infraweaver 0.3.9 → 0.3.11

package/dist/index.js

@@ -84161,14 +84161,14 @@ var require_turndown_cjs = __commonJS({
         } else if (node3.nodeType === 1) {
           replacement = replacementForNode.call(self2, node3);
         }
-        return join73(output2, replacement);
+        return join74(output2, replacement);
       }, "");
     }
     function postProcess(output2) {
       var self2 = this;
       this.rules.forEach(function(rule) {
         if (typeof rule.append === "function") {
-          output2 = join73(output2, rule.append(self2.options));
+          output2 = join74(output2, rule.append(self2.options));
         }
       });
       return output2.replace(/^[\t\r\n]+/, "").replace(/[\t\r\n\s]+$/, "");
@@ -84180,7 +84180,7 @@ var require_turndown_cjs = __commonJS({
       if (whitespace.leading || whitespace.trailing) content = content.trim();
       return whitespace.leading + rule.replacement(content, node3, this.options) + whitespace.trailing;
     }
-    function join73(output2, replacement) {
+    function join74(output2, replacement) {
       var s1 = trimTrailingNewlines(output2);
       var s2 = trimLeadingNewlines(replacement);
       var nls = Math.max(output2.length - s1.length, replacement.length - s2.length);
@@ -97300,7 +97300,7 @@ var require_polyfill = __commonJS({
     var {
       dirname: dirname15,
       isAbsolute: isAbsolute7,
-      join: join73,
+      join: join74,
       parse: parse8,
       resolve: resolve11,
       sep: sep11,
@@ -97557,8 +97557,8 @@ var require_polyfill = __commonJS({
       const dir = await readdir2(src);
       for (let i = 0; i < dir.length; i++) {
         const item = dir[i];
-        const srcItem = join73(src, item);
-        const destItem = join73(dest, item);
+        const srcItem = join74(src, item);
+        const destItem = join74(dest, item);
         const { destStat } = await checkPaths2(srcItem, destItem, opts);
         await startCopy(destStat, srcItem, destItem, opts);
       }
@@ -97631,7 +97631,7 @@ var require_cp = __commonJS({
 // node_modules/.pnpm/@npmcli+fs@6.0.0/node_modules/@npmcli/fs/lib/with-temp-dir.js
 var require_with_temp_dir = __commonJS({
   "node_modules/.pnpm/@npmcli+fs@6.0.0/node_modules/@npmcli/fs/lib/with-temp-dir.js"(exports2, module) {
-    var { join: join73, sep: sep11 } = __require("path");
+    var { join: join74, sep: sep11 } = __require("path");
     var getOptions2 = require_get_options();
     var { mkdir: mkdir5, mkdtemp, rm: rm2 } = __require("fs/promises");
     var withTempDir = async (root, fn2, opts) => {
@@ -97639,7 +97639,7 @@ var require_with_temp_dir = __commonJS({
         copy: ["tmpPrefix"]
       });
       await mkdir5(root, { recursive: true });
-      const target = await mkdtemp(join73(`${root}${sep11}`, options.tmpPrefix || ""));
+      const target = await mkdtemp(join74(`${root}${sep11}`, options.tmpPrefix || ""));
       let err;
       let result;
       try {
@@ -97664,13 +97664,13 @@ var require_with_temp_dir = __commonJS({
 var require_readdir_scoped = __commonJS({
   "node_modules/.pnpm/@npmcli+fs@6.0.0/node_modules/@npmcli/fs/lib/readdir-scoped.js"(exports2, module) {
     var { readdir: readdir2 } = __require("fs/promises");
-    var { join: join73 } = __require("path");
+    var { join: join74 } = __require("path");
     var readdirScoped = async (dir) => {
       const results = [];
       for (const item of await readdir2(dir)) {
         if (item.startsWith("@")) {
-          for (const scopedItem of await readdir2(join73(dir, item))) {
-            results.push(join73(item, scopedItem));
+          for (const scopedItem of await readdir2(join74(dir, item))) {
+            results.push(join74(item, scopedItem));
           }
         } else {
           results.push(item);
@@ -97685,7 +97685,7 @@ var require_readdir_scoped = __commonJS({
 // node_modules/.pnpm/@npmcli+fs@6.0.0/node_modules/@npmcli/fs/lib/move-file.js
 var require_move_file = __commonJS({
   "node_modules/.pnpm/@npmcli+fs@6.0.0/node_modules/@npmcli/fs/lib/move-file.js"(exports2, module) {
-    var { dirname: dirname15, join: join73, resolve: resolve11, relative: relative8, isAbsolute: isAbsolute7 } = __require("path");
+    var { dirname: dirname15, join: join74, resolve: resolve11, relative: relative8, isAbsolute: isAbsolute7 } = __require("path");
     var fs12 = __require("fs/promises");
     var pathExists2 = async (path15) => {
       try {
@@ -97715,7 +97715,7 @@ var require_move_file = __commonJS({
           if (sourceStat.isDirectory()) {
             const files = await fs12.readdir(source);
             await Promise.all(files.map(
-              (file2) => moveFile(join73(source, file2), join73(destination, file2), options, false, symlinks)
+              (file2) => moveFile(join74(source, file2), join74(destination, file2), options, false, symlinks)
             ));
           } else if (sourceStat.isSymbolicLink()) {
             symlinks.push({ source, destination });
@@ -160384,7 +160384,7 @@ var init_cacheTwirpClient = __esm({
 });
 
 // node_modules/.pnpm/@actions+cache@6.3.0_supports-color@7.2.0/node_modules/@actions/cache/lib/internal/tar.js
-import { existsSync as existsSync16, writeFileSync as writeFileSync21 } from "fs";
+import { existsSync as existsSync17, writeFileSync as writeFileSync21 } from "fs";
 import * as path13 from "path";
 function getTarPath() {
   return __awaiter18(this, void 0, void 0, function* () {
@@ -160394,7 +160394,7 @@ function getTarPath() {
         const systemTar = SystemTarPathOnWindows;
         if (gnuTar) {
           return { path: gnuTar, type: ArchiveToolType.GNU };
-        } else if (existsSync16(systemTar)) {
+        } else if (existsSync17(systemTar)) {
           return { path: systemTar, type: ArchiveToolType.BSD };
         }
         break;
@@ -258516,7 +258516,7 @@ var declare = ark.declare;
 import { createHash as createHash4 } from "node:crypto";
 
 // src/mcp/crosswalk-digest.ts
-var EXPECTED_CROSSWALK_DIGEST = "95afd7e402f0f1875fa0aac33aeee8b6b54f869ec65499fb727f515ee2101ee1";
+var EXPECTED_CROSSWALK_DIGEST = "f583001997c4c69f84f189a14e69e4f6eb2c52bddc04ca7f404286b5280d1ff4";
 
 // node_modules/.pnpm/@infraweaver-io+crosswalk@1.2.0/node_modules/@infraweaver-io/crosswalk/dist/frameworks.js
 var FRAMEWORKS = [
@@ -259020,9 +259020,9 @@ function boxString(text, options) {
     if (line.length <= maxWidth - padding * 2) {
       wrappedLines.push(line);
     } else {
-      const words = line.split(" ");
+      const words2 = line.split(" ");
       let currentLine = "";
-      for (const word of words) {
+      for (const word of words2) {
         const testLine = currentLine ? `${currentLine} ${word}` : word;
         if (testLine.length <= maxWidth - padding * 2) {
           currentLine = testLine;
@@ -259203,7 +259203,7 @@ import { randomBytes as randomBytes2 } from "node:crypto";
 // package.json
 var package_default = {
   name: "infraweaver",
-  version: "0.3.9",
+  version: "0.3.11",
   description: "GitHub Action that remediates Terraform to best practices and opens one scoped pull request per concern.",
   keywords: [
     "ai-coding-agent",
@@ -260156,6 +260156,7 @@ import { createHash as createHash3 } from "node:crypto";
 var NATIVE_SOURCE = TOOL_NAME;
 var SECRET_PERSISTED_TO_STATE = "secret-persisted-to-state";
 var COMMITTED_STATE_FILE = "committed-state-file";
+var HARDCODED_SECRET_ARGUMENT = "hardcoded-secret-argument";
 var IMPERATIVE_ACTION_TRIGGER = "imperative-action-trigger";
 var DYNAMIC_DESTROY_PROTECTION = "dynamic-destroy-protection";
 var DEPRECATED_STATE_LOCKING = "deprecated-state-locking";
@@ -260191,6 +260192,14 @@ var NATIVE_RULES = [
     asserts: "git tracks a `.tfstate` / `.tfstate.backup` file at this path, so the plaintext record of every attribute Terraform read back from the provider is in the history of every clone and fork",
     doesNotAssert: "that the state contains a live credential, or that anyone has read it \u2014 the file is never opened; the finding is that state is under version control, and what it recorded is for the owner to say"
   },
+  {
+    id: HARDCODED_SECRET_ARGUMENT,
+    title: "Credential written into the configuration as a literal",
+    band: "verified",
+    category: "security",
+    asserts: "an argument, map key or variable whose name says it holds a credential (`password`, `token`, `client_secret`, `api_key`, \u2026) is assigned a string literal, so the value is in the repository and in its history",
+    doesNotAssert: "that the value is a live credential \u2014 it may be a test value; the finding is that a credential slot is filled from the code rather than at run time"
+  },
   {
     id: IMPERATIVE_ACTION_TRIGGER,
     title: "Imperative side-effect invoked from declarative IaC (action / action_trigger)",
@@ -261515,7 +261524,9 @@ var THEME_LOCKED = /* @__PURE__ */ new Map([
   // credentials", and state in git is the canonical failure of it. It deliberately
   // does NOT also cite `encryption-at-rest`: whether the repository is encrypted is
   // not what the finding establishes.
-  ["committed-state-file", "secrets-management"]
+  ["committed-state-file", "secrets-management"],
+  // a credential in the code is the same CIS 16.4 failure one step earlier than state in git
+  ["hardcoded-secret-argument", "secrets-management"]
 ]);
 function bareRuleId(ruleId) {
   const colon = ruleId.indexOf(":");
@@ -266086,6 +266097,128 @@ function scanDialect(files) {
   return concerns;
 }
 
