@bevel-software/platform-core-backend 0.26.0 → 0.27.0

package/src/modules/workflow/agent-tools/workflow.tools.ts

@@ -1,11 +1,10 @@
 import type { Router, RequestHandler } from 'express';
 import type { IToolRegistry, JsonSchema } from '../../tool-registry/tool.contract.js';
 import { ToolError, type ToolContext, type ToolHandler } from '../../tool-helpers/tool.contract.js';
-import { toolDef, withBranchInput } from '../../tool-helpers/tool-def.js';
+import { toolDef } from '../../tool-helpers/tool-def.js';
 import type { ToolHandlerFactory } from '../../tool-helpers/tool-handler.js';
 import { requireInternalSource } from '../../tool-auth/tool-auth.middleware.js';
 import type { KbContext } from '../../../shared/kb-context.js';
-import { assertBranchProvided } from '../../../shared/domain-errors.js';
 import { workspaceIdForBranch } from '../../../shared/workspace-id.js';
 import { assertInsideRepo, normalizePathArgs } from '../../kb-fs/repo-path.js';
 import { RETIRED_TOOL_MESSAGES } from '@bevel-software/platform-mcp-core';
@@ -171,6 +170,12 @@ export function registerWorkflowTools(
   toolHandler: ToolHandlerFactory,
   /** The clone folder at the workspace root (`save_file` refuses a path outside it) and the branch model. */
   kb: Pick<KbContext, 'kbDirName' | 'defaultBranch' | 'defaultWorkspaceId' | 'protectedBranches'>,
+  /**
+   * Whether the caller may see change request `number` — `get_change_request`'s
+   * own gate (`changeRequestScope(...).maySee`). `delete_branch` neither names
+   * nor links a request it answers no for.
+   */
+  maySeeChangeRequest: (ctx: ToolContext, number: number) => Promise<boolean>,
 ): void {
   const { kbDirName } = kb;
   const mount = (spec: {
@@ -191,21 +196,24 @@ export function registerWorkflowTools(
      * out of the check while still demanding the input.
      */
     skipBranch?: boolean;
+    /** Arguments this tool's handler refuses by name itself (see `ToolDefSpec`). */
+    refusesItself?: string[];
     handler: ToolHandler;
   }): void => {
     const path = `/api/agent/tools/${spec.name}`;
-    const inputs = spec.skipBranch ? spec.inputs : withBranchInput(spec.inputs);
-    // The tool's OWN declaration is the only honest answer to "must this call
-    // name a branch": the injected input and a hand-declared one (the fork
-    // base, the draft to switch to) are equally required, and a tool that adds
-    // or drops the input later moves this with it.
-    const requiresBranch = ((inputs as { required?: string[] }).required ?? []).includes('branch');
+    // Every workflow tool that takes a branch REQUIRES it — the injected input
+    // and a hand-declared one (the fork base, the draft to switch to) alike.
+    // A hand-declared one is required by its own schema, which `toolDef`
+    // reads as `required` too; the tool handler refuses a call without it.
     const def = toolDef({
       name: spec.name,
       description: spec.description,
       path,
-      inputs,
+      inputs: spec.inputs,
+      branch: spec.skipBranch ? undefined : 'required',
+      write: spec.write,
       outputs: spec.outputs,
+      refusesItself: spec.refusesItself,
       tags: spec.write ? ['workflow', 'write'] : ['workflow'],
     });
     registry.registerInternalTool(def);
@@ -223,24 +231,12 @@ export function registerWorkflowTools(
       // workspace path, and a path with no prefix is placed under
       // `<kbDirName>/` rather than refused.
       toolHandler(
-        (args, ctx) => {
-          // These tools hand `branch` STRAIGHT to `workspaceIdForBranch` —
-          // they address a workspace by id rather than going through
-          // `getFilesystem`, so the choke point that guards the file tools
-          // never sees them. Without this, a branch-less `commit_change`
-          // commits to a workspace id literally named "undefined", and a
-          // branch-less `create_branch` forks from one: it clones a branch of
-          // that name, fails, and answers `There is no branch named undefined.`
-          //
-          // Keyed on whether the SCHEMA requires `branch`, not on whether the
-          // input was injected. `create_branch` and `switch_branch` declare
-          // their own required `branch`; a check keyed on the injection skipped
-          // exactly those two, which is how the reported bug survived on
-          // `create_branch` — the one tool whose `branch` is a branch the
-          // caller must already have.
