@wardby/cli 0.6.0 → 0.7.0

package/dist/providers/coding-proxy/proxy.js

@@ -2,7 +2,9 @@ import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { shippedCatalog } from "../llm/catalog.js";
 import { SHIPPED_CATALOG_VERSION } from "../llm/catalog-shipped.js";
 import { deriveRegistryToken } from "../../coding/registry/token.js";
-import { AnthropicSseUsageTracker, actualCostUsd, estimateReservationUsd, fingerprintRequest, parseAnthropicAuthoritativeUsage, parseAuthoritativeUsage, pricingSnapshot, safeUpstreamErrorCode, terminalUsageFromSseFrame, } from "./metering.js";
+import { AnthropicSseUsageTracker, actualCostUsd, fingerprintRequest, parseAnthropicAuthoritativeUsage, parseAuthoritativeUsage, pricingSnapshot, safeUpstreamErrorCode, terminalUsageFromSseFrame, } from "./metering.js";
+import { conversationKey, estimateHold } from "./hold.js";
+import { estimateInterrupted, previousInput } from "./interrupted.js";
 import { createPinnedProxyFetch } from "./secure-fetch.js";
 export const PROXY_MAX_BODY_BYTES = 8 * 1024 * 1024;
 export const PROXY_MAX_OUTPUT_TOKENS = 1_000_000;
@@ -818,8 +820,10 @@ export class CodingProxy {
     getPricing;
     priceVersion;
     activeRequests = new Map();
+    onModelRequest;
     constructor(options) {
         this.ledger = options.ledger;
+        this.onModelRequest = options.onModelRequest;
         this.credentials = options.credentials;
         this.upstreamUrls = {
             "openai-responses": options.upstreamUrl ?? "https://api.openai.com/v1/responses",
@@ -905,12 +909,19 @@ export class CodingProxy {
     budgetExhausted(sessionId) {
         return this.ledger.budgetExhausted(sessionId);
     }
+    /** The numbers behind this session's first budget refusal, if any. */
+    budgetRefusal(sessionId) {
+        return this.ledger.budgetRefusal(sessionId);
+    }
     /** The code of the first upstream failure relayed for this session's run, if any. */
     upstreamFailure(sessionId) {
         return this.ledger.upstreamFailure(sessionId);
     }
     async execute(input, sink) {
         const session = await this.authenticate(input.bearer);
+        // The run's agent exists from its first model request on (both protocols arrive here).
+        if (this.onModelRequest)
+            await this.onModelRequest(session.runId).catch(() => undefined);
         if (session.protocol !== input.protocol) {
             this.audit({ type: "request.rejected", runId: session.runId, reason: "protocol_mismatch" });
             throw new CodingProxyError(403, "protocol_mismatch");
@@ -948,7 +959,32 @@ export class CodingProxy {
         }
         const requestKey = safeRequestKey(input.requestKey, parsed.fingerprint);
         const snapshot = pricingSnapshot(terms.version, terms.pricing);
-        const reservationUsd = estimateReservationUsd(Buffer.byteLength(parsed.encoded), parsed.maxOutputTokens, snapshot);
+        const bodyBytes = Buffer.byteLength(parsed.encoded);
+        const conversation = conversationKey(session.protocol, parsed.body);
+        // A failed lookup holds the ceiling: never a reason to fail the request.
+        const previous = conversation ? await this.ledger.previousReply(session.id, conversation).catch(() => null) : null;
+        const holdNow = this.now();
+        const hold = estimateHold({
+            protocol: session.protocol,
+            model: parsed.model,
+            bodyBytes,
+            maxOutputTokens: parsed.maxOutputTokens,
+            pricing: snapshot,
+            previous,
+            now: holdNow,
+        });
+        // An interrupted reply's input, from the same previous reply and clock as the hold.
