@bevel-software/platform-core-backend 0.35.0 → 0.37.0

package/src/modules/workspace/__tests__/agent-access.gate.test.ts

@@ -7,7 +7,7 @@ import {
   ToolDescriptionNotes,
   type AgentAccessGate,
 } from '../agent-access.gate.js';
-import { WorkflowHooks, type AgentOperationContext } from '../../workflow/workflow-hooks.js';
+import { VersionControlHooks, type AgentOperationContext } from '../../version-control/version-control-hooks.js';
 import { ToolError, type ToolContext } from '../../tool-helpers/tool.contract.js';
 
 const RECOVERY_EMAIL = 'recovery-bot@bevel.local';
@@ -21,7 +21,7 @@ function ctx(over: Partial<ToolContext> = {}): ToolContext {
     sessionId: 's1',
     abortSignal: new AbortController().signal,
     workspaceService: {} as never,
-    workflowService: {} as never,
+    versionControlService: {} as never,
     events: {} as never,
     getFilesystem: async () => ({}) as never,
     ...over,
@@ -30,7 +30,7 @@ function ctx(over: Partial<ToolContext> = {}): ToolContext {
 
 /** A gate with a fresh hook registry, plus the two lists of what the hooks saw. */
 function makeGate(): { gate: AgentAccessGate; reads: AgentOperationContext[]; writes: AgentOperationContext[] } {
-  const hooks = new WorkflowHooks();
+  const hooks = new VersionControlHooks();
   const reads: AgentOperationContext[] = [];
   const writes: AgentOperationContext[] = [];
   hooks.onAgentRead(async (op) => {
@@ -84,7 +84,7 @@ describe('notifyAgentRead', () => {
   });
 
   it('refuses the read with the hook\'s own message and status', async () => {
-    const hooks = new WorkflowHooks();
+    const hooks = new VersionControlHooks();
     hooks.onAgentRead(async () => {
       throw new ToolError('Not in this conversation.', 403);
     });
@@ -98,7 +98,7 @@ describe('notifyAgentRead', () => {
   it('is a no-op with no hook registered', async () => {
     const gate: AgentAccessGate = {
       recoveryBotEmail: RECOVERY_EMAIL,
-      hooks: new WorkflowHooks(),
+      hooks: new VersionControlHooks(),
       notes: new ToolDescriptionNotes(),
     };
     await expect(notifyAgentRead(gate, ctx({ sessionId: undefined }), 'main', P_FILE)).resolves.toBeUndefined();
@@ -123,7 +123,7 @@ describe('assertAgentWriteAllowed', () => {
   });
 
   it('refuses the write with the hook\'s own message and status', async () => {
-    const hooks = new WorkflowHooks();
+    const hooks = new VersionControlHooks();
     hooks.onPreWrite(async () => {
       throw new ToolError('Not in this conversation.', 403);
     });
@@ -135,7 +135,7 @@ describe('assertAgentWriteAllowed', () => {
   });
 
   it('runs every registered write hook, in registration order, until one throws', async () => {
-    const hooks = new WorkflowHooks();
+    const hooks = new VersionControlHooks();
     const seen: string[] = [];
     hooks.onPreWrite(async () => {
       seen.push('first');
@@ -162,7 +162,7 @@ describe('assertAgentWriteAllowed', () => {
   it('is a no-op with no hook registered, with or without a session id', async () => {
     const gate: AgentAccessGate = {
       recoveryBotEmail: RECOVERY_EMAIL,
-      hooks: new WorkflowHooks(),
+      hooks: new VersionControlHooks(),
       notes: new ToolDescriptionNotes(),
     };
     await expect(assertAgentWriteAllowed(gate, ctx(), 'main', P_FILE)).resolves.toBeUndefined();

