infraweaver 0.3.7 → 0.3.8

package/src/utils/github/github.ts

@@ -1,14 +1,15 @@
-import { createSign } from "node:crypto";
 import { rename, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import * as core from "@actions/core";
 import { errorMessage } from "@infraweaver-io/core/errors";
 import { retry } from "@infraweaver-io/core/retry";
+import { createAppAuth } from "@octokit/auth-app";
 import { throttling } from "@octokit/plugin-throttling";
 import { Octokit } from "@octokit/rest";
 import { DOC_LINKS, PRODUCT_NAME, PRODUCT_SLUG } from "#app/brand";
 import { apiFetch } from "#app/utils/cloud/apiFetch";
 import { cloudOidcAudience } from "#app/utils/cloud/apiUrl";
+import { DEFAULT_CLOUD_TIMEOUT_MS } from "#app/utils/cloud/cloudFetchCore";
 
 function isObject(value: unknown) {
   return typeof value === "object" && value !== null;
@@ -32,37 +33,6 @@ interface InstallationToken {
   owner?: string;
 }
 
-interface GitHubAppConfig {
-  appId: string;
-  privateKey: string;
-  repoOwner: string;
-  repoName: string;
-}
-
-interface Installation {
-  id: number;
-  account: {
-    login: string;
-    type: string;
-  };
-}
-
-interface Repository {
-  owner: {
-    login: string;
-  };
-  name: string;
-}
-
-interface InstallationTokenResponse {
-  token: string;
-  expires_at: string;
-}
-
-interface RepositoriesResponse {
-  repositories: Repository[];
-}
-
 function isOIDCAvailable(): boolean {
   // OIDC requires both env vars to be set (only in real GitHub Actions with id-token permission)
   return Boolean(
@@ -176,11 +146,8 @@ async function acquireTokenViaOIDC(opts?: AcquireTokenOptions): Promise<string>
   }
   const reposParam = repos.length ? `?repos=${repos.join(",")}` : "";
 
-  const timeoutMs = 30000;
-  const controller = new AbortController();
-  const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
-
   try {
+    // no `signal`: apiFetch applies the cloud transport's default timeout
     const tokenResponse = await apiFetch({
       path: `/api/github/installation-token${reposParam}`,
       method: "POST",
@@ -189,11 +156,8 @@ async function acquireTokenViaOIDC(opts?: AcquireTokenOptions): Promise<string>
         "Content-Type": "application/json",
       },
       body: opts?.permissions ? JSON.stringify({ permissions: opts.permissions }) : undefined,
-      signal: controller.signal,
     });
 
-    clearTimeout(timeoutId);
-
     if (!tokenResponse.ok) {
       // prefer the server-side `error` field — it's the single source of
       // truth for the install URL (uses GITHUB_APP_INSTALL_URL, or the
@@ -216,82 +180,23 @@ async function acquireTokenViaOIDC(opts?: AcquireTokenOptions): Promise<string>
     const tokenData = (await tokenResponse.json()) as InstallationToken;
     return tokenData.token;
   } catch (error) {
-    clearTimeout(timeoutId);
-
-    if (error instanceof Error && error.name === "AbortError") {
-      throw new Error(`Token exchange timed out after ${timeoutMs}ms`);
+    // the default timeout's AbortSignal.timeout() rejects with a TimeoutError;
+    // the message carries "timed out" so acquireNewToken's retry policy matches it
+    if (error instanceof Error && error.name === "TimeoutError") {
+      throw new Error(`Token exchange timed out after ${DEFAULT_CLOUD_TIMEOUT_MS}ms`);
     }
     throw error;
   }
 }
 
