infrawise 0.8.2 → 0.8.7

package/README.md

@@ -404,53 +404,7 @@ Infrawise does not use an LLM to analyze your infrastructure. All extraction and
 
 ## Architecture overview
 
-```mermaid
-flowchart LR
-    subgraph IN["Your Infrastructure & Code"]
-        direction TB
-        D["DynamoDB"]
-        L["Lambda · SQS · SNS\nEventBridge · RDS"]
-        S["Secrets Manager · SSM\nCloudWatch"]
-        P["PostgreSQL · MySQL"]
-        M["MongoDB"]
-        T["Terraform · CDK\nCloudFormation"]
-        C["TypeScript / JS"]
-    end
-
-    A["Adapters"]
-    G["Graph Engine"]
-    AN["23 Analyzers"]
-    CA["Cache"]
-
-    subgraph SV["infrawise dev"]
-        MCP["MCP Server\nlocalhost:3000/mcp"]
-    end
-
-    subgraph AI["AI Coding Assistants"]
-        direction TB
-        CC["Claude Code"]
-        CU["Cursor"]
-        WS["Windsurf"]
-    end
-
-    D & L & S & P & M & T & C --> A
-    A --> G --> AN --> CA --> MCP
-    MCP --> CC & CU & WS
-
-    classDef aws fill:#FF9900,stroke:#232F3E,color:#000
-    classDef db fill:#336791,stroke:#1a3a5c,color:#fff
-    classDef iac fill:#7B42BC,stroke:#4a2080,color:#fff
-    classDef code fill:#3178C6,stroke:#1a4a80,color:#fff
-    classDef iw fill:#1a1a2e,stroke:#e94560,color:#fff
-    classDef ai fill:#10a37f,stroke:#0a6b54,color:#fff
-
-    class D,L,S aws
-    class P,M db
-    class T iac
-    class C code
-    class A,G,AN,CA,MCP iw
-    class CC,CU,WS ai
-```
+![Architecture](./docs/architecture.svg)
 
 ### Source layout
 

package/dist/adapters/aws/logs.js

@@ -43,7 +43,9 @@ export async function extractLogsMetadata(cfg = {}) {
     // Discover log groups
     const logGroups = [];
     try {
-        const prefixes = cfg.logGroupPrefixes?.length ? cfg.logGroupPrefixes : [undefined];
+        const prefixes = cfg.logGroupPrefixes?.length
+            ? cfg.logGroupPrefixes
+            : [undefined];
         for (const prefix of prefixes) {
             let nextToken;
             do {

package/dist/adapters/aws/s3.js

@@ -1,11 +1,25 @@
 import { S3Client, ListBucketsCommand, GetBucketNotificationConfigurationCommand, GetBucketVersioningCommand, GetBucketEncryptionCommand, GetPublicAccessBlockCommand, } from '@aws-sdk/client-s3';
 import { fromIni } from '@aws-sdk/credential-providers';
 import { logger } from '../../core/index.js';
+function validateEndpoint(endpoint) {
+    let url;
+    try {
+        url = new URL(endpoint);
+    }
+    catch {
+        throw new Error(`Invalid aws.endpoint URL: "${endpoint}"`);
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        throw new Error(`aws.endpoint must use http:// or https://, got "${url.protocol}//"`);
+    }
+}
 function clientConfig(cfg) {
     const region = cfg.region ?? 'us-east-1';
     const base = { region };
-    if (cfg.endpoint)
+    if (cfg.endpoint) {
+        validateEndpoint(cfg.endpoint);
         base.endpoint = cfg.endpoint;
+    }
     if (cfg.profile)
         base.credentials = fromIni({ profile: cfg.profile });
     return base;
@@ -48,18 +62,34 @@ export async function extractS3Metadata(cfg = {}) {
                     notifications.push(notification);
                 }
             }
-            const versioned = versionResult.status === 'fulfilled'
-                ? versionResult.value.Status === 'Enabled'
-                : false;
+            const versioned = versionResult.status === 'fulfilled' ? versionResult.value.Status === 'Enabled' : false;
             const encrypted = encryptResult.status === 'fulfilled'
                 ? (encryptResult.value.ServerSideEncryptionConfiguration?.Rules?.length ?? 0) > 0
                 : false;
-            let publicAccessBlocked = false;
+            let publicAccessBlocked = null;
             if (pabResult.status === 'fulfilled') {
                 const pab = pabResult.value.PublicAccessBlockConfiguration ?? {};
-                publicAccessBlocked = !!(pab.BlockPublicAcls && pab.IgnorePublicAcls && pab.BlockPublicPolicy && pab.RestrictPublicBuckets);
+                publicAccessBlocked = !!(pab.BlockPublicAcls &&
+                    pab.IgnorePublicAcls &&
+                    pab.BlockPublicPolicy &&
+                    pab.RestrictPublicBuckets);
+            }
+            else {
+                const httpStatus = pabResult.reason
+                    ?.$metadata?.httpStatusCode;
+                if (httpStatus !== 403)
+                    publicAccessBlocked = false;
+                // 403 AccessDenied: leave as null — insufficient permissions, not a public access finding
             }
-            buckets.push({ name, arn, createdAt, versioned, encrypted, publicAccessBlocked, notifications });
+            buckets.push({
+                name,
+                arn,
+                createdAt,
+                versioned,
+                encrypted,
+                publicAccessBlocked,
+                notifications,
+            });
         }
     }
     catch (err) {

