infraweaver 0.1.0

package/src/mcp/terraform/tfquery.ts

@@ -0,0 +1,159 @@
+/**
+ * `*.tfquery.hcl` — Terraform 1.14 query files, read as DISCOVERY INPUT ONLY.
+ *
+ * A query file holds `list` blocks that ask a provider "what already exists out
+ * there?", and `terraform query -generate-config-out` turns the answers into
+ * importable configuration. That makes it a genuinely useful inventory signal:
+ * it tells you which parts of an estate the team knows are unmanaged and intends
+ * to adopt, which is exactly the coverage question a compliance report should be
+ * able to speak to.
+ *
+ * THE HARD RULE, AND WHY IT IS ARCHITECTURAL RATHER THAN A CONVENTION.
+ * Query results must never reach remediation. A `list` block describes resources
+ * that are NOT under Terraform management, so "fixing" one would mean writing
+ * configuration for infrastructure nobody has adopted yet — the engine would be
+ * inventing managed resources out of a search result, and the ✗→✓ proof machinery
+ * has nothing to prove against because there is no prior finding to clear.
+ *
+ * Three independent things enforce that, so no single mistake is enough:
+ *   1. this module produces an INVENTORY type, not `Concern[]`. There is no code
+ *      path from a query file to a finding, because the function that would do it
+ *      does not exist;
+ *   2. `.tfquery.hcl` is not a `.tf`, so `isTerraformFile` is false and
+ *      `buildConcernResult` — the single chokepoint every fixer-feeding surface
+ *      routes through — would drop such a concern even if one were fabricated;
+ *   3. `.tfquery.hcl` matches neither of the `DEFAULT_ALLOWED_PATHS` globs
+ *      (`*.tf`, `*.tfvars`), so the push guardrail refuses to write one.
+ *
+ * `tfquery.test.ts` asserts all three, so the rule survives a future refactor
+ * that forgets why it existed.
+ *
+ * Pure except `collectQueryInventory`, which reads the tree.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { type } from "arktype";
+import type { LocalToolContext } from "#app/mcp/localContext";
+import { walkFilesBySuffix } from "#app/mcp/modules";
+import { execute, tool, toolOk } from "#app/mcp/shared";
+import { parseBlocks, stripTrailingComment, topLevelAssignments } from "#app/mcp/terraform/hcl";
+import { log } from "#app/utils/cli";
+
+/** The extension Terraform reserves for query configuration. */
+export const TFQUERY_SUFFIX = ".tfquery.hcl";
+
+/** True for a path Terraform would execute as a query configuration. */
+export function isQueryFile(path: string): boolean {
+  return path.toLowerCase().endsWith(TFQUERY_SUFFIX);
+}
+
+/** One `list "<type>" "<name>" { … }` block — a declared intent to discover
+ *  unmanaged resources of that type. */
+export interface QueryListBlock {
+  /** the resource type being searched for, e.g. `google_compute_instance`. */
+  resourceType: string;
+  /** the query's local name, unique within the directory. */
+  name: string;
+  /** the `provider` argument as written — which provider configuration is
+   *  queried. Null when absent (Terraform requires it; we report, not validate). */
+  provider: string | null;
+  /** the `limit` as written, or null when defaulted (Terraform's default is 100). */
+  limit: string | null;
+  /** whether the block asks for full resource bodies (`include_resource`). */
+  includeResource: boolean;
+  /** 1-based line of the block header. */
+  line: number;
+}
+
+export interface QueryFileInventory {
+  file: string;
+  lists: QueryListBlock[];
+}
+
+/** Parse one query file's `list` blocks. Pure. */
+export function parseQueryFile(hcl: string): QueryListBlock[] {
+  return parseBlocks(hcl, ["list"]).map((block) => {
+    const args = topLevelAssignments(block.body);
+    const value = (key: string): string | null => {
+      const found = args.find((a) => a.name === key);
+      return found ? stripTrailingComment(found.value) : null;
+    };
+    return {
+      resourceType: block.labels[0] ?? "",
+      name: block.labels[1] ?? "",
+      provider: value("provider"),
+      limit: value("limit"),
+      includeResource: value("include_resource") === "true",
+      line: block.line,
+    };
+  });
+}
+
+export interface QueryInventory {
+  files: QueryFileInventory[];
+  /** total `list` blocks across the tree. */
+  total: number;
+  /** distinct resource types being searched for, sorted. */
+  resourceTypes: string[];
+}
+
+/**
+ * Every query file under `cwd` and the `list` blocks it declares.
