@bevel-software/platform-core-backend 0.26.0 → 0.27.0

package/src/modules/workspace/__tests__/workspace.routes.download.test.ts

@@ -49,6 +49,8 @@ interface Harness {
   server: Server;
   baseUrl: string;
   canDownload: ReturnType<typeof vi.fn>;
+  canReadBatch: ReturnType<typeof vi.fn>;
+  canDownloadBatch: ReturnType<typeof vi.fn>;
   canWrite: ReturnType<typeof vi.fn>;
   createFolderZip: ReturnType<typeof vi.fn>;
 }
@@ -70,14 +72,21 @@ async function makeHarness(opts: {
     return opts.canDownload;
   });
   const canWrite = vi.fn();
+  // The /file/raw route now read-gates before the download gate; these tests
+  // exercise the download verb, so reads pass.
+  const canReadBatch = vi.fn(async (_w: string, _e: string, paths: string[]) => new Map(paths.map((p) => [p, true])));
+  // Every entry of a folder is judged for download too; by default each gets
+  // the folder's own verdict.
+  const canDownloadBatch = vi.fn(async (_w: string, _e: string, paths: string[]) =>
+    new Map(paths.map((p) => [p, opts.canDownload])),
+  );
   const accessControl: IAccessControl = {
     canWrite,
     canWriteBatch: vi.fn(),
-    // The /file/raw route now read-gates before the download gate; these tests
-    // exercise the download verb, so reads pass.
     canRead: vi.fn(async () => true),
-    canReadBatch: vi.fn(async (_w: string, _e: string, paths: string[]) => new Map(paths.map((p) => [p, true]))),
+    canReadBatch,
     canDownload,
+    canDownloadBatch,
     eligibleWriters: vi.fn(),
     eligibleWriterEmails: vi.fn(),
     invalidate: vi.fn(),
@@ -152,7 +161,7 @@ async function makeHarness(opts: {
     throw new Error(`Unexpected server.address() shape: ${JSON.stringify(addr)}`);
   }
   const port = (addr as AddressInfo).port;
-  return { server, baseUrl: `http://127.0.0.1:${port}`, canDownload, canWrite, createFolderZip };
+  return { server, baseUrl: `http://127.0.0.1:${port}`, canDownload, canReadBatch, canDownloadBatch, canWrite, createFolderZip };
 }
 
 async function closeServer(server: Server): Promise<void> {
@@ -338,6 +347,8 @@ describe('GET /workspace/:id/folder/zip — gated on Download role', () => {
     expect(res.status).toBe(200);
     expect(res.headers.get('content-type')).toBe('application/zip');
     expect(res.headers.get('x-content-type-options')).toBe('nosniff');
+    // The archive holds one caller's verdicts, so a shared cache never keeps it.
+    expect(res.headers.get('cache-control')).toBe('private, no-store');
     const dispo = res.headers.get('content-disposition');
     expect(dispo).toBeTruthy();
     expect(dispo).toContain('attachment');
@@ -349,7 +360,43 @@ describe('GET /workspace/:id/folder/zip — gated on Download role', () => {
     // verb is resolved on its repo-relative form, and the service is handed the
     // repository path it was judged as.
     expect(h.canDownload).toHaveBeenCalledWith(WORKSPACE_ID, USER.email, 'Knowledge/Sales');
-    expect(h.createFolderZip).toHaveBeenCalledWith(WORKSPACE_ID, `${KB}/Knowledge/Sales`);
+    expect(h.createFolderZip.mock.calls[0]!.slice(0, 2)).toEqual([WORKSPACE_ID, `${KB}/Knowledge/Sales`]);
+  });
+
+  it('judges every file the zip would pack: unreadable ones and undownloadable ones are left out', async () => {
+    h = await makeHarness({ canDownload: true });
+    // What the service finds under the folder; the route's filter decides.
+    const found = ['Knowledge/Sales/open.md', 'Knowledge/Sales/hidden.md', 'Knowledge/Sales/no-save.md'];
+    h.canReadBatch.mockImplementation(async (_w: string, _e: string, paths: string[]) =>
+      new Map(paths.map((p) => [p, p !== 'Knowledge/Sales/hidden.md'])),
+    );
+    h.canDownloadBatch.mockImplementation(async (_w: string, _e: string, paths: string[]) =>
+      new Map(paths.map((p) => [p, p !== 'Knowledge/Sales/no-save.md'])),
+    );
+    let packed: ReadonlySet<string> | null = null;
+    h.createFolderZip.mockImplementation(
+      async (_id: string, _p: string, include: (paths: string[]) => Promise<ReadonlySet<string>>) => {
+        packed = await include(found);
+        return ZIP_BYTES;
+      },
+    );
+
+    const res = await fetch(
+      `${h.baseUrl}/api/workspace/${WORKSPACE_ID}/folder/zip?path=${encodeURIComponent('Knowledge/Sales')}&download=1`,
+    );
+
+    expect(res.status).toBe(200);
+    expect([...packed!]).toEqual(['Knowledge/Sales/open.md']);
+    // Read first, then download on what is readable: a file the caller may
+    // not see is never asked about for download, so nothing about it is
+    // computed or counted.
+    expect(h.canReadBatch).toHaveBeenCalledWith(WORKSPACE_ID, USER.email, found);
+    expect(h.canDownloadBatch).toHaveBeenCalledWith(WORKSPACE_ID, USER.email, [
+      'Knowledge/Sales/open.md',
+      'Knowledge/Sales/no-save.md',
+    ]);
+    // The count covers the readable file left out, not the hidden one.
+    expect(res.headers.get('x-withheld-files')).toBe('1');
   });
 
