@bevel-software/platform-core-backend 0.20.0 → 0.21.0

package/src/modules/plugins/plugins.routes.ts

@@ -13,7 +13,8 @@ import {
 import type { IAccessControl } from '../access/access-control.interface.js';
 import { WorkflowDomainError } from '../../shared/domain-errors.js';
 import { domainErrorBody } from '../../shared/http-errors.js';
-import { pluginsWorkspaceId, pluginFolderBelowRoot } from './plugins.service.js';
+import { pluginFolderBelowRoot } from './plugins.service.js';
+import type { KbContext } from '../../shared/kb-context.js';
 import { PluginProvisionError, type PluginProvisionService } from './plugin-provision.service.js';
 import { PluginLinkError, type PluginLinksService } from './plugin-links.service.js';
 import { PluginRenameError, type PluginRenameService } from './plugin-rename.service.js';
@@ -159,6 +160,8 @@ export function createPluginsRoutes(
   joinRequestJobs: PluginJoinRequestJobs,
   provision: PluginProvisionService,
   resolveUser: (req: express.Request) => Promise<AuthUser | null>,
+  /** The released branch's clone — every verdict here is read from it. */
+  kb: Pick<KbContext, 'defaultWorkspaceId'>,
   /** Optional: a host without the link machinery simply has no link routes. */
   links?: PluginLinksService,
   /** Optional: a host without it has no rename route. */
@@ -209,11 +212,30 @@ export function createPluginsRoutes(
    *   POST   /api/plugins/:name/links          { skillPath }  → { root, skills }
    *   DELETE /api/plugins/:name/links?skillPath=              → { root, revoked }
    *   POST   /api/plugins/:name/links/repair   { skillPath }  → { root }
+   *   POST   /api/plugins/:name/links/repair-all              → { repaired, skipped }
    *
    * Refusals carry a `kind` the UI branches on — `needs-skill-write` (409) is
    * the one that becomes "request write access".
+   *
+   * `repair-all` is the plugin PAGE's: it repairs every link of the plugin the
+   * caller can, and reports what it could not. A caller who may not write the
+   * plugin gets the same 404 every other link route gives them, so probing it
+   * confirms nothing about a plugin they cannot see.
    */
   if (links) {
+    /** The one refusal mapping every link route answers with. */
+    const linkFailure = (res: express.Response, err: unknown) => {
+      if (err instanceof PluginLinkError) {
+        res.status(err.status).json({ error: err.message, ...err.payload });
+        return;
+      }
+      if (err instanceof WorkflowDomainError) {
+        res.status(err.status).json(domainErrorBody(err));
+        return;
+      }
+      log.error('link operation failed:', { err });
+      res.status(500).json({ error: 'Failed to update the plugin\'s links' });
+    };
     const linkOp = async (
       req: express.Request,
       res: express.Response,
@@ -237,16 +259,7 @@ export function createPluginsRoutes(
       try {
         res.json(await op(user, String(req.params.name), skillPath));
       } catch (err) {
-        if (err instanceof PluginLinkError) {
-          res.status(err.status).json({ error: err.message, ...err.payload });
-          return;
-        }
-        if (err instanceof WorkflowDomainError) {
-          res.status(err.status).json(domainErrorBody(err));
-          return;
-        }
-        log.error('link operation failed:', { err });
-        res.status(500).json({ error: 'Failed to update the plugin\'s links' });
+        linkFailure(res, err);
       }
     };
     const bodyPath = (req: express.Request) => ((req.body ?? {}) as { skillPath?: unknown }).skillPath;
@@ -254,6 +267,23 @@ export function createPluginsRoutes(
     router.post('/plugins/:name/links/repair', (req, res) =>
       linkOp(req, res, (u, p, s) => links.repair(u, p, s), bodyPath),
     );
+    // No `skillPath`: this one is about the plugin, so it cannot ride `linkOp`.
+    router.post('/plugins/:name/links/repair-all', async (req, res) => {
+      if (!req.userEmail) {
+        res.status(401).json({ error: 'Unauthenticated' });
+        return;
+      }
+      const user = await resolveUser(req);
+      if (!user) {
+        res.status(401).json({ error: 'Unauthenticated' });
+        return;
+      }
+      try {
+        res.json(await links.repairAll(user, String(req.params.name)));
+      } catch (err) {
+        linkFailure(res, err);
+      }
+    });
     router.delete('/plugins/:name/links', (req, res) =>
       linkOp(req, res, (u, p, s) => links.unlink(u, p, s), (r) => r.query.skillPath),
     );
@@ -296,7 +326,7 @@ export function createPluginsRoutes(
         res.json({ plugins: [] });
         return;
       }
-      const wsId = pluginsWorkspaceId();
+      const wsId = kb.defaultWorkspaceId();
       const probes = probesFor(catalog);
       const [readable, writable, owned] = await Promise.all([
         accessControl.canReadBatch(wsId, email, probes),
@@ -453,7 +483,7 @@ export function createPluginsRoutes(
       }
       // By identity — the manifest name the catalog keys on.
       const plugin = (await pluginIndex.catalog()).find((g) => g.name === req.params.name);
-      const wsId = pluginsWorkspaceId();
+      const wsId = kb.defaultWorkspaceId();
       const ownerVerdicts = plugin
         ? await Promise.all(
             plugin.folders.map((f) => accessControl.canOwner(wsId, email, memberProbe(f))),
@@ -494,7 +524,7 @@ export function createPluginsRoutes(
       const catalog = await pluginIndex.catalog();
       // By identity — the manifest name the catalog keys on.
       const plugin = catalog.find((g) => g.name === req.params.name);
-      const wsId = pluginsWorkspaceId();
+      const wsId = kb.defaultWorkspaceId();
       // Same ANY-folder shape `GET /plugins` resolves with, so a plugin can
       // never be listed as discoverable there and rejected as unknown here.
       const verdicts = plugin
@@ -567,7 +597,7 @@ export function createPluginsRoutes(
       return null;
     }
     const writable = await accessControl.canWriteBatch(
-      pluginsWorkspaceId(),
+      kb.defaultWorkspaceId(),
       email,
       plugin.folders.map(accessMdOf),
     );

