@preventive/triage 1.0.0-alpha.5 → 1.0.0-alpha.50

package/server-managed/commit-coauthors.ts

@@ -0,0 +1,106 @@
+// Who made a commit beside its author, as the Commits tab shows them
+// (repository-history.ts): its co-authors, as its `Co-authored-by:` trailers
+// name them, and the agents its message marks.
+import { agentSignals, trailerBlock } from '../common/managed/agent-tasks.ts'
+import { GITHUB_AGENTS, type GithubAgentId, emailAgent, githubAgent } from '../common/managed/github-agents.ts'
+import { APP_AGENTS } from './app-agents.ts'
+import { type NamedAccount, commitAccount } from './github-accounts.ts'
+
+export const MAX_COAUTHORS = 3
+// The rules who a commit names beside its author is read by (coauthorFacts),
+// and how they are kept: what was kept read by others (history pages,
+// squashed pull requests) read again by these, once raised. The agents'
+// accounts, addresses and names are none of them (coauthorsOf).
+export const COAUTHORS_READ = 5
+const MAX_NAME = 256
+const textOf = (value: unknown, max: number) => typeof value === 'string' && value.trim() ? value.trim().slice(0, max) : null
+
+// One who made a commit beside its author: by name and account, as its
+// author is, and the agent it is where known (common/managed/github-agents.ts),
+// by its account, its commits' address or name, or the marks it leaves.
+export interface Coauthor { name: string | null; login: string | null; id: number | null; agent?: string }
+
+// `Co-authored-by: <name> <address>` trailers, GitHub matching the key
+// regardless of case; Cursor's agents' links, as their work carries them;
+// the app agents known by the fingerprints they leave.
+const COAUTHOR_TRAILER = /^co-authored-by:[ \t]*([^<\n]*?)[ \t]*<([^<>\s]+)>[ \t]*$/gimu
+const CURSOR_AGENT = /https:\/\/cursor\.com\/(?:agents\?id=|background-agent\?bcId=)bc-/u
+const FINGERPRINTED = APP_AGENTS.filter(agent => agent.fingerprint)
+
+// One named as a commit's author or co-author: by name, the address its
+// commit gives (where it is read), and account.
+export type Maker = { name: unknown; email?: unknown; account: NamedAccount }
+
+// Those a commit's message names in its `Co-authored-by:` trailers
+// (agent-tasks.ts trailerBlock), each by name and address.
+export const coauthorTrailers = (message: unknown) => typeof message === 'string'
+  ? [...trailerBlock(message.replaceAll('\r\n', '\n')).matchAll(COAUTHOR_TRAILER)].map(([, name, email]) => ({ name: name!, email: email! })) : []
+
+// The agent one who made a commit is: by their account, else the address
+// their commit names them by; else, GitHub naming no account for them, by
+// their name.
+const makerAgent = ({ name, email, account }: Maker): GithubAgentId | null => githubAgent(account.login, account.id) ?? emailAgent(email)
+  ?? (account.login ? null : githubAgent(null, null, typeof name === 'string' ? name : null))
+
+// Who a commit names beside its author, as its history keeps them
+// (repository-history.ts, `coauthorFacts`), its message never kept: its
+// co-authors (`named`), those GitHub's GraphQL API lists past the author
+// (`listed`, the addresses its `Co-authored-by:` trailers give, by the
+// accounts GitHub knows them by), else its trailers (agent-tasks.ts
+// trailerBlock), an account's no-reply address naming it, as many as
+// MAX_NAMED, each by name, address and account; and the agents its message
+// marks (`markedBy`), Claude's and Codex's as the Agents tab reads them
+// (agent-tasks.ts agentSignals: their sessions' and tasks' links, Claude's
+// co-author and "Generated with" lines), the app agents' by their
+// fingerprints, Cursor's by its agents' links. Which of them are agents,
+// and so the same as another, is told as they are answered (coauthorsOf), so
+// that the agents' accounts, addresses and names change none kept.
