thothctl 0.16.4__tar.gz → 0.16.7__tar.gz

{thothctl-0.16.4 → thothctl-0.16.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: thothctl
-Version: 0.16.4
+Version: 0.16.7
 Summary: A CLI for Developer Control Plane. Accelerate your cloud IaC deployments.
 Project-URL: SourceCode, https://github.com/thothforge/thothctl
 Project-URL: HomePage, https://github.com/thothforge/thothctl
@@ -441,6 +441,7 @@ Use Trivy to find vulnerabilities (CVE) & misconfigurations (IaC) across code re
 ## OS Packages
 
 - dot or graphviz
+- graph-easy (optional, for `--format boxart` topology view)
 
 You can install them with:
 
@@ -448,11 +449,19 @@ You can install them with:
  Chocolatey packages Graphviz for **Windows**.
 
 `choco install graphviz`
+
+> For `graph-easy` on Windows, use WSL: `sudo apt install libgraph-easy-perl`
+
 ### Linux
 Install packages with apt for Linux/Debian
 - 
 ```bash 
-sudo apt install graphviz -y
+sudo apt install graphviz libgraph-easy-perl -y
+```
+
+### macOS
+```bash
+brew install graphviz graph-easy
 ```
 - python >= 3.8 
     - check: `python --version` 
@@ -483,3 +492,11 @@ pip install --upgrade thothctl
  - ~~AI Agent for IaC Security — multi-agent orchestrator, auto-decisions, code fixes, adaptive memory~~
  - Create Stacks and Infrastructure composition engine
  - Strands Agents SDK integration for advanced memory and session management
+ - **Intent-to-IaC Generation** — Natural language → governed Terraform/Tofu code, grounded in organizational templates and rules
+ - **Organizational Rulesets / Policy Engine** — Custom naming, tagging, security, and architecture rules enforced at generation and CI/CD time (OPA/Rego support)
+ - **Compliance Scoring with Evidence** — Scored findings mapped to SOC2/ISO27001/CIS/NIST, code citations, auditor-ready evidence export
+ - **Composable Workflow Engine** — Declarative YAML workflows with DAG dependencies for multi-step IaC operations (scan → review → fix → validate → deploy)
+ - **Graph-Aware State Visibility** — Parse tfstate into queryable resource graph (SQLite), blast radius analysis, SQL queries across all infrastructure
+ - **Architecture Diagram Generation** — Auto-generate Mermaid/Graphviz topology diagrams from IaC, synced with code changes
+
+📖 **Full roadmap**: [ThothCTL Roadmap 2026 — Competitive Analysis & Plan](../thothctl_roadmap_2026.md)

{thothctl-0.16.4 → thothctl-0.16.7}/README.md

@@ -392,6 +392,7 @@ Use Trivy to find vulnerabilities (CVE) & misconfigurations (IaC) across code re
 ## OS Packages
 
 - dot or graphviz
+- graph-easy (optional, for `--format boxart` topology view)
 
 You can install them with:
 
@@ -399,11 +400,19 @@ You can install them with:
  Chocolatey packages Graphviz for **Windows**.
 
 `choco install graphviz`
+
+> For `graph-easy` on Windows, use WSL: `sudo apt install libgraph-easy-perl`
+
 ### Linux
 Install packages with apt for Linux/Debian
 - 
 ```bash 
-sudo apt install graphviz -y
+sudo apt install graphviz libgraph-easy-perl -y
+```
+
+### macOS
+```bash
+brew install graphviz graph-easy
 ```
 - python >= 3.8 
     - check: `python --version` 
@@ -434,3 +443,11 @@ pip install --upgrade thothctl
  - ~~AI Agent for IaC Security — multi-agent orchestrator, auto-decisions, code fixes, adaptive memory~~
  - Create Stacks and Infrastructure composition engine
  - Strands Agents SDK integration for advanced memory and session management
+ - **Intent-to-IaC Generation** — Natural language → governed Terraform/Tofu code, grounded in organizational templates and rules
+ - **Organizational Rulesets / Policy Engine** — Custom naming, tagging, security, and architecture rules enforced at generation and CI/CD time (OPA/Rego support)
+ - **Compliance Scoring with Evidence** — Scored findings mapped to SOC2/ISO27001/CIS/NIST, code citations, auditor-ready evidence export
+ - **Composable Workflow Engine** — Declarative YAML workflows with DAG dependencies for multi-step IaC operations (scan → review → fix → validate → deploy)
+ - **Graph-Aware State Visibility** — Parse tfstate into queryable resource graph (SQLite), blast radius analysis, SQL queries across all infrastructure
+ - **Architecture Diagram Generation** — Auto-generate Mermaid/Graphviz topology diagrams from IaC, synced with code changes
+
+📖 **Full roadmap**: [ThothCTL Roadmap 2026 — Competitive Analysis & Plan](../thothctl_roadmap_2026.md)

