@preventive/triage 1.0.0-alpha.52 → 1.0.0-alpha.54

package/server-managed/managed-issues.ts

@@ -1,10 +1,13 @@
 import type { ManagedSql } from './sql.ts'
 import type { TeamReportAccessSnapshot } from './db.ts'
-import { parseGithubPrUrl } from '../common/github-pr.ts'
+import { parseGithubIssueUrl, parseGithubPrUrl } from '../common/github-pr.ts'
 
 // One immutable reference per finding, shared across reports and teams. Keep
 // reservations across crashes/uncertain GitHub responses to prevent duplicates.
-// No triage/import/admin patch accepts these fields.
+// No triage/import/admin patch accepts these fields. What a lookup derives of
+// the issue (github-issue-links.ts) sits beside it, never in its place: the
+// issue it was closed as a duplicate of, kept as a redirect is, and the pull
+// request fixing either, both as last checked (auto_fix_checked_at).
 export const MANAGED_ISSUE_SCHEMA = `
 CREATE TABLE IF NOT EXISTS managed_finding_issue (
   finding_id TEXT PRIMARY KEY,
@@ -14,6 +17,7 @@ CREATE TABLE IF NOT EXISTS managed_finding_issue (
   issue_url TEXT,
   auto_fix_url TEXT,
   auto_fix_checked_at INTEGER,
+  duplicate_of_url TEXT,
   created_by TEXT REFERENCES managed_user(id) ON DELETE SET NULL,
   created_at INTEGER NOT NULL
 ) STRICT;
@@ -26,16 +30,20 @@ export interface ManagedIssue {
   issueUrl: string | null
   autoFixUrl: string | null
   autoFixCheckedAt: number | null
+  duplicateOfUrl: string | null
   createdBy: string | null
   createdAt: number
 }
+// What a lookup derives of a saved issue: the pull request fixing it, and the
+// issue it was closed as a duplicate of (followed to the last such one).
+export type IssueTracking = { autoFix: string | null; duplicateOf: string | null }
 export interface ManagedIssueStore {
   getManagedIssue(findingId: string): Promise<ManagedIssue | null>
   listManagedIssues(findingIds: readonly string[]): Promise<ManagedIssue[]>
-  claimManagedIssue(issue: Omit<ManagedIssue, 'issueUrl' | 'autoFixUrl' | 'autoFixCheckedAt'>): Promise<boolean>
+  claimManagedIssue(issue: Omit<ManagedIssue, 'issueUrl' | 'autoFixUrl' | 'autoFixCheckedAt' | 'duplicateOfUrl'>): Promise<boolean>
   finishManagedIssue(findingId: string, requestId: string, url: string): Promise<boolean>
   releaseManagedIssue(findingId: string, requestId: string): Promise<void>
-  setManagedIssueAutoFix(findingId: string, issueUrl: string, previous: string | null, next: string | null, checkedAt: number): Promise<boolean>
+  setManagedIssueTracking(findingId: string, issueUrl: string, previous: IssueTracking, next: IssueTracking, checkedAt: number): Promise<boolean>
 }
 
