infraweaver 0.1.0

package/src/mcp/crosswalkDigest.ts

@@ -0,0 +1,5 @@
+// Generated by `pnpm run gen:crosswalk-digest` — do not edit by hand.
+// Pinned sha256 of the reviewed compliance crosswalk (LLM04 integrity gate). It is
+// verified fail-closed before any compliance verdict is produced; see crosswalk.ts.
+// Regenerate this file whenever the crosswalk tables in crosswalk.ts change intentionally.
+export const EXPECTED_CROSSWALK_DIGEST = "a42bd438bbc32ba302c3bc7a74238adb97560e534f5c94d908f4e81ffe7c6a05";

package/src/mcp/cyberEssentials.ts

@@ -0,0 +1,60 @@
+import { mapConcernToControls } from "#app/mcp/crosswalk";
+import type { Concern, Severity } from "#app/mcp/terraform/types";
+
+/**
+ * Cyber Essentials posture, derived from the indicative crosswalk. Pure and
+ * dependency-light (crosswalk + types only) so BOTH the read-only Assess report
+ * and the Cloud report compute the identical number from the identical inputs —
+ * the score is never the model's word.
+ */
+
+export const CE_FRAMEWORK = "Cyber Essentials";
+
+// Points deducted from a perfect 100 per OPEN Cyber-Essentials concern, by
+// severity. Tuned so a handful of mediums stays in the 80s while a single
+// critical reads unambiguously as "action required" (the dashboard's red band).
+const CE_SEVERITY_PENALTY: Record<Severity, number> = {
+  critical: 25,
+  high: 12,
+  medium: 5,
+  low: 2,
+  info: 0,
+};
+
+/** The Cyber Essentials control labels a concern touches (via the indicative
+ *  crosswalk), or `[]` when it maps to none — what the finding-detail "Maps to
+ *  Cyber Essentials" panel renders. */
+export function cyberEssentialsControls(concern: Concern): string[] {
+  return mapConcernToControls(concern)
+    .controls.filter((c) => c.framework === CE_FRAMEWORK)
+    .map((c) => c.control);
+}
+
+/**
+ * The repo's Cyber Essentials posture as a deterministic 0–100 score — what the
+ * dashboard's "CE SCORE" shows. Honest by construction: only OPEN (non-suppressed)
+ * concerns that map to a Cyber Essentials control deduct from a perfect 100, so a
+ * suppressed/accepted finding or one that doesn't touch a CE control never moves
+ * the score, and a clean repo scores 100. Pure.
+ */
+export function cyberEssentialsScore(concerns: Concern[]): number {
+  let penalty = 0;
+  for (const c of concerns) {
+    if (c.suppression) continue;
+    if (cyberEssentialsControls(c).length === 0) continue;
+    penalty += CE_SEVERITY_PENALTY[c.severity];
+  }
+  return Math.max(0, Math.round(100 - penalty));
+}
+
+/** The distinct Cyber Essentials controls left at risk by the OPEN concern set —
+ *  the "N control(s) at risk" the assessment headline names. Sorted for a stable
+ *  report; empty when nothing open maps to a CE control. */
+export function cyberEssentialsControlsAtRisk(concerns: Concern[]): string[] {
+  const atRisk = new Set<string>();
+  for (const c of concerns) {
+    if (c.suppression) continue;
+    for (const control of cyberEssentialsControls(c)) atRisk.add(control);
+  }
+  return [...atRisk].sort();
+}

