@preventive/triage 1.0.0-alpha.45 → 1.0.0-alpha.47

package/server-managed/pull-dependencies.ts

@@ -109,6 +109,8 @@ export interface PullDependencyStore {
 // scan's are (repository-risk.ts riskCaches).
 type LockfileRead = { packages: LockedPackage[] } | { error: string; detail?: string }
 const lockfileReads: Lru<LockfileRead> = lru(200_000, read => 'packages' in read ? read.packages.length + 1 : 1)
+// Those being read, by the token reading them too, lest each asking at once read them.
+const lockfilesReading = new Map<string, Promise<LockfileRead>>()
 
 const api = (fullName: string) => `https://api.github.com/repos/${fullName.split('/').map(encodeURIComponent).join('/')}`
 
@@ -169,14 +171,26 @@ function lockfilesChanged(files: ChangedFile[]) {
     omitted: all.slice(MAX_DIRECTORIES).flatMap(([, directory]) => [...directory.paths]).toSorted() }
 }
 
-// A lockfile's packages at `ref`, as read in this instance, else of GitHub;
-// a lockfile its reader refuses, why. Any failure to read it of GitHub but
-// its having none there is the whole answer's, as it would be every file's.
-export async function readLockfile(fullName: string, token: string, ref: string, { path, format }: { path: string; format: Format }): Promise<LockfileRead> {
-  if (format === 'bun') return { error: 'lockfile-unsupported' }
-  const key = `${fullName}\0${ref}\0${path}`
+// Whether `lockfile` at `ref` is held in this instance, read without asking
+// GitHub: Bun's, never read, too.
+export const lockfileHeld = (fullName: string, ref: string, { path, format }: { path: string; format: Format }) =>
+  format === 'bun' || lockfileReads.get(`${fullName}\0${ref}\0${path}`) !== undefined
+
+// A lockfile's packages at `ref`, as read in this instance, else shared with
+// a read of it with the same token still under way, else of GitHub; a
+// lockfile its reader refuses, why. Any failure to read it of GitHub but its
+// having none there is the whole answer's, as it would be every file's.
+export function readLockfile(fullName: string, token: string, ref: string, lockfile: { path: string; format: Format }): Promise<LockfileRead> {
+  if (lockfile.format === 'bun') return Promise.resolve({ error: 'lockfile-unsupported' })
+  const key = `${fullName}\0${ref}\0${lockfile.path}`
   const known = lockfileReads.get(key)
-  if (known) return known
+  if (known) return Promise.resolve(known)
+  const shared = `${token}\0${key}`
+  const reading = lockfilesReading.get(shared) ?? readOf(fullName, token, ref, lockfile, key).finally(() => lockfilesReading.delete(shared))
+  lockfilesReading.set(shared, reading)
+  return reading
+}
+async function readOf(fullName: string, token: string, ref: string, { path, format }: { path: string; format: Format }, key: string): Promise<LockfileRead> {
   let text: string
   try {
     text = await upstreamGithub(() => createClient({ token, userAgent: 'deepview-triage' }).getRepoFile({ repo: fullName, path, ref }))
@@ -261,10 +275,16 @@ function addedIn(paths: string[], before: LockfileRead[], after: LockfileRead[])
 // where it changes no lockfile read here.
 export async function pullDependencies(fullName: string, token: string, number: number, kept: PullDependencyStore,
   fetchImpl: typeof fetch = globalThis.fetch): Promise<PullDependencies> {
+  return (await pullDependenciesAt(fullName, token, number, kept, fetchImpl)).told
+}
+// The same, with the commits it is kept by (`commits`), its base's and
+// head's, by which `kept` reads it.
+export async function pullDependenciesAt(fullName: string, token: string, number: number, kept: PullDependencyStore,
+  fetchImpl: typeof fetch = globalThis.fetch): Promise<{ commits: string; told: PullDependencies }> {
   const { base, head } = await pullCommits(fullName, token, number, fetchImpl)
   const key = `${base}...${head}`
   const held = await kept.read(key)
-  if (held) return held
+  if (held) return { commits: key, told: held }
   const { mergeBase, files, cut: filesCut } = await pullFiles(fullName, token, number, base, head, fetchImpl)
   const { directories, cut, omitted } = lockfilesChanged(files)
   const reads = directories.flatMap(({ before, after }) => [...before.map(lockfile => [mergeBase, lockfile] as const), ...after.map(lockfile => [head, lockfile] as const)])
@@ -276,5 +296,5 @@ export async function pullDependencies(fullName: string, token: string, number:
   })
   const told = { base: mergeBase, head, lockfiles, cut: filesCut || cut, ...cut && !filesCut && omitted.length <= MAX_OMITTED ? { omitted } : {} }
   await kept.write(key, told)
-  return told
+  return { commits: key, told }
 }

