infraweaver 0.3.12 → 0.3.13

package/src/mcp/terraform/hardcodedSecrets.ts

@@ -12,22 +12,28 @@
  * WHAT IS READ. Every `name = "…"` line inside a `resource`, `data`,
  * `provider`, `module` or `locals` block, at any depth, so
  * `environment { variables = { auth = "…" } }` and `jsonencode({ … })` objects
- * are reached; and the `default` of a `variable` whose name is a secret's. Not
- * read: comments, heredoc bodies, a name/value pair split across two keys
- * (`[{ name = "PASSWORD", value = "…" }]`), and a value that starts on a later
- * line than its name.
+ * are reached; the `default` of a `variable` whose name is a secret's; and
+ * every assignment in a `.tfvars` file, which is where a value kept out of the
+ * `.tf` source usually lands instead. Not read: comments, heredoc bodies, a
+ * name/value pair split across two keys (`[{ name = "PASSWORD", value = "…" }]`),
+ * and a value that starts on a later line than its name.
  *
- * WHAT IS NOT A FINDING. A reference, a function call, an interpolation, an
- * empty string, or a placeholder made only of `*` / `x` / `<…>`. Neither is an
- * argument whose name only mentions a secret (`password_length`, `secret_name`,
- * `token_validity_units`, `creation_token`): the last word of the name decides.
+ * WHAT IS NOT A FINDING. A reference, a function call, an interpolation or a
+ * template directive, an empty string, `true` / `false` / `null`, a number, or
+ * a placeholder made only of `*` / `x` / `<…>`. Nor is a literal that only POINTS
+ * at a secret — an ARN, a GCP `projects/…/secrets/…` name, a Key Vault secret
+ * URI or an SSM parameter path — since that is the fix, not the fault. Neither
+ * is an argument whose name only mentions a secret (`password_length`,
+ * `secret_name`, `token_validity_units`, `creation_token`): the last word of the
+ * name decides, and a name that is `secret` and nothing else names a Secret
+ * Manager secret (`secret_key_ref { secret = "db-password" }`), not its value.
  *
  * Arguments the provider can take write-only (`aws_db_instance.password`) may
  * also be reported by `secret-persisted-to-state`, which says something else:
  * that the value reaches state. This one says it is in git.
  */
 
-import { isStringLiteral, stripTrailingComment } from "#app/mcp/terraform/hcl";
+import { isStringLiteral, skipNonCode, stripTrailingComment } from "#app/mcp/terraform/hcl";
 import { HARDCODED_SECRET_ARGUMENT, NATIVE_SOURCE } from "#app/mcp/terraform/nativeRules";
 import type { SourceFile } from "#app/mcp/terraform/tree";
 import { buildConcern, type Concern } from "#app/mcp/terraform/types";
@@ -46,7 +52,18 @@ const SECRET_WORDS = new Set([
   "credentials",
 ]);
 /** `<word>_key` names that hold a secret (`api_key`, `secret_key`, …). */
-const SECRET_KEY_PREFIXES = new Set(["api", "secret", "private", "signing"]);
+const SECRET_KEY_PREFIXES = new Set([
+  "api",
+  "secret",
+  "private",
+  "signing",
+  "access",
+  "account",
+  "client",
+  "shared",
+  "preshared",
+  "master",
+]);
 /** `<word>_token` names that are identifiers, not credentials. */
 const NOT_SECRET_TOKENS = new Set(["creation", "idempotency", "client", "request", "continuation"]);
 
@@ -66,6 +83,9 @@ export function isSecretName(name: string): boolean {
   if (last === undefined) return false;
   if (last === "key") return prev !== undefined && SECRET_KEY_PREFIXES.has(prev);
   if (last === "token" && prev !== undefined && NOT_SECRET_TOKENS.has(prev)) return false;
+  if (last === "string") return prev === "connection";
+  // `secret` alone is the NAME of a Secret Manager secret (`secret_key_ref { secret = … }`)
+  if (last === "secret" && w.length === 1) return false;
   return SECRET_WORDS.has(last);
 }
 
