@bevel-software/platform-core-backend 0.20.0 → 0.21.0

package/src/modules/workflow/git/__tests__/git.service.fileContentsAtCommit.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { testKbContext } from '../../../../__tests__/kb-context.js';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import fs from 'node:fs/promises';
@@ -86,7 +87,7 @@ describe('GitService.fileContentsAtCommit', () => {
     const svc = new GitService(
       stubWorkspaceService(workspaceId, workspaceDir),
       new WorkflowHooks(),
-      'knowledge-base',
+      testKbContext(),
     );
 
     const rootAdd = await commitFile(repo, 'Knowledge/Foo.md', '# one\n', 'add foo');
@@ -123,7 +124,7 @@ describe('GitService.fileContentsAtCommit', () => {
     const svc = new GitService(
       stubWorkspaceService(workspaceId, workspaceDir),
       new WorkflowHooks(),
-      'knowledge-base',
+      testKbContext(),
     );
     await expect(
       svc.fileContentsAtCommit(workspaceId, 'Knowledge/Foo.md', 'not-a-sha'),

package/src/modules/workflow/git/__tests__/git.service.forkPoint.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { testKbContext } from '../../../../__tests__/kb-context.js';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import os from 'node:os';
@@ -52,7 +53,7 @@ describe('GitService — fork point, behind, and Update', () => {
     git = new GitService(
       stubWorkspaceService({ [WS]: path.dirname(repo) }),
       stubWorkflowHooks(),
-      'knowledge-base',
+      testKbContext(),
     );
   });
 

package/src/modules/workflow/git/__tests__/git.service.history-guards.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { testKbContext } from '../../../../__tests__/kb-context.js';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import os from 'node:os';
@@ -34,7 +35,7 @@ describe('GitService history guards', () => {
     svc = new GitService(
       stubWorkspaceService({ [workspaceId]: workspaceDir }),
       stubWorkflowHooks(),
-      'knowledge-base',
+      testKbContext(),
     );
   });
 

package/src/modules/workflow/git/__tests__/git.service.list-branches.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { testKbContext } from '../../../../__tests__/kb-context.js';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import fs from 'node:fs/promises';
@@ -82,7 +83,7 @@ describe('GitService.listBranches', () => {
     const svc = new GitService(
       stubWorkspaceService(workspaceId, path.join(root, workspaceId)),
       new WorkflowHooks(),
-      'knowledge-base',
+      testKbContext(),
     );
 
     const branches = await svc.listBranches(workspaceId);
@@ -101,7 +102,7 @@ describe('GitService.listBranches', () => {
     const svc = new GitService(
       stubWorkspaceService(workspaceId, path.join(root, workspaceId)),
       new WorkflowHooks(),
-      'knowledge-base',
+      testKbContext(),
     );
 
     const branches = await svc.listBranches(workspaceId);
@@ -115,7 +116,7 @@ describe('GitService.listBranches', () => {
     const svc = new GitService(
       stubWorkspaceService(workspaceId, path.join(root, workspaceId)),
       new WorkflowHooks(),
-      'knowledge-base',
+      testKbContext(),
     );
     // Prime the cache: first call fetches and populates lastImplicitFetchAt.
     await svc.listBranches(workspaceId);
@@ -131,7 +132,7 @@ describe('GitService.listBranches', () => {
     const freshSvc = new GitService(
       stubWorkspaceService(workspaceId, path.join(root, workspaceId)),
       new WorkflowHooks(),
-      'knowledge-base',
+      testKbContext(),
     );
     const branches = await freshSvc.listBranches(workspaceId);
     expect(branches.map((b) => b.name)).toContain('bob/draft-two');
@@ -145,7 +146,7 @@ describe('GitService.listBranches', () => {
     const svc = new GitService(
       stubWorkspaceService(workspaceId, path.join(root, workspaceId)),
       new WorkflowHooks(),
-      'knowledge-base',
+      testKbContext(),
     );
 
     // Should not throw and should return the refs we already had on disk.
@@ -159,7 +160,7 @@ describe('GitService.listBranches', () => {
     const svc = new GitService(
       stubWorkspaceService(workspaceId, path.join(root, workspaceId)),
       new WorkflowHooks(),
-      'knowledge-base',
+      testKbContext(),
     );
 
