infraweaver 0.3.7 → 0.3.9

package/src/mcp/terraform/deltaSummary.ts

@@ -8,7 +8,13 @@
  */
 import { packControlsForConcern, requiredControlViolations } from "#app/mcp/crosswalk";
 import { evaluateGate } from "#app/mcp/terraform/baseline";
-import type { DeltaFinding, GateDelta } from "#app/mcp/terraform/scanDelta";
+import { count } from "#app/mcp/terraform/prose";
+import {
+  type DeltaFinding,
+  type GateDelta,
+  type UndeclaredRename,
+  undeclaredRenames,
+} from "#app/mcp/terraform/scanDelta";
 import { SEVERITY_RANK } from "#app/mcp/terraform/types";
 import { neutralizeMarkup } from "#app/mcp/untrustedContent";
 
@@ -50,6 +56,47 @@ export function deltaVerdict(delta: GateDelta, requiredControls: string[]): Delt
   };
 }
 
+/** Whether one introduced finding fails the gate on its own — the same two
+ *  halves `deltaVerdict` applies to the whole delta. */
+export function failsGate(finding: DeltaFinding, requiredControls: string[]): boolean {
+  return (
+    !evaluateGate([finding.concern], null).pass ||
+    requiredControlViolations([finding.concern], requiredControls).length > 0
+  );
+}
+
+/** Renames a paragraph names before summarising the rest as a count. */
+const MAX_RENAMES_NAMED = 5;
+
+/**
+ * The undeclared renames in a delta as one paragraph — what happened, what it
+ * costs at apply, and the one thing to do about it — or "" when there are none.
+ * `fmt` code-spans a value the way the caller's surface does: every address and
+ * directory came out of the PR's own files.
+ */
+export function renderUndeclaredRenames(
+  renames: readonly UndeclaredRename[],
+  fmt: (text: string) => string,
+): string {
+  if (renames.length === 0) return "";
+  const one = renames.length === 1;
+  const named = renames.slice(0, MAX_RENAMES_NAMED).map((r) => {
+    const what =
+      r.from.address === r.to.address
+        ? `${fmt(r.to.address)} moved from ${fmt(r.from.dir || ".")} to ${fmt(r.to.dir || ".")}`
+        : `${fmt(r.from.address)} → ${fmt(r.to.address)}`;
+    return `${what} (${count(r.findings, "finding")})`;
+  });
+  const rest = renames.length - named.length;
+  return (
+    `**${count(renames.length, "resource")} ${one ? "looks" : "look"} renamed without a \`moved\` block:** ` +
+    `${named.join(", ")}${rest > 0 ? `, and ${rest} more` : ""}. ` +
+    `Without ${one ? "one" : "them"}, \`terraform apply\` destroys the old resource and creates the new one, ` +
+    `and every finding on it counts as new. Add a \`moved { from = … to = … }\` block for ${one ? "it" : "each"} ` +
+    "and those findings match their base instead."
+  );
+}
+
 /** The compliance controls the introduced findings touch, sorted and unique. */
 export function controlsTouched(findings: readonly DeltaFinding[]): string[] {
   return [...new Set(findings.flatMap((f) => packControlsForConcern(f.concern)))].sort();
@@ -88,6 +135,8 @@ export function renderDeltaSummary(input: {
     ].filter(Boolean);
     lines.push("", `The gate fails on ${why.join(" and ")}.`);
   }
+  const renames = renderUndeclaredRenames(undeclaredRenames(delta.introduced), cell);
+  if (renames) lines.push("", renames);
   const controls = controlsTouched(delta.introduced);
   if (controls.length > 0) lines.push("", `Controls touched: ${controls.map(cell).join(", ")}`);
   if (delta.introduced.length > 0) {

