@preventive/triage 1.0.0-alpha.46 → 1.0.0-alpha.48

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@preventive/triage",
-  "version": "1.0.0-alpha.46",
+  "version": "1.0.0-alpha.48",
   "description": "Client & relay server for triaging of automated reports",
   "license": "MIT OR Apache-2.0",
   "author": {
@@ -130,6 +130,7 @@
     "server-managed/github-actions.ts",
     "server-managed/github-app.ts",
     "server-managed/github-errors.ts",
+    "server-managed/github-graphql.ts",
     "server-managed/github-metadata.ts",
     "server-managed/github-issue-oauth.ts",
     "server-managed/github-issues.ts",
@@ -187,9 +188,11 @@
     "server-managed/repository-changes.ts",
     "server-managed/repository-code.ts",
     "server-managed/repository-dependency-reviews.ts",
+    "server-managed/request-timing.ts",
     "server-managed/reviewed-dependencies.ts",
     "server-managed/repository-agents.ts",
     "server-managed/repository-history.ts",
+    "server-managed/repository-squashes.ts",
     "server-managed/repository-issues.ts",
     "server-managed/repository-pulse.ts",
     "server-managed/repository-aliases.ts",
@@ -343,6 +346,7 @@
     "client/finding-link.js",
     "client/linked-findings.d.ts",
     "client/linked-findings.js",
+    "out/activity.js",
     "out/brotli-fallback.js",
     "out/chunk-*.js",
     "out/client-managed.js",
@@ -400,16 +404,16 @@
     "typescript": "^7.0.2"
   },
   "dependencies": {
-    "@exodus/stasis": "1.0.0-beta.9",
-    "@exodus/stasis-core": "1.0.0-beta.9",
-    "@preventive/archive": "^1.1.0",
+    "@exodus/stasis": "1.0.0-beta.11",
+    "@exodus/stasis-core": "1.0.0-beta.11",
+    "@preventive/archive": "^1.2.0",
     "@preventive/compare": "^1.2.11",
     "@preventive/diff": "^1.1.0",
     "@preventive/lockfile": "^1.2.0",
     "@preventive/publishers": "^1.1.0",
     "@preventive/report": "^1.0.0",
     "@preventive/sourcemap": "1.0.0-alpha.1",
-    "@preventive/upstream": "^1.2.0",
+    "@preventive/upstream": "^1.3.0",
     "css-tree": "^3.2.1",
     "oxc-minify": "^0.152.0",
     "oxc-parser": "^0.152.0",

package/risk/index.d.ts

@@ -40,8 +40,10 @@ export interface AssessNpmOptions {
   // Where what is read is kept, by type (risk/npm/registry.js and assess.js
   // name each): `npm/tarballs`, `risk/npm/versions`, `risk/npm/packages`,
   // `risk/npm/old-versions`, `risk/npm/public`, `risk/npm/downloads`,
-  // `risk/npm/advisories` and `risk/npm/assessments`.
-  cache?: CacheStore | false
+  // `risk/npm/advisories` and `risk/npm/assessments`. One that reads records
+  // of any types at once (`readEach`, each null where none is kept) is read
+  // so where risk reads several together.
+  cache?: (CacheStore & { readEach?(entries: [type: string, key: string][]): Promise<unknown[]> }) | false
   // Asks for a package's whole document in risk's stead, as the managed
   // server does within its bounds: null where npm has none for this asker.
   // `authorized` whether it may be asked with the caller's npm token: the

package/risk/npm/assess.js

@@ -197,15 +197,22 @@ export async function assessNpm(name, version, { oldVersion = null, fromEmpty =
   const facts = await npmPackageFacts(name, version, oldVersion, context)
   const old = facts.oldVersion
   if (old !== null && !facts.versions.has(old)) throw new NpmRiskError('version-not-found', `npm has no ${name}@${old}`)
-  const malware = npmMalwareFinding({ takenDown: facts.takenDown, advisories: advisories ? await npmVersionAdvisories(name, version, osv, context) : [] })
-  if (!facts.versions.has(version)) {
+  // Its advisories, its lasting risk and its downloads need none of each
+  // other, so all are asked at once, and waited on in this order, so that a
+  // failure fails it as the first of them failing would.
+  const listed = facts.versions.has(version)
+  const advised = settledLater(advisories ? npmVersionAdvisories(name, version, osv, context) : Promise.resolve([]))
+  const keeping = listed ? settledLater(lasting(name, version, old, facts, context, fromEmpty)) : null
+  const counting = listed && downloads && popularity ? settledLater(npmDownloads(name, context)) : null
+  const malware = npmMalwareFinding({ takenDown: facts.takenDown, advisories: await advised })
+  if (!listed) {
     if (!malware) throw new NpmRiskError('version-not-found', `npm has no ${name}@${version}`)
     return { name, version, oldVersion: null, published: facts.removed.get(version), removed: true, findings: [malware], files: {}, dependencies: { added: [], changed: [] },
       score: npmRiskScore([malware]) }
   }
   const { published, manifest } = facts.versions.get(version)
-  const kept = await lasting(name, version, old, facts, context, fromEmpty)
-  const counted = downloads && popularity ? await npmDownloads(name, context) : null
+  const kept = await keeping
+  const counted = await counting
   const own = npmVersionFindings({ deprecated: facts.deprecated[version], published, minimumReleaseAge, now, known: Boolean(manifest.knownAccounts), scope: npmKnownScope(name),
     provenance: Boolean(manifest.provenance), downloads: counted })
   const was = old === null ? null : facts.versions.get(old).published
@@ -225,6 +232,10 @@ export async function assessNpm(name, version, { oldVersion = null, fromEmpty =
 // A dependency's key among a version's, by its kind and name.
 const keyOf = row => `${row.kind ?? ''}\0${row.name}`
 