     // current-company-state is the workspace clone's checked-out branch (the
@@ -179,7 +180,7 @@ describe('GitService.listBranches', () => {
     const svc = new GitService(
       stubWorkspaceService(workspaceId, path.join(root, workspaceId)),
       new WorkflowHooks(),
-      'knowledge-base',
+      testKbContext(),
     );
     // Simulate a just-completed clone — the workspace is freshly fetched.
     svc.noteWorkspaceFetched(workspaceId);
@@ -205,7 +206,7 @@ describe('GitService.listBranches', () => {
     const svc = new GitService(
       stubWorkspaceService(workspaceId, path.join(root, workspaceId)),
       new WorkflowHooks(),
-      'knowledge-base',
+      testKbContext(),
     );
     const seen: string[][] = [];
     svc.setBranchesListedListener((names) => seen.push(names));
@@ -222,7 +223,7 @@ describe('GitService.listBranches', () => {
     const svc = new GitService(
       stubWorkspaceService(workspaceId, path.join(root, workspaceId)),
       new WorkflowHooks(),
-      'knowledge-base',
+      testKbContext(),
     );
     svc.setBranchesListedListener(() => { throw new Error('listener blew up'); });
 

package/src/modules/workflow/git/__tests__/git.service.listTrackedFiles.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { testKbContext } from '../../../../__tests__/kb-context.js';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import fs from 'node:fs/promises';
@@ -63,7 +64,7 @@ async function makeSvc(root: string, workspaceId: string) {
   const svc = new GitService(
     stubWorkspaceService(workspaceId, path.join(root, workspaceId)),
     new WorkflowHooks(),
-    'knowledge-base',
+    testKbContext(),
   );
   return { svc, repo };
 }

package/src/modules/workflow/git/__tests__/git.service.logForFile.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { testKbContext } from '../../../../__tests__/kb-context.js';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import fs from 'node:fs/promises';
@@ -120,7 +121,7 @@ describe('GitService.logForFile', () => {
     const svc = new GitService(
       stubWorkspaceService(workspaceId, workspaceDir),
       new WorkflowHooks(),
-      'knowledge-base',
+      testKbContext(),
     );
 
     await commitFile(repo, 'Knowledge/Foo.md', 'one\n', 'first save');
@@ -140,7 +141,7 @@ describe('GitService.logForFile', () => {
     const svc = new GitService(
       stubWorkspaceService(workspaceId, workspaceDir),
       new WorkflowHooks(),
-      'knowledge-base',
+      testKbContext(),
     );
 
     await commitFile(repo, 'Knowledge/Foo.md', 'base\n', 'base edit');
@@ -159,7 +160,7 @@ describe('GitService.logForFile', () => {
     const svc = new GitService(
       stubWorkspaceService(workspaceId, workspaceDir),
       new WorkflowHooks(),
-      'knowledge-base',
+      testKbContext(),
     );
 
     await runGit(repo, ['commit', '--allow-empty', '-m', 'init']);
@@ -174,7 +175,7 @@ describe('GitService.logForFile', () => {
     const svc = new GitService(
       stubWorkspaceService(workspaceId, workspaceDir),
       new WorkflowHooks(),
-      'knowledge-base',
+      testKbContext(),
     );
 
     // 110 commits is the minimum that still proves "clamped to 100" — going
@@ -206,7 +207,7 @@ describe('GitService.logForFile', () => {
     const svc = new GitService(
       stubWorkspaceService(workspaceId, workspaceDir),
       new WorkflowHooks(),
-      'knowledge-base',
+      testKbContext(),
     );
     await runGit(repo, ['commit', '--allow-empty', '-m', 'init']);
     const user = { id: 'u', name: 'Test', email: 't@x.com' };

package/src/modules/workflow/git/__tests__/git.service.mergeChangeRequest.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { testKbContext } from '../../../../__tests__/kb-context.js';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import fs from 'node:fs/promises';
@@ -94,7 +95,7 @@ describe('GitService.mergeChangeRequest', () => {
       await fs.writeFile(path.join(dir, 'feature.md'), 'new content\n');
     });
 