+ *
+ * Returns an inventory, never findings — see the module note. An unreadable file
+ * is skipped rather than reported: a query file we cannot read is a gap in the
+ * inventory, and inventing an entry for it would be worse than a shorter list.
+ */
+export function collectQueryInventory(cwd: string): QueryInventory {
+  const files: QueryFileInventory[] = [];
+  const types = new Set<string>();
+  let total = 0;
+  for (const rel of walkFilesBySuffix(cwd, TFQUERY_SUFFIX)) {
+    let text: string;
+    try {
+      text = readFileSync(join(cwd, rel), "utf8");
+    } catch {
+      continue;
+    }
+    const lists = parseQueryFile(text);
+    if (lists.length === 0) continue;
+    total += lists.length;
+    for (const l of lists) if (l.resourceType) types.add(l.resourceType);
+    files.push({ file: rel.replace(/\\/g, "/"), lists });
+  }
+  return { files, total, resourceTypes: [...types].sort() };
+}
+
+// --- the tool -----------------------------------------------------------------
+
+export const TerraformQueryInventoryParams = type({});
+
+export function TerraformQueryInventoryTool(ctx: LocalToolContext) {
+  return tool({
+    name: "terraform_query_inventory",
+    description:
+      "Inventory the repo's Terraform QUERY files (`*.tfquery.hcl`, Terraform 1.14 `list` blocks) — the " +
+      "declared intent to discover infrastructure that is NOT yet under Terraform management. Returns, per " +
+      "file, each `list` block's resource type, local name, `provider`, `limit` and `include_resource`, plus " +
+      "the distinct resource types across the tree. READ-ONLY DISCOVERY INPUT: use it to describe management " +
+      'coverage in an assessment ("the team is adopting N unmanaged resource types"). It NEVER produces ' +
+      "findings and its results must NEVER drive remediation — a `list` block describes resources nobody has " +
+      "adopted yet, so writing configuration from one would invent managed infrastructure. Query files are " +
+      "not `*.tf`, so the push guardrail refuses to write them and the fix loop drops them regardless.",
+    parameters: TerraformQueryInventoryParams,
+    execute: execute(async () => {
+      const cwd = ctx.payload.cwd ?? process.cwd();
+      const inventory = collectQueryInventory(cwd);
+      log.info(
+        `» terraform_query_inventory: ${inventory.total} list block(s) across ${inventory.files.length} query file(s)`,
+      );
+      return toolOk({
+        ...inventory,
+        note:
+          inventory.total === 0
+            ? "no *.tfquery.hcl files found — nothing declared as pending discovery"
+            : "read-only discovery input: report it as management-coverage context, never as findings and never as remediation input",
+      });
+    }),
+  });
+}

package/src/mcp/terraform/toolchainIntegrity.ts

@@ -0,0 +1,151 @@
+import { PRODUCT_NAME } from "#app/brand";
+import { run } from "#app/mcp/terraform/subprocess";
+
+/**
+ * Compromised-scanner gate (supply-chain phase 0.1).
+ *
+ * THE THREAT, CONCRETELY. In March 2026 the Trivy project was compromised
+ * (TeamPCP): a malicious **v0.69.4** was published across GHCR, ECR Public,
+ * Docker Hub, deb/rpm and `get.trivy.dev` on 19 Mar; 76 of 77 `trivy-action`
+ * tags and all 7 `setup-trivy` tags were repointed at infostealer commits;
+ * malicious 0.69.5 / 0.69.6 images followed on 22 Mar. The payload dumped
+ * runner memory and called home. Advisory: GHSA-69fq-xp46-6x23. Last clean
+ * release before the incident: 0.69.3.
