infragen 0.1.0__tar.gz

infragen-0.1.0/.claude/settings.local.json

@@ -0,0 +1,23 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(curl *)",
+      "PowerShell(infragen *)",
+      "PowerShell(python -c \"import infragen.config, infragen.tools.llm, infragen.main; print\\('imports OK'\\)\")",
+      "PowerShell(git ls-tree *)",
+      "PowerShell(git *)",
+      "PowerShell(python -m pytest tests/ -q)",
+      "PowerShell(python -c \"import hcl2, io, json; print\\(json.dumps\\(hcl2.load\\(io.StringIO\\('resource \\\\\"aws_instance\\\\\" \\\\\"web\\\\\" {`n instance_type = \\\\\"m5.4xlarge\\\\\"`n}'\\)\\), indent=1\\)\\)\")",
+      "PowerShell(python \"C:\\\\Users\\\\adity\\\\AppData\\\\Local\\\\Temp\\\\claude\\\\C--Users-adity-OneDrive-Desktop-infragen\\\\364394a5-fda1-45bd-afa0-f21a33004478\\\\scratchpad\\\\inspect_hcl.py\")",
+      "PowerShell(python -m pytest tests/ -q; python -c \"from infragen.graph import build_generate_graph; from infragen import repl, main; print\\('imports OK'\\)\")",
+      "PowerShell(python -m pytest tests/ -q 2>$null)",
+      "PowerShell(New-Item *)",
+      "PowerShell(terraform *)",
+      "PowerShell(python -m pytest tests/ -q 2>$null; if \\($LASTEXITCODE -eq 0\\) { \"all 28 tests pass\" })",
+      "PowerShell(python -m pytest tests/ -q 2>$null; if \\($LASTEXITCODE -eq 0\\) { \"30 tests pass\" })",
+      "PowerShell(python -m pytest tests/ -q --tb=no 2>$null)",
+      "PowerShell(curl *)",
+      "PowerShell(try { Invoke-WebRequest -Uri https://pypi.org/pypi/infragen/json -UseBasicParsing -ErrorAction Stop | Out-Null; \"TAKEN\" } catch { if \\($_.Exception.Response.StatusCode.value__ -eq 404\\) { \"available\" } else { $_.Exception.Message } })"
+    ]
+  }
+}

infragen-0.1.0/.env.example

@@ -0,0 +1,7 @@
+# Copy this file to .env and fill in your key.
+# Get a free API key at https://console.groq.com/keys (no credit card required).
+GROQ_API_KEY=gsk_your_key_here
+
+# Optional overrides (defaults are set in infragen/config.py)
+# INFRAGEN_MODEL_MAIN=openai/gpt-oss-120b
+# INFRAGEN_MODEL_FAST=openai/gpt-oss-20b

infragen-0.1.0/.gitignore

@@ -0,0 +1,25 @@
+# Python
+__pycache__/
+*.py[cod]
+*.egg-info/
+dist/
+build/
+.venv/
+venv/
+
+# Env / secrets
+.env
+
+# Tooling
+.pytest_cache/
+.ruff_cache/
+
+# InfraGen workspace state (generated per user project, not this repo)
+.infragen/
+
+# Terraform (in case of local experiments)
+.terraform/
+*.tfstate
+*.tfstate.backup
+
+CLAUDE.md

