infraweaver 0.1.0

package/src/mcp/terraform/baseline.ts

@@ -0,0 +1,172 @@
+/**
+ * Baseline + gate (2c).
+ *
+ * A committed `.infraweaver.baseline.json` records the line-independent keys of the
+ * concerns that already existed when the baseline was taken. With a baseline in
+ * place the check fails only on findings that are NEW relative to it (and at or
+ * above the gate severity) — so a first scan on a messy repo doesn't fail the
+ * build wholesale, and the team isn't pushed to suppress everything at once.
+ *
+ * The gate defaults to High/Critical: only NEW high/critical findings fail the
+ * check. Lower-severity findings are still reported (and counted) — just not
+ * gated — matching the Checkov/tfsec "baseline + severity gate" convention.
+ *
+ * Pure module (the file read lives in `loadBaseline`); the gate evaluation is
+ * fully unit-testable.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { BASELINE_FILE } from "#app/brand";
+import {
+  type Concern,
+  concernKeyOf,
+  SEVERITY_RANK,
+  type Severity,
+} from "#app/mcp/terraform/types";
+
+export const BASELINE_FILENAME = BASELINE_FILE;
+
+/** Findings at/above this severity fail the gate. High = high + critical. */
+export const DEFAULT_GATE_SEVERITY: Severity = "high";
+
+export interface BaselineFile {
+  version: 1;
+  /** ISO date the baseline was taken (informational). */
+  created?: string;
+  /** line-independent concern keys (see `concernKeyOf`) present at baseline time. */
+  keys: string[];
+}
+
+/** The serialized baseline for the current concern set (what a `--write-baseline` emits). */
+export function serializeBaseline(
+  concerns: Concern[],
+  created: string,
+): BaselineFile {
+  const keys = Array.from(new Set(concerns.map((c) => concernKeyOf(c)))).sort();
+  return { version: 1, created, keys };
+}
+
+/** Parse baseline JSON into a key set; tolerant of a malformed/old file (→ null). */
+export function parseBaseline(raw: string): Set<string> | null {
+  let doc: unknown;
+  try {
+    doc = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (!doc || typeof doc !== "object") return null;
+  const keys = (doc as { keys?: unknown }).keys;
+  if (!Array.isArray(keys)) return null;
+  return new Set(keys.filter((k): k is string => typeof k === "string"));
+}
+
+/** Load `.infraweaver.baseline.json` under `cwd`; null when absent/unreadable/malformed. */
+export function loadBaseline(cwd: string | undefined): Set<string> | null {
+  const root = cwd ?? process.cwd();
+  let raw: string;
+  try {
+    raw = readFileSync(join(root, BASELINE_FILENAME), "utf-8");
+  } catch {
+    return null;
+  }
+  return parseBaseline(raw);
+}
+
+export interface LoadedBaseline {
+  keys: Set<string>;
+  /** ISO date the baseline was taken — the report's "since baseline (…)" label. */
+  created: string | null;
+}
+
+/** Load the baseline WITH its `created` date (the report's delta needs both the
+ *  keys to diff against and the date to label the comparison). Null when
+ *  absent/unreadable/malformed. `loadBaseline` stays the keys-only path the gate uses. */
+export function loadBaselineWithMeta(
+  cwd: string | undefined,
+): LoadedBaseline | null {
+  const root = cwd ?? process.cwd();
+  let raw: string;
+  try {
+    raw = readFileSync(join(root, BASELINE_FILENAME), "utf-8");
+  } catch {
+    return null;
+  }
+  const keys = parseBaseline(raw);
+  if (!keys) return null;
+  let created: string | null = null;
+  try {
+    const doc = JSON.parse(raw) as { created?: unknown };
+    if (typeof doc.created === "string") created = doc.created;
+  } catch {
+    // parseBaseline already accepted the file, so this never throws — guard anyway.
