@preventive/triage 1.0.0-alpha.46 → 1.0.0-alpha.48

package/server-managed/pretty-print.ts

@@ -45,6 +45,10 @@ const MAX_KEPT_DETAILS_BYTES = 256 * 1024 * 1024
 // Files hashed at once: one at a time, each waits its own round trip to the
 // thread pool; all at once, every one's job is held together.
 const HASHES_AT_ONCE = 32
+// Kept copies a stream reads ahead of the line it is sending (readAhead):
+// one at a time, each waits its own storage round trip; each read whole, as
+// its line will send it.
+const KEPT_AHEAD = 8
 
 export class PrettyError extends Error {
   status: number
@@ -166,6 +170,29 @@ async function prettyLine({ path, hash }: PrettyRequest, copy: () => Promise<Ope
   }
 }
 
+// A file's line from its kept copy, `open` opening it, or null where none is
+// kept.
+async function keptLine(request: PrettyRequest, open: () => Promise<OpenedBlob | null>): Promise<PrettyLine | null> {
+  const copy = await open()
+  return copy && prettyLine(request, () => Promise.resolve(copy))
+}
+
+// Each of `items` with what `read` reads of it, in their order, up to
+// KEPT_AHEAD of them read at once ahead of the one iterated, each answered
+// (or failing) in its turn. One iterated no further starts no more; those
+// under way settle unread.
+async function* readAhead<T, R>(items: readonly T[], read: (item: T) => Promise<R>): AsyncGenerator<[T, R]> {
+  const reads: Promise<R>[] = []
+  for (const [i, item] of items.entries()) {
+    while (reads.length < Math.min(items.length, i + KEPT_AHEAD)) {
+      const reading = read(items[reads.length]!)
+      reading.catch(() => {})
+      reads.push(reading)
+    }
+    yield [item, await reads[i]!]
+  }
+}
+
 // The files that changed between two sides, pretty-printed: each side's
 // formattable files the other has another text at the path of, or, where it
 // has none there, none of their text at a path of its own (a file renamed, or
@@ -174,8 +201,9 @@ async function prettyLine({ path, hash }: PrettyRequest, copy: () => Promise<Ope
 // the viewer diffs but where it pairs files otherwise (among copies of one
 // text, across packages), whose copies it asks for alone. As they are
 // iterated, in path order, the base's first where both have one: those kept,
-// at once; then the rest, formatted one after another, the minified before
-// the others (needsPrettyPrint), as the viewer prints those unasked.
+// at once, a few read ahead (readAhead); then the rest, formatted one after
+// another, the minified before the others (needsPrettyPrint), as the viewer
+// prints those unasked.
 export function compared(sides: readonly [ComparedSide, ComparedSide]): AsyncGenerator<ComparedLine> {
   // Each side's texts at the paths the other hasn't: where a file moved has its own.
   const moved = sides.map((own, i) => new Set([...own.hashes].filter(([path]) => !sides[1 - i]!.hashes.has(path)).map(([, hash]) => hash)))
@@ -185,9 +213,8 @@ export function compared(sides: readonly [ComparedSide, ComparedSide]): AsyncGen
   }).toSorted((a, b) => (a.file.path < b.file.path ? -1 : a.file.path > b.file.path ? 1 : 0))
   return (async function* () {
     const unkept: typeof changed = []
-    for (const { own, file } of changed) {
-      const copy = await own.kept(file)
-      if (copy) yield { side: own.side, ...await prettyLine(file, () => Promise.resolve(copy)) }
+    for await (const [{ own, file }, line] of readAhead(changed, item => keptLine(item.file, () => item.own.kept(item.file)))) {
+      if (line) yield { side: own.side, ...line }
       else unkept.push({ own, file })
     }
     const minified = new Map(unkept.map(({ file }) => [file, needsPrettyPrint(file.path, file.text)]))
@@ -325,15 +352,18 @@ export function createPrettyCache(bundles: BundleCacheStorage, npm: CacheStorage
       return body
     })
   }
+  // The copy kept for a public version's file, or null where none is (and
+  // for a private version's, which none is kept for).
+  const npmKept = (doc: NpmVersionDocument, request: PrettyRequest) => (doc.private ? Promise.resolve(null) : kept(() => npm.open(prettyFile(request))))
   // A version's file pretty-printed, `read` reading its text (and checking
   // it is the file named): from the copy kept for a public version, else
   // made, and kept for a public one.
   async function npmCopy(doc: NpmVersionDocument, request: PrettyRequest, read: () => Promise<string>): Promise<OpenedBlob> {
+    return await npmKept(doc, request) ?? npmMade(doc, request, read)
+  }
+  // The file pretty-printed from the text `read` reads, kept for a public version.
+  async function npmMade(doc: NpmVersionDocument, request: PrettyRequest, read: () => Promise<string>): Promise<OpenedBlob> {
     const file = prettyFile(request)
-    if (!doc.private) {
-      try { return await npm.open(file) }
-      catch (err) { if (!(err instanceof CacheMissError)) throw err }
-    }
     return opened(await shared(doc.private ? `npm ${doc.dist.integrity} ${file}` : `npm ${file}`, async () => {
       const body = await prettyBody(await read(), request.extension)
       if (!doc.private) await keep(() => npm.put(file, body))
@@ -369,11 +399,14 @@ export function createPrettyCache(bundles: BundleCacheStorage, npm: CacheStorage
     },
     // Every file of the version that needs pretty-printing (npmPrintable),
     // read before this resolves; then, as they are iterated, each
-    // pretty-printed as `npm` has it, one after another.
+    // pretty-printed as `npm` has it, one after another, those kept a few
+    // read ahead (readAhead).
     async npmAll(doc: NpmVersionDocument): Promise<AsyncGenerator<PrettyLine>> {
       const files = await npmPrintable(doc)
       return (async function* () {
-        for (const { text, ...request } of files) yield await prettyLine(request, () => npmCopy(doc, request, () => Promise.resolve(text)))
+        for await (const [file, line] of readAhead(files, request => keptLine(request, () => npmKept(doc, request)))) {
+          yield line ?? await prettyLine(file, () => npmMade(doc, file, () => Promise.resolve(file.text)))
+        }
       })()
     },
     // Two bundles' sides, or two versions', as a comparison reads them, read
@@ -392,7 +425,7 @@ export function createPrettyCache(bundles: BundleCacheStorage, npm: CacheStorage
     npmSides(base: NpmVersionDocument, other: NpmVersionDocument): Promise<[ComparedSide, ComparedSide]> {
       const sideOf = async (doc: NpmVersionDocument, side: Side): Promise<ComparedSide> => ({ side, ...await sideFiles(await npmFiles(doc), (_, bytes) => npmFileHash(bytes)),
         packageDirs: null,
-        kept: request => (doc.private ? Promise.resolve(null) : kept(() => npm.open(prettyFile(request)))),
+        kept: request => npmKept(doc, request),
         made: (request, text) => npmCopy(doc, request, () => Promise.resolve(text)) })
       return Promise.all([sideOf(base, 'base'), sideOf(other, 'other')])
     },

