infraweaver 0.3.3 → 0.3.4

package/README.md

@@ -2,7 +2,7 @@
 
 [![License: AGPL v3](https://img.shields.io/badge/License-AGPL%20v3-blue.svg)](LICENSE)
 [![CI](https://github.com/infraweaver-io/infraweaver-action/actions/workflows/test.yml/badge.svg?branch=main)](https://github.com/infraweaver-io/infraweaver-action/actions/workflows/test.yml)
-[![Version](https://img.shields.io/badge/version-0.3.3)](package.json) <!-- x-release-please-version -->
+[![Version](https://img.shields.io/badge/version-0.3.4)](package.json) <!-- x-release-please-version -->
 
 **Infraweaver brings your Terraform up to best practice — automatically, as reviewable pull requests.**
 

package/dist/cli.mjs

@@ -136700,7 +136700,7 @@ import { existsSync as existsSync12, readdirSync as readdirSync6 } from "node:fs
 import { readFile as readFile5 } from "node:fs/promises";
 import { join as join52 } from "node:path";
 
-// node_modules/.pnpm/@infraweaver-io+ci@0.1.1/node_modules/@infraweaver-io/ci/dist/diffCoverage.js
+// node_modules/.pnpm/@infraweaver-io+ci@0.1.2/node_modules/@infraweaver-io/ci/dist/diffCoverage.js
 import { isAbsolute, normalize, resolve } from "node:path";
 function countLines(params) {
   const content = params.content;
@@ -136991,7 +136991,7 @@ function readNumber(params) {
   return void 0;
 }
 
-// node_modules/.pnpm/@infraweaver-io+ci@0.1.1/node_modules/@infraweaver-io/ci/dist/gitAuth.js
+// node_modules/.pnpm/@infraweaver-io+ci@0.1.2/node_modules/@infraweaver-io/ci/dist/gitAuth.js
 import { execSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { readFileSync, realpathSync, unlinkSync } from "node:fs";
@@ -137184,7 +137184,7 @@ function resolveEnv(mode) {
   return { ...filterEnv(), ...mode };
 }
 
-// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.1/node_modules/@infraweaver-io/sandbox/dist/shell.js
+// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.2/node_modules/@infraweaver-io/sandbox/dist/shell.js
 import { spawnSync } from "node:child_process";
 
 // node_modules/.pnpm/@infraweaver-io+core@0.1.0/node_modules/@infraweaver-io/core/dist/env.js
@@ -137658,7 +137658,7 @@ function getDevDependencyVersion(manifest, name) {
   return version3;
 }
 
-// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.1/node_modules/@infraweaver-io/sandbox/dist/shell.js
+// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.2/node_modules/@infraweaver-io/sandbox/dist/shell.js
 var DEFAULT_TIMEOUT_MS = 10 * 6e4;
 var DEFAULT_MAX_BUFFER = 64 * 1024 * 1024;
 function $(cmd, args2, options) {
@@ -137711,16 +137711,16 @@ function $(cmd, args2, options) {
   return stdout.trim();
 }
 
-// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.1/node_modules/@infraweaver-io/sandbox/dist/subprocess.js
+// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.2/node_modules/@infraweaver-io/sandbox/dist/subprocess.js
 import { spawn as nodeSpawn } from "node:child_process";
 import { performance as performance3 } from "node:perf_hooks";
 import { StringDecoder } from "node:string_decoder";
 
-// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.1/node_modules/@infraweaver-io/sandbox/dist/activity.js
+// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.2/node_modules/@infraweaver-io/sandbox/dist/activity.js
 var DEFAULT_ACTIVITY_TIMEOUT_MS = 3e5;
 var DEFAULT_ACTIVITY_CHECK_INTERVAL_MS = 5e3;
 
-// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.1/node_modules/@infraweaver-io/sandbox/dist/exitHandler.js
+// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.2/node_modules/@infraweaver-io/sandbox/dist/exitHandler.js
 import os5 from "node:os";
 var handlers = /* @__PURE__ */ new Set();
 var installed = false;
@@ -137746,7 +137746,7 @@ function exitWithSignal(signal) {
   process.exit(128 + os5.constants.signals[signal]);
 }
 
-// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.1/node_modules/@infraweaver-io/sandbox/dist/subprocess.js
+// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.2/node_modules/@infraweaver-io/sandbox/dist/subprocess.js
 var SPAWN_TIMEOUT_CODE = "E_SPAWN_TIMEOUT";
 var SPAWN_ACTIVITY_TIMEOUT_CODE = "E_SPAWN_ACTIVITY_TIMEOUT";
 var SpawnTimeoutError = class extends Error {
@@ -138032,7 +138032,7 @@ ${errMsg}` : errMsg;
   });
 }
 
-// node_modules/.pnpm/@infraweaver-io+ci@0.1.1/node_modules/@infraweaver-io/ci/dist/gitAuth.js
+// node_modules/.pnpm/@infraweaver-io+ci@0.1.2/node_modules/@infraweaver-io/ci/dist/gitAuth.js
 var gitBinary;
 function hashFile(path4) {
   return createHash("sha256").update(readFileSync(path4)).digest("hex");
@@ -138153,7 +138153,7 @@ async function $gitFetchWithDeepen(args2, options, label) {
   }
 }
 
-// node_modules/.pnpm/@infraweaver-io+ci@0.1.1/node_modules/@infraweaver-io/ci/dist/gitAuthServer.js
+// node_modules/.pnpm/@infraweaver-io+ci@0.1.2/node_modules/@infraweaver-io/ci/dist/gitAuthServer.js
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { writeFileSync } from "node:fs";
 import { createServer } from "node:http";
@@ -138264,7 +138264,7 @@ async function startGitAuthServer(tmpdir4, options) {
   };
 }
 
-// node_modules/.pnpm/@infraweaver-io+models@0.1.1/node_modules/@infraweaver-io/models/dist/costQuota.js
+// node_modules/.pnpm/@infraweaver-io+models@0.1.2/node_modules/@infraweaver-io/models/dist/costQuota.js
 var CostQuotaExceededError = class extends Error {
   code = "COST_QUOTA_EXCEEDED";
   constructor(message) {
@@ -138333,7 +138333,7 @@ function resolveRunCostQuota(parsed2) {
   return parsed2 === void 0 ? DEFAULT_RUN_COST_QUOTA_USD : parsed2;
 }
 
-// node_modules/.pnpm/@infraweaver-io+models@0.1.1/node_modules/@infraweaver-io/models/dist/tokenQuota.js
+// node_modules/.pnpm/@infraweaver-io+models@0.1.2/node_modules/@infraweaver-io/models/dist/tokenQuota.js
 var TokenQuotaExceededError = class extends Error {
   code = "TOKEN_QUOTA_EXCEEDED";
   constructor(message) {
@@ -138415,7 +138415,7 @@ import { join as join12 } from "node:path";
 import { performance as performance5 } from "node:perf_hooks";
 import { setTimeout as sleep3 } from "node:timers/promises";
 
-// node_modules/.pnpm/@infraweaver-io+models@0.1.1/node_modules/@infraweaver-io/models/dist/catalog.js
+// node_modules/.pnpm/@infraweaver-io+models@0.1.2/node_modules/@infraweaver-io/models/dist/catalog.js
 function provider(config3) {
   return config3;
 }
@@ -138957,7 +138957,7 @@ function isVertexAnthropicId(vertexModelId) {
   return /^claude-/i.test(vertexModelId.trim());
 }
 
-// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.1/node_modules/@infraweaver-io/sandbox/dist/nativeFsDenies.js
+// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.2/node_modules/@infraweaver-io/sandbox/dist/nativeFsDenies.js
 var GIT_NATIVE_WRITE_DENY_OPENCODE = {
   ".git": "deny",
   ".git/*": "deny",
@@ -139006,7 +139006,7 @@ function runnerHomeWriteDenyClaude(runnerHome) {
   return RUNNER_HOME_WRITE_TARGETS.flatMap((target) => CLAUDE_WRITE_TOOLS.map((tool2) => `${tool2}(${home}/${target})`));
 }
 
-// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.1/node_modules/@infraweaver-io/sandbox/dist/glob.js
+// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.2/node_modules/@infraweaver-io/sandbox/dist/glob.js
 function globToRegex(glob) {
   let re = "";
   for (let i = 0; i < glob.length; i++) {
@@ -139038,7 +139038,7 @@ function isPathAllowed(path4, globs) {
   return globs.some((g) => globToRegex(g).test(normalized));
 }
 
-// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.1/node_modules/@infraweaver-io/sandbox/dist/writeGateSource.js
+// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.2/node_modules/@infraweaver-io/sandbox/dist/writeGateSource.js
 var WRITE_GATE_HELPERS_SOURCE = `
 import { readFileSync, realpathSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
@@ -139323,7 +139323,7 @@ import { readFile as readFile2 } from "node:fs/promises";
 import { execFileSync } from "node:child_process";
 import { join as join3 } from "node:path";
 
-// node_modules/.pnpm/@infraweaver-io+models@0.1.1/node_modules/@infraweaver-io/models/dist/usage.js
+// node_modules/.pnpm/@infraweaver-io+models@0.1.2/node_modules/@infraweaver-io/models/dist/usage.js
 function formatCostUsd(costUsd) {
   return costUsd.toFixed(4);
 }
@@ -141645,7 +141645,7 @@ function formatWithLabel(label, message) {
   return message.split("\n").map((line) => `${colored}${line}`).join("\n");
 }
 
-// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.1/node_modules/@infraweaver-io/sandbox/dist/writePolicy.js
+// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.2/node_modules/@infraweaver-io/sandbox/dist/writePolicy.js
 import { renameSync, writeFileSync as writeFileSync2 } from "node:fs";
 import { join as join4 } from "node:path";
 function writePolicyPath(tmpdir4, filename) {
@@ -141672,7 +141672,7 @@ import { join as join7 } from "node:path";
 import { existsSync as existsSync4, readdirSync, readFileSync as readFileSync2, statSync } from "node:fs";
 import { join as join6 } from "node:path";
 
-// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.1/node_modules/@infraweaver-io/sandbox/dist/pathSafety.js
+// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.2/node_modules/@infraweaver-io/sandbox/dist/pathSafety.js
 import { realpathSync as realpathSync2 } from "node:fs";
 import { basename, dirname, isAbsolute as isAbsolute2, join as join5, relative, resolve as resolve2 } from "node:path";
 function realpathDeepest(target) {
@@ -151254,7 +151254,7 @@ function moduleDirExists(cwd, dir) {
   }
 }
 
-// node_modules/.pnpm/@infraweaver-io+ci@0.1.1/node_modules/@infraweaver-io/ci/dist/progressComment.js
+// node_modules/.pnpm/@infraweaver-io+ci@0.1.2/node_modules/@infraweaver-io/ci/dist/progressComment.js
 function parseProgressComment(raw2) {
   if (!raw2?.id)
     return void 0;
@@ -155792,7 +155792,7 @@ function resolveTerraformMcp(payload) {
 // package.json
 var package_default = {
   name: "infraweaver",
-  version: "0.3.3",
+  version: "0.3.4",
   description: "GitHub Action that remediates Terraform to best practices and opens one scoped pull request per concern.",
   keywords: [
     "ai-coding-agent",
@@ -155883,10 +155883,10 @@ var package_default = {
     "@anthropic-ai/claude-code": "2.1.235",
     "@biomejs/biome": "2.5.9",
     "@infraweaver-io/attest": "^0.1.1",
-    "@infraweaver-io/ci": "^0.1.1",
+    "@infraweaver-io/ci": "^0.1.2",
     "@infraweaver-io/core": "^0.1.0",
-    "@infraweaver-io/models": "^0.1.1",
-    "@infraweaver-io/sandbox": "^0.1.1",
+    "@infraweaver-io/models": "^0.1.2",
+    "@infraweaver-io/sandbox": "^0.1.2",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "@octokit/plugin-throttling": "^11.0.5",
     "@octokit/rest": "^22.0.1",
@@ -199663,7 +199663,9 @@ function run(cmd, args2, cwd, extraEnv) {
     // plugin) can't exfiltrate credentials. `extraEnv` re-admits only the named vars.
     env: resolveEnv(extraEnv ?? "restricted"),
     stdio: ["ignore", "pipe", "pipe"],
-    maxBuffer: 64 * 1024 * 1024,
+    // one shared definition of the output cap: big `terraform show -json` /
+    // scanner SARIF output far exceeds node's 1 MiB spawnSync default.
+    maxBuffer: DEFAULT_MAX_BUFFER,
     timeout: SUBPROCESS_TIMEOUT_MS
   });
   if (result.error) {
@@ -205367,7 +205369,7 @@ function createChangeImpactArtifact(params) {
   };
 }
 
