@bevel-software/platform-core-backend 0.4.1 → 0.5.1

package/src/modules/workflow/git/__tests__/pull-request.service.viewer-can-cancel.test.ts

@@ -14,6 +14,7 @@ describe('computeViewerCanCancel', () => {
         authorId: AUTHOR_HASH,
         viewerEmail: undefined,
         viewerCanBypassMerge: false,
+        viewerWritesAllFiles: false,
       }),
     ).toBe(false);
   });
@@ -25,6 +26,7 @@ describe('computeViewerCanCancel', () => {
         authorId: AUTHOR_HASH,
         viewerEmail: EMAIL,
         viewerCanBypassMerge: false,
+        viewerWritesAllFiles: false,
       }),
     ).toBe(true);
   });
@@ -36,6 +38,7 @@ describe('computeViewerCanCancel', () => {
         authorId: OTHER_AUTHOR_HASH,
         viewerEmail: EMAIL,
         viewerCanBypassMerge: true,
+        viewerWritesAllFiles: false,
       }),
     ).toBe(true);
   });
@@ -47,6 +50,7 @@ describe('computeViewerCanCancel', () => {
         authorId: AUTHOR_HASH,
         viewerEmail: EMAIL,
         viewerCanBypassMerge: true,
+        viewerWritesAllFiles: false,
       }),
     ).toBe(true);
   });
@@ -58,6 +62,7 @@ describe('computeViewerCanCancel', () => {
         authorId: AUTHOR_HASH,
         viewerEmail: EMAIL,
         viewerCanBypassMerge: false,
+        viewerWritesAllFiles: false,
       }),
     ).toBe(false);
   });
@@ -69,6 +74,7 @@ describe('computeViewerCanCancel', () => {
         authorId: OTHER_AUTHOR_HASH,
         viewerEmail: EMAIL,
         viewerCanBypassMerge: true,
+        viewerWritesAllFiles: false,
       }),
     ).toBe(false);
   });
@@ -80,6 +86,7 @@ describe('computeViewerCanCancel', () => {
         authorId: undefined,
         viewerEmail: EMAIL,
         viewerCanBypassMerge: false,
+        viewerWritesAllFiles: false,
       }),
     ).toBe(false);
   });
@@ -95,7 +102,44 @@ describe('computeViewerCanCancel', () => {
         authorId: AUTHOR_HASH,
         viewerEmail: '  Juan@Bevel.Software  ',
         viewerCanBypassMerge: false,
+        viewerWritesAllFiles: false,
       }),
     ).toBe(true);
   });
+
+  it('returns true for a non-author, non-admin who writes EVERY changed file (the reject route’s third grant)', () => {
+    expect(
+      computeViewerCanCancel({
+        state: 'open',
+        authorId: OTHER_AUTHOR_HASH,
+        viewerEmail: EMAIL,
+        viewerCanBypassMerge: false,
+        viewerWritesAllFiles: true,
+      }),
+    ).toBe(true);
+  });
+
+  it('fails closed for an anonymous viewer even with the owner grant', () => {
+    expect(
+      computeViewerCanCancel({
+        state: 'open',
+        authorId: OTHER_AUTHOR_HASH,
+        viewerEmail: undefined,
+        viewerCanBypassMerge: false,
+        viewerWritesAllFiles: true,
+      }),
+    ).toBe(false);
+  });
+
+  it('terminal states refuse the owner grant too', () => {
+    expect(
+      computeViewerCanCancel({
+        state: 'merged',
+        authorId: OTHER_AUTHOR_HASH,
+        viewerEmail: EMAIL,
+        viewerCanBypassMerge: false,
+        viewerWritesAllFiles: true,
+      }),
+    ).toBe(false);
+  });
 });

package/src/modules/workflow/git/branch-name.ts

@@ -7,7 +7,11 @@ export { PROTECTED_BRANCHES, isProtectedBranch } from '@bevel-software/platform-
 // picker's `canDelete` rule and the backend authorisation check on
 // `deleteBranch` must agree on every edge case (uppercase email, dotted
 // localpart, etc.).
-export { branchAuthorLocalpart, isBranchAuthoredBy } from '@bevel-software/platform-shared';
+export {
+  branchAuthorLocalpart,
+  isBranchAuthoredBy,
+  isOwnSuggestionsBranch,
+} from '@bevel-software/platform-shared';
 
