +1,43 @@
-// A package's files from its tarball, as npm installs them: gunzipped, read as
-// a tar archive (ustar, pax and GNU long names), each file by the path npm
-// installs it at, its first component dropped, none escaping the package; a
-// text where it is UTF-8 with no NUL, else null. Held to the npm viewer's
-// bounds (server-managed/npm-packages.ts readNpmTar).
+// A package's files from its tarball, as it holds them, whatever installs it
+// (npm renames a .gitignore .npmignore, pnpm and yarn keep it): gunzipped and
+// read as a tar archive by @preventive/archive, which refuses one malformed, a
+// name or a symlink that would climb out of it, and a name repeated as another
+// entry; each file by its path there, its first component dropped; a text
+// where it is UTF-8 with no NUL, else null. Held to the npm viewer's bounds
+// (server-managed/npm-packages.ts readNpmTar).
+import { CompressionError, decompress } from '@preventive/archive/compression.js'
+import { ArchiveError, unpack } from '@preventive/archive/tar.js'
+
 const MAX_PACKAGE_FILES = 20_000
 export const MAX_PACKAGE_BYTES = 64 * 1024 * 1024
+// The entries its tar stream may hold, a directory's too, read before any is
+// counted as a file, as npm-packages.ts bounds them (MAX_NPM_TAR_ENTRIES).
+export const MAX_TAR_ENTRIES = 2 * MAX_PACKAGE_FILES
 // What its tar stream may unpack to, its headers and padding beside its
 // files, as npm-loads.ts bounds it (MAX_TAR_BYTES).
 export const MAX_TAR_BYTES = 96 * 1024 * 1024
 
-const latin1 = new TextDecoder('latin1')
 const utf8 = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true })
-const utf8Lenient = bytes => new TextDecoder().decode(bytes)
-// A header's text field, to its first NUL.
-const textOf = (bytes, start, length) => {
-  const field = bytes.subarray(start, start + length)
-  const end = field.indexOf(0)
-  return utf8Lenient(end === -1 ? field : field.subarray(0, end))
-}
 
-// A header's size field: octal, or GNU base-256 past its 11 digits.
-function sizeOf(bytes, offset) {
-  if (bytes[offset] & 0x80) {
-    let size = bytes[offset] & 0x7f
-    for (let i = 1; i < 12; i++) size = size * 256 + bytes[offset + i]
-    return size
-  }
-  const text = textOf(bytes, offset, 12).trim()
-  return /^[0-7]+$/u.test(text) ? Number.parseInt(text, 8) : Number.NaN
-}
-
-// A pax header's path: records `<length> <key>=<value>\n`, their lengths in
-// bytes.
-function paxPath(data) {
-  let at = 0, path = null
-  while (at < data.length) {
-    const space = data.indexOf(0x20, at)
-    const length = Number.parseInt(latin1.decode(data.subarray(at, space)), 10)
-    if (space === -1 || !Number.isSafeInteger(length) || length <= 0) break
-    const record = utf8Lenient(data.subarray(space + 1, at + length - 1))
-    if (record.startsWith('path=')) path = record.slice(5)
-    at += length
-  }
-  return path
-}
-
-const packagePath = raw => {
-  const parts = raw.split('/').slice(1).filter(part => part !== '' && part !== '.')
-  return parts.length === 0 || parts.includes('..') ? null : parts.join('/')
-}
-
-// The files of a tar archive, by path: their bytes.
+// The files of a tar archive, by path: their bytes. A file at its top is not
+// extracted, and one under another top directory at the same path replaces
+// an earlier one, as extraction would. Past MAX_TAR_ENTRIES it is given up on
+// as `package-too-large`, before any more of it is read.
 function npmTarFiles(tar) {
+  let entries
+  try {
+    entries = unpack(tar, { maxEntries: MAX_TAR_ENTRIES })
+  } catch (error) {
+    if (error instanceof ArchiveError && error.limited) throw new Error('package-too-large', { cause: error })
+    throw error
+  }
   const files = new Map()
-  let longName = null, offset = 0, total = 0
-  while (offset + 512 <= tar.length) {
-    const header = tar.subarray(offset, offset + 512)
-    if (header.every(byte => byte === 0)) break
-    const size = sizeOf(header, 124), start = offset + 512, type = String.fromCodePoint(header[156])
-    if (!Number.isSafeInteger(size) || size < 0 || start + size > tar.length) throw new Error('bad-tarball')
-    const data = tar.subarray(start, start + size)
-    offset = start + Math.ceil(size / 512) * 512
-    if (type === 'x' || type === 'L') { longName = type === 'x' ? paxPath(data) : textOf(data, 0, data.length); continue }
-    if (type === 'g' || type === 'K') continue
-    const prefix = textOf(header, 257, 6) === 'ustar' ? textOf(header, 345, 155) : ''
-    const name = longName ?? (prefix ? `${prefix}/${textOf(header, 0, 100)}` : textOf(header, 0, 100))
-    longName = null
-    const path = ['0', '\0', '7'].includes(type) ? packagePath(name) : null
-    if (path === null) continue
-    total += size - (files.get(path)?.length ?? 0)
+  let total = 0
+  for (const { name, type, data } of entries) {
+    const slash = name.indexOf('/')
+    if ((type !== 'file' && type !== 'contiguous-file') || slash === -1) continue
+    const path = name.slice(slash + 1)
+    total += data.length - (files.get(path)?.length ?? 0)
     files.set(path, data)
     if (files.size > MAX_PACKAGE_FILES || total > MAX_PACKAGE_BYTES) throw new Error('package-too-large')
   }
@@ -81,18 +50,31 @@ export function npmFileText(bytes) {
   try { return utf8.decode(bytes) } catch { return null }
 }
 