package/src/mcp/terraform/emittedArtefacts.ts

@@ -0,0 +1,63 @@
+/**
+ * The compliance artefacts this run's emit tools wrote, and whether a push
+ * carries them exactly as written.
+ *
+ * `terraform_emit_evidence` (and the OSCAL and VEX emitters) write into the
+ * workspace — `compliance/…` by default — because the artefact is meant to be
+ * committed beside the change it describes: a Refactor PR names its evidence
+ * bundle so a reviewer can run `verify-evidence` on it. A guarded mode's push is
+ * Terraform-only, which refused that file and sent the agent into untracking it.
+ *
+ * Opening `compliance/**` would let the agent commit anything there. What is
+ * admitted instead is narrower: a path one of these tools wrote this run, with
+ * the bytes it wrote. An edited artefact, or a file that only looks like one,
+ * is still refused.
+ */
+import { createHash } from "node:crypto";
+import { writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { scanSessionOf } from "#app/mcp/terraform/scanSession";
+
+/** the directory every emit tool writes to by default, repo-relative. */
+const ARTEFACT_DIR = "compliance/";
+
+/** The id git gives a blob with these contents — what `git rev-parse HEAD:<path>` prints. */
+export function gitBlobId(bytes: string): string {
+  const content = Buffer.from(bytes, "utf8");
+  return createHash("sha1").update(`blob ${content.length}\0`).update(content).digest("hex");
+}
+
+/** Write an emit tool's artefact to `path` (absolute) and remember the bytes written. */
+export function writeEmittedArtefact(
+  toolState: Parameters<typeof scanSessionOf>[0],
+  path: string,
+  bytes: string,
+): void {
+  writeFileSync(path, bytes);
+  const session = scanSessionOf(toolState);
+  session.emittedArtefacts ??= {};
+  const written = session.emittedArtefacts;
+  const key = resolve(path);
+  // every version: an emit re-run after the first was committed leaves the
+  // commit holding the earlier bytes, which the tool wrote just the same
+  written[key] = [...new Set([...(written[key] ?? []), gitBlobId(bytes)])];
+}
+
+/**
+ * True when `file` — repo-relative, as `git diff` names it — is an artefact an
+ * emit tool wrote this run and `committedBlob` (its blob id at the pushed
+ * commit, null when absent) is one of the versions it wrote.
+ */
+export function isUnchangedEmittedArtefact(
+  toolState: Parameters<typeof scanSessionOf>[0],
+  repoTop: string,
+  file: string,
+  committedBlob: string | null,
+): boolean {
+  // only where the emit tools write by default: an `output_path` aimed at
+  // `.github/CODEOWNERS` or `package.json` would otherwise replace that file
+  // with an artefact and pass as "committed as emitted"
+  if (!file.startsWith(ARTEFACT_DIR)) return false;
+  const written = scanSessionOf(toolState).emittedArtefacts?.[resolve(repoTop, file)];
+  return committedBlob !== null && (written?.includes(committedBlob) ?? false);
+}

package/src/mcp/terraform/evidence.ts

@@ -311,6 +311,23 @@ export interface RefactorEquivalenceInput {
   values_verified?: number;
 }
 
+/**
+ * What a proposed-unproven change IS, named from the mode that made it. The
+ * agent's flag says only that the change is unproven; a signed statement that
+ * called a version bump a module adoption would misdescribe the artefact it
+ * signs.
+ */
+export function proposedChangeOf(mode: string | undefined): string {
+  switch (mode) {
+    case "UpdateDependencies":
+      return "dependency version change";
+    case "ModernizeDeprecated":
+      return "deprecated-pattern migration";
+    default:
+      return "third-party-module adoption";
+  }
+}
+
 /**
  * Build the refactor evidence statement (pure). Returns undefined when nothing
  * refactor-related happened (no equivalence proof, not a proposed-unproven b.4,
@@ -330,8 +347,12 @@ export function buildRefactorStatement(args: {
     | undefined;
   /** the agent recorded the reviewed-plan outcome (b.4 with credentials). */
   reviewedPlan?: boolean;
+  /** what the unproven change is (`proposedChangeOf`); a module adoption when
+   * absent. */
+  change?: string;
 }): EvidenceRefactorStatement | undefined {
   const { equivalence, provenance, proposedUnproven, planTotals, reviewedPlan } = args;
+  const change = args.change ?? proposedChangeOf(undefined);
   if (!equivalence && !proposedUnproven && !reviewedPlan && provenance.length === 0)
     return undefined;
 