-    const git = new GitService(stubWorkspaceService(baseWsId, baseRepo), new WorkflowHooks(), 'knowledge-base');
+    const git = new GitService(stubWorkspaceService(baseWsId, baseRepo), new WorkflowHooks(), testKbContext());
     const result = await git.mergeChangeRequest(
       baseWsId, 'alice/add', BASE, { subject: 'Add feature (#1)', body: 'Merged via Bevel' }, USER,
     );
@@ -129,7 +130,7 @@ describe('GitService.mergeChangeRequest', () => {
     await runGit(root, ['clone', '-b', 'tmp-base-advance', upstream, advancer]);
     await runGit(advancer, ['push', 'origin', 'tmp-base-advance:' + BASE]);
 
-    const git = new GitService(stubWorkspaceService(baseWsId, baseRepo), new WorkflowHooks(), 'knowledge-base');
+    const git = new GitService(stubWorkspaceService(baseWsId, baseRepo), new WorkflowHooks(), testKbContext());
     const result = await git.mergeChangeRequest(
       baseWsId, 'alice/edit', BASE, { subject: 'Edit (#2)', body: 'x' }, USER,
     );
@@ -163,7 +164,7 @@ describe('GitService.mergeChangeRequest', () => {
       // A save that has not been shared yet, exactly as a file tool leaves it.
       await fs.writeFile(path.join(baseRepo, 'base.md'), 'edited but not shared\n');
 
-      const git = new GitService(stubWorkspaceService(baseWsId, baseRepo), new WorkflowHooks(), 'knowledge-base');
+      const git = new GitService(stubWorkspaceService(baseWsId, baseRepo), new WorkflowHooks(), testKbContext());
       await expect(
         git.mergeChangeRequest(
           baseWsId, 'alice/add', BASE, { subject: 'Add (#1)', body: 'x' }, USER,
@@ -188,7 +189,7 @@ describe('GitService.mergeChangeRequest', () => {
       await runGit(baseRepo, ['add', '-A']);
       await runGit(baseRepo, ['commit', '-m', 'local only']);
 
-      const git = new GitService(stubWorkspaceService(baseWsId, baseRepo), new WorkflowHooks(), 'knowledge-base');
+      const git = new GitService(stubWorkspaceService(baseWsId, baseRepo), new WorkflowHooks(), testKbContext());
       await expect(
         git.mergeChangeRequest(
           baseWsId, 'alice/add', BASE, { subject: 'Add (#1)', body: 'x' }, USER,
@@ -203,7 +204,7 @@ describe('GitService.mergeChangeRequest', () => {
       await pushFeatureBranch(root, upstream, 'alice/add', async (dir) => {
         await fs.writeFile(path.join(dir, 'feature.md'), 'new content\n');
       });
-      const git = new GitService(stubWorkspaceService(baseWsId, baseRepo), new WorkflowHooks(), 'knowledge-base');
+      const git = new GitService(stubWorkspaceService(baseWsId, baseRepo), new WorkflowHooks(), testKbContext());
       const result = await git.mergeChangeRequest(
         baseWsId, 'alice/add', BASE, { subject: 'Add (#1)', body: 'x' }, USER,
         { requireCleanTarget: true },
@@ -236,7 +237,7 @@ describe('GitService.mergeChangeRequest', () => {
       const publishedTip = (await gitOut(advancer, ['rev-parse', 'HEAD'])).trim();
       expect(staleHead).not.toBe(publishedTip);
 
-      const git = new GitService(stubWorkspaceService(baseWsId, baseRepo), new WorkflowHooks(), 'knowledge-base');
+      const git = new GitService(stubWorkspaceService(baseWsId, baseRepo), new WorkflowHooks(), testKbContext());
       const seen: { sha: string; changedPaths: string[] }[] = [];
       const result = await git.mergeChangeRequest(
         baseWsId, 'alice/add', BASE, { subject: 'Add (#1)', body: 'x' }, USER,
@@ -254,7 +255,7 @@ describe('GitService.mergeChangeRequest', () => {
       await pushFeatureBranch(root, upstream, 'alice/add', async (dir) => {
         await fs.writeFile(path.join(dir, 'feature.md'), 'new content\n');
       });
-      const git = new GitService(stubWorkspaceService(baseWsId, baseRepo), new WorkflowHooks(), 'knowledge-base');
+      const git = new GitService(stubWorkspaceService(baseWsId, baseRepo), new WorkflowHooks(), testKbContext());
       await expect(
         git.mergeChangeRequest(
           baseWsId, 'alice/add', BASE, { subject: 'Add (#1)', body: 'x' }, USER,
@@ -279,7 +280,7 @@ describe('GitService.mergeChangeRequest', () => {
         await runGit(dir, ['mv', 'roles.yaml', 'people.yaml']);
       });
 
