@preventive/triage 1.0.0-alpha.43 → 1.0.0-alpha.45

package/server-managed/http.ts

@@ -3,10 +3,16 @@
 // server doesn't speak the e2e sync protocol yet). Every handler is async; the
 // boot's `track()` keeps in-flight requests drainable on shutdown.
 //
-//   GET  /api/config             → { mode:'managed', managed:{ loginPath, cookieName } }  (public)
+//   GET  /api/config             → { mode:'managed', managed:{ loginPath, cookieName }, session }  (public;
+//        `session` is /api/auth/session's answer, null signed out, absent when it could not be read)
 //   GET  /api/oauth/github/login → 302 to GitHub (+ state cookie)
 //   GET  /api/oauth/github/callback → the OAuth hook (see github-oauth.ts)
 //   GET  /api/auth/session       → { user, csrfToken } | 401
+//   GET  /api/auth/profile       → { profile: { login, name, githubName, nameAccount, avatarAccount, accounts } }, the
+//        GitHub accounts linked to the user's and which of them the displayed name and avatar come from | 401/403
+//   POST /api/auth/profile       → CSRF, chooses those ({ name?, avatar? }: a linked account's id, null the sign-in one) | 400/401/403/404
+//   DELETE /api/auth/profile/accounts/<id> → CSRF, unlinks a linked GitHub account | 401/403/404
+//   GET  /api/oauth/github/link  → 302 to GitHub to link another account (+ state cookie); the callback lands on /my/profile
 //   GET  /api/teams              → the current user's teams + their reports and bundles | 401
 //   GET  /api/teams/<id>/fixes → PR/issue metadata from visible findings' stored Fix links
 //   GET  /api/teams/<id>/reports → all reports and links filtered through this team | 401/404
@@ -16,14 +22,48 @@
 //   GET  /api/reports/<id>/triage → triage entries (by finding id, shared across reports) for a viewable report's findings | 401/404
 //   POST /api/reports/<id>/triage → write triage entries: admin, or ≥triage role + membership | 401/403/404
 //   GET  /api/reports/<id>/triage/history?finding=<fid> → one visible finding's triage trail, newest first | 400/401/404
-//   GET  /api/avatar/<id>        → cached avatar bytes by user id | 401/404
+//   GET  /api/avatar/<id>[?own]  → cached avatar bytes by user id, of the account chosen on their profile (`own`: the
+//        sign-in account's), or by linked account id; `app-<id>` or `user-<id>`, an app agent's GitHub App's or account's (APP_AGENTS) | 401/404
 //   GET  /api/admin/users        → admin-only user list | 401/403
 //   GET  /api/admin/history      → paginated activity (admin), team content activity (manage) | 401/403
 //   POST /api/admin/set-role     → admin sets another user's role | 401/403/404
 //   GET  /api/admin/repositories → admin repo list (each flagged selected) | 401/403
 //   POST /api/admin/repositories/select → admin selects/deactivates a repo | 401/403
+//   POST /api/admin/repositories/dependency-review → admin sets a repo's dependency review: enabled, the reviews each
+//        version needs, and the commit its lockfiles' versions need none since | 400/401/403/404
 //   GET /api/admin/repositories/impact → admin attached data summary
-//   GET /api/admin/repositories/{browsable,refs,contents} → admin|manage + GitHub read access
+//   GET /api/admin/repositories/{browsable,refs,contents} → view or above, within the reader's team grants, + GitHub read access
+//        (browsable: the names alone; these and the reads below are the code viewer's, open to every team member)
+//   GET /api/admin/repositories/code?repoId=&ref=&path= → the files of a directory at a revision, within the reader's grants,
+//        Brotli-encoded | 400/401/403/404/409/413/429/502
+//   GET /api/admin/repositories/history?repoId=&ref=&path=&page=[&all=true[&from=]] → the commits a revision reaches, a page at a time,
+//        or across the most recently updated branches, with the branches and tags naming them, then on from the commits `from`
+//        names | 400/401/403/404/409/429/502
+//   GET /api/admin/repositories/changes?repoId=&path=&shas= → the files each of the commits `shas` names (fifty at most)
+//        adds, modifies, removes and renames within `path`, as `git log --name-status` lists them | 400/401/403/404/409/429/502
+//   GET /api/admin/repositories/tree?repoId=&path=&commit= → the files commit `commit` holds within `path`, as many as
+//        75,000, for Replay to start from | 400/401/403/404/409/429/502
+//   GET /api/admin/repositories/issues?repoId=&kind=issues|pulls&state=open|closed[&after=] → a page of the repository's issues
+//        or pull requests, the most recently updated first, with how many are open and closed | 400/401/403/404/409/429/502
+//   GET /api/admin/repositories/agents?repoId=[&pulls=&commits=] → a page of what agents left: pull requests and commits to
+//        the default branch no pull request merged, with issues, agents' branches and the app agents first | 400/401/403/404/409/429/502
+//   GET /api/admin/repositories/item?repoId=&number= → an issue or pull request, as its popup shows it, with its
+//        description's Markdown | 400/401/403/404/409/429/502
+//   GET /api/admin/repositories/pull-dependencies?repoId=&number= → the package versions a pull request's npm, pnpm and
+//        Yarn 1 lockfiles lock that they didn't at its merge base, an update's with those it was, by directory; with review=1, each's
+//        review, where its repository reviews dependencies | 400/401/403/404/409/429/502
+//   GET /api/admin/repositories/branch-dependencies?repoId= → the versions the default branch's lockfiles lock that want review, where
+//        its review is in effect for the reader | 400/401/403/404/409/429/502
+//   GET /api/admin/repositories/lockfiles?repoId= → the lockfiles of the default branch its dependency review reads, by their
+//        paths, for its settings to name | 400/401/403/404/409/429/502
+//   GET /api/admin/repositories/pulse?repoId=&weeks=1|4|13|52 → the default branch's commits and lines a week and a day over
+//        the last year, its contributors and when in the period they commit, counted from its commits as Commits keeps them (how many are
+//        read while they are), and the pull requests
+//        merged and opened and the issues closed and opened in the last `weeks` weeks and the same days a period earlier | 400/401/403/404/409/429/502
+//   GET /api/admin/repositories/pulse/items?repoId=&weeks=&from=[&to=&authors=] → those pull requests and issues of the days
+//        `from` to `to` (YYYY-MM-DD, UTC; no `to`, on), and of any of `authors` (GitHub logins, comma-separated) | 400/401/403/404/409/429/502
+//        History, issues, item, agents and pulse each carry `users`: the app's users and agents the GitHub accounts they
+//        name are (github-users.ts), by login
 //   POST /api/admin/repositories/remove → admin permanently removes a repo
 //   GET  /api/admin/repositories/risk[?team=|?repo=] → admin: each connected repo's npm lockfiles, or a team's or one repo's,
 //        their packages and what risk tells of each, Brotli-encoded ndjson as each is found; the reader leaving stops it | 400/401/403/404
@@ -63,6 +103,8 @@
 //   GET/POST /api/npm/reviews → read private/team reviews; save, publish, revoke or continue a set | 400/401/403/404/409
 //   POST /api/npm/reviews/discard → author discards an unpublished review and its file rows | 400/401/403/409
 //   GET /api/npm/reviews/latest → latest own review for exact target bytes, across all bases | 400/401/403
+//   GET /api/npm/reviews/team?teamId=&beforeTime=&beforeId= → the reviews published to a team, the latest first, for one who
+//        reads them there | 400/401/404
 //   GET  /api/npm/package?name=&version= → a published version's manifest and files | 400/401/404/413/429/502
 //   GET  /api/npm/versions?name= → its dist-tags, versions, when each was published and its first was, and whether a team lists its scope | 400/401/404/429/502
 //   GET  /api/npm/download?name=&version= → its tarball | 400/401/404/413/429/502
@@ -81,6 +123,9 @@
 //        Brotli-encoded ndjson | 400/401/404/413/429/502/503
 //   GET  /api/npm/type-only?name=&version=&otherVersion= → the files that changed between two versions in types alone,
 //        Brotli-encoded ndjson | 400/401/404/413/429/502/503
+//   GET  /api/npm/delta?name=&version=&otherVersion= → the lines a version adds and removes against another, or `(empty)`, and
+//        those but for declaration files changed in types alone, where any are, and whether binary files changed
+//        | 400/401/404/413/422/429/502/503/504
 //   GET  /api/npm/risk?name=&version=&otherVersion= → what calls for a look at a version, as risk tells it, against another where given | 400/401/404/413/429/502
 //   POST /api/auth/logout        → same-origin + CSRF, drops the session (and any view)
 //   POST /api/auth/view-as       → admin opens a read-only view as another user | 400/401/403/404
@@ -89,7 +134,9 @@ import { mergeLinkGroups } from './link-reports.ts'
 import { backfillFindingIds, reportEntries } from '@preventive/report'
 import type { IncomingMessage, ServerResponse } from 'node:http'
 import { pipeline } from 'node:stream/promises'
-import { npmVersionStore, riskLineStore, scanReadStore } from './npm-kept.ts'
+import { REPOSITORY_READ_KEPT_MS, historyChangeStore, historyPageStore, historySquashStore, historyTreeStore, npmDeltaStore, npmVersionStore, pullDependencyStore,
+  repositoryReadStore, reviewBaselineStore, riskLineStore, scanReadStore } from './npm-kept.ts'
+import { type NpmDelta, npmDelta } from './npm-delta.ts'
 import { ADVISORIES_TIMEOUT_MS, fetchBundleAdvisories } from './bundle-advisories.ts'
 import { auditCache, auditedRepos, lastListing } from './upstream-cache.ts'
 import type { BundleAdvisoryInventory } from './bundle-advisory-inventory.ts'
@@ -114,13 +161,14 @@ import { isRole, roleAtLeast } from '../common/managed/roles.ts'
 import { VISIBILITY_PERMISSIONS, parseTeamUserPermissions } from '../common/managed/permissions.ts'
 import { filterReportData } from '../common/managed/report-filter.ts'
 import type { TriageEntryPatch } from '../common/managed/triage.ts'
+import { GITHUB_AGENTS } from '../common/managed/github-agents.ts'
 import { MAX_FINDING_ID, MAX_TRIAGE_BODY_BYTES, MAX_TRIAGE_ENTRIES, MAX_TRIAGE_HISTORY, parseTriageEntryPatch } from '../common/managed/triage.ts'
 import { reportRepoGithub } from '@preventive/report'
 import { findingsRepository, loadManagedFindings, ownFileDirectory, readManagedReport } from '../common/managed/report-content.ts'
 import type { ReportSourcesCache } from './report-sources.ts'
 import { normalizeTeamPath } from './repo-path.ts'
 import { DEFAULT_MANAGED_SCAN_MODEL, MANAGED_SCAN_MODELS } from '../common/managed/scan-models.ts'
-import { CONFIG_PATH, type ServerInfo } from '../common/server-info.ts'
+import { CONFIG_PATH, type ManagedSessionInfo, type ServerInfo } from '../common/server-info.ts'
 import { bundleCommitHash } from '../common/bundle-commit.js'
 import { GithubApiError, collectRepos, fetchPublicRepository, installUrl, publicRepositoryName, repositoryInstallation } from './github-app.ts'
 import { upstreamGithub } from './github-errors.ts'
@@ -129,8 +177,10 @@ import type { ConnectedRepo } from './github-app.ts'
 import { canAddAnyPublicRepository, canAddRepositories, passesPublicRepositorySafeguard } from './repository-policy.ts'
 import { RepositoryDiscovery } from './repository-discovery.ts'
 import { RISK_KEPT_MS, SCAN_READ_KEPT_MS, type ScanProgress, repositoryRiskLines } from './repository-risk.ts'
-import { type RepositoryEntry, createRepositoryBrowser, scopedDirectory } from './repository-browser.ts'
-import { CALLBACK_PATH, LOGIN_PATH, OAuthError, buildLoginRedirect, ensureUserAccessToken, handleCallback } from './github-oauth.ts'
+import { WORKFLOWS_DIR } from './repository-actions.ts'
+import { githubActionsSource } from './github-actions.ts'
+import { type RepositoryEntry, createRepositoryBrowser, repositoryTreeFiles, scopedDirectory } from './repository-browser.ts'
+import { CALLBACK_PATH, LOGIN_PATH, OAuthError, buildLoginRedirect, cacheAvatar, ensureUserAccessToken, handleCallback } from './github-oauth.ts'
 import { clearCookie, endSession, readSession } from './session.ts'
 import { VIEW_AS_PATH, VIEW_ONLY_ERROR, clearViewCookie, endViewSession, runViewing, startViewSession, viewToken } from './view-as.ts'
 import type { ActivityContext, ActivityInput } from './activity.ts'
@@ -142,17 +192,40 @@ import { lookupIssueLinks } from './github-issue-links.ts'
 import { visibleManagedIssues } from './managed-issues.ts'
 import { IssueError, MAX_ISSUE_BODY_BYTES, createGithubIssue, parseIssueContext, prepareGithubIssue } from './github-issues.ts'
 import { ISSUE_LOGIN_PATH, isIssueOAuthCallback, issueLoginRedirect, issueOAuthCallback } from './github-issue-oauth.ts'
+import { LINK_LOGIN_PATH, isLinkOAuthCallback, linkLoginRedirect, linkOAuthCallback } from './github-link-oauth.ts'
+import type { ProfileChoice } from './github-links.ts'
+import { withAppUsers } from './github-users.ts'
+import { isBlobId } from './object-storage.ts'
 import { attachmentDisposition, sendJson, sendLines, writeResponse } from './http-response.ts'
 import { triageWireEntry } from './triage-response.ts'
 import { handlePublicWorkspace } from './public-workspace.ts'
 import { serveUserTeamFeed } from './team-feed.ts'
-import { teamAppKey, teamAppStates } from './team-app.ts'
+import { teamAppKey, teamAppStates, withWorkspaceSummary } from './team-app.ts'
 import { hashToken, randomToken, safeEqual } from './crypto.ts'
 import { canDeleteComment, parseCommentBody } from '../common/managed/comments.ts'
 import { ManagedMutationError, reportReferenceSnapshot } from './management.ts'
 import { BundleBuildError, buildRepositoryBundle, parseBundleBuild, withBundleBuildLease } from './bundle-build.ts'
 import { NpmPackageError, type NpmReader, type NpmVersionDocument, canReadPrivateNpm, npmFileRows, npmScopesCount, npmTarballFilename, readNpmVersion, readNpmVersions } from './npm-packages.ts'
 import { loadNpmFiles, loadNpmPackageBody, loadNpmTarball } from './npm-loads.ts'
+import { loadRepositoryCodeBody, repositoryCodeFits } from './repository-code.ts'
+import { type ChangesStore, type CommitChanges, type CommitTree, TREES_READ, changesAsked, changesWithin, directoryFiles, repositoryChanges } from './repository-changes.ts'
+import { COAUTHORS_READ } from './commit-coauthors.ts'
+import { type AllHeads, type HistoryCommit, type HistoryPages, MAX_HISTORY_PAGE, type SquashedPull, type Squashes, historyFrom, historyStarts, openPullHeads,
+  repositoryAllHeads, repositoryAllHistory, repositoryHistory, repositoryRefTips, squashedPulls } from './repository-history.ts'
+import { AGENTS_READ_VERSION, APP_AGENTS, COMMITS_CURSOR, repositoryAgents } from './repository-agents.ts'
+import { ISSUES_CURSOR, ISSUES_READ_VERSION, repositoryIssues, repositoryItem } from './repository-issues.ts'
+import { MAX_LOCKED, PULL_DEPENDENCIES_READ, type PullDependencies, type PullDependencyStore, eachOf, lockfileFormat, pullDependencies } from './pull-dependencies.ts'
+import { lockedAt, lockedIn, lockfilesAt } from './commit-lockfiles.ts'
+import { MAX_REQUIRED_REVIEWS, SINCE_COMMIT } from './repository-dependency-reviews.ts'
+import { EVERY_LOCKFILE, heldTo, scopeOf } from './lockfile-scope.ts'
+import { type ReviewBaselineStore, baselineFor, heldDependencies, reviewedDependencies, reviewedPackages } from './pull-dependency-reviews.ts'
+import { formattedPull, withFormatted } from './dependency-review-comments.ts'
+import type { ReviewedDependencies } from './reviewed-dependencies.ts'
+import { commentReviews } from './pull-comment-reviews.ts'
+import { PULSE_WEEKS, PULSE_YEAR_VERSION, type PulseStats, StatsPending, commitStats, defaultHead, periodStats, pulseSince, repositoryActivity, repositoryLines,
+  repositoryStats, withLines, yearCommits } from './repository-pulse.ts'
+import { type AgentMerges, agentCommits, agentMerges, directCommits, sameMerges } from './agent-merges.ts'
+import { releaseCommits } from './release-commits.ts'
 import { computeBundleDiff } from '../common/bundle-compare-diff.js'
 import type { ReviewChange, ReviewContext, ReviewInput } from './dependency-reviews.ts'
 import { allowedReviewVerdicts, isReviewableFile, npmReviewVerdictLimit, npmTakenDown } from '../common/dependency-reviews.js'
@@ -163,9 +236,11 @@ import { NpmRiskError } from '../risk/index.js'
 import { type PrettyCache, PrettyError, type PrettyRequest, compared, prettyRequest, prettyText } from './pretty-print.ts'
 import { renameDiffOf, renameDiffRequest, renamedPairs } from './rename-diff.ts'
 import { typeOnlyFiles } from './type-only.ts'
+import { comparisonBody, emptySide, npmComparedSide } from './comparison.ts'
 import { isNpmPackageName, isNpmPackageSpec, npmPackageScope } from '../common/managed/npm-packages.js'
 
