@preventive/triage 1.0.0-alpha.47 → 1.0.0-alpha.49

package/server-managed/dependency-reviews.ts

@@ -7,11 +7,15 @@ export interface ReviewContext {
   ecosystem: 'npm'; package: string; version: string; integrity: string
   basePackage: string | null; baseVersion: string | null; baseIntegrity: string | null
 }
+// The shasums (sha1s, in hex) of the tarballs a review reads, its version's
+// and its base's, where npm tells them: each held, with its integrity, to the
+// tarball its reviewer was shown, as a review is written (http.ts).
+export interface ReviewedTarballs { shasum: string | null; baseShasum: string | null }
 export interface ReviewInput { file: string; comment: string; status: ReviewVerdict | null }
 export interface ReviewEntry extends ReviewInput { id: string; time: number }
 export interface ReviewTeam { id: string; name: string }
-export interface DependencyReview extends ReviewContext, ReviewSummary {
-  id: string; user: string | null; userLogin: string; time: number; revision: number
+export interface DependencyReview extends ReviewContext, ReviewedTarballs, ReviewSummary {
+  id: string; user: string | null; userLogin: string; userName: string | null; time: number; revision: number
   publishedAt: number | null; revokedAt: number | null; entries: ReviewEntry[]; teams: ReviewTeam[]; files: string[] | null
   nonTextFiles: string[] | null
   status: ReviewVerdict | null; comment: string
@@ -30,14 +34,15 @@ export interface DependencyReviewStore {
   // The reviews published to team `teamId`, revoked ones too, the latest
   // published first, a page on from `before` (when it was published, and
   // its id), for one who reads them there (reviewsIn); null for another.
+  // In one statement.
   listTeamDependencyReviews(teamId: string, user: string, before: { time: number; id: string } | null): Promise<{ reviews: DependencyReview[]; next: { time: number; id: string } | null } | null>
-  // Whether `user` reads the reviews published to team `teamId` (reviewsIn).
-  readsTeamDependencyReviews(teamId: string, user: string): Promise<boolean>
   listDependencyReviewTeams(user: string): Promise<ReviewTeam[]>
   listDependencyReviewEnabledTeams(): Promise<string[]>
   setTeamDependencyReview(sessionId: string, teamId: string, enabled: boolean): Promise<boolean>
   discardDependencyReview(sessionId: string, reviewId: string, revision: number): Promise<void>
-  changeDependencyReview(context: ReviewContext, sessionId: string, change: ReviewChange, now: number): Promise<DependencyReview>
+  // Written with the shasums of the tarballs read (`tarballs`), which a
+  // draft keeps as it is begun, saved and published; none where not told.
+  changeDependencyReview(context: ReviewContext, sessionId: string, change: ReviewChange, now: number, tarballs?: ReviewedTarballs): Promise<DependencyReview>
 }
 