 // A repeated finding ID never grants access to another team's repository.
@@ -43,21 +51,26 @@ export function visibleManagedIssues(issues: ManagedIssue[], snapshot: TeamRepor
   if (snapshot.user.id.startsWith('share:')) return []
   const repos = new Set(snapshot.repositories.map(repo => repo.repoId))
   const names = new Set(snapshot.repositories.map(repo => repo.github.toLowerCase()))
-  return issues.filter(issue => issue.issueUrl && repos.has(issue.repoId)).map(issue => {
-    const ref = parseGithubPrUrl(issue.autoFixUrl)
-    return { ...issue, autoFixUrl: ref && names.has(ref.repo.toLowerCase()) ? issue.autoFixUrl : null }
-  })
+  const inTeam = (url: string | null, parse: typeof parseGithubPrUrl) => {
+    const ref = parse(url)
+    return ref && names.has(ref.repo.toLowerCase()) ? url : null
+  }
+  return issues.filter(issue => issue.issueUrl && repos.has(issue.repoId)).map(issue =>
+    ({ ...issue, autoFixUrl: inTeam(issue.autoFixUrl, parseGithubPrUrl), duplicateOfUrl: inTeam(issue.duplicateOfUrl, parseGithubIssueUrl) }))
 }
 export function managedIssueMethods(db: ManagedSql): ManagedIssueStore {
   const fields = `finding_id AS findingId, repo_id AS repoId, repository, request_id AS requestId,
-    issue_url AS issueUrl, auto_fix_url AS autoFixUrl, auto_fix_checked_at AS autoFixCheckedAt, created_by AS createdBy, created_at AS createdAt`
+    issue_url AS issueUrl, auto_fix_url AS autoFixUrl, auto_fix_checked_at AS autoFixCheckedAt, duplicate_of_url AS duplicateOfUrl,
+    created_by AS createdBy, created_at AS createdAt`
   const get = db.prepare(`SELECT ${fields} FROM managed_finding_issue WHERE finding_id = ?`)
   const list = db.prepare(`SELECT ${fields} FROM managed_finding_issue WHERE finding_id IN (SELECT value FROM json_each(?)) ORDER BY finding_id`)
-  // A lookup's derived Fix replaces the one it read, unless one started later
-  // changed it since: the check time, which only changes stamp
-  // (github-issue-links.ts issueUpdates), orders them.
-  const autoFix = db.prepare(`UPDATE managed_finding_issue SET auto_fix_url = ?, auto_fix_checked_at = ?
+  // A lookup's derived Fix and duplicate replace those it read, unless one
+  // started later changed them since: the check time, which only changes
+  // stamp (github-issue-links.ts issueUpdates), orders them. The issue's own
+  // URL is never written here.
+  const tracking = db.prepare(`UPDATE managed_finding_issue SET auto_fix_url = ?, duplicate_of_url = ?, auto_fix_checked_at = ?
     WHERE finding_id = ? AND issue_url = ? AND COALESCE(auto_fix_url, '') = COALESCE(?, '')
+      AND COALESCE(duplicate_of_url, '') = COALESCE(?, '')
       AND (auto_fix_checked_at IS NULL OR auto_fix_checked_at <= ?)`)
   const claim = db.prepare(`INSERT INTO managed_finding_issue (finding_id, repo_id, repository, request_id, created_by, created_at)
     VALUES (?, ?, ?, ?, ?, ?) ON CONFLICT (finding_id) DO NOTHING`)
@@ -66,8 +79,9 @@ export function managedIssueMethods(db: ManagedSql): ManagedIssueStore {
   return {
     async getManagedIssue(findingId) { return (await get.get(findingId) as ManagedIssue | undefined) ?? null },
     async listManagedIssues(ids) { return await list.all(JSON.stringify(ids)) as ManagedIssue[] },
-    async setManagedIssueAutoFix(findingId, issueUrl, previous, next, checkedAt) {
-      return Number((await autoFix.run(next, checkedAt, findingId, issueUrl, previous, checkedAt)).changes) > 0
+    async setManagedIssueTracking(findingId, issueUrl, previous, next, checkedAt) {
+      return Number((await tracking.run(next.autoFix, next.duplicateOf, checkedAt, findingId, issueUrl,
+        previous.autoFix, previous.duplicateOf, checkedAt)).changes) > 0
     },
     async claimManagedIssue(issue) {
       return Number((await claim.run(issue.findingId, issue.repoId, issue.repository, issue.requestId, issue.createdBy, issue.createdAt)).changes) > 0

package/server-managed/npm-insights.ts

@@ -286,10 +286,11 @@ export async function npmCommitTags(repo: string, sha: string, version: string,
 // An advisory on the package, with the versions it covers as their indexes in
 // the list it was asked with: npm's (`registry`), or one its repository
 // publishes on GitHub before GitHub reviews it into npm's (`repository`); its
-// text (markdown) where its source has one.
+// text (markdown) where its source has one; `malware` where upstream tells it
+// is of malware, any of its rows.
 export interface NpmAdvisory {
   id: string; source: Advisory['source']; ghsa?: string; url?: string; title?: string; severity?: string; cvss?: number; cwe: string[]; range?: string
-  details?: string; affected: number[]
+  details?: string; malware?: true; affected: number[]
 }
 
 // `versions` those `affected` indexes; `repository` false where the
@@ -377,7 +378,7 @@ async function askAdvisories(name: string, versions: string[], { githubToken, re
     const own: NpmAdvisory = {
       id: row.id, source: row.source, ...row.ghsa && { ghsa: row.ghsa }, ...row.url && { url: row.url }, ...row.title && { title: row.title },
       ...row.severity && { severity: row.severity }, ...row.cvss !== undefined && { cvss: row.cvss }, cwe: row.cwe, ...row.range && { range: row.range },
-      ...row.details && { details: row.details }, affected,
+      ...row.details && { details: row.details }, ...row.malware && { malware: true }, affected,
     }
     const known = merged.get(row.id)
     if (!known) {

package/server-managed/npm-kept.ts

@@ -227,3 +227,7 @@ export const reviewBaselineStore = (db: UpstreamCacheStore, debug = false): Kept
 // what their reviews are held to.
 export const lockfileReadStore = <T>(db: UpstreamCacheStore, type: 'listings' | 'lockfiles', debug = false): KeptStore<T> =>
   keptStore<T>(db, `repository/review-${type}`, HISTORY_PAGE_KEPT_MS, debug)
+// A bundle's validations (bundle-validation.ts), by the bundle, where it is,
+// what its reader could check and the rules they were made by: kept a month
+// after they were made, as what they check never changes.
+export const bundleValidationStore = <T>(db: UpstreamCacheStore, debug = false): KeptStore<T> => keptStore<T>(db, 'bundles/validations', HISTORY_PAGE_KEPT_MS, debug)

