@preventive/triage 1.0.0-alpha.44 → 1.0.0-alpha.46

package/client/linked-findings.js

@@ -63,6 +63,9 @@ function entryId(entry) {
 // A file whose every link normalises away is still a links file; it
 // just has no links, which its view says plainly.
 export function parseLinkedFindings(content) {
+  // Only text opening an array can parse to one, so a report — which
+  // opens an object — is turned away without being parsed twice.
+  if (typeof content === 'string' && !/^\s*\[/u.test(content)) return null
   let data
   try { data = JSON.parse(content) } catch { return null }
   if (!Array.isArray(data) || data.length === 0) return null

package/common/bundle-metadata.d.ts

@@ -5,6 +5,7 @@ export const FILE_HASH: RegExp
 export interface BundleIdentity { integrity: string; kind: string | null; size: number }
 export interface BundleDetails extends BundleIdentity { bundle?: unknown; json?: unknown; map?: SourceMap; edges?: readonly SourcemapEdge[] }
 export function parseBundleContents(text: string, identity: BundleIdentity): BundleDetails
+export function computeBundleFileHashes(details: BundleDetails): Promise<Map<string, string>>
 export interface BundleMetadata extends Record<string, unknown> {
   files: [string, number | null, string | null, number | null][]
   codeStats: { files: number; lines: number; bytes: number }

package/common/bundle-metadata.js

@@ -174,7 +174,7 @@ export function parseBundleMetadata(data, integrity) {
       || [...unsized].some((path) => typeof path !== 'string' || !fileSizes.has(path) || fileSizes.get(path) !== null)) throw new Error('Invalid bundle metadata')
   const details = { integrity, kind: data.kind, size: data.size, metadataOnly: true, fileSizes, fileHashes, lineCounts, unsizedFiles: unsized, stale }
   if (data.kind === 'stasis') {
-    details.bundle = Bundle.parse(JSON.stringify(data.bundle))
+    details.bundle = Bundle.fromJSON(data.bundle)
     const paths = details.bundle.sources
     if (paths.size !== fileSizes.size || [...paths.keys()].some((path) => !fileSizes.has(path))) throw new Error('Invalid bundle metadata inventory')
     // A file is hashed exactly when it is source: a resource has bytes and

package/common/bundle-sources.js

@@ -111,11 +111,30 @@ export function bundleSourceOrder(sources) {
 // Directory captures stay out. They are the one entry that is not a
 // file in any encoding, and mounting one puts a second `lib` beside
 // the directory it names.
+// Files as the managed server reads a tarball's (server-managed/npm-packages.ts
+// npmFileRows), `[path, bytes, text]` or `[path, bytes, null, digest]`, as
+// details of `entry` in the shape of a sourcemap carrying its sources: one
+// source per file, text inline, and every file's size from its bytes, so a
+// file that is not text still lists with its size. Those carry a digest of
+// their bytes instead (`npmBinaries`), which Compare compares them by. An npm
+// version's files come so (view/npm-package.js), and a repository
+// directory's (view/repository-code.js).
+export function fileRowDetails(entry, rows) {
+  const files = Array.isArray(rows) ? rows : []
+  return {
+    integrity: entry.integrity, kind: 'sourcemap', size: entry.size,
+    json: { version: 3, sources: files.map(([path]) => path), sourcesContent: files.map(([, , text]) => typeof text === 'string' ? text : null) },
+    fileSizes: new Map(files.map(([path, size]) => [path, size])),
+    npmBinaries: new Map(files.filter(([, , text, digest]) => typeof text !== 'string' && typeof digest === 'string')
+      .map(([path, size, , digest]) => [path, { size, digest }])),
+  }
+}
+
 export function bundleFilesAsMap(details) {
   const key = details?.bundle ?? details?.json
   if (key && filesCache.has(key)) return filesCache.get(key)
   const files = new Map(bundleSourcesAsMap(details))
-  // An npm package's files that are not text (view/npm-package.js) carry
+  // An npm package's files that are not text (fileRowDetails) carry
   // their size and digest alone: enough for Compare to tell a changed one
   // from an unchanged one, as `{ format: 'digest', size, digest }`.
   for (const [path, file] of details?.npmBinaries ?? []) files.set(path, { format: 'digest', ...file })
@@ -263,15 +282,19 @@ export function bundleSourceSizes(details) {
 //
 // Returns null for sourcemap bundles (and anything without parsed
 // modules) — they carry no package metadata, so callers fall back to
-// the path heuristic alone.
+// the path heuristic alone. Kept by the bundle, as its sources are:
+// callers only read it.
+const packageDirsCache = new WeakMap()
 export function bundlePackageDirs(details) {
   if (details?.kind !== 'stasis' || !details.bundle?.modules) return null
+  if (packageDirsCache.has(details.bundle)) return packageDirsCache.get(details.bundle)
   const map = new Map()
   for (const [dir, info] of details.bundle.modules) {
     for (const rel of Object.keys(info.files)) {
       map.set(dir === '.' ? rel : `${dir}/${rel}`, dir)
     }
   }
+  packageDirsCache.set(details.bundle, map)
   return map
 }
 