+  }
+  return { keys, created };
+}
+
+export interface BaselineDelta {
+  /** active keys NOT in the baseline — new since the checkpoint. */
+  added: number;
+  /** baseline keys no longer present — cleared since the checkpoint. */
+  fixed: number;
+  /** keys in both — carried, unchanged. */
+  unchanged: number;
+}
+
+/**
+ * The new / fixed / unchanged split of the current ACTIVE concern set against a
+ * baseline checkpoint, keyed line-independently (`concernKeyOf`) so a line shift
+ * never reads as a fix or a regression. Pure — the report's "what changed" line.
+ */
+export function baselineDelta(
+  concerns: Concern[],
+  baselineKeys: Set<string>,
+): BaselineDelta {
+  const current = new Set(concerns.map((c) => concernKeyOf(c)));
+  let added = 0;
+  let unchanged = 0;
+  for (const key of current) {
+    if (baselineKeys.has(key)) unchanged++;
+    else added++;
+  }
+  let fixed = 0;
+  for (const key of baselineKeys) if (!current.has(key)) fixed++;
+  return { added, fixed, unchanged };
+}
+
+function meetsGate(severity: Severity, threshold: Severity): boolean {
+  return SEVERITY_RANK[severity] >= SEVERITY_RANK[threshold];
+}
+
+export interface GateResult {
+  /** active concerns whose key is NOT in the baseline (or all, when no baseline). */
+  newConcerns: Concern[];
+  /** the new concerns at/above the gate severity — these fail the check. */
+  gating: Concern[];
+  /** true = the gate passes (no new finding at/above the gate severity). */
+  pass: boolean;
+  /** whether a baseline was supplied (false ⇒ every active concern is "new"). */
+  hasBaseline: boolean;
+}
+
+/**
+ * Evaluate the gate. `concerns` should already be the ACTIVE set (suppressed
+ * concerns excluded — a suppression keeps a finding out of the gate by design).
+ * With no baseline (`baselineKeys` null) every active concern counts as new, so
+ * the gate behaves as a plain High/Critical gate.
+ */
+export function evaluateGate(
+  concerns: Concern[],
+  baselineKeys: Set<string> | null,
+  threshold: Severity = DEFAULT_GATE_SEVERITY,
+): GateResult {
+  const newConcerns = baselineKeys
+    ? concerns.filter((c) => !baselineKeys.has(concernKeyOf(c)))
+    : [...concerns];
+  const gating = newConcerns.filter((c) => meetsGate(c.severity, threshold));
+  return {
+    newConcerns,
+    gating,
+    pass: gating.length === 0,
+    hasBaseline: baselineKeys !== null,
+  };
+}

package/src/mcp/terraform/concernResult.ts

@@ -0,0 +1,111 @@
+import type { LocalToolContext } from "#app/mcp/localContext";
+import {
+  annotateGroups,
+  groupConcerns,
+  groupConcernsByRule,
+  planBatches,
+} from "#app/mcp/terraform/decisions";
+import { scanSessionOf } from "#app/mcp/terraform/scanSession";
+import { suppressConcerns } from "#app/mcp/terraform/suppressions";
+import { dedupeCrossScanner } from "#app/mcp/terraform/taxonomy";
+import {
+  type Concern,
+  concernKeyOf,
+  dedupe,
+  isTerraformConcern,
+  SEVERITY_RANK,
+  type Severity,
+  sortConcerns,
+} from "#app/mcp/terraform/types";
+
+export interface ConcernResult {
+  /** non-suppressed concerns ≥ threshold, sorted */
+  active: Concern[];
+  /** concerns that matched a suppression rule */
+  suppressed: Concern[];
+  /** active ∪ suppressed (post-suppression annotation) — scan stores this as lastScanConcerns */
+  annotated: Concern[];
+  groups: ReturnType<typeof annotateGroups>;
+  batchPlan: ReturnType<typeof planBatches>;
+  bySeverity: Record<string, number>;
+}
+
+/**
+ * The shared concerns→result pipeline behind `terraform_scan` and `read_findings`:
+ * capture the line-pinned + line-independent baseline (so verify's regression diff
+ * is apples-to-apples), filter to in-scope Terraform concerns ≥ threshold, apply
+ * suppressions, group + annotate autonomy, plan batches, and tally by severity.
