@bevel-software/platform-core-backend 0.32.0 → 0.33.0

package/src/modules/workflow/agent-tools/__tests__/change-request-read-shape.test.ts

@@ -1,12 +1,11 @@
 import { describe, expect, it } from 'vitest';
-import type {
-  ChangeRequest,
-  ChangeRequestDetail,
-  FileApproval,
+import {
+  type ChangeRequest,
+  type ChangeRequestDetail,
+  type FileApproval,
 } from '@bevel-software/platform-shared';
 import { hashEmail } from '../../../../shared/email-identity.js';
 import {
-  authorsDescription,
   fileIsReadable,
   isAuthor,
   loginFor,
@@ -16,11 +15,10 @@ import {
   pagingOf,
   pathsOf,
   statesFor,
+  toCrDetail,
   toCrViewer,
   toCrSummary,
   APPLY_FAILURE_REASON_WITHHELD,
-  visibleComments,
-  toCrComment,
   toCrFile,
   toCrReviews,
   visibleBlockers,
@@ -373,56 +371,6 @@ describe('reviews, gathered out of the per-file approvals', () => {
   });
 });
 
-describe('comments', () => {
-  // Scenario: WHEN a reviewer left an inline comment and a reply followed THEN
-  // `list_change_request_comments` returns both, the reply with `parentId`.
-  it('maps an inline comment and a reply, the reply carrying `parentId`', () => {
-    const inline = toCrComment({
-      id: 'c-1',
-      author: { email: 'mia@bevel.software', name: 'Mia' },
-      body: 'This line is out of date.',
-      path: 'Knowledge/A.md',
-      line: 14,
-      headSha: 'head-1',
-      createdAt: '2026-09-29T08:00:00.000Z',
-    });
-    expect(inline).toEqual({
-      id: 'c-1',
-      author: { login: loginFor('mia@bevel.software'), name: 'Mia', email: 'mia@bevel.software' },
-      body: 'This line is out of date.',
-      path: 'Knowledge/A.md',
-      line: 14,
-      headSha: 'head-1',
-      createdAt: '2026-09-29T08:00:00.000Z',
-    });
-    const reply = toCrComment({
-      id: 'c-2',
-      author: { email: AUTHOR, name: 'Juan' },
-      body: 'Fixed.',
-      path: 'Knowledge/A.md',
-      line: 14,
-      headSha: 'head-1',
-      parentId: 'c-1',
-      createdAt: '2026-09-29T09:00:00.000Z',
-      updatedAt: '2026-09-29T09:05:00.000Z',
-    });
-    expect(reply).toMatchObject({ parentId: 'c-1', updatedAt: '2026-09-29T09:05:00.000Z' });
-  });
-
-  it('leaves `path`, `line` and `parentId` off a general comment', () => {
-    const general = toCrComment({
-      id: 'c-3',
-      author: { email: AUTHOR, name: 'Juan' },
-      body: 'Ready for review.',
-      headSha: 'head-1',
-      createdAt: '2026-09-29T07:00:00.000Z',
-    });
-    expect(general.path).toBeUndefined();
-    expect(general.line).toBeUndefined();
-    expect(general.parentId).toBeUndefined();
-  });
-});
-
 describe('the viewer block — what this caller may do', () => {
   const detail = (over: Partial<ChangeRequestDetail> = {}) =>
     ({
@@ -520,71 +468,34 @@ describe('merge blockers never name a file the caller may not read', () => {
 });
 
