infraweaver 0.1.0

package/src/mcp/capabilityContext.ts

@@ -0,0 +1,80 @@
+import type { AgentId } from "#app/external";
+import type { ToolState } from "#app/toolState";
+import type { OctokitWithPlugins } from "#app/utils/github";
+import type { ResolvedPayload } from "#app/utils/payload";
+import type { RunContextData } from "#app/utils/runContextData";
+
+/**
+ * Capability contexts: the narrow, per-family subsets of the 28-field
+ * `ToolContext` (see `mcp/server.ts`). Each interface is a structural subset, so
+ * the full `ToolContext` is assignable to it — the server wires every tool with
+ * one `ToolContext` and each factory sees only the capability it declares.
+ *
+ * The point is the TEST SURFACE. A git tool typed `GitToolContext` is unit-tested
+ * by constructing seven real fields with real types — not a 28-field object cast
+ * `as unknown as ToolContext`, whose cast hides whichever field the tool actually
+ * reaches for. `LocalToolContext` (see `mcp/localContext.ts`) is the cwd-scoped
+ * member of this same family; these three add the GitHub / git / cloud surfaces.
+ *
+ * `payload` and `toolState` stay their full shared types — they are legitimately
+ * broad state carriers every family reads, and narrowing them buys nothing for
+ * the test surface (a fixture builds them either way). What each interface drops
+ * is the top-level capability fields a family never touches: a cloud tool needn't
+ * fabricate an `octokit`, a git tool needn't fabricate an `apiToken`.
+ */
+
+/**
+ * GitHub REST/GraphQL capability: the authenticated `octokit` client, the repo
+ * coordinates it addresses, the installation token (raw-asset fetch), and the
+ * review-surface fields (`agentId` for tool-ref rendering, `prApproveEnabled`).
+ * The home of the ~15 issue/PR/review/comment/label tools.
+ */
+export interface GitHubToolContext {
+  octokit: OctokitWithPlugins;
+  githubInstallationToken: string;
+  repo: RunContextData["repo"];
+  payload: ResolvedPayload;
+  toolState: ToolState;
+  tmpdir: string;
+  agentId: AgentId;
+  prApproveEnabled: boolean;
+}
+
+/**
+ * Git capability: the token pushes authenticate with, the single-flight re-minter
+ * (`refreshGitToken`), the prepush lifecycle hook, and the repo/payload/state the
+ * push guardrails read. No `octokit` — the git tools shell out, they don't call
+ * the API.
+ */
+export interface GitToolContext {
+  gitToken: string;
+  // single-flight git-token re-minter, or undefined when re-minting isn't
+  // possible (off-CI / external GH_TOKEN). Mirrors `ToolContext.refreshGitToken`.
+  refreshGitToken?: ((stale: string) => Promise<string>) | undefined;
+  prepushScript: string | null;
+  repo: RunContextData["repo"];
+  payload: ResolvedPayload;
+  toolState: ToolState;
+  // needed only so the git tools can hand this context to the push guardrails,
+  // which spill a gitleaks report under tmpdir (see `mcp/guardrails.ts`).
+  tmpdir: string;
+}
+
+/**
+ * Cloud capability: the identity a tool presents to Infraweaver Cloud — the run's
+ * `api_token` (a `tmnd_`/`tmpx_` bearer) and its `runId`. Consumed by the upload
+ * tool and by `patchWorkflowRunFields`. See `utils/cloudClient.ts` (E3).
+ */
+export interface CloudToolContext {
+  apiToken: string;
+  runId: number | undefined;
+}
+
+/**
+ * The write tools that create a GitHub artifact AND report its node-id back to
+ * Cloud via `patchWorkflowRunFields` (create_pull_request, create_issue,
+ * create_review, the plan-comment writers) genuinely span two capabilities: the
+ * GitHub surface plus the cloud identity. Naming the intersection keeps their
+ * signatures honest about both.
