@bevel-software/platform-core-backend 0.14.0 → 0.19.0

package/src/modules/workflow/__tests__/event-bus.test.ts

@@ -8,14 +8,16 @@ import { WorkflowEventBus } from '../event-bus.js';
  * tests can simulate focus changes without re-subscribing.
  */
 function makeSubscriber(sessionId: string, userId: string, initialFocus: string | null = null) {
-  let focus = initialFocus;
+  let watched = initialFocus === null ? [] : [initialFocus];
   const push = vi.fn();
   return {
     sessionId,
     userId,
     push,
-    getFocusedWorkspaceId: () => focus,
-    setFocus: (id: string | null) => { focus = id; },
+    getFocusedWorkspaceIds: () => watched,
+    setFocus: (id: string | null) => { watched = id === null ? [] : [id]; },
+    /** Add a workspace alongside the focused one, as `alsoWatch` does. */
+    alsoWatch: (id: string) => { watched = [...watched, id]; },
   };
 }
 
@@ -42,6 +44,53 @@ describe('WorkflowEventBus', () => {
       expect(onB.push).not.toHaveBeenCalled();
     });
 
+    // A page can read from a workspace other than the one in the address bar:
+    // the skill page renders the default branch's files while the reader
+    // stands on their own suggestion branch. With one focus per session, the
+    // `file-changed` for a screenshot a teammate replaced on the default
+    // branch reached nobody who wasn't standing there, and every such page
+    // showed the old picture until a reload.
+    it('delivers to a session watching a second workspace alongside its focus', () => {
+      const bus = new WorkflowEventBus();
+      const onBranch = makeSubscriber('s-a', 'u-1', 'alice%2Fdraft');
+      onBranch.alsoWatch('main');
+      const elsewhere = makeSubscriber('s-b', 'u-2', 'bob%2Fdraft');
+      bus.subscribe(onBranch);
+      bus.subscribe(elsewhere);
+
+      bus.emit({
+        kind: 'file-changed',
+        workspaceId: 'main',
+        branch: 'main',
+        path: 'knowledge-base/Skills/deploy/assets/shot.png',
+        newSha: 'abc',
+        byUserId: 'u-3',
+        byUserName: 'Carol',
+      });
+
+      expect(onBranch.push).toHaveBeenCalledTimes(1);
+      expect(elsewhere.push).not.toHaveBeenCalled();
+    });
+
+    it('still delivers the focused workspace to a session that also watches another', () => {
+      const bus = new WorkflowEventBus();
+      const sub = makeSubscriber('s-a', 'u-1', 'alice%2Fdraft');
+      sub.alsoWatch('main');
+      bus.subscribe(sub);
+
+      bus.emit({
+        kind: 'file-changed',
+        workspaceId: 'alice/draft',
+        branch: 'alice/draft',
+        path: 'Foo.md',
+        newSha: 'abc',
+        byUserId: 'u-1',
+        byUserName: 'Alice',
+      });
+
+      expect(sub.push).toHaveBeenCalledTimes(1);
+    });
+
     it('matches workspace focus across URL-encoded vs decoded forms', () => {
       // The frontend stores `workspace.id` as `encodeURIComponent(branch)` and
       // sends that as the SSE focus value. The route handlers, however,
@@ -186,7 +235,7 @@ describe('WorkflowEventBus', () => {
   describe('replay', () => {
     it('returns events strictly after the last-seen id', () => {
       const bus = new WorkflowEventBus();
-      const sub = { userId: 'u-1', getFocusedWorkspaceId: () => 'ws-a' };
+      const sub = { userId: 'u-1', getFocusedWorkspaceIds: () => ['ws-a'] };
       bus.emit({ kind: 'lock-released', workspaceId: 'ws-a', branch: 'a', path: '1.md' });
       bus.emit({ kind: 'lock-released', workspaceId: 'ws-a', branch: 'a', path: '2.md' });
