@intentius/chant 0.101.0 → 0.104.0

package/src/workspace/session-kinds.ts

@@ -11,7 +11,7 @@ import { execFileSync } from "node:child_process";
 import { dirname, resolve } from "node:path";
 import { WorkspaceReadError } from "./declaration";
 import { gitRoot, resolveRevision } from "./record-source";
-import { loadRecordKind, RecordReadError, type LoadedRecordKind } from "./records";
+import { loadRecordKind, RecordReadError, sessionSubjectKinds, type LoadedRecordKind } from "./records";
 import { declaredKindFiles, realpathOr } from "./records-cli";
 
 /** The shape of an id `records --since` looks up as a session before reading it as a revision: `S-0002`, `ws-052`. */
@@ -46,10 +46,10 @@ export async function findSessionKinds(cwd: string, extra: string[] = []): Promi
   return out;
 }
 
-/** The session kinds whose `session.subjects.kind` is the kind file `subjectFile`. */
+/** The session kinds one of whose subject kinds (`session.subjects.kind` or `.kinds`) is the kind file `subjectFile`. */
 export async function sessionKindsFor(subjectFile: string, cwd: string): Promise<LoadedRecordKind[]> {
   const target = realpathOr(resolve(cwd, subjectFile));
-  return (await findSessionKinds(cwd)).filter((k) => realpathOr(resolve(dirname(k.file), k.kind.session!.subjects.kind)) === target);
+  return (await findSessionKinds(cwd)).filter((k) => sessionSubjectKinds(k.kind.session!).some((f) => realpathOr(resolve(dirname(k.file), f)) === target));
 }
 
 /** The full commit id HEAD names in the repository holding `dir`, or null outside git or before the first commit. */

