@bevel-software/platform-core-backend 0.21.0 → 0.22.0

package/dist/shared/git.contract.d.ts

@@ -61,6 +61,16 @@ export interface GitCredentials {
     username(): string;
     /** The token in effect, or null when the deployment has none configured. */
     token(): string | null;
+    /**
+     * Make sure {@link token} answers with a credential that is still good,
+     * for one that is not fixed: a token a host issues for an hour has to be
+     * renewed by asking the host, which `token` cannot do, being read where
+     * nothing can wait. The runner awaits this before every call it makes. A
+     * failure here is not the call's failure: git runs with the token in
+     * hand, and the host says what it thinks of it. Absent for a credential
+     * that does not expire.
+     */
+    prepare?(): Promise<void>;
 }
 /** The username git is given when a deployment names none. */
 export declare const DEFAULT_GIT_USERNAME = "x-access-token";

package/dist/shared/git.contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git.contract.d.ts","sourceRoot":"","sources":["../../src/shared/git.contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;;OAKG;IACH,QAAQ,IAAI,MAAM,CAAC;IACnB,4EAA4E;IAC5E,KAAK,IAAI,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,8DAA8D;AAC9D,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AAErD;;;;;GAKG;AACH,eAAO,MAAM,aAAa,iBAAiB,CAAC;AAE5C,iEAAiE;AACjE,eAAO,MAAM,kBAAkB,EAAE,cAG/B,CAAC;AAEH,0EAA0E;AAC1E,wBAAgB,cAAc,CAC5B,QAAQ,GAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAwB,EACxD,KAAK,GAAE,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,MAAM,GAAG,IAAI,CAAQ,GAClD,cAAc,CAOhB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAMrF;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY,CAAC,IAAI,GAAG,MAAM;IACzC,MAAM,EAAE,IAAI,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,WAAY,SAAQ,KAAK;IACpC,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAE3B;;;;;OAKG;gBACS,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAO;CAOnG;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAElD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IACrC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,GAAG;QAAE,QAAQ,EAAE,QAAQ,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9G,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CACvG"}
+{"version":3,"file":"git.contract.d.ts","sourceRoot":"","sources":["../../src/shared/git.contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;;OAKG;IACH,QAAQ,IAAI,MAAM,CAAC;IACnB,4EAA4E;IAC5E,KAAK,IAAI,MAAM,GAAG,IAAI,CAAC;IACvB;;;;;;;;OAQG;IACH,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,8DAA8D;AAC9D,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AAErD;;;;;GAKG;AACH,eAAO,MAAM,aAAa,iBAAiB,CAAC;AAE5C,iEAAiE;AACjE,eAAO,MAAM,kBAAkB,EAAE,cAG/B,CAAC;AAEH,0EAA0E;AAC1E,wBAAgB,cAAc,CAC5B,QAAQ,GAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAwB,EACxD,KAAK,GAAE,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,MAAM,GAAG,IAAI,CAAQ,GAClD,cAAc,CAOhB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAMrF;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY,CAAC,IAAI,GAAG,MAAM;IACzC,MAAM,EAAE,IAAI,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,WAAY,SAAQ,KAAK;IACpC,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAE3B;;;;;OAKG;gBACS,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAO;CAOnG;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAElD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IACrC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,GAAG;QAAE,QAAQ,EAAE,QAAQ,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9G,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CACvG"}