 // An unpublished review belongs only to its author. Publication freezes all
@@ -51,7 +56,8 @@ CREATE TABLE IF NOT EXISTS managed_dependency_review (
   package TEXT NOT NULL, version TEXT NOT NULL, integrity TEXT NOT NULL,
   base_package TEXT NOT NULL, base_version TEXT NOT NULL, base_integrity TEXT NOT NULL,
   time INTEGER NOT NULL, revision INTEGER NOT NULL, published_at INTEGER, revoked_at INTEGER, files TEXT,
-  status TEXT CHECK (status IN ('accept', 'accept-with-nits', 'request-changes', 'reject')), comment TEXT NOT NULL DEFAULT ''
+  status TEXT CHECK (status IN ('accept', 'accept-with-nits', 'request-changes', 'reject')), comment TEXT NOT NULL DEFAULT '',
+  shasum TEXT NOT NULL DEFAULT '', base_shasum TEXT NOT NULL DEFAULT ''
 ) STRICT;
 CREATE INDEX IF NOT EXISTS managed_dependency_review_context_idx
   ON managed_dependency_review(ecosystem, package, version, integrity, base_package, base_version, base_integrity, time);
@@ -72,13 +78,19 @@ CREATE TABLE IF NOT EXISTS managed_dependency_review_team (
 ) STRICT;
 CREATE INDEX IF NOT EXISTS managed_dependency_review_team_idx ON managed_dependency_review_team(team_id, review_id);
 `
+// The columns added since the table was, for a database that has it already.
+export const DEPENDENCY_REVIEW_COLUMNS = [['shasum', "TEXT NOT NULL DEFAULT ''"], ['base_shasum', "TEXT NOT NULL DEFAULT ''"]] as const
 const values = (c: ReviewContext) => [c.ecosystem, c.package, c.version, c.integrity, c.basePackage ?? '', c.baseVersion ?? '', c.baseIntegrity ?? '']
 const targetWhere = 'ecosystem = ? AND package = ? AND version = ? AND integrity = ?'
 const contextWhere = `${targetWhere} AND base_package = ? AND base_version = ? AND base_integrity = ?`
-const columns = `id, user_id AS user, user_login AS userLogin, ecosystem, package, version, integrity,
+// Its author by the login they reviewed as, and by the name the app's user
+// has now (null once they are none, or have none), as the lists show them.
+const columns = `id, user_id AS user, user_login AS userLogin, (SELECT n.name FROM managed_user n WHERE n.id = user_id) AS userName, ecosystem, package, version, integrity,
   NULLIF(base_package, '') AS basePackage, NULLIF(base_version, '') AS baseVersion, NULLIF(base_integrity, '') AS baseIntegrity,
+  NULLIF(shasum, '') AS shasum, NULLIF(base_shasum, '') AS baseShasum,
   time, revision, published_at AS publishedAt, revoked_at AS revokedAt, files, status, comment`
 const conflict = () => { throw new ManagedMutationError(409, 'review-conflict') }
+const shasums = (tarballs: ReviewedTarballs | undefined) => [tarballs?.shasum ?? '', tarballs?.baseShasum ?? '']
 
 // Who reviews dependencies in team `t`, user `u` as the query joins them: an
 // admin, in any team; a member who manages, in theirs; a member who triages,
@@ -124,8 +136,9 @@ async function requireReviewer(db: ManagedSql, user: string) {
   if ((await teams(db, user)).length === 0) throw new ManagedMutationError(403, 'review-access-required')
 }
 
+type ReviewRow = Omit<DependencyReview, 'files' | 'entries' | 'teams' | keyof ReviewSummary> & { files: string | null }
 async function expandReviews(db: ManagedSql, rows: unknown[], user: string): Promise<DependencyReview[]> {
-  const reviews = rows as (Omit<DependencyReview, 'files'> & { files: string | null })[]
+  const reviews = rows as ReviewRow[]
   if (reviews.length === 0) return []
   const ids = reviews.map(review => review.id), placeholders = ids.map(() => '?').join(',')
   const entries = await db.prepare(`SELECT review_id AS reviewId, id, file, comment, status, time
@@ -145,16 +158,24 @@ async function expandReviews(db: ManagedSql, rows: unknown[], user: string): Pro
     return of
   }
   const [entriesOf, teamsOf] = [byReview(entries), byReview(linked)]
-  return reviews.map(review => {
-    const snapshot = review.files === null ? null : JSON.parse(review.files) as string[] | { paths: string[]; nonTextFiles: string[] }
-    const files = Array.isArray(snapshot) ? snapshot : snapshot?.paths ?? null
-    const nonTextFiles = Array.isArray(snapshot) ? null : snapshot?.nonTextFiles ?? []
-    const ownEntries = fileEntries((entriesOf.get(review.id) ?? []) as ReviewEntry[])
-    return { ...review, files, nonTextFiles, entries: ownEntries, ...summarizeReview(ownEntries, files, nonTextFiles), teams: (teamsOf.get(review.id) ?? []) as ReviewTeam[] }
-  })
+  return reviews.map(review => expanded(review, (entriesOf.get(review.id) ?? []) as ReviewEntry[], (teamsOf.get(review.id) ?? []) as ReviewTeam[]))
 }
+// A review as its row, its entries and the teams its reader reads it in
+// tell it: its files' snapshot, its entries a file's each (fileEntries), and
+// what they sum up to.
+function expanded(review: ReviewRow, entries: ReviewEntry[], readIn: ReviewTeam[]): DependencyReview {
+  const snapshot = review.files === null ? null : JSON.parse(review.files) as string[] | { paths: string[]; nonTextFiles: string[] }
+  const files = Array.isArray(snapshot) ? snapshot : snapshot?.paths ?? null
+  const nonTextFiles = Array.isArray(snapshot) ? null : snapshot?.nonTextFiles ?? []
+  const ownEntries = fileEntries(entries)
+  return { ...review, files, nonTextFiles, entries: ownEntries, ...summarizeReview(ownEntries, files, nonTextFiles), teams: readIn }
+}
+// Rows gathered into one JSON array value (json_group_array): its text on
+// SQLite, parsed already on Postgres, where none gather as NULL.
+export const gathered = <T>(value: unknown): T[] => value == null ? [] : (typeof value === 'string' ? JSON.parse(value) : value) as T[]
 
