infraweaver 0.3.12 → 0.3.13

package/src/mcp/terraform/scanDelta.ts

@@ -275,38 +275,79 @@ export function computeScanDelta(input: ScanDeltaInput): ScanDelta {
 }
 
 /**
- * Pair an introduced finding on a NEW resource with a resolved one that broke
- * the same rule and whose resource no longer exists where it was: renamed within
- * its module, or moved under the same name to another directory (a resource
- * extracted into a module without a `moved` block). Each resolved finding pairs
- * at most once.
+ * Pair a NEW resource with a vanished one — a resource whose findings resolved
+ * because it no longer exists where it was: renamed within its module, or moved
+ * under the same name to another directory (a resource extracted into a module
+ * without a `moved` block).
+ *
+ * Resources pair one-to-one, as `moved` blocks do: Terraform rejects two blocks
+ * with the same `from` or the same `to`, so a pairing made per finding — one new
+ * bucket matched to two old ones because each shared a different rule — would
+ * advise blocks that cannot be written. Each candidate pair scores the findings
+ * the two resources share (rule by rule, instance by instance), the best pairs
+ * are taken first, and ties fall to address order so the result is stable. Only
+ * the shared findings of a pair are labelled; a rule the vanished resource never
+ * broke is new on the renamed one too.
  */
 function markPossibleRenames(
   introduced: DeltaFinding[],
   resolved: DeltaFinding[],
   headAddresses: (dir: string) => ReadonlySet<string>,
 ): void {
-  const vanished = resolved.filter((r) => {
-    if (r.address === null) return false;
-    return !headAddresses(dirOf(r.concern.location.file)).has(r.address);
-  });
-  const used = new Set<DeltaFinding>();
-  for (const finding of introduced) {
-    if (finding.address === null) continue;
-    const dir = dirOf(finding.concern.location.file);
-    const match = vanished.find(
-      (r) =>
-        !used.has(r) &&
-        ruleKey(r.concern) === ruleKey(finding.concern) &&
-        // a `moved` block cannot change a resource's type
-        typeOf(r.address as string) === typeOf(finding.address as string) &&
-        // renamed in place, or moved elsewhere under its own name
-        (dirOf(r.concern.location.file) === dir) !== (r.address === finding.address),
-    );
-    if (!match) continue;
-    used.add(match);
-    finding.possiblyPreexisting = true;
-    finding.renamedFrom = { address: match.address as string, file: match.concern.location.file };
+  const byResource = (findings: DeltaFinding[]) => {
+    const out = new Map<string, { dir: string; address: string; findings: DeltaFinding[] }>();
+    for (const f of [...findings].sort((a, b) => byLocation(a.concern, b.concern))) {
+      if (f.address === null) continue;
+      const dir = dirOf(f.concern.location.file);
+      const key = `${dir}|${f.address}`;
+      const entry = out.get(key);
+      if (entry) entry.findings.push(f);
+      else out.set(key, { dir, address: f.address, findings: [f] });
+    }
+    return [...out.values()];
+  };
+  const vanished = byResource(resolved).filter((r) => !headAddresses(r.dir).has(r.address));
+  const appeared = byResource(introduced);
+
+  // the findings of `to` that match one of `from`'s, each of `from`'s used once
+  const shared = (from: (typeof vanished)[number], to: (typeof appeared)[number]) => {
+    const left = new Map<string, number>();
+    for (const f of from.findings)
+      left.set(ruleKey(f.concern), (left.get(ruleKey(f.concern)) ?? 0) + 1);
+    return to.findings.filter((f) => {
+      const n = left.get(ruleKey(f.concern)) ?? 0;
+      if (n === 0) return false;
+      left.set(ruleKey(f.concern), n - 1);
+      return true;
+    });
+  };
+  const order = (a: { dir: string; address: string }, b: { dir: string; address: string }) =>
+    a.dir.localeCompare(b.dir) || a.address.localeCompare(b.address);
+  const candidates = vanished.flatMap((from) =>
+    appeared
+      .filter(
+        (to) =>
+          // a `moved` block cannot change a resource's type
+          typeOf(from.address) === typeOf(to.address) &&
+          // renamed in place, or moved elsewhere under its own name
+          (from.dir === to.dir) !== (from.address === to.address),
+      )
+      .map((to) => ({ from, to, findings: shared(from, to) }))
+      .filter((p) => p.findings.length > 0),
+  );
+  candidates.sort(
+    (a, b) => b.findings.length - a.findings.length || order(a.from, b.from) || order(a.to, b.to),
+  );
+  const used = new Set<object>();
+  for (const { from, to, findings } of candidates) {
+    if (used.has(from) || used.has(to)) continue;
+    used.add(from);
+    used.add(to);
+    const file = from.findings[0]?.concern.location.file as string;
+    for (const finding of findings) {
+      finding.possiblyPreexisting = true;
+      finding.renamedFrom = { address: from.address, file };
+    }
   }
 }
 

