infraweaver 0.3.7 → 0.3.9

package/src/mcp/terraform/concernResult.ts

@@ -12,7 +12,7 @@ import {
   groupConcernsByRule,
   planBatches,
 } from "#app/mcp/terraform/decisions";
-import { scanSessionOf } from "#app/mcp/terraform/scanSession";
+import { recordConcernKeys, scanSessionOf } from "#app/mcp/terraform/scanSession";
 import { suppressConcerns } from "#app/mcp/terraform/suppressions";
 import { dedupeCrossScanner } from "#app/mcp/terraform/taxonomy";
 import {
@@ -114,6 +114,7 @@ export function buildConcernResult(
     session.baselineConcernKeys,
     fullBaseline.map((c) => concernKeyOf(c)),
   );
+  recordConcernKeys(session, fullBaseline);
   // the files already unformatted at this (pre-fix) scan. terraform_validate
   // subtracts these so PRE-EXISTING `terraform fmt` drift can't force a
   // whole-file reformat into a scoped fix. Captured from the raw set (fmt

package/src/mcp/terraform/consolidation.ts

@@ -40,11 +40,22 @@
  *     the expression as text. Multiplicity is part of the key, so those dirs
  *     simply never group.
  *
+ * MODULE CALLS IN THE SHAPE. A root's call of a LOCAL module that the
+ * cluster's resources read is part of the stack as much as they are, so it can
+ * join the cluster: the proposed module then wraps the call (`module.data` → `module.<new>.module.data`, one
+ * `moved {}` block) and a reference into it stays inside the module instead of
+ * crossing the boundary as an input. Only calls the proof can follow make it
+ * in — a local source, no `count`/`for_each`/`providers`/`depends_on` — and a
+ * cluster that wraps calls is only the WIDER offer: when it cannot be
+ * proposed, the same roots are still considered without their calls.
+ *
  * Pure: an already-read tree in, structure out. No filesystem, no subprocess.
  */
 
+import { posix } from "node:path";
 import { classifyRootDirs, detectEnvironmentTwins, groupFilesByDir } from "#app/mcp/roots";
 import { parseBlocks, topLevelEntries } from "#app/mcp/terraform/hcl";
+import { localSourceFrom } from "#app/mcp/terraform/localModules";
 import { generateMovedBlocks, type MovedBlock } from "#app/mcp/terraform/refactor/movedBlocks";
 import { type Multiplicity, parseResourcesWithArgs } from "#app/mcp/terraform/refactor/resources";
 import type { SourceFile } from "#app/mcp/terraform/tree";
@@ -75,8 +86,16 @@ const MODELLED_META: ReadonlySet<string> = new Set(["count", "for_each"]);
 
 /** expressions whose meaning is scoped to the ROOT that writes them. Identical
  *  text in two roots does NOT mean an identical value — `var.bucket_name`
- *  resolves per root — so these become module variables even when they match. */
-const ROOT_SCOPED = /\b(?:var|local|data|module|terraform)\./;
+ *  resolves per root — so these become module variables even when they match.
+ *  The lookbehind keeps `aws_s3_bucket.data.id` and `module.data.x` from reading
+ *  as a data source. `module.` is judged per cluster — see [[isRootScoped]]. */
+const ROOT_SCOPED = /(?<![\w.-])(?:var|local|data|terraform)\./;
+const MODULE_REF = /(?<![\w.-])module\.([A-Za-z_][\w-]*)/g;
+
+/** a module call that cannot join a cluster: the proof does not follow a
+ *  relocated call's repetition or provider mapping, and `depends_on` is as
+ *  invisible on a call as on a resource. */
+const CALL_META: ReadonlySet<string> = new Set(["count", "for_each", "providers", "depends_on"]);
 
 /** expressions that cannot survive relocation into a module at all. `path.module`
  *  resolves to the directory the code LIVES in, so moving the code changes its
@@ -120,6 +139,10 @@ export interface MemberResource {
   invisibleMeta: string[];
   /** attributes whose value did not parse to a close — a truncated file. */
   unreadable: string[];
+  /** set on a module CALL (`type` is `module`): the repo-relative directory its
+   *  local source resolves to. Part of the shape key — two calls of different
+   *  modules are not the same shape, whatever their inputs. */
+  call?: { dir: string };
 }
 
