@preventive/triage 1.0.0-alpha.44 → 1.0.0-alpha.46

package/server-managed/rename-diff.ts

@@ -179,7 +179,10 @@ export async function renameDiffOf(request: RenameDiffRequest, texts: () => Prom
   return opened(await answerOf(request, texts, keep))
 }
 
-async function answerOf(request: RenameDiffRequest, texts: () => Promise<[string, string]>, keep: boolean): Promise<Buffer> {
+// Sides `verified` to be the files the request names (renamedPairs) are read
+// only where no answer is kept or on its way; others are read first, as
+// reading them checks they are.
+async function answerOf(request: RenameDiffRequest, texts: () => Promise<[string, string]>, keep: boolean, verified = false): Promise<Buffer> {
   // Sides not kept are formatted again for each diff (pretty-print.ts), so
   // they are read in its turn: the files a Diff view asks for at once wait
   // here rather than being refused by the formats running. Within its minute
@@ -193,21 +196,27 @@ async function answerOf(request: RenameDiffRequest, texts: () => Promise<[string
     })
     return encoded(diff, request, sides)
   }
-  const [before, after] = await texts()
   // A file's type is part of how it is read: the same text as a script and as a module differ.
   const key = `${request.base.hash}\0${request.base.extension}\0${request.other.hash}\0${request.other.extension}`
-  const found = kept.get(key)
-  if (found) {
-    kept.delete(key)
-    kept.set(key, found)
-    return found
+  const held = () => {
+    const found = kept.get(key)
+    if (found) {
+      kept.delete(key)
+      kept.set(key, found)
+    }
+    return found ?? pending.get(key)
   }
-  let job = pending.get(key)
-  if (!job) {
-    const deadline = Date.now() + DIFF_TIMEOUT_MS
-    pending.set(key, job = inTurn(deadline, () => inWorker(before, after, request, deadline)).then(diff => encoded(diff, request, [before, after])).finally(() => pending.delete(key)))
+  let answer = verified ? held() : undefined
+  if (!answer) {
+    const [before, after] = await texts()
+    answer = held()
+    if (!answer) {
+      const deadline = Date.now() + DIFF_TIMEOUT_MS
+      const job = inTurn(deadline, () => inWorker(before, after, request, deadline)).then(diff => encoded(diff, request, [before, after])).finally(() => pending.delete(key))
+      pending.set(key, answer = job)
+    }
   }
-  const body = await job
+  const body = await answer
   kept.set(key, body)
   if (kept.size > KEPT_DIFFS) kept.delete(kept.keys().next().value!)
   return body
@@ -258,7 +267,7 @@ export function renamedPairs([base, other]: readonly [ComparedSide, ComparedSide
       const named = { path: from.path, hash: from.hash, otherPath: to.path, otherHash: to.hash }
       const copy = async (side: ComparedSide, { text, ...file }: typeof from) => prettyText(await side.kept(file) ?? await side.made(file, text))
       let body
-      try { body = await answerOf(request, async () => [await copy(base, from), await copy(other, to)], keep) }
+      try { body = await answerOf(request, async () => [await copy(base, from), await copy(other, to)], keep, true) }
       catch (err) {
         if (!(err instanceof PrettyError)) throw err
         yield { ...named, error: err.message, status: err.status }

package/server-managed/report-sources.ts

@@ -146,7 +146,7 @@ export function createReportSourcesCache(storage: CacheStorage, db: ManagedDb, r
   }
   return {
     async open(report: ReportRecord, bundle: ManagedBundle, permissions: ViewerPermissions, sourcePaths?: Set<string>) {
-      const repo = { github: (await db.listAllRepos()).find(entry => entry.repoId === report.repoId)?.fullName ?? null }
+      const repo = { github: report.repoId == null ? null : await db.getRepoFullName(report.repoId) }
       const target = sourceCacheFilename(report, bundle, permissions, repo, sourcePaths)
       try { return { ...await storage.open(target), repo } }
       catch (error) { if (!(error instanceof CacheMissError)) throw error }

package/server-managed/report-store.ts

@@ -15,33 +15,66 @@ async function readBytes(stored: OpenedBlob): Promise<Buffer> {
   } finally { stored.stream.destroy() }
 }
 
+// Ids whose original copy is known gone, at most this many.
+const COMPRESSED_ONLY_MAX = 16_384
+
 export function createReportStore(legacy: BlobStore, compressed: BlobStore,
   replaceLegacy: (id: string, bytes: Buffer) => Promise<unknown>): BlobStore {
+  // Reports this store wrote, converted, or found with only the compressed
+  // copy. Uploads write only that copy and nothing writes an original again,
+  // so their reads stop asking storage for one, each a miss (and, encrypted,
+  // a row read too). A compressed copy missing there asks for the original
+  // after all. An original left by a conversion that failed is never in it:
+  // the next read finds that original and resumes the conversion.