package/common/default-scan-models.ts

@@ -13,7 +13,7 @@ export function defaultScanModels(provider: string | null = null) {
     'openai/gpt-6-luna',
     'openai/gpt-6-luna-pro',
     'moonshotai/kimi-k3',
-    'google/gemini-3.8-flash',
+    'google/gemini-4-argon',
     'google/gemma-4-31b-it',
     'x-ai/grok-4.7',
     'z-ai/glm-5.3',

package/common/dependency-reviews.d.ts

@@ -16,8 +16,3 @@ export function npmReviewVerdictLimit(npm: ReviewNpmVersion | null | undefined,
   socket?: { alerts: { type: string }[] } | null, risk?: { findings: { id: string }[] } | null): ReviewVerdict
 export function needsPackageJsonReview(entries: { file: string; status: ReviewVerdict | null }[], files: string[], nonTextFiles?: string[] | null): boolean
 export function parseReviewNotes(comment: string): { text: string; bullet: boolean }[]
-export function auditMarkdown(review: ReviewSummary & {
-  package: string; version: string; integrity: string; basePackage: string | null; baseVersion: string | null
-  publishedAt: number | null; revokedAt: number | null; entries: { file: string; comment: string }[]
-  status: ReviewVerdict | null; comment: string
-}): string | null

package/common/dependency-reviews.js

@@ -58,24 +58,7 @@ export function needsPackageJsonReview(entries, files, nonTextFiles = []) {
       || !entries.some(entry => entry.file === 'package.json' && Object.keys(REVIEW_VERDICTS).includes(entry.status)))
 }
 
-const markdownText = text => text.replaceAll(/[\\`*_{}[\]<>]/gu, '\\$&').replaceAll(/\r\n?/gu, '\n').replaceAll('\n', '\n  ')
-
 export function parseReviewNotes(comment) {
   return comment.replaceAll(/\r\n?/gu, '\n').split(/(?:^|\n)[\t ]*\*[\t ]+/u)
     .map((text, index) => ({ text: text.trim(), bullet: index > 0 })).filter(note => note.text)
 }
-
-function auditNotes(comment, prefix = '') {
-  return parseReviewNotes(comment).map(note => `* ${prefix}${note.text.replaceAll('\n', '\n  ')}`)
-}
-
-export function auditMarkdown(review) {
-  if (review.publishedAt === null || review.revokedAt !== null || review.coverage !== 'full'
-    || !['accept', 'accept-with-nits'].includes(review.status)) return null
-  const target = `${review.package} ${review.version} ${review.integrity}`
-  const dependency = review.basePackage === null ? target
-    : review.basePackage === review.package ? `${review.package} ${review.baseVersion} -> ${review.version} ${review.integrity}`
-    : `${review.basePackage} ${review.baseVersion} -> ${target}`
-  const notes = [...review.entries.filter(entry => entry.status).flatMap(entry => auditNotes(entry.comment, `In ${markdownText(entry.file)}: `)), ...auditNotes(review.comment)]
-  return `Audited:\n\`\`\`\n${dependency}\n\`\`\`${notes.length > 0 ? `\n\nNotes:\n${notes.join('\n')}` : ''}`
-}

package/common/line-diff.js

@@ -5,7 +5,7 @@
 //
 // Lines are numbered the way the diff numbers them: from zero, a final
 // newline ending the last line rather than starting an empty one.
-import { diff, parseDiff } from '@preventive/diff'
+import { changeSet } from '@preventive/diff'
 
 export function textLines(text) {
   if (text === '') return []
@@ -25,10 +25,11 @@ const spacing = line => line.replace(/[ \t\n\v\f\r]+$/u, '').replaceAll(/[ \t\n\
 
 // Each `a[a0..a1)` replaced by `b[b0..b1)`. `ignoreWhitespace` is diff -b:
 // lines differing only in how much whitespace they have pair up as unchanged,
-// whitespace added or removed between other characters still a change.
+// whitespace added or removed between other characters still a change. Those
+// a unified diff with no context shows (horizon 0), found without printing
+// one and reading it back.
 export function changeBlocks(before, after, ignoreWhitespace = false) {
-  const text = diff(before, after, { format: 'unified', context: 0, whitespace: ignoreWhitespace ? 'change' : 'none' })
-  return text ? (parseDiff(text)[0]?.blocks ?? []).map(({ a0, a1, b0, b1 }) => ({ a0, a1, b0, b1 })) : []
+  return changeSet(before, after, { horizon: 0, whitespace: ignoreWhitespace ? 'change' : 'none' }).map(({ a0, a1, b0, b1 }) => ({ a0, a1, b0, b1 }))
 }
 
