infrawise 0.8.3 → 0.8.7

package/dist/adapters/aws/s3.js

@@ -1,11 +1,25 @@
 import { S3Client, ListBucketsCommand, GetBucketNotificationConfigurationCommand, GetBucketVersioningCommand, GetBucketEncryptionCommand, GetPublicAccessBlockCommand, } from '@aws-sdk/client-s3';
 import { fromIni } from '@aws-sdk/credential-providers';
 import { logger } from '../../core/index.js';
+function validateEndpoint(endpoint) {
+    let url;
+    try {
+        url = new URL(endpoint);
+    }
+    catch {
+        throw new Error(`Invalid aws.endpoint URL: "${endpoint}"`);
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        throw new Error(`aws.endpoint must use http:// or https://, got "${url.protocol}//"`);
+    }
+}
 function clientConfig(cfg) {
     const region = cfg.region ?? 'us-east-1';
     const base = { region };
-    if (cfg.endpoint)
+    if (cfg.endpoint) {
+        validateEndpoint(cfg.endpoint);
         base.endpoint = cfg.endpoint;
+    }
     if (cfg.profile)
         base.credentials = fromIni({ profile: cfg.profile });
     return base;
@@ -52,7 +66,7 @@ export async function extractS3Metadata(cfg = {}) {
             const encrypted = encryptResult.status === 'fulfilled'
                 ? (encryptResult.value.ServerSideEncryptionConfiguration?.Rules?.length ?? 0) > 0
                 : false;
-            let publicAccessBlocked = false;
+            let publicAccessBlocked = null;
             if (pabResult.status === 'fulfilled') {
                 const pab = pabResult.value.PublicAccessBlockConfiguration ?? {};
                 publicAccessBlocked = !!(pab.BlockPublicAcls &&
@@ -60,6 +74,13 @@ export async function extractS3Metadata(cfg = {}) {
                     pab.BlockPublicPolicy &&
                     pab.RestrictPublicBuckets);
             }
+            else {
+                const httpStatus = pabResult.reason
+                    ?.$metadata?.httpStatusCode;
+                if (httpStatus !== 403)
+                    publicAccessBlocked = false;
+                // 403 AccessDenied: leave as null — insufficient permissions, not a public access finding
+            }
             buckets.push({
                 name,
                 arn,

package/dist/adapters/aws/services.js

@@ -7,11 +7,25 @@ import { EventBridgeClient, ListRulesCommand, ListTargetsByRuleCommand, } from '
 import { RDSClient, DescribeDBInstancesCommand } from '@aws-sdk/client-rds';
 import { fromIni } from '@aws-sdk/credential-providers';
 import { logger } from '../../core/index.js';
+function validateEndpoint(endpoint) {
+    let url;
+    try {
+        url = new URL(endpoint);
+    }
+    catch {
+        throw new Error(`Invalid aws.endpoint URL: "${endpoint}"`);
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        throw new Error(`aws.endpoint must use http:// or https://, got "${url.protocol}//"`);
+    }
+}
 function clientConfig(cfg) {
     const region = cfg.region ?? 'us-east-1';
     const base = { region };
-    if (cfg.endpoint)
+    if (cfg.endpoint) {
+        validateEndpoint(cfg.endpoint);
         base.endpoint = cfg.endpoint;
+    }
     if (cfg.profile)
         base.credentials = fromIni({ profile: cfg.profile });
     return base;
@@ -298,7 +312,7 @@ export async function extractLambdaMetadata(cfg = {}, includeFunctions) {
                 });
             }
             marker = res.NextMarker;
-        } while (marker && functions.length < 200);
+        } while (marker);
         // Fetch all event source mappings in one paginated call and attach to functions
         const triggerMap = await fetchAllEventSourceMappings(cfg);
         for (const fn of functions) {

package/dist/adapters/db/mongodb.js

@@ -1,12 +1,15 @@
 import { MongoClient } from 'mongodb';
 import { InfrawiseError, logger } from '../../core/index.js';
 const SYSTEM_DATABASES = new Set(['admin', 'local', 'config']);
+function sanitizeConnectionDetail(s) {
+    return s.replace(/\/\/[^:/@]+:[^@]+@/g, '//***:***@');
+}
 export class MongoConnectionError extends InfrawiseError {
     constructor(details) {
         super('Unable to connect to MongoDB.\n\nPossible reasons:\n- invalid connection string\n- port 27017 not accessible\n- wrong credentials\n\nRun: infrawise doctor', undefined, undefined);
         this.name = 'MongoConnectionError';
         if (details) {
-            this.message = `Unable to connect to MongoDB.\n\nPossible reasons:\n- invalid connection string\n- port 27017 not accessible\n- wrong credentials\n\nRun: infrawise doctor\n\nDetail: ${details}`;
+            this.message = `Unable to connect to MongoDB.\n\nPossible reasons:\n- invalid connection string\n- port 27017 not accessible\n- wrong credentials\n\nRun: infrawise doctor\n\nDetail: ${sanitizeConnectionDetail(details)}`;
         }
     }
 }

