infraweaver 0.3.11 → 0.3.13

package/dist/index.js

@@ -84161,14 +84161,14 @@ var require_turndown_cjs = __commonJS({
         } else if (node3.nodeType === 1) {
           replacement = replacementForNode.call(self2, node3);
         }
-        return join74(output2, replacement);
+        return join75(output2, replacement);
       }, "");
     }
     function postProcess(output2) {
       var self2 = this;
       this.rules.forEach(function(rule) {
         if (typeof rule.append === "function") {
-          output2 = join74(output2, rule.append(self2.options));
+          output2 = join75(output2, rule.append(self2.options));
         }
       });
       return output2.replace(/^[\t\r\n]+/, "").replace(/[\t\r\n\s]+$/, "");
@@ -84180,7 +84180,7 @@ var require_turndown_cjs = __commonJS({
       if (whitespace.leading || whitespace.trailing) content = content.trim();
       return whitespace.leading + rule.replacement(content, node3, this.options) + whitespace.trailing;
     }
-    function join74(output2, replacement) {
+    function join75(output2, replacement) {
       var s1 = trimTrailingNewlines(output2);
       var s2 = trimLeadingNewlines(replacement);
       var nls = Math.max(output2.length - s1.length, replacement.length - s2.length);
@@ -97300,7 +97300,7 @@ var require_polyfill = __commonJS({
     var {
       dirname: dirname15,
       isAbsolute: isAbsolute7,
-      join: join74,
+      join: join75,
       parse: parse8,
       resolve: resolve11,
       sep: sep11,
@@ -97557,8 +97557,8 @@ var require_polyfill = __commonJS({
       const dir = await readdir2(src);
       for (let i = 0; i < dir.length; i++) {
         const item = dir[i];
-        const srcItem = join74(src, item);
-        const destItem = join74(dest, item);
+        const srcItem = join75(src, item);
+        const destItem = join75(dest, item);
         const { destStat } = await checkPaths2(srcItem, destItem, opts);
         await startCopy(destStat, srcItem, destItem, opts);
       }
@@ -97631,7 +97631,7 @@ var require_cp = __commonJS({
 // node_modules/.pnpm/@npmcli+fs@6.0.0/node_modules/@npmcli/fs/lib/with-temp-dir.js
 var require_with_temp_dir = __commonJS({
   "node_modules/.pnpm/@npmcli+fs@6.0.0/node_modules/@npmcli/fs/lib/with-temp-dir.js"(exports2, module) {
-    var { join: join74, sep: sep11 } = __require("path");
+    var { join: join75, sep: sep11 } = __require("path");
     var getOptions2 = require_get_options();
     var { mkdir: mkdir5, mkdtemp, rm: rm2 } = __require("fs/promises");
     var withTempDir = async (root, fn2, opts) => {
@@ -97639,7 +97639,7 @@ var require_with_temp_dir = __commonJS({
         copy: ["tmpPrefix"]
       });
       await mkdir5(root, { recursive: true });
-      const target = await mkdtemp(join74(`${root}${sep11}`, options.tmpPrefix || ""));
+      const target = await mkdtemp(join75(`${root}${sep11}`, options.tmpPrefix || ""));
       let err;
       let result;
       try {
@@ -97664,13 +97664,13 @@ var require_with_temp_dir = __commonJS({
 var require_readdir_scoped = __commonJS({
   "node_modules/.pnpm/@npmcli+fs@6.0.0/node_modules/@npmcli/fs/lib/readdir-scoped.js"(exports2, module) {
     var { readdir: readdir2 } = __require("fs/promises");
-    var { join: join74 } = __require("path");
+    var { join: join75 } = __require("path");
     var readdirScoped = async (dir) => {
       const results = [];
       for (const item of await readdir2(dir)) {
         if (item.startsWith("@")) {
-          for (const scopedItem of await readdir2(join74(dir, item))) {
-            results.push(join74(item, scopedItem));
+          for (const scopedItem of await readdir2(join75(dir, item))) {
+            results.push(join75(item, scopedItem));
           }
         } else {
           results.push(item);
@@ -97685,7 +97685,7 @@ var require_readdir_scoped = __commonJS({
 // node_modules/.pnpm/@npmcli+fs@6.0.0/node_modules/@npmcli/fs/lib/move-file.js
 var require_move_file = __commonJS({
   "node_modules/.pnpm/@npmcli+fs@6.0.0/node_modules/@npmcli/fs/lib/move-file.js"(exports2, module) {
-    var { dirname: dirname15, join: join74, resolve: resolve11, relative: relative8, isAbsolute: isAbsolute7 } = __require("path");
+    var { dirname: dirname15, join: join75, resolve: resolve11, relative: relative8, isAbsolute: isAbsolute7 } = __require("path");
     var fs12 = __require("fs/promises");
     var pathExists2 = async (path15) => {
       try {
@@ -97715,7 +97715,7 @@ var require_move_file = __commonJS({
           if (sourceStat.isDirectory()) {
             const files = await fs12.readdir(source);
             await Promise.all(files.map(
-              (file2) => moveFile(join74(source, file2), join74(destination, file2), options, false, symlinks)
+              (file2) => moveFile(join75(source, file2), join75(destination, file2), options, false, symlinks)
             ));
           } else if (sourceStat.isSymbolicLink()) {
             symlinks.push({ source, destination });
@@ -107552,23 +107552,23 @@ var require_helpers = __commonJS({
   "node_modules/.pnpm/ip-address@10.7.3/node_modules/ip-address/dist/v6/helpers.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.escapeHtml = escapeHtml;
+    exports2.escapeHtml = escapeHtml2;
     exports2.spanAllZeroes = spanAllZeroes;
     exports2.spanAll = spanAll;
     exports2.spanLeadingZeroes = spanLeadingZeroes;
     exports2.simpleGroup = simpleGroup;
-    function escapeHtml(s) {
+    function escapeHtml2(s) {
       return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
     }
     function spanAllZeroes(s) {
-      return escapeHtml(s).replace(/(0+)/g, '<span class="zero">$1</span>');
+      return escapeHtml2(s).replace(/(0+)/g, '<span class="zero">$1</span>');
     }
     function spanAll(s, offset = 0) {
       const letters = s.split("");
-      return letters.map((n, i) => `<span class="digit value-${escapeHtml(n)} position-${i + offset}">${spanAllZeroes(n)}</span>`).join("");
+      return letters.map((n, i) => `<span class="digit value-${escapeHtml2(n)} position-${i + offset}">${spanAllZeroes(n)}</span>`).join("");
     }
     function spanLeadingZeroesSimple(group2) {
-      return escapeHtml(group2).replace(/^(0+)/, '<span class="zero">$1</span>');
+      return escapeHtml2(group2).replace(/^(0+)/, '<span class="zero">$1</span>');
     }
     function spanLeadingZeroes(address) {
       const groups2 = address.split(":");
@@ -160384,7 +160384,7 @@ var init_cacheTwirpClient = __esm({
 });
 
 // node_modules/.pnpm/@actions+cache@6.3.0_supports-color@7.2.0/node_modules/@actions/cache/lib/internal/tar.js
-import { existsSync as existsSync17, writeFileSync as writeFileSync21 } from "fs";
+import { existsSync as existsSync16, writeFileSync as writeFileSync21 } from "fs";
 import * as path13 from "path";
 function getTarPath() {
   return __awaiter18(this, void 0, void 0, function* () {
@@ -160394,7 +160394,7 @@ function getTarPath() {
         const systemTar = SystemTarPathOnWindows;
         if (gnuTar) {
           return { path: gnuTar, type: ArchiveToolType.GNU };
-        } else if (existsSync17(systemTar)) {
+        } else if (existsSync16(systemTar)) {
           return { path: systemTar, type: ArchiveToolType.BSD };
         }
         break;
@@ -250325,7 +250325,7 @@ var FastMCP = class extends FastMCPEventEmitter {
   }
 };
 
-// node_modules/.pnpm/@infraweaver-io+models@0.1.6/node_modules/@infraweaver-io/models/dist/catalog.js
+// node_modules/.pnpm/@infraweaver-io+models@0.1.7/node_modules/@infraweaver-io/models/dist/catalog.js
 function provider(config3) {
   return config3;
 }
@@ -258848,7 +258848,7 @@ function isGeminiRouted(ctx) {
 init_core3();
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
 
-// node_modules/.pnpm/@infraweaver-io+models@0.1.6/node_modules/@infraweaver-io/models/dist/usage.js
+// node_modules/.pnpm/@infraweaver-io+models@0.1.7/node_modules/@infraweaver-io/models/dist/usage.js
 function formatCostUsd(costUsd) {
   return costUsd.toFixed(4);
 }
@@ -259203,7 +259203,7 @@ import { randomBytes as randomBytes2 } from "node:crypto";
 // package.json
 var package_default = {
   name: "infraweaver",
-  version: "0.3.11",
+  version: "0.3.13",
   description: "GitHub Action that remediates Terraform to best practices and opens one scoped pull request per concern.",
   keywords: [
     "ai-coding-agent",
@@ -259306,7 +259306,7 @@ var package_default = {
     "@infraweaver-io/ci": "^0.1.8",
     "@infraweaver-io/core": "^0.1.5",
     "@infraweaver-io/crosswalk": "^1.2.0",
-    "@infraweaver-io/models": "^0.1.6",
+    "@infraweaver-io/models": "^0.1.7",
     "@infraweaver-io/policy-spec": "^1.2.0",
     "@infraweaver-io/report-contract": "^0.1.5",
     "@infraweaver-io/sandbox": "^0.1.8",
@@ -266110,7 +266110,18 @@ var SECRET_WORDS = /* @__PURE__ */ new Set([
   "credential",
   "credentials"
 ]);
-var SECRET_KEY_PREFIXES = /* @__PURE__ */ new Set(["api", "secret", "private", "signing"]);
+var SECRET_KEY_PREFIXES = /* @__PURE__ */ new Set([
+  "api",
+  "secret",
+  "private",
+  "signing",
+  "access",
+  "account",
+  "client",
+  "shared",
+  "preshared",
+  "master"
+]);
 var NOT_SECRET_TOKENS = /* @__PURE__ */ new Set(["creation", "idempotency", "client", "request", "continuation"]);
 function words(name) {
   return name.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase().split(/[_-]+/).filter(Boolean);
@@ -266122,24 +266133,70 @@ function isSecretName(name) {
   if (last === void 0) return false;
   if (last === "key") return prev !== void 0 && SECRET_KEY_PREFIXES.has(prev);
   if (last === "token" && prev !== void 0 && NOT_SECRET_TOKENS.has(prev)) return false;
+  if (last === "string") return prev === "connection";
+  if (last === "secret" && w.length === 1) return false;
   return SECRET_WORDS.has(last);
 }
 function isPlaceholder(inner) {
-  return inner.trim() === "" || /^[*xX.]+$/.test(inner) || /^<[^>]*>$/.test(inner) || // the dummy credentials offline plans and LocalStack are given (`secret_key = "test"`)
-  /^(?:test|mock|fake|dummy|fixture|example|placeholder|sample)(?:[_-].*)?$/i.test(inner) || // a token's lifetime unit: `token_validity_units { access_token = "hours" }`
+  return inner.trim() === "" || /^[*xX.]+$/.test(inner) || /^<[^>]*>$/.test(inner) || /^(?:true|false|null)$/.test(inner) || /^-?\d+(?:\.\d+)?$/.test(inner) || // a template directive is computed, like an interpolation: `"%{ if … }…%{ endif }"`
+  inner.includes("%{") || // the dummy credentials offline plans and LocalStack are given (`secret_key = "test"`,
+  // `"example-secret"`) — but only when that is the whole value: a lowercase tail at
+  // most, so `"Test-Pr0dDbPassw0rd!"` is a password that happens to start with a word
+  isDummy(inner) || // a token's lifetime unit: `token_validity_units { access_token = "hours" }`
   /^(?:seconds|minutes|hours|days)$/.test(inner);
 }
-var HEADER = /^(resource|data|provider|module|locals|variable|output|terraform)\b([^{]*)\{\s*$/;
+function isDummy(inner) {
+  const m = /^(?:test|mock|fake|dummy|fixture|example|placeholder|sample)([_-].*)?$/i.exec(inner);
+  return m !== null && (m[1] === void 0 || /^[_-][a-z0-9_-]*$/.test(m[1]));
+}
+function isSecretReference(inner) {
+  return inner.startsWith("arn:") || /^projects\/[^/]+\/secrets\//.test(inner) || /^https:\/\/[\w-]+\.vault\.azure\.net\/secrets\//i.test(inner) || /^\/[\w./-]+$/.test(inner);
+}
+var HEADER = /^(resource|data|provider|module|locals|variable|output|terraform)\b([^{]*)\{(.*)$/;
 var ASSIGNMENT = /^\s*(?:"([A-Za-z_][\w-]*)"|([A-Za-z_][\w-]*))\s*=(?!=)\s*(.*)$/;
 var HEREDOC = /<<-?([A-Za-z_]\w*)\s*$/;
 var INLINE_PAIR = /(?:"([A-Za-z_][\w-]*)"|\b([A-Za-z_][\w-]*))\s*=(?!=)\s*("(?:[^"\\]|\\.)*")/g;
-function literalValue(raw2) {
+function literalValue(name, raw2) {
   const value2 = stripTrailingComment(raw2).replace(/,$/, "").trim();
-  return isStringLiteral(value2) && !isPlaceholder(value2.slice(1, -1));
+  if (!isStringLiteral(value2)) return false;
+  const inner = value2.slice(1, -1);
+  if (isPlaceholder(inner) || isSecretReference(inner)) return false;
+  return !(words(name).at(-1) === "auth" && /^[A-Z]+(?:_[A-Z]+)*$/.test(inner));
+}
+function variableName(holder) {
+  return /^variable\s+"?([\w-]+)"?/.exec(holder)?.[1] ?? "";
+}
+function opensBlockComment(line) {
+  for (let i = 0; i < line.length; i++) {
+    const span = skipNonCode(line, i);
+    if (!span) continue;
+    if (line.startsWith("/*", i) && !line.includes("*/", i + 2)) return true;
+    i = span.end;
+  }
+  return false;
+}
+function closesOnLine(rest) {
+  let depth = 1;
+  for (let i = 0; i < rest.length; i++) {
+    const span = skipNonCode(rest, i);
+    if (span) {
+      i = span.end;
+      continue;
+    }
+    if (rest[i] === "{") depth++;
+    else if (rest[i] === "}" && --depth === 0) return true;
+  }
+  return false;
 }
 function findHardcodedSecrets(hcl2) {
+  return findInLines(hcl2, null);
+}
+function findTfvarsSecrets(hcl2, path15) {
+  return findInLines(hcl2, `tfvars input ${path15}`);
+}
+function findInLines(hcl2, fileHolder) {
   const out = [];
-  let holder = null;
+  let holder = fileHolder;
   let heredoc = null;
   let inComment = false;
   const lines = hcl2.split("\n");
@@ -266159,12 +266216,28 @@ function findHardcodedSecrets(hcl2) {
       continue;
     }
     if (trimmed.startsWith("#") || trimmed.startsWith("//")) continue;
-    const header = HEADER.exec(line);
+    if (opensBlockComment(line)) inComment = true;
+    const header = fileHolder === null ? HEADER.exec(line) : null;
     if (header) {
       holder = `${header[1]}${header[2].trimEnd() ? ` ${header[2].trim()}` : ""}`;
+      const rest = header[3];
+      const opens2 = HEREDOC.exec(rest);
+      if (opens2) heredoc = opens2[1];
+      if (!holder.startsWith("output ") && !holder.startsWith("terraform")) {
+        for (const pair of rest.matchAll(INLINE_PAIR)) {
+          const key = pair[1] ?? pair[2];
+          const isVariable = holder.startsWith("variable ");
+          if (isVariable && key !== "default") continue;
+          const name2 = isVariable ? variableName(holder) : key;
+          if (isSecretName(name2) && literalValue(name2, pair[3])) {
+            out.push({ name: name2, holder, line: i + 1 });
+          }
+        }
+      }
+      if (closesOnLine(rest)) holder = null;
       continue;
     }
-    if (line.startsWith("}")) {
+    if (fileHolder === null && line.startsWith("}")) {
       holder = null;
       continue;
     }
@@ -266176,30 +266249,34 @@ function findHardcodedSecrets(hcl2) {
     const name = m[1] ?? m[2];
     const value2 = m[3];
     if (holder.startsWith("variable ")) {
-      const variable = /^variable\s+"?([\w-]+)"?/.exec(holder)?.[1] ?? "";
-      if (name === "default" && isSecretName(variable) && literalValue(value2)) {
+      const variable = variableName(holder);
+      if (name === "default" && isSecretName(variable) && literalValue(variable, value2)) {
         out.push({ name: variable, holder, line: i + 1 });
       }
       continue;
     }
     if (holder.startsWith("output ") || holder.startsWith("terraform")) continue;
-    if (isSecretName(name) && literalValue(value2)) {
+    if (isSecretName(name) && literalValue(name, value2)) {
       out.push({ name, holder, line: i + 1 });
       continue;
     }
     for (const pair of value2.matchAll(INLINE_PAIR)) {
       const key = pair[1] ?? pair[2];
-      if (isSecretName(key) && literalValue(pair[3])) {
+      if (isSecretName(key) && literalValue(key, pair[3])) {
         out.push({ name: key, holder, line: i + 1 });
       }
     }
   }
   return out;
 }
-function scanHardcodedSecrets(files) {
+function scanHardcodedSecrets(files, tfvarsFiles = []) {
   const concerns = [];
-  for (const { path: path15, hcl: hcl2 } of files) {
-    for (const hit of findHardcodedSecrets(hcl2)) {
+  const hits = [
+    ...files.map((f) => ({ path: f.path, found: findHardcodedSecrets(f.hcl) })),
+    ...tfvarsFiles.map((f) => ({ path: f.path, found: findTfvarsSecrets(f.hcl, f.path) }))
+  ];
+  for (const { path: path15, found } of hits) {
+    for (const hit of found) {
       concerns.push(
         buildConcern({
           source: NATIVE_SOURCE,
@@ -268202,7 +268279,8 @@ var NATIVE_RULE_SCANNERS = [
     name: "hardcoded-secrets",
     rules: [HARDCODED_SECRET_ARGUMENT],
     // Per file: the argument's name and its literal are both on the line itself.
-    scan: (ctx) => ({ concerns: scanHardcodedSecrets(ctx.files) })
+    // The only rule that reads `.tfvars`: an input file holds values, not config.
+    scan: (ctx) => ({ concerns: scanHardcodedSecrets(ctx.files, ctx.tfvarsFiles) })
   },
   {
     name: "write-only",
@@ -268287,6 +268365,7 @@ function createRuleContext(input2) {
     cwd: input2.cwd,
     files: input2.files,
     tofuFiles: input2.tofuFiles ?? [],
+    tfvarsFiles: input2.tfvarsFiles ?? [],
     truncated: input2.truncated ?? null,
     repeatedLiteralThreshold: input2.repeatedLiteralThreshold
   };
@@ -268338,6 +268417,9 @@ function readTfTree(cwd, limits) {
 function readTofuTree(cwd, limits) {
   return readTree(cwd, ".tofu", limits);
 }
+function readTfvarsTree(cwd, limits) {
+  return readTree(cwd, ".tfvars", limits);
+}
 var OVERSIZE_NAMED = 5;
 function describeOversize(paths) {
   const named = paths.slice(0, OVERSIZE_NAMED).join(", ");
@@ -268366,6 +268448,9 @@ function scanNative(cwd, opts = {}) {
     // walk over a suffix most repos do not use at all, and threading it through
     // the context keeps the scanners uniform.
     tofuFiles: readTofuTree(cwd).files,
+    // likewise only for the hardcoded-secret rule: a value kept out of the `.tf`
+    // source is most often committed here instead
+    tfvarsFiles: readTfvarsTree(cwd).files,
     truncated: tree.truncated,
     repeatedLiteralThreshold: opts.repeatedLiteralThreshold ?? DEFAULT_REPEAT_THRESHOLD
   });
@@ -272923,9 +273008,9 @@ function TerraformChangeSummaryTool(ctx) {
 }
 