   it('user without Download role gets 403 and no zip is built', async () => {

package/src/modules/workspace/__tests__/workspace.routes.folder-zip-access.test.ts

@@ -0,0 +1,190 @@
+import type { Server } from 'node:http';
+import type { AddressInfo } from 'node:net';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import express from 'express';
+import AdmZip from 'adm-zip';
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { testKbContext } from '../../../__tests__/kb-context.js';
+import { NodeFs } from '../../kb-fs/node-fs.js';
+import type { IWorkflowService } from '@bevel-software/platform-shared';
+import type { ICreatorAccess } from '../../access-model/creator.js';
+import type { IAdminAccessService } from '../../admin/admin.interface.js';
+import type { WorkflowEventBus } from '../../workflow/event-bus.js';
+import type { AuthService } from '../../auth/auth.service.js';
+import { AccessControlService } from '../../access/access-control.service.js';
+import { createWorkspaceRoutes } from '../workspace.routes.js';
+import { WorkspaceService } from '../workspace.service.js';
+
+/**
+ * The folder download over the REAL resolver and the REAL zip builder.
+ *
+ * `download` on a folder let the caller ask for its zip, and the zip then
+ * packed every file under the folder: no file was judged against its own
+ * rules, so a caller got files whose frontmatter denied them `download`, files
+ * whose frontmatter denied them `read`, and whole sub-folders a nested
+ * access.md closed to them — files the per-file route refused and the file
+ * tree never showed (found 2026-10-07). The four cases below are the ones
+ * that were verified leaking; each must now be absent from the archive, and
+ * the one the caller may download must still be in it.
+ */
+
+const KB = 'knowledge-base';
+const WORKSPACE_ID = 'target-company-state';
+
+const stubCreatorAccess: ICreatorAccess = {
+  planForCreate: async () => null,
+  grantInExtractedFile: async () => null,
+  noteAccessFileWritten: () => {},
+};
+
+let caller = { id: 'user-1', email: 'ana@x.io', name: 'Ana' };
+
+const ROLES_YAML = `roles:
+  Admin:
+    - admin@x.io
+`;
+
+/** The folder Ana may download, with the files the rules below decide over. */
+const FILES: Record<string, string> = {
+  'Shared/access.md': '---\n---\ndownload:\n  - Ana <ana@x.io>\n',
+  'Shared/Open.md': '# open\n',
+  'Shared/Node-Deny-Download.md': '---\ndownload:\n  - deny Ana <ana@x.io>\n---\n# no save\n',
+  'Shared/Node-Deny-Read.md': '---\nread:\n  - deny Ana <ana@x.io>\n---\n# hidden\n',
+  'Shared/Inner/access.md': '---\n---\nread:\n  - deny Ana <ana@x.io>\ndownload:\n  - deny Ana <ana@x.io>\n',
+  'Shared/Inner/Plan.md': '# hidden plan\n',
+};
+
+interface Harness {
+  server: Server;
+  baseUrl: string;
+}
+
+describe('GET /folder/zip judges every file it packs (real resolver, real zip)', () => {
+  let root: string;
+  let h: Harness | null = null;
+
+  beforeEach(async () => {
+    root = await fs.mkdtemp(path.join(os.tmpdir(), 'bevel-zip-access-'));
+    caller = { id: 'user-1', email: 'ana@x.io', name: 'Ana' };
+  });
+
+  afterEach(async () => {
+    if (h) {
+      await new Promise<void>((resolve, reject) => h!.server.close((e) => (e ? reject(e) : resolve())));
+      h = null;
+    }
+    await fs.rm(root, { recursive: true, force: true });
+  });
+
+  async function makeHarness(files: Record<string, string>): Promise<Harness> {
+    const workspaceDir = path.join(root, WORKSPACE_ID);
+    const repo = path.join(workspaceDir, KB);
+    // A `.git` folder is what makes the service adopt the clone without cloning.
+    await fs.mkdir(path.join(repo, '.git'), { recursive: true });
+    for (const [rel, contents] of Object.entries({ 'roles.yaml': ROLES_YAML, ...files })) {
+      const abs = path.join(repo, rel);
+      await fs.mkdir(path.dirname(abs), { recursive: true });
+      await fs.writeFile(abs, contents);
+    }
+
+    const workspaceService = new WorkspaceService(
+      root,
+      'https://example.invalid/kb.git',