+ * Both tools then wrap their own envelope around this. The diff-scope predicate is
+ * `scan`-only (defaults to "everything in scope"); `lastScanConcerns` is written by
+ * `scan` from `annotated`, not here, since `read_findings` does not set it.
+ */
+export function buildConcernResult(
+  ctx: LocalToolContext,
+  rawConcerns: Concern[],
+  opts: {
+    cwd: string;
+    minRank: number;
+    grouping: "file" | "rule";
+    autonomyThreshold: Severity;
+    inScope?: (c: Concern) => boolean;
+    /** How this call affects the session's verify baseline. `replace` (default)
+     *  is for the full-workspace sources (`scan`, `read_findings`). The narrow
+     *  concern sources (`detect_plan_drift`, `ingest_external_findings`) pass
+     *  `merge`: their small set must JOIN an existing scan baseline, not clobber
+     *  it — otherwise a later `terraform_verify_remediation` diffs the full
+     *  re-scan against the narrow set and reports every pre-existing scanner
+     *  concern as a false regression. */
+    baselineMode?: "replace" | "merge";
+  },
+): ConcernResult {
+  const fullBaseline = dedupe(rawConcerns);
+  const session = scanSessionOf(ctx.toolState);
+  const merge = opts.baselineMode === "merge";
+  const union = (prior: string[] | undefined, next: string[]) =>
+    merge ? [...new Set([...(prior ?? []), ...next])] : next;
+  session.baselineConcernIds = union(
+    session.baselineConcernIds,
+    fullBaseline.map((c) => c.id),
+  );
+  session.baselineConcernKeys = union(
+    session.baselineConcernKeys,
+    fullBaseline.map((c) => concernKeyOf(c)),
+  );
+  // the files already unformatted at this (pre-fix) scan. terraform_validate
+  // subtracts these so PRE-EXISTING `terraform fmt` drift can't force a
+  // whole-file reformat into a scoped fix. Captured from the raw set (fmt
+  // concerns survive the threshold/scope filters that shape `active`).
+  session.baselineFmtDriftFiles = union(
+    session.baselineFmtDriftFiles,
+    fullBaseline.filter((c) => c.source === "terraform-fmt").map((c) => c.location.file),
+  );
+
+  const inScope = opts.inScope ?? (() => true);
+  const annotated = suppressConcerns(
+    sortConcerns(dedupe(rawConcerns))
+      .filter(isTerraformConcern)
+      .filter(inScope)
+      .filter((c) => SEVERITY_RANK[c.severity] >= opts.minRank),
+    opts.cwd,
+  );
+  // Cross-scanner canonical dedupe (2c) is applied ONLY to the ACTIVE set that
+  // feeds grouping/PRs/coLocated/display — NOT to `annotated` or the baseline. The
+  // ✗→✓ verifier re-scans raw and key-maps requested ids through `lastScanConcerns`
+  // (= annotated) and `baselineConcernKeys`, both of which stay raw, so collapsing a
+  // cross-tool duplicate here can never make the verifier read a merged-away concern
+  // as resolved or as a regression. The user still gets ONE PR per cross-tool dup.