 // Whether `blocks` take `before`'s lines to `after`'s: each in order and apart

package/common/managed/agent-tasks.ts

@@ -0,0 +1,292 @@
+// Agents' sessions and their tasks, reconstructed from what each
+// leaves on GitHub (the code viewer's Agents tab, repository-agents.js): a
+// task is a pull request it opened, or a commit it pushed to the default
+// branch without one; a session holds as many as name it, with the branches
+// they are on and the issues they work on. The server reads each artifact's
+// own texts, never others' comments on it (a pull request's body and its
+// head and merge commits' messages, where an agent links its session; a
+// commit's message; a branch's tip commit) for the marks an agent leaves
+// (agentSignals), sending those alone; agentSessions then groups them:
+// those naming one session, a pull request with its branch, a branch with
+// the session its commits name, an issue with the pull requests closing it
+// or a branch named for it. Without a session named, a branch's pull
+// requests are one session, and a commit its own.
+//
+// The agents are Claude and Codex, and those the server knows by their GitHub
+// Apps or accounts (repository-agents.ts APP_AGENTS): each told by its
+// fingerprint, a line of its texts, by the account its work is authored by,
+// or by its branches' prefix, the server's to read, and named to the client
+// by its id, name and avatar (AppAgent). Such an agent names no session:
+// a pull request of its is a session alone, with its branch; Claude's or
+// Codex's marks on its work show those as its tools. A pull request labelled
+// for an agent (labelAgents) is that agent's too, where its own texts and
+// branch name none: the mark one who ran it gives work it left unmarked.
+
+// 'claude', 'codex', or an app agent's id.
+export type Agent = string
+
+// An agent known by its GitHub App or account, as the server names it to the
+// client: its id, its name, and its avatar, its mark (/api/avatar/<avatar>:
+// `app-<id>` a GitHub App's, `user-<id>` a GitHub account's), where the app
+// draws no mark of its own for it (Copilot's, ui/view/repository-tiles.js).
+export interface AppAgent { id: string; name: string; avatar?: string }
+// How the server tells one: its fingerprint, a line of an artifact's texts
+// starting with it; the GitHub account its work is authored by, its id and
+// the logins GitHub names it by; its branches' prefix.
+export interface AppAgentMarks { id: string; fingerprint?: string; account?: { id: number; logins: readonly string[] }; prefix: string }
+// An artifact's author, as GitHub names its account: its login and id.
+export interface AgentAuthor { login: string; id: number }
+
+// What an artifact's texts say of the agents that made it: the Claude Code
+// sessions and Codex tasks they link, whether they carry Claude's marks,
+// its co-author trailer or its "Generated with" line, and Codex's, its
+// co-author trailer, and the app agents whose fingerprints they carry, or
+// whose branch it is.
+export interface AgentSignals { sessions: string[]; tasks: string[]; claude: boolean; codex: boolean; agents: string[] }
+
+// Each by its author's login, and their account's numeric id (`authorId`)
+// where GitHub names it.
+export interface AgentPull { number: number; title: string; state: 'open' | 'merged' | 'closed'; draft: boolean; author: string | null; authorId?: number | null
+  // Its branch, and the owner of the fork it is in, null where it is in the
+  // repository itself.
+  createdAt: number | null; updatedAt: number | null; head: string | null; fork: string | null; additions: number; deletions: number; commits: number
+  closes: number[]; signals: AgentSignals }
+export interface AgentIssue { number: number; title: string; state: 'open' | 'closed'; author: string | null; authorId?: number | null; createdAt: number | null; updatedAt: number | null }
+export interface AgentBranch { name: string; at: number | null; author: string | null; authorId?: number | null; signals: AgentSignals }
+// A commit to the default branch no pull request merged.
+export interface AgentCommit { oid: string; title: string; at: number | null; author: string | null; authorId?: number | null; additions: number; deletions: number
+  signals: AgentSignals }
+
+export interface AgentSession {
+  id: string
+  agents: Agent[]
+  // Where to open it: a Claude Code session or a Codex task.
+  sessions: string[]
+  tasks: string[]
+  title: string
+  authors: string[]
+  startedAt: number | null
+  updatedAt: number | null
+  state: 'open' | 'merged' | 'closed' | 'branch'
