thothctl 0.16.2__tar.gz → 0.16.4__tar.gz

{thothctl-0.16.2 → thothctl-0.16.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: thothctl
-Version: 0.16.2
+Version: 0.16.4
 Summary: A CLI for Developer Control Plane. Accelerate your cloud IaC deployments.
 Project-URL: SourceCode, https://github.com/thothforge/thothctl
 Project-URL: HomePage, https://github.com/thothforge/thothctl

{thothctl-0.16.2 → thothctl-0.16.4}/docs/framework/commands/check/check_project_iac.md

@@ -17,9 +17,99 @@ Options:
                                   Type of IaC check to perform [default: structure]
   -p, --project-type [stack|module]
                                   Project type: stack or module [default: stack]
+  --org-policy TEXT               Organization policy source (Git URL or local path)
+  --enforcement [soft|hard]       Enforcement mode: soft (report) or hard (fail pipeline)
   --help                          Show this message and exit.
 ```
 
+## Organization Policy Enforcement
+
+ThothCTL can enforce organizational standards that projects **cannot override**. This ensures all projects in your organization follow the same structure, naming, and tagging rules — regardless of what individual `.thothcf.toml` files contain.
+
+### How It Works
+
+1. Set `THOTH_ORG_POLICY` to your org policy Git repo (or pass `--org-policy`)
+2. The repo contains `rules/base.toml` + `rules/<project_type>.toml`
+3. ThothCTL merges org rules with project rules — **mandatory org rules cannot be weakened**
+4. Violations are reported with enforcement level (mandatory = fail, recommended = warn)
+
+### Usage
+
+```bash
+# Via env var (CI/CD recommended)
+export THOTH_ORG_POLICY=https://github.com/myorg/org-policies.git
+thothctl check project iac --enforcement hard
+
+# Pin to a version
+export THOTH_ORG_POLICY=https://github.com/myorg/org-policies.git@v1.0
+thothctl check project iac --enforcement hard
+
+# Via flag
+thothctl check project iac --org-policy /path/to/org-policies --enforcement hard
+
+# Local path (development)
+thothctl check project iac --org-policy ../org-iac-policies
+```
+
+### Enforcement Levels
+
+| Level | Behavior | Project Can Override? |
+|-------|----------|---------------------|
+| `mandatory` | Fails pipeline with `--enforcement hard` | ❌ No |
+| `recommended` | Warning only | ⚠️ Can opt-out |
+| `informational` | Report only | ✅ Yes |
+
+### Org Policy Repo Structure
+
+```
+org-policies/
+├── rules/                    # ThothCTL structural rules
+│   ├── base.toml             # All project types
+│   ├── terraform-terragrunt.toml
+│   ├── terraform_module.toml
+│   └── cdkv2.toml
+├── shared/policy/            # OPA/Rego policies (used by scan iac -t opa)
+│   ├── naming.rego
+│   ├── tagging.rego
+│   └── regions.rego
+└── README.md
+```
+
+The same repo serves both:
+- **`thothctl check project iac`** → reads `rules/`
+- **`thothctl scan iac -t opa`** → reads `shared/policy/` (auto-discovered via `THOTH_ORG_POLICY`)
+
+### Example Output
+
+```
+📜 Loading org policy from: https://github.com/myorg/org-policies.git
+
+❌ Mandatory Violations
+┌────────────────────────────────────┬─────────────────┬─────────┐
+│ Rule                               │ Expected        │ Found   │
+├────────────────────────────────────┼─────────────────┼─────────┤
+│ project_structure.folders.docs     │ docs/ exists    │ missing │
+│ project_structure.root_files       │ .pre-commit...  │ missing │
+└────────────────────────────────────┴─────────────────┴─────────┘
+
+⚠️ Recommendations
+┌────────────────────────────────────┬─────────────────┬─────────┐
+│ Rule                               │ Expected        │ Found   │
+├────────────────────────────────────┼─────────────────┼─────────┤
+│ project_structure.folders.common   │ common/ exists  │ missing │
+└────────────────────────────────────┴─────────────────┴─────────┘
+```
+
+### CI/CD Integration
+
+```yaml
+# GitHub Actions
+- name: Check org compliance
+  run: thothctl check project iac --enforcement hard
+  env:
+    THOTH_ORG_POLICY: https://github.com/myorg/org-policies.git@v1.0
+```
+
 ## Project Types
 
 ### Stack Projects (`-p stack`)

{thothctl-0.16.2 → thothctl-0.16.4}/docs/framework/commands/scan/scan_iac.md

@@ -58,13 +58,101 @@ thothctl scan iac -t kics
 
 ### Terraform-compliance
 
-[Terraform-compliance](https://terraform-compliance.com/) is a lightweight, security and compliance focused test framework against Terraform that enables negative testing capability for your infrastructure-as-code.
