infraweaver 0.1.0

package/src/mcp/terraform/iacLanguages.ts

@@ -0,0 +1,431 @@
+import { closeSync, openSync, readdirSync, readSync } from "node:fs";
+import { join } from "node:path";
+
+/**
+ * Multi-language IaC support for the READ-ONLY surfaces (Assess / SARIF /
+ * evidence). One honest principle throughout: **breadth never dilutes the moat**
+ * — trivy and checkov already parse these formats, so Assess widens to them, but
+ * Remediate stays Terraform-first (the `✗→✓` proof + equivalence machinery is
+ * Terraform-specific and is never faked for other formats; `terraform_scan` and
+ * the fix loop keep their Terraform-only filter).
+ *
+ * Everything here is verified against the scanners' actual support matrices
+ * (checkov 3.3.x `--framework` values; trivy 0.7x `--misconfig-scanners`), and
+ * the matrix below records per-language coverage HONESTLY — including what is
+ * NOT scannable (Pulumi programs have no credible static scanner: checkov never
+ * shipped one, trivy has none, and `pulumi preview` requires the engine + a
+ * backend). A detected-but-unscannable language is REPORTED as such, never
+ * silently dropped and never given fabricated findings.
+ */
+
+export const IAC_LANGUAGES = [
+  "terraform",
+  "cloudformation",
+  "kubernetes",
+  "helm",
+  "kustomize",
+  "dockerfile",
+  "arm",
+  "bicep",
+  "serverless",
+  "ansible",
+  "pulumi",
+] as const;
+export type IacLanguage = (typeof IAC_LANGUAGES)[number];
+
+export const LANGUAGE_LABEL: Record<IacLanguage, string> = {
+  terraform: "Terraform / OpenTofu",
+  cloudformation: "CloudFormation",
+  kubernetes: "Kubernetes manifests",
+  helm: "Helm charts",
+  kustomize: "Kustomize",
+  dockerfile: "Dockerfile / Containerfile",
+  arm: "Azure ARM templates",
+  bicep: "Azure Bicep",
+  serverless: "Serverless Framework",
+  ansible: "Ansible",
+  pulumi: "Pulumi",
+};
+
+/**
+ * Which of the two multi-format scanners genuinely covers each language, with
+ * the caveat an operator must know. This is the single source of the honesty
+ * notes the scorecard prints — a language whose only covering scanner didn't
+ * run is a COVERAGE GAP, not a pass, and a language neither covers is reported
+ * `unsupported`, never scanned-and-silent.
+ */
+export const LANGUAGE_COVERAGE: Record<
+  IacLanguage,
+  { trivy: boolean; checkov: boolean; note?: string }
+> = {
+  terraform: {
+    trivy: true,
+    checkov: true,
+    note: "OpenTofu: `.tf` repos are fully covered; `.tofu` files are scanned by trivy only (checkov does not read them yet)",
+  },
+  cloudformation: { trivy: true, checkov: true },
+  kubernetes: { trivy: true, checkov: true },
+  helm: {
+    trivy: true,
+    checkov: true,
+    note: "trivy renders charts built-in; checkov's helm framework needs the `helm` binary on the runner (skipped without it)",
+  },
+  kustomize: {
+    trivy: false,
+    checkov: true,
+    note: "checkov only, and it needs the `kustomize` binary on the runner",
+  },
+  dockerfile: { trivy: true, checkov: true },
+  arm: { trivy: true, checkov: true },
+  bicep: {
+    trivy: false,
+    checkov: true,
+    note: "checkov scans .bicep natively; trivy needs `az bicep build` to ARM JSON first",
+  },
+  serverless: { trivy: false, checkov: true },
+  ansible: {
+    trivy: false,
+    checkov: true,
+    note: "checkov's ansible framework; trivy's ansible scanner is experimental (AWS S3 modules only) and not relied on",
+  },
+  pulumi: {
+    trivy: false,
+    checkov: false,
+    note: "no static scanner can parse Pulumi programs (TypeScript/Python/Go); `pulumi preview` needs the Pulumi engine + backend credentials",
+  },
+};
+
+/** The checkov `--framework` values a language enables. `terraform_json` rides
+ *  with terraform so CDKTF synth output (`cdk.tf.json`) is covered. */
+const CHECKOV_FRAMEWORKS: Record<IacLanguage, string[]> = {
+  terraform: ["terraform", "terraform_json"],
+  cloudformation: ["cloudformation"],
+  kubernetes: ["kubernetes"],
+  helm: ["helm"],
+  kustomize: ["kustomize"],
+  dockerfile: ["dockerfile"],
+  arm: ["arm"],
+  bicep: ["bicep"],
+  serverless: ["serverless"],
+  ansible: ["ansible"],
+  pulumi: [],
+};
+
+/** The checkov `--framework` list for a scanned-language set (sorted, deduped).