package/server-managed/public-workspace.ts

@@ -7,7 +7,7 @@ import type { OpenedBlob } from './blob-store.ts'
 import type { WorkspaceShareSnapshot } from './workspace-shares.ts'
 import { sendJson, sendLines, writeResponse } from './http-response.ts'
 import { hashToken } from './crypto.ts'
-import { TeamReportsError, loadTeamAnnotations, loadTeamReportsResponse, teamReportVisibility } from './team-reports.ts'
+import { TeamReportsError, loadTeamAnnotations, loadTeamReportsResponse, loadTeamTreesResponse, teamReportVisibility } from './team-reports.ts'
 import { triageWireEntry } from './triage-response.ts'
 import { MAX_PACKAGE_INVENTORY_BYTES } from './bundle-cache.ts'
 import { backfillBundleSummaries, bundleSummaries } from './bundle-catalog.ts'
@@ -34,7 +34,7 @@ export async function handlePublicWorkspace(req: IncomingMessage, res: ServerRes
   const method = req.method ?? 'GET'
   if (method !== 'GET' && method !== 'HEAD') { json(res, 403, { error: 'share-read-only' }); return }
   const shareRoute = /^\/api\/shares\/([A-Za-z0-9_-]+)\/workspace$/u.exec(url.pathname)
-  const teamRoute = /^\/api\/teams\/([^/]+)\/(shared|reports|feed|annotations)$/u.exec(url.pathname)
+  const teamRoute = /^\/api\/teams\/([^/]+)\/(shared|reports|trees|feed|annotations)$/u.exec(url.pathname)
   const reportRoute = /^\/api\/reports\/([^/]+)\/(triage|comments|sources)$/u.exec(url.pathname)
   const bundleRoute = /^\/api\/bundles\/([^/]+)\/(metadata|contents|download|advisories|pretty|rename-diff|type-only|comparison)$/u.exec(url.pathname)
   if (!shareRoute && !teamRoute && !reportRoute && !bundleRoute) { json(res, 403, { error: 'share-scope-required' }); return }
@@ -84,7 +84,7 @@ export async function handlePublicWorkspace(req: IncomingMessage, res: ServerRes
       await send(await loadTeamAnnotations(deps.db, deps.reportStore, snapshot, url.searchParams.get('reportId'))); return
     }
     if (teamRoute[2] === 'shared') { await sendTeam(); return }
-    const body = await loadTeamReportsResponse(deps.db, deps.reportStore, snapshot)
+    const body = await (teamRoute[2] === 'trees' ? loadTeamTreesResponse : loadTeamReportsResponse)(deps.db, deps.reportStore, snapshot)
     await recheck()
     res.writeHead(200, { 'content-type': 'application/json', 'cache-control': 'private, no-store', 'referrer-policy': 'no-referrer' })
     writeResponse(res, body); return

