@preventive/triage 1.0.0-alpha.44 → 1.0.0-alpha.46

package/server-e2e/http.ts

@@ -59,6 +59,9 @@ export type HttpServerDeps = {
   handleSaveRest: (req: HttpRequest, res: ServerResponse) => Promise<void>
   restPutIdleTimeoutMs: number
   debug: boolean
+  // Serve the static UI bundle (default). False serves only the API and
+  // never reads `out/`, for hosts that serve the UI themselves.
+  ui?: boolean
 }
 
 // `POST /api/sync/save` dispatch. Returns the in-flight handler promise when
@@ -114,12 +117,12 @@ function dispatchSaveRest(
 }
 
 export function createHttpServer(deps: HttpServerDeps): Server {
-  const { wss, restDeps, sseServer, serverInfo, isOriginAllowed, isShuttingDown, track, handleSaveRest, restPutIdleTimeoutMs, debug } = deps
+  const { wss, restDeps, sseServer, serverInfo, isOriginAllowed, isShuttingDown, track, handleSaveRest, restPutIdleTimeoutMs, debug, ui = true } = deps
   // Static-file plane (see ./static.ts). The directory is the
   // `build.js build` output sibling to this file; the loader handles
   // enumeration, pre-compression, and ETag derivation. Plugged in after
   // the `/api/objstore/...` REST branch.
-  const handleStatic = loadStatic(fileURLToPath(new URL('../out', import.meta.url)), serverInfo.deepviewScanServer ?? null)
+  const handleStatic = ui ? loadStatic(fileURLToPath(new URL('../out', import.meta.url)), serverInfo.deepviewScanServer ?? null) : () => false
 
   const httpServer = createServer((req: HttpRequest, res: ServerResponse) => {
     // Static mode probe: GET /api/config → this server's `server-info` as JSON.

