@bevel-software/platform-core-backend 0.22.0 → 0.24.0

package/src/modules/mcp/mcp.service.ts

@@ -27,7 +27,7 @@ import {
 } from '@utcp/sdk';
 import { CodeModeUtcpClient } from '@utcp/code-mode';
 import {
-  CODE_MODE_META_TOOLS,
+  codeModeMetaTools,
   META_TOOL_NAMES,
   dispatchMetaTool,
   dispatchToolCall,
@@ -43,6 +43,7 @@ import {
   type SkillSummary,
   type LoadedSkill,
 } from '@bevel-software/platform-mcp-core';
+import type { KbLayout } from '@bevel-software/platform-shared';
 import { bevelSecretsLoaderConfig } from '../secrets-vault/index.js';
 import {
   scopesCovered,
@@ -65,6 +66,7 @@ import {
   composeAgentInstructions,
   prefixToolDescription,
   PREFIXED_TOOLS,
+  sharedRulesPointer,
   type AgentPreambleReader,
   type ComposedAgentInstructions,
 } from '../agent-instructions/index.js';
@@ -91,6 +93,13 @@ export interface McpProxyOptions {
    * carries the platform header alone.
    */
   readAgentPreamble?: AgentPreambleReader;
+  /**
+   * The layout in effect, read per request: the shared file rules name the
+   * managed guide, and a deployment may rename it after boot (the setup save
+   * applies a name without a restart). A GETTER, so nothing snapshots the
+   * pre-setup default. Absent, the rules name `AGENTS.md`.
+   */
+  kbLayout?: () => KbLayout;
   /** Bounds of the downstream (`mcp.json`) connection pool; defaults are 4h idle / 5000 entries. */
   downstreamPool?: Pick<DownstreamPoolOptions<unknown>, 'idleTtlMs' | 'maxEntries' | 'now'>;
   /**
@@ -434,12 +443,26 @@ export class McpService {
       const seen = new Set(META_TOOL_NAMES);
       const dropped: string[] = [];
       const direct: McpTool[] = [];
+      const examplePool: ProxiedTool[] = [];
       for (const t of listed) {
         const entry = toListedTool(t); // logs its own reason on a name/schema drop
         if (!entry) {
           dropped.push(t.mcpName);
           continue;
         }
+        // Kept for the worked example in the meta-tool descriptions: it must
+        // be derived from the tools THIS caller actually gets, not from the
+        // whole catalog, or a connection-key caller is shown an example naming
+        // a credential-gated tool the filter above just removed from its
+        // listing — a copied call that cannot work.
+        //
+        // BEFORE the duplicate drop below, on purpose. A tool dropped from the
+        // LISTING for sharing its name with another is still in the catalog a
+        // chain dispatches to, so the chain sees two tools under one name and
+        // refuses the call as ambiguous. The example has to know about both to
+        // steer clear of either (`chainExample` skips a name two tools share);
+        // shown only the survivor, it took that name for a safe one.
+        examplePool.push(t);
         if (seen.has(entry.name)) {
           dropped.push(`${entry.name} (duplicate)`);
           continue;
@@ -456,18 +479,33 @@ export class McpService {
             : entry,
         );
       }
+      // The meta-tools' examples name the namespace THIS endpoint registers the
+      // knowledge-base tools under, and a tool this caller is really served, so
+      // a chain copied out of the description runs. Built here rather than held
+      // as a constant: the local MCP server registers the same tools under a
+      // different name, and one fixed example is necessarily wrong on one of the
+      // two surfaces.
+      //
+      // The chain's description ends with the same pointer every file tool ends
+      // with: what a chain does with a failure, a large result or an image is
+      // stated once, in the shared rules, and the clients that drop
+      // `instructions` have the description and the guide to go on. Composed
+      // here because the guide's name is this deployment's setting.
+      const metaTools = codeModeMetaTools(EXTERNAL_KB_MANUAL_NAME, examplePool, {
+        sharedRulesPointer: sharedRulesPointer(this.opts.kbLayout?.()),
+      });
       // Log only when a tool was dropped (name/schema/duplicate) — that's the
       // anomaly worth surfacing, since a downstream client would otherwise hide
       // it by rejecting the whole response.
       if (dropped.length) {
         log.warn(
-          `tools/list: serving ${CODE_MODE_META_TOOLS.length + direct.length} tool(s); ` +
+          `tools/list: serving ${metaTools.length + direct.length} tool(s); ` +
             `dropped ${dropped.length} non-listable: ${dropped.join(', ')}`,
         );
       }
       return {
         // Code-mode meta-tools first, then every validated direct tool.
-        tools: [...CODE_MODE_META_TOOLS, ...direct],
+        tools: [...metaTools, ...direct],
       };
     });
 