+ */
+export type GitHubWriteToolContext = GitHubToolContext & CloudToolContext;

package/src/mcp/changeSummary.ts

@@ -0,0 +1,145 @@
+import { type } from "arktype";
+import type { BaseBranchContext } from "#app/mcp/pr";
+import { resolveBaseBranch } from "#app/mcp/pr";
+import { execute, tool, toolOk } from "#app/mcp/shared";
+import { skipResult } from "#app/mcp/terraform/types";
+import { log } from "#app/utils/cli";
+import { $ } from "#app/utils/shell";
+
+/**
+ * AI PR summaries — the deterministic Terraform-change anchor. A PR summary
+ * written purely by the model drifts (miscounts resources, invents changes). This
+ * parses the PR's unified diff for Terraform BLOCK changes (which resource /
+ * module / data / variable / output addresses were added or removed, which files
+ * were touched) so the human-readable summary is anchored to facts, not prose.
+ *
+ * Pure parser (`summarizeTerraformResourceDiff`) + a tool that runs the
+ * merge-base diff and feeds it in. Block ADDED/REMOVED is precise (a block header
+ * on a +/- line); in-place edits to an existing block surface as a touched FILE
+ * (attributing a sub-block edit to a specific address needs full-file parsing —
+ * we stay honest and report the file rather than guess).
+ */
+
+export interface TerraformChangeSummary {
+  /** addresses of blocks added in this diff (e.g. `aws_s3_bucket.logs`, `module.vpc`). */
+  added: string[];
+  /** addresses of blocks removed in this diff. */
+  removed: string[];
+  /** Terraform files touched (a superset signal — includes in-place edits). */
+  files: string[];
+  counts: { added: number; removed: number; files: number };
+}
+
+const isTfFile = (file: string): boolean => /\.tf$|\.tfvars$/.test(file);
+
+/**
+ * Parse a Terraform block header into its address, or null when the line is not a
+ * top-level block header. Handles two-label blocks (`resource`/`data`) and
+ * single-label blocks (`module`/`variable`/`output`/`provider`). The line is the
+ * raw HCL (diff +/- prefix already stripped). Pure.
+ */
+export function parseBlockAddress(line: string): string | null {
+  const s = line.trim();
+  const two = s.match(/^(resource|data)\s+"([^"]+)"\s+"([^"]+)"\s*\{/);
+  if (two) {
+    const [, kind, t, name] = two;
+    return kind === "data" ? `data.${t}.${name}` : `${t}.${name}`;
+  }
+  const one = s.match(/^(module|variable|output|provider)\s+"([^"]+)"\s*\{/);
+  if (one) {
+    const [, kind, name] = one;
+    const prefix = kind === "variable" ? "var" : kind;
+    return `${prefix}.${name}`;
+  }
+  return null;
+}
+
+/**
+ * Summarise a unified `git diff` into added/removed Terraform block addresses +
+ * the touched Terraform files. Tracks the current file from `+++ b/<path>`
+ * headers and only considers `.tf`/`.tfvars` files. Pure; deterministic ordering
+ * (sorted, de-duplicated). A block counted as both added and removed (moved) is
+ * left in both lists — the prose can describe the move.
