infrawise 0.11.0 → 0.12.1

package/README.md

@@ -69,10 +69,10 @@ infrawise start --claude
 
 That's it. Infrawise will:
 
-1. Ask a few questions and generate `infrawise.yaml` (first time only)
+1. Probe your environment and generate `infrawise.yaml` (first time only — asks which AWS profile to use only if you have several)
 2. Scan your AWS services, databases, and codebase
 3. Write `.mcp.json` so your editor auto-connects on every future launch
-4. Open Claude Code with all 15 MCP tools ready
+4. Open Claude Code with all 16 MCP tools ready
 
 **Every time after:**
 
@@ -80,7 +80,7 @@ That's it. Infrawise will:
 claude    # no infrawise command needed — editor manages the connection
 ```
 
-Analysis is cached for 24 hours. When the cache is stale, `infrawise stdio` (spawned automatically by your editor) refreshes it at session start. File changes are detected within the session and the code graph is updated automatically.
+Analysis is cached for 24 hours. When the cache is stale, `infrawise serve --stdio` (spawned automatically by your editor) refreshes it at session start. File changes are detected within the session and the code graph is updated automatically.
 
 ```
 Findings (3 total)
@@ -107,7 +107,7 @@ Findings (3 total)
 infrawise start --claude
 ```
 
-Writes `.mcp.json` to your project root and opens Claude Code. Claude Code reads `.mcp.json` automatically on every launch and manages the `infrawise stdio` process — no server to start, no ports to configure.
+Writes `.mcp.json` to your project root and opens Claude Code. Claude Code reads `.mcp.json` automatically on every launch and manages the `infrawise serve --stdio` process — no server to start, no ports to configure.
 
 ### Cursor
 
@@ -115,7 +115,7 @@ Writes `.mcp.json` to your project root and opens Claude Code. Claude Code reads
 infrawise start --cursor
 ```
 
-Writes `.cursor/mcp.json` and opens Cursor. All 15 infrawise tools are available in Cursor's MCP panel.
+Writes `.cursor/mcp.json` and opens Cursor. All 16 infrawise tools are available in Cursor's MCP panel.
 
 ### Any editor (no flag)
 
@@ -123,14 +123,14 @@ Writes `.cursor/mcp.json` and opens Cursor. All 15 infrawise tools are available
 infrawise start
 ```
 
-Writes `.mcp.json` and exits. Open whichever editor you prefer — point it at `infrawise stdio --config /path/to/infrawise.yaml` as an MCP server command.
+Writes `.mcp.json` and exits. Open whichever editor you prefer — point it at `infrawise serve --stdio --config /path/to/infrawise.yaml` as an MCP server command.
 
 ### HTTP transport (alternative)
 
 If your editor or workflow requires an HTTP MCP endpoint instead of stdio:
 
 ```bash
-infrawise dev    # starts server at http://localhost:3000/mcp
+infrawise serve    # starts server at http://localhost:3000/mcp
 ```
 
 Add to your editor's MCP config:
@@ -170,17 +170,17 @@ Add to your editor's MCP config:
 
 ## CLI reference
 
-| Command                      | What it does                                                                      |
-| ---------------------------- | --------------------------------------------------------------------------------- |
-| `infrawise start`            | **Primary command** — init + analyze + write editor MCP config, then exit         |
-| `infrawise start --claude`   | Same as above, then opens Claude Code                                             |
-| `infrawise start --cursor`   | Same as above, then opens Cursor                                                  |
-| `infrawise init`             | Generate `infrawise.yaml` only (no analysis, no editor config)                   |
-| `infrawise auth`             | Select or switch AWS profile                                                      |
-| `infrawise analyze`          | Force a full re-scan — useful after major infrastructure changes                  |
-| `infrawise dev`              | HTTP transport alternative — starts server at `localhost:3000/mcp`               |
-| `infrawise stdio`            | Stdio transport — auto-managed by editors via `.mcp.json` (rarely run directly)  |
-| `infrawise doctor`           | Validate AWS access, DB connectivity, and config                                  |
+| Command                       | What it does                                                                       |
+| ----------------------------- | --------------------------------------------------------------------------------- |
+| `infrawise start`             | **Primary command** — probe env, generate config, analyze, write editor MCP config |
+| `infrawise start --claude`    | Same as above, then opens Claude Code                                             |
+| `infrawise start --cursor`    | Same as above, then opens Cursor                                                  |
+| `infrawise start --interactive` | Run the guided setup wizard instead of auto-discovery                           |
+| `infrawise start --rediscover` | Delete `infrawise.yaml` + `.infrawise/`, then re-probe and re-analyze            |
+| `infrawise analyze`           | Force a full re-scan — useful after major infrastructure changes                  |
+| `infrawise check`             | CI gate — analyze and exit non-zero when findings reach the threshold severity    |
+| `infrawise serve`             | Start the MCP server — HTTP by default, or `--stdio` for editor integration       |
+| `infrawise doctor`            | Diagnostic escape hatch — validate AWS/DB access, config, and repo scan            |
 
 ### `infrawise analyze` options
 
@@ -190,7 +190,7 @@ Add to your editor's MCP config:
 | `-r, --repo <path>`   | Repository to scan (default: current directory)                        |
 | `--no-cache`          | Skip reading/writing the cache                                         |
 | `-o, --output <path>` | Save findings as a markdown report, e.g. `report.md`                   |
-| `--severity <level>`  | Only show findings at or above this level: `high` \| `medium` \| `low` \| `verify` |
+| `--severity <level>`  | Only show findings at or above this level: `high` \| `medium` \| `low` |
 
 ```bash
 # Export a shareable findings report
@@ -203,11 +203,37 @@ infrawise analyze --severity high
 infrawise analyze --severity high --output report.md
 ```
 
+### `infrawise check` options (CI/CD)
+
+`check` runs a fresh analysis and sets a non-zero exit code when blocking findings exist, so it can gate a pipeline without an AI editor.
