fix: re add the token check

Signed-off-by: Umberto Sgueglia <usgueglia@contractor.linuxfoundation.org>

Author: ulemons

backend/src/api/public/v1/akrites-external/index.ts

@@ -73,7 +73,7 @@ export function akritesExternalRouter(): Router {
   // (same as advisories above — see the scope-naming note in the akrites-external
   // OpenAPI). Not issued by Auth0 yet, so reuse READ_PACKAGES for now.
   const blastRadiusSubRouter = Router()
-  // blastRadiusSubRouter.use(requireScopes([SCOPES.READ_PACKAGES]))
+  blastRadiusSubRouter.use(requireScopes([SCOPES.READ_PACKAGES]))
   blastRadiusSubRouter.post('/jobs', blastRadiusRateLimiter, safeWrap(submitBlastRadiusJob))
   blastRadiusSubRouter.get('/jobs/:analysisId', rateLimiter, safeWrap(getBlastRadiusJob))
   router.use('/blast-radius', blastRadiusSubRouter)

backend/src/api/public/v1/index.ts

@@ -43,8 +43,7 @@ export function v1Router(): Router {
   router.use('/ossprey', oauth2Middleware(AUTH0_CONFIG), osspreyRouter())
 
   router.use('/akrites', oauth2Middleware(AUTH0_CONFIG), akritesRouter())
-  router.use('/akrites-external', akritesExternalRouter())
-  // router.use('/akrites-external', oauth2Middleware(AUTH0_CONFIG), akritesExternalRouter())
+  router.use('/akrites-external', oauth2Middleware(AUTH0_CONFIG), akritesExternalRouter())
 
   router.use(() => {
     throw new NotFoundError()

backend/src/api/public/v1/packages/blastRadiusAnalysis.ts

@@ -99,22 +99,25 @@ function toResultItem(row: VerdictResultRow): BlastRadiusResultItem {
 // candidates the topN walk never reached (so candidatesConsidered - analyzed
 // overstates range exclusions). dependentsAnalyzed = number of verdicts produced,
 // dependentsAffected = count with an 'affected' verdict, affectedPercentage rounded
-// to 1 decimal (null when nothing was analyzed, to avoid a misleading 0%).
+// to 1 decimal — computed over conclusive verdicts only (affected/not_affected), so
+// persistent agent/tarball failures ('unclear') don't drag it toward a misleading 0%.
+// null when nothing conclusive was analyzed.
 function toSummary(
   dependentsExcludedUpfront: number,
   results: BlastRadiusResultItem[],
 ): BlastRadiusAnalysisSummary {
   const dependentsAnalyzed = results.length
   const affected = results.filter((r) => r.affected)
+  const conclusive = results.filter((r) => r.verdict !== 'unclear')
 
   return {
     totalDependentsInRange: dependentsAnalyzed + dependentsExcludedUpfront,
     dependentsExcludedUpfront,
     dependentsAnalyzed,
     dependentsAffected: affected.length,
     affectedPercentage:
-      dependentsAnalyzed > 0
-        ? Math.round((affected.length / dependentsAnalyzed) * 1000) / 10
+      conclusive.length > 0
+        ? Math.round((affected.length / conclusive.length) * 1000) / 10
         : null,
     affectedDependents: affected.map((r) => r.dependent),
   }

services/apps/packages_worker/src/blast-radius/clients/npmTarball.ts

@@ -91,9 +91,8 @@ export async function downloadAndExtractTarball(
     } finally {
       fs.rmSync(tempDir, { recursive: true, force: true })
     }
-  } catch (err) {
+  } finally {
     clearTimeout(timeoutHandle)
-    throw err
   }
 }
 

services/apps/packages_worker/src/blast-radius/stages/intel.ts

@@ -111,7 +111,7 @@ export async function runIntelStage(
       for (const url of patchUrls.slice(0, 3)) {
         try {
           const patchText = await fetchPatch(url)
-          const slug = url.split('/').slice(-2).join('-')
+          const slug = new URL(url).pathname.split('/').filter(Boolean).join('-')
           patches[slug] = patchText
         } catch {
           // Ignore patch fetch errors

services/apps/packages_worker/src/blast-radius/stages/reachability.ts

@@ -72,7 +72,12 @@ export async function runReachabilityStage(
     const concurrency = 4
     const queue = [...dependents]
 
-    const upsertErrorVerdict = (dependentId: string, reasoning: string, model: string | null) =>
+    const upsertErrorVerdict = (
+      dependentId: string,
+      reasoning: string,
+      model: string | null,
+      costUsd = 0,
+    ) =>
       blastRadiusDal.upsertVerdict(qx, {
         analysisId,
         dependentId,
@@ -85,7 +90,7 @@ export async function runReachabilityStage(
         reasoning,
         model,
         turnsUsed: null,
-        costUsd: 0,
+        costUsd,
       })
 
     const processOne = async (dep: blastRadiusDal.DependentRow): Promise<void> => {
@@ -114,7 +119,11 @@ export async function runReachabilityStage(
           return
         }
 
-        // Try agent up to MAX_ATTEMPTS times with exponential backoff
+        // Try agent up to MAX_ATTEMPTS times with exponential backoff. costUsd is
+        // accumulated across attempts — a persistent failure still spends real money
+        // on every retry, and that spend must show up in the verdict/stage/analysis
+        // totals even though only the last attempt's outcome is persisted.
+        let accumulatedCost = 0
         for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
           try {
             const systemPrompt = buildReachabilitySystemPrompt(spec)
@@ -129,6 +138,7 @@ export async function runReachabilityStage(
               timeoutMs: 600_000,
               onProgress,
             })
+            accumulatedCost += agentResult.costUsd || 0
 
             if (!agentResult.isError && agentResult.structuredOutput) {
               const output = agentResult.structuredOutput
@@ -145,7 +155,7 @@ export async function runReachabilityStage(
                 reasoning: String(output.reasoning || ''),
                 model: 'claude-sonnet-5',
                 turnsUsed: agentResult.numTurns,
-                costUsd: agentResult.costUsd || 0,
+                costUsd: accumulatedCost,
               })
 
               return
@@ -161,6 +171,7 @@ export async function runReachabilityStage(
                 dep.id,
                 `Agent failed: ${err instanceof Error ? err.message : String(err)}`,
                 'claude-sonnet-5',
+                accumulatedCost,
               )
               return
             }

services/libs/data-access-layer/src/packages/blastRadius.ts

@@ -140,7 +140,7 @@ export async function markAnalysisRunning(qx: QueryExecutor, analysisId: string)
   await qx.result(
     `
     UPDATE blast_radius_analyses
-    SET status = 'running', started_at = NOW(), updated_at = NOW()
+    SET status = 'running', updated_at = NOW()
     WHERE id = $(analysisId) AND status = 'pending'
     `,
     { analysisId },
@@ -203,12 +203,13 @@ export async function resolveAdvisoryAndPackageIds(
     `
     UPDATE blast_radius_analyses bra
     SET
-      advisory_id = COALESCE(a.id, bra.advisory_id),
+      advisory_id = COALESCE(
+        (SELECT id FROM advisories WHERE osv_id = $(advisoryOsvId)),
+        bra.advisory_id
+      ),
       package_id = COALESCE($(packageId), bra.package_id),
       updated_at = NOW()
-    FROM advisories a
     WHERE bra.id = $(analysisId)
-      AND a.osv_id = $(advisoryOsvId)
     `,
     { analysisId, advisoryOsvId, packageId },
   )