cloud-doctor 0.0.1-alpha.0

package/dist/cli/index.js

@@ -0,0 +1,612 @@
+import {
+  SsoLoginRequiredError,
+  TOP_FIXES_DISPLAY_COUNT,
+  buildJsonReport,
+  buildJsonReportError,
+  computeProjectedScore,
+  getDefaultRegistry,
+  getTopErrorRules,
+  highlighter,
+  isProviderId,
+  listAwsProfiles,
+  loadConfig,
+  setColorEnabled,
+  sortCategoriesForDisplay,
+  validateAwsCredentials
+} from "../chunk-4PZ65VRA.js";
+
+// src/cli/index.ts
+import { Command } from "commander";
+
+// src/cli/utils/cli-logger.ts
+var cliLogger = {
+  log: (message = "") => {
+    console.log(message);
+  },
+  break: () => {
+    console.log("");
+  },
+  error: (message) => {
+    console.error(highlighter.error(message));
+  },
+  warn: (message) => {
+    console.warn(highlighter.warn(message));
+  },
+  info: (message) => {
+    console.log(highlighter.info(message));
+  }
+};
+
+// src/cli/commands/aws-meta.ts
+var awsProfilesAction = async () => {
+  const profiles = await listAwsProfiles();
+  if (profiles.length === 0) {
+    cliLogger.warn("No AWS profiles found in ~/.aws/config or ~/.aws/credentials");
+    return;
+  }
+  cliLogger.log(highlighter.bold("AWS profiles"));
+  cliLogger.break();
+  for (const profile of profiles) {
+    const region = profile.region ? highlighter.dim(` \xB7 ${profile.region}`) : "";
+    const kind = highlighter.gray(` (${profile.kind})`);
+    cliLogger.log(`  ${profile.name}${region}${kind}`);
+    if (profile.roleArn) {
+      cliLogger.log(highlighter.dim(`    role ${profile.roleArn}`));
+    }
+  }
+  cliLogger.break();
+};
+var awsWhoamiAction = async (profile) => {
+  const identity = await validateAwsCredentials({
+    profileName: profile ?? process.env.AWS_PROFILE,
+    region: process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION,
+    label: profile ?? process.env.AWS_PROFILE ?? "default",
+    kind: "profile",
+    useEnvironment: !profile && Boolean(process.env.AWS_ACCESS_KEY_ID)
+  });
+  cliLogger.log(highlighter.bold("AWS identity"));
+  cliLogger.break();
+  cliLogger.log(`  Account  ${identity.accountId ?? "unknown"}`);
+  cliLogger.log(`  ARN      ${identity.arn ?? "unknown"}`);
+  if (identity.profileName) cliLogger.log(`  Profile  ${identity.profileName}`);
+  if (identity.region) cliLogger.log(`  Region   ${identity.region}`);
+  cliLogger.break();
+};
+
+// src/cli/commands/scan.ts
+import ora from "ora";
+
+// src/cli/utils/prompts.ts
+import basePrompts from "prompts";
+
+// src/cli/utils/unref-stdin.ts
+var unrefStdin = () => {
+  if (process.stdin.isTTY) return;
+  process.stdin.unref?.();
+};
+
+// src/cli/utils/prompts.ts
+var onCancel = () => {
+  cliLogger.break();
+  cliLogger.log("Cancelled.");
+  cliLogger.break();
+  process.exit(0);
+};
+var prompts = (questions, options = {}) => basePrompts(questions, { onCancel: options.onCancel ?? onCancel }).finally(unrefStdin);
+
+// src/cli/utils/is-non-interactive-environment.ts
+var NON_INTERACTIVE_ENVIRONMENT_VARIABLES = [
+  "CI",
+  "GITHUB_ACTIONS",
+  "GITLAB_CI",
+  "BUILDKITE",
+  "JENKINS_URL",
+  "TF_BUILD",
+  "CODEBUILD_BUILD_ID",
+  "TEAMCITY_VERSION",
+  "BITBUCKET_BUILD_NUMBER",
+  "CIRCLECI",
+  "TRAVIS",
+  "DRONE",
+  "GIT_DIR"
+];
+var CODING_AGENT_ENVIRONMENT_VARIABLES = [
+  "CURSOR_AGENT",
+  "CLAUDE_CODE",
+  "CODEX_CI",
+  "AGENT_MODE"
+];
+var isNonInteractiveEnvironment = () => NON_INTERACTIVE_ENVIRONMENT_VARIABLES.some(
+  (envVariable) => Boolean(process.env[envVariable])
+) || CODING_AGENT_ENVIRONMENT_VARIABLES.some((envVariable) => Boolean(process.env[envVariable]));
+
+// src/cli/utils/should-skip-prompts.ts
