infrawise 0.8.3 → 0.9.0

package/README.md

@@ -170,7 +170,7 @@ To let Claude Code manage the server lifecycle automatically:
 | `suggest_mongo_index`        | Exact `createIndex` command for a MongoDB collection + field                                                |
 | `mysql_index_suggestions`    | Exact `ALTER TABLE ADD INDEX` SQL for your MySQL table                                                      |
 | `get_queue_details`          | SQS queues — DLQ status, encryption, message counts                                                         |
-| `get_topic_details`          | SNS topics — subscription counts and protocols                                                              |
+| `get_topic_details`          | SNS topics — subscription counts, protocols, and filter policies (required message attributes per subscription) |
 | `get_secrets_overview`       | Secrets Manager — names and rotation status (values never included)                                         |
 | `get_parameter_overview`     | SSM Parameter Store — names, types, tiers (values never included)                                           |
 | `get_lambda_overview`        | Lambda functions — runtime, memory, timeout, triggers (SQS/DynamoDB/Kinesis/EventBridge/S3), env var key names |
@@ -345,6 +345,7 @@ Works from AWS APIs, database schema introspection, and IaC files — no depende
 | PostgreSQL / MySQL schema        | Tables, indexes, column types                                                                                      |
 | MongoDB schema                   | Collections, indexes                                                                                               |
 | SQS                              | Missing DLQs, unencrypted queues, large backlogs                                                                   |
+| SNS                              | Subscription filter policies — required message attributes per subscription                                        |
 | Kafka (kafkajs)                  | Producer/consumer topic mapping from code                                                                          |
 | Secrets Manager                  | Missing secret rotation                                                                                            |
 | Lambda                           | Default memory (128 MB), high timeouts, triggers (SQS/DynamoDB/Kinesis/EventBridge/S3), missing DLQ on trigger source |

package/dist/adapters/aws/s3.js

@@ -1,11 +1,25 @@
 import { S3Client, ListBucketsCommand, GetBucketNotificationConfigurationCommand, GetBucketVersioningCommand, GetBucketEncryptionCommand, GetPublicAccessBlockCommand, } from '@aws-sdk/client-s3';
 import { fromIni } from '@aws-sdk/credential-providers';
 import { logger } from '../../core/index.js';
+function validateEndpoint(endpoint) {
+    let url;
+    try {
+        url = new URL(endpoint);
+    }
+    catch {
+        throw new Error(`Invalid aws.endpoint URL: "${endpoint}"`);
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        throw new Error(`aws.endpoint must use http:// or https://, got "${url.protocol}//"`);
+    }
+}
 function clientConfig(cfg) {
     const region = cfg.region ?? 'us-east-1';
     const base = { region };
-    if (cfg.endpoint)
+    if (cfg.endpoint) {
+        validateEndpoint(cfg.endpoint);
         base.endpoint = cfg.endpoint;
+    }
     if (cfg.profile)
         base.credentials = fromIni({ profile: cfg.profile });
     return base;
@@ -52,7 +66,7 @@ export async function extractS3Metadata(cfg = {}) {
             const encrypted = encryptResult.status === 'fulfilled'
                 ? (encryptResult.value.ServerSideEncryptionConfiguration?.Rules?.length ?? 0) > 0
                 : false;
-            let publicAccessBlocked = false;
+            let publicAccessBlocked = null;
             if (pabResult.status === 'fulfilled') {
                 const pab = pabResult.value.PublicAccessBlockConfiguration ?? {};
                 publicAccessBlocked = !!(pab.BlockPublicAcls &&
@@ -60,6 +74,13 @@ export async function extractS3Metadata(cfg = {}) {
                     pab.BlockPublicPolicy &&
                     pab.RestrictPublicBuckets);
             }
+            else {
+                const httpStatus = pabResult.reason
+                    ?.$metadata?.httpStatusCode;
+                if (httpStatus !== 403)
+                    publicAccessBlocked = false;
+                // 403 AccessDenied: leave as null — insufficient permissions, not a public access finding
+            }
             buckets.push({
                 name,
                 arn,

