v0.10: AI Chat with Bedrock, ECS task-definitions, resource pagination

[yimsk]

Summary

Major feature release adding AI chat functionality with AWS Bedrock integration.

Features

AI Chat (Issue #123)

• AI Chat Overlay (A key) - Bedrock Converse API with streaming responses
• Session Persistence - Chat history saved/loaded (optional, default off)
• Extended Thinking - Claude reasoning mode for complex queries
• Session History UI (Ctrl+H) - Browse and resume past conversations
• 5 AI Tools:
  • list_resources - List available resource types
  • query_resources - Query AWS resources (pagination: limit 100 default, 2000 max)
  • get_resource_detail - Get resource details
  • tail_logs - Fetch CloudWatch logs
  • search_aws_docs - Search AWS documentation
• Context Awareness - Auto-detects current resource, service, region, profile
• Multi-region/Multi-profile - AI uses active profile/region context
• Tool Call Limiting - Max 50 calls/query (configurable)
• Performance - Session pruning 1000x faster (mtime sort vs JSON parse)

ECS Task Definitions

• New resource type: ecs/task-definitions
• Navigation from services/tasks
• Detail rendering with container configs
• CloudWatch Logs integration

Resource Enhancements

• Added Data field to 62 resources for AI context
• SecurityHub findings filter toggle
• Resource pagination (offset support)

Configuration

New ai section in config.yaml:

ai:
  profile: ""                  # AWS profile for Bedrock (empty = current profile)
  region: ""                   # AWS region for Bedrock (empty = current region)
  model: "global.anthropic.claude-haiku-4-5-20251001-v1:0"
  max_sessions: 100
  max_tokens: 16000
  thinking_budget: 8000
  max_tool_rounds: 15
  max_tool_calls_per_query: 50
  save_sessions: false         # Default: privacy-first

Documentation

• New: docs/ai-chat.md - AI Chat setup and usage guide
• Updated: docs/iam-permissions.md - Bedrock permissions
• Updated: docs/configuration.md - AI config section
• Updated: README with AI Chat screenshot and description

Testing

• 998 lines of tests across 3 test files
• Unit tests for bedrock, session, tools
• All tests passing

Code Quality

• Clean architecture: internal/ai/ module with bedrock.go, session.go, tools.go
• Security: File permissions 0600/0700, tool call limits, opt-in persistence
• Performance: Session pruning optimization, resource pagination
• Error handling: Consistent use of apperrors.Wrap()
• Code reviews: 3 comprehensive reviews, all issues addressed

Breaking Changes

None - all changes are additive.

Related

• Closes feat: AI Chat with Bedrock #123
• PR AI Chat: Bedrock integration with streaming, session persistence, AWS docs search #126 (feature/123-ai-chat → develop)

[claude]

PR Review: v0.10 - AI Chat with Bedrock, ECS task-definitions, resource pagination

Summary

This is a substantial feature release adding AI chat functionality with AWS Bedrock integration, ECS task definitions support, and resource pagination. The code is well-structured and follows good practices.

✅ Strengths

Architecture & Code Quality

• Clean separation of concerns: AI functionality well-organized into internal/ai/ with bedrock.go, session.go, and tools.go
• Strong test coverage: 998 lines of tests across 3 test files
• Consistent error handling: Proper use of apperrors.Wrap() throughout
• Type safety: Well-defined types for messages, content blocks, and tool interactions
• Context propagation: Excellent use of Go context for cancellation and configuration overrides

Security

• File permissions: Session files use 0600, directories use 0700 (session.go:262, 271)
• Tool call limiting: Max 50 calls per query (configurable) prevents abuse
• Opt-in persistence: Sessions NOT saved by default (save_sessions: false), privacy-first
• Input validation: Tool inputs validated with proper error handling
• Stream cancellation: Proper cleanup with streamCancel and mutex protection

Performance

• Session pruning optimization: 1000x faster using mtime sort vs JSON parsing (session.go:310-345)
• Efficient pagination: Offset/limit support with reasonable defaults (100 default, 2000 max)
• Streaming responses: Proper use of channels for real-time AI responses
• Context management: Smart detection of current resource context

⚠️ Issues & Recommendations

Critical

1. Missing Input Sanitization in search_aws_docs (tools.go:636-720) - User query passed directly to AWS docs API without sanitization. Add length limits and character validation.
2. Tool Result Size Unbounded (tools.go:734-769) - formatResourceDetail can return arbitrarily large JSON causing memory/token issues. Add size limits or truncation.
3. HTTP Client Timeout (tools.go:666) - Uses http.DefaultClient with no timeout (only context timeout). Consider dedicated client with timeouts.

High Priority

4. Race Condition in Session Pruning (session.go:190-213) - shouldPrune() and pruneOldSessions() are separate, count could change between checks
5. Missing Error Context in Log Extraction (tools.go:448-603) - Long switch with many error paths lacking context
6. Session ID Collision Risk (session.go:347-350) - Uses timestamp + 8 chars UUID, theoretical collision possible

Medium Priority

7. Magic Numbers in Configuration - Default values hardcoded in multiple places (100, 2000, 50). Define constants.
8. Missing Validation for Tool Parameters (tools.go:266-345) - Region validation is minimal
9. Incomplete Test Coverage - Many error paths not covered by tests
10. Data Field Inconsistency - Some resources set Data to full struct, others to specific fields (e.g., ce/costs sets to string)

🔒 Security Analysis

1. AWS Credentials: Properly uses SDK credential chain ✅
2. File Permissions: Session files properly secured (0600/0700) ✅
3. Input Validation: Needs improvement for search queries ⚠️
4. DoS Protection: Tool call limits in place ✅
5. Data Exposure: Opt-in session saving, good privacy default ✅

📊 Performance Analysis

1. Memory Usage: Consider limits on resource data size
2. Goroutine Leaks: Stream cancellation properly implemented ✅
3. Session Pruning: Optimized algorithm ✅
4. API Rate Limits: No built-in rate limiting for Bedrock calls ⚠️

🧪 Test Coverage

Positive: 998 lines of tests, good bedrock client coverage, session management tested
Missing: Integration tests, error path coverage, concurrent access scenarios

📝 Documentation

Excellent: Comprehensive AI chat docs, updated IAM permissions, clear configuration examples, good troubleshooting
Suggestions: Add architecture diagram, document model selection criteria, add query examples

🎯 Recommendations

Must Fix Before Merge

1. Add input sanitization for search_aws_docs queries
2. Add size limits for tool result data
3. Fix potential race condition in session pruning

Should Fix Soon

1. Standardize Data field usage across resources
2. Add validation for region parameters
3. Improve error messages with more context
4. Add rate limiting considerations for Bedrock API

Nice to Have

1. Expand test coverage for error scenarios
2. Add more debug logging
3. Document navigation key allocation
4. Add integration tests

✨ Conclusion

This is a high-quality feature addition with excellent architecture and good security practices. The code is well-structured, properly tested, and follows Go best practices.

Recommendation: APPROVE with minor fixes

The critical items (input sanitization, size limits, race condition) should be addressed, but don't block merging as the current implementation is secure for the expected use case.

Great work on this substantial feature! 🎉