infraweaver 0.3.7 → 0.3.8

package/src/mcp/terraform/tools/plan.ts

@@ -19,7 +19,7 @@ import {
 import { analysePlanPairs, type PairAnalysis } from "#app/mcp/terraform/planPairs";
 import { readWorkingTree, workingTreeFingerprint } from "#app/mcp/terraform/refactor/workspace";
 import { scanSessionOf } from "#app/mcp/terraform/scanSession";
-import { runTf } from "#app/mcp/terraform/subprocess";
+import { runTfAsync } from "#app/mcp/terraform/subprocess";
 import { skipResult } from "#app/mcp/terraform/types";
 import { log } from "#app/utils/cli";
 import { resolveModuleCredentialEnv } from "#app/utils/setup/registryAuth";
@@ -66,13 +66,13 @@ interface RootPlanOutcome {
  * throws on that deliberately) yields no pairs, and the proof degrades to the
  * keys-free floor it always had.
  */
-function capturePlanPairs(
+async function capturePlanPairs(
   absDir: string,
   planFile: string,
   creds: Record<string, string>,
-): PairAnalysis | undefined {
+): Promise<PairAnalysis | undefined> {
   try {
-    const shown = runTf(["show", "-json", planFile], absDir, creds);
+    const shown = await runTfAsync(["show", "-json", planFile], absDir, creds);
     if (shown.status !== 0 || !shown.stdout.trim()) return undefined;
     return analysePlanPairs(parseTerraformPlanFile(shown.stdout).resourceChanges);
   } catch {
@@ -85,14 +85,14 @@ function capturePlanPairs(
 
 /** init + plan (+ a stability re-plan + a human-readable plan) in a SINGLE root.
  * Used by terraform_plan once per discovered root. */
-function planOneRoot(
+async function planOneRoot(
   absDir: string,
   creds: Record<string, string>,
   tmpdir?: string,
-): RootPlanOutcome {
+): Promise<RootPlanOutcome> {
   // `terraform` when installed, else `tofu` (identical plan CLI, resolved by
-  // runTf) — an OpenTofu-only runner keeps the plan gate instead of skipping it.
-  const init = runTf(["init", "-input=false", "-no-color"], absDir, creds);
+  // runTfAsync) — an OpenTofu-only runner keeps the plan gate instead of skipping it.
+  const init = await runTfAsync(["init", "-input=false", "-no-color"], absDir, creds);
   if (init.missing) return { ran: false, skipReason: "terraform (or tofu) not installed" };
   if (init.status !== 0) {
     return {
@@ -106,7 +106,7 @@ function planOneRoot(
   // and a stray one left by a crash would land in the customer's diff. Absent a
   // tmpdir (a caller that did not supply one) the pairing is simply skipped.
   const planFile = tmpdir ? join(tmpdir, `plan-${process.pid}-${planFileSeq++}.tfplan`) : undefined;
-  const plan = runTf(
+  const plan = await runTfAsync(
     planFile ? [...PLAN_JSON_ARGS, `-out=${planFile}`] : PLAN_JSON_ARGS,
     absDir,
     creds,
@@ -118,7 +118,7 @@ function planOneRoot(
       skipReason: `terraform plan failed: ${plan.stderr.trim().slice(0, 200) || "unknown error"}`,
     };
   }
-  const pairs = planFile ? capturePlanPairs(absDir, planFile, creds) : undefined;
+  const pairs = planFile ? await capturePlanPairs(absDir, planFile, creds) : undefined;
   const summary = parseTerraformPlanJson(plan.stdout);
   const hasChanges =
     summary.add + summary.change + summary.destroy > 0 || summary.changed.length > 0;
@@ -127,7 +127,7 @@ function planOneRoot(
   let stable = true;
   let stabilityReason: string | undefined;
   if (hasChanges) {
-    const plan2 = runTf(PLAN_JSON_ARGS, absDir, creds);
+    const plan2 = await runTfAsync(PLAN_JSON_ARGS, absDir, creds);
     if (plan2.status === 0) {
       const s = comparePlanStability(summary, parseTerraformPlanJson(plan2.stdout));
       stable = s.stable;
@@ -137,7 +137,11 @@ function planOneRoot(
   // human-readable plan for the PR <details> block (separate non-json run).
   let planText: string | undefined;
   if (hasChanges) {
-    const readable = runTf(["plan", "-input=false", "-no-color", "-lock=false"], absDir, creds);
+    const readable = await runTfAsync(
+      ["plan", "-input=false", "-no-color", "-lock=false"],
+      absDir,
+      creds,
+    );
     if (readable.status === 0 && readable.stdout.trim())
       planText = readable.stdout.trim().slice(0, 12_000);
   }
@@ -220,7 +224,11 @@ const TerraformPlanParams = type({});
 export interface PlanRunners {
   /** `tmpdir` is where the saved plan file goes — outside the repository,
    *  because it holds attribute values. */
-  planOneRoot: (absDir: string, creds: Record<string, string>, tmpdir?: string) => RootPlanOutcome;
+  planOneRoot: (
+    absDir: string,
+    creds: Record<string, string>,
+    tmpdir?: string,
+  ) => Promise<RootPlanOutcome>;
   hasCloudCredentials: () => boolean;
 }
 