package/src/workspace/squash.ts

@@ -0,0 +1,198 @@
+/**
+ * Following a squash merge to the pull request's original commits (#3035,
+ * ws-092).
+ *
+ * A squash merge folds a pull request's commits into one new commit, and with
+ * them the trailers and signatures that joined each to its run and its work.
+ * The forge keeps the originals: GitHub and Forgejo both keep a pull
+ * request's head at `refs/pull/<n>/head` on the remote. A read that is asked
+ * to follow squashes (`--follow-squash`) looks for that ref locally, fetches
+ * the missing ones from `origin` in one `git fetch`, and keeps what it
+ * fetched under `refs/chant/pull/<n>/head`, so the next read needs no network.
+ * Without the flag nothing here runs, and a read never touches the network
+ * (studio-032 b: follow only when asked).
+ *
+ * A commit is followed as a squash when its subject ends with `(#<n>)`, as
+ * GitHub and Forgejo write a squash's subject, it has one parent, and the
+ * pull request's head is not already in its history (a merge commit or a
+ * rebase keeps the originals, so there is nothing to follow). Its original
+ * commits are the head's commits that the squash's parent does not have,
+ * oldest first. When the ref can't be read or fetched, the read says so and
+ * keeps its answer without them.
+ */
+
+import { execFileSync } from "node:child_process";
+
+/** A forge chant knows the pull request refs of. */
+export type Forge = "github" | "forgejo";
+
+/** Where a read keeps the pull request heads it fetched. */
+export const PULL_CACHE_PREFIX = "refs/chant/pull/";
+
+/** The remote a squash's pull request ref is fetched from. */
+export const SQUASH_REMOTE = "origin";
+
+/** How long one fetch of pull request refs may take. */
+const FETCH_TIMEOUT_MS = 60_000;
+
+function git(top: string, args: string[], opts: { input?: string; timeout?: number } = {}): string | undefined {
+  try {
+    return execFileSync("git", args, {
+      cwd: top,
+      encoding: "utf-8",
+      input: opts.input,
+      timeout: opts.timeout,
+      stdio: [opts.input === undefined ? "ignore" : "pipe", "pipe", "pipe"],
+      maxBuffer: 256 * 1024 * 1024,
+      // A fetch must never wait on a credential prompt.
+      env: { ...process.env, GIT_TERMINAL_PROMPT: "0" },
+    });
+  } catch {
+    return undefined;
+  }
+}
+
+/** The pull request number a squash's subject ends with, `(#<n>)`, or null. */
+export function pullRequestOf(subject: string): number | null {
+  const m = subject.match(/\(#([0-9]+)\)\s*$/);
+  return m ? Number(m[1]) : null;
+}
+
+/**
+ * The forge a remote URL points at: `github` for github.com and GitHub
+ * Enterprise hosts named for it, `forgejo` for codeberg.org and hosts named
+ * forgejo or gitea. Null for any other, which is still read at
+ * `refs/pull/<n>/head`, the ref both keep.
+ */
+export function forgeOf(url: string | null | undefined): Forge | null {
+  if (!url) return null;
+  const host = (url.match(/^[a-z][a-z0-9+.-]*:\/\/(?:[^@/]*@)?([^/:]+)/i)?.[1] ?? url.match(/^(?:[^@/]*@)?([^/:]+):/)?.[1] ?? "").toLowerCase();
+  if (host === "github.com" || host.endsWith(".github.com") || /(^|[.-])github([.-]|$)/.test(host)) return "github";
+  if (host === "codeberg.org" || /(^|[.-])(forgejo|gitea)([.-]|$)/.test(host)) return "forgejo";
+  return null;
+}
+
+/** The pull request ref a forge keeps for `n`. GitHub and Forgejo keep the same one. */
+export function pullRef(_forge: Forge | null, n: number): string {
+  return `refs/pull/${n}/head`;
+}
+
+/** What following one squash commit found. */
+export interface SquashFollow {
+  /** The squash commit. */
+  sha: string;
+  pullRequest: number;
+  /** The forge `origin` points at, or null when it is none chant knows, or there is no `origin`. */
+  forge: Forge | null;
+  /** The local ref the pull request's head was read from, or null when none could be read. */
+  ref: string | null;
+  /** The pull request's head commit, or null. */
+  head: string | null;
+  /** Whether this read fetched the ref from the remote. */
+  fetched: boolean;
+  /** Whether the original commits were read. */
+  followed: boolean;
+  /** The original commits, oldest first. Empty when not followed. */
+  commits: string[];
+  /** Why it was not followed, when it wasn't. */
+  problem: string | null;
+}
+
+const commitOf = (top: string, rev: string): string | undefined => git(top, ["rev-parse", "--verify", "--quiet", `${rev}^{commit}`])?.trim() || undefined;
+
+/** The local ref holding pull request `n`'s head: chant's cache, the forge's own ref, or a `refs/remotes/<remote>/pr/<n>` mirror. */
+function localPullRef(top: string, forge: Forge | null, n: number): { ref: string; head: string } | undefined {
+  for (const ref of [`${PULL_CACHE_PREFIX}${n}/head`, pullRef(forge, n), `refs/remotes/${SQUASH_REMOTE}/pr/${n}`]) {
+    const head = commitOf(top, ref);
+    if (head) return { ref, head };
+  }
+  return undefined;
+}
+
+/** Fetch each pull request's head into chant's cache, all in one fetch and then one by one if that fails. The numbers fetched. */
