infraweaver 0.3.11 → 0.3.13

package/dist/cli.mjs

@@ -80148,7 +80148,7 @@ var require_polyfill = __commonJS({
     var {
       dirname: dirname16,
       isAbsolute: isAbsolute10,
-      join: join77,
+      join: join78,
       parse: parse8,
       resolve: resolve15,
       sep: sep12,
@@ -80405,8 +80405,8 @@ var require_polyfill = __commonJS({
       const dir = await readdir2(src);
       for (let i = 0; i < dir.length; i++) {
         const item = dir[i];
-        const srcItem = join77(src, item);
-        const destItem = join77(dest, item);
+        const srcItem = join78(src, item);
+        const destItem = join78(dest, item);
         const { destStat } = await checkPaths2(srcItem, destItem, opts);
         await startCopy(destStat, srcItem, destItem, opts);
       }
@@ -80479,7 +80479,7 @@ var require_cp = __commonJS({
 // node_modules/.pnpm/@npmcli+fs@6.0.0/node_modules/@npmcli/fs/lib/with-temp-dir.js
 var require_with_temp_dir = __commonJS({
   "node_modules/.pnpm/@npmcli+fs@6.0.0/node_modules/@npmcli/fs/lib/with-temp-dir.js"(exports2, module) {
-    var { join: join77, sep: sep12 } = __require("path");
+    var { join: join78, sep: sep12 } = __require("path");
     var getOptions2 = require_get_options();
     var { mkdir: mkdir5, mkdtemp, rm: rm2 } = __require("fs/promises");
     var withTempDir = async (root, fn2, opts) => {
@@ -80487,7 +80487,7 @@ var require_with_temp_dir = __commonJS({
         copy: ["tmpPrefix"]
       });
       await mkdir5(root, { recursive: true });
-      const target = await mkdtemp(join77(`${root}${sep12}`, options.tmpPrefix || ""));
+      const target = await mkdtemp(join78(`${root}${sep12}`, options.tmpPrefix || ""));
       let err;
       let result;
       try {
@@ -80512,13 +80512,13 @@ var require_with_temp_dir = __commonJS({
 var require_readdir_scoped = __commonJS({
   "node_modules/.pnpm/@npmcli+fs@6.0.0/node_modules/@npmcli/fs/lib/readdir-scoped.js"(exports2, module) {
     var { readdir: readdir2 } = __require("fs/promises");
-    var { join: join77 } = __require("path");
+    var { join: join78 } = __require("path");
     var readdirScoped = async (dir) => {
       const results = [];
       for (const item of await readdir2(dir)) {
         if (item.startsWith("@")) {
-          for (const scopedItem of await readdir2(join77(dir, item))) {
-            results.push(join77(item, scopedItem));
+          for (const scopedItem of await readdir2(join78(dir, item))) {
+            results.push(join78(item, scopedItem));
           }
         } else {
           results.push(item);
@@ -80533,7 +80533,7 @@ var require_readdir_scoped = __commonJS({
 // node_modules/.pnpm/@npmcli+fs@6.0.0/node_modules/@npmcli/fs/lib/move-file.js
 var require_move_file = __commonJS({
   "node_modules/.pnpm/@npmcli+fs@6.0.0/node_modules/@npmcli/fs/lib/move-file.js"(exports2, module) {
-    var { dirname: dirname16, join: join77, resolve: resolve15, relative: relative10, isAbsolute: isAbsolute10 } = __require("path");
+    var { dirname: dirname16, join: join78, resolve: resolve15, relative: relative10, isAbsolute: isAbsolute10 } = __require("path");
     var fs12 = __require("fs/promises");
     var pathExists2 = async (path15) => {
       try {
@@ -80563,7 +80563,7 @@ var require_move_file = __commonJS({
           if (sourceStat.isDirectory()) {
             const files = await fs12.readdir(source);
             await Promise.all(files.map(
-              (file2) => moveFile(join77(source, file2), join77(destination, file2), options, false, symlinks)
+              (file2) => moveFile(join78(source, file2), join78(destination, file2), options, false, symlinks)
             ));
           } else if (sourceStat.isSymbolicLink()) {
             symlinks.push({ source, destination });
@@ -90400,23 +90400,23 @@ var require_helpers = __commonJS({
   "node_modules/.pnpm/ip-address@10.7.3/node_modules/ip-address/dist/v6/helpers.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.escapeHtml = escapeHtml;
+    exports2.escapeHtml = escapeHtml2;
     exports2.spanAllZeroes = spanAllZeroes;
     exports2.spanAll = spanAll;
     exports2.spanLeadingZeroes = spanLeadingZeroes;
     exports2.simpleGroup = simpleGroup;
-    function escapeHtml(s) {
+    function escapeHtml2(s) {
       return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
     }
     function spanAllZeroes(s) {
-      return escapeHtml(s).replace(/(0+)/g, '<span class="zero">$1</span>');
+      return escapeHtml2(s).replace(/(0+)/g, '<span class="zero">$1</span>');
     }
     function spanAll(s, offset = 0) {
       const letters = s.split("");
-      return letters.map((n, i) => `<span class="digit value-${escapeHtml(n)} position-${i + offset}">${spanAllZeroes(n)}</span>`).join("");
+      return letters.map((n, i) => `<span class="digit value-${escapeHtml2(n)} position-${i + offset}">${spanAllZeroes(n)}</span>`).join("");
     }
     function spanLeadingZeroesSimple(group2) {
-      return escapeHtml(group2).replace(/^(0+)/, '<span class="zero">$1</span>');
+      return escapeHtml2(group2).replace(/^(0+)/, '<span class="zero">$1</span>');
     }
     function spanLeadingZeroes(address) {
       const groups2 = address.split(":");
@@ -112581,14 +112581,14 @@ var require_turndown_cjs = __commonJS({
         } else if (node3.nodeType === 1) {
           replacement = replacementForNode.call(self2, node3);
         }
-        return join77(output2, replacement);
+        return join78(output2, replacement);
       }, "");
     }
     function postProcess(output2) {
       var self2 = this;
       this.rules.forEach(function(rule) {
         if (typeof rule.append === "function") {
-          output2 = join77(output2, rule.append(self2.options));
+          output2 = join78(output2, rule.append(self2.options));
         }
       });
       return output2.replace(/^[\t\r\n]+/, "").replace(/[\t\r\n\s]+$/, "");
@@ -112600,7 +112600,7 @@ var require_turndown_cjs = __commonJS({
       if (whitespace.leading || whitespace.trailing) content = content.trim();
       return whitespace.leading + rule.replacement(content, node3, this.options) + whitespace.trailing;
     }
-    function join77(output2, replacement) {
+    function join78(output2, replacement) {
       var s1 = trimTrailingNewlines(output2);
       var s2 = trimLeadingNewlines(replacement);
       var nls = Math.max(output2.length - s1.length, replacement.length - s2.length);
@@ -160536,7 +160536,7 @@ var init_cacheTwirpClient = __esm({
 });
 
 // node_modules/.pnpm/@actions+cache@6.3.0_supports-color@7.2.0/node_modules/@actions/cache/lib/internal/tar.js
-import { existsSync as existsSync19, writeFileSync as writeFileSync21 } from "fs";
+import { existsSync as existsSync18, writeFileSync as writeFileSync21 } from "fs";
 import * as path13 from "path";
 function getTarPath() {
   return __awaiter18(this, void 0, void 0, function* () {
@@ -160546,7 +160546,7 @@ function getTarPath() {
         const systemTar = SystemTarPathOnWindows;
         if (gnuTar) {
           return { path: gnuTar, type: ArchiveToolType.GNU };
-        } else if (existsSync19(systemTar)) {
+        } else if (existsSync18(systemTar)) {
           return { path: systemTar, type: ArchiveToolType.BSD };
         }
         break;
@@ -191031,7 +191031,7 @@ var BOT_EMAIL = `${BOT_LOGIN}@users.noreply.github.com`;
 var OIDC_AUDIENCE = `${PRODUCT_SLUG}-api`;
 
 // src/commands/assess.ts
-import { existsSync as existsSync10, statSync as statSync8 } from "node:fs";
+import { existsSync as existsSync9, statSync as statSync8 } from "node:fs";
 import { isAbsolute as isAbsolute4, resolve as resolve7 } from "node:path";
 var import_arg = __toESM(require_arg(), 1);
 
@@ -199939,7 +199939,7 @@ var log = {
   debug: (...args2) => current.debug(...args2)
 };
 
-// node_modules/.pnpm/@infraweaver-io+models@0.1.6/node_modules/@infraweaver-io/models/dist/usage.js
+// node_modules/.pnpm/@infraweaver-io+models@0.1.7/node_modules/@infraweaver-io/models/dist/usage.js
 function formatCostUsd(costUsd) {
   return costUsd.toFixed(4);
 }
@@ -200490,7 +200490,7 @@ import { randomBytes } from "node:crypto";
 // package.json
 var package_default = {
   name: "infraweaver",
-  version: "0.3.11",
+  version: "0.3.13",
   description: "GitHub Action that remediates Terraform to best practices and opens one scoped pull request per concern.",
   keywords: [
     "ai-coding-agent",
@@ -200593,7 +200593,7 @@ var package_default = {
     "@infraweaver-io/ci": "^0.1.8",
     "@infraweaver-io/core": "^0.1.5",
     "@infraweaver-io/crosswalk": "^1.2.0",
-    "@infraweaver-io/models": "^0.1.6",
+    "@infraweaver-io/models": "^0.1.7",
     "@infraweaver-io/policy-spec": "^1.2.0",
     "@infraweaver-io/report-contract": "^0.1.5",
     "@infraweaver-io/sandbox": "^0.1.8",
@@ -207495,7 +207495,18 @@ var SECRET_WORDS = /* @__PURE__ */ new Set([
   "credential",
   "credentials"
 ]);
-var SECRET_KEY_PREFIXES = /* @__PURE__ */ new Set(["api", "secret", "private", "signing"]);
+var SECRET_KEY_PREFIXES = /* @__PURE__ */ new Set([
+  "api",
+  "secret",
+  "private",
+  "signing",
+  "access",
+  "account",
+  "client",
+  "shared",
+  "preshared",
+  "master"
+]);
 var NOT_SECRET_TOKENS = /* @__PURE__ */ new Set(["creation", "idempotency", "client", "request", "continuation"]);
 function words(name) {
   return name.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase().split(/[_-]+/).filter(Boolean);
@@ -207507,24 +207518,70 @@ function isSecretName(name) {
   if (last === void 0) return false;
   if (last === "key") return prev !== void 0 && SECRET_KEY_PREFIXES.has(prev);
   if (last === "token" && prev !== void 0 && NOT_SECRET_TOKENS.has(prev)) return false;
+  if (last === "string") return prev === "connection";
+  if (last === "secret" && w.length === 1) return false;
   return SECRET_WORDS.has(last);
 }
 function isPlaceholder(inner) {
-  return inner.trim() === "" || /^[*xX.]+$/.test(inner) || /^<[^>]*>$/.test(inner) || // the dummy credentials offline plans and LocalStack are given (`secret_key = "test"`)
-  /^(?:test|mock|fake|dummy|fixture|example|placeholder|sample)(?:[_-].*)?$/i.test(inner) || // a token's lifetime unit: `token_validity_units { access_token = "hours" }`
+  return inner.trim() === "" || /^[*xX.]+$/.test(inner) || /^<[^>]*>$/.test(inner) || /^(?:true|false|null)$/.test(inner) || /^-?\d+(?:\.\d+)?$/.test(inner) || // a template directive is computed, like an interpolation: `"%{ if … }…%{ endif }"`
+  inner.includes("%{") || // the dummy credentials offline plans and LocalStack are given (`secret_key = "test"`,
+  // `"example-secret"`) — but only when that is the whole value: a lowercase tail at
+  // most, so `"Test-Pr0dDbPassw0rd!"` is a password that happens to start with a word
+  isDummy(inner) || // a token's lifetime unit: `token_validity_units { access_token = "hours" }`
   /^(?:seconds|minutes|hours|days)$/.test(inner);
 }
-var HEADER = /^(resource|data|provider|module|locals|variable|output|terraform)\b([^{]*)\{\s*$/;
+function isDummy(inner) {
+  const m = /^(?:test|mock|fake|dummy|fixture|example|placeholder|sample)([_-].*)?$/i.exec(inner);
+  return m !== null && (m[1] === void 0 || /^[_-][a-z0-9_-]*$/.test(m[1]));
+}
+function isSecretReference(inner) {
+  return inner.startsWith("arn:") || /^projects\/[^/]+\/secrets\//.test(inner) || /^https:\/\/[\w-]+\.vault\.azure\.net\/secrets\//i.test(inner) || /^\/[\w./-]+$/.test(inner);
+}
+var HEADER = /^(resource|data|provider|module|locals|variable|output|terraform)\b([^{]*)\{(.*)$/;
 var ASSIGNMENT = /^\s*(?:"([A-Za-z_][\w-]*)"|([A-Za-z_][\w-]*))\s*=(?!=)\s*(.*)$/;
 var HEREDOC = /<<-?([A-Za-z_]\w*)\s*$/;
 var INLINE_PAIR = /(?:"([A-Za-z_][\w-]*)"|\b([A-Za-z_][\w-]*))\s*=(?!=)\s*("(?:[^"\\]|\\.)*")/g;
-function literalValue(raw2) {
+function literalValue(name, raw2) {
   const value2 = stripTrailingComment(raw2).replace(/,$/, "").trim();
-  return isStringLiteral(value2) && !isPlaceholder(value2.slice(1, -1));
+  if (!isStringLiteral(value2)) return false;
+  const inner = value2.slice(1, -1);
+  if (isPlaceholder(inner) || isSecretReference(inner)) return false;
+  return !(words(name).at(-1) === "auth" && /^[A-Z]+(?:_[A-Z]+)*$/.test(inner));
+}
+function variableName(holder) {
+  return /^variable\s+"?([\w-]+)"?/.exec(holder)?.[1] ?? "";
+}
+function opensBlockComment(line) {
+  for (let i = 0; i < line.length; i++) {
+    const span = skipNonCode(line, i);
+    if (!span) continue;
+    if (line.startsWith("/*", i) && !line.includes("*/", i + 2)) return true;
+    i = span.end;
+  }
+  return false;
+}
+function closesOnLine(rest) {
+  let depth = 1;
+  for (let i = 0; i < rest.length; i++) {
+    const span = skipNonCode(rest, i);
+    if (span) {
+      i = span.end;
+      continue;
+    }
+    if (rest[i] === "{") depth++;
+    else if (rest[i] === "}" && --depth === 0) return true;
+  }
+  return false;
 }
 function findHardcodedSecrets(hcl2) {
+  return findInLines(hcl2, null);
+}
+function findTfvarsSecrets(hcl2, path15) {
+  return findInLines(hcl2, `tfvars input ${path15}`);
+}
+function findInLines(hcl2, fileHolder) {
   const out = [];
-  let holder = null;
+  let holder = fileHolder;
   let heredoc = null;
   let inComment = false;
   const lines = hcl2.split("\n");
@@ -207544,12 +207601,28 @@ function findHardcodedSecrets(hcl2) {
       continue;
     }
     if (trimmed.startsWith("#") || trimmed.startsWith("//")) continue;
-    const header = HEADER.exec(line);
+    if (opensBlockComment(line)) inComment = true;
+    const header = fileHolder === null ? HEADER.exec(line) : null;
     if (header) {
       holder = `${header[1]}${header[2].trimEnd() ? ` ${header[2].trim()}` : ""}`;
+      const rest = header[3];
+      const opens2 = HEREDOC.exec(rest);
+      if (opens2) heredoc = opens2[1];
+      if (!holder.startsWith("output ") && !holder.startsWith("terraform")) {
+        for (const pair of rest.matchAll(INLINE_PAIR)) {
+          const key = pair[1] ?? pair[2];
+          const isVariable = holder.startsWith("variable ");
+          if (isVariable && key !== "default") continue;
+          const name2 = isVariable ? variableName(holder) : key;
+          if (isSecretName(name2) && literalValue(name2, pair[3])) {
+            out.push({ name: name2, holder, line: i + 1 });
+          }
+        }
+      }
+      if (closesOnLine(rest)) holder = null;
       continue;
     }
-    if (line.startsWith("}")) {
+    if (fileHolder === null && line.startsWith("}")) {
       holder = null;
       continue;
     }
@@ -207561,30 +207634,34 @@ function findHardcodedSecrets(hcl2) {
     const name = m[1] ?? m[2];
     const value2 = m[3];
     if (holder.startsWith("variable ")) {
-      const variable = /^variable\s+"?([\w-]+)"?/.exec(holder)?.[1] ?? "";
-      if (name === "default" && isSecretName(variable) && literalValue(value2)) {
+      const variable = variableName(holder);
+      if (name === "default" && isSecretName(variable) && literalValue(variable, value2)) {
         out.push({ name: variable, holder, line: i + 1 });
       }
       continue;
     }
     if (holder.startsWith("output ") || holder.startsWith("terraform")) continue;
-    if (isSecretName(name) && literalValue(value2)) {
+    if (isSecretName(name) && literalValue(name, value2)) {
       out.push({ name, holder, line: i + 1 });
       continue;
     }
     for (const pair of value2.matchAll(INLINE_PAIR)) {
       const key = pair[1] ?? pair[2];
-      if (isSecretName(key) && literalValue(pair[3])) {
+      if (isSecretName(key) && literalValue(key, pair[3])) {
         out.push({ name: key, holder, line: i + 1 });
       }
     }
   }
   return out;
 }
-function scanHardcodedSecrets(files) {
+function scanHardcodedSecrets(files, tfvarsFiles = []) {
   const concerns = [];
-  for (const { path: path15, hcl: hcl2 } of files) {
-    for (const hit of findHardcodedSecrets(hcl2)) {
+  const hits = [
+    ...files.map((f) => ({ path: f.path, found: findHardcodedSecrets(f.hcl) })),
+    ...tfvarsFiles.map((f) => ({ path: f.path, found: findTfvarsSecrets(f.hcl, f.path) }))
+  ];
+  for (const { path: path15, found } of hits) {
+    for (const hit of found) {
       concerns.push(
         buildConcern({
           source: NATIVE_SOURCE,
@@ -209587,7 +209664,8 @@ var NATIVE_RULE_SCANNERS = [
     name: "hardcoded-secrets",
     rules: [HARDCODED_SECRET_ARGUMENT],
     // Per file: the argument's name and its literal are both on the line itself.
-    scan: (ctx) => ({ concerns: scanHardcodedSecrets(ctx.files) })
+    // The only rule that reads `.tfvars`: an input file holds values, not config.
+    scan: (ctx) => ({ concerns: scanHardcodedSecrets(ctx.files, ctx.tfvarsFiles) })
   },
   {
     name: "write-only",
@@ -209672,6 +209750,7 @@ function createRuleContext(input2) {
     cwd: input2.cwd,
     files: input2.files,
     tofuFiles: input2.tofuFiles ?? [],
+    tfvarsFiles: input2.tfvarsFiles ?? [],
     truncated: input2.truncated ?? null,
     repeatedLiteralThreshold: input2.repeatedLiteralThreshold
   };
@@ -209723,6 +209802,9 @@ function readTfTree(cwd, limits) {
 function readTofuTree(cwd, limits) {
   return readTree(cwd, ".tofu", limits);
 }
+function readTfvarsTree(cwd, limits) {
+  return readTree(cwd, ".tfvars", limits);
+}
 var OVERSIZE_NAMED = 5;
 function describeOversize(paths) {
   const named = paths.slice(0, OVERSIZE_NAMED).join(", ");
@@ -209751,6 +209833,9 @@ function scanNative(cwd, opts = {}) {
     // walk over a suffix most repos do not use at all, and threading it through
     // the context keeps the scanners uniform.
     tofuFiles: readTofuTree(cwd).files,
+    // likewise only for the hardcoded-secret rule: a value kept out of the `.tf`
+    // source is most often committed here instead
+    tfvarsFiles: readTfvarsTree(cwd).files,
     truncated: tree.truncated,
     repeatedLiteralThreshold: opts.repeatedLiteralThreshold ?? DEFAULT_REPEAT_THRESHOLD
   });
@@ -214109,7 +214194,7 @@ function TerraformAssessTool(ctx) {
 // src/mcp/localServer.ts
 import { mkdtempSync as mkdtempSync4 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
-import { join as join40 } from "node:path";
+import { join as join41 } from "node:path";
 
 // node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -271571,7 +271656,7 @@ var FastMCP = class extends FastMCPEventEmitter {
   }
 };
 
-// node_modules/.pnpm/@infraweaver-io+models@0.1.6/node_modules/@infraweaver-io/models/dist/catalog.js
+// node_modules/.pnpm/@infraweaver-io+models@0.1.7/node_modules/@infraweaver-io/models/dist/catalog.js
 function provider(config3) {
   return config3;
 }
@@ -272932,12 +273017,47 @@ function readTfDir(cwd, dir) {
 }
 