+  // Its tasks: the pull requests it opened, and the commits it pushed to
+  // the default branch, the newest first.
+  pulls: Pick<AgentPull, 'number' | 'title' | 'state' | 'draft'>[]
+  commits: Pick<AgentCommit, 'oid' | 'title'>[]
+  issues: Pick<AgentIssue, 'number' | 'title' | 'state'>[]
+  branches: string[]
+  // The commits its pull requests hold, and their lines and its commits'.
+  commitCount: number
+  additions: number
+  deletions: number
+}
+
+const SESSION = /https:\/\/claude\.ai\/code\/(session_[A-Za-z\d]{6,64})\b/gu
+const CODEX_TASK = /https:\/\/chatgpt\.com\/codex\/tasks\/(task_[a-z]_[A-Za-z\d]{6,64})\b/gu
+// Claude's marks on its commits and pull requests: its co-author trailer,
+// its "Generated with" line, its session trailer.
+const CLAUDE_MARK = /^co-authored-by: claude\b|generated with \[claude code\]|^claude-session:/imu
+// Codex's: its co-author trailer, by its address, as Codex names itself
+// co-author of the commits it makes as whoever ran it; a trailer of a text's
+// trailers (trailerBlock), not a line before them that shows one.
+const CODEX_MARK = /^co-authored-by:[ \t]*[^<\n]*<codex@openai\.com>[ \t]*$/imu
+const MAX_LINKS = 8
+
+// A message's trailers, as git reads them (`git interpret-trailers`): its
+// last paragraph, past its subject's, where each of its lines is a trailer
+// (`Key: value`) or goes on with one (indented), or, where it holds git's
+// own `Signed-off-by:`, a quarter of them are; none where it isn't, as
+// lines a description or example holds, fenced or not, are not.
+const TRAILER_LINE = /^[A-Za-z\d-]+[ \t]*:/u
+export function trailerBlock(text: string): string {
+  const paragraphs = text.replaceAll('\r\n', '\n').trim().split(/\n[ \t]*\n/u)
+  const block = paragraphs.length > 1 ? paragraphs.at(-1)! : ''
+  const lines = block.split('\n')
+  const trailers = lines.filter(line => TRAILER_LINE.test(line)).length
+  const others = lines.filter((line, at) => !TRAILER_LINE.test(line) && !(at > 0 && /^[ \t]/u.test(line))).length
+  return others === 0 || (lines.some(line => /^signed-off-by[ \t]*:/iu.test(line)) && trailers * 3 >= others) ? block : ''
+}
+
+// The agents of those whose ids are `ids` that `labels` name (a pull
+// request's): a label an agent's id, regardless of case, alone or after
+// `agent:` or `agent/` (`Codex`, `agent: claude`).
+const LABEL = /^(?:agent[:/] ?)?([a-z][a-z\d-]*)$/u
+export function labelAgents(labels: unknown[], ids: readonly string[]): Agent[] {
+  return [...new Set(labels.flatMap(label => {
+    const id = typeof label === 'string' ? LABEL.exec(label.trim().toLowerCase())?.[1] : undefined
+    return id !== undefined && ids.includes(id) ? [id] : []
+  }))]
+}
+
+// The sessions and tasks `texts` link, whether they carry Claude's marks and
+// Codex's, and the agents of `apps` whose fingerprints start a line of them
+// (not one a text quotes, as one describing it may), whose account `author`
+// is, by its id and login both, or whose prefix the branch `branch` is under;
+// Claude, Codex or the agents of `apps` its `labels` name (labelAgents).
+export function agentSignals(texts: unknown[], apps: readonly AppAgentMarks[] = [], branch: string | null = null,
+  author: AgentAuthor | null = null, labels: unknown[] = []): AgentSignals {
+  const strings = texts.filter((text): text is string => typeof text === 'string')
+  const found = (pattern: RegExp) => [...new Set(strings.flatMap(text => [...text.matchAll(pattern)].map(match => match[1]!)))].slice(0, MAX_LINKS)
+  const lines = strings.flatMap(text => text.split('\n').map(line => line.trimStart()))
+  const login = author?.login.toLowerCase()
+  const authored = ({ account }: AppAgentMarks) => author !== null && account !== undefined && account.id === author.id
+    && account.logins.some(name => name.toLowerCase() === login)
+  const labelled = labelAgents(labels, ['claude', 'codex', ...apps.map(app => app.id)])
+  return { sessions: found(SESSION), tasks: found(CODEX_TASK), claude: labelled.includes('claude') || strings.some(text => CLAUDE_MARK.test(text)),
+    codex: labelled.includes('codex') || strings.some(text => CODEX_MARK.test(trailerBlock(text))),
+    agents: apps.filter(app => (app.fingerprint && lines.some(line => line.startsWith(app.fingerprint!)))
+      || authored(app) || branch?.startsWith(app.prefix) || labelled.includes(app.id)).map(app => app.id) }
+}
+
+// The agent a branch's name says made it, and the issue or pull request the
+// Claude GitHub App names its branch for (`claude/issue-12-…`).
