infraweaver 0.3.11 → 0.3.12

package/dist/index.js

@@ -84161,14 +84161,14 @@ var require_turndown_cjs = __commonJS({
         } else if (node3.nodeType === 1) {
           replacement = replacementForNode.call(self2, node3);
         }
-        return join74(output2, replacement);
+        return join75(output2, replacement);
       }, "");
     }
     function postProcess(output2) {
       var self2 = this;
       this.rules.forEach(function(rule) {
         if (typeof rule.append === "function") {
-          output2 = join74(output2, rule.append(self2.options));
+          output2 = join75(output2, rule.append(self2.options));
         }
       });
       return output2.replace(/^[\t\r\n]+/, "").replace(/[\t\r\n\s]+$/, "");
@@ -84180,7 +84180,7 @@ var require_turndown_cjs = __commonJS({
       if (whitespace.leading || whitespace.trailing) content = content.trim();
       return whitespace.leading + rule.replacement(content, node3, this.options) + whitespace.trailing;
     }
-    function join74(output2, replacement) {
+    function join75(output2, replacement) {
       var s1 = trimTrailingNewlines(output2);
       var s2 = trimLeadingNewlines(replacement);
       var nls = Math.max(output2.length - s1.length, replacement.length - s2.length);
@@ -97300,7 +97300,7 @@ var require_polyfill = __commonJS({
     var {
       dirname: dirname15,
       isAbsolute: isAbsolute7,
-      join: join74,
+      join: join75,
       parse: parse8,
       resolve: resolve11,
       sep: sep11,
@@ -97557,8 +97557,8 @@ var require_polyfill = __commonJS({
       const dir = await readdir2(src);
       for (let i = 0; i < dir.length; i++) {
         const item = dir[i];
-        const srcItem = join74(src, item);
-        const destItem = join74(dest, item);
+        const srcItem = join75(src, item);
+        const destItem = join75(dest, item);
         const { destStat } = await checkPaths2(srcItem, destItem, opts);
         await startCopy(destStat, srcItem, destItem, opts);
       }
@@ -97631,7 +97631,7 @@ var require_cp = __commonJS({
 // node_modules/.pnpm/@npmcli+fs@6.0.0/node_modules/@npmcli/fs/lib/with-temp-dir.js
 var require_with_temp_dir = __commonJS({
   "node_modules/.pnpm/@npmcli+fs@6.0.0/node_modules/@npmcli/fs/lib/with-temp-dir.js"(exports2, module) {
-    var { join: join74, sep: sep11 } = __require("path");
+    var { join: join75, sep: sep11 } = __require("path");
     var getOptions2 = require_get_options();
     var { mkdir: mkdir5, mkdtemp, rm: rm2 } = __require("fs/promises");
     var withTempDir = async (root, fn2, opts) => {
@@ -97639,7 +97639,7 @@ var require_with_temp_dir = __commonJS({
         copy: ["tmpPrefix"]
       });
       await mkdir5(root, { recursive: true });
-      const target = await mkdtemp(join74(`${root}${sep11}`, options.tmpPrefix || ""));
+      const target = await mkdtemp(join75(`${root}${sep11}`, options.tmpPrefix || ""));
       let err;
       let result;
       try {
@@ -97664,13 +97664,13 @@ var require_with_temp_dir = __commonJS({
 var require_readdir_scoped = __commonJS({
   "node_modules/.pnpm/@npmcli+fs@6.0.0/node_modules/@npmcli/fs/lib/readdir-scoped.js"(exports2, module) {
     var { readdir: readdir2 } = __require("fs/promises");
-    var { join: join74 } = __require("path");
+    var { join: join75 } = __require("path");
     var readdirScoped = async (dir) => {
       const results = [];
       for (const item of await readdir2(dir)) {
         if (item.startsWith("@")) {
-          for (const scopedItem of await readdir2(join74(dir, item))) {
-            results.push(join74(item, scopedItem));
+          for (const scopedItem of await readdir2(join75(dir, item))) {
+            results.push(join75(item, scopedItem));
           }
         } else {
           results.push(item);
@@ -97685,7 +97685,7 @@ var require_readdir_scoped = __commonJS({
 // node_modules/.pnpm/@npmcli+fs@6.0.0/node_modules/@npmcli/fs/lib/move-file.js
 var require_move_file = __commonJS({
   "node_modules/.pnpm/@npmcli+fs@6.0.0/node_modules/@npmcli/fs/lib/move-file.js"(exports2, module) {
-    var { dirname: dirname15, join: join74, resolve: resolve11, relative: relative8, isAbsolute: isAbsolute7 } = __require("path");
+    var { dirname: dirname15, join: join75, resolve: resolve11, relative: relative8, isAbsolute: isAbsolute7 } = __require("path");
     var fs12 = __require("fs/promises");
     var pathExists2 = async (path15) => {
       try {
@@ -97715,7 +97715,7 @@ var require_move_file = __commonJS({
           if (sourceStat.isDirectory()) {
             const files = await fs12.readdir(source);
             await Promise.all(files.map(
-              (file2) => moveFile(join74(source, file2), join74(destination, file2), options, false, symlinks)
+              (file2) => moveFile(join75(source, file2), join75(destination, file2), options, false, symlinks)
             ));
           } else if (sourceStat.isSymbolicLink()) {
             symlinks.push({ source, destination });
@@ -259203,7 +259203,7 @@ import { randomBytes as randomBytes2 } from "node:crypto";
 // package.json
 var package_default = {
   name: "infraweaver",
-  version: "0.3.11",
+  version: "0.3.12",
   description: "GitHub Action that remediates Terraform to best practices and opens one scoped pull request per concern.",
   keywords: [
     "ai-coding-agent",
@@ -272925,7 +272925,7 @@ function TerraformChangeSummaryTool(ctx) {
 // src/mcp/checkout.ts
 import { createHash as createHash9 } from "node:crypto";
 import { statSync as statSync5, unlinkSync as unlinkSync3, writeFileSync as writeFileSync10 } from "node:fs";
-import { join as join35 } from "node:path";
+import { join as join36 } from "node:path";
 
 // node_modules/.pnpm/@infraweaver-io+ci@0.1.8/node_modules/@infraweaver-io/ci/dist/diffCoverage.js
 import { isAbsolute as isAbsolute3, normalize as normalize3, resolve as resolve5 } from "node:path";
@@ -278577,7 +278577,7 @@ function PushTagsTool(ctx) {
 }
 
 // src/mcp/review.ts
-import { readFileSync as readFileSync19 } from "node:fs";
+import { readFileSync as readFileSync20 } from "node:fs";
 
 // src/mcp/findingAudit.ts
 var COHERENCE_RULES = {
@@ -281789,7 +281789,7 @@ function apply(worktree, path15, cs) {
 
 // src/mcp/terraform/gateScan.ts
 import { existsSync as existsSync7, mkdtempSync as mkdtempSync3, rmSync as rmSync6 } from "node:fs";
-import { join as join32, posix as posix10 } from "node:path";
+import { join as join33, posix as posix10 } from "node:path";
 
 // src/mcp/terraform/coverage.ts
 function bandOf(group2, concerns, signals) {
@@ -282227,6 +282227,66 @@ function dedupeCrossScanner(concerns) {
   return [...merged, ...passthrough];
 }
 
+// src/mcp/terraform/verifySites.ts
+import { readFileSync as readFileSync17 } from "node:fs";
+import { join as join29 } from "node:path";
+function fileReader(cwd) {
+  const cache3 = /* @__PURE__ */ new Map();
+  return (file2) => {
+    if (!cache3.has(file2)) {
+      let text;
+      try {
+        text = readFileSync17(join29(cwd, file2), "utf8");
+      } catch {
+        text = null;
+      }
+      cache3.set(file2, text);
+    }
+    return cache3.get(file2) ?? null;
+  };
+}
+function siteOf(c, read3) {
+  const text = read3(c.location.file);
+  return text === null ? null : resourceAddressAt(text, c.location.line);
+}
+function recordConcernSites(session, concerns, cwd) {
+  const read3 = fileReader(cwd);
+  session.siteById ??= /* @__PURE__ */ new Map();
+  session.firstSitesByKey ??= /* @__PURE__ */ new Map();
+  const first = session.firstSitesByKey;
+  const fresh = /* @__PURE__ */ new Map();
+  for (const c of concerns) {
+    const site = siteOf(c, read3);
+    session.siteById.set(c.id, site);
+    const key = concernKeyOf(c);
+    if (first.has(key)) continue;
+    const sites = fresh.get(key) ?? /* @__PURE__ */ new Set();
+    sites.add(site);
+    fresh.set(key, sites);
+  }
+  for (const [key, sites] of fresh) first.set(key, sites);
+}
+function resolvedAtSite(params) {
+  const firingByKey = /* @__PURE__ */ new Map();
+  for (const c of params.current) {
+    const list = firingByKey.get(c.key) ?? [];
+    list.push(c.site);
+    firingByKey.set(c.key, list);
+  }
+  const out = [];
+  for (const r of params.requested) {
+    if (r.site === null || r.file === void 0) continue;
+    const firing = firingByKey.get(r.key) ?? [];
+    const known = params.firstSites.get(r.key);
+    if (known === void 0) continue;
+    if (firing.some((s) => s === null || !known.has(s))) continue;
+    if (firing.includes(r.site)) continue;
+    if (!params.declared(r.file).has(r.site)) continue;
+    out.push(r.id);
+  }
+  return out;
+}
+
 // src/mcp/terraform/concernResult.ts
 function annotateConcerns(rawConcerns, opts) {
   const inScope = opts.inScope ?? (() => true);
@@ -282253,6 +282313,7 @@ function buildConcernResult(ctx, rawConcerns, opts) {
     fullBaseline.map((c) => concernKeyOf(c))
   );
   recordConcernKeys(session, fullBaseline);
+  recordConcernSites(session, fullBaseline, opts.cwd);
   session.baselineFmtDriftFiles = union3(
     session.baselineFmtDriftFiles,
     fullBaseline.filter((c) => c.source === "terraform-fmt").map((c) => c.location.file)
@@ -282289,7 +282350,7 @@ function buildConcernResult(ctx, rawConcerns, opts) {
 
