@bevel-software/platform-core-backend 0.34.0 → 0.36.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (908) hide show
  1. package/agent-guide/access-control.md +146 -300
  2. package/agent-guide/conventions.md +23 -25
  3. package/agent-guide/directory-structure.md +72 -120
  4. package/agent-guide/drafts-and-change-requests.md +92 -0
  5. package/agent-guide/for-git-users.md +47 -0
  6. package/agent-guide/glossary.md +36 -0
  7. package/agent-guide/how-agents-find-things.md +49 -0
  8. package/agent-guide/html-views.md +16 -11
  9. package/agent-guide/new-knowledge-base.md +9 -8
  10. package/agent-guide/onboarding.md +111 -0
  11. package/agent-guide/skills.md +67 -42
  12. package/agent-guide/start-here.md +66 -0
  13. package/agent-guide/tool-manuals.md +133 -154
  14. package/agent-guide/tools.md +67 -0
  15. package/agent-guide/where-a-new-file-goes.md +45 -28
  16. package/dist/core/catalog-cache-invalidation.d.ts +2 -2
  17. package/dist/core/catalog-cache-invalidation.d.ts.map +1 -1
  18. package/dist/core/compose-embed.d.ts +2 -2
  19. package/dist/core/compose-embed.d.ts.map +1 -1
  20. package/dist/core/compose-embed.js +1 -1
  21. package/dist/core/compose-embed.js.map +1 -1
  22. package/dist/core/core-ports.d.ts +19 -4
  23. package/dist/core/core-ports.d.ts.map +1 -1
  24. package/dist/core/core-ports.js.map +1 -1
  25. package/dist/core/create-core-server.d.ts.map +1 -1
  26. package/dist/core/create-core-server.js +27 -25
  27. package/dist/core/create-core-server.js.map +1 -1
  28. package/dist/core/create-core-services.d.ts +25 -13
  29. package/dist/core/create-core-services.d.ts.map +1 -1
  30. package/dist/core/create-core-services.js +75 -60
  31. package/dist/core/create-core-services.js.map +1 -1
  32. package/dist/core/lifecycle.d.ts +4 -4
  33. package/dist/core/lifecycle.d.ts.map +1 -1
  34. package/dist/core/lifecycle.js +5 -5
  35. package/dist/core/lifecycle.js.map +1 -1
  36. package/dist/core-config.d.ts +2 -2
  37. package/dist/core-config.js +3 -3
  38. package/dist/core-config.js.map +1 -1
  39. package/dist/index.d.ts +4 -4
  40. package/dist/index.d.ts.map +1 -1
  41. package/dist/index.js +3 -3
  42. package/dist/index.js.map +1 -1
  43. package/dist/modules/access/access-control.interface.d.ts +22 -0
  44. package/dist/modules/access/access-control.interface.d.ts.map +1 -1
  45. package/dist/modules/access/access-control.service.d.ts +3 -1
  46. package/dist/modules/access/access-control.service.d.ts.map +1 -1
  47. package/dist/modules/access/access-control.service.js +76 -1
  48. package/dist/modules/access/access-control.service.js.map +1 -1
  49. package/dist/modules/access/access-declarations.d.ts +2 -2
  50. package/dist/modules/access/access-declarations.d.ts.map +1 -1
  51. package/dist/modules/access/access-declarations.js +2 -2
  52. package/dist/modules/access/access-declarations.js.map +1 -1
  53. package/dist/modules/access/access-mutation.service.d.ts +2 -2
  54. package/dist/modules/access/access-mutation.service.d.ts.map +1 -1
  55. package/dist/modules/access/access-mutation.service.js +2 -2
  56. package/dist/modules/access/access-mutation.service.js.map +1 -1
  57. package/dist/modules/access/access-requests.routes.d.ts +2 -2
  58. package/dist/modules/access/access-requests.routes.d.ts.map +1 -1
  59. package/dist/modules/access/access-requests.routes.js +5 -5
  60. package/dist/modules/access/access-requests.routes.js.map +1 -1
  61. package/dist/modules/access/access-requests.service.d.ts +2 -2
  62. package/dist/modules/access/access-requests.service.d.ts.map +1 -1
  63. package/dist/modules/access/access-requests.service.js +11 -11
  64. package/dist/modules/access/access-requests.service.js.map +1 -1
  65. package/dist/modules/access/access.routes.d.ts +2 -2
  66. package/dist/modules/access/access.routes.d.ts.map +1 -1
  67. package/dist/modules/access/access.routes.js +32 -13
  68. package/dist/modules/access/access.routes.js.map +1 -1
  69. package/dist/modules/access/admin-locked-commit.d.ts +5 -5
  70. package/dist/modules/access/admin-locked-commit.d.ts.map +1 -1
  71. package/dist/modules/access/admin-locked-commit.js +7 -7
  72. package/dist/modules/access/admin-locked-commit.js.map +1 -1
  73. package/dist/modules/access/admin-route-helpers.d.ts +1 -1
  74. package/dist/modules/access/admin-route-helpers.js +5 -5
  75. package/dist/modules/access/admin-route-helpers.js.map +1 -1
  76. package/dist/modules/access/change-read-gate.d.ts +1 -1
  77. package/dist/modules/access/change-read-gate.js +1 -1
  78. package/dist/modules/access/groups-admin.service.d.ts +7 -7
  79. package/dist/modules/access/groups-admin.service.d.ts.map +1 -1
  80. package/dist/modules/access/groups-admin.service.js +6 -6
  81. package/dist/modules/access/groups-admin.service.js.map +1 -1
  82. package/dist/modules/access/index.d.ts +1 -1
  83. package/dist/modules/access/index.d.ts.map +1 -1
  84. package/dist/modules/access/reference-scan.d.ts +1 -1
  85. package/dist/modules/access/roles-admin.service.d.ts +7 -7
  86. package/dist/modules/access/roles-admin.service.d.ts.map +1 -1
  87. package/dist/modules/access/roles-admin.service.js +8 -8
  88. package/dist/modules/access/roles-admin.service.js.map +1 -1
  89. package/dist/modules/access/synced-groups-committer.d.ts +4 -4
  90. package/dist/modules/access/synced-groups-committer.d.ts.map +1 -1
  91. package/dist/modules/access/synced-groups-committer.js +7 -7
  92. package/dist/modules/access/synced-groups-committer.js.map +1 -1
  93. package/dist/modules/access/user-access-removal.service.d.ts +6 -6
  94. package/dist/modules/access/user-access-removal.service.d.ts.map +1 -1
  95. package/dist/modules/access/user-access-removal.service.js +4 -4
  96. package/dist/modules/access/user-access-removal.service.js.map +1 -1
  97. package/dist/modules/access-model/access-errors.d.ts +4 -4
  98. package/dist/modules/access-model/access-errors.d.ts.map +1 -1
  99. package/dist/modules/access-model/access-errors.js +4 -4
  100. package/dist/modules/access-model/access-errors.js.map +1 -1
  101. package/dist/modules/access-model/access-grammar.d.ts +1 -1
  102. package/dist/modules/access-model/access-grammar.js +4 -4
  103. package/dist/modules/access-model/change-gate.d.ts +1 -1
  104. package/dist/modules/access-model/change-gate.js +1 -1
  105. package/dist/modules/access-model/roles-yaml-guard.d.ts +4 -4
  106. package/dist/modules/access-model/roles-yaml-guard.d.ts.map +1 -1
  107. package/dist/modules/access-model/roles-yaml-guard.js +4 -4
  108. package/dist/modules/access-model/roles-yaml-guard.js.map +1 -1
  109. package/dist/modules/agent-guide/agent-guide.d.ts +63 -18
  110. package/dist/modules/agent-guide/agent-guide.d.ts.map +1 -1
  111. package/dist/modules/agent-guide/agent-guide.js +144 -30
  112. package/dist/modules/agent-guide/agent-guide.js.map +1 -1
  113. package/dist/modules/agent-guide/agent-guide.tools.d.ts +6 -2
  114. package/dist/modules/agent-guide/agent-guide.tools.d.ts.map +1 -1
  115. package/dist/modules/agent-guide/agent-guide.tools.js +45 -31
  116. package/dist/modules/agent-guide/agent-guide.tools.js.map +1 -1
  117. package/dist/modules/agent-guide/guide-budget.d.ts +51 -0
  118. package/dist/modules/agent-guide/guide-budget.d.ts.map +1 -0
  119. package/dist/modules/agent-guide/guide-budget.js +71 -0
  120. package/dist/modules/agent-guide/guide-budget.js.map +1 -0
  121. package/dist/modules/agent-guide/index.d.ts +2 -1
  122. package/dist/modules/agent-guide/index.d.ts.map +1 -1
  123. package/dist/modules/agent-guide/index.js +2 -1
  124. package/dist/modules/agent-guide/index.js.map +1 -1
  125. package/dist/modules/agent-instructions/agent-instructions.routes.d.ts +12 -5
  126. package/dist/modules/agent-instructions/agent-instructions.routes.d.ts.map +1 -1
  127. package/dist/modules/agent-instructions/agent-instructions.routes.js +13 -6
  128. package/dist/modules/agent-instructions/agent-instructions.routes.js.map +1 -1
  129. package/dist/modules/agent-instructions/compose.d.ts +15 -8
  130. package/dist/modules/agent-instructions/compose.d.ts.map +1 -1
  131. package/dist/modules/agent-instructions/compose.js +28 -10
  132. package/dist/modules/agent-instructions/compose.js.map +1 -1
  133. package/dist/modules/agent-instructions/shared-file-rules.d.ts +14 -6
  134. package/dist/modules/agent-instructions/shared-file-rules.d.ts.map +1 -1
  135. package/dist/modules/agent-instructions/shared-file-rules.js +60 -18
  136. package/dist/modules/agent-instructions/shared-file-rules.js.map +1 -1
  137. package/dist/modules/auth/account-erasure.service.d.ts +36 -7
  138. package/dist/modules/auth/account-erasure.service.d.ts.map +1 -1
  139. package/dist/modules/auth/account-erasure.service.js +30 -10
  140. package/dist/modules/auth/account-erasure.service.js.map +1 -1
  141. package/dist/modules/auth/account-hooks.d.ts +20 -0
  142. package/dist/modules/auth/account-hooks.d.ts.map +1 -1
  143. package/dist/modules/auth/account-hooks.js +10 -0
  144. package/dist/modules/auth/account-hooks.js.map +1 -1
  145. package/dist/modules/auth/account-switch-lock.js +2 -2
  146. package/dist/modules/auth/account-switch-lock.js.map +1 -1
  147. package/dist/modules/auth/account.routes.d.ts +7 -2
  148. package/dist/modules/auth/account.routes.d.ts.map +1 -1
  149. package/dist/modules/auth/account.routes.js +23 -4
  150. package/dist/modules/auth/account.routes.js.map +1 -1
  151. package/dist/modules/auth/auth.service.d.ts +1 -1
  152. package/dist/modules/auth/auth.service.js +4 -4
  153. package/dist/modules/auth/auth.service.js.map +1 -1
  154. package/dist/modules/auth/index.d.ts +1 -0
  155. package/dist/modules/auth/index.d.ts.map +1 -1
  156. package/dist/modules/code-mode/code-mode.tool.js +2 -2
  157. package/dist/modules/code-mode/code-mode.tool.js.map +1 -1
  158. package/dist/modules/connection-probe/connection-probe.service.d.ts +0 -12
  159. package/dist/modules/connection-probe/connection-probe.service.d.ts.map +1 -1
  160. package/dist/modules/connection-probe/connection-probe.service.js +1 -38
  161. package/dist/modules/connection-probe/connection-probe.service.js.map +1 -1
  162. package/dist/modules/database/core-schema.js +2 -2
  163. package/dist/modules/database/core-schema.js.map +1 -1
  164. package/dist/modules/diff/diff.routes.d.ts +3 -3
  165. package/dist/modules/diff/diff.routes.d.ts.map +1 -1
  166. package/dist/modules/diff/diff.routes.js +7 -7
  167. package/dist/modules/diff/diff.routes.js.map +1 -1
  168. package/dist/modules/embed/embed.routes.js +1 -1
  169. package/dist/modules/embed/embed.routes.js.map +1 -1
  170. package/dist/modules/embed/embed.service.d.ts +4 -4
  171. package/dist/modules/embed/embed.service.d.ts.map +1 -1
  172. package/dist/modules/embed/embed.service.js +18 -18
  173. package/dist/modules/embed/embed.service.js.map +1 -1
  174. package/dist/modules/kb-fs/branch-name.js +8 -8
  175. package/dist/modules/kb-fs/branch-name.js.map +1 -1
  176. package/dist/modules/kb-fs/file-change-notifier.d.ts +2 -2
  177. package/dist/modules/kb-fs/locking-filesystem.d.ts +9 -9
  178. package/dist/modules/kb-fs/locking-filesystem.d.ts.map +1 -1
  179. package/dist/modules/kb-fs/locking-filesystem.js +27 -27
  180. package/dist/modules/kb-fs/locking-filesystem.js.map +1 -1
  181. package/dist/modules/kb-fs/repo-path.js +5 -5
  182. package/dist/modules/kb-fs/repo-path.js.map +1 -1
  183. package/dist/modules/kb-fs/tmp-ref.d.ts +2 -2
  184. package/dist/modules/kb-fs/tmp-ref.d.ts.map +1 -1
  185. package/dist/modules/kb-fs/tmp-ref.js +2 -2
  186. package/dist/modules/kb-fs/tmp-ref.js.map +1 -1
  187. package/dist/modules/kb-sync/index.d.ts +1 -1
  188. package/dist/modules/kb-sync/index.d.ts.map +1 -1
  189. package/dist/modules/kb-sync/kb-sync.interface.d.ts +3 -3
  190. package/dist/modules/kb-sync/kb-sync.interface.d.ts.map +1 -1
  191. package/dist/modules/kb-sync/kb-sync.service.d.ts +3 -3
