infraweaver 0.3.11 → 0.3.13

package/src/mcp/git.ts

@@ -948,19 +948,68 @@ export const Git = type({
   args: type.string.array().describe("Additional arguments for the git command").optional(),
 });
 
-/** a command line split into words, honouring single and double quotes. */
+/**
+ * A command line split into words the way a POSIX shell splits it, with no
+ * expansion: a quote may open mid-word and is removed (`--message="a b"` is
+ * the one word `--message=a b`), single quotes are literal, a backslash
+ * escapes the next character outside them (inside double quotes only `"`,
+ * `\`, `$` and `` ` ``), and adjacent parts join into one word. What a shell
+ * would read differently — an unterminated quote, a trailing backslash, an
+ * unquoted newline (a second command) — throws instead of being guessed at.
+ */
 function splitWords(line: string): string[] {
-  return [...line.matchAll(/"([^"]*)"|'([^']*)'|(\S+)/g)].map((m) => m[1] ?? m[2] ?? m[3] ?? "");
+  const words: string[] = [];
+  let word = "";
+  let inWord = false;
+  let quote: "'" | '"' | undefined;
+  for (let i = 0; i < line.length; i++) {
+    const ch = line.charAt(i);
+    if (quote === "'") {
+      if (ch === "'") quote = undefined;
+      else word += ch;
+    } else if (quote === '"') {
+      if (ch === '"') quote = undefined;
+      else if (ch === "\\" && i + 1 < line.length && '"\\$`\n'.includes(line.charAt(i + 1))) {
+        i += 1;
+        if (line.charAt(i) !== "\n") word += line.charAt(i);
+      } else word += ch;
+    } else if (ch === " " || ch === "\t") {
+      if (inWord) words.push(word);
+      word = "";
+      inWord = false;
+    } else if (ch === "\n") {
+      throw new Error(
+        "command holds an unquoted newline — pass one git command per call, and quote a multi-line message",
+      );
+    } else if (ch === "\\") {
+      if (i + 1 >= line.length) throw new Error("command ends in a backslash that escapes nothing");
+      i += 1;
+      if (line.charAt(i) === "\n") continue;
+      word += line.charAt(i);
+      inWord = true;
+    } else if (ch === "'" || ch === '"') {
+      quote = ch;
+      inWord = true;
+    } else {
+      word += ch;
+      inWord = true;
+    }
+  }
+  if (quote) throw new Error(`command has an unterminated ${quote} quote`);
+  if (inWord) words.push(word);
+  return words;
 }
 
 /**
  * The subcommand and arguments of a call, however the model wrote it: the
  * subcommand alone (the documented form), a whole `git …` command line, or the
  * subcommand as the first of `args`. Models wrote the other two often enough
- * to cost a turn per run, and each is unambiguous. The subcommand is checked
- * against the same pattern the schema uses, so a flag (`-c`, `-C`,
- * `--exec-path`) can no more arrive through `args[0]` or a command line than
- * through `command`.
+ * to cost a turn per run, and each is unambiguous. Leading `git` words are
+ * dropped, so `{ command: "git", args: ["status"] }` is not `git git status`.
+ * The subcommand is checked against the same pattern the schema uses — in
+ * every form, the documented one included, so the check does not rest on the
+ * schema alone — and a flag (`-c`, `-C`, `--exec-path`) can no more arrive
+ * through `args[0]` or a command line than through `command`.
  */
 export function normalizeGitCall(params: {
   command?: string | undefined;
@@ -969,12 +1018,15 @@ export function normalizeGitCall(params: {
   command: string;
   args: string[];
 } {
-  let words: string[];
-  if (params.command === undefined) words = [...(params.args ?? [])];
-  else if (/^git\s/.test(params.command))
-    words = [...splitWords(params.command).slice(1), ...(params.args ?? [])];
-  else return { command: params.command, args: params.args ?? [] };
-  const [command, ...args] = words[0] === "git" ? words.slice(1) : words;
+  const words =
+    params.command === undefined
+      ? []
+      : /^git\s/.test(params.command)
+        ? splitWords(params.command)
+        : [params.command];
+  words.push(...(params.args ?? []));
+  while (words[0] === "git") words.shift();
+  const [command, ...args] = words;
   if (command === undefined || !/^[a-z][a-z0-9-]*$/.test(command)) {
     throw new Error(
       `command must be a Git subcommand such as 'status' or 'checkout' (was "${command ?? ""}")`,

