infraweaver 0.3.7 → 0.3.8

package/src/mcp/guardrails.ts

@@ -1,6 +1,7 @@
 import { spawnSync } from "node:child_process";
 import { readFileSync, rmSync } from "node:fs";
 import { join } from "node:path";
+import { errorMessage } from "@infraweaver-io/core/errors";
 import { resolveEnv } from "@infraweaver-io/core/secrets";
 import { globToRegex, isPathAllowed } from "@infraweaver-io/sandbox/glob";
 import { $ } from "@infraweaver-io/sandbox/shell";
@@ -12,19 +13,25 @@ import {
   findDialectMarkers,
   foreignDialectIntroductions,
 } from "#app/mcp/terraform/dialect";
+import { isUnchangedEmittedArtefact } from "#app/mcp/terraform/emittedArtefacts";
 import { addressKey, stripIndices } from "#app/mcp/terraform/refactor/addresses";
 import { type MovedBlock, parseMovedBlocks } from "#app/mcp/terraform/refactor/movedBlocks";
 import { parseResourcesWithArgs } from "#app/mcp/terraform/refactor/resources";
 import { readWorkingTree, workingTreeFingerprint } from "#app/mcp/terraform/refactor/workspace";
 import { scanSessionOf } from "#app/mcp/terraform/scanSession";
 import type { SourceFile } from "#app/mcp/terraform/tree";
-import { describeAfter, guardVersionConstraints } from "#app/mcp/terraform/versionGuard";
+import {
+  type ConstraintChange,
+  describeAfter,
+  guardVersionConstraints,
+} from "#app/mcp/terraform/versionGuard";
 import type { ToolState } from "#app/toolState";
 import { log } from "#app/utils/cli";
 import type { RunContextData } from "#app/utils/cloud/runContextData";
 import type { ResolvedPayload } from "#app/utils/config/payload";
 import type { OctokitWithPlugins } from "#app/utils/github/github";
 import { resolveToolSelection } from "#app/utils/prompt/toolSelection";
+import { parseDiffLines } from "#app/utils/unifiedDiff";
 
 /**
  * The narrow context the push-time guardrails read: the payload (allow-lists,
@@ -265,6 +272,29 @@ export function changedFilesSinceRunStart(ctx: GuardrailContext): string[] {
   return files;
 }
 
+/**
+ * A compliance artefact an emit tool wrote this run, committed with the bytes it
+ * wrote — the one non-Terraform file a guarded push carries (see
+ * emittedArtefacts.ts). Asks git only when some artefact was emitted.
+ */
+function isCommittedAsEmitted(ctx: GuardrailContext, file: string): boolean {
+  if (!scanSessionOf(ctx.toolState).emittedArtefacts) return false;
+  let top: string;
+  let blob: string | null;
+  try {
+    top = $("git", ["rev-parse", "--show-toplevel"], { log: false });
+  } catch {
+    return false;
+  }
+  try {
+    blob = $("git", ["rev-parse", `HEAD:${file}`], { log: false });
+  } catch {
+    // deleted at HEAD: nothing an emit tool wrote
+    blob = null;
+  }
+  return isUnchangedEmittedArtefact(ctx.toolState, top, file, blob);
+}
+
 /**
  * Enforce the path allow-list before a Remediate-mode push. Throws if the
  * branch changed any file outside the allowed globs — the choke point is
@@ -285,7 +315,14 @@ export function enforceRemediationPaths(ctx: GuardrailContext): void {
 
   const allowed = resolveAllowedPaths(ctx);
   const changed = changedFilesSinceRunStart(ctx);
-  const violations = changed.filter((f) => !isPathAllowed(f, allowed));
+  const outside = changed.filter((f) => !isPathAllowed(f, allowed));
+  const emitted = outside.filter((f) => isCommittedAsEmitted(ctx, f));
+  const violations = outside.filter((f) => !emitted.includes(f));
+  if (emitted.length > 0) {
+    log.info(
+      `» Terraform-only path guardrail: ${emitted.join(", ")} committed as emitted this run`,
+    );
+  }
   if (violations.length > 0) {
     throw new Error(
       `push blocked (Terraform-only guardrail): this run changed files outside the allowed paths [${allowed.join(", ")}]. ` +
@@ -294,7 +331,8 @@ export function enforceRemediationPaths(ctx: GuardrailContext): void {
     );
   }
   log.info(
-    `» Terraform-only path guardrail ok (${changed.length} file(s), all within [${allowed.join(", ")}])`,
+    `» Terraform-only path guardrail ok (${changed.length - emitted.length} file(s) within [${allowed.join(", ")}]` +
+      (emitted.length > 0 ? `, ${emitted.length} emitted artefact(s))` : ")"),
   );
 }
 