+export interface Named { name: string | null; email: string | null; login: string | null; id: number | null }
+export const MAX_NAMED = 10
+export function coauthorFacts(message: unknown, listed: Maker[] | null = null): { named: Named[]; markedBy: string[] } {
+  const text = typeof message === 'string' ? message.replaceAll('\r\n', '\n') : ''
+  const makers = listed ?? coauthorTrailers(text).map(({ name, email }) => ({ name, email, account: commitAccount({ email }) }))
+  const signals = agentSignals([text], FINGERPRINTED)
+  return {
+    named: makers.slice(0, MAX_NAMED).map(({ name, email, account }) => ({ name: textOf(name, MAX_NAME), email: textOf(email, MAX_NAME), login: account.login, id: account.id })),
+    markedBy: [...signals.claude || signals.sessions.length > 0 ? ['claude'] : [], ...signals.tasks.length > 0 || signals.codex ? ['codex'] : [],
+      ...CURSOR_AGENT.test(text) ? ['cursor'] : [], ...signals.agents],
+  }
+}
+
+// A commit as its history keeps it: its author by name, address and account,
+// and who it names beside them (coauthorFacts), absent from pages kept before.
+export interface CommitFacts { authorName: string | null; authorEmail?: string | null; authorLogin: string | null; authorId?: number | null; named?: Named[]
+  markedBy?: string[] }
+
+// Who made a commit, past its author, as its history keeps them
+// (`commit`, coauthorFacts): its co-authors, then the agents its message
+// marks, each the agent it is where known, by the agents the app knows now,
+// and once, the author none of them, as many as MAX_COAUTHORS: two are one by
+// the first of their agent, account, address and name both name, two people
+// of one name with accounts or addresses of their own two.
+export function coauthorsOf({ authorName, authorEmail = null, authorLogin, authorId = null, named = [], markedBy = [] }: CommitFacts): Coauthor[] {
+  type Identity = { agent: string | null; login: string | null; email: string | null; name: string | null }
+  const identity = (agent: string | null, login: string | null, name: string | null, email: unknown = null): Identity => ({ agent, login: login?.toLowerCase() ?? null,
+    email: typeof email === 'string' && email.trim() ? email.trim().toLowerCase() : null, name: name?.toLowerCase() ?? null })
+  const same = (a: Identity, b: Identity) => a.agent && b.agent ? a.agent === b.agent : a.login && b.login ? a.login === b.login
+    : a.email && b.email ? a.email === b.email : a.name !== null && a.name === b.name
+  const author: Maker = { name: authorName, email: authorEmail, account: { login: authorLogin, id: authorId } }
+  const seen = [identity(makerAgent(author), authorLogin, textOf(authorName, MAX_NAME), authorEmail)]
+  const coauthors: Coauthor[] = []
+  const add = (coauthor: Coauthor, email: unknown = null) => {
+    const who = identity(coauthor.agent ?? null, coauthor.login, coauthor.name, email)
+    if (seen.some(other => same(other, who)) || coauthors.length >= MAX_COAUTHORS || (!coauthor.login && !coauthor.name && !coauthor.agent)) return
+    seen.push(who)
+    coauthors.push(coauthor)
+  }
+  for (const { name, email, ...account } of named) {
+    const agent = makerAgent({ name, email, account })
+    // An agent known by its address where GitHub names someone else's
+    // account for it (Codex's), as itself, not that account.
