@preventive/triage 1.0.0-alpha.46 → 1.0.0-alpha.47

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@preventive/triage",
-  "version": "1.0.0-alpha.46",
+  "version": "1.0.0-alpha.47",
   "description": "Client & relay server for triaging of automated reports",
   "license": "MIT OR Apache-2.0",
   "author": {
@@ -343,6 +343,7 @@
     "client/finding-link.js",
     "client/linked-findings.d.ts",
     "client/linked-findings.js",
+    "out/activity.js",
     "out/brotli-fallback.js",
     "out/chunk-*.js",
     "out/client-managed.js",

package/risk/index.d.ts

@@ -40,8 +40,10 @@ export interface AssessNpmOptions {
   // Where what is read is kept, by type (risk/npm/registry.js and assess.js
   // name each): `npm/tarballs`, `risk/npm/versions`, `risk/npm/packages`,
   // `risk/npm/old-versions`, `risk/npm/public`, `risk/npm/downloads`,
-  // `risk/npm/advisories` and `risk/npm/assessments`.
-  cache?: CacheStore | false
+  // `risk/npm/advisories` and `risk/npm/assessments`. One that reads records
+  // of any types at once (`readEach`, each null where none is kept) is read
+  // so where risk reads several together.
+  cache?: (CacheStore & { readEach?(entries: [type: string, key: string][]): Promise<unknown[]> }) | false
   // Asks for a package's whole document in risk's stead, as the managed
   // server does within its bounds: null where npm has none for this asker.
   // `authorized` whether it may be asked with the caller's npm token: the

package/risk/npm/assess.js

@@ -197,15 +197,22 @@ export async function assessNpm(name, version, { oldVersion = null, fromEmpty =
   const facts = await npmPackageFacts(name, version, oldVersion, context)
   const old = facts.oldVersion
   if (old !== null && !facts.versions.has(old)) throw new NpmRiskError('version-not-found', `npm has no ${name}@${old}`)
-  const malware = npmMalwareFinding({ takenDown: facts.takenDown, advisories: advisories ? await npmVersionAdvisories(name, version, osv, context) : [] })
-  if (!facts.versions.has(version)) {
+  // Its advisories, its lasting risk and its downloads need none of each
+  // other, so all are asked at once, and waited on in this order, so that a
+  // failure fails it as the first of them failing would.
+  const listed = facts.versions.has(version)
+  const advised = settledLater(advisories ? npmVersionAdvisories(name, version, osv, context) : Promise.resolve([]))
+  const keeping = listed ? settledLater(lasting(name, version, old, facts, context, fromEmpty)) : null
+  const counting = listed && downloads && popularity ? settledLater(npmDownloads(name, context)) : null
+  const malware = npmMalwareFinding({ takenDown: facts.takenDown, advisories: await advised })
+  if (!listed) {
     if (!malware) throw new NpmRiskError('version-not-found', `npm has no ${name}@${version}`)
     return { name, version, oldVersion: null, published: facts.removed.get(version), removed: true, findings: [malware], files: {}, dependencies: { added: [], changed: [] },
       score: npmRiskScore([malware]) }
   }
   const { published, manifest } = facts.versions.get(version)
-  const kept = await lasting(name, version, old, facts, context, fromEmpty)
-  const counted = downloads && popularity ? await npmDownloads(name, context) : null
+  const kept = await keeping
+  const counted = await counting
   const own = npmVersionFindings({ deprecated: facts.deprecated[version], published, minimumReleaseAge, now, known: Boolean(manifest.knownAccounts), scope: npmKnownScope(name),
     provenance: Boolean(manifest.provenance), downloads: counted })
   const was = old === null ? null : facts.versions.get(old).published
@@ -225,6 +232,10 @@ export async function assessNpm(name, version, { oldVersion = null, fromEmpty =
 // A dependency's key among a version's, by its kind and name.
 const keyOf = row => `${row.kind ?? ''}\0${row.name}`
 
+// `promise`, waited on later: its failure, if it fails before then, not
+// thrown as unhandled meanwhile.
+const settledLater = promise => { promise.catch(() => {}); return promise }
+
 // The keys of the dependencies a version holds that nothing of it imports
 // (`kept`, npmLastingRisk's: its `held-unused-deps`), those risk counts
 // (dependencies.js npmUnusedDependencyCounted).

package/risk/npm/registry.js

@@ -87,6 +87,11 @@ async function kept({ cache }, type, key, ask, fresh = () => true) {
   return value
 }
 
