infraweaver 0.1.0

package/src/utils/toolSelection.ts

@@ -0,0 +1,239 @@
+/**
+ * Unified tool-selection config + the
+ * non-permissive-tool confirmation gate (built on [[toolLicensing]]).
+ *
+ * One declarative `tools_enabled` list replaces the previous mix of per-flag
+ * inputs and silent presence-detection: an operator names the scanners/engines
+ * they want, prefixing `-` to turn one off. The same list is how a non-permissive
+ * tool (tflint, terraform-mcp-server) is opted into — naming it is the explicit,
+ * licence-aware acknowledgement the gate requires.
+ *
+ * Resolution precedence, per tool (highest first):
+ *   1. the required substrate (`terraform`)  → ON  (exempt; never disablable)
+ *   2. an explicit `-tool` in the list       → OFF (always wins over the rest)
+ *   3. an explicit `tool` / `+tool`          → ON  (this is the licence opt-in)
+ *   4. `all` base                            → ON  (operator accepts every tool)
+ *   5. `none` base                           → only the explicitly/flag-enabled
+ *   6. default base:
+ *        - licence-gated tool  → ON only if its dedicated flag is set, else OFF
+ *        - flag-opt-in tool    → ON only if its dedicated flag is set, else OFF
+ *        - permissive tool     → ON
+ *
+ * The dedicated booleans (`gitleaks`, `terratest`, `terraform_mcp`) still work
+ * and count as an opt-in, so existing workflows keep running unchanged. Pure.
+ */
+
+import { isLicenseGated, isPermissive, TOOL_LICENSES, type ToolId } from "#app/utils/toolLicensing";
+
+/** the parsed `tools_enabled` input: a base posture + per-tool overrides. */
+export interface ToolDirective {
+  /** `all` (enable everything) / `none` (enable nothing) / undefined (defaults). */
+  base?: "all" | "none" | undefined;
+  /** explicit per-tool overrides: true = enable, false = disable. */
+  explicit: Map<ToolId, boolean>;
+  /** tokens that matched no known tool — surfaced as a warning, never fatal. */
+  unknown: string[];
+}
+
+/** the dedicated booleans that pre-date the unified list. */
+export interface ToolSelectionFlags {
+  toolsEnabled?: ToolDirective | undefined;
+  gitleaks?: boolean;
+  terratest?: boolean;
+  terraformMcp?: boolean;
+  opentofuMcp?: boolean;
+}
+
+/**
+ * Permissive tools that still default OFF — not for licence reasons but because
+ * each is an extra/heavier engine (or writes extra files) the operator opts into
+ * via its dedicated input. Listing keeps their long-standing behaviour intact
+ * while the unified list can also enable/disable them.
+ */
+const FLAG_OPT_IN: ReadonlySet<ToolId> = new Set<ToolId>(["gitleaks", "terratest"]);
+
+/** map a token to a canonical tool id (case-insensitive; common spellings). */
+const TOKEN_ALIASES: Readonly<Record<string, ToolId>> = {
+  terraform: "terraform",
+  tf: "terraform",
+  "terraform-fmt": "terraform",
+  "terraform-validate": "terraform",
+  tflint: "tflint",
+  trivy: "trivy",
+  checkov: "checkov",
+  infracost: "infracost",
+  cost: "infracost",
+  gitleaks: "gitleaks",
+  conftest: "conftest",
+  opa: "conftest",
+  policy: "conftest",
+  terratest: "terratest",
+  terraform_mcp: "terraform_mcp",
+  "terraform-mcp": "terraform_mcp",
+  "terraform-mcp-server": "terraform_mcp",
+  opentofu_mcp: "opentofu_mcp",
+  "opentofu-mcp": "opentofu_mcp",
+  "opentofu-mcp-server": "opentofu_mcp",
+  tofu_mcp: "opentofu_mcp",
+  "tofu-mcp": "opentofu_mcp",
+} as const;
+
+/**
+ * Parse the `tools_enabled` input (comma- or newline-separated). Recognises the
+ * `all` / `none` bases and `tool` / `+tool` / `-tool` (also `!tool`) overrides.
+ * Returns undefined for an empty input so "unset" stays distinguishable from an
+ * explicit list (the consumer then applies the licence-aware defaults).
+ */
+export function parseToolSelection(raw: string | undefined): ToolDirective | undefined {
+  if (!raw?.trim()) return undefined;
+  const explicit = new Map<ToolId, boolean>();
+  const unknown: string[] = [];
+  let base: "all" | "none" | undefined;
+
+  for (const token of raw.split(/[\n,]/)) {
+    const tok = token.trim();
+    if (!tok) continue;
+    const lower = tok.toLowerCase();
+    if (lower === "all" || lower === "*") {
+      base = "all";
+      continue;
+    }
+    if (lower === "none") {
+      base = "none";
+      continue;
+    }
+    let enable = true;
+    let name = lower;
+    if (name.startsWith("-") || name.startsWith("!")) {
+      enable = false;