 // src/mcp/checkout.ts
-import { createHash as createHash9 } from "node:crypto";
+import { createHash as createHash10 } from "node:crypto";
 import { statSync as statSync5, unlinkSync as unlinkSync3, writeFileSync as writeFileSync10 } from "node:fs";
-import { join as join35 } from "node:path";
+import { join as join36 } from "node:path";
 
 // node_modules/.pnpm/@infraweaver-io+ci@0.1.8/node_modules/@infraweaver-io/ci/dist/diffCoverage.js
 import { isAbsolute as isAbsolute3, normalize as normalize3, resolve as resolve5 } from "node:path";
@@ -273331,6 +273416,9 @@ import { spawnSync as spawnSync5 } from "node:child_process";
 import { readFileSync as readFileSync12, rmSync as rmSync2 } from "node:fs";
 import { join as join22 } from "node:path";
 
+// src/mcp/staleFix.ts
+import { createHash as createHash6 } from "node:crypto";
+
 // node_modules/.pnpm/@infraweaver-io+ci@0.1.8/node_modules/@infraweaver-io/ci/dist/progressComment.js
 function parseProgressComment(raw2) {
   if (!raw2?.id)
@@ -274283,7 +274371,31 @@ function groupIdFromBranch(branch) {
 }
 function remediationBranchSuffix(base, defaultBranch) {
   if (!base || !defaultBranch || base === defaultBranch) return "";
-  return `--${base.replace(/[^A-Za-z0-9._-]+/g, "-")}`;
+  const slug2 = base.replace(/[^A-Za-z0-9._-]+/g, "-");
+  if (slug2 === base) return `--${slug2}`;
+  return `--${slug2}-${createHash6("sha1").update(base).digest("hex").slice(0, 8)}`;
+}
+function remediationBranchFor(id, base, defaultBranch, open3) {
+  const computed = `remediate/${id}${remediationBranchSuffix(base, defaultBranch)}`;
+  const heads = (open3 ?? []).filter((pr) => pr.base === base && groupIdFromBranch(pr.head) === id).map((pr) => pr.head).filter((head) => !(open3 ?? []).some((pr) => pr.head === head && pr.base !== base));
+  return heads.includes(computed) ? computed : heads[0] ?? computed;
+}
+async function listOpenRemediationPrs(ctx) {
+  const { octokit, repo } = ctx;
+  if (ctx.toolState?.selectedMode !== "Remediate") return [];
+  if (!octokit || !repo?.owner || !repo.name) return [];
+  try {
+    const open3 = await octokit.paginate(octokit.rest.pulls.list, {
+      owner: repo.owner,
+      repo: repo.name,
+      state: "open",
+      per_page: 100
+    });
+    return open3.filter((pr) => pr.head.repo?.id === pr.base.repo.id && groupIdFromBranch(pr.head.ref)).map((pr) => ({ head: pr.head.ref, base: pr.base.ref }));
+  } catch (e) {
+    log2.warning(`\xBB could not list open remediation PRs: ${errorMessage(e)}`);
+    return [];
+  }
 }
 function matchesBotIdentity(identity) {
   const normalized = identity.replace(/\[bot\]$/i, "").toLowerCase();
@@ -274539,13 +274651,13 @@ function ClosePullRequestTool(ctx) {
 }
 
 // src/mcp/terraform/emittedArtefacts.ts
-import { createHash as createHash6 } from "node:crypto";
+import { createHash as createHash7 } from "node:crypto";
 import { writeFileSync as writeFileSync4 } from "node:fs";
 import { resolve as resolve6 } from "node:path";
 var ARTEFACT_DIR = "compliance/";
 function gitBlobId(bytes) {
   const content = Buffer.from(bytes, "utf8");
-  return createHash6("sha1").update(`blob ${content.length}\0`).update(content).digest("hex");
+  return createHash7("sha1").update(`blob ${content.length}\0`).update(content).digest("hex");
 }
 function writeEmittedArtefact(toolState, path15, bytes) {
   writeFileSync4(path15, bytes);
@@ -274895,7 +275007,7 @@ function parseResourcesWithArgs(hcl2) {
 }
 
 // src/mcp/terraform/refactor/workspace.ts
-import { createHash as createHash7 } from "node:crypto";
+import { createHash as createHash8 } from "node:crypto";
 import { readdirSync as readdirSync4, readFileSync as readFileSync11 } from "node:fs";
 import { join as join21, posix as posix6 } from "node:path";
 function readTreeAtRef(cwd, ref) {
@@ -274925,7 +275037,7 @@ function readWorkingTree(cwd) {
   return files;
 }
 function workingTreeFingerprint(files) {
-  const h = createHash7("sha256");
+  const h = createHash8("sha256");
   for (const f of [...files].sort((a, b) => a.path.localeCompare(b.path, "en"))) {
     h.update(f.path);
     h.update("\0");
@@ -276636,7 +276748,7 @@ This mode standardises STRUCTURE while preserving BEHAVIOUR \u2014 the equivalen
    - \`${t("terraform_normalization_candidates")}\` \u2192 in-place idiomatic cleanups that change SYNTAX, not behaviour (redundant whole-string \`"\${expr}"\` interpolation; legacy HCL0.11 map-argument block syntax like \`vars {\` on a \`template_file\`). These relocate NOTHING \u2014 zero \`moved {}\` blocks \u2014 and are proven by the same equivalence check.
    - \`${t("terraform_consolidation_candidates")}\` \u2192 the SAME resource shape declared in several root directories (\`env/dev\` + \`env/staging\` + \`env/prod\`), with the single parameterised module they could all call already derived: which attributes are identical (module content) and which differ (per-environment inputs). A member root of a group will ALSO show up as a zero-candidate cluster in \`${t("module_extraction_candidates")}\` \u2014 prefer the consolidation, which does that work once for every environment instead of once per environment. Its \`near_groups\` are the opposite case: roots recognisably the same stack that DIFFER (one carries a resource the other does not), where folding them together is a design decision this mode has no basis for. Do NOT extract a near-group root's shared resources into a module on its own either \u2014 a module one twin calls and the other does not widens exactly the drift the near-group reports. Leave those roots alone and name the near-group and its \`differences\` in your report.
 
-   **A result marked \`report_only\` is an observation, not work.** The repository is a module other configurations call (\`report_only_reason\` says why), and restructuring it is churn for every caller: name those candidates in your \`${t("report_progress")}\` summary and open no PR for them. \`examples/\` roots are left out of every candidate list unless the operator set \`refactor_examples\`.
+   **A candidate marked \`report_only\` is an observation, not work.** It sits in the code of a module other configurations call (\`report_only_reason\` says why), and restructuring that is churn for every caller: name those candidates in your \`${t("report_progress")}\` summary and open no PR for them. \`examples/\` roots are left out of every candidate list unless the operator set \`refactor_examples\`.
 
    **Before picking, check the interface.** \`${t("module_extraction_candidates")}\` reports \`unmapped_attributes\` per candidate and a top-level \`partial_interfaces\` list: arguments the raw resources SET that the target module does not. Adopting such a module DROPS them silently \u2014 and the equivalence check cannot catch it, because once the argument is gone it is absent from both sides. Two of these are unrecoverable rather than merely wrong (\`object_lock_enabled\` cannot be set after creation; \`force_destroy\` changes deletion semantics). So: **decline the candidate, or extend the module to expose the argument and say so in the PR body.** Deleting the argument to make the shapes match is never the fix. A candidate whose \`unmapped_attributes\` is \`null\` was NOT checked \u2014 the module is external and its code is not in this repo \u2014 which is not the same as clean.
 
@@ -276769,7 +276881,7 @@ function remediateMode(t) {
 
 4. **for the chosen group**:
    - **base branch**: this run's base branch is resolved deterministically \u2014 \`${t("create_pull_request")}\` targets the \`base_branch\` input if set, else the branch the run started on, else the repository's default branch (\`main\`, or \`master\`). You do not choose it; just **omit** the \`base\` argument when opening the PR (below) and it is filled in.
-   - **idempotency**: the remediation branch is the group's \`branch\` (\`remediate/<group-id>\`, with a \`--<base>\` suffix when the PR targets a non-default branch) \u2014 use it exactly, never a name of your own. Before doing anything, check whether that branch or an open PR for it already exists (\`${t("git")}\` / \`${t("get_pull_request")}\`). If one exists, update it rather than opening a duplicate.
+   - **idempotency**: the remediation branch is the group's \`branch\` (\`remediate/<group-id>\`, with a \`--<base>\` suffix when the PR targets a non-default branch, or the branch of the PR already open for this group) \u2014 use it exactly, never a name of your own. Before doing anything, check whether that branch or an open PR for it already exists (\`${t("git")}\` / \`${t("get_pull_request")}\`). If one exists, update it rather than opening a duplicate.
    - **branch**: create the group's \`branch\` from the **current HEAD** (the checkout that was just scanned) via \`${t("git")}\` (\`git({ command: "checkout", args: ["-b", <branch>] })\`). Do NOT switch to a different base first \u2014 branching from the scanned checkout keeps the PR diff to exactly your fix.
    - **honest refusal (decide BEFORE fixing)**: if the group's concerns appear in the scan's \`refusal_candidates\` (the fix needs a human decision \u2014 narrowing an IAM wildcard, a KMS key policy, a real ingress CIDR), do **not** guess a fix that could break the stack. Instead open a structured issue (\`${t("create_issue")}\`) describing the concern, why it isn't auto-fixed, and what a human should do, and skip the PR for that group. A proven fix or an honest refusal \u2014 never a guessed, unverifiable PR.
    - **propose, then let me steer (when there's no single right fix)**: distinct from honest refusal (which refuses a fix a human must *decide*), this is for a finding with **2\u20133 genuinely distinct, defensible fixes** that differ in trade-offs, not correctness (e.g. encrypt with an AWS-managed key **vs** a customer-managed KMS key; a narrow security-group rule **vs** a prefix list **vs** a VPC endpoint). When such a fork exists **and the triggering comment did not already select a strategy**, do **not** silently pick for the reviewer: via \`${t("create_issue_comment")}\` post one short comment listing the options as **A / B / C** \u2014 each a single line (what it does + its trade-off) \u2014 and ask the reviewer to reply \`${COMMENT_COMMAND} fix #<concern-id> with strategy <A|B|C>\`. Then **skip the PR for this group** this run and note it in your final report (it resumes when the reviewer replies). When the comment **did** select one (\`fix #<id> with strategy B\`, or a bare \`strategy B\` reply on the proposal thread), apply **exactly** that strategy \u2014 don't second-guess it. Reserve this for real forks in the road; a fix with one obvious correct answer just gets made.
@@ -276830,7 +276942,7 @@ This mode composes the **Remediate** and **Refactor** verbs into a single run. I
    - **commit the fix** (\`git add\` only the changed \`*.tf\`/\`*.tfvars\`, a \`fix(tf): \u2026\` message). Do NOT push yet. This committed state is the refactor's equivalence BASELINE.
 
 3. **REFACTOR (phase 2) \u2014 modularise on top of the committed fix**: follow the **Refactor** mode's flow:
-   - \`${t("module_extraction_candidates")}\` / \`${t("terraform_normalization_candidates")}\` \u2192 pick one behaviour-preserving refactor; a result marked \`report_only\` (the repository is a module others call) is named in the summary, never proposed. Respect a pinned \`refactor_source\` if one was supplied (it constrains which module source you may use; the behaviour-altering b.4 path is only available when the operator pinned \`third-party\`).
+   - \`${t("module_extraction_candidates")}\` / \`${t("terraform_normalization_candidates")}\` \u2192 pick one behaviour-preserving refactor; a candidate marked \`report_only\` (it sits in the code of a module others call) is named in the summary, never proposed. Respect a pinned \`refactor_source\` if one was supplied (it constrains which module source you may use; the behaviour-altering b.4 path is only available when the operator pinned \`third-party\`).
    - resolve the module source, wire the \`module\` call against its real interface (\`${t("terraform_module_interface")}\` for a local module dir, \`${t("terraform_module_lookup")}\` for a registry-sourced one), and emit a \`moved {}\` block for EVERY relocated address (\`${t("terraform_generate_moved")}\`).
    - \`terraform fmt\` + \`${t("terraform_validate")}\`, then \u2014 **with the refactor edits still UNCOMMITTED** \u2014 call \`${t("terraform_equivalence_check")}\`. In this mode it diffs the working tree against the COMMITTED fix (not the run-start commit), so it measures only the refactor. It must return \`equivalent: true\` (zero uncovered moves, resource set + arguments preserved, validate + fmt clean) before you proceed; \`${t("push_branch")}\` hard-blocks an unproven one \u2014 and, once this run has added a \`moved {}\` block, it also hard-blocks a push that never ran the check at all, so abandoning the refactor means REVERTING its edits rather than leaving them in with the fix. If it can't be proven equivalent, abandon the refactor and ship the fix alone.
    - **document the module (only when the \`docs\` input is enabled)**: after the equivalence check passes, call \`${t("terraform_module_docs")}\` for the module you created/adopted (pass the relocated addresses as \`moves\`). Do not hand-write docs \u2014 the tool builds from the interface, moved blocks, and equivalence verdict.
@@ -278383,15 +278495,52 @@ var Git = type({
   args: type.string.array().describe("Additional arguments for the git command").optional()
 });
 function splitWords(line) {
-  return [...line.matchAll(/"([^"]*)"|'([^']*)'|(\S+)/g)].map((m) => m[1] ?? m[2] ?? m[3] ?? "");
+  const words2 = [];
+  let word = "";
+  let inWord = false;
+  let quote;
+  for (let i = 0; i < line.length; i++) {
+    const ch = line.charAt(i);
+    if (quote === "'") {
+      if (ch === "'") quote = void 0;
+      else word += ch;
+    } else if (quote === '"') {
+      if (ch === '"') quote = void 0;
+      else if (ch === "\\" && i + 1 < line.length && '"\\$`\n'.includes(line.charAt(i + 1))) {
+        i += 1;
+        if (line.charAt(i) !== "\n") word += line.charAt(i);
+      } else word += ch;
+    } else if (ch === " " || ch === "	") {
+      if (inWord) words2.push(word);
+      word = "";
+      inWord = false;
+    } else if (ch === "\n") {
+      throw new Error(
+        "command holds an unquoted newline \u2014 pass one git command per call, and quote a multi-line message"
+      );
+    } else if (ch === "\\") {
+      if (i + 1 >= line.length) throw new Error("command ends in a backslash that escapes nothing");
+      i += 1;
+      if (line.charAt(i) === "\n") continue;
+      word += line.charAt(i);
+      inWord = true;
+    } else if (ch === "'" || ch === '"') {
+      quote = ch;
+      inWord = true;
+    } else {
+      word += ch;
+      inWord = true;
+    }
+  }
+  if (quote) throw new Error(`command has an unterminated ${quote} quote`);
+  if (inWord) words2.push(word);
+  return words2;
 }
 function normalizeGitCall(params) {
-  let words2;
-  if (params.command === void 0) words2 = [...params.args ?? []];
-  else if (/^git\s/.test(params.command))
-    words2 = [...splitWords(params.command).slice(1), ...params.args ?? []];
-  else return { command: params.command, args: params.args ?? [] };
-  const [command, ...args2] = words2[0] === "git" ? words2.slice(1) : words2;
+  const words2 = params.command === void 0 ? [] : /^git\s/.test(params.command) ? splitWords(params.command) : [params.command];
+  words2.push(...params.args ?? []);
+  while (words2[0] === "git") words2.shift();
+  const [command, ...args2] = words2;
   if (command === void 0 || !/^[a-z][a-z0-9-]*$/.test(command)) {
     throw new Error(
       `command must be a Git subcommand such as 'status' or 'checkout' (was "${command ?? ""}")`
@@ -278577,7 +278726,7 @@ function PushTagsTool(ctx) {
 }
 
 // src/mcp/review.ts
-import { readFileSync as readFileSync19 } from "node:fs";
+import { readFileSync as readFileSync20 } from "node:fs";
 
 // src/mcp/findingAudit.ts
 var COHERENCE_RULES = {
@@ -278827,7 +278976,7 @@ function claimsBlockingSeverity(body2) {
 init_core3();
 import { isAbsolute as isAbsolute4, resolve as resolve7 } from "node:path";
 
-// node_modules/.pnpm/@infraweaver-io+models@0.1.6/node_modules/@infraweaver-io/models/dist/monotonicQuota.js
+// node_modules/.pnpm/@infraweaver-io+models@0.1.7/node_modules/@infraweaver-io/models/dist/monotonicQuota.js
 function createMonotonicQuota(params) {
   const { limit, unlimited, normalize: normalize5 } = params;
   let used = 0;
@@ -278852,7 +279001,7 @@ function createMonotonicQuota(params) {
   };
 }
 
-// node_modules/.pnpm/@infraweaver-io+models@0.1.6/node_modules/@infraweaver-io/models/dist/costQuota.js
+// node_modules/.pnpm/@infraweaver-io+models@0.1.7/node_modules/@infraweaver-io/models/dist/costQuota.js
 var CostQuotaExceededError = class extends Error {
   code = "COST_QUOTA_EXCEEDED";
   constructor(message2) {
@@ -278899,7 +279048,7 @@ function resolveRunCostQuota(parsed2) {
   return parsed2 === void 0 ? DEFAULT_RUN_COST_QUOTA_USD : parsed2;
 }
 