  192. package/dist/modules/kb-sync/kb-sync.service.d.ts.map +1 -1
  193. package/dist/modules/kb-sync/kb-sync.service.js +10 -10
  194. package/dist/modules/kb-sync/kb-sync.service.js.map +1 -1
  195. package/dist/modules/mcp/mcp.service.d.ts +11 -4
  196. package/dist/modules/mcp/mcp.service.d.ts.map +1 -1
  197. package/dist/modules/mcp/mcp.service.js +80 -53
  198. package/dist/modules/mcp/mcp.service.js.map +1 -1
  199. package/dist/modules/onboarding/onboarding.contract.d.ts +1 -1
  200. package/dist/modules/onboarding/onboarding.routes.js +2 -2
  201. package/dist/modules/onboarding/onboarding.routes.js.map +1 -1
  202. package/dist/modules/onboarding/starter-pack.service.d.ts +4 -4
  203. package/dist/modules/onboarding/starter-pack.service.d.ts.map +1 -1
  204. package/dist/modules/onboarding/starter-pack.service.js +4 -4
  205. package/dist/modules/onboarding/starter-pack.service.js.map +1 -1
  206. package/dist/modules/plugins/join-request-jobs.service.d.ts +2 -2
  207. package/dist/modules/plugins/join-request-jobs.service.d.ts.map +1 -1
  208. package/dist/modules/plugins/join-request-jobs.service.js +7 -7
  209. package/dist/modules/plugins/join-request-jobs.service.js.map +1 -1
  210. package/dist/modules/plugins/join-requests.service.d.ts +3 -3
  211. package/dist/modules/plugins/join-requests.service.d.ts.map +1 -1
  212. package/dist/modules/plugins/join-requests.service.js +5 -5
  213. package/dist/modules/plugins/join-requests.service.js.map +1 -1
  214. package/dist/modules/plugins/plugin-rename.service.js +1 -1
  215. package/dist/modules/plugins/plugin-rename.service.js.map +1 -1
  216. package/dist/modules/plugins/plugins.routes.d.ts +2 -2
  217. package/dist/modules/plugins/plugins.routes.d.ts.map +1 -1
  218. package/dist/modules/plugins/plugins.routes.js +8 -8
  219. package/dist/modules/plugins/plugins.routes.js.map +1 -1
  220. package/dist/modules/secrets-vault/db-secrets-vault.service.d.ts +87 -2
  221. package/dist/modules/secrets-vault/db-secrets-vault.service.d.ts.map +1 -1
  222. package/dist/modules/secrets-vault/db-secrets-vault.service.js +635 -74
  223. package/dist/modules/secrets-vault/db-secrets-vault.service.js.map +1 -1
  224. package/dist/modules/secrets-vault/index.d.ts +3 -2
  225. package/dist/modules/secrets-vault/index.d.ts.map +1 -1
  226. package/dist/modules/secrets-vault/index.js +2 -1
  227. package/dist/modules/secrets-vault/index.js.map +1 -1
  228. package/dist/modules/secrets-vault/managed-sign-in-erasure.d.ts +36 -0
  229. package/dist/modules/secrets-vault/managed-sign-in-erasure.d.ts.map +1 -0
  230. package/dist/modules/secrets-vault/managed-sign-in-erasure.js +37 -0
  231. package/dist/modules/secrets-vault/managed-sign-in-erasure.js.map +1 -0
  232. package/dist/modules/secrets-vault/secrets-vault.contract.d.ts +205 -11
  233. package/dist/modules/secrets-vault/secrets-vault.contract.d.ts.map +1 -1
  234. package/dist/modules/secrets-vault/secrets-vault.contract.js +27 -0
  235. package/dist/modules/secrets-vault/secrets-vault.contract.js.map +1 -1
  236. package/dist/modules/secrets-vault/secrets-vault.routes.d.ts +7 -1
  237. package/dist/modules/secrets-vault/secrets-vault.routes.d.ts.map +1 -1
  238. package/dist/modules/secrets-vault/secrets-vault.routes.js +206 -45
  239. package/dist/modules/secrets-vault/secrets-vault.routes.js.map +1 -1
  240. package/dist/modules/settings/connection-check.js +1 -1
  241. package/dist/modules/settings/connection-check.js.map +1 -1
  242. package/dist/modules/settings/deployment-settings.service.js +1 -1
  243. package/dist/modules/settings/git-root-folders.js +1 -1
  244. package/dist/modules/settings/git-root-folders.js.map +1 -1
  245. package/dist/modules/settings/oidc-check.d.ts.map +1 -1
  246. package/dist/modules/settings/oidc-check.js +5 -17
  247. package/dist/modules/settings/oidc-check.js.map +1 -1
  248. package/dist/modules/settings/setup.routes.d.ts +1 -1
  249. package/dist/modules/settings/setup.routes.js +1 -1
  250. package/dist/modules/skills/pending-skills.service.d.ts +3 -3
  251. package/dist/modules/skills/pending-skills.service.d.ts.map +1 -1
  252. package/dist/modules/skills/pending-skills.service.js +4 -4
  253. package/dist/modules/skills/pending-skills.service.js.map +1 -1
  254. package/dist/modules/skills/skill-access-requests.routes.d.ts +2 -2
  255. package/dist/modules/skills/skill-access-requests.routes.d.ts.map +1 -1
  256. package/dist/modules/skills/skill-access-requests.routes.js +5 -5
  257. package/dist/modules/skills/skill-access-requests.routes.js.map +1 -1
  258. package/dist/modules/skills/skills.tools.js +1 -1
  259. package/dist/modules/skills/skills.tools.js.map +1 -1
  260. package/dist/modules/tool-helpers/tool-context.d.ts +4 -4
  261. package/dist/modules/tool-helpers/tool-context.d.ts.map +1 -1
  262. package/dist/modules/tool-helpers/tool-context.js +2 -2
  263. package/dist/modules/tool-helpers/tool-context.js.map +1 -1
  264. package/dist/modules/tool-helpers/tool-def.js +1 -1
  265. package/dist/modules/tool-helpers/tool-def.js.map +1 -1
  266. package/dist/modules/tool-helpers/tool-handler.js +2 -2
  267. package/dist/modules/tool-helpers/tool-handler.js.map +1 -1
  268. package/dist/modules/tool-helpers/tool.contract.d.ts +4 -4
  269. package/dist/modules/tool-helpers/tool.contract.d.ts.map +1 -1
  270. package/dist/modules/tool-manuals/mcp-json-discovery.d.ts +7 -1
  271. package/dist/modules/tool-manuals/mcp-json-discovery.d.ts.map +1 -1
  272. package/dist/modules/tool-manuals/mcp-json-discovery.js +69 -38
  273. package/dist/modules/tool-manuals/mcp-json-discovery.js.map +1 -1
  274. package/dist/modules/tool-manuals/mcp-server-edit.service.js +1 -1
  275. package/dist/modules/tool-manuals/mcp-server-edit.service.js.map +1 -1
  276. package/dist/modules/tool-manuals/pending-tools.service.d.ts +3 -3
  277. package/dist/modules/tool-manuals/pending-tools.service.d.ts.map +1 -1
  278. package/dist/modules/tool-manuals/pending-tools.service.js +4 -4
  279. package/dist/modules/tool-manuals/pending-tools.service.js.map +1 -1
  280. package/dist/modules/tool-manuals/tool-delete.service.js +1 -1
  281. package/dist/modules/tool-manuals/tool-delete.service.js.map +1 -1
  282. package/dist/modules/tool-manuals/tool-manuals.contract.d.ts +70 -3
  283. package/dist/modules/tool-manuals/tool-manuals.contract.d.ts.map +1 -1
  284. package/dist/modules/tool-manuals/tool-manuals.service.d.ts +18 -8
  285. package/dist/modules/tool-manuals/tool-manuals.service.d.ts.map +1 -1
  286. package/dist/modules/tool-manuals/tool-manuals.service.js +166 -49
  287. package/dist/modules/tool-manuals/tool-manuals.service.js.map +1 -1
  288. package/dist/modules/tool-manuals/tool-manuals.tools.d.ts +11 -2
  289. package/dist/modules/tool-manuals/tool-manuals.tools.d.ts.map +1 -1
  290. package/dist/modules/tool-manuals/tool-manuals.tools.js +66 -24
  291. package/dist/modules/tool-manuals/tool-manuals.tools.js.map +1 -1
  292. package/dist/modules/version-control/agent-tools/change-request-read-shape.d.ts.map +1 -0
  293. package/dist/modules/version-control/agent-tools/change-request-read-shape.js.map +1 -0
  294. package/dist/modules/version-control/agent-tools/change-request-read.tools.d.ts.map +1 -0
  295. package/dist/modules/{workflow → version-control}/agent-tools/change-request-read.tools.js +2 -2
  296. package/dist/modules/version-control/agent-tools/change-request-read.tools.js.map +1 -0
  297. package/dist/modules/version-control/agent-tools/change-request-summary.d.ts.map +1 -0
  298. package/dist/modules/version-control/agent-tools/change-request-summary.js.map +1 -0
  299. package/dist/modules/{workflow/agent-tools/workflow.tools.d.ts → version-control/agent-tools/version-control.tools.d.ts} +4 -4
  300. package/dist/modules/version-control/agent-tools/version-control.tools.d.ts.map +1 -0
  301. package/dist/modules/{workflow/agent-tools/workflow.tools.js → version-control/agent-tools/version-control.tools.js} +53 -49
  302. package/dist/modules/version-control/agent-tools/version-control.tools.js.map +1 -0
  303. package/dist/modules/{workflow → version-control}/change-request-hooks.d.ts +1 -1
  304. package/dist/modules/version-control/change-request-hooks.d.ts.map +1 -0
  305. package/dist/modules/version-control/change-request-hooks.js.map +1 -0
  306. package/dist/modules/version-control/change-request-review/approval-lock.d.ts.map +1 -0
  307. package/dist/modules/version-control/change-request-review/approval-lock.js.map +1 -0
  308. package/dist/modules/{workflow/review-workflow/review-workflow.interface.d.ts → version-control/change-request-review/change-request-review.interface.d.ts} +2 -2
  309. package/dist/modules/version-control/change-request-review/change-request-review.interface.d.ts.map +1 -0
  310. package/dist/modules/version-control/change-request-review/change-request-review.interface.js +2 -0
  311. package/dist/modules/version-control/change-request-review/change-request-review.interface.js.map +1 -0
  312. package/dist/modules/{workflow/review-workflow/review-workflow.service.d.ts → version-control/change-request-review/change-request-review.service.d.ts} +3 -3
  313. package/dist/modules/version-control/change-request-review/change-request-review.service.d.ts.map +1 -0
  314. package/dist/modules/{workflow/review-workflow/review-workflow.service.js → version-control/change-request-review/change-request-review.service.js} +26 -26
  315. package/dist/modules/version-control/change-request-review/change-request-review.service.js.map +1 -0
  316. package/dist/modules/{workflow → version-control}/event-bus.d.ts +8 -8
  317. package/dist/modules/version-control/event-bus.d.ts.map +1 -0
  318. package/dist/modules/{workflow → version-control}/event-bus.js +4 -4
  319. package/dist/modules/version-control/event-bus.js.map +1 -0
  320. package/dist/modules/{workflow → version-control}/events-delivery.d.ts +4 -4
  321. package/dist/modules/version-control/events-delivery.d.ts.map +1 -0
  322. package/dist/modules/version-control/events-delivery.js.map +1 -0
  323. package/dist/modules/{workflow → version-control}/events.routes.d.ts +4 -4
  324. package/dist/modules/version-control/events.routes.d.ts.map +1 -0
  325. package/dist/modules/version-control/events.routes.js.map +1 -0
  326. package/dist/modules/{workflow → version-control}/file-lock.service.d.ts +2 -2
  327. package/dist/modules/version-control/file-lock.service.d.ts.map +1 -0
  328. package/dist/modules/{workflow → version-control}/file-lock.service.js +6 -6
  329. package/dist/modules/version-control/file-lock.service.js.map +1 -0
  330. package/dist/modules/version-control/git/change-request-link.d.ts.map +1 -0
  331. package/dist/modules/version-control/git/change-request-link.js.map +1 -0
  332. package/dist/modules/version-control/git/git-version.d.ts.map +1 -0
  333. package/dist/modules/version-control/git/git-version.js.map +1 -0
  334. package/dist/modules/{workflow → version-control}/git/git.service.d.ts +8 -8
  335. package/dist/modules/version-control/git/git.service.d.ts.map +1 -0
  336. package/dist/modules/{workflow → version-control}/git/git.service.js +53 -53
  337. package/dist/modules/version-control/git/git.service.js.map +1 -0
  338. package/dist/modules/version-control/git/merge-commit.d.ts.map +1 -0
  339. package/dist/modules/version-control/git/merge-commit.js.map +1 -0
  340. package/dist/modules/version-control/git/node-git-runner.d.ts.map +1 -0
  341. package/dist/modules/{workflow → version-control}/git/node-git-runner.js +1 -1
  342. package/dist/modules/version-control/git/node-git-runner.js.map +1 -0
  343. package/dist/modules/{workflow → version-control}/git/pull-request.service.d.ts +5 -5
  344. package/dist/modules/version-control/git/pull-request.service.d.ts.map +1 -0
  345. package/dist/modules/{workflow → version-control}/git/pull-request.service.js +10 -10
  346. package/dist/modules/version-control/git/pull-request.service.js.map +1 -0