 // src/mcp/terraform/initArtefacts.ts
 import { rmSync as rmSync4 } from "node:fs";
-import { join as join29, posix as posix9 } from "node:path";
+import { join as join30, posix as posix9 } from "node:path";
 var INIT_ARTEFACTS = /* @__PURE__ */ new Set([".terraform", ".terraform.lock.hcl"]);
 function initArtefacts(cwd) {
   const r = run("git", ["status", "--porcelain=v1", "-z", "--untracked-files=normal"], cwd);
@@ -282312,7 +282373,7 @@ function removeNewInitArtefacts(cwd, before, by) {
   const created = [...after?.untracked ?? []].filter((p) => !before.untracked.has(p));
   const changed = [...after?.modifiedLocks ?? []].filter((p) => !before.modifiedLocks.has(p));
   if (!top || created.length + changed.length === 0) return;
-  for (const p of created) rmSync4(join29(top, p), { recursive: true, force: true });
+  for (const p of created) rmSync4(join30(top, p), { recursive: true, force: true });
   if (changed.length > 0) run("git", ["checkout", "--", ...changed], top);
   resetTerraformInitCache();
   log2.info(
@@ -282321,8 +282382,8 @@ function removeNewInitArtefacts(cwd, before, by) {
 }
 
 // src/mcp/terraform/secretScan.ts
-import { readFileSync as readFileSync17, rmSync as rmSync5 } from "node:fs";
-import { join as join30 } from "node:path";
+import { readFileSync as readFileSync18, rmSync as rmSync5 } from "node:fs";
+import { join as join31 } from "node:path";
 function parseBetterleaksReport(json5, prefix2 = "") {
   const doc = JSON.parse(json5);
   if (Array.isArray(doc) || !doc || typeof doc !== "object" || !("findings" in doc)) {
@@ -282356,7 +282417,7 @@ async function scanAddedSecrets(cwd, mergeBase, tmp) {
   const top = run("git", ["rev-parse", "--show-toplevel"], cwd).stdout.trim();
   const prefix2 = run("git", ["rev-parse", "--show-prefix"], cwd).stdout.trim();
   if (!top) return { ran: false, reason: "not a git checkout", concerns: [] };
-  const report2 = join30(tmp, `betterleaks-${process.pid}.json`);
+  const report2 = join31(tmp, `betterleaks-${process.pid}.json`);
   try {
     const r = await runAsync(
       "betterleaks",
@@ -282379,7 +282440,7 @@ async function scanAddedSecrets(cwd, mergeBase, tmp) {
     const why = (r.stderr || r.stdout).trim().split("\n").pop() ?? "";
     let parsed2;
     try {
-      parsed2 = parseBetterleaksReport(readFileSync17(report2, "utf-8"), prefix2);
+      parsed2 = parseBetterleaksReport(readFileSync18(report2, "utf-8"), prefix2);
     } catch (error63) {
       const reason = r.status !== 0 ? `betterleaks exited ${r.status}: ${why}` : `${error63}`;
       return { ran: false, reason, concerns: [] };
@@ -282394,8 +282455,8 @@ async function scanAddedSecrets(cwd, mergeBase, tmp) {
 }
 
 // src/mcp/terraform/tools/scan.ts
-import { readFileSync as readFileSync18 } from "node:fs";
-import { join as join31 } from "node:path";
+import { readFileSync as readFileSync19 } from "node:fs";
+import { join as join32 } from "node:path";
 
 // src/mcp/terraform/noiseProfile.ts
 var MIN_DISMISSAL_REPOS = 3;
@@ -282581,7 +282642,7 @@ async function runScan(ctx, {
     outcomes.flatMap((o) => o.concerns),
     (rel) => {
       try {
-        return readFileSync18(join31(cwd, rel), "utf-8");
+        return readFileSync19(join32(cwd, rel), "utf-8");
       } catch {
         return null;
       }
@@ -282733,8 +282794,8 @@ function checkOutBase(cwd, pr, tmp) {
   }
   const mergeBase = run("git", ["merge-base", pr.baseSha, "HEAD"], cwd).stdout.trim() || pr.baseSha;
   const prefix2 = run("git", ["rev-parse", "--show-prefix"], cwd).stdout.trim();
-  const parent = mkdtempSync3(join32(tmp, "scan-delta-base-"));
-  const worktree = join32(parent, "wt");
+  const parent = mkdtempSync3(join33(tmp, "scan-delta-base-"));
+  const worktree = join33(parent, "wt");
   if (run("git", ["worktree", "add", "--detach", worktree, mergeBase], cwd).status !== 0) {
     rmSync6(parent, { recursive: true, force: true });
     log2.warning("\xBB scan delta: could not check out the base \u2014 every finding is treated as new.");
@@ -282742,7 +282803,7 @@ function checkOutBase(cwd, pr, tmp) {
   }
   return {
     mergeBase,
-    cwd: prefix2 ? join32(worktree, prefix2) : worktree,
+    cwd: prefix2 ? join33(worktree, prefix2) : worktree,
     close: () => {
       run("git", ["worktree", "remove", "--force", worktree], cwd);
       rmSync6(parent, { recursive: true, force: true });
@@ -283677,7 +283738,7 @@ ${coverageState.lastBreakdown}`
 }
 function readReviewedFile(path15) {
   try {
-    return readFileSync19(resolveWithinCwd(resolveRepoRoot(), path15), "utf-8");
+    return readFileSync20(resolveWithinCwd(resolveRepoRoot(), path15), "utf-8");
   } catch {
     return null;
   }
@@ -283992,7 +284053,7 @@ function fastForwardDiff(params, exec2) {
 
 // src/utils/prompt/changeImpact.ts
 import { writeFileSync as writeFileSync9 } from "node:fs";
-import { join as join33 } from "node:path";
+import { join as join34 } from "node:path";
 var MAX_ATOMS = 20;
 var MAX_REFS_PER_ATOM = 6;
 var MAX_EXCERPT = 160;
@@ -284172,7 +284233,7 @@ function createChangeImpactArtifact(params) {
     fileCount: params.files.length,
     lookupError
   });
-  const path15 = join33(
+  const path15 = join34(
     params.tmpdir,
     `pr-${params.pullNumber}-${params.headSha.slice(0, 7)}-impact.md`
   );
@@ -284192,7 +284253,7 @@ function createChangeImpactArtifact(params) {
 import { execFileSync, execSync as execSync2 } from "node:child_process";
 import { mkdtempSync as mkdtempSync4, readdirSync as readdirSync5, realpathSync as realpathSync4, unlinkSync as unlinkSync2 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join34 } from "node:path";
+import { join as join35 } from "node:path";
 
 // src/utils/github/ghaCore.ts
 import { randomUUID as randomUUID6 } from "node:crypto";
@@ -284215,7 +284276,7 @@ var TEMP_DIR_STATE_KEY = "infraweaver_temp_dir";
 
 // src/utils/setup/setup.ts
 function createTempDirectory() {
-  const sharedTempDir = mkdtempSync4(join34(tmpdir2(), `${PRODUCT_SLUG}-`));
+  const sharedTempDir = mkdtempSync4(join35(tmpdir2(), `${PRODUCT_SLUG}-`));
   process.env.INFRAWEAVER_TEMP_DIR = sharedTempDir;
   saveState2(TEMP_DIR_STATE_KEY, sharedTempDir);
   log2.info(`\xBB created temp dir at ${sharedTempDir}`);
@@ -284261,13 +284322,13 @@ function wipeRunnerLeakSurface() {
       return [];
     }
   };
-  const fileCommandsDir = join34(runnerTemp, "_runner_file_commands");
+  const fileCommandsDir = join35(runnerTemp, "_runner_file_commands");
   for (const entry4 of listDir(fileCommandsDir)) {
-    tryUnlink(join34(fileCommandsDir, entry4));
+    tryUnlink(join35(fileCommandsDir, entry4));
   }
   for (const entry4 of listDir(runnerTemp)) {
     if (entry4.endsWith(".sh") || /^git-credentials-.*\.config$/.test(entry4)) {
-      tryUnlink(join34(runnerTemp, entry4));
+      tryUnlink(join35(runnerTemp, entry4));
     }
   }
   if (wiped.length > 0) {
@@ -284766,7 +284827,7 @@ function CheckoutPrTool(ctx) {
         headSha: ctx.toolState.checkoutSha
       });
       if (incremental) {
-        incrementalDiffPath = join35(
+        incrementalDiffPath = join36(
           tempDir,
           `pr-${pull_number}-${beforeShort}-${headShort}-incremental.diff`
         );
@@ -284780,7 +284841,7 @@ function CheckoutPrTool(ctx) {
     const diffPreview = formatResult.content.split("\n").slice(0, 100).join("\n");
     log2.debug(`formatted diff preview (first 100 lines):
 ${diffPreview}`);
-    const diffPath = join35(tempDir, `pr-${pull_number}-${headShort}.diff`);
+    const diffPath = join36(tempDir, `pr-${pull_number}-${headShort}.diff`);
     writeFileSync10(diffPath, formatResult.content);
     log2.debug(`wrote diff to ${diffPath} (${formatResult.content.length} bytes)`);
     ctx.toolState.diffCoverage = createDiffCoverageState({
@@ -284921,7 +284982,7 @@ ${dirty}`
 