package/server-managed/pull-dependency-reviews.ts

@@ -24,7 +24,7 @@
 // changes: it is read once, every lockfile there of those read here
 // (pull-dependencies.ts), and kept by the commit (`baselines` in this
 // instance, `kept` beyond it), never stored as reviews.
-import { lockedAt, lockedIn } from './commit-lockfiles.ts'
+import { type GithubAsked, lockedAt, lockedIn } from './commit-lockfiles.ts'
 import { GithubApiError } from './github-app.ts'
 import type { LockedPackage } from './locked-packages.ts'
 import { EVERY_LOCKFILE, type LockfileScope, heldTo, isEvery, reviewedIn } from './lockfile-scope.ts'
@@ -68,13 +68,13 @@ const baselineKeys = (pkg: LockedPackage) => hashesOf(pkg).map(hash => `${pkg.na
 // and kept; with the lockfiles there its reader refuses, isn't one of, or
 // past those read (`unread`). GitHub having none of a lockfile it lists
 // there is a failure of the whole, as of any file, never kept.
-export async function reviewBaseline(fullName: string, token: string, repoId: number, since: string, kept: ReviewBaselineStore): Promise<Baseline> {
+export async function reviewBaseline(fullName: string, token: string, repoId: number, since: string, kept: ReviewBaselineStore, asked?: GithubAsked): Promise<Baseline> {
   const key = `${repoId}\0${since}`
   const known = baselines.get(key)
   if (known) return known
   const stored = await kept.read(key)
   if (stored) { const baseline = { versions: new Set(stored.versions), unread: stored.unread }; baselines.set(key, baseline); return baseline }
-  const read = await lockedAt(fullName, token, since)
+  const read = await lockedAt(fullName, token, since, () => true, asked)
   const { packages } = lockedIn(read), { unread } = read
   const versions = new Set<string>()
   for (const pkg of packages) if (reviewedAs(pkg) === 'version') for (const held of baselineKeys(pkg)) versions.add(held)
@@ -298,18 +298,18 @@ export async function reviewedDependencies(told: PullDependencies, state: RepoRe
     ...unread.length > 0 && !reviewed ? { baselineUnread: unread.slice(0, MAX_UNREVIEWED) } : {}, ...isEvery(scope) ? {} : { lockfiles: scope } } }
 }
 
-// The packages a pull request's lockfiles lock that its reviews here may
-// pass, whose reviews are asked: those that can be reviewed, unpatched.
+// The package versions a pull request's lockfiles lock that its reviews here
+// may pass, whose reviews are asked: those that can be reviewed, unpatched.
 export const reviewedPackages = (told: PullDependencies) => told.lockfiles
-  .flatMap(dir => 'error' in dir ? [] : dir.locked.filter(pkg => reviewedAs(pkg) === 'version' && !pkg.patchHash).map(pkg => pkg.name))
+  .flatMap(dir => 'error' in dir ? [] : dir.locked.filter(pkg => reviewedAs(pkg) === 'version' && !pkg.patchHash).map(pkg => ({ name: pkg.name, version: pkg.version! })))
 
 // A repository's baseline as read for a pull request: its versions and the
 // lockfiles there left unread; none where it reviews since no commit; and
 // where GitHub doesn't read it, none and why.
-export async function baselineFor(fullName: string, token: string, repoId: number, state: RepoReviewState, kept: ReviewBaselineStore) {
+export async function baselineFor(fullName: string, token: string, repoId: number, state: RepoReviewState, kept: ReviewBaselineStore, asked?: GithubAsked) {
   if (!state.since) return { baseline: null, unread: [], error: null }
   try {
-    const { versions, unread } = await reviewBaseline(fullName, token, repoId, state.since, kept)
+    const { versions, unread } = await reviewBaseline(fullName, token, repoId, state.since, kept, asked)
     return { baseline: versions, unread, error: null }
   } catch (err) {
     if (err instanceof GithubApiError && err.status !== 429 && err.status !== 401) return { baseline: null, unread: [], error: err.message }

