nexarch 0.13.0 → 0.13.1

package/dist/lib/iac-tool.js

@@ -0,0 +1,138 @@
+import { readdirSync, readFileSync, statSync } from "fs";
+import { join } from "path";
+import { detectAnsibleProject } from "./ansible-detect.js";
+const HASHICORP_SHAPED = {
+    estateArgs: ["show", "-json"],
+    unitNoun: "root module",
+    hasWorkspaces: true,
+    provisions: true,
+};
+export const IAC_TOOLS = [
+    { id: "terraform", displayName: "Terraform", executable: "terraform", applyExecutable: "terraform", aliases: ["terraform"], ...HASHICORP_SHAPED },
+    { id: "opentofu", displayName: "OpenTofu", executable: "tofu", applyExecutable: "tofu", aliases: ["opentofu", "tofu"], ...HASHICORP_SHAPED },
+    {
+        id: "ansible",
+        displayName: "Ansible",
+        executable: "ansible-inventory",
+        // --export resolves group and host variables the way a playbook run would
+        // see them, rather than printing the raw file.
+        estateArgs: ["--list", "--export"],
+        applyExecutable: "ansible-playbook",
+        unitNoun: "inventory",
+        hasWorkspaces: false,
+        provisions: false,
+        aliases: ["ansible"],
+    },
+];
+export function getIacTool(value) {
+    if (!value)
+        return null;
+    const normalised = value.trim().toLowerCase();
+    return IAC_TOOLS.find((tool) => tool.aliases.includes(normalised)) ?? null;
+}
+const IGNORED = new Set(["node_modules", ".git", ".terraform", "dist", "build", ".next"]);
+/**
+ * Files that say how the estate is *run*. Deliberately not `.tf` or `.hcl`:
+ * OpenTofu reads the same HCL and kept the `terraform { ... }` block name, so
+ * every OpenTofu repository on earth contains the word "terraform" in its
+ * configuration. Treating that as evidence of the Terraform CLI made a real
+ * OpenTofu estate -- `terraform {}` block, `tofu apply` in CI -- come back
+ * ambiguous, which then threw, so the one case this feature exists for could
+ * not be ingested without passing --tool by hand.
+ */
+const AUTOMATION_FILE = /\.(ya?ml|json|sh|bash|ps1|tfvars)$|^(Makefile|Taskfile\.ya?ml|justfile)$/i;
+/** `.tofu` is OpenTofu-only: it is the extension Terraform will not read. */
+const TOFU_SOURCE_FILE = /\.tofu$/i;
+/**
+ * A CLI invocation, not a mention. `terraform apply`, `tofu init`, `tofu -chdir`.
+ * The subcommand list is what automation actually runs; "terraform" alone in a
+ * comment, a module source or an HCL block is not evidence of either binary.
+ */
+// Built with String.raw, not a plain template literal: in a plain one the
+// backslash escapes are consumed by the string before the regex ever sees
+// them, which is how the first version of these came to match nothing at all
+// and report every repository as "defaulted".
+const SUBCOMMANDS = "init|plan|apply|show|destroy|validate|state|workspace|output|fmt|refresh|import|providers|-chdir";
+const TERRAFORM_COMMAND = new RegExp(String.raw `(?:^|[^\w./-])terraform\s+(?:${SUBCOMMANDS})\b`, "im");
+const TOFU_COMMAND = new RegExp(String.raw `(?:^|[^\w./-])tofu\s+(?:${SUBCOMMANDS})\b`, "im");
+function collectEvidence(dir, depth = 0, found = { terraform: false, opentofu: false }) {
+    if (depth > 4 || (found.terraform && found.opentofu))
+        return found;
+    let entries;
+    try {
+        entries = readdirSync(dir);
+    }
+    catch {
+        return found;
+    }
+    for (const entry of entries) {
+        if (IGNORED.has(entry))
+            continue;
+        const full = join(dir, entry);
+        try {
+            if (statSync(full).isDirectory()) {
+                collectEvidence(full, depth + 1, found);
+            }
+            else if (TOFU_SOURCE_FILE.test(entry)) {
+                found.opentofu = true;
+            }
+            else if (AUTOMATION_FILE.test(entry)) {
+                // One file at a time: the first version pushed every file's full
+                // contents into an array before matching, which on a large estate is
+                // the whole repository held in memory to answer a yes/no.
+                const text = readFileSync(full, "utf8");
+                if (!found.opentofu && TOFU_COMMAND.test(text))
+                    found.opentofu = true;
+                if (!found.terraform && TERRAFORM_COMMAND.test(text))
+                    found.terraform = true;
+            }
+        }
+        catch { /* unreadable configuration is not evidence */ }
+        if (found.terraform && found.opentofu)
+            return found;
+    }
+    return found;
+}
+/**
+ * Detects the IaC tool from how the repository is actually driven — the
+ * commands its automation runs, `.tofu` files, which only OpenTofu reads, and
+ * Ansible's own repository shape.
+ *
+ * Terraform and OpenTofu together is genuinely ambiguous: they are the same
+ * tool twice, so one estate cannot be read by guessing which. **Terraform and
+ * Ansible together is not** — it is the most ordinary infrastructure repository
+ * there is, one tool provisioning and the other configuring, and they describe
+ * different things. So the provisioning tool wins and the signals say the
+ * inventory is there to be ingested too, rather than refusing a layout that is
+ * completely normal.
+ */
+export function detectIacTool(dir, requestedTool) {
+    if (requestedTool) {
+        const tool = getIacTool(requestedTool);
+        if (!tool)
+            throw new Error(`Unknown IaC tool "${requestedTool}". Use terraform, opentofu or ansible.`);
+        return { status: "detected", tool, signals: [`--tool ${tool.id}`] };
+    }
+    const { terraform, opentofu } = collectEvidence(dir);
+    const ansible = detectAnsibleProject(dir);
+    const alsoAnsible = ansible.isAnsible ? ["Ansible is here too — ingest its inventory with --tool ansible"] : [];
+    if (terraform && opentofu) {
+        return { status: "ambiguous", tool: null, signals: ["both `terraform` and `tofu` commands are run by this repository", ...alsoAnsible] };
+    }
+    if (opentofu)
+        return { status: "detected", tool: IAC_TOOLS[1], signals: ["`tofu` commands or .tofu files", ...alsoAnsible] };
+    if (terraform)
+        return { status: "detected", tool: IAC_TOOLS[0], signals: ["`terraform` commands", ...alsoAnsible] };
+    if (ansible.isAnsible) {
+        const tool = IAC_TOOLS.find((candidate) => candidate.id === "ansible");
+        return { status: "detected", tool, signals: ansible.signals };
+    }
+    return { status: "defaulted", tool: IAC_TOOLS[0], signals: ["no IaC CLI named in automation; defaulting to Terraform"] };
+}
+export function iacToolOrThrow(dir, requestedTool) {
+    const detection = detectIacTool(dir, requestedTool);
+    if (detection.status === "ambiguous") {
+        throw new Error("Both Terraform and OpenTofu were detected. Select the state CLI explicitly with --tool terraform or --tool opentofu.");
+    }
+    return detection.tool;
+}