+// src/mcp/terraform/hardcodedSecrets.ts
+var SECRET_WORDS = /* @__PURE__ */ new Set([
+  "password",
+  "passwd",
+  "pwd",
+  "passphrase",
+  "secret",
+  "token",
+  "auth",
+  "apikey",
+  "credential",
+  "credentials"
+]);
+var SECRET_KEY_PREFIXES = /* @__PURE__ */ new Set(["api", "secret", "private", "signing"]);
+var NOT_SECRET_TOKENS = /* @__PURE__ */ new Set(["creation", "idempotency", "client", "request", "continuation"]);
+function words(name) {
+  return name.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase().split(/[_-]+/).filter(Boolean);
+}
+function isSecretName(name) {
+  const w = words(name);
+  const last = w.at(-1);
+  const prev = w.at(-2);
+  if (last === void 0) return false;
+  if (last === "key") return prev !== void 0 && SECRET_KEY_PREFIXES.has(prev);
+  if (last === "token" && prev !== void 0 && NOT_SECRET_TOKENS.has(prev)) return false;
+  return SECRET_WORDS.has(last);
+}
+function isPlaceholder(inner) {
+  return inner.trim() === "" || /^[*xX.]+$/.test(inner) || /^<[^>]*>$/.test(inner) || // the dummy credentials offline plans and LocalStack are given (`secret_key = "test"`)
+  /^(?:test|mock|fake|dummy|fixture|example|placeholder|sample)(?:[_-].*)?$/i.test(inner) || // a token's lifetime unit: `token_validity_units { access_token = "hours" }`
+  /^(?:seconds|minutes|hours|days)$/.test(inner);
+}
+var HEADER = /^(resource|data|provider|module|locals|variable|output|terraform)\b([^{]*)\{\s*$/;
+var ASSIGNMENT = /^\s*(?:"([A-Za-z_][\w-]*)"|([A-Za-z_][\w-]*))\s*=(?!=)\s*(.*)$/;
+var HEREDOC = /<<-?([A-Za-z_]\w*)\s*$/;
+var INLINE_PAIR = /(?:"([A-Za-z_][\w-]*)"|\b([A-Za-z_][\w-]*))\s*=(?!=)\s*("(?:[^"\\]|\\.)*")/g;
+function literalValue(raw2) {
+  const value2 = stripTrailingComment(raw2).replace(/,$/, "").trim();
+  return isStringLiteral(value2) && !isPlaceholder(value2.slice(1, -1));
+}
+function findHardcodedSecrets(hcl2) {
+  const out = [];
+  let holder = null;
+  let heredoc = null;
+  let inComment = false;
+  const lines = hcl2.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i].replace(/\r$/, "");
+    if (heredoc !== null) {
+      if (line.trim() === heredoc) heredoc = null;
+      continue;
+    }
+    if (inComment) {
+      if (line.includes("*/")) inComment = false;
+      continue;
+    }
+    const trimmed = line.trimStart();
+    if (trimmed.startsWith("/*")) {
+      inComment = !trimmed.includes("*/");
+      continue;
+    }
+    if (trimmed.startsWith("#") || trimmed.startsWith("//")) continue;
+    const header = HEADER.exec(line);
+    if (header) {
+      holder = `${header[1]}${header[2].trimEnd() ? ` ${header[2].trim()}` : ""}`;
+      continue;
+    }
+    if (line.startsWith("}")) {
+      holder = null;
+      continue;
+    }
+    const opens = HEREDOC.exec(line);
+    if (opens) heredoc = opens[1];
+    if (holder === null || opens) continue;
+    const m = ASSIGNMENT.exec(line);
+    if (!m) continue;
+    const name = m[1] ?? m[2];
+    const value2 = m[3];
+    if (holder.startsWith("variable ")) {
+      const variable = /^variable\s+"?([\w-]+)"?/.exec(holder)?.[1] ?? "";
+      if (name === "default" && isSecretName(variable) && literalValue(value2)) {
+        out.push({ name: variable, holder, line: i + 1 });
+      }
+      continue;
+    }
+    if (holder.startsWith("output ") || holder.startsWith("terraform")) continue;
+    if (isSecretName(name) && literalValue(value2)) {
+      out.push({ name, holder, line: i + 1 });
+      continue;
+    }
+    for (const pair of value2.matchAll(INLINE_PAIR)) {
+      const key = pair[1] ?? pair[2];
+      if (isSecretName(key) && literalValue(pair[3])) {
+        out.push({ name: key, holder, line: i + 1 });
+      }
+    }
+  }
+  return out;
+}
+function scanHardcodedSecrets(files) {
+  const concerns = [];
+  for (const { path: path15, hcl: hcl2 } of files) {
+    for (const hit of findHardcodedSecrets(hcl2)) {
+      concerns.push(
+        buildConcern({
+          source: NATIVE_SOURCE,
+          rule: HARDCODED_SECRET_ARGUMENT,
+          file: path15,
+          line: hit.line,
+          // a credential in the repository is readable by everyone who can read
+          // it, and stays in the history after it is edited out
+          severity: "high",
+          category: "security",
+          evidence: `\`${hit.name}\` in \`${hit.holder}\` is a string literal, so the credential it holds is committed to the repository (value not quoted here)`,
+          remediation_hint: "Rotate the credential first \u2014 it stays in the branch history after the line is changed. Then pass it in at run time: a `sensitive` variable with no default, or a read from a secret store (AWS Secrets Manager, Azure Key Vault, GCP Secret Manager)."
+        })
+      );
+    }
+  }
+  return concerns;
+}
+
 // src/mcp/roots.ts
 import { readFileSync as readFileSync5 } from "node:fs";
 import { join as join10 } from "node:path";
@@ -268065,6 +268198,12 @@ var NATIVE_RULE_SCANNERS = [
     // one. See [[stateFiles]].
     scan: (ctx) => scanCommittedStateFiles(ctx.cwd)
   },
+  {
+    name: "hardcoded-secrets",
+    rules: [HARDCODED_SECRET_ARGUMENT],
+    // Per file: the argument's name and its literal are both on the line itself.
+    scan: (ctx) => ({ concerns: scanHardcodedSecrets(ctx.files) })
+  },
   {
     name: "write-only",
     rules: [SECRET_PERSISTED_TO_STATE],
@@ -268655,8 +268794,8 @@ function matchRoot(file2, keys, roots) {
   const dir = dirOf2(file2);
   const inside = candidates.filter((r) => r.dir !== "" && isWithin(dir, r.dir)).sort((a, b) => b.dir.length - a.dir.length);
   if (inside[0]) return { root: inside[0].dir };
-  const words = new Set(tokens(file2));
-  const scored = candidates.map((r) => ({ dir: r.dir, score: tokens(r.dir).filter((t) => words.has(t)).length })).sort((a, b) => b.score - a.score);
+  const words2 = new Set(tokens(file2));
+  const scored = candidates.map((r) => ({ dir: r.dir, score: tokens(r.dir).filter((t) => words2.has(t)).length })).sort((a, b) => b.score - a.score);
   if (scored[0] && scored[0].score > 0 && scored[0].score !== scored[1]?.score) {
     return { root: scored[0].dir };
   }
@@ -274140,7 +274279,11 @@ function isRemediationBranch(branch) {
   return REMEDIATION_BRANCH.test(branch);
 }
 function groupIdFromBranch(branch) {
-  return branch.match(/^remediate\/(.+)$/)?.[1] ?? null;
+  return branch.match(/^remediate\/(.+?)(?:--.+)?$/)?.[1] ?? null;
+}
+function remediationBranchSuffix(base, defaultBranch) {
+  if (!base || !defaultBranch || base === defaultBranch) return "";
+  return `--${base.replace(/[^A-Za-z0-9._-]+/g, "-")}`;
 }
 function matchesBotIdentity(identity) {
   const normalized = identity.replace(/\[bot\]$/i, "").toLowerCase();
@@ -276493,6 +276636,8 @@ This mode standardises STRUCTURE while preserving BEHAVIOUR \u2014 the equivalen
    - \`${t("terraform_normalization_candidates")}\` \u2192 in-place idiomatic cleanups that change SYNTAX, not behaviour (redundant whole-string \`"\${expr}"\` interpolation; legacy HCL0.11 map-argument block syntax like \`vars {\` on a \`template_file\`). These relocate NOTHING \u2014 zero \`moved {}\` blocks \u2014 and are proven by the same equivalence check.
    - \`${t("terraform_consolidation_candidates")}\` \u2192 the SAME resource shape declared in several root directories (\`env/dev\` + \`env/staging\` + \`env/prod\`), with the single parameterised module they could all call already derived: which attributes are identical (module content) and which differ (per-environment inputs). A member root of a group will ALSO show up as a zero-candidate cluster in \`${t("module_extraction_candidates")}\` \u2014 prefer the consolidation, which does that work once for every environment instead of once per environment. Its \`near_groups\` are the opposite case: roots recognisably the same stack that DIFFER (one carries a resource the other does not), where folding them together is a design decision this mode has no basis for. Do NOT extract a near-group root's shared resources into a module on its own either \u2014 a module one twin calls and the other does not widens exactly the drift the near-group reports. Leave those roots alone and name the near-group and its \`differences\` in your report.
 
+   **A result marked \`report_only\` is an observation, not work.** The repository is a module other configurations call (\`report_only_reason\` says why), and restructuring it is churn for every caller: name those candidates in your \`${t("report_progress")}\` summary and open no PR for them. \`examples/\` roots are left out of every candidate list unless the operator set \`refactor_examples\`.
+
    **Before picking, check the interface.** \`${t("module_extraction_candidates")}\` reports \`unmapped_attributes\` per candidate and a top-level \`partial_interfaces\` list: arguments the raw resources SET that the target module does not. Adopting such a module DROPS them silently \u2014 and the equivalence check cannot catch it, because once the argument is gone it is absent from both sides. Two of these are unrecoverable rather than merely wrong (\`object_lock_enabled\` cannot be set after creation; \`force_destroy\` changes deletion semantics). So: **decline the candidate, or extend the module to expose the argument and say so in the PR body.** Deleting the argument to make the shapes match is never the fix. A candidate whose \`unmapped_attributes\` is \`null\` was NOT checked \u2014 the module is external and its code is not in this repo \u2014 which is not the same as clean.
 
    Pick the highest-value refactor across ALL THREE detectors. Only when they ALL come back empty \u2014 or all that remains is a cluster in a near-group root \u2014 is there genuinely nothing to do: call \`${t("report_progress")}\` with an ACCURATE message \u2014 e.g. "No behaviour-preserving refactor found: no extraction clusters and no idiomatic-normalisation candidates." \u2014 and **stop**. Two anti-patterns to avoid in that message: (i) never call a repo "already idiomatic" while normalisation candidates remain; (ii) when what's left is behaviour-CHANGING modernisation \u2014 a deprecated-resource swap (\`aws_launch_configuration\`\u2192\`aws_launch_template\`, \`aws_elb\`\u2192\`aws_lb\`, \`template_file\`\u2192\`templatefile()\`) \u2014 do NOT report "nothing to refactor": that is real work, but it ALTERS the resource set, so it belongs to Remediate. Say so explicitly rather than implying the code is clean.
@@ -276579,7 +276724,7 @@ This mode keeps already-open ${PRODUCT_NAME} remediation PRs healthy. A remediat
    - **resolved-on-base? \u2192 close it**: look for a group in step 3's scan whose \`id\` equals the PR's \`group_id\` (for a by-rule/batch PR, match on the concern ids it covered). If **no** current group/concern corresponds, the concern was already fixed on the base (a human fix, or a base change removed the file) \u2014 the PR is redundant. Call \`${t("close_pull_request")}\` with a one-line \`comment\` explaining it's resolved on the base. Do not push anything for this PR.
    - **still present \u2192 re-derive the fix on the current base**:
      - **read WHY the CI failed, before changing anything** (\`checks_failing\` PRs only): when step 2 gave the PR a \`failing_check_suite_id\`, call \`${t("get_check_suite_logs")}\` with that id FIRST. Re-deriving without reading the failure is exactly how attempt 2 and attempt 3 become identical repeats of attempt 1 \u2014 same fix, same red check, three times, until the retry cap escalates a PR nobody learned anything about. Use the returned \`failed_steps\` and log excerpt to decide what to do DIFFERENTLY this attempt. If the log shows the failure is not ours \u2014 a broken base, a missing credential, an unrelated flaky job \u2014 do not spend an attempt re-deriving: add \`needs-human\` (\`${t("add_labels")}\`), post ONE comment naming the failing step, and move on. Record the cause in the PR body/comment you write below, so the next attempt and any human start from what you found. When the id is absent, or the tool reports no failed runs, say so in the comment and continue with the plain re-derive rather than guessing.
-     - **branch**: recreate the remediation branch at the current base HEAD via \`${t("git")}\` (\`git checkout -B remediate/<id>\`) \u2014 \`-B\` force-resets it to the just-scanned base so the diff is only your fix.
+     - **branch**: recreate the remediation branch at the current base HEAD via \`${t("git")}\` (\`git({ command: "checkout", args: ["-B", <the PR's branch>] })\`, the \`branch\` step 2 returned) \u2014 \`-B\` force-resets it to the just-scanned base so the diff is only your fix.
      - **fix \u2192 validate \u2192 plan \u2192 keep tests consistent \u2192 prove it**: apply the minimal fix for that group exactly as in **Remediate** step 4 (same \`${t("terraform_validate")}\`, \`${t("terraform_plan")}\`, \`${t("terraform_module_tests")}\`, and \`${t("terraform_verify_remediation")}\` gates, and the same guardrails \u2014 never open/keep a PR whose validate didn't pass, abandon a group that would destroy a stateful resource, etc.).
      - **force-update the PR branch**: \`${t("push_branch")}\` with \`force: true\` (the PR already exists; force-updating its branch refreshes it in place \u2014 do NOT open a second PR). The Terraform-only / secret / destroy guardrails still run at push time.
      - **refresh the body**: \`${t("update_pull_request_body")}\` rebuilt from the fresh \`${t("terraform_verify_remediation")}\` result (the Remediation PR format below), and add a one-line note that it was rebased onto the current base (\`<short-sha>\`) on this run.
@@ -276624,8 +276769,8 @@ function remediateMode(t) {
 
