infraweaver 0.3.12 → 0.3.13

package/dist/internal.js

@@ -110,7 +110,7 @@ function isValidTimeString(input) {
   return parseTimeString(input) !== null;
 }
 
-// node_modules/.pnpm/@infraweaver-io+models@0.1.6/node_modules/@infraweaver-io/models/dist/catalog.js
+// node_modules/.pnpm/@infraweaver-io+models@0.1.7/node_modules/@infraweaver-io/models/dist/catalog.js
 function provider(config) {
   return config;
 }
@@ -1781,7 +1781,7 @@ This mode standardises STRUCTURE while preserving BEHAVIOUR \u2014 the equivalen
    - \`${t("terraform_normalization_candidates")}\` \u2192 in-place idiomatic cleanups that change SYNTAX, not behaviour (redundant whole-string \`"\${expr}"\` interpolation; legacy HCL0.11 map-argument block syntax like \`vars {\` on a \`template_file\`). These relocate NOTHING \u2014 zero \`moved {}\` blocks \u2014 and are proven by the same equivalence check.
    - \`${t("terraform_consolidation_candidates")}\` \u2192 the SAME resource shape declared in several root directories (\`env/dev\` + \`env/staging\` + \`env/prod\`), with the single parameterised module they could all call already derived: which attributes are identical (module content) and which differ (per-environment inputs). A member root of a group will ALSO show up as a zero-candidate cluster in \`${t("module_extraction_candidates")}\` \u2014 prefer the consolidation, which does that work once for every environment instead of once per environment. Its \`near_groups\` are the opposite case: roots recognisably the same stack that DIFFER (one carries a resource the other does not), where folding them together is a design decision this mode has no basis for. Do NOT extract a near-group root's shared resources into a module on its own either \u2014 a module one twin calls and the other does not widens exactly the drift the near-group reports. Leave those roots alone and name the near-group and its \`differences\` in your report.
 
-   **A result marked \`report_only\` is an observation, not work.** The repository is a module other configurations call (\`report_only_reason\` says why), and restructuring it is churn for every caller: name those candidates in your \`${t("report_progress")}\` summary and open no PR for them. \`examples/\` roots are left out of every candidate list unless the operator set \`refactor_examples\`.
+   **A candidate marked \`report_only\` is an observation, not work.** It sits in the code of a module other configurations call (\`report_only_reason\` says why), and restructuring that is churn for every caller: name those candidates in your \`${t("report_progress")}\` summary and open no PR for them. \`examples/\` roots are left out of every candidate list unless the operator set \`refactor_examples\`.
 
    **Before picking, check the interface.** \`${t("module_extraction_candidates")}\` reports \`unmapped_attributes\` per candidate and a top-level \`partial_interfaces\` list: arguments the raw resources SET that the target module does not. Adopting such a module DROPS them silently \u2014 and the equivalence check cannot catch it, because once the argument is gone it is absent from both sides. Two of these are unrecoverable rather than merely wrong (\`object_lock_enabled\` cannot be set after creation; \`force_destroy\` changes deletion semantics). So: **decline the candidate, or extend the module to expose the argument and say so in the PR body.** Deleting the argument to make the shapes match is never the fix. A candidate whose \`unmapped_attributes\` is \`null\` was NOT checked \u2014 the module is external and its code is not in this repo \u2014 which is not the same as clean.
 