package/src/modules/workspace/__tests__/agent-downloads.test.ts

@@ -10,15 +10,14 @@ import { afterEach, describe, expect, it, vi } from 'vitest';
 import { LocalFilesystem } from '@mastra/core/workspace';
 import { DEFAULT_KB_LAYOUT } from '@bevel-software/platform-shared';
 import { testKbContext } from '../../../__tests__/kb-context.js';
-import { NodeFs } from '../../kb-fs/node-fs.js';
-import { AccessControlService } from '../../access/access-control.service.js';
-import { ToolRegistry } from '../../tool-registry/tool-registry.js';
-import { createToolHandlerFactory, type ToolBranchPort } from '../../tool-helpers/tool-handler.js';
-import { ToolError, type ToolContext } from '../../tool-helpers/tool.contract.js';
-import type { ToolAuth } from '../../tool-auth/tool-auth.middleware.js';
+import { realDisk } from '../../../__tests__/real-disk.js';
+import { AccessControlService, createToolHandlerFactory, type ToolBranchPort, VersionControlHooks, readAuthCookie } from '../../../__tests__/tool-wiring.js';
+import { ToolRegistry } from '../../tool-registry/index.js';
+import { ToolError, type ToolContext } from '../../tool-helpers/index.js';
+import type { ToolAuth } from '../../tool-auth/index.js';
+import { READ_ONLY_CODE, type IWriteAccess } from '../../write-access/index.js';
 import { registerWorkspaceTools } from '../workspace.tools.js';
 import { RoutineWritePolicyService } from '../routine-write-policy.js';
-import { WorkflowHooks } from '../../workflow/workflow-hooks.js';
 import { ToolDescriptionNotes } from '../agent-access.gate.js';
 import { SpillStore } from '../spill-store.js';
 import { DocExtractService } from '../file-readers/doc-extract.service.js';
@@ -26,11 +25,9 @@ import { WorkerDocumentExtractor } from '../file-readers/extract-in-worker.js';
 import { workspaceIdForBranch } from '../../../shared/workspace-id.js';
 import { AgentDownloadStore, DOWNLOAD_TOKEN_REFUSAL } from '../agent-download.store.js';
 import { attachmentDisposition, createAgentDownloadRoutes, createDownloadFetcherIdentifier } from '../agent-download.routes.js';
-import { readAuthCookie } from '../../auth/auth.middleware.js';
 import jwt from 'jsonwebtoken';
 import { buildDownload, DOWNLOAD_PERMISSION_REQUIRED, NOT_FOUND } from '../agent-download.builder.js';
-import { READ_ONLY_CODE, type IWriteAccess } from '../../write-access/write-access.js';
-import { sharedFileRules } from '../../agent-instructions/shared-file-rules.js';
+import { sharedFileRules } from '../../agent-instructions/index.js';
 import { newWorkspaceService } from '../../../__tests__/workspace-service.js';
 
 /**
@@ -141,9 +138,9 @@ async function start(options: StartOptions = {}): Promise<Started> {
     root,
     'https://example.invalid/kb.git',
     testKbContext({ kbDirName: KB }),
-    new NodeFs(),
+    realDisk(),
   );
-  const accessControl = new AccessControlService(workspaceService, KB, new NodeFs());
+  const accessControl = new AccessControlService(workspaceService, KB, realDisk());
   const store = new AgentDownloadStore({
     root: downloadsRoot,
     publicBaseUrl: PUBLIC_BASE,
@@ -152,7 +149,7 @@ async function start(options: StartOptions = {}): Promise<Started> {
     ...(options.maxOpenPerUser !== undefined ? { maxOpenPerUser: options.maxOpenPerUser } : {}),
   });
   stores.push(store);
-  const hooks = new WorkflowHooks();
+  const hooks = new VersionControlHooks();
   const readsHooked: string[] = [];
   hooks.onAgentRead(async (op) => {
     readsHooked.push(op.wsPath ?? '');
@@ -168,7 +165,7 @@ async function start(options: StartOptions = {}): Promise<Started> {
     sessionId,
     abortSignal: signal,
     workspaceService,
-    workflowService: {} as never,
+    versionControlService: {} as never,
     events: {} as never,
     getFilesystem: async () => fs,
   });
@@ -783,7 +780,7 @@ describe('credentials, deployments and the read hook', () => {
 
