@bevel-software/platform-core-backend 0.20.0 → 0.22.0

package/src/modules/workflow/git/__tests__/node-git-runner.test.ts

@@ -3,7 +3,7 @@ import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { NodeGitRunner } from '../node-git-runner.js';
-import { GitRunError, isGitTimeout } from '../../../../shared/git.contract.js';
+import { GitRunError, gitCredentials, isGitTimeout } from '../../../../shared/git.contract.js';
 
 /**
  * These run REAL git, like the rest of this module's suites: the behaviours
@@ -94,10 +94,48 @@ describe('NodeGitRunner', () => {
     expect(true).toBe(true);
   });
 
+  /**
+   * The helper the runner's callers stamp into a clone, reduced to the one
+   * thing under test here: what `$GITHUB_TOKEN` is in the child. `credential
+   * fill` runs it through git's own shell and prints what it answered, which
+   * is the same path a push takes to its password.
+   */
+  const ECHO_TOKEN_HELPER = `!f() { printf '%s\\n' "username=u" "password=\${GITHUB_TOKEN-none}"; }; f`;
+  const fill = (runner: NodeGitRunner, env?: NodeJS.ProcessEnv) =>
+    runner.run(dir, ['-c', `credential.helper=${ECHO_TOKEN_HELPER}`, 'credential', 'fill'], {
+      input: 'protocol=https\nhost=example.test\n\n',
+      env,
+    });
+
+  it('hands its token to the child, where the helper reads it, and never puts it in argv', async () => {
+    const runner = new NodeGitRunner(undefined, gitCredentials('x-access-token', 'ghp_child_secret'));
+    const { stdout } = await fill(runner);
+    expect(stdout).toContain('password=ghp_child_secret');
+  });
+
+  it('drops a token this process inherited: only the credentials in effect reach git', async () => {
+    const previous = process.env.GITHUB_TOKEN;
+    process.env.GITHUB_TOKEN = 'ghp_stale_in_process_env';
+    try {
+      const { stdout } = await fill(new NodeGitRunner());
+      expect(stdout).toContain('password=none');
+      expect(stdout).not.toContain('ghp_stale_in_process_env');
+    } finally {
+      if (previous === undefined) delete process.env.GITHUB_TOKEN;
+      else process.env.GITHUB_TOKEN = previous;
+    }
+  });
+
+  it('lets a per-call environment entry win over its own token: the setup probe checks the token it was given', async () => {
+    const runner = new NodeGitRunner(undefined, gitCredentials('x-access-token', 'ghp_in_effect'));
+    const { stdout } = await fill(runner, { GITHUB_TOKEN: 'ghp_being_checked' });
+    expect(stdout).toContain('password=ghp_being_checked');
+  });
+
   it('keeps the configured git token out of failures', async () => {
-    const runner = new NodeGitRunner();
+    const runner = new NodeGitRunner(undefined, gitCredentials('x-access-token', 'ghp_secret_value_here'));
     const previous = process.env.GITHUB_TOKEN;
-    process.env.GITHUB_TOKEN = 'ghp_secret_value_here';
+    delete process.env.GITHUB_TOKEN;
     try {
       const err = await runner
         .run(dir, ['ls-remote', 'https://x-access-token:ghp_secret_value_here@127.0.0.1:1/r.git'], {

package/src/modules/workflow/git/__tests__/pull-request.service.getPrDetail.test.ts

@@ -49,7 +49,13 @@ describe('PullRequestService.getPrDetail — git work per read', () => {
     const resolvePrShas = vi.fn(async () => ({ baseSha: BASE, headSha: HEAD }));
     const changedFilesForPr = vi.fn(async () => []);
     const forkPointForPr = vi.fn(async () => ({ mergeBaseSha: FORK, behind: true }));
-    const git = { resolvePrShas, changedFilesForPr, forkPointForPr } as unknown as GitService;
+    const pathsChangedBetween = vi.fn(async () => []);
+    const git = {
+      resolvePrShas,
+      changedFilesForPr,
+      forkPointForPr,
+      pathsChangedBetween,
+    } as unknown as GitService;
     const workspace = {
       findAnyWorkspaceId: async () => 'ws-main',
       ensureRemotesFetched: async () => undefined,
@@ -63,7 +69,14 @@ describe('PullRequestService.getPrDetail — git work per read', () => {
       getApprovalStates,
       evaluateMergeGate: () => ({ mergeable: false, reasons: [], warnings: [] }),
     });
-    return { svc, resolvePrShas, changedFilesForPr, forkPointForPr, getApprovalStates };
+    return {
+      svc,
+      resolvePrShas,
+      changedFilesForPr,
+      forkPointForPr,
+      pathsChangedBetween,
+      getApprovalStates,
+    };
   }
 
