@bevel-software/platform-core-backend 0.20.0 → 0.22.0

package/src/modules/plugins/plugin-provision.service.ts

@@ -38,8 +38,6 @@ import type { IFsProbe } from '../../shared/fs.contract.js';
 import type { Discovery, PluginSource } from './discovery/plugin-source.js';
 
 import {
-  DEFAULT_BRANCH,
-  PLUGINS_DIR,
   PLUGIN_MANIFEST_FILE,
   PLUGIN_SKILLS_DIR,
   pluginDisplayNameOf,
@@ -52,6 +50,7 @@ import {
   validateFilename,
   type AuthUser,
 } from '@bevel-software/platform-shared';
+import type { KbContext } from '../../shared/kb-context.js';
 import type { WorkspaceService } from '../workspace/workspace.service.js';
 import type { IAccessControl } from '../access/access-control.interface.js';
 import { creatorPrincipal } from '../access-model/creator.js';
@@ -65,7 +64,8 @@ export interface ProvisionCommitDriver {
     branch: string,
     targetPath: string,
     user: AuthUser,
-    opts?: { systemAuthorized?: boolean },
+    /** `summary` overrides the path-derived commit subject — see `GitService.commitFile`. */
+    opts?: { systemAuthorized?: boolean; summary?: string },
   ): Promise<void>;
 }
 
@@ -129,8 +129,14 @@ export class PluginProvisionError extends Error {
 }
 
 /** The one shape every provisioning answer has: the folder in both spellings, and where its skills go. */
-function provisioned(folder: string, name: string, displayName: string, created: boolean): ProvisionedPlugin {
-  const path = `${PLUGINS_DIR}/${folder}`;
+function provisioned(
+  pluginsDir: string,
+  folder: string,
+  name: string,
+  displayName: string,
+  created: boolean,
+): ProvisionedPlugin {
+  const path = `${pluginsDir}/${folder}`;
   return { folder, path, skillsDir: `${path}/${PLUGIN_SKILLS_DIR}`, name, displayName, created };
 }
 
@@ -149,13 +155,22 @@ export class PluginProvisionService {
     private readonly workspaceService: WorkspaceService,
     private readonly commits: ProvisionCommitDriver,
     private readonly accessControl: IAccessControl,
-    private readonly kbDirName: string,
+    private readonly kb: KbContext,
     private readonly events: { emit(event: { kind: 'fs-tree-changed'; workspaceId: string; branch: string }): void } | undefined,
     /** Which names are TAKEN is discovery's answer — the same one every catalog gets. */
     private readonly source: PluginSource,
     private readonly disk: IFsProbe,
   ) {}
 
+  private get kbDirName(): string {
+    return this.kb.kbDirName;
+  }
+
+  /** The plugins root's name, read per use: a deployment may rename it from the setup screen. */
+  private get pluginsRoot(): string {
+    return this.kb.layout.pluginsDir;
+  }
+
   /**
    * Create `Plugins/<name>/` — or `Plugins/<parent>/<name>/` — for `user`.
    * Throws `PluginProvisionError` 422 on a name the filesystem or the model
@@ -226,7 +241,7 @@ export class PluginProvisionService {
       // `name` is the creator's own spelling, trimmed — the folder's leaf AND
       // the display name persisted for it, whether or not it equals either.
       await this.provision(user, folder, name, pluginAccessMd(user));
-      return provisioned(folder, pluginManifestName(name), name, true);
+      return provisioned(this.pluginsRoot, folder, pluginManifestName(name), name, true);
     });
   }
 