package/server-managed/pull-dependencies.ts

@@ -22,7 +22,10 @@
 // changes, so what is told of one is kept by them (`kept`), and each
 // lockfile read is kept in this instance's memory by its commit
 // (`lockfileReads`): the pull requests branching off the same commit, as a
-// bot's do, read their base's once.
+// bot's do, read their base's once. One read as a commit lists it, with its
+// blob's id (commit-lockfiles.ts), is kept by its blob instead, and beyond
+// this instance where its reader keeps it (LockfileStore): what a blob holds
+// never changes either, and a push changing no lockfile changes none.
 import { createClient } from '@preventive/upstream/github.js'
 import { GithubApiError, githubJson } from './github-app.ts'
 import { upstreamGithub } from './github-errors.ts'
@@ -46,7 +49,8 @@ export const MAX_LOCKED = 20_000
 // Lockfiles read at once.
 const READ_PARALLEL = 4
 // The rules what is told was told by, kept with it (http.ts
-// pullDependencyKept): one told by others is told again.
+// pullDependencyKept), and the lockfiles read for it (lockfileKept): one
+// told or read by others is told or read again.
 export const PULL_DEPENDENCIES_READ = 3
 const SHA = /^[a-f\d]{40}$/u
 
@@ -104,20 +108,42 @@ export interface PullDependencyStore {
   write(key: string, value: PullDependencies): Promise<void>
 }
 
-// A lockfile's packages, or why its reader refused it, by its repository,
-// commit and path, read in this instance; by the packages each holds, as the
-// scan's are (repository-risk.ts riskCaches).
-type LockfileRead = { packages: LockedPackage[] } | { error: string; detail?: string }
+// A lockfile's packages, or why its reader refused it, by its repository and
+// readKey, read in this instance; by the packages each holds, as the scan's
+// are (repository-risk.ts riskCaches).
+export type LockfileRead = { packages: LockedPackage[] } | { error: string; detail?: string }
 const lockfileReads: Lru<LockfileRead> = lru(200_000, read => 'packages' in read ? read.packages.length + 1 : 1)
-// Those being read, by the token reading them too, lest each asking at once read them.
-const lockfilesReading = new Map<string, Promise<LockfileRead>>()
+// Those being read, by the token reading them too, lest each asking at once
+// read them, with whether GitHub was asked.
+const lockfilesReading = new Map<string, Promise<{ read: LockfileRead; github: boolean }>>()
+// A lockfile at a commit as findRepoLockfiles lists it, by its path, with its
+// format (lockfileFormat) and its blob's id (`sha`).
+export interface ListedLockfile { path: string; format: Format; sha: string }
+// What a repository's lockfiles read for its dependency review keep beyond
+// this instance (http.ts lockfileKept), by what never changes: a commit's
+// lockfiles as listed (`listings`, by the commit), and a lockfile's read
+// (`lockfiles`, by its readKey). A read GitHub failed is kept nowhere.
+export interface LockfileStore {
+  listings: { read(commit: string): Promise<ListedLockfile[] | null>; write(commit: string, listed: ListedLockfile[]): Promise<void> }
+  lockfiles: { read(key: string): Promise<LockfileRead | null>; write(key: string, read: LockfileRead): Promise<void> }
+}
+// Set where GitHub was asked for what a read reads (`github`), not all of it
+// held in this instance or kept beyond it.
+export interface GithubAsked { github: boolean }
+
+// A lockfile's read, by its blob where it is listed with its id (`sha`),
+// which with its format alone tell how it reads; else by the commit and its
+// path.
+const readKey = (ref: string, { path, format, sha }: { path: string; format: Format; sha?: string }) =>
+  sha ? `blob\0${format}\0${sha}` : `commit\0${ref}\0${path}`
 
 const api = (fullName: string) => `https://api.github.com/repos/${fullName.split('/').map(encodeURIComponent).join('/')}`
 