+      testKbContext({ kbDirName: KB }),
+      new NodeFs(),
+    );
+    const accessControl = new AccessControlService(workspaceService, KB, new NodeFs());
+    const authService = { getUserById: async () => caller } as unknown as AuthService;
+
+    const app = express();
+    app.use(express.json());
+    app.use('/api', (req, _res, next) => {
+      (req as unknown as { userId: string }).userId = caller.id;
+      next();
+    });
+    app.use(
+      '/api',
+      createWorkspaceRoutes(
+        workspaceService,
+        authService,
+        {} as unknown as IWorkflowService,
+        {} as unknown as WorkflowEventBus,
+        accessControl,
+        testKbContext({ kbDirName: KB }),
+        stubCreatorAccess,
+        { isAdmin: async () => false } as unknown as IAdminAccessService,
+        new NodeFs(),
+      ),
+    );
+    const server = await new Promise<Server>((resolve) => {
+      const s = app.listen(0, () => resolve(s));
+    });
+    const addr = server.address() as AddressInfo;
+    return { server, baseUrl: `http://127.0.0.1:${addr.port}` };
+  }
+
+  const zipOf = (base: string, folder: string) =>
+    fetch(`${base}/api/workspace/${WORKSPACE_ID}/folder/zip?path=${encodeURIComponent(folder)}&download=1`);
+
+  const entriesOf = async (res: Response) =>
+    new AdmZip(Buffer.from(await res.arrayBuffer()))
+      .getEntries()
+      .map((e) => e.entryName)
+      .sort();
+
+  it('packs the file the caller may download, and none of the ones their own rules withhold', async () => {
+    h = await makeHarness(FILES);
+
+    const res = await zipOf(h.baseUrl, `${KB}/Shared`);
+
+    expect(res.status).toBe(200);
+    expect(res.headers.get('content-type')).toBe('application/zip');
+    // Ana's archive, with Ana's verdicts: never served to anyone else from a cache.
+    expect(res.headers.get('cache-control')).toBe('private, no-store');
+    expect(await entriesOf(res)).toEqual(['Shared/Open.md', 'Shared/access.md']);
+    // One file Ana can see but not save is counted; the two she cannot see
+    // and the closed folder are not — the count says nothing the tree does not.
+    expect(res.headers.get('x-withheld-files')).toBe('1');
+  });
+
+  it('the per-file route agrees on every one of them', async () => {
+    h = await makeHarness(FILES);
+    const raw = (p: string) =>
+      fetch(`${h!.baseUrl}/api/workspace/${WORKSPACE_ID}/file/raw?path=${encodeURIComponent(`${KB}/${p}`)}&download=1`);
+
+    expect((await raw('Shared/Open.md')).status).toBe(200);
+    expect((await raw('Shared/Node-Deny-Download.md')).status).toBe(403);
+    expect((await raw('Shared/Node-Deny-Read.md')).status).toBe(403);
+    expect((await raw('Shared/Inner/Plan.md')).status).toBe(403);
+  });
+
+  it('still refuses the folder itself to someone with no download grant', async () => {
+    h = await makeHarness(FILES);
+    caller = { id: 'user-2', email: 'mallory@x.io', name: 'Mallory' };
+
+    const res = await zipOf(h.baseUrl, `${KB}/Shared`);
+
+    expect(res.status).toBe(403);
+  });
+
+  // `access.md` itself stays in HERE: this fixture's declares nothing for
+  // itself (its frontmatter is empty), so the folder's rules — which admit
+  // the caller — admit the file too. That is not a guarantee: an `access.md`
+  // is judged like any file, by its own frontmatter and the folder chain, and
+  // one whose frontmatter denies the caller its read is left out of the
+  // archive exactly as the single-file route would refuse it.
+  it('answers an archive holding only the grant file, not an error, when every content file is withheld', async () => {
+    h = await makeHarness({
+      'Shared/access.md': '---\n---\ndownload:\n  - Ana <ana@x.io>\n',
+      'Shared/Only.md': '---\ndownload:\n  - deny Ana <ana@x.io>\n---\n# no save\n',
+    });
+
+    const res = await zipOf(h.baseUrl, `${KB}/Shared`);
+
+    expect(res.status).toBe(200);
+    expect(await entriesOf(res)).toEqual(['Shared/access.md']);
+    expect(res.headers.get('x-withheld-files')).toBe('1');
+  });
+});