+      name = name.slice(1).trim();
+    } else if (name.startsWith("+")) {
+      name = name.slice(1).trim();
+    }
+    const id = TOKEN_ALIASES[name];
+    if (!id) {
+      unknown.push(tok);
+      continue;
+    }
+    explicit.set(id, enable);
+  }
+  return { base, explicit, unknown };
+}
+
+function flagFor(id: ToolId, flags: ToolSelectionFlags): boolean {
+  switch (id) {
+    case "gitleaks":
+      return !!flags.gitleaks;
+    case "terratest":
+      return !!flags.terratest;
+    case "terraform_mcp":
+      return !!flags.terraformMcp;
+    case "opentofu_mcp":
+      return !!flags.opentofuMcp;
+    default:
+      return false;
+  }
+}
+
+interface Verdict {
+  on: boolean;
+  /** why a tool is OFF (for reporting); undefined when ON. */
+  reason?: string;
+}
+
+function decide(id: ToolId, flags: ToolSelectionFlags): Verdict {
+  const dir = flags.toolsEnabled;
+  const explicit = dir?.explicit.get(id);
+
+  // 1. the required substrate is the engine's reason to exist — never gated,
+  // never disablable (a Terraform fixer always has Terraform).
+  if (TOOL_LICENSES[id].required) return { on: true };
+  // 2. an explicit disable always wins.
+  if (explicit === false) return { on: false, reason: "disabled via tools_enabled" };
+  // 3. an explicit enable is the licence-aware opt-in.
+  if (explicit === true) return { on: true };
+  // 4 / 5. an `all` / `none` base.
+  if (dir?.base === "all") return { on: true };
+  if (dir?.base === "none") {
+    return flagFor(id, flags)
+      ? { on: true }
+      : { on: false, reason: "not in the tools_enabled allow-list" };
+  }
+  // 6. licence-aware defaults.
+  if (isLicenseGated(id)) {
+    if (flagFor(id, flags)) return { on: true };
+    const { license, name } = TOOL_LICENSES[id];
+    return {
+      on: false,
+      reason: `licence-gated (${name}, ${license}) — enable explicitly by naming "${id}" in tools_enabled`,
+    };
+  }
+  if (FLAG_OPT_IN.has(id)) {
+    return flagFor(id, flags)
+      ? { on: true }
+      : { on: false, reason: `opt-in — set the ${id} input or name "${id}" in tools_enabled` };
+  }
+  // permissive default-on (subject to the tool's own runtime presence checks).
+  return { on: true };
+}
+
+/** the resolved selection for a run — a deterministic verdict per tool. */
+export interface ResolvedToolSelection {
+  enabled(id: ToolId): boolean;
+  /** the reason a tool is OFF (for the scan report / logs); undefined when ON. */
+  offReason(id: ToolId): string | undefined;
+  /** licence-gated tools that are OFF because they weren't opted into. */
+  gated: ToolId[];
+  /** tools explicitly turned off via `tools_enabled`. */
+  disabled: ToolId[];
+  /** unrecognised `tools_enabled` tokens (warn, never fatal). */
+  unknownTokens: string[];
+}
+
+/**
+ * Resolve the per-tool selection from the run's payload (the parsed
+ * `tools_enabled` directive + the dedicated booleans). Pure; safe to call from
+ * any consumer (the scan tool, the secret guardrail, the terraform-mcp resolver,
+ * the plan tool) so they all agree on which tools may run this run.
+ */
+export function resolveToolSelection(flags: ToolSelectionFlags): ResolvedToolSelection {
+  const verdicts = new Map<ToolId, Verdict>();
+  const gated: ToolId[] = [];
+  const disabled: ToolId[] = [];
+  for (const id of Object.keys(TOOL_LICENSES) as ToolId[]) {
+    const verdict = decide(id, flags);
+    verdicts.set(id, verdict);
+    if (verdict.on) continue;
+    if (flags.toolsEnabled?.explicit.get(id) === false) disabled.push(id);
+    else if (isLicenseGated(id)) gated.push(id);
+  }
+  return {
+    enabled: (id) => verdicts.get(id)?.on ?? false,
+    offReason: (id) => verdicts.get(id)?.reason,
+    gated,
+    disabled,
+    unknownTokens: flags.toolsEnabled?.unknown ?? [],
+  };
+}
+
+/** map a `terraform_scan` scanner source to the tool id it belongs to (null for
+ * the `reviewer` pseudo-source, which the gate never governs). */
+export function scannerToolId(source: string): ToolId | null {
+  switch (source) {
+    case "terraform-fmt":
+    case "terraform-validate":
+      return "terraform";
+    case "tflint":
+      return "tflint";
+    case "trivy":
+      return "trivy";
+    case "checkov":
+      return "checkov";
+    default:
+      return null;
+  }
+}
+
+export type { ToolId };
+// re-exported so callers need only this module for the common path.
+export { isPermissive, TOOL_LICENSES };