 // The pull request's base's and head's commits, as GitHub has them now: its
 // base's moving on as it does, its head's with each push, both kept once it
 // is merged or closed.
-async function pullCommits(fullName: string, token: string, number: number, fetchImpl: typeof fetch) {
+export interface PullCommits { base: string; head: string }
+async function pullCommits(fullName: string, token: string, number: number, fetchImpl: typeof fetch): Promise<PullCommits> {
   const pull = await githubJson(`${api(fullName)}/pulls/${number}`, token, fetchImpl) as
     { number?: unknown; base?: { sha?: unknown; repo?: { full_name?: unknown } | null }; head?: { sha?: unknown } } | null
   const base = pull?.base?.sha, head = pull?.head?.sha, repo = pull?.base?.repo?.full_name
@@ -129,13 +155,16 @@ async function pullCommits(fullName: string, token: string, number: number, fetc
 // The pull request's merge base and the files it changes from it: as GitHub
 // compares its base with its head, else, where that lists as many as it lists
 // at most, from the pull request's own list, a page at a time; `cut` where
-// that lists as many as it lists at most, too.
-async function pullFiles(fullName: string, token: string, number: number, base: string, head: string, fetchImpl: typeof fetch) {
+// that lists as many as it lists at most, too. That list is of its commits
+// now: null where they are no longer `base` and `head` (`current`).
+async function pullFiles(fullName: string, token: string, number: number, base: string, head: string, fetchImpl: typeof fetch,
+  current: () => Promise<boolean>) {
   const compared = await githubJson(`${api(fullName)}/compare/${base}...${head}?per_page=1`, token, fetchImpl) as { merge_base_commit?: { sha?: unknown } } | null
   const mergeBase = compared?.merge_base_commit?.sha
   if (typeof mergeBase !== 'string' || !SHA.test(mergeBase)) throw new GithubApiError(502, 'github-malformed')
   const { files, more } = commitChanges(compared)
   if (!more) return { mergeBase, files, cut: false }
+  if (!await current()) return null
   const listed: ChangedFile[] = []
   for (let page = 1; listed.length < PULL_FILES; page++) {
     const data = await githubJson(`${api(fullName)}/pulls/${number}/files?per_page=${FILES_PAGE}&page=${page}`, token, fetchImpl)
@@ -171,39 +200,49 @@ function lockfilesChanged(files: ChangedFile[]) {
     omitted: all.slice(MAX_DIRECTORIES).flatMap(([, directory]) => [...directory.paths]).toSorted() }
 }
 
-// Whether `lockfile` at `ref` is held in this instance, read without asking
-// GitHub: Bun's, never read, too.
-export const lockfileHeld = (fullName: string, ref: string, { path, format }: { path: string; format: Format }) =>
-  format === 'bun' || lockfileReads.get(`${fullName}\0${ref}\0${path}`) !== undefined
-
-// A lockfile's packages at `ref`, as read in this instance, else shared with
-// a read of it with the same token still under way, else of GitHub; a
-// lockfile its reader refuses, why. Any failure to read it of GitHub but its
-// having none there is the whole answer's, as it would be every file's.
-export function readLockfile(fullName: string, token: string, ref: string, lockfile: { path: string; format: Format }): Promise<LockfileRead> {
-  if (lockfile.format === 'bun') return Promise.resolve({ error: 'lockfile-unsupported' })
-  const key = `${fullName}\0${ref}\0${lockfile.path}`
-  const known = lockfileReads.get(key)
-  if (known) return Promise.resolve(known)
-  const shared = `${token}\0${key}`
-  const reading = lockfilesReading.get(shared) ?? readOf(fullName, token, ref, lockfile, key).finally(() => lockfilesReading.delete(shared))
+// A lockfile's packages at `ref`, as read in this instance, else as kept
+// beyond it (`kept`), else shared with a read of it with the same token still
+// under way, else of GitHub, and kept; a lockfile its reader refuses, why,
+// kept as well, its reader refusing it again; `asked` told where GitHub was.
+// Any failure to read it of GitHub but its having none there is the whole
+// answer's, as it would be every file's; neither is kept.
+export async function readLockfile(fullName: string, token: string, ref: string, lockfile: { path: string; format: Format; sha?: string },
+  kept: LockfileStore | null = null, asked?: GithubAsked): Promise<LockfileRead> {
+  if (lockfile.format === 'bun') return { error: 'lockfile-unsupported' }
+  const key = readKey(ref, lockfile)
+  const known = lockfileReads.get(`${fullName}\0${key}`)
+  if (known) return known
+  const shared = `${token}\0${fullName}\0${key}`
+  const reading = lockfilesReading.get(shared) ?? readOf(fullName, token, ref, lockfile, key, kept).finally(() => lockfilesReading.delete(shared))
   lockfilesReading.set(shared, reading)
-  return reading
+  // One failing was asked of GitHub too, though a caller swallows its
+  // failure, as a baseline's does: its access is asked again all the same.
+  let told
+  try { told = await reading } catch (err) {
+    if (asked) asked.github = true
+    throw err
+  }
+  if (told.github && asked) asked.github = true
+  return told.read
 }
-async function readOf(fullName: string, token: string, ref: string, { path, format }: { path: string; format: Format }, key: string): Promise<LockfileRead> {
+async function readOf(fullName: string, token: string, ref: string, { path, format }: { path: string; format: Format }, key: string,
+  kept: LockfileStore | null): Promise<{ read: LockfileRead; github: boolean }> {
+  const stored = await kept?.lockfiles.read(key)
+  if (stored) { lockfileReads.set(`${fullName}\0${key}`, stored); return { read: stored, github: false } }
   let text: string
   try {
     text = await upstreamGithub(() => createClient({ token, userAgent: 'deepview-triage' }).getRepoFile({ repo: fullName, path, ref }))
   } catch (err) {
-    if (err instanceof GithubApiError && err.message === 'github-not-found') return { error: 'github-not-found' }
+    if (err instanceof GithubApiError && err.message === 'github-not-found') return { read: { error: 'github-not-found' }, github: true }
     throw err
   }
   let read: LockfileRead
   try { read = { packages: lockedPackages(format, text, { review: true }) } } catch (error) {
     read = { error: 'lockfile-unreadable', ...error instanceof Error ? { detail: error.message.slice(0, 500) } : {} }
   }
-  lockfileReads.set(key, read)
-  return read
+  lockfileReads.set(`${fullName}\0${key}`, read)
+  await kept?.lockfiles.write(key, read)
+  return { read, github: true }
 }
 