+        const previousPrompt = previousInput({ model: parsed.model, bodyBytes, previous, pricing: snapshot, now: holdNow });
+        const reservationUsd = hold.holdUsd;
+        const holdAudit = {
+            reservationUsd,
+            ceilingUsd: hold.ceilingUsd,
+            reservationBasis: hold.basis,
+            ...(hold.fallback ? { holdFallback: hold.fallback } : {}),
+            ...(hold.cachedTokens !== undefined
+                ? { holdCachedTokens: hold.cachedTokens, holdUncachedTokens: hold.uncachedTokens }
+                : {}),
+        };
         const reservation = await this.ledger.reserve({
             id: randomUUID(),
             sessionId: session.id,
@@ -956,6 +992,10 @@ export class CodingProxy {
             requestFingerprint: parsed.fingerprint,
             model: parsed.model,
             reservationUsd,
+            requestBytes: bodyBytes,
+            ceilingUsd: hold.ceilingUsd,
+            reservationBasis: hold.basis,
+            conversationKey: conversation,
             pricing: snapshot,
             now: this.now(),
         });
@@ -969,7 +1009,12 @@ export class CodingProxy {
                 runId: session.runId,
                 model: parsed.model,
                 reason: "budget_exhausted",
-                reservationUsd,
+                ...holdAudit,
+                budgetUsd: reservation.details.budgetUsd,
+                spentUsd: reservation.details.spentUsd,
+                heldReservedUsd: reservation.details.heldReservedUsd,
+                heldUncertainUsd: reservation.details.heldUncertainUsd,
+                turn: reservation.details.turn,
             });
             throw new CodingProxyError(429, "wardby_budget_exhausted");
         }
@@ -982,7 +1027,7 @@ export class CodingProxy {
             runId: session.runId,
             requestId: request.id,
             model: request.model,
-            reservationUsd,
+            ...holdAudit,
         });
         let key;
         try {
@@ -1010,6 +1055,13 @@ export class CodingProxy {
         const deadlineTimer = setTimeout(() => controller.abort(), remainingMs);
         deadlineTimer.unref();
         this.trackActive(session.id, controller);
+        const progress = {
+            maxOutputTokens: parsed.maxOutputTokens,
+            stream: parsed.stream,
+            bodyBytes,
+            ...(previousPrompt ? { previousInput: previousPrompt } : {}),
+            relayedOutputBytes: 0,
+        };
         const cleanupActive = () => {
             clearTimeout(deadlineTimer);
             const active = this.activeRequests.get(session.id);
@@ -1042,10 +1094,11 @@ export class CodingProxy {
                 redirect: "error",
                 signal: controller.signal,
             });
+            progress.responseStarted = true;
         }
         catch {
             cleanupActive();
-            await this.markUncertain(session, request, undefined, controller.signal.aborted ? "upstream_aborted" : "upstream_transport");
+            await this.markUncertain(session, request, undefined, controller.signal.aborted ? "upstream_aborted" : "upstream_transport", {}, progress);
             throw new CodingProxyError(502, controller.signal.aborted ? "upstream_aborted" : "upstream_transport_error");
         }
         if (!upstream.ok) {
@@ -1068,12 +1121,12 @@ export class CodingProxy {
         }
         try {
             if (parsed.stream)
-                await this.forwardStream(session, request, upstream, sink);
+                await this.forwardStream(session, request, upstream, sink, progress);
             else
                 await this.forwardJson(session, request, upstream, sink);
         }
         catch (error) {
-            await this.markUncertain(session, request, upstream.status, failureReason(error), responseHeadersOf(upstream));
+            await this.markUncertain(session, request, upstream.status, failureReason(error), responseHeadersOf(upstream), progress);
             sink.destroy();
             throw error instanceof CodingProxyError ? error : new CodingProxyError(502, "invalid_upstream_response");
         }
@@ -1117,6 +1170,7 @@ export class CodingProxy {
     async complete(session, request, usage, upstreamStatus) {
         const costUsd = actualCostUsd(usage, request.pricing);
         await this.ledger.complete(request.id, usage, costUsd, upstreamStatus);
+        const overshootUsd = costUsd - request.reservationUsd;
         this.audit({
             type: "response.completed",
             runId: session.runId,
@@ -1124,13 +1178,17 @@ export class CodingProxy {
             model: request.model,
             status: upstreamStatus,
             costUsd,
+            reservationUsd: request.reservationUsd,
+            ...(overshootUsd > Number.EPSILON ? { reason: "reservation_exceeded", overshootUsd } : {}),
             inputTokens: usage.inputTokens,
             outputTokens: usage.outputTokens,
             cachedInputTokens: usage.cachedInputTokens,
             cacheWriteTokens: usage.cacheWriteTokens,
             reasoningTokens: usage.reasoningTokens,
         });
-        if (costUsd > request.reservationUsd + Number.EPSILON) {
+        // A cached hold may be exceeded when the cache misses (settled, audited above); the ceiling may not.