 // src/mcp/terraform/refactorScope.ts
-import { existsSync as existsSync6, readdirSync as readdirSync6, readFileSync as readFileSync12, statSync as statSync5 } from "node:fs";
+import { readdirSync as readdirSync6, readFileSync as readFileSync12, statSync as statSync5 } from "node:fs";
 import { join as join22 } from "node:path";
 function isExamplePath(path15) {
-  return /(?:^|\/)examples?\//.test(path15.replace(/\\/g, "/"));
+  return /(?:^|\/)examples\/|^example\//i.test(path15.replace(/\\/g, "/"));
+}
+var PROVIDER_OR_BACKEND = new RegExp(
+  String.raw`(?:^|\n)\s*(?:provider|backend)\s+${BLOCK_LABEL}\s*\{`
+);
+var CLOUD_BLOCK = /(?:^|\n)\s*cloud\s*\{/;
+function configuresDeployment(name, text) {
+  if (name.endsWith(".tf.json")) {
+    let doc;
+    try {
+      doc = JSON.parse(text);
+    } catch {
+      return false;
+    }
+    if (typeof doc !== "object" || doc === null) return false;
+    const { provider: provider2, terraform } = doc;
+    if (provider2 !== void 0) return true;
+    return [terraform].flat().some((t) => typeof t === "object" && t !== null && ("backend" in t || "cloud" in t));
+  }
+  if (PROVIDER_OR_BACKEND.test(text)) return true;
+  return parseBlocks(text, ["terraform"]).some((b) => CLOUD_BLOCK.test(b.body));
+}
+var isTerraformFile2 = (name) => name.endsWith(".tf") || name.endsWith(".tf.json");
+function deploysFrom(dir) {
+  let names;
+  try {
+    names = readdirSync6(dir).filter(isTerraformFile2);
+  } catch {
+    return false;
+  }
+  return names.some((name) => {
+    try {
+      return configuresDeployment(name, readFileSync12(join22(dir, name), "utf8"));
+    } catch {
+      return false;
+    }
+  });
 }
-var PROVIDER_OR_BACKEND = /^\s*(?:provider\s+"|backend\s+")/m;
 function holdsTerraform(dir, depth) {
   let entries;
   try {
@@ -272955,26 +273075,35 @@ function holdsTerraform(dir, depth) {
   return false;
 }
 function libraryRepoReason(cwd) {
-  let rootFiles;
+  let rootEntries;
   try {
-    rootFiles = readdirSync6(cwd).filter((f) => f.endsWith(".tf"));
+    rootEntries = readdirSync6(cwd);
   } catch {
     return null;
   }
-  if (rootFiles.length === 0) return null;
-  for (const f of rootFiles) {
-    let text;
-    try {
-      text = readFileSync12(join22(cwd, f), "utf8");
-    } catch {
-      continue;
-    }
-    if (PROVIDER_OR_BACKEND.test(text)) return null;
-  }
-  const examples = ["examples", "example"].find((d) => existsSync6(join22(cwd, d)));
+  if (!rootEntries.some(isTerraformFile2) || deploysFrom(cwd)) return null;
+  const examples = rootEntries.find((d) => /^examples?$/i.test(d));
   if (examples === void 0 || !holdsTerraform(join22(cwd, examples), 2)) return null;
   return `the repository root configures no provider and no backend, and ships \`${examples}/\`: it is a module other configurations call, so restructuring it is churn for every caller`;
 }
+function libraryScope(cwd) {
+  const reason = libraryRepoReason(cwd);
+  if (reason === null) return () => null;
+  const deploys = /* @__PURE__ */ new Map();
+  return (file2) => {
+    const dirs = file2.replace(/\\/g, "/").split("/").slice(0, -1);
+    for (let i = dirs.length; i > 0; i--) {
+      const dir = dirs.slice(0, i).join("/");
+      let d = deploys.get(dir);
+      if (d === void 0) {
+        d = deploysFrom(join22(cwd, dir));
+        deploys.set(dir, d);
+      }
+      if (d) return null;
+    }
+    return reason;
+  };
+}
 function reportOnly(reason) {
   return reason === null ? {} : { report_only: true, report_only_reason: reason };
 }
@@ -273332,12 +273461,12 @@ function ModuleExtractionCandidatesTool(ctx) {
     parameters: ModuleExtractionCandidatesParams,
     execute: execute(async () => {
       const cwd = ctx.payload.cwd ?? process.cwd();
+      const library = libraryScope(cwd);
       const candidates = findExtractionCandidates(
         cwd,
         ctx.payload.moduleCatalogue,
         ctx.toolState.orgModuleHcl
-      ).filter((c) => ctx.payload.refactorExamples || !isExamplePath(c.cluster.file));
-      const library = libraryRepoReason(cwd);
+      ).filter((c) => ctx.payload.refactorExamples || !isExamplePath(c.cluster.file)).map((c) => ({ ...reportOnly(library(c.cluster.file)), ...c }));
       const matched = candidates.filter((c) => c.candidates.length > 0);
       const reasons = {};
       for (const c of candidates)
@@ -273351,7 +273480,6 @@ function ModuleExtractionCandidatesTool(ctx) {
         `\xBB module_extraction_candidates: ${candidates.length} cluster(s), ${matched.length} with a module match` + (partialInterfaces.length > 0 ? `, ${partialInterfaces.length} partial-interface block(s)` : "")
       );
       return toolOk({
-        ...reportOnly(library),
         cluster_count: candidates.length,
         matched_count: matched.length,
         candidates,
@@ -273375,7 +273503,7 @@ function ModuleExtractionCandidatesTool(ctx) {
 }
 
 // src/mcp/moduleTests.ts
-import { existsSync as existsSync7, readdirSync as readdirSync7, readFileSync as readFileSync14, statSync as statSync6 } from "node:fs";
+import { existsSync as existsSync6, readdirSync as readdirSync7, readFileSync as readFileSync14, statSync as statSync6 } from "node:fs";
 import { join as join24 } from "node:path";
 var MODULE_META_ARGS = /* @__PURE__ */ new Set([
   "source",
@@ -273496,7 +273624,7 @@ function resolveSourceDir(fromDir, source) {
 }
 function isDir(p) {
   try {
-    return existsSync7(p) && statSync6(p).isDirectory();
+    return existsSync6(p) && statSync6(p).isDirectory();
   } catch {
     return false;
   }
@@ -273630,7 +273758,7 @@ function TerraformModuleTestsTool(ctx) {
 }
 
 // src/mcp/terraform/tools/advise.ts
-import { existsSync as existsSync8, readFileSync as readFileSync16 } from "node:fs";
+import { existsSync as existsSync7, readFileSync as readFileSync16 } from "node:fs";
 import { join as join26 } from "node:path";
 
 // src/mcp/terraform/fixMemory.ts
@@ -273789,7 +273917,7 @@ function inlineWaivers(content, file2) {
 }
 function readLearnings(tmpdir6) {
   const path15 = join26(tmpdir6, LEARNINGS_FILE);
-  if (!existsSync8(path15)) return [];
+  if (!existsSync7(path15)) return [];
   try {
     return readFileSync16(path15, "utf-8").split("\n");
   } catch {
@@ -275148,8 +275276,11 @@ function ConsolidationCandidatesTool(ctx) {
 }
 
 // src/mcp/terraform/tools/detectPlanDrift.ts
-import { readFileSync as readFileSync17 } from "node:fs";
-import { join as join27 } from "node:path";
+import { readFileSync as readFileSync18 } from "node:fs";
+import { join as join28 } from "node:path";
+
+// src/mcp/staleFix.ts
+import { createHash as createHash6 } from "node:crypto";
 
 // node_modules/.pnpm/@infraweaver-io+ci@0.1.8/node_modules/@infraweaver-io/ci/dist/progressComment.js
 function parseProgressComment(raw2) {
@@ -276206,7 +276337,31 @@ function groupIdFromBranch(branch) {
 }
 function remediationBranchSuffix(base, defaultBranch) {
   if (!base || !defaultBranch || base === defaultBranch) return "";
-  return `--${base.replace(/[^A-Za-z0-9._-]+/g, "-")}`;
+  const slug2 = base.replace(/[^A-Za-z0-9._-]+/g, "-");
+  if (slug2 === base) return `--${slug2}`;
+  return `--${slug2}-${createHash6("sha1").update(base).digest("hex").slice(0, 8)}`;
+}
+function remediationBranchFor(id, base, defaultBranch, open3) {
+  const computed = `remediate/${id}${remediationBranchSuffix(base, defaultBranch)}`;
+  const heads = (open3 ?? []).filter((pr) => pr.base === base && groupIdFromBranch(pr.head) === id).map((pr) => pr.head).filter((head) => !(open3 ?? []).some((pr) => pr.head === head && pr.base !== base));
+  return heads.includes(computed) ? computed : heads[0] ?? computed;
+}
+async function listOpenRemediationPrs(ctx) {
+  const { octokit, repo } = ctx;
+  if (ctx.toolState?.selectedMode !== "Remediate") return [];
+  if (!octokit || !repo?.owner || !repo.name) return [];
+  try {
+    const open3 = await octokit.paginate(octokit.rest.pulls.list, {
+      owner: repo.owner,
+      repo: repo.name,
+      state: "open",
+      per_page: 100
+    });
+    return open3.filter((pr) => pr.head.repo?.id === pr.base.repo.id && groupIdFromBranch(pr.head.ref)).map((pr) => ({ head: pr.head.ref, base: pr.base.ref }));
+  } catch (e) {
+    log2.warning(`\xBB could not list open remediation PRs: ${errorMessage(e)}`);
+    return [];
+  }
 }
 function matchesBotIdentity(identity) {
   const normalized = identity.replace(/\[bot\]$/i, "").toLowerCase();
@@ -276897,6 +277052,68 @@ function dedupeCrossScanner(concerns) {
   return [...merged, ...passthrough];
 }
 
+// src/mcp/terraform/verifySites.ts
+import { readFileSync as readFileSync17 } from "node:fs";
+import { join as join27 } from "node:path";
+function fileReader(cwd) {
+  const cache3 = /* @__PURE__ */ new Map();
+  return (file2) => {
+    if (!cache3.has(file2)) {
+      let text;
+      try {
+        text = readFileSync17(join27(cwd, file2), "utf8");
+      } catch {
+        text = null;
+      }
+      cache3.set(file2, text);
+    }
+    return cache3.get(file2) ?? null;
+  };
+}
+function siteOf(c, read3) {
+  const text = read3(c.location.file);
+  return text === null ? null : resourceAddressAt(text, c.location.line);
+}
+function recordConcernSites(session, concerns, cwd, linesMatchTree) {
+  const read3 = fileReader(cwd);
+  session.siteById ??= /* @__PURE__ */ new Map();
+  session.firstSitesByKey ??= /* @__PURE__ */ new Map();
+  const first = session.firstSitesByKey;
+  const fresh = /* @__PURE__ */ new Map();
+  for (const c of concerns) {
+    const site = linesMatchTree ? siteOf(c, read3) : null;
+    const prior = session.siteById.get(c.id);
+    session.siteById.set(c.id, prior === void 0 || prior === site ? site : null);
+    if (!linesMatchTree) continue;
+    const key = concernKeyOf(c);
+    if (first.has(key)) continue;
+    const sites = fresh.get(key) ?? /* @__PURE__ */ new Set();
+    sites.add(site);
+    fresh.set(key, sites);
+  }
+  for (const [key, sites] of fresh) first.set(key, sites);
+}
+function resolvedAtSite(params) {
+  const firingByKey = /* @__PURE__ */ new Map();
+  for (const c of params.current) {
+    const list = firingByKey.get(c.key) ?? [];
+    list.push(c.site);
+    firingByKey.set(c.key, list);
+  }
+  const out = [];
+  for (const r of params.requested) {
+    if (r.site === null || r.file === void 0) continue;
+    const firing = firingByKey.get(r.key) ?? [];
+    const known = params.firstSites.get(r.key);
+    if (known === void 0) continue;
+    if (firing.some((s) => s === null || !known.has(s))) continue;
+    if (firing.includes(r.site)) continue;
+    if (!params.declared(r.file).has(r.site)) continue;
+    out.push(r.id);
+  }
+  return out;
+}
+
 // src/mcp/terraform/concernResult.ts
 function annotateConcerns(rawConcerns, opts) {
   const inScope = opts.inScope ?? (() => true);
@@ -276923,6 +277140,7 @@ function buildConcernResult(ctx, rawConcerns, opts) {
     fullBaseline.map((c) => concernKeyOf(c))
   );
   recordConcernKeys(session, fullBaseline);
+  recordConcernSites(session, fullBaseline, opts.cwd, opts.linesMatchTree ?? false);
   session.baselineFmtDriftFiles = union3(
     session.baselineFmtDriftFiles,
     fullBaseline.filter((c) => c.source === "terraform-fmt").map((c) => c.location.file)
@@ -276937,13 +277155,13 @@ function buildConcernResult(ctx, rawConcerns, opts) {
     active,
     opts.autonomyThreshold
   );
-  const suffix2 = remediationBranchSuffix(
-    remediationBaseOf(ctx),
-    ctx.repo?.data.default_branch?.trim() || void 0
-  );
-  const groups2 = (opts.priority ? prioritizeGroups(annotatedGroups, active, opts.priority) : annotatedGroups).map((g) => ({ ...g, branch: `remediate/${g.id}${suffix2}` }));
+  const base = remediationBaseOf(ctx);
+  const defaultBranch = ctx.repo?.data.default_branch?.trim() || void 0;
+  const branchFor = (id) => remediationBranchFor(id, base, defaultBranch, opts.openRemediationPrs);
+  const groups2 = (opts.priority ? prioritizeGroups(annotatedGroups, active, opts.priority) : annotatedGroups).map((g) => ({ ...g, branch: branchFor(g.id) }));
   const planned = planBatches(groups2);
-  const batchPlan = planned.batch_branch ? { ...planned, batch_branch: `${planned.batch_branch}${suffix2}` } : planned;
+  const batchId = planned.batch_branch ? groupIdFromBranch(planned.batch_branch) : null;
+  const batchPlan = batchId ? { ...planned, batch_branch: branchFor(batchId) } : planned;
   const bySeverity = {};
   for (const c of active) bySeverity[c.severity] = (bySeverity[c.severity] ?? 0) + 1;
   return {
@@ -277373,7 +277591,7 @@ function readTfFiles(cwd) {
   const out = [];
   for (const file2 of walkTfFiles(cwd)) {
     try {
-      out.push({ file: file2, hcl: readFileSync17(join27(cwd, file2), "utf8") });
+      out.push({ file: file2, hcl: readFileSync18(join28(cwd, file2), "utf8") });
     } catch {
     }
   }
@@ -277390,7 +277608,7 @@ function DetectPlanDriftTool(ctx) {
       const planPath = path15 || !envPlanPath ? resolveWithinCwd(cwd, path15 ?? "plan.json") : envPlanPath;
       let raw2;
       try {
-        raw2 = readFileSync17(planPath, "utf8");
+        raw2 = readFileSync18(planPath, "utf8");
       } catch {
         return skipResult(
           "plan_artifact_not_found",
@@ -277460,7 +277678,8 @@ function DetectPlanDriftTool(ctx) {
         autonomyThreshold,
         // drift is a narrow concern source — join any prior scan baseline so a
         // later ✗→✓ verify doesn't read the whole workspace as regressions.
-        baselineMode: "merge"
+        baselineMode: "merge",
+        openRemediationPrs: await listOpenRemediationPrs(ctx)
       });
       log2.info(
         `\xBB detect_plan_drift: ${active.length} drifted resource(s) \u2265 ${threshold} from ${planPath}` + (noiseFiltered.length ? `, ${noiseFiltered.length} noise-filtered` : "") + (unlocated.length ? `, ${unlocated.length} unlocated` : "") + (statefulForgotten.length ? `, ${statefulForgotten.length} STATEFUL forget(s)` : "") + (suppressed.length ? ` (${suppressed.length} suppressed)` : "")
@@ -277522,22 +277741,22 @@ function DetectPlanDriftTool(ctx) {
 }
 
 // src/mcp/terraform/tools/emitCost.ts
-import { readFileSync as readFileSync19, writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join29 } from "node:path";
+import { readFileSync as readFileSync20, writeFileSync as writeFileSync4 } from "node:fs";
+import { join as join30 } from "node:path";
 
 // src/mcp/guardrails.ts
 import { spawnSync as spawnSync5 } from "node:child_process";
-import { readFileSync as readFileSync18, rmSync as rmSync2 } from "node:fs";
-import { join as join28 } from "node:path";
+import { readFileSync as readFileSync19, rmSync as rmSync2 } from "node:fs";
+import { join as join29 } from "node:path";
 
 // src/mcp/terraform/emittedArtefacts.ts
-import { createHash as createHash6 } from "node:crypto";
+import { createHash as createHash7 } from "node:crypto";
 import { writeFileSync as writeFileSync3 } from "node:fs";
 import { resolve as resolve5 } from "node:path";
 var ARTEFACT_DIR = "compliance/";
 function gitBlobId(bytes) {
   const content = Buffer.from(bytes, "utf8");
-  return createHash6("sha1").update(`blob ${content.length}\0`).update(content).digest("hex");
+  return createHash7("sha1").update(`blob ${content.length}\0`).update(content).digest("hex");
 }
 function writeEmittedArtefact(toolState, path15, bytes) {
   writeFileSync3(path15, bytes);
@@ -277830,7 +278049,7 @@ function parseGitleaksReport(json5) {
   return hits;
 }
 function scanWithGitleaks(ctx, base) {
-  const reportPath = join28(ctx.tmpdir, `gitleaks-report-${process.pid}.json`);
+  const reportPath = join29(ctx.tmpdir, `gitleaks-report-${process.pid}.json`);
   const cwd = ctx.payload.cwd ?? process.cwd();
   const result = spawnSync5(
     "gitleaks",
@@ -277864,7 +278083,7 @@ function scanWithGitleaks(ctx, base) {
     return null;
   }
   try {
-    const report2 = readFileSync18(reportPath, "utf8");
+    const report2 = readFileSync19(reportPath, "utf8");
     return parseGitleaksReport(report2);
   } catch {
     return [];
@@ -277936,7 +278155,7 @@ function assertNoForeignDialectIntroduced(ctx) {
     const file2 = rel.replace(/\\/g, "/");
     if (changedSet.has(file2)) continue;
     try {
-      established.push(...findDialectMarkers(readFileSync18(join28(cwd, rel), "utf8"), file2));
+      established.push(...findDialectMarkers(readFileSync19(join29(cwd, rel), "utf8"), file2));
     } catch {
     }
   }
@@ -278310,7 +278529,7 @@ var OpenPrOverlapError = class extends Error {
 // src/mcp/terraform/awsPrices.ts
 var AWS_PRICE_REGION = "eu-west-2";
 var AWS_PRICE_CURRENCY = "USD";
-var AWS_PRICE_FETCHED_AT = "2026-09-23";
+var AWS_PRICE_FETCHED_AT = "2026-10-03";
 var AWS_HOURLY_PRICES = {
   "eks-cluster-standard": 0.1,
   "elb-application": 0.02646,
@@ -278328,30 +278547,30 @@ var AWS_PER_GB_PRICES = {
 // src/mcp/terraform/azurePrices.ts
 var AZURE_PRICE_REGION = "westeurope";
 var AZURE_PRICE_CURRENCY = "EUR";
-var AZURE_PRICE_FETCHED_AT = "2026-09-03";
+var AZURE_PRICE_FETCHED_AT = "2026-10-03";
 var AZURE_HOURLY_PRICES = {
-  "app-service-p0v3": 0.0764,
-  "app-service-p1v3": 0.1528,
-  "app-service-p2v3": 0.3057,
-  "app-service-p3v3": 0.6114,
-  "bastion-basic": 0.1631,
-  "bastion-premium": 0.3864,
-  "bastion-standard": 0.249,
-  "firewall-basic": 0.3392,
-  "firewall-premium": 1.5027,
-  "firewall-standard": 1.0733,
-  "redis-c0": 0.0236,
-  "redis-c1": 0.0592,
-  "redis-c2": 0.0962,
-  "redis-c3": 0.1932,
-  "redis-p1": 0.2378,
-  "redis-p2": 0.4766,
-  "redis-p3": 0.9523,
-  "vpn-gateway-vpngw1": 0.1631,
-  "vpn-gateway-vpngw2": 0.4207,
-  "vpn-gateway-vpngw3": 1.0733,
-  "vpn-gateway-vpngw4": 1.8032,
-  "vpn-gateway-vpngw5": 3.1341
+  "app-service-p0v3": 0.0783,
+  "app-service-p1v3": 0.1566,
+  "app-service-p2v3": 0.3133,
+  "app-service-p3v3": 0.6265,
+  "bastion-basic": 0.1672,
+  "bastion-premium": 0.396,
+  "bastion-standard": 0.2552,
+  "firewall-basic": 0.3476,
+  "firewall-premium": 1.54,
+  "firewall-standard": 1.1,
+  "redis-c0": 0.0242,
+  "redis-c1": 0.0607,
+  "redis-c2": 0.0986,
+  "redis-c3": 0.198,
+  "redis-p1": 0.2438,
+  "redis-p2": 0.4884,
+  "redis-p3": 0.9759,
+  "vpn-gateway-vpngw1": 0.1672,
+  "vpn-gateway-vpngw2": 0.4312,
+  "vpn-gateway-vpngw3": 1.1,
+  "vpn-gateway-vpngw4": 1.8479,
+  "vpn-gateway-vpngw5": 3.2119
 };
 
