@bevel-software/platform-core-backend 0.28.1 → 0.30.0

package/src/modules/workflow/pending-commits.service.ts

@@ -41,6 +41,7 @@ const log = logger('pending-commits');
 import type { Database } from '../database/connection.js';
 import { canonicalEmail } from '../../shared/email-identity.js';
 import { pendingCommits } from '../database/schema.js';
+import { canonicalWorkspaceId } from '../../shared/workspace-id.js';
 
 /**
  * Transient-failure budget per recovery cycle. After this many consecutive
@@ -80,29 +81,9 @@ export const N_RECOVERY = 3;
  */
 export const BACKOFF_MS = [1_000, 5_000, 30_000];
 
-/**
- * Canonicalize a workspace id so an enqueued row and the worker's claim always
- * key on the SAME string.
- *
- * The id reaches `enqueue` via a route `:id` path param, which Express
- * URL-decodes — so a slashed feature branch arrives as `alice/feature`. But the
- * worker claims per `WorkspaceService.knownWorkspaces()`, whose ids are
- * `encodeURIComponent(branch)` → `alice%2Ffeature`. Those strings differ, so
- * `WHERE workspace_id = …` never matched and the row was never drained —
- * silently stranding every human save on a feature branch (protected branches
- * have no `/`, so encoded == decoded and they were unaffected).
- *
- * `encodeURIComponent(decodeURIComponent(id))` is idempotent and collapses both
- * forms to the encoded id `knownWorkspaces()` uses. A malformed `%` sequence
- * (which `decodeURIComponent` would throw on) is left untouched.
- */
-export function canonicalWorkspaceId(id: string): string {
-  try {
-    return encodeURIComponent(decodeURIComponent(id));
-  } catch {
-    return id;
-  }
-}
+// Lives in `shared/workspace-id.ts`, beside the encoding it canonicalises to;
+// re-exported for this module's existing importers.
+export { canonicalWorkspaceId };
 
 export interface PendingCommit {
   id: string;

package/src/modules/workflow/workflow-hooks.ts

@@ -65,7 +65,7 @@ export interface AgentOperationContext {
   sessionId?: string;
   /**
    * The workspace-relative path the operation targets. Absent for a
-   * write-capable operation with no resolvable target (`execute_command`).
+   * write-capable operation with no resolvable target.
    */
   wsPath?: string;
   /** The branch (draft) whose workspace the operation acts on. */

package/src/modules/workflow/workflow.routes.ts

@@ -40,6 +40,7 @@ import type { WorkflowEventBus } from './event-bus.js';
 import { WorkflowDomainError } from '../../shared/domain-errors.js';
 import { assertValidRelativePath } from '../kb-fs/branch-name.js';
 import { domainErrorBody } from '../../shared/http-errors.js';
+import { canonicalFileIdentity } from '../../shared/canonical-file-identity.js';
 import '../auth/auth.middleware.js'; // Express Request augmentation
 
 function toHttpError(
@@ -501,6 +502,8 @@ export function createWorkflowRoutes(
   // answer for that same input, and `toHttpError` passes it through unchanged.
   // Nothing is canonicalised at this layer on purpose: a route-level fix would
   // leave any other caller of the service coordinating on its own identity.
+  // (The status read canonicalises once for its read gate only; the lookup
+  // still takes the caller's spelling.)
 
   router.post('/workspace/:id/workflow/locks', async (req, res) => {
     const user = await requireUser(req, res);
@@ -589,7 +592,8 @@ export function createWorkflowRoutes(
   });
 
