infraweaver 0.3.12 → 0.3.13

package/dist/cli.mjs

@@ -90400,23 +90400,23 @@ var require_helpers = __commonJS({
   "node_modules/.pnpm/ip-address@10.7.3/node_modules/ip-address/dist/v6/helpers.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.escapeHtml = escapeHtml;
+    exports2.escapeHtml = escapeHtml2;
     exports2.spanAllZeroes = spanAllZeroes;
     exports2.spanAll = spanAll;
     exports2.spanLeadingZeroes = spanLeadingZeroes;
     exports2.simpleGroup = simpleGroup;
-    function escapeHtml(s) {
+    function escapeHtml2(s) {
       return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
     }
     function spanAllZeroes(s) {
-      return escapeHtml(s).replace(/(0+)/g, '<span class="zero">$1</span>');
+      return escapeHtml2(s).replace(/(0+)/g, '<span class="zero">$1</span>');
     }
     function spanAll(s, offset = 0) {
       const letters = s.split("");
-      return letters.map((n, i) => `<span class="digit value-${escapeHtml(n)} position-${i + offset}">${spanAllZeroes(n)}</span>`).join("");
+      return letters.map((n, i) => `<span class="digit value-${escapeHtml2(n)} position-${i + offset}">${spanAllZeroes(n)}</span>`).join("");
     }
     function spanLeadingZeroesSimple(group2) {
-      return escapeHtml(group2).replace(/^(0+)/, '<span class="zero">$1</span>');
+      return escapeHtml2(group2).replace(/^(0+)/, '<span class="zero">$1</span>');
     }
     function spanLeadingZeroes(address) {
       const groups2 = address.split(":");
@@ -160536,7 +160536,7 @@ var init_cacheTwirpClient = __esm({
 });
 
 // node_modules/.pnpm/@actions+cache@6.3.0_supports-color@7.2.0/node_modules/@actions/cache/lib/internal/tar.js
-import { existsSync as existsSync19, writeFileSync as writeFileSync21 } from "fs";
+import { existsSync as existsSync18, writeFileSync as writeFileSync21 } from "fs";
 import * as path13 from "path";
 function getTarPath() {
   return __awaiter18(this, void 0, void 0, function* () {
@@ -160546,7 +160546,7 @@ function getTarPath() {
         const systemTar = SystemTarPathOnWindows;
         if (gnuTar) {
           return { path: gnuTar, type: ArchiveToolType.GNU };
-        } else if (existsSync19(systemTar)) {
+        } else if (existsSync18(systemTar)) {
           return { path: systemTar, type: ArchiveToolType.BSD };
         }
         break;
@@ -191031,7 +191031,7 @@ var BOT_EMAIL = `${BOT_LOGIN}@users.noreply.github.com`;
 var OIDC_AUDIENCE = `${PRODUCT_SLUG}-api`;
 
 // src/commands/assess.ts
-import { existsSync as existsSync10, statSync as statSync8 } from "node:fs";
+import { existsSync as existsSync9, statSync as statSync8 } from "node:fs";
 import { isAbsolute as isAbsolute4, resolve as resolve7 } from "node:path";
 var import_arg = __toESM(require_arg(), 1);
 
@@ -199939,7 +199939,7 @@ var log = {
   debug: (...args2) => current.debug(...args2)
 };
 
-// node_modules/.pnpm/@infraweaver-io+models@0.1.6/node_modules/@infraweaver-io/models/dist/usage.js
+// node_modules/.pnpm/@infraweaver-io+models@0.1.7/node_modules/@infraweaver-io/models/dist/usage.js
 function formatCostUsd(costUsd) {
   return costUsd.toFixed(4);
 }
@@ -200490,7 +200490,7 @@ import { randomBytes } from "node:crypto";
 // package.json
 var package_default = {
   name: "infraweaver",
-  version: "0.3.12",
+  version: "0.3.13",
   description: "GitHub Action that remediates Terraform to best practices and opens one scoped pull request per concern.",
   keywords: [
     "ai-coding-agent",
@@ -200593,7 +200593,7 @@ var package_default = {
     "@infraweaver-io/ci": "^0.1.8",
     "@infraweaver-io/core": "^0.1.5",
     "@infraweaver-io/crosswalk": "^1.2.0",
-    "@infraweaver-io/models": "^0.1.6",
+    "@infraweaver-io/models": "^0.1.7",
     "@infraweaver-io/policy-spec": "^1.2.0",
     "@infraweaver-io/report-contract": "^0.1.5",
     "@infraweaver-io/sandbox": "^0.1.8",
@@ -207495,7 +207495,18 @@ var SECRET_WORDS = /* @__PURE__ */ new Set([
   "credential",
   "credentials"
 ]);
-var SECRET_KEY_PREFIXES = /* @__PURE__ */ new Set(["api", "secret", "private", "signing"]);
+var SECRET_KEY_PREFIXES = /* @__PURE__ */ new Set([
+  "api",
+  "secret",
+  "private",
+  "signing",
+  "access",
+  "account",
+  "client",
+  "shared",
+  "preshared",
+  "master"
+]);
 var NOT_SECRET_TOKENS = /* @__PURE__ */ new Set(["creation", "idempotency", "client", "request", "continuation"]);
 function words(name) {
   return name.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase().split(/[_-]+/).filter(Boolean);
@@ -207507,24 +207518,70 @@ function isSecretName(name) {
   if (last === void 0) return false;
   if (last === "key") return prev !== void 0 && SECRET_KEY_PREFIXES.has(prev);
   if (last === "token" && prev !== void 0 && NOT_SECRET_TOKENS.has(prev)) return false;
+  if (last === "string") return prev === "connection";
+  if (last === "secret" && w.length === 1) return false;
   return SECRET_WORDS.has(last);
 }
 function isPlaceholder(inner) {
-  return inner.trim() === "" || /^[*xX.]+$/.test(inner) || /^<[^>]*>$/.test(inner) || // the dummy credentials offline plans and LocalStack are given (`secret_key = "test"`)
-  /^(?:test|mock|fake|dummy|fixture|example|placeholder|sample)(?:[_-].*)?$/i.test(inner) || // a token's lifetime unit: `token_validity_units { access_token = "hours" }`
+  return inner.trim() === "" || /^[*xX.]+$/.test(inner) || /^<[^>]*>$/.test(inner) || /^(?:true|false|null)$/.test(inner) || /^-?\d+(?:\.\d+)?$/.test(inner) || // a template directive is computed, like an interpolation: `"%{ if … }…%{ endif }"`
+  inner.includes("%{") || // the dummy credentials offline plans and LocalStack are given (`secret_key = "test"`,
+  // `"example-secret"`) — but only when that is the whole value: a lowercase tail at
+  // most, so `"Test-Pr0dDbPassw0rd!"` is a password that happens to start with a word
+  isDummy(inner) || // a token's lifetime unit: `token_validity_units { access_token = "hours" }`
   /^(?:seconds|minutes|hours|days)$/.test(inner);
 }
-var HEADER = /^(resource|data|provider|module|locals|variable|output|terraform)\b([^{]*)\{\s*$/;
+function isDummy(inner) {
+  const m = /^(?:test|mock|fake|dummy|fixture|example|placeholder|sample)([_-].*)?$/i.exec(inner);
+  return m !== null && (m[1] === void 0 || /^[_-][a-z0-9_-]*$/.test(m[1]));
+}
+function isSecretReference(inner) {
+  return inner.startsWith("arn:") || /^projects\/[^/]+\/secrets\//.test(inner) || /^https:\/\/[\w-]+\.vault\.azure\.net\/secrets\//i.test(inner) || /^\/[\w./-]+$/.test(inner);
+}
+var HEADER = /^(resource|data|provider|module|locals|variable|output|terraform)\b([^{]*)\{(.*)$/;
 var ASSIGNMENT = /^\s*(?:"([A-Za-z_][\w-]*)"|([A-Za-z_][\w-]*))\s*=(?!=)\s*(.*)$/;
 var HEREDOC = /<<-?([A-Za-z_]\w*)\s*$/;
 var INLINE_PAIR = /(?:"([A-Za-z_][\w-]*)"|\b([A-Za-z_][\w-]*))\s*=(?!=)\s*("(?:[^"\\]|\\.)*")/g;
-function literalValue(raw2) {
+function literalValue(name, raw2) {
   const value2 = stripTrailingComment(raw2).replace(/,$/, "").trim();
-  return isStringLiteral(value2) && !isPlaceholder(value2.slice(1, -1));
+  if (!isStringLiteral(value2)) return false;
+  const inner = value2.slice(1, -1);
+  if (isPlaceholder(inner) || isSecretReference(inner)) return false;
+  return !(words(name).at(-1) === "auth" && /^[A-Z]+(?:_[A-Z]+)*$/.test(inner));
+}
+function variableName(holder) {
+  return /^variable\s+"?([\w-]+)"?/.exec(holder)?.[1] ?? "";
+}
+function opensBlockComment(line) {
+  for (let i = 0; i < line.length; i++) {
+    const span = skipNonCode(line, i);
+    if (!span) continue;
+    if (line.startsWith("/*", i) && !line.includes("*/", i + 2)) return true;
+    i = span.end;
+  }
+  return false;
+}
+function closesOnLine(rest) {
+  let depth = 1;
+  for (let i = 0; i < rest.length; i++) {
+    const span = skipNonCode(rest, i);
+    if (span) {
+      i = span.end;
+      continue;
+    }
+    if (rest[i] === "{") depth++;
+    else if (rest[i] === "}" && --depth === 0) return true;
+  }
+  return false;
 }
 function findHardcodedSecrets(hcl2) {
+  return findInLines(hcl2, null);
+}
+function findTfvarsSecrets(hcl2, path15) {
+  return findInLines(hcl2, `tfvars input ${path15}`);
+}
+function findInLines(hcl2, fileHolder) {
   const out = [];
-  let holder = null;
+  let holder = fileHolder;
   let heredoc = null;
   let inComment = false;
   const lines = hcl2.split("\n");
@@ -207544,12 +207601,28 @@ function findHardcodedSecrets(hcl2) {
       continue;
     }
     if (trimmed.startsWith("#") || trimmed.startsWith("//")) continue;
-    const header = HEADER.exec(line);
+    if (opensBlockComment(line)) inComment = true;
+    const header = fileHolder === null ? HEADER.exec(line) : null;
     if (header) {
       holder = `${header[1]}${header[2].trimEnd() ? ` ${header[2].trim()}` : ""}`;
+      const rest = header[3];
+      const opens2 = HEREDOC.exec(rest);
+      if (opens2) heredoc = opens2[1];
+      if (!holder.startsWith("output ") && !holder.startsWith("terraform")) {
+        for (const pair of rest.matchAll(INLINE_PAIR)) {
+          const key = pair[1] ?? pair[2];
+          const isVariable = holder.startsWith("variable ");
+          if (isVariable && key !== "default") continue;
+          const name2 = isVariable ? variableName(holder) : key;
+          if (isSecretName(name2) && literalValue(name2, pair[3])) {
+            out.push({ name: name2, holder, line: i + 1 });
+          }
+        }
+      }
+      if (closesOnLine(rest)) holder = null;
       continue;
     }
-    if (line.startsWith("}")) {
+    if (fileHolder === null && line.startsWith("}")) {
       holder = null;
       continue;
     }
@@ -207561,30 +207634,34 @@ function findHardcodedSecrets(hcl2) {
     const name = m[1] ?? m[2];
     const value2 = m[3];
     if (holder.startsWith("variable ")) {
-      const variable = /^variable\s+"?([\w-]+)"?/.exec(holder)?.[1] ?? "";
-      if (name === "default" && isSecretName(variable) && literalValue(value2)) {
+      const variable = variableName(holder);
+      if (name === "default" && isSecretName(variable) && literalValue(variable, value2)) {
         out.push({ name: variable, holder, line: i + 1 });
       }
       continue;
     }
     if (holder.startsWith("output ") || holder.startsWith("terraform")) continue;
-    if (isSecretName(name) && literalValue(value2)) {
+    if (isSecretName(name) && literalValue(name, value2)) {
       out.push({ name, holder, line: i + 1 });
       continue;
     }
     for (const pair of value2.matchAll(INLINE_PAIR)) {
       const key = pair[1] ?? pair[2];
-      if (isSecretName(key) && literalValue(pair[3])) {
+      if (isSecretName(key) && literalValue(key, pair[3])) {
         out.push({ name: key, holder, line: i + 1 });
       }
     }
   }
   return out;
 }
-function scanHardcodedSecrets(files) {
+function scanHardcodedSecrets(files, tfvarsFiles = []) {
   const concerns = [];
-  for (const { path: path15, hcl: hcl2 } of files) {
-    for (const hit of findHardcodedSecrets(hcl2)) {
+  const hits = [
+    ...files.map((f) => ({ path: f.path, found: findHardcodedSecrets(f.hcl) })),
+    ...tfvarsFiles.map((f) => ({ path: f.path, found: findTfvarsSecrets(f.hcl, f.path) }))
+  ];
+  for (const { path: path15, found } of hits) {
+    for (const hit of found) {
       concerns.push(
         buildConcern({
           source: NATIVE_SOURCE,
@@ -209587,7 +209664,8 @@ var NATIVE_RULE_SCANNERS = [
     name: "hardcoded-secrets",
     rules: [HARDCODED_SECRET_ARGUMENT],
     // Per file: the argument's name and its literal are both on the line itself.
-    scan: (ctx) => ({ concerns: scanHardcodedSecrets(ctx.files) })
+    // The only rule that reads `.tfvars`: an input file holds values, not config.
+    scan: (ctx) => ({ concerns: scanHardcodedSecrets(ctx.files, ctx.tfvarsFiles) })
   },
   {
     name: "write-only",
@@ -209672,6 +209750,7 @@ function createRuleContext(input2) {
     cwd: input2.cwd,
     files: input2.files,
     tofuFiles: input2.tofuFiles ?? [],
+    tfvarsFiles: input2.tfvarsFiles ?? [],
     truncated: input2.truncated ?? null,
     repeatedLiteralThreshold: input2.repeatedLiteralThreshold
   };
@@ -209723,6 +209802,9 @@ function readTfTree(cwd, limits) {
 function readTofuTree(cwd, limits) {
   return readTree(cwd, ".tofu", limits);
 }
+function readTfvarsTree(cwd, limits) {
+  return readTree(cwd, ".tfvars", limits);
+}
 var OVERSIZE_NAMED = 5;
 function describeOversize(paths) {
   const named = paths.slice(0, OVERSIZE_NAMED).join(", ");
@@ -209751,6 +209833,9 @@ function scanNative(cwd, opts = {}) {
     // walk over a suffix most repos do not use at all, and threading it through
     // the context keeps the scanners uniform.
     tofuFiles: readTofuTree(cwd).files,
+    // likewise only for the hardcoded-secret rule: a value kept out of the `.tf`
+    // source is most often committed here instead
+    tfvarsFiles: readTfvarsTree(cwd).files,
     truncated: tree.truncated,
     repeatedLiteralThreshold: opts.repeatedLiteralThreshold ?? DEFAULT_REPEAT_THRESHOLD
   });
@@ -271571,7 +271656,7 @@ var FastMCP = class extends FastMCPEventEmitter {
   }
 };
 
