@bevel-software/platform-core-backend 0.20.0 → 0.21.0

package/src/modules/workflow/git/git.service.ts

@@ -26,9 +26,8 @@ import {
   assertValidRelativePath,
   isBranchAuthoredBy,
   isOwnSuggestionsBranch,
-  isProtectedBranch,
-  PROTECTED_BRANCHES,
 } from '../../kb-fs/branch-name.js';
+import type { KbContext } from '../../../shared/kb-context.js';
 import {
   BranchAuthorshipError,
   WorkflowDomainError,
@@ -42,6 +41,7 @@ import {
   GitRunError,
   isGitTimeout,
   redactGitToken,
+  type GitCredentials,
   type GitRunOptions,
   type GitRunResult,
   type IGitRunner,
@@ -296,7 +296,7 @@ export class GitService implements IGitService {
      * safe because validation is advisory and never blocks a commit.
      */
     private readonly hooks: WorkflowHooks,
-    private readonly kbDirName: string,
+    private readonly kb: KbContext,
     private readonly mutex: WorkspaceMutex = new WorkspaceMutex(),
     private readonly accessControl: IAccessControl | null = null,
     /**
@@ -309,6 +309,18 @@ export class GitService implements IGitService {
     private readonly gitRunner: IGitRunner = new NodeGitRunner(),
   ) {}
 
+  private get kbDirName(): string {
+    return this.kb.kbDirName;
+  }
+
+  /**
+   * The credentials the runner authenticates with — for the services above
+   * this one that scrub a message git or the host echoed a token into.
+   */
+  get credentials(): GitCredentials {
+    return this.gitRunner.credentials;
+  }
+
   /**
    * "Does the pending-commits queue hold rows for this workspace?" — used by
    * `statusInternal` to tell an expected dirty tree (queued saves still
@@ -552,7 +564,7 @@ export class GitService implements IGitService {
             );
             infos[i] = {
               name: row.shortName,
-              isProtected: isProtectedBranch(row.shortName),
+              isProtected: this.kb.isProtectedBranch(row.shortName),
               ahead,
               behind,
               hasRemote: row.hasRemote,
@@ -655,7 +667,7 @@ export class GitService implements IGitService {
     fromBase?: string,
   ): Promise<BranchInfo> {
     assertValidBranchName(name);
-    if (isProtectedBranch(name)) {
+    if (this.kb.isProtectedBranch(name)) {
       throw new ProtectedBranchError(name, 'creating a protected branch');
     }
     if (fromBase) assertValidBranchName(fromBase);
@@ -731,7 +743,7 @@ export class GitService implements IGitService {
     opts: { onlyIfNoRemote?: boolean; systemCleanup?: boolean } = {},
   ): Promise<void> {
     assertValidBranchName(name);
-    if (isProtectedBranch(name)) {
+    if (this.kb.isProtectedBranch(name)) {
       throw new ProtectedBranchError(name, 'deleting a protected branch');
     }
     return this.mutex.run(workspaceId, async () => {
@@ -895,7 +907,7 @@ export class GitService implements IGitService {
       // boundary. Without this guard, the standard "fork to draft then
       // propose" workflow would 403 for non-admins — they can't write
       // protected, can't write the draft they forked from it either.
-      if (isProtectedBranch(branch)) {
+      if (this.kb.isProtectedBranch(branch)) {
         // Gate against the access tree as it exists at HEAD — the pre-commit
         // state. Reading from the working tree would let the user broaden
         // their own access by editing access.md alongside the change they're
@@ -1172,7 +1184,7 @@ export class GitService implements IGitService {
       // Protected-branch access gate (defence in depth — callers already gate at
       // lock-acquire / upload-mint, but this primitive is generic). Gate every
       // touched path against the access tree at HEAD, like `commit()`.
-      if (isProtectedBranch(branch)) {
+      if (this.kb.isProtectedBranch(branch)) {
         await this.assertCanWriteAtRef(workspaceId, 'HEAD', user.email, touched);
       }
 