package/server-managed/package-entry-points.ts

@@ -1,5 +1,7 @@
 import { Buffer } from 'node:buffer'
+import { buildableEntry } from './bundle-build.ts'
 import { normalizeTeamPath } from './repo-path.ts'
+import { MAX_STASIS_CONFIG_BYTES, parseStasisConfig } from './stasis-config.ts'
 
 export const MAX_PACKAGE_BYTES = 256 * 1024
 const MAX_ENTRY_POINTS = 100
@@ -33,19 +35,45 @@ export function packageEntryPoints(manifest: unknown, directory: string): string
   return [...paths]
 }
 
+// The entries a stasis.config.json in `directory` lists, as repository paths:
+// the ones a server build takes, which it builds with their options there.
+export function configEntryPoints(text: string, directory: string): string[] {
+  const paths: string[] = []
+  for (const key of parseStasisConfig(text, directory) ?? []) {
+    const path = directory ? `${directory}/${key}` : key
+    if (buildableEntry(path) && paths.length < MAX_ENTRY_POINTS) paths.push(path)
+  }
+  return paths
+}
+
 // Use the immutable blob from the authorized listing, never download_url or a
-// resolved symlink target. Malformed or oversized manifests are optional.
+// resolved symlink target. A malformed or oversized blob is none (null).
+async function readBlobText(sha: string, read: (suffix: string) => Promise<unknown>, maxBytes: number): Promise<string | null> {
+  const blob = await read(`/git/blobs/${sha}`) as { encoding?: unknown; content?: unknown; size?: unknown }
+  if (blob?.encoding !== 'base64' || typeof blob.content !== 'string' || typeof blob.size !== 'number'
+    || blob.size < 0 || blob.size > maxBytes || blob.content.length > maxBytes * 2) return null
+  const bytes = Buffer.from(blob.content, 'base64')
+  return bytes.length !== blob.size || bytes.length > maxBytes ? null : bytes.toString('utf8')
+}
+
+// Manifests are optional: suggestions must not prevent browsing. The handler
+// still rechecks GitHub and managed access after these optional upstream reads.
 export async function readPackageEntryPoints(sha: string, directory: string, read: (suffix: string) => Promise<unknown>): Promise<string[]> {
   try {
-    const blob = await read(`/git/blobs/${sha}`) as { encoding?: unknown; content?: unknown; size?: unknown }
-    if (blob?.encoding !== 'base64' || typeof blob.content !== 'string' || typeof blob.size !== 'number'
-      || blob.size < 0 || blob.size > MAX_PACKAGE_BYTES || blob.content.length > MAX_PACKAGE_BYTES * 2) return []
-    const bytes = Buffer.from(blob.content, 'base64')
-    if (bytes.length !== blob.size || bytes.length > MAX_PACKAGE_BYTES) return []
-    return packageEntryPoints(JSON.parse(bytes.toString('utf8')), directory)
+    const text = await readBlobText(sha, read, MAX_PACKAGE_BYTES)
+    return text === null ? [] : packageEntryPoints(JSON.parse(text), directory)
+  } catch {
+    return []
+  }
+}
+
+// A stasis.config.json whose entries Stasis can't tell lists none here;
+// building them reports why (config-invalid), as it does options Stasis refuses.
+export async function readConfigEntryPoints(sha: string, directory: string, read: (suffix: string) => Promise<unknown>): Promise<string[]> {
+  try {
+    const text = await readBlobText(sha, read, MAX_STASIS_CONFIG_BYTES)
+    return text === null ? [] : configEntryPoints(text, directory)
   } catch {
-    // Suggestions must not prevent browsing. The handler still rechecks
-    // GitHub and managed access after this optional upstream read.
     return []
   }
 }