+    const { login, id } = agent && account.login && githubAgent(account.login, account.id) !== agent ? { login: null, id: null } : account
+    add({ name, login, id, ...agent ? { agent } : {} }, email)
+  }
+  for (const agent of markedBy) if (Object.hasOwn(GITHUB_AGENTS, agent)) add({ name: GITHUB_AGENTS[agent as GithubAgentId].name, login: null, id: null, agent })
+  return coauthors
+}

package/server-managed/commit-lockfiles.ts

@@ -0,0 +1,73 @@
+// The versions a repository's lockfiles of npm's ecosystem lock at a commit,
+// as their review reads them (pull-dependency-reviews.ts): every lockfile
+// there (findRepoLockfiles) a review holds to (`held`, lockfile-scope.ts),
+// read as a pull request's are (pull-dependencies.ts readLockfile), but kept
+// by its blob, in this instance and beyond it (`kept`), as many as
+// MAX_LOCKFILES of those, each's versions (`lockfiles`), and those its reader
+// refuses, of Bun's, or past MAX_LOCKFILES (`unread`), as many read at once
+// as READ_AT_ONCE; and those of some of them (lockedIn), each version once by
+// what its reviews are held to (lockedWith), dev only where it is wherever it
+// is locked. GitHub having none of a lockfile it lists there fails the
+// whole, as it would for any file.
+import { createClient } from '@preventive/upstream/github.js'
+import { upstreamGithub } from './github-errors.ts'
+import { GithubApiError } from './github-app.ts'
+import type { LockedPackage } from './locked-packages.ts'
+import { type Lru, lru } from './lru.ts'
+import { type GithubAsked, type ListedLockfile, type LockfileStore, eachOf, lockedWith, lockfileFormat, readLockfile } from './pull-dependencies.ts'
+
+export const MAX_LOCKFILES = 100
+const READ_AT_ONCE = 4
+
+export interface CommitLockfiles { lockfiles: { path: string; packages: LockedPackage[] }[]; unread: string[] }
+
+// The lockfiles at commit `sha` its review reads, by their paths, each with
+// its format (pull-dependencies.ts lockfileFormat) and its blob's id, kept by
+// the commit, in this instance and beyond it (`kept`); `asked` told where
+// GitHub was.
+const listings: Lru<ListedLockfile[]> = lru(20_000, listed => listed.length + 1)
+export async function lockfilesAt(fullName: string, token: string, sha: string, kept: LockfileStore | null, asked?: GithubAsked) {
+  const key = `${fullName}\0${sha}`
+  const known = listings.get(key)
+  if (known) return known
+  const stored = await kept?.listings.read(sha)
+  if (stored) { listings.set(key, stored); return stored }
+  if (asked) asked.github = true
+  const { lockfiles } = await upstreamGithub(() => createClient({ token, userAgent: 'deepview-triage' }).findRepoLockfiles({ repo: fullName, sha }))
+  const listed = lockfiles.flatMap(({ path, sha: blob }) => { const format = lockfileFormat(path); return format ? [{ path, format, sha: blob }] : [] })
+  listings.set(key, listed)
+  await kept?.listings.write(sha, listed)
+  return listed
+}
+
+export async function lockedAt(fullName: string, token: string, sha: string, kept: LockfileStore | null, held: (path: string) => boolean = () => true,
+  asked?: GithubAsked): Promise<CommitLockfiles> {
+  const listed = (await lockfilesAt(fullName, token, sha, kept, asked)).filter(({ path }) => held(path))
+  const unread = listed.slice(MAX_LOCKFILES).map(({ path }) => path)
+  const lockfiles: CommitLockfiles['lockfiles'] = []
+  const reading = listed.slice(0, MAX_LOCKFILES)
+  const reads = await eachOf(reading, READ_AT_ONCE, lockfile => readLockfile(fullName, token, sha, lockfile, kept, asked))
+  for (const [at, lockfile] of reading.entries()) {
+    const read = reads[at]!
+    if ('error' in read && read.error === 'github-not-found') throw new GithubApiError(404, 'github-not-found')
+    if ('error' in read) unread.push(lockfile.path)
+    else lockfiles.push({ path: lockfile.path, packages: read.packages })
+  }
+  return { lockfiles, unread: unread.toSorted() }
+}
+
+// The versions those of `read`'s lockfiles `held` holds to lock, each once,
+// and their paths.