+ */
+export function summarizeTerraformResourceDiff(diff: string): TerraformChangeSummary {
+  const added = new Set<string>();
+  const removed = new Set<string>();
+  const files = new Set<string>();
+  let file = "";
+  let inTf = false;
+  for (const raw of diff.split("\n")) {
+    if (raw.startsWith("+++ ")) {
+      const path = raw.slice(4).trim().replace(/^b\//, "");
+      file = path === "/dev/null" ? "" : path;
+      inTf = !!file && isTfFile(file);
+      continue;
+    }
+    if (raw.startsWith("--- ") || raw.startsWith("diff --git") || raw.startsWith("@@")) continue;
+    if (!inTf) continue;
+    if (raw.startsWith("+") || raw.startsWith("-")) {
+      files.add(file);
+      const addr = parseBlockAddress(raw.slice(1));
+      if (addr) (raw.startsWith("+") ? added : removed).add(addr);
+    }
+  }
+  const sort = (s: Set<string>): string[] => [...s].sort();
+  return {
+    added: sort(added),
+    removed: sort(removed),
+    files: sort(files),
+    counts: { added: added.size, removed: removed.size, files: files.size },
+  };
+}
+
+export const TerraformChangeSummaryParams = type({
+  "base?": type.string.describe(
+    "base branch to diff against (default: the run's resolved base branch — main/master or the base_branch input).",
+  ),
+});
+
+export function TerraformChangeSummaryTool(ctx: BaseBranchContext) {
+  return tool({
+    name: "terraform_change_summary",
+    description:
+      "A DETERMINISTIC anchor for a PR summary: the Terraform `resource`/`module`/`data`/`variable`/" +
+      "`output` addresses ADDED and REMOVED on this branch vs its base, plus the Terraform files touched. " +
+      "Runs a merge-base `git diff` of `*.tf`/`*.tfvars` and parses the block headers, so the human-readable " +
+      "summary you write is grounded in real counts instead of guessed ones. Degrades green (returns " +
+      "`ok: false`) when git can't resolve the base (fetch it first) or nothing Terraform changed — then " +
+      "summarise from the diff yourself. In-place edits to an existing block surface as a touched `file` " +
+      "(not an added/removed address). Use it in SummarizePr (or any PR summary) before writing the prose.",
+    parameters: TerraformChangeSummaryParams,
+    execute: execute(async ({ base }) => {
+      const baseBranch = base ?? resolveBaseBranch(ctx);
+      const pathspec = ["--", "*.tf", "*.tfvars"];
+      let diff: string | null = null;
+      // prefer the remote-tracking base (origin/<base>), fall back to a local ref.
+      for (const ref of [`origin/${baseBranch}`, baseBranch]) {
+        try {
+          diff = $("git", ["diff", "--merge-base", ref, ...pathspec], { log: false });
+          break;
+        } catch {
+          diff = null;
+        }
+      }
+      if (diff === null) {
+        return skipResult(
+          "base_unresolved",
+          `could not diff against '${baseBranch}' (fetch the base first, e.g. git_fetch({ ref: "${baseBranch}" })) — summarise from the diff yourself`,
+        );
+      }
+      const summary = summarizeTerraformResourceDiff(diff);
+      if (summary.counts.files === 0) {
+        return skipResult(
+          "no_terraform_changes",
+          "no Terraform files changed vs the base — this PR's summary is not Terraform-specific; summarise from the diff yourself",
+        );
+      }
+      log.info(
+        `» terraform_change_summary: +${summary.counts.added} -${summary.counts.removed} block(s) ` +
+          `across ${summary.counts.files} file(s) vs ${baseBranch}`,
+      );
+      return toolOk({ base: baseBranch, ...summary });
+    }),
+  });
+}

package/src/mcp/checkSuite.ts

@@ -0,0 +1,261 @@
+import { mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { type } from "arktype";
+import type { GitHubToolContext } from "#app/mcp/capabilityContext";
+import { execute, tool } from "#app/mcp/shared";
+import { fenceUntrusted } from "#app/mcp/untrustedContent";
+import { getTempDir } from "#app/utils/env";
+import { log } from "#app/utils/log";
+
+export const GetCheckSuiteLogs = type({
+  check_suite_id: type.number.describe("the id from check_suite.id"),
+});
+
+type LogLine = {
+  line: number;
+  content: string;
+  type: "error" | "warning" | "failure" | "trace";
+};
+