thothctl-0.16.7/docs/framework/commands/check/deps.md

@@ -0,0 +1,145 @@
+# Check Dependencies Command
+
+## Overview
+
+The `check deps` command visualizes and analyzes infrastructure dependencies in your Terragrunt projects. It parses the DAG (Directed Acyclic Graph) from `terragrunt dag graph`, calculates component risk scores, and renders the topology in multiple formats.
+
+## Usage
+
+```bash
+# Default: Rich tree with risk percentages
+thothctl check iac -type deps
+
+# ASCII box topology (best for terminal sharing)
+thothctl check iac -type deps --format boxart
+
+# Interactive HTML in browser (vis.js graph)
+thothctl check iac -type deps --format html
+
+# Raw DOT output (pipe to graphviz or other tools)
+thothctl check iac -type deps --format dot
+```
+
+## Output Formats
+
+| Format | Description | Use Case |
+|--------|-------------|----------|
+| `tree` | Rich tree with color-coded risk | Default terminal view |
+| `boxart` | ASCII box drawing topology | Copy/paste into docs, Slack, PRs |
+| `html` | Interactive vis.js graph in browser | Presentations, exploration |
+| `dot` | Raw GraphViz DOT | Pipe to `dot`, `neato`, custom tools |
+
+### Tree (default)
+
+```
+Infrastructure Modules
+└── stacks/observability/network/reachability-analyzer (31.0% risk)
+    ├── stacks/foundation/network/security-groups (38.5% risk)
+    │   └── stacks/foundation/network/vpc (46.5% risk)
+    └── stacks/platform/data/rds (42.5% risk)
+```
+
+### Boxart
+
+```
+┌───────────────┐  ┌──────────────────┐
+│ vpc 47%       │  │ security-groups 39% │
+└───────────────┘  └──────────────────┘
+         │                    │
+         ▼                    ▼
+┌───────────────┐  ┌──────────────────┐
+│ rds 43%       │  │ vpc-lattice 34%  │
+└───────────────┘  └──────────────────┘
+```
+
+For best quality boxart, install `graph-easy`:
+
+| OS | Install Command |
+|----|----------------|
+| **Linux (Debian/Ubuntu)** | `sudo apt install libgraph-easy-perl` |
+| **macOS** | `brew install graph-easy` |
+| **Windows** | `choco install graphviz` then use `--format dot \| dot -Tpng -o graph.png` |
+
+> **Note**: Without `graph-easy`, ThothCTL uses a built-in Python fallback renderer.
+
+### HTML
+
+Opens an interactive topology in your default browser with:
+- Hierarchical top-down layout
+- Color-coded nodes (green < 30% risk, orange 30-50%, red > 50%)
+- Hover for full stack path
+- Saved to `Reports/dependency_topology.html`
+
+### DOT
+
+Outputs raw DOT graph for piping:
+
+```bash
+# Generate PNG image
+thothctl check iac -type deps --format dot | dot -Tpng -o topology.png
+
+# Generate SVG
+thothctl check iac -type deps --format dot | dot -Tsvg -o topology.svg
+
+# Open in xdot viewer
+thothctl check iac -type deps --format dot | xdot -
+```
+
+## Prerequisites
+
+| Tool | Required | Install |
+|------|----------|---------|
+| `terragrunt` | ✅ Required | [terragrunt.gruntwork.io](https://terragrunt.gruntwork.io/) |
+| `graphviz` | Optional (for `--format dot` piping) | See below |
+| `graph-easy` | Optional (for `--format boxart` enhanced output) | See below |
+
+### Installing Graphviz
+
+| OS | Command |
+|----|---------|
+| Linux (Debian/Ubuntu) | `sudo apt install graphviz` |
+| macOS | `brew install graphviz` |
+| Windows | `choco install graphviz` |
+
+### Installing graph-easy
+
+| OS | Command |
+|----|---------|
+| Linux (Debian/Ubuntu) | `sudo apt install libgraph-easy-perl` |
+| macOS | `brew install graph-easy` |
+| Windows (WSL) | `sudo apt install libgraph-easy-perl` |
+
+> **Windows native**: `graph-easy` is a Perl tool. On native Windows, use WSL or the `--format html` alternative.
+
+## Features
+
+- **Risk Assessment**: Each component gets a risk percentage based on fan-in/fan-out degree and dependency depth
+- **Terragrunt Details**: Shows mock_outputs and config_path from `dependency` blocks
+- **Multiple Renderers**: Terminal, ASCII art, browser, and raw DOT
+- **CI/CD Friendly**: `--format dot` for pipeline image generation, `--format boxart` for PR comments
+
+## Examples
+
+### CI/CD Pipeline — Post topology to PR
+
+```bash
+# Generate boxart for PR comment
+echo '```' > /tmp/deps.md
+thothctl check iac -type deps --format boxart >> /tmp/deps.md
+echo '```' >> /tmp/deps.md
+gh pr comment --body-file /tmp/deps.md
+```
+
+### Generate documentation artifact
+
+```bash
+thothctl check iac -type deps --format html
+# → Opens browser + saves Reports/dependency_topology.html
+```
+
+## Related Commands
+
+- [`check blast-radius`](blast-radius.md) — Assess change impact analysis
+- [`check tfplan`](plan.md) — Analyze Terraform plans
+- [`inventory iac`](../inventory/iac.md) — Create dependency inventory
+- [`document iac`](../document/iac.md) — Generate documentation with graphs