-async function publish(db: ManagedSql, current: DependencyReview | undefined, user: string, change: Extract<ReviewChange, { action: 'publish' }>, now: number) {
+async function publish(db: ManagedSql, current: DependencyReview | undefined, user: string, change: Extract<ReviewChange, { action: 'publish' }>, now: number,
+  tarballs: ReviewedTarballs | undefined) {
   if (!current || current.revokedAt !== null) return conflict()
   const allowed = new Set((await teams(db, user)).map(team => team.id))
   const selected = [...new Set(change.teamIds)]
@@ -164,8 +185,9 @@ async function publish(db: ManagedSql, current: DependencyReview | undefined, us
     if (!summarizeReview(entries, change.files, change.nonTextFiles).checkedFiles) throw new ManagedMutationError(400, 'no-reviewed-files')
     if (!change.final || !allowedReviewVerdicts(entries.filter(entry => !change.nonTextFiles.includes(entry.file))).includes(change.final.status)) throw new ManagedMutationError(400, 'bad-final-verdict')
     if (needsPackageJsonReview(entries, change.files, change.nonTextFiles)) throw new ManagedMutationError(400, 'package-json-not-reviewed')
-    await db.prepare(`UPDATE managed_dependency_review SET published_at = ?, files = ?, status = ?, comment = ?, revision = revision + 1 WHERE id = ?`)
-      .run(now, JSON.stringify({ paths: [...new Set(change.files)].toSorted(), nonTextFiles: [...new Set(change.nonTextFiles)].toSorted() }), change.final.status, change.final.comment, current.id)
+    await db.prepare(`UPDATE managed_dependency_review SET published_at = ?, files = ?, status = ?, comment = ?, shasum = ?, base_shasum = ?, revision = revision + 1
+      WHERE id = ?`).run(now, JSON.stringify({ paths: [...new Set(change.files)].toSorted(), nonTextFiles: [...new Set(change.nonTextFiles)].toSorted() }),
+      change.final.status, change.final.comment, ...shasums(tarballs), current.id)
   } else {
     if (change.final) return conflict()
     await db.prepare('UPDATE managed_dependency_review SET revision = revision + 1 WHERE id = ?').run(current.id)
@@ -193,17 +215,34 @@ async function listContext(db: ManagedSql, context: ReviewContext, user: string,
   return expandReviews(db, rows, user)
 }
 