 // src/mcp/checkSuite.ts
 import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync11 } from "node:fs";
-import { join as join36 } from "node:path";
+import { join as join37 } from "node:path";
 import { stripVTControlCharacters } from "node:util";
 var GetCheckSuiteLogs = type({
   check_suite_id: type.number.describe("the id from check_suite.id")
@@ -285016,7 +285077,7 @@ function GetCheckSuiteLogsTool(ctx) {
         };
       }
       const tempDir = getTempDir();
-      const logsDir = join36(tempDir, "ci-logs");
+      const logsDir = join37(tempDir, "ci-logs");
       mkdirSync3(logsDir, { recursive: true });
       const jobLists = await mapWithConcurrency(
         failedRuns,
@@ -285040,7 +285101,7 @@ function GetCheckSuiteLogsTool(ctx) {
             request: { signal: AbortSignal.timeout(1e4) }
           });
           const logsText = typeof data === "string" ? data : Buffer.from(data).toString("utf8");
-          const logPath = join36(logsDir, `job-${job.id}.log`);
+          const logPath = join37(logsDir, `job-${job.id}.log`);
           writeFileSync11(logPath, logsText);
           const analysis = analyzeLog(logsText, 80);
           const failedSteps = job.steps?.filter((s) => s.conclusion === "failure").map((s) => `Step ${s.number}: ${s.name}`) ?? [];
@@ -285102,7 +285163,7 @@ function GetCheckSuiteLogsTool(ctx) {
 
 // src/mcp/commitInfo.ts
 import { writeFileSync as writeFileSync12 } from "node:fs";
-import { join as join37 } from "node:path";
+import { join as join38 } from "node:path";
 var CommitInfo = type({
   sha: type.string.describe("the commit SHA (full or abbreviated) to fetch")
 });
@@ -285121,7 +285182,7 @@ function CommitInfoTool(ctx) {
       const files = data.files ?? [];
       const formatResult = formatFilesWithLineNumbers(files);
       const tempDir = getTempDir("get_commit_info");
-      const diffFile = join37(tempDir, `commit-${sha.slice(0, 7)}.diff`);
+      const diffFile = join38(tempDir, `commit-${sha.slice(0, 7)}.diff`);
       writeFileSync12(diffFile, formatResult.content);
       log2.debug(`wrote commit diff to ${diffFile} (${formatResult.content.length} bytes)`);
       return {
@@ -285283,7 +285344,7 @@ import { performance as performance3 } from "node:perf_hooks";
 
 // src/prep/installNodeDependencies.ts
 import { existsSync as existsSync8 } from "node:fs";
-import { join as join38 } from "node:path";
+import { join as join39 } from "node:path";
 
 // node_modules/.pnpm/package-manager-detector@1.8.0/node_modules/package-manager-detector/dist/commands.mjs
 function splitRunArgs(args2, valueFlags = []) {
@@ -285669,7 +285730,7 @@ async function installFallback(name, installSpec) {
     return result.stderr || `failed to install ${name}`;
   }
   if (name === "deno") {
-    const denoPath = join38(process.env.HOME || "", ".deno", "bin");
+    const denoPath = join39(process.env.HOME || "", ".deno", "bin");
     process.env.PATH = `${denoPath}:${process.env.PATH}`;
   }
   log2.info(`\xBB installed ${name}`);
@@ -285678,7 +285739,7 @@ async function installFallback(name, installSpec) {
 var installNodeDependencies = {
   name: "installNodeDependencies",
   shouldRun: () => {
-    const packageJsonPath = join38(process.cwd(), "package.json");
+    const packageJsonPath = join39(process.cwd(), "package.json");
     return existsSync8(packageJsonPath);
   },
   run: async (options) => {
@@ -285787,8 +285848,8 @@ ${errorMessage2}`]
 };
 
 // src/prep/installPythonDependencies.ts
-import { existsSync as existsSync9, readFileSync as readFileSync20 } from "node:fs";
-import { join as join39 } from "node:path";
+import { existsSync as existsSync9, readFileSync as readFileSync21 } from "node:fs";
+import { join as join40 } from "node:path";
 var PYTHON_CONFIGS = [
   {
     file: "requirements.txt",
@@ -285823,7 +285884,7 @@ var PYTHON_CONFIGS = [
 ];
 function pyprojectDeclaresBuildSystem(cwd) {
   try {
-    const content = readFileSync20(join39(cwd, "pyproject.toml"), "utf8");
+    const content = readFileSync21(join40(cwd, "pyproject.toml"), "utf8");
     return /^\s*\[build-system\]/m.test(content);
   } catch {
     return false;
@@ -285873,13 +285934,13 @@ var installPythonDependencies = {
     }
     const cwd = process.cwd();
     return PYTHON_CONFIGS.some(
-      (config3) => existsSync9(join39(cwd, config3.file)) && configApplies(config3, cwd)
+      (config3) => existsSync9(join40(cwd, config3.file)) && configApplies(config3, cwd)
     );
   },
   run: async (options) => {
     const cwd = process.cwd();
     const config3 = PYTHON_CONFIGS.find(
-      (c) => existsSync9(join39(cwd, c.file)) && configApplies(c, cwd)
+      (c) => existsSync9(join40(cwd, c.file)) && configApplies(c, cwd)
     );
     if (!config3) {
       return {
@@ -286400,12 +286461,12 @@ function AddLabelsTool(ctx) {
 }
 
 // src/mcp/moduleExtraction.ts
-import { readFileSync as readFileSync23 } from "node:fs";
-import { join as join42, posix as posix11 } from "node:path";
+import { readFileSync as readFileSync24 } from "node:fs";
+import { join as join43, posix as posix11 } from "node:path";
 
 // src/mcp/terraform/partialInterface.ts
-import { readdirSync as readdirSync6, readFileSync as readFileSync21 } from "node:fs";
-import { join as join40 } from "node:path";
+import { readdirSync as readdirSync6, readFileSync as readFileSync22 } from "node:fs";
+import { join as join41 } from "node:path";
 function unmappedArguments(resource, moduleResources) {
   const matching = moduleResources.filter((m) => m.type === resource.type);
   if (matching.length === 0) return [];
@@ -286415,10 +286476,10 @@ function unmappedArguments(resource, moduleResources) {
 function readDirHcl(cwd, dir) {
   let text = "";
   try {
-    for (const f of readdirSync6(join40(cwd, dir)).sort((a, b) => a.localeCompare(b, "en"))) {
+    for (const f of readdirSync6(join41(cwd, dir)).sort((a, b) => a.localeCompare(b, "en"))) {
       if (!f.endsWith(".tf")) continue;
       try {
-        text += `${readFileSync21(join40(cwd, dir, f), "utf8")}
+        text += `${readFileSync22(join41(cwd, dir, f), "utf8")}
 `;
       } catch {
       }
@@ -286448,7 +286509,7 @@ function findPartialInterfaces(cwd) {
     if (isInHouseModule(file2, graph)) continue;
     let text;
     try {
-      text = readFileSync21(join40(cwd, file2), "utf8");
+      text = readFileSync22(join41(cwd, file2), "utf8");
     } catch {
       continue;
     }
@@ -286465,8 +286526,8 @@ function findPartialInterfaces(cwd) {
 }
 
 // src/mcp/terraform/refactorScope.ts
-import { existsSync as existsSync10, readdirSync as readdirSync7, readFileSync as readFileSync22, statSync as statSync6 } from "node:fs";
-import { join as join41 } from "node:path";
+import { existsSync as existsSync10, readdirSync as readdirSync7, readFileSync as readFileSync23, statSync as statSync6 } from "node:fs";
+import { join as join42 } from "node:path";
 function isExamplePath(path15) {
   return /(?:^|\/)examples?\//.test(path15.replace(/\\/g, "/"));
 }
@@ -286479,7 +286540,7 @@ function holdsTerraform(dir, depth) {
     return false;
   }
   for (const name of entries) {
-    const path15 = join41(dir, name);
+    const path15 = join42(dir, name);
     if (name.endsWith(".tf")) return true;
     if (depth > 0 && !name.startsWith(".") && statSync6(path15, { throwIfNoEntry: false })?.isDirectory()) {
       if (holdsTerraform(path15, depth - 1)) return true;
@@ -286498,14 +286559,14 @@ function libraryRepoReason(cwd) {
   for (const f of rootFiles) {
     let text;
     try {
-      text = readFileSync22(join41(cwd, f), "utf8");
+      text = readFileSync23(join42(cwd, f), "utf8");
     } catch {
       continue;
     }
     if (PROVIDER_OR_BACKEND.test(text)) return null;
   }
-  const examples = ["examples", "example"].find((d) => existsSync10(join41(cwd, d)));
-  if (examples === void 0 || !holdsTerraform(join41(cwd, examples), 2)) return null;
+  const examples = ["examples", "example"].find((d) => existsSync10(join42(cwd, d)));
+  if (examples === void 0 || !holdsTerraform(join42(cwd, examples), 2)) return null;
   return `the repository root configures no provider and no backend, and ships \`${examples}/\`: it is a module other configurations call, so restructuring it is churn for every caller`;
 }
 function reportOnly(reason) {
@@ -286800,7 +286861,7 @@ function findExtractionCandidates(cwd, rawCatalogue, orgModuleHcl) {
     if (isInHouseModule(file2, graph) !== null) continue;
     let text;
     try {
-      text = readFileSync23(join42(cwd, file2), "utf8");
+      text = readFileSync24(join43(cwd, file2), "utf8");
     } catch {
       continue;
     }
@@ -286908,8 +286969,8 @@ function ModuleExtractionCandidatesTool(ctx) {
 }
 
