@intentius/behold 0.29.15 → 0.29.16

package/README.md

@@ -6,6 +6,27 @@ substrate in one graph, coloured by drift. Then act through delegated, gated Ops
 📖 **[Documentation](https://intentius.io/behold/)** starts with an agent prompt
 that gets you to a running graph without reading anything else first.
 
+Paste it into Claude Code, or any coding agent with a shell, from anywhere:
+
+```text
+Clone https://github.com/INTENTIUS/behold and get me looking at a live
+infrastructure graph in my browser.
+
+I want the bundled demo. It needs Docker and no cloud account. Install what
+it needs and start it, then tell me the URL.
+
+Walk me through what I am looking at: what the colours mean, and how I make a
+resource change colour while I watch.
+
+When Docker is not running, say so. Show me the source graph on its own
+instead.
+
+For anything past the demo, read https://intentius.io/behold/llms.txt and
+https://intentius.io/behold/using/agents/.
+
+Never deploy with the Deploy button, `POST /api/apply` or `POST /api/ci/dispatch`. Gate approvals stay mine as well (`/api/ops/:name/signal/:gate`, `/api/workspace/gates/approve`, `/api/operator/approve/:op/:gate`). Op runs (`/api/ops/:name/run`) and rollbacks (`/api/rollback`) are mine too. Leave `--auto-sync` off, and keep a `behold preview` or `--public` serve read-only.
+```
+
 Where Argo CD shows one cluster's tree, behold shows the mixed-substrate estate:
 cloud drift on AWS, supply-chain drift on GitHub Actions, artifact presence on
 Helm. Each substrate's own kind of truth, in one picture.

package/dist/cli.js

@@ -24594,7 +24594,7 @@ function kioskRoute(app, webRoot2, enabled) {
     return new Response(readFileSync29(join40(webRoot2, "kiosk.html"), "utf8"), { headers: { "content-type": "text/html; charset=utf-8", "cache-control": "no-cache" } });
   });
 }
-var VENDOR_TOOLS = ["terraform", "terragrunt", "cdk-terrain", "choudoufu"];
+var VENDOR_TOOLS = ["terraform", "terragrunt", "cdk-terrain", "choudoufu", "chant"];
 var isVendorTool = (v) => VENDOR_TOOLS.includes(v);
 var cycleKey = (tool) => `cycles/${tool}/latest.json`;
 var CYCLE_READ_TTL_MS = 1e4;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/behold",
-  "version": "0.29.15",
+  "version": "0.29.16",
   "license": "Apache-2.0",
   "type": "module",
   "description": "behold — a live control plane on chant. See your whole estate (every substrate in one graph), coloured by drift; act through delegated, gated Ops.",

package/web/kiosk-vendor.js

@@ -16,7 +16,11 @@
  * null, the name as text), and the footer's credit. `terms` are the words
  * that name the tool or its owner. `kind` is what it competes as (see
  * COMPETES): an `engine` plans and applies, an `orchestrator` drives an
- * engine. Keep the keys in step with VENDOR_TOOLS in src/terragucci-demo.ts.
+ * engine, and a `pipeline` plans and applies a pull request's change with an
+ * engine. `reports: false` marks a tool whose pipeline writes no terragucci
+ * reports or run view: its page draws the checkout behold serves for its repo
+ * (kiosk.js `frameOk`). Keep the keys in step with VENDOR_TOOLS in
+ * src/terragucci-demo.ts.
  *
  * - Terraform: HashiCorp's rules allow the name as text, with the mark noted.
  * - Terragrunt: Gruntwork publishes logo files, but a logo on a page like
@@ -24,6 +28,8 @@
  * - CDK Terrain: the Open Construct Foundation's continuation of CDKTF; its
  *   site, cdktn.io, publishes no rules for its logo, so the name is text.
  * - choudoufu: ours, logo and all.
+ * - chant: ours too. Its docs ship no logo, so the name is text. Its scenario
+ *   runs chant's own pull-request pipeline, which installs OpenTofu.
  */
 export const VENDORS = {
   terraform: {
@@ -67,6 +73,17 @@ export const VENDORS = {
     terms: ["choudoufu"],
     runsWith: [],
   },
+  chant: {
+    name: "chant",
+    owner: "Intentius",
+    url: "https://intentius.io/chant/",
+    logo: null,
+    credit: "chant is made by Intentius, who also make this demo.",
+    kind: "pipeline",
+    terms: ["chant"],
+    runsWith: ["opentofu"],
+    reports: false,
+  },
 };
 
