@preventive/triage 1.0.0-alpha.5 → 1.0.0-alpha.50

package/common/revalidation-conflicts.js

@@ -0,0 +1,48 @@
+import { REVALIDATE_KINDS, revalidateKindOf } from '@preventive/report'
+
+// Keep only the pass's fields, before gap-filling changes the survivor.
+// In particular, a verdict borrowed from report B must never be attributed
+// to an unstamped copy from report A when report C later contradicts it.
+function fieldsOf(finding) {
+  return Object.fromEntries(Object.entries(finding).filter(([key, value]) =>
+    key.startsWith('revalidate') && value != null))
+}
+
+export function recordRevalidationCopies(survivor, duplicate, reportName) {
+  const fields = fieldsOf(duplicate)
+  if (!survivor._revalidationCopies) {
+    const own = fieldsOf(survivor)
+    if (Object.keys(own).length === 0 && Object.keys(fields).length === 0) return []
+    survivor._revalidationCopies = Object.keys(own).length > 0
+      ? [{ reportName: survivor._reportName ?? '', fields: own }]
+      : []
+  }
+  if (Object.keys(fields).length > 0) survivor._revalidationCopies.push({ reportName, fields })
+  return survivor._revalidationCopies
+}
+
+// Same comparisons as mergeDuplicateFields: missing values are gaps, stamps
+// are normalized, and prose ignores surrounding whitespace. Group agreeing
+// reports together, retaining every distinct answer rather than just a pair.
+export function revalidationDifferences(copies) {
+  const byField = new Map()
+  const knownKinds = new Set(REVALIDATE_KINDS)
+  for (const { reportName, fields } of copies) {
+    for (const [key, value] of Object.entries(fields)) {
+      if (value == null) continue
+      const normalized = key === 'revalidate'
+        ? revalidateKindOf(fields) || String(value).trim().toLowerCase()
+        : String(value).trim()
+      if (key === 'revalidate' && !normalized) continue
+      if (key === 'revalidate' && !knownKinds.has(normalized)) continue
+      if (!byField.has(key)) byField.set(key, new Map())
+      const variants = byField.get(key)
+      if (!variants.has(normalized)) variants.set(normalized, new Set())
+      variants.get(normalized).add(reportName)
+    }
+  }
+  return [...byField].filter(([, variants]) => variants.size > 1).map(([field, variants]) => ({
+    field,
+    variants: [...variants].map(([value, reports]) => ({ value, reports: [...reports] })),
+  }))
+}

package/common/revalidation-input-groups.js

@@ -0,0 +1,56 @@
+// Recover source-level row boundaries before hiding the App layer. App
+// deduplication alone does not make the underlying code findings equivalent.
+// Only split when every source ID is accounted for and every referenced input
+// exists in this row. Missing input lists are empty, not missing evidence for
+// an otherwise complete partition. Original findings and rows stay untouched.
+export function splitRevalidationInputs(group, appFindings = null) {
+  const app = appFindings ?? group.filter((f) => f.isApp)
+  const source = group.filter((f) => !f.isApp)
+  if (app.length === 0 || source.length === 0) return [group]
+  // A surviving App finding means this is not a pure non-App projection;
+  // never move it into a source-only partition.
+  if (appFindings && group.some((f) => f.isApp)) return [group]
+  if (source.some((f) => typeof f.id !== 'string' || !f.id)) return [group]
+
+  const sourceIds = new Set(source.map((f) => f.id))
+  const inputsByApp = new Map()
+  const covered = new Set()
+  for (const f of app) {
+    const inputs = f.revalidateInputs === undefined ? [] : f.revalidateInputs
+    if (!Array.isArray(inputs)) return [group]
+    for (const id of inputs) {
+      if (!sourceIds.has(id)) return [group]
+      covered.add(id)
+    }
+    inputsByApp.set(f, inputs)
+  }
+  if (covered.size !== sourceIds.size) return [group]
+
+  const parent = new Map([...sourceIds].map((id) => [id, id]))
+  const find = (id) => {
+    let root = id
+    while (parent.get(root) !== root) root = parent.get(root)
+    while (parent.get(id) !== root) {
+      const next = parent.get(id)
+      parent.set(id, root)
+      id = next
+    }
+    return root
+  }
+  for (const inputs of inputsByApp.values()) {
+    if (inputs.length === 0) continue
+    const root = find(inputs[0])
+    for (const id of inputs) parent.set(find(id), root)
+  }
+
+  const components = new Map()
+  for (const f of group) {
+    const inputs = inputsByApp.get(f)
+    // Keep an App finding with its inputs until the caller projects the lens.
+    // App findings without inputs stand alone; hiding them then drops the row.
+    const key = inputs ? inputs.length > 0 ? find(inputs[0]) : f : find(f.id)
+    if (!components.has(key)) components.set(key, [])
+    components.get(key).push(f)
+  }
+  return components.size === 1 ? [group] : [...components.values()]
+}