package/dist/shared/git.contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"git.contract.js","sourceRoot":"","sources":["../../src/shared/git.contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AA4BH,8DAA8D;AAC9D,MAAM,CAAC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAErD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,cAAc,CAAC;AAE5C,iEAAiE;AACjE,MAAM,CAAC,MAAM,kBAAkB,GAAmB,MAAM,CAAC,MAAM,CAAC;IAC9D,QAAQ,EAAE,GAAG,EAAE,CAAC,oBAAoB;IACpC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI;CAClB,CAAC,CAAC;AAEH,0EAA0E;AAC1E,MAAM,UAAU,cAAc,CAC5B,WAAoC,oBAAoB,EACxD,QAA+C,IAAI;IAEnD,MAAM,IAAI,GAAG,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC;IACxE,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;IACjE,OAAO;QACL,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,oBAAoB;QAC9C,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,IAAI,IAAI;KAC9B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,KAAgC;IAC3E,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,wEAAwE;IACxE,2EAA2E;IAC3E,wCAAwC;IACxC,OAAO,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;AACxD,CAAC;AA8CD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,0DAA0D;IACjD,QAAQ,CAAU;IAC3B,+DAA+D;IACtD,MAAM,CAAU;IACzB,+DAA+D;IACtD,QAAQ,CAAU;IAE3B;;;;;OAKG;IACH,YAAY,OAAe,EAAE,OAAmE,EAAE;QAChG,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC;IACzC,CAAC;CACF;AAED,kFAAkF;AAClF,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,OAAO,GAAG,YAAY,WAAW,IAAI,GAAG,CAAC,QAAQ,CAAC;AACpD,CAAC"}
+{"version":3,"file":"git.contract.js","sourceRoot":"","sources":["../../src/shared/git.contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAsCH,8DAA8D;AAC9D,MAAM,CAAC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAErD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,cAAc,CAAC;AAE5C,iEAAiE;AACjE,MAAM,CAAC,MAAM,kBAAkB,GAAmB,MAAM,CAAC,MAAM,CAAC;IAC9D,QAAQ,EAAE,GAAG,EAAE,CAAC,oBAAoB;IACpC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI;CAClB,CAAC,CAAC;AAEH,0EAA0E;AAC1E,MAAM,UAAU,cAAc,CAC5B,WAAoC,oBAAoB,EACxD,QAA+C,IAAI;IAEnD,MAAM,IAAI,GAAG,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC;IACxE,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;IACjE,OAAO;QACL,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,oBAAoB;QAC9C,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,IAAI,IAAI;KAC9B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,KAAgC;IAC3E,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,wEAAwE;IACxE,2EAA2E;IAC3E,wCAAwC;IACxC,OAAO,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;AACxD,CAAC;AA8CD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,0DAA0D;IACjD,QAAQ,CAAU;IAC3B,+DAA+D;IACtD,MAAM,CAAU;IACzB,+DAA+D;IACtD,QAAQ,CAAU;IAE3B;;;;;OAKG;IACH,YAAY,OAAe,EAAE,OAAmE,EAAE;QAChG,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC;IACzC,CAAC;CACF;AAED,kFAAkF;AAClF,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,OAAO,GAAG,YAAY,WAAW,IAAI,GAAG,CAAC,QAAQ,CAAC;AACpD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bevel-software/platform-core-backend",
-  "version": "0.21.0",
+  "version": "0.22.0",
   "description": "Open-source core backend of the Bevel platform: git-backed knowledge workspace, workflow (branches/change requests/locks/SSE), skills, tools, secrets vault, access control and the remote MCP surface.",
   "type": "module",
   "main": "./dist/index.js",
@@ -52,8 +52,8 @@
     "xlsx": "https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz",
     "yaml": "^2.9.0",
     "zod": "^3.24.0",
-    "@bevel-software/platform-mcp-core": "0.21.0",
-    "@bevel-software/platform-shared": "0.21.0"
+    "@bevel-software/platform-mcp-core": "0.22.0",
+    "@bevel-software/platform-shared": "0.22.0"
   },
   "devDependencies": {
     "@types/adm-zip": "^0.5.8",

