@bevel-software/platform-core-backend 0.19.0 → 0.21.0

package/src/modules/workflow/git/__tests__/git.service.syncFromRemote.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { testKbContext } from '../../../../__tests__/kb-context.js';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import os from 'node:os';
@@ -81,7 +82,7 @@ describe('GitService.syncFromRemote', () => {
       await fs.writeFile(path.join(dir, 'b.md'), 'b\n');
       await fs.rename(path.join(dir, 'old name.md'), path.join(dir, 'new name.md'));
     });
-    const git = new GitService(stubWorkspaceService({ ws: workspaceDir }), stubWorkflowHooks(), 'knowledge-base');
+    const git = new GitService(stubWorkspaceService({ ws: workspaceDir }), stubWorkflowHooks(), testKbContext());
 
     const r = await git.syncFromRemote('ws');
     expect(r.before).toBe(before);
@@ -105,7 +106,7 @@ describe('GitService.syncFromRemote', () => {
     await runGit(repo, ['config', 'user.email', 'workspace@bevel.test']);
     await runGit(repo, ['config', 'user.name', 'bevel Workspace']);
     await runGit(repo, ['checkout', '-b', BRANCH]).catch(() => undefined);
-    const git = new GitService(stubWorkspaceService({ ws: workspaceDir }), stubWorkflowHooks(), 'knowledge-base');
+    const git = new GitService(stubWorkspaceService({ ws: workspaceDir }), stubWorkflowHooks(), testKbContext());
 
     // Still empty on both sides: nothing to sync, and NOT 'remote gone' — a
     // fresh deployment nobody has pushed to must never have its clone retired.
@@ -134,7 +135,7 @@ describe('GitService.syncFromRemote', () => {
     await runGit(upstream, ['branch', 'ali/x', BRANCH]);
     const { workspaceDir } = await cloneWorkspace(root, upstream, 'ali%2Fx', 'ali/x');
     await runGit(upstream, ['update-ref', '-d', 'refs/heads/ali/x']);
-    const git = new GitService(stubWorkspaceService({ 'ali%2Fx': workspaceDir }), stubWorkflowHooks(), 'knowledge-base');
+    const git = new GitService(stubWorkspaceService({ 'ali%2Fx': workspaceDir }), stubWorkflowHooks(), testKbContext());
     await expect(git.syncFromRemote('ali%2Fx')).rejects.toBeInstanceOf(RemoteBranchGoneError);
   });
 });
@@ -163,7 +164,7 @@ describe('GitService.syncFromRemote — the cases git exits 0 on but should not
     await pushFromElsewhere(root, upstream, async (dir) => {
       await fs.writeFile(path.join(dir, 'a.md'), 'edited on the host\n');
     });
-    const git = new GitService(stubWorkspaceService({ ws: workspaceDir }), stubWorkflowHooks(), 'knowledge-base');
+    const git = new GitService(stubWorkspaceService({ ws: workspaceDir }), stubWorkflowHooks(), testKbContext());
 
     await expect(git.syncFromRemote('ws')).rejects.toMatchObject({
       name: 'PullRebaseConflictError',
@@ -186,7 +187,7 @@ describe('GitService.syncFromRemote — the cases git exits 0 on but should not
     await runGit(repo, ['rm', '-rf', '--cached', '.']).catch(() => undefined);
     await fs.rm(path.join(repo, 'a.md'), { force: true });
     await fs.rm(path.join(repo, 'old name.md'), { force: true });
-    const git = new GitService(stubWorkspaceService({ ws: workspaceDir }), stubWorkflowHooks(), 'knowledge-base');
+    const git = new GitService(stubWorkspaceService({ ws: workspaceDir }), stubWorkflowHooks(), testKbContext());
     await expect(git.syncFromRemote('ws')).rejects.toBeInstanceOf(RemoteBranchGoneError);
   });
 