@@ -1292,7 +1304,7 @@ export class GitService implements IGitService {
       // decided the write is legitimate (unused name, exclusive create);
       // gating it here again just refuses every non-admin the product
       // promised a plugin to.
-      if (isProtectedBranch(branch) && !opts?.systemAuthorized) {
+      if (this.kb.isProtectedBranch(branch) && !opts?.systemAuthorized) {
         const touched = await this.unpushedTouchedPaths(cwd);
         await this.assertCanWriteAtRef(
           workspaceId,
@@ -1542,6 +1554,7 @@ export class GitService implements IGitService {
           throw new Error(
             `git merge failed without detectable conflicts: ${redactGitToken(
               err instanceof Error ? err.message : String(err),
+              this.credentials.token(),
             )}`,
           );
         }
@@ -2109,7 +2122,7 @@ export class GitService implements IGitService {
     return this.mutex.run(workspaceId, async () => {
       const cwd = await this.repoDir(workspaceId);
       let best: { base: string; ahead: number } | null = null;
-      for (const p of PROTECTED_BRANCHES) {
+      for (const p of this.kb.protectedBranches) {
         if (p === branch) continue;
         const res = await this.tryAheadBehind(cwd, branch, `origin/${p}`);
         if (res && (best === null || res.ahead < best.ahead)) {
@@ -3133,7 +3146,7 @@ export class GitService implements IGitService {
     }
 
     let best: { ahead: number; behind: number } | null = null;
-    for (const p of PROTECTED_BRANCHES) {
+    for (const p of this.kb.protectedBranches) {
       if (p === shortName) continue;
       const res = await this.tryAheadBehind(cwd, ref, `refs/remotes/origin/${p}`);
       if (res && (best === null || res.ahead < best.ahead)) best = res;
@@ -3447,5 +3460,3 @@ export function parseNumstatZ(out: string): NumstatEntry[] {
   }
   return entries;
 }
-
-export { PROTECTED_BRANCHES };

package/src/modules/workflow/git/node-git-runner.ts

@@ -1,7 +1,10 @@
 import { spawn, type ChildProcess, type SpawnOptions } from 'node:child_process';
 import {
+  GIT_TOKEN_ENV,
   GitRunError,
+  NO_GIT_CREDENTIALS,
   redactGitToken,
+  type GitCredentials,
   type GitRunOptions,
   type GitRunResult,
   type IGitRunner,
@@ -212,7 +215,33 @@ function spawnGit(args: string[], options: SpawnOptions & { maxBuffer: number })
  * `WorkspaceMutex`'s job and stays the caller's to have done.
  */
 export class NodeGitRunner implements IGitRunner {
-  constructor(readonly defaultTimeoutMs: number = DEFAULT_GIT_TIMEOUT_MS) {}
+  constructor(
+    readonly defaultTimeoutMs: number = DEFAULT_GIT_TIMEOUT_MS,
+    /**
+     * What every call authenticates with. The token goes into the CHILD's
+     * environment only (see {@link childEnv}); a runner built without one
+     * runs git unauthenticated, which is what a directly constructed service
+     * in a test gets.
+     */
+    readonly credentials: GitCredentials = NO_GIT_CREDENTIALS,
+  ) {}
+
+  /**
+   * The environment one invocation runs under. The token in effect goes in
+   * under {@link GIT_TOKEN_ENV}, and a stale one this process inherited from
+   * its own environment goes OUT: a server hosting several knowledge bases
+   * must never let one knowledge base's git call find another's token, or an
+   * operator's, lying in `process.env`. A caller's per-call entry still wins
+   * over the provider's (the setup probe runs with the token it is checking,
+   * not the one in effect), and the fixed entries win over everything.
+   */
+  private childEnv(overrides: NodeJS.ProcessEnv | undefined): NodeJS.ProcessEnv {
+    const env: NodeJS.ProcessEnv = { ...process.env };
+    delete env[GIT_TOKEN_ENV];
+    const token = this.credentials.token();
+    if (token) env[GIT_TOKEN_ENV] = token;
+    return { ...env, ...overrides, ...FIXED_ENV };
+  }
 