@@ -1914,7 +1914,7 @@ function remediateMode(t) {
 
 4. **for the chosen group**:
    - **base branch**: this run's base branch is resolved deterministically \u2014 \`${t("create_pull_request")}\` targets the \`base_branch\` input if set, else the branch the run started on, else the repository's default branch (\`main\`, or \`master\`). You do not choose it; just **omit** the \`base\` argument when opening the PR (below) and it is filled in.
-   - **idempotency**: the remediation branch is the group's \`branch\` (\`remediate/<group-id>\`, with a \`--<base>\` suffix when the PR targets a non-default branch) \u2014 use it exactly, never a name of your own. Before doing anything, check whether that branch or an open PR for it already exists (\`${t("git")}\` / \`${t("get_pull_request")}\`). If one exists, update it rather than opening a duplicate.
+   - **idempotency**: the remediation branch is the group's \`branch\` (\`remediate/<group-id>\`, with a \`--<base>\` suffix when the PR targets a non-default branch, or the branch of the PR already open for this group) \u2014 use it exactly, never a name of your own. Before doing anything, check whether that branch or an open PR for it already exists (\`${t("git")}\` / \`${t("get_pull_request")}\`). If one exists, update it rather than opening a duplicate.
    - **branch**: create the group's \`branch\` from the **current HEAD** (the checkout that was just scanned) via \`${t("git")}\` (\`git({ command: "checkout", args: ["-b", <branch>] })\`). Do NOT switch to a different base first \u2014 branching from the scanned checkout keeps the PR diff to exactly your fix.
    - **honest refusal (decide BEFORE fixing)**: if the group's concerns appear in the scan's \`refusal_candidates\` (the fix needs a human decision \u2014 narrowing an IAM wildcard, a KMS key policy, a real ingress CIDR), do **not** guess a fix that could break the stack. Instead open a structured issue (\`${t("create_issue")}\`) describing the concern, why it isn't auto-fixed, and what a human should do, and skip the PR for that group. A proven fix or an honest refusal \u2014 never a guessed, unverifiable PR.
    - **propose, then let me steer (when there's no single right fix)**: distinct from honest refusal (which refuses a fix a human must *decide*), this is for a finding with **2\u20133 genuinely distinct, defensible fixes** that differ in trade-offs, not correctness (e.g. encrypt with an AWS-managed key **vs** a customer-managed KMS key; a narrow security-group rule **vs** a prefix list **vs** a VPC endpoint). When such a fork exists **and the triggering comment did not already select a strategy**, do **not** silently pick for the reviewer: via \`${t("create_issue_comment")}\` post one short comment listing the options as **A / B / C** \u2014 each a single line (what it does + its trade-off) \u2014 and ask the reviewer to reply \`${COMMENT_COMMAND} fix #<concern-id> with strategy <A|B|C>\`. Then **skip the PR for this group** this run and note it in your final report (it resumes when the reviewer replies). When the comment **did** select one (\`fix #<id> with strategy B\`, or a bare \`strategy B\` reply on the proposal thread), apply **exactly** that strategy \u2014 don't second-guess it. Reserve this for real forks in the road; a fix with one obvious correct answer just gets made.
@@ -1975,7 +1975,7 @@ This mode composes the **Remediate** and **Refactor** verbs into a single run. I
    - **commit the fix** (\`git add\` only the changed \`*.tf\`/\`*.tfvars\`, a \`fix(tf): \u2026\` message). Do NOT push yet. This committed state is the refactor's equivalence BASELINE.
 
 3. **REFACTOR (phase 2) \u2014 modularise on top of the committed fix**: follow the **Refactor** mode's flow:
-   - \`${t("module_extraction_candidates")}\` / \`${t("terraform_normalization_candidates")}\` \u2192 pick one behaviour-preserving refactor; a result marked \`report_only\` (the repository is a module others call) is named in the summary, never proposed. Respect a pinned \`refactor_source\` if one was supplied (it constrains which module source you may use; the behaviour-altering b.4 path is only available when the operator pinned \`third-party\`).
+   - \`${t("module_extraction_candidates")}\` / \`${t("terraform_normalization_candidates")}\` \u2192 pick one behaviour-preserving refactor; a candidate marked \`report_only\` (it sits in the code of a module others call) is named in the summary, never proposed. Respect a pinned \`refactor_source\` if one was supplied (it constrains which module source you may use; the behaviour-altering b.4 path is only available when the operator pinned \`third-party\`).
    - resolve the module source, wire the \`module\` call against its real interface (\`${t("terraform_module_interface")}\` for a local module dir, \`${t("terraform_module_lookup")}\` for a registry-sourced one), and emit a \`moved {}\` block for EVERY relocated address (\`${t("terraform_generate_moved")}\`).
    - \`terraform fmt\` + \`${t("terraform_validate")}\`, then \u2014 **with the refactor edits still UNCOMMITTED** \u2014 call \`${t("terraform_equivalence_check")}\`. In this mode it diffs the working tree against the COMMITTED fix (not the run-start commit), so it measures only the refactor. It must return \`equivalent: true\` (zero uncovered moves, resource set + arguments preserved, validate + fmt clean) before you proceed; \`${t("push_branch")}\` hard-blocks an unproven one \u2014 and, once this run has added a \`moved {}\` block, it also hard-blocks a push that never ran the check at all, so abandoning the refactor means REVERTING its edits rather than leaving them in with the fix. If it can't be proven equivalent, abandon the refactor and ship the fix alone.
    - **document the module (only when the \`docs\` input is enabled)**: after the equivalence check passes, call \`${t("terraform_module_docs")}\` for the module you created/adopted (pass the relocated addresses as \`moves\`). Do not hand-write docs \u2014 the tool builds from the interface, moved blocks, and equivalence verdict.