package/server-managed/pretty-print.ts

@@ -13,7 +13,7 @@ import { brotliDecompress } from 'node:zlib'
 import { format } from '@preventive/compare/pretty.js'
 import { computeFileHash } from '@preventive/report'
 import { FILE_HASH, computeBundleFileHashes } from '../common/bundle-metadata.js'
-import { bundleCompareFiles } from '../common/bundle-compare-inputs.js'
+import { bundleCompareFiles, bundleCompareSideScopes } from '../common/bundle-compare-inputs.js'
 import { bundlePackageDirs, bundleSourcesAsMap } from '../common/bundle-sources.js'
 import { MAX_PRETTY_BYTES, needsPrettyPrint, prettyExtension } from '../common/pretty-print.js'
 import type { OpenedBlob } from './blob-store.ts'
@@ -413,12 +413,14 @@ export function createPrettyCache(bundles: BundleCacheStorage, npm: CacheStorage
     // before this resolves: for the files that changed between them
     // pretty-printed (compared), and their diffs with renamed names hidden
     // (rename-diff.ts renamedPairs); a bundle's within a reason `scope`
-    // where one is asked for, as Compare reads it then.
-    bundleSides(base: ManagedBundle, other: ManagedBundle, scope = ''): Promise<[ComparedSide, ComparedSide]> {
-      const sideOf = async (record: ManagedBundle, side: Side): Promise<ComparedSide> => ({ side, ...await bundleSide(await bundleDetails(record), scope),
+    // where one is asked for, as Compare reads it then (bundleCompareSideScopes).
+    async bundleSides(base: ManagedBundle, other: ManagedBundle, scope = ''): Promise<[ComparedSide, ComparedSide]> {
+      const [baseDetails, otherDetails] = await Promise.all([bundleDetails(base), bundleDetails(other)])
+      const [baseScope, otherScope] = bundleCompareSideScopes(baseDetails, otherDetails, scope)
+      const sideOf = async (record: ManagedBundle, details: typeof baseDetails, side: Side, within: string): Promise<ComparedSide> => ({ side, ...await bundleSide(details, within),
         kept: request => kept(() => bundles.open(record.id, prettyFile(request))),
         made: async (request, text) => opened(await bundleCopy(record, request, () => Promise.resolve(text))) })
-      return Promise.all([sideOf(base, 'base'), sideOf(other, 'other')])
+      return Promise.all([sideOf(base, baseDetails, 'base', baseScope), sideOf(other, otherDetails, 'other', otherScope)])
     },
     // A bundle's details, read in its turn, as Compare pairs them (comparison.ts).
     bundleDetails,

package/server-managed/public-workspace.ts

@@ -12,7 +12,7 @@ import { triageWireEntry } from './triage-response.ts'
 import { MAX_PACKAGE_INVENTORY_BYTES } from './bundle-cache.ts'
 import { backfillBundleSummaries, bundleSummaries } from './bundle-catalog.ts'
 import { ADVISORIES_TIMEOUT_MS, fetchBundleAdvisories } from './bundle-advisories.ts'
-import { auditCache, auditedRepos } from './upstream-cache.ts'
+import { auditCache, auditedKeys } from './upstream-cache.ts'
 import { serveTeamFeed } from './team-feed.ts'
 import { type ComparedSide, PrettyError, compared, prettyRequest, prettyText } from './pretty-print.ts'
 import { renameDiffOf, renameDiffRequest, renamedPairs } from './rename-diff.ts'
@@ -207,7 +207,7 @@ async function serveBundle(res: ServerResponse, deps: ManagedHttpDeps, bundle: M
     const repoAdvisories = url.searchParams.get('repoAdvisories') === 'true'
     const result = await fetchBundleAdvisories(inventory.packages, signal, {
       debug: deps.config.debug, repoAdvisories, details: url.searchParams.get('details') === 'true',
-      cache: auditCache(deps.config.upstreamCacheDir, deps.db, signal, deps.config.debug, auditedRepos(inventory.packages, repoAdvisories)),
+      cache: auditCache(deps.config.upstreamCacheDir, deps.db, signal, deps.config.debug, auditedKeys(inventory.packages, repoAdvisories)),
     })
     await recheck()
     json(res, result.status, result.status === 200 ? { ...inventory, advisories: result.body } : result.body); return

package/server-managed/repository-actions.ts

@@ -111,7 +111,8 @@ const isCommit = (text: string) => /^[\da-f]{40}$/u.test(text)
 
 // `source`, what it answers of a public repository kept for every scan, the
 // same whoever asks: of a commit while kept (but none, as one can be pushed
-// later), the rest for RISK_KEPT_MS. A private one's, or one missing, never.
+// later), the rest, its advisories too, for RISK_KEPT_MS. A private one's,
+// or one missing, never.
 export function sharedSource(source: ActionsSource, answers: ActionAnswers): ActionsSource {
   const keyOf = (what: string, name: string, ...more: string[]) => [what, name.toLowerCase(), ...more].join('\0')
   const kept = (key: string, lasting = false) => {
@@ -140,6 +141,8 @@ export function sharedSource(source: ActionsSource, answers: ActionAnswers): Act
     branches: name => shared(name, keyOf('branches', name), false, () => source.branches(name)),
     contains: (name, base, sha) => shared(name, keyOf('contains', name, base, sha), isCommit(base), () => source.contains(name, base, sha)),
     file: (name, path, commit) => shared(name, keyOf('file', name, path, commit), isCommit(commit), () => source.file(name, path, commit)),
+    ...source.advisories && { advisories: (name: string, versions: string[], internal: boolean) =>
+      shared(name, keyOf('advisories', name, ...versions), false, () => source.advisories!(name, versions, internal)) },
   }
 }
 