-// node_modules/.pnpm/@infraweaver-io+ci@0.1.1/node_modules/@infraweaver-io/ci/dist/rangeDiff.js
+// node_modules/.pnpm/@infraweaver-io+ci@0.1.2/node_modules/@infraweaver-io/ci/dist/rangeDiff.js
 function computeIncrementalDiff(params) {
   const exec = params.exec ?? $;
   try {
@@ -224206,7 +224208,7 @@ function buildLocalTools(ctx) {
   ];
 }
 function cliVersion() {
-  const raw2 = "0.3.3";
+  const raw2 = "0.3.4";
   if (raw2 !== void 0 && /^\d+\.\d+\.\d+$/.test(raw2)) {
     return raw2;
   }
@@ -224399,7 +224401,7 @@ async function runVerifyEvidenceCli2(params) {
 }
 
 // src/cli.ts
-var VERSION10 = "0.3.3";
+var VERSION10 = "0.3.4";
 var bin = basename5(process.argv[1] || "");
 var PROG = bin === "pf" || bin === PRODUCT_SLUG ? bin : PRODUCT_SLUG;
 var rawArgs = process.argv.slice(2);

package/dist/index.js

@@ -135084,7 +135084,7 @@ import { existsSync as existsSync12, readdirSync as readdirSync6 } from "node:fs
 import { readFile as readFile5 } from "node:fs/promises";
 import { join as join52 } from "node:path";
 
-// node_modules/.pnpm/@infraweaver-io+ci@0.1.1/node_modules/@infraweaver-io/ci/dist/diffCoverage.js
+// node_modules/.pnpm/@infraweaver-io+ci@0.1.2/node_modules/@infraweaver-io/ci/dist/diffCoverage.js
 import { isAbsolute, normalize, resolve } from "node:path";
 function countLines(params) {
   const content = params.content;
@@ -135375,7 +135375,7 @@ function readNumber(params) {
   return void 0;
 }
 
-// node_modules/.pnpm/@infraweaver-io+ci@0.1.1/node_modules/@infraweaver-io/ci/dist/gitAuth.js
+// node_modules/.pnpm/@infraweaver-io+ci@0.1.2/node_modules/@infraweaver-io/ci/dist/gitAuth.js
 import { execSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { readFileSync, realpathSync, unlinkSync } from "node:fs";
@@ -135568,7 +135568,7 @@ function resolveEnv(mode) {
   return { ...filterEnv(), ...mode };
 }
 
-// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.1/node_modules/@infraweaver-io/sandbox/dist/shell.js
+// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.2/node_modules/@infraweaver-io/sandbox/dist/shell.js
 import { spawnSync } from "node:child_process";
 
 // node_modules/.pnpm/@infraweaver-io+core@0.1.0/node_modules/@infraweaver-io/core/dist/env.js
@@ -136042,7 +136042,7 @@ function getDevDependencyVersion(manifest, name) {
   return version3;
 }
 
-// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.1/node_modules/@infraweaver-io/sandbox/dist/shell.js
+// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.2/node_modules/@infraweaver-io/sandbox/dist/shell.js
 var DEFAULT_TIMEOUT_MS = 10 * 6e4;
 var DEFAULT_MAX_BUFFER = 64 * 1024 * 1024;
 function $(cmd, args2, options) {
@@ -136095,16 +136095,16 @@ function $(cmd, args2, options) {
   return stdout.trim();
 }
 
-// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.1/node_modules/@infraweaver-io/sandbox/dist/subprocess.js
+// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.2/node_modules/@infraweaver-io/sandbox/dist/subprocess.js
 import { spawn as nodeSpawn } from "node:child_process";
 import { performance as performance3 } from "node:perf_hooks";
 import { StringDecoder } from "node:string_decoder";
 
-// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.1/node_modules/@infraweaver-io/sandbox/dist/activity.js
+// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.2/node_modules/@infraweaver-io/sandbox/dist/activity.js
 var DEFAULT_ACTIVITY_TIMEOUT_MS = 3e5;
 var DEFAULT_ACTIVITY_CHECK_INTERVAL_MS = 5e3;
 
-// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.1/node_modules/@infraweaver-io/sandbox/dist/exitHandler.js
+// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.2/node_modules/@infraweaver-io/sandbox/dist/exitHandler.js
 import os from "node:os";
 var handlers = /* @__PURE__ */ new Set();
 var installed = false;
@@ -136130,7 +136130,7 @@ function exitWithSignal(signal) {
   process.exit(128 + os.constants.signals[signal]);
 }
 
-// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.1/node_modules/@infraweaver-io/sandbox/dist/subprocess.js
+// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.2/node_modules/@infraweaver-io/sandbox/dist/subprocess.js
 var SPAWN_TIMEOUT_CODE = "E_SPAWN_TIMEOUT";
 var SPAWN_ACTIVITY_TIMEOUT_CODE = "E_SPAWN_ACTIVITY_TIMEOUT";
 var SpawnTimeoutError = class extends Error {
@@ -136416,7 +136416,7 @@ ${errMsg}` : errMsg;
   });
 }
 
-// node_modules/.pnpm/@infraweaver-io+ci@0.1.1/node_modules/@infraweaver-io/ci/dist/gitAuth.js
+// node_modules/.pnpm/@infraweaver-io+ci@0.1.2/node_modules/@infraweaver-io/ci/dist/gitAuth.js
 var gitBinary;
 function hashFile(path4) {
   return createHash("sha256").update(readFileSync(path4)).digest("hex");
@@ -136537,7 +136537,7 @@ async function $gitFetchWithDeepen(args2, options, label) {
   }
 }
 
-// node_modules/.pnpm/@infraweaver-io+ci@0.1.1/node_modules/@infraweaver-io/ci/dist/gitAuthServer.js
+// node_modules/.pnpm/@infraweaver-io+ci@0.1.2/node_modules/@infraweaver-io/ci/dist/gitAuthServer.js
 import { randomUUID } from "node:crypto";
 import { writeFileSync } from "node:fs";
 import { createServer } from "node:http";
@@ -136648,7 +136648,7 @@ async function startGitAuthServer(tmpdir3, options) {
   };
 }
 
-// node_modules/.pnpm/@infraweaver-io+models@0.1.1/node_modules/@infraweaver-io/models/dist/costQuota.js
+// node_modules/.pnpm/@infraweaver-io+models@0.1.2/node_modules/@infraweaver-io/models/dist/costQuota.js
 var CostQuotaExceededError = class extends Error {
   code = "COST_QUOTA_EXCEEDED";
   constructor(message) {
@@ -136717,7 +136717,7 @@ function resolveRunCostQuota(parsed2) {
   return parsed2 === void 0 ? DEFAULT_RUN_COST_QUOTA_USD : parsed2;
 }
 
-// node_modules/.pnpm/@infraweaver-io+models@0.1.1/node_modules/@infraweaver-io/models/dist/tokenQuota.js
+// node_modules/.pnpm/@infraweaver-io+models@0.1.2/node_modules/@infraweaver-io/models/dist/tokenQuota.js
 var TokenQuotaExceededError = class extends Error {
   code = "TOKEN_QUOTA_EXCEEDED";
   constructor(message) {
@@ -136799,7 +136799,7 @@ import { join as join12 } from "node:path";
 import { performance as performance5 } from "node:perf_hooks";
 import { setTimeout as sleep3 } from "node:timers/promises";
 
-// node_modules/.pnpm/@infraweaver-io+models@0.1.1/node_modules/@infraweaver-io/models/dist/catalog.js
+// node_modules/.pnpm/@infraweaver-io+models@0.1.2/node_modules/@infraweaver-io/models/dist/catalog.js
 function provider(config3) {
   return config3;
 }
@@ -137341,7 +137341,7 @@ function isVertexAnthropicId(vertexModelId) {
   return /^claude-/i.test(vertexModelId.trim());
 }
 
-// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.1/node_modules/@infraweaver-io/sandbox/dist/nativeFsDenies.js
+// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.2/node_modules/@infraweaver-io/sandbox/dist/nativeFsDenies.js
 var GIT_NATIVE_WRITE_DENY_OPENCODE = {
   ".git": "deny",
   ".git/*": "deny",
@@ -137390,7 +137390,7 @@ function runnerHomeWriteDenyClaude(runnerHome) {
   return RUNNER_HOME_WRITE_TARGETS.flatMap((target) => CLAUDE_WRITE_TOOLS.map((tool2) => `${tool2}(${home}/${target})`));
 }
 
-// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.1/node_modules/@infraweaver-io/sandbox/dist/glob.js
+// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.2/node_modules/@infraweaver-io/sandbox/dist/glob.js
 function globToRegex(glob) {
   let re = "";
   for (let i = 0; i < glob.length; i++) {
@@ -137422,7 +137422,7 @@ function isPathAllowed(path4, globs) {
   return globs.some((g) => globToRegex(g).test(normalized));
 }
 
-// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.1/node_modules/@infraweaver-io/sandbox/dist/writeGateSource.js
+// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.2/node_modules/@infraweaver-io/sandbox/dist/writeGateSource.js
 var WRITE_GATE_HELPERS_SOURCE = `
 import { readFileSync, realpathSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
@@ -137748,7 +137748,7 @@ import { readFile as readFile2 } from "node:fs/promises";
 import { execFileSync } from "node:child_process";
 import { join as join3 } from "node:path";
 
-// node_modules/.pnpm/@infraweaver-io+models@0.1.1/node_modules/@infraweaver-io/models/dist/usage.js
+// node_modules/.pnpm/@infraweaver-io+models@0.1.2/node_modules/@infraweaver-io/models/dist/usage.js
 function formatCostUsd(costUsd) {
   return costUsd.toFixed(4);
 }
@@ -141409,7 +141409,7 @@ function formatWithLabel(label, message) {
   return message.split("\n").map((line) => `${colored}${line}`).join("\n");
 }
 
-// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.1/node_modules/@infraweaver-io/sandbox/dist/writePolicy.js
+// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.2/node_modules/@infraweaver-io/sandbox/dist/writePolicy.js
 import { renameSync, writeFileSync as writeFileSync2 } from "node:fs";
 import { join as join4 } from "node:path";
 function writePolicyPath(tmpdir3, filename) {
@@ -141436,7 +141436,7 @@ import { join as join7 } from "node:path";
 import { existsSync as existsSync4, readdirSync, readFileSync as readFileSync2, statSync } from "node:fs";
 import { join as join6 } from "node:path";
 
-// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.1/node_modules/@infraweaver-io/sandbox/dist/pathSafety.js
+// node_modules/.pnpm/@infraweaver-io+sandbox@0.1.2/node_modules/@infraweaver-io/sandbox/dist/pathSafety.js
 import { realpathSync as realpathSync2 } from "node:fs";
 import { basename, dirname, isAbsolute as isAbsolute2, join as join5, relative, resolve as resolve2 } from "node:path";
 function realpathDeepest(target) {
@@ -151018,7 +151018,7 @@ function moduleDirExists(cwd, dir) {
   }
 }
 
-// node_modules/.pnpm/@infraweaver-io+ci@0.1.1/node_modules/@infraweaver-io/ci/dist/progressComment.js
+// node_modules/.pnpm/@infraweaver-io+ci@0.1.2/node_modules/@infraweaver-io/ci/dist/progressComment.js
 function parseProgressComment(raw2) {
   if (!raw2?.id)
     return void 0;
@@ -155556,7 +155556,7 @@ function resolveTerraformMcp(payload) {
 // package.json
 var package_default = {
   name: "infraweaver",
-  version: "0.3.3",
+  version: "0.3.4",
   description: "GitHub Action that remediates Terraform to best practices and opens one scoped pull request per concern.",
   keywords: [
     "ai-coding-agent",
@@ -155647,10 +155647,10 @@ var package_default = {
     "@anthropic-ai/claude-code": "2.1.235",
     "@biomejs/biome": "2.5.9",
     "@infraweaver-io/attest": "^0.1.1",
-    "@infraweaver-io/ci": "^0.1.1",
+    "@infraweaver-io/ci": "^0.1.2",
     "@infraweaver-io/core": "^0.1.0",
-    "@infraweaver-io/models": "^0.1.1",
-    "@infraweaver-io/sandbox": "^0.1.1",
+    "@infraweaver-io/models": "^0.1.2",
+    "@infraweaver-io/sandbox": "^0.1.2",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "@octokit/plugin-throttling": "^11.0.5",
     "@octokit/rest": "^22.0.1",
@@ -199427,7 +199427,9 @@ function run(cmd, args2, cwd, extraEnv) {
     // plugin) can't exfiltrate credentials. `extraEnv` re-admits only the named vars.
     env: resolveEnv(extraEnv ?? "restricted"),
     stdio: ["ignore", "pipe", "pipe"],
-    maxBuffer: 64 * 1024 * 1024,
+    // one shared definition of the output cap: big `terraform show -json` /
+    // scanner SARIF output far exceeds node's 1 MiB spawnSync default.
+    maxBuffer: DEFAULT_MAX_BUFFER,
     timeout: SUBPROCESS_TIMEOUT_MS
   });
   if (result.error) {
@@ -205131,7 +205133,7 @@ function createChangeImpactArtifact(params) {
   };
 }
 