@@ -425,39 +463,23 @@ const SENSITIVE_ASSIGNMENT =
 export function scanDiffForSecrets(diff: string): SecretHit[] {
   const hits: SecretHit[] = [];
   let file = "(unknown)";
-  let newLine = 0;
-  for (const raw of diff.split("\n")) {
-    if (raw.startsWith("+++ ")) {
-      const path = raw.slice(4).trim().replace(/^b\//, "");
-      file = path === "/dev/null" ? "(deleted)" : path;
+  for (const line of parseDiffLines(diff)) {
+    if (line.kind === "file") {
+      file = line.path === "/dev/null" ? "(deleted)" : line.path;
       continue;
     }
-    if (raw.startsWith("--- ") || raw.startsWith("diff --git") || raw.startsWith("index "))
-      continue;
-    const hunk = raw.match(/^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/);
-    if (hunk) {
-      newLine = Number(hunk[1]);
-      continue;
+    if (line.kind !== "add") continue;
+    const content = line.text;
+    for (const [rule, re] of SECRET_VALUE_PATTERNS) {
+      if (re.test(content)) hits.push({ file, line: line.newLine, rule });
     }
-    if (raw.startsWith("+")) {
-      const content = raw.slice(1);
-      for (const [rule, re] of SECRET_VALUE_PATTERNS) {
-        if (re.test(content)) hits.push({ file, line: newLine, rule });
-      }
-      // only a real inlined literal trips it: skip empty strings and any value
-      // carrying a `${...}` interpolation — including one with literal text before
-      // the interpolation (e.g. `connection_string = "postgres://u:${var.pw}@h"`),
-      // which the prior first-char-only exclusion wrongly flagged and dead-ended.
-      const secretValue = content.match(SENSITIVE_ASSIGNMENT)?.[1];
-      if (secretValue && !secretValue.includes("${")) {
-        hits.push({ file, line: newLine, rule: "hardcoded-secret-assignment" });
-      }
-      newLine++;
-    } else if (raw.startsWith("-")) {
-      // removed line — does not advance the new-side counter
-    } else {
-      // context line (leading space) or blank — advances the new-side counter
-      newLine++;
+    // only a real inlined literal trips it: skip empty strings and any value
+    // carrying a `${...}` interpolation — including one with literal text before
+    // the interpolation (e.g. `connection_string = "postgres://u:${var.pw}@h"`),
+    // which the prior first-char-only exclusion wrongly flagged and dead-ended.
+    const secretValue = content.match(SENSITIVE_ASSIGNMENT)?.[1];
+    if (secretValue && !secretValue.includes("${")) {
+      hits.push({ file, line: line.newLine, rule: "hardcoded-secret-assignment" });
     }
   }
   return hits;
@@ -796,7 +818,11 @@ export function assertNoUnreviewedMajorBump(ctx: GuardrailContext): void {
   }
 
   const allow = ctx.payload.allowMajorUpgrade ?? [];
-  const blocked = verdict.crossing.filter((c) => !isReplaceAllowed(c.name, allow));
+  // an operator names a dependency by what it IS — `terraform-aws-modules/s3-bucket/aws`,
+  // `hashicorp/aws` — as readily as by the call or local name this repo gives it
+  const allowed = (c: ConstraintChange) =>
+    isReplaceAllowed(c.name, allow) || (c.source !== null && isReplaceAllowed(c.source, allow));
+  const blocked = verdict.crossing.filter((c) => !allowed(c));
   if (blocked.length === 0) {
     if (verdict.crossing.length > 0) {
       log.info(
@@ -810,8 +836,13 @@ export function assertNoUnreviewedMajorBump(ctx: GuardrailContext): void {
       `ACROSS A MAJOR. A provider/module major renames arguments and removes blocks, so the upgrade needs a ` +
       `human to review the interface change — it is real work, but it is not autonomous work. Either revert ` +
       `the constraint to its original major, or, if the upgrade is genuinely intended, set the ` +
-      `\`allow_major_upgrade\` input to include the name(s):\n` +
-      blocked.map((c) => `  - ${c.kind} ${c.name}: '${c.before}' → '${c.after}'`).join("\n"),
+      `\`allow_major_upgrade\` input to include the name or source:\n` +
+      blocked
+        .map(
+          (c) =>
+            `  - ${c.kind} ${c.name}${c.source ? ` (${c.source})` : ""}: '${c.before}' → '${c.after}'`,
+        )
+        .join("\n"),
   );
 }
 