@@ -371,14 +392,13 @@ export function buildRefactorStatement(args: {
     if (planTotals) {
       asserts =
         "nothing about runtime behaviour beyond what the recorded terraform plan shows — this " +
-        "module adoption is behaviour-ALTERING and ships for human review of that plan.";
+        `${change} is behaviour-ALTERING and ships for human review of that plan.`;
       doesNotAssert =
         "behaviour-equivalence (it alters behaviour and is not claimed equivalent). A terraform " +
         `plan WAS recorded (+${planTotals.to_add} ~${planTotals.to_change} -${planTotals.to_destroy}); ` +
         "the claim rests on a human reviewing that delta, which this bundle cannot assert.";
     } else {
-      asserts =
-        "nothing about runtime behaviour — this third-party-module adoption is PROPOSED only and was not verified against a plan.";
+      asserts = `nothing about runtime behaviour — this ${change} is PROPOSED only and was not verified against a plan.`;
       doesNotAssert =
         "behaviour-equivalence (it alters behaviour and is not claimed equivalent); no terraform plan was run.";
     }

package/src/mcp/terraform/gateScan.ts

@@ -4,6 +4,7 @@ import type { LocalToolContext } from "#app/mcp/localContext";
 import { walkTfFiles } from "#app/mcp/modules";
 import { loadBaselineForRun, loadResolvedLedger } from "#app/mcp/terraform/baseline";
 import { annotateConcerns } from "#app/mcp/terraform/concernResult";
+import { initArtefacts, removeNewInitArtefacts } from "#app/mcp/terraform/initArtefacts";
 import { lineageResolver, repoFileReader } from "#app/mcp/terraform/lineage";
 import {
   computeScanDelta,
@@ -14,10 +15,12 @@ import {
   parseMovedBlocks,
 } from "#app/mcp/terraform/scanDelta";
 import { runScannersCached } from "#app/mcp/terraform/scannerCache";
-import { changedTerraformFiles, resetTerraformInitCache } from "#app/mcp/terraform/scanners";
+import { changedTerraformFiles } from "#app/mcp/terraform/scanners";
 import { scanSessionOf } from "#app/mcp/terraform/scanSession";
+import { scanAddedSecrets } from "#app/mcp/terraform/secretScan";
 import { run } from "#app/mcp/terraform/subprocess";
 import { inChangedFiles, type ScanScanners } from "#app/mcp/terraform/tools/scan";
+import { scopeFor, treeLayout } from "#app/mcp/terraform/treeLayout";
 import {
   type Concern,
   isReviewedTerraformFile,
@@ -53,11 +56,10 @@ const realScanners: ScanScanners = { runScannersCached, changedTerraformFiles };
 export async function runGateScan(
   ctx: LocalToolContext,
   scanners: ScanScanners = realScanners,
-  isTerraform?: (c: Concern) => boolean,
 ): Promise<Concern[] | undefined> {
   const cwd = ctx.payload.cwd ?? process.cwd();
   if (walkTfFiles(cwd).length === 0) return undefined;
-  return scanTree(ctx, cwd, diffScope(ctx, cwd, scanners), scanners, isTerraform);
+  return scanTree(ctx, cwd, diffScope(ctx, cwd, scanners), scanners);
 }
 
 /** What a pull-request review judges: its own file scope, JSON syntax included. */
@@ -68,13 +70,17 @@ function diffScope(ctx: LocalToolContext, cwd: string, scanners: ScanScanners):
   return (ctx.payload.scanScope ?? "full") === "diff" ? scanners.changedTerraformFiles(cwd) : null;
 }
 
-/** One gate-configured scan of the tree at `cwd`, kept to `changed` when set. */
+/**
+ * One gate-configured scan of the tree at `cwd`, kept to `changed` when set.
+ * `scope` limits it to those directories (`scopeFor`).
+ */
 async function scanTree(
   ctx: LocalToolContext,
   cwd: string,
   changed: Set<string> | null,
   scanners: ScanScanners,
   isTerraform?: (c: Concern) => boolean,
+  scope?: string[],
 ): Promise<Concern[]> {
   const outcomes = await scanners.runScannersCached(cwd, {
     selection: resolveToolSelection(ctx.payload),
@@ -82,6 +88,8 @@ async function scanTree(
     downloadExternalModules: undefined,
     toolsNetwork: ctx.payload.toolsNetwork,
     repeatedLiteralThreshold: ctx.payload.repeatedLiteralThreshold,
+    varFiles: ctx.payload.varFiles,
+    ...(scope ? { scope } : {}),
   });
 
   const threshold = (ctx.payload.severityThreshold as Severity | undefined) ?? "low";
@@ -91,25 +99,27 @@ async function scanTree(
   );
 }
 