@@ -75,13 +95,38 @@ function isPlaceholder(inner: string): boolean {
     inner.trim() === "" ||
     /^[*xX.]+$/.test(inner) ||
     /^<[^>]*>$/.test(inner) ||
-    // the dummy credentials offline plans and LocalStack are given (`secret_key = "test"`)
-    /^(?:test|mock|fake|dummy|fixture|example|placeholder|sample)(?:[_-].*)?$/i.test(inner) ||
+    /^(?:true|false|null)$/.test(inner) ||
+    /^-?\d+(?:\.\d+)?$/.test(inner) ||
+    // a template directive is computed, like an interpolation: `"%{ if … }…%{ endif }"`
+    inner.includes("%{") ||
+    // the dummy credentials offline plans and LocalStack are given (`secret_key = "test"`,
+    // `"example-secret"`) — but only when that is the whole value: a lowercase tail at
+    // most, so `"Test-Pr0dDbPassw0rd!"` is a password that happens to start with a word
+    isDummy(inner) ||
     // a token's lifetime unit: `token_validity_units { access_token = "hours" }`
     /^(?:seconds|minutes|hours|days)$/.test(inner)
   );
 }
 
+function isDummy(inner: string): boolean {
+  const m = /^(?:test|mock|fake|dummy|fixture|example|placeholder|sample)([_-].*)?$/i.exec(inner);
+  return m !== null && (m[1] === undefined || /^[_-][a-z0-9_-]*$/.test(m[1]));
+}
+
+/**
+ * A literal that names where a secret is kept rather than holding it: a Secrets
+ * Manager / SSM ARN, a GCP Secret Manager resource name, a Key Vault secret URI,
+ * or an SSM parameter path. Passing one of these is the remedy this rule asks for.
+ */
+function isSecretReference(inner: string): boolean {
+  return (
+    inner.startsWith("arn:") ||
+    /^projects\/[^/]+\/secrets\//.test(inner) ||
+    /^https:\/\/[\w-]+\.vault\.azure\.net\/secrets\//i.test(inner) ||
+    /^\/[\w./-]+$/.test(inner)
+  );
+}
+
 export interface HardcodedSecret {
   /** the argument, map key or variable name. */
   name: string;
@@ -90,17 +135,52 @@ export interface HardcodedSecret {
   line: number;
 }
 
-/** a top-level block header: `resource "aws_db_instance" "db" {`, `locals {` */
-const HEADER = /^(resource|data|provider|module|locals|variable|output|terraform)\b([^{]*)\{\s*$/;
+/** a top-level block header, `resource "aws_db_instance" "db" {`, and whatever follows its `{` */
+const HEADER = /^(resource|data|provider|module|locals|variable|output|terraform)\b([^{]*)\{(.*)$/;
 /** `name = value`, the name bare or quoted */
 const ASSIGNMENT = /^\s*(?:"([A-Za-z_][\w-]*)"|([A-Za-z_][\w-]*))\s*=(?!=)\s*(.*)$/;
 const HEREDOC = /<<-?([A-Za-z_]\w*)\s*$/;
 /** a `key = "string"` pair inside a one-line object */
 const INLINE_PAIR = /(?:"([A-Za-z_][\w-]*)"|\b([A-Za-z_][\w-]*))\s*=(?!=)\s*("(?:[^"\\]|\\.)*")/g;
 
