infraweaver 0.1.0

package/src/mcp/terraform/packs/cloudflare-4-5.ts

@@ -0,0 +1,114 @@
+import type { TransformEntry, TransformPack } from "#app/mcp/terraform/transformPacks";
+
+/**
+ * cloudflare 4.x → 5.0.
+ *
+ * This pack is deliberately THIN, and the reason is the interesting part:
+ * Cloudflare ships its own migration tool. `tf-migrate` rewrites the HCL,
+ * generates the `moved {}` blocks and updates cross-file references, and the
+ * provider carries state upgraders from v5.19 onward. Re-implementing forty
+ * resource renames here would produce a worse version of something the vendor
+ * maintains — the same "integrate upward, don't compete" call the product makes
+ * everywhere else.
+ *
+ * So what this pack contributes is the thing `tf-migrate` deliberately does not:
+ * a verdict on whether the change is safe to ship unattended. It names the
+ * renames whose state moves automatically (fine) and, separately, the handful
+ * the vendor's own guide marks **Manual** — those have no `MoveState` handler,
+ * so they need `terraform state rm` + `terraform import` and must never be
+ * applied by an agent on its own.
+ */
+
+const SOURCE =
+  "https://github.com/cloudflare/terraform-provider-cloudflare/blob/main/docs/guides/version-5-migration.md";
+
+/** Renames the provider can carry across automatically (`moved {}` blocks, or a
+ *  built-in `MoveState` handler on v5.19+). State survives; no replacement. */
+const AUTO_RENAMES: [from: string, to: string][] = [
+  ["cloudflare_record", "cloudflare_dns_record"],
+  ["cloudflare_tunnel", "cloudflare_zero_trust_tunnel_cloudflared"],
+  ["cloudflare_access_application", "cloudflare_zero_trust_access_application"],
+  ["cloudflare_teams_rule", "cloudflare_zero_trust_gateway_policy"],
+];
+
+/** Renames where the resource also SPLIT, so a `moved {}` block carries only
+ *  part of what the v4 resource managed. The remainder has to be created fresh,
+ *  and saying only "renamed" would leave it silently unmanaged. */
+const SPLIT_RENAMES: [from: string, to: string, alsoNeeded: string, what: string][] = [
+  [
+    "cloudflare_argo",
+    "cloudflare_argo_smart_routing",
+    "cloudflare_argo_tiered_caching",
+    "tiered caching",
+  ],
+];
+
+/** Marked **Manual** in Cloudflare's rename table: no automatic state move.
+ *  Applying the config edit alone destroys and recreates the resource. */
+const MANUAL_RENAMES: [from: string, to: string][] = [
+  ["cloudflare_access_custom_page", "cloudflare_zero_trust_access_custom_page"],
+  ["cloudflare_access_keys_configuration", "cloudflare_zero_trust_access_key_configuration"],
+  ["cloudflare_device_policy_certificates", "cloudflare_zero_trust_device_certificates"],
+  ["cloudflare_gre_tunnel", "cloudflare_magic_wan_gre_tunnel"],
+];
+
+const ENTRIES: TransformEntry[] = [
+  {
+    id: "cloudflare.4-5.use-tf-migrate",
+    kind: "provider_setting",
+    resource_type: null,
+    from: "manual v4 → v5 rewrite",
+    to: "tf-migrate",
+    state_move: "auto",
+    forces_replacement: false,
+    note: "Cloudflare maintains `tf-migrate` (github.com/cloudflare/tf-migrate) for this upgrade: it rewrites resource types, transforms attributes, generates `moved {}` blocks and fixes cross-file references. Run it first and review its diff — do not hand-migrate what it already handles. Terraform 1.8+ is needed for `moved {}`, and provider v5.19+ ships the automatic state upgraders.",
+  },
+  ...AUTO_RENAMES.map(
+    ([from, to]): TransformEntry => ({
+      id: `cloudflare.4-5.resource.${from}`,
+      kind: "resource_renamed",
+      resource_type: from,
+      from,
+      to,
+      state_move: "moved_block",
+      forces_replacement: false,