@@ -194,7 +195,7 @@ describe('GitService.syncFromRemote — the cases git exits 0 on but should not
     const upstream = await bareUpstream(root, true);
     await runGit(upstream, ['branch', 'ali/x', BRANCH]);
     const { workspaceDir } = await cloneWorkspace(root, upstream, 'ws');
-    const git = new GitService(stubWorkspaceService({ ws: workspaceDir }), stubWorkflowHooks(), 'knowledge-base');
+    const git = new GitService(stubWorkspaceService({ ws: workspaceDir }), stubWorkflowHooks(), testKbContext());
     expect(await git.remoteBranchExists('ws', 'ali/x')).toBe(true);
     await runGit(upstream, ['update-ref', '-d', 'refs/heads/ali/x']);
     expect(await git.remoteBranchExists('ws', 'ali/x')).toBe(false);
@@ -241,7 +242,7 @@ describe('GitService.syncFromRemote — an unborn clone that already holds stage
     await runGit(seed, ['add', '.']);
     await runGit(seed, ['commit', '-m', 'first']);
     await runGit(seed, ['push', upstream, BRANCH]);
-    const git = new GitService(stubWorkspaceService({ ws: workspaceDir }), stubWorkflowHooks(), 'knowledge-base');
+    const git = new GitService(stubWorkspaceService({ ws: workspaceDir }), stubWorkflowHooks(), testKbContext());
 
     await expect(git.syncFromRemote('ws')).rejects.toMatchObject({
       name: 'PullRebaseConflictError',

package/src/modules/workflow/git/__tests__/node-git-runner.test.ts

@@ -3,7 +3,7 @@ import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { NodeGitRunner } from '../node-git-runner.js';
-import { GitRunError, isGitTimeout } from '../../../../shared/git.contract.js';
+import { GitRunError, gitCredentials, isGitTimeout } from '../../../../shared/git.contract.js';
 
 /**
  * These run REAL git, like the rest of this module's suites: the behaviours
@@ -94,10 +94,48 @@ describe('NodeGitRunner', () => {
     expect(true).toBe(true);
   });
 
+  /**
+   * The helper the runner's callers stamp into a clone, reduced to the one
+   * thing under test here: what `$GITHUB_TOKEN` is in the child. `credential
+   * fill` runs it through git's own shell and prints what it answered, which
+   * is the same path a push takes to its password.
+   */
+  const ECHO_TOKEN_HELPER = `!f() { printf '%s\\n' "username=u" "password=\${GITHUB_TOKEN-none}"; }; f`;
+  const fill = (runner: NodeGitRunner, env?: NodeJS.ProcessEnv) =>
+    runner.run(dir, ['-c', `credential.helper=${ECHO_TOKEN_HELPER}`, 'credential', 'fill'], {
+      input: 'protocol=https\nhost=example.test\n\n',
+      env,
+    });
+
+  it('hands its token to the child, where the helper reads it, and never puts it in argv', async () => {
+    const runner = new NodeGitRunner(undefined, gitCredentials('x-access-token', 'ghp_child_secret'));
+    const { stdout } = await fill(runner);
+    expect(stdout).toContain('password=ghp_child_secret');
+  });
+
+  it('drops a token this process inherited: only the credentials in effect reach git', async () => {
+    const previous = process.env.GITHUB_TOKEN;
+    process.env.GITHUB_TOKEN = 'ghp_stale_in_process_env';
+    try {
+      const { stdout } = await fill(new NodeGitRunner());
+      expect(stdout).toContain('password=none');
+      expect(stdout).not.toContain('ghp_stale_in_process_env');
+    } finally {
+      if (previous === undefined) delete process.env.GITHUB_TOKEN;
+      else process.env.GITHUB_TOKEN = previous;
+    }
+  });
+
+  it('lets a per-call environment entry win over its own token: the setup probe checks the token it was given', async () => {
+    const runner = new NodeGitRunner(undefined, gitCredentials('x-access-token', 'ghp_in_effect'));
+    const { stdout } = await fill(runner, { GITHUB_TOKEN: 'ghp_being_checked' });
+    expect(stdout).toContain('password=ghp_being_checked');
+  });
+
   it('keeps the configured git token out of failures', async () => {
-    const runner = new NodeGitRunner();
+    const runner = new NodeGitRunner(undefined, gitCredentials('x-access-token', 'ghp_secret_value_here'));
     const previous = process.env.GITHUB_TOKEN;
-    process.env.GITHUB_TOKEN = 'ghp_secret_value_here';
+    delete process.env.GITHUB_TOKEN;
     try {
       const err = await runner
         .run(dir, ['ls-remote', 'https://x-access-token:ghp_secret_value_here@127.0.0.1:1/r.git'], {

