cloudwright-ai-cli 1.4.0__tar.gz → 1.5.0__tar.gz

{cloudwright_ai_cli-1.4.0 → cloudwright_ai_cli-1.5.0}/.gitignore

@@ -18,3 +18,5 @@ node_modules/
 CLAUDE.md
 packages/*/CLAUDE.md
 docs/fix-plan.md
+tmp/
+_recording*/

{cloudwright_ai_cli-1.4.0 → cloudwright_ai_cli-1.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cloudwright-ai-cli
-Version: 1.4.0
+Version: 1.5.0
 Summary: CLI for Cloudwright architecture intelligence
 Project-URL: Homepage, https://github.com/xmpuspus/cloudwright
 Project-URL: Repository, https://github.com/xmpuspus/cloudwright

cloudwright_ai_cli-1.5.0/cloudwright_cli/__init__.py

@@ -0,0 +1 @@
+__version__ = "1.5.0"

cloudwright_ai_cli-1.5.0/cloudwright_cli/commands/compliance_cmd.py

@@ -0,0 +1,104 @@
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Annotated
+
+import typer
+from rich.console import Console
+from rich.table import Table
+
+from cloudwright_cli.output import emit_stream, emit_success, is_json_mode, should_stream
+from cloudwright_cli.utils import handle_error
+
+console = Console()
+
+_SEVERITY_ORDER = {"critical": 0, "high": 1, "medium": 2, "low": 3, "none": 4}
+
+
+def compliance_scan(
+    ctx: typer.Context,
+    spec_file: Annotated[Path, typer.Argument(help="Path to ArchSpec YAML file", exists=True)],
+    frameworks: Annotated[
+        str | None,
+        typer.Option("--frameworks", "-f", help="Comma list: hipaa,soc2,pci-dss,fedramp,gdpr,iso27001,nist"),
+    ] = None,
+    checkov: Annotated[
+        bool | None,
+        typer.Option("--checkov/--no-checkov", help="Force or skip the Checkov deep scan (auto-detected by default)"),
+    ] = None,
+    fail_on: Annotated[str, typer.Option("--fail-on", help="Fail on: critical, high, medium, none")] = "high",
+    output: Annotated[str | None, typer.Option("--output", "-o", help="Write a markdown control report")] = None,
+) -> None:
+    """Scan an ArchSpec and map every finding to framework control IDs.
+
+    Maps design-stage findings to HIPAA / SOC 2 / PCI-DSS / FedRAMP / GDPR /
+    ISO 27001 / NIST 800-53 controls before any infrastructure exists. Folds in
+    a Checkov deep scan against the exported Terraform when Checkov is on PATH.
+    """
+    try:
+        from cloudwright import ArchSpec
+        from cloudwright.compliance import ComplianceScanner, render_markdown
+
+        spec = ArchSpec.from_file(spec_file)
+        fw_list = [f for f in (frameworks.split(",") if frameworks else []) if f.strip()]
+        report = ComplianceScanner().scan(spec, frameworks=fw_list or None, run_checkov=checkov)
+
+        if output:
+            Path(output).write_text(render_markdown(spec, report))
+
+        if is_json_mode(ctx):
+            if should_stream(ctx):
+                for f in report.findings:
+                    emit_stream(f.as_dict())
+            else:
+                emit_success(ctx, report.as_dict())
+            _maybe_exit(report, fail_on)
+            return
+
+        console.print(f"\nCompliance Scan: {spec_file.name}  (scanner: {report.scanner})\n")
+
+        posture = Table("Framework", "Satisfied", "Violated controls", "Findings", "Status")
+        for s in report.frameworks:
+            sat = f"{s.controls_total - len(s.controls_violated)}/{s.controls_total}"
+            viol = ", ".join(s.controls_violated) if s.controls_violated else "-"
+            style = "green" if s.status == "pass" else "red"
+            posture.add_row(s.framework, sat, viol, str(s.findings), f"[{style}]{s.status.upper()}[/{style}]")
+        console.print(posture)
+        console.print()
+
+        if not report.findings:
+            console.print("[green][PASS][/green] No control violations detected.")
+        else:
+            for f in report.findings:
+                sev = f.severity.upper()
+                color = {"CRITICAL": "bold red", "HIGH": "red", "MEDIUM": "yellow"}.get(sev, "dim")
+                console.print(f"  [{color}][{sev}][/{color}] {f.message}  [dim]({f.source})[/dim]")
+                if f.controls:
+                    ctrl = ", ".join(f"{c.framework} {c.control_id}" for c in f.controls)
+                    console.print(f"           Controls: {ctrl}", style="cyan")
+                console.print(f"           Remediation: {f.remediation}", style="dim")
+                console.print()
+
+        crit = report.critical_count
+        high = report.high_count
+        console.print(f"{len(report.findings)} finding(s) ({crit} critical, {high} high)")
+        threshold = _SEVERITY_ORDER.get(fail_on, 1)
+        worst = min((_SEVERITY_ORDER.get(f.severity, 4) for f in report.findings), default=4)
+        status = "PASSED" if worst > threshold else "FAILED"
+        console.print(f"Status: [{'green' if status == 'PASSED' else 'red'}]{status}[/] (fail-on={fail_on})")
+        if output:
+            console.print(f"\nReport written to {output}", style="dim")
+
+        _maybe_exit(report, fail_on)
+
+    except typer.Exit:
+        raise
+    except Exception as e:
+        handle_error(ctx, e)
+
+
+def _maybe_exit(report, fail_on: str) -> None:
+    threshold = _SEVERITY_ORDER.get(fail_on, 1)
+    for f in report.findings:
+        if _SEVERITY_ORDER.get(f.severity, 4) <= threshold:
+            raise typer.Exit(1)

