@preventive/triage 1.0.0-alpha.44 → 1.0.0-alpha.45

package/server-managed/agent-merges.ts

@@ -0,0 +1,198 @@
+// The commits agents' pull requests brought to a repository's default
+// branch, for its Pulse (repository-pulse.ts commitStats): an agent that
+// commits as whoever ran it (Codex's own) leaves its commits no mark, its
+// pull request's branch alone naming it (app-agents.ts
+// AGENT_BRANCH_PREFIXES), or a label one who ran it gave it naming the agent
+// (agent-tasks.ts labelAgents), as the Agents tab tells an agent's work; or
+// its author, an account agents work as (github-agents.ts AGENT_OPERATED).
+import { labelAgents } from '../common/managed/agent-tasks.ts'
+import { GITHUB_AGENTS, agentOperated } from '../common/managed/github-agents.ts'
+import { AGENT_BRANCH_PREFIXES, APP_AGENTS } from './app-agents.ts'
+import { type HistoryCommit, githubGraphql } from './repository-history.ts'
+
+// The merged pull requests read an answer, a page a query, as many queries
+// as MERGED_QUERIES, the rest left for the next to ask; of each, as many of
+// its latest commits as MERGED_COMMITS.
+const MERGED_PAGE = 100
+const MERGED_QUERIES = 5
+const MERGED_COMMITS = 100
+// Of each, as many labels as MERGED_LABELS, GitHub's most a page, a label
+// naming any agent the app knows making it an agent's.
+const MERGED_LABELS = 100
+// How long before or after a pull request rebased onto the branch was merged
+// its copies are committed.
+const REBASE_SKEW_MS = 10 * 60_000
+const LABEL_AGENTS = [...new Set([...Object.keys(GITHUB_AGENTS), ...APP_AGENTS.map(agent => agent.id)])]
+const SHA = /^[a-f\d]{40}$/u
+
+const count = (value: unknown) => Number.isSafeInteger(value) && (value as number) >= 0 ? value as number : 0
+const timeOf = (value: unknown) => {
+  const at = typeof value === 'string' ? Date.parse(value) : Number.NaN
+  return Number.isSafeInteger(at) ? at : null
+}
+
+// The agents' pull requests merged since a year's start, as read so far
+// (agentMerges): the commits each brought, and when it was merged; those
+// rebased onto the branch by their last commit there, when merged, and
+// their commits' subjects, the oldest first (agentCommits); when the newest
+// read was last updated, those updated since read again (`through`, null
+// till all are read once); and a read not finished: where it goes on
+// (`after`), when the newest it began with was updated (`from`), the oldest
+// it reads to (`stop`) and how many it has read (`read`). And of every pull
+// request merged, an agent's or not, its merge commit and when (`pulls`),
+// and one rebased so (`pullRebases`), for the commits pushed to the branch
+// directly to be told (directCommits).
+export interface AgentMerges { merges: [string, number][]; rebases: Rebase[]; through: number | null
+  next: { after: string; from: number; stop: number; read: number } | null; pulls?: [string, number][]; pullRebases?: Rebase[] }
+// A pull request rebased onto the branch: its last commit there, when it was
+// merged, its latest commits' subjects, the oldest first, and how many more
+// it had than those read (`more`).
+type Rebase = [sha: string, at: number, subjects: string[], more?: number]
+
+const MERGED_QUERY = `query($owner: String!, $name: String!, $after: String) {
+  repository(owner: $owner, name: $name) {
+    pullRequests(states: MERGED, first: ${MERGED_PAGE}, after: $after, orderBy: { field: UPDATED_AT, direction: DESC }) {
+      pageInfo { hasNextPage endCursor }
+      nodes { updatedAt mergedAt headRefName author { login ... on User { databaseId } } labels(first: ${MERGED_LABELS}) { nodes { name } }
+        mergeCommit { oid parents { totalCount } }
+        commits(last: ${MERGED_COMMITS}) { totalCount nodes { commit { oid messageHeadline changedFilesIfAvailable } } } }
+    }
+  }
+}`
+type MergedPage = { repository?: { pullRequests?: { pageInfo?: { hasNextPage?: unknown; endCursor?: unknown }
+  nodes?: ({ updatedAt?: unknown; mergedAt?: unknown; headRefName?: unknown; author?: { login?: unknown; databaseId?: unknown } | null
+    labels?: { nodes?: ({ name?: unknown } | null)[] } | null
+    mergeCommit?: { oid?: unknown; parents?: { totalCount?: unknown } | null } | null
+    commits?: { totalCount?: unknown; nodes?: ({ commit?: { oid?: unknown; messageHeadline?: unknown; changedFilesIfAvailable?: unknown } | null } | null)[] } | null
+  } | null)[] } | null } | null }
+const agentBranch = (name: unknown) => typeof name === 'string' && AGENT_BRANCH_PREFIXES.some(prefix => name.startsWith(prefix))
+type MergedNode = NonNullable<NonNullable<NonNullable<NonNullable<MergedPage['repository']>['pullRequests']>['nodes']>[number]>
+// Whether a pull request is an agent's: by its branch, a label naming one,
+// or its author, an account agents work as.
+const agentPull = ({ headRefName, labels, author }: MergedNode) => agentBranch(headRefName)
+  || labelAgents((labels?.nodes ?? []).map(label => label?.name), LABEL_AGENTS).length > 0
+  || agentOperated(typeof author?.login === 'string' ? author.login : null, Number.isSafeInteger(author?.databaseId) ? author!.databaseId as number : null)
+
+// The commits the pull requests merged since `since` from an agent's branch,
+// labelled for one, or opened by an account agents work as, brought: each its merge commit, a squash merge's one
+// commit; where it was
+// merged with a merge commit, which a year counts none of, its own commits,
+// its latest MERGED_COMMITS; and of one of more commits whose merge commit
+// has one parent, its commits' subjects, for those it was rebased as to be
+// told by (agentCommits), those of its empty commits left out, as a rebase
+// leaves them. Those merged are read the most recently updated
+// first (a pull request is updated when merged, or after), on from what was
+// `kept`: till one updated before the year, or before the newest read before
+// was, as many queries an answer as MERGED_QUERIES, a read not finished
+// going on from where it was left by the next; one read again whose label
+// no longer names an agent, what it was read to bring forgotten.
+export async function agentMerges(fullName: string, token: string, since: number, kept: AgentMerges | null,
+  fetchImpl: typeof fetch = globalThis.fetch): Promise<AgentMerges> {
+  const [owner, name] = fullName.split('/') as [string, string]
+  const merges = new Map((kept?.merges ?? []).filter(([, at]) => at >= since))
+  const rebases = new Map((kept?.rebases ?? []).filter(([, at]) => at >= since).map(([sha, at, subjects, more = 0]) => [sha, [at, subjects, more] as const]))
+  const pulls = new Map((kept?.pulls ?? []).filter(([, at]) => at >= since))