   router.get('/workspace/:id/workflow/locks', async (req, res) => {
-    if (!(await requireUser(req, res))) return;
+    const user = await requireUser(req, res);
+    if (!user) return;
     const branch = typeof req.query.branch === 'string' ? req.query.branch : '';
     const targetPath = typeof req.query.path === 'string' ? req.query.path : '';
     if (!branch || !targetPath) {
@@ -597,6 +601,25 @@ export function createWorkflowRoutes(
       return;
     }
     try {
+      // A lock names who is editing the file, so a caller who may not read
+      // the file is refused before the lookup: the answer is the same whether
+      // or not it is held. The gate judges the canonical spelling, which is
+      // the one the lock is found under (`./kb//x.md` would otherwise slip
+      // past the KB-prefix test), and a refused spelling keeps the file
+      // verbs' status. A path without the KB prefix is not exempted as
+      // non-KB: the git layer also takes the repo-relative form (`GTM/x.md`
+      // for `knowledge-base/GTM/x.md`, see `requireReadPermission`), so it is
+      // judged as the repository file it would name.
+      const canonical = canonicalFileIdentity(targetPath);
+      const readable = await accessControl.canRead(
+        req.params.id,
+        user.email,
+        toKbRelative(canonical, kbDirName) ?? canonical,
+      );
+      if (!readable) {
+        res.status(403).json({ error: `You don't have permission to read "${targetPath}".` });
+        return;
+      }
       res.json({ lock: await workflow.getLock(req.params.id, branch, targetPath) });
     } catch (err) {
       const { status, body } = toHttpError(err);

package/src/modules/workflow/workflow.service.ts

@@ -542,7 +542,7 @@ export class WorkflowService implements IWorkflowService {
     // One line per deletion, whoever asked: the commit is what a restore
     // starts from, and for a deletion made in the app or by the cleanup this
     // line is the only trace there is.
-    // By id, never by address: log lines carry no email (the release's own promise).
+    // By id: log lines carry no email addresses.
     const actor = opts?.systemCleanup ? 'system' : user.id;
     log.info(`branch deleted by ${actor}: "${name}" at ${lastCommit ?? '(no commit)'}`);
     // Retire the deleted branch's own workspace clone, best-effort. A stale
@@ -629,6 +629,7 @@ export class WorkflowService implements IWorkflowService {
    */
   private async closeIfEmpty(
     number: number,
+    // `actor` is a user id or `system`, never an address: it goes into a log line.
     opts: { reason: string; actor: string; workspaceId?: string; fresh?: boolean },
   ): Promise<{ base: string } | null> {
     const summary = await this.prs.getPr(number);
@@ -3360,7 +3361,7 @@ export class WorkflowService implements IWorkflowService {
    * Returns true when THIS call closed it.
    */
   async closeEmptyChangeRequest(number: number, user: AuthUser): Promise<boolean> {
-    const closed = await this.closeIfEmpty(number, { reason: 'found empty', actor: user.email });
+    const closed = await this.closeIfEmpty(number, { reason: 'found empty', actor: user.id });
     if (!closed) return false;
     await this.retireMergedSourceBranch(number, closed.base, user);
     return true;

package/src/modules/workspace/__tests__/agent-downloads.test.ts

@@ -22,7 +22,6 @@ import { WorkflowHooks } from '../../workflow/workflow-hooks.js';
 import { ToolDescriptionNotes } from '../agent-access.gate.js';
 import { SpillStore } from '../spill-store.js';
 import { DocExtractService } from '../file-readers/doc-extract.service.js';
-import { WorkspaceService } from '../workspace.service.js';
 import { workspaceIdForBranch } from '../../../shared/workspace-id.js';
 import { AgentDownloadStore, DOWNLOAD_TOKEN_REFUSAL } from '../agent-download.store.js';
 import { attachmentDisposition, createAgentDownloadRoutes, createDownloadFetcherIdentifier } from '../agent-download.routes.js';
@@ -31,6 +30,7 @@ import jwt from 'jsonwebtoken';
 import { buildDownload, DOWNLOAD_PERMISSION_REQUIRED, NOT_FOUND } from '../agent-download.builder.js';
 import { READ_ONLY_CODE, type IWriteAccess } from '../../write-access/write-access.js';
 import { sharedFileRules } from '../../agent-instructions/shared-file-rules.js';
+import { newWorkspaceService } from '../../../__tests__/workspace-service.js';
 
 /**
  * `request_file_download` end to end, over the REAL access resolver on a
@@ -136,7 +136,7 @@ async function start(options: StartOptions = {}): Promise<Started> {
     await mkdir(dirname(abs), { recursive: true });
     await writeFile(abs, contents);
   }
-  const workspaceService = new WorkspaceService(
+  const workspaceService = newWorkspaceService(
     root,
     'https://example.invalid/kb.git',
     testKbContext({ kbDirName: KB }),