+  const compressedOnly = new Set<string>()
+  function remember(id: string): void {
+    compressedOnly.delete(id)
+    if (compressedOnly.size >= COMPRESSED_ONLY_MAX) compressedOnly.delete(compressedOnly.values().next().value!)
+    compressedOnly.add(id)
+  }
+  async function openCompressed(id: string): Promise<OpenedBlob | null> {
+    const stored = await compressed.open(id)
+    if (!stored) return null
+    const stream = createBrotliDecompress()
+    // pipeline carries storage/authentication errors into the decoded stream
+    // and closes the stored source when a reader leaves before EOF.
+    void pipeline(stored.stream, stream).catch(() => {})
+    return { size: null, stream }
+  }
   async function open(id: string): Promise<OpenedBlob | null> {
+    if (compressedOnly.has(id)) {
+      const stored = await openCompressed(id)
+      if (stored) return stored
+      compressedOnly.delete(id)
+    }
     // Keep the original available until conversion succeeds. Concurrent reads
     // can finish using an already-open stream while another reader converts it.
     const original = await legacy.open(id)
     if (original) {
       const bytes = await readBytes(original)
       await replaceLegacy(id, await encodeBrotli(bytes, 9))
+      remember(id)
       return { size: bytes.length, stream: Readable.from([bytes]) }
     }
-    const stored = await compressed.open(id)
-    if (!stored) return null
-    const stream = createBrotliDecompress()
-    // pipeline carries storage/authentication errors into the decoded stream
-    // and closes the stored source when a reader leaves before EOF.
-    void pipeline(stored.stream, stream).catch(() => {})
-    return { size: null, stream }
+    const stored = await openCompressed(id)
+    if (stored) remember(id)
+    return stored
   }
   return {
-    put: async (id, bytes) => compressed.put(id, await encodeBrotli(bytes, 9)),
+    async put(id, bytes) {
+      const wrapped = await compressed.put(id, await encodeBrotli(bytes, 9))
+      remember(id)
+      return wrapped
+    },
     open,
     async get(id) {
       const stored = await open(id)
       if (!stored) return null
       return readBytes(stored)
     },
-    async delete(id) { await Promise.all([compressed.delete(id), legacy.delete(id)]) },
+    async delete(id) {
+      compressedOnly.delete(id)
+      await Promise.all([compressed.delete(id), legacy.delete(id)])
+    },
   }
 }

package/server-managed/repository-actions.ts

@@ -0,0 +1,218 @@
+// A repository's GitHub Actions in a risk scan (repository-risk.ts): its
+// workflows and its own actions scanned (risk scanWorkflow), and the
+// references they make resolved (risk resolveAction). Of a public
+// repository, a reference resolved and what GitHub answers are kept for
+// every scan, as many repositories use the same few actions.
+import { type ActionsSource, type ResolvedAction, type ScanOptions, type WorkflowScan, dockerfileFindings, keptSource, ownFilesOf, resolveAction,
+  scanWorkflow, usesOfKey } from '../risk/index.js'
+import type { OpenedRepository } from './repository-risk-read.ts'
+import type { Lru } from './lru.ts'
+import type { KeptStore } from './npm-kept.ts'
+import { type Queue, queue } from './queue.ts'
+import { RISK_KEPT_MS, type RiskFailure, failureOf } from './repository-risk-assess.ts'
+
+export const WORKFLOWS_DIR = '.github/workflows'
+// How many files of a repository's Actions are read, and how large.
+const MAX_FILES = 200
+const MAX_FILE_CHARS = 1024 * 1024
+// How many references a scan resolves, how deep it follows what they name,
+// and how many at once.
+const MAX_ACTIONS = 1000
+const MAX_DEPTH = 4
+const RESOLVERS = 4
+
+// A file of a repository's Actions: its text, or why it couldn't be had.
+export type ActionsFile = { path: string; kind: 'workflow' | 'action' | 'dockerfile' } & ({ text: string } | RiskFailure)
+export type WorkflowsRead = { files: ActionsFile[] } | RiskFailure
+
+// What a scan tells of them: the workflows' paths, each file's scan, and
+// each reference resolved, or why not.
+export type WorkflowsLine = { type: 'workflows'; repo: number } & ({ paths: string[] } | RiskFailure)
+export type WorkflowLine = { type: 'workflow'; repo: number; path: string; kind: ActionsFile['kind'] } & (WorkflowScan | RiskFailure)
+export type ActionLine = { type: 'action' } & (ResolvedAction | { key: string } & RiskFailure)
+
+// A reference to resolve, by the owner of the workflow naming it.