@@ -613,13 +651,14 @@ export class McpService {
    * fails over its preamble.
    */
   private async composeAgentInstructions(): Promise<ComposedAgentInstructions> {
+    const layout = this.opts.kbLayout?.();
     const read = this.opts.readAgentPreamble;
-    if (!read) return composeAgentInstructions(null);
+    if (!read) return composeAgentInstructions(null, layout);
     try {
-      return composeAgentInstructions(await read());
+      return composeAgentInstructions(await read(), layout);
     } catch (err) {
-      log.warn('could not read mcp-description.md; this request gets the platform header alone:', { err });
-      return composeAgentInstructions(null);
+      log.warn('could not read mcp-description.md; this request gets the platform text alone:', { err });
+      return composeAgentInstructions(null, layout);
     }
   }
 

package/src/modules/mcp/oauth/bevel-oauth-provider.ts

@@ -309,7 +309,8 @@ export class BevelOAuthProvider implements OAuthServerProvider {
     // the revoke (a refresh that raced it) is dead on arrival rather than
     // live until its own expiry. A token from before connections existed
     // (null `connection_id`) has no connection to be revoked and verifies on
-    // its own row alone.
+    // its own row alone. A switched-off account's tokens fail here too, and
+    // come back with it.
     const [row] = await this.deps.db
       .select({
         id: oauthTokens.id,
@@ -330,6 +331,7 @@ export class BevelOAuthProvider implements OAuthServerProvider {
           isNull(oauthTokens.revokedAt),
           gt(oauthTokens.expiresAt, now),
           or(isNull(oauthTokens.connectionId), isNull(agentConnections.revokedAt)),
+          isNull(users.deactivatedAt),
         ),
       )
       .limit(1);

package/src/modules/plugins/__tests__/plugins.tools.test.ts

@@ -53,7 +53,8 @@ describe('the creation endpoints behind the key-or-session gate', () => {
   } as never;
   const authService = {
     getUserById: async (id: string) => (id === ALICE.id ? ALICE : null),
-    verifyToken: (t: string) => {
+    // A session is accepted only for an account that is on; Alice's is.
+    resolveSession: async (t: string) => {
       if (t !== 'session-alice') throw new Error('bad token');
       return { userId: ALICE.id, email: ALICE.email };
     },

package/src/modules/plugins/join-request-records.store.ts

@@ -143,11 +143,14 @@ export class DbJoinRequestStore implements JoinRequestStore {
     pluginKey: string;
   }): Promise<JoinRequestRecord> {
     const requesterEmail = input.requesterEmail.toLowerCase();
+    // Keyed by the blind index throughout: the email column is randomized
+    // ciphertext, so the uniqueness and every lookup go through its index,
+    // which is written and compared with the address.
     const [inserted] = await this.db
       .insert(pluginJoinRequests)
-      .values({ requesterEmail, requesterName: input.requesterName, pluginKey: input.pluginKey })
+      .values({ requesterEmail, requesterEmailBidx: requesterEmail, requesterName: input.requesterName, pluginKey: input.pluginKey })
       .onConflictDoNothing({
-        target: [pluginJoinRequests.requesterEmail, pluginJoinRequests.pluginKey],
+        target: [pluginJoinRequests.requesterEmailBidx, pluginJoinRequests.pluginKey],
       })
       .returning();
     if (inserted) return toRecord(inserted);
@@ -170,7 +173,7 @@ export class DbJoinRequestStore implements JoinRequestStore {
       })
       .where(
         and(
-          eq(pluginJoinRequests.requesterEmail, requesterEmail),
+          eq(pluginJoinRequests.requesterEmailBidx, requesterEmail),
           eq(pluginJoinRequests.pluginKey, input.pluginKey),
         ),
       )
@@ -191,7 +194,7 @@ export class DbJoinRequestStore implements JoinRequestStore {
     const rows = await this.db
       .select()
       .from(pluginJoinRequests)
-      .where(eq(pluginJoinRequests.requesterEmail, requesterEmail.toLowerCase()));
+      .where(eq(pluginJoinRequests.requesterEmailBidx, requesterEmail));
     return rows.map(toRecord);
   }
 

package/src/modules/settings/__tests__/deployment-settings.service.test.ts

@@ -413,6 +413,22 @@ describe('DeploymentSettingsService — validation', () => {
     );
   });
 
