infrawise 0.10.3 → 0.12.0

package/dist/analyzers/pipeline.js

@@ -0,0 +1,166 @@
+import { HeuristicLinker, IaCHandlerLinker, CompositeLinker, } from './linkers.js';
+const TRANSPORT_EDGES = new Set(['publishes_to', 'triggers']);
+export class PipelineAnalyzer {
+    name = 'PipelineAnalyzer';
+    iacLambdas = [];
+    setIaCLambdas(lambdas) {
+        this.iacLambdas = lambdas;
+    }
+    async analyze(graph) {
+        const links = new CompositeLinker(new IaCHandlerLinker(this.iacLambdas), new HeuristicLinker()).link(graph);
+        const nodeById = new Map(graph.nodes.map((n) => [n.id, n]));
+        return [
+            ...detectMissingDlqHop(graph),
+            ...detectScanInPipeline(graph, links, nodeById),
+            ...detectRepeatedTableAccess(graph, links, nodeById),
+        ];
+    }
+}
+class UnionFind {
+    parent = new Map();
+    find(x) {
+        const p = this.parent.get(x);
+        if (p === undefined) {
+            this.parent.set(x, x);
+            return x;
+        }
+        if (p === x)
+            return x;
+        const root = this.find(p);
+        this.parent.set(x, root);
+        return root;
+    }
+    union(a, b) {
+        const ra = this.find(a);
+        const rb = this.find(b);
+        if (ra !== rb)
+            this.parent.set(ra, rb);
+    }
+}
+function buildComponents(graph, links) {
+    const uf = new UnionFind();
+    for (const e of graph.edges) {
+        if (TRANSPORT_EDGES.has(e.type))
+            uf.union(e.from, e.to);
+    }
+    for (const l of links)
+        uf.union(l.lambdaId, l.functionId);
+    const inferredRoots = new Set();
+    for (const l of links) {
+        if (l.confidence === 'inferred')
+            inferredRoots.add(uf.find(l.lambdaId));
+    }
+    return { uf, inferredRoots };
+}
+function detectMissingDlqHop(graph) {
+    const hasProducer = new Set();
+    const hasConsumer = new Set();
+    for (const e of graph.edges) {
+        if (e.type === 'publishes_to')
+            hasProducer.add(e.to);
+        if (e.type === 'triggers')
+            hasConsumer.add(e.from);
+    }
+    const findings = [];
+    for (const node of graph.nodes) {
+        if (node.type !== 'queue' || node.hasDLQ)
+            continue;
+        if (!hasProducer.has(node.id) || !hasConsumer.has(node.id))
+            continue;
+        findings.push({
+            severity: 'medium',
+            issue: `Queue "${node.name}" sits mid-pipeline without a Dead Letter Queue`,
+            description: `Queue "${node.name}" has both a producer and a downstream consumer but no DLQ. A failure in the consumer drops the message silently, breaking the pipeline with no recovery path.`,
+            recommendation: `Add a Dead Letter Queue to "${node.name}" with maxReceiveCount 3-5, and alert on DLQ depth so mid-pipeline failures are visible.`,
+            metadata: { queueName: node.name, pipelineHop: true },
+        });
+    }
+    return findings;
+}
+function detectScanInPipeline(graph, links, nodeById) {
+    const triggeredLambdas = new Set();
+    for (const e of graph.edges) {
+        if (e.type === 'triggers')
+            triggeredLambdas.add(e.to);
+    }
+    const triggeredFunctionLinks = new Map();
+    for (const l of links) {
+        if (triggeredLambdas.has(l.lambdaId))
+            triggeredFunctionLinks.set(l.functionId, l);
+    }
+    const findings = [];
+    const seen = new Set();
+    for (const e of graph.edges) {
+        if (e.type !== 'scan')
+            continue;
+        const link = triggeredFunctionLinks.get(e.from);
+        if (!link)
+            continue;
+        const fn = nodeById.get(e.from);
+        const table = nodeById.get(e.to);
+        const lambda = nodeById.get(link.lambdaId);
+        if (!fn || fn.type !== 'function' || !table || table.type !== 'table')