package/dist/adapters/aws/services.js

@@ -1,17 +1,31 @@
-import { SQSClient, ListQueuesCommand, GetQueueAttributesCommand, } from '@aws-sdk/client-sqs';
+import { SQSClient, ListQueuesCommand, GetQueueAttributesCommand } from '@aws-sdk/client-sqs';
 import { SNSClient, ListTopicsCommand, GetTopicAttributesCommand, ListSubscriptionsByTopicCommand, } from '@aws-sdk/client-sns';
-import { SSMClient, DescribeParametersCommand, } from '@aws-sdk/client-ssm';
-import { SecretsManagerClient, ListSecretsCommand, } from '@aws-sdk/client-secrets-manager';
+import { SSMClient, DescribeParametersCommand } from '@aws-sdk/client-ssm';
+import { SecretsManagerClient, ListSecretsCommand } from '@aws-sdk/client-secrets-manager';
 import { LambdaClient, ListFunctionsCommand, ListEventSourceMappingsCommand, } from '@aws-sdk/client-lambda';
 import { EventBridgeClient, ListRulesCommand, ListTargetsByRuleCommand, } from '@aws-sdk/client-eventbridge';
-import { RDSClient, DescribeDBInstancesCommand, } from '@aws-sdk/client-rds';
+import { RDSClient, DescribeDBInstancesCommand } from '@aws-sdk/client-rds';
 import { fromIni } from '@aws-sdk/credential-providers';
 import { logger } from '../../core/index.js';
+function validateEndpoint(endpoint) {
+    let url;
+    try {
+        url = new URL(endpoint);
+    }
+    catch {
+        throw new Error(`Invalid aws.endpoint URL: "${endpoint}"`);
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        throw new Error(`aws.endpoint must use http:// or https://, got "${url.protocol}//"`);
+    }
+}
 function clientConfig(cfg) {
     const region = cfg.region ?? 'us-east-1';
     const base = { region };
-    if (cfg.endpoint)
+    if (cfg.endpoint) {
+        validateEndpoint(cfg.endpoint);
         base.endpoint = cfg.endpoint;
+    }
     if (cfg.profile)
         base.credentials = fromIni({ profile: cfg.profile });
     return base;
@@ -33,9 +47,14 @@ export async function extractSQSMetadata(cfg = {}) {
                 const attrs = await client.send(new GetQueueAttributesCommand({
                     QueueUrl: url,
                     AttributeNames: [
-                        'QueueArn', 'VisibilityTimeout', 'MessageRetentionPeriod',
-                        'RedrivePolicy', 'KmsMasterKeyId', 'SqsManagedSseEnabled',
-                        'ApproximateNumberOfMessages', 'ApproximateNumberOfMessagesNotVisible',
+                        'QueueArn',
+                        'VisibilityTimeout',
+                        'MessageRetentionPeriod',
+                        'RedrivePolicy',
+                        'KmsMasterKeyId',
+                        'SqsManagedSseEnabled',
+                        'ApproximateNumberOfMessages',
+                        'ApproximateNumberOfMessagesNotVisible',
                     ],
                 }));
                 const a = attrs.Attributes ?? {};
@@ -293,7 +312,7 @@ export async function extractLambdaMetadata(cfg = {}, includeFunctions) {
                 });
             }
             marker = res.NextMarker;
-        } while (marker && functions.length < 200);
+        } while (marker);
         // Fetch all event source mappings in one paginated call and attach to functions
         const triggerMap = await fetchAllEventSourceMappings(cfg);
         for (const fn of functions) {