package/src/core/create-core-server.ts

@@ -10,6 +10,7 @@ import { createDiffRoutes } from '../modules/diff/diff.routes.js';
 import { createWorkflowRoutes } from '../modules/workflow/workflow.routes.js';
 import { createEventsRoutes } from '../modules/workflow/events.routes.js';
 import { createAccessRoutes } from '../modules/access/access.routes.js';
+import { createAccessRequestRoutes } from '../modules/access/access-requests.routes.js';
 import { createMcpRoutes } from '../modules/mcp/mcp.routes.js';
 import { createOAuthConsentRoutes } from '../modules/mcp/oauth/oauth-consent.routes.js';
 import { mcpAuthRouter } from '@modelcontextprotocol/sdk/server/auth/router.js';
@@ -50,7 +51,8 @@ import { createConnectionKeysAdminRoutes } from '../modules/tool-auth/connection
 import { createAuditRoutes } from '../modules/audit/audit.routes.js';
 import { createAgentRestAuditMiddleware } from '../modules/audit/agent-rest-audit.middleware.js';
 import { EXTERNAL_KB_MANUAL_NAME } from '../modules/tool-manuals/tool-manuals.contract.js';
-import { createSetupRoutes } from '../modules/settings/setup.routes.js';
+import { createSetupRoutes, isComplete } from '../modules/settings/setup.routes.js';
+import { createGitHubAppRoutes } from '../modules/github-app/index.js';
 import { oidcRedirectUri } from '../modules/auth/oidc-auth-provider.js';
 import { repositoryConnectionCheck } from '../modules/settings/connection-check.js';
 import { rootFolderListerFor } from '../modules/settings/git-root-folders.js';
@@ -591,6 +593,18 @@ export async function createCoreServer(
     core.kb,
     [core.config.adminEmail],
   ));
+  // Asking for Can edit or Owner on an item from its Manage access dialog, and
+  // the editors' Accept / Decline. Mounted beside the access routes it shares
+  // its gate with: the request is refused by the same canWrite it would
+  // otherwise have to wait for.
+  app.use('/api', core.authMiddleware, createAccessRequestRoutes({
+    accessControl: core.accessControl,
+    workspaceService: core.workspaceService,
+    authService: core.authService,
+    workflow: core.workflowService,
+    lifecycle: core.joinRequestsService,
+    kb: core.kb,
+  }));
   app.use(
     '/api',
     core.authMiddleware,
@@ -700,8 +714,30 @@ export async function createCoreServer(
       repositoryConnectionCheck(core.gitRunner),
       rootFolderListerFor(core.gitRunner),
       oidcRedirectUri(core.config.publicBackendUrl),
+      // The two sign-in checks keep their defaults.
+      undefined,
+      undefined,
+      {
+        source: core.repositorySource,
+        ensureManaged: (branch) => core.managedRepository.ensure(core.gitRunner, branch),
+        githubApp: core.githubApp,
+      },
     ),
   );
+  // Connecting a repository on GitHub through a GitHub App: the round trips
+  // to GitHub the setup screen starts, behind the same sign-in.
+  app.use(
+    '/api',
+    core.authMiddleware,
+    createGitHubAppRoutes({
+      settings: core.settings,
+      connection: core.githubApp,
+      adminAccess: core.adminAccess,
+      publicBackendUrl: core.config.publicBackendUrl,
+      publicFrontendUrl: core.config.publicFrontendUrl,
+      isComplete: () => isComplete(core.settings, core.kb, core.repositorySource),
+    }),
+  );
   const toolPageUser = async (userId: string): Promise<AuthUser | undefined> => {
     const u = await core.authService.getUserById(userId);
     return u ? ({ id: u.id, email: u.email, name: u.name } as AuthUser) : undefined;

package/src/core/create-core-services.ts

@@ -30,7 +30,10 @@ import { KbSyncService } from '../modules/kb-sync/kb-sync.service.js';
 import { NodeFs } from '../modules/kb-fs/node-fs.js';
 import { assertKbDirNameFree } from '../modules/kb-fs/repo-path.js';
 import type { IFsProbe, ITreeWalker } from '../shared/fs.contract.js';
-import { gitCredentials, type IGitRunner } from '../shared/git.contract.js';
+import type { IGitRunner } from '../shared/git.contract.js';
+import { ManagedRepository, MANAGED_DEFAULT_BRANCH } from '../modules/settings/managed-repository.js';
+import { RepositorySource } from '../modules/settings/repository-source.js';
+import { GitHubAppConnection } from '../modules/github-app/index.js';
 import { AdvisoryLease, AdvisoryLock } from '../modules/database/advisory-lock.js';
 import { holdCommitWorkerLease, withStartupTask, type LeaseLoopHandle } from './lifecycle.js';
 
