@bevel-software/platform-core-backend 0.33.0 → 0.35.0

package/src/core/__tests__/lifecycle.test.ts

@@ -5,7 +5,10 @@ import { createShutdown, stopCore, withStartupTask, type LeasedWorker } from '..
 import { holdCommitWorkerLease, holdable } from '../lifecycle.js';
 import { BevelSecretsVariableLoader, registerBevelSecretsVariableLoader } from '../../modules/secrets-vault/secrets-variable-loader.js';
 import type { AdvisoryLease } from '../../modules/database/advisory-lock.js';
-import { WorkerPatternMatcher } from '../../modules/workspace/bounded-matcher.js';
+import { realpath } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { RipgrepPatternMatcher } from '../../modules/workspace/index.js';
+import { slowRipgrep } from '../../__tests__/slow-ripgrep.js';
 
 /** A lease the suite scripts: what each `tryAcquire` answers, and a way to lose it. */
 function fakeLease(answers: boolean[]) {
@@ -510,6 +513,24 @@ describe('stopCore', () => {
     expect(drained).toBeLessThan(g.order.indexOf('db.end'));
   });
 
+  it('stops the workspaces\' tmp sweep with the graph: the timer cleared, the sweep in flight awaited before the pool goes', async () => {
+    const g = graph();
+    const tmpSweeper = {
+      stopSweeping() {
+        g.order.push('tmpSweeper.stopSweeping');
+      },
+      async drainSweep() {
+        g.order.push('tmpSweeper.drainSweep');
+      },
+    };
+    await stopCore({ ...g.core, tmpSweeper } as never);
+    const stopped = g.order.indexOf('tmpSweeper.stopSweeping');
+    const drained = g.order.indexOf('tmpSweeper.drainSweep');
+    expect(stopped).toBeGreaterThanOrEqual(0);
+    expect(stopped).toBeLessThan(drained);
+    expect(drained).toBeLessThan(g.order.indexOf('db.end'));
+  });
+
   it('forgets the graph\'s secrets scope, so a descriptor that outlives it resolves nothing', async () => {
     const g = graph();
     registerBevelSecretsVariableLoader(
@@ -538,19 +559,31 @@ describe('stopCore', () => {
     ]);
   });
 
-  it('ends the grep matcher\'s workers, so an evicted graph leaves no search running behind it', async () => {
+  it('ends the grep matcher\'s running searches, so an evicted graph leaves no ripgrep running behind it', async () => {
     const g = graph();
-    const patternMatcher = new WorkerPatternMatcher();
-    // A search holding a worker for its whole 5 s budget when the graph is stopped.
-    const running = patternMatcher.search('^(a+)+$', '').matchingLines([`${'a'.repeat(39)}!`], 1);
-    await new Promise((r) => setTimeout(r, 100));
-    const started = Date.now();
-    await stopCore({ ...g.core, patternMatcher } as never);
-    await expect(running).rejects.toMatchObject({ status: 503, details: { code: 'search_busy' } });
-    expect(Date.now() - started).toBeLessThan(1_000);
-    // Closed for good: nothing after the stop starts a worker.
-    await expect(patternMatcher.search('b', '').matchingLines(['b'], 1)).rejects.toMatchObject({ status: 503 });
-    expect(g.order.at(-1)).toBe('db.end');
+    const slow = await slowRipgrep();
+    const patternMatcher = new RipgrepPatternMatcher();
+    try {
+      // A tree search that would hold its ripgrep for the whole 5 s budget when the graph is stopped.
+      const search = await patternMatcher.search('needle', { ignoreCase: false });
+      // A scope's cwd is canonical: where the temp folder is a link (macOS),
+      // the raw spelling would read as a root that has moved, and walk nothing.
+      const cwd = await realpath(tmpdir());
+      const running = (async () => {
+        for await (const file of search.files({ cwd, root: '.' }, { only: ['hit.md'], maxLinesPerFile: 1 })) void file;
+      })();
+      while ((await slow.alive()).length === 0) await new Promise((r) => setTimeout(r, 20));
+      const started = Date.now();
+      await stopCore({ ...g.core, patternMatcher } as never);
+      await expect(running).rejects.toMatchObject({ status: 503, details: { code: 'search_busy' } });
+      expect(Date.now() - started).toBeLessThan(1_000);
+      expect(await slow.alive()).toEqual([]);
+      // Closed for good: nothing after the stop starts a search.
+      await expect(patternMatcher.search('b', { ignoreCase: false })).rejects.toMatchObject({ status: 503 });
+      expect(g.order.at(-1)).toBe('db.end');
+    } finally {
+      await slow.remove();
+    }
   });
 