 /** What a tool's scenarios run on, said on its page as the owner's rules allow ("works with OpenTofu"). */
@@ -92,11 +109,13 @@ export const COMPETITORS = {
 /**
  * What competes with what. Engines compete with engines (Terraform, OpenTofu,
  * choudoufu); orchestrators with orchestrators (Terragrunt, CDK Terrain,
- * Atmos, Terramate). An orchestrator runs on an engine, so its page names the
- * engine freely; an engine's page names no other engine, but for the one its
- * scenarios really run with (`runsWith`).
+ * Atmos, Terramate); pipelines with pipelines (chant, and none other has a
+ * page). An orchestrator runs on an engine, so its page names the engine
+ * freely; an engine's page names no other engine, but for the one its
+ * scenarios really run with (`runsWith`). chant is a pipeline, so the engine
+ * and orchestrator pages keep the `chant approve` lines their runs print.
  */
-export const COMPETES = { engine: "engine", orchestrator: "orchestrator" };
+export const COMPETES = { engine: "engine", orchestrator: "orchestrator", pipeline: "pipeline" };
 
 const own = (o, k) => Object.prototype.hasOwnProperty.call(o, k);
 

package/web/kiosk-vendor.test.js

@@ -147,8 +147,8 @@ describe("the branding table (behold#571)", () => {
       const v = VENDORS[tool];
       const words = [v.name, ...creditLines(tool).map((l) => l.map((s) => s.text).join("")), ...Object.values(notRunWords(v)), legendWords("components", tool), legendWords("resources", tool)];
       for (const w of words) expect(namesOther(w, tool), `${tool}: ${w}`).toBe(false);
-      // choudoufu is ours: its credit says so instead.
-      if (tool !== "choudoufu") expect(v.credit).toMatch(/(does not|don't) endorse this demo\./);
+      // choudoufu and chant are ours: their credits say so instead.
+      if (tool !== "choudoufu" && tool !== "chant") expect(v.credit).toMatch(/(does not|don't) endorse this demo\./);
     }
     expect(VENDORS.choudoufu.credit).toMatch(/AWS and Kubernetes/);
     expect(VENDORS.choudoufu.credit).not.toMatch(/experimental/i);
@@ -170,9 +170,18 @@ describe("the branding table (behold#571)", () => {
       terragrunt: ["CDK Terrain", "CDKTN", "Open Construct", "Atmos", "Cloud Posse", "Terramate"],
       "cdk-terrain": ["Terragrunt", "Gruntwork", "Atmos", "Cloud Posse", "Terramate"],
       choudoufu: ["Terraform", "HashiCorp", "OpenTofu"],
+      // A pipeline: no other tool with a page is one.
+      chant: [],
     });
     expect(otherTerms(null)).toEqual([]);
   });
+  it("keeps the chant approve lines on every page, since chant is a pipeline and competes with no engine or orchestrator", () => {
+    for (const tool of VENDOR_TOOLS) expect(namesOther("chant approve tf-apply wave-2 --actor demo-reviewer --sign", tool), tool).toBe(false);
+    expect(VENDORS.chant.url).toBe("https://intentius.io/chant/");
+    expect(VENDORS.chant.owner).toBe("Intentius");
+    expect(creditLines("chant").flat().filter((s) => s.url).map((s) => s.text)).toEqual(["chant", "OpenTofu"]);
+    expect(toolCheckout("chant")).toBe("demo-chant");
+  });
   it("lets an orchestrator's page name the engines it runs on, and keeps an engine's page from naming another engine", () => {
     expect(namesOther("Big Terraform setups run on OpenTofu", "terragrunt")).toBe(false);
     expect(namesOther("Big Terraform setups", "cdk-terrain")).toBe(false);

package/web/kiosk.js

@@ -412,6 +412,12 @@ export function kioskView(demo, { components = false, pick = null, now = Date.no
 export function legendWords(view, tool = null) {
   const root = rootWord(tool);
   const n = rootNoun(tool);
+  // A tool whose pipeline writes no reports: behold's own graph of its components, boxed by the wave each applies in.
+  if (reportless(vendorOf(tool))) {
+    return view === "components"
+      ? `Components shows the project's components, in a box per wave. Each card is ${root} with its own state, and an arrow is one component reading another's outputs.`
+      : `Each box is ${root} with its own state.`;
+  }
   const rest = `an arrow is one ${n.one} reading another's outputs, dashed while it reads planned values. A wave applies its ${n.many} together, after the waves it reads.`;
   if (view === "components") {
     return `Components shows the pipeline's jobs and waves. Each card is ${root} with its own state, in a box per wave titled with the job that applies it; ${rest}`;
@@ -420,6 +426,16 @@ export function legendWords(view, tool = null) {
 }
 
