infraweaver 0.3.11 → 0.3.12

package/dist/mcp/terraform/awsPrices.d.ts

@@ -3,7 +3,7 @@ export declare const AWS_PRICE_REGION = "eu-west-2";
 /** Currency of every price below. The bulk API quotes USD for every region. */
 export declare const AWS_PRICE_CURRENCY = "USD";
 /** ISO date the snapshot was captured — surfaced in cost.md so staleness is visible. */
-export declare const AWS_PRICE_FETCHED_AT = "2026-09-23";
+export declare const AWS_PRICE_FETCHED_AT = "2026-10-03";
 /** meter key → list price per HOUR. */
 export declare const AWS_HOURLY_PRICES: Record<string, number>;
 /** meter key → list price per GB processed. Usage, so never part of a floor. */

package/dist/mcp/terraform/azurePrices.d.ts

@@ -3,6 +3,6 @@ export declare const AZURE_PRICE_REGION = "westeurope";
 /** Currency of every price below. */
 export declare const AZURE_PRICE_CURRENCY = "EUR";
 /** ISO date the snapshot was captured — surfaced in cost.md so staleness is visible. */
-export declare const AZURE_PRICE_FETCHED_AT = "2026-09-03";
+export declare const AZURE_PRICE_FETCHED_AT = "2026-10-03";
 /** meter key → list price per HOUR. */
 export declare const AZURE_HOURLY_PRICES: Record<string, number>;

package/dist/mcp/terraform/scanSession.d.ts

@@ -44,6 +44,8 @@ export interface ScanSession {
     baselineFmtDriftFiles?: string[];
     lastScanConcerns?: Concern[];
     concernsById?: Map<string, Concern>;
+    siteById?: Map<string, string | null>;
+    firstSitesByKey?: Map<string, Set<string | null>>;
     gateConcerns?: Concern[];
     policyRules?: unknown[] | null;
     policyGate?: PolicyGateResult;

package/dist/mcp/terraform/verifySites.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Which findings a fix resolved where its rule still fires elsewhere in the file.
+ *
+ * terraform_verify_remediation keys a finding on (scanner, rule, file), so a
+ * rule fixed on one resource but still firing on another in the same file read
+ * as unfixed for both: AWSGoat's open-egress fix on two of four security groups
+ * verified as 0 of 5. Counting by resource instead risks the opposite error —
+ * a fix that moves the defect onto a new resource would look resolved — so a
+ * finding counts as resolved at its own site only when ALL of these hold:
+ *
+ *   - it was placed on a resource when it was reported;
+ *   - that resource is still declared in the file (a renamed or deleted one
+ *     proves nothing);
+ *   - the rule no longer fires on it;
+ *   - every place the rule still fires in the file is a resource it already
+ *     fired on before the fix (no new site, and no finding outside a resource).
+ *
+ * Anything else keeps the file-level answer, which under-claims and never
+ * over-claims.
+ */
+import type { ScanSession } from "./scanSession.js";
+import { type Concern } from "./types.js";
+/** A reader that returns each file under `cwd` once, or null when unreadable. */
+export declare function fileReader(cwd: string): (file: string) => string | null;
+/** The resource a concern sits in, read from the file as it is now. */
+export declare function siteOf(c: Concern, read: (file: string) => string | null): string | null;
+/** Remember where each reported concern sat, and the first sites per key. */
+export declare function recordConcernSites(session: ScanSession, concerns: Concern[], cwd: string): void;
+export interface SiteRequest {
+    id: string;
+    /** the (scanner, rule, file) key */
+    key: string;
+    /** the resource address the finding sat in when reported, or null */
+    site: string | null;
+    file: string | undefined;
+}
+export declare function resolvedAtSite(params: {
+    requested: readonly SiteRequest[];
+    /** every finding the re-scan reports, with the resource it sits in */
+    current: readonly {
+        key: string;
+        site: string | null;
+    }[];
+    /** per key, the resources the rule fired on in the first scan of the run */
+    firstSites: ReadonlyMap<string, ReadonlySet<string | null>>;
+    /** the resource addresses a file declares now */
+    declared: (file: string) => ReadonlySet<string>;
+}): string[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "infraweaver",
-  "version": "0.3.11",
+  "version": "0.3.12",
   "description": "GitHub Action that remediates Terraform to best practices and opens one scoped pull request per concern.",
   "keywords": [
     "ai-coding-agent",

