infraweaver 0.1.0

package/src/mcp/terraform/noiseProfile.ts

@@ -0,0 +1,183 @@
+/**
+ * G7 — the noise-reduction learning loop.
+ *
+ * WHAT IT LEARNS FROM. Every time an org waives a rule it records a decision: a
+ * `rule`, a human `reason`, and (since the two-person gate) who proposed and who
+ * ratified it. When the SAME rule has been waived independently across several
+ * repos in a fleet, that is no longer a per-repo judgement — it is the org
+ * telling us, in writing and with reasons, that this finding type is noise for
+ * them. This module turns that record into a **surfacing** signal.
+ *
+ * WHAT IT IS NOT. Not suppression, and the distinction is the whole design:
+ *
+ *   - A down-ranked finding is still **reported**, still **gates CI**, still
+ *     appears in the **signed evidence** with an unchanged verdict. Only its
+ *     position in "the top N that matter" moves.
+ *   - The concern's `severity`, `category`, band and assessability are never
+ *     touched. Nothing derived from a scanner's judgement is rewritten.
+ *   - It applies to nothing at `critical` or `high`. A repeatedly-waived
+ *     critical is a governance problem that should get LOUDER, not quieter, and
+ *     an attacker who can get a rule waived across a fleet must not thereby be
+ *     able to bury it.
+ *
+ * A ranking model that could hide a finding would be a liability in an evidence
+ * product; one that can only reorder the low-severity tail is a genuine
+ * ergonomic win with no honesty cost.
+ *
+ * WHY A THRESHOLD. One waiver is a decision, not a pattern — a single repo
+ * silencing a rule says nothing about the fleet. The signal needs
+ * {@link MIN_DISMISSAL_REPOS} *distinct repos*, counted per repo rather than
+ * per policy so that one repo with five overlapping path-scoped waivers cannot
+ * masquerade as five repos agreeing.
+ *
+ * ALWAYS REASON-LOGGED. An adjustment carries the repo count and the actual
+ * human reasons, and the scan output surfaces them next to the finding. A
+ * ranking that quietly demotes things is indistinguishable from a bug; one that
+ * says "ranked lower: 4 repos waived this — 'managed by the platform team'" is
+ * reviewable, and can be argued with.
+ *
+ * Pure. The profile arrives from Cloud over run-context as an untrusted blob
+ * (same shape and trust posture as §5.12's proven-fix library) and is coerced
+ * here before anything reads it.
+ */
+import type { Concern, Severity } from "#app/mcp/terraform/types";
+
+/** Distinct repos that must have waived a rule before it is treated as fleet
+ *  noise rather than one team's decision. */
+export const MIN_DISMISSAL_REPOS = 3;
+
+/** Severities a noise adjustment may never touch. A finding this loud stays
+ *  where it is no matter how often it has been waived — see the module note. */
+const PROTECTED_SEVERITIES: ReadonlySet<Severity> = new Set<Severity>(["critical", "high"]);
+
+/** The largest amount a score may be reduced, and the floor it may not cross.
+ *  Bounded so a down-rank reorders the tail rather than deleting a finding from
+ *  practical view: a heavily-waived medium still outranks an untouched info. */
+export const MAX_NOISE_PENALTY = 1.5;
+export const NOISE_SCORE_FLOOR = 1;
+
+/** How many distinct reasons to carry into the report. Enough to show the
+ *  pattern; not so many that the finding's own text is buried. */
+const MAX_REASONS_SURFACED = 3;
+
+/** One rule's dismissal history across an org's fleet. */
+export interface NoiseEntry {
+  /** the waived rule id, exactly as the org recorded it. */
+  rule: string;
+  /** DISTINCT repos that have waived it — never a raw policy count. */
+  repos: number;
+  /** the human reasons given, deduped, in the order Cloud returned them. */
+  reasons: string[];
+}
+
+/** The org's fleet-wide dismissal record, keyed by rule id. */
+export type NoiseProfile = ReadonlyMap<string, NoiseEntry>;
+
+export const EMPTY_NOISE_PROFILE: NoiseProfile = new Map();
+
+/**
+ * Coerce the untrusted run-context blob into a {@link NoiseProfile}.