package/src/modules/workflow/git/git.service.ts

@@ -26,9 +26,8 @@ import {
   assertValidRelativePath,
   isBranchAuthoredBy,
   isOwnSuggestionsBranch,
-  isProtectedBranch,
-  PROTECTED_BRANCHES,
 } from '../../kb-fs/branch-name.js';
+import type { KbContext } from '../../../shared/kb-context.js';
 import {
   BranchAuthorshipError,
   WorkflowDomainError,
@@ -42,6 +41,7 @@ import {
   GitRunError,
   isGitTimeout,
   redactGitToken,
+  type GitCredentials,
   type GitRunOptions,
   type GitRunResult,
   type IGitRunner,
@@ -296,7 +296,7 @@ export class GitService implements IGitService {
      * safe because validation is advisory and never blocks a commit.
      */
     private readonly hooks: WorkflowHooks,
-    private readonly kbDirName: string,
+    private readonly kb: KbContext,
     private readonly mutex: WorkspaceMutex = new WorkspaceMutex(),
     private readonly accessControl: IAccessControl | null = null,
     /**
@@ -309,6 +309,18 @@ export class GitService implements IGitService {
     private readonly gitRunner: IGitRunner = new NodeGitRunner(),
   ) {}
 
+  private get kbDirName(): string {
+    return this.kb.kbDirName;
+  }
+
+  /**
+   * The credentials the runner authenticates with — for the services above
+   * this one that scrub a message git or the host echoed a token into.
+   */
+  get credentials(): GitCredentials {
+    return this.gitRunner.credentials;
+  }
+
   /**
    * "Does the pending-commits queue hold rows for this workspace?" — used by
    * `statusInternal` to tell an expected dirty tree (queued saves still
@@ -552,7 +564,7 @@ export class GitService implements IGitService {
             );
             infos[i] = {
               name: row.shortName,
-              isProtected: isProtectedBranch(row.shortName),
+              isProtected: this.kb.isProtectedBranch(row.shortName),
               ahead,
               behind,
               hasRemote: row.hasRemote,
@@ -655,7 +667,7 @@ export class GitService implements IGitService {
     fromBase?: string,
   ): Promise<BranchInfo> {
     assertValidBranchName(name);
-    if (isProtectedBranch(name)) {
+    if (this.kb.isProtectedBranch(name)) {
       throw new ProtectedBranchError(name, 'creating a protected branch');
     }
     if (fromBase) assertValidBranchName(fromBase);
@@ -731,7 +743,7 @@ export class GitService implements IGitService {
     opts: { onlyIfNoRemote?: boolean; systemCleanup?: boolean } = {},
   ): Promise<void> {
     assertValidBranchName(name);
-    if (isProtectedBranch(name)) {
+    if (this.kb.isProtectedBranch(name)) {
       throw new ProtectedBranchError(name, 'deleting a protected branch');
     }
     return this.mutex.run(workspaceId, async () => {
@@ -895,7 +907,7 @@ export class GitService implements IGitService {
       // boundary. Without this guard, the standard "fork to draft then
       // propose" workflow would 403 for non-admins — they can't write
       // protected, can't write the draft they forked from it either.
-      if (isProtectedBranch(branch)) {
+      if (this.kb.isProtectedBranch(branch)) {
         // Gate against the access tree as it exists at HEAD — the pre-commit
         // state. Reading from the working tree would let the user broaden
         // their own access by editing access.md alongside the change they're
@@ -1172,7 +1184,7 @@ export class GitService implements IGitService {
       // Protected-branch access gate (defence in depth — callers already gate at
       // lock-acquire / upload-mint, but this primitive is generic). Gate every
       // touched path against the access tree at HEAD, like `commit()`.
-      if (isProtectedBranch(branch)) {
+      if (this.kb.isProtectedBranch(branch)) {
         await this.assertCanWriteAtRef(workspaceId, 'HEAD', user.email, touched);
       }
 