package/dist/adapters/aws/services.js

@@ -1,5 +1,5 @@
 import { SQSClient, ListQueuesCommand, GetQueueAttributesCommand } from '@aws-sdk/client-sqs';
-import { SNSClient, ListTopicsCommand, GetTopicAttributesCommand, ListSubscriptionsByTopicCommand, } from '@aws-sdk/client-sns';
+import { SNSClient, ListTopicsCommand, GetTopicAttributesCommand, ListSubscriptionsByTopicCommand, GetSubscriptionAttributesCommand, } from '@aws-sdk/client-sns';
 import { SSMClient, DescribeParametersCommand } from '@aws-sdk/client-ssm';
 import { SecretsManagerClient, ListSecretsCommand } from '@aws-sdk/client-secrets-manager';
 import { LambdaClient, ListFunctionsCommand, ListEventSourceMappingsCommand, } from '@aws-sdk/client-lambda';
@@ -7,11 +7,25 @@ import { EventBridgeClient, ListRulesCommand, ListTargetsByRuleCommand, } from '
 import { RDSClient, DescribeDBInstancesCommand } from '@aws-sdk/client-rds';
 import { fromIni } from '@aws-sdk/credential-providers';
 import { logger } from '../../core/index.js';
+function validateEndpoint(endpoint) {
+    let url;
+    try {
+        url = new URL(endpoint);
+    }
+    catch {
+        throw new Error(`Invalid aws.endpoint URL: "${endpoint}"`);
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        throw new Error(`aws.endpoint must use http:// or https://, got "${url.protocol}//"`);
+    }
+}
 function clientConfig(cfg) {
     const region = cfg.region ?? 'us-east-1';
     const base = { region };
-    if (cfg.endpoint)
+    if (cfg.endpoint) {
+        validateEndpoint(cfg.endpoint);
         base.endpoint = cfg.endpoint;
+    }
     if (cfg.profile)
         base.credentials = fromIni({ profile: cfg.profile });
     return base;
@@ -98,12 +112,34 @@ export async function extractSNSMetadata(cfg = {}) {
                 ]);
                 const attrs = attrsRes.Attributes ?? {};
                 const subs = subsRes.Subscriptions ?? [];
+                const filterPolicies = [];
+                for (const sub of subs) {
+                    if (!sub.SubscriptionArn || sub.SubscriptionArn === 'PendingConfirmation')
+                        continue;
+                    try {
+                        const subAttrs = await client.send(new GetSubscriptionAttributesCommand({ SubscriptionArn: sub.SubscriptionArn }));
+                        const fp = subAttrs.Attributes?.['FilterPolicy'];
+                        if (fp) {
+                            const parsed = JSON.parse(fp);
+                            filterPolicies.push({
+                                subscriptionArn: sub.SubscriptionArn,
+                                protocol: sub.Protocol ?? 'unknown',
+                                requiredAttributes: Object.keys(parsed),
+                                scope: subAttrs.Attributes?.['FilterPolicyScope'] ?? 'MessageAttributes',
+                            });
+                        }
+                    }
+                    catch {
+                        // skip subscription if attributes fetch fails
+                    }
+                }
                 topics.push({
                     name: arn.split(':').pop() ?? arn,
                     arn,
                     encrypted: !!attrs['KmsMasterKeyId'],
                     subscriptionCount: parseInt(attrs['SubscriptionsConfirmed'] ?? '0', 10),
                     subscriptionProtocols: [...new Set(subs.map((s) => s.Protocol ?? 'unknown'))],
+                    filterPolicies,
                 });
             }
             catch (err) {
@@ -298,7 +334,7 @@ export async function extractLambdaMetadata(cfg = {}, includeFunctions) {
                 });
             }
             marker = res.NextMarker;
-        } while (marker && functions.length < 200);
+        } while (marker);
         // Fetch all event source mappings in one paginated call and attach to functions
         const triggerMap = await fetchAllEventSourceMappings(cfg);
         for (const fn of functions) {