 4. **for the chosen group**:
    - **base branch**: this run's base branch is resolved deterministically \u2014 \`${t("create_pull_request")}\` targets the \`base_branch\` input if set, else the branch the run started on, else the repository's default branch (\`main\`, or \`master\`). You do not choose it; just **omit** the \`base\` argument when opening the PR (below) and it is filled in.
-   - **idempotency**: the remediation branch is \`remediate/<group-id>\`. Before doing anything, check whether that branch or an open PR for it already exists (\`${t("git")}\` / \`${t("get_pull_request")}\`). If one exists, update it rather than opening a duplicate.
-   - **branch**: create \`remediate/<group-id>\` from the **current HEAD** (the checkout that was just scanned) via \`${t("git")}\` (\`git checkout -b remediate/<group-id>\`). Do NOT switch to a different base first \u2014 branching from the scanned checkout keeps the PR diff to exactly your fix.
+   - **idempotency**: the remediation branch is the group's \`branch\` (\`remediate/<group-id>\`, with a \`--<base>\` suffix when the PR targets a non-default branch) \u2014 use it exactly, never a name of your own. Before doing anything, check whether that branch or an open PR for it already exists (\`${t("git")}\` / \`${t("get_pull_request")}\`). If one exists, update it rather than opening a duplicate.
+   - **branch**: create the group's \`branch\` from the **current HEAD** (the checkout that was just scanned) via \`${t("git")}\` (\`git({ command: "checkout", args: ["-b", <branch>] })\`). Do NOT switch to a different base first \u2014 branching from the scanned checkout keeps the PR diff to exactly your fix.
    - **honest refusal (decide BEFORE fixing)**: if the group's concerns appear in the scan's \`refusal_candidates\` (the fix needs a human decision \u2014 narrowing an IAM wildcard, a KMS key policy, a real ingress CIDR), do **not** guess a fix that could break the stack. Instead open a structured issue (\`${t("create_issue")}\`) describing the concern, why it isn't auto-fixed, and what a human should do, and skip the PR for that group. A proven fix or an honest refusal \u2014 never a guessed, unverifiable PR.
    - **propose, then let me steer (when there's no single right fix)**: distinct from honest refusal (which refuses a fix a human must *decide*), this is for a finding with **2\u20133 genuinely distinct, defensible fixes** that differ in trade-offs, not correctness (e.g. encrypt with an AWS-managed key **vs** a customer-managed KMS key; a narrow security-group rule **vs** a prefix list **vs** a VPC endpoint). When such a fork exists **and the triggering comment did not already select a strategy**, do **not** silently pick for the reviewer: via \`${t("create_issue_comment")}\` post one short comment listing the options as **A / B / C** \u2014 each a single line (what it does + its trade-off) \u2014 and ask the reviewer to reply \`${COMMENT_COMMAND} fix #<concern-id> with strategy <A|B|C>\`. Then **skip the PR for this group** this run and note it in your final report (it resumes when the reviewer replies). When the comment **did** select one (\`fix #<id> with strategy B\`, or a bare \`strategy B\` reply on the proposal thread), apply **exactly** that strategy \u2014 don't second-guess it. Reserve this for real forks in the road; a fix with one obvious correct answer just gets made.
    - **reuse a proven fix (optional, do this BEFORE editing)**: call \`${t("terraform_fix_memory")}\`. When proven-fix memory is enabled it returns any patterns whose \`finding_type\` matches this group's concerns \u2014 each a transformation that already passed a \`\u2717\u2192\u2713\` proof on this repo or elsewhere in the fleet, with its \`remediation_hint\` + a \`before_example\`. Use a matching pattern as your STARTING POINT (it saves you rediscovering the approach), but ADAPT it to this repo's own resources \u2014 it is a prior, never a patch to paste. You MUST still run \`${t("terraform_verify_remediation")}\` to prove \`\u2717\u2192\u2713\` here; a pattern is never blind-applied and never substitutes for the per-target proof. Returns an empty list (never an error) when memory is off or nothing matches \u2014 then fix from first principles as usual.
@@ -276685,7 +276830,7 @@ This mode composes the **Remediate** and **Refactor** verbs into a single run. I
    - **commit the fix** (\`git add\` only the changed \`*.tf\`/\`*.tfvars\`, a \`fix(tf): \u2026\` message). Do NOT push yet. This committed state is the refactor's equivalence BASELINE.
 
 3. **REFACTOR (phase 2) \u2014 modularise on top of the committed fix**: follow the **Refactor** mode's flow:
-   - \`${t("module_extraction_candidates")}\` / \`${t("terraform_normalization_candidates")}\` \u2192 pick one behaviour-preserving refactor. Respect a pinned \`refactor_source\` if one was supplied (it constrains which module source you may use; the behaviour-altering b.4 path is only available when the operator pinned \`third-party\`).
+   - \`${t("module_extraction_candidates")}\` / \`${t("terraform_normalization_candidates")}\` \u2192 pick one behaviour-preserving refactor; a result marked \`report_only\` (the repository is a module others call) is named in the summary, never proposed. Respect a pinned \`refactor_source\` if one was supplied (it constrains which module source you may use; the behaviour-altering b.4 path is only available when the operator pinned \`third-party\`).
    - resolve the module source, wire the \`module\` call against its real interface (\`${t("terraform_module_interface")}\` for a local module dir, \`${t("terraform_module_lookup")}\` for a registry-sourced one), and emit a \`moved {}\` block for EVERY relocated address (\`${t("terraform_generate_moved")}\`).
    - \`terraform fmt\` + \`${t("terraform_validate")}\`, then \u2014 **with the refactor edits still UNCOMMITTED** \u2014 call \`${t("terraform_equivalence_check")}\`. In this mode it diffs the working tree against the COMMITTED fix (not the run-start commit), so it measures only the refactor. It must return \`equivalent: true\` (zero uncovered moves, resource set + arguments preserved, validate + fmt clean) before you proceed; \`${t("push_branch")}\` hard-blocks an unproven one \u2014 and, once this run has added a \`moved {}\` block, it also hard-blocks a push that never ran the check at all, so abandoning the refactor means REVERTING its edits rather than leaving them in with the fix. If it can't be proven equivalent, abandon the refactor and ship the fix alone.
    - **document the module (only when the \`docs\` input is enabled)**: after the equivalence check passes, call \`${t("terraform_module_docs")}\` for the module you created/adopted (pass the relocated addresses as \`moves\`). Do not hand-write docs \u2014 the tool builds from the interface, moved blocks, and equivalence verdict.
@@ -277251,7 +277396,7 @@ async function ensurePackageManager(params) {
 // src/mcp/shell.ts
 var ShellParams = type({
   command: "string",
-  description: "string",
+  "description?": "string",
   "timeout?": type.number.describe(
     "Timeout in MILLISECONDS (not seconds). Default 30000 (30s), max 120000 (2m). e.g. timeout: 180000 for 3 minutes; timeout: 180 means 180ms and will kill the process almost immediately."
   ),
@@ -277486,7 +277631,7 @@ function ShellTool(ctx) {
   return tool({
     name: "shell",
     timeoutMs: 12e4,
-    description: `Execute shell commands securely. Environment is filtered to remove API keys and secrets.
+    description: `Execute shell commands securely. Environment is filtered to remove API keys and secrets. NOT for git: any command running \`git\` is refused here \u2014 use the git tool (and push_branch / git_fetch).
 
 Example: \`shell({ command: "pnpm test", description: "run the test suite" })\`.
 
@@ -278232,18 +278377,35 @@ function spillGitOutput(params) {
   };
 }
 var subcommandPattern = regex("^[a-z][a-z0-9-]*$");
+var commandLinePattern = regex("^git\\s+[a-z][a-z0-9-]*(?:\\s.*)?$");
 var Git = type({
-  command: type(subcommandPattern).describe("Git command (e.g., 'status', 'log', 'diff')"),
+  command: type(subcommandPattern).or(type(commandLinePattern)).describe("Git command (e.g., 'status', 'log', 'diff')").optional(),
   args: type.string.array().describe("Additional arguments for the git command").optional()
 });
+function splitWords(line) {
+  return [...line.matchAll(/"([^"]*)"|'([^']*)'|(\S+)/g)].map((m) => m[1] ?? m[2] ?? m[3] ?? "");
+}
+function normalizeGitCall(params) {
+  let words2;
+  if (params.command === void 0) words2 = [...params.args ?? []];
+  else if (/^git\s/.test(params.command))
+    words2 = [...splitWords(params.command).slice(1), ...params.args ?? []];
+  else return { command: params.command, args: params.args ?? [] };
+  const [command, ...args2] = words2[0] === "git" ? words2.slice(1) : words2;
+  if (command === void 0 || !/^[a-z][a-z0-9-]*$/.test(command)) {
+    throw new Error(
+      `command must be a Git subcommand such as 'status' or 'checkout' (was "${command ?? ""}")`
+    );
+  }
+  return { command, args: args2 };
+}
 function GitTool(ctx) {
   return tool({
     name: "git",
     description: 'Run a git subcommand. `command` is the subcommand ONLY \u2014 never repeat it inside `args`. `args` is optional; omit it entirely for no-flag invocations like plain `git status`. Example: `git({ command: "status" })` for plain `git status`. Example: `git({ command: "log", args: ["--oneline", "-n", "20"] })`. Example: `git({ command: "diff", args: ["--merge-base", "origin/main"] })` \u2014 merge-base diff including uncommitted edits (single MCP call). Example: `git({ command: "diff", args: ["origin/main...HEAD"] })` \u2014 three-dot, committed-only changes vs merge-base. For PR-scope diffs ALWAYS use `--merge-base <base>` or three-dot `<base>...HEAD`. Bare `<base>` and two-dot `<base>..HEAD` are symmetric (working-tree-or-HEAD vs ref): when your branch is behind `<base>` they include the inverse of every commit on `<base>` you lack \u2014 pure noise, and this tool will reject those forms when the divergence is detected. Output >50K chars is spilled to a tmp file; the tool returns a head preview + path you can `read` selectively. For push/fetch, use the dedicated MCP tools (push_branch, git_fetch). git pull is not available \u2014 use git_fetch then this tool with command \'merge\'.',
     parameters: Git,
     execute: execute(async (params) => {
-      const command = params.command;
-      const args2 = params.args ?? [];
+      const { command, args: args2 } = normalizeGitCall(params);
       if (args2[0]?.toLowerCase() === command.toLowerCase()) {
         throw new Error(
           `git ${command}: '${args2[0]}' duplicates the subcommand \u2014 drop args[0] (the subcommand only belongs in 'command'). git would otherwise parse it as a pathspec and silently return empty/clean output when nothing matches. if you really meant a pathspec named '${args2[0]}', use args: ["--", "${args2[0]}"].`
@@ -279431,6 +279593,7 @@ var Inputs = type({
   // org-repo | author | third-party). Structured scope, not prompt text — see
   // parseRefactorSource / withRefactorSource. Gates the behaviour-altering b.4.
   "refactor_source?": type.string.or("undefined"),
+  "refactor_examples?": type.string.or("undefined"),
   "review_instructions?": type.string.or("undefined"),
   "fp_filtering_instructions?": type.string.or("undefined"),
   "remediation_instructions?": type.string.or("undefined"),
@@ -279508,6 +279671,7 @@ function resolveNonPromptInputs() {
     registry_token: getInput("registry_token") || void 0,
     registry_host: getInput("registry_host") || void 0,
     refactor_source: getInput("refactor_source") || void 0,
+    refactor_examples: getInput("refactor_examples") || void 0,
     review_instructions: getInput("review_instructions") || void 0,
     fp_filtering_instructions: getInput("fp_filtering_instructions") || void 0,
     remediation_instructions: getInput("remediation_instructions") || void 0,
@@ -279809,6 +279973,8 @@ function resolvePayload(resolvedPromptInput, repoSettings, orgRequiredControls =
     // Refactor mode for the b.4 consent gate. undefined → auto. Action-input/
     // trusted-dispatch only (not the untrusted repo file).
     refactorSource,
+    // opt in to refactoring `examples/` roots, which Refactor leaves alone by default
+    refactorExamples: parseBooleanInput(inputs.refactor_examples),
     // a `@infraweaver fix …` command parsed from the triggering comment
     // body (the raw prompt), scoping the run to a specific concern/severity/file.
     // null when the prompt isn't a recognised command.
@@ -282069,6 +282235,10 @@ function annotateConcerns(rawConcerns, opts) {
     opts.cwd
   );
 }
+function remediationBaseOf(ctx) {
+  const head = ctx.toolState.initialHead;
+  return ctx.payload.baseBranch?.trim() || (head?.kind === "branch" ? head.name : void 0) || ctx.repo?.data.default_branch?.trim() || void 0;
+}
 function buildConcernResult(ctx, rawConcerns, opts) {
   const fullBaseline = dedupe(rawConcerns);
   const session = scanSessionOf(ctx.toolState);
@@ -282097,8 +282267,13 @@ function buildConcernResult(ctx, rawConcerns, opts) {
     active,
     opts.autonomyThreshold
   );
-  const groups2 = opts.priority ? prioritizeGroups(annotatedGroups, active, opts.priority) : annotatedGroups;
-  const batchPlan = planBatches(groups2);
+  const suffix2 = remediationBranchSuffix(
+    remediationBaseOf(ctx),
+    ctx.repo?.data.default_branch?.trim() || void 0
+  );
+  const groups2 = (opts.priority ? prioritizeGroups(annotatedGroups, active, opts.priority) : annotatedGroups).map((g) => ({ ...g, branch: `remediate/${g.id}${suffix2}` }));
+  const planned = planBatches(groups2);
+  const batchPlan = planned.batch_branch ? { ...planned, batch_branch: `${planned.batch_branch}${suffix2}` } : planned;
   const bySeverity = {};
   for (const c of active) bySeverity[c.severity] = (bySeverity[c.severity] ?? 0) + 1;
   return {
@@ -283385,6 +283560,7 @@ ${marker2}`;
       await deleteProgressComment(ctx).catch((err) => {
         log2.debug(`progress comment cleanup after review failed: ${err}`);
       });
+      ctx.toolState.progressComment = null;
       if (ctx.toolState.checkoutSha && latestHeadSha && latestHeadSha !== ctx.toolState.checkoutSha) {
         const fromSha = ctx.toolState.checkoutSha;
         const toSha = latestHeadSha;
@@ -286224,8 +286400,8 @@ function AddLabelsTool(ctx) {
 }
 