+// `promise`, waited on later: its failure, if it fails before then, not
+// thrown as unhandled meanwhile.
+const settledLater = promise => { promise.catch(() => {}); return promise }
+
 // The keys of the dependencies a version holds that nothing of it imports
 // (`kept`, npmLastingRisk's: its `held-unused-deps`), those risk counts
 // (dependencies.js npmUnusedDependencyCounted).

package/risk/npm/registry.js

@@ -87,6 +87,11 @@ async function kept({ cache }, type, key, ask, fresh = () => true) {
   return value
 }
 
+// What is kept under each `[type, key]` of `entries`, in their order, null
+// where nothing is: in one read where the cache reads records of any types at
+// once (`readEach`), else one a key.
+const readEach = (cache, entries) => cache.readEach ? cache.readEach(entries) : Promise.all(entries.map(([type, key]) => cache.read(type, key)))
+
 // An answer's body as JSON, read no further than `limit` bytes.
 async function jsonOf(res, limit, what) {
   const tooLarge = () => new NpmRiskError('upstream-too-large', `npm's answer for ${what} is over ${limit} bytes`)
@@ -169,7 +174,7 @@ export async function npmPackageFacts(name, version, oldVersion, context) {
   const given = oldVersion === true ? fresh(picked) ? picked.oldVersion : undefined : oldVersion
   if (cache && given !== undefined) {
     const wanted = given === null ? [version] : [version, given]
-    const [facts, pkg] = await Promise.all([Promise.all(wanted.map(at => cache.read('risk/npm/versions', `${name}@${at}`))), cache.read('risk/npm/packages', name)])
+    const [pkg, ...facts] = await readEach(cache, [['risk/npm/packages', name], ...wanted.map(at => ['risk/npm/versions', `${name}@${at}`])])
     const gone = at => Object.hasOwn(pkg.removed, at)
     if (fresh(pkg) && 'removed' in pkg && wanted.every((at, i) => facts[i] || gone(at))) {
       return { versions: new Map(wanted.flatMap((at, i) => gone(at) ? [] : [[at, facts[i]]])), removed: new Map(wanted.filter(gone).map(at => [at, pkg.removed[at]])),

package/risk/npm/score.js

@@ -7,7 +7,7 @@ import { DAY_MS } from './downloads.js'
 // How much each finding raises the score, by its severity: a version's
 // findings combined as independent chances are (1 − Π(1 − weight)), so that
 // each adds less the more there are, none past 100. One red finding alone is
-// 50; two, or one with two orange, past 75, as attacks show.
+// 50; two are 75, and one with two orange 68, as attacks show.
 const WEIGHTS = { critical: 0.5, high: 0.2, moderate: 0.08, low: 0.03, notice: 0 }
 // What the version's age tells instead (`too-new`), as exposure does below.
 const TOLD_BY_AGE = new Set(['too-new'])

