infraweaver 0.1.0

package/src/mcp/terraform/scannerCache.ts

@@ -0,0 +1,86 @@
+/**
+ * Per-process cache for the read-only `terraform_scan` tool (the deferred 3.5
+ * "tool-result caching", scoped safely).
+ *
+ * The cache key is a CONTENT hash of the Terraform tree plus the active toolchain,
+ * which makes it self-invalidating: any file edit — a remediation fix above all —
+ * changes the hash, so a stale result can never be returned for a changed tree.
+ *
+ * It is DELIBERATELY wired only into `terraform_scan`. The ✗→✓ verifier
+ * (`terraform_verify_remediation`) ALWAYS re-scans fresh by calling `runScanners`
+ * directly, never through here — so a cache can never make the verifier read a
+ * fixed tree as still-broken or vice-versa. Within one run the only thing that
+ * varies between repeated `terraform_scan` calls on an UNCHANGED tree is nothing,
+ * so those repeats become instant; the first scan after any edit always re-runs.
+ */
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { walkTfFiles } from "#app/mcp/modules";
+import { type RunScannersOptions, runScanners } from "#app/mcp/terraform/scanners";
+import type { ScannerOutcome } from "#app/mcp/terraform/types";
+
+const cache = new Map<string, ScannerOutcome[]>();
+
+/** Content hash of every Terraform file under `cwd` (sorted for determinism),
+ *  mixed with an `extra` signature (the toolchain). Reading the files is cheap
+ *  next to running Trivy/Checkov, and hashing CONTENT (not mtime) means an edit
+ *  that rewrites a file in place still busts the key. */
+export function treeHash(cwd: string, extra: string): string {
+  const h = createHash("sha256");
+  for (const rel of walkTfFiles(cwd).sort()) {
+    h.update(rel);
+    h.update("\0");
+    try {
+      h.update(readFileSync(join(cwd, rel)));
+    } catch {
+      h.update("<unreadable>");
+    }
+    h.update("\0");
+  }
+  h.update(extra);
+  return h.digest("hex");
+}
+
+/** Stable signature of the run's toolchain — the selected tools (the `enabled`
+ *  method is dropped by JSON, leaving the gated/disabled config) plus whether a
+ *  module-fetch credential is present (it can change private-module resolution). */
+function toolchainSignature(opts: RunScannersOptions): string {
+  return JSON.stringify({
+    selection: opts.selection ?? null,
+    fetch: opts.terraformEnv ? Object.keys(opts.terraformEnv).sort() : null,
+    // external-module resolution changes WHICH code checkov scans, so a scan
+    // with it on must never be served a cached scan that had it off (else the
+    // b.4 internal findings would silently vanish — the laundering this guards).
+    externalModules: opts.downloadExternalModules ?? false,
+    // egress policy changes both the subprocess env AND the outcome's
+    // `egress_isolation` marker — a denied scan must not serve an open-scan
+    // cache entry (or vice versa), else the run summary lies about isolation.
+    network: opts.toolsNetwork
+      ? {
+          base: opts.toolsNetwork.base,
+          perTool: [...opts.toolsNetwork.perTool.entries()].sort(),
+          allow: [...opts.toolsNetwork.extraAllowedHosts].sort(),
+        }
+      : null,
+  });
+}
+
+/**
+ * `runScanners` with a per-process, tree-content-keyed cache — ONLY for the
+ * read-only scan path. Identical signature to `runScanners`. Never call this from
+ * the verifier; call `runScanners` there so it always re-scans fresh.
+ */
+export function runScannersCached(cwd: string, opts: RunScannersOptions = {}): ScannerOutcome[] {
+  const key = treeHash(cwd, toolchainSignature(opts));
+  const hit = cache.get(key);
+  if (hit) return hit;
+  const out = runScanners(cwd, opts);
+  cache.set(key, out);
+  return out;
+}
+
+/** Drop the cache (test isolation / explicit invalidation). */
+export function clearScannerCache(): void {
+  cache.clear();
+}