package/src/modules/workspace/__tests__/bounded-matcher.test.ts

@@ -0,0 +1,213 @@
+import { Worker } from 'node:worker_threads';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { WorkerPatternMatcher, type WorkerPatternMatcherOptions } from '../bounded-matcher.js';
+import { PatternTooExpensiveError } from '../pattern-matcher.contract.js';
+
+/** The QA finding's pattern, and a 40-character line it backtracks on for ever. */
+const CATASTROPHIC = '^(a+)+$';
+const LONG_LINE = `${'a'.repeat(39)}!`;
+/** The ticket's per-search budget (Razvan, 2026-10-15). */
+const FIVE_SECONDS = 5_000;
+
+let matchers: WorkerPatternMatcher[] = [];
+/** A matcher of the test's own, closed after it — the defaults unless a test says otherwise. */
+function matcher(opts?: WorkerPatternMatcherOptions): WorkerPatternMatcher {
+  const m = new WorkerPatternMatcher(opts);
+  matchers.push(m);
+  return m;
+}
+afterEach(async () => {
+  await Promise.all(matchers.map((m) => m.close()));
+  matchers = [];
+});
+
+/**
+ * The longest the event loop went without running a timer while `work` ran.
+ * A pattern run on the loop would show the whole match time here.
+ */
+async function longestStall(work: () => Promise<unknown>): Promise<number> {
+  let last = Date.now();
+  let worst = 0;
+  const tick = setInterval(() => {
+    const now = Date.now();
+    worst = Math.max(worst, now - last);
+    last = now;
+  }, 10);
+  try {
+    await work().catch(() => {});
+  } finally {
+    clearInterval(tick);
+  }
+  return Math.max(worst, Date.now() - last);
+}
+
+describe('WorkerPatternMatcher', () => {
+  it('stops a catastrophic pattern over a 40-character line with the worded 400 in its 5 s budget, and never stalls the loop', async () => {
+    expect(LONG_LINE).toHaveLength(40);
+    const started = Date.now();
+    let caught: unknown;
+    const stall = await longestStall(async () => {
+      try {
+        await matcher().search(CATASTROPHIC, '').matchingLines([LONG_LINE], 200);
+      } catch (err) {
+        caught = err;
+      }
+    });
+    const took = Date.now() - started;
+    expect(caught).toBeInstanceOf(PatternTooExpensiveError);
+    expect((caught as PatternTooExpensiveError).status).toBe(400);
+    expect((caught as Error).message).toMatch(/^Pattern too expensive: /);
+    expect((caught as Error).message).toContain('simpler pattern');
+    expect((caught as Error).message).toContain("this search's 5 s budget");
+    expect(took).toBeGreaterThanOrEqual(FIVE_SECONDS - 100);
+    expect(took).toBeLessThan(FIVE_SECONDS + 2_000);
+    expect(stall).toBeLessThan(500);
+  });
+
+  it('answers ordinary patterns with exactly the lines RegExp#test matches', async () => {
+    const m = matcher();
+    const lines = ['hello world', 'Getting started', 'aaa', 'line 42', '', 'foo|bar', 'bar baz', LONG_LINE];
+    for (const [source, flags] of [
+      ['world', ''],
+      ['^aaa$', ''],
+      ['getting started', 'i'],
+      ['[0-9]+', ''],
+      ['foo|baz', ''],
+      ['^$', ''],
+      ['a+!$', ''],
+    ] as const) {
+      const re = new RegExp(source, flags);
+      const expected = lines.flatMap((l, i) => (re.test(l) ? [i] : []));
+      expect(await m.search(source, flags).matchingLines(lines, 1000), `/${source}/${flags}`).toEqual(expected);
+    }
+  });
+
+  it('returns only the first `limit` matches', async () => {
+    expect(await matcher().search('x', '').matchingLines(['x', 'y', 'x', 'x'], 2)).toEqual([0, 2]);
+  });
+
+  it('refuses a sizing that could never serve a search when it is built, not when a search hangs on it', () => {