package/server-managed/queue.ts

@@ -21,3 +21,19 @@ export function queue<T>(signal: AbortSignal, { drain = false } = {}): Queue<T>
     },
   }
 }
+
+// Work done `count` at a time, in the order asked, the rest waiting their
+// turn.
+export function inTurns(count: number): <T>(work: () => Promise<T>) => Promise<T> {
+  let active = 0
+  const waiting: (() => void)[] = []
+  return async work => {
+    if (active < count) active++
+    else await new Promise<void>(resolve => { waiting.push(resolve) })
+    try { return await work() } finally {
+      const next = waiting.shift()
+      if (next) next()
+      else active--
+    }
+  }
+}

package/server-managed/rename-diff.ts

@@ -179,7 +179,10 @@ export async function renameDiffOf(request: RenameDiffRequest, texts: () => Prom
   return opened(await answerOf(request, texts, keep))
 }
 
-async function answerOf(request: RenameDiffRequest, texts: () => Promise<[string, string]>, keep: boolean): Promise<Buffer> {
+// Sides `verified` to be the files the request names (renamedPairs) are read
+// only where no answer is kept or on its way; others are read first, as
+// reading them checks they are.
+async function answerOf(request: RenameDiffRequest, texts: () => Promise<[string, string]>, keep: boolean, verified = false): Promise<Buffer> {
   // Sides not kept are formatted again for each diff (pretty-print.ts), so
   // they are read in its turn: the files a Diff view asks for at once wait
   // here rather than being refused by the formats running. Within its minute
@@ -193,21 +196,27 @@ async function answerOf(request: RenameDiffRequest, texts: () => Promise<[string
     })
     return encoded(diff, request, sides)
   }
-  const [before, after] = await texts()
   // A file's type is part of how it is read: the same text as a script and as a module differ.
   const key = `${request.base.hash}\0${request.base.extension}\0${request.other.hash}\0${request.other.extension}`
-  const found = kept.get(key)
-  if (found) {
-    kept.delete(key)
-    kept.set(key, found)
-    return found
+  const held = () => {
+    const found = kept.get(key)
+    if (found) {
+      kept.delete(key)
+      kept.set(key, found)
+    }
+    return found ?? pending.get(key)
   }
-  let job = pending.get(key)
-  if (!job) {
-    const deadline = Date.now() + DIFF_TIMEOUT_MS
-    pending.set(key, job = inTurn(deadline, () => inWorker(before, after, request, deadline)).then(diff => encoded(diff, request, [before, after])).finally(() => pending.delete(key)))
+  let answer = verified ? held() : undefined
+  if (!answer) {
+    const [before, after] = await texts()
+    answer = held()
+    if (!answer) {
+      const deadline = Date.now() + DIFF_TIMEOUT_MS
+      const job = inTurn(deadline, () => inWorker(before, after, request, deadline)).then(diff => encoded(diff, request, [before, after])).finally(() => pending.delete(key))
+      pending.set(key, answer = job)
+    }
   }
-  const body = await job
+  const body = await answer
   kept.set(key, body)
   if (kept.size > KEPT_DIFFS) kept.delete(kept.keys().next().value!)
   return body
@@ -258,7 +267,7 @@ export function renamedPairs([base, other]: readonly [ComparedSide, ComparedSide
       const named = { path: from.path, hash: from.hash, otherPath: to.path, otherHash: to.hash }
       const copy = async (side: ComparedSide, { text, ...file }: typeof from) => prettyText(await side.kept(file) ?? await side.made(file, text))
       let body
-      try { body = await answerOf(request, async () => [await copy(base, from), await copy(other, to)], keep) }
+      try { body = await answerOf(request, async () => [await copy(base, from), await copy(other, to)], keep, true) }
       catch (err) {
         if (!(err instanceof PrettyError)) throw err
         yield { ...named, error: err.message, status: err.status }

package/server-managed/report-sources.ts

@@ -146,7 +146,7 @@ export function createReportSourcesCache(storage: CacheStorage, db: ManagedDb, r
   }
   return {
     async open(report: ReportRecord, bundle: ManagedBundle, permissions: ViewerPermissions, sourcePaths?: Set<string>) {
-      const repo = { github: (await db.listAllRepos()).find(entry => entry.repoId === report.repoId)?.fullName ?? null }
+      const repo = { github: report.repoId == null ? null : await db.getRepoFullName(report.repoId) }
       const target = sourceCacheFilename(report, bundle, permissions, repo, sourcePaths)
       try { return { ...await storage.open(target), repo } }
       catch (error) { if (!(error instanceof CacheMissError)) throw error }

package/server-managed/report-store.ts

@@ -15,33 +15,71 @@ async function readBytes(stored: OpenedBlob): Promise<Buffer> {
   } finally { stored.stream.destroy() }
 }
 