package/server-managed/agent-merges.ts

@@ -0,0 +1,198 @@
+// The commits agents' pull requests brought to a repository's default
+// branch, for its Pulse (repository-pulse.ts commitStats): an agent that
+// commits as whoever ran it (Codex's own) leaves its commits no mark, its
+// pull request's branch alone naming it (app-agents.ts
+// AGENT_BRANCH_PREFIXES), or a label one who ran it gave it naming the agent
+// (agent-tasks.ts labelAgents), as the Agents tab tells an agent's work; or
+// its author, an account agents work as (github-agents.ts AGENT_OPERATED).
+import { labelAgents } from '../common/managed/agent-tasks.ts'
+import { GITHUB_AGENTS, agentOperated } from '../common/managed/github-agents.ts'
+import { AGENT_BRANCH_PREFIXES, APP_AGENTS } from './app-agents.ts'
+import { type HistoryCommit, githubGraphql } from './repository-history.ts'
+
+// The merged pull requests read an answer, a page a query, as many queries
+// as MERGED_QUERIES, the rest left for the next to ask; of each, as many of
+// its latest commits as MERGED_COMMITS.
+const MERGED_PAGE = 100
+const MERGED_QUERIES = 5
+const MERGED_COMMITS = 100
+// Of each, as many labels as MERGED_LABELS, GitHub's most a page, a label
+// naming any agent the app knows making it an agent's.
+const MERGED_LABELS = 100
+// How long before or after a pull request rebased onto the branch was merged
+// its copies are committed.
+const REBASE_SKEW_MS = 10 * 60_000
+const LABEL_AGENTS = [...new Set([...Object.keys(GITHUB_AGENTS), ...APP_AGENTS.map(agent => agent.id)])]
+const SHA = /^[a-f\d]{40}$/u
+
+const count = (value: unknown) => Number.isSafeInteger(value) && (value as number) >= 0 ? value as number : 0
+const timeOf = (value: unknown) => {
+  const at = typeof value === 'string' ? Date.parse(value) : Number.NaN
+  return Number.isSafeInteger(at) ? at : null
+}
+
+// The agents' pull requests merged since a year's start, as read so far
+// (agentMerges): the commits each brought, and when it was merged; those
+// rebased onto the branch by their last commit there, when merged, and
+// their commits' subjects, the oldest first (agentCommits); when the newest
+// read was last updated, those updated since read again (`through`, null
+// till all are read once); and a read not finished: where it goes on
+// (`after`), when the newest it began with was updated (`from`), the oldest
+// it reads to (`stop`) and how many it has read (`read`). And of every pull
+// request merged, an agent's or not, its merge commit and when (`pulls`),
+// and one rebased so (`pullRebases`), for the commits pushed to the branch
+// directly to be told (directCommits).
+export interface AgentMerges { merges: [string, number][]; rebases: Rebase[]; through: number | null
+  next: { after: string; from: number; stop: number; read: number } | null; pulls?: [string, number][]; pullRebases?: Rebase[] }
+// A pull request rebased onto the branch: its last commit there, when it was
+// merged, its latest commits' subjects, the oldest first, and how many more
+// it had than those read (`more`).
+type Rebase = [sha: string, at: number, subjects: string[], more?: number]
+
+const MERGED_QUERY = `query($owner: String!, $name: String!, $after: String) {
+  repository(owner: $owner, name: $name) {
+    pullRequests(states: MERGED, first: ${MERGED_PAGE}, after: $after, orderBy: { field: UPDATED_AT, direction: DESC }) {
+      pageInfo { hasNextPage endCursor }
+      nodes { updatedAt mergedAt headRefName author { login ... on User { databaseId } } labels(first: ${MERGED_LABELS}) { nodes { name } }
+        mergeCommit { oid parents { totalCount } }
+        commits(last: ${MERGED_COMMITS}) { totalCount nodes { commit { oid messageHeadline changedFilesIfAvailable } } } }
+    }
+  }
+}`
+type MergedPage = { repository?: { pullRequests?: { pageInfo?: { hasNextPage?: unknown; endCursor?: unknown }
+  nodes?: ({ updatedAt?: unknown; mergedAt?: unknown; headRefName?: unknown; author?: { login?: unknown; databaseId?: unknown } | null
+    labels?: { nodes?: ({ name?: unknown } | null)[] } | null
+    mergeCommit?: { oid?: unknown; parents?: { totalCount?: unknown } | null } | null
+    commits?: { totalCount?: unknown; nodes?: ({ commit?: { oid?: unknown; messageHeadline?: unknown; changedFilesIfAvailable?: unknown } | null } | null)[] } | null
+  } | null)[] } | null } | null }