+
+| Flag                  | Description                                                            |
+| --------------------- | ---------------------------------------------------------------------- |
+| `-c, --config <path>` | Path to `infrawise.yaml` (default: `infrawise.yaml`)                   |
+| `-r, --repo <path>`   | Repository to scan (default: current directory)                        |
+| `--fail-on <level>`   | Severity that fails the build: `high` (default) \| `medium` \| `low`   |
+
+```bash
+# Block a deploy if any high-severity finding exists (exit 1)
+infrawise check
+
+# Stricter gate — fail on medium and above
+infrawise check --fail-on medium
+```
+
+### `infrawise serve` options
+
+| Flag                  | Description                                                            |
+| --------------------- | ---------------------------------------------------------------------- |
+| `-c, --config <path>` | Path to `infrawise.yaml` (default: `infrawise.yaml`)                   |
+| `--stdio`             | Use stdio transport (for editors via `.mcp.json`) instead of HTTP      |
+| `-p, --port <number>` | Port to listen on, HTTP only (default: `3000`)                         |
+
 ---
 
 ## Configuration
 
-`infrawise.yaml` is generated by `infrawise start` (or `infrawise init` to create the file only) and lives in your repo root. Every service must be explicitly `enabled: true` — infrawise never connects to anything not listed in config.
+`infrawise.yaml` is generated by `infrawise start` (or `infrawise start --interactive` for the guided wizard) and lives in your repo root. Every service must be explicitly `enabled: true` — infrawise never connects to anything not listed in config.
 
 Connection strings support `${ENV_VAR}` substitution so passwords never need to be committed:
 
@@ -272,9 +298,6 @@ rds:
 s3:
   enabled: false
 
-kafka:
-  enabled: false
-
 apiGateway:
   enabled: false
 
@@ -343,9 +366,9 @@ Works from AWS APIs, database schema introspection, and IaC files — no depende
 | MongoDB schema                   | Collections, indexes                                                                                               |
 | SQS                              | Missing DLQs, unencrypted queues, large backlogs, FIFO detection, visibility timeout vs Lambda timeout mismatch    |
 | SNS                              | Subscription filter policies — required message attributes per subscription                                        |
-| Kafka (kafkajs)                  | Producer/consumer topic mapping from code                                                                          |
+| Apache Kafka (kafkajs)           | Producer/consumer topic mapping from code — any broker (self-hosted, Confluent, Redpanda, MSK); distinct from the MSK Lambda trigger |
 | Secrets Manager                  | Missing secret rotation                                                                                            |
-| Lambda                           | Default memory (128 MB), high timeouts, triggers (SQS/DynamoDB/Kinesis/EventBridge/S3), missing DLQ on trigger source |
+| Lambda                           | Default memory (128 MB), high timeouts, triggers (SQS/SNS/DynamoDB/Kinesis/MSK/EventBridge/S3), missing DLQ on trigger source |
 | S3                               | Public access blocking (verify), missing versioning, missing encryption                                            |
 | EventBridge                      | Rules, schedules, event patterns, target Lambda functions                                                          |
 | API Gateway                      | REST, HTTP, and WebSocket APIs — routes, methods, Lambda integrations                                             |
@@ -363,7 +386,7 @@ Uses [ts-morph](https://ts-morph.com/) AST analysis to detect which functions ca
 | Missing GSI                | Medium   | Queries on attributes without a matching GSI  |
 | Hot Partition              | Medium   | 5+ distinct code paths hitting the same table |
 | Missing Index (PostgreSQL) | Medium   | Tables queried without indexes                |
-| N+1 Query                  | Medium   | Repeated query patterns from ORM loops        |
+| N+1 Query                  | High     | Repeated query patterns from ORM loops        |
 | Large SELECT               | Low      | `SELECT *` usage                              |
 | Missing MySQL Index        | Medium   | MySQL tables queried without indexes          |
 | MySQL Full Table Scan      | High     | Full table scan patterns in MySQL queries     |

package/dist/adapters/aws/dynamodb.js

@@ -4,10 +4,7 @@ import { DynamoDBError, logger } from '../../core/index.js';
 function createDynamoClient(config) {
     const region = config.aws?.region ?? 'us-east-1';
     const profile = config.aws?.profile;
-    const endpoint = config.aws?.endpoint;
     const clientConfig = { region };
-    if (endpoint)
-        clientConfig.endpoint = endpoint;
     if (profile)
         clientConfig.credentials = fromIni({ profile });
     return new DynamoDBClient(clientConfig);

package/dist/adapters/aws/logs.js

@@ -7,8 +7,6 @@ const MAX_EVENTS_PER_GROUP = 50;
 function clientConfig(cfg) {
     const region = cfg.region ?? 'us-east-1';
     const base = { region };
-    if (cfg.endpoint)
-        base.endpoint = cfg.endpoint;
     if (cfg.profile)
         base.credentials = fromIni({ profile: cfg.profile });
     return base;

package/dist/adapters/aws/s3.js

@@ -1,25 +1,9 @@
 import { S3Client, ListBucketsCommand, GetBucketNotificationConfigurationCommand, GetBucketVersioningCommand, GetBucketEncryptionCommand, GetPublicAccessBlockCommand, } from '@aws-sdk/client-s3';
 import { fromIni } from '@aws-sdk/credential-providers';
 import { logger } from '../../core/index.js';
-function validateEndpoint(endpoint) {
-    let url;
-    try {
-        url = new URL(endpoint);
-    }
-    catch {
-        throw new Error(`Invalid aws.endpoint URL: "${endpoint}"`);
-    }
-    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
-        throw new Error(`aws.endpoint must use http:// or https://, got "${url.protocol}//"`);
-    }
-}
 function clientConfig(cfg) {
     const region = cfg.region ?? 'us-east-1';
     const base = { region };
-    if (cfg.endpoint) {
-        validateEndpoint(cfg.endpoint);
-        base.endpoint = cfg.endpoint;
-    }
     if (cfg.profile)
         base.credentials = fromIni({ profile: cfg.profile });
     return base;

package/dist/adapters/aws/services.js

@@ -9,25 +9,9 @@ import { EventBridgeClient, ListRulesCommand, ListTargetsByRuleCommand, } from '
 import { RDSClient, DescribeDBInstancesCommand } from '@aws-sdk/client-rds';
 import { fromIni } from '@aws-sdk/credential-providers';
 import { logger } from '../../core/index.js';
-function validateEndpoint(endpoint) {
-    let url;
-    try {
-        url = new URL(endpoint);
-    }
-    catch {
-        throw new Error(`Invalid aws.endpoint URL: "${endpoint}"`);
-    }
-    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
-        throw new Error(`aws.endpoint must use http:// or https://, got "${url.protocol}//"`);
-    }
-}
 function clientConfig(cfg) {
     const region = cfg.region ?? 'us-east-1';
     const base = { region };
-    if (cfg.endpoint) {
-        validateEndpoint(cfg.endpoint);
-        base.endpoint = cfg.endpoint;
-    }
     if (cfg.profile)
         base.credentials = fromIni({ profile: cfg.profile });
     return base;

package/dist/cli/commands/analyze.js

@@ -63,7 +63,6 @@ export async function runAnalyze(options = {}) {
     const awsCfg = {
         region: config.aws?.region,
         profile: config.aws?.profile,
-        endpoint: config.aws?.endpoint,
     };
     const dynamoMeta = [];
     const postgresMeta = [];

package/dist/cli/commands/check.js

@@ -0,0 +1,28 @@
+import * as path from 'path';
+import chalk from 'chalk';
+import { readCache, setCacheDir } from '../../core/index.js';
+import { printFinding, log, printHeader } from '../utils.js';
+import { runAnalyze } from './analyze.js';
+const SEVERITY_ORDER = { high: 3, medium: 2, low: 1, verify: 0 };
+export async function runCheck(options = {}) {
+    const failOn = options.failOn ?? 'high';
+    const threshold = SEVERITY_ORDER[failOn] ?? 3;
+    printHeader('Infrawise Check');
+    // Always extract fresh — CI must not gate on a stale graph.