 /** Read one directory's resources, values included. */
@@ -146,7 +169,18 @@ function readResources(files: readonly SourceFile[]): MemberResource[] {
           continue;
         }
         if (MODELLED_META.has(entry.name)) continue;
-        if (entry.kind === "dynamic" || entry.value === null) continue;
+        // a `dynamic` block generates nested blocks, so it is judged like one:
+        // carried verbatim when every member writes it alike and it reads
+        // nothing the root keeps, refused otherwise. Skipping it let two roots
+        // whose blocks differed — tcp in one, udp in the other — share one body.
+        if (entry.kind === "dynamic") {
+          const bodies = parseBlocks(block.body, ["dynamic"])
+            .filter((d) => d.labels[0] === entry.name)
+            .map((d) => normaliseValue(d.body));
+          values.set(`dynamic "${entry.name}"`, { kind: "block", text: bodies.join("\n") });
+          continue;
+        }
+        if (entry.value === null) continue;
         if (!entry.complete) {
           unreadable.push(entry.name);
           continue;
@@ -170,6 +204,72 @@ function readResources(files: readonly SourceFile[]): MemberResource[] {
   return out.sort((a, b) => byText(`${a.type}.${a.name}`, `${b.type}.${b.name}`));
 }
 
+/**
+ * Read one root directory's module calls that may join a cluster: a local
+ * source inside the repository and none of [[CALL_META]]. Any other call stays
+ * where it is, exactly as before calls could join — a reference into it crosses
+ * the new module's boundary as an input.
+ */
+function readModuleCalls(dir: string, files: readonly SourceFile[]): MemberResource[] {
+  const out: MemberResource[] = [];
+  for (const file of files) {
+    for (const block of parseBlocks(file.hcl, ["module"])) {
+      const [name] = block.labels;
+      if (!name) continue;
+      const entries = topLevelEntries(block.body);
+      if (entries.some((e) => CALL_META.has(e.name))) continue;
+      const source = entries.find((e) => e.name === "source")?.value?.trim() ?? "";
+      const local = /^"(\.\.?\/[^"$]*)"$/.exec(source)?.[1];
+      if (!local) continue;
+      const target = posix.normalize(posix.join(dir || ".", local)).replace(/\/$/, "");
+      if (target === ".." || target.startsWith("../")) continue;
+      const values = new Map<string, { kind: "attribute" | "block"; text: string }>();
+      const unreadable: string[] = [];
+      for (const entry of entries) {
+        if (entry.name === "source" || entry.value === null) continue;
+        if (!entry.complete) {
+          unreadable.push(entry.name);
+          continue;
+        }
+        values.set(entry.name, {
+          kind: entry.kind === "block" ? "block" : "attribute",
+          text: normaliseValue(entry.value),
+        });
+      }
+      out.push({
+        type: "module",
+        name,
+        argNames: [...values.keys()].sort(),
+        multiplicity: null,
+        values,
+        invisibleMeta: [],
+        unreadable: unreadable.sort(),
+        call: { dir: target },
+      });
+    }
+  }
+  return out;
+}
+
+/** whether a value reaches something that stays in the ROOT when `cluster`
+ *  moves into a module: a variable, local, data source or terraform setting; a
+ *  module call the cluster does not wrap; or a resource the cluster leaves
+ *  behind. Its text may match in every member while its value differs. */
+function isRootScoped(
+  text: string,
+  cluster: readonly MemberResource[],
+  rootAddresses: readonly string[],
+): boolean {
+  if (ROOT_SCOPED.test(text)) return true;
+  const inside = new Set(cluster.map((r) => `${r.type}.${r.name}`));
+  for (const m of text.matchAll(MODULE_REF)) if (!inside.has(`module.${m[1]}`)) return true;
+  return rootAddresses.some(
+    (address) =>
+      !inside.has(address) &&
+      new RegExp(`(?<![\\w.-])${address.replace(/[.]/g, "\\.")}(?![\\w-])`).test(text),
+  );
+}
+
 // --- the shape key ------------------------------------------------------------
 