package/src/modules/plugins/plugins.service.ts

@@ -3,13 +3,10 @@ import { logger } from '../../shared/logging.js';
 
 const log = logger('plugins');
 import path from 'node:path';
-import {
-  DEFAULT_BRANCH,
-} from '@bevel-software/platform-shared';
 import { isPrivateAccessMd } from '../access-model/access-grammar.js';
 import { isAbsence } from '../../shared/fs.contract.js';
 import type { WorkspaceService } from '../workspace/workspace.service.js';
-import { workspaceIdForBranch } from '../../shared/workspace-id.js';
+import type { KbContext } from '../../shared/kb-context.js';
 import type { IAccessControl } from '../access/access-control.interface.js';
 import type { ISkillService } from '../skills/skills.contract.js';
 import type { IToolManualService } from '../tool-manuals/tool-manuals.contract.js';
@@ -63,7 +60,7 @@ export class PluginIndexService implements IPluginIndexService {
     private readonly accessControl: IAccessControl,
     private readonly skillService: ISkillService,
     private readonly toolManualService: IToolManualService,
-    private readonly kbDirName: string,
+    private readonly kb: KbContext,
     /** Where plugins come from — the one discovery every catalog shares. */
     private readonly source: PluginSource,
     now: () => number = Date.now,
@@ -77,6 +74,10 @@ export class PluginIndexService implements IPluginIndexService {
     this.cache = new TtlCache(CACHE_TTL_MS, now);
   }
 
+  private get kbDirName(): string {
+    return this.kb.kbDirName;
+  }
+
   invalidate(): void {
     this.cache.invalidate();
   }
@@ -115,7 +116,7 @@ export class PluginIndexService implements IPluginIndexService {
    */
   private async build(): Promise<PluginCatalogEntry[] | null> {
     try {
-      const wsId = (await this.workspaceService.getOrCreateForBranch(DEFAULT_BRANCH)).id;
+      const wsId = (await this.workspaceService.getOrCreateForBranch(this.kb.defaultBranch)).id;
       const kbRoot = path.join(await this.workspaceService.getWorkspacePath(wsId), this.kbDirName);
 
       const scanned = await this.scanFolders(kbRoot);
@@ -301,11 +302,6 @@ function bucketByFolder(items: { path: string }[], folders: Map<string, string[]
   return counts;
 }
 