package/src/mcp/dashboard.ts

@@ -0,0 +1,232 @@
+import { type } from "arktype";
+import { COMMENT_COMMAND, PRODUCT_NAME } from "#app/brand";
+import { dashboardStrings } from "#app/i18n/scaffolding";
+import type { GitHubToolContext } from "#app/mcp/capabilityContext";
+import { recordCreatedTarget } from "#app/mcp/scope";
+import { execute, tool } from "#app/mcp/shared";
+import { log } from "#app/utils/cli";
+import { fixDoubleEscapedString } from "#app/utils/fixDoubleEscapedString";
+import type { UserFacingLanguage } from "#app/utils/payload";
+
+/**
+ * The per-repo "Remediation Dashboard" issue (Renovate's single pinned
+ * Dependency Dashboard, mapped to Infraweaver). ONE issue per repo gives the
+ * maintainer a stable, at-a-glance view of the Terraform remediation state:
+ * which remediation PRs are open, which concern-groups are waiting (held back by
+ * the per-run/concurrency caps), and which findings are suppressed. A waiting
+ * group is opened on demand from the dashboard's Remediate button or a
+ * `@infraweaver fix …` comment — the surfaces that actually dispatch a run.
+ *
+ * This file is the engine seam: a pure body renderer (`buildDashboardBody`) and
+ * an upsert tool that finds-or-creates the single issue. Each waiting row carries
+ * a hidden `<!-- group:ID -->` anchor reserved for a future tick-to-request
+ * consumer (a Renovate-style checkbox read back on the next run); that consumer
+ * is not yet wired, so the body renders a plain list rather than a checkbox that
+ * would silently do nothing. In keeping with the product's hard rule, the
+ * dashboard never merges or deploys anything.
+ */
+
+/** trailing marker that identifies the dashboard issue when we search for it. */
+export const DASHBOARD_MARKER = "<!-- infraweaver:remediation-dashboard -->";
+/** label applied to the dashboard issue (the primary find key + a pin target). */
+export const DASHBOARD_LABEL = "infraweaver-dashboard";
+export const DASHBOARD_TITLE = `${PRODUCT_NAME} — Remediation Dashboard`;
+
+export interface DashboardOpenPr {
+  number: number;
+  title: string;
+  url: string;
+  group_id?: string;
+  zombie?: boolean;
+}
+export interface DashboardPending {
+  title: string;
+  severity?: string;
+  files?: string;
+  group_id?: string;
+  reason?: string;
+}
+export interface DashboardSuppressed {
+  title: string;
+  reason?: string;
+}
+export interface DashboardData {
+  open_prs: DashboardOpenPr[];
+  pending: DashboardPending[];
+  suppressed?: DashboardSuppressed[];
+  note?: string;
+}
+
+/**
+ * Render the dashboard issue body (pure — no I/O). The trailing {@link
+ * DASHBOARD_MARKER} lets the upsert recognise the issue on the next run. The
+ * fixed section headers/notes are localized by the run's `language` (default
+ * English); the data rows (PR titles, counts, group markers) are unchanged.
+ */
+export function buildDashboardBody(
+  data: DashboardData,
+  language: UserFacingLanguage = "en",
+): string {
+  const t = dashboardStrings(language);
+  const lines: string[] = [];
+  lines.push(t.maintainedBy);
+  lines.push("");
+
+  lines.push(`## ${t.openPrs} (${data.open_prs.length})`);
+  if (data.open_prs.length === 0) {
+    lines.push(t.noneOpen);
+  } else {
+    for (const pr of data.open_prs) {
+      lines.push(
+        `- [#${pr.number}](${pr.url}) — ${pr.title}${pr.zombie ? " · ⚠️ stale" : ""}`,
+      );
+    }
+  }
+  lines.push("");
+
+  lines.push(`## ${t.waiting} (${data.pending.length})`);
+  if (data.pending.length === 0) {
+    lines.push(t.nothingWaiting);
+  } else {
+    lines.push(t.openOnDemand);
+    for (const p of data.pending) {
+      const sev = p.severity ? ` \`${p.severity}\`` : "";
+      const files = p.files ? ` — ${p.files}` : "";
+      const reason = p.reason ? ` _(${p.reason})_` : "";
+      const marker = p.group_id ? ` <!-- group:${p.group_id} -->` : "";
+      lines.push(`- **${p.title}**${sev}${files}${reason}${marker}`);
+    }
+  }
+  lines.push("");
+
+  const suppressed = data.suppressed ?? [];
+  if (suppressed.length > 0) {
+    lines.push(`## ${t.suppressed} (${suppressed.length})`);
+    for (const s of suppressed) {
+      lines.push(`- ${s.title}${s.reason ? ` — _${s.reason}_` : ""}`);
+    }
+    lines.push("");
+  }
+
+  if (data.note) {
+    lines.push(data.note);