   run(cwd: string, args: string[], opts: GitRunOptions & { encoding: 'buffer' }): Promise<GitRunResult<Buffer>>;
   run(cwd: string, args: string[], opts?: GitRunOptions & { encoding?: 'utf8' }): Promise<GitRunResult>;
@@ -224,7 +253,7 @@ export class NodeGitRunner implements IGitRunner {
     try {
       const { promise: pending, child } = spawnGit(args, {
         cwd,
-        env: { ...process.env, ...opts.env, ...FIXED_ENV },
+        env: this.childEnv(opts.env),
         maxBuffer: MAX_OUTPUT_BYTES,
         // Makes the child a process-group leader so that `killTree` can signal
         // the transport helpers it spawns, not just git itself. Not on Windows,
@@ -291,9 +320,13 @@ export class NodeGitRunner implements IGitRunner {
           : Buffer.isBuffer(original.stderr)
             ? original.stderr.toString()
             : undefined;
-      throw new GitRunError(`git ${subcommand} failed: ${redactGitToken(message)}`, {
+      // Scrubbed with the token THIS runner handed the child, and the one a
+      // caller laid over it for the call: both can be echoed back by git.
+      const secrets = [this.credentials.token(), opts.env?.[GIT_TOKEN_ENV]];
+      const scrub = (text: string): string => secrets.reduce<string>((out, token) => redactGitToken(out, token), text);
+      throw new GitRunError(`git ${subcommand} failed: ${scrub(message)}`, {
         exitCode: typeof original.code === 'number' ? original.code : undefined,
-        stderr: stderr === undefined ? undefined : redactGitToken(stderr),
+        stderr: stderr === undefined ? undefined : scrub(stderr),
       });
     } finally {
       // Every timer is cleared on every path. The later ones in particular

package/src/modules/workflow/review-workflow/review-workflow.service.ts

@@ -18,6 +18,7 @@ import { changeRequests, prComments, prFileApprovals, prMergeLog, users } from '
 import { AccessUnreadableError } from '../../access-model/access-errors.js';
 import type { IAccessControl } from '../../access/access-control.interface.js';
 import type { GitService } from '../git/git.service.js';
+import { redactSecret } from '../../../shared/redact-secret.js';
 import {
   ChangeRequestConflictsError,
   WorkflowDomainError,
@@ -45,11 +46,13 @@ import {
 const MERGE_METHOD = 'merge' as const;
 const EVERYONE_CANONICAL = 'everyone';
 
-function redactTokens(msg: string): string {
-  const tokens = [process.env.GITHUB_TOKEN, process.env.GH_TOKEN].filter(
-    (t): t is string => !!t && t.length > 0,
-  );
-  return tokens.reduce((m, t) => m.replaceAll(t, '***'), msg);
+/**
+ * Redact a git token from an error string before it is stored: the one the
+ * knowledge base's runner authenticates with, plus whatever the environment
+ * holds (`redactSecret` names those itself).
+ */
+function redactTokens(msg: string, token: string | null | undefined): string {
+  return redactSecret(msg, [token]);
 }
 
 class CommentAuthError extends WorkflowDomainError {
@@ -743,7 +746,7 @@ export class ReviewWorkflowService implements IReviewWorkflowService {
         user,
       );
     } catch (err) {
-      const redacted = redactTokens(err instanceof Error ? err.message : String(err));
+      const redacted = redactTokens(err instanceof Error ? err.message : String(err), this.git.credentials?.token());
       await this.db
         .update(prMergeLog)
         .set({ succeeded: false, completedAt: new Date(), error: redacted })

package/src/modules/workflow/session-ontology.service.ts

@@ -33,6 +33,7 @@
 
 import { eq, lt } from 'drizzle-orm';
 import { ontologyOf } from '../../shared/kb-layout.js';
+import type { KbContext } from '../../shared/kb-context.js';
 
 import type { Database } from '../database/connection.js';
 import { sessionOntologyTouches } from '../database/schema.js';
@@ -77,7 +78,11 @@ export class SessionOntologyService implements ISessionOntologyService {
    */
   private readonly locks = new WorkspaceMutex();
 
-  constructor(private readonly db: Database) {}
+  constructor(
+    private readonly db: Database,
+    /** Names the knowledge-base root a path is classified under; read per call. */
+    private readonly kb: Pick<KbContext, 'layout'>,
+  ) {}
 
   /**
    * Resolve `wsPath` to its ontology and evaluate/record the operation. Thin
@@ -89,7 +94,7 @@ export class SessionOntologyService implements ISessionOntologyService {
     isWrite: boolean,
     kbDirName?: string,
   ): Promise<OperationDecision> {
-    return this.checkOntology(sessionId, ontologyOf(wsPath, kbDirName), isWrite);
+    return this.checkOntology(sessionId, ontologyOf(wsPath, this.kb.layout, kbDirName), isWrite);
   }
 