+export function lockedIn(read: CommitLockfiles, held: (path: string) => boolean = () => true) {
+  const packages = new Map<string, LockedPackage>()
+  const paths: string[] = []
+  for (const lockfile of read.lockfiles.filter(({ path }) => held(path))) {
+    paths.push(lockfile.path)
+    for (const pkg of lockfile.packages) {
+      const kept = packages.get(lockedWith(pkg))
+      if (!kept) packages.set(lockedWith(pkg), { ...pkg })
+      else if (kept.dev && !pkg.dev) delete kept.dev
+    }
+  }
+  return { packages: [...packages.values()], paths }
+}

package/server-managed/comparison.ts

@@ -0,0 +1,41 @@
+// Compare's comparison of two managed bundles or two versions of an npm
+// package (GET /api/bundles/:id/comparison?other=, GET /api/npm/comparison):
+// their files paired, at one path or renamed, with the sizes, resolutions,
+// dependency versions and line counts its Overview and Code read beside them,
+// as common/bundle-comparison.js prepareComparison works them out. The viewer
+// of a managed bundle or a package has every comparison worked out here and
+// loads none of the pairing itself. Answered as Brotli-encoded JSON, its
+// `files.basePaths` (a Map) as `[path, as laid out]` pairs where the two
+// sides' roots differ and none else, as the viewer reads none then. Access is
+// the caller's to check.
+import { Buffer } from 'node:buffer'
+import { Readable } from 'node:stream'
+import { prepareComparison } from '../common/bundle-comparison.js'
+import type { BundleDetails } from '../common/bundle-metadata.js'
+import type { OpenedBlob } from './blob-store.ts'
+import { encodeBrotli } from './brotli.ts'
+import { type NpmPackageFile, npmFileRows } from './npm-packages.ts'
+
+// A side with no files, as Review compares a package's first version with:
+// one for each comparison, as working one out keeps its line counts on it.
+export const emptySide = (): BundleDetails => ({ integrity: '(empty)', kind: 'sourcemap', size: 0, json: { version: 3, sources: [], sourcesContent: [] } })
+
+// A version's files as the viewer reads them for a comparison (ui/view/npm-package.js
+// npmPackageDetails): its texts, and those that are not text by their size and digest.
+export function npmComparedSide(integrity: string, files: NpmPackageFile[]): BundleDetails & { npmBinaries: Map<string, { size: number; digest: string }> } {
+  const rows = npmFileRows(files)
+  return {
+    integrity, kind: 'sourcemap', size: 0,
+    json: { version: 3, sources: rows.map(([path]) => path), sourcesContent: rows.map(([, , text]) => text) },
+    npmBinaries: new Map(rows.flatMap(([path, size, text, digest]) => (text === null ? [[path, { size, digest: digest! }] as const] : []))),
+  }
+}
+
+// The comparison of `base` with `other`, within a reason `scope` where given, as sent.
+export async function comparisonBody(base: BundleDetails, other: BundleDetails, scope = ''): Promise<OpenedBlob> {
+  const comparison = prepareComparison(base, other, scope)
+  const { files } = comparison
+  const json = JSON.stringify({ ...comparison, files: { ...files, basePaths: files.root ? [...files.basePaths] : [] } })
+  const body = await encodeBrotli(Buffer.from(json))
+  return { size: body.byteLength, stream: Readable.from([body]) }
+}

package/server-managed/config.ts

@@ -0,0 +1,164 @@
+// Managed-server boot config. GitHub user authorization establishes identity;
+// optional App installation credentials enable repository access. A single
+// GitHub App can provide both flows, with repository grants at installation.