package/common/save-error-reason.ts

@@ -15,8 +15,11 @@
 //                   `session.error` until `dismissError()`.
 //   `busy`        — per-socket inflight cap dropped the save
 //                   (transport backpressure). Recoverable; the
-//                   client clears `pending` and re-arms
-//                   `pendingSave` for the next natural trigger.
+//                   client clears `pending`, re-arms `pendingSave`,
+//                   and schedules a short timed retry — without the
+//                   timer an idle client (no further edit /
+//                   broadcast / reconnect) would strand its last
+//                   edit unsynced indefinitely.
 //   `stale-base`  — concurrent commit advanced the head past the
 //                   client's claimed base. The server emits the
 //                   typed frame AFTER a `workspace-state` catch-up
@@ -25,11 +28,21 @@
 //                   and this frame's handler then early-returns
 //                   on the missing pending. So `stale-base` is
 //                   NOT in the recoverable set: in the happy path
-//                   the recoverable branch is unreachable; in the
-//                   pathological case where wire order flipped,
-//                   we'd rather mark the session errored (visible
-//                   via UI + recoverable via `dismissError()`)
-//                   than silently swallow a state divergence.
+//                   the recoverable branch is unreachable. When
+//                   `pending` DOES survive to this frame — the
+//                   catch-up was empty (chain gone: wiped /
+//                   migrated DB) or didn't apply (chain rebuilt
+//                   past the client's base) — the client answers
+//                   with ONE full-state-push reset per recovery
+//                   cycle (re-anchor at base=null; safe because
+//                   the server's null-safe head CAS rejects a
+//                   base=null root against any non-empty chain;
+//                   see `staleResetAttempted` in triage-sync.ts).
+//                   A repeat within the cycle marks the session
+//                   errored (visible via UI + recoverable via
+//                   `dismissError()`) rather than looping
+//                   full-state saves against a relay that keeps
+//                   rejecting them.
 
 export type SaveErrorReason = 'too-large' | 'busy' | 'stale-base'
 

package/common/scan-server.ts

@@ -0,0 +1,13 @@
+export const DEFAULT_SCAN_SERVER = 'http://127.0.0.1:3123/'
+
+// Discovery is optional: malformed scan configuration must never prevent
+// opening local data or recognizing the server's sync protocol.
+export function normalizeScanServer(value: unknown): string | null {
+  if (typeof value !== 'string' || !value.trim()) return null
+  try {
+    const url = new URL(value)
+    if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.search || url.hash) return null
+    url.pathname = url.pathname.replace(/\/+$/u, '') + '/'
+    return url.href
+  } catch { return null }
+}

package/common/security-links.d.ts

@@ -0,0 +1,5 @@
+export function securityLinks(links?: Iterable<readonly string[]>): {
+  add(ids: readonly string[]): void
+  linkedIds(id: string): Iterable<string>
+}
+export function revalidationLinks(findings: Iterable<unknown>): string[][]