+      note: `Renamed in v5: \`${from}\` → \`${to}\`. Author a \`moved {}\` block (or let \`tf-migrate\` generate it) so state follows the rename instead of the resource being destroyed and recreated.`,
+    }),
+  ),
+  ...SPLIT_RENAMES.map(
+    ([from, to, alsoNeeded, what]): TransformEntry => ({
+      id: `cloudflare.4-5.resource.${from}`,
+      kind: "resource_renamed",
+      resource_type: from,
+      from,
+      to,
+      state_move: "moved_block",
+      forces_replacement: false,
+      value_change: `⚠️ v4's \`${from}\` managed TWO things; v5 splits them. \`${to}\` inherits the state via \`moved {}\`, but ${what} does NOT come with it — it needs a fresh \`${alsoNeeded}\` resource. Rename alone and ${what} silently stops being managed by Terraform, with no plan diff to warn you.`,
+      note: `Renamed AND split in v5: \`${from}\` → \`${to}\` + \`${alsoNeeded}\`. Author the \`moved {}\` block for the first and create the second.`,
+    }),
+  ),
+  ...MANUAL_RENAMES.map(
+    ([from, to]): TransformEntry => ({
+      id: `cloudflare.4-5.resource.${from}`,
+      kind: "resource_renamed",
+      resource_type: from,
+      from,
+      to,
+      state_move: "manual_import",
+      forces_replacement: true,
+      note: `\`${from}\` → \`${to}\` is marked **Manual** in Cloudflare's own rename table: there is no automatic state move, so a \`moved {}\` block will not help. This needs \`terraform state rm\` + \`terraform import\` performed by a human.`,
+    }),
+  ),
+];
+
+export const CLOUDFLARE_4_TO_5: TransformPack = {
+  provider: "cloudflare",
+  from_major: 4,
+  to_major: 5,
+  version: "2026.07",
+  source: SOURCE,
+  exhaustive: false,
+  official_tool: "tf-migrate — https://github.com/cloudflare/tf-migrate",
+  entries: ENTRIES,
+};

package/src/mcp/terraform/paths.ts

@@ -0,0 +1,59 @@
+import { join } from "node:path";
+import { discoverTerraformRoots } from "#app/mcp/roots";
+import { run } from "#app/mcp/terraform/subprocess";
+
+/**
+ * Normalize a scanner-reported path to a repo-relative POSIX path. Each scanner
+ * reports the file differently — tflint gives `main.tf` (relative), trivy a
+ * scan-dir-relative `Target`, terraform an absolute path (`/repo/main.tf` or
+ * `D:\repo\main.tf`), checkov a leading-slash path (`/main.tf`). Left
+ * unnormalized, these leak into `location.file` AND the
+ * content-derived `concernId`, making the id (and the `remediate/<id>` branch)
+ * machine-dependent and breaking the ✗→✓ re-scan id match across environments.
+ * So normalize BEFORE building any Concern.
+ */
+export function toRepoRelative(raw: string | undefined, cwd: string): string {
+  if (!raw) return "(unknown)";
+  const posix = raw.replace(/\\/g, "/");
+  const cwdPosix = cwd.replace(/\\/g, "/").replace(/\/+$/, "");
+  let rel = posix;
+  if (cwdPosix && posix.toLowerCase().startsWith(`${cwdPosix.toLowerCase()}/`)) {
+    rel = posix.slice(cwdPosix.length + 1);
+  }
+  // strip any leading "./" or "/" (checkov reports paths relative to its -d root
+  // with a leading separator).
+  rel = rel.replace(/^(?:\.\/|\/)+/, "");
+  return rel || "(unknown)";
+}
+
+export interface ResolvedRoot {
+  /** absolute dir the per-root command (init/plan/validate) runs in. */
+  absDir: string;
+  /** that root's path relative to the scan `cwd` ("" when the root IS cwd) —
+   * prepended to per-root concern files so they stay cwd-relative. */
+  relDir: string;
+}
+
+/**
+ * The Terraform root modules to operate on under `cwd`. A repo can hold several
+ * roots (hepcare: `terraform/` + `terraform/core/`); `terraform validate` /
+ * `plan` are per-root, so they must run in EACH. Falls back to `cwd` itself as a
+ * single root when none is detected — so a normal single-root repo behaves
+ * exactly as before (no rebasing, one iteration).