  347. package/dist/modules/{workflow → version-control}/index.d.ts +6 -5
  348. package/dist/modules/version-control/index.d.ts.map +1 -0
  349. package/dist/modules/{workflow → version-control}/index.js +3 -2
  350. package/dist/modules/version-control/index.js.map +1 -0
  351. package/dist/modules/{workflow → version-control}/pending-commits.service.d.ts +2 -2
  352. package/dist/modules/version-control/pending-commits.service.d.ts.map +1 -0
  353. package/dist/modules/{workflow → version-control}/pending-commits.service.js +2 -2
  354. package/dist/modules/version-control/pending-commits.service.js.map +1 -0
  355. package/dist/modules/{workflow → version-control}/pending-commits.worker.d.ts +5 -5
  356. package/dist/modules/version-control/pending-commits.worker.d.ts.map +1 -0
  357. package/dist/modules/{workflow → version-control}/pending-commits.worker.js +3 -3
  358. package/dist/modules/version-control/pending-commits.worker.js.map +1 -0
  359. package/dist/modules/{workflow → version-control}/read-on-branch.d.ts +2 -2
  360. package/dist/modules/version-control/read-on-branch.d.ts.map +1 -0
  361. package/dist/modules/{workflow → version-control}/read-on-branch.js +2 -2
  362. package/dist/modules/version-control/read-on-branch.js.map +1 -0
  363. package/dist/modules/version-control/recovery-bot.d.ts.map +1 -0
  364. package/dist/modules/version-control/recovery-bot.js.map +1 -0
  365. package/dist/modules/version-control/sanitize-error.d.ts.map +1 -0
  366. package/dist/modules/version-control/sanitize-error.js.map +1 -0
  367. package/dist/modules/{workflow/workflow-hooks.d.ts → version-control/version-control-hooks.d.ts} +4 -4
  368. package/dist/modules/version-control/version-control-hooks.d.ts.map +1 -0
  369. package/dist/modules/{workflow/workflow-hooks.js → version-control/version-control-hooks.js} +3 -3
  370. package/dist/modules/version-control/version-control-hooks.js.map +1 -0
  371. package/dist/modules/{workflow/workflow.routes.d.ts → version-control/version-control.routes.d.ts} +6 -5
  372. package/dist/modules/version-control/version-control.routes.d.ts.map +1 -0
  373. package/dist/modules/{workflow/workflow.routes.js → version-control/version-control.routes.js} +61 -60
  374. package/dist/modules/version-control/version-control.routes.js.map +1 -0
  375. package/dist/modules/{workflow/workflow.service.d.ts → version-control/version-control.service.d.ts} +26 -31
  376. package/dist/modules/version-control/version-control.service.d.ts.map +1 -0
  377. package/dist/modules/{workflow/workflow.service.js → version-control/version-control.service.js} +89 -94
  378. package/dist/modules/version-control/version-control.service.js.map +1 -0
  379. package/dist/modules/workspace/agent-access.gate.d.ts +6 -6
  380. package/dist/modules/workspace/agent-access.gate.d.ts.map +1 -1
  381. package/dist/modules/workspace/agent-access.gate.js +2 -2
  382. package/dist/modules/workspace/agent-access.gate.js.map +1 -1
  383. package/dist/modules/workspace/git-internals.middleware.d.ts +1 -1
  384. package/dist/modules/workspace/git-internals.middleware.js +2 -2
  385. package/dist/modules/workspace/kb-repository.js +1 -1
  386. package/dist/modules/workspace/kb-repository.js.map +1 -1
  387. package/dist/modules/workspace/startup/kb-git.d.ts +1 -1
  388. package/dist/modules/workspace/startup/kb-git.d.ts.map +1 -1
  389. package/dist/modules/workspace/startup/kb-git.js +1 -1
  390. package/dist/modules/workspace/startup/kb-git.js.map +1 -1
  391. package/dist/modules/workspace/startup/steps/seed-tree.d.ts +2 -2
  392. package/dist/modules/workspace/startup/steps/seed-tree.d.ts.map +1 -1
  393. package/dist/modules/workspace/startup/steps/seed-tree.js +1 -1
  394. package/dist/modules/workspace/startup/steps/seed-tree.js.map +1 -1
  395. package/dist/modules/workspace/startup/steps/template-files.step.d.ts +2 -2
  396. package/dist/modules/workspace/startup/steps/template-files.step.d.ts.map +1 -1
  397. package/dist/modules/workspace/startup/steps/template-files.step.js +2 -2
  398. package/dist/modules/workspace/startup/steps/template-files.step.js.map +1 -1
  399. package/dist/modules/workspace/startup/steps/template-source.d.ts +17 -4
  400. package/dist/modules/workspace/startup/steps/template-source.d.ts.map +1 -1
  401. package/dist/modules/workspace/startup/steps/template-source.js +8 -5
  402. package/dist/modules/workspace/startup/steps/template-source.js.map +1 -1
  403. package/dist/modules/workspace/workspace-tmp.js +3 -3
  404. package/dist/modules/workspace/workspace-tmp.js.map +1 -1
  405. package/dist/modules/workspace/workspace.routes.d.ts +4 -4
  406. package/dist/modules/workspace/workspace.routes.d.ts.map +1 -1
  407. package/dist/modules/workspace/workspace.routes.js +22 -22
  408. package/dist/modules/workspace/workspace.routes.js.map +1 -1
  409. package/dist/modules/workspace/workspace.service.d.ts +6 -6
  410. package/dist/modules/workspace/workspace.service.d.ts.map +1 -1
  411. package/dist/modules/workspace/workspace.service.js +11 -11
  412. package/dist/modules/workspace/workspace.service.js.map +1 -1
  413. package/dist/modules/workspace/workspace.tools.d.ts +5 -3
  414. package/dist/modules/workspace/workspace.tools.d.ts.map +1 -1
  415. package/dist/modules/workspace/workspace.tools.js +85 -30
  416. package/dist/modules/workspace/workspace.tools.js.map +1 -1
  417. package/dist/shared/canonical-file-identity.d.ts +2 -2
  418. package/dist/shared/canonical-file-identity.js +5 -5
  419. package/dist/shared/canonical-file-identity.js.map +1 -1
  420. package/dist/shared/domain-errors.d.ts +39 -39
  421. package/dist/shared/domain-errors.d.ts.map +1 -1
  422. package/dist/shared/domain-errors.js +44 -44
  423. package/dist/shared/domain-errors.js.map +1 -1
  424. package/dist/shared/git.contract.d.ts +1 -1
  425. package/dist/shared/git.contract.js +1 -1
  426. package/dist/shared/http-errors.d.ts +3 -3
  427. package/dist/shared/http-errors.d.ts.map +1 -1
  428. package/dist/shared/http-errors.js +1 -1
  429. package/dist/shared/http-errors.js.map +1 -1
  430. package/dist/shared/oauth-token-error.d.ts +23 -0
  431. package/dist/shared/oauth-token-error.d.ts.map +1 -0
  432. package/dist/shared/oauth-token-error.js +47 -0
  433. package/dist/shared/oauth-token-error.js.map +1 -0
  434. package/dist/shared/pending-proposals.d.ts +3 -3
  435. package/dist/shared/pending-proposals.d.ts.map +1 -1
  436. package/dist/shared/pending-proposals.js +2 -2
  437. package/dist/shared/pending-proposals.js.map +1 -1
  438. package/dist/shared/read-capped.d.ts +19 -0
  439. package/dist/shared/read-capped.d.ts.map +1 -0
  440. package/dist/shared/read-capped.js +45 -0
  441. package/dist/shared/read-capped.js.map +1 -0
  442. package/dist/tenancy/static-tenant-source.js +1 -1
  443. package/dist/tenancy/static-tenant-source.js.map +1 -1
  444. package/migrations/0012_agent_audit.sql +40 -40
  445. package/migrations/0013_agent_identity_and_key_soft_delete.sql +29 -29
  446. package/migrations/meta/0012_snapshot.json +2246 -2246
  447. package/migrations/meta/0013_snapshot.json +2258 -2258
  448. package/package.json +5 -4
  449. package/src/__tests__/account-admin.ts +27 -0
  450. package/src/__tests__/hexis-catalog.ts +144 -0
  451. package/src/__tests__/kb-context.ts +30 -30
  452. package/src/__tests__/kb-layout-config.test.ts +21 -0
  453. package/src/__tests__/open-change-gate.ts +1 -1
  454. package/src/__tests__/real-disk.ts +21 -0
  455. package/src/__tests__/tokens.ts +19 -0
  456. package/src/__tests__/tool-handler.ts +15 -0
  457. package/src/__tests__/tool-manuals.ts +32 -0
  458. package/src/__tests__/tool-wiring.ts +31 -0
  459. package/src/__tests__/workspace-service.ts +1 -1
  460. package/src/core/__tests__/catalog-cache-invalidation.test.ts +3 -3
  461. package/src/core/__tests__/compose-embed.test.ts +1 -1
  462. package/src/core/__tests__/damaged-document.tools.test.ts +3 -3
  463. package/src/core/__tests__/erasure-slices-wired-once.test.ts +46 -0
  464. package/src/core/__tests__/gated-boot.test.ts +2 -2
  465. package/src/core/__tests__/lifecycle.test.ts +9 -9
  466. package/src/core/__tests__/oauth-sign-in-real-file.test.ts +179 -0
  467. package/src/core/catalog-cache-invalidation.ts +2 -2
  468. package/src/core/compose-embed.ts +3 -3
  469. package/src/core/core-ports.ts +19 -4
  470. package/src/core/create-core-server.ts +40 -26
  471. package/src/core/create-core-services.ts +92 -66
  472. package/src/core/lifecycle.ts +9 -9
  473. package/src/core-config.ts +3 -3
  474. package/src/index.ts +5 -5
  475. package/src/modules/access/__tests__/access-control.admin-root-floor.test.ts +4 -4
  476. package/src/modules/access/__tests__/access-own-read-grant.test.ts +14 -14
  477. package/src/modules/access/__tests__/access-requests.routes.test.ts +20 -20
  478. package/src/modules/access/__tests__/access.routes.admins.test.ts +4 -4
  479. package/src/modules/access/__tests__/access.routes.batch.test.ts +4 -4
  480. package/src/modules/access/__tests__/access.routes.folder-governs.test.ts +6 -6
  481. package/src/modules/access/__tests__/access.routes.group-grant.test.ts +6 -6
  482. package/src/modules/access/__tests__/access.routes.overrides.test.ts +5 -5
  483. package/src/modules/access/__tests__/access.routes.proposal-branch.test.ts +6 -6
  484. package/src/modules/access/__tests__/access.routes.prospective.test.ts +54 -14
  485. package/src/modules/access/__tests__/access.routes.revoke.test.ts +6 -6
  486. package/src/modules/access/__tests__/access.routes.unknown-email.test.ts +6 -6
  487. package/src/modules/access/__tests__/admin-locked-commit.test.ts +6 -6
  488. package/src/modules/access/__tests__/admin-route-helpers.test.ts +5 -5
  489. package/src/modules/access/__tests__/groups-admin.service.test.ts +27 -27
  490. package/src/modules/access/__tests__/holder-changes.test.ts +127 -0
  491. package/src/modules/access/__tests__/roles-admin.security.test.ts +14 -13
  492. package/src/modules/access/__tests__/roles-admin.service.test.ts +27 -27
  493. package/src/modules/access/__tests__/roles-capabilities.test.ts +19 -19
  494. package/src/modules/access/__tests__/roles.routes.test.ts +6 -6
  495. package/src/modules/access/__tests__/synced-groups-committer.test.ts +13 -13
  496. package/src/modules/access/__tests__/user-access-removal.service.test.ts +29 -29
  497. package/src/modules/access/access-control.interface.ts +26 -0
  498. package/src/modules/access/access-control.service.ts +93 -1
  499. package/src/modules/access/access-declarations.ts +2 -2
  500. package/src/modules/access/access-mutation.service.ts +2 -2
  501. package/src/modules/access/access-requests.routes.ts +7 -7
  502. package/src/modules/access/access-requests.service.ts +13 -13
  503. package/src/modules/access/access.routes.ts +34 -15
  504. package/src/modules/access/admin-locked-commit.ts +11 -11
  505. package/src/modules/access/admin-route-helpers.ts +5 -5
  506. package/src/modules/access/change-read-gate.ts +1 -1
  507. package/src/modules/access/groups-admin.service.ts +7 -7
  508. package/src/modules/access/index.ts +1 -1
  509. package/src/modules/access/reference-scan.ts +1 -1
  510. package/src/modules/access/roles-admin.service.ts +9 -9
  511. package/src/modules/access/synced-groups-committer.ts +11 -11
  512. package/src/modules/access/user-access-removal.service.ts +7 -7
  513. package/src/modules/access-model/__tests__/access-grammar.test.ts +2 -2
  514. package/src/modules/access-model/access-errors.ts +4 -4
  515. package/src/modules/access-model/access-grammar.ts +4 -4
  516. package/src/modules/access-model/change-gate.ts +1 -1
  517. package/src/modules/access-model/roles-yaml-guard.ts +4 -4
  518. package/src/modules/agent-guide/__tests__/agent-guide.test.ts +98 -29
  519. package/src/modules/agent-guide/__tests__/agent-guide.tools.test.ts +39 -12
  520. package/src/modules/agent-guide/__tests__/guide-budget.test.ts +95 -0