-// A gzipped tarball's tar stream, given up on as `package-too-large` once it
-// unpacks past MAX_TAR_BYTES, before any more of it is held.
+// A gzipped tarball's tar stream, through @preventive/archive's gzip, given up
+// on as `package-too-large` once it unpacks past MAX_TAR_BYTES, before any
+// more of it is held.
 async function gunzip(gzipped) {
-  const reader = new Blob([gzipped]).stream().pipeThrough(new DecompressionStream('gzip')).getReader()
-  const chunks = []
-  let size = 0
-  for (let read = await reader.read(); !read.done; read = await reader.read()) {
-    size += read.value.byteLength
-    if (size > MAX_TAR_BYTES) { await reader.cancel(); throw new Error('package-too-large') }
-    chunks.push(read.value)
+  try {
+    return await decompress(gzipped, 'gzip', { limit: MAX_TAR_BYTES })
+  } catch (error) {
+    if (error instanceof CompressionError && error.limited) throw new Error('package-too-large', { cause: error })
+    throw error
   }
-  return new Uint8Array(await new Blob(chunks).arrayBuffer())
+}
+
+// Whether a file that isn't text may run as JavaScript all the same, as node
+// decodes it as UTF-8 (npm/files.js npmLoadedScripts): only where its first
+// character no UTF-8 encodes, or its first NUL, which JavaScript holds only
+// in a string, a template, a regular expression or a comment, may sit in
+// one, after a quote, a backtick, a slash, a `<` or `-` (an HTML-like
+// comment, `<!--`, `-->`) or on a hashbang's line. An image's, a font's or
+// WebAssembly's is in its first bytes, before any.
+const OPENS = [0x27, 0x22, 0x60, 0x2F, 0x3C, 0x2D]
+function npmRunnable(bytes) {
+  const start = bytes[0] === 0xEF && bytes[1] === 0xBB && bytes[2] === 0xBF ? 3 : 0
+  if (bytes[start] === 0x23 && bytes[start + 1] === 0x21) return true
+  const opens = Math.min(...OPENS.map(byte => bytes.indexOf(byte, start)).filter(at => at !== -1))
+  return Number.isFinite(opens) && npmFileText(bytes.subarray(0, opens)) !== null
 }
 
 // A file's bytes' digest, as the managed server gives one of a file that
@@ -103,11 +85,12 @@ const sha256 = async bytes => `sha256-${btoa(String.fromCodePoint(...new Uint8Ar
 // viewer holds a version (ui/view/npm-package.js npmPackageDetails), a source
 // map listing them (`kind: 'sourcemap'`): `json.sources` their paths, sorted,
 // `json.sourcesContent` their texts, `fileSizes` by path, and `npmBinaries`,
-// those that aren't text, `{ size, digest }` by path, which compare.js and
+// those that aren't text, `{ size, digest, runnable }` by path (npmRunnable),
+// which compare.js and
 // diff.js tell them by.
 export async function npmTarballVersion(gzipped) {
   const files = [...npmTarFiles(await gunzip(gzipped))].toSorted(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)
   const texts = files.map(([, bytes]) => npmFileText(bytes))
-  const binaries = await Promise.all(files.filter((_, at) => texts[at] === null).map(async ([path, bytes]) => [path, { size: bytes.length, digest: await sha256(bytes) }]))
+  const binaries = await Promise.all(files.filter((_, at) => texts[at] === null).map(async ([path, bytes]) => [path, { size: bytes.length, digest: await sha256(bytes), runnable: npmRunnable(bytes) }]))
   return { kind: 'sourcemap', json: { version: 3, sources: files.map(([path]) => path), sourcesContent: texts }, fileSizes: new Map(files.map(([path, bytes]) => [path, bytes.length])), npmBinaries: new Map(binaries) }
 }