+  const pullRebases = new Map((kept?.pullRebases ?? []).filter(([, at]) => at >= since).map(([sha, at, subjects, more = 0]) => [sha, [at, subjects, more] as const]))
+  const stop = kept?.next?.stop ?? Math.max(since, kept?.through ?? since)
+  const listed = (map: typeof rebases) => [...map].map(([sha, [at, subjects, more]]): Rebase => more > 0 ? [sha, at, subjects, more] : [sha, at, subjects])
+  const result = (through: number | null, next: AgentMerges['next']): AgentMerges => ({ merges: [...merges], rebases: listed(rebases), through, next,
+    pulls: [...pulls], pullRebases: listed(pullRebases) })
+  let { after = null, from = null, read = 0 }: { after?: string | null; from?: number | null; read?: number } = kept?.next ?? {}
+  for (let queries = 0; queries < MERGED_QUERIES; queries++) {
+    const page = (await githubGraphql(MERGED_QUERY, { owner, name, after }, token, fetchImpl) as MergedPage | null)?.repository?.pullRequests
+    let done = page?.pageInfo?.hasNextPage !== true || typeof page.pageInfo.endCursor !== 'string'
+    for (const node of page?.nodes ?? []) {
+      const updated = timeOf(node?.updatedAt)
+      if (updated === null) continue
+      if (updated < stop) { done = true; break }
+      from ??= updated
+      read++
+      const [merged, merge] = [timeOf(node?.mergedAt), node?.mergeCommit?.oid]
+      if (!node || merged === null || merged < since || typeof merge !== 'string' || !SHA.test(merge)) continue
+      const own = (node.commits?.nodes ?? []).map(item => item?.commit)
+      const merging = count(node.mergeCommit?.parents?.totalCount) > 1
+      const brought = [merge, ...merging ? own.map(commit => commit?.oid) : []].filter((oid): oid is string => typeof oid === 'string' && SHA.test(oid))
+      const copied = own.filter(commit => commit?.changedFilesIfAvailable !== 0)
+      // Of one of more commits than its latest read, how many more it had.
+      const more = Math.max(0, count(node.commits?.totalCount) - own.length)
+      const subjects = !merging && (copied.length > 1 || more > 0) && copied.length > 0 && copied.every(commit => typeof commit?.messageHeadline === 'string')
+        ? copied.map(commit => commit!.messageHeadline as string) : null
+      pulls.set(merge, merged)
+      if (subjects) pullRebases.set(merge, [merged, subjects, more])
+      // One an agent's no more, its label taken off (which updates it), what
+      // it was read to bring none of an agent's.
+      if (!agentPull(node)) {
+        for (const oid of brought.filter(sha => merges.get(sha) === merged)) merges.delete(oid)
+        if (rebases.get(merge)?.[0] === merged) rebases.delete(merge)
+        continue
+      }
+      for (const oid of brought) merges.set(oid, merged)
+      if (subjects) rebases.set(merge, [merged, subjects, more])
+    }
+    if (done) return result(from ?? stop, null)
+    after = page!.pageInfo!.endCursor as string
+  }
+  return result(kept?.through ?? null, { after: after!, from: from ?? stop, stop, read })
+}
+
+// Whether two reads of the pull requests merged (agentMerges) bring the
+// same commits, the agents' and every one's (`pulls`, `pullRebases`, which
+// tell those pushed directly), whatever order each read them in.
+export function sameMerges(a: AgentMerges, b: AgentMerges) {
+  const sorted = (entries: unknown[] = []) => entries.map(entry => JSON.stringify(entry)).toSorted()
+  const brought = (read: AgentMerges) => JSON.stringify([read.merges, read.rebases, read.pulls, read.pullRebases].map(sorted))
+  return brought(a) === brought(b)
+}
+
+// A commit's subject as GitHub heads its message: whole, or, past what it
+// shows, cut short before an ellipsis.
+const headed = (subject: string, headline: string) => headline.endsWith('…') ? subject.startsWith(headline.slice(0, -1)) : subject === headline
+
+// The commits of `commits` (a year's) the agents' pull requests brought
+// (`read`, agentMerges): those it names, and of one rebased, its commits'
+// copies, the last and those below it on their first parents, as long as
+// each one's subject is that of one of its commits older than the last
+// matched, as Commits tells a rebase (repository-history.ts squashedPulls),
+// past those of its commits the rebase left none of (an empty one GitHub
+// counted no files of), and, past them all, as many more as it had before
+// its latest read; a squash merge's one commit alone, its subject the pull
+// request's own.
+export function agentCommits(read: AgentMerges, commits: HistoryCommit[]): Set<string> {
+  const shas = new Set(read.merges.map(([sha]) => sha))
+  const bySha = new Map(commits.map(commit => [commit.sha, commit]))
+  for (const [last, merged, subjects, more = 0] of read.rebases) {
+    let commit = bySha.get(last)
+    let at = subjects.length - 1
+    for (; commit && at >= 0; commit = bySha.get(commit.parents[0] ?? '')) {
+      const [copied, upTo] = [commit, at]
+      const found = subjects.findLastIndex((subject, index) => index <= upTo && headed(copied.subject, subject))
+      if (found < 0) break
+      shas.add(commit.sha)
+      at = found - 1
+    }
+    // Each of its latest commits read copied, as many as it had before them
+    // the commits below, on their first parents, as long as each was
+    // committed as it was merged, as a rebase commits its copies: not past
+    // its first, its empty ones, which a rebase leaves out, counted too.
+    const copiedAsMerged = (when: number | null) => when !== null && Math.abs(when - merged) <= REBASE_SKEW_MS
+    for (let rest = at < 0 ? more : 0; commit && rest > 0 && copiedAsMerged(commit.committedAt); rest--, commit = bySha.get(commit.parents[0] ?? '')) {
+      shas.add(commit.sha)
+    }
+  }
+  return shas
+}
+
+// The commits of `commits` (a year's, from the branch's `head`) pushed to
+// it directly: on its first parents from the head, none a merge, none a
+// pull request brought (`read.pulls`: its merge commit, a squash's one
+// commit, or the copies of one rebased onto it, as agentCommits tells
+// them); those a merge brought from its other parents, not.
+export function directCommits(read: AgentMerges, commits: HistoryCommit[], head: string): Set<string> {
+  const pulled = agentCommits({ ...read, merges: read.pulls ?? [], rebases: read.pullRebases ?? [] }, commits)
+  const bySha = new Map(commits.map(commit => [commit.sha, commit]))
+  const direct = new Set<string>()
+  for (let commit = bySha.get(head); commit; commit = bySha.get(commit.parents[0] ?? '')) {
+    if (commit.parents.length <= 1 && !pulled.has(commit.sha)) direct.add(commit.sha)
+  }
+  return direct
+}