@@ -186,6 +189,15 @@ export interface CoreServices {
    * first-time setup completion — and never again while the process serves.
    */
   kbStartupRunner: KbStartupRunner;
+  /**
+   * Where the knowledge base's repository is and what git presents to it,
+   * whichever way the deployment was given one (see `RepositorySource`).
+   */
+  repositorySource: RepositorySource;
+  /** The repository the deployment keeps for itself, when that is the way it chose. */
+  managedRepository: ManagedRepository;
+  /** The connection to GitHub through a GitHub App, when that is the way it chose. */
+  githubApp: GitHubAppConnection;
   /**
    * The startup phase's retry when the boot survived an unreachable remote
    * — set by `startCore`, stopped by `stopCore` (see `core/lifecycle.ts`);
@@ -434,18 +446,49 @@ export async function createCoreServices(
   // settings catalogue knows `GIT_TOKEN` alone. Handed to the runner, which
   // puts the token into each child's environment — never into this
   // process's, which several knowledge bases may share.
-  const gitCredentialsInEffect = gitCredentials(
-    () => settings.resolve('gitUsername') || config.gitUsername,
-    () => settings.resolve('gitToken') || config.gitToken || null,
-  );
+  //
+  // Both come from the repository source, which is the one place that knows
+  // a deployment can be given its repository in more than one way; what
+  // comes back is the address and the credential, as it always was.
+  const managedRepository = new ManagedRepository(path.join(config.backupsRoot, 'managed-repository'));
+  const githubApp = new GitHubAppConnection({
+    read: (key) => settings.resolve(key),
+    sourceOf: (key) => settings.sourceOf(key),
+  });
+  const repositorySource = new RepositorySource({
+    read: (key) => settings.resolve(key),
+    fallback: { username: config.gitUsername, token: config.gitToken },
+    managed: managedRepository,
+    githubApp,
+  });
+  const gitCredentialsInEffect = repositorySource.credentials;
   // How git is run, for every module that runs it: one environment, one buffer
   // ceiling, one error shape, and — the reason it exists — one deadline, so a
   // git that never returns cannot hold a workspace (and with it the commit
   // queue) open indefinitely. See `shared/git.contract.ts`.
   const gitRunner = new NodeGitRunner(config.gitTimeoutMs, gitCredentialsInEffect);
+  // A deployment that keeps its own repository has it before anything asks
+  // for it: one that chose the mode through the environment never passes
+  // through the save that would have created it, and the startup phase's
+  // first question would be asked of a folder that is not there. Left to
+  // that phase to report if it cannot be made: its failures are classified
+  // and shown on the setup screen, where a throw here would take the screen
+  // down with the boot.
+  if (repositorySource.mode() === 'managed') {
+    await managedRepository
+      .ensure(gitRunner, settings.resolve('defaultBranch') || MANAGED_DEFAULT_BRANCH)
+      .catch((err: unknown) => logger('setup').error('the managed repository could not be created:', { err }));
+  }
+  // One reached through a GitHub App has a token in hand before anything
+  // reads it: a working copy's credential helper is stamped according to
+  // whether there is a token, by code that cannot wait for one. A failure is
+  // the startup phase's to report, for the same reason as above.
+  if (repositorySource.mode() === 'github-app') {
+    await githubApp.prepare().catch(() => undefined);
+  }
   const workspaceService = new WorkspaceService(
     config.workspacesRoot,
-    () => settings.resolve('kbRepoUrl'),
+    () => repositorySource.url(),
     kb,
     disk,
     gitRunner,
@@ -484,8 +527,12 @@ export async function createCoreServices(
     // Getters, not values: the remote and the branch model can arrive from the
     // setup screen after this object exists, and the setup-completion run is
     // the first thing that needs them.
-    kbRepoUrl: () => settings.resolve('kbRepoUrl'),
+    kbRepoUrl: () => repositorySource.url(),
     workspacesRoot: config.workspacesRoot,
+    // Under the backups root, a persistent volume of its own and one nothing
+    // sweeps: a working copy of a repository that was replaced is kept there,
+    // never deleted (see the runner's `reconcileClonesWithConfiguredRepository`).
+    setAsideRoot: path.join(config.backupsRoot, 'replaced-working-copies'),
     kbDirName,
     templateDir: config.kbTemplateDir,
     defaultBranch: () => kb.defaultBranch,
@@ -693,7 +740,14 @@ export async function createCoreServices(
   // (the request's branch vs the default branch), so it holds no state — it
   // only needs to read files at refs and to close a request whose proposals
   // have all landed.
-  const joinRequestsService = new JoinRequestsService(workspaceService, workflowService, kb);
+  const joinRequestsService = new JoinRequestsService(
+    workspaceService,
+    workflowService,
+    kb,
+    // Read-only: the one question a request asks of the resolver is whether
+    // the person it names already holds what it proposes.
+    accessControl,
+  );
   // The OTHER half of a join request: the row the subscribe endpoint writes
   // before it answers, and the branch/clone/commit/push/change-request work
   // that runs against it afterwards. The row is what lets the click be
@@ -1237,6 +1291,9 @@ export async function createCoreServices(
     toolDeleteService,
     workspaceService,
     kbStartupRunner,
+    repositorySource,
+    managedRepository,
+    githubApp,
     settings,
     kb,
     kbDirName,