 const SESSION_PATH = '/api/auth/session'
+const PROFILE_PATH = '/api/auth/profile'
 const AVATAR_PREFIX = '/api/avatar/'
 const LOGOUT_PATH = '/api/auth/logout'
 const ADMIN_USERS_PATH = '/api/admin/users'
@@ -176,7 +251,20 @@ const ADMIN_REPOS_PATH = '/api/admin/repositories'
 const BROWSABLE_REPOS_PATH = '/api/admin/repositories/browsable'
 const REPO_REFS_PATH = '/api/admin/repositories/refs'
 const REPO_CONTENTS_PATH = '/api/admin/repositories/contents'
+const REPO_CODE_PATH = '/api/admin/repositories/code'
+const REPO_HISTORY_PATH = '/api/admin/repositories/history'
+const REPO_CHANGES_PATH = '/api/admin/repositories/changes'
+const REPO_TREE_PATH = '/api/admin/repositories/tree'
+const REPO_ISSUES_PATH = '/api/admin/repositories/issues'
+const REPO_AGENTS_PATH = '/api/admin/repositories/agents'
+const REPO_ITEM_PATH = '/api/admin/repositories/item'
+const REPO_PULL_DEPENDENCIES_PATH = '/api/admin/repositories/pull-dependencies'
+const REPO_BRANCH_DEPENDENCIES_PATH = '/api/admin/repositories/branch-dependencies'
+const REPO_LOCKFILES_PATH = '/api/admin/repositories/lockfiles'
+const REPO_PULSE_PATH = '/api/admin/repositories/pulse'
+const REPO_PULSE_ITEMS_PATH = '/api/admin/repositories/pulse/items'
 const SELECT_REPO_PATH = '/api/admin/repositories/select'
+const REPO_DEPENDENCY_REVIEW_PATH = '/api/admin/repositories/dependency-review'
 const ADD_PUBLIC_REPO_PATH = '/api/admin/repositories/add-public'
 const CONNECT_REPO_APP_PATH = '/api/admin/repositories/connect-app'
 const REPO_IMPACT_PATH = '/api/admin/repositories/impact'
@@ -216,7 +304,9 @@ const NPM_PROVENANCE_PATH = '/api/npm/provenance'
 const NPM_PRETTY_PATH = '/api/npm/pretty'
 const NPM_RENAME_DIFF_PATH = '/api/npm/rename-diff'
 const NPM_TYPE_ONLY_PATH = '/api/npm/type-only'
+const NPM_COMPARISON_PATH = '/api/npm/comparison'
 const NPM_RISK_PATH = '/api/npm/risk'
+const NPM_DELTA_PATH = '/api/npm/delta'
 // What risk's errors (risk/npm/registry.js NpmRiskError) are answered as: npm
 // having no such package or version, or a tarball unpacking past risk's
 // bounds; npm failing otherwise a 502.
@@ -229,7 +319,7 @@ function sendRiskError(res: ServerResponse, err: NpmRiskError) {
   sendJson(res, status, { error: err.code })
 }
 const NPM_PATHS = new Set([NPM_PACKAGE_PATH, NPM_VERSIONS_PATH, NPM_DOWNLOAD_PATH, NPM_STATS_PATH, NPM_ADVISORIES_PATH, NPM_TAGS_PATH, NPM_SOCKET_PATH, NPM_PROVENANCE_PATH, NPM_PRETTY_PATH,
-  NPM_RENAME_DIFF_PATH, NPM_TYPE_ONLY_PATH, NPM_RISK_PATH])
+  NPM_RENAME_DIFF_PATH, NPM_TYPE_ONLY_PATH, NPM_RISK_PATH, NPM_COMPARISON_PATH, NPM_DELTA_PATH])
 // How long an npm response may go unread before its connection is dropped.
 const NPM_RESPONSE_IDLE_MS = 60_000
 const MAX_TEAM_NAME = 100
@@ -350,6 +440,9 @@ export interface ManagedHttpDeps {
   serveStatic?: (req: IncomingMessage, res: ServerResponse) => boolean
   next?: Handler
   serverInfo?: ServerInfo
+  // The reviewed dependencies the host registered, as the server was
+  // assembled (reviewed-dependencies.ts).
+  reviewedDependencies?: ReviewedDependencies
 }
 
 type Handler = (req: IncomingMessage, res: ServerResponse) => void | Promise<void>
@@ -364,8 +457,9 @@ function firstHeader(v: string | string[] | undefined): string | null {
   return null
 }
 
-async function serveAvatar(res: ServerResponse, avatarStore: AvatarStore, userId: string): Promise<void> {
-  const avatar = await avatarStore.get(userId)
+// `key` is the image chosen for `id`; one not cached falls back to `id`'s own.
+async function serveAvatar(res: ServerResponse, avatarStore: AvatarStore, id: string, key = id): Promise<void> {
+  const avatar = await avatarStore.get(key) ?? (key === id ? null : await avatarStore.get(id))
   if (avatar == null) { sendJson(res, 404, { error: 'no-avatar' }); return }
   res.writeHead(200, {
     'content-type': avatar.contentType,
@@ -376,6 +470,26 @@ async function serveAvatar(res: ServerResponse, avatarStore: AvatarStore, userId
   res.end(avatar.bytes)
 }
 
+// The avatars `/api/avatar/app-<id>` and `/api/avatar/user-<id>` serve, these
+// alone: the agents' known by their GitHub Apps or accounts (APP_AGENTS),
+// each its mark on the Agents tab, and those the app draws agents' accounts
+// by (GITHUB_AGENTS). Each is fetched from GitHub once and
+// kept, under a key no user's, a v4 UUID, can be: an app's, `…-0000-<id>`,
+// an account's, `…-0001-<id>`.
+const AGENT_AVATARS: ReadonlySet<string> = new Set([...APP_AGENTS, ...Object.values(GITHUB_AGENTS)]
+  .flatMap(agent => 'avatar' in agent && agent.avatar ? [agent.avatar] : []))
+const AGENT_AVATAR = /^(app|user)-([1-9]\d{0,11})$/u
+
+async function serveAgentAvatar(res: ServerResponse, avatarStore: AvatarStore, avatar: string): Promise<void> {
+  const [, kind, id] = AGENT_AVATAR.exec(avatar)!
+  const key = `00000000-0000-0000-000${kind === 'app' ? 0 : 1}-${id!.padStart(12, '0')}`
+  if (await avatarStore.get(key) == null) {
+    await cacheAvatar(avatarStore, key, `https://avatars.githubusercontent.com/${kind === 'app' ? 'in' : 'u'}/${id}`, globalThis.fetch)
+      .catch((err) => { console.warn('managed: agent avatar caching failed:', err) })
+  }
+  await serveAvatar(res, avatarStore, key)
+}
+
 const MAX_JSON_BODY_BYTES = 4096
 
 // Buffer the request body, aborting (and throwing 'too-large') once it exceeds
@@ -478,9 +592,10 @@ function sendViewOnly(res: ServerResponse): void {
 // Reads stay available while an admin views as another user. Everything else
 // is refused before dispatch, except ending the view or signing out, and the
 // batch report preview, a POST without effects. Issue authorization would
-// grant GitHub access on the viewed user's behalf.
+// grant GitHub access on the viewed user's behalf, and linking an account
+// would link it to the viewed user.
 function viewAllows(method: string, path: string): boolean {
-  if (method === 'GET' || method === 'HEAD') return path !== ISSUE_LOGIN_PATH
+  if (method === 'GET' || method === 'HEAD') return path !== ISSUE_LOGIN_PATH && path !== LINK_LOGIN_PATH
   return (method === 'DELETE' && path === VIEW_AS_PATH) || (method === 'POST' && (path === LOGOUT_PATH || path === REPORT_QUERY_PATH))
 }
 
@@ -525,6 +640,65 @@ async function handleViewAs(req: IncomingMessage, res: ServerResponse, deps: Man
   res.end()
 }
 
+// GET /api/auth/profile — the user's profile (github-links.ts). POST chooses
+// the accounts their displayed name and avatar come from. Workspace access is
+// required: the accounts a user links are reserved for them.
+async function handleProfile(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
+  const method = req.method ?? 'GET'
+  if (method === 'GET') {
+    const s = await readWorkspaceSession(res, deps, cookie)
+    if (s) await sendProfile(res, deps, s.user.id)
+    return
+  }
+  if (method !== 'POST') { send405(res, 'GET, POST'); return }
+  const s = await profileMutation(req, res, deps, cookie)
+  if (s == null) return
+  let body: unknown
+  try { body = await readJsonBody(req) } catch { sendJson(res, 400, { error: 'bad-body' }); return }
+  const choice = parseProfileChoice(body)
+  if (choice == null) { sendJson(res, 400, { error: 'bad-request' }); return }
+  await deps.db.setProfileChoice(s.session.id, choice, Date.now())
+  await sendProfile(res, deps, s.user.id)
+}
+
+// DELETE /api/auth/profile/accounts/<id> — unlink one of the user's linked
+// GitHub accounts, which may then sign in or register again.
+async function handleUnlinkAccount(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, id: string): Promise<void> {
+  if ((req.method ?? 'GET') !== 'DELETE') { send405(res, 'DELETE'); return }
+  const s = await profileMutation(req, res, deps, cookie)
+  if (s == null) return
+  const link = await deps.db.unlinkGithubAccount(s.session.id, id, Date.now())
+  if (link == null) { sendJson(res, 404, { error: 'no-account' }); return }
+  await deps.avatarStore.delete(link.id).catch((err) => { console.warn('managed: linked avatar removal failed:', err) })
+  await activity(deps, s.user, 'access', `unlinked GitHub account @${link.login}`)
+  await sendProfile(res, deps, s.user.id)
+}
+
+async function profileMutation(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<{ session: ManagedSession; user: StoredUser } | null> {
+  const s = await checkMutation(req, res, deps, cookie)
+  if (s != null && !roleAtLeast(s.user.role, 'view')) { sendJson(res, 403, { error: 'forbidden' }); return null }
+  return s
+}
+
+async function sendProfile(res: ServerResponse, deps: ManagedHttpDeps, userId: string): Promise<void> {
+  const profile = await deps.db.getProfile(userId)
+  if (profile == null) { sendJson(res, 401, { error: 'unauthenticated' }); return }
+  sendJson(res, 200, { profile })
+}
+
+// { name?, avatar? }, each a linked account's id or null; at least one.
+function parseProfileChoice(body: unknown): ProfileChoice | null {
+  if (body == null || typeof body !== 'object' || Array.isArray(body)) return null
+  const choice: ProfileChoice = {}
+  for (const key of ['name', 'avatar'] as const) {
+    if (!Object.hasOwn(body, key)) continue
+    const value = (body as Record<string, unknown>)[key]
+    if (value !== null && (typeof value !== 'string' || !isBlobId(value))) return null
+    choice[key] = value
+  }
+  return Object.keys(choice).length > 0 ? choice : null
+}
+
 // POST /api/admin/set-role — an admin sets ANOTHER user's role. Admin-only, and
 // refused for the caller's own id so an admin can't drop their own admin (keeps
 // at least one admin).
@@ -581,6 +755,27 @@ async function readWorkspaceSession(res: ServerResponse, deps: ManagedHttpDeps,
   return s
 }
 