+ *
+ * WHY THIS LIVES HERE. Infraweaver does not download the toolchain — it executes
+ * whatever `trivy`/`checkov`/`tflint` the customer's CI put on PATH, inside the
+ * customer's runner, alongside their credentials. So the registry-side controls
+ * that failed in this incident are not ours to fix; what we CAN do is refuse to
+ * execute a build we know is malicious. A scanner is the one subprocess whose
+ * output we trust, so running a known-backdoored one is the worst case for an
+ * attestation product: we would be both the execution vector and the notary.
+ *
+ * FAIL-CLOSED, NOT SKIP. Every other scanner problem here degrades to
+ * "skipped" (absent binary, unparseable output) because a missing tool must not
+ * block a run. A KNOWN-COMPROMISED tool is the opposite: continuing would mean
+ * knowingly executing malware, so this throws and the run stops.
+ */
+
+/** A published release known to be malicious. */
+interface CompromisedRelease {
+  /** Binary name as invoked (matches the `run()` command). */
+  tool: string;
+  /** Exact affected versions — never a range, so a fix release can't be caught. */
+  versions: readonly string[];
+  /** Advisory id to name in the failure message. */
+  advisory: string;
+  /** Shortest safe instruction for the operator. */
+  guidance: string;
+}
+
+/**
+ * The denylist. Deliberately EXACT versions: a range would sweep up the fixed
+ * release and turn a security control into an outage. Add an entry per advisory.
+ */
+export const COMPROMISED_RELEASES: readonly CompromisedRelease[] = [
+  {
+    tool: "trivy",
+    versions: ["0.69.4", "0.69.5", "0.69.6"],
+    advisory: "GHSA-69fq-xp46-6x23",
+    guidance:
+      "These builds contain an infostealer that dumps runner memory and exfiltrates it. " +
+      "Pin trivy to 0.69.3 (the last clean release before the incident) or a fixed release " +
+      "above 0.69.6, and re-pull from a trusted source — the compromised artifacts were " +
+      "published to every official channel including GHCR, Docker Hub, deb/rpm and the " +
+      "install script. Do NOT use aquasecurity/trivy-action or setup-trivy tags from the " +
+      "incident window: they were repointed at the malicious commits.",
+  },
+];
+
+/**
+ * Extract a semantic version from a tool's `--version` output. Tools disagree
+ * wildly on format (`Version: 0.55.0`, `TFLint version 0.52.0`, a bare
+ * `3.2.0`), so take the first `x.y.z` that appears. Returns null when the output
+ * carries no recognisable version. Pure.
+ */
+export function parseToolVersion(output: string): string | null {
+  const m = /(\d+\.\d+\.\d+)/.exec(output);
+  return m?.[1] ?? null;
+}
+
+/**
+ * The advisory matching a tool+version, or null when the pair is not known to be
+ * compromised. Pure — the whole decision is table-driven and testable without a
+ * subprocess.
+ */
+export function compromisedRelease(
+  tool: string,
+  version: string | null,
+): CompromisedRelease | null {
+  if (!version) return null;
+  return (
+    COMPROMISED_RELEASES.find(
+      (r) => r.tool === tool && r.versions.includes(version),
+    ) ?? null
+  );
+}
+
+/** The operator-facing failure text for a compromised tool. Pure. */
+export function compromisedToolMessage(
+  rel: CompromisedRelease,
+  version: string,
+): string {
+  return (
+    `refusing to run ${rel.tool} ${version}: this release is known-compromised (${rel.advisory}). ` +
+    `${rel.guidance} ` +
+    `${PRODUCT_NAME} fails closed here rather than execute a scanner it knows is backdoored — ` +
+    "the scan did not run and no findings were produced."