-// node_modules/.pnpm/@infraweaver-io+models@0.1.6/node_modules/@infraweaver-io/models/dist/catalog.js
+// node_modules/.pnpm/@infraweaver-io+models@0.1.7/node_modules/@infraweaver-io/models/dist/catalog.js
 function provider(config3) {
   return config3;
 }
@@ -272932,12 +273017,47 @@ function readTfDir(cwd, dir) {
 }
 
 // src/mcp/terraform/refactorScope.ts
-import { existsSync as existsSync6, readdirSync as readdirSync6, readFileSync as readFileSync12, statSync as statSync5 } from "node:fs";
+import { readdirSync as readdirSync6, readFileSync as readFileSync12, statSync as statSync5 } from "node:fs";
 import { join as join22 } from "node:path";
 function isExamplePath(path15) {
-  return /(?:^|\/)examples?\//.test(path15.replace(/\\/g, "/"));
+  return /(?:^|\/)examples\/|^example\//i.test(path15.replace(/\\/g, "/"));
+}
+var PROVIDER_OR_BACKEND = new RegExp(
+  String.raw`(?:^|\n)\s*(?:provider|backend)\s+${BLOCK_LABEL}\s*\{`
+);
+var CLOUD_BLOCK = /(?:^|\n)\s*cloud\s*\{/;
+function configuresDeployment(name, text) {
+  if (name.endsWith(".tf.json")) {
+    let doc;
+    try {
+      doc = JSON.parse(text);
+    } catch {
+      return false;
+    }
+    if (typeof doc !== "object" || doc === null) return false;
+    const { provider: provider2, terraform } = doc;
+    if (provider2 !== void 0) return true;
+    return [terraform].flat().some((t) => typeof t === "object" && t !== null && ("backend" in t || "cloud" in t));
+  }
+  if (PROVIDER_OR_BACKEND.test(text)) return true;
+  return parseBlocks(text, ["terraform"]).some((b) => CLOUD_BLOCK.test(b.body));
+}
+var isTerraformFile2 = (name) => name.endsWith(".tf") || name.endsWith(".tf.json");
+function deploysFrom(dir) {
+  let names;
+  try {
+    names = readdirSync6(dir).filter(isTerraformFile2);
+  } catch {
+    return false;
+  }
+  return names.some((name) => {
+    try {
+      return configuresDeployment(name, readFileSync12(join22(dir, name), "utf8"));
+    } catch {
+      return false;
+    }
+  });
 }
-var PROVIDER_OR_BACKEND = /^\s*(?:provider\s+"|backend\s+")/m;
 function holdsTerraform(dir, depth) {
   let entries;
   try {
@@ -272955,26 +273075,35 @@ function holdsTerraform(dir, depth) {
   return false;
 }
 function libraryRepoReason(cwd) {
-  let rootFiles;
+  let rootEntries;
   try {
-    rootFiles = readdirSync6(cwd).filter((f) => f.endsWith(".tf"));
+    rootEntries = readdirSync6(cwd);
   } catch {
     return null;
   }
-  if (rootFiles.length === 0) return null;
-  for (const f of rootFiles) {
-    let text;
-    try {
-      text = readFileSync12(join22(cwd, f), "utf8");
-    } catch {
-      continue;
-    }
-    if (PROVIDER_OR_BACKEND.test(text)) return null;
-  }
-  const examples = ["examples", "example"].find((d) => existsSync6(join22(cwd, d)));
+  if (!rootEntries.some(isTerraformFile2) || deploysFrom(cwd)) return null;
+  const examples = rootEntries.find((d) => /^examples?$/i.test(d));
   if (examples === void 0 || !holdsTerraform(join22(cwd, examples), 2)) return null;
   return `the repository root configures no provider and no backend, and ships \`${examples}/\`: it is a module other configurations call, so restructuring it is churn for every caller`;
 }
+function libraryScope(cwd) {
+  const reason = libraryRepoReason(cwd);
+  if (reason === null) return () => null;
+  const deploys = /* @__PURE__ */ new Map();
+  return (file2) => {
+    const dirs = file2.replace(/\\/g, "/").split("/").slice(0, -1);
+    for (let i = dirs.length; i > 0; i--) {
+      const dir = dirs.slice(0, i).join("/");
+      let d = deploys.get(dir);
+      if (d === void 0) {
+        d = deploysFrom(join22(cwd, dir));
+        deploys.set(dir, d);
+      }
+      if (d) return null;
+    }
+    return reason;
+  };
+}
 function reportOnly(reason) {
   return reason === null ? {} : { report_only: true, report_only_reason: reason };
 }
@@ -273332,12 +273461,12 @@ function ModuleExtractionCandidatesTool(ctx) {
     parameters: ModuleExtractionCandidatesParams,
     execute: execute(async () => {
       const cwd = ctx.payload.cwd ?? process.cwd();
+      const library = libraryScope(cwd);
       const candidates = findExtractionCandidates(
         cwd,
         ctx.payload.moduleCatalogue,
         ctx.toolState.orgModuleHcl
-      ).filter((c) => ctx.payload.refactorExamples || !isExamplePath(c.cluster.file));
-      const library = libraryRepoReason(cwd);
+      ).filter((c) => ctx.payload.refactorExamples || !isExamplePath(c.cluster.file)).map((c) => ({ ...reportOnly(library(c.cluster.file)), ...c }));
       const matched = candidates.filter((c) => c.candidates.length > 0);
       const reasons = {};
       for (const c of candidates)
@@ -273351,7 +273480,6 @@ function ModuleExtractionCandidatesTool(ctx) {
         `\xBB module_extraction_candidates: ${candidates.length} cluster(s), ${matched.length} with a module match` + (partialInterfaces.length > 0 ? `, ${partialInterfaces.length} partial-interface block(s)` : "")
       );
       return toolOk({
-        ...reportOnly(library),
         cluster_count: candidates.length,
         matched_count: matched.length,
         candidates,
@@ -273375,7 +273503,7 @@ function ModuleExtractionCandidatesTool(ctx) {
 }
 
 // src/mcp/moduleTests.ts
-import { existsSync as existsSync7, readdirSync as readdirSync7, readFileSync as readFileSync14, statSync as statSync6 } from "node:fs";
+import { existsSync as existsSync6, readdirSync as readdirSync7, readFileSync as readFileSync14, statSync as statSync6 } from "node:fs";
 import { join as join24 } from "node:path";
 var MODULE_META_ARGS = /* @__PURE__ */ new Set([
   "source",
@@ -273496,7 +273624,7 @@ function resolveSourceDir(fromDir, source) {
 }
 function isDir(p) {
   try {
-    return existsSync7(p) && statSync6(p).isDirectory();
+    return existsSync6(p) && statSync6(p).isDirectory();
   } catch {
     return false;
   }
@@ -273630,7 +273758,7 @@ function TerraformModuleTestsTool(ctx) {
 }
 
 // src/mcp/terraform/tools/advise.ts
-import { existsSync as existsSync8, readFileSync as readFileSync16 } from "node:fs";
+import { existsSync as existsSync7, readFileSync as readFileSync16 } from "node:fs";
 import { join as join26 } from "node:path";
 
 // src/mcp/terraform/fixMemory.ts
@@ -273789,7 +273917,7 @@ function inlineWaivers(content, file2) {
 }
 function readLearnings(tmpdir6) {
   const path15 = join26(tmpdir6, LEARNINGS_FILE);
-  if (!existsSync8(path15)) return [];
+  if (!existsSync7(path15)) return [];
   try {
     return readFileSync16(path15, "utf-8").split("\n");
   } catch {
@@ -275151,6 +275279,9 @@ function ConsolidationCandidatesTool(ctx) {
 import { readFileSync as readFileSync18 } from "node:fs";
 import { join as join28 } from "node:path";
 