-/** The default-branch workspace id every plugin resolution runs against. */
-export function pluginsWorkspaceId(): string {
-  return workspaceIdForBranch(DEFAULT_BRANCH);
-}
-
 /**
  * A plugin folder's path BELOW the plugins root: `GTM`, or `teams/deep`.
  *

package/src/modules/plugins/teams.routes.ts

@@ -2,12 +2,17 @@ import express from 'express';
 import { logger } from '../../shared/logging.js';
 
 const log = logger('teams');
-import { isPersonalPluginDir, isPersonalPluginFolder, pluginOfPath } from '@bevel-software/platform-shared';
+import {
+  isPersonalPluginDir,
+  isPersonalPluginFolder,
+  pluginOfPath,
+  type KbLayout,
+} from '@bevel-software/platform-shared';
 import type { IAccessControl } from '../access/access-control.interface.js';
+import type { KbContext } from '../../shared/kb-context.js';
 import type { ISkillService } from '../skills/skills.contract.js';
 import type { IToolManualService } from '../tool-manuals/tool-manuals.contract.js';
 import type { IPluginIndexService, PluginCatalogEntry } from './plugins.contract.js';
-import { pluginsWorkspaceId } from './plugins.service.js';
 
 /**
  * What one team can use, by id — the Library's "Your teams" lens.
@@ -51,6 +56,8 @@ export function createTeamsRoutes(
   pluginIndex: IPluginIndexService,
   skillService: Pick<ISkillService, 'listSkills'>,
   toolManuals: Pick<IToolManualService, 'listAllSummaries'>,
+  /** The released branch's clone the verdicts are read from, and the layout that names the plugins root. */
+  kb: Pick<KbContext, 'defaultWorkspaceId' | 'layout'>,
 ): express.Router {
   const router = express.Router();
 
@@ -61,7 +68,7 @@ export function createTeamsRoutes(
       return;
     }
     try {
-      const wsId = pluginsWorkspaceId();
+      const wsId = kb.defaultWorkspaceId();
       const [{ groups }, catalog, allSkills, allTools] = await Promise.all([
         accessControl.kbPrincipals(wsId),
         pluginIndex.catalog(),
@@ -73,9 +80,10 @@ export function createTeamsRoutes(
       // be a team's to read — whatever a hand-written grant in there says.
       // One rule for the plugin and for its contents, so the two cannot
       // disagree.
-      const plugins = catalog.filter((g) => !g.folders.every(isPersonalPluginDir));
-      const skills = allSkills.filter((s) => !inPersonalPlugin(s.path));
-      const tools = allTools.filter((t) => !inPersonalPlugin(t.path));
+      const layout = kb.layout;
+      const plugins = catalog.filter((g) => !g.folders.every((f) => isPersonalPluginDir(f, layout)));
+      const skills = allSkills.filter((s) => !inPersonalPlugin(s.path, layout));
+      const tools = allTools.filter((t) => !inPersonalPlugin(t.path, layout));
       const folderProbes = plugins.flatMap((g) => g.folders);
       const discoverProbes = folderProbes.map(accessMdOf);
       const skillProbes = skills.map((s) => skillMdOf(s.path));
@@ -123,7 +131,7 @@ export function createTeamsRoutes(
 const accessMdOf = (folder: string) => `${folder}/access.md`;
 const skillMdOf = (skillPath: string) => `${skillPath}/SKILL.md`;
 /** Under `Plugins/personal-<id>/…` — one person's space, whatever it grants. */
-const inPersonalPlugin = (repoPath: string) => {
-  const folder = pluginOfPath(repoPath);
+const inPersonalPlugin = (repoPath: string, layout: KbLayout) => {
+  const folder = pluginOfPath(repoPath, layout);
   return folder !== null && isPersonalPluginFolder(folder);
 };