 // src/mcp/moduleExtraction.ts
-import { readFileSync as readFileSync22 } from "node:fs";
-import { join as join41, posix as posix11 } from "node:path";
+import { readFileSync as readFileSync23 } from "node:fs";
+import { join as join42, posix as posix11 } from "node:path";
 
 // src/mcp/terraform/partialInterface.ts
 import { readdirSync as readdirSync6, readFileSync as readFileSync21 } from "node:fs";
@@ -286288,6 +286464,54 @@ function findPartialInterfaces(cwd) {
   return out;
 }
 
+// src/mcp/terraform/refactorScope.ts
+import { existsSync as existsSync10, readdirSync as readdirSync7, readFileSync as readFileSync22, statSync as statSync6 } from "node:fs";
+import { join as join41 } from "node:path";
+function isExamplePath(path15) {
+  return /(?:^|\/)examples?\//.test(path15.replace(/\\/g, "/"));
+}
+var PROVIDER_OR_BACKEND = /^\s*(?:provider\s+"|backend\s+")/m;
+function holdsTerraform(dir, depth) {
+  let entries;
+  try {
+    entries = readdirSync7(dir);
+  } catch {
+    return false;
+  }
+  for (const name of entries) {
+    const path15 = join41(dir, name);
+    if (name.endsWith(".tf")) return true;
+    if (depth > 0 && !name.startsWith(".") && statSync6(path15, { throwIfNoEntry: false })?.isDirectory()) {
+      if (holdsTerraform(path15, depth - 1)) return true;
+    }
+  }
+  return false;
+}
+function libraryRepoReason(cwd) {
+  let rootFiles;
+  try {
+    rootFiles = readdirSync7(cwd).filter((f) => f.endsWith(".tf"));
+  } catch {
+    return null;
+  }
+  if (rootFiles.length === 0) return null;
+  for (const f of rootFiles) {
+    let text;
+    try {
+      text = readFileSync22(join41(cwd, f), "utf8");
+    } catch {
+      continue;
+    }
+    if (PROVIDER_OR_BACKEND.test(text)) return null;
+  }
+  const examples = ["examples", "example"].find((d) => existsSync10(join41(cwd, d)));
+  if (examples === void 0 || !holdsTerraform(join41(cwd, examples), 2)) return null;
+  return `the repository root configures no provider and no backend, and ships \`${examples}/\`: it is a module other configurations call, so restructuring it is churn for every caller`;
+}
+function reportOnly(reason) {
+  return reason === null ? {} : { report_only: true, report_only_reason: reason };
+}
+
 // src/mcp/moduleExtraction.ts
 function parseResourceBlocks(hcl2) {
   const out = [];
@@ -286576,7 +286800,7 @@ function findExtractionCandidates(cwd, rawCatalogue, orgModuleHcl) {
     if (isInHouseModule(file2, graph) !== null) continue;
     let text;
     try {
-      text = readFileSync22(join41(cwd, file2), "utf8");
+      text = readFileSync23(join42(cwd, file2), "utf8");
     } catch {
       continue;
     }
@@ -286645,7 +286869,8 @@ function ModuleExtractionCandidatesTool(ctx) {
         cwd,
         ctx.payload.moduleCatalogue,
         ctx.toolState.orgModuleHcl
-      );
+      ).filter((c) => ctx.payload.refactorExamples || !isExamplePath(c.cluster.file));
+      const library = libraryRepoReason(cwd);
       const matched = candidates.filter((c) => c.candidates.length > 0);
       const reasons = {};
       for (const c of candidates)
@@ -286659,6 +286884,7 @@ function ModuleExtractionCandidatesTool(ctx) {
         `\xBB module_extraction_candidates: ${candidates.length} cluster(s), ${matched.length} with a module match` + (partialInterfaces.length > 0 ? `, ${partialInterfaces.length} partial-interface block(s)` : "")
       );
       return toolOk({
+        ...reportOnly(library),
         cluster_count: candidates.length,
         matched_count: matched.length,
         candidates,
@@ -286682,8 +286908,8 @@ function ModuleExtractionCandidatesTool(ctx) {
 }
 
 // src/mcp/moduleTests.ts
-import { existsSync as existsSync10, readdirSync as readdirSync7, readFileSync as readFileSync23, statSync as statSync6 } from "node:fs";
-import { join as join42 } from "node:path";
+import { existsSync as existsSync11, readdirSync as readdirSync8, readFileSync as readFileSync24, statSync as statSync7 } from "node:fs";
+import { join as join43 } from "node:path";
 var MODULE_META_ARGS = /* @__PURE__ */ new Set([
   "source",
   "version",
@@ -286803,30 +287029,30 @@ function resolveSourceDir(fromDir, source) {
 }
 function isDir(p) {
   try {
-    return existsSync10(p) && statSync6(p).isDirectory();
+    return existsSync11(p) && statSync7(p).isDirectory();
   } catch {
     return false;
   }
 }
 function listFiles(absDir, suffix2) {
   try {
-    return readdirSync7(absDir).filter((f) => f.endsWith(suffix2)).sort();
+    return readdirSync8(absDir).filter((f) => f.endsWith(suffix2)).sort();
   } catch {
     return [];
   }
 }
 function listSubdirs(absDir) {
   try {
-    return readdirSync7(absDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name).sort();
+    return readdirSync8(absDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name).sort();
   } catch {
     return [];
   }
 }
 function readAllTf(cwd, relDir) {
   let text = "";
-  for (const f of listFiles(join42(cwd, relDir), ".tf")) {
+  for (const f of listFiles(join43(cwd, relDir), ".tf")) {
     try {
-      text += `${readFileSync23(join42(cwd, relDir, f), "utf8")}
+      text += `${readFileSync24(join43(cwd, relDir, f), "utf8")}
 `;
     } catch {
     }
@@ -286838,8 +287064,8 @@ function discoverModuleTestAssets(cwd, moduleDir) {
   const assets = [];
   const matchesModule = (source, fromDir) => resolveSourceDir(fromDir, source) === md;
   for (const examplesRoot of [`${md}/examples`, "examples"]) {
-    if (!isDir(join42(cwd, examplesRoot))) continue;
-    for (const sub of listSubdirs(join42(cwd, examplesRoot))) {
+    if (!isDir(join43(cwd, examplesRoot))) continue;
+    for (const sub of listSubdirs(join43(cwd, examplesRoot))) {
       const exDir = `${examplesRoot}/${sub}`;
       const hcl2 = readAllTf(cwd, exDir);
       if (!hcl2) continue;
@@ -286855,12 +287081,12 @@ function discoverModuleTestAssets(cwd, moduleDir) {
     }
   }
   for (const testDir of [`${md}/tests`, md]) {
-    if (!isDir(join42(cwd, testDir))) continue;
-    for (const f of listFiles(join42(cwd, testDir), ".tftest.hcl")) {
+    if (!isDir(join43(cwd, testDir))) continue;
+    for (const f of listFiles(join43(cwd, testDir), ".tftest.hcl")) {
       const rel = `${testDir}/${f}`;
       let hcl2;
       try {
-        hcl2 = readFileSync23(join42(cwd, rel), "utf8");
+        hcl2 = readFileSync24(join43(cwd, rel), "utf8");
       } catch {
         continue;
       }
@@ -286868,12 +287094,12 @@ function discoverModuleTestAssets(cwd, moduleDir) {
     }
   }
   for (const goDir of [`${md}/test`, `${md}/tests`]) {
-    if (!isDir(join42(cwd, goDir))) continue;
-    for (const f of listFiles(join42(cwd, goDir), "_test.go")) {
+    if (!isDir(join43(cwd, goDir))) continue;
+    for (const f of listFiles(join43(cwd, goDir), "_test.go")) {
       const rel = `${goDir}/${f}`;
       let go;
       try {
-        go = readFileSync23(join42(cwd, rel), "utf8");
+        go = readFileSync24(join43(cwd, rel), "utf8");
       } catch {
         continue;
       }
@@ -286997,8 +287223,8 @@ function SetOutputTool(ctx, outputSchema) {
 
