@preventive/triage 1.0.0-alpha.50 → 1.0.0-alpha.52

package/server-managed/repository-pulls.ts

@@ -1,34 +1,43 @@
-// A repository's pull requests, the most recently updated first, as kept
-// once for both of those that read them so (http.ts keptPulls): the Pulse,
-// telling whose its year's commits are by those merged (agent-merges.ts
-// agentMerges), and the Agents tab, its pages of them (repository-agents.ts
-// agentPulls). Those updated since its year's start, a few queries an
-// answer, the rest read by the next, and those updated since read as they
-// are. Each kept as the Agents tab shows it (repository-agents.ts pull: the
-// marks an agent left in its texts, never the texts) and, one merged, what
-// it brought the default branch, as the Pulse tells it: an agent that
+// A repository's pull requests and its issues, the most recently updated
+// first, each kept once for all of those that read them so (http.ts
+// keptList): the Pulse, telling whose its year's commits are by the pull
+// requests merged (agent-merges.ts agentMerges) and counting those of a
+// period (repository-pulse.ts listedActivity), and the Agents tab, its pages
+// of pull requests (repository-agents.ts agentPulls) and its latest issues.
+// Those updated since the Pulse's year's start, a few queries an answer, the
+// rest read by the next, and those updated since read as they are. An issue
+// kept as both show it; a pull request as the Agents tab shows it
+// (repository-agents.ts pull: the marks an agent left in its texts, never
+// the texts) and, one merged, what it brought the default branch, as the
+// Pulse tells it: an agent that
 // commits as whoever ran it (Codex's own) leaves its commits no mark, its
 // pull request's branch alone naming it (app-agents.ts
 // AGENT_BRANCH_PREFIXES), or a label one who ran it gave it naming the agent
 // (agent-tasks.ts labelAgents), as the Agents tab tells an agent's work; or
 // its author, an account agents work as (github-agents.ts AGENT_OPERATED),
 // or any GitHub App's bot.
-import { type AgentPull, labelAgents } from '../common/managed/agent-tasks.ts'
+import { type AgentIssue, type AgentPull, labelAgents } from '../common/managed/agent-tasks.ts'
 import { GITHUB_AGENTS, agentOperated } from '../common/managed/github-agents.ts'
 import { AGENT_BRANCH_PREFIXES } from './app-agents.ts'
-import { AGENT_PULL_FIELDS, type PullNode, pull } from './repository-agents.ts'
+import { AGENT_ISSUE_FIELDS, AGENT_PULL_FIELDS, type IssueNode, type PullNode, issue, pull } from './repository-agents.ts'
 import { githubGraphql } from './repository-history.ts'
 
 // What the pull requests kept are read by, its version: bumped as what a
 // page reads, or how one is told, changes, its pull requests read again
-// (http.ts keptPulls keys them by AGENTS_READ_VERSION and the Pulse's
-// PULSE_YEAR_VERSION too, as either changes how it tells an agent's).
-export const PULLS_READ_VERSION = 1
-// The pull requests read an answer, a page a query, as many queries as
-// PULLS_QUERIES, the rest left for the next to ask; of each merged, as many
-// of its latest commits as MERGED_COMMITS.
-const PULLS_PAGE = 100
-const PULLS_QUERIES = 5
+// (http.ts keptList keys them by AGENTS_READ_VERSION and the Pulse's
+// PULSE_YEAR_VERSION too, as either changes how it tells an agent's); and
+// the issues kept.
+export const PULLS_READ_VERSION = 2
+export const ISSUES_LIST_READ_VERSION = 1
+// The pull requests or issues read an answer, a page a query, as many
+// queries as LIST_QUERIES, the rest left for the next to ask; of each pull
+// request merged, as many of its latest commits as MERGED_COMMITS. Those
+// updated since the newest read, few as they mostly are, read TOP_UP_PAGE
+// first, the rest LIST_PAGE a page (GitHub reading on from a page's end
+// whatever its size).
+const LIST_PAGE = 100
+const TOP_UP_PAGE = 10
+const LIST_QUERIES = 5
 const MERGED_COMMITS = 100
 const LABEL_AGENTS = Object.keys(GITHUB_AGENTS)
 const SHA = /^[a-f\d]{40}$/u
@@ -39,9 +48,10 @@ const timeOf = (value: unknown) => {
   return Number.isSafeInteger(at) ? at : null
 }
 