package/src/modules/secrets-vault/__tests__/connect-pending.route.test.ts

@@ -2,6 +2,7 @@ import type { Server as HttpServer } from 'node:http';
 import express from 'express';
 import { afterEach, describe, expect, it } from 'vitest';
 import { createSecretsVaultRoutes } from '../secrets-vault.routes.js';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 
 /**
  * The aggregated `/connect/pending` surface: everything standing between the
@@ -85,6 +86,7 @@ async function baseUrlWith(auth: { userId?: string; email?: string }): Promise<s
   app.use(
     '/api',
     createSecretsVaultRoutes({
+      kb: testKbContext(),
       secretsVault,
       toolManualService,
       accessControl,
@@ -170,6 +172,7 @@ describe('GET /api/connect/pending — the workspace tier', () => {
     app.use(
       '/api',
       createSecretsVaultRoutes({
+      kb: testKbContext(),
         secretsVault: {
           statusFor: async (_u: string, keys: string[]) =>
             keys.map((key) => ({
@@ -258,6 +261,7 @@ describe('GET /api/connect/pending — readability', () => {
     app.use(
       '/api',
       createSecretsVaultRoutes({
+      kb: testKbContext(),
         secretsVault: {
           statusFor: async (_u: string, keys: string[]) =>
             keys.map((key) => ({
@@ -384,6 +388,7 @@ describe('GET /api/connect/pending — OAuth scope coverage', () => {
     app.use(
       '/api',
       createSecretsVaultRoutes({
+      kb: testKbContext(),
         secretsVault: vaultWithGranted(grantedScopes),
         toolManualService: oauthTool,
         accessControl,
@@ -478,6 +483,7 @@ describe('GET /api/connect/pending — tool sign-ins are not double-listed as st
     app.use(
       '/api',
       createSecretsVaultRoutes({
+      kb: testKbContext(),
         secretsVault: vault,
         toolManualService: oauthTool,
         accessControl,
@@ -538,6 +544,7 @@ describe('GET /api/connect/pending — a row of the wrong KIND is not "set up"',
     app.use(
       '/api',
       createSecretsVaultRoutes({
+      kb: testKbContext(),
         secretsVault: {
           statusFor: async (_u: string, keys: string[]) => keys.map(opts.status),
           list: async () => [],

package/src/modules/secrets-vault/__tests__/secrets-variable-loader.test.ts

@@ -1,7 +1,11 @@
 import { describe, test, expect } from 'vitest';
+import { UtcpClientConfigSerializer } from '@utcp/sdk';
 import {
   BevelSecretsVariableLoader,
+  DEFAULT_SECRETS_SCOPE,
+  bevelSecretsLoaderConfig,
   registerBevelSecretsVariableLoader,
+  unregisterBevelSecretsVariableLoader,
 } from '../secrets-variable-loader.js';
 import type { ISecretsVaultService } from '../secrets-vault.contract.js';
 