+/** The PR's base, checked out beside the head. */
+interface BaseCheckout {
+  mergeBase: string;
+  cwd: string;
+  close: () => void;
+}
+
 /**
- * The scan delta of a pull request: the base scanned with the same scanners and
- * configuration as the head, in a detached worktree so the checkout the agent
- * works in is never touched, and the two concern sets matched (`scanDelta.ts`).
- *
- * The base is the merge base of the PR's base commit and HEAD, which is the base
- * commit itself on GitHub's `refs/pull/N/merge` checkout and the fork point on a
- * head checkout — "what this PR changed" either way.
- *
- * Undefined when the base commit is not in the clone (a shallow checkout) or the
- * worktree cannot be made. The run then gates as it always has, and says why.
+ * Check out the base of a pull request in a detached worktree, so the checkout
+ * the agent works in is never touched. The base is the merge base of the PR's
+ * base commit and HEAD, which is the base commit itself on GitHub's
+ * `refs/pull/N/merge` checkout and the fork point on a head checkout — "what
+ * this PR changed" either way. Undefined when the base commit is not in the
+ * clone (a shallow checkout) or the worktree cannot be made: the run then
+ * gates as it always has, and says why.
  */
-export async function runScanDelta(
-  ctx: LocalToolContext,
-  pr: Pick<PullRequestRunContext, "baseSha" | "headSha">,
-  headConcerns: Concern[],
-  scanners: ScanScanners = realScanners,
-): Promise<GateDelta | undefined> {
-  const cwd = ctx.payload.cwd ?? process.cwd();
+function checkOutBase(
+  cwd: string,
+  pr: Pick<PullRequestRunContext, "baseSha">,
+  tmp: string,
+): BaseCheckout | undefined {
   if (run("git", ["cat-file", "-e", `${pr.baseSha}^{commit}`], cwd).status !== 0) {
     log.warning(
       `» scan delta: base commit ${pr.baseSha.slice(0, 7)} is not in this clone — ` +
@@ -119,59 +129,169 @@ export async function runScanDelta(
   }
   const mergeBase = run("git", ["merge-base", pr.baseSha, "HEAD"], cwd).stdout.trim() || pr.baseSha;
   const prefix = run("git", ["rev-parse", "--show-prefix"], cwd).stdout.trim();
-
   // a fresh parent from mkdtemp, the worktree in a not-yet-existing child: git
   // refuses to add a worktree at a path that exists, and a predictable name is
   // one a local actor could pre-create.
-  const parent = mkdtempSync(join(ctx.tmpdir, "scan-delta-base-"));
+  const parent = mkdtempSync(join(tmp, "scan-delta-base-"));
   const worktree = join(parent, "wt");
   if (run("git", ["worktree", "add", "--detach", worktree, mergeBase], cwd).status !== 0) {
     rmSync(parent, { recursive: true, force: true });
     log.warning("» scan delta: could not check out the base — every finding is treated as new.");
     return undefined;
   }
-  const started = Date.now();
+  return {
+    mergeBase,
+    cwd: prefix ? join(worktree, prefix) : worktree,
+    close: () => {
+      run("git", ["worktree", "remove", "--force", worktree], cwd);
+      rmSync(parent, { recursive: true, force: true });
+    },
+  };
+}
+
+/** Every file the PR changed, relative to `cwd`; null when git cannot say. */
+function changedSince(cwd: string, mergeBase: string): string[] | null {
+  const diff = run("git", ["diff", "--name-only", "--no-renames", mergeBase, "HEAD"], cwd);
+  if (diff.status !== 0) return null;
+  const prefix = run("git", ["rev-parse", "--show-prefix"], cwd).stdout.trim();
+  return diff.stdout
+    .split("\n")
+    .map((f) => f.trim())
+    .filter((f) => f !== "" && f.startsWith(prefix))
+    .map((f) => f.slice(prefix.length));
+}
+
+/**
+ * The directories both scans of a review cover: the root modules the PR's
+ * changes reach, on either side, with their local modules. A root the PR cannot
+ * reach has the same findings on both sides, so scanning it changes no count
+ * the review reports or the gate judges — only how long it takes. Undefined
+ * (the whole tree) when the change cannot be attributed.
+ */
+function reviewScope(ctx: LocalToolContext, cwd: string, base: BaseCheckout): string[] | undefined {
+  const changed = changedSince(cwd, base.mergeBase);
+  if (!changed) return undefined;
+  const head = treeLayout(cwd, ctx.payload.varFiles);
+  const scope = scopeFor([head, treeLayout(base.cwd, ctx.payload.varFiles)], changed);
+  if (!scope) {
