@yawlabs/aws-mcp 1.5.0 → 1.5.3

package/dist/index.js

@@ -7,7 +7,11 @@ var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __commonJS = (cb, mod) => function __require() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
 };
 var __export = (target, all) => {
   for (var name in all)
@@ -30055,6 +30059,7 @@ var require_turndown_cjs = __commonJS({
 });
 
 // src/index.ts
+import { createRequire } from "node:module";
 import { pathToFileURL } from "node:url";
 
 // node_modules/zod/v3/helpers/util.js
@@ -53846,7 +53851,7 @@ function mergeProfileBody(existingBody, creds) {
       updated.push(line);
       continue;
     }
-    const key = line.slice(0, eqIdx).trim();
+    const key = line.slice(0, eqIdx).trim().toLowerCase();
     if (managedKeys.has(key)) {
       seen.add(key);
       updated.push(`${key} = ${creds[key]}`);
@@ -54061,7 +54066,7 @@ var assumeTools = [
             error: `SSO session expired for source profile '${sourceProfile}'. Call aws_login_start with profile='${sourceProfile}' before assuming.`
           };
         }
-        return { ok: false, error: result.error, rawBody: result.rawStderr ?? result.rawStdout };
+        return { ok: false, error: result.error, rawBody: result.rawStderr };
       }
       const data = result.data ?? {};
       const creds = data.Credentials;
@@ -54069,11 +54074,22 @@ var assumeTools = [
         return { ok: false, error: "STS AssumeRole succeeded but returned incomplete credentials." };
       }
       const credentialsPath = join(homedir(), ".aws", "credentials");
-      await upsertProfile(credentialsPath, targetProfile, {
-        aws_access_key_id: creds.AccessKeyId,
-        aws_secret_access_key: creds.SecretAccessKey,
-        aws_session_token: creds.SessionToken
-      });
+      try {
+        await upsertProfile(credentialsPath, targetProfile, {
+          aws_access_key_id: creds.AccessKeyId,
+          aws_secret_access_key: creds.SecretAccessKey,
+          aws_session_token: creds.SessionToken
+        });
+      } catch (err) {
+        const code = err.code;
+        if (code === "EACCES" || code === "EROFS" || code === "EPERM") {
+          return {
+            ok: false,
+            error: `Cannot write ${credentialsPath} (permission denied). Check directory permissions or set AWS_SHARED_CREDENTIALS_FILE to a writable path.`
+          };
+        }
+        throw err;
+      }
       const expiration = creds.Expiration;
       return {
         ok: true,
@@ -54841,6 +54857,7 @@ function parseSearchResults(json2, limit) {
     const t = tes;
     const url2 = typeof t.link === "string" ? t.link : void 0;
     if (!url2) continue;
+    if (!isValidDocsUrl(url2)) continue;
     const title = typeof t.title === "string" ? t.title : url2;
     const result = { title, url: url2 };
     if (typeof t.summary === "string" && t.summary.length > 0) result.summary = t.summary;
@@ -55156,9 +55173,25 @@ function parseSimulationResults(raw) {
     const matched = Array.isArray(er.MatchedStatements) ? er.MatchedStatements : [];
     const ids = [];
     for (const m of matched) {
-      if (m && typeof m === "object" && typeof m.SourcePolicyId === "string") {
-        ids.push(m.SourcePolicyId);
+      if (!m || typeof m !== "object") continue;
+      const ms = m;
+      const sourceId = ms.SourcePolicyId;
+      if (typeof sourceId === "string" && sourceId.length > 0) {
+        ids.push(sourceId);
+        continue;
+      }
+      if (sourceId !== void 0 && sourceId !== "") continue;
+      const sourceType = ms.SourcePolicyType;
+      if (typeof sourceType !== "string") continue;
+      const startPos = ms.StartPosition;
+      if (startPos && typeof startPos === "object") {
+        const line = startPos.Line;
+        if (typeof line === "number") {
+          ids.push(`inline#L${line}`);
+          continue;
+        }
       }
+      ids.push("inline");
     }
     if (ids.length > 0) result.matchedStatementIds = ids;
     const missing = Array.isArray(er.MissingContextValues) ? er.MissingContextValues : [];
@@ -55369,6 +55402,12 @@ var logsTools = [
           error: `Invalid logStreamNamePrefix '${i.logStreamNamePrefix}'. Must be 1-512 chars, not start with '-', and contain no ':', '*', or control characters.`
         };
       }
+      if (i.filterPattern?.startsWith("-")) {
+        return {
+          ok: false,
+          error: "Invalid filterPattern: must not start with '-'."