+// src/mcp/staleFix.ts
+import { createHash as createHash6 } from "node:crypto";
+
 // node_modules/.pnpm/@infraweaver-io+ci@0.1.8/node_modules/@infraweaver-io/ci/dist/progressComment.js
 function parseProgressComment(raw2) {
   if (!raw2?.id)
@@ -276206,7 +276337,31 @@ function groupIdFromBranch(branch) {
 }
 function remediationBranchSuffix(base, defaultBranch) {
   if (!base || !defaultBranch || base === defaultBranch) return "";
-  return `--${base.replace(/[^A-Za-z0-9._-]+/g, "-")}`;
+  const slug2 = base.replace(/[^A-Za-z0-9._-]+/g, "-");
+  if (slug2 === base) return `--${slug2}`;
+  return `--${slug2}-${createHash6("sha1").update(base).digest("hex").slice(0, 8)}`;
+}
+function remediationBranchFor(id, base, defaultBranch, open3) {
+  const computed = `remediate/${id}${remediationBranchSuffix(base, defaultBranch)}`;
+  const heads = (open3 ?? []).filter((pr) => pr.base === base && groupIdFromBranch(pr.head) === id).map((pr) => pr.head).filter((head) => !(open3 ?? []).some((pr) => pr.head === head && pr.base !== base));
+  return heads.includes(computed) ? computed : heads[0] ?? computed;
+}
+async function listOpenRemediationPrs(ctx) {
+  const { octokit, repo } = ctx;
+  if (ctx.toolState?.selectedMode !== "Remediate") return [];
+  if (!octokit || !repo?.owner || !repo.name) return [];
+  try {
+    const open3 = await octokit.paginate(octokit.rest.pulls.list, {
+      owner: repo.owner,
+      repo: repo.name,
+      state: "open",
+      per_page: 100
+    });
+    return open3.filter((pr) => pr.head.repo?.id === pr.base.repo.id && groupIdFromBranch(pr.head.ref)).map((pr) => ({ head: pr.head.ref, base: pr.base.ref }));
+  } catch (e) {
+    log2.warning(`\xBB could not list open remediation PRs: ${errorMessage(e)}`);
+    return [];
+  }
 }
 function matchesBotIdentity(identity) {
   const normalized = identity.replace(/\[bot\]$/i, "").toLowerCase();
@@ -276919,15 +277074,17 @@ function siteOf(c, read3) {
   const text = read3(c.location.file);
   return text === null ? null : resourceAddressAt(text, c.location.line);
 }
-function recordConcernSites(session, concerns, cwd) {
+function recordConcernSites(session, concerns, cwd, linesMatchTree) {
   const read3 = fileReader(cwd);
   session.siteById ??= /* @__PURE__ */ new Map();
   session.firstSitesByKey ??= /* @__PURE__ */ new Map();
   const first = session.firstSitesByKey;
   const fresh = /* @__PURE__ */ new Map();
   for (const c of concerns) {
-    const site = siteOf(c, read3);
-    session.siteById.set(c.id, site);
+    const site = linesMatchTree ? siteOf(c, read3) : null;
+    const prior = session.siteById.get(c.id);
+    session.siteById.set(c.id, prior === void 0 || prior === site ? site : null);
+    if (!linesMatchTree) continue;
     const key = concernKeyOf(c);
     if (first.has(key)) continue;
     const sites = fresh.get(key) ?? /* @__PURE__ */ new Set();
@@ -276983,7 +277140,7 @@ function buildConcernResult(ctx, rawConcerns, opts) {
     fullBaseline.map((c) => concernKeyOf(c))
   );
   recordConcernKeys(session, fullBaseline);
-  recordConcernSites(session, fullBaseline, opts.cwd);
+  recordConcernSites(session, fullBaseline, opts.cwd, opts.linesMatchTree ?? false);
   session.baselineFmtDriftFiles = union3(
     session.baselineFmtDriftFiles,
     fullBaseline.filter((c) => c.source === "terraform-fmt").map((c) => c.location.file)
@@ -276998,13 +277155,13 @@ function buildConcernResult(ctx, rawConcerns, opts) {
     active,
     opts.autonomyThreshold
   );
-  const suffix2 = remediationBranchSuffix(
-    remediationBaseOf(ctx),
-    ctx.repo?.data.default_branch?.trim() || void 0
-  );
-  const groups2 = (opts.priority ? prioritizeGroups(annotatedGroups, active, opts.priority) : annotatedGroups).map((g) => ({ ...g, branch: `remediate/${g.id}${suffix2}` }));
+  const base = remediationBaseOf(ctx);
+  const defaultBranch = ctx.repo?.data.default_branch?.trim() || void 0;
+  const branchFor = (id) => remediationBranchFor(id, base, defaultBranch, opts.openRemediationPrs);
+  const groups2 = (opts.priority ? prioritizeGroups(annotatedGroups, active, opts.priority) : annotatedGroups).map((g) => ({ ...g, branch: branchFor(g.id) }));
   const planned = planBatches(groups2);
-  const batchPlan = planned.batch_branch ? { ...planned, batch_branch: `${planned.batch_branch}${suffix2}` } : planned;
+  const batchId = planned.batch_branch ? groupIdFromBranch(planned.batch_branch) : null;
+  const batchPlan = batchId ? { ...planned, batch_branch: branchFor(batchId) } : planned;
   const bySeverity = {};
   for (const c of active) bySeverity[c.severity] = (bySeverity[c.severity] ?? 0) + 1;
   return {
@@ -277521,7 +277678,8 @@ function DetectPlanDriftTool(ctx) {
         autonomyThreshold,
         // drift is a narrow concern source — join any prior scan baseline so a
         // later ✗→✓ verify doesn't read the whole workspace as regressions.
-        baselineMode: "merge"
+        baselineMode: "merge",
+        openRemediationPrs: await listOpenRemediationPrs(ctx)
       });
       log2.info(
         `\xBB detect_plan_drift: ${active.length} drifted resource(s) \u2265 ${threshold} from ${planPath}` + (noiseFiltered.length ? `, ${noiseFiltered.length} noise-filtered` : "") + (unlocated.length ? `, ${unlocated.length} unlocated` : "") + (statefulForgotten.length ? `, ${statefulForgotten.length} STATEFUL forget(s)` : "") + (suppressed.length ? ` (${suppressed.length} suppressed)` : "")
@@ -277592,13 +277750,13 @@ import { readFileSync as readFileSync19, rmSync as rmSync2 } from "node:fs";
 import { join as join29 } from "node:path";
 
 // src/mcp/terraform/emittedArtefacts.ts
-import { createHash as createHash6 } from "node:crypto";
+import { createHash as createHash7 } from "node:crypto";
 import { writeFileSync as writeFileSync3 } from "node:fs";
 import { resolve as resolve5 } from "node:path";
 var ARTEFACT_DIR = "compliance/";
 function gitBlobId(bytes) {
   const content = Buffer.from(bytes, "utf8");
-  return createHash6("sha1").update(`blob ${content.length}\0`).update(content).digest("hex");
+  return createHash7("sha1").update(`blob ${content.length}\0`).update(content).digest("hex");
 }
 function writeEmittedArtefact(toolState, path15, bytes) {
   writeFileSync3(path15, bytes);
@@ -278795,7 +278953,7 @@ function buildSuppressionSummary(waivers) {
 }
 
 // node_modules/.pnpm/@infraweaver-io+attest@0.1.7_supports-color@7.2.0/node_modules/@infraweaver-io/attest/dist/signing.js
-import { createHash as createHash7, createPrivateKey, createPublicKey, sign as cryptoSign, verify as cryptoVerify } from "node:crypto";
+import { createHash as createHash8, createPrivateKey, createPublicKey, sign as cryptoSign, verify as cryptoVerify } from "node:crypto";
 var SIGNATURE_ALGORITHM = "Ed25519";
 var DEFAULT_KEY_LABEL = "the signing key";
 function loadSigningKey(raw2, options) {
@@ -278822,7 +278980,7 @@ function loadSigningKey(raw2, options) {
   return {
     privateKey,
     publicKeyPem,
-    fingerprint: createHash7("sha256").update(spkiDer).digest("hex")
+    fingerprint: createHash8("sha256").update(spkiDer).digest("hex")
   };
 }
 function signBytes(bytes, key) {
@@ -278843,7 +279001,7 @@ function publicKeyFingerprint(publicKeyPem) {
     type: "spki",
     format: "der"
   });
-  return createHash7("sha256").update(der).digest("hex");
+  return createHash8("sha256").update(der).digest("hex");
 }
 function signatureMetadata(key, sigFile) {
   return {
@@ -279073,7 +279231,7 @@ function buildEvidenceBundle(args2) {
 // node_modules/.pnpm/@infraweaver-io+attest@0.1.7_supports-color@7.2.0/node_modules/@infraweaver-io/attest/dist/keyless.js
 var import_bundle = __toESM(require_dist6(), 1);
 var import_sign = __toESM(require_dist9(), 1);
-import { createHash as createHash8 } from "node:crypto";
+import { createHash as createHash9 } from "node:crypto";
 
 // node_modules/.pnpm/@infraweaver-io+attest@0.1.7_supports-color@7.2.0/node_modules/@infraweaver-io/attest/dist/keylessOidc.js
 var SIGSTORE_OIDC_AUDIENCE = "sigstore";
@@ -279102,7 +279260,7 @@ function keylessSigningPossible(env2, envName) {
 }
 function buildInTotoStatement(args2) {
   const data = typeof args2.artifactBytes === "string" ? Buffer.from(args2.artifactBytes, "utf8") : args2.artifactBytes;
-  const sha2562 = createHash8("sha256").update(data).digest("hex");
+  const sha2562 = createHash9("sha256").update(data).digest("hex");
   return {
     _type: "https://in-toto.io/Statement/v1",
     subject: [{ name: args2.subjectName, digest: { sha256: sha2562 } }],
@@ -279312,12 +279470,12 @@ import { mkdirSync as mkdirSync4 } from "node:fs";
 import { dirname as dirname6 } from "node:path";
 
 // src/mcp/terraform/oscal.ts
-import { createHash as createHash9 } from "node:crypto";
+import { createHash as createHash10 } from "node:crypto";
 var OSCAL_VERSION = "1.1.2";
 var INDICATIVE_REMARK = "Indicative, crosswalk-derived assessment from a deterministic starter rule-pack \u2014 NOT a formal OSCAL assessment against an authored assessment plan. Statuses are code-verified only; absence of a finding is not proof of compliance.";
 var NS = "https://infraweaver.io/ns/oscal";
 function deterministicUuid(seed) {
-  const hex4 = createHash9("sha256").update(seed).digest("hex").slice(0, 32).split("");
+  const hex4 = createHash10("sha256").update(seed).digest("hex").slice(0, 32).split("");
   hex4[12] = "5";
   hex4[16] = (Number.parseInt(hex4[16] ?? "0", 16) & 3 | 8).toString(16);
   const u = hex4.join("");
@@ -279456,7 +279614,7 @@ function TerraformEmitOscalTool(ctx) {
 import { writeFileSync as writeFileSync5 } from "node:fs";
 
