@preventive/triage 1.0.0-alpha.45 → 1.0.0-alpha.47

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@preventive/triage",
-  "version": "1.0.0-alpha.45",
+  "version": "1.0.0-alpha.47",
   "description": "Client & relay server for triaging of automated reports",
   "license": "MIT OR Apache-2.0",
   "author": {
@@ -139,6 +139,7 @@
     "server-managed/github-users.ts",
     "server-managed/github-oauth.ts",
     "server-managed/github-pulls.ts",
+    "server-managed/github-requests.ts",
     "server-managed/http-response.ts",
     "server-managed/http.ts",
     "server-managed/link-reports.ts",
@@ -156,6 +157,7 @@
     "server-managed/npm-risk.ts",
     "server-managed/npm-provenance.ts",
     "server-managed/kept.ts",
+    "server-managed/kept-briefly.ts",
     "server-managed/npm-kept.ts",
     "server-managed/npm-loads.ts",
     "server-managed/npm-delta.ts",
@@ -341,6 +343,7 @@
     "client/finding-link.js",
     "client/linked-findings.d.ts",
     "client/linked-findings.js",
+    "out/activity.js",
     "out/brotli-fallback.js",
     "out/chunk-*.js",
     "out/client-managed.js",

package/risk/actions/findings.js

@@ -64,16 +64,21 @@ function lockedIn(lockfiles, directory, name) {
 // The inputs a text names (`${{ inputs.title }}`).
 const inputsIn = text => typeof text === 'string' ? [...dotted(text).matchAll(/\$\{\{[^}]*?\binputs\s*\.\s*([\w-]+)/gu)].map(match => match[1]) : []
 
-// The inputs a step's action writes into a script: github-script's
-// `script`, and those an action of the repository's own (ScanOptions
-// `actions`) names in its `run:`s or hands to such an input of a step's.
+// The inputs a step's action, or a job's reusable workflow, writes into a
+// script: github-script's `script`; those one of the repository's own
+// (ScanOptions `actions`) names in its `run:`s or its jobs' images, or hands
+// to such an input of a step's or a job's; and each of another reusable
+// workflow's, or one whose text isn't told, as it may.
 function scriptInputs(step, actions, seen = new Set()) {
   if (step.uses?.repo?.toLowerCase() === 'actions/github-script') return ['script']
-  const dir = step.uses?.kind === 'local' && actions?.has(step.uses.path) && !seen.has(step.uses.path) ? step.uses.path : null
-  const read = dir === null ? null : readWorkflow('action', actions.get(dir))
+  if (step.uses?.kind === 'workflow' || (step.uses?.job && !actions?.has(step.uses.path))) return Object.keys(step.with ?? {})
+  const path = step.uses?.kind === 'local' && actions?.has(step.uses.path) && !seen.has(step.uses.path) ? step.uses.path : null
+  const read = path === null ? null : readWorkflow(step.uses.job ? 'workflow' : 'action', actions.get(path))
   if (!read || read instanceof YamlError) return []
-  return [...new Set(read.jobs.flatMap(job => job.steps.flatMap(each => [...inputsIn(each.run?.script),
-    ...scriptInputs(each, actions, new Set(seen).add(dir)).flatMap(input => inputsIn(each.with?.[input]))])))]
+  const inner = new Set(seen).add(path)
+  const handed = each => scriptInputs(each, actions, inner).flatMap(input => inputsIn(each.with?.[input]))
+  return [...new Set(read.jobs.flatMap(job => [...job.uses ? handed(job) : [], ...job.images.flatMap(image => inputsIn(image.text)),
+    ...job.steps.flatMap(each => [...inputsIn(each.run?.script), ...handed(each)])]))]
 }
 
 // Injections through the inputs an action writes into its scripts, and a
@@ -98,8 +103,8 @@ function jobFindings(job, triggers, { owner, lockfiles, external, actions }) {
     const finding = usesFinding(job.uses, owner)
     if (finding) found.push({ ...finding, line: job.uses.line })
     if (job.secrets === 'inherit' && job.uses.repo && ownerKind(job.uses.repo, owner) === 'third-party') found.push({ id: 'secrets-inherited', severity: 'high', uses: job.uses.uses, key: usesKey(job.uses), line: job.uses.line })
-    // An input of a reusable workflow, which one writes into its scripts.
-    for (const [input, value] of Object.entries(job.with ?? {})) for (const { index: _index, ...injected } of scriptInjections(value, triggers)) found.push({ ...injected, line: job.withLines[input] })
+    // An input a reusable workflow writes into its scripts.
+    for (const input of scriptInputs(job, actions)) for (const { index: _index, ...injected } of scriptInjections(job.with?.[input], triggers)) found.push({ ...injected, line: job.withLines[input] })
   }
   for (const image of job.images) {
     if (!image.read?.digest && !image.text.includes('${{')) found.push({ ...imageFinding(image.text, image.read), line: image.line })