   /**

package/src/modules/workflow/workflow.service.ts

@@ -57,16 +57,16 @@ import type {
   RemoteSyncPullResult,
 } from '@bevel-software/platform-shared';
 import {
-  isProtectedBranch,
-  DEFAULT_BRANCH,
   isFolderPlaceholder,
   folderPlaceholderPath,
   isPlatformRestoreShape,
 } from '@bevel-software/platform-shared';
+import type { KbContext } from '../../shared/kb-context.js';
 import { and, eq, inArray, isNotNull, isNull, lt, or } from 'drizzle-orm';
 import type { Database } from '../database/connection.js';
 import { changeRequests } from '../database/schema.js';
 import type { GitService } from './git/git.service.js';
+import { redactSecret } from '../../shared/redact-secret.js';
 import type { PullRequestService } from './git/pull-request.service.js';
 import type { IReviewWorkflowService } from './review-workflow/review-workflow.interface.js';
 import type { WorkspaceService } from '../workspace/workspace.service.js';
@@ -156,12 +156,13 @@ export function syncConflictMessage(branch: string, conflictedPaths: string[]):
 /** How many conflicted files the sync-conflict sentence names before "and N more". */
 const SYNC_CONFLICT_FILES_NAMED = 3;
 
-/** Redact the shared GitHub token from any error string before surfacing it. */
-function redactTokens(msg: string): string {
-  const tokens = [process.env.GITHUB_TOKEN, process.env.GH_TOKEN].filter(
-    (t): t is string => !!t && t.length > 0,
-  );
-  return tokens.reduce((m, t) => m.replaceAll(t, '***'), msg);
+/**
+ * Redact a git token from an error string before surfacing it: the one the
+ * knowledge base's runner authenticates with, plus whatever the environment
+ * holds (`redactSecret` names those itself).
+ */
+function redactTokens(msg: string, token: string | null | undefined): string {
+  return redactSecret(msg, [token]);
 }
 
 /**
@@ -275,6 +276,10 @@ export class WorkflowService implements IWorkflowService {
    * implementation detail of the workflow auto-merge story; nothing outside
    * the facade should call it directly.
    */
+  private get kbDirName(): string {
+    return this.kb.kbDirName;
+  }
+
   constructor(
     private readonly db: Database,
     private readonly git: GitService,
@@ -291,7 +296,7 @@ export class WorkflowService implements IWorkflowService {
      * See `lock-decoupling-plan.md` for the full design.
      */
     private readonly pendingCommits: PendingCommitsService,
-    private readonly kbDirName: string,
+    private readonly kb: KbContext,
     /**
      * The read-before-write gate `acquireLock` asks on every branch (see
      * `access-model/change-gate.ts`). Required, and checked at construction:
@@ -419,7 +424,7 @@ export class WorkflowService implements IWorkflowService {
     fn: () => Promise<T>,
   ): Promise<T> {
     const keys = [`branch:${source}`];
-    if (!isProtectedBranch(target)) keys.push(`branch:${target}`);
+    if (!this.kb.isProtectedBranch(target)) keys.push(`branch:${target}`);
     return this.branchLifecycle.runAll(keys, fn);
   }
 