 // src/mcp/terraform/lineage.ts
-import { createHash as createHash10 } from "node:crypto";
+import { createHash as createHash11 } from "node:crypto";
 import { readFileSync as readFileSync21 } from "node:fs";
 import { join as join31 } from "node:path";
 function repoFileReader(cwd) {
@@ -279469,7 +279627,7 @@ function repoFileReader(cwd) {
   };
 }
 function lineageKeyOf(c, address) {
-  return createHash10("sha1").update(`${c.source}|${bareRuleOf(c.source, c.rule_id)}|${c.location.file}|${address ?? ""}`).digest("hex").slice(0, 16);
+  return createHash11("sha1").update(`${c.source}|${bareRuleOf(c.source, c.rule_id)}|${c.location.file}|${address ?? ""}`).digest("hex").slice(0, 16);
 }
 function lineageResolver(read3) {
   const files = /* @__PURE__ */ new Map();
@@ -280511,16 +280669,32 @@ function uncoveredInstanceKeys(p) {
   if (expected === null) return null;
   const kind = level[0].kind;
   const written = (k) => kind === "count" ? k : `"${k}"`;
+  const fromAt = level[0].at;
+  const toAt = p.after.multiplicity[0]?.at;
+  if (fromAt === void 0 || toAt === void 0) return null;
   const declared2 = /* @__PURE__ */ new Set();
   for (const blk of p.blocks) {
+    if (stripIndices(normaliseAddress(blk.from)) !== p.before.address || stripIndices(normaliseAddress(blk.to)) !== p.after.address)
+      return null;
     const from = instanceKeysOf(blk.from);
     const to = instanceKeysOf(blk.to);
     if (from.length > 1 || to.length > 1) return null;
     if (from.length === 0 && to.length === 0) return null;
-    if (from.length === 1 && to.length === 1 && from[0] === to[0]) declared2.add(from[0]);
+    if (from.length !== 1 || to.length !== 1 || from[0] !== to[0]) continue;
+    const fromPlaced = keyAtLevel(blk.from, fromAt);
+    const toPlaced = keyAtLevel(blk.to, toAt);
+    if (fromPlaced === false || toPlaced === false) continue;
+    if (fromPlaced === null || toPlaced === null) return null;
+    declared2.add(from[0]);
   }
   return expected.filter((k) => !declared2.has(written(k)));
 }
+function keyAtLevel(address, at) {
+  const onResource = instanceKeysOf(stripModuleHops(normaliseAddress(address))).length > 0;
+  if (at === "resource") return onResource;
+  if (onResource) return false;
+  return moduleHops(address).length === 1 ? true : null;
+}
 function computeEquivalence(before, after, movedBlocks, ambiguous = [], planPairs, opts = {}) {
   const reasons = [];
   const corr = correspond(before, after, movedBlocks);
@@ -282447,7 +282621,8 @@ function IngestExternalFindingsTool(ctx) {
         // an external feed is a narrow concern source — join any prior scan
         // baseline so a later ✗→✓ verify doesn't read the workspace as regressions.
         baselineMode: "merge",
-        seedCaps: seedCapsFrom(input2)
+        seedCaps: seedCapsFrom(input2),
+        openRemediationPrs: await listOpenRemediationPrs(ctx)
       });
       const cappedBlock = cappedSummary(capped);
       log2.info(
@@ -282917,15 +283092,13 @@ function NormalizationCandidatesTool(ctx) {
     parameters: NormalizationCandidatesParams,
     execute: execute(async () => {
       const cwd = ctx.payload.cwd ?? process.cwd();
-      const files = findNormalizationCandidates(cwd).filter(
-        (f) => ctx.payload.refactorExamples || !isExamplePath(f.file)
-      );
+      const library = libraryScope(cwd);
+      const files = findNormalizationCandidates(cwd).filter((f) => ctx.payload.refactorExamples || !isExamplePath(f.file)).map((f) => ({ ...reportOnly(library(f.file)), ...f }));
       const total = files.reduce((n, f) => n + f.count, 0);
       log2.info(
         `\xBB terraform_normalization_candidates: ${total} site(s) across ${files.length} file(s)`
       );
       return toolOk({
-        ...reportOnly(libraryRepoReason(cwd)),
         file_count: files.length,
         total,
         files,
@@ -283460,7 +283633,8 @@ function ReadFindingsTool(ctx) {
         minRank,
         grouping,
         autonomyThreshold,
-        seedCaps: seedCapsFrom(input2)
+        seedCaps: seedCapsFrom(input2),
+        openRemediationPrs: await listOpenRemediationPrs(ctx)
       });
       const cappedBlock = cappedSummary(capped);
       log2.info(
@@ -283639,23 +283813,54 @@ function computeScanDelta(input2) {
   };
 }
 function markPossibleRenames(introduced, resolved, headAddresses) {
-  const vanished = resolved.filter((r) => {
-    if (r.address === null) return false;
-    return !headAddresses(dirOf3(r.concern.location.file)).has(r.address);
-  });
+  const byResource = (findings) => {
+    const out = /* @__PURE__ */ new Map();
+    for (const f of [...findings].sort((a, b) => byLocation(a.concern, b.concern))) {
+      if (f.address === null) continue;
+      const dir = dirOf3(f.concern.location.file);
+      const key = `${dir}|${f.address}`;
+      const entry4 = out.get(key);
+      if (entry4) entry4.findings.push(f);
+      else out.set(key, { dir, address: f.address, findings: [f] });
+    }
+    return [...out.values()];
+  };
+  const vanished = byResource(resolved).filter((r) => !headAddresses(r.dir).has(r.address));
+  const appeared = byResource(introduced);
+  const shared = (from, to) => {
+    const left = /* @__PURE__ */ new Map();
+    for (const f of from.findings)
+      left.set(ruleKey(f.concern), (left.get(ruleKey(f.concern)) ?? 0) + 1);
+    return to.findings.filter((f) => {
+      const n = left.get(ruleKey(f.concern)) ?? 0;
+      if (n === 0) return false;
+      left.set(ruleKey(f.concern), n - 1);
+      return true;
+    });
+  };
+  const order2 = (a, b) => a.dir.localeCompare(b.dir) || a.address.localeCompare(b.address);
+  const candidates = vanished.flatMap(
+    (from) => appeared.filter(
+      (to) => (
+        // a `moved` block cannot change a resource's type
+        typeOf(from.address) === typeOf(to.address) && // renamed in place, or moved elsewhere under its own name
+        from.dir === to.dir !== (from.address === to.address)
+      )
+    ).map((to) => ({ from, to, findings: shared(from, to) })).filter((p) => p.findings.length > 0)
+  );
+  candidates.sort(
+    (a, b) => b.findings.length - a.findings.length || order2(a.from, b.from) || order2(a.to, b.to)
+  );
   const used = /* @__PURE__ */ new Set();
-  for (const finding of introduced) {
-    if (finding.address === null) continue;
-    const dir = dirOf3(finding.concern.location.file);
-    const match5 = vanished.find(
-      (r) => !used.has(r) && ruleKey(r.concern) === ruleKey(finding.concern) && // a `moved` block cannot change a resource's type
-      typeOf(r.address) === typeOf(finding.address) && // renamed in place, or moved elsewhere under its own name
-      dirOf3(r.concern.location.file) === dir !== (r.address === finding.address)
-    );
-    if (!match5) continue;
-    used.add(match5);
-    finding.possiblyPreexisting = true;
-    finding.renamedFrom = { address: match5.address, file: match5.concern.location.file };
+  for (const { from, to, findings } of candidates) {
+    if (used.has(from) || used.has(to)) continue;
+    used.add(from);
+    used.add(to);
+    const file2 = from.findings[0]?.concern.location.file;
+    for (const finding of findings) {
+      finding.possiblyPreexisting = true;
+      finding.renamedFrom = { address: from.address, file: file2 };
+    }
   }
 }
 function typeOf(address) {
@@ -283698,7 +283903,8 @@ function deltaVerdict(delta, requiredControls) {
   return {
     pass: gate.pass && required3.length === 0,
     gating: gate.gating.length,
-    required: required3.length
+    required: required3.length,
+    blocking: (/* @__PURE__ */ new Set([...gate.gating, ...required3])).size
   };
 }
 function failsGate(finding, requiredControls) {
@@ -283991,7 +284197,9 @@ async function runScan(ctx, {
       grouping,
       autonomyThreshold,
       inScope,
-      priority
+      priority,
+      openRemediationPrs: await listOpenRemediationPrs(ctx),
+      linesMatchTree: true
     }
   );
   const { active, suppressed, groups: groups2, batchPlan, bySeverity: by_severity } = result;
@@ -284520,8 +284728,8 @@ function TerraformStandardsReportTool(ctx) {
 }
 
 // src/mcp/terraform/tools/tag.ts
-import { createHash as createHash11 } from "node:crypto";
-import { existsSync as existsSync9, readdirSync as readdirSync8, readFileSync as readFileSync26, realpathSync as realpathSync2, rmSync as rmSync7 } from "node:fs";
+import { createHash as createHash12 } from "node:crypto";
+import { existsSync as existsSync8, readdirSync as readdirSync8, readFileSync as readFileSync26, realpathSync as realpathSync2, rmSync as rmSync7 } from "node:fs";
 import { isAbsolute as isAbsolute3, join as join40, relative as relative5, resolve as resolve6, sep as sep2 } from "node:path";
 var TerraformTagParams = type({
   tags: type({ "[string]": "string" }).describe(
@@ -284543,7 +284751,7 @@ var TerraformTagParams = type({
 var realRunners3 = { run };
 function sha(path15) {
   try {
-    return createHash11("sha256").update(readFileSync26(path15)).digest("hex");
+    return createHash12("sha256").update(readFileSync26(path15)).digest("hex");
   } catch {
     return null;
   }
@@ -284557,7 +284765,7 @@ function toPosix(p) {
 function terratagFiles(dir) {
   const dirs = [dir];
   const manifest = join40(dir, ".terraform", "modules", "modules.json");
-  if (existsSync9(manifest)) {
+  if (existsSync8(manifest)) {
     let modules;
     try {
       modules = JSON.parse(readFileSync26(manifest, "utf8")).Modules;
@@ -284600,12 +284808,12 @@ function runTag(ctx, params, runners = realRunners3) {
     return rel !== ".." && !rel.startsWith(`..${sep2}`) && !isAbsolute3(rel);
   };
   const requested = resolve6(cwd, params.dir ?? ".");
-  const target = existsSync9(requested) ? realpathSync2(requested) : requested;
+  const target = existsSync8(requested) ? realpathSync2(requested) : requested;
   if (!inside(target)) {
     throw new Error(`terraform_tag: \`dir\` must stay inside the workspace (got ${params.dir})`);
   }
   const relDir = toPosix(relative5(cwd, target)) || ".";
-  if (!existsSync9(target)) {
+  if (!existsSync8(target)) {
     return toolSkip("no_terraform_files", `no .tf files under ${relDir}`);
   }
   const absFiles = terratagFiles(target);
@@ -284643,7 +284851,7 @@ function runTag(ctx, params, runners = realRunners3) {
   if (params.filter) args2.push(`-filter=${params.filter}`);
   if (params.skip) args2.push(`-skip=${params.skip}`);
   const before = snapshot2(cwd, files);
-  const priorBackups = new Set(files.filter((f) => existsSync9(join40(cwd, `${f}.bak`))));
+  const priorBackups = new Set(files.filter((f) => existsSync8(join40(cwd, `${f}.bak`))));
   const r = runners.run("terratag", args2, cwd);
   if (r.missing) {
     return toolSkip(
@@ -285066,10 +285274,10 @@ var DispatchRecorder = class {
    * orchestrator counts as subagent — including a session the labeler could not
    * name, because an unnamed session is by definition not the orchestrator's.
    */
-  recordTokens(label, billableTokens2) {
-    if (!Number.isFinite(billableTokens2) || billableTokens2 <= 0) return;
-    if (label === ORCHESTRATOR_LABEL) this.#orchestratorTokens += billableTokens2;
-    else this.#subagentTokens += billableTokens2;
+  recordTokens(label, billableTokens) {
+    if (!Number.isFinite(billableTokens) || billableTokens <= 0) return;
+    if (label === ORCHESTRATOR_LABEL) this.#orchestratorTokens += billableTokens;
+    else this.#subagentTokens += billableTokens;
   }
   tally() {
     return {
@@ -285239,7 +285447,7 @@ function buildLocalTools(ctx) {
   ];
 }
 function cliVersion() {
-  const raw2 = "0.3.12";
+  const raw2 = "0.3.13";
   if (raw2 !== void 0 && /^\d+\.\d+\.\d+$/.test(raw2)) {
     return raw2;
   }
@@ -285378,7 +285586,7 @@ async function runAssessCli(params) {
   }
   let cwd = process.cwd();
   if (rawCwd) cwd = isAbsolute4(rawCwd) ? rawCwd : resolve7(process.cwd(), rawCwd);
-  if (!existsSync10(cwd) || !statSync8(cwd).isDirectory()) {
+  if (!existsSync9(cwd) || !statSync8(cwd).isDirectory()) {
     console.error(`assess: not a directory: ${cwd}`);
     process.exit(ASSESS_EXIT.USAGE);
   }
@@ -285652,7 +285860,7 @@ var import_arg3 = __toESM(require_arg(), 1);
 