package/risk/actions/scripts/shell.js

@@ -12,7 +12,11 @@ const SHELL = new RegExp(String.raw`^(?:.*[\/\\])?${SHELLS}(?:\.exe)?$`, 'iu')
 // pipe, `&&` or `||` the next line goes on from), and the line it starts
 // on, counting from 0.
 export function scriptLines(script) {
-  const lines = script.split('\n')
+  // An expression (`${{ … }}`), which GitHub writes in before the shell reads
+  // the script, read as a variable is: a value unknown here, each line it
+  // spans past its first continuing the one it is on; a `}}` in one of its
+  // strings (`format('{{0}}')`) not its end.
+  const lines = script.replaceAll(/\$\{\{(?:'[^']*'|[^'])*?\}\}/gu, expression => `$EXPRESSION${' \\\n'.repeat(expression.split('\n').length - 1)}`).split('\n')
   const joined = []
   for (let at = 0; at < lines.length; at++) {
     const start = at

package/risk/index.d.ts

@@ -40,8 +40,10 @@ export interface AssessNpmOptions {
   // Where what is read is kept, by type (risk/npm/registry.js and assess.js
   // name each): `npm/tarballs`, `risk/npm/versions`, `risk/npm/packages`,
   // `risk/npm/old-versions`, `risk/npm/public`, `risk/npm/downloads`,
-  // `risk/npm/advisories` and `risk/npm/assessments`.
-  cache?: CacheStore | false
+  // `risk/npm/advisories` and `risk/npm/assessments`. One that reads records
+  // of any types at once (`readEach`, each null where none is kept) is read
+  // so where risk reads several together.
+  cache?: (CacheStore & { readEach?(entries: [type: string, key: string][]): Promise<unknown[]> }) | false
   // Asks for a package's whole document in risk's stead, as the managed
   // server does within its bounds: null where npm has none for this asker.
   // `authorized` whether it may be asked with the caller's npm token: the
@@ -200,8 +202,11 @@ export interface ScanOptions {
   // Its lockfiles' paths, the packages each locks, as npx runs those, by
   // name and by `name@version`, and those only devDependencies need.
   lockfiles?: { path: string; names: ReadonlySet<string>; dev?: ReadonlySet<string> }[]
-  // Its own actions' metadata by their directories, for where they install
-  // its packages; else each counts as installing them anywhere.
+  // Its own actions' metadata by their directories, and its workflows by
+  // their paths: for where its actions install its packages, else each
+  // counts as installing them anywhere; and for the inputs its actions and
+  // reusable workflows write into their scripts, else each of a reusable
+  // workflow's counts as one.
   actions?: ReadonlyMap<string, string> | null
 }
 

package/risk/npm/assess.js

@@ -197,15 +197,22 @@ export async function assessNpm(name, version, { oldVersion = null, fromEmpty =
   const facts = await npmPackageFacts(name, version, oldVersion, context)
   const old = facts.oldVersion
   if (old !== null && !facts.versions.has(old)) throw new NpmRiskError('version-not-found', `npm has no ${name}@${old}`)
-  const malware = npmMalwareFinding({ takenDown: facts.takenDown, advisories: advisories ? await npmVersionAdvisories(name, version, osv, context) : [] })
-  if (!facts.versions.has(version)) {
+  // Its advisories, its lasting risk and its downloads need none of each
+  // other, so all are asked at once, and waited on in this order, so that a
+  // failure fails it as the first of them failing would.
+  const listed = facts.versions.has(version)
+  const advised = settledLater(advisories ? npmVersionAdvisories(name, version, osv, context) : Promise.resolve([]))
+  const keeping = listed ? settledLater(lasting(name, version, old, facts, context, fromEmpty)) : null
+  const counting = listed && downloads && popularity ? settledLater(npmDownloads(name, context)) : null
+  const malware = npmMalwareFinding({ takenDown: facts.takenDown, advisories: await advised })
+  if (!listed) {
     if (!malware) throw new NpmRiskError('version-not-found', `npm has no ${name}@${version}`)
     return { name, version, oldVersion: null, published: facts.removed.get(version), removed: true, findings: [malware], files: {}, dependencies: { added: [], changed: [] },
       score: npmRiskScore([malware]) }
   }
   const { published, manifest } = facts.versions.get(version)
-  const kept = await lasting(name, version, old, facts, context, fromEmpty)
-  const counted = downloads && popularity ? await npmDownloads(name, context) : null
+  const kept = await keeping
+  const counted = await counting
   const own = npmVersionFindings({ deprecated: facts.deprecated[version], published, minimumReleaseAge, now, known: Boolean(manifest.knownAccounts), scope: npmKnownScope(name),
     provenance: Boolean(manifest.provenance), downloads: counted })
   const was = old === null ? null : facts.versions.get(old).published
@@ -225,6 +232,10 @@ export async function assessNpm(name, version, { oldVersion = null, fromEmpty =
 // A dependency's key among a version's, by its kind and name.
 const keyOf = row => `${row.kind ?? ''}\0${row.name}`
 