package/common/security-links.js

@@ -0,0 +1,33 @@
+// Links as stampSecurityGroups reads them, shared by the managed server's
+// permission filter and the view's security lens. A star per link is enough
+// for transitive propagation, without a quadratic expansion for large links.
+// `add` extends the lookup while a stamp is running: rows the finding index
+// returns can carry links of their own.
+export function securityLinks(links = []) {
+  const edges = new Map()
+  const connect = (a, b) => {
+    if (!edges.has(a)) edges.set(a, new Set())
+    edges.get(a).add(b)
+  }
+  const add = (ids) => {
+    for (const id of ids.slice(1)) { connect(ids[0], id); connect(id, ids[0]) }
+  }
+  for (const ids of links) add(ids)
+  return { add, linkedIds: (id) => edges.get(id) ?? [] }
+}
+
+// An App finding can name the source findings it revalidated only by ID, in
+// another row or report. The App view counts those as represented by it, so
+// they are one issue for security too: hiding one side alone would leave the
+// App answer to a hidden security finding, or a source row without its App row.
+// Only App findings: the view ignores inputs on any other finding
+// (finding-filters.js confirmedCoverage, revalidation-input-groups.js).
+export function revalidationLinks(findings) {
+  const links = []
+  for (const finding of findings) {
+    const inputs = finding?.revalidateInputs
+    if (finding?.isApp !== true || typeof finding.id !== 'string' || !Array.isArray(inputs)) continue
+    links.push([finding.id, ...inputs.filter((id) => typeof id === 'string' && id !== '')])
+  }
+  return links
+}

package/common/server-info.ts

@@ -0,0 +1,46 @@
+// The sync-protocol mode a server advertises — shared by the server (which
+// emits it) and the client (which parses + caches it) so a change to the
+// shape surfaces as a compile error on BOTH sides, the same single-source
+// discipline as ./save-error-reason.ts.
+//
+// Delivered to the client as the first `server-info` frame on a sync
+// connection (the WS plane and the SSE+POST fallback share one send path).
+// A client uses it to detect whether a deployment speaks the end-to-end
+// (`e2e`, zero-knowledge) protocol, the trusted `managed` protocol, or both.
+// Combined discovery modes put the default protocol first.
+
+export type ServerMode = 'e2e' | 'managed'
+
+// Managed-mode entry points the server advertises; null for an e2e server.
+export interface ManagedServerInfo {
+  loginPath: string
+  cookieName: string
+  uploadChunkBytes?: number
+  uploadMaxBytes?: { reports: number; bundles: number }
+  allowShare?: boolean
+}
+
+// GET /api/auth/session's answer. A managed server's GET /api/config also
+// carries it as `session`, null when signed out, so a client can skip asking.
+export interface ManagedSessionInfo {
+  user: { id: string; login: string; name: string | null; role: string }
+  csrfToken: string
+  viewer?: { id: string; login: string; name: string | null }
+  // Where the user publishes dependency reviews to some team: an npm
+  // version's Review tab is theirs (server-managed/dependency-reviews.ts).
+  dependencyReview?: true
+}
+
+// The `server-info` frame payload (the `type` discriminant is added at the
+// send site). `managed` is null on e2e-only deployments.
+export interface ServerInfo {
+  mode: ServerMode | 'managed+e2e' | 'e2e+managed'
+  managed: ManagedServerInfo | null
+  deepviewScanServer?: string
+  githubNewIssueLabels?: string
+}
+
+// The mode-probe route. A client GETs this to learn a server's protocol up
+// front — a managed server has no WS plane to carry the connect frame — and
+// the response body is the same `ServerInfo` shape emitted as that frame.
+export const CONFIG_PATH = '/api/config'

package/common/utf8.d.ts

@@ -11,3 +11,6 @@
 // narrower declaration is safe.
 export function encodeUtf8(str: string): Uint8Array<ArrayBuffer>
 export function decodeUtf8(bytes: Uint8Array | ArrayBuffer | ArrayBufferView): string
+// Bytes `str` takes in UTF-8, measured without encoding when no character
+// is past \xFF. A lone surrogate counts as the U+FFFD it encodes to.
+export function utf8ByteLength(str: string): number

package/common/utf8.js

@@ -43,6 +43,51 @@ export function encodeUtf8(str) {
   return encoder.encode(str)
 }
 
