utkarsh5026/lambwatch

lambda-watcher

Watch your Downloads folder for AWS Lambda deployment zips, archive every version automatically, and review what actually changed between any two of them.

If your deploy ritual is "download the current function zip as a backup, then push the new one", you end up with a folder of near-identical archives and no practical way to answer "what changed between the 2nd one and the 10th?". This tool turns that pile into a queryable, diffable history — with no change to how you work. You keep downloading zips; it does the rest.

How it works, step by step →

$ lambda-watcher watch
lambda-watcher 0.3.0 — archiving into ~/.lambda-watcher
watching ~/Downloads. Press Ctrl-C to stop.
               new  order-processor v0001  order-processor.zip — archived a new version
               new  order-processor v0002  order-processor (1).zip — 2 added, 2 modified, 9 renamed, 55 vendored
                    +24/-5 lines · new: 1 env var, 1 AWS service, 3 secrets
                    report: ~/.lambda-watcher/reports/order-processor/v0001-v0002.html
         unchanged  order-processor v0002  order-processor (2).zip — identical to version 2
done

That third line is the one that matters: the same code, downloaded again, is recorded as unchanged rather than becoming a bogus version 3.

---

What it does

Every time a .zip lands in your Downloads folder, lambda-watcher:

• waits until the download has actually finished (no half-written files);
• works out which Lambda it is from the filename, a sidecar

get-function JSON, or the archive's contents — order-processor.zip, order-processor (1).zip and order-processor-2026-03-01.zip all land under the same function;

• extracts it safely (path traversal, zip bombs and encrypted archives are

refused, not trusted);

• hashes the content, not the file — re-downloading unchanged code is

recorded as unchanged instead of creating a bogus new version;

• analyses it: runtime, handler, dependencies (declared and the versions

actually vendored in the zip), environment variables the code reads, AWS services it calls, and hardcoded credentials;

• archives it as version N with a manifest.json, indexes it in SQLite,