infraweaver 0.3.11 → 0.3.12

package/dist/cli.mjs

@@ -80148,7 +80148,7 @@ var require_polyfill = __commonJS({
     var {
       dirname: dirname16,
       isAbsolute: isAbsolute10,
-      join: join77,
+      join: join78,
       parse: parse8,
       resolve: resolve15,
       sep: sep12,
@@ -80405,8 +80405,8 @@ var require_polyfill = __commonJS({
       const dir = await readdir2(src);
       for (let i = 0; i < dir.length; i++) {
         const item = dir[i];
-        const srcItem = join77(src, item);
-        const destItem = join77(dest, item);
+        const srcItem = join78(src, item);
+        const destItem = join78(dest, item);
         const { destStat } = await checkPaths2(srcItem, destItem, opts);
         await startCopy(destStat, srcItem, destItem, opts);
       }
@@ -80479,7 +80479,7 @@ var require_cp = __commonJS({
 // node_modules/.pnpm/@npmcli+fs@6.0.0/node_modules/@npmcli/fs/lib/with-temp-dir.js
 var require_with_temp_dir = __commonJS({
   "node_modules/.pnpm/@npmcli+fs@6.0.0/node_modules/@npmcli/fs/lib/with-temp-dir.js"(exports2, module) {
-    var { join: join77, sep: sep12 } = __require("path");
+    var { join: join78, sep: sep12 } = __require("path");
     var getOptions2 = require_get_options();
     var { mkdir: mkdir5, mkdtemp, rm: rm2 } = __require("fs/promises");
     var withTempDir = async (root, fn2, opts) => {
@@ -80487,7 +80487,7 @@ var require_with_temp_dir = __commonJS({
         copy: ["tmpPrefix"]
       });
       await mkdir5(root, { recursive: true });
-      const target = await mkdtemp(join77(`${root}${sep12}`, options.tmpPrefix || ""));
+      const target = await mkdtemp(join78(`${root}${sep12}`, options.tmpPrefix || ""));
       let err;
       let result;
       try {
@@ -80512,13 +80512,13 @@ var require_with_temp_dir = __commonJS({
 var require_readdir_scoped = __commonJS({
   "node_modules/.pnpm/@npmcli+fs@6.0.0/node_modules/@npmcli/fs/lib/readdir-scoped.js"(exports2, module) {
     var { readdir: readdir2 } = __require("fs/promises");
-    var { join: join77 } = __require("path");
+    var { join: join78 } = __require("path");
     var readdirScoped = async (dir) => {
       const results = [];
       for (const item of await readdir2(dir)) {
         if (item.startsWith("@")) {
-          for (const scopedItem of await readdir2(join77(dir, item))) {
-            results.push(join77(item, scopedItem));
+          for (const scopedItem of await readdir2(join78(dir, item))) {
+            results.push(join78(item, scopedItem));
           }
         } else {
           results.push(item);
@@ -80533,7 +80533,7 @@ var require_readdir_scoped = __commonJS({
 // node_modules/.pnpm/@npmcli+fs@6.0.0/node_modules/@npmcli/fs/lib/move-file.js
 var require_move_file = __commonJS({
   "node_modules/.pnpm/@npmcli+fs@6.0.0/node_modules/@npmcli/fs/lib/move-file.js"(exports2, module) {
-    var { dirname: dirname16, join: join77, resolve: resolve15, relative: relative10, isAbsolute: isAbsolute10 } = __require("path");
+    var { dirname: dirname16, join: join78, resolve: resolve15, relative: relative10, isAbsolute: isAbsolute10 } = __require("path");
     var fs12 = __require("fs/promises");
     var pathExists2 = async (path15) => {
       try {
@@ -80563,7 +80563,7 @@ var require_move_file = __commonJS({
           if (sourceStat.isDirectory()) {
             const files = await fs12.readdir(source);
             await Promise.all(files.map(
-              (file2) => moveFile(join77(source, file2), join77(destination, file2), options, false, symlinks)
+              (file2) => moveFile(join78(source, file2), join78(destination, file2), options, false, symlinks)
             ));
           } else if (sourceStat.isSymbolicLink()) {
             symlinks.push({ source, destination });
@@ -112581,14 +112581,14 @@ var require_turndown_cjs = __commonJS({
         } else if (node3.nodeType === 1) {
           replacement = replacementForNode.call(self2, node3);
         }
-        return join77(output2, replacement);
+        return join78(output2, replacement);
       }, "");
     }
     function postProcess(output2) {
       var self2 = this;
       this.rules.forEach(function(rule) {
         if (typeof rule.append === "function") {
-          output2 = join77(output2, rule.append(self2.options));
+          output2 = join78(output2, rule.append(self2.options));
         }
       });
       return output2.replace(/^[\t\r\n]+/, "").replace(/[\t\r\n\s]+$/, "");
@@ -112600,7 +112600,7 @@ var require_turndown_cjs = __commonJS({
       if (whitespace.leading || whitespace.trailing) content = content.trim();
       return whitespace.leading + rule.replacement(content, node3, this.options) + whitespace.trailing;
     }
-    function join77(output2, replacement) {
+    function join78(output2, replacement) {
       var s1 = trimTrailingNewlines(output2);
       var s2 = trimLeadingNewlines(replacement);
       var nls = Math.max(output2.length - s1.length, replacement.length - s2.length);
@@ -200490,7 +200490,7 @@ import { randomBytes } from "node:crypto";
 // package.json
 var package_default = {
   name: "infraweaver",
-  version: "0.3.11",
+  version: "0.3.12",
   description: "GitHub Action that remediates Terraform to best practices and opens one scoped pull request per concern.",
   keywords: [
     "ai-coding-agent",
@@ -214109,7 +214109,7 @@ function TerraformAssessTool(ctx) {
 // src/mcp/localServer.ts
 import { mkdtempSync as mkdtempSync4 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
-import { join as join40 } from "node:path";
+import { join as join41 } from "node:path";
 
 // node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -275148,8 +275148,8 @@ function ConsolidationCandidatesTool(ctx) {
 }
 
 // src/mcp/terraform/tools/detectPlanDrift.ts
-import { readFileSync as readFileSync17 } from "node:fs";
-import { join as join27 } from "node:path";
+import { readFileSync as readFileSync18 } from "node:fs";
+import { join as join28 } from "node:path";
 
 // node_modules/.pnpm/@infraweaver-io+ci@0.1.8/node_modules/@infraweaver-io/ci/dist/progressComment.js
 function parseProgressComment(raw2) {
@@ -276897,6 +276897,66 @@ function dedupeCrossScanner(concerns) {
   return [...merged, ...passthrough];
 }
 
+// src/mcp/terraform/verifySites.ts
+import { readFileSync as readFileSync17 } from "node:fs";
+import { join as join27 } from "node:path";
+function fileReader(cwd) {
+  const cache3 = /* @__PURE__ */ new Map();
+  return (file2) => {
+    if (!cache3.has(file2)) {
+      let text;
+      try {
+        text = readFileSync17(join27(cwd, file2), "utf8");
+      } catch {
+        text = null;
+      }
+      cache3.set(file2, text);
+    }
+    return cache3.get(file2) ?? null;
+  };
+}
+function siteOf(c, read3) {
+  const text = read3(c.location.file);
+  return text === null ? null : resourceAddressAt(text, c.location.line);
+}
+function recordConcernSites(session, concerns, cwd) {
+  const read3 = fileReader(cwd);
+  session.siteById ??= /* @__PURE__ */ new Map();
+  session.firstSitesByKey ??= /* @__PURE__ */ new Map();
+  const first = session.firstSitesByKey;
+  const fresh = /* @__PURE__ */ new Map();
+  for (const c of concerns) {
+    const site = siteOf(c, read3);
+    session.siteById.set(c.id, site);
+    const key = concernKeyOf(c);
+    if (first.has(key)) continue;
+    const sites = fresh.get(key) ?? /* @__PURE__ */ new Set();
+    sites.add(site);
+    fresh.set(key, sites);
+  }
+  for (const [key, sites] of fresh) first.set(key, sites);
+}
+function resolvedAtSite(params) {
+  const firingByKey = /* @__PURE__ */ new Map();
+  for (const c of params.current) {
+    const list = firingByKey.get(c.key) ?? [];
+    list.push(c.site);
+    firingByKey.set(c.key, list);
+  }
+  const out = [];
+  for (const r of params.requested) {
+    if (r.site === null || r.file === void 0) continue;
+    const firing = firingByKey.get(r.key) ?? [];
+    const known = params.firstSites.get(r.key);
+    if (known === void 0) continue;
+    if (firing.some((s) => s === null || !known.has(s))) continue;
+    if (firing.includes(r.site)) continue;
+    if (!params.declared(r.file).has(r.site)) continue;
+    out.push(r.id);
+  }
+  return out;
+}
+
 // src/mcp/terraform/concernResult.ts
 function annotateConcerns(rawConcerns, opts) {
   const inScope = opts.inScope ?? (() => true);
@@ -276923,6 +276983,7 @@ function buildConcernResult(ctx, rawConcerns, opts) {
     fullBaseline.map((c) => concernKeyOf(c))
   );
   recordConcernKeys(session, fullBaseline);
+  recordConcernSites(session, fullBaseline, opts.cwd);
   session.baselineFmtDriftFiles = union3(
     session.baselineFmtDriftFiles,
     fullBaseline.filter((c) => c.source === "terraform-fmt").map((c) => c.location.file)
@@ -277373,7 +277434,7 @@ function readTfFiles(cwd) {
   const out = [];
   for (const file2 of walkTfFiles(cwd)) {
     try {
-      out.push({ file: file2, hcl: readFileSync17(join27(cwd, file2), "utf8") });
+      out.push({ file: file2, hcl: readFileSync18(join28(cwd, file2), "utf8") });
     } catch {
     }
   }
@@ -277390,7 +277451,7 @@ function DetectPlanDriftTool(ctx) {
       const planPath = path15 || !envPlanPath ? resolveWithinCwd(cwd, path15 ?? "plan.json") : envPlanPath;
       let raw2;
       try {
-        raw2 = readFileSync17(planPath, "utf8");
+        raw2 = readFileSync18(planPath, "utf8");
       } catch {
         return skipResult(
           "plan_artifact_not_found",
@@ -277522,13 +277583,13 @@ function DetectPlanDriftTool(ctx) {
 }
 
 // src/mcp/terraform/tools/emitCost.ts
-import { readFileSync as readFileSync19, writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join29 } from "node:path";
+import { readFileSync as readFileSync20, writeFileSync as writeFileSync4 } from "node:fs";
+import { join as join30 } from "node:path";
 
 // src/mcp/guardrails.ts
 import { spawnSync as spawnSync5 } from "node:child_process";
-import { readFileSync as readFileSync18, rmSync as rmSync2 } from "node:fs";
-import { join as join28 } from "node:path";
+import { readFileSync as readFileSync19, rmSync as rmSync2 } from "node:fs";
+import { join as join29 } from "node:path";
 