+    expect(() => new WorkerPatternMatcher({ poolMax: 0 })).toThrow(/poolMax must be an integer from 1 /);
+    // Past the longest delay setTimeout honours, the timer would fire after 1 ms and stop every search.
+    expect(() => new WorkerPatternMatcher({ budgetMs: 2_147_483_647 })).toThrow(/budgetMs must be an integer from 1 to 2147483397/);
+    expect(() => new WorkerPatternMatcher({ poolMax: 1.5 })).toThrow(RangeError);
+    expect(() => new WorkerPatternMatcher({ budgetMs: 0 })).toThrow(/budgetMs/);
+    expect(() => new WorkerPatternMatcher({ maxWaiting: -1 })).toThrow(/maxWaiting/);
+    expect(() => new WorkerPatternMatcher({ batchChars: Number.NaN })).toThrow(/batchChars/);
+    expect(() => new WorkerPatternMatcher({ batchLines: 0 })).toThrow(/batchLines/);
+    expect(() => matcher({ maxWaiting: 0 })).not.toThrow();
+  });
+
+  it('serves an ordinary search under the largest budget the timer can hold', async () => {
+    expect(await matcher({ budgetMs: 2_147_483_647 - 250 }).search('b', '').matchingLines(['a', 'b'], 10)).toEqual([1]);
+  });
+
+  it('refuses invalid syntax with the 400 grep always gave', () => {
+    expect(() => matcher().search('(', '')).toThrow(/^Invalid regex: /);
+  });
+
+  it('refuses a pattern too long to compile on the request thread, and accepts one at the limit', () => {
+    const m = matcher({ maxPatternLength: 10 });
+    expect(() => m.search('a'.repeat(11), '')).toThrow(/^Pattern too long: /);
+    expect(() => m.search('a'.repeat(10), '')).not.toThrow();
+  });
+
+  it('hands a large file over in batches and answers the same line numbers, up to `limit`', async () => {
+    const m = matcher({ batchChars: 100 });
+    const filler = 'x'.repeat(9);
+    const lines = Array.from({ length: 250 }, (_, i) => (i % 7 === 0 ? `hit ${i}` : filler));
+    const expected = lines.flatMap((l, i) => (l.startsWith('hit') ? [i] : []));
+    expect(expected.at(-1)! * filler.length).toBeGreaterThan(200);
+    expect(await m.search('^hit', '').matchingLines(lines, 10_000)).toEqual(expected);
+    expect(await m.search('^hit', '').matchingLines(lines, 3)).toEqual(expected.slice(0, 3));
+  });
+
+  it('caps a batch by its line count too, so a file of empty lines never goes over in one message', async () => {
+    const m = matcher({ batchLines: 100 });
+    const lines = Array.from({ length: 1_050 }, (_, i) => (i % 97 === 0 ? 'hit' : ''));
+    const expected = lines.flatMap((l, i) => (l === 'hit' ? [i] : []));
+    const posted = vi.spyOn(Worker.prototype, 'postMessage');
+    try {
+      expect(await m.search('^hit$', '').matchingLines(lines, 10_000)).toEqual(expected);
+      expect(await m.search('^$', '').matchingLines(lines, 10_000)).toHaveLength(lines.length - expected.length);
+      const postedLines = posted.mock.calls.map(([msg]) => ((msg as { lines?: string[] }).lines ?? []).length);
+      expect(postedLines.filter((n) => n > 0)).toHaveLength(2 * 11);
+      expect(Math.max(...postedLines)).toBeLessThanOrEqual(100);
+    } finally {
+      posted.mockRestore();
+    }
+  });
+
+  it('hands a line longer than one batch over in shared memory, never in a message, and matches it exactly', async () => {
+    const m = matcher({ batchChars: 100 });
+    // A lone surrogate included: the line must reach the worker code unit for code unit.
+    const long = `${'x'.repeat(1_000)}\uD800 tail ${'y'.repeat(500)}`;
+    const lines = ['short', long, 'z'.repeat(400), 'end tail'];
+    const posted = vi.spyOn(Worker.prototype, 'postMessage');
+    try {
+      for (const pattern of ['tail', '\\uD800 tail', '^x+\\uD800', 'y{500}$', '^z+$', 'nowhere']) {