+const agentBranch = (name: unknown) => typeof name === 'string' && AGENT_BRANCH_PREFIXES.some(prefix => name.startsWith(prefix))
+type MergedNode = NonNullable<NonNullable<NonNullable<NonNullable<MergedPage['repository']>['pullRequests']>['nodes']>[number]>
+// Whether a pull request is an agent's: by its branch, a label naming one,
+// or its author, an account agents work as.
+const agentPull = ({ headRefName, labels, author }: MergedNode) => agentBranch(headRefName)
+  || labelAgents((labels?.nodes ?? []).map(label => label?.name), LABEL_AGENTS).length > 0
+  || agentOperated(typeof author?.login === 'string' ? author.login : null, Number.isSafeInteger(author?.databaseId) ? author!.databaseId as number : null)
+
+// The commits the pull requests merged since `since` from an agent's branch,
+// labelled for one, or opened by an account agents work as, brought: each its merge commit, a squash merge's one
+// commit; where it was
+// merged with a merge commit, which a year counts none of, its own commits,
+// its latest MERGED_COMMITS; and of one of more commits whose merge commit
+// has one parent, its commits' subjects, for those it was rebased as to be
+// told by (agentCommits), those of its empty commits left out, as a rebase
+// leaves them. Those merged are read the most recently updated
+// first (a pull request is updated when merged, or after), on from what was
+// `kept`: till one updated before the year, or before the newest read before
+// was, as many queries an answer as MERGED_QUERIES, a read not finished
+// going on from where it was left by the next; one read again whose label
+// no longer names an agent, what it was read to bring forgotten.
+export async function agentMerges(fullName: string, token: string, since: number, kept: AgentMerges | null,
+  fetchImpl: typeof fetch = globalThis.fetch): Promise<AgentMerges> {
+  const [owner, name] = fullName.split('/') as [string, string]
+  const merges = new Map((kept?.merges ?? []).filter(([, at]) => at >= since))
+  const rebases = new Map((kept?.rebases ?? []).filter(([, at]) => at >= since).map(([sha, at, subjects, more = 0]) => [sha, [at, subjects, more] as const]))
+  const pulls = new Map((kept?.pulls ?? []).filter(([, at]) => at >= since))
+  const pullRebases = new Map((kept?.pullRebases ?? []).filter(([, at]) => at >= since).map(([sha, at, subjects, more = 0]) => [sha, [at, subjects, more] as const]))
+  const stop = kept?.next?.stop ?? Math.max(since, kept?.through ?? since)
+  const listed = (map: typeof rebases) => [...map].map(([sha, [at, subjects, more]]): Rebase => more > 0 ? [sha, at, subjects, more] : [sha, at, subjects])
+  const result = (through: number | null, next: AgentMerges['next']): AgentMerges => ({ merges: [...merges], rebases: listed(rebases), through, next,
+    pulls: [...pulls], pullRebases: listed(pullRebases) })
+  let { after = null, from = null, read = 0 }: { after?: string | null; from?: number | null; read?: number } = kept?.next ?? {}
+  for (let queries = 0; queries < MERGED_QUERIES; queries++) {
+    const page = (await githubGraphql(MERGED_QUERY, { owner, name, after }, token, fetchImpl) as MergedPage | null)?.repository?.pullRequests
+    let done = page?.pageInfo?.hasNextPage !== true || typeof page.pageInfo.endCursor !== 'string'
+    for (const node of page?.nodes ?? []) {
+      const updated = timeOf(node?.updatedAt)
+      if (updated === null) continue
+      if (updated < stop) { done = true; break }
+      from ??= updated
+      read++
+      const [merged, merge] = [timeOf(node?.mergedAt), node?.mergeCommit?.oid]
+      if (!node || merged === null || merged < since || typeof merge !== 'string' || !SHA.test(merge)) continue
+      const own = (node.commits?.nodes ?? []).map(item => item?.commit)
+      const merging = count(node.mergeCommit?.parents?.totalCount) > 1
+      const brought = [merge, ...merging ? own.map(commit => commit?.oid) : []].filter((oid): oid is string => typeof oid === 'string' && SHA.test(oid))
+      const copied = own.filter(commit => commit?.changedFilesIfAvailable !== 0)
+      // Of one of more commits than its latest read, how many more it had.
+      const more = Math.max(0, count(node.commits?.totalCount) - own.length)
+      const subjects = !merging && (copied.length > 1 || more > 0) && copied.length > 0 && copied.every(commit => typeof commit?.messageHeadline === 'string')
+        ? copied.map(commit => commit!.messageHeadline as string) : null
