@bevel-software/platform-core-backend 0.32.0 → 0.34.0

package/src/modules/workflow/events.routes.ts

@@ -27,19 +27,27 @@
  * has evicted past `n`, the route emits `{ kind: 'resync' }` so the
  * client refetches state from scratch.
  *
+ * **Who receives what** — the bus picks the sessions that HEAR about an
+ * event (focus for workspace events, owner for user events); before writing
+ * it, the route asks the delivery rule (`IEventDelivery`) whether this
+ * session's person may have it, and in what form (`events-delivery.ts`). Live fan-out and replay go
+ * through the same rule, and through one ordered queue per session, so a
+ * slow verdict never reorders a session's stream.
+ *
  * **Heartbeat** — every 25 s the route writes an SSE comment (`:\n\n`).
  * Keeps proxies (nginx, Coolify's Traefik, Cloudflare) from killing the
  * connection as idle. Cheap (~15 bytes), eliminates a whole class of bug.
  */
 
-import type { Request, Response } from 'express';
+import type { Response } from 'express';
 import { logger } from '../../shared/logging.js';
 
 const log = logger('events');
 import express from 'express';
-import type { WorkflowEvent } from '@bevel-software/platform-shared';
+import { type WorkflowEvent } from '@bevel-software/platform-shared';
 import type { WorkflowEventBus } from './event-bus.js';
-import '../auth/auth.middleware.js'; // Express Request augmentation
+import type { IEventDelivery } from './events-delivery.js';
+import '../auth/index.js'; // Express Request augmentation
 
 /** Interval between SSE keep-alive comments (ms). 25 s sits comfortably under
  * the typical 30–100 s proxy idle timeout. */
@@ -73,15 +81,16 @@ interface ActiveSession {
    * suggestion branch got no `file-changed` for the images on screen and kept
    * showing a screenshot a teammate had already replaced.
    *
-   * The client declares the list; this is a delivery filter, not an access
-   * check. It always was — a session could name any workspace as its focus —
-   * and the events it selects carry no file contents, only paths. Whether the
-   * reader may open what changed is settled by the routes that serve it.
+   * The client declares the list, and may name any workspace in it: this is
+   * a delivery filter, not an access check. The access check is the
+   * delivery rule (`IEventDelivery`) every event passes on its way to the session.
    */
   focusedWorkspaceIds: string[];
   /** Set when the SSE connection closes. Used by the focus POST so a
    *  request that arrives after the connection drops 404s cleanly. */
   closed: boolean;
+  /** Tail of this session's writes: each event waits for its verdict, in arrival order. */
+  queue: Promise<void>;
   /** The Express response stream backing this session. Stored so a
    *  same-id reconnect can `end()` the old response and close its TCP
    *  socket immediately, rather than leaving a dangling connection that
@@ -97,6 +106,7 @@ interface ActiveSession {
 export function createEventsRoutes(
   bus: WorkflowEventBus,
   authMiddleware: express.RequestHandler,
+  delivery: IEventDelivery,
 ): express.Router {
   const router = express.Router();
 
@@ -114,6 +124,7 @@ export function createEventsRoutes(
       return;
     }
     const userId = req.userId!;
+    const viewer = { userId, email: req.userEmail };
 
     // SSE headers. `X-Accel-Buffering: no` tells nginx not to buffer the
     // response (would batch events behind a flush boundary, killing
@@ -158,15 +169,24 @@ export function createEventsRoutes(
       userId,
       focusedWorkspaceIds: [],
       closed: false,
+      queue: Promise.resolve(),
       res,
       // Filled in below once `unsubscribe` + `heartbeat` exist.
       cleanup: () => {},
     };
     sessions.set(sessionId, session);
 