+ */
+export function resolveRoots(cwd: string): ResolvedRoot[] {
+  const discovered = discoverTerraformRoots(cwd);
+  if (discovered.length === 0) return [{ absDir: cwd, relDir: "" }];
+  return discovered.map((r) => ({ absDir: r.dir ? join(cwd, r.dir) : cwd, relDir: r.dir }));
+}
+
+/** the repo's base ref for diff-scope, or null when one can't be determined. */
+export function resolveBaseRef(cwd: string): string | null {
+  const head = run("git", ["rev-parse", "--abbrev-ref", "origin/HEAD"], cwd);
+  if (head.status === 0 && head.stdout.trim()) return head.stdout.trim();
+  for (const ref of ["origin/main", "origin/master"]) {
+    const verify = run("git", ["rev-parse", "--verify", "--quiet", ref], cwd);
+    if (verify.status === 0 && verify.stdout.trim()) return ref;
+  }
+  return null;
+}

package/src/mcp/terraform/plan.ts

@@ -0,0 +1,377 @@
+import type { BlastTier } from "#app/mcp/terraform/types";
+
+// --- terraform plan (the safety gate) -------------------------------------
+
+export interface PlanSummary {
+  /** resources to add / change / destroy, from the plan's change_summary. */
+  add: number;
+  change: number;
+  destroy: number;
+  /** every resource with a real action (create/update/delete/replace) — the set
+   * that powers blast-radius and plan-stability. */
+  changed: { address: string; action: string }[];
+  /** resources that would be deleted or replaced — the destructive set. */
+  destructive: { address: string; action: string }[];
+  hasDestroyOrReplace: boolean;
+  /** state-only moves (`moved {}` blocks / refactors): the new address and the
+   * address it came from. Moves don't mutate live infrastructure, so they are
+   * NOT in `changed` — they power the modularization gate (`isPureMovePlan`). */
+  moved: { address: string; previousAddress: string | null }[];
+}
+
+/**
+ * Parse `terraform plan -json` (newline-delimited JSON). `change_summary` gives
+ * the add/change/destroy totals; each `planned_change` with a real action is
+ * collected into `changed`, and the delete/replace subset into `destructive`
+ * (the high-risk set a reviewer must scrutinise). Non-mutating actions are
+ * ignored, as are non-JSON / non-plan lines, so a noisy stream (provider logs,
+ * diagnostics) parses cleanly.
+ *
+ * NB on the action enum: terraform's machine-readable UI (the `-json` stream)
+ * spells no-op as `"noop"` — NOT `"no-op"` — and also emits `"move"` / `"import"`
+ * / `"forget"` for state-only operations that don't mutate live infrastructure.
+ * None of those should count toward `changed` (they'd inflate the blast
+ * radius). We skip them explicitly; `"no-op"` is tolerated too in case a wrapper
+ * or older format hyphenates it. See
+ * https://developer.hashicorp.com/terraform/internals/machine-readable-ui.
+ */
+const NON_MUTATING_PLAN_ACTIONS: ReadonlySet<string> = new Set([
+  "noop",
+  "no-op",
+  "read",
+  "move",
+  "import",
+  "forget",
+]);
+
+export function parseTerraformPlanJson(stdout: string): PlanSummary {
+  let add = 0;
+  let change = 0;
+  let destroy = 0;
+  const changed: { address: string; action: string }[] = [];
+  const destructive: { address: string; action: string }[] = [];
+  const moved: { address: string; previousAddress: string | null }[] = [];
+  for (const line of stdout.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed.startsWith("{")) continue;
+    let msg: {
+      type?: string;
+      changes?: { add?: number; change?: number; remove?: number };
+      change?: {
+        action?: string;
+        resource?: { addr?: string; resource?: string };
+        previous_resource?: { addr?: string; resource?: string };
+      };
+    };
+    try {
+      msg = JSON.parse(trimmed);
+    } catch {
+      continue;
+    }
+    if (msg.type === "change_summary" && msg.changes) {
+      add = Number(msg.changes.add) || 0;
+      change = Number(msg.changes.change) || 0;
+      destroy = Number(msg.changes.remove) || 0;
+    } else if (msg.type === "planned_change" && msg.change) {
+      const action = String(msg.change.action ?? "");
+      // moves are state-only (no infra mutation) but are tracked separately —
+      // they prove a modularization refactor is a no-op (`isPureMovePlan`).