+ *
+ * Every field is validated and anything malformed is dropped rather than
+ * defaulted: this data reorders a security report, so a blob that is not
+ * recognisably a dismissal record must produce NO adjustment instead of a
+ * plausible-looking one. Mirrors `fixMemory.coerceLibrary`.
+ */
+export function coerceNoiseProfile(raw: unknown): NoiseProfile {
+  if (!Array.isArray(raw)) return EMPTY_NOISE_PROFILE;
+  const out = new Map<string, NoiseEntry>();
+  for (const item of raw) {
+    if (typeof item !== "object" || item === null) continue;
+    const entry = item as Record<string, unknown>;
+    const rule = typeof entry.rule === "string" ? entry.rule.trim() : "";
+    if (!rule) continue;
+    // `repos` must be a real count. A non-integer, a negative, or a missing
+    // value means we cannot tell how many teams agreed — so we don't guess.
+    const repos = entry.repos;
+    if (typeof repos !== "number" || !Number.isInteger(repos) || repos < 1) continue;
+    const reasons = Array.isArray(entry.reasons)
+      ? [
+          ...new Set(
+            entry.reasons
+              .filter((r): r is string => typeof r === "string")
+              .map((r) => r.trim())
+              .filter(Boolean),
+          ),
+        ]
+      : [];
+    // last write wins on a duplicate rule — Cloud aggregates, so a duplicate is
+    // a serialisation artefact, not two different histories.
+    out.set(rule, { rule, repos, reasons });
+  }
+  return out;
+}
+
+/** A ranking adjustment, with the evidence for it. Never produced silently. */
+export interface NoiseAdjustment {
+  /** how much the risk score was reduced (positive, ≤ {@link MAX_NOISE_PENALTY}). */
+  penalty: number;
+  /** distinct repos in the org that waived this rule. */
+  repos: number;
+  /** the human reasons they gave, truncated to {@link MAX_REASONS_SURFACED}. */
+  reasons: string[];
+}
+
+/**
+ * The penalty for a rule with `repos` distinct dismissals.
+ *
+ * Logarithmic, not linear: the difference between three teams and four is
+ * meaningful, the difference between twenty and thirty is not, and a linear
+ * ramp would let a large fleet drive any rule to the floor. Saturates at
+ * {@link MAX_NOISE_PENALTY}.
+ */
+function penaltyFor(repos: number): number {
+  const over = repos - MIN_DISMISSAL_REPOS + 1;
+  const raw = MAX_NOISE_PENALTY * (Math.log2(over + 1) / Math.log2(9));
+  return Math.min(MAX_NOISE_PENALTY, Math.round(raw * 10) / 10);
+}
+
+/**
+ * The adjustment for one concern, or null when none applies.
+ *
+ * Returns null — rather than a zero penalty — when the rule is unknown, below
+ * the threshold, or protected by severity, so a caller cannot accidentally
+ * report "adjusted by 0" as if a judgement had been made.
+ */
+export function noiseAdjustmentFor(
+  concern: Pick<Concern, "rule_id" | "severity">,
+  profile: NoiseProfile,
+): NoiseAdjustment | null {
+  if (PROTECTED_SEVERITIES.has(concern.severity)) return null;
+  const entry = profile.get(concern.rule_id);
+  if (!entry || entry.repos < MIN_DISMISSAL_REPOS) return null;
+  return {
+    penalty: penaltyFor(entry.repos),
+    repos: entry.repos,
+    reasons: entry.reasons.slice(0, MAX_REASONS_SURFACED),
+  };
+}
+
+/**
+ * Apply an adjustment to a risk score, clamped to {@link NOISE_SCORE_FLOOR}.
+ *
+ * The floor is what keeps this a re-ordering rather than a disappearance: a
+ * finding can be pushed down the list but never to zero, because zero reads as
+ * "nothing here" and something is definitely here.