+    // Every event this session hears goes through the delivery rule, in the
+    // order it arrived: the verdict is async, the stream must not reorder.
     const push = (event: WorkflowEvent): void => {
       if (session.closed) return;
-      writeSseEvent(res, event);
+      const verdict = delivery.judge(event, viewer);
+      session.queue = session.queue.then(async () => {
+        const deliverable = await verdict;
+        if (deliverable && !session.closed) writeSseEvent(res, deliverable);
+      }).catch((err: unknown) => {
+        log.warn(`write to session=${sessionId} failed:`, { err });
+      });
     };
 
     const unsubscribe = bus.subscribe({
@@ -196,7 +216,8 @@ export function createEventsRoutes(
           reason: 'last-event-id too old; ring buffer evicted',
         });
       } else {
-        for (const event of replay) writeSseEvent(res, event);
+        // The same rule as live delivery, queued ahead of anything live.
+        for (const event of replay) push(event);
       }
     }
 

package/src/modules/workflow/file-lock.service.ts

@@ -58,8 +58,8 @@
  */
 
 import { and, eq, gt, inArray, lte } from 'drizzle-orm';
-import type { Database } from '../database/connection.js';
-import { fileLocks } from '../database/schema.js';
+import type { Database } from '../database/index.js';
+import { fileLocks } from '../database/index.js';
 import type { AcquireLockResult, AuthUser, FileLock } from '@bevel-software/platform-shared';
 import { WorkflowValidationError } from '../../shared/domain-errors.js';
 import { canonicalFileIdentity } from '../../shared/canonical-file-identity.js';

package/src/modules/workflow/git/__tests__/git.service.list-branches.test.ts

@@ -8,6 +8,8 @@ import os from 'node:os';
 import type { WorkspaceService } from '../../../workspace/workspace.service.js';
 import { WorkflowHooks } from '../../workflow-hooks.js';
 import { GitService } from '../git.service.js';
+import { NodeGitRunner } from '../node-git-runner.js';
+import type { IGitRunner } from '../../../../shared/git.contract.js';
 
 const execFileAsync = promisify(execFile);
 
@@ -155,7 +157,7 @@ describe('GitService.listBranches', () => {
     expect(names).toEqual(['alice/draft-one', 'current-company-state', 'target-company-state']);
   });
 
-  it('returns local branches before remote-only ones, order preserved through parallel ahead/behind', async () => {
+  it('returns local branches before remote-only ones, then alphabetically', async () => {
     await seedWorkspace(root, workspaceId);
     const svc = new GitService(
       stubWorkspaceService(workspaceId, path.join(root, workspaceId)),
@@ -165,8 +167,7 @@ describe('GitService.listBranches', () => {
 