  521. package/src/modules/agent-guide/__tests__/guide-eval.test.ts +182 -0
  522. package/src/modules/agent-guide/__tests__/guide-matches-code.test.ts +263 -0
  523. package/src/modules/agent-guide/__tests__/tool-surface.json +514 -0
  524. package/src/modules/agent-guide/__tests__/tool-surface.test.ts +75 -0
  525. package/src/modules/agent-guide/agent-guide.tools.ts +49 -31
  526. package/src/modules/agent-guide/agent-guide.ts +165 -32
  527. package/src/modules/agent-guide/guide-budget.ts +77 -0
  528. package/src/modules/agent-guide/index.ts +12 -0
  529. package/src/modules/agent-instructions/__tests__/agent-instructions.route.test.ts +4 -5
  530. package/src/modules/agent-instructions/__tests__/compose.test.ts +1 -1
  531. package/src/modules/agent-instructions/__tests__/shared-file-rules.test.ts +117 -11
  532. package/src/modules/agent-instructions/agent-instructions.routes.ts +12 -5
  533. package/src/modules/agent-instructions/compose.ts +28 -9
  534. package/src/modules/agent-instructions/shared-file-rules.ts +62 -18
  535. package/src/modules/agent-scope/__tests__/agent-surfaces.connect-as.test.ts +1 -1
  536. package/src/modules/audit/__tests__/agent-rest-audit.middleware.test.ts +113 -113
  537. package/src/modules/audit/__tests__/event-classifier.test.ts +121 -121
  538. package/src/modules/audit/event-classifier.ts +155 -155
  539. package/src/modules/auth/__tests__/account-deactivation.test.ts +1 -1
  540. package/src/modules/auth/__tests__/account-erasure.approval-gate.test.ts +4 -4
  541. package/src/modules/auth/__tests__/account-erasure.participants.test.ts +56 -0
  542. package/src/modules/auth/__tests__/account-switch-lock.pg.test.ts +2 -2
  543. package/src/modules/auth/__tests__/account-switch-lock.test.ts +2 -2
  544. package/src/modules/auth/__tests__/account.routes.test.ts +73 -11
  545. package/src/modules/auth/__tests__/auth.service.test.ts +1 -1
  546. package/src/modules/auth/account-erasure.service.ts +27 -9
  547. package/src/modules/auth/account-hooks.ts +34 -0
  548. package/src/modules/auth/account-switch-lock.ts +2 -2
  549. package/src/modules/auth/account.routes.ts +23 -5
  550. package/src/modules/auth/auth.service.ts +4 -4
  551. package/src/modules/auth/index.ts +1 -0
  552. package/src/modules/code-mode/code-mode.tool.ts +2 -2
  553. package/src/modules/connection-probe/__tests__/connection-probe.service.test.ts +5 -24
  554. package/src/modules/connection-probe/connection-probe.service.ts +1 -34
  555. package/src/modules/database/__tests__/advisory-lock.test.ts +169 -169
  556. package/src/modules/database/__tests__/migrations-unqualified.test.ts +32 -32
  557. package/src/modules/database/core-schema.ts +2 -2
  558. package/src/modules/diff/__tests__/diff.routes.read-gate.test.ts +2 -2
  559. package/src/modules/diff/__tests__/diff.routes.rejectPathsLocked.test.ts +12 -12
  560. package/src/modules/diff/diff.routes.ts +8 -8
  561. package/src/modules/embed/__tests__/embed.service.lock.test.ts +7 -7
  562. package/src/modules/embed/__tests__/embed.service.test.ts +42 -42
  563. package/src/modules/embed/__tests__/embed.tools.test.ts +1 -1
  564. package/src/modules/embed/embed.routes.ts +1 -1
  565. package/src/modules/embed/embed.service.ts +17 -17
  566. package/src/modules/kb-fs/__tests__/branch-name.test.ts +2 -2
  567. package/src/modules/kb-fs/__tests__/locking-filesystem.test.ts +260 -260
  568. package/src/modules/kb-fs/__tests__/move-with-edits.test.ts +34 -34
  569. package/src/modules/kb-fs/__tests__/repo-path.test.ts +8 -8
  570. package/src/modules/kb-fs/branch-name.ts +8 -8
  571. package/src/modules/kb-fs/file-change-notifier.ts +2 -2
  572. package/src/modules/kb-fs/locking-filesystem.ts +30 -30
  573. package/src/modules/kb-fs/repo-path.ts +5 -5
  574. package/src/modules/kb-fs/tmp-ref.ts +3 -3
  575. package/src/modules/kb-sync/__tests__/kb-sync.service.test.ts +36 -36
  576. package/src/modules/kb-sync/index.ts +1 -1
  577. package/src/modules/kb-sync/kb-sync.interface.ts +3 -3
  578. package/src/modules/kb-sync/kb-sync.service.ts +9 -9
  579. package/src/modules/marketplace/__tests__/github-facade.test.ts +1 -1
  580. package/src/modules/marketplace/__tests__/marketplace-git.test.ts +1 -1
  581. package/src/modules/mcp/__tests__/mcp-proxy-helpers.test.ts +4 -2
  582. package/src/modules/mcp/__tests__/mcp.e2e.test.ts +69 -8
  583. package/src/modules/mcp/__tests__/mcp.service.test.ts +91 -13
  584. package/src/modules/mcp/__tests__/read-only-hint.pg.test.ts +194 -0
  585. package/src/modules/mcp/mcp.service.ts +93 -62
  586. package/src/modules/onboarding/__tests__/starter-pack.service.test.ts +55 -55
  587. package/src/modules/onboarding/onboarding.contract.ts +1 -1
  588. package/src/modules/onboarding/onboarding.routes.ts +2 -2
  589. package/src/modules/onboarding/starter-pack.service.ts +6 -6
  590. package/src/modules/plugins/__tests__/bundle-dialect.e2e.test.ts +1 -1
  591. package/src/modules/plugins/__tests__/compile-marketplace.test.ts +1 -1
  592. package/src/modules/plugins/__tests__/join-request-jobs.service.test.ts +43 -43
  593. package/src/modules/plugins/__tests__/join-requests.service.test.ts +19 -19
  594. package/src/modules/plugins/__tests__/join-requests.settlement.test.ts +26 -26
  595. package/src/modules/plugins/__tests__/plugins.routes.test.ts +25 -25
  596. package/src/modules/plugins/join-request-jobs.service.ts +10 -10
  597. package/src/modules/plugins/join-requests.service.ts +4 -4
  598. package/src/modules/plugins/plugin-rename.service.ts +1 -1
  599. package/src/modules/plugins/plugins.routes.ts +9 -9
  600. package/src/modules/secrets-vault/__tests__/db-secrets-vault.managed.test.ts +773 -0
  601. package/src/modules/secrets-vault/__tests__/db-secrets-vault.oauth.test.ts +458 -4
  602. package/src/modules/secrets-vault/__tests__/managed-sign-in.route.test.ts +351 -0
  603. package/src/modules/secrets-vault/__tests__/oauth-live-declaration.route.test.ts +218 -0
  604. package/src/modules/secrets-vault/__tests__/oauth-return-to.route.test.ts +39 -6
  605. package/src/modules/secrets-vault/db-secrets-vault.service.ts +728 -118
  606. package/src/modules/secrets-vault/index.ts +8 -1
  607. package/src/modules/secrets-vault/managed-sign-in-erasure.ts +41 -0
  608. package/src/modules/secrets-vault/secrets-variable-loader.ts +134 -134
  609. package/src/modules/secrets-vault/secrets-vault.contract.ts +213 -11
  610. package/src/modules/secrets-vault/secrets-vault.routes.ts +244 -45
  611. package/src/modules/settings/__tests__/repository-source.test.ts +1 -1
  612. package/src/modules/settings/__tests__/setup.routes.layout-phase.test.ts +1 -1
  613. package/src/modules/settings/__tests__/setup.routes.managed-phase.test.ts +1 -1
  614. package/src/modules/settings/connection-check.ts +1 -1
  615. package/src/modules/settings/deployment-settings.service.ts +1 -1
  616. package/src/modules/settings/git-root-folders.ts +1 -1
  617. package/src/modules/settings/oidc-check.ts +5 -18
  618. package/src/modules/settings/setup.routes.ts +1 -1
  619. package/src/modules/skills/__tests__/allowed-tools-warn.tools.test.ts +3 -3
  620. package/src/modules/skills/__tests__/branch-skills.tools.test.ts +1 -1
  621. package/src/modules/skills/__tests__/pending-skills.service.test.ts +8 -8
  622. package/src/modules/skills/__tests__/skill-access-requests.routes.test.ts +18 -18
  623. package/src/modules/skills/__tests__/skills.service.test.ts +3 -3
  624. package/src/modules/skills/pending-skills.service.ts +3 -3
  625. package/src/modules/skills/skill-access-requests.routes.ts +7 -7
  626. package/src/modules/skills/skills.tools.ts +1 -1
  627. package/src/modules/tool-helpers/__tests__/agent-roles-write.test.ts +22 -14
  628. package/src/modules/tool-helpers/__tests__/branch-declaration.test.ts +3 -3
  629. package/src/modules/tool-helpers/__tests__/can-write.tools.test.ts +3 -3
  630. package/src/modules/tool-helpers/__tests__/phase4-tools.test.ts +4 -4
  631. package/src/modules/tool-helpers/__tests__/route-tool-schemas.catalog.test.ts +38 -0
  632. package/src/modules/tool-helpers/__tests__/tools-surface.test.ts +3 -3
  633. package/src/modules/tool-helpers/__tests__/validate-token.test.ts +1 -1
  634. package/src/modules/tool-helpers/tool-context.ts +6 -6
  635. package/src/modules/tool-helpers/tool-def.ts +1 -1
  636. package/src/modules/tool-helpers/tool-handler.ts +2 -2
  637. package/src/modules/tool-helpers/tool.contract.ts +4 -4
  638. package/src/modules/tool-manuals/__tests__/pending-tools.service.test.ts +9 -9
  639. package/src/modules/tool-manuals/__tests__/tool-manuals.managed-sign-in.test.ts +89 -0
  640. package/src/modules/tool-manuals/__tests__/tool-manuals.mcp-oauth.test.ts +197 -11
  641. package/src/modules/tool-manuals/__tests__/tool-manuals.restart.test.ts +1 -1
  642. package/src/modules/tool-manuals/__tests__/tool-manuals.tools.test.ts +132 -6
  643. package/src/modules/tool-manuals/mcp-json-discovery.ts +73 -34
  644. package/src/modules/tool-manuals/mcp-server-edit.service.ts +1 -1
  645. package/src/modules/tool-manuals/pending-tools.service.ts +3 -3
  646. package/src/modules/tool-manuals/tool-delete.service.ts +1 -1
  647. package/src/modules/tool-manuals/tool-manuals.contract.ts +63 -3
  648. package/src/modules/tool-manuals/tool-manuals.service.ts +191 -51
  649. package/src/modules/tool-manuals/tool-manuals.tools.ts +93 -28
  650. package/src/modules/tool-registry/__tests__/own-tool-schemas.test.ts +4 -4
  651. package/src/modules/tool-registry/__tests__/read-only-hints.test.ts +3 -3
  652. package/src/modules/tool-registry/__tests__/tool-description-length.test.ts +12 -119
  653. package/src/modules/{workflow → version-control}/__tests__/apply-failure.test.ts +54 -54
  654. package/src/modules/{workflow → version-control}/__tests__/event-bus.test.ts +27 -27
  655. package/src/modules/{workflow → version-control}/__tests__/events-delivery.test.ts +37 -37
  656. package/src/modules/{workflow → version-control}/__tests__/file-lock.service.deletion-gate.test.ts +2 -2
  657. package/src/modules/{workflow → version-control}/__tests__/file-lock.service.path-identity.test.ts +8 -8
  658. package/src/modules/{workflow → version-control}/__tests__/merge-announces-tree.test.ts +11 -11
  659. package/src/modules/{workflow → version-control}/__tests__/pending-commits.worker.concurrency.test.ts +9 -9
  660. package/src/modules/{workflow → version-control}/__tests__/pending-commits.worker.test.ts +25 -25
  661. package/src/modules/{workflow → version-control}/__tests__/preserve-roles-yaml.test.ts +42 -42
  662. package/src/modules/version-control/__tests__/public-surface.test.ts +114 -0
  663. package/src/modules/{workflow/__tests__/workflow.routes.folder-proposals.test.ts → version-control/__tests__/version-control.routes.folder-proposals.test.ts} +18 -18
  664. package/src/modules/{workflow/__tests__/workflow.routes.fork-point-file.test.ts → version-control/__tests__/version-control.routes.fork-point-file.test.ts} +19 -19
  665. package/src/modules/{workflow/__tests__/workflow.routes.history-read-gate.test.ts → version-control/__tests__/version-control.routes.history-read-gate.test.ts} +13 -13
  666. package/src/modules/{workflow/__tests__/workflow.routes.lock-path.test.ts → version-control/__tests__/version-control.routes.lock-path.test.ts} +18 -18
  667. package/src/modules/{workflow/__tests__/workflow.routes.open-change-request.test.ts → version-control/__tests__/version-control.routes.open-change-request.test.ts} +7 -7
  668. package/src/modules/{workflow/__tests__/workflow.routes.push-refused.test.ts → version-control/__tests__/version-control.routes.push-refused.test.ts} +14 -14
  669. package/src/modules/{workflow/__tests__/workflow.service.branch-in-use.test.ts → version-control/__tests__/version-control.service.branch-in-use.test.ts} +6 -6
  670. package/src/modules/{workflow/__tests__/workflow.service.commitFileWhileLocked.test.ts → version-control/__tests__/version-control.service.commitFileWhileLocked.test.ts} +14 -14
