infraweaver 0.1.0

package/src/mcp/terraform/tools/verifyRemediation.ts

@@ -0,0 +1,190 @@
+import { type } from "arktype";
+import type { LocalToolContext } from "#app/mcp/localContext";
+import { execute, tool, toolOk } from "#app/mcp/shared";
+import { computeConfidence } from "#app/mcp/terraform/decisions";
+import { captureProvenFix } from "#app/mcp/terraform/fixMemory";
+import { hasBaseline, scanSessionOf } from "#app/mcp/terraform/scanSession";
+import {
+  computeRegressions,
+  computeRemediationVerdict,
+  partitionByKey,
+  regressionIdsByKey,
+  runScanners,
+} from "#app/mcp/terraform/scanners";
+import { concernKeyOf, dedupe } from "#app/mcp/terraform/types";
+import { log } from "#app/utils/cli";
+import { resolveModuleCredentialEnv } from "#app/utils/registryAuth";
+import { resolveToolSelection } from "#app/utils/toolSelection";
+
+export const TerraformVerifyRemediationParams = type({
+  concern_ids: type.string
+    .array()
+    .describe(
+      "the `concern_ids` of the group being remediated (from the original terraform_scan). the tool re-runs the scanners and reports which are now resolved vs still present.",
+    ),
+  "download_external_modules?": type("boolean").describe(
+    "default false. Set true when verifying a refactor that ADOPTED a third-party module, so the re-scan looks INSIDE the adopted module — otherwise findings hidden in the module would vanish and falsely read as resolved (finding-laundering). Must match the resolution used for the baseline scan.",
+  ),
+});
+
+export interface VerifyScanners {
+  runScanners: typeof runScanners;
+}
+
+const realScanners: VerifyScanners = { runScanners };
+
+export async function runVerifyRemediation(
+  ctx: LocalToolContext,
+  {
+    concern_ids,
+    download_external_modules,
+  }: typeof TerraformVerifyRemediationParams.infer,
+  scanners: VerifyScanners = realScanners,
+) {
+  const cwd = ctx.payload.cwd ?? process.cwd();
+  const session = scanSessionOf(ctx.toolState);
+  // re-scan with the SAME selection + module-fetch credential the
+  // scan used, so a licence-gated tool is consistently off across baseline +
+  // verification and the ✗→✓ partition stays apples-to-apples. Carry the
+  // external-module resolution through too so the re-scan can't launder
+  // findings hidden inside an adopted module.
+  const outcomes = scanners.runScanners(cwd, {
+    selection: resolveToolSelection(ctx.payload),
+    terraformEnv: resolveModuleCredentialEnv(ctx.payload, {
+      sshKeyDir: ctx.tmpdir,
+    }),
+    downloadExternalModules: download_external_modules,
+    toolsNetwork: ctx.payload.toolsNetwork,
+  });
+  const currentConcerns = dedupe(outcomes.flatMap((o) => o.concerns));
+  const currentIds = currentConcerns.map((c) => c.id);
+  // line-INDEPENDENT keys: verify on (source|rule|file), not the line-pinned
+  // id, so a fix that shifts lines (almost every fix) can't make an unfixed
+  // concern look resolved nor a pre-existing one look like a regression.
+  const currentKeys = new Set(currentConcerns.map((c) => concernKeyOf(c)));
+
+  // Map each requested id → its key via the original scan's concerns
+  // (lastScanConcerns). Ids we can't key-map (verify called without a prior
+  // scan this run — e.g. a bare findings.json) fall back to exact-id matching.
+  const keyById = new Map(
+    (session.lastScanConcerns ?? []).map(
+      (c) => [c.id, concernKeyOf(c)] as const,
+    ),
+  );
+  const keyed: { id: string; key: string }[] = [];
+  const unkeyed: string[] = [];
+  for (const id of concern_ids) {
+    const key = keyById.get(id);
+    if (key !== undefined) keyed.push({ id, key });
+    else unkeyed.push(id);
+  }
+  const keyedVerdict = partitionByKey(keyed, currentKeys);
+  const fallbackVerdict = computeRemediationVerdict(
+    unkeyed,
+    new Set(currentIds),
+  );
+  const resolved = [...keyedVerdict.resolved, ...fallbackVerdict.resolved];
+  const remaining = [
+    ...keyedVerdict.remaining,
+    ...fallbackVerdict.remaining,
+  ];
+  const verified = remaining.length === 0;
+
+  // concerns the fix INTRODUCED, on the SAME line-independent key basis
+  // (a pre-existing concern that merely shifted lines is NOT a regression).
+  // Prefer baseline keys; fall back to the legacy raw-id diff only when keys
