@preventive/triage 1.0.0-alpha.45 → 1.0.0-alpha.46

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@preventive/triage",
-  "version": "1.0.0-alpha.45",
+  "version": "1.0.0-alpha.46",
   "description": "Client & relay server for triaging of automated reports",
   "license": "MIT OR Apache-2.0",
   "author": {
@@ -139,6 +139,7 @@
     "server-managed/github-users.ts",
     "server-managed/github-oauth.ts",
     "server-managed/github-pulls.ts",
+    "server-managed/github-requests.ts",
     "server-managed/http-response.ts",
     "server-managed/http.ts",
     "server-managed/link-reports.ts",
@@ -156,6 +157,7 @@
     "server-managed/npm-risk.ts",
     "server-managed/npm-provenance.ts",
     "server-managed/kept.ts",
+    "server-managed/kept-briefly.ts",
     "server-managed/npm-kept.ts",
     "server-managed/npm-loads.ts",
     "server-managed/npm-delta.ts",

package/risk/actions/findings.js

@@ -64,16 +64,21 @@ function lockedIn(lockfiles, directory, name) {
 // The inputs a text names (`${{ inputs.title }}`).
 const inputsIn = text => typeof text === 'string' ? [...dotted(text).matchAll(/\$\{\{[^}]*?\binputs\s*\.\s*([\w-]+)/gu)].map(match => match[1]) : []
 
-// The inputs a step's action writes into a script: github-script's
-// `script`, and those an action of the repository's own (ScanOptions
-// `actions`) names in its `run:`s or hands to such an input of a step's.
+// The inputs a step's action, or a job's reusable workflow, writes into a
+// script: github-script's `script`; those one of the repository's own
+// (ScanOptions `actions`) names in its `run:`s or its jobs' images, or hands
+// to such an input of a step's or a job's; and each of another reusable
+// workflow's, or one whose text isn't told, as it may.
 function scriptInputs(step, actions, seen = new Set()) {
   if (step.uses?.repo?.toLowerCase() === 'actions/github-script') return ['script']
-  const dir = step.uses?.kind === 'local' && actions?.has(step.uses.path) && !seen.has(step.uses.path) ? step.uses.path : null
-  const read = dir === null ? null : readWorkflow('action', actions.get(dir))
+  if (step.uses?.kind === 'workflow' || (step.uses?.job && !actions?.has(step.uses.path))) return Object.keys(step.with ?? {})
+  const path = step.uses?.kind === 'local' && actions?.has(step.uses.path) && !seen.has(step.uses.path) ? step.uses.path : null
+  const read = path === null ? null : readWorkflow(step.uses.job ? 'workflow' : 'action', actions.get(path))
   if (!read || read instanceof YamlError) return []
-  return [...new Set(read.jobs.flatMap(job => job.steps.flatMap(each => [...inputsIn(each.run?.script),
-    ...scriptInputs(each, actions, new Set(seen).add(dir)).flatMap(input => inputsIn(each.with?.[input]))])))]
+  const inner = new Set(seen).add(path)
+  const handed = each => scriptInputs(each, actions, inner).flatMap(input => inputsIn(each.with?.[input]))
+  return [...new Set(read.jobs.flatMap(job => [...job.uses ? handed(job) : [], ...job.images.flatMap(image => inputsIn(image.text)),
+    ...job.steps.flatMap(each => [...inputsIn(each.run?.script), ...handed(each)])]))]
 }
 
 // Injections through the inputs an action writes into its scripts, and a
@@ -98,8 +103,8 @@ function jobFindings(job, triggers, { owner, lockfiles, external, actions }) {
     const finding = usesFinding(job.uses, owner)
     if (finding) found.push({ ...finding, line: job.uses.line })
     if (job.secrets === 'inherit' && job.uses.repo && ownerKind(job.uses.repo, owner) === 'third-party') found.push({ id: 'secrets-inherited', severity: 'high', uses: job.uses.uses, key: usesKey(job.uses), line: job.uses.line })
-    // An input of a reusable workflow, which one writes into its scripts.
-    for (const [input, value] of Object.entries(job.with ?? {})) for (const { index: _index, ...injected } of scriptInjections(value, triggers)) found.push({ ...injected, line: job.withLines[input] })
+    // An input a reusable workflow writes into its scripts.
+    for (const input of scriptInputs(job, actions)) for (const { index: _index, ...injected } of scriptInjections(job.with?.[input], triggers)) found.push({ ...injected, line: job.withLines[input] })
   }
   for (const image of job.images) {
     if (!image.read?.digest && !image.text.includes('${{')) found.push({ ...imageFinding(image.text, image.read), line: image.line })