+// `promise`, waited on later: its failure, if it fails before then, not
+// thrown as unhandled meanwhile.
+const settledLater = promise => { promise.catch(() => {}); return promise }
+
 // The keys of the dependencies a version holds that nothing of it imports
 // (`kept`, npmLastingRisk's: its `held-unused-deps`), those risk counts
 // (dependencies.js npmUnusedDependencyCounted).

package/risk/npm/registry.js

@@ -87,6 +87,11 @@ async function kept({ cache }, type, key, ask, fresh = () => true) {
   return value
 }
 
+// What is kept under each `[type, key]` of `entries`, in their order, null
+// where nothing is: in one read where the cache reads records of any types at
+// once (`readEach`), else one a key.
+const readEach = (cache, entries) => cache.readEach ? cache.readEach(entries) : Promise.all(entries.map(([type, key]) => cache.read(type, key)))
+
 // An answer's body as JSON, read no further than `limit` bytes.
 async function jsonOf(res, limit, what) {
   const tooLarge = () => new NpmRiskError('upstream-too-large', `npm's answer for ${what} is over ${limit} bytes`)
@@ -169,7 +174,7 @@ export async function npmPackageFacts(name, version, oldVersion, context) {
   const given = oldVersion === true ? fresh(picked) ? picked.oldVersion : undefined : oldVersion
   if (cache && given !== undefined) {
     const wanted = given === null ? [version] : [version, given]
-    const [facts, pkg] = await Promise.all([Promise.all(wanted.map(at => cache.read('risk/npm/versions', `${name}@${at}`))), cache.read('risk/npm/packages', name)])
+    const [pkg, ...facts] = await readEach(cache, [['risk/npm/packages', name], ...wanted.map(at => ['risk/npm/versions', `${name}@${at}`])])
     const gone = at => Object.hasOwn(pkg.removed, at)
     if (fresh(pkg) && 'removed' in pkg && wanted.every((at, i) => facts[i] || gone(at))) {
       return { versions: new Map(wanted.flatMap((at, i) => gone(at) ? [] : [[at, facts[i]]])), removed: new Map(wanted.filter(gone).map(at => [at, pkg.removed[at]])),

package/server-e2e/app.ts

@@ -102,11 +102,12 @@ import { createBusReceiver } from './bus-receiver.ts'
 import { e2eStorageLines } from '../server-common/storage-log.ts'
 
 // Each embedding gets its own stores, transports, timers and shutdown state.
-export async function createE2eApp(config = loadConfig()) {
-  return await initializeApp(rollback => assembleE2eApp(config, rollback))
+// `ui: false` serves only the API (see ./http.ts).
+export async function createE2eApp(config = loadConfig(), { ui = true }: { ui?: boolean } = {}) {
+  return await initializeApp(rollback => assembleE2eApp(config, ui, rollback))
 }
 
-async function assembleE2eApp(config: Config, rollback: AsyncDisposableStack) {
+async function assembleE2eApp(config: Config, ui: boolean, rollback: AsyncDisposableStack) {
   // All external inputs (env vars + optional config.json) are parsed
   // and validated in ./config.ts; destructure into the uppercase names
   // the rest of this module uses.
@@ -388,7 +389,7 @@ async function assembleE2eApp(config: Config, rollback: AsyncDisposableStack) {
   // below.
   const httpServer = createHttpServer({
     wss, restDeps: objstoreRestDeps, sseServer, serverInfo: SERVER_INFO, isOriginAllowed,
-    isShuttingDown, track, handleSaveRest,
+    isShuttingDown, track, handleSaveRest, ui,
     restPutIdleTimeoutMs: REST_PUT_IDLE_TIMEOUT_MS, debug: DEBUG,
   })
   const requestHandler = httpServer.listeners('request')[0]!

package/server-e2e/http.ts

@@ -59,6 +59,9 @@ export type HttpServerDeps = {
   handleSaveRest: (req: HttpRequest, res: ServerResponse) => Promise<void>
   restPutIdleTimeoutMs: number
   debug: boolean
+  // Serve the static UI bundle (default). False serves only the API and
+  // never reads `out/`, for hosts that serve the UI themselves.
+  ui?: boolean
 }
 
 // `POST /api/sync/save` dispatch. Returns the in-flight handler promise when
@@ -114,12 +117,12 @@ function dispatchSaveRest(
 }
 
 export function createHttpServer(deps: HttpServerDeps): Server {
-  const { wss, restDeps, sseServer, serverInfo, isOriginAllowed, isShuttingDown, track, handleSaveRest, restPutIdleTimeoutMs, debug } = deps
+  const { wss, restDeps, sseServer, serverInfo, isOriginAllowed, isShuttingDown, track, handleSaveRest, restPutIdleTimeoutMs, debug, ui = true } = deps
   // Static-file plane (see ./static.ts). The directory is the
   // `build.js build` output sibling to this file; the loader handles
   // enumeration, pre-compression, and ETag derivation. Plugged in after
   // the `/api/objstore/...` REST branch.
-  const handleStatic = loadStatic(fileURLToPath(new URL('../out', import.meta.url)), serverInfo.deepviewScanServer ?? null)
+  const handleStatic = ui ? loadStatic(fileURLToPath(new URL('../out', import.meta.url)), serverInfo.deepviewScanServer ?? null) : () => false
 
   const httpServer = createServer((req: HttpRequest, res: ServerResponse) => {
     // Static mode probe: GET /api/config → this server's `server-info` as JSON.