{thothctl-0.16.4 → thothctl-0.16.7}/src/thothctl/commands/check/commands/iac.py

@@ -70,7 +70,8 @@ class CheckIaCCommand(ClickCommand):
             elif kwargs['check_type'] == "deps":
                 result = self._visualize_dependencies(
                     directory=directory,
-                    dagtool='terragrunt'  # Force terragrunt as the tool for dependencies
+                    dagtool='terragrunt',
+                    output_format=kwargs.get('format', 'tree'),
                 )
                 return result
             elif kwargs['check_type'] == "blast-radius":
@@ -593,7 +594,7 @@ class CheckIaCCommand(ClickCommand):
 
                         f.write("\n")
 
-    def _visualize_dependencies(self, directory: str, dagtool: str = 'terragrunt') -> bool:
+    def _visualize_dependencies(self, directory: str, dagtool: str = 'terragrunt', output_format: str = 'tree') -> bool:
         """Visualize infrastructure dependencies using terragrunt graph commands"""
         self.logger.info(f"Visualizing dependencies in {directory} using {dagtool}")
         
@@ -620,21 +621,22 @@ class CheckIaCCommand(ClickCommand):
                 self.console.print(result.stderr)
                 return False
             
-            # Parse and visualize the DOT graph
             dot_graph = result.stdout
-            
-            # Parse the DOT graph to extract nodes and edges
+
+            # Route to the appropriate renderer
+            if output_format == "dot":
+                click.echo(dot_graph)
+                return True
+            elif output_format == "boxart":
+                return self._render_boxart(dot_graph, directory)
+            elif output_format == "html":
+                return self._render_html_topology(dot_graph, directory)
+
+            # Default: tree format
             nodes, edges = self._parse_dot_graph(dot_graph)
-            
-            # Calculate risk percentages for each component
             risks = calculate_component_risks(nodes, edges, directory)
-            
-            # Parse terragrunt.hcl files to get dependency details
             dep_info = self._parse_terragrunt_dependencies(directory)
-            
-            # Display the enhanced visualization with risk percentages and dependency info
             self._display_dependency_graph(dot_graph, risks, dep_info)
-            
             return True
             
         except Exception as e:
@@ -642,6 +644,129 @@ class CheckIaCCommand(ClickCommand):
             self.console.print(f"[red]Error: {str(e)}[/red]")
             return False
     