package/server-managed/agent-merges.ts

@@ -0,0 +1,198 @@
+// The commits agents' pull requests brought to a repository's default
+// branch, for its Pulse (repository-pulse.ts commitStats): an agent that
+// commits as whoever ran it (Codex's own) leaves its commits no mark, its
+// pull request's branch alone naming it (app-agents.ts
+// AGENT_BRANCH_PREFIXES), or a label one who ran it gave it naming the agent
+// (agent-tasks.ts labelAgents), as the Agents tab tells an agent's work; or
+// its author, an account agents work as (github-agents.ts AGENT_OPERATED).
+import { labelAgents } from '../common/managed/agent-tasks.ts'
+import { GITHUB_AGENTS, agentOperated } from '../common/managed/github-agents.ts'
+import { AGENT_BRANCH_PREFIXES, APP_AGENTS } from './app-agents.ts'
+import { type HistoryCommit, githubGraphql } from './repository-history.ts'
+
+// The merged pull requests read an answer, a page a query, as many queries
+// as MERGED_QUERIES, the rest left for the next to ask; of each, as many of
+// its latest commits as MERGED_COMMITS.
+const MERGED_PAGE = 100
+const MERGED_QUERIES = 5
+const MERGED_COMMITS = 100
+// Of each, as many labels as MERGED_LABELS, GitHub's most a page, a label
+// naming any agent the app knows making it an agent's.
+const MERGED_LABELS = 100
+// How long before or after a pull request rebased onto the branch was merged
+// its copies are committed.
+const REBASE_SKEW_MS = 10 * 60_000
+const LABEL_AGENTS = [...new Set([...Object.keys(GITHUB_AGENTS), ...APP_AGENTS.map(agent => agent.id)])]
+const SHA = /^[a-f\d]{40}$/u
+
+const count = (value: unknown) => Number.isSafeInteger(value) && (value as number) >= 0 ? value as number : 0
+const timeOf = (value: unknown) => {
+  const at = typeof value === 'string' ? Date.parse(value) : Number.NaN
+  return Number.isSafeInteger(at) ? at : null
+}
+
+// The agents' pull requests merged since a year's start, as read so far
+// (agentMerges): the commits each brought, and when it was merged; those
+// rebased onto the branch by their last commit there, when merged, and
+// their commits' subjects, the oldest first (agentCommits); when the newest
+// read was last updated, those updated since read again (`through`, null
+// till all are read once); and a read not finished: where it goes on
+// (`after`), when the newest it began with was updated (`from`), the oldest
+// it reads to (`stop`) and how many it has read (`read`). And of every pull
+// request merged, an agent's or not, its merge commit and when (`pulls`),
+// and one rebased so (`pullRebases`), for the commits pushed to the branch
+// directly to be told (directCommits).
+export interface AgentMerges { merges: [string, number][]; rebases: Rebase[]; through: number | null
+  next: { after: string; from: number; stop: number; read: number } | null; pulls?: [string, number][]; pullRebases?: Rebase[] }
+// A pull request rebased onto the branch: its last commit there, when it was
+// merged, its latest commits' subjects, the oldest first, and how many more
+// it had than those read (`more`).
+type Rebase = [sha: string, at: number, subjects: string[], more?: number]
+
+const MERGED_QUERY = `query($owner: String!, $name: String!, $after: String) {
+  repository(owner: $owner, name: $name) {
+    pullRequests(states: MERGED, first: ${MERGED_PAGE}, after: $after, orderBy: { field: UPDATED_AT, direction: DESC }) {
+      pageInfo { hasNextPage endCursor }
+      nodes { updatedAt mergedAt headRefName author { login ... on User { databaseId } } labels(first: ${MERGED_LABELS}) { nodes { name } }
+        mergeCommit { oid parents { totalCount } }
+        commits(last: ${MERGED_COMMITS}) { totalCount nodes { commit { oid messageHeadline changedFilesIfAvailable } } } }
+    }
+  }
+}`
+type MergedPage = { repository?: { pullRequests?: { pageInfo?: { hasNextPage?: unknown; endCursor?: unknown }
+  nodes?: ({ updatedAt?: unknown; mergedAt?: unknown; headRefName?: unknown; author?: { login?: unknown; databaseId?: unknown } | null
+    labels?: { nodes?: ({ name?: unknown } | null)[] } | null
+    mergeCommit?: { oid?: unknown; parents?: { totalCount?: unknown } | null } | null
+    commits?: { totalCount?: unknown; nodes?: ({ commit?: { oid?: unknown; messageHeadline?: unknown; changedFilesIfAvailable?: unknown } | null } | null)[] } | null
+  } | null)[] } | null } | null }