package/risk/actions/scripts/shell.js

@@ -12,7 +12,11 @@ const SHELL = new RegExp(String.raw`^(?:.*[\/\\])?${SHELLS}(?:\.exe)?$`, 'iu')
 // pipe, `&&` or `||` the next line goes on from), and the line it starts
 // on, counting from 0.
 export function scriptLines(script) {
-  const lines = script.split('\n')
+  // An expression (`${{ … }}`), which GitHub writes in before the shell reads
+  // the script, read as a variable is: a value unknown here, each line it
+  // spans past its first continuing the one it is on; a `}}` in one of its
+  // strings (`format('{{0}}')`) not its end.
+  const lines = script.replaceAll(/\$\{\{(?:'[^']*'|[^'])*?\}\}/gu, expression => `$EXPRESSION${' \\\n'.repeat(expression.split('\n').length - 1)}`).split('\n')
   const joined = []
   for (let at = 0; at < lines.length; at++) {
     const start = at

package/risk/index.d.ts

@@ -200,8 +200,11 @@ export interface ScanOptions {
   // Its lockfiles' paths, the packages each locks, as npx runs those, by
   // name and by `name@version`, and those only devDependencies need.
   lockfiles?: { path: string; names: ReadonlySet<string>; dev?: ReadonlySet<string> }[]
-  // Its own actions' metadata by their directories, for where they install
-  // its packages; else each counts as installing them anywhere.
+  // Its own actions' metadata by their directories, and its workflows by
+  // their paths: for where its actions install its packages, else each
+  // counts as installing them anywhere; and for the inputs its actions and
+  // reusable workflows write into their scripts, else each of a reusable
+  // workflow's counts as one.
   actions?: ReadonlyMap<string, string> | null
 }
 

package/server-e2e/app.ts

@@ -102,11 +102,12 @@ import { createBusReceiver } from './bus-receiver.ts'
 import { e2eStorageLines } from '../server-common/storage-log.ts'
 
 // Each embedding gets its own stores, transports, timers and shutdown state.
-export async function createE2eApp(config = loadConfig()) {
-  return await initializeApp(rollback => assembleE2eApp(config, rollback))
+// `ui: false` serves only the API (see ./http.ts).
+export async function createE2eApp(config = loadConfig(), { ui = true }: { ui?: boolean } = {}) {
+  return await initializeApp(rollback => assembleE2eApp(config, ui, rollback))
 }
 
-async function assembleE2eApp(config: Config, rollback: AsyncDisposableStack) {
+async function assembleE2eApp(config: Config, ui: boolean, rollback: AsyncDisposableStack) {
   // All external inputs (env vars + optional config.json) are parsed
   // and validated in ./config.ts; destructure into the uppercase names
   // the rest of this module uses.
@@ -388,7 +389,7 @@ async function assembleE2eApp(config: Config, rollback: AsyncDisposableStack) {
   // below.
   const httpServer = createHttpServer({
     wss, restDeps: objstoreRestDeps, sseServer, serverInfo: SERVER_INFO, isOriginAllowed,
-    isShuttingDown, track, handleSaveRest,
+    isShuttingDown, track, handleSaveRest, ui,
     restPutIdleTimeoutMs: REST_PUT_IDLE_TIMEOUT_MS, debug: DEBUG,
   })
   const requestHandler = httpServer.listeners('request')[0]!

package/server-e2e/http.ts

@@ -59,6 +59,9 @@ export type HttpServerDeps = {
   handleSaveRest: (req: HttpRequest, res: ServerResponse) => Promise<void>
   restPutIdleTimeoutMs: number
   debug: boolean
+  // Serve the static UI bundle (default). False serves only the API and
+  // never reads `out/`, for hosts that serve the UI themselves.
+  ui?: boolean
 }
 
 // `POST /api/sync/save` dispatch. Returns the in-flight handler promise when
@@ -114,12 +117,12 @@ function dispatchSaveRest(
 }
 
 export function createHttpServer(deps: HttpServerDeps): Server {
-  const { wss, restDeps, sseServer, serverInfo, isOriginAllowed, isShuttingDown, track, handleSaveRest, restPutIdleTimeoutMs, debug } = deps
+  const { wss, restDeps, sseServer, serverInfo, isOriginAllowed, isShuttingDown, track, handleSaveRest, restPutIdleTimeoutMs, debug, ui = true } = deps
   // Static-file plane (see ./static.ts). The directory is the
   // `build.js build` output sibling to this file; the loader handles
   // enumeration, pre-compression, and ETag derivation. Plugged in after
   // the `/api/objstore/...` REST branch.
-  const handleStatic = loadStatic(fileURLToPath(new URL('../out', import.meta.url)), serverInfo.deepviewScanServer ?? null)
+  const handleStatic = ui ? loadStatic(fileURLToPath(new URL('../out', import.meta.url)), serverInfo.deepviewScanServer ?? null) : () => false
 
   const httpServer = createServer((req: HttpRequest, res: ServerResponse) => {
     // Static mode probe: GET /api/config → this server's `server-info` as JSON.