+        const ceilingUsd = request.ceilingUsd ?? request.reservationUsd;
+        if (costUsd > ceilingUsd + Number.EPSILON) {
             await this.ledger.cancelSession(session.id);
             throw new CodingProxyError(502, "reservation_invariant_violated");
         }
@@ -1156,7 +1214,7 @@ export class CodingProxy {
         await safeWrite(sink, bytes, { value: true });
         sink.end();
     }
-    async forwardStream(session, request, upstream, sink) {
+    async forwardStream(session, request, upstream, sink, progress) {
         if (!upstream.body)
             throw new Error("missing_upstream_body");
         sink.start(upstream.status, { "content-type": "text/event-stream", "cache-control": "no-store" });
@@ -1166,7 +1224,7 @@ export class CodingProxy {
         let receivedBytes = 0;
         let completed = false;
         let failedWithoutUsage = false;
-        const anthropicUsage = session.protocol === "anthropic-messages" ? new AnthropicSseUsageTracker() : undefined;
+        const anthropicUsage = session.protocol === "anthropic-messages" ? (progress.anthropic = new AnthropicSseUsageTracker()) : undefined;
         const body = upstream.body;
         for await (const chunk of body) {
             receivedBytes += chunk.byteLength;
@@ -1181,6 +1239,7 @@ export class CodingProxy {
                 buffer = buffer.slice(boundary + 2);
                 const terminal = anthropicUsage ? anthropicUsage.consume(frame) : terminalUsageFromSseFrame(frame);
                 if (!terminal.terminal) {
+                    progress.relayedOutputBytes += relayedTextBytes(frame, session.protocol);
                     await safeWrite(sink, Buffer.from(`${frame}\n\n`), connected);
                     continue;
                 }
@@ -1191,7 +1250,7 @@ export class CodingProxy {
                     // client sees the real error instead of a cut connection; the reservation stays held.
                     await this.recordUpstreamFailure(session, terminal.failure);
                     if (!completed) {
-                        await this.markUncertain(session, request, upstream.status, `upstream_failed:${terminal.failure}`, responseHeadersOf(upstream));
+                        await this.markUncertain(session, request, upstream.status, `upstream_failed:${terminal.failure}`, responseHeadersOf(upstream), progress);
                     }
                     failedWithoutUsage = true;
                     await safeWrite(sink, Buffer.from(`${frame}\n\n`), connected);
@@ -1214,9 +1273,102 @@ export class CodingProxy {
     async recordUpstreamFailure(session, code) {
         await this.ledger.recordUpstreamFailure(session.id, code).catch(() => undefined);
     }
-    async markUncertain(session, request, status, reason, headers = {}) {
-        await this.ledger.markUncertain(request.id, status);
-        this.audit({ type: "request.uncertain", runId: session.runId, requestId: request.id, status, reason, ...headers });
+    async markUncertain(session, request, status, reason, headers, progress) {
+        if (progress.marked)
+            return;
+        progress.marked = true;
+        let estimate = await this.estimateInterrupted(session, request, progress);
+        if (estimate) {
+            try {
+                await this.ledger.markUncertain(request.id, status, estimate);
+            }
+            catch {
+                // Settling at the estimate failed: mark it uncertain without one, so it keeps its full hold.