package/server-managed/app-agents.ts

@@ -0,0 +1,30 @@
+// The agents the server knows by their GitHub Apps or accounts (the Agents
+// tab's, server-managed/repository-agents.ts, whose marks the Commits tab
+// reads on commits too, repository-history.ts).
+import type { AppAgent, AppAgentMarks } from '../common/managed/agent-tasks.ts'
+import { GITHUB_AGENTS } from '../common/managed/github-agents.ts'
+
+// The agents known by their GitHub Apps or accounts, beside Claude and
+// Codex: each its id and name, its avatar (its mark, served by
+// /api/avatar/<avatar>, for these alone: a GitHub App's, `app-<id>`, or
+// account's, `user-<id>`), the fingerprint it leaves as a line of its pull
+// requests' bodies and its commits' messages, the account its work is
+// authored by (its id and the logins GitHub names it by, told by both), and
+// its branches' prefix. Their work may carry Claude's or
+// Codex's marks too, those its tools. Copilot's coding agent opens its pull
+// requests and authors its commits as its account, Copilot (198982749), on
+// `copilot/` branches; Dependabot, its GitHub App (29110), opens its pull
+// requests as its account, `dependabot` (49699333, `dependabot[bot]` to
+// GitHub's REST API and in its address), on `dependabot/<ecosystem>/…`
+// branches. Their accounts and marks are those the app draws their work by
+// wherever it shows it (common/managed/github-agents.ts): Copilot's its own,
+// the app's to draw, no avatar.
+const { copilot, dependabot } = GITHUB_AGENTS
+export const APP_AGENTS: readonly (AppAgent & AppAgentMarks)[] = [
+  { id: 'neo', name: 'Neo', avatar: 'app-3115942', fingerprint: '🤖 Generated with [Neo](', prefix: 'neo/' },
+  { id: 'copilot', name: copilot.name, account: copilot.accounts[0], prefix: 'copilot/' },
+  { id: 'dependabot', name: dependabot.name, avatar: dependabot.avatar, account: dependabot.accounts[0], prefix: 'dependabot/' },
+]
+// The prefixes of the branches agents work on: Claude Code's and Codex's,
+// and the app agents'.
+export const AGENT_BRANCH_PREFIXES = ['claude/', 'codex/', ...APP_AGENTS.map(agent => agent.prefix)]

package/server-managed/avatar-store.ts

@@ -9,4 +9,5 @@ export interface CachedAvatar {
 export interface AvatarStore {
   put(id: string, contentType: string, bytes: Buffer): Promise<void>
   get(id: string): Promise<CachedAvatar | null>
+  delete(id: string): Promise<void>
 }