package/src/mcp/localContext.ts

@@ -1,5 +1,6 @@
 import type { ToolState } from "#app/toolState";
 import type { ResolvedPayload } from "#app/utils/config/payload";
+import type { OctokitWithPlugins } from "#app/utils/github/github";
 
 /**
  * The cwd-scoped, GitHub-free subset of `ToolContext` that the read-only
@@ -79,5 +80,9 @@ export interface LocalToolContext {
   /** the repository, for its default branch. The Action's full `ToolContext`
    * carries it; a local session has none, so its remediation branches keep the
    * plain `remediate/<id>` name. */
-  repo?: { data: { default_branch?: string | null } } | undefined;
+  repo?: { owner?: string; name?: string; data: { default_branch?: string | null } } | undefined;
+  /** the Action's GitHub client, read only to find the remediation PRs already
+   * open, so a group that has one keeps that PR's branch. A local session has
+   * none and names its branches from the group and base alone. */
+  octokit?: OctokitWithPlugins | undefined;
 }

package/src/mcp/moduleExtraction.ts

@@ -42,7 +42,7 @@ import {
   readFetchedGitModules,
   readFetchedRegistryModuleDirs,
 } from "#app/mcp/terraform/refactor/workspace";
-import { isExamplePath, libraryRepoReason, reportOnly } from "#app/mcp/terraform/refactorScope";
+import { isExamplePath, libraryScope, reportOnly } from "#app/mcp/terraform/refactorScope";
 import { scanSessionOf } from "#app/mcp/terraform/scanSession";
 import { log } from "#app/utils/cli";
 import { pushInto } from "#app/utils/collect";
@@ -912,12 +912,14 @@ export function ModuleExtractionCandidatesTool(ctx: LocalToolContext) {
     parameters: ModuleExtractionCandidatesParams,
     execute: execute(async () => {
       const cwd = ctx.payload.cwd ?? process.cwd();
+      const library = libraryScope(cwd);
       const candidates = findExtractionCandidates(
         cwd,
         ctx.payload.moduleCatalogue,
         ctx.toolState.orgModuleHcl,
-      ).filter((c) => ctx.payload.refactorExamples || !isExamplePath(c.cluster.file));
-      const library = libraryRepoReason(cwd);
+      )
+        .filter((c) => ctx.payload.refactorExamples || !isExamplePath(c.cluster.file))
+        .map((c) => ({ ...reportOnly(library(c.cluster.file)), ...c }));
       const matched = candidates.filter((c) => c.candidates.length > 0);
       // Record every candidate's reason, keyed by source, for create_pull_request:
       // when a refactor PR's diff adopts one of these modules and the agent left
@@ -945,7 +947,6 @@ export function ModuleExtractionCandidatesTool(ctx: LocalToolContext) {
             : ""),
       );
       return toolOk({
-        ...reportOnly(library),
         cluster_count: candidates.length,
         matched_count: matched.length,
         candidates,