   it('does not wait past the budget for a worker that never stops, and still ends the pool', async () => {

package/src/core/__tests__/oauth-sign-in-real-file.test.ts

@@ -0,0 +1,179 @@
+import type { Server as HttpServer } from 'node:http';
+import { mkdtemp, rm, mkdir, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import express from 'express';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { DEFAULT_BRANCH } from '@bevel-software/platform-shared';
+import { createSecretsVaultRoutes } from '../../modules/secrets-vault/index.js';
+import { KbPluginSource } from '../../modules/plugins/index.js';
+import type { WorkspaceService } from '../../modules/workspace/index.js';
+import type { IAccessControl } from '../../modules/access/index.js';
+// The two concrete services this suite wires, it wires the way the composition
+// root does (`create-core-services.ts`): their modules publish them as types
+// only, and the composition root is the one place that constructs them from
+// their files. This suite stands in for that root — the routes of one module
+// over the real parser of another — which is why it lives beside it.
+import { ToolManualService } from '../../modules/tool-manuals/tool-manuals.service.js';
+import { realDisk } from '../../__tests__/real-disk.js';
+import { workspaceIdForBranch } from '../../shared/workspace-id.js';
+import { testKbContext } from '../../__tests__/kb-context.js';
+
+/**
+ * The sign-in start against REAL tool files: the routes are wired to the real
+ * `ToolManualService` over a workspace on disk, so what the start answers is
+ * what the parser makes of the file, not what a stub says it makes of it.
+ *
+ * The case this exists for (Local Testing, 2026-10-27): a declaration edited to
+ * `tokenUrl: http://127.0.0.1/token` is refused by the parser before the vault
+ * ever validates it — and the start answered "Tool or variable not found"
+ * instead of the validation's message.
+ */
+
+const KB_DIR = 'knowledge-base';
+const wsId = workspaceIdForBranch(DEFAULT_BRANCH);
+const USER = 'owner@x.com';
+const AUTHORIZE = 'https://auth.crm.example/authorize';
+const TOKEN = 'https://auth.crm.example/token';
+
+let root: string;
+let httpServer: HttpServer | undefined;
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), 'signin-live-'));
+  await mkdir(join(root, wsId, KB_DIR, 'Plugins', 'GTM'), { recursive: true });
+});
+afterEach(async () => {
+  await new Promise<void>((r) => (httpServer ? httpServer.close(() => r()) : r()));
+  httpServer = undefined;
+  await rm(root, { recursive: true, force: true });
+  vi.restoreAllMocks();
+});
+
+const toolPath = () => join(root, wsId, KB_DIR, 'Plugins', 'crm.tool');
+const writeTool = (oauth: Record<string, unknown>) =>
+  writeFile(
+    toolPath(),
+    JSON.stringify({
+      name: 'crm',
+      type: 'http',
+      url: 'https://api.crm.example/openapi.json',
+      variables: [{ name: 'SIGNIN', scope: 'user', oauth }],
+    }),
+  );
+const writePlugin = (oauth: Record<string, unknown>) =>
+  Promise.all([
+    writeFile(
+      join(root, wsId, KB_DIR, 'Plugins', 'GTM', 'mcp.json'),
+      JSON.stringify({ mcpServers: { hubspot: { type: 'streamable-http', url: 'https://mcp.hubspot.example/mcp' } } }),
+    ),
+    writeFile(
+      join(root, wsId, KB_DIR, 'Plugins', 'GTM', 'plugin.json'),
+      JSON.stringify({
+        name: 'gtm',
+        extensions: {
+          'software.bevel.hexis': {
+            mcpServers: {
+              hubspot: {
+                headers: { Authorization: 'Bearer ${HUBSPOT_TOKEN}' },
+                variables: [{ name: 'HUBSPOT_TOKEN', scope: 'user', oauth }],
+              },
+            },
+          },
+        },
+      }),
+    ),
+  ]);
+
+async function serve() {
+  const disk = realDisk();
+  const kb = testKbContext({ kbDirName: KB_DIR });
+  const accessControl = {
+    canRead: async () => true,
+    canWrite: async () => true,
+    canReadBatch: async (_w: string, _e: string, paths: string[]) => new Map(paths.map((p) => [p, true])),
+  } as unknown as IAccessControl;
+  const workspaceService = {
+    getOrCreateForBranch: async () => ({ id: wsId }),
+    getWorkspacePath: async (id: string) => join(root, id),