package/server-managed/activity.ts

@@ -176,12 +176,21 @@ export function activityMethods(db: ManagedSql): ActivityStore {
       const stmts = contexts == null ? admin : manager
       const scope = contexts == null ? {} : { contexts: JSON.stringify(contexts), userId: userId ?? '' }
       const params = { ...scope, kind, query, repo, actor }
-      const { total } = (await stmts.count.get(params)) as { total: number }
-      const currentPage = Math.min(page, Math.max(1, Math.ceil(total / limit)))
-      const history = (await stmts.rows.all({ ...params, limit, offset: (currentPage - 1) * limit })) as ActivityEntry[]
-      const filters: ActivityFilters = {
-        repos: ((await stmts.repos.all(scope)) as { repo: string }[]).map(row => row.repo),
-        users: ((await stmts.users.all(scope)) as ActivityFilters['users']).map(row => ({ id: row.id, login: row.login, detail: row.detail })),
+      const read = async (at: number) => (await stmts.rows.all({ ...params, limit, offset: (at - 1) * limit })) as (ActivityEntry & { total: number | string })[]
+      // A page's rows carry the total. Only a page past the last has none to
+      // carry it: it is counted, and the last page read in its place.
+      let currentPage = page, rows = await read(page)
+      let total = rows.length > 0 ? Number(rows[0]!.total) : 0
+      if (rows.length === 0 && page > 1) {
+        total = Number(((await stmts.count.get(params)) as { total: number | string }).total)
+        currentPage = Math.min(page, Math.max(1, Math.ceil(total / limit)))
+        if (currentPage !== page) rows = total === 0 ? [] : await read(currentPage)
+      }
+      const history = rows.map(({ total: _total, ...entry }) => entry)
+      const filters: ActivityFilters = { repos: [], users: [] }
+      for (const row of (await stmts.filters.all(scope)) as { facet: string; id: string; login: string; detail: string | null }[]) {
+        if (row.facet === 'repo') filters.repos.push(row.id)
+        else filters.users.push({ id: row.id, login: row.login, detail: row.detail })
       }
       return { history, total, page: currentPage, limit, filters }
     },
@@ -199,17 +208,21 @@ function activityStatements(db: ManagedSql, source: string) {
     AND (:repo = '' OR repo = :repo) AND (:actor = '' OR actorKey = :actor)
     AND (:query = '' OR instr(lower(coalesce(actor, '') || ' ' || action || ' ' ||
       coalesce(repo, '') || ' ' || coalesce(report, '') || ' ' || coalesce(finding, '')), lower(:query)) > 0)`
+  // A page's rows each carry the total, so the source is read once for both;
+  // the selector choices, repositories then users, once between them.
   return {
     count: db.prepare(`SELECT count(*) AS total FROM (${filtered}) AS filtered`),
-    rows: db.prepare(`${filtered} ORDER BY at DESC,
+    rows: db.prepare(`SELECT filtered.*, count(*) OVER () AS total FROM (${filtered}) AS filtered ORDER BY at DESC,
       CASE WHEN kind = 'triage' THEN CAST(substr(id, instr(id, ':') + 1) AS INTEGER) ELSE 0 END DESC,
       id DESC LIMIT :limit OFFSET :offset`),
-    repos: db.prepare(`${activity} SELECT DISTINCT repo FROM activity WHERE repo IS NOT NULL AND repo <> '' ORDER BY repo`),
-    users: db.prepare(`${activity} SELECT a.actorKey AS id, COALESCE(u.login, a.actor, a.actorId) AS login,
-      CASE WHEN a.actorId IS NULL THEN 'Legacy actor' ELSE NULL END AS detail FROM (
+    filters: db.prepare(`${activity} SELECT 'repo' AS facet, repo AS id, repo AS login, NULL AS detail, repo AS sort, '' AS tiebreak
+      FROM (SELECT DISTINCT repo FROM activity WHERE repo IS NOT NULL AND repo <> '') AS repos
+      UNION ALL SELECT 'user' AS facet, a.actorKey AS id, COALESCE(u.login, a.actor, a.actorId) AS login,
+      CASE WHEN a.actorId IS NULL THEN 'Legacy actor' ELSE NULL END AS detail, COALESCE(u.login, a.actor, a.actorId) AS sort, a.actorKey AS tiebreak FROM (
         SELECT actorKey, actorId, actor, ROW_NUMBER() OVER (PARTITION BY actorKey ORDER BY at DESC, id DESC) AS position
         FROM activity WHERE actorKey IS NOT NULL AND actorKey <> 'legacy:'
-      ) a LEFT JOIN managed_user u ON u.id = a.actorId WHERE a.position = 1 ORDER BY login, a.actorKey`),
+      ) a LEFT JOIN managed_user u ON u.id = a.actorId WHERE a.position = 1
+      ORDER BY facet, sort, tiebreak`),
   }
 }
 

package/server-managed/app-agents.ts

@@ -2,29 +2,18 @@
 // tab's, server-managed/repository-agents.ts, whose marks the Commits tab
 // reads on commits too, repository-history.ts).
 import type { AppAgent, AppAgentMarks } from '../common/managed/agent-tasks.ts'
-import { GITHUB_AGENTS } from '../common/managed/github-agents.ts'
+import { GITHUB_AGENTS, type GithubAgent } from '../common/managed/github-agents.ts'
 