package/server-managed/commit-coauthors.ts

@@ -0,0 +1,83 @@
+// Who made a commit beside its author, as the Commits tab shows them
+// (repository-history.ts): its co-authors, as its `Co-authored-by:` trailers
+// name them, and the agents its message marks.
+import { agentSignals, trailerBlock } from '../common/managed/agent-tasks.ts'
+import { GITHUB_AGENTS, type GithubAgentId, emailAgent, githubAgent } from '../common/managed/github-agents.ts'
+import { APP_AGENTS } from './app-agents.ts'
+import { type NamedAccount, commitAccount } from './github-accounts.ts'
+
+export const MAX_COAUTHORS = 3
+// The rules co-authors are read by, the agents' addresses and names among
+// them: what was kept read by others (history pages, squashed pull requests)
+// read again by these, once raised.
+export const COAUTHORS_READ = 2
+const MAX_NAME = 256
+const textOf = (value: unknown, max: number) => typeof value === 'string' && value.trim() ? value.trim().slice(0, max) : null
+
+// One who made a commit beside its author: by name and account, as its
+// author is, and the agent it is where known, one GitHub knows by its account
+// or its commits' address or name (common/managed/github-agents.ts) or one
+// the server knows by its app (app-agents.ts), with its avatar.
+export interface Coauthor { name: string | null; login: string | null; id: number | null; agent?: string; avatar?: string }
+
+// `Co-authored-by: <name> <address>` trailers, GitHub matching the key
+// regardless of case; Cursor's agents' links, as their work carries them;
+// the app agents known by the fingerprints they leave.
+const COAUTHOR_TRAILER = /^co-authored-by:[ \t]*([^<\n]*?)[ \t]*<([^<>\s]+)>[ \t]*$/gimu
+const CURSOR_AGENT = /https:\/\/cursor\.com\/(?:agents\?id=|background-agent\?bcId=)bc-/u
+const FINGERPRINTED = APP_AGENTS.filter(agent => agent.fingerprint)
+
+// One named as a commit's author or co-author: by name, the address its
+// commit gives (where it is read), and account.
+export type Maker = { name: unknown; email?: unknown; account: NamedAccount }
+
+// The agent one who made a commit is: by their account, else the address
+// their commit names them by; else, GitHub naming no account for them, by
+// their name.
+const makerAgent = ({ name, email, account }: Maker): GithubAgentId | null => githubAgent(account.login, account.id) ?? emailAgent(email)
+  ?? (account.login ? null : githubAgent(null, null, typeof name === 'string' ? name : null))
+
+// Who made a commit, past its author (`author`), as its message names them:
+// its co-authors, those GitHub's GraphQL API lists past the author (`listed`,
+// the addresses its `Co-authored-by:` trailers give, by the accounts GitHub
+// knows them by), else its trailers (agent-tasks.ts trailerBlock), an account's no-reply
+// address naming it;
+// then the agents it marks, Claude's and Codex's as the Agents tab reads them
+// (agent-tasks.ts agentSignals: their sessions' and tasks' links, Claude's
+// co-author and "Generated with" lines), the app agents' by their
+// fingerprints, Cursor's by its agents' links. Each the agent it is where
+// known, and once, the author none of them, as many as MAX_COAUTHORS: two
+// are one by the first of their agent, account, address and name both name,
+// two people of one name with accounts or addresses of their own two.
+export function coauthorsOf(message: unknown, author: Maker, listed: Maker[] | null = null): Coauthor[] {
+  const text = typeof message === 'string' ? message.replaceAll('\r\n', '\n') : ''
+  const named = listed ?? [...trailerBlock(text).matchAll(COAUTHOR_TRAILER)].map(([, name, email]) => ({ name, email, account: commitAccount({ email }) }))
+  const signals = agentSignals([text], FINGERPRINTED)
+  const marked = [...signals.claude || signals.sessions.length > 0 ? ['claude'] : [], ...signals.tasks.length > 0 || signals.codex ? ['codex'] : [],
+    ...CURSOR_AGENT.test(text) ? ['cursor'] : [], ...signals.agents]
+  type Identity = { agent: string | null; login: string | null; email: string | null; name: string | null }
+  const identity = (agent: string | null, login: string | null, name: string | null, email: unknown = null): Identity => ({ agent, login: login?.toLowerCase() ?? null,
+    email: typeof email === 'string' && email.trim() ? email.trim().toLowerCase() : null, name: name?.toLowerCase() ?? null })
+  const same = (a: Identity, b: Identity) => a.agent && b.agent ? a.agent === b.agent : a.login && b.login ? a.login === b.login
+    : a.email && b.email ? a.email === b.email : a.name !== null && a.name === b.name
+  const seen = [identity(makerAgent(author), author.account.login, textOf(author.name, MAX_NAME), author.email)]
+  const coauthors: Coauthor[] = []
+  const add = (coauthor: Coauthor, email: unknown = null) => {
+    const who = identity(coauthor.agent ?? null, coauthor.login, coauthor.name, email)
+    if (seen.some(other => same(other, who)) || coauthors.length >= MAX_COAUTHORS || (!coauthor.login && !coauthor.name && !coauthor.agent)) return
+    seen.push(who)
+    coauthors.push(coauthor)
+  }
+  for (const maker of named) {
+    const agent = makerAgent(maker)
+    // An agent known by its address where GitHub names someone else's
+    // account for it (Codex's), as itself, not that account.
+    const { login, id } = agent && maker.account.login && githubAgent(maker.account.login, maker.account.id) !== agent ? { login: null, id: null } : maker.account
+    add({ name: textOf(maker.name, MAX_NAME), login, id, ...agent ? { agent } : {} }, maker.email)
+  }
+  for (const agent of marked) {
+    const app = APP_AGENTS.find(known => known.id === agent && !Object.hasOwn(GITHUB_AGENTS, known.id))
+    add({ name: app?.name ?? GITHUB_AGENTS[agent as GithubAgentId].name, login: null, id: null, agent, ...app?.avatar ? { avatar: app.avatar } : {} })
+  }
+  return coauthors
+}