-function literalValue(raw: string): boolean {
+function literalValue(name: string, raw: string): boolean {
   const value = stripTrailingComment(raw).replace(/,$/, "").trim();
-  return isStringLiteral(value) && !isPlaceholder(value.slice(1, -1));
+  if (!isStringLiteral(value)) return false;
+  const inner = value.slice(1, -1);
+  if (isPlaceholder(inner) || isSecretReference(inner)) return false;
+  // an `auth` setting's mode, not its credential: `iam_auth = "DISABLED"`, `auth = "NONE"`
+  return !(words(name).at(-1) === "auth" && /^[A-Z]+(?:_[A-Z]+)*$/.test(inner));
+}
+
+/** the name a `variable "…"` holder declares. */
+function variableName(holder: string): string {
+  return /^variable\s+"?([\w-]+)"?/.exec(holder)?.[1] ?? "";
+}
+
+/** True when `line` leaves a block comment open past its end (`foo = 1 /* …`). */
+function opensBlockComment(line: string): boolean {
+  for (let i = 0; i < line.length; i++) {
+    const span = skipNonCode(line, i);
+    if (!span) continue;
+    if (line.startsWith("/*", i) && !line.includes("*/", i + 2)) return true;
+    i = span.end;
+  }
+  return false;
+}
+
+/** True when the text after a header's `{` also closes that block. */
+function closesOnLine(rest: string): boolean {
+  let depth = 1;
+  for (let i = 0; i < rest.length; i++) {
+    const span = skipNonCode(rest, i);
+    if (span) {
+      i = span.end;
+      continue;
+    }
+    if (rest[i] === "{") depth++;
+    else if (rest[i] === "}" && --depth === 0) return true;
+  }
+  return false;
 }
 
 /**
@@ -111,8 +191,21 @@ function literalValue(raw: string): boolean {
  * parser is shared by every scanner and budgeted (see nativeScan.perf.test).
  */
 export function findHardcodedSecrets(hcl: string): HardcodedSecret[] {
+  return findInLines(hcl, null);
+}
+
+/**
+ * Every secret-named literal in a `.tfvars` file. A tfvars file is nothing but
+ * assignments, so every one is read, at any depth, under the file's own name.
+ */
+export function findTfvarsSecrets(hcl: string, path: string): HardcodedSecret[] {
+  return findInLines(hcl, `tfvars input ${path}`);
+}
+
+/** `fileHolder` set: the whole file is one holder (a tfvars file), with no blocks. */
+function findInLines(hcl: string, fileHolder: string | null): HardcodedSecret[] {
   const out: HardcodedSecret[] = [];
-  let holder: string | null = null;
+  let holder: string | null = fileHolder;
   let heredoc: string | null = null;
   let inComment = false;
   const lines = hcl.split("\n");
@@ -132,12 +225,30 @@ export function findHardcodedSecrets(hcl: string): HardcodedSecret[] {
       continue;
     }
     if (trimmed.startsWith("#") || trimmed.startsWith("//")) continue;
-    const header = HEADER.exec(line);
+    // a comment opened mid-line hides the lines after it; this line's code still counts
+    if (opensBlockComment(line)) inComment = true;
+    const header = fileHolder === null ? HEADER.exec(line) : null;
     if (header) {
       holder = `${header[1]}${(header[2] as string).trimEnd() ? ` ${(header[2] as string).trim()}` : ""}`;
+      // a block written on one line, `resource "a" "b" { password = "…" }`, carries its body
+      const rest = header[3] as string;
+      const opens = HEREDOC.exec(rest);
+      if (opens) heredoc = opens[1] as string;
+      if (!holder.startsWith("output ") && !holder.startsWith("terraform")) {
+        for (const pair of rest.matchAll(INLINE_PAIR)) {
+          const key = (pair[1] ?? pair[2]) as string;
+          const isVariable = holder.startsWith("variable ");
+          if (isVariable && key !== "default") continue;
+          const name = isVariable ? variableName(holder) : key;
+          if (isSecretName(name) && literalValue(name, pair[3] as string)) {
+            out.push({ name, holder, line: i + 1 });
+          }
+        }
+      }
+      if (closesOnLine(rest)) holder = null;
       continue;
     }
-    if (line.startsWith("}")) {
+    if (fileHolder === null && line.startsWith("}")) {
       holder = null;
       continue;
     }
@@ -150,21 +261,21 @@ export function findHardcodedSecrets(hcl: string): HardcodedSecret[] {
     const value = m[3] as string;
     if (holder.startsWith("variable ")) {
       // a variable's literal is its default, and the variable's name says what it holds
-      const variable = /^variable\s+"?([\w-]+)"?/.exec(holder)?.[1] ?? "";
-      if (name === "default" && isSecretName(variable) && literalValue(value)) {
+      const variable = variableName(holder);
+      if (name === "default" && isSecretName(variable) && literalValue(variable, value)) {
         out.push({ name: variable, holder, line: i + 1 });
       }
       continue;
     }
     if (holder.startsWith("output ") || holder.startsWith("terraform")) continue;
-    if (isSecretName(name) && literalValue(value)) {
+    if (isSecretName(name) && literalValue(name, value)) {
       out.push({ name, holder, line: i + 1 });
       continue;
     }
     // an object written on one line holds its own pairs: `{ "DB_PASSWORD" = "…" }`
     for (const pair of value.matchAll(INLINE_PAIR)) {
       const key = (pair[1] ?? pair[2]) as string;
-      if (isSecretName(key) && literalValue(pair[3] as string)) {
+      if (isSecretName(key) && literalValue(key, pair[3] as string)) {
         out.push({ name: key, holder, line: i + 1 });
       }
     }
@@ -172,11 +283,21 @@ export function findHardcodedSecrets(hcl: string): HardcodedSecret[] {
   return out;
 }
 