 /** the multiplicity half of the key — `count`/`for_each` with the expression as
@@ -188,7 +288,8 @@ export function shapeKey(resources: readonly MemberResource[]): string {
   return resources
     .map(
       (r) =>
-        `${r.type}.${r.name}|${[...r.argNames].sort().join(",")}|${multiplicitySignature(r.multiplicity)}`,
+        `${r.type}.${r.name}|${[...r.argNames].sort().join(",")}|${multiplicitySignature(r.multiplicity)}` +
+        (r.call ? `|source=${r.call.dir}` : ""),
     )
     .join("\n");
 }
@@ -216,23 +317,87 @@ interface Cluster {
  * unrelated resources, so requiring whole-directory equality would fire on
  * almost no real repository — while prefix cohesion alone would miss a root
  * whose every resource belongs to the one stack.
+ *
+ * Each comes twice when one of the cluster's resources READS a wrappable module
+ * call: with that call, and without it. Only a call the resources read is
+ * worth wrapping — leaving it behind is what would force the reference across
+ * the new module's boundary. A call that merely takes a cluster resource as an
+ * input (a resource group's name, say) stays in the root: wrapping it with
+ * that resource adds a layer and consolidates nothing.
  */
-function clustersOf(dir: string, resources: MemberResource[]): Cluster[] {
+function clustersOf(
+  dir: string,
+  resources: MemberResource[],
+  calls: MemberResource[] = [],
+): Cluster[] {
   if (resources.length === 0) return [];
-  const out: Cluster[] = [{ dir, prefix: null, resources }];
+  const out: Cluster[] = [];
+  const seen = new Set<string>();
+  const add = (prefix: string | null, members: MemberResource[]) => {
+    // a prefix group equal to the whole directory is the same cluster twice.
+    const key = members.map((m) => `${m.type}.${m.name}`).join("\n");
+    if (seen.has(key)) return;
+    seen.add(key);
+    if (readByLeftBehind(members, [...resources, ...calls])) return;
+    out.push({ dir, prefix, resources: members });
+  };
+  const withReadCalls = (members: MemberResource[]) =>
+    [...members, ...calls.filter((c) => readsCall(members, c.name))].sort((a, b) =>
+      byText(`${a.type}.${a.name}`, `${b.type}.${b.name}`),
+    );
+  add(null, withReadCalls(resources));
+  add(null, resources);
   const byPrefix = new Map<string, MemberResource[]>();
   for (const r of resources) {
     const p = namePrefix(r.name);
     byPrefix.set(p, [...(byPrefix.get(p) ?? []), r]);
   }
   for (const [prefix, members] of [...byPrefix].sort(([a], [b]) => byText(a, b))) {
-    // a prefix group equal to the whole directory is the same cluster twice.
-    if (members.length === resources.length) continue;
-    out.push({ dir, prefix, resources: members });
+    add(prefix, withReadCalls(members));
+    add(prefix, members);
   }
   return out;
 }
 