+    lines.push("");
+  }
+
+  lines.push(DASHBOARD_MARKER);
+  return lines.join("\n");
+}
+
+export const RemediationDashboardParams = type({
+  open_prs: type({
+    number: type.number,
+    title: type.string,
+    url: type.string,
+    "group_id?": type.string,
+    "zombie?": type.boolean,
+  })
+    .array()
+    .describe(
+      "the currently-open remediation PRs (pass `pull_requests` from list_remediation_prs).",
+    ),
+  pending: type({
+    title: type.string,
+    "severity?": type.string,
+    "files?": type.string,
+    "group_id?": type.string,
+    "reason?": type.string,
+  })
+    .array()
+    .describe(
+      "concern groups not yet opened as PRs — e.g. held back by max_prs/pr_concurrent_limit, or awaiting an on-demand request. Pass the scan groups you did NOT open this run.",
+    ),
+  suppressed: type({ title: type.string, "reason?": type.string })
+    .array()
+    .describe("findings suppressed via inline skips / ignore rules (optional).")
+    .optional(),
+  "note?": type.string.describe(
+    "an optional free-text note appended to the dashboard.",
+  ),
+});
+
+/**
+ * Create or update the single per-repo Remediation Dashboard issue. Idempotent:
+ * finds the existing issue by the {@link DASHBOARD_LABEL} + marker and updates
+ * its body, else creates it. Bound by the same `push: disabled` read-only gate as
+ * the other issue/PR writes.
+ */
+export function UpsertRemediationDashboardTool(ctx: GitHubToolContext) {
+  return tool({
+    name: "upsert_remediation_dashboard",
+    description:
+      `Create or update the repo's single ${PRODUCT_NAME} Remediation Dashboard issue: a stable, pinned ` +
+      "summary of open remediation PRs, the concern groups waiting to be opened (each requestable on demand " +
+      `via the Remediate button or a \`${COMMENT_COMMAND} fix\` comment), and suppressed findings. Idempotent — it ` +
+      "reuses the existing dashboard issue (found by " +
+      `the \`${DASHBOARD_LABEL}\` label) instead of filing a new one each run. Call it at the END of a ` +
+      "Remediate/RefreshRemediation run with the current state. Blocked under `push: disabled`. Never merges.",
+    parameters: RemediationDashboardParams,
+    execute: execute(async (data) => {
+      if (ctx.payload.push === "disabled") {
+        throw new Error(
+          "Updating the remediation dashboard is disabled. This repository is configured for read-only access (push: disabled).",
+        );
+      }
+      const owner = ctx.repo.owner;
+      const repo = ctx.repo.name;
+      const body = fixDoubleEscapedString(
+        buildDashboardBody(data as DashboardData, ctx.payload.language),
+      );
+
+      // Find the existing dashboard: a single OPEN issue carrying our label. The
+      // listForRepo result includes PRs too (a PR is an issue), so exclude those
+      // and require the marker — belt and braces against a label collision.
+      const candidates = await ctx.octokit.paginate(
+        ctx.octokit.rest.issues.listForRepo,
+        {
+          owner,
+          repo,
+          state: "open",
+          labels: DASHBOARD_LABEL,
+          per_page: 100,
+        },
+      );
+      const existing = candidates.find(
+        (i) => !i.pull_request && (i.body ?? "").includes(DASHBOARD_MARKER),
+      );
+
+      if (existing) {
+        const updated = await ctx.octokit.rest.issues.update({
+          owner,
+          repo,
+          issue_number: existing.number,
+          body,
+        });
+        recordCreatedTarget(ctx, existing.number);
+        log.info(`» updated remediation dashboard issue #${existing.number}`);
+        return {
+          success: true,
+          action: "updated" as const,
+          number: existing.number,
+          url: updated.data.html_url,
+        };
+      }
+
+      const created = await ctx.octokit.rest.issues.create({
+        owner,
+        repo,
+        title: DASHBOARD_TITLE,
+        body,
+        labels: [DASHBOARD_LABEL],
+      });
+      recordCreatedTarget(ctx, created.data.number);
+      log.info(`» created remediation dashboard issue #${created.data.number}`);
+      return {
+        success: true,
+        action: "created" as const,
+        number: created.data.number,
+        url: created.data.html_url,
+      };
+    }),
+  });
+}