+            continue;
+        const dedupe = `${e.from}\0${e.to}`;
+        if (seen.has(dedupe))
+            continue;
+        seen.add(dedupe);
+        const inferred = link.confidence === 'inferred';
+        const lambdaName = lambda && lambda.type === 'lambda' ? lambda.name : link.lambdaId;
+        findings.push({
+            severity: inferred ? 'verify' : 'high',
+            issue: `Full scan runs inside event-triggered Lambda "${lambdaName}"`,
+            description: `Function "${fn.name}" (${fn.file}) performs a full scan on table "${table.name}" and runs as the handler for event-triggered Lambda "${lambdaName}". A scan inside an event-driven consumer executes on every invocation, multiplying read cost with traffic.` +
+                (inferred
+                    ? ` The Lambda-to-code link is inferred by name match (not proven from IaC), so verify it before acting.`
+                    : ` The Lambda-to-code link is proven from IaC handler configuration.`),
+            recommendation: `Replace the scan with a Query using a partition key, or add a GSI for the access pattern. Scans in per-event handlers are the highest-leverage place to fix.`,
+            metadata: { function: fn.name, table: table.name, lambda: lambdaName, inferred },
+        });
+    }
+    return findings;
+}
+function detectRepeatedTableAccess(graph, links, nodeById) {
+    const { uf, inferredRoots } = buildComponents(graph, links);
+    const access = new Map();
+    for (const e of graph.edges) {
+        if (e.type !== 'query' && e.type !== 'scan')
+            continue;
+        const fromNode = nodeById.get(e.from);
+        const toNode = nodeById.get(e.to);
+        if (!fromNode || fromNode.type !== 'function')
+            continue;
+        if (!toNode || toNode.type !== 'table')
+            continue;
+        const key = `${uf.find(e.from)}\0${e.to}`;
+        const set = access.get(key) ?? new Set();
+        set.add(e.from);
+        access.set(key, set);
+    }
+    const findings = [];
+    for (const [key, fns] of access) {
+        if (fns.size < 2)
+            continue;
+        const [root, tableId] = key.split('\0');
+        const table = nodeById.get(tableId);
+        if (!table || table.type !== 'table')
+            continue;
+        const fnNames = [...fns]
+            .map((id) => nodeById.get(id))
+            .filter((n) => !!n && n.type === 'function')
+            .map((n) => `${n.name} (${n.file})`)
+            .sort();
+        const inferred = inferredRoots.has(root);
+        findings.push({
+            severity: inferred ? 'verify' : 'medium',
+            issue: `Table "${table.name}" is accessed at multiple stages of one pipeline`,
+            description: `Table "${table.name}" is read by ${fns.size} functions linked in the same service pipeline: ${fnNames.join(', ')}. Re-reading the same table across pipeline stages often signals redundant work that could be passed forward in the message payload.` +
+                (inferred
+                    ? ` One or more Lambda-to-code links on this pipeline are inferred by name match (not proven from IaC), so verify the chain before acting.`
+                    : ''),
+            recommendation: `Confirm each access is necessary. Consider carrying the needed fields in the event payload, caching the first read, or consolidating the reads. If the duplication is intentional, no action needed.`,
+            metadata: { tableName: table.name, functions: fnNames, inferred },
+        });
+    }
+    return findings;
+}

package/dist/cli/commands/analyze.js

@@ -8,12 +8,12 @@ import { extractPostgresMetadata } from '../../adapters/db/postgres.js';
 import { extractMySQLMetadata } from '../../adapters/db/mysql.js';