 // src/mcp/terraform/emittedArtefacts.ts
 import { createHash as createHash6 } from "node:crypto";
@@ -277830,7 +277891,7 @@ function parseGitleaksReport(json5) {
   return hits;
 }
 function scanWithGitleaks(ctx, base) {
-  const reportPath = join28(ctx.tmpdir, `gitleaks-report-${process.pid}.json`);
+  const reportPath = join29(ctx.tmpdir, `gitleaks-report-${process.pid}.json`);
   const cwd = ctx.payload.cwd ?? process.cwd();
   const result = spawnSync5(
     "gitleaks",
@@ -277864,7 +277925,7 @@ function scanWithGitleaks(ctx, base) {
     return null;
   }
   try {
-    const report2 = readFileSync18(reportPath, "utf8");
+    const report2 = readFileSync19(reportPath, "utf8");
     return parseGitleaksReport(report2);
   } catch {
     return [];
@@ -277936,7 +277997,7 @@ function assertNoForeignDialectIntroduced(ctx) {
     const file2 = rel.replace(/\\/g, "/");
     if (changedSet.has(file2)) continue;
     try {
-      established.push(...findDialectMarkers(readFileSync18(join28(cwd, rel), "utf8"), file2));
+      established.push(...findDialectMarkers(readFileSync19(join29(cwd, rel), "utf8"), file2));
     } catch {
     }
   }
@@ -278310,7 +278371,7 @@ var OpenPrOverlapError = class extends Error {
 // src/mcp/terraform/awsPrices.ts
 var AWS_PRICE_REGION = "eu-west-2";
 var AWS_PRICE_CURRENCY = "USD";
-var AWS_PRICE_FETCHED_AT = "2026-09-23";
+var AWS_PRICE_FETCHED_AT = "2026-10-03";
 var AWS_HOURLY_PRICES = {
   "eks-cluster-standard": 0.1,
   "elb-application": 0.02646,
@@ -278328,30 +278389,30 @@ var AWS_PER_GB_PRICES = {
 // src/mcp/terraform/azurePrices.ts
 var AZURE_PRICE_REGION = "westeurope";
 var AZURE_PRICE_CURRENCY = "EUR";
-var AZURE_PRICE_FETCHED_AT = "2026-09-03";
+var AZURE_PRICE_FETCHED_AT = "2026-10-03";
 var AZURE_HOURLY_PRICES = {
-  "app-service-p0v3": 0.0764,
-  "app-service-p1v3": 0.1528,
-  "app-service-p2v3": 0.3057,
-  "app-service-p3v3": 0.6114,
-  "bastion-basic": 0.1631,
-  "bastion-premium": 0.3864,
-  "bastion-standard": 0.249,
-  "firewall-basic": 0.3392,
-  "firewall-premium": 1.5027,
-  "firewall-standard": 1.0733,
-  "redis-c0": 0.0236,
-  "redis-c1": 0.0592,
-  "redis-c2": 0.0962,
-  "redis-c3": 0.1932,
-  "redis-p1": 0.2378,
-  "redis-p2": 0.4766,
-  "redis-p3": 0.9523,
-  "vpn-gateway-vpngw1": 0.1631,
-  "vpn-gateway-vpngw2": 0.4207,
-  "vpn-gateway-vpngw3": 1.0733,
-  "vpn-gateway-vpngw4": 1.8032,
-  "vpn-gateway-vpngw5": 3.1341
+  "app-service-p0v3": 0.0783,
+  "app-service-p1v3": 0.1566,
+  "app-service-p2v3": 0.3133,
+  "app-service-p3v3": 0.6265,
+  "bastion-basic": 0.1672,
+  "bastion-premium": 0.396,
+  "bastion-standard": 0.2552,
+  "firewall-basic": 0.3476,
+  "firewall-premium": 1.54,
+  "firewall-standard": 1.1,
+  "redis-c0": 0.0242,
+  "redis-c1": 0.0607,
+  "redis-c2": 0.0986,
+  "redis-c3": 0.198,
+  "redis-p1": 0.2438,
+  "redis-p2": 0.4884,
+  "redis-p3": 0.9759,
+  "vpn-gateway-vpngw1": 0.1672,
+  "vpn-gateway-vpngw2": 0.4312,
+  "vpn-gateway-vpngw3": 1.1,
+  "vpn-gateway-vpngw4": 1.8479,
+  "vpn-gateway-vpngw5": 3.2119
 };
 
 // src/mcp/terraform/idleFloor.ts
@@ -278629,7 +278690,7 @@ function readTfFiles2(cwd) {
   const out = [];
   for (const file2 of walkTfFiles(cwd)) {
     try {
-      out.push({ file: file2, hcl: readFileSync19(join29(cwd, file2), "utf8") });
+      out.push({ file: file2, hcl: readFileSync20(join30(cwd, file2), "utf8") });
     } catch {
     }
   }
@@ -279396,12 +279457,12 @@ import { writeFileSync as writeFileSync5 } from "node:fs";
 
 // src/mcp/terraform/lineage.ts
 import { createHash as createHash10 } from "node:crypto";
-import { readFileSync as readFileSync20 } from "node:fs";
-import { join as join30 } from "node:path";
+import { readFileSync as readFileSync21 } from "node:fs";
+import { join as join31 } from "node:path";
 function repoFileReader(cwd) {
   return (rel) => {
     try {
-      return readFileSync20(join30(cwd, rel), "utf-8");
+      return readFileSync21(join31(cwd, rel), "utf-8");
     } catch {
       return null;
     }
@@ -279954,11 +280015,11 @@ function TerraformEmitVexTool(ctx) {
 // src/mcp/terraform/tools/equivalenceCheck.ts
 import { mkdtempSync as mkdtempSync2, rmSync as rmSync4 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join32 } from "node:path";
+import { join as join33 } from "node:path";
 
 // src/mcp/terraform/initArtefacts.ts
 import { rmSync as rmSync3 } from "node:fs";
-import { join as join31, posix as posix9 } from "node:path";
+import { join as join32, posix as posix9 } from "node:path";
 var INIT_ARTEFACTS = /* @__PURE__ */ new Set([".terraform", ".terraform.lock.hcl"]);
 function initArtefacts(cwd) {
   const r = run("git", ["status", "--porcelain=v1", "-z", "--untracked-files=normal"], cwd);
@@ -279981,7 +280042,7 @@ function removeNewInitArtefacts(cwd, before, by) {
   const created = [...after?.untracked ?? []].filter((p) => !before.untracked.has(p));
   const changed = [...after?.modifiedLocks ?? []].filter((p) => !before.modifiedLocks.has(p));
   if (!top || created.length + changed.length === 0) return;
-  for (const p of created) rmSync3(join31(top, p), { recursive: true, force: true });
+  for (const p of created) rmSync3(join32(top, p), { recursive: true, force: true });
   if (changed.length > 0) run("git", ["checkout", "--", ...changed], top);
   resetTerraformInitCache();
   log2.info(
@@ -281779,12 +281840,12 @@ async function baselineValidateErrors(cwd, base, env2, session) {
   }
   const prefix2 = run("git", ["rev-parse", "--show-prefix"], cwd);
   if (prefix2.status !== 0) return null;
-  const tree = mkdtempSync2(join32(tmpdir2(), "iw-baseline-"));
+  const tree = mkdtempSync2(join33(tmpdir2(), "iw-baseline-"));
   try {
     if (run("git", ["worktree", "add", "--detach", "--quiet", tree, base], cwd).status !== 0) {
       return null;
     }
-    const outcome2 = await scanValidate(join32(tree, prefix2.stdout.trim()), env2);
+    const outcome2 = await scanValidate(join33(tree, prefix2.stdout.trim()), env2);
     if (!outcome2.ran || outcome2.unvalidated) return null;
     const errors = outcome2.concerns.map(validateErrorKey);
     session.baselineValidateErrors = { base, errors };
@@ -281885,7 +281946,7 @@ function TerraformGenerateMovedTool(ctx) {
 
 // src/mcp/terraform/cost.ts
 import { mkdtempSync as mkdtempSync3, rmSync as rmSync5 } from "node:fs";
-import { join as join33 } from "node:path";
+import { join as join34 } from "node:path";
 function parseInfracostBreakdown(stdout) {
   const parsed2 = parseScannerJson(InfracostBreakdownOutput, stdout, "infracost");
   const raw2 = parsed2.totalMonthlyCost;
@@ -281967,15 +282028,15 @@ async function infracostBaseline(cwd, key, tmpdir6) {
   if (!baseRef) return null;
   const prefixResult = run("git", ["rev-parse", "--show-prefix"], cwd);
   const prefix2 = prefixResult.status === 0 ? prefixResult.stdout.trim() : "";
-  const baseDir = mkdtempSync3(join33(tmpdir6, "infracost-base-"));
-  const worktree = join33(baseDir, "wt");
+  const baseDir = mkdtempSync3(join34(tmpdir6, "infracost-base-"));
+  const worktree = join34(baseDir, "wt");
   const add = run("git", ["worktree", "add", "--detach", worktree, baseRef], cwd);
   if (add.status !== 0) {
     rmSync5(baseDir, { recursive: true, force: true });
     return null;
   }
   try {
-    const scanCwd = prefix2 ? join33(worktree, prefix2) : worktree;
+    const scanCwd = prefix2 ? join34(worktree, prefix2) : worktree;
     const r = await runInfracostBreakdown(scanCwd, key);
     if (r.missing || r.status !== 0) return null;
     return parseInfracostBreakdown(r.stdout);
@@ -282046,7 +282107,7 @@ function InfracostDiffTool(ctx) {
 
 // src/mcp/terraform/tools/ingestExternalFindings.ts
 import { statSync as statSync7 } from "node:fs";
-import { join as join34 } from "node:path";
+import { join as join35 } from "node:path";
 
 // src/mcp/terraform/prowlerOcsf.ts
 var DETECTION_FINDING_CREATE = 200401;
@@ -282272,7 +282333,7 @@ var MAX_FEED_BYTES = 100 * 1024 * 1024;
 function readTfFiles3(cwd) {
   const out = [];
   for (const file2 of walkTfFiles(cwd)) {
-    const hcl2 = readTextCapped(join34(cwd, file2));
+    const hcl2 = readTextCapped(join35(cwd, file2));
     if (hcl2 !== null) out.push({ file: file2, hcl: hcl2 });
   }
   return out;
@@ -282429,8 +282490,8 @@ function IngestExternalFindingsTool(ctx) {
 }
 
 // src/mcp/terraform/tools/moduleDocs.ts
-import { readFileSync as readFileSync21, writeFileSync as writeFileSync6 } from "node:fs";
-import { join as join35 } from "node:path";
+import { readFileSync as readFileSync22, writeFileSync as writeFileSync6 } from "node:fs";
+import { join as join36 } from "node:path";
 
 // src/mcp/terraform/moduleDocs.ts
 var VERDICT_CLAIM = {
@@ -282544,7 +282605,7 @@ function TerraformModuleDocsTool(ctx) {
         );
       }
       const absDir = resolveWithinCwd(cwd, module_dir);
-      const target = join35(absDir, "README.md");
+      const target = join36(absDir, "README.md");
       let gitHead = null;
       try {
         gitHead = $("git", ["rev-parse", "HEAD"], { cwd, log: false });
@@ -282552,7 +282613,7 @@ function TerraformModuleDocsTool(ctx) {
       }
       let existing = null;
       try {
-        existing = readFileSync21(target, "utf8");
+        existing = readFileSync22(target, "utf8");
       } catch {
       }
       const priorHead = readFooterGitHead(existing);
@@ -282876,7 +282937,7 @@ function NormalizationCandidatesTool(ctx) {
 