 // src/mcp/moduleTests.ts
-import { existsSync as existsSync11, readdirSync as readdirSync8, readFileSync as readFileSync24, statSync as statSync7 } from "node:fs";
-import { join as join43 } from "node:path";
+import { existsSync as existsSync11, readdirSync as readdirSync8, readFileSync as readFileSync25, statSync as statSync7 } from "node:fs";
+import { join as join44 } from "node:path";
 var MODULE_META_ARGS = /* @__PURE__ */ new Set([
   "source",
   "version",
@@ -287050,9 +287111,9 @@ function listSubdirs(absDir) {
 }
 function readAllTf(cwd, relDir) {
   let text = "";
-  for (const f of listFiles(join43(cwd, relDir), ".tf")) {
+  for (const f of listFiles(join44(cwd, relDir), ".tf")) {
     try {
-      text += `${readFileSync24(join43(cwd, relDir, f), "utf8")}
+      text += `${readFileSync25(join44(cwd, relDir, f), "utf8")}
 `;
     } catch {
     }
@@ -287064,8 +287125,8 @@ function discoverModuleTestAssets(cwd, moduleDir) {
   const assets = [];
   const matchesModule = (source, fromDir) => resolveSourceDir(fromDir, source) === md;
   for (const examplesRoot of [`${md}/examples`, "examples"]) {
-    if (!isDir(join43(cwd, examplesRoot))) continue;
-    for (const sub of listSubdirs(join43(cwd, examplesRoot))) {
+    if (!isDir(join44(cwd, examplesRoot))) continue;
+    for (const sub of listSubdirs(join44(cwd, examplesRoot))) {
       const exDir = `${examplesRoot}/${sub}`;
       const hcl2 = readAllTf(cwd, exDir);
       if (!hcl2) continue;
@@ -287081,12 +287142,12 @@ function discoverModuleTestAssets(cwd, moduleDir) {
     }
   }
   for (const testDir of [`${md}/tests`, md]) {
-    if (!isDir(join43(cwd, testDir))) continue;
-    for (const f of listFiles(join43(cwd, testDir), ".tftest.hcl")) {
+    if (!isDir(join44(cwd, testDir))) continue;
+    for (const f of listFiles(join44(cwd, testDir), ".tftest.hcl")) {
       const rel = `${testDir}/${f}`;
       let hcl2;
       try {
-        hcl2 = readFileSync24(join43(cwd, rel), "utf8");
+        hcl2 = readFileSync25(join44(cwd, rel), "utf8");
       } catch {
         continue;
       }
@@ -287094,12 +287155,12 @@ function discoverModuleTestAssets(cwd, moduleDir) {
     }
   }
   for (const goDir of [`${md}/test`, `${md}/tests`]) {
-    if (!isDir(join43(cwd, goDir))) continue;
-    for (const f of listFiles(join43(cwd, goDir), "_test.go")) {
+    if (!isDir(join44(cwd, goDir))) continue;
+    for (const f of listFiles(join44(cwd, goDir), "_test.go")) {
       const rel = `${goDir}/${f}`;
       let go;
       try {
-        go = readFileSync24(join43(cwd, rel), "utf8");
+        go = readFileSync25(join44(cwd, rel), "utf8");
       } catch {
         continue;
       }
@@ -287223,8 +287284,8 @@ function SetOutputTool(ctx, outputSchema) {
 
 // src/mcp/policy.ts
 import { spawnSync as spawnSync8 } from "node:child_process";
-import { existsSync as existsSync12, readFileSync as readFileSync25 } from "node:fs";
-import { join as join44 } from "node:path";
+import { existsSync as existsSync12, readFileSync as readFileSync26 } from "node:fs";
+import { join as join45 } from "node:path";
 function parseConftestOutput(stdout) {
   let parsed2;
   try {
@@ -287258,7 +287319,7 @@ var CONFTEST_CONFIG = "conftest.toml";
 function conftestSelectsNamespaces(conftestCwd) {
   let raw2;
   try {
-    raw2 = readFileSync25(join44(conftestCwd, CONFTEST_CONFIG), "utf-8");
+    raw2 = readFileSync26(join45(conftestCwd, CONFTEST_CONFIG), "utf-8");
   } catch {
     return false;
   }
@@ -287274,7 +287335,7 @@ function namespaceArgs(conftestCwd) {
 }
 function findPlanJson(cwd) {
   for (const candidate of PLAN_JSON_NAMES) {
-    const abs = join44(cwd, candidate);
+    const abs = join45(cwd, candidate);
     if (existsSync12(abs)) return abs;
   }
   return null;
@@ -287319,7 +287380,7 @@ function resolvePolicyDir(cwd, explicit) {
     return existsSync12(abs) ? abs : null;
   }
   for (const d of DEFAULT_POLICY_DIRS) {
-    const abs = join44(cwd, d);
+    const abs = join45(cwd, d);
     if (existsSync12(abs)) return abs;
   }
   return null;
@@ -287627,9 +287688,9 @@ function PullRequestInfoTool(ctx) {
 
 // node_modules/.pnpm/@infraweaver-io+sandbox@0.1.8/node_modules/@infraweaver-io/sandbox/dist/writePolicy.js
 import { renameSync, writeFileSync as writeFileSync13 } from "node:fs";
-import { join as join45 } from "node:path";
+import { join as join46 } from "node:path";
 function writePolicyPath(tmpdir5, filename) {
-  return join45(tmpdir5, filename);
+  return join46(tmpdir5, filename);
 }
 function publishWritePolicy(params) {
   try {
@@ -287800,12 +287861,12 @@ function SelectModeTool(ctx) {
 }
 
 // src/mcp/terraform/tools/advise.ts
-import { existsSync as existsSync13, readFileSync as readFileSync27 } from "node:fs";
-import { join as join47 } from "node:path";
+import { existsSync as existsSync13, readFileSync as readFileSync28 } from "node:fs";
+import { join as join48 } from "node:path";
 
 // src/mcp/terraform/fixMemory.ts
-import { readFileSync as readFileSync26 } from "node:fs";
-import { join as join46 } from "node:path";
+import { readFileSync as readFileSync27 } from "node:fs";
+import { join as join47 } from "node:path";
 var FIX_MEMORY_FILENAME = FIX_MEMORY_FILE;
 var MAX_DESCRIPTION = 400;
 var MAX_BEFORE_EXAMPLE = 1200;
@@ -287892,7 +287953,7 @@ function loadFixMemory(cwd) {
   const root = cwd ?? process.cwd();
   for (const filename of [FIX_MEMORY_FILENAME, LEGACY_FIX_MEMORY_FILENAME]) {
     try {
-      return parseFixMemory(readFileSync26(join46(root, filename), "utf-8")) ?? [];
+      return parseFixMemory(readFileSync27(join47(root, filename), "utf-8")) ?? [];
     } catch {
     }
   }
@@ -287958,10 +288019,10 @@ function inlineWaivers(content, file2) {
   ];
 }
 function readLearnings(tmpdir5) {
-  const path15 = join47(tmpdir5, LEARNINGS_FILE);
+  const path15 = join48(tmpdir5, LEARNINGS_FILE);
   if (!existsSync13(path15)) return [];
   try {
-    return readFileSync27(path15, "utf-8").split("\n");
+    return readFileSync28(path15, "utf-8").split("\n");
   } catch {
     return [];
   }
@@ -287980,7 +288041,7 @@ function runAdvise(ctx, input2) {
   const learnings = readLearnings(ctx.tmpdir);
   const openConcerns = session.lastScanConcerns;
   const dossiers = files.map((file2) => {
-    const content = readTextCapped(join47(cwd, file2));
+    const content = readTextCapped(join48(cwd, file2));
     const inline = content === null ? [] : inlineWaivers(content, file2);
     const reviewedInline = reviewedCopy(
       cwd,
@@ -289318,8 +289379,8 @@ function ConsolidationCandidatesTool(ctx) {
 }
 
 // src/mcp/terraform/tools/detectPlanDrift.ts
-import { readFileSync as readFileSync28 } from "node:fs";
-import { join as join48 } from "node:path";
+import { readFileSync as readFileSync29 } from "node:fs";
+import { join as join49 } from "node:path";
 
 // src/mcp/terraform/cspm.ts
 var ExternalResource = type({
@@ -289737,7 +289798,7 @@ function readTfFiles(cwd) {
   const out = [];
   for (const file2 of walkTfFiles(cwd)) {
     try {
-      out.push({ file: file2, hcl: readFileSync28(join48(cwd, file2), "utf8") });
+      out.push({ file: file2, hcl: readFileSync29(join49(cwd, file2), "utf8") });
     } catch {
     }
   }
@@ -289754,7 +289815,7 @@ function DetectPlanDriftTool(ctx) {
       const planPath = path15 || !envPlanPath ? resolveWithinCwd(cwd, path15 ?? "plan.json") : envPlanPath;
       let raw2;
       try {
-        raw2 = readFileSync28(planPath, "utf8");
+        raw2 = readFileSync29(planPath, "utf8");
       } catch {
         return skipResult(
           "plan_artifact_not_found",
@@ -289886,13 +289947,13 @@ function DetectPlanDriftTool(ctx) {
 }
 
 // src/mcp/terraform/tools/emitCost.ts
-import { readFileSync as readFileSync29, writeFileSync as writeFileSync14 } from "node:fs";
-import { join as join49 } from "node:path";
+import { readFileSync as readFileSync30, writeFileSync as writeFileSync14 } from "node:fs";
+import { join as join50 } from "node:path";
 