@@ -1292,7 +1304,7 @@ export class GitService implements IGitService {
       // decided the write is legitimate (unused name, exclusive create);
       // gating it here again just refuses every non-admin the product
       // promised a plugin to.
-      if (isProtectedBranch(branch) && !opts?.systemAuthorized) {
+      if (this.kb.isProtectedBranch(branch) && !opts?.systemAuthorized) {
         const touched = await this.unpushedTouchedPaths(cwd);
         await this.assertCanWriteAtRef(
           workspaceId,
@@ -1542,6 +1554,7 @@ export class GitService implements IGitService {
           throw new Error(
             `git merge failed without detectable conflicts: ${redactGitToken(
               err instanceof Error ? err.message : String(err),
+              this.credentials.token(),
             )}`,
           );
         }
@@ -2109,7 +2122,7 @@ export class GitService implements IGitService {
     return this.mutex.run(workspaceId, async () => {
       const cwd = await this.repoDir(workspaceId);
       let best: { base: string; ahead: number } | null = null;
-      for (const p of PROTECTED_BRANCHES) {
+      for (const p of this.kb.protectedBranches) {
         if (p === branch) continue;
         const res = await this.tryAheadBehind(cwd, branch, `origin/${p}`);
         if (res && (best === null || res.ahead < best.ahead)) {
@@ -3133,7 +3146,7 @@ export class GitService implements IGitService {
     }
 
     let best: { ahead: number; behind: number } | null = null;
-    for (const p of PROTECTED_BRANCHES) {
+    for (const p of this.kb.protectedBranches) {
       if (p === shortName) continue;
       const res = await this.tryAheadBehind(cwd, ref, `refs/remotes/origin/${p}`);
       if (res && (best === null || res.ahead < best.ahead)) best = res;
@@ -3447,5 +3460,3 @@ export function parseNumstatZ(out: string): NumstatEntry[] {
   }
   return entries;
 }
-
-export { PROTECTED_BRANCHES };

package/src/modules/workflow/git/node-git-runner.ts

@@ -1,7 +1,10 @@
 import { spawn, type ChildProcess, type SpawnOptions } from 'node:child_process';
 import {
+  GIT_TOKEN_ENV,
   GitRunError,
+  NO_GIT_CREDENTIALS,
   redactGitToken,
+  type GitCredentials,
   type GitRunOptions,
   type GitRunResult,
   type IGitRunner,
@@ -212,7 +215,33 @@ function spawnGit(args: string[], options: SpawnOptions & { maxBuffer: number })
  * `WorkspaceMutex`'s job and stays the caller's to have done.
  */
 export class NodeGitRunner implements IGitRunner {
-  constructor(readonly defaultTimeoutMs: number = DEFAULT_GIT_TIMEOUT_MS) {}
+  constructor(
+    readonly defaultTimeoutMs: number = DEFAULT_GIT_TIMEOUT_MS,
+    /**
+     * What every call authenticates with. The token goes into the CHILD's
+     * environment only (see {@link childEnv}); a runner built without one
+     * runs git unauthenticated, which is what a directly constructed service
+     * in a test gets.
+     */
+    readonly credentials: GitCredentials = NO_GIT_CREDENTIALS,
+  ) {}
+
+  /**
+   * The environment one invocation runs under. The token in effect goes in
+   * under {@link GIT_TOKEN_ENV}, and a stale one this process inherited from
+   * its own environment goes OUT: a server hosting several knowledge bases
+   * must never let one knowledge base's git call find another's token, or an
+   * operator's, lying in `process.env`. A caller's per-call entry still wins
+   * over the provider's (the setup probe runs with the token it is checking,
+   * not the one in effect), and the fixed entries win over everything.
+   */
+  private childEnv(overrides: NodeJS.ProcessEnv | undefined): NodeJS.ProcessEnv {
+    const env: NodeJS.ProcessEnv = { ...process.env };
+    delete env[GIT_TOKEN_ENV];
+    const token = this.credentials.token();
+    if (token) env[GIT_TOKEN_ENV] = token;
+    return { ...env, ...overrides, ...FIXED_ENV };
+  }
 