+export interface ActionRef { key: string; owner: string | null; depth: number }
+
+// What reading a repository's Actions asks of it.
+export type ActionsReading = Required<Pick<OpenedRepository, 'workflows' | 'file'>>
+
+// A file's text, or why not: one GitHub hasn't, or larger than read.
+async function readFile(reading: ActionsReading, path: string): Promise<{ text: string } | RiskFailure> {
+  try {
+    const text = await reading.file(path)
+    return text.length > MAX_FILE_CHARS ? { error: 'workflow-too-large' } : { text }
+  } catch (error) { return failureOf(error) }
+}
+
+// Whether a read holds what any read of its commit would: no file that
+// couldn't be had for a while, as GitHub's limits are.
+export const lastingRead = (read: WorkflowsRead) => !('error' in read) && read.files.every(file => 'text' in file || file.error === 'workflow-too-large' || file.error === 'github-not-found')
+
+// An action's directory, by its metadata's path.
+const actionDir = (path: string) => path.replace(/\/?action\.ya?ml$/u, '')
+const inRepository = (path: string) => !path.split('/').includes('..')
+const notFound = (read: { text: string } | RiskFailure) => 'error' in read && read.error === 'github-not-found'
+
+// A repository's workflows, the actions of its own they use in turn (`./`
+// as the workspace has it, the repository checked out first) and those's
+// Dockerfiles, MAX_FILES at most; why not, where they couldn't be listed.
+export async function readActions(reading: ActionsReading): Promise<WorkflowsRead> {
+  let listed
+  try { listed = await reading.workflows() } catch (error) { return failureOf(error, 'listing its workflows') }
+  const files: ActionsFile[] = await Promise.all(listed.slice(0, MAX_FILES).map(async path => ({ path, kind: 'workflow' as const, ...await readFile(reading, path) })))
+  const seen = new Set<string>()
+  for (let at = 0; at < files.length; at++) {
+    const file = files[at]!
+    if (!('text' in file) || file.kind === 'dockerfile') continue
+    const { actions, dockerfile } = ownFilesOf(file.kind, file.text)
+    const path = dockerfile && [actionDir(file.path), dockerfile].filter(Boolean).join('/')
+    if (path && inRepository(path) && files.length < MAX_FILES) files.push({ path, kind: 'dockerfile', ...await readFile(reading, path) })
+    for (const dir of actions) {
+      if (files.length >= MAX_FILES || seen.has(dir) || !inRepository(dir) || !seen.add(dir)) continue
+      const named = dir === '' ? 'action' : `${dir}/action`, yml = await readFile(reading, `${named}.yml`)
+      const yaml = notFound(yml) ? await readFile(reading, `${named}.yaml`) : null
+      files.push(yaml && !notFound(yaml) ? { path: `${named}.yaml`, kind: 'action', ...yaml } : { path: `${named}.yml`, kind: 'action', ...yml })
+    }
+  }
+  return { files }
+}
+
+// A lockfile's packages, by name and by `name@version`, and those only
+// devDependencies need.
+export function lockedNames(path: string, packages: readonly { name: string; version: string | null; dev?: true }[]) {
+  const dev = new Map<string, boolean>()
+  for (const { name, version, dev: only } of packages) for (const key of version ? [name, `${name}@${version}`] : [name]) dev.set(key, (dev.get(key) ?? true) && only === true)
+  return { path, names: new Set(dev.keys()), dev: new Set([...dev].flatMap(([name, only]) => only ? [name] : [])) }
+}
+
+// The lines a repository's Actions read are told by, and the references
+// they make to resolve. `lockfiles`, its lockfiles' packages' names by path.
+export function actionsLines(repo: number, owner: string, read: WorkflowsRead, lockfiles: NonNullable<ScanOptions['lockfiles']>) {
+  if ('error' in read) return { lines: [{ type: 'workflows', repo, ...read } as WorkflowsLine], refs: [] as ActionRef[] }
+  const lines: (WorkflowsLine | WorkflowLine)[] = [{ type: 'workflows', repo, paths: read.files.filter(file => file.kind === 'workflow').map(file => file.path) }]
+  const refs = new Map<string, ActionRef>()
+  // Its own actions by their directories and workflows by their paths, as a step or a job uses one.