package/server-managed/activity.ts

@@ -176,12 +176,21 @@ export function activityMethods(db: ManagedSql): ActivityStore {
       const stmts = contexts == null ? admin : manager
       const scope = contexts == null ? {} : { contexts: JSON.stringify(contexts), userId: userId ?? '' }
       const params = { ...scope, kind, query, repo, actor }
-      const { total } = (await stmts.count.get(params)) as { total: number }
-      const currentPage = Math.min(page, Math.max(1, Math.ceil(total / limit)))
-      const history = (await stmts.rows.all({ ...params, limit, offset: (currentPage - 1) * limit })) as ActivityEntry[]
-      const filters: ActivityFilters = {
-        repos: ((await stmts.repos.all(scope)) as { repo: string }[]).map(row => row.repo),
-        users: ((await stmts.users.all(scope)) as ActivityFilters['users']).map(row => ({ id: row.id, login: row.login, detail: row.detail })),
+      const read = async (at: number) => (await stmts.rows.all({ ...params, limit, offset: (at - 1) * limit })) as (ActivityEntry & { total: number | string })[]
+      // A page's rows carry the total. Only a page past the last has none to
+      // carry it: it is counted, and the last page read in its place.
+      let currentPage = page, rows = await read(page)
+      let total = rows.length > 0 ? Number(rows[0]!.total) : 0
+      if (rows.length === 0 && page > 1) {
+        total = Number(((await stmts.count.get(params)) as { total: number | string }).total)
+        currentPage = Math.min(page, Math.max(1, Math.ceil(total / limit)))
+        if (currentPage !== page) rows = total === 0 ? [] : await read(currentPage)
+      }
+      const history = rows.map(({ total: _total, ...entry }) => entry)
+      const filters: ActivityFilters = { repos: [], users: [] }
+      for (const row of (await stmts.filters.all(scope)) as { facet: string; id: string; login: string; detail: string | null }[]) {
+        if (row.facet === 'repo') filters.repos.push(row.id)
+        else filters.users.push({ id: row.id, login: row.login, detail: row.detail })
       }
       return { history, total, page: currentPage, limit, filters }
     },
@@ -199,17 +208,21 @@ function activityStatements(db: ManagedSql, source: string) {
     AND (:repo = '' OR repo = :repo) AND (:actor = '' OR actorKey = :actor)
     AND (:query = '' OR instr(lower(coalesce(actor, '') || ' ' || action || ' ' ||
       coalesce(repo, '') || ' ' || coalesce(report, '') || ' ' || coalesce(finding, '')), lower(:query)) > 0)`
+  // A page's rows each carry the total, so the source is read once for both;
+  // the selector choices, repositories then users, once between them.
   return {
     count: db.prepare(`SELECT count(*) AS total FROM (${filtered}) AS filtered`),
-    rows: db.prepare(`${filtered} ORDER BY at DESC,
+    rows: db.prepare(`SELECT filtered.*, count(*) OVER () AS total FROM (${filtered}) AS filtered ORDER BY at DESC,
       CASE WHEN kind = 'triage' THEN CAST(substr(id, instr(id, ':') + 1) AS INTEGER) ELSE 0 END DESC,
       id DESC LIMIT :limit OFFSET :offset`),
-    repos: db.prepare(`${activity} SELECT DISTINCT repo FROM activity WHERE repo IS NOT NULL AND repo <> '' ORDER BY repo`),
-    users: db.prepare(`${activity} SELECT a.actorKey AS id, COALESCE(u.login, a.actor, a.actorId) AS login,
-      CASE WHEN a.actorId IS NULL THEN 'Legacy actor' ELSE NULL END AS detail FROM (
+    filters: db.prepare(`${activity} SELECT 'repo' AS facet, repo AS id, repo AS login, NULL AS detail, repo AS sort, '' AS tiebreak
+      FROM (SELECT DISTINCT repo FROM activity WHERE repo IS NOT NULL AND repo <> '') AS repos
+      UNION ALL SELECT 'user' AS facet, a.actorKey AS id, COALESCE(u.login, a.actor, a.actorId) AS login,
+      CASE WHEN a.actorId IS NULL THEN 'Legacy actor' ELSE NULL END AS detail, COALESCE(u.login, a.actor, a.actorId) AS sort, a.actorKey AS tiebreak FROM (
         SELECT actorKey, actorId, actor, ROW_NUMBER() OVER (PARTITION BY actorKey ORDER BY at DESC, id DESC) AS position
         FROM activity WHERE actorKey IS NOT NULL AND actorKey <> 'legacy:'
-      ) a LEFT JOIN managed_user u ON u.id = a.actorId WHERE a.position = 1 ORDER BY login, a.actorKey`),
+      ) a LEFT JOIN managed_user u ON u.id = a.actorId WHERE a.position = 1
+      ORDER BY facet, sort, tiebreak`),
   }
 }
 

package/server-managed/agent-merges.ts

@@ -4,10 +4,11 @@
 // pull request's branch alone naming it (app-agents.ts
 // AGENT_BRANCH_PREFIXES), or a label one who ran it gave it naming the agent
 // (agent-tasks.ts labelAgents), as the Agents tab tells an agent's work; or
-// its author, an account agents work as (github-agents.ts AGENT_OPERATED).
+// its author, an account agents work as (github-agents.ts AGENT_OPERATED),
+// or any GitHub App's bot.
 import { labelAgents } from '../common/managed/agent-tasks.ts'
 import { GITHUB_AGENTS, agentOperated } from '../common/managed/github-agents.ts'
-import { AGENT_BRANCH_PREFIXES, APP_AGENTS } from './app-agents.ts'
+import { AGENT_BRANCH_PREFIXES } from './app-agents.ts'
 import { type HistoryCommit, githubGraphql } from './repository-history.ts'
 