package/server-managed/bundle-cache.ts

@@ -24,11 +24,17 @@ export type BundleCacheRecord = Pick<ManagedBundle, 'id' | 'integrity' | 'filena
 export interface BundleSummary { files: number; codeFiles: number; lines: number; commit?: string; stasisVersion?: number; versionedPackages?: number }
 
 export async function readBundleDetails(record: BundleCacheRecord, store: BundleStore) {
+  return (await readSizedBundleDetails(record, store))?.details ?? null
+}
+
+// As readBundleDetails, with the bytes the bundle decoded to: about what
+// holding its details takes.
+export async function readSizedBundleDetails(record: BundleCacheRecord, store: BundleStore) {
   const bytes = await store.get(record.id, record.kind)
   if (!bytes) return null
   const decoded = record.kind === 'stasis' || record.kind === 'sourcemap' ? await decompress(bytes, { maxOutputLength: MAX_DECODED_BYTES }) : bytes
   if (decoded.length > MAX_DECODED_BYTES) throw new Error('Decoded bundle too large')
-  return parseBundleContents(decodeUtf8(decoded), { integrity: record.integrity, kind: record.kind, size: record.byteSize })
+  return { details: parseBundleContents(decodeUtf8(decoded), { integrity: record.integrity, kind: record.kind, size: record.byteSize }), decodedBytes: decoded.length }
 }
 
 export interface BundleCacheStorage {

package/server-managed/combined.ts

@@ -10,13 +10,13 @@ import { loadManagedConfig } from './config.ts'
 import { LOGIN_PATH } from './github-oauth.ts'
 import { createManagedApp, logManagedStartup } from './index.ts'
 
-export async function init(mode: 'managed+e2e' | 'e2e+managed'): Promise<Server> {
+export async function init(mode: 'managed+e2e' | 'e2e+managed', { ui = true }: { ui?: boolean } = {}): Promise<Server> {
   const config = loadManagedConfig({ combined: true })
   const e2eConfig = loadConfig()
   if (!e2eConfig.neonUrl && !config.neonUrl && config.dbPath !== ':memory:' && resolve(config.dbPath) === resolve(e2eConfig.dbPath)) {
     throw new Error('MANAGED_DB_PATH must differ from e2e DB_PATH in combined mode.')
   }
-  const e2e = await createE2eApp(e2eConfig)
+  const e2e = await createE2eApp(e2eConfig, { ui })
   // Replace the assembled server's single
   // request listener; adding a second would write two responses per request.
   const handlers = e2e.httpServer.listeners('request')
@@ -25,6 +25,7 @@ export async function init(mode: 'managed+e2e' | 'e2e+managed'): Promise<Server>
   const managed = await createManagedApp(config, {
     next: e2e.handleRequest,
     isShuttingDown: e2e.isShuttingDown,
+    ui,
     serverInfo: {
       mode, managed: { loginPath: LOGIN_PATH, cookieName: config.sessionCookieName },
       ...(e2eConfig.deepviewScanServer ? { deepviewScanServer: e2eConfig.deepviewScanServer } : {}),

package/server-managed/commit-lockfiles.ts

@@ -4,40 +4,50 @@
 // read as a pull request's are (pull-dependencies.ts readLockfile, kept in
 // this instance by the commit and path), as many as MAX_LOCKFILES of those,
 // each's versions (`lockfiles`), and those its reader refuses, of Bun's, or
-// past MAX_LOCKFILES (`unread`); and those of some of them (lockedIn), each
-// version once by what its reviews are held to (lockedWith), dev only where
-// it is wherever it is locked. GitHub having none of a lockfile it lists
-// there fails the whole, as it would for any file.
+// past MAX_LOCKFILES (`unread`), as many read at once as READ_AT_ONCE; and
+// those of some of them (lockedIn), each version once by what its reviews
+// are held to (lockedWith), dev only where it is wherever it is locked.
+// GitHub having none of a lockfile it lists there fails the whole, as it
+// would for any file.
 import { createClient } from '@preventive/upstream/github.js'
 import { upstreamGithub } from './github-errors.ts'
 import { GithubApiError } from './github-app.ts'
 import type { LockedPackage } from './locked-packages.ts'
 import { type Lru, lru } from './lru.ts'
-import { lockedWith, lockfileFormat, readLockfile } from './pull-dependencies.ts'
+import { eachOf, lockedWith, lockfileFormat, lockfileHeld, readLockfile } from './pull-dependencies.ts'
 
 export const MAX_LOCKFILES = 100
+const READ_AT_ONCE = 4
 
 export interface CommitLockfiles { lockfiles: { path: string; packages: LockedPackage[] }[]; unread: string[] }
+// Set where GitHub was asked for what a read reads (`github`), not all of it
+// held in this instance.
+export interface GithubAsked { github: boolean }
 
 // The lockfiles at commit `sha` its review reads, by their paths, each with
-// its format (pull-dependencies.ts lockfileFormat), kept by the commit.
+// its format (pull-dependencies.ts lockfileFormat), kept by the commit;
+// `asked` told where GitHub was.
 const listings: Lru<{ path: string; format: NonNullable<ReturnType<typeof lockfileFormat>> }[]> = lru(20_000, listed => listed.length + 1)
-export async function lockfilesAt(fullName: string, token: string, sha: string) {
+export async function lockfilesAt(fullName: string, token: string, sha: string, asked?: GithubAsked) {
   const key = `${fullName}\0${sha}`
   const known = listings.get(key)
   if (known) return known
+  if (asked) asked.github = true
   const { lockfiles } = await upstreamGithub(() => createClient({ token, userAgent: 'deepview-triage' }).findRepoLockfiles({ repo: fullName, sha }))
   const listed = lockfiles.flatMap(({ path }) => { const format = lockfileFormat(path); return format ? [{ path, format }] : [] })
   listings.set(key, listed)
   return listed
 }
 