package/dist/mcp/git.d.ts

@@ -51,10 +51,12 @@ export declare const Git: import("arktype/internal/variants/object.ts").ObjectTy
  * The subcommand and arguments of a call, however the model wrote it: the
  * subcommand alone (the documented form), a whole `git …` command line, or the
  * subcommand as the first of `args`. Models wrote the other two often enough
- * to cost a turn per run, and each is unambiguous. The subcommand is checked
- * against the same pattern the schema uses, so a flag (`-c`, `-C`,
- * `--exec-path`) can no more arrive through `args[0]` or a command line than
- * through `command`.
+ * to cost a turn per run, and each is unambiguous. Leading `git` words are
+ * dropped, so `{ command: "git", args: ["status"] }` is not `git git status`.
+ * The subcommand is checked against the same pattern the schema uses — in
+ * every form, the documented one included, so the check does not rest on the
+ * schema alone — and a flag (`-c`, `-C`, `--exec-path`) can no more arrive
+ * through `args[0]` or a command line than through `command`.
  */
 export declare function normalizeGitCall(params: {
     command?: string | undefined;

package/dist/mcp/localContext.d.ts

@@ -1,5 +1,6 @@
 import type { ToolState } from "../toolState.js";
 import type { ResolvedPayload } from "../utils/config/payload.js";
+import type { OctokitWithPlugins } from "../utils/github/github.js";
 /**
  * The cwd-scoped, GitHub-free subset of `ToolContext` that the read-only
  * Terraform tools depend on. Two providers exist:
@@ -27,8 +28,14 @@ export interface LocalToolContext {
      * carries it; a local session has none, so its remediation branches keep the
      * plain `remediate/<id>` name. */
     repo?: {
+        owner?: string;
+        name?: string;
         data: {
             default_branch?: string | null;
         };
     } | undefined;
+    /** the Action's GitHub client, read only to find the remediation PRs already
+     * open, so a group that has one keeps that PR's branch. A local session has
+     * none and names its branches from the group and base alone. */
+    octokit?: OctokitWithPlugins | undefined;
 }

package/dist/mcp/reviewCommentLimit.d.ts

@@ -1,3 +1,29 @@
+/**
+ * How many inline comments one review posts.
+ *
+ * A review of forty inline comments is read by no one, and every one of them is
+ * a thread the author must resolve. Past the limit the most important comments
+ * still post inline — ranked by the scanner severity of the finding a comment
+ * answers, or else by its own 🚨/⚠️/ℹ️ marker (the marker is optional, so an
+ * unmarked comment ranks level with ⚠️, not last), a proven (one-click
+ * committable) fix ahead of an equal one without, otherwise in the order the
+ * reviewer wrote them — and the rest are listed in the review body in full, so
+ * nothing the review found is lost, only folded. The gate is not involved: it
+ * judges the scan delta, never the comments.
+ *
+ * A folded comment opens no thread, so the approval check that counts open
+ * threads cannot see it. A folded scanner finding keeps its hidden marker in
+ * the review body instead, and a later approval is refused while the head
+ * still introduces it (`foldedFindingsStillIntroduced`).
+ *
+ * The limit is a repo setting (`review_comment_limit`), read from the base
+ * branch on a pull request: lowering it moves findings out of the diff view,
+ * which is a way to make them easier to miss, so a PR does not get to set it for
+ * itself.
+ */
+import type { Dismissal } from "./reviewProvenance.js";
+import { type DeltaFinding, type GateDelta } from "./terraform/scanDelta.js";
+import type { Severity } from "./terraform/types.js";
 interface LimitableComment {
     path: string;
     line?: number | undefined;
@@ -5,13 +31,37 @@ interface LimitableComment {
 }
 /**
  * Split `comments` into those posted inline and those folded into the body.
- * `limit` 0 or undefined means no limit. Both halves keep the input order, so
- * the posted review reads in the order the reviewer wrote it.
+ * `limit` 0 or undefined means no limit. `severityOf` names the severity of the
+ * finding a comment answers, when it answers one. Both halves keep the input
+ * order, so the posted review reads in the order the reviewer wrote it.
  */
-export declare function limitInlineComments<T extends LimitableComment>(comments: readonly T[], limit: number | undefined): {
+export declare function limitInlineComments<T extends LimitableComment>(comments: readonly T[], limit: number | undefined, severityOf?: (c: T) => Severity | undefined): {
     kept: T[];
     overflow: T[];
 };
-/** The review-body note listing the comments the limit folded, or "" for none. */
-export declare function formatOverflowNote(overflow: readonly LimitableComment[], limit: number): string;
+/**
+ * The review-body note carrying the comments the limit folded, or "" for none.
+ * Each is kept whole while the note stays within its share of GitHub's body
+ * limit; past that, by place and first line (and its finding marker), and the
+ * note says so.
+ */
+export declare function formatOverflowNote<T extends LimitableComment>(overflow: readonly T[], limit: number, linkOf?: (c: T) => string | undefined): string;
+/**
+ * The introduced findings an earlier review of this PR folded into its body —
+ * so they never became threads — that this head still introduces and this
+ * review does not dismiss. An approval past one would pass a finding the
+ * open-thread check cannot see. Markers count only in the engine's own reviews;
+ * one pasted elsewhere can only add a finding to this list, never remove one.
+ */
+export declare function foldedFindingsStillIntroduced(input: {
+    reviews: readonly {
+        user?: {
+            login?: string | null;
+            type?: string | null;
+        } | null;
+        body?: string | null;
+    }[];
+    delta: GateDelta;
+    dismissed: readonly Dismissal[];
+}): DeltaFinding[];
 export {};