package/src/mcp/terraform/awsPrices.ts

@@ -13,7 +13,7 @@ export const AWS_PRICE_REGION = "eu-west-2";
 /** Currency of every price below. The bulk API quotes USD for every region. */
 export const AWS_PRICE_CURRENCY = "USD";
 /** ISO date the snapshot was captured — surfaced in cost.md so staleness is visible. */
-export const AWS_PRICE_FETCHED_AT = "2026-09-23";
+export const AWS_PRICE_FETCHED_AT = "2026-10-03";
 
 /** meter key → list price per HOUR. */
 export const AWS_HOURLY_PRICES: Record<string, number> = {

package/src/mcp/terraform/azurePrices.ts

@@ -9,30 +9,30 @@ export const AZURE_PRICE_REGION = "westeurope";
 /** Currency of every price below. */
 export const AZURE_PRICE_CURRENCY = "EUR";
 /** ISO date the snapshot was captured — surfaced in cost.md so staleness is visible. */
-export const AZURE_PRICE_FETCHED_AT = "2026-09-03";
+export const AZURE_PRICE_FETCHED_AT = "2026-10-03";
 
 /** meter key → list price per HOUR. */
 export const AZURE_HOURLY_PRICES: Record<string, number> = {
-  "app-service-p0v3": 0.0764,
-  "app-service-p1v3": 0.1528,
-  "app-service-p2v3": 0.3057,
-  "app-service-p3v3": 0.6114,
-  "bastion-basic": 0.1631,
-  "bastion-premium": 0.3864,
-  "bastion-standard": 0.249,
-  "firewall-basic": 0.3392,
-  "firewall-premium": 1.5027,
-  "firewall-standard": 1.0733,
-  "redis-c0": 0.0236,
-  "redis-c1": 0.0592,
-  "redis-c2": 0.0962,
-  "redis-c3": 0.1932,
-  "redis-p1": 0.2378,
-  "redis-p2": 0.4766,
-  "redis-p3": 0.9523,
-  "vpn-gateway-vpngw1": 0.1631,
-  "vpn-gateway-vpngw2": 0.4207,
-  "vpn-gateway-vpngw3": 1.0733,
-  "vpn-gateway-vpngw4": 1.8032,
-  "vpn-gateway-vpngw5": 3.1341,
+  "app-service-p0v3": 0.0783,
+  "app-service-p1v3": 0.1566,
+  "app-service-p2v3": 0.3133,
+  "app-service-p3v3": 0.6265,
+  "bastion-basic": 0.1672,
+  "bastion-premium": 0.396,
+  "bastion-standard": 0.2552,
+  "firewall-basic": 0.3476,
+  "firewall-premium": 1.54,
+  "firewall-standard": 1.1,
+  "redis-c0": 0.0242,
+  "redis-c1": 0.0607,
+  "redis-c2": 0.0986,
+  "redis-c3": 0.198,
+  "redis-p1": 0.2438,
+  "redis-p2": 0.4884,
+  "redis-p3": 0.9759,
+  "vpn-gateway-vpngw1": 0.1672,
+  "vpn-gateway-vpngw2": 0.4312,
+  "vpn-gateway-vpngw3": 1.1,
+  "vpn-gateway-vpngw4": 1.8479,
+  "vpn-gateway-vpngw5": 3.2119,
 };

package/src/mcp/terraform/concernResult.ts

@@ -25,6 +25,7 @@ import {
   type Severity,
   sortConcerns,
 } from "#app/mcp/terraform/types";
+import { recordConcernSites } from "#app/mcp/terraform/verifySites";
 
