@intentius/chant 0.124.9 → 0.124.11

package/src/op/op-waves-point.test.ts

@@ -13,7 +13,7 @@ import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { assertOpWavesSpec, type OpWavesSpec } from "./op-waves";
-import { runOpWave, type OpWaveDecision, type OpWaveExec, type OpWaveShowAtBase } from "./op-waves-run";
+import { runOpWave, type OpWaveDecision, type OpWaveExec, type OpWaveRunsFile, type OpWaveShowAtBase } from "./op-waves-run";
 import { memoryGateLedgerPort } from "./gate";
 import { waveSetDigest } from "../gated-waves";
 import { pointGateResumable, type GatePointAsker, type GatePointQuestion, type GatePointRequest } from "../point-decision";
@@ -218,6 +218,62 @@ describe("a wave gate that asks a decision point (#3836)", () => {
     h.done();
   });
 
+  test("the plans file's pending fields and the spec's neverOverMcp land on the point gate's pending fact (#3863)", async () => {
+    const tg: OpWavesSpec = {
+      name: "tf-apply",
+      op: "tf-apply",
+      gateName: "wave-{k}",
+      planWave: ["tg", "plan", "{wave}", "{runs}", "{plans}"],
+      applyWave: ["tg", "apply", "{wave}", "{runs}", "{plans}"],
+      point: { name: "prod-apply" },
+      waves: [{ name: "net", runs: [{ target: "vpc" }, { target: "nat" }] }],
+    };
+    const members = [{ member: "vpc", planDigest: digest("1") }, { member: "nat", planDigest: digest("2") }];
+    const cwd = mkdtempSync(join(tmpdir(), "op-waves-point-3863-"));
+    const exec: OpWaveExec = (argv, dir) => {
+      const runs = JSON.parse(readFileSync(join(dir, argv[3]!), "utf-8")) as OpWaveRunsFile;
+      if (argv[1] === "plan") {
+        writeFileSync(join(dir, argv[4]!), JSON.stringify({
+          runs: runs.runs.map((r) => ({ target: r.target, planDigest: members.find((m) => m.member === r.target)!.planDigest })),
+          pending: { commit: "c".repeat(40), members, description: "wave 1 of 1: vpc, nat" },
+        }));
+      }
+      return 0;
+    };
+    // neverOverMcp at base counts even when the change drops it.
+    const show: OpWaveShowAtBase = () => ({ sha: "b".repeat(40), text: JSON.stringify({ ...tg, neverOverMcp: true }) });
+    const gates = memoryGateLedgerPort();
+    const asker = stubAsker();
+    const waiting = await runOpWave({ spec: tg, specFile: "waves.json", wave: 1, cwd, exec, show, gates, points: asker, now: NOW, log: () => {} });
+    expect(waiting.exitCode).toBe(3);
+    expect(gates.appended).toHaveLength(1);
+    expect(gates.appended[0]).toMatchObject({
+      op: "tf-apply",
+      gate: "wave-1",
+      commit: "c".repeat(40),
+      members,
+      description: "wave 1 of 1: vpc, nat",
+      neverOverMcp: true,
+      answer: { point: "prod-apply" },
+    });
+    expect(waiting.decision?.pendingFact).toMatchObject({ commit: "c".repeat(40), neverOverMcp: true });
+
+    // A standing fact for the same question that does not carry neverOverMcp does not stand: the run records one that does.
+    const old = { ...gates.appended[0]! };
+    delete (old as { neverOverMcp?: true }).neverOverMcp;
+    const stale = memoryGateLedgerPort({ pending: [old] });
+    await runOpWave({ spec: tg, specFile: "waves.json", wave: 1, cwd, exec, show, gates: stale, points: asker, now: NOW, log: () => {} });
+    expect(stale.appended).toHaveLength(1);
+    expect(stale.appended[0]).toMatchObject({ neverOverMcp: true });
+
+    // Without neverOverMcp at base, the fact carries the fields and no neverOverMcp.
+    const plain = memoryGateLedgerPort();
+    await runOpWave({ spec: tg, specFile: "waves.json", wave: 1, cwd, exec, show: () => ({ sha: "b".repeat(40), text: JSON.stringify(tg) }), gates: plain, points: asker, now: NOW, log: () => {} });
+    expect(plain.appended[0]).toMatchObject({ commit: "c".repeat(40), members });
+    expect(plain.appended[0]).not.toHaveProperty("neverOverMcp");
+    rmSync(cwd, { recursive: true, force: true });
+  });
+
   test("resume picks up the waiting wave once its question is answered (#3835)", async () => {
     vi.stubEnv("GITLAB_CI", "");
     vi.stubEnv("GITHUB_ACTIONS", "true");
@@ -245,7 +301,9 @@ describe("a wave gate that asks a decision point (#3836)", () => {
     expect(await resumeStanding(fact, [], { questions: new Map([[id, yes]]), dryRun: true })).toMatchObject({
       op: "tf-apply",
       gate: "tf-apply-wave-1",
-      status: "skipped",
+      status: "would-resume",
+      resumable: true,
+      reason: "answered",
       approvedBy: "alice",
       message: expect.stringContaining("would resume github run 4242"),
     });