 describe('what agents are told', () => {
   it('describes download beside upload in the shared rule on large and binary content', () => {
-    const rule = sharedFileRules(DEFAULT_KB_LAYOUT).find((r) => r.id === 'upload-route')!;
+    const rule = sharedFileRules(DEFAULT_KB_LAYOUT, '').find((r) => r.id === 'upload-route')!;
     expect(rule.heading).toMatch(/download out/);
     expect(rule.body).toContain('`request_file_upload`');
     expect(rule.body).toContain('`request_file_download`');
@@ -801,7 +798,7 @@ describe('what agents are told', () => {
       {} as never,
       {} as never,
       testKbContext({ kbDirName: KB }),
-      { recoveryBotEmail: 'r@x', hooks: new WorkflowHooks(), notes: new ToolDescriptionNotes() },
+      { recoveryBotEmail: 'r@x', hooks: new VersionControlHooks(), notes: new ToolDescriptionNotes() },
       new RoutineWritePolicyService(),
       {} as never,
       undefined,

package/src/modules/workspace/__tests__/agent-uploads.test.ts

@@ -8,29 +8,28 @@ import express from 'express';
 import { afterEach, describe, expect, it } from 'vitest';
 import { LocalFilesystem } from '@mastra/core/workspace';
 import { testKbContext } from '../../../__tests__/kb-context.js';
-import { ToolRegistry } from '../../tool-registry/tool-registry.js';
-import { createToolHandlerFactory } from '../../tool-helpers/tool-handler.js';
-import type { ToolContext } from '../../tool-helpers/tool.contract.js';
-import type { ToolAuth } from '../../tool-auth/tool-auth.middleware.js';
+import { ToolRegistry } from '../../tool-registry/index.js';
+import { createToolHandlerFactory, VersionControlHooks } from '../../../__tests__/tool-wiring.js';
+import type { ToolContext } from '../../tool-helpers/index.js';
+import type { ToolAuth } from '../../tool-auth/index.js';
+import type { IAccessControl } from '../../access/index.js';
+import { normalizeWorkspacePath } from '../../kb-fs/index.js';
+import { READ_ONLY_CODE, type IWriteAccess } from '../../write-access/index.js';
 import { registerWorkspaceTools } from '../workspace.tools.js';
 import { RoutineWritePolicyService } from '../routine-write-policy.js';
-import { WorkflowHooks } from '../../workflow/workflow-hooks.js';
 import { ToolDescriptionNotes } from '../agent-access.gate.js';
 import { SpillStore } from '../spill-store.js';
 import { DocExtractService } from '../file-readers/doc-extract.service.js';
 import { WorkerDocumentExtractor } from '../file-readers/extract-in-worker.js';
-import type { IAccessControl } from '../../access/access-control.interface.js';
-import { normalizeWorkspacePath } from '../../kb-fs/repo-path.js';
 import {
   AgentUploadStore,
   assertUploadsRootOutsideWorkspaces,
   UPLOAD_TOKEN_REFUSAL,
 } from '../agent-upload.store.js';
 import { createAgentUploadRoutes, isAgentUploadRawBodyPath } from '../agent-upload.routes.js';
-import { READ_ONLY_CODE, type IWriteAccess } from '../../write-access/write-access.js';
 import { MAX_UPLOAD_BYTES } from '../upload-limits.js';
 import { DEFAULT_KB_LAYOUT } from '@bevel-software/platform-shared';
-import { sharedFileRules } from '../../agent-instructions/shared-file-rules.js';
+import { sharedFileRules } from '../../agent-instructions/index.js';
 
 /**
  * The upload route an agent lands files by, end to end: a token, bytes sent to
@@ -223,7 +222,7 @@ async function start(options: StartOptions = {}): Promise<string> {
         }
       },
     } as never,
-    workflowService: {} as never,
+    versionControlService: {} as never,
     events: {} as never,
     getFilesystem: async () => fs,
   });
@@ -247,7 +246,7 @@ async function start(options: StartOptions = {}): Promise<string> {
     new DocExtractService(docCacheDir, new WorkerDocumentExtractor()),
     access,
     testKbContext({ kbDirName: KB_DIR }),
-    { recoveryBotEmail: 'recovery-bot@bevel.local', hooks: new WorkflowHooks(), notes: new ToolDescriptionNotes() },
+    { recoveryBotEmail: 'recovery-bot@bevel.local', hooks: new VersionControlHooks(), notes: new ToolDescriptionNotes() },
     new RoutineWritePolicyService(),
     {} as never,
     undefined,
@@ -1507,7 +1506,7 @@ describe('the write tools name the upload route', () => {
     // The three failures the route exists for are named where the full
     // explanation lives: said on each of three descriptions, it took every one
     // of them past the length a client cuts at.
-    const rule = sharedFileRules(DEFAULT_KB_LAYOUT).find((r) => r.id === 'upload-route');
+    const rule = sharedFileRules(DEFAULT_KB_LAYOUT, '').find((r) => r.id === 'upload-route');
     expect(rule).toBeDefined();
     expect(rule!.body).toMatch(/cut off mid-answer/);
     expect(rule!.body).toMatch(/escapes fails to parse/);