+        };
+      }
       const extraFlags = [i.logGroupName, "--format", "json", "--since", i.since ?? "10m"];
       if (i.filterPattern) extraFlags.push("--filter-pattern", i.filterPattern);
       if (i.logStreamNames && i.logStreamNames.length > 0) {
@@ -55989,6 +56028,11 @@ function _applyJsonPatchInPlace(doc, ops) {
       throw new Error(`op '${op.op}' at index ${i} is not implemented in aws_resource_diff (use add/remove/replace).`);
     }
     const tokens = parseJsonPointer(op.path);
+    for (const seg of tokens) {
+      if (seg === "__proto__" || seg === "constructor" || seg === "prototype") {
+        throw new Error(`Path '${op.path}' contains reserved segment '${seg}' at op index ${i}.`);
+      }
+    }
     if (tokens.length === 0) {
       if (op.op === "remove") {
         throw new Error(`Cannot remove the document root at index ${i}.`);
@@ -56013,7 +56057,7 @@ function _applyJsonPatchInPlace(doc, ops) {
         }
         parent = parent[idx];
       } else if (isObj(parent)) {
-        if (!(segment in parent)) {
+        if (!Object.hasOwn(parent, segment)) {
           if (op.op === "add") {
             parent[segment] = {};
             parent = parent[segment];
@@ -56056,12 +56100,12 @@ function _applyJsonPatchInPlace(doc, ops) {
       }
     } else if (isObj(parent)) {
       if (op.op === "remove") {
-        if (!(lastToken in parent)) {
+        if (!Object.hasOwn(parent, lastToken)) {
           throw new Error(`Cannot remove missing key '${lastToken}' at index ${i}.`);
         }
         delete parent[lastToken];
       } else if (op.op === "replace") {
-        if (!(lastToken in parent)) {
+        if (!Object.hasOwn(parent, lastToken)) {
           throw new Error(`Cannot replace missing key '${lastToken}' at index ${i} (use 'add' to create it).`);
         }
         parent[lastToken] = clone2(op.value);
@@ -56275,12 +56319,12 @@ function buildMetricDataQueries(inputs, autoPeriod) {
       if (q.period !== void 0) base.Period = q.period;
       return base;
     }
-    const dimensions = q.dimensions ? Object.entries(q.dimensions).map(([Name, Value]) => ({ Name, Value })) : void 0;
+    const dimEntries = q.dimensions ? Object.entries(q.dimensions) : [];
     const stat = {
       Metric: {
         Namespace: q.namespace,
         MetricName: q.metricName,
-        ...dimensions ? { Dimensions: dimensions } : {}
+        ...dimEntries.length > 0 ? { Dimensions: dimEntries.map(([Name, Value]) => ({ Name, Value })) } : {}
       },
       Period: q.period ?? autoPeriod,
       Stat: q.statistic !== void 0 ? canonicalizeStatistic(q.statistic) : "Average"
@@ -56313,14 +56357,14 @@ var metricsTools = [
           ),
           period: external_exports3.number().int().positive().optional().describe("Period in seconds. Defaults to an auto-pick from the time range (60s/300s/900s/3600s)."),
           expression: external_exports3.string().min(1).optional().describe(
-            `CloudWatch metric math expression, e.g. 'SUM([m1, m2])' or 'AVG(METRICS("AWS/Lambda"))'. Mutually exclusive with namespace/metricName/dimensions.`
+            `CloudWatch metric math expression, e.g. 'SUM([m1, m2])' or 'AVG(METRICS("AWS/Lambda"))'. Mutually exclusive with namespace/metricName/dimensions. Validated server-side by CloudWatch; malformed values surface as a downstream ValidationError rather than a local rejection.`
           ),
           label: external_exports3.string().optional().describe("Human-readable label for the series in the response."),
           returnData: external_exports3.boolean().optional().describe(
             "Set false to compute this query but not return its data (useful for intermediate values in expressions). Default true."