@@ -153,8 +156,8 @@ export interface ActionsResolving {
 }
 
 // A reference's line: kept (`stored`, as read of the store with others),
-// else resolved, and kept where it is a public repository's; why not, where
-// it couldn't be.
+// else resolved, and kept where it is a public repository's and its
+// advisories could be had; why not, where it couldn't be.
 async function resolved(resolving: ActionsResolving, source: ActionsSource, { key, owner }: ActionRef,
   stored = resolving.store?.read(key)): Promise<ActionLine | null> {
   const kept = resolving.memory.get(key) ?? await stored?.then(row => row && { at: row.at, line: row.value })
@@ -164,7 +167,7 @@ async function resolved(resolving: ActionsResolving, source: ActionsSource, { ke
   let found: ResolvedAction
   try { found = await resolveAction(uses, source, { owner }) } catch (error) { return resolving.signal.aborted ? null : { type: 'action', key, ...failureOf(error) } }
   const line: ActionLine = { type: 'action', ...found }
-  if (found.repository?.private === false) {
+  if (found.repository?.private === false && !found.findings.some(({ id }) => id === 'advisories-unavailable')) {
     const at = Date.now()
     resolving.memory.set(key, { at, line })
     await resolving.store?.write(key, line, at)

package/server-managed/repository-browser.ts

@@ -2,7 +2,8 @@ import { createHash } from 'node:crypto'
 import type { ManagedConfig } from './config.ts'
 import type { SelectedRepo } from './db.ts'
 import { GithubApiError, type GithubIdentity, READ_PERMISSIONS, githubJson, githubRepoPermission, githubUserIdentity, onTokenRejected, repoAccessToken } from './github-app.ts'
-import { MAX_PACKAGE_BYTES, readPackageEntryPoints } from './package-entry-points.ts'
+import { MAX_PACKAGE_BYTES, readConfigEntryPoints, readPackageEntryPoints } from './package-entry-points.ts'
+import { MAX_STASIS_CONFIG_BYTES, STASIS_CONFIG } from './stasis-config.ts'
 import { readSolidityEntryPoints } from './solidity-entry-points.ts'
 import { parseGithubCommit } from './bundle-commits.ts'
 import { appDependabotAlerts } from './dependabot-access.ts'
@@ -279,9 +280,15 @@ async function repositoryReader(repo: SelectedRepo, userToken: string | null, in
         const type = item.submodule_git_url ? 'submodule' : item.type
         if (['dir', 'file', 'symlink', 'submodule'].includes(type)) entries.push({ name: item.name, path: expectedPath, type })
       }
-      const manifestPath = path ? `${path}/package.json` : 'package.json'
-      const manifest = data.find(item => item?.path === manifestPath && item.name === 'package.json' && item.type === 'file' && !item.submodule_git_url
-        && typeof item.size === 'number' && item.size >= 0 && item.size <= MAX_PACKAGE_BYTES && typeof item.sha === 'string' && /^[a-f\d]{40}$/iu.test(item.sha))
+      const listed = (name: string, maxBytes: number) => data.find(item => item?.path === (path ? `${path}/${name}` : name) && item.name === name
+        && item.type === 'file' && !item.submodule_git_url && typeof item.size === 'number' && item.size >= 0 && item.size <= maxBytes
+        && typeof item.sha === 'string' && /^[a-f\d]{40}$/iu.test(item.sha))
+      // The entries stasis.config.json lists are suggested before any guess:
+      // a build takes them alone, with their options there.
+      const config = listed(STASIS_CONFIG, MAX_STASIS_CONFIG_BYTES)
+      const configEntryPoints = config ? await readConfigEntryPoints(config.sha, path, read) : []
+      if (configEntryPoints.length > 0) return { entries, limited: data.length >= 1000, configEntryPoints }
+      const manifest = listed('package.json', MAX_PACKAGE_BYTES)
       // Both optional suggestions, read together: neither fails, each
       // answering none where its reads do.
       const [packageEntryPoints, solidity] = await Promise.all([manifest ? readPackageEntryPoints(manifest.sha, path, read) : undefined,

package/server-managed/repository-history.ts

@@ -242,8 +242,8 @@ async function repositoryHeads(owner: string, name: string, token: string, fetch
 // Histories read in a GraphQL query, and queries at once: each counts its
 // commits' lines, which GitHub works out as it answers, stopping a query
 // past ten seconds.
-const PAGES_PER_QUERY = 5
-const PAGES_PARALLEL = 5
+export const PAGES_PER_QUERY = 5
+export const PAGES_PARALLEL = 5
 