  671. package/src/modules/{workflow/__tests__/workflow.service.delete-branch.test.ts → version-control/__tests__/version-control.service.delete-branch.test.ts} +14 -14
  672. package/src/modules/{workflow/__tests__/workflow.service.deleted-branch-sweep.test.ts → version-control/__tests__/version-control.service.deleted-branch-sweep.test.ts} +4 -4
  673. package/src/modules/{workflow/__tests__/workflow.service.facade.test.ts → version-control/__tests__/version-control.service.facade.test.ts} +97 -99
  674. package/src/modules/{workflow/__tests__/workflow.service.folder-proposals.test.ts → version-control/__tests__/version-control.service.folder-proposals.test.ts} +7 -7
  675. package/src/modules/{workflow/__tests__/workflow.service.platform-restore.test.ts → version-control/__tests__/version-control.service.platform-restore.test.ts} +6 -6
  676. package/src/modules/{workflow/__tests__/workflow.service.read-gate.test.ts → version-control/__tests__/version-control.service.read-gate.test.ts} +9 -9
  677. package/src/modules/{workflow/__tests__/workflow.service.releaseLock.test.ts → version-control/__tests__/version-control.service.releaseLock.test.ts} +42 -42
  678. package/src/modules/{workflow/__tests__/workflow.service.repository-replaced.test.ts → version-control/__tests__/version-control.service.repository-replaced.test.ts} +4 -4
  679. package/src/modules/{workflow/__tests__/workflow.service.sync.test.ts → version-control/__tests__/version-control.service.sync.test.ts} +17 -17
  680. package/src/modules/{workflow/__tests__/workflow.service.update-change-request.pg.test.ts → version-control/__tests__/version-control.service.update-change-request.pg.test.ts} +6 -6
  681. package/src/modules/{workflow/__tests__/workflow.service.update-change-request.test.ts → version-control/__tests__/version-control.service.update-change-request.test.ts} +11 -11
  682. package/src/modules/{workflow/__tests__/workflow.service.update-from-target.test.ts → version-control/__tests__/version-control.service.update-from-target.test.ts} +22 -22
  683. package/src/modules/{workflow → version-control}/agent-tools/__tests__/change-request-read.tools.test.ts +3 -3
  684. package/src/modules/{workflow → version-control}/agent-tools/__tests__/update-change-request.parity.test.ts +16 -16
  685. package/src/modules/{workflow/agent-tools/__tests__/workflow.tools.test.ts → version-control/agent-tools/__tests__/version-control.tools.test.ts} +9 -9
  686. package/src/modules/{workflow → version-control}/agent-tools/change-request-read.tools.ts +2 -2
  687. package/src/modules/{workflow/agent-tools/workflow.tools.ts → version-control/agent-tools/version-control.tools.ts} +52 -48
  688. package/src/modules/{workflow → version-control}/change-request-hooks.ts +1 -1
  689. package/src/modules/{workflow/review-workflow → version-control/change-request-review}/__tests__/approval-states.test.ts +5 -5
  690. package/src/modules/{workflow/review-workflow → version-control/change-request-review}/__tests__/cancel-pr.test.ts +8 -8
  691. package/src/modules/{workflow/review-workflow → version-control/change-request-review}/__tests__/carry-approvals-forward.test.ts +6 -6
  692. package/src/modules/{workflow/review-workflow → version-control/change-request-review}/__tests__/erase-approver.test.ts +5 -5
  693. package/src/modules/{workflow/review-workflow → version-control/change-request-review}/__tests__/merge-gate.test.ts +3 -3
  694. package/src/modules/{workflow/review-workflow → version-control/change-request-review}/__tests__/merge-records-own-commit.test.ts +3 -3
  695. package/src/modules/{workflow/review-workflow/review-workflow.interface.ts → version-control/change-request-review/change-request-review.interface.ts} +1 -1
  696. package/src/modules/{workflow/review-workflow/review-workflow.service.ts → version-control/change-request-review/change-request-review.service.ts} +28 -28
  697. package/src/modules/{workflow → version-control}/event-bus.ts +14 -14
  698. package/src/modules/{workflow → version-control}/events-delivery.ts +11 -11
  699. package/src/modules/{workflow → version-control}/events.routes.ts +5 -5
  700. package/src/modules/{workflow → version-control}/file-lock.service.ts +6 -6
  701. package/src/modules/{workflow → version-control}/git/__tests__/git-test-helpers.ts +3 -3
  702. package/src/modules/{workflow → version-control}/git/__tests__/git.service.accessGating.test.ts +5 -5
  703. package/src/modules/{workflow → version-control}/git/__tests__/git.service.appliedChange.test.ts +4 -4
  704. package/src/modules/{workflow → version-control}/git/__tests__/git.service.changedFilesForPr.test.ts +16 -16
  705. package/src/modules/{workflow → version-control}/git/__tests__/git.service.changedPathsMemo.test.ts +2 -2
  706. package/src/modules/{workflow → version-control}/git/__tests__/git.service.commitChanges.test.ts +3 -3
  707. package/src/modules/{workflow → version-control}/git/__tests__/git.service.commitFile.strayPath.test.ts +10 -10
  708. package/src/modules/{workflow → version-control}/git/__tests__/git.service.commitFile.test.ts +3 -3
  709. package/src/modules/{workflow → version-control}/git/__tests__/git.service.createBranch.test.ts +3 -3
  710. package/src/modules/{workflow → version-control}/git/__tests__/git.service.deleteBranch.test.ts +7 -7
  711. package/src/modules/{workflow → version-control}/git/__tests__/git.service.diffFileAtCommit.test.ts +9 -9
  712. package/src/modules/{workflow → version-control}/git/__tests__/git.service.diffFileBetweenBranches.test.ts +23 -23
  713. package/src/modules/{workflow → version-control}/git/__tests__/git.service.fileBytesAtCommit.test.ts +7 -7
  714. package/src/modules/{workflow → version-control}/git/__tests__/git.service.fileContentsAtCommit.test.ts +3 -3
  715. package/src/modules/{workflow → version-control}/git/__tests__/git.service.forkPoint.test.ts +2 -2
  716. package/src/modules/{workflow → version-control}/git/__tests__/git.service.history-guards.test.ts +2 -2
  717. package/src/modules/{workflow → version-control}/git/__tests__/git.service.list-branches.test.ts +12 -12
  718. package/src/modules/{workflow → version-control}/git/__tests__/git.service.listTrackedFiles.test.ts +2 -2
  719. package/src/modules/{workflow → version-control}/git/__tests__/git.service.logForFile.test.ts +6 -6
  720. package/src/modules/{workflow → version-control}/git/__tests__/git.service.mergeChangeRequest.test.ts +20 -20
  721. package/src/modules/{workflow → version-control}/git/__tests__/git.service.mergeIntoBranch.test.ts +16 -16
  722. package/src/modules/{workflow → version-control}/git/__tests__/git.service.pendingChanges.test.ts +2 -2
  723. package/src/modules/{workflow → version-control}/git/__tests__/git.service.postMergePull.test.ts +5 -5
  724. package/src/modules/{workflow → version-control}/git/__tests__/git.service.prFetchFailure.test.ts +2 -2
  725. package/src/modules/{workflow → version-control}/git/__tests__/git.service.pull.test.ts +12 -12
  726. package/src/modules/{workflow → version-control}/git/__tests__/git.service.readFileAtRef.test.ts +3 -3
  727. package/src/modules/{workflow → version-control}/git/__tests__/git.service.revertPathsAndPush.test.ts +2 -2
  728. package/src/modules/{workflow → version-control}/git/__tests__/git.service.status.test.ts +4 -4
  729. package/src/modules/{workflow → version-control}/git/__tests__/git.service.syncFromRemote.test.ts +8 -8
  730. package/src/modules/{workflow → version-control}/git/__tests__/git.service.worktrees.test.ts +4 -4
  731. package/src/modules/{workflow → version-control}/git/__tests__/pull-request.service.list-fetch.test.ts +2 -2
  732. package/src/modules/{workflow → version-control}/git/__tests__/pull-request.service.test.ts +6 -6
  733. package/src/modules/{workflow → version-control}/git/git.service.ts +57 -57
  734. package/src/modules/{workflow → version-control}/git/node-git-runner.ts +1 -1
  735. package/src/modules/{workflow → version-control}/git/pull-request.service.ts +12 -12
  736. package/src/modules/{workflow → version-control}/index.ts +6 -5
  737. package/src/modules/{workflow → version-control}/pending-commits.service.ts +2 -2
  738. package/src/modules/{workflow → version-control}/pending-commits.worker.ts +8 -8
  739. package/src/modules/{workflow → version-control}/read-on-branch.ts +2 -2
  740. package/src/modules/{workflow/workflow-hooks.ts → version-control/version-control-hooks.ts} +3 -3
  741. package/src/modules/{workflow/workflow.routes.ts → version-control/version-control.routes.ts} +64 -63
  742. package/src/modules/{workflow/workflow.service.ts → version-control/version-control.service.ts} +92 -97
  743. package/src/modules/workspace/__tests__/agent-access.gate.test.ts +8 -8
  744. package/src/modules/workspace/__tests__/agent-downloads.test.ts +13 -16
  745. package/src/modules/workspace/__tests__/agent-uploads.test.ts +11 -12
  746. package/src/modules/workspace/__tests__/escape-sequences.routes.test.ts +11 -16
  747. package/src/modules/workspace/__tests__/file-stat-access.test.ts +3 -3
  748. package/src/modules/workspace/__tests__/git-internals.security.test.ts +27 -27
  749. package/src/modules/workspace/__tests__/kb-repository.test.ts +1 -1
  750. package/src/modules/workspace/__tests__/rest-tool-arguments.test.ts +3 -3
  751. package/src/modules/workspace/__tests__/start-session.default-branch.test.ts +152 -0
  752. package/src/modules/workspace/__tests__/workspace-paths-inside-the-repo.test.ts +6 -6
  753. package/src/modules/workspace/__tests__/workspace-tmp.tools.test.ts +13 -14
  754. package/src/modules/workspace/__tests__/workspace.routes.at-ref.test.ts +6 -6
  755. package/src/modules/workspace/__tests__/workspace.routes.branch-errors.test.ts +4 -4
  756. package/src/modules/workspace/__tests__/workspace.routes.create-grant.test.ts +6 -6
  757. package/src/modules/workspace/__tests__/workspace.routes.delete.test.ts +8 -8
  758. package/src/modules/workspace/__tests__/workspace.routes.download-implies-read.test.ts +4 -4
  759. package/src/modules/workspace/__tests__/workspace.routes.download.test.ts +6 -6
  760. package/src/modules/workspace/__tests__/workspace.routes.file-writes.test.ts +6 -6
  761. package/src/modules/workspace/__tests__/workspace.routes.folder-zip-access.test.ts +4 -4
  762. package/src/modules/workspace/__tests__/workspace.routes.folders.test.ts +6 -6
  763. package/src/modules/workspace/__tests__/workspace.routes.move-platform-files.test.ts +7 -7
  764. package/src/modules/workspace/__tests__/workspace.routes.read-gate.test.ts +13 -13
  765. package/src/modules/workspace/__tests__/workspace.service.any-workspace-credentials.test.ts +1 -1
  766. package/src/modules/workspace/__tests__/workspace.service.replaced-repository.test.ts +1 -1
  767. package/src/modules/workspace/__tests__/workspace.service.worktrees.test.ts +1 -1
  768. package/src/modules/workspace/__tests__/workspace.tools.agents-file.test.ts +12 -14
  769. package/src/modules/workspace/__tests__/workspace.tools.branch-errors.test.ts +5 -5
  770. package/src/modules/workspace/__tests__/workspace.tools.test.ts +182 -75
  771. package/src/modules/workspace/agent-access.gate.ts +6 -6
  772. package/src/modules/workspace/git-internals.middleware.ts +2 -2
  773. package/src/modules/workspace/kb-repository.ts +1 -1
  774. package/src/modules/workspace/startup/__tests__/kb-startup-runner.degraded.test.ts +1 -1
  775. package/src/modules/workspace/startup/__tests__/kb-startup-runner.test.ts +1 -1
  776. package/src/modules/workspace/startup/__tests__/kb-startup-runner.worktrees.test.ts +1 -1
  777. package/src/modules/workspace/startup/kb-git.ts +1 -1
  778. package/src/modules/workspace/startup/steps/__tests__/steps.test.ts +94 -70
  779. package/src/modules/workspace/startup/steps/seed-tree.ts +4 -5
  780. package/src/modules/workspace/startup/steps/template-files.step.ts +4 -5