package/dist/mcp/reviewMarkers.d.ts

@@ -15,6 +15,11 @@ export type CommentMarker = {
 };
 export declare function renderCommentMarker(marker: CommentMarker): string;
 export declare function parseCommentMarker(body: string | null | undefined): CommentMarker | null;
+/**
+ * The key of every finding marker in `body`. A review BODY carries one per
+ * comment the comment limit folded into it, where a comment carries one.
+ */
+export declare function findingKeysIn(body: string): string[];
 /** The text of a comment's `suggestion` block, without its closing newline. */
 export declare function suggestionText(body: string): string | undefined;
 /**

package/dist/mcp/staleFix.d.ts

@@ -1,4 +1,5 @@
 import type { GitHubToolContext } from "./capabilityContext.js";
+import type { OctokitWithPlugins } from "../utils/github/github.js";
 /** true when `branch` is a Infraweaver remediation/generation branch. */
 export declare function isRemediationBranch(branch: string): boolean;
 /** the `<group-id>` of a `remediate/<group-id>` branch (the scan group id that
@@ -7,7 +8,8 @@ export declare function isRemediationBranch(branch: string): boolean;
 export declare function groupIdFromBranch(branch: string): string | null;
 /**
  * What a remediation branch name carries after its group id: nothing when the
- * PR targets the repository default branch, `--<base>` otherwise.
+ * PR targets the repository default branch, `--<base>` otherwise — slugged for
+ * a ref, with a hash of the raw name when the slug changed it.
  *
  * The group id is a hash of the file (or rule) alone, so the same fix aimed at
  * two base branches — or at two repos whose roots are both `main.tf` — named
@@ -16,6 +18,39 @@ export declare function groupIdFromBranch(branch: string): string | null;
  * plain name, so the PRs already open under it are still found and refreshed.
  */
 export declare function remediationBranchSuffix(base: string | undefined, defaultBranch: string | undefined): string;
+/** an open remediation PR, as far as naming a group's branch needs it. */
+export interface OpenRemediationPr {
+    head: string;
+    base: string;
+}
+/**
+ * The branch a remediation group's fix is pushed to: the head of the PR already
+ * open for this group into this exact base, when there is one, else
+ * `remediate/<id>` plus [[remediationBranchSuffix]].
+ *
+ * The open PR wins because its name may predate the current naming — opened
+ * before the base suffix existed, or under an unhashed suffix — and Remediate
+ * keys idempotency on the name, so a newly computed one opened a duplicate PR.
+ * A head that another open PR also proposes into a different base is never
+ * reused: pushing to it would rewrite that PR too.
+ */
+export declare function remediationBranchFor(id: string, base: string | undefined, defaultBranch: string | undefined, open: readonly OpenRemediationPr[] | undefined): string;
+/**
+ * This repository's open `remediate/*` PRs, for [[remediationBranchFor]]. Empty
+ * without a GitHub client (a local session) or when the API call fails: the
+ * group then gets the computed name, as it did before open PRs were consulted.
+ * Only Remediate pushes to a group's branch, so no other mode pays for the call.
+ */
+export declare function listOpenRemediationPrs(ctx: {
+    octokit?: OctokitWithPlugins | undefined;
+    repo?: {
+        owner?: string;
+        name?: string;
+    } | undefined;
+    toolState?: {
+        selectedMode?: string | undefined;
+    } | undefined;
+}): Promise<OpenRemediationPr[]>;
 /** true when a commit-author LOGIN is Infraweaver's bot (so a commit by it is NOT
  * a human edit). A null/absent login is treated as non-human here for backward
  * compatibility of this login-only helper — but prefer {@link isBotCommit}, which

package/dist/mcp/terraform/concernResult.d.ts

@@ -1,4 +1,5 @@
 import type { LocalToolContext } from "../localContext.js";
+import { type OpenRemediationPr } from "../staleFix.js";
 import { type PrioritySignals, type SeedCapResult, type SeedCaps } from "./coverage.js";
 import { annotateGroups, planBatches } from "./decisions.js";
 import { type Concern, type Severity } from "./types.js";
@@ -59,4 +60,12 @@ export declare function buildConcernResult(ctx: LocalToolContext, rawConcerns: C
      *  the full raw set — so a capped concern the re-scan still sees can never
      *  read as a regression. */
     seedCaps?: SeedCaps;
+    /** The repository's open remediation PRs (see `listOpenRemediationPrs`), so
+     *  a group that already has one keeps its branch. */
+    openRemediationPrs?: readonly OpenRemediationPr[];
+    /** The concerns were scanned off the tree in `cwd` as it is now, so their
+     *  lines name today's resources (see `recordConcernSites`). Only
+     *  `terraform_scan` sets it: a findings file or external report may
+     *  describe another commit. */
+    linesMatchTree?: boolean;
 }): ConcernResult;