   it('pins the file list to the SHAs it just resolved, and keeps patches for a client read', async () => {
@@ -179,3 +192,133 @@ describe('PullRequestService — change request link', () => {
     expect(detail?.urlNote).toBe('Set PUBLIC_FRONTEND_URL to get absolute links.');
   });
 });
+
+/**
+ * `needsUpdate` — the answer the dialog acts on, as distinct from `behind`.
+ *
+ * `behind` is the honest git fact that the two branches have diverged. On a
+ * knowledge base where every shared save commits to the default branch it is
+ * true again minutes after every update, and acting on it made opening a
+ * request pay for a merge on almost every open — for changes to files the
+ * request does not contain. `needsUpdate` adds the half that matters: the
+ * target changed a file THIS request also changes.
+ */
+describe('PullRequestService.getPrDetail — needsUpdate', () => {
+  const FILE = 'Sales/Deal.md';
+  const OTHER = 'Ops/Runbook.md';
+
+  function harness(opts: {
+    behind?: boolean;
+    mergeBaseSha?: string | null;
+    files?: { path: string; previousPath?: string }[];
+    changedOnTarget?: string[];
+    changedOnTargetError?: Error;
+    state?: string;
+  } = {}) {
+    const resolvePrShas = vi.fn(async () => ({ baseSha: BASE, headSha: HEAD }));
+    const changedFilesForPr = vi.fn(async () => (opts.files ?? [{ path: FILE }]) as never);
+    const forkPointForPr = vi.fn(async () => ({
+      mergeBaseSha: opts.mergeBaseSha === undefined ? FORK : opts.mergeBaseSha,
+      behind: opts.behind ?? true,
+    }));
+    const pathsChangedBetween = opts.changedOnTargetError
+      ? vi.fn().mockRejectedValue(opts.changedOnTargetError)
+      : vi.fn(async () => opts.changedOnTarget ?? []);
+    const git = {
+      resolvePrShas,
+      changedFilesForPr,
+      forkPointForPr,
+      pathsChangedBetween,
+    } as unknown as GitService;
+    const workspace = {
+      findAnyWorkspaceId: async () => 'ws-main',
+      ensureRemotesFetched: async () => undefined,
+    } as unknown as WorkspaceService;
+    const access = { canWriteAtRef: async () => false } as unknown as IAccessControl;
+    const db = {
+      select: () => ({
+        from: () => ({
+          where: () => ({ limit: async () => [{ ...ROW, state: opts.state ?? 'open' }] }),
+        }),
+      }),
+    } as unknown as Database;
+    const svc = new PullRequestService(db, workspace, access, git);
+    svc.setDetailEnricher({
+      listComments: async () => [],
+      getApprovalStates: async () => [],
+      evaluateMergeGate: () => ({ mergeable: false, reasons: [], warnings: [] }),
+    });
+    return { svc, pathsChangedBetween };
+  }
+
+  it('is false when the target moved in files this request does not change', async () => {
+    // The case that made the message appear on essentially every open: a
+    // shared save somewhere else in the knowledge base.
+    const h = harness({ files: [{ path: FILE }], changedOnTarget: [OTHER] });
+    const detail = await h.svc.getPrDetail(7, { fresh: true });