+  } as unknown as WorkspaceService;
+  const toolManualService = new ToolManualService(workspaceService, accessControl, kb, disk, new KbPluginSource(disk, kb));
+  toolManualService.setMcpAuthDiscovery({ statusFor: async () => ({ status: 'open' as const }) });
+  const beginToolOAuthByKey = vi.fn(async () => ({ id: 'row-1', url: `${AUTHORIZE}?client_id=x` }));
+  const deps = {
+    secretsVault: { beginToolOAuthByKey },
+    toolManualService,
+    accessControl,
+    connectionProbe: {},
+    kb: { defaultWorkspaceId: () => wsId },
+    stateSecret: 'state-secret',
+    publicBackendUrl: 'http://localhost:3000',
+    publicFrontendUrl: 'http://localhost:5173',
+  } as unknown as Parameters<typeof createSecretsVaultRoutes>[0];
+  const app = express();
+  app.use(express.json());
+  app.use((req, _res, next) => {
+    req.userId = 'user-1';
+    req.userEmail = USER;
+    next();
+  });
+  app.use('/api', createSecretsVaultRoutes(deps));
+  httpServer = await new Promise<HttpServer>((resolve) => {
+    const s = app.listen(0, () => resolve(s));
+  });
+  const base = `http://127.0.0.1:${(httpServer.address() as { port: number }).port}/api/secrets/tools`;
+  const start = (slug: string, varName: string) => fetch(`${base}/${slug}/vars/${varName}/oauth/start`, { method: 'POST' });
+  return { toolManualService, beginToolOAuthByKey, start };
+}
+
+describe('POST …/oauth/start — through a real tool file', () => {
+  it('a client id edited in the .tool after the catalog was scanned is the one handed to the vault', async () => {
+    await writeTool({ clientId: 'client-A', authorizationUrl: AUTHORIZE, tokenUrl: TOKEN });
+    const s = await serve();
+    await s.toolManualService.listAccessible(USER); // the catalog caches client A
+    await writeTool({ clientId: 'client-B', authorizationUrl: AUTHORIZE, tokenUrl: TOKEN });
+
+    expect((await s.start('crm', 'SIGNIN')).status).toBe(200);
+    expect(s.beginToolOAuthByKey.mock.calls[0][0]).toMatchObject({
+      key: 'crm_SIGNIN',
+      provider: { clientId: 'client-B', authorizationUrl: AUTHORIZE, tokenUrl: TOKEN, pkce: true },
+    });
+  });
+
+  it.each([
+    ['an http:// token endpoint', 'http://127.0.0.1/token', '`variables[0].oauth.tokenUrl` must use https'],
+    ['a private token endpoint', 'https://10.0.0.5/token', '`variables[0].oauth.tokenUrl` host is not allowed'],
+  ])('a .tool naming %s is refused with the validation message, sending nothing', async (_n, tokenUrl, message) => {
+    await writeTool({ clientId: 'client-A', authorizationUrl: AUTHORIZE, tokenUrl: TOKEN });
+    vi.spyOn(console, 'warn').mockImplementation(() => {});
+    const s = await serve();
+    await s.toolManualService.listAccessible(USER); // the catalog still holds the valid version
+    await writeTool({ clientId: 'client-A', authorizationUrl: AUTHORIZE, tokenUrl });
+    const fetchSpy = vi.spyOn(globalThis, 'fetch');
+
+    const res = await s.start('crm', 'SIGNIN');
+    expect(res.status).toBe(422);
+    expect(((await res.json()) as { error: string }).error).toBe(message);
+    expect(s.beginToolOAuthByKey).not.toHaveBeenCalled();
+    // The one fetch is the test's own call to the route: nothing went to a provider.
+    expect(fetchSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it('a plugin.json sign-in naming an http:// token endpoint is refused with the validation message, sending nothing', async () => {
+    await writePlugin({ clientId: 'owner-app', authorizationUrl: AUTHORIZE, tokenUrl: 'http://127.0.0.1/token' });
+    vi.spyOn(console, 'warn').mockImplementation(() => {});
+    const s = await serve();
+    const fetchSpy = vi.spyOn(globalThis, 'fetch');
+
+    const res = await s.start('hubspot', 'HUBSPOT_TOKEN');
+    expect(res.status).toBe(422);
+    expect(((await res.json()) as { error: string }).error).toContain('`variables[0].oauth.tokenUrl` must use https');
+    expect(s.beginToolOAuthByKey).not.toHaveBeenCalled();
+    expect(fetchSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it('a slug no file declares is still not found', async () => {
+    const s = await serve();
+    expect((await s.start('nothing', 'SIGNIN')).status).toBe(404);
+  });
+});