   run(cwd: string, args: string[], opts: GitRunOptions & { encoding: 'buffer' }): Promise<GitRunResult<Buffer>>;
   run(cwd: string, args: string[], opts?: GitRunOptions & { encoding?: 'utf8' }): Promise<GitRunResult>;
@@ -224,7 +253,7 @@ export class NodeGitRunner implements IGitRunner {
     try {
       const { promise: pending, child } = spawnGit(args, {
         cwd,
-        env: { ...process.env, ...opts.env, ...FIXED_ENV },
+        env: this.childEnv(opts.env),
         maxBuffer: MAX_OUTPUT_BYTES,
         // Makes the child a process-group leader so that `killTree` can signal
         // the transport helpers it spawns, not just git itself. Not on Windows,
@@ -291,9 +320,13 @@ export class NodeGitRunner implements IGitRunner {
           : Buffer.isBuffer(original.stderr)
             ? original.stderr.toString()
             : undefined;
-      throw new GitRunError(`git ${subcommand} failed: ${redactGitToken(message)}`, {
+      // Scrubbed with the token THIS runner handed the child, and the one a
+      // caller laid over it for the call: both can be echoed back by git.
+      const secrets = [this.credentials.token(), opts.env?.[GIT_TOKEN_ENV]];
+      const scrub = (text: string): string => secrets.reduce<string>((out, token) => redactGitToken(out, token), text);
+      throw new GitRunError(`git ${subcommand} failed: ${scrub(message)}`, {
         exitCode: typeof original.code === 'number' ? original.code : undefined,
-        stderr: stderr === undefined ? undefined : redactGitToken(stderr),
+        stderr: stderr === undefined ? undefined : scrub(stderr),
       });
     } finally {
       // Every timer is cleared on every path. The later ones in particular

package/src/modules/workflow/review-workflow/review-workflow.service.ts

@@ -18,6 +18,7 @@ import { changeRequests, prComments, prFileApprovals, prMergeLog, users } from '
 import { AccessUnreadableError } from '../../access-model/access-errors.js';
 import type { IAccessControl } from '../../access/access-control.interface.js';
 import type { GitService } from '../git/git.service.js';
+import { redactSecret } from '../../../shared/redact-secret.js';
 import {
   ChangeRequestConflictsError,
   WorkflowDomainError,
@@ -45,11 +46,13 @@ import {
 const MERGE_METHOD = 'merge' as const;
 const EVERYONE_CANONICAL = 'everyone';
 
-function redactTokens(msg: string): string {
-  const tokens = [process.env.GITHUB_TOKEN, process.env.GH_TOKEN].filter(
-    (t): t is string => !!t && t.length > 0,
-  );
-  return tokens.reduce((m, t) => m.replaceAll(t, '***'), msg);
+/**
+ * Redact a git token from an error string before it is stored: the one the
+ * knowledge base's runner authenticates with, plus whatever the environment
+ * holds (`redactSecret` names those itself).
+ */
+function redactTokens(msg: string, token: string | null | undefined): string {
+  return redactSecret(msg, [token]);
 }
 
 class CommentAuthError extends WorkflowDomainError {
@@ -743,7 +746,7 @@ export class ReviewWorkflowService implements IReviewWorkflowService {
         user,
       );
     } catch (err) {
-      const redacted = redactTokens(err instanceof Error ? err.message : String(err));
+      const redacted = redactTokens(err instanceof Error ? err.message : String(err), this.git.credentials?.token());
       await this.db
         .update(prMergeLog)
         .set({ succeeded: false, completedAt: new Date(), error: redacted })