-const base64UrlEncode = (str: string): string => {
-  return Buffer.from(str)
-    .toString("base64")
-    .replace(/\+/g, "-")
-    .replace(/\//g, "_")
-    .replace(/=/g, "");
-};
-
-const generateJWT = (appId: string, privateKey: string): string => {
-  const now = Math.floor(Date.now() / 1000);
-  const payload = {
-    iat: now - 60,
-    exp: now + 5 * 60,
-    iss: appId,
-  };
-
-  const header = {
-    alg: "RS256",
-    typ: "JWT",
-  };
-
-  const encodedHeader = base64UrlEncode(JSON.stringify(header));
-  const encodedPayload = base64UrlEncode(JSON.stringify(payload));
-  const signaturePart = `${encodedHeader}.${encodedPayload}`;
-
-  const signature = createSign("RSA-SHA256")
-    .update(signaturePart)
-    .sign(privateKey, "base64")
-    .replace(/\+/g, "-")
-    .replace(/\//g, "_")
-    .replace(/=/g, "");
-
-  return `${signaturePart}.${signature}`;
-};
-
-const githubRequest = async <T>(
-  path: string,
-  options: {
-    method?: string;
-    headers?: Record<string, string>;
-    body?: string;
-  } = {},
-): Promise<T> => {
-  const { method = "GET", headers = {}, body } = options;
-
-  const url = `https://api.github.com${path}`;
-  const requestHeaders = {
-    Accept: "application/vnd.github.v3+json",
-    "User-Agent": `${PRODUCT_NAME}-Installation-Token-Generator/1.0`,
-    ...headers,
-  };
-
-  const response = await fetch(url, {
-    method,
-    headers: requestHeaders,
-    ...(body && { body }),
-    signal: AbortSignal.timeout(30_000),
-  });
-
-  if (!response.ok) {
-    const errorText = await response.text();
-    throw new Error(
-      `GitHub API request failed: ${response.status} ${response.statusText}\n${errorText}`,
-    );
-  }
-
-  return response.json() as T;
+// the local-dev App path talks to api.github.com directly; bound every request
+// the way the cloud transport bounds its own.
+const appRequestDefaults = {
+  userAgent: `${PRODUCT_NAME}-Installation-Token-Generator/1.0`,
+  request: {
+    fetch: (url: string, init: RequestInit) =>
+      fetch(url, { ...init, signal: AbortSignal.timeout(30_000) }),
+  },
 };
 
 const checkRepositoryAccess = async (
@@ -300,13 +205,13 @@ const checkRepositoryAccess = async (
   repoName: string,
 ): Promise<boolean> => {
   try {
-    const response = await githubRequest<RepositoriesResponse>("/installation/repositories", {
-      headers: { Authorization: `token ${token}` },
-    });
+    const { data } = await new Octokit({ ...appRequestDefaults, auth: token }).request(
+      "GET /installation/repositories",
+    );
 
     const ownerLower = repoOwner.toLowerCase();
     const nameLower = repoName.toLowerCase();
-    return response.repositories.some(
+    return data.repositories.some(
       (repo) =>
         repo.owner.login.toLowerCase() === ownerLower && repo.name.toLowerCase() === nameLower,
     );
@@ -316,31 +221,18 @@ const checkRepositoryAccess = async (
 };
 
 const createInstallationToken = async (
-  jwt: string,
+  app: Octokit,
   installationId: number,
   permissions?: GitHubAppPermissions,
 ): Promise<string> => {
-  const requestOpts: {
-    method: string;
-    headers: Record<string, string>;
-    body?: string;
-  } = {
-    method: "POST",
-    headers: { Authorization: `Bearer ${jwt}` },
+  const { token } = (await app.auth({ type: "installation", installationId, permissions })) as {
+    token: string;
   };
-  if (permissions) {
-    requestOpts.body = JSON.stringify({ permissions });
-  }
-  const response = await githubRequest<InstallationTokenResponse>(
-    `/app/installations/${installationId}/access_tokens`,
-    requestOpts,
-  );
-
-  return response.token;
+  return token;
 };
 
 const findInstallationId = async (
-  jwt: string,
+  app: Octokit,
   repoOwner: string,
   repoName: string,
 ): Promise<number> => {
@@ -352,10 +244,10 @@ const findInstallationId = async (
   // repo, and the loop's per-installation errors are what produce the useful
   // diagnosis in that case.
   try {
-    const direct = await githubRequest<{ id: number }>(
-      `/repos/${repoOwner}/${repoName}/installation`,
-      { headers: { Authorization: `Bearer ${jwt}` } },
-    );
+    const { data: direct } = await app.request("GET /repos/{owner}/{repo}/installation", {
+      owner: repoOwner,
+      repo: repoName,
+    });
     if (Number.isInteger(direct?.id)) return direct.id;
   } catch {
     // Not installed on this repo, or the endpoint is unavailable — fall through
@@ -363,9 +255,7 @@ const findInstallationId = async (
     // selection includes it and which produces the better error message.
   }
 