@@ -246,7 +261,7 @@ export class PluginProvisionService {
     if (segments.some((s) => validateFilename(s) !== null || s.startsWith('.'))) {
       throw new PluginProvisionError(`"${rawParent}" is not a folder name the knowledge base can carry.`, 422);
     }
-    const rel = `${PLUGINS_DIR}/${rawParent}`;
+    const rel = `${this.pluginsRoot}/${rawParent}`;
     // The personal namespace is the FIRST segment below the root — the same
     // structural rule as `isPersonalPluginDir`, applied to the parent and
     // everything under it. A `personal-*` folder there is a personal space
@@ -257,8 +272,8 @@ export class PluginProvisionService {
     }
     const wsId = await this.readyWorkspaceId();
     const wsDir = await this.workspaceService.getWorkspacePath(wsId);
-    if (!(await this.exactFolderExists(path.join(wsDir, this.kbDirName, PLUGINS_DIR), segments))) {
-      throw new PluginProvisionError(`There is no folder "${rawParent}" under ${PLUGINS_DIR}/.`, 404);
+    if (!(await this.exactFolderExists(path.join(wsDir, this.kbDirName, this.pluginsRoot), segments))) {
+      throw new PluginProvisionError(`There is no folder "${rawParent}" under ${this.pluginsRoot}/.`, 404);
     }
     // Judged against every folder discovery CLAIMS, not only the plugins it
     // lists: a twin skipped for its slug still owns its subtree, and a
@@ -287,7 +302,13 @@ export class PluginProvisionService {
     return this.creations.run(`plugin:${pluginManifestName(folder)}`, async () => {
       const existing = await this.existingFolder(folder);
       if (existing !== null) {
-        return provisioned(folder, pluginManifestName(folder), await this.persistedDisplayName(existing, folder), false);
+        return provisioned(
+          this.pluginsRoot,
+          folder,
+          pluginManifestName(folder),
+          await this.persistedDisplayName(existing, folder),
+          false,
+        );
       }
       try {
         await this.provision(user, folder, folder, personalAccessMd(user));
@@ -296,11 +317,17 @@ export class PluginProvisionService {
         // process, a checkout that appeared between check and write): the
         // folder existing is this method's success case, never its error.
         if (err instanceof PluginProvisionError && err.status === 409) {
-          return provisioned(folder, pluginManifestName(folder), await this.persistedDisplayName(folder, folder), false);
+          return provisioned(
+            this.pluginsRoot,
+            folder,
+            pluginManifestName(folder),
+            await this.persistedDisplayName(folder, folder),
+            false,
+          );
         }
         throw err;
       }
-      return provisioned(folder, pluginManifestName(folder), folder, true);
+      return provisioned(this.pluginsRoot, folder, pluginManifestName(folder), folder, true);
     });
   }
 
@@ -343,14 +370,14 @@ export class PluginProvisionService {
     if (!name || segments.some((s) => validateFilename(s) !== null || s.startsWith('.'))) {
       throw new PluginProvisionError('A plugin needs a name.', 422);
     }
-    if (isPersonalPluginDir(`${PLUGINS_DIR}/${name}`)) {
+    if (isPersonalPluginDir(`${this.pluginsRoot}/${name}`, this.kb.layout)) {
       // Personal folders are not plugins (the catalog never lists them), and
       // nobody deletes somebody's private shelf through the plugin door.
       throw new PluginProvisionError('Unknown plugin', 404);
     }
     const wsId = await this.readyWorkspaceId();
     const wsDir = await this.workspaceService.getWorkspacePath(wsId);
-    const pluginsDir = path.join(wsDir, this.kbDirName, PLUGINS_DIR);
+    const pluginsDir = path.join(wsDir, this.kbDirName, this.pluginsRoot);
     const folderDir = path.join(pluginsDir, ...segments);
     // Locked on the plugin's IDENTITY — the same key a creation of that name
     // takes — not on a slug of the folder path, which for a nested plugin is a
@@ -361,7 +388,7 @@ export class PluginProvisionService {
     // discovery refuses, as it does for creation. A folder discovery does not
     // list (no manifest at all) locks on its own slug — nothing else can
     // claim that identity either.
-    const identity = await this.discoveredIdentity(`${PLUGINS_DIR}/${name}`, segments[segments.length - 1]!);
+    const identity = await this.discoveredIdentity(`${this.pluginsRoot}/${name}`, segments[segments.length - 1]!);
     return this.creations.run(`plugin:${identity}`, async () => {
       // Exact spelling of EVERY component — the catalog hands the route the
       // on-disk spelling, so a mismatch means the plugin is gone (or was
@@ -392,8 +419,8 @@ export class PluginProvisionService {
         // deletion under it: one commit, one removed plugin.
         await this.commits.runPendingCommit(
           wsId,
-          DEFAULT_BRANCH,
-          `${this.kbDirName}/${PLUGINS_DIR}/${name}`,
+          this.kb.defaultBranch,
+          `${this.kbDirName}/${this.pluginsRoot}/${name}`,
           user,
           { systemAuthorized: true },
         );
@@ -411,7 +438,7 @@ export class PluginProvisionService {
       // The folder's rules left the access model — drop the resolver cache
       // so the very next check runs against a tree without them.
       this.accessControl.invalidate(wsId);
-      this.events?.emit({ kind: 'fs-tree-changed', workspaceId: wsId, branch: DEFAULT_BRANCH });
+      this.events?.emit({ kind: 'fs-tree-changed', workspaceId: wsId, branch: this.kb.defaultBranch });
     });
   }
 