+// What is kept under each `[type, key]` of `entries`, in their order, null
+// where nothing is: in one read where the cache reads records of any types at
+// once (`readEach`), else one a key.
+const readEach = (cache, entries) => cache.readEach ? cache.readEach(entries) : Promise.all(entries.map(([type, key]) => cache.read(type, key)))
+
 // An answer's body as JSON, read no further than `limit` bytes.
 async function jsonOf(res, limit, what) {
   const tooLarge = () => new NpmRiskError('upstream-too-large', `npm's answer for ${what} is over ${limit} bytes`)
@@ -169,7 +174,7 @@ export async function npmPackageFacts(name, version, oldVersion, context) {
   const given = oldVersion === true ? fresh(picked) ? picked.oldVersion : undefined : oldVersion
   if (cache && given !== undefined) {
     const wanted = given === null ? [version] : [version, given]
-    const [facts, pkg] = await Promise.all([Promise.all(wanted.map(at => cache.read('risk/npm/versions', `${name}@${at}`))), cache.read('risk/npm/packages', name)])
+    const [pkg, ...facts] = await readEach(cache, [['risk/npm/packages', name], ...wanted.map(at => ['risk/npm/versions', `${name}@${at}`])])
     const gone = at => Object.hasOwn(pkg.removed, at)
     if (fresh(pkg) && 'removed' in pkg && wanted.every((at, i) => facts[i] || gone(at))) {
       return { versions: new Map(wanted.flatMap((at, i) => gone(at) ? [] : [[at, facts[i]]])), removed: new Map(wanted.filter(gone).map(at => [at, pkg.removed[at]])),

package/server-managed/activity.ts

@@ -176,12 +176,21 @@ export function activityMethods(db: ManagedSql): ActivityStore {
       const stmts = contexts == null ? admin : manager
       const scope = contexts == null ? {} : { contexts: JSON.stringify(contexts), userId: userId ?? '' }
       const params = { ...scope, kind, query, repo, actor }
-      const { total } = (await stmts.count.get(params)) as { total: number }
-      const currentPage = Math.min(page, Math.max(1, Math.ceil(total / limit)))
-      const history = (await stmts.rows.all({ ...params, limit, offset: (currentPage - 1) * limit })) as ActivityEntry[]
-      const filters: ActivityFilters = {
-        repos: ((await stmts.repos.all(scope)) as { repo: string }[]).map(row => row.repo),
-        users: ((await stmts.users.all(scope)) as ActivityFilters['users']).map(row => ({ id: row.id, login: row.login, detail: row.detail })),
+      const read = async (at: number) => (await stmts.rows.all({ ...params, limit, offset: (at - 1) * limit })) as (ActivityEntry & { total: number | string })[]
+      // A page's rows carry the total. Only a page past the last has none to
+      // carry it: it is counted, and the last page read in its place.
+      let currentPage = page, rows = await read(page)
+      let total = rows.length > 0 ? Number(rows[0]!.total) : 0
+      if (rows.length === 0 && page > 1) {
+        total = Number(((await stmts.count.get(params)) as { total: number | string }).total)
+        currentPage = Math.min(page, Math.max(1, Math.ceil(total / limit)))
+        if (currentPage !== page) rows = total === 0 ? [] : await read(currentPage)
+      }
+      const history = rows.map(({ total: _total, ...entry }) => entry)
+      const filters: ActivityFilters = { repos: [], users: [] }
+      for (const row of (await stmts.filters.all(scope)) as { facet: string; id: string; login: string; detail: string | null }[]) {
+        if (row.facet === 'repo') filters.repos.push(row.id)
+        else filters.users.push({ id: row.id, login: row.login, detail: row.detail })
       }
       return { history, total, page: currentPage, limit, filters }
     },
@@ -199,17 +208,21 @@ function activityStatements(db: ManagedSql, source: string) {
     AND (:repo = '' OR repo = :repo) AND (:actor = '' OR actorKey = :actor)
     AND (:query = '' OR instr(lower(coalesce(actor, '') || ' ' || action || ' ' ||
       coalesce(repo, '') || ' ' || coalesce(report, '') || ' ' || coalesce(finding, '')), lower(:query)) > 0)`
+  // A page's rows each carry the total, so the source is read once for both;
+  // the selector choices, repositories then users, once between them.
   return {
     count: db.prepare(`SELECT count(*) AS total FROM (${filtered}) AS filtered`),
-    rows: db.prepare(`${filtered} ORDER BY at DESC,
+    rows: db.prepare(`SELECT filtered.*, count(*) OVER () AS total FROM (${filtered}) AS filtered ORDER BY at DESC,
       CASE WHEN kind = 'triage' THEN CAST(substr(id, instr(id, ':') + 1) AS INTEGER) ELSE 0 END DESC,
       id DESC LIMIT :limit OFFSET :offset`),
-    repos: db.prepare(`${activity} SELECT DISTINCT repo FROM activity WHERE repo IS NOT NULL AND repo <> '' ORDER BY repo`),
-    users: db.prepare(`${activity} SELECT a.actorKey AS id, COALESCE(u.login, a.actor, a.actorId) AS login,
-      CASE WHEN a.actorId IS NULL THEN 'Legacy actor' ELSE NULL END AS detail FROM (
+    filters: db.prepare(`${activity} SELECT 'repo' AS facet, repo AS id, repo AS login, NULL AS detail, repo AS sort, '' AS tiebreak
+      FROM (SELECT DISTINCT repo FROM activity WHERE repo IS NOT NULL AND repo <> '') AS repos
+      UNION ALL SELECT 'user' AS facet, a.actorKey AS id, COALESCE(u.login, a.actor, a.actorId) AS login,
+      CASE WHEN a.actorId IS NULL THEN 'Legacy actor' ELSE NULL END AS detail, COALESCE(u.login, a.actor, a.actorId) AS sort, a.actorKey AS tiebreak FROM (
         SELECT actorKey, actorId, actor, ROW_NUMBER() OVER (PARTITION BY actorKey ORDER BY at DESC, id DESC) AS position
         FROM activity WHERE actorKey IS NOT NULL AND actorKey <> 'legacy:'
-      ) a LEFT JOIN managed_user u ON u.id = a.actorId WHERE a.position = 1 ORDER BY login, a.actorKey`),
+      ) a LEFT JOIN managed_user u ON u.id = a.actorId WHERE a.position = 1
+      ORDER BY facet, sort, tiebreak`),
   }
 }
 