  781. package/src/modules/workspace/startup/steps/template-source.ts +21 -6
  782. package/src/modules/workspace/workspace-tmp.ts +4 -4
  783. package/src/modules/workspace/workspace.routes.ts +26 -26
  784. package/src/modules/workspace/workspace.service.ts +11 -11
  785. package/src/modules/workspace/workspace.tools.ts +90 -30
  786. package/src/shared/__tests__/canonical-file-identity.test.ts +5 -5
  787. package/src/shared/__tests__/http-errors.test.ts +4 -4
  788. package/src/shared/__tests__/read-capped.test.ts +68 -0
  789. package/src/shared/canonical-file-identity.ts +5 -5
  790. package/src/shared/domain-errors.ts +44 -44
  791. package/src/shared/git.contract.ts +1 -1
  792. package/src/shared/http-errors.ts +3 -3
  793. package/src/shared/kb-context.ts +130 -130
  794. package/src/shared/oauth-token-error.ts +46 -0
  795. package/src/shared/pending-proposals.ts +4 -4
  796. package/src/shared/read-capped.ts +40 -0
  797. package/src/tenancy/__tests__/tenant-host.test.ts +372 -372
  798. package/src/tenancy/__tests__/tenant-runtime.test.ts +221 -221
  799. package/src/tenancy/__tests__/tenant-secrets.test.ts +35 -35
  800. package/src/tenancy/index.ts +35 -35
  801. package/src/tenancy/static-tenant-source.ts +1 -1
  802. package/src/tenancy/tenant-host.ts +261 -261
  803. package/src/tenancy/tenant-runtime.ts +208 -208
  804. package/src/tenancy/tenant-source.contract.ts +59 -59
  805. package/agent-guide/finding-things.md +0 -7
  806. package/agent-guide/introduction.md +0 -27
  807. package/dist/modules/workflow/agent-tools/change-request-read-shape.d.ts.map +0 -1
  808. package/dist/modules/workflow/agent-tools/change-request-read-shape.js.map +0 -1
  809. package/dist/modules/workflow/agent-tools/change-request-read.tools.d.ts.map +0 -1
  810. package/dist/modules/workflow/agent-tools/change-request-read.tools.js.map +0 -1
  811. package/dist/modules/workflow/agent-tools/change-request-summary.d.ts.map +0 -1
  812. package/dist/modules/workflow/agent-tools/change-request-summary.js.map +0 -1
  813. package/dist/modules/workflow/agent-tools/workflow.tools.d.ts.map +0 -1
  814. package/dist/modules/workflow/agent-tools/workflow.tools.js.map +0 -1
  815. package/dist/modules/workflow/change-request-hooks.d.ts.map +0 -1
  816. package/dist/modules/workflow/change-request-hooks.js.map +0 -1
  817. package/dist/modules/workflow/event-bus.d.ts.map +0 -1
  818. package/dist/modules/workflow/event-bus.js.map +0 -1
  819. package/dist/modules/workflow/events-delivery.d.ts.map +0 -1
  820. package/dist/modules/workflow/events-delivery.js.map +0 -1
  821. package/dist/modules/workflow/events.routes.d.ts.map +0 -1
  822. package/dist/modules/workflow/events.routes.js.map +0 -1
  823. package/dist/modules/workflow/file-lock.service.d.ts.map +0 -1
  824. package/dist/modules/workflow/file-lock.service.js.map +0 -1
  825. package/dist/modules/workflow/git/change-request-link.d.ts.map +0 -1
  826. package/dist/modules/workflow/git/change-request-link.js.map +0 -1
  827. package/dist/modules/workflow/git/git-version.d.ts.map +0 -1
  828. package/dist/modules/workflow/git/git-version.js.map +0 -1
  829. package/dist/modules/workflow/git/git.service.d.ts.map +0 -1
  830. package/dist/modules/workflow/git/git.service.js.map +0 -1
  831. package/dist/modules/workflow/git/merge-commit.d.ts.map +0 -1
  832. package/dist/modules/workflow/git/merge-commit.js.map +0 -1
  833. package/dist/modules/workflow/git/node-git-runner.d.ts.map +0 -1
  834. package/dist/modules/workflow/git/node-git-runner.js.map +0 -1
  835. package/dist/modules/workflow/git/pull-request.service.d.ts.map +0 -1
  836. package/dist/modules/workflow/git/pull-request.service.js.map +0 -1
  837. package/dist/modules/workflow/index.d.ts.map +0 -1
  838. package/dist/modules/workflow/index.js.map +0 -1
  839. package/dist/modules/workflow/pending-commits.service.d.ts.map +0 -1
  840. package/dist/modules/workflow/pending-commits.service.js.map +0 -1
  841. package/dist/modules/workflow/pending-commits.worker.d.ts.map +0 -1
  842. package/dist/modules/workflow/pending-commits.worker.js.map +0 -1
  843. package/dist/modules/workflow/read-on-branch.d.ts.map +0 -1
  844. package/dist/modules/workflow/read-on-branch.js.map +0 -1
  845. package/dist/modules/workflow/recovery-bot.d.ts.map +0 -1
  846. package/dist/modules/workflow/recovery-bot.js.map +0 -1
  847. package/dist/modules/workflow/review-workflow/approval-lock.d.ts.map +0 -1
  848. package/dist/modules/workflow/review-workflow/approval-lock.js.map +0 -1
  849. package/dist/modules/workflow/review-workflow/review-workflow.interface.d.ts.map +0 -1
  850. package/dist/modules/workflow/review-workflow/review-workflow.interface.js +0 -2
  851. package/dist/modules/workflow/review-workflow/review-workflow.interface.js.map +0 -1
  852. package/dist/modules/workflow/review-workflow/review-workflow.service.d.ts.map +0 -1
  853. package/dist/modules/workflow/review-workflow/review-workflow.service.js.map +0 -1
  854. package/dist/modules/workflow/sanitize-error.d.ts.map +0 -1
  855. package/dist/modules/workflow/sanitize-error.js.map +0 -1
  856. package/dist/modules/workflow/workflow-hooks.d.ts.map +0 -1
  857. package/dist/modules/workflow/workflow-hooks.js.map +0 -1
  858. package/dist/modules/workflow/workflow.routes.d.ts.map +0 -1
  859. package/dist/modules/workflow/workflow.routes.js.map +0 -1
  860. package/dist/modules/workflow/workflow.service.d.ts.map +0 -1
  861. package/dist/modules/workflow/workflow.service.js.map +0 -1
  862. package/src/modules/mcp/__tests__/read-only-hint.e2e.test.ts +0 -213
  863. /package/dist/modules/{workflow → version-control}/agent-tools/change-request-read-shape.d.ts +0 -0
  864. /package/dist/modules/{workflow → version-control}/agent-tools/change-request-read-shape.js +0 -0
  865. /package/dist/modules/{workflow → version-control}/agent-tools/change-request-read.tools.d.ts +0 -0
  866. /package/dist/modules/{workflow → version-control}/agent-tools/change-request-summary.d.ts +0 -0
  867. /package/dist/modules/{workflow → version-control}/agent-tools/change-request-summary.js +0 -0
  868. /package/dist/modules/{workflow → version-control}/change-request-hooks.js +0 -0
  869. /package/dist/modules/{workflow/review-workflow → version-control/change-request-review}/approval-lock.d.ts +0 -0
  870. /package/dist/modules/{workflow/review-workflow → version-control/change-request-review}/approval-lock.js +0 -0
  871. /package/dist/modules/{workflow → version-control}/events-delivery.js +0 -0
  872. /package/dist/modules/{workflow → version-control}/events.routes.js +0 -0
  873. /package/dist/modules/{workflow → version-control}/git/change-request-link.d.ts +0 -0
  874. /package/dist/modules/{workflow → version-control}/git/change-request-link.js +0 -0
  875. /package/dist/modules/{workflow → version-control}/git/git-version.d.ts +0 -0
  876. /package/dist/modules/{workflow → version-control}/git/git-version.js +0 -0
  877. /package/dist/modules/{workflow → version-control}/git/merge-commit.d.ts +0 -0
  878. /package/dist/modules/{workflow → version-control}/git/merge-commit.js +0 -0
  879. /package/dist/modules/{workflow → version-control}/git/node-git-runner.d.ts +0 -0
  880. /package/dist/modules/{workflow → version-control}/recovery-bot.d.ts +0 -0
  881. /package/dist/modules/{workflow → version-control}/recovery-bot.js +0 -0
  882. /package/dist/modules/{workflow → version-control}/sanitize-error.d.ts +0 -0
  883. /package/dist/modules/{workflow → version-control}/sanitize-error.js +0 -0
  884. /package/src/modules/{workflow → version-control}/__tests__/change-request-hooks.test.ts +0 -0
  885. /package/src/modules/{workflow → version-control}/__tests__/fake-file-lock-db.ts +0 -0
  886. /package/src/modules/{workflow → version-control}/__tests__/pending-commits.canonical.test.ts +0 -0
  887. /package/src/modules/{workflow → version-control}/__tests__/pending-commits.enqueue-if-absent.test.ts +0 -0
  888. /package/src/modules/{workflow → version-control}/__tests__/pending-commits.repository-replaced.test.ts +0 -0
  889. /package/src/modules/{workflow → version-control}/__tests__/sanitize-error.test.ts +0 -0
  890. /package/src/modules/{workflow → version-control}/agent-tools/__tests__/change-request-read-shape.test.ts +0 -0
  891. /package/src/modules/{workflow → version-control}/agent-tools/change-request-read-shape.ts +0 -0
  892. /package/src/modules/{workflow → version-control}/agent-tools/change-request-summary.ts +0 -0
  893. /package/src/modules/{workflow/review-workflow → version-control/change-request-review}/approval-lock.ts +0 -0
  894. /package/src/modules/{workflow → version-control}/git/__tests__/branchAuthor.test.ts +0 -0
  895. /package/src/modules/{workflow → version-control}/git/__tests__/change-request-link.test.ts +0 -0
  896. /package/src/modules/{workflow → version-control}/git/__tests__/git-version.failure.test.ts +0 -0
  897. /package/src/modules/{workflow → version-control}/git/__tests__/git-version.test.ts +0 -0
  898. /package/src/modules/{workflow → version-control}/git/__tests__/node-git-runner.test.ts +0 -0
  899. /package/src/modules/{workflow → version-control}/git/__tests__/pull-request.service.getPrDetail.test.ts +0 -0
  900. /package/src/modules/{workflow → version-control}/git/__tests__/pull-request.service.placeholder.test.ts +0 -0
  901. /package/src/modules/{workflow → version-control}/git/__tests__/pull-request.service.viewer-can-cancel.test.ts +0 -0
  902. /package/src/modules/{workflow → version-control}/git/__tests__/pull-request.service.viewer-can-delete.test.ts +0 -0
  903. /package/src/modules/{workflow → version-control}/git/__tests__/pull-request.service.viewer-can-update.test.ts +0 -0
  904. /package/src/modules/{workflow → version-control}/git/change-request-link.ts +0 -0
  905. /package/src/modules/{workflow → version-control}/git/git-version.ts +0 -0
  906. /package/src/modules/{workflow → version-control}/git/merge-commit.ts +0 -0
  907. /package/src/modules/{workflow → version-control}/recovery-bot.ts +0 -0
  908. /package/src/modules/{workflow → version-control}/sanitize-error.ts +0 -0
@@ -1,6 +1,10 @@
1
+ import type { AddressInfo } from 'node:net';
2
+ import type { Server as HttpServer } from 'node:http';
1
3
  import { DEFAULT_KB_LAYOUT, PREAMBLE_CAP } from '@bevel-software/platform-shared';
4
+ import express from 'express';
2
5
  import { describe, expect, it } from 'vitest';
3
- import { composeAgentGuide } from '../../agent-guide/agent-guide.js';
6
+ import { composeAgentGuide } from '../../agent-guide/index.js';
7
+ import { createAgentInstructionsRoutes } from '../agent-instructions.routes.js';
4
8
  import {
5
9
  INSTRUCTIONS_CAP,
6
10
  PLATFORM_HEADER,
@@ -25,7 +29,7 @@ import {
25
29
 
26
30
  describe('the shared file rules are one text, in two places', () => {
27
31
  it('puts the identical section in the handshake instructions and in the agent guide', async () => {
28
- const section = sharedFileRulesSection(DEFAULT_KB_LAYOUT);
32
+ const section = sharedFileRulesSection(DEFAULT_KB_LAYOUT, '');
29
33
  expect(section.startsWith(`## ${SHARED_RULES_SECTION}\n\n`)).toBe(true);
30
34
 
31
35
  const instructions = composeAgentInstructions(null).instructions;
@@ -47,7 +51,7 @@ describe('the shared file rules are one text, in two places', () => {
47
51
  it('states every rule in both places, and the content rule exactly once in each', async () => {
48
52
  const instructions = composeAgentInstructions(null).instructions;
49
53
  const guide = await composeAgentGuide(DEFAULT_KB_LAYOUT);
50
- const rules = sharedFileRules(DEFAULT_KB_LAYOUT);
54
+ const rules = sharedFileRules(DEFAULT_KB_LAYOUT, '');
51
55
  expect(rules.map((r) => r.id)).toEqual([
52
56
  'agent-guide',
53
57
  'content-kinds',
@@ -93,10 +97,10 @@ describe('the shared file rules are one text, in two places', () => {
93
97
  * organisation's own conventions file beside it — which is what a
94
98
  * `read_file` of that name serves first.