@@ -422,7 +449,7 @@ export class PluginProvisionService {
    */
   private async exactFolderExists(root: string, segments: string[]): Promise<boolean> {
     let dir = root;
-    let rel = PLUGINS_DIR;
+    let rel = this.pluginsRoot;
     for (const segment of segments) {
       const entries = await listDirOrIncomplete(this.disk, dir, rel);
       if (!entries?.some((e) => e.isDirectory() && e.name === segment)) return false;
@@ -439,7 +466,7 @@ export class PluginProvisionService {
   private async existingFolder(name: string, parent = ''): Promise<string | null> {
     const wsId = await this.readyWorkspaceId();
     const wsDir = await this.workspaceService.getWorkspacePath(wsId);
-    const rel = parent ? `${PLUGINS_DIR}/${parent}` : PLUGINS_DIR;
+    const rel = parent ? `${this.pluginsRoot}/${parent}` : this.pluginsRoot;
     // No Plugins/ root yet — nothing can collide.
     const children = await listDirOrIncomplete(this.disk, path.join(wsDir, this.kbDirName, rel), rel);
     if (!children) return null;
@@ -461,7 +488,7 @@ export class PluginProvisionService {
     const wsId = await this.readyWorkspaceId();
     const wsDir = await this.workspaceService.getWorkspacePath(wsId);
     const manifest = await this.disk.readJsonObject(
-      path.join(wsDir, this.kbDirName, PLUGINS_DIR, ...folder.split('/'), PLUGIN_MANIFEST_FILE),
+      path.join(wsDir, this.kbDirName, this.pluginsRoot, ...folder.split('/'), PLUGIN_MANIFEST_FILE),
     );
     return pluginDisplayNameOf(manifest) || fallback;
   }
@@ -518,7 +545,7 @@ export class PluginProvisionService {
    */
   private async provision(user: AuthUser, folder: string, leaf: string, accessMd: string): Promise<void> {
     const wsId = await this.readyWorkspaceId();
-    const folderPath = `${this.kbDirName}/${PLUGINS_DIR}/${folder}`;
+    const folderPath = `${this.kbDirName}/${this.pluginsRoot}/${folder}`;
     const wsRelPath = `${folderPath}/access.md`;
     try {
       // Exclusive create — the fs is the arbiter of a same-name race, not
@@ -557,7 +584,7 @@ export class PluginProvisionService {
       // rule this endpoint exists to carve through. The endpoint has already
       // authorized the write (any signed-in user, unused name, exclusive
       // create), so the per-user gate is skipped for exactly this commit.
-      await this.commits.runPendingCommit(wsId, DEFAULT_BRANCH, folderPath, user, {
+      await this.commits.runPendingCommit(wsId, this.kb.defaultBranch, folderPath, user, {
         systemAuthorized: true,
       });
     } catch (err) {
@@ -568,7 +595,7 @@ export class PluginProvisionService {
       // so a concurrent writer's bytes can't be collateral.
       try {
         const wsDir = await this.workspaceService.getWorkspacePath(wsId);
-        const folderDir = path.join(wsDir, this.kbDirName, PLUGINS_DIR, folder);
+        const folderDir = path.join(wsDir, this.kbDirName, this.pluginsRoot, folder);
         await fs.rm(path.join(folderDir, 'access.md'), { force: true });
         await fs.rm(path.join(folderDir, PLUGIN_MANIFEST_FILE), { force: true });
         await fs.rmdir(folderDir).catch(() => {});
@@ -580,11 +607,11 @@ export class PluginProvisionService {
     // The folder's rules changed the access model — drop the resolver cache
     // so the very next check (the creator's first skill write) sees them.
     this.accessControl.invalidate(wsId);
-    this.events?.emit({ kind: 'fs-tree-changed', workspaceId: wsId, branch: DEFAULT_BRANCH });
+    this.events?.emit({ kind: 'fs-tree-changed', workspaceId: wsId, branch: this.kb.defaultBranch });
   }
 