 // src/mcp/terraform/idleFloor.ts
@@ -278629,7 +278848,7 @@ function readTfFiles2(cwd) {
   const out = [];
   for (const file2 of walkTfFiles(cwd)) {
     try {
-      out.push({ file: file2, hcl: readFileSync19(join29(cwd, file2), "utf8") });
+      out.push({ file: file2, hcl: readFileSync20(join30(cwd, file2), "utf8") });
     } catch {
     }
   }
@@ -278734,7 +278953,7 @@ function buildSuppressionSummary(waivers) {
 }
 
 // node_modules/.pnpm/@infraweaver-io+attest@0.1.7_supports-color@7.2.0/node_modules/@infraweaver-io/attest/dist/signing.js
-import { createHash as createHash7, createPrivateKey, createPublicKey, sign as cryptoSign, verify as cryptoVerify } from "node:crypto";
+import { createHash as createHash8, createPrivateKey, createPublicKey, sign as cryptoSign, verify as cryptoVerify } from "node:crypto";
 var SIGNATURE_ALGORITHM = "Ed25519";
 var DEFAULT_KEY_LABEL = "the signing key";
 function loadSigningKey(raw2, options) {
@@ -278761,7 +278980,7 @@ function loadSigningKey(raw2, options) {
   return {
     privateKey,
     publicKeyPem,
-    fingerprint: createHash7("sha256").update(spkiDer).digest("hex")
+    fingerprint: createHash8("sha256").update(spkiDer).digest("hex")
   };
 }
 function signBytes(bytes, key) {
@@ -278782,7 +279001,7 @@ function publicKeyFingerprint(publicKeyPem) {
     type: "spki",
     format: "der"
   });
-  return createHash7("sha256").update(der).digest("hex");
+  return createHash8("sha256").update(der).digest("hex");
 }
 function signatureMetadata(key, sigFile) {
   return {
@@ -279012,7 +279231,7 @@ function buildEvidenceBundle(args2) {
 // node_modules/.pnpm/@infraweaver-io+attest@0.1.7_supports-color@7.2.0/node_modules/@infraweaver-io/attest/dist/keyless.js
 var import_bundle = __toESM(require_dist6(), 1);
 var import_sign = __toESM(require_dist9(), 1);
-import { createHash as createHash8 } from "node:crypto";
+import { createHash as createHash9 } from "node:crypto";
 
 // node_modules/.pnpm/@infraweaver-io+attest@0.1.7_supports-color@7.2.0/node_modules/@infraweaver-io/attest/dist/keylessOidc.js
 var SIGSTORE_OIDC_AUDIENCE = "sigstore";
@@ -279041,7 +279260,7 @@ function keylessSigningPossible(env2, envName) {
 }
 function buildInTotoStatement(args2) {
   const data = typeof args2.artifactBytes === "string" ? Buffer.from(args2.artifactBytes, "utf8") : args2.artifactBytes;
-  const sha2562 = createHash8("sha256").update(data).digest("hex");
+  const sha2562 = createHash9("sha256").update(data).digest("hex");
   return {
     _type: "https://in-toto.io/Statement/v1",
     subject: [{ name: args2.subjectName, digest: { sha256: sha2562 } }],
@@ -279251,12 +279470,12 @@ import { mkdirSync as mkdirSync4 } from "node:fs";
 import { dirname as dirname6 } from "node:path";
 
 // src/mcp/terraform/oscal.ts
-import { createHash as createHash9 } from "node:crypto";
+import { createHash as createHash10 } from "node:crypto";
 var OSCAL_VERSION = "1.1.2";
 var INDICATIVE_REMARK = "Indicative, crosswalk-derived assessment from a deterministic starter rule-pack \u2014 NOT a formal OSCAL assessment against an authored assessment plan. Statuses are code-verified only; absence of a finding is not proof of compliance.";
 var NS = "https://infraweaver.io/ns/oscal";
 function deterministicUuid(seed) {
-  const hex4 = createHash9("sha256").update(seed).digest("hex").slice(0, 32).split("");
+  const hex4 = createHash10("sha256").update(seed).digest("hex").slice(0, 32).split("");
   hex4[12] = "5";
   hex4[16] = (Number.parseInt(hex4[16] ?? "0", 16) & 3 | 8).toString(16);
   const u = hex4.join("");
@@ -279395,20 +279614,20 @@ function TerraformEmitOscalTool(ctx) {
 import { writeFileSync as writeFileSync5 } from "node:fs";
 
 // src/mcp/terraform/lineage.ts
-import { createHash as createHash10 } from "node:crypto";
-import { readFileSync as readFileSync20 } from "node:fs";
-import { join as join30 } from "node:path";
+import { createHash as createHash11 } from "node:crypto";
+import { readFileSync as readFileSync21 } from "node:fs";
+import { join as join31 } from "node:path";
 function repoFileReader(cwd) {
   return (rel) => {
     try {
-      return readFileSync20(join30(cwd, rel), "utf-8");
+      return readFileSync21(join31(cwd, rel), "utf-8");
     } catch {
       return null;
     }
   };
 }
 function lineageKeyOf(c, address) {
-  return createHash10("sha1").update(`${c.source}|${bareRuleOf(c.source, c.rule_id)}|${c.location.file}|${address ?? ""}`).digest("hex").slice(0, 16);
+  return createHash11("sha1").update(`${c.source}|${bareRuleOf(c.source, c.rule_id)}|${c.location.file}|${address ?? ""}`).digest("hex").slice(0, 16);
 }
 function lineageResolver(read3) {
   const files = /* @__PURE__ */ new Map();
@@ -279954,11 +280173,11 @@ function TerraformEmitVexTool(ctx) {
 // src/mcp/terraform/tools/equivalenceCheck.ts
 import { mkdtempSync as mkdtempSync2, rmSync as rmSync4 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join32 } from "node:path";
+import { join as join33 } from "node:path";
 
 // src/mcp/terraform/initArtefacts.ts
 import { rmSync as rmSync3 } from "node:fs";
-import { join as join31, posix as posix9 } from "node:path";
+import { join as join32, posix as posix9 } from "node:path";
 var INIT_ARTEFACTS = /* @__PURE__ */ new Set([".terraform", ".terraform.lock.hcl"]);
 function initArtefacts(cwd) {
   const r = run("git", ["status", "--porcelain=v1", "-z", "--untracked-files=normal"], cwd);
@@ -279981,7 +280200,7 @@ function removeNewInitArtefacts(cwd, before, by) {
   const created = [...after?.untracked ?? []].filter((p) => !before.untracked.has(p));
   const changed = [...after?.modifiedLocks ?? []].filter((p) => !before.modifiedLocks.has(p));
   if (!top || created.length + changed.length === 0) return;
-  for (const p of created) rmSync3(join31(top, p), { recursive: true, force: true });
+  for (const p of created) rmSync3(join32(top, p), { recursive: true, force: true });
   if (changed.length > 0) run("git", ["checkout", "--", ...changed], top);
   resetTerraformInitCache();
   log2.info(
@@ -280450,16 +280669,32 @@ function uncoveredInstanceKeys(p) {
   if (expected === null) return null;
   const kind = level[0].kind;
   const written = (k) => kind === "count" ? k : `"${k}"`;
+  const fromAt = level[0].at;
+  const toAt = p.after.multiplicity[0]?.at;
+  if (fromAt === void 0 || toAt === void 0) return null;
   const declared2 = /* @__PURE__ */ new Set();
   for (const blk of p.blocks) {
+    if (stripIndices(normaliseAddress(blk.from)) !== p.before.address || stripIndices(normaliseAddress(blk.to)) !== p.after.address)
+      return null;
     const from = instanceKeysOf(blk.from);
     const to = instanceKeysOf(blk.to);
     if (from.length > 1 || to.length > 1) return null;
     if (from.length === 0 && to.length === 0) return null;
-    if (from.length === 1 && to.length === 1 && from[0] === to[0]) declared2.add(from[0]);
+    if (from.length !== 1 || to.length !== 1 || from[0] !== to[0]) continue;
+    const fromPlaced = keyAtLevel(blk.from, fromAt);
+    const toPlaced = keyAtLevel(blk.to, toAt);
+    if (fromPlaced === false || toPlaced === false) continue;
+    if (fromPlaced === null || toPlaced === null) return null;
+    declared2.add(from[0]);
   }
   return expected.filter((k) => !declared2.has(written(k)));
 }
+function keyAtLevel(address, at) {
+  const onResource = instanceKeysOf(stripModuleHops(normaliseAddress(address))).length > 0;
+  if (at === "resource") return onResource;
+  if (onResource) return false;
+  return moduleHops(address).length === 1 ? true : null;
+}
 function computeEquivalence(before, after, movedBlocks, ambiguous = [], planPairs, opts = {}) {
   const reasons = [];
   const corr = correspond(before, after, movedBlocks);
@@ -281779,12 +282014,12 @@ async function baselineValidateErrors(cwd, base, env2, session) {
   }
   const prefix2 = run("git", ["rev-parse", "--show-prefix"], cwd);
   if (prefix2.status !== 0) return null;
-  const tree = mkdtempSync2(join32(tmpdir2(), "iw-baseline-"));
+  const tree = mkdtempSync2(join33(tmpdir2(), "iw-baseline-"));
   try {
     if (run("git", ["worktree", "add", "--detach", "--quiet", tree, base], cwd).status !== 0) {
       return null;
     }
-    const outcome2 = await scanValidate(join32(tree, prefix2.stdout.trim()), env2);
+    const outcome2 = await scanValidate(join33(tree, prefix2.stdout.trim()), env2);
     if (!outcome2.ran || outcome2.unvalidated) return null;
     const errors = outcome2.concerns.map(validateErrorKey);
     session.baselineValidateErrors = { base, errors };
@@ -281885,7 +282120,7 @@ function TerraformGenerateMovedTool(ctx) {
 
 // src/mcp/terraform/cost.ts
 import { mkdtempSync as mkdtempSync3, rmSync as rmSync5 } from "node:fs";
-import { join as join33 } from "node:path";
+import { join as join34 } from "node:path";
 function parseInfracostBreakdown(stdout) {
   const parsed2 = parseScannerJson(InfracostBreakdownOutput, stdout, "infracost");
   const raw2 = parsed2.totalMonthlyCost;
@@ -281967,15 +282202,15 @@ async function infracostBaseline(cwd, key, tmpdir6) {
   if (!baseRef) return null;
   const prefixResult = run("git", ["rev-parse", "--show-prefix"], cwd);
   const prefix2 = prefixResult.status === 0 ? prefixResult.stdout.trim() : "";
-  const baseDir = mkdtempSync3(join33(tmpdir6, "infracost-base-"));
-  const worktree = join33(baseDir, "wt");
+  const baseDir = mkdtempSync3(join34(tmpdir6, "infracost-base-"));
+  const worktree = join34(baseDir, "wt");
   const add = run("git", ["worktree", "add", "--detach", worktree, baseRef], cwd);
   if (add.status !== 0) {
     rmSync5(baseDir, { recursive: true, force: true });
     return null;
   }
   try {
-    const scanCwd = prefix2 ? join33(worktree, prefix2) : worktree;
+    const scanCwd = prefix2 ? join34(worktree, prefix2) : worktree;
     const r = await runInfracostBreakdown(scanCwd, key);
     if (r.missing || r.status !== 0) return null;
     return parseInfracostBreakdown(r.stdout);
@@ -282046,7 +282281,7 @@ function InfracostDiffTool(ctx) {
 
 // src/mcp/terraform/tools/ingestExternalFindings.ts
 import { statSync as statSync7 } from "node:fs";
-import { join as join34 } from "node:path";
+import { join as join35 } from "node:path";
 
 // src/mcp/terraform/prowlerOcsf.ts
 var DETECTION_FINDING_CREATE = 200401;
@@ -282272,7 +282507,7 @@ var MAX_FEED_BYTES = 100 * 1024 * 1024;
 function readTfFiles3(cwd) {
   const out = [];
   for (const file2 of walkTfFiles(cwd)) {
-    const hcl2 = readTextCapped(join34(cwd, file2));
+    const hcl2 = readTextCapped(join35(cwd, file2));
     if (hcl2 !== null) out.push({ file: file2, hcl: hcl2 });
   }
   return out;
@@ -282386,7 +282621,8 @@ function IngestExternalFindingsTool(ctx) {
         // an external feed is a narrow concern source — join any prior scan
         // baseline so a later ✗→✓ verify doesn't read the workspace as regressions.
         baselineMode: "merge",
-        seedCaps: seedCapsFrom(input2)
+        seedCaps: seedCapsFrom(input2),
+        openRemediationPrs: await listOpenRemediationPrs(ctx)
       });
       const cappedBlock = cappedSummary(capped);
       log2.info(
@@ -282429,8 +282665,8 @@ function IngestExternalFindingsTool(ctx) {
 }
 
 // src/mcp/terraform/tools/moduleDocs.ts
-import { readFileSync as readFileSync21, writeFileSync as writeFileSync6 } from "node:fs";
-import { join as join35 } from "node:path";
+import { readFileSync as readFileSync22, writeFileSync as writeFileSync6 } from "node:fs";
+import { join as join36 } from "node:path";
 
 // src/mcp/terraform/moduleDocs.ts
 var VERDICT_CLAIM = {
@@ -282544,7 +282780,7 @@ function TerraformModuleDocsTool(ctx) {
         );
       }
       const absDir = resolveWithinCwd(cwd, module_dir);
-      const target = join35(absDir, "README.md");
+      const target = join36(absDir, "README.md");
       let gitHead = null;
       try {
         gitHead = $("git", ["rev-parse", "HEAD"], { cwd, log: false });
@@ -282552,7 +282788,7 @@ function TerraformModuleDocsTool(ctx) {
       }
       let existing = null;
       try {
-        existing = readFileSync21(target, "utf8");
+        existing = readFileSync22(target, "utf8");
       } catch {
       }
       const priorHead = readFooterGitHead(existing);
@@ -282856,15 +283092,13 @@ function NormalizationCandidatesTool(ctx) {
     parameters: NormalizationCandidatesParams,
     execute: execute(async () => {
       const cwd = ctx.payload.cwd ?? process.cwd();
-      const files = findNormalizationCandidates(cwd).filter(
-        (f) => ctx.payload.refactorExamples || !isExamplePath(f.file)
-      );
+      const library = libraryScope(cwd);
+      const files = findNormalizationCandidates(cwd).filter((f) => ctx.payload.refactorExamples || !isExamplePath(f.file)).map((f) => ({ ...reportOnly(library(f.file)), ...f }));
       const total = files.reduce((n, f) => n + f.count, 0);
       log2.info(
         `\xBB terraform_normalization_candidates: ${total} site(s) across ${files.length} file(s)`
       );
       return toolOk({
-        ...reportOnly(libraryRepoReason(cwd)),
         file_count: files.length,
         total,
         files,
@@ -282876,7 +283110,7 @@ function NormalizationCandidatesTool(ctx) {
 
 // src/mcp/terraform/tools/plan.ts
 import { rmSync as rmSync6 } from "node:fs";
-import { join as join36 } from "node:path";
+import { join as join37 } from "node:path";
 var PLAN_JSON_ARGS = ["plan", "-input=false", "-no-color", "-lock=false", "-json"];
 var planFileSeq = 0;
 async function capturePlanPairs(absDir, planFile, creds) {
@@ -282899,7 +283133,7 @@ async function planOneRoot(absDir, creds, tmpdir6) {
       skipReason: `terraform init failed: ${init.stderr.trim().slice(0, 200) || "unknown error"}`
     };
   }
-  const planFile = tmpdir6 ? join36(tmpdir6, `plan-${process.pid}-${planFileSeq++}.tfplan`) : void 0;
+  const planFile = tmpdir6 ? join37(tmpdir6, `plan-${process.pid}-${planFileSeq++}.tfplan`) : void 0;
   const plan = await runTfAsync(
     planFile ? [...PLAN_JSON_ARGS, `-out=${planFile}`] : PLAN_JSON_ARGS,
     absDir,
@@ -283269,8 +283503,8 @@ function TerraformProviderUpgradeTool(ctx) {
 }
 
 // src/mcp/terraform/tfquery.ts
-import { readFileSync as readFileSync22 } from "node:fs";
-import { join as join37 } from "node:path";
+import { readFileSync as readFileSync23 } from "node:fs";
+import { join as join38 } from "node:path";
 var TFQUERY_SUFFIX = ".tfquery.hcl";
 function parseQueryFile(hcl2) {
   return parseBlocks(hcl2, ["list"]).map((block) => {
@@ -283296,7 +283530,7 @@ function collectQueryInventory(cwd) {
   for (const rel of walkFilesBySuffix(cwd, TFQUERY_SUFFIX)) {
     let text;
     try {
-      text = readFileSync22(join37(cwd, rel), "utf8");
+      text = readFileSync23(join38(cwd, rel), "utf8");
     } catch {
       continue;
     }
@@ -283331,7 +283565,7 @@ function TerraformQueryInventoryTool(ctx) {
 }
 
 // src/mcp/terraform/tools/readFindings.ts
-import { readFileSync as readFileSync23 } from "node:fs";
+import { readFileSync as readFileSync24 } from "node:fs";
 var ReadFindingsParams = type({
   "path?": type.string.describe(
     "path to the Assessor's findings.json. Defaults to $INFRAWEAVER_FINDINGS_PATH, then ./findings.json in the workspace."
@@ -283356,7 +283590,7 @@ function ReadFindingsTool(ctx) {
       const findingsPath = path15 || !envFindingsPath ? resolveWithinCwd(cwd, path15 ?? "findings.json") : envFindingsPath;
       let raw2;
       try {
-        raw2 = readFileSync23(findingsPath, "utf8");
+        raw2 = readFileSync24(findingsPath, "utf8");
       } catch {
         return skipResult(
           "findings_not_found",
@@ -283399,7 +283633,8 @@ function ReadFindingsTool(ctx) {
         minRank,
         grouping,
         autonomyThreshold,
-        seedCaps: seedCapsFrom(input2)
+        seedCaps: seedCapsFrom(input2),
+        openRemediationPrs: await listOpenRemediationPrs(ctx)
       });
       const cappedBlock = cappedSummary(capped);
       log2.info(
@@ -283578,23 +283813,54 @@ function computeScanDelta(input2) {
   };
 }
 function markPossibleRenames(introduced, resolved, headAddresses) {
-  const vanished = resolved.filter((r) => {
-    if (r.address === null) return false;
-    return !headAddresses(dirOf3(r.concern.location.file)).has(r.address);
-  });
+  const byResource = (findings) => {
+    const out = /* @__PURE__ */ new Map();
+    for (const f of [...findings].sort((a, b) => byLocation(a.concern, b.concern))) {
+      if (f.address === null) continue;
+      const dir = dirOf3(f.concern.location.file);
+      const key = `${dir}|${f.address}`;
+      const entry4 = out.get(key);
+      if (entry4) entry4.findings.push(f);
+      else out.set(key, { dir, address: f.address, findings: [f] });
+    }
+    return [...out.values()];
+  };
+  const vanished = byResource(resolved).filter((r) => !headAddresses(r.dir).has(r.address));
+  const appeared = byResource(introduced);
+  const shared = (from, to) => {
+    const left = /* @__PURE__ */ new Map();
+    for (const f of from.findings)
+      left.set(ruleKey(f.concern), (left.get(ruleKey(f.concern)) ?? 0) + 1);
+    return to.findings.filter((f) => {
+      const n = left.get(ruleKey(f.concern)) ?? 0;
+      if (n === 0) return false;
+      left.set(ruleKey(f.concern), n - 1);
+      return true;
+    });
+  };
+  const order2 = (a, b) => a.dir.localeCompare(b.dir) || a.address.localeCompare(b.address);
+  const candidates = vanished.flatMap(
+    (from) => appeared.filter(
+      (to) => (
+        // a `moved` block cannot change a resource's type
+        typeOf(from.address) === typeOf(to.address) && // renamed in place, or moved elsewhere under its own name
+        from.dir === to.dir !== (from.address === to.address)
+      )
+    ).map((to) => ({ from, to, findings: shared(from, to) })).filter((p) => p.findings.length > 0)
+  );
+  candidates.sort(
+    (a, b) => b.findings.length - a.findings.length || order2(a.from, b.from) || order2(a.to, b.to)
+  );
   const used = /* @__PURE__ */ new Set();
-  for (const finding of introduced) {
-    if (finding.address === null) continue;
-    const dir = dirOf3(finding.concern.location.file);
-    const match5 = vanished.find(
-      (r) => !used.has(r) && ruleKey(r.concern) === ruleKey(finding.concern) && // a `moved` block cannot change a resource's type
-      typeOf(r.address) === typeOf(finding.address) && // renamed in place, or moved elsewhere under its own name
-      dirOf3(r.concern.location.file) === dir !== (r.address === finding.address)
-    );
-    if (!match5) continue;
-    used.add(match5);
-    finding.possiblyPreexisting = true;
-    finding.renamedFrom = { address: match5.address, file: match5.concern.location.file };
+  for (const { from, to, findings } of candidates) {
+    if (used.has(from) || used.has(to)) continue;
+    used.add(from);
+    used.add(to);
+    const file2 = from.findings[0]?.concern.location.file;
+    for (const finding of findings) {
+      finding.possiblyPreexisting = true;
+      finding.renamedFrom = { address: from.address, file: file2 };
+    }
   }
 }
 function typeOf(address) {
@@ -283637,7 +283903,8 @@ function deltaVerdict(delta, requiredControls) {
   return {
     pass: gate.pass && required3.length === 0,
     gating: gate.gating.length,
-    required: required3.length
+    required: required3.length,
+    blocking: (/* @__PURE__ */ new Set([...gate.gating, ...required3])).size
   };
 }
 function failsGate(finding, requiredControls) {
@@ -283755,8 +284022,8 @@ function describe3(f) {
 }
 