+import { env } from 'node:process'
+import { databaseUrls } from '../server-common/database-config.ts'
+import { MAX_UPLOAD_BYTES } from './uploads.ts'
+import { parseStorageKey } from '../server-common/storage-crypto.ts'
+import { defaultCacheDir } from '@preventive/upstream/npm.js'
+import { RESERVED_COOKIES } from './session.ts'
+
+const LOOPBACK_HOSTS = new Set(['127.0.0.1', '::1', 'localhost'])
+
+export interface ManagedConfig {
+  port: number
+  host: string
+  dbPath: string
+  neonUrl?: string | null
+  blobToken?: string | null
+  storageEncryptionKey?: string | null
+  storageEncryptionMigrate?: boolean
+  storageEncryptionMigrateMaxMs?: number
+  vercelPreview?: boolean
+  serverless?: boolean
+  // Upstream's disk cache (setCacheDir) for audits and bundle builds: its default
+  // location, or null for none, as on Vercel, where the database keeps listings.
+  upstreamCacheDir?: string | null
+  debug: boolean
+  allowShare: boolean
+  trustProxyEnv: string | undefined
+  // GitHub App user-authorization (identity) credentials — the App's client id
+  // + secret, used by the login flow.
+  githubClientId: string
+  githubClientSecret: string
+  // Preapproved GitHub identity promoted on login when it is the only user
+  // and its role is No access, including a login after registration.
+  initialAdminGithubId: number | null
+  // Absolute callback registered with GitHub, e.g.
+  // 'https://triage.example.com/api/oauth/github/callback'.
+  oauthCallbackUrl: string
+  // Whether cookies carry `Secure` (callback is https). Also gates the
+  // `__Host-` prefix, so loopback http dev can run with a plain cookie name.
+  cookieSecure: boolean
+  sessionCookieName: string
+  sessionTtlMs: number
+  // How long GitHub's answer on a user's access to a repository (its
+  // visibility, their permission) is kept for that user and repository
+  // (repository-browser.ts), asked again past it; 0 asks on every request
+  // (MANAGED_REPOSITORY_ACCESS_CACHE_MS, five minutes by default).
+  repositoryAccessCacheMs: number
+  // Optional installation credentials for the same GitHub App as login.
+  // Repository permissions are approved when connecting repositories.
+  githubAppId: string | null
+  githubAppPrivateKey: string | null
+  githubAppSlug: string | null
+  githubNewIssueLabels?: string
+  // Max accepted size (bytes) for an uploaded report on the "Manage reports"
+  // page, before storage compression (default 25 MiB).
+  maxReportBytes: number
+  // Max accepted size (bytes) for an uploaded bundle (sourcemap / stasis
+  // archive). Bundles run larger than reports, so a higher cap (default 200 MiB).
+  maxBundleBytes: number
+  // How many triage-trail events to keep per finding (managed_finding_triage_event):
+  // 0, the default, keeps everything — the trail is the record. An operator
+  // who would rather bound the store sets a positive count; older events of a
+  // finding are then trimmed as new ones land.
+  triageHistoryLimit: number
+}
+
+function fail(msg: string): never {
+  throw new Error(msg)
+}
+
+function requireStr(name: string): string {
+  const v = env[name]
+  if (v == null || v === '') fail(`Missing required env ${name} (managed mode).`)
+  return v
+}
+
+function intEnv(name: string, def: number, min: number, max: number): number {
+  const raw = env[name]
+  const n = raw == null ? def : Number(raw)
+  if (!Number.isSafeInteger(n) || n < min || n > max) {
+    fail(`Invalid ${name}: ${raw} — must be an integer in [${min}, ${max}].`)
+  }
+  return n
+}
+
+function optionalGithubId(name: string): number | null {
+  const raw = env[name]
+  if (raw == null || raw === '') return null
+  const id = Number(raw)
+  if (!/^[1-9]\d*$/u.test(raw) || !Number.isSafeInteger(id)) {
+    fail(`Invalid ${name}: must be a single positive numeric GitHub user ID.`)
+  }
+  return id
+}
+
+function urlOrFail(name: string, raw: string): URL {
+  try { return new URL(raw) } catch { fail(`${name} is not a valid URL: ${raw}`) }
+}
+
+export function loadManagedConfig({ combined = false } = {}): ManagedConfig {
+  const serverless = env['VERCEL'] === '1'
+  const neonUrl = databaseUrls({ combined }).managed
+  const blobToken = env['BLOB_READ_WRITE_TOKEN'] || null
+  const storageEncryptionKey = env['MANAGED_STORAGE_ENCRYPTION_KEY'] || null
+  parseStorageKey(storageEncryptionKey)
+  const storageEncryptionMigrate = env['MANAGED_STORAGE_ENCRYPTION_MIGRATE'] === '1'
+  if (storageEncryptionMigrate && !storageEncryptionKey) fail('MANAGED_STORAGE_ENCRYPTION_MIGRATE requires MANAGED_STORAGE_ENCRYPTION_KEY.')