+export function agentBranch(name: string | null): { agent: Agent | null; issue: number | null; pull: number | null } {
+  const agent = name?.startsWith('claude/') ? 'claude' : name?.startsWith('codex/') ? 'codex' : null
+  const named = agent === 'claude' ? /^claude\/(issue|pr)-([1-9]\d{0,9})-/u.exec(name!) : null
+  return { agent, issue: named?.[1] === 'issue' ? Number(named[2]) : null, pull: named?.[1] === 'pr' ? Number(named[2]) : null }
+}
+
+// A pull request's branch, as GitHub names one in a fork: `owner:branch`;
+// two forks' of one name, or a fork's and the repository's, are two.
+const headName = (pull: AgentPull) => pull.head && pull.fork ? `${pull.fork}:${pull.head}` : pull.head
+
+const signalAgents = (signals: AgentSignals): Agent[] => [...signals.agents, ...signals.sessions.length > 0 || signals.claude ? ['claude'] : [],
+  ...signals.tasks.length > 0 || signals.codex ? ['codex'] : []]
+const TOOLS = new Set(['claude', 'codex'])
+
+type Artifacts = { pulls?: AgentPull[]; commits?: AgentCommit[]; issues?: AgentIssue[]; branches?: AgentBranch[] }
+type Group = { agents: Set<Agent>; keys: string[] }
+
+// The artifacts joined (`pull:<n>`, `commit:<oid>`, `branch:<name>`,
+// `session:<id>`, `task:<id>`), each set with the agents whose marks are on
+// them: by the sessions and tasks they link and the branches pull requests
+// are from. An app agent's join none by what they link, and a pull request
+// of its its branch alone, where no pull request newer is from it, an app
+// agent's or another's: one a session.
+function artifactGroups({ pulls = [], commits = [], branches = [] }: Artifacts): Group[] {
+  const parent = new Map<string, string>()
+  const find = (key: string): string => {
+    let root = key
+    while (parent.has(root) && parent.get(root) !== root) root = parent.get(root)!
+    parent.set(key, root)
+    return root
+  }
+  const join = (a: string, b: string) => {
+    const [x, y] = [find(a), find(b)]
+    if (x !== y) parent.set(y, x)
+  }
+  const agentsOf = new Map<string, Set<Agent>>()
+  const mark = (key: string, agents: Agent[]) => { for (const agent of agents) agentsOf.set(key, new Set([...agentsOf.get(key) ?? [], agent])) }
+  const linked = (key: string, signals: AgentSignals) => {
+    find(key)
+    if (signals.agents.length === 0) for (const session of signals.sessions) join(key, `session:${session}`)
+    if (signals.agents.length === 0) for (const task of signals.tasks) join(key, `task:${task}`)
+    mark(key, signalAgents(signals))
+  }
+  const branchNames = new Set(branches.map(branch => branch.name))
+  for (const branch of branches) {
+    const key = `branch:${branch.name}`
+    linked(key, branch.signals)
+    const { agent } = agentBranch(branch.name)
+    if (agent) mark(key, [agent])
+  }
+  // The newest pull request read from each branch, by its number, as GitHub
+  // numbers them as they are opened: they are read as they were updated.
+  const newest = new Map<string, number>()
+  for (const pull of pulls) {
+    const head = headName(pull)
+    if (head !== null && pull.number > (newest.get(head) ?? 0)) newest.set(head, pull.number)
+  }
+  for (const pull of pulls) {
+    const key = `pull:${pull.number}`
+    linked(key, pull.signals)
+    const { agent, pull: named } = agentBranch(pull.head)
+    if (agent) mark(key, [agent])
+    // Its branch, an agent's or its own, read or not; a fork's its own.
+    const head = headName(pull)
+    if (pull.signals.agents.length > 0) {
+      if (head !== null && newest.get(head) === pull.number) join(key, `branch:${head}`)
+      continue
+    }
+    if (head && (agent || signalAgents(pull.signals).length > 0 || branchNames.has(head))) join(key, `branch:${head}`)
+    if (named) join(key, `pull:${named}`)
+  }
+  for (const commit of commits) linked(`commit:${commit.oid}`, commit.signals)
+
+  const groups = new Map<string, Group>()
+  for (const key of parent.keys()) {
+    const root = find(key)
+    const group = groups.get(root) ?? { agents: new Set(), keys: [] }
+    group.keys.push(key)
+    for (const agent of agentsOf.get(key) ?? []) group.agents.add(agent)
+    groups.set(root, group)
+  }
+  return [...groups.values()]
+}
+
+const byTime = <T>(time: (item: T) => number | null) => (a: T, b: T) => (time(a) ?? 0) - (time(b) ?? 0)
+
+// The session a group of artifacts is, its tasks and what they touched; null
+// for one no agent left marks on, or holding none read.
+function sessionOf({ agents, keys }: Group, { pulls, commits, issues, branches }: {
+  pulls: Map<number, AgentPull>; commits: Map<string, AgentCommit>; issues: Map<number, AgentIssue>; branches: Map<string, AgentBranch> }): AgentSession | null {