+      pulls.set(merge, merged)
+      if (subjects) pullRebases.set(merge, [merged, subjects, more])
+      // One an agent's no more, its label taken off (which updates it), what
+      // it was read to bring none of an agent's.
+      if (!agentPull(node)) {
+        for (const oid of brought.filter(sha => merges.get(sha) === merged)) merges.delete(oid)
+        if (rebases.get(merge)?.[0] === merged) rebases.delete(merge)
+        continue
+      }
+      for (const oid of brought) merges.set(oid, merged)
+      if (subjects) rebases.set(merge, [merged, subjects, more])
+    }
+    if (done) return result(from ?? stop, null)
+    after = page!.pageInfo!.endCursor as string
+  }
+  return result(kept?.through ?? null, { after: after!, from: from ?? stop, stop, read })
+}
+
+// Whether two reads of the pull requests merged (agentMerges) bring the
+// same commits, the agents' and every one's (`pulls`, `pullRebases`, which
+// tell those pushed directly), whatever order each read them in.
+export function sameMerges(a: AgentMerges, b: AgentMerges) {
+  const sorted = (entries: unknown[] = []) => entries.map(entry => JSON.stringify(entry)).toSorted()
+  const brought = (read: AgentMerges) => JSON.stringify([read.merges, read.rebases, read.pulls, read.pullRebases].map(sorted))
+  return brought(a) === brought(b)
+}
+
+// A commit's subject as GitHub heads its message: whole, or, past what it
+// shows, cut short before an ellipsis.
+const headed = (subject: string, headline: string) => headline.endsWith('…') ? subject.startsWith(headline.slice(0, -1)) : subject === headline
+
+// The commits of `commits` (a year's) the agents' pull requests brought
+// (`read`, agentMerges): those it names, and of one rebased, its commits'
+// copies, the last and those below it on their first parents, as long as
+// each one's subject is that of one of its commits older than the last
+// matched, as Commits tells a rebase (repository-history.ts squashedPulls),
+// past those of its commits the rebase left none of (an empty one GitHub
+// counted no files of), and, past them all, as many more as it had before
+// its latest read; a squash merge's one commit alone, its subject the pull
+// request's own.
+export function agentCommits(read: AgentMerges, commits: HistoryCommit[]): Set<string> {
+  const shas = new Set(read.merges.map(([sha]) => sha))
+  const bySha = new Map(commits.map(commit => [commit.sha, commit]))
+  for (const [last, merged, subjects, more = 0] of read.rebases) {
+    let commit = bySha.get(last)
+    let at = subjects.length - 1
+    for (; commit && at >= 0; commit = bySha.get(commit.parents[0] ?? '')) {
+      const [copied, upTo] = [commit, at]
+      const found = subjects.findLastIndex((subject, index) => index <= upTo && headed(copied.subject, subject))
+      if (found < 0) break
+      shas.add(commit.sha)
+      at = found - 1
+    }
+    // Each of its latest commits read copied, as many as it had before them
+    // the commits below, on their first parents, as long as each was
+    // committed as it was merged, as a rebase commits its copies: not past
+    // its first, its empty ones, which a rebase leaves out, counted too.
+    const copiedAsMerged = (when: number | null) => when !== null && Math.abs(when - merged) <= REBASE_SKEW_MS
+    for (let rest = at < 0 ? more : 0; commit && rest > 0 && copiedAsMerged(commit.committedAt); rest--, commit = bySha.get(commit.parents[0] ?? '')) {
+      shas.add(commit.sha)
+    }
+  }
+  return shas
+}
+
+// The commits of `commits` (a year's, from the branch's `head`) pushed to
+// it directly: on its first parents from the head, none a merge, none a
+// pull request brought (`read.pulls`: its merge commit, a squash's one
+// commit, or the copies of one rebased onto it, as agentCommits tells
+// them); those a merge brought from its other parents, not.
+export function directCommits(read: AgentMerges, commits: HistoryCommit[], head: string): Set<string> {
+  const pulled = agentCommits({ ...read, merges: read.pulls ?? [], rebases: read.pullRebases ?? [] }, commits)
+  const bySha = new Map(commits.map(commit => [commit.sha, commit]))
+  const direct = new Set<string>()
+  for (let commit = bySha.get(head); commit; commit = bySha.get(commit.parents[0] ?? '')) {
+    if (commit.parents.length <= 1 && !pulled.has(commit.sha)) direct.add(commit.sha)
+  }
+  return direct
+}