infragen-0.1.0/MANIFEST.in

@@ -0,0 +1,2 @@
+include README.md
+include .env.example

infragen-0.1.0/PKG-INFO

@@ -0,0 +1,98 @@
+Metadata-Version: 2.4
+Name: infragen
+Version: 0.1.0
+Summary: Multi-agent CLI that generates Terraform and deploys full-stack apps to AWS/GCP free tier
+Project-URL: Repository, https://github.com/adityapanyala/infragen
+Author: Aditya Panyala
+License: MIT
+Keywords: agents,aws,cli,free-tier,gcp,iac,llm,terraform
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Software Development :: Build Tools
+Requires-Python: >=3.11
+Requires-Dist: httpx>=0.27.0
+Requires-Dist: langchain-core>=0.3.0
+Requires-Dist: langchain-groq>=0.2.0
+Requires-Dist: langgraph>=0.2.0
+Requires-Dist: python-dotenv>=1.0.0
+Requires-Dist: python-hcl2>=4.3.0
+Requires-Dist: rich>=13.0.0
+Requires-Dist: typer>=0.12.0
+Provides-Extra: dev
+Requires-Dist: build; extra == 'dev'
+Requires-Dist: pytest>=8.0.0; extra == 'dev'
+Requires-Dist: twine; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# InfraGen
+
+Multi-agent CLI that takes a plain-English description of your app and deploys it to the **AWS or GCP free tier** — generates Terraform, provisions infrastructure, and pushes your code, with a review-and-confirm gate before anything runs.
+
+```
+$ infragen deploy
+detected: react frontend at ./frontend; fastapi backend at ./backend
+tf_write: attempt 1 generated 219 lines of HCL
+guardrail: PASS, 0 warning(s)
+validate: PASS
++--------------------------- review before deploy ---------------------------+
+| terraform plan: 10 to add, 0 to change, 0 to destroy                       |
+|   aws_instance.backend (created)                                           |
+|   aws_s3_bucket.frontend (created)  ...                                    |
+| free tier: all resources within free tier limits                           |
+| deploy steps:                                                              |
+|   1. build frontend (react)                                                |
+|   2. upload frontend to s3://...                                           |
+|   3. copy backend code to ubuntu@...                                       |
+|   4. install dependencies and start fastapi on port 8000                   |
+| estimated monthly cost: $0.00 (free tier)                                  |
++----------------------------------------------------------------------------+
+Deploy this? [y/N]:
+```
+
+## Why
+
+Free-tier users get surprise bills from two things: resources that were never free (NAT gateways, oversized instances) and forgotten resources left running. InfraGen guards both ends: a **deterministic free-tier auditor** checks every generated resource against hardcoded limit tables (an LLM can miss a paid instance type; a dict lookup can't), and `infragen destroy` tears everything down from tracked state.
+
+## Install
+
+```bash
+pip install -e ".[dev]"        # from a clone (PyPI release planned)
+cp .env.example .env           # add YOUR OWN free Groq API key (console.groq.com/keys)
+infragen doctor                # verify terraform + aws/gcloud are ready
+```
+
+**Bring your own accounts** — infragen ships no credentials. You need:
+
+- Python 3.11+ and [Terraform](https://developer.hashicorp.com/terraform/install)
+- your own **Groq API key** (free, no credit card) in a `.env` file in your project, or globally in `~/.infragen.env`
+- your own **AWS** account with the CLI authenticated (`aws configure`), or **GCP** with `gcloud auth login` — deploys go to *your* cloud account, on its free tier
+
+The CLI checks all of this up front and prints setup instructions for anything missing.
+
+## Usage
+
+```bash
+infragen                        # REPL: describe infra, get audited Terraform
+infragen deploy                 # scan project -> generate -> review -> deploy
+infragen deploy --dry-run       # everything except apply (CI-friendly)
+infragen destroy                # tear down everything (with confirmation)
+infragen explain ./main.tf      # plain-English explanation of any Terraform
+infragen translate ./ --to gcp  # convert AWS Terraform to GCP (or vice versa)
+infragen validate ./            # terraform validate + free-tier audit + tflint
+infragen doctor                 # prerequisite checks
+```
+
+Supported app patterns (any combination): static frontends (React/Vue/Next/plain) on S3 or Cloud Storage, Python backends (FastAPI/Flask/Django) on EC2 or Compute Engine. All artifacts and state live in `.infragen/` inside your project, so redeploys update the same stack.
+
+## How it works
+
+A LangGraph state machine (running on Groq's free LLM tier) drives generation: a **TF writer** produces HCL, a **deterministic guardrail** blocks anything outside free-tier limits (feeding precise substitutions back for a rewrite), and a **validator** loops `terraform validate` errors back until clean — max 3 attempts. Deployment steps are built deterministically from the scanned app spec plus real terraform outputs, and the review panel is backed by actual `terraform plan` output, never an LLM's summary of intent.
+
+## Development
+
+```bash
+python -m pytest tests/ -q     # unit tests (no API key needed)
+```