+    await runAnalyze({ config: options.config, repo: options.repo, silent: true });
+    setCacheDir(path.dirname(path.resolve(options.config ?? 'infrawise.yaml')));
+    const findings = readCache('findings') ?? [];
+    const violations = findings.filter((f) => (SEVERITY_ORDER[f.severity] ?? 0) >= threshold);
+    console.log('');
+    if (violations.length === 0) {
+        log.success('Check passed', `no ${failOn}+ findings (${findings.length} total below threshold)`);
+        console.log('');
+        return;
+    }
+    console.log(chalk.bold('  Blocking findings') + chalk.dim(`  ${violations.length} at or above ${failOn}`));
+    violations.forEach((f, i) => printFinding(f, i));
+    console.log('');
+    log.fail(`Check failed`, `${violations.length} ${failOn}+ finding(s) must be resolved before deploy`);
+    console.log('');
+    process.exit(1);
+}

package/dist/cli/commands/discover.js

@@ -0,0 +1,201 @@
+import * as fs from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+import * as yaml from 'js-yaml';
+import chalk from 'chalk';
+import inquirer from 'inquirer';
+import { probePort, scanDotEnv } from '../probe.js';
+import { readAWSProfiles, detectAWSRegion, log } from '../utils.js';
+import { runInit } from '../interactive-setup.js';
+const DB_PORTS = { postgres: 5432, mysql: 3306, mongodb: 27017 };
+const ENV_KEYS = {
+    postgres: ['DATABASE_URL', 'POSTGRES_URL', 'POSTGRESQL_URL', 'POSTGRES_CONNECTION_STRING'],
+    mysql: ['MYSQL_URL', 'MYSQL_CONNECTION_STRING'],
+    mongodb: ['MONGO_URI', 'MONGODB_URI', 'MONGO_URL', 'MONGODB_URL'],
+};
+export async function runDiscover(options = {}) {
+    if (options.interactive) {
+        await runInit();
+        return;
+    }
+    const cwd = process.cwd();
+    log.dim('Probing environment...');
+    const [pgDetected, mysqlDetected, mongoDetected] = await Promise.all([
+        probePort('localhost', DB_PORTS.postgres, 300),
+        probePort('localhost', DB_PORTS.mysql, 300),
+        probePort('localhost', DB_PORTS.mongodb, 300),
+    ]);
+    if (pgDetected)
+        log.success('Postgres detected', `port ${DB_PORTS.postgres}`);
+    if (mysqlDetected)
+        log.success('MySQL detected', `port ${DB_PORTS.mysql}`);
+    if (mongoDetected)
+        log.success('MongoDB detected', `port ${DB_PORTS.mongodb}`);
+    const envVars = scanDotEnv(cwd);
+    const secrets = extractDbSecrets(envVars);
+    const iacDetected = detectIaC(cwd);
+    const hasAWSConfig = process.env.AWS_ACCESS_KEY_ID !== undefined ||
+        fs.existsSync(path.join(os.homedir(), '.aws', 'credentials')) ||
+        fs.existsSync(path.join(os.homedir(), '.aws', 'config'));
+    if (!hasAWSConfig && !pgDetected && !mysqlDetected && !mongoDetected) {
+        console.error(chalk.red('\n  Nothing detected.'));
+        console.error(chalk.dim('  Run `aws configure` to set up AWS credentials, or start a local database.\n'));
+        process.exit(1);
+    }
+    let selectedProfile = '';
+    if (process.env.AWS_PROFILE) {
+        selectedProfile = process.env.AWS_PROFILE;
+        log.success('AWS profile', `${selectedProfile} (from AWS_PROFILE)`);
+    }
+    else {
+        const profiles = readAWSProfiles();
+        if (profiles.length === 1) {
+            selectedProfile = profiles[0];
+            log.success('AWS profile', profiles[0]);
+        }
+        else if (profiles.length > 1) {
+            console.log('');
+            const answer = await inquirer.prompt([
+                {
+                    type: 'select',
+                    name: 'profile',
+                    message: 'Select AWS profile:',
+                    choices: profiles,
+                    default: profiles[0],
+                },
+            ]);
+            selectedProfile = answer.profile;
+        }
+    }
+    const region = detectAWSRegion(selectedProfile);
+    ensureInfrawiseDir(cwd);
+    writeYaml(cwd, {
+        profile: selectedProfile,
+        region,
+        pgDetected,
+        mysqlDetected,
+        mongoDetected,
+        iacDetected,
+    });
+    const anyDbDetected = pgDetected || mysqlDetected || mongoDetected;
+    if (anyDbDetected) {
+        writeSecrets(cwd, secrets);
+    }
+    console.log('');
+    log.success('Generated infrawise.yaml');
+    if (pgDetected && !secrets.postgres) {
+        log.warn('Postgres detected — add connection string to .infrawise/secrets.yaml');
+    }
+    if (mysqlDetected && !secrets.mysql) {
+        log.warn('MySQL detected — add connection string to .infrawise/secrets.yaml');
+    }
+    if (mongoDetected && !secrets.mongodb) {
+        log.warn('MongoDB detected — add connection string to .infrawise/secrets.yaml');
+    }
+    console.log('');
+}
+function extractDbSecrets(env) {
+    const secrets = {};
+    for (const key of ENV_KEYS.postgres) {
+        if (env[key]) {
+            secrets.postgres = env[key];
+            break;
+        }
+    }
+    for (const key of ENV_KEYS.mysql) {
+        if (env[key]) {
+            secrets.mysql = env[key];
+            break;
+        }
+    }
+    for (const key of ENV_KEYS.mongodb) {
+        if (env[key]) {
+            secrets.mongodb = env[key];
+            break;
+        }
+    }
+    return secrets;
+}
+function detectIaC(cwd) {
+    return scanDirForIaC(cwd, 3);
+}
+function scanDirForIaC(dir, depth) {
+    if (depth < 0)
+        return false;
+    try {
+        const entries = fs.readdirSync(dir, { withFileTypes: true });
+        for (const entry of entries) {
+            if (entry.name.startsWith('.') || entry.name === 'node_modules')
+                continue;
+            if (entry.isFile()) {
+                const n = entry.name;
+                if (n.endsWith('.tf') ||