+// Ids whose original copy is known gone, at most this many.
+const COMPRESSED_ONLY_MAX = 16_384
+
 export function createReportStore(legacy: BlobStore, compressed: BlobStore,
   replaceLegacy: (id: string, bytes: Buffer) => Promise<unknown>): BlobStore {
+  // Reports this store wrote, converted, or found with only the compressed
+  // copy. Uploads write only that copy and nothing writes an original again,
+  // so their reads stop asking storage for one, each a miss (and, encrypted,
+  // a row read too). A compressed copy missing there asks for the original
+  // after all. An original left by a conversion that failed is never in it:
+  // the next read finds that original and resumes the conversion.
+  const compressedOnly = new Set<string>()
+  function remember(id: string): void {
+    compressedOnly.delete(id)
+    if (compressedOnly.size >= COMPRESSED_ONLY_MAX) compressedOnly.delete(compressedOnly.values().next().value!)
+    compressedOnly.add(id)
+  }
+  function decoded(stored: OpenedBlob): OpenedBlob {
+    const stream = createBrotliDecompress()
+    // pipeline carries storage/authentication errors into the decoded stream
+    // and closes the stored source when a reader leaves before EOF.
+    void pipeline(stored.stream, stream).catch(() => {})
+    return { size: null, stream }
+  }
   async function open(id: string): Promise<OpenedBlob | null> {
+    if (compressedOnly.has(id)) {
+      const stored = await compressed.open(id)
+      if (stored) return decoded(stored)
+      compressedOnly.delete(id)
+    }
     // Keep the original available until conversion succeeds. Concurrent reads
     // can finish using an already-open stream while another reader converts it.
-    const original = await legacy.open(id)
-    if (original) {
-      const bytes = await readBytes(original)
+    // Both copies are asked for at once, the original answering where it is
+    // still there: one round trip of storage for a report not known yet, as
+    // a cold instance knows none.
+    const [original, stored] = await Promise.allSettled([legacy.open(id), compressed.open(id)])
+    const unused = (copy: PromiseSettledResult<OpenedBlob | null>) => { if (copy.status === 'fulfilled') copy.value?.stream.destroy() }
+    if (original.status === 'rejected') { unused(stored); throw original.reason }
+    if (original.value) {
+      unused(stored)
+      const bytes = await readBytes(original.value)
       await replaceLegacy(id, await encodeBrotli(bytes, 9))
+      remember(id)
       return { size: bytes.length, stream: Readable.from([bytes]) }
     }
-    const stored = await compressed.open(id)
-    if (!stored) return null
-    const stream = createBrotliDecompress()
-    // pipeline carries storage/authentication errors into the decoded stream
-    // and closes the stored source when a reader leaves before EOF.
-    void pipeline(stored.stream, stream).catch(() => {})
-    return { size: null, stream }
+    if (stored.status === 'rejected') throw stored.reason
+    if (!stored.value) return null
+    remember(id)
+    return decoded(stored.value)
   }
   return {
-    put: async (id, bytes) => compressed.put(id, await encodeBrotli(bytes, 9)),
+    async put(id, bytes) {
+      const wrapped = await compressed.put(id, await encodeBrotli(bytes, 9))
+      remember(id)
+      return wrapped
+    },
     open,
     async get(id) {
       const stored = await open(id)
       if (!stored) return null
       return readBytes(stored)
     },
-    async delete(id) { await Promise.all([compressed.delete(id), legacy.delete(id)]) },
+    async delete(id) {
+      compressedOnly.delete(id)
+      await Promise.all([compressed.delete(id), legacy.delete(id)])
+    },
   }
 }