+  if (serverless && !neonUrl) fail('Vercel managed mode requires DATABASE_URL or MANAGED_DATABASE_URL.')
+  if (neonUrl && !blobToken) fail('Managed Neon mode requires BLOB_READ_WRITE_TOKEN.')
+  const host = env['HOST'] ?? '127.0.0.1'
+  const oauthCallbackUrl = requireStr('OAUTH_CALLBACK_URL')
+  const callback = urlOrFail('OAUTH_CALLBACK_URL', oauthCallbackUrl)
+  const cookieSecure = callback.protocol === 'https:'
+  // A `__Host-` cookie mandates `Secure`, so any non-loopback bind must be
+  // HTTPS — fail fast (mirrors server-e2e's boot check). Loopback dev over
+  // http is allowed with a non-prefixed cookie name.
+  if ((serverless || !LOOPBACK_HOSTS.has(host)) && !cookieSecure) {
+    fail(`Vercel or non-loopback HOST=${host} requires an https OAUTH_CALLBACK_URL — the session cookie needs Secure.`)
+  }
+  const sessionCookieName = env['SESSION_COOKIE_NAME'] ?? '__Host-dvsid'
+  if (sessionCookieName.startsWith('__Host-') && !cookieSecure) {
+    fail(`SESSION_COOKIE_NAME=${sessionCookieName} uses the __Host- prefix but the callback is not https. Use a non-prefixed name for loopback http dev.`)
+  }
+  if (RESERVED_COOKIES.includes(sessionCookieName.replace(/^__Host-/u, ''))) {
+    fail(`SESSION_COOKIE_NAME=${sessionCookieName} is reserved for another managed cookie. Choose a different name.`)
+  }
+  return {
+    neonUrl, blobToken, serverless, storageEncryptionKey, storageEncryptionMigrate,
+    storageEncryptionMigrateMaxMs: intEnv('MANAGED_STORAGE_ENCRYPTION_MIGRATE_MAX_MS', 150_000, 1, serverless ? 240_000 : 3_600_000),
+    vercelPreview: env['VERCEL_ENV'] === 'preview',
+    upstreamCacheDir: serverless ? null : defaultCacheDir ?? null,
+    port: intEnv('PORT', 8765, 0, 65535),
+    host,
+    // DB_PATH belongs to e2e in a combined process. Keep the two stores apart.