+[Terraform-compliance](https://terraform-compliance.com/) (v1.15.1) is a lightweight BDD test framework that evaluates `tfplan.json` files against Gherkin `.feature` files. It enables human-readable compliance scenarios like "S3 buckets must have encryption enabled."
+
+#### Prerequisites
 
 ```bash
-# Scan with Terraform-compliance
+pip install terraform-compliance
+```
+
+Requires `tfplan.json` files in your project (generated with `terraform show -json tfplan.binary > tfplan.json`).
+
+#### Usage
+
+```bash
+# Local features directory
+thothctl scan iac -t terraform-compliance -o "features_dir=features"
+
+# Git repository with subpath (//subpath syntax)
+thothctl scan iac -t terraform-compliance -o "features_dir=https://github.com/myorg/org-policies.git//compliance/features"
+
+# Git repository (auto-discovers compliance/features/ or features/)
+thothctl scan iac -t terraform-compliance -o "features_dir=https://github.com/myorg/org-policies.git"
+
+# SSH Git URL with subpath
+thothctl scan iac -t terraform-compliance -o "features_dir=git@github.com:myorg/compliance.git//features"
+
+# Auto-discover from THOTH_ORG_POLICY (looks in compliance/features/)
+export THOTH_ORG_POLICY=https://github.com/myorg/org-policies.git
 thothctl scan iac -t terraform-compliance
 ```
 
+#### Features Resolution
+
+| Priority | Source | Example |
+|----------|--------|---------|
+| 1 | **Git URL with `//subpath`** | `https://github.com/myorg/policies.git//compliance/features` |
+| 2 | **Git URL** (auto-discovers `compliance/features/` or `features/`) | `https://github.com/myorg/policies.git` |
+| 3 | **Relative to project** | `features/` |
+| 4 | **Absolute path** | `/shared/compliance/features` |
+| 5 | **`THOTH_ORG_POLICY` env** → `compliance/features/` | Auto-discovered |
+
+#### Writing Feature Files
+
+Feature files use Gherkin syntax:
+
+```gherkin
+Feature: Ensure encryption is enabled for all storage resources
+
+  Scenario: S3 buckets must have encryption
+    Given I have aws_s3_bucket defined
+    Then it must have server_side_encryption_configuration
+
+  Scenario: RDS instances must be encrypted
+    Given I have aws_db_instance defined
+    Then it must have storage_encrypted
+    And its value must be true
+```
+
+```gherkin
+Feature: Ensure all resources have required tags
+
+  Scenario Outline: Resources must have mandatory tags
+    Given I have resource that supports tags defined
+    Then it must have tags
+    And it must contain <tag>
+
+    Examples:
+      | tag         |
+      | Environment |
+      | Owner       |
+      | Project     |
+```
+
+#### Per-Stack Scanning
+
+ThothCTL finds all `tfplan.json` files in your project and runs terraform-compliance against each one individually. Results are aggregated into:
+
+- Per-stack HTML reports at `Reports/terraform-compliance/html_reports/`
+- Unified `scan_report.html` alongside other tools
+
+#### Organization Policy Integration
+
+Store feature files in your org policy repo alongside OPA policies:
+
+```
+org-policies/
+├── compliance/features/     ← terraform-compliance features
+│   ├── encryption.feature
+│   ├── tagging.feature
+│   └── networking.feature
+├── shared/policy/           ← OPA/Rego policies
+└── rules/                   ← ThothCTL structure rules
+```
+
+Both tools share the same `THOTH_ORG_POLICY` env var.