-// A pull request as read: its row on the Agents tab, and one merged, what
-// it brought the default branch (`merged`).
-export type KeptPull = AgentPull & { merged?: Merged }
+// A pull request as read: its row on the Agents tab, whether a GitHub App's
+// bot opened it (`bot`, GitHub's GraphQL API naming one by its app's login
+// alone), and one merged, what it brought the default branch (`merged`).
+export type KeptPull = AgentPull & { bot?: true; merged?: Merged }
 // What a merged pull request brought: its merge commit (`sha`), when it was
 // merged (`at`) and whether it was an agent's (agentPull); an agent's merged
 // with a merge commit, which a year counts none of, its own commits too
@@ -51,25 +61,33 @@ export type KeptPull = AgentPull & { merged?: Merged }
 // its empty commits left out, as a rebase leaves them, and how many more it
 // had than those read (`more`).
 export interface Merged { sha: string; at: number; agent: boolean; own?: string[]; subjects?: string[]; more?: number }
-// The pull requests updated since a year's start (`since`) as read so far
-// (readPulls), the most recently updated first; when the newest read was
-// last updated, those updated since read again (`through`, null till all
-// are read once), and where those read reach back no further than was
-// needed, when the oldest of them was updated (`reach`); whether every one
-// the repository has is read (`all`); and a read not finished: where it goes
-// on (`after`), when the newest it began with was updated (`from`), the
-// oldest it reads to (`stop`), how many it has read (`read`) and when the
-// oldest of them was updated (`to`).
-export interface PullList { pulls: KeptPull[]; since: number; through: number | null; reach?: number; all?: true
+// An issue as read: as the Agents tab shows it, whether a bot opened it
+// (`bot`, as a pull request's), when it was closed, and why (`reason`, as
+// GitHub tells it: completed, not planned or a duplicate).
+export type KeptIssue = AgentIssue & { bot?: true; closedAt: number | null; reason: IssueReason | null }
+export type IssueReason = 'completed' | 'not-planned' | 'duplicate'
+export const ISSUE_REASONS: Record<string, IssueReason> = { COMPLETED: 'completed', NOT_PLANNED: 'not-planned', DUPLICATE: 'duplicate' }
+// The pull requests or issues updated since a year's start (`since`) as
+// read so far (readList), the most recently updated first (`rows`); when the
+// newest read was last updated, those updated since read again (`through`,
+// null till all are read once), and where those read reach back no further
+// than was needed, when the oldest of them was updated (`reach`); whether
+// every one the repository has is read (`all`); and a read not finished:
+// where it goes on (`after`), when the newest it began with was updated
+// (`from`), the oldest it reads to (`stop`), how many it has read (`read`)
+// and when the oldest of them was updated (`to`).
+export interface Listed<Row> { rows: Row[]; since: number; through: number | null; reach?: number; all?: true
   next: { after: string; from: number; stop: number; read: number; to?: number } | null }
+export type PullList = Listed<KeptPull>
+export type IssueList = Listed<KeptIssue>
 
-// Since when every pull request updated is read: all of them since the
-// year's start, -∞; none yet, ∞.
-export const pullsReadTo = (list: Pick<PullList, 'next' | 'reach'>) => list.next ? list.next.to ?? Number.POSITIVE_INFINITY : list.reach ?? Number.NEGATIVE_INFINITY
+// Since when every one updated is read: all of them since the year's
+// start, -∞; none yet, ∞.
+export const pullsReadTo = (list: Pick<Listed<unknown>, 'next' | 'reach'>) => list.next ? list.next.to ?? Number.POSITIVE_INFINITY : list.reach ?? Number.NEGATIVE_INFINITY
 