+  const actions = new Map(read.files.flatMap(file => file.kind !== 'dockerfile' && 'text' in file ? [[file.kind === 'action' ? actionDir(file.path) : file.path, file.text] as const] : []))
+  for (const file of read.files) {
+    const scan = 'error' in file ? file : file.kind === 'dockerfile' ? { uses: [], findings: dockerfileFindings(file.text) } : scanWorkflow(file.kind, file.text, { owner, lockfiles, actions })
+    lines.push({ type: 'workflow', repo, path: file.path, kind: file.kind, ...scan })
+    if ('uses' in scan) for (const uses of scan.uses) if (uses.kind === 'action' || uses.kind === 'workflow') refs.set(uses.key!, { key: uses.key!, owner, depth: 0 })
+  }
+  return { lines, refs: [...refs.values()] }
+}
+
+export type ActionAnswers = Lru<{ at: number; answer: unknown }>
+// An answer's weight: an entry of a list, a kilobyte of a file.
+export const answerWeight = ({ answer }: { at: number; answer: unknown }) => Array.isArray(answer) ? answer.length + 1
+  : typeof answer === 'string' ? Math.ceil(answer.length / 1024) + 1 : ((answer as { branches?: unknown[] } | null)?.branches?.length ?? 0) + 1
+
+const isCommit = (text: string) => /^[\da-f]{40}$/u.test(text)
+
+// `source`, what it answers of a public repository kept for every scan, the
+// same whoever asks: of a commit while kept (but none, as one can be pushed
+// later), the rest for RISK_KEPT_MS. A private one's, or one missing, never.
+export function sharedSource(source: ActionsSource, answers: ActionAnswers): ActionsSource {
+  const keyOf = (what: string, name: string, ...more: string[]) => [what, name.toLowerCase(), ...more].join('\0')
+  const kept = (key: string, lasting = false) => {
+    const at = answers.get(key)
+    return at && ((lasting && at.answer !== null) || Date.now() - at.at < RISK_KEPT_MS) ? at : undefined
+  }
+  async function shared<T>(name: string, key: string, lasting: boolean, ask: () => Promise<T>): Promise<T> {
+    if (!kept(keyOf('repo', name))) return ask()
+    const at = kept(key, lasting)
+    if (at) return at.answer as T
+    const answer = await ask()
+    answers.set(key, { at: Date.now(), answer })
+    return answer
+  }
+  return {
+    async repo(name) {
+      const at = kept(keyOf('repo', name))
+      if (at) return at.answer as Awaited<ReturnType<ActionsSource['repo']>>
+      const info = await source.repo(name)
+      if (info?.private === false) for (const each of [name, info.fullName]) answers.set(keyOf('repo', each), { at: Date.now(), answer: info })
+      return info
+    },
+    tags: name => shared(name, keyOf('tags', name), false, () => source.tags(name)),
+    tag: (name, tag) => shared(name, keyOf('tag', name, tag), false, () => source.tag(name, tag)),
+    branch: (name, branch) => shared(name, keyOf('branch', name, branch), false, () => source.branch(name, branch)),
+    branches: name => shared(name, keyOf('branches', name), false, () => source.branches(name)),
+    contains: (name, base, sha) => shared(name, keyOf('contains', name, base, sha), isCommit(base), () => source.contains(name, base, sha)),
+    file: (name, path, commit) => shared(name, keyOf('file', name, path, commit), isCommit(commit), () => source.file(name, path, commit)),
+  }
+}
+
+export interface ActionsResolving {
+  source: ActionsSource
+  signal: AbortSignal
+  tell(line: ActionLine): void
+  memory: Lru<{ at: number; line: ActionLine }>
+  answers: ActionAnswers
+  store?: KeptStore<ActionLine> | undefined
+}
+
+// A reference's line: kept (`stored`, as read of the store with others),
+// else resolved, and kept where it is a public repository's; why not, where
+// it couldn't be.
+async function resolved(resolving: ActionsResolving, source: ActionsSource, { key, owner }: ActionRef,
+  stored = resolving.store?.read(key)): Promise<ActionLine | null> {
+  const kept = resolving.memory.get(key) ?? await stored?.then(row => row && { at: row.at, line: row.value })
+  if (kept && Date.now() - kept.at < RISK_KEPT_MS) { resolving.memory.set(key, kept); return kept.line }
+  const uses = usesOfKey(key)
+  if (!uses) return { type: 'action', key, error: 'invalid-uses' }
+  let found: ResolvedAction
+  try { found = await resolveAction(uses, source, { owner }) } catch (error) { return resolving.signal.aborted ? null : { type: 'action', key, ...failureOf(error) } }
+  const line: ActionLine = { type: 'action', ...found }
+  if (found.repository?.private === false) {
+    const at = Date.now()
+    resolving.memory.set(key, { at, line })
+    await resolving.store?.write(key, line, at)
+  }
+  return line
+}
+
+// Whether a reference is named by a workflow of its repository's owner.
