stacklok / toolhive / 40322280336

73%

Build Type

push

github

Committed by web-flow

Commit Message

Merge commit from fork

* Stop composite workflow on skip_remaining

The skip_remaining elicitation action is documented as skipping the
remaining workflow steps, but the engine only recorded the gate step as
a success and returned nil. The DAG executor then ran every later step,
so tool calls gated behind a declined, cancelled or timed-out
elicitation were still executed.

Return an internal sentinel from the skip_remaining handler. The DAG
executor stops on it before applying continue-on-error, and
ExecuteWorkflow records every step that did not run as skipped (with
its defaultResults and a step-skipped audit event) before completing
the workflow successfully. This keeps skip_remaining distinct from
abort, which fails the workflow.

Cover it with a workflow-engine regression test and an in-process
end-to-end test that drives a real client, vMCP and a real backend:
declining or cancelling the gate must leave the backend tool uncalled,
accepting it must run the tool once.

Document the abort, skip_remaining and continue semantics in the
elicitation example and the vMCP architecture doc.

Fixes GHSA-hjq9-7gq7-wg83

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: Giuseppe Scuglia <peppescg@gmail.com>

* Report timeouts during a skip_remaining gate

A workflow timeout or caller deadline that expired while a
skip_remaining elicitation waited was mapped to an elicitation timeout,
routed to onCancel, and reported as a successfully completed workflow.
Report the context error instead so the existing timeout and failure
handling applies; the gate's own timeout is still a graceful skip.

Document what skip_remaining guarantees: only steps that depend on the
gate never run, while steps on the same DAG level may have run or be
cancelled. Add the decline/cancel/timeout semantics to the operator
guide and the architecture doc, fix comments that said a skipped step
always means a false condition, and make the elicitation example ... (continued)

Coverage Stats

19 of 19 new or added lines in 2 files covered. (100.0%)

146 existing lines in 8 files now uncovered.

89489 of 124675 relevant lines covered (71.78%)

128.9 hits per line