 const VALID_BRANCH_REGEX = /^[A-Za-z0-9][A-Za-z0-9/_\-.]*$/;
 

package/src/modules/workflow/git/git.service.ts

@@ -22,6 +22,7 @@ import {
   assertValidBranchName,
   assertValidRelativePath,
   isBranchAuthoredBy,
+  isOwnSuggestionsBranch,
   isProtectedBranch,
   PROTECTED_BRANCHES,
 } from './branch-name.js';
@@ -607,7 +608,7 @@ export class GitService implements IGitService {
     workspaceId: string,
     name: string,
     user: AuthUser,
-    opts: { onlyIfNoRemote?: boolean } = {},
+    opts: { onlyIfNoRemote?: boolean; systemCleanup?: boolean } = {},
   ): Promise<void> {
     assertValidBranchName(name);
     if (isProtectedBranch(name)) {
@@ -622,7 +623,12 @@ export class GitService implements IGitService {
         );
       }
 
-      if (opts.onlyIfNoRemote) {
+      if (opts.systemCleanup) {
+        // Internal post-merge retirement (never reachable from a route): the
+        // merge that emptied this branch was itself authorized, so no
+        // authorship check — the protected-branch and checked-out guards
+        // above still hold.
+      } else if (opts.onlyIfNoRemote) {
         // Legacy orphan-cleanup path (PR merged + remote head pruned). Skip
         // the authorship check — callers prune any orphan they encounter,
         // not just their own — but keep the "refuse if origin still has the
@@ -642,7 +648,13 @@ export class GitService implements IGitService {
         // that predicate is the existing source of truth for `Admin`-role
         // membership inside the access model — no separate `isAdmin()` plumbing
         // needed.
-        const isAuthor = isBranchAuthoredBy(name, user.email);
+        // Two authorship conventions: `<localpart>/…` UI drafts, and the
+        // `suggestions/<who>-<id8>/…` namespace the propose flow files its
+        // branches under — a user resetting THEIR OWN suggestion bundle is
+        // deleting their own branch.
+        const isAuthor =
+          isBranchAuthoredBy(name, user.email) ||
+          isOwnSuggestionsBranch(name, { email: user.email, id: user.id });
         const isAdmin = this.accessControl
           ? await this.accessControl.canWrite(workspaceId, user.email, 'roles.yaml')
           : false;
@@ -1017,7 +1029,11 @@ export class GitService implements IGitService {
     });
   }
 
-  async push(workspaceId: string, user: AuthUser): Promise<void> {
+  async push(
+    workspaceId: string,
+    user: AuthUser,
+    opts?: { systemAuthorized?: boolean },
+  ): Promise<void> {
     return this.mutex.run(workspaceId, async () => {
       const cwd = await this.repoDir(workspaceId);
       const branch = await this.currentBranch(cwd);
@@ -1030,7 +1046,14 @@ export class GitService implements IGitService {
       // PR. Gate against `origin/<branch>` — the published state — for
       // protected pushes; that's defence-in-depth against local rebases or
       // `commit-tree` shenanigans that might bypass the commit-time gate.
-      if (isProtectedBranch(branch)) {
+      // `systemAuthorized` skips the gate for flows whose ENDPOINT is the
+      // authorization — group provisioning commits an access.md into a
+      // folder that does not exist at origin yet, which this gate can only
+      // ever read as "write: Admin". The provisioning service has already
+      // decided the write is legitimate (unused name, exclusive create);
+      // gating it here again just refuses every non-admin the product
+      // promised a group to.
+      if (isProtectedBranch(branch) && !opts?.systemAuthorized) {
         const touched = await this.unpushedTouchedPaths(cwd);
         await this.assertCanWriteAtRef(
           workspaceId,
@@ -1608,60 +1631,6 @@ export class GitService implements IGitService {
     });
   }
 