 // src/mcp/terraform/tools/plan.ts
 import { rmSync as rmSync6 } from "node:fs";
-import { join as join36 } from "node:path";
+import { join as join37 } from "node:path";
 var PLAN_JSON_ARGS = ["plan", "-input=false", "-no-color", "-lock=false", "-json"];
 var planFileSeq = 0;
 async function capturePlanPairs(absDir, planFile, creds) {
@@ -282899,7 +282960,7 @@ async function planOneRoot(absDir, creds, tmpdir6) {
       skipReason: `terraform init failed: ${init.stderr.trim().slice(0, 200) || "unknown error"}`
     };
   }
-  const planFile = tmpdir6 ? join36(tmpdir6, `plan-${process.pid}-${planFileSeq++}.tfplan`) : void 0;
+  const planFile = tmpdir6 ? join37(tmpdir6, `plan-${process.pid}-${planFileSeq++}.tfplan`) : void 0;
   const plan = await runTfAsync(
     planFile ? [...PLAN_JSON_ARGS, `-out=${planFile}`] : PLAN_JSON_ARGS,
     absDir,
@@ -283269,8 +283330,8 @@ function TerraformProviderUpgradeTool(ctx) {
 }
 
 // src/mcp/terraform/tfquery.ts
-import { readFileSync as readFileSync22 } from "node:fs";
-import { join as join37 } from "node:path";
+import { readFileSync as readFileSync23 } from "node:fs";
+import { join as join38 } from "node:path";
 var TFQUERY_SUFFIX = ".tfquery.hcl";
 function parseQueryFile(hcl2) {
   return parseBlocks(hcl2, ["list"]).map((block) => {
@@ -283296,7 +283357,7 @@ function collectQueryInventory(cwd) {
   for (const rel of walkFilesBySuffix(cwd, TFQUERY_SUFFIX)) {
     let text;
     try {
-      text = readFileSync22(join37(cwd, rel), "utf8");
+      text = readFileSync23(join38(cwd, rel), "utf8");
     } catch {
       continue;
     }
@@ -283331,7 +283392,7 @@ function TerraformQueryInventoryTool(ctx) {
 }
 
 // src/mcp/terraform/tools/readFindings.ts
-import { readFileSync as readFileSync23 } from "node:fs";
+import { readFileSync as readFileSync24 } from "node:fs";
 var ReadFindingsParams = type({
   "path?": type.string.describe(
     "path to the Assessor's findings.json. Defaults to $INFRAWEAVER_FINDINGS_PATH, then ./findings.json in the workspace."
@@ -283356,7 +283417,7 @@ function ReadFindingsTool(ctx) {
       const findingsPath = path15 || !envFindingsPath ? resolveWithinCwd(cwd, path15 ?? "findings.json") : envFindingsPath;
       let raw2;
       try {
-        raw2 = readFileSync23(findingsPath, "utf8");
+        raw2 = readFileSync24(findingsPath, "utf8");
       } catch {
         return skipResult(
           "findings_not_found",
@@ -283755,8 +283816,8 @@ function describe3(f) {
 }
 
 // src/mcp/terraform/tools/scan.ts
-import { readFileSync as readFileSync24 } from "node:fs";
-import { join as join38 } from "node:path";
+import { readFileSync as readFileSync25 } from "node:fs";
+import { join as join39 } from "node:path";
 
 // src/mcp/terraform/noiseProfile.ts
 var MIN_DISMISSAL_REPOS = 3;
@@ -283942,7 +284003,7 @@ async function runScan(ctx, {
     outcomes.flatMap((o) => o.concerns),
     (rel) => {
       try {
-        return readFileSync24(join38(cwd, rel), "utf-8");
+        return readFileSync25(join39(cwd, rel), "utf-8");
       } catch {
         return null;
       }
@@ -284460,8 +284521,8 @@ function TerraformStandardsReportTool(ctx) {
 
 // src/mcp/terraform/tools/tag.ts
 import { createHash as createHash11 } from "node:crypto";
-import { existsSync as existsSync9, readdirSync as readdirSync8, readFileSync as readFileSync25, realpathSync as realpathSync2, rmSync as rmSync7 } from "node:fs";
-import { isAbsolute as isAbsolute3, join as join39, relative as relative5, resolve as resolve6, sep as sep2 } from "node:path";
+import { existsSync as existsSync9, readdirSync as readdirSync8, readFileSync as readFileSync26, realpathSync as realpathSync2, rmSync as rmSync7 } from "node:fs";
+import { isAbsolute as isAbsolute3, join as join40, relative as relative5, resolve as resolve6, sep as sep2 } from "node:path";
 var TerraformTagParams = type({
   tags: type({ "[string]": "string" }).describe(
     'the tag set to apply, key \u2192 value (e.g. {"Owner":"platform","CostCentre":"1234"}); merged into every taggable resource\'s `tags`'
@@ -284482,24 +284543,24 @@ var TerraformTagParams = type({
 var realRunners3 = { run };
 function sha(path15) {
   try {
-    return createHash11("sha256").update(readFileSync25(path15)).digest("hex");
+    return createHash11("sha256").update(readFileSync26(path15)).digest("hex");
   } catch {
     return null;
   }
 }
 function snapshot2(cwd, files) {
-  return new Map(files.map((f) => [f, sha(join39(cwd, f))]));
+  return new Map(files.map((f) => [f, sha(join40(cwd, f))]));
 }
 function toPosix(p) {
   return p.split(sep2).join("/");
 }
 function terratagFiles(dir) {
   const dirs = [dir];
-  const manifest = join39(dir, ".terraform", "modules", "modules.json");
+  const manifest = join40(dir, ".terraform", "modules", "modules.json");
   if (existsSync9(manifest)) {
     let modules;
     try {
-      modules = JSON.parse(readFileSync25(manifest, "utf8")).Modules;
+      modules = JSON.parse(readFileSync26(manifest, "utf8")).Modules;
     } catch {
       throw new Error(`terraform_tag refused: cannot read ${manifest} (re-run terraform init)`);
     }
@@ -284507,7 +284568,7 @@ function terratagFiles(dir) {
       const moduleDir = m?.Dir;
       if (typeof moduleDir !== "string") continue;
       try {
-        dirs.push(realpathSync2(join39(dir, moduleDir)));
+        dirs.push(realpathSync2(join40(dir, moduleDir)));
       } catch {
       }
     }
@@ -284515,7 +284576,7 @@ function terratagFiles(dir) {
   const files = /* @__PURE__ */ new Set();
   for (const d of dirs) {
     for (const name of readdirSync8(d)) {
-      if (name.endsWith(".tf")) files.add(realpathSync2(join39(d, name)));
+      if (name.endsWith(".tf")) files.add(realpathSync2(join40(d, name)));
     }
   }
   return [...files];
@@ -284582,7 +284643,7 @@ function runTag(ctx, params, runners = realRunners3) {
   if (params.filter) args2.push(`-filter=${params.filter}`);
   if (params.skip) args2.push(`-skip=${params.skip}`);
   const before = snapshot2(cwd, files);
-  const priorBackups = new Set(files.filter((f) => existsSync9(join39(cwd, `${f}.bak`))));
+  const priorBackups = new Set(files.filter((f) => existsSync9(join40(cwd, `${f}.bak`))));
   const r = runners.run("terratag", args2, cwd);
   if (r.missing) {
     return toolSkip(
@@ -284596,7 +284657,7 @@ function runTag(ctx, params, runners = realRunners3) {
 ${tail}` : ""}`);
   }
   for (const f of files) {
-    if (!priorBackups.has(f)) rmSync7(join39(cwd, `${f}.bak`), { force: true });
+    if (!priorBackups.has(f)) rmSync7(join40(cwd, `${f}.bak`), { force: true });
   }
   const failed = [
     ...`${r.stderr}
@@ -284767,7 +284828,25 @@ async function runVerifyRemediation(ctx, { concern_ids, download_external_module
     if (key !== void 0) keyed.push({ id, key });
     else unkeyed.push(id);
   }
-  const keyedVerdict = partitionByKey(keyed, currentKeys);
+  const byKey = partitionByKey(keyed, currentKeys);
+  const read3 = fileReader(cwd);
+  const remainingKeyed = keyed.filter((k) => byKey.remaining.includes(k.id));
+  const atSite = new Set(
+    resolvedAtSite({
+      requested: remainingKeyed.map((k) => ({
+        ...k,
+        site: session.siteById?.get(k.id) ?? null,
+        file: reported.get(k.id)?.location.file
+      })),
+      current: currentConcerns.map((c) => ({ key: concernKeyOf(c), site: siteOf(c, read3) })),
+      firstSites: session.firstSitesByKey ?? /* @__PURE__ */ new Map(),
+      declared: (file2) => new Set(declaredAddresses(read3(file2) ?? ""))
+    })
+  );
+  const keyedVerdict = {
+    resolved: [...byKey.resolved, ...byKey.remaining.filter((id) => atSite.has(id))],
+    remaining: byKey.remaining.filter((id) => !atSite.has(id))
+  };
   const fallbackVerdict = computeRemediationVerdict(unkeyed, new Set(currentIds));
   const resolved = [...keyedVerdict.resolved, ...fallbackVerdict.resolved];
   const remaining = [...keyedVerdict.remaining, ...fallbackVerdict.remaining];
@@ -285117,7 +285196,7 @@ function buildLocalContext(options) {
       registryHost: options.registryHost
     },
     toolState: initToolState({ progressComment: void 0 }),
-    tmpdir: mkdtempSync4(join40(tmpdir3(), `${PRODUCT_SLUG}-mcp-`))
+    tmpdir: mkdtempSync4(join41(tmpdir3(), `${PRODUCT_SLUG}-mcp-`))
   };
 }
 function buildLocalTools(ctx) {
@@ -285160,7 +285239,7 @@ function buildLocalTools(ctx) {
   ];
 }
 function cliVersion() {
-  const raw2 = "0.3.11";
+  const raw2 = "0.3.12";
   if (raw2 !== void 0 && /^\d+\.\d+\.\d+$/.test(raw2)) {
     return raw2;
   }
@@ -285391,15 +285470,15 @@ ${postureLine(scorecard.posture, scorecard.total)} \u2014 failing the gate (--fa
 }
 
 // src/commands/explain.ts
-import { readFileSync as readFileSync26 } from "node:fs";
-import { join as join41, relative as relative6, resolve as resolve8 } from "node:path";
+import { readFileSync as readFileSync27 } from "node:fs";
+import { join as join42, relative as relative6, resolve as resolve8 } from "node:path";
 var import_arg2 = __toESM(require_arg(), 1);
 var import_yaml3 = __toESM(require_dist(), 1);
 function readConfig(cwd) {
   for (const name of INFRAWEAVER_CONFIG_FILENAMES) {
     let raw2;
     try {
-      raw2 = readFileSync26(join41(cwd, name), "utf-8");
+      raw2 = readFileSync27(join42(cwd, name), "utf-8");
     } catch {
       continue;
     }
@@ -285574,7 +285653,7 @@ var import_arg3 = __toESM(require_arg(), 1);
 // node_modules/.pnpm/@infraweaver-io+ci@0.1.8/node_modules/@infraweaver-io/ci/dist/gitAuth.js
 import { execSync } from "node:child_process";
 import { createHash as createHash12 } from "node:crypto";
-import { readFileSync as readFileSync27, realpathSync as realpathSync3, unlinkSync } from "node:fs";
+import { readFileSync as readFileSync28, realpathSync as realpathSync3, unlinkSync } from "node:fs";
 