+const ownOwners = ({ key, owner }: ActionRef) => key.split('/')[0] === owner?.toLowerCase()
+
+// Resolves the references added, and those they name in turn, each once a
+// scan, RESOLVERS at once, each told as it is; once more where another
+// owner's workflow names one its own owner's did, as a repository missing is
+// red then, or one is met nearer, its own followed as far as they then go. `close` settles once all are told, or the scan stops.
+export function resolvingActions(resolving: ActionsResolving) {
+  const source = keptSource(sharedSource(resolving.source, resolving.answers))
+  const pending: Queue<ActionRef> = queue(resolving.signal)
+  const latest = new Map<string, ActionRef>()
+  // Those of the references added at once kept beyond this instance, read of
+  // the store together as they are added.
+  const stored = new Map<string, Promise<{ at: number; value: ActionLine } | null>>()
+  let closed = false, waiting = 0
+  const settle = () => { if (closed && waiting === 0) pending.close() }
+  const add = (refs: ActionRef[]) => {
+    for (const ref of refs) {
+      const first = latest.get(ref.key)
+      if (ref.depth > MAX_DEPTH || (first ? (!ownOwners(first) || ownOwners(ref)) && first.depth <= ref.depth : latest.size >= MAX_ACTIONS)) continue
+      const kept = first ? { ...ref, owner: ownOwners(first) ? ref.owner : first.owner, depth: Math.min(ref.depth, first.depth) } : ref
+      latest.set(ref.key, kept)
+      waiting++
+      pending.add(kept)
+    }
+    const unread = [...new Set(refs.map(ref => ref.key))].filter(key => latest.has(key) && !stored.has(key) && !resolving.memory.get(key))
+    const read = unread.length > 0 ? resolving.store?.readMany(unread) : undefined
+    for (const key of read ? unread : []) stored.set(key, read!.then(found => found.get(key) ?? null))
+  }
+  const work = async () => {
+    for (let ref = await pending.take(); ref !== undefined; ref = await pending.take()) {
+      try {
+        const line = await resolved(resolving, source, ref, stored.get(ref.key))
+        if (line && latest.get(ref.key) === ref) {
+          resolving.tell(line)
+          const owner = 'repository' in line ? (line.repository?.fullName ?? line.repo).split('/')[0]! : ref.owner
+          if ('uses' in line) add(line.uses.map(key => ({ key, owner, depth: ref.depth + 1 })))
+        }
+      } finally { waiting--; settle() }
+    }
+  }
+  const workers = Array.from({ length: RESOLVERS }, work)
+  return { add, async close() { closed = true; settle(); await Promise.all(workers) } }
+}

package/server-managed/repository-agents.ts

@@ -0,0 +1,220 @@
+// What the code viewer's Agents tab reconstructs agents' sessions
+// from (GET /api/admin/repositories/agents, common/managed/agent-tasks.ts):
+// a page of the repository's pull requests, the most recently updated first,
+// and of its default branch's commits, the newest first, those no pull
+// request merged; on the first page, its latest issues and the newest of
+// its agents' branches (GitHub lists branches by name alone, so every one an
+// agent's prefix names is read, as many as fifty pages of each, and the newest
+// kept). Each artifact's own texts (never comments: an agent links its
+// session in a pull request's body and its commits' messages) are read here
+// for the marks an agent leaves, and a pull request's labels for one naming
+// an agent, and those alone are answered, never the texts. GraphQL alone
+// gives them, so it needs a token.
+import { type AgentAuthor, type AgentBranch, type AgentCommit, type AgentIssue, type AgentPull, type AppAgent, agentSignals } from '../common/managed/agent-tasks.ts'
+import { AGENT_BRANCH_PREFIXES, APP_AGENTS } from './app-agents.ts'
+import { GithubApiError } from './github-app.ts'
+import { ACTOR, type NamedAccount, actorOf, commitAccount, githubGraphql } from './repository-history.ts'
+import { ISSUES_CURSOR } from './repository-issues.ts'
+
+export { APP_AGENTS }
+
+export const AGENT_PULLS_PAGE = 50
+export const AGENT_COMMITS_PAGE = 100
+const AGENT_ISSUES = 100
+const AGENT_BRANCHES = 500
+const MAX_BRANCH_PAGES = 50
+const CLOSES = 5
+// A pull request's labels read, for one naming an agent: GitHub's most a
+// page.
+const LABELS = 100
+const MAX_TITLE = 1000
+const MAX_NAME = 256
+const LOGIN = /^[A-Za-z\d][A-Za-z\d-]{0,38}(?:\[bot\])?$/u
+const SHA = /^[a-f\d]{40}$/u
+// The address Claude's own commits are authored with.