95
99
  */
96
- it('tells an agent to call get_agent_guide first, and that AGENTS.md answers with the same guide after the organisation\'s own', () => {
100
+ it('tells an agent to call get_agent_guide first, and that AGENTS.md answers with that start after the organisation\'s own', () => {
97
101
  const rule = sharedFileRules(DEFAULT_KB_LAYOUT).find((r) => r.id === 'agent-guide')!.body;
98
- expect(rule).toContain("call `get_agent_guide` and read the platform's guide");
99
- expect(rule).toContain('read_file on `AGENTS.md` at the KB root answers with the same guide');
102
+ expect(rule).toContain("call `get_agent_guide`: it answers the guide's start, which names the default branch");
103
+ expect(rule).toContain('read_file on `AGENTS.md` at the KB root answers with that start');
100
104
  expect(rule).toContain("after the organisation's own conventions file of that name");
101
105
  // The pre-rename name is still offered, for a knowledge base that kept one.
102
106
  expect(rule).toContain('`CLAUDE.md`');
@@ -104,8 +108,8 @@ describe('the shared file rules are one text, in two places', () => {
104
108
 
105
109
  it('names one guide on every deployment, whatever name a deployment once saved for the written one', () => {
106
110
  const layout = { ...DEFAULT_KB_LAYOUT, agentsFile: 'HEXIS.md' };
107
- const section = sharedFileRulesSection(layout);
108
- expect(section).toBe(sharedFileRulesSection(DEFAULT_KB_LAYOUT));
111
+ const section = sharedFileRulesSection(layout, '');
112
+ expect(section).toBe(sharedFileRulesSection(DEFAULT_KB_LAYOUT, ''));
109
113
  expect(section).not.toContain('HEXIS.md');
110
114
  expect(composeAgentInstructions(null, layout).instructions).toContain(section);
111
115
  // The guide is not a platform file under any name: the list a move
@@ -115,8 +119,108 @@ describe('the shared file rules are one text, in two places', () => {
115
119
 
116
120
  });
117
121
 
122
+ /**
123
+ * The guide's start names the deployment's default branch, but only to an
124
+ * agent that calls `get_agent_guide`; an agent left to guess guesses `main`,
125
+ * and on a deployment whose default is another branch writes where nobody
126
+ * reads. The conventions rule names it, on every channel the shared rules ride.
127
+ */
128
+ describe('the default branch is named', () => {
129
+ const SENTENCE =
130
+ "This knowledge base's default branch is `target-company-state`: the branch people read and the usual target of a " +
131
+ 'change request; pass it as `branch` unless you are working on a draft.';
132
+
133
+ /** The text under the "own conventions" heading, up to the next rule's heading. */
134
+ const conventions = (text: string): string => {
135
+ const start = text.indexOf("### This knowledge base's own conventions\n\n");
136
+ expect(start).toBeGreaterThanOrEqual(0);
137
+ const end = text.indexOf('\n### ', start + 1);
138
+ return text.slice(start, end);
139
+ };
140
+
141
+ it('says the name in one sentence under "This knowledge base\'s own conventions"', () => {
142
+ const section = sharedFileRulesSection(DEFAULT_KB_LAYOUT, 'target-company-state');
143
+ expect(conventions(section)).toContain(SENTENCE);
144
+ expect(section.split(SENTENCE)).toHaveLength(2);
145
+ expect(section).not.toContain('`main`');
146
+ });
147
+
148
+ it('says whatever the name is — `main` on a deployment that uses it', () => {
149
+ const rule = sharedFileRules(DEFAULT_KB_LAYOUT, 'main').find((r) => r.id === 'agent-guide')!.body;
150
+ expect(rule).toContain(SENTENCE.replace('target-company-state', 'main'));
151
+ });
152
+
153
+ it('names no branch while the deployment has none', () => {
154
+ const rule = sharedFileRules(DEFAULT_KB_LAYOUT, '').find((r) => r.id === 'agent-guide')!.body;
155
+ expect(rule).not.toContain('default branch is');
156
+ });
157
+
158
+ it('keeps a name holding a backtick inside one code span', () => {
159
+ // A valid ref name may carry a backtick; a plain span would end at it.
160
+ const rule = sharedFileRules(DEFAULT_KB_LAYOUT, 'release`candidate').find((r) => r.id === 'agent-guide')!.body;
161
+ expect(rule).toContain("default branch is ``release`candidate``: the branch");
162
+ const edge = sharedFileRules(DEFAULT_KB_LAYOUT, '`main`').find((r) => r.id === 'agent-guide')!.body;
163
+ expect(edge).toContain('default branch is `` `main` ``: the branch');
164
+ });
165
+
166
+ it('fits the caps with the longest branch name the platform accepts, so the caps are ceilings and not samples', () => {
167
+ // kb-fs refuses a branch name over 255 characters; the caps are measured
168
+ // with one of exactly that length, not with a typical name.
169
+ const longest = 'b'.repeat(255);
170
+ expect(sharedFileRulesSection(DEFAULT_KB_LAYOUT, longest).length).toBeLessThanOrEqual(SHARED_FILE_RULES_CAP);
171
+ expect(composeAgentInstructions('x'.repeat(PREAMBLE_CAP * 2), DEFAULT_KB_LAYOUT, longest).instructions.length).toBeLessThanOrEqual(
172
+ INSTRUCTIONS_CAP,
173
+ );
174
+ });
175
+
176
+ it('keeps a call that passes no branch working, naming none', () => {
177
+ // The helpers are exported: a caller written before the branch was named
178
+ // gets the text it got then, not a throw on an undefined name.
179
+ expect(sharedFileRules(DEFAULT_KB_LAYOUT)).toEqual(sharedFileRules(DEFAULT_KB_LAYOUT, ''));
180
+ expect(sharedFileRulesSection(DEFAULT_KB_LAYOUT)).toBe(sharedFileRulesSection(DEFAULT_KB_LAYOUT, ''));
181
+ expect(platformInstructions(DEFAULT_KB_LAYOUT)).toBe(platformInstructions(DEFAULT_KB_LAYOUT, ''));
182
+ });
183
+
184
+ it('carries the same sentence in the handshake instructions and in the managed guide', async () => {
185
+ const instructions = composeAgentInstructions(null, DEFAULT_KB_LAYOUT, 'target-company-state').instructions;
186
+ const guide = await composeAgentGuide(DEFAULT_KB_LAYOUT, undefined, { defaultBranch: 'target-company-state' });
187
+ expect(conventions(instructions)).toContain(SENTENCE);
188
+ expect(conventions(guide)).toContain(SENTENCE);
189
+ expect(instructions).toContain(sharedFileRulesSection(DEFAULT_KB_LAYOUT, 'target-company-state'));
190
+ expect(guide).toContain(sharedFileRulesSection(DEFAULT_KB_LAYOUT, 'target-company-state'));
191
+ });
192
+
193
+ it('names the renamed branch, and nothing else changes', async () => {
194
+ const before = composeAgentInstructions(null, DEFAULT_KB_LAYOUT, 'target-company-state').instructions;
195
+ const after = composeAgentInstructions(null, DEFAULT_KB_LAYOUT, 'company-state').instructions;
196
+ expect(after).toContain(SENTENCE.replace('target-company-state', 'company-state'));
197
+ expect(after).toBe(before.replaceAll('target-company-state', 'company-state'));
198
+ });
199
+
200
+ it('names the branch in effect on GET /agent/instructions, read per request', async () => {
201
+ let branch = 'target-company-state';
202
+ // Who may read the route is its own suite's question; here every caller passes.
203
+ const app = express();
204
+ app.use('/api', createAgentInstructionsRoutes((_req, _res, next) => next(), async () => null, undefined, () => branch));
205
+ const server = await new Promise<HttpServer>((resolve) => {
206
+ const s = app.listen(0, () => resolve(s));
207
+ });
208
+ try {
209
+ const url = `http://127.0.0.1:${(server.address() as AddressInfo).port}/api/agent/instructions`;
210
+ const read = async () => ((await (await fetch(url)).json()) as { instructions: string }).instructions;
211
+ const before = await read();
212
+ expect(before).toBe(platformInstructions(DEFAULT_KB_LAYOUT, 'target-company-state'));
213
+ expect(conventions(before)).toContain(SENTENCE);
214
+ branch = 'company-state';
215
+ expect(await read()).toBe(before.replaceAll('target-company-state', 'company-state'));
216
+ } finally {
217
+ await new Promise<void>((r) => server.close(() => r()));
218
+ }
219
+ });
220
+ });
221
+
118
222
  describe('the delete rule for platform files', () => {
119
- const managedItems = (): string => sharedFileRules(DEFAULT_KB_LAYOUT).find((r) => r.id === 'managed-items')!.body;
223
+ const managedItems = (): string => sharedFileRules(DEFAULT_KB_LAYOUT, '').find((r) => r.id === 'managed-items')!.body;
120
224
 
121
225
  it('says a nested access.md is deleted by whoever may write it, and the root\'s platform files by nobody', async () => {
122
226
  const body = managedItems();
@@ -131,7 +235,9 @@ describe('the delete rule for platform files', () => {
131
235
 
132
236
  describe('the handshake text stays inside the length it pins', () => {
133
237
  it('holds the shared section under its own cap', () => {
134
- const section = sharedFileRulesSection(DEFAULT_KB_LAYOUT);
238
+ // With a default branch named, as on every deployment past setup — the
239
+ // sentence naming it counts against the cap like any rule.
240
+ const section = sharedFileRulesSection(DEFAULT_KB_LAYOUT, 'target-company-state');
135
241
  expect(
136
242
  section.length,
137
243
  `the shared rules are ${section.length} characters (cap ${SHARED_FILE_RULES_CAP})`,
@@ -151,7 +257,7 @@ describe('the handshake text stays inside the length it pins', () => {
151
257
 
152
258
  it('hands the platform-owned text back as `header`, apart from the admin preamble', () => {
153
259
  const out = composeAgentInstructions('We sell permits.');
154
- expect(out.header).toBe(platformInstructions(DEFAULT_KB_LAYOUT));
260
+ expect(out.header).toBe(platformInstructions(DEFAULT_KB_LAYOUT, ''));
155
261
  expect(out.header).toContain(PLATFORM_HEADER);
156
262
  expect(out.header).toContain(`## ${SHARED_RULES_SECTION}`);
157
263
  expect(out.preamble).toBe('We sell permits.');
@@ -27,12 +27,19 @@ export function createAgentInstructionsRoutes(
27
27
  manualAuth: RequestHandler,
28
28
  readPreamble: AgentPreambleReader,
29
29
  /**
30
- * The layout in effect, read per request — the shared file rules name the
31
- * guide by the name a deployment saved for it, which the setup save may
32
- * change without a restart. Optional so a construction with no layout in
33
- * hand gets `AGENTS.md`.
30
+ * The layout in effect, read per request — the shared file rules spell the
31
+ * root folders (`Skills/`, the knowledge folder) and the platform files by
32
+ * the names a deployment saved, which the setup save may change without a
33
+ * restart. Optional so a construction with no layout in hand gets the
34
+ * default layout. The guide itself is `AGENTS.md` on every deployment.
34
35
  */
35
36
  kbLayout?: () => KbLayout,
37
+ /**
38
+ * The default branch in effect, read per request, which the shared file
39
+ * rules name as the branch people read. Optional like the layout: without
40
+ * it the rules name no branch.
41
+ */
42
+ defaultBranch?: () => string,
36
43
  ): express.Router {
37
44
  const router = express.Router();
38
45
 
@@ -41,7 +48,7 @@ export function createAgentInstructionsRoutes(
41
48
  // successful one: the contract is on the route, not on the happy path.
42
49
  res.setHeader('Cache-Control', 'no-store');
43
50
  try {
44
- res.json(composeAgentInstructions(await readPreamble(), kbLayout?.()));
51
+ res.json(composeAgentInstructions(await readPreamble(), kbLayout?.(), defaultBranch?.()));
45
52
  } catch (err) {
46
53
  log.error('reading mcp-description.md failed:', { err });
47
54
  res.status(500).json({ error: 'Failed to read the agent instructions' });
@@ -50,6 +50,17 @@ export const PLATFORM_HEADER =
50
50
  'search the knowledge base: call `start_session` once, then `grep` for the key terms, `list_files` to orient, and `read_file` what matches. ' +
51
51
  'Prefer what you find there over memory or the web, and say so when the knowledge base is silent on something the organisation should have documented. ' +
52
52
  'Skills are available as prompts and through `list_skills` and `get_skill`. ' +
53
+ // Not said here: how to onboard someone new. The guide's start routes that
54
+ // question to the `onboarding` section, and that row is what the agents
55
+ // read (the agent-guide benchmark, 2026-10-29: every onboarding run reached
56
+ // the section through `start-here`, including the runs in clients that
57
+ // drop `instructions` — claude.ai on the web, the Agent SDK, Cline). The
58
+ // handshake stays the text an agent gets before it reads the guide, not a
59
+ // second copy of the guide's routing.