-          if (requiresBranch) assertBranchProvided(args.branch);
-          return spec.handler(normalizePathArgs(args, kbDirName), ctx);
-        },
+        // These tools hand `branch` STRAIGHT to `workspaceIdForBranch` —
+        // they address a workspace by id rather than going through
+        // `getFilesystem` — so the branch-less call the tool handler refuses
+        // before this runs would otherwise commit to, or fork from, a
+        // workspace literally named "undefined".
+        (args, ctx) => spec.handler(normalizePathArgs(args, kbDirName), ctx),
         { write: spec.write },
       ),
     );
@@ -383,6 +379,9 @@ export function registerWorkflowTools(
     // workspace-`branch` injection ("the branch you are currently working on"),
     // whose wording invites filling in the draft being created instead.
     skipBranch: true,
+    // The handler refuses a missing `name` with a message that says what the
+    // name is for (`name-required`); the generic check leaves it to that.
+    refusesItself: ['name'],
     inputs: {
       type: 'object',
       properties: {
@@ -550,13 +549,16 @@ export function registerWorkflowTools(
     name: 'merge_branch',
     description:
       'Merge branch `source` into branch `target` as you, and publish `target`. An agent proposes and syncs; ' +
-      'a person merges: this tool never lands a change request. It refuses when a change request from `source` ' +
-      'into `target` is open (naming it) — ask the user to review that request in the app instead. It refuses ' +
+      'a person merges: this tool never lands a change request. It refuses while a change request from `source` ' +
+      'into `target` is open (naming it): ask the user to review it in the app. It refuses ' +
       'when `target` is a protected branch unless you could commit every changed file directly to it. ' +
       'SYNC: merging the target into your draft (`source` = the change request\'s target, `target` = your draft) ' +
-      'is always allowed, even with that draft\'s request open — use it to bring a draft up to date. ' +
-      'Returns `merged` with the merge commit, or `conflicts-need-resolution` with the conflicting paths ' +
-      '(nothing is written; resolve them on `source` and merge again).',
+      'is always allowed, even with the draft\'s request open. ' +
+      'Writes are committed asynchronously; the merge first waits up to 20s for those on `source`. ' +
+      'Returns `merged` with the merge commit; `nothing-to-merge` with `target`\'s tip when it already holds ' +
+      'all of `source`; `pending-commits` (nothing merged) when writes are still committing — retry shortly — ' +
+      'or one failed (`needsAttention`: tell the user); or `conflicts-need-resolution` with the conflicting ' +
+      'paths (nothing is written; resolve them on `source` and merge again).',
     // Names both branches itself; the merge runs in `target`'s workspace.