-  const installations = await githubRequest<Installation[]>("/app/installations", {
-    headers: { Authorization: `Bearer ${jwt}` },
-  });
+  const { data: installations } = await app.request("GET /app/installations");
 
   // Probing each installation is best-effort — one that legitimately can't mint a
   // token (suspended, revoked) must not abort the search. But swallowing the error
@@ -376,7 +266,7 @@ const findInstallationId = async (
   let lastError: unknown;
   for (const installation of installations) {
     try {
-      const tempToken = await createInstallationToken(jwt, installation.id);
+      const tempToken = await createInstallationToken(app, installation.id);
       const hasAccess = await checkRepositoryAccess(tempToken, repoOwner, repoName);
 
       if (hasAccess) {
@@ -407,16 +297,18 @@ async function acquireTokenViaGitHubApp(opts?: AcquireTokenOptions): Promise<str
 
   const repoContext = parseRepoContext();
 
-  const config: GitHubAppConfig = {
-    appId: process.env.GITHUB_APP_ID,
-    privateKey: process.env.GITHUB_PRIVATE_KEY.replace(/\\n/g, "\n"),
-    repoOwner: repoContext.owner,
-    repoName: repoContext.name,
-  };
-
-  const jwt = generateJWT(config.appId, config.privateKey);
-  const installationId = await findInstallationId(jwt, config.repoOwner, config.repoName);
-  return await createInstallationToken(jwt, installationId, opts?.permissions);
+  // createAppAuth signs the App JWT for the /app/* and /repos/{owner}/{repo}/installation
+  // routes and mints installation tokens through `app.auth()`.
+  const app = new Octokit({
+    ...appRequestDefaults,
+    authStrategy: createAppAuth,
+    auth: {
+      appId: process.env.GITHUB_APP_ID,
+      privateKey: process.env.GITHUB_PRIVATE_KEY.replace(/\\n/g, "\n"),
+    },
+  });
+  const installationId = await findInstallationId(app, repoContext.owner, repoContext.name);
+  return await createInstallationToken(app, installationId, opts?.permissions);
 }
 
 /**

package/src/utils/github/token.ts

@@ -2,6 +2,7 @@ import assert from "node:assert/strict";
 import * as core from "@actions/core";
 import { errorMessage } from "@infraweaver-io/core/errors";
 import { onExitSignal } from "@infraweaver-io/sandbox/exitHandler";
+import { Octokit } from "@octokit/rest";
 import type { PushPermission } from "#app/external";
 import { log } from "#app/utils/cli";
 import { stashKeylessOidcCreds } from "#app/utils/cloud/keylessOidc";
@@ -260,18 +261,12 @@ export function getGitHubInstallationToken(): string {
 }
 
 export async function revokeGitHubInstallationToken(token: string): Promise<void> {
-  const apiUrl = process.env.GITHUB_API_URL || "https://api.github.com";
-
   try {
-    await fetch(`${apiUrl}/installation/token`, {
-      method: "DELETE",
-      headers: {
-        Accept: "application/vnd.github+json",
-        Authorization: `Bearer ${token}`,
-        "X-GitHub-Api-Version": "2022-11-28",
-      },
-      signal: AbortSignal.timeout(10_000),
-    });
+    await new Octokit({
+      auth: token,
+      baseUrl: process.env.GITHUB_API_URL || "https://api.github.com",
+      request: { signal: AbortSignal.timeout(10_000) },
+    }).rest.apps.revokeInstallationAccessToken();
     log.debug("» installation token revoked");
   } catch (error) {
     log.info(`Failed to revoke installation token: ${errorMessage(error)}`);

package/src/utils/log.ts

@@ -6,8 +6,10 @@ import { AsyncLocalStorage } from "node:async_hooks";
 import * as core from "@actions/core";
 import { setLogger } from "@infraweaver-io/core/logger";
 import { type AgentUsage, formatCostUsd } from "@infraweaver-io/models/usage";
+import pc from "picocolors";
 import { table } from "table";
 import { isGitHubActions, isInsideDocker } from "#app/utils/globals";
+import { tableCell } from "#app/utils/markdownTable";
 import { redactSecrets } from "#app/utils/redact";
 