package/server-managed/repository-actions.ts

@@ -92,7 +92,8 @@ export function actionsLines(repo: number, owner: string, read: WorkflowsRead, l
   if ('error' in read) return { lines: [{ type: 'workflows', repo, ...read } as WorkflowsLine], refs: [] as ActionRef[] }
   const lines: (WorkflowsLine | WorkflowLine)[] = [{ type: 'workflows', repo, paths: read.files.filter(file => file.kind === 'workflow').map(file => file.path) }]
   const refs = new Map<string, ActionRef>()
-  const actions = new Map(read.files.flatMap(file => file.kind === 'action' && 'text' in file ? [[actionDir(file.path), file.text] as const] : []))
+  // Its own actions by their directories and workflows by their paths, as a step or a job uses one.
+  const actions = new Map(read.files.flatMap(file => file.kind !== 'dockerfile' && 'text' in file ? [[file.kind === 'action' ? actionDir(file.path) : file.path, file.text] as const] : []))
   for (const file of read.files) {
     const scan = 'error' in file ? file : file.kind === 'dockerfile' ? { uses: [], findings: dockerfileFindings(file.text) } : scanWorkflow(file.kind, file.text, { owner, lockfiles, actions })
     lines.push({ type: 'workflow', repo, path: file.path, kind: file.kind, ...scan })
@@ -151,10 +152,12 @@ export interface ActionsResolving {
   store?: KeptStore<ActionLine> | undefined
 }
 
-// A reference's line: kept, else resolved, and kept where it is a public
-// repository's; why not, where it couldn't be.
-async function resolved(resolving: ActionsResolving, source: ActionsSource, { key, owner }: ActionRef): Promise<ActionLine | null> {
-  const kept = resolving.memory.get(key) ?? await resolving.store?.read(key).then(row => row && { at: row.at, line: row.value })
+// A reference's line: kept (`stored`, as read of the store with others),
+// else resolved, and kept where it is a public repository's; why not, where
+// it couldn't be.
+async function resolved(resolving: ActionsResolving, source: ActionsSource, { key, owner }: ActionRef,
+  stored = resolving.store?.read(key)): Promise<ActionLine | null> {
+  const kept = resolving.memory.get(key) ?? await stored?.then(row => row && { at: row.at, line: row.value })
   if (kept && Date.now() - kept.at < RISK_KEPT_MS) { resolving.memory.set(key, kept); return kept.line }
   const uses = usesOfKey(key)
   if (!uses) return { type: 'action', key, error: 'invalid-uses' }
@@ -180,6 +183,9 @@ export function resolvingActions(resolving: ActionsResolving) {
   const source = keptSource(sharedSource(resolving.source, resolving.answers))
   const pending: Queue<ActionRef> = queue(resolving.signal)
   const latest = new Map<string, ActionRef>()
+  // Those of the references added at once kept beyond this instance, read of
+  // the store together as they are added.
+  const stored = new Map<string, Promise<{ at: number; value: ActionLine } | null>>()
   let closed = false, waiting = 0
   const settle = () => { if (closed && waiting === 0) pending.close() }
   const add = (refs: ActionRef[]) => {
@@ -191,11 +197,14 @@ export function resolvingActions(resolving: ActionsResolving) {
       waiting++
       pending.add(kept)
     }
+    const unread = [...new Set(refs.map(ref => ref.key))].filter(key => latest.has(key) && !stored.has(key) && !resolving.memory.get(key))
+    const read = unread.length > 0 ? resolving.store?.readMany(unread) : undefined
+    for (const key of read ? unread : []) stored.set(key, read!.then(found => found.get(key) ?? null))
   }
   const work = async () => {
     for (let ref = await pending.take(); ref !== undefined; ref = await pending.take()) {
       try {
-        const line = await resolved(resolving, source, ref)
+        const line = await resolved(resolving, source, ref, stored.get(ref.key))
         if (line && latest.get(ref.key) === ref) {
           resolving.tell(line)
           const owner = 'repository' in line ? (line.repository?.fullName ?? line.repo).split('/')[0]! : ref.owner

package/server-managed/repository-agents.ts

@@ -175,7 +175,7 @@ async function agentBranches(owner: string, name: string, prefix: string, token:
 // What its answers are kept by, with their cursors (http.ts
 // handleRepositoryAgents): bumped as what a page reads, or how it tells an
 // agent, changes, so that no answer an older server kept is sent for a day.
-export const AGENTS_READ_VERSION = 5
+export const AGENTS_READ_VERSION = 6
 
 // A cursor of the default branch's commits: GitHub names one by a commit
 // and how many on from it, `<oid> <offset>`, a space between.