     skipBranch: true,
     inputs: {
@@ -573,11 +575,28 @@ export function registerWorkflowTools(
       properties: {
         outcome: {
           type: 'object',
-          description: 'Either a completed merge or a signal that conflicts must be resolved first.',
+          description:
+            'A completed merge, a merge with nothing to do, writes on `source` not committed yet ' +
+            '(writes are committed asynchronously and the merge waits up to 20 seconds for them), ' +
+            'or a signal that conflicts must be resolved first.',
           properties: {
-            kind: { type: 'string', enum: ['merged', 'conflicts-need-resolution'] },
-            sha: { type: 'string', description: 'Present when `kind` is `merged` — the tip of `target` after the merge.' },
+            kind: { type: 'string', enum: ['merged', 'nothing-to-merge', 'pending-commits', 'conflicts-need-resolution'] },
+            sha: {
+              type: 'string',
+              description:
+                'Present when `kind` is `merged` (the merge commit, now the tip of `target`) or `nothing-to-merge` ' +
+                '(the unchanged tip of `target`, which already held everything on `source`).',
+            },
             conflictedPaths: { type: 'array', items: { type: 'string' }, description: 'Present when `kind` is `conflicts-need-resolution`.' },
+            branch: { type: 'string', description: 'Present when `kind` is `pending-commits` — the branch whose writes are not committed yet.' },
+            pending: { type: 'integer', description: 'Present when `kind` is `pending-commits` — how many commits on that branch are still queued, plus those that failed when `needsAttention` is present.' },
+            needsAttention: {
+              type: 'string',
+              description:
+                'Present when `kind` is `pending-commits` and a queued commit failed: the worker\'s message. ' +
+                'Waiting will not help; tell the user.',
+            },
+            message: { type: 'string', description: 'Present when `kind` is `pending-commits` — what to do next.' },
           },
           required: ['kind'],
         },
@@ -595,6 +614,81 @@ export function registerWorkflowTools(
     },
   });
 
+  mount({
+    name: 'delete_branch',
+    description:
+      'Delete branch `name` from the shared repository and the server. Allowed for the ' +
+      'branch\'s author (`<email-localpart>/…`, or your own `suggestions/…` bundle) or an Admin. Refuses a ' +
+      'protected branch, a name that is not a branch, a branch with saves still landing or a file held ' +
+      '(retry once they land). An open change request from or into it that proposes nothing is closed and the ' +
+      'delete goes ahead; one that still proposes something refuses it, naming and linking it: its author ' +
+      'withdraws it or an Admin declines it, in the app (one you cannot see is not named, nor in a preview). ' +
+      'Refuses a branch holding commits that are not on the ' +
+      'default branch, saying how many; `discardUnmerged: true` deletes it anyway and reports them as ' +
+      '`discardedCommits`. Refuses if the shared repository is unreachable. Preview with ' +
+      '`dryRun: true`: it changes nothing and answers `exists`, `canDelete`, `refusals`, `unmergedCommits`, ' +
+      '`openChangeRequests` and `lastCommit`. A preview grants nothing; checks rerun on delete. ' +
+      'Answers the deleted branch\'s `lastCommit`.',
+    // Names its branch itself; the deletion runs in the default branch's workspace.
+    skipBranch: true,
+    refusesItself: ['name'],
+    inputs: {
+      type: 'object',
+      properties: {
+        name: { type: 'string', minLength: 1, description: 'The branch to delete.' },
+        dryRun: { type: 'boolean', description: 'Report what deleting would do, and change nothing.' },
+        discardUnmerged: {
+          type: 'boolean',
+          description: 'Delete even though the branch holds commits that are not on the default branch. They are lost.',
+        },
+      },
+      required: ['name'],
+      additionalProperties: false,
+    },
+    outputs: {
+      type: 'object',
+      properties: {
+        kind: { type: 'string', enum: ['preview', 'deleted'] },
+        branch: { type: 'string' },
+        lastCommit: { type: ['string', 'null'], description: 'The branch\'s tip — what a restore starts from. Null in a preview of a branch that does not exist.' },