@@ -250,10 +258,15 @@ export async function runPlan(ctx: LocalToolContext, runners: PlanRunners = real
   // aggregate. resolveRoots falls back to [cwd] for a single-root repo, so
   // behaviour there is identical to before.
   const roots = resolveRoots(cwd);
-  const perRoot = roots.map((r) => ({
-    dir: r.relDir || ".",
-    outcome: runners.planOneRoot(r.absDir, creds, ctx.tmpdir),
-  }));
+  // one root at a time: each init writes its root's `.terraform`, and the
+  // providers they download share the same plugin directories.
+  const perRoot: { dir: string; outcome: RootPlanOutcome }[] = [];
+  for (const r of roots) {
+    perRoot.push({
+      dir: r.relDir || ".",
+      outcome: await runners.planOneRoot(r.absDir, creds, ctx.tmpdir),
+    });
+  }
   const ran = perRoot.filter((p) => p.outcome.ran);
   if (ran.length === 0) {
     // every root skipped — surface the first reason (e.g. not installed / init failed).

package/src/mcp/terraform/tools/reviewScanDelta.ts

@@ -69,6 +69,9 @@ function describe(f: DeltaFinding) {
       ? {
           possibly_preexisting:
             "this resource appeared as another with the same finding vanished — likely a rename without a `moved` block",
+          ...(f.renamedFrom
+            ? { renamed_from: { resource: f.renamedFrom.address, file: f.renamedFrom.file } }
+            : {}),
         }
       : {}),
     evidence: c.evidence,

package/src/mcp/terraform/tools/scan.ts

@@ -19,7 +19,7 @@ import { EMPTY_NOISE_PROFILE, explainNoiseAdjustment } from "#app/mcp/terraform/
 import { scoreConcern, topRisks } from "#app/mcp/terraform/risk";
 import { runScannersCached } from "#app/mcp/terraform/scannerCache";
 import { changedTerraformFiles } from "#app/mcp/terraform/scanners";
-import { scanSessionOf } from "#app/mcp/terraform/scanSession";
+import { recordScanConcerns, scanSessionOf } from "#app/mcp/terraform/scanSession";
 import { auditNativeSkips } from "#app/mcp/terraform/suppressions";
 import { type Concern, SEVERITY_RANK, type Severity } from "#app/mcp/terraform/types";
 import { UNTRUSTED_DATA_NOTICE } from "#app/mcp/untrustedContent";
@@ -38,7 +38,7 @@ const TerraformScanParams = type({
     "'file' (default) makes one group per file (smaller blast radius per PR). 'rule' groups a single rule's concerns across ALL files into one group — use for sweeping, low-risk rules (e.g. 'add tags everywhere') so they become one PR instead of many.",
   ),
   "download_external_modules?": type("boolean").describe(
-    "default false. When true, checkov resolves and scans INSIDE registry/git modules — REQUIRED for the refactor b.4 path (adopting a third-party module): scanning with it OFF would stop looking inside the adopted module and silently drop its findings (a false ✗→✓ / 'finding-laundering'). Leave off for normal Terraform-only scans (faster, offline).",
+    "default false. When true, checkov resolves and scans INSIDE registry/git modules — REQUIRED for the refactor b.4 path (adopting a third-party module): scanning with it OFF would stop looking inside the adopted module and silently drop its findings (a false ✗→✓ / 'finding-laundering'). A finding inside a module is reported on the line of the `module` block that calls it, naming the module resource. Leave off for normal Terraform-only scans (faster, offline).",
   ),
 });
 
@@ -99,6 +99,8 @@ export async function runScan(
     // the SAME threshold everywhere a scan happens. A verifier running on a
     // different one would report a finding resolved because the knob moved.
     repeatedLiteralThreshold: ctx.payload.repeatedLiteralThreshold,
+    // and the same variable files, which decide what trivy and checkov see
+    varFiles: ctx.payload.varFiles,
   });
   if (ctx.payload.toolsNetwork?.unknown.length) {
     log.warning(
@@ -152,7 +154,7 @@ export async function runScan(
   const reintroduced = findReintroduced(active, resolved);
   // the reported (post-filter) set — read at end-of-run by finalizeSuccessRun
   // to emit the SARIF artifact + findings outputs.
-  scanSessionOf(ctx.toolState).lastScanConcerns = result.annotated;
+  recordScanConcerns(scanSessionOf(ctx.toolState), result.annotated);
   // G7: the org's fleet-wide dismissal record, seeded at run start. Affects the
   // ORDER of `top_risks` / `risk_score` only — every concern above is already
   // final by this point, and nothing here can remove one.