+    expect(detail?.behind).toBe(true);
+    expect(detail?.needsUpdate).toBe(false);
+  });
+
+  it('is true when the target changed a file this request also changes', async () => {
+    const h = harness({ files: [{ path: FILE }], changedOnTarget: [OTHER, FILE] });
+    const detail = await h.svc.getPrDetail(7, { fresh: true });
+    expect(detail?.needsUpdate).toBe(true);
+    // Intersected over the fork point → the target's tip: the same two
+    // commits the rest of the detail is pinned to.
+    expect(h.pathsChangedBetween).toHaveBeenCalledWith('ws-main', FORK, BASE);
+  });
+
+  it('asks git nothing at all when the request is not behind', async () => {
+    // The common case, and the one that has to stay free.
+    const h = harness({ behind: false });
+    const detail = await h.svc.getPrDetail(7, { fresh: true });
+    expect(detail?.needsUpdate).toBe(false);
+    expect(h.pathsChangedBetween).not.toHaveBeenCalled();
+  });
+
+  it('asks git nothing when the request changes no files', async () => {
+    const h = harness({ files: [], changedOnTarget: [FILE] });
+    const detail = await h.svc.getPrDetail(7, { fresh: true });
+    expect(detail?.needsUpdate).toBe(false);
+    expect(h.pathsChangedBetween).not.toHaveBeenCalled();
+  });
+
+  it('counts a file the target RENAMED, under either of its names', async () => {
+    // `pathsChangedBetween` runs without rename detection, so the target's
+    // rename reports the path it left as well as the one it arrived at — and
+    // a request still editing the old name is affected.
+    const h = harness({
+      files: [{ path: FILE }],
+      changedOnTarget: [FILE, 'Sales/Deal-2026.md'],
+    });
+    expect((await h.svc.getPrDetail(7, { fresh: true }))?.needsUpdate).toBe(true);
+  });
+
+  it('counts a file THIS request renamed, under the name it came from', async () => {
+    const h = harness({
+      files: [{ path: 'Sales/Deal-final.md', previousPath: FILE }],
+      changedOnTarget: [FILE],
+    });
+    expect((await h.svc.getPrDetail(7, { fresh: true }))?.needsUpdate).toBe(true);
+  });
+
+  it('is true when the branches share no history — there is nothing to intersect', async () => {
+    const h = harness({ mergeBaseSha: null });
+    const detail = await h.svc.getPrDetail(7, { fresh: true });
+    expect(detail?.needsUpdate).toBe(true);
+    expect(h.pathsChangedBetween).not.toHaveBeenCalled();
+  });
+
+  it('is true when the comparison itself fails — an infra error is not "this is fine"', async () => {
+    const h = harness({ changedOnTargetError: new Error('git exploded') });
+    expect((await h.svc.getPrDetail(7, { fresh: true }))?.needsUpdate).toBe(true);
+  });
+
+  it('is false for a request that is not open, whatever git says', async () => {
+    const h = harness({ state: 'merged', changedOnTarget: [FILE] });
+    const detail = await h.svc.getPrDetail(7, { fresh: true });
+    expect(detail?.needsUpdate).toBe(false);
+    expect(detail?.behind).toBe(false);
+  });
+});