-  async revertCommit(
-    workspaceId: string,
-    user: AuthUser,
-    sha: string,
-  ): Promise<CommitAttribution> {
-    if (!/^[a-f0-9]{7,40}$/i.test(sha)) {
-      throw new WorkflowValidationError('invalid commit sha');
-    }
-    assertValidAuthor(user);
-    return this.mutex.run(workspaceId, async () => {
-      const cwd = await this.repoDir(workspaceId);
-      const branch = await this.currentBranch(cwd);
-
-      // Revert creates a new commit reversing `sha`. Same model as commit:
-      // gate only on protected branches; reverts on feature/draft branches
-      // are free (they produce a commit that would still need to merge via
-      // PR to affect canonical state).
-      if (isProtectedBranch(branch)) {
-        const { stdout: diffOut } = await this.git(cwd, [
-          'diff-tree', '--no-commit-id', '--name-only', '-r', sha,
-        ]);
-        const touched = diffOut.split('\n').map((s) => s.trim()).filter(Boolean);
-        await this.assertCanWriteAtRef(workspaceId, 'HEAD', user.email, touched);
-      }
-
-      await this.git(cwd, [
-        'revert',
-        '--no-edit',
-        `--author=${user.name} <${user.email}>`,
-        sha,
-      ]);
-
-      const { stdout } = await this.git(cwd, [
-        'log',
-        '-1',
-        '--pretty=format:%H%x00%an%x00%ae%x00%s%x00%aI',
-      ]);
-      const [headSha, authorName, authorEmail, subj, committedAt] = stdout.split('\x00');
-
-      // A revert may have touched roles.yaml or access.md — drop cached
-      // access state so the next gate read reflects the rolled-back tree.
-      // Mirrors the commit / pull paths.
-      this.accessControl?.invalidate(workspaceId);
-
-      return {
-        sha: headSha?.trim() ?? '',
-        authorName: authorName ?? '',
-        authorEmail: authorEmail ?? '',
-        subject: subj ?? '',
-        committedAt: committedAt?.trim() ?? new Date().toISOString(),
-      };
-    });
-  }
-
   async logForFile(
     workspaceId: string,
     relativePath: string,
@@ -1726,6 +1695,44 @@ export class GitService implements IGitService {
     });
   }
 
+  /**
+   * Full file contents on both sides of one commit: `baseline` is the file at
+   * `<sha>^` (the parent), `current` at `<sha>`. Null means the file is absent
+   * at that ref — added files have `baseline: null`, deleted files
+   * `current: null`. A root commit (no parent) also yields `baseline: null`.
+   * Feeds the rendered-markdown history view, which needs before/after text
+   * rather than the patch `diffFileAtCommit` returns.
+   */
+  async fileContentsAtCommit(
+    workspaceId: string,
+    relativePath: string,
+    sha: string,
+  ): Promise<{ baseline: string | null; current: string | null }> {
+    assertValidRelativePath(relativePath);
+    if (!/^[a-f0-9]{7,40}$/i.test(sha)) {
+      throw new WorkflowValidationError('invalid commit sha');
+    }
+    const repoRelativePath = this.stripRepoPrefix(relativePath);
+    return this.mutex.run(workspaceId, async () => {
+      const current = await this.readFileAtRef(workspaceId, sha, repoRelativePath);
+      let baseline: string | null;
+      try {
+        baseline = await this.readFileAtRef(workspaceId, `${sha}^`, repoRelativePath);
+      } catch (err) {
+        // `readFileAtRef` maps "path absent at ref" to null but propagates an
+        // unresolvable ref. `<sha>^` on a root commit is exactly that (git
+        // reports it as "invalid object name '<sha>^'", or "unknown/bad
+        // revision" in other codepaths), and it legitimately means "no parent
+        // side" — fold it into null. Anything else stays fatal.
+        const stderr =
+          (err as { stderr?: string }).stderr ?? (err instanceof Error ? err.message : String(err));
+        if (/invalid object name|unknown revision|bad revision/i.test(stderr)) baseline = null;
+        else throw err;
+      }
+      return { baseline, current };
+    });
+  }
+
   async diffFileBetweenBranches(
     workspaceId: string,
     relativePath: string,
@@ -1859,8 +1866,20 @@ export class GitService implements IGitService {
         this.git(cwd, ['diff', '-M', '-z', '--name-status', range]),
         this.git(cwd, ['diff', '-M', '-z', '--numstat', range]),
       ]);
-      const statuses = parseNameStatusZ(nameStatusOut);
-      const counts = parseNumstatZ(numstatOut);
+      let statuses = parseNameStatusZ(nameStatusOut);
+      let counts = parseNumstatZ(numstatOut);
+      // roles.yaml can NEVER change through a merge — `preserveBaseRolesYaml`
+      // restores the base copy onto the source branch before every merge — so
+      // listing it as "changed" claims something the merge will not do, and
+      // (worse) makes its approval a requirement for a change that cannot
+      // land. Filter it from the review surface entirely; the neutralisation
+      // reads the raw refs itself and is unaffected. Both lists are filtered
+      // IN STEP so the index-zip below stays aligned.
+      if (statuses.some((s) => s.path === 'roles.yaml')) {
+        const keep = statuses.map((s) => s.path !== 'roles.yaml');
+        statuses = statuses.filter((_, i) => keep[i]);
+        if (counts.length === keep.length) counts = counts.filter((_, i) => keep[i]);
+      }
 