package/server-managed/app-agents.ts

@@ -0,0 +1,30 @@
+// The agents the server knows by their GitHub Apps or accounts (the Agents
+// tab's, server-managed/repository-agents.ts, whose marks the Commits tab
+// reads on commits too, repository-history.ts).
+import type { AppAgent, AppAgentMarks } from '../common/managed/agent-tasks.ts'
+import { GITHUB_AGENTS } from '../common/managed/github-agents.ts'
+
+// The agents known by their GitHub Apps or accounts, beside Claude and
+// Codex: each its id and name, its avatar (its mark, served by
+// /api/avatar/<avatar>, for these alone: a GitHub App's, `app-<id>`, or
+// account's, `user-<id>`), the fingerprint it leaves as a line of its pull
+// requests' bodies and its commits' messages, the account its work is
+// authored by (its id and the logins GitHub names it by, told by both), and
+// its branches' prefix. Their work may carry Claude's or
+// Codex's marks too, those its tools. Copilot's coding agent opens its pull
+// requests and authors its commits as its account, Copilot (198982749), on
+// `copilot/` branches; Dependabot, its GitHub App (29110), opens its pull
+// requests as its account, `dependabot` (49699333, `dependabot[bot]` to
+// GitHub's REST API and in its address), on `dependabot/<ecosystem>/…`
+// branches. Their accounts and marks are those the app draws their work by
+// wherever it shows it (common/managed/github-agents.ts): Copilot's its own,
+// the app's to draw, no avatar.
+const { copilot, dependabot } = GITHUB_AGENTS
+export const APP_AGENTS: readonly (AppAgent & AppAgentMarks)[] = [
+  { id: 'neo', name: 'Neo', avatar: 'app-3115942', fingerprint: '🤖 Generated with [Neo](', prefix: 'neo/' },
+  { id: 'copilot', name: copilot.name, account: copilot.accounts[0], prefix: 'copilot/' },
+  { id: 'dependabot', name: dependabot.name, avatar: dependabot.avatar, account: dependabot.accounts[0], prefix: 'dependabot/' },
+]
+// The prefixes of the branches agents work on: Claude Code's and Codex's,
+// and the app agents'.
+export const AGENT_BRANCH_PREFIXES = ['claude/', 'codex/', ...APP_AGENTS.map(agent => agent.prefix)]

package/server-managed/avatar-store.ts

@@ -9,4 +9,5 @@ export interface CachedAvatar {
 export interface AvatarStore {
   put(id: string, contentType: string, bytes: Buffer): Promise<void>
   get(id: string): Promise<CachedAvatar | null>
+  delete(id: string): Promise<void>
 }

package/server-managed/bundle-cache.ts

@@ -24,11 +24,17 @@ export type BundleCacheRecord = Pick<ManagedBundle, 'id' | 'integrity' | 'filena
 export interface BundleSummary { files: number; codeFiles: number; lines: number; commit?: string; stasisVersion?: number; versionedPackages?: number }
 
 export async function readBundleDetails(record: BundleCacheRecord, store: BundleStore) {
+  return (await readSizedBundleDetails(record, store))?.details ?? null
+}
+
+// As readBundleDetails, with the bytes the bundle decoded to: about what
+// holding its details takes.
+export async function readSizedBundleDetails(record: BundleCacheRecord, store: BundleStore) {
   const bytes = await store.get(record.id, record.kind)
   if (!bytes) return null
   const decoded = record.kind === 'stasis' || record.kind === 'sourcemap' ? await decompress(bytes, { maxOutputLength: MAX_DECODED_BYTES }) : bytes
   if (decoded.length > MAX_DECODED_BYTES) throw new Error('Decoded bundle too large')
-  return parseBundleContents(decodeUtf8(decoded), { integrity: record.integrity, kind: record.kind, size: record.byteSize })
+  return { details: parseBundleContents(decodeUtf8(decoded), { integrity: record.integrity, kind: record.kind, size: record.byteSize }), decodedBytes: decoded.length }
 }
 
 export interface BundleCacheStorage {

package/server-managed/combined.ts

@@ -10,13 +10,13 @@ import { loadManagedConfig } from './config.ts'
 import { LOGIN_PATH } from './github-oauth.ts'
 import { createManagedApp, logManagedStartup } from './index.ts'
 
-export async function init(mode: 'managed+e2e' | 'e2e+managed'): Promise<Server> {
+export async function init(mode: 'managed+e2e' | 'e2e+managed', { ui = true }: { ui?: boolean } = {}): Promise<Server> {
   const config = loadManagedConfig({ combined: true })
   const e2eConfig = loadConfig()
   if (!e2eConfig.neonUrl && !config.neonUrl && config.dbPath !== ':memory:' && resolve(config.dbPath) === resolve(e2eConfig.dbPath)) {
     throw new Error('MANAGED_DB_PATH must differ from e2e DB_PATH in combined mode.')
   }
-  const e2e = await createE2eApp(e2eConfig)
+  const e2e = await createE2eApp(e2eConfig, { ui })
   // Replace the assembled server's single
   // request listener; adding a second would write two responses per request.
   const handlers = e2e.httpServer.listeners('request')
@@ -25,6 +25,7 @@ export async function init(mode: 'managed+e2e' | 'e2e+managed'): Promise<Server>
   const managed = await createManagedApp(config, {
     next: e2e.handleRequest,
     isShuttingDown: e2e.isShuttingDown,
+    ui,
     serverInfo: {
       mode, managed: { loginPath: LOGIN_PATH, cookieName: config.sessionCookieName },
       ...(e2eConfig.deepviewScanServer ? { deepviewScanServer: e2eConfig.deepviewScanServer } : {}),