+        const re = new RegExp(pattern);
+        const expected = lines.flatMap((l, i) => (re.test(l) ? [i] : []));
+        expect(await m.search(pattern, '').matchingLines(lines, 10_000)).toEqual(expected);
+      }
+      const postedChars = posted.mock.calls.map(([msg]) =>
+        ((msg as { lines?: string[] }).lines ?? []).reduce((n, l) => n + l.length, 0),
+      );
+      expect(postedChars.length).toBeGreaterThan(0);
+      expect(Math.max(...postedChars)).toBeLessThanOrEqual(100);
+    } finally {
+      posted.mockRestore();
+    }
+  });
+
+  it('refuses a search with 503 once the queue for a worker is full, rather than holding its lines', async () => {
+    const m = matcher({ budgetMs: 500, poolMax: 2, maxWaiting: 2 });
+    // Every worker held by a pattern that runs out its budget, the queue filled behind them.
+    const holding = Promise.allSettled(Array.from({ length: 2 }, () => m.search(CATASTROPHIC, '').matchingLines([LONG_LINE], 1)));
+    await new Promise((r) => setTimeout(r, 100));
+    const queued = Array.from({ length: 2 }, () => m.search('b', '').matchingLines(['b'], 1));
+    await expect(m.search('b', '').matchingLines(['b'], 1)).rejects.toMatchObject({
+      status: 503,
+      details: { code: 'search_busy' },
+    });
+    // The queued searches are served once the workers come free.
+    expect(await Promise.all(queued)).toEqual(queued.map(() => [0]));
+    expect((await holding).every((r) => r.status === 'rejected')).toBe(true);
+  });
+
+  it('stops two expensive searches at once, and a search started meanwhile still answers', async () => {
+    const m = matcher({ budgetMs: 500 });
+    const results = await Promise.allSettled([
+      m.search(CATASTROPHIC, '').matchingLines([LONG_LINE], 10),
+      m.search('(a|aa)+$', '').matchingLines([`${'a'.repeat(60)}!`], 10),
+      m.search('aaa', '').matchingLines(['xaaay'], 10),
+    ]);
+    expect(results[0]).toMatchObject({ status: 'rejected', reason: expect.any(PatternTooExpensiveError) });
+    expect(results[1]).toMatchObject({ status: 'rejected', reason: expect.any(PatternTooExpensiveError) });
+    expect(results[2]).toEqual({ status: 'fulfilled', value: [0] });
+    // The terminated workers were replaced: the pool still serves.
+    expect(await m.search('b', '').matchingLines(['a', 'b'], 10)).toEqual([1]);
+  });
+
+  it('ends its workers on close: a search running then, and one after, is answered busy', async () => {
+    const m = matcher();
+    const running = m.search(CATASTROPHIC, '').matchingLines([LONG_LINE], 1);
+    await new Promise((r) => setTimeout(r, 100));
+    const started = Date.now();
+    await m.close();
+    await expect(running).rejects.toMatchObject({ status: 503, details: { code: 'search_busy' } });
+    expect(Date.now() - started).toBeLessThan(1_000);
+    await expect(m.search('b', '').matchingLines(['b'], 1)).rejects.toMatchObject({ status: 503 });
+  });
+
+  it('answers busy at once when closed while a long line is still being written to shared memory', async () => {
+    // A line of a million characters written ten at a time: many turns of the loop to close in.
+    const m = matcher({ budgetMs: 3_000, batchChars: 10 });
+    const running = m.search('nowhere', '').matchingLines(['a'.repeat(1_000_000)], 1);
+    await new Promise((r) => setTimeout(r, 20));
+    const started = Date.now();
+    await m.close();
+    await expect(running).rejects.toMatchObject({ status: 503, details: { code: 'search_busy' } });
+    expect(Date.now() - started).toBeLessThan(1_000);
+  });
+});