package/server-managed/app-agents.ts

@@ -2,29 +2,18 @@
 // tab's, server-managed/repository-agents.ts, whose marks the Commits tab
 // reads on commits too, repository-history.ts).
 import type { AppAgent, AppAgentMarks } from '../common/managed/agent-tasks.ts'
-import { GITHUB_AGENTS } from '../common/managed/github-agents.ts'
+import { GITHUB_AGENTS, type GithubAgent } from '../common/managed/github-agents.ts'
 
 // The agents known by their GitHub Apps or accounts, beside Claude and
-// Codex: each its id and name, its avatar (its mark, served by
-// /api/avatar/<avatar>, for these alone: a GitHub App's, `app-<id>`, or
-// account's, `user-<id>`), the fingerprint it leaves as a line of its pull
-// requests' bodies and its commits' messages, the account its work is
-// authored by (its id and the logins GitHub names it by, told by both), and
-// its branches' prefix. Their work may carry Claude's or
-// Codex's marks too, those its tools. Copilot's coding agent opens its pull
-// requests and authors its commits as its account, Copilot (198982749), on
-// `copilot/` branches; Dependabot, its GitHub App (29110), opens its pull
-// requests as its account, `dependabot` (49699333, `dependabot[bot]` to
-// GitHub's REST API and in its address), on `dependabot/<ecosystem>/…`
-// branches. Their accounts and marks are those the app draws their work by
-// wherever it shows it (common/managed/github-agents.ts): Copilot's its own,
-// the app's to draw, no avatar.
-const { copilot, dependabot } = GITHUB_AGENTS
-export const APP_AGENTS: readonly (AppAgent & AppAgentMarks)[] = [
-  { id: 'neo', name: 'Neo', avatar: 'app-3115942', fingerprint: '🤖 Generated with [Neo](', prefix: 'neo/' },
-  { id: 'copilot', name: copilot.name, account: copilot.accounts[0], prefix: 'copilot/' },
-  { id: 'dependabot', name: dependabot.name, avatar: dependabot.avatar, account: dependabot.accounts[0], prefix: 'dependabot/' },
-]
+// Codex: those of GITHUB_AGENTS with branches of their own, in its order
+// (common/managed/github-agents.ts, where each is told), each its id and
+// name, its avatar (its mark, served by /api/avatar/<avatar>, a GitHub
+// App's, `app-<id>`), the fingerprint it leaves, the account its work is
+// authored by (its id and the logins GitHub names it by, told by both, or by
+// its id alone where it names none), and its branches' prefix.
+export const APP_AGENTS: readonly (AppAgent & AppAgentMarks)[] = (Object.entries(GITHUB_AGENTS) as [string, GithubAgent][])
+  .flatMap(([id, { name, avatar, accounts: [account], prefix, fingerprint }]) => prefix ? [{ id, name, prefix, ...avatar ? { avatar } : {},
+    ...account?.id === undefined ? {} : { account: { id: account.id, logins: account.logins } }, ...fingerprint ? { fingerprint } : {} }] : [])
 // The prefixes of the branches agents work on: Claude Code's and Codex's,
 // and the app agents'.
 export const AGENT_BRANCH_PREFIXES = ['claude/', 'codex/', ...APP_AGENTS.map(agent => agent.prefix)]