+const agentBranch = (name: unknown) => typeof name === 'string' && AGENT_BRANCH_PREFIXES.some(prefix => name.startsWith(prefix))
+type MergedNode = NonNullable<NonNullable<NonNullable<NonNullable<MergedPage['repository']>['pullRequests']>['nodes']>[number]>
+// Whether a pull request is an agent's: by its branch, a label naming one,
+// or its author, an account agents work as.
+const agentPull = ({ headRefName, labels, author }: MergedNode) => agentBranch(headRefName)
+  || labelAgents((labels?.nodes ?? []).map(label => label?.name), LABEL_AGENTS).length > 0
+  || agentOperated(typeof author?.login === 'string' ? author.login : null, Number.isSafeInteger(author?.databaseId) ? author!.databaseId as number : null)
+
+// The commits the pull requests merged since `since` from an agent's branch,
+// labelled for one, or opened by an account agents work as, brought: each its merge commit, a squash merge's one
+// commit; where it was
+// merged with a merge commit, which a year counts none of, its own commits,
+// its latest MERGED_COMMITS; and of one of more commits whose merge commit
+// has one parent, its commits' subjects, for those it was rebased as to be
+// told by (agentCommits), those of its empty commits left out, as a rebase
+// leaves them. Those merged are read the most recently updated
+// first (a pull request is updated when merged, or after), on from what was
+// `kept`: till one updated before the year, or before the newest read before
+// was, as many queries an answer as MERGED_QUERIES, a read not finished
+// going on from where it was left by the next; one read again whose label
+// no longer names an agent, what it was read to bring forgotten.
+export async function agentMerges(fullName: string, token: string, since: number, kept: AgentMerges | null,
+  fetchImpl: typeof fetch = globalThis.fetch): Promise<AgentMerges> {
+  const [owner, name] = fullName.split('/') as [string, string]
+  const merges = new Map((kept?.merges ?? []).filter(([, at]) => at >= since))
+  const rebases = new Map((kept?.rebases ?? []).filter(([, at]) => at >= since).map(([sha, at, subjects, more = 0]) => [sha, [at, subjects, more] as const]))
+  const pulls = new Map((kept?.pulls ?? []).filter(([, at]) => at >= since))
+  const pullRebases = new Map((kept?.pullRebases ?? []).filter(([, at]) => at >= since).map(([sha, at, subjects, more = 0]) => [sha, [at, subjects, more] as const]))
+  const stop = kept?.next?.stop ?? Math.max(since, kept?.through ?? since)
+  const listed = (map: typeof rebases) => [...map].map(([sha, [at, subjects, more]]): Rebase => more > 0 ? [sha, at, subjects, more] : [sha, at, subjects])
+  const result = (through: number | null, next: AgentMerges['next']): AgentMerges => ({ merges: [...merges], rebases: listed(rebases), through, next,
+    pulls: [...pulls], pullRebases: listed(pullRebases) })
+  let { after = null, from = null, read = 0 }: { after?: string | null; from?: number | null; read?: number } = kept?.next ?? {}
+  for (let queries = 0; queries < MERGED_QUERIES; queries++) {
+    const page = (await githubGraphql(MERGED_QUERY, { owner, name, after }, token, fetchImpl) as MergedPage | null)?.repository?.pullRequests
+    let done = page?.pageInfo?.hasNextPage !== true || typeof page.pageInfo.endCursor !== 'string'
+    for (const node of page?.nodes ?? []) {
+      const updated = timeOf(node?.updatedAt)
+      if (updated === null) continue
+      if (updated < stop) { done = true; break }
+      from ??= updated
+      read++
+      const [merged, merge] = [timeOf(node?.mergedAt), node?.mergeCommit?.oid]
+      if (!node || merged === null || merged < since || typeof merge !== 'string' || !SHA.test(merge)) continue
+      const own = (node.commits?.nodes ?? []).map(item => item?.commit)
+      const merging = count(node.mergeCommit?.parents?.totalCount) > 1
+      const brought = [merge, ...merging ? own.map(commit => commit?.oid) : []].filter((oid): oid is string => typeof oid === 'string' && SHA.test(oid))
+      const copied = own.filter(commit => commit?.changedFilesIfAvailable !== 0)
+      // Of one of more commits than its latest read, how many more it had.
+      const more = Math.max(0, count(node.commits?.totalCount) - own.length)
+      const subjects = !merging && (copied.length > 1 || more > 0) && copied.length > 0 && copied.every(commit => typeof commit?.messageHeadline === 'string')
+        ? copied.map(commit => commit!.messageHeadline as string) : null