+  if (agents.size === 0) return null
+  const of = (prefix: string) => keys.filter(key => key.startsWith(prefix)).map(key => key.slice(prefix.length))
+  const taskPulls = of('pull:').flatMap(number => pulls.get(Number(number)) ?? []).toSorted(byTime(pull => pull.createdAt))
+  const taskCommits = of('commit:').flatMap(oid => commits.get(oid) ?? []).toSorted(byTime(commit => commit.at))
+  const names = [...new Set([...of('branch:'), ...taskPulls.flatMap(pull => headName(pull) ?? [])])]
+  // The issues its pull requests close, and those its branches are named
+  // for, by a pull request's own name for its branch, a fork's too.
+  const issueNumbers = new Set([...taskPulls.flatMap(pull => pull.closes),
+    ...taskPulls.flatMap(pull => agentBranch(pull.head).issue ?? []), ...of('branch:').flatMap(name => agentBranch(name).issue ?? [])])
+  const taskIssues = [...issueNumbers].flatMap(number => issues.get(number) ?? []).toSorted(byTime(issue => issue.createdAt))
+  const taskBranches = names.flatMap(name => branches.get(name) ?? [])
+  const items = [...taskPulls, ...taskCommits, ...taskIssues, ...taskBranches]
+  if (items.length === 0) return null
+  const [codexTasks, sessions] = [of('task:'), of('session:')]
+  const started = items.flatMap(item => ('createdAt' in item ? item.createdAt : item.at) ?? [])
+  const updated = items.flatMap(item => ('updatedAt' in item ? item.updatedAt : item.at) ?? [])
+  const states = new Set(taskPulls.map(pull => pull.state))
+  // Its first task names it: the earliest of its pull requests and commits.
+  const first = [...taskPulls.map(pull => ({ at: pull.createdAt, title: pull.title })), ...taskCommits.map(commit => ({ at: commit.at, title: commit.title }))]
+    .toSorted(byTime(task => task.at))[0]
+  const landed = [...taskPulls, ...taskCommits]
+  return {
+    id: sessions[0] ?? codexTasks[0] ?? (taskPulls[0] ? `pull-${taskPulls[0].number}` : taskCommits[0]?.oid ?? names[0] ?? ''),
+    // An app agent's first, the one whose session it is, then the tools it
+    // used, Claude's or Codex's.
+    agents: [...[...agents].filter(agent => !TOOLS.has(agent)), ...['claude', 'codex'].filter(agent => agents.has(agent))],
+    sessions, tasks: codexTasks,
+    title: first?.title ?? taskIssues[0]?.title ?? names[0] ?? '',
+    authors: [...new Set(items.flatMap(item => item.author ?? []))],
+    startedAt: started.length > 0 ? Math.min(...started) : null,
+    updatedAt: updated.length > 0 ? Math.max(...updated) : null,
+    state: states.has('open') ? 'open' : states.has('merged') || taskCommits.length > 0 ? 'merged' : states.has('closed') ? 'closed' : 'branch',
+    pulls: taskPulls.map(({ number, title, state, draft }) => ({ number, title, state, draft })).toReversed(),
+    commits: taskCommits.map(({ oid, title }) => ({ oid, title })).toReversed(),
+    issues: taskIssues.map(({ number, title, state }) => ({ number, title, state })),
+    branches: names,
+    commitCount: taskPulls.reduce((sum, pull) => sum + pull.commits, 0) + taskCommits.length,
+    additions: landed.reduce((sum, item) => sum + item.additions, 0),
+    deletions: landed.reduce((sum, item) => sum + item.deletions, 0),
+  }
+}
+
+// The sessions `pulls`, `commits`, `issues` and `branches` make, the most
+// recently updated first: each a set of them, joined by the sessions and
+// tasks they link and the branches pull requests are from, with the issues
+// a pull request closes or a branch is named for.
+// Artifacts no agent left marks on belong to none. Where pull requests
+// updated before `branchesSince` are yet to be read, a session of branches
+// alone older than that waits for them: its pull request may be among them.
+export function agentSessions(artifacts: Artifacts, { branchesSince = null }: { branchesSince?: number | null } = {}): AgentSession[] {
+  const lookups = {
+    pulls: new Map((artifacts.pulls ?? []).map(pull => [pull.number, pull])),
+    commits: new Map((artifacts.commits ?? []).map(commit => [commit.oid, commit])),
+    issues: new Map((artifacts.issues ?? []).map(issue => [issue.number, issue])),
+    branches: new Map((artifacts.branches ?? []).map(branch => [branch.name, branch])),
+  }
+  const waiting = (session: AgentSession) => branchesSince !== null && session.pulls.length === 0 && session.commits.length === 0
+    && (session.updatedAt ?? 0) < branchesSince
+  return artifactGroups(artifacts).flatMap(group => sessionOf(group, lookups) ?? []).filter(session => !waiting(session))
+    .toSorted(byTime(session => session.updatedAt)).toReversed()
+}