-export async function lockedAt(fullName: string, token: string, sha: string, held: (path: string) => boolean = () => true): Promise<CommitLockfiles> {
-  const listed = (await lockfilesAt(fullName, token, sha)).filter(({ path }) => held(path))
+export async function lockedAt(fullName: string, token: string, sha: string, held: (path: string) => boolean = () => true, asked?: GithubAsked): Promise<CommitLockfiles> {
+  const listed = (await lockfilesAt(fullName, token, sha, asked)).filter(({ path }) => held(path))
   const unread = listed.slice(MAX_LOCKFILES).map(({ path }) => path)
   const lockfiles: CommitLockfiles['lockfiles'] = []
-  for (const lockfile of listed.slice(0, MAX_LOCKFILES)) {
-    const read = await readLockfile(fullName, token, sha, lockfile)
+  const reading = listed.slice(0, MAX_LOCKFILES)
+  if (asked && reading.some(lockfile => !lockfileHeld(fullName, sha, lockfile))) asked.github = true
+  const reads = await eachOf(reading, READ_AT_ONCE, lockfile => readLockfile(fullName, token, sha, lockfile))
+  for (const [at, lockfile] of reading.entries()) {
+    const read = reads[at]!
     if ('error' in read && read.error === 'github-not-found') throw new GithubApiError(404, 'github-not-found')
     if ('error' in read) unread.push(lockfile.path)
     else lockfiles.push({ path: lockfile.path, packages: read.packages })

package/server-managed/config.ts

@@ -42,6 +42,11 @@ export interface ManagedConfig {
   cookieSecure: boolean
   sessionCookieName: string
   sessionTtlMs: number
+  // How long GitHub's answer on a user's access to a repository (its
+  // visibility, their permission) is kept for that user and repository
+  // (repository-browser.ts), asked again past it; 0 asks on every request
+  // (MANAGED_REPOSITORY_ACCESS_CACHE_MS, five minutes by default).
+  repositoryAccessCacheMs: number
   // Optional installation credentials for the same GitHub App as login.
   // Repository permissions are approved when connecting repositories.
   githubAppId: string | null
@@ -140,6 +145,7 @@ export function loadManagedConfig({ combined = false } = {}): ManagedConfig {
     cookieSecure,
     sessionCookieName,
     sessionTtlMs: intEnv('SESSION_TTL_MS', 1_209_600_000, 60_000, 7_776_000_000),
+    repositoryAccessCacheMs: intEnv('MANAGED_REPOSITORY_ACCESS_CACHE_MS', 300_000, 0, 3_600_000),
     githubAppId: env['GITHUB_APP_ID'] ?? null,
     githubAppPrivateKey: normalizePem(env['GITHUB_APP_PRIVATE_KEY']),
     githubAppSlug: env['GITHUB_APP_SLUG'] ?? null,

package/server-managed/db-methods.ts

@@ -392,6 +392,10 @@ export interface ManagedDb extends DependencyReviewStore, RepositoryDependencyRe
   // A view session opened by `viewerSessionId`, while that session is current
   // and its user is still an admin. Presence is the admin's, not the viewed user's.
   viewSessionWithUser(id: string, viewerSessionId: string, now: number): Promise<{ session: ManagedSession; user: StoredUser } | null>
+  // The two above as they read, recording no presence: for a read again in a
+  // request whose first read recorded it.
+  getSessionWithUser(id: string, now: number): Promise<{ session: ManagedSession; user: StoredUser } | null>
+  getViewSessionWithUser(id: string, viewerSessionId: string, now: number): Promise<{ session: ManagedSession; user: StoredUser } | null>
   // Store `candidate` unless the session already has an upload key; returns
   // the stored key, or null when the session no longer exists.
   ensureSessionUploadKey(id: string, candidate: string): Promise<string | null>
@@ -413,6 +417,8 @@ export interface ManagedDb extends DependencyReviewStore, RepositoryDependencyRe
   deselectRepo(repoId: number): Promise<boolean>
   listSelectedRepos(): Promise<SelectedRepo[]>
   listAllRepos(): Promise<ManagedRepo[]>
+  // A selected repository's full name, active or not; null for none.
+  getRepoFullName(repoId: number): Promise<string | null>
   deactivateRepo(repoId: number): Promise<boolean>
   reactivateRepo(repoId: number): Promise<boolean>
   deleteRepo(repoId: number): Promise<boolean>
@@ -459,6 +465,8 @@ export interface ManagedDb extends DependencyReviewStore, RepositoryDependencyRe
   // stamp nor the trail. Every change also appends to managed_finding_triage_event;
   // listTriageHistory walks one finding's trail, newest first.
   listTriage(findingIds: readonly string[]): Promise<TriageRow[]>
+  // The distinct Fix links of those, without the rest of their entries.
+  listTriageFixes(findingIds: readonly string[]): Promise<string[]>
   getAnnotations(findingIds: readonly string[]): Promise<{ triage: TriageRow[]; comments: Awaited<ReturnType<CommentStore['listComments']>>; issues: Awaited<ReturnType<ManagedIssueStore['listManagedIssues']>> }>
   applyManagedIssueFixes(sessionId: string, snapshot: TeamReportAccessSnapshot, updates: IssueFixUpdate[]): Promise<boolean>
   // A content-free fingerprint of current annotations, read in one snapshot.
@@ -543,6 +551,15 @@ type SessionRow = {
   uid: string; login: string; name: string | null; avatar: string | null; role: Role
 }
 type ViewSessionRow = SessionRow & { viewerId: string; viewerLogin: string; viewerName: string | null }
+const ownSession = (row: SessionRow) => ({
+  session: { id: row.id, userId: row.uid, csrfToken: row.csrf, expiresAt: row.exp, uploadKey: row.uploadKey },
+  user: { id: row.uid, login: row.login, name: row.name, avatarUrl: row.avatar, role: row.role },
+})
+const viewSession = (row: ViewSessionRow) => ({
+  session: { id: row.id, userId: row.uid, csrfToken: row.csrf, expiresAt: row.exp, uploadKey: row.uploadKey,
+    viewer: { id: row.viewerId, login: row.viewerLogin, name: row.viewerName } },
+  user: { id: row.uid, login: row.login, name: row.name, avatarUrl: row.avatar, role: row.role },
+})
 