+ */
+export function applyNoisePenalty(score: number, adjustment: NoiseAdjustment | null): number {
+  if (!adjustment) return score;
+  const adjusted = Math.max(NOISE_SCORE_FLOOR, score - adjustment.penalty);
+  return Math.round(adjusted * 10) / 10;
+}
+
+/** One line explaining an adjustment, for the report. Deliberately states the
+ *  bound as well as the reason — a reader must not infer that we hid anything. */
+export function explainNoiseAdjustment(adjustment: NoiseAdjustment): string {
+  const reasons = adjustment.reasons.length
+    ? ` — ${adjustment.reasons.map((r) => `"${r}"`).join("; ")}`
+    : "";
+  return (
+    `ranked lower: ${adjustment.repos} repos in this org have waived this rule${reasons}. ` +
+    "Still reported and still gating — only its position in the ranking changed."
+  );
+}

package/src/mcp/terraform/normalization.ts

@@ -0,0 +1,265 @@
+/**
+ * Idiomatic-normalisation DETECTION — the Refactor verb's companion to
+ * moduleExtraction.ts. Module extraction lifts raw resources behind a boundary;
+ * this finds the OTHER provably-equivalent refactor: in-place idiomatic cleanup of
+ * legacy HCL that changes STRUCTURE/SYNTAX but not behaviour, so a repo that is
+ * already modular but stylistically dated still has a real refactor to ship.
+ *
+ * Every kind here is a no-op the keys-free equivalence check proves: the resource
+ * set and per-resource argument NAMES are untouched, addresses don't move (zero
+ * `moved {}` needed), and `terraform validate` + `fmt` stay clean. That is the hard
+ * boundary — anything that changes a resource TYPE or the managed-resource set
+ * (e.g. `aws_launch_configuration`→`aws_launch_template`, `aws_elb`→`aws_lb`) is
+ * behaviour-ALTERING modernisation and belongs to Remediate, NOT here; the
+ * equivalence check would reject it as a resource-set diff anyway.
+ *
+ * Pure parsing over files already on disk — no subprocess, no network — mirroring
+ * moduleExtraction.ts.
+ */
+
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { type } from "arktype";
+import type { LocalToolContext } from "#app/mcp/localContext";
+import { walkTfFiles } from "#app/mcp/modules";
+import { execute, tool, toolOk } from "#app/mcp/shared";
+import { log } from "#app/utils/cli";
+
+export type NormalizationKind = "redundant_interpolation" | "legacy_block_assignment";
+
+export interface NormalizationSite {
+  kind: NormalizationKind;
+  /** 1-based line of the offending snippet. */
+  line: number;
+  /** the snippet as written. */
+  before: string;
+  /** the idiomatic, behaviour-identical rewrite (advisory — the agent writes the edit). */
+  after: string;
+}
+
+// --- redundant whole-string interpolation (pure) -----------------------------
+
+/**
+ * Find the index of the closing `}` matching the `{` at `openBrace`, string-aware
+ * (a `}` inside a nested string literal doesn't close it) and nesting-aware.
+ * Mutually recursive with {@link stringLiteralEnd} so `${file("x{}y")}` matches.
+ */
+function interpolationEnd(hcl: string, openBrace: number): number {
+  let depth = 0;
+  for (let i = openBrace; i < hcl.length; i++) {
+    const ch = hcl[i];
+    if (ch === '"') {
+      i = stringLiteralEnd(hcl, i);
+      continue;
+    }
+    if (ch === "{") depth++;
+    else if (ch === "}") {
+      depth--;
+      if (depth === 0) return i;
+    }
+  }
+  return hcl.length - 1;
+}
+
+/**
+ * The index of the closing quote of the string literal opening at `openQuote`,
+ * escape-aware and interpolation-aware (a `"` inside a `${ … }` is part of the
+ * interpolation, not the string's end — `"${coalesce(var.a, "x")}"`).