 import { extractMongoMetadata } from '../../adapters/db/mongodb.js';
 import { extractIaCSchema } from '../../adapters/iac/terraform.js';
-import { extractSQSMetadata, extractSNSMetadata, extractSSMMetadata, extractSecretsMetadata, extractLambdaMetadata, extractEventBridgeMetadata, extractRDSMetadata, } from '../../adapters/aws/services.js';
+import { extractSQSMetadata, extractSNSMetadata, extractSSMMetadata, extractSecretsMetadata, extractLambdaMetadata, extractEventBridgeMetadata, extractRDSMetadata, extractAPIGatewayMetadata, } from '../../adapters/aws/services.js';
 import { extractLogsMetadata } from '../../adapters/aws/logs.js';
 import { extractS3Metadata } from '../../adapters/aws/s3.js';
 import { scanRepository } from '../../context/index.js';
 import { buildGraph } from '../../graph/index.js';
-import { runAllAnalyzers, IaCDriftAnalyzer, FullTableScanAnalyzer, MissingGSIAnalyzer, HotPartitionAnalyzer, MissingIndexAnalyzer, NplusOneAnalyzer, LargeSelectAnalyzer, MissingMySQLIndexAnalyzer, MySQLFullTableScanAnalyzer, MissingMongoIndexAnalyzer, MongoCollectionScanAnalyzer, MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, RDSPubliclyAccessibleAnalyzer, RDSNoBackupAnalyzer, RDSUnencryptedAnalyzer, RDSNoDeletionProtectionAnalyzer, RDSNoMultiAZAnalyzer, S3PublicAccessAnalyzer, S3MissingVersioningAnalyzer, S3UnencryptedAnalyzer, } from '../../analyzers/index.js';
+import { runAllAnalyzers, IaCDriftAnalyzer, PipelineAnalyzer, FullTableScanAnalyzer, MissingGSIAnalyzer, HotPartitionAnalyzer, MissingIndexAnalyzer, NplusOneAnalyzer, LargeSelectAnalyzer, MissingMySQLIndexAnalyzer, MySQLFullTableScanAnalyzer, MissingMongoIndexAnalyzer, MongoCollectionScanAnalyzer, MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, VisibilityTimeoutMismatchAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, RDSPubliclyAccessibleAnalyzer, RDSNoBackupAnalyzer, RDSUnencryptedAnalyzer, RDSNoDeletionProtectionAnalyzer, RDSNoMultiAZAnalyzer, S3PublicAccessAnalyzer, S3MissingVersioningAnalyzer, S3UnencryptedAnalyzer, } from '../../analyzers/index.js';
 import { printFinding, printSummaryBox, log, printHeader } from '../utils.js';
 const SEVERITY_ORDER = { high: 3, medium: 2, low: 1, verify: 0 };
 function buildMarkdownReport(findings, projectName) {
@@ -63,7 +63,6 @@ export async function runAnalyze(options = {}) {
     const awsCfg = {
         region: config.aws?.region,
         profile: config.aws?.profile,
-        endpoint: config.aws?.endpoint,
     };
     const dynamoMeta = [];
     const postgresMeta = [];
@@ -230,6 +229,20 @@ export async function runAnalyze(options = {}) {
                 chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
         }
     }
+    // ── API Gateway ───────────────────────────────────────────────────────────────
+    if (config.apiGateway?.enabled === true) {
+        const s = mkSpinner('Extracting API Gateway routes...');
+        try {
+            const result = await extractAPIGatewayMetadata(awsCfg);
+            servicesMeta.apiGateway = result;
+            const routeCount = result.reduce((sum, api) => sum + api.routes.length, 0);
+            s.succeed(chalk.green('API Gateway') + chalk.dim(`  ${result.length} API(s), ${routeCount} route(s)`));
+        }
+        catch (err) {
+            s.warn(chalk.yellow('API Gateway skipped') +
+                chalk.dim(`  ${err instanceof Error ? err.message : String(err)}`));
+        }
+    }
     // ── CloudWatch Logs ──────────────────────────────────────────────────────────
     if (config.cloudwatchLogs?.enabled) {
         const s = mkSpinner('Sampling CloudWatch Logs (errors only, max 50 groups)...');
@@ -251,6 +264,7 @@ export async function runAnalyze(options = {}) {
     }
     // ── IaC schema (Terraform / CloudFormation / CDK) ────────────────────────────