@@ -1331,6 +1362,33 @@ export function assertUnderPrCap(ctx: GuardrailContext): void {
   }
 }
 
+/**
+ * Refuse a guarded-mode PR whose head is not a commit this run pushed.
+ *
+ * Every content guardrail — the path allow-list, the secret scan, the rename
+ * and equivalence gates — runs in `push_branch`, so a PR is only as safe as the
+ * push behind it. A head this run never pushed went through none of them: a
+ * branch another run (or a person) left on the remote, adopted after this
+ * run's own push was rejected, opens a PR whose content nothing here checked,
+ * under a body describing work it does not contain.
+ */
+export function assertHeadPushedThisRun(
+  ctx: GuardrailContext,
+  branch: string,
+  headSha: string,
+): void {
+  if (!isGuardedMode(ctx)) return;
+  const pushed = ctx.toolState.pushedHeads?.get(branch);
+  if (pushed === headSha) return;
+  throw new Error(
+    `PR blocked (pushed-head guardrail): '${branch}' at ${headSha.slice(0, 12)} is not a commit this run pushed ` +
+      (pushed
+        ? `(it pushed ${pushed.slice(0, 12)} there) — commit and push_branch what you want proposed first.`
+        : "— a PR may only present a commit that went through push_branch, where every guardrail runs. " +
+          "If that branch belongs to another change, do not reuse it: put this run's change on a NEW branch name and push that."),
+  );
+}
+
 /** record that a guarded-mode PR was opened (after create_pull_request succeeds). */
 export function recordRemediationPrOpened(ctx: GuardrailContext): void {
   if (!isGuardedMode(ctx)) return;
@@ -1412,3 +1470,97 @@ export async function assertUnderOpenPrCaps(ctx: OpenPrCapContext): Promise<void
     }
   }
 }
+
+/** the head branches this engine opens its own PRs from. */
+const ENGINE_PR_BRANCH = /^(?:remediate\/|remediate-refactor\/|infraweaver\/)/;
+
+/** the modes that cut a fresh branch, and so a fresh PR, for each change.
+ *  Remediate is not one: its branch is named by the concern group, so a re-run
+ *  for the same group updates the same PR. */
+const BRANCH_PER_CHANGE_MODES: ReadonlySet<string> = new Set([
+  REFACTOR_MODE,
+  REMEDIATE_AND_REFACTOR_MODE,
+  UPDATE_DEPENDENCIES_MODE,
+  MODERNIZE_DEPRECATED_MODE,
+  COST_OPTIMIZATION_MODE,
+]);
+
+/** whether a mode names a fresh branch for every change, so that a remote
+ *  branch of the same name which this run did not push is another change. */
+export function isBranchPerChangeMode(mode: string | undefined): boolean {
+  return mode !== undefined && BRANCH_PER_CHANGE_MODES.has(mode);
+}
+
+/** how many open PRs a new one is compared with — bounds the API calls. */
+const MAX_OPEN_PRS_COMPARED = 30;
+
+/**
+ * Refuse to open a PR for a change to files an open PR of this engine already
+ * changes against the same base.
+ *
+ * Checked when the PR is opened, because that is where a duplicate comes into
+ * being and where the GitHub API is reachable — the push tools deliberately
+ * shell out without it. The pushed branch is left for the agent to delete.
+ *
+ * Every run of a branch-per-change mode names its own branch, so nothing else
+ * notices that a scheduled run is re-proposing what last week's run proposed
+ * and nobody has reviewed yet: each run opened another PR over the same code,
+ * duplicating the review and conflicting with the first on merge. Overlapping
+ * FILES is the test rather than an identical diff: two open PRs editing one
+ * file from one base conflict whatever they say, and a run that finds its
+ * files taken can still pick work elsewhere.
+ *
+ * Fails open on an API error — this guards review noise, not infrastructure,
+ * and a GitHub hiccup must not throw away a proven change.
+ */
+export async function assertNotAlreadyProposed(
+  ctx: OpenPrCapContext,
+  opts: { branch: string; base: string; changed: readonly string[] },
+): Promise<void> {
+  if (!isBranchPerChangeMode(ctx.toolState.selectedMode)) return;
+  const changed = new Set(opts.changed);
+  if (changed.size === 0) return;
+  const owner = ctx.repo.owner;
+  const repo = ctx.repo.name;
+  try {
+    const open = await ctx.octokit.paginate(ctx.octokit.rest.pulls.list, {
+      owner,
+      repo,
+      state: "open",
+      base: opts.base,
+      per_page: 100,
+    });
+    const engine = open.filter(
+      (pr) => ENGINE_PR_BRANCH.test(pr.head.ref) && pr.head.ref !== opts.branch,
+    );
+    if (engine.length > MAX_OPEN_PRS_COMPARED) {
+      log.warning(
+        `open PR guardrail: ${engine.length} open ${PRODUCT_NAME} PRs against \`${opts.base}\`; ` +
+          `only the newest ${MAX_OPEN_PRS_COMPARED} are compared for overlapping files`,
+      );
+    }
+    const ours = engine.slice(0, MAX_OPEN_PRS_COMPARED);
+    for (const pr of ours) {
+      const files = await ctx.octokit.paginate(ctx.octokit.rest.pulls.listFiles, {
+        owner,
+        repo,
+        pull_number: pr.number,
+        per_page: 100,
+      });
+      const shared = files.map((f) => f.filename).filter((f) => changed.has(f));
+      if (shared.length === 0) continue;
+      throw new OpenPrOverlapError(
+        `PR blocked (open PR guardrail): #${pr.number} (\`${pr.head.ref}\`) is already open against ` +
+          `\`${opts.base}\` and changes ${shared.join(", ")}. A second PR over the same code duplicates ` +
+          `that review and conflicts with it on merge. Do not retry under another branch name: delete the ` +
+          `branch you pushed (\`delete_branch\`), stop, and report that #${pr.number} is waiting for ` +
+          "review — a run after it is merged or closed picks the work up again.",
+      );
+    }
+  } catch (err) {
+    if (err instanceof OpenPrOverlapError) throw err;
+    log.warning(`» open PR guardrail skipped — could not list open PRs: ${errorMessage(err)}`);
+  }
+}
+
+class OpenPrOverlapError extends Error {}