package/src/mcp/review.ts

@@ -25,7 +25,11 @@ import {
 } from "#app/mcp/findingAudit";
 import { reproveStaleSuggestions } from "#app/mcp/reproveSuggestions";
 import { formatReanchoredNote, patchLinesBySide, reanchorComments } from "#app/mcp/reviewAnchor";
-import { formatOverflowNote, limitInlineComments } from "#app/mcp/reviewCommentLimit";
+import {
+  foldedFindingsStillIntroduced,
+  formatOverflowNote,
+  limitInlineComments,
+} from "#app/mcp/reviewCommentLimit";
 import { listOpenInfraweaverThreads, type OpenInfraweaverThread } from "#app/mcp/reviewComments";
 import {
   type DuplicateComment,
@@ -56,6 +60,7 @@ import { deltaVerdict } from "#app/mcp/terraform/deltaSummary";
 import { scanForProof } from "#app/mcp/terraform/gateScan";
 import { findingKey, type GateDelta } from "#app/mcp/terraform/scanDelta";
 import { scanSessionOf } from "#app/mcp/terraform/scanSession";
+import type { Severity } from "#app/mcp/terraform/types";
 import type { CommentableLines } from "#app/toolState";
 import { log } from "#app/utils/cli";
 import { getApiUrl, isBackendConfigured } from "#app/utils/cloud/apiUrl";
@@ -730,6 +735,33 @@ export function CreatePullRequestReviewTool(ctx: GitHubWriteToolContext) {
               `if any thread is a real outstanding issue, do NOT approve — submit a non-approving review (omit \`approved\`, or set \`request_changes\` for a blocking one) that covers it instead.`,
           );
         }
+        // a comment the limit folded into an earlier review's body never became
+        // a thread, so the count above cannot see it. A folded scanner finding
+        // left its marker in that body: it holds an approval back the same way
+        // while this head still introduces it. Fatal on a failed fetch, like
+        // the thread check — this is the same invariant.
+        if (delta) {
+          const reviews = await ctx.octokit.paginate(ctx.octokit.rest.pulls.listReviews, {
+            owner: ctx.repo.owner,
+            repo: ctx.repo.name,
+            pull_number,
+            per_page: 100,
+          });
+          const folded = foldedFindingsStillIntroduced({ reviews, delta, dismissed });
+          if (folded.length > 0) {
+            throw new Error(
+              `cannot approve: ${folded.length} introduced finding(s) an earlier ${PRODUCT_NAME} review listed in its body (past \`review_comment_limit\`, so with no thread to resolve) are still introduced by this head: ` +
+                folded
+                  .slice(0, 20)
+                  .map(
+                    (f) =>
+                      `${f.concern.id} (${f.concern.rule_id} at ${f.concern.location.file}:${f.concern.location.line ?? "?"})`,
+                  )
+                  .join(", ") +
+                `. approval requires every prior ${PRODUCT_NAME} finding to be addressed. if one genuinely needs no change, list it in \`dismissed\` with the reason and retry; otherwise do NOT approve — submit a non-approving review that covers it.`,
+            );
+          }
+        }
       }
 
       // skip empty COMMENT reviews before any GitHub call. see reviewSkipDecision
@@ -893,6 +925,9 @@ export function CreatePullRequestReviewTool(ctx: GitHubWriteToolContext) {
         : new Map<number, SuggestionProof>();
 
       type ReviewComment = NonNullable<typeof params.comments>[number];
+      // the scanner severity of the finding a comment answers: what the comment
+      // limit ranks it by, whatever marker the reviewer gave it
+      const findingSeverity = new Map<ReviewComment, Severity>();
       const reviewComments = auditedComments.map((comment, index) => {
         let commentBody = fixDoubleEscapedString(comment.body || "");
         if (comment.suggestion !== undefined) {
@@ -931,6 +966,9 @@ export function CreatePullRequestReviewTool(ctx: GitHubWriteToolContext) {
           reviewComment.start_line = comment.start_line;
           reviewComment.start_side = side;
         }
+        if (comment.provenance?.kind === "scanner") {
+          findingSeverity.set(reviewComment, comment.provenance.finding.concern.severity);
+        }
         return reviewComment;
       });
 