     let iacDriftAnalyzer;
+    let iacLambdas = [];
     {
         const s = mkSpinner('Extracting IaC schema (Terraform / CloudFormation / CDK)...');
         try {
@@ -267,6 +281,7 @@ export async function runAnalyze(options = {}) {
                 iacSchema.apiGateways.length;
             iacDriftAnalyzer = new IaCDriftAnalyzer();
             iacDriftAnalyzer.setIaCSchema(iacSchema);
+            iacLambdas = iacSchema.lambdas;
             s.succeed(chalk.green('IaC schema') + chalk.dim(`  ${total} resource(s) across TF/CFN/CDK`));
         }
         catch (err) {
@@ -301,9 +316,17 @@ export async function runAnalyze(options = {}) {
     let findings;
     {
         const s = mkSpinner('Running analyzers...');
+        const hotPartitionThreshold = config.analysis?.hotPartitionThreshold;
+        const hotPartitionThresholds = config.analysis?.hotPartitionThresholds;
+        const pipelineAnalyzer = new PipelineAnalyzer();
+        pipelineAnalyzer.setIaCLambdas(iacLambdas);
         const analyzers = [
             ...(config.dynamodb?.enabled === true
-                ? [new FullTableScanAnalyzer(), new MissingGSIAnalyzer(), new HotPartitionAnalyzer()]
+                ? [
+                    new FullTableScanAnalyzer(),
+                    new MissingGSIAnalyzer(),
+                    new HotPartitionAnalyzer(hotPartitionThreshold, hotPartitionThresholds),
+                ]
                 : []),
             ...(config.postgres?.enabled
                 ? [new MissingIndexAnalyzer(), new NplusOneAnalyzer(), new LargeSelectAnalyzer()]
@@ -319,6 +342,7 @@ export async function runAnalyze(options = {}) {
                     new MissingDLQAnalyzer(),
                     new UnencryptedQueueAnalyzer(),
                     new LargeQueueBacklogAnalyzer(),
+                    new VisibilityTimeoutMismatchAnalyzer(),
                 ]
                 : []),
             ...(config.secretsManager?.enabled === true ? [new MissingSecretRotationAnalyzer()] : []),
@@ -347,6 +371,7 @@ export async function runAnalyze(options = {}) {
                 ]
                 : []),
             ...(iacDriftAnalyzer ? [iacDriftAnalyzer] : []),
+            pipelineAnalyzer,
         ];
         findings = await runAllAnalyzers(graph, analyzers);
         s.succeed(chalk.green('Analysis complete') + chalk.dim(`  ${findings.length} finding(s)`));
@@ -406,10 +431,12 @@ export async function runCodeRefresh(repoPath, config) {
     const servicesMeta = cached?.servicesMeta ?? {};
     // Re-run IaC schema (pure file scan, no AWS calls)
     let iacDriftAnalyzer;
+    let iacLambdas = [];
     try {
         const iacSchema = await extractIaCSchema(repoPath);
         iacDriftAnalyzer = new IaCDriftAnalyzer();
         iacDriftAnalyzer.setIaCSchema(iacSchema);
+        iacLambdas = iacSchema.lambdas;
     }
     catch {
         // IaC scan is best-effort
@@ -423,9 +450,17 @@ export async function runCodeRefresh(repoPath, config) {
         operations = [];
     }
     const graph = buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta, mongoMeta, servicesMeta);
+    const hotPartitionThreshold = config.analysis?.hotPartitionThreshold;
+    const hotPartitionThresholds = config.analysis?.hotPartitionThresholds;
+    const pipelineAnalyzer = new PipelineAnalyzer();
+    pipelineAnalyzer.setIaCLambdas(iacLambdas);
     const analyzers = [
         ...(config.dynamodb?.enabled === true
-            ? [new FullTableScanAnalyzer(), new MissingGSIAnalyzer(), new HotPartitionAnalyzer()]
+            ? [
+                new FullTableScanAnalyzer(),
+                new MissingGSIAnalyzer(),
+                new HotPartitionAnalyzer(hotPartitionThreshold, hotPartitionThresholds),
+            ]