package/src/modules/workflow/session-ontology.service.ts

@@ -33,6 +33,7 @@
 
 import { eq, lt } from 'drizzle-orm';
 import { ontologyOf } from '../../shared/kb-layout.js';
+import type { KbContext } from '../../shared/kb-context.js';
 
 import type { Database } from '../database/connection.js';
 import { sessionOntologyTouches } from '../database/schema.js';
@@ -77,7 +78,11 @@ export class SessionOntologyService implements ISessionOntologyService {
    */
   private readonly locks = new WorkspaceMutex();
 
-  constructor(private readonly db: Database) {}
+  constructor(
+    private readonly db: Database,
+    /** Names the knowledge-base root a path is classified under; read per call. */
+    private readonly kb: Pick<KbContext, 'layout'>,
+  ) {}
 
   /**
    * Resolve `wsPath` to its ontology and evaluate/record the operation. Thin
@@ -89,7 +94,7 @@ export class SessionOntologyService implements ISessionOntologyService {
     isWrite: boolean,
     kbDirName?: string,
   ): Promise<OperationDecision> {
-    return this.checkOntology(sessionId, ontologyOf(wsPath, kbDirName), isWrite);
+    return this.checkOntology(sessionId, ontologyOf(wsPath, this.kb.layout, kbDirName), isWrite);
   }
 
   /**

package/src/modules/workflow/workflow.service.ts

@@ -57,16 +57,16 @@ import type {
   RemoteSyncPullResult,
 } from '@bevel-software/platform-shared';
 import {
-  isProtectedBranch,
-  DEFAULT_BRANCH,
   isFolderPlaceholder,
   folderPlaceholderPath,
   isPlatformRestoreShape,
 } from '@bevel-software/platform-shared';
+import type { KbContext } from '../../shared/kb-context.js';
 import { and, eq, inArray, isNotNull, isNull, lt, or } from 'drizzle-orm';
 import type { Database } from '../database/connection.js';
 import { changeRequests } from '../database/schema.js';
 import type { GitService } from './git/git.service.js';
+import { redactSecret } from '../../shared/redact-secret.js';
 import type { PullRequestService } from './git/pull-request.service.js';
 import type { IReviewWorkflowService } from './review-workflow/review-workflow.interface.js';
 import type { WorkspaceService } from '../workspace/workspace.service.js';
@@ -156,12 +156,13 @@ export function syncConflictMessage(branch: string, conflictedPaths: string[]):
 /** How many conflicted files the sync-conflict sentence names before "and N more". */
 const SYNC_CONFLICT_FILES_NAMED = 3;
 
-/** Redact the shared GitHub token from any error string before surfacing it. */
-function redactTokens(msg: string): string {
-  const tokens = [process.env.GITHUB_TOKEN, process.env.GH_TOKEN].filter(
-    (t): t is string => !!t && t.length > 0,
-  );
-  return tokens.reduce((m, t) => m.replaceAll(t, '***'), msg);
+/**
+ * Redact a git token from an error string before surfacing it: the one the
+ * knowledge base's runner authenticates with, plus whatever the environment
+ * holds (`redactSecret` names those itself).
+ */
+function redactTokens(msg: string, token: string | null | undefined): string {
+  return redactSecret(msg, [token]);
 }
 
 /**
@@ -275,6 +276,10 @@ export class WorkflowService implements IWorkflowService {
    * implementation detail of the workflow auto-merge story; nothing outside
    * the facade should call it directly.
    */
+  private get kbDirName(): string {
+    return this.kb.kbDirName;
+  }
+
   constructor(
     private readonly db: Database,
     private readonly git: GitService,
@@ -291,7 +296,7 @@ export class WorkflowService implements IWorkflowService {
      * See `lock-decoupling-plan.md` for the full design.
      */
     private readonly pendingCommits: PendingCommitsService,
-    private readonly kbDirName: string,
+    private readonly kb: KbContext,
     /**
      * The read-before-write gate `acquireLock` asks on every branch (see
      * `access-model/change-gate.ts`). Required, and checked at construction:
@@ -419,7 +424,7 @@ export class WorkflowService implements IWorkflowService {
     fn: () => Promise<T>,
   ): Promise<T> {
     const keys = [`branch:${source}`];
-    if (!isProtectedBranch(target)) keys.push(`branch:${target}`);
+    if (!this.kb.isProtectedBranch(target)) keys.push(`branch:${target}`);
     return this.branchLifecycle.runAll(keys, fn);
   }
 