+                    n === 'cdk.json' ||
+                    n === 'template.yaml' ||
+                    n === 'template.yml') {
+                    return true;
+                }
+            }
+            else if (entry.isDirectory() && depth > 0) {
+                if (scanDirForIaC(path.join(dir, entry.name), depth - 1))
+                    return true;
+            }
+        }
+    }
+    catch {
+        // ignore permission errors
+    }
+    return false;
+}
+function ensureInfrawiseDir(cwd) {
+    const infrawiseDir = path.join(cwd, '.infrawise');
+    if (!fs.existsSync(infrawiseDir)) {
+        fs.mkdirSync(infrawiseDir, { recursive: true });
+    }
+    const gitignorePath = path.join(cwd, '.gitignore');
+    const entry = '.infrawise/';
+    if (fs.existsSync(gitignorePath)) {
+        const content = fs.readFileSync(gitignorePath, 'utf-8');
+        if (!content.includes(entry)) {
+            const prefix = content.length > 0 && !content.endsWith('\n') ? '\n' : '';
+            fs.appendFileSync(gitignorePath, `${prefix}${entry}\n`);
+        }
+    }
+    else {
+        fs.writeFileSync(gitignorePath, `${entry}\n`);
+    }
+}
+function writeYaml(cwd, opts) {
+    const config = {
+        project: path.basename(cwd),
+        aws: {
+            profile: opts.profile,
+            region: opts.region,
+        },
+        dynamodb: { enabled: true, includeTables: [] },
+        postgres: { enabled: opts.pgDetected, connectionString: '' },
+        mysql: { enabled: opts.mysqlDetected, connectionString: '' },
+        mongodb: { enabled: opts.mongoDetected, connectionString: '', databases: [] },
+        terraform: { enabled: opts.iacDetected },
+        sqs: { enabled: true },
+        sns: { enabled: true },
+        ssm: { enabled: true, paths: [] },
+        secretsManager: { enabled: true },
+        lambda: { enabled: true },
+        eventbridge: { enabled: true },
+        rds: { enabled: false },
+        s3: { enabled: true },
+        apiGateway: { enabled: true },
+        cloudwatchLogs: { enabled: false, logGroupPrefixes: [], windowHours: 24 },
+        analysis: { sampleSize: 100 },
+    };
+    fs.writeFileSync(path.join(cwd, 'infrawise.yaml'), yaml.dump(config, { lineWidth: 120 }), 'utf-8');
+}
+function writeSecrets(cwd, secrets) {
+    const data = {
+        postgres: { connectionString: secrets.postgres ?? '' },
+        mysql: { connectionString: secrets.mysql ?? '' },
+        mongodb: { connectionString: secrets.mongodb ?? '' },
+    };
+    fs.writeFileSync(path.join(cwd, '.infrawise', 'secrets.yaml'), yaml.dump(data, { lineWidth: 120 }), 'utf-8');
+}

package/dist/cli/commands/doctor.js

@@ -44,7 +44,7 @@ export async function runDoctor(options = {}) {
             name: 'Config file',
             status: exists ? 'pass' : 'fail',
             message: exists ? configPath : `Not found at ${configPath}`,
-            detail: exists ? undefined : 'Run: infrawise init',
+            detail: exists ? undefined : 'Run: infrawise start',
         };
     }));
     // Config valid
@@ -80,7 +80,6 @@ export async function runDoctor(options = {}) {
     const awsCfg = {
         region: config?.aws?.region,
         profile: config?.aws?.profile,
-        endpoint: config?.aws?.endpoint,
     };
     // DynamoDB
     results.push(await runCheck('Testing DynamoDB access...', async () => {

package/dist/cli/commands/serve.js

@@ -0,0 +1,9 @@
+import { runDev } from './dev.js';
+import { runStdio } from './stdio.js';
+export async function runServe(options = {}) {
+    if (options.stdio) {
+        await runStdio(options.config);
+        return;
+    }
+    await runDev({ config: options.config, port: options.port });
+}

package/dist/cli/commands/start.js

@@ -4,7 +4,7 @@ import { spawn } from 'child_process';
 import chalk from 'chalk';
 import { readCache, setCacheDir, formatError, loadConfig } from '../../core/index.js';
 import { log, printHeader } from '../utils.js';
-import { runInit } from './init.js';
+import { runDiscover } from './discover.js';
 import { runAnalyze } from './analyze.js';
 const CACHE_TTL_MS = 24 * 60 * 60 * 1000;
 function writeMcpJson(configAbsPath) {
@@ -12,7 +12,7 @@ function writeMcpJson(configAbsPath) {
         mcpServers: {
             infrawise: {
                 command: 'infrawise',
-                args: ['stdio', '--config', configAbsPath],
+                args: ['serve', '--stdio', '--config', configAbsPath],
             },
         },
     };
@@ -27,7 +27,7 @@ function writeCursorMcp(configAbsPath) {
         mcpServers: {
             infrawise: {
                 command: 'infrawise',
-                args: ['stdio', '--config', configAbsPath],
+                args: ['serve', '--stdio', '--config', configAbsPath],
             },
         },
     };
@@ -54,7 +54,7 @@ function launchEditor(editor) {
             const cmd = editor;
             const args = ['.'];
             console.log('');
-            console.log(chalk.dim('  Opening Cursor...'));
+            console.log(chalk.dim(`  Opening ${cmd}...`));
             const child = spawn(cmd, args, { detached: true, stdio: 'ignore' });
             child.on('error', (err) => {
                 if (err.code === 'ENOENT') {
@@ -71,23 +71,35 @@ export async function runStart(options = {}) {
     const cwd = process.cwd();
     const configPath = options.config ?? 'infrawise.yaml';
     const configAbsPath = path.resolve(cwd, configPath);
-    // Step 1 — create infrawise.yaml if missing
+    // --rediscover: wipe yaml + entire .infrawise dir, then re-run discovery and analysis
+    if (options.rediscover) {
+        if (fs.existsSync(configAbsPath)) {
+            fs.unlinkSync(configAbsPath);
+        }