package/dist/adapters/db/mongodb.js

@@ -1,12 +1,15 @@
 import { MongoClient } from 'mongodb';
 import { InfrawiseError, logger } from '../../core/index.js';
 const SYSTEM_DATABASES = new Set(['admin', 'local', 'config']);
+function sanitizeConnectionDetail(s) {
+    return s.replace(/\/\/[^:/@]+:[^@]+@/g, '//***:***@');
+}
 export class MongoConnectionError extends InfrawiseError {
     constructor(details) {
         super('Unable to connect to MongoDB.\n\nPossible reasons:\n- invalid connection string\n- port 27017 not accessible\n- wrong credentials\n\nRun: infrawise doctor', undefined, undefined);
         this.name = 'MongoConnectionError';
         if (details) {
-            this.message = `Unable to connect to MongoDB.\n\nPossible reasons:\n- invalid connection string\n- port 27017 not accessible\n- wrong credentials\n\nRun: infrawise doctor\n\nDetail: ${details}`;
+            this.message = `Unable to connect to MongoDB.\n\nPossible reasons:\n- invalid connection string\n- port 27017 not accessible\n- wrong credentials\n\nRun: infrawise doctor\n\nDetail: ${sanitizeConnectionDetail(details)}`;
         }
     }
 }

package/dist/adapters/db/mysql.js

@@ -1,12 +1,15 @@
 import mysql from 'mysql2/promise';
 import { InfrawiseError, logger } from '../../core/index.js';
 const SYSTEM_SCHEMAS = new Set(['information_schema', 'performance_schema', 'mysql', 'sys']);
+function sanitizeConnectionDetail(s) {
+    return s.replace(/\/\/[^:/@]+:[^@]+@/g, '//***:***@');
+}
 export class MySQLConnectionError extends InfrawiseError {
     constructor(details) {
         super('Unable to connect to MySQL.\n\nPossible reasons:\n- invalid connection string\n- port 3306 not accessible\n- wrong credentials\n\nRun: infrawise doctor', undefined, undefined);
         this.name = 'MySQLConnectionError';
         if (details) {
-            this.message = `Unable to connect to MySQL.\n\nPossible reasons:\n- invalid connection string\n- port 3306 not accessible\n- wrong credentials\n\nRun: infrawise doctor\n\nDetail: ${details}`;
+            this.message = `Unable to connect to MySQL.\n\nPossible reasons:\n- invalid connection string\n- port 3306 not accessible\n- wrong credentials\n\nRun: infrawise doctor\n\nDetail: ${sanitizeConnectionDetail(details)}`;
         }
     }
 }