+                estimate = undefined;
+            }
+        }
+        if (!estimate)
+            await this.ledger.markUncertain(request.id, status);
+        this.audit({
+            type: "request.uncertain",
+            runId: session.runId,
+            requestId: request.id,
+            status,
+            reason,
+            ...(estimate ? { estimatedCostUsd: estimate.costUsd } : {}),
+            ...headers,
+        });
+    }
+    /**
+     * The best known cost of a request that broke before its final usage (interrupted.ts), or
+     * undefined when none can be made: the request then keeps its full hold. Never throws.
+     */
+    async estimateInterrupted(session, request, progress) {
+        try {
+            const hints = await this.ledger.settlementHints(session.id, request.model);
+            const estimate = estimateInterrupted({
+                ...progress.anthropic?.partial(),
+                beforeResponse: progress.stream && !progress.responseStarted,
+                relayedOutputBytes: progress.relayedOutputBytes,
+                ...hints,
+                ...(progress.previousInput ? { previous: progress.previousInput } : {}),
+                bodyBytes: progress.bodyBytes,
+                reservationUsd: request.reservationUsd,
+                maxOutputTokens: progress.maxOutputTokens,
+                ceilingUsd: request.ceilingUsd ?? request.reservationUsd,
+            }, request.pricing);
+            return Number.isFinite(estimate.costUsd) ? estimate : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+}
+/** OpenAI Responses events whose string `delta` is generated output: text, tool input, reasoning. */
+const OPENAI_OUTPUT_DELTAS = new Set([
+    "response.output_text.delta",
+    "response.refusal.delta",
+    "response.function_call_arguments.delta",
+    "response.custom_tool_call_input.delta",
+    "response.reasoning_text.delta",
+    "response.reasoning_summary_text.delta",
+]);
+/** The generated-output field of each Anthropic content_block_delta type (signatures are not output). */
+const ANTHROPIC_OUTPUT_DELTAS = {
+    text_delta: "text",
+    input_json_delta: "partial_json",
+    thinking_delta: "thinking",
+};
+/**
+ * UTF-8 bytes of generated output in a relayed SSE frame: text, tool-call input and thinking or
+ * reasoning deltas, which are most of a coding agent's output.
+ */
+function relayedTextBytes(frame, protocol) {
+    if (!frame.includes(protocol === "anthropic-messages" ? "content_block_delta" : ".delta"))
+        return 0;
+    try {
+        const data = frame
+            .split("\n")
+            .filter((line) => line.startsWith("data:"))
+            .map((line) => line.slice(5).trimStart())
+            .join("\n");
+        const value = JSON.parse(data);
+        if (!value || typeof value.type !== "string")
+            return 0;
+        if (protocol === "openai-responses") {
+            return OPENAI_OUTPUT_DELTAS.has(value.type) && typeof value.delta === "string"
+                ? Buffer.byteLength(value.delta)
+                : 0;
+        }
+        if (value.type !== "content_block_delta")
+            return 0;
+        const delta = value.delta;
+        const field = typeof delta?.type === "string" ? ANTHROPIC_OUTPUT_DELTAS[delta.type] : undefined;
+        const text = field ? delta?.[field] : undefined;
+        return typeof text === "string" ? Buffer.byteLength(text) : 0;
+    }
+    catch {
+        return 0;
     }
 }
 /** The safe error code in a rejected upstream's JSON body, or undefined when it names none or cannot be read. */

package/dist/providers/coding-proxy/registry/audit.d.ts

@@ -16,6 +16,7 @@
  * - a version or event the comparator cannot parse counts as affected
  *   (fail closed).