+        const infrawiseDir = path.join(path.dirname(configAbsPath), '.infrawise');
+        if (fs.existsSync(infrawiseDir)) {
+            fs.rmSync(infrawiseDir, { recursive: true, force: true });
+        }
+        log.warn('Cleared config and .infrawise — rediscovering...');
+        console.log('');
+    }
+    // Generate config if missing
     if (!fs.existsSync(configAbsPath)) {
-        log.warn('No infrawise.yaml found — running setup...');
+        log.warn('No infrawise.yaml found — probing environment...');
         console.log('');
-        await runInit({ quiet: true });
+        await runDiscover({ interactive: options.interactive });
         console.log('');
     }
-    // Validate config is loadable before proceeding
+    // Validate config
     try {
-        loadConfig(configPath);
+        loadConfig(configAbsPath);
     }
     catch (err) {
         console.error(formatError(err));
         process.exit(1);
     }
     setCacheDir(path.dirname(configAbsPath));
-    // Step 2 — check cache with 24h TTL, re-analyze if stale or missing
+    // Check cache, re-analyze if stale
     const cachedGraph = readCache('graph', CACHE_TTL_MS);
     const cachedFindings = readCache('findings', CACHE_TTL_MS);
     if (cachedGraph && cachedFindings) {
@@ -100,12 +112,12 @@ export async function runStart(options = {}) {
         await runAnalyze({ config: options.config, silent: true });
         console.log('');
     }
-    // Step 3 — write editor MCP config files
+    // Write editor MCP config files
     console.log('');
     writeMcpJson(configAbsPath);
     if (options.cursor)
         writeCursorMcp(configAbsPath);
-    // Step 4 — launch editor or print instructions
+    // Launch editor or print instructions
     const editor = options.claude ? 'claude' : options.cursor ? 'cursor' : null;
     if (!editor) {
         console.log('');

package/dist/cli/index.js

@@ -3,10 +3,9 @@ import { readFileSync } from 'fs';
 import { join } from 'path';
 import { Command } from 'commander';
 import { printBanner } from './utils.js';
-import { runInit } from './commands/init.js';
-import { runAuth } from './commands/auth.js';
 import { runAnalyze } from './commands/analyze.js';
-import { runDev } from './commands/dev.js';
+import { runCheck } from './commands/check.js';
+import { runServe } from './commands/serve.js';
 import { runDoctor } from './commands/doctor.js';
 import { runStdio } from './commands/stdio.js';
 import { runStart } from './commands/start.js';
@@ -18,33 +17,22 @@ program
     .version(version);
 program
     .command('start')
-    .description('Set up infrawise and connect your editor — runs init + analyze + writes editor MCP config')
+    .description('Probe environment, generate config, analyze, and connect your editor')
     .option('-c, --config <path>', 'Path to infrawise.yaml', 'infrawise.yaml')
     .option('--claude', 'Write .mcp.json and open Claude Code')
     .option('--cursor', 'Write .cursor/mcp.json and open Cursor')
+    .option('--interactive', 'Run interactive setup wizard instead of auto-discovery')
+    .option('--rediscover', 'Delete existing infrawise.yaml and re-probe the environment')
     .action(async (options) => {
     printBanner();
     await runStart({
         config: options.config !== 'infrawise.yaml' ? options.config : undefined,
         claude: options.claude,
         cursor: options.cursor,
+        interactive: options.interactive,
+        rediscover: options.rediscover,
     });
 });
-program
-    .command('init')
-    .description('Detect AWS profile/region, ask setup questions, and generate infrawise.yaml')
-    .option('--force', 'Overwrite existing infrawise.yaml')
-    .action(async (options) => {
-    printBanner();
-    await runInit({ force: options.force });
-});
-program
-    .command('auth')
-    .description('Validate and select AWS profile from ~/.aws/credentials')
-    .action(async () => {
-    printBanner();
-    await runAuth();
-});
 program
     .command('analyze')
     .description('Load config, run extractors, build graph, and run all analyzers')
@@ -64,27 +52,45 @@ program
     });
 });
 program
-    .command('dev')
-    .description('Start MCP server over HTTP at localhost:3000 (alternative to stdio-based start)')
+    .command('check')
+    .description('CI gate: analyze and exit non-zero if findings reach the threshold severity')
     .option('-c, --config <path>', 'Path to infrawise.yaml', 'infrawise.yaml')
-    .option('-p, --port <number>', 'Port to listen on', '3000')
+    .option('-r, --repo <path>', 'Path to repository to scan', process.cwd())
+    .option('--fail-on <level>', 'Severity that fails the build: high | medium | low', 'high')
     .action(async (options) => {
     printBanner();
-    await runDev({
+    await runCheck({
+        config: options.config !== 'infrawise.yaml' ? options.config : undefined,
+        repo: options.repo,
+        failOn: options.failOn,
+    });
+});
+program
+    .command('serve')
+    .description('Start the MCP server — HTTP by default, or stdio for editor integration')
+    .option('-c, --config <path>', 'Path to infrawise.yaml', 'infrawise.yaml')
+    .option('--stdio', 'Use stdio transport (for editors via .mcp.json) instead of HTTP')
+    .option('-p, --port <number>', 'Port to listen on (HTTP only)', '3000')
+    .action(async (options) => {
+    if (!options.stdio)
+        printBanner();
+    await runServe({
         config: options.config !== 'infrawise.yaml' ? options.config : undefined,
+        stdio: options.stdio,
         port: parseInt(options.port, 10),
     });
 });
+// Hidden backcompat alias: editors launched from a .mcp.json generated before
+// `serve` existed still invoke `infrawise stdio`. Kept out of --help.