 export interface ConcernResult {
   /** non-suppressed concerns ≥ threshold, sorted */
@@ -128,6 +129,7 @@ export function buildConcernResult(
     fullBaseline.map((c) => concernKeyOf(c)),
   );
   recordConcernKeys(session, fullBaseline);
+  recordConcernSites(session, fullBaseline, opts.cwd);
   // the files already unformatted at this (pre-fix) scan. terraform_validate
   // subtracts these so PRE-EXISTING `terraform fmt` drift can't force a
   // whole-file reformat into a scoped fix. Captured from the raw set (fmt

package/src/mcp/terraform/scanSession.ts

@@ -77,6 +77,12 @@ export interface ScanSession {
   // agent took from the FIRST scan (`concernKeyOf`), or it falls back to
   // matching ids exactly and calls every line-shifted finding resolved.
   concernsById?: Map<string, Concern>;
+  // the resource each reported concern sat in when it was reported (by id), and
+  // per (scanner, rule, file) key the resources the rule fired on the first time
+  // the run saw that key. terraform_verify_remediation reads both to count a fix
+  // on one resource while the rule still fires on another (see verifySites).
+  siteById?: Map<string, string | null>;
+  firstSitesByKey?: Map<string, Set<string | null>>;
   // the findings gate's concern set: scanned by the engine itself before the
   // agent starts, on the tree the run was invoked on, at the CONFIGURED
   // threshold and scope. read at end-of-run by finalizeSuccessRun for the

package/src/mcp/terraform/tools/verifyRemediation.ts

@@ -3,6 +3,7 @@ import type { LocalToolContext } from "#app/mcp/localContext";
 import { execute, tool, toolOk } from "#app/mcp/shared";
 import { computeConfidence } from "#app/mcp/terraform/decisions";
 import { captureProvenFix } from "#app/mcp/terraform/fixMemory";
+import { declaredAddresses } from "#app/mcp/terraform/scanDelta";
 import {
   computeRegressions,
   computeRemediationVerdict,
@@ -12,6 +13,7 @@ import {
 } from "#app/mcp/terraform/scanners";
 import { hasBaseline, scanSessionOf } from "#app/mcp/terraform/scanSession";
 import { concernKeyOf, dedupe } from "#app/mcp/terraform/types";
+import { fileReader, resolvedAtSite, siteOf } from "#app/mcp/terraform/verifySites";
 import { log } from "#app/utils/cli";
 import { resolveToolSelection } from "#app/utils/prompt/toolSelection";
 import { resolveModuleCredentialEnv } from "#app/utils/setup/registryAuth";
@@ -82,7 +84,27 @@ export async function runVerifyRemediation(
     if (key !== undefined) keyed.push({ id, key });
     else unkeyed.push(id);
   }
-  const keyedVerdict = partitionByKey(keyed, currentKeys);
+  const byKey = partitionByKey(keyed, currentKeys);
+  // a rule still firing in the file may have been fixed on THIS finding's
+  // resource; count it only under the conditions verifySites spells out
+  const read = fileReader(cwd);
+  const remainingKeyed = keyed.filter((k) => byKey.remaining.includes(k.id));
+  const atSite = new Set(
+    resolvedAtSite({
+      requested: remainingKeyed.map((k) => ({
+        ...k,
+        site: session.siteById?.get(k.id) ?? null,
+        file: reported.get(k.id)?.location.file,
+      })),
+      current: currentConcerns.map((c) => ({ key: concernKeyOf(c), site: siteOf(c, read) })),
+      firstSites: session.firstSitesByKey ?? new Map(),
+      declared: (file) => new Set(declaredAddresses(read(file) ?? "")),
+    }),
+  );
+  const keyedVerdict = {
+    resolved: [...byKey.resolved, ...byKey.remaining.filter((id) => atSite.has(id))],
+    remaining: byKey.remaining.filter((id) => !atSite.has(id)),
+  };
   const fallbackVerdict = computeRemediationVerdict(unkeyed, new Set(currentIds));
   const resolved = [...keyedVerdict.resolved, ...fallbackVerdict.resolved];
   const remaining = [...keyedVerdict.remaining, ...fallbackVerdict.remaining];