package/dist/adapters/db/mongodb.js

@@ -1,12 +1,15 @@
 import { MongoClient } from 'mongodb';
 import { InfrawiseError, logger } from '../../core/index.js';
 const SYSTEM_DATABASES = new Set(['admin', 'local', 'config']);
+function sanitizeConnectionDetail(s) {
+    return s.replace(/\/\/[^:/@]+:[^@]+@/g, '//***:***@');
+}
 export class MongoConnectionError extends InfrawiseError {
     constructor(details) {
         super('Unable to connect to MongoDB.\n\nPossible reasons:\n- invalid connection string\n- port 27017 not accessible\n- wrong credentials\n\nRun: infrawise doctor', undefined, undefined);
         this.name = 'MongoConnectionError';
         if (details) {
-            this.message = `Unable to connect to MongoDB.\n\nPossible reasons:\n- invalid connection string\n- port 27017 not accessible\n- wrong credentials\n\nRun: infrawise doctor\n\nDetail: ${details}`;
+            this.message = `Unable to connect to MongoDB.\n\nPossible reasons:\n- invalid connection string\n- port 27017 not accessible\n- wrong credentials\n\nRun: infrawise doctor\n\nDetail: ${sanitizeConnectionDetail(details)}`;
         }
     }
 }
@@ -25,9 +28,7 @@ export async function extractMongoMetadata(connectionString, databases) {
         else {
             const adminDb = client.db('admin');
             const dbList = await adminDb.admin().listDatabases();
-            dbNames = dbList.databases
-                .map((d) => d.name)
-                .filter((name) => !SYSTEM_DATABASES.has(name));
+            dbNames = dbList.databases.map((d) => d.name).filter((name) => !SYSTEM_DATABASES.has(name));
         }
         logger.debug(`Introspecting ${dbNames.length} MongoDB database(s)`);
         const results = [];

package/dist/adapters/db/mysql.js

@@ -1,12 +1,15 @@
 import mysql from 'mysql2/promise';
 import { InfrawiseError, logger } from '../../core/index.js';
 const SYSTEM_SCHEMAS = new Set(['information_schema', 'performance_schema', 'mysql', 'sys']);
+function sanitizeConnectionDetail(s) {
+    return s.replace(/\/\/[^:/@]+:[^@]+@/g, '//***:***@');
+}
 export class MySQLConnectionError extends InfrawiseError {
     constructor(details) {
         super('Unable to connect to MySQL.\n\nPossible reasons:\n- invalid connection string\n- port 3306 not accessible\n- wrong credentials\n\nRun: infrawise doctor', undefined, undefined);
         this.name = 'MySQLConnectionError';
         if (details) {
-            this.message = `Unable to connect to MySQL.\n\nPossible reasons:\n- invalid connection string\n- port 3306 not accessible\n- wrong credentials\n\nRun: infrawise doctor\n\nDetail: ${details}`;
+            this.message = `Unable to connect to MySQL.\n\nPossible reasons:\n- invalid connection string\n- port 3306 not accessible\n- wrong credentials\n\nRun: infrawise doctor\n\nDetail: ${sanitizeConnectionDetail(details)}`;
         }
     }
 }