package/src/modules/access/__tests__/access-requests.recut.test.ts

@@ -0,0 +1,134 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+
+import { spliceGrant } from '../../access-model/access-splice.js';
+import { pendingProposals } from '../../plugins/join-proposals.js';
+
+const execFileAsync = promisify(execFile);
+
+/**
+ * WHY A REQUEST BRANCH IS CUT AGAIN FROM LIVE, proved against real git.
+ *
+ * Opening a change request merges the target branch INTO its source branch.
+ * A request branch survives being declined — that is what lets the dialog say
+ * "your last request wasn't accepted" — so the next request finds a branch
+ * whose base may be old. Writing the new proposal onto it and opening the
+ * request then asks git to merge live into a branch that edited the same
+ * rules file from a different starting point, and git does what git does.
+ *
+ * The person asking is told to "resolve on reader2/join-artest3-04i7dr4", a
+ * branch they cannot reach, and every retry says the same thing. There is no
+ * route out of it for them, which is what made this worth a fix rather than a
+ * better error message.
+ *
+ * Everything below is plain git on a scratch repo: no app, no doubles. The
+ * first case is the bug, kept so the fix cannot quietly stop being necessary;
+ * the second is the fix.
+ */
+describe('a request branch whose base has moved', () => {
+  let root: string;
+  let repo: string;
+
+  const RULES = 'Research/access.md';
+  const LIVE = 'live';
+  const REQUEST = 'reader2/join-research-abc1234-def5678';
+  const RITA = { kind: 'user' as const, email: 'rita@x.io', displayName: 'Rita' };
+  const RAVI = { kind: 'user' as const, email: 'ravi@x.io', displayName: 'Ravi' };
+
+  const git = (...args: string[]) => execFileAsync('git', ['-C', repo, ...args]);
+
+  const readRules = async () => fs.readFile(path.join(repo, RULES), 'utf-8');
+  const writeRules = async (text: string) => {
+    await fs.mkdir(path.dirname(path.join(repo, RULES)), { recursive: true });
+    await fs.writeFile(path.join(repo, RULES), text);
+  };
+  const commit = async (message: string) => {
+    await git('add', '-A');
+    await git('commit', '-q', '-m', message);
+  };
+
+  /** What opening a change request does: merge live INTO the request branch. */
+  async function mergeLiveIntoRequest(): Promise<{ ok: boolean; conflicted: string[] }> {
+    try {
+      await git('merge', '--no-edit', LIVE);
+      return { ok: true, conflicted: [] };
+    } catch {
+      const { stdout } = await execFileAsync('git', [
+        '-C',
+        repo,
+        'diff',
+        '--name-only',
+        '--diff-filter=U',
+      ]);
+      await git('merge', '--abort');
+      return { ok: false, conflicted: stdout.split('\n').filter(Boolean) };
+    }
+  }
+
+  beforeEach(async () => {
+    root = await fs.mkdtemp(path.join(os.tmpdir(), 'bevel-recut-'));
+    repo = path.join(root, 'kb');
+    await fs.mkdir(repo, { recursive: true });