package/src/modules/workflow/git/__tests__/pull-request.service.viewer-can-delete.test.ts

@@ -0,0 +1,166 @@
+import { describe, it, expect } from 'vitest';
+import { computeViewerCanDelete } from '../pull-request.service.js';
+import { hashEmail } from '../../../../shared/email-identity.js';
+
+const EMAIL = 'juan@bevel.software';
+const AUTHOR_HASH = hashEmail(EMAIL);
+const OTHER_AUTHOR_HASH = hashEmail('someone-else@bevel.software');
+
+/**
+ * The truth table for who may delete a request outright — close it AND retire
+ * its branch. It must mirror `deleteChangeRequest`'s own check, which is why
+ * the interesting rows here are the ones where it DIFFERS from its siblings:
+ * an owner of every changed file is absent (they decline, they do not
+ * destroy), and a closed request still says yes (its leftover branch is still
+ * the server's to retire).
+ */
+describe('computeViewerCanDelete', () => {
+  it('lets the author delete their own open request', () => {
+    expect(
+      computeViewerCanDelete({
+        state: 'open',
+        authorId: AUTHOR_HASH,
+        viewerEmail: EMAIL,
+        viewerCanBypassMerge: false,
+      }),
+    ).toBe(true);
+  });
+
+  it('lets an admin delete someone else’s open request', () => {
+    expect(
+      computeViewerCanDelete({
+        state: 'open',
+        authorId: OTHER_AUTHOR_HASH,
+        viewerEmail: EMAIL,
+        viewerCanBypassMerge: true,
+      }),
+    ).toBe(true);
+  });
+
+  it('says yes once for a viewer who is both author and admin', () => {
+    expect(
+      computeViewerCanDelete({
+        state: 'open',
+        authorId: AUTHOR_HASH,
+        viewerEmail: EMAIL,
+        viewerCanBypassMerge: true,
+      }),
+    ).toBe(true);
+  });
+
+  it('refuses a signed-in user who is neither author nor admin', () => {
+    expect(
+      computeViewerCanDelete({
+        state: 'open',
+        authorId: OTHER_AUTHOR_HASH,
+        viewerEmail: EMAIL,
+        viewerCanBypassMerge: false,
+      }),
+    ).toBe(false);
+  });
+
+  it('fails closed with no viewer, even on one’s own-looking request', () => {
+    expect(
+      computeViewerCanDelete({
+        state: 'open',
+        authorId: AUTHOR_HASH,
+        viewerEmail: undefined,
+        viewerCanBypassMerge: false,
+      }),
+    ).toBe(false);
+  });
+
+  it('fails closed for an anonymous admin-flagged read', () => {
+    expect(
+      computeViewerCanDelete({
+        state: 'open',
+        authorId: OTHER_AUTHOR_HASH,
+        viewerEmail: undefined,
+        viewerCanBypassMerge: true,
+      }),
+    ).toBe(false);
+  });
+
+  it('refuses an APPLIED request to its author — applied history is nobody’s to delete', () => {
+    expect(
+      computeViewerCanDelete({
+        state: 'merged',
+        authorId: AUTHOR_HASH,
+        viewerEmail: EMAIL,
+        viewerCanBypassMerge: false,
+      }),
+    ).toBe(false);
+  });
+
+  it('refuses an APPLIED request to an admin too', () => {
+    expect(
+      computeViewerCanDelete({
+        state: 'merged',
+        authorId: OTHER_AUTHOR_HASH,
+        viewerEmail: EMAIL,
+        viewerCanBypassMerge: true,
+      }),
+    ).toBe(false);
+  });
+
+  it('still says yes on a CLOSED request: the leftover branch is the delete’s job', () => {
+    // Withdrawn in another tab. The server's delete still succeeds there and
+    // removes the branch the withdraw left behind, so the hint must not go
+    // quiet the moment the row flips — unlike `viewerCanCancel`, which is
+    // open-only because there is nothing left to cancel.
+    expect(
+      computeViewerCanDelete({
+        state: 'closed',
+        authorId: AUTHOR_HASH,
+        viewerEmail: EMAIL,
+        viewerCanBypassMerge: false,
+      }),
+    ).toBe(true);
+    expect(
+      computeViewerCanDelete({
+        state: 'closed',
+        authorId: OTHER_AUTHOR_HASH,
+        viewerEmail: EMAIL,
+        viewerCanBypassMerge: true,
+      }),
+    ).toBe(true);
+  });
+
+  it('refuses a request with no stored author to a non-admin (opened outside this backend)', () => {
+    expect(
+      computeViewerCanDelete({
+        state: 'open',
+        authorId: undefined,
+        viewerEmail: EMAIL,
+        viewerCanBypassMerge: false,
+      }),
+    ).toBe(false);
+  });
+
+  it('leaves normalization to hashEmail, exactly as its siblings do', () => {
+    expect(
+      computeViewerCanDelete({
+        state: 'open',
+        authorId: AUTHOR_HASH,
+        viewerEmail: '  Juan@Bevel.Software  ',
+        viewerCanBypassMerge: false,
+      }),
+    ).toBe(true);
+  });
+
+  it('does NOT grant the owner of every changed file — it takes no such input', () => {
+    // Decision 4. The owner of every changed file is exactly the person
+    // `computeViewerCanCancel` says yes to and this predicate must not: they
+    // may decline the request, which leaves the author's branch to rework.
+    // There is no input here to express that grant, and the row a
+    // file-owning non-admin produces reads false.
+    expect(
+      computeViewerCanDelete({
+        state: 'open',
+        authorId: OTHER_AUTHOR_HASH,
+        viewerEmail: EMAIL,
+        viewerCanBypassMerge: false,
+      }),
+    ).toBe(false);
+  });
+});