cloudwright_ai_cli-1.5.0/cloudwright_cli/commands/import_live_cmd.py

@@ -0,0 +1,172 @@
+"""Import live cloud infrastructure into an ArchSpec via provider APIs.
+
+Supports AWS (boto3), GCP (google-cloud SDKs), and Azure (azure-mgmt SDKs):
+
+    cloudwright import-live --provider aws   --region us-east-1
+    cloudwright import-live --provider gcp   --project my-project
+    cloudwright import-live --provider azure --subscription <SUB_ID>
+"""
+
+from __future__ import annotations
+
+import json
+import sys
+from pathlib import Path
+from typing import Annotated
+
+import typer
+from rich.console import Console
+
+from cloudwright_cli.output import emit_success, err_console, is_json_mode, validate_output_path
+from cloudwright_cli.utils import handle_error
+
+console = Console()
+
+
+def import_live(
+    ctx: typer.Context,
+    provider: Annotated[
+        str,
+        typer.Option("--provider", help="Cloud provider to scan: aws | gcp | azure"),
+    ] = "aws",
+    region: Annotated[
+        str,
+        typer.Option("--region", help="Cloud region (e.g. us-east-1). Recorded in metadata for gcp/azure."),
+    ] = "us-east-1",
+    profile: Annotated[
+        str | None,
+        typer.Option("--profile", help="AWS named profile (~/.aws/credentials)"),
+    ] = None,
+    project: Annotated[
+        str | None,
+        typer.Option("--project", help="GCP project ID (or set GOOGLE_CLOUD_PROJECT)"),
+    ] = None,
+    subscription: Annotated[
+        str | None,
+        typer.Option("--subscription", help="Azure subscription ID (or set AZURE_SUBSCRIPTION_ID)"),
+    ] = None,
+    services: Annotated[
+        str | None,
+        typer.Option(
+            "--services",
+            help="Comma-separated subset of services to scan. Default: all for the provider.",
+        ),
+    ] = None,
+    output: Annotated[
+        str | None,
+        typer.Option("--output", "-o", help="Write ArchSpec YAML to this file instead of stdout"),
+    ] = None,
+    name: Annotated[
+        str | None,
+        typer.Option("--name", help="Override the architecture name"),
+    ] = None,
+) -> None:
+    """Walk live cloud APIs and produce an ArchSpec from running infrastructure."""
+    try:
+        provider_norm = (provider or "aws").lower()
+        if provider_norm == "google":
+            provider_norm = "gcp"
+        if provider_norm not in {"aws", "gcp", "azure"}:
+            raise typer.BadParameter(f"Unknown --provider {provider!r}. Supported: aws, gcp, azure.")
+
+        try:
+            from cloudwright.importer.live_aws import LiveImportError
+        except ImportError as exc:
+            err_console.print(
+                "[red]Live import core is unavailable.[/red] Install with: pip install 'cloudwright-ai[live-import]'"
+            )
+            raise typer.Exit(code=1) from exc
+
+        json_mode = is_json_mode(ctx)
+
+        def _progress(msg: str) -> None:
+            if not json_mode:
+                err_console.print(msg)
+
+        services_list: list[str] | None = None
+        if services:
+            services_list = [s.strip().lower() for s in services.split(",") if s.strip()]
+