+// Who am I? While an admin views as another user, that user, plus the admin
+// as `viewer`. A view that has ended (with the admin's session or role, or the
+// viewed account) is cleared, returning to the own session. Null signed out.
+// `dependencyReview` where they publish dependency reviews to some team.
+async function currentSession(config: ManagedConfig, db: ManagedDb, cookie: string | undefined): Promise<{ body: ManagedSessionInfo | null; headers: Record<string, string> }> {
+  const now = Date.now()
+  let s = await readSession(config, db, cookie, now)
+  const ended = s == null && viewToken(config, cookie) != null
+  if (ended) s = await readSession(config, db, cookie, now, { own: true })
+  const reviews = s != null && (await db.listDependencyReviewTeams(s.user.id)).length > 0
+  return {
+    body: s && {
+      user: { id: s.user.id, login: s.user.login, name: s.user.name, role: s.user.role },
+      csrfToken: s.session.csrfToken,
+      ...(s.session.viewer ? { viewer: s.session.viewer } : {}),
+      ...(reviews ? { dependencyReview: true as const } : {}),
+    },
+    headers: ended ? { 'set-cookie': clearViewCookie(config) } : {},
+  }
+}
+
 // GET /api/admin/scan/models — the server's canonical scan model ids and effort
 // levels. Names are intentionally absent; the client derives them from ids.
 async function handleListModels(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
@@ -623,9 +818,13 @@ async function handleListRepositories(req: IncomingMessage, res: ServerResponse,
   let tokenMissing = false
   let repositories
   if (scope === 'connected') {
+    const reviews = await deps.db.listRepoDependencyReviews()
+    const reviewTeams = await deps.db.listRepoReviewTeams()
     repositories = allRows.map((r) => ({
       id: r.repoId, fullName: r.fullName, private: r.private, htmlUrl: r.htmlUrl,
       installed: r.installationId != null, selected: r.active, active: r.active,
+      dependencyReview: reviews.get(r.repoId) ?? { enabled: false, required: 1, since: null, lockfiles: EVERY_LOCKFILE },
+      reviewTeams: reviewTeams.get(r.repoId) ?? [],
     }))
   } else {
     const showAll = scope === 'installed' && url.searchParams.get('showAll') === 'true'
@@ -655,6 +854,7 @@ async function handleListRepositories(req: IncomingMessage, res: ServerResponse,
     inactiveCount: allRows.filter((r) => !r.active).length,
     total,
     tokenMissing,
+    ...deps.reviewedDependencies ? { reviewedDependencies: true } : {},
   })
 }
 
@@ -789,6 +989,39 @@ async function handleSelectRepository(req: IncomingMessage, res: ServerResponse,
   await selectRepository(res, deps, s.user, repoId, cookie)
 }
 
+// POST /api/admin/repositories/dependency-review — a repository's dependency
+// review (repository-dependency-reviews.ts): `enabled`, the published reviews
+// each version its pull requests' lockfiles lock needs (`required`, 1 to
+// MAX_REQUIRED_REVIEWS), and the commit whose lockfiles' versions need none
+// (`since`, a full commit id, or null; where the host registered reviewed
+// dependencies, which replace it, none, `400 since-unsupported`, the one
+// stored kept as it is). Answers the setting then. Admin, CSRF.
+async function handleRepositoryDependencyReview(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
+  if ((req.method ?? 'GET') !== 'POST') { send405(res, 'POST'); return }
+  const s = await adminMutation(req, res, deps, cookie)
+  if (s == null) return
+  let body: Record<string, unknown> | null
+  try { body = await readJsonBody(req) as Record<string, unknown> | null } catch { sendJson(res, 400, { error: 'bad-body' }); return }
+  const repoId = body?.['repoId']
+  const enabled = body?.['enabled']
+  const required = body?.['required']
+  const since = body?.['since'] ?? null
+  // The lockfiles it holds to, kept as they are where none is sent.
+  const lockfiles = body?.['lockfiles'] === undefined ? undefined : scopeOf(body['lockfiles'])
+  if (typeof repoId !== 'number' || !Number.isSafeInteger(repoId) || typeof enabled !== 'boolean'
+    || typeof required !== 'number' || !Number.isSafeInteger(required) || required < 1 || required > MAX_REQUIRED_REVIEWS
+    || (since !== null && (typeof since !== 'string' || !SINCE_COMMIT.test(since))) || lockfiles === null) {
+    sendJson(res, 400, { error: 'bad-request' }); return
+  }
+  if (since !== null && deps.reviewedDependencies) { sendJson(res, 400, { error: 'since-unsupported' }); return }
+  const repo = (await deps.db.listAllRepos()).find(row => row.repoId === repoId)
+  const setting = repo ? await deps.db.setRepoDependencyReview(repoId, { enabled, required, ...deps.reviewedDependencies ? {} : { since: since as string | null },
+    ...lockfiles ? { lockfiles } : {} }) : null
+  if (!repo || !setting) { sendJson(res, 404, { error: 'no-repository' }); return }
+  await activity(deps, s.user, 'repository', enabled ? 'enabled dependency review' : 'disabled dependency review', { repo: repo.fullName })
+  sendJson(res, 200, { ok: true, dependencyReview: setting })
+}
+
 async function repositoryFindingIds(deps: ManagedHttpDeps, reports: { id: string, filename: string }[]): Promise<Set<string>> {
   const ids = new Set<string>()
   for (const report of reports) {
@@ -1228,8 +1461,10 @@ async function backfillCatalogCommits(deps: ManagedHttpDeps, userId: string, mis
 
 // Listing connected repository names uses managed access only. Verify GitHub
 // access after selection, before returning any refs or source directory data.
+// Any team member (view or above) lists those their teams reach, for the code
+// viewer as for Create a bundle, whose builds stay admin|manage.
 async function handleBrowsableRepositories(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined): Promise<void> {
-  const s = await readManageSession(res, deps, cookie)
+  const s = await readWorkspaceSession(res, deps, cookie)
   if (!s) return
   sendJson(res, 200, { repos: selectableRepos(await bundleRepos(deps, s.user)) })
 }
@@ -1268,25 +1503,54 @@ function scopeRepositoryContents(contents: RepositoryContents | null, virtualEnt
   } : {}) }
 }
 