 // The merged pull requests read an answer, a page a query, as many queries
@@ -22,7 +23,7 @@ const MERGED_LABELS = 100
 // How long before or after a pull request rebased onto the branch was merged
 // its copies are committed.
 const REBASE_SKEW_MS = 10 * 60_000
-const LABEL_AGENTS = [...new Set([...Object.keys(GITHUB_AGENTS), ...APP_AGENTS.map(agent => agent.id)])]
+const LABEL_AGENTS = Object.keys(GITHUB_AGENTS)
 const SHA = /^[a-f\d]{40}$/u
 
 const count = (value: unknown) => Number.isSafeInteger(value) && (value as number) >= 0 ? value as number : 0
@@ -53,14 +54,14 @@ const MERGED_QUERY = `query($owner: String!, $name: String!, $after: String) {
   repository(owner: $owner, name: $name) {
     pullRequests(states: MERGED, first: ${MERGED_PAGE}, after: $after, orderBy: { field: UPDATED_AT, direction: DESC }) {
       pageInfo { hasNextPage endCursor }
-      nodes { updatedAt mergedAt headRefName author { login ... on User { databaseId } } labels(first: ${MERGED_LABELS}) { nodes { name } }
+      nodes { updatedAt mergedAt headRefName author { __typename login ... on User { databaseId } } labels(first: ${MERGED_LABELS}) { nodes { name } }
         mergeCommit { oid parents { totalCount } }
         commits(last: ${MERGED_COMMITS}) { totalCount nodes { commit { oid messageHeadline changedFilesIfAvailable } } } }
     }
   }
 }`
 type MergedPage = { repository?: { pullRequests?: { pageInfo?: { hasNextPage?: unknown; endCursor?: unknown }
-  nodes?: ({ updatedAt?: unknown; mergedAt?: unknown; headRefName?: unknown; author?: { login?: unknown; databaseId?: unknown } | null
+  nodes?: ({ updatedAt?: unknown; mergedAt?: unknown; headRefName?: unknown; author?: { __typename?: unknown; login?: unknown; databaseId?: unknown } | null
     labels?: { nodes?: ({ name?: unknown } | null)[] } | null
     mergeCommit?: { oid?: unknown; parents?: { totalCount?: unknown } | null } | null
     commits?: { totalCount?: unknown; nodes?: ({ commit?: { oid?: unknown; messageHeadline?: unknown; changedFilesIfAvailable?: unknown } | null } | null)[] } | null
@@ -68,9 +69,10 @@ type MergedPage = { repository?: { pullRequests?: { pageInfo?: { hasNextPage?: u
 const agentBranch = (name: unknown) => typeof name === 'string' && AGENT_BRANCH_PREFIXES.some(prefix => name.startsWith(prefix))
 type MergedNode = NonNullable<NonNullable<NonNullable<NonNullable<MergedPage['repository']>['pullRequests']>['nodes']>[number]>
 // Whether a pull request is an agent's: by its branch, a label naming one,
-// or its author, an account agents work as.
+// or its author, an account agents work as or a bot (GitHub's GraphQL API
+// naming a bot by its app's login alone, its type telling it).
 const agentPull = ({ headRefName, labels, author }: MergedNode) => agentBranch(headRefName)
-  || labelAgents((labels?.nodes ?? []).map(label => label?.name), LABEL_AGENTS).length > 0
+  || labelAgents((labels?.nodes ?? []).map(label => label?.name), LABEL_AGENTS).length > 0 || author?.__typename === 'Bot'
   || agentOperated(typeof author?.login === 'string' ? author.login : null, Number.isSafeInteger(author?.databaseId) ? author!.databaseId as number : null)
 
 // The commits the pull requests merged since `since` from an agent's branch,
@@ -152,7 +154,7 @@ const headed = (subject: string, headline: string) => headline.endsWith('…') ?
 // (`read`, agentMerges): those it names, and of one rebased, its commits'
 // copies, the last and those below it on their first parents, as long as
 // each one's subject is that of one of its commits older than the last
-// matched, as Commits tells a rebase (repository-history.ts squashedPulls),
+// matched, as Commits tells a rebase (repository-squashes.ts squashedPulls),
 // past those of its commits the rebase left none of (an empty one GitHub
 // counted no files of), and, past them all, as many more as it had before
 // its latest read; a squash merge's one commit alone, its subject the pull

package/server-managed/app-agents.ts

@@ -2,29 +2,16 @@
 // tab's, server-managed/repository-agents.ts, whose marks the Commits tab
 // reads on commits too, repository-history.ts).
 import type { AppAgent, AppAgentMarks } from '../common/managed/agent-tasks.ts'
-import { GITHUB_AGENTS } from '../common/managed/github-agents.ts'
+import { GITHUB_AGENTS, type GithubAgent } from '../common/managed/github-agents.ts'
 