 // src/mcp/terraform/tools/scan.ts
-import { readFileSync as readFileSync24 } from "node:fs";
-import { join as join38 } from "node:path";
+import { readFileSync as readFileSync25 } from "node:fs";
+import { join as join39 } from "node:path";
 
 // src/mcp/terraform/noiseProfile.ts
 var MIN_DISMISSAL_REPOS = 3;
@@ -283930,7 +284197,9 @@ async function runScan(ctx, {
       grouping,
       autonomyThreshold,
       inScope,
-      priority
+      priority,
+      openRemediationPrs: await listOpenRemediationPrs(ctx),
+      linesMatchTree: true
     }
   );
   const { active, suppressed, groups: groups2, batchPlan, bySeverity: by_severity } = result;
@@ -283942,7 +284211,7 @@ async function runScan(ctx, {
     outcomes.flatMap((o) => o.concerns),
     (rel) => {
       try {
-        return readFileSync24(join38(cwd, rel), "utf-8");
+        return readFileSync25(join39(cwd, rel), "utf-8");
       } catch {
         return null;
       }
@@ -284459,9 +284728,9 @@ function TerraformStandardsReportTool(ctx) {
 }
 
 // src/mcp/terraform/tools/tag.ts
-import { createHash as createHash11 } from "node:crypto";
-import { existsSync as existsSync9, readdirSync as readdirSync8, readFileSync as readFileSync25, realpathSync as realpathSync2, rmSync as rmSync7 } from "node:fs";
-import { isAbsolute as isAbsolute3, join as join39, relative as relative5, resolve as resolve6, sep as sep2 } from "node:path";
+import { createHash as createHash12 } from "node:crypto";
+import { existsSync as existsSync8, readdirSync as readdirSync8, readFileSync as readFileSync26, realpathSync as realpathSync2, rmSync as rmSync7 } from "node:fs";
+import { isAbsolute as isAbsolute3, join as join40, relative as relative5, resolve as resolve6, sep as sep2 } from "node:path";
 var TerraformTagParams = type({
   tags: type({ "[string]": "string" }).describe(
     'the tag set to apply, key \u2192 value (e.g. {"Owner":"platform","CostCentre":"1234"}); merged into every taggable resource\'s `tags`'
@@ -284482,24 +284751,24 @@ var TerraformTagParams = type({
 var realRunners3 = { run };
 function sha(path15) {
   try {
-    return createHash11("sha256").update(readFileSync25(path15)).digest("hex");
+    return createHash12("sha256").update(readFileSync26(path15)).digest("hex");
   } catch {
     return null;
   }
 }
 function snapshot2(cwd, files) {
-  return new Map(files.map((f) => [f, sha(join39(cwd, f))]));
+  return new Map(files.map((f) => [f, sha(join40(cwd, f))]));
 }
 function toPosix(p) {
   return p.split(sep2).join("/");
 }
 function terratagFiles(dir) {
   const dirs = [dir];
-  const manifest = join39(dir, ".terraform", "modules", "modules.json");
-  if (existsSync9(manifest)) {
+  const manifest = join40(dir, ".terraform", "modules", "modules.json");
+  if (existsSync8(manifest)) {
     let modules;
     try {
-      modules = JSON.parse(readFileSync25(manifest, "utf8")).Modules;
+      modules = JSON.parse(readFileSync26(manifest, "utf8")).Modules;
     } catch {
       throw new Error(`terraform_tag refused: cannot read ${manifest} (re-run terraform init)`);
     }
@@ -284507,7 +284776,7 @@ function terratagFiles(dir) {
       const moduleDir = m?.Dir;
       if (typeof moduleDir !== "string") continue;
       try {
-        dirs.push(realpathSync2(join39(dir, moduleDir)));
+        dirs.push(realpathSync2(join40(dir, moduleDir)));
       } catch {
       }
     }
@@ -284515,7 +284784,7 @@ function terratagFiles(dir) {
   const files = /* @__PURE__ */ new Set();
   for (const d of dirs) {
     for (const name of readdirSync8(d)) {
-      if (name.endsWith(".tf")) files.add(realpathSync2(join39(d, name)));
+      if (name.endsWith(".tf")) files.add(realpathSync2(join40(d, name)));
     }
   }
   return [...files];
@@ -284539,12 +284808,12 @@ function runTag(ctx, params, runners = realRunners3) {
     return rel !== ".." && !rel.startsWith(`..${sep2}`) && !isAbsolute3(rel);
   };
   const requested = resolve6(cwd, params.dir ?? ".");
-  const target = existsSync9(requested) ? realpathSync2(requested) : requested;
+  const target = existsSync8(requested) ? realpathSync2(requested) : requested;
   if (!inside(target)) {
     throw new Error(`terraform_tag: \`dir\` must stay inside the workspace (got ${params.dir})`);
   }
   const relDir = toPosix(relative5(cwd, target)) || ".";
-  if (!existsSync9(target)) {
+  if (!existsSync8(target)) {
     return toolSkip("no_terraform_files", `no .tf files under ${relDir}`);
   }
   const absFiles = terratagFiles(target);
@@ -284582,7 +284851,7 @@ function runTag(ctx, params, runners = realRunners3) {
   if (params.filter) args2.push(`-filter=${params.filter}`);
   if (params.skip) args2.push(`-skip=${params.skip}`);
   const before = snapshot2(cwd, files);
-  const priorBackups = new Set(files.filter((f) => existsSync9(join39(cwd, `${f}.bak`))));
+  const priorBackups = new Set(files.filter((f) => existsSync8(join40(cwd, `${f}.bak`))));
   const r = runners.run("terratag", args2, cwd);
   if (r.missing) {
     return toolSkip(
@@ -284596,7 +284865,7 @@ function runTag(ctx, params, runners = realRunners3) {
 ${tail}` : ""}`);
   }
   for (const f of files) {
-    if (!priorBackups.has(f)) rmSync7(join39(cwd, `${f}.bak`), { force: true });
+    if (!priorBackups.has(f)) rmSync7(join40(cwd, `${f}.bak`), { force: true });
   }
   const failed = [
     ...`${r.stderr}
@@ -284767,7 +285036,25 @@ async function runVerifyRemediation(ctx, { concern_ids, download_external_module
     if (key !== void 0) keyed.push({ id, key });
     else unkeyed.push(id);
   }
-  const keyedVerdict = partitionByKey(keyed, currentKeys);
+  const byKey = partitionByKey(keyed, currentKeys);
+  const read3 = fileReader(cwd);
+  const remainingKeyed = keyed.filter((k) => byKey.remaining.includes(k.id));
+  const atSite = new Set(
+    resolvedAtSite({
+      requested: remainingKeyed.map((k) => ({
+        ...k,
+        site: session.siteById?.get(k.id) ?? null,
+        file: reported.get(k.id)?.location.file
+      })),
+      current: currentConcerns.map((c) => ({ key: concernKeyOf(c), site: siteOf(c, read3) })),
+      firstSites: session.firstSitesByKey ?? /* @__PURE__ */ new Map(),
+      declared: (file2) => new Set(declaredAddresses(read3(file2) ?? ""))
+    })
+  );
+  const keyedVerdict = {
+    resolved: [...byKey.resolved, ...byKey.remaining.filter((id) => atSite.has(id))],
+    remaining: byKey.remaining.filter((id) => !atSite.has(id))
+  };
   const fallbackVerdict = computeRemediationVerdict(unkeyed, new Set(currentIds));
   const resolved = [...keyedVerdict.resolved, ...fallbackVerdict.resolved];
   const remaining = [...keyedVerdict.remaining, ...fallbackVerdict.remaining];
@@ -284987,10 +285274,10 @@ var DispatchRecorder = class {
    * orchestrator counts as subagent — including a session the labeler could not
    * name, because an unnamed session is by definition not the orchestrator's.
    */
-  recordTokens(label, billableTokens2) {
-    if (!Number.isFinite(billableTokens2) || billableTokens2 <= 0) return;
-    if (label === ORCHESTRATOR_LABEL) this.#orchestratorTokens += billableTokens2;
-    else this.#subagentTokens += billableTokens2;
+  recordTokens(label, billableTokens) {
+    if (!Number.isFinite(billableTokens) || billableTokens <= 0) return;
+    if (label === ORCHESTRATOR_LABEL) this.#orchestratorTokens += billableTokens;
+    else this.#subagentTokens += billableTokens;
   }
   tally() {
     return {
@@ -285117,7 +285404,7 @@ function buildLocalContext(options) {
       registryHost: options.registryHost
     },
     toolState: initToolState({ progressComment: void 0 }),
-    tmpdir: mkdtempSync4(join40(tmpdir3(), `${PRODUCT_SLUG}-mcp-`))
+    tmpdir: mkdtempSync4(join41(tmpdir3(), `${PRODUCT_SLUG}-mcp-`))
   };
 }
 function buildLocalTools(ctx) {
@@ -285160,7 +285447,7 @@ function buildLocalTools(ctx) {
   ];
 }
 function cliVersion() {
-  const raw2 = "0.3.11";
+  const raw2 = "0.3.13";
   if (raw2 !== void 0 && /^\d+\.\d+\.\d+$/.test(raw2)) {
     return raw2;
   }
@@ -285299,7 +285586,7 @@ async function runAssessCli(params) {
   }
   let cwd = process.cwd();
   if (rawCwd) cwd = isAbsolute4(rawCwd) ? rawCwd : resolve7(process.cwd(), rawCwd);
-  if (!existsSync10(cwd) || !statSync8(cwd).isDirectory()) {
+  if (!existsSync9(cwd) || !statSync8(cwd).isDirectory()) {
     console.error(`assess: not a directory: ${cwd}`);
     process.exit(ASSESS_EXIT.USAGE);
   }
@@ -285391,15 +285678,15 @@ ${postureLine(scorecard.posture, scorecard.total)} \u2014 failing the gate (--fa
 }
 
 // src/commands/explain.ts
-import { readFileSync as readFileSync26 } from "node:fs";
-import { join as join41, relative as relative6, resolve as resolve8 } from "node:path";
+import { readFileSync as readFileSync27 } from "node:fs";
+import { join as join42, relative as relative6, resolve as resolve8 } from "node:path";
 var import_arg2 = __toESM(require_arg(), 1);
 var import_yaml3 = __toESM(require_dist(), 1);
 function readConfig(cwd) {
   for (const name of INFRAWEAVER_CONFIG_FILENAMES) {
     let raw2;
     try {
-      raw2 = readFileSync26(join41(cwd, name), "utf-8");
+      raw2 = readFileSync27(join42(cwd, name), "utf-8");
     } catch {
       continue;
     }
@@ -285573,8 +285860,8 @@ var import_arg3 = __toESM(require_arg(), 1);
 
 // node_modules/.pnpm/@infraweaver-io+ci@0.1.8/node_modules/@infraweaver-io/ci/dist/gitAuth.js
 import { execSync } from "node:child_process";
-import { createHash as createHash12 } from "node:crypto";
-import { readFileSync as readFileSync27, realpathSync as realpathSync3, unlinkSync } from "node:fs";
+import { createHash as createHash13 } from "node:crypto";
+import { readFileSync as readFileSync28, realpathSync as realpathSync3, unlinkSync } from "node:fs";
 
 // node_modules/.pnpm/@infraweaver-io+sandbox@0.1.8/node_modules/@infraweaver-io/sandbox/dist/subprocess.js
 import { spawn as nodeSpawn } from "node:child_process";
@@ -285900,7 +286187,7 @@ ${errMsg}` : errMsg;
 // node_modules/.pnpm/@infraweaver-io+ci@0.1.8/node_modules/@infraweaver-io/ci/dist/gitAuth.js
 var gitBinary;
 function hashFile(path15) {
-  return createHash12("sha256").update(readFileSync27(path15)).digest("hex");
+  return createHash13("sha256").update(readFileSync28(path15)).digest("hex");
 }
 function resolveGit() {
   const lookup3 = process.platform === "win32" ? "where git" : "which git";
@@ -286022,7 +286309,7 @@ async function $gitFetchWithDeepen(args2, options, label) {
 import { randomUUID as randomUUID3 } from "node:crypto";
 import { writeFileSync as writeFileSync7 } from "node:fs";
 import { createServer } from "node:http";
-import { join as join42 } from "node:path";
+import { join as join43 } from "node:path";
 var REVOKED_TRAP_MS = 6e4;
 function revokeGitHubToken(token, userAgent2) {
   const apiBase = process.env.GITHUB_API_URL || "https://api.github.com";
@@ -286094,7 +286381,7 @@ async function startGitAuthServer(tmpdir6, options) {
   function writeAskpassScript(code2) {
     const scriptId = randomUUID3();
     const scriptName = `askpass-${scriptId}.js`;
-    const scriptPath = join42(tmpdir6, scriptName);
+    const scriptPath = join43(tmpdir6, scriptName);
     const content = [
       `#!/usr/bin/env node`,
       `var a=process.argv[2]||"";`,
@@ -286273,9 +286560,9 @@ function TerraformChangeSummaryTool(ctx) {
 }
 
 // src/mcp/checkout.ts
-import { createHash as createHash13 } from "node:crypto";
+import { createHash as createHash14 } from "node:crypto";
 import { statSync as statSync9, unlinkSync as unlinkSync3, writeFileSync as writeFileSync13 } from "node:fs";
-import { join as join52 } from "node:path";
+import { join as join53 } from "node:path";
 
 // node_modules/.pnpm/@infraweaver-io+ci@0.1.8/node_modules/@infraweaver-io/ci/dist/diffCoverage.js
 import { isAbsolute as isAbsolute5, normalize as normalize4, resolve as resolve9 } from "node:path";
@@ -286571,7 +286858,7 @@ function readNumber(params) {
 // src/mcp/git.ts
 import { randomUUID as randomUUID5 } from "node:crypto";
 import { writeFileSync as writeFileSync9 } from "node:fs";
-import { join as join45 } from "node:path";
+import { join as join46 } from "node:path";
 
 // src/modes/address-reviews.ts
 function addressReviewsMode(t) {
@@ -287467,7 +287754,7 @@ This mode standardises STRUCTURE while preserving BEHAVIOUR \u2014 the equivalen
    - \`${t("terraform_normalization_candidates")}\` \u2192 in-place idiomatic cleanups that change SYNTAX, not behaviour (redundant whole-string \`"\${expr}"\` interpolation; legacy HCL0.11 map-argument block syntax like \`vars {\` on a \`template_file\`). These relocate NOTHING \u2014 zero \`moved {}\` blocks \u2014 and are proven by the same equivalence check.
    - \`${t("terraform_consolidation_candidates")}\` \u2192 the SAME resource shape declared in several root directories (\`env/dev\` + \`env/staging\` + \`env/prod\`), with the single parameterised module they could all call already derived: which attributes are identical (module content) and which differ (per-environment inputs). A member root of a group will ALSO show up as a zero-candidate cluster in \`${t("module_extraction_candidates")}\` \u2014 prefer the consolidation, which does that work once for every environment instead of once per environment. Its \`near_groups\` are the opposite case: roots recognisably the same stack that DIFFER (one carries a resource the other does not), where folding them together is a design decision this mode has no basis for. Do NOT extract a near-group root's shared resources into a module on its own either \u2014 a module one twin calls and the other does not widens exactly the drift the near-group reports. Leave those roots alone and name the near-group and its \`differences\` in your report.
 
-   **A result marked \`report_only\` is an observation, not work.** The repository is a module other configurations call (\`report_only_reason\` says why), and restructuring it is churn for every caller: name those candidates in your \`${t("report_progress")}\` summary and open no PR for them. \`examples/\` roots are left out of every candidate list unless the operator set \`refactor_examples\`.
+   **A candidate marked \`report_only\` is an observation, not work.** It sits in the code of a module other configurations call (\`report_only_reason\` says why), and restructuring that is churn for every caller: name those candidates in your \`${t("report_progress")}\` summary and open no PR for them. \`examples/\` roots are left out of every candidate list unless the operator set \`refactor_examples\`.
 
    **Before picking, check the interface.** \`${t("module_extraction_candidates")}\` reports \`unmapped_attributes\` per candidate and a top-level \`partial_interfaces\` list: arguments the raw resources SET that the target module does not. Adopting such a module DROPS them silently \u2014 and the equivalence check cannot catch it, because once the argument is gone it is absent from both sides. Two of these are unrecoverable rather than merely wrong (\`object_lock_enabled\` cannot be set after creation; \`force_destroy\` changes deletion semantics). So: **decline the candidate, or extend the module to expose the argument and say so in the PR body.** Deleting the argument to make the shapes match is never the fix. A candidate whose \`unmapped_attributes\` is \`null\` was NOT checked \u2014 the module is external and its code is not in this repo \u2014 which is not the same as clean.
 
@@ -287600,7 +287887,7 @@ function remediateMode(t) {
 
 4. **for the chosen group**:
    - **base branch**: this run's base branch is resolved deterministically \u2014 \`${t("create_pull_request")}\` targets the \`base_branch\` input if set, else the branch the run started on, else the repository's default branch (\`main\`, or \`master\`). You do not choose it; just **omit** the \`base\` argument when opening the PR (below) and it is filled in.
-   - **idempotency**: the remediation branch is the group's \`branch\` (\`remediate/<group-id>\`, with a \`--<base>\` suffix when the PR targets a non-default branch) \u2014 use it exactly, never a name of your own. Before doing anything, check whether that branch or an open PR for it already exists (\`${t("git")}\` / \`${t("get_pull_request")}\`). If one exists, update it rather than opening a duplicate.
+   - **idempotency**: the remediation branch is the group's \`branch\` (\`remediate/<group-id>\`, with a \`--<base>\` suffix when the PR targets a non-default branch, or the branch of the PR already open for this group) \u2014 use it exactly, never a name of your own. Before doing anything, check whether that branch or an open PR for it already exists (\`${t("git")}\` / \`${t("get_pull_request")}\`). If one exists, update it rather than opening a duplicate.
    - **branch**: create the group's \`branch\` from the **current HEAD** (the checkout that was just scanned) via \`${t("git")}\` (\`git({ command: "checkout", args: ["-b", <branch>] })\`). Do NOT switch to a different base first \u2014 branching from the scanned checkout keeps the PR diff to exactly your fix.
    - **honest refusal (decide BEFORE fixing)**: if the group's concerns appear in the scan's \`refusal_candidates\` (the fix needs a human decision \u2014 narrowing an IAM wildcard, a KMS key policy, a real ingress CIDR), do **not** guess a fix that could break the stack. Instead open a structured issue (\`${t("create_issue")}\`) describing the concern, why it isn't auto-fixed, and what a human should do, and skip the PR for that group. A proven fix or an honest refusal \u2014 never a guessed, unverifiable PR.
    - **propose, then let me steer (when there's no single right fix)**: distinct from honest refusal (which refuses a fix a human must *decide*), this is for a finding with **2\u20133 genuinely distinct, defensible fixes** that differ in trade-offs, not correctness (e.g. encrypt with an AWS-managed key **vs** a customer-managed KMS key; a narrow security-group rule **vs** a prefix list **vs** a VPC endpoint). When such a fork exists **and the triggering comment did not already select a strategy**, do **not** silently pick for the reviewer: via \`${t("create_issue_comment")}\` post one short comment listing the options as **A / B / C** \u2014 each a single line (what it does + its trade-off) \u2014 and ask the reviewer to reply \`${COMMENT_COMMAND} fix #<concern-id> with strategy <A|B|C>\`. Then **skip the PR for this group** this run and note it in your final report (it resumes when the reviewer replies). When the comment **did** select one (\`fix #<id> with strategy B\`, or a bare \`strategy B\` reply on the proposal thread), apply **exactly** that strategy \u2014 don't second-guess it. Reserve this for real forks in the road; a fix with one obvious correct answer just gets made.
@@ -287661,7 +287948,7 @@ This mode composes the **Remediate** and **Refactor** verbs into a single run. I
    - **commit the fix** (\`git add\` only the changed \`*.tf\`/\`*.tfvars\`, a \`fix(tf): \u2026\` message). Do NOT push yet. This committed state is the refactor's equivalence BASELINE.
 