       // `--name-status` and `--numstat` enumerate the same files in the same
       // order (same `-M` over the same range), so we zip by index. If the two
@@ -1924,7 +1943,85 @@ export class GitService implements IGitService {
       const { stdout } = await this.git(cwd, [
         'diff', '-M', '--name-only', `${baseRef}...${headRef}`,
       ]);
-      return stdout.split('\n').map((s) => s.trim()).filter(Boolean);
+      return (
+        stdout
+          .split('\n')
+          .map((s) => s.trim())
+          .filter(Boolean)
+          // Same rule as `changedFilesForPr`: a roles.yaml change never
+          // survives a merge, so it is not a touched path for routing or
+          // summaries either.
+          .filter((p) => p !== 'roles.yaml')
+      );
+    });
+  }
+
+  /**
+   * The merge-base commit of a change request's two branches (their origin
+   * refs), or null when they share no history. This is the "before" the CR's
+   * three-dot diff is read against — the ref a per-file revert restores from,
+   * so the reverted file drops OUT of that same diff.
+   */
+  async mergeBaseForPr(
+    workspaceId: string,
+    baseBranch: string,
+    headBranch: string,
+  ): Promise<string | null> {
+    assertValidBranchName(baseBranch);
+    assertValidBranchName(headBranch);
+    const cwd = await this.repoDir(workspaceId);
+    await this.fetchPrRefs(cwd, baseBranch, headBranch);
+    return this.mutex.run(workspaceId, async () => {
+      const baseRef = await this.resolveBranchRef(cwd, baseBranch);
+      const headRef = await this.resolveBranchRef(cwd, headBranch);
+      try {
+        const { stdout } = await this.git(cwd, ['merge-base', baseRef, headRef]);
+        return stdout.trim() || null;
+      } catch (err) {
+        // Exit 1 is git's specific "no common ancestor" answer; anything else
+        // is an infra failure that must not masquerade as it.
+        if ((err as { exitCode?: number }).exitCode === 1) return null;
+        throw err;
+      }
+    });
+  }
+
+  /**
+   * Restore one path in the working tree (and index) to its content at `ref`;
+   * a path ABSENT at `ref` is deleted — the revert of an added file is its
+   * removal. Byte-exact via git itself (`checkout <ref> -- <path>`), never a
+   * read-as-string round-trip that would mangle binary files. The caller owns
+   * committing the result (see `commitFile`).
+   */
+  async restorePathFromRef(
+    workspaceId: string,
+    ref: string,
+    repoRelativePath: string,
+  ): Promise<void> {
+    assertValidRelativePath(repoRelativePath);
+    return this.mutex.run(workspaceId, async () => {
+      const cwd = await this.repoDir(workspaceId);
+      let existsAtRef = true;
+      try {
+        await this.git(cwd, ['cat-file', '-e', `${ref}:${repoRelativePath}`]);
+      } catch {
+        existsAtRef = false;
+      }
+      if (existsAtRef) {
+        await this.git(cwd, ['checkout', ref, '--', repoRelativePath]);
+      } else {
+        // First re-align the INDEX with HEAD for this path. A previous failed
+        // attempt (the git-rm era of this method) can have left a staged
+        // deletion — index entry gone — and `git add` can only stage a
+        // deletion for a path the index still tracks. No-op on a clean tree.
+        await this.git(cwd, ['reset', '-q', 'HEAD', '--', repoRelativePath]);
+        // Then delete from the WORKING TREE only, never `git rm`: the
+        // follow-up `commitFile` stages via `git add -- <path>`, and dropping
+        // the index entry too made that add match nothing — the whole revert
+        // failed with "pathspec did not match any files". A tracked file
+        // missing from disk is exactly what `git add` records as deleted.
+        await fs.rm(path.join(cwd, repoRelativePath), { force: true });
+      }
     });
   }
 