 // src/mcp/terraform/awsPrices.ts
 var AWS_PRICE_REGION = "eu-west-2";
 var AWS_PRICE_CURRENCY = "USD";
-var AWS_PRICE_FETCHED_AT = "2026-09-23";
+var AWS_PRICE_FETCHED_AT = "2026-10-03";
 var AWS_HOURLY_PRICES = {
   "eks-cluster-standard": 0.1,
   "elb-application": 0.02646,
@@ -289910,30 +289971,30 @@ var AWS_PER_GB_PRICES = {
 // src/mcp/terraform/azurePrices.ts
 var AZURE_PRICE_REGION = "westeurope";
 var AZURE_PRICE_CURRENCY = "EUR";
-var AZURE_PRICE_FETCHED_AT = "2026-09-03";
+var AZURE_PRICE_FETCHED_AT = "2026-10-03";
 var AZURE_HOURLY_PRICES = {
-  "app-service-p0v3": 0.0764,
-  "app-service-p1v3": 0.1528,
-  "app-service-p2v3": 0.3057,
-  "app-service-p3v3": 0.6114,
-  "bastion-basic": 0.1631,
-  "bastion-premium": 0.3864,
-  "bastion-standard": 0.249,
-  "firewall-basic": 0.3392,
-  "firewall-premium": 1.5027,
-  "firewall-standard": 1.0733,
-  "redis-c0": 0.0236,
-  "redis-c1": 0.0592,
-  "redis-c2": 0.0962,
-  "redis-c3": 0.1932,
-  "redis-p1": 0.2378,
-  "redis-p2": 0.4766,
-  "redis-p3": 0.9523,
-  "vpn-gateway-vpngw1": 0.1631,
-  "vpn-gateway-vpngw2": 0.4207,
-  "vpn-gateway-vpngw3": 1.0733,
-  "vpn-gateway-vpngw4": 1.8032,
-  "vpn-gateway-vpngw5": 3.1341
+  "app-service-p0v3": 0.0783,
+  "app-service-p1v3": 0.1566,
+  "app-service-p2v3": 0.3133,
+  "app-service-p3v3": 0.6265,
+  "bastion-basic": 0.1672,
+  "bastion-premium": 0.396,
+  "bastion-standard": 0.2552,
+  "firewall-basic": 0.3476,
+  "firewall-premium": 1.54,
+  "firewall-standard": 1.1,
+  "redis-c0": 0.0242,
+  "redis-c1": 0.0607,
+  "redis-c2": 0.0986,
+  "redis-c3": 0.198,
+  "redis-p1": 0.2438,
+  "redis-p2": 0.4884,
+  "redis-p3": 0.9759,
+  "vpn-gateway-vpngw1": 0.1672,
+  "vpn-gateway-vpngw2": 0.4312,
+  "vpn-gateway-vpngw3": 1.1,
+  "vpn-gateway-vpngw4": 1.8479,
+  "vpn-gateway-vpngw5": 3.2119
 };
 
 // src/mcp/terraform/idleFloor.ts
@@ -290211,7 +290272,7 @@ function readTfFiles2(cwd) {
   const out = [];
   for (const file2 of walkTfFiles(cwd)) {
     try {
-      out.push({ file: file2, hcl: readFileSync29(join49(cwd, file2), "utf8") });
+      out.push({ file: file2, hcl: readFileSync30(join50(cwd, file2), "utf8") });
     } catch {
     }
   }
@@ -291475,7 +291536,7 @@ function TerraformEmitVexTool(ctx) {
 // src/mcp/terraform/tools/equivalenceCheck.ts
 import { mkdtempSync as mkdtempSync5, rmSync as rmSync7 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
-import { join as join50 } from "node:path";
+import { join as join51 } from "node:path";
 
 // src/mcp/terraform/refactor/attribution.ts
 import { posix as posix13 } from "node:path";
@@ -293267,12 +293328,12 @@ async function baselineValidateErrors(cwd, base, env2, session) {
   }
   const prefix2 = run("git", ["rev-parse", "--show-prefix"], cwd);
   if (prefix2.status !== 0) return null;
-  const tree = mkdtempSync5(join50(tmpdir3(), "iw-baseline-"));
+  const tree = mkdtempSync5(join51(tmpdir3(), "iw-baseline-"));
   try {
     if (run("git", ["worktree", "add", "--detach", "--quiet", tree, base], cwd).status !== 0) {
       return null;
     }
-    const outcome2 = await scanValidate(join50(tree, prefix2.stdout.trim()), env2);
+    const outcome2 = await scanValidate(join51(tree, prefix2.stdout.trim()), env2);
     if (!outcome2.ran || outcome2.unvalidated) return null;
     const errors = outcome2.concerns.map(validateErrorKey);
     session.baselineValidateErrors = { base, errors };
@@ -293373,7 +293434,7 @@ function TerraformGenerateMovedTool(ctx) {
 
 // src/mcp/terraform/cost.ts
 import { mkdtempSync as mkdtempSync6, rmSync as rmSync8 } from "node:fs";
-import { join as join51 } from "node:path";
+import { join as join52 } from "node:path";
 function parseInfracostBreakdown(stdout) {
   const parsed2 = parseScannerJson(InfracostBreakdownOutput, stdout, "infracost");
   const raw2 = parsed2.totalMonthlyCost;
@@ -293455,15 +293516,15 @@ async function infracostBaseline(cwd, key, tmpdir5) {
   if (!baseRef) return null;
   const prefixResult = run("git", ["rev-parse", "--show-prefix"], cwd);
   const prefix2 = prefixResult.status === 0 ? prefixResult.stdout.trim() : "";
-  const baseDir = mkdtempSync6(join51(tmpdir5, "infracost-base-"));
-  const worktree = join51(baseDir, "wt");
+  const baseDir = mkdtempSync6(join52(tmpdir5, "infracost-base-"));
+  const worktree = join52(baseDir, "wt");
   const add = run("git", ["worktree", "add", "--detach", worktree, baseRef], cwd);
   if (add.status !== 0) {
     rmSync8(baseDir, { recursive: true, force: true });
     return null;
   }
   try {
-    const scanCwd = prefix2 ? join51(worktree, prefix2) : worktree;
+    const scanCwd = prefix2 ? join52(worktree, prefix2) : worktree;
     const r = await runInfracostBreakdown(scanCwd, key);
     if (r.missing || r.status !== 0) return null;
     return parseInfracostBreakdown(r.stdout);
@@ -293534,7 +293595,7 @@ function InfracostDiffTool(ctx) {
 
 // src/mcp/terraform/tools/ingestExternalFindings.ts
 import { statSync as statSync8 } from "node:fs";
-import { join as join52 } from "node:path";
+import { join as join53 } from "node:path";
 
 // src/mcp/terraform/prowlerOcsf.ts
 var DETECTION_FINDING_CREATE = 200401;
@@ -293760,7 +293821,7 @@ var MAX_FEED_BYTES = 100 * 1024 * 1024;
 function readTfFiles3(cwd) {
   const out = [];
   for (const file2 of walkTfFiles(cwd)) {
-    const hcl2 = readTextCapped(join52(cwd, file2));
+    const hcl2 = readTextCapped(join53(cwd, file2));
     if (hcl2 !== null) out.push({ file: file2, hcl: hcl2 });
   }
   return out;
@@ -293917,8 +293978,8 @@ function IngestExternalFindingsTool(ctx) {
 }
 
 // src/mcp/terraform/tools/moduleDocs.ts
-import { readFileSync as readFileSync30, writeFileSync as writeFileSync16 } from "node:fs";
-import { join as join53 } from "node:path";
+import { readFileSync as readFileSync31, writeFileSync as writeFileSync16 } from "node:fs";
+import { join as join54 } from "node:path";
 
 // src/mcp/terraform/moduleDocs.ts
 var VERDICT_CLAIM = {
@@ -294032,7 +294093,7 @@ function TerraformModuleDocsTool(ctx) {
         );
       }
       const absDir = resolveWithinCwd(cwd, module_dir);
-      const target = join53(absDir, "README.md");
+      const target = join54(absDir, "README.md");
       let gitHead = null;
       try {
         gitHead = $("git", ["rev-parse", "HEAD"], { cwd, log: false });
@@ -294040,7 +294101,7 @@ function TerraformModuleDocsTool(ctx) {
       }
       let existing = null;
       try {
-        existing = readFileSync30(target, "utf8");
+        existing = readFileSync31(target, "utf8");
       } catch {
       }
       const priorHead = readFooterGitHead(existing);
@@ -294364,7 +294425,7 @@ function NormalizationCandidatesTool(ctx) {
 
 // src/mcp/terraform/tools/plan.ts
 import { rmSync as rmSync9 } from "node:fs";
-import { join as join54 } from "node:path";
+import { join as join55 } from "node:path";
 var PLAN_JSON_ARGS = ["plan", "-input=false", "-no-color", "-lock=false", "-json"];
 var planFileSeq = 0;
 async function capturePlanPairs(absDir, planFile, creds) {
@@ -294387,7 +294448,7 @@ async function planOneRoot(absDir, creds, tmpdir5) {
       skipReason: `terraform init failed: ${init.stderr.trim().slice(0, 200) || "unknown error"}`
     };
   }
-  const planFile = tmpdir5 ? join54(tmpdir5, `plan-${process.pid}-${planFileSeq++}.tfplan`) : void 0;
+  const planFile = tmpdir5 ? join55(tmpdir5, `plan-${process.pid}-${planFileSeq++}.tfplan`) : void 0;
   const plan = await runTfAsync(
     planFile ? [...PLAN_JSON_ARGS, `-out=${planFile}`] : PLAN_JSON_ARGS,
     absDir,
@@ -294757,8 +294818,8 @@ function TerraformProviderUpgradeTool(ctx) {
 }
 
 // src/mcp/terraform/tfquery.ts
-import { readFileSync as readFileSync31 } from "node:fs";
-import { join as join55 } from "node:path";
+import { readFileSync as readFileSync32 } from "node:fs";
+import { join as join56 } from "node:path";
 var TFQUERY_SUFFIX = ".tfquery.hcl";
 function parseQueryFile(hcl2) {
   return parseBlocks(hcl2, ["list"]).map((block) => {
@@ -294784,7 +294845,7 @@ function collectQueryInventory(cwd) {
   for (const rel of walkFilesBySuffix(cwd, TFQUERY_SUFFIX)) {
     let text;
     try {
-      text = readFileSync31(join55(cwd, rel), "utf8");
+      text = readFileSync32(join56(cwd, rel), "utf8");
     } catch {
       continue;
     }
@@ -294819,7 +294880,7 @@ function TerraformQueryInventoryTool(ctx) {
 }
 