 // The agents known by their GitHub Apps or accounts, beside Claude and
-// Codex: each its id and name, its avatar (its mark, served by
-// /api/avatar/<avatar>, for these alone: a GitHub App's, `app-<id>`, or
-// account's, `user-<id>`), the fingerprint it leaves as a line of its pull
-// requests' bodies and its commits' messages, the account its work is
-// authored by (its id and the logins GitHub names it by, told by both), and
-// its branches' prefix. Their work may carry Claude's or
-// Codex's marks too, those its tools. Copilot's coding agent opens its pull
-// requests and authors its commits as its account, Copilot (198982749), on
-// `copilot/` branches; Dependabot, its GitHub App (29110), opens its pull
-// requests as its account, `dependabot` (49699333, `dependabot[bot]` to
-// GitHub's REST API and in its address), on `dependabot/<ecosystem>/…`
-// branches. Their accounts and marks are those the app draws their work by
-// wherever it shows it (common/managed/github-agents.ts): Copilot's its own,
-// the app's to draw, no avatar.
-const { copilot, dependabot } = GITHUB_AGENTS
-export const APP_AGENTS: readonly (AppAgent & AppAgentMarks)[] = [
-  { id: 'neo', name: 'Neo', avatar: 'app-3115942', fingerprint: '🤖 Generated with [Neo](', prefix: 'neo/' },
-  { id: 'copilot', name: copilot.name, account: copilot.accounts[0], prefix: 'copilot/' },
-  { id: 'dependabot', name: dependabot.name, avatar: dependabot.avatar, account: dependabot.accounts[0], prefix: 'dependabot/' },
-]
+// Codex: those of GITHUB_AGENTS with branches of their own, in its order
+// (common/managed/github-agents.ts, where each is told, its accounts among
+// it), each its id and name, its avatar (its mark, served by
+// /api/avatar/<avatar>, a GitHub App's, `app-<id>`), the fingerprint it
+// leaves, and its branches' prefix.
+export const APP_AGENTS: readonly (AppAgent & AppAgentMarks)[] = Object.entries<GithubAgent>(GITHUB_AGENTS)
+  .flatMap(([id, { name, avatar, prefix, fingerprint }]) => prefix ? [{ id, name, prefix, ...avatar ? { avatar } : {}, ...fingerprint ? { fingerprint } : {} }] : [])
 // The prefixes of the branches agents work on: Claude Code's and Codex's,
 // and the app agents'.
 export const AGENT_BRANCH_PREFIXES = ['claude/', 'codex/', ...APP_AGENTS.map(agent => agent.prefix)]

package/server-managed/bundle-build-worker.js

@@ -96,13 +96,17 @@ export function buildErrorCode(error, message) {
 if (parentPort && workerData?.type === 'managed-bundle-build') {
   // Send diagnostics to the request's parent thread, which writes them before
   // returning the HTTP response. Worker stdout can be lost on termination.
-  const send = message => {
+  const send = (message, transfer = []) => {
     // Node worker messages have no browser target origin.
     // oxlint-disable-next-line unicorn/require-post-message-target-origin
-    parentPort.postMessage(message)
+    parentPort.postMessage(message, transfer)
   }
   try {
-    send(await buildStasisBundle(workerData, undefined, stage => send({ type: 'progress', stage })))
+    const built = await buildStasisBundle(workerData, undefined, stage => send({ type: 'progress', stage }))
+    // The bytes handed over rather than copied, where they alone fill their
+    // buffer (a small one may share Node's pool, which can't be moved).
+    const { bytes } = built
+    send(built, bytes.byteOffset === 0 && bytes.byteLength === bytes.buffer.byteLength ? [bytes.buffer] : [])
   } catch (error) {
     const diagnostic = bundleBuildDiagnostic(error, workerData.token)
     const code = buildErrorCode(error, diagnostic.message)

package/server-managed/bundle-build.ts

@@ -95,7 +95,7 @@ export function githubBundleFilename(github: string, directory: string, commit:
   return `${repo}.${dir}${tail}`
 }
 