+  );
+}
+
+/** Cache: one `--version` probe per tool per process, not per scanned root. */
+const probed = new Map<string, string | null>();
+
+/** Reset the probe cache — tests only. */
+export function resetToolVersionCache(): void {
+  probed.clear();
+}
+
+/**
+ * Every tool version probed this process, sorted by tool name — the scanner
+ * half of the evidence bundle's PROVENANCE block (A.3). These are the versions
+ * the integrity gate actually observed before executing each scanner, so the
+ * signed bundle records the toolchain that genuinely ran — nothing is probed
+ * retroactively and nothing is fabricated for a tool that never ran. `null`
+ * means the tool ran a probe but printed no recognisable version.
+ */
+export function probedToolVersions(): {
+  tool: string;
+  version: string | null;
+}[] {
+  return [...probed.entries()]
+    .map(([tool, version]) => ({ tool, version }))
+    .sort((a, b) => a.tool.localeCompare(b.tool));
+}
+
+/**
+ * Detect a tool's version by running `<tool> --version`. Returns null when the
+ * binary is absent or prints nothing recognisable (both are non-events — the
+ * caller's normal "skipped" path handles an absent tool).
+ */
+export function detectToolVersion(tool: string, cwd: string): string | null {
+  const cached = probed.get(tool);
+  if (cached !== undefined) return cached;
+  const r = run(tool, ["--version"], cwd);
+  const version = r.missing
+    ? null
+    : parseToolVersion(`${r.stdout}\n${r.stderr}`);
+  probed.set(tool, version);
+  return version;
+}
+
+/**
+ * Fail-closed gate: throws when `tool` on PATH is a known-compromised release.
+ * A no-op for an absent tool, an unknown version, or any tool with no advisory —
+ * this must never become a reason a clean run fails.
+ */
+export function assertToolchainIntegrity(tool: string, cwd: string): void {
+  const version = detectToolVersion(tool, cwd);
+  const rel = compromisedRelease(tool, version);
+  if (rel && version) throw new Error(compromisedToolMessage(rel, version));
+}

package/src/mcp/terraform/tools/authorPolicy.ts

@@ -0,0 +1,185 @@
+import { type } from "arktype";
+import { PRODUCT_NAME } from "#app/brand";
+import { hubControlsForThemes, packControlsForThemes, THEME_TO_NIST } from "#app/mcp/crosswalk";
+import { execute, tool, toolOk } from "#app/mcp/shared";
+import {
+  AUTHORED_RULE_PREFIX,
+  authoredRuleId,
+  emitPlanFixture,
+  emitPolicyHcl,
+  emitPolicyTestHcl,
+  emitRego,
+  POLICY_OPERATORS,
+  type PolicyRuleSpec,
+  planFixtureFileName,
+  policyFileName,
+  policyHclFidelity,
+  policyTestFileName,
+  regoFileName,
+  selfTestSpec,
+  validateSpec,
+} from "#app/mcp/terraform/policyAuthor";
+import { skipResult } from "#app/mcp/terraform/types";
+import { log } from "#app/utils/cli";
+
+const THEMES = Object.keys(THEME_TO_NIST).sort();
+
+export const PolicyAuthorParams = type({
+  id: type.string.describe(
+    `kebab-case rule id, unique within the pack — e.g. \`s3-bucket-encryption-aes256\`. Becomes the filename and the \`${AUTHORED_RULE_PREFIX}:<id>\` rule id in every emitted artifact.`,
+  ),
+  title: type.string.describe("one-line human title for the rule."),
+  source_requirement: type.string.describe(
+    "the SENTENCE OF THE SOURCE STANDARD this rule was derived from, quoted as written. This is the audit trail from prose to policy — do not paraphrase it and do not invent one; if the standard does not say it, the rule should not exist.",
+  ),
+  resource_type: type.string.describe(
+    "the Terraform resource type the rule applies to, e.g. `aws_s3_bucket`. One type per rule.",
+  ),
+  attribute: type.string.describe(
+    "dotted path into the resource's PLANNED VALUES (what `terraform show -json` puts in `change.after`), e.g. `server_side_encryption_configuration.rule.apply_server_side_encryption_by_default.sse_algorithm`. A segment that resolves to a list is flattened and the rule must hold for every element.",
+  ),
+  operator: type(`'${POLICY_OPERATORS.join("' | '")}'`).describe(
+    "the comparison. `equals`/`not_equals`/`matches`/`gte`/`lte` take a scalar `value`; `in`/`not_in` take a list `value`; `present`/`absent`/`is_true`/`is_false`/`non_empty` take none.",
+  ),
+  "value?": type("string | number | boolean | (string | number)[]").describe(