   private async readyWorkspaceId(): Promise<string> {
-    const ws = await this.workspaceService.getOrCreateForBranch(DEFAULT_BRANCH);
+    const ws = await this.workspaceService.getOrCreateForBranch(this.kb.defaultBranch);
     return ws.id;
   }
 }

package/src/modules/plugins/plugin-rename.service.ts

@@ -18,8 +18,8 @@ import {
   parsePluginPrincipalKey,
 } from '../access-model/access-grammar.js';
 import type { WorkspaceService } from '../workspace/workspace.service.js';
+import type { KbContext } from '../../shared/kb-context.js';
 import type { PluginSource } from './discovery/plugin-source.js';
-import { linksWorkspaceId } from './plugin-links.js';
 
 export class PluginRenameError extends Error {
   constructor(
@@ -70,15 +70,19 @@ export class PluginRenameService {
     private readonly accessControl: IAccessControl,
     private readonly source: PluginSource,
     private readonly disk: ITreeWalker,
-    private readonly kbDirName: string,
+    private readonly kb: KbContext,
     private readonly events?: {
       emit(event: { kind: 'fs-tree-changed'; workspaceId: string; branch: string }): void;
     },
     private readonly onChanged?: () => void,
   ) {}
 
+  private get kbDirName(): string {
+    return this.kb.kbDirName;
+  }
+
   private noteChanged(wsId: string): void {
-    noteChangedFor(this.accessControl, this.events, this.onChanged, wsId);
+    noteChangedFor(this.accessControl, this.events, this.onChanged, wsId, this.kb.defaultBranch);
   }
 
   /** The READ phase must have seen everything it needed; a hole refuses the rename before any write. */
@@ -96,7 +100,7 @@ export class PluginRenameService {
     current: string,
     patch: { name?: unknown; displayName?: unknown },
   ): Promise<RenameResult> {
-    const wsId = linksWorkspaceId();
+    const wsId = this.kb.defaultWorkspaceId();
     const kbRoot = path.join(await this.workspaceService.getWorkspacePath(wsId), this.kbDirName);
     // ONE walk of the checkout for everything the rename needs to know:
     // the plugins (discovery's listener) and every file that can carry a
@@ -277,9 +281,10 @@ function noteChangedFor(
   events: PluginRenameService['events'],
   onChanged: (() => void) | undefined,
   wsId: string,
+  branch: string,
 ): void {
   accessControl.invalidate(wsId);
-  events?.emit({ kind: 'fs-tree-changed', workspaceId: wsId, branch: linksWorkspaceIdBranch() });
+  events?.emit({ kind: 'fs-tree-changed', workspaceId: wsId, branch });
   onChanged?.();
 }
 