package/common/managed/github-agents.ts

@@ -0,0 +1,92 @@
+// Agents by their own GitHub accounts, where a repository's activity names
+// them: each its name, and how the app draws it, by its mark, as the Agents
+// tab does (ui/view/provider-icons.js), or by its avatar, which
+// /api/avatar/<avatar> serves (server-managed/repository-agents.ts
+// APP_AGENTS, the Agents tab's marks); its accounts, each by the logins GitHub's REST and GraphQL APIs
+// name it by and its numeric id where known, which GitHub never gives
+// another; and the names its commits carry where GitHub names no account for
+// them. Claude Code's commits are authored as Claude <noreply@anthropic.com>,
+// which GitHub names `claude`; the Claude GitHub App's as `claude[bot]`.
+// Codex's GitHub connector's are its own; Codex otherwise commits as whoever
+// ran it, and those commits are theirs, with a
+// `Co-authored-by: Codex <codex@openai.com>` trailer, an address GitHub
+// names someone else's account for, so Codex is known by the address, not
+// that account. Copilot's coding agent authors its commits as its account,
+// Copilot; Copilot's code review reviews as another, its bot, which GitHub
+// names Copilot as well where it is asked to review and in its threads, and
+// `copilot-pull-request-reviewer` (`[bot]` to GitHub's REST API) on its
+// reviews, the accounts' ids telling the two apart: a login may so be more
+// than one account's. Dependabot, its GitHub App, as its bot,
+// `dependabot` to GitHub's GraphQL API, `dependabot[bot]` to its REST API and
+// in its address. GitHub's Agentic Workflows (gh-aw) post, and approve or
+// review pull requests, as GitHub Actions' bot, `github-actions` (41898282,
+// `[bot]` to the REST API), its mark the GitHub Actions App's avatar; other
+// workflows the bot runs are as much its own. Cursor's agents commit as whoever ran them, with a
+// `Co-authored-by: Cursor Agent <cursoragent@cursor.com>` trailer; the app
+// has no mark of Cursor's, and draws it by its name's letter. Each by the
+// addresses (`emails`) its commits name it by, as author or co-author.
+export interface GithubAgentAccount { id?: number; logins: readonly string[] }
+export interface GithubAgent { name: string; mark?: 'anthropic' | 'openai' | 'github-copilot'; avatar?: string; accounts: readonly GithubAgentAccount[]; names: readonly string[]
+  emails?: readonly string[] }
+
+export const GITHUB_AGENTS = {
+  claude: { name: 'Claude', mark: 'anthropic', accounts: [{ id: 81847, logins: ['claude'] }, { logins: ['claude[bot]'] }], names: ['Claude'], emails: ['noreply@anthropic.com'] },
+  codex: { name: 'Codex', mark: 'openai', accounts: [{ id: 199175422, logins: ['chatgpt-codex-connector', 'chatgpt-codex-connector[bot]'] }], names: ['Codex'],
+    emails: ['codex@openai.com'] },
+  copilot: { name: 'Copilot', mark: 'github-copilot', accounts: [{ id: 198982749, logins: ['Copilot', 'copilot-swe-agent'] },
+    { id: 175728472, logins: ['Copilot', 'copilot-pull-request-reviewer', 'copilot-pull-request-reviewer[bot]'] }], names: ['Copilot'] },
+  dependabot: { name: 'Dependabot', avatar: 'app-29110', accounts: [{ id: 49699333, logins: ['dependabot', 'dependabot[bot]'] }], names: ['dependabot[bot]'] },
+  actions: { name: 'GitHub Actions', avatar: 'app-15368', accounts: [{ id: 41898282, logins: ['github-actions', 'github-actions[bot]'] }], names: ['github-actions[bot]'] },
+  cursor: { name: 'Cursor', accounts: [], names: ['Cursor Agent'], emails: ['cursoragent@cursor.com'] },
+} as const satisfies Record<string, GithubAgent>
+export type GithubAgentId = keyof typeof GITHUB_AGENTS
+
+const agents = Object.entries(GITHUB_AGENTS) as [GithubAgentId, GithubAgent][]
+// Each login's agent, and the ids of the accounts it names, undefined for
+// one whose id the app doesn't know.
+const byLogin = new Map<string, { agent: GithubAgentId; ids: (number | undefined)[] }>()
+for (const [agent, { accounts }] of agents) {
+  for (const { id, logins } of accounts) {
+    for (const login of logins) byLogin.set(login.toLowerCase(), { agent, ids: [...byLogin.get(login.toLowerCase())?.ids ?? [], id] })
+  }
+}
+const byName = new Map(agents.flatMap(([agent, { names }]) => names.map(name => [name.toLowerCase(), agent] as const)))
+const byEmail = new Map(agents.flatMap(([agent, { emails = [] }]) => emails.map(email => [email, agent] as const)))
+
+// The agent whose address `email` is, GitHub matching addresses regardless of
+// case; null for anyone else's.
+export const emailAgent = (email: unknown): GithubAgentId | null => typeof email === 'string' ? byEmail.get(email.trim().toLowerCase()) ?? null : null
+
+// The agent an author is: by their login, GitHub matching logins regardless
+// of case, their account's id the agent's where both are known, so another
+// account GitHub names by the same login (a user's, the bot's GraphQL login
+// may be) is not; for an author GitHub names no account for, by the name
+// they carry. Null for anyone else: a human's account is theirs, whatever
+// their commits name them.
+export function githubAgent(login: string | null, account: number | null = null, name: string | null = null): GithubAgentId | null {
+  if (typeof login !== 'string') return typeof name === 'string' ? byName.get(name.trim().toLowerCase()) ?? null : null
+  const known = byLogin.get(login.toLowerCase())
+  return known && (account === null || known.ids.includes(undefined) || known.ids.includes(account)) ? known.agent : null
+}
+
+// Whether the accounts `ids` a login is named by are all one agent's, as
+// Copilot's coding agent's and its code review's, both named Copilot, are:
+// the login is that agent's whichever it is, rather than no one's.
+export function oneAgent(login: string, ids: Iterable<number>): boolean {
+  const theirs = new Set([...ids].map(id => githubAgent(login, id)))
+  return theirs.size === 1 && !theirs.has(null)
+}
+
+// The accounts agents work as, a person's to GitHub, as the app is told of
+// them, each by its id and logins: the pull requests they open and the
+// commits they push to a branch directly are agents' (the Pulse's,
+// server-managed/agent-merges.ts agentMerges, repository-pulse.ts
+// commitStats), whatever their branches and labels, the rest of what they do
+// theirs. Christopher Turing's.
+export const AGENT_OPERATED = [{ id: 188797125, logins: ['ChristopherTuring'] }] as const satisfies readonly GithubAgentAccount[]
+
+// Whether an author is an account agents work as (AGENT_OPERATED): by its id
+// where GitHub gives it, whatever it is renamed to, else by its login,
+// regardless of case.
+export const agentOperated = (login: string | null, id: number | null = null): boolean => AGENT_OPERATED.some(account => id === null
+  ? typeof login === 'string' && account.logins.some(name => name.toLowerCase() === login.toLowerCase()) : account.id === id)