+    "the operand, when the operator takes one. Omit it entirely otherwise.",
+  ),
+  when_absent: type("'violation' | 'compliant'").describe(
+    "REQUIRED, and the field to think hardest about: what the rule concludes when the attribute is not set at all. `sse_algorithm` missing means unencrypted (violation); `acl` missing means the private default (compliant). Same shape, opposite answer — so state it, never guess it.",
+  ),
+  severity: type("'critical' | 'high' | 'medium' | 'low' | 'info'").describe(
+    "severity of a violation. critical/high emit tfpolicy `enforcement_level = mandatory`; the rest emit `advisory`.",
+  ),
+  theme: type.string.describe(
+    `the compliance theme the rule evidences — this is what earns the control citation, so it must be one of the reviewed crosswalk themes: ${THEMES.join(", ")}.`,
+  ),
+  message: type.string.describe(
+    "the violation message an engineer reads in CI. Say what is wrong and what to set.",
+  ),
+  "example_compliant?": type("string | number | boolean").describe(
+    "a value that SATISFIES the rule, used to build the compliant fixture. REQUIRED when operator is `matches` (a value cannot be derived from a regex); optional elsewhere, where it overrides the synthesised fixture value.",
+  ),
+  "example_violating?": type("string | number | boolean").describe(
+    "a value that VIOLATES the rule. REQUIRED when operator is `matches`; optional elsewhere.",
+  ),
+});
+
+/**
+ * §5.2 — the authoring surface. Turns one requirement from a written standard
+ * into reviewed policy-as-code plus the fixtures that prove it is not vacuous.
+ *
+ * The tool is NON-MUTATING on purpose. It returns file CONTENT, never writes it:
+ * the whole premise of §5.2 is that the output is reviewed code a human commits,
+ * not a policy that appears in the repo because a model decided it should. That
+ * also keeps the push allow-list untouched.
+ *
+ * It takes no `LocalToolContext` for the same reason: nothing here reads the
+ * workspace, the run payload or the scan session. Spec in, artifacts out — which
+ * is what lets the whole path be unit-tested without a fixture repo.
+ */
+export function PolicyAuthorTool() {
+  return tool({
+    name: "policy_author",
+    description:
+      "Turn ONE requirement from a written standard (an internal policy, a control objective, a customer " +
+      "security schedule) into reviewed policy-as-code: an OPA/Rego file `policy_check` can enforce, a " +
+      "HashiCorp tfpolicy `.policy.hcl`, a `.policytest.hcl` of fixtures, a plan-JSON fixture, and the " +
+      "compliance controls the rule evidences. Call it ONCE PER RULE. " +
+      "You do not write Rego here — you fill in a closed rule spec, and the generator emits every artifact " +
+      "deterministically, which is what makes the result reviewable. Before emitting, it SELF-TESTS the " +
+      "rule against violating / compliant / attribute-absent fixtures and REFUSES a spec that fails or that " +
+      "denies nothing (a policy that never fires is the failure mode that matters — it reads as enforced " +
+      "and passes everything). " +
+      "Only express what a Terraform plan can actually decide: one resource type, one attribute, one " +
+      "comparison. A requirement about people, process, or runtime state is NOT authorable — say so and " +
+      "move on rather than encoding a rule that cannot be evaluated. " +
+      "It writes nothing: return the content to the human who reviews and commits it.",
+    parameters: PolicyAuthorParams,
+    execute: execute(async (params) => {
+      const spec = params as PolicyRuleSpec;
+
+      const errors = validateSpec(spec);
+      if (errors.length > 0) {
+        return skipResult("invalid_spec", `the rule spec is not valid: ${errors.join("; ")}`, {
+          key: "found",
+          reasonKey: "reason",
+          extra: { errors },
+        });
+      }
+
+      // The vacuity gate. A spec that does not deny its own violating fixture,
+      // or that denies nothing at all, is never emitted — handing a human a
+      // policy that contradicts its own description is worse than handing them
+      // nothing, because it will be reviewed as if it worked.