+        scope_label = region
+        try:
+            if provider_norm == "aws":
+                from cloudwright.importer.live_aws import SUPPORTED_SERVICES, import_live_aws
+
+                _check_services(services_list, SUPPORTED_SERVICES)
+                spec = import_live_aws(
+                    region=region,
+                    profile=profile,
+                    services=services_list,
+                    progress=_progress,
+                    name=name,
+                )
+                scope_label = region
+            elif provider_norm == "gcp":
+                from cloudwright.importer.live_gcp import SUPPORTED_SERVICES, import_live_gcp
+
+                _check_services(services_list, SUPPORTED_SERVICES)
+                spec = import_live_gcp(
+                    project=project,
+                    region=region,
+                    services=services_list,
+                    progress=_progress,
+                    name=name,
+                )
+                scope_label = project or "project"
+            else:  # azure
+                from cloudwright.importer.live_azure import SUPPORTED_SERVICES, import_live_azure
+
+                _check_services(services_list, SUPPORTED_SERVICES)
+                spec = import_live_azure(
+                    subscription=subscription,
+                    region=region,
+                    services=services_list,
+                    progress=_progress,
+                    name=name,
+                )
+                scope_label = subscription or "subscription"
+        except LiveImportError as exc:
+            err_console.print(f"[red]error:[/red] {exc}")
+            raise typer.Exit(code=1) from exc
+
+        if name:
+            spec = spec.model_copy(update={"name": name})
+
+        if json_mode:
+            emit_success(ctx, {"spec": json.loads(spec.to_json())})
+            return
+
+        content = spec.to_yaml()
+        n_comps = len(spec.components)
+        n_bounds = len(spec.boundaries)
+
+        if output:
+            validate_output_path(output)
+            Path(output).write_text(content)
+            err_console.print()
+            err_console.print(
+                f"[green]Imported[/green] {n_comps} component(s), {n_bounds} boundary(ies) "
+                f"from {scope_label} -> [bold]{output}[/bold]"
+            )
+            err_console.print(f"Run [bold]cloudwright cost {output}[/bold] to estimate.")
+        else:
+            sys.stdout.write(content)
+            err_console.print()
+            err_console.print(
+                f"[green]Imported[/green] {n_comps} component(s), {n_bounds} boundary(ies) from {scope_label}"
+            )
+
+    except typer.Exit:
+        raise
+    except typer.BadParameter:
+        raise
+    except Exception as e:
+        handle_error(ctx, e)
+
+
+def _check_services(services_list: list[str] | None, supported: tuple[str, ...]) -> None:
+    if not services_list:
+        return
+    unknown = [s for s in services_list if s not in supported]
+    if unknown:
+        raise typer.BadParameter(f"Unknown service(s): {sorted(set(unknown))}. Supported: {list(supported)}")