 3. **REFACTOR (phase 2) \u2014 modularise on top of the committed fix**: follow the **Refactor** mode's flow:
-   - \`${t("module_extraction_candidates")}\` / \`${t("terraform_normalization_candidates")}\` \u2192 pick one behaviour-preserving refactor; a result marked \`report_only\` (the repository is a module others call) is named in the summary, never proposed. Respect a pinned \`refactor_source\` if one was supplied (it constrains which module source you may use; the behaviour-altering b.4 path is only available when the operator pinned \`third-party\`).
+   - \`${t("module_extraction_candidates")}\` / \`${t("terraform_normalization_candidates")}\` \u2192 pick one behaviour-preserving refactor; a candidate marked \`report_only\` (it sits in the code of a module others call) is named in the summary, never proposed. Respect a pinned \`refactor_source\` if one was supplied (it constrains which module source you may use; the behaviour-altering b.4 path is only available when the operator pinned \`third-party\`).
    - resolve the module source, wire the \`module\` call against its real interface (\`${t("terraform_module_interface")}\` for a local module dir, \`${t("terraform_module_lookup")}\` for a registry-sourced one), and emit a \`moved {}\` block for EVERY relocated address (\`${t("terraform_generate_moved")}\`).
    - \`terraform fmt\` + \`${t("terraform_validate")}\`, then \u2014 **with the refactor edits still UNCOMMITTED** \u2014 call \`${t("terraform_equivalence_check")}\`. In this mode it diffs the working tree against the COMMITTED fix (not the run-start commit), so it measures only the refactor. It must return \`equivalent: true\` (zero uncovered moves, resource set + arguments preserved, validate + fmt clean) before you proceed; \`${t("push_branch")}\` hard-blocks an unproven one \u2014 and, once this run has added a \`moved {}\` block, it also hard-blocks a push that never ran the check at all, so abandoning the refactor means REVERTING its edits rather than leaving them in with the fix. If it can't be proven equivalent, abandon the refactor and ship the fix alone.
    - **document the module (only when the \`docs\` input is enabled)**: after the equivalence check passes, call \`${t("terraform_module_docs")}\` for the module you created/adopted (pass the relocated addresses as \`moves\`). Do not hand-write docs \u2014 the tool builds from the interface, moved blocks, and equivalence verdict.
@@ -288074,14 +288361,14 @@ import { spawn as spawn3, spawnSync as spawnSync6 } from "node:child_process";
 import { randomUUID as randomUUID4 } from "node:crypto";
 import { closeSync as closeSync3, openSync as openSync3, writeFileSync as writeFileSync8 } from "node:fs";
 import { constants as osConstants, userInfo } from "node:os";
-import { join as join44 } from "node:path";
+import { join as join45 } from "node:path";
 import { setTimeout as sleep3 } from "node:timers/promises";
 
 // node_modules/.pnpm/@infraweaver-io+core@0.1.5/node_modules/@infraweaver-io/core/dist/packageManager.js
 var import_semver = __toESM(require_semver2(), 1);
-import { existsSync as existsSync11 } from "node:fs";
+import { existsSync as existsSync10 } from "node:fs";
 import { mkdir as mkdir2, readFile } from "node:fs/promises";
-import { delimiter as delimiter2, join as join43 } from "node:path";
+import { delimiter as delimiter2, join as join44 } from "node:path";
 var SUPPORTED_NAMES = ["npm", "pnpm", "yarn", "bun"];
 var COREPACK_MANAGED = ["pnpm", "yarn"];
 function isSupported(name) {
@@ -288121,8 +288408,8 @@ function parseDevEnginesField(field) {
   };
 }
 async function resolvePackageManagerSpec(cwd) {
-  const pkgPath = join43(cwd, "package.json");
-  if (!existsSync11(pkgPath))
+  const pkgPath = join44(cwd, "package.json");
+  if (!existsSync10(pkgPath))
     return null;
   let pkg;
   try {
@@ -288180,7 +288467,7 @@ async function currentVersion(run4, name) {
   return result.stdout.trim();
 }
 function packageManagerBinDir(tmpdir6) {
-  return join43(tmpdir6, "pm-bin");
+  return join44(tmpdir6, "pm-bin");
 }
 async function ensurePackageManager(params) {
   const spec = params.spec;
@@ -288421,7 +288708,7 @@ async function killProcessGroup(proc) {
 var MAX_OUTPUT_CHARS = 5e3;
 function capOutput(output2) {
   if (output2.length <= MAX_OUTPUT_CHARS) return output2;
-  const fullPath = join44(getTempDir(), `shell-${randomUUID4().slice(0, 8)}.log`);
+  const fullPath = join45(getTempDir(), `shell-${randomUUID4().slice(0, 8)}.log`);
   writeFileSync8(fullPath, output2);
   const elided = output2.length - MAX_OUTPUT_CHARS;
   return `... [${elided} chars truncated; output saved to ${fullPath}] ...
@@ -288487,8 +288774,8 @@ Do NOT use this tool for git commands \u2014 use the dedicated git tools instead
       if (params.background) {
         const tempDir = getTempDir();
         const handle = `bg-${randomUUID4().slice(0, 8)}`;
-        const outputPath = join44(tempDir, `${handle}.log`);
-        const pidPath = join44(tempDir, `${handle}.pid`);
+        const outputPath = join45(tempDir, `${handle}.log`);
+        const pidPath = join45(tempDir, `${handle}.pid`);
         const logFd = openSync3(outputPath, "a");
         let proc;
         try {
@@ -289193,7 +289480,7 @@ function countAhead(head, base) {
 }
 function spillGitOutput(params) {
   const tempDir = getTempDir();
-  const outputPath = join45(tempDir, `git-${params.command}-${randomUUID5().slice(0, 8)}.txt`);
+  const outputPath = join46(tempDir, `git-${params.command}-${randomUUID5().slice(0, 8)}.txt`);
   writeFileSync9(outputPath, params.output);
   const previewByLines = params.output.split("\n").slice(0, OVERFLOW_PREVIEW_LINES).join("\n");
   const preview = previewByLines.length <= OVERFLOW_PREVIEW_MAX_CHARS ? previewByLines : `${previewByLines.slice(0, OVERFLOW_PREVIEW_MAX_CHARS)}\u2026`;
@@ -289214,15 +289501,52 @@ var Git = type({
   args: type.string.array().describe("Additional arguments for the git command").optional()
 });
 function splitWords(line) {
-  return [...line.matchAll(/"([^"]*)"|'([^']*)'|(\S+)/g)].map((m) => m[1] ?? m[2] ?? m[3] ?? "");
+  const words2 = [];
+  let word = "";
+  let inWord = false;
+  let quote;
+  for (let i = 0; i < line.length; i++) {
+    const ch = line.charAt(i);
+    if (quote === "'") {
+      if (ch === "'") quote = void 0;
+      else word += ch;
+    } else if (quote === '"') {
+      if (ch === '"') quote = void 0;
+      else if (ch === "\\" && i + 1 < line.length && '"\\$`\n'.includes(line.charAt(i + 1))) {
+        i += 1;
+        if (line.charAt(i) !== "\n") word += line.charAt(i);
+      } else word += ch;
+    } else if (ch === " " || ch === "	") {
+      if (inWord) words2.push(word);
+      word = "";
+      inWord = false;
+    } else if (ch === "\n") {
+      throw new Error(
+        "command holds an unquoted newline \u2014 pass one git command per call, and quote a multi-line message"
+      );
+    } else if (ch === "\\") {
+      if (i + 1 >= line.length) throw new Error("command ends in a backslash that escapes nothing");
+      i += 1;
+      if (line.charAt(i) === "\n") continue;
+      word += line.charAt(i);
+      inWord = true;
+    } else if (ch === "'" || ch === '"') {
+      quote = ch;
+      inWord = true;
+    } else {
+      word += ch;
+      inWord = true;
+    }
+  }
+  if (quote) throw new Error(`command has an unterminated ${quote} quote`);
+  if (inWord) words2.push(word);
+  return words2;
 }
 function normalizeGitCall(params) {
-  let words2;
-  if (params.command === void 0) words2 = [...params.args ?? []];
-  else if (/^git\s/.test(params.command))
-    words2 = [...splitWords(params.command).slice(1), ...params.args ?? []];
-  else return { command: params.command, args: params.args ?? [] };
-  const [command, ...args2] = words2[0] === "git" ? words2.slice(1) : words2;
+  const words2 = params.command === void 0 ? [] : /^git\s/.test(params.command) ? splitWords(params.command) : [params.command];
+  words2.push(...params.args ?? []);
+  while (words2[0] === "git") words2.shift();
+  const [command, ...args2] = words2;
   if (command === void 0 || !/^[a-z][a-z0-9-]*$/.test(command)) {
     throw new Error(
       `command must be a Git subcommand such as 'status' or 'checkout' (was "${command ?? ""}")`
@@ -289408,7 +289732,7 @@ function PushTagsTool(ctx) {
 }
 
 // src/mcp/review.ts
-import { readFileSync as readFileSync32 } from "node:fs";
+import { readFileSync as readFileSync33 } from "node:fs";
 
 // src/mcp/findingAudit.ts
 var COHERENCE_RULES = {
@@ -289658,7 +289982,7 @@ function claimsBlockingSeverity(body2) {
 init_core();
 import { isAbsolute as isAbsolute6, resolve as resolve10 } from "node:path";
 
-// node_modules/.pnpm/@infraweaver-io+models@0.1.6/node_modules/@infraweaver-io/models/dist/monotonicQuota.js
+// node_modules/.pnpm/@infraweaver-io+models@0.1.7/node_modules/@infraweaver-io/models/dist/monotonicQuota.js
 function createMonotonicQuota(params) {
   const { limit, unlimited, normalize: normalize5 } = params;
   let used = 0;
@@ -289683,7 +290007,7 @@ function createMonotonicQuota(params) {
   };
 }
 
-// node_modules/.pnpm/@infraweaver-io+models@0.1.6/node_modules/@infraweaver-io/models/dist/costQuota.js
+// node_modules/.pnpm/@infraweaver-io+models@0.1.7/node_modules/@infraweaver-io/models/dist/costQuota.js
 var CostQuotaExceededError = class extends Error {
   code = "COST_QUOTA_EXCEEDED";
   constructor(message2) {
@@ -289730,7 +290054,7 @@ function resolveRunCostQuota(parsed2) {
   return parsed2 === void 0 ? DEFAULT_RUN_COST_QUOTA_USD : parsed2;
 }
 
-// node_modules/.pnpm/@infraweaver-io+models@0.1.6/node_modules/@infraweaver-io/models/dist/tokenQuota.js
+// node_modules/.pnpm/@infraweaver-io+models@0.1.7/node_modules/@infraweaver-io/models/dist/tokenQuota.js
 var TokenQuotaExceededError = class extends Error {
   code = "TOKEN_QUOTA_EXCEEDED";
   constructor(message2) {
@@ -289740,19 +290064,16 @@ var TokenQuotaExceededError = class extends Error {
 };
 var DEFAULT_RUN_TOKEN_QUOTA = 1e7;
 var RUN_TOKEN_QUOTA_INPUT = "max_run_tokens";
-function billableTokens(t) {
-  let total = 0;
-  for (const v of [t.input, t.output, t.cacheRead, t.cacheWrite]) {
-    if (typeof v === "number" && Number.isFinite(v) && v > 0)
-      total += v;
-  }
-  return Math.floor(total);
+var CACHE_READ_WEIGHT = 0.1;
+function quotaTokens(t) {
+  const part = (v) => typeof v === "number" && Number.isFinite(v) && v > 0 ? v : 0;
+  return Math.floor(part(t.input) + part(t.output) + part(t.cacheWrite) + part(t.cacheRead) * CACHE_READ_WEIGHT);
 }
 function normalizeTotal(total) {
-  return typeof total === "number" ? Math.max(0, Math.floor(total)) : billableTokens(total);
+  return typeof total === "number" ? Math.max(0, Math.floor(total)) : quotaTokens(total);
 }
 function tokenGap(used, ceiling) {
-  return `run token quota exhausted: ${used.toLocaleString("en-GB")} of ${ceiling.toLocaleString("en-GB")} billable tokens consumed, so the run was stopped before it finished. Its results are INCOMPLETE and must not be read as a clean assessment \u2014 a finding that would have been raised after this point was never looked for. Raise \`${RUN_TOKEN_QUOTA_INPUT}\` if the run legitimately needs more budget, or set \`${RUN_TOKEN_QUOTA_INPUT}: 0\` to remove the bound entirely. A run that reaches this limit without finishing is more often a remediation loop that cannot converge (a fix that re-breaks its own check) than a genuinely large repository.`;
+  return `run token quota exhausted: ${used.toLocaleString("en-GB")} of ${ceiling.toLocaleString("en-GB")} tokens counted against the quota (a token read from the prompt cache counts as a tenth), so the run was stopped before it finished. Its results are INCOMPLETE and must not be read as a clean assessment \u2014 a finding that would have been raised after this point was never looked for. Raise \`${RUN_TOKEN_QUOTA_INPUT}\` if the run legitimately needs more budget, or set \`${RUN_TOKEN_QUOTA_INPUT}: 0\` to remove the bound entirely. A run that reaches this limit without finishing is more often a remediation loop that cannot converge (a fix that re-breaks its own check) than a genuinely large repository.`;
 }
 function unlimitedTokenQuota() {
   return createMonotonicQuota({
@@ -289807,7 +290128,7 @@ function validateCompatibility(payloadVersion, actionVersion) {
 }
 
 // src/utils/github/prCommentEvent.ts
-import { readFileSync as readFileSync28 } from "node:fs";
+import { readFileSync as readFileSync29 } from "node:fs";
 var obj = (v) => typeof v === "object" && v !== null && !Array.isArray(v) ? v : void 0;
 function parsePrCommentEvent(eventName, raw2) {
   if (eventName !== "issue_comment") return void 0;
@@ -289836,7 +290157,7 @@ function readPrCommentEvent(env2 = process.env) {
   try {
     return parsePrCommentEvent(
       env2.GITHUB_EVENT_NAME,
-      JSON.parse(readFileSync28(env2.GITHUB_EVENT_PATH, "utf-8"))
+      JSON.parse(readFileSync29(env2.GITHUB_EVENT_PATH, "utf-8"))
     );
   } catch {
     return void 0;
@@ -289844,7 +290165,7 @@ function readPrCommentEvent(env2 = process.env) {
 }
 
 // src/utils/github/pullRequestEvent.ts
-import { readFileSync as readFileSync29 } from "node:fs";
+import { readFileSync as readFileSync30 } from "node:fs";
 var obj2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v) ? v : void 0;
 var str = (v) => typeof v === "string" && v ? v : void 0;
 function parsePullRequestEvent(eventName, raw2) {
@@ -289904,7 +290225,7 @@ function readPullRequestEvent(env2 = process.env) {
   if (env2.GITHUB_EVENT_NAME !== "pull_request" || !env2.GITHUB_EVENT_PATH) return void 0;
   let raw2;
   try {
-    raw2 = JSON.parse(readFileSync29(env2.GITHUB_EVENT_PATH, "utf-8"));
+    raw2 = JSON.parse(readFileSync30(env2.GITHUB_EVENT_PATH, "utf-8"));
   } catch {
     return void 0;
   }
@@ -290895,6 +291216,12 @@ function parseCommentMarker(body2) {
     return null;
   }
 }
+function findingKeysIn(body2) {
+  return [...body2.matchAll(new RegExp(MARKER.source, "g"))].flatMap((m) => {
+    const marker2 = parseCommentMarker(m[0]);
+    return marker2?.kind === "finding" ? [marker2.key] : [];
+  });
+}
 var SUGGESTION = /```suggestion\r?\n([\s\S]*?)```/;
 function suggestionText(body2) {
   const m = SUGGESTION.exec(body2);
@@ -291144,44 +291471,120 @@ function formatDuplicateCommentsNote(duplicates) {
 var MAX_DUPLICATE_COMMENT_LINES = 50;
 
 // src/mcp/reviewCommentLimit.ts
-var MAX_OVERFLOW_LINES = 50;
+var MAX_NOTE_CHARS = 3e4;
+var TRAILER_RESERVE = 400;
 var PROVEN_MARK = "\u2705 **Proven by re-scan**";
-function rank(c) {
+var SEVERITY_LEVEL = {
+  critical: 0,
+  high: 1,
+  medium: 2,
+  low: 3,
+  info: 4
+};
+var MARKER_LEVEL = { "\u{1F6A8}": 1, "\u26A0\uFE0F": 2, "\u26A0": 2, "\u2139\uFE0F": 3, \u2139: 3 };
+var UNMARKED_LEVEL = 2;
+function rank(c, severity) {
   const body2 = c.body ?? "";
-  const marker2 = leadingMarker(body2);
-  const severity = marker2 === "\u{1F6A8}" ? 0 : marker2 === "\u26A0\uFE0F" || marker2 === "\u26A0" ? 2 : 4;
-  return severity + (body2.includes(PROVEN_MARK) ? 0 : 1);
+  const level = severity ? SEVERITY_LEVEL[severity] : MARKER_LEVEL[leadingMarker(body2) ?? ""] ?? UNMARKED_LEVEL;
+  return level * 2 + (body2.includes(PROVEN_MARK) ? 0 : 1);
 }
-function limitInlineComments(comments, limit) {
+function limitInlineComments(comments, limit, severityOf) {
   if (!limit || comments.length <= limit) return { kept: [...comments], overflow: [] };
   const keep = new Set(
-    comments.map((c, i) => ({ i, r: rank(c) })).sort((a, b) => a.r - b.r || a.i - b.i).slice(0, limit).map(({ i }) => i)
+    comments.map((c, i) => ({ i, r: rank(c, severityOf?.(c)) })).sort((a, b) => a.r - b.r || a.i - b.i).slice(0, limit).map(({ i }) => i)
   );
   return {
     kept: comments.filter((_, i) => keep.has(i)),
     overflow: comments.filter((_, i) => !keep.has(i))
   };
 }
-function formatOverflowNote(overflow, limit) {
+var escapeHtml = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+var whereOf = (c) => c.line ? `${c.path}:${c.line}` : c.path;
+function closesItself(body2) {
+  const occurrences = (re) => body2.match(re)?.length ?? 0;
+  const fences = body2.split("\n").filter((l) => /^\s*(```|~~~)/.test(l)).length;
+  return fences % 2 === 0 && occurrences(/<details\b/gi) === occurrences(/<\/details\s*>/gi) && occurrences(/<!--/g) === occurrences(/-->/g);
+}
+function asText(body2) {
+  const longest = Math.max(0, ...(body2.match(/`+/g) ?? []).map((run4) => run4.length));
+  const fence = "`".repeat(Math.max(3, longest + 1));
+  return `${fence}text
+${body2}
+${fence}`;
+}
+function renderWhole(c, linkOf) {
+  const where4 = escapeHtml(whereOf(c));
+  const gist = gistOf(c.body);
+  const href = linkOf?.(c);
+  const body2 = c.body ?? "";
+  return [
+    `<details><summary><code>${where4}</code>${gist ? ` \u2014 ${gist}` : ""}</summary>`,
+    ...href ? [`<a href="${escapeHtml(href)}">${where4}</a>`] : [],
+    ...body2 ? [closesItself(body2) ? body2 : asText(body2)] : [],
+    "</details>"
+  ].join("\n\n");
+}
+function renderBrief(c) {
+  const gist = gistOf(c.body);
+  const markers = findingKeysIn(c.body ?? "").map(
+    (key) => renderCommentMarker({ kind: "finding", key, proven: false })
+  );
+  return `- \`${whereOf(c).replace(/`/g, "'")}\`${gist ? ` \u2014 ${gist}` : ""}${markers.map((m) => ` ${m}`).join("")}`;
+}
+function formatOverflowNote(overflow, limit, linkOf) {
   if (overflow.length === 0) return "";
-  const shown = overflow.slice(0, MAX_OVERFLOW_LINES).map((c) => {
-    const where4 = c.line ? `${c.path}:${c.line}` : c.path;
-    const gist = gistOf(c.body);
-    return `- \`${where4.replace(/`/g, "'")}\`${gist ? ` \u2014 ${gist}` : ""}`;
-  });
-  const rest = overflow.length - shown.length;
-  if (rest > 0) shown.push(`- \u2026and ${rest} more not shown`);
-  return `
+  const header = `
 