 // node_modules/.pnpm/@infraweaver-io+sandbox@0.1.8/node_modules/@infraweaver-io/sandbox/dist/subprocess.js
 import { spawn as nodeSpawn } from "node:child_process";
@@ -285900,7 +285979,7 @@ ${errMsg}` : errMsg;
 // node_modules/.pnpm/@infraweaver-io+ci@0.1.8/node_modules/@infraweaver-io/ci/dist/gitAuth.js
 var gitBinary;
 function hashFile(path15) {
-  return createHash12("sha256").update(readFileSync27(path15)).digest("hex");
+  return createHash12("sha256").update(readFileSync28(path15)).digest("hex");
 }
 function resolveGit() {
   const lookup3 = process.platform === "win32" ? "where git" : "which git";
@@ -286022,7 +286101,7 @@ async function $gitFetchWithDeepen(args2, options, label) {
 import { randomUUID as randomUUID3 } from "node:crypto";
 import { writeFileSync as writeFileSync7 } from "node:fs";
 import { createServer } from "node:http";
-import { join as join42 } from "node:path";
+import { join as join43 } from "node:path";
 var REVOKED_TRAP_MS = 6e4;
 function revokeGitHubToken(token, userAgent2) {
   const apiBase = process.env.GITHUB_API_URL || "https://api.github.com";
@@ -286094,7 +286173,7 @@ async function startGitAuthServer(tmpdir6, options) {
   function writeAskpassScript(code2) {
     const scriptId = randomUUID3();
     const scriptName = `askpass-${scriptId}.js`;
-    const scriptPath = join42(tmpdir6, scriptName);
+    const scriptPath = join43(tmpdir6, scriptName);
     const content = [
       `#!/usr/bin/env node`,
       `var a=process.argv[2]||"";`,
@@ -286275,7 +286354,7 @@ function TerraformChangeSummaryTool(ctx) {
 // src/mcp/checkout.ts
 import { createHash as createHash13 } from "node:crypto";
 import { statSync as statSync9, unlinkSync as unlinkSync3, writeFileSync as writeFileSync13 } from "node:fs";
-import { join as join52 } from "node:path";
+import { join as join53 } from "node:path";
 
 // node_modules/.pnpm/@infraweaver-io+ci@0.1.8/node_modules/@infraweaver-io/ci/dist/diffCoverage.js
 import { isAbsolute as isAbsolute5, normalize as normalize4, resolve as resolve9 } from "node:path";
@@ -286571,7 +286650,7 @@ function readNumber(params) {
 // src/mcp/git.ts
 import { randomUUID as randomUUID5 } from "node:crypto";
 import { writeFileSync as writeFileSync9 } from "node:fs";
-import { join as join45 } from "node:path";
+import { join as join46 } from "node:path";
 
 // src/modes/address-reviews.ts
 function addressReviewsMode(t) {
@@ -288074,14 +288153,14 @@ import { spawn as spawn3, spawnSync as spawnSync6 } from "node:child_process";
 import { randomUUID as randomUUID4 } from "node:crypto";
 import { closeSync as closeSync3, openSync as openSync3, writeFileSync as writeFileSync8 } from "node:fs";
 import { constants as osConstants, userInfo } from "node:os";
-import { join as join44 } from "node:path";
+import { join as join45 } from "node:path";
 import { setTimeout as sleep3 } from "node:timers/promises";
 
 // node_modules/.pnpm/@infraweaver-io+core@0.1.5/node_modules/@infraweaver-io/core/dist/packageManager.js
 var import_semver = __toESM(require_semver2(), 1);
 import { existsSync as existsSync11 } from "node:fs";
 import { mkdir as mkdir2, readFile } from "node:fs/promises";
-import { delimiter as delimiter2, join as join43 } from "node:path";
+import { delimiter as delimiter2, join as join44 } from "node:path";
 var SUPPORTED_NAMES = ["npm", "pnpm", "yarn", "bun"];
 var COREPACK_MANAGED = ["pnpm", "yarn"];
 function isSupported(name) {
@@ -288121,7 +288200,7 @@ function parseDevEnginesField(field) {
   };
 }
 async function resolvePackageManagerSpec(cwd) {
-  const pkgPath = join43(cwd, "package.json");
+  const pkgPath = join44(cwd, "package.json");
   if (!existsSync11(pkgPath))
     return null;
   let pkg;
@@ -288180,7 +288259,7 @@ async function currentVersion(run4, name) {
   return result.stdout.trim();
 }
 function packageManagerBinDir(tmpdir6) {
-  return join43(tmpdir6, "pm-bin");
+  return join44(tmpdir6, "pm-bin");
 }
 async function ensurePackageManager(params) {
   const spec = params.spec;
@@ -288421,7 +288500,7 @@ async function killProcessGroup(proc) {
 var MAX_OUTPUT_CHARS = 5e3;
 function capOutput(output2) {
   if (output2.length <= MAX_OUTPUT_CHARS) return output2;
-  const fullPath = join44(getTempDir(), `shell-${randomUUID4().slice(0, 8)}.log`);
+  const fullPath = join45(getTempDir(), `shell-${randomUUID4().slice(0, 8)}.log`);
   writeFileSync8(fullPath, output2);
   const elided = output2.length - MAX_OUTPUT_CHARS;
   return `... [${elided} chars truncated; output saved to ${fullPath}] ...
@@ -288487,8 +288566,8 @@ Do NOT use this tool for git commands \u2014 use the dedicated git tools instead
       if (params.background) {
         const tempDir = getTempDir();
         const handle = `bg-${randomUUID4().slice(0, 8)}`;
-        const outputPath = join44(tempDir, `${handle}.log`);
-        const pidPath = join44(tempDir, `${handle}.pid`);
+        const outputPath = join45(tempDir, `${handle}.log`);
+        const pidPath = join45(tempDir, `${handle}.pid`);
         const logFd = openSync3(outputPath, "a");
         let proc;
         try {
@@ -289193,7 +289272,7 @@ function countAhead(head, base) {
 }
 function spillGitOutput(params) {
   const tempDir = getTempDir();
-  const outputPath = join45(tempDir, `git-${params.command}-${randomUUID5().slice(0, 8)}.txt`);
+  const outputPath = join46(tempDir, `git-${params.command}-${randomUUID5().slice(0, 8)}.txt`);
   writeFileSync9(outputPath, params.output);
   const previewByLines = params.output.split("\n").slice(0, OVERFLOW_PREVIEW_LINES).join("\n");
   const preview = previewByLines.length <= OVERFLOW_PREVIEW_MAX_CHARS ? previewByLines : `${previewByLines.slice(0, OVERFLOW_PREVIEW_MAX_CHARS)}\u2026`;
@@ -289408,7 +289487,7 @@ function PushTagsTool(ctx) {
 }
 
 // src/mcp/review.ts
-import { readFileSync as readFileSync32 } from "node:fs";
+import { readFileSync as readFileSync33 } from "node:fs";
 
 // src/mcp/findingAudit.ts
 var COHERENCE_RULES = {
@@ -289807,7 +289886,7 @@ function validateCompatibility(payloadVersion, actionVersion) {
 }
 
 // src/utils/github/prCommentEvent.ts
-import { readFileSync as readFileSync28 } from "node:fs";
+import { readFileSync as readFileSync29 } from "node:fs";
 var obj = (v) => typeof v === "object" && v !== null && !Array.isArray(v) ? v : void 0;
 function parsePrCommentEvent(eventName, raw2) {
   if (eventName !== "issue_comment") return void 0;
@@ -289836,7 +289915,7 @@ function readPrCommentEvent(env2 = process.env) {
   try {
     return parsePrCommentEvent(
       env2.GITHUB_EVENT_NAME,
-      JSON.parse(readFileSync28(env2.GITHUB_EVENT_PATH, "utf-8"))
+      JSON.parse(readFileSync29(env2.GITHUB_EVENT_PATH, "utf-8"))
     );
   } catch {
     return void 0;
@@ -289844,7 +289923,7 @@ function readPrCommentEvent(env2 = process.env) {
 }
 
 // src/utils/github/pullRequestEvent.ts
-import { readFileSync as readFileSync29 } from "node:fs";
+import { readFileSync as readFileSync30 } from "node:fs";
 var obj2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v) ? v : void 0;
 var str = (v) => typeof v === "string" && v ? v : void 0;
 function parsePullRequestEvent(eventName, raw2) {
@@ -289904,7 +289983,7 @@ function readPullRequestEvent(env2 = process.env) {
   if (env2.GITHUB_EVENT_NAME !== "pull_request" || !env2.GITHUB_EVENT_PATH) return void 0;
   let raw2;
   try {
-    raw2 = JSON.parse(readFileSync29(env2.GITHUB_EVENT_PATH, "utf-8"));
+    raw2 = JSON.parse(readFileSync30(env2.GITHUB_EVENT_PATH, "utf-8"));
   } catch {
     return void 0;
   }
@@ -291181,7 +291260,7 @@ function formatOverflowNote(overflow, limit) {
 
 // src/mcp/reviewComments.ts
 import { writeFileSync as writeFileSync10 } from "node:fs";
-import { join as join46 } from "node:path";
+import { join as join47 } from "node:path";
 
 // src/utils/github/body.ts
 var import_turndown = __toESM(require_turndown_cjs(), 1);
@@ -291865,7 +291944,7 @@ function GetReviewCommentsTool(ctx) {
       const { threadBlocks, reviewer, formatted, truncated } = result;
       const tempDir = getTempDir();
       const filename = `review-${params.review_id}-threads.md`;
-      const commentsPath = join46(tempDir, filename);
+      const commentsPath = join47(tempDir, filename);
       writeFileSync10(commentsPath, formatted.content);
       log2.debug(`wrote ${threadBlocks.length} threads to ${commentsPath}`);
       const truncationNote = truncated ? ` WARNING: this PR has more review threads/comments than a single fetch returns, so the set above is INCOMPLETE \u2014 some threads or comments are not included. Address what's here, but do not treat the list as exhaustive.` : "";
@@ -292161,8 +292240,8 @@ function renderReviewSummarySection(input2) {
 }
 