+  // weren't captured (no scan this run) — then report as unknown if neither is.
+  const baselineKeys = session.baselineConcernKeys;
+  const baselineIds = session.baselineConcernIds;
+  const regressions = baselineKeys
+    ? regressionIdsByKey(
+        currentConcerns.map((c) => ({ id: c.id, key: concernKeyOf(c) })),
+        new Set(baselineKeys),
+      )
+    : baselineIds
+      ? computeRegressions(baselineIds, currentIds)
+      : [];
+  const regressionsKnown = hasBaseline(session);
+
+  // §5.12 proven-fix memory: on a CLEAN proof (every requested id resolved AND no
+  // regressions introduced), capture the finding-TYPE of each resolved concern as
+  // a reusable pattern. Only a clean ✗→✓ earns a pattern — a partial or
+  // regressing fix is not a proven transformation. `regressionsKnown` is required
+  // too: without a captured baseline the regression check is vacuous (regressions
+  // is [] because nothing was compared, not because none exist), so an off-script
+  // tool order (e.g. assess→verify) can't cache a fix whose regressions were never
+  // checked. Gated on the opt-in flag; the captured patterns are reported to the
+  // org library at end-of-run. This never changes verify's own result — it's a
+  // side-effect of a proof, not part of it.
+  if (
+    ctx.payload.fixMemory &&
+    verified &&
+    regressionsKnown &&
+    regressions.length === 0 &&
+    resolved.length > 0
+  ) {
+    const resolvedSet = new Set(resolved);
+    const captures = (session.lastScanConcerns ?? [])
+      .filter((c) => resolvedSet.has(c.id))
+      .map(captureProvenFix);
+    if (captures.length > 0) {
+      session.provenFixCaptures = [...(session.provenFixCaptures ?? []), ...captures];
+    }
+  }
+
+  // deterministic confidence from the evidence on hand.
+  const confidence = computeConfidence({
+    verified,
+    regressionCount: regressions.length,
+    idempotent: session.lastIdempotent,
+    blastTier: session.lastBlastTier,
+    costDirection: session.lastCostDirection,
+  });
+
+  const ran = outcomes.filter((o) => o.ran).map((o) => o.source);
+  log.info(
+    `» terraform_verify_remediation: ${resolved.length}/${concern_ids.length} resolved` +
+      ` (${remaining.length} still present` +
+      (regressionsKnown ? `, ${regressions.length} regression(s)` : "") +
+      `) — confidence: ${confidence.level} — from [${ran.join(", ")}]`,
+  );
+  return toolOk({
+    verified,
+    resolved_count: resolved.length,
+    remaining_count: remaining.length,
+    resolved,
+    remaining,
+    // regression guard
+    has_regressions: regressions.length > 0,
+    regressions,
+    ...(regressionsKnown
+      ? {}
+      : {
+          regressions_note:
+            "no pre-fix baseline captured (run terraform_scan first) — regressions not checked",
+        }),
+    // confidence label
+    confidence: confidence.level,
+    confidence_reasons: confidence.reasons,
+    scanners_ran: ran,
+  });
+}
+
+export function TerraformVerifyRemediationTool(ctx: LocalToolContext) {
+  return tool({
+    name: "terraform_verify_remediation",
+    description:
+      "Deterministic ✗→✓ proof for a remediation. Re-runs the scanners and partitions the given " +
+      "`concern_ids` into `resolved` (gone from the re-scan) and `remaining` (still present), with a " +
+      "`verified` flag that is true ONLY when every id is gone. Also reports `regressions` — NEW concern " +
+      "ids the fix introduced that were not in the pre-fix scan: when `has_regressions` is true the " +
+      "PR must be labelled `needs-human` and the new concerns listed. Finally returns a deterministic " +
+      "`confidence` (high/medium/low) computed from the verification evidence (verified + no " +
+      "regressions + plan idempotency + blast radius + cost direction) — render it as a PR label/badge. " +
+      "Call this AFTER pushing the fix branch and build the PR's Validation section from its result — do " +
+      "NOT eyeball a scan or self-report resolution. A concern may be listed as ✓ resolved only if it " +
+      "appears in `resolved`.",
+    parameters: TerraformVerifyRemediationParams,
+    execute: execute(async (input) => runVerifyRemediation(ctx, input)),
+  });
+}