-/** Scan an already-read tree into native concerns. Pure; no I/O of its own. */
-export function scanHardcodedSecrets(files: readonly SourceFile[]): Concern[] {
+/**
+ * Scan an already-read tree into native concerns. Pure; no I/O of its own.
+ * `tfvarsFiles` are the `.tfvars` inputs, read as assignments rather than blocks.
+ */
+export function scanHardcodedSecrets(
+  files: readonly SourceFile[],
+  tfvarsFiles: readonly SourceFile[] = [],
+): Concern[] {
   const concerns: Concern[] = [];
-  for (const { path, hcl } of files) {
-    for (const hit of findHardcodedSecrets(hcl)) {
+  const hits = [
+    ...files.map((f) => ({ path: f.path, found: findHardcodedSecrets(f.hcl) })),
+    ...tfvarsFiles.map((f) => ({ path: f.path, found: findTfvarsSecrets(f.hcl, f.path) })),
+  ];
+  for (const { path, found } of hits) {
+    for (const hit of found) {
       concerns.push(
         buildConcern({
           source: NATIVE_SOURCE,

package/src/mcp/terraform/nativeRuleScanners.ts

@@ -131,7 +131,8 @@ export const NATIVE_RULE_SCANNERS: readonly NativeRuleScanner[] = [
     name: "hardcoded-secrets",
     rules: [HARDCODED_SECRET_ARGUMENT],
     // Per file: the argument's name and its literal are both on the line itself.
-    scan: (ctx) => ({ concerns: scanHardcodedSecrets(ctx.files) }),
+    // The only rule that reads `.tfvars`: an input file holds values, not config.
+    scan: (ctx) => ({ concerns: scanHardcodedSecrets(ctx.files, ctx.tfvarsFiles) }),
   },
   {
     name: "write-only",

package/src/mcp/terraform/nativeScan.ts

@@ -26,6 +26,7 @@ import {
   describeOversize,
   describeTruncation,
   readTfTree,
+  readTfvarsTree,
   readTofuTree,
   type SourceTree,
 } from "#app/mcp/terraform/tree";
@@ -74,6 +75,9 @@ export function scanNative(cwd: string, opts: NativeScanOptions = {}): ScannerOu
     // walk over a suffix most repos do not use at all, and threading it through
     // the context keeps the scanners uniform.
     tofuFiles: readTofuTree(cwd).files,
+    // likewise only for the hardcoded-secret rule: a value kept out of the `.tf`
+    // source is most often committed here instead
+    tfvarsFiles: readTfvarsTree(cwd).files,
     truncated: tree.truncated,
     repeatedLiteralThreshold: opts.repeatedLiteralThreshold ?? DEFAULT_REPEAT_THRESHOLD,
   });