+function fetchPullRefs(top: string, forge: Forge | null, numbers: number[]): Set<number> {
+  const spec = (n: number) => `+${pullRef(forge, n)}:${PULL_CACHE_PREFIX}${n}/head`;
+  const fetchRefs = (ns: number[]) => git(top, ["fetch", "--no-tags", "--quiet", "--no-write-fetch-head", SQUASH_REMOTE, ...ns.map(spec)], { timeout: FETCH_TIMEOUT_MS }) !== undefined;
+  if (numbers.length === 0) return new Set();
+  if (fetchRefs(numbers)) return new Set(numbers);
+  // One missing ref fails the whole fetch; the others may still be there.
+  return new Set(numbers.length === 1 ? [] : numbers.filter((n) => fetchRefs([n])));
+}
+
+/**
+ * Follow each squash commit among `commits` to its pull request's original
+ * commits (#3035). A commit that is not a squash (no `(#<n>)` subject, a
+ * merge, or a head already in its history) is left out of the result. With
+ * `fetchMissing`, a pull request ref missing locally is fetched from `origin`;
+ * without it, only refs already present are read.
+ */
+export function followSquashes(top: string, commits: { sha: string; subject: string }[], opts: { fetchMissing: boolean }): Map<string, SquashFollow> {
+  const out = new Map<string, SquashFollow>();
+  const candidates = commits.map((c) => ({ sha: c.sha, n: pullRequestOf(c.subject) })).filter((c): c is { sha: string; n: number } => c.n !== null);
+  if (candidates.length === 0) return out;
+  const parents = new Map<string, string[]>();
+  for (const line of (git(top, ["log", "--no-walk=unsorted", "--stdin", "--format=%H %P"], { input: `${candidates.map((c) => c.sha).join("\n")}\n` }) ?? "").split("\n")) {
+    const [sha, ...ps] = line.trim().split(/\s+/);
+    if (sha) parents.set(sha, ps);
+  }
+  const squashes = candidates.filter((c) => parents.get(c.sha)?.length === 1);
+  if (squashes.length === 0) return out;
+  const url = git(top, ["config", "--get", `remote.${SQUASH_REMOTE}.url`])?.trim() || null;
+  const forge = forgeOf(url);
+  const local = new Map<number, { ref: string; head: string }>();
+  for (const n of new Set(squashes.map((c) => c.n))) {
+    const hit = localPullRef(top, forge, n);
+    if (hit) local.set(n, hit);
+  }
+  const missing = [...new Set(squashes.map((c) => c.n))].filter((n) => !local.has(n));
+  const fetched = opts.fetchMissing && url ? fetchPullRefs(top, forge, missing) : new Set<number>();
+  for (const n of fetched) {
+    const head = commitOf(top, `${PULL_CACHE_PREFIX}${n}/head`);
+    if (head) local.set(n, { ref: `${PULL_CACHE_PREFIX}${n}/head`, head });
+  }
+  for (const c of squashes) {
+    const hit = local.get(c.n);
+    const base: SquashFollow = { sha: c.sha, pullRequest: c.n, forge, ref: null, head: null, fetched: false, followed: false, commits: [], problem: null };
+    if (!hit) {
+      const problem = !opts.fetchMissing
+        ? `${pullRef(forge, c.n)} is not in this clone`
+        : !url
+          ? `there is no ${SQUASH_REMOTE} remote to fetch ${pullRef(forge, c.n)} from`
+          : `${pullRef(forge, c.n)} could not be fetched from ${SQUASH_REMOTE}: the forge has no such ref, or it can't be reached`;
+      out.set(c.sha, { ...base, problem });
+      continue;
+    }
+    // A head already in the commit's history was merged or rebased, not squashed: nothing to follow.
+    if (git(top, ["merge-base", "--is-ancestor", hit.head, c.sha]) !== undefined) continue;
+    const parent = parents.get(c.sha)![0];
+    const list = git(top, ["rev-list", "--reverse", "--no-merges", hit.head, `^${parent}`]);
+    if (list === undefined) {
+      out.set(c.sha, { ...base, ref: hit.ref, head: hit.head, fetched: fetched.has(c.n), problem: `the commits of ${hit.ref} could not be listed` });
+      continue;
+    }
+    const originals = list.split("\n").map((s) => s.trim()).filter(Boolean);
+    out.set(c.sha, { ...base, ref: hit.ref, head: hit.head, fetched: fetched.has(c.n), followed: true, commits: originals });
+  }
+  return out;
+}
+
+/**
+ * For the lines of `path` in a squash commit: which original commit last wrote
+ * each, by `git blame` at the pull request's head, when the file there is the
+ * same as in the squash (#3035). Undefined when it is not, since the lines
+ * then don't correspond one to one.
+ */
+export function squashLineOrigins(top: string, squash: string, head: string, path: string, originals: Set<string>): Map<number, string> | undefined {
+  const a = git(top, ["rev-parse", "--verify", "--quiet", `${squash}:${path}`])?.trim();
+  const b = git(top, ["rev-parse", "--verify", "--quiet", `${head}:${path}`])?.trim();
+  if (!a || a !== b) return undefined;
+  const out = git(top, ["blame", "--porcelain", head, "--", path]);
+  if (out === undefined) return undefined;
+  const lines = new Map<number, string>();
+  // Every line has a header, `<sha> <line in that commit> <line now>`, with a count after it on a group's first.
+  for (const l of out.split("\n")) {
+    const m = l.match(/^([0-9a-f]{40,64}) \d+ (\d+)(?: \d+)?$/);
+    if (m && originals.has(m[1])) lines.set(Number(m[2]), m[1]);
+  }
+  return lines;
+}