           ),
           unit: external_exports3.string().optional().describe(
-            "Restrict to a specific Unit (e.g. 'Seconds', 'Bytes'). Default: no filter. Only meaningful on metric-stat queries."
+            "Restrict to a specific Unit (e.g. 'Seconds', 'Bytes'). Default: no filter. Only meaningful on metric-stat queries. Validated server-side by CloudWatch; malformed values surface as a downstream ValidationError rather than a local rejection."
           )
         })
       ).min(1).max(MAX_QUERIES).describe(`1-${MAX_QUERIES} queries. Each is either a metric-stat (namespace + metricName) or an expression.`),
@@ -56535,34 +56579,43 @@ var multiRegionTools = [
       }
       const concurrency = i.concurrency ?? DEFAULT_CONCURRENCY;
       const results = await runWithConcurrency(regions, concurrency, async (region) => {
-        if (!isValidRegionName(region)) {
-          return {
+        try {
+          if (!isValidRegionName(region)) {
+            return {
+              region,
+              ok: false,
+              error: `Invalid region '${region}'. Must match ${REGION_NAME_RE} (e.g. 'us-east-1').`,
+              errorKind: "bad_input"
+            };
+          }
+          const r = await runAwsCall({
+            service: i.service,
+            operation: i.operation,
+            params: i.params,
+            query: i.query,
+            profile: i.profile,
             region,
-            ok: false,
-            error: `Invalid region '${region}'. Must match ${REGION_NAME_RE} (e.g. 'us-east-1').`,
-            errorKind: "bad_input"
-          };
-        }
-        const r = await runAwsCall({
-          service: i.service,
-          operation: i.operation,
-          params: i.params,
-          query: i.query,
-          profile: i.profile,
-          region,
-          outputFormat: i.outputFormat,
-          timeoutMs: i.timeoutMs
-        });
-        if (!r.ok) {
+            outputFormat: i.outputFormat,
+            timeoutMs: i.timeoutMs
+          });
+          if (!r.ok) {
+            return {
+              region,
+              ok: false,
+              command: r.command,
+              error: r.error,
+              errorKind: r.kind
+            };
+          }
+          return { region, ok: true, command: r.command, data: r.data };
+        } catch (err) {
           return {
             region,
             ok: false,
-            command: r.command,
-            error: r.error,
-            errorKind: r.kind
+            error: err instanceof Error ? err.message : String(err),
+            errorKind: "unexpected"
           };
         }
-        return { region, ok: true, command: r.command, data: r.data };
       });
       const okCount = results.filter((r) => r.ok).length;
       const errCount = results.length - okCount;
@@ -56976,8 +57029,18 @@ function errorToMcpResult(err, toolName) {
     isError: true
   };
 }
-var version2 = true ? "1.5.0" : (await null).createRequire(import.meta.url)("../package.json").version;
-var isEntryPoint = (() => {
+var version2 = true ? "1.5.3" : (await null).createRequire(import.meta.url)("../package.json").version;
+var isSeaBinary = (() => {
+  try {
+    const base = import.meta.url || pathToFileURL(process.execPath).href;
+    const require2 = createRequire(base);
+    const sea = require2("node:sea");
+    return typeof sea.isSea === "function" && sea.isSea() === true;
+  } catch {
+    return false;
+  }
+})();
+var isEntryPoint = isSeaBinary || (() => {
   const entry = process.argv[1];
   if (!entry) return false;
   return import.meta.url === pathToFileURL(entry).href;
@@ -57017,8 +57080,13 @@ if (isEntryPoint) {
     });
   }
   const transport = new StdioServerTransport();
-  await server.connect(transport);
-  console.error(`@yawlabs/aws-mcp v${version2} ready (${allTools.length} tools)`);
+  server.connect(transport).then(() => {
+    console.error(`@yawlabs/aws-mcp v${version2} ready (${allTools.length} tools)`);
+  }).catch((err) => {
+    process.stderr.write(`aws-mcp: ${err instanceof Error ? err.message : String(err)}
+`);
+    process.exit(1);
+  });
 }
 export {
   allTools,