+// ASCII characters in a row after which the count hands back to the
+// native scan. A jump costs a call and a step does not, so it pays only
+// across a real gap: at 1, alternating text (`aéaé…`) takes a jump per
+// character, and past 2, text with an accent every few words steps
+// through ASCII the scan crosses faster. Measured on 50 MB of each, 2 was
+// never more than 1.5x the best of the thresholds tried, 1 to 32.
+const ASCII_RUN = 2
+
+// The number of bytes `str` takes in UTF-8, without encoding it where
+// that can be helped. A string with no character past \xFF is Latin-1:
+// ASCII takes a byte and \x80-\xFF two, so its size is its length plus
+// its high characters. An engine stores such a string a byte per
+// character, where no character past \xFF can be, so the first test is
+// answered without reading it. Only a string with a wider character is
+// encoded to be measured.
+//
+// The high characters are counted without collecting them: a match array
+// takes an entry apiece, which for Latin-1-heavy text outweighs the
+// encoding this avoids. A native scan jumps to the next one — for ASCII
+// it finds none — and a loop counts on from there while they keep coming,
+// handing back to the scan after a run of ASCII. Sparse text is read
+// natively, dense text by the loop, and neither allocates.
+//
+// This sizes text for display, so unlike `encodeUtf8` it does not refuse
+// a lone surrogate: it counts the U+FFFD that TextEncoder writes for one.
+export function utf8ByteLength(str) {
+  if (typeof str !== 'string') {
+    throw new TypeError(`utf8ByteLength expects a string, got ${typeof str}`)
+  }
+  // Code units, not code points: a `u` regexp reads a two-byte string by
+  // code point, several times slower, and a surrogate is past \xFF either way.
+  // eslint-disable-next-line require-unicode-regexp
+  if (/[\u0100-\uFFFF]/.test(str)) return encoder.encode(str).byteLength
+  const high = /[\u0080-\u00FF]/gu
+  let bytes = str.length
+  while (high.test(str)) {
+    let i = high.lastIndex - 1
+    for (let ascii = 0; i < str.length && ascii < ASCII_RUN; i++) {
+      if (str.codePointAt(i) > 0x7F) { bytes++; ascii = 0 } else ascii++
+    }
+    high.lastIndex = i
+  }
+  return bytes
+}
+
 export function decodeUtf8(bytes) {
   // Reject non-BufferSource so a missed destructure / optional field /
   // misnamed property surfaces here instead of silently defaulting to

package/common/workspace-app.js

@@ -0,0 +1,39 @@
+import { revalidateKindOf } from '@preventive/report'
+import { canLockConfirmed } from './finding-filters.js'
+import { mergeReportGroups } from './workspace-groups.js'
+import { mergeLinkedWorkspaceGroups } from './linked-workspace-groups.js'
+
+function appTabs(group) {
+  if (group.linkedTabs) return group.linkedTabs
+  const app = group.filter((f) => revalidateKindOf(f) === 'revalidation')
+  return app.length > 0 ? app : group
+}
+
+// Findings imported from another analyzer are App findings by construction,
+// and Confirmed counts one its report holds no pass for as shown. A set of
+// nothing but those is already its own App view, with no pass to fold anything
+// under. The Confirmed lock asks for a pass as well (it has no outcome control
+// to offer without one), so this is asked on its own: a team whose permissions
+// leave only other analyzers' findings opens as App, as it does unrestricted.
+// Such a view opens with no outcome filter, but keeps the confidence range of
+// imports that score themselves (DeepSec's do).
+function onlyUnjudgedImports(groups) {
+  const visible = groups.map(appTabs).filter((g) => g.length > 0)
+  return visible.length > 0 && visible.every((g) => g.every((f) => f.isApp && f._source && !f._sourcePass && revalidateKindOf(f) === ''))
+}
+
+// Evaluate the entire workspace, independent of triage, filters, or the lens
+// left active by another report. Use the same merge and link rules as the view.
+// `countFindings` has a workspace that is not App count its rows too, after
+// the same merging, for a caller that shows it collapsed (managed teams).
+export function workspaceAppMetadata(reports, duplicatesOf = () => [], { countFindings = false } = {}) {
+  const { groups, conflicts } = mergeReportGroups(reports, { hideRuledOut: true })
+  const linked = mergeLinkedWorkspaceGroups(groups, duplicatesOf, appTabs)
+  const notApp = countFindings ? { appMode: false, findings: linked.length } : { appMode: false }
+  if (conflicts.size > 0) return notApp
+  if (!onlyUnjudgedImports(linked) && !canLockConfirmed(linked, { tabs: appTabs, kindOf: revalidateKindOf, severityMode: 'corrected' })) return notApp
+  return {
+    appMode: true,
+    appFindings: linked.filter((group) => appTabs(group).some((f) => f.isApp)).length,
+  }
+}