+
+    def _render_boxart(self, dot_graph: str, directory: str) -> bool:
+        """Render dependency graph as ASCII box art using graph-easy or fallback."""
+        # Try graph-easy first (best output)
+        try:
+            result = subprocess.run(
+                ['graph-easy', '--from=dot', '--as=boxart'],
+                input=dot_graph, capture_output=True, text=True, check=True
+            )
+            self.console.print(Panel("[bold blue]🔄 Dependency Topology[/bold blue]", box=box.ROUNDED))
+            click.echo(result.stdout)
+            return True
+        except (FileNotFoundError, subprocess.CalledProcessError):
+            pass
+
+        # Fallback: pure Python box rendering
+        nodes, edges = self._parse_dot_graph(dot_graph)
+        risks = calculate_component_risks(nodes, edges, directory)
+
+        self.console.print(Panel("[bold blue]🔄 Dependency Topology (boxart)[/bold blue]", box=box.ROUNDED))
+        self.console.print("[dim]Install graph-easy for better rendering: sudo apt install libgraph-easy-perl[/dim]\n")
+
+        # Simple layered box drawing
+        # Build adjacency: who depends on whom
+        dependents = {n: set() for n in nodes}
+        for src, tgt in edges:
+            if src in dependents:
+                dependents[src].add(tgt)
+
+        # Find layers (topological sort by depth)
+        depth = {n: 0 for n in nodes}
+        changed = True
+        while changed:
+            changed = False
+            for src, tgt in edges:
+                if depth.get(src, 0) <= depth.get(tgt, 0):
+                    depth[src] = depth[tgt] + 1
+                    changed = True
+
+        max_depth = max(depth.values()) if depth else 0
+        layers = [[] for _ in range(max_depth + 1)]
+        for n, d in depth.items():
+            layers[max_depth - d].append(n)
+
+        # Render boxes per layer
+        for i, layer in enumerate(layers):
+            if not layer:
+                continue
+            boxes = []
+            for node in layer:
+                short = node.split("/")[-1] if "/" in node else node
+                risk = risks.get(node, 0)
+                boxes.append(f"┌{'─' * (len(short) + 6)}┐")
+                boxes.append(f"│ {short} {risk:.0f}% │")
+                boxes.append(f"└{'─' * (len(short) + 6)}┘")
+
+            # Print boxes side by side
+            lines_per_box = 3
+            row_boxes = [boxes[j:j+lines_per_box] for j in range(0, len(boxes), lines_per_box)]
+            for line_idx in range(lines_per_box):
+                click.echo("  ".join(b[line_idx] for b in row_boxes))
+
+            # Print arrows between layers
+            if i < len(layers) - 1:
+                click.echo("         │")
+                click.echo("         ▼")
+
+        return True
+
+    def _render_html_topology(self, dot_graph: str, directory: str) -> bool:
+        """Render interactive HTML topology and open in browser."""
+        import webbrowser
+        from pathlib import Path
+
+        nodes, edges = self._parse_dot_graph(dot_graph)
+        risks = calculate_component_risks(nodes, edges, directory)
+
+        # Build nodes/edges JSON for vis.js
+        vis_nodes = []
+        for i, node in enumerate(nodes):
+            short = node.split("/")[-1] if "/" in node else node
+            risk = risks.get(node, 0)
+            color = "#4caf50" if risk < 30 else "#ff9800" if risk < 50 else "#f44336"
+            vis_nodes.append(f'{{id: {i}, label: "{short}\\n{risk:.0f}% risk", color: "{color}", title: "{node}"}}')
+
+        node_idx = {n: i for i, n in enumerate(nodes)}
+        vis_edges = []
+        for src, tgt in edges:
+            if src in node_idx and tgt in node_idx:
+                vis_edges.append(f'{{from: {node_idx[src]}, to: {node_idx[tgt]}, arrows: "to"}}')
+
+        html = f"""<!DOCTYPE html>
+<html><head><title>ThothCTL - Dependency Topology</title>
+<script src="https://unpkg.com/vis-network/standalone/umd/vis-network.min.js"></script>
+<style>
+body {{ margin: 0; font-family: Inter, sans-serif; background: linear-gradient(135deg, #667eea 0%, #764ba2 100%); }}
+#graph {{ width: 100vw; height: 100vh; }}
+h1 {{ position: absolute; top: 10px; left: 20px; color: white; font-size: 1.2em; z-index: 10; }}
+</style></head><body>
+<h1>🔄 ThothCTL Dependency Topology</h1>
+<div id="graph"></div>
+<script>
+var nodes = new vis.DataSet([{', '.join(vis_nodes)}]);
+var edges = new vis.DataSet([{', '.join(vis_edges)}]);
+var container = document.getElementById('graph');
+var data = {{ nodes: nodes, edges: edges }};
+var options = {{
+  layout: {{ hierarchical: {{ direction: "UD", sortMethod: "directed" }} }},
+  physics: false,
+  nodes: {{ shape: "box", font: {{ size: 14 }}, margin: 10 }},
+  edges: {{ color: "#ffffff80", width: 2 }}
+}};
+new vis.Network(container, data, options);
+</script></body></html>"""
+
+        out_path = Path(directory) / "Reports" / "dependency_topology.html"
+        out_path.parent.mkdir(parents=True, exist_ok=True)
+        out_path.write_text(html)
+
+        self.console.print(f"[green]✅ HTML topology saved to {out_path}[/green]")
+        webbrowser.open(f"file://{out_path.resolve()}")
+        return True
+
     def _parse_terragrunt_dependencies(self, directory: str) -> Dict[str, Dict]:
         """Parse terragrunt.hcl files to extract dependency and mock_outputs information.
         