package/dist/adapters/db/mysql.js

@@ -1,12 +1,15 @@
 import mysql from 'mysql2/promise';
 import { InfrawiseError, logger } from '../../core/index.js';
 const SYSTEM_SCHEMAS = new Set(['information_schema', 'performance_schema', 'mysql', 'sys']);
+function sanitizeConnectionDetail(s) {
+    return s.replace(/\/\/[^:/@]+:[^@]+@/g, '//***:***@');
+}
 export class MySQLConnectionError extends InfrawiseError {
     constructor(details) {
         super('Unable to connect to MySQL.\n\nPossible reasons:\n- invalid connection string\n- port 3306 not accessible\n- wrong credentials\n\nRun: infrawise doctor', undefined, undefined);
         this.name = 'MySQLConnectionError';
         if (details) {
-            this.message = `Unable to connect to MySQL.\n\nPossible reasons:\n- invalid connection string\n- port 3306 not accessible\n- wrong credentials\n\nRun: infrawise doctor\n\nDetail: ${details}`;
+            this.message = `Unable to connect to MySQL.\n\nPossible reasons:\n- invalid connection string\n- port 3306 not accessible\n- wrong credentials\n\nRun: infrawise doctor\n\nDetail: ${sanitizeConnectionDetail(details)}`;
         }
     }
 }

package/dist/cli/commands/analyze.js

@@ -2,7 +2,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import chalk from 'chalk';
 import ora from 'ora';
-import { loadConfig, formatError, writeCache, readCache } from '../../core/index.js';
+import { loadConfig, formatError, writeCache, readCache, setCacheDir } from '../../core/index.js';
 import { extractDynamoMetadata } from '../../adapters/aws/dynamodb.js';
 import { extractPostgresMetadata } from '../../adapters/db/postgres.js';
 import { extractMySQLMetadata } from '../../adapters/db/mysql.js';
@@ -51,6 +51,7 @@ export async function runAnalyze(options = {}) {
     let config;
     try {
         config = loadConfig(options.config);
+        setCacheDir(path.dirname(path.resolve(options.config ?? 'infrawise.yaml')));
         log.success('Config loaded', options.config ?? 'infrawise.yaml');
     }
     catch (err) {
@@ -351,16 +352,18 @@ export async function runAnalyze(options = {}) {
         s.succeed(chalk.green('Analysis complete') + chalk.dim(`  ${findings.length} finding(s)`));
     }
     // ── Cache ─────────────────────────────────────────────────────────────────────
-    writeCache('graph', graph);
-    writeCache('findings', findings);
-    writeCache('operations', operations);
-    writeCache('meta', {
-        dynamoMeta,
-        postgresMeta,
-        mysqlMeta,
-        mongoMeta,
-        servicesMeta,
-    });
+    if (!options.noCache) {
+        writeCache('graph', graph);
+        writeCache('findings', findings);
+        writeCache('operations', operations);
+        writeCache('meta', {
+            dynamoMeta,
+            postgresMeta,
+            mysqlMeta,
+            mongoMeta,
+            servicesMeta,
+        });
+    }
     // ── Output ────────────────────────────────────────────────────────────────────
     const displayFindings = minSeverity > 0
         ? findings.filter((f) => (SEVERITY_ORDER[f.severity] ?? 0) >= minSeverity)
@@ -394,7 +397,7 @@ export async function runAnalyze(options = {}) {
     console.log('');
 }
 export async function runCodeRefresh(repoPath, config) {
-    const cached = readCache('meta', Infinity);
+    const cached = readCache('meta', 60 * 60 * 1000);
     const dynamoMeta = cached?.dynamoMeta ?? [];
     const postgresMeta = cached?.postgresMeta ?? [];
     const mysqlMeta = cached?.mysqlMeta ?? [];
@@ -438,7 +441,11 @@ export async function runCodeRefresh(repoPath, config) {
         ...(config.secretsManager?.enabled === true ? [new MissingSecretRotationAnalyzer()] : []),
         ...(config.cloudwatchLogs?.enabled ? [new MissingLogRetentionAnalyzer()] : []),
         ...(config.lambda?.enabled === true
-            ? [new LambdaDefaultMemoryAnalyzer(), new LambdaHighTimeoutAnalyzer()]
+            ? [
+                new LambdaDefaultMemoryAnalyzer(),
+                new LambdaHighTimeoutAnalyzer(),
+                new LambdaMissingTriggerDLQAnalyzer(),
+            ]
             : []),
         ...(config.rds?.enabled === true
             ? [