 ---
 
-**Note:** this review posts at most ${limit} inline comments (\`review_comment_limit\`), so ${overflow.length} more ${overflow.length === 1 ? "is" : "are"} listed here instead:
-` + shown.join("\n");
+**Note:** this review posts at most ${limit} inline comments (\`review_comment_limit\`), so ${overflow.length} more ${overflow.length === 1 ? "is" : "are"} listed here instead:`;
+  const SEP = 2;
+  let room = MAX_NOTE_CHARS - TRAILER_RESERVE - header.length;
+  const items = [];
+  for (const c of overflow) {
+    const brief2 = renderBrief(c);
+    if (brief2.length + SEP > room) break;
+    items.push(brief2);
+    room -= brief2.length + SEP;
+  }
+  let brief = items.length;
+  for (const [i, c] of overflow.slice(0, items.length).entries()) {
+    const whole = renderWhole(c, linkOf);
+    const extra = whole.length - items[i].length;
+    if (extra > room) continue;
+    items[i] = whole;
+    room -= extra;
+    brief--;
+  }
+  const omitted = overflow.length - items.length;
+  if (omitted > 0) items.push(`- \u2026and ${omitted} more not shown`);
+  const cut = [
+    brief > 0 ? `${brief} of them ${brief === 1 ? "is" : "are"} shown by place and first line only` : "",
+    omitted > 0 ? `${omitted} ${omitted === 1 ? "is" : "are"} not shown at all` : ""
+  ].filter(Boolean);
+  if (cut.length > 0) {
+    items.push(`${cut.join(" and ")}, to keep this review within GitHub's size limit.`);
+  }
+  return `${header}
+
+${items.join("\n\n")}`;
+}
+function foldedFindingsStillIntroduced(input2) {
+  const folded = new Set(
+    input2.reviews.flatMap(
+      (r) => r.body && isOwnReviewComment(r.user, r.body) ? findingKeysIn(r.body) : []
+    )
+  );
+  if (folded.size === 0) return [];
+  const dismissed = new Set(input2.dismissed.map((d) => d.finding_id));
+  return input2.delta.introduced.filter(
+    (f) => folded.has(findingKey(f)) && !dismissed.has(f.concern.id)
+  );
 }
 
 // src/mcp/reviewComments.ts
 import { writeFileSync as writeFileSync10 } from "node:fs";
-import { join as join46 } from "node:path";
+import { join as join47 } from "node:path";
 
 // src/utils/github/body.ts
 var import_turndown = __toESM(require_turndown_cjs(), 1);
@@ -291865,7 +292268,7 @@ function GetReviewCommentsTool(ctx) {
       const { threadBlocks, reviewer, formatted, truncated } = result;
       const tempDir = getTempDir();
       const filename = `review-${params.review_id}-threads.md`;
-      const commentsPath = join46(tempDir, filename);
+      const commentsPath = join47(tempDir, filename);
       writeFileSync10(commentsPath, formatted.content);
       log2.debug(`wrote ${threadBlocks.length} threads to ${commentsPath}`);
       const truncationNote = truncated ? ` WARNING: this PR has more review threads/comments than a single fetch returns, so the set above is INCOMPLETE \u2014 some threads or comments are not included. Address what's here, but do not treat the list as exhaustive.` : "";
@@ -292056,7 +292459,7 @@ function where2(f) {
 function renderReviewVerdict(input2) {
   const { delta, verdict: verdict2 } = input2;
   const introduced = delta.introduced.length;
-  const blocking = verdict2.gating + verdict2.required;
+  const { blocking } = verdict2;
   const renamedBlocking = delta.introduced.filter(
     (f) => f.possiblyPreexisting && failsGate(f, [...input2.requiredControls ?? []])
   ).length;
@@ -292161,8 +292564,8 @@ function renderReviewSummarySection(input2) {
 }
 
 // src/mcp/suggestionProver.ts
-import { mkdtempSync as mkdtempSync5, readFileSync as readFileSync30, rmSync as rmSync8, writeFileSync as writeFileSync11 } from "node:fs";
-import { join as join47, posix as posix14 } from "node:path";
+import { mkdtempSync as mkdtempSync5, readFileSync as readFileSync31, rmSync as rmSync8, writeFileSync as writeFileSync11 } from "node:fs";
+import { join as join48, posix as posix14 } from "node:path";
 var MAX_SINGLE_PROOFS = 4;
 async function proveSuggestions(input2, deps) {
   const out = /* @__PURE__ */ new Map();
@@ -292174,8 +292577,8 @@ async function proveSuggestions(input2, deps) {
     else ready.push(c);
   }
   if (ready.length === 0) return input2.candidates.map((c) => out.get(c.index));
-  const parent = mkdtempSync5(join47(input2.tmpdir, "suggestion-proof-"));
-  const worktree = join47(parent, "wt");
+  const parent = mkdtempSync5(join48(input2.tmpdir, "suggestion-proof-"));
+  const worktree = join48(parent, "wt");
   if (run("git", ["worktree", "add", "--detach", worktree, "HEAD"], input2.repoCwd).status !== 0) {
     rmSync8(parent, { recursive: true, force: true });
     for (const c of ready) {
@@ -292187,7 +292590,7 @@ async function proveSuggestions(input2, deps) {
     }
     return input2.candidates.map((c) => out.get(c.index));
   }
-  const scanCwd = prefix2 ? join47(worktree, prefix2) : worktree;
+  const scanCwd = prefix2 ? join48(worktree, prefix2) : worktree;
   const files = [...new Set(ready.map((c) => c.path.slice(prefix2.length)))];
   try {
     const before = await deps.scan(scanCwd, files);
@@ -292283,16 +292686,16 @@ function snapshot3(worktree, prefix2, cs) {
   const m = /* @__PURE__ */ new Map();
   for (const c of cs) {
     const rel = c.path.slice(prefix2.length);
-    if (!m.has(rel)) m.set(rel, readFileSync30(join47(worktree, c.path), "utf-8"));
+    if (!m.has(rel)) m.set(rel, readFileSync31(join48(worktree, c.path), "utf-8"));
   }
   return m;
 }
 function restore(worktree, prefix2, pristine) {
-  for (const [rel, text] of pristine) writeFileSync11(join47(worktree, prefix2, rel), text);
+  for (const [rel, text] of pristine) writeFileSync11(join48(worktree, prefix2, rel), text);
 }
 function apply(worktree, path15, cs) {
-  const file2 = join47(worktree, path15);
-  const text = readFileSync30(file2, "utf-8");
+  const file2 = join48(worktree, path15);
+  const text = readFileSync31(file2, "utf-8");
   const eol = text.includes("\r\n") ? "\r\n" : "\n";
   const lines = text.split(/\r?\n/);
   for (const c of [...cs].sort((a, b) => b.startLine - a.startLine)) {
@@ -292302,12 +292705,12 @@ function apply(worktree, path15, cs) {
 }
 
 // src/mcp/terraform/gateScan.ts
-import { existsSync as existsSync12, mkdtempSync as mkdtempSync6, rmSync as rmSync10 } from "node:fs";
-import { join as join49, posix as posix15 } from "node:path";
+import { existsSync as existsSync11, mkdtempSync as mkdtempSync6, rmSync as rmSync10 } from "node:fs";
+import { join as join50, posix as posix15 } from "node:path";
 
 // src/mcp/terraform/secretScan.ts
-import { readFileSync as readFileSync31, rmSync as rmSync9 } from "node:fs";
-import { join as join48 } from "node:path";
+import { readFileSync as readFileSync32, rmSync as rmSync9 } from "node:fs";
+import { join as join49 } from "node:path";
 function parseBetterleaksReport(json5, prefix2 = "") {
   const doc = JSON.parse(json5);
   if (Array.isArray(doc) || !doc || typeof doc !== "object" || !("findings" in doc)) {
@@ -292341,7 +292744,7 @@ async function scanAddedSecrets(cwd, mergeBase, tmp) {
   const top = run("git", ["rev-parse", "--show-toplevel"], cwd).stdout.trim();
   const prefix2 = run("git", ["rev-parse", "--show-prefix"], cwd).stdout.trim();
   if (!top) return { ran: false, reason: "not a git checkout", concerns: [] };
-  const report2 = join48(tmp, `betterleaks-${process.pid}.json`);
+  const report2 = join49(tmp, `betterleaks-${process.pid}.json`);
   try {
     const r = await runAsync(
       "betterleaks",
@@ -292364,7 +292767,7 @@ async function scanAddedSecrets(cwd, mergeBase, tmp) {
     const why = (r.stderr || r.stdout).trim().split("\n").pop() ?? "";
     let parsed2;
     try {
-      parsed2 = parseBetterleaksReport(readFileSync31(report2, "utf-8"), prefix2);
+      parsed2 = parseBetterleaksReport(readFileSync32(report2, "utf-8"), prefix2);
     } catch (error63) {
       const reason = r.status !== 0 ? `betterleaks exited ${r.status}: ${why}` : `${error63}`;
       return { ran: false, reason, concerns: [] };
@@ -292414,8 +292817,8 @@ function checkOutBase(cwd, pr, tmp) {
   }
   const mergeBase = run("git", ["merge-base", pr.baseSha, "HEAD"], cwd).stdout.trim() || pr.baseSha;
   const prefix2 = run("git", ["rev-parse", "--show-prefix"], cwd).stdout.trim();
-  const parent = mkdtempSync6(join49(tmp, "scan-delta-base-"));
-  const worktree = join49(parent, "wt");
+  const parent = mkdtempSync6(join50(tmp, "scan-delta-base-"));
+  const worktree = join50(parent, "wt");
   if (run("git", ["worktree", "add", "--detach", worktree, mergeBase], cwd).status !== 0) {
     rmSync10(parent, { recursive: true, force: true });
     log2.warning("\xBB scan delta: could not check out the base \u2014 every finding is treated as new.");
@@ -292423,7 +292826,7 @@ function checkOutBase(cwd, pr, tmp) {
   }
   return {
     mergeBase,
-    cwd: prefix2 ? join49(worktree, prefix2) : worktree,
+    cwd: prefix2 ? join50(worktree, prefix2) : worktree,
     close: () => {
       run("git", ["worktree", "remove", "--force", worktree], cwd);
       rmSync10(parent, { recursive: true, force: true });
@@ -292459,7 +292862,7 @@ async function reviewScans(ctx, pr, scanners) {
     const changed = diffScope(ctx, cwd, scanners);
     const scope2 = base ? reviewScope(ctx, cwd, base) : void 0;
     const started = Date.now();
-    const scanBase = async (b) => existsSync12(b.cwd) ? scanTree(ctx, b.cwd, changed, scanners, reviewedConcern, scope2) : [];
+    const scanBase = async (b) => existsSync11(b.cwd) ? scanTree(ctx, b.cwd, changed, scanners, reviewedConcern, scope2) : [];
     const [head, baseScan, secrets] = await Promise.allSettled([
       scanTree(ctx, cwd, changed, scanners, reviewedConcern, scope2),
       base ? scanBase(base) : Promise.resolve([]),
@@ -292891,6 +293294,22 @@ function CreatePullRequestReviewTool(ctx) {
             `cannot approve: ${outstanding} unresolved ${PRODUCT_NAME} review thread(s) still open on this PR. approval requires every prior ${PRODUCT_NAME} finding to be resolved, not just the latest commits to be clean. inspect them with \`${listRef}\`; for each thread the current code genuinely addresses, reply then call \`${resolveRef2}\`, and retry this approval. if any thread is a real outstanding issue, do NOT approve \u2014 submit a non-approving review (omit \`approved\`, or set \`request_changes\` for a blocking one) that covers it instead.`
           );
         }
+        if (delta) {
+          const reviews = await ctx.octokit.paginate(ctx.octokit.rest.pulls.listReviews, {
+            owner: ctx.repo.owner,
+            repo: ctx.repo.name,
+            pull_number,
+            per_page: 100
+          });
+          const folded = foldedFindingsStillIntroduced({ reviews, delta, dismissed });
+          if (folded.length > 0) {
+            throw new Error(
+              `cannot approve: ${folded.length} introduced finding(s) an earlier ${PRODUCT_NAME} review listed in its body (past \`review_comment_limit\`, so with no thread to resolve) are still introduced by this head: ` + folded.slice(0, 20).map(
+                (f) => `${f.concern.id} (${f.concern.rule_id} at ${f.concern.location.file}:${f.concern.location.line ?? "?"})`
+              ).join(", ") + `. approval requires every prior ${PRODUCT_NAME} finding to be addressed. if one genuinely needs no change, list it in \`dismissed\` with the reason and retry; otherwise do NOT approve \u2014 submit a non-approving review that covers it.`
+            );
+          }
+        }
       }
       const skip = reviewSkipDecision({
         approved: approved ?? false,
@@ -292997,6 +293416,7 @@ ${formatReanchoredNote(reanchored.moved)}`
         params.event = event;
       }
       const proofs = delta ? await proveReviewSuggestions(ctx, auditedComments) : /* @__PURE__ */ new Map();
+      const findingSeverity = /* @__PURE__ */ new Map();
       const reviewComments = auditedComments.map((comment, index) => {
         let commentBody = fixDoubleEscapedString(comment.body || "");
         if (comment.suggestion !== void 0) {
@@ -293038,6 +293458,9 @@ ${marker2}`;
           reviewComment.start_line = comment.start_line;
           reviewComment.start_side = side;
         }
+        if (comment.provenance?.kind === "scanner") {
+          findingSeverity.set(reviewComment, comment.provenance.finding.concern.severity);
+        }
         return reviewComment;
       });
       let droppedComments = [];
@@ -293073,7 +293496,11 @@ ${marker2}`;
             `withholding ${duplicateComments.length}/${reviewComments.length} inline comment(s) that duplicate open review threads`
           );
         }
-        const limited = limitInlineComments(deduped.kept, ctx.payload.reviewCommentLimit);
+        const limited = limitInlineComments(
+          deduped.kept,
+          ctx.payload.reviewCommentLimit,
+          (c) => findingSeverity.get(c)
+        );
         overflowComments = limited.overflow;
         if (overflowComments.length > 0) {
           log2.info(
@@ -293105,7 +293532,13 @@ ${marker2}`;
         body2 = body2 ? body2 + note : note.replace(/^\n\n/, "");
       }
       if (overflowComments.length > 0) {
-        const note = formatOverflowNote(overflowComments, ctx.payload.reviewCommentLimit);
+        const server = process.env.GITHUB_SERVER_URL || "https://github.com";
+        const commit = params.commit_id;
+        const note = formatOverflowNote(
+          overflowComments,
+          ctx.payload.reviewCommentLimit,
+          commit ? (c) => `${server}/${ctx.repo.owner}/${ctx.repo.name}/blob/${commit}/${c.path.split("/").map(encodeURIComponent).join("/")}${c.line && c.side !== "LEFT" ? `#L${c.line}` : ""}` : void 0
+        );
         body2 = body2 ? body2 + note : note.replace(/^\n\n/, "");
       }
       let reproved = 0;
@@ -293358,7 +293791,7 @@ ${coverageState.lastBreakdown}`
 }
 function readReviewedFile(path15) {
   try {
-    return readFileSync32(resolveWithinCwd(resolveRepoRoot(), path15), "utf-8");
+    return readFileSync33(resolveWithinCwd(resolveRepoRoot(), path15), "utf-8");
   } catch {
     return null;
   }
@@ -293673,7 +294106,7 @@ function fastForwardDiff(params, exec2) {
 
 // src/utils/prompt/changeImpact.ts
 import { writeFileSync as writeFileSync12 } from "node:fs";
-import { join as join50 } from "node:path";
+import { join as join51 } from "node:path";
 var MAX_ATOMS = 20;
 var MAX_REFS_PER_ATOM = 6;
 var MAX_EXCERPT = 160;
@@ -293853,7 +294286,7 @@ function createChangeImpactArtifact(params) {
     fileCount: params.files.length,
     lookupError
   });
-  const path15 = join50(
+  const path15 = join51(
     params.tmpdir,
     `pr-${params.pullNumber}-${params.headSha.slice(0, 7)}-impact.md`
   );
@@ -293873,7 +294306,7 @@ function createChangeImpactArtifact(params) {
 import { execFileSync, execSync as execSync2 } from "node:child_process";
 import { mkdtempSync as mkdtempSync7, readdirSync as readdirSync9, realpathSync as realpathSync5, unlinkSync as unlinkSync2 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
-import { join as join51 } from "node:path";
+import { join as join52 } from "node:path";
 
 // src/utils/github/ghaCore.ts
 import { randomUUID as randomUUID6 } from "node:crypto";
@@ -293896,7 +294329,7 @@ var TEMP_DIR_STATE_KEY = "infraweaver_temp_dir";
 
 // src/utils/setup/setup.ts
 function createTempDirectory() {
-  const sharedTempDir = mkdtempSync7(join51(tmpdir4(), `${PRODUCT_SLUG}-`));
+  const sharedTempDir = mkdtempSync7(join52(tmpdir4(), `${PRODUCT_SLUG}-`));
   process.env.INFRAWEAVER_TEMP_DIR = sharedTempDir;
   saveState2(TEMP_DIR_STATE_KEY, sharedTempDir);
   log2.info(`\xBB created temp dir at ${sharedTempDir}`);
@@ -293942,13 +294375,13 @@ function wipeRunnerLeakSurface() {
       return [];
     }
   };
-  const fileCommandsDir = join51(runnerTemp, "_runner_file_commands");
+  const fileCommandsDir = join52(runnerTemp, "_runner_file_commands");
   for (const entry4 of listDir(fileCommandsDir)) {
-    tryUnlink(join51(fileCommandsDir, entry4));
+    tryUnlink(join52(fileCommandsDir, entry4));
   }
   for (const entry4 of listDir(runnerTemp)) {
     if (entry4.endsWith(".sh") || /^git-credentials-.*\.config$/.test(entry4)) {
-      tryUnlink(join51(runnerTemp, entry4));
+      tryUnlink(join52(runnerTemp, entry4));
     }
   }
   if (wiped.length > 0) {
@@ -294117,7 +294550,7 @@ function formatFilesWithLineNumbers(files) {
   }
   const tocLines = [`## Files (${files.length})`];
   for (const entry4 of tocEntries) {
-    const anchor2 = createHash13("sha256").update(entry4.filename).digest("hex");
+    const anchor2 = createHash14("sha256").update(entry4.filename).digest("hex");
     tocLines.push(
       `- ${entry4.filename} \u2192 lines ${entry4.startLine}-${entry4.endLine} \xB7 diff-${anchor2}`
     );
@@ -294447,7 +294880,7 @@ function CheckoutPrTool(ctx) {
         headSha: ctx.toolState.checkoutSha
       });
       if (incremental) {
-        incrementalDiffPath = join52(
+        incrementalDiffPath = join53(
           tempDir,
           `pr-${pull_number}-${beforeShort}-${headShort}-incremental.diff`
         );
@@ -294461,7 +294894,7 @@ function CheckoutPrTool(ctx) {
     const diffPreview = formatResult.content.split("\n").slice(0, 100).join("\n");
     log2.debug(`formatted diff preview (first 100 lines):
 ${diffPreview}`);
-    const diffPath = join52(tempDir, `pr-${pull_number}-${headShort}.diff`);
+    const diffPath = join53(tempDir, `pr-${pull_number}-${headShort}.diff`);
     writeFileSync13(diffPath, formatResult.content);
     log2.debug(`wrote diff to ${diffPath} (${formatResult.content.length} bytes)`);
     ctx.toolState.diffCoverage = createDiffCoverageState({
@@ -294602,7 +295035,7 @@ ${dirty}`
 
 // src/mcp/checkSuite.ts
 import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync14 } from "node:fs";
-import { join as join53 } from "node:path";
+import { join as join54 } from "node:path";
 import { stripVTControlCharacters } from "node:util";
 var GetCheckSuiteLogs = type({
   check_suite_id: type.number.describe("the id from check_suite.id")
@@ -294697,7 +295130,7 @@ function GetCheckSuiteLogsTool(ctx) {
         };
       }
       const tempDir = getTempDir();
-      const logsDir = join53(tempDir, "ci-logs");
+      const logsDir = join54(tempDir, "ci-logs");
       mkdirSync6(logsDir, { recursive: true });
       const jobLists = await mapWithConcurrency(
         failedRuns,
@@ -294721,7 +295154,7 @@ function GetCheckSuiteLogsTool(ctx) {
             request: { signal: AbortSignal.timeout(1e4) }
           });
           const logsText = typeof data === "string" ? data : Buffer.from(data).toString("utf8");
-          const logPath = join53(logsDir, `job-${job.id}.log`);
+          const logPath = join54(logsDir, `job-${job.id}.log`);
           writeFileSync14(logPath, logsText);
           const analysis = analyzeLog(logsText, 80);
           const failedSteps = job.steps?.filter((s) => s.conclusion === "failure").map((s) => `Step ${s.number}: ${s.name}`) ?? [];
@@ -294783,7 +295216,7 @@ function GetCheckSuiteLogsTool(ctx) {
 