+      pulls.set(merge, merged)
+      if (subjects) pullRebases.set(merge, [merged, subjects, more])
+      // One an agent's no more, its label taken off (which updates it), what
+      // it was read to bring none of an agent's.
+      if (!agentPull(node)) {
+        for (const oid of brought.filter(sha => merges.get(sha) === merged)) merges.delete(oid)
+        if (rebases.get(merge)?.[0] === merged) rebases.delete(merge)
+        continue
+      }
+      for (const oid of brought) merges.set(oid, merged)
+      if (subjects) rebases.set(merge, [merged, subjects, more])
+    }
+    if (done) return result(from ?? stop, null)
+    after = page!.pageInfo!.endCursor as string
+  }
+  return result(kept?.through ?? null, { after: after!, from: from ?? stop, stop, read })
+}
+
+// Whether two reads of the pull requests merged (agentMerges) bring the
+// same commits, the agents' and every one's (`pulls`, `pullRebases`, which
+// tell those pushed directly), whatever order each read them in.
+export function sameMerges(a: AgentMerges, b: AgentMerges) {
+  const sorted = (entries: unknown[] = []) => entries.map(entry => JSON.stringify(entry)).toSorted()
+  const brought = (read: AgentMerges) => JSON.stringify([read.merges, read.rebases, read.pulls, read.pullRebases].map(sorted))
+  return brought(a) === brought(b)
+}
+
+// A commit's subject as GitHub heads its message: whole, or, past what it
+// shows, cut short before an ellipsis.
+const headed = (subject: string, headline: string) => headline.endsWith('…') ? subject.startsWith(headline.slice(0, -1)) : subject === headline
+
+// The commits of `commits` (a year's) the agents' pull requests brought
+// (`read`, agentMerges): those it names, and of one rebased, its commits'
+// copies, the last and those below it on their first parents, as long as
+// each one's subject is that of one of its commits older than the last
+// matched, as Commits tells a rebase (repository-history.ts squashedPulls),
+// past those of its commits the rebase left none of (an empty one GitHub
+// counted no files of), and, past them all, as many more as it had before
+// its latest read; a squash merge's one commit alone, its subject the pull
+// request's own.
+export function agentCommits(read: AgentMerges, commits: HistoryCommit[]): Set<string> {
+  const shas = new Set(read.merges.map(([sha]) => sha))
+  const bySha = new Map(commits.map(commit => [commit.sha, commit]))
+  for (const [last, merged, subjects, more = 0] of read.rebases) {
+    let commit = bySha.get(last)
+    let at = subjects.length - 1
+    for (; commit && at >= 0; commit = bySha.get(commit.parents[0] ?? '')) {
+      const [copied, upTo] = [commit, at]
+      const found = subjects.findLastIndex((subject, index) => index <= upTo && headed(copied.subject, subject))
+      if (found < 0) break
+      shas.add(commit.sha)
+      at = found - 1
+    }
+    // Each of its latest commits read copied, as many as it had before them
+    // the commits below, on their first parents, as long as each was
+    // committed as it was merged, as a rebase commits its copies: not past
+    // its first, its empty ones, which a rebase leaves out, counted too.
+    const copiedAsMerged = (when: number | null) => when !== null && Math.abs(when - merged) <= REBASE_SKEW_MS
+    for (let rest = at < 0 ? more : 0; commit && rest > 0 && copiedAsMerged(commit.committedAt); rest--, commit = bySha.get(commit.parents[0] ?? '')) {
+      shas.add(commit.sha)
+    }
+  }
+  return shas
+}
+
+// The commits of `commits` (a year's, from the branch's `head`) pushed to
+// it directly: on its first parents from the head, none a merge, none a
+// pull request brought (`read.pulls`: its merge commit, a squash's one
+// commit, or the copies of one rebased onto it, as agentCommits tells
+// them); those a merge brought from its other parents, not.
+export function directCommits(read: AgentMerges, commits: HistoryCommit[], head: string): Set<string> {
+  const pulled = agentCommits({ ...read, merges: read.pulls ?? [], rebases: read.pullRebases ?? [] }, commits)
+  const bySha = new Map(commits.map(commit => [commit.sha, commit]))
+  const direct = new Set<string>()
+  for (let commit = bySha.get(head); commit; commit = bySha.get(commit.parents[0] ?? '')) {
+    if (commit.parents.length <= 1 && !pulled.has(commit.sha)) direct.add(commit.sha)
+  }
+  return direct
+}