  */
+import { type AuditAdvisory } from "../../../coding/registry/audit-mode.js";
 import { type RegistryAdapter, type UpstreamFetch } from "../../../coding/registry/types.js";
 export declare const DEFAULT_VULN_CACHE_ENTRIES = 10000;
 /** Exact versions whose querybatch results are cached. */
@@ -39,6 +40,7 @@ interface OsvAffected {
 }
 interface OsvVuln {
     id: string;
+    summary?: unknown;
     aliases?: string[];
     affected?: (OsvAffected & {
         database_specific?: Record<string, unknown>;
@@ -58,11 +60,50 @@ export declare function isMalware(vuln: OsvVuln): boolean;
  *  names compare, and how versions order. */
 export type AuditAdapter = Pick<RegistryAdapter, "osvEcosystem" | "normalizeName" | "compareVersions">;
 export interface AdvisoryIndex {
-    /** Advisory ids with HIGH or CRITICAL severity that affect `version`. */
-    withheld(version: string): readonly string[];
+    /** Ids of the blocking advisories (HIGH, CRITICAL or malware) that affect
+     *  `version`, minus those waived by `accepted` (see `isWaived`). Without
+     *  `accepted`, or with an empty set, every blocking advisory. With
+     *  `auditAll` (package audit mode `full`), only those that can never be
+     *  served past: malware. */
+    withheld(version: string, accepted?: ReadonlySet<string>, auditAll?: boolean): readonly string[];
+    /** Ids of the blocking advisories affecting `version` that `accepted`
+     *  waives: exactly those `withheld` subtracts. For reporting. */
+    waived(version: string, accepted: ReadonlySet<string>): readonly string[];
     /** Advisory ids of any other severity that affect `version`. */
     reported(version: string): readonly string[];
+    /** Blocking, non-malware, non-accepted advisories that `auditAll` lets
+     *  through, with detail: what a full-mode run records when it serves `version`. */
+    audited?(version: string, accepted: ReadonlySet<string>): readonly AuditAdvisory[];
 }
+/** A blocking advisory, with what deciding a waiver needs. */
+export interface WithheldAdvisory {
+    id: string;
+    /** Reports malicious code (`isMalware`): never waived. */
+    malware: boolean;
+    /** The advisory's OSV aliases (CVE ids, other GHSA ids, …). */
+    aliases: readonly string[];
+    /** OSV severity, upper-cased (HIGH, CRITICAL, …); absent when OSV gives none (malware). */
+    severity?: string;
+    /** OSV summary as plain bounded text; absent when OSV gives none. */
+    summary?: string;
+}
+/** Whether `accepted` waives a blocking advisory: it is not malware, and
+ *  its id or one of its aliases is accepted. Malware is never waived,
+ *  whatever the accepted set lists. */
+export declare function isWaived(advisory: WithheldAdvisory, accepted?: ReadonlySet<string>): boolean;
+/** Splits the blocking advisories affecting one version into those still
+ *  withholding it, those `accepted` waives, and (package audit mode `full`,
+ *  `auditAll`) those served past and recorded. Malware is always withheld.
+ *  The version is withheld while `withheld` is non-empty. */
+export declare function splitWaived<T extends WithheldAdvisory>(advisories: readonly T[], accepted?: ReadonlySet<string>, options?: {
+    auditAll?: boolean;
+}): {
+    withheld: T[];
+    waived: T[];
+    audited: T[];
+};
+/** A blocking advisory as package audit mode records it. */
+export declare function auditAdvisoryOf(advisory: WithheldAdvisory): AuditAdvisory;
 type Compare = (a: string, b: string) => number;
 /** OSV range evaluation: sort events by version, then sweep. A version or
  *  event the comparator cannot parse makes the version count as affected. */
@@ -73,9 +114,10 @@ export interface AuditedVersion {
     name: string;
     version: string;
 }
-/** `name@version` -> the HIGH/CRITICAL advisory ids affecting it; a
- *  version with none is absent. */
-export type WithheldVersions = Map<string, string[]>;
+/** `name@version` -> the blocking (HIGH/CRITICAL or malware) advisories
+ *  affecting it; a version with none is absent. Independent of any
+ *  accepted set: callers subtract waivers with `splitWaived`. */