 // src/mcp/policy.ts
 import { spawnSync as spawnSync8 } from "node:child_process";
-import { existsSync as existsSync11, readFileSync as readFileSync24 } from "node:fs";
-import { join as join43 } from "node:path";
+import { existsSync as existsSync12, readFileSync as readFileSync25 } from "node:fs";
+import { join as join44 } from "node:path";
 function parseConftestOutput(stdout) {
   let parsed2;
   try {
@@ -287032,7 +287258,7 @@ var CONFTEST_CONFIG = "conftest.toml";
 function conftestSelectsNamespaces(conftestCwd) {
   let raw2;
   try {
-    raw2 = readFileSync24(join43(conftestCwd, CONFTEST_CONFIG), "utf-8");
+    raw2 = readFileSync25(join44(conftestCwd, CONFTEST_CONFIG), "utf-8");
   } catch {
     return false;
   }
@@ -287048,8 +287274,8 @@ function namespaceArgs(conftestCwd) {
 }
 function findPlanJson(cwd) {
   for (const candidate of PLAN_JSON_NAMES) {
-    const abs = join43(cwd, candidate);
-    if (existsSync11(abs)) return abs;
+    const abs = join44(cwd, candidate);
+    if (existsSync12(abs)) return abs;
   }
   return null;
 }
@@ -287090,11 +287316,11 @@ function resolvePolicyDir(cwd, explicit) {
     } catch {
       return null;
     }
-    return existsSync11(abs) ? abs : null;
+    return existsSync12(abs) ? abs : null;
   }
   for (const d of DEFAULT_POLICY_DIRS) {
-    const abs = join43(cwd, d);
-    if (existsSync11(abs)) return abs;
+    const abs = join44(cwd, d);
+    if (existsSync12(abs)) return abs;
   }
   return null;
 }
@@ -287128,7 +287354,7 @@ function PolicyCheckTool(ctx) {
         } catch {
           abs = null;
         }
-        targetFile = abs && existsSync11(abs) ? abs : null;
+        targetFile = abs && existsSync12(abs) ? abs : null;
         if (!targetFile) {
           return toolSkip(
             "target_not_found",
@@ -287401,9 +287627,9 @@ function PullRequestInfoTool(ctx) {
 
 // node_modules/.pnpm/@infraweaver-io+sandbox@0.1.8/node_modules/@infraweaver-io/sandbox/dist/writePolicy.js
 import { renameSync, writeFileSync as writeFileSync13 } from "node:fs";
-import { join as join44 } from "node:path";
+import { join as join45 } from "node:path";
 function writePolicyPath(tmpdir5, filename) {
-  return join44(tmpdir5, filename);
+  return join45(tmpdir5, filename);
 }
 function publishWritePolicy(params) {
   try {
@@ -287574,12 +287800,12 @@ function SelectModeTool(ctx) {
 }
 
 // src/mcp/terraform/tools/advise.ts
-import { existsSync as existsSync12, readFileSync as readFileSync26 } from "node:fs";
-import { join as join46 } from "node:path";
+import { existsSync as existsSync13, readFileSync as readFileSync27 } from "node:fs";
+import { join as join47 } from "node:path";
 
 // src/mcp/terraform/fixMemory.ts
-import { readFileSync as readFileSync25 } from "node:fs";
-import { join as join45 } from "node:path";
+import { readFileSync as readFileSync26 } from "node:fs";
+import { join as join46 } from "node:path";
 var FIX_MEMORY_FILENAME = FIX_MEMORY_FILE;
 var MAX_DESCRIPTION = 400;
 var MAX_BEFORE_EXAMPLE = 1200;
@@ -287666,7 +287892,7 @@ function loadFixMemory(cwd) {
   const root = cwd ?? process.cwd();
   for (const filename of [FIX_MEMORY_FILENAME, LEGACY_FIX_MEMORY_FILENAME]) {
     try {
-      return parseFixMemory(readFileSync25(join45(root, filename), "utf-8")) ?? [];
+      return parseFixMemory(readFileSync26(join46(root, filename), "utf-8")) ?? [];
     } catch {
     }
   }
@@ -287732,10 +287958,10 @@ function inlineWaivers(content, file2) {
   ];
 }
 function readLearnings(tmpdir5) {
-  const path15 = join46(tmpdir5, LEARNINGS_FILE);
-  if (!existsSync12(path15)) return [];
+  const path15 = join47(tmpdir5, LEARNINGS_FILE);
+  if (!existsSync13(path15)) return [];
   try {
-    return readFileSync26(path15, "utf-8").split("\n");
+    return readFileSync27(path15, "utf-8").split("\n");
   } catch {
     return [];
   }
@@ -287754,7 +287980,7 @@ function runAdvise(ctx, input2) {
   const learnings = readLearnings(ctx.tmpdir);
   const openConcerns = session.lastScanConcerns;
   const dossiers = files.map((file2) => {
-    const content = readTextCapped(join46(cwd, file2));
+    const content = readTextCapped(join47(cwd, file2));
     const inline = content === null ? [] : inlineWaivers(content, file2);
     const reviewedInline = reviewedCopy(
       cwd,
@@ -289072,7 +289298,10 @@ function ConsolidationCandidatesTool(ctx) {
     parameters: ConsolidationCandidatesParams,
     execute: execute(async () => {
       const cwd = ctx.payload.cwd ?? process.cwd();
-      const result = findConsolidationGroups(readWorkingTree(cwd));
+      const tree = readWorkingTree(cwd);
+      const result = findConsolidationGroups(
+        ctx.payload.refactorExamples ? tree : tree.filter((f) => !isExamplePath(f.path))
+      );
       log2.info(
         `\xBB terraform_consolidation_candidates: ${result.groups.length} group(s), ${result.near_groups.length} near-group(s), ${result.declined_groups.length} declined`
       );
@@ -289089,8 +289318,8 @@ function ConsolidationCandidatesTool(ctx) {
 }
 
 // src/mcp/terraform/tools/detectPlanDrift.ts
-import { readFileSync as readFileSync27 } from "node:fs";
-import { join as join47 } from "node:path";
+import { readFileSync as readFileSync28 } from "node:fs";
+import { join as join48 } from "node:path";
 
 // src/mcp/terraform/cspm.ts
 var ExternalResource = type({
@@ -289508,7 +289737,7 @@ function readTfFiles(cwd) {
   const out = [];
   for (const file2 of walkTfFiles(cwd)) {
     try {
-      out.push({ file: file2, hcl: readFileSync27(join47(cwd, file2), "utf8") });
+      out.push({ file: file2, hcl: readFileSync28(join48(cwd, file2), "utf8") });
     } catch {
     }
   }
@@ -289525,7 +289754,7 @@ function DetectPlanDriftTool(ctx) {
       const planPath = path15 || !envPlanPath ? resolveWithinCwd(cwd, path15 ?? "plan.json") : envPlanPath;
       let raw2;
       try {
-        raw2 = readFileSync27(planPath, "utf8");
+        raw2 = readFileSync28(planPath, "utf8");
       } catch {
         return skipResult(
           "plan_artifact_not_found",
@@ -289657,8 +289886,8 @@ function DetectPlanDriftTool(ctx) {
 }
 
 // src/mcp/terraform/tools/emitCost.ts
-import { readFileSync as readFileSync28, writeFileSync as writeFileSync14 } from "node:fs";
-import { join as join48 } from "node:path";
+import { readFileSync as readFileSync29, writeFileSync as writeFileSync14 } from "node:fs";
+import { join as join49 } from "node:path";
 
 // src/mcp/terraform/awsPrices.ts
 var AWS_PRICE_REGION = "eu-west-2";
@@ -289982,7 +290211,7 @@ function readTfFiles2(cwd) {
   const out = [];
   for (const file2 of walkTfFiles(cwd)) {
     try {
-      out.push({ file: file2, hcl: readFileSync28(join48(cwd, file2), "utf8") });
+      out.push({ file: file2, hcl: readFileSync29(join49(cwd, file2), "utf8") });
     } catch {
     }
   }
@@ -291246,7 +291475,7 @@ function TerraformEmitVexTool(ctx) {
 // src/mcp/terraform/tools/equivalenceCheck.ts
 import { mkdtempSync as mkdtempSync5, rmSync as rmSync7 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
-import { join as join49 } from "node:path";
+import { join as join50 } from "node:path";
 
 // src/mcp/terraform/refactor/attribution.ts
 import { posix as posix13 } from "node:path";
@@ -293038,12 +293267,12 @@ async function baselineValidateErrors(cwd, base, env2, session) {
   }
   const prefix2 = run("git", ["rev-parse", "--show-prefix"], cwd);
   if (prefix2.status !== 0) return null;
-  const tree = mkdtempSync5(join49(tmpdir3(), "iw-baseline-"));
+  const tree = mkdtempSync5(join50(tmpdir3(), "iw-baseline-"));
   try {
     if (run("git", ["worktree", "add", "--detach", "--quiet", tree, base], cwd).status !== 0) {
       return null;
     }
-    const outcome2 = await scanValidate(join49(tree, prefix2.stdout.trim()), env2);
+    const outcome2 = await scanValidate(join50(tree, prefix2.stdout.trim()), env2);
     if (!outcome2.ran || outcome2.unvalidated) return null;
     const errors = outcome2.concerns.map(validateErrorKey);
     session.baselineValidateErrors = { base, errors };
@@ -293144,7 +293373,7 @@ function TerraformGenerateMovedTool(ctx) {
 
 // src/mcp/terraform/cost.ts
 import { mkdtempSync as mkdtempSync6, rmSync as rmSync8 } from "node:fs";
-import { join as join50 } from "node:path";
+import { join as join51 } from "node:path";
 function parseInfracostBreakdown(stdout) {
   const parsed2 = parseScannerJson(InfracostBreakdownOutput, stdout, "infracost");
   const raw2 = parsed2.totalMonthlyCost;
@@ -293226,15 +293455,15 @@ async function infracostBaseline(cwd, key, tmpdir5) {
   if (!baseRef) return null;
   const prefixResult = run("git", ["rev-parse", "--show-prefix"], cwd);
   const prefix2 = prefixResult.status === 0 ? prefixResult.stdout.trim() : "";
-  const baseDir = mkdtempSync6(join50(tmpdir5, "infracost-base-"));
-  const worktree = join50(baseDir, "wt");
+  const baseDir = mkdtempSync6(join51(tmpdir5, "infracost-base-"));
+  const worktree = join51(baseDir, "wt");
   const add = run("git", ["worktree", "add", "--detach", worktree, baseRef], cwd);
   if (add.status !== 0) {
     rmSync8(baseDir, { recursive: true, force: true });
     return null;
   }
   try {
-    const scanCwd = prefix2 ? join50(worktree, prefix2) : worktree;
+    const scanCwd = prefix2 ? join51(worktree, prefix2) : worktree;
     const r = await runInfracostBreakdown(scanCwd, key);
     if (r.missing || r.status !== 0) return null;
     return parseInfracostBreakdown(r.stdout);
@@ -293304,8 +293533,8 @@ function InfracostDiffTool(ctx) {
 }
 
 // src/mcp/terraform/tools/ingestExternalFindings.ts
-import { statSync as statSync7 } from "node:fs";
-import { join as join51 } from "node:path";
+import { statSync as statSync8 } from "node:fs";
+import { join as join52 } from "node:path";
 
 // src/mcp/terraform/prowlerOcsf.ts
 var DETECTION_FINDING_CREATE = 200401;
@@ -293531,7 +293760,7 @@ var MAX_FEED_BYTES = 100 * 1024 * 1024;
 function readTfFiles3(cwd) {
   const out = [];
   for (const file2 of walkTfFiles(cwd)) {
-    const hcl2 = readTextCapped(join51(cwd, file2));
+    const hcl2 = readTextCapped(join52(cwd, file2));
     if (hcl2 !== null) out.push({ file: file2, hcl: hcl2 });
   }
   return out;
@@ -293559,7 +293788,7 @@ function IngestExternalFindingsTool(ctx) {
         return unusableFeed("external_findings_outside_workspace", errorMessage(error63));
       }
       try {
-        const size = statSync7(feedPath).size;
+        const size = statSync8(feedPath).size;
         if (size > MAX_FEED_BYTES) {
           return unusableFeed(
             "external_findings_too_large",
@@ -293688,8 +293917,8 @@ function IngestExternalFindingsTool(ctx) {
 }
 
 // src/mcp/terraform/tools/moduleDocs.ts
-import { readFileSync as readFileSync29, writeFileSync as writeFileSync16 } from "node:fs";
-import { join as join52 } from "node:path";
+import { readFileSync as readFileSync30, writeFileSync as writeFileSync16 } from "node:fs";
+import { join as join53 } from "node:path";
 