@@ -51,4 +55,40 @@ describe('BevelSecretsVariableLoader', () => {
     const loader = new BevelSecretsVariableLoader('');
     expect(await loader.get('m_X')).toBeNull();
   });
+
+  test('two knowledge bases in one process resolve the same user and key from their own vaults', async () => {
+    // One process, two vaults, one user id in each (ids are only unique
+    // within a knowledge base): a loader reads the vault registered under
+    // ITS scope, and a scope nobody registered resolves nothing.
+    registerBevelSecretsVariableLoader(fakeVault('user-1', { weather_WEATHER_KEY: 'sk-acme' }), 'acme');
+    registerBevelSecretsVariableLoader(fakeVault('user-1', { weather_WEATHER_KEY: 'sk-globex' }), 'globex');
+    expect(await new BevelSecretsVariableLoader('user-1', 'acme').get('weather_WEATHER_KEY')).toBe('sk-acme');
+    expect(await new BevelSecretsVariableLoader('user-1', 'globex').get('weather_WEATHER_KEY')).toBe('sk-globex');
+    expect(await new BevelSecretsVariableLoader('user-1', 'nobody').get('weather_WEATHER_KEY')).toBeNull();
+  });
+
+  test('the descriptor round-trips the scope through the serializer registry', async () => {
+    registerBevelSecretsVariableLoader(fakeVault('user-1', { weather_WEATHER_KEY: 'sk-acme' }), 'acme');
+    const config = new UtcpClientConfigSerializer().validateDict({
+      variables: {},
+      load_variables_from: [bevelSecretsLoaderConfig('user-1', 'acme')],
+    });
+    const [loader] = config.load_variables_from as BevelSecretsVariableLoader[];
+    expect(loader.scope).toBe('acme');
+    expect(await loader.get('weather_WEATHER_KEY')).toBe('sk-acme');
+    // Without a scope the descriptor names the single knowledge base's.
+    const [plain] = new UtcpClientConfigSerializer().validateDict({
+      variables: {},
+      load_variables_from: [bevelSecretsLoaderConfig('user-1')],
+    }).load_variables_from as BevelSecretsVariableLoader[];
+    expect(plain.scope).toBe(DEFAULT_SECRETS_SCOPE);
+  });
+
+  test('unregistering a scope makes its loaders resolve nothing', async () => {
+    registerBevelSecretsVariableLoader(fakeVault('user-1', { weather_WEATHER_KEY: 'sk-acme' }), 'evicted');
+    const loader = new BevelSecretsVariableLoader('user-1', 'evicted');
+    expect(await loader.get('weather_WEATHER_KEY')).toBe('sk-acme');
+    unregisterBevelSecretsVariableLoader('evicted');
+    expect(await loader.get('weather_WEATHER_KEY')).toBeNull();
+  });
 });

package/src/modules/secrets-vault/__tests__/tool-owner-gate.route.test.ts

@@ -2,6 +2,7 @@ import type { Server as HttpServer } from 'node:http';
 import express from 'express';
 import { afterEach, describe, expect, it, vi } from 'vitest';
 import { createSecretsVaultRoutes } from '../secrets-vault.routes.js';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 
 /**
  * THE OWNER GATE: a tool's shared (admin) secrets — plain values and OAuth
@@ -91,6 +92,7 @@ async function baseUrlAs(email: string): Promise<string> {
   app.use(
     '/api',
     createSecretsVaultRoutes({
+      kb: testKbContext(),
       secretsVault,
       toolManualService,
       accessControl,

package/src/modules/secrets-vault/index.ts

@@ -21,6 +21,8 @@ export {
 } from './secrets-vault.contract.js';
 export {
   registerBevelSecretsVariableLoader,
+  unregisterBevelSecretsVariableLoader,
   bevelSecretsLoaderConfig,
   BEVEL_SECRETS_LOADER_TYPE,
+  DEFAULT_SECRETS_SCOPE,
 } from './secrets-variable-loader.js';

package/src/modules/secrets-vault/secrets-variable-loader.ts

@@ -18,29 +18,43 @@ const log = logger('secrets-vault');
  * The `UtcpClient.create` path re-validates the whole config through the
  * serializer registry, so a loader can't be handed in as a bare live object — it
  * must round-trip through a registered serializer. We therefore put a plain
- * descriptor `{ variable_loader_type, user_id }` in `load_variables_from` (via
- * {@link bevelSecretsLoaderConfig}) and let the registered serializer rebuild a
- * live loader bound to the process-wide vault. Swapping the vault backend (e.g.
- * to a client's external secret manager) is just a different
- * `ISecretsVaultService` passed to {@link registerBevelSecretsVariableLoader}.
+ * descriptor `{ variable_loader_type, user_id, scope }` in `load_variables_from`
+ * (via {@link bevelSecretsLoaderConfig}) and let the registered serializer
+ * rebuild a live loader bound to the vault registered under that scope.
+ *
+ * ONE VAULT PER SCOPE, NOT PER PROCESS. The serializer registry is UTCP's and
+ * process-wide, but a process can host several knowledge bases, each with a
+ * vault of its own, and a user id is only unique within one of them. So the
+ * descriptor names the scope its vault was registered under, and a loader
+ * reads through that vault alone: two knowledge bases whose users both stored
+ * `weather_WEATHER_KEY` never see each other's value. A single-tenant
+ * deployment registers under {@link DEFAULT_SECRETS_SCOPE} and names nothing.
+ * Swapping the vault backend (e.g. to a client's external secret manager) is
+ * just a different `ISecretsVaultService` passed to
+ * {@link registerBevelSecretsVariableLoader}.
  */
 export const BEVEL_SECRETS_LOADER_TYPE = 'bevel_secrets';
 