+/** a reference to `address` (`type.name` or `module.name`) in HCL text. Only
+ *  the `${…}` interpolations of a string literal count: a description that
+ *  mentions an address reads nothing. Hyphens bound a name, as they do in HCL
+ *  identifiers. */
+function readsAddress(text: string, address: string): boolean {
+  const ref = new RegExp(`(?<![\\w.-])${address.replace(/[.-]/g, "\\$&")}\\.`);
+  const code = text.replace(
+    /"((?:[^"\\]|\\.)*)"/g,
+    (_, inner: string) => ` ${[...inner.matchAll(/\$\{([^}]*)\}/g)].map((m) => m[1]).join(" ")} `,
+  );
+  return ref.test(code);
+}
+
+/** whether any of `resources` reads an output of module call `name`. */
+function readsCall(resources: readonly MemberResource[], name: string): boolean {
+  return resources.some((r) =>
+    [...r.values.values()].some((v) => readsAddress(v.text, `module.${name}`)),
+  );
+}
+
+/** whether something the cluster leaves in the root reads one of its members.
+ *  Moved into a module, that member is reachable only through an output, and
+ *  the proposal carries none — so the reference would go stale. */
+function readByLeftBehind(
+  members: readonly MemberResource[],
+  all: readonly MemberResource[],
+): boolean {
+  const addressOf = (m: MemberResource) =>
+    m.type === "module" ? `module.${m.name}` : `${m.type}.${m.name}`;
+  const inside = new Set(members.map(addressOf));
+  return all.some(
+    (other) =>
+      !inside.has(addressOf(other)) &&
+      [...other.values.values()].some((v) =>
+        [...inside].some((address) => readsAddress(v.text, address)),
+      ),
+  );
+}
+
 // --- the group ----------------------------------------------------------------
 
 type VariableClass = "differing" | "reference";
@@ -257,8 +422,20 @@ interface ConsolidationGroup {
    *  path, else null. A LABEL on a group established from content — never the
    *  thing that formed it. */
   pattern: string | null;
-  members: { dir: string; environment: string | null; name_prefix: string | null }[];
+  members: {
+    dir: string;
+    environment: string | null;
+    name_prefix: string | null;
+    /** the `source` this member's call writes: `proposed_module.path` is
+     *  repo-relative, and a local source is relative to the caller. */
+    call_source: string;
+  }[];
+  /** a module CALL the shape includes is here too, as type `module`. */
   resources: { type: string; name: string; arg_names: string[]; multiplicity: string | null }[];
+  /** the module calls the new module wraps: each moves into it keeping its
+   *  name, and `source` is what it writes THERE — relative to the new module's
+   *  directory, not to the roots it came from. */
+  wrapped_calls: { name: string; source: string }[];
   proposed_module: { name: string; path: string; call_name: string };
   /** arguments identical across every member: these go in the module body
    *  verbatim, and are NOT variables. `kind` says whether the text is an
@@ -321,13 +498,24 @@ const MIN_MEMBERS_FOR_SINGLE_RESOURCE = 3;
  *  stack, drifted"; below it they are simply different stacks. */
 const NEAR_OVERLAP = 0.5;
 
-function suggestModuleName(resources: readonly MemberResource[], prefix: string | null): string {
-  if (prefix) return prefix;
+function suggestModuleName(
+  members: readonly MemberResource[],
+  prefix: string | null,
+  taken: ReadonlySet<string>,
+): string {
+  const resources = members.filter((r) => !r.call);
   const names = new Set(resources.map((r) => r.name));
-  if (names.size === 1) return [...names][0] as string;
   // the commonest type's service words, e.g. `aws_s3_bucket` → `s3_bucket`.
-  const type = resources[0]?.type ?? "shared";
-  return type.replace(/^[a-z]+_/, "");
+  const base =
+    prefix ??
+    (names.size === 1
+      ? ([...names][0] as string)
+      : (resources[0]?.type ?? "shared").replace(/^[a-z]+_/, ""));
+  // never a directory the tree already has: the proposal would author into an
+  // existing module — the very one it wraps, when the names coincide.
+  let name = base;
+  for (let i = 2; taken.has(`modules/${name}`); i++) name = `${base}_${i}`;
+  return name;
 }
 