package/dist/mcp/terraform/deltaSummary.d.ts

@@ -14,6 +14,9 @@ export interface DeltaVerdict {
     gating: number;
     /** introduced findings on a required control, any severity */
     required: number;
+    /** introduced findings that fail either half, each counted once: a high
+     *  finding on a required control is in both `gating` and `required`. */
+    blocking: number;
 }
 /** The gate's verdict on a delta: the same two halves `findings-gate` applies. */
 export declare function deltaVerdict(delta: GateDelta, requiredControls: string[]): DeltaVerdict;

package/dist/mcp/terraform/hardcodedSecrets.d.ts

@@ -12,15 +12,21 @@
  * WHAT IS READ. Every `name = "…"` line inside a `resource`, `data`,
  * `provider`, `module` or `locals` block, at any depth, so
  * `environment { variables = { auth = "…" } }` and `jsonencode({ … })` objects
- * are reached; and the `default` of a `variable` whose name is a secret's. Not
- * read: comments, heredoc bodies, a name/value pair split across two keys
- * (`[{ name = "PASSWORD", value = "…" }]`), and a value that starts on a later
- * line than its name.
+ * are reached; the `default` of a `variable` whose name is a secret's; and
+ * every assignment in a `.tfvars` file, which is where a value kept out of the
+ * `.tf` source usually lands instead. Not read: comments, heredoc bodies, a
+ * name/value pair split across two keys (`[{ name = "PASSWORD", value = "…" }]`),
+ * and a value that starts on a later line than its name.
  *
- * WHAT IS NOT A FINDING. A reference, a function call, an interpolation, an
- * empty string, or a placeholder made only of `*` / `x` / `<…>`. Neither is an
- * argument whose name only mentions a secret (`password_length`, `secret_name`,
- * `token_validity_units`, `creation_token`): the last word of the name decides.
+ * WHAT IS NOT A FINDING. A reference, a function call, an interpolation or a
+ * template directive, an empty string, `true` / `false` / `null`, a number, or
+ * a placeholder made only of `*` / `x` / `<…>`. Nor is a literal that only POINTS
+ * at a secret — an ARN, a GCP `projects/…/secrets/…` name, a Key Vault secret
+ * URI or an SSM parameter path — since that is the fix, not the fault. Neither
+ * is an argument whose name only mentions a secret (`password_length`,
+ * `secret_name`, `token_validity_units`, `creation_token`): the last word of the
+ * name decides, and a name that is `secret` and nothing else names a Secret
+ * Manager secret (`secret_key_ref { secret = "db-password" }`), not its value.
  *
  * Arguments the provider can take write-only (`aws_db_instance.password`) may
  * also be reported by `secret-persisted-to-state`, which says something else:
@@ -45,5 +51,13 @@ export interface HardcodedSecret {
  * parser is shared by every scanner and budgeted (see nativeScan.perf.test).
  */
 export declare function findHardcodedSecrets(hcl: string): HardcodedSecret[];
-/** Scan an already-read tree into native concerns. Pure; no I/O of its own. */
-export declare function scanHardcodedSecrets(files: readonly SourceFile[]): Concern[];
+/**
+ * Every secret-named literal in a `.tfvars` file. A tfvars file is nothing but
+ * assignments, so every one is read, at any depth, under the file's own name.
+ */
+export declare function findTfvarsSecrets(hcl: string, path: string): HardcodedSecret[];
+/**
+ * Scan an already-read tree into native concerns. Pure; no I/O of its own.
+ * `tfvarsFiles` are the `.tfvars` inputs, read as assignments rather than blocks.
+ */
+export declare function scanHardcodedSecrets(files: readonly SourceFile[], tfvarsFiles?: readonly SourceFile[]): Concern[];

package/dist/mcp/terraform/refactorScope.d.ts

@@ -1,11 +1,23 @@
-/** true for a path inside an `examples/` (or `example/`) directory, at any depth. */
+/**
+ * true for a path inside an `examples/` directory at any depth, or an `example/`
+ * one at the repository root. The registry's convention is `examples/`; the
+ * singular is accepted only where that convention puts it, because a module
+ * NAMED `example` (`modules/example/`) is code someone calls.
+ */
 export declare function isExamplePath(path: string): boolean;
 /**
  * Why the repository at `cwd` reads as a reusable module rather than a
  * deployment, or null when it does not.
  */
 export declare function libraryRepoReason(cwd: string): string | null;
-/** what a detector tool adds to its result when the repository is a library. */
+/**
+ * For a library repository, why a candidate in `file` (repo-relative) is
+ * reported rather than restructured — or null when the file belongs to a
+ * directory, or sits under one, that deploys on its own. Outside a library,
+ * always null.
+ */
+export declare function libraryScope(cwd: string): (file: string) => string | null;
+/** what a detector tool adds to a candidate in a library's own code. */
 export declare function reportOnly(reason: string | null): {
     report_only?: true;
     report_only_reason?: string;