 /**
- * The leak Local Testing caught on the first attempt: `openChangeRequest`
- * appends a generated `## Affected owners` block to the body, naming every
- * changed path and its approvers, and the detail returned the body verbatim.
+ * The body is the description and nothing else — Hexis writes none of its own
+ * facts into it — so a caller is handed it verbatim, whatever they may read:
+ * a path in it is one the author chose to write about.
  */
-describe('the body a caller is handed is the author\'s, not the machine\'s', () => {
-  const GENERATED = [
-    '## Affected owners',
-    '',
-    '- `KnowledgeBase/Engineering/Knowledge/Avi-Checkin.md` — Admin',
-    '- `KnowledgeBase/GTM/Notes.md` — GTM Team',
-  ].join('\n');
-
-  it('drops the generated owners block, keeping what the author typed', () => {
-    expect(authorsDescription(`Please take a look.\n\n${GENERATED}`)).toBe('Please take a look.');
-    expect(authorsDescription(GENERATED)).toBe('');
-  });
-
-  it('names no path of the generated block, readable or not', () => {
-    const out = authorsDescription(`Why this is needed.\n\n${GENERATED}`);
-    expect(out).not.toContain('Avi-Checkin');
-    expect(out).not.toContain('KnowledgeBase');
-    expect(out).not.toContain('Affected owners');
-  });
-
-  it("strips the hidden identity markers older bodies carry, and only those — an author's own HTML comment is prose", () => {
-    expect(authorsDescription('<!-- bevel:author:abc123 -->\nMy reason.')).toBe('My reason.');
-    expect(authorsDescription('<!--hexis:access-request-level:write-->\nMy reason.')).toBe('My reason.');
-    expect(authorsDescription('My reason.\n<!-- TODO: ask Mia about the title -->')).toBe(
-      'My reason.\n<!-- TODO: ask Mia about the title -->',
-    );
-  });
-
-  it('leaves a body that is only the author\'s prose alone', () => {
-    expect(authorsDescription('  A multi-line\nreason.  ')).toBe('A multi-line\nreason.');
-    expect(authorsDescription('')).toBe('');
-  });
-
-  // Razvan's review (2026-10-02): the first cut copied the app's dialog, which
-  // drops everything from the first `##` heading on. An author who writes their
-  // description in sections lost it from that heading onwards, and was never
-  // told. The cut is now the generated block and nothing else.
-  it("keeps the author's own headings, and everything under them", () => {
-    expect(authorsDescription('Lead.\n\n## My own heading\n\nmore')).toBe(
-      'Lead.\n\n## My own heading\n\nmore',
-    );
-    expect(authorsDescription(`Lead.\n\n## Why now\n\nBecause.\n\n${GENERATED}`)).toBe(
-      'Lead.\n\n## Why now\n\nBecause.',
-    );
-  });
-
-  // Hexis appends the block LAST, so the last such line is always the generated
-  // one — which is what makes an author who happens to use that heading
-  // themselves no worse off than before.
-  it('cuts the LAST such heading, so an author may use the words too', () => {
-    const out = authorsDescription(`Lead.\n\n## Affected owners\n\nI mean the GTM ones.\n\n${GENERATED}`);
-    expect(out).toBe('Lead.\n\n## Affected owners\n\nI mean the GTM ones.');
-    // Their sentence is kept; not one path of the generated block is.
-    expect(out).not.toContain('Avi-Checkin');
-    expect(out).not.toContain('KnowledgeBase');
-  });
-
-  it('cuts an author\'s own owners heading when there is no generated block', () => {
-    // Indistinguishable from the generated one with nothing after it, so it is
-    // cut — the safe direction, and the only way this can err.
-    expect(authorsDescription('Lead.\n\n## Affected owners\n\nI mean the GTM ones.')).toBe('Lead.');
+describe('the body a caller is handed is the stored one', () => {
+  const body = 'Lead.\n\n## Why now\n\nBecause of `Knowledge/Secret.md`.\n<!-- my own aside -->';
+  const stored = {
+    ...summary(),
+    body,
+    headSha: 'a'.repeat(40),
+    baseSha: 'b'.repeat(40),
+    files: [],
+    approvals: [],
+    mergeableInBevel: false,
+    mergeBlockedReasons: [],
+    mergeWarnings: [],
+    viewerCanBypassMerge: false,
+  } as unknown as ChangeRequestDetail;
+
+  it('is the body as stored, headings and comments included', () => {
+    const out = toCrDetail(stored, { readable: 1, withheld: 0 }, { visible: [], withheld: 0 }, toCrViewer(stored, false, []));
+    expect(out.body).toBe(body);
+  });
+
+  it('does not vary by what the caller may read', () => {
+    const forReader = toCrDetail(stored, { readable: 0, withheld: 1 }, { visible: [], withheld: 1 }, toCrViewer(stored, false, []));
+    const forAuthor = toCrDetail(stored, { readable: 1, withheld: 0 }, { visible: [], withheld: 0 }, toCrViewer(stored, true, []));
+    expect(forReader.body).toBe(forAuthor.body);
   });
 });
 