 // The first page of the history from each of `tops`, by its top, each told
 // to `keep` as it is read, so those read stay kept where another fails: with

package/server-managed/repository-pulse.ts

@@ -16,6 +16,7 @@ import { agentOperated, githubAgent } from '../common/managed/github-agents.ts'
 import { GithubApiError, githubJson } from './github-app.ts'
 import { shareGithubRead } from './github-requests.ts'
 import { coauthorsOf } from './commit-coauthors.ts'
+import { windowsOn } from './history-windows.ts'
 import { ACTOR, type GraphAccount, type HistoryCommit, type HistoryPages, accountOf, actorOf, githubGraphql, historyFrom } from './repository-history.ts'
 
 export const PULSE_WEEKS = [1, 4, 13, 52]
@@ -222,6 +223,7 @@ export async function yearCommits(fullName: string, token: string, head: string,
   const read = () => [...found.values()].filter(dated).length
   const passed = () => [...found.values()].filter(commit => !dated(commit) && within(commit))
   let queries = 0
+  let windowed = false
   let starts = [head]
   while (starts.length > 0) {
     // Those not read yet, the head before any, else the parents of those
@@ -232,9 +234,16 @@ export async function yearCommits(fullName: string, token: string, head: string,
       .filter(commit => commit.parents.some(sha => unread.has(sha))).map(commit => commit.committedAt ?? Number.POSITIVE_INFINITY))
     if (need > since && from < need) return { complete: true, commits: [...found.values()].filter(dated), passed: passed(), from }
     if (queries >= YEAR_QUERIES) return { complete: false, read: read(), tooMany: false }
-    const batch = starts.slice(0, YEAR_STARTS)
+    // The pages kept read first; once past them, the rest read at once by
+    // when its commits were made (history-windows.ts windowsOn), as far back
+    // as it needs, the year's as far as its commits are followed.
+    const next: Awaited<ReturnType<typeof windowsOn>> | null = windowed || found.size === 0 ? null
+      : await windowsOn(fullName, token, head, starts, found, need > since ? need : since - YEAR_SKEW_MS, from, pages, fetchImpl, queries)
+    windowed ||= next?.windowed === true
+    queries += next?.queries ?? 0
+    const batch = (next?.batch ?? starts).slice(0, YEAR_STARTS)
     for (const sha of batch) tried.add(sha)
-    const got = await historyFrom(fullName, token, batch, pages, fetchImpl)
+    const got = batch.length > 0 ? await historyFrom(fullName, token, batch, pages, fetchImpl) : { commits: [], read: 0 }
     if (got.read > 0) queries++
     for (const commit of got.commits) if (!found.has(commit.sha)) found.set(commit.sha, commit)
     told(read())

package/server-managed/repository-risk-audit.ts

@@ -1,19 +1,18 @@
 // A lockfile's advisories, as a repository risk scan asks them
 // (repository-risk.ts): npm's registry's of its packages of the registry or
 // a mirror, asked at once, as `npm audit` asks, each told with whether it is
-// of malware (risk's npmMalwareAdvisory); kept by the lockfile's blob, in the
-// instance's memory and the source's `audits`, for RISK_KEPT_MS, as npm
+// of malware, as upstream tells (`malware`); kept by the lockfile's blob, in
+// the instance's memory and the source's `audits`, for RISK_KEPT_MS, as npm
 // publishes advisories, or why they couldn't be had for AUDIT_FAILED_KEPT_MS.
 import type { Advisory } from '@preventive/upstream/advisories.js'
 import { isExactVersion } from '@preventive/upstream/semver.js'
-import { npmMalwareAdvisory } from '../risk/index.js'
 import { isNpmPackageName } from '../common/managed/npm-packages.js'
 import type { LockedPackage } from './locked-packages.ts'
 import type { Lru } from './lru.ts'
 import type { KeptStore } from './npm-kept.ts'
 import { RISK_KEPT_MS, type RiskFailure, failureOf } from './repository-risk-assess.ts'
 
-export type AdvisoryRow = Advisory & { malware: boolean }
+export type AdvisoryRow = Omit<Advisory, 'malware'> & { malware: boolean }
 // A lockfile's advisories, or why they couldn't be had.
 export type Audit = AdvisoryRow[] | RiskFailure
 