package/src/mcp/localContext.ts

@@ -29,6 +29,8 @@ export interface LocalToolContext {
     // (the native `repeated-literal` rule). Honoured on the local stdio MCP
     // server too, so a CLI session scans on the same threshold as CI.
     | "repeatedLiteralThreshold"
+    // `-var-file` files the repo assigns to a root, loaded by trivy and checkov
+    | "varFiles"
     | "costIncreaseBlockUsd"
     | "moduleCatalogue"
     // resource addresses the operator allows to be destroyed/replaced. Read by

package/src/mcp/localServer.ts

@@ -104,6 +104,7 @@ export function buildLocalContext(options: LocalMcpOptions): LocalToolContext {
       autonomyThreshold: undefined,
       // the local server has no action inputs; the rule uses its own default.
       repeatedLiteralThreshold: undefined,
+      varFiles: undefined,
       costIncreaseBlockUsd: undefined,
       // a local `infraweaver mcp` run has no PR/push surface, so the
       // allow_replace gate never engages — terraform_plan reports

package/src/mcp/moduleExtraction.ts

@@ -13,7 +13,7 @@
  */
 
 import { readFileSync } from "node:fs";
-import { join } from "node:path";
+import { join, posix } from "node:path";
 import { type } from "arktype";
 import type { LocalToolContext } from "#app/mcp/localContext";
 import {
@@ -28,6 +28,8 @@ import {
 } from "#app/mcp/modules";
 import { execute, tool, toolOk } from "#app/mcp/shared";
 import { PUBLIC_REGISTRY_HOST, splitModuleAddress } from "#app/mcp/terraform/currency";
+import { RESOURCE_HEADER, unquoteLabel } from "#app/mcp/terraform/hcl";
+import { localSourceFrom } from "#app/mcp/terraform/localModules";
 import {
   findPartialInterfaces,
   MAX_PARTIAL_INTERFACE_FINDINGS,
@@ -55,14 +57,14 @@ export interface ParsedResource {
  * enough here — clustering and signature matching only need type + name. */
 export function parseResourceBlocks(hcl: string): ParsedResource[] {
   const out: ParsedResource[] = [];
-  const re = /(?:^|\n)\s*resource\s+"([^"]+)"\s+"([^"]+)"\s*\{/g;
+  const re = new RegExp(RESOURCE_HEADER, "g");
   let m: RegExpExecArray | null;
   // biome-ignore lint/suspicious/noAssignInExpressions: idiomatic regex-exec iteration
   while ((m = re.exec(hcl)) !== null) {
     const resourceType = m[1];
     const name = m[2];
     if (resourceType !== undefined && name !== undefined) {
-      out.push({ type: resourceType, name });
+      out.push({ type: unquoteLabel(resourceType), name: unquoteLabel(name) });
     }
   }
   return out;
@@ -172,7 +174,12 @@ export function clusterResources(file: string, resources: ParsedResource[]): Ext
 
 export interface CandidateModule {
   name: string;
+  /** the module's identity: repo-relative (`./modules/s3`) for a house module. */
   source: string;
+  /** a house module only: the `source` the cluster's root writes to call it —
+   *  relative to that root, so `../../modules/s3` from `env/dev`. `source` is
+   *  not a valid module source anywhere but the repo root. */
+  call_source?: string;