 // src/mcp/suggestionProver.ts
-import { mkdtempSync as mkdtempSync5, readFileSync as readFileSync30, rmSync as rmSync8, writeFileSync as writeFileSync11 } from "node:fs";
-import { join as join47, posix as posix14 } from "node:path";
+import { mkdtempSync as mkdtempSync5, readFileSync as readFileSync31, rmSync as rmSync8, writeFileSync as writeFileSync11 } from "node:fs";
+import { join as join48, posix as posix14 } from "node:path";
 var MAX_SINGLE_PROOFS = 4;
 async function proveSuggestions(input2, deps) {
   const out = /* @__PURE__ */ new Map();
@@ -292174,8 +292253,8 @@ async function proveSuggestions(input2, deps) {
     else ready.push(c);
   }
   if (ready.length === 0) return input2.candidates.map((c) => out.get(c.index));
-  const parent = mkdtempSync5(join47(input2.tmpdir, "suggestion-proof-"));
-  const worktree = join47(parent, "wt");
+  const parent = mkdtempSync5(join48(input2.tmpdir, "suggestion-proof-"));
+  const worktree = join48(parent, "wt");
   if (run("git", ["worktree", "add", "--detach", worktree, "HEAD"], input2.repoCwd).status !== 0) {
     rmSync8(parent, { recursive: true, force: true });
     for (const c of ready) {
@@ -292187,7 +292266,7 @@ async function proveSuggestions(input2, deps) {
     }
     return input2.candidates.map((c) => out.get(c.index));
   }
-  const scanCwd = prefix2 ? join47(worktree, prefix2) : worktree;
+  const scanCwd = prefix2 ? join48(worktree, prefix2) : worktree;
   const files = [...new Set(ready.map((c) => c.path.slice(prefix2.length)))];
   try {
     const before = await deps.scan(scanCwd, files);
@@ -292283,16 +292362,16 @@ function snapshot3(worktree, prefix2, cs) {
   const m = /* @__PURE__ */ new Map();
   for (const c of cs) {
     const rel = c.path.slice(prefix2.length);
-    if (!m.has(rel)) m.set(rel, readFileSync30(join47(worktree, c.path), "utf-8"));
+    if (!m.has(rel)) m.set(rel, readFileSync31(join48(worktree, c.path), "utf-8"));
   }
   return m;
 }
 function restore(worktree, prefix2, pristine) {
-  for (const [rel, text] of pristine) writeFileSync11(join47(worktree, prefix2, rel), text);
+  for (const [rel, text] of pristine) writeFileSync11(join48(worktree, prefix2, rel), text);
 }
 function apply(worktree, path15, cs) {
-  const file2 = join47(worktree, path15);
-  const text = readFileSync30(file2, "utf-8");
+  const file2 = join48(worktree, path15);
+  const text = readFileSync31(file2, "utf-8");
   const eol = text.includes("\r\n") ? "\r\n" : "\n";
   const lines = text.split(/\r?\n/);
   for (const c of [...cs].sort((a, b) => b.startLine - a.startLine)) {
@@ -292303,11 +292382,11 @@ function apply(worktree, path15, cs) {
 
 // src/mcp/terraform/gateScan.ts
 import { existsSync as existsSync12, mkdtempSync as mkdtempSync6, rmSync as rmSync10 } from "node:fs";
-import { join as join49, posix as posix15 } from "node:path";
+import { join as join50, posix as posix15 } from "node:path";
 
 // src/mcp/terraform/secretScan.ts
-import { readFileSync as readFileSync31, rmSync as rmSync9 } from "node:fs";
-import { join as join48 } from "node:path";
+import { readFileSync as readFileSync32, rmSync as rmSync9 } from "node:fs";
+import { join as join49 } from "node:path";
 function parseBetterleaksReport(json5, prefix2 = "") {
   const doc = JSON.parse(json5);
   if (Array.isArray(doc) || !doc || typeof doc !== "object" || !("findings" in doc)) {
@@ -292341,7 +292420,7 @@ async function scanAddedSecrets(cwd, mergeBase, tmp) {
   const top = run("git", ["rev-parse", "--show-toplevel"], cwd).stdout.trim();
   const prefix2 = run("git", ["rev-parse", "--show-prefix"], cwd).stdout.trim();
   if (!top) return { ran: false, reason: "not a git checkout", concerns: [] };
-  const report2 = join48(tmp, `betterleaks-${process.pid}.json`);
+  const report2 = join49(tmp, `betterleaks-${process.pid}.json`);
   try {
     const r = await runAsync(
       "betterleaks",
@@ -292364,7 +292443,7 @@ async function scanAddedSecrets(cwd, mergeBase, tmp) {
     const why = (r.stderr || r.stdout).trim().split("\n").pop() ?? "";
     let parsed2;
     try {
-      parsed2 = parseBetterleaksReport(readFileSync31(report2, "utf-8"), prefix2);
+      parsed2 = parseBetterleaksReport(readFileSync32(report2, "utf-8"), prefix2);
     } catch (error63) {
       const reason = r.status !== 0 ? `betterleaks exited ${r.status}: ${why}` : `${error63}`;
       return { ran: false, reason, concerns: [] };
@@ -292414,8 +292493,8 @@ function checkOutBase(cwd, pr, tmp) {
   }
   const mergeBase = run("git", ["merge-base", pr.baseSha, "HEAD"], cwd).stdout.trim() || pr.baseSha;
   const prefix2 = run("git", ["rev-parse", "--show-prefix"], cwd).stdout.trim();
-  const parent = mkdtempSync6(join49(tmp, "scan-delta-base-"));
-  const worktree = join49(parent, "wt");
+  const parent = mkdtempSync6(join50(tmp, "scan-delta-base-"));
+  const worktree = join50(parent, "wt");
   if (run("git", ["worktree", "add", "--detach", worktree, mergeBase], cwd).status !== 0) {
     rmSync10(parent, { recursive: true, force: true });
     log2.warning("\xBB scan delta: could not check out the base \u2014 every finding is treated as new.");
@@ -292423,7 +292502,7 @@ function checkOutBase(cwd, pr, tmp) {
   }
   return {
     mergeBase,
-    cwd: prefix2 ? join49(worktree, prefix2) : worktree,
+    cwd: prefix2 ? join50(worktree, prefix2) : worktree,
     close: () => {
       run("git", ["worktree", "remove", "--force", worktree], cwd);
       rmSync10(parent, { recursive: true, force: true });
@@ -293358,7 +293437,7 @@ ${coverageState.lastBreakdown}`
 }
 function readReviewedFile(path15) {
   try {
-    return readFileSync32(resolveWithinCwd(resolveRepoRoot(), path15), "utf-8");
+    return readFileSync33(resolveWithinCwd(resolveRepoRoot(), path15), "utf-8");
   } catch {
     return null;
   }
@@ -293673,7 +293752,7 @@ function fastForwardDiff(params, exec2) {
 
 // src/utils/prompt/changeImpact.ts
 import { writeFileSync as writeFileSync12 } from "node:fs";
-import { join as join50 } from "node:path";
+import { join as join51 } from "node:path";
 var MAX_ATOMS = 20;
 var MAX_REFS_PER_ATOM = 6;
 var MAX_EXCERPT = 160;
@@ -293853,7 +293932,7 @@ function createChangeImpactArtifact(params) {
     fileCount: params.files.length,
     lookupError
   });
-  const path15 = join50(
+  const path15 = join51(
     params.tmpdir,
     `pr-${params.pullNumber}-${params.headSha.slice(0, 7)}-impact.md`
   );
@@ -293873,7 +293952,7 @@ function createChangeImpactArtifact(params) {
 import { execFileSync, execSync as execSync2 } from "node:child_process";
 import { mkdtempSync as mkdtempSync7, readdirSync as readdirSync9, realpathSync as realpathSync5, unlinkSync as unlinkSync2 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
-import { join as join51 } from "node:path";
+import { join as join52 } from "node:path";
 
 // src/utils/github/ghaCore.ts
 import { randomUUID as randomUUID6 } from "node:crypto";
@@ -293896,7 +293975,7 @@ var TEMP_DIR_STATE_KEY = "infraweaver_temp_dir";
 
 // src/utils/setup/setup.ts
 function createTempDirectory() {
-  const sharedTempDir = mkdtempSync7(join51(tmpdir4(), `${PRODUCT_SLUG}-`));
+  const sharedTempDir = mkdtempSync7(join52(tmpdir4(), `${PRODUCT_SLUG}-`));
   process.env.INFRAWEAVER_TEMP_DIR = sharedTempDir;
   saveState2(TEMP_DIR_STATE_KEY, sharedTempDir);
   log2.info(`\xBB created temp dir at ${sharedTempDir}`);
@@ -293942,13 +294021,13 @@ function wipeRunnerLeakSurface() {
       return [];
     }
   };
-  const fileCommandsDir = join51(runnerTemp, "_runner_file_commands");
+  const fileCommandsDir = join52(runnerTemp, "_runner_file_commands");
   for (const entry4 of listDir(fileCommandsDir)) {
-    tryUnlink(join51(fileCommandsDir, entry4));
+    tryUnlink(join52(fileCommandsDir, entry4));
   }
   for (const entry4 of listDir(runnerTemp)) {
     if (entry4.endsWith(".sh") || /^git-credentials-.*\.config$/.test(entry4)) {
-      tryUnlink(join51(runnerTemp, entry4));
+      tryUnlink(join52(runnerTemp, entry4));
     }
   }
   if (wiped.length > 0) {
@@ -294447,7 +294526,7 @@ function CheckoutPrTool(ctx) {
         headSha: ctx.toolState.checkoutSha
       });
       if (incremental) {
-        incrementalDiffPath = join52(
+        incrementalDiffPath = join53(
           tempDir,
           `pr-${pull_number}-${beforeShort}-${headShort}-incremental.diff`
         );
@@ -294461,7 +294540,7 @@ function CheckoutPrTool(ctx) {
     const diffPreview = formatResult.content.split("\n").slice(0, 100).join("\n");
     log2.debug(`formatted diff preview (first 100 lines):
 ${diffPreview}`);
-    const diffPath = join52(tempDir, `pr-${pull_number}-${headShort}.diff`);
+    const diffPath = join53(tempDir, `pr-${pull_number}-${headShort}.diff`);
     writeFileSync13(diffPath, formatResult.content);
     log2.debug(`wrote diff to ${diffPath} (${formatResult.content.length} bytes)`);
     ctx.toolState.diffCoverage = createDiffCoverageState({
@@ -294602,7 +294681,7 @@ ${dirty}`
 
 // src/mcp/checkSuite.ts
 import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync14 } from "node:fs";
-import { join as join53 } from "node:path";
+import { join as join54 } from "node:path";
 import { stripVTControlCharacters } from "node:util";
 var GetCheckSuiteLogs = type({
   check_suite_id: type.number.describe("the id from check_suite.id")
@@ -294697,7 +294776,7 @@ function GetCheckSuiteLogsTool(ctx) {
         };
       }
       const tempDir = getTempDir();
-      const logsDir = join53(tempDir, "ci-logs");
+      const logsDir = join54(tempDir, "ci-logs");
       mkdirSync6(logsDir, { recursive: true });
       const jobLists = await mapWithConcurrency(
         failedRuns,
@@ -294721,7 +294800,7 @@ function GetCheckSuiteLogsTool(ctx) {
             request: { signal: AbortSignal.timeout(1e4) }
           });
           const logsText = typeof data === "string" ? data : Buffer.from(data).toString("utf8");
-          const logPath = join53(logsDir, `job-${job.id}.log`);
+          const logPath = join54(logsDir, `job-${job.id}.log`);
           writeFileSync14(logPath, logsText);
           const analysis = analyzeLog(logsText, 80);
           const failedSteps = job.steps?.filter((s) => s.conclusion === "failure").map((s) => `Step ${s.number}: ${s.name}`) ?? [];
@@ -294783,7 +294862,7 @@ function GetCheckSuiteLogsTool(ctx) {
 