+
 ### OPA / Conftest
 
 [Open Policy Agent (OPA)](https://www.openpolicyagent.org/) is a CNCF-graduated general-purpose policy engine. ThothCTL integrates OPA through two modes:

{thothctl-0.16.2 → thothctl-0.16.4}/docs/framework/commands/scan/scan_overview.md

@@ -79,10 +79,12 @@ ThothCTL automatically tracks scan results in `~/.thothcf/scan_history.db` (SQLi
 | **Checkov** | Static analysis with built-in rules | `checkov` binary |
 | **Trivy** | Vulnerability and misconfiguration detection | `trivy` binary |
 | **KICS** | Static analysis via Docker | Docker |
-| **Terraform-compliance** | BDD-style compliance testing | `terraform-compliance` binary |
+| **Terraform-compliance** | BDD-style compliance testing against tfplan.json | `terraform-compliance` (pip) |
 | **OPA/Conftest** | Custom policy evaluation with Rego | `conftest` and/or `opa` binary |
 
-Each tool has its own strengths. Combine built-in rule scanners (Checkov, Trivy) with custom policy tools (OPA) for comprehensive coverage.
+Each tool has its own strengths. Combine built-in rule scanners (Checkov, Trivy) with custom policy tools (OPA, Terraform-compliance) for comprehensive coverage.
+
+**Organization Policy Repo**: Set `THOTH_ORG_POLICY` env var to point all policy tools (OPA, terraform-compliance, project structure rules) to a single centralized governance repository.
 
 ## Next Steps
 

{thothctl-0.16.2 → thothctl-0.16.4}/docs/framework/use_cases/tasks/create_template.md

@@ -269,8 +269,8 @@ content = ["main.tf", "variables.tf", "outputs.tf"]
 
 ## Related Documentation
 
-- [Template Engine Overview](../../template_engine/template_engine.md)
-- [GitHub Templates](../../template_engine/github_templates.md)
-- [Project Convert](../commands/project/project_convert.md)
-- [Project Upgrade](../commands/project/project_upgrade.md)
+- [Template Engine Overview](../../../template_engine/template_engine.md)
+- [GitHub Templates](../../../template_engine/github_templates.md)
+- [Project Convert](../../commands/project/project_convert.md)
+- [Project Upgrade](../../commands/project/project_upgrade.md)
 - [Platform Engineering Templates](../platform_engineering_templates.md)

{thothctl-0.16.2 → thothctl-0.16.4}/docs/index.md

@@ -52,6 +52,8 @@ pip install thothctl
 | **Security** | [Checkov](https://www.checkov.io/) | Native (pip) |
 | **Security** | [Trivy](https://trivy.dev/) | CLI binary |
 | **Security** | [KICS](https://docs.kics.io/) | Docker container |
+| **Compliance** | [Terraform-compliance](https://terraform-compliance.com/) | CLI binary |
+| **Policy** | [OPA/Conftest](https://www.openpolicyagent.org/) | CLI binary |
 | **Docs** | [Terraform-docs](https://terraform-docs.io/) | CLI binary |
 | **AI** | [OpenAI](https://platform.openai.com/) | GPT-4 Turbo |
 | **AI** | [AWS Bedrock](https://aws.amazon.com/bedrock/) | Claude Sonnet (InvokeModel + Agent) |

{thothctl-0.16.2 → thothctl-0.16.4}/src/thothctl/commands/check/commands/project/iac.py

@@ -1,4 +1,5 @@
 import logging
+import os
 import click
 import sys
 import io
@@ -173,6 +174,8 @@ class CheckProjectIaCCommand(ClickCommand):
         ctx = click.get_current_context()
         directory = ctx.obj.get("CODE_DIRECTORY", ".")