 
+/** Whether a tool's pipeline writes no terragucci reports or run view (VENDORS' `reports: false`). */
+export function reportless(vendor) {
+  return !!vendor && vendor.reports === false;
+}
+
+/** Whether /api/project's answer is a chant project: behold draws its components itself. */
+export function chantProject(p) {
+  return !!p && Array.isArray(p.memberKinds) && p.memberKinds.includes("chant");
+}
+
 /** The tool the page shows: its own on a tool's page, else the running scenario's (demo.json `tool`). */
 export function nounTool(s) {
   if (s.vendor) return s.vendor;
@@ -593,7 +609,7 @@ function drawBar(bar, s, now, foot) {
     then.append(`then comments `, el("code", "k-inline", appr.comment), ` on ${appr.on}, and the waves run again.`);
     a.appendChild(then);
     holdBox.appendChild(a);
-  } else if (!s.noReports) {
+  } else if (!s.noReports && !reportless(vendor || vendorOf(demo.tool))) {
     const panel = runPanel(demo, s.answer, s.progress);
     if (panel.note) holdBox.appendChild(elRoots("p", "k-note", panel.note, s));
     else if (panel.stage === "pull-request") for (const u of unreviewedLines(s.answer)) holdBox.appendChild(elRoots("p", "k-note k-unknown", u, s));
@@ -744,7 +760,10 @@ export function startKiosk({ bar, frame, foot, side, main, views, tools = null }
     if (!vendor) return true;
     // Before the tool's first cycle: its repo's checkout, when this behold serves it.
     if (s.mode === "none") return !!notRunRepo(tool, s.viewRepos) && s.aimed === notRunRepo(tool, s.viewRepos);
-    return servesRepo(s.answer && !s.answer.error ? s.answer.project : null, s.repo);
+    if (servesRepo(s.answer && !s.answer.error ? s.answer.project : null, s.repo)) return true;
+    // A tool whose pipeline writes no terragucci reports (chant's own loop) has no
+    // reports to name its repo: the frame is its repo's when behold serves that checkout.
+    return reportless(vendor) && !!repoParam(s.repo, s.viewRepos);
   };
   // behold#571: a behold serving several repos (`serve --repos`) answers the
   // graph's reads from the checkout of the repo the page is about, asked by
@@ -1066,7 +1085,8 @@ export function startKiosk({ bar, frame, foot, side, main, views, tools = null }
       s.viewCommits = p.viewCommits || null;
       if (s.aimed === null && p.viewRepo) s.aimed = p.viewRepo;
     }
-    s.components = !!(p && !p.error && p.terragucciComponents);
+    // A chant project's graph is its components (web/app.js bootZoom), so it has that view too.
+    s.components = !!(p && !p.error && (p.terragucciComponents || chantProject(p)));
     // behold#571: the declared roots (their colours' order) and the wave jobs that apply them.
     if (p && p.terragucciRoots) {
       s.roots = Array.isArray(p.terragucciRoots.roots) ? p.terragucciRoots.roots : [];

package/web/kiosk.test.js

@@ -1,5 +1,6 @@
 import { describe, expect, it } from "vitest";
-import { INTRO_HEAD, STEP_VIEW, STEP_WORDS, aboutRows, approvalPanel, approveGloss, focusRoots, introText, scenarioHead, frameSrc, factLines, kioskView, legendWords, matchingPull, pendingApproval, renderKiosk, renderViewToggle, runPanel, runPin, stepView, viewZoom } from "./kiosk.js";
+import { INTRO_HEAD, STEP_VIEW, STEP_WORDS, aboutRows, approvalPanel, approveGloss, chantProject, focusRoots, introText, scenarioHead, frameSrc, factLines, kioskView, legendWords, matchingPull, pendingApproval, renderKiosk, renderViewToggle, reportless, runPanel, runPin, stepView, viewZoom } from "./kiosk.js";
+import { VENDORS } from "./kiosk-vendor.js";
 import { PICK_HOLD_MS } from "./kiosk-runs.js";
 
 const demo = (step, extra = {}) => ({ cycle: 1, scenario: "a-output", title: "t", step, label: "", started_at: "2026-10-15T03:00:00Z", next: null, pull: 7, commit: "abc12345", ...extra });
@@ -253,6 +254,19 @@ describe("which view the frame shows (#571)", () => {
       expect(words).toMatch(/one unit reading another's outputs.*applies its units together/);
       expect(words).not.toMatch(/\broots?\b/);
     }
+    // A tool whose pipeline writes no reports: behold's own components graph, with no jobs or planned values in it.
+    expect(legendWords("components", "chant")).toBe(
+      "Components shows the project's components, in a box per wave. Each card is a Terraform root with its own state, and an arrow is one component reading another's outputs.",
+    );
+    expect(legendWords("resources", "chant")).toBe("Each box is a Terraform root with its own state.");
+  });
+
+  it("knows a tool whose pipeline writes no terragucci reports, and a chant project behold draws itself", () => {
+    expect(Object.entries(VENDORS).filter(([, v]) => reportless(v)).map(([id]) => id)).toEqual(["chant"]);
+    expect(reportless(null)).toBe(false);
+    expect(chantProject({ memberKinds: ["chant"] })).toBe(true);
+    expect(chantProject({ memberKinds: ["terraform"] })).toBe(false);
+    expect(chantProject({ error: "nope" })).toBe(false);
   });
 
   // A DOM for the toggle: elements with attributes and click listeners.