package/src/mcp/terraform/tools/detectPlanDrift.ts

@@ -6,6 +6,7 @@ import { PRODUCT_NAME } from "#app/brand";
 import type { LocalToolContext } from "#app/mcp/localContext";
 import { walkTfFiles } from "#app/mcp/modules";
 import { execute, tool, toolOk } from "#app/mcp/shared";
+import { listOpenRemediationPrs } from "#app/mcp/staleFix";
 import { buildConcernResult } from "#app/mcp/terraform/concernResult";
 import { indexTfResources } from "#app/mcp/terraform/cspm";
 import { docUrlsForGroup, ruleDocUrl } from "#app/mcp/terraform/decisions";
@@ -180,6 +181,7 @@ export function DetectPlanDriftTool(ctx: LocalToolContext) {
         // drift is a narrow concern source — join any prior scan baseline so a
         // later ✗→✓ verify doesn't read the whole workspace as regressions.
         baselineMode: "merge",
+        openRemediationPrs: await listOpenRemediationPrs(ctx),
       });
 
       log.info(

package/src/mcp/terraform/tools/ingestExternalFindings.ts

@@ -7,6 +7,7 @@ import { PRODUCT_NAME } from "#app/brand";
 import type { LocalToolContext } from "#app/mcp/localContext";
 import { readTextCapped, walkTfFiles } from "#app/mcp/modules";
 import { execute, tool, toolOk } from "#app/mcp/shared";
+import { listOpenRemediationPrs } from "#app/mcp/staleFix";
 import { buildConcernResult } from "#app/mcp/terraform/concernResult";
 import { cappedSummary, SeedCapParams, seedCapsFrom } from "#app/mcp/terraform/coverage";
 import {
@@ -220,6 +221,7 @@ export function IngestExternalFindingsTool(ctx: LocalToolContext) {
         // baseline so a later ✗→✓ verify doesn't read the workspace as regressions.
         baselineMode: "merge",
         seedCaps: seedCapsFrom(input),
+        openRemediationPrs: await listOpenRemediationPrs(ctx),
       });
       const cappedBlock = cappedSummary(capped);
 

package/src/mcp/terraform/tools/normalizationCandidates.ts

@@ -2,7 +2,7 @@ import { type } from "arktype";
 import type { LocalToolContext } from "#app/mcp/localContext";
 import { execute, tool, toolOk } from "#app/mcp/shared";
 import { findNormalizationCandidates } from "#app/mcp/terraform/normalization";
-import { isExamplePath, libraryRepoReason, reportOnly } from "#app/mcp/terraform/refactorScope";
+import { isExamplePath, libraryScope, reportOnly } from "#app/mcp/terraform/refactorScope";
 import { log } from "#app/utils/cli";
 