 // src/mcp/terraform/moduleDocs.ts
 var VERDICT_CLAIM = {
@@ -293803,7 +294032,7 @@ function TerraformModuleDocsTool(ctx) {
         );
       }
       const absDir = resolveWithinCwd(cwd, module_dir);
-      const target = join52(absDir, "README.md");
+      const target = join53(absDir, "README.md");
       let gitHead = null;
       try {
         gitHead = $("git", ["rev-parse", "HEAD"], { cwd, log: false });
@@ -293811,7 +294040,7 @@ function TerraformModuleDocsTool(ctx) {
       }
       let existing = null;
       try {
-        existing = readFileSync29(target, "utf8");
+        existing = readFileSync30(target, "utf8");
       } catch {
       }
       const priorHead = readFooterGitHead(existing);
@@ -294115,12 +294344,15 @@ function NormalizationCandidatesTool(ctx) {
     parameters: NormalizationCandidatesParams,
     execute: execute(async () => {
       const cwd = ctx.payload.cwd ?? process.cwd();
-      const files = findNormalizationCandidates(cwd);
+      const files = findNormalizationCandidates(cwd).filter(
+        (f) => ctx.payload.refactorExamples || !isExamplePath(f.file)
+      );
       const total = files.reduce((n, f) => n + f.count, 0);
       log2.info(
         `\xBB terraform_normalization_candidates: ${total} site(s) across ${files.length} file(s)`
       );
       return toolOk({
+        ...reportOnly(libraryRepoReason(cwd)),
         file_count: files.length,
         total,
         files,
@@ -294132,7 +294364,7 @@ function NormalizationCandidatesTool(ctx) {
 
 // src/mcp/terraform/tools/plan.ts
 import { rmSync as rmSync9 } from "node:fs";
-import { join as join53 } from "node:path";
+import { join as join54 } from "node:path";
 var PLAN_JSON_ARGS = ["plan", "-input=false", "-no-color", "-lock=false", "-json"];
 var planFileSeq = 0;
 async function capturePlanPairs(absDir, planFile, creds) {
@@ -294155,7 +294387,7 @@ async function planOneRoot(absDir, creds, tmpdir5) {
       skipReason: `terraform init failed: ${init.stderr.trim().slice(0, 200) || "unknown error"}`
     };
   }
-  const planFile = tmpdir5 ? join53(tmpdir5, `plan-${process.pid}-${planFileSeq++}.tfplan`) : void 0;
+  const planFile = tmpdir5 ? join54(tmpdir5, `plan-${process.pid}-${planFileSeq++}.tfplan`) : void 0;
   const plan = await runTfAsync(
     planFile ? [...PLAN_JSON_ARGS, `-out=${planFile}`] : PLAN_JSON_ARGS,
     absDir,
@@ -294525,8 +294757,8 @@ function TerraformProviderUpgradeTool(ctx) {
 }
 
 // src/mcp/terraform/tfquery.ts
-import { readFileSync as readFileSync30 } from "node:fs";
-import { join as join54 } from "node:path";
+import { readFileSync as readFileSync31 } from "node:fs";
+import { join as join55 } from "node:path";
 var TFQUERY_SUFFIX = ".tfquery.hcl";
 function parseQueryFile(hcl2) {
   return parseBlocks(hcl2, ["list"]).map((block) => {
@@ -294552,7 +294784,7 @@ function collectQueryInventory(cwd) {
   for (const rel of walkFilesBySuffix(cwd, TFQUERY_SUFFIX)) {
     let text;
     try {
-      text = readFileSync30(join54(cwd, rel), "utf8");
+      text = readFileSync31(join55(cwd, rel), "utf8");
     } catch {
       continue;
     }
@@ -294587,7 +294819,7 @@ function TerraformQueryInventoryTool(ctx) {
 }
 
 // src/mcp/terraform/tools/readFindings.ts
-import { readFileSync as readFileSync31 } from "node:fs";
+import { readFileSync as readFileSync32 } from "node:fs";
 var ReadFindingsParams = type({
   "path?": type.string.describe(
     "path to the Assessor's findings.json. Defaults to $INFRAWEAVER_FINDINGS_PATH, then ./findings.json in the workspace."
@@ -294612,7 +294844,7 @@ function ReadFindingsTool(ctx) {
       const findingsPath = path15 || !envFindingsPath ? resolveWithinCwd(cwd, path15 ?? "findings.json") : envFindingsPath;
       let raw2;
       try {
-        raw2 = readFileSync31(findingsPath, "utf8");
+        raw2 = readFileSync32(findingsPath, "utf8");
       } catch {
         return skipResult(
           "findings_not_found",
@@ -294871,6 +295103,8 @@ var SUBJECT = {
   // rule's silence a real statement. Whether git could answer is handled one
   // level up by the blind set: a run that could not ask is never conforming.
   "committed-state-file": ANY_BLOCK,
+  // any block may hold a credential argument, a map of them, or a variable default
+  "hardcoded-secret-argument": ANY_BLOCK,
   "deprecated-s3-bucket-argument": /(?:^|\n)\s*resource\s+"?aws_s3_bucket(?:"|\s)/,
   "superseded-resource-type": /(?:^|\n)\s*(?:resource\s+"?(?:aws_launch_configuration|aws_elb)(?:"|\s)|data\s+"?template_file(?:"|\s))/,
   "missing-required-version": /(?:^|\n)\s*(?:resource|module|provider)\s+"/,
@@ -298542,15 +298776,15 @@ async function startMcpHttpServer(ctx, options) {
 
 // src/mcp/terraform/policyGate.ts
 import {
-  existsSync as existsSync13,
+  existsSync as existsSync14,
   mkdirSync as mkdirSync7,
   mkdtempSync as mkdtempSync7,
-  readdirSync as readdirSync8,
-  readFileSync as readFileSync33,
+  readdirSync as readdirSync9,
+  readFileSync as readFileSync34,
   writeFileSync as writeFileSync17
 } from "node:fs";
 import { tmpdir as osTmpdir } from "node:os";
-import { dirname as dirname8, isAbsolute as isAbsolute6, join as join56, relative as relative6, resolve as resolve8 } from "node:path";
+import { dirname as dirname8, isAbsolute as isAbsolute6, join as join57, relative as relative6, resolve as resolve8 } from "node:path";
 function coercePolicyRules(raw2) {
   const rules = [];
   const rejected = [];
@@ -298578,7 +298812,7 @@ var UNKNOWN2 = /* @__PURE__ */ Symbol("unknown");
 function isScalar(v) {
   return typeof v === "string" || typeof v === "number" || typeof v === "boolean";
 }
-function literalValue(raw2) {
+function literalValue2(raw2) {
   const v = raw2.includes("\n") ? raw2.trim() : stripTrailingComment(raw2);
   if (v === "true") return true;
   if (v === "false") return false;
@@ -298611,7 +298845,7 @@ function objectLiteral(v) {
   for (const line of lines) {
     const m = OBJECT_LINE.exec(line);
     if (!m) return UNKNOWN2;
-    const value2 = literalValue(m[3] ?? "");
+    const value2 = literalValue2(m[3] ?? "");
     if (value2 !== void 0) out[m[1] ?? m[2]] = value2;
   }
   return out;
@@ -298639,7 +298873,7 @@ function staticValues(body2) {
       continue;
     }
     if (e.kind === "attr") {
-      const value2 = literalValue(e.value ?? "");
+      const value2 = literalValue2(e.value ?? "");
       if (value2 !== void 0) out[e.name] = value2;
       continue;
     }
@@ -298802,7 +299036,7 @@ function evaluateRulesStatically(cwd, rules, scope2 = { kind: "all", reason: ""
   const files = [];
   for (const rel of walk.files) {
     try {
-      files.push({ rel, text: readFileSync33(join56(cwd, rel), "utf-8") });
+      files.push({ rel, text: readFileSync34(join57(cwd, rel), "utf-8") });
     } catch {
     }
   }
@@ -298917,16 +299151,16 @@ function cloudEmittedRego(rules) {
 }
 function readOrEmpty(path15) {
   try {
-    return readFileSync33(path15, "utf-8");
+    return readFileSync34(path15, "utf-8");
   } catch {
     return "";
   }
 }
 function regoDirIn(root, skip) {
   for (const dir of DEFAULT_POLICY_DIRS) {
-    const abs = join56(root, dir);
-    if (existsSync13(abs) && walkFilesBySuffix(abs, ".rego").some(
-      (rel) => !skip(join56(dir, rel), readOrEmpty(join56(abs, rel)))
+    const abs = join57(root, dir);
+    if (existsSync14(abs) && walkFilesBySuffix(abs, ".rego").some(
+      (rel) => !skip(join57(dir, rel), readOrEmpty(join57(abs, rel)))
     )) {
       return dir;
     }
@@ -298934,14 +299168,14 @@ function regoDirIn(root, skip) {
   return null;
 }
 function withoutSkipped(root, dir, skip, tmpdir5) {
-  const abs = join56(root, dir);
-  const files = readdirSync8(abs, { recursive: true, withFileTypes: true }).filter((e) => e.isFile()).map((e) => relative6(abs, join56(e.parentPath, e.name)));
-  const kept = files.filter((rel) => !skip(join56(dir, rel), readOrEmpty(join56(abs, rel))));
+  const abs = join57(root, dir);
+  const files = readdirSync9(abs, { recursive: true, withFileTypes: true }).filter((e) => e.isFile()).map((e) => relative6(abs, join57(e.parentPath, e.name)));
+  const kept = files.filter((rel) => !skip(join57(dir, rel), readOrEmpty(join57(abs, rel))));
   if (kept.length === files.length) return abs;
-  const copy = join56(mkdtempSync7(join56(tmpdir5 ?? osTmpdir(), "policy-own-")), dir);
+  const copy = join57(mkdtempSync7(join57(tmpdir5 ?? osTmpdir(), "policy-own-")), dir);
   for (const rel of kept) {
-    mkdirSync7(dirname8(join56(copy, rel)), { recursive: true });
-    writeFileSync17(join56(copy, rel), readFileSync33(join56(abs, rel)));
+    mkdirSync7(dirname8(join57(copy, rel)), { recursive: true });
+    writeFileSync17(join57(copy, rel), readFileSync34(join57(abs, rel)));
   }
   return copy;
 }
@@ -298963,18 +299197,18 @@ function resolveRepoPolicy(cwd, baseRef, tmpdir5, notes, skip) {
     }
     const own2 = tree.files.filter((f) => !skip(f.path, f.raw));
     if (!own2.some((f) => f.path.endsWith(".rego"))) continue;
-    const root = mkdtempSync7(join56(tmpdir5 ?? osTmpdir(), "policy-base-"));
+    const root = mkdtempSync7(join57(tmpdir5 ?? osTmpdir(), "policy-base-"));
     for (const f of own2) {
-      mkdirSync7(dirname8(join56(root, f.path)), { recursive: true });
-      writeFileSync17(join56(root, f.path), f.raw);
+      mkdirSync7(dirname8(join57(root, f.path)), { recursive: true });
+      writeFileSync17(join57(root, f.path), f.raw);
     }
     const toml = readFileAtBaseRef(cwd, baseRef, CONFTEST_CONFIG);
-    if (toml.kind === "file") writeFileSync17(join56(root, CONFTEST_CONFIG), toml.raw);
-    const same = head === dir && readdirSync8(join56(cwd, dir), { recursive: true, withFileTypes: true }).filter(
+    if (toml.kind === "file") writeFileSync17(join57(root, CONFTEST_CONFIG), toml.raw);
+    const same = head === dir && readdirSync9(join57(cwd, dir), { recursive: true, withFileTypes: true }).filter(
       (e) => e.isFile()
     ).length === tree.files.length && tree.files.every((f) => {
       try {
-        return readFileSync33(join56(cwd, f.path), "utf-8") === f.raw;
+        return readFileSync34(join57(cwd, f.path), "utf-8") === f.raw;
       } catch {
         return false;
       }
@@ -298984,7 +299218,7 @@ function resolveRepoPolicy(cwd, baseRef, tmpdir5, notes, skip) {
         `the Rego policy differs from the base ref (${tree.ref}) \u2014 applying the BASE ${dir}/ so this change cannot relax the policy reviewing it. It takes effect once merged.`
       );
     }
-    return { policyDir: join56(root, dir), conftestCwd: root };
+    return { policyDir: join57(root, dir), conftestCwd: root };
   }
   if (head) {
     notes.push(
@@ -298994,7 +299228,7 @@ function resolveRepoPolicy(cwd, baseRef, tmpdir5, notes, skip) {
   return null;
 }
 function findWorkflowPlanJson(cwd, notes) {
-  const present = PLAN_JSON_NAMES.filter((name) => existsSync13(join56(cwd, name)));
+  const present = PLAN_JSON_NAMES.filter((name) => existsSync14(join57(cwd, name)));
   if (present.length === 0) return null;
   const listing = run("git", ["ls-files", "-z"], cwd);
   if (listing.status !== 0) {
@@ -299011,7 +299245,7 @@ function findWorkflowPlanJson(cwd, notes) {
       );
       continue;
     }
-    return join56(cwd, name);
+    return join57(cwd, name);
   }
   return null;
 }
@@ -299041,7 +299275,7 @@ function evaluatePolicyGate(cwd, rawRules, opts = {}) {
   let plan;
   if (planPath) {
     try {
-      plan = asPlan(JSON.parse(readFileSync33(planPath, "utf-8")));
+      plan = asPlan(JSON.parse(readFileSync34(planPath, "utf-8")));
     } catch {
     }
     if (!plan) notes.push(`${planPath} is not a Terraform plan JSON \u2014 ignored`);
@@ -299144,7 +299378,7 @@ function capturePolicyGate(ctx) {
     if (!result) return;
     const workspace = process.env.GITHUB_WORKSPACE ?? cwd;
     for (const o of [...result.violations, ...result.inconclusive]) {
-      if (o.file) o.file = posix16(relative6(workspace, join56(cwd, o.file)));
+      if (o.file) o.file = posix16(relative6(workspace, join57(cwd, o.file)));
     }
     session.policyGate = result;
     for (const n of result.notes) log2.warning(`\xBB policy gate: ${n}`);
@@ -299479,7 +299713,7 @@ var ThinkingTimer = class {
 // src/agents/claude.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
 import { chmodSync as chmodSync3, mkdirSync as mkdirSync10, writeFileSync as writeFileSync22 } from "node:fs";
-import { join as join65 } from "node:path";
+import { join as join66 } from "node:path";
 import { performance as performance6 } from "node:perf_hooks";
 import { setTimeout as sleep6 } from "node:timers/promises";
 