 // Runs `run` for each of `items`, as many at once as `parallel`, each's
@@ -278,14 +317,23 @@ export async function pullDependencies(fullName: string, token: string, number:
   return (await pullDependenciesAt(fullName, token, number, kept, fetchImpl)).told
 }
 // The same, with the commits it is kept by (`commits`), its base's and
-// head's, by which `kept` reads it.
+// head's, by which `kept` reads it: those `given`, as a page of its
+// repository's open pull requests read them (repository-issues.ts), else as
+// GitHub has them now. Commits given that its own list of its files is no
+// longer of are read as GitHub has them now.
 export async function pullDependenciesAt(fullName: string, token: string, number: number, kept: PullDependencyStore,
-  fetchImpl: typeof fetch = globalThis.fetch): Promise<{ commits: string; told: PullDependencies }> {
-  const { base, head } = await pullCommits(fullName, token, number, fetchImpl)
+  fetchImpl: typeof fetch = globalThis.fetch, given?: PullCommits): Promise<{ commits: string; told: PullDependencies }> {
+  const { base, head } = given ?? await pullCommits(fullName, token, number, fetchImpl)
   const key = `${base}...${head}`
   const held = await kept.read(key)
   if (held) return { commits: key, told: held }
-  const { mergeBase, files, cut: filesCut } = await pullFiles(fullName, token, number, base, head, fetchImpl)
+  const current = async () => {
+    const now = given && await pullCommits(fullName, token, number, fetchImpl)
+    return !now || (now.base === base && now.head === head)
+  }
+  const pulled = await pullFiles(fullName, token, number, base, head, fetchImpl, current)
+  if (!pulled) return pullDependenciesAt(fullName, token, number, kept, fetchImpl)
+  const { mergeBase, files, cut: filesCut } = pulled
   const { directories, cut, omitted } = lockfilesChanged(files)
   const reads = directories.flatMap(({ before, after }) => [...before.map(lockfile => [mergeBase, lockfile] as const), ...after.map(lockfile => [head, lockfile] as const)])
   const read = await eachOf(reads, READ_PARALLEL, ([ref, lockfile]) => readLockfile(fullName, token, ref, lockfile))

package/server-managed/pull-dependency-reviews.ts

@@ -24,12 +24,12 @@
 // changes: it is read once, every lockfile there of those read here
 // (pull-dependencies.ts), and kept by the commit (`baselines` in this
 // instance, `kept` beyond it), never stored as reviews.
-import { type GithubAsked, lockedAt, lockedIn } from './commit-lockfiles.ts'
+import { lockedAt, lockedIn } from './commit-lockfiles.ts'
 import { GithubApiError } from './github-app.ts'
 import type { LockedPackage } from './locked-packages.ts'
 import { EVERY_LOCKFILE, type LockfileScope, heldTo, isEvery, reviewedIn } from './lockfile-scope.ts'
 import { type Lru, lru } from './lru.ts'
-import { type DirectoryDependencies, MAX_ADDED, type PullDependencies, lockedAs, lockedWith } from './pull-dependencies.ts'
+import { type DirectoryDependencies, type GithubAsked, type LockfileStore, MAX_ADDED, type PullDependencies, lockedAs, lockedWith } from './pull-dependencies.ts'
 import type { PublishedReview, RepoReviewState } from './repository-dependency-reviews.ts'
 import { type ReviewedDependencies, type ReviewedDependency, askReviewed } from './reviewed-dependencies.ts'
 