+ *  Always includes terraform so the scanner invocation can never regress the
+ *  core product even on an empty/odd scope. Pure. */
+export function checkovFrameworksFor(scanned: readonly IacLanguage[]): string[] {
+  const out = new Set<string>(CHECKOV_FRAMEWORKS.terraform);
+  for (const lang of scanned) {
+    for (const fw of CHECKOV_FRAMEWORKS[lang] ?? []) out.add(fw);
+  }
+  return [...out].sort();
+}
+
+// trivy `Results[].Type` → language. Plan-JSON results count as terraform (they
+// describe Terraform resources); yaml/json custom-check types are unmapped (off
+// by default in trivy, and we don't enable them).
+const TRIVY_TYPE_TO_LANGUAGE: Record<string, IacLanguage> = {
+  terraform: "terraform",
+  terraformplan: "terraform",
+  "terraformplan-json": "terraform",
+  "terraformplan-snapshot": "terraform",
+  cloudformation: "cloudformation",
+  kubernetes: "kubernetes",
+  helm: "helm",
+  dockerfile: "dockerfile",
+  "azure-arm": "arm",
+  ansible: "ansible",
+};
+
+/** Map a trivy result `Type` to a language; null for types we don't model. Pure. */
+export function trivyTypeToLanguage(type: string | undefined): IacLanguage | null {
+  return type ? (TRIVY_TYPE_TO_LANGUAGE[type.toLowerCase()] ?? null) : null;
+}
+
+// checkov `check_type` → language (one JSON block per framework that ran).
+const CHECKOV_TYPE_TO_LANGUAGE: Record<string, IacLanguage> = {
+  terraform: "terraform",
+  terraform_json: "terraform",
+  terraform_plan: "terraform",
+  cloudformation: "cloudformation",
+  kubernetes: "kubernetes",
+  helm: "helm",
+  kustomize: "kustomize",
+  dockerfile: "dockerfile",
+  arm: "arm",
+  bicep: "bicep",
+  serverless: "serverless",
+  ansible: "ansible",
+};
+
+/** Map a checkov block `check_type` to a language; null for types we don't model. Pure. */
+export function checkovTypeToLanguage(checkType: string | undefined): IacLanguage | null {
+  return checkType ? (CHECKOV_TYPE_TO_LANGUAGE[checkType.toLowerCase()] ?? null) : null;
+}
+
+const YAML_EXT = /\.ya?ml$/i;
+
+/**
+ * Classify a file by path alone (no content). Returns the language, or
+ * "needs-content" for yaml/json whose kind is only knowable by sniffing, or null
+ * for a file that is no IaC we model. Pure.
+ */
+export function classifyByPath(path: string): IacLanguage | "needs-content" | null {
+  const norm = path.replace(/\\/g, "/");
+  const base = (norm.split("/").pop() ?? "").toLowerCase();
+
+  if (base.endsWith(".tf") || base.endsWith(".tfvars") || base.endsWith(".tf.json"))
+    return "terraform";
+  if (base.endsWith(".tofu") || base.endsWith(".tofu.json")) return "terraform";
+  if (base === "dockerfile" || base === "containerfile" || base.endsWith(".dockerfile"))
+    return "dockerfile";
+  if (base.startsWith("dockerfile.") || base.startsWith("containerfile.")) return "dockerfile";
+  if (base.endsWith(".bicep")) return "bicep";
+  if (base === "chart.yaml" || base === "chart.yml") return "helm";
+  if (base === "kustomization.yaml" || base === "kustomization.yml") return "kustomize";
+  if (base === "serverless.yml" || base === "serverless.yaml") return "serverless";
+  if (base === "pulumi.yaml" || base === "pulumi.yml" || /^pulumi\..+\.ya?ml$/.test(base))
+    return "pulumi";
+  // CDK synth output — CloudFormation JSON regardless of directory.
+  if (base.endsWith(".template.json")) return "cloudformation";
+  if (YAML_EXT.test(base) || base.endsWith(".json")) return "needs-content";
+  return null;
+}
+
+/**
+ * Classify a yaml/json file by its content (first few KB). Conservative: only
+ * unmistakable markers classify; anything ambiguous returns null (better to
+ * under-detect than to claim coverage of a file no scanner will read). Pure.
+ */
+export function classifyByContent(path: string, content: string): IacLanguage | null {
+  const head = content.slice(0, 4096);
+  if (/\.json$/i.test(path)) {
+    // ARM: the $schema pins it; CloudFormation JSON: template-version or typed Resources.