package/server-managed/repository-browser.ts

@@ -1,6 +1,7 @@
+import { createHash } from 'node:crypto'
 import type { ManagedConfig } from './config.ts'
 import type { SelectedRepo } from './db.ts'
-import { GithubApiError, type GithubIdentity, READ_PERMISSIONS, githubJson, githubRepoPermission, githubUserIdentity, repoAccessToken } from './github-app.ts'
+import { GithubApiError, type GithubIdentity, READ_PERMISSIONS, githubJson, githubRepoPermission, githubUserIdentity, onTokenRejected, repoAccessToken } from './github-app.ts'
 import { MAX_PACKAGE_BYTES, readPackageEntryPoints } from './package-entry-points.ts'
 import { readSolidityEntryPoints } from './solidity-entry-points.ts'
 import { parseGithubCommit } from './bundle-commits.ts'
@@ -40,14 +41,63 @@ function credentialFailure(err: unknown): err is GithubApiError {
   return err instanceof GithubApiError && ([401, 404].includes(err.status) || err.message === 'github-status-403')
 }
 
-// Create once per HTTP request. Coalesce concurrent credential lookups without
-// caching repository visibility or permissions, or sharing credentials across users.
+// GitHub's answer on a user's access to a repository, as checkAccess reads it:
+// the repository's metadata, which credential reads it (the user's token, the
+// App installation's, or none, as for a public repository read anonymously)
+// and the permission level GitHub told, where it was asked. Kept per user, by
+// their GitHub id and token, and per repository, by its id, name and
+// installation, for config.repositoryAccessCacheMs; only access granted is kept.
+// One answered for a user with a token is kept no longer once GitHub rejects
+// that token (`userToken`, hashed), whichever credential reads it: a private
+// repository's was granted on who that token told GitHub they are. The next
+// check asks GitHub, falling back to the installation's or none as it does.
+type RepoMetadata = { id?: unknown; full_name?: unknown; private?: unknown; visibility?: unknown; default_branch?: unknown }
+type AccessVerdict = { until: number; data: RepoMetadata; credential: 'user' | 'app' | 'none'; level: string | null; userToken: string | null }
+type VerdictCache = { get(): AccessVerdict | undefined; set(verdict: Omit<AccessVerdict, 'until' | 'userToken'>): void }
+const MAX_ACCESS_VERDICTS = 1000
+// By the fetch reading GitHub, as installation tokens are: a test's own.
+const accessVerdicts = new WeakMap<typeof fetch, Map<string, AccessVerdict>>()
+const hashed = (token: string) => createHash('sha256').update(token).digest('hex')
+onTokenRejected((token, fetchImpl) => {
+  const kept = accessVerdicts.get(fetchImpl)
+  if (!kept) return
+  const rejected = hashed(token)
+  for (const [key, verdict] of kept) if (verdict.userToken === rejected) kept.delete(key)
+})
+
+function verdictCache(config: ManagedConfig, user: RepositoryBrowserUser, repo: SelectedRepo, fetchImpl: typeof fetch): VerdictCache | null {
+  const keepMs = config.repositoryAccessCacheMs
+  if (!(keepMs > 0)) return null
+  let verdicts = accessVerdicts.get(fetchImpl)
+  if (!verdicts) { verdicts = new Map(); accessVerdicts.set(fetchImpl, verdicts) }
+  const kept = verdicts
+  // The token hashed with the rest, never kept as it is.
+  const key = createHash('sha256').update(JSON.stringify([user.githubUserId, user.token, repo.repoId, repo.fullName.toLowerCase(), repo.installationId, config.githubAppId])).digest('hex')
+  return {
+    get() {
+      const verdict = kept.get(key)
+      if (verdict && verdict.until > Date.now()) return verdict
+      kept.delete(key)
+      return undefined
+    },
+    set(verdict) {
+      kept.delete(key)
+      kept.set(key, { ...verdict, until: Date.now() + keepMs, userToken: user.token ? hashed(user.token) : null })
+      while (kept.size > MAX_ACCESS_VERDICTS) kept.delete(kept.keys().next().value!)
+    },
+  }
+}
+
+// Create once per HTTP request. Coalesce concurrent credential lookups, and
+// keep GitHub's answer on each user's access to each repository a while
+// (verdictCache), never sharing credentials or answers across users.
 export function createRepositoryBrowser(config: ManagedConfig, user: RepositoryBrowserUser, fetchImpl: typeof fetch = globalThis.fetch) {
   const tokens = new Map<number, Promise<string | null>>()
   let identity: Promise<GithubIdentity> | undefined
-  const getIdentity = (fresh = false): Promise<GithubIdentity> => {
+  // The user as GitHub tells them, asked once a request.
+  const getIdentity = (): Promise<GithubIdentity> => {
     if (!user.token || user.githubUserId == null) return Promise.reject(new GithubApiError(404, 'no-repository'))
-    if (!identity || fresh) {
+    if (!identity) {
       identity = githubUserIdentity(user.token, fetchImpl).then(value => {
         if (value.id !== user.githubUserId) throw new GithubApiError(404, 'no-repository')
         return value
@@ -71,7 +121,7 @@ export function createRepositoryBrowser(config: ManagedConfig, user: RepositoryB
       // Its Dependabot alerts, with the token of the installation GitHub tells
       // covers it, where the user's own access lets them see them
       // (dependabot-access.ts).
-      return repositoryReader(repo, user.token, installationToken, getIdentity, fetchImpl).then(reader => ({ ...reader,
+      return repositoryReader(repo, user.token, installationToken, getIdentity, fetchImpl, verdictCache(config, user, repo, fetchImpl)).then(reader => ({ ...reader,
         dependabotAlerts: () => appDependabotAlerts(config, repo, { identity: getIdentity, permission: reader.permission }, fetchImpl) }))
     },
   }
@@ -96,48 +146,86 @@ export async function repositoryTreeFiles(fullName: string, token: string | null
   return { files, bytes }
 }
 