-export interface BuiltBundle { bytes: Uint8Array; directory: string; filename: string }
+export interface BuiltBundle { bytes: Buffer; directory: string; filename: string }
 export interface BuildRequest {
   input: BundleBuildInput; github: string; token: string | null; maxBytes: number; scopes: (string | null)[]
   // Upstream's disk cache for what a build fetches (setCacheDir), or null for
@@ -174,14 +174,16 @@ export async function buildRepositoryBundle(userId: string, request: BuildReques
       const abort = () => fail(signal.reason instanceof BundleBuildError ? signal.reason.status : 499,
         signal.reason instanceof BundleBuildError ? signal.reason.code : 'build-cancelled')
       signal.addEventListener('abort', abort, { once: true })
-      running.on('message', (message: BuiltBundle & { type?: string; stage?: BundleBuildStage; error?: string; status?: number; diagnostic?: BundleBuildDiagnostic }) => {
+      running.on('message', (message: Omit<BuiltBundle, 'bytes'> & { bytes: Uint8Array; type?: string; stage?: BundleBuildStage; error?: string; status?: number; diagnostic?: BundleBuildDiagnostic }) => {
         if (settled) return
         if (message.type === 'progress' && message.stage) { stage = message.stage; log('progress'); return }
         if (message.error) { fail(message.status ?? 422, message.error, { diagnostic: message.diagnostic }); return }
         settled = true
         cleanup()
         log('completed', { byteSize: message.bytes.length })
-        resolve({ bytes: Buffer.from(message.bytes), directory: message.directory, filename: message.filename })
+        // A view of the bytes the worker handed over, not a copy of them.
+        const { bytes } = message
+        resolve({ bytes: Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength), directory: message.directory, filename: message.filename })
       })
       running.once('error', error => fail(422, 'build-failed', { diagnostic: bundleBuildDiagnostic(error, request.token) }))
       running.once('exit', exitCode => fail(422, 'build-failed', { exitCode }))

package/server-managed/bundle-cache.ts

@@ -111,16 +111,22 @@ async function build(record: BundleCacheRecord, storage: BundleCacheStorage, db:
   const metadata = { ...await createBundleMetadata(details), id: record.id, filename: record.filename }
   const body = await encodeBrotli(Buffer.from(JSON.stringify(metadata)))
   if (!(await db.getBundle(record.id))) throw new Error('Bundle deleted')
-  await storage.put(record.id, filename, body)
-  if (record.kind === 'stasis') await storage.put(record.id, packagesFilename, encodePackageInventory(details))
   const summary = bundleSummary(details, metadata)
-  await storage.put(record.id, SUMMARY_FILENAME, Buffer.from(JSON.stringify(summary)))
+  // Written together, each settled before the row is looked at again: one
+  // failing leaves the others, which a later open builds over.
+  const written = await Promise.allSettled([
+    storage.put(record.id, filename, body),
+    ...record.kind === 'stasis' ? [storage.put(record.id, packagesFilename, encodePackageInventory(details))] : [],
+    storage.put(record.id, SUMMARY_FILENAME, Buffer.from(JSON.stringify(summary))),
+  ])
   // A different instance may have deleted the row while these writes ran.
   // Reconcile after publishing so its cleanup cannot be undone by us.
   if (!(await db.getBundle(record.id))) {
     await storage.delete(record.id)
     throw new Error('Bundle deleted')
   }
+  const failed = written.find(result => result.status === 'rejected')
+  if (failed) throw failed.reason
   return summary
 }
 

package/server-managed/bundle.ts

@@ -109,10 +109,9 @@ export async function bundleFilePrefix(bytes: Buffer): Promise<string> {
 }
 
 // Extract the bundle integrities a report declares (its top-level
-// `bundleHashes`). Non-JSON reports (markdown / CSV) or a missing field → [].
-export function reportBundleHashes(bytes: Buffer): string[] {
-  let data: unknown
-  try { data = JSON.parse(bytes.toString('utf8')) } catch { return [] }
+// `bundleHashes`), from the JSON it parsed to (readManagedReport's, as is).
+// Non-JSON reports (markdown / CSV, given as null) or a missing field → [].
+export function reportBundleHashes(data: unknown): string[] {
   if (data == null || typeof data !== 'object') return []
   const hashes = (data as { bundleHashes?: unknown }).bundleHashes
   if (!Array.isArray(hashes)) return []

package/server-managed/cache-storage.ts

@@ -5,12 +5,13 @@ export class CacheMissError extends Error {
   constructor() { super('Managed cache unavailable') }
 }
 