package/src/modules/workspace/__tests__/workspace.service.forget-clone-races.test.ts

@@ -127,6 +127,13 @@ describe('a bootstrap in flight when the working copy is taken away', () => {
     const svc = service(runner);
     // Nothing on disk: this is a first clone, which is what takes seconds.
     const opening = svc.getOrCreateForBranch(BRANCH);
+    // Told, rather than handed a cached path to a working copy of the
+    // repository that was replaced — which every later read would ENOENT on,
+    // with nothing left to re-clone it. The expectation is attached NOW: the
+    // refusal lands somewhere inside the timer turns below, and a rejection
+    // with no handler on it across a turn is what Vitest reports as unhandled
+    // — a flake that failed the suite on CI with every test green.
+    const refused = expect(opening).rejects.toThrow(/replaced while the "main" working copy was being created/);
     await vi.waitFor(() => expect(calls.length).toBeGreaterThan(0));
 
     // The replacement lands while the clone runs.
@@ -139,9 +146,6 @@ describe('a bootstrap in flight when the working copy is taken away', () => {
       await new Promise((r) => setTimeout(r, 0));
     }
 
-    // Told, rather than handed a cached path to a working copy of the
-    // repository that was replaced — which every later read would ENOENT on,
-    // with nothing left to re-clone it.
-    await expect(opening).rejects.toThrow(/replaced while the "main" working copy was being created/);
+    await refused;
   });
 });

package/src/modules/workspace/__tests__/workspace.service.test.ts

@@ -698,13 +698,55 @@ describe('WorkspaceService.createFolderZip', () => {
     }));
   }
 
+  /** The filter a caller with every permission passes: pack everything found. */
+  const ALL = async (paths: string[]) => new Set(paths);
+
+  it('packs only what the filter allows, and asks it once with every file as a repository path', async () => {
+    const dir = path.join(repoDir, 'judged');
+    await fs.mkdir(path.join(dir, 'inner'), { recursive: true });
+    await fs.writeFile(path.join(dir, 'open.md'), 'open');
+    await fs.writeFile(path.join(dir, 'withheld.md'), 'withheld');
+    await fs.writeFile(path.join(dir, 'inner', 'deep.md'), 'deep');
+    const asked: string[][] = [];
+    const include = async (paths: string[]) => {
+      asked.push([...paths].sort());
+      return new Set(paths.filter((p) => p !== 'judged/withheld.md'));
+    };
+
+    const buf = await svc.createFolderZip(workspaceId, 'judged', include);
+
+    // Asked once, with every file the walk found, keyed the way the access
+    // rules are: relative to the repository, not to the folder or the workspace.
+    expect(asked).toEqual([['judged/inner/deep.md', 'judged/open.md', 'judged/withheld.md']]);
+    const names = (await unzipEntries(buf)).map((e) => e.name).sort();
+    expect(names).toEqual(['judged/inner/deep.md', 'judged/open.md']);
+  });
+
+  it('keys the files the same way whether the folder is written with a trailing slash or not', async () => {
+    const dir = path.join(repoDir, 'slashed');
+    await fs.mkdir(dir, { recursive: true });
+    await fs.writeFile(path.join(dir, 'a.md'), 'a');
+    const asked: string[][] = [];
+    const include = async (paths: string[]) => {
+      asked.push(paths);
+      return new Set(paths);
+    };
+
+    await svc.createFolderZip(workspaceId, 'slashed/', include);
+    await svc.createFolderZip(workspaceId, `${'knowledge-base'}/slashed//`, include);
+
+    // A `slashed//a.md` key would match no verdict, and the filter would
+    // withhold the whole folder without a word.
+    expect(asked).toEqual([['slashed/a.md'], ['slashed/a.md']]);
+  });
+
   it('zips a folder prefixing entries with the folder name', async () => {
     const dir = path.join(repoDir, 'docs');
     await fs.mkdir(dir, { recursive: true });
     await fs.writeFile(path.join(dir, 'a.md'), 'alpha');
     await fs.writeFile(path.join(dir, 'b.md'), 'beta');
 