package/dist/lib/skills.js

@@ -317,22 +317,44 @@ say so rather than skipping it or inventing a target.
 `;
 const FEEDBACK_SKILL_BODY = `---
 name: nexarch-feedback
-description: Report a Nexarch tool problem or misleading graph answer. Use after a blocked tool error that required a workaround, a graph answer that was wrong or unhelpful enough to mislead, or an ambiguous repository agent instruction that contradicts tool behaviour. Requires the Nexarch MCP tools (nexarch_*).
+description: Offer to report a Nexarch problem the moment you notice it, rather than waiting to be asked. Use when a Nexarch tool error blocked work and needed a workaround, when a graph answer was wrong or misleading, or when a repository agent instruction contradicts what the tools actually do. Ask the human before sending. Requires the Nexarch MCP tools (nexarch_*).
 ---
 
 # Nexarch Feedback
 
-Call \`nexarch_submit_feedback\` when a Nexarch tool error blocked the task and
-you had to work around it; when a graph answer was wrong or unhelpful enough to
-mislead; or when an instruction in the repository's agent files was ambiguous
-or contradicted what the tools actually do.
+These are worth reporting to Nexarch: a Nexarch tool error that blocked the task
+and made you work around it; a graph answer that was wrong or unhelpful enough
+to mislead; an instruction in the repository's agent files that was ambiguous or
+contradicted what the tools actually do.
 
-Make each report useful: write one concrete sentence, name the tool or surface
-involved, and say what you expected instead. Include reproduction detail when
-it clarifies the problem.
+## Offer to report it when it happens
 
-Do **not** report a refused write when governance was working as designed, or
-your own malformed call. Fix the call or follow the governance response instead.
+When you notice one, raise it with the human in the next thing you say to them
+— not in a closing summary or a list of open items at the end of the task. Say
+in a sentence or two what looked wrong, and ask whether they would like you to
+report it to Nexarch.
+
+- If they say yes, call \`nexarch_submit_feedback\` and tell them the feedback id
+  you got back.
+- If they say no, drop it and do not offer again for the same problem.
+- Do not send a report without their yes, unless they have already told you in
+  this session to report problems without asking.
+
+If you find yourself writing "this may be a Nexarch bug", that is the moment to
+offer.
+
+## Make each report useful
+
+Write one concrete sentence, name the tool or surface involved, and say what
+you expected instead. Include reproduction detail when it clarifies the
+problem. Never include secrets, credentials or customer data.
+
+## Do not offer to report
+
+A refused write when governance was working as designed, or your own malformed
+call. Fix the call or follow the governance response instead. Work that is
+waiting on a human decision, such as a proposed application awaiting
+activation, is the process working, not a fault.
 `;
 export const SKILLS = [
     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexarch",
-  "version": "0.13.0",
+  "version": "0.13.1",
   "description": "Your architecture workspace for AI delivery.",
   "keywords": [
     "nexarch",
@@ -26,7 +26,7 @@
     "prepublishOnly": "tsc",
     "dev": "tsx src/index.ts",
     "typecheck": "tsc --noEmit",
-    "test": "tsx scripts/test-mcp-proxy-response.ts && tsx scripts/test-trust-reattest.ts && tsx scripts/test-similar-applications.ts"
+    "test": "tsx scripts/test-mcp-proxy-response.ts && tsx scripts/test-trust-reattest.ts && tsx scripts/test-similar-applications.ts && tsx scripts/test-iac-tool.ts && tsx scripts/test-ansible.ts && tsx scripts/test-reference-sightings.ts"
   },
   "devDependencies": {
     "@types/node": "^22",