-// node_modules/.pnpm/@infraweaver-io+ci@0.1.1/node_modules/@infraweaver-io/ci/dist/rangeDiff.js
+// node_modules/.pnpm/@infraweaver-io+ci@0.1.2/node_modules/@infraweaver-io/ci/dist/rangeDiff.js
 function computeIncrementalDiff(params) {
   const exec = params.exec ?? $;
   try {

package/dist/internal.js

@@ -1,6 +1,6 @@
 import { createRequire as __createRequire } from 'module'; import { fileURLToPath as __fileURLToPath } from 'url'; import { dirname as __dirnameFn } from 'path'; const require = __createRequire(import.meta.url); const __filename = __fileURLToPath(import.meta.url); const __dirname = __dirnameFn(__filename);
 
-// node_modules/.pnpm/@infraweaver-io+ci@0.1.1/node_modules/@infraweaver-io/ci/dist/progressComment.js
+// node_modules/.pnpm/@infraweaver-io+ci@0.1.2/node_modules/@infraweaver-io/ci/dist/progressComment.js
 async function getProgressComment(ctx, comment) {
   const result = await (comment.type === "review" ? ctx.octokit.rest.pulls.getReviewComment({
     owner: ctx.owner,
@@ -110,7 +110,7 @@ function isValidTimeString(input) {
   return parseTimeString(input) !== null;
 }
 
-// node_modules/.pnpm/@infraweaver-io+models@0.1.1/node_modules/@infraweaver-io/models/dist/catalog.js
+// node_modules/.pnpm/@infraweaver-io+models@0.1.2/node_modules/@infraweaver-io/models/dist/catalog.js
 function provider(config) {
   return config;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "infraweaver",
-  "version": "0.3.3",
+  "version": "0.3.4",
   "description": "GitHub Action that remediates Terraform to best practices and opens one scoped pull request per concern.",
   "keywords": [
     "ai-coding-agent",
@@ -91,10 +91,10 @@
     "@anthropic-ai/claude-code": "2.1.235",
     "@biomejs/biome": "2.5.9",
     "@infraweaver-io/attest": "^0.1.1",
-    "@infraweaver-io/ci": "^0.1.1",
+    "@infraweaver-io/ci": "^0.1.2",
     "@infraweaver-io/core": "^0.1.0",
-    "@infraweaver-io/models": "^0.1.1",
-    "@infraweaver-io/sandbox": "^0.1.1",
+    "@infraweaver-io/models": "^0.1.2",
+    "@infraweaver-io/sandbox": "^0.1.2",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "@octokit/plugin-throttling": "^11.0.5",
     "@octokit/rest": "^22.0.1",

package/src/mcp/terraform/subprocess.ts

@@ -1,5 +1,6 @@
 import { spawnSync } from "node:child_process";
 import { resolveEnv } from "@infraweaver-io/core/secrets";
+import { DEFAULT_MAX_BUFFER } from "@infraweaver-io/sandbox/shell";
 import { log } from "#app/utils/cli";
 
 export type RunResult = { status: number; stdout: string; stderr: string; missing: boolean };
@@ -38,7 +39,9 @@ export function run(
     // plugin) can't exfiltrate credentials. `extraEnv` re-admits only the named vars.
     env: resolveEnv(extraEnv ?? "restricted") as NodeJS.ProcessEnv,
     stdio: ["ignore", "pipe", "pipe"],
-    maxBuffer: 64 * 1024 * 1024,
+    // one shared definition of the output cap: big `terraform show -json` /
+    // scanner SARIF output far exceeds node's 1 MiB spawnSync default.
+    maxBuffer: DEFAULT_MAX_BUFFER,
     timeout: SUBPROCESS_TIMEOUT_MS,
   });
   if (result.error) {