diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json index 059c4c8d..0e58c535 100644 --- a/.claude-plugin/marketplace.json +++ b/.claude-plugin/marketplace.json @@ -133,7 +133,7 @@ "transform", "continuous modernization" ], - "version": "1.8.0" + "version": "1.9.0" }, { "category": "development", diff --git a/plugins/aws-transform/.claude-plugin/plugin.json b/plugins/aws-transform/.claude-plugin/plugin.json index 65aa1916..f3d87a9d 100644 --- a/plugins/aws-transform/.claude-plugin/plugin.json +++ b/plugins/aws-transform/.claude-plugin/plugin.json @@ -31,5 +31,5 @@ "license": "Apache-2.0", "name": "aws-transform", "repository": "https://github.com/awslabs/agent-plugins", - "version": "1.8.0" + "version": "1.9.0" } diff --git a/plugins/aws-transform/.codex-plugin/plugin.json b/plugins/aws-transform/.codex-plugin/plugin.json index bab652af..baa53b89 100644 --- a/plugins/aws-transform/.codex-plugin/plugin.json +++ b/plugins/aws-transform/.codex-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "aws-transform", - "version": "1.8.0", + "version": "1.9.0", "description": "Migrate, modernize, and upgrade codebases to AWS. Transforms .NET Framework to .NET 8/10, mainframe COBOL to Java, VMware VMs to EC2, SQL Server to Aurora, and upgrades Java/Python/Node.js versions and AWS SDKs. AWS Transform - continuous modernization analyzes codebases for tech debt, security issues, and upgrade opportunities, then remediates them.", "author": { "name": "Amazon Web Services", diff --git a/plugins/aws-transform/skills/aws-transform/references/continuous-modernization-analysis.md b/plugins/aws-transform/skills/aws-transform/references/continuous-modernization-analysis.md index 51e9914b..a699f78b 100644 --- a/plugins/aws-transform/skills/aws-transform/references/continuous-modernization-analysis.md +++ b/plugins/aws-transform/skills/aws-transform/references/continuous-modernization-analysis.md @@ -1,6 +1,6 @@ --- name: analysis -description: Run/start/restart/cancel/delete analyses (tech-debt-quick, tech-debt-comprehensive, security, agentic-readiness, modernization-readiness, custom). Detects vulnerabilities, outdated dependencies, migration opportunities, modernization candidates. Custom type runs any TD. +description: Run/start/restart/cancel/delete analyses (rapid-techdebt-analysis, tech-debt-comprehensive, security, agentic-readiness, modernization-readiness, custom). Detects vulnerabilities, outdated dependencies, migration opportunities, modernization candidates. Custom type runs any TD. --- name: analysis @@ -46,10 +46,10 @@ If the scope exceeds 100 repositories, split it into multiple runs, each targeti ```bash # Run analysis. Pass --wait so the command blocks until the run finishes (preferred — see "Running long analyses" below). -atx ct analysis run --type --source [--repo ::] --wait --telemetry "agent=,executionMode=local" +atx ct analysis run --type --source [--repo ::] --wait --telemetry "agent=,executionMode=local" # --wait is only in newer CLI versions. If it isn't supported, run the same command without --wait. -atx ct analysis run --type --source [--repo ::] --telemetry "agent=,executionMode=local" +atx ct analysis run --type --source [--repo ::] --telemetry "agent=,executionMode=local" # Run custom analysis with a specific transformation definition atx ct analysis run --type custom --transformation-name --source --repo :: --wait --telemetry "agent=,executionMode=local" @@ -65,7 +65,7 @@ atx ct analysis list --json # Filter on the server-side index (fast). Combine as needed. atx ct analysis list --status --json -atx ct analysis list --type --json +atx ct analysis list --type --json atx ct analysis list --status complete --type security --json # Category is filtered client-side (does not reduce the fetch); only narrows what's printed. @@ -165,7 +165,7 @@ When the user asks to run a custom analysis or mentions a capability not covered ### When to use TD discovery vs built-in types -- If the user's request clearly maps to a built-in type (`tech-debt-quick`, `tech-debt-comprehensive`, `security`, `agentic-readiness`, `modernization-readiness`), use that type directly -- do NOT