package/src/modules/workspace/__tests__/escape-sequences.routes.test.ts

@@ -6,24 +6,19 @@ import { join } from 'node:path';
 import express, { type RequestHandler } from 'express';
 import { afterEach, describe, expect, it } from 'vitest';
 import { LocalFilesystem } from '@mastra/core/workspace';
-import { ToolRegistry } from '../../tool-registry/tool-registry.js';
-import { createManualRoutes } from '../../tool-registry/manual.routes.js';
-import { createToolHandlerFactory } from '../../tool-helpers/tool-handler.js';
-import type { ToolContext } from '../../tool-helpers/tool.contract.js';
-import type { ToolAuth } from '../../tool-auth/tool-auth.middleware.js';
+import { ToolRegistry, createManualRoutes, GUIDE_FIRST_SENTENCE } from '../../tool-registry/index.js';
+import { createToolHandlerFactory, VersionControlHooks, createMcpRoutes, McpService } from '../../../__tests__/tool-wiring.js';
+import type { ToolContext } from '../../tool-helpers/index.js';
+import type { ToolAuth } from '../../tool-auth/index.js';
+import type { IAccessControl } from '../../access/index.js';
 import { registerWorkspaceTools } from '../workspace.tools.js';
 import { RoutineWritePolicyService } from '../routine-write-policy.js';
-import { WorkflowHooks } from '../../workflow/workflow-hooks.js';
 import { ToolDescriptionNotes } from '../agent-access.gate.js';
 import { SpillStore } from '../spill-store.js';
 import { DocExtractService } from '../file-readers/doc-extract.service.js';
 import { WorkerDocumentExtractor } from '../file-readers/extract-in-worker.js';
-import type { IAccessControl } from '../../access/access-control.interface.js';
-import { createMcpRoutes } from '../../mcp/mcp.routes.js';
-import { McpService } from '../../mcp/mcp.service.js';
 import { testKbContext } from '../../../__tests__/kb-context.js';
-import { sharedFileRules, sharedFileRulesSection } from '../../agent-instructions/shared-file-rules.js';
-import { GUIDE_FIRST_SENTENCE } from '../../tool-registry/guide-first.js';
+import { sharedFileRules, sharedFileRulesSection } from '../../agent-instructions/index.js';
 
 /**
  * Who decodes escape sequences in written content a second time — settled on
@@ -122,7 +117,7 @@ async function startPlatform(): Promise<Platform> {
     sessionId,
     abortSignal: signal,
     workspaceService: {} as never,
-    workflowService: {} as never,
+    versionControlService: {} as never,
     events: {} as never,
     getFilesystem: async () => fs,
   });
@@ -140,7 +135,7 @@ async function startPlatform(): Promise<Platform> {
     new DocExtractService(join(tempDir, 'doc-extract'), new WorkerDocumentExtractor()),
     allowAll,
     testKbContext({ kbDirName: KB_DIR }),
-    { recoveryBotEmail: 'recovery-bot@bevel.local', hooks: new WorkflowHooks(), notes: new ToolDescriptionNotes() },
+    { recoveryBotEmail: 'recovery-bot@bevel.local', hooks: new VersionControlHooks(), notes: new ToolDescriptionNotes() },
     new RoutineWritePolicyService(),
     {} as never,
   );
@@ -371,18 +366,18 @@ describe('what the write tools tell an agent about escape sequences', () => {
     // a SHARED rule: stated in the handshake instructions and in the managed
     // agent guide, and repeated in no tool description — a description that
     // carried it was long enough for a client to cut the end off.
-    const rule = sharedFileRules(testKbContext().layout).find((r) => r.id === 'escape-sequences')!;
+    const rule = sharedFileRules(testKbContext().layout, testKbContext().defaultBranch).find((r) => r.id === 'escape-sequences')!;
     expect(rule.body).toContain('some clients decode escape sequences in arguments before sending');
     // The way out is the upload route, which the rule after it spells out by
     // the names of the tools this deployment serves.
     expect(rule.body).toContain('by upload (see below), which lands it unchanged');
-    const upload = sharedFileRules(testKbContext().layout).find((r) => r.id === 'upload-route')!;
+    const upload = sharedFileRules(testKbContext().layout, testKbContext().defaultBranch).find((r) => r.id === 'upload-route')!;
     expect(upload.body).toContain('`request_file_upload`');
     expect(upload.body).toContain('`apply_file_upload`');
     // It names the three tools it is about, so an agent reading the section
     // knows where it applies.
     for (const name of ['write_file', 'write_files', 'edit_file']) expect(rule.body, name).toContain(name);
-    expect(sharedFileRulesSection(testKbContext().layout)).toContain(rule.body);
+    expect(sharedFileRulesSection(testKbContext().layout, testKbContext().defaultBranch)).toContain(rule.body);
 