-// node_modules/.pnpm/@infraweaver-io+models@0.1.6/node_modules/@infraweaver-io/models/dist/tokenQuota.js
+// node_modules/.pnpm/@infraweaver-io+models@0.1.7/node_modules/@infraweaver-io/models/dist/tokenQuota.js
 var TokenQuotaExceededError = class extends Error {
   code = "TOKEN_QUOTA_EXCEEDED";
   constructor(message2) {
@@ -278909,19 +279058,16 @@ var TokenQuotaExceededError = class extends Error {
 };
 var DEFAULT_RUN_TOKEN_QUOTA = 1e7;
 var RUN_TOKEN_QUOTA_INPUT = "max_run_tokens";
-function billableTokens(t) {
-  let total = 0;
-  for (const v of [t.input, t.output, t.cacheRead, t.cacheWrite]) {
-    if (typeof v === "number" && Number.isFinite(v) && v > 0)
-      total += v;
-  }
-  return Math.floor(total);
+var CACHE_READ_WEIGHT = 0.1;
+function quotaTokens(t) {
+  const part = (v) => typeof v === "number" && Number.isFinite(v) && v > 0 ? v : 0;
+  return Math.floor(part(t.input) + part(t.output) + part(t.cacheWrite) + part(t.cacheRead) * CACHE_READ_WEIGHT);
 }
 function normalizeTotal(total) {
-  return typeof total === "number" ? Math.max(0, Math.floor(total)) : billableTokens(total);
+  return typeof total === "number" ? Math.max(0, Math.floor(total)) : quotaTokens(total);
 }
 function tokenGap(used, ceiling) {
-  return `run token quota exhausted: ${used.toLocaleString("en-GB")} of ${ceiling.toLocaleString("en-GB")} billable tokens consumed, so the run was stopped before it finished. Its results are INCOMPLETE and must not be read as a clean assessment \u2014 a finding that would have been raised after this point was never looked for. Raise \`${RUN_TOKEN_QUOTA_INPUT}\` if the run legitimately needs more budget, or set \`${RUN_TOKEN_QUOTA_INPUT}: 0\` to remove the bound entirely. A run that reaches this limit without finishing is more often a remediation loop that cannot converge (a fix that re-breaks its own check) than a genuinely large repository.`;
+  return `run token quota exhausted: ${used.toLocaleString("en-GB")} of ${ceiling.toLocaleString("en-GB")} tokens counted against the quota (a token read from the prompt cache counts as a tenth), so the run was stopped before it finished. Its results are INCOMPLETE and must not be read as a clean assessment \u2014 a finding that would have been raised after this point was never looked for. Raise \`${RUN_TOKEN_QUOTA_INPUT}\` if the run legitimately needs more budget, or set \`${RUN_TOKEN_QUOTA_INPUT}: 0\` to remove the bound entirely. A run that reaches this limit without finishing is more often a remediation loop that cannot converge (a fix that re-breaks its own check) than a genuinely large repository.`;
 }
 function unlimitedTokenQuota() {
   return createMonotonicQuota({
@@ -280064,6 +280210,12 @@ function parseCommentMarker(body2) {
     return null;
   }
 }
+function findingKeysIn(body2) {
+  return [...body2.matchAll(new RegExp(MARKER.source, "g"))].flatMap((m) => {
+    const marker2 = parseCommentMarker(m[0]);
+    return marker2?.kind === "finding" ? [marker2.key] : [];
+  });
+}
 var SUGGESTION = /```suggestion\r?\n([\s\S]*?)```/;
 function suggestionText(body2) {
   const m = SUGGESTION.exec(body2);
@@ -280220,23 +280372,54 @@ function computeScanDelta(input2) {
   };
 }
 function markPossibleRenames(introduced, resolved, headAddresses) {
-  const vanished = resolved.filter((r) => {
-    if (r.address === null) return false;
-    return !headAddresses(dirOf3(r.concern.location.file)).has(r.address);
-  });
+  const byResource = (findings) => {
+    const out = /* @__PURE__ */ new Map();
+    for (const f of [...findings].sort((a, b) => byLocation(a.concern, b.concern))) {
+      if (f.address === null) continue;
+      const dir = dirOf3(f.concern.location.file);
+      const key = `${dir}|${f.address}`;
+      const entry4 = out.get(key);
+      if (entry4) entry4.findings.push(f);
+      else out.set(key, { dir, address: f.address, findings: [f] });
+    }
+    return [...out.values()];
+  };
+  const vanished = byResource(resolved).filter((r) => !headAddresses(r.dir).has(r.address));
+  const appeared = byResource(introduced);
+  const shared = (from, to) => {
+    const left = /* @__PURE__ */ new Map();
+    for (const f of from.findings)
+      left.set(ruleKey(f.concern), (left.get(ruleKey(f.concern)) ?? 0) + 1);
+    return to.findings.filter((f) => {
+      const n = left.get(ruleKey(f.concern)) ?? 0;
+      if (n === 0) return false;
+      left.set(ruleKey(f.concern), n - 1);
+      return true;
+    });
+  };
+  const order2 = (a, b) => a.dir.localeCompare(b.dir) || a.address.localeCompare(b.address);
+  const candidates = vanished.flatMap(
+    (from) => appeared.filter(
+      (to) => (
+        // a `moved` block cannot change a resource's type
+        typeOf(from.address) === typeOf(to.address) && // renamed in place, or moved elsewhere under its own name
+        from.dir === to.dir !== (from.address === to.address)
+      )
+    ).map((to) => ({ from, to, findings: shared(from, to) })).filter((p) => p.findings.length > 0)
+  );
+  candidates.sort(
+    (a, b) => b.findings.length - a.findings.length || order2(a.from, b.from) || order2(a.to, b.to)
+  );
   const used = /* @__PURE__ */ new Set();
-  for (const finding of introduced) {
-    if (finding.address === null) continue;
-    const dir = dirOf3(finding.concern.location.file);
-    const match5 = vanished.find(
-      (r) => !used.has(r) && ruleKey(r.concern) === ruleKey(finding.concern) && // a `moved` block cannot change a resource's type
-      typeOf(r.address) === typeOf(finding.address) && // renamed in place, or moved elsewhere under its own name
-      dirOf3(r.concern.location.file) === dir !== (r.address === finding.address)
-    );
-    if (!match5) continue;
-    used.add(match5);
-    finding.possiblyPreexisting = true;
-    finding.renamedFrom = { address: match5.address, file: match5.concern.location.file };
+  for (const { from, to, findings } of candidates) {
+    if (used.has(from) || used.has(to)) continue;
+    used.add(from);
+    used.add(to);
+    const file2 = from.findings[0]?.concern.location.file;
+    for (const finding of findings) {
+      finding.possiblyPreexisting = true;
+      finding.renamedFrom = { address: from.address, file: file2 };
+    }
   }
 }
 function typeOf(address) {
@@ -280505,39 +280688,115 @@ function formatDuplicateCommentsNote(duplicates) {
 var MAX_DUPLICATE_COMMENT_LINES = 50;
 
 // src/mcp/reviewCommentLimit.ts
-var MAX_OVERFLOW_LINES = 50;
+var MAX_NOTE_CHARS = 3e4;
+var TRAILER_RESERVE = 400;
 var PROVEN_MARK = "\u2705 **Proven by re-scan**";
-function rank(c) {
+var SEVERITY_LEVEL = {
+  critical: 0,
+  high: 1,
+  medium: 2,
+  low: 3,
+  info: 4
+};
+var MARKER_LEVEL = { "\u{1F6A8}": 1, "\u26A0\uFE0F": 2, "\u26A0": 2, "\u2139\uFE0F": 3, \u2139: 3 };
+var UNMARKED_LEVEL = 2;
+function rank(c, severity) {
   const body2 = c.body ?? "";
-  const marker2 = leadingMarker(body2);
-  const severity = marker2 === "\u{1F6A8}" ? 0 : marker2 === "\u26A0\uFE0F" || marker2 === "\u26A0" ? 2 : 4;
-  return severity + (body2.includes(PROVEN_MARK) ? 0 : 1);
+  const level = severity ? SEVERITY_LEVEL[severity] : MARKER_LEVEL[leadingMarker(body2) ?? ""] ?? UNMARKED_LEVEL;
+  return level * 2 + (body2.includes(PROVEN_MARK) ? 0 : 1);
 }
-function limitInlineComments(comments, limit) {
+function limitInlineComments(comments, limit, severityOf) {
   if (!limit || comments.length <= limit) return { kept: [...comments], overflow: [] };
   const keep = new Set(
-    comments.map((c, i) => ({ i, r: rank(c) })).sort((a, b) => a.r - b.r || a.i - b.i).slice(0, limit).map(({ i }) => i)
+    comments.map((c, i) => ({ i, r: rank(c, severityOf?.(c)) })).sort((a, b) => a.r - b.r || a.i - b.i).slice(0, limit).map(({ i }) => i)
   );
   return {
     kept: comments.filter((_, i) => keep.has(i)),
     overflow: comments.filter((_, i) => !keep.has(i))
   };
 }
-function formatOverflowNote(overflow, limit) {
+var escapeHtml = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+var whereOf = (c) => c.line ? `${c.path}:${c.line}` : c.path;
+function closesItself(body2) {
+  const occurrences = (re) => body2.match(re)?.length ?? 0;
+  const fences = body2.split("\n").filter((l) => /^\s*(```|~~~)/.test(l)).length;
+  return fences % 2 === 0 && occurrences(/<details\b/gi) === occurrences(/<\/details\s*>/gi) && occurrences(/<!--/g) === occurrences(/-->/g);
+}
+function asText(body2) {
+  const longest = Math.max(0, ...(body2.match(/`+/g) ?? []).map((run2) => run2.length));
+  const fence = "`".repeat(Math.max(3, longest + 1));
+  return `${fence}text
+${body2}
+${fence}`;
+}
+function renderWhole(c, linkOf) {
+  const where4 = escapeHtml(whereOf(c));
+  const gist = gistOf(c.body);
+  const href = linkOf?.(c);
+  const body2 = c.body ?? "";
+  return [
+    `<details><summary><code>${where4}</code>${gist ? ` \u2014 ${gist}` : ""}</summary>`,
+    ...href ? [`<a href="${escapeHtml(href)}">${where4}</a>`] : [],
+    ...body2 ? [closesItself(body2) ? body2 : asText(body2)] : [],
+    "</details>"
+  ].join("\n\n");
+}
+function renderBrief(c) {
+  const gist = gistOf(c.body);
+  const markers = findingKeysIn(c.body ?? "").map(
+    (key) => renderCommentMarker({ kind: "finding", key, proven: false })
+  );
+  return `- \`${whereOf(c).replace(/`/g, "'")}\`${gist ? ` \u2014 ${gist}` : ""}${markers.map((m) => ` ${m}`).join("")}`;
+}
+function formatOverflowNote(overflow, limit, linkOf) {
   if (overflow.length === 0) return "";
-  const shown = overflow.slice(0, MAX_OVERFLOW_LINES).map((c) => {
-    const where4 = c.line ? `${c.path}:${c.line}` : c.path;
-    const gist = gistOf(c.body);
-    return `- \`${where4.replace(/`/g, "'")}\`${gist ? ` \u2014 ${gist}` : ""}`;
-  });
-  const rest = overflow.length - shown.length;
-  if (rest > 0) shown.push(`- \u2026and ${rest} more not shown`);
-  return `
+  const header = `
 
 ---
 
-**Note:** this review posts at most ${limit} inline comments (\`review_comment_limit\`), so ${overflow.length} more ${overflow.length === 1 ? "is" : "are"} listed here instead:
-` + shown.join("\n");
+**Note:** this review posts at most ${limit} inline comments (\`review_comment_limit\`), so ${overflow.length} more ${overflow.length === 1 ? "is" : "are"} listed here instead:`;
+  const SEP = 2;
+  let room = MAX_NOTE_CHARS - TRAILER_RESERVE - header.length;
+  const items = [];
+  for (const c of overflow) {
+    const brief2 = renderBrief(c);
+    if (brief2.length + SEP > room) break;
+    items.push(brief2);
+    room -= brief2.length + SEP;
+  }
+  let brief = items.length;
+  for (const [i, c] of overflow.slice(0, items.length).entries()) {
+    const whole = renderWhole(c, linkOf);
+    const extra = whole.length - items[i].length;
+    if (extra > room) continue;
+    items[i] = whole;
+    room -= extra;
+    brief--;
+  }
+  const omitted = overflow.length - items.length;
+  if (omitted > 0) items.push(`- \u2026and ${omitted} more not shown`);
+  const cut = [
+    brief > 0 ? `${brief} of them ${brief === 1 ? "is" : "are"} shown by place and first line only` : "",
+    omitted > 0 ? `${omitted} ${omitted === 1 ? "is" : "are"} not shown at all` : ""
+  ].filter(Boolean);
+  if (cut.length > 0) {
+    items.push(`${cut.join(" and ")}, to keep this review within GitHub's size limit.`);
+  }
+  return `${header}
+
+${items.join("\n\n")}`;
+}
+function foldedFindingsStillIntroduced(input2) {
+  const folded = new Set(
+    input2.reviews.flatMap(
+      (r) => r.body && isOwnReviewComment(r.user, r.body) ? findingKeysIn(r.body) : []
+    )
+  );
+  if (folded.size === 0) return [];
+  const dismissed = new Set(input2.dismissed.map((d) => d.finding_id));
+  return input2.delta.introduced.filter(
+    (f) => folded.has(findingKey(f)) && !dismissed.has(f.concern.id)
+  );
 }
 
 // src/mcp/reviewComments.ts
@@ -281368,7 +281627,8 @@ function deltaVerdict(delta, requiredControls) {
   return {
     pass: gate.pass && required3.length === 0,
     gating: gate.gating.length,
-    required: required3.length
+    required: required3.length,
+    blocking: (/* @__PURE__ */ new Set([...gate.gating, ...required3])).size
   };
 }
 function failsGate(finding, requiredControls) {
@@ -281495,7 +281755,7 @@ function where2(f) {
 function renderReviewVerdict(input2) {
   const { delta, verdict: verdict2 } = input2;
   const introduced = delta.introduced.length;
-  const blocking = verdict2.gating + verdict2.required;
+  const { blocking } = verdict2;
   const renamedBlocking = delta.introduced.filter(
     (f) => f.possiblyPreexisting && failsGate(f, [...input2.requiredControls ?? []])
   ).length;
@@ -281604,7 +281864,7 @@ import { mkdtempSync as mkdtempSync2, readFileSync as readFileSync16, rmSync as
 import { join as join28, posix as posix8 } from "node:path";
 
 // src/mcp/terraform/lineage.ts
-import { createHash as createHash8 } from "node:crypto";
+import { createHash as createHash9 } from "node:crypto";
 import { readFileSync as readFileSync15 } from "node:fs";
 import { join as join27 } from "node:path";
 function repoFileReader(cwd) {
@@ -281617,7 +281877,7 @@ function repoFileReader(cwd) {
   };
 }
 function lineageKeyOf(c, address) {
-  return createHash8("sha1").update(`${c.source}|${bareRuleOf(c.source, c.rule_id)}|${c.location.file}|${address ?? ""}`).digest("hex").slice(0, 16);
+  return createHash9("sha1").update(`${c.source}|${bareRuleOf(c.source, c.rule_id)}|${c.location.file}|${address ?? ""}`).digest("hex").slice(0, 16);
 }
 function lineageResolver(read3) {
   const files = /* @__PURE__ */ new Map();
@@ -281789,7 +282049,7 @@ function apply(worktree, path15, cs) {
 
 // src/mcp/terraform/gateScan.ts
 import { existsSync as existsSync7, mkdtempSync as mkdtempSync3, rmSync as rmSync6 } from "node:fs";
-import { join as join32, posix as posix10 } from "node:path";
+import { join as join33, posix as posix10 } from "node:path";
 
 // src/mcp/terraform/coverage.ts
 function bandOf(group2, concerns, signals) {
@@ -282227,6 +282487,68 @@ function dedupeCrossScanner(concerns) {
   return [...merged, ...passthrough];
 }
 
+// src/mcp/terraform/verifySites.ts
+import { readFileSync as readFileSync17 } from "node:fs";
+import { join as join29 } from "node:path";
+function fileReader(cwd) {
+  const cache3 = /* @__PURE__ */ new Map();
+  return (file2) => {
+    if (!cache3.has(file2)) {
+      let text;
+      try {
+        text = readFileSync17(join29(cwd, file2), "utf8");
+      } catch {
+        text = null;
+      }
+      cache3.set(file2, text);
+    }
+    return cache3.get(file2) ?? null;
+  };
+}
+function siteOf(c, read3) {
+  const text = read3(c.location.file);
+  return text === null ? null : resourceAddressAt(text, c.location.line);
+}
+function recordConcernSites(session, concerns, cwd, linesMatchTree) {
+  const read3 = fileReader(cwd);
+  session.siteById ??= /* @__PURE__ */ new Map();
+  session.firstSitesByKey ??= /* @__PURE__ */ new Map();
+  const first = session.firstSitesByKey;
+  const fresh = /* @__PURE__ */ new Map();
+  for (const c of concerns) {
+    const site = linesMatchTree ? siteOf(c, read3) : null;
+    const prior = session.siteById.get(c.id);
+    session.siteById.set(c.id, prior === void 0 || prior === site ? site : null);
+    if (!linesMatchTree) continue;
+    const key = concernKeyOf(c);
+    if (first.has(key)) continue;
+    const sites = fresh.get(key) ?? /* @__PURE__ */ new Set();
+    sites.add(site);
+    fresh.set(key, sites);
+  }
+  for (const [key, sites] of fresh) first.set(key, sites);
+}
+function resolvedAtSite(params) {
+  const firingByKey = /* @__PURE__ */ new Map();
+  for (const c of params.current) {
+    const list = firingByKey.get(c.key) ?? [];
+    list.push(c.site);
+    firingByKey.set(c.key, list);
+  }
+  const out = [];
+  for (const r of params.requested) {
+    if (r.site === null || r.file === void 0) continue;
+    const firing = firingByKey.get(r.key) ?? [];
+    const known = params.firstSites.get(r.key);
+    if (known === void 0) continue;
+    if (firing.some((s) => s === null || !known.has(s))) continue;
+    if (firing.includes(r.site)) continue;
+    if (!params.declared(r.file).has(r.site)) continue;
+    out.push(r.id);
+  }
+  return out;
+}
+
 // src/mcp/terraform/concernResult.ts
 function annotateConcerns(rawConcerns, opts) {
   const inScope = opts.inScope ?? (() => true);
@@ -282253,6 +282575,7 @@ function buildConcernResult(ctx, rawConcerns, opts) {
     fullBaseline.map((c) => concernKeyOf(c))
   );
   recordConcernKeys(session, fullBaseline);
+  recordConcernSites(session, fullBaseline, opts.cwd, opts.linesMatchTree ?? false);
   session.baselineFmtDriftFiles = union3(
     session.baselineFmtDriftFiles,
     fullBaseline.filter((c) => c.source === "terraform-fmt").map((c) => c.location.file)
@@ -282267,13 +282590,13 @@ function buildConcernResult(ctx, rawConcerns, opts) {
     active,
     opts.autonomyThreshold
   );
-  const suffix2 = remediationBranchSuffix(
-    remediationBaseOf(ctx),
-    ctx.repo?.data.default_branch?.trim() || void 0
-  );
-  const groups2 = (opts.priority ? prioritizeGroups(annotatedGroups, active, opts.priority) : annotatedGroups).map((g) => ({ ...g, branch: `remediate/${g.id}${suffix2}` }));
+  const base = remediationBaseOf(ctx);
+  const defaultBranch = ctx.repo?.data.default_branch?.trim() || void 0;
+  const branchFor = (id) => remediationBranchFor(id, base, defaultBranch, opts.openRemediationPrs);
+  const groups2 = (opts.priority ? prioritizeGroups(annotatedGroups, active, opts.priority) : annotatedGroups).map((g) => ({ ...g, branch: branchFor(g.id) }));
   const planned = planBatches(groups2);
-  const batchPlan = planned.batch_branch ? { ...planned, batch_branch: `${planned.batch_branch}${suffix2}` } : planned;
+  const batchId = planned.batch_branch ? groupIdFromBranch(planned.batch_branch) : null;
+  const batchPlan = batchId ? { ...planned, batch_branch: branchFor(batchId) } : planned;
   const bySeverity = {};
   for (const c of active) bySeverity[c.severity] = (bySeverity[c.severity] ?? 0) + 1;
   return {
@@ -282289,7 +282612,7 @@ function buildConcernResult(ctx, rawConcerns, opts) {
 