+        discardedCommits: { type: 'integer', description: 'When `kind` is `deleted`: commits not on the default branch that went with it.' },
+        exists: { type: 'boolean', description: 'When `kind` is `preview`.' },
+        canDelete: { type: 'boolean', description: 'When `kind` is `preview`: whether a delete asked for now would go through.' },
+        refusals: { type: 'array', items: { type: 'string' }, description: 'When `kind` is `preview`: why it would not.' },
+        unmergedCommits: { type: 'integer', description: 'When `kind` is `preview`: commits not on the default branch.' },
+        openChangeRequests: {
+          type: 'array',
+          description: 'When `kind` is `preview`: open change requests from (`source`) or into (`target`) the branch that you can see.',
+          items: {
+            type: 'object',
+            properties: {
+              number: { type: 'integer' },
+              end: { type: 'string', enum: ['source', 'target'] },
+              url: { type: 'string', description: 'Link to the request in the app.' },
+              proposesNothing: { type: 'boolean', description: 'True when the delete would close it rather than be refused by it.' },
+            },
+            required: ['number', 'end', 'url', 'proposesNothing'],
+          },
+        },
+      },
+      required: ['kind', 'branch', 'lastCommit'],
+    },
+    write: true,
+    handler: async (args, ctx: ToolContext) => {
+      const name = args.name;
+      if (typeof name !== 'string' || name.length === 0) {
+        throw new ToolError('`name` is required: pass the name of the branch to delete.', 400, {
+          kind: 'name-required',
+        });
+      }
+      return ctx.workflowService.deleteBranchChecked(ctx.user, name, {
+        dryRun: args.dryRun === true,
+        discardUnmerged: args.discardUnmerged === true,
+        maySee: (number) => maySeeChangeRequest(ctx, number),
+      });
+    },
+  });
+
   // `merge_change_request` is retired: a change request is merged by a person
   // in the app. It is in no catalog, but a caller holding an old manual still
   // posts to its path — answer with who merges now, not a bare 404.

package/src/modules/workflow/file-lock.service.ts

@@ -69,17 +69,52 @@ function rowToFileLock(row: typeof fileLocks.$inferSelect): FileLock {
 export class FileLockService {
   constructor(private readonly db: Database) {}
 
+  /**
+   * Branches being deleted right now, with how many deletions hold each. No
+   * lock is granted on them: a deletion checks that no save is landing and
+   * then removes the branch, and a save that took its lock in between would
+   * be lost with the checkout. See `whileNoneAcquired`.
+   */
+  private readonly closing = new Map<string, number>();
+
+  /**
+   * Acquires on each branch that passed the `closing` check and have not
+   * settled yet. `whileNoneAcquired` waits for them: one whose row is still
+   * being written when a deletion starts would otherwise land after the
+   * deletion's last check.
+   */
+  private readonly acquiring = new Map<string, Set<Promise<unknown>>>();
+
+  /**
+   * Run `fn` while no lock can be acquired on `branch`, once every acquire
+   * already under way on it has settled. The deletion paths re-check for
+   * saves landing inside it, so that check sees every lock granted before it,
+   * and the deletion meets no save that started in between.
+   */
+  async whileNoneAcquired<T>(branch: string, fn: () => Promise<T>): Promise<T> {
+    this.closing.set(branch, (this.closing.get(branch) ?? 0) + 1);
+    try {
+      await Promise.allSettled([...(this.acquiring.get(branch) ?? [])]);
+      return await fn();
+    } finally {
+      const n = (this.closing.get(branch) ?? 1) - 1;
+      if (n > 0) this.closing.set(branch, n);
+      else this.closing.delete(branch);
+    }
+  }
+
   /**
    * Acquire a lock for `(workspaceId, branch, path)` on behalf of `user`.
    *
    * Three outcomes folded into the same return shape:
    *   - No existing row: insert + return `{ acquired: true, lock }`.
    *   - Existing row, expired: take it over (update) + `{ acquired: true }`.
-   *   - Existing row, live, different user: return `{ acquired: false }`
-   *     with the current holder's lock state so the UI can render
-   *     "Locked by X" without a follow-up call.
-   *   - Existing row, live, same user: refresh TTL + `{ acquired: true }`
-   *     so re-acquiring your own lock is idempotent.