package/dist/mcp/terraform/ruleContext.d.ts

@@ -44,6 +44,8 @@ export interface RuleContext {
     readonly files: readonly SourceFile[];
     /** the `.tofu` half. Only the dialect rule needs it; empty on a repo with none. */
     readonly tofuFiles: readonly SourceFile[];
+    /** the `.tfvars` inputs. Only the hardcoded-secret rule reads them; empty on a repo with none. */
+    readonly tfvarsFiles: readonly SourceFile[];
     /** non-null when the walk was bounded before it finished — see [[tree]]. */
     readonly truncated: TreeTruncation;
     /** how many times a literal must repeat in one directory before it is reported. */
@@ -75,6 +77,7 @@ export interface RuleContextInput {
     cwd: string;
     files: readonly SourceFile[];
     tofuFiles?: readonly SourceFile[];
+    tfvarsFiles?: readonly SourceFile[];
     truncated?: TreeTruncation;
     repeatedLiteralThreshold: number;
 }

package/dist/mcp/terraform/tree.d.ts

@@ -102,6 +102,11 @@ export declare function readTfTree(cwd: string, limits?: TreeReadLimits): Source
  * one is a fact about the PAIR.
  */
 export declare function readTofuTree(cwd: string, limits?: TreeReadLimits): SourceTree;
+/**
+ * The `.tfvars` inputs (`.auto.tfvars` included). Not configuration, so no rule
+ * reads them as blocks; the hardcoded-secret rule reads their assignments.
+ */
+export declare function readTfvarsTree(cwd: string, limits?: TreeReadLimits): SourceTree;
 /** how a declined-for-size file reads in a coverage report. Names the files,
  *  because unlike a truncated walk this gap knows exactly what went unread. */
 export declare function describeOversize(paths: readonly string[]): string;

package/dist/mcp/terraform/types.d.ts

@@ -243,7 +243,8 @@ export interface ConcernGroup {
      * the file (by-file grouping) or the rule (by-rule grouping). */
     id: string;
     /** the branch its fix is pushed to: `remediate/<id>`, plus `--<base>` when the
-     * PR targets a branch other than the repository default. */
+     * PR targets a branch other than the repository default — or the head of the
+     * remediation PR already open for this group into the same base. */
     branch?: string;
     /** the group's primary file (by-file) or a human label like "3 files"
      * (by-rule); `files` carries the full list for by-rule groups. */

package/dist/mcp/terraform/verifySites.d.ts

@@ -8,7 +8,8 @@
  * a fix that moves the defect onto a new resource would look resolved — so a
  * finding counts as resolved at its own site only when ALL of these hold:
  *
- *   - it was placed on a resource when it was reported;
+ *   - it was placed on a resource when it was reported, by a scan of the tree
+ *     as it then stood, and no later scan placed the same id elsewhere;
  *   - that resource is still declared in the file (a renamed or deleted one
  *     proves nothing);
  *   - the rule no longer fires on it;
@@ -24,8 +25,15 @@ import { type Concern } from "./types.js";
 export declare function fileReader(cwd: string): (file: string) => string | null;
 /** The resource a concern sits in, read from the file as it is now. */
 export declare function siteOf(c: Concern, read: (file: string) => string | null): string | null;
-/** Remember where each reported concern sat, and the first sites per key. */
-export declare function recordConcernSites(session: ScanSession, concerns: Concern[], cwd: string): void;
+/**
+ * Remember where each reported concern sat, and the first sites per key.
+ *
+ * `linesMatchTree` says the concerns were scanned off the tree in `cwd` as it
+ * is now. Without it (a findings file or external report, which may describe
+ * another commit) their lines are not trusted to name today's resources: their
+ * ids get no site and their keys no first sites.
+ */
+export declare function recordConcernSites(session: ScanSession, concerns: Concern[], cwd: string, linesMatchTree: boolean): void;
 export interface SiteRequest {
     id: string;
     /** the (scanner, rule, file) key */