 // src/mcp/terraform/initArtefacts.ts
 import { rmSync as rmSync4 } from "node:fs";
-import { join as join29, posix as posix9 } from "node:path";
+import { join as join30, posix as posix9 } from "node:path";
 var INIT_ARTEFACTS = /* @__PURE__ */ new Set([".terraform", ".terraform.lock.hcl"]);
 function initArtefacts(cwd) {
   const r = run("git", ["status", "--porcelain=v1", "-z", "--untracked-files=normal"], cwd);
@@ -282312,7 +282635,7 @@ function removeNewInitArtefacts(cwd, before, by) {
   const created = [...after?.untracked ?? []].filter((p) => !before.untracked.has(p));
   const changed = [...after?.modifiedLocks ?? []].filter((p) => !before.modifiedLocks.has(p));
   if (!top || created.length + changed.length === 0) return;
-  for (const p of created) rmSync4(join29(top, p), { recursive: true, force: true });
+  for (const p of created) rmSync4(join30(top, p), { recursive: true, force: true });
   if (changed.length > 0) run("git", ["checkout", "--", ...changed], top);
   resetTerraformInitCache();
   log2.info(
@@ -282321,8 +282644,8 @@ function removeNewInitArtefacts(cwd, before, by) {
 }
 
 // src/mcp/terraform/secretScan.ts
-import { readFileSync as readFileSync17, rmSync as rmSync5 } from "node:fs";
-import { join as join30 } from "node:path";
+import { readFileSync as readFileSync18, rmSync as rmSync5 } from "node:fs";
+import { join as join31 } from "node:path";
 function parseBetterleaksReport(json5, prefix2 = "") {
   const doc = JSON.parse(json5);
   if (Array.isArray(doc) || !doc || typeof doc !== "object" || !("findings" in doc)) {
@@ -282356,7 +282679,7 @@ async function scanAddedSecrets(cwd, mergeBase, tmp) {
   const top = run("git", ["rev-parse", "--show-toplevel"], cwd).stdout.trim();
   const prefix2 = run("git", ["rev-parse", "--show-prefix"], cwd).stdout.trim();
   if (!top) return { ran: false, reason: "not a git checkout", concerns: [] };
-  const report2 = join30(tmp, `betterleaks-${process.pid}.json`);
+  const report2 = join31(tmp, `betterleaks-${process.pid}.json`);
   try {
     const r = await runAsync(
       "betterleaks",
@@ -282379,7 +282702,7 @@ async function scanAddedSecrets(cwd, mergeBase, tmp) {
     const why = (r.stderr || r.stdout).trim().split("\n").pop() ?? "";
     let parsed2;
     try {
-      parsed2 = parseBetterleaksReport(readFileSync17(report2, "utf-8"), prefix2);
+      parsed2 = parseBetterleaksReport(readFileSync18(report2, "utf-8"), prefix2);
     } catch (error63) {
       const reason = r.status !== 0 ? `betterleaks exited ${r.status}: ${why}` : `${error63}`;
       return { ran: false, reason, concerns: [] };
@@ -282394,8 +282717,8 @@ async function scanAddedSecrets(cwd, mergeBase, tmp) {
 }
 
 // src/mcp/terraform/tools/scan.ts
-import { readFileSync as readFileSync18 } from "node:fs";
-import { join as join31 } from "node:path";
+import { readFileSync as readFileSync19 } from "node:fs";
+import { join as join32 } from "node:path";
 
 // src/mcp/terraform/noiseProfile.ts
 var MIN_DISMISSAL_REPOS = 3;
@@ -282569,7 +282892,9 @@ async function runScan(ctx, {
       grouping,
       autonomyThreshold,
       inScope,
-      priority
+      priority,
+      openRemediationPrs: await listOpenRemediationPrs(ctx),
+      linesMatchTree: true
     }
   );
   const { active, suppressed, groups: groups2, batchPlan, bySeverity: by_severity } = result;
@@ -282581,7 +282906,7 @@ async function runScan(ctx, {
     outcomes.flatMap((o) => o.concerns),
     (rel) => {
       try {
-        return readFileSync18(join31(cwd, rel), "utf-8");
+        return readFileSync19(join32(cwd, rel), "utf-8");
       } catch {
         return null;
       }
@@ -282733,8 +283058,8 @@ function checkOutBase(cwd, pr, tmp) {
   }
   const mergeBase = run("git", ["merge-base", pr.baseSha, "HEAD"], cwd).stdout.trim() || pr.baseSha;
   const prefix2 = run("git", ["rev-parse", "--show-prefix"], cwd).stdout.trim();
-  const parent = mkdtempSync3(join32(tmp, "scan-delta-base-"));
-  const worktree = join32(parent, "wt");
+  const parent = mkdtempSync3(join33(tmp, "scan-delta-base-"));
+  const worktree = join33(parent, "wt");
   if (run("git", ["worktree", "add", "--detach", worktree, mergeBase], cwd).status !== 0) {
     rmSync6(parent, { recursive: true, force: true });
     log2.warning("\xBB scan delta: could not check out the base \u2014 every finding is treated as new.");
@@ -282742,7 +283067,7 @@ function checkOutBase(cwd, pr, tmp) {
   }
   return {
     mergeBase,
-    cwd: prefix2 ? join32(worktree, prefix2) : worktree,
+    cwd: prefix2 ? join33(worktree, prefix2) : worktree,
     close: () => {
       run("git", ["worktree", "remove", "--force", worktree], cwd);
       rmSync6(parent, { recursive: true, force: true });
@@ -283210,6 +283535,22 @@ function CreatePullRequestReviewTool(ctx) {
             `cannot approve: ${outstanding} unresolved ${PRODUCT_NAME} review thread(s) still open on this PR. approval requires every prior ${PRODUCT_NAME} finding to be resolved, not just the latest commits to be clean. inspect them with \`${listRef}\`; for each thread the current code genuinely addresses, reply then call \`${resolveRef2}\`, and retry this approval. if any thread is a real outstanding issue, do NOT approve \u2014 submit a non-approving review (omit \`approved\`, or set \`request_changes\` for a blocking one) that covers it instead.`
           );
         }
+        if (delta) {
+          const reviews = await ctx.octokit.paginate(ctx.octokit.rest.pulls.listReviews, {
+            owner: ctx.repo.owner,
+            repo: ctx.repo.name,
+            pull_number,
+            per_page: 100
+          });
+          const folded = foldedFindingsStillIntroduced({ reviews, delta, dismissed });
+          if (folded.length > 0) {
+            throw new Error(
+              `cannot approve: ${folded.length} introduced finding(s) an earlier ${PRODUCT_NAME} review listed in its body (past \`review_comment_limit\`, so with no thread to resolve) are still introduced by this head: ` + folded.slice(0, 20).map(
+                (f) => `${f.concern.id} (${f.concern.rule_id} at ${f.concern.location.file}:${f.concern.location.line ?? "?"})`
+              ).join(", ") + `. approval requires every prior ${PRODUCT_NAME} finding to be addressed. if one genuinely needs no change, list it in \`dismissed\` with the reason and retry; otherwise do NOT approve \u2014 submit a non-approving review that covers it.`
+            );
+          }
+        }
       }
       const skip = reviewSkipDecision({
         approved: approved ?? false,
@@ -283316,6 +283657,7 @@ ${formatReanchoredNote(reanchored.moved)}`
         params.event = event;
       }
       const proofs = delta ? await proveReviewSuggestions(ctx, auditedComments) : /* @__PURE__ */ new Map();
+      const findingSeverity = /* @__PURE__ */ new Map();
       const reviewComments = auditedComments.map((comment, index) => {
         let commentBody = fixDoubleEscapedString(comment.body || "");
         if (comment.suggestion !== void 0) {
@@ -283357,6 +283699,9 @@ ${marker2}`;
           reviewComment.start_line = comment.start_line;
           reviewComment.start_side = side;
         }
+        if (comment.provenance?.kind === "scanner") {
+          findingSeverity.set(reviewComment, comment.provenance.finding.concern.severity);
+        }
         return reviewComment;
       });
       let droppedComments = [];
@@ -283392,7 +283737,11 @@ ${marker2}`;
             `withholding ${duplicateComments.length}/${reviewComments.length} inline comment(s) that duplicate open review threads`
           );
         }
-        const limited = limitInlineComments(deduped.kept, ctx.payload.reviewCommentLimit);
+        const limited = limitInlineComments(
+          deduped.kept,
+          ctx.payload.reviewCommentLimit,
+          (c) => findingSeverity.get(c)
+        );
         overflowComments = limited.overflow;
         if (overflowComments.length > 0) {
           log2.info(
@@ -283424,7 +283773,13 @@ ${marker2}`;
         body2 = body2 ? body2 + note : note.replace(/^\n\n/, "");
       }
       if (overflowComments.length > 0) {
-        const note = formatOverflowNote(overflowComments, ctx.payload.reviewCommentLimit);
+        const server = process.env.GITHUB_SERVER_URL || "https://github.com";
+        const commit = params.commit_id;
+        const note = formatOverflowNote(
+          overflowComments,
+          ctx.payload.reviewCommentLimit,
+          commit ? (c) => `${server}/${ctx.repo.owner}/${ctx.repo.name}/blob/${commit}/${c.path.split("/").map(encodeURIComponent).join("/")}${c.line && c.side !== "LEFT" ? `#L${c.line}` : ""}` : void 0
+        );
         body2 = body2 ? body2 + note : note.replace(/^\n\n/, "");
       }
       let reproved = 0;
@@ -283677,7 +284032,7 @@ ${coverageState.lastBreakdown}`
 }
 function readReviewedFile(path15) {
   try {
-    return readFileSync19(resolveWithinCwd(resolveRepoRoot(), path15), "utf-8");
+    return readFileSync20(resolveWithinCwd(resolveRepoRoot(), path15), "utf-8");
   } catch {
     return null;
   }
@@ -283992,7 +284347,7 @@ function fastForwardDiff(params, exec2) {
 
 // src/utils/prompt/changeImpact.ts
 import { writeFileSync as writeFileSync9 } from "node:fs";
-import { join as join33 } from "node:path";
+import { join as join34 } from "node:path";
 var MAX_ATOMS = 20;
 var MAX_REFS_PER_ATOM = 6;
 var MAX_EXCERPT = 160;
@@ -284172,7 +284527,7 @@ function createChangeImpactArtifact(params) {
     fileCount: params.files.length,
     lookupError
   });
-  const path15 = join33(
+  const path15 = join34(
     params.tmpdir,
     `pr-${params.pullNumber}-${params.headSha.slice(0, 7)}-impact.md`
   );
@@ -284192,7 +284547,7 @@ function createChangeImpactArtifact(params) {
 import { execFileSync, execSync as execSync2 } from "node:child_process";
 import { mkdtempSync as mkdtempSync4, readdirSync as readdirSync5, realpathSync as realpathSync4, unlinkSync as unlinkSync2 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join34 } from "node:path";
+import { join as join35 } from "node:path";
 
 // src/utils/github/ghaCore.ts
 import { randomUUID as randomUUID6 } from "node:crypto";
@@ -284215,7 +284570,7 @@ var TEMP_DIR_STATE_KEY = "infraweaver_temp_dir";
 
 // src/utils/setup/setup.ts
 function createTempDirectory() {
-  const sharedTempDir = mkdtempSync4(join34(tmpdir2(), `${PRODUCT_SLUG}-`));
+  const sharedTempDir = mkdtempSync4(join35(tmpdir2(), `${PRODUCT_SLUG}-`));
   process.env.INFRAWEAVER_TEMP_DIR = sharedTempDir;
   saveState2(TEMP_DIR_STATE_KEY, sharedTempDir);
   log2.info(`\xBB created temp dir at ${sharedTempDir}`);
@@ -284261,13 +284616,13 @@ function wipeRunnerLeakSurface() {
       return [];
     }
   };
-  const fileCommandsDir = join34(runnerTemp, "_runner_file_commands");
+  const fileCommandsDir = join35(runnerTemp, "_runner_file_commands");
   for (const entry4 of listDir(fileCommandsDir)) {
-    tryUnlink(join34(fileCommandsDir, entry4));
+    tryUnlink(join35(fileCommandsDir, entry4));
   }
   for (const entry4 of listDir(runnerTemp)) {
     if (entry4.endsWith(".sh") || /^git-credentials-.*\.config$/.test(entry4)) {
-      tryUnlink(join34(runnerTemp, entry4));
+      tryUnlink(join35(runnerTemp, entry4));
     }
   }
   if (wiped.length > 0) {
@@ -284436,7 +284791,7 @@ function formatFilesWithLineNumbers(files) {
   }
   const tocLines = [`## Files (${files.length})`];
   for (const entry4 of tocEntries) {
-    const anchor2 = createHash9("sha256").update(entry4.filename).digest("hex");
+    const anchor2 = createHash10("sha256").update(entry4.filename).digest("hex");
     tocLines.push(
       `- ${entry4.filename} \u2192 lines ${entry4.startLine}-${entry4.endLine} \xB7 diff-${anchor2}`
     );
@@ -284766,7 +285121,7 @@ function CheckoutPrTool(ctx) {
         headSha: ctx.toolState.checkoutSha
       });
       if (incremental) {
-        incrementalDiffPath = join35(
+        incrementalDiffPath = join36(
           tempDir,
           `pr-${pull_number}-${beforeShort}-${headShort}-incremental.diff`
         );
@@ -284780,7 +285135,7 @@ function CheckoutPrTool(ctx) {
     const diffPreview = formatResult.content.split("\n").slice(0, 100).join("\n");
     log2.debug(`formatted diff preview (first 100 lines):
 ${diffPreview}`);
-    const diffPath = join35(tempDir, `pr-${pull_number}-${headShort}.diff`);
+    const diffPath = join36(tempDir, `pr-${pull_number}-${headShort}.diff`);
     writeFileSync10(diffPath, formatResult.content);
     log2.debug(`wrote diff to ${diffPath} (${formatResult.content.length} bytes)`);
     ctx.toolState.diffCoverage = createDiffCoverageState({
@@ -284921,7 +285276,7 @@ ${dirty}`
 
 // src/mcp/checkSuite.ts
 import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync11 } from "node:fs";
-import { join as join36 } from "node:path";
+import { join as join37 } from "node:path";
 import { stripVTControlCharacters } from "node:util";
 var GetCheckSuiteLogs = type({
   check_suite_id: type.number.describe("the id from check_suite.id")
@@ -285016,7 +285371,7 @@ function GetCheckSuiteLogsTool(ctx) {
         };
       }
       const tempDir = getTempDir();
-      const logsDir = join36(tempDir, "ci-logs");
+      const logsDir = join37(tempDir, "ci-logs");
       mkdirSync3(logsDir, { recursive: true });
       const jobLists = await mapWithConcurrency(
         failedRuns,
@@ -285040,7 +285395,7 @@ function GetCheckSuiteLogsTool(ctx) {
             request: { signal: AbortSignal.timeout(1e4) }
           });
           const logsText = typeof data === "string" ? data : Buffer.from(data).toString("utf8");
-          const logPath = join36(logsDir, `job-${job.id}.log`);
+          const logPath = join37(logsDir, `job-${job.id}.log`);
           writeFileSync11(logPath, logsText);
           const analysis = analyzeLog(logsText, 80);
           const failedSteps = job.steps?.filter((s) => s.conclusion === "failure").map((s) => `Step ${s.number}: ${s.name}`) ?? [];
@@ -285102,7 +285457,7 @@ function GetCheckSuiteLogsTool(ctx) {
 
 // src/mcp/commitInfo.ts
 import { writeFileSync as writeFileSync12 } from "node:fs";
-import { join as join37 } from "node:path";
+import { join as join38 } from "node:path";
 var CommitInfo = type({
   sha: type.string.describe("the commit SHA (full or abbreviated) to fetch")
 });
@@ -285121,7 +285476,7 @@ function CommitInfoTool(ctx) {
       const files = data.files ?? [];
       const formatResult = formatFilesWithLineNumbers(files);
       const tempDir = getTempDir("get_commit_info");
-      const diffFile = join37(tempDir, `commit-${sha.slice(0, 7)}.diff`);
+      const diffFile = join38(tempDir, `commit-${sha.slice(0, 7)}.diff`);
       writeFileSync12(diffFile, formatResult.content);
       log2.debug(`wrote commit diff to ${diffFile} (${formatResult.content.length} bytes)`);
       return {
@@ -285283,7 +285638,7 @@ import { performance as performance3 } from "node:perf_hooks";
 
 // src/prep/installNodeDependencies.ts
 import { existsSync as existsSync8 } from "node:fs";
-import { join as join38 } from "node:path";
+import { join as join39 } from "node:path";
 
 // node_modules/.pnpm/package-manager-detector@1.8.0/node_modules/package-manager-detector/dist/commands.mjs
 function splitRunArgs(args2, valueFlags = []) {
@@ -285669,7 +286024,7 @@ async function installFallback(name, installSpec) {
     return result.stderr || `failed to install ${name}`;
   }
   if (name === "deno") {
-    const denoPath = join38(process.env.HOME || "", ".deno", "bin");
+    const denoPath = join39(process.env.HOME || "", ".deno", "bin");
     process.env.PATH = `${denoPath}:${process.env.PATH}`;
   }
   log2.info(`\xBB installed ${name}`);
@@ -285678,7 +286033,7 @@ async function installFallback(name, installSpec) {
 var installNodeDependencies = {
   name: "installNodeDependencies",
   shouldRun: () => {
-    const packageJsonPath = join38(process.cwd(), "package.json");
+    const packageJsonPath = join39(process.cwd(), "package.json");
     return existsSync8(packageJsonPath);
   },
   run: async (options) => {
@@ -285787,8 +286142,8 @@ ${errorMessage2}`]
 };
 