@@ -573,8 +578,9 @@ export class WorkflowService implements IWorkflowService {
    */
   private async pullWorkspace(workspaceId: string): Promise<boolean> {
     const { treeChanged } = await this.git.pull(workspaceId);
-    if (treeChanged && branchForWorkspaceId(workspaceId) === DEFAULT_BRANCH) {
-      this.events?.emit({ kind: 'fs-tree-changed', workspaceId, branch: DEFAULT_BRANCH });
+    const defaultBranch = this.kb.defaultBranch;
+    if (treeChanged && branchForWorkspaceId(workspaceId) === defaultBranch) {
+      this.events?.emit({ kind: 'fs-tree-changed', workspaceId, branch: defaultBranch });
       return true;
     }
     return false;
@@ -961,7 +967,7 @@ export class WorkflowService implements IWorkflowService {
     // future caller can make that claim by passing a flag.
     if (
       typeof platformRestore?.source === 'string' &&
-      isPlatformRestoreShape(toRepoRelative(platformRestore.source), repoRelative) &&
+      isPlatformRestoreShape(toRepoRelative(platformRestore.source), repoRelative, this.kb.layout) &&
       (await this.accessControl.canRestorePlatformFile(workspaceId, userEmail, repoRelative))
     ) {
       return 'restore';
@@ -1037,7 +1043,7 @@ export class WorkflowService implements IWorkflowService {
     // coordination hold as write possession (see those methods).
     if (!opts?.coordination) {
       let via: 'granted' | 'restore' = 'granted';
-      if (isProtectedBranch(branch)) {
+      if (this.kb.isProtectedBranch(branch)) {
         // `assertCanWriteAtPath` throws AccessDeniedError on denial, with the
         // eligible-writers payload so the frontend can render a useful refusal.
         via = await this.assertCanWriteAtPath(
@@ -1321,7 +1327,8 @@ export class WorkflowService implements IWorkflowService {
     branch: string,
     targetPath: string,
     user: AuthUser,
-    opts?: { systemAuthorized?: boolean; skipValidation?: boolean },
+    /** `summary` overrides the path-derived commit subject; see `commitFile`. */
+    opts?: { systemAuthorized?: boolean; skipValidation?: boolean; summary?: string },
   ): Promise<void> {
     // `skipValidation` is the worker telling us this commit is not the last of
     // a burst. The validator is advisory — it parses the whole KB to produce a
@@ -1332,7 +1339,7 @@ export class WorkflowService implements IWorkflowService {
       workspaceId,
       user,
       targetPath,
-      undefined,
+      opts?.summary,
       opts?.skipValidation,
     );
     if (!change) {
@@ -1759,7 +1766,7 @@ export class WorkflowService implements IWorkflowService {
       throw new WorkflowValidationError('source and target branches must differ');
     }
     if (!input.title?.trim()) throw new WorkflowValidationError('title is required');
-    if (isProtectedBranch(input.sourceBranch)) {
+    if (this.kb.isProtectedBranch(input.sourceBranch)) {
       throw new WorkflowValidationError(
         `Cannot open a change request *from* a protected branch ("${input.sourceBranch}").`,
         { kind: 'source-is-protected', sourceBranch: input.sourceBranch },
@@ -1897,7 +1904,7 @@ export class WorkflowService implements IWorkflowService {
       // up-to-date) auto-merge, and inserts the row.
       const rawMsg = err instanceof Error ? err.message : String(err);
       throw new WorkflowValidationError(
-        `Failed to open change request: ${redactTokens(rawMsg)}`,
+        `Failed to open change request: ${redactTokens(rawMsg, this.git.credentials?.token())}`,
         { kind: 'open-change-request-failed' },
       );
     }
@@ -2851,7 +2858,7 @@ export class WorkflowService implements IWorkflowService {
 
     let live: Set<string>;
     try {
-      const branches = await this.git.listBranches(workspaceIdForBranch(DEFAULT_BRANCH), {
+      const branches = await this.git.listBranches(this.kb.defaultWorkspaceId(), {
         freshFetch: true,
         // The list is used to PROVE absence, and the listing's normal
         // degrade-to-stale behaviour would report every branch created since
@@ -3166,8 +3173,8 @@ export class WorkflowService implements IWorkflowService {
     // outright if it disagrees with the request's own base.) The failure the
     // pull reports is about OTHER people's commits not arriving, which leaves
     // the catalogs no staler than they were.
-    if (!announced && targetWorkspaceId && targetBranch === DEFAULT_BRANCH) {
-      this.events?.emit({ kind: 'fs-tree-changed', workspaceId: targetWorkspaceId, branch: DEFAULT_BRANCH });
+    if (!announced && targetWorkspaceId && targetBranch === this.kb.defaultBranch) {
+      this.events?.emit({ kind: 'fs-tree-changed', workspaceId: targetWorkspaceId, branch: targetBranch });
     }
   }
 