+ */
+function stringLiteralEnd(hcl: string, openQuote: number): number {
+  for (let i = openQuote + 1; i < hcl.length; i++) {
+    const ch = hcl[i];
+    if (ch === "\\") {
+      i++;
+      continue;
+    }
+    if (ch === '"') return i;
+    if ((ch === "$" || ch === "%") && hcl[i + 1] === "{") {
+      i = interpolationEnd(hcl, i + 1);
+    }
+  }
+  return hcl.length - 1;
+}
+
+/** 1-based line number of `index` in `hcl`. */
+function lineOf(hcl: string, index: number): number {
+  let line = 1;
+  for (let i = 0; i < index && i < hcl.length; i++) if (hcl[i] === "\n") line++;
+  return line;
+}
+
+/**
+ * Find every string literal that is EXACTLY one full-span interpolation
+ * (`"${ expr }"`), where dropping the wrapper to a bare `expr` is a behaviour-
+ * identical HCL2 rewrite (the canonical 0.11→0.12 cleanup). Skips comments and
+ * heredocs, and naturally excludes `"$${literal}"` (an escaped, non-interpolated
+ * `${`) and partial templates like `"${a}-${b}"` (where the quotes are load-bearing).
+ */
+export function findRedundantInterpolations(hcl: string): NormalizationSite[] {
+  const out: NormalizationSite[] = [];
+  for (let i = 0; i < hcl.length; i++) {
+    const ch = hcl[i];
+    // skip line comments
+    if (ch === "#" || (ch === "/" && hcl[i + 1] === "/")) {
+      const nl = hcl.indexOf("\n", i);
+      if (nl === -1) break;
+      i = nl;
+      continue;
+    }
+    // skip block comments
+    if (ch === "/" && hcl[i + 1] === "*") {
+      const close = hcl.indexOf("*/", i + 2);
+      i = close === -1 ? hcl.length : close + 1;
+      continue;
+    }
+    // skip heredocs (their bodies are templates we don't normalise)
+    if (ch === "<" && hcl[i + 1] === "<") {
+      const m = /^<<[-~]?([A-Za-z_][A-Za-z0-9_]*)/.exec(hcl.slice(i, i + 80));
+      if (m) {
+        const openNl = hcl.indexOf("\n", i);
+        if (openNl === -1) break;
+        const cm = new RegExp(`\\n[ \\t]*${m[1]}[ \\t]*(?=\\n|$)`).exec(hcl.slice(openNl));
+        i = cm ? openNl + cm.index + cm[0].length - 1 : hcl.length;
+        continue;
+      }
+    }
+    if (ch !== '"') continue;
+    const end = stringLiteralEnd(hcl, i);
+    // full-span single interpolation: opens `${`, and its matching `}` is the last
+    // inner char (immediately before the closing quote).
+    if (hcl[i + 1] === "$" && hcl[i + 2] === "{") {
+      const close = interpolationEnd(hcl, i + 2);
+      if (close === end - 1) {
+        const expr = hcl.slice(i + 3, close).trim();
+        if (expr) {
+          out.push({
+            kind: "redundant_interpolation",
+            line: lineOf(hcl, i),
+            before: hcl.slice(i, end + 1),
+            after: expr,
+          });
+        }
+      }
+    }
+    i = end;
+  }
+  return out;
+}
+
+// --- legacy HCL0.11 map-argument block syntax (pure) --------------------------
+
+/**
+ * HCL0.11 assigned a map/object argument with a bare block — `config { … }` — where
+ * HCL2 requires `config = { … }`. The argument is the same name and the same data,
+ * so the conversion is behaviour-preserving (and `terraform validate` rejects the
+ * old form on modern Terraform). Limited to the well-known offenders so the
+ * line-level match can't mistake a genuine nested block for a map argument.