@@ -615,91 +526,3 @@ describe('a renamed file is judged on both of its names', () => {
     expect(pathsOf({ path: 'A.md' })).toEqual(['A.md']);
   });
 });
-
-/**
- * A reply is shown only when the comment it replies to is (Razvan's review,
- * 2026-10-02, finding 3). A reply posted without a path of its own — which
- * `post_change_request_comment` accepts, taking `parentId` without `path` — read
- * as a general comment when judged on itself, so a reply to a comment on a
- * withheld file came back with its body and a `parentId` naming a comment the
- * caller cannot see.
- */
-describe('a reply takes its parent\'s verdict, up the chain', () => {
-  const c = (id: string, over: { path?: string; parentId?: string } = {}) => ({ id, ...over });
-  const mayShow = (path: string) => path.startsWith('Open/');
-
-  it('withholds a pathless reply to a comment on a file the caller may not read', () => {
-    const { visible, withheld } = visibleComments(
-      [c('c-1', { path: 'Secret/Pay.md' }), c('c-2', { parentId: 'c-1' })],
-      mayShow,
-    );
-    expect(visible).toEqual([]);
-    expect(withheld).toBe(2);
-  });
-
-  it('withholds a reply to that reply, however deep the thread goes', () => {
-    const { visible, withheld } = visibleComments(
-      [
-        c('c-1', { path: 'Secret/Pay.md' }),
-        c('c-2', { parentId: 'c-1' }),
-        c('c-3', { parentId: 'c-2' }),
-        c('c-4', { parentId: 'c-3' }),
-      ],
-      mayShow,
-    );
-    expect(visible).toEqual([]);
-    expect(withheld).toBe(4);
-  });
-
-  it('keeps a reply whose whole chain is readable', () => {
-    const { visible, withheld } = visibleComments(
-      [c('c-1', { path: 'Open/A.md' }), c('c-2', { parentId: 'c-1' }), c('c-3', { parentId: 'c-2' })],
-      mayShow,
-    );
-    expect(visible.map((v) => v.id)).toEqual(['c-1', 'c-2', 'c-3']);
-    expect(withheld).toBe(0);
-  });
-
-  // Both halves of the rule are needed, and this is the half the inheritance
-  // alone would miss: the reply names a withheld file itself.
-  it('withholds a reply that names a withheld file under a readable parent', () => {
-    const { visible } = visibleComments(
-      [c('c-1', { path: 'Open/A.md' }), c('c-2', { path: 'Secret/Pay.md', parentId: 'c-1' })],
-      mayShow,
-    );
-    expect(visible.map((v) => v.id)).toEqual(['c-1']);
-  });
-
-  it('keeps a general comment and a reply to one — neither is about a file', () => {
-    const { visible, withheld } = visibleComments([c('c-1'), c('c-2', { parentId: 'c-1' })], mayShow);
-    expect(visible.map((v) => v.id)).toEqual(['c-1', 'c-2']);
-    expect(withheld).toBe(0);
-  });
-
-  it('withholds a reply whose parent is not in the list at all', () => {
-    // Not provably pathless, so it goes: the parent may have been anchored to
-    // anything, including a file this caller was refused.
-    const { visible, withheld } = visibleComments([c('c-2', { parentId: 'gone' })], mayShow);
-    expect(visible).toEqual([]);
-    expect(withheld).toBe(1);
-  });
-
-  it('withholds a cycle rather than looping on it', () => {
-    const { visible, withheld } = visibleComments(
-      [c('c-1', { parentId: 'c-2' }), c('c-2', { parentId: 'c-1' })],
-      mayShow,
-    );
-    expect(visible).toEqual([]);
-    expect(withheld).toBe(2);
-  });
-
-  it('resolves a long thread without re-walking it per reply', () => {
-    // 500 replies in one chain: memoised, this is linear; unmemoised it is
-    // quadratic and the suite would feel it.
-    const chain = [c('c-0', { path: 'Open/A.md' })];
-    for (let i = 1; i <= 500; i++) chain.push(c(`c-${i}`, { parentId: `c-${i - 1}` }));
-    const { visible, withheld } = visibleComments(chain, mayShow);
-    expect(visible).toHaveLength(501);
-    expect(withheld).toBe(0);
-  });
-});

package/src/modules/workflow/agent-tools/__tests__/change-request-read.tools.test.ts