-// Recheck repository/path grants after upstream reads, before returning names.
-async function handleRepositoryBrowser(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams, refs: boolean): Promise<void> {
+// A browse's repository, revision and directory, as its query names them;
+// null, answered, where it names none.
+function repositoryQuery(res: ServerResponse, query: URLSearchParams) {
   const repoId = Number(query.get('repoId'))
   const normalized = normalizeTeamPath(query.get('path') ?? '')
   const ref = query.get('ref') ?? ''
   if (!Number.isSafeInteger(repoId) || repoId <= 0 || !normalized.ok || ref.length > 1024 || /\p{Cc}/u.test(ref)) {
-    sendJson(res, 400, { error: 'bad-request' }); return
+    sendJson(res, 400, { error: 'bad-request' }); return null
   }
+  return { repoId, ref, path: normalized.path ?? '' }
+}
+
+// The repository `repoId` as the reader may browse it at `path`: one of their
+// bundle repositories, and what their grants show of that directory
+// (`virtualEntries`, null where they reach all of it: scopedDirectory). Null,
+// answered, where it is none of theirs. Every team member (view or above)
+// reads the repositories their teams reach; the reader then checks their own
+// GitHub read permission (repository-browser.ts), on each read.
+async function authorizeRepository(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, repoId: number, path: string) {
+  const s = await readWorkspaceSession(res, deps, cookie)
+  if (!s) return null
+  const repo = (await bundleRepos(deps, s.user)).find(item => item.repoId === repoId)
+  if (!repo) { sendJson(res, 404, { error: 'no-repository' }); return null }
+  const scopes = s.user.role === 'admin' ? [null] : (await deps.db.listRepoScopesForUser(s.user.id)).filter(scope => scope.repoId === repoId).map(scope => scope.path)
+  return { repo, virtualEntries: scopedDirectory(path, scopes), user: s.user }
+}
+
+// The repository as it was authorized, but for the shared default branch hint,
+// which a read may refresh meanwhile: that changes none of its identity,
+// credentials or managed grants.
+const sameRepository = (current: SelectedRepo, authorized: SelectedRepo) =>
+  JSON.stringify({ ...current, cachedDefaultBranch: authorized.cachedDefaultBranch }) === JSON.stringify(authorized)
+
+function sendGithubError(res: ServerResponse, err: GithubApiError) {
+  sendJson(res, err.status === 401 ? 502 : err.status, { error: err.message }, err.retryAfter == null ? {} : { 'retry-after': String(err.retryAfter) })
+}
+
+// Recheck repository/path grants after upstream reads, before returning names.
+async function handleRepositoryBrowser(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams, refs: boolean): Promise<void> {
+  const asked = repositoryQuery(res, query)
+  if (!asked) return
+  const { repoId, ref } = asked
   const withDefault = refs && query.get('withDefault') === 'true'
-  const path = refs ? '' : normalized.path ?? ''
+  const path = refs ? '' : asked.path
   const authorize = async () => {
-    const s = await readManageSession(res, deps, cookie)
-    if (!s) return null
-    const repo = (await bundleRepos(deps, s.user)).find(item => item.repoId === repoId)
-    if (!repo) { sendJson(res, 404, { error: 'no-repository' }); return null }
-    const scopes = s.user.role === 'admin' ? [null] : (await deps.db.listRepoScopesForUser(s.user.id)).filter(scope => scope.repoId === repoId).map(scope => scope.path)
-    const virtualEntries = scopedDirectory(path, scopes)
-    if ((!refs || withDefault) && virtualEntries?.length === 0) { sendJson(res, 404, { error: 'no-directory' }); return null }
-    return { repo, virtualEntries, user: s.user }
+    const access = await authorizeRepository(res, deps, cookie, repoId, path)
+    if (access && (!refs || withDefault) && access.virtualEntries?.length === 0) { sendJson(res, 404, { error: 'no-directory' }); return null }
+    return access
   }
   const access = await authorize()
   if (!access) return
@@ -1308,23 +1572,729 @@ async function handleRepositoryBrowser(res: ServerResponse, deps: ManagedHttpDep
     await reader.recheckAccess()
     const current = await authorize()
     if (!current) return
-    // This request (or another reader) may have refreshed the shared hint. It
-    // does not change repository identity, credentials, or managed grants.
-    if (JSON.stringify({ ...current.repo, cachedDefaultBranch: access.repo.cachedDefaultBranch }) !== JSON.stringify(access.repo)) {
-      sendJson(res, 409, { error: 'repository-changed' }); return
-    }
-    sendJson(res, 200, refs ? { ...listed, ...(withDefault ? {
+    // This request (or another reader) may have refreshed the shared hint.
+    if (!sameRepository(current.repo, access.repo)) { sendJson(res, 409, { error: 'repository-changed' }); return }
+    sendJson(res, 200, refs ? { ...listed, tagCommits, ...(withDefault ? {
       defaultContents: scopeRepositoryContents(revisions?.defaultContents ?? null, current.virtualEntries),
     } : {}) } : scopeRepositoryContents(contents, current.virtualEntries))
   } catch (err) {
-    if (err instanceof GithubApiError) {
-      sendJson(res, err.status === 401 ? 502 : err.status, { error: err.message }, err.retryAfter == null ? {} : { 'retry-after': String(err.retryAfter) })
+    if (err instanceof GithubApiError) { sendGithubError(res, err); return }
+    throw err
+  }
+}
+
+// GET /api/admin/repositories/code: the files of a directory of a repository
+// at a revision, for the code viewer (repository-code.ts), read as browsing
+// it is, with the reader's own GitHub access, and only where their grants
+// reach the whole directory: one they reach only the ancestor of is none to
+// read. Its tree's listing says first whether its files fit, before its
+// tarball is asked for; the reader's access is checked again once it is
+// read, before any of it is sent. The load stays held until this response is
+// written or abandoned, and a reader who stops reading it gives it up after
+// a while.
+async function handleRepositoryCode(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams): Promise<void> {
+  const asked = repositoryQuery(res, query)
+  if (!asked) return
+  const { repoId, ref, path } = asked
+  const authorize = async () => {
+    const access = await authorizeRepository(res, deps, cookie, repoId, path)
+    if (access && access.virtualEntries !== null) { sendJson(res, 404, { error: 'no-directory' }); return null }
+    return access
+  }
+  const access = await authorize()
+  if (!access) return
+  try {
+    const reader = await createRepositoryBrowser(deps.config, await repositoryBrowserUser(deps, access.user.id)).reader(access.repo)
+    const commit = await reader.commit(ref)
+    const repo = access.repo.fullName
+    const client = createClient({ token: reader.readToken() })
+    // A directory the commit has none at is none to read, as browsing it says.
+    const tree = await upstreamGithub(() => client.getRepoTreeId({ repo, sha: commit, ...(path ? { directory: path } : {}) }).catch((err: unknown) => {
+      throw err instanceof Error && err.name === 'AssertionError' && err.message.includes(' has no directory at ') ? new GithubApiError(404, 'no-directory') : err
+    }))
+    // Access still held, and the same repository, before anything read is sent.
+    const fenced = async () => {
+      await reader.recheckAccess()
+      const current = await authorize()
+      if (!current) return false
+      if (!sameRepository(current.repo, access.repo)) { sendJson(res, 409, { error: 'repository-changed' }); return false }
+      return true
+    }
+    // Too large names the commit it was read at, for History to read.
+    if (!repositoryCodeFits(await repositoryTreeFiles(repo, reader.readToken(), tree))) {
+      if (await fenced()) sendJson(res, 413, { error: 'directory-too-large', commit })
       return
     }
+    if (res.destroyed) return
+    const load = loadRepositoryCodeBody({ repoId, repo, commit, path, tree }, () => upstreamGithub(() => client.getRepoTreeTarball({ repo, tree })))
+    res.once('close', load.release)
+    const bytes = await load.result
+    if (!(await fenced()) || res.destroyed) return
+    res.setTimeout(NPM_RESPONSE_IDLE_MS, () => res.destroy())
+    res.writeHead(200, {
+      'content-type': 'application/json', 'content-encoding': 'br', 'content-length': String(bytes.byteLength),
+      'cache-control': 'private, no-store', 'x-content-type-options': 'nosniff',
+    })
+    writeResponse(res, bytes)
+  } catch (err) {
+    if (res.headersSent || res.destroyed) return
+    if (err instanceof GithubApiError) { sendGithubError(res, err); return }
+    if (err instanceof NpmPackageError) { sendJson(res, err.status, { error: err.message }); return }
+    throw err
+  }
+}
+
+// GET /api/admin/repositories/history: what the code viewer's History tab
+// draws (repository-history.ts), read as browsing is, with the reader's own
+// GitHub access, within their grants as the code is. From a revision (`ref`),
+// a page at a time (`page`), the commits touching `path` where it names a
+// directory, with the branches and tags naming commits on the first page; or,
+// with `all`, across the repository's most recently updated branches, which
+// needs a GitHub token. A whole repository's history, from a revision or all
+// branches, is read from commits a page each, kept by the commit each starts
+// at, and those kept glued on (historyFrom); a later page reads on from the
+// commits `from` names. The branches and tags naming commits are kept as an
+// issue's page is (keptAnswer). Access is checked again once it is read,
+// before any of it is sent, with the app's users its authors are
+// (github-users.ts).
+async function handleRepositoryHistory(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams): Promise<void> {
+  const asked = repositoryQuery(res, query)
+  if (!asked) return
+  const { repoId, ref, path } = asked
+  const page = Number(query.get('page') ?? '1')
+  const all = query.get('all') === 'true'
+  // Every branch's heads read now, not as kept: the client asks so where
+  // they miss the commit shown, as a branch moved since may.
+  const fresh = query.get('fresh') === 'true'
+  // A whole repository's later pages read on from where those before stop:
+  // all branches', always; a revision's, where the client names them.
+  const from = query.get('from')
+  const starts = from === null ? null : historyStarts(from)
+  if (!Number.isSafeInteger(page) || page < 1 || page > MAX_HISTORY_PAGE || (all && (path !== '' || (page > 1) !== (starts !== null)))
+    || (from !== null && (starts === null || path !== '' || page === 1))) { sendJson(res, 400, { error: 'bad-request' }); return }
+  const authorize = async () => {
+    const access = await authorizeRepository(res, deps, cookie, repoId, path)
+    if (access && access.virtualEntries !== null) { sendJson(res, 404, { error: 'no-directory' }); return null }
+    return access
+  }
+  const access = await authorize()
+  if (!access) return
+  try {
+    const reader = await createRepositoryBrowser(deps.config, await repositoryBrowserUser(deps, access.user.id)).reader(access.repo)
+    const repo = access.repo.fullName
+    const token = reader.readToken()
+    // With a token, as GraphQL reads them.
+    const pages = historyPages(deps, repoId, token !== null)
+    let body: object
+    if (all) {
+      if (!token) { sendJson(res, 403, { error: 'github-token-required' }); return }
+      // What a later page reads on from, the client knows; whether one may
+      // follow, the deepest page says.
+      // Asked for afresh, those kept answered as just read: how long till
+      // they may be read again (`retryIn`), for the client to ask then.
+      const heads = starts ? null : await keptAnswer<AllHeads>(deps, `${repoId}\0heads`, () => repositoryAllHeads(repo, token), undefined, fresh)
+      const retryIn = heads && fresh && heads.kept ? heads.at + REPOSITORY_READ_FLOOR_MS - Date.now() : 0
+      body = starts ? { all: true, page, commits: (await historyFrom(repo, token, starts, pages)).commits, more: page < MAX_HISTORY_PAGE }
+        : { all: true, ...await repositoryAllHistory(repo, token, heads!.value, pages), ...retryIn > 0 ? { retryIn } : {} }
+    } else {
+      const commit = await reader.commit(ref)
+      // The branches and tags naming commits: with a token, every branch All
+      // branches reads and the latest tags, kept for both; without, GitHub's
+      // first page of each.
+      const naming = () => token
+        ? keptAnswer<AllHeads>(deps, `${repoId}\0heads`, () => repositoryAllHeads(repo, token)).then(({ value }) => ({
+          branches: value.heads.map(({ name, sha }) => ({ name, sha })), tags: value.tags }))
+        : keptAnswer(deps, `${repoId}\0refs`, () => repositoryRefTips(repo, token)).then(answer => answer.value)
+      const tips = page === 1 ? naming() : null
+      // A whole repository's from its commit, or on from those `from` names
+      // (a page by its number where none are, as GitHub lists them); a
+      // directory's by its number.
+      const history = path !== '' || (page > 1 && !starts) ? repositoryHistory(repo, token, commit, path, page)
+        : historyFrom(repo, token, starts ?? [commit], pages).then(read => ({ commits: read.commits, more: (starts !== null || read.more) && page < MAX_HISTORY_PAGE }))
+      const [read, named] = await Promise.all([history, tips])
+      body = { commit, path, page, ...read, ...named }
+    }
+    // The pull requests squashed into a whole repository's commits, drawn as
+    // the merges they were, and on its first page the open ones' heads,
+    // naming commits: with a token, as far as GitHub answers them, the
+    // history sent all the same where it doesn't.
+    const listed = (body as { commits: HistoryCommit[] }).commits
+    const quiet = <T>(fallback: T) => (err: unknown) => {
+      if (deps.config.debug) console.warn('managed: history pull requests read failed:', err)
+      return fallback
+    }
+    const [pulls, openPulls] = token && path === '' ? await Promise.all([
+      squashedPulls(repo, token, listed, historySquashes(deps, repoId)).catch(quiet<SquashedPull[]>([])),
+      page === 1 ? keptAnswer(deps, `${repoId}\0openPulls`, () => openPullHeads(repo, token), undefined, fresh).then(answer => answer.value.pulls, quiet(null)) : null,
+    ]) : [[], null]
+    await reader.recheckAccess()
+    const current = await authorize()
+    if (!current) return
+    if (!sameRepository(current.repo, access.repo)) { sendJson(res, 409, { error: 'repository-changed' }); return }
+    // Each commit as the tab draws it, its co-authors with it: what Pulse
+    // counts of it (its lines, its author's time) not sent.
+    const shown = ({ sha, parents, subject, authorName, authorLogin, authorId, coauthors, committedAt }: HistoryCommit) =>
+      ({ sha, parents, subject, authorName, authorLogin, authorId: authorId ?? null, coauthors: coauthors ?? [], committedAt })
+    sendJson(res, 200, await withAppUsers(deps.db, { ...body, commits: listed.map(shown),
+      ...pulls.length > 0 ? { pulls: pulls.map(pull => ({ ...pull, commits: pull.commits.map(shown) })) } : {}, ...openPulls?.length ? { openPulls } : {} }))
+  } catch (err) {
+    if (err instanceof GithubApiError) { sendGithubError(res, err); return }
+    throw err
+  }
+}
+
+// GET /api/admin/repositories/changes: the files each commit `shas` names
+// changes, as the code viewer's Replay plays them (repository-changes.ts),
+// within `path`, each commit's kept whole by the commit (historyChanges);
+// read as Replay's reads are (readForReplay).
+async function handleRepositoryChanges(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams): Promise<void> {
+  const shas = changesAsked(query.get('shas'))
+  if (!shas) { sendJson(res, 400, { error: 'bad-request' }); return }
+  await readForReplay(res, deps, cookie, query, async (fullName, token, repoId, path) => {
+    const changes = await repositoryChanges(fullName, token, shas, historyChanges(deps, repoId))
+    return { path, changes: [...changes].map(([sha, read]) => read ? { sha, ...changesWithin(read, path) } : { sha, files: null, more: false }) }
+  })
+}
+
+// GET /api/admin/repositories/tree: the files commit `commit` holds within
+// `path` and their bytes (`sizes`), which Replay starts from and the Treemap
+// of a directory too large to open draws (repository-changes.ts
+// directoryFiles: the directory's own tree where the commit's is cut short),
+// kept whole by the commit and the rules it is read by (historyTreeStore,
+// TREES_READ); none (null) for one GitHub has none of. Read as Replay's
+// reads are (readForReplay).
+async function handleRepositoryTree(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams): Promise<void> {
+  const commit = query.get('commit') ?? ''
+  if (!/^[a-f\d]{40}$/u.test(commit)) { sendJson(res, 400, { error: 'bad-request' }); return }
+  const store = historyTreeStore<CommitTree>(deps.db, deps.config.debug)
+  await readForReplay(res, deps, cookie, query, async (fullName, token, repoId, path) => {
+    const kept = { read: async (sha: string) => {
+      const value = (await store.read(`${repoId}\0${TREES_READ}\0${sha}`))?.value
+      return value && Array.isArray(value.files) && Array.isArray(value.sizes) && value.sizes.length === value.files.length ? value : null
+    }, write: (sha: string, tree: CommitTree) => store.write(`${repoId}\0${TREES_READ}\0${sha}`, tree, Date.now()) }
+    const tree = await directoryFiles(fullName, token, commit, path, kept)
+    return { commit, path, ...tree ?? { files: null, sizes: null, cut: false } }
+  })
+}
+
+// What Replay reads of repository `repoId` within `path` (`read`, with its
+// name and the reader's token), as the history is read: with the reader's
+// own GitHub access, within their grants as the code is, a directory they
+// reach all of, and sent once access is checked again.
+async function readForReplay(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams,
+  read: (fullName: string, token: string | null, repoId: number, path: string) => Promise<object>): Promise<void> {
+  const asked = repositoryQuery(res, query)
+  if (!asked) return
+  const { repoId, path } = asked
+  const authorize = async () => {
+    const access = await authorizeRepository(res, deps, cookie, repoId, path)
+    if (access && access.virtualEntries !== null) { sendJson(res, 404, { error: 'no-directory' }); return null }
+    return access
+  }
+  const access = await authorize()
+  if (!access) return
+  try {
+    const reader = await createRepositoryBrowser(deps.config, await repositoryBrowserUser(deps, access.user.id)).reader(access.repo)
+    const body = await read(access.repo.fullName, reader.readToken(), repoId, path)
+    await reader.recheckAccess()
+    const current = await authorize()
+    if (!current) return
+    if (!sameRepository(current.repo, access.repo)) { sendJson(res, 409, { error: 'repository-changed' }); return }
+    sendJson(res, 200, body)
+  } catch (err) {
+    if (err instanceof GithubApiError) { sendGithubError(res, err); return }
+    throw err
+  }
+}
+
+// The files repository `repoId`'s commits change, kept by each commit
+// (historyChangeStore, repository-changes.ts repositoryChanges).
+function historyChanges(deps: ManagedHttpDeps, repoId: number): ChangesStore {
+  const store = historyChangeStore<CommitChanges>(deps.db, deps.config.debug)
+  const keyOf = (sha: string) => `${repoId}\0${sha}`
+  return {
+    async read(shas) {
+      const kept = await store.readMany(shas.map(keyOf))
+      return new Map(shas.flatMap(sha => {
+        const value = kept.get(keyOf(sha))?.value
+        return value && Array.isArray(value.files) ? [[sha, value] as const] : []
+      }))
+    },
+    write: (sha, changes) => store.write(keyOf(sha), changes, Date.now()),
+  }
+}
+
+// How long what readWholeRepository read is answered as kept, unread again;
+// and how long one read is answered as kept even where it is asked for afresh.
+const REPOSITORY_READ_FRESH_MS = 2 * 60_000
+const REPOSITORY_READ_FLOOR_MS = 10_000
+// The repositories' reads being read again, behind a kept answer or as asked
+// for afresh, by key: one at a time, those asking meanwhile answered by it.
+const repositoryRereads = new Map<string, Promise<unknown>>()
+// A read GitHub refused, not failed: its credential or the GitHub App's
+// permission for it withdrawn (Issues, Pull requests, Checks), the
+// repository or what was asked of it gone. What was kept of it goes too.
+const refusedRead = (err: unknown) => err instanceof GithubApiError
+  && (err.status === 401 || err.status === 403 || err.status === 404 || err.message === 'github-status-403')
+
+// What `read` answers of a repository, kept by `key` (its id first) for every
+// reader (repositoryReadStore), each one's access checked as they ask before
+// this: answered as kept for REPOSITORY_READ_FRESH_MS, then, while it is
+// kept, answered at once and read again behind it for the next to ask, where
+// the instance outlives its answer (not serverless, where it is read again
+// before it is answered); `kept` where it was, or where reading it again
+// failed as `keepThrough` lets it. One asked for afresh (`fresh`) is read
+// now, unless it was read REPOSITORY_READ_FLOOR_MS since, what was kept
+// answered where that read fails. One GitHub refuses to read again is no
+// longer kept: the next to ask is refused as GitHub refused it. `at` is when
+// what it answers was read.
+async function keptAnswer<T extends object>(deps: ManagedHttpDeps, key: string, read: () => Promise<T>,
+  keepThrough: (err: unknown) => boolean = () => false, fresh = false): Promise<{ value: T; kept: boolean; at: number }> {
+  const store = repositoryReadStore(deps.db, deps.config.debug)
+  // One kept longer than a day, not yet removed (pruneKept removes them as
+  // others are written), is none.
+  const stored = await store.read(key)
+  const held = stored && Date.now() - stored.at < REPOSITORY_READ_KEPT_MS ? stored : null
+  // Read, and kept as read when it was, which it is said read at.
+  const readKept = async () => {
+    try {
+      const value = await read()
+      const at = Date.now()
+      await store.write(key, value, at)
+      return { value, at }
+    } catch (err) {
+      if (refusedRead(err)) await store.remove(key)
+      throw err
+    }
+  }
+  const reread = () => {
+    let reading = repositoryRereads.get(key)
+    if (!reading) {
+      reading = readKept().finally(() => repositoryRereads.delete(key))
+      repositoryRereads.set(key, reading)
+    }
+    return reading as Promise<{ value: T; at: number }>
+  }
+  const age = held ? Date.now() - held.at : Infinity
+  const now = fresh && age >= REPOSITORY_READ_FLOOR_MS
+  if (held && !now && (age < REPOSITORY_READ_FRESH_MS || !deps.config.serverless)) {
+    if (age >= REPOSITORY_READ_FRESH_MS && !repositoryRereads.has(key)) {
+      // Its failure leaves the kept answer sent until it is a day old, so it is said.
+      deps.track(reread().catch((err: unknown) => { console.warn('managed: repository read failed:', err) }))
+    }
+    return { value: held.value as T, kept: true, at: held.at }
+  }
+  try {
+    return { ...now ? await reread() : await readKept(), kept: false }
+  } catch (err) {
+    if (held && ((now && !refusedRead(err)) || keepThrough(err))) return { value: held.value as T, kept: true, at: held.at }
     throw err
   }
 }
 