 // node_modules/.pnpm/@infraweaver-io+ci@0.1.8/node_modules/@infraweaver-io/ci/dist/gitAuth.js
 import { execSync } from "node:child_process";
-import { createHash as createHash12 } from "node:crypto";
+import { createHash as createHash13 } from "node:crypto";
 import { readFileSync as readFileSync28, realpathSync as realpathSync3, unlinkSync } from "node:fs";
 
 // node_modules/.pnpm/@infraweaver-io+sandbox@0.1.8/node_modules/@infraweaver-io/sandbox/dist/subprocess.js
@@ -285979,7 +286187,7 @@ ${errMsg}` : errMsg;
 // node_modules/.pnpm/@infraweaver-io+ci@0.1.8/node_modules/@infraweaver-io/ci/dist/gitAuth.js
 var gitBinary;
 function hashFile(path15) {
-  return createHash12("sha256").update(readFileSync28(path15)).digest("hex");
+  return createHash13("sha256").update(readFileSync28(path15)).digest("hex");
 }
 function resolveGit() {
   const lookup3 = process.platform === "win32" ? "where git" : "which git";
@@ -286352,7 +286560,7 @@ function TerraformChangeSummaryTool(ctx) {
 }
 
 // src/mcp/checkout.ts
-import { createHash as createHash13 } from "node:crypto";
+import { createHash as createHash14 } from "node:crypto";
 import { statSync as statSync9, unlinkSync as unlinkSync3, writeFileSync as writeFileSync13 } from "node:fs";
 import { join as join53 } from "node:path";
 
@@ -287546,7 +287754,7 @@ This mode standardises STRUCTURE while preserving BEHAVIOUR \u2014 the equivalen
    - \`${t("terraform_normalization_candidates")}\` \u2192 in-place idiomatic cleanups that change SYNTAX, not behaviour (redundant whole-string \`"\${expr}"\` interpolation; legacy HCL0.11 map-argument block syntax like \`vars {\` on a \`template_file\`). These relocate NOTHING \u2014 zero \`moved {}\` blocks \u2014 and are proven by the same equivalence check.
    - \`${t("terraform_consolidation_candidates")}\` \u2192 the SAME resource shape declared in several root directories (\`env/dev\` + \`env/staging\` + \`env/prod\`), with the single parameterised module they could all call already derived: which attributes are identical (module content) and which differ (per-environment inputs). A member root of a group will ALSO show up as a zero-candidate cluster in \`${t("module_extraction_candidates")}\` \u2014 prefer the consolidation, which does that work once for every environment instead of once per environment. Its \`near_groups\` are the opposite case: roots recognisably the same stack that DIFFER (one carries a resource the other does not), where folding them together is a design decision this mode has no basis for. Do NOT extract a near-group root's shared resources into a module on its own either \u2014 a module one twin calls and the other does not widens exactly the drift the near-group reports. Leave those roots alone and name the near-group and its \`differences\` in your report.
 
-   **A result marked \`report_only\` is an observation, not work.** The repository is a module other configurations call (\`report_only_reason\` says why), and restructuring it is churn for every caller: name those candidates in your \`${t("report_progress")}\` summary and open no PR for them. \`examples/\` roots are left out of every candidate list unless the operator set \`refactor_examples\`.
+   **A candidate marked \`report_only\` is an observation, not work.** It sits in the code of a module other configurations call (\`report_only_reason\` says why), and restructuring that is churn for every caller: name those candidates in your \`${t("report_progress")}\` summary and open no PR for them. \`examples/\` roots are left out of every candidate list unless the operator set \`refactor_examples\`.
 
    **Before picking, check the interface.** \`${t("module_extraction_candidates")}\` reports \`unmapped_attributes\` per candidate and a top-level \`partial_interfaces\` list: arguments the raw resources SET that the target module does not. Adopting such a module DROPS them silently \u2014 and the equivalence check cannot catch it, because once the argument is gone it is absent from both sides. Two of these are unrecoverable rather than merely wrong (\`object_lock_enabled\` cannot be set after creation; \`force_destroy\` changes deletion semantics). So: **decline the candidate, or extend the module to expose the argument and say so in the PR body.** Deleting the argument to make the shapes match is never the fix. A candidate whose \`unmapped_attributes\` is \`null\` was NOT checked \u2014 the module is external and its code is not in this repo \u2014 which is not the same as clean.
 
@@ -287679,7 +287887,7 @@ function remediateMode(t) {
 
 4. **for the chosen group**:
    - **base branch**: this run's base branch is resolved deterministically \u2014 \`${t("create_pull_request")}\` targets the \`base_branch\` input if set, else the branch the run started on, else the repository's default branch (\`main\`, or \`master\`). You do not choose it; just **omit** the \`base\` argument when opening the PR (below) and it is filled in.
-   - **idempotency**: the remediation branch is the group's \`branch\` (\`remediate/<group-id>\`, with a \`--<base>\` suffix when the PR targets a non-default branch) \u2014 use it exactly, never a name of your own. Before doing anything, check whether that branch or an open PR for it already exists (\`${t("git")}\` / \`${t("get_pull_request")}\`). If one exists, update it rather than opening a duplicate.
+   - **idempotency**: the remediation branch is the group's \`branch\` (\`remediate/<group-id>\`, with a \`--<base>\` suffix when the PR targets a non-default branch, or the branch of the PR already open for this group) \u2014 use it exactly, never a name of your own. Before doing anything, check whether that branch or an open PR for it already exists (\`${t("git")}\` / \`${t("get_pull_request")}\`). If one exists, update it rather than opening a duplicate.
    - **branch**: create the group's \`branch\` from the **current HEAD** (the checkout that was just scanned) via \`${t("git")}\` (\`git({ command: "checkout", args: ["-b", <branch>] })\`). Do NOT switch to a different base first \u2014 branching from the scanned checkout keeps the PR diff to exactly your fix.
    - **honest refusal (decide BEFORE fixing)**: if the group's concerns appear in the scan's \`refusal_candidates\` (the fix needs a human decision \u2014 narrowing an IAM wildcard, a KMS key policy, a real ingress CIDR), do **not** guess a fix that could break the stack. Instead open a structured issue (\`${t("create_issue")}\`) describing the concern, why it isn't auto-fixed, and what a human should do, and skip the PR for that group. A proven fix or an honest refusal \u2014 never a guessed, unverifiable PR.
    - **propose, then let me steer (when there's no single right fix)**: distinct from honest refusal (which refuses a fix a human must *decide*), this is for a finding with **2\u20133 genuinely distinct, defensible fixes** that differ in trade-offs, not correctness (e.g. encrypt with an AWS-managed key **vs** a customer-managed KMS key; a narrow security-group rule **vs** a prefix list **vs** a VPC endpoint). When such a fork exists **and the triggering comment did not already select a strategy**, do **not** silently pick for the reviewer: via \`${t("create_issue_comment")}\` post one short comment listing the options as **A / B / C** \u2014 each a single line (what it does + its trade-off) \u2014 and ask the reviewer to reply \`${COMMENT_COMMAND} fix #<concern-id> with strategy <A|B|C>\`. Then **skip the PR for this group** this run and note it in your final report (it resumes when the reviewer replies). When the comment **did** select one (\`fix #<id> with strategy B\`, or a bare \`strategy B\` reply on the proposal thread), apply **exactly** that strategy \u2014 don't second-guess it. Reserve this for real forks in the road; a fix with one obvious correct answer just gets made.
@@ -287740,7 +287948,7 @@ This mode composes the **Remediate** and **Refactor** verbs into a single run. I
    - **commit the fix** (\`git add\` only the changed \`*.tf\`/\`*.tfvars\`, a \`fix(tf): \u2026\` message). Do NOT push yet. This committed state is the refactor's equivalence BASELINE.
 
 3. **REFACTOR (phase 2) \u2014 modularise on top of the committed fix**: follow the **Refactor** mode's flow:
-   - \`${t("module_extraction_candidates")}\` / \`${t("terraform_normalization_candidates")}\` \u2192 pick one behaviour-preserving refactor; a result marked \`report_only\` (the repository is a module others call) is named in the summary, never proposed. Respect a pinned \`refactor_source\` if one was supplied (it constrains which module source you may use; the behaviour-altering b.4 path is only available when the operator pinned \`third-party\`).
+   - \`${t("module_extraction_candidates")}\` / \`${t("terraform_normalization_candidates")}\` \u2192 pick one behaviour-preserving refactor; a candidate marked \`report_only\` (it sits in the code of a module others call) is named in the summary, never proposed. Respect a pinned \`refactor_source\` if one was supplied (it constrains which module source you may use; the behaviour-altering b.4 path is only available when the operator pinned \`third-party\`).
    - resolve the module source, wire the \`module\` call against its real interface (\`${t("terraform_module_interface")}\` for a local module dir, \`${t("terraform_module_lookup")}\` for a registry-sourced one), and emit a \`moved {}\` block for EVERY relocated address (\`${t("terraform_generate_moved")}\`).
    - \`terraform fmt\` + \`${t("terraform_validate")}\`, then \u2014 **with the refactor edits still UNCOMMITTED** \u2014 call \`${t("terraform_equivalence_check")}\`. In this mode it diffs the working tree against the COMMITTED fix (not the run-start commit), so it measures only the refactor. It must return \`equivalent: true\` (zero uncovered moves, resource set + arguments preserved, validate + fmt clean) before you proceed; \`${t("push_branch")}\` hard-blocks an unproven one \u2014 and, once this run has added a \`moved {}\` block, it also hard-blocks a push that never ran the check at all, so abandoning the refactor means REVERTING its edits rather than leaving them in with the fix. If it can't be proven equivalent, abandon the refactor and ship the fix alone.
    - **document the module (only when the \`docs\` input is enabled)**: after the equivalence check passes, call \`${t("terraform_module_docs")}\` for the module you created/adopted (pass the relocated addresses as \`moves\`). Do not hand-write docs \u2014 the tool builds from the interface, moved blocks, and equivalence verdict.
@@ -288158,7 +288366,7 @@ import { setTimeout as sleep3 } from "node:timers/promises";
 