+const CLAUDE_EMAIL = 'noreply@anthropic.com'
+
+// The app agents' accounts' no-reply addresses, by each login of theirs.
+const AGENT_EMAILS = APP_AGENTS.flatMap(({ account }) => account?.logins.map(login => `${account.id}+${login}@users.noreply.github.com`) ?? [])
+
+// An agent's branches, a page at a time, as GitHub lists them, by name;
+// each its tip commit's time, message and author.
+const BRANCHES_QUERY = `query($owner: String!, $name: String!, $prefix: String!, $after: String) {
+  repository(owner: $owner, name: $name) {
+    refs(refPrefix: $prefix, first: 100, after: $after) {
+      pageInfo { hasNextPage endCursor }
+      nodes { prefix name target { ... on Commit { committedDate message author { email user { login databaseId } } } } }
+    }
+  }
+}`
+// What a commit of the default branch is read by.
+const COMMIT_FIELDS = 'oid messageHeadline message committedDate additions deletions author { email user { login databaseId } } associatedPullRequests(first: 1) { totalCount }'
+// The newest of the default branch's commits the app agents' accounts
+// authored, by their GitHub no-reply addresses, however far back: a bot's
+// commits pushed with no pull request here (as before a repository moved)
+// may lie deeper than pages are read on to.
+const AUTHORED_QUERY = `query($owner: String!, $name: String!, $emails: [String!]!) {
+  repository(owner: $owner, name: $name) {
+    defaultBranchRef { target { ... on Commit { history(first: ${AGENT_COMMITS_PAGE}, author: { emails: $emails }) { nodes { ${COMMIT_FIELDS} } } } } }
+  }
+}`
+const PAGE_QUERY = `query($owner: String!, $name: String!, $pulls: String, $commits: String, $first: Boolean!, $readPulls: Boolean!, $readCommits: Boolean!) {
+  repository(owner: $owner, name: $name) {
+    pullRequests(first: ${AGENT_PULLS_PAGE}, after: $pulls, orderBy: { field: UPDATED_AT, direction: DESC }) @include(if: $readPulls) {
+      pageInfo { hasNextPage endCursor }
+      nodes { number title state isDraft createdAt updatedAt author { ${ACTOR} } body headRefName isCrossRepository headRepositoryOwner { login } additions deletions
+        commits(last: 1) { totalCount nodes { commit { message } } }
+        mergeCommit { message }
+        closingIssuesReferences(first: ${CLOSES}) { nodes { number } }
+        labels(first: ${LABELS}) { nodes { name } } }
+    }
+    defaultBranchRef { target { ... on Commit {
+      history(first: ${AGENT_COMMITS_PAGE}, after: $commits) @include(if: $readCommits) {
+        pageInfo { hasNextPage endCursor }
+        nodes { ${COMMIT_FIELDS} }
+      }
+    } } }
+    issues(first: ${AGENT_ISSUES}, orderBy: { field: UPDATED_AT, direction: DESC }) @include(if: $first) {
+      nodes { number title state createdAt updatedAt author { ${ACTOR} } }
+    }
+  }
+}`
+
+type Login = { login?: unknown; databaseId?: unknown } | null | undefined
+type PullNode = { number?: unknown; title?: unknown; state?: unknown; isDraft?: unknown; createdAt?: unknown; updatedAt?: unknown; author?: Login; body?: unknown
+  headRefName?: unknown; isCrossRepository?: unknown; headRepositoryOwner?: Login; additions?: unknown; deletions?: unknown; commits?: { totalCount?: unknown; nodes?: ({ commit?: { message?: unknown } | null } | null)[] }
+  mergeCommit?: { message?: unknown } | null; closingIssuesReferences?: { nodes?: ({ number?: unknown } | null)[] }; labels?: { nodes?: ({ name?: unknown } | null)[] } }
+type GitActor = { email?: unknown; user?: Login }
+type CommitNode = { oid?: unknown; messageHeadline?: unknown; message?: unknown; committedDate?: unknown; additions?: unknown; deletions?: unknown
+  author?: GitActor | null; associatedPullRequests?: { totalCount?: unknown } }
+type IssueNode = { number?: unknown; title?: unknown; state?: unknown; createdAt?: unknown; updatedAt?: unknown; author?: Login }
+type RefNode = { prefix?: unknown; name?: unknown; target?: { committedDate?: unknown; message?: unknown; author?: GitActor | null } | null }
+type Connection<T> = { pageInfo?: { hasNextPage?: unknown; endCursor?: unknown }; nodes?: (T | null)[] }