 program
-    .command('stdio')
-    .description('Start MCP server on stdio transport — used by editors via .mcp.json (auto-managed)')
+    .command('stdio', { hidden: true })
     .option('-c, --config <path>', 'Path to infrawise.yaml', 'infrawise.yaml')
     .action(async (options) => {
     await runStdio(options.config !== 'infrawise.yaml' ? options.config : undefined);
 });
 program
     .command('doctor')
-    .description('Validate AWS access, postgres connectivity, config, and repo scan')
+    .description('Diagnostic escape hatch: validate AWS/DB access, config, and repo scan')
     .option('-c, --config <path>', 'Path to infrawise.yaml', 'infrawise.yaml')
     .action(async (options) => {
     printBanner();

package/dist/cli/{commands/init.js → interactive-setup.js}

@@ -2,8 +2,8 @@ import * as fs from 'fs';
 import * as path from 'path';
 import chalk from 'chalk';
 import inquirer from 'inquirer';
-import { generateDefaultConfig } from '../../core/index.js';
-import { readAWSProfiles, detectAWSRegion, detectRepoType, log, printHeader } from '../utils.js';
+import { generateDefaultConfig } from '../core/index.js';
+import { readAWSProfiles, detectAWSRegion, log, printHeader } from './utils.js';
 export async function runInit(options = {}) {
     const cwd = process.cwd();
     const configPath = path.join(cwd, 'infrawise.yaml');
@@ -12,12 +12,10 @@ export async function runInit(options = {}) {
         return;
     }
     printHeader('Initialize Infrawise');
-    const repoType = detectRepoType(cwd);
     const repoName = path.basename(cwd);
     const profiles = readAWSProfiles();
     const detectedRegion = detectAWSRegion();
     log.success(`Repository detected`, repoName);
-    log.success(`Type`, repoType);
     log.success(`AWS profiles found`, String(profiles.length));
     console.log('');
     // ── Core settings ──────────────────────────────────────────────────────────
@@ -37,7 +35,6 @@ export async function runInit(options = {}) {
             message: 'Infrastructure:',
             choices: [
                 { name: 'AWS', value: 'aws' },
-                { name: 'LocalStack  (mimics AWS locally)', value: 'localstack' },
                 { name: 'Local  (no cloud — databases, queues, self-hosted services)', value: 'local' },
             ],
         },
@@ -59,12 +56,8 @@ export async function runInit(options = {}) {
         ]);
         awsProfile = answer.awsProfile;
     }
-    else if (provider === 'localstack') {
-        awsProfile = '__localstack__';
-    }
-    // ── Step 3: region + endpoint ─────────────────────────────────────────────
+    // ── Step 3: region ────────────────────────────────────────────────────────
     let region = detectedRegion;
-    let endpoint;
     if (provider !== 'local') {
         const regionAnswer = await inquirer.prompt([
             {
@@ -75,19 +68,8 @@ export async function runInit(options = {}) {
             },
         ]);
         region = regionAnswer.region;
-        if (provider === 'localstack') {
-            const endpointAnswer = await inquirer.prompt([
-                {
-                    type: 'input',
-                    name: 'endpoint',
-                    message: 'LocalStack endpoint:',
-                    default: 'http://localhost:4566',
-                },
-            ]);
-            endpoint = endpointAnswer.endpoint;
-        }
     }
-    const core = { project, awsProfile, region, endpoint };
+    const core = { project, awsProfile, region };
     // ── Databases ──────────────────────────────────────────────────────────────
     console.log('\n  ' + chalk.bold('Databases'));
     console.log(chalk.dim('  Self-hosted databases (PostgreSQL, MySQL, MongoDB).'));
@@ -253,15 +235,12 @@ export async function runInit(options = {}) {
             .map((p) => p.trim())
             .filter(Boolean)
         : [];
-    const isLocalStack = core.awsProfile === '__localstack__';
     const isEnvVars = core.awsProfile === '__env__';
-    const resolvedProfile = isLocalStack || isEnvVars ? '' : core.awsProfile;
-    const resolvedEndpoint = isLocalStack ? (core.endpoint ?? 'http://localhost:4566') : undefined;
+    const resolvedProfile = isEnvVars ? '' : core.awsProfile;
     const configContent = generateDefaultConfig(core.project, {
         aws: {
             profile: resolvedProfile,
             region: core.region ?? detectedRegion,
-            endpoint: resolvedEndpoint,
         },
         dynamodb: { enabled: services.dynamoEnabled, includeTables },
         postgres: {
@@ -296,7 +275,7 @@ export async function runInit(options = {}) {
         console.log('');
         console.log(chalk.bold('  Next steps:'));
         log.info(`Run ${chalk.cyan('infrawise start')} to analyze and connect your editor`);
-        log.info(`Run ${chalk.cyan('infrawise doctor')} to validate your setup`);
+        log.info(`Run ${chalk.cyan('infrawise doctor')} if extraction comes up empty`);
         console.log('');
     }
 }

package/dist/cli/probe.js

@@ -0,0 +1,44 @@
+import * as net from 'net';
+import * as fs from 'fs';
+import * as path from 'path';
+export function probePort(host, port, timeoutMs = 300) {
+    return new Promise((resolve) => {
+        const socket = new net.Socket();
+        const cleanup = (result) => {
+            socket.destroy();
+            resolve(result);
+        };
+        socket.setTimeout(timeoutMs);
+        socket.on('connect', () => cleanup(true));
+        socket.on('timeout', () => cleanup(false));
+        socket.on('error', () => cleanup(false));
+        socket.connect(port, host);
+    });
+}