-const readsTeam = async (db: ManagedSql, teamId: string, user: string) =>
-  Boolean(await db.prepare(`SELECT 1 FROM managed_team t JOIN managed_user u ON u.id = ? WHERE t.id = ? AND ${reviewsIn(false)}`).get(user, teamId))
-
+// A team's page of reviews in one statement: a row of its reader `v` where
+// they read them there (reviewsIn), none for another, with each review on
+// a row of its own, its entries and the teams `v` reads it in (as
+// expandReviews reads them) each one JSON array.
 async function listTeam(db: ManagedSql, teamId: string, user: string, before: { time: number; id: string } | null) {
-  if (!await readsTeam(db, teamId, user)) return null
-  const rows = await db.prepare(`SELECT ${columns} FROM managed_dependency_review r JOIN managed_dependency_review_team rt ON rt.review_id = r.id
-    WHERE rt.team_id = ? AND r.published_at IS NOT NULL ${before ? 'AND (r.published_at < ? OR (r.published_at = ? AND r.id < ?))' : ''}
-    ORDER BY r.published_at DESC, r.id DESC LIMIT 51`).all(teamId, ...before ? [before.time, before.time, before.id] : []) as DependencyReview[]
-  const page = rows.slice(0, 50)
+  const rows = await db.prepare(`WITH reader AS (
+      SELECT u.id AS id FROM managed_team t JOIN managed_user u ON u.id = ? WHERE t.id = ? AND ${reviewsIn(false)}
+    ), page AS (
+      SELECT ${columns} FROM managed_dependency_review r JOIN managed_dependency_review_team rt ON rt.review_id = r.id
+      WHERE rt.team_id = ? AND r.published_at IS NOT NULL AND EXISTS (SELECT 1 FROM reader)
+        ${before ? 'AND (r.published_at < ? OR (r.published_at = ? AND r.id < ?))' : ''}
+      ORDER BY r.published_at DESC, r.id DESC LIMIT 51
+    )
+    SELECT v.id AS reader, p.*,
+      (SELECT json_group_array(json_object('id', e.id, 'file', e.file, 'comment', e.comment, 'status', e.status, 'time', e.time) ORDER BY e.time, e.id)
+        FROM managed_dependency_file_review e WHERE e.review_id = p.id) AS entries,
+      (SELECT json_group_array(json_object('id', t.id, 'name', t.name) ORDER BY t.name, t.id)
+        FROM managed_dependency_review_team rt JOIN managed_team t ON t.id = rt.team_id JOIN managed_user u ON u.id = v.id
+        WHERE rt.review_id = p.id AND (p.user = u.id OR (${reviewsIn(false)}))) AS teams
+    FROM reader v LEFT JOIN page p ON 1 = 1
+    ORDER BY p.publishedAt DESC, p.id DESC`).all(user, teamId, teamId, ...before ? [before.time, before.time, before.id] : []) as
+    (ReviewRow & { reader: string; entries: unknown; teams: unknown })[]
+  if (rows.length === 0) return null
+  const reviews = rows.filter(row => row.id != null)
+  const page = reviews.slice(0, 50)
   const last = page.at(-1)
-  return { reviews: await expandReviews(db, page, user), next: rows.length > 50 && last ? { time: Number(last.publishedAt), id: last.id } : null }
+  return { reviews: page.map(({ reader: _reader, entries, teams: readIn, ...review }) => expanded(review, gathered(entries), gathered(readIn))),
+    next: reviews.length > 50 && last ? { time: Number(last.publishedAt), id: last.id } : null }
 }
 