package/src/modules/workflow/git/pull-request.service.ts

@@ -183,10 +183,13 @@ export class PullRequestService implements IPullRequestService {
     return summaries;
   }
 
-  async listPrsAuthoredBy(loginOrEmail: string): Promise<PullRequestSummary[]> {
+  async listPrsAuthoredBy(
+    loginOrEmail: string,
+    opts: { fresh?: boolean } = {},
+  ): Promise<PullRequestSummary[]> {
     const needle = loginOrEmail.trim().toLowerCase();
     if (!needle) return [];
-    const prs = await this.listOpenPrs();
+    const prs = await this.listOpenPrs(opts);
     const needleIsEmail = needle.includes('@');
     const needleHash = needleIsEmail ? hashEmail(needle) : null;
     return prs.filter((p) => {
@@ -378,6 +381,11 @@ export class PullRequestService implements IPullRequestService {
       authorId: summary.authorId,
       viewerEmail: opts.viewerEmail,
       viewerCanBypassMerge,
+      // The reject route's third grant (see `rejectChangeRequest`): write on
+      // every changed file at origin/<base>. Derived from the per-file
+      // `viewerCanApprove` flags — the SAME `canWriteBatchAtRef` predicate the
+      // route enforces — so the hint cannot drift from the enforcement.
+      viewerWritesAllFiles: approvals.length > 0 && approvals.every((a) => a.viewerCanApprove),
     });
 
     const detail: PullRequestDetail = {
@@ -423,23 +431,26 @@ export class PullRequestService implements IPullRequestService {
 }
 
 /**
- * Pure predicate for the cancel-button's enabled state. The viewer can cancel
- * iff the PR is open AND they're either the author (hash-match against the
- * stored author) or an admin (`viewerCanBypassMerge` is the proxy — same
- * `canWriteAtRef('roles.yaml')` predicate). Fail-closed defaults: missing
- * email → false.
+ * Pure predicate for the `viewerCanCancel` hint. The viewer can cancel iff
+ * the PR is open AND they're the author (hash-match against the stored
+ * author), an admin (`viewerCanBypassMerge` is the proxy — same
+ * `canWriteAtRef('roles.yaml')` predicate), or they hold write on EVERY
+ * changed file (`viewerWritesAllFiles`) — the reject route's full
+ * authorization set, mirrored exactly so the hint never claims less (or
+ * more) than the server enforces. Fail-closed: no viewer email → false,
+ * whatever the grants say.
  */
 export function computeViewerCanCancel(input: {
   state: PullRequestState;
   authorId: string | undefined;
   viewerEmail: string | undefined;
   viewerCanBypassMerge: boolean;
+  viewerWritesAllFiles: boolean;
 }): boolean {
   if (input.state !== 'open') return false;
-  const viewerIsAuthor = !!(
-    input.authorId && input.viewerEmail && input.authorId === hashEmail(input.viewerEmail)
-  );
-  return viewerIsAuthor || input.viewerCanBypassMerge;
+  if (!input.viewerEmail) return false;
+  const viewerIsAuthor = !!(input.authorId && input.authorId === hashEmail(input.viewerEmail));
+  return viewerIsAuthor || input.viewerCanBypassMerge || input.viewerWritesAllFiles;
 }
 