         project_type = kwargs.get('project_type', 'stack')
+        org_policy = kwargs.get('org_policy')
+        enforcement = kwargs.get('enforcement', 'soft')
         
         # Create header with project type
         header_text = f"🏗️ Infrastructure as Code {'Module' if project_type == 'module' else 'Stack'} Structure Check"
@@ -184,6 +187,9 @@ class CheckProjectIaCCommand(ClickCommand):
         ))
         
         try:
+            # Run org policy check if source is provided
+            org_violations = self._check_org_policy(directory, project_type, org_policy)
+
             # Capture stdout to format it nicely
             captured_output = io.StringIO()
             
@@ -196,13 +202,19 @@ class CheckProjectIaCCommand(ClickCommand):
                         project_type=project_type
                     )
                 except SystemExit as e:
-                    # Handle sys.exit() from validation service
                     result = e.code == 0
             
             # Format and display the captured output
             output = captured_output.getvalue()
             if output.strip():
                 self._format_validation_output(output)
+
+            # Display org policy results
+            if org_violations is not None:
+                self._display_org_violations(org_violations, enforcement)
+                mandatory_fails = [v for v in org_violations if v.enforcement == "mandatory"]
+                if mandatory_fails and enforcement == "hard":
+                    result = False
             
             # Create summary
             if result:
@@ -224,8 +236,8 @@ class CheckProjectIaCCommand(ClickCommand):
             self.console.print()
             self.console.print(summary_panel)
             
-            # Only exit with error code in strict mode
-            if not result and kwargs.get('mode') == 'strict':
+            # Exit with error code if hard enforcement has mandatory violations
+            if not result and (kwargs.get('mode') == 'strict' or enforcement == 'hard'):
                 exit(1)
                 
         except Exception as e:
@@ -233,6 +245,69 @@ class CheckProjectIaCCommand(ClickCommand):
             self.logger.error(f"Failed to execute IaC project check: {str(e)}")
             raise
 
+    def _check_org_policy(self, directory: str, project_type: str, org_policy=None):
+        """Check project against organizational policy if available."""
+        from .....services.check.org_policy_loader import get_org_policy_path, resolve_rules_dir
+        from .....services.check.rule_merger import load_org_rules, merge_with_project, evaluate
+
+        org_path = get_org_policy_path(org_policy)
+        if not org_path:
+            return None
+
+        rules_dir = resolve_rules_dir(org_path)
+        if not rules_dir:
+            logger.info(f"No rules/ directory in org policy at {org_path}")
+            return None
+
+        self.console.print(f"[blue]📜 Loading org policy from: {org_path}[/blue]")
+
+        # Map CLI project_type to toml filename
+        type_map = {"stack": "terraform-terragrunt", "module": "terraform_module"}
+        rule_type = type_map.get(project_type, project_type)
+
+        ruleset = load_org_rules(rules_dir, rule_type)
+        project_toml = os.path.join(directory, ".thothcf.toml")
+        ruleset = merge_with_project(ruleset, project_toml)
+
+        return evaluate(ruleset, directory)
+
+    def _display_org_violations(self, violations, enforcement: str):
+        """Display org policy violations in a Rich table."""
+        if not violations:
+            self.console.print(Panel(
+                "✅ [green]Organization policy check passed[/green]",
+                title="Org Policy",
+                style="green",
+                box=box.ROUNDED,
+            ))
+            return
+
+        mandatory = [v for v in violations if v.enforcement == "mandatory"]
+        recommended = [v for v in violations if v.enforcement == "recommended"]
+        info = [v for v in violations if v.enforcement == "informational"]
+
+        if mandatory:
+            table = Table(title="❌ Mandatory Violations", box=box.ROUNDED, header_style="bold red")
+            table.add_column("Rule", style="cyan")
+            table.add_column("Expected", style="green")
+            table.add_column("Found", style="red")
+            for v in mandatory:
+                table.add_row(v.rule, v.expected, v.found)
+            self.console.print(table)
+
+        if recommended:
+            table = Table(title="⚠️ Recommendations", box=box.ROUNDED, header_style="bold yellow")
+            table.add_column("Rule", style="cyan")
+            table.add_column("Expected", style="green")