 // node_modules/.pnpm/@infraweaver-io+core@0.1.5/node_modules/@infraweaver-io/core/dist/packageManager.js
 var import_semver = __toESM(require_semver2(), 1);
-import { existsSync as existsSync11 } from "node:fs";
+import { existsSync as existsSync10 } from "node:fs";
 import { mkdir as mkdir2, readFile } from "node:fs/promises";
 import { delimiter as delimiter2, join as join44 } from "node:path";
 var SUPPORTED_NAMES = ["npm", "pnpm", "yarn", "bun"];
@@ -288201,7 +288409,7 @@ function parseDevEnginesField(field) {
 }
 async function resolvePackageManagerSpec(cwd) {
   const pkgPath = join44(cwd, "package.json");
-  if (!existsSync11(pkgPath))
+  if (!existsSync10(pkgPath))
     return null;
   let pkg;
   try {
@@ -289293,15 +289501,52 @@ var Git = type({
   args: type.string.array().describe("Additional arguments for the git command").optional()
 });
 function splitWords(line) {
-  return [...line.matchAll(/"([^"]*)"|'([^']*)'|(\S+)/g)].map((m) => m[1] ?? m[2] ?? m[3] ?? "");
+  const words2 = [];
+  let word = "";
+  let inWord = false;
+  let quote;
+  for (let i = 0; i < line.length; i++) {
+    const ch = line.charAt(i);
+    if (quote === "'") {
+      if (ch === "'") quote = void 0;
+      else word += ch;
+    } else if (quote === '"') {
+      if (ch === '"') quote = void 0;
+      else if (ch === "\\" && i + 1 < line.length && '"\\$`\n'.includes(line.charAt(i + 1))) {
+        i += 1;
+        if (line.charAt(i) !== "\n") word += line.charAt(i);
+      } else word += ch;
+    } else if (ch === " " || ch === "	") {
+      if (inWord) words2.push(word);
+      word = "";
+      inWord = false;
+    } else if (ch === "\n") {
+      throw new Error(
+        "command holds an unquoted newline \u2014 pass one git command per call, and quote a multi-line message"
+      );
+    } else if (ch === "\\") {
+      if (i + 1 >= line.length) throw new Error("command ends in a backslash that escapes nothing");
+      i += 1;
+      if (line.charAt(i) === "\n") continue;
+      word += line.charAt(i);
+      inWord = true;
+    } else if (ch === "'" || ch === '"') {
+      quote = ch;
+      inWord = true;
+    } else {
+      word += ch;
+      inWord = true;
+    }
+  }
+  if (quote) throw new Error(`command has an unterminated ${quote} quote`);
+  if (inWord) words2.push(word);
+  return words2;
 }
 function normalizeGitCall(params) {
-  let words2;
-  if (params.command === void 0) words2 = [...params.args ?? []];
-  else if (/^git\s/.test(params.command))
-    words2 = [...splitWords(params.command).slice(1), ...params.args ?? []];
-  else return { command: params.command, args: params.args ?? [] };
-  const [command, ...args2] = words2[0] === "git" ? words2.slice(1) : words2;
+  const words2 = params.command === void 0 ? [] : /^git\s/.test(params.command) ? splitWords(params.command) : [params.command];
+  words2.push(...params.args ?? []);
+  while (words2[0] === "git") words2.shift();
+  const [command, ...args2] = words2;
   if (command === void 0 || !/^[a-z][a-z0-9-]*$/.test(command)) {
     throw new Error(
       `command must be a Git subcommand such as 'status' or 'checkout' (was "${command ?? ""}")`
@@ -289737,7 +289982,7 @@ function claimsBlockingSeverity(body2) {
 init_core();
 import { isAbsolute as isAbsolute6, resolve as resolve10 } from "node:path";
 
-// node_modules/.pnpm/@infraweaver-io+models@0.1.6/node_modules/@infraweaver-io/models/dist/monotonicQuota.js
+// node_modules/.pnpm/@infraweaver-io+models@0.1.7/node_modules/@infraweaver-io/models/dist/monotonicQuota.js
 function createMonotonicQuota(params) {
   const { limit, unlimited, normalize: normalize5 } = params;
   let used = 0;
@@ -289762,7 +290007,7 @@ function createMonotonicQuota(params) {
   };
 }
 
-// node_modules/.pnpm/@infraweaver-io+models@0.1.6/node_modules/@infraweaver-io/models/dist/costQuota.js
+// node_modules/.pnpm/@infraweaver-io+models@0.1.7/node_modules/@infraweaver-io/models/dist/costQuota.js
 var CostQuotaExceededError = class extends Error {
   code = "COST_QUOTA_EXCEEDED";
   constructor(message2) {
@@ -289809,7 +290054,7 @@ function resolveRunCostQuota(parsed2) {
   return parsed2 === void 0 ? DEFAULT_RUN_COST_QUOTA_USD : parsed2;
 }
 
-// node_modules/.pnpm/@infraweaver-io+models@0.1.6/node_modules/@infraweaver-io/models/dist/tokenQuota.js
+// node_modules/.pnpm/@infraweaver-io+models@0.1.7/node_modules/@infraweaver-io/models/dist/tokenQuota.js
 var TokenQuotaExceededError = class extends Error {
   code = "TOKEN_QUOTA_EXCEEDED";
   constructor(message2) {
@@ -289819,19 +290064,16 @@ var TokenQuotaExceededError = class extends Error {
 };
 var DEFAULT_RUN_TOKEN_QUOTA = 1e7;
 var RUN_TOKEN_QUOTA_INPUT = "max_run_tokens";
-function billableTokens(t) {
-  let total = 0;
-  for (const v of [t.input, t.output, t.cacheRead, t.cacheWrite]) {
-    if (typeof v === "number" && Number.isFinite(v) && v > 0)
-      total += v;
-  }
-  return Math.floor(total);
+var CACHE_READ_WEIGHT = 0.1;
+function quotaTokens(t) {
+  const part = (v) => typeof v === "number" && Number.isFinite(v) && v > 0 ? v : 0;
+  return Math.floor(part(t.input) + part(t.output) + part(t.cacheWrite) + part(t.cacheRead) * CACHE_READ_WEIGHT);
 }
 function normalizeTotal(total) {
-  return typeof total === "number" ? Math.max(0, Math.floor(total)) : billableTokens(total);
+  return typeof total === "number" ? Math.max(0, Math.floor(total)) : quotaTokens(total);
 }
 function tokenGap(used, ceiling) {
-  return `run token quota exhausted: ${used.toLocaleString("en-GB")} of ${ceiling.toLocaleString("en-GB")} billable tokens consumed, so the run was stopped before it finished. Its results are INCOMPLETE and must not be read as a clean assessment \u2014 a finding that would have been raised after this point was never looked for. Raise \`${RUN_TOKEN_QUOTA_INPUT}\` if the run legitimately needs more budget, or set \`${RUN_TOKEN_QUOTA_INPUT}: 0\` to remove the bound entirely. A run that reaches this limit without finishing is more often a remediation loop that cannot converge (a fix that re-breaks its own check) than a genuinely large repository.`;
+  return `run token quota exhausted: ${used.toLocaleString("en-GB")} of ${ceiling.toLocaleString("en-GB")} tokens counted against the quota (a token read from the prompt cache counts as a tenth), so the run was stopped before it finished. Its results are INCOMPLETE and must not be read as a clean assessment \u2014 a finding that would have been raised after this point was never looked for. Raise \`${RUN_TOKEN_QUOTA_INPUT}\` if the run legitimately needs more budget, or set \`${RUN_TOKEN_QUOTA_INPUT}: 0\` to remove the bound entirely. A run that reaches this limit without finishing is more often a remediation loop that cannot converge (a fix that re-breaks its own check) than a genuinely large repository.`;
 }
 function unlimitedTokenQuota() {
   return createMonotonicQuota({
@@ -290974,6 +291216,12 @@ function parseCommentMarker(body2) {
     return null;
   }
 }
+function findingKeysIn(body2) {
+  return [...body2.matchAll(new RegExp(MARKER.source, "g"))].flatMap((m) => {
+    const marker2 = parseCommentMarker(m[0]);
+    return marker2?.kind === "finding" ? [marker2.key] : [];
+  });
+}
 var SUGGESTION = /```suggestion\r?\n([\s\S]*?)```/;
 function suggestionText(body2) {
   const m = SUGGESTION.exec(body2);
@@ -291223,39 +291471,115 @@ function formatDuplicateCommentsNote(duplicates) {
 var MAX_DUPLICATE_COMMENT_LINES = 50;
 
 // src/mcp/reviewCommentLimit.ts
-var MAX_OVERFLOW_LINES = 50;
+var MAX_NOTE_CHARS = 3e4;
+var TRAILER_RESERVE = 400;
 var PROVEN_MARK = "\u2705 **Proven by re-scan**";
-function rank(c) {
+var SEVERITY_LEVEL = {
+  critical: 0,
+  high: 1,
+  medium: 2,
+  low: 3,
+  info: 4
+};
+var MARKER_LEVEL = { "\u{1F6A8}": 1, "\u26A0\uFE0F": 2, "\u26A0": 2, "\u2139\uFE0F": 3, \u2139: 3 };
+var UNMARKED_LEVEL = 2;
+function rank(c, severity) {
   const body2 = c.body ?? "";
-  const marker2 = leadingMarker(body2);
-  const severity = marker2 === "\u{1F6A8}" ? 0 : marker2 === "\u26A0\uFE0F" || marker2 === "\u26A0" ? 2 : 4;
-  return severity + (body2.includes(PROVEN_MARK) ? 0 : 1);
+  const level = severity ? SEVERITY_LEVEL[severity] : MARKER_LEVEL[leadingMarker(body2) ?? ""] ?? UNMARKED_LEVEL;
+  return level * 2 + (body2.includes(PROVEN_MARK) ? 0 : 1);
 }
-function limitInlineComments(comments, limit) {
+function limitInlineComments(comments, limit, severityOf) {
   if (!limit || comments.length <= limit) return { kept: [...comments], overflow: [] };
   const keep = new Set(
-    comments.map((c, i) => ({ i, r: rank(c) })).sort((a, b) => a.r - b.r || a.i - b.i).slice(0, limit).map(({ i }) => i)
+    comments.map((c, i) => ({ i, r: rank(c, severityOf?.(c)) })).sort((a, b) => a.r - b.r || a.i - b.i).slice(0, limit).map(({ i }) => i)
   );
   return {
     kept: comments.filter((_, i) => keep.has(i)),
     overflow: comments.filter((_, i) => !keep.has(i))
   };
 }
-function formatOverflowNote(overflow, limit) {
+var escapeHtml = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+var whereOf = (c) => c.line ? `${c.path}:${c.line}` : c.path;
+function closesItself(body2) {
+  const occurrences = (re) => body2.match(re)?.length ?? 0;
+  const fences = body2.split("\n").filter((l) => /^\s*(```|~~~)/.test(l)).length;
+  return fences % 2 === 0 && occurrences(/<details\b/gi) === occurrences(/<\/details\s*>/gi) && occurrences(/<!--/g) === occurrences(/-->/g);
+}
+function asText(body2) {
+  const longest = Math.max(0, ...(body2.match(/`+/g) ?? []).map((run4) => run4.length));
+  const fence = "`".repeat(Math.max(3, longest + 1));
+  return `${fence}text
+${body2}
+${fence}`;
+}
+function renderWhole(c, linkOf) {
+  const where4 = escapeHtml(whereOf(c));
+  const gist = gistOf(c.body);
+  const href = linkOf?.(c);
+  const body2 = c.body ?? "";
+  return [
+    `<details><summary><code>${where4}</code>${gist ? ` \u2014 ${gist}` : ""}</summary>`,
+    ...href ? [`<a href="${escapeHtml(href)}">${where4}</a>`] : [],
+    ...body2 ? [closesItself(body2) ? body2 : asText(body2)] : [],
+    "</details>"
+  ].join("\n\n");
+}
+function renderBrief(c) {
+  const gist = gistOf(c.body);
+  const markers = findingKeysIn(c.body ?? "").map(
+    (key) => renderCommentMarker({ kind: "finding", key, proven: false })
+  );
+  return `- \`${whereOf(c).replace(/`/g, "'")}\`${gist ? ` \u2014 ${gist}` : ""}${markers.map((m) => ` ${m}`).join("")}`;
+}
+function formatOverflowNote(overflow, limit, linkOf) {
   if (overflow.length === 0) return "";
-  const shown = overflow.slice(0, MAX_OVERFLOW_LINES).map((c) => {
-    const where4 = c.line ? `${c.path}:${c.line}` : c.path;
-    const gist = gistOf(c.body);
-    return `- \`${where4.replace(/`/g, "'")}\`${gist ? ` \u2014 ${gist}` : ""}`;
-  });
-  const rest = overflow.length - shown.length;
-  if (rest > 0) shown.push(`- \u2026and ${rest} more not shown`);
-  return `
+  const header = `
 