@@ -3,7 +3,6 @@ import express from 'express';
 import { afterEach, beforeEach, describe, expect, it } from 'vitest';
 import type {
   ChangeRequest,
-  ChangeRequestComment,
   ChangeRequestDetail,
   ChangeRequestState,
   ChangedFile,
@@ -28,7 +27,6 @@ const TOOLS = [
   'get_change_request',
   'list_change_request_files',
   'list_change_request_reviews',
-  'list_change_request_comments',
 ] as const;
 
 // ── The world each test sets up ─────────────────────────────────────────────
@@ -69,18 +67,6 @@ function approval(path: string, over: Partial<FileApproval> = {}): FileApproval
   };
 }
 
-/** A comment as the detail carries one. Module-level: the rename suite needs it too. */
-function comment(over: Partial<ChangeRequestComment>): ChangeRequestComment {
-  return {
-    id: 'c-1',
-    author: { email: VIEWER, name: 'Mia' },
-    body: 'This line is out of date.',
-    headSha: 'head-1',
-    createdAt: '2026-09-29T08:00:00.000Z',
-    ...over,
-  };
-}
-
 function approvedBy(email: string, name: string, at: string, isStale = false) {
   return { email, name, approvedAt: at, isStale, isSelfApproval: false };
 }
@@ -126,7 +112,6 @@ function detail(over: Partial<ChangeRequestDetail> = {}): ChangeRequestDetail {
     headSha: 'head-1',
     baseSha: 'base-1',
     files,
-    comments: [],
     approvals: files.map((f) => approval(f.path)),
     mergeableInBevel: false,
     mergeBlockedReasons: [],
@@ -274,7 +259,7 @@ afterEach(async () => {
 
 // ── The catalog ─────────────────────────────────────────────────────────────
 
-describe('the five read tools', () => {
+describe('the four read tools', () => {
   it('are all registered, on both surfaces, by their GitHub-counterpart names', async () => {
     await start();
     const internal = (await registryRef!.listInternal()).map((t) => t.name);
@@ -285,6 +270,15 @@ describe('the five read tools', () => {
     }
   });
 
+  // Change-request comments were removed (no screen ever showed one), and the
+  // tool that listed them went with them.
+  it('offers no comment tool on either surface', async () => {
+    await start();
+    for (const list of [await registryRef!.listInternal(), await registryRef!.listExternal()]) {
+      expect(list.map((t) => t.name).filter((n) => n.includes('comment'))).toEqual([]);
+    }
+  });
+
   // "None of the tools changes anything." A `write`-tagged tool is refused to
   // read-scoped callers; these must carry no such tag, because none writes.
   it('carry no `write` tag, so a read-scoped caller may use every one', async () => {
@@ -891,123 +885,13 @@ describe('list_change_request_reviews', () => {
   });
 });
 