+      const selfTest = selfTestSpec(spec);
+      if (!selfTest.passed) {
+        const failed = selfTest.cases.filter((c) => !c.passed);
+        const detail = !selfTest.denies_something
+          ? "the rule denies none of its own fixtures — as written it can never fire. Re-check `when_absent` and the operator."
+          : `the rule disagreed with its own fixtures: ${failed
+              .map(
+                (c) =>
+                  `${c.kind} expected ${c.expected ? "violation" : "pass"}, got ${c.actual ? "violation" : "pass"} (${c.reason})`,
+              )
+              .join("; ")}`;
+        return skipResult("self_test_failed", detail, {
+          key: "found",
+          reasonKey: "reason",
+          extra: { self_test: selfTest },
+        });
+      }
+
+      const controls = hubControlsForThemes([spec.theme]);
+      const fidelity = policyHclFidelity(spec);
+      log.info(
+        `» policy_author: ${authoredRuleId(spec.id)} self-test PASS (${selfTest.cases.length} fixtures), ${controls.length} control(s), .policy.hcl fidelity=${fidelity}`,
+      );
+
+      return toolOk({
+        rule_id: authoredRuleId(spec.id),
+        self_test: selfTest,
+        // what was verified, and — the part that matters — what was not.
+        asserts:
+          "the rule's SEMANTICS were evaluated in-process against a violating, a compliant and an " +
+          "attribute-absent fixture and behaved as each demands, and the emitted artifacts are a " +
+          "deterministic function of the spec",
+        does_not_assert:
+          "that the emitted Rego or .policy.hcl was EXECUTED — no OPA or tfpolicy binary is bundled. Run " +
+          "`policy_check` (conftest) against the plan fixture, and `tfpolicy validate` + `tfpolicy test` " +
+          "against the .policy.hcl and .policytest.hcl, before relying on either in a gate",
+        crosswalk: {
+          theme: spec.theme,
+          controls,
+          pack_control_ids: packControlsForThemes([spec.theme]),
+        },
+        artifacts: [
+          {
+            path: `policy/${regoFileName(spec)}`,
+            purpose: "OPA/Rego — the enforceable artifact; policy_check runs it via conftest",
+            content: emitRego(spec),
+          },
+          {
+            path: `policy/${planFixtureFileName(spec)}`,
+            purpose:
+              "plan-JSON fixture — run `conftest test -p policy <this file>` to execute the Rego above",
+            content: emitPlanFixture(spec),
+          },
+          {
+            path: policyFileName(spec),
+            purpose: `HashiCorp tfpolicy (authored, not enforced by ${PRODUCT_NAME}) — fidelity: ${fidelity}`,
+            content: emitPolicyHcl(spec),
+          },
+          {
+            path: policyTestFileName(spec),
+            purpose: "tfpolicy fixtures — `tfpolicy test --policies=. --tests=.`",
+            content: emitPolicyTestHcl(spec),
+          },
+        ],
+        policy_hcl_fidelity: fidelity,
+        next_step:
+          "show the human the Rego and the source requirement it came from, state the self-test result, and let " +
+          "them commit it — this tool deliberately writes nothing",
+      });
+    }),
+  });
+}