 // src/mcp/terraform/tools/readFindings.ts
-import { readFileSync as readFileSync32 } from "node:fs";
+import { readFileSync as readFileSync33 } from "node:fs";
 var ReadFindingsParams = type({
   "path?": type.string.describe(
     "path to the Assessor's findings.json. Defaults to $INFRAWEAVER_FINDINGS_PATH, then ./findings.json in the workspace."
@@ -294844,7 +294905,7 @@ function ReadFindingsTool(ctx) {
       const findingsPath = path15 || !envFindingsPath ? resolveWithinCwd(cwd, path15 ?? "findings.json") : envFindingsPath;
       let raw2;
       try {
-        raw2 = readFileSync32(findingsPath, "utf8");
+        raw2 = readFileSync33(findingsPath, "utf8");
       } catch {
         return skipResult(
           "findings_not_found",
@@ -295522,7 +295583,25 @@ async function runVerifyRemediation(ctx, { concern_ids, download_external_module
     if (key !== void 0) keyed.push({ id, key });
     else unkeyed.push(id);
   }
-  const keyedVerdict = partitionByKey(keyed, currentKeys);
+  const byKey = partitionByKey(keyed, currentKeys);
+  const read3 = fileReader(cwd);
+  const remainingKeyed = keyed.filter((k) => byKey.remaining.includes(k.id));
+  const atSite = new Set(
+    resolvedAtSite({
+      requested: remainingKeyed.map((k) => ({
+        ...k,
+        site: session.siteById?.get(k.id) ?? null,
+        file: reported.get(k.id)?.location.file
+      })),
+      current: currentConcerns.map((c) => ({ key: concernKeyOf(c), site: siteOf(c, read3) })),
+      firstSites: session.firstSitesByKey ?? /* @__PURE__ */ new Map(),
+      declared: (file2) => new Set(declaredAddresses2(read3(file2) ?? ""))
+    })
+  );
+  const keyedVerdict = {
+    resolved: [...byKey.resolved, ...byKey.remaining.filter((id) => atSite.has(id))],
+    remaining: byKey.remaining.filter((id) => !atSite.has(id))
+  };
   const fallbackVerdict = computeRemediationVerdict(unkeyed, new Set(currentIds));
   const resolved = [...keyedVerdict.resolved, ...fallbackVerdict.resolved];
   const remaining = [...keyedVerdict.remaining, ...fallbackVerdict.remaining];
@@ -298780,11 +298859,11 @@ import {
   mkdirSync as mkdirSync7,
   mkdtempSync as mkdtempSync7,
   readdirSync as readdirSync9,
-  readFileSync as readFileSync34,
+  readFileSync as readFileSync35,
   writeFileSync as writeFileSync17
 } from "node:fs";
 import { tmpdir as osTmpdir } from "node:os";
-import { dirname as dirname8, isAbsolute as isAbsolute6, join as join57, relative as relative6, resolve as resolve8 } from "node:path";
+import { dirname as dirname8, isAbsolute as isAbsolute6, join as join58, relative as relative6, resolve as resolve8 } from "node:path";
 function coercePolicyRules(raw2) {
   const rules = [];
   const rejected = [];
@@ -299036,7 +299115,7 @@ function evaluateRulesStatically(cwd, rules, scope2 = { kind: "all", reason: ""
   const files = [];
   for (const rel of walk.files) {
     try {
-      files.push({ rel, text: readFileSync34(join57(cwd, rel), "utf-8") });
+      files.push({ rel, text: readFileSync35(join58(cwd, rel), "utf-8") });
     } catch {
     }
   }
@@ -299151,16 +299230,16 @@ function cloudEmittedRego(rules) {
 }
 function readOrEmpty(path15) {
   try {
-    return readFileSync34(path15, "utf-8");
+    return readFileSync35(path15, "utf-8");
   } catch {
     return "";
   }
 }
 function regoDirIn(root, skip) {
   for (const dir of DEFAULT_POLICY_DIRS) {
-    const abs = join57(root, dir);
+    const abs = join58(root, dir);
     if (existsSync14(abs) && walkFilesBySuffix(abs, ".rego").some(
-      (rel) => !skip(join57(dir, rel), readOrEmpty(join57(abs, rel)))
+      (rel) => !skip(join58(dir, rel), readOrEmpty(join58(abs, rel)))
     )) {
       return dir;
     }
@@ -299168,14 +299247,14 @@ function regoDirIn(root, skip) {
   return null;
 }
 function withoutSkipped(root, dir, skip, tmpdir5) {
-  const abs = join57(root, dir);
-  const files = readdirSync9(abs, { recursive: true, withFileTypes: true }).filter((e) => e.isFile()).map((e) => relative6(abs, join57(e.parentPath, e.name)));
-  const kept = files.filter((rel) => !skip(join57(dir, rel), readOrEmpty(join57(abs, rel))));
+  const abs = join58(root, dir);
+  const files = readdirSync9(abs, { recursive: true, withFileTypes: true }).filter((e) => e.isFile()).map((e) => relative6(abs, join58(e.parentPath, e.name)));
+  const kept = files.filter((rel) => !skip(join58(dir, rel), readOrEmpty(join58(abs, rel))));
   if (kept.length === files.length) return abs;
-  const copy = join57(mkdtempSync7(join57(tmpdir5 ?? osTmpdir(), "policy-own-")), dir);
+  const copy = join58(mkdtempSync7(join58(tmpdir5 ?? osTmpdir(), "policy-own-")), dir);
   for (const rel of kept) {
-    mkdirSync7(dirname8(join57(copy, rel)), { recursive: true });
-    writeFileSync17(join57(copy, rel), readFileSync34(join57(abs, rel)));
+    mkdirSync7(dirname8(join58(copy, rel)), { recursive: true });
+    writeFileSync17(join58(copy, rel), readFileSync35(join58(abs, rel)));
   }
   return copy;
 }
@@ -299197,18 +299276,18 @@ function resolveRepoPolicy(cwd, baseRef, tmpdir5, notes, skip) {
     }
     const own2 = tree.files.filter((f) => !skip(f.path, f.raw));
     if (!own2.some((f) => f.path.endsWith(".rego"))) continue;
-    const root = mkdtempSync7(join57(tmpdir5 ?? osTmpdir(), "policy-base-"));
+    const root = mkdtempSync7(join58(tmpdir5 ?? osTmpdir(), "policy-base-"));
     for (const f of own2) {
-      mkdirSync7(dirname8(join57(root, f.path)), { recursive: true });
-      writeFileSync17(join57(root, f.path), f.raw);
+      mkdirSync7(dirname8(join58(root, f.path)), { recursive: true });
+      writeFileSync17(join58(root, f.path), f.raw);
     }
     const toml = readFileAtBaseRef(cwd, baseRef, CONFTEST_CONFIG);
-    if (toml.kind === "file") writeFileSync17(join57(root, CONFTEST_CONFIG), toml.raw);
-    const same = head === dir && readdirSync9(join57(cwd, dir), { recursive: true, withFileTypes: true }).filter(
+    if (toml.kind === "file") writeFileSync17(join58(root, CONFTEST_CONFIG), toml.raw);
+    const same = head === dir && readdirSync9(join58(cwd, dir), { recursive: true, withFileTypes: true }).filter(
       (e) => e.isFile()
     ).length === tree.files.length && tree.files.every((f) => {
       try {
-        return readFileSync34(join57(cwd, f.path), "utf-8") === f.raw;
+        return readFileSync35(join58(cwd, f.path), "utf-8") === f.raw;
       } catch {
         return false;
       }
@@ -299218,7 +299297,7 @@ function resolveRepoPolicy(cwd, baseRef, tmpdir5, notes, skip) {
         `the Rego policy differs from the base ref (${tree.ref}) \u2014 applying the BASE ${dir}/ so this change cannot relax the policy reviewing it. It takes effect once merged.`
       );
     }
-    return { policyDir: join57(root, dir), conftestCwd: root };
+    return { policyDir: join58(root, dir), conftestCwd: root };
   }
   if (head) {
     notes.push(
@@ -299228,7 +299307,7 @@ function resolveRepoPolicy(cwd, baseRef, tmpdir5, notes, skip) {
   return null;
 }
 function findWorkflowPlanJson(cwd, notes) {
-  const present = PLAN_JSON_NAMES.filter((name) => existsSync14(join57(cwd, name)));
+  const present = PLAN_JSON_NAMES.filter((name) => existsSync14(join58(cwd, name)));
   if (present.length === 0) return null;
   const listing = run("git", ["ls-files", "-z"], cwd);
   if (listing.status !== 0) {
@@ -299245,7 +299324,7 @@ function findWorkflowPlanJson(cwd, notes) {
       );
       continue;
     }
-    return join57(cwd, name);
+    return join58(cwd, name);
   }
   return null;
 }
@@ -299275,7 +299354,7 @@ function evaluatePolicyGate(cwd, rawRules, opts = {}) {
   let plan;
   if (planPath) {
     try {
-      plan = asPlan(JSON.parse(readFileSync34(planPath, "utf-8")));
+      plan = asPlan(JSON.parse(readFileSync35(planPath, "utf-8")));
     } catch {
     }
     if (!plan) notes.push(`${planPath} is not a Terraform plan JSON \u2014 ignored`);
@@ -299378,7 +299457,7 @@ function capturePolicyGate(ctx) {
     if (!result) return;
     const workspace = process.env.GITHUB_WORKSPACE ?? cwd;
     for (const o of [...result.violations, ...result.inconclusive]) {
-      if (o.file) o.file = posix16(relative6(workspace, join57(cwd, o.file)));
+      if (o.file) o.file = posix16(relative6(workspace, join58(cwd, o.file)));
     }
     session.policyGate = result;
     for (const n of result.notes) log2.warning(`\xBB policy gate: ${n}`);
@@ -299713,7 +299792,7 @@ var ThinkingTimer = class {
 // src/agents/claude.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
 import { chmodSync as chmodSync3, mkdirSync as mkdirSync10, writeFileSync as writeFileSync22 } from "node:fs";
-import { join as join66 } from "node:path";
+import { join as join67 } from "node:path";
 import { performance as performance6 } from "node:perf_hooks";
 import { setTimeout as sleep6 } from "node:timers/promises";
 