+type Page = { repository?: { pullRequests?: Connection<PullNode>; defaultBranchRef?: { target?: { history?: Connection<CommitNode> } | null } | null
+  issues?: Connection<IssueNode> } | null }
+type RefsPage = { repository?: { refs?: Connection<RefNode> } | null }
+
+const count = (value: unknown) => Number.isSafeInteger(value) && (value as number) >= 0 ? value as number : 0
+const number = (value: unknown) => Number.isSafeInteger(value) && (value as number) > 0 ? value as number : null
+const timeOf = (value: unknown) => {
+  const at = typeof value === 'string' ? Date.parse(value) : Number.NaN
+  return Number.isSafeInteger(at) ? at : null
+}
+const nameOf = (value: unknown, max = MAX_NAME) => typeof value === 'string' && value.trim() ? value.trim().slice(0, max) : null
+const loginOf = (author: Login) => typeof author?.login === 'string' && LOGIN.test(author.login) ? author.login : null
+const PULL_STATES: Record<string, AgentPull['state']> = { OPEN: 'open', MERGED: 'merged', CLOSED: 'closed' }
+
+function pull(node: PullNode | null): AgentPull | null {
+  const at = number(node?.number)
+  if (!node || !at) return null
+  const author = accountOf(node.author)
+  return { number: at, title: nameOf(node.title, MAX_TITLE) ?? '', state: PULL_STATES[String(node.state)] ?? 'closed', draft: node.isDraft === true,
+    author: loginOf(node.author), authorId: author?.id ?? null, createdAt: timeOf(node.createdAt), updatedAt: timeOf(node.updatedAt), head: nameOf(node.headRefName),
+    // A fork's, its owner; one GitHub no longer names, a fork of its own.
+    fork: node.isCrossRepository === true ? loginOf(node.headRepositoryOwner) ?? `pull-${at}` : null,
+    additions: count(node.additions), deletions: count(node.deletions), commits: count(node.commits?.totalCount),
+    closes: (node.closingIssuesReferences?.nodes ?? []).flatMap(closed => number(closed?.number) ?? []),
+    signals: agentSignals([node.body, node.commits?.nodes?.[0]?.commit?.message, node.mergeCommit?.message], APP_AGENTS, nameOf(node.headRefName),
+      author, (node.labels?.nodes ?? []).map(label => label?.name)) }
+}
+
+// An account as GitHub names it, by its login and id, both.
+const both = ({ login, id }: NamedAccount): AgentAuthor | null => login !== null && id !== null ? { login, id } : null
+const accountOf = (actor: Login) => both(actorOf(actor))
+// A commit's author: the account GitHub knows by its address, else the one
+// its no-reply address names by id and login, as a bot's, Copilot's or
+// Dependabot's, is told by that alone (repository-history.ts commitAccount).
+const authorOf = (actor: GitActor | null | undefined) => both(commitAccount(actor))
+
+// A commit to the default branch no pull request merged, where an agent left
+// its marks on it, or Claude authored it.
+function directCommit(node: CommitNode | null): AgentCommit | null {
+  if (!node || typeof node.oid !== 'string' || !SHA.test(node.oid) || count(node.associatedPullRequests?.totalCount) > 0) return null
+  const author = authorOf(node.author)
+  const signals = agentSignals([node.message], APP_AGENTS, null, author)
+  if (node.author?.email === CLAUDE_EMAIL) signals.claude = true
+  if (!signals.claude && !signals.codex && signals.agents.length === 0 && signals.sessions.length === 0 && signals.tasks.length === 0) return null
+  return { oid: node.oid, title: nameOf(node.messageHeadline, MAX_TITLE) ?? '', at: timeOf(node.committedDate),
+    author: author?.login ?? loginOf(node.author?.user), authorId: author?.id ?? null,
+    additions: count(node.additions), deletions: count(node.deletions), signals }
+}
+
+function issue(node: IssueNode | null): AgentIssue | null {
+  const at = number(node?.number)
+  if (!node || !at) return null
+  return { number: at, title: nameOf(node.title, MAX_TITLE) ?? '', state: node.state === 'OPEN' ? 'open' : 'closed', author: loginOf(node.author),
+    authorId: accountOf(node.author)?.id ?? null, createdAt: timeOf(node.createdAt), updatedAt: timeOf(node.updatedAt) }
+}
+
+// A branch under `prefix`, an agent's, named in full however GitHub splits
+// its name from the prefix it was listed under.