-const PULLS_QUERY = `query($owner: String!, $name: String!, $after: String) {
+const PULLS_QUERY = `query($owner: String!, $name: String!, $after: String, $first: Int!) {
   repository(owner: $owner, name: $name) {
-    pullRequests(first: ${PULLS_PAGE}, after: $after, orderBy: { field: UPDATED_AT, direction: DESC }) {
+    pullRequests(first: $first, after: $after, orderBy: { field: UPDATED_AT, direction: DESC }) {
       pageInfo { hasNextPage endCursor }
       nodes { ${AGENT_PULL_FIELDS} mergedAt mergeCommit { oid parents { totalCount } }
         commits(last: ${MERGED_COMMITS}) { totalCount nodes { commit { oid messageHeadline changedFilesIfAvailable } } } }
@@ -79,7 +97,17 @@ const PULLS_QUERY = `query($owner: String!, $name: String!, $after: String) {
 type MergedNode = PullNode & { mergedAt?: unknown; mergeCommit?: { oid?: unknown; message?: unknown; parents?: { totalCount?: unknown } | null } | null
   author?: PullNode['author'] & { __typename?: unknown }
   commits?: { totalCount?: unknown; nodes?: ({ commit?: { oid?: unknown; messageHeadline?: unknown; changedFilesIfAvailable?: unknown } | null } | null)[] } | null }
-type PullsPage = { repository?: { pullRequests?: { pageInfo?: { hasNextPage?: unknown; endCursor?: unknown }; nodes?: (MergedNode | null)[] } | null } | null }
+const ISSUES_QUERY = `query($owner: String!, $name: String!, $after: String, $first: Int!) {
+  repository(owner: $owner, name: $name) {
+    issues(first: $first, after: $after, orderBy: { field: UPDATED_AT, direction: DESC }) {
+      pageInfo { hasNextPage endCursor }
+      nodes { ${AGENT_ISSUE_FIELDS} stateReason closedAt }
+    }
+  }
+}`
+type ClosedNode = IssueNode & { stateReason?: unknown; closedAt?: unknown; author?: IssueNode['author'] & { __typename?: unknown } }
+const botOf = (author: { __typename?: unknown } | null | undefined) => author?.__typename === 'Bot' ? { bot: true as const } : {}
+type ListPage<Node> = { repository?: Record<string, { pageInfo?: { hasNextPage?: unknown; endCursor?: unknown }; nodes?: (Node | null)[] } | null> | null }
 
 const agentBranch = (name: unknown) => typeof name === 'string' && AGENT_BRANCH_PREFIXES.some(prefix => name.startsWith(prefix))
 // Whether a pull request is an agent's: by its branch, a label naming one,
@@ -105,31 +133,60 @@ function mergedOf(node: MergedNode): Merged | null {
   return { sha, at, agent, ...own.length > 0 ? { own } : {}, ...subjects ? { subjects, ...more > 0 ? { more } : {} } : {} }
 }
 