@@ -64,17 +64,19 @@ const hashesOf = (pkg: LockedPackage) => (pkg.integrity ?? '').split(/\s+/u).fil
 const baselineKeys = (pkg: LockedPackage) => hashesOf(pkg).map(hash => `${pkg.name}@${pkg.version ?? ''}\0${hash}\0${pkg.patchHash ?? ''}`)
 
 // The versions the repository's lockfiles locked at commit `since` that are
-// reviewed (reviewedAs), as kept, else read of GitHub (commit-lockfiles.ts)
-// and kept; with the lockfiles there its reader refuses, isn't one of, or
-// past those read (`unread`). GitHub having none of a lockfile it lists
-// there is a failure of the whole, as of any file, never kept.
-export async function reviewBaseline(fullName: string, token: string, repoId: number, since: string, kept: ReviewBaselineStore, asked?: GithubAsked): Promise<Baseline> {
+// reviewed (reviewedAs), as kept, else read of GitHub (commit-lockfiles.ts,
+// its lockfiles as `reads` keeps them) and kept; with the lockfiles there its
+// reader refuses, isn't one of, or past those read (`unread`). GitHub having
+// none of a lockfile it lists there is a failure of the whole, as of any
+// file, never kept.
+export async function reviewBaseline(fullName: string, token: string, repoId: number, since: string, kept: ReviewBaselineStore, reads: LockfileStore | null = null,
+  asked?: GithubAsked): Promise<Baseline> {
   const key = `${repoId}\0${since}`
   const known = baselines.get(key)
   if (known) return known
   const stored = await kept.read(key)
   if (stored) { const baseline = { versions: new Set(stored.versions), unread: stored.unread }; baselines.set(key, baseline); return baseline }
-  const read = await lockedAt(fullName, token, since, () => true, asked)
+  const read = await lockedAt(fullName, token, since, reads, () => true, asked)
   const { packages } = lockedIn(read), { unread } = read
   const versions = new Set<string>()
   for (const pkg of packages) if (reviewedAs(pkg) === 'version') for (const held of baselineKeys(pkg)) versions.add(held)
@@ -306,10 +308,11 @@ export const reviewedPackages = (told: PullDependencies) => told.lockfiles
 // A repository's baseline as read for a pull request: its versions and the
 // lockfiles there left unread; none where it reviews since no commit; and
 // where GitHub doesn't read it, none and why.
-export async function baselineFor(fullName: string, token: string, repoId: number, state: RepoReviewState, kept: ReviewBaselineStore, asked?: GithubAsked) {
+export async function baselineFor(fullName: string, token: string, repoId: number, state: RepoReviewState, kept: ReviewBaselineStore, reads: LockfileStore | null,
+  asked?: GithubAsked) {
   if (!state.since) return { baseline: null, unread: [], error: null }
   try {
-    const { versions, unread } = await reviewBaseline(fullName, token, repoId, state.since, kept, asked)
+    const { versions, unread } = await reviewBaseline(fullName, token, repoId, state.since, kept, reads, asked)
     return { baseline: versions, unread, error: null }
   } catch (err) {
     if (err instanceof GithubApiError && err.status !== 429 && err.status !== 401) return { baseline: null, unread: [], error: err.message }

package/server-managed/rename-diff-worker.js

@@ -1,6 +1,6 @@
 // Compare's diff with renamed names hidden (rename-diff.ts), worked out off the
 // server's event loop by @preventive/compare's renamedDiffs: the old side given
-// the new side's names, formatted again where that changes its layout alone,
+// the new side's names, not formatted again (each line where the old side's was),
 // diffed with whitespace changes shown and hidden, and the blocks checked to
 // take it to the new side. `{ before, blocks, reason, reads, marks,
 // ignoringWhitespace }`: the old side as diffed, the change blocks, why the