package/server-managed/commit-lockfiles.ts

@@ -0,0 +1,62 @@
+// The versions a repository's lockfiles of npm's ecosystem lock at a commit,
+// as their review reads them (pull-dependency-reviews.ts): every lockfile
+// there (findRepoLockfiles) a review holds to (`held`, lockfile-scope.ts),
+// read as a pull request's are (pull-dependencies.ts readLockfile, kept in
+// this instance by the commit and path), as many as MAX_LOCKFILES of those,
+// each's versions (`lockfiles`), and those its reader refuses, of Bun's, or
+// past MAX_LOCKFILES (`unread`); and those of some of them (lockedIn), each
+// version once by what its reviews are held to (lockedWith), dev only where
+// it is wherever it is locked. GitHub having none of a lockfile it lists
+// there fails the whole, as it would for any file.
+import { createClient } from '@preventive/upstream/github.js'
+import { upstreamGithub } from './github-errors.ts'
+import { GithubApiError } from './github-app.ts'
+import type { LockedPackage } from './locked-packages.ts'
+import { type Lru, lru } from './lru.ts'
+import { lockedWith, lockfileFormat, readLockfile } from './pull-dependencies.ts'
+
+export const MAX_LOCKFILES = 100
+
+export interface CommitLockfiles { lockfiles: { path: string; packages: LockedPackage[] }[]; unread: string[] }
+
+// The lockfiles at commit `sha` its review reads, by their paths, each with
+// its format (pull-dependencies.ts lockfileFormat), kept by the commit.
+const listings: Lru<{ path: string; format: NonNullable<ReturnType<typeof lockfileFormat>> }[]> = lru(20_000, listed => listed.length + 1)
+export async function lockfilesAt(fullName: string, token: string, sha: string) {
+  const key = `${fullName}\0${sha}`
+  const known = listings.get(key)
+  if (known) return known
+  const { lockfiles } = await upstreamGithub(() => createClient({ token, userAgent: 'deepview-triage' }).findRepoLockfiles({ repo: fullName, sha }))
+  const listed = lockfiles.flatMap(({ path }) => { const format = lockfileFormat(path); return format ? [{ path, format }] : [] })
+  listings.set(key, listed)
+  return listed
+}
+
+export async function lockedAt(fullName: string, token: string, sha: string, held: (path: string) => boolean = () => true): Promise<CommitLockfiles> {
+  const listed = (await lockfilesAt(fullName, token, sha)).filter(({ path }) => held(path))
+  const unread = listed.slice(MAX_LOCKFILES).map(({ path }) => path)
+  const lockfiles: CommitLockfiles['lockfiles'] = []
+  for (const lockfile of listed.slice(0, MAX_LOCKFILES)) {
+    const read = await readLockfile(fullName, token, sha, lockfile)
+    if ('error' in read && read.error === 'github-not-found') throw new GithubApiError(404, 'github-not-found')
+    if ('error' in read) unread.push(lockfile.path)
+    else lockfiles.push({ path: lockfile.path, packages: read.packages })
+  }
+  return { lockfiles, unread: unread.toSorted() }
+}
+
+// The versions those of `read`'s lockfiles `held` holds to lock, each once,
+// and their paths.
+export function lockedIn(read: CommitLockfiles, held: (path: string) => boolean = () => true) {
+  const packages = new Map<string, LockedPackage>()
+  const paths: string[] = []
+  for (const lockfile of read.lockfiles.filter(({ path }) => held(path))) {
+    paths.push(lockfile.path)
+    for (const pkg of lockfile.packages) {
+      const kept = packages.get(lockedWith(pkg))
+      if (!kept) packages.set(lockedWith(pkg), { ...pkg })
+      else if (kept.dev && !pkg.dev) delete kept.dev
+    }
+  }
+  return { packages: [...packages.values()], paths }
+}

package/server-managed/db-methods.ts

@@ -1,7 +1,9 @@
 import { type LinkReportStore, linkReportMethods, linkRevision } from './link-reports.ts'
 import { type RepositoryAliasStore, repositoryAliasMethods } from './repository-aliases.ts'
 import { type DependencyReviewStore, dependencyReviewMethods } from './dependency-reviews.ts'
+import { type RepositoryDependencyReviewStore, repositoryDependencyReviewMethods } from './repository-dependency-reviews.ts'
 import { type TeamNpmScopeStore, teamNpmScopeMethods } from './team-npm-scopes.ts'
+import { type GithubLinkStore, githubLinkMethods } from './github-links.ts'
 import { createHash, randomUUID } from 'node:crypto'
 import { teamCatalogRevision } from './team-catalog.ts'
 import { type Role, roleAtLeast } from '../common/managed/roles.ts'
@@ -358,21 +360,26 @@ export interface UserTeam {
   dependencyReview?: boolean
   permissions: TeamUserPermissions
   cacheKey?: string
+  // The team's repository links, by name: its Repositories, whether or not
+  // anything is attached to them yet.
+  repos: TeamRepoLink[]
   reports: UserTeamReport[]
   bundles: UserTeamBundle[]
 }
 