-      const git = new GitService(stubWorkspaceService(baseWsId, baseRepo), new WorkflowHooks(), 'knowledge-base');
+      const git = new GitService(stubWorkspaceService(baseWsId, baseRepo), new WorkflowHooks(), testKbContext());
       const seen: string[][] = [];
       const result = await git.mergeChangeRequest(
         baseWsId, 'alice/rename', BASE, { subject: 'Rename (#1)', body: 'x' }, USER,

package/src/modules/workflow/git/__tests__/git.service.pendingChanges.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { testKbContext } from '../../../../__tests__/kb-context.js';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import fs from 'node:fs/promises';
@@ -72,7 +73,7 @@ async function makeSvc(root: string, workspaceId: string) {
   const svc = new GitService(
     stubWorkspaceService(workspaceId, workspaceDir),
     new WorkflowHooks(),
-    'knowledge-base',
+    testKbContext(),
   );
   return { svc, repo };
 }

package/src/modules/workflow/git/__tests__/git.service.postMergePull.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { testKbContext } from '../../../../__tests__/kb-context.js';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import fs from 'node:fs/promises';
@@ -109,7 +110,7 @@ describe('post-merge refresh of the target branch workspace', () => {
         [baseWsId]: path.dirname(baseRepo),
       }),
       stubWorkflowHooks(),
-      KB_DIR,
+      testKbContext({ kbDirName: KB_DIR }),
     );
 
     // 1. The merge lands on origin/BASE (run from the caller's workspace).
@@ -163,7 +164,7 @@ describe('post-merge refresh of the target branch workspace', () => {
         [baseWsId]: path.dirname(baseRepo),
       }),
       stubWorkflowHooks(),
-      KB_DIR,
+      testKbContext({ kbDirName: KB_DIR }),
     );
 
     const merged = await git.mergeChangeRequest(
@@ -254,7 +255,7 @@ describe('post-merge refresh of the target branch workspace', () => {
         [baseWsId]: path.dirname(baseRepo),
       }),
       stubWorkflowHooks(),
-      KB_DIR,
+      testKbContext({ kbDirName: KB_DIR }),
     );
 
     const merged = await git.mergeChangeRequest(

package/src/modules/workflow/git/__tests__/git.service.pull.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { testKbContext } from '../../../../__tests__/kb-context.js';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import os from 'node:os';
@@ -85,7 +86,7 @@ describe('GitService.pull', () => {
     const svc = new GitService(
       stubWorkspaceService({ [workspaceId]: path.join(root, workspaceId) }),
       stubWorkflowHooks(),
-      'knowledge-base',
+      testKbContext(),
     );
 
     await expect(svc.pull(workspaceId)).resolves.toEqual({ treeChanged: true });
@@ -128,7 +129,7 @@ describe('GitService.pull', () => {
     const svc = new GitService(
       stubWorkspaceService({ [workspaceId]: path.join(root, workspaceId) }),
       stubWorkflowHooks(),
-      'knowledge-base',
+      testKbContext(),
     );
 
     await expect(svc.pull(workspaceId)).resolves.toEqual({ treeChanged: true });
@@ -174,7 +175,7 @@ describe('GitService.pull', () => {
     const svc = new GitService(
       stubWorkspaceService({ [workspaceId]: path.join(root, workspaceId) }),
       stubWorkflowHooks(),
-      'knowledge-base',
+      testKbContext(),
     );
 
     await expect(svc.pull(workspaceId)).resolves.toEqual({ treeChanged: true });
@@ -219,7 +220,7 @@ describe('GitService.pull', () => {
     const svc = new GitService(
       stubWorkspaceService({ [workspaceId]: path.join(root, workspaceId) }),
       stubWorkflowHooks(),
-      'knowledge-base',
+      testKbContext(),
     );
 
     await expect(svc.pull(workspaceId)).resolves.toEqual({ treeChanged: true });
@@ -247,7 +248,7 @@ describe('GitService.pull', () => {
     const svc = new GitService(
       stubWorkspaceService({ [workspaceId]: path.join(root, workspaceId) }),
       stubWorkflowHooks(),
-      'knowledge-base',
+      testKbContext(),
     );
 