package/src/op/op-waves-run.ts

@@ -1067,7 +1067,8 @@ async function settleOtherGate(ctx: WaveContext, hold: OtherGateHold): Promise<O
     planDigest: hold.request.digest,
     description: hold.request.description ?? `wave ${k} (${wave.name}) of ${spec.name} is held on it by ${hold.label}`,
     now,
-    ...(hold.request.pending ? { fields: hold.request.pending } : {}),
+    // #3839: the wave a hold belongs to, as a field, whatever the hook's own description says.
+    fields: { ...hold.request.pending, wave: { number: k, name: wave.name, op: spec.name } },
     ...(neverOverMcp ? { neverOverMcp: true } : {}),
   });
   const base = { op, gate: hold.request.gate, digest: hold.request.digest, hook: hold.label };
@@ -1559,7 +1560,7 @@ async function settleDenials(ctx: WaveContext, decision: OpWaveDecision, listed:
         description: m.denied.reason ?? `wave ${k} (${wave.name}) of ${spec.name}: ${m.member}: plan ${m.planDigest} denied by ${og.sortedRules(m.denied.rules).join(", ")}`,
       });
       try {
-        await port.appendPending({ ...fact, members: [{ member: m.member, planDigest: m.planDigest }] } as typeof fact);
+        await port.appendPending({ ...fact, members: [{ member: m.member, planDigest: m.planDigest }], wave: { number: k, name: wave.name, op: spec.name } } as typeof fact);
       } catch (err) {
         log(`${m.member}: the denial was not recorded for an override: ${err instanceof Error ? err.message : String(err)}`);
       }
@@ -1695,6 +1696,9 @@ async function settlePointGate(options: RunOpWaveOptions, ctx: WaveContext, deci
     ...(point.timeout ? { timeout: point.timeout } : {}),
     planDigest: digest,
     ...(options.now ? { now: options.now } : {}),
+    // #3863: the plans file's pending fields and the spec's neverOverMcp, as settleGate passes them.
+    ...(decision.pending ? { fields: decision.pending } : {}),
+    ...(decision.neverOverMcp ? { neverOverMcp: true } : {}),
   });
   if (check.satisfied) {
     decision.status = "approved";

package/src/op/op-waves.test.ts

@@ -836,6 +836,8 @@ describe("gates and holds a product's wave needs (#3821)", () => {
     expect(result).toMatchObject({ exitCode: 7, decision: { status: "refused", refused: { reason: "policy", runs: ["vpc"] } } });
     expect(gates.appended).toHaveLength(1);
     expect(gates.appended[0]).toMatchObject({ op: "policy-override", gate: "vpc", plan: digest("1"), rules: ["no-public-s3"], members: [{ member: "vpc", planDigest: digest("1") }] });
+    // #3839: the denial names its wave as a field.
+    expect(gates.appended[0]).toMatchObject({ wave: { number: 1, name: expect.any(String), op: tg.name } });
     expect(h.envs.find((e) => e.CHANT_HOOK === "after-gate")).toMatchObject({ CHANT_GATE_STATUS: "refused" });
     expect(h.calls.some((c) => c.startsWith("tg apply"))).toBe(false);
     const { opWaveNotifyFields } = await import("./op-waves-notify");
@@ -883,7 +885,7 @@ describe("gates and holds a product's wave needs (#3821)", () => {
     const hook = (argv: string[], env: Record<string, string>, dir: string) => {
       if (argv[0] !== "migrate") return 0;
       if (env.CHANT_HOLD_APPROVED) return 0;
-      writeFileSync(join(dir, env.CHANT_HOLD!), JSON.stringify({ op: "tf-migrate", gate: "split-queues", digest: digest("m"), pending: { members: [] } }));
+      writeFileSync(join(dir, env.CHANT_HOLD!), JSON.stringify({ op: "tf-migrate", gate: "split-queues", digest: digest("m"), description: "move the queues", pending: { members: [] } }));
       return 3;
     };
     const h = harness({ vpc: { planDigest: digest("1") }, dns: { planDigest: digest("2") } }, { hook, atBase: spec });
@@ -892,6 +894,8 @@ describe("gates and holds a product's wave needs (#3821)", () => {
     expect(waiting).toMatchObject({ exitCode: 3, decision: { status: "waiting", heldOn: { op: "tf-migrate", gate: "split-queues", digest: digest("m"), status: "waiting" } } });
     expect(waiting.decision!.approve).toBe(`chant approve tf-migrate split-queues --plan ${digest("m")}`);
     expect(gates.appended[0]).toMatchObject({ op: "tf-migrate", gate: "split-queues", planDigest: digest("m"), members: [] });
+    // #3839: the hold names its wave as a field, even when the hook wrote the description.
+    expect(gates.appended[0]).toMatchObject({ description: "move the queues", wave: { number: 1, name: expect.any(String), op: tg.name } });
     expect(h.calls.some((c) => c.startsWith("tg plan"))).toBe(false);
     expect(h.envs.find((e) => e.CHANT_HOOK === "after-gate")).toMatchObject({ CHANT_GATE_STATUS: "waiting", CHANT_GATE_OP: "tf-migrate", CHANT_GATE: "split-queues" });
     h.done();