+var shouldSkipPrompts = (input = {}) => Boolean(input.yes) || Boolean(input.json) || isNonInteractiveEnvironment() || !process.stdin.isTTY;
+
+// src/cli/resolve-identity.ts
+var formatIdentityChoice = (identity) => {
+  const hints = [identity.hint, identity.accountId ? `account ${identity.accountId}` : void 0].filter(Boolean).join(" \xB7 ");
+  return hints ? `${identity.label} (${hints})` : identity.label;
+};
+var promptForIdentity = async (identities) => {
+  const selectable = identities.filter((identity) => !identity.disabled);
+  if (selectable.length === 0) {
+    throw new Error("No identities available. Configure AWS credentials or pass --profile.");
+  }
+  const defaultIndex = Math.max(
+    0,
+    selectable.findIndex((identity) => identity.profileName === process.env.AWS_PROFILE)
+  );
+  const { identityId } = await prompts({
+    type: "select",
+    name: "identityId",
+    message: "Which AWS identity?",
+    initial: defaultIndex === -1 ? 0 : defaultIndex,
+    choices: [
+      ...selectable.map((identity) => ({
+        title: formatIdentityChoice(identity),
+        value: identity.id
+      })),
+      {
+        title: "Enter credentials manually\u2026",
+        value: "__manual__"
+      }
+    ]
+  });
+  if (identityId === "__manual__") {
+    return promptForManualIdentity();
+  }
+  const selected = selectable.find((identity) => identity.id === identityId);
+  if (!selected) throw new Error("Invalid identity selection");
+  return selected;
+};
+var promptForManualIdentity = async () => {
+  const answers = await prompts([
+    {
+      type: "text",
+      name: "accessKeyId",
+      message: "AWS access key ID",
+      validate: (value) => value.trim() ? true : "Required"
+    },
+    {
+      type: "password",
+      name: "secretAccessKey",
+      message: "AWS secret access key",
+      validate: (value) => value.trim() ? true : "Required"
+    },
+    {
+      type: "text",
+      name: "sessionToken",
+      message: "Session token (optional)"
+    },
+    {
+      type: "text",
+      name: "region",
+      message: "Default region (optional)"
+    }
+  ]);
+  return {
+    id: "__manual__",
+    label: "(manual credentials)",
+    kind: "manual",
+    status: "unknown",
+    hint: "Session-only \u2014 not saved to disk",
+    profileName: void 0,
+    defaultRegion: answers.region || void 0
+  };
+};
+var identitySummaryToInput = (identity, options, manual) => {
+  if (identity.id === "__manual__" && manual) {
+    return {
+      manualAccessKeyId: manual.accessKeyId,
+      manualSecretAccessKey: manual.secretAccessKey,
+      manualSessionToken: manual.sessionToken,
+      region: options.region ?? identity.defaultRegion,
+      accountId: options.account
+    };
+  }
+  if (identity.kind === "environment") {
+    return {
+      useEnvironment: true,
+      region: options.region,
+      accountId: options.account
+    };
+  }
+  return {
+    profile: options.profile ?? identity.profileName,
+    region: options.region ?? identity.defaultRegion,
+    accountId: options.account
+  };
+};
+var resolveIdentity = async (options) => {
+  const config = await loadConfig();
+  const ctx = {
+    cwd: process.cwd(),
+    yes: Boolean(options.yes),
+    json: Boolean(options.json)
+  };
+  const configProfile = config.aws?.profile;
+  const identities = await options.plugin.discoverIdentities(ctx);
+  let identityInput = {
+    profile: options.profile ?? configProfile,
+    region: options.region,
+    accountId: options.account ?? config.aws?.account
+  };
+  if (!identityInput.profile && !identityInput.useEnvironment && !shouldSkipPrompts({ yes: options.yes, json: options.json })) {