       bus.emit({ kind: 'lock-released', workspaceId: 'ws-a', branch: 'a', path: '3.md' });
@@ -198,7 +247,7 @@ describe('WorkflowEventBus', () => {
 
     it('respects scope filtering on replay (no leak of other workspaces)', () => {
       const bus = new WorkflowEventBus();
-      const sub = { userId: 'u-1', getFocusedWorkspaceId: () => 'ws-a' };
+      const sub = { userId: 'u-1', getFocusedWorkspaceIds: () => ['ws-a'] };
       bus.emit({ kind: 'lock-released', workspaceId: 'ws-a', branch: 'a', path: 'a.md' });
       bus.emit({ kind: 'lock-released', workspaceId: 'ws-b', branch: 'b', path: 'b.md' });
       bus.emit({ kind: 'change-request-merged', number: 5 });
@@ -219,7 +268,7 @@ describe('WorkflowEventBus', () => {
       for (let i = 0; i < 501; i++) {
         bus.emit({ kind: 'change-request-merged', number: i + 1 });
       }
-      const sub = { userId: 'u-1', getFocusedWorkspaceId: () => null };
+      const sub = { userId: 'u-1', getFocusedWorkspaceIds: () => [] };
       // After 501 emits with capacity 500: ids 2..501 remain, id 1 evicted.
       // Requesting events after id 0 means "everything from id 1 onward",
       // but id 1 is gone — bus must signal a resync rather than silently
@@ -238,7 +287,7 @@ describe('WorkflowEventBus', () => {
       // The bus must return `null` so the route emits a `resync` and the
       // client refetches state from scratch.
       const bus = new WorkflowEventBus();
-      const sub = { userId: 'u-1', getFocusedWorkspaceId: () => null };
+      const sub = { userId: 'u-1', getFocusedWorkspaceIds: () => [] };
       expect(bus.replayAfter(42, sub)).toBeNull();
       // First-time client (Last-Event-ID === 0) on an empty buffer is
       // genuinely caught up — replay is an empty array, not a resync.
@@ -256,7 +305,7 @@ describe('WorkflowEventBus', () => {
       for (let i = 0; i < 5; i++) {
         bus.emit({ kind: 'change-request-merged', number: i + 1 });
       }
-      const sub = { userId: 'u-1', getFocusedWorkspaceId: () => null };
+      const sub = { userId: 'u-1', getFocusedWorkspaceIds: () => [] };
       // Newest id is 5; 100 is far ahead → resync.
       expect(bus.replayAfter(100, sub)).toBeNull();
       // 4 is in-buffer → caller gets event 5 back.
@@ -350,7 +399,10 @@ describe('WorkflowEventBus', () => {
       expect(after).toEqual(['fs-tree-changed']);
       // The containment is LOGGED, not silent — a listener dying quietly
       // would be undebuggable.
-      expect(warn).toHaveBeenCalledWith('[event-bus] onEmit listener threw:', 'bad listener');
+      expect(warn).toHaveBeenCalledWith(
+        '[event-bus] onEmit listener threw:',
+        expect.objectContaining({ message: 'bad listener' }),
+      );
       warn.mockRestore();
     });
   });

package/src/modules/workflow/__tests__/fake-file-lock-db.ts

@@ -0,0 +1,199 @@
+/**
+ * An in-memory stand-in for the `file_locks` table, good enough to run the
+ * real `FileLockService` against.
+ *
+ * The question these tests ask is "how many lock rows does this produce, and
+ * which one does a caller find" — which a spy that only records arguments
+ * cannot answer, because the answer lives in the primary key. So this fake
+ * keeps actual rows behind the composite key `(workspace_id, branch, path)`
+ * and honours the one PostgreSQL behaviour the service leans on: an
+ * `INSERT ... ON CONFLICT DO UPDATE` whose `setWhere` does not match returns
+ * NOTHING rather than raising, which is how a live lock reads as contended.