     await expect(svc.pull(workspaceId)).resolves.toEqual({ treeChanged: false });
@@ -269,7 +270,7 @@ describe('GitService.pull', () => {
     const svc = new GitService(
       stubWorkspaceService({ [workspaceId]: path.join(root, workspaceId) }),
       stubWorkflowHooks(),
-      'knowledge-base',
+      testKbContext(),
     );
 
     await expect(svc.pull(workspaceId)).resolves.toEqual({ treeChanged: false });
@@ -311,7 +312,7 @@ describe('GitService.pull', () => {
     const svc = new GitService(
       stubWorkspaceService({ [workspaceId]: path.join(root, workspaceId) }),
       stubWorkflowHooks(),
-      'knowledge-base',
+      testKbContext(),
     );
 
     const err = await svc.pull(workspaceId).then(() => null).catch((e: unknown) => e);
@@ -338,7 +339,7 @@ describe('GitService.pull', () => {
     const svc = new GitService(
       stubWorkspaceService({ [workspaceId]: path.join(root, workspaceId) }),
       stubWorkflowHooks(),
-      'knowledge-base',
+      testKbContext(),
     );
 
     await expect(svc.hasUnpushedCommits(workspaceId)).resolves.toBe(false);

package/src/modules/workflow/git/__tests__/git.service.readFileAtRef.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { testKbContext } from '../../../../__tests__/kb-context.js';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import fs from 'node:fs/promises';
@@ -59,7 +60,7 @@ describe('GitService.readFileAtRef', () => {
     return new GitService(
       stubWorkspaceService(workspaceId, workspaceDir),
       new WorkflowHooks(),
-      PROCESS_MAP_DIR,
+      testKbContext({ kbDirName: PROCESS_MAP_DIR }),
     );
   }
 

package/src/modules/workflow/git/__tests__/git.service.revertPathsAndPush.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { testKbContext } from '../../../../__tests__/kb-context.js';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import os from 'node:os';
@@ -58,7 +59,7 @@ async function seed(root: string, branches: string[]): Promise<Fixture> {
     await runGit(repo, ['config', 'core.autocrlf', 'false']);
     repos[b] = repo;
   }
-  const svc = new GitService(stubWorkspaceService(dirs), stubWorkflowHooks(), KB);
+  const svc = new GitService(stubWorkspaceService(dirs), stubWorkflowHooks(), testKbContext({ kbDirName: KB }));
   return { upstream, base, repos, svc };
 }
 

package/src/modules/workflow/git/__tests__/git.service.status.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { testKbContext } from '../../../../__tests__/kb-context.js';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import fs from 'node:fs/promises';
@@ -80,7 +81,7 @@ describe('GitService.status — hasUpstream', () => {
 
   it('reports hasUpstream=true on a tracked branch (cloned from origin)', async () => {
     const { workspaceDir } = await seedWorkspace(root, workspaceId);
-    const svc = new GitService(stubWorkspaceService(workspaceId, workspaceDir), new WorkflowHooks(), 'knowledge-base');
+    const svc = new GitService(stubWorkspaceService(workspaceId, workspaceDir), new WorkflowHooks(), testKbContext());
 
     const status = await svc.status(workspaceId);
     expect(status.branch).toBe('current-company-state');
@@ -96,7 +97,7 @@ describe('GitService.status — hasUpstream', () => {
     await runGit(repo, ['checkout', '-b', 'alice/unpublished-draft']);
     await runGit(repo, ['commit', '--allow-empty', '-m', 'local-only edit']);
 
-    const svc = new GitService(stubWorkspaceService(workspaceId, workspaceDir), new WorkflowHooks(), 'knowledge-base');
+    const svc = new GitService(stubWorkspaceService(workspaceId, workspaceDir), new WorkflowHooks(), testKbContext());
     const status = await svc.status(workspaceId);
 
     expect(status.branch).toBe('alice/unpublished-draft');
@@ -114,7 +115,7 @@ describe('GitService.status — hasUpstream', () => {
     await runGit(repo, ['commit', '--allow-empty', '-m', 'two']);
     await runGit(repo, ['push', '-u', 'origin', 'alice/published-draft']);
 