@@ -3234,7 +3241,7 @@ export class WorkflowService implements IWorkflowService {
           // change request's merge, nothing strips it here — so its presence
           // is what the hook refuses on) and both sides of a rename, since the
           // old name is a file this merge deletes.
-          authorize: isProtectedBranch(targetBranch)
+          authorize: this.kb.isProtectedBranch(targetBranch)
             ? async ({ sha, changedPaths }) => {
                 if (changedPaths.length === 0) return;
                 // roles.yaml never changes through a merge. A change request's
@@ -3445,7 +3452,7 @@ export class WorkflowService implements IWorkflowService {
         .where(eq(changeRequests.number, number))
         .limit(1);
       const sourceBranch = rows[0]?.sourceBranch;
-      if (!sourceBranch || isProtectedBranch(sourceBranch)) return;
+      if (!sourceBranch || this.kb.isProtectedBranch(sourceBranch)) return;
       // The open-check and the deletion hold the branch's lifecycle lock
       // TOGETHER — `openChangeRequest` holds the same lock across its own
       // check-then-insert, so a request being opened from this branch either
@@ -3620,7 +3627,7 @@ export class WorkflowService implements IWorkflowService {
       return stdout.split('\n').map((s) => s.trim()).filter(Boolean);
     } catch (err) {
       log.warn('listChangedPathsBetweenBranches failed:', {
-        detail: redactTokens(err instanceof Error ? err.message : String(err)),
+        detail: redactTokens(err instanceof Error ? err.message : String(err), this.git.credentials?.token()),
       });
       return [];
     }

package/src/modules/workspace/__tests__/file-stat-access.test.ts

@@ -4,6 +4,7 @@ import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import express from 'express';
 import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 import { LocalFilesystem } from '@mastra/core/workspace';
 import { ToolRegistry } from '../../tool-registry/tool-registry.js';
 import { createToolHandlerFactory } from '../../tool-helpers/tool-handler.js';
@@ -86,8 +87,8 @@ beforeAll(async () => {
     new SpillStore(join(tmpdir(), 'bevel-test-spills')),
     new DocExtractService(docCache),
     service,
-    KB,
-    { service: {} as never, enabled: false, kbDirName: KB, recoveryBotEmail: 'recovery-bot@bevel.local', hooks: new WorkflowHooks() },
+    testKbContext({ kbDirName: KB }),
+    { service: {} as never, enabled: false, kb: testKbContext({ kbDirName: KB }), recoveryBotEmail: 'recovery-bot@bevel.local', hooks: new WorkflowHooks() },
     new RoutineWritePolicyService(),
     {} as never,
   );

package/src/modules/workspace/__tests__/git-internals.security.test.ts

@@ -6,6 +6,7 @@ import { join } from 'node:path';
 import AdmZip from 'adm-zip';
 import express from 'express';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 import type { IWorkflowService } from '@bevel-software/platform-shared';
 import { GIT_INTERNALS_MESSAGE, GitInternalsError } from '../../../shared/domain-errors.js';
 import { workspaceIdForBranch } from '../../../shared/workspace-id.js';
@@ -241,7 +242,7 @@ describe('workspace tools refuse the git folder', () => {
 
   beforeEach(async () => {
     workflow = makeWorkflow();
-    const service = new WorkspaceService(root, 'https://example.invalid/kb.git', KB, new NodeFs());
+    const service = new WorkspaceService(root, 'https://example.invalid/kb.git', testKbContext({ kbDirName: KB }), new NodeFs());
     unzipSpy = vi.spyOn(service, 'unzipFile');
     bootstrappedSpy = vi.spyOn(service, 'hasBootstrappedWorkspace');
     const lockingFs = new LockingFilesystem(
@@ -275,8 +276,8 @@ describe('workspace tools refuse the git folder', () => {
       new SpillStore(join(root, 'spills')),
       new DocExtractService(join(root, 'doc-cache')),
       allowAll,
-      KB,
-      { service: {} as never, enabled: false, kbDirName: KB, recoveryBotEmail: 'recovery-bot@bevel.local', hooks: new WorkflowHooks() },
+      testKbContext({ kbDirName: KB }),
+      { service: {} as never, enabled: false, kb: testKbContext({ kbDirName: KB }), recoveryBotEmail: 'recovery-bot@bevel.local', hooks: new WorkflowHooks() },
       new RoutineWritePolicyService(),
       {} as never,
     );
@@ -416,7 +417,7 @@ describe('workspace routes refuse the git folder', () => {
 