use custom. +- If the user's request clearly maps to a built-in type (`rapid-techdebt-analysis`, `tech-debt-comprehensive`, `security`, `agentic-readiness`, `modernization-readiness`), use that type directly -- do NOT use custom. - If the request mentions a specific capability not covered by built-in types, or asks about custom/customer-owned TDs, use TD discovery. - If the user explicitly names a TD, skip discovery and run it directly with `--type custom --transformation-name `. @@ -206,7 +206,7 @@ A `0 findings` result does NOT automatically mean the repo is clean. Each analys | Type | What 0 findings means | What to do next | | ------------------------- | ------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| `tech-debt-quick` | Metadata files didn't expose any stale versions. **Inconclusive** -- quick scan only inspects manifests. | Tell the user the result is inconclusive (metadata-only). Offer to run `tech-debt-comprehensive` for a code-level analysis. | +| `rapid-techdebt-analysis` | Metadata files didn't expose any stale versions. **Inconclusive** -- quick scan only inspects manifests. | Tell the user the result is inconclusive (metadata-only). Offer to run `tech-debt-comprehensive` for a code-level analysis. | | `tech-debt-comprehensive` | Bedrock did not surface tech-debt issues. Repo is likely well-maintained, but other dimensions weren't checked. | Offer `security` for CVEs, `agentic-readiness` for AI-readiness, and `modernization-readiness` for modernization opportunities. Mention these are separate scans. | | `security` | Security Agent didn't surface CVEs or vulnerable patterns. | Verify the Security Agent is healthy (`atx ct setup security-agent --status`). If healthy, offer `tech-debt-comprehensive` for non-security issues. | | `agentic-readiness` | Repo did not show AI-readiness gaps at the framework level. | Offer `modernization-readiness` for cloud/infrastructure modernization or `tech-debt-comprehensive` for general code health. | @@ -220,12 +220,12 @@ If an analysis returns 0 findings on a repo that's obviously stale (Java 8, Node `atx ct analysis list` exposes these filters. Pick the narrowest combination the question allows. -| Filter | Where it runs | Allowed values | -| --------------- | --------------------------------------- | --------------------------------------------------------------------------------------------------------------------- | -| `--status` | server-side (GSI-backed, fast) | `pending`, `running`, `complete`, `cancelled`, `failed` | -| `--type` | server-side (GSI-backed, fast) | `tech-debt-quick`, `tech-debt-comprehensive`, `security`, `agentic-readiness`, `modernization-readiness`, `custom` | -| `--category` | client-side (does not reduce the fetch) | `"Tech Debt"`, `"Security"`, `"Agentic Readiness"` | -| `--schedule-id` | server-side | a schedule's `sched-` analysisId (from `atx ct schedule list`) — lists that schedule's fired child runs, newest first | +| Filter | Where it runs | Allowed values | +| --------------- | --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | +| `--status` | server-side (GSI-backed, fast) | `pending`, `running`, `complete`, `cancelled`, `failed` | +| `--type` | server-side (GSI-backed, fast) | `rapid-techdebt-analysis`, `tech-debt-comprehensive`, `security`, `agentic-readiness`, `modernization-readiness`, `custom` | +| `--category` | client-side (does not reduce the fetch) | `"Tech Debt"`, `"Security"`, `"Agentic Readiness"` | +| `--schedule-id` | server-side | a schedule's `sched-` analysisId (from `atx ct schedule list`) — lists that schedule's fired child runs, newest first | **Recommended shapes:** @@ -235,7 +235,7 @@ If an analysis returns 0 findings on a repo that's obviously stale (Java 8, Node - "What has my nightly schedule run so far?" → `atx ct analysis list --schedule-id --json` (the fired child runs of that schedule; get `` from `atx ct schedule list`) - One specific run → `atx ct analysis get --id --json` (point lookup; cheaper than list). -`--category` is a client-side grouping; e.g. `"Tech Debt"` matches both `tech-debt-quick` and `tech-debt-comprehensive`. Use it when the user