package/server-managed/bundle-build-worker.js

@@ -96,13 +96,17 @@ export function buildErrorCode(error, message) {
 if (parentPort && workerData?.type === 'managed-bundle-build') {
   // Send diagnostics to the request's parent thread, which writes them before
   // returning the HTTP response. Worker stdout can be lost on termination.
-  const send = message => {
+  const send = (message, transfer = []) => {
     // Node worker messages have no browser target origin.
     // oxlint-disable-next-line unicorn/require-post-message-target-origin
-    parentPort.postMessage(message)
+    parentPort.postMessage(message, transfer)
   }
   try {
-    send(await buildStasisBundle(workerData, undefined, stage => send({ type: 'progress', stage })))
+    const built = await buildStasisBundle(workerData, undefined, stage => send({ type: 'progress', stage }))
+    // The bytes handed over rather than copied, where they alone fill their
+    // buffer (a small one may share Node's pool, which can't be moved).
+    const { bytes } = built
+    send(built, bytes.byteOffset === 0 && bytes.byteLength === bytes.buffer.byteLength ? [bytes.buffer] : [])
   } catch (error) {
     const diagnostic = bundleBuildDiagnostic(error, workerData.token)
     const code = buildErrorCode(error, diagnostic.message)

package/server-managed/bundle-build.ts

@@ -95,7 +95,7 @@ export function githubBundleFilename(github: string, directory: string, commit:
   return `${repo}.${dir}${tail}`
 }
 
-export interface BuiltBundle { bytes: Uint8Array; directory: string; filename: string }
+export interface BuiltBundle { bytes: Buffer; directory: string; filename: string }
 export interface BuildRequest {
   input: BundleBuildInput; github: string; token: string | null; maxBytes: number; scopes: (string | null)[]
   // Upstream's disk cache for what a build fetches (setCacheDir), or null for
@@ -174,14 +174,16 @@ export async function buildRepositoryBundle(userId: string, request: BuildReques
       const abort = () => fail(signal.reason instanceof BundleBuildError ? signal.reason.status : 499,
         signal.reason instanceof BundleBuildError ? signal.reason.code : 'build-cancelled')
       signal.addEventListener('abort', abort, { once: true })
-      running.on('message', (message: BuiltBundle & { type?: string; stage?: BundleBuildStage; error?: string; status?: number; diagnostic?: BundleBuildDiagnostic }) => {
+      running.on('message', (message: Omit<BuiltBundle, 'bytes'> & { bytes: Uint8Array; type?: string; stage?: BundleBuildStage; error?: string; status?: number; diagnostic?: BundleBuildDiagnostic }) => {
         if (settled) return
         if (message.type === 'progress' && message.stage) { stage = message.stage; log('progress'); return }
         if (message.error) { fail(message.status ?? 422, message.error, { diagnostic: message.diagnostic }); return }
         settled = true
         cleanup()
         log('completed', { byteSize: message.bytes.length })
-        resolve({ bytes: Buffer.from(message.bytes), directory: message.directory, filename: message.filename })
+        // A view of the bytes the worker handed over, not a copy of them.
+        const { bytes } = message
+        resolve({ bytes: Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength), directory: message.directory, filename: message.filename })
       })
       running.once('error', error => fail(422, 'build-failed', { diagnostic: bundleBuildDiagnostic(error, request.token) }))
       running.once('exit', exitCode => fail(422, 'build-failed', { exitCode }))