 // src/prep/installPythonDependencies.ts
-import { existsSync as existsSync9, readFileSync as readFileSync20 } from "node:fs";
-import { join as join39 } from "node:path";
+import { existsSync as existsSync9, readFileSync as readFileSync21 } from "node:fs";
+import { join as join40 } from "node:path";
 var PYTHON_CONFIGS = [
   {
     file: "requirements.txt",
@@ -285823,7 +286178,7 @@ var PYTHON_CONFIGS = [
 ];
 function pyprojectDeclaresBuildSystem(cwd) {
   try {
-    const content = readFileSync20(join39(cwd, "pyproject.toml"), "utf8");
+    const content = readFileSync21(join40(cwd, "pyproject.toml"), "utf8");
     return /^\s*\[build-system\]/m.test(content);
   } catch {
     return false;
@@ -285873,13 +286228,13 @@ var installPythonDependencies = {
     }
     const cwd = process.cwd();
     return PYTHON_CONFIGS.some(
-      (config3) => existsSync9(join39(cwd, config3.file)) && configApplies(config3, cwd)
+      (config3) => existsSync9(join40(cwd, config3.file)) && configApplies(config3, cwd)
     );
   },
   run: async (options) => {
     const cwd = process.cwd();
     const config3 = PYTHON_CONFIGS.find(
-      (c) => existsSync9(join39(cwd, c.file)) && configApplies(c, cwd)
+      (c) => existsSync9(join40(cwd, c.file)) && configApplies(c, cwd)
     );
     if (!config3) {
       return {
@@ -286400,12 +286755,12 @@ function AddLabelsTool(ctx) {
 }
 
 // src/mcp/moduleExtraction.ts
-import { readFileSync as readFileSync23 } from "node:fs";
-import { join as join42, posix as posix11 } from "node:path";
+import { readFileSync as readFileSync24 } from "node:fs";
+import { join as join43, posix as posix11 } from "node:path";
 
 // src/mcp/terraform/partialInterface.ts
-import { readdirSync as readdirSync6, readFileSync as readFileSync21 } from "node:fs";
-import { join as join40 } from "node:path";
+import { readdirSync as readdirSync6, readFileSync as readFileSync22 } from "node:fs";
+import { join as join41 } from "node:path";
 function unmappedArguments(resource, moduleResources) {
   const matching = moduleResources.filter((m) => m.type === resource.type);
   if (matching.length === 0) return [];
@@ -286415,10 +286770,10 @@ function unmappedArguments(resource, moduleResources) {
 function readDirHcl(cwd, dir) {
   let text = "";
   try {
-    for (const f of readdirSync6(join40(cwd, dir)).sort((a, b) => a.localeCompare(b, "en"))) {
+    for (const f of readdirSync6(join41(cwd, dir)).sort((a, b) => a.localeCompare(b, "en"))) {
       if (!f.endsWith(".tf")) continue;
       try {
-        text += `${readFileSync21(join40(cwd, dir, f), "utf8")}
+        text += `${readFileSync22(join41(cwd, dir, f), "utf8")}
 `;
       } catch {
       }
@@ -286448,7 +286803,7 @@ function findPartialInterfaces(cwd) {
     if (isInHouseModule(file2, graph)) continue;
     let text;
     try {
-      text = readFileSync21(join40(cwd, file2), "utf8");
+      text = readFileSync22(join41(cwd, file2), "utf8");
     } catch {
       continue;
     }
@@ -286465,12 +286820,47 @@ function findPartialInterfaces(cwd) {
 }
 
 // src/mcp/terraform/refactorScope.ts
-import { existsSync as existsSync10, readdirSync as readdirSync7, readFileSync as readFileSync22, statSync as statSync6 } from "node:fs";
-import { join as join41 } from "node:path";
+import { readdirSync as readdirSync7, readFileSync as readFileSync23, statSync as statSync6 } from "node:fs";
+import { join as join42 } from "node:path";
 function isExamplePath(path15) {
-  return /(?:^|\/)examples?\//.test(path15.replace(/\\/g, "/"));
+  return /(?:^|\/)examples\/|^example\//i.test(path15.replace(/\\/g, "/"));
+}
+var PROVIDER_OR_BACKEND = new RegExp(
+  String.raw`(?:^|\n)\s*(?:provider|backend)\s+${BLOCK_LABEL}\s*\{`
+);
+var CLOUD_BLOCK = /(?:^|\n)\s*cloud\s*\{/;
+function configuresDeployment(name, text) {
+  if (name.endsWith(".tf.json")) {
+    let doc;
+    try {
+      doc = JSON.parse(text);
+    } catch {
+      return false;
+    }
+    if (typeof doc !== "object" || doc === null) return false;
+    const { provider: provider2, terraform } = doc;
+    if (provider2 !== void 0) return true;
+    return [terraform].flat().some((t) => typeof t === "object" && t !== null && ("backend" in t || "cloud" in t));
+  }
+  if (PROVIDER_OR_BACKEND.test(text)) return true;
+  return parseBlocks(text, ["terraform"]).some((b) => CLOUD_BLOCK.test(b.body));
+}
+var isTerraformFile2 = (name) => name.endsWith(".tf") || name.endsWith(".tf.json");
+function deploysFrom(dir) {
+  let names;
+  try {
+    names = readdirSync7(dir).filter(isTerraformFile2);
+  } catch {
+    return false;
+  }
+  return names.some((name) => {
+    try {
+      return configuresDeployment(name, readFileSync23(join42(dir, name), "utf8"));
+    } catch {
+      return false;
+    }
+  });
 }
-var PROVIDER_OR_BACKEND = /^\s*(?:provider\s+"|backend\s+")/m;
 function holdsTerraform(dir, depth) {
   let entries;
   try {
@@ -286479,7 +286869,7 @@ function holdsTerraform(dir, depth) {
     return false;
   }
   for (const name of entries) {
-    const path15 = join41(dir, name);
+    const path15 = join42(dir, name);
     if (name.endsWith(".tf")) return true;
     if (depth > 0 && !name.startsWith(".") && statSync6(path15, { throwIfNoEntry: false })?.isDirectory()) {
       if (holdsTerraform(path15, depth - 1)) return true;
@@ -286488,26 +286878,35 @@ function holdsTerraform(dir, depth) {
   return false;
 }
 function libraryRepoReason(cwd) {
-  let rootFiles;
+  let rootEntries;
   try {
-    rootFiles = readdirSync7(cwd).filter((f) => f.endsWith(".tf"));
+    rootEntries = readdirSync7(cwd);
   } catch {
     return null;
   }
-  if (rootFiles.length === 0) return null;
-  for (const f of rootFiles) {
-    let text;
-    try {
-      text = readFileSync22(join41(cwd, f), "utf8");
-    } catch {
-      continue;
-    }
-    if (PROVIDER_OR_BACKEND.test(text)) return null;
-  }
-  const examples = ["examples", "example"].find((d) => existsSync10(join41(cwd, d)));
-  if (examples === void 0 || !holdsTerraform(join41(cwd, examples), 2)) return null;
+  if (!rootEntries.some(isTerraformFile2) || deploysFrom(cwd)) return null;
+  const examples = rootEntries.find((d) => /^examples?$/i.test(d));
+  if (examples === void 0 || !holdsTerraform(join42(cwd, examples), 2)) return null;
   return `the repository root configures no provider and no backend, and ships \`${examples}/\`: it is a module other configurations call, so restructuring it is churn for every caller`;
 }
+function libraryScope(cwd) {
+  const reason = libraryRepoReason(cwd);
+  if (reason === null) return () => null;
+  const deploys = /* @__PURE__ */ new Map();
+  return (file2) => {
+    const dirs = file2.replace(/\\/g, "/").split("/").slice(0, -1);
+    for (let i = dirs.length; i > 0; i--) {
+      const dir = dirs.slice(0, i).join("/");
+      let d = deploys.get(dir);
+      if (d === void 0) {
+        d = deploysFrom(join42(cwd, dir));
+        deploys.set(dir, d);
+      }
+      if (d) return null;
+    }
+    return reason;
+  };
+}
 function reportOnly(reason) {
   return reason === null ? {} : { report_only: true, report_only_reason: reason };
 }
@@ -286800,7 +287199,7 @@ function findExtractionCandidates(cwd, rawCatalogue, orgModuleHcl) {
     if (isInHouseModule(file2, graph) !== null) continue;
     let text;
     try {
-      text = readFileSync23(join42(cwd, file2), "utf8");
+      text = readFileSync24(join43(cwd, file2), "utf8");
     } catch {
       continue;
     }
@@ -286865,12 +287264,12 @@ function ModuleExtractionCandidatesTool(ctx) {
     parameters: ModuleExtractionCandidatesParams,
     execute: execute(async () => {
       const cwd = ctx.payload.cwd ?? process.cwd();
+      const library = libraryScope(cwd);
       const candidates = findExtractionCandidates(
         cwd,
         ctx.payload.moduleCatalogue,
         ctx.toolState.orgModuleHcl
-      ).filter((c) => ctx.payload.refactorExamples || !isExamplePath(c.cluster.file));
-      const library = libraryRepoReason(cwd);
+      ).filter((c) => ctx.payload.refactorExamples || !isExamplePath(c.cluster.file)).map((c) => ({ ...reportOnly(library(c.cluster.file)), ...c }));
       const matched = candidates.filter((c) => c.candidates.length > 0);
       const reasons = {};
       for (const c of candidates)
@@ -286884,7 +287283,6 @@ function ModuleExtractionCandidatesTool(ctx) {
         `\xBB module_extraction_candidates: ${candidates.length} cluster(s), ${matched.length} with a module match` + (partialInterfaces.length > 0 ? `, ${partialInterfaces.length} partial-interface block(s)` : "")
       );
       return toolOk({
-        ...reportOnly(library),
         cluster_count: candidates.length,
         matched_count: matched.length,
         candidates,
@@ -286908,8 +287306,8 @@ function ModuleExtractionCandidatesTool(ctx) {
 }
 
 // src/mcp/moduleTests.ts
-import { existsSync as existsSync11, readdirSync as readdirSync8, readFileSync as readFileSync24, statSync as statSync7 } from "node:fs";
-import { join as join43 } from "node:path";
+import { existsSync as existsSync10, readdirSync as readdirSync8, readFileSync as readFileSync25, statSync as statSync7 } from "node:fs";
+import { join as join44 } from "node:path";
 var MODULE_META_ARGS = /* @__PURE__ */ new Set([
   "source",
   "version",
@@ -287029,7 +287427,7 @@ function resolveSourceDir(fromDir, source) {
 }
 function isDir(p) {
   try {
-    return existsSync11(p) && statSync7(p).isDirectory();
+    return existsSync10(p) && statSync7(p).isDirectory();
   } catch {
     return false;
   }
@@ -287050,9 +287448,9 @@ function listSubdirs(absDir) {
 }
 function readAllTf(cwd, relDir) {
   let text = "";
-  for (const f of listFiles(join43(cwd, relDir), ".tf")) {
+  for (const f of listFiles(join44(cwd, relDir), ".tf")) {
     try {
-      text += `${readFileSync24(join43(cwd, relDir, f), "utf8")}
+      text += `${readFileSync25(join44(cwd, relDir, f), "utf8")}
 `;
     } catch {
     }
@@ -287064,8 +287462,8 @@ function discoverModuleTestAssets(cwd, moduleDir) {
   const assets = [];
   const matchesModule = (source, fromDir) => resolveSourceDir(fromDir, source) === md;
   for (const examplesRoot of [`${md}/examples`, "examples"]) {
-    if (!isDir(join43(cwd, examplesRoot))) continue;
-    for (const sub of listSubdirs(join43(cwd, examplesRoot))) {
+    if (!isDir(join44(cwd, examplesRoot))) continue;
+    for (const sub of listSubdirs(join44(cwd, examplesRoot))) {
       const exDir = `${examplesRoot}/${sub}`;
       const hcl2 = readAllTf(cwd, exDir);
       if (!hcl2) continue;
@@ -287081,12 +287479,12 @@ function discoverModuleTestAssets(cwd, moduleDir) {
     }
   }
   for (const testDir of [`${md}/tests`, md]) {
-    if (!isDir(join43(cwd, testDir))) continue;
-    for (const f of listFiles(join43(cwd, testDir), ".tftest.hcl")) {
+    if (!isDir(join44(cwd, testDir))) continue;
+    for (const f of listFiles(join44(cwd, testDir), ".tftest.hcl")) {
       const rel = `${testDir}/${f}`;
       let hcl2;
       try {
-        hcl2 = readFileSync24(join43(cwd, rel), "utf8");
+        hcl2 = readFileSync25(join44(cwd, rel), "utf8");
       } catch {
         continue;
       }
@@ -287094,12 +287492,12 @@ function discoverModuleTestAssets(cwd, moduleDir) {
     }
   }
   for (const goDir of [`${md}/test`, `${md}/tests`]) {
-    if (!isDir(join43(cwd, goDir))) continue;
-    for (const f of listFiles(join43(cwd, goDir), "_test.go")) {
+    if (!isDir(join44(cwd, goDir))) continue;
+    for (const f of listFiles(join44(cwd, goDir), "_test.go")) {
       const rel = `${goDir}/${f}`;
       let go;
       try {
-        go = readFileSync24(join43(cwd, rel), "utf8");
+        go = readFileSync25(join44(cwd, rel), "utf8");
       } catch {
         continue;
       }
@@ -287223,8 +287621,8 @@ function SetOutputTool(ctx, outputSchema) {
 
 // src/mcp/policy.ts
 import { spawnSync as spawnSync8 } from "node:child_process";
-import { existsSync as existsSync12, readFileSync as readFileSync25 } from "node:fs";
-import { join as join44 } from "node:path";
+import { existsSync as existsSync11, readFileSync as readFileSync26 } from "node:fs";
+import { join as join45 } from "node:path";
 function parseConftestOutput(stdout) {
   let parsed2;
   try {
@@ -287258,7 +287656,7 @@ var CONFTEST_CONFIG = "conftest.toml";
 function conftestSelectsNamespaces(conftestCwd) {
   let raw2;
   try {
-    raw2 = readFileSync25(join44(conftestCwd, CONFTEST_CONFIG), "utf-8");
+    raw2 = readFileSync26(join45(conftestCwd, CONFTEST_CONFIG), "utf-8");
   } catch {
     return false;
   }
@@ -287274,8 +287672,8 @@ function namespaceArgs(conftestCwd) {
 }
 function findPlanJson(cwd) {
   for (const candidate of PLAN_JSON_NAMES) {
-    const abs = join44(cwd, candidate);
-    if (existsSync12(abs)) return abs;
+    const abs = join45(cwd, candidate);
+    if (existsSync11(abs)) return abs;
   }
   return null;
 }
@@ -287316,11 +287714,11 @@ function resolvePolicyDir(cwd, explicit) {
     } catch {
       return null;
     }
-    return existsSync12(abs) ? abs : null;
+    return existsSync11(abs) ? abs : null;
   }
   for (const d of DEFAULT_POLICY_DIRS) {
-    const abs = join44(cwd, d);
-    if (existsSync12(abs)) return abs;
+    const abs = join45(cwd, d);
+    if (existsSync11(abs)) return abs;
   }
   return null;
 }
@@ -287354,7 +287752,7 @@ function PolicyCheckTool(ctx) {
         } catch {
           abs = null;
         }
-        targetFile = abs && existsSync12(abs) ? abs : null;
+        targetFile = abs && existsSync11(abs) ? abs : null;
         if (!targetFile) {
           return toolSkip(
             "target_not_found",
@@ -287627,9 +288025,9 @@ function PullRequestInfoTool(ctx) {
 
 // node_modules/.pnpm/@infraweaver-io+sandbox@0.1.8/node_modules/@infraweaver-io/sandbox/dist/writePolicy.js
 import { renameSync, writeFileSync as writeFileSync13 } from "node:fs";
-import { join as join45 } from "node:path";
+import { join as join46 } from "node:path";
 function writePolicyPath(tmpdir5, filename) {
-  return join45(tmpdir5, filename);
+  return join46(tmpdir5, filename);
 }
 function publishWritePolicy(params) {
   try {
@@ -287800,12 +288198,12 @@ function SelectModeTool(ctx) {
 }
 
 // src/mcp/terraform/tools/advise.ts
-import { existsSync as existsSync13, readFileSync as readFileSync27 } from "node:fs";
-import { join as join47 } from "node:path";
+import { existsSync as existsSync12, readFileSync as readFileSync28 } from "node:fs";
+import { join as join48 } from "node:path";
 
 // src/mcp/terraform/fixMemory.ts
-import { readFileSync as readFileSync26 } from "node:fs";
-import { join as join46 } from "node:path";
+import { readFileSync as readFileSync27 } from "node:fs";
+import { join as join47 } from "node:path";
 var FIX_MEMORY_FILENAME = FIX_MEMORY_FILE;
 var MAX_DESCRIPTION = 400;
 var MAX_BEFORE_EXAMPLE = 1200;
@@ -287892,7 +288290,7 @@ function loadFixMemory(cwd) {
   const root = cwd ?? process.cwd();
   for (const filename of [FIX_MEMORY_FILENAME, LEGACY_FIX_MEMORY_FILENAME]) {
     try {
-      return parseFixMemory(readFileSync26(join46(root, filename), "utf-8")) ?? [];
+      return parseFixMemory(readFileSync27(join47(root, filename), "utf-8")) ?? [];
     } catch {
     }
   }
@@ -287958,10 +288356,10 @@ function inlineWaivers(content, file2) {
   ];
 }
 function readLearnings(tmpdir5) {
-  const path15 = join47(tmpdir5, LEARNINGS_FILE);
-  if (!existsSync13(path15)) return [];
+  const path15 = join48(tmpdir5, LEARNINGS_FILE);
+  if (!existsSync12(path15)) return [];
   try {
-    return readFileSync27(path15, "utf-8").split("\n");
+    return readFileSync28(path15, "utf-8").split("\n");
   } catch {
     return [];
   }
@@ -287980,7 +288378,7 @@ function runAdvise(ctx, input2) {
   const learnings = readLearnings(ctx.tmpdir);
   const openConcerns = session.lastScanConcerns;
   const dossiers = files.map((file2) => {
-    const content = readTextCapped(join47(cwd, file2));
+    const content = readTextCapped(join48(cwd, file2));
     const inline = content === null ? [] : inlineWaivers(content, file2);
     const reviewedInline = reviewedCopy(
       cwd,
@@ -289318,8 +289716,8 @@ function ConsolidationCandidatesTool(ctx) {
 }
 