   beforeEach(async () => {
     workflow = makeWorkflow();
-    service = new WorkspaceService(root, 'https://example.invalid/kb.git', KB, new NodeFs());
+    service = new WorkspaceService(root, 'https://example.invalid/kb.git', testKbContext({ kbDirName: KB }), new NodeFs());
     const app = express();
     app.use(express.json());
     app.use('/api', (req, _res, next) => {
@@ -436,7 +437,7 @@ describe('workspace routes refuse the git folder', () => {
         workflow as unknown as IWorkflowService,
         { emit: vi.fn() } as unknown as WorkflowEventBus,
         allowAll,
-        KB,
+        testKbContext({ kbDirName: KB }),
         stubCreatorAccess,
         { isAdmin: async () => true } as unknown as IAdminAccessService,
         new NodeFs(),
@@ -563,7 +564,7 @@ describe('WorkspaceService refuses the git folder on its own', () => {
   let service: WorkspaceService;
 
   beforeEach(() => {
-    service = new WorkspaceService(root, 'https://example.invalid/kb.git', KB, new NodeFs());
+    service = new WorkspaceService(root, 'https://example.invalid/kb.git', testKbContext({ kbDirName: KB }), new NodeFs());
   });
 
   afterEach(async () => {
@@ -620,7 +621,7 @@ describe('WorkspaceService refuses the git folder on its own', () => {
         return { stdout: '.git\n', stderr: '', code: 0 };
       }),
     };
-    const refService = new WorkspaceService(root, 'https://example.invalid/kb.git', KB, new NodeFs(), 'x-access-token', gitRunner as never);
+    const refService = new WorkspaceService(root, 'https://example.invalid/kb.git', testKbContext({ kbDirName: KB }), new NodeFs(), gitRunner as never);
 
     for (const [form, raw] of Object.entries(fileForms('config'))) {
       if (!form.startsWith('symlinked')) continue;
@@ -674,7 +675,7 @@ describe('the route guard on its own', () => {
   beforeEach(async () => {
     reached = 0;
     userId = USER.id;
-    const service = new WorkspaceService(root, 'https://example.invalid/kb.git', KB, new NodeFs());
+    const service = new WorkspaceService(root, 'https://example.invalid/kb.git', testKbContext({ kbDirName: KB }), new NodeFs());
     const app = express();
     // The server's own order: the guard ahead of the body parser, then again
     // on the parsed body, then again once the caller is known.
@@ -774,7 +775,7 @@ describe('DiffService refuses the git folder on its own', () => {
   let diffService: DiffService;
 
   beforeEach(() => {
-    const service = new WorkspaceService(root, 'https://example.invalid/kb.git', KB, new NodeFs());
+    const service = new WorkspaceService(root, 'https://example.invalid/kb.git', testKbContext({ kbDirName: KB }), new NodeFs());
     diffService = new DiffService(service, new WorkspaceMutex(), root, join(root, 'backups'), KB, new NodeFs());
   });
 

package/src/modules/workspace/__tests__/session-ontology.gate.test.ts

@@ -11,8 +11,10 @@ import type { ToolContext } from '../../tool-helpers/tool.contract.js';
 import type { ISessionOntologyService, OperationDecision } from '../../workflow/session-ontology.service.js';
 import { WorkflowHooks } from '../../workflow/workflow-hooks.js';
 import { ontologyOf } from '../../../shared/kb-layout.js';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 
 const KB = 'knowledge-base';
+const kbContext = testKbContext({ kbDirName: KB });
 const P_FILE = 'KnowledgeBase/Product/Knowledge/Foo.md';
 const PL_FILE = 'KnowledgeBase/Platform/Knowledge/Bar.md';
 const NEUTRAL = 'access.md';
@@ -28,7 +30,7 @@ function makeFakeService(): ISessionOntologyService {
   const setFor = (s: string) => touched.get(s) ?? new Set<string>();
   return {
     async checkOperation(sessionId, wsPath, isWrite): Promise<OperationDecision> {
-      const ont = ontologyOf(wsPath, KB);
+      const ont = ontologyOf(wsPath, kbContext.layout, KB);
       const set = setFor(sessionId);
       if (ont === null) return { allow: true, touched: [...set].sort() };
       if (isWrite) {
@@ -63,7 +65,7 @@ function makeFakeService(): ISessionOntologyService {
 function makeGate(): SessionOntologyGate {
   const service = makeFakeService();
   const hooks = new WorkflowHooks();
-  return { service, enabled: true, kbDirName: KB, recoveryBotEmail: RECOVERY_EMAIL, hooks };
+  return { service, enabled: true, kb: kbContext, recoveryBotEmail: RECOVERY_EMAIL, hooks };
 }
 