wants both subtypes together. +`--category` is a client-side grouping; e.g. `"Tech Debt"` matches both `rapid-techdebt-analysis` and `tech-debt-comprehensive`. Use it when the user wants both subtypes together. `--schedule-id` is how you inspect a schedule's history: each fire creates one child analysis, and this lists them newest-first. It **cannot** be combined with `--status` or `--type` (the CLI returns `INVALID_INPUT`). To read one fire's findings, take a child's id and run `atx ct findings list --analysis-id --json`. diff --git a/plugins/aws-transform/skills/aws-transform/references/continuous-modernization-discovery.md b/plugins/aws-transform/skills/aws-transform/references/continuous-modernization-discovery.md index b31b5a56..ffb3c378 100644 --- a/plugins/aws-transform/skills/aws-transform/references/continuous-modernization-discovery.md +++ b/plugins/aws-transform/skills/aws-transform/references/continuous-modernization-discovery.md @@ -27,8 +27,8 @@ atx ct discovery scan --source --path # Scan a GitHub source (use the bare name from `source add --name`) atx ct discovery scan --source -# Check scan status -atx ct discovery status --source +# List the repos a scan registered +atx ct repository list --source --json ``` ## After discovery completes diff --git a/plugins/aws-transform/skills/aws-transform/references/continuous-modernization-findings.md b/plugins/aws-transform/skills/aws-transform/references/continuous-modernization-findings.md index c26e6a56..8eb86026 100644 --- a/plugins/aws-transform/skills/aws-transform/references/continuous-modernization-findings.md +++ b/plugins/aws-transform/skills/aws-transform/references/continuous-modernization-findings.md @@ -88,7 +88,7 @@ Filtering at the CLI is materially faster than pulling everything and filtering - Per-repo loops when a single `--source` filter would cover the whole batch. - Omitting `--status open` when the user only cares about live findings — `dismissed` and `obsolete` pile up over time. - Passing `--type` and `--analysis-id` together when `--analysis-id` alone already pins the result set to one run. -- "Auto-fixable" without a transform name → narrow with `--type tech-debt-quick` first. `tech-debt-quick` findings carry an ATX-transform fix; `security` findings carry a security-agent fix (see the [remediation](continuous-modernization-remediation.md) skill). Findings without a `fix` field may still be remediable — see the [remediation](continuous-modernization-remediation.md) skill's decision tree. +- "Auto-fixable" without a transform name → narrow with `--type rapid-techdebt-analysis` first. `rapid-techdebt-analysis` findings carry an ATX-transform fix; `security` findings carry a security-agent fix (see the [remediation](continuous-modernization-remediation.md) skill). Findings without a `fix` field may still be remediable — see the [remediation](continuous-modernization-remediation.md) skill's decision tree. - `--type` alone or `--type --severity`/`--type --min-severity` (no status, no repo) → add `--status open` to anchor on the live-triage shape. - Passing both `--severity` and `--min-severity` in the same call → the CLI rejects this. Pick one. - Treating the first page of `atx ct findings list` as the complete set when the response carries a non-empty `nextToken`. Page through with `--next-token ` until no `nextToken` remains — otherwise you silently drop findings. diff --git a/plugins/aws-transform/skills/aws-transform/references/continuous-modernization-reporting.md b/plugins/aws-transform/skills/aws-transform/references/continuous-modernization-reporting.md index 11700adc..44f78787 100644 --- a/plugins/aws-transform/skills/aws-transform/references/continuous-modernization-reporting.md +++ b/plugins/aws-transform/skills/aws-transform/references/continuous-modernization-reporting.md @@ -258,7 +258,7 @@ Fields (raw → normalized): `id`, `analysis_type` → `analysisType`, `status`, Two charts side-by-side: 1. Bar — severity counts. Use `status === 'open'` only. **Only include severity buckets that have at least one finding** — don't render zero-count columns. Iterate `['high','medium','low']` in that order, filter to non-zero, then plot. -2. Doughnut — analysis-type split (`quick-scan`, `tech-debt`, `security`, `agentic-readiness`, `custom`, `manual`). Same rule: only include types with at least one finding. +2. Doughnut — analysis-type split (`rapid-techdebt-analysis`, `tech-debt-comprehensive`, `security`, `agentic-readiness`, `modernization-readiness`, `custom`, `manual`). Same rule: only include types with at least one finding. **Severity enum is `high | medium | low`. There is no `critical`.