-    const buf = await svc.createFolderZip(workspaceId, 'docs');
+    const buf = await svc.createFolderZip(workspaceId, 'docs', ALL);
     const entries = await unzipEntries(buf);
     const names = entries.map((e) => e.name).sort();
     expect(names).toEqual(['docs/a.md', 'docs/b.md']);
@@ -719,7 +761,7 @@ describe('WorkspaceService.createFolderZip', () => {
     await fs.writeFile(path.join(dir, 'nested', 'mid.md'), 'mid');
     await fs.writeFile(path.join(dir, 'nested', 'deep', 'leaf.md'), 'leaf');
 
-    const buf = await svc.createFolderZip(workspaceId, 'tree');
+    const buf = await svc.createFolderZip(workspaceId, 'tree', ALL);
     const names = (await unzipEntries(buf)).map((e) => e.name).sort();
     expect(names).toEqual([
       'tree/nested/deep/leaf.md',
@@ -736,7 +778,7 @@ describe('WorkspaceService.createFolderZip', () => {
     await fs.writeFile(path.join(dir, '.gitkeep'), '');
     await fs.writeFile(path.join(dir, 'real.md'), 'real');
 
-    const buf = await svc.createFolderZip(workspaceId, 'mixed');
+    const buf = await svc.createFolderZip(workspaceId, 'mixed', ALL);
     const names = (await unzipEntries(buf)).map((e) => e.name).sort();
     expect(names).toEqual(['mixed/real.md']);
   });
@@ -748,7 +790,7 @@ describe('WorkspaceService.createFolderZip', () => {
     await fs.writeFile(path.join(dir, 'public.md'), 'pub');
     await fs.writeFile(path.join(dir, 'secret.md'), 'shh');
 
-    const buf = await svc.createFolderZip(workspaceId, 'with-ignore');
+    const buf = await svc.createFolderZip(workspaceId, 'with-ignore', ALL);
     const names = (await unzipEntries(buf)).map((e) => e.name).sort();
     expect(names).toContain('with-ignore/public.md');
     expect(names).not.toContain('with-ignore/secret.md');
@@ -756,17 +798,17 @@ describe('WorkspaceService.createFolderZip', () => {
 
   it('refuses to zip a file (not a directory)', async () => {
     await fs.writeFile(path.join(repoDir, 'lone.md'), 'one');
-    await expect(svc.createFolderZip(workspaceId, 'lone.md')).rejects.toThrow('Not a directory');
+    await expect(svc.createFolderZip(workspaceId, 'lone.md', ALL)).rejects.toThrow('Not a directory');
   });
 
   it('refuses a traversing path, and reads an unprefixed one as the repository folder', async () => {
-    await expect(svc.createFolderZip(workspaceId, '../escape')).rejects.toThrow(
+    await expect(svc.createFolderZip(workspaceId, '../escape', ALL)).rejects.toThrow(
       'is outside the knowledge base repository',
     );
     // The unprefixed spelling is the repository's own folder, so it zips.
     await fs.mkdir(path.join(repoDir, 'unprefixed'), { recursive: true });
     await fs.writeFile(path.join(repoDir, 'unprefixed', 'a.md'), 'a');
-    const buf = await svc.createFolderZip(workspaceId, 'unprefixed');
+    const buf = await svc.createFolderZip(workspaceId, 'unprefixed', ALL);
     expect((await unzipEntries(buf)).map((e) => e.name)).toEqual(['unprefixed/a.md']);
   });
 