package/src/utils/toon.ts

@@ -0,0 +1,76 @@
+import { encode } from "@toon-format/toon";
+
+/**
+ * TOON encoding for infraweaver, hardened against a behaviour change in
+ * `@toon-format/toon` 4.1.0.
+ *
+ * 4.1.0 made `encode` **throw** `TypeError` on any string value — or object
+ * key — containing an unpaired surrogate. 2.x encoded such strings through
+ * without complaint. Every payload we encode is attacker-influenced: PR and
+ * issue titles/bodies and label names (`buildEventMetadata`), `git status`
+ * output and remediation commands parsed from comments (`buildRuntimeContext`),
+ * and every MCP tool result (`handleToolSuccess`), which carries third-party
+ * scanner output and repository file content. A lone surrogate is trivially
+ * reachable — GitHub's API returns JSON, and `JSON.parse('"\\ud800"')` yields
+ * exactly that — so an unguarded `encode` lets a crafted PR title abort prompt
+ * assembly and fail the run. Availability, not a guardrail bypass, but
+ * attacker-triggered either way.
+ *
+ * The library's own `replacer` hook cannot fix this: the surrogate check runs
+ * during input normalization, BEFORE the replacer is applied (verified against
+ * 4.1.0 — a replacer is never invoked for a value that fails validation). The
+ * input therefore has to be well-formed before `encode` sees it.
+ *
+ * `String.prototype.toWellFormed()` (ES2024) replaces each lone surrogate with
+ * U+FFFD, which is the standard substitution and keeps the surrounding text
+ * intact — strictly more faithful than dropping the field or the whole run.
+ */
+
+/**
+ * Plain objects only — anything with a custom prototype is passed through
+ * untouched so `toJSON` carriers (`Date`, class instances) keep the
+ * serialization TOON already gives them. Every payload we hand to
+ * {@link toonEncode} is a plain object or array of them, so this covers the
+ * real inputs; a `toJSON` that itself returns an ill-formed string would still
+ * throw, which is the correct place for it to surface.
+ */
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  if (typeof value !== "object" || value === null) return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+
+/**
+ * Recursively replaces lone surrogates in strings and object keys with U+FFFD.
+ * Exported for the tests; prefer {@link toonEncode}.
+ *
+ * Rebuilt with `Object.fromEntries`, which defines own data properties rather
+ * than assigning them — so a `__proto__` key in untrusted input cannot reach
+ * the prototype setter.
+ */
+export function toWellFormedDeep<T>(value: T): T {
+  if (typeof value === "string") return value.toWellFormed() as T;
+  if (Array.isArray(value))
+    return value.map((item) => toWellFormedDeep(item)) as T;
+  if (isPlainObject(value)) {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, item]) => [
+        key.toWellFormed(),
+        toWellFormedDeep(item),
+      ]),
+    ) as T;
+  }
+  return value;
+}
+
+/**
+ * `@toon-format/toon`'s `encode`, applied to well-formed input. Use this
+ * everywhere instead of importing `encode` directly — `knip` and the import
+ * guard keep the direct import to this module.
+ */
+export function toonEncode(
+  input: unknown,
+  options?: Parameters<typeof encode>[1],
+): string {
+  return encode(toWellFormedDeep(input), options);
+}