             : []),
         ...(config.postgres?.enabled
             ? [new MissingIndexAnalyzer(), new NplusOneAnalyzer(), new LargeSelectAnalyzer()]
@@ -437,7 +472,12 @@ export async function runCodeRefresh(repoPath, config) {
             ? [new MissingMongoIndexAnalyzer(), new MongoCollectionScanAnalyzer()]
             : []),
         ...(config.sqs?.enabled === true
-            ? [new MissingDLQAnalyzer(), new UnencryptedQueueAnalyzer(), new LargeQueueBacklogAnalyzer()]
+            ? [
+                new MissingDLQAnalyzer(),
+                new UnencryptedQueueAnalyzer(),
+                new LargeQueueBacklogAnalyzer(),
+                new VisibilityTimeoutMismatchAnalyzer(),
+            ]
             : []),
         ...(config.secretsManager?.enabled === true ? [new MissingSecretRotationAnalyzer()] : []),
         ...(config.cloudwatchLogs?.enabled ? [new MissingLogRetentionAnalyzer()] : []),
@@ -465,6 +505,7 @@ export async function runCodeRefresh(repoPath, config) {
             ]
             : []),
         ...(iacDriftAnalyzer ? [iacDriftAnalyzer] : []),
+        pipelineAnalyzer,
     ];
     const findings = await runAllAnalyzers(graph, analyzers);
     writeCache('graph', graph);

package/dist/cli/commands/check.js

@@ -0,0 +1,28 @@
+import * as path from 'path';
+import chalk from 'chalk';
+import { readCache, setCacheDir } from '../../core/index.js';
+import { printFinding, log, printHeader } from '../utils.js';
+import { runAnalyze } from './analyze.js';
+const SEVERITY_ORDER = { high: 3, medium: 2, low: 1, verify: 0 };
+export async function runCheck(options = {}) {
+    const failOn = options.failOn ?? 'high';
+    const threshold = SEVERITY_ORDER[failOn] ?? 3;
+    printHeader('Infrawise Check');
+    // Always extract fresh — CI must not gate on a stale graph.
+    await runAnalyze({ config: options.config, repo: options.repo, silent: true });
+    setCacheDir(path.dirname(path.resolve(options.config ?? 'infrawise.yaml')));
+    const findings = readCache('findings') ?? [];
+    const violations = findings.filter((f) => (SEVERITY_ORDER[f.severity] ?? 0) >= threshold);
+    console.log('');
+    if (violations.length === 0) {
+        log.success('Check passed', `no ${failOn}+ findings (${findings.length} total below threshold)`);
+        console.log('');
+        return;
+    }
+    console.log(chalk.bold('  Blocking findings') + chalk.dim(`  ${violations.length} at or above ${failOn}`));
+    violations.forEach((f, i) => printFinding(f, i));
+    console.log('');
+    log.fail(`Check failed`, `${violations.length} ${failOn}+ finding(s) must be resolved before deploy`);
+    console.log('');
+    process.exit(1);
+}

package/dist/cli/commands/discover.js

@@ -0,0 +1,201 @@
+import * as fs from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+import * as yaml from 'js-yaml';
+import chalk from 'chalk';
+import inquirer from 'inquirer';
+import { probePort, scanDotEnv } from '../probe.js';
+import { readAWSProfiles, detectAWSRegion, log } from '../utils.js';
+import { runInit } from '../interactive-setup.js';
+const DB_PORTS = { postgres: 5432, mysql: 3306, mongodb: 27017 };
+const ENV_KEYS = {
+    postgres: ['DATABASE_URL', 'POSTGRES_URL', 'POSTGRESQL_URL', 'POSTGRES_CONNECTION_STRING'],
+    mysql: ['MYSQL_URL', 'MYSQL_CONNECTION_STRING'],
+    mongodb: ['MONGO_URI', 'MONGODB_URI', 'MONGO_URL', 'MONGODB_URL'],
+};
+export async function runDiscover(options = {}) {
+    if (options.interactive) {
+        await runInit();
+        return;
+    }
+    const cwd = process.cwd();
+    log.dim('Probing environment...');
+    const [pgDetected, mysqlDetected, mongoDetected] = await Promise.all([
+        probePort('localhost', DB_PORTS.postgres, 300),
+        probePort('localhost', DB_PORTS.mysql, 300),