+// What an issue closed tells beside its row (KeptIssue).
+function closedOf(node: ClosedNode): KeptIssue | null {
+  const row = issue(node)
+  return row ? { ...row, ...botOf(node.author), closedAt: timeOf(node.closedAt), reason: ISSUE_REASONS[String(node.stateReason)] ?? null } : null
+}
+
 // The most recently updated first, the higher number first of those
 // updated together.
-const newestFirst = (a: AgentPull, b: AgentPull) => (b.updatedAt ?? 0) - (a.updatedAt ?? 0) || b.number - a.number
+const newestFirst = (a: { number: number; updatedAt: number | null }, b: { number: number; updatedAt: number | null }) =>
+  (b.updatedAt ?? 0) - (a.updatedAt ?? 0) || b.number - a.number
+
+// How a list is read: the query of its pages, the repository's connection
+// they are of, and what each of them is kept as.
+interface ListSpec<Node, Row> { query: string; connection: 'pullRequests' | 'issues'; row(node: Node): Row | null }
+const PULLS: ListSpec<MergedNode, KeptPull> = { query: PULLS_QUERY, connection: 'pullRequests', row: node => {
+  const row = pull(node)
+  const merged = mergedOf(node)
+  return row ? { ...row, ...botOf(node.author), ...merged ? { merged } : {} } : null
+} }
+const ISSUES: ListSpec<ClosedNode, KeptIssue> = { query: ISSUES_QUERY, connection: 'issues', row: closedOf }
+
+// The pull requests updated since `since` (readList), and what each merged
+// brought.
+export const readPulls = (fullName: string, token: string, since: number, kept: PullList | null, fetchImpl: typeof fetch = globalThis.fetch, need = since) =>
+  readList(PULLS, fullName, token, since, kept, fetchImpl, need)
+// The issues updated since `since` (readList), and when and why each closed was.
+export const readIssues = (fullName: string, token: string, since: number, kept: IssueList | null, fetchImpl: typeof fetch = globalThis.fetch, need = since) =>
+  readList(ISSUES, fullName, token, since, kept, fetchImpl, need)
 
-// The pull requests updated since `since`, read the most recently updated
-// first (a pull request is updated when merged, or after), on from what was
-// `kept`: till one updated before the year, or before the newest read before
-// was, as many queries an answer as PULLS_QUERIES, a read not finished going
-// on from where it was left by the next, or once those updated since `need`
-// are all read; where those read reached no further back than they needed,
-// and `need` is further, read again from the newest on, as far back as it
-// needs. Each kept as last read, one updated before the year forgotten.
-export async function readPulls(fullName: string, token: string, since: number, kept: PullList | null,
-  fetchImpl: typeof fetch = globalThis.fetch, need = since): Promise<PullList> {
+// Those of a list (`spec`) updated since `since`, read the most recently
+// updated first (a pull request is updated when merged, or after, an issue
+// when closed), on from what was `kept`: till one updated before the year,
+// or before the newest read before was, as many queries an answer as
+// LIST_QUERIES, a read not finished going on from where it was left by the
+// next, or once those updated since `need` are all read; where those read
+// reached no further back than they needed, and `need` is further, read
+// again from the newest on, as far back as it needs. Each kept as last read,
+// one updated before the year forgotten.
+async function readList<Node extends { updatedAt?: unknown }, Row extends { number: number; updatedAt: number | null }>(spec: ListSpec<Node, Row>,
+  fullName: string, token: string, since: number, kept: Listed<Row> | null, fetchImpl: typeof fetch, need: number): Promise<Listed<Row>> {
   const [owner, name] = fullName.split('/') as [string, string]
-  const pulls = new Map((kept?.pulls ?? []).filter(item => (item.updatedAt ?? 0) >= since).map(item => [item.number, item]))
+  const rows = new Map((kept?.rows ?? []).filter(item => (item.updatedAt ?? 0) >= since).map(item => [item.number, item]))
   // Every one read, as long as none was forgotten, the year begun since.
-  const whole = kept?.all === true && pulls.size === kept.pulls.length
+  const whole = kept?.all === true && rows.size === kept.rows.length
   const further = !kept?.next && kept?.reach !== undefined && kept.reach > need
   const stop = kept?.next?.stop ?? (further ? since : Math.max(since, kept?.through ?? since))
-  const result = (through: number | null, next: PullList['next'], reach: number | undefined, all = whole): PullList => ({
-    pulls: [...pulls.values()].toSorted(newestFirst), since, through, ...reach === undefined ? {} : { reach }, ...all ? { all: true as const } : {}, next })
+  const result = (through: number | null, next: Listed<Row>['next'], reach: number | undefined, all = whole): Listed<Row> => ({
+    rows: [...rows.values()].toSorted(newestFirst), since, through, ...reach === undefined ? {} : { reach }, ...all ? { all: true as const } : {}, next })
+  // A read of those updated since the newest read alone.
+  const topping = !kept?.next && !further && kept?.through !== null && kept?.through !== undefined
   let { after = null, from = null, read = 0, to = null }: { after?: string | null; from?: number | null; read?: number; to?: number | null } = kept?.next ?? {}
-  for (let queries = 0; queries < PULLS_QUERIES; queries++) {
-    const page = (await githubGraphql(PULLS_QUERY, { owner, name, after }, token, fetchImpl) as PullsPage | null)?.repository?.pullRequests
+  for (let queries = 0; queries < LIST_QUERIES; queries++) {
+    const first = topping && queries === 0 ? TOP_UP_PAGE : LIST_PAGE
+    const page = (await githubGraphql(spec.query, { owner, name, after, first }, token, fetchImpl) as ListPage<Node> | null)?.repository?.[spec.connection]
     const end = page?.pageInfo?.hasNextPage !== true || typeof page.pageInfo.endCursor !== 'string'
     let crossed = false
     for (const node of page?.nodes ?? []) {
@@ -139,9 +196,8 @@ export async function readPulls(fullName: string, token: string, since: number,
       from ??= updated
       to = updated
       read++
-      const row = pull(node)
-      const merged = mergedOf(node)
-      if (row) pulls.set(row.number, merged ? { ...row, merged } : row)
+      const row = spec.row(node)
+      if (row) rows.set(row.number, row)
     }
     // Read as far back as it reads to: the year's start, every one since
     // read; else as far as those read before reached. Read to the last