 // Backend-agnostic store surface (SQLite + PostgreSQL implementations).
-export interface ManagedDb extends DependencyReviewStore, ActivityStore, CommentStore, GithubMetadataStore, GithubCommitStore, ManagedIssueStore, BundleBuildLeaseStore, UpstreamCacheStore, WorkspaceShareStore, ImportTriageStore, ManagementStore, ManagementCatalogStore, StorageDb, LinkReportStore, RepositoryAliasStore, TeamNpmScopeStore {
+export interface ManagedDb extends DependencyReviewStore, RepositoryDependencyReviewStore, ActivityStore, CommentStore, GithubMetadataStore, GithubCommitStore, ManagedIssueStore, BundleBuildLeaseStore, UpstreamCacheStore, WorkspaceShareStore, ImportTriageStore, ManagementStore, ManagementCatalogStore, StorageDb, LinkReportStore, RepositoryAliasStore, TeamNpmScopeStore, GithubLinkStore {
   claimMaintenanceLease(owner: string, now: number, until: number, migration?: boolean): Promise<boolean>
   finishMaintenanceLease(owner: string, until: number): Promise<void>
   getFeedState(sessionId: string, now: number): Promise<{ user: Pick<StoredUser, 'id' | 'role'>; catalog: number; annotations: number } | null>
   // Reuse connections within a finite request or one feed polling iteration.
   withRequest?<T>(work: () => Promise<T>): Promise<T>
-  // Upsert the identity; returns the user's opaque id (stable across logins).
+  // Upsert the identity; returns the user's opaque id (stable across logins),
+  // or null for an account linked to a user (github-links.ts), which neither
+  // signs in nor registers. A name chosen from a linked account is kept.
   // Initial-admin approval comes only from trusted login configuration. It
   // promotes a matching No access identity only while it is the sole user.
-  upsertUser(user: ManagedUser, now: number, initialAdminGithubId?: number | null): Promise<string>
+  upsertUser(user: ManagedUser, now: number, initialAdminGithubId?: number | null): Promise<string | null>
   createSession(session: ManagedSession, now: number): Promise<void>
   // A sign-in session; never a view session, so a view token in the session
   // cookie authenticates nothing.
@@ -563,12 +570,14 @@ function prepareStatements(db: ManagedSql) {
     // Identity refreshes preserve roles. Login can separately bootstrap the
     // configured sole No access user within this same writer transaction.
     upsertUserStmt: db.prepare(
-      `INSERT INTO managed_user (id, github_user_id, login, name, avatar_url, role, created_at, updated_at)
-       VALUES (?, ?, ?, ?, ?, 'none', ?, ?)
+      `INSERT INTO managed_user (id, github_user_id, login, name, github_name, avatar_url, role, created_at, updated_at)
+       VALUES (?, ?, ?, ?, ?, ?, 'none', ?, ?)
        ON CONFLICT(github_user_id) DO UPDATE SET
-         login = excluded.login, name = excluded.name,
+         login = excluded.login, github_name = excluded.github_name,
+         name = CASE WHEN managed_user.name_link IS NULL THEN excluded.name ELSE managed_user.name END,
          avatar_url = excluded.avatar_url, updated_at = excluded.updated_at`,
     ),
+    selectLinkedStmt: db.prepare(`SELECT 1 AS linked FROM managed_github_link WHERE github_user_id = ?`),
     selectUserIdStmt: db.prepare(`SELECT id, role FROM managed_user WHERE github_user_id = ?`),
     promoteInitialAdminStmt: db.prepare(
       `UPDATE managed_user SET role = 'admin' WHERE id = ? AND role = 'none'
@@ -910,10 +919,15 @@ function prepareStatements(db: ManagedSql) {
     renameTeamStmt: db.prepare(`UPDATE managed_team SET name = ?, updated_at = ? WHERE id = ?`),
     setTeamHiddenStmt: db.prepare(`UPDATE managed_team SET hidden = ?, updated_at = ? WHERE id = ?`),
     selectTeamsStmt: db.prepare(`SELECT id, slug, name, hidden FROM managed_team ORDER BY name ASC`),
+    // `dependencyReview` where the user reviews dependencies in the team
+    // (dependency-reviews.ts reviewsIn): one that reviews them, and a member
+    // who manages, or triages and may see its dependencies; an admin in any.
     selectTeamsForUserStmt: db.prepare(
-      `SELECT t.id AS id, t.slug AS slug, t.name AS name, t.dependency_review AS dependencyReview,
+      `SELECT t.id AS id, t.slug AS slug, t.name AS name,
+              CASE WHEN t.dependency_review = 1 AND (u.role IN ('admin', 'manage') OR (u.role = 'triage' AND tu.view_dependencies = 1))
+                THEN 1 ELSE 0 END AS dependencyReview,
               tu.view_dependencies AS dependencies, tu.view_security AS security
-         FROM managed_team_user tu JOIN managed_team t ON t.id = tu.team_id
+         FROM managed_team_user tu JOIN managed_team t ON t.id = tu.team_id JOIN managed_user u ON u.id = tu.user_id
         WHERE tu.user_id = ? AND t.hidden = 0 ORDER BY t.name ASC, t.id ASC`,
     ),
     selectUserTeamScopesStmt: db.prepare(
@@ -1513,6 +1527,8 @@ function teamMethods(stmts: ReturnType<typeof prepareStatements>, db: ManagedSql
         cacheKey: createHash('sha256').update(JSON.stringify([
           t.dependencies, t.security, links, scopes.filter(scope => scope.teamId === t.id),
         ])).digest('base64url'),
+        repos: scopes.filter(scope => scope.teamId === t.id).map(scope => ({ repoId: scope.repoId, fullName: scope.fullName, path: scope.path || null }))
+          .toSorted((a, b) => a.fullName.localeCompare(b.fullName) || (a.path ?? '').localeCompare(b.path ?? '')),
         reports: reportsByTeam.get(t.id) ?? [],
         bundles: bundlesByTeam.get(t.id) ?? [],
       }))
@@ -1597,7 +1613,7 @@ export function createManagedMethods(db: ManagedSql, options: ManagedDbOptions =
   const reports = reportMethods(stmts, db, key)
   const triage = triageMethods(stmts, options.triageHistoryLimit ?? 0, db)
   const {
-    upsertUserStmt, selectUserIdStmt, promoteInitialAdminStmt, selectGithubIdStmt, insertSessionStmt, selectOwnSessionStmt, selectUsersStmt,
+    upsertUserStmt, selectLinkedStmt, selectUserIdStmt, promoteInitialAdminStmt, selectGithubIdStmt, insertSessionStmt, selectOwnSessionStmt, selectUsersStmt,
     touchUserSeenStmt, updateRoleStmt, updateTokensStmt, selectTokensStmt, ensureUploadKeyStmt, deleteSessionStmt, deleteExpiredStmt,
     selectViewSessionStmt, deleteOtherViewsStmt, insertViewSessionStmt, deleteDemotedViewsStmt,
   } = stmts
@@ -1607,7 +1623,9 @@ export function createManagedMethods(db: ManagedSql, options: ManagedDbOptions =
     ...linkReportMethods(db, key),
     ...repositoryAliasMethods(db),
     ...teamNpmScopeMethods(db),
+    ...githubLinkMethods(db),
     ...dependencyReviewMethods(db),
+    ...repositoryDependencyReviewMethods(db),
     ...bundleBuildLeaseMethods(db),
     ...upstreamCacheMethods(db),
     async claimMaintenanceLease(owner, now, until, migration = false) {
@@ -1619,9 +1637,10 @@ export function createManagedMethods(db: ManagedSql, options: ManagedDbOptions =
       await db.prepare('UPDATE managed_maintenance_lease SET expires_at = ? WHERE owner = ?').run(until, owner)
     },
     async upsertUser(user, now, initialAdminGithubId = null) {
+      if (await selectLinkedStmt.get(user.githubUserId)) return null
       // New row → a fresh id; ON CONFLICT(github_user_id) keeps an existing
       // user's id (DO UPDATE leaves it untouched), so re-read to return it.
-      await upsertUserStmt.run(randomUUID(), user.githubUserId, user.login, user.name, user.avatarUrl, now, now)
+      await upsertUserStmt.run(randomUUID(), user.githubUserId, user.login, user.name, user.name, user.avatarUrl, now, now)
       const row = (await selectUserIdStmt.get(user.githubUserId)) as { id: string; role: Role }
       // Avoid the population check unless this login matches the configured
       // identity and still needs approval. NOT EXISTS stops at any other user.