+    const selected = await promptForIdentity(identities);
+    if (selected.id === "__manual__") {
+      const manualAnswers = await prompts([
+        {
+          type: "text",
+          name: "accessKeyId",
+          message: "AWS access key ID",
+          validate: (value) => value.trim() ? true : "Required"
+        },
+        {
+          type: "password",
+          name: "secretAccessKey",
+          message: "AWS secret access key",
+          validate: (value) => value.trim() ? true : "Required"
+        },
+        {
+          type: "text",
+          name: "sessionToken",
+          message: "Session token (optional)"
+        }
+      ]);
+      identityInput = identitySummaryToInput(selected, options, manualAnswers);
+    } else {
+      identityInput = identitySummaryToInput(selected, options);
+    }
+  }
+  const resolved = await options.plugin.resolveIdentity(ctx, identityInput);
+  if (resolved.kind === "manual" && identityInput.manualAccessKeyId) {
+    const validated = await validateAwsCredentials({
+      profileName: void 0,
+      region: identityInput.region,
+      label: "(manual credentials)",
+      kind: "manual",
+      manualAccessKeyId: identityInput.manualAccessKeyId,
+      manualSecretAccessKey: identityInput.manualSecretAccessKey,
+      manualSessionToken: identityInput.manualSessionToken
+    });
+    return { identity: validated, identityInput };
+  }
+  try {
+    const validated = await options.plugin.validateIdentity(resolved);
+    if (options.account && validated.accountId && validated.accountId !== options.account) {
+      throw new Error(
+        `Account guard failed: expected ${options.account}, got ${validated.accountId}`
+      );
+    }
+    return { identity: validated, identityInput };
+  } catch (error) {
+    if (error instanceof SsoLoginRequiredError) {
+      console.error(highlighter.error(error.message));
+      process.exit(1);
+    }
+    throw error;
+  }
+};
+
+// src/cli/resolve-provider.ts
+var resolveProvider = async (input) => {
+  const registry = getDefaultRegistry();
+  const config = await loadConfig();
+  if (input.providerArg) {
+    if (!isProviderId(input.providerArg)) {
+      throw new Error(
+        `Unknown provider "${input.providerArg}". Expected one of: aws, gcloud, k8s, db, cloudflare`
+      );
+    }
+    return registry.require(input.providerArg);
+  }
+  const configured = config.defaultProvider;
+  if (configured) {
+    return registry.require(configured);
+  }
+  if (shouldSkipPrompts(input)) {
+    return registry.require("aws");
+  }
+  const plugins = registry.list();
+  const { provider } = await prompts({
+    type: "select",
+    name: "provider",
+    message: "What do you want to grade?",
+    initial: 0,
+    choices: plugins.map((plugin) => ({
+      title: plugin.status === "coming-soon" ? `${plugin.displayName} (coming soon)` : plugin.displayName,
+      description: plugin.description,
+      value: plugin.id,
+      disabled: plugin.status === "coming-soon"
+    }))
+  });
+  const selected = registry.require(provider);
+  if (selected.status === "coming-soon") {
+    throw new Error(`${selected.displayName} support is coming soon. Use "aws" for now.`);
+  }
+  return selected;
+};
+
+// src/cli/render-scan-report.ts
+import isUnicodeSupported from "is-unicode-supported";
+var POINTER = isUnicodeSupported() ? "\u203A" : ">";
+var renderScoreBar = (score, width = 24) => {
+  const filled = Math.round(score / 100 * width);
+  const filledSegment = highlighter.success("\u2588".repeat(filled));
+  const emptySegment = highlighter.dim("\u2591".repeat(Math.max(0, width - filled)));