+export function scanDotEnv(cwd) {
+    const envPath = path.join(cwd, '.env');
+    if (!fs.existsSync(envPath))
+        return {};
+    const result = {};
+    try {
+        const lines = fs.readFileSync(envPath, 'utf-8').split('\n');
+        for (const line of lines) {
+            const trimmed = line.trim();
+            if (!trimmed || trimmed.startsWith('#'))
+                continue;
+            const eqIdx = trimmed.indexOf('=');
+            if (eqIdx === -1)
+                continue;
+            const key = trimmed.slice(0, eqIdx).trim();
+            const value = trimmed
+                .slice(eqIdx + 1)
+                .trim()
+                .replace(/^["']|["']$/g, '');
+            result[key] = value;
+        }
+    }
+    catch {
+        // silent — non-critical
+    }
+    return result;
+}

package/dist/cli/utils.js

@@ -1,49 +1,40 @@
 import * as fs from 'fs';
 import * as path from 'path';
-import * as os from 'os';
+import { execSync } from 'child_process';
 import chalk from 'chalk';
 // ─── AWS helpers ─────────────────────────────────────────────────────────────
 export function readAWSProfiles() {
-    const credentialsPath = path.join(os.homedir(), '.aws', 'credentials');
-    const configPath = path.join(os.homedir(), '.aws', 'config');
-    const profiles = new Set();
-    function parseFile(filePath) {
-        if (!fs.existsSync(filePath))
-            return;
-        for (const line of fs.readFileSync(filePath, 'utf-8').split('\n')) {
-            const match = line.match(/^\[(.+)\]$/);
-            if (match?.[1]) {
-                let name = match[1];
-                if (name.startsWith('profile '))
-                    name = name.slice(8);
-                profiles.add(name);
-            }
-        }
+    try {
+        const out = execSync('aws configure list-profiles', {
+            encoding: 'utf-8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        const profiles = out.trim().split('\n').filter(Boolean);
+        return profiles.length > 0 ? profiles : ['default'];
+    }
+    catch {
+        return ['default'];
     }
-    parseFile(credentialsPath);
-    parseFile(configPath);
-    return profiles.size > 0 ? [...profiles] : ['default'];
 }
-export function detectAWSRegion() {
+export function detectAWSRegion(profile) {
     if (process.env.AWS_DEFAULT_REGION)
         return process.env.AWS_DEFAULT_REGION;
     if (process.env.AWS_REGION)
         return process.env.AWS_REGION;
-    const configPath = path.join(os.homedir(), '.aws', 'config');
-    if (fs.existsSync(configPath)) {
-        const match = fs.readFileSync(configPath, 'utf-8').match(/region\s*=\s*(.+)/);
-        if (match?.[1])
-            return match[1].trim();
+    const target = profile ?? process.env.AWS_PROFILE ?? 'default';
+    try {
+        const region = execSync(`aws configure get region --profile ${target}`, {
+            encoding: 'utf-8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        }).trim();
+        if (region)
+            return region;
+    }
+    catch {
+        // profile may not have region configured
     }
     return 'us-east-1';
 }
-export function detectRepoType(repoPath) {
-    if (fs.existsSync(path.join(repoPath, 'tsconfig.json')))
-        return 'typescript';
-    if (fs.existsSync(path.join(repoPath, 'package.json')))
-        return 'javascript';
-    return 'unknown';
-}
 // ─── Banner ──────────────────────────────────────────────────────────────────
 function readVersion() {
     try {

package/dist/core/config.js

@@ -8,7 +8,6 @@ export const InfrawiseConfigSchema = z.object({
         .object({
         profile: z.string().optional().default(''),
         region: z.string().optional().default('us-east-1'),
-        endpoint: z.string().optional(),
     })
         .optional()
         .default({ profile: 'default', region: 'us-east-1' }),
@@ -56,7 +55,6 @@ export const InfrawiseConfigSchema = z.object({
     eventbridge: z.object({ enabled: z.boolean().optional().default(true) }).optional(),
     rds: z.object({ enabled: z.boolean().optional().default(false) }).optional(),
     s3: z.object({ enabled: z.boolean().optional().default(false) }).optional(),
-    kafka: z.object({ enabled: z.boolean().optional().default(false) }).optional(),
     apiGateway: z.object({ enabled: z.boolean().optional().default(false) }).optional(),
     cloudwatchLogs: z
         .object({
@@ -84,13 +82,32 @@ export class ConfigError extends Error {
         this.name = 'ConfigError';
     }
 }
+const SecretsSchema = z.object({
+    postgres: z.object({ connectionString: z.string() }).optional(),
+    mysql: z.object({ connectionString: z.string() }).optional(),
+    mongodb: z.object({ connectionString: z.string() }).optional(),
+});
+export function loadSecrets(configDir) {
+    const secretsPath = path.join(configDir, '.infrawise', 'secrets.yaml');
+    if (!fs.existsSync(secretsPath))
+        return {};
+    try {
+        const raw = fs.readFileSync(secretsPath, 'utf-8');
+        const parsed = yaml.load(raw);
+        const result = SecretsSchema.safeParse(parsed);
+        return result.success ? result.data : {};
+    }
+    catch {
+        return {};
+    }
+}
 export function loadConfig(configPath) {
     const resolvedPath = configPath
         ? path.resolve(configPath)
         : path.resolve(process.cwd(), 'infrawise.yaml');
     if (!fs.existsSync(resolvedPath)) {
         throw new ConfigError(`Configuration file not found at: ${resolvedPath}`, [
-            'Run `infrawise init` to generate a configuration file',
+            'Run `infrawise start` to generate a configuration file',