+            table.add_column("Found", style="yellow")
+            for v in recommended:
+                table.add_row(v.rule, v.expected, v.found)
+            self.console.print(table)
+
+        if info:
+            for v in info:
+                self.console.print(f"  ℹ️  {v.rule}: {v.expected} (found: {v.found})")
+
     def _validate_project_structure(self, directory: str, mode: str = "soft", check_type: str = "structure", project_type: str = "stack") -> bool:
         """Validate the IaC project structure
         
@@ -269,4 +344,15 @@ cli = CheckProjectIaCCommand.as_click_command(
         type=click.Choice(["stack", "module"], case_sensitive=False),
         default="stack"
     ),
+    click.option(
+        "--org-policy",
+        help="Organization policy source (Git URL or local path). Also reads THOTH_ORG_POLICY env var.",
+        default=None,
+    ),
+    click.option(
+        "--enforcement",
+        help="Enforcement mode: soft (report only) or hard (fail on mandatory violations)",
+        type=click.Choice(["soft", "hard"], case_sensitive=False),
+        default="soft",
+    ),
 )

{thothctl-0.16.2 → thothctl-0.16.4}/src/thothctl/core/version_tools.py

@@ -38,7 +38,7 @@ version_tools = """[
   },
   {
     "name": "terraform-compliance",
-    "version": "1.13.0"
+    "version": "1.15.1"
   },
   {
     "name": "terramate",

{thothctl-0.16.2 → thothctl-0.16.4}/src/thothctl/services/ai_review/ai_agent.py

@@ -18,6 +18,7 @@ from .utils.prompts import (
     SYSTEM_SECURITY_ANALYST,
     SYSTEM_CODE_REVIEWER,
     SYSTEM_FULL_ANALYSIS,
+    SYSTEM_COMPACT,
 )
 from .utils.fix_prompts import SYSTEM_FIX_GENERATOR
 from .tracing import span
@@ -85,10 +86,12 @@ class AIReviewAgent:
         """
         with span("ai_agent.analyze_directory", {"directory": directory}) as s:
             logger.info(f"Building rich context for {directory}")
+            self._emit_status("📦 Collecting project context (inventory, scan reports, plans)...")
             ctx = self.context_builder.build_context(directory)
 
             basic_risk = None
             if ctx.scan_results.get("total_findings", 0) > 0:
+                self._emit_status(f"⚠️  Found {ctx.scan_results['total_findings']} scan findings, assessing risk...")
                 basic_risk = self.risk_assessor.assess_risk(ctx.scan_results)
 
             if not self.cost_tracker.check_budget():
@@ -98,9 +101,28 @@ class AIReviewAgent:
                     return self._basic_analysis(ctx.scan_results, basic_risk)
                 return self._empty_result()
 
+            self._emit_status("🤖 Sending context to LLM for security analysis...")
             formatted = self.context_builder.format_for_ai(ctx)
-            fallback = (lambda: self._basic_analysis(ctx.scan_results, basic_risk)) if basic_risk else self._empty_result
-            result = self._call_ai(SYSTEM_FULL_ANALYSIS, formatted, "analyze_directory", fallback=fallback)
+            
+            # Use compact prompt for local models (Ollama) to fit VRAM constraints
+            if self._provider.name == "ollama":
+                # Hybrid: scan data for structured findings + LLM for recommendations
+                base_result = self._basic_analysis(ctx.scan_results, basic_risk) if basic_risk else self._empty_result()
+                try:
+                    ai_response = self._provider.analyze(SYSTEM_COMPACT, formatted)
+                    # AI might return JSON or text — either way, use it as recommendations
+                    if isinstance(ai_response, dict) and ai_response.get("recommendations"):
+                        base_result["recommendations"] = ai_response["recommendations"]
+                        base_result["architecture_assessment"] = ai_response.get("architecture_assessment", "")
+                    elif isinstance(ai_response, dict) and ai_response.get("_raw_text"):
+                        base_result["recommendations"] = [ai_response["_raw_text"][:2000]]
+                except Exception as e:
+                    logger.debug(f"LLM recommendations failed: {e}")
+                result = base_result
+            else:
+                system_prompt = SYSTEM_FULL_ANALYSIS
+                fallback = (lambda: self._basic_analysis(ctx.scan_results, basic_risk)) if basic_risk else self._empty_result
+                result = self._call_ai(system_prompt, formatted, "analyze_directory", fallback=fallback)
 
             result["_context"] = {
                 "project_type": ctx.project_type,
@@ -265,6 +287,12 @@ class AIReviewAgent:
                 return fallback()
             return self._empty_result()
 
+    @staticmethod
+    def _emit_status(msg: str) -> None:
+        """Print a status message visible during the spinner."""