package/dist/vendor/@infraweaver-io/models/tokenQuota.d.ts

@@ -44,10 +44,11 @@ export declare class TokenQuotaExceededError extends Error {
 }
 /** The workflow input that overrides {@link DEFAULT_RUN_TOKEN_QUOTA}. */
 export declare const RUN_TOKEN_QUOTA_INPUT = "max_run_tokens";
-/** The four token components a run is charged for. Cache reads are cheap per
- *  token but they are still work performed on the model's behalf, and a
- *  runaway loop is visible mostly in cache reads — excluding them would leave
- *  the loudest signal of the very failure this bounds outside the count. */
+/** The four token components a run is charged for. Cache reads still count —
+ *  a runaway loop is visible mostly in cache reads, and excluding them would
+ *  leave the loudest signal of the very failure this bounds outside the count —
+ *  but at {@link CACHE_READ_WEIGHT}, their price, so a long healthy run that
+ *  re-reads a large cached prompt every turn is not stopped for it. */
 interface TokenComponents {
     input?: number | undefined;
     output?: number | undefined;
@@ -55,9 +56,9 @@ interface TokenComponents {
     cacheWrite?: number | undefined;
 }
 export interface RunTokenQuota {
-    /** The ceiling, in billable tokens. */
+    /** The ceiling, in quota tokens (a cache read counts as a tenth). */
     readonly limit: number;
-    /** Billable tokens charged so far across every source. */
+    /** Quota tokens charged so far across every source. */
     used(): number;
     /**
      * Report a source's running TOTAL (not a delta) and return whether the quota

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "infraweaver",
-  "version": "0.3.12",
+  "version": "0.3.13",
   "description": "GitHub Action that remediates Terraform to best practices and opens one scoped pull request per concern.",
   "keywords": [
     "ai-coding-agent",
@@ -103,7 +103,7 @@
     "@infraweaver-io/ci": "^0.1.8",
     "@infraweaver-io/core": "^0.1.5",
     "@infraweaver-io/crosswalk": "^1.2.0",
-    "@infraweaver-io/models": "^0.1.6",
+    "@infraweaver-io/models": "^0.1.7",
     "@infraweaver-io/policy-spec": "^1.2.0",
     "@infraweaver-io/report-contract": "^0.1.5",
     "@infraweaver-io/sandbox": "^0.1.8",

package/src/agents/opencode.ts

@@ -417,6 +417,12 @@ export interface TurnAccumulator {
   tokens: {
     input: number;
     output: number;
+    /**
+     * opencode reports reasoning apart from `output` (which excludes it). Kept
+     * separate so it reaches the token quota without changing the reported
+     * output count; cost already prices it, via opencode's per-step `cost`.
+     */
+    reasoning: number;
     cacheRead: number;
     cacheWrite: number;
   };
@@ -439,7 +445,7 @@ export function newTurn(): TurnAccumulator {
   turnCounter += 1;
   return {
     finalText: "",
-    tokens: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+    tokens: { input: 0, output: 0, reasoning: 0, cacheRead: 0, cacheWrite: 0 },
     costUsd: 0,
     sessionError: null,
     lastToolError: null,
@@ -739,6 +745,7 @@ async function onPartUpdated(ctx: RunnerContext, part: Part): Promise<void> {
     if (t) {
       ctx.currentTurn.tokens.input += t.input || 0;
       ctx.currentTurn.tokens.output += t.output || 0;
+      ctx.currentTurn.tokens.reasoning += t.reasoning || 0;
       ctx.currentTurn.tokens.cacheRead += t.cache?.read || 0;
       ctx.currentTurn.tokens.cacheWrite += t.cache?.write || 0;
     }

package/src/agents/quotaTokens.ts

@@ -15,11 +15,17 @@ const CACHE_READ_WEIGHT = 0.1;
 export interface TokenUsage {
   input: number;
   output: number;
+  /**
+   * Reasoning tokens a harness reports apart from `output`. opencode does (its
+   * `output` excludes them, its cost prices them as output); Anthropic's
+   * `output_tokens` already include thinking, so the Claude harness has none.
+   */
+  reasoning?: number;
   cacheRead: number;
   cacheWrite: number;
 }
 
 /** The pre-summed total the run's token quota observes. */
 export function quotaTokens(t: TokenUsage): number {
-  return t.input + t.output + t.cacheWrite + t.cacheRead * CACHE_READ_WEIGHT;
+  return t.input + t.output + (t.reasoning ?? 0) + t.cacheWrite + t.cacheRead * CACHE_READ_WEIGHT;
 }

package/src/mcp/git.ts

@@ -948,19 +948,68 @@ export const Git = type({
   args: type.string.array().describe("Additional arguments for the git command").optional(),
 });
 