 type UserRow = { id: string; login: string; name: string | null; role: Role; created: number; lastSeen: number | null; lastActivity: number | null }
 
@@ -690,6 +707,7 @@ function prepareStatements(db: ManagedSql) {
               added_by AS addedBy, added_at AS addedAt, active AS active
          FROM managed_selected_repo WHERE active = 1 ORDER BY full_name ASC`,
     ),
+    selectRepoFullNameStmt: db.prepare(`SELECT full_name AS fullName FROM managed_selected_repo WHERE repo_id = ?`),
     selectAllReposStmt: db.prepare(
       `SELECT repo_id AS repoId, full_name AS fullName, is_private AS priv,
               installation_id AS installId, default_branch AS branch, cached_default_branch AS cachedDefaultBranch, html_url AS htmlUrl,
@@ -820,6 +838,8 @@ function prepareStatements(db: ManagedSql) {
         WHERE t.finding_id IN (SELECT value FROM json_each(?))
         ORDER BY t.finding_id ASC`,
     ),
+    selectTriageFixesStmt: db.prepare(`SELECT DISTINCT fix FROM managed_finding_triage
+      WHERE finding_id IN (SELECT value FROM json_each(?)) AND fix IS NOT NULL ORDER BY fix`),
     annotationTriageRevisionStmt: db.prepare(`
       SELECT t.finding_id AS id,
         (SELECT e.batch_id FROM managed_finding_triage_event e
@@ -1065,6 +1085,9 @@ function selectedRepoMethods(stmts: ReturnType<typeof prepareStatements>) {
       const rows = (await selectAllReposStmt.all()) as RepoRow[]
       return rows.map(readManagedRepo)
     },
+    async getRepoFullName(repoId: number): Promise<string | null> {
+      return ((await stmts.selectRepoFullNameStmt.get(repoId)) as { fullName: string } | undefined)?.fullName ?? null
+    },
     async deactivateRepo(repoId: number): Promise<boolean> {
       return Number((await deactivateRepoStmt.run(repoId)).changes) > 0
     },
@@ -1289,6 +1312,10 @@ function triageMethods(stmts: ReturnType<typeof prepareStatements>, historyLimit
         actorId: r.actorId, actorLogin: r.actorLogin, actorName: r.actorName, at: r.at,
       }))
     },
+    async listTriageFixes(findingIds: readonly string[]): Promise<string[]> {
+      if (findingIds.length === 0) return []
+      return ((await stmts.selectTriageFixesStmt.all(JSON.stringify(findingIds))) as { fix: string }[]).map(row => row.fix)
+    },
     async listTriage(findingIds: readonly string[]): Promise<TriageRow[]> {
       if (findingIds.length === 0) return []
       const rows = (await selectTriageStmt.all(JSON.stringify(findingIds))) as TriageDbRow[]
@@ -1658,10 +1685,11 @@ export function createManagedMethods(db: ManagedSql, options: ManagedDbOptions =
       const row = (await selectOwnSessionStmt.get(id, now)) as SessionRow | undefined
       if (row == null) return null
       await touchUserSeenStmt.run(now, row.uid, now)
-      return {
-        session: { id: row.id, userId: row.uid, csrfToken: row.csrf, expiresAt: row.exp, uploadKey: row.uploadKey },
-        user: { id: row.uid, login: row.login, name: row.name, avatarUrl: row.avatar, role: row.role },
-      }
+      return ownSession(row)
+    },
+    async getSessionWithUser(id, now) {
+      const row = (await selectOwnSessionStmt.get(id, now)) as SessionRow | undefined
+      return row == null ? null : ownSession(row)
     },
     async createViewSession(view, now) {
       if (Number((await insertViewSessionStmt.run(view.id, view.csrfToken, now, view.userId, view.viewerSessionId, now)).changes) === 0) return false
@@ -1672,11 +1700,11 @@ export function createManagedMethods(db: ManagedSql, options: ManagedDbOptions =
       const row = (await selectViewSessionStmt.get(id, viewerSessionId, now, now)) as ViewSessionRow | undefined
       if (row == null) return null
       await touchUserSeenStmt.run(now, row.viewerId, now)
-      return {
-        session: { id: row.id, userId: row.uid, csrfToken: row.csrf, expiresAt: row.exp, uploadKey: row.uploadKey,
-          viewer: { id: row.viewerId, login: row.viewerLogin, name: row.viewerName } },
-        user: { id: row.uid, login: row.login, name: row.name, avatarUrl: row.avatar, role: row.role },
-      }
+      return viewSession(row)
+    },
+    async getViewSessionWithUser(id, viewerSessionId, now) {
+      const row = (await selectViewSessionStmt.get(id, viewerSessionId, now, now)) as ViewSessionRow | undefined
+      return row == null ? null : viewSession(row)
     },
     async ensureSessionUploadKey(id, candidate) {
       const row = (await ensureUploadKeyStmt.get(candidate, id)) as { uploadKey: string } | undefined