+  it('rejects a directory name carrying a line break, which every path is prefixed with', async () => {
+    // The name is joined onto every workspace-relative path, and a line break
+    // in a path is a separator to git's `cat-file --batch` — so a name
+    // carrying one would make the normaliser emit a path it refuses from a
+    // caller. Refused where the name is SET, which is here and at boot.
+    const { db } = makeDb();
+    const settings = new DeploymentSettingsService(db, ENC_KEY);
+    for (const bad of ['kb\nname', 'kb\rname', 'kb\u0000name', 'kb\u007Fname']) {
+      await expect(settings.save({ kbDirName: bad }, null), bad).rejects.toThrow(
+        /Invalid settings/,
+      );
+    }
+    // The ordinary name beside them, so the rule is not simply refusing both.
+    await expect(settings.save({ kbDirName: 'company-brain' }, null)).resolves.toBeTruthy();
+  });
+
   it('rejects a username that would break out of the credential-helper snippet', async () => {
     const { db } = makeDb();
     const settings = new DeploymentSettingsService(db, ENC_KEY);

package/src/modules/settings/__tests__/setup.routes.git-mode.test.ts

@@ -112,11 +112,12 @@ function listen(
   server = app.listen(0);
   const { port } = server.address() as AddressInfo;
   const base = `http://127.0.0.1:${port}`;
-  const save = (entries: Record<string, string>) =>
+  /** `confirm` is the admin's answer to the question a move is asked, when they have given one. */
+  const save = (entries: Record<string, string>, confirm?: 'keep' | 'close') =>
     fetch(`${base}/api/setup/settings`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ settings: entries }),
+      body: JSON.stringify({ settings: entries, ...(confirm ? { confirmRepositoryChange: confirm } : {}) }),
     });
   const status = async () => (await fetch(`${base}/api/setup/status`)).json() as Promise<Record<string, unknown>>;
   return { save, status, settings, source, managed, ensured, probed, kb, phase: { runs: () => phaseRuns, saw: phaseSaw } };
@@ -199,63 +200,97 @@ describe('a deployment that is serving moves to another repository', () => {
     return mounted;
   }
 
-  it('owes a restart, and says both where it is and where it is going', async () => {
-    const { save, status, phase, ensured } = await serving();
+  /**
+   * A move is asked about before anything is stored: the save is refused
+   * until the answer comes back, naming the way left and the way moved to.
+   * Refused, it has changed nothing — the deployment is where it was.
+   */
+  it('is asked first, and until it answers nothing has moved', async () => {
+    const { save, status, phase, source, settings } = await serving();
     const runsBefore = phase.runs();
     const res = await save({ gitMode: 'managed' });
-    const body = (await res.json()) as Record<string, unknown>;
-    expect(body).toMatchObject({ ok: true, complete: true, restartRequired: true, repository: { mode: 'token', chosen: 'managed' } });
-    expect(await status()).toMatchObject({ complete: true, repository: { mode: 'token', chosen: 'managed' } });
-    expect(ensured).toHaveLength(1);
-    // Sessions may be live: the phase that moves working copies waits for the restart.
+    expect(res.status).toBe(409);
+    expect(await res.json()).toMatchObject({ repositoryChange: { openChangeRequests: 0, from: 'token', to: 'managed' } });
+    expect(settings.resolve('gitMode')).toBe('');
+    expect(source.mode()).toBe('token');
+    expect(source.url()).toBe(HOSTED.kbRepoUrl);
     expect(phase.runs()).toBe(runsBefore);
+    expect(await status()).toMatchObject({ complete: true, repository: { mode: 'token', chosen: 'token' } });
   });
 