package/src/modules/workspace/__tests__/git-internals.security.test.ts

@@ -5,7 +5,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import AdmZip from 'adm-zip';
 import express from 'express';
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { afterEach, beforeEach, describe, expect, it, vi, afterAll } from 'vitest';
 import { testKbContext } from '../../../__tests__/kb-context.js';
 import type { IWorkflowService } from '@bevel-software/platform-shared';
 import { GIT_INTERNALS_MESSAGE, GitInternalsError } from '../../../shared/domain-errors.js';
@@ -35,6 +35,12 @@ import { createDiffRoutes } from '../../diff/diff.routes.js';
 import { DiffService } from '../../diff/diff.service.js';
 import { WorkspaceMutex } from '../../kb-fs/mutex.js';
 import { WorkspaceService } from '../workspace.service.js';
+import { WorkerPatternMatcher } from '../bounded-matcher.js';
+import { newWorkspaceService } from '../../../__tests__/workspace-service.js';
+
+/** The grep matcher this file's harness wires, closed once the file is done. */
+const patternMatcher = new WorkerPatternMatcher();
+afterAll(() => patternMatcher.close());
 
 /**
  * Security regression: the repository's internal git folder is unreachable
@@ -244,7 +250,7 @@ describe('workspace tools refuse the git folder', () => {
 
   beforeEach(async () => {
     workflow = makeWorkflow();
-    const service = new WorkspaceService(root, 'https://example.invalid/kb.git', testKbContext({ kbDirName: KB }), new NodeFs());
+    const service = newWorkspaceService(root, 'https://example.invalid/kb.git', testKbContext({ kbDirName: KB }), new NodeFs());
     unzipSpy = vi.spyOn(service, 'unzipFile');
     bootstrappedSpy = vi.spyOn(service, 'hasBootstrappedWorkspace');
     const lockingFs = new LockingFilesystem(
@@ -282,6 +288,15 @@ describe('workspace tools refuse the git folder', () => {
       { recoveryBotEmail: 'recovery-bot@bevel.local', hooks: new WorkflowHooks(), notes: new ToolDescriptionNotes() },
       new RoutineWritePolicyService(),
       {} as never,
+      // Skill check, change gate, uploads, guide, downloads, starter packs, disk: not this harness's business.
+      undefined,
+      undefined,
+      undefined,
+      undefined,
+      undefined,
+      undefined,
+      undefined,
+      patternMatcher,
     );
     app.use('/api', router);
     ({ server, baseUrl } = await listen(app));
@@ -419,7 +434,7 @@ describe('workspace routes refuse the git folder', () => {
 
   beforeEach(async () => {
     workflow = makeWorkflow();
-    service = new WorkspaceService(root, 'https://example.invalid/kb.git', testKbContext({ kbDirName: KB }), new NodeFs());
+    service = newWorkspaceService(root, 'https://example.invalid/kb.git', testKbContext({ kbDirName: KB }), new NodeFs());
     const app = express();
     app.use(express.json());
     app.use('/api', (req, _res, next) => {
@@ -566,7 +581,7 @@ describe('WorkspaceService refuses the git folder on its own', () => {
   let service: WorkspaceService;
 
   beforeEach(() => {
-    service = new WorkspaceService(root, 'https://example.invalid/kb.git', testKbContext({ kbDirName: KB }), new NodeFs());
+    service = newWorkspaceService(root, 'https://example.invalid/kb.git', testKbContext({ kbDirName: KB }), new NodeFs());
   });
 
   afterEach(async () => {
@@ -623,7 +638,7 @@ describe('WorkspaceService refuses the git folder on its own', () => {
         return { stdout: '.git\n', stderr: '', code: 0 };
       }),
     };
-    const refService = new WorkspaceService(root, 'https://example.invalid/kb.git', testKbContext({ kbDirName: KB }), new NodeFs(), gitRunner as never);
+    const refService = newWorkspaceService(root, 'https://example.invalid/kb.git', testKbContext({ kbDirName: KB }), new NodeFs(), gitRunner as never);
 
     for (const [form, raw] of Object.entries(fileForms('config'))) {
       if (!form.startsWith('symlinked')) continue;
@@ -679,7 +694,7 @@ describe('the route guard on its own', () => {
   beforeEach(async () => {
     reached = 0;
     userId = USER.id;
-    const service = new WorkspaceService(root, 'https://example.invalid/kb.git', testKbContext({ kbDirName: KB }), new NodeFs());
+    const service = newWorkspaceService(root, 'https://example.invalid/kb.git', testKbContext({ kbDirName: KB }), new NodeFs());
     const app = express();
     // The server's own order: the guard ahead of the body parser, then again
     // on the parsed body, then again once the caller is known.
@@ -779,7 +794,7 @@ describe('DiffService refuses the git folder on its own', () => {
   let diffService: DiffService;
 
   beforeEach(() => {
-    const service = new WorkspaceService(root, 'https://example.invalid/kb.git', testKbContext({ kbDirName: KB }), new NodeFs());
+    const service = newWorkspaceService(root, 'https://example.invalid/kb.git', testKbContext({ kbDirName: KB }), new NodeFs());
     diffService = new DiffService(service, new WorkspaceMutex(), root, join(root, 'backups'), KB, new NodeFs());
   });