 // --- the tool ----------------------------------------------------------------
@@ -29,15 +29,15 @@ export function NormalizationCandidatesTool(ctx: LocalToolContext) {
     parameters: NormalizationCandidatesParams,
     execute: execute(async () => {
       const cwd = ctx.payload.cwd ?? process.cwd();
-      const files = findNormalizationCandidates(cwd).filter(
-        (f) => ctx.payload.refactorExamples || !isExamplePath(f.file),
-      );
+      const library = libraryScope(cwd);
+      const files = findNormalizationCandidates(cwd)
+        .filter((f) => ctx.payload.refactorExamples || !isExamplePath(f.file))
+        .map((f) => ({ ...reportOnly(library(f.file)), ...f }));
       const total = files.reduce((n, f) => n + f.count, 0);
       log.info(
         `» terraform_normalization_candidates: ${total} site(s) across ${files.length} file(s)`,
       );
       return toolOk({
-        ...reportOnly(libraryRepoReason(cwd)),
         file_count: files.length,
         total,
         files,

package/src/mcp/terraform/tools/readFindings.ts

@@ -4,6 +4,7 @@ import { type } from "arktype";
 import { PRODUCT_NAME } from "#app/brand";
 import type { LocalToolContext } from "#app/mcp/localContext";
 import { execute, tool, toolOk } from "#app/mcp/shared";
+import { listOpenRemediationPrs } from "#app/mcp/staleFix";
 import { buildConcernResult } from "#app/mcp/terraform/concernResult";
 import { cappedSummary, SeedCapParams, seedCapsFrom } from "#app/mcp/terraform/coverage";
 import { docUrlsForGroup, ruleDocUrl } from "#app/mcp/terraform/decisions";
@@ -102,6 +103,7 @@ export function ReadFindingsTool(ctx: LocalToolContext) {
         grouping,
         autonomyThreshold,
         seedCaps: seedCapsFrom(input),
+        openRemediationPrs: await listOpenRemediationPrs(ctx),
       });
       const cappedBlock = cappedSummary(capped);
 

package/src/mcp/terraform/tools/scan.ts

@@ -4,6 +4,7 @@ import { type } from "arktype";
 import type { LocalToolContext } from "#app/mcp/localContext";
 import { walkTfFiles } from "#app/mcp/modules";
 import { execute, tool, toolOk } from "#app/mcp/shared";
+import { listOpenRemediationPrs } from "#app/mcp/staleFix";
 import { loadBaseline, loadResolvedLedger } from "#app/mcp/terraform/baseline";
 import { buildConcernResult } from "#app/mcp/terraform/concernResult";
 import {
@@ -148,6 +149,8 @@ export async function runScan(
       autonomyThreshold,
       inScope,
       priority,
+      openRemediationPrs: await listOpenRemediationPrs(ctx),
+      linesMatchTree: true,
     },
   );
   const { active, suppressed, groups, batchPlan, bySeverity: by_severity } = result;

package/src/mcp/terraform/tree.ts

@@ -176,6 +176,14 @@ export function readTofuTree(cwd: string, limits?: TreeReadLimits): SourceTree {
   return readTree(cwd, ".tofu", limits);
 }
 
+/**
+ * The `.tfvars` inputs (`.auto.tfvars` included). Not configuration, so no rule
+ * reads them as blocks; the hardcoded-secret rule reads their assignments.
+ */
+export function readTfvarsTree(cwd: string, limits?: TreeReadLimits): SourceTree {
+  return readTree(cwd, ".tfvars", limits);
+}
+
 /** How many oversize paths a gap names before it stops listing them. A gap is a
  *  sentence in a report, not a manifest; past a handful the count carries the
  *  fact and the list only buries it. */

package/src/mcp/terraform/types.ts

@@ -399,7 +399,8 @@ export interface ConcernGroup {
    * the file (by-file grouping) or the rule (by-rule grouping). */
   id: string;
   /** the branch its fix is pushed to: `remediate/<id>`, plus `--<base>` when the
-   * PR targets a branch other than the repository default. */
+   * PR targets a branch other than the repository default — or the head of the
+   * remediation PR already open for this group into the same base. */
   branch?: string;
   /** the group's primary file (by-file) or a human label like "3 files"
    * (by-rule); `files` carries the full list for by-rule groups. */