package/dist/adapters/iac/terraform.js

@@ -96,7 +96,8 @@ export async function extractTerraformSchema(repoPath) {
                         partitionKey: tfStr(body, 'hash_key'),
                         sortKey: tfStr(body, 'range_key'),
                         gsiNames: tfGSINames(body),
-                        source: 'terraform', filePath,
+                        source: 'terraform',
+                        filePath,
                     });
                     break;
                 case 'aws_db_instance':
@@ -104,13 +105,15 @@ export async function extractTerraformSchema(repoPath) {
                     schema.rdsInstances.push({
                         identifier: tfStr(body, 'identifier') ?? tfStr(body, 'cluster_identifier') ?? resourceName,
                         engine: tfStr(body, 'engine') ?? 'unknown',
-                        source: 'terraform', filePath,
+                        source: 'terraform',
+                        filePath,
                     });
                     break;
                 case 'aws_docdb_cluster':
                     schema.mongoClusters.push({
                         identifier: tfStr(body, 'cluster_identifier') ?? resourceName,
-                        source: 'terraform', filePath,
+                        source: 'terraform',
+                        filePath,
                     });
                     break;
                 case 'aws_sqs_queue': {
@@ -124,41 +127,47 @@ export async function extractTerraformSchema(repoPath) {
                     schema.topics.push({
                         name: tfStr(body, 'name') ?? resourceName,
                         encrypted: body.includes('kms_master_key_id'),
-                        source: 'terraform', filePath,
+                        source: 'terraform',
+                        filePath,
                     });
                     break;
                 case 'aws_lambda_function':
                     schema.lambdas.push({
                         name: tfStr(body, 'function_name') ?? resourceName,
                         runtime: tfStr(body, 'runtime'),
-                        source: 'terraform', filePath,
+                        source: 'terraform',
+                        filePath,
                     });
                     break;
                 case 'aws_s3_bucket':
                     schema.buckets.push({
                         name: tfStr(body, 'bucket') ?? tfStr(body, 'bucket_prefix') ?? resourceName,
                         versioned: body.includes('versioning') && body.includes('enabled = true'),
-                        source: 'terraform', filePath,
+                        source: 'terraform',
+                        filePath,
                     });
                     break;
                 case 'aws_ssm_parameter':
                     schema.parameters.push({
                         name: tfStr(body, 'name') ?? resourceName,
                         type: tfStr(body, 'type') ?? 'String',
-                        source: 'terraform', filePath,
+                        source: 'terraform',
+                        filePath,
                     });
                     break;
                 case 'aws_secretsmanager_secret':
                     schema.secrets.push({
                         name: tfStr(body, 'name') ?? resourceName,
-                        source: 'terraform', filePath,
+                        source: 'terraform',
+                        filePath,
                     });
                     break;
                 case 'aws_api_gateway_rest_api':
                 case 'aws_apigatewayv2_api':
                     schema.apiGateways.push({
                         name: tfStr(body, 'name') ?? resourceName,
-                        source: 'terraform', filePath,
+                        source: 'terraform',
+                        filePath,
                     });
                     break;
             }
@@ -171,7 +180,8 @@ function isCloudFormationTemplate(parsed) {
     if (typeof parsed !== 'object' || parsed === null)
         return false;
     const obj = parsed;
-    return 'AWSTemplateFormatVersion' in obj || ('Resources' in obj && typeof obj['Resources'] === 'object');
+    return ('AWSTemplateFormatVersion' in obj ||
+        ('Resources' in obj && typeof obj['Resources'] === 'object'));
 }
 function parseCFNFile(filePath) {
     let content;
@@ -242,7 +252,8 @@ function processCFNResources(resources, schema, filePath, source) {
                     partitionKey: pk,
                     sortKey: sk,
                     gsiNames,
-                    source, filePath,
+                    source,
+                    filePath,
                 });
                 break;
             }
@@ -250,20 +261,23 @@ function processCFNResources(resources, schema, filePath, source) {