package/src/mcp/terraform/tools/standardsReport.ts

@@ -55,7 +55,7 @@ export function TerraformStandardsReportTool(ctx: LocalToolContext) {
           note: "no `.tf` files found in the workspace — nothing to report on",
         });
       }
-      const report = standardsReport(cwd);
+      const report = await standardsReport(cwd);
       scanSessionOf(ctx.toolState).standardsReport = report;
       log.info(
         `» terraform_standards_report: ${report.summary.violations} violation(s), ` +

package/src/mcp/terraform/tools/validate.ts

@@ -1,10 +1,12 @@
 import { type } from "arktype";
 import type { LocalToolContext } from "#app/mcp/localContext";
 import { execute, tool, toolOk } from "#app/mcp/shared";
+import { initArtefacts, removeNewInitArtefacts } from "#app/mcp/terraform/initArtefacts";
 import { resolveRoots } from "#app/mcp/terraform/paths";
 import {
   checkArgumentsAgainstSchema,
   collectProviderRequirements,
+  initFailures,
   scanFmt,
   scanTflint,
   scanValidate,
@@ -29,6 +31,7 @@ export interface ValidateScanners {
   scanTflint: typeof scanTflint;
   collectProviderRequirements: typeof collectProviderRequirements;
   checkArgumentsAgainstSchema: typeof checkArgumentsAgainstSchema;
+  initFailures: typeof initFailures;
 }
 
 const realScanners: ValidateScanners = {
@@ -37,6 +40,7 @@ const realScanners: ValidateScanners = {
   scanTflint,
   collectProviderRequirements,
   checkArgumentsAgainstSchema,
+  initFailures,
 };
 
 export async function runValidate(
@@ -53,14 +57,15 @@ export async function runValidate(
   });
   // `terraform validate` runs per-root (multi-root aware); fmt + tflint are
   // recursive over the whole tree.
-  const fmtOutcome = scanners.scanFmt(cwd);
-  const validateOutcome = scanners.scanValidate(cwd, terraformEnv);
+  const artefactsBefore = initArtefacts(cwd);
+  const fmtOutcome = await scanners.scanFmt(cwd);
+  const validateOutcome = await scanners.scanValidate(cwd, terraformEnv);
   // the SAME egress directive as terraform_scan: without it, a validate call
   // would spawn tflint (and its network-fetching `--init`, memoised per dir)
   // with open egress under `tools_network: deny` — and whichever call inits
   // first wins for the rest of the process.
   const tflintOutcome = selection.enabled("tflint")
-    ? scanners.scanTflint(cwd, ctx.payload.toolsNetwork)
+    ? await scanners.scanTflint(cwd, ctx.payload.toolsNetwork)
     : skipped("tflint", selection.offReason("tflint") ?? "disabled by tools_enabled");
 
   // PRE-EXISTING `terraform fmt` drift (captured by the pre-fix scan, before
@@ -89,6 +94,10 @@ export async function runValidate(
   // those roots are valid, so `passed` must fail closed below rather than
   // silently treating an un-validated root as passing.
   const unvalidatedRoots = validateOutcome.unvalidated ?? 0;
+  // roots whose init failed validated without their modules and providers, so
+  // a clean list there checked almost nothing — a module bump the provider pin
+  // cannot satisfy reads exactly like a pass unless this is said
+  const initFailed = scanners.initFailures(cwd);
   // surface the pinned provider majors so the fix targets the right
   // argument schema (deterministic, read straight from required_providers).
   const providers = scanners.collectProviderRequirements(cwd);
@@ -100,6 +109,8 @@ export async function runValidate(
   // Deterministic and degrades green (omitted) when the schema isn't
   // available (terraform not installed / dir not init-ed).
   const schemaCheck = scanners.checkArgumentsAgainstSchema(cwd);
+  // the schema was read from what init installed; left behind, it blocks the push
+  removeNewInitArtefacts(cwd, artefactsBefore, "terraform_validate");
   return toolOk({
     // `passed` stays gated on fmt + validate + tflint only — those are
     // authoritative (fmt counts only NEW drift; see preexisting_fmt_drift).
@@ -107,13 +118,17 @@ export async function runValidate(
     // parse), surfaced separately so a parser edge case can never wrongly
     // block a valid fix. Fails closed when a root ran but couldn't be
     // validated: an un-validated root is "unknown", not "clean".
-    passed: remaining.length === 0 && unvalidatedRoots === 0,
+    passed: remaining.length === 0 && unvalidatedRoots === 0 && initFailed.length === 0,
     checks_ran: ran,
     // true when ≥1 Terraform root could not be validated (terraform ran but
     // its `-json` output was unparseable). When set, `passed` is false even
     // with no remaining_issues — re-run after fixing the root's init/state,
     // or inspect it by hand; do NOT treat the clean issue list as a pass.
-    validate_incomplete: unvalidatedRoots > 0,
+    validate_incomplete: unvalidatedRoots > 0 || initFailed.length > 0,
+    // the roots whose `terraform init` failed, with init's error — fix what it
+    // names (often a version constraint the change made unsatisfiable) before
+    // anything else; their validate result means nothing until then.
+    init_failed: initFailed,
     remaining_issues: remaining,
     // ADVISORY (does not gate `passed`): files that already failed
     // `terraform fmt` at the pre-fix baseline. Reformatting them would pull