package/src/mcp/terraform/verifySites.ts

@@ -8,7 +8,8 @@
  * a fix that moves the defect onto a new resource would look resolved — so a
  * finding counts as resolved at its own site only when ALL of these hold:
  *
- *   - it was placed on a resource when it was reported;
+ *   - it was placed on a resource when it was reported, by a scan of the tree
+ *     as it then stood, and no later scan placed the same id elsewhere;
  *   - that resource is still declared in the file (a renamed or deleted one
  *     proves nothing);
  *   - the rule no longer fires on it;
@@ -48,16 +49,33 @@ export function siteOf(c: Concern, read: (file: string) => string | null): strin
   return text === null ? null : resourceAddressAt(text, c.location.line);
 }
 
-/** Remember where each reported concern sat, and the first sites per key. */
-export function recordConcernSites(session: ScanSession, concerns: Concern[], cwd: string): void {
+/**
+ * Remember where each reported concern sat, and the first sites per key.
+ *
+ * `linesMatchTree` says the concerns were scanned off the tree in `cwd` as it
+ * is now. Without it (a findings file or external report, which may describe
+ * another commit) their lines are not trusted to name today's resources: their
+ * ids get no site and their keys no first sites.
+ */
+export function recordConcernSites(
+  session: ScanSession,
+  concerns: Concern[],
+  cwd: string,
+  linesMatchTree: boolean,
+): void {
   const read = fileReader(cwd);
   session.siteById ??= new Map();
   session.firstSitesByKey ??= new Map();
   const first = session.firstSitesByKey;
   const fresh = new Map<string, Set<string | null>>();
   for (const c of concerns) {
-    const site = siteOf(c, read);
-    session.siteById.set(c.id, site);
+    const site = linesMatchTree ? siteOf(c, read) : null;
+    // an id is line-pinned, so after an edit a re-scan can report a different
+    // finding under it. It keeps the site it was first reported at; placed
+    // anywhere else later, it is ambiguous and gets none.
+    const prior = session.siteById.get(c.id);
+    session.siteById.set(c.id, prior === undefined || prior === site ? site : null);
+    if (!linesMatchTree) continue;
     const key = concernKeyOf(c);
     if (first.has(key)) continue;
     const sites = fresh.get(key) ?? new Set();

package/src/modes/refactor.ts

@@ -18,7 +18,7 @@ This mode standardises STRUCTURE while preserving BEHAVIOUR — the equivalence
    - \`${t("terraform_normalization_candidates")}\` → in-place idiomatic cleanups that change SYNTAX, not behaviour (redundant whole-string \`"\${expr}"\` interpolation; legacy HCL0.11 map-argument block syntax like \`vars {\` on a \`template_file\`). These relocate NOTHING — zero \`moved {}\` blocks — and are proven by the same equivalence check.
    - \`${t("terraform_consolidation_candidates")}\` → the SAME resource shape declared in several root directories (\`env/dev\` + \`env/staging\` + \`env/prod\`), with the single parameterised module they could all call already derived: which attributes are identical (module content) and which differ (per-environment inputs). A member root of a group will ALSO show up as a zero-candidate cluster in \`${t("module_extraction_candidates")}\` — prefer the consolidation, which does that work once for every environment instead of once per environment. Its \`near_groups\` are the opposite case: roots recognisably the same stack that DIFFER (one carries a resource the other does not), where folding them together is a design decision this mode has no basis for. Do NOT extract a near-group root's shared resources into a module on its own either — a module one twin calls and the other does not widens exactly the drift the near-group reports. Leave those roots alone and name the near-group and its \`differences\` in your report.
 