 export const __testing = {

package/src/modules/workflow/review-workflow/__tests__/cancel-pr.test.ts

@@ -100,7 +100,10 @@ describe('ReviewWorkflowService.cancelPr', () => {
     ).rejects.toMatchObject({
       name: 'CancelAuthError',
       status: 403,
-      message: expect.stringMatching(/only the author or an admin/i),
+      // Names the FULL authorization set — the facade's owner grant
+      // (write on every changed file) included, so the refusal never
+      // undersells who could actually do this.
+      message: expect.stringMatching(/author, an admin, or having edit access to every file/i),
     });
     expect(updateReturning).not.toHaveBeenCalled();
   });

package/src/modules/workflow/review-workflow/review-workflow.service.ts

@@ -106,7 +106,8 @@ class CancelStateError extends WorkflowDomainError {
 class CancelAuthError extends WorkflowDomainError {
   constructor() {
     super(
-      "You can't cancel this change request — only the author or an admin can.",
+      "You can't cancel this change request — that takes being its author, an admin, " +
+        'or having edit access to every file it changes.',
       403,
     );
     this.name = 'CancelAuthError';
@@ -500,7 +501,11 @@ export class ReviewWorkflowService implements IReviewWorkflowService {
       })
       .onConflictDoNothing();
 
-    return this.getApprovalStates(prNumber, files, headSha, baseBranch, prAuthorIdHash, workspaceId);
+    // WITH the caller as viewer: these approvals go straight back to the UI
+    // that just clicked, and omitting the viewer computed every
+    // `viewerCanApprove` as false — one approval made the apply button and
+    // every remaining approve control vanish until a fresh detail fetch.
+    return this.getApprovalStates(prNumber, files, headSha, baseBranch, prAuthorIdHash, workspaceId, user.email);
   }
 
   evaluateMergeGate(input: MergeGateInput): MergeGateResult {
@@ -801,6 +806,10 @@ export class ReviewWorkflowService implements IReviewWorkflowService {
         ),
       );
 
-    return this.getApprovalStates(prNumber, files, headSha, baseBranch, prAuthorIdHash, workspaceId);
+    // WITH the caller as viewer: these approvals go straight back to the UI
+    // that just clicked, and omitting the viewer computed every
+    // `viewerCanApprove` as false — one approval made the apply button and
+    // every remaining approve control vanish until a fresh detail fetch.
+    return this.getApprovalStates(prNumber, files, headSha, baseBranch, prAuthorIdHash, workspaceId, user.email);
   }
 }

package/src/modules/workflow/workflow.routes.ts

@@ -266,17 +266,6 @@ export function createWorkflowRoutes(
     }
   });
 
-  router.post('/workspace/:id/workflow/changes/:sha/revert', async (req, res) => {
-    const user = await requireUser(req, res);
-    if (!user) return;
-    try {
-      res.json(await workflow.revertChange(req.params.id, user, req.params.sha));
-    } catch (err) {
-      const { status, body } = toHttpError(err);
-      res.status(status).json(body);
-    }
-  });
-
   router.get('/workspace/:id/workflow/compare-file', async (req, res) => {
     if (!(await requireUser(req, res))) return;
     const pathParam = typeof req.query.path === 'string' ? req.query.path : '';
@@ -312,6 +301,23 @@ export function createWorkflowRoutes(
     }
   });
 
+  router.get('/workspace/:id/workflow/file-at-change', async (req, res) => {
+    if (!(await requireUser(req, res))) return;
+    const pathParam = typeof req.query.path === 'string' ? req.query.path : '';
+    const sha = typeof req.query.sha === 'string' ? req.query.sha : '';
+    if (!pathParam || !sha) {
+      res.status(400).json({ error: 'path and sha are required' });
+      return;
+    }
+    try {
+      const { baseline, current } = await workflow.fileAtChange(req.params.id, pathParam, sha);
+      res.json({ baseline, current });
+    } catch (err) {
+      const { status, body } = toHttpError(err);
+      res.status(status).json(body);
+    }
+  });
+
   // ── File locks ────────────────────────────────────────────────────────────
 