infragen-0.1.0/README.md

@@ -0,0 +1,69 @@
+# InfraGen
+
+Multi-agent CLI that takes a plain-English description of your app and deploys it to the **AWS or GCP free tier** — generates Terraform, provisions infrastructure, and pushes your code, with a review-and-confirm gate before anything runs.
+
+```
+$ infragen deploy
+detected: react frontend at ./frontend; fastapi backend at ./backend
+tf_write: attempt 1 generated 219 lines of HCL
+guardrail: PASS, 0 warning(s)
+validate: PASS
++--------------------------- review before deploy ---------------------------+
+| terraform plan: 10 to add, 0 to change, 0 to destroy                       |
+|   aws_instance.backend (created)                                           |
+|   aws_s3_bucket.frontend (created)  ...                                    |
+| free tier: all resources within free tier limits                           |
+| deploy steps:                                                              |
+|   1. build frontend (react)                                                |
+|   2. upload frontend to s3://...                                           |
+|   3. copy backend code to ubuntu@...                                       |
+|   4. install dependencies and start fastapi on port 8000                   |
+| estimated monthly cost: $0.00 (free tier)                                  |
++----------------------------------------------------------------------------+
+Deploy this? [y/N]:
+```
+
+## Why
+
+Free-tier users get surprise bills from two things: resources that were never free (NAT gateways, oversized instances) and forgotten resources left running. InfraGen guards both ends: a **deterministic free-tier auditor** checks every generated resource against hardcoded limit tables (an LLM can miss a paid instance type; a dict lookup can't), and `infragen destroy` tears everything down from tracked state.
+
+## Install
+
+```bash
+pip install -e ".[dev]"        # from a clone (PyPI release planned)
+cp .env.example .env           # add YOUR OWN free Groq API key (console.groq.com/keys)
+infragen doctor                # verify terraform + aws/gcloud are ready
+```
+
+**Bring your own accounts** — infragen ships no credentials. You need:
+
+- Python 3.11+ and [Terraform](https://developer.hashicorp.com/terraform/install)
+- your own **Groq API key** (free, no credit card) in a `.env` file in your project, or globally in `~/.infragen.env`
+- your own **AWS** account with the CLI authenticated (`aws configure`), or **GCP** with `gcloud auth login` — deploys go to *your* cloud account, on its free tier
+
+The CLI checks all of this up front and prints setup instructions for anything missing.
+
+## Usage
+
+```bash
+infragen                        # REPL: describe infra, get audited Terraform
+infragen deploy                 # scan project -> generate -> review -> deploy
+infragen deploy --dry-run       # everything except apply (CI-friendly)
+infragen destroy                # tear down everything (with confirmation)
+infragen explain ./main.tf      # plain-English explanation of any Terraform
+infragen translate ./ --to gcp  # convert AWS Terraform to GCP (or vice versa)
+infragen validate ./            # terraform validate + free-tier audit + tflint
+infragen doctor                 # prerequisite checks
+```
+
+Supported app patterns (any combination): static frontends (React/Vue/Next/plain) on S3 or Cloud Storage, Python backends (FastAPI/Flask/Django) on EC2 or Compute Engine. All artifacts and state live in `.infragen/` inside your project, so redeploys update the same stack.
+
+## How it works
+
+A LangGraph state machine (running on Groq's free LLM tier) drives generation: a **TF writer** produces HCL, a **deterministic guardrail** blocks anything outside free-tier limits (feeding precise substitutions back for a rewrite), and a **validator** loops `terraform validate` errors back until clean — max 3 attempts. Deployment steps are built deterministically from the scanned app spec plus real terraform outputs, and the review panel is backed by actual `terraform plan` output, never an LLM's summary of intent.
+
+## Development
+
+```bash
+python -m pytest tests/ -q     # unit tests (no API key needed)
+```

infragen-0.1.0/infragen/__init__.py

@@ -0,0 +1,3 @@
+"""InfraGen — multi-agent CLI that deploys full-stack apps to AWS/GCP free tier."""
+
+__version__ = "0.1.0"