     // current-company-state is the workspace clone's checked-out branch (the
     // only local head); the rest are remote-only. The result order must be
-    // local-first then alphabetical — `listBranches` now computes ahead/behind
-    // with `Promise.all`, so this pins that the mapping preserves row order.
+    // local-first then alphabetical.
     const branches = await svc.listBranches(workspaceId);
     expect(branches.map((b) => b.name)).toEqual([
       'current-company-state',
@@ -231,4 +232,130 @@ describe('GitService.listBranches', () => {
       expect.arrayContaining([expect.objectContaining({ name: 'alice/draft-one' })]),
     );
   });
+
+  // A listing names branches; it counts nothing. Counting cost one to three
+  // `rev-list` spawns a branch — about 120 git processes a listing on a
+  // knowledge base with 121 branches — for numbers no listing reader shows.
+  it('runs no git per branch: a listing over many branches spawns the same few commands as one over three', async () => {
+    const { upstream } = await seedWorkspace(root, workspaceId);
+    const pusher = path.join(root, '.pusher');
+    await runGit(root, ['clone', upstream, pusher]);
+    const drafts = Array.from({ length: 12 }, (_, i) => `team/draft-${String(i).padStart(2, '0')}`);
+    for (const d of drafts) {
+      await runGit(pusher, ['checkout', '-q', '-b', d, 'origin/current-company-state']);
+      await runGit(pusher, ['commit', '--allow-empty', '-m', d]);
+    }
+    await runGit(pusher, ['push', '-q', 'origin', ...drafts]);
+    // The workspace's own branch carries an upstream and local commits too:
+    // exactly what the old listing counted against.
+    const repo = path.join(root, workspaceId, 'knowledge-base');
+    await runGit(repo, ['commit', '--allow-empty', '-m', 'unshared']);
+
+    const { runner, commands } = recordingRunner();
+    const svc = new GitService(
+      stubWorkspaceService(workspaceId, path.join(root, workspaceId)),
+      new WorkflowHooks(),
+      testKbContext(),
+      undefined,
+      null,
+      runner,
+    );
+    const branches = await svc.listBranches(workspaceId);
+
+    expect(branches.map((b) => b.name)).toEqual([
+      'current-company-state',
+      'alice/draft-one',
+      'target-company-state',
+      ...drafts,
+    ]);
+    expect(branches[0]).toEqual({ name: 'current-company-state', isProtected: true, hasRemote: true });
+    for (const b of branches) expect(Object.keys(b).sort()).toEqual(['hasRemote', 'isProtected', 'name']);
+    expect(commands.filter((c) => c === 'rev-list')).toEqual([]);
+    // Its fetch, and the two reads of what the repository holds — whatever
+    // the number of branches.
+    expect([...commands].sort()).toEqual(['fetch', 'for-each-ref', 'symbolic-ref']);
+  });
+});
+
+/** The real runner, recording the subcommand of every git it is asked to run. */
+function recordingRunner(): { runner: IGitRunner; commands: string[] } {
+  const inner = new NodeGitRunner();
+  const commands: string[] = [];
+  const runner = {
+    defaultTimeoutMs: inner.defaultTimeoutMs,
+    credentials: inner.credentials,
+    run: async (cwd: string, args: string[], opts?: object) => {
+      // Skip `-c key=value` pairs: the subcommand is the first bare word.
+      let i = 0;
+      while (i < args.length && args[i].startsWith('-')) i += args[i] === '-c' ? 2 : 1;
+      commands.push(args[i] ?? '');
+      return inner.run(cwd, args, opts as never);
+    },
+  } as unknown as IGitRunner;
+  return { runner, commands };
+}
+
+describe('GitService.branchCounts', () => {
+  let root: string;
+
+  beforeEach(async () => {
+    root = await mkTmpRoot();
+  });
+
+  afterEach(async () => {
+    await fs.rm(root, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 });
+  });
+
+  const draftWs = encodeURIComponent('alice/draft-one');
+
+  /** The draft's own workspace, on the draft, three commits ahead of what it shared. */
+  async function seedDraft(): Promise<{ upstream: string; repo: string }> {
+    const { upstream, repo } = await seedWorkspace(root, draftWs);
+    await runGit(repo, ['checkout', '-q', 'alice/draft-one']);
+    for (const m of ['one', 'two', 'three']) await runGit(repo, ['commit', '--allow-empty', '-m', m]);
+    return { upstream, repo };
+  }
+
+  function svcFor(runner: IGitRunner = new NodeGitRunner(), kb = testKbContext()): GitService {
+    return new GitService(stubWorkspaceService(draftWs, path.join(root, draftWs)), new WorkflowHooks(), kb, undefined, null, runner);
+  }
+
+  it('counts the workspace\'s own branch against its upstream, with rev-list for that branch alone', async () => {
+    const { upstream, repo } = await seedDraft();
+    // A teammate shares one commit on the same draft, which this clone fetches.
+    const pusher = path.join(root, '.pusher');
+    await runGit(root, ['clone', '-q', '-b', 'alice/draft-one', upstream, pusher]);
+    await runGit(pusher, ['commit', '--allow-empty', '-m', 'teammate']);
+    await runGit(pusher, ['push', '-q', 'origin', 'alice/draft-one']);
+    await runGit(repo, ['fetch', '-q', 'origin']);
+
+    const { runner, commands } = recordingRunner();
+    await expect(svcFor(runner).branchCounts(draftWs)).resolves.toEqual({ ahead: 3, behind: 1 });
+    // The upstream resolved, so one count was enough.
+    expect(commands.filter((c) => c === 'rev-list')).toHaveLength(1);
+  });
+
+  it('falls back to the protected branch on origin it is fewest commits ahead of when it has no upstream', async () => {
+    const { upstream, repo } = await seedDraft();
+    await runGit(repo, ['branch', '--unset-upstream']);
+    // `target-company-state` moves on by two commits; `current-company-state` stays.
+    const pusher = path.join(root, '.pusher');
+    await runGit(root, ['clone', '-q', '-b', 'target-company-state', upstream, pusher]);
+    for (const m of ['t1', 't2']) await runGit(pusher, ['commit', '--allow-empty', '-m', m]);
+    await runGit(pusher, ['push', '-q', 'origin', 'target-company-state']);
+    await runGit(repo, ['fetch', '-q', 'origin']);
+
+    const { runner, commands } = recordingRunner();
+    // Three ahead of both; ties keep the first protected branch, which is behind by nothing.
+    await expect(svcFor(runner).branchCounts(draftWs)).resolves.toEqual({ ahead: 3, behind: 0 });
+    // The upstream it tried, then each protected branch.
+    expect(commands.filter((c) => c === 'rev-list')).toHaveLength(3);
+  });
+
+  it('answers null for a branch never shared, with no protected base to count against', async () => {
+    const { repo } = await seedDraft();
+    await runGit(repo, ['branch', '--unset-upstream']);
+    const kb = testKbContext({ branchModel: { defaultBranch: 'main', protectedBranches: ['main'] } });
+    await expect(svcFor(undefined, kb).branchCounts(draftWs)).resolves.toEqual({ ahead: null, behind: null });
+  });
 });