+    log.info("» scan delta: a scanner setting changed — scanning every root module");
+    return undefined;
+  }
+  const reached = head.roots.filter((r) => scope.includes(r.dir)).length;
+  log.info(
+    `» scan delta: scanning the ${reached} of ${head.roots.length} root module(s) this change reaches`,
+  );
+  return scope;
+}
+
+/**
+ * The head and base scans of a pull request, run together and over the same
+ * scope, and the delta between them (`scanDelta.ts`). Undefined when the
+ * checkout has no Terraform. No delta when the base could not be checked out
+ * or scanned: the run then gates every finding, as a run without one always has.
+ */
+async function reviewScans(
+  ctx: LocalToolContext,
+  pr: Pick<PullRequestRunContext, "baseSha" | "headSha">,
+  scanners: ScanScanners,
+): Promise<{ head: Concern[]; delta?: GateDelta } | undefined> {
+  const cwd = ctx.payload.cwd ?? process.cwd();
+  if (walkTfFiles(cwd).length === 0) return undefined;
+  const base = checkOutBase(cwd, pr, ctx.tmpdir);
   try {
-    const baseCwd = prefix ? join(worktree, prefix) : worktree;
     const changed = diffScope(ctx, cwd, scanners);
-    const baseConcerns = existsSync(baseCwd)
-      ? await scanTree(ctx, baseCwd, changed, scanners, reviewedConcern)
-      : [];
-    const moved = new Map<string, MovedBlock[]>();
-    const modules = new Map<string, Map<string, string>>();
-    const addresses = new Map<string, Set<string>>();
-    const readHead = repoFileReader(cwd);
-    for (const rel of walkTfFiles(cwd)) {
-      const src = readHead(rel);
-      if (src === null) continue;
-      const dir = posix.dirname(rel.replace(/\\/g, "/"));
-      const key = dir === "." ? "" : dir;
-      moved.set(key, [...(moved.get(key) ?? []), ...parseMovedBlocks(src)]);
-      modules.set(key, new Map([...(modules.get(key) ?? []), ...localModuleSources(src)]));
-      const set = addresses.get(key) ?? new Set<string>();
-      for (const a of declaredAddresses(src)) set.add(a);
-      addresses.set(key, set);
+    const scope = base ? reviewScope(ctx, cwd, base) : undefined;
+    const started = Date.now();
+    const scanBase = async (b: BaseCheckout) =>
+      existsSync(b.cwd) ? scanTree(ctx, b.cwd, changed, scanners, reviewedConcern, scope) : [];
+    // settled, not `all`: a failed head scan must not leave the base scanning
+    // a worktree the `finally` below removes
+    const [head, baseScan, secrets] = await Promise.allSettled([
+      scanTree(ctx, cwd, changed, scanners, reviewedConcern, scope),
+      base ? scanBase(base) : Promise.resolve([]),
+      secretsOf(ctx, cwd, base),
+    ]);
+    if (head.status === "rejected") throw head.reason;
+    if (!base) return { head: head.value };
+    const added = secrets.status === "fulfilled" ? secrets.value : [];
+    if (baseScan.status === "rejected") {
+      log.warning(
+        `» scan delta: base scan failed, every finding is treated as new — ${baseScan.reason}`,
+      );
+      return { head: head.value };
     }
-    const delta = computeScanDelta({
-      base: baseConcerns.filter((c) => !c.suppression),
-      head: headConcerns.filter((c) => !c.suppression),
-      readBase: repoFileReader(baseCwd),
-      readHead,
-      moved,
-      moduleSources: (dir) => modules.get(dir) ?? new Map(),
-      headAddresses: (dir) => addresses.get(dir) ?? new Set(),
-    });
+    const delta = deltaOf(cwd, base, head.value, baseScan.value);
+    // every secret the PR's commits add is introduced by the PR
+    delta.introduced.push(...added.map((concern) => ({ concern, address: null })));
     log.info(
       `» scan delta: ${delta.introduced.length} introduced, ${delta.resolved.length} resolved, ` +
-        `${delta.unchanged.length} unchanged vs ${mergeBase.slice(0, 7)} (base scan ${Date.now() - started}ms)`,
+        `${delta.unchanged.length} unchanged vs ${base.mergeBase.slice(0, 7)} ` +
+        `(base and head scanned in ${Date.now() - started}ms)`,
     );
-    return { ...delta, baseSha: mergeBase, headSha: pr.headSha };
+    return {
+      head: [...head.value, ...added],
+      delta: { ...delta, baseSha: base.mergeBase, headSha: pr.headSha },
+    };
   } finally {
-    run("git", ["worktree", "remove", "--force", worktree], cwd);
-    rmSync(parent, { recursive: true, force: true });
+    base?.close();
   }
 }
 