 // src/mcp/commitInfo.ts
 import { writeFileSync as writeFileSync15 } from "node:fs";
-import { join as join54 } from "node:path";
+import { join as join55 } from "node:path";
 var CommitInfo = type({
   sha: type.string.describe("the commit SHA (full or abbreviated) to fetch")
 });
@@ -294802,7 +295235,7 @@ function CommitInfoTool(ctx) {
       const files = data.files ?? [];
       const formatResult = formatFilesWithLineNumbers(files);
       const tempDir = getTempDir("get_commit_info");
-      const diffFile = join54(tempDir, `commit-${sha2.slice(0, 7)}.diff`);
+      const diffFile = join55(tempDir, `commit-${sha2.slice(0, 7)}.diff`);
       writeFileSync15(diffFile, formatResult.content);
       log2.debug(`wrote commit diff to ${diffFile} (${formatResult.content.length} bytes)`);
       return {
@@ -294963,8 +295396,8 @@ function UpsertRemediationDashboardTool(ctx) {
 import { performance as performance3 } from "node:perf_hooks";
 
 // src/prep/installNodeDependencies.ts
-import { existsSync as existsSync13 } from "node:fs";
-import { join as join55 } from "node:path";
+import { existsSync as existsSync12 } from "node:fs";
+import { join as join56 } from "node:path";
 
 // node_modules/.pnpm/package-manager-detector@1.8.0/node_modules/package-manager-detector/dist/commands.mjs
 function splitRunArgs(args2, valueFlags = []) {
@@ -295350,7 +295783,7 @@ async function installFallback(name, installSpec) {
     return result.stderr || `failed to install ${name}`;
   }
   if (name === "deno") {
-    const denoPath = join55(process.env.HOME || "", ".deno", "bin");
+    const denoPath = join56(process.env.HOME || "", ".deno", "bin");
     process.env.PATH = `${denoPath}:${process.env.PATH}`;
   }
   log2.info(`\xBB installed ${name}`);
@@ -295359,8 +295792,8 @@ async function installFallback(name, installSpec) {
 var installNodeDependencies = {
   name: "installNodeDependencies",
   shouldRun: () => {
-    const packageJsonPath = join55(process.cwd(), "package.json");
-    return existsSync13(packageJsonPath);
+    const packageJsonPath = join56(process.cwd(), "package.json");
+    return existsSync12(packageJsonPath);
   },
   run: async (options) => {
     const declared2 = await resolvePackageManagerSpec(process.cwd());
@@ -295468,8 +295901,8 @@ ${errorMessage2}`]
 };
 
 // src/prep/installPythonDependencies.ts
-import { existsSync as existsSync14, readFileSync as readFileSync33 } from "node:fs";
-import { join as join56 } from "node:path";
+import { existsSync as existsSync13, readFileSync as readFileSync34 } from "node:fs";
+import { join as join57 } from "node:path";
 var PYTHON_CONFIGS = [
   {
     file: "requirements.txt",
@@ -295504,7 +295937,7 @@ var PYTHON_CONFIGS = [
 ];
 function pyprojectDeclaresBuildSystem(cwd) {
   try {
-    const content = readFileSync33(join56(cwd, "pyproject.toml"), "utf8");
+    const content = readFileSync34(join57(cwd, "pyproject.toml"), "utf8");
     return /^\s*\[build-system\]/m.test(content);
   } catch {
     return false;
@@ -295554,13 +295987,13 @@ var installPythonDependencies = {
     }
     const cwd = process.cwd();
     return PYTHON_CONFIGS.some(
-      (config3) => existsSync14(join56(cwd, config3.file)) && configApplies(config3, cwd)
+      (config3) => existsSync13(join57(cwd, config3.file)) && configApplies(config3, cwd)
     );
   },
   run: async (options) => {
     const cwd = process.cwd();
     const config3 = PYTHON_CONFIGS.find(
-      (c) => existsSync14(join56(cwd, c.file)) && configApplies(c, cwd)
+      (c) => existsSync13(join57(cwd, c.file)) && configApplies(c, cwd)
     );
     if (!config3) {
       return {
@@ -296141,8 +296574,8 @@ function SetOutputTool(ctx, outputSchema) {
 
 // src/mcp/policy.ts
 import { spawnSync as spawnSync8 } from "node:child_process";
-import { existsSync as existsSync15, readFileSync as readFileSync34 } from "node:fs";
-import { join as join57 } from "node:path";
+import { existsSync as existsSync14, readFileSync as readFileSync35 } from "node:fs";
+import { join as join58 } from "node:path";
 function parseConftestOutput(stdout) {
   let parsed2;
   try {
@@ -296176,7 +296609,7 @@ var CONFTEST_CONFIG = "conftest.toml";
 function conftestSelectsNamespaces(conftestCwd) {
   let raw2;
   try {
-    raw2 = readFileSync34(join57(conftestCwd, CONFTEST_CONFIG), "utf-8");
+    raw2 = readFileSync35(join58(conftestCwd, CONFTEST_CONFIG), "utf-8");
   } catch {
     return false;
   }
@@ -296192,8 +296625,8 @@ function namespaceArgs(conftestCwd) {
 }
 function findPlanJson(cwd) {
   for (const candidate of PLAN_JSON_NAMES) {
-    const abs = join57(cwd, candidate);
-    if (existsSync15(abs)) return abs;
+    const abs = join58(cwd, candidate);
+    if (existsSync14(abs)) return abs;
   }
   return null;
 }
@@ -296234,11 +296667,11 @@ function resolvePolicyDir(cwd, explicit) {
     } catch {
       return null;
     }
-    return existsSync15(abs) ? abs : null;
+    return existsSync14(abs) ? abs : null;
   }
   for (const d of DEFAULT_POLICY_DIRS) {
-    const abs = join57(cwd, d);
-    if (existsSync15(abs)) return abs;
+    const abs = join58(cwd, d);
+    if (existsSync14(abs)) return abs;
   }
   return null;
 }
@@ -296272,7 +296705,7 @@ function PolicyCheckTool(ctx) {
         } catch {
           abs = null;
         }
-        targetFile = abs && existsSync15(abs) ? abs : null;
+        targetFile = abs && existsSync14(abs) ? abs : null;
         if (!targetFile) {
           return toolSkip(
             "target_not_found",
@@ -296545,9 +296978,9 @@ function PullRequestInfoTool(ctx) {
 
 // node_modules/.pnpm/@infraweaver-io+sandbox@0.1.8/node_modules/@infraweaver-io/sandbox/dist/writePolicy.js
 import { renameSync, writeFileSync as writeFileSync16 } from "node:fs";
-import { join as join58 } from "node:path";
+import { join as join59 } from "node:path";
 function writePolicyPath(tmpdir6, filename) {
-  return join58(tmpdir6, filename);
+  return join59(tmpdir6, filename);
 }
 function publishWritePolicy(params) {
   try {
@@ -299863,15 +300296,15 @@ async function startMcpHttpServer(ctx, options) {
 
 // src/mcp/terraform/policyGate.ts
 import {
-  existsSync as existsSync16,
+  existsSync as existsSync15,
   mkdirSync as mkdirSync7,
   mkdtempSync as mkdtempSync8,
   readdirSync as readdirSync10,
-  readFileSync as readFileSync36,
+  readFileSync as readFileSync37,
   writeFileSync as writeFileSync17
 } from "node:fs";
 import { tmpdir as osTmpdir } from "node:os";
-import { dirname as dirname8, isAbsolute as isAbsolute8, join as join60, relative as relative8, resolve as resolve11 } from "node:path";
+import { dirname as dirname8, isAbsolute as isAbsolute8, join as join61, relative as relative8, resolve as resolve11 } from "node:path";
 function coercePolicyRules(raw2) {
   const rules = [];
   const rejected = [];
@@ -300123,7 +300556,7 @@ function evaluateRulesStatically(cwd, rules, scope2 = { kind: "all", reason: ""
   const files = [];
   for (const rel of walk.files) {
     try {
-      files.push({ rel, text: readFileSync36(join60(cwd, rel), "utf-8") });
+      files.push({ rel, text: readFileSync37(join61(cwd, rel), "utf-8") });
     } catch {
     }
   }
@@ -300238,16 +300671,16 @@ function cloudEmittedRego(rules) {
 }
 function readOrEmpty(path15) {
   try {
-    return readFileSync36(path15, "utf-8");
+    return readFileSync37(path15, "utf-8");
   } catch {
     return "";
   }
 }
 function regoDirIn(root, skip) {
   for (const dir of DEFAULT_POLICY_DIRS) {
-    const abs = join60(root, dir);
-    if (existsSync16(abs) && walkFilesBySuffix(abs, ".rego").some(
-      (rel) => !skip(join60(dir, rel), readOrEmpty(join60(abs, rel)))
+    const abs = join61(root, dir);
+    if (existsSync15(abs) && walkFilesBySuffix(abs, ".rego").some(
+      (rel) => !skip(join61(dir, rel), readOrEmpty(join61(abs, rel)))
     )) {
       return dir;
     }
@@ -300255,14 +300688,14 @@ function regoDirIn(root, skip) {
   return null;
 }
 function withoutSkipped(root, dir, skip, tmpdir6) {
-  const abs = join60(root, dir);
-  const files = readdirSync10(abs, { recursive: true, withFileTypes: true }).filter((e) => e.isFile()).map((e) => relative8(abs, join60(e.parentPath, e.name)));
-  const kept = files.filter((rel) => !skip(join60(dir, rel), readOrEmpty(join60(abs, rel))));
+  const abs = join61(root, dir);
+  const files = readdirSync10(abs, { recursive: true, withFileTypes: true }).filter((e) => e.isFile()).map((e) => relative8(abs, join61(e.parentPath, e.name)));
+  const kept = files.filter((rel) => !skip(join61(dir, rel), readOrEmpty(join61(abs, rel))));
   if (kept.length === files.length) return abs;
-  const copy = join60(mkdtempSync8(join60(tmpdir6 ?? osTmpdir(), "policy-own-")), dir);
+  const copy = join61(mkdtempSync8(join61(tmpdir6 ?? osTmpdir(), "policy-own-")), dir);
   for (const rel of kept) {
-    mkdirSync7(dirname8(join60(copy, rel)), { recursive: true });
-    writeFileSync17(join60(copy, rel), readFileSync36(join60(abs, rel)));
+    mkdirSync7(dirname8(join61(copy, rel)), { recursive: true });
+    writeFileSync17(join61(copy, rel), readFileSync37(join61(abs, rel)));
   }
   return copy;
 }
@@ -300284,18 +300717,18 @@ function resolveRepoPolicy(cwd, baseRef, tmpdir6, notes, skip) {
     }
     const own2 = tree.files.filter((f) => !skip(f.path, f.raw));
     if (!own2.some((f) => f.path.endsWith(".rego"))) continue;
-    const root = mkdtempSync8(join60(tmpdir6 ?? osTmpdir(), "policy-base-"));
+    const root = mkdtempSync8(join61(tmpdir6 ?? osTmpdir(), "policy-base-"));
     for (const f of own2) {
-      mkdirSync7(dirname8(join60(root, f.path)), { recursive: true });
-      writeFileSync17(join60(root, f.path), f.raw);
+      mkdirSync7(dirname8(join61(root, f.path)), { recursive: true });
+      writeFileSync17(join61(root, f.path), f.raw);
     }
     const toml = readFileAtBaseRef(cwd, baseRef, CONFTEST_CONFIG);
-    if (toml.kind === "file") writeFileSync17(join60(root, CONFTEST_CONFIG), toml.raw);
-    const same = head === dir && readdirSync10(join60(cwd, dir), { recursive: true, withFileTypes: true }).filter(
+    if (toml.kind === "file") writeFileSync17(join61(root, CONFTEST_CONFIG), toml.raw);
+    const same = head === dir && readdirSync10(join61(cwd, dir), { recursive: true, withFileTypes: true }).filter(
       (e) => e.isFile()
     ).length === tree.files.length && tree.files.every((f) => {
       try {
-        return readFileSync36(join60(cwd, f.path), "utf-8") === f.raw;
+        return readFileSync37(join61(cwd, f.path), "utf-8") === f.raw;
       } catch {
         return false;
       }
@@ -300305,7 +300738,7 @@ function resolveRepoPolicy(cwd, baseRef, tmpdir6, notes, skip) {
         `the Rego policy differs from the base ref (${tree.ref}) \u2014 applying the BASE ${dir}/ so this change cannot relax the policy reviewing it. It takes effect once merged.`
       );
     }
-    return { policyDir: join60(root, dir), conftestCwd: root };
+    return { policyDir: join61(root, dir), conftestCwd: root };
   }
   if (head) {
     notes.push(
@@ -300315,7 +300748,7 @@ function resolveRepoPolicy(cwd, baseRef, tmpdir6, notes, skip) {
   return null;
 }
 function findWorkflowPlanJson(cwd, notes) {
-  const present = PLAN_JSON_NAMES.filter((name) => existsSync16(join60(cwd, name)));
+  const present = PLAN_JSON_NAMES.filter((name) => existsSync15(join61(cwd, name)));
   if (present.length === 0) return null;
   const listing = run("git", ["ls-files", "-z"], cwd);
   if (listing.status !== 0) {
@@ -300332,7 +300765,7 @@ function findWorkflowPlanJson(cwd, notes) {
       );
       continue;
     }
-    return join60(cwd, name);
+    return join61(cwd, name);
   }
   return null;
 }
@@ -300362,7 +300795,7 @@ function evaluatePolicyGate(cwd, rawRules, opts = {}) {
   let plan;
   if (planPath) {
     try {
-      plan = asPlan(JSON.parse(readFileSync36(planPath, "utf-8")));
+      plan = asPlan(JSON.parse(readFileSync37(planPath, "utf-8")));
     } catch {
     }
     if (!plan) notes.push(`${planPath} is not a Terraform plan JSON \u2014 ignored`);
@@ -300465,7 +300898,7 @@ function capturePolicyGate(ctx) {
     if (!result) return;
     const workspace = process.env.GITHUB_WORKSPACE ?? cwd;
     for (const o of [...result.violations, ...result.inconclusive]) {
-      if (o.file) o.file = posix16(relative8(workspace, join60(cwd, o.file)));
+      if (o.file) o.file = posix16(relative8(workspace, join61(cwd, o.file)));
     }
     session.policyGate = result;
     for (const n of result.notes) log2.warning(`\xBB policy gate: ${n}`);
@@ -300800,7 +301233,7 @@ var ThinkingTimer = class {
 // src/agents/claude.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
 import { chmodSync as chmodSync3, mkdirSync as mkdirSync10, writeFileSync as writeFileSync22 } from "node:fs";
-import { join as join69 } from "node:path";
+import { join as join70 } from "node:path";
 import { performance as performance6 } from "node:perf_hooks";
 import { setTimeout as sleep6 } from "node:timers/promises";
 
@@ -301160,7 +301593,7 @@ import { readFile as readFile2 } from "node:fs/promises";
 
 // src/agents/shared.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { join as join61 } from "node:path";
+import { join as join62 } from "node:path";
 var MAX_STDERR_LINES = 20;
 var MAX_POST_RUN_RETRIES = 3;
 function getGitStatus() {
@@ -301197,7 +301630,7 @@ var agent = (input2) => {
   };
 };
 function agentHomeEnv(tmpdir6) {
-  return { HOME: tmpdir6, XDG_CONFIG_HOME: join61(tmpdir6, ".config") };
+  return { HOME: tmpdir6, XDG_CONFIG_HOME: join62(tmpdir6, ".config") };
 }
 function baseAgentEnv(homeEnv, repoDir) {
   return { ...process.env, ...homeEnv, PWD: repoDir };
@@ -301674,9 +302107,9 @@ function shouldRunGraceTurn(params) {
 }
 
 // src/agents/quotaTokens.ts
-var CACHE_READ_WEIGHT = 0.1;
-function quotaTokens(t) {
-  return t.input + t.output + t.cacheWrite + t.cacheRead * CACHE_READ_WEIGHT;
+var CACHE_READ_WEIGHT2 = 0.1;
+function quotaTokens2(t) {
+  return t.input + t.output + (t.reasoning ?? 0) + t.cacheWrite + t.cacheRead * CACHE_READ_WEIGHT2;
 }
 
 // src/agents/toolPlaneWatch.ts
@@ -301905,7 +302338,7 @@ function matchesRouteSentinel(envVar, model) {
 import { randomUUID as randomUUID9 } from "node:crypto";
 import { mkdirSync as mkdirSync8, rmSync as rmSync11, writeFileSync as writeFileSync18 } from "node:fs";
 import { homedir } from "node:os";
-import { join as join62 } from "node:path";
+import { join as join63 } from "node:path";
 var VERTEX_SERVICE_ACCOUNT_JSON_ENV = "VERTEX_SERVICE_ACCOUNT_JSON";
 var GOOGLE_APPLICATION_CREDENTIALS_ENV = "GOOGLE_APPLICATION_CREDENTIALS";
 var GOOGLE_CLOUD_PROJECT_ENV = "GOOGLE_CLOUD_PROJECT";
@@ -301929,7 +302362,7 @@ function readProjectIdFromVertexServiceAccountJson() {
 }
 function createSecretDir() {
   const base = process.env.INFRAWEAVER_SECRET_HOME || process.env.HOME || homedir();
-  const secretDir = join62(base, `.${PRODUCT_SLUG}`, "secrets", randomUUID9());
+  const secretDir = join63(base, `.${PRODUCT_SLUG}`, "secrets", randomUUID9());
   mkdirSync8(secretDir, { recursive: true, mode: 448 });
   return secretDir;
 }
@@ -301938,7 +302371,7 @@ function materializeVertexCredentials(params) {
   const blob = process.env[VERTEX_SERVICE_ACCOUNT_JSON_ENV];
   if (!blob) return void 0;
   const secretDir = createSecretDir();
-  const credentialsPath = join62(secretDir, "vertex-sa.json");
+  const credentialsPath = join63(secretDir, "vertex-sa.json");
   writeFileSync18(credentialsPath, blob, { mode: 384 });
   process.env[GOOGLE_APPLICATION_CREDENTIALS_ENV] = credentialsPath;
   const projectId = readProjectIdFromVertexServiceAccountJson();
@@ -302074,29 +302507,29 @@ function createProcessOutputActivityTimeout(ctx) {
 }
 
 // src/utils/prompt/skills.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync9, readFileSync as readFileSync37, writeFileSync as writeFileSync19 } from "node:fs";
-import { dirname as dirname9, join as join63 } from "node:path";
+import { existsSync as existsSync16, mkdirSync as mkdirSync9, readFileSync as readFileSync38, writeFileSync as writeFileSync19 } from "node:fs";
+import { dirname as dirname9, join as join64 } from "node:path";
 import { fileURLToPath } from "node:url";
 var BUNDLED_SKILL_NAMES = ["terraform-best-practices"];
 function resolveSkillPath(name) {
   const here = dirname9(fileURLToPath(import.meta.url));
   const candidates = [
-    join63(here, "..", "..", "skills", name, "SKILL.md"),
-    join63(here, "skills", name, "SKILL.md")
+    join64(here, "..", "..", "skills", name, "SKILL.md"),
+    join64(here, "skills", name, "SKILL.md")
   ];
   for (const candidate of candidates) {
-    if (existsSync17(candidate)) return candidate;
+    if (existsSync16(candidate)) return candidate;
   }
   throw new Error(`bundled skill not found: ${name} (looked in ${candidates.join(", ")})`);
 }
 var SKILL_TARGET_DIRS = [".opencode/skills", ".claude/skills", ".agents/skills"];
 function installBundledSkills(params) {
   for (const name of BUNDLED_SKILL_NAMES) {
-    const content = readFileSync37(resolveSkillPath(name), "utf8");
+    const content = readFileSync38(resolveSkillPath(name), "utf8");
     for (const targetDir of SKILL_TARGET_DIRS) {
-      const skillDir = join63(params.home, targetDir, name);
+      const skillDir = join64(params.home, targetDir, name);
       mkdirSync9(skillDir, { recursive: true });
-      writeFileSync19(join63(skillDir, "SKILL.md"), content);
+      writeFileSync19(join64(skillDir, "SKILL.md"), content);
     }
   }
   log2.success(`installed bundled skills: ${BUNDLED_SKILL_NAMES.join(", ")}`);
@@ -302104,9 +302537,9 @@ function installBundledSkills(params) {
 
 // src/utils/setup/install.ts
 import { spawnSync as spawnSync9 } from "node:child_process";
-import { createHash as createHash15 } from "node:crypto";
-import { chmodSync as chmodSync2, createWriteStream as createWriteStream2, existsSync as existsSync20, readFileSync as readFileSync38 } from "node:fs";
-import { join as join68 } from "node:path";
+import { createHash as createHash16 } from "node:crypto";
+import { chmodSync as chmodSync2, createWriteStream as createWriteStream2, existsSync as existsSync19, readFileSync as readFileSync39 } from "node:fs";
+import { join as join69 } from "node:path";
 import { pipeline as pipeline2 } from "node:stream/promises";
 