@@ -1003,7 +1041,9 @@ export function CreatePullRequestReviewTool(ctx: GitHubWriteToolContext) {
         // then the per-review limit: the most important comments stay inline,
         // the rest are listed in the body (see reviewCommentLimit.ts). After
         // dedup, so a withheld duplicate never takes a slot.
-        const limited = limitInlineComments(deduped.kept, ctx.payload.reviewCommentLimit);
+        const limited = limitInlineComments(deduped.kept, ctx.payload.reviewCommentLimit, (c) =>
+          findingSeverity.get(c),
+        );
         overflowComments = limited.overflow;
         if (overflowComments.length > 0) {
           log.info(
@@ -1063,7 +1103,16 @@ export function CreatePullRequestReviewTool(ctx: GitHubWriteToolContext) {
         body = body ? body + note : note.replace(/^\n\n/, "");
       }
       if (overflowComments.length > 0) {
-        const note = formatOverflowNote(overflowComments, ctx.payload.reviewCommentLimit);
+        const server = process.env.GITHUB_SERVER_URL || "https://github.com";
+        const commit = params.commit_id;
+        const note = formatOverflowNote(
+          overflowComments,
+          ctx.payload.reviewCommentLimit,
+          commit
+            ? (c) =>
+                `${server}/${ctx.repo.owner}/${ctx.repo.name}/blob/${commit}/${c.path.split("/").map(encodeURIComponent).join("/")}${c.line && c.side !== "LEFT" ? `#L${c.line}` : ""}`
+            : undefined,
+        );
         body = body ? body + note : note.replace(/^\n\n/, "");
       }
 

package/src/mcp/reviewCommentLimit.ts

@@ -3,23 +3,39 @@
  *
  * A review of forty inline comments is read by no one, and every one of them is
  * a thread the author must resolve. Past the limit the most important comments
- * still post inline — 🚨 before ⚠️ before the rest, a proven (one-click
+ * still post inline — ranked by the scanner severity of the finding a comment
+ * answers, or else by its own 🚨/⚠️/ℹ️ marker (the marker is optional, so an
+ * unmarked comment ranks level with ⚠️, not last), a proven (one-click
  * committable) fix ahead of an equal one without, otherwise in the order the
- * reviewer wrote them — and the rest are listed in the review body, so nothing
- * the review found is lost, only folded. The gate is not involved: it judges the
- * scan delta, never the comments.
+ * reviewer wrote them — and the rest are listed in the review body in full, so
+ * nothing the review found is lost, only folded. The gate is not involved: it
+ * judges the scan delta, never the comments.
+ *
+ * A folded comment opens no thread, so the approval check that counts open
+ * threads cannot see it. A folded scanner finding keeps its hidden marker in
+ * the review body instead, and a later approval is refused while the head
+ * still introduces it (`foldedFindingsStillIntroduced`).
  *
  * The limit is a repo setting (`review_comment_limit`), read from the base
  * branch on a pull request: lowering it moves findings out of the diff view,
  * which is a way to make them easier to miss, so a PR does not get to set it for
  * itself.
  */
+
 import { leadingMarker } from "#app/mcp/findingAudit";
 import { gistOf } from "#app/mcp/reviewDedup";
+import { findingKeysIn, isOwnReviewComment, renderCommentMarker } from "#app/mcp/reviewMarkers";
+import type { Dismissal } from "#app/mcp/reviewProvenance";
+import { type DeltaFinding, findingKey, type GateDelta } from "#app/mcp/terraform/scanDelta";
+import type { Severity } from "#app/mcp/terraform/types";
 
-/** Lines the overflow note lists before counting the rest; keeps the body
- *  clear of GitHub's ~65 KB limit, as the other review notes do. */
-const MAX_OVERFLOW_LINES = 50;
+/** The note's share of GitHub's 65,536-character review body; the verdict, the
+ *  reviewer's own text, the other notes, the delta summary and the footer
+ *  share the rest. */
+const MAX_NOTE_CHARS = 30_000;
+
+/** Room kept for the closing count and size note. */
+const TRAILER_RESERVE = 400;
 