-// ── Scenario: comments ──────────────────────────────────────────────────────
-
-describe('list_change_request_comments', () => {
-  // WHEN a reviewer left an inline comment and a reply followed THEN
-  // `list_change_request_comments` returns both, the reply with `parentId`.
-  it('returns the inline comment and its reply, the reply carrying parentId', async () => {
-    const base = await start();
-    details.set(
-      12,
-      detail({
-        comments: [
-          comment({ id: 'c-1', path: 'Knowledge/A.md', line: 14 }),
-          comment({
-            id: 'c-2',
-            author: { email: AUTHOR, name: 'Juan' },
-            body: 'Fixed.',
-            path: 'Knowledge/A.md',
-            line: 14,
-            parentId: 'c-1',
-            createdAt: '2026-09-29T09:00:00.000Z',
-          }),
-        ],
-      }),
-    );
-    const { status, json } = await call(base, 'list_change_request_comments', { number: 12 });
-    expect(status).toBe(200);
-    expect(json.comments).toHaveLength(2);
-    expect(json.comments[0]).toMatchObject({
-      id: 'c-1',
-      author: { name: 'Mia', email: VIEWER },
-      body: 'This line is out of date.',
-      path: 'Knowledge/A.md',
-      line: 14,
-      headSha: 'head-1',
-      createdAt: '2026-09-29T08:00:00.000Z',
-    });
-    expect(json.comments[1]).toMatchObject({ id: 'c-2', parentId: 'c-1' });
-    expect(json.withheldComments).toBe(0);
-  });
-
-  it('keeps a general comment, which belongs to the request rather than a file', async () => {
-    const base = await start();
-    details.set(12, detail({ comments: [comment({ id: 'c-9', body: 'Ready for review.' })] }));
-    const { json } = await call(base, 'list_change_request_comments', { number: 12 });
-    expect(json.comments).toHaveLength(1);
-    expect((json.comments as unknown as { path?: string }[])[0].path).toBeUndefined();
-  });
-
-  it('leaves out a comment on a file the caller may not read, and counts it', async () => {
-    const base = await start();
-    readable = ['Knowledge/A.md'];
-    details.set(
-      12,
-      detail({
-        files: [file('Knowledge/A.md'), file('Payroll/Rates.md')],
-        comments: [
-          comment({ id: 'c-1', path: 'Knowledge/A.md', line: 1 }),
-          comment({ id: 'c-2', path: 'Payroll/Rates.md', line: 2, body: 'The band is wrong.' }),
-        ],
-      }),
-    );
-    const { json } = await call(base, 'list_change_request_comments', { number: 12 });
-    expect((json.comments as unknown as { id: string }[]).map((c) => c.id)).toEqual(['c-1']);
-    expect(json.withheldComments).toBe(1);
-    expect(JSON.stringify(json)).not.toContain('Payroll');
-    expect(JSON.stringify(json)).not.toContain('band is wrong');
-  });
-
-  it('keeps a comment on a file the request no longer changes but the caller may read', async () => {
-    const base = await start();
-    readable = ['Knowledge/A.md', 'Knowledge/Gone.md'];
-    details.set(12, detail({ comments: [comment({ id: 'c-7', path: 'Knowledge/Gone.md', line: 3 })] }));
-    const { json } = await call(base, 'list_change_request_comments', { number: 12 });
-    expect((json.comments as unknown as { id: string }[]).map((c) => c.id)).toEqual(['c-7']);
-    expect(json.withheldComments).toBe(0);
-  });
-
-  it('pages the comments', async () => {
-    const base = await start();
-    details.set(
-      12,
-      detail({
-        comments: Array.from({ length: 40 }, (_, i) =>
-          comment({ id: `c-${i}`, createdAt: `2026-09-29T08:00:${String(i).padStart(2, '0')}.000Z` }),
-        ),
-      }),
-    );
-    const first = await call(base, 'list_change_request_comments', { number: 12 });
-    expect(first.json.comments).toHaveLength(30);
-    expect(first.json.hasNextPage).toBe(true);
-    const second = await call(base, 'list_change_request_comments', { number: 12, page: 2 });
-    expect(second.json.comments).toHaveLength(10);
-    expect(second.json.hasNextPage).toBe(false);
-  });
-
-  it('answers not found when the caller may read none of its files', async () => {
-    const base = await start();
-    readable = [];
-    details.set(12, detail({ comments: [comment({ id: 'c-1' })] }));
-    expect((await call(base, 'list_change_request_comments', { number: 12 })).status).toBe(404);
-  });
-});
-
 /**
  * Reproductions of what Local Testing found on sha ae2f49d9, through the HTTP
  * tool surface it found them on — not just the pure mapper underneath.
  */
 describe('a mixed-access caller is never handed a path they may not read', () => {
-  /** A body exactly as `openChangeRequest` builds it: prose, then the block. */
-  const bodyWithOwnersBlock = [
-    'Please review the check-in note.',
-    '',
-    '## Affected owners',
-    '',
-    '- `KnowledgeBase/Engineering/Knowledge/Avi-Checkin.md` — Admin',
-    '- `KnowledgeBase/GTM/Notes.md` — GTM Team',
-  ].join('\n');
+  /** A body as `openChangeRequest` stores it: the description, nothing else. */
+  const body = 'Please review the check-in note.';
 