package/server-managed/app-agents.ts

@@ -0,0 +1,30 @@
+// The agents the server knows by their GitHub Apps or accounts (the Agents
+// tab's, server-managed/repository-agents.ts, whose marks the Commits tab
+// reads on commits too, repository-history.ts).
+import type { AppAgent, AppAgentMarks } from '../common/managed/agent-tasks.ts'
+import { GITHUB_AGENTS } from '../common/managed/github-agents.ts'
+
+// The agents known by their GitHub Apps or accounts, beside Claude and
+// Codex: each its id and name, its avatar (its mark, served by
+// /api/avatar/<avatar>, for these alone: a GitHub App's, `app-<id>`, or
+// account's, `user-<id>`), the fingerprint it leaves as a line of its pull
+// requests' bodies and its commits' messages, the account its work is
+// authored by (its id and the logins GitHub names it by, told by both), and
+// its branches' prefix. Their work may carry Claude's or
+// Codex's marks too, those its tools. Copilot's coding agent opens its pull
+// requests and authors its commits as its account, Copilot (198982749), on
+// `copilot/` branches; Dependabot, its GitHub App (29110), opens its pull
+// requests as its account, `dependabot` (49699333, `dependabot[bot]` to
+// GitHub's REST API and in its address), on `dependabot/<ecosystem>/…`
+// branches. Their accounts and marks are those the app draws their work by
+// wherever it shows it (common/managed/github-agents.ts): Copilot's its own,
+// the app's to draw, no avatar.
+const { copilot, dependabot } = GITHUB_AGENTS
+export const APP_AGENTS: readonly (AppAgent & AppAgentMarks)[] = [
+  { id: 'neo', name: 'Neo', avatar: 'app-3115942', fingerprint: '🤖 Generated with [Neo](', prefix: 'neo/' },
+  { id: 'copilot', name: copilot.name, account: copilot.accounts[0], prefix: 'copilot/' },
+  { id: 'dependabot', name: dependabot.name, avatar: dependabot.avatar, account: dependabot.accounts[0], prefix: 'dependabot/' },
+]
+// The prefixes of the branches agents work on: Claude Code's and Codex's,
+// and the app agents'.
+export const AGENT_BRANCH_PREFIXES = ['claude/', 'codex/', ...APP_AGENTS.map(agent => agent.prefix)]

package/server-managed/avatar-store.ts

@@ -9,4 +9,5 @@ export interface CachedAvatar {
 export interface AvatarStore {
   put(id: string, contentType: string, bytes: Buffer): Promise<void>
   get(id: string): Promise<CachedAvatar | null>
+  delete(id: string): Promise<void>
 }