 function ctx(overrides: Partial<ToolContext> = {}): ToolContext {

package/src/modules/workspace/__tests__/workspace-paths-inside-the-repo.test.ts

@@ -7,6 +7,7 @@ import { fileURLToPath } from 'node:url';
 import AdmZip from 'adm-zip';
 import express from 'express';
 import { describe, it, expect, afterEach, vi } from 'vitest';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 import type { IWorkflowService } from '@bevel-software/platform-shared';
 import { NodeFs } from '../../kb-fs/node-fs.js';
 import type { IAccessControl } from '../../access/access-control.interface.js';
@@ -55,7 +56,7 @@ async function makeHarness(): Promise<Harness> {
   const workspaceDir = path.join(root, workspaceId);
   // The inner `.git` lets the service accept the workspace without cloning.
   await fs.mkdir(path.join(workspaceDir, KB, '.git'), { recursive: true });
-  const workspaceService = new WorkspaceService(root, 'https://example.invalid/kb.git', KB, new NodeFs());
+  const workspaceService = new WorkspaceService(root, 'https://example.invalid/kb.git', testKbContext({ kbDirName: KB }), new NodeFs());
   await workspaceService.getWorkspacePath(workspaceId);
 
   const asked: string[] = [];
@@ -102,7 +103,7 @@ async function makeHarness(): Promise<Harness> {
       workflowService,
       { emit: vi.fn() } as unknown as WorkflowEventBus,
       accessControl,
-      KB,
+      testKbContext({ kbDirName: KB }),
       stubCreatorAccess,
       { isAdmin: async () => false } as unknown as IAdminAccessService,
       new NodeFs(),

package/src/modules/workspace/__tests__/workspace.routes.branch-errors.test.ts

@@ -2,6 +2,7 @@ import type { Server } from 'node:http';
 import type { AddressInfo } from 'node:net';
 import express from 'express';
 import { describe, it, expect, afterEach, vi } from 'vitest';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 import { NodeFs } from '../../kb-fs/node-fs.js';
 import type { FileTreeEntry, IWorkflowService } from '@bevel-software/platform-shared';
 import type { IAccessControl } from '../../access/access-control.interface.js';
@@ -55,7 +56,7 @@ async function makeHarness(
     {} as unknown as IWorkflowService,
     { emit: vi.fn() } as unknown as WorkflowEventBus,
     accessControl,
-    'knowledge-base',
+    testKbContext(),
     stubCreatorAccess,
     { isAdmin: async () => false } as unknown as IAdminAccessService,
     new NodeFs(),

package/src/modules/workspace/__tests__/workspace.routes.create-grant.test.ts

@@ -2,6 +2,7 @@ import type { Server } from 'node:http';
 import type { AddressInfo } from 'node:net';
 import express from 'express';
 import { describe, it, expect, afterEach, vi } from 'vitest';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 import { NodeFs } from '../../kb-fs/node-fs.js';
 import type { IWorkflowService } from '@bevel-software/platform-shared';
 import type { IAccessControl } from '../../access/access-control.interface.js';
@@ -99,7 +100,7 @@ async function makeHarness(opts: { extracted?: string[]; changeGate?: IChangeRea
       workflowService,
       eventBus,
       {} as unknown as IAccessControl,
-      KB,
+      testKbContext({ kbDirName: KB }),
         creatorAccess as unknown as ICreatorAccess,
       // Not exercised here — only `.bevelignore`'s tree visibility consults it.
       { isAdmin: async () => false } as unknown as IAdminAccessService,

package/src/modules/workspace/__tests__/workspace.routes.delete.test.ts

@@ -5,6 +5,7 @@ import path from 'node:path';
 import os from 'node:os';
 import express from 'express';
 import { describe, it, expect, afterEach, vi } from 'vitest';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 import { NodeFs } from '../../kb-fs/node-fs.js';
 import type { IWorkflowService } from '@bevel-software/platform-shared';
 import type { IAccessControl } from '../../access/access-control.interface.js';
@@ -103,7 +104,7 @@ async function makeHarness(): Promise<Harness> {
     workflowService,
     eventBus,
     accessControl,
-    KB,
+    testKbContext({ kbDirName: KB }),
     stubCreatorAccess,
     // Not exercised here — only `.bevelignore`'s tree visibility consults it.
     { isAdmin: async () => false } as unknown as IAdminAccessService,