 // src/mcp/terraform/tools/detectPlanDrift.ts
-import { readFileSync as readFileSync28 } from "node:fs";
-import { join as join48 } from "node:path";
+import { readFileSync as readFileSync29 } from "node:fs";
+import { join as join49 } from "node:path";
 
 // src/mcp/terraform/cspm.ts
 var ExternalResource = type({
@@ -289737,7 +290135,7 @@ function readTfFiles(cwd) {
   const out = [];
   for (const file2 of walkTfFiles(cwd)) {
     try {
-      out.push({ file: file2, hcl: readFileSync28(join48(cwd, file2), "utf8") });
+      out.push({ file: file2, hcl: readFileSync29(join49(cwd, file2), "utf8") });
     } catch {
     }
   }
@@ -289754,7 +290152,7 @@ function DetectPlanDriftTool(ctx) {
       const planPath = path15 || !envPlanPath ? resolveWithinCwd(cwd, path15 ?? "plan.json") : envPlanPath;
       let raw2;
       try {
-        raw2 = readFileSync28(planPath, "utf8");
+        raw2 = readFileSync29(planPath, "utf8");
       } catch {
         return skipResult(
           "plan_artifact_not_found",
@@ -289824,7 +290222,8 @@ function DetectPlanDriftTool(ctx) {
         autonomyThreshold,
         // drift is a narrow concern source — join any prior scan baseline so a
         // later ✗→✓ verify doesn't read the whole workspace as regressions.
-        baselineMode: "merge"
+        baselineMode: "merge",
+        openRemediationPrs: await listOpenRemediationPrs(ctx)
       });
       log2.info(
         `\xBB detect_plan_drift: ${active.length} drifted resource(s) \u2265 ${threshold} from ${planPath}` + (noiseFiltered.length ? `, ${noiseFiltered.length} noise-filtered` : "") + (unlocated.length ? `, ${unlocated.length} unlocated` : "") + (statefulForgotten.length ? `, ${statefulForgotten.length} STATEFUL forget(s)` : "") + (suppressed.length ? ` (${suppressed.length} suppressed)` : "")
@@ -289886,13 +290285,13 @@ function DetectPlanDriftTool(ctx) {
 }
 
 // src/mcp/terraform/tools/emitCost.ts
-import { readFileSync as readFileSync29, writeFileSync as writeFileSync14 } from "node:fs";
-import { join as join49 } from "node:path";
+import { readFileSync as readFileSync30, writeFileSync as writeFileSync14 } from "node:fs";
+import { join as join50 } from "node:path";
 
 // src/mcp/terraform/awsPrices.ts
 var AWS_PRICE_REGION = "eu-west-2";
 var AWS_PRICE_CURRENCY = "USD";
-var AWS_PRICE_FETCHED_AT = "2026-09-23";
+var AWS_PRICE_FETCHED_AT = "2026-10-03";
 var AWS_HOURLY_PRICES = {
   "eks-cluster-standard": 0.1,
   "elb-application": 0.02646,
@@ -289910,30 +290309,30 @@ var AWS_PER_GB_PRICES = {
 // src/mcp/terraform/azurePrices.ts
 var AZURE_PRICE_REGION = "westeurope";
 var AZURE_PRICE_CURRENCY = "EUR";
-var AZURE_PRICE_FETCHED_AT = "2026-09-03";
+var AZURE_PRICE_FETCHED_AT = "2026-10-03";
 var AZURE_HOURLY_PRICES = {
-  "app-service-p0v3": 0.0764,
-  "app-service-p1v3": 0.1528,
-  "app-service-p2v3": 0.3057,
-  "app-service-p3v3": 0.6114,
-  "bastion-basic": 0.1631,
-  "bastion-premium": 0.3864,
-  "bastion-standard": 0.249,
-  "firewall-basic": 0.3392,
-  "firewall-premium": 1.5027,
-  "firewall-standard": 1.0733,
-  "redis-c0": 0.0236,
-  "redis-c1": 0.0592,
-  "redis-c2": 0.0962,
-  "redis-c3": 0.1932,
-  "redis-p1": 0.2378,
-  "redis-p2": 0.4766,
-  "redis-p3": 0.9523,
-  "vpn-gateway-vpngw1": 0.1631,
-  "vpn-gateway-vpngw2": 0.4207,
-  "vpn-gateway-vpngw3": 1.0733,
-  "vpn-gateway-vpngw4": 1.8032,
-  "vpn-gateway-vpngw5": 3.1341
+  "app-service-p0v3": 0.0783,
+  "app-service-p1v3": 0.1566,
+  "app-service-p2v3": 0.3133,
+  "app-service-p3v3": 0.6265,
+  "bastion-basic": 0.1672,
+  "bastion-premium": 0.396,
+  "bastion-standard": 0.2552,
+  "firewall-basic": 0.3476,
+  "firewall-premium": 1.54,
+  "firewall-standard": 1.1,
+  "redis-c0": 0.0242,
+  "redis-c1": 0.0607,
+  "redis-c2": 0.0986,
+  "redis-c3": 0.198,
+  "redis-p1": 0.2438,
+  "redis-p2": 0.4884,
+  "redis-p3": 0.9759,
+  "vpn-gateway-vpngw1": 0.1672,
+  "vpn-gateway-vpngw2": 0.4312,
+  "vpn-gateway-vpngw3": 1.1,
+  "vpn-gateway-vpngw4": 1.8479,
+  "vpn-gateway-vpngw5": 3.2119
 };
 
 // src/mcp/terraform/idleFloor.ts
@@ -290211,7 +290610,7 @@ function readTfFiles2(cwd) {
   const out = [];
   for (const file2 of walkTfFiles(cwd)) {
     try {
-      out.push({ file: file2, hcl: readFileSync29(join49(cwd, file2), "utf8") });
+      out.push({ file: file2, hcl: readFileSync30(join50(cwd, file2), "utf8") });
     } catch {
     }
   }
@@ -290316,7 +290715,7 @@ function buildSuppressionSummary(waivers) {
 }
 
 // node_modules/.pnpm/@infraweaver-io+attest@0.1.7_supports-color@7.2.0/node_modules/@infraweaver-io/attest/dist/signing.js
-import { createHash as createHash10, createPrivateKey, createPublicKey, sign as cryptoSign, verify as cryptoVerify } from "node:crypto";
+import { createHash as createHash11, createPrivateKey, createPublicKey, sign as cryptoSign, verify as cryptoVerify } from "node:crypto";
 var SIGNATURE_ALGORITHM = "Ed25519";
 var DEFAULT_KEY_LABEL = "the signing key";
 function loadSigningKey(raw2, options) {
@@ -290343,7 +290742,7 @@ function loadSigningKey(raw2, options) {
   return {
     privateKey,
     publicKeyPem,
-    fingerprint: createHash10("sha256").update(spkiDer).digest("hex")
+    fingerprint: createHash11("sha256").update(spkiDer).digest("hex")
   };
 }
 function signBytes(bytes, key) {
@@ -290578,7 +290977,7 @@ function buildEvidenceBundle(args2) {
 // node_modules/.pnpm/@infraweaver-io+attest@0.1.7_supports-color@7.2.0/node_modules/@infraweaver-io/attest/dist/keyless.js
 var import_bundle = __toESM(require_dist6(), 1);
 var import_sign = __toESM(require_dist9(), 1);
-import { createHash as createHash11 } from "node:crypto";
+import { createHash as createHash12 } from "node:crypto";
 
 // node_modules/.pnpm/@infraweaver-io+attest@0.1.7_supports-color@7.2.0/node_modules/@infraweaver-io/attest/dist/keylessOidc.js
 var SIGSTORE_OIDC_AUDIENCE = "sigstore";
@@ -290607,7 +291006,7 @@ function keylessSigningPossible(env2, envName) {
 }
 function buildInTotoStatement(args2) {
   const data = typeof args2.artifactBytes === "string" ? Buffer.from(args2.artifactBytes, "utf8") : args2.artifactBytes;
-  const sha2562 = createHash11("sha256").update(data).digest("hex");
+  const sha2562 = createHash12("sha256").update(data).digest("hex");
   return {
     _type: "https://in-toto.io/Statement/v1",
     subject: [{ name: args2.subjectName, digest: { sha256: sha2562 } }],
@@ -290817,12 +291216,12 @@ import { mkdirSync as mkdirSync5 } from "node:fs";
 import { dirname as dirname6 } from "node:path";
 
 // src/mcp/terraform/oscal.ts
-import { createHash as createHash12 } from "node:crypto";
+import { createHash as createHash13 } from "node:crypto";
 var OSCAL_VERSION = "1.1.2";
 var INDICATIVE_REMARK = "Indicative, crosswalk-derived assessment from a deterministic starter rule-pack \u2014 NOT a formal OSCAL assessment against an authored assessment plan. Statuses are code-verified only; absence of a finding is not proof of compliance.";
 var NS = "https://infraweaver.io/ns/oscal";
 function deterministicUuid(seed) {
-  const hex4 = createHash12("sha256").update(seed).digest("hex").slice(0, 32).split("");
+  const hex4 = createHash13("sha256").update(seed).digest("hex").slice(0, 32).split("");
   hex4[12] = "5";
   hex4[16] = (Number.parseInt(hex4[16] ?? "0", 16) & 3 | 8).toString(16);
   const u = hex4.join("");
@@ -291475,7 +291874,7 @@ function TerraformEmitVexTool(ctx) {
 // src/mcp/terraform/tools/equivalenceCheck.ts
 import { mkdtempSync as mkdtempSync5, rmSync as rmSync7 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
-import { join as join50 } from "node:path";
+import { join as join51 } from "node:path";
 
 // src/mcp/terraform/refactor/attribution.ts
 import { posix as posix13 } from "node:path";
@@ -291938,16 +292337,32 @@ function uncoveredInstanceKeys(p) {
   if (expected === null) return null;
   const kind = level[0].kind;
   const written = (k) => kind === "count" ? k : `"${k}"`;
+  const fromAt = level[0].at;
+  const toAt = p.after.multiplicity[0]?.at;
+  if (fromAt === void 0 || toAt === void 0) return null;
   const declared2 = /* @__PURE__ */ new Set();
   for (const blk of p.blocks) {
+    if (stripIndices(normaliseAddress(blk.from)) !== p.before.address || stripIndices(normaliseAddress(blk.to)) !== p.after.address)
+      return null;
     const from = instanceKeysOf(blk.from);
     const to = instanceKeysOf(blk.to);
     if (from.length > 1 || to.length > 1) return null;
     if (from.length === 0 && to.length === 0) return null;
-    if (from.length === 1 && to.length === 1 && from[0] === to[0]) declared2.add(from[0]);
+    if (from.length !== 1 || to.length !== 1 || from[0] !== to[0]) continue;
+    const fromPlaced = keyAtLevel(blk.from, fromAt);
+    const toPlaced = keyAtLevel(blk.to, toAt);
+    if (fromPlaced === false || toPlaced === false) continue;
+    if (fromPlaced === null || toPlaced === null) return null;
+    declared2.add(from[0]);
   }
   return expected.filter((k) => !declared2.has(written(k)));
 }
+function keyAtLevel(address, at) {
+  const onResource = instanceKeysOf(stripModuleHops(normaliseAddress(address))).length > 0;
+  if (at === "resource") return onResource;
+  if (onResource) return false;
+  return moduleHops(address).length === 1 ? true : null;
+}
 function computeEquivalence(before, after, movedBlocks, ambiguous = [], planPairs, opts = {}) {
   const reasons = [];
   const corr = correspond(before, after, movedBlocks);
@@ -293267,12 +293682,12 @@ async function baselineValidateErrors(cwd, base, env2, session) {
   }
   const prefix2 = run("git", ["rev-parse", "--show-prefix"], cwd);
   if (prefix2.status !== 0) return null;
-  const tree = mkdtempSync5(join50(tmpdir3(), "iw-baseline-"));
+  const tree = mkdtempSync5(join51(tmpdir3(), "iw-baseline-"));
   try {
     if (run("git", ["worktree", "add", "--detach", "--quiet", tree, base], cwd).status !== 0) {
       return null;
     }
-    const outcome2 = await scanValidate(join50(tree, prefix2.stdout.trim()), env2);
+    const outcome2 = await scanValidate(join51(tree, prefix2.stdout.trim()), env2);
     if (!outcome2.ran || outcome2.unvalidated) return null;
     const errors = outcome2.concerns.map(validateErrorKey);
     session.baselineValidateErrors = { base, errors };
@@ -293373,7 +293788,7 @@ function TerraformGenerateMovedTool(ctx) {
 
 // src/mcp/terraform/cost.ts
 import { mkdtempSync as mkdtempSync6, rmSync as rmSync8 } from "node:fs";
-import { join as join51 } from "node:path";
+import { join as join52 } from "node:path";
 function parseInfracostBreakdown(stdout) {
   const parsed2 = parseScannerJson(InfracostBreakdownOutput, stdout, "infracost");
   const raw2 = parsed2.totalMonthlyCost;
@@ -293455,15 +293870,15 @@ async function infracostBaseline(cwd, key, tmpdir5) {
   if (!baseRef) return null;
   const prefixResult = run("git", ["rev-parse", "--show-prefix"], cwd);
   const prefix2 = prefixResult.status === 0 ? prefixResult.stdout.trim() : "";
-  const baseDir = mkdtempSync6(join51(tmpdir5, "infracost-base-"));
-  const worktree = join51(baseDir, "wt");
+  const baseDir = mkdtempSync6(join52(tmpdir5, "infracost-base-"));
+  const worktree = join52(baseDir, "wt");
   const add = run("git", ["worktree", "add", "--detach", worktree, baseRef], cwd);
   if (add.status !== 0) {
     rmSync8(baseDir, { recursive: true, force: true });
     return null;
   }
   try {
-    const scanCwd = prefix2 ? join51(worktree, prefix2) : worktree;
+    const scanCwd = prefix2 ? join52(worktree, prefix2) : worktree;
     const r = await runInfracostBreakdown(scanCwd, key);
     if (r.missing || r.status !== 0) return null;
     return parseInfracostBreakdown(r.stdout);
@@ -293534,7 +293949,7 @@ function InfracostDiffTool(ctx) {
 
 // src/mcp/terraform/tools/ingestExternalFindings.ts
 import { statSync as statSync8 } from "node:fs";
-import { join as join52 } from "node:path";
+import { join as join53 } from "node:path";
 
 // src/mcp/terraform/prowlerOcsf.ts
 var DETECTION_FINDING_CREATE = 200401;
@@ -293760,7 +294175,7 @@ var MAX_FEED_BYTES = 100 * 1024 * 1024;
 function readTfFiles3(cwd) {
   const out = [];
   for (const file2 of walkTfFiles(cwd)) {
-    const hcl2 = readTextCapped(join52(cwd, file2));
+    const hcl2 = readTextCapped(join53(cwd, file2));
     if (hcl2 !== null) out.push({ file: file2, hcl: hcl2 });
   }
   return out;
@@ -293874,7 +294289,8 @@ function IngestExternalFindingsTool(ctx) {
         // an external feed is a narrow concern source — join any prior scan
         // baseline so a later ✗→✓ verify doesn't read the workspace as regressions.
         baselineMode: "merge",
-        seedCaps: seedCapsFrom(input2)
+        seedCaps: seedCapsFrom(input2),
+        openRemediationPrs: await listOpenRemediationPrs(ctx)
       });
       const cappedBlock = cappedSummary(capped);
       log2.info(
@@ -293917,8 +294333,8 @@ function IngestExternalFindingsTool(ctx) {
 }
 
 // src/mcp/terraform/tools/moduleDocs.ts
-import { readFileSync as readFileSync30, writeFileSync as writeFileSync16 } from "node:fs";
-import { join as join53 } from "node:path";
+import { readFileSync as readFileSync31, writeFileSync as writeFileSync16 } from "node:fs";
+import { join as join54 } from "node:path";
 
 // src/mcp/terraform/moduleDocs.ts
 var VERDICT_CLAIM = {
@@ -294032,7 +294448,7 @@ function TerraformModuleDocsTool(ctx) {
         );
       }
       const absDir = resolveWithinCwd(cwd, module_dir);
-      const target = join53(absDir, "README.md");
+      const target = join54(absDir, "README.md");
       let gitHead = null;
       try {
         gitHead = $("git", ["rev-parse", "HEAD"], { cwd, log: false });
@@ -294040,7 +294456,7 @@ function TerraformModuleDocsTool(ctx) {
       }
       let existing = null;
       try {
-        existing = readFileSync30(target, "utf8");
+        existing = readFileSync31(target, "utf8");
       } catch {
       }
       const priorHead = readFooterGitHead(existing);
@@ -294344,15 +294760,13 @@ function NormalizationCandidatesTool(ctx) {
     parameters: NormalizationCandidatesParams,
     execute: execute(async () => {
       const cwd = ctx.payload.cwd ?? process.cwd();
-      const files = findNormalizationCandidates(cwd).filter(
-        (f) => ctx.payload.refactorExamples || !isExamplePath(f.file)
-      );
+      const library = libraryScope(cwd);
+      const files = findNormalizationCandidates(cwd).filter((f) => ctx.payload.refactorExamples || !isExamplePath(f.file)).map((f) => ({ ...reportOnly(library(f.file)), ...f }));
       const total = files.reduce((n, f) => n + f.count, 0);
       log2.info(
         `\xBB terraform_normalization_candidates: ${total} site(s) across ${files.length} file(s)`
       );
       return toolOk({
-        ...reportOnly(libraryRepoReason(cwd)),
         file_count: files.length,
         total,
         files,
@@ -294364,7 +294778,7 @@ function NormalizationCandidatesTool(ctx) {
 
 // src/mcp/terraform/tools/plan.ts
 import { rmSync as rmSync9 } from "node:fs";
-import { join as join54 } from "node:path";
+import { join as join55 } from "node:path";
 var PLAN_JSON_ARGS = ["plan", "-input=false", "-no-color", "-lock=false", "-json"];
 var planFileSeq = 0;
 async function capturePlanPairs(absDir, planFile, creds) {
@@ -294387,7 +294801,7 @@ async function planOneRoot(absDir, creds, tmpdir5) {
       skipReason: `terraform init failed: ${init.stderr.trim().slice(0, 200) || "unknown error"}`
     };
   }
-  const planFile = tmpdir5 ? join54(tmpdir5, `plan-${process.pid}-${planFileSeq++}.tfplan`) : void 0;
+  const planFile = tmpdir5 ? join55(tmpdir5, `plan-${process.pid}-${planFileSeq++}.tfplan`) : void 0;
   const plan = await runTfAsync(
     planFile ? [...PLAN_JSON_ARGS, `-out=${planFile}`] : PLAN_JSON_ARGS,
     absDir,
@@ -294757,8 +295171,8 @@ function TerraformProviderUpgradeTool(ctx) {
 }
 