package/server-managed/db-neon.ts

@@ -8,7 +8,7 @@ import { AsyncLocalStorage } from 'node:async_hooks'
 import { WebSocket } from 'ws'
 import { type ManagedDb, type ManagedDbOptions, createManagedMethods } from './db-methods.ts'
 import { revisionSchema } from './revisions.ts'
-import { MANAGED_SCHEMA, VIEW_SESSION_INDEX } from './db-schema.ts'
+import { MANAGED_SCHEMA, REPO_UPLOAD_INDEXES, VIEW_SESSION_INDEX } from './db-schema.ts'
 import { STORAGE_SCHEMA } from './storage-db.ts'
 import { GITHUB_COMMIT_SCHEMA, GITHUB_METADATA_SCHEMA, GITHUB_STATE_REASON_COLUMN } from './github-metadata.ts'
 import { MANAGED_ISSUE_SCHEMA } from './managed-issues.ts'
@@ -27,7 +27,8 @@ export interface PgConnection {
     rows: Record<string, unknown>[]; rowCount?: number | null
     fields?: { name: string; dataTypeID: number }[]
   }>
-  release(): Promise<void>
+  // After a failure the connection's state is unknown: discard it, never reuse it.
+  release(discard?: boolean): Promise<void>
 }
 export type PgConnect = () => Promise<PgConnection>
 // Content/access mutations cooperate on this transaction-scoped lock. Reads,
@@ -38,7 +39,7 @@ async function currentSchema(db: PgConnection): Promise<boolean> {
   const exists = (await db.query("SELECT to_regclass('managed_schema_version') AS name")).rows[0]?.['name']
   if (!exists) return false
   const versions = new Set((await db.query('SELECT version FROM managed_schema_version')).rows.map(row => Number(row['version'])))
-  return Array.from({ length: 30 }, (_, i) => i + 1).every(version => versions.has(version))
+  return Array.from({ length: 31 }, (_, i) => i + 1).every(version => versions.has(version))
 }
 
 async function migrateRepositoryDefaultCache(db: PgConnection): Promise<void> {
@@ -169,6 +170,12 @@ async function migrateRepositoryDependencyReviewLockfiles(db: PgConnection): Pro
   await db.query('INSERT INTO managed_schema_version VALUES (30)')
 }
 