+  return `${filledSegment}${emptySegment}`;
+};
+var renderScanReport = (result, verbose) => {
+  const { summary, identity, provider, diagnostics, meta } = result;
+  const projectedScore = computeProjectedScore(diagnostics) ?? summary.projectedScore;
+  const totalFindings = summary.errorCount + summary.warningCount;
+  console.log("");
+  console.log(
+    `  ${highlighter.bold(`${summary.score} / 100`)} ${summary.label}          ${totalFindings} findings`
+  );
+  console.log(`  ${renderScoreBar(summary.score)}`);
+  if (projectedScore !== void 0 && projectedScore > summary.score) {
+    console.log(
+      highlighter.dim(
+        `  +${projectedScore - summary.score} by fixing the top ${TOP_FIXES_DISPLAY_COUNT} issues`
+      )
+    );
+  }
+  console.log("");
+  console.log(
+    highlighter.dim(
+      `${provider.toUpperCase()} \xB7 account ${identity.accountId ?? identity.id} \xB7 ${identity.label}`
+    )
+  );
+  console.log("");
+  const topRules = getTopErrorRules(diagnostics);
+  if (topRules.length > 0) {
+    console.log(highlighter.bold(`  Top ${topRules.length} issues to fix first`));
+    console.log("");
+    topRules.forEach(({ ruleKey, diagnostics: ruleDiagnostics }, index) => {
+      const sample = ruleDiagnostics[0];
+      if (!sample) return;
+      console.log(
+        `  ${index + 1}. ${highlighter.bold(`${sample.category}: ${sample.title}`)}`
+      );
+      const location = [sample.region, sample.resourceArn].filter(Boolean).join(" \xB7 ");
+      if (location) console.log(highlighter.dim(`     ${location}`));
+      console.log(`     ${POINTER} ${sample.recommendation}`);
+      if (verbose && ruleDiagnostics.length > 1) {
+        console.log(highlighter.gray(`     (${ruleDiagnostics.length} resources)`));
+      }
+      console.log("");
+    });
+  } else if (totalFindings === 0) {
+    console.log(highlighter.success("  No issues found."));
+    console.log("");
+  }
+  if (totalFindings > 0) {
+    console.log(highlighter.bold(`  All ${totalFindings} issues`));
+    const categories = sortCategoriesForDisplay(
+      Object.keys(summary.categoryCounts)
+    );
+    for (const category of categories) {
+      const counts = summary.categoryCounts[category];
+      if (!counts) continue;
+      const parts = [];
+      if (counts.errors > 0) parts.push(`${counts.errors} errors`);
+      if (counts.warnings > 0) parts.push(`${counts.warnings} warnings`);
+      console.log(`  ${category.padEnd(16)} ${POINTER} ${parts.join(", ")}`);
+    }
+    console.log("");
+  }
+  const regionInfo = meta.regionsScanned && meta.regionsScanned.length > 0 ? ` \xB7 ${meta.regionsScanned.length} regions` : "";
+  console.log(
+    highlighter.dim(
+      `  Scanned in ${(meta.durationMs / 1e3).toFixed(1)}s${regionInfo} \xB7 read-only \xB7 no changes made`
+    )
+  );
+  if (!verbose && totalFindings > 0) {
+    console.log(highlighter.dim("  Run npx cloud-doctor@latest --verbose for every finding"));
+  }
+  console.log("");
+};
+
+// src/cli/utils/json-mode.ts
+import { performance } from "perf_hooks";
+var context = null;
+var installSilentConsole = () => {
+  const noop = () => {
+  };
+  for (const key of ["log", "error", "warn", "info", "debug", "trace"]) {
+    console[key] = noop;
+  }
+};
+var serialize = (value) => context?.compact ? JSON.stringify(value) : JSON.stringify(value, null, 2);
+var enableJsonMode = (compact) => {
+  context = { compact, startTime: performance.now() };
+  installSilentConsole();
+};
+var isJsonModeActive = () => context !== null;
+var writeJsonReport = (report) => {
+  process.stdout.write(`${serialize(report)}
+`);
+};