package/src/mcp/terraform/refactor/equivalence.ts

@@ -31,14 +31,17 @@ import { describeMissingMoves, type PairAnalysis } from "#app/mcp/terraform/plan
 import {
   instanceKeysOf,
   isModuleAddress,
+  moduleHops,
   normaliseAddress,
   qualify,
   stripIndices,
+  stripModuleHops,
 } from "#app/mcp/terraform/refactor/addresses";
 import { type MovedBlock, moveId } from "#app/mcp/terraform/refactor/movedBlocks";
 import {
   describeMultiplicity,
   enumerateInstanceKeys,
+  type Multiplicity,
   type ResourceRef,
   sameMultiplicity,
   sameMultiplicityLevels,
@@ -384,10 +387,11 @@ function correspond(
  * than sending a correct refactor away for a plan it does not need.
  *
  * Abstains (null) on anything it cannot read exactly: a chain of more than one
- * repetition, an expression that is not a literal collection, or a declared block
- * that names no single instance. Extra blocks naming keys the collection does not
- * contain are NOT an error — a `moved` block whose source never existed is a
- * no-op, and a mistyped key shows up as the missing one it left behind.
+ * repetition, an expression that is not a literal collection, a declared block
+ * that names no single instance, or one whose key level cannot be located.
+ * Extra blocks naming keys the collection does not contain are NOT an error — a
+ * `moved` block whose source never existed is a no-op, and a mistyped key shows
+ * up as the missing one it left behind.
  */
 function uncoveredInstanceKeys(p: Pairing): string[] | null {
   const level = p.before.multiplicity;
@@ -400,25 +404,54 @@ function uncoveredInstanceKeys(p: Pairing): string[] | null {
   // is their exact spelling.
   const kind = level[0].kind;
   const written = (k: string) => (kind === "count" ? k : `"${k}"`);
+  const fromAt = level[0].at;
+  const toAt = p.after.multiplicity[0]?.at;
+  if (fromAt === undefined || toAt === undefined) return null;
   const declared = new Set<string>();
   for (const blk of p.blocks) {
+    // a chain hop or a module-level block names an address neither tree
+    // attributes, so where its repetition sits is unknown
+    if (
+      stripIndices(normaliseAddress(blk.from)) !== p.before.address ||
+      stripIndices(normaliseAddress(blk.to)) !== p.after.address
+    )
+      return null;
     // A relevelling repeats BOTH sides, at different levels: the instance is
     // `aws_s3_bucket.data["logs"]` before and `module.data["logs"].…` after, so a
-    // block covers it only when each side names that same key. A key on one side
-    // alone (`aws_s3_bucket.data["logs"]` → `module.data.aws_s3_bucket.this`)
-    // points at an address the repetition no longer has, and Terraform plans it
-    // as a destroy and a create.
+    // block covers it only when each side names that same key, at the level that
+    // side repeats. A key on one side alone (`aws_s3_bucket.data["logs"]` →
+    // `module.data.aws_s3_bucket.this`), or on the wrong level
+    // (`module.data.aws_s3_bucket.this["logs"]`), points at an address the
+    // repetition does not have, and Terraform plans it as a destroy and a create.
     const from = instanceKeysOf(blk.from);
     const to = instanceKeysOf(blk.to);
     // more than one key per side is a chain this proof does not read; no key on
     // either side names no single instance
     if (from.length > 1 || to.length > 1) return null;
     if (from.length === 0 && to.length === 0) return null;
-    if (from.length === 1 && to.length === 1 && from[0] === to[0]) declared.add(from[0] as string);
+    if (from.length !== 1 || to.length !== 1 || from[0] !== to[0]) continue;
+    const fromPlaced = keyAtLevel(blk.from, fromAt);
+    const toPlaced = keyAtLevel(blk.to, toAt);
+    // a side on the wrong level covers nothing, whatever the other side says
+    if (fromPlaced === false || toPlaced === false) continue;
+    if (fromPlaced === null || toPlaced === null) return null;
+    declared.add(from[0] as string);
   }
   return expected.filter((k) => !declared.has(written(k)));
 }
 