-   **A result marked \`report_only\` is an observation, not work.** The repository is a module other configurations call (\`report_only_reason\` says why), and restructuring it is churn for every caller: name those candidates in your \`${t("report_progress")}\` summary and open no PR for them. \`examples/\` roots are left out of every candidate list unless the operator set \`refactor_examples\`.
+   **A candidate marked \`report_only\` is an observation, not work.** It sits in the code of a module other configurations call (\`report_only_reason\` says why), and restructuring that is churn for every caller: name those candidates in your \`${t("report_progress")}\` summary and open no PR for them. \`examples/\` roots are left out of every candidate list unless the operator set \`refactor_examples\`.
 
    **Before picking, check the interface.** \`${t("module_extraction_candidates")}\` reports \`unmapped_attributes\` per candidate and a top-level \`partial_interfaces\` list: arguments the raw resources SET that the target module does not. Adopting such a module DROPS them silently — and the equivalence check cannot catch it, because once the argument is gone it is absent from both sides. Two of these are unrecoverable rather than merely wrong (\`object_lock_enabled\` cannot be set after creation; \`force_destroy\` changes deletion semantics). So: **decline the candidate, or extend the module to expose the argument and say so in the PR body.** Deleting the argument to make the shapes match is never the fix. A candidate whose \`unmapped_attributes\` is \`null\` was NOT checked — the module is external and its code is not in this repo — which is not the same as clean.
 

package/src/modes/remediate-and-refactor.ts

@@ -20,7 +20,7 @@ This mode composes the **Remediate** and **Refactor** verbs into a single run. I
    - **commit the fix** (\`git add\` only the changed \`*.tf\`/\`*.tfvars\`, a \`fix(tf): …\` message). Do NOT push yet. This committed state is the refactor's equivalence BASELINE.
 
 3. **REFACTOR (phase 2) — modularise on top of the committed fix**: follow the **Refactor** mode's flow:
-   - \`${t("module_extraction_candidates")}\` / \`${t("terraform_normalization_candidates")}\` → pick one behaviour-preserving refactor; a result marked \`report_only\` (the repository is a module others call) is named in the summary, never proposed. Respect a pinned \`refactor_source\` if one was supplied (it constrains which module source you may use; the behaviour-altering b.4 path is only available when the operator pinned \`third-party\`).
+   - \`${t("module_extraction_candidates")}\` / \`${t("terraform_normalization_candidates")}\` → pick one behaviour-preserving refactor; a candidate marked \`report_only\` (it sits in the code of a module others call) is named in the summary, never proposed. Respect a pinned \`refactor_source\` if one was supplied (it constrains which module source you may use; the behaviour-altering b.4 path is only available when the operator pinned \`third-party\`).
    - resolve the module source, wire the \`module\` call against its real interface (\`${t("terraform_module_interface")}\` for a local module dir, \`${t("terraform_module_lookup")}\` for a registry-sourced one), and emit a \`moved {}\` block for EVERY relocated address (\`${t("terraform_generate_moved")}\`).
    - \`terraform fmt\` + \`${t("terraform_validate")}\`, then — **with the refactor edits still UNCOMMITTED** — call \`${t("terraform_equivalence_check")}\`. In this mode it diffs the working tree against the COMMITTED fix (not the run-start commit), so it measures only the refactor. It must return \`equivalent: true\` (zero uncovered moves, resource set + arguments preserved, validate + fmt clean) before you proceed; \`${t("push_branch")}\` hard-blocks an unproven one — and, once this run has added a \`moved {}\` block, it also hard-blocks a push that never ran the check at all, so abandoning the refactor means REVERTING its edits rather than leaving them in with the fix. If it can't be proven equivalent, abandon the refactor and ship the fix alone.
    - **document the module (only when the \`docs\` input is enabled)**: after the equivalence check passes, call \`${t("terraform_module_docs")}\` for the module you created/adopted (pass the relocated addresses as \`moves\`). Do not hand-write docs — the tool builds from the interface, moved blocks, and equivalence verdict.