-/** a command line split into words, honouring single and double quotes. */
+/**
+ * A command line split into words the way a POSIX shell splits it, with no
+ * expansion: a quote may open mid-word and is removed (`--message="a b"` is
+ * the one word `--message=a b`), single quotes are literal, a backslash
+ * escapes the next character outside them (inside double quotes only `"`,
+ * `\`, `$` and `` ` ``), and adjacent parts join into one word. What a shell
+ * would read differently — an unterminated quote, a trailing backslash, an
+ * unquoted newline (a second command) — throws instead of being guessed at.
+ */
 function splitWords(line: string): string[] {
-  return [...line.matchAll(/"([^"]*)"|'([^']*)'|(\S+)/g)].map((m) => m[1] ?? m[2] ?? m[3] ?? "");
+  const words: string[] = [];
+  let word = "";
+  let inWord = false;
+  let quote: "'" | '"' | undefined;
+  for (let i = 0; i < line.length; i++) {
+    const ch = line.charAt(i);
+    if (quote === "'") {
+      if (ch === "'") quote = undefined;
+      else word += ch;
+    } else if (quote === '"') {
+      if (ch === '"') quote = undefined;
+      else if (ch === "\\" && i + 1 < line.length && '"\\$`\n'.includes(line.charAt(i + 1))) {
+        i += 1;
+        if (line.charAt(i) !== "\n") word += line.charAt(i);
+      } else word += ch;
+    } else if (ch === " " || ch === "\t") {
+      if (inWord) words.push(word);
+      word = "";
+      inWord = false;
+    } else if (ch === "\n") {
+      throw new Error(
+        "command holds an unquoted newline — pass one git command per call, and quote a multi-line message",
+      );
+    } else if (ch === "\\") {
+      if (i + 1 >= line.length) throw new Error("command ends in a backslash that escapes nothing");
+      i += 1;
+      if (line.charAt(i) === "\n") continue;
+      word += line.charAt(i);
+      inWord = true;
+    } else if (ch === "'" || ch === '"') {
+      quote = ch;
+      inWord = true;
+    } else {
+      word += ch;
+      inWord = true;
+    }
+  }
+  if (quote) throw new Error(`command has an unterminated ${quote} quote`);
+  if (inWord) words.push(word);
+  return words;
 }
 
 /**
  * The subcommand and arguments of a call, however the model wrote it: the
  * subcommand alone (the documented form), a whole `git …` command line, or the
  * subcommand as the first of `args`. Models wrote the other two often enough
- * to cost a turn per run, and each is unambiguous. The subcommand is checked
- * against the same pattern the schema uses, so a flag (`-c`, `-C`,
- * `--exec-path`) can no more arrive through `args[0]` or a command line than
- * through `command`.
+ * to cost a turn per run, and each is unambiguous. Leading `git` words are
+ * dropped, so `{ command: "git", args: ["status"] }` is not `git git status`.
+ * The subcommand is checked against the same pattern the schema uses — in
+ * every form, the documented one included, so the check does not rest on the
+ * schema alone — and a flag (`-c`, `-C`, `--exec-path`) can no more arrive
+ * through `args[0]` or a command line than through `command`.
  */
 export function normalizeGitCall(params: {
   command?: string | undefined;
@@ -969,12 +1018,15 @@ export function normalizeGitCall(params: {
   command: string;
   args: string[];
 } {
-  let words: string[];
-  if (params.command === undefined) words = [...(params.args ?? [])];
-  else if (/^git\s/.test(params.command))
-    words = [...splitWords(params.command).slice(1), ...(params.args ?? [])];
-  else return { command: params.command, args: params.args ?? [] };
-  const [command, ...args] = words[0] === "git" ? words.slice(1) : words;
+  const words =
+    params.command === undefined
+      ? []
+      : /^git\s/.test(params.command)
+        ? splitWords(params.command)
+        : [params.command];
+  words.push(...(params.args ?? []));
+  while (words[0] === "git") words.shift();
+  const [command, ...args] = words;
   if (command === undefined || !/^[a-z][a-z0-9-]*$/.test(command)) {
     throw new Error(
       `command must be a Git subcommand such as 'status' or 'checkout' (was "${command ?? ""}")`,

package/src/mcp/localContext.ts

@@ -1,5 +1,6 @@
 import type { ToolState } from "#app/toolState";
 import type { ResolvedPayload } from "#app/utils/config/payload";
+import type { OctokitWithPlugins } from "#app/utils/github/github";
 
 /**
  * The cwd-scoped, GitHub-free subset of `ToolContext` that the read-only
@@ -79,5 +80,9 @@ export interface LocalToolContext {
   /** the repository, for its default branch. The Action's full `ToolContext`
    * carries it; a local session has none, so its remediation branches keep the
    * plain `remediate/<id>` name. */
-  repo?: { data: { default_branch?: string | null } } | undefined;
+  repo?: { owner?: string; name?: string; data: { default_branch?: string | null } } | undefined;
+  /** the Action's GitHub client, read only to find the remediation PRs already
+   * open, so a group that has one keeps that PR's branch. A local session has
+   * none and names its branches from the group and base alone. */
+  octokit?: OctokitWithPlugins | undefined;
 }