+        probePort('localhost', DB_PORTS.mongodb, 300),
+    ]);
+    if (pgDetected)
+        log.success('Postgres detected', `port ${DB_PORTS.postgres}`);
+    if (mysqlDetected)
+        log.success('MySQL detected', `port ${DB_PORTS.mysql}`);
+    if (mongoDetected)
+        log.success('MongoDB detected', `port ${DB_PORTS.mongodb}`);
+    const envVars = scanDotEnv(cwd);
+    const secrets = extractDbSecrets(envVars);
+    const iacDetected = detectIaC(cwd);
+    const hasAWSConfig = process.env.AWS_ACCESS_KEY_ID !== undefined ||
+        fs.existsSync(path.join(os.homedir(), '.aws', 'credentials')) ||
+        fs.existsSync(path.join(os.homedir(), '.aws', 'config'));
+    if (!hasAWSConfig && !pgDetected && !mysqlDetected && !mongoDetected) {
+        console.error(chalk.red('\n  Nothing detected.'));
+        console.error(chalk.dim('  Run `aws configure` to set up AWS credentials, or start a local database.\n'));
+        process.exit(1);
+    }
+    let selectedProfile = '';
+    if (process.env.AWS_PROFILE) {
+        selectedProfile = process.env.AWS_PROFILE;
+        log.success('AWS profile', `${selectedProfile} (from AWS_PROFILE)`);
+    }
+    else {
+        const profiles = readAWSProfiles();
+        if (profiles.length === 1) {
+            selectedProfile = profiles[0];
+            log.success('AWS profile', profiles[0]);
+        }
+        else if (profiles.length > 1) {
+            console.log('');
+            const answer = await inquirer.prompt([
+                {
+                    type: 'select',
+                    name: 'profile',
+                    message: 'Select AWS profile:',
+                    choices: profiles,
+                    default: profiles[0],
+                },
+            ]);
+            selectedProfile = answer.profile;
+        }
+    }
+    const region = detectAWSRegion(selectedProfile);
+    ensureInfrawiseDir(cwd);
+    writeYaml(cwd, {
+        profile: selectedProfile,
+        region,
+        pgDetected,
+        mysqlDetected,
+        mongoDetected,
+        iacDetected,
+    });
+    const anyDbDetected = pgDetected || mysqlDetected || mongoDetected;
+    if (anyDbDetected) {
+        writeSecrets(cwd, secrets);
+    }
+    console.log('');
+    log.success('Generated infrawise.yaml');
+    if (pgDetected && !secrets.postgres) {
+        log.warn('Postgres detected — add connection string to .infrawise/secrets.yaml');
+    }
+    if (mysqlDetected && !secrets.mysql) {
+        log.warn('MySQL detected — add connection string to .infrawise/secrets.yaml');
+    }
+    if (mongoDetected && !secrets.mongodb) {
+        log.warn('MongoDB detected — add connection string to .infrawise/secrets.yaml');
+    }
+    console.log('');
+}
+function extractDbSecrets(env) {
+    const secrets = {};
+    for (const key of ENV_KEYS.postgres) {
+        if (env[key]) {
+            secrets.postgres = env[key];
+            break;
+        }
+    }
+    for (const key of ENV_KEYS.mysql) {
+        if (env[key]) {
+            secrets.mysql = env[key];
+            break;
+        }
+    }
+    for (const key of ENV_KEYS.mongodb) {
+        if (env[key]) {
+            secrets.mongodb = env[key];
+            break;
+        }
+    }
+    return secrets;
+}
+function detectIaC(cwd) {
+    return scanDirForIaC(cwd, 3);
+}
+function scanDirForIaC(dir, depth) {
+    if (depth < 0)
+        return false;
+    try {
+        const entries = fs.readdirSync(dir, { withFileTypes: true });
+        for (const entry of entries) {
+            if (entry.name.startsWith('.') || entry.name === 'node_modules')
+                continue;
+            if (entry.isFile()) {
+                const n = entry.name;
+                if (n.endsWith('.tf') ||
+                    n === 'cdk.json' ||