     const carrying = Object.entries(served)
       .filter(([, d]) => d.includes('decode escape sequences in arguments before sending') || d.includes('some clients decode them in arguments'))

package/src/modules/workspace/__tests__/file-stat-access.test.ts

@@ -12,7 +12,7 @@ import type { ToolContext } from '../../tool-helpers/tool.contract.js';
 import type { ToolAuth } from '../../tool-auth/tool-auth.middleware.js';
 import { registerWorkspaceTools } from '../workspace.tools.js';
 import { RoutineWritePolicyService } from '../routine-write-policy.js';
-import { WorkflowHooks } from '../../workflow/workflow-hooks.js';
+import { VersionControlHooks } from '../../version-control/version-control-hooks.js';
 import { ToolDescriptionNotes } from '../../workspace/agent-access.gate.js';
 import { SpillStore } from '../spill-store.js';
 import { DocExtractService } from '../file-readers/doc-extract.service.js';
@@ -70,7 +70,7 @@ beforeAll(async () => {
     sessionId,
     abortSignal: signal,
     workspaceService: workspaceService as never,
-    workflowService: {} as never,
+    versionControlService: {} as never,
     events: {} as never,
     getFilesystem: async () => fs,
   });
@@ -90,7 +90,7 @@ beforeAll(async () => {
     new DocExtractService(docCache, new WorkerDocumentExtractor()),
     service,
     testKbContext({ kbDirName: KB }),
-    { recoveryBotEmail: 'recovery-bot@bevel.local', hooks: new WorkflowHooks(), notes: new ToolDescriptionNotes() },
+    { recoveryBotEmail: 'recovery-bot@bevel.local', hooks: new VersionControlHooks(), notes: new ToolDescriptionNotes() },
     new RoutineWritePolicyService(),
     {} as never,
   );

package/src/modules/workspace/__tests__/git-internals.security.test.ts

@@ -7,7 +7,7 @@ import AdmZip from 'adm-zip';
 import express from 'express';
 import { afterEach, beforeEach, describe, expect, it, vi, afterAll } from 'vitest';
 import { testKbContext } from '../../../__tests__/kb-context.js';
-import type { IWorkflowService } from '@bevel-software/platform-shared';
+import type { IVersionControlService } from '@bevel-software/platform-shared';
 import { GIT_INTERNALS_MESSAGE, GitInternalsError } from '../../../shared/domain-errors.js';
 import { workspaceIdForBranch } from '../../../shared/workspace-id.js';
 import { NodeFs } from '../../kb-fs/node-fs.js';
@@ -20,8 +20,8 @@ import type { ToolAuth } from '../../tool-auth/tool-auth.middleware.js';
 import type { IAccessControl } from '../../access/access-control.interface.js';
 import type { ICreatorAccess } from '../../access-model/creator.js';
 import type { IAdminAccessService } from '../../admin/admin.interface.js';
-import type { WorkflowEventBus } from '../../workflow/event-bus.js';
-import { WorkflowHooks } from '../../workflow/workflow-hooks.js';
+import type { VersionControlEventBus } from '../../version-control/event-bus.js';
+import { VersionControlHooks } from '../../version-control/version-control-hooks.js';
 import { ToolDescriptionNotes } from '../../workspace/agent-access.gate.js';
 import type { AuthService } from '../../auth/auth.service.js';
 import { registerWorkspaceTools } from '../workspace.tools.js';
@@ -178,7 +178,7 @@ afterEach(async () => {
   await rm(root, { recursive: true, force: true });
 });
 