+    if (/"\$schema"\s*:\s*"[^"]*deploymentTemplate\.json/i.test(head)) return "arm";
+    if (/"AWSTemplateFormatVersion"/.test(head)) return "cloudformation";
+    if (/"Resources"\s*:/.test(head) && /"Type"\s*:\s*"(AWS|Alexa|Custom)::/.test(head))
+      return "cloudformation";
+    return null;
+  }
+  // yaml
+  if (/^AWSTemplateFormatVersion/m.test(head)) return "cloudformation";
+  if (/^Resources:/m.test(head) && /^\s+Type:\s*['"]?(AWS|Alexa|Custom)::/m.test(head))
+    return "cloudformation";
+  // A Go-templated file (`{{ … }}`) is a Helm chart template, NOT a raw Kubernetes
+  // manifest — even though it carries apiVersion/kind. Classifying it as kubernetes
+  // would double-count a Helm chart AND point checkov's k8s parser at un-rendered
+  // templates. Helm charts are detected by their `Chart.yaml` (classifyByPath); the
+  // helm framework renders the templates itself, so skip template files here.
+  if (head.includes("{{")) return null;
+  if (/^apiVersion:/m.test(head) && /^kind:/m.test(head)) return "kubernetes";
+  // Ansible playbook: a top-level play list with hosts + tasks/roles.
+  if (/^-\s+(name|hosts):/m.test(head) && /^\s+(hosts|tasks|roles):/m.test(head)) return "ansible";
+  return null;
+}
+
+/**
+ * The language a concern belongs to, for scope filtering: the scanner-reported
+ * language when present, else a path-only classification (fmt/validate/tflint
+ * only ever fire on Terraform), else terraform (the historical default — a
+ * reviewer-loaded concern with an unknowable file stays in the core scope
+ * rather than vanishing). Pure.
+ */
+export function languageOfConcern(c: {
+  language?: IacLanguage | undefined;
+  location: { file: string };
+}): IacLanguage {
+  if (c.language) return c.language;
+  const byPath = classifyByPath(c.location.file);
+  return byPath === null || byPath === "needs-content" ? "terraform" : byPath;
+}
+
+// mirror walkTfFiles' bounds so a huge monorepo can't stall detection.
+const SKIP_DIRS = new Set([
+  ".git",
+  ".terraform",
+  ".terragrunt-cache",
+  ".venv",
+  "venv",
+  "node_modules",
+  ".idea",
+  ".vscode",
+]);
+const MAX_DEPTH = 8;
+const FILE_CAP = 4000;
+// only this much of a yaml/json file is read for classification.
+const SNIFF_BYTES = 4096;
+
+/** the first SNIFF_BYTES of a file, without reading the rest (a giant yaml/json
+ *  must not stall detection); "" when unreadable. */
+function sniffHead(absPath: string): string {
+  try {
+    const fd = openSync(absPath, "r");
+    try {
+      const buf = Buffer.alloc(SNIFF_BYTES);
+      const n = readSync(fd, buf, 0, SNIFF_BYTES, 0);
+      return buf.toString("utf8", 0, n);
+    } finally {
+      closeSync(fd);
+    }
+  } catch {
+    return "";
+  }
+}
+
+export interface DetectedLanguages {
+  /** every language present in the tree, most files first. */
+  detected: IacLanguage[];
+  /** file count per detected language (the scorecard's breadth line). */
+  fileCounts: Partial<Record<IacLanguage, number>>;
+}
+
+/**
+ * Walk the workspace and detect which IaC languages are present. Bounded (depth
+ * + file cap + skip dirs) and read-only; yaml/json files are sniffed from their
+ * first bytes only. Terraform is detected by extension; everything else by
+ * basename or unmistakable content markers. Pure-ish (read-only I/O).