 async function saveFile(db: ManagedSql, reviewId: string, entry: ReviewInput, requestedId: string | null, now: number) {
@@ -236,7 +275,6 @@ export function dependencyReviewMethods(db: ManagedSql): DependencyReviewStore {
         ORDER BY time, id`).all(user, ...ids), user)
     },
     listTeamDependencyReviews: (teamId, user, before) => listTeam(db, teamId, user, before),
-    readsTeamDependencyReviews: (teamId, user) => readsTeam(db, teamId, user),
     async getLatestOwnDependencyReview(user, target) {
       const row = await db.prepare(`SELECT ${columns} FROM managed_dependency_review
         WHERE user_id = ? AND ecosystem = ? AND package = ? AND version = ? AND integrity = ? ORDER BY time DESC, id DESC LIMIT 1`)
@@ -258,7 +296,7 @@ export function dependencyReviewMethods(db: ManagedSql): DependencyReviewStore {
     },
     listDependencyReviewTeams: user => teams(db, user),
     listDependencyReviews: (context, user, allBases = false) => listContext(db, context, user, allBases),
-    async changeDependencyReview(context, sessionId, change, now) {
+    async changeDependencyReview(context, sessionId, change, now, tarballs) {
       const user = await actor(db, sessionId)
       if (change.action !== 'revoke' && change.action !== 'publish') await requireReviewer(db, user.id)
       let id = change.reviewId
@@ -274,8 +312,8 @@ export function dependencyReviewMethods(db: ManagedSql): DependencyReviewStore {
         if (await unpublished()) return conflict()
         const next = randomUUID()
         await db.prepare(`INSERT INTO managed_dependency_review
-          (id, user_id, user_login, ecosystem, package, version, integrity, base_package, base_version, base_integrity, time, revision)
-          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1)`).run(next, user.id, user.login, ...values(context), now)
+          (id, user_id, user_login, ecosystem, package, version, integrity, base_package, base_version, base_integrity, shasum, base_shasum, time, revision)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1)`).run(next, user.id, user.login, ...values(context), ...shasums(tarballs), now)
         return next
       }
       if (change.action === 'start') {
@@ -294,11 +332,11 @@ export function dependencyReviewMethods(db: ManagedSql): DependencyReviewStore {
         if (!current || current.publishedAt === null || current.revokedAt !== null) return conflict()
         await db.prepare('UPDATE managed_dependency_review SET revoked_at = ?, revision = revision + 1 WHERE id = ?').run(now, id)
       } else if (change.action === 'publish') {
-        await publish(db, current, user.id, change, now)
+        await publish(db, current, user.id, change, now, tarballs)
       } else {
         if (current?.publishedAt != null) return conflict()
         if (change.entry.status === null && !change.entryId) throw new ManagedMutationError(400, 'bad-review')
-        if (id) await db.prepare('UPDATE managed_dependency_review SET time = ?, revision = revision + 1 WHERE id = ?').run(now, id)
+        if (id) await db.prepare('UPDATE managed_dependency_review SET time = ?, shasum = ?, base_shasum = ?, revision = revision + 1 WHERE id = ?').run(now, ...shasums(tarballs), id)
         else { if (change.entryId) return conflict(); id = await create() }
         await saveFile(db, id, change.entry, change.entryId, now)
       }

package/server-managed/github-accounts.ts

@@ -1,6 +1,8 @@
 // GitHub accounts as GitHub's REST and GraphQL APIs name them, where a
 // repository's activity names its authors (repository-history.ts and the
 // Commits, Issues, Agents and Pulse tabs' readers).
+import { githubGraphql } from './github-graphql.ts'
+
 const LOGIN = /^[A-Za-z\d][A-Za-z\d-]{0,38}(?:\[bot\])?$/u
 
 // An account as GitHub names it: its login, else null, and its numeric id
@@ -23,7 +25,8 @@ export const actorOf = (actor: GraphAccount) => accountOf({ login: actor?.login,
 // GitHub knows its address for; else, as GitHub's REST API does, the account
 // whose noreply address its address is, `<id>+<login>@users.noreply.github.com`:
 // a GitHub App's bot's, which is no user (GraphQL's `user` is a User's, never
-// a bot's).
+// a bot's). One by GitHub's older no-reply address, `<login>@users.noreply.github.com`,
+// naming no id, its user looked up by its login (repository-history.ts linkNoreplyUsers).
 const NOREPLY = /^([1-9]\d{0,11})\+([^@]+)@users\.noreply\.github\.com$/iu
 export type GraphActor = { email?: unknown; user?: GraphAccount | null }
 export function commitAccount(author: GraphActor | null | undefined): NamedAccount {
@@ -31,3 +34,27 @@ export function commitAccount(author: GraphActor | null | undefined): NamedAccou
   const noreply = user.id === null && typeof author?.email === 'string' ? NOREPLY.exec(author.email) : null
   return noreply ? accountOf({ login: noreply[2], id: Number(noreply[1]) }) : user
 }
+
+// GitHub's no-reply address of old, `<login>@users.noreply.github.com`, which
+// names no id: GitHub links the commits it authors to the account of its
+// login, as its REST API names them, but its GraphQL API names no user for it.
+const NOREPLY_LOGIN = /^([A-Za-z\d][A-Za-z\d-]{0,38})@users\.noreply\.github\.com$/iu
+const MAX_NOREPLY_LOGINS = 100
+
+// Commits' authors and co-authors (`actors`), as GitHub's GraphQL API names
+// them, those it names no user for by such an address named the user of its
+// login, as GitHub links them: those logins, as many as MAX_NOREPLY_LOGINS,
+// looked up in one query, where any is.
+export async function linkNoreplyUsers(actors: (GraphActor | null | undefined)[], token: string, fetchImpl: typeof fetch): Promise<void> {
+  const unnamed = actors.flatMap(actor => {
+    const login = actor && !actor.user && typeof actor.email === 'string' ? NOREPLY_LOGIN.exec(actor.email)?.[1]?.toLowerCase() : undefined
+    return login ? [{ actor: actor!, login }] : []
+  })
+  const logins = [...new Set(unnamed.map(({ login }) => login))].slice(0, MAX_NOREPLY_LOGINS)
+  if (logins.length === 0) return
+  const query = `query(${logins.map((_, at) => `$l${at}: String!`).join(', ')}) { ${logins.map((_, at) => `u${at}: user(login: $l${at}) { login databaseId }`).join(' ')} }`
+  const data = await githubGraphql(query, Object.fromEntries(logins.map((login, at) => [`l${at}`, login])), token, fetchImpl,
+    error => error?.type === 'NOT_FOUND') as Record<string, GraphAccount> | null
+  const users = new Map(logins.map((login, at) => [login, data?.[`u${at}`] ?? null]))
+  for (const { actor, login } of unnamed) actor.user = users.get(login) ?? null
+}