 // The agents known by their GitHub Apps or accounts, beside Claude and
-// Codex: each its id and name, its avatar (its mark, served by
-// /api/avatar/<avatar>, for these alone: a GitHub App's, `app-<id>`, or
-// account's, `user-<id>`), the fingerprint it leaves as a line of its pull
-// requests' bodies and its commits' messages, the account its work is
-// authored by (its id and the logins GitHub names it by, told by both), and
-// its branches' prefix. Their work may carry Claude's or
-// Codex's marks too, those its tools. Copilot's coding agent opens its pull
-// requests and authors its commits as its account, Copilot (198982749), on
-// `copilot/` branches; Dependabot, its GitHub App (29110), opens its pull
-// requests as its account, `dependabot` (49699333, `dependabot[bot]` to
-// GitHub's REST API and in its address), on `dependabot/<ecosystem>/…`
-// branches. Their accounts and marks are those the app draws their work by
-// wherever it shows it (common/managed/github-agents.ts): Copilot's its own,
-// the app's to draw, no avatar.
-const { copilot, dependabot } = GITHUB_AGENTS
-export const APP_AGENTS: readonly (AppAgent & AppAgentMarks)[] = [
-  { id: 'neo', name: 'Neo', avatar: 'app-3115942', fingerprint: '🤖 Generated with [Neo](', prefix: 'neo/' },
-  { id: 'copilot', name: copilot.name, account: copilot.accounts[0], prefix: 'copilot/' },
-  { id: 'dependabot', name: dependabot.name, avatar: dependabot.avatar, account: dependabot.accounts[0], prefix: 'dependabot/' },
-]
+// Codex: those of GITHUB_AGENTS with branches of their own, in its order
+// (common/managed/github-agents.ts, where each is told), each its id and
+// name, its avatar (its mark, served by /api/avatar/<avatar>, a GitHub
+// App's, `app-<id>`), the fingerprint it leaves, the account its work is
+// authored by (its id and the logins GitHub names it by, told by both, or by
+// its id alone where it names none), and its branches' prefix.
+export const APP_AGENTS: readonly (AppAgent & AppAgentMarks)[] = (Object.entries(GITHUB_AGENTS) as [string, GithubAgent][])
+  .flatMap(([id, { name, avatar, accounts: [account], prefix, fingerprint }]) => prefix ? [{ id, name, prefix, ...avatar ? { avatar } : {},
+    ...account?.id === undefined ? {} : { account: { id: account.id, logins: account.logins } }, ...fingerprint ? { fingerprint } : {} }] : [])
 // The prefixes of the branches agents work on: Claude Code's and Codex's,
 // and the app agents'.
 export const AGENT_BRANCH_PREFIXES = ['claude/', 'codex/', ...APP_AGENTS.map(agent => agent.prefix)]

package/server-managed/bundle-build-worker.js

@@ -96,13 +96,17 @@ export function buildErrorCode(error, message) {
 if (parentPort && workerData?.type === 'managed-bundle-build') {
   // Send diagnostics to the request's parent thread, which writes them before
   // returning the HTTP response. Worker stdout can be lost on termination.
-  const send = message => {
+  const send = (message, transfer = []) => {
     // Node worker messages have no browser target origin.
     // oxlint-disable-next-line unicorn/require-post-message-target-origin
-    parentPort.postMessage(message)
+    parentPort.postMessage(message, transfer)
   }
   try {
-    send(await buildStasisBundle(workerData, undefined, stage => send({ type: 'progress', stage })))
+    const built = await buildStasisBundle(workerData, undefined, stage => send({ type: 'progress', stage }))
+    // The bytes handed over rather than copied, where they alone fill their
+    // buffer (a small one may share Node's pool, which can't be moved).
+    const { bytes } = built
+    send(built, bytes.byteOffset === 0 && bytes.byteLength === bytes.buffer.byteLength ? [bytes.buffer] : [])
   } catch (error) {
     const diagnostic = bundleBuildDiagnostic(error, workerData.token)
     const code = buildErrorCode(error, diagnostic.message)

package/server-managed/bundle-build.ts

@@ -95,7 +95,7 @@ export function githubBundleFilename(github: string, directory: string, commit:
   return `${repo}.${dir}${tail}`
 }
 