 // src/utils/setup/tarballCache.ts
@@ -302161,7 +302594,7 @@ function verifyTarballIntegrity(tarballPath, dist, descriptor) {
       `Refusing to install ${descriptor}: the registry published no integrity digest (neither dist.integrity nor dist.shasum), so the download cannot be verified.`
     );
   }
-  const bytes = readFileSync38(tarballPath);
+  const bytes = readFileSync39(tarballPath);
   if (integrity2) {
     const candidates = integrity2.trim().split(/\s+/).filter(Boolean);
     for (const candidate of candidates) {
@@ -302171,7 +302604,7 @@ function verifyTarballIntegrity(tarballPath, dist, descriptor) {
       const expected = candidate.slice(separator2 + 1);
       let actual;
       try {
-        actual = createHash15(algorithm).update(bytes).digest("base64");
+        actual = createHash16(algorithm).update(bytes).digest("base64");
       } catch {
         continue;
       }
@@ -302181,7 +302614,7 @@ function verifyTarballIntegrity(tarballPath, dist, descriptor) {
       `Integrity check FAILED for ${descriptor}: the downloaded tarball does not match the registry's published digest (${integrity2}). Refusing to execute it.`
     );
   }
-  const actualShasum = createHash15("sha1").update(bytes).digest("hex");
+  const actualShasum = createHash16("sha1").update(bytes).digest("hex");
   if (actualShasum !== shasum) {
     throw new Error(
       `Integrity check FAILED for ${descriptor}: the downloaded tarball does not match the registry's published shasum (expected ${shasum}, got ${actualShasum}). Refusing to execute it.`
@@ -302190,9 +302623,9 @@ function verifyTarballIntegrity(tarballPath, dist, descriptor) {
 }
 async function installFromNpmTarball(params) {
   const tempDir = getTempDir();
-  const extractedDir = join68(tempDir, "package");
-  const cliPath = join68(extractedDir, params.executablePath);
-  if (existsSync20(cliPath)) {
+  const extractedDir = join69(tempDir, "package");
+  const cliPath = join69(extractedDir, params.executablePath);
+  if (existsSync19(cliPath)) {
     log2.debug(`\xBB using cached binary at ${cliPath}`);
     return cliPath;
   }
@@ -302243,7 +302676,7 @@ async function installFromNpmTarball(params) {
     dist = (await manifestResponse.json()).dist;
   }
   log2.debug(`\xBB installing ${params.packageName}@${resolvedVersion}...`);
-  const tarballPath = join68(tempDir, "package.tgz");
+  const tarballPath = join69(tempDir, "package.tgz");
   const tarballFileName = params.packageName.startsWith("@") ? params.packageName.split("/")[1] : params.packageName;
   const tarballUrl = `${npmRegistry}/${encodedName}/-/${tarballFileName}-${resolvedVersion}.tgz`;
   const restored = await restoreTarball({
@@ -302283,7 +302716,7 @@ async function installFromNpmTarball(params) {
       `Failed to extract tarball: ${extractResult.stderr || extractResult.stdout || "Unknown error"}`
     );
   }
-  if (!existsSync20(cliPath)) {
+  if (!existsSync19(cliPath)) {
     throw new Error(`Executable not found in extracted package at ${cliPath}`);
   }
   if (params.installDependencies) {
@@ -302394,9 +302827,9 @@ var CLAUDE_DISALLOWED_TOOLS = CLAUDE_EXEC_TOOL_DENY_RULES.join(",");
 var INFRAWEAVER_MCP_AUTH_HEADER = `Bearer \${${MCP_SERVER_TOKEN_ENV}}`;
 var CLAUDE_MAX_CONCURRENT_SUBAGENTS_DEFAULT = "4";
 function writeMcpConfig(ctx) {
-  const configDir = join69(ctx.tmpdir, ".claude");
+  const configDir = join70(ctx.tmpdir, ".claude");
   mkdirSync10(configDir, { recursive: true });
-  const configPath = join69(configDir, "mcp.json");
+  const configPath = join70(configDir, "mcp.json");
   const terraformMcp = resolveTerraformMcp(ctx.payload);
   if (terraformMcp.kind === "docker_missing") log2.info(`\xBB ${terraformMcp.note}`);
   const opentofuMcp = resolveOpenTofuMcp(ctx.payload);
@@ -302428,13 +302861,13 @@ function writeMcpConfig(ctx) {
   return configPath;
 }
 function writePretoolGateAssets(ctx, stopHookPath) {
-  const scriptPath = join69(ctx.tmpdir, CLAUDE_PRETOOL_GATE_FILENAME);
+  const scriptPath = join70(ctx.tmpdir, CLAUDE_PRETOOL_GATE_FILENAME);
   writeFileSync22(
     scriptPath,
     buildClaudePretoolGateSource(ctx.subagentDeniedTools, writePolicyPath2(ctx.tmpdir))
   );
   chmodSync3(scriptPath, 493);
-  const settingsPath = join69(ctx.tmpdir, "infraweaver-claude-settings.json");
+  const settingsPath = join70(ctx.tmpdir, "infraweaver-claude-settings.json");
   const settings = buildClaudePretoolGateSettings(scriptPath, CLAUDE_EXEC_TOOL_DENY_RULES);
   settings.permissions.deny.push(...harnessTmpdirWriteDenyClaude(ctx.tmpdir));
   if (stopHookPath) {
@@ -302523,7 +302956,7 @@ function timerFor(state5, label) {
 function chargeTokenQuota(state5) {
   const quota = state5.params.tokenQuota;
   if (!quota || state5.stopRun.signal.aborted) return;
-  if (!quota.observe(state5.quotaSource, quotaTokens(state5.accumulatedTokens))) return;
+  if (!quota.observe(state5.quotaSource, quotaTokens2(state5.accumulatedTokens))) return;
   log2.info(`\xBB ${state5.params.label}: ${quota.gap()}`);
   state5.stopRun.abort(new TokenQuotaExceededError(quota.gap()));
 }
@@ -303059,11 +303492,11 @@ var claude = agent({
       const onVertex = matchesRouteSentinel(VERTEX_MODEL_ID_ENV, specifier) && specifier !== void 0 && isVertexAnthropicId(specifier);
       const model = !specifier ? void 0 : onBedrock ? specifier : onVertex ? void 0 : stripProviderPrefix(specifier);
       const homeEnv = agentHomeEnv(ctx.tmpdir);
-      mkdirSync10(join69(homeEnv.XDG_CONFIG_HOME, "claude"), { recursive: true });
+      mkdirSync10(join70(homeEnv.XDG_CONFIG_HOME, "claude"), { recursive: true });
       installBundledSkills({ home: homeEnv.HOME });
       const mcpConfigPath = writeMcpConfig(ctx);
       const effort = resolveEffort(model);
-      const stopHookPath = join69(ctx.tmpdir, "infraweaver-stop-hook.sh");
+      const stopHookPath = join70(ctx.tmpdir, "infraweaver-stop-hook.sh");
       writeFileSync22(stopHookPath, buildStopHookScript(), { mode: 493 });
       const pretoolGate = writePretoolGateAssets(ctx, stopHookPath);
       installManagedSettings({
@@ -303229,7 +303662,7 @@ var claude = agent({
 init_core();
 import { spawn as nodeSpawn2 } from "node:child_process";
 import { mkdirSync as mkdirSync12, writeFileSync as writeFileSync24 } from "node:fs";
-import { join as join71 } from "node:path";
+import { join as join72 } from "node:path";
 import { performance as performance7 } from "node:perf_hooks";
 import { StringDecoder as StringDecoder2 } from "node:string_decoder";
 import { setTimeout as sleep7 } from "node:timers/promises";
@@ -308912,7 +309345,7 @@ function autoSelectModel() {
 import { execFileSync as execFileSync4 } from "node:child_process";
 import { mkdirSync as mkdirSync11, writeFileSync as writeFileSync23 } from "node:fs";
 import { homedir as homedir3, userInfo as userInfo2 } from "node:os";
-import { join as join70 } from "node:path";
+import { join as join71 } from "node:path";
 
 // src/utils/agent/codexOAuth.ts
 init_webapi();
@@ -308966,8 +309399,8 @@ function installCodexAuth() {
   }
   const expiresMs = decodeJwtExpMs(body2.tokens.access_token) ?? 0;
   const xdgDataHome = resolveDataHome();
-  const opencodeDir = join70(xdgDataHome, "opencode");
-  const authPath = join70(opencodeDir, "auth.json");
+  const opencodeDir = join71(xdgDataHome, "opencode");
+  const authPath = join71(opencodeDir, "auth.json");
   const opencodeAuth = {
     openai: {
       type: "oauth",
@@ -308991,7 +309424,7 @@ function installCodexAuth() {
   };
 }
 function resolveDataHome() {
-  if (process.env.CI !== "true") return join70(homedir3(), ".local", "share");
+  if (process.env.CI !== "true") return join71(homedir3(), ".local", "share");
   bootstrapInfraweaverDataDir();
   return INFRAWEAVER_DATA_DIR;
 }
@@ -309255,7 +309688,7 @@ function newTurn() {
   turnCounter += 1;
   return {
     finalText: "",
-    tokens: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+    tokens: { input: 0, output: 0, reasoning: 0, cacheRead: 0, cacheWrite: 0 },
     costUsd: 0,
     sessionError: null,
     lastToolError: null,
@@ -309265,7 +309698,7 @@ function newTurn() {
 function chargeTokenQuota2(ctx) {
   const quota = ctx.tokenQuota;
   if (!quota || !ctx.currentTurn || ctx.tokenQuotaExceeded) return;
-  if (!quota.observe(ctx.currentTurn.quotaSource, quotaTokens(ctx.currentTurn.tokens))) return;
+  if (!quota.observe(ctx.currentTurn.quotaSource, quotaTokens2(ctx.currentTurn.tokens))) return;
   ctx.tokenQuotaExceeded = true;
   log2.info(`\xBB ${ctx.label}: ${quota.gap()}`);
   ctx.abortRun?.(new TokenQuotaExceededError(quota.gap()));
@@ -309374,6 +309807,7 @@ async function onPartUpdated(ctx, part) {
     if (t) {
       ctx.currentTurn.tokens.input += t.input || 0;
       ctx.currentTurn.tokens.output += t.output || 0;
+      ctx.currentTurn.tokens.reasoning += t.reasoning || 0;
       ctx.currentTurn.tokens.cacheRead += t.cache?.read || 0;
       ctx.currentTurn.tokens.cacheWrite += t.cache?.write || 0;
     }
@@ -309732,10 +310166,10 @@ var opencode = agent({
     const openAiCompatModel = resolveOpenAiCompatibleOpenCodeModel(rawModel);
     const model = isBedrockRoute ? `amazon-bedrock/${rawModel}` : vertexModel ?? openAiCompatModel ?? rawModel;
     const homeEnv = agentHomeEnv(ctx.tmpdir);
-    const opencodePluginDir = join71(homeEnv.XDG_CONFIG_HOME, "opencode", "plugin");
+    const opencodePluginDir = join72(homeEnv.XDG_CONFIG_HOME, "opencode", "plugin");
     mkdirSync12(opencodePluginDir, { recursive: true });
     writeFileSync24(
-      join71(opencodePluginDir, INFRAWEAVER_OPENCODE_GATE_PLUGIN_FILENAME),
+      join72(opencodePluginDir, INFRAWEAVER_OPENCODE_GATE_PLUGIN_FILENAME),
       buildOpencodeSubagentGateSource(ctx.subagentDeniedTools, writePolicyPath2(ctx.tmpdir))
     );
     installBundledSkills({ home: homeEnv.HOME });
@@ -310671,7 +311105,7 @@ async function fetchRunContext(params) {
 // src/utils/github/github.ts
 init_core();
 import { rename as rename2, writeFile as writeFile2 } from "node:fs/promises";
-import { dirname as dirname12, join as join72 } from "node:path";
+import { dirname as dirname12, join as join73 } from "node:path";
 
 // node_modules/.pnpm/universal-user-agent@7.0.3/node_modules/universal-user-agent/index.js
 function getUserAgent2() {
@@ -310770,8 +311204,8 @@ function addQueryParameters(url5, parameters) {
   }).join("&");
 }
 var urlVariableRegex = /\{[^{}}]+\}/g;
-function removeNonChars(variableName) {
-  return variableName.replace(/(?:^\W+)|(?:(?<!\W)\W+$)/g, "").split(/,/);
+function removeNonChars(variableName2) {
+  return variableName2.replace(/(?:^\W+)|(?:(?<!\W)\W+$)/g, "").split(/,/);
 }
 function extractUrlVariableNames(url5) {
   const matches2 = url5.match(urlVariableRegex);
@@ -316487,7 +316921,7 @@ function getGitHubUsageSummary() {
 }
 async function writeGitHubUsageSummaryToFile(path15) {
   const summary2 = getGitHubUsageSummary();
-  const tmpPath = join72(dirname12(path15), `.usage-summary-${process.pid}.tmp`);
+  const tmpPath = join73(dirname12(path15), `.usage-summary-${process.pid}.tmp`);
   await writeFile2(tmpPath, JSON.stringify(summary2));
   await rename2(tmpPath, path15);
 }
@@ -317032,7 +317466,7 @@ async function resolveModelAndAuth(params) {
 // src/utils/run/runLifecycle.ts
 init_core();
 import { writeFile as writeFile5 } from "node:fs/promises";
-import { join as join75, resolve as resolve13 } from "node:path";
+import { join as join76, resolve as resolve13 } from "node:path";
 
 // src/utils/cloud/cloudReport.ts
 init_core();
@@ -317426,7 +317860,7 @@ async function reportToCloud(input2) {
 
 // src/utils/cloud/learnings.ts
 import { mkdir as mkdir3, readFile as readFile3, writeFile as writeFile3 } from "node:fs/promises";
-import { dirname as dirname13, join as join73 } from "node:path";
+import { dirname as dirname13, join as join74 } from "node:path";
 
 // src/utils/cloud/learningsTruncate.ts
 var MAX_LEARNINGS_LENGTH = 1e5;
@@ -317443,7 +317877,7 @@ function truncateAtLineBoundary(body2, cap2) {
 // src/utils/cloud/learnings.ts
 var LEARNINGS_FILE_NAME = LEARNINGS_FILE;
 function learningsFilePath(tmpdir6) {
-  return join73(tmpdir6, LEARNINGS_FILE_NAME);
+  return join74(tmpdir6, LEARNINGS_FILE_NAME);
 }
 async function seedLearningsFile(params) {
   const path15 = learningsFilePath(params.tmpdir);
@@ -317574,7 +318008,7 @@ ${ctx.error}` : ctx.error;
 
 // src/utils/github/prSummary.ts
 import { mkdir as mkdir4, readFile as readFile4, writeFile as writeFile4 } from "node:fs/promises";
-import { dirname as dirname14, join as join74 } from "node:path";
+import { dirname as dirname14, join as join75 } from "node:path";
 var SUMMARY_FILE_NAME = SUMMARY_FILE;
 var SUMMARY_SCAFFOLD = `# PR summary
 
@@ -317584,7 +318018,7 @@ var SUMMARY_SCAFFOLD = `# PR summary
 var MIN_SNAPSHOT_LENGTH = 60;
 var MAX_SNAPSHOT_LENGTH = 32768;
 function summaryFilePath(tmpdir6) {
-  return join74(tmpdir6, SUMMARY_FILE_NAME);
+  return join75(tmpdir6, SUMMARY_FILE_NAME);
 }
 async function seedSummaryFile(params) {
   const path15 = summaryFilePath(params.tmpdir);
@@ -318118,7 +318552,7 @@ async function emitFindingsOutputs(toolState, requiredControls) {
       if (a.level === "error") error(a.message, props);
       else warning(a.message, props);
     }
-    const sarifPath = join75(workspace, SARIF_FILE);
+    const sarifPath = join76(workspace, SARIF_FILE);
     if (session.emittedSarifPath && resolve13(session.emittedSarifPath) === resolve13(sarifPath)) {
       log2.info(`\xBB findings output: replacing the agent-emitted ${SARIF_FILE} with the gate's`);
     }
@@ -318450,7 +318884,7 @@ async function runAgentWithWatchdogs(params) {
   const tokenQuota = reserved ? quotas.token : createTokenQuota(quotas.tokenLimit.full);
   const costQuota = reserved ? quotas.cost : createCostQuota(quotas.costLimit.full);
   log2.info(
-    quotas.tokenLimit.full > 0 ? `\xBB run token quota: ${quotas.tokenLimit.full.toLocaleString("en-GB")} billable tokens` + (reserved ? ` (${tokenQuota.limit.toLocaleString("en-GB")} for the run, the rest reserved to deliver findings if it runs out)` : "") : `\xBB run token quota: disabled (${RUN_TOKEN_QUOTA_INPUT}: 0)`
+    quotas.tokenLimit.full > 0 ? `\xBB run token quota: ${quotas.tokenLimit.full.toLocaleString("en-GB")} tokens` + (reserved ? ` (${tokenQuota.limit.toLocaleString("en-GB")} for the run, the rest reserved to deliver findings if it runs out)` : "") + "; a token read from the prompt cache counts as a tenth" : `\xBB run token quota: disabled (${RUN_TOKEN_QUOTA_INPUT}: 0)`
   );
   log2.info(
     quotas.costLimit.full > 0 ? `\xBB run cost quota: $${quotas.costLimit.full.toFixed(2)}` + (reserved ? ` ($${costQuota.limit.toFixed(2)} for the run, the rest reserved to deliver findings if it runs out)` : "") : `\xBB run cost quota: disabled (${RUN_COST_QUOTA_INPUT}: 0)`
@@ -318548,9 +318982,9 @@ async function runAgentWithWatchdogs(params) {
 }
 
 // src/phases/startToolPlane.ts
-import { existsSync as existsSync21, readdirSync as readdirSync11 } from "node:fs";
+import { existsSync as existsSync20, readdirSync as readdirSync11 } from "node:fs";
 import { readFile as readFile5 } from "node:fs/promises";
-import { join as join76 } from "node:path";
+import { join as join77 } from "node:path";
 
 // src/utils/cloud/runTerminalStatus.ts
 var TERMINAL_STATE_KEY = "run_terminal";
@@ -319378,8 +319812,8 @@ ${instructions.user}` : null,
     log2.info(instructions.full);
   });
   if (toolContext.agentId === "opencode") {
-    const pluginDir = join76(process.cwd(), ".opencode", "plugin");
-    const hasPlugins = existsSync21(pluginDir) && readdirSync11(pluginDir).some((f) => /\.[jt]sx?$/.test(f));
+    const pluginDir = join77(process.cwd(), ".opencode", "plugin");
+    const hasPlugins = existsSync20(pluginDir) && readdirSync11(pluginDir).some((f) => /\.[jt]sx?$/.test(f));
     if (hasPlugins && toolState.dependencyInstallation?.promise) {
       log2.info(
         "\xBB .opencode/plugin/ detected \u2014 awaiting dependency installation before agent start"
@@ -319865,7 +320299,7 @@ async function run2(args2) {
 }
 
 // src/commands/mcp.ts
-import { existsSync as existsSync22, statSync as statSync12 } from "node:fs";
+import { existsSync as existsSync21, statSync as statSync12 } from "node:fs";
 import { isAbsolute as isAbsolute9, resolve as resolve14 } from "node:path";
 var import_arg4 = __toESM(require_arg(), 1);
 var SEVERITIES5 = ["critical", "high", "medium", "low", "info"];
@@ -319938,7 +320372,7 @@ async function runMcpCli(params) {
   if (rawCwd) {
     cwd = isAbsolute9(rawCwd) ? rawCwd : resolve14(process.cwd(), rawCwd);
   }
-  if (!existsSync22(cwd) || !statSync12(cwd).isDirectory()) {
+  if (!existsSync21(cwd) || !statSync12(cwd).isDirectory()) {
     console.error(`--cwd is not a directory: ${cwd}`);
     process.exit(1);
   }
@@ -319971,7 +320405,7 @@ async function runMcpCli(params) {
 }
 
 // node_modules/.pnpm/@infraweaver-io+attest@0.1.7_supports-color@7.2.0/node_modules/@infraweaver-io/attest/dist/verifyEvidence.js
-import { readFileSync as readFileSync39 } from "node:fs";
+import { readFileSync as readFileSync40 } from "node:fs";
 function usageLine(params) {
   const command = params.command ? `${params.command} ` : "";
   return `usage: ${params.prog} ${command}<bundle> <sig> <pubkey>`;
@@ -319989,7 +320423,7 @@ function printUsage(params, stream2) {
 }
 function readFileOrExit(path15, what) {
   try {
-    return readFileSync39(path15);
+    return readFileSync40(path15);
   } catch (e) {
     console.error(`could not read the ${what} at ${path15}: ${errorMessage(e)}`);
     process.exit(1);
@@ -320037,7 +320471,7 @@ async function runVerifyEvidenceCli2(params) {
 }
 
 // src/cli.ts
-var VERSION14 = "0.3.11";
+var VERSION14 = "0.3.13";
 var bin = basename9(process.argv[1] || "");
 var PROG = bin === "pf" || bin === PRODUCT_SLUG ? bin : PRODUCT_SLUG;
 var rawArgs = process.argv.slice(2);