** diff --git a/plugins/aws-transform/skills/aws-transform/references/continuous-modernization-security-agent.md b/plugins/aws-transform/skills/aws-transform/references/continuous-modernization-security-agent.md index ceea32a5..dc70af93 100644 --- a/plugins/aws-transform/skills/aws-transform/references/continuous-modernization-security-agent.md +++ b/plugins/aws-transform/skills/aws-transform/references/continuous-modernization-security-agent.md @@ -115,7 +115,7 @@ Do NOT proceed until status is `configured`. Once setup is verified, proceed with the normal analysis flow using `--type security`. The CLI discovers the security agent configuration from CloudFormation at runtime — no manual config steps are needed. ```bash -atx ct analysis run --type security --sources +atx ct analysis run --type security --source ``` The executor IAM policy required for runtime is documented in `AWSTransformSecurityAgentExecutorAccess.json` (included with this skill). diff --git a/plugins/aws-transform/skills/aws-transform/references/continuous-modernization-troubleshooting.md b/plugins/aws-transform/skills/aws-transform/references/continuous-modernization-troubleshooting.md index 378727f0..78dccd0f 100644 --- a/plugins/aws-transform/skills/aws-transform/references/continuous-modernization-troubleshooting.md +++ b/plugins/aws-transform/skills/aws-transform/references/continuous-modernization-troubleshooting.md @@ -25,7 +25,7 @@ then respond accordingly. | `discovery scan` reports **0 repos** | `--path` points at a repo instead of its parent, wrong org/identifier, or an empty source | "Found 0 repositories under ``." Check the org/identifier is correct; for `--provider local`, `--path` must be the **parent** directory that _contains_ Git repos, not a repo itself. | | Analysis / findings list is **empty** but shouldn't be | Wrong `AWS_REGION` (resources are region-scoped), analysis not run yet, or a read that silently failed | "No results found." Confirm `AWS_REGION` matches where your resources live, that an analysis has completed (`atx ct analysis list`), and re-run the read. If a read errored, surface the error — do not report "0". | | Security analysis shows **COMPLETED with 0 findings** after an error line | Findings could not be retrieved from the Security Agent | This is **not** a clean result. Retry the analysis; if it persists, verify AWS credentials/region and Security Agent access (`atx ct setup security-agent`). | -| `error: required option '--type ' not specified` | A required flag is missing or was transposed | Run the command with `--help` to see valid options and values. Note `--type` takes a value, e.g. `--type tech-debt-comprehensive`; don't pass the type as a bare flag like `--tech-debt-quick`. | +| `error: required option '--type ' not specified` | A required flag is missing or was transposed | Run the command with `--help` to see valid options and values. Note `--type` takes a value, e.g. `--type tech-debt-comprehensive`; don't pass the type as a bare flag like `--rapid-techdebt-analysis`. | | `error: unknown option '--xyz'` with `(Did you mean ...?)` | A misspelled or wrong flag | Use the suggested flag, or run the command with `--help` for the full list. | | 5xx / `InternalServerException` / throttling | Transient backend/infra issue | "The service hit a transient error." Retry shortly; if it persists, capture the Request ID from the message and contact support. | | Write to `~/.atxct` fails ("File access is restricted…") | Workspace folder access restriction | See "Error writing files to the `~/.atxct` folder" below — find another way to read/write it; there is no alternative location. |