package/src/utils/version.ts

@@ -0,0 +1,10 @@
+import semver from "semver";
+import packageJson from "#package.json" with { type: "json" };
+
+export function getDevDependencyVersion(name: keyof typeof packageJson.devDependencies): string {
+  const version = packageJson.devDependencies[name];
+  if (!semver.valid(version)) {
+    throw new Error(`dev dependency "${name}" must be a pinned version, got "${version}"`);
+  }
+  return version;
+}

package/src/utils/versioning.ts

@@ -0,0 +1,44 @@
+import semver from "semver";
+
+type CompatibilityPolicy =
+  /**
+   * Strict policy: the action must support the same features as the payload version declares
+   * @example Payload version 1.2.3 => ^1.2.0 range of action versions supported
+   * @example Payload version 0.1.55 => ^0.1.55 range of action versions supported
+   */
+  | "same-features"
+  /**
+   * Loose policy: the action must have no breaking changes compared to the payload version
+   * @example Payload version 1.2.3 => ^1.0.0 range of action versions supported
+   * @example Payload version 0.1.55 => ^0.1.0 range of action versions supported
+   */
+  | "non-breaking";
+
+const COMPATIBILITY_POLICY: CompatibilityPolicy = "non-breaking";
+
+/**
+ * @throws Error if the action can't process payload
+ * The compatibility is determined according to the COMPATIBILITY_POLICY above.
+ * @param payloadVersion the version of the payload
+ * @param actionVersion the version of the action (recipient)
+ */
+export function validateCompatibility(payloadVersion: string, actionVersion: string): void {
+  const payloadSemVer = semver.parse(payloadVersion);
+  if (!payloadSemVer)
+    throw new Error(`Payload version ${payloadVersion} is not a valid semantic version.`);
+  const major = payloadSemVer.major;
+  const minor = payloadSemVer.minor;
+  const patch = payloadSemVer.patch;
+
+  const compatibilityRange =
+    COMPATIBILITY_POLICY === "same-features"
+      ? `^${major}.${minor}.${major === 0 ? patch : 0}`
+      : `^${major}.${major === 0 ? minor : 0}.${major === 0 ? "x" : 0}`; // non-breaking
+
+  if (!semver.satisfies(actionVersion, compatibilityRange)) {
+    throw new Error(
+      `Payload version ${payloadVersion} is incompatible with action version ${actionVersion}. ` +
+        `Please update your workflow to use at least ${semver.minVersion(compatibilityRange)} version of the action.`,
+    );
+  }
+}