package/src/modules/workflow/git/__tests__/pull-request.service.getPrDetail.test.ts

@@ -22,11 +22,11 @@ const ROW = {
   closedAt: null,
 };
 
-function makeDb(): Database {
+function makeDb(row: Record<string, unknown> = ROW): Database {
   return {
     select: () => ({
       from: () => ({
-        where: () => ({ limit: async () => [ROW] }),
+        where: () => ({ limit: async () => [row] }),
       }),
     }),
   } as unknown as Database;
@@ -42,10 +42,10 @@ const FORK = 'c'.repeat(40);
  * both refs), so the file list must be pinned to those same commits rather
  * than fetch and resolve again. The SHAs and the file list are read on every
  * call (a new head must show); what the detail cache saves is the DB
- * enrichment (comments, approvals), so that is where "cached" is observed.
+ * enrichment (approvals), so that is where "cached" is observed.
  */
 describe('PullRequestService.getPrDetail — git work per read', () => {
-  function harness() {
+  function harness(row: Record<string, unknown> = ROW) {
     const resolvePrShas = vi.fn(async () => ({ baseSha: BASE, headSha: HEAD }));
     const changedFilesForPr = vi.fn(async () => []);
     const forkPointForPr = vi.fn(async () => ({ mergeBaseSha: FORK, behind: true }));
@@ -61,11 +61,9 @@ describe('PullRequestService.getPrDetail — git work per read', () => {
       ensureRemotesFetched: async () => undefined,
     } as unknown as WorkspaceService;
     const access = { canWriteAtRef: async () => false } as unknown as IAccessControl;
-    const svc = new PullRequestService(makeDb(), workspace, access, git);
-    const listComments = vi.fn(async () => []);
+    const svc = new PullRequestService(makeDb(row), workspace, access, git);
     const getApprovalStates = vi.fn(async () => []);
     svc.setDetailEnricher({
-      listComments,
       getApprovalStates,
       evaluateMergeGate: () => ({ mergeable: false, reasons: [], warnings: [] }),
     });
@@ -79,6 +77,25 @@ describe('PullRequestService.getPrDetail — git work per read', () => {
     };
   }
 