+      if (action === "move") {
+        const address =
+          msg.change.resource?.addr ||
+          msg.change.resource?.resource ||
+          "(unknown)";
+        const previousAddress =
+          msg.change.previous_resource?.addr ||
+          msg.change.previous_resource?.resource ||
+          null;
+        moved.push({ address, previousAddress });
+        continue;
+      }
+      if (!action || NON_MUTATING_PLAN_ACTIONS.has(action)) continue;
+      const address =
+        msg.change.resource?.addr ||
+        msg.change.resource?.resource ||
+        "(unknown)";
+      changed.push({ address, action });
+      // "delete", "replace", and the "*-then-delete" / "delete-then-*" forms.
+      if (action.includes("delete") || action === "replace") {
+        destructive.push({ address, action });
+      }
+    }
+  }
+  return {
+    add,
+    change,
+    destroy,
+    changed,
+    destructive,
+    hasDestroyOrReplace: destructive.length > 0,
+    moved,
+  };
+}
+
+/**
+ * modularization gate — true when the plan is PURELY state moves: at least
+ * one `moved` entry and zero create/update/delete/replace. That proves a
+ * resources→module refactor preserved every resource address (via `moved {}`
+ * blocks) and is a no-op on live infrastructure — the condition under which a
+ * modularization PR may proceed without human escalation.
+ */
+export function isPureMovePlan(plan: {
+  add: number;
+  change: number;
+  destroy: number;
+  changed: { address: string }[];
+  moved: { address: string }[];
+}): boolean {
+  return (
+    plan.moved.length > 0 &&
+    plan.changed.length === 0 &&
+    plan.add + plan.change + plan.destroy === 0
+  );
+}
+
+// --- stateful destroy/replace classification (safety gate) ------------
+
+/**
+ * Resource types that hold data/state — destroying or replacing one of these
+ * means data loss, not just recreation. A remediation that would delete or
+ * replace one is hard-blocked at push time unless the operator opts in via the
+ * `allow_replace` input. Not exhaustive: it covers the common managed
+ * datastores across AWS / Azure / GCP; extend as new ones come up.
+ */
+export const STATEFUL_RESOURCE_TYPES: ReadonlySet<string> = new Set([
+  // AWS
+  "aws_db_instance",
+  "aws_rds_cluster",
+  "aws_rds_cluster_instance",
+  "aws_s3_bucket",
+  "aws_ebs_volume",
+  "aws_efs_file_system",
+  "aws_dynamodb_table",
+  "aws_dynamodb_global_table",
+  "aws_elasticache_cluster",
+  "aws_elasticache_replication_group",
+  "aws_redshift_cluster",
+  "aws_docdb_cluster",
+  "aws_neptune_cluster",
+  "aws_opensearch_domain",
+  "aws_elasticsearch_domain",
+  // Azure
+  "azurerm_sql_database",
+  "azurerm_mssql_database",
+  "azurerm_postgresql_database",
+  "azurerm_postgresql_flexible_server",
+  "azurerm_mysql_database",
+  "azurerm_mysql_flexible_server",
+  "azurerm_cosmosdb_account",
+  "azurerm_cosmosdb_sql_database",
+  // The container is where the documents actually live, and replacing one (a
+  // partition-key change does exactly that) empties it. Added 2026-07-27 after
+  // TC-2.2's azurerm v3→v4 pack surfaced a documented breaking change that
+  // forces this replacement while the guard below could not see it.