   version: string | null;
   kind: ModuleSourceKind;
   /** how the match was made: a house module's actual resource types, or a
@@ -501,7 +508,7 @@ function selectionReason(
   return (
     `${basis}. INDISTINGUISHABLE from ${runnerUp.source} on every signal available — same ` +
     `overlap, same kind of match — so the pick is source order, which is stable but not ` +
-    `meaningful. Say so in the PR and let the reviewer choose.`
+    `meaningful: which of the two to adopt is the reviewer's call.`
   );
 }
 
@@ -631,7 +638,12 @@ export function matchCluster(
       { name, source: `./${house.dir}`, version: null, kind: "local", publicRegistry: false },
       clusterArgs,
     );
-    if (candidate && exactEnough(house, candidate)) out.push(candidate);
+    if (candidate && exactEnough(house, candidate)) {
+      out.push({
+        ...candidate,
+        call_source: localSourceFrom(posix.dirname(cluster.file), house.dir),
+      });
+    }
   }
   for (const entry of catalogue) {
     // local catalogue entries are house modules — already covered by signature.

package/src/mcp/moduleTests.ts

@@ -5,6 +5,7 @@ import { type } from "arktype";
 import type { LocalToolContext } from "#app/mcp/localContext";
 import { collectModuleInterface } from "#app/mcp/modules";
 import { execute, tool, toolOk } from "#app/mcp/shared";
+import { BLOCK_LABEL } from "#app/mcp/terraform/hcl";
 import { log } from "#app/utils/cli";
 
 /**
@@ -139,7 +140,10 @@ export function parseExampleModuleVariables(
   sourceMatches: (source: string) => boolean,
 ): string[] {
   const set = new Set<string>();
-  for (const body of eachBlockBody(hcl, /module\s+"[^"]+"\s*\{/g)) {
+  for (const body of eachBlockBody(
+    hcl,
+    new RegExp(String.raw`module\s+${BLOCK_LABEL}\s*\{`, "g"),
+  )) {
     const source = moduleBlockSource(body);
     if (!source || !sourceMatches(source)) continue;
     for (const name of topLevelAttributeNames(body)) {
@@ -298,7 +302,10 @@ export function discoverModuleTestAssets(cwd: string, moduleDir: string): Module
       const vars = parseExampleModuleVariables(hcl, (s) => matchesModule(s, exDir));
       // only count it as THIS module's example when a module block actually
       // targets it (an `examples/` tree can hold fixtures for sibling modules).
-      const targets = eachBlockBody(hcl, /module\s+"[^"]+"\s*\{/g).some((b) => {
+      const targets = eachBlockBody(
+        hcl,
+        new RegExp(String.raw`module\s+${BLOCK_LABEL}\s*\{`, "g"),
+      ).some((b) => {
         const src = moduleBlockSource(b);
         return src !== null && matchesModule(src, exDir);
       });

package/src/mcp/modules.ts

@@ -4,6 +4,7 @@ import { resolveWithinCwd } from "@infraweaver-io/sandbox/pathSafety";
 import { type } from "arktype";
 import type { LocalToolContext } from "#app/mcp/localContext";
 import { execute, tool, toolOk } from "#app/mcp/shared";
+import { MODULE_HEADER, unquoteLabel } from "#app/mcp/terraform/hcl";
 import { log } from "#app/utils/cli";
 