@@ -303,8 +308,3 @@ export function renamePluginPrincipalInText(text: string, oldName: string, nextN
     })
     .join('\n');
 }
-
-function linksWorkspaceIdBranch(): string {
-  // The default branch's workspace id IS its encoded branch name.
-  return decodeURIComponent(linksWorkspaceId());
-}

package/src/modules/plugins/plugins.routes.ts

@@ -13,11 +13,13 @@ import {
 import type { IAccessControl } from '../access/access-control.interface.js';
 import { WorkflowDomainError } from '../../shared/domain-errors.js';
 import { domainErrorBody } from '../../shared/http-errors.js';
-import { pluginsWorkspaceId, pluginFolderBelowRoot } from './plugins.service.js';
+import { pluginFolderBelowRoot } from './plugins.service.js';
+import type { KbContext } from '../../shared/kb-context.js';
 import { PluginProvisionError, type PluginProvisionService } from './plugin-provision.service.js';
 import { PluginLinkError, type PluginLinksService } from './plugin-links.service.js';
 import { PluginRenameError, type PluginRenameService } from './plugin-rename.service.js';
 import type { JoinRequestsService } from './join-requests.service.js';
+import { folderTarget } from '../access/access-requests.contract.js';
 import type { PluginJoinRequestJobs } from './join-request-jobs.service.js';
 import type { JoinRequestRecord } from './join-request-records.store.js';
 import type {
@@ -159,6 +161,8 @@ export function createPluginsRoutes(
   joinRequestJobs: PluginJoinRequestJobs,
   provision: PluginProvisionService,
   resolveUser: (req: express.Request) => Promise<AuthUser | null>,
+  /** The released branch's clone — every verdict here is read from it. */
+  kb: Pick<KbContext, 'defaultWorkspaceId'>,
   /** Optional: a host without the link machinery simply has no link routes. */
   links?: PluginLinksService,
   /** Optional: a host without it has no rename route. */
@@ -209,11 +213,30 @@ export function createPluginsRoutes(
    *   POST   /api/plugins/:name/links          { skillPath }  → { root, skills }
    *   DELETE /api/plugins/:name/links?skillPath=              → { root, revoked }
    *   POST   /api/plugins/:name/links/repair   { skillPath }  → { root }
+   *   POST   /api/plugins/:name/links/repair-all              → { repaired, skipped }
    *
    * Refusals carry a `kind` the UI branches on — `needs-skill-write` (409) is
    * the one that becomes "request write access".
+   *
+   * `repair-all` is the plugin PAGE's: it repairs every link of the plugin the
+   * caller can, and reports what it could not. A caller who may not write the
+   * plugin gets the same 404 every other link route gives them, so probing it
+   * confirms nothing about a plugin they cannot see.
    */
   if (links) {
+    /** The one refusal mapping every link route answers with. */
+    const linkFailure = (res: express.Response, err: unknown) => {
+      if (err instanceof PluginLinkError) {
+        res.status(err.status).json({ error: err.message, ...err.payload });
+        return;
+      }
+      if (err instanceof WorkflowDomainError) {
+        res.status(err.status).json(domainErrorBody(err));
+        return;
+      }
+      log.error('link operation failed:', { err });
+      res.status(500).json({ error: 'Failed to update the plugin\'s links' });
+    };
     const linkOp = async (
       req: express.Request,
       res: express.Response,
@@ -237,16 +260,7 @@ export function createPluginsRoutes(
       try {
         res.json(await op(user, String(req.params.name), skillPath));
       } catch (err) {
-        if (err instanceof PluginLinkError) {
-          res.status(err.status).json({ error: err.message, ...err.payload });
-          return;
-        }
-        if (err instanceof WorkflowDomainError) {
-          res.status(err.status).json(domainErrorBody(err));
-          return;