cloudwright_ai_cli-1.5.0/cloudwright_cli/commands/plan_cmd.py

@@ -0,0 +1,75 @@
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Annotated
+
+import typer
+from rich.console import Console
+
+from cloudwright_cli.output import emit_success, is_json_mode
+from cloudwright_cli.utils import handle_error
+
+console = Console()
+
+
+def plan(
+    ctx: typer.Context,
+    spec_file: Annotated[Path, typer.Argument(help="Path to ArchSpec YAML file", exists=True)],
+    target: Annotated[
+        str,
+        typer.Option("--target", "-t", help="terraform | pulumi-python | pulumi-ts"),
+    ] = "terraform",
+    no_plan: Annotated[
+        bool,
+        typer.Option("--no-plan", help="Validate only; skip the credential-requiring plan/preview step"),
+    ] = False,
+    timeout: Annotated[int, typer.Option("--timeout", help="Seconds before the plan step is aborted")] = 180,
+) -> None:
+    """Prove the exported infrastructure is deployable.
+
+    Runs `terraform validate`/`plan` or `pulumi preview` against the generated
+    artifact. Read-only — nothing is applied. `validate` needs no credentials
+    and is the offline proof of deployability; `plan` adds a real resource
+    diff when cloud credentials are available.
+    """
+    try:
+        from cloudwright import ArchSpec
+        from cloudwright.planner import plan as run_plan
+
+        spec = ArchSpec.from_file(spec_file)
+        result = run_plan(spec, target=target, run_plan=not no_plan, timeout=timeout)
+
+        if is_json_mode(ctx):
+            emit_success(ctx, result.as_dict())
+            if not result.ok:
+                raise typer.Exit(1)
+            return
+
+        console.print(f"\nPlan ({result.tool}): {spec_file.name}\n")
+        if not result.available:
+            console.print(f"[yellow][SKIP][/yellow] {result.messages[0]}")
+            raise typer.Exit(1)
+
+        for msg in result.messages:
+            console.print(f"  {msg}")
+        if result.summary is not None:
+            s = result.summary
+            console.print(
+                f"\n  Resource diff: [green]+{s['add']}[/green] "
+                f"[yellow]~{s['change']}[/yellow] [red]-{s['destroy']}[/red]"
+            )
+        if result.output_tail:
+            console.print("\n[dim]--- tool output (tail) ---[/dim]")
+            console.print(f"[dim]{result.output_tail}[/dim]")
+
+        verdict = "DEPLOYABLE" if result.ok else "NOT DEPLOYABLE"
+        style = "green" if result.ok else "red"
+        plan_note = "" if result.plan_ran else " (validate only — no credentials for full plan)"
+        console.print(f"\nVerdict: [{style}]{verdict}[/{style}]{plan_note}")
+        if not result.ok:
+            raise typer.Exit(1)
+
+    except typer.Exit:
+        raise
+    except Exception as e:
+        handle_error(ctx, e)

{cloudwright_ai_cli-1.4.0 → cloudwright_ai_cli-1.5.0}/cloudwright_cli/main.py

@@ -6,6 +6,7 @@ from cloudwright_cli.commands.analyze_cmd import analyze
 from cloudwright_cli.commands.catalog_cmd import catalog_app
 from cloudwright_cli.commands.chat import chat
 from cloudwright_cli.commands.compare import compare
+from cloudwright_cli.commands.compliance_cmd import compliance_scan
 from cloudwright_cli.commands.cost import cost
 from cloudwright_cli.commands.databricks_cmd import databricks_validate
 from cloudwright_cli.commands.design import design
@@ -18,6 +19,7 @@ from cloudwright_cli.commands.init_cmd import init
 from cloudwright_cli.commands.lint_cmd import lint
 from cloudwright_cli.commands.mcp_cmd import mcp_serve
 from cloudwright_cli.commands.modify_cmd import modify
+from cloudwright_cli.commands.plan_cmd import plan
 from cloudwright_cli.commands.policy import policy
 from cloudwright_cli.commands.refresh_cmd import refresh
 from cloudwright_cli.commands.schema_cmd import schema
@@ -72,6 +74,7 @@ app.command(name="import")(import_infra)
 app.command(name="import-live")(import_live)
 app.command()(chat)
 app.command()(init)
+app.command()(plan)
 app.command()(policy)
 app.command()(score)
 app.command()(analyze)
@@ -79,6 +82,7 @@ app.command()(refresh)
 app.command()(lint)
 app.command()(databricks_validate)
 app.command(name="security")(security_scan)
+app.command(name="compliance")(compliance_scan)
 app.command(name="adr")(adr)
 app.command()(schema)
 app.command(name="mcp")(mcp_serve)

cloudwright_ai_cli-1.4.0/cloudwright_cli/__init__.py

@@ -1 +0,0 @@
-__version__ = "1.4.0"