+   *   - Existing row, live — ANY user, the holder included: return
+   *     `{ acquired: false }` with the current holder's lock state so the UI
+   *     can render "Locked by X" without a follow-up call. Re-acquiring your
+   *     own live lock is refused on purpose (see the comment in the body):
+   *     refresh a held lock with `heartbeat()`, and ask "do I already hold
+   *     it?" with `get()`.
    *
    * `opts.coordination` stamps the row's `mode` as `'coordination'` — a
    * pure-mutex hold that grants no write authority (see
@@ -97,6 +132,33 @@ export class FileLockService {
     opts?: { coordination?: boolean },
   ): Promise<AcquireLockResult> {
     const targetPath = canonicalFileIdentity(rawPath);
+    if (this.closing.has(branch)) {
+      throw new WorkflowValidationError(`"${branch}" is being deleted, so "${targetPath}" cannot be held for editing.`, {
+        kind: 'branch-being-deleted',
+        branch,
+        path: targetPath,
+      });
+    }
+    const pending = this.acquireUnchecked(workspaceId, branch, targetPath, user, opts);
+    const inFlight = this.acquiring.get(branch) ?? new Set<Promise<unknown>>();
+    inFlight.add(pending);
+    this.acquiring.set(branch, inFlight);
+    try {
+      return await pending;
+    } finally {
+      inFlight.delete(pending);
+      if (inFlight.size === 0 && this.acquiring.get(branch) === inFlight) this.acquiring.delete(branch);
+    }
+  }
+
+  /** `acquire` past the deletion gate. */
+  private async acquireUnchecked(
+    workspaceId: string,
+    branch: string,
+    targetPath: string,
+    user: AuthUser,
+    opts?: { coordination?: boolean },
+  ): Promise<AcquireLockResult> {
     const now = new Date();
     const expiresAt = new Date(now.getTime() + LOCK_TTL_MS);
 

package/src/modules/workflow/git/__tests__/git.service.deleteBranch.test.ts

@@ -12,6 +12,7 @@ import type { IAccessControl } from '../../../access/access-control.interface.js
 import { GitService } from '../git.service.js';
 import {
   BranchAuthorshipError,
+  BranchDeleteRefusedError,
   ProtectedBranchError,
   WorkflowValidationError,
 } from '../../../../shared/domain-errors.js';
@@ -182,6 +183,57 @@ describe('GitService.deleteBranch — authorship + remote delete', () => {
     expect(await remoteHasRef(upstream, 'alice/my-draft')).toBe(false);
   });
 
+  it('when the host refuses the remote deletion, deletes nothing and says so (409, no git output)', async () => {
+    const { upstream, repo } = await seedWorkspace(root, workspaceId);
+    // The host turns every push away, as GitHub did during its incident.
+    const hook = path.join(upstream, 'hooks', 'pre-receive');
+    await fs.writeFile(hook, '#!/bin/sh\necho "Internal Server Error" >&2\nexit 1\n');
+    await fs.chmod(hook, 0o755);
+    const svc = makeService();
+
+    const err = await svc.deleteBranch(workspaceId, 'alice/my-draft', ALICE).catch((e: unknown) => e);
+    expect(err).toBeInstanceOf(BranchDeleteRefusedError);
+    const refusal = err as BranchDeleteRefusedError;
+    expect(refusal.status).toBe(409);
+    expect(refusal.message).toBe(
+      'The repository host refused to delete "alice/my-draft"; it is still there. Try again later.',
+    );
+    expect(JSON.stringify({ ...refusal.payload, error: refusal.message })).not.toMatch(
+      /Internal Server Error|remote rejected|pre-receive|upstream\.git/,
+    );
+    // Still there — remotely AND locally.