+  "azurerm_cosmosdb_sql_container",
+  "azurerm_storage_account",
+  // Data-bearing children of a storage account: the share directory and the
+  // table entity hold content the account itself does not.
+  "azurerm_storage_share_directory",
+  "azurerm_storage_table_entity",
+  "azurerm_managed_disk",
+  // GCP
+  "google_sql_database_instance",
+  "google_storage_bucket",
+  "google_bigtable_instance",
+  "google_bigquery_dataset",
+  "google_spanner_database",
+  "google_redis_instance",
+  "google_filestore_instance",
+  "google_compute_disk",
+]);
+
+/**
+ * Extract the Terraform resource TYPE from a plan address, stripping any
+ * `module.<name>.` prefixes and an instance index/key suffix:
+ *   `module.db.aws_db_instance.main`               -> `aws_db_instance`
+ *   `aws_s3_bucket.data["prod"]`                   -> `aws_s3_bucket`
+ *   `module.a.module.b.google_storage_bucket.x[0]` -> `google_storage_bucket`
+ * Returns "" when the address has no parseable `type.name` pair.
+ */
+export function resourceTypeOf(address: string): string {
+  const withoutModules = address.replace(/^(?:module\.[^.]+\.)+/, "");
+  const cleaned = withoutModules.replace(/\[[^\]]*\]$/, "");
+  const segments = cleaned.split(".");
+  return segments.at(-2) ?? "";
+}
+
+export interface DestroyClassification {
+  /** destroy/replace of a data-bearing type — high-risk, blocked by default. */
+  stateful: { address: string; action: string; type: string }[];
+  /** destroy/replace of a recreatable type — recorded, not blocked. */
+  ephemeral: { address: string; action: string; type: string }[];
+}
+
+/** partition a plan's destructive set into stateful (blocked) vs ephemeral. */
+export function classifyDestructive(
+  destructive: { address: string; action: string }[],
+): DestroyClassification {
+  const stateful: DestroyClassification["stateful"] = [];
+  const ephemeral: DestroyClassification["ephemeral"] = [];
+  for (const d of destructive) {
+    const type = resourceTypeOf(d.address);
+    (STATEFUL_RESOURCE_TYPES.has(type) ? stateful : ephemeral).push({
+      ...d,
+      type,
+    });
+  }
+  return { stateful, ephemeral };
+}
+
+// --- blast-radius scoring -------------------------------------------
+
+export interface BlastRadius {
+  tier: BlastTier;
+  /** count of resources the plan would create/update/delete/replace. */
+  resourceCount: number;
+  /** distinct module addresses touched (root resources count as `root`). */
+  modules: string[];
+}
+
+/**
+ * Extract the module address from a resource address: the `module.X[.module.Y]`
+ * call path, or `root` for a top-level resource. Strips instance index/key from
+ * EVERY segment — a `count`/`for_each` MODULE carries its key on the module
+ * segment (`module.net[0]`), so all instances of one module collapse to one
+ * address (else a single-module fix would look cross-module). Removing keys
+ * first also tolerates a `.` inside a `for_each` string key.
+ *   `aws_s3_bucket.b`                  -> `root`
+ *   `module.db.aws_db_instance.main`   -> `module.db`
+ *   `module.net[0].aws_vpc.main`       -> `module.net`
+ *   `module.a.module.b.google_x.y[0]`  -> `module.a.module.b`
+ */
+export function moduleAddressOf(address: string): string {
+  const cleaned = address.replace(/\[[^\]]*\]/g, "");
+  const segments = cleaned.split(".");
+  // the resource is the final `type.name` pair; anything before is the module path.
+  return segments.length <= 2
+    ? "root"
+    : segments.slice(0, segments.length - 2).join(".");
+}
+
+/**
+ * Score how much a fix touches, to route large changes through stricter review:
+ * 1–2 resources = `low`, 3–10 = `medium`, more than 10 OR spanning more than one
+ * module = `high`. A `high` blast radius should force human-in-the-loop
+ * regardless of finding severity. 0 changes is `low` (nothing to do).