+/** The scope a deployment that hosts one knowledge base registers under. */
+export const DEFAULT_SECRETS_SCOPE = 'default';
+
 /**
- * Process-wide vault the reconstructed loaders read through. Set once at
- * composition time (before any client is built) so the serializer — which only
- * receives a plain dict — can bind live loaders to it.
+ * The vaults the reconstructed loaders read through, by scope. A composition
+ * root registers its vault before any client is built; a graph that is torn
+ * down unregisters it so a stale descriptor resolves nothing.
  */
-let sharedSecretsVault: ISecretsVaultService | null = null;
+const vaults = new Map<string, ISecretsVaultService>();
 
 export class BevelSecretsVariableLoader implements VariableLoader {
   readonly variable_loader_type = BEVEL_SECRETS_LOADER_TYPE;
   readonly user_id: string;
+  readonly scope: string;
   // VariableLoader is an open shape; allow arbitrary extra props.
   [key: string]: unknown;
 
-  constructor(userId: string) {
+  constructor(userId: string, scope: string = DEFAULT_SECRETS_SCOPE) {
     this.user_id = userId;
+    this.scope = scope;
   }
 
   /**
@@ -52,9 +66,10 @@ export class BevelSecretsVariableLoader implements VariableLoader {
    * harvest a secret the user configured for a different manual.
    */
   async get(effectiveKey: string): Promise<string | null> {
-    if (!sharedSecretsVault || !this.user_id) return null;
+    const vault = vaults.get(this.scope);
+    if (!vault || !this.user_id) return null;
     try {
-      return await sharedSecretsVault.resolve(this.user_id, effectiveKey);
+      return await vault.resolve(this.user_id, effectiveKey);
     } catch (err) {
       // Log the fault so a backend failure is distinguishable from a merely
       // unset secret (resolve returning null) when troubleshooting.
@@ -66,15 +81,18 @@ export class BevelSecretsVariableLoader implements VariableLoader {
 
 class BevelSecretsVariableLoaderSerializer extends Serializer<VariableLoader> {
   toDict(obj: VariableLoader): Record<string, unknown> {
+    const loader = obj as BevelSecretsVariableLoader;
     return {
       variable_loader_type: BEVEL_SECRETS_LOADER_TYPE,
-      user_id: (obj as BevelSecretsVariableLoader).user_id ?? '',
+      user_id: loader.user_id ?? '',
+      scope: loader.scope ?? DEFAULT_SECRETS_SCOPE,
     };
   }
 
   validateDict(obj: Record<string, unknown>): VariableLoader {
     const userId = typeof obj.user_id === 'string' ? obj.user_id : '';
-    return new BevelSecretsVariableLoader(userId);
+    const scope = typeof obj.scope === 'string' && obj.scope ? obj.scope : DEFAULT_SECRETS_SCOPE;
+    return new BevelSecretsVariableLoader(userId, scope);
   }
 }
 
@@ -91,14 +109,26 @@ VariableLoaderSerializer.registerVariableLoader(
 );
 
 /**
- * Bind the process-wide vault the reconstructed loaders read through. Called
- * once at composition time; before it runs, loaders resolve to null.
+ * Bind the vault the loaders of `scope` read through. Called once per
+ * knowledge base at composition time; before it runs, loaders of that scope
+ * resolve to null.
  */
-export function registerBevelSecretsVariableLoader(secretsVault: ISecretsVaultService): void {
-  sharedSecretsVault = secretsVault;
+export function registerBevelSecretsVariableLoader(
+  secretsVault: ISecretsVaultService,
+  scope: string = DEFAULT_SECRETS_SCOPE,
+): void {
+  vaults.set(scope, secretsVault);
+}
+
+/** Forget a scope's vault — the last step of tearing a knowledge base's graph down. */
+export function unregisterBevelSecretsVariableLoader(scope: string = DEFAULT_SECRETS_SCOPE): void {
+  vaults.delete(scope);
 }
 