package/server-managed/commit-coauthors.ts

@@ -0,0 +1,83 @@
+// Who made a commit beside its author, as the Commits tab shows them
+// (repository-history.ts): its co-authors, as its `Co-authored-by:` trailers
+// name them, and the agents its message marks.
+import { agentSignals, trailerBlock } from '../common/managed/agent-tasks.ts'
+import { GITHUB_AGENTS, type GithubAgentId, emailAgent, githubAgent } from '../common/managed/github-agents.ts'
+import { APP_AGENTS } from './app-agents.ts'
+import { type NamedAccount, commitAccount } from './github-accounts.ts'
+
+export const MAX_COAUTHORS = 3
+// The rules co-authors are read by, the agents' addresses and names among
+// them: what was kept read by others (history pages, squashed pull requests)
+// read again by these, once raised.
+export const COAUTHORS_READ = 2
+const MAX_NAME = 256
+const textOf = (value: unknown, max: number) => typeof value === 'string' && value.trim() ? value.trim().slice(0, max) : null
+
+// One who made a commit beside its author: by name and account, as its
+// author is, and the agent it is where known, one GitHub knows by its account
+// or its commits' address or name (common/managed/github-agents.ts) or one
+// the server knows by its app (app-agents.ts), with its avatar.
+export interface Coauthor { name: string | null; login: string | null; id: number | null; agent?: string; avatar?: string }
+
+// `Co-authored-by: <name> <address>` trailers, GitHub matching the key
+// regardless of case; Cursor's agents' links, as their work carries them;
+// the app agents known by the fingerprints they leave.
+const COAUTHOR_TRAILER = /^co-authored-by:[ \t]*([^<\n]*?)[ \t]*<([^<>\s]+)>[ \t]*$/gimu
+const CURSOR_AGENT = /https:\/\/cursor\.com\/(?:agents\?id=|background-agent\?bcId=)bc-/u
+const FINGERPRINTED = APP_AGENTS.filter(agent => agent.fingerprint)
+
+// One named as a commit's author or co-author: by name, the address its
+// commit gives (where it is read), and account.
+export type Maker = { name: unknown; email?: unknown; account: NamedAccount }
+
+// The agent one who made a commit is: by their account, else the address
+// their commit names them by; else, GitHub naming no account for them, by
+// their name.
+const makerAgent = ({ name, email, account }: Maker): GithubAgentId | null => githubAgent(account.login, account.id) ?? emailAgent(email)
+  ?? (account.login ? null : githubAgent(null, null, typeof name === 'string' ? name : null))
+
+// Who made a commit, past its author (`author`), as its message names them:
+// its co-authors, those GitHub's GraphQL API lists past the author (`listed`,
+// the addresses its `Co-authored-by:` trailers give, by the accounts GitHub
+// knows them by), else its trailers (agent-tasks.ts trailerBlock), an account's no-reply
+// address naming it;
+// then the agents it marks, Claude's and Codex's as the Agents tab reads them
+// (agent-tasks.ts agentSignals: their sessions' and tasks' links, Claude's