package/server-managed/repository-pulse.ts

@@ -26,7 +26,7 @@ const WEEK_MS = 7 * 24 * 60 * 60_000
 const DAY_MS = 24 * 60 * 60_000
 const MAX_CONTRIBUTORS = 100
 const DIRECT_LISTED = 500
-const LISTED = 10
+export const LISTED = 10
 // Merged pull requests and closed issues are searched by when each was last
 // updated, GitHub sorting by no merge or close: as many as this are read, and
 // the latest merged or closed of them listed.
@@ -211,9 +211,10 @@ export async function defaultHead(fullName: string, token: string, fetchImpl: ty
 // before it, a clock behind, the branch's commits since beneath them. Read
 // no further than `need` asks, those since it read whole (`complete`, `from`
 // the newest of those read whose parents are not, every commit after it
-// read; null, the year read whole).
+// read; null, the year read whole). How many are read so far `told` as they
+// are.
 export async function yearCommits(fullName: string, token: string, head: string, since: number, pages: HistoryPages,
-  fetchImpl: typeof fetch = globalThis.fetch, need = since): Promise<YearCommits> {
+  fetchImpl: typeof fetch = globalThis.fetch, need = since, told: (read: number) => void = () => {}): Promise<YearCommits> {
   const found = new Map<string, HistoryCommit>()
   const tried = new Set<string>()
   const within = (commit: HistoryCommit) => commit.committedAt === null || commit.committedAt >= since - YEAR_SKEW_MS
@@ -236,6 +237,7 @@ export async function yearCommits(fullName: string, token: string, head: string,
     const got = await historyFrom(fullName, token, batch, pages, fetchImpl)
     if (got.read > 0) queries++
     for (const commit of got.commits) if (!found.has(commit.sha)) found.set(commit.sha, commit)
+    told(read())
     if (read() > YEAR_COMMITS) return { complete: false, read: read(), tooMany: true }
     starts = [...new Set([...found.values()].filter(within).flatMap(commit => commit.parents))].filter(sha => !found.has(sha) && !tried.has(sha))
   }