@@ -300073,7 +300152,7 @@ import { readFile as readFile2 } from "node:fs/promises";
 
 // src/agents/shared.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { join as join58 } from "node:path";
+import { join as join59 } from "node:path";
 var MAX_STDERR_LINES = 20;
 var MAX_POST_RUN_RETRIES = 3;
 function getGitStatus() {
@@ -300110,7 +300189,7 @@ var agent = (input2) => {
   };
 };
 function agentHomeEnv(tmpdir5) {
-  return { HOME: tmpdir5, XDG_CONFIG_HOME: join58(tmpdir5, ".config") };
+  return { HOME: tmpdir5, XDG_CONFIG_HOME: join59(tmpdir5, ".config") };
 }
 function baseAgentEnv(homeEnv, repoDir) {
   return { ...process.env, ...homeEnv, PWD: repoDir };
@@ -300913,7 +300992,7 @@ function matchesRouteSentinel(envVar, model) {
 import { randomUUID as randomUUID9 } from "node:crypto";
 import { mkdirSync as mkdirSync8, rmSync as rmSync10, writeFileSync as writeFileSync18 } from "node:fs";
 import { homedir } from "node:os";
-import { join as join59 } from "node:path";
+import { join as join60 } from "node:path";
 var VERTEX_SERVICE_ACCOUNT_JSON_ENV = "VERTEX_SERVICE_ACCOUNT_JSON";
 var GOOGLE_APPLICATION_CREDENTIALS_ENV = "GOOGLE_APPLICATION_CREDENTIALS";
 var GOOGLE_CLOUD_PROJECT_ENV = "GOOGLE_CLOUD_PROJECT";
@@ -300937,7 +301016,7 @@ function readProjectIdFromVertexServiceAccountJson() {
 }
 function createSecretDir() {
   const base = process.env.INFRAWEAVER_SECRET_HOME || process.env.HOME || homedir();
-  const secretDir = join59(base, `.${PRODUCT_SLUG}`, "secrets", randomUUID9());
+  const secretDir = join60(base, `.${PRODUCT_SLUG}`, "secrets", randomUUID9());
   mkdirSync8(secretDir, { recursive: true, mode: 448 });
   return secretDir;
 }
@@ -300946,7 +301025,7 @@ function materializeVertexCredentials(params) {
   const blob = process.env[VERTEX_SERVICE_ACCOUNT_JSON_ENV];
   if (!blob) return void 0;
   const secretDir = createSecretDir();
-  const credentialsPath = join59(secretDir, "vertex-sa.json");
+  const credentialsPath = join60(secretDir, "vertex-sa.json");
   writeFileSync18(credentialsPath, blob, { mode: 384 });
   process.env[GOOGLE_APPLICATION_CREDENTIALS_ENV] = credentialsPath;
   const projectId = readProjectIdFromVertexServiceAccountJson();
@@ -301082,15 +301161,15 @@ function createProcessOutputActivityTimeout(ctx) {
 }
 
 // src/utils/prompt/skills.ts
-import { existsSync as existsSync15, mkdirSync as mkdirSync9, readFileSync as readFileSync35, writeFileSync as writeFileSync19 } from "node:fs";
-import { dirname as dirname9, join as join60 } from "node:path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync9, readFileSync as readFileSync36, writeFileSync as writeFileSync19 } from "node:fs";
+import { dirname as dirname9, join as join61 } from "node:path";
 import { fileURLToPath } from "node:url";
 var BUNDLED_SKILL_NAMES = ["terraform-best-practices"];
 function resolveSkillPath(name) {
   const here = dirname9(fileURLToPath(import.meta.url));
   const candidates = [
-    join60(here, "..", "..", "skills", name, "SKILL.md"),
-    join60(here, "skills", name, "SKILL.md")
+    join61(here, "..", "..", "skills", name, "SKILL.md"),
+    join61(here, "skills", name, "SKILL.md")
   ];
   for (const candidate of candidates) {
     if (existsSync15(candidate)) return candidate;
@@ -301100,11 +301179,11 @@ function resolveSkillPath(name) {
 var SKILL_TARGET_DIRS = [".opencode/skills", ".claude/skills", ".agents/skills"];
 function installBundledSkills(params) {
   for (const name of BUNDLED_SKILL_NAMES) {
-    const content = readFileSync35(resolveSkillPath(name), "utf8");
+    const content = readFileSync36(resolveSkillPath(name), "utf8");
     for (const targetDir of SKILL_TARGET_DIRS) {
-      const skillDir = join60(params.home, targetDir, name);
+      const skillDir = join61(params.home, targetDir, name);
       mkdirSync9(skillDir, { recursive: true });
-      writeFileSync19(join60(skillDir, "SKILL.md"), content);
+      writeFileSync19(join61(skillDir, "SKILL.md"), content);
     }
   }
   log2.success(`installed bundled skills: ${BUNDLED_SKILL_NAMES.join(", ")}`);
@@ -301113,8 +301192,8 @@ function installBundledSkills(params) {
 // src/utils/setup/install.ts
 import { spawnSync as spawnSync9 } from "node:child_process";
 import { createHash as createHash14 } from "node:crypto";
-import { chmodSync as chmodSync2, createWriteStream as createWriteStream2, existsSync as existsSync18, readFileSync as readFileSync36 } from "node:fs";
-import { join as join65 } from "node:path";
+import { chmodSync as chmodSync2, createWriteStream as createWriteStream2, existsSync as existsSync18, readFileSync as readFileSync37 } from "node:fs";
+import { join as join66 } from "node:path";
 import { pipeline as pipeline2 } from "node:stream/promises";
 
 // src/utils/setup/tarballCache.ts
@@ -301169,7 +301248,7 @@ function verifyTarballIntegrity(tarballPath, dist, descriptor) {
       `Refusing to install ${descriptor}: the registry published no integrity digest (neither dist.integrity nor dist.shasum), so the download cannot be verified.`
     );
   }
-  const bytes = readFileSync36(tarballPath);
+  const bytes = readFileSync37(tarballPath);
   if (integrity2) {
     const candidates = integrity2.trim().split(/\s+/).filter(Boolean);
     for (const candidate of candidates) {
@@ -301198,8 +301277,8 @@ function verifyTarballIntegrity(tarballPath, dist, descriptor) {
 }
 async function installFromNpmTarball(params) {
   const tempDir = getTempDir();
-  const extractedDir = join65(tempDir, "package");
-  const cliPath = join65(extractedDir, params.executablePath);
+  const extractedDir = join66(tempDir, "package");
+  const cliPath = join66(extractedDir, params.executablePath);
   if (existsSync18(cliPath)) {
     log2.debug(`\xBB using cached binary at ${cliPath}`);
     return cliPath;
@@ -301251,7 +301330,7 @@ async function installFromNpmTarball(params) {
     dist = (await manifestResponse.json()).dist;
   }
   log2.debug(`\xBB installing ${params.packageName}@${resolvedVersion}...`);
-  const tarballPath = join65(tempDir, "package.tgz");
+  const tarballPath = join66(tempDir, "package.tgz");
   const tarballFileName = params.packageName.startsWith("@") ? params.packageName.split("/")[1] : params.packageName;
   const tarballUrl = `${npmRegistry}/${encodedName}/-/${tarballFileName}-${resolvedVersion}.tgz`;
   const restored = await restoreTarball({
@@ -301402,9 +301481,9 @@ var CLAUDE_DISALLOWED_TOOLS = CLAUDE_EXEC_TOOL_DENY_RULES.join(",");
 var INFRAWEAVER_MCP_AUTH_HEADER = `Bearer \${${MCP_SERVER_TOKEN_ENV}}`;
 var CLAUDE_MAX_CONCURRENT_SUBAGENTS_DEFAULT = "4";
 function writeMcpConfig(ctx) {
-  const configDir = join66(ctx.tmpdir, ".claude");
+  const configDir = join67(ctx.tmpdir, ".claude");
   mkdirSync10(configDir, { recursive: true });
-  const configPath = join66(configDir, "mcp.json");
+  const configPath = join67(configDir, "mcp.json");
   const terraformMcp = resolveTerraformMcp(ctx.payload);
   if (terraformMcp.kind === "docker_missing") log2.info(`\xBB ${terraformMcp.note}`);
   const opentofuMcp = resolveOpenTofuMcp(ctx.payload);
@@ -301436,13 +301515,13 @@ function writeMcpConfig(ctx) {
   return configPath;
 }
 function writePretoolGateAssets(ctx, stopHookPath) {
-  const scriptPath = join66(ctx.tmpdir, CLAUDE_PRETOOL_GATE_FILENAME);
+  const scriptPath = join67(ctx.tmpdir, CLAUDE_PRETOOL_GATE_FILENAME);
   writeFileSync22(
     scriptPath,
     buildClaudePretoolGateSource(ctx.subagentDeniedTools, writePolicyPath2(ctx.tmpdir))
   );
   chmodSync3(scriptPath, 493);
-  const settingsPath = join66(ctx.tmpdir, "infraweaver-claude-settings.json");
+  const settingsPath = join67(ctx.tmpdir, "infraweaver-claude-settings.json");
   const settings = buildClaudePretoolGateSettings(scriptPath, CLAUDE_EXEC_TOOL_DENY_RULES);
   settings.permissions.deny.push(...harnessTmpdirWriteDenyClaude(ctx.tmpdir));
   if (stopHookPath) {
@@ -302067,11 +302146,11 @@ var claude = agent({
       const onVertex = matchesRouteSentinel(VERTEX_MODEL_ID_ENV, specifier) && specifier !== void 0 && isVertexAnthropicId(specifier);
       const model = !specifier ? void 0 : onBedrock ? specifier : onVertex ? void 0 : stripProviderPrefix(specifier);
       const homeEnv = agentHomeEnv(ctx.tmpdir);
-      mkdirSync10(join66(homeEnv.XDG_CONFIG_HOME, "claude"), { recursive: true });
+      mkdirSync10(join67(homeEnv.XDG_CONFIG_HOME, "claude"), { recursive: true });
       installBundledSkills({ home: homeEnv.HOME });
       const mcpConfigPath = writeMcpConfig(ctx);
       const effort = resolveEffort(model);
-      const stopHookPath = join66(ctx.tmpdir, "infraweaver-stop-hook.sh");
+      const stopHookPath = join67(ctx.tmpdir, "infraweaver-stop-hook.sh");
       writeFileSync22(stopHookPath, buildStopHookScript(), { mode: 493 });
       const pretoolGate = writePretoolGateAssets(ctx, stopHookPath);
       installManagedSettings({
@@ -302237,7 +302316,7 @@ var claude = agent({
 init_core3();
 import { spawn as nodeSpawn2 } from "node:child_process";
 import { mkdirSync as mkdirSync12, writeFileSync as writeFileSync24 } from "node:fs";
-import { join as join68 } from "node:path";
+import { join as join69 } from "node:path";
 import { performance as performance7 } from "node:perf_hooks";
 import { StringDecoder as StringDecoder2 } from "node:string_decoder";
 import { setTimeout as sleep7 } from "node:timers/promises";
@@ -307920,7 +307999,7 @@ function autoSelectModel() {
 import { execFileSync as execFileSync4 } from "node:child_process";
 import { mkdirSync as mkdirSync11, writeFileSync as writeFileSync23 } from "node:fs";
 import { homedir as homedir3, userInfo as userInfo2 } from "node:os";
-import { join as join67 } from "node:path";
+import { join as join68 } from "node:path";
 