infragen-0.1.0/infragen/agents/deployment_planner.py

@@ -0,0 +1,153 @@
+"""Deployment Planner — builds the ordered, structured step list that the
+deployer executes after terraform apply.
+
+Deterministic: steps are derived from the scanned app spec + terraform
+outputs. Steps are plain data (JSON-serializable) so the review panel can
+show exactly what will run, and `.infragen/deploy_steps.json` records it.
+"""
+
+from __future__ import annotations
+
+import getpass
+import json
+import os
+from dataclasses import dataclass, field, asdict
+from pathlib import Path
+
+from infragen.tools.scanner import AppSpec
+
+SSH_OPTS = ["-i", "{key_path}", "-o", "StrictHostKeyChecking=accept-new"]
+
+
+@dataclass
+class Step:
+    description: str
+    argv: list[str]              # command + args (no shell), placeholders resolved
+    cwd: str | None = None
+    shell: bool = False          # npm on Windows needs shell resolution
+    env: dict[str, str] = field(default_factory=dict)
+
+    def as_dict(self) -> dict:
+        return asdict(self)
+
+
+class MissingOutputError(RuntimeError):
+    """A terraform output the deploy steps depend on was not produced."""
+
+
+def _require(outputs: dict[str, str], name: str) -> str:
+    value = outputs.get(name, "").strip()
+    if not value:
+        raise MissingOutputError(
+            f"terraform output '{name}' is missing or empty - cannot build deploy steps"
+        )
+    return value
+
+
+def _key_permission_steps(key_path: str, windows: bool | None = None) -> list[Step]:
+    """Restrict the SSH key so OpenSSH accepts it.
+
+    Terraform's file_permission=0600 does not translate to Windows ACLs, and
+    Windows OpenSSH refuses keys readable by other users ("bad permissions").
+    """
+    if windows is None:
+        windows = os.name == "nt"
+    if windows:
+        user = getpass.getuser()
+        return [
+            Step(
+                description="restrict SSH key permissions (remove inherited ACLs)",
+                argv=["icacls", key_path, "/inheritance:r"],
+            ),
+            Step(
+                description=f"restrict SSH key permissions (grant only {user})",
+                argv=["icacls", key_path, "/grant:r", f"{user}:R"],
+            ),
+        ]
+    return [Step(description="restrict SSH key permissions", argv=["chmod", "600", key_path])]
+
+
+def build_steps(spec: AppSpec, provider: str, outputs: dict[str, str], workdir: str | Path) -> list[Step]:
+    steps: list[Step] = []
+    workdir = Path(workdir)
+
+    if spec.frontend:
+        f = spec.frontend
+        if f.build_command:
+            steps.append(Step(
+                description=f"build frontend ({f.framework})",
+                argv=f.build_command.split(),
+                cwd=f.path,
+                shell=True,   # npm/npx are .cmd shims on Windows
+            ))
+        build_dir = str(Path(f.path) / (f.build_output_dir or "."))
+        bucket = _require(outputs, "frontend_bucket_name")
+        if provider == "aws":
+            steps.append(Step(
+                description=f"upload frontend to s3://{bucket}",
+                argv=["aws", "s3", "sync", build_dir, f"s3://{bucket}", "--delete"],
+                shell=True,
+            ))
+        else:
+            steps.append(Step(
+                description=f"upload frontend to gs://{bucket}",
+                argv=["gsutil", "-m", "rsync", "-r", "-d", build_dir, f"gs://{bucket}"],
+                shell=True,
+            ))
+
+    if spec.backend:
+        b = spec.backend
+        ip = _require(outputs, "backend_public_ip")
+        user = outputs.get("backend_ssh_user", "ubuntu").strip() or "ubuntu"
+        key_path = str(workdir / "infragen_key.pem")
+        ssh_opts = [opt.format(key_path=key_path) for opt in SSH_OPTS]
+        steps.extend(_key_permission_steps(key_path))
+        module = (b.entry_point or "main.py").replace("\\", "/").removesuffix(".py").replace("/", ".")
+
+        steps.append(Step(
+            description=f"copy backend code to {user}@{ip}",
+            # rm first: scp -r into an existing dir would nest a copy inside it
+            argv=["ssh", *ssh_opts, f"{user}@{ip}", f"rm -rf /home/{user}/app"],
+        ))
+        steps.append(Step(
+            description=f"upload backend code",
+            argv=["scp", *ssh_opts, "-r", b.path, f"{user}@{ip}:/home/{user}/app"],
+        ))
+        # A venv sidesteps PEP 668 (--break-system-packages exists only on new
+        # pip and errors on old pip) and works on every Ubuntu version.
+        setup = (
+            f"cd /home/{user}/app && "
+            "sudo apt-get update -qq && "
+            "sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq python3-venv python3-pip psmisc && "
+            "python3 -m venv .venv && "
+            ".venv/bin/pip install -q --upgrade pip && "
+            ".venv/bin/pip install -q -r requirements.txt "
+        )
+        if b.framework == "django":
+            run_cmd = f"nohup .venv/bin/python manage.py runserver 0.0.0.0:{b.port} > app.log 2>&1 &"
+        elif b.framework == "flask":
+            run_cmd = f"nohup .venv/bin/python -m flask --app {module} run --host 0.0.0.0 --port {b.port} > app.log 2>&1 &"
+        else:  # fastapi
+            setup += "&& .venv/bin/pip install -q uvicorn "
+            run_cmd = f"nohup .venv/bin/python -m uvicorn {module}:app --host 0.0.0.0 --port {b.port} > app.log 2>&1 &"
+        # Verify the server responds (any HTTP status counts) or fail loudly
+        # with the log tail - a silent nohup must not report success.
+        verify = (
+            f"sleep 4; curl -s -o /dev/null http://127.0.0.1:{b.port}/ "
+            f"&& echo BACKEND_UP || (echo BACKEND_FAILED; tail -n 30 app.log; exit 1)"
+        )
+        steps.append(Step(
+            description=f"install dependencies and start {b.framework} on port {b.port}",
+            # Stop any previous server by PORT (fuser), never by process name:
+            # pkill -f would match this very ssh command line and kill itself.
+            argv=["ssh", *ssh_opts, f"{user}@{ip}",
+                  f"{setup}&& sudo fuser -k {b.port}/tcp 2>/dev/null || true; sleep 1; {run_cmd} {verify}"],
+        ))
+
+    return steps
+
+
+def save_steps(steps: list[Step], workdir: str | Path) -> Path:
+    path = Path(workdir) / "deploy_steps.json"
+    path.write_text(json.dumps([s.as_dict() for s in steps], indent=2), encoding="utf-8")
+    return path