package/src/mcp/terraform/tools/verifyRemediation.ts

@@ -55,6 +55,8 @@ export async function runVerifyRemediation(
     // the SAME threshold everywhere a scan happens. A verifier running on a
     // different one would report a finding resolved because the knob moved.
     repeatedLiteralThreshold: ctx.payload.repeatedLiteralThreshold,
+    // and the same variable files, which decide what trivy and checkov see
+    varFiles: ctx.payload.varFiles,
   });
   const currentConcerns = dedupe(outcomes.flatMap((o) => o.concerns));
   const currentIds = currentConcerns.map((c) => c.id);
@@ -63,12 +65,16 @@ export async function runVerifyRemediation(
   // concern look resolved nor a pre-existing one look like a regression.
   const currentKeys = new Set(currentConcerns.map((c) => concernKeyOf(c)));
 
-  // Map each requested id → its key via the original scan's concerns
-  // (lastScanConcerns). Ids we can't key-map (verify called without a prior
-  // scan this run — e.g. a bare findings.json) fall back to exact-id matching.
-  const keyById = new Map(
-    (session.lastScanConcerns ?? []).map((c) => [c.id, concernKeyOf(c)] as const),
-  );
+  // Map each requested id → its key via EVERY scan this run, not only the
+  // latest: an agent that re-scans after its edit still verifies the ids it
+  // took from the first scan, and those are line-pinned. Ids no scan this run
+  // reported (verify called without one — e.g. a bare findings.json) fall back
+  // to exact-id matching.
+  const reported = new Map([
+    ...(session.concernsById ?? []),
+    ...(session.lastScanConcerns ?? []).map((c) => [c.id, c] as const),
+  ]);
+  const keyById = new Map([...reported].map(([id, c]) => [id, concernKeyOf(c)] as const));
   const keyed: { id: string; key: string }[] = [];
   const unkeyed: string[] = [];
   for (const id of concern_ids) {
@@ -116,7 +122,8 @@ export async function runVerifyRemediation(
     resolved.length > 0
   ) {
     const resolvedSet = new Set(resolved);
-    const captures = (session.lastScanConcerns ?? [])
+    // from every scan: after a re-scan the resolved ids are the FIRST scan's
+    const captures = [...reported.values()]
       .filter((c) => resolvedSet.has(c.id))
       .map(captureProvenFix);
     if (captures.length > 0) {

package/src/mcp/terraform/tools/versionCurrency.ts

@@ -15,7 +15,9 @@ export function TerraformVersionCurrencyTool(ctx: LocalToolContext) {
       "Check the workspace's pinned providers and registry modules against the Terraform Registry's " +
       "published versions — the upgrade intelligence no scanner provides (tflint checks pins EXIST, not " +
       "that they're current). Reports per provider/module the written constraint, the `latest` stable " +
-      "version, the newest version the constraint admits, and `outdated`/`majors_behind`; registry " +
+      "version, the newest version the constraint admits, `latest_in_major` (the newest release in the " +
+      "major the constraint already sits on — the bump that crosses no major, offered even when `latest` " +
+      "is majors ahead), and `outdated`/`majors_behind`; registry " +
       "modules with no version pin are flagged `unpinned` (pin them to `latest`). Remediation contract: " +
       "one `chore(deps)` PR per upgrade group; minor/patch bumps may proceed autonomously; a MAJOR " +
       "bump means the module/provider interface may have changed — apply it only with a `needs-human` " +