 // --- log prefix via AsyncLocalStorage ---
@@ -16,9 +18,6 @@ type LogContext = { prefix: string };
 
 const logContext = new AsyncLocalStorage<LogContext>();
 
-const MAGENTA = "\x1b[35m";
-const RESET = "\x1b[0m";
-
 /** run `fn` with every log line prefixed by `prefix` (e.g. "[task-label]") in magenta */
 export function withLogPrefix<T>(prefix: string, fn: () => Promise<T>): Promise<T> {
   return logContext.run({ prefix }, fn);
@@ -27,7 +26,7 @@ export function withLogPrefix<T>(prefix: string, fn: () => Promise<T>): Promise<
 function prefixLines(message: string): string {
   const ctx = logContext.getStore();
   if (!ctx) return message;
-  const colored = `${MAGENTA}${ctx.prefix}${RESET} `;
+  const colored = `${pc.magenta(ctx.prefix)} `;
   return message
     .split("\n")
     .map((line) => `${colored}${line}`)
@@ -439,7 +438,7 @@ export function formatUsageSummary(entries: AgentUsage[]): string {
 
   const rows = entries.map(
     (e) =>
-      `| ${e.agent} | ${fmt(nonCachedInput(e))} | ${fmt(e.cacheReadTokens ?? 0)} | ${fmt(e.cacheWriteTokens ?? 0)} | ${fmt(e.outputTokens)} | ${fmt(totalFor(e))} | ${costCell(e)} |`,
+      `| ${tableCell(e.agent)} | ${fmt(nonCachedInput(e))} | ${fmt(e.cacheReadTokens ?? 0)} | ${fmt(e.cacheWriteTokens ?? 0)} | ${fmt(e.outputTokens)} | ${fmt(totalFor(e))} | ${costCell(e)} |`,
   );
 
   const totalsRows: string[] = [];

package/src/utils/markdownTable.ts

@@ -0,0 +1,11 @@
+/**
+ * Flatten text into one markdown table cell: escape pipes (an unescaped `|`
+ * starts a new column and shears the row) and fold newlines, which would end the
+ * row, into single spaces.
+ */
+export function tableCell(text: string): string {
+  return text
+    .replaceAll("|", "\\|")
+    .replaceAll(/\s*\n\s*/g, " ")
+    .trim();
+}

package/src/utils/prompt/changeImpact.ts

@@ -2,6 +2,7 @@ import { writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { $ } from "@infraweaver-io/sandbox/shell";
 import { log } from "#app/utils/cli";
+import { parseDiffLines } from "#app/utils/unifiedDiff";
 