+// The pages of repository `repoId`'s history kept (historyPageStore), each by
+// the commit it starts at (repository-history.ts historyFrom) and the rules
+// its co-authors were read by (commit-coauthors.ts COAUTHORS_READ), those
+// telling each commit's co-authors (kept since they are read), and with
+// `graphql`, only those read with GraphQL, telling its lines and the accounts
+// its co-authors' addresses are (a page GitHub's REST API listed tells
+// neither); the rest read again.
+function historyPages(deps: ManagedHttpDeps, repoId: number, graphql = false): HistoryPages {
+  const store = historyPageStore<HistoryCommit[]>(deps.db, deps.config.debug)
+  const keyOf = (top: string) => `${repoId}\0${COAUTHORS_READ}\0${top}`
+  return {
+    async read(tops) {
+      const kept = await store.readMany(tops.map(keyOf))
+      return new Map(tops.flatMap(top => {
+        const page = kept.get(keyOf(top))?.value
+        return Array.isArray(page) && page.every(commit => Array.isArray(commit.coauthors)) && (!graphql || page.every(commit => commit.additions != null))
+          ? [[top, page] as const] : []
+      }))
+    },
+    write: (top, commits) => store.write(keyOf(top), commits, Date.now()),
+  }
+}
+
+// The pull requests squashed into repository `repoId`'s commits, kept by
+// each commit and the rules their commits' co-authors were read by
+// (COAUTHORS_READ), null for one none was (repository-history.ts
+// squashedPulls); one kept before its commits' co-authors were read, read
+// again.
+function historySquashes(deps: ManagedHttpDeps, repoId: number): Squashes {
+  const store = historySquashStore<SquashedPull | null>(deps.db, deps.config.debug)
+  const keyOf = (sha: string) => `${repoId}\0${COAUTHORS_READ}\0${sha}`
+  return {
+    async read(shas) {
+      const kept = await store.readMany(shas.map(keyOf))
+      return new Map(shas.flatMap(sha => {
+        const entry = kept.get(keyOf(sha))
+        return entry && (entry.value === null || (Array.isArray(entry.value.commits) && entry.value.commits.every(commit => Array.isArray(commit.coauthors))))
+          ? [[sha, entry.value] as const] : []
+      }))
+    },
+    write: (sha, pull) => store.write(keyOf(sha), pull, Date.now()),
+  }
+}
+
+// What the whole of repository `repoId` gives in GraphQL (`read`, with its
+// name and a token), read as browsing is, with the reader's own GitHub
+// access: only by a reader whose grants reach all of it, with a token, and
+// sent once access is checked again after it is read; what `key` names kept
+// (keptAnswer), sent as kept, its reader's access checked as they ask; with
+// `readAt`, when it was read from GitHub, one kept as old as it was kept, so
+// that a reader holding two reads of the same can tell the later.
+async function readWholeRepository(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, repoId: number,
+  read: (fullName: string, token: string) => Promise<object>, key: string | null = null, readAt = false): Promise<void> {
+  await answerWholeRepository(res, deps, cookie, repoId, async (fullName, token) => {
+    const { value, kept, at } = key === null ? { value: await read(fullName, token), kept: false, at: Date.now() }
+      : await keptAnswer(deps, `${repoId}\0${key}`, () => read(fullName, token))
+    return { value: readAt ? { ...value, readAt: at } : value, kept }
+  })
+}
+
+// What `answer` gives of the whole of repository `repoId` (with its name and
+// a token), as readWholeRepository reads it: sent at once where it was kept,
+// else once access is checked again, with the app's users it names
+// (github-users.ts), never kept with it.
+async function answerWholeRepository(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, repoId: number,
+  answer: (fullName: string, token: string, user: StoredUser) => Promise<{ value: object; kept: boolean }>): Promise<void> {
+  const authorize = async () => {
+    const access = await authorizeRepository(res, deps, cookie, repoId, '')
+    if (access && access.virtualEntries !== null) { sendJson(res, 404, { error: 'no-directory' }); return null }
+    return access
+  }
+  const access = await authorize()
+  if (!access) return
+  try {
+    const reader = await createRepositoryBrowser(deps.config, await repositoryBrowserUser(deps, access.user.id)).reader(access.repo)
+    const token = reader.readToken()
+    if (!token) { sendJson(res, 403, { error: 'github-token-required' }); return }
+    const answered = await answer(access.repo.fullName, token, access.user)
+    if (answered.kept) { sendJson(res, 200, await withAppUsers(deps.db, answered.value)); return }
+    await reader.recheckAccess()
+    const current = await authorize()
+    if (!current) return
+    if (!sameRepository(current.repo, access.repo)) { sendJson(res, 409, { error: 'repository-changed' }); return }
+    sendJson(res, 200, await withAppUsers(deps.db, answered.value))
+  } catch (err) {
+    if (err instanceof GithubApiError) { sendGithubError(res, err); return }
+    throw err
+  }
+}
+
+// GET /api/admin/repositories/issues: what the code viewer's Issues and Pull
+// requests tabs show (repository-issues.ts): `kind`'s open or closed
+// (`state`), a page at a time, on from the cursor `after` names. They are
+// the whole repository's (readWholeRepository).
+async function handleRepositoryIssues(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams): Promise<void> {
+  const repoId = Number(query.get('repoId'))
+  const kind = query.get('kind')
+  const state = query.get('state') ?? 'open'
+  const after = query.get('after')
+  if (!Number.isSafeInteger(repoId) || repoId <= 0 || (kind !== 'issues' && kind !== 'pulls') || (state !== 'open' && state !== 'closed')
+    || (after !== null && !ISSUES_CURSOR.test(after))) { sendJson(res, 400, { error: 'bad-request' }); return }
+  await readWholeRepository(res, deps, cookie, repoId, async (fullName, token) => ({ kind, state, ...await repositoryIssues(fullName, token, kind, state, after) }),
+    `issues\0${ISSUES_READ_VERSION}\0${kind}\0${state}\0${after ?? ''}`, true)
+}
+
+// GET /api/admin/repositories/agents: what the code viewer's Agents tab
+// reconstructs agents' sessions from (repository-agents.ts): a page
+// of pull requests on from the cursor `pulls` names, and of the default
+// branch's commits on from `commits`, the first page, naming neither, with
+// issues and branches. They are the whole repository's (readWholeRepository).
+async function handleRepositoryAgents(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams): Promise<void> {
+  const repoId = Number(query.get('repoId'))
+  const cursors = { pulls: query.get('pulls'), commits: query.get('commits') }
+  if (!Number.isSafeInteger(repoId) || repoId <= 0 || (cursors.pulls !== null && !ISSUES_CURSOR.test(cursors.pulls))
+    || (cursors.commits !== null && !COMMITS_CURSOR.test(cursors.commits))) {
+    sendJson(res, 400, { error: 'bad-request' }); return
+  }
+  await readWholeRepository(res, deps, cookie, repoId, (fullName, token) => repositoryAgents(fullName, token, cursors),
+    `agents\0${AGENTS_READ_VERSION}\0${cursors.pulls ?? ''}\0${cursors.commits ?? ''}`)
+}
+
+// GET /api/admin/repositories/item: the issue or pull request numbered
+// `number`, as the code viewer's popup for it shows it (repository-issues.ts
+// repositoryItem). It is the whole repository's (readWholeRepository).
+async function handleRepositoryItem(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams): Promise<void> {
+  const repoId = Number(query.get('repoId'))
+  const number = itemNumber(query)
+  if (!Number.isSafeInteger(repoId) || repoId <= 0 || number === null) { sendJson(res, 400, { error: 'bad-request' }); return }
+  await readWholeRepository(res, deps, cookie, repoId, (fullName, token) => repositoryItem(fullName, token, number), `item\0${ISSUES_READ_VERSION}\0${number}`, true)
+}
+
+// The issue's or pull request's number a request names, as GraphQL takes one
+// (an Int, at most 2³¹ − 1); null for none.
+function itemNumber(query: URLSearchParams): number | null {
+  const number = Number(query.get('number'))
+  return /^[1-9]\d{0,9}$/u.test(query.get('number') ?? '') && number <= 2 ** 31 - 1 ? number : null
+}
+
+// GET /api/admin/repositories/pull-dependencies: the package versions pull
+// request `number`'s lockfiles add (pull-dependencies.ts), what its base's and head's
+// commits tell kept by them (pullDependencyKept), its `number` with them.
+// They are the whole repository's (answerWholeRepository), kept by its number
+// as its popup's item is, its head moving with each push. With `review=1`,
+// as an open one's are asked, where the repository reviews dependencies,
+// each version's review (pull-dependency-reviews.ts), read afresh as each
+// asks, reviews being published meanwhile; its baseline kept, where the host
+// registered no reviewed dependencies, which are asked in its place.
+async function handleRepositoryPullDependencies(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams): Promise<void> {
+  const repoId = Number(query.get('repoId'))
+  const number = itemNumber(query)
+  const review = query.get('review') === '1'
+  if (!Number.isSafeInteger(repoId) || repoId <= 0 || number === null || !['1', null].includes(query.get('review'))) { sendJson(res, 400, { error: 'bad-request' }); return }
+  await answerWholeRepository(res, deps, cookie, repoId, async (fullName, token, user) => {
+    const answered = await keptAnswer(deps, `${repoId}\0pull-dependencies\0${PULL_DEPENDENCIES_READ}\0${number}`,
+      async () => ({ number, ...await pullDependencies(fullName, token, number, pullDependencyKept(deps, repoId)) }))
+    // Where its review is on, those of lockfiles it leaves out told to none,
+    // whoever asks.
+    const setting = (await deps.db.listRepoDependencyReviews()).get(repoId)
+    const held = setting?.enabled ? heldDependencies(answered.value, setting.lockfiles) : answered.value
+    const now = review ? await deps.db.repoDependencyReviewState(repoId, user.id, reviewedPackages(held)) : null
+    // Its review by the lockfiles they were told by, though they have changed
+    // since; turned off meanwhile, all of them, as where it is off.
+    const state = now && setting?.enabled ? { ...now, lockfiles: setting.lockfiles } : now
+    const told = review && !now && setting?.enabled && !(await deps.db.listRepoDependencyReviews()).get(repoId)?.enabled ? answered.value : held
+    const reviewed = deps.reviewedDependencies ?? null
+    const { baseline, unread, error } = state && !reviewed ? await baselineFor(fullName, token, repoId, state, baselineKept(deps)) : { baseline: null, unread: [], error: null }
+    // Its comments read for reviews, where the host reads them, while it is
+    // open (pull-comment-reviews.ts reads whether it is with them).
+    const parse = reviewed?.parseComments
+    const comments = state && parse ? commentReviews({ fullName, number, token, parse, reviewers: accounts => repoReviewers(deps, repoId, accounts) }) : null
+    // The comment the host formats of the reader's reviews of its versions, for its copy button.
+    const formatted = await formattedPull(reviewed, deps.db, user.id, told, state, { repository: fullName, number })
+    return { value: { number: told.number, ...await reviewedDependencies(told, state, { baseline, baselineUnread: unread, baselineError: error, reviewed, commentReviews: comments }),
+      ...formatted ? { formatted } : {} }, kept: answered.kept }
+  })
+}
+
+// GET /api/admin/repositories/branch-dependencies: what the lockfiles of the
+// repository's default branch lock that wants review, where its review is in
+// effect for the reader (`review`, else none), as a team's Dependencies tab
+// shows it: its head, as its pulse reads it, kept a while; every lockfile
+// there its review holds to (lockfile-scope.ts, commit-lockfiles.ts) as one
+// directory, its versions as a pull request's others are
+// (pull-dependency-reviews.ts), each left unread a directory of its own
+// failing the review, as a pull request's are.
+async function handleRepositoryBranchDependencies(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams): Promise<void> {
+  const repoId = Number(query.get('repoId'))
+  if (!Number.isSafeInteger(repoId) || repoId <= 0) { sendJson(res, 400, { error: 'bad-request' }); return }
+  await answerWholeRepository(res, deps, cookie, repoId, async (fullName, token, user) => {
+    const head = (await keptAnswer(deps, `${repoId}\0pulse-head`, async () => ({ sha: await defaultHead(fullName, token) }))).value.sha
+    if (!head) return { value: { head: null, review: null }, kept: false }
+    // Those its review holds to alone read, as many as are read of them.
+    const setting = (await deps.db.listRepoDependencyReviews()).get(repoId)
+    if (!setting?.enabled) return { value: { head, review: null }, kept: false }
+    const read = await lockedAt(fullName, token, head, path => heldTo(setting.lockfiles, path))
+    const { packages, paths } = lockedIn(read)
+    const told = { base: head, head, cut: false, lockfiles: [{ paths, added: [], more: 0, locked: packages.slice(0, MAX_LOCKED), moreLocked: Math.max(0, packages.length - MAX_LOCKED) },
+      ...read.unread.map(path => ({ paths: [path], error: lockfileFormat(path) === 'bun' ? 'lockfile-unsupported' : 'lockfile-unreadable' }))] }
+    const now = await deps.db.repoDependencyReviewState(repoId, user.id, reviewedPackages(told))
+    if (!now) return { value: { head, review: null }, kept: false }
+    // Told by the lockfiles it held to as they were read, though they have
+    // changed since.
+    const state = { ...now, lockfiles: setting.lockfiles }
+    const reviewed = deps.reviewedDependencies ?? null
+    const { baseline, unread: baselineUnread, error } = reviewed ? { baseline: null, unread: [], error: null } : await baselineFor(fullName, token, repoId, state, baselineKept(deps))
+    return { value: await reviewedDependencies(told, state, { baseline, baselineUnread, baselineError: error, reviewed }), kept: false }
+  })
+}
+
+// GET /api/admin/repositories/lockfiles: the lockfiles of the repository's
+// default branch its dependency review reads (commit-lockfiles.ts), by their
+// paths, with their formats, at its head, as its pulse reads it, for its
+// settings to name those it holds to (lockfile-scope.ts).
+async function handleRepositoryLockfiles(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams): Promise<void> {
+  const repoId = Number(query.get('repoId'))
+  if (!Number.isSafeInteger(repoId) || repoId <= 0) { sendJson(res, 400, { error: 'bad-request' }); return }
+  await answerWholeRepository(res, deps, cookie, repoId, async (fullName, token) => {
+    const head = (await keptAnswer(deps, `${repoId}\0pulse-head`, async () => ({ sha: await defaultHead(fullName, token) }))).value.sha
+    return { value: { head, lockfiles: head ? (await lockfilesAt(fullName, token, head)).map(({ path, format }) => ({ path, format })) : [] }, kept: false }
+  })
+}
+
+// The app's users `accounts` are, by their logins in lower case, of those
+// who publish reviews to a team counting for repository `repoId`.
+async function repoReviewers(deps: ManagedHttpDeps, repoId: number, accounts: { login: string; githubId: number | null }[]) {
+  const users = await deps.db.listUsersByAccount(accounts)
+  const counted = await deps.db.listRepoReviewers(repoId, [...new Set(Object.values(users).map(user => user.id))])
+  return new Map(Object.entries(users).flatMap(([login, user]) => counted.has(user.id) ? [[login.toLowerCase(), user.id] as const] : []))
+}
+
+// The versions repository lockfiles locked at the commits their dependencies
+// are reviewed since, kept by each (reviewBaselineStore).
+function baselineKept(deps: ManagedHttpDeps): ReviewBaselineStore {
+  const store = reviewBaselineStore(deps.db, deps.config.debug)
+  return {
+    async read(key) {
+      const value = (await store.read(key))?.value
+      const strings = (list: unknown) => Array.isArray(list) && list.every(item => typeof item === 'string')
+      return strings(value?.versions) && strings(value?.unread) ? value : null
+    },
+    write: (key, baseline) => store.write(key, baseline, Date.now()),
+  }
+}
+
+// What repository `repoId`'s pull requests' lockfiles add, kept by the
+// commits of each's base and head and the rules they were told by
+// (PULL_DEPENDENCIES_READ, pullDependencyStore).
+function pullDependencyKept(deps: ManagedHttpDeps, repoId: number): PullDependencyStore {
+  const store = pullDependencyStore<PullDependencies>(deps.db, deps.config.debug)
+  const keyOf = (commits: string) => `${repoId}\0${PULL_DEPENDENCIES_READ}\0${commits}`
+  return {
+    async read(commits) {
+      const value = (await store.read(keyOf(commits)))?.value
+      return value && Array.isArray(value.lockfiles) ? value : null
+    },
+    write: (commits, told) => store.write(keyOf(commits), told, Date.now()),
+  }
+}
+
+// GET /api/admin/repositories/pulse: what the code viewer's Pulse tab shows
+// (repository-pulse.ts): the default branch's year, counted from its commits
+// (pulseCommits), and the pull requests and issues of the last `weeks`
+// weeks, each kept apart. A year not read whole yet answers how many of its
+// commits are (`reading`), or of the pull requests merged in it (`pulls`);
+// one GitHub's statistics count, while it is still computing them,
+// `pending`, for the client to ask again. They are the whole repository's
+// (readWholeRepository).
+async function handleRepositoryPulse(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams): Promise<void> {
+  const repoId = Number(query.get('repoId'))
+  const weeks = Number(query.get('weeks') ?? '4')
+  if (!Number.isSafeInteger(repoId) || repoId <= 0 || !PULSE_WEEKS.includes(weeks)) { sendJson(res, 400, { error: 'bad-request' }); return }
+  await answerWholeRepository(res, deps, cookie, repoId, async (fullName, token) => {
+    const [period, year] = await Promise.all([
+      keptAnswer(deps, `${repoId}\0pulse\0${weeks}`, () => repositoryActivity(fullName, token, weeks)),
+      pulseCommits(deps, repoId, fullName, token),
+    ])
+    return { value: { weeks, ...period.value, stats: year.stats && periodStats(year.stats, weeks), reading: year.reading, pulls: year.pulls,
+      pending: year.pending }, kept: period.kept && year.kept }
+  })
+}
+
+// The default branch's year (repository-pulse.ts commitStats), counted from
+// its commits as the Commits tab keeps them, with their lines
+// (yearCommits): kept by the head it was read from (repositoryReadStore),
+// that head kept as an issue's page is; its commits merged from an agent's
+// pull request told by those merged (agentMerges), kept as read, the rest
+// read on by the next answer as the year's commits are, and read again as
+// an answer kept is, a label changing whose a pull request is without
+// moving the head, the year counted again where what they bring changed.
+// A year not read whole yet is how many of its commits are (`reading`), or
+// of the pull requests merged (`pulls`), beside the year last counted from
+// an earlier head over the same weeks, where one is kept, so that a head
+// moved on shows the year as it was till it is counted again; one past
+// YEAR_COMMITS is GitHub's statistics' (repositoryStats, repositoryLines),
+// kept together as an issue's page is and through GitHub computing them
+// again, `pending` while it first computes them, the year last counted
+// beside it so too.
+// A day as a pulse's items are narrowed by (YYYY-MM-DD, UTC), when it starts;
+// a GitHub login, as many of them as PULSE_AUTHORS.
+const PULSE_DAY = /^\d{4}-\d{2}-\d{2}$/u
+const GITHUB_LOGIN = /^[a-z\d](?:[a-z\d]|-(?=[a-z\d])){0,38}(?:\[bot\])?$/iu
+const PULSE_AUTHORS = 10
+const pulseDay = (value: string | null) => {
+  const at = value !== null && PULSE_DAY.test(value) ? Date.parse(`${value}T00:00:00Z`) : Number.NaN
+  return Number.isSafeInteger(at) ? at : null
+}
+
+// GET /api/admin/repositories/pulse/items: the Pulse tab's pull requests and
+// issues narrowed to a picked day or week (`from` to `to`, else on from
+// `from`) and the GitHub accounts a picked contributor committed as
+// (`authors`), as repositoryActivity reads them, kept apart for each.
+async function handleRepositoryPulseItems(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams): Promise<void> {
+  const repoId = Number(query.get('repoId'))
+  const weeks = Number(query.get('weeks') ?? '4')
+  const [from, to] = [pulseDay(query.get('from')), query.has('to') ? pulseDay(query.get('to')) : null]
+  const logins = (query.get('authors') ?? '').split(',').filter(Boolean)
+  // Each once, whatever its case, as GitHub matches logins.
+  const authors = [...new Set(logins.map(login => login.toLowerCase()))].toSorted()
+  if (!Number.isSafeInteger(repoId) || repoId <= 0 || !PULSE_WEEKS.includes(weeks) || from === null || (query.has('to') && (to === null || to < from))
+    || authors.length > PULSE_AUTHORS || !logins.every(login => GITHUB_LOGIN.test(login))) { sendJson(res, 400, { error: 'bad-request' }); return }
+  await answerWholeRepository(res, deps, cookie, repoId, async (fullName, token) => {
+    const narrowing = { from, to, authors }
+    const items = await keptAnswer(deps, `${repoId}\0pulse-items\0${weeks}\0${from}\0${to ?? ''}\0${narrowing.authors.join(',')}`,
+      () => repositoryActivity(fullName, token, weeks, Date.now(), globalThis.fetch, narrowing))
+    return { value: { weeks, ...items.value }, kept: items.kept }
+  })
+}
+
+async function pulseCommits(deps: ManagedHttpDeps, repoId: number, fullName: string, token: string) {
+  const first = pulseSince(52, Date.now())
+  const head = await keptAnswer(deps, `${repoId}\0pulse-head`, async () => ({ sha: await defaultHead(fullName, token) }))
+  if (!head.value.sha) return { stats: commitStats([], first), reading: null, pulls: null, pending: false, kept: head.kept }
+  const store = repositoryReadStore(deps.db, deps.config.debug)
+  const key = `${repoId}\0pulse-year\0${PULSE_YEAR_VERSION}\0${head.value.sha}\0${first}`
+  const lastKey = `${repoId}\0pulse-year-last`
+  const mergesKey = `${repoId}\0pulse-merges\0${PULSE_YEAR_VERSION}`
+  const last = async () => {
+    const kept = (await store.read(lastKey))?.value as { first: number; stats: PulseStats } | undefined
+    return kept?.first === first ? kept.stats : null
+  }
+  const sha = head.value.sha
+  // What tells whose the year's commits are, kept as read: the agents' pull
+  // requests merged (agentMerges), and the commits that release the
+  // repository (`releases`, release-commits.ts releaseCommits).
+  type Attribution = AgentMerges & { releases?: string[] }
+  const keptAttribution = async () => ((await store.read(mergesKey))?.value as Attribution | undefined) ?? null
+  const attribution = async (kept: Attribution | null): Promise<Attribution> => {
+    const [merges, releases] = await Promise.all([agentMerges(fullName, token, first, kept), releaseCommits(fullName, token, first, historyChanges(deps, repoId))])
+    return { ...merges, releases }
+  }
+  // The year counted from its `commits` as `read` tells whose they are and
+  // which were pushed directly, the branch followed through those it was
+  // read on past (`passed`, yearCommits) too; kept by its head and as the
+  // year last counted.
+  const count = async ({ commits, passed }: { commits: HistoryCommit[]; passed: HistoryCommit[] }, read: Attribution) => {
+    const walked = [...commits, ...passed]
+    const stats = commitStats(commits, first, agentCommits(read, walked), new Set(read.releases), directCommits(read, walked, sha))
+    await Promise.all([store.write(key, stats, Date.now()), store.write(lastKey, { first, stats }, Date.now())])
+    return stats
+  }
+  // A year kept by its head, what tells whose its commits are read again as
+  // an answer kept is (keptAnswer), a label or a tag changing it without
+  // moving the head: counted again from its pages kept where what agents'
+  // pull requests bring, or the releases, changed, or a read of the pull
+  // requests left unfinished is finished; the year as kept answered
+  // meanwhile, and where reading them fails.
+  const relabelled = async (stats: PulseStats) => {
+    const recounted: { stats?: PulseStats } = {}
+    await keptAnswer(deps, mergesKey, async () => {
+      const kept = await keptAttribution()
+      const read = await attribution(kept)
+      const same = kept && !kept.next && sameMerges(read, kept) && read.releases!.join() === (kept.releases ?? []).join()
+      if (read.next || same) return read
+      const year = await yearCommits(fullName, token, sha, first, historyPages(deps, repoId, true))
+      if (year.complete) recounted.stats = await count(year, read)
+      return read
+    }, () => true).catch((err: unknown) => { console.warn('managed: pulse attribution read failed:', err) })
+    return recounted.stats ?? stats
+  }
+  const held = (await store.read(key))?.value as PulseStats | { tooMany: true } | undefined
+  if (held && !('tooMany' in held)) return { stats: await relabelled(held), reading: null, pulls: null, pending: false, kept: head.kept }
+  if (!held) {
+    const year = await yearCommits(fullName, token, sha, first, historyPages(deps, repoId, true))
+    if (year.complete) {
+      const read = await attribution(await keptAttribution())
+      await store.write(mergesKey, read, Date.now())
+      if (read.next) return { stats: await last(), reading: null, pulls: read.next.read, pending: false, kept: false }
+      return { stats: await count(year, read), reading: null, pulls: null, pending: false, kept: false }
+    }
+    if (!year.tooMany) return { stats: await last(), reading: year.read, pulls: null, pending: false, kept: false }
+    await store.write(key, { tooMany: true }, Date.now())
+  }
+  // Its commits and lines read together, kept as one: never the one GitHub
+  // has counted since a push beside the other kept from before it.
+  const computing = (err: unknown) => err instanceof StatsPending
+  const counted = await keptAnswer(deps, `${repoId}\0pulse-stats`, async () => {
+    const [stats, lines] = await Promise.all([repositoryStats(fullName, token), repositoryLines(fullName, token, first)])
+    return withLines(stats, lines)
+  }, computing).catch((err: unknown) => { if (computing(err)) return null; throw err })
+  if (counted) return { stats: counted.value, reading: null, pulls: null, pending: false, kept: counted.kept }
+  return { stats: await last(), reading: null, pulls: null, pending: true, kept: false }
+}
+
 function prebuildBundle(deps: ManagedHttpDeps, id: string) {
   if (!deps.bundleCache || deps.config.serverless) return
   deps.track((async () => {
@@ -1399,9 +2369,13 @@ function scanProgress(deps: ManagedHttpDeps, key: string, scan: string | null) {
 // (repository-browser.ts), and that access checked again once it is read,
 // before any of it is told; packages as the npm viewer's admins read them, in
 // spare assessments (npm-risk.ts), trusted however new where a team lists
-// their scope, and each lockfile's asked of npm's advisories at once. The
-// reader leaving, losing their admin role or the server shutting down stops
-// it.
+// their scope, and each lockfile's asked of npm's advisories at once; each
+// repository's Dependabot alerts, open or dismissed, read with the App's
+// installation token where the admin's own access to it lets them see them on
+// GitHub (dependabot-access.ts); and its GitHub Actions, the references they
+// make resolved with the admin's own GitHub token (github-actions.ts). The
+// reader leaving, losing their admin role or
+// the server shutting down stops it.
 async function handleRepositoryRisk(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, query: URLSearchParams): Promise<void> {
   const s = await readAdminSession(res, deps, cookie)
   if (!s) return
@@ -1414,7 +2388,8 @@ async function handleRepositoryRisk(res: ServerResponse, deps: ManagedHttpDeps,
   const controller = new AbortController()
   res.on('close', () => { controller.abort() })
   res.setTimeout(REPO_RISK_IDLE_MS, () => res.destroy())
-  const browser = createRepositoryBrowser(deps.config, await repositoryBrowserUser(deps, s.user.id))
+  const user = await repositoryBrowserUser(deps, s.user.id)
+  const browser = createRepositoryBrowser(deps.config, user)
   const scopes = new Map<string, Promise<boolean>>()
   const teamScoped = (name: string) => {
     const scope = npmPackageScope(name)
@@ -1439,8 +2414,15 @@ async function handleRepositoryRisk(res: ServerResponse, deps: ManagedHttpDeps,
         lockfiles: async () => (await upstreamGithub(() => client.findRepoLockfiles({ repo: repo.fullName, sha: commit }))).lockfiles,
         file: path => upstreamGithub(() => client.getRepoFile({ repo: repo.fullName, path, ref: commit })),
         recheck: async () => { await reader.recheckAccess() },
+        // As GitHub has them now, where the admin's own access lets them see them.
+        dependabot: () => reader.dependabotAlerts(),
+        workflows: () => reader.directory(WORKFLOWS_DIR, commit).then(({ entries }) => entries.filter(entry => entry.type === 'file' && /\.ya?ml$/iu.test(entry.name)).map(entry => entry.path),
+          (error: unknown) => { if (error instanceof GithubApiError && error.status === 404) return []; throw error }),
       }
     },
+    actions: githubActionsSource(user.token),
+    actionFiles: scanReadStore(deps.db, 'action-files', SCAN_READ_KEPT_MS, deps.config.debug),
+    actionLines: scanReadStore(deps.db, 'actions', RISK_KEPT_MS, deps.config.debug),
     teamScoped,
     // Each package's downloads readied before it is assessed
     // (scan-downloads.ts), so that none waits on npm's downloads API; a
@@ -1515,18 +2497,25 @@ async function handleBundleCache(req: IncomingMessage, res: ServerResponse, deps
   await sendEncoded(req, res, cached, contentType, headers)
 }
 