package/dist/cli/commands/analyze.js

@@ -2,7 +2,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import chalk from 'chalk';
 import ora from 'ora';
-import { loadConfig, formatError, writeCache, readCache } from '../../core/index.js';
+import { loadConfig, formatError, writeCache, readCache, setCacheDir } from '../../core/index.js';
 import { extractDynamoMetadata } from '../../adapters/aws/dynamodb.js';
 import { extractPostgresMetadata } from '../../adapters/db/postgres.js';
 import { extractMySQLMetadata } from '../../adapters/db/mysql.js';
@@ -51,6 +51,7 @@ export async function runAnalyze(options = {}) {
     let config;
     try {
         config = loadConfig(options.config);
+        setCacheDir(path.dirname(path.resolve(options.config ?? 'infrawise.yaml')));
         log.success('Config loaded', options.config ?? 'infrawise.yaml');
     }
     catch (err) {
@@ -351,16 +352,18 @@ export async function runAnalyze(options = {}) {
         s.succeed(chalk.green('Analysis complete') + chalk.dim(`  ${findings.length} finding(s)`));
     }
     // ── Cache ─────────────────────────────────────────────────────────────────────
-    writeCache('graph', graph);
-    writeCache('findings', findings);
-    writeCache('operations', operations);
-    writeCache('meta', {
-        dynamoMeta,
-        postgresMeta,
-        mysqlMeta,
-        mongoMeta,
-        servicesMeta,
-    });
+    if (!options.noCache) {
+        writeCache('graph', graph);
+        writeCache('findings', findings);
+        writeCache('operations', operations);
+        writeCache('meta', {
+            dynamoMeta,
+            postgresMeta,
+            mysqlMeta,
+            mongoMeta,
+            servicesMeta,
+        });
+    }
     // ── Output ────────────────────────────────────────────────────────────────────
     const displayFindings = minSeverity > 0
         ? findings.filter((f) => (SEVERITY_ORDER[f.severity] ?? 0) >= minSeverity)
@@ -394,7 +397,7 @@ export async function runAnalyze(options = {}) {
     console.log('');
 }
 export async function runCodeRefresh(repoPath, config) {
-    const cached = readCache('meta', Infinity);
+    const cached = readCache('meta', 60 * 60 * 1000);
     const dynamoMeta = cached?.dynamoMeta ?? [];
     const postgresMeta = cached?.postgresMeta ?? [];
     const mysqlMeta = cached?.mysqlMeta ?? [];
@@ -438,7 +441,11 @@ export async function runCodeRefresh(repoPath, config) {
         ...(config.secretsManager?.enabled === true ? [new MissingSecretRotationAnalyzer()] : []),
         ...(config.cloudwatchLogs?.enabled ? [new MissingLogRetentionAnalyzer()] : []),
         ...(config.lambda?.enabled === true
-            ? [new LambdaDefaultMemoryAnalyzer(), new LambdaHighTimeoutAnalyzer()]
+            ? [
+                new LambdaDefaultMemoryAnalyzer(),
+                new LambdaHighTimeoutAnalyzer(),
+                new LambdaMissingTriggerDLQAnalyzer(),
+            ]
             : []),
         ...(config.rds?.enabled === true
             ? [

package/dist/cli/commands/dev.js

@@ -2,7 +2,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import chalk from 'chalk';
 import ora from 'ora';
-import { loadConfig, formatError, readCache } from '../../core/index.js';
+import { loadConfig, formatError, readCache, setCacheDir } from '../../core/index.js';
 import { createServer, setGraphState } from '../../server/index.js';
 import { log, printHeader } from '../utils.js';
 import { runAnalyze, runCodeRefresh } from './analyze.js';
@@ -59,6 +59,7 @@ export async function runDev(options = {}) {
     let config;
     try {
         config = loadConfig(options.config);
+        setCacheDir(path.dirname(path.resolve(options.config ?? 'infrawise.yaml')));
         log.success('Config loaded', options.config ?? 'infrawise.yaml');
     }
     catch (err) {

package/dist/context/index.js

@@ -193,14 +193,15 @@ function resolveStringValue(node, sourceFile) {
         return result;
     }
     if (Node.isIdentifier(node)) {
-        const name = node.getText();
-        const decl = sourceFile
-            .getDescendantsOfKind(SyntaxKind.VariableDeclaration)
-            .find((d) => d.getName() === name);
-        if (decl) {
-            const init = decl.getInitializer();
-            if (init)
-                return resolveStringValue(init, sourceFile);
+        const symbol = node.getSymbol();
+        if (symbol) {
+            for (const decl of symbol.getDeclarations()) {
+                if (Node.isVariableDeclaration(decl)) {
+                    const init = decl.getInitializer();
+                    if (init)
+                        return resolveStringValue(init, sourceFile);
+                }
+            }
         }
     }
     return null;