package/src/mcp/terraform/tools/versionCurrency.ts

@@ -0,0 +1,64 @@
+import { type } from "arktype";
+import type { LocalToolContext } from "#app/mcp/localContext";
+import { execute, tool, toolOk } from "#app/mcp/shared";
+import { checkVersionCurrency } from "#app/mcp/terraform/currency";
+import { skipResult } from "#app/mcp/terraform/types";
+import { log } from "#app/utils/cli";
+
+export const TerraformVersionCurrencyParams = type({});
+
+export function TerraformVersionCurrencyTool(ctx: LocalToolContext) {
+  return tool({
+    name: "terraform_version_currency",
+    description:
+      "Check the workspace's pinned providers and registry modules against the Terraform Registry's " +
+      "published versions — the upgrade intelligence no scanner provides (tflint checks pins EXIST, not " +
+      "that they're current). Reports per provider/module the written constraint, the `latest` stable " +
+      "version, the newest version the constraint admits, and `outdated`/`majors_behind`; registry " +
+      "modules with no version pin are flagged `unpinned` (pin them to `latest`). Remediation contract: " +
+      "one `chore(deps)` PR per upgrade group; minor/patch bumps may proceed autonomously; a MAJOR " +
+      "bump means the module/provider interface may have changed — apply it only with a `needs-human` " +
+      "label, and re-verify every bump with terraform_validate (plus terraform_plan when credentials " +
+      "exist; an upgrade that plans destructive changes is never auto). Network-dependent and degrades " +
+      "green: per-source lookup failures are reported per row, and an unreachable registry returns " +
+      "`ok: false` with code `registry_unreachable` (never an error).",
+    parameters: TerraformVersionCurrencyParams,
+    execute: execute(async () => {
+      const cwd = ctx.payload.cwd ?? process.cwd();
+      const report = await checkVersionCurrency(cwd);
+      if (report.lookups_attempted === 0) {
+        return toolOk({
+          providers: [],
+          modules: [],
+          outdated_count: 0,
+          unpinned_count: 0,
+          note: "no provider requirements or registry modules found in the workspace",
+        });
+      }
+      if (report.lookups_failed === report.lookups_attempted) {
+        return skipResult(
+          "registry_unreachable",
+          `all ${report.lookups_attempted} registry lookup(s) failed — registry.terraform.io unreachable from this runner; currency not checked`,
+        );
+      }
+      log.info(
+        `» terraform_version_currency: ${report.outdated_count} outdated, ${report.unpinned_count} unpinned ` +
+          `across ${report.providers.length} provider(s) + ${report.modules.length} registry module(s)` +
+          (report.lookups_failed
+            ? ` (${report.lookups_failed} lookup(s) failed)`
+            : ""),
+      );
+      return toolOk({
+        providers: report.providers,
+        modules: report.modules,
+        outdated_count: report.outdated_count,
+        unpinned_count: report.unpinned_count,
+        ...(report.lookups_failed > 0
+          ? {
+              note: `${report.lookups_failed} lookup(s) failed — those rows report lookup != "ok"`,
+            }
+          : {}),
+      });
+    }),
+  });
+}

package/src/mcp/terraform/tools.ts

@@ -0,0 +1,62 @@
+export {
+  PolicyAuthorParams,
+  PolicyAuthorTool,
+} from "#app/mcp/terraform/tools/authorPolicy";
+export {
+  DetectPlanDriftParams,
+  DetectPlanDriftTool,
+} from "#app/mcp/terraform/tools/detectPlanDrift";
+export {
+  TerraformEmitCostParams,
+  TerraformEmitCostTool,
+} from "#app/mcp/terraform/tools/emitCost";
+export {
+  TerraformEmitSarifParams,
+  TerraformEmitSarifTool,
+} from "#app/mcp/terraform/tools/emitSarif";
+export {
+  TerraformFixMemoryParams,
+  TerraformFixMemoryTool,
+} from "#app/mcp/terraform/tools/fixMemory";
+export {
+  InfracostDiffParams,
+  InfracostDiffTool,
+} from "#app/mcp/terraform/tools/infracostDiff";
+export {
+  IngestExternalFindingsParams,
+  IngestExternalFindingsTool,
+} from "#app/mcp/terraform/tools/ingestExternalFindings";
+export {
+  TerraformModuleLookupParams,
+  TerraformModuleLookupTool,
+} from "#app/mcp/terraform/tools/moduleLookup";
+export {
+  TerraformModuleSearchParams,
+  TerraformModuleSearchTool,
+} from "#app/mcp/terraform/tools/moduleSearch";
+export {
+  collectCloudCredentials,
+  TerraformPlanParams,
+  TerraformPlanTool,
+} from "#app/mcp/terraform/tools/plan";
+export {
+  TerraformProviderUpgradeParams,
+  TerraformProviderUpgradeTool,
+} from "#app/mcp/terraform/tools/providerUpgrade";
+export {
+  ReadFindingsParams,
+  ReadFindingsTool,
+} from "#app/mcp/terraform/tools/readFindings";
+export { TerraformScanParams, TerraformScanTool } from "#app/mcp/terraform/tools/scan";
+export {
+  TerraformValidateParams,
+  TerraformValidateTool,
+} from "#app/mcp/terraform/tools/validate";
+export {
+  TerraformVerifyRemediationParams,
+  TerraformVerifyRemediationTool,
+} from "#app/mcp/terraform/tools/verifyRemediation";
+export {
+  TerraformVersionCurrencyParams,
+  TerraformVersionCurrencyTool,
+} from "#app/mcp/terraform/tools/versionCurrency";