package/server-managed/bundle-cache.ts

@@ -111,16 +111,22 @@ async function build(record: BundleCacheRecord, storage: BundleCacheStorage, db:
   const metadata = { ...await createBundleMetadata(details), id: record.id, filename: record.filename }
   const body = await encodeBrotli(Buffer.from(JSON.stringify(metadata)))
   if (!(await db.getBundle(record.id))) throw new Error('Bundle deleted')
-  await storage.put(record.id, filename, body)
-  if (record.kind === 'stasis') await storage.put(record.id, packagesFilename, encodePackageInventory(details))
   const summary = bundleSummary(details, metadata)
-  await storage.put(record.id, SUMMARY_FILENAME, Buffer.from(JSON.stringify(summary)))
+  // Written together, each settled before the row is looked at again: one
+  // failing leaves the others, which a later open builds over.
+  const written = await Promise.allSettled([
+    storage.put(record.id, filename, body),
+    ...record.kind === 'stasis' ? [storage.put(record.id, packagesFilename, encodePackageInventory(details))] : [],
+    storage.put(record.id, SUMMARY_FILENAME, Buffer.from(JSON.stringify(summary))),
+  ])
   // A different instance may have deleted the row while these writes ran.
   // Reconcile after publishing so its cleanup cannot be undone by us.
   if (!(await db.getBundle(record.id))) {
     await storage.delete(record.id)
     throw new Error('Bundle deleted')
   }
+  const failed = written.find(result => result.status === 'rejected')
+  if (failed) throw failed.reason
   return summary
 }
 

package/server-managed/bundle.ts

@@ -109,10 +109,9 @@ export async function bundleFilePrefix(bytes: Buffer): Promise<string> {
 }
 
 // Extract the bundle integrities a report declares (its top-level
-// `bundleHashes`). Non-JSON reports (markdown / CSV) or a missing field → [].
-export function reportBundleHashes(bytes: Buffer): string[] {
-  let data: unknown
-  try { data = JSON.parse(bytes.toString('utf8')) } catch { return [] }
+// `bundleHashes`), from the JSON it parsed to (readManagedReport's, as is).
+// Non-JSON reports (markdown / CSV, given as null) or a missing field → [].
+export function reportBundleHashes(data: unknown): string[] {
   if (data == null || typeof data !== 'object') return []
   const hashes = (data as { bundleHashes?: unknown }).bundleHashes
   if (!Array.isArray(hashes)) return []

package/server-managed/commit-coauthors.ts

@@ -10,15 +10,14 @@ export const MAX_COAUTHORS = 3
 // The rules co-authors are read by, the agents' addresses and names among
 // them: what was kept read by others (history pages, squashed pull requests)
 // read again by these, once raised.
-export const COAUTHORS_READ = 2
+export const COAUTHORS_READ = 3
 const MAX_NAME = 256
 const textOf = (value: unknown, max: number) => typeof value === 'string' && value.trim() ? value.trim().slice(0, max) : null
 
 // One who made a commit beside its author: by name and account, as its
-// author is, and the agent it is where known, one GitHub knows by its account
-// or its commits' address or name (common/managed/github-agents.ts) or one
-// the server knows by its app (app-agents.ts), with its avatar.
-export interface Coauthor { name: string | null; login: string | null; id: number | null; agent?: string; avatar?: string }
+// author is, and the agent it is where known (common/managed/github-agents.ts),
+// by its account, its commits' address or name, or the marks it leaves.
+export interface Coauthor { name: string | null; login: string | null; id: number | null; agent?: string }
 
 // `Co-authored-by: <name> <address>` trailers, GitHub matching the key
 // regardless of case; Cursor's agents' links, as their work carries them;
@@ -75,9 +74,6 @@ export function coauthorsOf(message: unknown, author: Maker, listed: Maker[] | n
     const { login, id } = agent && maker.account.login && githubAgent(maker.account.login, maker.account.id) !== agent ? { login: null, id: null } : maker.account
     add({ name: textOf(maker.name, MAX_NAME), login, id, ...agent ? { agent } : {} }, maker.email)
   }
-  for (const agent of marked) {
-    const app = APP_AGENTS.find(known => known.id === agent && !Object.hasOwn(GITHUB_AGENTS, known.id))
-    add({ name: app?.name ?? GITHUB_AGENTS[agent as GithubAgentId].name, login: null, id: null, agent, ...app?.avatar ? { avatar: app.avatar } : {} })
-  }
+  for (const agent of marked) add({ name: GITHUB_AGENTS[agent as GithubAgentId].name, login: null, id: null, agent })
   return coauthors
 }