+export type WithheldVersions = Map<string, WithheldAdvisory[]>;
 export declare const versionKey: (name: string, version: string) => string;
 export declare class OsvAudit {
     private readonly options;
@@ -85,8 +127,8 @@ export declare class OsvAudit {
     private readonly cache;
     /** Single-flight: concurrent audits of one package share one OSV query. */
     private readonly loads;
-    /** Advisory severities by id, with the OSV `modified` time they were
-     *  read at, least recently used first. */
+    /** Advisory severities (and malware flag and aliases) by id, with the
+     *  OSV `modified` time they were read at, least recently used first. */
     private readonly vulns;
     /** Advisory ids (and their `modified` time) per exact version from
      *  querybatch, for the audit TTL, least recently used first, so repeated
@@ -121,9 +163,10 @@ export declare class OsvAudit {
     auditVersions(adapter: AuditAdapter, versions: readonly AuditedVersion[], signal?: AbortSignal): Promise<WithheldVersions>;
     private loadVersions;
     private rememberBatch;
-    /** Whether an advisory is HIGH or CRITICAL, cached by id while OSV's
-     *  `modified` time for it is unchanged. */
-    private blocking;
+    /** Whether an advisory blocks (HIGH, CRITICAL or malware), whether it is
+     *  malware, and its aliases, cached by id while OSV's `modified` time for
+     *  it is unchanged. */
+    private detail;
     private remember;
     private load;
     private query;

package/dist/providers/coding-proxy/registry/audit.js

@@ -16,6 +16,7 @@
  * - a version or event the comparator cannot parse counts as affected
  *   (fail closed).
  */
+import { sanitizeAuditSummary } from "../../../coding/registry/audit-mode.js";
 import { RegistryError } from "../../../coding/registry/types.js";
 import { boundedMetadataFetch, DEFAULT_MAX_METADATA_BYTES, DEFAULT_METADATA_TIMEOUT_MS } from "./bounded-fetch.js";
 const OSV_QUERY = "https://api.osv.dev/v1/query";
@@ -52,10 +53,59 @@ export function isMalware(vuln) {
             (typeof detail.source === "string" && detail.source.includes("/malicious-packages/")));
     });
 }
+/** An advisory's OSV severity (database_specific.severity), upper-cased; "" when it has none. */
+function severityOf(vuln) {
+    const severity = vuln.database_specific?.severity;
+    return typeof severity === "string" ? severity.toUpperCase() : "";
+}
 /** Whether an advisory withholds the versions it affects. */
 function blocks(vuln) {
-    return BLOCKING.has(vuln.database_specific?.severity?.toUpperCase() ?? "") || isMalware(vuln);
+    return BLOCKING.has(severityOf(vuln)) || isMalware(vuln);
+}
+/** What package audit mode records of an advisory: its severity, and its summary bounded at the source. */
+function auditDetail(vuln) {
+    const severity = severityOf(vuln);
+    const summary = sanitizeAuditSummary(vuln.summary);
+    return { ...(severity ? { severity } : {}), ...(summary ? { summary } : {}) };
+}
+/** Whether `accepted` waives a blocking advisory: it is not malware, and
+ *  its id or one of its aliases is accepted. Malware is never waived,
+ *  whatever the accepted set lists. */
+export function isWaived(advisory, accepted) {
+    if (advisory.malware || !accepted || accepted.size === 0)
+        return false;
+    // Belt and braces for entries not built from an OSV record here.
+    if ([advisory.id, ...advisory.aliases].some((id) => id.startsWith("MAL-")))
+        return false;
+    return accepted.has(advisory.id) || advisory.aliases.some((alias) => accepted.has(alias));
+}
+/** Whether a blocking advisory reports, or may report, malicious code: never served in any mode. */
+function isMalwareAdvisory(advisory) {
+    return advisory.malware || [advisory.id, ...advisory.aliases].some((id) => id.startsWith("MAL-"));
 }
+/** Splits the blocking advisories affecting one version into those still
+ *  withholding it, those `accepted` waives, and (package audit mode `full`,
+ *  `auditAll`) those served past and recorded. Malware is always withheld.