+    expect(await remoteHasRef(upstream, 'alice/my-draft')).toBe(true);
+    expect(
+      await gitOut(repo, ['for-each-ref', 'refs/heads/alice/my-draft', '--format', '%(refname)']),
+    ).toBe('refs/heads/alice/my-draft');
+  });
+
+  it('when the host cannot be reached, the local branch stays too', async () => {
+    const { repo } = await seedWorkspace(root, workspaceId);
+    await runGit(repo, ['remote', 'set-url', 'origin', path.join(root, 'gone.git')]);
+    const svc = makeService();
+
+    await expect(svc.deleteBranch(workspaceId, 'alice/my-draft', ALICE)).rejects.toBeInstanceOf(
+      BranchDeleteRefusedError,
+    );
+    expect(
+      await gitOut(repo, ['for-each-ref', 'refs/heads/alice/my-draft', '--format', '%(refname)']),
+    ).toBe('refs/heads/alice/my-draft');
+  });
+
+  it('deletes the remote branch even when this clone has no tracking ref for it (pushed from elsewhere since the last fetch)', async () => {
+    const { upstream, repo } = await seedWorkspace(root, workspaceId);
+    await runGit(repo, ['update-ref', '-d', 'refs/remotes/origin/alice/my-draft']);
+    const svc = makeService();
+
+    await svc.deleteBranch(workspaceId, 'alice/my-draft', ALICE);
+
+    expect(await remoteHasRef(upstream, 'alice/my-draft')).toBe(false);
+    expect(
+      await gitOut(repo, ['for-each-ref', 'refs/heads/alice/my-draft', '--format', '%(refname)']),
+    ).toBe('');
+  });
+
   it("refuses when the user isn't the author — leaves the remote ref intact", async () => {
     const { upstream } = await seedWorkspace(root, workspaceId);
     const svc = makeService();
@@ -318,3 +370,115 @@ describe('GitService.deleteBranch — authorship + remote delete', () => {
     ).rejects.toBeInstanceOf(ProtectedBranchError);
   });
 });
+
+/**
+ * The pieces an agent's `delete_branch` and the leftover cleanup decide with:
+ * where a branch stands against the default branch, whether a commit is
+ * contained in another, and a delete leased on the tip the checks saw.
+ */
+describe('GitService — branch state for a checked delete', () => {
+  let root: string;
+  const workspaceId = 'target-company-state';
+
+  beforeEach(async () => {
+    root = await mkTmpRoot();
+  });
+
+  afterEach(async () => {
+    await fs.rm(root, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 });
+  });
+
+  function makeService(): GitService {
+    return new GitService(
+      stubWorkspaceService(workspaceId, path.join(root, workspaceId)),
+      new WorkflowHooks(),
+      testKbContext(),
+    );
+  }
+
+  /** Push `n` commits onto `branch` from a separate clone, as a colleague would. */
+  async function pushCommits(upstream: string, branch: string, n: number): Promise<string> {
+    const other = path.join(root, `.other-${Math.random().toString(36).slice(2)}`);
+    await runGit(root, ['clone', '-b', branch, upstream, other]);
+    for (let i = 0; i < n; i++) await runGit(other, ['commit', '--allow-empty', '-m', `work ${i}`]);
+    await runGit(other, ['push', 'origin', branch]);
+    return gitOut(other, ['rev-parse', 'HEAD']);
+  }
+
+  it('counts the commits not on the default branch, and reads the tip', async () => {
+    const { upstream, repo } = await seedWorkspace(root, workspaceId);
+    const tip = await pushCommits(upstream, 'bob/other-draft', 3);
+    await runGit(repo, ['fetch', 'origin']);
+    const svc = makeService();
+
+    const state = await svc.branchState(workspaceId, 'bob/other-draft', 'target-company-state');
+    expect(state).toEqual({ exists: true, lastCommit: tip, unmergedCommits: 3 });
+
+    // A branch with nothing of its own counts none.