   /** The reader of one folder of a two-folder request — john.newcomer's case. */
   function mixedAccessRequest(): void {
@@ -1020,7 +904,7 @@ describe('a mixed-access caller is never handed a path they may not read', () =>
       1,
       detail({
         number: 1,
-        body: bodyWithOwnersBlock,
+        body,
         files: [
           file('KnowledgeBase/Engineering/Knowledge/Avi-Checkin.md'),
           file('KnowledgeBase/GTM/Notes.md'),
@@ -1039,7 +923,7 @@ describe('a mixed-access caller is never handed a path they may not read', () =>
     );
   }
 
-  it('get_change_request answers the author\'s reason and names no withheld file anywhere', async () => {
+  it('get_change_request answers the description and names no withheld file anywhere', async () => {
     const base = await start();
     mixedAccessRequest();
     const { status, json } = await call(base, 'get_change_request', { number: 1 });
@@ -1054,13 +938,12 @@ describe('a mixed-access caller is never handed a path they may not read', () =>
     const whole = JSON.stringify(json);
     expect(whole).not.toContain('Avi-Checkin');
     expect(whole).not.toContain('KnowledgeBase/Engineering');
-    expect(whole).not.toContain('Affected owners');
     // The file they CAN read is still named, and its blocker still readable.
     expect(whole).toContain('KnowledgeBase/GTM/Notes.md');
     expect(json).toMatchObject({ withheldMergeBlockedReasons: 1 });
   });
 
-  it('no tool of the five names the withheld file, in any field', async () => {
+  it('no tool of the four names the withheld file, in any field', async () => {
     const base = await start();
     mixedAccessRequest();
     summaries = [details.get(1)!];
@@ -1081,7 +964,7 @@ describe('a mixed-access caller is never handed a path they may not read', () =>
     }
   });
 
-  it('the author sees their own body too — the cut is the same for everyone', async () => {
+  it('the author is handed the same body — one body for everyone', async () => {
     const base = await start();
     mixedAccessRequest();
     callerEmail = AUTHOR;
@@ -1090,14 +973,11 @@ describe('a mixed-access caller is never handed a path they may not read', () =>
       'KnowledgeBase/Engineering/Knowledge/Avi-Checkin.md',
     ];
     const { json } = await call(base, 'get_change_request', { number: 1 });
-    // A caller who may read everything gets the same author text, not the
-    // machine block — one body nobody has to reason about.
     expect(json).toMatchObject({
       body: 'Please review the check-in note.',
       changedFiles: 2,
       withheldFiles: 0,
     });
-    expect(JSON.stringify(json)).not.toContain('Affected owners');
   });
 });
 
@@ -1159,35 +1039,6 @@ describe('a file renamed out of a folder the caller may not read', () => {
     expect(json.withheldFiles).toBe(0);
   });
 
