infraweaver 0.3.7 → 0.3.8

package/src/mcp/terraform/scanDelta.ts

@@ -41,6 +41,8 @@ export interface DeltaFinding {
   block?: string;
   /** an introduced finding whose resource may be an undeclared rename. */
   possiblyPreexisting?: true;
+  /** with `possiblyPreexisting`: the vanished resource it pairs with on the base. */
+  renamedFrom?: { address: string; file: string };
 }
 
 export interface ScanDelta {
@@ -302,9 +304,41 @@ function markPossibleRenames(
     if (!match) continue;
     used.add(match);
     finding.possiblyPreexisting = true;
+    finding.renamedFrom = { address: match.address as string, file: match.concern.location.file };
   }
 }
 
+/** One resource that looks renamed (or moved to another directory) without a
+ *  `moved` block, and how many introduced findings ride on it. */
+export interface UndeclaredRename {
+  from: { address: string; dir: string };
+  to: { address: string; dir: string };
+  findings: number;
+}
+
+/**
+ * The possibly-pre-existing findings grouped by the rename behind them.
+ *
+ * Fifteen findings on one renamed bucket are one thing for the author to do —
+ * add a `moved` block — not fifteen, and without that block `terraform apply`
+ * destroys the old resource and creates the new one. So a verdict reads better
+ * naming the resource once than listing every rule it carries. Order follows
+ * the findings (which are sorted by location), so the output is stable.
+ */
+export function undeclaredRenames(introduced: readonly DeltaFinding[]): UndeclaredRename[] {
+  const byPair = new Map<string, UndeclaredRename>();
+  for (const f of introduced) {
+    if (!f.possiblyPreexisting || !f.renamedFrom || f.address === null) continue;
+    const from = { address: f.renamedFrom.address, dir: dirOf(f.renamedFrom.file) };
+    const to = { address: f.address, dir: dirOf(f.concern.location.file) };
+    const key = `${from.dir}|${from.address}|${to.dir}|${to.address}`;
+    const seen = byPair.get(key);
+    if (seen) seen.findings++;
+    else byPair.set(key, { from, to, findings: 1 });
+  }
+  return [...byPair.values()];
+}
+
 function byLocation(a: Concern, b: Concern): number {
   return (
     a.location.file.localeCompare(b.location.file) ||

package/src/mcp/terraform/scanSession.ts

@@ -71,6 +71,12 @@ export interface ScanSession {
   // by cloudReport to build the dashboard report. undefined until a scan ran;
   // [] means the scan came back clean.
   lastScanConcerns?: Concern[];
+  // every concern ANY concern source this run reported, by id. An id is
+  // line-pinned, so a re-scan after an edit reports the same finding under a
+  // new id and replaces lastScanConcerns; verify must still key the ids the
+  // agent took from the FIRST scan (`concernKeyOf`), or it falls back to
+  // matching ids exactly and calls every line-shifted finding resolved.
+  concernsById?: Map<string, Concern>;
   // the findings gate's concern set: scanned by the engine itself before the
   // agent starts, on the tree the run was invoked on, at the CONFIGURED
   // threshold and scope. read at end-of-run by finalizeSuccessRun for the
@@ -142,6 +148,10 @@ export interface ScanSession {
   // `forgotten` blind-spot list and every coverage gap — enters the SIGNED
   // bundle instead of dying as a run verdict. undefined until drift ran.
   lastDrift?: DriftEvidenceStatement | undefined;
+  // the compliance artefacts an emit tool wrote this run: absolute path → the
+  // git blob id of every version written. Read by the Terraform-only push
+  // guardrail, which lets exactly those bytes through (see emittedArtefacts.ts).
+  emittedArtefacts?: Record<string, string[]>;
   // absolute path of a SARIF file the agent wrote via terraform_emit_sarif.
   // set by that tool on a successful write. read by finalizeSuccessRun's
   // findings-output step so the end-of-run safety-net emit does NOT clobber an
@@ -261,6 +271,11 @@ export interface ScanSession {
   // between the two tools, and a stale pairing corroborates nothing. Addresses
   // and attribute NAMES only; the plan's values are never stored.
   lastPlanPairs?: { fingerprint: string; pairs: PairAnalysis };
+  // the `terraform validate` errors the run-start commit already has, as
+  // `file: message` keys. Computed once per base by terraform_equivalence_check,
+  // and only when the working tree fails validate — so it can tell an error the
+  // change introduced from one it inherited.
+  baselineValidateErrors?: { base: string; errors: string[] };
   // was the upgrade ALREADY detected when this plan ran? Set by
   // terraform_plan from whether `upgradeIntent` existed at that moment.
   //
@@ -318,6 +333,21 @@ export function scanSessionOf(toolState: { scanSession?: ScanSession }): ScanSes
   return toolState.scanSession;
 }
 
+/** Publish a scan's reported concern set, and remember each concern for the
+ *  rest of the run (see `concernsById`). */
+export function recordScanConcerns(session: ScanSession, concerns: Concern[]): void {
+  session.lastScanConcerns = concerns;
+  recordConcernKeys(session, concerns);
+}
+
+/** Remember each concern for the rest of the run, so
+ *  terraform_verify_remediation can key an id from ANY concern source — a
+ *  findings file or an external report as much as a scan. */
+export function recordConcernKeys(session: ScanSession, concerns: Concern[]): void {
+  session.concernsById ??= new Map();
+  for (const c of concerns) session.concernsById.set(c.id, c);
+}
+
 /**
  * true once terraform_scan / read_findings captured a pre-fix baseline this
  * session. terraform_verify_remediation key-maps requested ids against the

package/src/mcp/terraform/scannerCache.ts

@@ -131,6 +131,10 @@ function toolchainSignature(opts: RunScannersOptions): string {
     // the native repeated-literal rule keys its findings on this threshold, so
     // two scans differing only here produce different finding sets.
     repeatedLiteralThreshold: opts.repeatedLiteralThreshold ?? null,
+    // a scoped scan holds only some directories' findings, and the variable
+    // files decide which values trivy and checkov evaluate
+    scope: opts.scope ?? null,
+    varFiles: opts.varFiles ?? null,
     // egress policy changes both the subprocess env AND the outcome's
     // `egress_isolation` marker — a denied scan must not serve an open-scan
     // cache entry (or vice versa), else the run summary lies about isolation.