+/**
+ * The secrets the PR's commits add, when `tools_enabled` names betterleaks
+ * (`secretScan.ts`): in every file the PR changes, not only Terraform, with the
+ * gate's threshold and the repository's suppressions applied.
+ */
+async function secretsOf(
+  ctx: LocalToolContext,
+  cwd: string,
+  base: BaseCheckout | undefined,
+): Promise<Concern[]> {
+  if (!resolveToolSelection(ctx.payload).enabled("betterleaks")) return [];
+  if (!base) {
+    log.info("» betterleaks: no base commit to scan from — secrets were not scanned");
+    return [];
+  }
+  const scan = await scanAddedSecrets(cwd, base.mergeBase, ctx.tmpdir);
+  // a scan that did not finish still reports what it found
+  if (!scan.ran) log.warning(`» betterleaks did not run fully — ${scan.reason}`);
+  log.info(`» betterleaks: ${scan.concerns.length} secret(s) added by this pull request`);
+  const threshold = (ctx.payload.severityThreshold as Severity | undefined) ?? "low";
+  return annotateConcerns(scan.concerns, {
+    cwd,
+    minRank: SEVERITY_RANK[threshold],
+    isTerraform: () => true,
+  });
+}
+
+/** Match the two scans (`scanDelta.ts`), with what the head's configuration says moved. */
+function deltaOf(cwd: string, base: BaseCheckout, head: Concern[], baseConcerns: Concern[]) {
+  const moved = new Map<string, MovedBlock[]>();
+  const modules = new Map<string, Map<string, string>>();
+  const addresses = new Map<string, Set<string>>();
+  const readHead = repoFileReader(cwd);
+  for (const rel of walkTfFiles(cwd)) {
+    const src = readHead(rel);
+    if (src === null) continue;
+    const dir = posix.dirname(rel.replace(/\\/g, "/"));
+    const key = dir === "." ? "" : dir;
+    moved.set(key, [...(moved.get(key) ?? []), ...parseMovedBlocks(src)]);
+    modules.set(key, new Map([...(modules.get(key) ?? []), ...localModuleSources(src)]));
+    const set = addresses.get(key) ?? new Set<string>();
+    for (const a of declaredAddresses(src)) set.add(a);
+    addresses.set(key, set);
+  }
+  return computeScanDelta({
+    base: baseConcerns.filter((c) => !c.suppression),
+    head: head.filter((c) => !c.suppression),
+    readBase: repoFileReader(base.cwd),
+    readHead,
+    moved,
+    moduleSources: (dir) => modules.get(dir) ?? new Map(),
+    headAddresses: (dir) => addresses.get(dir) ?? new Set(),
+  });
+}
+
 /**
  * Record the gate scan on the session. A failure leaves `gateConcerns` unset —
  * the outputs then read "not scanned", never a pass — and must not stop the run.
@@ -189,87 +309,24 @@ export async function captureGateScan(
   try {
     await captureGateScanInner(ctx, scanners, review);
   } finally {
-    removeNewInitArtefacts(checkout, before);
+    removeNewInitArtefacts(checkout, before, "findings gate");
   }
 }
 