package/common/managed/github-logins.ts

@@ -0,0 +1,49 @@
+// The GitHub accounts an answer about a repository's activity names (its
+// commits', issues', pull requests', agents' and pulse's): as an author, one
+// who merged or a contributor, by login, and by the account's numeric id
+// where the answer names it beside the login. The server resolves them to the
+// app's users and agents (server-managed/github-users.ts), and the client
+// keeps those it answered with in place of what it held for them
+// (ui/view/github-users.js).
+import { oneAgent } from './github-agents.ts'
+
+// Where answers name a login, each with where the account's id is named
+// beside it.
+const LOGIN_KEYS = new Map([['author', 'authorId'], ['authorLogin', 'authorId'], ['mergedBy', 'mergedById'], ['login', 'id']])
+const LOGIN = /^[A-Za-z\d][A-Za-z\d-]{0,38}(?:\[bot\])?$/u
+const MAX_DEPTH = 8
+const accountId = (value: unknown) => Number.isSafeInteger(value) && (value as number) > 0 ? value as number : null
+
+// The logins `answer` names, each once, with the numeric id of the account
+// named beside them (null where none is, or where those named are all one
+// agent's, oneAgent); `ambiguous` where a login, GitHub matching logins
+// regardless of case, is named beside more than one: by an account GitHub
+// named by it once, as what was kept of the history says, and one it names by
+// it now, which is no telling whose each is.
+export function namedAccounts(answer: unknown): Map<string, number | 'ambiguous' | null> {
+  const named = new Map<string, Set<number>>()
+  collect(answer, named, 0)
+  const ids = new Map<string, Set<number>>()
+  for (const [login, theirs] of named) ids.set(login.toLowerCase(), new Set([...ids.get(login.toLowerCase()) ?? [], ...theirs]))
+  return new Map([...named.keys()].map((login): [string, number | 'ambiguous' | null] => {
+    const theirs = ids.get(login.toLowerCase())!
+    if (theirs.size <= 1) return [login, [...theirs][0] ?? null]
+    return [login, oneAgent(login, theirs) ? null : 'ambiguous']
+  }))
+}
+
+function collect(answer: unknown, named: Map<string, Set<number>>, depth: number): void {
+  if (depth > MAX_DEPTH || answer === null || typeof answer !== 'object') return
+  if (Array.isArray(answer)) {
+    for (const value of answer) collect(value, named, depth + 1)
+    return
+  }
+  const fields = answer as Record<string, unknown>
+  for (const [key, value] of Object.entries(fields)) {
+    const idKey = LOGIN_KEYS.get(key)
+    if (idKey && typeof value === 'string' && LOGIN.test(value)) {
+      const id = accountId(fields[idKey])
+      named.set(value, new Set([...named.get(value) ?? [], ...id === null ? [] : [id]]))
+    } else collect(value, named, depth + 1)
+  }
+}

package/common/managed/roles.ts

@@ -26,3 +26,10 @@ export function roleAtLeast(role: Role, min: Role): boolean {
   const r = ROLES.indexOf(role)
   return r !== -1 && r <= ROLES.indexOf(min)
 }
+
+// Who reads connected repositories' code (the code viewer): a team member,
+// view or above, the server reading only what their team grants reach and
+// their own GitHub account may read. A public link reads none.
+export function canReadRepositoryCode(session: { role: Role; publicShare?: boolean } | null | undefined): boolean {
+  return session != null && !session.publicShare && roleAtLeast(session.role, 'view')
+}