@@ -573,8 +578,9 @@ export class WorkflowService implements IWorkflowService {
    */
   private async pullWorkspace(workspaceId: string): Promise<boolean> {
     const { treeChanged } = await this.git.pull(workspaceId);
-    if (treeChanged && branchForWorkspaceId(workspaceId) === DEFAULT_BRANCH) {
-      this.events?.emit({ kind: 'fs-tree-changed', workspaceId, branch: DEFAULT_BRANCH });
+    const defaultBranch = this.kb.defaultBranch;
+    if (treeChanged && branchForWorkspaceId(workspaceId) === defaultBranch) {
+      this.events?.emit({ kind: 'fs-tree-changed', workspaceId, branch: defaultBranch });
       return true;
     }
     return false;
@@ -961,7 +967,7 @@ export class WorkflowService implements IWorkflowService {
     // future caller can make that claim by passing a flag.
     if (
       typeof platformRestore?.source === 'string' &&
-      isPlatformRestoreShape(toRepoRelative(platformRestore.source), repoRelative) &&
+      isPlatformRestoreShape(toRepoRelative(platformRestore.source), repoRelative, this.kb.layout) &&
       (await this.accessControl.canRestorePlatformFile(workspaceId, userEmail, repoRelative))
     ) {
       return 'restore';
@@ -1037,7 +1043,7 @@ export class WorkflowService implements IWorkflowService {
     // coordination hold as write possession (see those methods).
     if (!opts?.coordination) {
       let via: 'granted' | 'restore' = 'granted';
-      if (isProtectedBranch(branch)) {
+      if (this.kb.isProtectedBranch(branch)) {
         // `assertCanWriteAtPath` throws AccessDeniedError on denial, with the
         // eligible-writers payload so the frontend can render a useful refusal.
         via = await this.assertCanWriteAtPath(
@@ -1321,7 +1327,8 @@ export class WorkflowService implements IWorkflowService {
     branch: string,
     targetPath: string,
     user: AuthUser,
-    opts?: { systemAuthorized?: boolean; skipValidation?: boolean },
+    /** `summary` overrides the path-derived commit subject; see `commitFile`. */
+    opts?: { systemAuthorized?: boolean; skipValidation?: boolean; summary?: string },
   ): Promise<void> {
     // `skipValidation` is the worker telling us this commit is not the last of
     // a burst. The validator is advisory — it parses the whole KB to produce a
@@ -1332,7 +1339,7 @@ export class WorkflowService implements IWorkflowService {
       workspaceId,
       user,
       targetPath,
-      undefined,
+      opts?.summary,
       opts?.skipValidation,
     );
     if (!change) {
@@ -1759,7 +1766,7 @@ export class WorkflowService implements IWorkflowService {
       throw new WorkflowValidationError('source and target branches must differ');
     }
     if (!input.title?.trim()) throw new WorkflowValidationError('title is required');
-    if (isProtectedBranch(input.sourceBranch)) {
+    if (this.kb.isProtectedBranch(input.sourceBranch)) {
       throw new WorkflowValidationError(
         `Cannot open a change request *from* a protected branch ("${input.sourceBranch}").`,
         { kind: 'source-is-protected', sourceBranch: input.sourceBranch },
@@ -1897,7 +1904,7 @@ export class WorkflowService implements IWorkflowService {
       // up-to-date) auto-merge, and inserts the row.
       const rawMsg = err instanceof Error ? err.message : String(err);
       throw new WorkflowValidationError(
-        `Failed to open change request: ${redactTokens(rawMsg)}`,
+        `Failed to open change request: ${redactTokens(rawMsg, this.git.credentials?.token())}`,
         { kind: 'open-change-request-failed' },
       );
     }
@@ -2851,7 +2858,7 @@ export class WorkflowService implements IWorkflowService {
 