+// co-author and "Generated with" lines), the app agents' by their
+// fingerprints, Cursor's by its agents' links. Each the agent it is where
+// known, and once, the author none of them, as many as MAX_COAUTHORS: two
+// are one by the first of their agent, account, address and name both name,
+// two people of one name with accounts or addresses of their own two.
+export function coauthorsOf(message: unknown, author: Maker, listed: Maker[] | null = null): Coauthor[] {
+  const text = typeof message === 'string' ? message.replaceAll('\r\n', '\n') : ''
+  const named = listed ?? [...trailerBlock(text).matchAll(COAUTHOR_TRAILER)].map(([, name, email]) => ({ name, email, account: commitAccount({ email }) }))
+  const signals = agentSignals([text], FINGERPRINTED)
+  const marked = [...signals.claude || signals.sessions.length > 0 ? ['claude'] : [], ...signals.tasks.length > 0 || signals.codex ? ['codex'] : [],
+    ...CURSOR_AGENT.test(text) ? ['cursor'] : [], ...signals.agents]
+  type Identity = { agent: string | null; login: string | null; email: string | null; name: string | null }
+  const identity = (agent: string | null, login: string | null, name: string | null, email: unknown = null): Identity => ({ agent, login: login?.toLowerCase() ?? null,
+    email: typeof email === 'string' && email.trim() ? email.trim().toLowerCase() : null, name: name?.toLowerCase() ?? null })
+  const same = (a: Identity, b: Identity) => a.agent && b.agent ? a.agent === b.agent : a.login && b.login ? a.login === b.login
+    : a.email && b.email ? a.email === b.email : a.name !== null && a.name === b.name
+  const seen = [identity(makerAgent(author), author.account.login, textOf(author.name, MAX_NAME), author.email)]
+  const coauthors: Coauthor[] = []
+  const add = (coauthor: Coauthor, email: unknown = null) => {
+    const who = identity(coauthor.agent ?? null, coauthor.login, coauthor.name, email)
+    if (seen.some(other => same(other, who)) || coauthors.length >= MAX_COAUTHORS || (!coauthor.login && !coauthor.name && !coauthor.agent)) return
+    seen.push(who)
+    coauthors.push(coauthor)
+  }
+  for (const maker of named) {
+    const agent = makerAgent(maker)
+    // An agent known by its address where GitHub names someone else's
+    // account for it (Codex's), as itself, not that account.
+    const { login, id } = agent && maker.account.login && githubAgent(maker.account.login, maker.account.id) !== agent ? { login: null, id: null } : maker.account
+    add({ name: textOf(maker.name, MAX_NAME), login, id, ...agent ? { agent } : {} }, maker.email)
+  }
+  for (const agent of marked) {
+    const app = APP_AGENTS.find(known => known.id === agent && !Object.hasOwn(GITHUB_AGENTS, known.id))
+    add({ name: app?.name ?? GITHUB_AGENTS[agent as GithubAgentId].name, login: null, id: null, agent, ...app?.avatar ? { avatar: app.avatar } : {} })
+  }
+  return coauthors
+}