@@ -67,7 +66,7 @@ export async function auditLockfile(source: AuditSource, memory: Lru<{ at: numbe
   let audit: Audit
   try {
     audit = (await source.advisories([...asked].map(([name, versions]) => ({ name, versions: [...versions] })), signal))
-      .map(advisory => ({ ...advisory, malware: npmMalwareAdvisory(advisory) }))
+      .map(advisory => ({ ...advisory, malware: advisory.malware === true }))
   } catch (error) {
     if (signal.aborted) return null
     audit = failureOf(error)

package/server-managed/repository-risk.ts

@@ -18,8 +18,8 @@
 // that locks them (LockedPackage `dev`) once all the rest are, as an install
 // of no devDependencies leaves them out. A lockfile's packages of npm's
 // registry or a mirror are asked of npm's advisories all at once, as `npm
-// audit` asks, each advisory told with whether it is of malware (risk's
-// npmMalwareAdvisory), which alone is a supply chain's risk; the rest are
+// audit` asks, each advisory told with whether it is of malware (upstream's
+// `malware`), which alone is a supply chain's risk; the rest are
 // vulnerabilities, told beside. A repository's Dependabot alerts of npm's, open or dismissed,
 // are told once its lockfiles' advisories are, each with the versions its
 // lockfile locks that it covers, for the page to blend them into npm's; one
@@ -94,8 +94,8 @@ export interface RepositoryRiskSource<R extends RepositoryRiskRepo> extends Audi
 
 // A Dependabot alert as a scan tells it: with the versions of its package
 // the lockfile it is of locks that it covers, none where it is of none read
-// (a package.json, bun's lockfile), and whether it is of malware, as an
-// advisory's is told.
+// (a package.json, bun's lockfile), and whether it is of malware, by the rule
+// upstream tells an advisory's by (risk's npmMalwareAdvisory).
 export type DependabotAlertRow = DependabotAlert & { versions: string[]; malware: boolean }
 
 // A risk line is of npm's package of its name and version, or, with an

package/server-managed/sql.ts

@@ -26,12 +26,13 @@ const SINGLE_STATEMENTS = new Set(['getReport', 'getBundle', 'getStorageRow', 'g
   'listTriageFixes', 'getRepoDependencyReviews', 'listTeamDependencyReviews', 'getNpmReviewReader',
   'listDependencyReviewTeams', 'listDependencyReviewEnabledTeams', 'listUserNpmScopes', 'listTeamNpmScopes', 'hasTeamNpmScope',
   'listGithubMetadata', 'listGithubRepositoryVisibility', 'setGithubMetadata', 'recordGithubMetadataAttempts', 'setGithubRepositoryVisibility',
-  'listLinkReports', 'listLegacyLinkReports', 'listReportFilenamesWithBundleHash', 'listReportsForRepo', 'listBundlesForRepo',
+  'listLinkReports', 'listLegacyLinkReports', 'listReportFilenamesWithBundleHash', 'listReportsForBundle', 'listReportsForRepo', 'listBundlesForRepo',
   'listFindingCatalogReports', 'userCanReadBundleAdvisories',
   'sessionWithUser', 'getTeamReportAccessSnapshot', 'getReportAccessSnapshot', 'getBundleAccessSnapshot', 'getReportView', 'getUserGithubId', 'getUserTeamFeedSnapshot', 'getAnnotations', 'getAnnotationRevision', 'getUserTokens',
   'listReports', 'listBundles', 'listReadableBundleIds', 'listAllRepos', 'listSelectedRepos', 'listRepoScopesForUser', 'listTriage',
   'getFeedState', 'getWorkspaceShareFeedState', 'claimMaintenanceLease', 'finishMaintenanceLease', 'cacheRepoDefaultBranch', 'releaseBundleBuildLease',
   'getUpstreamCacheEntry', 'getUpstreamCacheEntries', 'getFirstUpstreamCacheEntries', 'setUpstreamCacheEntry', 'setUpstreamCacheEntries', 'ensureSessionUploadKey',
+  'getTeamAppSummaries', 'setTeamAppSummary', 'deleteTeamAppSummaries',
   'listGithubCommits', 'listGithubCommitTags', 'setGithubCommits', 'getAvatarKey', 'listUsersByAccount'])
 // Session presence and upload keys change only their own rows.
 const UNLOCKED_WRITES = new Set(['sessionWithUser', 'viewSessionWithUser', 'ensureSessionUploadKey'])