package/server-managed/db-neon.ts

@@ -2,6 +2,8 @@ import { DEPENDENCY_REVIEW_SCHEMA } from './dependency-reviews.ts'
 import { LINK_REPORT_SCHEMA } from './link-reports.ts'
 import { REPOSITORY_ALIAS_SCHEMA } from './repository-aliases.ts'
 import { TEAM_NPM_SCOPE_SCHEMA } from './team-npm-scopes.ts'
+import { GITHUB_LINK_SCHEMA, GITHUB_LINK_USER_COLUMNS } from './github-links.ts'
+import { REPOSITORY_DEPENDENCY_REVIEW_COLUMNS } from './repository-dependency-reviews.ts'
 import { AsyncLocalStorage } from 'node:async_hooks'
 import { WebSocket } from 'ws'
 import { type ManagedDb, type ManagedDbOptions, createManagedMethods } from './db-methods.ts'
@@ -36,7 +38,7 @@ async function currentSchema(db: PgConnection): Promise<boolean> {
   const exists = (await db.query("SELECT to_regclass('managed_schema_version') AS name")).rows[0]?.['name']
   if (!exists) return false
   const versions = new Set((await db.query('SELECT version FROM managed_schema_version')).rows.map(row => Number(row['version'])))
-  return Array.from({ length: 27 }, (_, i) => i + 1).every(version => versions.has(version))
+  return Array.from({ length: 30 }, (_, i) => i + 1).every(version => versions.has(version))
 }
 
 async function migrateRepositoryDefaultCache(db: PgConnection): Promise<void> {
@@ -142,6 +144,31 @@ async function migrateDependencyReviews(db: PgConnection): Promise<void> {
   await db.query('INSERT INTO managed_schema_version VALUES (27)')
 }
 
+// Existing names are the sign-in accounts' own: none was chosen yet.
+async function migrateGithubLinks(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 28')).rows.length > 0) return
+  await db.query(postgresSchema(GITHUB_LINK_SCHEMA))
+  await db.query(`ALTER TABLE managed_user ${GITHUB_LINK_USER_COLUMNS.map(([column, type]) => `ADD COLUMN IF NOT EXISTS ${column} ${type}`).join(', ')}`)
+  await db.query('UPDATE managed_user SET github_name = name')
+  await db.query('INSERT INTO managed_schema_version VALUES (28)')
+}
+
+async function migrateRepositoryDependencyReviews(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 29')).rows.length > 0) return
+  await db.query(`ALTER TABLE managed_selected_repo ${REPOSITORY_DEPENDENCY_REVIEW_COLUMNS.map(([column, type]) => `ADD COLUMN IF NOT EXISTS ${column} ${type}`).join(', ')}`)
+  await db.query('INSERT INTO managed_schema_version VALUES (29)')
+}
+
+// The lockfiles a repository's dependency review holds to, its columns
+// added since 29 added there too; and a team's published reviews, listed by
+// it, indexed so.
+async function migrateRepositoryDependencyReviewLockfiles(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 30')).rows.length > 0) return
+  await db.query(`ALTER TABLE managed_selected_repo ${REPOSITORY_DEPENDENCY_REVIEW_COLUMNS.map(([column, type]) => `ADD COLUMN IF NOT EXISTS ${column} ${type}`).join(', ')}`)
+  await db.query('CREATE INDEX IF NOT EXISTS managed_dependency_review_team_idx ON managed_dependency_review_team(team_id, review_id)')
+  await db.query('INSERT INTO managed_schema_version VALUES (30)')
+}
+
 async function initialize(db: PgConnection): Promise<void> {
   if (await currentSchema(db)) return
   await db.query('BEGIN')
@@ -215,7 +242,8 @@ async function initialize(db: PgConnection): Promise<void> {
     if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 11')).rows.length === 0) {
       await db.query(postgresSchema(revisionSchema(true)) + '; INSERT INTO managed_schema_version VALUES (11)')
     }
-    for (const migrate of [migrateRepositoryDefaultCache, migrateBundleBuildLeases, migrateBundleVisibility, migrateLinkReports, migrateRepositoryAliases, migrateHiddenTeams, migrateIssueFixes, migrateBundleProvenance, migrateUpstreamCache, migrateBundleBuildConditions, migrateSessionUploadKeys, migrateViewSessions, migrateGithubCommits, migrateTeamNpmScopes, migrateDependencyReviews]) await migrate(db)
+    for (const migrate of [migrateRepositoryDefaultCache, migrateBundleBuildLeases, migrateBundleVisibility, migrateLinkReports, migrateRepositoryAliases, migrateHiddenTeams, migrateIssueFixes, migrateBundleProvenance, migrateUpstreamCache, migrateBundleBuildConditions, migrateSessionUploadKeys, migrateViewSessions, migrateGithubCommits, migrateTeamNpmScopes, migrateDependencyReviews, migrateGithubLinks, migrateRepositoryDependencyReviews,
+      migrateRepositoryDependencyReviewLockfiles]) await migrate(db)
     await db.query('COMMIT')
   } catch (err) {
     await db.query('ROLLBACK')