60
+ // Said here as well as on the write tools: agents wrote to the default
61
+ // branch without asking (the agent-guide benchmark, 2026-10-26), and this
62
+ // text reaches an agent that never fetches the guide.
63
+ 'A write to the default branch is live for everyone: unless the person said where, ask first whether to write there or on a draft. ' +
53
64
  // There is no one calling shape to state: the knowledge-base tools take
54
65
  // their arguments under `body`, a tool that calls another service takes them
55
66
  // flat, and an agent told one rule for all of them sends a GET with a body.
@@ -71,13 +82,13 @@ export const TOOL_PREFIX_LINE = "This organisation's knowledge base. Search it b
71
82
  * `header` field carries and what the card shows as fixed and not editable;
72
83
  * the admin's preamble follows it.
73
84
  *
74
- * A FUNCTION of the layout, because the shared rules name the platform files
75
- * by the root names a deployment chose (`Skills/`, `Plugins/`), which are
76
- * deployment settings. The guide's name is not one of them: it is `AGENTS.md`
77
- * everywhere.
85
+ * A FUNCTION of the layout and the default branch, because the shared rules
86
+ * name the platform files by the root names a deployment chose (`Skills/`,
87
+ * `Plugins/`) and name the branch it reads from, which are deployment
88
+ * settings. The guide's name is not one of them: it is `AGENTS.md` everywhere.
78
89
  */
79
- export function platformInstructions(layout: KbLayout): string {
80
- return `${PLATFORM_HEADER}\n\n${sharedFileRulesSection(layout)}`;
90
+ export function platformInstructions(layout: KbLayout, defaultBranch = ''): string {
91
+ return `${PLATFORM_HEADER}\n\n${sharedFileRulesSection(layout, defaultBranch)}`;
81
92
  }
82
93
 
83
94
  /**
@@ -91,9 +102,11 @@ export function platformInstructions(layout: KbLayout): string {
91
102
  * test is what makes it a ceiling rather than a hope: a shared rule that grew
92
103
  * past it fails before it reaches an agent.
93
104
  *
94
- * 14,400 since the shared rules' own cap rose by 400 (the `__tmp__/` ref).
105
+ * 14,400 since the shared rules' own cap rose by 400 (the `__tmp__/` ref);
106
+ * 14,900 since it rose by 500 more (the sentence naming the default branch,
107
+ * measured with the longest name the platform accepts — see that cap).
95
108
  */
96
- export const INSTRUCTIONS_CAP = 14_400;
109
+ export const INSTRUCTIONS_CAP = 14_900;
97
110
 
98
111
  /** The one-line marker that replaces everything past the preamble cap. */
99
112
  export const PREAMBLE_TRUNCATION_MARKER = `[preamble truncated at ${PREAMBLE_CAP.toLocaleString('en-US')} characters; shorten ${PREAMBLE_FILE}]`;
@@ -135,12 +148,18 @@ export interface ComposedAgentInstructions {
135
148
  * caller with no layout in hand (a test, a surface that predates the setting)
136
149
  * gets the defaults. The guide's name is not among them: it is `AGENTS.md` on
137
150
  * every deployment.
151
+ *
152
+ * `defaultBranch` is the branch the shared rules name as the one people read
153
+ * (`KbContext.defaultBranch`, read when composing). Without one — a caller
154
+ * with no knowledge base in hand, or a deployment not yet set up — the rules
155
+ * name no branch.
138
156
  */
139
157
  export function composeAgentInstructions(
140
158
  preamble: string | null,
141
159
  layout: KbLayout = DEFAULT_KB_LAYOUT,
160
+ defaultBranch = '',
142
161
  ): ComposedAgentInstructions {
143
- const platform = platformInstructions(layout);
162
+ const platform = platformInstructions(layout, defaultBranch);
144
163
  const { text, unterminated } = stripHtmlComments(preamble ?? '');
145
164
  const normalized = text.replace(/\r\n?/g, '\n');
146
165
  const stripped = normalized.trim();
@@ -26,9 +26,11 @@
26
26
  * which copy is current. Each description opens instead with the one
27
27
  * sentence sending the agent to the guide (`tool-registry/guide-first.ts`).
28
28
  *
29
- * Pure text, a function of the layout only: the guide's name is a deployment
30
- * setting (an alias a deployment chose before the guide left the disk), so
31
- * nothing here may snapshot `AGENTS.md`.
29
+ * Pure text, a function of the layout and the default branch: both are
30
+ * deployment settings, so every caller passes the values in effect when it
31
+ * composes, and nothing here may snapshot a folder name or a branch name.
32
+ * The branch defaults to `''` (no branch named), so a caller that passes only
33
+ * the layout gets the text it got before the branch was named.
32
34
  */
33
35
 
34
36
  import {
@@ -65,8 +67,14 @@ const PRE_RENAME_AGENTS_FILE = 'CLAUDE.md';
65
67
  * 7,400 since the `__tmp__/` ref: four tools take it, so what it reaches and
66
68
  * that it is read-only is said once here rather than in each description, and
67
69
  * the section had no room left for it.
70
+ *
71
+ * 7,900 since the conventions rule names the default branch: the guide's start
72
+ * names it too, but only to an agent that calls `get_agent_guide`, and the
73
+ * sentence is ~165 characters plus the name. A CEILING, not a sample: measured
74
+ * with the longest branch name the platform accepts (255 characters, the
75
+ * bound `kb-fs` enforces), so no deployment's name can push the rules past it.
68
76
  */
69
- export const SHARED_FILE_RULES_CAP = 7_400;
77
+ export const SHARED_FILE_RULES_CAP = 7_900;
70
78
 
71
79
  /** One shared rule: how the guide heads it, and the rule itself. */
72
80
  export interface SharedFileRule {
@@ -87,12 +95,12 @@ export interface SharedFileRule {
87
95
  * than rewritten wherever the wording still reads outside its old tool — the
88
96
  * ones that said "this tool" or "this call" name the tools instead.
89
97
  */
90
- export function sharedFileRules(layout: KbLayout): readonly SharedFileRule[] {
98
+ export function sharedFileRules(layout: KbLayout, defaultBranch = ''): readonly SharedFileRule[] {
91
99
  return [
92
100
  {
93
101
  id: 'agent-guide',
94
102
  heading: "This knowledge base's own conventions",
95
- body: conventionsRule(),
103
+ body: conventionsRule(defaultBranch),
96
104
  },
97
105
  {
98
106
  id: 'content-kinds',
@@ -177,10 +185,10 @@ export function sharedFileRules(layout: KbLayout): readonly SharedFileRule[] {
177
185
  body:
178
186
  'move_file, copy_file and delete_folder take `dryRun: true`: it changes nothing and answers the impact — ' +
179
187
  'what the call would touch, `allowed`, and `reason` when it may not run. A non-empty folder is deleted, and a ' +
180
- 'move that changes your access runs, only with `confirm: true`; without it the call changes nothing and ' +
188
+ 'move that changes anyone\'s access runs, only with `confirm: true`; without it the call changes nothing and ' +
181
189
  'returns the same impact with `confirmationRequired: true`. Do NOT set `confirm: true` on your first call — ' +
182
190
  'dry-run, check the impact, then confirm. delete_file takes neither: check it first with file_stat ' +
183
- '(`deletable`) if you are unsure. delete_branch has its own `dryRun`.',
191
+ '(`deletable`). delete_branch has its own `dryRun`.',
184
192
  },
185
193
  {
186
194
  id: 'managed-items',
@@ -200,7 +208,7 @@ export function sharedFileRules(layout: KbLayout): readonly SharedFileRule[] {
200
208
  id: 'refused-for-permissions',
201
209
  heading: 'When a write is refused for permissions',
202
210
  body:
203
- 'A refusal is not necessarily the end of the road: the `write-denied` error says whether you may propose the ' +
211
+ 'The `write-denied` error says whether you may propose the ' +
204
212
  'change instead (create a branch from this one, repeat the call on it, then `open_change_request` into this ' +
205
213
  'branch) and lists those steps.',
206
214
  },
@@ -238,28 +246,64 @@ function platformFileList(layout: KbLayout): string {
238
246
  * The conventions reminder — where the platform's guide is, that the
239
247
  * organisation's own conventions file comes with it, and to read both first.
240
248
  *
241
- * The guide is read by name at the repository root, where coding agents look
242
- * for an `AGENTS.md` by convention, and `get_agent_guide` returns it alone.
249
+ * The guide's start is read by name at the repository root, where coding
250
+ * agents look for an `AGENTS.md` by convention, and `get_agent_guide` returns
251
+ * it or any one section.
243
252
  * One name on every deployment, so the rule takes no layout. `CLAUDE.md` is
244
253
  * named as a fallback because a knowledge base seeded before the rename may
245
254
  * still carry one its people edited.
246
255
  */
247
- function conventionsRule(): string {
256
+ function conventionsRule(defaultBranch: string): string {
257
+ const guide =
258
+ "Before your first read or change in a workspace, call `get_agent_guide`: it answers the guide's start, " +
259
+ "which names the default branch and the section for each question. " +
260
+ `read_file on \`${LEGACY_AGENTS_FILE}\` at the KB root answers with ` +
261
+ "that start, after the organisation's own conventions file of that name when it has one: follow both. A " +
262
+ `\`${PRE_RENAME_AGENTS_FILE}\` at the KB root is the organisation's own too; read it if it exists.`;
263
+ const branch = defaultBranchSentence(defaultBranch);
264
+ return branch ? `${guide}\n\n${branch}` : guide;
265
+ }
266
+
267
+ /**
268
+ * The one sentence naming the deployment's default branch. The guide's start
269
+ * names it too, but only once an agent calls `get_agent_guide`; every file
270
+ * tool asks for "the branch you are working on", and an agent left to guess
271
+ * guesses `main`, which on a deployment whose default is another branch
272
+ * writes where nobody reads. So the rules every channel carries name it.
273
+ *
274
+ * Empty while the deployment has no branch model (`KbContext.defaultBranch` is
275
+ * `''` until setup is answered): there is no name to give yet.
276
+ */
277
+ function defaultBranchSentence(defaultBranch: string): string {
278
+ const name = defaultBranch.trim();
279
+ if (!name) return '';
248
280
  return (
249
- "Before your first read or change in a workspace, call `get_agent_guide` and read the platform's guide " +
250
- `(whole, or one section). read_file on \`${LEGACY_AGENTS_FILE}\` at the KB root answers with the same ` +
251
- "guide, after the organisation's own conventions file of that name when it has one: follow both. A " +
252
- `\`${PRE_RENAME_AGENTS_FILE}\` at the KB root is the organisation's own too; read it if it exists.`
281
+ `This knowledge base's default branch is ${markdownCodeSpan(name)}: the branch people read and the usual target of a ` +
282
+ 'change request; pass it as `branch` unless you are working on a draft.'
253
283
  );
254
284
  }
255
285
 
286
+ /**
287
+ * `text` as one Markdown code span whatever it contains: a fence one backtick
288
+ * longer than the longest run inside it, padded with a space where the text
289
+ * starts or ends with a backtick (CommonMark strips one such space). A branch
290
+ * name may hold a backtick, and a plain `` `name` `` would end the span early
291
+ * and leave the rest of the sentence naming half a branch.
292
+ */
293
+ function markdownCodeSpan(text: string): string {
294
+ const longestRun = Math.max(0, ...(text.match(/`+/g) ?? []).map((run) => run.length));
295
+ const fence = '`'.repeat(longestRun + 1);
296
+ const padded = text.startsWith('`') || text.endsWith('`') ? ` ${text} ` : text;
297
+ return `${fence}${padded}${fence}`;
298
+ }
299
+
256
300
  /**
257
301
  * The shared rules as ONE markdown section — the string both channels carry,
258
302
  * byte for byte. A `##` section so it drops into the managed guide at that
259
303
  * level and still reads as a block in the instructions blob.
260
304
  */
261
- export function sharedFileRulesSection(layout: KbLayout): string {
262
- const body = sharedFileRules(layout)
305
+ export function sharedFileRulesSection(layout: KbLayout, defaultBranch = ''): string {
306
+ const body = sharedFileRules(layout, defaultBranch)
263
307
  .map((rule) => `### ${rule.heading}\n\n${rule.body}`)
264
308
  .join('\n\n');
265
309
  return `## ${SHARED_RULES_SECTION}\n\n${body}`;
@@ -133,7 +133,7 @@ async function start(opts: { agentScope?: boolean } = {}): Promise<string> {
133
133
  const resolve = createToolContextResolver({
134
134
  authService: { getUserById: async () => ADA } as never,
135
135
  workspaceService: {} as never,
136
- workflowService: {} as never,
136
+ versionControlService: {} as never,
137
137
  events: {} as never,
138
138
  kbDirName: 'knowledge-base',
139
139
  creatorAccess: {} as never,