@@ -299839,7 +300073,7 @@ import { readFile as readFile2 } from "node:fs/promises";
 
 // src/agents/shared.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { join as join57 } from "node:path";
+import { join as join58 } from "node:path";
 var MAX_STDERR_LINES = 20;
 var MAX_POST_RUN_RETRIES = 3;
 function getGitStatus() {
@@ -299876,7 +300110,7 @@ var agent = (input2) => {
   };
 };
 function agentHomeEnv(tmpdir5) {
-  return { HOME: tmpdir5, XDG_CONFIG_HOME: join57(tmpdir5, ".config") };
+  return { HOME: tmpdir5, XDG_CONFIG_HOME: join58(tmpdir5, ".config") };
 }
 function baseAgentEnv(homeEnv, repoDir) {
   return { ...process.env, ...homeEnv, PWD: repoDir };
@@ -300352,6 +300586,12 @@ function shouldRunGraceTurn(params) {
   return params.stopReason === "quota" && params.hasReserve && params.canResume && params.unsubmitted !== null;
 }
 
+// src/agents/quotaTokens.ts
+var CACHE_READ_WEIGHT = 0.1;
+function quotaTokens(t) {
+  return t.input + t.output + t.cacheWrite + t.cacheRead * CACHE_READ_WEIGHT;
+}
+
 // src/agents/sessionLabeler.ts
 var import_picocolors2 = __toESM(require_picocolors(), 1);
 var ORCHESTRATOR_LABEL = "orchestrator";
@@ -300673,7 +300913,7 @@ function matchesRouteSentinel(envVar, model) {
 import { randomUUID as randomUUID9 } from "node:crypto";
 import { mkdirSync as mkdirSync8, rmSync as rmSync10, writeFileSync as writeFileSync18 } from "node:fs";
 import { homedir } from "node:os";
-import { join as join58 } from "node:path";
+import { join as join59 } from "node:path";
 var VERTEX_SERVICE_ACCOUNT_JSON_ENV = "VERTEX_SERVICE_ACCOUNT_JSON";
 var GOOGLE_APPLICATION_CREDENTIALS_ENV = "GOOGLE_APPLICATION_CREDENTIALS";
 var GOOGLE_CLOUD_PROJECT_ENV = "GOOGLE_CLOUD_PROJECT";
@@ -300697,7 +300937,7 @@ function readProjectIdFromVertexServiceAccountJson() {
 }
 function createSecretDir() {
   const base = process.env.INFRAWEAVER_SECRET_HOME || process.env.HOME || homedir();
-  const secretDir = join58(base, `.${PRODUCT_SLUG}`, "secrets", randomUUID9());
+  const secretDir = join59(base, `.${PRODUCT_SLUG}`, "secrets", randomUUID9());
   mkdirSync8(secretDir, { recursive: true, mode: 448 });
   return secretDir;
 }
@@ -300706,7 +300946,7 @@ function materializeVertexCredentials(params) {
   const blob = process.env[VERTEX_SERVICE_ACCOUNT_JSON_ENV];
   if (!blob) return void 0;
   const secretDir = createSecretDir();
-  const credentialsPath = join58(secretDir, "vertex-sa.json");
+  const credentialsPath = join59(secretDir, "vertex-sa.json");
   writeFileSync18(credentialsPath, blob, { mode: 384 });
   process.env[GOOGLE_APPLICATION_CREDENTIALS_ENV] = credentialsPath;
   const projectId = readProjectIdFromVertexServiceAccountJson();
@@ -300842,29 +301082,29 @@ function createProcessOutputActivityTimeout(ctx) {
 }
 
 // src/utils/prompt/skills.ts
-import { existsSync as existsSync14, mkdirSync as mkdirSync9, readFileSync as readFileSync34, writeFileSync as writeFileSync19 } from "node:fs";
-import { dirname as dirname9, join as join59 } from "node:path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync9, readFileSync as readFileSync35, writeFileSync as writeFileSync19 } from "node:fs";
+import { dirname as dirname9, join as join60 } from "node:path";
 import { fileURLToPath } from "node:url";
 var BUNDLED_SKILL_NAMES = ["terraform-best-practices"];
 function resolveSkillPath(name) {
   const here = dirname9(fileURLToPath(import.meta.url));
   const candidates = [
-    join59(here, "..", "..", "skills", name, "SKILL.md"),
-    join59(here, "skills", name, "SKILL.md")
+    join60(here, "..", "..", "skills", name, "SKILL.md"),
+    join60(here, "skills", name, "SKILL.md")
   ];
   for (const candidate of candidates) {
-    if (existsSync14(candidate)) return candidate;
+    if (existsSync15(candidate)) return candidate;
   }
   throw new Error(`bundled skill not found: ${name} (looked in ${candidates.join(", ")})`);
 }
 var SKILL_TARGET_DIRS = [".opencode/skills", ".claude/skills", ".agents/skills"];
 function installBundledSkills(params) {
   for (const name of BUNDLED_SKILL_NAMES) {
-    const content = readFileSync34(resolveSkillPath(name), "utf8");
+    const content = readFileSync35(resolveSkillPath(name), "utf8");
     for (const targetDir of SKILL_TARGET_DIRS) {
-      const skillDir = join59(params.home, targetDir, name);
+      const skillDir = join60(params.home, targetDir, name);
       mkdirSync9(skillDir, { recursive: true });
-      writeFileSync19(join59(skillDir, "SKILL.md"), content);
+      writeFileSync19(join60(skillDir, "SKILL.md"), content);
     }
   }
   log2.success(`installed bundled skills: ${BUNDLED_SKILL_NAMES.join(", ")}`);
@@ -300873,8 +301113,8 @@ function installBundledSkills(params) {
 // src/utils/setup/install.ts
 import { spawnSync as spawnSync9 } from "node:child_process";
 import { createHash as createHash14 } from "node:crypto";
-import { chmodSync as chmodSync2, createWriteStream as createWriteStream2, existsSync as existsSync17, readFileSync as readFileSync35 } from "node:fs";
-import { join as join64 } from "node:path";
+import { chmodSync as chmodSync2, createWriteStream as createWriteStream2, existsSync as existsSync18, readFileSync as readFileSync36 } from "node:fs";
+import { join as join65 } from "node:path";
 import { pipeline as pipeline2 } from "node:stream/promises";
 