@@ -796,7 +838,7 @@ describe('WorkspaceService.createFolderZip', () => {
       return result;
     });
     try {
-      await expect(svc.createFolderZip(workspaceId, 'too-big'))
+      await expect(svc.createFolderZip(workspaceId, 'too-big', ALL))
         .rejects.toBeInstanceOf(FolderTooLargeError);
     } finally {
       statSpy.mockRestore();

package/src/modules/workspace/__tests__/workspace.tools.branch-errors.test.ts

@@ -9,6 +9,7 @@ import { afterEach, describe, expect, it } from 'vitest';
 import '@utcp/http'; // registers the http CallTemplate serializer + protocol
 import { UtcpManualSerializer } from '@utcp/sdk';
 import { HttpCallTemplateSerializer } from '@utcp/http';
+import { exampleArguments } from '@bevel-software/platform-mcp-core';
 import { CodeModeUtcpClient } from '../../code-mode/index.js';
 import { testKbContext } from '../../../__tests__/kb-context.js';
 import { NodeFs } from '../../kb-fs/node-fs.js';
@@ -167,7 +168,12 @@ describe('workspace tools — a branch that cannot be opened', () => {
         } as ToolAuth;
         next();
       },
-      createToolHandlerFactory(resolve),
+      // Wired as the composition root wires it, so a missing branch is
+      // answered before the tool runs, as it is in production.
+      createToolHandlerFactory(resolve, undefined, {
+        defaultBranch: () => 'target-company-state',
+        isMissing: (branch) => workspaces!.isBranchMissing(branch),
+      }),
       new SpillStore(spillRoot),
       new DocExtractService(docCacheDir),
       allowAll,
@@ -272,6 +278,24 @@ describe('workspace tools — a branch that cannot be opened', () => {
       });
     }
 
+    /**
+     * The platform's file tools keep the refusal they had: `read_file` is
+     * still `required`, answered the same sentence by the tool handler that
+     * now answers it for every tool that takes a branch.
+     */
+    it('read_file refuses a call without a branch as before', async () => {
+      const base = await start();
+
+      const res = await callTool(base, 'read_file', { path: 'knowledge-base/a.md' });
+
+      expect(res.status).toBe(400);
+      expect(res.body).toEqual({
+        kind: 'branch-required',
+        error: '`branch` is required: pass the branch (draft) you are working on.',
+      });
+      expect(await workspaceDirs()).toEqual([]);
+    });
+
     it('never writes `undefined` or `null` as a branch name into the answer', async () => {
       const base = await start();
 
@@ -407,6 +431,25 @@ describe('workspace tools — a branch that cannot be opened', () => {
     expect(await workspaceDirs()).toEqual([]);
   });
 
+  it('404s a branch that does not exist on every mounted tool that takes one, before the tool runs', async () => {
+    const base = await start({ source: 'internal', scope: 'write' });
+    const takesBranch = internalTools
+      .map((t) => ({ name: t.name, body: (t.inputs as { properties?: { body?: { required?: string[] } } }).properties?.body }))
+      .filter(({ body }) => (body?.required ?? []).includes('branch'))
+      // Resolves its own branch, and validates it itself first.
+      .filter(({ name }) => name !== 'execute_command');
+
+    for (const { name: tool, body } of takesBranch) {
+      // Every other argument the tool requires, so the call matches the tool
+      // and it is the branch, not a missing argument, that is refused.
+      const args = { ...exampleArguments(body), branch: 'nobody/never-made-this' };
+      const res = await callTool(base, tool, args);
+      expect(res.status, `${tool} must 404 a branch that does not exist`).toBe(404);
+      expect(res.body, tool).toMatchObject({ kind: 'branch-not-found', branch: 'nobody/never-made-this' });
+    }
+    expect(await workspaceDirs()).toEqual([]);
+  });
+
   it('410s a branch a listing showed us and origin no longer has', async () => {
     const base = await start();
     workspaces!.noteBranchesListed(['target-company-state', 'alice/draft']);