+                    n === 'template.yaml' ||
+                    n === 'template.yml') {
+                    return true;
+                }
+            }
+            else if (entry.isDirectory() && depth > 0) {
+                if (scanDirForIaC(path.join(dir, entry.name), depth - 1))
+                    return true;
+            }
+        }
+    }
+    catch {
+        // ignore permission errors
+    }
+    return false;
+}
+function ensureInfrawiseDir(cwd) {
+    const infrawiseDir = path.join(cwd, '.infrawise');
+    if (!fs.existsSync(infrawiseDir)) {
+        fs.mkdirSync(infrawiseDir, { recursive: true });
+    }
+    const gitignorePath = path.join(cwd, '.gitignore');
+    const entry = '.infrawise/';
+    if (fs.existsSync(gitignorePath)) {
+        const content = fs.readFileSync(gitignorePath, 'utf-8');
+        if (!content.includes(entry)) {
+            const prefix = content.length > 0 && !content.endsWith('\n') ? '\n' : '';
+            fs.appendFileSync(gitignorePath, `${prefix}${entry}\n`);
+        }
+    }
+    else {
+        fs.writeFileSync(gitignorePath, `${entry}\n`);
+    }
+}
+function writeYaml(cwd, opts) {
+    const config = {
+        project: path.basename(cwd),
+        aws: {
+            profile: opts.profile,
+            region: opts.region,
+        },
+        dynamodb: { enabled: true, includeTables: [] },
+        postgres: { enabled: opts.pgDetected, connectionString: '' },
+        mysql: { enabled: opts.mysqlDetected, connectionString: '' },
+        mongodb: { enabled: opts.mongoDetected, connectionString: '', databases: [] },
+        terraform: { enabled: opts.iacDetected },
+        sqs: { enabled: true },
+        sns: { enabled: true },
+        ssm: { enabled: true, paths: [] },
+        secretsManager: { enabled: true },
+        lambda: { enabled: true },
+        eventbridge: { enabled: true },
+        rds: { enabled: false },
+        s3: { enabled: true },
+        apiGateway: { enabled: true },
+        cloudwatchLogs: { enabled: false, logGroupPrefixes: [], windowHours: 24 },
+        analysis: { sampleSize: 100 },
+    };
+    fs.writeFileSync(path.join(cwd, 'infrawise.yaml'), yaml.dump(config, { lineWidth: 120 }), 'utf-8');
+}
+function writeSecrets(cwd, secrets) {
+    const data = {
+        postgres: { connectionString: secrets.postgres ?? '' },
+        mysql: { connectionString: secrets.mysql ?? '' },
+        mongodb: { connectionString: secrets.mongodb ?? '' },
+    };
+    fs.writeFileSync(path.join(cwd, '.infrawise', 'secrets.yaml'), yaml.dump(data, { lineWidth: 120 }), 'utf-8');
+}

package/dist/cli/commands/doctor.js

@@ -44,7 +44,7 @@ export async function runDoctor(options = {}) {
             name: 'Config file',
             status: exists ? 'pass' : 'fail',
             message: exists ? configPath : `Not found at ${configPath}`,
-            detail: exists ? undefined : 'Run: infrawise init',
+            detail: exists ? undefined : 'Run: infrawise start',
         };
     }));
     // Config valid
@@ -80,7 +80,6 @@ export async function runDoctor(options = {}) {
     const awsCfg = {
         region: config?.aws?.region,
         profile: config?.aws?.profile,
-        endpoint: config?.aws?.endpoint,
     };
     // DynamoDB
     results.push(await runCheck('Testing DynamoDB access...', async () => {

package/dist/cli/commands/serve.js

@@ -0,0 +1,9 @@
+import { runDev } from './dev.js';
+import { runStdio } from './stdio.js';
+export async function runServe(options = {}) {
+    if (options.stdio) {
+        await runStdio(options.config);
+        return;
+    }
+    await runDev({ config: options.config, port: options.port });
+}

package/dist/cli/commands/start.js

@@ -4,7 +4,7 @@ import { spawn } from 'child_process';
 import chalk from 'chalk';