 /**
@@ -342,6 +530,7 @@ function suggestModuleName(resources: readonly MemberResource[], prefix: string
 function classifyEntry(
   kind: "attribute" | "block",
   values: ({ kind: "attribute" | "block"; text: string } | undefined)[],
+  rootScopedIn: (text: string, member: number) => boolean,
 ): { kind: "identical" | "differing" | "reference" } | { kind: "refused"; reason: string } {
   if (values.some((v) => v === undefined)) {
     return { kind: "refused", reason: "not declared by every member" };
@@ -362,7 +551,7 @@ function classifyEntry(
     };
   }
   const identical = new Set(texts).size === 1;
-  const rootScoped = texts.some((t) => ROOT_SCOPED.test(t));
+  const rootScoped = texts.some((t, i) => rootScopedIn(t, i));
   // A NESTED BLOCK can only be carried into the module body VERBATIM. There is
   // no variable that stands in for a block: `versioning_configuration = var.x`
   // is not the block, and parameterising the one attribute inside it that
@@ -374,7 +563,7 @@ function classifyEntry(
       kind: "refused",
       reason: !identical
         ? "it is a nested block whose contents differ between members, and a block cannot be replaced by a variable — parameterise the attribute inside it by hand"
-        : "it is a nested block containing a root-scoped reference (`var.`/`local.`/`data.`/`module.`), which resolves per root and so cannot move into a shared module verbatim",
+        : "it is a nested block containing a root-scoped reference (`var.`/`local.`/`data.`/`module.`, or a resource the module would leave behind), which resolves per root and so cannot move into a shared module verbatim",
     };
   }
   if (rootScoped) return { kind: "reference" };
@@ -398,17 +587,20 @@ export function findConsolidationGroups(
 
   // resources per ROOT directory. A non-root dir has no state of its own, so a
   // `moved {}` block there would name an address in nobody's state.
+  const existingDirs = new Set(byDir.map(([dir]) => dir));
   const resourcesByDir = new Map<string, MemberResource[]>();
+  const callsByDir = new Map<string, MemberResource[]>();
   for (const [dir, dirFiles] of byDir) {
     if (!roots.has(dir)) continue;
     const resources = readResources(dirFiles);
     if (resources.length > 0) resourcesByDir.set(dir, resources);
+    callsByDir.set(dir, readModuleCalls(dir, dirFiles));
   }
 
   // every candidate cluster, keyed by exact shape.
   const byShape = new Map<string, Cluster[]>();
   for (const [dir, resources] of resourcesByDir) {
-    for (const cluster of clustersOf(dir, resources)) {
+    for (const cluster of clustersOf(dir, resources, callsByDir.get(dir))) {
       const key = shapeKey(cluster.resources);
       byShape.set(key, [...(byShape.get(key) ?? []), cluster]);
     }
@@ -441,11 +633,16 @@ export function findConsolidationGroups(
       break;
     }
     const dirs = clusters.map((c) => c.dir).sort(byText);
+    // a cluster wrapping module calls is the wider of two offers for the same
+    // roots. When it cannot be proposed it neither declines nor claims them:
+    // the cluster without the calls comes next and speaks for those roots.
+    const wraps = first.resources.some((r) => r.call);
 
     const meta = [
       ...new Set(clusters.flatMap((c) => c.resources.flatMap((r) => r.invisibleMeta))),
     ].sort();
     if (meta.length > 0) {
+      if (wraps) continue;
       declined.push({
         dirs,
         reason:
@@ -461,6 +658,7 @@ export function findConsolidationGroups(
       ...new Set(clusters.flatMap((c) => c.resources.flatMap((r) => r.unreadable))),
     ].sort();
     if (unreadable.length > 0) {
+      if (wraps) continue;
       declined.push({
         dirs,
         reason: `the value of \`${unreadable.join("`, `")}\` could not be read to a close (a truncated or malformed file), and a value nobody read cannot be compared`,
@@ -490,6 +688,12 @@ export function findConsolidationGroups(
         const verdict = classifyEntry(
           entry.kind,
           perMember.map((p) => p.value),
+          (text, i) =>
+            isRootScoped(
+              text,
+              ordered[i]?.resources ?? [],
+              (resourcesByDir.get(ordered[i]?.dir ?? "") ?? []).map((r) => `${r.type}.${r.name}`),
+            ),
         );
         if (verdict.kind === "refused") {
           refusals.push(`${address}.${argument}: ${verdict.reason}`);
@@ -517,6 +721,7 @@ export function findConsolidationGroups(
     }
 