@@ -721,6 +846,13 @@ class CheckIaCCommand(ClickCommand):
         # Display dependency details if available
         if dep_info:
             self._display_dependency_details(dep_info)
+
+        # Display summary
+        self.console.print(f"\n[green]✅ Found {len(nodes)} modules with {len(edges)} dependencies[/green]")
+
+        # Display risk legend
+        if risks:
+            self._display_risk_legend()
     
     def _display_dependency_details(self, dep_info: Dict) -> None:
         """Display detailed dependency information from terragrunt.hcl files.
@@ -749,14 +881,6 @@ class CheckIaCCommand(ClickCommand):
                                 value_str = value_str[:47] + "..."
                             self.console.print(f"       • {key} = [green]{value_str}[/green]")
 
-        
-        # Display summary
-        self.console.print(f"\n[green]✅ Found {len(nodes)} modules with {len(edges)} dependencies[/green]")
-        
-        # Display risk legend
-        if risks:
-            self._display_risk_legend()
-    
     def _display_risk_legend(self) -> None:
         """Display a legend for risk levels"""
         legend = Table(show_header=False, box=box.SIMPLE)
@@ -1428,6 +1552,12 @@ cli = CheckIaCCommand.as_click_command(
                  type=click.Choice(["tfplan", "deps", "blast-radius", "cost-analysis", "drift"], case_sensitive=True),
                  default="tfplan",
                  ),
+    click.option(
+        '--format',
+        type=click.Choice(['tree', 'boxart', 'html', 'dot'], case_sensitive=True),
+        default='tree',
+        help='Output format for deps visualization (tree: Rich tree, boxart: ASCII boxes, html: interactive browser, dot: raw DOT)'
+    ),
     click.option(
         '--plan-file',
         help="Path to terraform plan JSON file (for blast-radius)",

{thothctl-0.16.4 → thothctl-0.16.7}/src/thothctl/services/ai_review/ai_agent.py

@@ -106,19 +106,23 @@ class AIReviewAgent:
             