-function makeWorkflow() {
+function makeVersionControl() {
   return {
     getLock: vi.fn(async () => null),
     acquireLock: vi.fn(async () => ({ acquired: true, lock: { holderUserId: USER.id, holderName: USER.name } })),
@@ -244,19 +244,19 @@ async function expectRefused(res: Response, form?: string): Promise<unknown> {
 describe('workspace tools refuse the git folder', () => {
   let server: Server | undefined;
   let baseUrl = '';
-  let workflow: ReturnType<typeof makeWorkflow>;
+  let versionControl: ReturnType<typeof makeVersionControl>;
   let unzipSpy: ReturnType<typeof vi.spyOn>;
   let bootstrappedSpy: ReturnType<typeof vi.spyOn>;
   let getFilesystem: ReturnType<typeof vi.fn>;
 
   beforeEach(async () => {
-    workflow = makeWorkflow();
+    versionControl = makeVersionControl();
     const service = newWorkspaceService(root, 'https://example.invalid/kb.git', testKbContext({ kbDirName: KB }), new NodeFs());
     unzipSpy = vi.spyOn(service, 'unzipFile');
     bootstrappedSpy = vi.spyOn(service, 'hasBootstrappedWorkspace');
     const lockingFs = new LockingFilesystem(
       { basePath: workspaceDir, contained: true },
-      { workflow: workflow as unknown as IWorkflowService, workspaceId: WS, branch: BRANCH, user: USER, kbDirName: KB },
+      { versionControl: versionControl as unknown as IVersionControlService, workspaceId: WS, branch: BRANCH, user: USER, kbDirName: KB },
     );
     getFilesystem = vi.fn(async () => lockingFs);
     const resolve = async (auth: ToolAuth, signal: AbortSignal, sessionId?: string): Promise<ToolContext> => ({
@@ -266,7 +266,7 @@ describe('workspace tools refuse the git folder', () => {
       sessionId,
       abortSignal: signal,
       workspaceService: service,
-      workflowService: workflow as never,
+      versionControlService: versionControl as never,
       events: {} as never,
       getFilesystem,
     });
@@ -286,7 +286,7 @@ describe('workspace tools refuse the git folder', () => {
       new DocExtractService(join(root, 'doc-cache'), new WorkerDocumentExtractor()),
       allowAll,
       testKbContext({ kbDirName: KB }),
-      { recoveryBotEmail: 'recovery-bot@bevel.local', hooks: new WorkflowHooks(), notes: new ToolDescriptionNotes() },
+      { recoveryBotEmail: 'recovery-bot@bevel.local', hooks: new VersionControlHooks(), notes: new ToolDescriptionNotes() },
       new RoutineWritePolicyService(),
       {} as never,
       // Skill check, change gate, uploads, guide, downloads, starter packs, disk: not this harness's business.
@@ -307,8 +307,8 @@ describe('workspace tools refuse the git folder', () => {
     if (server) await new Promise<void>((r) => server!.close(() => r()));
     server = undefined;
     // Nothing reached the lock service, and the git folder is untouched.
-    expect(workflow.acquireLock).not.toHaveBeenCalled();
-    expect(workflow.commitChanges).not.toHaveBeenCalled();
+    expect(versionControl.acquireLock).not.toHaveBeenCalled();
+    expect(versionControl.commitChanges).not.toHaveBeenCalled();
     expect(await snapshotGit()).toBe(gitSnapshot);
   });
 
@@ -421,7 +421,7 @@ describe('workspace tools refuse the git folder', () => {
   it('ordinary paths that merely look alike still work', async () => {
     const res = await call('write_file', { path: `${KB}/.github/workflows/ci.yml`, content: 'on: push\n' });
     expect(res.status).toBe(200);
-    workflow.acquireLock.mockClear();
+    versionControl.acquireLock.mockClear();
   });
 });
 