package/src/mcp/terraform/verifySites.ts

@@ -0,0 +1,106 @@
+/**
+ * Which findings a fix resolved where its rule still fires elsewhere in the file.
+ *
+ * terraform_verify_remediation keys a finding on (scanner, rule, file), so a
+ * rule fixed on one resource but still firing on another in the same file read
+ * as unfixed for both: AWSGoat's open-egress fix on two of four security groups
+ * verified as 0 of 5. Counting by resource instead risks the opposite error —
+ * a fix that moves the defect onto a new resource would look resolved — so a
+ * finding counts as resolved at its own site only when ALL of these hold:
+ *
+ *   - it was placed on a resource when it was reported;
+ *   - that resource is still declared in the file (a renamed or deleted one
+ *     proves nothing);
+ *   - the rule no longer fires on it;
+ *   - every place the rule still fires in the file is a resource it already
+ *     fired on before the fix (no new site, and no finding outside a resource).
+ *
+ * Anything else keeps the file-level answer, which under-claims and never
+ * over-claims.
+ */
+
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import type { ScanSession } from "#app/mcp/terraform/scanSession";
+import { resourceAddressAt } from "#app/mcp/terraform/suppressions";
+import { type Concern, concernKeyOf } from "#app/mcp/terraform/types";
+
+/** A reader that returns each file under `cwd` once, or null when unreadable. */
+export function fileReader(cwd: string): (file: string) => string | null {
+  const cache = new Map<string, string | null>();
+  return (file) => {
+    if (!cache.has(file)) {
+      let text: string | null;
+      try {
+        text = readFileSync(join(cwd, file), "utf8");
+      } catch {
+        text = null;
+      }
+      cache.set(file, text);
+    }
+    return cache.get(file) ?? null;
+  };
+}
+
+/** The resource a concern sits in, read from the file as it is now. */
+export function siteOf(c: Concern, read: (file: string) => string | null): string | null {
+  const text = read(c.location.file);
+  return text === null ? null : resourceAddressAt(text, c.location.line);
+}
+
+/** Remember where each reported concern sat, and the first sites per key. */
+export function recordConcernSites(session: ScanSession, concerns: Concern[], cwd: string): void {
+  const read = fileReader(cwd);
+  session.siteById ??= new Map();
+  session.firstSitesByKey ??= new Map();
+  const first = session.firstSitesByKey;
+  const fresh = new Map<string, Set<string | null>>();
+  for (const c of concerns) {
+    const site = siteOf(c, read);
+    session.siteById.set(c.id, site);
+    const key = concernKeyOf(c);
+    if (first.has(key)) continue;
+    const sites = fresh.get(key) ?? new Set();
+    sites.add(site);
+    fresh.set(key, sites);
+  }
+  for (const [key, sites] of fresh) first.set(key, sites);
+}
+
+export interface SiteRequest {
+  id: string;
+  /** the (scanner, rule, file) key */
+  key: string;
+  /** the resource address the finding sat in when reported, or null */
+  site: string | null;
+  file: string | undefined;
+}
+
+export function resolvedAtSite(params: {
+  requested: readonly SiteRequest[];
+  /** every finding the re-scan reports, with the resource it sits in */
+  current: readonly { key: string; site: string | null }[];
+  /** per key, the resources the rule fired on in the first scan of the run */
+  firstSites: ReadonlyMap<string, ReadonlySet<string | null>>;
+  /** the resource addresses a file declares now */
+  declared: (file: string) => ReadonlySet<string>;
+}): string[] {
+  const firingByKey = new Map<string, (string | null)[]>();
+  for (const c of params.current) {
+    const list = firingByKey.get(c.key) ?? [];
+    list.push(c.site);
+    firingByKey.set(c.key, list);
+  }
+  const out: string[] = [];
+  for (const r of params.requested) {
+    if (r.site === null || r.file === undefined) continue;
+    const firing = firingByKey.get(r.key) ?? [];
+    const known = params.firstSites.get(r.key);
+    if (known === undefined) continue;
+    if (firing.some((s) => s === null || !known.has(s))) continue;
+    if (firing.includes(r.site)) continue;
+    if (!params.declared(r.file).has(r.site)) continue;
+    out.push(r.id);
+  }
+  return out;
+}