+var writeJsonErrorReport = (error) => {
+  if (!context) return;
+  const report = buildJsonReportError({
+    error,
+    elapsedMilliseconds: performance.now() - context.startTime
+  });
+  process.stdout.write(`${serialize(report)}
+`);
+};
+
+// src/cli/commands/scan.ts
+var scanAction = async (options) => {
+  const config = await loadConfig();
+  const plugin = await resolveProvider({
+    providerArg: options.providerArg,
+    yes: options.yes,
+    json: options.json
+  });
+  if (plugin.status === "coming-soon") {
+    throw new Error(`${plugin.displayName} support is coming soon. Use "aws" for now.`);
+  }
+  const spinner = !isJsonModeActive() && !isNonInteractiveEnvironment() ? ora(`Connecting to ${plugin.displayName}\u2026`).start() : null;
+  try {
+    const { identity } = await resolveIdentity({
+      plugin,
+      profile: options.profile ?? config.aws?.profile,
+      region: options.region,
+      account: options.account ?? config.aws?.account,
+      yes: options.yes,
+      json: options.json
+    });
+    if (spinner) {
+      spinner.text = `Grading ${plugin.displayName} account ${identity.accountId ?? identity.id}\u2026`;
+    }
+    const regions = options.regions?.split(",").map((r) => r.trim()) ?? config.aws?.regions;
+    const result = await plugin.scan(identity, {
+      regions,
+      verbose: Boolean(options.verbose),
+      accountGuard: options.account
+    });
+    spinner?.stop();
+    if (isJsonModeActive()) {
+      writeJsonReport(buildJsonReport(result));
+      return;
+    }
+    renderScanReport(result, Boolean(options.verbose));
+  } catch (error) {
+    spinner?.stop();
+    throw error;
+  }
+};
+
+// src/cli/utils/apply-color-preference.ts
+var parseColorPreference = (colorOption) => {
+  if (colorOption === true) return true;
+  if (colorOption === false) return false;
+  return void 0;
+};
+var applyColorPreference = (colorOption) => {
+  const preference = parseColorPreference(colorOption);
+  if (preference === void 0) return;
+  setColorEnabled(preference);
+};
+var formatExampleLines = (examples) => {
+  const width = Math.max(...examples.map(([command]) => command.length));
+  return examples.map(
+    ([command, description]) => `  $ ${command.padEnd(width)}  ${highlighter.dim(`# ${description}`)}`
+  ).join("\n");
+};
+
+// src/cli/utils/version.ts
+var VERSION = "0.0.1-alpha.0";
+var TERMINAL_HANGUP_EXIT_CODE = 130;
+
+// src/cli/utils/exit-gracefully.ts
+var exitGracefully = () => {
+  process.exit(TERMINAL_HANGUP_EXIT_CODE);
+};
+
+// src/cli/utils/guard-stdin.ts
+var TERMINAL_HANGUP_CODES = /* @__PURE__ */ new Set(["EIO", "ENXIO"]);
+var handleStdinError = (error) => {
+  if (error.code !== void 0 && TERMINAL_HANGUP_CODES.has(error.code)) {
+    process.exit(TERMINAL_HANGUP_EXIT_CODE);
+  }
+  throw error;
+};
+var guardStdin = () => {
+  process.stdin.on("error", handleStdinError);
+};
+
+// src/cli/index.ts
+process.on("SIGINT", exitGracefully);
+process.on("SIGTERM", exitGracefully);
+unrefStdin();
+guardStdin();
+var renderRootHelpEpilog = () => `
+${highlighter.dim("Examples:")}
+${formatExampleLines([
+  ["cloud-doctor", "pick a provider, then grade (defaults to AWS)"],
+  ["cloud-doctor aws", "grade your AWS account"],
+  ["cloud-doctor aws --profile prod", "use a named AWS profile"],
+  ["cloud-doctor aws --yes --json", "non-interactive JSON report"],
+  ["cloud-doctor aws profiles", "list discovered AWS profiles"],
+  ["cloud-doctor aws whoami", "show the resolved AWS identity"]
+])}
+
+${highlighter.dim("Configuration:")}
+  Add a ${highlighter.info("doctor.config.ts")} (or a ${highlighter.info('"cloudDoctor"')} key in package.json).