infragen-0.1.0/infragen/agents/docs_generator.py

@@ -0,0 +1,39 @@
+"""Docs Generator agent — writes a README for the deployed infrastructure."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from langchain_core.messages import HumanMessage, SystemMessage
+
+from infragen.tools.llm import get_llm
+
+_SYSTEM_PROMPT = """Write a README.md for infrastructure that was just deployed with \
+the infragen CLI. Sections, in order:
+
+# <short project title>
+## What is deployed
+## Live URLs / endpoints  (from the terraform outputs given)
+## Prerequisites          (terraform, aws/gcloud CLI authenticated)
+## Redeploying            (`infragen deploy` is idempotent - updates in place)
+## Free tier impact       (which limits apply; state it costs $0/month within them)
+## Cleanup                (`infragen destroy` removes everything; warn that free \
+tier hours are finite - do not leave unused instances running)
+
+Be accurate to the given Terraform and outputs - do not invent resources or URLs. \
+Output only the markdown."""
+
+
+def generate_readme(workdir: str | Path, outputs: dict[str, str]) -> Path:
+    """Generate .infragen/README.md from the deployed config + outputs."""
+    workdir = Path(workdir)
+    hcl = (workdir / "main.tf").read_text(encoding="utf-8")
+    outputs_text = "\n".join(f"{k} = {v}" for k, v in outputs.items()) or "(none)"
+
+    response = get_llm(fast=True).invoke([
+        SystemMessage(content=_SYSTEM_PROMPT),
+        HumanMessage(content=f"Terraform:\n{hcl}\n\nTerraform outputs:\n{outputs_text}"),
+    ])
+    readme = workdir / "README.md"
+    readme.write_text(response.content, encoding="utf-8")
+    return readme