+/**
+ * Whether the one instance key `address` writes sits on the level `at` that
+ * repeats, or null when that level cannot be located: a module repetition on a
+ * path through several calls is on one of them, and the chain does not say which.
+ */
+function keyAtLevel(address: string, at: NonNullable<Multiplicity["at"]>): boolean | null {
+  const onResource = instanceKeysOf(stripModuleHops(normaliseAddress(address))).length > 0;
+  if (at === "resource") return onResource;
+  if (onResource) return false;
+  return moduleHops(address).length === 1 ? true : null;
+}
+
 /**
  * Compute the keys-free equivalence verdict from the before/after resource
  * address sets and the `moved {}` blocks present in the after tree. Validate/fmt

package/src/mcp/terraform/refactorScope.ts

@@ -12,19 +12,72 @@
  * people call (terraform-aws-vpc, say). Moving its resources into a submodule is
  * provably equivalent, and still churn for every consumer: their plans gain a
  * wall of `moved` addresses for no change in what they get. There, extraction
- * and normalisation candidates come back marked `report_only` — named in the
- * run's summary, never opened as a PR. Consolidating roots that duplicate each
- * other is unaffected: that removes real duplication, not style.
+ * and normalisation candidates in the module's own code come back marked
+ * `report_only` — named in the run's summary, never opened as a PR. A directory
+ * inside it that deploys (`envs/prod/` with its own provider or backend) is a
+ * configuration like any other, and its candidates stay actionable.
+ * Consolidating roots that duplicate each other is unaffected: that removes real
+ * duplication, not style.
  */
-import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { readdirSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
+import { BLOCK_LABEL, parseBlocks } from "#app/mcp/terraform/hcl";
 
-/** true for a path inside an `examples/` (or `example/`) directory, at any depth. */
+/**
+ * true for a path inside an `examples/` directory at any depth, or an `example/`
+ * one at the repository root. The registry's convention is `examples/`; the
+ * singular is accepted only where that convention puts it, because a module
+ * NAMED `example` (`modules/example/`) is code someone calls.
+ */
 export function isExamplePath(path: string): boolean {
-  return /(?:^|\/)examples?\//.test(path.replace(/\\/g, "/"));
+  return /(?:^|\/)examples\/|^example\//i.test(path.replace(/\\/g, "/"));
+}
+
+const PROVIDER_OR_BACKEND = new RegExp(
+  String.raw`(?:^|\n)\s*(?:provider|backend)\s+${BLOCK_LABEL}\s*\{`,
+);
+const CLOUD_BLOCK = /(?:^|\n)\s*cloud\s*\{/;
+
+/** whether one file's text configures a provider, a backend or HCP Terraform. */
+function configuresDeployment(name: string, text: string): boolean {
+  if (name.endsWith(".tf.json")) {
+    let doc: unknown;
+    try {
+      doc = JSON.parse(text);
+    } catch {
+      return false;
+    }
+    if (typeof doc !== "object" || doc === null) return false;
+    const { provider, terraform } = doc as { provider?: unknown; terraform?: unknown };
+    if (provider !== undefined) return true;
+    // `terraform` is an object, or an array of them, in the JSON syntax
+    return [terraform]
+      .flat()
+      .some((t) => typeof t === "object" && t !== null && ("backend" in t || "cloud" in t));
+  }
+  if (PROVIDER_OR_BACKEND.test(text)) return true;
+  // `cloud` is a block name other schemas use too; only the settings block's counts
+  return parseBlocks(text, ["terraform"]).some((b) => CLOUD_BLOCK.test(b.body));
 }
 
-const PROVIDER_OR_BACKEND = /^\s*(?:provider\s+"|backend\s+")/m;
+const isTerraformFile = (name: string) => name.endsWith(".tf") || name.endsWith(".tf.json");
+
+/** whether the Terraform directly in `dir` is a root someone deploys from. */
+function deploysFrom(dir: string): boolean {
+  let names: string[];
+  try {
+    names = readdirSync(dir).filter(isTerraformFile);
+  } catch {
+    return false;
+  }
+  return names.some((name) => {
+    try {
+      return configuresDeployment(name, readFileSync(join(dir, name), "utf8"));
+    } catch {
+      return false;
+    }
+  });
+}
 