+async function migrateRepoUploadIndexes(db: PgConnection): Promise<void> {
+  if ((await db.query('SELECT version FROM managed_schema_version WHERE version = 31')).rows.length > 0) return
+  await db.query(REPO_UPLOAD_INDEXES)
+  await db.query('INSERT INTO managed_schema_version VALUES (31)')
+}
+
 async function initialize(db: PgConnection): Promise<void> {
   if (await currentSchema(db)) return
   await db.query('BEGIN')
@@ -243,7 +250,7 @@ async function initialize(db: PgConnection): Promise<void> {
       await db.query(postgresSchema(revisionSchema(true)) + '; INSERT INTO managed_schema_version VALUES (11)')
     }
     for (const migrate of [migrateRepositoryDefaultCache, migrateBundleBuildLeases, migrateBundleVisibility, migrateLinkReports, migrateRepositoryAliases, migrateHiddenTeams, migrateIssueFixes, migrateBundleProvenance, migrateUpstreamCache, migrateBundleBuildConditions, migrateSessionUploadKeys, migrateViewSessions, migrateGithubCommits, migrateTeamNpmScopes, migrateDependencyReviews, migrateGithubLinks, migrateRepositoryDependencyReviews,
-      migrateRepositoryDependencyReviewLockfiles]) await migrate(db)
+      migrateRepositoryDependencyReviewLockfiles, migrateRepoUploadIndexes]) await migrate(db)
     await db.query('COMMIT')
   } catch (err) {
     await db.query('ROLLBACK')
@@ -276,7 +283,7 @@ function requestConnections(connect: PgConnect) {
       const connection = await connect()
       let result: T
       try { result = await work(connection) }
-      catch (error) { await connection.release().catch(() => {}); throw error }
+      catch (error) { await connection.release(true).catch(() => {}); throw error }
       await connection.release()
       return result
     }
@@ -287,7 +294,7 @@ function requestConnections(connect: PgConnect) {
       try { return await work(connection) }
       catch (error) {
         delete request.connection
-        await connection.release().catch(() => {})
+        await connection.release(true).catch(() => {})
         throw error
       }
     })
@@ -303,7 +310,7 @@ function requestConnections(connect: PgConnect) {
     finally {
       request.ended = true
       await request.queue
-      if (failed) await request.connection?.release().catch(() => {})
+      if (failed) await request.connection?.release(true).catch(() => {})
       else await request.connection?.release()
     }
   }
@@ -313,7 +320,8 @@ function requestConnections(connect: PgConnect) {
 // Exposed for parity tests against real PostgreSQL semantics via PGlite.
 export async function openPostgresManagedDb(connect: PgConnect, options: ManagedDbOptions = {}, reuseConnections = false): Promise<ManagedDb> {
   const initial = await connect()
-  try { await initialize(initial) } finally { await initial.release() }
+  try { await initialize(initial) } catch (err) { await initial.release(true).catch(() => {}); throw err }
+  await initial.release()
   const { withConnection, withRequest } = requestConnections(connect)
   const context = new AsyncLocalStorage<PgConnection>()
   let closed = false
@@ -376,20 +384,52 @@ export async function openPostgresManagedDb(connect: PgConnect, options: Managed
   return methods
 }
 
-export async function openNeonManagedDb(url: string, options: ManagedDbOptions = {}): Promise<ManagedDb> {
-  // Reuse the e2e optional-driver boundary. Requests lease one connection and
-  // close it before returning; no socket must survive a frozen invocation.
-  const { Client, neonConfig } = await import('../server-e2e/neon-driver.ts') as unknown as {
-    Client: new (url: string) => { connect(): Promise<void>; end(): Promise<void>; query: PgConnection['query']; on?(event: 'error', listener: (error: Error) => void): void }
+// Idle connections stay open this long between leases, so a warm instance's
+// requests and feed polls (three seconds apart) skip the TLS, WebSocket and
+// Postgres handshake a new connection repeats.
+const NEON_POOL_IDLE_MS = 5_000
+
+type NeonPoolClient = {
+  query: PgConnection['query']
+  release(discard?: boolean): void
+  on(event: string, listener: (...args: unknown[]) => void): void
+}
+export type NeonPool = {
+  connect(): Promise<NeonPoolClient>
+  end(): Promise<void>
+  on(event: string, listener: (...args: unknown[]) => void): void
+}
+
+// `attachPool` is Vercel's attachDatabasePool on serverless instances: each
+// release keeps the invocation alive until idle connections have closed, so
+// no socket survives a frozen instance.
+export async function openNeonManagedDb(url: string, options: ManagedDbOptions = {}, attachPool?: (pool: NeonPool) => void): Promise<ManagedDb> {
+  // Reuse the e2e optional-driver boundary.
+  const { Pool, neonConfig } = await import('../server-e2e/neon-driver.ts') as unknown as {
+    Pool: new (config: { connectionString: string; max: number; idleTimeoutMillis: number }) => NeonPool
     neonConfig: { webSocketConstructor: typeof WebSocket }
   }
   neonConfig.webSocketConstructor = WebSocket
-  return openPostgresManagedDb(async () => {
-    const client = new Client(url)
-    // A remote disconnect between operations must reject the next query, not
-    // become an unhandled EventEmitter error while the request is reading Blob.
-    client.on?.('error', () => {})
-    try { await client.connect() } catch (err) { await client.end().catch(() => {}); throw err }
-    return { query: (sql, params) => client.query(sql, params), release: () => client.end() }
-  }, options, true)
+  // Leases stay unbounded, one per request or operation as before: a cap would
+  // stall a request that holds one while it awaits work needing another.
+  const pool = new Pool({ connectionString: url, max: Infinity, idleTimeoutMillis: NEON_POOL_IDLE_MS })
+  // The pool evicts an idle connection the server closed. Neither that nor a
+  // remote disconnect while leased may become an unhandled EventEmitter error;
+  // a leased one must instead reject its next query, and is then discarded.
+  pool.on('error', () => {})
+  attachPool?.(pool)
+  const failed = new WeakSet<NeonPoolClient>(), watched = new WeakSet<NeonPoolClient>()
+  let ending: Promise<void> | undefined
+  const end = () => ending ??= pool.end()
+  let db: ManagedDb
+  try {
+    db = await openPostgresManagedDb(async () => {
+      const client = await pool.connect()
+      if (!watched.has(client)) { watched.add(client); client.on('error', () => { failed.add(client) }) }
+      return { query: (sql, params) => client.query(sql, params),
+        release: discard => Promise.try(() => client.release(discard === true || failed.has(client))) }
+    }, options, true)
+  } catch (err) { await end().catch(() => {}); throw err }
+  const close = db.close
+  return { ...db, async close() { try { await close() } finally { await end() } } }
 }

package/server-managed/db-schema.ts

@@ -7,6 +7,10 @@ import { GITHUB_LINK_SCHEMA } from './github-links.ts'
 