+`;
+var program = new Command().name("cloud-doctor").description("Grade your cloud account \u2014 misconfigurations, observability, and security posture").version(VERSION, "-v, --version", "display the version number").option("--yes, -y", "skip interactive prompts", false).option("--json", "write a machine-readable report to stdout", false).option("--verbose", "show every finding", false).option("--no-color", "disable ANSI colors").hook("preAction", (thisCommand) => {
+  const opts = thisCommand.opts();
+  applyColorPreference(opts.color);
+  if (thisCommand.opts().json) {
+    enableJsonMode(false);
+  }
+}).addHelpText("after", renderRootHelpEpilog);
+var addScanOptions = (command) => command.option("--profile <name>", "AWS named profile (or provider-specific identity)").option("--region <region>", "default region for discovery").option("--regions <list>", "comma-separated regions to scan").option("--account <id>", "assert the expected account ID");
+var collectOptions = (command) => {
+  const parent = command.parent;
+  const root = parent?.parent ?? parent;
+  return { ...root?.opts() ?? {}, ...parent?.opts() ?? {}, ...command.opts() };
+};
+var runScan = async (providerArg, command) => {
+  const opts = collectOptions(command);
+  try {
+    await scanAction({
+      providerArg,
+      profile: opts.profile,
+      region: opts.region,
+      account: opts.account,
+      regions: opts.regions,
+      verbose: Boolean(opts.verbose),
+      yes: Boolean(opts.yes),
+      json: Boolean(opts.json)
+    });
+  } catch (error) {
+    if (isJsonModeActive()) {
+      writeJsonErrorReport(error);
+      process.exit(1);
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(highlighter.error(message));
+    process.exit(1);
+  }
+};
+addScanOptions(
+  program.command("scan [provider]").description("grade a cloud account").action(async (provider, _options, command) => {
+    await runScan(provider, command);
+  })
+);
+program.argument("[provider]", "cloud provider (aws, gcloud, k8s, db, cloudflare)").option("--profile <name>", "AWS named profile (or provider-specific identity)").option("--region <region>", "default region for discovery").option("--regions <list>", "comma-separated regions to scan").option("--account <id>", "assert the expected account ID").action(async (provider, _options, command) => {
+  await runScan(provider, command);
+});
+var aws = program.command("aws").description("AWS account commands");
+addScanOptions(
+  aws.command("scan").description("grade an AWS account").action(async (_options, command) => {
+    await runScan("aws", command);
+  })
+);
+aws.command("profiles").description("list AWS profiles from ~/.aws/config").action(async () => {
+  await awsProfilesAction();
+});
+aws.command("whoami").description("show the resolved AWS identity").option("--profile <name>", "AWS named profile").action(async (options) => {
+  try {
+    await awsWhoamiAction(options.profile);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(highlighter.error(message));
+    process.exit(1);
+  }
+});
+for (const provider of ["gcloud", "k8s", "db", "cloudflare"]) {
+  addScanOptions(
+    program.command(provider).description(`grade ${provider} (coming soon)`).action(async (_options, command) => {
+      await runScan(provider, command);
+    })
+  );
+}
+await program.parseAsync(process.argv);
+//# sourceMappingURL=index.js.map