+    const merged = await svc.branchState(workspaceId, 'alice/my-draft', 'target-company-state');
+    expect(merged.exists).toBe(true);
+    expect(merged.unmergedCommits).toBe(0);
+  });
+
+  it('a name that is not a branch does not exist', async () => {
+    await seedWorkspace(root, workspaceId);
+    const state = await makeService().branchState(workspaceId, 'alice/no-such-branch', 'target-company-state');
+    expect(state).toEqual({ exists: false, lastCommit: null, unmergedCommits: 0 });
+  });
+
+  it('isAncestor: yes for a contained commit, no for one that is not, and throws for an unknown commit', async () => {
+    const { upstream, repo } = await seedWorkspace(root, workspaceId);
+    const base = await gitOut(repo, ['rev-parse', 'HEAD']);
+    const tip = await pushCommits(upstream, 'bob/other-draft', 1);
+    await runGit(repo, ['fetch', 'origin']);
+    const svc = makeService();
+
+    expect(await svc.isAncestor(workspaceId, base, tip)).toBe(true);
+    expect(await svc.isAncestor(workspaceId, tip, base)).toBe(false);
+    await expect(svc.isAncestor(workspaceId, 'f'.repeat(40), base)).rejects.toThrow();
+  });
+
+  it('removes the branch from the shared repository even when this clone never fetched it, and answers its tip', async () => {
+    const { upstream, repo } = await seedWorkspace(root, workspaceId);
+    // Created from elsewhere after this clone was made: no tracking ref here.
+    const other = path.join(root, '.creator');
+    await runGit(root, ['clone', upstream, other]);
+    await runGit(other, ['checkout', '-b', 'alice/new-elsewhere']);
+    await runGit(other, ['commit', '--allow-empty', '-m', 'elsewhere']);
+    await runGit(other, ['push', 'origin', 'alice/new-elsewhere']);
+    const tip = await gitOut(other, ['rev-parse', 'HEAD']);
+    expect(await gitOut(repo, ['for-each-ref', 'refs/remotes/origin/alice/new-elsewhere'])).toBe('');
+
+    const result = await makeService().deleteBranch(workspaceId, 'alice/new-elsewhere', ALICE);
+    expect(result).toEqual({ lastCommit: tip });
+    expect(await remoteHasRef(upstream, 'alice/new-elsewhere')).toBe(false);
+  });
+
+  it('a delete leased on a tip refuses a branch that moved since, and leaves it in place', async () => {
+    const { upstream } = await seedWorkspace(root, workspaceId);
+    const seen = await gitOut(upstream, ['rev-parse', 'refs/heads/alice/my-draft']);
+    // A colleague pushes after the checks were made.
+    await pushCommits(upstream, 'alice/my-draft', 1);
+
+    const err = await makeService()
+      .deleteBranch(workspaceId, 'alice/my-draft', ALICE, { expectTip: seen })
+      .catch((e: unknown) => e);
+    expect(err).toBeInstanceOf(BranchDeleteRefusedError);
+    expect(await remoteHasRef(upstream, 'alice/my-draft')).toBe(true);
+  });
+
+  it('a delete leased on the current tip goes through', async () => {
+    const { upstream } = await seedWorkspace(root, workspaceId);
+    const seen = await gitOut(upstream, ['rev-parse', 'refs/heads/alice/my-draft']);
+    const result = await makeService().deleteBranch(workspaceId, 'alice/my-draft', ALICE, { expectTip: seen });
+    expect(result.lastCommit).toBe(seen);
+    expect(await remoteHasRef(upstream, 'alice/my-draft')).toBe(false);
+  });
+
+  it('mayDeleteBranch: the author yes, anyone else without the Admin role no', async () => {
+    await seedWorkspace(root, workspaceId);
+    const svc = makeService();
+    expect(await svc.mayDeleteBranch(workspaceId, 'alice/my-draft', ALICE)).toBe(true);
+    expect(await svc.mayDeleteBranch(workspaceId, 'bob/other-draft', ALICE)).toBe(false);
+  });
+});

package/src/modules/workflow/git/__tests__/git.service.pull.test.ts

@@ -352,6 +352,39 @@ describe('GitService.pull', () => {
     await runGit(repo, ['push', 'origin', 'target-company-state']);
     await expect(svc.hasUnpushedCommits(workspaceId)).resolves.toBe(false);
   });
+
+  /**
+   * The question the roles.yaml preservation asks before pushing a restore it
+   * finds already committed: not "is there unpushed work" but "would the push
+   * fast-forward origin to HEAD". A clone behind origin answers no, and one
+   * whose tracking ref git cannot even resolve answers with an error — the
+   * guard that asks must fail closed on it, so the probe may not swallow it.