 ---
 
-**Note:** this review posts at most ${limit} inline comments (\`review_comment_limit\`), so ${overflow.length} more ${overflow.length === 1 ? "is" : "are"} listed here instead:
-` + shown.join("\n");
+**Note:** this review posts at most ${limit} inline comments (\`review_comment_limit\`), so ${overflow.length} more ${overflow.length === 1 ? "is" : "are"} listed here instead:`;
+  const SEP = 2;
+  let room = MAX_NOTE_CHARS - TRAILER_RESERVE - header.length;
+  const items = [];
+  for (const c of overflow) {
+    const brief2 = renderBrief(c);
+    if (brief2.length + SEP > room) break;
+    items.push(brief2);
+    room -= brief2.length + SEP;
+  }
+  let brief = items.length;
+  for (const [i, c] of overflow.slice(0, items.length).entries()) {
+    const whole = renderWhole(c, linkOf);
+    const extra = whole.length - items[i].length;
+    if (extra > room) continue;
+    items[i] = whole;
+    room -= extra;
+    brief--;
+  }
+  const omitted = overflow.length - items.length;
+  if (omitted > 0) items.push(`- \u2026and ${omitted} more not shown`);
+  const cut = [
+    brief > 0 ? `${brief} of them ${brief === 1 ? "is" : "are"} shown by place and first line only` : "",
+    omitted > 0 ? `${omitted} ${omitted === 1 ? "is" : "are"} not shown at all` : ""
+  ].filter(Boolean);
+  if (cut.length > 0) {
+    items.push(`${cut.join(" and ")}, to keep this review within GitHub's size limit.`);
+  }
+  return `${header}
+
+${items.join("\n\n")}`;
+}
+function foldedFindingsStillIntroduced(input2) {
+  const folded = new Set(
+    input2.reviews.flatMap(
+      (r) => r.body && isOwnReviewComment(r.user, r.body) ? findingKeysIn(r.body) : []
+    )
+  );
+  if (folded.size === 0) return [];
+  const dismissed = new Set(input2.dismissed.map((d) => d.finding_id));
+  return input2.delta.introduced.filter(
+    (f) => folded.has(findingKey(f)) && !dismissed.has(f.concern.id)
+  );
 }
 
 // src/mcp/reviewComments.ts
@@ -292135,7 +292459,7 @@ function where2(f) {
 function renderReviewVerdict(input2) {
   const { delta, verdict: verdict2 } = input2;
   const introduced = delta.introduced.length;
-  const blocking = verdict2.gating + verdict2.required;
+  const { blocking } = verdict2;
   const renamedBlocking = delta.introduced.filter(
     (f) => f.possiblyPreexisting && failsGate(f, [...input2.requiredControls ?? []])
   ).length;
@@ -292381,7 +292705,7 @@ function apply(worktree, path15, cs) {
 }
 
 // src/mcp/terraform/gateScan.ts
-import { existsSync as existsSync12, mkdtempSync as mkdtempSync6, rmSync as rmSync10 } from "node:fs";
+import { existsSync as existsSync11, mkdtempSync as mkdtempSync6, rmSync as rmSync10 } from "node:fs";
 import { join as join50, posix as posix15 } from "node:path";
 
 // src/mcp/terraform/secretScan.ts
@@ -292538,7 +292862,7 @@ async function reviewScans(ctx, pr, scanners) {
     const changed = diffScope(ctx, cwd, scanners);
     const scope2 = base ? reviewScope(ctx, cwd, base) : void 0;
     const started = Date.now();
-    const scanBase = async (b) => existsSync12(b.cwd) ? scanTree(ctx, b.cwd, changed, scanners, reviewedConcern, scope2) : [];
+    const scanBase = async (b) => existsSync11(b.cwd) ? scanTree(ctx, b.cwd, changed, scanners, reviewedConcern, scope2) : [];
     const [head, baseScan, secrets] = await Promise.allSettled([
       scanTree(ctx, cwd, changed, scanners, reviewedConcern, scope2),
       base ? scanBase(base) : Promise.resolve([]),
@@ -292970,6 +293294,22 @@ function CreatePullRequestReviewTool(ctx) {
             `cannot approve: ${outstanding} unresolved ${PRODUCT_NAME} review thread(s) still open on this PR. approval requires every prior ${PRODUCT_NAME} finding to be resolved, not just the latest commits to be clean. inspect them with \`${listRef}\`; for each thread the current code genuinely addresses, reply then call \`${resolveRef2}\`, and retry this approval. if any thread is a real outstanding issue, do NOT approve \u2014 submit a non-approving review (omit \`approved\`, or set \`request_changes\` for a blocking one) that covers it instead.`
           );
         }
+        if (delta) {
+          const reviews = await ctx.octokit.paginate(ctx.octokit.rest.pulls.listReviews, {
+            owner: ctx.repo.owner,
+            repo: ctx.repo.name,
+            pull_number,
+            per_page: 100
+          });
+          const folded = foldedFindingsStillIntroduced({ reviews, delta, dismissed });
+          if (folded.length > 0) {
+            throw new Error(
+              `cannot approve: ${folded.length} introduced finding(s) an earlier ${PRODUCT_NAME} review listed in its body (past \`review_comment_limit\`, so with no thread to resolve) are still introduced by this head: ` + folded.slice(0, 20).map(
+                (f) => `${f.concern.id} (${f.concern.rule_id} at ${f.concern.location.file}:${f.concern.location.line ?? "?"})`
+              ).join(", ") + `. approval requires every prior ${PRODUCT_NAME} finding to be addressed. if one genuinely needs no change, list it in \`dismissed\` with the reason and retry; otherwise do NOT approve \u2014 submit a non-approving review that covers it.`
+            );
+          }
+        }
       }
       const skip = reviewSkipDecision({
         approved: approved ?? false,
@@ -293076,6 +293416,7 @@ ${formatReanchoredNote(reanchored.moved)}`
         params.event = event;
       }
       const proofs = delta ? await proveReviewSuggestions(ctx, auditedComments) : /* @__PURE__ */ new Map();
+      const findingSeverity = /* @__PURE__ */ new Map();
       const reviewComments = auditedComments.map((comment, index) => {
         let commentBody = fixDoubleEscapedString(comment.body || "");
         if (comment.suggestion !== void 0) {
@@ -293117,6 +293458,9 @@ ${marker2}`;
           reviewComment.start_line = comment.start_line;
           reviewComment.start_side = side;
         }
+        if (comment.provenance?.kind === "scanner") {
+          findingSeverity.set(reviewComment, comment.provenance.finding.concern.severity);
+        }
         return reviewComment;
       });
       let droppedComments = [];
@@ -293152,7 +293496,11 @@ ${marker2}`;
             `withholding ${duplicateComments.length}/${reviewComments.length} inline comment(s) that duplicate open review threads`
           );
         }
-        const limited = limitInlineComments(deduped.kept, ctx.payload.reviewCommentLimit);
+        const limited = limitInlineComments(
+          deduped.kept,
+          ctx.payload.reviewCommentLimit,
+          (c) => findingSeverity.get(c)
+        );
         overflowComments = limited.overflow;
         if (overflowComments.length > 0) {
           log2.info(
@@ -293184,7 +293532,13 @@ ${marker2}`;
         body2 = body2 ? body2 + note : note.replace(/^\n\n/, "");
       }
       if (overflowComments.length > 0) {
-        const note = formatOverflowNote(overflowComments, ctx.payload.reviewCommentLimit);
+        const server = process.env.GITHUB_SERVER_URL || "https://github.com";
+        const commit = params.commit_id;
+        const note = formatOverflowNote(
+          overflowComments,
+          ctx.payload.reviewCommentLimit,
+          commit ? (c) => `${server}/${ctx.repo.owner}/${ctx.repo.name}/blob/${commit}/${c.path.split("/").map(encodeURIComponent).join("/")}${c.line && c.side !== "LEFT" ? `#L${c.line}` : ""}` : void 0
+        );
         body2 = body2 ? body2 + note : note.replace(/^\n\n/, "");
       }
       let reproved = 0;
@@ -294196,7 +294550,7 @@ function formatFilesWithLineNumbers(files) {
   }
   const tocLines = [`## Files (${files.length})`];
   for (const entry4 of tocEntries) {
-    const anchor2 = createHash13("sha256").update(entry4.filename).digest("hex");
+    const anchor2 = createHash14("sha256").update(entry4.filename).digest("hex");
     tocLines.push(
       `- ${entry4.filename} \u2192 lines ${entry4.startLine}-${entry4.endLine} \xB7 diff-${anchor2}`
     );
@@ -295042,7 +295396,7 @@ function UpsertRemediationDashboardTool(ctx) {
 import { performance as performance3 } from "node:perf_hooks";
 
 // src/prep/installNodeDependencies.ts
-import { existsSync as existsSync13 } from "node:fs";
+import { existsSync as existsSync12 } from "node:fs";
 import { join as join56 } from "node:path";
 
 // node_modules/.pnpm/package-manager-detector@1.8.0/node_modules/package-manager-detector/dist/commands.mjs
@@ -295439,7 +295793,7 @@ var installNodeDependencies = {
   name: "installNodeDependencies",
   shouldRun: () => {
     const packageJsonPath = join56(process.cwd(), "package.json");
-    return existsSync13(packageJsonPath);
+    return existsSync12(packageJsonPath);
   },
   run: async (options) => {
     const declared2 = await resolvePackageManagerSpec(process.cwd());
@@ -295547,7 +295901,7 @@ ${errorMessage2}`]
 };
 
 // src/prep/installPythonDependencies.ts
-import { existsSync as existsSync14, readFileSync as readFileSync34 } from "node:fs";
+import { existsSync as existsSync13, readFileSync as readFileSync34 } from "node:fs";
 import { join as join57 } from "node:path";
 var PYTHON_CONFIGS = [
   {
@@ -295633,13 +295987,13 @@ var installPythonDependencies = {
     }
     const cwd = process.cwd();
     return PYTHON_CONFIGS.some(
-      (config3) => existsSync14(join57(cwd, config3.file)) && configApplies(config3, cwd)
+      (config3) => existsSync13(join57(cwd, config3.file)) && configApplies(config3, cwd)
     );
   },
   run: async (options) => {
     const cwd = process.cwd();
     const config3 = PYTHON_CONFIGS.find(
-      (c) => existsSync14(join57(cwd, c.file)) && configApplies(c, cwd)
+      (c) => existsSync13(join57(cwd, c.file)) && configApplies(c, cwd)
     );
     if (!config3) {
       return {
@@ -296220,7 +296574,7 @@ function SetOutputTool(ctx, outputSchema) {
 
 // src/mcp/policy.ts
 import { spawnSync as spawnSync8 } from "node:child_process";
-import { existsSync as existsSync15, readFileSync as readFileSync35 } from "node:fs";
+import { existsSync as existsSync14, readFileSync as readFileSync35 } from "node:fs";
 import { join as join58 } from "node:path";
 function parseConftestOutput(stdout) {
   let parsed2;
@@ -296272,7 +296626,7 @@ function namespaceArgs(conftestCwd) {
 function findPlanJson(cwd) {
   for (const candidate of PLAN_JSON_NAMES) {
     const abs = join58(cwd, candidate);
-    if (existsSync15(abs)) return abs;
+    if (existsSync14(abs)) return abs;
   }
   return null;
 }
@@ -296313,11 +296667,11 @@ function resolvePolicyDir(cwd, explicit) {
     } catch {
       return null;
     }
-    return existsSync15(abs) ? abs : null;
+    return existsSync14(abs) ? abs : null;
   }
   for (const d of DEFAULT_POLICY_DIRS) {
     const abs = join58(cwd, d);
-    if (existsSync15(abs)) return abs;
+    if (existsSync14(abs)) return abs;
   }
   return null;
 }
@@ -296351,7 +296705,7 @@ function PolicyCheckTool(ctx) {
         } catch {
           abs = null;
         }
-        targetFile = abs && existsSync15(abs) ? abs : null;
+        targetFile = abs && existsSync14(abs) ? abs : null;
         if (!targetFile) {
           return toolSkip(
             "target_not_found",
@@ -299942,7 +300296,7 @@ async function startMcpHttpServer(ctx, options) {
 