                 schema.rdsInstances.push({
                     identifier: cfnStr(props, 'DBInstanceIdentifier') ?? logicalId,
                     engine: cfnStr(props, 'Engine') ?? 'unknown',
-                    source, filePath,
+                    source,
+                    filePath,
                 });
                 break;
             case 'AWS::RDS::DBCluster':
                 schema.rdsInstances.push({
                     identifier: cfnStr(props, 'DBClusterIdentifier') ?? logicalId,
                     engine: cfnStr(props, 'Engine') ?? 'aurora',
-                    source, filePath,
+                    source,
+                    filePath,
                 });
                 break;
             case 'AWS::DocDB::DBCluster':
                 schema.mongoClusters.push({
                     identifier: cfnStr(props, 'DBClusterIdentifier') ?? logicalId,
-                    source, filePath,
+                    source,
+                    filePath,
                 });
                 break;
             case 'AWS::SQS::Queue': {
@@ -277,14 +291,16 @@ function processCFNResources(resources, schema, filePath, source) {
                 schema.topics.push({
                     name: cfnStr(props, 'TopicName') ?? logicalId,
                     encrypted: !!props['KmsMasterKeyId'],
-                    source, filePath,
+                    source,
+                    filePath,
                 });
                 break;
             case 'AWS::Lambda::Function':
                 schema.lambdas.push({
                     name: cfnStr(props, 'FunctionName') ?? logicalId,
                     runtime: cfnStr(props, 'Runtime'),
-                    source, filePath,
+                    source,
+                    filePath,
                 });
                 break;
             case 'AWS::S3::Bucket': {
@@ -292,7 +308,8 @@ function processCFNResources(resources, schema, filePath, source) {
                 schema.buckets.push({
                     name: cfnStr(props, 'BucketName') ?? logicalId,
                     versioned: versioningConfig?.['Status'] === 'Enabled',
-                    source, filePath,
+                    source,
+                    filePath,
                 });
                 break;
             }
@@ -300,20 +317,23 @@ function processCFNResources(resources, schema, filePath, source) {
                 schema.parameters.push({
                     name: cfnStr(props, 'Name') ?? logicalId,
                     type: cfnStr(props, 'Type') ?? 'String',
-                    source, filePath,
+                    source,
+                    filePath,
                 });
                 break;
             case 'AWS::SecretsManager::Secret':
                 schema.secrets.push({
                     name: cfnStr(props, 'Name') ?? logicalId,
-                    source, filePath,
+                    source,
+                    filePath,
                 });
                 break;
             case 'AWS::ApiGateway::RestApi':
             case 'AWS::ApiGatewayV2::Api':
                 schema.apiGateways.push({
                     name: cfnStr(props, 'Name') ?? logicalId,
-                    source, filePath,
+                    source,
+                    filePath,
                 });
                 break;
         }
@@ -340,7 +360,8 @@ export async function extractCDKSchema(repoPath) {
     // Strategy 1: Parse cdk.out/*.template.json (synthesized CloudFormation)
     const cdkOutDir = path.join(repoPath, 'cdk.out');
     if (fs.existsSync(cdkOutDir)) {
-        const templateFiles = fs.readdirSync(cdkOutDir)
+        const templateFiles = fs
+            .readdirSync(cdkOutDir)
             .filter((f) => f.endsWith('.template.json'))
             .map((f) => path.join(cdkOutDir, f));
         logger.debug(`Found ${templateFiles.length} CDK synthesized template(s) in cdk.out/`);
@@ -459,10 +480,16 @@ export async function extractIaCSchema(repoPath) {
         extractCDKSchema(repoPath),
     ]);
     const merged = mergeSchemas(tfSchema, cfnSchema, cdkSchema);
-    const total = merged.dynamoTables.length + merged.rdsInstances.length +
-        merged.mongoClusters.length + merged.queues.length + merged.topics.length +
-        merged.lambdas.length + merged.buckets.length + merged.parameters.length +
-        merged.secrets.length + merged.apiGateways.length;
+    const total = merged.dynamoTables.length +
+        merged.rdsInstances.length +
+        merged.mongoClusters.length +
+        merged.queues.length +
+        merged.topics.length +
+        merged.lambdas.length +
+        merged.buckets.length +
+        merged.parameters.length +
+        merged.secrets.length +
+        merged.apiGateways.length;
     logger.debug(`IaC schema total: ${total} resource(s) across TF/CFN/CDK`);
     return merged;
 }