 /** what `renderSuggestion` writes under a suggestion a re-scan proved. */
 const PROVEN_MARK = "✅ **Proven by re-scan**";
@@ -30,26 +46,41 @@ interface LimitableComment {
   body?: string | undefined;
 }
 
-function rank(c: LimitableComment): number {
+/** Importance by level, most important first. */
+const SEVERITY_LEVEL: Record<Severity, number> = {
+  critical: 0,
+  high: 1,
+  medium: 2,
+  low: 3,
+  info: 4,
+};
+const MARKER_LEVEL: Record<string, number> = { "🚨": 1, "⚠️": 2, "⚠": 2, ℹ️: 3, ℹ: 3 };
+/** no marker, or one not on the ladder: the marker is optional, so mid-rank */
+const UNMARKED_LEVEL = 2;
+
+function rank(c: LimitableComment, severity: Severity | undefined): number {
   const body = c.body ?? "";
-  const marker = leadingMarker(body);
-  const severity = marker === "🚨" ? 0 : marker === "⚠️" || marker === "⚠" ? 2 : 4;
-  return severity + (body.includes(PROVEN_MARK) ? 0 : 1);
+  const level = severity
+    ? SEVERITY_LEVEL[severity]
+    : (MARKER_LEVEL[leadingMarker(body) ?? ""] ?? UNMARKED_LEVEL);
+  return level * 2 + (body.includes(PROVEN_MARK) ? 0 : 1);
 }
 
 /**
  * Split `comments` into those posted inline and those folded into the body.
- * `limit` 0 or undefined means no limit. Both halves keep the input order, so
- * the posted review reads in the order the reviewer wrote it.
+ * `limit` 0 or undefined means no limit. `severityOf` names the severity of the
+ * finding a comment answers, when it answers one. Both halves keep the input
+ * order, so the posted review reads in the order the reviewer wrote it.
  */
 export function limitInlineComments<T extends LimitableComment>(
   comments: readonly T[],
   limit: number | undefined,
+  severityOf?: (c: T) => Severity | undefined,
 ): { kept: T[]; overflow: T[] } {
   if (!limit || comments.length <= limit) return { kept: [...comments], overflow: [] };
   const keep = new Set(
     comments
-      .map((c, i) => ({ i, r: rank(c) }))
+      .map((c, i) => ({ i, r: rank(c, severityOf?.(c)) }))
       .sort((a, b) => a.r - b.r || a.i - b.i)
       .slice(0, limit)
       .map(({ i }) => i),
@@ -60,20 +91,132 @@ export function limitInlineComments<T extends LimitableComment>(
   };
 }
 