 // src/utils/agent/codexOAuth.ts
 init_webapi();
@@ -307974,8 +308053,8 @@ function installCodexAuth() {
   }
   const expiresMs = decodeJwtExpMs(body2.tokens.access_token) ?? 0;
   const xdgDataHome = resolveDataHome();
-  const opencodeDir = join67(xdgDataHome, "opencode");
-  const authPath = join67(opencodeDir, "auth.json");
+  const opencodeDir = join68(xdgDataHome, "opencode");
+  const authPath = join68(opencodeDir, "auth.json");
   const opencodeAuth = {
     openai: {
       type: "oauth",
@@ -307999,7 +308078,7 @@ function installCodexAuth() {
   };
 }
 function resolveDataHome() {
-  if (process.env.CI !== "true") return join67(homedir3(), ".local", "share");
+  if (process.env.CI !== "true") return join68(homedir3(), ".local", "share");
   bootstrapInfraweaverDataDir();
   return INFRAWEAVER_DATA_DIR;
 }
@@ -308740,10 +308819,10 @@ var opencode = agent({
     const openAiCompatModel = resolveOpenAiCompatibleOpenCodeModel(rawModel);
     const model = isBedrockRoute ? `amazon-bedrock/${rawModel}` : vertexModel ?? openAiCompatModel ?? rawModel;
     const homeEnv = agentHomeEnv(ctx.tmpdir);
-    const opencodePluginDir = join68(homeEnv.XDG_CONFIG_HOME, "opencode", "plugin");
+    const opencodePluginDir = join69(homeEnv.XDG_CONFIG_HOME, "opencode", "plugin");
     mkdirSync12(opencodePluginDir, { recursive: true });
     writeFileSync24(
-      join68(opencodePluginDir, INFRAWEAVER_OPENCODE_GATE_PLUGIN_FILENAME),
+      join69(opencodePluginDir, INFRAWEAVER_OPENCODE_GATE_PLUGIN_FILENAME),
       buildOpencodeSubagentGateSource(ctx.subagentDeniedTools, writePolicyPath2(ctx.tmpdir))
     );
     installBundledSkills({ home: homeEnv.HOME });
@@ -309779,7 +309858,7 @@ async function fetchRunContext(params) {
 // src/utils/github/github.ts
 init_core3();
 import { rename as rename2, writeFile as writeFile2 } from "node:fs/promises";
-import { dirname as dirname12, join as join69 } from "node:path";
+import { dirname as dirname12, join as join70 } from "node:path";
 
 // node_modules/.pnpm/universal-user-agent@7.0.3/node_modules/universal-user-agent/index.js
 function getUserAgent2() {
@@ -315595,7 +315674,7 @@ function getGitHubUsageSummary() {
 }
 async function writeGitHubUsageSummaryToFile(path15) {
   const summary2 = getGitHubUsageSummary();
-  const tmpPath = join69(dirname12(path15), `.usage-summary-${process.pid}.tmp`);
+  const tmpPath = join70(dirname12(path15), `.usage-summary-${process.pid}.tmp`);
   await writeFile2(tmpPath, JSON.stringify(summary2));
   await rename2(tmpPath, path15);
 }
@@ -316140,7 +316219,7 @@ async function resolveModelAndAuth(params) {
 // src/utils/run/runLifecycle.ts
 init_core3();
 import { writeFile as writeFile5 } from "node:fs/promises";
-import { join as join72, resolve as resolve10 } from "node:path";
+import { join as join73, resolve as resolve10 } from "node:path";
 
 // src/utils/cloud/cloudReport.ts
 init_core3();
@@ -316534,7 +316613,7 @@ async function reportToCloud(input2) {
 
 // src/utils/cloud/learnings.ts
 import { mkdir as mkdir3, readFile as readFile3, writeFile as writeFile3 } from "node:fs/promises";
-import { dirname as dirname13, join as join70 } from "node:path";
+import { dirname as dirname13, join as join71 } from "node:path";
 
 // src/utils/cloud/learningsTruncate.ts
 var MAX_LEARNINGS_LENGTH = 1e5;
@@ -316551,7 +316630,7 @@ function truncateAtLineBoundary(body2, cap2) {
 // src/utils/cloud/learnings.ts
 var LEARNINGS_FILE_NAME = LEARNINGS_FILE;
 function learningsFilePath(tmpdir5) {
-  return join70(tmpdir5, LEARNINGS_FILE_NAME);
+  return join71(tmpdir5, LEARNINGS_FILE_NAME);
 }
 async function seedLearningsFile(params) {
   const path15 = learningsFilePath(params.tmpdir);
@@ -316682,7 +316761,7 @@ ${ctx.error}` : ctx.error;
 
 // src/utils/github/prSummary.ts
 import { mkdir as mkdir4, readFile as readFile4, writeFile as writeFile4 } from "node:fs/promises";
-import { dirname as dirname14, join as join71 } from "node:path";
+import { dirname as dirname14, join as join72 } from "node:path";
 var SUMMARY_FILE_NAME = SUMMARY_FILE;
 var SUMMARY_SCAFFOLD = `# PR summary
 
@@ -316692,7 +316771,7 @@ var SUMMARY_SCAFFOLD = `# PR summary
 var MIN_SNAPSHOT_LENGTH = 60;
 var MAX_SNAPSHOT_LENGTH = 32768;
 function summaryFilePath(tmpdir5) {
-  return join71(tmpdir5, SUMMARY_FILE_NAME);
+  return join72(tmpdir5, SUMMARY_FILE_NAME);
 }
 async function seedSummaryFile(params) {
   const path15 = summaryFilePath(params.tmpdir);
@@ -317226,7 +317305,7 @@ async function emitFindingsOutputs(toolState, requiredControls) {
       if (a.level === "error") error62(a.message, props);
       else warning(a.message, props);
     }
-    const sarifPath = join72(workspace, SARIF_FILE);
+    const sarifPath = join73(workspace, SARIF_FILE);
     if (session.emittedSarifPath && resolve10(session.emittedSarifPath) === resolve10(sarifPath)) {
       log2.info(`\xBB findings output: replacing the agent-emitted ${SARIF_FILE} with the gate's`);
     }
@@ -317658,7 +317737,7 @@ async function runAgentWithWatchdogs(params) {
 // src/phases/startToolPlane.ts
 import { existsSync as existsSync19, readdirSync as readdirSync10 } from "node:fs";
 import { readFile as readFile5 } from "node:fs/promises";
-import { join as join73 } from "node:path";
+import { join as join74 } from "node:path";
 
 // src/utils/cloud/runTerminalStatus.ts
 var TERMINAL_STATE_KEY = "run_terminal";
@@ -318486,7 +318565,7 @@ ${instructions.user}` : null,
     log2.info(instructions.full);
   });
   if (toolContext.agentId === "opencode") {
-    const pluginDir = join73(process.cwd(), ".opencode", "plugin");
+    const pluginDir = join74(process.cwd(), ".opencode", "plugin");
     const hasPlugins = existsSync19(pluginDir) && readdirSync10(pluginDir).some((f) => /\.[jt]sx?$/.test(f));
     if (hasPlugins && toolState.dependencyInstallation?.promise) {
       log2.info(