+  it('carries the body as stored, and an access request\'s level and note off the row — absent on an ordinary request', async () => {
+    const plain = await harness().svc.getPrDetail(7, { fresh: true });
+    expect(plain?.body).toBe('');
+    expect(plain).not.toHaveProperty('accessRequest');
+
+    const asked = await harness({
+      ...ROW,
+      body: 'Rita asked for **Owner** on Research.',
+      accessRequestLevel: 'owner',
+      accessRequestNote: 'I maintain these pages now',
+    }).svc.getPrDetail(7, { fresh: true });
+    expect(asked?.body).toBe('Rita asked for **Owner** on Research.');
+    expect(asked?.accessRequest).toEqual({ level: 'owner', note: 'I maintain these pages now' });
+
+    // A level with no note: the note never stands alone, and never as ''.
+    const noNote = await harness({ ...ROW, accessRequestLevel: 'write', accessRequestNote: null }).svc.getPrDetail(7, { fresh: true });
+    expect(noNote?.accessRequest).toEqual({ level: 'write' });
+  });
+
   it('pins the file list to the SHAs it just resolved, and keeps patches for a client read', async () => {
     const { svc, resolvePrShas, changedFilesForPr } = harness();
     const detail = await svc.getPrDetail(7, { fresh: true });
@@ -164,7 +181,6 @@ describe('PullRequestService — change request link', () => {
     const access = { canWriteAtRef: async () => false } as unknown as IAccessControl;
     const svc = new PullRequestService(makeDb(), workspace, access, git, publicFrontendUrl);
     svc.setDetailEnricher({
-      listComments: async () => [],
       getApprovalStates: async () => [],
       evaluateMergeGate: () => ({ mergeable: false, reasons: [], warnings: [] }),
     });
@@ -244,7 +260,6 @@ describe('PullRequestService.getPrDetail — needsUpdate', () => {
     } as unknown as Database;
     const svc = new PullRequestService(db, workspace, access, git);
     svc.setDetailEnricher({
-      listComments: async () => [],
       getApprovalStates: async () => [],
       evaluateMergeGate: () => ({ mergeable: false, reasons: [], warnings: [] }),
     });

package/src/modules/workflow/git/git.service.ts

@@ -5,6 +5,7 @@ import type {
   AppliedChangeRef,
   AppliedMergeResult,
   AuthUser,
+  BranchCounts,
   BranchInfo,
   ChangedPathPair,
   CommitAttribution,
@@ -21,15 +22,12 @@ import type {
 } from '@bevel-software/platform-shared';
 import { isFolderPlaceholder } from '@bevel-software/platform-shared';
 import { mergeCommitMessageNames } from './merge-commit.js';
-import type { WorkspaceService } from '../../workspace/workspace.service.js';
+import type { WorkspaceService } from '../../workspace/index.js';
 import type { WorkflowHooks, CommitValidationContext } from '../workflow-hooks.js';
-import type { IAccessControl } from '../../access/access-control.interface.js';
-import { AccessDeniedError } from '../../access-model/access-errors.js';
-import { WorkspaceIdMutex, type WorkspaceMutex } from '../../kb-fs/index.js';
+import type { IAccessControl } from '../../access/index.js';
+import { AccessDeniedError } from '../../access-model/index.js';
+import { WorkspaceIdMutex, type WorkspaceMutex, assertInsideRepo, cloneTrackingConfigArgs, SAFE_IMPLICIT_FETCH_ARGS, readRefSha } from '../../kb-fs/index.js';
 import { isAbsence } from '../../../shared/fs.contract.js';
-import { assertInsideRepo } from '../../kb-fs/repo-path.js';
-import { cloneTrackingConfigArgs, SAFE_IMPLICIT_FETCH_ARGS } from '../../kb-fs/clone-config.js';
-import { readRefSha } from '../../kb-fs/index.js';
 import { utf8Text } from '../../../shared/utf8-text.js';
 import { lstatOrNull } from '../../../shared/rename-no-replace.js';
 import { linkedAncestor } from '../../../shared/no-link-below.js';
@@ -38,7 +36,7 @@ import {
   assertValidRelativePath,
   isBranchAuthoredBy,
   isOwnSuggestionsBranch,
-} from '../../kb-fs/branch-name.js';
+} from '../../kb-fs/index.js';
 import type { KbContext } from '../../../shared/kb-context.js';
 import {
   AppliedChangeMismatchError,
@@ -63,6 +61,7 @@ import {
 } from '../../../shared/git.contract.js';
 import { NodeGitRunner } from './node-git-runner.js';
 import { printable } from '../../../shared/printable.js';
+import { branchForWorkspaceId } from '../../../shared/workspace-id.js';
 import { sanitizeError } from '../sanitize-error.js';
 