-// Keys are internal relative paths; delete removes a whole directory of variants.
+// Keys are internal relative paths; delete removes a whole directory of
+// variants, but for one directory within it where `keep` names one.
 export interface CacheStorage {
   exists(key: string): Promise<boolean>
   put(key: string, bytes: Buffer): Promise<void>
   open(key: string): Promise<OpenedBlob>
-  delete(prefix: string): Promise<void>
+  delete(prefix: string, keep?: string): Promise<void>
 }
 
 export function validateCacheKey(key: string): string {

package/server-managed/commit-coauthors.ts

@@ -10,15 +10,14 @@ export const MAX_COAUTHORS = 3
 // The rules co-authors are read by, the agents' addresses and names among
 // them: what was kept read by others (history pages, squashed pull requests)
 // read again by these, once raised.
-export const COAUTHORS_READ = 2
+export const COAUTHORS_READ = 4
 const MAX_NAME = 256
 const textOf = (value: unknown, max: number) => typeof value === 'string' && value.trim() ? value.trim().slice(0, max) : null
 
 // One who made a commit beside its author: by name and account, as its
-// author is, and the agent it is where known, one GitHub knows by its account
-// or its commits' address or name (common/managed/github-agents.ts) or one
-// the server knows by its app (app-agents.ts), with its avatar.
-export interface Coauthor { name: string | null; login: string | null; id: number | null; agent?: string; avatar?: string }
+// author is, and the agent it is where known (common/managed/github-agents.ts),
+// by its account, its commits' address or name, or the marks it leaves.
+export interface Coauthor { name: string | null; login: string | null; id: number | null; agent?: string }
 
 // `Co-authored-by: <name> <address>` trailers, GitHub matching the key
 // regardless of case; Cursor's agents' links, as their work carries them;
@@ -31,6 +30,11 @@ const FINGERPRINTED = APP_AGENTS.filter(agent => agent.fingerprint)
 // commit gives (where it is read), and account.
 export type Maker = { name: unknown; email?: unknown; account: NamedAccount }
 
+// Those a commit's message names in its `Co-authored-by:` trailers
+// (agent-tasks.ts trailerBlock), each by name and address.
+export const coauthorTrailers = (message: unknown) => typeof message === 'string'
+  ? [...trailerBlock(message.replaceAll('\r\n', '\n')).matchAll(COAUTHOR_TRAILER)].map(([, name, email]) => ({ name: name!, email: email! })) : []
+
 // The agent one who made a commit is: by their account, else the address
 // their commit names them by; else, GitHub naming no account for them, by
 // their name.
@@ -51,7 +55,7 @@ const makerAgent = ({ name, email, account }: Maker): GithubAgentId | null => gi
 // two people of one name with accounts or addresses of their own two.
 export function coauthorsOf(message: unknown, author: Maker, listed: Maker[] | null = null): Coauthor[] {
   const text = typeof message === 'string' ? message.replaceAll('\r\n', '\n') : ''
-  const named = listed ?? [...trailerBlock(text).matchAll(COAUTHOR_TRAILER)].map(([, name, email]) => ({ name, email, account: commitAccount({ email }) }))
+  const named = listed ?? coauthorTrailers(text).map(({ name, email }) => ({ name, email, account: commitAccount({ email }) }))
   const signals = agentSignals([text], FINGERPRINTED)
   const marked = [...signals.claude || signals.sessions.length > 0 ? ['claude'] : [], ...signals.tasks.length > 0 || signals.codex ? ['codex'] : [],
     ...CURSOR_AGENT.test(text) ? ['cursor'] : [], ...signals.agents]
@@ -75,9 +79,6 @@ export function coauthorsOf(message: unknown, author: Maker, listed: Maker[] | n
     const { login, id } = agent && maker.account.login && githubAgent(maker.account.login, maker.account.id) !== agent ? { login: null, id: null } : maker.account
     add({ name: textOf(maker.name, MAX_NAME), login, id, ...agent ? { agent } : {} }, maker.email)
   }
-  for (const agent of marked) {
-    const app = APP_AGENTS.find(known => known.id === agent && !Object.hasOwn(GITHUB_AGENTS, known.id))
-    add({ name: app?.name ?? GITHUB_AGENTS[agent as GithubAgentId].name, login: null, id: null, agent, ...app?.avatar ? { avatar: app.avatar } : {} })
-  }
+  for (const agent of marked) add({ name: GITHUB_AGENTS[agent as GithubAgentId].name, login: null, id: null, agent })
   return coauthors
 }