 // src/mcp/terraform/policyGate.ts
 import {
-  existsSync as existsSync16,
+  existsSync as existsSync15,
   mkdirSync as mkdirSync7,
   mkdtempSync as mkdtempSync8,
   readdirSync as readdirSync10,
@@ -300325,7 +300679,7 @@ function readOrEmpty(path15) {
 function regoDirIn(root, skip) {
   for (const dir of DEFAULT_POLICY_DIRS) {
     const abs = join61(root, dir);
-    if (existsSync16(abs) && walkFilesBySuffix(abs, ".rego").some(
+    if (existsSync15(abs) && walkFilesBySuffix(abs, ".rego").some(
       (rel) => !skip(join61(dir, rel), readOrEmpty(join61(abs, rel)))
     )) {
       return dir;
@@ -300394,7 +300748,7 @@ function resolveRepoPolicy(cwd, baseRef, tmpdir6, notes, skip) {
   return null;
 }
 function findWorkflowPlanJson(cwd, notes) {
-  const present = PLAN_JSON_NAMES.filter((name) => existsSync16(join61(cwd, name)));
+  const present = PLAN_JSON_NAMES.filter((name) => existsSync15(join61(cwd, name)));
   if (present.length === 0) return null;
   const listing = run("git", ["ls-files", "-z"], cwd);
   if (listing.status !== 0) {
@@ -301753,9 +302107,9 @@ function shouldRunGraceTurn(params) {
 }
 
 // src/agents/quotaTokens.ts
-var CACHE_READ_WEIGHT = 0.1;
-function quotaTokens(t) {
-  return t.input + t.output + t.cacheWrite + t.cacheRead * CACHE_READ_WEIGHT;
+var CACHE_READ_WEIGHT2 = 0.1;
+function quotaTokens2(t) {
+  return t.input + t.output + (t.reasoning ?? 0) + t.cacheWrite + t.cacheRead * CACHE_READ_WEIGHT2;
 }
 
 // src/agents/toolPlaneWatch.ts
@@ -302153,7 +302507,7 @@ function createProcessOutputActivityTimeout(ctx) {
 }
 
 // src/utils/prompt/skills.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync9, readFileSync as readFileSync38, writeFileSync as writeFileSync19 } from "node:fs";
+import { existsSync as existsSync16, mkdirSync as mkdirSync9, readFileSync as readFileSync38, writeFileSync as writeFileSync19 } from "node:fs";
 import { dirname as dirname9, join as join64 } from "node:path";
 import { fileURLToPath } from "node:url";
 var BUNDLED_SKILL_NAMES = ["terraform-best-practices"];
@@ -302164,7 +302518,7 @@ function resolveSkillPath(name) {
     join64(here, "skills", name, "SKILL.md")
   ];
   for (const candidate of candidates) {
-    if (existsSync17(candidate)) return candidate;
+    if (existsSync16(candidate)) return candidate;
   }
   throw new Error(`bundled skill not found: ${name} (looked in ${candidates.join(", ")})`);
 }
@@ -302183,8 +302537,8 @@ function installBundledSkills(params) {
 
 // src/utils/setup/install.ts
 import { spawnSync as spawnSync9 } from "node:child_process";
-import { createHash as createHash15 } from "node:crypto";
-import { chmodSync as chmodSync2, createWriteStream as createWriteStream2, existsSync as existsSync20, readFileSync as readFileSync39 } from "node:fs";
+import { createHash as createHash16 } from "node:crypto";
+import { chmodSync as chmodSync2, createWriteStream as createWriteStream2, existsSync as existsSync19, readFileSync as readFileSync39 } from "node:fs";
 import { join as join69 } from "node:path";
 import { pipeline as pipeline2 } from "node:stream/promises";
 
@@ -302250,7 +302604,7 @@ function verifyTarballIntegrity(tarballPath, dist, descriptor) {
       const expected = candidate.slice(separator2 + 1);
       let actual;
       try {
-        actual = createHash15(algorithm).update(bytes).digest("base64");
+        actual = createHash16(algorithm).update(bytes).digest("base64");
       } catch {
         continue;
       }
@@ -302260,7 +302614,7 @@ function verifyTarballIntegrity(tarballPath, dist, descriptor) {
       `Integrity check FAILED for ${descriptor}: the downloaded tarball does not match the registry's published digest (${integrity2}). Refusing to execute it.`
     );
   }
-  const actualShasum = createHash15("sha1").update(bytes).digest("hex");
+  const actualShasum = createHash16("sha1").update(bytes).digest("hex");
   if (actualShasum !== shasum) {
     throw new Error(
       `Integrity check FAILED for ${descriptor}: the downloaded tarball does not match the registry's published shasum (expected ${shasum}, got ${actualShasum}). Refusing to execute it.`
@@ -302271,7 +302625,7 @@ async function installFromNpmTarball(params) {
   const tempDir = getTempDir();
   const extractedDir = join69(tempDir, "package");
   const cliPath = join69(extractedDir, params.executablePath);
-  if (existsSync20(cliPath)) {
+  if (existsSync19(cliPath)) {
     log2.debug(`\xBB using cached binary at ${cliPath}`);
     return cliPath;
   }
@@ -302362,7 +302716,7 @@ async function installFromNpmTarball(params) {
       `Failed to extract tarball: ${extractResult.stderr || extractResult.stdout || "Unknown error"}`
     );
   }
-  if (!existsSync20(cliPath)) {
+  if (!existsSync19(cliPath)) {
     throw new Error(`Executable not found in extracted package at ${cliPath}`);
   }
   if (params.installDependencies) {
@@ -302602,7 +302956,7 @@ function timerFor(state5, label) {
 function chargeTokenQuota(state5) {
   const quota = state5.params.tokenQuota;
   if (!quota || state5.stopRun.signal.aborted) return;
-  if (!quota.observe(state5.quotaSource, quotaTokens(state5.accumulatedTokens))) return;
+  if (!quota.observe(state5.quotaSource, quotaTokens2(state5.accumulatedTokens))) return;
   log2.info(`\xBB ${state5.params.label}: ${quota.gap()}`);
   state5.stopRun.abort(new TokenQuotaExceededError(quota.gap()));
 }
@@ -309334,7 +309688,7 @@ function newTurn() {
   turnCounter += 1;
   return {
     finalText: "",
-    tokens: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+    tokens: { input: 0, output: 0, reasoning: 0, cacheRead: 0, cacheWrite: 0 },
     costUsd: 0,
     sessionError: null,
     lastToolError: null,
@@ -309344,7 +309698,7 @@ function newTurn() {
 function chargeTokenQuota2(ctx) {
   const quota = ctx.tokenQuota;
   if (!quota || !ctx.currentTurn || ctx.tokenQuotaExceeded) return;
-  if (!quota.observe(ctx.currentTurn.quotaSource, quotaTokens(ctx.currentTurn.tokens))) return;
+  if (!quota.observe(ctx.currentTurn.quotaSource, quotaTokens2(ctx.currentTurn.tokens))) return;
   ctx.tokenQuotaExceeded = true;
   log2.info(`\xBB ${ctx.label}: ${quota.gap()}`);
   ctx.abortRun?.(new TokenQuotaExceededError(quota.gap()));
@@ -309453,6 +309807,7 @@ async function onPartUpdated(ctx, part) {
     if (t) {
       ctx.currentTurn.tokens.input += t.input || 0;
       ctx.currentTurn.tokens.output += t.output || 0;
+      ctx.currentTurn.tokens.reasoning += t.reasoning || 0;
       ctx.currentTurn.tokens.cacheRead += t.cache?.read || 0;
       ctx.currentTurn.tokens.cacheWrite += t.cache?.write || 0;
     }
@@ -310849,8 +311204,8 @@ function addQueryParameters(url5, parameters) {
   }).join("&");
 }
 var urlVariableRegex = /\{[^{}}]+\}/g;
-function removeNonChars(variableName) {
-  return variableName.replace(/(?:^\W+)|(?:(?<!\W)\W+$)/g, "").split(/,/);
+function removeNonChars(variableName2) {
+  return variableName2.replace(/(?:^\W+)|(?:(?<!\W)\W+$)/g, "").split(/,/);
 }
 function extractUrlVariableNames(url5) {
   const matches2 = url5.match(urlVariableRegex);
@@ -318529,7 +318884,7 @@ async function runAgentWithWatchdogs(params) {
   const tokenQuota = reserved ? quotas.token : createTokenQuota(quotas.tokenLimit.full);
   const costQuota = reserved ? quotas.cost : createCostQuota(quotas.costLimit.full);
   log2.info(
-    quotas.tokenLimit.full > 0 ? `\xBB run token quota: ${quotas.tokenLimit.full.toLocaleString("en-GB")} billable tokens` + (reserved ? ` (${tokenQuota.limit.toLocaleString("en-GB")} for the run, the rest reserved to deliver findings if it runs out)` : "") : `\xBB run token quota: disabled (${RUN_TOKEN_QUOTA_INPUT}: 0)`
+    quotas.tokenLimit.full > 0 ? `\xBB run token quota: ${quotas.tokenLimit.full.toLocaleString("en-GB")} tokens` + (reserved ? ` (${tokenQuota.limit.toLocaleString("en-GB")} for the run, the rest reserved to deliver findings if it runs out)` : "") + "; a token read from the prompt cache counts as a tenth" : `\xBB run token quota: disabled (${RUN_TOKEN_QUOTA_INPUT}: 0)`
   );
   log2.info(
     quotas.costLimit.full > 0 ? `\xBB run cost quota: $${quotas.costLimit.full.toFixed(2)}` + (reserved ? ` ($${costQuota.limit.toFixed(2)} for the run, the rest reserved to deliver findings if it runs out)` : "") : `\xBB run cost quota: disabled (${RUN_COST_QUOTA_INPUT}: 0)`
@@ -318627,7 +318982,7 @@ async function runAgentWithWatchdogs(params) {
 }
 
 // src/phases/startToolPlane.ts
-import { existsSync as existsSync21, readdirSync as readdirSync11 } from "node:fs";
+import { existsSync as existsSync20, readdirSync as readdirSync11 } from "node:fs";
 import { readFile as readFile5 } from "node:fs/promises";
 import { join as join77 } from "node:path";
 
@@ -319458,7 +319813,7 @@ ${instructions.user}` : null,
   });
   if (toolContext.agentId === "opencode") {
     const pluginDir = join77(process.cwd(), ".opencode", "plugin");
-    const hasPlugins = existsSync21(pluginDir) && readdirSync11(pluginDir).some((f) => /\.[jt]sx?$/.test(f));
+    const hasPlugins = existsSync20(pluginDir) && readdirSync11(pluginDir).some((f) => /\.[jt]sx?$/.test(f));
     if (hasPlugins && toolState.dependencyInstallation?.promise) {
       log2.info(
         "\xBB .opencode/plugin/ detected \u2014 awaiting dependency installation before agent start"
@@ -319944,7 +320299,7 @@ async function run2(args2) {
 }
 
 // src/commands/mcp.ts
-import { existsSync as existsSync22, statSync as statSync12 } from "node:fs";
+import { existsSync as existsSync21, statSync as statSync12 } from "node:fs";
 import { isAbsolute as isAbsolute9, resolve as resolve14 } from "node:path";
 var import_arg4 = __toESM(require_arg(), 1);
 var SEVERITIES5 = ["critical", "high", "medium", "low", "info"];
@@ -320017,7 +320372,7 @@ async function runMcpCli(params) {
   if (rawCwd) {
     cwd = isAbsolute9(rawCwd) ? rawCwd : resolve14(process.cwd(), rawCwd);
   }
-  if (!existsSync22(cwd) || !statSync12(cwd).isDirectory()) {
+  if (!existsSync21(cwd) || !statSync12(cwd).isDirectory()) {
     console.error(`--cwd is not a directory: ${cwd}`);
     process.exit(1);
   }
@@ -320116,7 +320471,7 @@ async function runVerifyEvidenceCli2(params) {
 }
 
 // src/cli.ts
-var VERSION14 = "0.3.12";
+var VERSION14 = "0.3.13";
 var bin = basename9(process.argv[1] || "");
 var PROG = bin === "pf" || bin === PRODUCT_SLUG ? bin : PRODUCT_SLUG;
 var rawArgs = process.argv.slice(2);