package/common/workspace-groups.js

@@ -0,0 +1,176 @@
+import { revalidateKindOf } from '@preventive/report'
+import { mergeReportDuplicateFields } from './finding-duplicates.js'
+import { splitRevalidationInputs } from './revalidation-input-groups.js'
+
+// Reports retain their original rows. Merge only this derived view, so two
+// application findings that refer to the same source issue keep their own
+// context, verdicts, and tabs. Code mode removes pass findings BEFORE deciding
+// which rows may merge; imports from other analyzers remain App findings.
+export function mergeReportGroups(reports, { showRevalidation = true, upstreamOnly = false, hideRuledOut = false, merges = [] } = {}) {
+  const rows = []
+  const ruledOutIds = new Set()
+  for (let reportIndex = 0; reportIndex < reports.length; reportIndex++) {
+    const report = reports[reportIndex]
+    for (const original of report.groups) {
+      for (const finding of original) {
+        if (finding.id && ['refuted', 'unreachable'].includes(revalidateKindOf(finding))) ruledOutIds.add(finding.id)
+      }
+      // Visibility precedes merging: a hidden answer from another app must
+      // neither cause a conflict nor gap-fill the answer the reader will see.
+      const kept = upstreamOnly
+        ? original.filter((f) => f.isUpstream && revalidateKindOf(f) !== 'revalidation').map(withoutRevalidation)
+        : showRevalidation
+        ? hideRuledOut
+          ? original.filter((f) => !['refuted', 'unreachable'].includes(revalidateKindOf(f)))
+          : original
+        : original.filter((f) => revalidateKindOf(f) !== 'revalidation').map(withoutRevalidation)
+      const group = kept.length === original.length && kept.every((f, i) => f === original[i]) ? original : kept
+      if (group.length > 0) rows.push({ group, sourceGroup: original, reportIndex, reportName: report.fileName ?? '', hasApp: group.some((f) => f.isApp) })
+    }
+  }
+  const parent = rows.map((_, i) => i)
+  const hasApp = rows.map((r) => r.hasApp)
+  const find = (i) => {
+    let root = i
+    while (parent[root] !== root) root = parent[root]
+    while (parent[i] !== root) { const next = parent[i]; parent[i] = root; i = next }
+    return root
+  }
+  const union = (a, b) => {
+    a = find(a); b = find(b)
+    if (a === b) return
+    parent[b] = a
+    hasApp[a] ||= hasApp[b]
+  }
+  const byId = new Map()
+  for (let i = 0; i < rows.length; i++) {
+    for (const f of rows[i].group) {
+      if (!f.id) continue
+      if (!byId.has(f.id)) byId.set(f.id, [])
+      byId.get(f.id).push({ index: i, app: f.isApp })
+    }
+  }
+  // App identities and within-report overlaps establish their components first.
+  // Otherwise a source-only row could bridge two App rows through another report.
+  for (const occurrences of byId.values()) {
+    const ownReports = new Map()
+    const app = occurrences.find((entry) => entry.app)
+    for (const { index } of occurrences) {
+      if (app) union(app.index, index)
+      const reportIndex = rows[index].reportIndex
+      if (ownReports.has(reportIndex)) union(ownReports.get(reportIndex), index)
+      else ownReports.set(reportIndex, index)
+    }
+  }
+  for (const occurrences of byId.values()) {
+    let first = null
+    for (const { index } of occurrences) {
+      if (hasApp[find(index)]) continue
+      if (first === null) first = index
+      else union(first, index)
+    }
+  }
+  // Explicit hints are retained for callers supplying already-deduplicated rows.
+  // Normal report loading no longer needs them: all original rows are retained.
+  for (const merge of merges) {
+    let first = null
+    for (const id of merge) {
+      for (const { index } of byId.get(id) ?? []) {
+        if (first === null) first = index
+        else union(first, index)
+      }
+    }
+  }
+  const components = new Map()
+  for (let i = 0; i < rows.length; i++) {
+    const root = find(i)
+    if (!components.has(root)) components.set(root, [])
+    components.get(root).push(rows[i])