package/server-managed/commit-lockfiles.ts

@@ -0,0 +1,72 @@
+// The versions a repository's lockfiles of npm's ecosystem lock at a commit,
+// as their review reads them (pull-dependency-reviews.ts): every lockfile
+// there (findRepoLockfiles) a review holds to (`held`, lockfile-scope.ts),
+// read as a pull request's are (pull-dependencies.ts readLockfile, kept in
+// this instance by the commit and path), as many as MAX_LOCKFILES of those,
+// each's versions (`lockfiles`), and those its reader refuses, of Bun's, or
+// past MAX_LOCKFILES (`unread`), as many read at once as READ_AT_ONCE; and
+// those of some of them (lockedIn), each version once by what its reviews
+// are held to (lockedWith), dev only where it is wherever it is locked.
+// GitHub having none of a lockfile it lists there fails the whole, as it
+// would for any file.
+import { createClient } from '@preventive/upstream/github.js'
+import { upstreamGithub } from './github-errors.ts'
+import { GithubApiError } from './github-app.ts'
+import type { LockedPackage } from './locked-packages.ts'
+import { type Lru, lru } from './lru.ts'
+import { eachOf, lockedWith, lockfileFormat, lockfileHeld, readLockfile } from './pull-dependencies.ts'
+
+export const MAX_LOCKFILES = 100
+const READ_AT_ONCE = 4
+
+export interface CommitLockfiles { lockfiles: { path: string; packages: LockedPackage[] }[]; unread: string[] }
+// Set where GitHub was asked for what a read reads (`github`), not all of it
+// held in this instance.
+export interface GithubAsked { github: boolean }
+
+// The lockfiles at commit `sha` its review reads, by their paths, each with
+// its format (pull-dependencies.ts lockfileFormat), kept by the commit;
+// `asked` told where GitHub was.
+const listings: Lru<{ path: string; format: NonNullable<ReturnType<typeof lockfileFormat>> }[]> = lru(20_000, listed => listed.length + 1)
+export async function lockfilesAt(fullName: string, token: string, sha: string, asked?: GithubAsked) {
+  const key = `${fullName}\0${sha}`
+  const known = listings.get(key)
+  if (known) return known
+  if (asked) asked.github = true
+  const { lockfiles } = await upstreamGithub(() => createClient({ token, userAgent: 'deepview-triage' }).findRepoLockfiles({ repo: fullName, sha }))
+  const listed = lockfiles.flatMap(({ path }) => { const format = lockfileFormat(path); return format ? [{ path, format }] : [] })
+  listings.set(key, listed)
+  return listed
+}
+
+export async function lockedAt(fullName: string, token: string, sha: string, held: (path: string) => boolean = () => true, asked?: GithubAsked): Promise<CommitLockfiles> {
+  const listed = (await lockfilesAt(fullName, token, sha, asked)).filter(({ path }) => held(path))
+  const unread = listed.slice(MAX_LOCKFILES).map(({ path }) => path)
+  const lockfiles: CommitLockfiles['lockfiles'] = []
+  const reading = listed.slice(0, MAX_LOCKFILES)
+  if (asked && reading.some(lockfile => !lockfileHeld(fullName, sha, lockfile))) asked.github = true
+  const reads = await eachOf(reading, READ_AT_ONCE, lockfile => readLockfile(fullName, token, sha, lockfile))
+  for (const [at, lockfile] of reading.entries()) {
+    const read = reads[at]!
+    if ('error' in read && read.error === 'github-not-found') throw new GithubApiError(404, 'github-not-found')
+    if ('error' in read) unread.push(lockfile.path)
+    else lockfiles.push({ path: lockfile.path, packages: read.packages })
+  }
+  return { lockfiles, unread: unread.toSorted() }
+}
+
+// The versions those of `read`'s lockfiles `held` holds to lock, each once,
+// and their paths.
+export function lockedIn(read: CommitLockfiles, held: (path: string) => boolean = () => true) {
+  const packages = new Map<string, LockedPackage>()
+  const paths: string[] = []
+  for (const lockfile of read.lockfiles.filter(({ path }) => held(path))) {
+    paths.push(lockfile.path)
+    for (const pkg of lockfile.packages) {
+      const kept = packages.get(lockedWith(pkg))
+      if (!kept) packages.set(lockedWith(pkg), { ...pkg })
+      else if (kept.dev && !pkg.dev) delete kept.dev
+    }
+  }
+  return { packages: [...packages.values()], paths }
+}

package/server-managed/config.ts

@@ -42,6 +42,11 @@ export interface ManagedConfig {
   cookieSecure: boolean
   sessionCookieName: string
   sessionTtlMs: number
+  // How long GitHub's answer on a user's access to a repository (its
+  // visibility, their permission) is kept for that user and repository
+  // (repository-browser.ts), asked again past it; 0 asks on every request
+  // (MANAGED_REPOSITORY_ACCESS_CACHE_MS, five minutes by default).
+  repositoryAccessCacheMs: number
   // Optional installation credentials for the same GitHub App as login.
   // Repository permissions are approved when connecting repositories.
   githubAppId: string | null
@@ -140,6 +145,7 @@ export function loadManagedConfig({ combined = false } = {}): ManagedConfig {
     cookieSecure,
     sessionCookieName,
     sessionTtlMs: intEnv('SESSION_TTL_MS', 1_209_600_000, 60_000, 7_776_000_000),
+    repositoryAccessCacheMs: intEnv('MANAGED_REPOSITORY_ACCESS_CACHE_MS', 300_000, 0, 3_600_000),
     githubAppId: env['GITHUB_APP_ID'] ?? null,
     githubAppPrivateKey: normalizePem(env['GITHUB_APP_PRIVATE_KEY']),
     githubAppSlug: env['GITHUB_APP_SLUG'] ?? null,