package/server-managed/repository-stamp.ts

@@ -0,0 +1,41 @@
+// A repository's change stamp: what moves as anything its tabs read of it
+// changes, but the checks its pull requests run, which move no pull
+// request's update time, read in one cheap GraphQL query: when it was last
+// pushed to, which branch is its default, how many branches and tags it
+// has, and how many pull requests and issues it has and when the one
+// updated last was. An answer kept of it
+// is read again behind its readers only where its stamp moved since the
+// answer was read (http.ts keptAnswer).
+import { GithubApiError } from './github-errors.ts'
+import { githubGraphql } from './github-graphql.ts'
+
+// The rules a stamp is read by: its key's, so that a stamp read by others is
+// none's (http.ts stampOf).
+export const STAMP_READ = 2
+
+const STAMP_QUERY = `query($owner: String!, $name: String!) {
+  repository(owner: $owner, name: $name) {
+    pushedAt
+    defaultBranchRef { name }
+    heads: refs(refPrefix: "refs/heads/", first: 1) { totalCount }
+    tags: refs(refPrefix: "refs/tags/", first: 1) { totalCount }
+    pullRequests(first: 1, orderBy: { field: UPDATED_AT, direction: DESC }) { totalCount nodes { updatedAt } }
+    issues(first: 1, orderBy: { field: UPDATED_AT, direction: DESC }) { totalCount nodes { updatedAt } }
+  }
+}`
+type Counted = { totalCount?: unknown; nodes?: ({ updatedAt?: unknown } | null)[] | null } | null
+type Stamped = { repository?: { pushedAt?: unknown; defaultBranchRef?: { name?: unknown } | null; heads?: Counted; tags?: Counted; pullRequests?: Counted; issues?: Counted } | null }
+  | null
+
+// Repository `fullName`'s stamp, read with `token`, as text to compare.
+export async function repositoryStamp(fullName: string, token: string, fetchImpl: typeof fetch = globalThis.fetch): Promise<{ stamp: string }> {
+  const [owner, name] = fullName.split('/') as [string, string]
+  const repository = (await githubGraphql(STAMP_QUERY, { owner, name }, token, fetchImpl) as Stamped)?.repository
+  if (!repository) throw new GithubApiError(404, 'github-not-found')
+  // One missing a count tells nothing: none, never one that would move with nothing.
+  const { heads, tags, pullRequests, issues } = repository
+  if (![heads, tags, pullRequests, issues].every(connection => Number.isSafeInteger(connection?.totalCount))) throw new GithubApiError(502, 'github-malformed')
+  const latest = (connection: Counted | undefined) => [connection?.totalCount, connection?.nodes?.[0]?.updatedAt ?? null]
+  return { stamp: JSON.stringify([repository.pushedAt ?? null, repository.defaultBranchRef?.name ?? null, heads?.totalCount, tags?.totalCount, ...latest(pullRequests),
+    ...latest(issues)]) }
+}

package/server-managed/reviewed-dependencies.ts

@@ -9,11 +9,10 @@
 // is reviewed since (pull-dependency-reviews.ts): a version passes by the
 // reviews its teams publish, and those its pull request's comments make, as
 // many as the repository requires, or by `lookup`'s saying so, and is
-// otherwise unreviewed. A patched version (pnpm's patchedDependencies)
-// passes by `lookup`, or reviews its comments make of its patch, alone, the
-// app reviewing no patch yet. Those comments' reviews count for the pull
-// request alone, as it is open: the host's to keep, as it is merged, among
-// those `lookup` tells of.
+// otherwise unreviewed. A patched version's (pnpm's patchedDependencies)
+// reviews are of its patch, its teams' and its comments' alike. Those
+// comments' reviews count for the pull request alone, as it is open: the
+// host's to keep, as it is merged, among those `lookup` tells of.
 //
 // Each version is asked of `lookup` once a request, as many at once as
 // ASK_AT_ONCE, its answer kept in this instance KEPT_MS; one it fails to