+ *  The version is withheld while `withheld` is non-empty. */
+export function splitWaived(advisories, accepted, options = {}) {
+    const withheld = [];
+    const waived = [];
+    const audited = [];
+    for (const advisory of advisories) {
+        if (isWaived(advisory, accepted))
+            waived.push(advisory);
+        else if (options.auditAll && !isMalwareAdvisory(advisory))
+            audited.push(advisory);
+        else
+            withheld.push(advisory);
+    }
+    return { withheld, waived, audited };
+}
+/** A blocking advisory as package audit mode records it. */
+export function auditAdvisoryOf(advisory) {
+    return { id: advisory.id, severity: advisory.severity ?? "UNKNOWN", summary: advisory.summary ?? "" };
+}
+const aliasesOf = (vuln) => Array.isArray(vuln.aliases) ? vuln.aliases.filter((alias) => typeof alias === "string") : [];
 function eventVersion(event) {
     return event.introduced ?? event.fixed ?? event.last_affected ?? event.limit;
 }
@@ -122,11 +172,16 @@ function indexOf(advisories, adapter) {
     const compare = (a, b) => adapter.compareVersions(a, b);
     const matching = (version, blocking) => advisories
         .filter((advisory) => advisory.blocking === blocking)
-        .filter((advisory) => advisory.affected.some((affected) => affects(version, affected, compare)))
-        .map((advisory) => advisory.id);
-    return { withheld: (version) => matching(version, true), reported: (version) => matching(version, false) };
+        .filter((advisory) => advisory.affected.some((affected) => affects(version, affected, compare)));
+    const ids = (list) => list.map((advisory) => advisory.id);
+    return {
+        withheld: (version, accepted, auditAll) => ids(splitWaived(matching(version, true), accepted, { auditAll }).withheld),
+        waived: (version, accepted) => ids(splitWaived(matching(version, true), accepted).waived),
+        reported: (version) => ids(matching(version, false)),
+        audited: (version, accepted) => splitWaived(matching(version, true), accepted, { auditAll: true }).audited.map(auditAdvisoryOf),
+    };
 }
-const EMPTY_INDEX = { withheld: () => [], reported: () => [] };
+const EMPTY_INDEX = { withheld: () => [], waived: () => [], reported: () => [], audited: () => [] };
 export const DEFAULT_AUDIT_CACHE_ENTRIES = 5000;
 export const versionKey = (name, version) => `${name}@${version}`;
 export class OsvAudit {
@@ -137,8 +192,8 @@ export class OsvAudit {
     cache = new Map();
     /** Single-flight: concurrent audits of one package share one OSV query. */
     loads = new Map();
-    /** Advisory severities by id, with the OSV `modified` time they were
-     *  read at, least recently used first. */
+    /** Advisory severities (and malware flag and aliases) by id, with the
+     *  OSV `modified` time they were read at, least recently used first. */
     vulns = new Map();
     /** Advisory ids (and their `modified` time) per exact version from
      *  querybatch, for the audit TTL, least recently used first, so repeated
@@ -286,10 +341,18 @@ export class OsvAudit {
             while (cursor < ids.length) {
                 const id = ids[cursor++];
                 const advisory = found.get(id);
-                if (!(await this.blocking(id, advisory.modified, signal)))
+                const detail = await this.detail(id, advisory.modified, signal);
+                if (!detail.blocking)
                     continue;
+                const entry = {
+                    id,
+                    malware: detail.malware,
+                    aliases: detail.aliases,
+                    ...(detail.severity ? { severity: detail.severity } : {}),
+                    ...(detail.summary ? { summary: detail.summary } : {}),
+                };
                 for (const key of advisory.versions)
-                    withheld.set(key, [...(withheld.get(key) ?? []), id]);
+                    withheld.set(key, [...(withheld.get(key) ?? []), entry]);
             }
         };