+const branch = (prefix: string) => (node: RefNode | null): AgentBranch | null => {
+  const ref = typeof node?.prefix === 'string' && typeof node.name === 'string' ? `${node.prefix}${node.name}` : null
+  const name = ref?.startsWith('refs/heads/') ? nameOf(ref.slice('refs/heads/'.length)) : null
+  const author = authorOf(node?.target?.author)
+  return name?.startsWith(prefix) ? { name, at: timeOf(node?.target?.committedDate), author: author?.login ?? loginOf(node?.target?.author?.user),
+    authorId: author?.id ?? null, signals: agentSignals([node?.target?.message], APP_AGENTS, name, author) } : null
+}
+
+// The newest of an agent's branches, those under `prefix`: every one, as many
+// as MAX_BRANCH_PAGES of them list, kept by their tips' times.
+async function agentBranches(owner: string, name: string, prefix: string, token: string, fetchImpl: typeof fetch) {
+  const found: AgentBranch[] = []
+  let after: string | null = null
+  for (let page = 0; page < MAX_BRANCH_PAGES; page++) {
+    const refs: Connection<RefNode> | undefined = (await githubGraphql(BRANCHES_QUERY, { owner, name, prefix: `refs/heads/${prefix}`, after }, token, fetchImpl) as RefsPage)
+      ?.repository?.refs
+    found.push(...(refs?.nodes ?? []).flatMap(node => branch(prefix)(node) ?? []))
+    const next: Connection<RefNode>['pageInfo'] = refs?.pageInfo
+    if (next?.hasNextPage !== true || typeof next.endCursor !== 'string') break
+    after = next.endCursor
+  }
+  return found.toSorted((a, b) => (b.at ?? 0) - (a.at ?? 0)).slice(0, AGENT_BRANCHES)
+}
+
+// What its answers are kept by, with their cursors (http.ts
+// handleRepositoryAgents): bumped as what a page reads, or how it tells an
+// agent, changes, so that no answer an older server kept is sent for a day.
+export const AGENTS_READ_VERSION = 5
+
+// A cursor of the default branch's commits: GitHub names one by a commit
+// and how many on from it, `<oid> <offset>`, a space between.
+export const COMMITS_CURSOR = /^(?:[!-~]{1,256}|[\da-f]{40} \d{1,9})$/u
+
+const nextCursor = (connection: Connection<unknown> | undefined, cursor = ISSUES_CURSOR) => {
+  const info = connection?.pageInfo
+  return info?.hasNextPage === true && typeof info.endCursor === 'string' && cursor.test(info.endCursor) ? info.endCursor : null
+}
+
+// A page of what the repository's agents left: its pull requests on from
+// the cursor `pulls` ends at, its default branch's commits on from
+// `commits` (the first page where neither is named, with its issues, its
+// agents' branches and the commits the app agents' accounts authored, and
+// the app agents it may name), and the cursors reading on from each, null
+// where either is read whole.
+export async function repositoryAgents(fullName: string, token: string, cursors: { pulls: string | null; commits: string | null },
+  fetchImpl: typeof fetch = globalThis.fetch) {
+  const [owner, name] = fullName.split('/') as [string, string]
+  const first = cursors.pulls === null && cursors.commits === null
+  const [data, branches, authored] = await Promise.all([
+    githubGraphql(PAGE_QUERY, { owner, name, pulls: cursors.pulls, commits: cursors.commits, first,
+      readPulls: first || cursors.pulls !== null, readCommits: first || cursors.commits !== null }, token, fetchImpl) as Promise<Page>,
+    first ? Promise.all(AGENT_BRANCH_PREFIXES.map(prefix => agentBranches(owner, name, prefix, token, fetchImpl))) : [],
+    first ? githubGraphql(AUTHORED_QUERY, { owner, name, emails: AGENT_EMAILS }, token, fetchImpl) as Promise<Page> : null,
+  ])
+  const repository = data?.repository
+  if (!repository) throw new GithubApiError(404, 'github-not-found')
+  const history = repository.defaultBranchRef?.target?.history
+  const after = { pulls: nextCursor(repository.pullRequests), commits: nextCursor(history, COMMITS_CURSOR) }
+  const commits = [...history?.nodes ?? [], ...authored?.repository?.defaultBranchRef?.target?.history?.nodes ?? []].flatMap(node => directCommit(node) ?? [])
+  return {
+    pulls: (repository.pullRequests?.nodes ?? []).flatMap(node => pull(node) ?? []),
+    commits: commits.filter((commit, index) => commits.findIndex(other => other.oid === commit.oid) === index),
+    ...first ? {
+      issues: (repository.issues?.nodes ?? []).flatMap(node => issue(node) ?? []),
+      branches: branches.flat(),
+      agents: APP_AGENTS.map(({ id, name: agent, avatar }): AppAgent => ({ id, name: agent, ...avatar ? { avatar } : {} })),
+    } : {},
+    more: after.pulls !== null || after.commits !== null, after,
+  }
+}