+  const active = dedupeCrossScanner(annotated.filter((c) => !c.suppression));
+  const suppressed = annotated.filter((c) => c.suppression);
+
+  const groups = annotateGroups(
+    opts.grouping === "rule" ? groupConcernsByRule(active) : groupConcerns(active),
+    active,
+    opts.autonomyThreshold,
+  );
+  const batchPlan = planBatches(groups);
+
+  const bySeverity: Record<string, number> = {};
+  for (const c of active) bySeverity[c.severity] = (bySeverity[c.severity] ?? 0) + 1;
+
+  return { active, suppressed, annotated, groups, batchPlan, bySeverity };
+}

package/src/mcp/terraform/cost.ts

@@ -0,0 +1,175 @@
+import { mkdtempSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { type } from "arktype";
+import { resolveBaseRef } from "#app/mcp/terraform/paths";
+import { parseScannerJson } from "#app/mcp/terraform/scannerJson";
+import { type RunResult, run } from "#app/mcp/terraform/subprocess";
+
+// --- infracost (cost lens) ------------------------------------------------
+
+export interface CostBreakdown {
+  /** total estimated monthly cost, or null when no resources are priced. */
+  totalMonthlyCost: number | null;
+  currency: string;
+}
+
+/**
+ * Parse `infracost breakdown --format json`. The top-level `totalMonthlyCost`
+ * is a decimal string (absent / null when a project has no priced resources);
+ * `currency` defaults to USD. A missing/unparseable cost becomes null so the
+ * caller reports "unpriced" rather than a misleading $0.00.
+ */
+export function parseInfracostBreakdown(stdout: string): CostBreakdown {
+  const parsed = parseScannerJson(InfracostBreakdownOutput, stdout, "infracost");
+  const raw = parsed.totalMonthlyCost;
+  const num = typeof raw === "number" ? raw : raw != null ? Number.parseFloat(raw) : Number.NaN;
+  return {
+    totalMonthlyCost: Number.isFinite(num) ? num : null,
+    currency: parsed.currency || "USD",
+  };
+}
+
+const InfracostBreakdownOutput = type({
+  "totalMonthlyCost?": "string | number | null",
+  "currency?": "string",
+});
+
+export interface ResourceCost {
+  name: string;
+  monthlyCost: number;
+}
+
+/**
+ * Parse the per-resource monthly costs from `infracost breakdown --format json`
+ * (`projects[].breakdown.resources[]`), so a cost increase can be attributed to
+ * the specific resources that drove it instead of just a total. Skips unpriced
+ * (null/zero) resources; returns them sorted most-expensive first. Pure.
+ */
+export function parseInfracostResources(stdout: string): ResourceCost[] {
+  let parsed: typeof InfracostResourcesOutput.infer;
+  try {
+    parsed = parseScannerJson(InfracostResourcesOutput, stdout, "infracost");
+  } catch {
+    return [];
+  }
+  const out: ResourceCost[] = [];
+  for (const project of parsed.projects ?? []) {
+    for (const r of project.breakdown?.resources ?? []) {
+      const raw = r.monthlyCost;
+      const cost =
+        typeof raw === "number" ? raw : raw != null ? Number.parseFloat(raw) : Number.NaN;
+      if (Number.isFinite(cost) && cost > 0 && r.name) {
+        out.push({ name: r.name, monthlyCost: Math.round(cost * 100) / 100 });
+      }
+    }
+  }
+  return out.sort((a, b) => b.monthlyCost - a.monthlyCost);
+}
+
+const InfracostResourcesOutput = type({
+  "projects?": type({
+    "breakdown?": {
+      "resources?": type({
+        "name?": "string",
+        "monthlyCost?": "string | number | null",
+      }).array(),
+    },
+  }).array(),
+});
+
+export interface CostDelta {
+  currency: string;
+  baselineMonthly: number | null;
+  currentMonthly: number | null;
+  /** current − baseline, rounded to cents; null when either side is unknown. */
+  deltaMonthly: number | null;
+  direction: "increase" | "decrease" | "no-change" | "unknown";
+}
+
+/** Pure cost-delta computation: current (post-fix) vs the base-branch baseline. */