+ *
+ * WHERE clauses are turned into predicates through drizzle's own
+ * `PgDialect.sqlToQuery`, the same public entry point the driver uses to
+ * render SQL, rather than by reaching into the condition object's internals.
+ * The rendered text is a stable, documented artifact; the internal chunk
+ * shapes are neither.
+ */
+
+import { PgDialect } from 'drizzle-orm/pg-core';
+import type { SQL } from 'drizzle-orm';
+import type { Database } from '../../database/connection.js';
+
+export interface LockRow {
+  workspaceId: string;
+  branch: string;
+  path: string;
+  holderUserId: string;
+  holderName: string;
+  mode: string;
+  acquiredAt: Date;
+  lastHeartbeatAt: Date;
+  expiresAt: Date;
+}
+
+/** Rendered column name to the row field drizzle maps it onto. */
+const FIELD_FOR_COLUMN: Record<string, keyof LockRow> = {
+  workspace_id: 'workspaceId',
+  branch: 'branch',
+  path: 'path',
+  holder_user_id: 'holderUserId',
+  holder_name: 'holderName',
+  mode: 'mode',
+  acquired_at: 'acquiredAt',
+  last_heartbeat_at: 'lastHeartbeatAt',
+  expires_at: 'expiresAt',
+};
+
+const COMPARISONS: Record<string, (a: string, b: string) => boolean> = {
+  '=': (a, b) => a === b,
+  '<=': (a, b) => a <= b,
+  '<': (a, b) => a < b,
+  '>': (a, b) => a > b,
+  '>=': (a, b) => a >= b,
+};
+
+/**
+ * Both sides of a comparison as strings. Timestamp parameters come back from
+ * `sqlToQuery` already rendered as ISO-8601, and ISO-8601 in a fixed zone
+ * sorts chronologically, so a plain string compare gives the same answer the
+ * database would.
+ */
+function comparable(value: unknown): string {
+  return value instanceof Date ? value.toISOString() : String(value);
+}
+
+const dialect = new PgDialect();
+const TERM = /"file_locks"\."(\w+)"\s*(<=|>=|=|<|>)\s*\$(\d+)/g;
+
+function predicateFor(condition: SQL | undefined): (row: LockRow) => boolean {
+  if (!condition) return () => true;
+  const { sql: text, params } = dialect.sqlToQuery(condition);
+  const terms = [...text.matchAll(TERM)].map(([, column, operator, index]) => {
+    const field = FIELD_FOR_COLUMN[column];
+    // A column the regex matched but FIELD_FOR_COLUMN does not know would
+    // read `row[undefined]` as the string "undefined" and compare it against
+    // a real parameter — excluding every row, silently, which reads in a test
+    // exactly like "no lock is held". Fail closed here too, for the same
+    // reason the unmatched-reference check below fails closed.
+    if (!field) {
+      throw new Error(`fake file_locks db has no field mapped for column "${column}": ${text}`);
+    }
+    return { field, operator, value: comparable(params[Number(index) - 1]) };
+  });
+  // Every clause the lock service builds is a conjunction of column
+  // comparisons. A term this cannot read would silently widen the match, so
+  // say so instead of quietly answering the wrong question.
+  const rendered = text.replace(TERM, '');
+  if (/"file_locks"/.test(rendered)) {
+    throw new Error(`fake file_locks db cannot read this WHERE clause: ${text}`);
+  }
+  return (row) =>
+    terms.every(({ field, operator, value }) =>
+      COMPARISONS[operator](comparable(row[field]), value),
+    );
+}
+
+function keyOf(row: Pick<LockRow, 'workspaceId' | 'branch' | 'path'>): string {
+  return JSON.stringify([row.workspaceId, row.branch, row.path]);
+}
+
+export interface FakeLockDb {
+  db: Database;
+  /** Every row currently stored, in insertion order. */
+  rows: () => LockRow[];
+  /**
+   * Store a row as-is, bypassing the service — for a row the service could
+   * not write today, such as one keyed on a raw spelling before paths were
+   * canonicalised.