+ */
+export function detectIacLanguages(cwd: string): DetectedLanguages {
+  const counts = new Map<IacLanguage, number>();
+  let seen = 0;
+  const visit = (dir: string, rel: string, depth: number): void => {
+    if (depth > MAX_DEPTH || seen >= FILE_CAP) return;
+    let entries: import("node:fs").Dirent[];
+    try {
+      entries = readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const e of entries) {
+      if (seen >= FILE_CAP) return;
+      if (e.isDirectory()) {
+        if (SKIP_DIRS.has(e.name)) continue;
+        visit(join(dir, e.name), rel ? `${rel}/${e.name}` : e.name, depth + 1);
+        continue;
+      }
+      if (!e.isFile()) continue;
+      seen++;
+      const relPath = rel ? `${rel}/${e.name}` : e.name;
+      let lang = classifyByPath(relPath);
+      if (lang === "needs-content") {
+        lang = classifyByContent(relPath, sniffHead(join(dir, e.name)));
+      }
+      if (lang) counts.set(lang, (counts.get(lang) ?? 0) + 1);
+    }
+  };
+  visit(cwd, "", 0);
+  const detected = [...counts.entries()]
+    .sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]))
+    .map(([lang]) => lang);
+  const fileCounts: Partial<Record<IacLanguage, number>> = {};
+  for (const [lang, n] of counts) fileCounts[lang] = n;
+  return { detected, fileCounts };
+}
+
+export interface LanguageScope {
+  /** the languages this run's read-only surfaces report on (scope ∩ scannable). */
+  scanned: IacLanguage[];
+  /** every language detected in the tree (superset of scanned + unsupported). */
+  detected: IacLanguage[];
+  fileCounts: Partial<Record<IacLanguage, number>>;
+  /** detected languages NO installed scanner can statically assess — surfaced,
+   * never silently dropped (e.g. pulumi). */
+  unsupported: { language: IacLanguage; reason: string }[];
+  /** iac_languages tokens that matched no known language (operator typo). */
+  unknown_tokens: string[];
+}
+
+/** membership test for the scope filter (terraform is always in scope). */
+export function inLanguageScope(scope: Pick<LanguageScope, "scanned">) {
+  const set = new Set<IacLanguage>(scope.scanned);
+  return (c: { language?: IacLanguage | undefined; location: { file: string } }): boolean =>
+    set.has(languageOfConcern(c));
+}
+
+/**
+ * Resolve the operator's `iac_languages` setting against what the tree actually
+ * contains. `auto` (the default) scans every detected language a scanner can
+ * read; `terraform` restores the historical Terraform-only behaviour; a comma
+ * list pins an explicit set (terraform is always included — the core product is
+ * never configured away). Detected-but-unscannable languages land in
+ * `unsupported` with the honest reason. Pure given the detection result.
+ */
+export function resolveLanguageScope(
+  raw: string | undefined,
+  detection: DetectedLanguages,
+): LanguageScope {
+  const tokens = (raw ?? "auto")
+    .split(",")
+    .map((t) => t.trim().toLowerCase())
+    .filter(Boolean);
+  const auto = tokens.length === 0 || tokens.includes("auto");
+  const known = new Set<IacLanguage>(IAC_LANGUAGES);
+  const unknown_tokens = tokens.filter((t) => t !== "auto" && !known.has(t as IacLanguage));
+
+  const scannable = (lang: IacLanguage): boolean =>
+    LANGUAGE_COVERAGE[lang].trivy || LANGUAGE_COVERAGE[lang].checkov;
+
+  const wanted = new Set<IacLanguage>(["terraform"]);
+  if (auto) {
+    for (const lang of detection.detected) wanted.add(lang);
+  } else {
+    for (const t of tokens) {
+      if (known.has(t as IacLanguage)) wanted.add(t as IacLanguage);
+    }
+  }
+
+  const unsupported = [...wanted]
+    .filter((lang) => !scannable(lang))
+    .map((lang) => ({
+      language: lang,
+      reason: LANGUAGE_COVERAGE[lang].note ?? "no static scanner covers this language",
+    }));
+
+  const scanned = IAC_LANGUAGES.filter((lang) => wanted.has(lang) && scannable(lang));
+  return {
+    scanned,
+    detected: detection.detected,
+    fileCounts: detection.fileCounts,
+    unsupported,
+    unknown_tokens,
+  };
+}
+
+/**
+ * Enforce the matrix's own honesty rule AGAINST the run's actual scanner
+ * outcomes: a language whose every covering scanner was skipped/disabled this
+ * run (e.g. `tools_enabled: "-checkov"` on a Bicep repo — Bicep is checkov-only)
+ * moves from `scanned` to `unsupported` with the reason, instead of being
+ * reported as scanned-clean-with-zero-findings. Terraform always stays: the
+ * native toolchain (fmt/validate/tflint) covers it regardless of trivy/checkov.
+ */
+export function applyScannerAvailability(
+  scope: LanguageScope,
+  ran: { trivy: boolean; checkov: boolean },
+): LanguageScope {
+  const uncovered = (lang: IacLanguage): boolean => {
+    if (lang === "terraform") return false;
+    const cov = LANGUAGE_COVERAGE[lang];
+    return !((cov.trivy && ran.trivy) || (cov.checkov && ran.checkov));
+  };
+  const dropped = scope.scanned.filter(uncovered);
+  if (dropped.length === 0) return scope;
+  return {
+    ...scope,
+    scanned: scope.scanned.filter((lang) => !uncovered(lang)),
+    unsupported: [
+      ...scope.unsupported,
+      ...dropped.map((lang) => {
+        const cov = LANGUAGE_COVERAGE[lang];
+        const covering = [cov.trivy ? "trivy" : null, cov.checkov ? "checkov" : null]
+          .filter(Boolean)
+          .join(" / ");
+        return {
+          language: lang,
+          reason: `its covering scanner${covering.includes("/") ? "s" : ""} (${covering}) did not run this time — coverage gap, not a pass`,
+        };
+      }),
+    ],
+  };
+}