package/server-managed/report-store.ts

@@ -32,9 +32,7 @@ export function createReportStore(legacy: BlobStore, compressed: BlobStore,
     if (compressedOnly.size >= COMPRESSED_ONLY_MAX) compressedOnly.delete(compressedOnly.values().next().value!)
     compressedOnly.add(id)
   }
-  async function openCompressed(id: string): Promise<OpenedBlob | null> {
-    const stored = await compressed.open(id)
-    if (!stored) return null
+  function decoded(stored: OpenedBlob): OpenedBlob {
     const stream = createBrotliDecompress()
     // pipeline carries storage/authentication errors into the decoded stream
     // and closes the stored source when a reader leaves before EOF.
@@ -43,22 +41,29 @@ export function createReportStore(legacy: BlobStore, compressed: BlobStore,
   }
   async function open(id: string): Promise<OpenedBlob | null> {
     if (compressedOnly.has(id)) {
-      const stored = await openCompressed(id)
-      if (stored) return stored
+      const stored = await compressed.open(id)
+      if (stored) return decoded(stored)
       compressedOnly.delete(id)
     }
     // Keep the original available until conversion succeeds. Concurrent reads
     // can finish using an already-open stream while another reader converts it.
-    const original = await legacy.open(id)
-    if (original) {
-      const bytes = await readBytes(original)
+    // Both copies are asked for at once, the original answering where it is
+    // still there: one round trip of storage for a report not known yet, as
+    // a cold instance knows none.
+    const [original, stored] = await Promise.allSettled([legacy.open(id), compressed.open(id)])
+    const unused = (copy: PromiseSettledResult<OpenedBlob | null>) => { if (copy.status === 'fulfilled') copy.value?.stream.destroy() }
+    if (original.status === 'rejected') { unused(stored); throw original.reason }
+    if (original.value) {
+      unused(stored)
+      const bytes = await readBytes(original.value)
       await replaceLegacy(id, await encodeBrotli(bytes, 9))
       remember(id)
       return { size: bytes.length, stream: Readable.from([bytes]) }
     }
-    const stored = await openCompressed(id)
-    if (stored) remember(id)
-    return stored
+    if (stored.status === 'rejected') throw stored.reason
+    if (!stored.value) return null
+    remember(id)
+    return decoded(stored.value)
   }
   return {
     async put(id, bytes) {

package/server-managed/repository-agents.ts

@@ -11,13 +11,12 @@
 // an agent, and those alone are answered, never the texts. GraphQL alone
 // gives them, so it needs a token.
 import { type AgentAuthor, type AgentBranch, type AgentCommit, type AgentIssue, type AgentPull, type AppAgent, agentSignals } from '../common/managed/agent-tasks.ts'
+import { GITHUB_AGENTS, type GithubAgentAccount, type GithubAgentId } from '../common/managed/github-agents.ts'
 import { AGENT_BRANCH_PREFIXES, APP_AGENTS } from './app-agents.ts'
 import { GithubApiError } from './github-app.ts'
-import { ACTOR, type NamedAccount, actorOf, commitAccount, githubGraphql } from './repository-history.ts'
+import { ACTOR, type NamedAccount, actorOf, commitAccount, githubGraphql, linkNoreplyUsers } from './repository-history.ts'
 import { ISSUES_CURSOR } from './repository-issues.ts'
 
-export { APP_AGENTS }
-
 export const AGENT_PULLS_PAGE = 50
 export const AGENT_COMMITS_PAGE = 100
 const AGENT_ISSUES = 100
@@ -35,7 +34,8 @@ const SHA = /^[a-f\d]{40}$/u
 const CLAUDE_EMAIL = 'noreply@anthropic.com'
 
 // The app agents' accounts' no-reply addresses, by each login of theirs.
-const AGENT_EMAILS = APP_AGENTS.flatMap(({ account }) => account?.logins.map(login => `${account.id}+${login}@users.noreply.github.com`) ?? [])
+const AGENT_EMAILS = APP_AGENTS.flatMap(({ id }) => GITHUB_AGENTS[id as GithubAgentId].accounts
+  .flatMap(({ id: account, logins }: GithubAgentAccount) => account === undefined ? [] : logins.map(login => `${account}+${login}@users.noreply.github.com`)))
 
 // An agent's branches, a page at a time, as GitHub lists them, by name;
 // each its tip commit's time, message and author.
@@ -164,6 +164,7 @@ async function agentBranches(owner: string, name: string, prefix: string, token:
   for (let page = 0; page < MAX_BRANCH_PAGES; page++) {
     const refs: Connection<RefNode> | undefined = (await githubGraphql(BRANCHES_QUERY, { owner, name, prefix: `refs/heads/${prefix}`, after }, token, fetchImpl) as RefsPage)
       ?.repository?.refs
+    await linkNoreplyUsers((refs?.nodes ?? []).map(node => node?.target?.author), token, fetchImpl)
     found.push(...(refs?.nodes ?? []).flatMap(node => branch(prefix)(node) ?? []))
     const next: Connection<RefNode>['pageInfo'] = refs?.pageInfo
     if (next?.hasNextPage !== true || typeof next.endCursor !== 'string') break
@@ -175,7 +176,7 @@ async function agentBranches(owner: string, name: string, prefix: string, token:
 // What its answers are kept by, with their cursors (http.ts
 // handleRepositoryAgents): bumped as what a page reads, or how it tells an
 // agent, changes, so that no answer an older server kept is sent for a day.
-export const AGENTS_READ_VERSION = 5
+export const AGENTS_READ_VERSION = 7
 
