infraweaver 0.3.7 → 0.3.9

package/README.md

@@ -2,7 +2,7 @@
 
 [![License: AGPL v3](https://img.shields.io/badge/License-AGPL%20v3-blue.svg)](LICENSE)
 [![CI](https://github.com/infraweaver-io/infraweaver-action/actions/workflows/test.yml/badge.svg?branch=main)](https://github.com/infraweaver-io/infraweaver-action/actions/workflows/test.yml)
-[![Version](https://img.shields.io/badge/version-0.3.7)](package.json) <!-- x-release-please-version -->
+[![Version](https://img.shields.io/badge/version-0.3.9)](package.json) <!-- x-release-please-version -->
 
 **Infraweaver brings your Terraform up to best practice — automatically, as reviewable pull requests.**
 
@@ -53,7 +53,7 @@ jobs:
       - uses: aquasecurity/setup-trivy@81e514348e19b6112ce2a7e3ecbafe19c1e1f567 # v0.3.1
         with:
           # renovate: datasource=github-releases depName=aquasecurity/trivy
-          version: v0.72.0 # pin the TOOL too: a SHA-pinned action still installs floating-latest
+          version: v0.74.0 # pin the TOOL too: a SHA-pinned action still installs floating-latest
       - run: pipx install checkov
 
       - name: Run Infraweaver

package/dist/agents/claude.d.ts

@@ -26,7 +26,7 @@ export declare function writeMcpConfig(ctx: AgentRunContext): string;
  * 'sonnet' | 'opus' | 'haiku') and takes precedence over what's set here —
  * we don't pass it; the per-subagent `model` field is the right default.
  *
- * The `model` is route-aware: the bare Anthropic-API id `claude-sonnet-5`
+ * The `model` is route-aware: the bare Anthropic-API id `claude-sonnet-5-5`
  * is only valid on the direct API. On Bedrock (`eu.anthropic.…`) and Vertex
  * (`@`-versioned) routes that id is rejected, and claude-code does not
  * translate per-agent model names — so on those routes we omit `model`

package/dist/agents/claudePretoolGate.d.ts

@@ -34,42 +34,6 @@
  * inside `ctx.tmpdir` (where `--settings` can find it) and survives bundle
  * minification.
  */
-/**
- * The pinned `@anthropic-ai/claude-code` version against which the subagent
- * gate's `agent_id` discriminator was last verified (see the contract notes in
- * the gate source below). The gate fails OPEN for subagents if claude-code ever
- * stops populating `agent_id` in the PreToolUse hook payload, so a version bump
- * must be paired with a re-verification of `createBaseHookInput`.
- *
- * `claudePretoolGate.test.ts` asserts this equals the version pinned in
- * `package.json` — that test fails on any bump, forcing the re-verification
- * before the pin and this constant are updated together.
- *
- * 2.1.266 verified 2026-09-26 against the schema embedded in the installed
- * binary: the base hook input still declares `agent_id` as
- * `string().optional().describe("Subagent identifier. Present only when the
- * hook fires from within a subagent (e.g., a tool called by an AgentTool
- * worker). Absent for the main thread, even in --agent sessions. Use this
- * field (not agent_type) to distinguish subagent calls from main-thread
- * calls.")` — exactly the discriminator the gate relies on, byte-for-byte
- * unchanged from the 2.1.220 verification (2026-07-28), which was itself
- * unchanged from 2.1.198 (2026-07-10), 2.1.195 (2026-07-01) and 2.1.190
- * (2026-06-25), the last of which was more explicit than the 2.1.177 schema it
- * replaced. The 2.1.266 pass also re-confirmed the field is POPULATED and not
- * merely declared: `createBaseHookInput` (minified; the names change per build)
- * returns `{ …, agent_id: o?.agentId, agent_type: d, … }` — read off the caller's
- * context object, not a hardcoded empty string. (The bundle does contain an
- * `agent_id:""` literal, but on a different path — the coercion
- * `Xu(e.agent_id) ? String(e.agent_id) : ""` that normalises an ABSENT id on
- * the main thread, which is the documented behaviour, not the hook builder.)
- *
- * Scope of this verification, stated honestly: it is static inspection of the
- * shipped binary. No CI job exercises the Claude subagent gate against a live
- * agent — `security-tests.yml` is deliberately opencode-only (free keyless
- * model; Claude Code cannot use an `opencode/*` gateway model). So this pin,
- * plus the tripwire test, IS the contract check. Keep both.
- */
-export declare const CLAUDE_CODE_AGENT_ID_VERIFIED_VERSION: "2.1.266";
 /**
  * Source written to `<ctx.tmpdir>/infraweaver-pretool-gate.mjs`. Plain ESM,
  * no TypeScript, no dependencies — node executes it directly via the

package/dist/agents/toolPlaneWatch.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Notices when the agent has lost the infraweaver tool server, so the run stops
+ * instead of spending its budget without it.
+ *
+ * Every deliverable — the push, the pull request, the review, the final
+ * progress report — goes through that server. Once Claude Code drops it, each
+ * call fails at once with "not connected", and a model told to keep trying
+ * retries in a tight loop until the token quota ends the run: a refactor did
+ * exactly that for 41 minutes and 8.5M tokens.
+ *
+ * One lost call is not enough to stop on: Claude Code reconnects, and a call
+ * that lands mid-reconnect fails the same way. The run stops only after
+ * {@link LOST_CALLS} such failures in a row spanning at least
+ * {@link LOST_WINDOW_MS}, with no infraweaver call succeeding in between.
+ */
+export declare const LOST_CALLS = 3;
+export declare const LOST_WINDOW_MS = 30000;
+export declare class ToolPlaneLostError extends Error {
+    constructor(calls: number, seconds: number);
+}
+export interface ToolResult {
+    /** the tool that was called, when known. */
+    toolName: string | undefined;
+    isError: boolean;
+    text: string;
+}
+export declare function createToolPlaneWatch(now?: () => number): {
+    /** Record one tool result; returns the error to stop with once the server is lost. */
+    observe(result: ToolResult): ToolPlaneLostError | null;
+};
+export type ToolPlaneWatch = ReturnType<typeof createToolPlaneWatch>;