 /**
@@ -466,11 +467,11 @@ export function isExactVersion(version: string | null | undefined): boolean {
  */
 export function parseModuleBlocks(hcl: string): ModuleBlock[] {
   const out: ModuleBlock[] = [];
-  const re = /module\s+"([^"]+)"\s*\{/g;
+  const re = new RegExp(MODULE_HEADER, "g");
   let m: RegExpExecArray | null;
   // biome-ignore lint/suspicious/noAssignInExpressions: idiomatic regex-exec iteration
   while ((m = re.exec(hcl)) !== null) {
-    const name = m[1]!;
+    const name = unquoteLabel(m[1]!);
     const braceStart = re.lastIndex - 1;
     let depth = 0;
     let end = -1;
@@ -564,9 +565,9 @@ export interface ModuleGraph {
  * whole tree; in the second it proposes extracting a module out of a module.
  */
 export function isModuleDir(hcl: string): boolean {
-  if (/(?:^|\n)\s*provider\s+"/.test(hcl)) return false;
-  if (!/(?:^|\n)\s*variable\s+"/.test(hcl)) return false;
-  return /(?:^|\n)\s*resource\s+"/.test(hcl);
+  if (/(?:^|\n)\s*provider\s+(?:"|[A-Za-z_])/.test(hcl)) return false;
+  if (!/(?:^|\n)\s*variable\s+(?:"|[A-Za-z_])/.test(hcl)) return false;
+  return /(?:^|\n)\s*resource\s+(?:"|[A-Za-z_])/.test(hcl);
 }
 
 // per-file byte cap for HCL reads. real .tf files are a few KB; anything this
@@ -616,9 +617,11 @@ const SKIP_DIRS = new Set([
   ".git",
   ".svn",
   ".hg",
-  // terraform's own working state and vendored copies
+  // terraform's own working state and vendored copies, and checkov's default
+  // download directory for the modules a scan fetches
   ".terraform",
   ".terragrunt-cache",
+  ".external_modules",
   // language dependency trees / virtualenvs
   ".venv",
   "venv",
@@ -1002,7 +1005,7 @@ function blockBody(
   let m: RegExpExecArray | null;
   // biome-ignore lint/suspicious/noAssignInExpressions: idiomatic regex-exec iteration
   while ((m = re.exec(hcl)) !== null) {
-    const name = m[1]!;
+    const name = unquoteLabel(m[1]!);
     const braceStart = re.lastIndex - 1;
     let depth = 0;
     let end = -1;

package/src/mcp/pr.ts

@@ -1,7 +1,11 @@
 import { $ } from "@infraweaver-io/sandbox/shell";
 import { type } from "arktype";
+import { resolveBaseBranch } from "#app/mcp/baseBranch";
 import type { GitHubWriteToolContext } from "#app/mcp/capabilityContext";
+import { assertWritableMode } from "#app/mcp/git";
 import {
+  assertHeadPushedThisRun,
+  assertNotAlreadyProposed,
   assertUnderOpenPrCaps,
   assertUnderPrCap,
   changedFilesSinceRunStart,
@@ -10,14 +14,11 @@ import {
   recordRemediationPrOpened,
   runStartSha,
 } from "#app/mcp/guardrails";
-import { assertWritableMode } from "#app/mcp/git";
 import { parseModuleBlocks } from "#app/mcp/modules";
 import { assertTargetInScope, recordCreatedTarget } from "#app/mcp/scope";
 import { execute, tool } from "#app/mcp/shared";
 import { scanSessionOf } from "#app/mcp/terraform/scanSession";
 import { log } from "#app/utils/cli";
-import type { RunContextData } from "#app/utils/cloud/runContextData";
-import type { ResolvedPayload } from "#app/utils/config/payload";
 import { fixDoubleEscapedString } from "#app/utils/fixDoubleEscapedString";
 import {
   buildInfraweaverFooter,
@@ -26,78 +27,17 @@ import {
 import { patchWorkflowRunFields } from "#app/utils/github/patchWorkflowRunFields";
 import { redactSecrets } from "#app/utils/redact";
 