package/src/utils/vertex.ts

@@ -0,0 +1,94 @@
+import { randomUUID } from "node:crypto";
+import { mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { PRODUCT_SLUG } from "#app/brand";
+import { VERTEX_MODEL_ID_ENV } from "#app/models";
+import { hasEnvVar } from "#app/utils/env";
+
+export const VERTEX_SERVICE_ACCOUNT_JSON_ENV = "VERTEX_SERVICE_ACCOUNT_JSON";
+export const GOOGLE_APPLICATION_CREDENTIALS_ENV =
+  "GOOGLE_APPLICATION_CREDENTIALS";
+export const GOOGLE_CLOUD_PROJECT_ENV = "GOOGLE_CLOUD_PROJECT";
+export const VERTEX_LOCATION_ENV = "VERTEX_LOCATION";
+
+export type VertexCredentials = {
+  credentialsPath: string;
+  secretDir: string;
+};
+
+export function isVertexRoute(model: string | undefined): boolean {
+  const vertexId = process.env[VERTEX_MODEL_ID_ENV]?.trim();
+  return model !== undefined && vertexId !== undefined && vertexId === model;
+}
+
+export function readProjectIdFromVertexServiceAccountJson():
+  | string
+  | undefined {
+  const blob = process.env[VERTEX_SERVICE_ACCOUNT_JSON_ENV];
+  if (!blob) return undefined;
+
+  try {
+    const parsed: unknown = JSON.parse(blob);
+    if (!parsed || typeof parsed !== "object" || !("project_id" in parsed)) {
+      return undefined;
+    }
+    const projectId = parsed.project_id;
+    return typeof projectId === "string" && projectId.length > 0
+      ? projectId
+      : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function createSecretDir(): string {
+  const base =
+    process.env.INFRAWEAVER_SECRET_HOME || process.env.HOME || homedir();
+  const secretDir = join(base, `.${PRODUCT_SLUG}`, "secrets", randomUUID());
+  mkdirSync(secretDir, { recursive: true, mode: 0o700 });
+  return secretDir;
+}
+
+export function materializeVertexCredentials(params: {
+  model: string | undefined;
+}): VertexCredentials | undefined {
+  if (!isVertexRoute(params.model)) return undefined;
+
+  const blob = process.env[VERTEX_SERVICE_ACCOUNT_JSON_ENV];
+  if (!blob) return undefined;
+
+  const secretDir = createSecretDir();
+  const credentialsPath = join(secretDir, "vertex-sa.json");
+  writeFileSync(credentialsPath, blob, { mode: 0o600 });
+  process.env[GOOGLE_APPLICATION_CREDENTIALS_ENV] = credentialsPath;
+
+  const projectId = readProjectIdFromVertexServiceAccountJson();
+  if (projectId && !hasEnvVar(GOOGLE_CLOUD_PROJECT_ENV)) {
+    process.env[GOOGLE_CLOUD_PROJECT_ENV] = projectId;
+  }
+
+  return { credentialsPath, secretDir };
+}
+
+export function cleanupVertexCredentials(
+  credentials: VertexCredentials | undefined,
+): void {
+  if (!credentials) return;
+  rmSync(credentials.secretDir, { recursive: true, force: true });
+  delete process.env[GOOGLE_APPLICATION_CREDENTIALS_ENV];
+}
+
+export function applyClaudeVertexEnv(
+  env: Record<string, string | undefined>,
+): void {
+  env.CLAUDE_CODE_USE_VERTEX = "1";
+  env.ANTHROPIC_VERTEX_PROJECT_ID ??= env[GOOGLE_CLOUD_PROJECT_ENV];
+  env.CLOUD_ML_REGION ??= env[VERTEX_LOCATION_ENV];
+}
+
+export function resolveVertexOpenCodeModel(
+  model: string | undefined,
+): string | undefined {
+  return isVertexRoute(model) && model ? `google-vertex/${model}` : undefined;
+}

package/src/utils/workflow.ts

@@ -0,0 +1,25 @@
+import type { OctokitWithPlugins } from "#app/utils/github";
+
+interface ResolveRunParams {
+  octokit: OctokitWithPlugins;
+}
+
+export interface ResolveRunResult {
+  runId: number | undefined;
+}
+
+/**
+ * Resolve GitHub Actions workflow run context.
+ * Uses GITHUB_REPOSITORY and GITHUB_RUN_ID env vars.
+ */
+export async function resolveRun(_params: ResolveRunParams): Promise<ResolveRunResult> {
+  const runId = process.env.GITHUB_RUN_ID
+    ? Number.parseInt(process.env.GITHUB_RUN_ID, 10)
+    : undefined;
+  const githubRepo = process.env.GITHUB_REPOSITORY;
+  if (!githubRepo?.includes("/")) {
+    throw new Error(`GITHUB_REPOSITORY env var must be set to "owner/repo", got: ${githubRepo}`);
+  }
+
+  return { runId };
+}