     let live: Set<string>;
     try {
-      const branches = await this.git.listBranches(workspaceIdForBranch(DEFAULT_BRANCH), {
+      const branches = await this.git.listBranches(this.kb.defaultWorkspaceId(), {
         freshFetch: true,
         // The list is used to PROVE absence, and the listing's normal
         // degrade-to-stale behaviour would report every branch created since
@@ -3166,8 +3173,8 @@ export class WorkflowService implements IWorkflowService {
     // outright if it disagrees with the request's own base.) The failure the
     // pull reports is about OTHER people's commits not arriving, which leaves
     // the catalogs no staler than they were.
-    if (!announced && targetWorkspaceId && targetBranch === DEFAULT_BRANCH) {
-      this.events?.emit({ kind: 'fs-tree-changed', workspaceId: targetWorkspaceId, branch: DEFAULT_BRANCH });
+    if (!announced && targetWorkspaceId && targetBranch === this.kb.defaultBranch) {
+      this.events?.emit({ kind: 'fs-tree-changed', workspaceId: targetWorkspaceId, branch: targetBranch });
     }
   }
 
@@ -3234,7 +3241,7 @@ export class WorkflowService implements IWorkflowService {
           // change request's merge, nothing strips it here — so its presence
           // is what the hook refuses on) and both sides of a rename, since the
           // old name is a file this merge deletes.
-          authorize: isProtectedBranch(targetBranch)
+          authorize: this.kb.isProtectedBranch(targetBranch)
             ? async ({ sha, changedPaths }) => {
                 if (changedPaths.length === 0) return;
                 // roles.yaml never changes through a merge. A change request's
@@ -3445,7 +3452,7 @@ export class WorkflowService implements IWorkflowService {
         .where(eq(changeRequests.number, number))
         .limit(1);
       const sourceBranch = rows[0]?.sourceBranch;
-      if (!sourceBranch || isProtectedBranch(sourceBranch)) return;
+      if (!sourceBranch || this.kb.isProtectedBranch(sourceBranch)) return;
       // The open-check and the deletion hold the branch's lifecycle lock
       // TOGETHER — `openChangeRequest` holds the same lock across its own
       // check-then-insert, so a request being opened from this branch either
@@ -3620,7 +3627,7 @@ export class WorkflowService implements IWorkflowService {
       return stdout.split('\n').map((s) => s.trim()).filter(Boolean);
     } catch (err) {
       log.warn('listChangedPathsBetweenBranches failed:', {
-        detail: redactTokens(err instanceof Error ? err.message : String(err)),
+        detail: redactTokens(err instanceof Error ? err.message : String(err), this.git.credentials?.token()),
       });
       return [];
     }

package/src/modules/workspace/__tests__/file-stat-access.test.ts

@@ -4,6 +4,7 @@ import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import express from 'express';
 import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 import { LocalFilesystem } from '@mastra/core/workspace';
 import { ToolRegistry } from '../../tool-registry/tool-registry.js';
 import { createToolHandlerFactory } from '../../tool-helpers/tool-handler.js';
@@ -86,8 +87,8 @@ beforeAll(async () => {
     new SpillStore(join(tmpdir(), 'bevel-test-spills')),
     new DocExtractService(docCache),
     service,
-    KB,
-    { service: {} as never, enabled: false, kbDirName: KB, recoveryBotEmail: 'recovery-bot@bevel.local', hooks: new WorkflowHooks() },
+    testKbContext({ kbDirName: KB }),
+    { service: {} as never, enabled: false, kb: testKbContext({ kbDirName: KB }), recoveryBotEmail: 'recovery-bot@bevel.local', hooks: new WorkflowHooks() },
     new RoutineWritePolicyService(),
     {} as never,
   );