   /**
-   * The move is a fact about the NEXT start. Until then every working copy
-   * is a clone of the repository the deployment had, so that is the
-   * repository git is handed the address of, and its token is the one
-   * presented. Reading the mode live moved the process at the save: pushes
-   * went out with no credential, and a branch opened in between was cloned
-   * from a repository nothing had prepared.
+   * Confirmed, the move takes effect ON THE SAVE: the way chosen is the way
+   * in effect, the startup phase runs against the repository moved to, and
+   * no restart is owed. It once waited for the next start, which an admin of
+   * a hosted workspace has no way to give.
    */
-  it('goes on working against the repository it has until it is started again', async () => {
-    const { save, source } = await serving();
-    await save({ gitMode: 'managed' });
-    expect(source.mode()).toBe('token');
-    expect(source.url()).toBe(HOSTED.kbRepoUrl);
-    expect(source.credentials.token()).toBe('the-token');
-    expect(source.credentials.username()).toBe('x-access-token');
-    // A token rotated meanwhile is still the one the next push carries.
-    await save({ gitToken: 'a-rotated-token' });
-    expect(source.credentials.token()).toBe('a-rotated-token');
+  it('moves on the save once confirmed, and owes no restart', async () => {
+    const { save, status, phase, ensured, managed, source } = await serving();
+    const runsBefore = phase.runs();
+    const res = await save({ gitMode: 'managed' }, 'keep');
+    const body = (await res.json()) as Record<string, unknown>;
+    expect(res.status, JSON.stringify(body)).toBe(200);
+    expect(body).toMatchObject({
+      ok: true,
+      complete: true,
+      restartRequired: false,
+      repository: { mode: 'managed', chosen: 'managed' },
+      repositoryChange: { choice: 'keep' },
+    });
+    expect(ensured).toHaveLength(1);
+    // The phase that sets the old working copies aside ran, against the repository moved to.
+    expect(phase.runs()).toBe(runsBefore + 1);
+    expect(phase.saw.at(-1)).toBe(managed.path);
+    expect(source.url()).toBe(managed.path);
+    expect(await status()).toMatchObject({ complete: true, repository: { mode: 'managed', chosen: 'managed' } });
   });
 
-  it('is on the repository it chose once it is started again, and presents it nothing of the old one', async () => {
-    const { save, source, managed } = await serving();
-    await save({ gitMode: 'managed' });
-    // What a restart does: the source is built on the mode chosen.
-    source.takeEffect();
-    expect(source.mode()).toBe('managed');
-    expect(source.url()).toBe(managed.path);
+  /** One way's credential is never presented to another way's repository. */
+  it('presents the repository moved to nothing of the one that was left', async () => {
+    const { save, source } = await serving();
+    expect(source.credentials.token()).toBe('the-token');
+    await save({ gitMode: 'managed' }, 'keep');
     expect(source.credentials.token()).toBeNull();
   });
 
-  it('goes on owing the restart through saves about other things', async () => {
+  it('owes nothing through later saves about other things, and is not asked again', async () => {
     const { save } = await serving();
-    await save({ gitMode: 'managed' });
-    const body = (await (await save({ kbSyncSecret: 'a-secret-of-sixteen-or-more' })).json()) as Record<string, unknown>;
-    expect(body).toMatchObject({ ok: true, restartRequired: true, repository: { mode: 'token', chosen: 'managed' } });
+    await save({ gitMode: 'managed' }, 'keep');
+    const res = await save({ kbSyncSecret: 'a-secret-of-sixteen-or-more' });
+    expect(res.status).toBe(200);
+    expect(await res.json()).toMatchObject({ ok: true, restartRequired: false, repository: { mode: 'managed', chosen: 'managed' } });
   });
 
-  it('owes nothing once the move is taken back', async () => {
-    const { save, probed } = await serving();
-    await save({ gitMode: 'managed' });
-    const asked = probed.length;
-    const body = (await (await save({ gitMode: 'token' })).json()) as Record<string, unknown>;
-    expect(body).toMatchObject({ ok: true, restartRequired: false, repository: { mode: 'token', chosen: 'token' } });
-    // Nothing about the connection changed, so the host is not asked again.
-    expect(probed).toHaveLength(asked);
+  it('is asked again to move back: that is a move too', async () => {
+    const { save, source } = await serving();
+    await save({ gitMode: 'managed' }, 'keep');
+    const back = await save({ gitMode: 'token' });
+    expect(back.status).toBe(409);
+    expect(await back.json()).toMatchObject({ repositoryChange: { from: 'managed', to: 'token' } });
+    const done = await save({ gitMode: 'token' }, 'keep');
+    expect(await done.json()).toMatchObject({ ok: true, restartRequired: false, repository: { mode: 'token', chosen: 'token' } });
+    expect(source.url()).toBe(HOSTED.kbRepoUrl);
+  });
+
+  /** Another address under the same way is the same question, with the same answer. */
+  it('asks the same of another address under the way it is on', async () => {
+    const { save, source, phase } = await serving();
+    const moved = { kbRepoUrl: 'https://git.example.com/acme/another.git', gitToken: 'another-token' };
+    const asked = await save(moved);
+    expect(asked.status).toBe(409);
+    expect(await asked.json()).toMatchObject({ repositoryChange: { from: 'token', to: 'token' } });
+    const runsBefore = phase.runs();
+    const done = await save(moved, 'close');
+    expect(await done.json()).toMatchObject({ ok: true, restartRequired: false, repositoryChange: { choice: 'close' } });
+    expect(phase.runs()).toBe(runsBefore + 1);
+    expect(source.url()).toBe(moved.kbRepoUrl);
+  });
+
+  it('asks nothing of a save that only spells the same address another way', async () => {
+    const { save } = await serving();
+    const res = await save({ kbRepoUrl: 'https://GIT.example.com/acme/kb/' });
+    expect(res.status).toBe(200);
+    expect(await res.json()).not.toHaveProperty('repositoryChange');
   });
 