+  }
+  const conflicts = new Map(), groups = []
+  for (const component of components.values()) {
+    const original = component[0].group
+    const ids = original.map((f) => f.id).filter(Boolean)
+    if (component.length === 1 && new Set(ids).size === ids.length && merges.length === 0) {
+      const app = reports.length > 1 && original.find((f) => f.isApp)
+      if (app) {
+        const group = [...original]
+        group.workspaceKey = app.id ?? String(app._id)
+        groups.push(...splitOutput(component, group, showRevalidation, upstreamOnly))
+      } else groups.push(...splitOutput(component, original, showRevalidation, upstreamOnly))
+      continue
+    }
+    const rowConflicts = new Map()
+    const copies = new Map()
+    const findings = []
+    for (const { group, reportName } of component) {
+      for (const f of group) {
+        if (f.id && copies.has(f.id)) {
+          mergeReportDuplicateFields(copies.get(f.id), f, reportName, rowConflicts)
+        } else {
+          // Only the derived copy receives gap fills and per-report variants.
+          const copy = { ...f, _reportName: f._reportName ?? reportName }
+          if (f.id) copies.set(f.id, copy)
+          findings.push(copy)
+        }
+      }
+    }
+    // Combined rows carry the author's order; singleton load order does not.
+    const canonical = new Set()
+    for (const merge of merges) for (const id of merge) if (copies.has(id)) canonical.add(id)
+    for (const { group } of component) {
+      if (group.length > 1) for (const f of group) if (f.id) canonical.add(f.id)
+    }
+    const group = [...canonical].map((id) => copies.get(id))
+    for (const f of findings) if (!canonical.has(f.id)) group.push(f)
+    // Separate App rows can begin with the SAME source id. Give each row its
+    // App identity so Lit keys, selection, and popup close targets stay unique.
+    if (reports.length > 1) {
+      const app = group.find((f) => f.isApp)
+      if (app) group.workspaceKey = app.id ?? String(app._id)
+    }
+    groups.push(...splitOutput(component, group, showRevalidation, upstreamOnly))
+    for (const [id, conflict] of rowConflicts) {
+      const previous = conflicts.get(id)
+      conflicts.set(id, previous
+        ? { finding: previous.finding, copies: [...previous.copies, ...conflict.copies] }
+        : conflict)
+    }
+  }
+  Object.defineProperty(groups, 'ruledOutIds', { value: ruledOutIds, configurable: true })
+  return { groups, conflicts }
+}
+
+function splitOutput(component, group, keepAppLayer, upstreamOnly) {
+  if (keepAppLayer) return [group]
+  if (upstreamOnly) {
+    // Upstream projection removes the App and own-source members before this
+    // function runs. Reconstruct the complete source component first so an
+    // App's inputs outside the upstream lens still determine its partition.
+    const complete = component.flatMap((row) => row.sourceGroup)
+    const partitions = splitRevalidationInputs(complete)
+    if (partitions.length === 1) return [group]
+    const projected = []
+    const covered = new Set()
+    for (const partition of partitions) {
+      const ids = new Set(partition.filter((f) => !f.isApp && f.id).map((f) => f.id))
+      const visible = group.filter((f) => ids.has(f.id))
+      if (visible.length > 0) {
+        projected.push(visible)
+        for (const finding of visible) covered.add(finding.id)
+      }
+    }
+    const groupIds = new Set(group.map((f) => f.id).filter(Boolean))
+    return covered.size === groupIds.size ? projected : [group]
+  }
+  const appFindings = component.flatMap((row) => row.sourceGroup.filter((f) => f.isApp))
+  return splitRevalidationInputs(group, appFindings)
+}
+
+function withoutRevalidation(finding) {
+  const fields = Object.keys(finding).filter((key) => key.startsWith('revalidate') || key === '_revalidationCopies')
+  if (fields.length === 0) return finding
+  const copy = { ...finding }
+  for (const field of fields) delete copy[field]
+  return copy
+}