+   */
+  seed: (row: LockRow) => void;
+}
+
+export function makeFakeLockDb(): FakeLockDb {
+  const store = new Map<string, LockRow>();
+
+  const insert = () => ({
+    values: (row: LockRow) => {
+      // `null` is the absorbed conflict: a row is already there and the
+      // `setWhere` refused it, so the statement writes nothing and RETURNING
+      // comes back empty.
+      let pending: LockRow | null = { ...row };
+      const chain = {
+        onConflictDoUpdate: ({
+          set,
+          setWhere,
+        }: {
+          set: Partial<LockRow>;
+          setWhere?: SQL;
+        }) => {
+          const existing = store.get(keyOf(row));
+          if (existing) {
+            pending = predicateFor(setWhere)(existing) ? { ...existing, ...set } : null;
+          }
+          return chain;
+        },
+        returning: async (): Promise<LockRow[]> => {
+          if (pending === null) return [];
+          store.set(keyOf(pending), pending);
+          return [{ ...pending }];
+        },
+      };
+      return chain;
+    },
+  });
+
+  const select = () => ({
+    from: () => {
+      let matches: LockRow[] = [];
+      const chain = {
+        where: (condition?: SQL) => {
+          matches = [...store.values()].filter(predicateFor(condition));
+          return chain;
+        },
+        limit: async (n: number): Promise<LockRow[]> => matches.slice(0, n).map((r) => ({ ...r })),
+        then: (onF: (v: LockRow[]) => unknown, onR?: (e: unknown) => unknown) =>
+          Promise.resolve(matches.map((r) => ({ ...r }))).then(onF, onR),
+      };
+      return chain;
+    },
+  });
+
+  const update = () => ({
+    set: (patch: Partial<LockRow>) => {
+      let updated: LockRow[] = [];
+      const chain = {
+        where: (condition?: SQL) => {
+          const match = predicateFor(condition);
+          updated = [];
+          for (const [key, row] of store) {
+            if (!match(row)) continue;
+            const next = { ...row, ...patch };
+            store.set(key, next);
+            updated.push(next);
+          }
+          return chain;
+        },
+        returning: async (): Promise<LockRow[]> => updated.map((r) => ({ ...r })),
+      };
+      return chain;
+    },
+  });
+
+  const del = () => ({
+    where: async (condition?: SQL): Promise<void> => {
+      const match = predicateFor(condition);
+      for (const [key, row] of [...store]) if (match(row)) store.delete(key);
+    },
+  });
+
+  const db = { insert, select, update, delete: del } as unknown as Database;
+  return {
+    db,
+    rows: () => [...store.values()].map((r) => ({ ...r })),
+    seed: (row) => {
+      store.set(keyOf(row), { ...row });
+    },
+  };
+}

package/src/modules/workflow/__tests__/file-lock.service.path-identity.test.ts

@@ -0,0 +1,237 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import type { AuthUser } from '@bevel-software/platform-shared';
+import { FileLockService } from '../file-lock.service.js';
+import { PathTraversalError, WorkflowValidationError } from '../../../shared/domain-errors.js';
+import { makeFakeLockDb, type FakeLockDb, type LockRow } from './fake-file-lock-db.js';
+
+/**
+ * A lock is only a lock if everyone agrees what it is on. `x/a.md`,
+ * `./x/a.md` and `x//a.md` are three spellings of one file, and before this
+ * each one took a row of its own: two editors could hold "the" lock on the
+ * same file at the same time and overwrite each other, and a release could
+ * find nothing to release.
+ *
+ * These tests drive the SERVICE, not the routes, on purpose. The routes are
+ * one caller among several (the agent's lock-aware filesystem and the roles
+ * admin reach the service directly), so the identity has to be decided at the
+ * row, where the coordination happens.