   it('owes none for naming the way it was already on', async () => {
@@ -268,10 +303,11 @@ describe('a deployment that is serving moves to another repository', () => {
 });
 
 /**
- * The pin protects what is running on the mode in effect. Behind a shut
- * gate nothing is, however completely the settings were answered, and a
- * deployment pinned there could not be got out of a repository that does
- * not work by choosing one that does.
+ * Behind a shut gate nothing is running on the way in effect, however
+ * completely the settings were answered, so a deployment there is got out of
+ * a repository that does not work by choosing one that does. One that never
+ * served is not even asked: there is no repository anyone worked on to
+ * leave. One that served before its boot failed is asked, as any move is.
  */
 describe('a deployment that answered everything and serves nobody', () => {
   const isHosted = (url: string) => url === HOSTED.kbRepoUrl;
@@ -300,19 +336,16 @@ describe('a deployment that answered everything and serves nobody', () => {
     const { save, status, phase, managed } = listen({ kb: testKbContext(), bootFailed: true, unreachable: isHosted });
     expect(await status()).toMatchObject({ complete: false, repository: { mode: 'token' } });
 
-    const body = (await (await save({ gitMode: 'managed' })).json()) as Record<string, unknown>;
+    // It served before this boot, so there may be work on the repository it
+    // leaves: it is asked, and nothing moves until it answers.
+    const asked = await save({ gitMode: 'managed' });
+    expect(asked.status).toBe(409);
+    expect(phase.saw).toEqual([]);
+
+    const body = (await (await save({ gitMode: 'managed' }, 'keep')).json()) as Record<string, unknown>;
     expect(phase.saw).toEqual([managed.path]);
     expect(body).toMatchObject({ complete: true, restartRequired: false, repository: { mode: 'managed', chosen: 'managed' } });
   });
-
-  it('is still asked for a restart once it IS serving: the same save, a different deployment', async () => {
-    const { save, phase } = listen({ kb: testKbContext() });
-    await save({ ...HOSTED, ...BRANCHES });
-    const runs = phase.runs();
-    const body = (await (await save({ gitMode: 'managed' })).json()) as Record<string, unknown>;
-    expect(body).toMatchObject({ complete: true, restartRequired: true, repository: { mode: 'token', chosen: 'managed' } });
-    expect(phase.runs()).toBe(runs);
-  });
 });
 
 describe('a deployment whose way is chosen by the environment', () => {

package/src/modules/settings/__tests__/setup.routes.github-app.test.ts

@@ -108,11 +108,12 @@ function listen(
   );
   server = app.listen(0);
   const base = `http://127.0.0.1:${(server.address() as AddressInfo).port}`;
-  const save = async (entries: Record<string, string>) => {
+  /** `confirm` is the admin's answer to the question a move is asked. */
+  const save = async (entries: Record<string, string>, confirm?: 'keep' | 'close') => {
     const res = await fetch(`${base}/api/setup/settings`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ settings: entries }),
+      body: JSON.stringify({ settings: entries, ...(confirm ? { confirmRepositoryChange: confirm } : {}) }),
     });
     return { status: res.status, body: (await res.json()) as Record<string, unknown> & { problems?: Record<string, string> } };
   };
@@ -271,12 +272,28 @@ describe('a deployment on GitHub that is serving', () => {
     expect(probed).toHaveLength(asked);
   });
 