-async function repositoryReader(repo: SelectedRepo, userToken: string | null, installationToken: () => Promise<string | null>, getIdentity: (fresh?: boolean) => Promise<GithubIdentity>, fetchImpl: typeof fetch) {
+type Access = { data: RepoMetadata; token: string | null; level: string | null }
+
+// GitHub asked whether the user may read `repo`: its metadata, read with
+// `token` (the reader's credential so far), else the installation's, else
+// none; and of one not public, the user's permission, read with the
+// installation's. What it told, the token reading it, and the level asked.
+async function askAccess(repo: SelectedRepo, start: string | null, userToken: string | null, installationToken: () => Promise<string | null>,
+  getIdentity: () => Promise<GithubIdentity>, fetchImpl: typeof fetch): Promise<Access> {
   const base = `https://api.github.com/repos/${repo.fullName.split('/').map(encodeURIComponent).join('/')}`
-  // Public reads can use the signed-in user's quota without repository grants.
-  // Nonpublic reads still require the repository App and the effective-user gate,
-  // whose permission level is kept (`level`).
-  let level: string | null = null, token = userToken ?? await installationToken()
-  const read = (suffix: string) => githubJson(base + suffix, token, fetchImpl)
+  let token = start
   const metadata = async () => {
-    try { return await read('') }
+    try { return await githubJson(base, token, fetchImpl) }
     catch (err) {
       if (!token || !credentialFailure(err)) throw err
       const fallback = await installationToken()
       if (fallback && fallback !== token) {
         token = fallback
-        try { return await read('') } catch (fallbackError) { if (!credentialFailure(fallbackError)) throw fallbackError }
+        try { return await githubJson(base, token, fetchImpl) } catch (fallbackError) { if (!credentialFailure(fallbackError)) throw fallbackError }
       }
       // Anonymous fallback is only for unavailable credentials, never rate
       // limits, network errors, or GitHub outages.
       token = null
-      return read('')
+      return githubJson(base, token, fetchImpl)
     }
   }
-  const checkAccess = async (freshIdentity = false) => {
-    // Stored visibility can be stale (or internal with private=false). Require
-    // current, explicit public visibility or the caller's effective permission.
-    const data = await metadata() as { id?: unknown; full_name?: unknown; private?: unknown; visibility?: unknown; default_branch?: unknown }
-    if (data?.id !== repo.repoId || typeof data.full_name !== 'string' || data.full_name.toLowerCase() !== repo.fullName.toLowerCase()) {
-      throw new GithubApiError(404, 'no-repository')
-    }
-    if (data.private === false && data.visibility === 'public') return data
-    if (!token) throw new GithubApiError(404, 'no-repository')
-    const appToken = await installationToken()
-    if (!appToken) throw new GithubApiError(404, 'no-repository')
-    level = await githubRepoPermission(repo.fullName, appToken, await getIdentity(freshIdentity), fetchImpl)
-    if (!READ_PERMISSIONS.has(level)) throw new GithubApiError(404, 'no-repository')
-    token = appToken
-    return data
+  // A repository last known private asks who the user is as it asks for its
+  // metadata, not after: its permission is asked of them.
+  if (repo.private && userToken) getIdentity().catch(() => {})
+  // Stored visibility can be stale (or internal with private=false). Require
+  // current, explicit public visibility or the caller's effective permission.
+  const data = await metadata() as RepoMetadata
+  if (data?.id !== repo.repoId || typeof data.full_name !== 'string' || data.full_name.toLowerCase() !== repo.fullName.toLowerCase()) {
+    throw new GithubApiError(404, 'no-repository')
+  }
+  if (data.private === false && data.visibility === 'public') return { data, token, level: null }
+  if (!token) throw new GithubApiError(404, 'no-repository')
+  const appToken = await installationToken()
+  if (!appToken) throw new GithubApiError(404, 'no-repository')