-/**
- * The slice `resolveBaseBranch` reads: the declared base-branch input and the
- * repository's default branch. Shared with `terraform_change_summary`, which
- * resolves the same base without needing the rest of the GitHub surface.
- */
-export interface BaseBranchContext {
-  payload: ResolvedPayload;
-  repo: RunContextData["repo"];
-}
-
 export const PullRequest = type({
   title: type.string.describe("the title of the pull request"),
   body: type.string.describe("the body content of the pull request"),
   "base?": type.string.describe(
-    "the base branch to merge into (e.g. 'main'). Omit to use the run's resolved base branch: the `base_branch` input, else the repository's default branch (main, or master).",
+    "the base branch to merge into (e.g. 'main'). Omit to use the run's resolved base branch: the `base_branch` input, else the branch the run started on, else the repository's default branch (main, or master).",
   ),
   "draft?": type.boolean.describe(
     "if true, create the pull request as a draft. use when the user explicitly asks for a draft PR.",
   ),
 });
 
-/**
- * Pure base-branch picker. Precedence: an explicit `base_branch` declaration
- * always wins; otherwise the repository's default branch (GitHub reports it —
- * normally `main`, sometimes `master`); otherwise prefer `main`, then `master`;
- * final fallback `main`. Split out from git/ctx so it's exhaustively testable.
- */
-export function pickBaseBranch(opts: {
-  declared?: string | undefined;
-  defaultBranch?: string | undefined;
-  mainExists: boolean;
-  masterExists: boolean;
-}): string {
-  if (opts.declared) return opts.declared;
-  if (opts.defaultBranch) return opts.defaultBranch;
-  if (opts.mainExists) return "main";
-  if (opts.masterExists) return "master";
-  return "main";
-}
-
-/** true when `branch` exists as a remote-tracking or local ref. */
-function branchExists(branch: string): boolean {
-  for (const ref of [`refs/remotes/origin/${branch}`, `refs/heads/${branch}`]) {
-    try {
-      $("git", ["rev-parse", "--verify", "--quiet", ref], { log: false });
-      return true;
-    } catch {
-      // ref absent — try the next form
-    }
-  }
-  return false;
-}
-
-/**
- * Deterministically resolve the branch a PR targets, so the base is never left
- * to the agent's guess. Resolves to the repository's default branch (`main`, or
- * `master`), overridable by the `base_branch` input. Git is only probed for
- * main/master in the last-resort case where neither an explicit declaration nor
- * a GitHub default branch is available (essentially never).
- */
-export function resolveBaseBranch(ctx: BaseBranchContext): string {
-  const declared = ctx.payload.baseBranch?.trim() || undefined;
-  const defaultBranch = ctx.repo.data.default_branch?.trim() || undefined;
-  const needsProbe = !declared && !defaultBranch;
-  return pickBaseBranch({
-    declared,
-    defaultBranch,
-    mainExists: needsProbe && branchExists("main"),
-    masterExists: needsProbe && branchExists("master"),
-  });
-}
-
 /**
  * Append the extraction detector's `selection_reason` for each adopted module
  * the body does not already state — pure half, so the rule is testable without
@@ -235,8 +175,20 @@ export function CreatePullRequestTool(ctx: GitHubWriteToolContext) {
       const currentBranch = $("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
         log: false,
       });
+      // the PR presents what this run pushed, or nothing
+      assertHeadPushedThisRun(
+        ctx,
+        currentBranch,
+        $("git", ["rev-parse", "HEAD"], { log: false }).trim(),
+      );
       const base = params.base ?? resolveBaseBranch(ctx);
       log.debug(`Current branch: ${currentBranch}; PR base: ${base}`);
+      // one change, one PR: not another over files an open one already changes
+      await assertNotAlreadyProposed(ctx, {
+        branch: currentBranch,
+        base,
+        changed: changedFilesSinceRunStart(ctx),
+      });
 
       const bodyWithFooter = buildPrBodyWithFooter(ctx, params.body);