-export interface BuiltBundle { bytes: Uint8Array; directory: string; filename: string }
+export interface BuiltBundle { bytes: Buffer; directory: string; filename: string }
 export interface BuildRequest {
   input: BundleBuildInput; github: string; token: string | null; maxBytes: number; scopes: (string | null)[]
   // Upstream's disk cache for what a build fetches (setCacheDir), or null for
@@ -174,14 +174,16 @@ export async function buildRepositoryBundle(userId: string, request: BuildReques
       const abort = () => fail(signal.reason instanceof BundleBuildError ? signal.reason.status : 499,
         signal.reason instanceof BundleBuildError ? signal.reason.code : 'build-cancelled')
       signal.addEventListener('abort', abort, { once: true })
-      running.on('message', (message: BuiltBundle & { type?: string; stage?: BundleBuildStage; error?: string; status?: number; diagnostic?: BundleBuildDiagnostic }) => {
+      running.on('message', (message: Omit<BuiltBundle, 'bytes'> & { bytes: Uint8Array; type?: string; stage?: BundleBuildStage; error?: string; status?: number; diagnostic?: BundleBuildDiagnostic }) => {
         if (settled) return
         if (message.type === 'progress' && message.stage) { stage = message.stage; log('progress'); return }
         if (message.error) { fail(message.status ?? 422, message.error, { diagnostic: message.diagnostic }); return }
         settled = true
         cleanup()
         log('completed', { byteSize: message.bytes.length })
-        resolve({ bytes: Buffer.from(message.bytes), directory: message.directory, filename: message.filename })
+        // A view of the bytes the worker handed over, not a copy of them.
+        const { bytes } = message
+        resolve({ bytes: Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength), directory: message.directory, filename: message.filename })
       })
       running.once('error', error => fail(422, 'build-failed', { diagnostic: bundleBuildDiagnostic(error, request.token) }))
       running.once('exit', exitCode => fail(422, 'build-failed', { exitCode }))

package/server-managed/bundle-cache.ts

@@ -24,11 +24,17 @@ export type BundleCacheRecord = Pick<ManagedBundle, 'id' | 'integrity' | 'filena
 export interface BundleSummary { files: number; codeFiles: number; lines: number; commit?: string; stasisVersion?: number; versionedPackages?: number }
 
 export async function readBundleDetails(record: BundleCacheRecord, store: BundleStore) {
+  return (await readSizedBundleDetails(record, store))?.details ?? null
+}
+
+// As readBundleDetails, with the bytes the bundle decoded to: about what
+// holding its details takes.
+export async function readSizedBundleDetails(record: BundleCacheRecord, store: BundleStore) {
   const bytes = await store.get(record.id, record.kind)
   if (!bytes) return null
   const decoded = record.kind === 'stasis' || record.kind === 'sourcemap' ? await decompress(bytes, { maxOutputLength: MAX_DECODED_BYTES }) : bytes
   if (decoded.length > MAX_DECODED_BYTES) throw new Error('Decoded bundle too large')
-  return parseBundleContents(decodeUtf8(decoded), { integrity: record.integrity, kind: record.kind, size: record.byteSize })
+  return { details: parseBundleContents(decodeUtf8(decoded), { integrity: record.integrity, kind: record.kind, size: record.byteSize }), decodedBytes: decoded.length }
 }
 
 export interface BundleCacheStorage {
@@ -105,16 +111,22 @@ async function build(record: BundleCacheRecord, storage: BundleCacheStorage, db:
   const metadata = { ...await createBundleMetadata(details), id: record.id, filename: record.filename }
   const body = await encodeBrotli(Buffer.from(JSON.stringify(metadata)))
   if (!(await db.getBundle(record.id))) throw new Error('Bundle deleted')
-  await storage.put(record.id, filename, body)
-  if (record.kind === 'stasis') await storage.put(record.id, packagesFilename, encodePackageInventory(details))
   const summary = bundleSummary(details, metadata)
-  await storage.put(record.id, SUMMARY_FILENAME, Buffer.from(JSON.stringify(summary)))
+  // Written together, each settled before the row is looked at again: one
+  // failing leaves the others, which a later open builds over.
+  const written = await Promise.allSettled([
+    storage.put(record.id, filename, body),
+    ...record.kind === 'stasis' ? [storage.put(record.id, packagesFilename, encodePackageInventory(details))] : [],
+    storage.put(record.id, SUMMARY_FILENAME, Buffer.from(JSON.stringify(summary))),
+  ])
   // A different instance may have deleted the row while these writes ran.
   // Reconcile after publishing so its cleanup cannot be undone by us.
   if (!(await db.getBundle(record.id))) {
     await storage.delete(record.id)
     throw new Error('Bundle deleted')
   }
+  const failed = written.find(result => result.status === 'rejected')
+  if (failed) throw failed.reason
   return summary
 }
 

package/server-managed/bundle.ts

@@ -109,10 +109,9 @@ export async function bundleFilePrefix(bytes: Buffer): Promise<string> {
 }
 