package/src/modes/remediate.ts

@@ -34,7 +34,7 @@ export function remediateMode(t: ToolRef): Mode {
 
 4. **for the chosen group**:
    - **base branch**: this run's base branch is resolved deterministically — \`${t("create_pull_request")}\` targets the \`base_branch\` input if set, else the branch the run started on, else the repository's default branch (\`main\`, or \`master\`). You do not choose it; just **omit** the \`base\` argument when opening the PR (below) and it is filled in.
-   - **idempotency**: the remediation branch is the group's \`branch\` (\`remediate/<group-id>\`, with a \`--<base>\` suffix when the PR targets a non-default branch) — use it exactly, never a name of your own. Before doing anything, check whether that branch or an open PR for it already exists (\`${t("git")}\` / \`${t("get_pull_request")}\`). If one exists, update it rather than opening a duplicate.
+   - **idempotency**: the remediation branch is the group's \`branch\` (\`remediate/<group-id>\`, with a \`--<base>\` suffix when the PR targets a non-default branch, or the branch of the PR already open for this group) — use it exactly, never a name of your own. Before doing anything, check whether that branch or an open PR for it already exists (\`${t("git")}\` / \`${t("get_pull_request")}\`). If one exists, update it rather than opening a duplicate.
    - **branch**: create the group's \`branch\` from the **current HEAD** (the checkout that was just scanned) via \`${t("git")}\` (\`git({ command: "checkout", args: ["-b", <branch>] })\`). Do NOT switch to a different base first — branching from the scanned checkout keeps the PR diff to exactly your fix.
    - **honest refusal (decide BEFORE fixing)**: if the group's concerns appear in the scan's \`refusal_candidates\` (the fix needs a human decision — narrowing an IAM wildcard, a KMS key policy, a real ingress CIDR), do **not** guess a fix that could break the stack. Instead open a structured issue (\`${t("create_issue")}\`) describing the concern, why it isn't auto-fixed, and what a human should do, and skip the PR for that group. A proven fix or an honest refusal — never a guessed, unverifiable PR.
    - **propose, then let me steer (when there's no single right fix)**: distinct from honest refusal (which refuses a fix a human must *decide*), this is for a finding with **2–3 genuinely distinct, defensible fixes** that differ in trade-offs, not correctness (e.g. encrypt with an AWS-managed key **vs** a customer-managed KMS key; a narrow security-group rule **vs** a prefix list **vs** a VPC endpoint). When such a fork exists **and the triggering comment did not already select a strategy**, do **not** silently pick for the reviewer: via \`${t("create_issue_comment")}\` post one short comment listing the options as **A / B / C** — each a single line (what it does + its trade-off) — and ask the reviewer to reply \`${COMMENT_COMMAND} fix #<concern-id> with strategy <A|B|C>\`. Then **skip the PR for this group** this run and note it in your final report (it resumes when the reviewer replies). When the comment **did** select one (\`fix #<id> with strategy B\`, or a bare \`strategy B\` reply on the proposal thread), apply **exactly** that strategy — don't second-guess it. Reserve this for real forks in the road; a fix with one obvious correct answer just gets made.

package/src/phases/runAgentWithWatchdogs.ts

@@ -105,10 +105,11 @@ export async function runAgentWithWatchdogs(params: RunAgentParams): Promise<Age
   const costQuota = reserved ? quotas.cost : createCostQuota(quotas.costLimit.full);
   log.info(
     quotas.tokenLimit.full > 0
-      ? `» run token quota: ${quotas.tokenLimit.full.toLocaleString("en-GB")} billable tokens` +
+      ? `» run token quota: ${quotas.tokenLimit.full.toLocaleString("en-GB")} tokens` +
           (reserved
             ? ` (${tokenQuota.limit.toLocaleString("en-GB")} for the run, the rest reserved to deliver findings if it runs out)`
-            : "")
+            : "") +
+          "; a token read from the prompt cache counts as a tenth"
       : `» run token quota: disabled (${RUN_TOKEN_QUOTA_INPUT}: 0)`,
   );
   log.info(