 import { readCache, setCacheDir, formatError, loadConfig } from '../../core/index.js';
 import { log, printHeader } from '../utils.js';
-import { runInit } from './init.js';
+import { runDiscover } from './discover.js';
 import { runAnalyze } from './analyze.js';
 const CACHE_TTL_MS = 24 * 60 * 60 * 1000;
 function writeMcpJson(configAbsPath) {
@@ -12,7 +12,7 @@ function writeMcpJson(configAbsPath) {
         mcpServers: {
             infrawise: {
                 command: 'infrawise',
-                args: ['stdio', '--config', configAbsPath],
+                args: ['serve', '--stdio', '--config', configAbsPath],
             },
         },
     };
@@ -27,7 +27,7 @@ function writeCursorMcp(configAbsPath) {
         mcpServers: {
             infrawise: {
                 command: 'infrawise',
-                args: ['stdio', '--config', configAbsPath],
+                args: ['serve', '--stdio', '--config', configAbsPath],
             },
         },
     };
@@ -54,7 +54,7 @@ function launchEditor(editor) {
             const cmd = editor;
             const args = ['.'];
             console.log('');
-            console.log(chalk.dim('  Opening Cursor...'));
+            console.log(chalk.dim(`  Opening ${cmd}...`));
             const child = spawn(cmd, args, { detached: true, stdio: 'ignore' });
             child.on('error', (err) => {
                 if (err.code === 'ENOENT') {
@@ -71,23 +71,35 @@ export async function runStart(options = {}) {
     const cwd = process.cwd();
     const configPath = options.config ?? 'infrawise.yaml';
     const configAbsPath = path.resolve(cwd, configPath);
-    // Step 1 — create infrawise.yaml if missing
+    // --rediscover: wipe yaml + entire .infrawise dir, then re-run discovery and analysis
+    if (options.rediscover) {
+        if (fs.existsSync(configAbsPath)) {
+            fs.unlinkSync(configAbsPath);
+        }
+        const infrawiseDir = path.join(path.dirname(configAbsPath), '.infrawise');
+        if (fs.existsSync(infrawiseDir)) {
+            fs.rmSync(infrawiseDir, { recursive: true, force: true });
+        }
+        log.warn('Cleared config and .infrawise — rediscovering...');
+        console.log('');
+    }
+    // Generate config if missing
     if (!fs.existsSync(configAbsPath)) {
-        log.warn('No infrawise.yaml found — running setup...');
+        log.warn('No infrawise.yaml found — probing environment...');
         console.log('');
-        await runInit({ quiet: true });
+        await runDiscover({ interactive: options.interactive });
         console.log('');
     }
-    // Validate config is loadable before proceeding
+    // Validate config
     try {
-        loadConfig(configPath);
+        loadConfig(configAbsPath);
     }
     catch (err) {
         console.error(formatError(err));
         process.exit(1);
     }
     setCacheDir(path.dirname(configAbsPath));
-    // Step 2 — check cache with 24h TTL, re-analyze if stale or missing
+    // Check cache, re-analyze if stale
     const cachedGraph = readCache('graph', CACHE_TTL_MS);
     const cachedFindings = readCache('findings', CACHE_TTL_MS);
     if (cachedGraph && cachedFindings) {
@@ -100,12 +112,12 @@ export async function runStart(options = {}) {
         await runAnalyze({ config: options.config, silent: true });
         console.log('');
     }
-    // Step 3 — write editor MCP config files
+    // Write editor MCP config files
     console.log('');
     writeMcpJson(configAbsPath);
     if (options.cursor)
         writeCursorMcp(configAbsPath);
-    // Step 4 — launch editor or print instructions
+    // Launch editor or print instructions
     const editor = options.claude ? 'claude' : options.cursor ? 'cursor' : null;
     if (!editor) {
         console.log('');