package/dist/core/cache.js

@@ -1,10 +1,13 @@
 import * as fs from 'fs';
 import * as path from 'path';
 const CACHE_VERSION = '1.0.0';
-const CACHE_DIR = path.join(process.cwd(), '.infrawise', 'cache');
+let cacheDir = path.join(process.cwd(), '.infrawise', 'cache');
+export function setCacheDir(dir) {
+    cacheDir = path.join(dir, '.infrawise', 'cache');
+}
 function ensureCacheDir() {
-    if (!fs.existsSync(CACHE_DIR)) {
-        fs.mkdirSync(CACHE_DIR, { recursive: true });
+    if (!fs.existsSync(cacheDir)) {
+        fs.mkdirSync(cacheDir, { recursive: true });
     }
 }
 export function writeCache(key, data) {
@@ -14,11 +17,11 @@ export function writeCache(key, data) {
         data,
         version: CACHE_VERSION,
     };
-    const filePath = path.join(CACHE_DIR, `${key}.json`);
+    const filePath = path.join(cacheDir, `${key}.json`);
     fs.writeFileSync(filePath, JSON.stringify(entry, null, 2), 'utf-8');
 }
 export function readCache(key, maxAgeMs = 3600000) {
-    const filePath = path.join(CACHE_DIR, `${key}.json`);
+    const filePath = path.join(cacheDir, `${key}.json`);
     if (!fs.existsSync(filePath))
         return null;
     try {
@@ -36,15 +39,15 @@ export function readCache(key, maxAgeMs = 3600000) {
 }
 export function clearCache(key) {
     if (key) {
-        const filePath = path.join(CACHE_DIR, `${key}.json`);
+        const filePath = path.join(cacheDir, `${key}.json`);
         if (fs.existsSync(filePath))
             fs.unlinkSync(filePath);
     }
     else {
-        if (fs.existsSync(CACHE_DIR)) {
-            const files = fs.readdirSync(CACHE_DIR);
+        if (fs.existsSync(cacheDir)) {
+            const files = fs.readdirSync(cacheDir);
             for (const file of files) {
-                fs.unlinkSync(path.join(CACHE_DIR, file));
+                fs.unlinkSync(path.join(cacheDir, file));
             }
         }
     }

package/dist/core/index.js

@@ -1,4 +1,4 @@
 export { loadConfig, generateDefaultConfig, InfrawiseConfigSchema, ConfigError as ConfigValidationError, } from './config.js';
 export { logger } from './logger.js';
 export { InfrawiseError, AWSConnectionError, DynamoDBError, PostgresConnectionError, RepositoryScanError, ConfigError, formatError, } from './errors.js';
-export { writeCache, readCache, clearCache } from './cache.js';
+export { writeCache, readCache, clearCache, setCacheDir } from './cache.js';

package/dist/graph/index.js

@@ -85,6 +85,7 @@ export function buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta = [],
             provider: 'aws',
             subscriptionCount: t.subscriptionCount,
             encrypted: t.encrypted,
+            filterPolicies: t.filterPolicies?.length > 0 ? t.filterPolicies : undefined,
         });
     }
     for (const s of servicesMeta.secrets ?? []) {

package/dist/server/index.js

@@ -265,7 +265,7 @@ export function createMcpServer() {
         });
     }));
     mcp.registerTool('get_topic_details', {
-        description: 'Returns all SNS topics with subscription count and encryption status. Call this when reviewing event fan-out patterns or checking whether a topic has the expected number of subscribers.',
+        description: 'Returns all SNS topics with subscription count, encryption status, and filter policies. Filter policies list the message attributes each subscription requires — publishers must include these attributes or messages are silently dropped. Call this before writing any SNS publish code or when reviewing event fan-out patterns.',
         inputSchema: z.object({}),
     }, logged('get_topic_details', async () => {
         const topics = getTopicNodes(currentGraph);
@@ -276,6 +276,7 @@ export function createMcpServer() {
                 provider: t.provider,
                 subscriptionCount: t.subscriptionCount,
                 encrypted: t.encrypted,
+                filterPolicies: t.filterPolicies ?? [],
             })),
         });
     }));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "infrawise",
-  "version": "0.8.3",
+  "version": "0.9.0",
   "mcpName": "io.github.Sidd27/infrawise",
   "description": "CLI-first infrastructure intelligence platform — analyzes DynamoDB, PostgreSQL, MySQL, MongoDB, SQS, SNS, SSM, Secrets Manager, Lambda, S3, CloudWatch Logs and exposes findings as an MCP server for Claude Code",
   "keywords": [