-    const svc = new GitService(stubWorkspaceService(workspaceId, workspaceDir), new WorkflowHooks(), 'knowledge-base');
+    const svc = new GitService(stubWorkspaceService(workspaceId, workspaceDir), new WorkflowHooks(), testKbContext());
     const status = await svc.status(workspaceId);
 
     expect(status.branch).toBe('alice/published-draft');

package/src/modules/workflow/git/__tests__/git.service.syncFromRemote.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { testKbContext } from '../../../../__tests__/kb-context.js';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import os from 'node:os';
@@ -81,7 +82,7 @@ describe('GitService.syncFromRemote', () => {
       await fs.writeFile(path.join(dir, 'b.md'), 'b\n');
       await fs.rename(path.join(dir, 'old name.md'), path.join(dir, 'new name.md'));
     });
-    const git = new GitService(stubWorkspaceService({ ws: workspaceDir }), stubWorkflowHooks(), 'knowledge-base');
+    const git = new GitService(stubWorkspaceService({ ws: workspaceDir }), stubWorkflowHooks(), testKbContext());
 
     const r = await git.syncFromRemote('ws');
     expect(r.before).toBe(before);
@@ -105,7 +106,7 @@ describe('GitService.syncFromRemote', () => {
     await runGit(repo, ['config', 'user.email', 'workspace@bevel.test']);
     await runGit(repo, ['config', 'user.name', 'bevel Workspace']);
     await runGit(repo, ['checkout', '-b', BRANCH]).catch(() => undefined);
-    const git = new GitService(stubWorkspaceService({ ws: workspaceDir }), stubWorkflowHooks(), 'knowledge-base');
+    const git = new GitService(stubWorkspaceService({ ws: workspaceDir }), stubWorkflowHooks(), testKbContext());
 
     // Still empty on both sides: nothing to sync, and NOT 'remote gone' — a
     // fresh deployment nobody has pushed to must never have its clone retired.
@@ -134,7 +135,7 @@ describe('GitService.syncFromRemote', () => {
     await runGit(upstream, ['branch', 'ali/x', BRANCH]);
     const { workspaceDir } = await cloneWorkspace(root, upstream, 'ali%2Fx', 'ali/x');
     await runGit(upstream, ['update-ref', '-d', 'refs/heads/ali/x']);
-    const git = new GitService(stubWorkspaceService({ 'ali%2Fx': workspaceDir }), stubWorkflowHooks(), 'knowledge-base');
+    const git = new GitService(stubWorkspaceService({ 'ali%2Fx': workspaceDir }), stubWorkflowHooks(), testKbContext());
     await expect(git.syncFromRemote('ali%2Fx')).rejects.toBeInstanceOf(RemoteBranchGoneError);
   });
 });
@@ -163,7 +164,7 @@ describe('GitService.syncFromRemote — the cases git exits 0 on but should not
     await pushFromElsewhere(root, upstream, async (dir) => {
       await fs.writeFile(path.join(dir, 'a.md'), 'edited on the host\n');
     });
-    const git = new GitService(stubWorkspaceService({ ws: workspaceDir }), stubWorkflowHooks(), 'knowledge-base');
+    const git = new GitService(stubWorkspaceService({ ws: workspaceDir }), stubWorkflowHooks(), testKbContext());
 
     await expect(git.syncFromRemote('ws')).rejects.toMatchObject({
       name: 'PullRebaseConflictError',
@@ -186,7 +187,7 @@ describe('GitService.syncFromRemote — the cases git exits 0 on but should not
     await runGit(repo, ['rm', '-rf', '--cached', '.']).catch(() => undefined);
     await fs.rm(path.join(repo, 'a.md'), { force: true });
     await fs.rm(path.join(repo, 'old name.md'), { force: true });
-    const git = new GitService(stubWorkspaceService({ ws: workspaceDir }), stubWorkflowHooks(), 'knowledge-base');
+    const git = new GitService(stubWorkspaceService({ ws: workspaceDir }), stubWorkflowHooks(), testKbContext());
     await expect(git.syncFromRemote('ws')).rejects.toBeInstanceOf(RemoteBranchGoneError);
   });
 