+export function computeCostDelta(
+  baseline: CostBreakdown | null,
+  current: CostBreakdown,
+): CostDelta {
+  const currency = current.currency || baseline?.currency || "USD";
+  const baselineMonthly = baseline?.totalMonthlyCost ?? null;
+  const currentMonthly = current.totalMonthlyCost;
+  if (baselineMonthly === null || currentMonthly === null) {
+    return { currency, baselineMonthly, currentMonthly, deltaMonthly: null, direction: "unknown" };
+  }
+  const deltaMonthly = Math.round((currentMonthly - baselineMonthly) * 100) / 100;
+  const direction = deltaMonthly > 0 ? "increase" : deltaMonthly < 0 ? "decrease" : "no-change";
+  return { currency, baselineMonthly, currentMonthly, deltaMonthly, direction };
+}
+
+export interface CostEscalation {
+  /** true when the monthly increase meets/exceeds the operator's threshold. */
+  escalate: boolean;
+  reason?: string;
+}
+
+/**
+ * decide whether a cost increase is large enough to escalate the PR
+ * to human review (`needs-human`). Compares the monthly delta against the
+ * operator's `cost_increase_block_usd` threshold. No threshold set, an unknown
+ * delta, or a decrease/no-change ⇒ no escalation. Pure + deterministic so the
+ * decision is auditable, not a model judgement.
+ */
+export function classifyCostEscalation(
+  deltaMonthly: number | null,
+  thresholdUsd: number | undefined,
+): CostEscalation {
+  if (thresholdUsd === undefined || deltaMonthly === null || deltaMonthly <= 0) {
+    return { escalate: false };
+  }
+  if (deltaMonthly >= thresholdUsd) {
+    return {
+      escalate: true,
+      reason: `the fix raises monthly cost by ${deltaMonthly}, at or above the ${thresholdUsd} escalation threshold`,
+    };
+  }
+  return { escalate: false };
+}
+
+export function runInfracostBreakdown(scanCwd: string, key: string): RunResult {
+  return run("infracost", ["breakdown", "--path", ".", "--format", "json", "--no-color"], scanCwd, {
+    INFRACOST_API_KEY: key,
+  });
+}
+
+/**
+ * Cost of the base-branch version of the same Terraform, computed in a detached
+ * git worktree so the current (fixed) checkout is never disturbed. Best-effort:
+ * any failure (no base ref, worktree add fails, infracost errors) returns null
+ * and the caller falls back to reporting current cost only.
+ */
+export function infracostBaseline(cwd: string, key: string, tmpdir: string): CostBreakdown | null {
+  const baseRef = resolveBaseRef(cwd);
+  if (!baseRef) return null;
+  const prefixResult = run("git", ["rev-parse", "--show-prefix"], cwd);
+  const prefix = prefixResult.status === 0 ? prefixResult.stdout.trim() : "";
+  // unique, unpredictable worktree path. the old `infracost-base-<pid>` name was
+  // predictable (a local actor could pre-create/symlink it) and collided when
+  // two baselines ran in the same process. mkdtemp gives a fresh PARENT dir;
+  // the worktree itself goes in a not-yet-existing child (git worktree add
+  // refuses a path that already exists). the finally removes both the git
+  // worktree registration and the parent dir.
+  const baseDir = mkdtempSync(join(tmpdir, "infracost-base-"));
+  const worktree = join(baseDir, "wt");
+  const add = run("git", ["worktree", "add", "--detach", worktree, baseRef], cwd);
+  if (add.status !== 0) {
+    rmSync(baseDir, { recursive: true, force: true });
+    return null;
+  }
+  try {
+    const scanCwd = prefix ? join(worktree, prefix) : worktree;
+    const r = runInfracostBreakdown(scanCwd, key);
+    if (r.missing || r.status !== 0) return null;
+    return parseInfracostBreakdown(r.stdout);
+  } catch {
+    return null;
+  } finally {
+    run("git", ["worktree", "remove", "--force", worktree], cwd);
+    rmSync(baseDir, { recursive: true, force: true });
+  }
+}