-/** The review-body note listing the comments the limit folded, or "" for none. */
-export function formatOverflowNote(overflow: readonly LimitableComment[], limit: number): string {
-  if (overflow.length === 0) return "";
-  const shown = overflow.slice(0, MAX_OVERFLOW_LINES).map((c) => {
-    const where = c.line ? `${c.path}:${c.line}` : c.path;
-    const gist = gistOf(c.body);
-    return `- \`${where.replace(/`/g, "'")}\`${gist ? ` — ${gist}` : ""}`;
-  });
-  const rest = overflow.length - shown.length;
-  if (rest > 0) shown.push(`- …and ${rest} more not shown`);
+const escapeHtml = (s: string): string =>
+  s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+
+const whereOf = (c: LimitableComment): string => (c.line ? `${c.path}:${c.line}` : c.path);
+
+/**
+ * Whether a comment's markup closes inside it. An inline comment is its own
+ * document; lifted into the shared review body, an unclosed fence, `<details>`
+ * or `<!--` would swallow everything after it — the other folded comments and
+ * the footer.
+ */
+function closesItself(body: string): boolean {
+  const occurrences = (re: RegExp) => body.match(re)?.length ?? 0;
+  const fences = body.split("\n").filter((l) => /^\s*(```|~~~)/.test(l)).length;
   return (
+    fences % 2 === 0 &&
+    occurrences(/<details\b/gi) === occurrences(/<\/details\s*>/gi) &&
+    occurrences(/<!--/g) === occurrences(/-->/g)
+  );
+}
+
+/** `body` as a fenced text block no run of backticks inside it can close. */
+function asText(body: string): string {
+  const longest = Math.max(0, ...(body.match(/`+/g) ?? []).map((run) => run.length));
+  const fence = "`".repeat(Math.max(3, longest + 1));
+  return `${fence}text\n${body}\n${fence}`;
+}
+
+/** One folded comment in full: collapsed under its place and first line. */
+function renderWhole<T extends LimitableComment>(
+  c: T,
+  linkOf: ((c: T) => string | undefined) | undefined,
+): string {
+  const where = escapeHtml(whereOf(c));
+  const gist = gistOf(c.body);
+  const href = linkOf?.(c);
+  const body = c.body ?? "";
+  return [
+    `<details><summary><code>${where}</code>${gist ? ` — ${gist}` : ""}</summary>`,
+    ...(href ? [`<a href="${escapeHtml(href)}">${where}</a>`] : []),
+    ...(body ? [closesItself(body) ? body : asText(body)] : []),
+    "</details>",
+  ].join("\n\n");
+}
+
+/** One folded comment by place and first line, keeping its finding marker. */
+function renderBrief(c: LimitableComment): string {
+  const gist = gistOf(c.body);
+  const markers = findingKeysIn(c.body ?? "").map((key) =>
+    renderCommentMarker({ kind: "finding", key, proven: false }),
+  );
+  return `- \`${whereOf(c).replace(/`/g, "'")}\`${gist ? ` — ${gist}` : ""}${markers.map((m) => ` ${m}`).join("")}`;
+}
+
+/**
+ * The review-body note carrying the comments the limit folded, or "" for none.
+ * Each is kept whole while the note stays within its share of GitHub's body
+ * limit; past that, by place and first line (and its finding marker), and the
+ * note says so.
+ */
+export function formatOverflowNote<T extends LimitableComment>(
+  overflow: readonly T[],
+  limit: number,
+  linkOf?: (c: T) => string | undefined,
+): string {
+  if (overflow.length === 0) return "";
+  const header =
     "\n\n---\n\n" +
     `**Note:** this review posts at most ${limit} inline comments (\`review_comment_limit\`), ` +
-    `so ${overflow.length} more ${overflow.length === 1 ? "is" : "are"} listed here instead:\n` +
-    shown.join("\n")
+    `so ${overflow.length} more ${overflow.length === 1 ? "is" : "are"} listed here instead:`;
+  const SEP = 2;
+  let room = MAX_NOTE_CHARS - TRAILER_RESERVE - header.length;
+  // every comment's place first, then as many in full as the rest allows
+  const items: string[] = [];
+  for (const c of overflow) {
+    const brief = renderBrief(c);
+    if (brief.length + SEP > room) break;
+    items.push(brief);
+    room -= brief.length + SEP;
+  }
+  let brief = items.length;
+  for (const [i, c] of overflow.slice(0, items.length).entries()) {
+    const whole = renderWhole(c, linkOf);
+    const extra = whole.length - (items[i] as string).length;
+    if (extra > room) continue;
+    items[i] = whole;
+    room -= extra;
+    brief--;
+  }
+  const omitted = overflow.length - items.length;
+  if (omitted > 0) items.push(`- …and ${omitted} more not shown`);
+  const cut = [
+    brief > 0
+      ? `${brief} of them ${brief === 1 ? "is" : "are"} shown by place and first line only`
+      : "",
+    omitted > 0 ? `${omitted} ${omitted === 1 ? "is" : "are"} not shown at all` : "",
+  ].filter(Boolean);
+  if (cut.length > 0) {
+    items.push(`${cut.join(" and ")}, to keep this review within GitHub's size limit.`);
+  }
+  return `${header}\n\n${items.join("\n\n")}`;
+}
+
+/**
+ * The introduced findings an earlier review of this PR folded into its body —
+ * so they never became threads — that this head still introduces and this
+ * review does not dismiss. An approval past one would pass a finding the
+ * open-thread check cannot see. Markers count only in the engine's own reviews;
+ * one pasted elsewhere can only add a finding to this list, never remove one.
+ */
+export function foldedFindingsStillIntroduced(input: {
+  reviews: readonly {
+    user?: { login?: string | null; type?: string | null } | null;
+    body?: string | null;
+  }[];
+  delta: GateDelta;
+  dismissed: readonly Dismissal[];
+}): DeltaFinding[] {
+  const folded = new Set(
+    input.reviews.flatMap((r) =>
+      r.body && isOwnReviewComment(r.user, r.body) ? findingKeysIn(r.body) : [],
+    ),
+  );
+  if (folded.size === 0) return [];
+  const dismissed = new Set(input.dismissed.map((d) => d.finding_id));
+  return input.delta.introduced.filter(
+    (f) => folded.has(findingKey(f)) && !dismissed.has(f.concern.id),
   );
 }