+ */
+const LEGACY_BLOCK_ARGS: ReadonlySet<string> = new Set(["config", "vars"]);
+
+export function findLegacyBlockAssignments(hcl: string): NormalizationSite[] {
+  const out: NormalizationSite[] = [];
+  const lines = hcl.split("\n");
+  for (let n = 0; n < lines.length; n++) {
+    const m = /^(\s*)([A-Za-z_][A-Za-z0-9_]*)\s*\{\s*$/.exec(lines[n] ?? "");
+    if (m && LEGACY_BLOCK_ARGS.has(m[2] ?? "")) {
+      out.push({
+        kind: "legacy_block_assignment",
+        line: n + 1,
+        before: `${m[2]} {`,
+        after: `${m[2]} = {`,
+      });
+    }
+  }
+  return out;
+}
+
+/** every normalisation site in one file, in line order. */
+export function scanNormalizations(hcl: string): NormalizationSite[] {
+  return [...findRedundantInterpolations(hcl), ...findLegacyBlockAssignments(hcl)].sort(
+    (a, b) => a.line - b.line,
+  );
+}
+
+// --- workspace scan (I/O composition) ----------------------------------------
+
+export interface NormalizationFile {
+  file: string;
+  count: number;
+  kind_counts: Record<NormalizationKind, number>;
+  /** a capped sample of the actual sites, for the agent to anchor its edits. */
+  sites: NormalizationSite[];
+}
+
+/** files shown in the result, and sites shown per file — caps so a legacy-heavy
+ *  repo reports a digestible summary, not a thousand-line dump. */
+const MAX_FILES = 30;
+const MAX_SITES_PER_FILE = 12;
+
+export function findNormalizationCandidates(cwd: string): NormalizationFile[] {
+  const out: NormalizationFile[] = [];
+  for (const rel of walkTfFiles(cwd)) {
+    let text: string;
+    try {
+      text = readFileSync(join(cwd, rel), "utf8");
+    } catch {
+      continue;
+    }
+    const sites = scanNormalizations(text);
+    if (sites.length === 0) continue;
+    const kindCounts: Record<NormalizationKind, number> = {
+      redundant_interpolation: 0,
+      legacy_block_assignment: 0,
+    };
+    for (const s of sites) kindCounts[s.kind]++;
+    out.push({
+      file: rel.replace(/\\/g, "/"),
+      count: sites.length,
+      kind_counts: kindCounts,
+      sites: sites.slice(0, MAX_SITES_PER_FILE),
+    });
+    if (out.length >= MAX_FILES) break;
+  }
+  return out;
+}
+
+// --- the tool ----------------------------------------------------------------
+
+export const NormalizationCandidatesParams = type({});
+
+export function NormalizationCandidatesTool(ctx: LocalToolContext) {
+  return tool({
+    name: "terraform_normalization_candidates",
+    description:
+      "Find BEHAVIOUR-PRESERVING idiomatic-normalisation opportunities in the Terraform tree — the Refactor " +
+      "companion to module_extraction_candidates for code that is already modular but stylistically dated. " +
+      "Detects (1) redundant whole-string interpolation wrapping — a quoted string that is exactly one " +
+      "interpolation, unwrapped to the bare expression (the canonical HCL 0.11→0.12 cleanup) — and (2) legacy " +
+      "HCL0.11 map-argument block syntax (`config {`/`vars {` → `config = {`). Both " +
+      "leave the managed-resource set and every resource's argument NAMES identical, so they need ZERO " +
+      "`moved {}` blocks and are proven a no-op by terraform_equivalence_check (resource set + args unchanged, " +
+      "validate + fmt clean). This is the path when there are no extraction clusters worth a module but the " +
+      "code is plainly non-idiomatic. HARD BOUNDARY: it never includes behaviour-CHANGING modernisation — a " +
+      "resource-type swap (`aws_launch_configuration`→`aws_launch_template`, `aws_elb`→`aws_lb`) alters the " +
+      "resource set and is Remediate's job, not a refactor. Returns per-file `count`, `kind_counts`, and a " +
+      "capped `sites` sample (each with `line`, `before`, `after`).",
+    parameters: NormalizationCandidatesParams,
+    execute: execute(async () => {
+      const cwd = ctx.payload.cwd ?? process.cwd();
+      const files = findNormalizationCandidates(cwd);
+      const total = files.reduce((n, f) => n + f.count, 0);
+      log.info(
+        `» terraform_normalization_candidates: ${total} site(s) across ${files.length} file(s)`,
+      );
+      return toolOk({
+        file_count: files.length,
+        total,
+        files,
+        note:
+          total === 0
+            ? "no idiomatic-normalisation opportunities found (redundant interpolation / legacy block syntax)"
+            : "apply these in-place edits (they keep the resource set + argument names identical), then PROVE the no-op with terraform_equivalence_check (zero moves expected) — never include a resource-type swap, that ALTERS behaviour and is Remediate's job",
+      });
+    }),
+  });
+}