package/server-managed/commit-lockfiles.ts

@@ -1,51 +1,52 @@
 // The versions a repository's lockfiles of npm's ecosystem lock at a commit,
 // as their review reads them (pull-dependency-reviews.ts): every lockfile
 // there (findRepoLockfiles) a review holds to (`held`, lockfile-scope.ts),
-// read as a pull request's are (pull-dependencies.ts readLockfile, kept in
-// this instance by the commit and path), as many as MAX_LOCKFILES of those,
-// each's versions (`lockfiles`), and those its reader refuses, of Bun's, or
-// past MAX_LOCKFILES (`unread`), as many read at once as READ_AT_ONCE; and
-// those of some of them (lockedIn), each version once by what its reviews
-// are held to (lockedWith), dev only where it is wherever it is locked.
-// GitHub having none of a lockfile it lists there fails the whole, as it
-// would for any file.
+// read as a pull request's are (pull-dependencies.ts readLockfile), but kept
+// by its blob, in this instance and beyond it (`kept`), as many as
+// MAX_LOCKFILES of those, each's versions (`lockfiles`), and those its reader
+// refuses, of Bun's, or past MAX_LOCKFILES (`unread`), as many read at once
+// as READ_AT_ONCE; and those of some of them (lockedIn), each version once by
+// what its reviews are held to (lockedWith), dev only where it is wherever it
+// is locked. GitHub having none of a lockfile it lists there fails the
+// whole, as it would for any file.
 import { createClient } from '@preventive/upstream/github.js'
 import { upstreamGithub } from './github-errors.ts'
 import { GithubApiError } from './github-app.ts'
 import type { LockedPackage } from './locked-packages.ts'
 import { type Lru, lru } from './lru.ts'
-import { eachOf, lockedWith, lockfileFormat, lockfileHeld, readLockfile } from './pull-dependencies.ts'
+import { type GithubAsked, type ListedLockfile, type LockfileStore, eachOf, lockedWith, lockfileFormat, readLockfile } from './pull-dependencies.ts'
 
 export const MAX_LOCKFILES = 100
 const READ_AT_ONCE = 4
 
 export interface CommitLockfiles { lockfiles: { path: string; packages: LockedPackage[] }[]; unread: string[] }
-// Set where GitHub was asked for what a read reads (`github`), not all of it
-// held in this instance.
-export interface GithubAsked { github: boolean }
 
 // The lockfiles at commit `sha` its review reads, by their paths, each with
-// its format (pull-dependencies.ts lockfileFormat), kept by the commit;
-// `asked` told where GitHub was.
-const listings: Lru<{ path: string; format: NonNullable<ReturnType<typeof lockfileFormat>> }[]> = lru(20_000, listed => listed.length + 1)
-export async function lockfilesAt(fullName: string, token: string, sha: string, asked?: GithubAsked) {
+// its format (pull-dependencies.ts lockfileFormat) and its blob's id, kept by
+// the commit, in this instance and beyond it (`kept`); `asked` told where
+// GitHub was.
+const listings: Lru<ListedLockfile[]> = lru(20_000, listed => listed.length + 1)
+export async function lockfilesAt(fullName: string, token: string, sha: string, kept: LockfileStore | null, asked?: GithubAsked) {
   const key = `${fullName}\0${sha}`
   const known = listings.get(key)
   if (known) return known
+  const stored = await kept?.listings.read(sha)
+  if (stored) { listings.set(key, stored); return stored }
   if (asked) asked.github = true
   const { lockfiles } = await upstreamGithub(() => createClient({ token, userAgent: 'deepview-triage' }).findRepoLockfiles({ repo: fullName, sha }))
-  const listed = lockfiles.flatMap(({ path }) => { const format = lockfileFormat(path); return format ? [{ path, format }] : [] })
+  const listed = lockfiles.flatMap(({ path, sha: blob }) => { const format = lockfileFormat(path); return format ? [{ path, format, sha: blob }] : [] })
   listings.set(key, listed)
+  await kept?.listings.write(sha, listed)
   return listed
 }
 
-export async function lockedAt(fullName: string, token: string, sha: string, held: (path: string) => boolean = () => true, asked?: GithubAsked): Promise<CommitLockfiles> {
-  const listed = (await lockfilesAt(fullName, token, sha, asked)).filter(({ path }) => held(path))
+export async function lockedAt(fullName: string, token: string, sha: string, kept: LockfileStore | null, held: (path: string) => boolean = () => true,
+  asked?: GithubAsked): Promise<CommitLockfiles> {
+  const listed = (await lockfilesAt(fullName, token, sha, kept, asked)).filter(({ path }) => held(path))
   const unread = listed.slice(MAX_LOCKFILES).map(({ path }) => path)
   const lockfiles: CommitLockfiles['lockfiles'] = []
   const reading = listed.slice(0, MAX_LOCKFILES)
-  if (asked && reading.some(lockfile => !lockfileHeld(fullName, sha, lockfile))) asked.github = true
-  const reads = await eachOf(reading, READ_AT_ONCE, lockfile => readLockfile(fullName, token, sha, lockfile))
+  const reads = await eachOf(reading, READ_AT_ONCE, lockfile => readLockfile(fullName, token, sha, lockfile, kept, asked))
   for (const [at, lockfile] of reading.entries()) {
     const read = reads[at]!
     if ('error' in read && read.error === 'github-not-found') throw new GithubApiError(404, 'github-not-found')