+type LogAnalysis = {
+  totalLines: number;
+  index: LogLine[];
+  excerpt: {
+    content: string;
+    startLine: number;
+    endLine: number;
+  };
+};
+
+export function analyzeLog(logs: string, excerptLines = 80): LogAnalysis {
+  // biome-ignore lint/suspicious/noControlCharactersInRegex: ANSI escape codes use control chars
+  const clean = logs.replace(/\x1b\[[0-9;]*m/g, "");
+  const lines = clean.split("\n");
+  const totalLines = lines.length;
+
+  const index: LogLine[] = [];
+
+  const patterns: Array<{ type: LogLine["type"]; pattern: RegExp; skip?: RegExp }> = [
+    { type: "error", pattern: /##\[error\]/i },
+    { type: "error", pattern: /\bError:/i },
+    { type: "error", pattern: /\bERR_/i },
+    { type: "error", pattern: /exit code [1-9]/i },
+    { type: "warning", pattern: /##\[warning\]/i },
+    { type: "warning", pattern: /\bWARN\b/i, skip: /apt|dpkg|Reading package/i },
+    { type: "failure", pattern: /\d+ failed/i },
+    { type: "failure", pattern: /FAIL\b/i },
+    { type: "failure", pattern: /✕|✗|×/ },
+    { type: "trace", pattern: /^\s+at\s+/i },
+  ];
+
+  for (const [i, line] of lines.entries()) {
+    for (const p of patterns) {
+      if (p.pattern.test(line)) {
+        if (p.skip?.test(line)) continue;
+
+        // dedupe consecutive traces
+        if (p.type === "trace" && index.length > 0 && index[index.length - 1]!.type === "trace") {
+          continue;
+        }
+
+        // truncate long lines
+        const truncated = line.length > 120 ? `${line.slice(0, 117)}...` : line;
+
+        index.push({
+          line: i + 1,
+          content: truncated.trim(),
+          type: p.type,
+        });
+        break;
+      }
+    }
+  }
+
+  // find excerpt range: focus on LAST ##[error] line
+  let errorLine = -1;
+  for (let i = lines.length - 1; i >= 0; i--) {
+    if (/##\[error\]/i.test(lines[i]!)) {
+      errorLine = i;
+      break;
+    }
+  }
+
+  let start: number;
+  let end: number;
+
+  if (errorLine === -1) {
+    start = Math.max(0, totalLines - excerptLines);
+    end = totalLines;
+  } else {
+    const contextAfter = 5;
+    const contextBefore = excerptLines - contextAfter;
+    start = Math.max(0, errorLine - contextBefore);
+    end = Math.min(totalLines, errorLine + contextAfter);
+  }
+
+  return {
+    totalLines,
+    index,
+    excerpt: {
+      content: lines.slice(start, end).join("\n"),
+      startLine: start + 1,
+      endLine: end,
+    },
+  };
+}
+
+type JobLogResult = {
+  job_id: number;
+  job_name: string;
+  job_url: string;
+  failed_steps: string[];
+  log_index: LogLine[];
+  excerpt: {
+    start_line: number;
+    end_line: number;
+    total_lines: number;
+    content: string;
+  };
+  full_log_path: string;
+};
+
+export function GetCheckSuiteLogsTool(ctx: GitHubToolContext) {
+  return tool({
+    name: "get_check_suite_logs",
+    description:
+      "get workflow run logs for a failed check suite. returns a log_index of interesting lines, " +
+      "a curated excerpt, and full_log_path for deeper investigation. " +
+      "pass check_suite.id from the webhook payload.",
+    parameters: GetCheckSuiteLogs,
+    execute: execute(async (params) => {
+      const check_suite_id = params.check_suite_id;
+
+      // get workflow runs for this specific check suite
+      const workflowRuns = await ctx.octokit.paginate(
+        ctx.octokit.rest.actions.listWorkflowRunsForRepo,
+        {
+          owner: ctx.repo.owner,
+          repo: ctx.repo.name,
+          check_suite_id,
+          per_page: 100,
+          request: { signal: AbortSignal.timeout(10_000) },
+        },
+      );
+
+      const failedRuns = workflowRuns.filter((run) => run.conclusion === "failure");
+
+      if (failedRuns.length === 0) {
+        return {
+          check_suite_id,
+          message: "no failed workflow runs found for this check suite",
+          failed_jobs: [],
+        };
+      }
+
+      // setup logs directory
+      const tempDir = getTempDir();
+      const logsDir = join(tempDir, "ci-logs");
+      mkdirSync(logsDir, { recursive: true });
+
+      const jobResults: JobLogResult[] = [];
+
+      // get logs for each failed run
+      for (const run of failedRuns) {