+        from rich.console import Console
+        Console(stderr=True).print(f"[dim]{msg}[/dim]")
+
     @staticmethod
     def _empty_result() -> Dict[str, Any]:
         return {

{thothctl-0.16.2 → thothctl-0.16.4}/src/thothctl/services/ai_review/analyzers/code_reviewer.py

@@ -6,7 +6,7 @@ from typing import Dict, Any, List
 logger = logging.getLogger(__name__)
 
 # File extensions to analyze
-IAC_EXTENSIONS = {".tf", ".hcl", ".tfvars", ".yaml", ".yml", ".json"}
+IAC_EXTENSIONS = {".tf", ".hcl", ".tfvars"}
 
 
 class CodeReviewer:
@@ -24,6 +24,12 @@ class CodeReviewer:
 
         for f in dir_path.rglob("*"):
             if f.suffix in exts and not any(p.startswith(".") for p in f.parts):
+                # Skip non-IaC directories
+                if any(skip in f.parts for skip in (
+                    "Reports", ".terraform", "node_modules", ".terragrunt-cache",
+                    "cdk.out", "__pycache__", ".git", "html_reports", "tfplan",
+                )):
+                    continue
                 try:
                     content = f.read_text(errors="ignore")
                     rel_path = str(f.relative_to(dir_path))

{thothctl-0.16.2 → thothctl-0.16.4}/src/thothctl/services/ai_review/analyzers/context_builder.py

@@ -38,6 +38,7 @@ class ContextBuilder:
         # Run each collector independently — failures don't block others
         self._collect_inventory(ctx)
         self._collect_scan_results(ctx)
+        self._collect_plan_files(ctx)
         self._collect_blast_radius(ctx)
         self._collect_code(ctx)
 
@@ -97,12 +98,30 @@ class ContextBuilder:
                 )
             sections.append("")
 
-        # Code section (only key files, truncated)
+        # Code section — only include files referenced in findings + plan summaries
         if ctx.code_files:
             sections.append("## Key IaC Files")
-            char_budget = 30000
+            char_budget = 12000  # ~3K tokens for code context
+
+            # Prioritize: plans first, then files mentioned in scan findings
+            referenced_files = set()
+            for tool_data in ctx.scan_results.get("tools", {}).values():
+                for f in tool_data.get("findings", []):
+                    ref = f.get("file", "")
+                    if ref:
+                        referenced_files.add(ref)
+
+            # Sort: plans first, then referenced files, then others
+            def priority(item):
+                path, _ = item
+                if "[PLAN]" in path:
+                    return 0
+                if any(ref in path for ref in referenced_files):
+                    return 1
+                return 2
+
             used = 0
-            for path, content in sorted(ctx.code_files.items()):
+            for path, content in sorted(ctx.code_files.items(), key=priority):
                 header = f"\n--- {path} ---\n"
                 if used + len(header) + len(content) > char_budget:
                     remaining = len(ctx.code_files) - len([s for s in sections if s.startswith("--- ")])
@@ -165,43 +184,74 @@ class ContextBuilder:
             ctx.errors.append(f"Inventory unavailable: {e}")
 
     def _collect_scan_results(self, ctx: IaCContext) -> None:
-        """Check for existing scan reports or run a quick scan."""
+        """Check for existing scan reports at project root."""