 // src/mcp/commitInfo.ts
 import { writeFileSync as writeFileSync15 } from "node:fs";
-import { join as join54 } from "node:path";
+import { join as join55 } from "node:path";
 var CommitInfo = type({
   sha: type.string.describe("the commit SHA (full or abbreviated) to fetch")
 });
@@ -294802,7 +294881,7 @@ function CommitInfoTool(ctx) {
       const files = data.files ?? [];
       const formatResult = formatFilesWithLineNumbers(files);
       const tempDir = getTempDir("get_commit_info");
-      const diffFile = join54(tempDir, `commit-${sha2.slice(0, 7)}.diff`);
+      const diffFile = join55(tempDir, `commit-${sha2.slice(0, 7)}.diff`);
       writeFileSync15(diffFile, formatResult.content);
       log2.debug(`wrote commit diff to ${diffFile} (${formatResult.content.length} bytes)`);
       return {
@@ -294964,7 +295043,7 @@ import { performance as performance3 } from "node:perf_hooks";
 
 // src/prep/installNodeDependencies.ts
 import { existsSync as existsSync13 } from "node:fs";
-import { join as join55 } from "node:path";
+import { join as join56 } from "node:path";
 
 // node_modules/.pnpm/package-manager-detector@1.8.0/node_modules/package-manager-detector/dist/commands.mjs
 function splitRunArgs(args2, valueFlags = []) {
@@ -295350,7 +295429,7 @@ async function installFallback(name, installSpec) {
     return result.stderr || `failed to install ${name}`;
   }
   if (name === "deno") {
-    const denoPath = join55(process.env.HOME || "", ".deno", "bin");
+    const denoPath = join56(process.env.HOME || "", ".deno", "bin");
     process.env.PATH = `${denoPath}:${process.env.PATH}`;
   }
   log2.info(`\xBB installed ${name}`);
@@ -295359,7 +295438,7 @@ async function installFallback(name, installSpec) {
 var installNodeDependencies = {
   name: "installNodeDependencies",
   shouldRun: () => {
-    const packageJsonPath = join55(process.cwd(), "package.json");
+    const packageJsonPath = join56(process.cwd(), "package.json");
     return existsSync13(packageJsonPath);
   },
   run: async (options) => {
@@ -295468,8 +295547,8 @@ ${errorMessage2}`]
 };
 
 // src/prep/installPythonDependencies.ts
-import { existsSync as existsSync14, readFileSync as readFileSync33 } from "node:fs";
-import { join as join56 } from "node:path";
+import { existsSync as existsSync14, readFileSync as readFileSync34 } from "node:fs";
+import { join as join57 } from "node:path";
 var PYTHON_CONFIGS = [
   {
     file: "requirements.txt",
@@ -295504,7 +295583,7 @@ var PYTHON_CONFIGS = [
 ];
 function pyprojectDeclaresBuildSystem(cwd) {
   try {
-    const content = readFileSync33(join56(cwd, "pyproject.toml"), "utf8");
+    const content = readFileSync34(join57(cwd, "pyproject.toml"), "utf8");
     return /^\s*\[build-system\]/m.test(content);
   } catch {
     return false;
@@ -295554,13 +295633,13 @@ var installPythonDependencies = {
     }
     const cwd = process.cwd();
     return PYTHON_CONFIGS.some(
-      (config3) => existsSync14(join56(cwd, config3.file)) && configApplies(config3, cwd)
+      (config3) => existsSync14(join57(cwd, config3.file)) && configApplies(config3, cwd)
     );
   },
   run: async (options) => {
     const cwd = process.cwd();
     const config3 = PYTHON_CONFIGS.find(
-      (c) => existsSync14(join56(cwd, c.file)) && configApplies(c, cwd)
+      (c) => existsSync14(join57(cwd, c.file)) && configApplies(c, cwd)
     );
     if (!config3) {
       return {
@@ -296141,8 +296220,8 @@ function SetOutputTool(ctx, outputSchema) {
 
 // src/mcp/policy.ts
 import { spawnSync as spawnSync8 } from "node:child_process";
-import { existsSync as existsSync15, readFileSync as readFileSync34 } from "node:fs";
-import { join as join57 } from "node:path";
+import { existsSync as existsSync15, readFileSync as readFileSync35 } from "node:fs";
+import { join as join58 } from "node:path";
 function parseConftestOutput(stdout) {
   let parsed2;
   try {
@@ -296176,7 +296255,7 @@ var CONFTEST_CONFIG = "conftest.toml";
 function conftestSelectsNamespaces(conftestCwd) {
   let raw2;
   try {
-    raw2 = readFileSync34(join57(conftestCwd, CONFTEST_CONFIG), "utf-8");
+    raw2 = readFileSync35(join58(conftestCwd, CONFTEST_CONFIG), "utf-8");
   } catch {
     return false;
   }
@@ -296192,7 +296271,7 @@ function namespaceArgs(conftestCwd) {
 }
 function findPlanJson(cwd) {
   for (const candidate of PLAN_JSON_NAMES) {
-    const abs = join57(cwd, candidate);
+    const abs = join58(cwd, candidate);
     if (existsSync15(abs)) return abs;
   }
   return null;
@@ -296237,7 +296316,7 @@ function resolvePolicyDir(cwd, explicit) {
     return existsSync15(abs) ? abs : null;
   }
   for (const d of DEFAULT_POLICY_DIRS) {
-    const abs = join57(cwd, d);
+    const abs = join58(cwd, d);
     if (existsSync15(abs)) return abs;
   }
   return null;
@@ -296545,9 +296624,9 @@ function PullRequestInfoTool(ctx) {
 
 // node_modules/.pnpm/@infraweaver-io+sandbox@0.1.8/node_modules/@infraweaver-io/sandbox/dist/writePolicy.js
 import { renameSync, writeFileSync as writeFileSync16 } from "node:fs";
-import { join as join58 } from "node:path";
+import { join as join59 } from "node:path";
 function writePolicyPath(tmpdir6, filename) {
-  return join58(tmpdir6, filename);
+  return join59(tmpdir6, filename);
 }
 function publishWritePolicy(params) {
   try {
@@ -299867,11 +299946,11 @@ import {
   mkdirSync as mkdirSync7,
   mkdtempSync as mkdtempSync8,
   readdirSync as readdirSync10,
-  readFileSync as readFileSync36,
+  readFileSync as readFileSync37,
   writeFileSync as writeFileSync17
 } from "node:fs";
 import { tmpdir as osTmpdir } from "node:os";
-import { dirname as dirname8, isAbsolute as isAbsolute8, join as join60, relative as relative8, resolve as resolve11 } from "node:path";
+import { dirname as dirname8, isAbsolute as isAbsolute8, join as join61, relative as relative8, resolve as resolve11 } from "node:path";
 function coercePolicyRules(raw2) {
   const rules = [];
   const rejected = [];
@@ -300123,7 +300202,7 @@ function evaluateRulesStatically(cwd, rules, scope2 = { kind: "all", reason: ""
   const files = [];
   for (const rel of walk.files) {
     try {
-      files.push({ rel, text: readFileSync36(join60(cwd, rel), "utf-8") });
+      files.push({ rel, text: readFileSync37(join61(cwd, rel), "utf-8") });
     } catch {
     }
   }
@@ -300238,16 +300317,16 @@ function cloudEmittedRego(rules) {
 }
 function readOrEmpty(path15) {
   try {
-    return readFileSync36(path15, "utf-8");
+    return readFileSync37(path15, "utf-8");
   } catch {
     return "";
   }
 }
 function regoDirIn(root, skip) {
   for (const dir of DEFAULT_POLICY_DIRS) {
-    const abs = join60(root, dir);
+    const abs = join61(root, dir);
     if (existsSync16(abs) && walkFilesBySuffix(abs, ".rego").some(
-      (rel) => !skip(join60(dir, rel), readOrEmpty(join60(abs, rel)))
+      (rel) => !skip(join61(dir, rel), readOrEmpty(join61(abs, rel)))
     )) {
       return dir;
     }
@@ -300255,14 +300334,14 @@ function regoDirIn(root, skip) {
   return null;
 }
 function withoutSkipped(root, dir, skip, tmpdir6) {
-  const abs = join60(root, dir);
-  const files = readdirSync10(abs, { recursive: true, withFileTypes: true }).filter((e) => e.isFile()).map((e) => relative8(abs, join60(e.parentPath, e.name)));
-  const kept = files.filter((rel) => !skip(join60(dir, rel), readOrEmpty(join60(abs, rel))));
+  const abs = join61(root, dir);
+  const files = readdirSync10(abs, { recursive: true, withFileTypes: true }).filter((e) => e.isFile()).map((e) => relative8(abs, join61(e.parentPath, e.name)));
+  const kept = files.filter((rel) => !skip(join61(dir, rel), readOrEmpty(join61(abs, rel))));
   if (kept.length === files.length) return abs;
-  const copy = join60(mkdtempSync8(join60(tmpdir6 ?? osTmpdir(), "policy-own-")), dir);
+  const copy = join61(mkdtempSync8(join61(tmpdir6 ?? osTmpdir(), "policy-own-")), dir);
   for (const rel of kept) {
-    mkdirSync7(dirname8(join60(copy, rel)), { recursive: true });
-    writeFileSync17(join60(copy, rel), readFileSync36(join60(abs, rel)));
+    mkdirSync7(dirname8(join61(copy, rel)), { recursive: true });
+    writeFileSync17(join61(copy, rel), readFileSync37(join61(abs, rel)));
   }
   return copy;
 }
@@ -300284,18 +300363,18 @@ function resolveRepoPolicy(cwd, baseRef, tmpdir6, notes, skip) {
     }
     const own2 = tree.files.filter((f) => !skip(f.path, f.raw));
     if (!own2.some((f) => f.path.endsWith(".rego"))) continue;
-    const root = mkdtempSync8(join60(tmpdir6 ?? osTmpdir(), "policy-base-"));
+    const root = mkdtempSync8(join61(tmpdir6 ?? osTmpdir(), "policy-base-"));
     for (const f of own2) {
-      mkdirSync7(dirname8(join60(root, f.path)), { recursive: true });
-      writeFileSync17(join60(root, f.path), f.raw);
+      mkdirSync7(dirname8(join61(root, f.path)), { recursive: true });
+      writeFileSync17(join61(root, f.path), f.raw);
     }
     const toml = readFileAtBaseRef(cwd, baseRef, CONFTEST_CONFIG);
-    if (toml.kind === "file") writeFileSync17(join60(root, CONFTEST_CONFIG), toml.raw);
-    const same = head === dir && readdirSync10(join60(cwd, dir), { recursive: true, withFileTypes: true }).filter(
+    if (toml.kind === "file") writeFileSync17(join61(root, CONFTEST_CONFIG), toml.raw);
+    const same = head === dir && readdirSync10(join61(cwd, dir), { recursive: true, withFileTypes: true }).filter(
       (e) => e.isFile()
     ).length === tree.files.length && tree.files.every((f) => {
       try {
-        return readFileSync36(join60(cwd, f.path), "utf-8") === f.raw;
+        return readFileSync37(join61(cwd, f.path), "utf-8") === f.raw;
       } catch {
         return false;
       }
@@ -300305,7 +300384,7 @@ function resolveRepoPolicy(cwd, baseRef, tmpdir6, notes, skip) {
         `the Rego policy differs from the base ref (${tree.ref}) \u2014 applying the BASE ${dir}/ so this change cannot relax the policy reviewing it. It takes effect once merged.`
       );
     }
-    return { policyDir: join60(root, dir), conftestCwd: root };
+    return { policyDir: join61(root, dir), conftestCwd: root };
   }
   if (head) {
     notes.push(
@@ -300315,7 +300394,7 @@ function resolveRepoPolicy(cwd, baseRef, tmpdir6, notes, skip) {
   return null;
 }
 function findWorkflowPlanJson(cwd, notes) {
-  const present = PLAN_JSON_NAMES.filter((name) => existsSync16(join60(cwd, name)));
+  const present = PLAN_JSON_NAMES.filter((name) => existsSync16(join61(cwd, name)));
   if (present.length === 0) return null;
   const listing = run("git", ["ls-files", "-z"], cwd);
   if (listing.status !== 0) {
@@ -300332,7 +300411,7 @@ function findWorkflowPlanJson(cwd, notes) {
       );
       continue;
     }
-    return join60(cwd, name);
+    return join61(cwd, name);
   }
   return null;
 }
@@ -300362,7 +300441,7 @@ function evaluatePolicyGate(cwd, rawRules, opts = {}) {
   let plan;
   if (planPath) {
     try {
-      plan = asPlan(JSON.parse(readFileSync36(planPath, "utf-8")));
+      plan = asPlan(JSON.parse(readFileSync37(planPath, "utf-8")));
     } catch {
     }
     if (!plan) notes.push(`${planPath} is not a Terraform plan JSON \u2014 ignored`);
@@ -300465,7 +300544,7 @@ function capturePolicyGate(ctx) {
     if (!result) return;
     const workspace = process.env.GITHUB_WORKSPACE ?? cwd;
     for (const o of [...result.violations, ...result.inconclusive]) {
-      if (o.file) o.file = posix16(relative8(workspace, join60(cwd, o.file)));
+      if (o.file) o.file = posix16(relative8(workspace, join61(cwd, o.file)));
     }
     session.policyGate = result;
     for (const n of result.notes) log2.warning(`\xBB policy gate: ${n}`);
@@ -300800,7 +300879,7 @@ var ThinkingTimer = class {
 // src/agents/claude.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
 import { chmodSync as chmodSync3, mkdirSync as mkdirSync10, writeFileSync as writeFileSync22 } from "node:fs";
-import { join as join69 } from "node:path";
+import { join as join70 } from "node:path";
 import { performance as performance6 } from "node:perf_hooks";
 import { setTimeout as sleep6 } from "node:timers/promises";
 