-const INIT_ARTEFACTS = new Set([".terraform", ".terraform.lock.hcl"]);
-
-interface InitArtefacts {
-  /** init output git neither tracks nor ignores. */
-  untracked: Set<string>;
-  /** committed lock files with uncommitted changes. */
-  modifiedLocks: Set<string>;
-}
-
-/**
- * The `terraform init` output in the checkout, as repo-relative paths; null
- * outside a git checkout. A committed lock file counts once it is modified:
- * init adds the runner's platform hash to one made on another platform (a
- * lock file from a Mac lacks the linux hash).
- */
-function initArtefacts(cwd: string): InitArtefacts | null {
-  const r = run("git", ["status", "--porcelain=v1", "-z", "--untracked-files=normal"], cwd);
-  if (r.status !== 0) return null;
-  const entries = r.stdout.split("\0");
-  const isArtefact = (p: string) => INIT_ARTEFACTS.has(posix.basename(p.replace(/\/$/, "")));
-  return {
-    untracked: new Set(
-      entries
-        .filter((e) => e.startsWith("?? "))
-        .map((e) => e.slice(3))
-        .filter(isArtefact),
-    ),
-    modifiedLocks: new Set(
-      entries
-        .filter((e) => e[1] === "M" && e[2] === " ")
-        .map((e) => e.slice(3))
-        .filter((p) => posix.basename(p) === ".terraform.lock.hcl"),
-    ),
-  };
-}
-
-/**
- * Undo what the gate scan's init did to the checkout: remove the artefacts it
- * created and restore the committed lock files it changed. Validate inits every
- * root in place, and a checkout that is dirty before the agent starts makes
- * `checkout_pr` refuse — or, on a committing run, ships the change in the fix.
- * What was there before the scan is left alone.
- */
-function removeNewInitArtefacts(cwd: string, before: InitArtefacts | null): void {
-  if (!before) return;
-  const top = run("git", ["rev-parse", "--show-toplevel"], cwd).stdout.trim();
-  const after = initArtefacts(cwd);
-  const created = [...(after?.untracked ?? [])].filter((p) => !before.untracked.has(p));
-  const changed = [...(after?.modifiedLocks ?? [])].filter((p) => !before.modifiedLocks.has(p));
-  if (!top || created.length + changed.length === 0) return;
-  for (const p of created) rmSync(join(top, p), { recursive: true, force: true });
-  if (changed.length > 0) run("git", ["checkout", "--", ...changed], top);
-  resetTerraformInitCache();
-  log.info(
-    `» findings gate: removed ${created.length} terraform init artefact(s) from the checkout` +
-      (changed.length ? `, restored ${changed.length} committed lock file(s)` : ""),
-  );
-}
-
 async function captureGateScanInner(
   ctx: LocalToolContext,
   scanners: ScanScanners,
   review: Pick<PullRequestRunContext, "baseSha" | "headSha"> | undefined,
 ): Promise<void> {
   try {
-    const concerns = await runGateScan(ctx, scanners, review ? reviewedConcern : undefined);
-    if (!concerns) return;
-    if (review) {
-      // a failed base scan must not cost the run its gate: it falls back to
-      // judging every finding, as a run without a delta always has.
-      try {
-        const delta = await runScanDelta(ctx, review, concerns, scanners);
-        if (delta) scanSessionOf(ctx.toolState).gateDelta = delta;
-      } catch (error) {
-        log.warning(`» scan delta: base scan failed, every finding is treated as new — ${error}`);
-      }
-    }
+    // a review scans its base too, and the gate then judges only what the PR
+    // introduced
+    const scanned: { head: Concern[]; delta?: GateDelta } | undefined = review
+      ? await reviewScans(ctx, review, scanners)
+      : await runGateScan(ctx, scanners).then((head) => head && { head });
+    if (!scanned) return;
+    const concerns = scanned.head;
+    if (scanned.delta) scanSessionOf(ctx.toolState).gateDelta = scanned.delta;
     const session = scanSessionOf(ctx.toolState);
     // the baseline is part of the verdict, so it is resolved NOW too — from the
     // tree and git state as invoked, before the agent can change either.
@@ -297,7 +354,13 @@ async function captureGateScanInner(
 export async function scanForProof(
   ctx: LocalToolContext,
   cwd: string,
+  files?: string[],
   scanners: ScanScanners = realScanners,
 ): Promise<Concern[]> {
-  return (await scanTree(ctx, cwd, null, scanners, reviewedConcern)).filter((c) => !c.suppression);
+  const scope = files
+    ? (scopeFor([treeLayout(cwd, ctx.payload.varFiles)], files) ?? undefined)
+    : undefined;
+  return (await scanTree(ctx, cwd, null, scanners, reviewedConcern, scope)).filter(
+    (c) => !c.suppression,
+  );
 }