         try:
-            from ..report_analyzer import ReportAnalyzer
+            from .report_analyzer import ReportAnalyzer
 
             analyzer = ReportAnalyzer()
-            reports_dir = Path(ctx.directory) / "Reports"
 
-            # First check if reports already exist
-            if reports_dir.exists():
+            # Look for Reports/ at target dir and up to project root
+            target = Path(ctx.directory)
+            reports_dir = None
+            for parent in [target] + list(target.parents):
+                candidate = parent / "Reports"
+                if candidate.exists():
+                    reports_dir = candidate
+                    break
+                if (parent / ".thothcf.toml").exists() or (parent / ".git").exists():
+                    break
+
+            if reports_dir and reports_dir.exists():
                 ctx.scan_results = analyzer.parse_scan_results(str(reports_dir))
                 if ctx.scan_results.get("total_findings", 0) > 0:
                     logger.info(f"Found existing scan results: {ctx.scan_results['total_findings']} findings")
                     return
 
-            # Try running a quick checkov scan
-            try:
-                from ...scan.scan_service import ScanService
-
-                scan_svc = ScanService()
-                tmp_reports = str(Path(ctx.directory) / "Reports")
-                scan_svc.execute_scans(
-                    directory=ctx.directory,
-                    reports_dir=tmp_reports,
-                    selected_tools=["checkov"],
-                    options={},
-                    html_reports_format="simple",
-                )
-                ctx.scan_results = analyzer.parse_scan_results(tmp_reports)
-                logger.info(f"Quick scan: {ctx.scan_results.get('total_findings', 0)} findings")
-            except Exception as scan_err:
-                logger.debug(f"Quick scan failed: {scan_err}")
-                ctx.errors.append(f"Live scan unavailable: {scan_err}")
+            ctx.errors.append("No scan reports found. Run 'thothctl scan iac' first for richer AI analysis.")
 
         except Exception as e:
             logger.debug(f"Scan results collection failed: {e}")
             ctx.errors.append(f"Scan results unavailable: {e}")
 
+    def _collect_plan_files(self, ctx: IaCContext) -> None:
+        """Collect tfplan.json summaries for change analysis."""
+        try:
+            import json as _json
+            target = Path(ctx.directory)
+
+            # Find tfplan.json in target and project-level stacks/tfplan/
+            plan_files = list(target.rglob("tfplan.json"))
+            for parent in [target] + list(target.parents):
+                if (parent / ".thothcf.toml").exists() or (parent / ".git").exists():
+                    tfplan_dir = parent / "stacks" / "tfplan"
+                    if tfplan_dir.exists():
+                        plan_files.extend(tfplan_dir.rglob("tfplan.json"))
+                    break
+
+            for pf in plan_files[:5]:
+                try:
+                    with open(pf) as f:
+                        plan = _json.load(f)
+                    changes = plan.get("resource_changes", [])
+                    creates = sum(1 for c in changes if "create" in c.get("change", {}).get("actions", []))
+                    updates = sum(1 for c in changes if "update" in c.get("change", {}).get("actions", []))
+                    deletes = sum(1 for c in changes if "delete" in c.get("change", {}).get("actions", []))
+                    ctx.code_files[f"[PLAN] {pf.name} ({pf.parent.name})"] = (
+                        f"# Terraform Plan: {pf.parent.name}\n"
+                        f"# Creates: {creates}, Updates: {updates}, Deletes: {deletes}\n"
+                        f"# Total resource changes: {len(changes)}\n"
+                        + "\n".join(
+                            f"# {c['type']}.{c['name']} → {c['change']['actions']}"
+                            for c in changes[:20]
+                        )
+                    )
+                except Exception:
+                    pass
+            if plan_files:
+                logger.info(f"Found {len(plan_files)} tfplan.json files")
+        except Exception as e:
+            logger.debug(f"Plan file collection failed: {e}")
+
     def _collect_blast_radius(self, ctx: IaCContext) -> None:
         """Run BlastRadiusService for dependency analysis."""
         try:
@@ -235,7 +285,7 @@ class ContextBuilder:
     def _collect_code(self, ctx: IaCContext) -> None:
         """Collect raw IaC files as supplementary context."""
         try:
-            from ..code_reviewer import CodeReviewer
+            from .code_reviewer import CodeReviewer
 
             reviewer = CodeReviewer()
             ctx.code_files = reviewer.collect_code_for_review(ctx.directory)

{thothctl-0.16.2 → thothctl-0.16.4}/src/thothctl/services/ai_review/config/ai_settings.py

@@ -18,7 +18,7 @@ DEFAULT_CONFIG_FILE = "ai_config.yaml"
 class ProviderConfig:
     """Configuration for a single AI provider."""
     model: str = ""
-    max_tokens: int = 4000
+    max_tokens: int = 8000
     temperature: float = 0.1
     api_key: str = ""
     region: str = "us-east-1"