-        }
-        log.error('link operation failed:', { err });
-        res.status(500).json({ error: 'Failed to update the plugin\'s links' });
+        linkFailure(res, err);
       }
     };
     const bodyPath = (req: express.Request) => ((req.body ?? {}) as { skillPath?: unknown }).skillPath;
@@ -254,6 +268,23 @@ export function createPluginsRoutes(
     router.post('/plugins/:name/links/repair', (req, res) =>
       linkOp(req, res, (u, p, s) => links.repair(u, p, s), bodyPath),
     );
+    // No `skillPath`: this one is about the plugin, so it cannot ride `linkOp`.
+    router.post('/plugins/:name/links/repair-all', async (req, res) => {
+      if (!req.userEmail) {
+        res.status(401).json({ error: 'Unauthenticated' });
+        return;
+      }
+      const user = await resolveUser(req);
+      if (!user) {
+        res.status(401).json({ error: 'Unauthenticated' });
+        return;
+      }
+      try {
+        res.json(await links.repairAll(user, String(req.params.name)));
+      } catch (err) {
+        linkFailure(res, err);
+      }
+    });
     router.delete('/plugins/:name/links', (req, res) =>
       linkOp(req, res, (u, p, s) => links.unlink(u, p, s), (r) => r.query.skillPath),
     );
@@ -296,7 +327,7 @@ export function createPluginsRoutes(
         res.json({ plugins: [] });
         return;
       }
-      const wsId = pluginsWorkspaceId();
+      const wsId = kb.defaultWorkspaceId();
       const probes = probesFor(catalog);
       const [readable, writable, owned] = await Promise.all([
         accessControl.canReadBatch(wsId, email, probes),
@@ -453,7 +484,7 @@ export function createPluginsRoutes(
       }
       // By identity — the manifest name the catalog keys on.
       const plugin = (await pluginIndex.catalog()).find((g) => g.name === req.params.name);
-      const wsId = pluginsWorkspaceId();
+      const wsId = kb.defaultWorkspaceId();
       const ownerVerdicts = plugin
         ? await Promise.all(
             plugin.folders.map((f) => accessControl.canOwner(wsId, email, memberProbe(f))),
@@ -494,7 +525,7 @@ export function createPluginsRoutes(
       const catalog = await pluginIndex.catalog();
       // By identity — the manifest name the catalog keys on.
       const plugin = catalog.find((g) => g.name === req.params.name);
-      const wsId = pluginsWorkspaceId();
+      const wsId = kb.defaultWorkspaceId();
       // Same ANY-folder shape `GET /plugins` resolves with, so a plugin can
       // never be listed as discoverable there and rejected as unknown here.
       const verdicts = plugin
@@ -567,7 +598,7 @@ export function createPluginsRoutes(
       return null;
     }
     const writable = await accessControl.canWriteBatch(
-      pluginsWorkspaceId(),
+      kb.defaultWorkspaceId(),
       email,
       plugin.folders.map(accessMdOf),
     );
@@ -589,7 +620,7 @@ export function createPluginsRoutes(
       if (!ctx) return;
       const crs = await workflow.listChangeRequests();
       res.json({
-        requests: await joinRequests.list(joinKeyOf(ctx.plugin), ctx.folder, crs, ctx.user),
+        requests: await joinRequests.list(joinKeyOf(ctx.plugin), folderTarget(ctx.folder), crs, ctx.user),
       });
     } catch (err) {
       log.error('failed to list join requests:', { err });
@@ -619,7 +650,7 @@ export function createPluginsRoutes(
         res.status(404).json({ error: 'Not found' });
         return;
       }
-      res.json({ closed: await joinRequests.reconcile(joinKeyOf(ctx.plugin), ctx.folder, cr, ctx.user) });
+      res.json({ closed: await joinRequests.reconcile(joinKeyOf(ctx.plugin), folderTarget(ctx.folder), cr, ctx.user) });
     } catch (err) {
       log.error('failed to reconcile a join request:', { err });
       res.status(500).json({ error: 'Failed to update the request' });