package/src/core/catalog-revision.ts

@@ -4,6 +4,7 @@ import { logger } from '../shared/logging.js';
 import type { ISkillService, SkillSummary } from '../modules/skills/skills.contract.js';
 import type { IToolManualService } from '../modules/tool-manuals/tool-manuals.contract.js';
 import '../modules/tool-auth/tool-auth.middleware.js'; // Express Request augmentation (req.toolAuth)
+import { resolveConnectionScope, type IAgentScopeResolver } from '../modules/agent-scope/index.js';
 
 const log = logger('catalog-revision');
 
@@ -65,6 +66,14 @@ export function catalogRevision(
    * server already running keeps serving the view it read at startup.
    */
   views: readonly { uri: string; text: string }[] = [],
+  /**
+   * The connection's agent configuration — its path and the digest of its bytes, or
+   * why it cannot be used (`ConnectionScope.fingerprint`) — so an edit of
+   * the file is a new revision even when it changes nothing listed (a new
+   * skill entry that names nothing yet still moves it). Absent for
+   * Everything, whose revision is exactly what it was before agents existed.
+   */
+  agent: string | null = null,
 ): string {
   const lines = [
     ...[...manuals].sort(),
@@ -72,6 +81,7 @@ export function catalogRevision(
     ...skills.map(skillFingerprint).sort(),
     '\u0001',
     ...views.map((v) => `${v.uri}\u0000${createHash('sha256').update(v.text).digest('hex')}`).sort(),
+    ...(agent !== null ? ['\u0001', agent] : []),
   ];
   return createHash('sha256').update(lines.join('\n')).digest('hex').slice(0, 32);
 }
@@ -90,6 +100,8 @@ export function createCatalogRevisionRoutes(deps: {
   toolManuals: Pick<IToolManualService, 'catalogFingerprints'>;
   skills: Pick<ISkillService, 'listSkills'>;
   manualAuth: RequestHandler;
+  /** Resolves the scope of a connection made as an agent configuration (`modules/agent-scope`). */
+  agentScope?: Pick<IAgentScopeResolver, 'resolve'>;
   /** Connection-key/internal-token user id → email, for the per-caller ACL. */
   resolveUserEmail: (userId: string) => Promise<string | undefined>;
   /** The MCP App views served; absent on a deployment that serves none. */
@@ -104,16 +116,26 @@ export function createCatalogRevisionRoutes(deps: {
       // No resolvable caller is an EMPTY catalog, not a failure: that is what
       // both list surfaces answer such a caller, so the fingerprint agrees
       // with them rather than inventing a third verdict.
+      // A connection made as an agent configuration is fingerprinted over what IT
+      // loads, plus the file itself; Everything asks exactly what it always did.
+      const scope = await resolveConnectionScope(deps.agentScope, email, req.toolAuth?.agentPath);
+      const connectors = scope.connectorFilter();
+      const within = scope.skillFilter();
       const [manuals, skills] = email
-        ? await Promise.all([deps.toolManuals.catalogFingerprints(email), deps.skills.listSkills(email)])
+        ? await Promise.all([
+            connectors ? deps.toolManuals.catalogFingerprints(email, connectors) : deps.toolManuals.catalogFingerprints(email),
+            within ? deps.skills.listSkills(email, { within }) : deps.skills.listSkills(email),
+          ])
         : [[], []];
       // A manifest that cannot be read counts as no views, which is also what
       // the MCP endpoint serves in that state.
       const views = deps.mcpApps ? ((await deps.mcpApps.manifest().catch(() => null))?.resources ?? []) : [];
+      const connection = scope.toWire();
       res.json({
-        revision: catalogRevision(manuals, skills, views),
+        revision: catalogRevision(manuals, skills, views, scope.fingerprint()),
         tools: manuals.length,
         skills: skills.length,
+        ...(connection ? { connection } : {}),
       });
     } catch (err) {
       log.error('catalog-revision failed:', { err });