package/src/point-decision.ts

@@ -31,7 +31,7 @@ import { execFile } from "node:child_process";
 import { isPendingGateExpired, latestPendingGate } from "./lifecycle/gate-ledger-select";
 import { DEFAULT_GATE_EXPIRY, resolveApprovalUrl } from "./lifecycle/gate-pending";
 import { samePlanDigest } from "./lifecycle/plan-digest";
-import type { GateAnswerRef, GateResolutionRecord, PendingGateRecord } from "./lifecycle/gate-ledger";
+import type { GateAnswerRef, GateResolutionRecord, PendingGateInput, PendingGateRecord } from "./lifecycle/gate-ledger";
 import { parseDuration } from "./op/duration";
 import type { GateLedgerPort } from "./op/gate";
 import { DEFAULT_GATE_POINT_PASS, defaultGatePointStore, gatePointInputs, gateSubject, type GatePoint, type GatePointFacts, type GatePointStore } from "./op/gate-point";
@@ -121,6 +121,17 @@ export interface PointGateInput {
    * ({@link resolveGateRunLocator}); false records none.
    */
   resume?: GateRunLocator | false;
+  /**
+   * Fields a caller adds to the pending fact it records (#3863), such as an
+   * Op waves product's commit and members, as `evaluateGate` takes them.
+   * Every field this function writes itself wins over one of the same name.
+   */
+  fields?: Record<string, unknown>;
+  /**
+   * The pending fact it records carries `neverOverMcp` (#3863): an answer to
+   * the question over MCP or ACP is refused (`answer-never-over-mcp`, #3817).
+   */
+  neverOverMcp?: boolean;
 }
 
 /** What reaching a gate that asks a point decided. */
@@ -198,12 +209,17 @@ export async function evaluatePointGate(port: PointGateLedgerPort, asker: GatePo
   const waiting: WaitingPoint = { id: q.id, point: q.point, state: q.state === "proposed" ? "proposed" : "escalated", path: q.path, subject: q.subject, steward: q.steward };
   const ledger = await port.read(input.op);
   const standing = latestPendingGate(ledger.pending.filter((p) => p.environment === undefined), input.gate);
-  if (standing && !isPendingGateExpired(standing, now) && samePlanDigest(standing.planDigest, input.planDigest) && standing.answer?.id === q.id) {
+  // #3863: a standing fact that does not carry the gate's neverOverMcp does not stand, so the answer path reads the rule.
+  if (
+    standing && !isPendingGateExpired(standing, now) && samePlanDigest(standing.planDigest, input.planDigest) && standing.answer?.id === q.id &&
+    (!input.neverOverMcp || standing.neverOverMcp === true)
+  ) {
     return { satisfied: false, waiting, pending: standing, recorded: false };
   }
   const url = resolveApprovalUrl();
   const resume = input.resume === false ? undefined : (input.resume ?? resolveGateRunLocator());
   const { record, pushed, pushWarning } = await port.appendPending({
+    ...(input.fields as Partial<PendingGateInput> | undefined),
     op: input.op,
     gate: input.gate,
     timestamp: now,
@@ -214,6 +230,7 @@ export async function evaluatePointGate(port: PointGateLedgerPort, asker: GatePo
     ...(input.planDigest !== undefined ? { planDigest: input.planDigest } : {}),
     ...(resume ? { resume } : {}),
     answer: { ...ref, ...(input.point.pass ? { pass: input.point.pass } : {}) },
+    ...(input.neverOverMcp ? { neverOverMcp: true as const } : {}),
   });
   return { satisfied: false, waiting, pending: record, recorded: true, pushed, ...(pushWarning ? { pushWarning } : {}) };
 }