package/src/mcp/reviewMarkers.ts

@@ -67,6 +67,17 @@ export function parseCommentMarker(body: string | null | undefined): CommentMark
   }
 }
 
+/**
+ * The key of every finding marker in `body`. A review BODY carries one per
+ * comment the comment limit folded into it, where a comment carries one.
+ */
+export function findingKeysIn(body: string): string[] {
+  return [...body.matchAll(new RegExp(MARKER.source, "g"))].flatMap((m) => {
+    const marker = parseCommentMarker(m[0]);
+    return marker?.kind === "finding" ? [marker.key] : [];
+  });
+}
+
 const SUGGESTION = /```suggestion\r?\n([\s\S]*?)```/;
 
 /** The text of a comment's `suggestion` block, without its closing newline. */

package/src/mcp/reviewProvenance.ts

@@ -175,7 +175,7 @@ export function renderReviewVerdict(input: {
 }): string {
   const { delta, verdict } = input;
   const introduced = delta.introduced.length;
-  const blocking = verdict.gating + verdict.required;
+  const { blocking } = verdict;
   const renamedBlocking = delta.introduced.filter(
     (f) => f.possiblyPreexisting && failsGate(f, [...(input.requiredControls ?? [])]),
   ).length;

package/src/mcp/staleFix.ts

@@ -1,3 +1,4 @@
+import { createHash } from "node:crypto";
 import { errorMessage } from "@infraweaver-io/core/errors";
 import { type } from "arktype";
 import { PRODUCT_NAME, PRODUCT_SLUG } from "#app/brand";
@@ -7,6 +8,7 @@ import { assertTargetInScope } from "#app/mcp/scope";
 import { execute, tool, toolOk } from "#app/mcp/shared";
 import { log } from "#app/utils/cli";
 import { mapWithConcurrency } from "#app/utils/concurrency";
+import type { OctokitWithPlugins } from "#app/utils/github/github";
 
 /**
  * Stale-fix self-healing. A Infraweaver remediation PR is "base + a minimal,
@@ -46,7 +48,8 @@ export function groupIdFromBranch(branch: string): string | null {
 