-  it('keeps a comment anchored to the withheld rename out of the comment list', async () => {
-    const base = await start();
-    renameRequest();
-    details.set(
-      12,
-      detail({
-        files: [
-          file('Knowledge/Open.md', { status: 'renamed', previousPath: 'Payroll/Rates.md' }),
-          file('Knowledge/Plain.md'),
-        ],
-        approvals: [approval('Knowledge/Open.md'), approval('Knowledge/Plain.md')],
-        comments: [
-          comment({ id: 'c-1', path: 'Knowledge/Plain.md', line: 4 }),
-          comment({ id: 'c-2', path: 'Knowledge/Open.md', line: 9, body: 'Rate band looks off.' }),
-        ],
-      }),
-    );
-    const { json } = await call(base, 'list_change_request_comments', { number: 12 });
-    // `Knowledge/Open.md` passes a bare read check — it is the file's new name —
-    // but the file is withheld whole, so a comment on it is withheld too. Were
-    // it kept, it would print the name the files tool refuses to print.
-    expect((json.comments as unknown as { id: string }[]).map((c) => c.id)).toEqual(['c-1']);
-    expect(json.withheldComments).toBe(1);
-    const whole = JSON.stringify(json);
-    expect(whole).not.toContain('Knowledge/Open.md');
-    expect(whole).not.toContain('Payroll');
-    expect(whole).not.toContain('Rate band');
-  });
-
   it('keeps the withheld rename out of the files a review names, and counts it', async () => {
     const base = await start();
     renameRequest();
@@ -1472,83 +1323,3 @@ describe('reading a request that is no longer open', () => {
     expect(mine.json).toMatchObject({ state: 'closed', changedFiles: 0, viewer: { isAuthor: true } });
   });
 });
-
-/**
- * Scenario (Razvan's review, 2026-10-02, finding 3): a reply is shown only when
- * the comment it replies to is.
- *
- * `post_change_request_comment` takes `parentId` without requiring `path`, so a
- * reply to a comment on a withheld file has no path of its own — and judged on
- * itself it looked like a general comment about the whole request. It came back
- * with its body and a `parentId` naming a comment the caller cannot see.
- */
-describe('a reply is shown only when the comment it replies to is', () => {
-  /** A request whose two files the caller can read one of. */
-  function threadRequest(comments: ChangeRequestComment[]) {
-    readable = ['Knowledge/Open.md'];
-    details.set(
-      12,
-      detail({
-        files: [file('Knowledge/Open.md'), file('Payroll/Rates.md')],
-        approvals: [approval('Knowledge/Open.md'), approval('Payroll/Rates.md')],
-        comments,
-      }),
-    );
-  }
-
-  it('withholds a pathless reply to a comment on a file the caller may not read', async () => {
-    const base = await start();
-    threadRequest([
-      comment({ id: 'c-1', path: 'Payroll/Rates.md', line: 3, body: 'This band is wrong.' }),
-      comment({ id: 'c-2', parentId: 'c-1', body: 'Agreed, the band moved in April.' }),
-    ]);
-    const { json } = await call(base, 'list_change_request_comments', { number: 12 });
-    expect(json.comments).toEqual([]);
-    expect(json.withheldComments).toBe(2);
-    const whole = JSON.stringify(json);
-    // Neither the parent's path, nor the reply's body, nor the id it answers.
-    expect(whole).not.toContain('Payroll');
-    expect(whole).not.toContain('band moved');
-    expect(whole).not.toContain('c-1');
-  });
-
-  it('withholds every reply down the thread, however deep it runs', async () => {
-    const base = await start();
-    threadRequest([
-      comment({ id: 'c-1', path: 'Payroll/Rates.md', body: 'This band is wrong.' }),
-      comment({ id: 'c-2', parentId: 'c-1', body: 'Which one?' }),
-      comment({ id: 'c-3', parentId: 'c-2', body: 'The senior one.' }),
-    ]);
-    const { json } = await call(base, 'list_change_request_comments', { number: 12 });
-    expect(json.comments).toEqual([]);
-    expect(json.withheldComments).toBe(3);
-    expect(JSON.stringify(json)).not.toContain('senior');
-  });
-
-  it('keeps a thread on a file the caller may read, replies and all', async () => {
-    const base = await start();
-    threadRequest([
-      comment({ id: 'c-1', path: 'Knowledge/Open.md', line: 4, body: 'Out of date.' }),
-      comment({ id: 'c-2', parentId: 'c-1', body: 'Fixed.' }),
-      comment({ id: 'c-3', parentId: 'c-2', body: 'Thanks.' }),
-    ]);
-    const { json } = await call(base, 'list_change_request_comments', { number: 12 });
-    expect((json.comments as unknown as { id: string }[]).map((c) => c.id)).toEqual([
-      'c-1',
-      'c-2',
-      'c-3',
-    ]);
-    expect(json.withheldComments).toBe(0);
-  });
-
-  it('keeps a general comment and its replies — neither is about a file', async () => {
-    const base = await start();
-    threadRequest([
-      comment({ id: 'c-1', body: 'Ready for review.' }),
-      comment({ id: 'c-2', parentId: 'c-1', body: 'Looking now.' }),
-    ]);
-    const { json } = await call(base, 'list_change_request_comments', { number: 12 });
-    expect(json.comments).toHaveLength(2);
-    expect(json.withheldComments).toBe(0);
-  });
-});