 const log = logger('git');
@@ -295,11 +294,6 @@ export class GitService implements IGitService {
   /** Whether the last implicit fetch per workspace SUCCEEDED — see `fetchOriginIfStale`. */
   private readonly lastImplicitFetchOk = new Map<string, boolean>();
   private static readonly IMPLICIT_FETCH_TTL_MS = 5_000;
-  // Cap on concurrent `aheadBehindForBranch` calls inside `listBranches`. Each
-  // call serializes up to 3 `git rev-list` spawns, so 8 workers ≈ ≤24
-  // concurrent processes worst case — fast for typical (<8) feature-branch
-  // counts, calm under large branch lists.
-  private static readonly MAX_AHEAD_BEHIND_CONCURRENCY = 8;
 
   /**
    * A change request's changed entries, keyed by the two commits its diff
@@ -548,7 +542,7 @@ export class GitService implements IGitService {
         )
       ).trim();
 
-      type Row = { shortName: string; ref: string; hasLocal: boolean; hasRemote: boolean };
+      type Row = { shortName: string; hasLocal: boolean; hasRemote: boolean };
       const buckets = new Map<string, Row>();
       for (const line of stdout.split('\n')) {
         const trimmed = line.trim();
@@ -576,16 +570,12 @@ export class GitService implements IGitService {
         if (!existing) {
           buckets.set(shortName, {
             shortName,
-            ref,
             hasLocal: isLocal,
             hasRemote: !isLocal,
           });
           continue;
         }
-        // Prefer the local entry's ref when both exist — ahead/behind against the
-        // configured upstream is more meaningful than against origin directly.
         if (isLocal && !existing.hasLocal) {
-          existing.ref = ref;
           existing.hasLocal = true;
         } else if (!isLocal) {
           existing.hasRemote = true;
@@ -597,36 +587,14 @@ export class GitService implements IGitService {
         return a.shortName.localeCompare(b.shortName);
       });
 
-      // Compute ahead/behind for every branch with bounded concurrency — each
-      // branch is 1–3 `git rev-list` spawns, and the unbounded `Promise.all`
-      // we used before could put N×3 processes in flight on repos with many
-      // branches. Workers pull indices off a shared counter and write into a
-      // pre-sized array, so input order (and the sort above) is preserved.
-      const infos: BranchInfo[] = new Array(rows.length);
-      let nextIndex = 0;
-      const workerCount = Math.min(GitService.MAX_AHEAD_BEHIND_CONCURRENCY, rows.length);
-      await Promise.all(
-        Array.from({ length: workerCount }, async () => {
-          while (true) {
-            const i = nextIndex++;
-            if (i >= rows.length) return;
-            const row = rows[i];
-            const { ahead, behind } = await this.aheadBehindForBranch(
-              cwd,
-              row.shortName,
-              row.ref,
-              row.hasLocal,
-            );
-            infos[i] = {
-              name: row.shortName,
-              isProtected: this.kb.isProtectedBranch(row.shortName),
-              ahead,
-              behind,
-              hasRemote: row.hasRemote,
-            };
-          }
-        }),
-      );
+      // No git per branch: commit counts are not part of a listing (they cost
+      // one to three `rev-list` spawns a branch, over every branch the
+      // repository has). The one branch that wants them asks `branchCounts`.
+      const infos: BranchInfo[] = rows.map((row) => ({
+        name: row.shortName,
+        isProtected: this.kb.isProtectedBranch(row.shortName),
+        hasRemote: row.hasRemote,
+      }));
       // Every name this listing showed — origin's refs and the local heads
       // alike, since a branch checked out here is one the platform has
       // plainly heard of. A listener that misbehaves must not turn a good
@@ -642,6 +610,24 @@ export class GitService implements IGitService {
     });
   }
 