package/server-managed/db-schema.ts

@@ -3,6 +3,7 @@ import { LINK_REPORT_SCHEMA } from './link-reports.ts'
 import { REPOSITORY_ALIAS_SCHEMA } from './repository-aliases.ts'
 import { WORKSPACE_SHARE_SCHEMA } from './workspace-shares.ts'
 import { TEAM_NPM_SCOPE_SCHEMA } from './team-npm-scopes.ts'
+import { GITHUB_LINK_SCHEMA } from './github-links.ts'
 
 // Created after the column migration, which predates it on older databases.
 export const VIEW_SESSION_INDEX = 'CREATE INDEX IF NOT EXISTS managed_session_viewer_idx ON managed_session(viewer_session);'
@@ -64,7 +65,13 @@ CREATE TABLE IF NOT EXISTS managed_selected_repo (
   added_by        TEXT REFERENCES managed_user(id) ON DELETE SET NULL,
   added_at        INTEGER NOT NULL,
   updated_at      INTEGER NOT NULL,
-  active          INTEGER NOT NULL DEFAULT 1
+  active          INTEGER NOT NULL DEFAULT 1,
+  -- Its pull requests' dependencies reviewed (repository-dependency-reviews.ts):
+  -- as many published reviews required of each version, and the commit at
+  -- whose lockfiles' versions none is (null for none).
+  dependency_review INTEGER NOT NULL DEFAULT 0,
+  dependency_reviews_required INTEGER NOT NULL DEFAULT 1,
+  dependency_review_since TEXT
 ) STRICT;
 
 CREATE INDEX IF NOT EXISTS selected_repo_full_name_idx ON managed_selected_repo(full_name);
@@ -224,4 +231,4 @@ CREATE TABLE IF NOT EXISTS managed_team_user (
 ) STRICT;
 
 CREATE INDEX IF NOT EXISTS team_user_user_idx ON managed_team_user(user_id);
-` + WORKSPACE_SHARE_SCHEMA + LINK_REPORT_SCHEMA + REPOSITORY_ALIAS_SCHEMA + TEAM_NPM_SCOPE_SCHEMA + DEPENDENCY_REVIEW_SCHEMA
+` + WORKSPACE_SHARE_SCHEMA + LINK_REPORT_SCHEMA + REPOSITORY_ALIAS_SCHEMA + TEAM_NPM_SCOPE_SCHEMA + DEPENDENCY_REVIEW_SCHEMA + GITHUB_LINK_SCHEMA

package/server-managed/db.ts

@@ -8,6 +8,8 @@ import { initCommentMethods } from './comments.ts'
 import { initActivityMethods } from './activity.ts'
 import { revisionSchema } from './revisions.ts'
 import { MANAGED_SCHEMA, VIEW_SESSION_INDEX } from './db-schema.ts'
+import { GITHUB_LINK_USER_COLUMNS } from './github-links.ts'
+import { REPOSITORY_DEPENDENCY_REVIEW_COLUMNS } from './repository-dependency-reviews.ts'
 import { STORAGE_SCHEMA } from './storage-db.ts'
 import { GITHUB_COMMIT_SCHEMA, GITHUB_METADATA_SCHEMA, GITHUB_STATE_REASON_COLUMN } from './github-metadata.ts'
 import { MANAGED_ISSUE_SCHEMA } from './managed-issues.ts'
@@ -79,6 +81,10 @@ export function openSqliteManagedDb(path: string, options: ManagedDbOptions = {}
       ensureColumn(db, table, 'storage_encrypted', 'INTEGER NOT NULL DEFAULT 0')
     }
     ensureColumn(db, 'managed_user', 'gh_tokens_encrypted', 'INTEGER NOT NULL DEFAULT 0')
+    // Existing names are the sign-in accounts' own: none was chosen yet.
+    for (const [column, type] of GITHUB_LINK_USER_COLUMNS) {
+      if (ensureColumn(db, 'managed_user', column, type) && column === 'github_name') db.exec('UPDATE managed_user SET github_name = name')
+    }
     ensureColumn(db, 'managed_github_metadata', 'state_reason', GITHUB_STATE_REASON_COLUMN)
     ensureColumn(db, 'managed_github_metadata', 'attempted_at', 'INTEGER')
     // Existing public links must opt in too; never preserve an implicit grant.
@@ -116,6 +122,7 @@ export function openSqliteManagedDb(path: string, options: ManagedDbOptions = {}
     ensureColumn(db, 'managed_finding_issue', 'auto_fix_url', 'TEXT')
     ensureColumn(db, 'managed_finding_issue', 'auto_fix_checked_at', 'INTEGER')
     ensureColumn(db, 'managed_selected_repo', 'active', 'INTEGER NOT NULL DEFAULT 1')
+    for (const [column, type] of REPOSITORY_DEPENDENCY_REVIEW_COLUMNS) ensureColumn(db, 'managed_selected_repo', column, type)
     ensureColumn(db, 'managed_finding_triage_event', 'report_id', 'TEXT')
     ensureColumn(db, 'managed_finding_triage_event', 'report', 'TEXT')
     ensureColumn(db, 'managed_finding_triage_event', 'repo', 'TEXT')