-/** The plain descriptor to place in a `UtcpClientConfig.load_variables_from` for a given user. */
-export function bevelSecretsLoaderConfig(userId: string): Record<string, unknown> {
-  return { variable_loader_type: BEVEL_SECRETS_LOADER_TYPE, user_id: userId };
+/**
+ * The plain descriptor to place in a `UtcpClientConfig.load_variables_from`
+ * for a given user of the knowledge base registered under `scope`.
+ */
+export function bevelSecretsLoaderConfig(userId: string, scope: string = DEFAULT_SECRETS_SCOPE): Record<string, unknown> {
+  return { variable_loader_type: BEVEL_SECRETS_LOADER_TYPE, user_id: userId, scope };
 }

package/src/modules/secrets-vault/secrets-vault.routes.ts

@@ -3,7 +3,6 @@ import { logger } from '../../shared/logging.js';
 
 const log = logger('secrets');
 import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
-import { DEFAULT_BRANCH } from '@bevel-software/platform-shared';
 import {
   InvalidSecretError,
   SecretNotFoundError,
@@ -17,11 +16,13 @@ import type { IToolManualService, ToolManualSummary, ToolVariable } from '../too
 import type { IConnectionProbeService } from '../connection-probe/connection-probe.contract.js';
 import { utcpNamespacedKey } from '../../shared/utcp-namespace.js';
 import type { IAccessControl } from '../access/access-control.interface.js';
-import { workspaceIdForBranch } from '../../shared/workspace-id.js';
+import type { KbContext } from '../../shared/kb-context.js';
 import '../auth/auth.middleware.js'; // Express Request augmentation (req.userId / req.userEmail)
 
 export interface SecretsVaultRoutesDeps {
   secretsVault: ISecretsVaultService;
+  /** The released branch's clone — where the `.tool` files the access verdicts are read from live. */
+  kb: Pick<KbContext, 'defaultWorkspaceId'>;
   /** Source of `.tool` manuals + their declared variable scopes (default-branch catalog). */
   toolManualService: IToolManualService;
   /** Gates who may set a tool's ADMIN (shared) secrets — writers of the `.tool` file. */
@@ -79,16 +80,16 @@ export function isSafeReturnPath(returnTo: unknown): returnTo is string {
  * `req.userId` — secrets are private per user. Mounted behind the JWT middleware.
  */
 export function createSecretsVaultRoutes(deps: SecretsVaultRoutesDeps): express.Router {
-  const { secretsVault, toolManualService, accessControl, connectionProbe } = deps;
+  const { secretsVault, toolManualService, accessControl, connectionProbe, kb } = deps;
   const router = express.Router();
   // A FUNCTION, not a constant. Routers are constructed at boot, and on a
   // deployment configured through the setup screen the branch model does not
-  // exist yet at that moment — `DEFAULT_BRANCH` is still ''. The live binding
-  // updates when setup applies the model, but only reads INSIDE a function
+  // exist yet at that moment — the default branch is still ''. The context
+  // learns it when setup applies the model, but only reads INSIDE a function
   // body see it; a construction-time capture would keep handing an empty
   // workspace id to the access resolver until the next restart ("Invalid
   // workspace ID" on every /secrets/tools call).
-  const defaultWs = () => workspaceIdForBranch(DEFAULT_BRANCH);
+  const defaultWs = () => kb.defaultWorkspaceId();
 
   // The vault key = the exact key UTCP looks the var up under (doubles underscores
   // in the manual namespace), so storage and resolution agree for snake_case ids.

package/src/modules/settings/__tests__/deployment-settings.service.test.ts

@@ -149,20 +149,12 @@ describe('DeploymentSettingsService — secrets', () => {
     expect(token).not.toHaveProperty('value');
   });
 