-  it('is asked again when it moves to another repository', async () => {
-    const { save, probed } = await serving();
-    const asked = probed.length;
-    const { status } = await save({ githubRepository: 'acme/another' });
-    expect(status).toBe(200);
-    expect(probed).toHaveLength(asked + 1);
+  /**
+   * Another repository on GitHub is a move like any other: GitHub is asked
+   * about the new one, the admin is asked about the move, and confirmed it
+   * happens on the save.
+   */
+  it('proves the new repository, asks about the move, and moves on the save once confirmed', async () => {
+    const { save, probed, source, phaseRuns } = await serving();
+    const before = probed.length;
+    const asked = await save({ githubRepository: 'acme/another' });
+    expect(asked.status).toBe(409);
+    expect(asked.body).toMatchObject({ repositoryChange: { from: 'github-app', to: 'github-app' } });
+    // The connection is proven before the question is put: nobody agrees to
+    // a move only to be told the repository cannot be reached.
+    expect(probed).toHaveLength(before + 1);
     expect(probed.at(-1)!.url).toBe('https://github.com/acme/another.git');
+    expect(source.url()).toBe('https://github.com/acme/kb.git');
+
+    const runs = phaseRuns();
+    const moved = await save({ githubRepository: 'acme/another' }, 'keep');
+    expect(moved.status, JSON.stringify(moved.body)).toBe(200);
+    expect(moved.body).toMatchObject({ ok: true, restartRequired: false, repositoryChange: { choice: 'keep' } });
+    expect(source.url()).toBe('https://github.com/acme/another.git');
+    expect(phaseRuns()).toBe(runs + 1);
   });
 });

package/src/modules/settings/__tests__/setup.routes.managed-phase.test.ts

@@ -131,11 +131,12 @@ function boot(kb: KbContext) {
   );
   server = app.listen(0);
   const base = `http://127.0.0.1:${(server.address() as AddressInfo).port}`;
-  const save = async (entries: Record<string, string>) => {
+  /** `confirm` is the admin's answer to the question a move is asked. */
+  const save = async (entries: Record<string, string>, confirm?: 'keep' | 'close') => {
     const res = await fetch(`${base}/api/setup/settings`, {
       method: 'POST',
       headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ settings: entries }),
+      body: JSON.stringify({ settings: entries, ...(confirm ? { confirmRepositoryChange: confirm } : {}) }),
     });
     return { status: res.status, body: (await res.json()) as Record<string, unknown> };
   };
@@ -175,7 +176,7 @@ describe('the save that chooses a repository the deployment keeps', () => {
 
 describe('a deployment that moves to a repository it keeps', () => {
   it('leaves the repository it had untouched and sets its working copies aside, unpushed work included', async () => {
-    const { save, managed, hosted, runner, source, workingCopy, setAsideRoot } = boot(
+    const { save, managed, hosted, source, workingCopy, setAsideRoot } = boot(
       testKbContext({ branchModel: { defaultBranch: 'main', protectedBranches: ['main'] } }),
     );
     // A deployment on a repository of its own, set up and serving. The
@@ -203,17 +204,19 @@ describe('a deployment that moves to a repository it keeps', () => {
     await git(copy, ['commit', '-m', 'never pushed']);
     const hostedBefore = await git(hosted, ['for-each-ref']);
 
-    const moved = await save({ gitMode: 'managed' });
-    expect(moved.body).toMatchObject({ ok: true, restartRequired: true });
-    // Until the restart the working copy is where it was, and so is the
-    // deployment: the repository it has is the one it goes on talking to.
+    // Asked first: until the admin answers, the working copy is where it
+    // was and so is the deployment.
+    const asked = await save({ gitMode: 'managed' });
+    expect(asked.status).toBe(409);
     expect(await git(copy, ['config', '--get', 'remote.origin.url'])).toBe(hosted);
     expect(source.url()).toBe(hosted);
 
-    // The restart: the deployment is built on the mode chosen, and the
-    // phase brings the working copies into line.
-    source.takeEffect();
-    await runner.runAll();
+    // Confirmed, the move happens on the save, with no restart: the way
+    // chosen takes effect and the phase brings the working copies into line.
+    const moved = await save({ gitMode: 'managed' }, 'keep');
+    expect(moved.status, JSON.stringify(moved.body)).toBe(200);
+    expect(moved.body).toMatchObject({ ok: true, complete: true, restartRequired: false });
+    expect(source.url()).toBe(managed.path);
 
     expect(await git(hosted, ['for-each-ref'])).toBe(hostedBefore);
     expect(await git(copy, ['config', '--get', 'remote.origin.url'])).toBe(managed.path);