         await Promise.all(Array.from({ length: Math.min(OSV_VULN_CONCURRENCY, ids.length) }, worker));
@@ -307,14 +370,15 @@ export class OsvAudit {
         }
         this.batchCache.set(key, { expires: now + this.ttlMs, vulns });
     }
-    /** Whether an advisory is HIGH or CRITICAL, cached by id while OSV's
-     *  `modified` time for it is unchanged. */
-    async blocking(id, modified, signal) {
+    /** Whether an advisory blocks (HIGH, CRITICAL or malware), whether it is
+     *  malware, and its aliases, cached by id while OSV's `modified` time for
+     *  it is unchanged. */
+    async detail(id, modified, signal) {
         const cached = this.vulns.get(id);
         if (cached && modified !== "" && cached.modified === modified) {
             this.vulns.delete(id);
             this.vulns.set(id, cached); // most recently used
-            return cached.blocking;
+            return cached;
         }
         const response = await this.fetch(`${OSV_VULN}${encodeURIComponent(id)}`, { accept: "application/json", signal });
         if (!response.ok)
@@ -322,7 +386,13 @@ export class OsvAudit {
         const vuln = (await response.json());
         if (typeof vuln.id !== "string")
             throw new Error("osv_vuln_invalid");
-        const blocking = blocks(vuln);
+        const detail = {
+            modified: typeof vuln.modified === "string" ? vuln.modified : modified,
+            blocking: blocks(vuln),
+            malware: isMalware(vuln),
+            aliases: aliasesOf(vuln),
+            ...auditDetail(vuln),
+        };
         this.vulns.delete(id);
         while (this.vulns.size >= (this.options.maxVulnEntries ?? DEFAULT_VULN_CACHE_ENTRIES)) {
             const oldest = this.vulns.keys().next();
@@ -330,8 +400,8 @@ export class OsvAudit {
                 break;
             this.vulns.delete(oldest.value);
         }
-        this.vulns.set(id, { modified: typeof vuln.modified === "string" ? vuln.modified : modified, blocking });
-        return blocking;
+        this.vulns.set(id, detail);
+        return detail;
     }
     remember(key, advisories) {
         const now = this.now();
@@ -356,7 +426,14 @@ export class OsvAudit {
                 adapter.normalizeName(entry.package.name) === wanted);
             if (affected.length === 0)
                 continue;
-            advisories.push({ id: vuln.id, blocking: blocks(vuln), affected });
+            advisories.push({
+                id: vuln.id,
+                blocking: blocks(vuln),
+                malware: isMalware(vuln),
+                aliases: aliasesOf(vuln),
+                ...auditDetail(vuln),
+                affected,
+            });
         }
         return advisories;
     }

package/dist/providers/coding-proxy/registry/lockfile-parse-worker.d.ts

@@ -0,0 +1,36 @@
+import { type ParsedLockfile } from "../../../coding/registry/types.js";
+export interface ParseRequest {
+    ecosystem: string;
+    body: string;
+    maxEntries: number;
+    proxyRegistryUrl: string;
+}
+/** A ParsedLockfile without its functions: `edges[i]` lists, for
+ *  `entries[i]`, each dependency key the lockfile records that resolves to
+ *  an entry, with that entry's index; `projectEdges[i]` the same for
+ *  `projects[i]`. */
+export interface ShippedLockfile {
+    entries: ParsedLockfile["entries"];
+    projects: ParsedLockfile["projects"];
+    integrity?: ParsedLockfile["integrity"];
+    edges: [key: string, target: number][][];
+    projectEdges: [key: string, target: number][][];
+}
+export type ParseResponse = {
+    ok: true;
+    lockfile: ShippedLockfile;
+} | {
+    ok: false;
+    status: number;
+    code: string;
+    message: string;
+} | {
+    ok: false;
+    unexpected: true;
+    message: string;
+};
+export declare function parseAndShip(request: ParseRequest): ShippedLockfile;
+/** The answer for one parse: the lockfile, the parser's refusal, or (a bug,
+ *  not a verdict about the lockfile) the unexpected error's message, which
+ *  the main thread logs. */
+export declare function responseFor(parse: () => ShippedLockfile): ParseResponse;