 // Extract the bundle integrities a report declares (its top-level
-// `bundleHashes`). Non-JSON reports (markdown / CSV) or a missing field → [].
-export function reportBundleHashes(bytes: Buffer): string[] {
-  let data: unknown
-  try { data = JSON.parse(bytes.toString('utf8')) } catch { return [] }
+// `bundleHashes`), from the JSON it parsed to (readManagedReport's, as is).
+// Non-JSON reports (markdown / CSV, given as null) or a missing field → [].
+export function reportBundleHashes(data: unknown): string[] {
   if (data == null || typeof data !== 'object') return []
   const hashes = (data as { bundleHashes?: unknown }).bundleHashes
   if (!Array.isArray(hashes)) return []

package/server-managed/combined.ts

@@ -10,13 +10,13 @@ import { loadManagedConfig } from './config.ts'
 import { LOGIN_PATH } from './github-oauth.ts'
 import { createManagedApp, logManagedStartup } from './index.ts'
 
-export async function init(mode: 'managed+e2e' | 'e2e+managed'): Promise<Server> {
+export async function init(mode: 'managed+e2e' | 'e2e+managed', { ui = true }: { ui?: boolean } = {}): Promise<Server> {
   const config = loadManagedConfig({ combined: true })
   const e2eConfig = loadConfig()
   if (!e2eConfig.neonUrl && !config.neonUrl && config.dbPath !== ':memory:' && resolve(config.dbPath) === resolve(e2eConfig.dbPath)) {
     throw new Error('MANAGED_DB_PATH must differ from e2e DB_PATH in combined mode.')
   }
-  const e2e = await createE2eApp(e2eConfig)
+  const e2e = await createE2eApp(e2eConfig, { ui })
   // Replace the assembled server's single
   // request listener; adding a second would write two responses per request.
   const handlers = e2e.httpServer.listeners('request')
@@ -25,6 +25,7 @@ export async function init(mode: 'managed+e2e' | 'e2e+managed'): Promise<Server>
   const managed = await createManagedApp(config, {
     next: e2e.handleRequest,
     isShuttingDown: e2e.isShuttingDown,
+    ui,
     serverInfo: {
       mode, managed: { loginPath: LOGIN_PATH, cookieName: config.sessionCookieName },
       ...(e2eConfig.deepviewScanServer ? { deepviewScanServer: e2eConfig.deepviewScanServer } : {}),

package/server-managed/commit-coauthors.ts

@@ -10,15 +10,14 @@ export const MAX_COAUTHORS = 3
 // The rules co-authors are read by, the agents' addresses and names among
 // them: what was kept read by others (history pages, squashed pull requests)
 // read again by these, once raised.
-export const COAUTHORS_READ = 2
+export const COAUTHORS_READ = 3
 const MAX_NAME = 256
 const textOf = (value: unknown, max: number) => typeof value === 'string' && value.trim() ? value.trim().slice(0, max) : null
 
 // One who made a commit beside its author: by name and account, as its
-// author is, and the agent it is where known, one GitHub knows by its account
-// or its commits' address or name (common/managed/github-agents.ts) or one
-// the server knows by its app (app-agents.ts), with its avatar.
-export interface Coauthor { name: string | null; login: string | null; id: number | null; agent?: string; avatar?: string }
+// author is, and the agent it is where known (common/managed/github-agents.ts),
+// by its account, its commits' address or name, or the marks it leaves.
+export interface Coauthor { name: string | null; login: string | null; id: number | null; agent?: string }
 
 // `Co-authored-by: <name> <address>` trailers, GitHub matching the key
 // regardless of case; Cursor's agents' links, as their work carries them;
@@ -75,9 +74,6 @@ export function coauthorsOf(message: unknown, author: Maker, listed: Maker[] | n
     const { login, id } = agent && maker.account.login && githubAgent(maker.account.login, maker.account.id) !== agent ? { login: null, id: null } : maker.account
     add({ name: textOf(maker.name, MAX_NAME), login, id, ...agent ? { agent } : {} }, maker.email)
   }
-  for (const agent of marked) {
-    const app = APP_AGENTS.find(known => known.id === agent && !Object.hasOwn(GITHUB_AGENTS, known.id))
-    add({ name: app?.name ?? GITHUB_AGENTS[agent as GithubAgentId].name, login: null, id: null, agent, ...app?.avatar ? { avatar: app.avatar } : {} })
-  }
+  for (const agent of marked) add({ name: GITHUB_AGENTS[agent as GithubAgentId].name, login: null, id: null, agent })
   return coauthors
 }