package/server-managed/github-app.ts

@@ -8,6 +8,7 @@ import { createClient } from '@preventive/upstream/github.js'
 import type { ManagedConfig } from './config.ts'
 import { GithubApiError, githubUnreachable, throwGithubResponseError, upstreamGithub } from './github-errors.ts'
 import { onTokenRejected, shareGithubRead, tokenRejected } from './github-requests.ts'
+import { timed } from './request-timing.ts'
 
 export { GithubApiError } from './github-errors.ts'
 export { onTokenRejected } from './github-requests.ts'
@@ -74,31 +75,34 @@ export function mergeRepos(...lists: ConnectedRepo[][]): ConnectedRepo[] {
 // GithubApiError (401 passes through for the caller to handle). Identical GETs
 // share an outstanding read through its body. POSTs only opt in for read-only
 // GraphQL queries (repository-history.ts), never for mutations or token mints.
-export async function githubJson(url: string, token: string | null, fetchImpl: typeof fetch, method: 'GET' | 'POST' = 'GET', body?: unknown,
+export function githubJson(url: string, token: string | null, fetchImpl: typeof fetch, method: 'GET' | 'POST' = 'GET', body?: unknown,
   readOnly = method === 'GET'): Promise<unknown> {
   if (readOnly) return shareGithubRead(fetchImpl, JSON.stringify([url, token, method, body]), () => githubJson(url, token, fetchImpl, method, body, false))
-  let res: Response
-  const started = Date.now()
-  try {
-    res = await fetchImpl(url, {
-      method,
-      signal: AbortSignal.timeout(body === undefined ? 10_000 : 20_000),
-      redirect: 'error',
-      headers: {
-        ...(token == null ? {} : { authorization: `Bearer ${token}` }), 'accept': 'application/vnd.github+json',
-        ...(body === undefined ? {} : { 'content-type': 'application/json' }), 'user-agent': USER_AGENT, 'x-github-api-version': API_VERSION,
-      },
-      ...(body === undefined ? {} : { body: JSON.stringify(body) }),
-    })
-  } catch (error) { throw githubUnreachable(error, started) }
-  if (res.status === 401 && token) tokenRejected(token, fetchImpl)
-  if (!res.ok) await throwGithubResponseError(res)
-  // The answer's body is read within the same timeout: one not read whole is
-  // GitHub not reached, as one not answered is; only one that isn't JSON is
-  // malformed.
-  try { return await res.json() } catch (error) {
-    throw error instanceof SyntaxError ? new GithubApiError(502, 'github-malformed') : githubUnreachable(error, started)
-  }
+  // Each call told in its request's Server-Timing (request-timing.ts).
+  return timed('gh', async () => {
+    let res: Response
+    const started = Date.now()
+    try {
+      res = await fetchImpl(url, {
+        method,
+        signal: AbortSignal.timeout(body === undefined ? 10_000 : 20_000),
+        redirect: 'error',
+        headers: {
+          ...(token == null ? {} : { authorization: `Bearer ${token}` }), 'accept': 'application/vnd.github+json',
+          ...(body === undefined ? {} : { 'content-type': 'application/json' }), 'user-agent': USER_AGENT, 'x-github-api-version': API_VERSION,
+        },
+        ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+      })
+    } catch (error) { throw githubUnreachable(error, started) }
+    if (res.status === 401 && token) tokenRejected(token, fetchImpl)
+    if (!res.ok) await throwGithubResponseError(res)
+    // The answer's body is read within the same timeout: one not read whole is
+    // GitHub not reached, as one not answered is; only one that isn't JSON is
+    // malformed.
+    try { return await res.json() } catch (error) {
+      throw error instanceof SyntaxError ? new GithubApiError(502, 'github-malformed') : githubUnreachable(error, started)
+    }
+  })
 }
 