   router.post('/workspace/:id/workflow/locks', async (req, res) => {
@@ -431,8 +437,12 @@ export function createWorkflowRoutes(
   router.get('/workflow/change-requests/mine', async (req, res) => {
     const user = await requireUser(req, res);
     if (!user) return;
+    // `?fresh=1` bypasses the 30s list cache — event-driven refreshes (a
+    // proposal or suggestion-routed upload just landed) ask because they KNOW
+    // the list changed, and a cached answer would hide their own change.
+    const fresh = isTruthyQuery(req.query.fresh);
     try {
-      res.json(await workflow.listChangeRequestsAuthoredBy(user.email));
+      res.json(await workflow.listChangeRequestsAuthoredBy(user.email, { fresh }));
     } catch (err) {
       const { status, body } = toHttpError(err);
       res.status(status).json(body);
@@ -497,7 +507,7 @@ export function createWorkflowRoutes(
           // blip when the caller's workspace isn't yet provisioned.
         }
       }
-      const detail = await workflow.getChangeRequestDetail(num, {
+      let detail = await workflow.getChangeRequestDetail(num, {
         fresh,
         workspaceId,
         viewerEmail,
@@ -506,6 +516,26 @@ export function createWorkflowRoutes(
         res.status(404).json({ error: 'change request not found' });
         return;
       }
+      // Lazy reconcile (the join-requests pattern): an OPEN request whose
+      // diff has emptied — everything it proposed has since landed, been
+      // reverted, or been undone on its branch — closes itself on
+      // observation and its branch retires. The close re-verifies the
+      // emptiness authoritatively and never fires on a failed diff.
+      if (detail.state === 'open' && detail.files.length === 0 && req.userId) {
+        try {
+          const user = await authService.getUserById(req.userId);
+          if (user && (await workflow.closeEmptyChangeRequest(num, user))) {
+            detail =
+              (await workflow.getChangeRequestDetail(num, {
+                fresh: true,
+                workspaceId,
+                viewerEmail,
+              })) ?? detail;
+          }
+        } catch (err) {
+          console.warn(`[cr] lazy empty-close of #${num} failed (non-fatal):`, err);
+        }
+      }
       res.json(detail);
     } catch (err) {
       const { status, body } = toHttpError(err);
@@ -513,6 +543,54 @@ export function createWorkflowRoutes(
     }
   });
 
+  /**
+   * Delete a change request outright — close it and retire its source
+   * branch. Admin-only; the moderation verb for a shared deployment.
+   */
+  router.delete('/workflow/change-requests/:number', async (req, res) => {
+    const num = parsePrNumber(req.params.number);
+    if (num === null) {
+      res.status(400).json({ error: 'invalid change request number' });
+      return;
+    }
+    const user = await requireUser(req, res);
+    if (!user) return;
+    try {
+      await workflow.deleteChangeRequest(num, user);
+      res.json({ deleted: true });
+    } catch (err) {
+      const { status, body } = toHttpError(err);
+      res.status(status).json(body);
+    }
+  });
+
+  /**
+   * Decline ONE file of a change request: restore its merge-base version on
+   * the source branch, dropping it from the request's diff. Takes the same
+   * permission as approving the file. When the last file is declined the
+   * request closes itself and its branch retires (`closed: true`).
+   */
+  router.post('/workflow/change-requests/:number/files/revert', async (req, res) => {
+    const num = parsePrNumber(req.params.number);
+    if (num === null) {
+      res.status(400).json({ error: 'invalid change request number' });
+      return;
+    }
+    const user = await requireUser(req, res);
+    if (!user) return;
+    const body = (req.body ?? {}) as { path?: string };
+    if (typeof body.path !== 'string' || !body.path) {
+      res.status(400).json({ error: 'path is required' });
+      return;
+    }
+    try {
+      res.json(await workflow.revertChangeRequestFile(num, user, body.path));
+    } catch (err) {
+      const { status, body: errBody } = toHttpError(err);
+      res.status(status).json(errBody);
+    }
+  });
+
   router.post('/workflow/change-requests', async (req, res) => {
     const user = await requireUser(req, res);
     if (!user) return;