+ */
+
+const ALICE: AuthUser = { id: '11111111-1111-4111-8111-111111111111', email: 'alice@example.com', name: 'Alice' };
+const BOB: AuthUser = { id: '22222222-2222-4222-8222-222222222222', email: 'bob@example.com', name: 'Bob' };
+
+const WS = 'feat%2Fx';
+const BRANCH = 'feat/x';
+const CANONICAL = 'knowledge-base/x/a.md';
+/** Spellings of CANONICAL: a leading `./`, a doubled separator, and both. */
+const SPELLINGS = [
+  './knowledge-base/x/a.md',
+  'knowledge-base//x/a.md',
+  './knowledge-base//x//a.md',
+];
+
+describe('FileLockService coordinates on one canonical path', () => {
+  let fake: FakeLockDb;
+  let locks: FileLockService;
+
+  beforeEach(() => {
+    fake = makeFakeLockDb();
+    locks = new FileLockService(fake.db);
+  });
+
+  it('stores the canonical spelling even when only a raw one was ever passed', async () => {
+    // The direct-service case: nothing above canonicalised for us here.
+    const result = await locks.acquire(WS, BRANCH, './knowledge-base//x//a.md', ALICE);
+
+    expect(result.acquired).toBe(true);
+    expect(result.lock.path).toBe(CANONICAL);
+    expect(fake.rows().map((r) => r.path)).toEqual([CANONICAL]);
+  });
+
+  it.each(SPELLINGS)('a lock taken as %s refuses a second acquire spelled canonically', async (spelling) => {
+    const first = await locks.acquire(WS, BRANCH, spelling, ALICE);
+    expect(first.acquired).toBe(true);
+
+    const second = await locks.acquire(WS, BRANCH, CANONICAL, BOB);
+
+    // Refused exactly as a same-spelling re-acquire would be: not acquired,
+    // and the holder comes back so the UI can say who has it.
+    expect(second.acquired).toBe(false);
+    expect(second.lock.holderUserId).toBe(ALICE.id);
+    expect(second.lock.path).toBe(CANONICAL);
+    // ONE lock, not two.
+    expect(fake.rows()).toHaveLength(1);
+  });
+
+  it('refuses the same way when the same spelling is used twice (control)', async () => {
+    await locks.acquire(WS, BRANCH, CANONICAL, ALICE);
+    const second = await locks.acquire(WS, BRANCH, CANONICAL, BOB);
+
+    expect(second.acquired).toBe(false);
+    expect(second.lock.holderUserId).toBe(ALICE.id);
+    expect(fake.rows()).toHaveLength(1);
+  });
+
+  it('holds one lock across the branch boundary only (same path, other branch is free)', async () => {
+    await locks.acquire(WS, BRANCH, './knowledge-base//x/a.md', ALICE);
+    const other = await locks.acquire('other%2Fy', 'other/y', CANONICAL, BOB);
+
+    expect(other.acquired).toBe(true);
+    expect(fake.rows()).toHaveLength(2);
+  });
+
+  it.each(SPELLINGS)('heartbeats a canonically-taken lock spelled as %s', async (spelling) => {
+    const acquired = await locks.acquire(WS, BRANCH, CANONICAL, ALICE);
+
+    const beat = await locks.heartbeat(WS, BRANCH, spelling, ALICE);
+
+    expect(beat.path).toBe(CANONICAL);
+    expect(beat.holderUserId).toBe(ALICE.id);
+    expect(new Date(beat.expiresAt).getTime()).toBeGreaterThanOrEqual(
+      new Date(acquired.lock.expiresAt).getTime(),
+    );
+    expect(fake.rows()).toHaveLength(1);
+  });
+
+  it.each(SPELLINGS)('releases a canonically-taken lock spelled as %s', async (spelling) => {
+    await locks.acquire(WS, BRANCH, CANONICAL, ALICE);
+
+    await locks.release(WS, BRANCH, spelling, ALICE);
+
+    expect(fake.rows()).toEqual([]);
+    expect(await locks.get(WS, BRANCH, CANONICAL)).toBeNull();
+  });
+
+  it.each(SPELLINGS)('reads a canonically-taken lock spelled as %s', async (spelling) => {
+    await locks.acquire(WS, BRANCH, CANONICAL, ALICE);
+
+    const read = await locks.get(WS, BRANCH, spelling);
+
+    expect(read?.holderUserId).toBe(ALICE.id);
+    expect(read?.path).toBe(CANONICAL);
+  });
+
+  it('goes the other way too: taken raw, released and read canonically', async () => {
+    await locks.acquire(WS, BRANCH, './knowledge-base//x//a.md', ALICE);
+
+    expect((await locks.get(WS, BRANCH, CANONICAL))?.holderUserId).toBe(ALICE.id);
+    await locks.release(WS, BRANCH, CANONICAL, ALICE);
+    expect(fake.rows()).toEqual([]);
+  });
+
+  /**
+   * A path the canonicaliser refuses to touch must not become a lock row of
+   * its own. The statuses match what the file verbs answer for the same
+   * input: `WorkspaceService.withPathTurn` validates first (400) and checks
+   * workspace containment second (403).