 // Validate one repo object into a ConnectedRepo (or null to skip), tagging it

package/server-managed/github-graphql.ts

@@ -0,0 +1,39 @@
+// GitHub's GraphQL API, a query at a time, as the repository readers ask it
+// (repository-history.ts, repository-agents.ts, repository-pulse.ts and the rest).
+import { GithubApiError, githubJson } from './github-app.ts'
+
+export type GraphqlError = { type?: unknown; path?: unknown; message?: unknown }
+
+const NAMED_ERRORS = new Set(['RATE_LIMITED', 'NOT_FOUND', 'FORBIDDEN'])
+// GitHub's own words for a query it stopped past its time (ten seconds):
+// "Something went wrong while executing your query. This may be the result
+// of a timeout, …", with no type.
+const TIMED_OUT = /\btimeout\b/iu
+
+// One GraphQL query with `token`, answered with its `data`: one GitHub answers
+// with errors, but for those the caller reads past (`tolerated`, the fields
+// they name then null), is rate limited, names what isn't there, is refused,
+// as one a GitHub App lacks the permission for is, or a token the scope for
+// (`INSUFFICIENT_SCOPES`, a sign-in's having none), took GitHub too long, or
+// else is malformed, as one GitHub rejects unread is (a field or type its API
+// doesn't know). GitHub's words for errors of none of those first three types
+// are logged, those read past too.
+export async function githubGraphql(query: string, variables: Record<string, unknown>, token: string, fetchImpl: typeof fetch,
+  tolerated: (error: GraphqlError) => boolean = () => false) {
+  const body = await githubJson('https://api.github.com/graphql', token, fetchImpl, 'POST', { query, variables }, true) as { data?: unknown; errors?: GraphqlError[] } | null
+  const all = Array.isArray(body?.errors) ? body.errors : []
+  const unnamed = all.filter(error => !NAMED_ERRORS.has(String(error?.type)))
+  if (unnamed.length > 0) {
+    console.warn('managed: GitHub answered a query with errors:', JSON.stringify(unnamed.slice(0, 3)
+      .map(error => ({ type: error?.type, message: String(error?.message).slice(0, 300), path: error?.path }))))
+  }
+  const errors = all.filter(error => !tolerated(error))
+  if (errors.length > 0) {
+    if (errors.some(error => error?.type === 'RATE_LIMITED')) throw new GithubApiError(429, 'github-rate-limited', 60)
+    if (errors.some(error => error?.type === 'NOT_FOUND')) throw new GithubApiError(404, 'github-not-found')
+    if (errors.some(error => error?.type === 'FORBIDDEN' || error?.type === 'INSUFFICIENT_SCOPES')) throw new GithubApiError(502, 'github-status-403')
+    if (errors.some(error => typeof error?.message === 'string' && TIMED_OUT.test(error.message))) throw new GithubApiError(502, 'github-timeout')
+    throw new GithubApiError(502, 'github-malformed')
+  }
+  return body?.data
+}