 /**
  * What a remediation branch name carries after its group id: nothing when the
- * PR targets the repository default branch, `--<base>` otherwise.
+ * PR targets the repository default branch, `--<base>` otherwise — slugged for
+ * a ref, with a hash of the raw name when the slug changed it.
  *
  * The group id is a hash of the file (or rule) alone, so the same fix aimed at
  * two base branches — or at two repos whose roots are both `main.tf` — named
@@ -59,7 +62,75 @@ export function remediationBranchSuffix(
   defaultBranch: string | undefined,
 ): string {
   if (!base || !defaultBranch || base === defaultBranch) return "";
-  return `--${base.replace(/[^A-Za-z0-9._-]+/g, "-")}`;
+  const slug = base.replace(/[^A-Za-z0-9._-]+/g, "-");
+  if (slug === base) return `--${slug}`;
+  // a lossy slug is shared — `release/1.0` and `release-1.0` — so a fix built
+  // on one base would be force-pushed into the PR targeting the other
+  return `--${slug}-${createHash("sha1").update(base).digest("hex").slice(0, 8)}`;
+}
+
+/** an open remediation PR, as far as naming a group's branch needs it. */
+export interface OpenRemediationPr {
+  head: string;
+  base: string;
+}
+
+/**
+ * The branch a remediation group's fix is pushed to: the head of the PR already
+ * open for this group into this exact base, when there is one, else
+ * `remediate/<id>` plus [[remediationBranchSuffix]].
+ *
+ * The open PR wins because its name may predate the current naming — opened
+ * before the base suffix existed, or under an unhashed suffix — and Remediate
+ * keys idempotency on the name, so a newly computed one opened a duplicate PR.
+ * A head that another open PR also proposes into a different base is never
+ * reused: pushing to it would rewrite that PR too.
+ */
+export function remediationBranchFor(
+  id: string,
+  base: string | undefined,
+  defaultBranch: string | undefined,
+  open: readonly OpenRemediationPr[] | undefined,
+): string {
+  const computed = `remediate/${id}${remediationBranchSuffix(base, defaultBranch)}`;
+  const heads = (open ?? [])
+    .filter((pr) => pr.base === base && groupIdFromBranch(pr.head) === id)
+    .map((pr) => pr.head)
+    .filter((head) => !(open ?? []).some((pr) => pr.head === head && pr.base !== base));
+  return heads.includes(computed) ? computed : (heads[0] ?? computed);
+}
+
+/**
+ * This repository's open `remediate/*` PRs, for [[remediationBranchFor]]. Empty
+ * without a GitHub client (a local session) or when the API call fails: the
+ * group then gets the computed name, as it did before open PRs were consulted.
+ * Only Remediate pushes to a group's branch, so no other mode pays for the call.
+ */
+export async function listOpenRemediationPrs(ctx: {
+  octokit?: OctokitWithPlugins | undefined;
+  repo?: { owner?: string; name?: string } | undefined;
+  toolState?: { selectedMode?: string | undefined } | undefined;
+}): Promise<OpenRemediationPr[]> {
+  const { octokit, repo } = ctx;
+  if (ctx.toolState?.selectedMode !== "Remediate") return [];
+  if (!octokit || !repo?.owner || !repo.name) return [];
+  try {
+    const open = await octokit.paginate(octokit.rest.pulls.list, {
+      owner: repo.owner,
+      repo: repo.name,
+      state: "open",
+      per_page: 100,
+    });
+    return (
+      open
+        // a fork's branch of the same name is not one this run can push to
+        .filter((pr) => pr.head.repo?.id === pr.base.repo.id && groupIdFromBranch(pr.head.ref))
+        .map((pr) => ({ head: pr.head.ref, base: pr.base.ref }))
+    );
+  } catch (e) {
+    log.warning(`» could not list open remediation PRs: ${errorMessage(e)}`);
+    return [];
+  }
 }
 
 /** core matcher: a NON-EMPTY identity string (a GitHub login or a git author

package/src/mcp/terraform/awsPrices.ts

@@ -13,7 +13,7 @@ export const AWS_PRICE_REGION = "eu-west-2";
 /** Currency of every price below. The bulk API quotes USD for every region. */
 export const AWS_PRICE_CURRENCY = "USD";
 /** ISO date the snapshot was captured — surfaced in cost.md so staleness is visible. */
-export const AWS_PRICE_FETCHED_AT = "2026-09-23";
+export const AWS_PRICE_FETCHED_AT = "2026-10-03";
 
 /** meter key → list price per HOUR. */
 export const AWS_HOURLY_PRICES: Record<string, number> = {