package/src/core/core-ports.ts

@@ -10,7 +10,34 @@ import type { IAccountAdmission } from '../modules/auth/account-admission.js';
 import type { IWriteAccess } from '../modules/write-access/write-access.js';
 import type { OnServerStart } from '../modules/workspace/startup/on-server-start.js';
 import type { AgentGuideHook } from '../modules/agent-guide/agent-guide.js';
+import type { IAgentScopeResolver } from '../modules/agent-scope/index.js';
 import type { EmbedNodeIdResolver } from '../modules/embed/embed.interface.js';
+import type { IWorkspaceService } from '@bevel-software/platform-shared';
+import type { IAccessControl } from '../modules/access/index.js';
+import type { KbContext } from '../shared/kb-context.js';
+import type { ITreeWalker } from '../shared/fs.contract.js';
+import type { IPluginLinkIndex } from '../modules/plugins/index.js';
+
+/**
+ * The core services a distribution's agent-scope resolver reads through,
+ * handed to `CorePorts.agentScope` when core makes it: the clones of the
+ * branches, the person's read gate, the branch model and knowledge-base
+ * layout, the disk walk that finds its configurations, and the plugin link
+ * index that says which plugins a `plugins:`-style entry stands for.
+ *
+ * Each is the service's CONTRACT, not its class: a resolver written against
+ * these runs on any implementation of them — core's own services in a
+ * deployment, a stand-in in a distribution's tests — and a resolver that
+ * needs more than a contract offers asks for the contract to grow, not for
+ * the class.
+ */
+export interface AgentScopeCollaborators {
+  workspaceService: IWorkspaceService;
+  accessControl: IAccessControl;
+  kb: KbContext;
+  disk: ITreeWalker;
+  pluginLinkIndex: IPluginLinkIndex;
+}
 
 /**
  * Every seam the enterprise overlay can fill in the CORE composition
@@ -112,6 +139,21 @@ export interface CorePorts {
    * `modules/agent-guide`.
    */
   agentGuide?: AgentGuideHook;
+  /**
+   * THIS distribution's agent configurations: what "Connect as" offers beside
+   * Everything, and what a connection made as one of them loads (see
+   * `modules/agent-scope`). Core owns the mechanism and no configuration —
+   * the file kind, where it lives and what its definition says are the
+   * distribution's, as the file kinds registered for access verbs are. A
+   * factory, since a resolver reads through core services that exist only
+   * once core is built: called ONCE, during construction, with those
+   * services (`AgentScopeCollaborators`), and its answer is the one resolver
+   * every surface consults from then on — the tool contexts, which capture it
+   * at construction, as much as the routes the server mounts later. Core
+   * default: `noAgentConfigurations()` — nothing is offered, and a connection
+   * recorded as some path loads nothing, never Everything.
+   */
+  agentScope?: (core: AgentScopeCollaborators) => IAgentScopeResolver;
   /**
    * Mirror this composition's branch model and knowledge-base layout onto the
    * shared package's PROCESS-WIDE live bindings (`DEFAULT_BRANCH`,

package/src/core/create-core-server.ts

@@ -3,6 +3,7 @@ import cors from 'cors';
 import path from 'node:path';
 import type { Router, RequestHandler } from 'express';
 import { createAuthRoutes } from '../modules/auth/auth.routes.js';
+import { authCookieSecure } from '../modules/auth/auth.middleware.js';
 import { createWorkspaceRoutes } from '../modules/workspace/workspace.routes.js';
 import {
   createAgentUploadRoutes,
@@ -364,6 +365,9 @@ export async function createCoreServer(
       core.authMiddleware,
       core.authProviders,
       core.config.loginPasswordEnabled,
+      // The cookie's Secure flag follows the scheme the deployment is reached
+      // on, as the SSO providers' does: one rule for every sign-in path.
+      { cookieSecure: authCookieSecure(core.config.publicBackendUrl) },
     ),
   );
 