package/server-managed/commit-coauthors.ts

@@ -0,0 +1,83 @@
+// Who made a commit beside its author, as the Commits tab shows them
+// (repository-history.ts): its co-authors, as its `Co-authored-by:` trailers
+// name them, and the agents its message marks.
+import { agentSignals, trailerBlock } from '../common/managed/agent-tasks.ts'
+import { GITHUB_AGENTS, type GithubAgentId, emailAgent, githubAgent } from '../common/managed/github-agents.ts'
+import { APP_AGENTS } from './app-agents.ts'
+import { type NamedAccount, commitAccount } from './github-accounts.ts'
+
+export const MAX_COAUTHORS = 3
+// The rules co-authors are read by, the agents' addresses and names among
+// them: what was kept read by others (history pages, squashed pull requests)
+// read again by these, once raised.
+export const COAUTHORS_READ = 2
+const MAX_NAME = 256
+const textOf = (value: unknown, max: number) => typeof value === 'string' && value.trim() ? value.trim().slice(0, max) : null
+
+// One who made a commit beside its author: by name and account, as its
+// author is, and the agent it is where known, one GitHub knows by its account
+// or its commits' address or name (common/managed/github-agents.ts) or one
+// the server knows by its app (app-agents.ts), with its avatar.
+export interface Coauthor { name: string | null; login: string | null; id: number | null; agent?: string; avatar?: string }
+
+// `Co-authored-by: <name> <address>` trailers, GitHub matching the key
+// regardless of case; Cursor's agents' links, as their work carries them;
+// the app agents known by the fingerprints they leave.
+const COAUTHOR_TRAILER = /^co-authored-by:[ \t]*([^<\n]*?)[ \t]*<([^<>\s]+)>[ \t]*$/gimu
+const CURSOR_AGENT = /https:\/\/cursor\.com\/(?:agents\?id=|background-agent\?bcId=)bc-/u
+const FINGERPRINTED = APP_AGENTS.filter(agent => agent.fingerprint)
+
+// One named as a commit's author or co-author: by name, the address its
+// commit gives (where it is read), and account.
+export type Maker = { name: unknown; email?: unknown; account: NamedAccount }
+
+// The agent one who made a commit is: by their account, else the address
+// their commit names them by; else, GitHub naming no account for them, by
+// their name.
+const makerAgent = ({ name, email, account }: Maker): GithubAgentId | null => githubAgent(account.login, account.id) ?? emailAgent(email)
+  ?? (account.login ? null : githubAgent(null, null, typeof name === 'string' ? name : null))
+
+// Who made a commit, past its author (`author`), as its message names them:
+// its co-authors, those GitHub's GraphQL API lists past the author (`listed`,
+// the addresses its `Co-authored-by:` trailers give, by the accounts GitHub
+// knows them by), else its trailers (agent-tasks.ts trailerBlock), an account's no-reply
+// address naming it;
+// then the agents it marks, Claude's and Codex's as the Agents tab reads them
+// (agent-tasks.ts agentSignals: their sessions' and tasks' links, Claude's
+// co-author and "Generated with" lines), the app agents' by their
+// fingerprints, Cursor's by its agents' links. Each the agent it is where
+// known, and once, the author none of them, as many as MAX_COAUTHORS: two
+// are one by the first of their agent, account, address and name both name,
+// two people of one name with accounts or addresses of their own two.
+export function coauthorsOf(message: unknown, author: Maker, listed: Maker[] | null = null): Coauthor[] {
+  const text = typeof message === 'string' ? message.replaceAll('\r\n', '\n') : ''
+  const named = listed ?? [...trailerBlock(text).matchAll(COAUTHOR_TRAILER)].map(([, name, email]) => ({ name, email, account: commitAccount({ email }) }))
+  const signals = agentSignals([text], FINGERPRINTED)
+  const marked = [...signals.claude || signals.sessions.length > 0 ? ['claude'] : [], ...signals.tasks.length > 0 || signals.codex ? ['codex'] : [],
+    ...CURSOR_AGENT.test(text) ? ['cursor'] : [], ...signals.agents]
+  type Identity = { agent: string | null; login: string | null; email: string | null; name: string | null }
+  const identity = (agent: string | null, login: string | null, name: string | null, email: unknown = null): Identity => ({ agent, login: login?.toLowerCase() ?? null,
+    email: typeof email === 'string' && email.trim() ? email.trim().toLowerCase() : null, name: name?.toLowerCase() ?? null })
+  const same = (a: Identity, b: Identity) => a.agent && b.agent ? a.agent === b.agent : a.login && b.login ? a.login === b.login
+    : a.email && b.email ? a.email === b.email : a.name !== null && a.name === b.name
+  const seen = [identity(makerAgent(author), author.account.login, textOf(author.name, MAX_NAME), author.email)]
+  const coauthors: Coauthor[] = []
+  const add = (coauthor: Coauthor, email: unknown = null) => {
+    const who = identity(coauthor.agent ?? null, coauthor.login, coauthor.name, email)
+    if (seen.some(other => same(other, who)) || coauthors.length >= MAX_COAUTHORS || (!coauthor.login && !coauthor.name && !coauthor.agent)) return
+    seen.push(who)
+    coauthors.push(coauthor)
+  }
+  for (const maker of named) {
+    const agent = makerAgent(maker)
+    // An agent known by its address where GitHub names someone else's
+    // account for it (Codex's), as itself, not that account.
+    const { login, id } = agent && maker.account.login && githubAgent(maker.account.login, maker.account.id) !== agent ? { login: null, id: null } : maker.account
+    add({ name: textOf(maker.name, MAX_NAME), login, id, ...agent ? { agent } : {} }, maker.email)
+  }
+  for (const agent of marked) {
+    const app = APP_AGENTS.find(known => known.id === agent && !Object.hasOwn(GITHUB_AGENTS, known.id))
+    add({ name: app?.name ?? GITHUB_AGENTS[agent as GithubAgentId].name, login: null, id: null, agent, ...app?.avatar ? { avatar: app.avatar } : {} })
+  }
+  return coauthors
+}