package/src/workspace/status-contract.test.ts

@@ -316,6 +316,11 @@ describe("chant workspace status on built workspaces", () => {
         isolation: null,
         intent: null,
         services: [],
+        factory: null,
+        listing: null,
+        publisher: null,
+        ship: null,
+        replicate: null,
       },
     ]);
   });
@@ -449,8 +454,9 @@ describe("gate state in chant workspace status --json (#2674)", () => {
         state: "approved",
         recordedAt: "2026-09-20T00:00:00.000Z",
         expiresAt: "2026-12-31T00:00:00.000Z",
-        approvals: [{ principal: "alice", channel: "cli", at: "2026-09-20T01:00:00.000Z" }],
+        approvals: [{ principal: "alice", channel: "cli", relayedBy: null, at: "2026-09-20T01:00:00.000Z" }],
         needed: 1,
+        signed: null,
         approve: `chant approve web deploy --env staging --plan ${D("1")}`,
       },
       {
@@ -463,6 +469,7 @@ describe("gate state in chant workspace status --json (#2674)", () => {
         expiresAt: "2026-12-31T00:00:00.000Z",
         approvals: [],
         needed: 1,
+        signed: null,
         approve: `chant approve web deploy --env prod --plan ${D("2")}`,
       },
       {
@@ -474,8 +481,9 @@ describe("gate state in chant workspace status --json (#2674)", () => {
         recordedAt: "2026-09-20T00:00:00.000Z",
         expiresAt: "2026-12-31T00:00:00.000Z",
         // The agent's approval doesn't count toward the quorum.
-        approvals: [{ principal: "bob", channel: "cli", at: "2026-09-20T02:00:00.000Z" }],
+        approvals: [{ principal: "bob", channel: "cli", relayedBy: null, at: "2026-09-20T02:00:00.000Z" }],
         needed: 2,
+        signed: null,
         approve: `chant approve web review --env staging --plan ${D("4")}`,
       },
     ]);

package/src/workspace/status-gates.ts

@@ -22,7 +22,7 @@ import { execFileSync } from "node:child_process";
 import { samePlanDigest } from "../lifecycle/plan-digest";
 import type { GateResolutionRecord, PendingGateRecord } from "../lifecycle/gate-ledger";
 import { isPendingGateExpired, latestPendingGate, latestResolutionForPlan, parseGateLedger } from "../lifecycle/gate-ledger";
-import { tallyGateApprovals } from "../op/gate";
+import { tallyGateApprovals, type GateApprovalRule } from "../op/gate";
 import type { ReasonCode } from "./reason-codes";
 
 /** Why a member's gates can't be listed. Closed: a new code is a contract change. */
@@ -43,6 +43,8 @@ export interface StatusGateApproval {
   principal: string;
   /** The channel it was recorded on (`cli`, `mcp`, `acp`), or null for a record older than chant#2384. */
   channel: string | null;
+  /** Who relayed it for `principal` (`chant approve --relayed-by`, #3402), or null when nobody did. */
+  relayedBy: string | null;
   at: string;
 }
 
@@ -63,10 +65,20 @@ export interface StatusGate {
   approvals: StatusGateApproval[];
   /** How many human approvals the gate needs: its quorum's count, 1 without one. */
   needed: number;
+  /**
+   * The declaration's rule for the gate (#3163, ws-080): set when
+   * `identity.gates` names it, so only an approval sealed by a signer at
+   * base (from `class`, when it names one) counts, and `approve` carries
+   * `--sign`. Null when any approval counts.
+   */
+  signed: { class: string | null } | null;
   /** The command that approves it, run in the member's directory. */
   approve: string;
 }
 
+/** The rule for a gate, by name, as `identity.gates` at base sets it (#3163). Null when it sets none. */
+export type GateRuleLookup = (gate: string) => GateApprovalRule | null;
+
 export interface StatusGateLedger {
   /** `members` for `_members/<member>/_gates`, `flat` for `_gates`. */
   layout: "members" | "flat";
@@ -110,15 +122,17 @@ export const defaultGateLedgerReader: GateLedgerReader = async (dir, commit, cwd
  * plan this read showed and not whatever happens to be pending by the time
  * someone runs it.
  */
-export function approveCommand(component: string, gate: string, env: string | null, planDigest?: string | null): string {
-  return `chant approve ${component} ${gate}${env !== null ? ` --env ${env}` : ""}${planDigest ? ` --plan ${planDigest}` : ""}`;
+export function approveCommand(component: string, gate: string, env: string | null, planDigest?: string | null, signed = false): string {
+  return `chant approve ${component} ${gate}${env !== null ? ` --env ${env}` : ""}${planDigest ? ` --plan ${planDigest}` : ""}${signed ? " --sign" : ""}`;
 }
 