@@ -430,11 +430,11 @@ describe('workspace tools refuse the git folder', () => {
 describe('workspace routes refuse the git folder', () => {
   let server: Server | undefined;
   let baseUrl = '';
-  let workflow: ReturnType<typeof makeWorkflow>;
+  let versionControl: ReturnType<typeof makeVersionControl>;
   let service: WorkspaceService;
 
   beforeEach(async () => {
-    workflow = makeWorkflow();
+    versionControl = makeVersionControl();
     service = newWorkspaceService(root, 'https://example.invalid/kb.git', testKbContext({ kbDirName: KB }), new NodeFs());
     const app = express();
     app.use(express.json());
@@ -452,8 +452,8 @@ describe('workspace routes refuse the git folder', () => {
       createWorkspaceRoutes(
         service,
         { getUserById: vi.fn(async () => USER) } as unknown as AuthService,
-        workflow as unknown as IWorkflowService,
-        { emit: vi.fn() } as unknown as WorkflowEventBus,
+        versionControl as unknown as IVersionControlService,
+        { emit: vi.fn() } as unknown as VersionControlEventBus,
         allowAll,
         testKbContext({ kbDirName: KB }),
         stubCreatorAccess,
@@ -466,7 +466,7 @@ describe('workspace routes refuse the git folder', () => {
       createDiffRoutes(
         diffService,
         { getUserById: vi.fn(async () => USER) } as unknown as AuthService,
-        workflow as unknown as IWorkflowService,
+        versionControl as unknown as IVersionControlService,
         allowAll,
         KB,
       ),
@@ -477,7 +477,7 @@ describe('workspace routes refuse the git folder', () => {
   afterEach(async () => {
     if (server) await new Promise<void>((r) => server!.close(() => r()));
     server = undefined;
-    expect(workflow.acquireLock).not.toHaveBeenCalled();
+    expect(versionControl.acquireLock).not.toHaveBeenCalled();
     expect(await snapshotGit()).toBe(gitSnapshot);
   });
 
@@ -564,7 +564,7 @@ describe('workspace routes refuse the git folder', () => {
     expect(await res.json()).toEqual({ status: 'deleted', count: 1 });
     await expect(readFile(join(workspaceDir, KB, 'Notes', 'a.md'))).rejects.toMatchObject({ code: 'ENOENT' });
     expect(await readFile(join(upper, 'config'), 'utf8')).toBe('[credential]\n');
-    workflow.acquireLock.mockClear();
+    versionControl.acquireLock.mockClear();
   });
 
   it('an ordinary read and a .github path still work', async () => {
@@ -572,7 +572,7 @@ describe('workspace routes refuse the git folder', () => {
     expect(read.status).toBe(200);
     const write = await json('PUT', `${baseUrl}/api/workspace/${WS}/file?path=${q(`${KB}/.github/ci.yml`)}`, { content: 'on: push\n' });
     expect(write.status).toBe(200);
-    workflow.acquireLock.mockClear();
+    versionControl.acquireLock.mockClear();
   });
 });
 
@@ -742,7 +742,7 @@ describe('the route guard on its own', () => {
     await expectRefused(await fetch(`${baseUrl}/api/workspace/${WS}/access/prospective?from=${git}&toDir=${note}`));
     await expectRefused(await fetch(`${baseUrl}/api/workspace/${WS}/access/prospective?from=${note}&toDir=${git}`));
     // `toDir` is a path wherever it appears; `from` is a BRANCH on the
-    // workflow comparison and is left to the branch-name rule there.
+    // version-control comparison and is left to the branch-name rule there.
     await expectRefused(await fetch(`${baseUrl}/api/workspace/${WS}/anything?toDir=${git}`));
     expect(reached).toBe(0);
     const compare = await fetch(`${baseUrl}/api/workspace/${WS}/workflow/compare?from=${git}`);
@@ -847,10 +847,10 @@ describe('DiffService refuses the git folder on its own', () => {
 