infragen-0.1.0/infragen/agents/explainer.py

@@ -0,0 +1,56 @@
+"""Explainer agent — plain-English summaries of Terraform files."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from langchain_core.messages import HumanMessage, SystemMessage
+
+from infragen import config
+from infragen.tools.llm import get_llm
+
+_SYSTEM_PROMPT = """You explain Terraform configurations to developers who may not \
+know Terraform. Be concrete and brief. Structure the answer as markdown:
+
+## What gets deployed
+One bullet per resource, in dependency order, each explaining WHAT it is and WHY \
+it's there (e.g. "an S3 bucket configured as a public static website - hosts the \
+frontend files").
+
+## How it connects
+2-4 sentences on how the pieces talk to each other (network path, ports, policies).
+
+## Free tier impact
+For each billable service, state the relevant free tier limit and whether this \
+config stays inside it. Relevant limits:
+{quotas}
+
+Do not invent resources that are not in the file. If something looks risky or \
+unusual, say so plainly."""
+
+
+def read_tf(path: str | Path) -> str:
+    """Read a .tf file, or concatenate all .tf files in a directory."""
+    path = Path(path)
+    if path.is_file():
+        return path.read_text(encoding="utf-8")
+    files = sorted(path.glob("*.tf"))
+    if not files:
+        raise FileNotFoundError(f"no .tf files found at {path}")
+    return "\n\n".join(
+        f"# --- {f.name} ---\n{f.read_text(encoding='utf-8')}" for f in files
+    )
+
+
+def explain(path: str | Path) -> str:
+    hcl = read_tf(path)
+    quotas = "\n".join(
+        f"- {cloud} {service}: {limit}"
+        for cloud, services in config.FREE_TIER_QUOTAS.items()
+        for service, limit in services.items()
+    )
+    response = get_llm(fast=True).invoke([
+        SystemMessage(content=_SYSTEM_PROMPT.format(quotas=quotas)),
+        HumanMessage(content=hcl),
+    ])
+    return response.content

infragen-0.1.0/infragen/agents/free_tier_guard.py

@@ -0,0 +1,52 @@
+"""Free Tier Guardrail graph node.
+
+The audit itself is deterministic (tools/free_tier.py). This node runs it
+and, when there are violations, turns them into rewrite feedback for the
+TF Writer. No LLM call is needed for the loop — findings already carry
+the substitute value.
+"""
+
+from __future__ import annotations
+
+from infragen.graph import InfraGenState
+from infragen.tools import free_tier
+
+
+def guardrail_node(state: InfraGenState) -> dict:
+    try:
+        result = free_tier.audit_hcl(state["hcl"])
+    except free_tier.HclParseError:
+        # The writer produced prose (e.g. a refusal) instead of HCL — loop back.
+        return {
+            "guardrail_findings": [{
+                "severity": "violation",
+                "resource": "(output)",
+                "message": "previous output was not valid Terraform HCL",
+                "attribute": None, "actual_value": None, "suggestion": None,
+            }],
+            "feedback": [
+                "Your output was not valid Terraform HCL. Output ONLY raw HCL code. "
+                "If the request asks for non-free-tier resources, generate the closest "
+                "free-tier-eligible equivalent instead of refusing or explaining."
+            ],
+            "log": ["guardrail: output was not parseable HCL"],
+        }
+    findings = [f.as_dict() for f in result.findings]
+
+    feedback = []
+    for finding in result.violations:
+        line = f"{finding.resource_address}: {finding.message}"
+        if finding.suggestion and finding.attribute:
+            line += f" Set {finding.attribute} = \"{finding.suggestion}\"."
+        elif finding.suggestion:
+            line += f" Use {finding.suggestion} instead."
+        else:
+            line += " Remove this resource and restructure without it."
+        feedback.append(line)
+
+    status = "PASS" if result.passed else f"{len(result.violations)} violation(s)"
+    return {
+        "guardrail_findings": findings,
+        "feedback": feedback,
+        "log": [f"guardrail: {status}, {len(result.warnings)} warning(s)"],
+    }