 // src/mcp/terraform/tfquery.ts
-import { readFileSync as readFileSync31 } from "node:fs";
-import { join as join55 } from "node:path";
+import { readFileSync as readFileSync32 } from "node:fs";
+import { join as join56 } from "node:path";
 var TFQUERY_SUFFIX = ".tfquery.hcl";
 function parseQueryFile(hcl2) {
   return parseBlocks(hcl2, ["list"]).map((block) => {
@@ -294784,7 +295198,7 @@ function collectQueryInventory(cwd) {
   for (const rel of walkFilesBySuffix(cwd, TFQUERY_SUFFIX)) {
     let text;
     try {
-      text = readFileSync31(join55(cwd, rel), "utf8");
+      text = readFileSync32(join56(cwd, rel), "utf8");
     } catch {
       continue;
     }
@@ -294819,7 +295233,7 @@ function TerraformQueryInventoryTool(ctx) {
 }
 
 // src/mcp/terraform/tools/readFindings.ts
-import { readFileSync as readFileSync32 } from "node:fs";
+import { readFileSync as readFileSync33 } from "node:fs";
 var ReadFindingsParams = type({
   "path?": type.string.describe(
     "path to the Assessor's findings.json. Defaults to $INFRAWEAVER_FINDINGS_PATH, then ./findings.json in the workspace."
@@ -294844,7 +295258,7 @@ function ReadFindingsTool(ctx) {
       const findingsPath = path15 || !envFindingsPath ? resolveWithinCwd(cwd, path15 ?? "findings.json") : envFindingsPath;
       let raw2;
       try {
-        raw2 = readFileSync32(findingsPath, "utf8");
+        raw2 = readFileSync33(findingsPath, "utf8");
       } catch {
         return skipResult(
           "findings_not_found",
@@ -294887,7 +295301,8 @@ function ReadFindingsTool(ctx) {
         minRank,
         grouping,
         autonomyThreshold,
-        seedCaps: seedCapsFrom(input2)
+        seedCaps: seedCapsFrom(input2),
+        openRemediationPrs: await listOpenRemediationPrs(ctx)
       });
       const cappedBlock = cappedSummary(capped);
       log2.info(
@@ -295522,7 +295937,25 @@ async function runVerifyRemediation(ctx, { concern_ids, download_external_module
     if (key !== void 0) keyed.push({ id, key });
     else unkeyed.push(id);
   }
-  const keyedVerdict = partitionByKey(keyed, currentKeys);
+  const byKey = partitionByKey(keyed, currentKeys);
+  const read3 = fileReader(cwd);
+  const remainingKeyed = keyed.filter((k) => byKey.remaining.includes(k.id));
+  const atSite = new Set(
+    resolvedAtSite({
+      requested: remainingKeyed.map((k) => ({
+        ...k,
+        site: session.siteById?.get(k.id) ?? null,
+        file: reported.get(k.id)?.location.file
+      })),
+      current: currentConcerns.map((c) => ({ key: concernKeyOf(c), site: siteOf(c, read3) })),
+      firstSites: session.firstSitesByKey ?? /* @__PURE__ */ new Map(),
+      declared: (file2) => new Set(declaredAddresses2(read3(file2) ?? ""))
+    })
+  );
+  const keyedVerdict = {
+    resolved: [...byKey.resolved, ...byKey.remaining.filter((id) => atSite.has(id))],
+    remaining: byKey.remaining.filter((id) => !atSite.has(id))
+  };
   const fallbackVerdict = computeRemediationVerdict(unkeyed, new Set(currentIds));
   const resolved = [...keyedVerdict.resolved, ...fallbackVerdict.resolved];
   const remaining = [...keyedVerdict.remaining, ...fallbackVerdict.remaining];
@@ -298776,15 +299209,15 @@ async function startMcpHttpServer(ctx, options) {
 
 // src/mcp/terraform/policyGate.ts
 import {
-  existsSync as existsSync14,
+  existsSync as existsSync13,
   mkdirSync as mkdirSync7,
   mkdtempSync as mkdtempSync7,
   readdirSync as readdirSync9,
-  readFileSync as readFileSync34,
+  readFileSync as readFileSync35,
   writeFileSync as writeFileSync17
 } from "node:fs";
 import { tmpdir as osTmpdir } from "node:os";
-import { dirname as dirname8, isAbsolute as isAbsolute6, join as join57, relative as relative6, resolve as resolve8 } from "node:path";
+import { dirname as dirname8, isAbsolute as isAbsolute6, join as join58, relative as relative6, resolve as resolve8 } from "node:path";
 function coercePolicyRules(raw2) {
   const rules = [];
   const rejected = [];
@@ -299036,7 +299469,7 @@ function evaluateRulesStatically(cwd, rules, scope2 = { kind: "all", reason: ""
   const files = [];
   for (const rel of walk.files) {
     try {
-      files.push({ rel, text: readFileSync34(join57(cwd, rel), "utf-8") });
+      files.push({ rel, text: readFileSync35(join58(cwd, rel), "utf-8") });
     } catch {
     }
   }
@@ -299151,16 +299584,16 @@ function cloudEmittedRego(rules) {
 }
 function readOrEmpty(path15) {
   try {
-    return readFileSync34(path15, "utf-8");
+    return readFileSync35(path15, "utf-8");
   } catch {
     return "";
   }
 }
 function regoDirIn(root, skip) {
   for (const dir of DEFAULT_POLICY_DIRS) {
-    const abs = join57(root, dir);
-    if (existsSync14(abs) && walkFilesBySuffix(abs, ".rego").some(
-      (rel) => !skip(join57(dir, rel), readOrEmpty(join57(abs, rel)))
+    const abs = join58(root, dir);
+    if (existsSync13(abs) && walkFilesBySuffix(abs, ".rego").some(
+      (rel) => !skip(join58(dir, rel), readOrEmpty(join58(abs, rel)))
     )) {
       return dir;
     }
@@ -299168,14 +299601,14 @@ function regoDirIn(root, skip) {
   return null;
 }
 function withoutSkipped(root, dir, skip, tmpdir5) {
-  const abs = join57(root, dir);
-  const files = readdirSync9(abs, { recursive: true, withFileTypes: true }).filter((e) => e.isFile()).map((e) => relative6(abs, join57(e.parentPath, e.name)));
-  const kept = files.filter((rel) => !skip(join57(dir, rel), readOrEmpty(join57(abs, rel))));
+  const abs = join58(root, dir);
+  const files = readdirSync9(abs, { recursive: true, withFileTypes: true }).filter((e) => e.isFile()).map((e) => relative6(abs, join58(e.parentPath, e.name)));
+  const kept = files.filter((rel) => !skip(join58(dir, rel), readOrEmpty(join58(abs, rel))));
   if (kept.length === files.length) return abs;
-  const copy = join57(mkdtempSync7(join57(tmpdir5 ?? osTmpdir(), "policy-own-")), dir);
+  const copy = join58(mkdtempSync7(join58(tmpdir5 ?? osTmpdir(), "policy-own-")), dir);
   for (const rel of kept) {
-    mkdirSync7(dirname8(join57(copy, rel)), { recursive: true });
-    writeFileSync17(join57(copy, rel), readFileSync34(join57(abs, rel)));
+    mkdirSync7(dirname8(join58(copy, rel)), { recursive: true });
+    writeFileSync17(join58(copy, rel), readFileSync35(join58(abs, rel)));
   }
   return copy;
 }
@@ -299197,18 +299630,18 @@ function resolveRepoPolicy(cwd, baseRef, tmpdir5, notes, skip) {
     }
     const own2 = tree.files.filter((f) => !skip(f.path, f.raw));
     if (!own2.some((f) => f.path.endsWith(".rego"))) continue;
-    const root = mkdtempSync7(join57(tmpdir5 ?? osTmpdir(), "policy-base-"));
+    const root = mkdtempSync7(join58(tmpdir5 ?? osTmpdir(), "policy-base-"));
     for (const f of own2) {
-      mkdirSync7(dirname8(join57(root, f.path)), { recursive: true });
-      writeFileSync17(join57(root, f.path), f.raw);
+      mkdirSync7(dirname8(join58(root, f.path)), { recursive: true });
+      writeFileSync17(join58(root, f.path), f.raw);
     }
     const toml = readFileAtBaseRef(cwd, baseRef, CONFTEST_CONFIG);
-    if (toml.kind === "file") writeFileSync17(join57(root, CONFTEST_CONFIG), toml.raw);
-    const same = head === dir && readdirSync9(join57(cwd, dir), { recursive: true, withFileTypes: true }).filter(
+    if (toml.kind === "file") writeFileSync17(join58(root, CONFTEST_CONFIG), toml.raw);
+    const same = head === dir && readdirSync9(join58(cwd, dir), { recursive: true, withFileTypes: true }).filter(
       (e) => e.isFile()
     ).length === tree.files.length && tree.files.every((f) => {
       try {
-        return readFileSync34(join57(cwd, f.path), "utf-8") === f.raw;
+        return readFileSync35(join58(cwd, f.path), "utf-8") === f.raw;
       } catch {
         return false;
       }
@@ -299218,7 +299651,7 @@ function resolveRepoPolicy(cwd, baseRef, tmpdir5, notes, skip) {
         `the Rego policy differs from the base ref (${tree.ref}) \u2014 applying the BASE ${dir}/ so this change cannot relax the policy reviewing it. It takes effect once merged.`
       );
     }
-    return { policyDir: join57(root, dir), conftestCwd: root };
+    return { policyDir: join58(root, dir), conftestCwd: root };
   }
   if (head) {
     notes.push(
@@ -299228,7 +299661,7 @@ function resolveRepoPolicy(cwd, baseRef, tmpdir5, notes, skip) {
   return null;
 }
 function findWorkflowPlanJson(cwd, notes) {
-  const present = PLAN_JSON_NAMES.filter((name) => existsSync14(join57(cwd, name)));
+  const present = PLAN_JSON_NAMES.filter((name) => existsSync13(join58(cwd, name)));
   if (present.length === 0) return null;
   const listing = run("git", ["ls-files", "-z"], cwd);
   if (listing.status !== 0) {
@@ -299245,7 +299678,7 @@ function findWorkflowPlanJson(cwd, notes) {
       );
       continue;
     }
-    return join57(cwd, name);
+    return join58(cwd, name);
   }
   return null;
 }
@@ -299275,7 +299708,7 @@ function evaluatePolicyGate(cwd, rawRules, opts = {}) {
   let plan;
   if (planPath) {
     try {
-      plan = asPlan(JSON.parse(readFileSync34(planPath, "utf-8")));
+      plan = asPlan(JSON.parse(readFileSync35(planPath, "utf-8")));
     } catch {
     }
     if (!plan) notes.push(`${planPath} is not a Terraform plan JSON \u2014 ignored`);
@@ -299378,7 +299811,7 @@ function capturePolicyGate(ctx) {
     if (!result) return;
     const workspace = process.env.GITHUB_WORKSPACE ?? cwd;
     for (const o of [...result.violations, ...result.inconclusive]) {
-      if (o.file) o.file = posix16(relative6(workspace, join57(cwd, o.file)));
+      if (o.file) o.file = posix16(relative6(workspace, join58(cwd, o.file)));
     }
     session.policyGate = result;
     for (const n of result.notes) log2.warning(`\xBB policy gate: ${n}`);
@@ -299713,7 +300146,7 @@ var ThinkingTimer = class {
 // src/agents/claude.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
 import { chmodSync as chmodSync3, mkdirSync as mkdirSync10, writeFileSync as writeFileSync22 } from "node:fs";
-import { join as join66 } from "node:path";
+import { join as join67 } from "node:path";
 import { performance as performance6 } from "node:perf_hooks";
 import { setTimeout as sleep6 } from "node:timers/promises";
 
@@ -300073,7 +300506,7 @@ import { readFile as readFile2 } from "node:fs/promises";
 
 // src/agents/shared.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { join as join58 } from "node:path";
+import { join as join59 } from "node:path";
 var MAX_STDERR_LINES = 20;
 var MAX_POST_RUN_RETRIES = 3;
 function getGitStatus() {
@@ -300110,7 +300543,7 @@ var agent = (input2) => {
   };
 };
 function agentHomeEnv(tmpdir5) {
-  return { HOME: tmpdir5, XDG_CONFIG_HOME: join58(tmpdir5, ".config") };
+  return { HOME: tmpdir5, XDG_CONFIG_HOME: join59(tmpdir5, ".config") };
 }
 function baseAgentEnv(homeEnv, repoDir) {
   return { ...process.env, ...homeEnv, PWD: repoDir };
@@ -300587,9 +301020,9 @@ function shouldRunGraceTurn(params) {
 }
 
 // src/agents/quotaTokens.ts
-var CACHE_READ_WEIGHT = 0.1;
-function quotaTokens(t) {
-  return t.input + t.output + t.cacheWrite + t.cacheRead * CACHE_READ_WEIGHT;
+var CACHE_READ_WEIGHT2 = 0.1;
+function quotaTokens2(t) {
+  return t.input + t.output + (t.reasoning ?? 0) + t.cacheWrite + t.cacheRead * CACHE_READ_WEIGHT2;
 }
 
 // src/agents/sessionLabeler.ts
@@ -300913,7 +301346,7 @@ function matchesRouteSentinel(envVar, model) {
 import { randomUUID as randomUUID9 } from "node:crypto";
 import { mkdirSync as mkdirSync8, rmSync as rmSync10, writeFileSync as writeFileSync18 } from "node:fs";
 import { homedir } from "node:os";
-import { join as join59 } from "node:path";
+import { join as join60 } from "node:path";
 var VERTEX_SERVICE_ACCOUNT_JSON_ENV = "VERTEX_SERVICE_ACCOUNT_JSON";
 var GOOGLE_APPLICATION_CREDENTIALS_ENV = "GOOGLE_APPLICATION_CREDENTIALS";
 var GOOGLE_CLOUD_PROJECT_ENV = "GOOGLE_CLOUD_PROJECT";
@@ -300937,7 +301370,7 @@ function readProjectIdFromVertexServiceAccountJson() {
 }
 function createSecretDir() {
   const base = process.env.INFRAWEAVER_SECRET_HOME || process.env.HOME || homedir();
-  const secretDir = join59(base, `.${PRODUCT_SLUG}`, "secrets", randomUUID9());
+  const secretDir = join60(base, `.${PRODUCT_SLUG}`, "secrets", randomUUID9());
   mkdirSync8(secretDir, { recursive: true, mode: 448 });
   return secretDir;
 }
@@ -300946,7 +301379,7 @@ function materializeVertexCredentials(params) {
   const blob = process.env[VERTEX_SERVICE_ACCOUNT_JSON_ENV];
   if (!blob) return void 0;
   const secretDir = createSecretDir();
-  const credentialsPath = join59(secretDir, "vertex-sa.json");
+  const credentialsPath = join60(secretDir, "vertex-sa.json");
   writeFileSync18(credentialsPath, blob, { mode: 384 });
   process.env[GOOGLE_APPLICATION_CREDENTIALS_ENV] = credentialsPath;
   const projectId = readProjectIdFromVertexServiceAccountJson();
@@ -301082,29 +301515,29 @@ function createProcessOutputActivityTimeout(ctx) {
 }
 
 // src/utils/prompt/skills.ts
-import { existsSync as existsSync15, mkdirSync as mkdirSync9, readFileSync as readFileSync35, writeFileSync as writeFileSync19 } from "node:fs";
-import { dirname as dirname9, join as join60 } from "node:path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync9, readFileSync as readFileSync36, writeFileSync as writeFileSync19 } from "node:fs";
+import { dirname as dirname9, join as join61 } from "node:path";
 import { fileURLToPath } from "node:url";
 var BUNDLED_SKILL_NAMES = ["terraform-best-practices"];
 function resolveSkillPath(name) {
   const here = dirname9(fileURLToPath(import.meta.url));
   const candidates = [
-    join60(here, "..", "..", "skills", name, "SKILL.md"),
-    join60(here, "skills", name, "SKILL.md")
+    join61(here, "..", "..", "skills", name, "SKILL.md"),
+    join61(here, "skills", name, "SKILL.md")
   ];
   for (const candidate of candidates) {
-    if (existsSync15(candidate)) return candidate;
+    if (existsSync14(candidate)) return candidate;
   }
   throw new Error(`bundled skill not found: ${name} (looked in ${candidates.join(", ")})`);
 }
 var SKILL_TARGET_DIRS = [".opencode/skills", ".claude/skills", ".agents/skills"];
 function installBundledSkills(params) {
   for (const name of BUNDLED_SKILL_NAMES) {
-    const content = readFileSync35(resolveSkillPath(name), "utf8");
+    const content = readFileSync36(resolveSkillPath(name), "utf8");
     for (const targetDir of SKILL_TARGET_DIRS) {
-      const skillDir = join60(params.home, targetDir, name);
+      const skillDir = join61(params.home, targetDir, name);
       mkdirSync9(skillDir, { recursive: true });
-      writeFileSync19(join60(skillDir, "SKILL.md"), content);
+      writeFileSync19(join61(skillDir, "SKILL.md"), content);
     }
   }
   log2.success(`installed bundled skills: ${BUNDLED_SKILL_NAMES.join(", ")}`);
@@ -301112,9 +301545,9 @@ function installBundledSkills(params) {
 
 // src/utils/setup/install.ts
 import { spawnSync as spawnSync9 } from "node:child_process";
-import { createHash as createHash14 } from "node:crypto";
-import { chmodSync as chmodSync2, createWriteStream as createWriteStream2, existsSync as existsSync18, readFileSync as readFileSync36 } from "node:fs";
-import { join as join65 } from "node:path";
+import { createHash as createHash15 } from "node:crypto";
+import { chmodSync as chmodSync2, createWriteStream as createWriteStream2, existsSync as existsSync17, readFileSync as readFileSync37 } from "node:fs";
+import { join as join66 } from "node:path";
 import { pipeline as pipeline2 } from "node:stream/promises";
 