+   */
+  describe('refuses a path the file verbs would refuse', () => {
+    const REFUSED: [string, string, new () => Error][] = [
+      ['climbs out of the workspace', '../etc/passwd', WorkflowValidationError],
+      ['climbs out from inside', 'knowledge-base/../../etc/passwd', WorkflowValidationError],
+      ['launders back inside', 'knowledge-base/x/../y.md', WorkflowValidationError],
+      ['is a bare parent', '..', WorkflowValidationError],
+      ['is the current directory', '.', WorkflowValidationError],
+      ['uses backslashes', 'knowledge-base\\x\\a.md', WorkflowValidationError],
+      ['is absolute', '/etc/passwd', PathTraversalError],
+    ];
+
+    it.each(REFUSED)('acquire refuses a path that %s', async (_why, badPath, error) => {
+      await expect(locks.acquire(WS, BRANCH, badPath, ALICE)).rejects.toBeInstanceOf(error);
+      expect(fake.rows()).toEqual([]);
+    });
+
+    it.each(REFUSED)('heartbeat refuses a path that %s', async (_why, badPath, error) => {
+      await expect(locks.heartbeat(WS, BRANCH, badPath, ALICE)).rejects.toBeInstanceOf(error);
+    });
+
+    it.each(REFUSED)('release refuses a path that %s', async (_why, badPath, error) => {
+      await locks.acquire(WS, BRANCH, CANONICAL, ALICE);
+      await expect(locks.release(WS, BRANCH, badPath, ALICE)).rejects.toBeInstanceOf(error);
+      // Nothing was deleted on the way to the refusal.
+      expect(fake.rows()).toHaveLength(1);
+    });
+
+    it.each(REFUSED)('get refuses a path that %s', async (_why, badPath, error) => {
+      await expect(locks.get(WS, BRANCH, badPath)).rejects.toBeInstanceOf(error);
+    });
+  });
+
+  /**
+   * A row written under a raw spelling before this change. There is
+   * deliberately no transition handling: nothing rewrites the row to its
+   * canonical key, nothing matches it by its old name, and it goes away the
+   * way any unheartbeaten lock does — its own `expiresAt`. A dual match would
+   * be a second identity for the file, which is the thing being removed.