 /** whether some directory under `dir` (to a small depth) holds a `.tf` file. */
 function holdsTerraform(dir: string, depth: number): boolean {
@@ -53,23 +106,14 @@ function holdsTerraform(dir: string, depth: number): boolean {
  * deployment, or null when it does not.
  */
 export function libraryRepoReason(cwd: string): string | null {
-  let rootFiles: string[];
+  let rootEntries: string[];
   try {
-    rootFiles = readdirSync(cwd).filter((f) => f.endsWith(".tf"));
+    rootEntries = readdirSync(cwd);
   } catch {
     return null;
   }
-  if (rootFiles.length === 0) return null;
-  for (const f of rootFiles) {
-    let text: string;
-    try {
-      text = readFileSync(join(cwd, f), "utf8");
-    } catch {
-      continue;
-    }
-    if (PROVIDER_OR_BACKEND.test(text)) return null;
-  }
-  const examples = ["examples", "example"].find((d) => existsSync(join(cwd, d)));
+  if (!rootEntries.some(isTerraformFile) || deploysFrom(cwd)) return null;
+  const examples = rootEntries.find((d) => /^examples?$/i.test(d));
   if (examples === undefined || !holdsTerraform(join(cwd, examples), 2)) return null;
   return (
     `the repository root configures no provider and no backend, and ships \`${examples}/\`: it is a ` +
@@ -77,7 +121,32 @@ export function libraryRepoReason(cwd: string): string | null {
   );
 }
 
-/** what a detector tool adds to its result when the repository is a library. */
+/**
+ * For a library repository, why a candidate in `file` (repo-relative) is
+ * reported rather than restructured — or null when the file belongs to a
+ * directory, or sits under one, that deploys on its own. Outside a library,
+ * always null.
+ */
+export function libraryScope(cwd: string): (file: string) => string | null {
+  const reason = libraryRepoReason(cwd);
+  if (reason === null) return () => null;
+  const deploys = new Map<string, boolean>();
+  return (file) => {
+    const dirs = file.replace(/\\/g, "/").split("/").slice(0, -1);
+    for (let i = dirs.length; i > 0; i--) {
+      const dir = dirs.slice(0, i).join("/");
+      let d = deploys.get(dir);
+      if (d === undefined) {
+        d = deploysFrom(join(cwd, dir));
+        deploys.set(dir, d);
+      }
+      if (d) return null;
+    }
+    return reason;
+  };
+}
+
+/** what a detector tool adds to a candidate in a library's own code. */
 export function reportOnly(reason: string | null): {
   report_only?: true;
   report_only_reason?: string;

package/src/mcp/terraform/ruleContext.ts

@@ -46,6 +46,8 @@ export interface RuleContext {
   readonly files: readonly SourceFile[];
   /** the `.tofu` half. Only the dialect rule needs it; empty on a repo with none. */
   readonly tofuFiles: readonly SourceFile[];
+  /** the `.tfvars` inputs. Only the hardcoded-secret rule reads them; empty on a repo with none. */
+  readonly tfvarsFiles: readonly SourceFile[];
   /** non-null when the walk was bounded before it finished — see [[tree]]. */
   readonly truncated: TreeTruncation;
   /** how many times a literal must repeat in one directory before it is reported. */
@@ -80,6 +82,7 @@ export interface RuleContextInput {
   cwd: string;
   files: readonly SourceFile[];
   tofuFiles?: readonly SourceFile[];
+  tfvarsFiles?: readonly SourceFile[];
   truncated?: TreeTruncation;
   repeatedLiteralThreshold: number;
 }
@@ -89,6 +92,7 @@ export function createRuleContext(input: RuleContextInput): RuleContext {
     cwd: input.cwd,
     files: input.files,
     tofuFiles: input.tofuFiles ?? [],
+    tfvarsFiles: input.tfvarsFiles ?? [],
     truncated: input.truncated ?? null,
     repeatedLiteralThreshold: input.repeatedLiteralThreshold,
   };