             # Use compact prompt for local models (Ollama) to fit VRAM constraints
             if self._provider.name == "ollama":
-                # Hybrid: scan data for structured findings + LLM for recommendations
-                base_result = self._basic_analysis(ctx.scan_results, basic_risk) if basic_risk else self._empty_result()
-                try:
-                    ai_response = self._provider.analyze(SYSTEM_COMPACT, formatted)
-                    # AI might return JSON or text — either way, use it as recommendations
-                    if isinstance(ai_response, dict) and ai_response.get("recommendations"):
-                        base_result["recommendations"] = ai_response["recommendations"]
-                        base_result["architecture_assessment"] = ai_response.get("architecture_assessment", "")
-                    elif isinstance(ai_response, dict) and ai_response.get("_raw_text"):
-                        base_result["recommendations"] = [ai_response["_raw_text"][:2000]]
-                except Exception as e:
-                    logger.debug(f"LLM recommendations failed: {e}")
-                result = base_result
+                # qwen models handle JSON well — use direct approach
+                if "qwen" in self._provider.model.lower():
+                    fallback = (lambda: self._basic_analysis(ctx.scan_results, basic_risk)) if basic_risk else self._empty_result
+                    result = self._call_ai(SYSTEM_COMPACT, formatted, "analyze_directory", fallback=fallback)
+                else:
+                    # Other models (mistral, gemma): hybrid scan data + LLM recommendations
+                    base_result = self._basic_analysis(ctx.scan_results, basic_risk) if basic_risk else self._empty_result()
+                    try:
+                        ai_response = self._provider.analyze(SYSTEM_COMPACT, formatted)
+                        if isinstance(ai_response, dict) and ai_response.get("recommendations"):
+                            base_result["recommendations"] = ai_response["recommendations"]
+                            base_result["architecture_assessment"] = ai_response.get("architecture_assessment", "")
+                        elif isinstance(ai_response, dict) and ai_response.get("_raw_text"):
+                            base_result["recommendations"] = [ai_response["_raw_text"][:2000]]
+                    except Exception as e:
+                        logger.debug(f"LLM recommendations failed: {e}")
+                    result = base_result
             else:
                 system_prompt = SYSTEM_FULL_ANALYSIS
                 fallback = (lambda: self._basic_analysis(ctx.scan_results, basic_risk)) if basic_risk else self._empty_result
@@ -175,31 +179,63 @@ class AIReviewAgent:
                 return self._pattern_fixes(scan_results, code_files, severity_filter)
 
             content = self._format_fix_request(scan_results, code_files, severity_filter)
-            result = self._call_ai(SYSTEM_FIX_GENERATOR, content, "generate_fixes",
+
+            # Use compact fix prompt for Ollama
+            if self._provider.name == "ollama":
+                fix_prompt = (
+                    "IaC fix generator. Generate fixes for the STACK files (where modules are called), "
+                    "NOT inside .terraform/modules/. Add missing parameters to module blocks.\n"
+                    "Respond with JSON: {\"fixes\":[{\"fix_id\":\"fix_001\",\"finding_id\":\"check_id\","
+                    "\"file\":\"stack main.tf path\",\"severity\":\"HIGH\",\"description\":\"what\","
+                    "\"original\":\"exact module block code\",\"replacement\":\"fixed module block with new params\"}],"
+                    "\"summary\":{\"total_findings\":N,\"fixes_generated\":N,\"skipped\":N}}"
+                )
+            else:
+                fix_prompt = SYSTEM_FIX_GENERATOR
+
+            result = self._call_ai(fix_prompt, content, "generate_fixes",
                                    fallback=lambda: self._pattern_fixes(scan_results, code_files, severity_filter))
             s.set_attribute("fixes_generated", len(result.get("fixes", [])))
             return result
 
     def _format_fix_request(self, scan_results: Dict, code_files: Dict,
                             severity_filter: str = None) -> str:
-        """Format findings + code into a fix request for the AI."""
+        """Format findings + code + org policy into a fix request for the AI."""
         severity_order = {"CRITICAL": 0, "HIGH": 1, "MEDIUM": 2, "LOW": 3}
         min_sev = severity_order.get((severity_filter or "LOW").upper(), 3)
 