+// Two bundles a reader asks about together, where they may read both, else
+// null, told as 401 or 404: asked before what is worked out of them and
+// again before it is sent.
+function bothBundles(res: ServerResponse, deps: ManagedHttpDeps, session: ManagedSession, id: string, otherId: string) {
+  return async () => {
+    const [base, other] = await Promise.all([id, otherId].map(bundle => deps.db.getBundleAccessSnapshot(session.id, Date.now(), bundle)))
+    if (!base || !other) { sendJson(res, 401, { error: 'unauthenticated' }); return null }
+    if (!base.bundle || !other.bundle) { sendJson(res, 404, { error: 'no-bundle' }); return null }
+    return [base.bundle, other.bundle] as const
+  }
+}
+
 // GET /api/bundles/:id/rename-diff: one of its JavaScript files diffed with
 // one of the `other` bundle's, both pretty-printed, renamed names hidden
 // (rename-diff.ts), for a reader of both, checked again once it is worked out.
 async function handleBundleRenameDiff(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, session: ManagedSession, id: string, params: URLSearchParams) {
   const otherId = params.get('other') ?? '', request = renameDiffRequest(params)
   if (!request || !/^[a-f\d-]{36}$/iu.test(otherId)) { sendJson(res, 400, { error: 'bad-file' }); return }
-  const readable = async () => {
-    const [base, other] = await Promise.all([id, otherId].map(bundle => deps.db.getBundleAccessSnapshot(session.id, Date.now(), bundle)))
-    if (!base || !other) { sendJson(res, 401, { error: 'unauthenticated' }); return null }
-    if (!base.bundle || !other.bundle) { sendJson(res, 404, { error: 'no-bundle' }); return null }
-    return [base.bundle, other.bundle] as const
-  }
+  const readable = bothBundles(res, deps, session, id, otherId)
   const records = await readable()
   if (!records) return
   const { prettyCache } = deps
@@ -1542,6 +2531,25 @@ async function handleBundleRenameDiff(req: IncomingMessage, res: ServerResponse,
   else diff.stream.destroy()
 }
 