 /**
  * Deterministic change-impact leads for Terraform review.
@@ -75,27 +76,27 @@ const TF_DECL_PATTERNS: Array<{
 }> = [
   {
     declaration: "resource",
-    re: /^resource\s+"([A-Za-z0-9_]+)"\s+"([A-Za-z0-9_-]+)"/,
+    re: /^resource\s+"?([A-Za-z0-9_]+)"?\s+"?([A-Za-z0-9_-]+)"?/,
     build: (m) => ({ label: `${m[1]}.${m[2]}`, ref: `${m[1]}.${m[2]}` }),
   },
   {
     declaration: "data",
-    re: /^data\s+"([A-Za-z0-9_]+)"\s+"([A-Za-z0-9_-]+)"/,
+    re: /^data\s+"?([A-Za-z0-9_]+)"?\s+"?([A-Za-z0-9_-]+)"?/,
     build: (m) => ({ label: `data.${m[1]}.${m[2]}`, ref: `data.${m[1]}.${m[2]}` }),
   },
   {
     declaration: "variable",
-    re: /^variable\s+"([A-Za-z0-9_-]+)"/,
+    re: /^variable\s+"?([A-Za-z0-9_-]+)"?/,
     build: (m) => ({ label: `var.${m[1]}`, ref: `var.${m[1]}` }),
   },
   {
     declaration: "module",
-    re: /^module\s+"([A-Za-z0-9_-]+)"/,
+    re: /^module\s+"?([A-Za-z0-9_-]+)"?/,
     build: (m) => ({ label: `module.${m[1]}`, ref: `module.${m[1]}` }),
   },
   {
     declaration: "output",
-    re: /^output\s+"([A-Za-z0-9_-]+)"/,
+    re: /^output\s+"?([A-Za-z0-9_-]+)"?/,
     // an output is consumed as `module.<caller>.<name>`; grep that access form as
     // a regex rather than the bare `.<name>`, which would match every attribute
     // access named `<name>` in the tree (for common names like `id`/`arn` that is
@@ -143,34 +144,25 @@ export function extractTerraformAtoms(files: ChangedFile[]): {
     if (!file.patch) continue;
     // only Terraform declarations matter here.
     if (!/\.(tf|tfvars)$/.test(file.filename)) continue;
-    let oldLine = 0;
-    let newLine = 0;
-    for (const patchLine of file.patch.split("\n")) {
-      const hunk = patchLine.match(/^@@ -(\d+)(?:,\d+)? \+(\d+)(?:,\d+)? @@/);
-      if (hunk) {
-        oldLine = Number.parseInt(hunk[1] ?? "0", 10);
-        newLine = Number.parseInt(hunk[2] ?? "0", 10);
-        continue;
-      }
-      if (patchLine.startsWith("+")) {
-        const decl = declarationOf(patchLine.slice(1));
-        const where: ChangeLocation = { path: file.filename, line: newLine, kind: "added" };
-        addedLines.add(locationKey(file.filename, newLine));
+    for (const patchLine of parseDiffLines(file.patch)) {
+      if (patchLine.kind === "add") {
+        const decl = declarationOf(patchLine.text);
+        const where: ChangeLocation = {
+          path: file.filename,
+          line: patchLine.newLine,
+          kind: "added",
+        };
+        addedLines.add(locationKey(file.filename, patchLine.newLine));
         if (decl && !byRef.has(decl.ref)) byRef.set(decl.ref, { ...decl, where });
-        newLine++;
-      } else if (patchLine.startsWith("-")) {
-        const decl = declarationOf(patchLine.slice(1));
+      } else if (patchLine.kind === "remove") {
+        const decl = declarationOf(patchLine.text);
         const oldPath = file.previous_filename ?? file.filename;
         if (decl && !byRef.has(decl.ref)) {
           byRef.set(decl.ref, {
             ...decl,
-            where: { path: oldPath, line: oldLine, kind: "removed" },
+            where: { path: oldPath, line: patchLine.oldLine, kind: "removed" },
           });
         }
-        oldLine++;
-      } else if (!patchLine.startsWith("\\")) {
-        oldLine++;
-        newLine++;
       }
     }
   }

package/src/utils/prompt/instructions.ts

@@ -421,7 +421,7 @@ When embedding images (e.g. uploaded screenshots) in comments or PR bodies, alwa
 
 **Your raw assistant messages are never delivered** — they exist only in the run logs. Anything the user is meant to see (an answer to a question, a mention reply, a result) MUST go through \`report_progress\` (or another ${infraweaverMcpName} write tool). Do not rely on returning the answer as plain text — the harness makes a best-effort attempt to recover it into the progress comment, but that is a safety net, not a substitute for calling \`report_progress\`.
 
-**\`report_progress\`**: call this exactly once at the end of every run with a brief final summary (1-3 sentences) unless the mode guidance instructs otherwise. Never call it for intermediate status updates (e.g., "Checking for changes...", "Starting review...") — the task list handles live progress automatically. Calling \`report_progress\` replaces the task list with your summary and preserves the current task list in a collapsible section. Keep the summary concise — do not repeat what the task list already shows. Focus on the outcome (what was accomplished, links to artifacts) rather than listing individual steps. If something failed, include the tool's error text even when that makes the summary longer.
+**\`report_progress\`**: call this exactly once at the end of every run, with its \`body\` set to a brief final summary (1-3 sentences) unless the mode guidance instructs otherwise. Never call it for intermediate status updates (e.g., "Checking for changes...", "Starting review...") — the task list handles live progress automatically. Calling \`report_progress\` replaces the task list with your summary and preserves the current task list in a collapsible section. Keep the summary concise — do not repeat what the task list already shows. Focus on the outcome (what was accomplished, links to artifacts) rather than listing individual steps. If something failed, include the tool's error text even when that makes the summary longer.
 