package/server-managed/team-app.ts

@@ -17,6 +17,7 @@
 // findings, and only expanded does it show that they fail to combine.
 import { reportEntries } from '@preventive/report'
 import { type TeamAppMetadata, managedTeamAppMetadata } from '../common/managed/team-app.js'
+import { expandFindingValues } from '../common/managed/finding-values.js'
 import type { BlobStore } from './blob-store.ts'
 import type { ManagedDb, TeamReportAccessSnapshot, UserTeam } from './db.ts'
 import type { WorkspaceShareSnapshot } from './workspace-shares.ts'
@@ -86,8 +87,9 @@ async function classify(db: ManagedDb, store: BlobStore, key: string, team: User
     // A catalog read before a concurrent publication names another report set.
     if (!access?.teamId || access.reports.length !== ids.size || access.reports.some(report => !ids.has(report.id))) return null
     const body = JSON.parse((await loadTeamReportsResponse(db, store, access)).toString('utf8')) as {
-      reports: { id: string; filename: string; data: unknown }[]; links?: string[][]
+      reports: { id: string; filename: string; data: unknown }[]; links?: string[][]; values?: unknown[]
     }
+    for (const report of body.reports) expandFindingValues(report.data, body.values)
     const restricted = access.reports.some(report => !report.permissions.dependencies || !report.permissions.security)
     const empty = restricted ? body.reports.filter(report => !hasContent(report.data)).map(report => report.id) : []
     const links = body.links ?? []