package/src/modules/plugins/plugins.service.ts

@@ -3,13 +3,10 @@ import { logger } from '../../shared/logging.js';
 
 const log = logger('plugins');
 import path from 'node:path';
-import {
-  DEFAULT_BRANCH,
-} from '@bevel-software/platform-shared';
 import { isPrivateAccessMd } from '../access-model/access-grammar.js';
 import { isAbsence } from '../../shared/fs.contract.js';
 import type { WorkspaceService } from '../workspace/workspace.service.js';
-import { workspaceIdForBranch } from '../../shared/workspace-id.js';
+import type { KbContext } from '../../shared/kb-context.js';
 import type { IAccessControl } from '../access/access-control.interface.js';
 import type { ISkillService } from '../skills/skills.contract.js';
 import type { IToolManualService } from '../tool-manuals/tool-manuals.contract.js';
@@ -63,7 +60,7 @@ export class PluginIndexService implements IPluginIndexService {
     private readonly accessControl: IAccessControl,
     private readonly skillService: ISkillService,
     private readonly toolManualService: IToolManualService,
-    private readonly kbDirName: string,
+    private readonly kb: KbContext,
     /** Where plugins come from — the one discovery every catalog shares. */
     private readonly source: PluginSource,
     now: () => number = Date.now,
@@ -77,6 +74,10 @@ export class PluginIndexService implements IPluginIndexService {
     this.cache = new TtlCache(CACHE_TTL_MS, now);
   }
 
+  private get kbDirName(): string {
+    return this.kb.kbDirName;
+  }
+
   invalidate(): void {
     this.cache.invalidate();
   }
@@ -115,7 +116,7 @@ export class PluginIndexService implements IPluginIndexService {
    */
   private async build(): Promise<PluginCatalogEntry[] | null> {
     try {
-      const wsId = (await this.workspaceService.getOrCreateForBranch(DEFAULT_BRANCH)).id;
+      const wsId = (await this.workspaceService.getOrCreateForBranch(this.kb.defaultBranch)).id;
       const kbRoot = path.join(await this.workspaceService.getWorkspacePath(wsId), this.kbDirName);
 
       const scanned = await this.scanFolders(kbRoot);
@@ -301,11 +302,6 @@ function bucketByFolder(items: { path: string }[], folders: Map<string, string[]
   return counts;
 }
 
-/** The default-branch workspace id every plugin resolution runs against. */
-export function pluginsWorkspaceId(): string {
-  return workspaceIdForBranch(DEFAULT_BRANCH);
-}
-
 /**
  * A plugin folder's path BELOW the plugins root: `GTM`, or `teams/deep`.
  *

package/src/modules/plugins/teams.routes.ts

@@ -2,12 +2,17 @@ import express from 'express';
 import { logger } from '../../shared/logging.js';
 
 const log = logger('teams');
-import { isPersonalPluginDir, isPersonalPluginFolder, pluginOfPath } from '@bevel-software/platform-shared';
+import {
+  isPersonalPluginDir,
+  isPersonalPluginFolder,
+  pluginOfPath,
+  type KbLayout,
+} from '@bevel-software/platform-shared';
 import type { IAccessControl } from '../access/access-control.interface.js';
+import type { KbContext } from '../../shared/kb-context.js';
 import type { ISkillService } from '../skills/skills.contract.js';
 import type { IToolManualService } from '../tool-manuals/tool-manuals.contract.js';
 import type { IPluginIndexService, PluginCatalogEntry } from './plugins.contract.js';
-import { pluginsWorkspaceId } from './plugins.service.js';
 
 /**
  * What one team can use, by id — the Library's "Your teams" lens.
@@ -51,6 +56,8 @@ export function createTeamsRoutes(
   pluginIndex: IPluginIndexService,
   skillService: Pick<ISkillService, 'listSkills'>,
   toolManuals: Pick<IToolManualService, 'listAllSummaries'>,
+  /** The released branch's clone the verdicts are read from, and the layout that names the plugins root. */
+  kb: Pick<KbContext, 'defaultWorkspaceId' | 'layout'>,
 ): express.Router {
   const router = express.Router();
 