package/src/modules/workflow/git/git.service.ts

@@ -26,9 +26,8 @@ import {
   assertValidRelativePath,
   isBranchAuthoredBy,
   isOwnSuggestionsBranch,
-  isProtectedBranch,
-  PROTECTED_BRANCHES,
 } from '../../kb-fs/branch-name.js';
+import type { KbContext } from '../../../shared/kb-context.js';
 import {
   BranchAuthorshipError,
   WorkflowDomainError,
@@ -42,6 +41,7 @@ import {
   GitRunError,
   isGitTimeout,
   redactGitToken,
+  type GitCredentials,
   type GitRunOptions,
   type GitRunResult,
   type IGitRunner,
@@ -296,7 +296,7 @@ export class GitService implements IGitService {
      * safe because validation is advisory and never blocks a commit.
      */
     private readonly hooks: WorkflowHooks,
-    private readonly kbDirName: string,
+    private readonly kb: KbContext,
     private readonly mutex: WorkspaceMutex = new WorkspaceMutex(),
     private readonly accessControl: IAccessControl | null = null,
     /**
@@ -309,6 +309,18 @@ export class GitService implements IGitService {
     private readonly gitRunner: IGitRunner = new NodeGitRunner(),
   ) {}
 
+  private get kbDirName(): string {
+    return this.kb.kbDirName;
+  }
+
+  /**
+   * The credentials the runner authenticates with — for the services above
+   * this one that scrub a message git or the host echoed a token into.
+   */
+  get credentials(): GitCredentials {
+    return this.gitRunner.credentials;
+  }
+
   /**
    * "Does the pending-commits queue hold rows for this workspace?" — used by
    * `statusInternal` to tell an expected dirty tree (queued saves still
@@ -552,7 +564,7 @@ export class GitService implements IGitService {
             );
             infos[i] = {
               name: row.shortName,
-              isProtected: isProtectedBranch(row.shortName),
+              isProtected: this.kb.isProtectedBranch(row.shortName),
               ahead,
               behind,
               hasRemote: row.hasRemote,
@@ -655,7 +667,7 @@ export class GitService implements IGitService {
     fromBase?: string,
   ): Promise<BranchInfo> {
     assertValidBranchName(name);
-    if (isProtectedBranch(name)) {
+    if (this.kb.isProtectedBranch(name)) {
       throw new ProtectedBranchError(name, 'creating a protected branch');
     }
     if (fromBase) assertValidBranchName(fromBase);
@@ -731,7 +743,7 @@ export class GitService implements IGitService {
     opts: { onlyIfNoRemote?: boolean; systemCleanup?: boolean } = {},
   ): Promise<void> {
     assertValidBranchName(name);
-    if (isProtectedBranch(name)) {
+    if (this.kb.isProtectedBranch(name)) {
       throw new ProtectedBranchError(name, 'deleting a protected branch');
     }
     return this.mutex.run(workspaceId, async () => {
@@ -895,7 +907,7 @@ export class GitService implements IGitService {
       // boundary. Without this guard, the standard "fork to draft then
       // propose" workflow would 403 for non-admins — they can't write
       // protected, can't write the draft they forked from it either.
-      if (isProtectedBranch(branch)) {
+      if (this.kb.isProtectedBranch(branch)) {
         // Gate against the access tree as it exists at HEAD — the pre-commit
         // state. Reading from the working tree would let the user broaden
         // their own access by editing access.md alongside the change they're
@@ -1172,7 +1184,7 @@ export class GitService implements IGitService {
       // Protected-branch access gate (defence in depth — callers already gate at
       // lock-acquire / upload-mint, but this primitive is generic). Gate every
       // touched path against the access tree at HEAD, like `commit()`.
-      if (isProtectedBranch(branch)) {
+      if (this.kb.isProtectedBranch(branch)) {
         await this.assertCanWriteAtRef(workspaceId, 'HEAD', user.email, touched);
       }
 