package/src/mcp/dependencies.ts

@@ -0,0 +1,190 @@
+import { type } from "arktype";
+import type { ToolContext } from "#app/mcp/server";
+import { execute, tool } from "#app/mcp/shared";
+import type { PrepOptions, PrepResult } from "#app/prep/index";
+import { runPrepPhase } from "#app/prep/index";
+import { packageManagerBinDir } from "#app/utils/packageManager";
+
+// empty schema for tools with no parameters
+const EmptyParams = type({});
+
+/**
+ * format prep results into agent-friendly message
+ */
+function formatPrepResults(results: PrepResult[]): string {
+  if (results.length === 0) {
+    return `No supported language detected in this repository (checked for package.json, requirements.txt, pyproject.toml, etc.).
+
+Inspect the repository structure to determine how dependencies should be installed, then use shell to install them.`;
+  }
+
+  const lines: string[] = [];
+
+  for (const result of results) {
+    if (result.language === "unknown") {
+      continue;
+    }
+
+    const langDisplay = result.language === "node" ? "Node.js" : "Python";
+
+    if (result.dependenciesInstalled) {
+      if (result.language === "node") {
+        lines.push(
+          `${langDisplay} dependencies installed successfully via ${result.packageManager}.`,
+        );
+      } else if (result.language === "python") {
+        lines.push(
+          `${langDisplay} dependencies installed successfully via ${result.packageManager} (from ${result.configFile}).`,
+        );
+      }
+    } else {
+      const errorMsg = result.issues.length > 0 ? result.issues.join("\n") : "unknown error";
+
+      if (result.language === "node") {
+        lines.push(`${langDisplay} dependency installation failed via ${result.packageManager}.
+
+Error:
+${errorMsg}
+
+Use shell or other tools at your disposal to diagnose and resolve the issue, then install dependencies manually.`);
+      } else if (result.language === "python") {
+        lines.push(`${langDisplay} dependency installation failed via ${result.packageManager} (from ${result.configFile}).
+
+Error:
+${errorMsg}
+
+Use shell or other tools at your disposal to diagnose and resolve the issue, then install dependencies manually.`);
+      }
+    }
+  }
+
+  if (lines.length === 0) {
+    return `No supported language detected in this repository (checked for package.json, requirements.txt, pyproject.toml, etc.).
+
+Inspect the repository structure to determine how dependencies should be installed, then use shell to install them.`;
+  }
+
+  return lines.join("\n\n");
+}
+
+/**
+ * start dependency installation in the background (non-blocking, idempotent).
+ * called eagerly from main.ts at startup and also available via MCP tools.
+ */
+export function startInstallation(ctx: ToolContext): void {
+  // already started or completed - do nothing
+  if (ctx.toolState.dependencyInstallation) {
+    return;
+  }
+
+  // SECURITY: when shell is disabled, suppress lifecycle scripts to prevent
+  // agents from using package.json scripts as a backdoor for code execution
+  const prepOptions: PrepOptions = {
+    ignoreScripts: ctx.payload.shell === "disabled",
+    binDir: packageManagerBinDir(ctx.tmpdir),
+  };
+
+  // initialize state and start installation
+  const promise = runPrepPhase(prepOptions);
+  ctx.toolState.dependencyInstallation = {
+    status: "in_progress",
+    promise,
+    results: undefined,
+  };
+
+  // when promise completes, update state
+  promise.then(
+    (results) => {
+      if (ctx.toolState.dependencyInstallation) {
+        const hasFailure = results.some((r) => !r.dependenciesInstalled && r.issues.length > 0);
+        ctx.toolState.dependencyInstallation.status = hasFailure ? "failed" : "completed";
+        ctx.toolState.dependencyInstallation.results = results;
+      }
+    },
+    () => {
+      if (ctx.toolState.dependencyInstallation) {
+        ctx.toolState.dependencyInstallation.status = "failed";
+      }
+    },
+  );
+}
+
+export function StartDependencyInstallationTool(ctx: ToolContext) {
+  return tool({
+    mutates: true,
+    name: "start_dependency_installation",
+    description:
+      "Start installing project dependencies in the background. This is non-blocking and returns immediately. Call this early (right after branch checkout) if you anticipate needing to run tests, builds, or other commands that require dependencies. Idempotent - safe to call multiple times.",
+    parameters: EmptyParams,
+    execute: execute(async () => {
+      const state = ctx.toolState.dependencyInstallation;
+
+      // already completed
+      if (state?.status === "completed" || state?.status === "failed") {
+        return {
+          status: state.status,
+          message: `Dependency installation already completed.`,
+          summary: formatPrepResults(state.results || []),
+        };
+      }
+
+      // already in progress
+      if (state?.status === "in_progress") {
+        return {
+          status: "in_progress",
+          message:
+            "Dependency installation is already in progress. Call await_dependency_installation when you need to use them.",
+        };
+      }
+
+      // start installation
+      startInstallation(ctx);
+
+      return {
+        status: "started",
+        message:
+          "Dependency installation started in background. Continue with other tasks and call await_dependency_installation when you need to run tests, builds, or other commands that require dependencies.",
+      };
+    }),
+  });
+}
+
+export function AwaitDependencyInstallationTool(ctx: ToolContext) {
+  return tool({
+    name: "await_dependency_installation",
+    description:
+      "Wait for dependency installation to complete and get the results. If installation hasn't been started yet, this will start it automatically. Call this before running tests, builds, or other commands that require dependencies.",
+    parameters: EmptyParams,
+    execute: execute(async () => {
+      // auto-start if not started
+      if (!ctx.toolState.dependencyInstallation) {
+        startInstallation(ctx);
+      }
+
+      const state = ctx.toolState.dependencyInstallation;
+      if (!state) {
+        throw new Error("failed to initialize dependency installation state");
+      }
+
+      // if already completed, return cached results
+      if (state.status === "completed" || state.status === "failed") {
+        return {
+          status: state.status,
+          message: formatPrepResults(state.results || []),
+        };
+      }
+
+      // await the promise
+      if (!state.promise) {
+        throw new Error("dependency installation state is corrupted - no promise found");
+      }
+
+      const results = await state.promise;
+
+      return {
+        status: state.status,
+        message: formatPrepResults(results),
+      };
+    }),
+  });
+}