infragen-0.1.0/infragen/agents/orchestrator.py

@@ -0,0 +1,45 @@
+"""Orchestrator — the entry point the REPL talks to.
+
+Phase 3 scope: detect the target provider, prepare the workspace, and run
+the generate graph. Intent routing to explain/translate/deploy expands in
+Phases 4-5.
+"""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+from infragen import config
+from infragen.graph import InfraGenState, build_generate_graph
+
+_GCP_HINTS = re.compile(r"\b(gcp|google|gcloud|firestore|cloud run|cloud function)\b", re.IGNORECASE)
+
+
+def detect_provider(request: str) -> str:
+    return "gcp" if _GCP_HINTS.search(request) else "aws"
+
+
+def workspace_dir(project_root: str | Path = ".") -> Path:
+    return (Path(project_root) / config.WORKSPACE_DIR).resolve()
+
+
+def run_generate(
+    request: str,
+    project_root: str | Path = ".",
+    *,
+    provider: str | None = None,
+    app_spec: dict | None = None,
+) -> InfraGenState:
+    """Run the tf_write -> guardrail -> validate loop; returns final state."""
+    graph = build_generate_graph()
+    initial: InfraGenState = {
+        "request": request,
+        "provider": provider or detect_provider(request),
+        "workdir": str(workspace_dir(project_root)),
+        "app_spec": app_spec,
+        "attempts": 0,
+        "feedback": [],
+        "log": [],
+    }
+    return graph.invoke(initial)

infragen-0.1.0/infragen/agents/project_scanner.py

@@ -0,0 +1,65 @@
+"""Project Scanner agent — wraps the deterministic scan and describes the
+detected app for the TF Writer. Ambiguities (multiple entry points) are
+surfaced rather than silently guessed wrong.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from infragen.tools.scanner import AppSpec, scan
+
+
+def scan_project(root: str | Path = ".") -> tuple[AppSpec, list[str]]:
+    """Scan and return (spec, notes) where notes are human-facing caveats."""
+    spec = scan(root)
+    notes: list[str] = []
+    if spec.backend and len(spec.backend.candidates) > 1:
+        notes.append(
+            f"multiple backend entry points found {spec.backend.candidates}; "
+            f"using '{spec.backend.entry_point}'"
+        )
+    return spec, notes
+
+
+def describe_for_writer(spec: AppSpec, provider: str, instance_type: str = "t3.micro") -> str:
+    """Build the TF Writer request for a full app deploy, including the exact
+    terraform outputs the deployment steps rely on."""
+    parts: list[str] = ["Deploy this application to the free tier:"]
+    outputs_needed: list[str] = []
+
+    if spec.frontend:
+        f = spec.frontend
+        parts.append(
+            f"- Static frontend: {f.framework} app at '{f.path}'"
+            + (f", built with `{f.build_command}` into '{f.build_output_dir}/'" if f.build_command else "")
+            + ". Host it on "
+            + ("an S3 bucket configured as a static website (public read via bucket policy, "
+               "website configuration with index.html)." if provider == "aws"
+               else "a public Cloud Storage bucket with website configuration.")
+        )
+        outputs_needed += (
+            ['output "frontend_bucket_name" (the bucket name)',
+             'output "frontend_website_url" (the website endpoint URL)']
+        )
+
+    if spec.backend:
+        b = spec.backend
+        parts.append(
+            f"- Python backend: {b.framework} app at '{b.path}', entry point '{b.entry_point}', "
+            f"listening on port {b.port}. Host it on "
+            + (f"a {instance_type} EC2 instance (ubuntu AMI via data source; pick the AMI "
+               f"architecture matching the instance type) with a security group "
+               f"allowing inbound tcp {b.port} and 22. Create a tls_private_key + aws_key_pair "
+               f"and write the private key to a local_file named 'infragen_key.pem' with the "
+               f"file permission 0600." if provider == "aws"
+               else f"an e2-micro compute instance with ubuntu image, firewall allowing tcp {b.port} and 22.")
+        )
+        outputs_needed += (
+            ['output "backend_public_ip" (the instance public IP)',
+             'output "backend_ssh_user" (value "ubuntu")']
+        )
+
+    if outputs_needed:
+        parts.append("REQUIRED terraform outputs (exact names): " + "; ".join(outputs_needed))
+    return "\n".join(parts)