@@ -1292,7 +1304,7 @@ export class GitService implements IGitService {
       // decided the write is legitimate (unused name, exclusive create);
       // gating it here again just refuses every non-admin the product
       // promised a plugin to.
-      if (isProtectedBranch(branch) && !opts?.systemAuthorized) {
+      if (this.kb.isProtectedBranch(branch) && !opts?.systemAuthorized) {
         const touched = await this.unpushedTouchedPaths(cwd);
         await this.assertCanWriteAtRef(
           workspaceId,
@@ -1542,6 +1554,7 @@ export class GitService implements IGitService {
           throw new Error(
             `git merge failed without detectable conflicts: ${redactGitToken(
               err instanceof Error ? err.message : String(err),
+              this.credentials.token(),
             )}`,
           );
         }
@@ -1747,7 +1760,12 @@ export class GitService implements IGitService {
    * conflict into the typed error the workflow layer queues recovery for.
    * Shared by `pull` and `syncFromRemote` so the two cannot drift.
    */
-  private async rebaseOntoRemote(cwd: string, branch: string, remoteRef: string): Promise<void> {
+  private async rebaseOntoRemote(
+    cwd: string,
+    branch: string,
+    remoteRef: string,
+    opts: { preserveMerges?: boolean } = {},
+  ): Promise<void> {
     // An UNBORN HEAD (a clone of an upstream that was empty when cloned) has
     // no commit to replay and `git rebase` refuses to start from it, so the
     // branch is moved to the remote commit instead. That is only safe while
@@ -1785,7 +1803,20 @@ export class GitService implements IGitService {
       // the local commits onto origin, then reapplies them, so the retry
       // push can fast-forward. Untracked files don't block rebase and are
       // left untouched.
-      await this.git(cwd, ['rebase', '--autostash', remoteRef]);
+      // `--rebase-merges` is what keeps an unpushed MERGE a merge. Plain
+      // rebase replays `--no-merges upstream..HEAD`, which turns a merge
+      // commit the clone holds but origin has not seen into cherry-picks of
+      // the commits it merged — the merged branch stops being a parent, so
+      // "does the published head contain the target's head" answers no
+      // however many times the update runs. Only the change-request update
+      // asks for it; every other pull replays plain saves, where the two
+      // spellings produce the same history.
+      await this.git(cwd, [
+        'rebase',
+        '--autostash',
+        ...(opts.preserveMerges ? ['--rebase-merges'] : []),
+        remoteRef,
+      ]);
     } catch (err) {
       // Capture the contested paths BEFORE the abort wipes the rebase
       // state — `--diff-filter=U` lists exactly the files whose replay
@@ -1909,7 +1940,10 @@ export class GitService implements IGitService {
     });
   }
 
-  async pull(workspaceId: string): Promise<{ treeChanged: boolean }> {
+  async pull(
+    workspaceId: string,
+    opts: { preserveMerges?: boolean } = {},
+  ): Promise<{ treeChanged: boolean }> {
     return this.mutex.run(workspaceId, async () => {
       const cwd = await this.repoDir(workspaceId);
       const branch = await this.checkedOutBranch(cwd);
@@ -1922,7 +1956,7 @@ export class GitService implements IGitService {
       // Refresh WITHOUT `git pull`, and without touching `FETCH_HEAD` — see
       // `refreshRemoteBranchRef` for why both halves are load-bearing.
       const remoteRef = await this.refreshRemoteBranchRef(cwd, branch);
-      await this.rebaseOntoRemote(cwd, branch, remoteRef);
+      await this.rebaseOntoRemote(cwd, branch, remoteRef, opts);
       this.accessControl?.invalidate(workspaceId);
       const treeAfter = (await this.revParseOrNull(cwd, 'HEAD^{tree}')) ?? '';
       return { treeChanged: treeAfter !== treeBefore };
@@ -2109,7 +2143,7 @@ export class GitService implements IGitService {
     return this.mutex.run(workspaceId, async () => {
       const cwd = await this.repoDir(workspaceId);
       let best: { base: string; ahead: number } | null = null;
-      for (const p of PROTECTED_BRANCHES) {
+      for (const p of this.kb.protectedBranches) {
         if (p === branch) continue;
         const res = await this.tryAheadBehind(cwd, branch, `origin/${p}`);
         if (res && (best === null || res.ahead < best.ahead)) {
@@ -3133,7 +3167,7 @@ export class GitService implements IGitService {
     }
 
     let best: { ahead: number; behind: number } | null = null;
-    for (const p of PROTECTED_BRANCHES) {
+    for (const p of this.kb.protectedBranches) {
       if (p === shortName) continue;
       const res = await this.tryAheadBehind(cwd, ref, `refs/remotes/origin/${p}`);
       if (res && (best === null || res.ahead < best.ahead)) best = res;
@@ -3447,5 +3481,3 @@ export function parseNumstatZ(out: string): NumstatEntry[] {
   }
   return entries;
 }
-
-export { PROTECTED_BRANCHES };