package/src/mcp/terraform/hcl.ts

@@ -482,9 +482,34 @@ export function parseBlocks(hcl: string, keywords: readonly string[]): HclBlock[
   return out;
 }
 
+/**
+ * One block label: a quoted string or, as the HCL grammar also allows, a bare
+ * identifier — `resource aws_vpc main {` is the same block as
+ * `resource "aws_vpc" "main" {`, and pre-0.12 code is full of it. A reader that
+ * knew only the quoted form saw none of those resources, so a proof read a
+ * `terraform fmt` that quoted them as resources being ADDED.
+ */
+export const BLOCK_LABEL = String.raw`(?:"[^"\n]*"|[A-Za-z_][A-Za-z0-9_-]*)`;
+
+/** a label as written, without its quotes. */
+export function unquoteLabel(label: string): string {
+  return label.startsWith('"') ? label.slice(1, -1) : label;
+}
+
+/** a `resource <type> <name> {` header in either label style; groups 1 and 2
+ *  are the labels as written ({@link unquoteLabel}). */
+export const RESOURCE_HEADER = String.raw`(?:^|\n)\s*resource\s+(${BLOCK_LABEL})\s+(${BLOCK_LABEL})\s*\{`;
+
+/** a `module <name> {` header in either label style; group 1 is the label as written. */
+export const MODULE_HEADER = String.raw`(?:^|\n)\s*module\s+(${BLOCK_LABEL})\s*\{`;
+
 function parseBlocksUncached(hcl: string, alternation: string): HclBlock[] {
   const out: HclBlock[] = [];
-  const re = new RegExp(`(?:^|\\n)[ \\t]*(${alternation})((?:[ \\t]+"[^"\\n]*")*)[ \\t]*\\{`, "g");
+  const re = new RegExp(
+    `(?:^|\\n)[ \\t]*(${alternation})((?:[ \\t]+${BLOCK_LABEL})*)[ \\t]*\\{`,
+    "g",
+  );
+  const labelRe = new RegExp(BLOCK_LABEL, "g");
 
   // The shared index rather than a forward counter of this pass's own: five
   // passes over one file used to walk its newlines five times over, and the
@@ -495,7 +520,7 @@ function parseBlocksUncached(hcl: string, alternation: string): HclBlock[] {
   // biome-ignore lint/suspicious/noAssignInExpressions: idiomatic regex-exec iteration
   while ((m = re.exec(hcl)) !== null) {
     const keyword = m[1] ?? "";
-    const labels = [...(m[2] ?? "").matchAll(/"([^"\n]*)"/g)].map((l) => l[1] ?? "");
+    const labels = [...(m[2] ?? "").matchAll(labelRe)].map((l) => unquoteLabel(l[0]));
     const bodyStart = m.index + m[0].length - 1; // the `{` the header ends on
     const body = matchBraceBody(hcl, bodyStart);
     if (!body) break;