+    dbPath: env['MANAGED_DB_PATH'] ?? (combined ? undefined : env['DB_PATH']) ?? 'server-managed/data/managed.db',
+    debug: env['DEBUG'] === '1' || env['DEBUG'] === 'true',
+    allowShare: env['DEEPVIEW_ALLOW_SHARE'] === '1',
+    trustProxyEnv: env['TRUST_PROXY'] ?? (serverless ? '1' : undefined),
+    githubClientId: requireStr('GITHUB_CLIENT_ID'),
+    githubClientSecret: requireStr('GITHUB_CLIENT_SECRET'),
+    initialAdminGithubId: optionalGithubId('MANAGED_INITIAL_ADMIN_GITHUB_ID'),
+    oauthCallbackUrl,
+    cookieSecure,
+    sessionCookieName,
+    sessionTtlMs: intEnv('SESSION_TTL_MS', 1_209_600_000, 60_000, 7_776_000_000),
+    repositoryAccessCacheMs: intEnv('MANAGED_REPOSITORY_ACCESS_CACHE_MS', 300_000, 0, 3_600_000),
+    githubAppId: env['GITHUB_APP_ID'] ?? null,
+    githubAppPrivateKey: normalizePem(env['GITHUB_APP_PRIVATE_KEY']),
+    githubAppSlug: env['GITHUB_APP_SLUG'] ?? null,
+    githubNewIssueLabels: env['GITHUB_NEW_ISSUE_LABELS'] ?? '',
+    maxReportBytes: intEnv('MAX_REPORT_BYTES', 26_214_400, 1, 104_857_600),
+    maxBundleBytes: intEnv('MAX_BUNDLE_BYTES', 209_715_200, 1, MAX_UPLOAD_BYTES),
+    triageHistoryLimit: intEnv('TRIAGE_HISTORY_LIMIT', 0, 0, 1_000_000_000),
+  }
+}
+
+// PEM private keys are awkward in env vars; accept a literal multi-line value or
+// one with escaped newlines (`\n`). Empty/absent → null (private repos off).
+function normalizePem(raw: string | undefined): string | null {
+  if (raw == null || raw === '') return null
+  return raw.includes('\\n') ? raw.replaceAll('\\n', '\n') : raw
+}

package/server-managed/content-access.ts

@@ -0,0 +1,15 @@
+import type { ManagedDb, StoredUser } from './db.ts'
+
+export type RepoScope = { repoId: number; path: string | null }
+type Content = { repoId: number | null; repoDirectory?: string }
+
+// Read grants for each request: neither the manager role nor a cached page
+// confers repository access. Bundles have repository scope; reports also have
+// a directory scope. Unassigned content is only available to administrators.
+export async function contentAccess(db: Pick<ManagedDb, 'listRepoScopesForUser'>, user: StoredUser) {
+  const scopes = user.role === 'admin' ? null : await db.listRepoScopesForUser(user.id)
+  const bundle = (item: Content) => scopes == null || scopes.some(scope => scope.repoId === item.repoId)
+  const report = (item: Content) => scopes == null || scopes.some(scope => scope.repoId === item.repoId
+    && (!scope.path || item.repoDirectory === scope.path || item.repoDirectory?.startsWith(scope.path + '/')))
+  return { scopes, bundle, report }
+}

package/server-managed/crypto.ts

@@ -0,0 +1,25 @@
+// Token helpers for the managed auth server. The raw session token lives ONLY
+// in the cookie; the DB row id is its SHA-256 (see db.ts / session.ts), so a
+// DB read can't reconstruct a live cookie. No HMAC pepper is needed — the
+// tokens are 256-bit random, not guessable or reversible from their hash.
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto'
+
+// 256-bit URL-safe random token: the session cookie value and the OAuth CSRF
+// `state` nonce.
+export function randomToken(): string {
+  return randomBytes(32).toString('base64url')
+}
+
+// At-rest id for a session cookie token (stored as the managed_session PK).
+export function hashToken(token: string): string {
+  return createHash('sha256').update(token, 'utf8').digest('base64url')
+}
+
+// Constant-time equality for CSRF / OAuth-state checks. A length mismatch
+// short-circuits (the length of these fixed-width tokens isn't a secret).
+export function safeEqual(a: string, b: string): boolean {
+  const ab = Buffer.from(a, 'utf8')
+  const bb = Buffer.from(b, 'utf8')
+  if (ab.length !== bb.length) return false
+  return timingSafeEqual(ab, bb)
+}