-        sections = ["# Findings to Fix\n"]
+        sections = []
+
+        # Add org policy context if available
+        org_rules = self._load_org_policy_context()
+        if org_rules:
+            sections.append("# Organization Rules (fixes MUST comply)\n")
+            sections.append(org_rules)
+            sections.append("")
+
+        sections.append("# Findings to Fix\n")
         for tool, data in scan_results.get("tools", {}).items():
             for f in data.get("findings", []):
                 sev = f.get("severity", "MEDIUM").upper()
                 if severity_order.get(sev, 2) <= min_sev:
-                    sections.append(
-                        f"- [{sev}] {f.get('check_id', '')}: {f.get('check_name', '')} "
-                        f"in {f.get('file', '')} resource={f.get('resource', '')}"
-                    )
+                    file_path = f.get("file", "")
+                    # Map .terraform/modules/ findings to the stack module call
+                    if ".terraform/modules/" in file_path or ".terraform\\modules\\" in file_path:
+                        resource = f.get("resource", "")
+                        sections.append(
+                            f"- [{sev}] {f.get('check_id', '')}: {f.get('check_name', '')} "
+                            f"resource={resource} (fix in the MODULE CALL, not module source)"
+                        )
+                    else:
+                        sections.append(
+                            f"- [{sev}] {f.get('check_id', '')}: {f.get('check_name', '')} "
+                            f"in {file_path} resource={f.get('resource', '')}"
+                        )
                     if f.get("guideline"):
                         sections.append(f"  Guideline: {f['guideline']}")
 
         sections.append("\n# Affected Code Files\n")
-        char_budget = 25000
+        char_budget = 25000 if self._provider.name != "ollama" else 8000
         used = 0
         for path, content in sorted(code_files.items()):
             entry = f"\n--- {path} ---\n{content}\n"
@@ -211,6 +247,32 @@ class AIReviewAgent:
 
         return "\n".join(sections)
 
+
+    def _load_org_policy_context(self) -> str:
+        """Load org policy rules as context for fix generation."""
+        from ..check.org_policy_loader import get_org_policy_path
+        org_path = get_org_policy_path()
+        if not org_path:
+            return ""
+
+        parts = []
+        rules_file = Path(org_path) / "rules" / "base.toml"
+        if rules_file.exists():
+            content = rules_file.read_text()
+            # Extract key rules compactly
+            for line in content.splitlines():
+                if any(k in line for k in ["required_tags", "pattern", "public_ingress", "enforcement"]):
+                    parts.append(line.strip())
+
+        # Add naming/tagging rego summaries
+        for rego in (Path(org_path) / "shared" / "policy").glob("*.rego"):
+            text = rego.read_text()
+            for line in text.splitlines():
+                if line.startswith(("required_tags", "naming_pattern", "deny[", "warn[")):
+                    parts.append(line.strip())
+
+        return "\n".join(parts[:15])  # Cap at 15 lines to save tokens
+
     def _fixes_from_analysis(self, analysis: Dict, directory: str) -> Dict:
         """Extract fix suggestions from an existing AI analysis."""
         fixes = []

thothctl-0.16.7/src/thothctl/version.py

@@ -0,0 +1,2 @@
+"""Version module."""
+__version__ = "0.16.7"

thothctl-0.16.4/docs/framework/commands/check/deps.md

@@ -1,50 +0,0 @@
-# Check Dependencies Command
-
-## Overview
-
-The `check deps` command visualizes and analyzes dependencies in your Infrastructure as Code projects.
-
-## Usage
-
-```bash
-# Basic dependency check
-thothctl check iac -type deps
-
-# With recursive search
-thothctl check iac --recursive -type deps
-
-# Generate dependency graph
-thothctl check iac -type deps --dependencies
-```
-
-## Features
-
-- **Dependency Visualization**: Generate ASCII and SVG dependency graphs
-- **Terragrunt Integration**: Analyze terragrunt.hcl dependencies
-- **Recursive Analysis**: Process multiple directories
-- **Graph Generation**: Create visual dependency maps
-
-## Output
-
-The command generates:
-- ASCII dependency tree in terminal
-- SVG graph files for visual representation
-- Dependency analysis reports
-
-## Examples
-
-### Basic Dependency Analysis
-```bash
-thothctl check iac -type deps
-```
-
-### Generate Visual Graph
-```bash
-thothctl check iac -type deps --dependencies
-```
-
-## Related Commands
-
-- [`check tfplan`](plan.md) - Analyze Terraform plans
-- [`check blast-radius`](blast-radius.md) - Assess change impact
-- [`inventory iac`](../inventory/iac.md) - Create dependency inventory

thothctl-0.16.4/src/thothctl/version.py

@@ -1,2 +0,0 @@
-"""Version module."""
-__version__ = "0.16.4"