+ */
+export function computeBlastRadius(
+  changed: { address: string }[],
+): BlastRadius {
+  const resourceCount = changed.length;
+  const modules = [
+    ...new Set(changed.map((c) => moduleAddressOf(c.address))),
+  ].sort();
+  const crossModule = modules.length > 1;
+  let tier: BlastTier;
+  if (resourceCount > 10 || crossModule) tier = "high";
+  else if (resourceCount >= 3) tier = "medium";
+  else tier = "low";
+  return { tier, resourceCount, modules };
+}
+
+// --- plan stability / idempotency -----------------------------------
+
+export interface StabilityResult {
+  /** true when a second plan produced the identical change set. */
+  stable: boolean;
+  reason?: string;
+}
+
+/** a normalized signature of a plan's change set (summary counts + sorted
+ * address:action pairs) — two plans with the same signature are equivalent. */
+function planSignature(s: PlanSummary): string {
+  const set = s.changed
+    .map((c) => `${c.address}:${c.action}`)
+    .sort()
+    .join(",");
+  return `+${s.add}~${s.change}-${s.destroy}|${set}`;
+}
+
+/**
+ * Compare two consecutive plans for stability. Infraweaver never `apply`s (it only
+ * opens PRs), so a true "no perpetual diff after apply" cannot be proven here —
+ * but a fix whose plan is non-deterministic (e.g. `timestamp()`, `uuid()`, an
+ * unkeyed `random_*`, or a data source that varies run-to-run) yields a DIFFERENT
+ * plan on the second run, and that is a real perpetual-diff smell we can catch
+ * without applying. Stable ⇒ the two plans matched; unstable ⇒ report it.
+ */
+export function comparePlanStability(
+  first: PlanSummary,
+  second: PlanSummary,
+): StabilityResult {
+  if (planSignature(first) === planSignature(second)) return { stable: true };
+  return {
+    stable: false,
+    reason:
+      `the plan is not deterministic — a second \`terraform plan\` (same state, no apply) produced a ` +
+      `different change set (first: +${first.add} ~${first.change} -${first.destroy}; ` +
+      `second: +${second.add} ~${second.change} -${second.destroy}). This is a perpetual-diff smell, ` +
+      `usually a non-deterministic value in the config (timestamp()/uuid()/unkeyed random_*/a varying data source).`,
+  };
+}
+
+// --- multi-root plan aggregation -------------------------------------------
+
+export interface RootPlan {
+  /** display label for the root ("." for the top-level root). */
+  dir: string;
+  summary: PlanSummary;
+  stable: boolean;
+}
+
+export interface AggregatedPlan {
+  add: number;
+  change: number;
+  destroy: number;
+  changed: { address: string; action: string }[];
+  destructive: { address: string; action: string }[];
+  hasDestroyOrReplace: boolean;
+  idempotent: boolean;
+  moved: { address: string; previousAddress: string | null }[];
+}
+
+/**
+ * Aggregate per-root plan results into one view: SUM the add/change/destroy
+ * counts, UNION the changed + destructive sets (so blast-radius and the
+ * destroy-block see every root's effect), and treat the whole run as
+ * non-idempotent if ANY root's plan was unstable. Pure. Single-root input passes
+ * straight through (identical to the pre-multi-root behaviour).
+ */
+export function aggregatePlans(roots: RootPlan[]): AggregatedPlan {
+  let add = 0;
+  let change = 0;
+  let destroy = 0;
+  let idempotent = true;
+  const changed: { address: string; action: string }[] = [];
+  const destructive: { address: string; action: string }[] = [];
+  const moved: { address: string; previousAddress: string | null }[] = [];
+  for (const r of roots) {
+    add += r.summary.add;
+    change += r.summary.change;
+    destroy += r.summary.destroy;
+    changed.push(...r.summary.changed);
+    destructive.push(...r.summary.destructive);
+    moved.push(...r.summary.moved);
+    if (!r.stable) idempotent = false;
+  }
+  return {
+    add,
+    change,
+    destroy,
+    changed,
+    destructive,
+    hasDestroyOrReplace: destructive.length > 0,
+    idempotent,
+    moved,
+  };
+}