+        const jobs = await ctx.octokit.paginate(ctx.octokit.rest.actions.listJobsForWorkflowRun, {
+          owner: ctx.repo.owner,
+          repo: ctx.repo.name,
+          run_id: run.id,
+          request: { signal: AbortSignal.timeout(10_000) },
+        });
+
+        // only process failed jobs
+        const failedJobs = jobs.filter((job) => job.conclusion === "failure");
+
+        for (const job of failedJobs) {
+          try {
+            const logsResponse = await ctx.octokit.rest.actions.downloadJobLogsForWorkflowRun({
+              owner: ctx.repo.owner,
+              repo: ctx.repo.name,
+              job_id: job.id,
+              request: { signal: AbortSignal.timeout(10_000) },
+            });
+
+            const logsUrl = logsResponse.url;
+            const logsResult = await fetch(logsUrl, { signal: AbortSignal.timeout(10_000) });
+            if (!logsResult.ok) {
+              throw new Error(
+                `failed to fetch logs: ${logsResult.status} ${logsResult.statusText}`,
+              );
+            }
+            const logsText = await logsResult.text();
+
+            // write full log to disk
+            const logPath = join(logsDir, `job-${job.id}.log`);
+            writeFileSync(logPath, logsText);
+
+            // analyze log
+            const analysis = analyzeLog(logsText, 80);
+
+            // get failed steps
+            const failedSteps =
+              job.steps
+                ?.filter((s) => s.conclusion === "failure")
+                .map((s) => `Step ${s.number}: ${s.name}`) ?? [];
+
+            jobResults.push({
+              job_id: job.id,
+              job_name: job.name,
+              job_url: job.html_url ?? "",
+              failed_steps: failedSteps,
+              log_index: analysis.index,
+              excerpt: {
+                start_line: analysis.excerpt.startLine,
+                end_line: analysis.excerpt.endLine,
+                total_lines: analysis.totalLines,
+                // LLM01. This is stdout from a workflow defined in the branch
+                // under review — on a fork PR, ~80 lines an outside contributor
+                // chose, arriving as free prose in the middle of a tool result.
+                // Fenced rather than neutralised: the excerpt is diagnostic and
+                // must stay byte-faithful to be useful, and the fence bounds it
+                // without editing it. `fenceUntrusted` defangs its own marker
+                // phrase, so the log cannot close the quarantine it sits in.
+                content: fenceUntrusted(`CI job log — ${job.name}`, analysis.excerpt.content),
+              },
+              full_log_path: logPath,
+            });
+
+            log.debug(`analyzed logs for job ${job.name}: ${analysis.index.length} indexed lines`);
+          } catch (error) {
+            log.info(`failed to fetch logs for job ${job.id}: ${error}`);
+          }
+        }
+      }
+
+      return {
+        _instructions: {
+          overview:
+            "this result contains CI failure information. use log_index to find interesting lines, then read full_log_path for details.",
+          fields: {
+            log_index:
+              "array of interesting lines (errors, warnings, failures) with line numbers. use these to navigate the full log.",
+            excerpt:
+              "a curated ~80 line window around the last error. may not show all failures if they occur in different places.",
+            full_log_path:
+              "path to the complete log file. read specific line ranges using the line numbers from log_index.",
+            failed_steps:
+              "which CI steps failed. read the workflow yml to understand what commands these steps run.",
+          },
+          workflow: [
+            "1. scan log_index to see where errors/warnings/failures are located",
+            "2. read excerpt for immediate context",
+            "3. if excerpt doesn't show what you need, read specific line ranges from full_log_path",
+            "4. check failed_steps to understand what command failed",
+          ],
+        },
+        check_suite_id,
+        repo: `${ctx.repo.owner}/${ctx.repo.name}`,
+        failed_jobs: jobResults,
+      };
+    }),
+  });
+}