+  async branchCounts(workspaceId: string): Promise<BranchCounts> {
+    return this.mutex.run(workspaceId, async () => {
+      const cwd = await this.repoDir(workspaceId);
+      const branch = branchForWorkspaceId(workspaceId);
+      // The workspace's own branch is its local head while it is checked out;
+      // otherwise only origin's ref names it — as a listing would read it.
+      const ownBranch = (
+        await this.git(cwd, ['symbolic-ref', '--quiet', '--short', 'HEAD']).then(
+          (r) => r.stdout,
+          () => '',
+        )
+      ).trim();
+      return ownBranch === branch
+        ? this.aheadBehindForBranch(cwd, branch, `refs/heads/${branch}`, true)
+        : this.aheadBehindForBranch(cwd, branch, `refs/remotes/origin/${branch}`, false);
+    });
+  }
+
   /**
    * Run `git fetch --prune origin` outside the workspace mutex, with a short
    * TTL so back-to-back callers (mount + dropdown-open + 30s poll) coalesce
@@ -760,12 +746,6 @@ export class GitService implements IGitService {
         await this.git(cwd, ['branch', '-D', name]).catch(() => undefined);
         throw err;
       }
-      const { ahead, behind } = await this.aheadBehindForBranch(
-        cwd,
-        name,
-        `refs/heads/${name}`,
-        true,
-      );
       // Drop the now-vestigial local head. Under the per-branch workspace model
       // this clone's identity is its OWN branch; the new draft lives in its own
       // workspace (cloned from origin on first navigation), so this clone never
@@ -785,8 +765,6 @@ export class GitService implements IGitService {
       return {
         name,
         isProtected: false,
-        ahead,
-        behind,
         hasRemote: true,
       };
     });

package/src/modules/workflow/git/node-git-runner.ts

@@ -10,7 +10,7 @@ import {
   type IGitRunner,
 } from '../../../shared/git.contract.js';
 import { logger } from '../../../shared/logging.js';
-import { credentialHelperValue } from '../../kb-fs/clone-config.js';
+import { credentialHelperValue } from '../../kb-fs/index.js';
 
 const log = logger('git-runner');
 

package/src/modules/workflow/git/pull-request.service.ts

@@ -7,7 +7,6 @@ import type {
   ChangedPathPair,
   FileApprovalState,
   IPullRequestService,
-  PrReviewComment,
   PullRequestDetail,
   PullRequestFile,
   PullRequestState,
@@ -15,22 +14,22 @@ import type {
   IGitService,
 } from '@bevel-software/platform-shared';
 import { isFolderPlaceholder } from '@bevel-software/platform-shared';
-import type { Database } from '../../database/connection.js';
-import { changeRequests } from '../../database/schema.js';
-import type { WorkspaceService } from '../../workspace/workspace.service.js';
-import type { IAccessControl } from '../../access/access-control.interface.js';
-import { AccessUnreadableError } from '../../access-model/access-errors.js';
+import type { Database } from '../../database/index.js';
+import { changeRequests } from '../../database/index.js';
+import type { WorkspaceService } from '../../workspace/index.js';
+import type { IAccessControl } from '../../access/index.js';
+import { AccessUnreadableError } from '../../access-model/index.js';
 import { AppliedChangeMismatchError, WorkflowValidationError } from '../../../shared/domain-errors.js';
 import { canonicalEmail, hashEmail } from '../../../shared/email-identity.js';
 import { changeRequestLink, changeRequestLinkBase } from './change-request-link.js';
 