cloudwright_ai_cli-1.4.0/cloudwright_cli/commands/import_live_cmd.py

@@ -1,136 +0,0 @@
-"""Import live cloud infrastructure into an ArchSpec via provider APIs.
-
-Currently supports AWS via boto3 (``cloudwright import-live --provider aws``).
-GCP and Azure surface a clear ``not yet implemented`` error.
-"""
-
-from __future__ import annotations
-
-import json
-import sys
-from pathlib import Path
-from typing import Annotated
-
-import typer
-from rich.console import Console
-
-from cloudwright_cli.output import emit_success, err_console, is_json_mode, validate_output_path
-from cloudwright_cli.utils import handle_error
-
-console = Console()
-
-
-def import_live(
-    ctx: typer.Context,
-    provider: Annotated[
-        str,
-        typer.Option("--provider", help="Cloud provider to scan: aws (gcp, azure not yet implemented)"),
-    ] = "aws",
-    region: Annotated[
-        str,
-        typer.Option("--region", help="Cloud region (e.g. us-east-1)"),
-    ] = "us-east-1",
-    profile: Annotated[
-        str | None,
-        typer.Option("--profile", help="AWS named profile (~/.aws/credentials)"),
-    ] = None,
-    services: Annotated[
-        str | None,
-        typer.Option(
-            "--services",
-            help="Comma-separated subset of services to scan (e.g. ec2,rds,s3). Default: all.",
-        ),
-    ] = None,
-    output: Annotated[
-        str | None,
-        typer.Option("--output", "-o", help="Write ArchSpec YAML to this file instead of stdout"),
-    ] = None,
-    name: Annotated[
-        str | None,
-        typer.Option("--name", help="Override the architecture name"),
-    ] = None,
-) -> None:
-    """Walk live AWS APIs and produce an ArchSpec from running infrastructure."""
-    try:
-        provider_norm = (provider or "aws").lower()
-        if provider_norm in {"gcp", "google", "azure"}:
-            raise typer.BadParameter(
-                f"--provider {provider!r} is not yet implemented. Only --provider aws is supported in v1.4."
-            )
-        if provider_norm != "aws":
-            raise typer.BadParameter(f"Unknown --provider {provider!r}. Supported: aws.")
-
-        try:
-            from cloudwright.importer.live_aws import (
-                SUPPORTED_SERVICES,
-                LiveImportError,
-                import_live_aws,
-            )
-        except ImportError as exc:
-            # boto3 not installed at all (cloudwright.importer.live_aws import boto3 lazily,
-            # but a missing core import surfaces here as a final fallback).
-            err_console.print(
-                "[red]boto3 is required for live AWS import.[/red] "
-                "Install with: pip install 'cloudwright-ai[live-import]'"
-            )
-            raise typer.Exit(code=1) from exc
-
-        services_list: list[str] | None = None
-        if services:
-            services_list = [s.strip().lower() for s in services.split(",") if s.strip()]
-            unknown = [s for s in services_list if s not in SUPPORTED_SERVICES]
-            if unknown:
-                raise typer.BadParameter(
-                    f"Unknown service(s): {sorted(set(unknown))}. Supported: {list(SUPPORTED_SERVICES)}"
-                )
-
-        json_mode = is_json_mode(ctx)
-
-        def _progress(msg: str) -> None:
-            if not json_mode:
-                err_console.print(msg)
-
-        try:
-            spec = import_live_aws(
-                region=region,
-                profile=profile,
-                services=services_list,
-                progress=_progress,
-                name=name,
-            )
-        except LiveImportError as exc:
-            # Clean error path — credentials missing, profile not found, etc.
-            err_console.print(f"[red]error:[/red] {exc}")
-            raise typer.Exit(code=1) from exc
-
-        if name:
-            spec = spec.model_copy(update={"name": name})
-
-        if json_mode:
-            emit_success(ctx, {"spec": json.loads(spec.to_json())})
-            return
-
-        content = spec.to_yaml()
-        n_comps = len(spec.components)
-        n_bounds = len(spec.boundaries)
-
-        if output:
-            validate_output_path(output)
-            Path(output).write_text(content)
-            err_console.print()
-            err_console.print(
-                f"[green]Imported[/green] {n_comps} component(s), {n_bounds} boundary(ies) "
-                f"from {region} -> [bold]{output}[/bold]"
-            )
-            err_console.print(f"Run [bold]cloudwright cost {output}[/bold] to estimate.")
-        else:
-            sys.stdout.write(content)
-            err_console.print()
-            err_console.print(f"[green]Imported[/green] {n_comps} component(s), {n_bounds} boundary(ies) from {region}")
-
-    except typer.Exit:
-        raise
-    except typer.BadParameter:
-        raise
-    except Exception as e:
-        handle_error(ctx, e)