package/dist/cli/commands/dev.js

@@ -2,7 +2,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import chalk from 'chalk';
 import ora from 'ora';
-import { loadConfig, formatError, readCache } from '../../core/index.js';
+import { loadConfig, formatError, readCache, setCacheDir } from '../../core/index.js';
 import { createServer, setGraphState } from '../../server/index.js';
 import { log, printHeader } from '../utils.js';
 import { runAnalyze, runCodeRefresh } from './analyze.js';
@@ -59,6 +59,7 @@ export async function runDev(options = {}) {
     let config;
     try {
         config = loadConfig(options.config);
+        setCacheDir(path.dirname(path.resolve(options.config ?? 'infrawise.yaml')));
         log.success('Config loaded', options.config ?? 'infrawise.yaml');
     }
     catch (err) {

package/dist/core/cache.js

@@ -1,10 +1,13 @@
 import * as fs from 'fs';
 import * as path from 'path';
 const CACHE_VERSION = '1.0.0';
-const CACHE_DIR = path.join(process.cwd(), '.infrawise', 'cache');
+let cacheDir = path.join(process.cwd(), '.infrawise', 'cache');
+export function setCacheDir(dir) {
+    cacheDir = path.join(dir, '.infrawise', 'cache');
+}
 function ensureCacheDir() {
-    if (!fs.existsSync(CACHE_DIR)) {
-        fs.mkdirSync(CACHE_DIR, { recursive: true });
+    if (!fs.existsSync(cacheDir)) {
+        fs.mkdirSync(cacheDir, { recursive: true });
     }
 }
 export function writeCache(key, data) {
@@ -14,11 +17,11 @@ export function writeCache(key, data) {
         data,
         version: CACHE_VERSION,
     };
-    const filePath = path.join(CACHE_DIR, `${key}.json`);
+    const filePath = path.join(cacheDir, `${key}.json`);
     fs.writeFileSync(filePath, JSON.stringify(entry, null, 2), 'utf-8');
 }
 export function readCache(key, maxAgeMs = 3600000) {
-    const filePath = path.join(CACHE_DIR, `${key}.json`);
+    const filePath = path.join(cacheDir, `${key}.json`);
     if (!fs.existsSync(filePath))
         return null;
     try {
@@ -36,15 +39,15 @@ export function readCache(key, maxAgeMs = 3600000) {
 }
 export function clearCache(key) {
     if (key) {
-        const filePath = path.join(CACHE_DIR, `${key}.json`);
+        const filePath = path.join(cacheDir, `${key}.json`);
         if (fs.existsSync(filePath))
             fs.unlinkSync(filePath);
     }
     else {
-        if (fs.existsSync(CACHE_DIR)) {
-            const files = fs.readdirSync(CACHE_DIR);
+        if (fs.existsSync(cacheDir)) {
+            const files = fs.readdirSync(cacheDir);
             for (const file of files) {
-                fs.unlinkSync(path.join(CACHE_DIR, file));
+                fs.unlinkSync(path.join(cacheDir, file));
             }
         }
     }

package/dist/core/index.js

@@ -1,4 +1,4 @@
 export { loadConfig, generateDefaultConfig, InfrawiseConfigSchema, ConfigError as ConfigValidationError, } from './config.js';
 export { logger } from './logger.js';
 export { InfrawiseError, AWSConnectionError, DynamoDBError, PostgresConnectionError, RepositoryScanError, ConfigError, formatError, } from './errors.js';
-export { writeCache, readCache, clearCache } from './cache.js';
+export { writeCache, readCache, clearCache, setCacheDir } from './cache.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "infrawise",
-  "version": "0.8.3",
+  "version": "0.8.7",
   "mcpName": "io.github.Sidd27/infrawise",
   "description": "CLI-first infrastructure intelligence platform — analyzes DynamoDB, PostgreSQL, MySQL, MongoDB, SQS, SNS, SSM, Secrets Manager, Lambda, S3, CloudWatch Logs and exposes findings as an MCP server for Claude Code",
   "keywords": [