-const approvalOf = (r: GateResolutionRecord): StatusGateApproval => ({ principal: r.resolvedBy, channel: r.origin ?? null, at: r.timestamp });
+const approvalOf = (r: GateResolutionRecord): StatusGateApproval => ({ principal: r.resolvedBy, channel: r.origin ?? null, relayedBy: r.relayedBy ?? null, at: r.timestamp });
 
 /** One gate in one environment, decided against its newest pending fact. */
-function decide(component: string, standing: PendingGateRecord, resolutions: GateResolutionRecord[], now: string): StatusGate {
+function decide(component: string, standing: PendingGateRecord, all: GateResolutionRecord[], now: string, rule: GateApprovalRule | null): StatusGate {
   const gate = standing.gate;
+  // #3163: under identity.gates, an unsigned approval, or one from outside the class, doesn't count, as a run reads it.
+  const resolutions = rule === null ? all : all.filter((r) => r.gate !== gate || rule.refuses(r) === null);
   const env = standing.environment ?? null;
   const since = standing.timestamp;
   const planDigest = standing.planDigest;
@@ -156,7 +170,8 @@ function decide(component: string, standing: PendingGateRecord, resolutions: Gat
     expiresAt: standing.expiresAt,
     approvals: approvals.map(approvalOf),
     needed,
-    approve: approveCommand(component, gate, env, planDigest),
+    signed: rule === null ? null : { class: rule.requirement.class },
+    approve: approveCommand(component, gate, env, planDigest, rule !== null),
   };
 }
 
@@ -167,7 +182,7 @@ function decide(component: string, standing: PendingGateRecord, resolutions: Gat
  * gate whose other facts have one is left out, as a run leaves it out: such a
  * line binds no environment, and `chant approve --expire` writes one.
  */
-export function gatesInLedger(component: string, content: string, envs: readonly string[], now: string): { gates: StatusGate[]; malformed: number } {
+export function gatesInLedger(component: string, content: string, envs: readonly string[], now: string, rules: GateRuleLookup = () => null): { gates: StatusGate[]; malformed: number } {
   const { pending, resolutions, malformed } = parseGateLedger(content);
   const gates: StatusGate[] = [];
   for (const gate of [...new Set(pending.map((p) => p.gate))].sort()) {
@@ -181,7 +196,7 @@ export function gatesInLedger(component: string, content: string, envs: readonly
       byEnv.set(env, [...(byEnv.get(env) ?? []), p]);
     }
     for (const env of [...byEnv.keys()].sort((a, b) => envs.indexOf(a ?? "") - envs.indexOf(b ?? ""))) {
-      gates.push(decide(component, latestPendingGate(byEnv.get(env)!, gate)!, resolutions, now));
+      gates.push(decide(component, latestPendingGate(byEnv.get(env)!, gate)!, resolutions, now, rules(gate)));
     }
   }
   return { gates, malformed };
@@ -196,6 +211,7 @@ export async function readMemberGates(
   cwd: string,
   now: string,
   read: GateLedgerReader = defaultGateLedgerReader,
+  rules: GateRuleLookup = () => null,
 ): Promise<{ gates: StatusGate[]; ledger: StatusGateLedger }> {
   const ledger: StatusGateLedger = { layout, path: dir, shared: false, malformed: 0, reason: null };
   if (commit === null) {
@@ -213,7 +229,7 @@ export async function readMemberGates(
   }
   const gates: StatusGate[] = [];
   for (const component of [...files.keys()].sort()) {
-    const read = gatesInLedger(component, files.get(component)!, envs, now);
+    const read = gatesInLedger(component, files.get(component)!, envs, now, rules);
     gates.push(...read.gates);
     ledger.malformed += read.malformed;
   }