+   */
+  it('headContainsOrigin: true in sync and ahead, false behind origin, an error without a tracking ref', async () => {
+    const { repo } = await seedWorkspace(root, workspaceId);
+    const svc = new GitService(
+      stubWorkspaceService({ [workspaceId]: path.join(root, workspaceId) }),
+      stubWorkflowHooks(),
+      testKbContext(),
+    );
+
+    await expect(svc.headContainsOrigin(workspaceId)).resolves.toBe(true);
+
+    // Ahead: a local commit on top of origin's tip.
+    await fs.writeFile(path.join(repo, 'new.txt'), 'x\n');
+    await runGit(repo, ['add', '.']);
+    await runGit(repo, ['commit', '-m', 'unpushed']);
+    await expect(svc.headContainsOrigin(workspaceId)).resolves.toBe(true);
+
+    // Behind: publish it, then step the clone back before it.
+    await runGit(repo, ['push', 'origin', 'target-company-state']);
+    await runGit(repo, ['reset', '--hard', 'HEAD~1']);
+    await expect(svc.headContainsOrigin(workspaceId)).resolves.toBe(false);
+
+    // No tracking ref at all: not "false", an error.
+    await runGit(repo, ['checkout', '-b', 'never-pushed']);
+    await expect(svc.headContainsOrigin(workspaceId)).rejects.toThrow();
+  });
 });
 
 /**
@@ -411,7 +444,10 @@ describe('GitService.pull — an unpushed merge commit', () => {
     const workspaceDir = path.join(root, workspaceId);
     const repo = path.join(workspaceDir, 'knowledge-base');
     await fs.mkdir(workspaceDir, { recursive: true });
-    await runGit(root, ['clone', '-b', 'alice/deal', upstream, repo]);
+    // `core.autocrlf=false` on the clone itself, not only afterwards: a
+    // Windows git would otherwise check the files out with CRLF, and the
+    // rebase's autostash of that "dirty" tree conflicts on reapply.
+    await runGit(root, ['-c', 'core.autocrlf=false', 'clone', '-b', 'alice/deal', upstream, repo]);
     await runGit(repo, ['config', 'user.email', 'workspace@bevel.test']);
     await runGit(repo, ['config', 'user.name', 'bevel Workspace']);
     await runGit(repo, ['config', 'core.autocrlf', 'false']);
@@ -456,6 +492,17 @@ describe('GitService.pull — an unpushed merge commit', () => {
     expect(contains).toBe(false);
   });
 
+  it('survives the background sync, which may reach the branch before any push does', async () => {
+    const { repo, targetTip } = await seedUnpushedMerge();
+    await svcFor().syncFromRemote(workspaceId);
+
+    expect(await gitOut(repo, ['rev-list', '--count', '--merges', 'HEAD'])).toBe('1');
+    const contains = await gitOut(repo, [
+      'merge-base', '--is-ancestor', targetTip, 'HEAD',
+    ]).then(() => true, () => false);
+    expect(contains).toBe(true);
+  });
+
   it('survives `preserveMerges`, and the branch still contains the target', async () => {
     const { repo, targetTip } = await seedUnpushedMerge();
     await svcFor().pull(workspaceId, { preserveMerges: true });