package/src/modules/workflow/git/node-git-runner.ts

@@ -1,7 +1,10 @@
 import { spawn, type ChildProcess, type SpawnOptions } from 'node:child_process';
 import {
+  GIT_TOKEN_ENV,
   GitRunError,
+  NO_GIT_CREDENTIALS,
   redactGitToken,
+  type GitCredentials,
   type GitRunOptions,
   type GitRunResult,
   type IGitRunner,
@@ -212,7 +215,33 @@ function spawnGit(args: string[], options: SpawnOptions & { maxBuffer: number })
  * `WorkspaceMutex`'s job and stays the caller's to have done.
  */
 export class NodeGitRunner implements IGitRunner {
-  constructor(readonly defaultTimeoutMs: number = DEFAULT_GIT_TIMEOUT_MS) {}
+  constructor(
+    readonly defaultTimeoutMs: number = DEFAULT_GIT_TIMEOUT_MS,
+    /**
+     * What every call authenticates with. The token goes into the CHILD's
+     * environment only (see {@link childEnv}); a runner built without one
+     * runs git unauthenticated, which is what a directly constructed service
+     * in a test gets.
+     */
+    readonly credentials: GitCredentials = NO_GIT_CREDENTIALS,
+  ) {}
+
+  /**
+   * The environment one invocation runs under. The token in effect goes in
+   * under {@link GIT_TOKEN_ENV}, and a stale one this process inherited from
+   * its own environment goes OUT: a server hosting several knowledge bases
+   * must never let one knowledge base's git call find another's token, or an
+   * operator's, lying in `process.env`. A caller's per-call entry still wins
+   * over the provider's (the setup probe runs with the token it is checking,
+   * not the one in effect), and the fixed entries win over everything.
+   */
+  private childEnv(overrides: NodeJS.ProcessEnv | undefined): NodeJS.ProcessEnv {
+    const env: NodeJS.ProcessEnv = { ...process.env };
+    delete env[GIT_TOKEN_ENV];
+    const token = this.credentials.token();
+    if (token) env[GIT_TOKEN_ENV] = token;
+    return { ...env, ...overrides, ...FIXED_ENV };
+  }
 
   run(cwd: string, args: string[], opts: GitRunOptions & { encoding: 'buffer' }): Promise<GitRunResult<Buffer>>;
   run(cwd: string, args: string[], opts?: GitRunOptions & { encoding?: 'utf8' }): Promise<GitRunResult>;
@@ -221,10 +250,16 @@ export class NodeGitRunner implements IGitRunner {
     const timers: NodeJS.Timeout[] = [];
     let timedOut = false;
 
+    // A credential that expires is renewed before it is read. Renewing is
+    // the credential's own business and its failure is not this call's:
+    // plenty of git never leaves the disk, and a call that does is told by
+    // the host what the token in hand is worth.
+    await this.credentials.prepare?.().catch(() => undefined);
+
     try {
       const { promise: pending, child } = spawnGit(args, {
         cwd,
-        env: { ...process.env, ...opts.env, ...FIXED_ENV },
+        env: this.childEnv(opts.env),
         maxBuffer: MAX_OUTPUT_BYTES,
         // Makes the child a process-group leader so that `killTree` can signal
         // the transport helpers it spawns, not just git itself. Not on Windows,
@@ -291,9 +326,13 @@ export class NodeGitRunner implements IGitRunner {
           : Buffer.isBuffer(original.stderr)
             ? original.stderr.toString()
             : undefined;
-      throw new GitRunError(`git ${subcommand} failed: ${redactGitToken(message)}`, {
+      // Scrubbed with the token THIS runner handed the child, and the one a
+      // caller laid over it for the call: both can be echoed back by git.
+      const secrets = [this.credentials.token(), opts.env?.[GIT_TOKEN_ENV]];
+      const scrub = (text: string): string => secrets.reduce<string>((out, token) => redactGitToken(out, token), text);
+      throw new GitRunError(`git ${subcommand} failed: ${scrub(message)}`, {
         exitCode: typeof original.code === 'number' ? original.code : undefined,
-        stderr: stderr === undefined ? undefined : redactGitToken(stderr),
+        stderr: stderr === undefined ? undefined : scrub(stderr),
       });
     } finally {
       // Every timer is cleared on every path. The later ones in particular