     if (refusals.length > 0) {
+      if (wraps) continue;
       declined.push({ dirs, reason: refusals.join("; ") });
       for (const c of clusters) claimed.add(c.dir);
       continue;
@@ -532,8 +737,10 @@ export function findConsolidationGroups(
     // name, so the type qualifier alone still collides and the agent would author
     // two `variable` blocks with one name — invalid HCL. Escalate those to the
     // resource's own name, which is unique within a directory by definition.
+    // A module call has no type worth naming, so its own name stands in.
     const qualify = (v: ConsolidationVariable, by: "type" | "address") => {
       const [type = "", name = ""] = v.resource.split(".");
+      if (type === "module") return `${name}_${v.argument}`;
       const short = type.replace(/^[a-z]+_/, "");
       const prefix = by === "type" ? short : `${short}_${name}`;
       return `${prefix}_${v.argument}`;
@@ -554,7 +761,7 @@ export function findConsolidationGroups(
       v.name = qualify(v, "address");
     }
 
-    const moduleName = suggestModuleName(first.resources, first.prefix);
+    const moduleName = suggestModuleName(first.resources, first.prefix, existingDirs);
     const callName = moduleName;
     groups.push({
       pattern: twin?.pattern ?? null,
@@ -562,6 +769,7 @@ export function findConsolidationGroups(
         dir: c.dir,
         environment: twin?.members.find((m) => m.dir === c.dir)?.environment ?? null,
         name_prefix: c.prefix,
+        call_source: localSourceFrom(c.dir, `modules/${moduleName}`),
       })),
       resources: first.resources.map((r) => ({
         type: r.type,
@@ -569,6 +777,11 @@ export function findConsolidationGroups(
         arg_names: r.argNames,
         multiplicity: r.multiplicity ? multiplicitySignature(r.multiplicity) : null,
       })),
+      wrapped_calls: first.resources.flatMap((r) =>
+        r.call
+          ? [{ name: r.name, source: localSourceFrom(`modules/${moduleName}`, r.call.dir) }]
+          : [],
+      ),
       proposed_module: {
         name: moduleName,
         path: `./modules/${moduleName}`,

package/src/mcp/terraform/cost.ts

@@ -3,7 +3,7 @@ import { join } from "node:path";
 import { type } from "arktype";
 import { resolveBaseRef } from "#app/mcp/terraform/paths";
 import { parseScannerJson } from "#app/mcp/terraform/scannerJson";
-import { type RunResult, run } from "#app/mcp/terraform/subprocess";
+import { type RunResult, run, runAsync } from "#app/mcp/terraform/subprocess";
 import { assertToolchainIntegrity } from "#app/mcp/terraform/toolchainIntegrity";
 
 // --- infracost (cost lens) ------------------------------------------------
@@ -132,16 +132,21 @@ export function classifyCostEscalation(
   return { escalate: false };
 }
 
-export function runInfracostBreakdown(scanCwd: string, key: string): RunResult {
+export function runInfracostBreakdown(scanCwd: string, key: string): Promise<RunResult> {
   // Same supply-chain posture as trivy/tflint/checkov: probe the version and
   // refuse a denylisted build BEFORE handing the binary a credential. There is
   // no infracost advisory today, so this is a no-op gate — but it records the
   // observed version for evidence provenance, and a future advisory needs only
   // a denylist row (the stated rationale for probing checkov).
   assertToolchainIntegrity("infracost", scanCwd);
-  return run("infracost", ["breakdown", "--path", ".", "--format", "json", "--no-color"], scanCwd, {
-    INFRACOST_API_KEY: key,
-  });
+  return runAsync(
+    "infracost",
+    ["breakdown", "--path", ".", "--format", "json", "--no-color"],
+    scanCwd,
+    {
+      INFRACOST_API_KEY: key,
+    },
+  );
 }
 