+  const level = await githubRepoPermission(repo.fullName, appToken, await getIdentity(), fetchImpl)
+  if (!READ_PERMISSIONS.has(level)) throw new GithubApiError(404, 'no-repository')
+  return { data, token: appToken, level }
+}
+
+// GitHub's answer as kept (verdictCache), with the credential it chose,
+// where that credential is still had; else asked (`ask`), and kept where it
+// grants access.
+async function keptAccess(verdicts: VerdictCache | null, userToken: string | null, installationToken: () => Promise<string | null>,
+  ask: () => Promise<Access>): Promise<Access> {
+  const kept = verdicts?.get()
+  if (kept) {
+    const credential = kept.credential === 'user' ? userToken : kept.credential === 'app' ? await installationToken() : null
+    if (kept.credential === 'none' || credential) return { data: kept.data, token: credential, level: kept.level }
+  }
+  const asked = await ask()
+  const { id, full_name, private: hidden, visibility, default_branch } = asked.data
+  const data = { id, full_name, private: hidden, visibility, default_branch }
+  verdicts?.set({ data, credential: asked.token === null ? 'none' : asked.token === userToken ? 'user' : 'app', level: asked.level })
+  return { ...asked, data }
+}
+
+async function repositoryReader(repo: SelectedRepo, userToken: string | null, installationToken: () => Promise<string | null>, getIdentity: (fresh?: boolean) => Promise<GithubIdentity>, fetchImpl: typeof fetch,
+  verdicts: VerdictCache | null) {
+  const base = `https://api.github.com/repos/${repo.fullName.split('/').map(encodeURIComponent).join('/')}`
+  // Public reads can use the signed-in user's quota without repository grants.
+  // Nonpublic reads still require the repository App and the effective-user gate,
+  // whose permission level is kept (`level`).
+  let level: string | null = null, token = userToken ?? await installationToken()
+  const read = (suffix: string) => githubJson(base + suffix, token, fetchImpl)
+  const checkAccess = async (): Promise<RepoMetadata> => {
+    const access = await keptAccess(verdicts, userToken, installationToken, () => askAccess(repo, token, userToken, installationToken, getIdentity, fetchImpl))
+    token = access.token
+    level = access.level
+    return access.data
   }
   const current = await checkAccess()
   const defaultBranch = typeof current.default_branch === 'string' ? current.default_branch : ''
   return {
-    recheckAccess: () => checkAccess(true),
+    // Its visibility and the user's permission asked again, the user as
+    // GitHub told them earlier in the request, not asked again.
+    recheckAccess: () => checkAccess(),
     // Server-only credential, selected by the same live visibility/permission
     // gate as directory browsing. Never included in an HTTP response.
     readToken: () => token,
@@ -184,8 +272,10 @@ async function repositoryReader(repo: SelectedRepo, userToken: string | null, in
       const manifestPath = path ? `${path}/package.json` : 'package.json'
       const manifest = data.find(item => item?.path === manifestPath && item.name === 'package.json' && item.type === 'file' && !item.submodule_git_url
         && typeof item.size === 'number' && item.size >= 0 && item.size <= MAX_PACKAGE_BYTES && typeof item.sha === 'string' && /^[a-f\d]{40}$/iu.test(item.sha))
-      const packageEntryPoints = manifest ? await readPackageEntryPoints(manifest.sha, path, read) : undefined
-      const solidity = await readSolidityEntryPoints(path, data, read)
+      // Both optional suggestions, read together: neither fails, each
+      // answering none where its reads do.
+      const [packageEntryPoints, solidity] = await Promise.all([manifest ? readPackageEntryPoints(manifest.sha, path, read) : undefined,
+        readSolidityEntryPoints(path, data, read)])
       return { entries, limited: data.length >= 1000, ...(packageEntryPoints ? { packageEntryPoints } : {}),
         ...(solidity.paths.length > 0 || solidity.limited ? { solidityEntryPoints: solidity.paths, soliditySuggestionsLimited: solidity.limited } : {}),
       }