 /**
- * The latest moment a change-request row records — its close time when it has
- * one, else its creation time, with `updated_at` folded in for the day
- * something writes it. Deliberately derived from the ROW alone: a time taken
- * from the newest comment or approval would make the same request report
- * different "last changed" moments to a list (which reads no comments) and a
- * detail (which does).
+ * The latest moment a change-request row records — the latest of its creation,
+ * its `updated_at` (a title or description edit) and its close time.
+ * Deliberately derived from the ROW alone: a time taken
+ * from the newest approval would make the same request report different
+ * "last changed" moments to a list (which reads no approvals) and a detail
+ * (which does).
  */
 function latestRowMoment(row: {
   createdAt: Date;
@@ -148,7 +147,6 @@ export function changeSourceFor(row: {
  * relationship in the composition root is explicit and minimal.
  */
 export interface PrDetailEnricher {
-  listComments(prNumber: number): Promise<PrReviewComment[]>;
   /**
    * Per-file approval state. `baseBranch` selects the access tree (resolved
    * against `origin/<baseBranch>`); `workspaceId` is optional and gates the
@@ -184,8 +182,8 @@ export interface PrDetailEnricher {
  *
  * The durable facts (pairing, title/body, author, state) live in the row; the
  * head/base SHAs, file list, and diffs are derived live from git so a new commit
- * or force-push is always reflected. Comments + per-file approvals + the merge
- * gate are stitched in from the review-workflow service (also DB-backed).
+ * or force-push is always reflected. Per-file approvals and the merge gate
+ * are stitched in from the review-workflow service (also DB-backed).
  */
 export class PullRequestService implements IPullRequestService {
   /**
@@ -837,16 +835,11 @@ export class PullRequestService implements IPullRequestService {
       })),
     );
 
-    // Comments + approvals come from our own DB via the review-workflow service.
-    // The enricher is optional — if it isn't wired yet (startup ordering,
-    // isolated tests) we return empty lists rather than blocking the fetch.
-    const [comments, approvals] = this.detailEnricher
-      ? await Promise.all([
-          this.detailEnricher.listComments(prNumber).catch((err) => {
-            log.warn(`listComments failed for #${prNumber}:`, { err });
-            return [] as PrReviewComment[];
-          }),
-          this.detailEnricher
+    // Approvals come from our own DB via the review-workflow service. The
+    // enricher is optional — if it isn't wired yet (startup ordering, isolated
+    // tests) we return an empty list rather than blocking the fetch.
+    const approvals = this.detailEnricher
+      ? await this.detailEnricher
             .getApprovalStates(
               prNumber,
               files,
@@ -863,9 +856,8 @@ export class PullRequestService implements IPullRequestService {
               if (err instanceof AccessUnreadableError) throw err;
               log.warn(`getApprovalStates failed for #${prNumber}:`, { err });
               return [] as FileApprovalState[];
-            }),
-        ])
-      : [[] as PrReviewComment[], [] as FileApprovalState[]];
+            })
+      : ([] as FileApprovalState[]);
 
     const gate = this.detailEnricher
       ? this.detailEnricher.evaluateMergeGate({
@@ -933,10 +925,19 @@ export class PullRequestService implements IPullRequestService {
     const detail: PullRequestDetail = {
       ...summary,
       body: row.body,
+      // Only a request the access-request flow opened has a level; the note
+      // rides with it and never stands alone.
+      ...(row.accessRequestLevel
+        ? {
+            accessRequest: {
+              level: row.accessRequestLevel as 'write' | 'owner',
+              ...(row.accessRequestNote ? { note: row.accessRequestNote } : {}),
+            },
+          }
+        : {}),
       headSha,
       baseSha,
       files,
-      comments,
       approvals,
       mergeableInBevel: gate.mergeable,
       mergeBlockedReasons: gate.reasons,
@@ -951,6 +952,10 @@ export class PullRequestService implements IPullRequestService {
       viewerCanUpdate,
       viewerIsAuthor,
       viewerCanDelete,
+      // Who may close a request may also change what it asks: the same
+      // grants, so the same predicate (`WorkflowService.updateChangeRequest`
+      // enforces it).
+      viewerCanEdit: viewerCanCancel,
     };
 
     // A patch-less detail is an internal read; it must not be served to the