 /**
@@ -150,7 +155,11 @@ export function runInfracostBreakdown(scanCwd: string, key: string): RunResult {
  * any failure (no base ref, worktree add fails, infracost errors) returns null
  * and the caller falls back to reporting current cost only.
  */
-export function infracostBaseline(cwd: string, key: string, tmpdir: string): CostBreakdown | null {
+export async function infracostBaseline(
+  cwd: string,
+  key: string,
+  tmpdir: string,
+): Promise<CostBreakdown | null> {
   const baseRef = resolveBaseRef(cwd);
   if (!baseRef) return null;
   const prefixResult = run("git", ["rev-parse", "--show-prefix"], cwd);
@@ -170,7 +179,7 @@ export function infracostBaseline(cwd: string, key: string, tmpdir: string): Cos
   }
   try {
     const scanCwd = prefix ? join(worktree, prefix) : worktree;
-    const r = runInfracostBreakdown(scanCwd, key);
+    const r = await runInfracostBreakdown(scanCwd, key);
     if (r.missing || r.status !== 0) return null;
     return parseInfracostBreakdown(r.stdout);
   } catch {

package/src/mcp/terraform/cspm.ts

@@ -1,4 +1,5 @@
 import { type } from "arktype";
+import { BLOCK_LABEL, unquoteLabel } from "#app/mcp/terraform/hcl";
 import { buildConcern, type Concern, type Severity } from "#app/mcp/terraform/types";
 import { neutralizeOptional } from "#app/mcp/untrustedContent";
 
@@ -89,7 +90,10 @@ export interface TfResourceEntry {
   identifiers: string[];
 }
 
-const RESOURCE_HEADER = /(^|\n)([ \t]*)resource\s+"([^"]+)"\s+"([^"]+)"\s*\{/g;
+const RESOURCE_HEADER = new RegExp(
+  String.raw`(^|\n)([ \t]*)resource\s+(${BLOCK_LABEL})\s+(${BLOCK_LABEL})\s*\{`,
+  "g",
+);
 
 /** Collect the string literals inside the block that opens at `openBraceIdx`, scanning
  *  to the matching close brace (approximate — good enough to correlate an id/ARN). */
@@ -127,9 +131,9 @@ export function indexTfResources(
     let m: RegExpExecArray | null;
     // biome-ignore lint/suspicious/noAssignInExpressions: idiomatic regex-exec iteration
     while ((m = RESOURCE_HEADER.exec(hcl)) !== null) {
-      const type = m[3];
-      const name = m[4];
-      if (type === undefined || name === undefined) continue;
+      if (m[3] === undefined || m[4] === undefined) continue;
+      const type = unquoteLabel(m[3]);
+      const name = unquoteLabel(m[4]);
       const headerStart = m.index + (m[1] ? m[1].length : 0);
       const line = hcl.slice(0, headerStart).split("\n").length;
       const openBraceIdx = hcl.indexOf("{", m.index);

package/src/mcp/terraform/currency.ts

@@ -26,7 +26,7 @@ import {
   getMajor,
   getMinor,
   getPrerelease,
-  isLess,
+  isLessThan,
   normalize,
   sortReversed,
 } from "verkit";
@@ -103,6 +103,12 @@ export interface CurrencyVerdict {
   /** how many MAJORs the constraint's best version trails the latest by —
    * >0 signals an interface-risk upgrade that must be `needs-human`. */
   majorsBehind: number;
+  /** the newest stable version in the major the constraint already admits,
+   * when the constraint does not admit it — the upgrade that crosses no major.
+   * An exact pin `3.15.1` with `3.15.2` published is outdated even when the
+   * latest release is two majors on; reporting only `latest` hides the one
+   * bump that needs nobody's sign-off. Null when there is none. */
+  latestInMajor: string | null;
 }
 