package/server-managed/commit-lockfiles.ts

@@ -0,0 +1,62 @@
+// The versions a repository's lockfiles of npm's ecosystem lock at a commit,
+// as their review reads them (pull-dependency-reviews.ts): every lockfile
+// there (findRepoLockfiles) a review holds to (`held`, lockfile-scope.ts),
+// read as a pull request's are (pull-dependencies.ts readLockfile, kept in
+// this instance by the commit and path), as many as MAX_LOCKFILES of those,
+// each's versions (`lockfiles`), and those its reader refuses, of Bun's, or
+// past MAX_LOCKFILES (`unread`); and those of some of them (lockedIn), each
+// version once by what its reviews are held to (lockedWith), dev only where
+// it is wherever it is locked. GitHub having none of a lockfile it lists
+// there fails the whole, as it would for any file.
+import { createClient } from '@preventive/upstream/github.js'
+import { upstreamGithub } from './github-errors.ts'
+import { GithubApiError } from './github-app.ts'
+import type { LockedPackage } from './locked-packages.ts'
+import { type Lru, lru } from './lru.ts'
+import { lockedWith, lockfileFormat, readLockfile } from './pull-dependencies.ts'
+
+export const MAX_LOCKFILES = 100
+
+export interface CommitLockfiles { lockfiles: { path: string; packages: LockedPackage[] }[]; unread: string[] }
+
+// The lockfiles at commit `sha` its review reads, by their paths, each with
+// its format (pull-dependencies.ts lockfileFormat), kept by the commit.
+const listings: Lru<{ path: string; format: NonNullable<ReturnType<typeof lockfileFormat>> }[]> = lru(20_000, listed => listed.length + 1)
+export async function lockfilesAt(fullName: string, token: string, sha: string) {
+  const key = `${fullName}\0${sha}`
+  const known = listings.get(key)
+  if (known) return known
+  const { lockfiles } = await upstreamGithub(() => createClient({ token, userAgent: 'deepview-triage' }).findRepoLockfiles({ repo: fullName, sha }))
+  const listed = lockfiles.flatMap(({ path }) => { const format = lockfileFormat(path); return format ? [{ path, format }] : [] })
+  listings.set(key, listed)
+  return listed
+}
+
+export async function lockedAt(fullName: string, token: string, sha: string, held: (path: string) => boolean = () => true): Promise<CommitLockfiles> {
+  const listed = (await lockfilesAt(fullName, token, sha)).filter(({ path }) => held(path))
+  const unread = listed.slice(MAX_LOCKFILES).map(({ path }) => path)
+  const lockfiles: CommitLockfiles['lockfiles'] = []
+  for (const lockfile of listed.slice(0, MAX_LOCKFILES)) {
+    const read = await readLockfile(fullName, token, sha, lockfile)
+    if ('error' in read && read.error === 'github-not-found') throw new GithubApiError(404, 'github-not-found')
+    if ('error' in read) unread.push(lockfile.path)
+    else lockfiles.push({ path: lockfile.path, packages: read.packages })
+  }
+  return { lockfiles, unread: unread.toSorted() }
+}
+
+// The versions those of `read`'s lockfiles `held` holds to lock, each once,
+// and their paths.
+export function lockedIn(read: CommitLockfiles, held: (path: string) => boolean = () => true) {
+  const packages = new Map<string, LockedPackage>()
+  const paths: string[] = []
+  for (const lockfile of read.lockfiles.filter(({ path }) => held(path))) {
+    paths.push(lockfile.path)
+    for (const pkg of lockfile.packages) {
+      const kept = packages.get(lockedWith(pkg))
+      if (!kept) packages.set(lockedWith(pkg), { ...pkg })
+      else if (kept.dev && !pkg.dev) delete kept.dev
+    }
+  }
+  return { packages: [...packages.values()], paths }
+}

package/server-managed/comparison.ts

@@ -0,0 +1,41 @@
+// Compare's comparison of two managed bundles or two versions of an npm
+// package (GET /api/bundles/:id/comparison?other=, GET /api/npm/comparison):
+// their files paired, at one path or renamed, with the sizes, resolutions,
+// dependency versions and line counts its Overview and Code read beside them,
+// as common/bundle-comparison.js prepareComparison works them out. The viewer
+// of a managed bundle or a package has every comparison worked out here and
+// loads none of the pairing itself. Answered as Brotli-encoded JSON, its
+// `files.basePaths` (a Map) as `[path, as laid out]` pairs where the two
+// sides' roots differ and none else, as the viewer reads none then. Access is
+// the caller's to check.
+import { Buffer } from 'node:buffer'
+import { Readable } from 'node:stream'
+import { prepareComparison } from '../common/bundle-comparison.js'
+import type { BundleDetails } from '../common/bundle-metadata.js'
+import type { OpenedBlob } from './blob-store.ts'
+import { encodeBrotli } from './brotli.ts'
+import { type NpmPackageFile, npmFileRows } from './npm-packages.ts'
+
+// A side with no files, as Review compares a package's first version with:
+// one for each comparison, as working one out keeps its line counts on it.
+export const emptySide = (): BundleDetails => ({ integrity: '(empty)', kind: 'sourcemap', size: 0, json: { version: 3, sources: [], sourcesContent: [] } })
+
+// A version's files as the viewer reads them for a comparison (ui/view/npm-package.js
+// npmPackageDetails): its texts, and those that are not text by their size and digest.
+export function npmComparedSide(integrity: string, files: NpmPackageFile[]): BundleDetails & { npmBinaries: Map<string, { size: number; digest: string }> } {
+  const rows = npmFileRows(files)
+  return {
+    integrity, kind: 'sourcemap', size: 0,
+    json: { version: 3, sources: rows.map(([path]) => path), sourcesContent: rows.map(([, , text]) => text) },
+    npmBinaries: new Map(rows.flatMap(([path, size, text, digest]) => (text === null ? [[path, { size, digest: digest! }] as const] : []))),
+  }
+}
+
+// The comparison of `base` with `other`, within a reason `scope` where given, as sent.
+export async function comparisonBody(base: BundleDetails, other: BundleDetails, scope = ''): Promise<OpenedBlob> {
+  const comparison = prepareComparison(base, other, scope)
+  const { files } = comparison
+  const json = JSON.stringify({ ...comparison, files: { ...files, basePaths: files.root ? [...files.basePaths] : [] } })
+  const body = await encodeBrotli(Buffer.from(json))
+  return { size: body.byteLength, stream: Readable.from([body]) }
+}