 // src/utils/setup/tarballCache.ts
@@ -300929,7 +301169,7 @@ function verifyTarballIntegrity(tarballPath, dist, descriptor) {
       `Refusing to install ${descriptor}: the registry published no integrity digest (neither dist.integrity nor dist.shasum), so the download cannot be verified.`
     );
   }
-  const bytes = readFileSync35(tarballPath);
+  const bytes = readFileSync36(tarballPath);
   if (integrity2) {
     const candidates = integrity2.trim().split(/\s+/).filter(Boolean);
     for (const candidate of candidates) {
@@ -300958,9 +301198,9 @@ function verifyTarballIntegrity(tarballPath, dist, descriptor) {
 }
 async function installFromNpmTarball(params) {
   const tempDir = getTempDir();
-  const extractedDir = join64(tempDir, "package");
-  const cliPath = join64(extractedDir, params.executablePath);
-  if (existsSync17(cliPath)) {
+  const extractedDir = join65(tempDir, "package");
+  const cliPath = join65(extractedDir, params.executablePath);
+  if (existsSync18(cliPath)) {
     log2.debug(`\xBB using cached binary at ${cliPath}`);
     return cliPath;
   }
@@ -301011,7 +301251,7 @@ async function installFromNpmTarball(params) {
     dist = (await manifestResponse.json()).dist;
   }
   log2.debug(`\xBB installing ${params.packageName}@${resolvedVersion}...`);
-  const tarballPath = join64(tempDir, "package.tgz");
+  const tarballPath = join65(tempDir, "package.tgz");
   const tarballFileName = params.packageName.startsWith("@") ? params.packageName.split("/")[1] : params.packageName;
   const tarballUrl = `${npmRegistry}/${encodedName}/-/${tarballFileName}-${resolvedVersion}.tgz`;
   const restored = await restoreTarball({
@@ -301051,7 +301291,7 @@ async function installFromNpmTarball(params) {
       `Failed to extract tarball: ${extractResult.stderr || extractResult.stdout || "Unknown error"}`
     );
   }
-  if (!existsSync17(cliPath)) {
+  if (!existsSync18(cliPath)) {
     throw new Error(`Executable not found in extracted package at ${cliPath}`);
   }
   if (params.installDependencies) {
@@ -301162,9 +301402,9 @@ var CLAUDE_DISALLOWED_TOOLS = CLAUDE_EXEC_TOOL_DENY_RULES.join(",");
 var INFRAWEAVER_MCP_AUTH_HEADER = `Bearer \${${MCP_SERVER_TOKEN_ENV}}`;
 var CLAUDE_MAX_CONCURRENT_SUBAGENTS_DEFAULT = "4";
 function writeMcpConfig(ctx) {
-  const configDir = join65(ctx.tmpdir, ".claude");
+  const configDir = join66(ctx.tmpdir, ".claude");
   mkdirSync10(configDir, { recursive: true });
-  const configPath = join65(configDir, "mcp.json");
+  const configPath = join66(configDir, "mcp.json");
   const terraformMcp = resolveTerraformMcp(ctx.payload);
   if (terraformMcp.kind === "docker_missing") log2.info(`\xBB ${terraformMcp.note}`);
   const opentofuMcp = resolveOpenTofuMcp(ctx.payload);
@@ -301196,13 +301436,13 @@ function writeMcpConfig(ctx) {
   return configPath;
 }
 function writePretoolGateAssets(ctx, stopHookPath) {
-  const scriptPath = join65(ctx.tmpdir, CLAUDE_PRETOOL_GATE_FILENAME);
+  const scriptPath = join66(ctx.tmpdir, CLAUDE_PRETOOL_GATE_FILENAME);
   writeFileSync22(
     scriptPath,
     buildClaudePretoolGateSource(ctx.subagentDeniedTools, writePolicyPath2(ctx.tmpdir))
   );
   chmodSync3(scriptPath, 493);
-  const settingsPath = join65(ctx.tmpdir, "infraweaver-claude-settings.json");
+  const settingsPath = join66(ctx.tmpdir, "infraweaver-claude-settings.json");
   const settings = buildClaudePretoolGateSettings(scriptPath, CLAUDE_EXEC_TOOL_DENY_RULES);
   settings.permissions.deny.push(...harnessTmpdirWriteDenyClaude(ctx.tmpdir));
   if (stopHookPath) {
@@ -301291,7 +301531,7 @@ function timerFor(state5, label) {
 function chargeTokenQuota(state5) {
   const quota = state5.params.tokenQuota;
   if (!quota || state5.stopRun.signal.aborted) return;
-  if (!quota.observe(state5.quotaSource, state5.accumulatedTokens)) return;
+  if (!quota.observe(state5.quotaSource, quotaTokens(state5.accumulatedTokens))) return;
   log2.info(`\xBB ${state5.params.label}: ${quota.gap()}`);
   state5.stopRun.abort(new TokenQuotaExceededError(quota.gap()));
 }
@@ -301827,11 +302067,11 @@ var claude = agent({
       const onVertex = matchesRouteSentinel(VERTEX_MODEL_ID_ENV, specifier) && specifier !== void 0 && isVertexAnthropicId(specifier);
       const model = !specifier ? void 0 : onBedrock ? specifier : onVertex ? void 0 : stripProviderPrefix(specifier);
       const homeEnv = agentHomeEnv(ctx.tmpdir);
-      mkdirSync10(join65(homeEnv.XDG_CONFIG_HOME, "claude"), { recursive: true });
+      mkdirSync10(join66(homeEnv.XDG_CONFIG_HOME, "claude"), { recursive: true });
       installBundledSkills({ home: homeEnv.HOME });
       const mcpConfigPath = writeMcpConfig(ctx);
       const effort = resolveEffort(model);
-      const stopHookPath = join65(ctx.tmpdir, "infraweaver-stop-hook.sh");
+      const stopHookPath = join66(ctx.tmpdir, "infraweaver-stop-hook.sh");
       writeFileSync22(stopHookPath, buildStopHookScript(), { mode: 493 });
       const pretoolGate = writePretoolGateAssets(ctx, stopHookPath);
       installManagedSettings({
@@ -301997,7 +302237,7 @@ var claude = agent({
 init_core3();
 import { spawn as nodeSpawn2 } from "node:child_process";
 import { mkdirSync as mkdirSync12, writeFileSync as writeFileSync24 } from "node:fs";
-import { join as join67 } from "node:path";
+import { join as join68 } from "node:path";
 import { performance as performance7 } from "node:perf_hooks";
 import { StringDecoder as StringDecoder2 } from "node:string_decoder";
 import { setTimeout as sleep7 } from "node:timers/promises";
@@ -307680,7 +307920,7 @@ function autoSelectModel() {
 import { execFileSync as execFileSync4 } from "node:child_process";
 import { mkdirSync as mkdirSync11, writeFileSync as writeFileSync23 } from "node:fs";
 import { homedir as homedir3, userInfo as userInfo2 } from "node:os";
-import { join as join66 } from "node:path";
+import { join as join67 } from "node:path";
 
 // src/utils/agent/codexOAuth.ts
 init_webapi();
@@ -307734,8 +307974,8 @@ function installCodexAuth() {
   }
   const expiresMs = decodeJwtExpMs(body2.tokens.access_token) ?? 0;
   const xdgDataHome = resolveDataHome();
-  const opencodeDir = join66(xdgDataHome, "opencode");
-  const authPath = join66(opencodeDir, "auth.json");
+  const opencodeDir = join67(xdgDataHome, "opencode");
+  const authPath = join67(opencodeDir, "auth.json");
   const opencodeAuth = {
     openai: {
       type: "oauth",
@@ -307759,7 +307999,7 @@ function installCodexAuth() {
   };
 }
 function resolveDataHome() {
-  if (process.env.CI !== "true") return join66(homedir3(), ".local", "share");
+  if (process.env.CI !== "true") return join67(homedir3(), ".local", "share");
   bootstrapInfraweaverDataDir();
   return INFRAWEAVER_DATA_DIR;
 }
@@ -308033,7 +308273,7 @@ function newTurn() {
 function chargeTokenQuota2(ctx) {
   const quota = ctx.tokenQuota;
   if (!quota || !ctx.currentTurn || ctx.tokenQuotaExceeded) return;
-  if (!quota.observe(ctx.currentTurn.quotaSource, ctx.currentTurn.tokens)) return;
+  if (!quota.observe(ctx.currentTurn.quotaSource, quotaTokens(ctx.currentTurn.tokens))) return;
   ctx.tokenQuotaExceeded = true;
   log2.info(`\xBB ${ctx.label}: ${quota.gap()}`);
   ctx.abortRun?.(new TokenQuotaExceededError(quota.gap()));
@@ -308500,10 +308740,10 @@ var opencode = agent({
     const openAiCompatModel = resolveOpenAiCompatibleOpenCodeModel(rawModel);
     const model = isBedrockRoute ? `amazon-bedrock/${rawModel}` : vertexModel ?? openAiCompatModel ?? rawModel;
     const homeEnv = agentHomeEnv(ctx.tmpdir);
-    const opencodePluginDir = join67(homeEnv.XDG_CONFIG_HOME, "opencode", "plugin");
+    const opencodePluginDir = join68(homeEnv.XDG_CONFIG_HOME, "opencode", "plugin");
     mkdirSync12(opencodePluginDir, { recursive: true });
     writeFileSync24(
-      join67(opencodePluginDir, INFRAWEAVER_OPENCODE_GATE_PLUGIN_FILENAME),
+      join68(opencodePluginDir, INFRAWEAVER_OPENCODE_GATE_PLUGIN_FILENAME),
       buildOpencodeSubagentGateSource(ctx.subagentDeniedTools, writePolicyPath2(ctx.tmpdir))
     );
     installBundledSkills({ home: homeEnv.HOME });
@@ -309539,7 +309779,7 @@ async function fetchRunContext(params) {
 // src/utils/github/github.ts
 init_core3();
 import { rename as rename2, writeFile as writeFile2 } from "node:fs/promises";
-import { dirname as dirname12, join as join68 } from "node:path";
+import { dirname as dirname12, join as join69 } from "node:path";
 
 // node_modules/.pnpm/universal-user-agent@7.0.3/node_modules/universal-user-agent/index.js
 function getUserAgent2() {
@@ -315355,7 +315595,7 @@ function getGitHubUsageSummary() {
 }
 async function writeGitHubUsageSummaryToFile(path15) {
   const summary2 = getGitHubUsageSummary();
-  const tmpPath = join68(dirname12(path15), `.usage-summary-${process.pid}.tmp`);
+  const tmpPath = join69(dirname12(path15), `.usage-summary-${process.pid}.tmp`);
   await writeFile2(tmpPath, JSON.stringify(summary2));
   await rename2(tmpPath, path15);
 }
@@ -315900,7 +316140,7 @@ async function resolveModelAndAuth(params) {
 // src/utils/run/runLifecycle.ts
 init_core3();
 import { writeFile as writeFile5 } from "node:fs/promises";
-import { join as join71, resolve as resolve10 } from "node:path";
+import { join as join72, resolve as resolve10 } from "node:path";
 
 // src/utils/cloud/cloudReport.ts
 init_core3();
@@ -316294,7 +316534,7 @@ async function reportToCloud(input2) {
 
 // src/utils/cloud/learnings.ts
 import { mkdir as mkdir3, readFile as readFile3, writeFile as writeFile3 } from "node:fs/promises";
-import { dirname as dirname13, join as join69 } from "node:path";
+import { dirname as dirname13, join as join70 } from "node:path";
 
 // src/utils/cloud/learningsTruncate.ts
 var MAX_LEARNINGS_LENGTH = 1e5;
@@ -316311,7 +316551,7 @@ function truncateAtLineBoundary(body2, cap2) {
 // src/utils/cloud/learnings.ts
 var LEARNINGS_FILE_NAME = LEARNINGS_FILE;
 function learningsFilePath(tmpdir5) {
-  return join69(tmpdir5, LEARNINGS_FILE_NAME);
+  return join70(tmpdir5, LEARNINGS_FILE_NAME);
 }
 async function seedLearningsFile(params) {
   const path15 = learningsFilePath(params.tmpdir);
@@ -316442,7 +316682,7 @@ ${ctx.error}` : ctx.error;
 
 // src/utils/github/prSummary.ts
 import { mkdir as mkdir4, readFile as readFile4, writeFile as writeFile4 } from "node:fs/promises";
-import { dirname as dirname14, join as join70 } from "node:path";
+import { dirname as dirname14, join as join71 } from "node:path";
 var SUMMARY_FILE_NAME = SUMMARY_FILE;
 var SUMMARY_SCAFFOLD = `# PR summary
 
@@ -316452,7 +316692,7 @@ var SUMMARY_SCAFFOLD = `# PR summary
 var MIN_SNAPSHOT_LENGTH = 60;
 var MAX_SNAPSHOT_LENGTH = 32768;
 function summaryFilePath(tmpdir5) {
-  return join70(tmpdir5, SUMMARY_FILE_NAME);
+  return join71(tmpdir5, SUMMARY_FILE_NAME);
 }
 async function seedSummaryFile(params) {
   const path15 = summaryFilePath(params.tmpdir);
@@ -316986,7 +317226,7 @@ async function emitFindingsOutputs(toolState, requiredControls) {
       if (a.level === "error") error62(a.message, props);
       else warning(a.message, props);
     }
-    const sarifPath = join71(workspace, SARIF_FILE);
+    const sarifPath = join72(workspace, SARIF_FILE);
     if (session.emittedSarifPath && resolve10(session.emittedSarifPath) === resolve10(sarifPath)) {
       log2.info(`\xBB findings output: replacing the agent-emitted ${SARIF_FILE} with the gate's`);
     }
@@ -317416,9 +317656,9 @@ async function runAgentWithWatchdogs(params) {
 }
 
 // src/phases/startToolPlane.ts
-import { existsSync as existsSync18, readdirSync as readdirSync9 } from "node:fs";
+import { existsSync as existsSync19, readdirSync as readdirSync10 } from "node:fs";
 import { readFile as readFile5 } from "node:fs/promises";
-import { join as join72 } from "node:path";
+import { join as join73 } from "node:path";
 
 // src/utils/cloud/runTerminalStatus.ts
 var TERMINAL_STATE_KEY = "run_terminal";
@@ -318246,8 +318486,8 @@ ${instructions.user}` : null,
     log2.info(instructions.full);
   });
   if (toolContext.agentId === "opencode") {
-    const pluginDir = join72(process.cwd(), ".opencode", "plugin");
-    const hasPlugins = existsSync18(pluginDir) && readdirSync9(pluginDir).some((f) => /\.[jt]sx?$/.test(f));
+    const pluginDir = join73(process.cwd(), ".opencode", "plugin");
+    const hasPlugins = existsSync19(pluginDir) && readdirSync10(pluginDir).some((f) => /\.[jt]sx?$/.test(f));
     if (hasPlugins && toolState.dependencyInstallation?.promise) {
       log2.info(
         "\xBB .opencode/plugin/ detected \u2014 awaiting dependency installation before agent start"