+// GET /api/bundles/:id/comparison?other=: its files paired with the `other`
+// bundle's as Compare pairs them, with what its Overview reads beside them
+// (comparison.ts), within a reason `scope` where given; for a reader of
+// both, checked again once it is worked out.
+async function handleBundleComparison(req: IncomingMessage, res: ServerResponse, deps: ManagedHttpDeps, session: ManagedSession, id: string, params: URLSearchParams) {
+  const otherId = params.get('other') ?? ''
+  if (!/^[a-f\d-]{36}$/iu.test(otherId)) { sendJson(res, 400, { error: 'bad-bundle' }); return }
+  const readable = bothBundles(res, deps, session, id, otherId)
+  const records = await readable()
+  if (!records) return
+  const { prettyCache } = deps
+  if (!prettyCache) { sendJson(res, 503, { error: 'unavailable' }); return }
+  let body
+  try { body = await comparisonBody(await prettyCache.bundleDetails(records[0]), await prettyCache.bundleDetails(records[1]), params.get('scope') ?? '') }
+  catch (err) { sendJson(res, err instanceof PrettyError ? err.status : 422, { error: err instanceof PrettyError ? err.message : 'bundle-unavailable' }); return }
+  if (await readable()) await sendEncoded(req, res, body, 'application/json')
+  else body.stream.destroy()
+}
+
 // GET /api/bundles/:id/pretty?other=: the files that changed between it and
 // the `other` bundle, both sides' pretty-printed (pretty-print.ts compared), a
 // line each as it is found kept or formatted; GET
@@ -1898,7 +2906,7 @@ async function handleMyTeams(res: ServerResponse, deps: ManagedHttpDeps, session
   // The revision sent is the reloaded catalog's, so classify what changed now.
   const apps = await teamAppStates(deps.db, deps.reportStore, session.id, teams, classified)
   sendJson(res, 200, {
-    teams: teams.map(team => ({ ...team, app: apps.get(teamAppKey(team)) ?? null,
+    teams: teams.map(team => ({ ...withWorkspaceSummary(team, apps.get(teamAppKey(team))),
       bundles: team.bundles.map(bundle => ({ ...bundle, ...(summaries.get(bundle.integrity) ?? { summary: null, summaryRetryAt: null }),
         commitInfo: commits.commitInfo(bundle) })) })),
     revision,
@@ -2666,6 +3674,11 @@ function found<T>(value: T | null | undefined): T {
   return value
 }
 
+// Version documents a list of reviews reads at once: each holds a version
+// document's room in what npm's reads may hold at once (npm-packages.ts),
+// which refuses past thirty-two of them.
+const REVIEW_READS_AT_ONCE = 8
+
 // Lists must enforce the same target and base access as the review itself,
 // including permission changes while the registry requests are in flight.
 async function readableNpmReviews<T extends ReviewContext>(res: ServerResponse, deps: ManagedHttpDeps, cookie: string | undefined, user: string, reviews: T[]): Promise<T[] | null> {
@@ -2675,18 +3688,15 @@ async function readableNpmReviews<T extends ReviewContext>(res: ServerResponse,
   try {
     const reader = await npmReader(deps, cookie, reviews.flatMap(review => [review.package, ...review.basePackage ? [review.basePackage] : []]))
     if (!reader || reader.userId !== user) { sendJson(res, 401, { error: 'unauthenticated' }); return null }
-    const documents = new Map<string, Promise<NpmVersionDocument | null>>()
     // Public versions' documents as the viewer keeps them (npm-kept.ts), a
-    // day: a list asks npm for none it read within it.
+    // day: a list asks npm for none it read within it. Each version once, as
+    // many at once as REVIEW_READS_AT_ONCE.
     const kept = npmVersionStore(deps.db, deps.config.debug)
-    const read = (name: string, version: string) => {
-      const key = `${name}@${version}`
-      if (!documents.has(key)) documents.set(key, readNpmVersion(name, version, canReadPrivateNpm(reader, name), controller.signal, kept))
-      return documents.get(key)!
-    }
-    const packages = await Promise.all(reviews.map(review => Promise.all([
-      read(review.package, review.version), ...(review.basePackage ? [read(review.basePackage, review.baseVersion!)] : []),
-    ])))
+    const versionsOf = (review: T) => [[review.package, review.version], ...review.basePackage ? [[review.basePackage, review.baseVersion!]] : []] as [string, string][]
+    const asked = new Map(reviews.flatMap(versionsOf).map(([name, version]) => [`${name}\0${version}`, [name, version] as const]))
+    const read = await eachOf([...asked], REVIEW_READS_AT_ONCE, ([, [name, version]]) => readNpmVersion(name, version, canReadPrivateNpm(reader, name), controller.signal, kept))
+    const documents = new Map([...asked.keys()].map((key, at) => [key, read[at] ?? null]))
+    const packages = reviews.map(review => versionsOf(review).map(([name, version]) => documents.get(`${name}\0${version}`) ?? null))
     const current = await npmReader(deps, cookie, packages.flat().flatMap(doc => doc?.private ? [doc.name] : []))
     if (!current || current.userId !== user) { sendJson(res, 401, { error: 'unauthenticated' }); return null }
     return reviews.filter((_, index) => packages[index]!.every(doc => doc && (!doc.private || canReadPrivateNpm(current, doc.name))))
@@ -2835,7 +3845,7 @@ async function handleNpmReviews(req: IncomingMessage, res: ServerResponse, deps:
       const allBases = params.get('allBases') === 'true'
       const rows = await deps.db.listDependencyReviews(context, current.userId, allBases)
       const reviews = allBases ? await readableNpmReviews(res, deps, cookie, current.userId, rows) : rows
-      if (reviews) sendJson(res, 200, { reviews, teams: await deps.db.listDependencyReviewTeams(current.userId) })
+      if (reviews) sendJson(res, 200, { reviews: await withFormatted(deps.reviewedDependencies ?? null, current.userId, reviews), teams: await deps.db.listDependencyReviewTeams(current.userId) })
       return
     }
     const checked = await checkMutation(req, res, deps, cookie)
@@ -2845,7 +3855,7 @@ async function handleNpmReviews(req: IncomingMessage, res: ServerResponse, deps:
       sendJson(res, 400, { error: limit === 'reject' ? 'review-malware' : 'review-critical-vulnerability' }); return
     }
     const review = await deps.db.changeDependencyReview(context, checked.session.id, change, Date.now())
-    sendJson(res, 200, { review })
+    sendJson(res, 200, { review: (await withFormatted(deps.reviewedDependencies ?? null, current.userId, [review]))[0] })
   } catch (err) {
     if (controller.signal.aborted) return
     if (err instanceof NpmPackageError) { sendJson(res, err.status, { error: err.message }); return }
@@ -2854,7 +3864,7 @@ async function handleNpmReviews(req: IncomingMessage, res: ServerResponse, deps:
   } finally { res.off('close', onClose) }
 }
 
-// GET /api/npm/{package,versions,download,stats,advisories,tags,socket,provenance,pretty,rename-diff,type-only}. Only readers with private access
+// GET /api/npm/{package,versions,download,stats,advisories,tags,socket,provenance,pretty,rename-diff,type-only,risk,comparison}. Only readers with private access
 // (canReadPrivateNpm) can be answered from the server's npm token; the rest get
 // what the registry answers anonymously, every time (see npm-packages.ts).
 // Access is checked again after the registry's answer.
@@ -2864,14 +3874,17 @@ async function handleNpm(req: IncomingMessage, res: ServerResponse, deps: Manage
   // All but the package's own (its versions, figures and advisories) are a version's.
   const versioned = path !== NPM_VERSIONS_PATH && path !== NPM_STATS_PATH && path !== NPM_ADVISORIES_PATH
   const otherSpec = params.get('otherVersion') ?? ''
-  if (!isNpmPackageName(name) || (versioned && !isNpmPackageSpec(spec)) || ((path === NPM_RENAME_DIFF_PATH || path === NPM_TYPE_ONLY_PATH) && !isNpmPackageSpec(otherSpec))
+  // The package a comparison's other side is a version of, another where Review compares a dependency replaced.
+  const otherName = path === NPM_COMPARISON_PATH ? params.get('otherName') ?? name : name
+  if (!isNpmPackageName(name) || !isNpmPackageName(otherName) || (versioned && !isNpmPackageSpec(spec)) || ((path === NPM_RENAME_DIFF_PATH || path === NPM_TYPE_ONLY_PATH) && !isNpmPackageSpec(otherSpec))
     || (path === NPM_PRETTY_PATH && otherSpec !== '' && !isNpmPackageSpec(otherSpec))
-    || (path === NPM_RISK_PATH && otherSpec !== '' && otherSpec !== '(empty)' && !isNpmPackageSpec(otherSpec))) {
+    || (path === NPM_RISK_PATH && otherSpec !== '' && otherSpec !== '(empty)' && !isNpmPackageSpec(otherSpec))
+    || ((path === NPM_COMPARISON_PATH || path === NPM_DELTA_PATH) && otherSpec !== '(empty)' && !isNpmPackageSpec(otherSpec))) {
     sendJson(res, 400, { error: 'bad-package' }); return
   }
   const diffed = path === NPM_RENAME_DIFF_PATH && params.has('path') ? renameDiffRequest(params) : null
   if (path === NPM_RENAME_DIFF_PATH && params.has('path') && !diffed) { sendJson(res, 400, { error: 'bad-file' }); return }
-  const reader = await npmReader(deps, cookie, [name])
+  const reader = await npmReader(deps, cookie, otherName === name ? [name] : [name, otherName])
   if (reader == null) { sendJson(res, 401, { error: 'unauthenticated' }); return }
   const controller = new AbortController()
   const onClose = () => { if (!res.writableEnded) controller.abort() }
@@ -2970,6 +3983,42 @@ async function handleNpm(req: IncomingMessage, res: ServerResponse, deps: Manage
       return
     }
     if (path === NPM_PROVENANCE_PATH) { await reply(doc.private, { name, version: doc.version, provenance: await provenanceOf() }); return }
+    // The lines it changes against `otherVersion`, or `(empty)`, its whole
+    // package's, and those but for declaration files changed in types alone
+    // (npm-delta.ts), as a list of versions wanting reviews tells them.
+    if (path === NPM_DELTA_PATH) {
+      const old = otherSpec === '(empty)' ? null : found(await readNpmVersion(name, otherSpec, privileged, controller.signal, keptVersions))
+      res.setTimeout(NPM_RESPONSE_IDLE_MS, () => res.destroy())
+      const side = (version: NpmVersionDocument) => ({ integrity: version.dist.integrity, files: async () => {
+        const load = loadNpmFiles(version)
+        try { return await load.result } finally { load.release() }
+      } })
+      const delta = await npmDelta(old ? side(old) : null, side(doc), npmDeltaStore<NpmDelta>(deps.db, deps.config.debug))
+      await reply(doc.private || old?.private === true, { name, version: doc.version, otherVersion: old?.version ?? null, ...delta })
+      return
+    }
+    // Its files paired with those of `otherVersion` (of `otherName`, else the
+    // same package), as Compare and Review pair them, with what their
+    // Overview reads beside them (comparison.ts): the version shown against
+    // the one compared with, or `(empty)`, none, as Review reads a first
+    // version. Read of both, each package's access checked again once worked out.
+    if (path === NPM_COMPARISON_PATH) {
+      const old = otherSpec === '(empty)' ? null : found(await readNpmVersion(otherName, otherSpec, canReadPrivateNpm(reader, otherName), controller.signal, keptVersions))
+      res.setTimeout(NPM_RESPONSE_IDLE_MS, () => res.destroy())
+      const loads = [doc, ...old ? [old] : []].map(loadNpmFiles)
+      let body
+      try {
+        const [files, oldFiles] = await Promise.all(loads.map(load => load.result))
+        body = await comparisonBody(old ? npmComparedSide(old.dist.integrity, oldFiles!) : emptySide(), npmComparedSide(doc.dist.integrity, files!))
+      } finally { for (const load of loads) load.release() }
+      const current = await npmReader(deps, cookie, otherName === name ? [name] : [name, otherName])
+      if (current == null) { body.stream.destroy(); sendJson(res, 401, { error: 'unauthenticated' }); return }
+      if ((doc.private && !canReadPrivateNpm(current, name)) || (old?.private && !canReadPrivateNpm(current, otherName))) {
+        body.stream.destroy(); sendJson(res, 404, { error: 'package-not-found' }); return
+      }
+      if (!res.destroyed) await sendEncoded(req, res, body, 'application/json')
+      return
+    }
     // Every one of its files that needs it pretty-printed (pretty-print.ts
     // npmAll), or, against another version, the files that changed between
     // them, both sides' (compared), a line each as it is formatted, or found
@@ -3110,13 +4159,16 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
     }
 