+   */
+  describe('a legacy row stored under a raw spelling', () => {
+    const RAW = './knowledge-base//x//a.md';
+    const T0 = new Date('2026-09-11T12:00:00.000Z');
+    const LEGACY_EXPIRES = new Date(T0.getTime() + 50_000);
+    const legacyRow: LockRow = {
+      workspaceId: WS,
+      branch: BRANCH,
+      path: RAW,
+      holderUserId: ALICE.id,
+      holderName: ALICE.name,
+      mode: 'edit',
+      acquiredAt: new Date(T0.getTime() - 10_000),
+      lastHeartbeatAt: new Date(T0.getTime() - 10_000),
+      expiresAt: LEGACY_EXPIRES,
+    };
+    const legacy = () => fake.rows().find((r) => r.path === RAW);
+
+    beforeEach(() => {
+      vi.useFakeTimers();
+      vi.setSystemTime(T0);
+      fake.seed(legacyRow);
+    });
+    afterEach(() => {
+      vi.useRealTimers();
+    });
+
+    it('is not dual-matched: a canonical acquire by someone else succeeds beside it', async () => {
+      const bob = await locks.acquire(WS, BRANCH, CANONICAL, BOB);
+
+      expect(bob.acquired).toBe(true);
+      expect(bob.lock.holderUserId).toBe(BOB.id);
+      expect((await locks.get(WS, BRANCH, RAW))?.holderUserId).toBe(BOB.id);
+      // Two rows: the new canonical one, and the legacy one left exactly as it was.
+      expect(fake.rows().map((r) => r.path).sort()).toEqual([RAW, CANONICAL].sort());
+      expect(legacy()).toEqual(legacyRow);
+    });
+
+    it('is unreachable by its old name: get, whatever the spelling, reads no lock', async () => {
+      expect(await locks.get(WS, BRANCH, RAW)).toBeNull();
+      expect(await locks.get(WS, BRANCH, CANONICAL)).toBeNull();
+      expect(legacy()).toEqual(legacyRow);
+    });
+
+    it('is not migrated or extended: its holder cannot heartbeat it by its old name', async () => {
+      await expect(locks.heartbeat(WS, BRANCH, RAW, ALICE)).rejects.toBeInstanceOf(
+        WorkflowValidationError,
+      );
+
+      // Not rewritten to the canonical key, and the TTL is its own.
+      expect(fake.rows()).toEqual([legacyRow]);
+    });
+
+    it('is not released by its old name either', async () => {
+      await locks.release(WS, BRANCH, RAW, ALICE);
+
+      expect(fake.rows()).toEqual([legacyRow]);
+    });
+
+    it('expires by its own TTL and nothing else', async () => {
+      // Live: it still reads as a held lock in the workspace until then.
+      expect(await locks.hasAnyActive(WS)).toBe(true);
+
+      vi.setSystemTime(new Date(LEGACY_EXPIRES.getTime() - 1));
+      expect(await locks.hasAnyActive(WS)).toBe(true);
+
+      vi.setSystemTime(LEGACY_EXPIRES);
+      expect(await locks.hasAnyActive(WS)).toBe(false);
+      expect(legacy()?.expiresAt).toEqual(LEGACY_EXPIRES);
+    });
+  });
+});

package/src/modules/workflow/__tests__/format-affected-owners.test.ts

@@ -65,3 +65,21 @@ describe('formatAffectedOwnersBlock', () => {
     expect(MAX_AFFECTED_PATHS_LISTED).toBe(50);
   });
 });
+
+describe('formatAffectedOwnersBlock — folder placeholder', () => {
+  it('never lists a placeholder, and placeholders do not count against the cap', () => {
+    const admin = { roles: ['Admin'], users: [] };
+    const placeholders = Array.from({ length: MAX_AFFECTED_PATHS_LISTED + 5 }, (_, i) => `F${i}/.gitkeep`);
+    const out = formatAffectedOwnersBlock(
+      [...placeholders, 'real.md'],
+      resolvedOf(Object.fromEntries([...placeholders, 'real.md'].map((p) => [p, admin]))),
+    );
+    expect(out).toBe(['## Affected owners', '', '- `real.md` — Admin'].join('\n'));
+  });
+
+  it('is empty when the only changes are placeholders', () => {
+    expect(
+      formatAffectedOwnersBlock(['A/.gitkeep'], resolvedOf({ 'A/.gitkeep': { roles: ['Admin'], users: [] } })),
+    ).toBe('');
+  });
+});