 // A cursor of the default branch's commits: GitHub names one by a commit
 // and how many on from it, `<oid> <offset>`, a space between.
@@ -206,7 +207,9 @@ export async function repositoryAgents(fullName: string, token: string, cursors:
   if (!repository) throw new GithubApiError(404, 'github-not-found')
   const history = repository.defaultBranchRef?.target?.history
   const after = { pulls: nextCursor(repository.pullRequests), commits: nextCursor(history, COMMITS_CURSOR) }
-  const commits = [...history?.nodes ?? [], ...authored?.repository?.defaultBranchRef?.target?.history?.nodes ?? []].flatMap(node => directCommit(node) ?? [])
+  const nodes = [...history?.nodes ?? [], ...authored?.repository?.defaultBranchRef?.target?.history?.nodes ?? []]
+  await linkNoreplyUsers(nodes.map(node => node?.author), token, fetchImpl)
+  const commits = nodes.flatMap(node => directCommit(node) ?? [])
   return {
     pulls: (repository.pullRequests?.nodes ?? []).flatMap(node => pull(node) ?? []),
     commits: commits.filter((commit, index) => commits.findIndex(other => other.oid === commit.oid) === index),

package/server-managed/repository-browser.ts

@@ -171,9 +171,16 @@ async function askAccess(repo: SelectedRepo, start: string | null, userToken: st
       return githubJson(base, token, fetchImpl)
     }
   }
-  // A repository last known private asks who the user is as it asks for its
-  // metadata, not after: its permission is asked of them.
-  if (repo.private && userToken) getIdentity().catch(() => {})
+  // A repository last known private asks who the user is, and mints the
+  // installation token its permission is asked with, as it asks for its
+  // metadata, not after. Each is asked once a request (the token once for
+  // concurrent requests too, github-app.ts), so a failure is answered where
+  // it is awaited. One made public since mints a token it never waits for,
+  // kept for later requests.
+  if (repo.private && userToken) {
+    getIdentity().catch(() => {})
+    if (repo.installationId != null) installationToken().catch(() => {})
+  }
   // Stored visibility can be stale (or internal with private=false). Require
   // current, explicit public visibility or the caller's effective permission.
   const data = await metadata() as RepoMetadata
@@ -232,6 +239,9 @@ async function repositoryReader(repo: SelectedRepo, userToken: string | null, in
     // The user's permission level on it where the gate asked GitHub of it, as
     // for a private repository; null for a public one.
     permission: () => level,
+    // Its default branch as GitHub named it when access was first checked,
+    // `''` where it named none: the one whose head `commit('')` reads.
+    defaultBranch,
     async refs() {
       // Suggestions are bounded; the input also accepts any branch or tag name.
       const list = async (kind: string) => {
@@ -272,8 +282,10 @@ async function repositoryReader(repo: SelectedRepo, userToken: string | null, in
       const manifestPath = path ? `${path}/package.json` : 'package.json'
       const manifest = data.find(item => item?.path === manifestPath && item.name === 'package.json' && item.type === 'file' && !item.submodule_git_url
         && typeof item.size === 'number' && item.size >= 0 && item.size <= MAX_PACKAGE_BYTES && typeof item.sha === 'string' && /^[a-f\d]{40}$/iu.test(item.sha))
-      const packageEntryPoints = manifest ? await readPackageEntryPoints(manifest.sha, path, read) : undefined
-      const solidity = await readSolidityEntryPoints(path, data, read)
+      // Both optional suggestions, read together: neither fails, each
+      // answering none where its reads do.
+      const [packageEntryPoints, solidity] = await Promise.all([manifest ? readPackageEntryPoints(manifest.sha, path, read) : undefined,
+        readSolidityEntryPoints(path, data, read)])
       return { entries, limited: data.length >= 1000, ...(packageEntryPoints ? { packageEntryPoints } : {}),
         ...(solidity.paths.length > 0 || solidity.limited ? { solidityEntryPoints: solidity.paths, soliditySuggestionsLimited: solidity.limited } : {}),
       }