+    await git('init', '-q', '-b', LIVE);
+    await git('config', 'user.email', 'test@bevel.software');
+    await git('config', 'user.name', 'Test');
+    await writeRules('---\n---\nowner:\n  - Ed <ed@x.io>\n');
+    await commit('the rules as they were');
+
+    // Ravi asked for Owner, and it was declined. The branch stays behind.
+    await git('checkout', '-q', '-b', REQUEST);
+    await writeRules(spliceGrant(await readRules(), 'owner', RAVI, { target: 'folder' }).text);
+    await commit('Request owner access to Research');
+    await git('checkout', '-q', LIVE);
+
+    // Then an editor grants somebody else Can edit here — an ordinary click in
+    // the dialog, and the only thing this scenario needs to go wrong.
+    await writeRules(spliceGrant(await readRules(), 'write', RITA, { target: 'folder' }).text);
+    await commit('Ed grants Rita Can edit');
+  });
+
+  afterEach(async () => {
+    await fs.rm(root, { recursive: true, force: true });
+  });
+
+  it('CONFLICTS when the stale branch is written to and the request opened on it', async () => {
+    // What this did before: splice onto live's text, write it to the branch as
+    // it stands, open the request. The content is right; the history is not.
+    await git('checkout', '-q', REQUEST);
+    const live = await execFileAsync('git', ['-C', repo, 'show', `${LIVE}:${RULES}`]);
+    await writeRules(spliceGrant(live.stdout, 'write', RAVI, { target: 'folder' }).text);
+    await commit('Request can edit access to Research');
+
+    const merged = await mergeLiveIntoRequest();
+    expect(merged.ok).toBe(false);
+    expect(merged.conflicted).toEqual([RULES]);
+  });
+
+  it('is CLEAN once the branch is cut again from live first', async () => {
+    // The fix: the answered request's branch is deleted and recut from live,
+    // so live's tip is the merge base and there is nothing to reconcile.
+    await git('branch', '-q', '-D', REQUEST);
+    await git('checkout', '-q', '-b', REQUEST, LIVE);
+    await writeRules(spliceGrant(await readRules(), 'write', RAVI, { target: 'folder' }).text);
+    await commit('Request can edit access to Research');
+
+    const merged = await mergeLiveIntoRequest();
+    expect(merged.ok).toBe(true);
+
+    // And the branch proposes exactly one thing — asked of the function the
+    // app itself asks, rather than of the diff's line-by-line shape (a splice
+    // may rewrite a whole block without proposing anything more). Rita's
+    // grant is already on live, so it is nothing new; the declined Owner
+    // proposal went with the branch that carried it.
+    const branchText = (await execFileAsync('git', ['-C', repo, 'show', `${REQUEST}:${RULES}`]))
+      .stdout;
+    const liveText = (await execFileAsync('git', ['-C', repo, 'show', `${LIVE}:${RULES}`])).stdout;
+    expect(pendingProposals(branchText, liveText, RULES)).toEqual([
+      expect.objectContaining({ verb: 'write', id: `user:${RAVI.email}` }),
+    ]);
+  });
+});