@@ -61,7 +68,7 @@ export function createTeamsRoutes(
       return;
     }
     try {
-      const wsId = pluginsWorkspaceId();
+      const wsId = kb.defaultWorkspaceId();
       const [{ groups }, catalog, allSkills, allTools] = await Promise.all([
         accessControl.kbPrincipals(wsId),
         pluginIndex.catalog(),
@@ -73,9 +80,10 @@ export function createTeamsRoutes(
       // be a team's to read — whatever a hand-written grant in there says.
       // One rule for the plugin and for its contents, so the two cannot
       // disagree.
-      const plugins = catalog.filter((g) => !g.folders.every(isPersonalPluginDir));
-      const skills = allSkills.filter((s) => !inPersonalPlugin(s.path));
-      const tools = allTools.filter((t) => !inPersonalPlugin(t.path));
+      const layout = kb.layout;
+      const plugins = catalog.filter((g) => !g.folders.every((f) => isPersonalPluginDir(f, layout)));
+      const skills = allSkills.filter((s) => !inPersonalPlugin(s.path, layout));
+      const tools = allTools.filter((t) => !inPersonalPlugin(t.path, layout));
       const folderProbes = plugins.flatMap((g) => g.folders);
       const discoverProbes = folderProbes.map(accessMdOf);
       const skillProbes = skills.map((s) => skillMdOf(s.path));
@@ -123,7 +131,7 @@ export function createTeamsRoutes(
 const accessMdOf = (folder: string) => `${folder}/access.md`;
 const skillMdOf = (skillPath: string) => `${skillPath}/SKILL.md`;
 /** Under `Plugins/personal-<id>/…` — one person's space, whatever it grants. */
-const inPersonalPlugin = (repoPath: string) => {
-  const folder = pluginOfPath(repoPath);
+const inPersonalPlugin = (repoPath: string, layout: KbLayout) => {
+  const folder = pluginOfPath(repoPath, layout);
   return folder !== null && isPersonalPluginFolder(folder);
 };

package/src/modules/secrets-vault/__tests__/connect-pending.route.test.ts

@@ -2,6 +2,7 @@ import type { Server as HttpServer } from 'node:http';
 import express from 'express';
 import { afterEach, describe, expect, it } from 'vitest';
 import { createSecretsVaultRoutes } from '../secrets-vault.routes.js';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 
 /**
  * The aggregated `/connect/pending` surface: everything standing between the
@@ -85,6 +86,7 @@ async function baseUrlWith(auth: { userId?: string; email?: string }): Promise<s
   app.use(
     '/api',
     createSecretsVaultRoutes({
+      kb: testKbContext(),
       secretsVault,
       toolManualService,
       accessControl,
@@ -170,6 +172,7 @@ describe('GET /api/connect/pending — the workspace tier', () => {
     app.use(
       '/api',
       createSecretsVaultRoutes({
+      kb: testKbContext(),
         secretsVault: {
           statusFor: async (_u: string, keys: string[]) =>
             keys.map((key) => ({
@@ -258,6 +261,7 @@ describe('GET /api/connect/pending — readability', () => {
     app.use(
       '/api',
       createSecretsVaultRoutes({
+      kb: testKbContext(),
         secretsVault: {
           statusFor: async (_u: string, keys: string[]) =>
             keys.map((key) => ({
@@ -384,6 +388,7 @@ describe('GET /api/connect/pending — OAuth scope coverage', () => {
     app.use(
       '/api',
       createSecretsVaultRoutes({
+      kb: testKbContext(),
         secretsVault: vaultWithGranted(grantedScopes),
         toolManualService: oauthTool,
         accessControl,
@@ -478,6 +483,7 @@ describe('GET /api/connect/pending — tool sign-ins are not double-listed as st
     app.use(
       '/api',
       createSecretsVaultRoutes({
+      kb: testKbContext(),
         secretsVault: vault,
         toolManualService: oauthTool,
         accessControl,
@@ -538,6 +544,7 @@ describe('GET /api/connect/pending — a row of the wrong KIND is not "set up"',
     app.use(
       '/api',
       createSecretsVaultRoutes({
+      kb: testKbContext(),
         secretsVault: {
           statusFor: async (_u: string, keys: string[]) => keys.map(opts.status),
           list: async () => [],