 /** drop non-semver tokens and prereleases; registries publish plain versions
@@ -135,22 +141,22 @@ export function classifyCurrency(params: {
 }): CurrencyVerdict {
   const versions = stableVersions(params.available);
   const latest = versions.length > 0 ? (sortReversed(versions)[0] ?? null) : null;
-  if (latest === null) {
-    return { latest: null, newestSatisfying: null, outdated: false, majorsBehind: 0 };
-  }
-  if (params.constraint === null) {
-    return { latest, newestSatisfying: null, outdated: false, majorsBehind: 0 };
-  }
+  const unknown = { newestSatisfying: null, outdated: false, majorsBehind: 0, latestInMajor: null };
+  if (latest === null) return { latest: null, ...unknown };
+  if (params.constraint === null) return { latest, ...unknown };
   const range = terraformConstraintToRange(params.constraint);
-  if (range === null) {
-    return { latest, newestSatisfying: null, outdated: false, majorsBehind: 0 };
-  }
+  if (range === null) return { latest, ...unknown };
   const newestSatisfying = findMaxSatisfying(versions, range);
-  const outdated = newestSatisfying === null || isLess(newestSatisfying, latest);
+  const outdated = newestSatisfying === null || isLessThan(newestSatisfying, latest);
   const majorsBehind = newestSatisfying
     ? Math.max(0, getMajor(latest) - getMajor(newestSatisfying))
     : Math.max(0, getMajor(latest));
-  return { latest, newestSatisfying, outdated, majorsBehind };
+  const sameMajor = newestSatisfying
+    ? sortReversed(versions.filter((v) => getMajor(v) === getMajor(newestSatisfying)))[0]
+    : undefined;
+  const latestInMajor =
+    newestSatisfying && sameMajor && isLessThan(newestSatisfying, sameMajor) ? sameMajor : null;
+  return { latest, newestSatisfying, outdated, majorsBehind, latestInMajor };
 }
 
 // --- registry lookups (I/O) --------------------------------------------------
@@ -386,6 +392,8 @@ interface ProviderCurrencyRow {
   constraint: string | null;
   latest: string | null;
   newest_satisfying: string | null;
+  /** see {@link CurrencyVerdict.latestInMajor}. */
+  latest_in_major: string | null;
   outdated: boolean;
   majors_behind: number;
   lookup: LookupStatus;
@@ -397,7 +405,10 @@ interface ModuleCurrencyRow {
   version: string | null;
   latest: string | null;
   newest_satisfying: string | null;
+  /** see {@link CurrencyVerdict.latestInMajor}. */
+  latest_in_major: string | null;
   outdated: boolean;
+  majors_behind: number;
   /** registry module with no `version` attribute — pin it (to `latest`). */
   unpinned: boolean;
   lookup: ModuleLookupStatus;
@@ -474,6 +485,7 @@ export async function checkVersionCurrency(
       constraint: req.version,
       latest: verdict.latest,
       newest_satisfying: verdict.newestSatisfying,
+      latest_in_major: verdict.latestInMajor,
       outdated: result.status === "ok" && verdict.outdated,
       majors_behind: result.status === "ok" ? verdict.majorsBehind : 0,
       lookup: result.status,
@@ -491,7 +503,9 @@ export async function checkVersionCurrency(
       version: mod.version,
       latest: verdict.latest,
       newest_satisfying: verdict.newestSatisfying,
+      latest_in_major: verdict.latestInMajor,
       outdated: result.status === "ok" && verdict.outdated,
+      majors_behind: result.status === "ok" ? verdict.majorsBehind : 0,
       unpinned: mod.version === null,
       lookup: result.status,
       declared_in: mod.declaredIn,
@@ -513,7 +527,9 @@ export async function checkVersionCurrency(
       version: mod.version,
       latest: null,
       newest_satisfying: null,
+      latest_in_major: null,
       outdated: false,
+      majors_behind: 0,
       // `unpinned` means "pin it to latest" — advice that cannot apply to a
       // source that resolves to nothing; the row's lookup status carries why.
       unpinned: false,

package/src/mcp/terraform/decisions.ts

@@ -546,7 +546,7 @@ export function preventiveControlFor(
         snippet: [
           "# .github/workflows/infraweaver-pr-gate.yml",
           "- id: assess",
-          "  uses: infraweaver-io/infraweaver-action@main",
+          "  uses: infraweaver-io/infraweaver-action@v0.3",
           "  with:",
           "    mode: assess",
           "- if: steps.assess.outputs.findings-gate == 'fail'",