@@ -301160,7 +301239,7 @@ import { readFile as readFile2 } from "node:fs/promises";
 
 // src/agents/shared.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { join as join61 } from "node:path";
+import { join as join62 } from "node:path";
 var MAX_STDERR_LINES = 20;
 var MAX_POST_RUN_RETRIES = 3;
 function getGitStatus() {
@@ -301197,7 +301276,7 @@ var agent = (input2) => {
   };
 };
 function agentHomeEnv(tmpdir6) {
-  return { HOME: tmpdir6, XDG_CONFIG_HOME: join61(tmpdir6, ".config") };
+  return { HOME: tmpdir6, XDG_CONFIG_HOME: join62(tmpdir6, ".config") };
 }
 function baseAgentEnv(homeEnv, repoDir) {
   return { ...process.env, ...homeEnv, PWD: repoDir };
@@ -301905,7 +301984,7 @@ function matchesRouteSentinel(envVar, model) {
 import { randomUUID as randomUUID9 } from "node:crypto";
 import { mkdirSync as mkdirSync8, rmSync as rmSync11, writeFileSync as writeFileSync18 } from "node:fs";
 import { homedir } from "node:os";
-import { join as join62 } from "node:path";
+import { join as join63 } from "node:path";
 var VERTEX_SERVICE_ACCOUNT_JSON_ENV = "VERTEX_SERVICE_ACCOUNT_JSON";
 var GOOGLE_APPLICATION_CREDENTIALS_ENV = "GOOGLE_APPLICATION_CREDENTIALS";
 var GOOGLE_CLOUD_PROJECT_ENV = "GOOGLE_CLOUD_PROJECT";
@@ -301929,7 +302008,7 @@ function readProjectIdFromVertexServiceAccountJson() {
 }
 function createSecretDir() {
   const base = process.env.INFRAWEAVER_SECRET_HOME || process.env.HOME || homedir();
-  const secretDir = join62(base, `.${PRODUCT_SLUG}`, "secrets", randomUUID9());
+  const secretDir = join63(base, `.${PRODUCT_SLUG}`, "secrets", randomUUID9());
   mkdirSync8(secretDir, { recursive: true, mode: 448 });
   return secretDir;
 }
@@ -301938,7 +302017,7 @@ function materializeVertexCredentials(params) {
   const blob = process.env[VERTEX_SERVICE_ACCOUNT_JSON_ENV];
   if (!blob) return void 0;
   const secretDir = createSecretDir();
-  const credentialsPath = join62(secretDir, "vertex-sa.json");
+  const credentialsPath = join63(secretDir, "vertex-sa.json");
   writeFileSync18(credentialsPath, blob, { mode: 384 });
   process.env[GOOGLE_APPLICATION_CREDENTIALS_ENV] = credentialsPath;
   const projectId = readProjectIdFromVertexServiceAccountJson();
@@ -302074,15 +302153,15 @@ function createProcessOutputActivityTimeout(ctx) {
 }
 
 // src/utils/prompt/skills.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync9, readFileSync as readFileSync37, writeFileSync as writeFileSync19 } from "node:fs";
-import { dirname as dirname9, join as join63 } from "node:path";
+import { existsSync as existsSync17, mkdirSync as mkdirSync9, readFileSync as readFileSync38, writeFileSync as writeFileSync19 } from "node:fs";
+import { dirname as dirname9, join as join64 } from "node:path";
 import { fileURLToPath } from "node:url";
 var BUNDLED_SKILL_NAMES = ["terraform-best-practices"];
 function resolveSkillPath(name) {
   const here = dirname9(fileURLToPath(import.meta.url));
   const candidates = [
-    join63(here, "..", "..", "skills", name, "SKILL.md"),
-    join63(here, "skills", name, "SKILL.md")
+    join64(here, "..", "..", "skills", name, "SKILL.md"),
+    join64(here, "skills", name, "SKILL.md")
   ];
   for (const candidate of candidates) {
     if (existsSync17(candidate)) return candidate;
@@ -302092,11 +302171,11 @@ function resolveSkillPath(name) {
 var SKILL_TARGET_DIRS = [".opencode/skills", ".claude/skills", ".agents/skills"];
 function installBundledSkills(params) {
   for (const name of BUNDLED_SKILL_NAMES) {
-    const content = readFileSync37(resolveSkillPath(name), "utf8");
+    const content = readFileSync38(resolveSkillPath(name), "utf8");
     for (const targetDir of SKILL_TARGET_DIRS) {
-      const skillDir = join63(params.home, targetDir, name);
+      const skillDir = join64(params.home, targetDir, name);
       mkdirSync9(skillDir, { recursive: true });
-      writeFileSync19(join63(skillDir, "SKILL.md"), content);
+      writeFileSync19(join64(skillDir, "SKILL.md"), content);
     }
   }
   log2.success(`installed bundled skills: ${BUNDLED_SKILL_NAMES.join(", ")}`);
@@ -302105,8 +302184,8 @@ function installBundledSkills(params) {
 // src/utils/setup/install.ts
 import { spawnSync as spawnSync9 } from "node:child_process";
 import { createHash as createHash15 } from "node:crypto";
-import { chmodSync as chmodSync2, createWriteStream as createWriteStream2, existsSync as existsSync20, readFileSync as readFileSync38 } from "node:fs";
-import { join as join68 } from "node:path";
+import { chmodSync as chmodSync2, createWriteStream as createWriteStream2, existsSync as existsSync20, readFileSync as readFileSync39 } from "node:fs";
+import { join as join69 } from "node:path";
 import { pipeline as pipeline2 } from "node:stream/promises";
 
 // src/utils/setup/tarballCache.ts
@@ -302161,7 +302240,7 @@ function verifyTarballIntegrity(tarballPath, dist, descriptor) {
       `Refusing to install ${descriptor}: the registry published no integrity digest (neither dist.integrity nor dist.shasum), so the download cannot be verified.`
     );
   }
-  const bytes = readFileSync38(tarballPath);
+  const bytes = readFileSync39(tarballPath);
   if (integrity2) {
     const candidates = integrity2.trim().split(/\s+/).filter(Boolean);
     for (const candidate of candidates) {
@@ -302190,8 +302269,8 @@ function verifyTarballIntegrity(tarballPath, dist, descriptor) {
 }
 async function installFromNpmTarball(params) {
   const tempDir = getTempDir();
-  const extractedDir = join68(tempDir, "package");
-  const cliPath = join68(extractedDir, params.executablePath);
+  const extractedDir = join69(tempDir, "package");
+  const cliPath = join69(extractedDir, params.executablePath);
   if (existsSync20(cliPath)) {
     log2.debug(`\xBB using cached binary at ${cliPath}`);
     return cliPath;
@@ -302243,7 +302322,7 @@ async function installFromNpmTarball(params) {
     dist = (await manifestResponse.json()).dist;
   }
   log2.debug(`\xBB installing ${params.packageName}@${resolvedVersion}...`);
-  const tarballPath = join68(tempDir, "package.tgz");
+  const tarballPath = join69(tempDir, "package.tgz");
   const tarballFileName = params.packageName.startsWith("@") ? params.packageName.split("/")[1] : params.packageName;
   const tarballUrl = `${npmRegistry}/${encodedName}/-/${tarballFileName}-${resolvedVersion}.tgz`;
   const restored = await restoreTarball({
@@ -302394,9 +302473,9 @@ var CLAUDE_DISALLOWED_TOOLS = CLAUDE_EXEC_TOOL_DENY_RULES.join(",");
 var INFRAWEAVER_MCP_AUTH_HEADER = `Bearer \${${MCP_SERVER_TOKEN_ENV}}`;
 var CLAUDE_MAX_CONCURRENT_SUBAGENTS_DEFAULT = "4";
 function writeMcpConfig(ctx) {
-  const configDir = join69(ctx.tmpdir, ".claude");
+  const configDir = join70(ctx.tmpdir, ".claude");
   mkdirSync10(configDir, { recursive: true });
-  const configPath = join69(configDir, "mcp.json");
+  const configPath = join70(configDir, "mcp.json");
   const terraformMcp = resolveTerraformMcp(ctx.payload);
   if (terraformMcp.kind === "docker_missing") log2.info(`\xBB ${terraformMcp.note}`);
   const opentofuMcp = resolveOpenTofuMcp(ctx.payload);
@@ -302428,13 +302507,13 @@ function writeMcpConfig(ctx) {
   return configPath;
 }
 function writePretoolGateAssets(ctx, stopHookPath) {
-  const scriptPath = join69(ctx.tmpdir, CLAUDE_PRETOOL_GATE_FILENAME);
+  const scriptPath = join70(ctx.tmpdir, CLAUDE_PRETOOL_GATE_FILENAME);
   writeFileSync22(
     scriptPath,
     buildClaudePretoolGateSource(ctx.subagentDeniedTools, writePolicyPath2(ctx.tmpdir))
   );
   chmodSync3(scriptPath, 493);
-  const settingsPath = join69(ctx.tmpdir, "infraweaver-claude-settings.json");
+  const settingsPath = join70(ctx.tmpdir, "infraweaver-claude-settings.json");
   const settings = buildClaudePretoolGateSettings(scriptPath, CLAUDE_EXEC_TOOL_DENY_RULES);
   settings.permissions.deny.push(...harnessTmpdirWriteDenyClaude(ctx.tmpdir));
   if (stopHookPath) {
@@ -303059,11 +303138,11 @@ var claude = agent({
       const onVertex = matchesRouteSentinel(VERTEX_MODEL_ID_ENV, specifier) && specifier !== void 0 && isVertexAnthropicId(specifier);
       const model = !specifier ? void 0 : onBedrock ? specifier : onVertex ? void 0 : stripProviderPrefix(specifier);
       const homeEnv = agentHomeEnv(ctx.tmpdir);
-      mkdirSync10(join69(homeEnv.XDG_CONFIG_HOME, "claude"), { recursive: true });
+      mkdirSync10(join70(homeEnv.XDG_CONFIG_HOME, "claude"), { recursive: true });
       installBundledSkills({ home: homeEnv.HOME });
       const mcpConfigPath = writeMcpConfig(ctx);
       const effort = resolveEffort(model);
-      const stopHookPath = join69(ctx.tmpdir, "infraweaver-stop-hook.sh");
+      const stopHookPath = join70(ctx.tmpdir, "infraweaver-stop-hook.sh");
       writeFileSync22(stopHookPath, buildStopHookScript(), { mode: 493 });
       const pretoolGate = writePretoolGateAssets(ctx, stopHookPath);
       installManagedSettings({
@@ -303229,7 +303308,7 @@ var claude = agent({
 init_core();
 import { spawn as nodeSpawn2 } from "node:child_process";
 import { mkdirSync as mkdirSync12, writeFileSync as writeFileSync24 } from "node:fs";
-import { join as join71 } from "node:path";
+import { join as join72 } from "node:path";
 import { performance as performance7 } from "node:perf_hooks";
 import { StringDecoder as StringDecoder2 } from "node:string_decoder";
 import { setTimeout as sleep7 } from "node:timers/promises";
@@ -308912,7 +308991,7 @@ function autoSelectModel() {
 import { execFileSync as execFileSync4 } from "node:child_process";
 import { mkdirSync as mkdirSync11, writeFileSync as writeFileSync23 } from "node:fs";
 import { homedir as homedir3, userInfo as userInfo2 } from "node:os";
-import { join as join70 } from "node:path";
+import { join as join71 } from "node:path";
 