     // Public mode probe — lets a client detect the managed protocol up front.
+    // It also sends the session, sparing the client's GET /api/auth/session;
+    // a failed read leaves that request to the client, never failing the probe.
     if (path === CONFIG_PATH) {
       if (method !== 'GET') { send405(res, 'GET'); return }
       const info = deps.serverInfo ?? { mode: 'managed', managed: { loginPath: LOGIN_PATH, cookieName: config.sessionCookieName } }
+      const current = await currentSession(config, db, cookie).catch((err) => { console.warn('managed: config session read failed:', err); return null })
       sendJson(res, 200, { ...info, ...(config.githubNewIssueLabels ? { githubNewIssueLabels: config.githubNewIssueLabels } : {}),
         managed: { ...info.managed, ...(config.allowShare ? { allowShare: true } : {}), ...(deps.uploadStore ? {
           uploadChunkBytes: UPLOAD_CHUNK_BYTES, uploadMaxBytes: { reports: config.maxReportBytes, bundles: config.maxBundleBytes },
-        } : {}) } })
+        } : {}) }, ...(current ? { session: current.body } : {}) }, current?.headers)
       return
     }
     if (viewing && underPrefix(path, VIEW_PREFIXES) && !viewAllows(method, path)) { sendViewOnly(res); return }
@@ -3132,6 +4184,15 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
     if (path === CALLBACK_PATH) {
       if (method !== 'GET') { send405(res, 'GET'); return }
       try {
+        if (isLinkOAuthCallback(config, url.searchParams, cookie)) {
+          if (viewing) { sendViewOnly(res); return }
+          const s = await readWorkspaceSession(res, deps, cookie)
+          if (!s) return
+          const result = await linkOAuthCallback(config, db, s.session, url.searchParams, cookie, { avatarStore })
+          if (result.linked != null) await activity(deps, s.user, 'access', `linked GitHub account @${result.linked}`)
+          res.writeHead(302, { location: result.location, 'set-cookie': result.setCookie, 'cache-control': 'no-store' })
+          res.end(); return
+        }
         if (isIssueOAuthCallback(config, url.searchParams, cookie)) {
           if (viewing) { sendViewOnly(res); return }
           const s = await readWorkspaceSession(res, deps, cookie)
@@ -3159,22 +4220,22 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
       res.writeHead(302, { location: result.location, 'set-cookie': result.setCookie, 'cache-control': 'no-store' })
       res.end(); return
     }
-    // Who am I? While an admin views as another user, that user, plus the
-    // admin as `viewer`. A view that has ended (with the admin's session or
-    // role, or the viewed account) is cleared, returning to the own session.
+    if (path === LINK_LOGIN_PATH) {
+      if (method !== 'GET') { send405(res, 'GET'); return }
+      const s = await readWorkspaceSession(res, deps, cookie)
+      if (!s) return
+      const result = linkLoginRedirect(config, s.session)
+      res.writeHead(302, { location: result.location, 'set-cookie': result.setCookie, 'cache-control': 'no-store' })
+      res.end(); return
+    }
+    if (path === PROFILE_PATH) { await handleProfile(req, res, deps, cookie); return }
+    const unlink = /^\/api\/auth\/profile\/accounts\/([a-f\d-]{36})$/iu.exec(path)
+    if (unlink) { await handleUnlinkAccount(req, res, deps, cookie, unlink[1]!); return }
     if (path === SESSION_PATH) {
       if (method !== 'GET') { send405(res, 'GET'); return }
-      const now = Date.now()
-      let s = await readSession(config, db, cookie, now)
-      const ended = s == null && viewing
-      if (ended) s = await readSession(config, db, cookie, now, { own: true })
-      const headers: Record<string, string> = ended ? { 'set-cookie': clearViewCookie(config) } : {}
-      if (s == null) { sendJson(res, 401, { error: 'unauthenticated' }, headers); return }
-      sendJson(res, 200, {
-        user: { id: s.user.id, login: s.user.login, name: s.user.name, role: s.user.role },
-        csrfToken: s.session.csrfToken,
-        ...(s.session.viewer ? { viewer: s.session.viewer } : {}),
-      }, headers)
+      const { body, headers } = await currentSession(config, db, cookie)
+      if (body == null) { sendJson(res, 401, { error: 'unauthenticated' }, headers); return }
+      sendJson(res, 200, body, headers)
       return
     }
     if (path === VIEW_AS_PATH) { await handleViewAs(req, res, deps, cookie); return }
@@ -3210,12 +4271,16 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
     if (path.startsWith('/api/admin/uploads/')) { await handleUploadPart(req, res, deps, cookie, path); return }
     // Cached avatar by user id, served same-origin (the page CSP forbids the
     // github CDN). The id in the path keys the browser cache per user, so a user
-    // switch never serves a stale avatar. Workspace access is required.
+    // switch never serves a stale avatar. Workspace access is required. A user's
+    // is that of the account chosen on their profile; `own` asks for the
+    // sign-in account's. A linked account's is served by its own id.
     if (path.startsWith(AVATAR_PREFIX)) {
       if (method !== 'GET') { send405(res, 'GET'); return }
       const s = await readSession(config, db, cookie, Date.now())
       if (s == null) { sendJson(res, 401, { error: 'unauthenticated' }); return }
-      await serveAvatar(res, avatarStore, path.slice(AVATAR_PREFIX.length))
+      const id = path.slice(AVATAR_PREFIX.length)
+      if (AGENT_AVATARS.has(id) && AGENT_AVATAR.test(id)) { await serveAgentAvatar(res, avatarStore, id); return }
+      await serveAvatar(res, avatarStore, id, url.searchParams.has('own') ? id : await db.getAvatarKey(id))
       return
     }
     // Admin: list users (admin-only).
@@ -3256,8 +4321,57 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
       if (method !== 'GET') { send405(res, 'GET'); return }
       await handleRepositoryBrowser(res, deps, cookie, url.searchParams, path === REPO_REFS_PATH); return
     }
+    if (path === REPO_CODE_PATH) {
+      if (method !== 'GET') { send405(res, 'GET'); return }
+      await handleRepositoryCode(res, deps, cookie, url.searchParams); return
+    }
+    if (path === REPO_HISTORY_PATH) {
+      if (method !== 'GET') { send405(res, 'GET'); return }
+      await handleRepositoryHistory(res, deps, cookie, url.searchParams); return
+    }
+    if (path === REPO_CHANGES_PATH) {
+      if (method !== 'GET') { send405(res, 'GET'); return }
+      await handleRepositoryChanges(res, deps, cookie, url.searchParams); return
+    }
+    if (path === REPO_TREE_PATH) {
+      if (method !== 'GET') { send405(res, 'GET'); return }
+      await handleRepositoryTree(res, deps, cookie, url.searchParams); return
+    }
+    if (path === REPO_ISSUES_PATH) {
+      if (method !== 'GET') { send405(res, 'GET'); return }
+      await handleRepositoryIssues(res, deps, cookie, url.searchParams); return
+    }
+    if (path === REPO_AGENTS_PATH) {
+      if (method !== 'GET') { send405(res, 'GET'); return }
+      await handleRepositoryAgents(res, deps, cookie, url.searchParams); return
+    }
+    if (path === REPO_ITEM_PATH) {
+      if (method !== 'GET') { send405(res, 'GET'); return }
+      await handleRepositoryItem(res, deps, cookie, url.searchParams); return
+    }
+    if (path === REPO_PULL_DEPENDENCIES_PATH) {
+      if (method !== 'GET') { send405(res, 'GET'); return }
+      await handleRepositoryPullDependencies(res, deps, cookie, url.searchParams); return
+    }
+    if (path === REPO_BRANCH_DEPENDENCIES_PATH) {
+      if (method !== 'GET') { send405(res, 'GET'); return }
+      await handleRepositoryBranchDependencies(res, deps, cookie, url.searchParams); return
+    }
+    if (path === REPO_LOCKFILES_PATH) {
+      if (method !== 'GET') { send405(res, 'GET'); return }
+      await handleRepositoryLockfiles(res, deps, cookie, url.searchParams); return
+    }
+    if (path === REPO_PULSE_PATH) {
+      if (method !== 'GET') { send405(res, 'GET'); return }
+      await handleRepositoryPulse(res, deps, cookie, url.searchParams); return
+    }
+    if (path === REPO_PULSE_ITEMS_PATH) {
+      if (method !== 'GET') { send405(res, 'GET'); return }
+      await handleRepositoryPulseItems(res, deps, cookie, url.searchParams); return
+    }
     if (path === ADMIN_REPOS_PATH) { await handleListRepositories(req, res, deps, cookie, repositoryDiscovery); return }
     if (path === SELECT_REPO_PATH) { await handleSelectRepository(req, res, deps, cookie); return }
+    if (path === REPO_DEPENDENCY_REVIEW_PATH) { await handleRepositoryDependencyReview(req, res, deps, cookie); return }
     if (path === ADD_PUBLIC_REPO_PATH) { await handleAddPublicRepository(req, res, deps, cookie); return }
     if (path === CONNECT_REPO_APP_PATH) { await handleConnectRepositoryApp(req, res, deps, cookie); return }
     // Reports: list / upload on the exact path, download / delete per-id on the
@@ -3302,9 +4416,13 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
       await handleBundleAdvisories(res, deps, workspaceSession!.session, bundleAdvisories[1]!, url.searchParams.get('team'), url.searchParams.get('reason') ?? '', url.searchParams.get('repoAdvisories') === 'true', url.searchParams.get('details') === 'true')
       return
     }
-    const bundleRead = /^\/api\/bundles\/([a-f\d-]{36})\/(metadata|contents|download|pretty|rename-diff|type-only)$/iu.exec(path)
+    const bundleRead = /^\/api\/bundles\/([a-f\d-]{36})\/(metadata|contents|download|pretty|rename-diff|type-only|comparison)$/iu.exec(path)
     if (bundleRead) {
       const id = bundleRead[1]!, part = bundleRead[2]!, { session } = workspaceSession!, { bundleCache, prettyCache } = deps
+      if (part === 'comparison') {
+        if (method !== 'GET') { send405(res, 'GET'); return }
+        await handleBundleComparison(req, res, deps, session, id, url.searchParams); return
+      }
       if (part === 'rename-diff' || part === 'type-only' || (part === 'pretty' && url.searchParams.has('other'))) {
         if (method !== 'GET') { send405(res, 'GET'); return }
         if (part === 'rename-diff' && url.searchParams.has('path')) { await handleBundleRenameDiff(req, res, deps, session, id, url.searchParams); return }
@@ -3445,7 +4563,7 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
       }
       const review = await deps.db.getLatestOwnDependencyReview(s.user.id, { ecosystem: 'npm', package: name, version, integrity })
       const visible = await readableNpmReviews(res, deps, cookie, s.user.id, review ? [review] : [])
-      if (visible) sendJson(res, 200, { review: visible[0] ?? null })
+      if (visible) sendJson(res, 200, { review: (await withFormatted(deps.reviewedDependencies ?? null, s.user.id, visible))[0] ?? null })
       return
     }
     if (path === '/api/npm/reviews/discard') {
@@ -3475,7 +4593,27 @@ export function createManagedRequestHandler(deps: ManagedHttpDeps): Handler {
       }
       const page = await deps.db.listOwnDependencyReviews(s.user.id, time !== null && id !== null ? { time: Number(time), id } : null)
       const reviews = await readableNpmReviews(res, deps, cookie, s.user.id, page.reviews)
-      if (reviews) sendJson(res, 200, { ...page, reviews })
+      if (reviews) sendJson(res, 200, { ...page, reviews: await withFormatted(deps.reviewedDependencies ?? null, s.user.id, reviews) })
+      return
+    }
+    // Those published to a team, of one who reads them there, as its
+    // Dependencies tab lists them, fifty a page.
+    if (path === '/api/npm/reviews/team') {
+      if (method !== 'GET') { send405(res, 'GET'); return }
+      const s = await readWorkspaceSession(res, deps, cookie)
+      if (!s) return
+      const id = url.searchParams.get('beforeId'), teamId = url.searchParams.get('teamId'), time = url.searchParams.get('beforeTime')
+      if (!teamId || teamId.length > 100) { sendJson(res, 400, { error: 'bad-team' }); return }
+      if ((time !== null || id !== null) && (time === null || !/^\d+$/u.test(time) || !Number.isSafeInteger(Number(time)) || !id || id.length > 100)) {
+        sendJson(res, 400, { error: 'bad-review-cursor' }); return
+      }
+      const page = await deps.db.listTeamDependencyReviews(teamId, s.user.id, time !== null && id !== null ? { time: Number(time), id } : null)
+      if (!page) { sendJson(res, 404, { error: 'no-team' }); return }
+      const reviews = await readableNpmReviews(res, deps, cookie, s.user.id, page.reviews)
+      if (!reviews) return
+      // Its access asked again, as it may have been taken while npm was read.
+      if (!await deps.db.readsTeamDependencyReviews(teamId, s.user.id)) { sendJson(res, 404, { error: 'no-team' }); return }
+      sendJson(res, 200, { ...page, reviews })
       return
     }
     if (path === '/api/npm/reviews') {