             `Or specify a path with --config <path>`,
         ]);
     }
@@ -118,7 +135,19 @@ export function loadConfig(configPath) {
         const details = result.error.issues.map((e) => `  - ${e.path.join('.')}: ${e.message}`);
         throw new ConfigError('Configuration validation failed', details);
     }
-    return result.data;
+    const config = result.data;
+    const configDir = path.dirname(resolvedPath);
+    const secrets = loadSecrets(configDir);
+    if (secrets.postgres?.connectionString && config.postgres) {
+        config.postgres.connectionString = secrets.postgres.connectionString;
+    }
+    if (secrets.mysql?.connectionString && config.mysql) {
+        config.mysql.connectionString = secrets.mysql.connectionString;
+    }
+    if (secrets.mongodb?.connectionString && config.mongodb) {
+        config.mongodb.connectionString = secrets.mongodb.connectionString;
+    }
+    return config;
 }
 export function generateDefaultConfig(projectName, options) {
     const config = {
@@ -126,7 +155,6 @@ export function generateDefaultConfig(projectName, options) {
         aws: {
             profile: options?.aws?.profile ?? '',
             region: options?.aws?.region ?? 'us-east-1',
-            ...(options?.aws?.endpoint ? { endpoint: options.aws.endpoint } : {}),
         },
         dynamodb: {
             enabled: options?.dynamodb?.enabled ?? true,

package/dist/core/errors.js

@@ -72,7 +72,7 @@ export class ConfigError extends InfrawiseError {
             'infrawise.yaml not found in current directory',
             'Missing required fields in configuration',
             details ?? 'Unexpected config error',
-        ], 'infrawise init');
+        ], 'infrawise start');
         this.name = 'ConfigError';
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "infrawise",
-  "version": "0.11.0",
+  "version": "0.12.1",
   "mcpName": "io.github.Sidd27/infrawise",
   "description": "CLI-first infrastructure intelligence platform — analyzes DynamoDB, PostgreSQL, MySQL, MongoDB, SQS, SNS, SSM, Secrets Manager, Lambda, S3, API Gateway, CloudWatch Logs and exposes findings as an MCP server for Claude Code",
   "keywords": [
@@ -65,12 +65,12 @@
     "build-arch": "node scripts/build-arch.mjs",
     "generate-diagrams": "node scripts/build-arch.mjs",
     "record": "bash docs/demo/record.sh",
-    "dev": "node dist/cli/index.js dev",
+    "dev": "node dist/cli/index.js serve",
     "release": "node scripts/release.js",
     "prepare": "simple-git-hooks"
   },
   "simple-git-hooks": {
-    "pre-commit": "pnpm format && git add src/ && pnpm lint && pnpm typecheck && pnpm test"
+    "pre-commit": "pnpm format && git add $(git diff --cached --name-only --diff-filter=ACMR) && pnpm lint && pnpm typecheck && pnpm test"
   },
   "dependencies": {
     "@aws-sdk/client-api-gateway": "^3.1068.0",
@@ -103,20 +103,16 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@mermaid-js/mermaid-cli": "^11.15.0",
-    "@types/inquirer": "^9.0.9",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^25.8.0",
     "@types/pg": "^8.11.0",
     "@typescript-eslint/eslint-plugin": "^8.59.3",
     "@typescript-eslint/parser": "^8.59.3",
     "@vitest/coverage-v8": "^4.1.6",
-    "@xmldom/xmldom": "^0.9.10",
     "eslint": "^10.4.0",
     "prettier": "^3.8.3",
     "simple-git-hooks": "^2.13.1",
     "typescript": "^6.0.3",
-    "vite": "^8.0.13",
     "vitest": "^4.1.6"
   },
   "files": [

package/dist/cli/commands/auth.js

@@ -1,54 +0,0 @@
-import chalk from 'chalk';
-import inquirer from 'inquirer';
-import ora from 'ora';
-import { readAWSProfiles, log, printHeader } from '../utils.js';
-import { validateDynamoAccess } from '../../adapters/aws/dynamodb.js';
-export async function runAuth() {
-    printHeader('AWS Authentication');
-    const profiles = readAWSProfiles();
-    if (profiles.length === 0) {
-        log.fail('No AWS profiles found');
-        console.log('');
-        log.info('Run ' + chalk.cyan('aws configure') + ' to set up credentials');
-        log.info('Or manually edit ' + chalk.dim('~/.aws/credentials'));
-        console.log('');
-        return;
-    }
-    log.success(`Found ${profiles.length} profile(s)`);
-    console.log('');
-    const { selectedProfile } = await inquirer.prompt([
-        {
-            type: 'list',
-            name: 'selectedProfile',
-            message: 'Select a profile to validate:',
-            choices: profiles,
-        },
-    ]);
-    console.log('');
-    const spin = ora({
-        text: chalk.dim(`Validating "${selectedProfile}"...`),
-        color: 'cyan',
-    }).start();
-    const testConfig = {
-        project: 'auth-test',
-        aws: { profile: selectedProfile, region: 'us-east-1' },
-    };
-    const isValid = await validateDynamoAccess(testConfig);
-    if (isValid) {
-        spin.succeed(chalk.green(`Profile "${chalk.bold(selectedProfile)}" is valid`));
-        console.log('');
-        console.log(chalk.dim('  Update your infrawise.yaml:'));
-        console.log(chalk.cyan(`  aws:\n    profile: ${selectedProfile}`));
-    }
-    else {
-        spin.fail(chalk.red(`Profile "${chalk.bold(selectedProfile)}" cannot access DynamoDB`));
-        console.log('');
-        log.warn('Possible causes:');
-        log.dim('Missing IAM permissions — need dynamodb:ListTables, dynamodb:DescribeTable');
-        log.dim('Expired SSO — run: aws sso login');
-        log.dim('Wrong region — check your AWS config');
-        console.log('');
-        log.info(`Run ${chalk.cyan('infrawise doctor')} for a full diagnostic`);
-    }
-    console.log('');
-}