 // src/utils/setup/tarballCache.ts
@@ -301169,7 +301602,7 @@ function verifyTarballIntegrity(tarballPath, dist, descriptor) {
       `Refusing to install ${descriptor}: the registry published no integrity digest (neither dist.integrity nor dist.shasum), so the download cannot be verified.`
     );
   }
-  const bytes = readFileSync36(tarballPath);
+  const bytes = readFileSync37(tarballPath);
   if (integrity2) {
     const candidates = integrity2.trim().split(/\s+/).filter(Boolean);
     for (const candidate of candidates) {
@@ -301179,7 +301612,7 @@ function verifyTarballIntegrity(tarballPath, dist, descriptor) {
       const expected = candidate.slice(separator2 + 1);
       let actual;
       try {
-        actual = createHash14(algorithm).update(bytes).digest("base64");
+        actual = createHash15(algorithm).update(bytes).digest("base64");
       } catch {
         continue;
       }
@@ -301189,7 +301622,7 @@ function verifyTarballIntegrity(tarballPath, dist, descriptor) {
       `Integrity check FAILED for ${descriptor}: the downloaded tarball does not match the registry's published digest (${integrity2}). Refusing to execute it.`
     );
   }
-  const actualShasum = createHash14("sha1").update(bytes).digest("hex");
+  const actualShasum = createHash15("sha1").update(bytes).digest("hex");
   if (actualShasum !== shasum) {
     throw new Error(
       `Integrity check FAILED for ${descriptor}: the downloaded tarball does not match the registry's published shasum (expected ${shasum}, got ${actualShasum}). Refusing to execute it.`
@@ -301198,9 +301631,9 @@ function verifyTarballIntegrity(tarballPath, dist, descriptor) {
 }
 async function installFromNpmTarball(params) {
   const tempDir = getTempDir();
-  const extractedDir = join65(tempDir, "package");
-  const cliPath = join65(extractedDir, params.executablePath);
-  if (existsSync18(cliPath)) {
+  const extractedDir = join66(tempDir, "package");
+  const cliPath = join66(extractedDir, params.executablePath);
+  if (existsSync17(cliPath)) {
     log2.debug(`\xBB using cached binary at ${cliPath}`);
     return cliPath;
   }
@@ -301251,7 +301684,7 @@ async function installFromNpmTarball(params) {
     dist = (await manifestResponse.json()).dist;
   }
   log2.debug(`\xBB installing ${params.packageName}@${resolvedVersion}...`);
-  const tarballPath = join65(tempDir, "package.tgz");
+  const tarballPath = join66(tempDir, "package.tgz");
   const tarballFileName = params.packageName.startsWith("@") ? params.packageName.split("/")[1] : params.packageName;
   const tarballUrl = `${npmRegistry}/${encodedName}/-/${tarballFileName}-${resolvedVersion}.tgz`;
   const restored = await restoreTarball({
@@ -301291,7 +301724,7 @@ async function installFromNpmTarball(params) {
       `Failed to extract tarball: ${extractResult.stderr || extractResult.stdout || "Unknown error"}`
     );
   }
-  if (!existsSync18(cliPath)) {
+  if (!existsSync17(cliPath)) {
     throw new Error(`Executable not found in extracted package at ${cliPath}`);
   }
   if (params.installDependencies) {
@@ -301402,9 +301835,9 @@ var CLAUDE_DISALLOWED_TOOLS = CLAUDE_EXEC_TOOL_DENY_RULES.join(",");
 var INFRAWEAVER_MCP_AUTH_HEADER = `Bearer \${${MCP_SERVER_TOKEN_ENV}}`;
 var CLAUDE_MAX_CONCURRENT_SUBAGENTS_DEFAULT = "4";
 function writeMcpConfig(ctx) {
-  const configDir = join66(ctx.tmpdir, ".claude");
+  const configDir = join67(ctx.tmpdir, ".claude");
   mkdirSync10(configDir, { recursive: true });
-  const configPath = join66(configDir, "mcp.json");
+  const configPath = join67(configDir, "mcp.json");
   const terraformMcp = resolveTerraformMcp(ctx.payload);
   if (terraformMcp.kind === "docker_missing") log2.info(`\xBB ${terraformMcp.note}`);
   const opentofuMcp = resolveOpenTofuMcp(ctx.payload);
@@ -301436,13 +301869,13 @@ function writeMcpConfig(ctx) {
   return configPath;
 }
 function writePretoolGateAssets(ctx, stopHookPath) {
-  const scriptPath = join66(ctx.tmpdir, CLAUDE_PRETOOL_GATE_FILENAME);
+  const scriptPath = join67(ctx.tmpdir, CLAUDE_PRETOOL_GATE_FILENAME);
   writeFileSync22(
     scriptPath,
     buildClaudePretoolGateSource(ctx.subagentDeniedTools, writePolicyPath2(ctx.tmpdir))
   );
   chmodSync3(scriptPath, 493);
-  const settingsPath = join66(ctx.tmpdir, "infraweaver-claude-settings.json");
+  const settingsPath = join67(ctx.tmpdir, "infraweaver-claude-settings.json");
   const settings = buildClaudePretoolGateSettings(scriptPath, CLAUDE_EXEC_TOOL_DENY_RULES);
   settings.permissions.deny.push(...harnessTmpdirWriteDenyClaude(ctx.tmpdir));
   if (stopHookPath) {
@@ -301531,7 +301964,7 @@ function timerFor(state5, label) {
 function chargeTokenQuota(state5) {
   const quota = state5.params.tokenQuota;
   if (!quota || state5.stopRun.signal.aborted) return;
-  if (!quota.observe(state5.quotaSource, quotaTokens(state5.accumulatedTokens))) return;
+  if (!quota.observe(state5.quotaSource, quotaTokens2(state5.accumulatedTokens))) return;
   log2.info(`\xBB ${state5.params.label}: ${quota.gap()}`);
   state5.stopRun.abort(new TokenQuotaExceededError(quota.gap()));
 }
@@ -302067,11 +302500,11 @@ var claude = agent({
       const onVertex = matchesRouteSentinel(VERTEX_MODEL_ID_ENV, specifier) && specifier !== void 0 && isVertexAnthropicId(specifier);
       const model = !specifier ? void 0 : onBedrock ? specifier : onVertex ? void 0 : stripProviderPrefix(specifier);
       const homeEnv = agentHomeEnv(ctx.tmpdir);
-      mkdirSync10(join66(homeEnv.XDG_CONFIG_HOME, "claude"), { recursive: true });
+      mkdirSync10(join67(homeEnv.XDG_CONFIG_HOME, "claude"), { recursive: true });
       installBundledSkills({ home: homeEnv.HOME });
       const mcpConfigPath = writeMcpConfig(ctx);
       const effort = resolveEffort(model);
-      const stopHookPath = join66(ctx.tmpdir, "infraweaver-stop-hook.sh");
+      const stopHookPath = join67(ctx.tmpdir, "infraweaver-stop-hook.sh");
       writeFileSync22(stopHookPath, buildStopHookScript(), { mode: 493 });
       const pretoolGate = writePretoolGateAssets(ctx, stopHookPath);
       installManagedSettings({
@@ -302237,7 +302670,7 @@ var claude = agent({
 init_core3();
 import { spawn as nodeSpawn2 } from "node:child_process";
 import { mkdirSync as mkdirSync12, writeFileSync as writeFileSync24 } from "node:fs";
-import { join as join68 } from "node:path";
+import { join as join69 } from "node:path";
 import { performance as performance7 } from "node:perf_hooks";
 import { StringDecoder as StringDecoder2 } from "node:string_decoder";
 import { setTimeout as sleep7 } from "node:timers/promises";
@@ -307920,7 +308353,7 @@ function autoSelectModel() {
 import { execFileSync as execFileSync4 } from "node:child_process";
 import { mkdirSync as mkdirSync11, writeFileSync as writeFileSync23 } from "node:fs";
 import { homedir as homedir3, userInfo as userInfo2 } from "node:os";
-import { join as join67 } from "node:path";
+import { join as join68 } from "node:path";
 
 // src/utils/agent/codexOAuth.ts
 init_webapi();
@@ -307974,8 +308407,8 @@ function installCodexAuth() {
   }
   const expiresMs = decodeJwtExpMs(body2.tokens.access_token) ?? 0;
   const xdgDataHome = resolveDataHome();
-  const opencodeDir = join67(xdgDataHome, "opencode");
-  const authPath = join67(opencodeDir, "auth.json");
+  const opencodeDir = join68(xdgDataHome, "opencode");
+  const authPath = join68(opencodeDir, "auth.json");
   const opencodeAuth = {
     openai: {
       type: "oauth",
@@ -307999,7 +308432,7 @@ function installCodexAuth() {
   };
 }
 function resolveDataHome() {
-  if (process.env.CI !== "true") return join67(homedir3(), ".local", "share");
+  if (process.env.CI !== "true") return join68(homedir3(), ".local", "share");
   bootstrapInfraweaverDataDir();
   return INFRAWEAVER_DATA_DIR;
 }
@@ -308263,7 +308696,7 @@ function newTurn() {
   turnCounter += 1;
   return {
     finalText: "",
-    tokens: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+    tokens: { input: 0, output: 0, reasoning: 0, cacheRead: 0, cacheWrite: 0 },
     costUsd: 0,
     sessionError: null,
     lastToolError: null,
@@ -308273,7 +308706,7 @@ function newTurn() {
 function chargeTokenQuota2(ctx) {
   const quota = ctx.tokenQuota;
   if (!quota || !ctx.currentTurn || ctx.tokenQuotaExceeded) return;
-  if (!quota.observe(ctx.currentTurn.quotaSource, quotaTokens(ctx.currentTurn.tokens))) return;
+  if (!quota.observe(ctx.currentTurn.quotaSource, quotaTokens2(ctx.currentTurn.tokens))) return;
   ctx.tokenQuotaExceeded = true;
   log2.info(`\xBB ${ctx.label}: ${quota.gap()}`);
   ctx.abortRun?.(new TokenQuotaExceededError(quota.gap()));
@@ -308382,6 +308815,7 @@ async function onPartUpdated(ctx, part) {
     if (t) {
       ctx.currentTurn.tokens.input += t.input || 0;
       ctx.currentTurn.tokens.output += t.output || 0;
+      ctx.currentTurn.tokens.reasoning += t.reasoning || 0;
       ctx.currentTurn.tokens.cacheRead += t.cache?.read || 0;
       ctx.currentTurn.tokens.cacheWrite += t.cache?.write || 0;
     }
@@ -308740,10 +309174,10 @@ var opencode = agent({
     const openAiCompatModel = resolveOpenAiCompatibleOpenCodeModel(rawModel);
     const model = isBedrockRoute ? `amazon-bedrock/${rawModel}` : vertexModel ?? openAiCompatModel ?? rawModel;
     const homeEnv = agentHomeEnv(ctx.tmpdir);
-    const opencodePluginDir = join68(homeEnv.XDG_CONFIG_HOME, "opencode", "plugin");
+    const opencodePluginDir = join69(homeEnv.XDG_CONFIG_HOME, "opencode", "plugin");
     mkdirSync12(opencodePluginDir, { recursive: true });
     writeFileSync24(
-      join68(opencodePluginDir, INFRAWEAVER_OPENCODE_GATE_PLUGIN_FILENAME),
+      join69(opencodePluginDir, INFRAWEAVER_OPENCODE_GATE_PLUGIN_FILENAME),
       buildOpencodeSubagentGateSource(ctx.subagentDeniedTools, writePolicyPath2(ctx.tmpdir))
     );
     installBundledSkills({ home: homeEnv.HOME });
@@ -308986,10 +309420,10 @@ var DispatchRecorder = class {
    * orchestrator counts as subagent — including a session the labeler could not
    * name, because an unnamed session is by definition not the orchestrator's.
    */
-  recordTokens(label, billableTokens2) {
-    if (!Number.isFinite(billableTokens2) || billableTokens2 <= 0) return;
-    if (label === ORCHESTRATOR_LABEL) this.#orchestratorTokens += billableTokens2;
-    else this.#subagentTokens += billableTokens2;
+  recordTokens(label, billableTokens) {
+    if (!Number.isFinite(billableTokens) || billableTokens <= 0) return;
+    if (label === ORCHESTRATOR_LABEL) this.#orchestratorTokens += billableTokens;
+    else this.#subagentTokens += billableTokens;
   }
   tally() {
     return {
@@ -309779,7 +310213,7 @@ async function fetchRunContext(params) {
 // src/utils/github/github.ts
 init_core3();
 import { rename as rename2, writeFile as writeFile2 } from "node:fs/promises";
-import { dirname as dirname12, join as join69 } from "node:path";
+import { dirname as dirname12, join as join70 } from "node:path";
 
 // node_modules/.pnpm/universal-user-agent@7.0.3/node_modules/universal-user-agent/index.js
 function getUserAgent2() {
@@ -309878,8 +310312,8 @@ function addQueryParameters(url5, parameters) {
   }).join("&");
 }
 var urlVariableRegex = /\{[^{}}]+\}/g;
-function removeNonChars(variableName) {
-  return variableName.replace(/(?:^\W+)|(?:(?<!\W)\W+$)/g, "").split(/,/);
+function removeNonChars(variableName2) {
+  return variableName2.replace(/(?:^\W+)|(?:(?<!\W)\W+$)/g, "").split(/,/);
 }
 function extractUrlVariableNames(url5) {
   const matches2 = url5.match(urlVariableRegex);
@@ -315595,7 +316029,7 @@ function getGitHubUsageSummary() {
 }
 async function writeGitHubUsageSummaryToFile(path15) {
   const summary2 = getGitHubUsageSummary();
-  const tmpPath = join69(dirname12(path15), `.usage-summary-${process.pid}.tmp`);
+  const tmpPath = join70(dirname12(path15), `.usage-summary-${process.pid}.tmp`);
   await writeFile2(tmpPath, JSON.stringify(summary2));
   await rename2(tmpPath, path15);
 }
@@ -316140,7 +316574,7 @@ async function resolveModelAndAuth(params) {
 // src/utils/run/runLifecycle.ts
 init_core3();
 import { writeFile as writeFile5 } from "node:fs/promises";
-import { join as join72, resolve as resolve10 } from "node:path";
+import { join as join73, resolve as resolve10 } from "node:path";
 
 // src/utils/cloud/cloudReport.ts
 init_core3();
@@ -316534,7 +316968,7 @@ async function reportToCloud(input2) {
 
 // src/utils/cloud/learnings.ts
 import { mkdir as mkdir3, readFile as readFile3, writeFile as writeFile3 } from "node:fs/promises";
-import { dirname as dirname13, join as join70 } from "node:path";
+import { dirname as dirname13, join as join71 } from "node:path";
 
 // src/utils/cloud/learningsTruncate.ts
 var MAX_LEARNINGS_LENGTH = 1e5;
@@ -316551,7 +316985,7 @@ function truncateAtLineBoundary(body2, cap2) {
 // src/utils/cloud/learnings.ts
 var LEARNINGS_FILE_NAME = LEARNINGS_FILE;
 function learningsFilePath(tmpdir5) {
-  return join70(tmpdir5, LEARNINGS_FILE_NAME);
+  return join71(tmpdir5, LEARNINGS_FILE_NAME);
 }
 async function seedLearningsFile(params) {
   const path15 = learningsFilePath(params.tmpdir);
@@ -316682,7 +317116,7 @@ ${ctx.error}` : ctx.error;
 
 // src/utils/github/prSummary.ts
 import { mkdir as mkdir4, readFile as readFile4, writeFile as writeFile4 } from "node:fs/promises";
-import { dirname as dirname14, join as join71 } from "node:path";
+import { dirname as dirname14, join as join72 } from "node:path";
 var SUMMARY_FILE_NAME = SUMMARY_FILE;
 var SUMMARY_SCAFFOLD = `# PR summary
 
@@ -316692,7 +317126,7 @@ var SUMMARY_SCAFFOLD = `# PR summary
 var MIN_SNAPSHOT_LENGTH = 60;
 var MAX_SNAPSHOT_LENGTH = 32768;
 function summaryFilePath(tmpdir5) {
-  return join71(tmpdir5, SUMMARY_FILE_NAME);
+  return join72(tmpdir5, SUMMARY_FILE_NAME);
 }
 async function seedSummaryFile(params) {
   const path15 = summaryFilePath(params.tmpdir);
@@ -317226,7 +317660,7 @@ async function emitFindingsOutputs(toolState, requiredControls) {
       if (a.level === "error") error62(a.message, props);
       else warning(a.message, props);
     }
-    const sarifPath = join72(workspace, SARIF_FILE);
+    const sarifPath = join73(workspace, SARIF_FILE);
     if (session.emittedSarifPath && resolve10(session.emittedSarifPath) === resolve10(sarifPath)) {
       log2.info(`\xBB findings output: replacing the agent-emitted ${SARIF_FILE} with the gate's`);
     }
@@ -317558,7 +317992,7 @@ async function runAgentWithWatchdogs(params) {
   const tokenQuota = reserved ? quotas.token : createTokenQuota(quotas.tokenLimit.full);
   const costQuota = reserved ? quotas.cost : createCostQuota(quotas.costLimit.full);
   log2.info(
-    quotas.tokenLimit.full > 0 ? `\xBB run token quota: ${quotas.tokenLimit.full.toLocaleString("en-GB")} billable tokens` + (reserved ? ` (${tokenQuota.limit.toLocaleString("en-GB")} for the run, the rest reserved to deliver findings if it runs out)` : "") : `\xBB run token quota: disabled (${RUN_TOKEN_QUOTA_INPUT}: 0)`
+    quotas.tokenLimit.full > 0 ? `\xBB run token quota: ${quotas.tokenLimit.full.toLocaleString("en-GB")} tokens` + (reserved ? ` (${tokenQuota.limit.toLocaleString("en-GB")} for the run, the rest reserved to deliver findings if it runs out)` : "") + "; a token read from the prompt cache counts as a tenth" : `\xBB run token quota: disabled (${RUN_TOKEN_QUOTA_INPUT}: 0)`
   );
   log2.info(
     quotas.costLimit.full > 0 ? `\xBB run cost quota: $${quotas.costLimit.full.toFixed(2)}` + (reserved ? ` ($${costQuota.limit.toFixed(2)} for the run, the rest reserved to deliver findings if it runs out)` : "") : `\xBB run cost quota: disabled (${RUN_COST_QUOTA_INPUT}: 0)`
@@ -317656,9 +318090,9 @@ async function runAgentWithWatchdogs(params) {
 }
 
 // src/phases/startToolPlane.ts
-import { existsSync as existsSync19, readdirSync as readdirSync10 } from "node:fs";
+import { existsSync as existsSync18, readdirSync as readdirSync10 } from "node:fs";
 import { readFile as readFile5 } from "node:fs/promises";
-import { join as join73 } from "node:path";
+import { join as join74 } from "node:path";
 
 // src/utils/cloud/runTerminalStatus.ts
 var TERMINAL_STATE_KEY = "run_terminal";
@@ -318486,8 +318920,8 @@ ${instructions.user}` : null,
     log2.info(instructions.full);
   });
   if (toolContext.agentId === "opencode") {
-    const pluginDir = join73(process.cwd(), ".opencode", "plugin");
-    const hasPlugins = existsSync19(pluginDir) && readdirSync10(pluginDir).some((f) => /\.[jt]sx?$/.test(f));
+    const pluginDir = join74(process.cwd(), ".opencode", "plugin");
+    const hasPlugins = existsSync18(pluginDir) && readdirSync10(pluginDir).some((f) => /\.[jt]sx?$/.test(f));
     if (hasPlugins && toolState.dependencyInstallation?.promise) {
       log2.info(
         "\xBB .opencode/plugin/ detected \u2014 awaiting dependency installation before agent start"