 // src/utils/agent/codexOAuth.ts
 init_webapi();
@@ -308966,8 +309045,8 @@ function installCodexAuth() {
   }
   const expiresMs = decodeJwtExpMs(body2.tokens.access_token) ?? 0;
   const xdgDataHome = resolveDataHome();
-  const opencodeDir = join70(xdgDataHome, "opencode");
-  const authPath = join70(opencodeDir, "auth.json");
+  const opencodeDir = join71(xdgDataHome, "opencode");
+  const authPath = join71(opencodeDir, "auth.json");
   const opencodeAuth = {
     openai: {
       type: "oauth",
@@ -308991,7 +309070,7 @@ function installCodexAuth() {
   };
 }
 function resolveDataHome() {
-  if (process.env.CI !== "true") return join70(homedir3(), ".local", "share");
+  if (process.env.CI !== "true") return join71(homedir3(), ".local", "share");
   bootstrapInfraweaverDataDir();
   return INFRAWEAVER_DATA_DIR;
 }
@@ -309732,10 +309811,10 @@ var opencode = agent({
     const openAiCompatModel = resolveOpenAiCompatibleOpenCodeModel(rawModel);
     const model = isBedrockRoute ? `amazon-bedrock/${rawModel}` : vertexModel ?? openAiCompatModel ?? rawModel;
     const homeEnv = agentHomeEnv(ctx.tmpdir);
-    const opencodePluginDir = join71(homeEnv.XDG_CONFIG_HOME, "opencode", "plugin");
+    const opencodePluginDir = join72(homeEnv.XDG_CONFIG_HOME, "opencode", "plugin");
     mkdirSync12(opencodePluginDir, { recursive: true });
     writeFileSync24(
-      join71(opencodePluginDir, INFRAWEAVER_OPENCODE_GATE_PLUGIN_FILENAME),
+      join72(opencodePluginDir, INFRAWEAVER_OPENCODE_GATE_PLUGIN_FILENAME),
       buildOpencodeSubagentGateSource(ctx.subagentDeniedTools, writePolicyPath2(ctx.tmpdir))
     );
     installBundledSkills({ home: homeEnv.HOME });
@@ -310671,7 +310750,7 @@ async function fetchRunContext(params) {
 // src/utils/github/github.ts
 init_core();
 import { rename as rename2, writeFile as writeFile2 } from "node:fs/promises";
-import { dirname as dirname12, join as join72 } from "node:path";
+import { dirname as dirname12, join as join73 } from "node:path";
 
 // node_modules/.pnpm/universal-user-agent@7.0.3/node_modules/universal-user-agent/index.js
 function getUserAgent2() {
@@ -316487,7 +316566,7 @@ function getGitHubUsageSummary() {
 }
 async function writeGitHubUsageSummaryToFile(path15) {
   const summary2 = getGitHubUsageSummary();
-  const tmpPath = join72(dirname12(path15), `.usage-summary-${process.pid}.tmp`);
+  const tmpPath = join73(dirname12(path15), `.usage-summary-${process.pid}.tmp`);
   await writeFile2(tmpPath, JSON.stringify(summary2));
   await rename2(tmpPath, path15);
 }
@@ -317032,7 +317111,7 @@ async function resolveModelAndAuth(params) {
 // src/utils/run/runLifecycle.ts
 init_core();
 import { writeFile as writeFile5 } from "node:fs/promises";
-import { join as join75, resolve as resolve13 } from "node:path";
+import { join as join76, resolve as resolve13 } from "node:path";
 
 // src/utils/cloud/cloudReport.ts
 init_core();
@@ -317426,7 +317505,7 @@ async function reportToCloud(input2) {
 
 // src/utils/cloud/learnings.ts
 import { mkdir as mkdir3, readFile as readFile3, writeFile as writeFile3 } from "node:fs/promises";
-import { dirname as dirname13, join as join73 } from "node:path";
+import { dirname as dirname13, join as join74 } from "node:path";
 
 // src/utils/cloud/learningsTruncate.ts
 var MAX_LEARNINGS_LENGTH = 1e5;
@@ -317443,7 +317522,7 @@ function truncateAtLineBoundary(body2, cap2) {
 // src/utils/cloud/learnings.ts
 var LEARNINGS_FILE_NAME = LEARNINGS_FILE;
 function learningsFilePath(tmpdir6) {
-  return join73(tmpdir6, LEARNINGS_FILE_NAME);
+  return join74(tmpdir6, LEARNINGS_FILE_NAME);
 }
 async function seedLearningsFile(params) {
   const path15 = learningsFilePath(params.tmpdir);
@@ -317574,7 +317653,7 @@ ${ctx.error}` : ctx.error;
 
 // src/utils/github/prSummary.ts
 import { mkdir as mkdir4, readFile as readFile4, writeFile as writeFile4 } from "node:fs/promises";
-import { dirname as dirname14, join as join74 } from "node:path";
+import { dirname as dirname14, join as join75 } from "node:path";
 var SUMMARY_FILE_NAME = SUMMARY_FILE;
 var SUMMARY_SCAFFOLD = `# PR summary
 
@@ -317584,7 +317663,7 @@ var SUMMARY_SCAFFOLD = `# PR summary
 var MIN_SNAPSHOT_LENGTH = 60;
 var MAX_SNAPSHOT_LENGTH = 32768;
 function summaryFilePath(tmpdir6) {
-  return join74(tmpdir6, SUMMARY_FILE_NAME);
+  return join75(tmpdir6, SUMMARY_FILE_NAME);
 }
 async function seedSummaryFile(params) {
   const path15 = summaryFilePath(params.tmpdir);
@@ -318118,7 +318197,7 @@ async function emitFindingsOutputs(toolState, requiredControls) {
       if (a.level === "error") error(a.message, props);
       else warning(a.message, props);
     }
-    const sarifPath = join75(workspace, SARIF_FILE);
+    const sarifPath = join76(workspace, SARIF_FILE);
     if (session.emittedSarifPath && resolve13(session.emittedSarifPath) === resolve13(sarifPath)) {
       log2.info(`\xBB findings output: replacing the agent-emitted ${SARIF_FILE} with the gate's`);
     }
@@ -318550,7 +318629,7 @@ async function runAgentWithWatchdogs(params) {
 // src/phases/startToolPlane.ts
 import { existsSync as existsSync21, readdirSync as readdirSync11 } from "node:fs";
 import { readFile as readFile5 } from "node:fs/promises";
-import { join as join76 } from "node:path";
+import { join as join77 } from "node:path";
 
 // src/utils/cloud/runTerminalStatus.ts
 var TERMINAL_STATE_KEY = "run_terminal";
@@ -319378,7 +319457,7 @@ ${instructions.user}` : null,
     log2.info(instructions.full);
   });
   if (toolContext.agentId === "opencode") {
-    const pluginDir = join76(process.cwd(), ".opencode", "plugin");
+    const pluginDir = join77(process.cwd(), ".opencode", "plugin");
     const hasPlugins = existsSync21(pluginDir) && readdirSync11(pluginDir).some((f) => /\.[jt]sx?$/.test(f));
     if (hasPlugins && toolState.dependencyInstallation?.promise) {
       log2.info(
@@ -319971,7 +320050,7 @@ async function runMcpCli(params) {
 }
 
 // node_modules/.pnpm/@infraweaver-io+attest@0.1.7_supports-color@7.2.0/node_modules/@infraweaver-io/attest/dist/verifyEvidence.js
-import { readFileSync as readFileSync39 } from "node:fs";
+import { readFileSync as readFileSync40 } from "node:fs";
 function usageLine(params) {
   const command = params.command ? `${params.command} ` : "";
   return `usage: ${params.prog} ${command}<bundle> <sig> <pubkey>`;
@@ -319989,7 +320068,7 @@ function printUsage(params, stream2) {
 }
 function readFileOrExit(path15, what) {
   try {
-    return readFileSync39(path15);
+    return readFileSync40(path15);
   } catch (e) {
     console.error(`could not read the ${what} at ${path15}: ${errorMessage(e)}`);
     process.exit(1);
@@ -320037,7 +320116,7 @@ async function runVerifyEvidenceCli2(params) {
 }
 
 // src/cli.ts
-var VERSION14 = "0.3.11";
+var VERSION14 = "0.3.12";
 var bin = basename9(process.argv[1] || "");
 var PROG = bin === "pf" || bin === PRODUCT_SLUG ? bin : PRODUCT_SLUG;
 var rawArgs = process.argv.slice(2);