 Never use \`create_issue_comment\` for task progress — that creates duplicate comments and leaves the progress comment stuck in its initial state. \`create_issue_comment\` is only for standalone comments unrelated to your current task. Plan output (initial post AND revisions) goes through \`report_progress\` — see the Plan mode guidance for details.
 

package/src/utils/prompt/promptDirectives.ts

@@ -116,7 +116,7 @@ const REFACTOR_SOURCE_DIRECTIVES: Readonly<Record<RefactorSource, string>> = {
   ].join("\n"),
   "same-repo": [
     "Use ONLY a module that already exists in THIS repository (variant b.2 — a local",
-    "`./modules/x` path, candidate `kind: local`). Do not author a new module, reach into",
+    "module called by its `call_source`, candidate `kind: local`). Do not author a new module, reach into",
     "another repo, or adopt a registry module. If no suitable in-repo module matches the",
     "cluster, report that and stop — do not fall back to another variant.",
   ].join("\n"),

package/src/utils/prompt/toolSelection.ts

@@ -55,7 +55,7 @@ export interface ToolSelectionFlags {
  * via its dedicated input. Listing keeps their long-standing behaviour intact
  * while the unified list can also enable/disable them.
  */
-const FLAG_OPT_IN: ReadonlySet<ToolId> = new Set<ToolId>(["gitleaks", "terratest"]);
+const FLAG_OPT_IN: ReadonlySet<ToolId> = new Set<ToolId>(["gitleaks", "betterleaks", "terratest"]);
 
 /** map a token to a canonical tool id (case-insensitive; common spellings). */
 const TOKEN_ALIASES: Readonly<Record<string, ToolId>> = {
@@ -69,6 +69,7 @@ const TOKEN_ALIASES: Readonly<Record<string, ToolId>> = {
   infracost: "infracost",
   cost: "infracost",
   gitleaks: "gitleaks",
+  betterleaks: "betterleaks",
   conftest: "conftest",
   opa: "conftest",
   policy: "conftest",
@@ -177,7 +178,13 @@ function decide(id: ToolId, flags: ToolSelectionFlags): Verdict {
   if (FLAG_OPT_IN.has(id)) {
     return flagFor(id, flags)
       ? { on: true }
-      : { on: false, reason: `opt-in — set the ${id} input or name "${id}" in tools_enabled` };
+      : {
+          on: false,
+          reason:
+            id === "betterleaks"
+              ? `opt-in — name "${id}" in tools_enabled`
+              : `opt-in — set the ${id} input or name "${id}" in tools_enabled`,
+        };
   }
   // permissive default-on (subject to the tool's own runtime presence checks).
   return { on: true };
@@ -235,6 +242,8 @@ export function scannerToolId(source: string): ToolId | null {
       return "trivy";
     case "checkov":
       return "checkov";
+    case "betterleaks":
+      return "betterleaks";
     default:
       return null;
   }

package/src/utils/setup/toolLicensing.ts

@@ -20,6 +20,7 @@ export type ToolId =
   | "checkov"
   | "infracost"
   | "gitleaks"
+  | "betterleaks"
   | "conftest"
   | "terratest"
   | "terratag"
@@ -96,6 +97,12 @@ export const TOOL_LICENSES: Readonly<Record<ToolId, ToolLicense>> = {
     license: "MIT",
     class: "permissive",
   },
+  betterleaks: {
+    id: "betterleaks",
+    name: "Betterleaks",
+    license: "MIT",
+    class: "permissive",
+  },
   conftest: {
     id: "conftest",
     name: "Conftest (OPA)",

package/src/utils/telemetry.ts

@@ -1,4 +1,5 @@
 import { randomBytes } from "node:crypto";
+import { errorMessage } from "@infraweaver-io/core/errors";
 import { PRODUCT_SLUG } from "#app/brand";
 import { log } from "#app/utils/cli";
 import { redactSecrets } from "#app/utils/redact";
@@ -356,6 +357,6 @@ export async function flushTelemetry(): Promise<void> {
     }
     log.debug(`telemetry exported ${armed.spans.length} span(s)`);
   } catch (err) {
-    log.debug(`telemetry export failed: ${err instanceof Error ? err.message : String(err)}`);
+    log.debug(`telemetry export failed: ${errorMessage(err)}`);
   }
 }