@@ -194,7 +195,7 @@ describe('GitService.syncFromRemote — the cases git exits 0 on but should not
     const upstream = await bareUpstream(root, true);
     await runGit(upstream, ['branch', 'ali/x', BRANCH]);
     const { workspaceDir } = await cloneWorkspace(root, upstream, 'ws');
-    const git = new GitService(stubWorkspaceService({ ws: workspaceDir }), stubWorkflowHooks(), 'knowledge-base');
+    const git = new GitService(stubWorkspaceService({ ws: workspaceDir }), stubWorkflowHooks(), testKbContext());
     expect(await git.remoteBranchExists('ws', 'ali/x')).toBe(true);
     await runGit(upstream, ['update-ref', '-d', 'refs/heads/ali/x']);
     expect(await git.remoteBranchExists('ws', 'ali/x')).toBe(false);
@@ -241,7 +242,7 @@ describe('GitService.syncFromRemote — an unborn clone that already holds stage
     await runGit(seed, ['add', '.']);
     await runGit(seed, ['commit', '-m', 'first']);
     await runGit(seed, ['push', upstream, BRANCH]);
-    const git = new GitService(stubWorkspaceService({ ws: workspaceDir }), stubWorkflowHooks(), 'knowledge-base');
+    const git = new GitService(stubWorkspaceService({ ws: workspaceDir }), stubWorkflowHooks(), testKbContext());
 
     await expect(git.syncFromRemote('ws')).rejects.toMatchObject({
       name: 'PullRebaseConflictError',

package/src/modules/workflow/git/__tests__/node-git-runner.test.ts

@@ -3,7 +3,7 @@ import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { NodeGitRunner } from '../node-git-runner.js';
-import { GitRunError, isGitTimeout } from '../../../../shared/git.contract.js';
+import { GitRunError, gitCredentials, isGitTimeout } from '../../../../shared/git.contract.js';
 
 /**
  * These run REAL git, like the rest of this module's suites: the behaviours
@@ -94,10 +94,48 @@ describe('NodeGitRunner', () => {
     expect(true).toBe(true);
   });
 
+  /**
+   * The helper the runner's callers stamp into a clone, reduced to the one
+   * thing under test here: what `$GITHUB_TOKEN` is in the child. `credential
+   * fill` runs it through git's own shell and prints what it answered, which
+   * is the same path a push takes to its password.
+   */
+  const ECHO_TOKEN_HELPER = `!f() { printf '%s\\n' "username=u" "password=\${GITHUB_TOKEN-none}"; }; f`;
+  const fill = (runner: NodeGitRunner, env?: NodeJS.ProcessEnv) =>
+    runner.run(dir, ['-c', `credential.helper=${ECHO_TOKEN_HELPER}`, 'credential', 'fill'], {
+      input: 'protocol=https\nhost=example.test\n\n',
+      env,
+    });
+
+  it('hands its token to the child, where the helper reads it, and never puts it in argv', async () => {
+    const runner = new NodeGitRunner(undefined, gitCredentials('x-access-token', 'ghp_child_secret'));
+    const { stdout } = await fill(runner);
+    expect(stdout).toContain('password=ghp_child_secret');
+  });
+
+  it('drops a token this process inherited: only the credentials in effect reach git', async () => {
+    const previous = process.env.GITHUB_TOKEN;
+    process.env.GITHUB_TOKEN = 'ghp_stale_in_process_env';
+    try {
+      const { stdout } = await fill(new NodeGitRunner());
+      expect(stdout).toContain('password=none');
+      expect(stdout).not.toContain('ghp_stale_in_process_env');
+    } finally {
+      if (previous === undefined) delete process.env.GITHUB_TOKEN;
+      else process.env.GITHUB_TOKEN = previous;
+    }
+  });
+
+  it('lets a per-call environment entry win over its own token: the setup probe checks the token it was given', async () => {
+    const runner = new NodeGitRunner(undefined, gitCredentials('x-access-token', 'ghp_in_effect'));
+    const { stdout } = await fill(runner, { GITHUB_TOKEN: 'ghp_being_checked' });
+    expect(stdout).toContain('password=ghp_being_checked');
+  });
+
   it('keeps the configured git token out of failures', async () => {
-    const runner = new NodeGitRunner();
+    const runner = new NodeGitRunner(undefined, gitCredentials('x-access-token', 'ghp_secret_value_here'));
     const previous = process.env.GITHUB_TOKEN;
-    process.env.GITHUB_TOKEN = 'ghp_secret_value_here';
+    delete process.env.GITHUB_TOKEN;
     try {
       const err = await runner
         .run(dir, ['ls-remote', 'https://x-access-token:ghp_secret_value_here@127.0.0.1:1/r.git'], {