package/server-managed/github-issue-links.ts

@@ -71,8 +71,15 @@ function issueUpdates(jobs: Job[], issues: ManagedIssue[], allowed: Map<string,
     if (latest && (!repo || repo.repoId !== latest.repository.databaseId)) continue
     const next = latest ? `https://github.com/${repo!.github}/pull/${latest.number}` : null
     if (latest && next) metadata.set(next, { url: next, ...itemMetadata(latest, 'pull')! })
+    // Only a changed derived Fix is written: an unchanged one's check time
+    // alone would bump the annotations revision that every open team feed
+    // polls, for nothing they show. Changes still stamp it, so an older lookup
+    // never replaces a newer change (managed-issues.ts). An older lookup that
+    // differs can now land after a newer unchanged one, as it could already
+    // land before it (whose compare-and-set then fails); either way the next
+    // lookup finds the stored Fix differs, and writes the current one.
     for (const issue of byIssue.get(`${job.repo.repoId}:${job.number}`) ?? []) {
-      updates.push({ findingId: issue.findingId, issueUrl: issue.issueUrl!, previous: issue.autoFixUrl, next, checkedAt })
+      if (issue.autoFixUrl !== next) updates.push({ findingId: issue.findingId, issueUrl: issue.issueUrl!, previous: issue.autoFixUrl, next, checkedAt })
     }
   }
   return updates

package/server-managed/github-metadata.ts

@@ -77,8 +77,8 @@ CREATE TABLE IF NOT EXISTS managed_github_repository_visibility (
 `
 // Bundles show their commit's details and tags from these tables. Readers rely
 // on bundle access alone; only a GitHub read made with access fills them.
-// Commits are retained without eviction. Create a bundle refreshes a
-// repository's tags, which go with the repository.
+// Commits are retained without eviction. Every refs read of a repository
+// (Create a bundle's, the code viewer's) refreshes its tags, which go with it.
 export const GITHUB_COMMIT_SCHEMA = `
 CREATE TABLE IF NOT EXISTS managed_github_commit (
   cache_key TEXT PRIMARY KEY,

package/server-managed/http-response.ts

@@ -38,21 +38,39 @@ export function sendJson(res: ServerResponse, status: number, body: unknown, hea
 // before a line, has the response cut short, as is one whose lines fail: a
 // response that ends is one with every line.
 export async function sendLines(res: ServerResponse, lines: AsyncIterable<unknown>, allowed: () => Promise<boolean>) {
-  res.writeHead(200, { 'content-type': 'application/x-ndjson', 'content-encoding': 'br', 'cache-control': 'private, no-store', 'x-content-type-options': 'nosniff' })
-  const encoder = createBrotliCompress({ params: { [zlibConstants.BROTLI_PARAM_QUALITY]: 4 } })
-  const sent = pipeline(encoder, res).catch(() => {})
-  const closed = new Promise(resolve => { res.once('close', resolve) })
+  const out = openLines(res)
   try {
     for await (const line of lines) {
-      if (res.destroyed || !await allowed()) { res.destroy(); return }
-      encoder.write(`${JSON.stringify(line)}\n`)
-      await Promise.race([new Promise<void>(resolve => { encoder.flush(() => { resolve() }) }), closed])
+      if (res.destroyed || !await allowed()) { out.cut(); return }
+      await out.write(line)
     }
   } catch (err) {
     console.warn('managed: a streamed response failed:', err)
-    res.destroy()
+    out.cut()
     return
   }
-  encoder.end()
-  await sent
+  await out.end()
+}
+
+// A response of lines of JSON as sendLines sends them, written as its caller
+// has each: `write` sends one, flushed, false where the reader is gone; `end`
+// ends it with every line; `cut` ends it short.
+export function openLines(res: ServerResponse) {
+  res.writeHead(200, { 'content-type': 'application/x-ndjson', 'content-encoding': 'br', 'cache-control': 'private, no-store', 'x-content-type-options': 'nosniff' })
+  const encoder = createBrotliCompress({ params: { [zlibConstants.BROTLI_PARAM_QUALITY]: 4 } })
+  const sent = pipeline(encoder, res).catch(() => {})
+  const closed = new Promise(resolve => { res.once('close', resolve) })
+  return {
+    async write(line: unknown): Promise<boolean> {
+      if (res.destroyed) return false
+      encoder.write(`${JSON.stringify(line)}\n`)
+      await Promise.race([new Promise<void>(resolve => { encoder.flush(() => { resolve() }) }), closed])
+      return !res.destroyed
+    },
+    async end() {
+      encoder.end()
+      await sent
+    },
+    cut() { res.destroy() },
+  }
 }