package/dist/analyzers/aws-services.js

@@ -155,7 +155,11 @@ export class LambdaMissingTriggerDLQAnalyzer {
                         issue: `Lambda "${node.name}" is triggered by "${trigger.sourceName}" which has no DLQ`,
                         description: `"${node.name}" receives events from "${trigger.sourceName}" (${trigger.type.toUpperCase()}). If the Lambda handler fails, messages will be retried and eventually discarded with no failure record.`,
                         recommendation: `Add a DLQ to "${trigger.sourceName}" and set a destination config on the event source mapping so failed batches are captured and inspectable.`,
-                        metadata: { functionName: node.name, triggerSource: trigger.sourceName, triggerType: trigger.type },
+                        metadata: {
+                            functionName: node.name,
+                            triggerSource: trigger.sourceName,
+                            triggerType: trigger.type,
+                        },
                     });
                 }
             }

package/dist/analyzers/rds.js

@@ -12,7 +12,11 @@ export class RDSPubliclyAccessibleAnalyzer {
                     issue: `RDS instance "${node.name}" is publicly accessible`,
                     description: `"${node.name}" (${node.engine}) has PubliclyAccessible=true, meaning it is reachable from the internet. This exposes the database to brute-force and credential-stuffing attacks.`,
                     recommendation: `Set PubliclyAccessible=false on "${node.name}" and use a bastion host, VPN, or VPC peering for private access. If public access is required, enforce strong passwords, IP allowlisting, and TLS.`,
-                    metadata: { dbInstanceIdentifier: node.name, engine: node.engine, instanceClass: node.instanceClass },
+                    metadata: {
+                        dbInstanceIdentifier: node.name,
+                        engine: node.engine,
+                        instanceClass: node.instanceClass,
+                    },
                 });
             }
         }
@@ -32,7 +36,11 @@ export class RDSNoBackupAnalyzer {
                     issue: `RDS instance "${node.name}" has automated backups disabled`,
                     description: `"${node.name}" has a backup retention period of 0, meaning automated backups are off. Any accidental deletion or corruption is unrecoverable without a manual snapshot.`,
                     recommendation: `Enable automated backups on "${node.name}" with at least 7 days retention (35 days for production workloads). Enable point-in-time recovery.`,
-                    metadata: { dbInstanceIdentifier: node.name, engine: node.engine, backupRetentionDays: node.backupRetentionDays },
+                    metadata: {
+                        dbInstanceIdentifier: node.name,
+                        engine: node.engine,
+                        backupRetentionDays: node.backupRetentionDays,
+                    },
                 });
             }
         }

package/dist/analyzers/terraform.js

@@ -21,7 +21,12 @@ export class IaCDriftAnalyzer {
                     issue: `IaC drift: DynamoDB table "${name}" defined in IaC but not deployed`,
                     description: `"${name}" is in ${fp} but not found in AWS. It may be undeployed or deleted manually.`,
                     recommendation: 'Run `terraform apply` / deploy your stack, or remove the definition from IaC.',
-                    metadata: { resourceType: 'dynamodb_table', name, filePath: fp, driftType: 'defined_not_deployed' },
+                    metadata: {
+                        resourceType: 'dynamodb_table',
+                        name,
+                        filePath: fp,
+                        driftType: 'defined_not_deployed',
+                    },
                 });
             }
         }
@@ -46,7 +51,12 @@ export class IaCDriftAnalyzer {
                     issue: `IaC drift: SQS queue "${name}" defined in IaC but not deployed`,
                     description: `SQS queue "${name}" is defined in ${fp} but not found in the live account.`,
                     recommendation: 'Deploy the queue via `terraform apply` or your CFN/CDK stack.',
-                    metadata: { resourceType: 'sqs_queue', name, filePath: fp, driftType: 'defined_not_deployed' },
+                    metadata: {
+                        resourceType: 'sqs_queue',
+                        name,
+                        filePath: fp,
+                        driftType: 'defined_not_deployed',
+                    },
                 });
             }
         }
@@ -71,7 +81,12 @@ export class IaCDriftAnalyzer {
                     issue: `IaC drift: Lambda "${name}" defined in IaC but not deployed`,
                     description: `Lambda function "${name}" is defined in ${fp} but not found in the live account.`,
                     recommendation: 'Deploy the function via `terraform apply` or your CFN/CDK stack.',
-                    metadata: { resourceType: 'lambda_function', name, filePath: fp, driftType: 'defined_not_deployed' },
+                    metadata: {
+                        resourceType: 'lambda_function',
+                        name,
+                        filePath: fp,
+                        driftType: 'defined_not_deployed',
+                    },
                 });
             }
         }