-  it('publishes a stored token as GITHUB_TOKEN, which is what git reads', async () => {
+  it('keeps a stored token out of the process environment: git reads it per call', async () => {
     const { db } = makeDb();
     const settings = new DeploymentSettingsService(db, ENC_KEY);
     await settings.save({ gitToken: 'ghp_fromsetup' }, null);
-    expect(process.env.GITHUB_TOKEN).toBe('ghp_fromsetup');
-  });
-
-  it('does not overwrite a git token the environment supplied', async () => {
-    process.env.GIT_TOKEN = 'ghp_fromenv';
-    process.env.GITHUB_TOKEN = 'ghp_fromenv';
-    const { db } = makeDb();
-    const settings = new DeploymentSettingsService(db, ENC_KEY);
-    settings.syncGitTokenEnv();
-    expect(process.env.GITHUB_TOKEN).toBe('ghp_fromenv');
+    expect(process.env.GITHUB_TOKEN).toBeUndefined();
+    expect(settings.resolve('gitToken')).toBe('ghp_fromsetup');
   });
 
   it('refuses to store a secret with no encryption key rather than writing plaintext', async () => {
@@ -528,3 +520,24 @@ describe('DeploymentSettingsService — validation', () => {
     ).toEqual([]);
   });
 });
+
+describe('DeploymentSettingsService — an environment of its own', () => {
+  it('resolves the env-first layer from the environment it was given, not the process\'s', async () => {
+    process.env.KB_REPO_URL = 'https://host.example/leaks-into-every-tenant.git';
+    const { db } = makeDb();
+    const own = new DeploymentSettingsService(db, ENC_KEY, undefined, {
+      env: { KB_REPO_URL: 'https://github.com/acme/kb.git', GIT_USERNAME: 'oauth2' },
+    });
+    await own.load();
+    expect(own.resolve('kbRepoUrl')).toBe('https://github.com/acme/kb.git');
+    expect(own.sourceOf('kbRepoUrl')).toBe('env');
+    expect(own.resolve('gitUsername')).toBe('oauth2');
+    // What the given environment leaves out is not taken from the process either.
+    expect(own.resolve('gitToken')).toBe('');
+    expect(own.sourceOf('gitToken')).toBe('unset');
+    // A service built without one keeps reading the process, as before.
+    const shared = new DeploymentSettingsService(db, ENC_KEY);
+    await shared.load();
+    expect(shared.resolve('kbRepoUrl')).toBe('https://host.example/leaks-into-every-tenant.git');
+  });
+});

package/src/modules/settings/__tests__/git-root-folders.test.ts

@@ -10,7 +10,7 @@ import {
   rootFolderListerFor,
   type GitRunner,
 } from '../git-root-folders.js';
-import type { IGitRunner } from '../../../shared/git.contract.js';
+import { NO_GIT_CREDENTIALS, type IGitRunner } from '../../../shared/git.contract.js';
 
 const LISTING = {
   url: 'https://example.com/acme/kb.git',
@@ -226,6 +226,7 @@ describe('rootFolderListerFor — the listing runs through the deployment git po
     const outcomes = ['', 'KnowledgeBase\0Plugins\0'];
     const port: IGitRunner = {
       defaultTimeoutMs: 1000,
+      credentials: NO_GIT_CREDENTIALS,
       run: (async (cwd: string, args: string[], opts: { env?: NodeJS.ProcessEnv; timeoutMs?: number } = {}) => {
         calls.push({ cwd, args, opts });
         return { stdout: outcomes.shift() ?? '', stderr: '' };

package/src/modules/settings/__tests__/setup.routes.boot-failure.test.ts

@@ -6,6 +6,7 @@ import { createSetupRoutes } from '../setup.routes.js';
 import { DeploymentSettingsService } from '../deployment-settings.service.js';
 import type { Database } from '../../database/connection.js';
 import type { IAdminAccessService } from '../../admin/admin.interface.js';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 
 /**
  * A boot that survived an unreachable remote leaves the RUNNER standing on a
@@ -68,7 +69,7 @@ function listen(runner: { runAll(): Promise<void>; lastFailure(): string | null
   });
   app.use(
     '/api',
-    createSetupRoutes(settings, { isAdmin: async () => true } as IAdminAccessService, runner),
+    createSetupRoutes(settings, { isAdmin: async () => true } as IAdminAccessService, runner, testKbContext()),
   );
   server = app.listen(0);
   const { port } = server.address() as AddressInfo;