 describe('agent filesystems refuse the git folder on their own', () => {
   it('LockingFilesystem refuses before taking a lock', async () => {
-    const workflow = makeWorkflow();
+    const versionControl = makeVersionControl();
     const lockingFs = new LockingFilesystem(
       { basePath: workspaceDir, contained: true },
-      { workflow: workflow as unknown as IWorkflowService, workspaceId: WS, branch: BRANCH, user: USER, kbDirName: KB },
+      { versionControl: versionControl as unknown as IVersionControlService, workspaceId: WS, branch: BRANCH, user: USER, kbDirName: KB },
     );
     for (const p of Object.values(FILE_FORMS).map(resolved)) {
       await expect(lockingFs.readFile(p)).rejects.toBeInstanceOf(GitInternalsError);
@@ -866,7 +866,7 @@ describe('agent filesystems refuse the git folder on their own', () => {
       await expect(lockingFs.readdir(p)).rejects.toBeInstanceOf(GitInternalsError);
       await expect(lockingFs.mkdir(`${p}/new`)).rejects.toBeInstanceOf(GitInternalsError);
     }
-    expect(workflow.acquireLock).not.toHaveBeenCalled();
+    expect(versionControl.acquireLock).not.toHaveBeenCalled();
     expect(await snapshotGit()).toBe(gitSnapshot);
   });
 
@@ -892,13 +892,13 @@ describe('agent filesystems refuse the git folder on their own', () => {
 
   it('a write through a dangling link into the git folder is refused and creates nothing', async () => {
     await symlink('.git/hooks/post-checkout', join(workspaceDir, KB, 'hook.md'));
-    const workflow = makeWorkflow();
+    const versionControl = makeVersionControl();
     const lockingFs = new LockingFilesystem(
       { basePath: workspaceDir, contained: true },
-      { workflow: workflow as unknown as IWorkflowService, workspaceId: WS, branch: BRANCH, user: USER, kbDirName: KB },
+      { versionControl: versionControl as unknown as IVersionControlService, workspaceId: WS, branch: BRANCH, user: USER, kbDirName: KB },
     );
     await expect(lockingFs.writeFile(`${KB}/hook.md`, '#!/bin/sh\n')).rejects.toBeInstanceOf(GitInternalsError);
-    expect(workflow.acquireLock).not.toHaveBeenCalled();
+    expect(versionControl.acquireLock).not.toHaveBeenCalled();
     expect(await snapshotGit()).toBe(gitSnapshot);
   });
 });

package/src/modules/workspace/__tests__/kb-repository.test.ts

@@ -6,7 +6,7 @@ import path from 'node:path';
 import os from 'node:os';
 import { KbRepository, repositoryDirFor } from '../kb-repository.js';
 import { fetchInstant } from '../fetch-instant.js';
-import { NodeGitRunner } from '../../workflow/git/node-git-runner.js';
+import { NodeGitRunner } from '../../version-control/git/node-git-runner.js';
 import type { IGitRunner } from '../../../shared/git.contract.js';
 
 /**

package/src/modules/workspace/__tests__/rest-tool-arguments.test.ts

@@ -13,7 +13,7 @@ import type { ToolContext } from '../../tool-helpers/tool.contract.js';
 import type { ToolAuth } from '../../tool-auth/tool-auth.middleware.js';
 import { registerWorkspaceTools } from '../workspace.tools.js';
 import { RoutineWritePolicyService } from '../routine-write-policy.js';
-import { WorkflowHooks } from '../../workflow/workflow-hooks.js';
+import { VersionControlHooks } from '../../version-control/version-control-hooks.js';
 import { ToolDescriptionNotes } from '../agent-access.gate.js';
 import { SpillStore } from '../spill-store.js';
 import { DocExtractService } from '../file-readers/doc-extract.service.js';
@@ -75,7 +75,7 @@ beforeAll(async () => {
       source: auth.source,
       abortSignal: signal,
       workspaceService: workspaceService as never,
-      workflowService: {} as never,
+      versionControlService: {} as never,
       events: {} as never,
       getFilesystem: async () => fs,
     }) as unknown as ToolContext;
@@ -95,7 +95,7 @@ beforeAll(async () => {
     new DocExtractService(docCache, new WorkerDocumentExtractor()),
     access,
     testKbContext({ kbDirName: KB }),
-    { recoveryBotEmail: 'recovery-bot@bevel.local', hooks: new WorkflowHooks(), notes: new ToolDescriptionNotes() },
+    { recoveryBotEmail: 'recovery-bot@bevel.local', hooks: new VersionControlHooks(), notes: new ToolDescriptionNotes() },
     new RoutineWritePolicyService(),
     {} as never,
     // Skill check, change gate, uploads, guide, downloads, starter packs, disk: not this harness's business.