package/src/mcp/terraform/scannerEgress.ts

@@ -0,0 +1,141 @@
+/**
+ * Per-scanner network egress control (supply-chain phase 0.2).
+ *
+ * THE THREAT. The TeamPCP trivy payload dumped runner memory and *called home* —
+ * the breach was the exfiltration, not the dump. The 0.1 integrity gate refuses
+ * builds we KNOW are compromised; this bounds the ones we don't: a scanner that
+ * cannot egress is a local nuisance, not a breach.
+ *
+ * THE MECHANISM. Env-level proxy denial: the scanner subprocess gets
+ * `HTTP(S)_PROXY` pointed at a blackhole (a local port nothing listens on, so
+ * every proxied connection fails fast) and `NO_PROXY` naming only the hosts that
+ * tool legitimately needs (trivy's DB registries, tflint's ruleset releases —
+ * which bypass the proxy and connect directly). Go and Python HTTP stacks both
+ * honour these variables, which covers all three scanners.
+ *
+ * HONESTY. This is the *degrade path* of the roadmap item — an env contract,
+ * not a kernel boundary: a malicious binary can ignore proxy vars. So an
+ * outcome produced under this control records `egress_isolation: "partial"`,
+ * never a stronger claim. The netns default-deny (a real kernel boundary) is
+ * the unbuilt upgrade; when it lands, this stays as the fallback for runners
+ * that can't grant namespace privileges. Deny is OPT-IN (`tools_network`
+ * input): turning it on by default would break DB pulls on runners whose
+ * mirrors we can't know about.
+ */
+
+export type EgressPolicy = "open" | "deny";
+
+/** the parsed `tools_network` input: a base policy + per-tool overrides. */
+export interface ToolsNetworkDirective {
+  base: EgressPolicy;
+  perTool: Map<string, EgressPolicy>;
+  /** unrecognised tokens (warn, never fatal — matching `tools_enabled`). */
+  unknown: string[];
+  /** extra NO_PROXY hosts admitted for every denied tool (private mirrors). */
+  extraAllowedHosts: string[];
+}
+
+/**
+ * Hosts each scanner legitimately needs when its egress is denied. Deliberately
+ * MINIMAL — every entry is a documented, first-party distribution endpoint, not
+ * a convenience:
+ *
+ *   - trivy: vulnerability-DB / checks-bundle OCI registries (`trivy-db`,
+ *     `trivy-checks` live on GHCR with the ECR Public mirror as fallback).
+ *   - tflint: ruleset plugins are GitHub release assets, fetched by
+ *     `tflint --init`.
+ *   - checkov: scans fully offline — needs nothing.
+ *
+ * An operator whose runner uses a private mirror adds it via
+ * `tools_network: "deny,allow=<host>"`.
+ */
+export const SCANNER_EGRESS_ALLOWLIST: Readonly<Record<string, readonly string[]>> = {
+  trivy: ["ghcr.io", "public.ecr.aws"],
+  tflint: ["github.com", "api.github.com", "objects.githubusercontent.com"],
+  checkov: [],
+};
+
+/**
+ * Parse the `tools_network` input (comma- or newline-separated). Grammar
+ * mirrors `tools_enabled`:
+ *
+ *   - `deny` / `open`      — base policy for every scanner (default open);
+ *   - `<tool>=deny|open`   — per-tool override (`trivy=deny`);
+ *   - `allow=<host>`       — extra NO_PROXY host admitted for every denied tool
+ *     (private DB mirrors).
+ *
+ * Unrecognised tokens are collected, never fatal — a typo must not silently
+ * change a security posture NOR fail the run.
+ */
+export function parseToolsNetwork(raw: string | undefined): ToolsNetworkDirective {
+  const directive: ToolsNetworkDirective = {
+    base: "open",
+    perTool: new Map<string, EgressPolicy>(),
+    unknown: [],
+    extraAllowedHosts: [],
+  };
+  for (const token of (raw ?? "").split(/[\n,]/)) {
+    const t = token.trim().toLowerCase();
+    if (!t) continue;
+    if (t === "deny" || t === "open") {
+      directive.base = t;
+      continue;
+    }
+    const eq = t.indexOf("=");
+    if (eq > 0) {
+      const key = t.slice(0, eq).trim();
+      const value = t.slice(eq + 1).trim();
+      if (key === "allow" && value) {
+        directive.extraAllowedHosts.push(value);
+        continue;
+      }
+      if (value === "deny" || value === "open") {
+        directive.perTool.set(key, value);
+        continue;
+      }
+    }
+    directive.unknown.push(token.trim());
+  }
+  return directive;
+}
+
+/** The effective policy for one tool under a directive. */
+export function egressPolicyFor(
+  tool: string,
+  directive: ToolsNetworkDirective | undefined,
+): EgressPolicy {
+  if (!directive) return "open";
+  return directive.perTool.get(tool) ?? directive.base;
+}
+
+// A local port with nothing listening: every proxied connection is refused
+// immediately (fail-fast), rather than hanging on an unroutable address.
+const BLACKHOLE_PROXY = "http://127.0.0.1:9";
+
+/**
+ * The env overlay that denies a tool's egress, or null when its policy is open.
+ * Both case spellings are set — Go reads either, Python's requests prefers
+ * lowercase. `NO_PROXY` admits the tool's documented endpoints (plus loopback,
+ * which is never egress) so the tool keeps working while everything else dies
+ * at the blackhole.
+ */
+export function egressEnvFor(
+  tool: string,
+  directive: ToolsNetworkDirective | undefined,
+): Record<string, string> | null {
+  if (egressPolicyFor(tool, directive) !== "deny") return null;
+  const allowed = [
+    "127.0.0.1",
+    "localhost",
+    ...(SCANNER_EGRESS_ALLOWLIST[tool] ?? []),
+    ...(directive?.extraAllowedHosts ?? []),
+  ].join(",");
+  return {
+    HTTP_PROXY: BLACKHOLE_PROXY,
+    HTTPS_PROXY: BLACKHOLE_PROXY,
+    http_proxy: BLACKHOLE_PROXY,
+    https_proxy: BLACKHOLE_PROXY,
+    NO_PROXY: allowed,
+    no_proxy: allowed,
+  };
+}

package/src/mcp/terraform/scannerJson.ts

@@ -0,0 +1,22 @@
+import { type, type Type } from "arktype";
+
+/**
+ * Parse + shape-validate JSON from an external subprocess (terraform, tflint,
+ * trivy, checkov, infracost, reviewer findings). MCP tool inputs are already
+ * arktype-validated at the tool boundary; this applies the same rigor to the
+ * other untrusted boundary — scanner stdout — so a version bump that changes a
+ * tool's output shape fails that scanner loudly (callers degrade to `skipped`
+ * / empty) instead of feeding silently-wrong fields into concerns.
+ *
+ * Throws on invalid JSON (exactly like the bare `JSON.parse` it replaces) and
+ * on a shape mismatch, with the offending paths in the message.
+ */
+export function parseScannerJson<t>(schema: Type<t>, stdout: string, tool: string): t {
+  const out = schema(JSON.parse(stdout || "{}"));
+  if (out instanceof type.errors) {
+    throw new Error(`${tool} output shape mismatch: ${out.summary}`);
+  }
+  // the schemas here are morph-free, so the validated output IS the schema's t;
+  // TS just can't relate arktype's distilled call-result back to the generic.
+  return out as t;
+}