package/server-managed/commit-lockfiles.ts

@@ -4,40 +4,50 @@
 // read as a pull request's are (pull-dependencies.ts readLockfile, kept in
 // this instance by the commit and path), as many as MAX_LOCKFILES of those,
 // each's versions (`lockfiles`), and those its reader refuses, of Bun's, or
-// past MAX_LOCKFILES (`unread`); and those of some of them (lockedIn), each
-// version once by what its reviews are held to (lockedWith), dev only where
-// it is wherever it is locked. GitHub having none of a lockfile it lists
-// there fails the whole, as it would for any file.
+// past MAX_LOCKFILES (`unread`), as many read at once as READ_AT_ONCE; and
+// those of some of them (lockedIn), each version once by what its reviews
+// are held to (lockedWith), dev only where it is wherever it is locked.
+// GitHub having none of a lockfile it lists there fails the whole, as it
+// would for any file.
 import { createClient } from '@preventive/upstream/github.js'
 import { upstreamGithub } from './github-errors.ts'
 import { GithubApiError } from './github-app.ts'
 import type { LockedPackage } from './locked-packages.ts'
 import { type Lru, lru } from './lru.ts'
-import { lockedWith, lockfileFormat, readLockfile } from './pull-dependencies.ts'
+import { eachOf, lockedWith, lockfileFormat, lockfileHeld, readLockfile } from './pull-dependencies.ts'
 
 export const MAX_LOCKFILES = 100
+const READ_AT_ONCE = 4
 
 export interface CommitLockfiles { lockfiles: { path: string; packages: LockedPackage[] }[]; unread: string[] }
+// Set where GitHub was asked for what a read reads (`github`), not all of it
+// held in this instance.
+export interface GithubAsked { github: boolean }
 
 // The lockfiles at commit `sha` its review reads, by their paths, each with
-// its format (pull-dependencies.ts lockfileFormat), kept by the commit.
+// its format (pull-dependencies.ts lockfileFormat), kept by the commit;
+// `asked` told where GitHub was.
 const listings: Lru<{ path: string; format: NonNullable<ReturnType<typeof lockfileFormat>> }[]> = lru(20_000, listed => listed.length + 1)
-export async function lockfilesAt(fullName: string, token: string, sha: string) {
+export async function lockfilesAt(fullName: string, token: string, sha: string, asked?: GithubAsked) {
   const key = `${fullName}\0${sha}`
   const known = listings.get(key)
   if (known) return known
+  if (asked) asked.github = true
   const { lockfiles } = await upstreamGithub(() => createClient({ token, userAgent: 'deepview-triage' }).findRepoLockfiles({ repo: fullName, sha }))
   const listed = lockfiles.flatMap(({ path }) => { const format = lockfileFormat(path); return format ? [{ path, format }] : [] })
   listings.set(key, listed)
   return listed
 }
 
-export async function lockedAt(fullName: string, token: string, sha: string, held: (path: string) => boolean = () => true): Promise<CommitLockfiles> {
-  const listed = (await lockfilesAt(fullName, token, sha)).filter(({ path }) => held(path))
+export async function lockedAt(fullName: string, token: string, sha: string, held: (path: string) => boolean = () => true, asked?: GithubAsked): Promise<CommitLockfiles> {
+  const listed = (await lockfilesAt(fullName, token, sha, asked)).filter(({ path }) => held(path))
   const unread = listed.slice(MAX_LOCKFILES).map(({ path }) => path)
   const lockfiles: CommitLockfiles['lockfiles'] = []
-  for (const lockfile of listed.slice(0, MAX_LOCKFILES)) {
-    const read = await readLockfile(fullName, token, sha, lockfile)
+  const reading = listed.slice(0, MAX_LOCKFILES)
+  if (asked && reading.some(lockfile => !lockfileHeld(fullName, sha, lockfile))) asked.github = true
+  const reads = await eachOf(reading, READ_AT_ONCE, lockfile => readLockfile(fullName, token, sha, lockfile))
+  for (const [at, lockfile] of reading.entries()) {
+    const read = reads[at]!
     if ('error' in read && read.error === 'github-not-found') throw new GithubApiError(404, 'github-not-found')
     if ('error' in read) unread.push(lockfile.path)
     else lockfiles.push({ path: lockfile.path, packages: read.packages })

package/server-managed/config.ts

@@ -42,6 +42,11 @@ export interface ManagedConfig {
   cookieSecure: boolean
   sessionCookieName: string
   sessionTtlMs: number
+  // How long GitHub's answer on a user's access to a repository (its
+  // visibility, their permission) is kept for that user and repository
+  // (repository-browser.ts), asked again past it; 0 asks on every request
+  // (MANAGED_REPOSITORY_ACCESS_CACHE_MS, five minutes by default).
+  repositoryAccessCacheMs: number
   // Optional installation credentials for the same GitHub App as login.
   // Repository permissions are approved when connecting repositories.
   githubAppId: string | null
@@ -140,6 +145,7 @@ export function loadManagedConfig({ combined = false } = {}): ManagedConfig {
     cookieSecure,
     sessionCookieName,
     sessionTtlMs: intEnv('SESSION_TTL_MS', 1_209_600_000, 60_000, 7_776_000_000),
+    repositoryAccessCacheMs: intEnv('MANAGED_REPOSITORY_ACCESS_CACHE_MS', 300_000, 0, 3_600_000),
     githubAppId: env['GITHUB_APP_ID'] ?? null,
     githubAppPrivateKey: normalizePem(env['GITHUB_APP_PRIVATE_KEY']),
     githubAppSlug: env['GITHUB_APP_SLUG'] ?? null,