@@ -383,6 +387,7 @@ export async function createCoreServer(
     core.internalTokenService,
     core.mcpOAuthProvider,
     core.mcpResourceMetadataUrl,
+    core.agentScopeService,
   ));
 
   // Remote sync — `POST /api/sync`, called by a git host's webhook or a
@@ -423,6 +428,7 @@ export async function createCoreServer(
     toolManualService: core.toolManualService,
     accessControl: core.accessControl,
     connectionProbe: core.connectionProbeService,
+    agents: core.agentScopeService,
     stateSecret: core.config.jwtSecret,
     publicBackendUrl: core.config.publicBackendUrl,
     publicFrontendUrl: core.config.publicFrontendUrl,
@@ -481,7 +487,7 @@ export async function createCoreServer(
   // because they are the only ones that gate their whole payload on the
   // caller's read access, so they take the access service and nothing else.
   registerChangeRequestReadTools(core.toolRegistry, toolsRouter, ta, th, core.accessControl, core.kb);
-  const workspaceTools = registerWorkspaceTools(core.toolRegistry, toolsRouter, ta, th, core.spillStore, core.docExtractService, core.accessControl, core.kb, agentAccessGate, core.routineWritePolicy, core.sessionSink, allowedToolsChecker, core.changeGate, core.agentUploadStore, core.agentGuide, core.agentDownloadStore, core.starterPackService, core.disk, core.patternMatcher);
+  const workspaceTools = registerWorkspaceTools(core.toolRegistry, toolsRouter, ta, th, core.spillStore, core.docExtractService, core.accessControl, core.kb, agentAccessGate, core.routineWritePolicy, core.sessionSink, allowedToolsChecker, core.changeGate, core.agentUploadStore, core.agentGuideStart, core.agentDownloadStore, core.starterPackService, core.disk, core.patternMatcher);
   // `open_page` — the knowledge-base page shown inside a chat. Registered
   // here, on the same router as the file tools, because it answers with
   // `read_file`'s own read: the read hook, the access gate and the
@@ -552,6 +558,7 @@ export async function createCoreServer(
     core.manualAuthMiddleware,
     async (userId) => (await core.authService.getUserById(userId))?.email,
     readOnlyHints,
+    core.agentScopeService,
   ));
   toolsRouter.use(createToolHintsAgentRoutes(readOnlyHints, core.manualAuthMiddleware));
   // The aggregated manual list (KB + the caller's accessible `.tool`s) + inline
@@ -568,6 +575,7 @@ export async function createCoreServer(
       disk: core.disk,
       pluginIndex: core.pluginIndexService,
     },
+    core.agentScopeService,
   ));
   // What every connected agent is told at session start, as the hosted proxy
   // composes it: read by the local `hexis-mcp` bridge at startup and by the
@@ -582,6 +590,7 @@ export async function createCoreServer(
     skills: core.skillService,
     manualAuth: core.manualAuthMiddleware,
     resolveUserEmail: async (userId) => (await core.authService.getUserById(userId))?.email,
+    agentScope: core.agentScopeService,
     // The views move the revision too: a release that changes a view and no
     // manual would otherwise leave a running local server on the old one.
     mcpApps: core.mcpAppService,
@@ -596,6 +605,7 @@ export async function createCoreServer(
     core.secretsVaultService,
     core.manualAuthMiddleware,
     async (userId) => (await core.authService.getUserById(userId))?.email,
+    core.agentScopeService,
   ));
   app.use('/api', toolsRouter);
 
@@ -638,6 +648,7 @@ export async function createCoreServer(
     createPluginCreationRoutes(
       core.pluginProvisionService,
       async (req) => (req.userId ? ((await core.authService.getUserById(req.userId)) ?? null) : null),
+      core.agentScopeService,
     ),
   );
 
@@ -705,6 +716,7 @@ export async function createCoreServer(
     core.eventBus,
     core.db,
     core.kb,
+    core.disk,
     [core.config.adminEmail],
   ));
   // Asking for Can edit or Owner on an item from its Manage access dialog, and
@@ -904,6 +916,7 @@ export async function createCoreServer(
       clientNameFor: (st) => core.githubFacade.clientNameFor(st),
       completeConsent: (userId, st) => core.githubFacade.completeConsent(userId, st),
     },
+    agents: core.agentScopeService,
   }));
 
   // What an Owner pastes into Claude's admin settings to register this