package/server-managed/team-reports.ts

@@ -8,7 +8,8 @@ import { managedFindingSourcePaths, readManagedReport } from '../common/managed/
 import { filterReportData, projectFinding } from '../common/managed/report-filter.ts'
 import { revalidationLinks, securityLinks } from '../common/security-links.js'
 import { treeDependencyDirectory } from '../client/dependency-paths.js'
-import { liteReportData } from '../common/managed/finding-detail.js'
+import { liteWorkspace } from '../common/managed/finding-detail.js'
+import { expandFindingValues, findingValueIndex } from '../common/managed/finding-values.js'
 import type { BlobStore } from './blob-store.ts'
 import type { ManagedDb, TeamReportAccessSnapshot } from './db.ts'
 import { triageWireEntry } from './triage-response.ts'
@@ -158,13 +159,23 @@ async function buildTeamWorkspace(db: ManagedDb, store: BlobStore, snapshot: Tea
   for (let i = 0; i < reports.length; i++) {
     const access = snapshot.reports[i]!, report = reports[i]!
     report.data = filterReportData(report.data, access.permissions, access.repo, securityIds)
+    if (report.data && typeof report.data === 'object' && ('think' in report.data || 'reportRepo' in report.data)) {
+      const { think: _think, reportRepo: _reportRepo, ...data } = report.data as Finding
+      report.data = data
+    }
     const ids = new Set<string>()
     for (const finding of groupsOf(report.data).flat()) {
       // Preserve linked security classification for the UI lens, including a
       // linked component that a dependency permission will hide from the UI.
       finding['isSecurity'] = securityIds.has(String(finding['id']))
-      // The hash of its file's tree, which nothing a team view shows reads.
+      // The hash of its file's tree, the fingerprint its ID was derived from,
+      // whether its run thought and the repository its report named, which
+      // nothing a team view reads, nor an export (@preventive/report
+      // write-md-finding.js) writes.
       delete finding['treeHash']
+      delete finding['_idBasis']
+      delete finding['think']
+      delete finding['reportRepo']
       if (typeof finding['id'] === 'string') { ids.add(finding['id']); allIds.add(finding['id']) }
     }
     visible.set(report.id, { ids, sourcePaths: managedFindingSourcePaths(groupsOf(report.data).flat()) })
@@ -177,11 +188,13 @@ async function buildTeamWorkspace(db: ManagedDb, store: BlobStore, snapshot: Tea
   }
   const trees = Buffer.from(`{"trees":{${reports.map(withoutTree).filter(tree => tree !== null).join(',')}}}`)
   const links = mergeLinkGroups(globalLinks, allIds)
+  // The board's: its findings without their detail, and in App mode its rows
+  // as the App view shows them (common/managed/finding-detail.js).
+  const lite = liteWorkspace(reports, links)
   const encoded = {
     // Bounded together, as when the trees were sent with their reports.
     reports: encodeReports(reports, links, trees.length),
-    // The board's, its findings without their detail (common/managed/finding-detail.js).
-    lite: encodeReports(reports.map(report => ({ ...report, data: liteReportData(report.data) })), links, 0),
+    lite: encodeReports(lite.reports, links, 0, lite.folded),
     trees,
   }
   retainVisibility(db, workspaceKey(snapshot), visible)
@@ -189,18 +202,23 @@ async function buildTeamWorkspace(db: ManagedDb, store: BlobStore, snapshot: Tea
   return { ...encoded, visible }
 }
 // `{ reports, links }` as a response sends them, `spent` bytes already
-// counted against the bound.
-function encodeReports(reports: readonly TeamReport[], links: readonly string[][], spent: number): Buffer {
+// counted against the bound; `folded` where the board's copy left out rows
+// App mode does not show (common/managed/finding-detail.js). Its findings'
+// packages and repositories are sent once each, in `values`
+// (common/managed/finding-values.js).
+function encodeReports(reports: readonly TeamReport[], links: readonly string[][], spent: number, folded = false): Buffer {
   let outputBytes = spent + 14
   const parts = [Buffer.from('{"reports":[')]
+  const values = findingValueIndex()
   for (const [index, report] of reports.entries()) {
-    const bytes = Buffer.from(JSON.stringify(report))
+    const bytes = Buffer.from(JSON.stringify({ ...report, data: values.index(report.data) }))
     outputBytes += bytes.length + 1
     if (outputBytes > MAX_REPORT_QUERY_BYTES) throw new TeamReportsError(413, 'batch-too-large')
     if (index) parts.push(Buffer.from(','))
     parts.push(bytes)
   }
-  const suffix = Buffer.from(links.length > 0 ? `],"links":${JSON.stringify(links)}}` : ']}')
+  const tail = JSON.stringify({ ...links.length > 0 ? { links } : {}, ...folded ? { folded } : {}, ...values.values.length > 0 ? { values: values.values } : {} })
+  const suffix = Buffer.from(tail === '{}' ? ']}' : `],${tail.slice(1)}`)
   if (outputBytes + suffix.length > MAX_REPORT_QUERY_BYTES) throw new TeamReportsError(413, 'batch-too-large')
   parts.push(suffix)
   return Buffer.concat(parts)
@@ -227,8 +245,9 @@ export async function loadTeamReportsResponse(db: ManagedDb, store: BlobStore, s
 }
 export async function loadTeamReports(db: ManagedDb, store: BlobStore, snapshot: TeamReportAccessSnapshot): Promise<TeamReport[]> {
   // Object consumers get their own copy, including when sharing a cold load.
-  const body = await loadTeamReportsResponse(db, store, snapshot)
-  return (JSON.parse(body.toString('utf8')) as { reports: TeamReport[] }).reports
+  const body = JSON.parse((await loadTeamReportsResponse(db, store, snapshot)).toString('utf8')) as { reports: TeamReport[]; values?: unknown[] }
+  for (const report of body.reports) expandFindingValues(report.data, body.values)
+  return body.reports
 }
 async function teamVisibility(db: ManagedDb, store: BlobStore, snapshot: TeamReportAccessSnapshot): Promise<Visibility> {
   let visible = caches.get(db)?.get(workspaceKey(snapshot))