package/server-managed/stasis-config.ts

@@ -0,0 +1,46 @@
+// stasis.config.json's `entries`, as Stasis reads them (src/cmd/bundle-options.js's
+// readConfigEntries, which is not a public package export): the entries it
+// names, each a path relative to the file's directory. Their options are
+// Stasis's: buildGitHubBundle builds the entries the stasis.config.json in its
+// directory names with their options there, and refuses what it can't build.
+export const STASIS_CONFIG = 'stasis.config.json'
+export const MAX_STASIS_CONFIG_BYTES = 256 * 1024
+
+const plainObject = (value: unknown): value is Record<string, unknown> =>
+  value !== null && typeof value === 'object' && !Array.isArray(value)
+
+// `entry` as a path from `directory` ('.' for it), as `stasis bundle` run
+// there resolves it; null where that is outside it.
+export function configEntryKey(directory: string, entry: string): string | null {
+  if (entry.startsWith('/')) return null
+  const base = directory ? directory.split('/') : []
+  const parts = [...base]
+  for (const part of entry.split('/')) {
+    if (part === '' || part === '.') continue
+    if (part !== '..') parts.push(part)
+    else if (parts.pop() === undefined) return null
+  }
+  if (base.some((part, i) => parts[i] !== part)) return null
+  return parts.slice(base.length).join('/') || '.'
+}
+
+// The entries the stasis.config.json in `directory` whose text is `text`
+// names, each as a path from there; null where it has no `entries`. One whose
+// entries Stasis can't tell throws.
+export function parseStasisConfig(text: string, directory = ''): Set<string> | null {
+  const file = directory ? `${directory}/${STASIS_CONFIG}` : STASIS_CONFIG
+  let config: unknown
+  try { config = JSON.parse(text) } catch (cause) { throw new Error(`${file} is not valid JSON`, { cause }) }
+  const entries = plainObject(config) ? config['entries'] : undefined
+  if (entries === undefined) return null
+  if (!plainObject(entries)) throw new Error(`${file}: entries must be an object of each entry's stasis bundle options`)
+  const named = new Map<string, string>()
+  for (const entry of Object.keys(entries)) {
+    const what = `${file}: entries ${JSON.stringify(entry)}`
+    const key = configEntryKey(directory, entry)
+    if (key === null) throw new Error(`${what}: an entry must be a path relative to the directory of ${STASIS_CONFIG}, within it`)
+    if (named.has(key)) throw new Error(`${what} names the same entry as ${JSON.stringify(named.get(key))}`)
+    named.set(key, entry)
+  }
+  return new Set(named.keys())
+}

package/server-managed/team-app-summaries.ts

@@ -0,0 +1,54 @@
+import { createHash } from 'node:crypto'
+import type { ManagedSql } from './sql.ts'
+
+// Each team's catalog summary (team-app.ts), kept for every instance: working
+// one out builds the team's whole workspace, which an instance would otherwise
+// do for the first catalog it serves. Keyed by the catalog's own content key
+// (team-app.ts teamAppKey), hashed: the published reports, their content and
+// what the reader is allowed of each (its role, its dependency and security
+// permissions, the team's scopes and links), so readers whose workspaces
+// differ never share one. A change to any of them is a new key, as is a new
+// deployment; one no longer asked for goes once it is old (index.ts reap).
+export const TEAM_APP_SUMMARY_SCHEMA = `
+CREATE TABLE IF NOT EXISTS managed_team_app_summary (
+  summary_key TEXT PRIMARY KEY,
+  summary     TEXT NOT NULL,
+  stored_at   INTEGER NOT NULL
+) STRICT;
+`
+
+export interface TeamAppSummaryStore {
+  // Hashed key (teamAppSummaryKey) → summary for those of `keys` kept.
+  getTeamAppSummaries(keys: string[]): Promise<Map<string, string>>
+  setTeamAppSummary(key: string, summary: string, storedAt: number): Promise<void>
+  // Removes those stored before `before`; how many.
+  deleteTeamAppSummaries(before: number): Promise<number>
+}
+
+// How a summary is worked out (common/workspace-app.js, team-app.js), which a
+// deployment may change: one stored by another deployment, or before this
+// is raised, is worked out again.
+const SUMMARY_VERSION = 1
+const DEPLOYMENT = process.env['VERCEL_DEPLOYMENT_ID'] ?? null
+
+export const teamAppSummaryKey = (key: string): string => createHash('sha256').update(JSON.stringify([SUMMARY_VERSION, DEPLOYMENT, key])).digest('base64url')
+
+export function teamAppSummaryMethods(db: ManagedSql): TeamAppSummaryStore {
+  const getMany = db.prepare('SELECT summary_key, summary FROM managed_team_app_summary WHERE summary_key IN (SELECT value FROM json_each(?))')
+  const set = db.prepare(`INSERT INTO managed_team_app_summary (summary_key, summary, stored_at) VALUES (?, ?, ?)
+    ON CONFLICT (summary_key) DO UPDATE SET summary = excluded.summary, stored_at = excluded.stored_at`)
+  const remove = db.prepare('DELETE FROM managed_team_app_summary WHERE stored_at < ?')
+  return {
+    async getTeamAppSummaries(keys) {
+      if (keys.length === 0) return new Map()
+      const rows = await getMany.all(JSON.stringify(keys)) as { summary_key: string; summary: string }[]
+      return new Map(rows.map(row => [row.summary_key, row.summary]))
+    },
+    async setTeamAppSummary(key, summary, storedAt) {
+      await set.run(key, summary, storedAt)
+    },
+    async deleteTeamAppSummaries(before) {
+      return Number((await remove.run(before)).changes)
+    },
+  }
+}