 // Created after the column migration, which predates it on older databases.
 export const VIEW_SESSION_INDEX = 'CREATE INDEX IF NOT EXISTS managed_session_viewer_idx ON managed_session(viewer_session);'
+// What a team's scopes join reports and bundles on: their repository, and the
+// directory in it. Created after the column migrations, as above.
+export const REPO_UPLOAD_INDEXES = `CREATE INDEX IF NOT EXISTS managed_report_repo_idx ON managed_report(repo_id, repo_directory);
+CREATE INDEX IF NOT EXISTS managed_bundle_repo_idx ON managed_bundle(repo_id, repo_directory);`
 
 export const MANAGED_SCHEMA = `
 CREATE TABLE IF NOT EXISTS managed_user (

package/server-managed/db.ts

@@ -7,7 +7,7 @@ import { migrateReportLocations } from './report-migration.ts'
 import { initCommentMethods } from './comments.ts'
 import { initActivityMethods } from './activity.ts'
 import { revisionSchema } from './revisions.ts'
-import { MANAGED_SCHEMA, VIEW_SESSION_INDEX } from './db-schema.ts'
+import { MANAGED_SCHEMA, REPO_UPLOAD_INDEXES, VIEW_SESSION_INDEX } from './db-schema.ts'
 import { GITHUB_LINK_USER_COLUMNS } from './github-links.ts'
 import { REPOSITORY_DEPENDENCY_REVIEW_COLUMNS } from './repository-dependency-reviews.ts'
 import { STORAGE_SCHEMA } from './storage-db.ts'
@@ -113,6 +113,7 @@ export function openSqliteManagedDb(path: string, options: ManagedDbOptions = {}
     if (addedVisible) db.prepare('UPDATE managed_report SET visible = 1 WHERE visible = 0').run()
     ensureColumn(db, 'managed_bundle', 'uploaded_by_login', 'TEXT')
     ensureColumn(db, 'managed_bundle', 'repo_directory', "TEXT NOT NULL DEFAULT ''")
+    db.exec(REPO_UPLOAD_INDEXES)
     ensureColumn(db, 'managed_bundle', 'visible', 'INTEGER NOT NULL DEFAULT 1')
     // Existing rows stay NULL (unknown): some may have been built on the server.
     ensureColumn(db, 'managed_bundle', 'provenance', 'TEXT')

package/server-managed/dependency-reviews.ts

@@ -134,13 +134,23 @@ async function expandReviews(db: ManagedSql, rows: unknown[], user: string): Pro
     JOIN managed_dependency_review r ON r.id = rt.review_id JOIN managed_team t ON t.id = rt.team_id JOIN managed_user u ON u.id = ?
     WHERE rt.review_id IN (${placeholders}) AND (r.user_id = u.id OR (${reviewsIn(false)}))
     ORDER BY t.name, t.id`).all(user, ...ids) as (ReviewTeam & { reviewId: string })[]
+  // Each review's own, in their order, by its id.
+  const byReview = <T extends { reviewId: string }>(list: T[]) => {
+    const of = new Map<string, Omit<T, 'reviewId'>[]>()
+    for (const { reviewId, ...row } of list) {
+      const own = of.get(reviewId)
+      if (own) own.push(row)
+      else of.set(reviewId, [row])
+    }
+    return of
+  }
+  const [entriesOf, teamsOf] = [byReview(entries), byReview(linked)]
   return reviews.map(review => {
     const snapshot = review.files === null ? null : JSON.parse(review.files) as string[] | { paths: string[]; nonTextFiles: string[] }
     const files = Array.isArray(snapshot) ? snapshot : snapshot?.paths ?? null
     const nonTextFiles = Array.isArray(snapshot) ? null : snapshot?.nonTextFiles ?? []
-    const ownEntries = fileEntries(entries.filter(entry => entry.reviewId === review.id).map(({ reviewId: _reviewId, ...entry }) => entry))
-    return { ...review, files, nonTextFiles, entries: ownEntries, ...summarizeReview(ownEntries, files, nonTextFiles),
-      teams: linked.filter(team => team.reviewId === review.id).map(({ reviewId: _reviewId, ...team }) => team) }
+    const ownEntries = fileEntries((entriesOf.get(review.id) ?? []) as ReviewEntry[])
+    return { ...review, files, nonTextFiles, entries: ownEntries, ...summarizeReview(ownEntries, files, nonTextFiles), teams: (teamsOf.get(review.id) ?? []) as ReviewTeam[] }
   })
 }