thinkwork-cli 0.12.0 → 0.12.2

package/dist/cli.js

@@ -1744,13 +1744,66 @@ function finalizeAws(profile, mode) {
       `  Override per-command with --profile <other>, or unset with \`rm ~/.thinkwork/config.json\`.`
     )
   );
-  console.log("");
-  console.log(
-    `  ${chalk7.bold("Next:")} run ${chalk7.cyan("thinkwork login --stage <stage>")} if you also need`
-  );
-  console.log(
-    `        an API session (required for ${chalk7.cyan("eval")}, ${chalk7.cyan("agent")}, ${chalk7.cyan("thread")}, etc.).`
+  return identity;
+}
+async function offerApiLoginChain(opts) {
+  const stages = listDeployedStages(opts.region);
+  const candidates = stages.filter(
+    (stage) => loadStageSession(stage) === null
   );
+  if (candidates.length === 0 || !isInteractive()) {
+    console.log("");
+    console.log(
+      `  ${chalk7.bold("Next:")} run ${chalk7.cyan("thinkwork login --stage <stage>")} if you also need`
+    );
+    console.log(
+      `        an API session (required for ${chalk7.cyan("eval")}, ${chalk7.cyan("agent")}, ${chalk7.cyan("thread")}, etc.).`
+    );
+    return;
+  }
+  console.log("");
+  let chosen;
+  if (candidates.length === 1) {
+    const stage = candidates[0];
+    const answer = await select2({
+      message: `Also sign in to the API for stage "${stage}"? (required for eval / agent / thread)`,
+      choices: [
+        { name: `Yes \u2014 sign in to ${stage}`, value: stage },
+        { name: "No \u2014 skip", value: null }
+      ]
+    });
+    chosen = answer ?? null;
+  } else {
+    const skip = "__skip__";
+    const answer = await select2({
+      message: "Also sign in to an API stage now?",
+      choices: [
+        ...candidates.map((stage) => ({
+          name: `Yes \u2014 ${stage}`,
+          value: stage
+        })),
+        new Separator(),
+        { name: "Skip", value: skip }
+      ]
+    });
+    chosen = answer === skip ? null : answer;
+  }
+  if (!chosen) {
+    console.log("");
+    console.log(
+      chalk7.dim(
+        `  Skipped. Run ${chalk7.cyan("thinkwork login --stage <stage>")} later for an API session.`
+      )
+    );
+    return;
+  }
+  console.log("");
+  await doCognitoLogin({
+    stage: chosen,
+    region: opts.region,
+    port: opts.port,
+    noBrowser: opts.noBrowser
+  });
 }
 async function bootstrapUserAndTenant(stage, region, idToken) {
   const baseUrl = getApiEndpoint(stage, region);
@@ -1879,11 +1932,10 @@ async function doApiKeyLogin(opts) {
 }
 function registerLoginCommand(program2) {
   program2.command("login").description(
-    "Sign in. Without --stage: configure AWS credentials (for deploy / destroy). With --stage <s>: sign in to that stack's Cognito / API and cache a session for API-backed commands."
+    "Sign in. Without --stage: configure AWS credentials AND offer to sign in to a deployed stack's API (the natural one-step UX). With --stage <s>: go straight to that stack's Cognito / API login and cache a session for API-backed commands."
   ).option(
     "--profile <name>",
-    "AWS profile name to configure (used when entering new keys or SSO)",
-    "thinkwork"
+    'AWS profile name to configure (used when entering new keys or SSO). Defaults to "thinkwork" only on the AWS-credentials branch; the Cognito branch leaves AWS_PROFILE alone.'
   ).option("--sso", "Skip the picker and go straight to SSO login").option("--keys", "Skip the picker and go straight to access-key entry").option(
     "-s, --stage <name>",
     "Sign in to a deployed stack instead of configuring AWS credentials"
@@ -1951,32 +2003,41 @@ Registered callback URL:
           });
           return;
         }
-        const port = Number.parseInt(opts.port, 10);
-        if (!Number.isFinite(port) || port < 1 || port > 65535) {
+        const port2 = Number.parseInt(opts.port, 10);
+        if (!Number.isFinite(port2) || port2 < 1 || port2 > 65535) {
           printError(`Invalid --port value: "${opts.port}".`);
           process.exit(1);
         }
         await doCognitoLogin({
           stage: opts.stage,
           region: opts.region,
-          port,
+          port: port2,
           noBrowser: opts.browser === false
         });
         return;
       }
-      printHeader("login", opts.profile);
+      const targetProfile = opts.profile ?? "thinkwork";
+      printHeader("login", targetProfile);
       const awsOk = await ensureAwsCli();
       if (!awsOk) process.exit(1);
+      const port = Number.parseInt(opts.port, 10);
+      if (!Number.isFinite(port) || port < 1 || port > 65535) {
+        printError(`Invalid --port value: "${opts.port}".`);
+        process.exit(1);
+      }
+      const chainOpts = { port, noBrowser: opts.browser === false };
       if (opts.sso) {
-        if (!runSsoLogin(opts.profile)) process.exit(1);
-        process.env.AWS_PROFILE = opts.profile;
-        finalizeAws(opts.profile, "SSO");
+        if (!runSsoLogin(targetProfile)) process.exit(1);
+        process.env.AWS_PROFILE = targetProfile;
+        const { region: region2 } = finalizeAws(targetProfile, "SSO");
+        await offerApiLoginChain({ region: region2, ...chainOpts });
         return;
       }
       if (opts.keys) {
-        if (!await runKeyEntry(opts.profile)) process.exit(1);
-        process.env.AWS_PROFILE = opts.profile;
-        finalizeAws(opts.profile, "access keys");
+        if (!await runKeyEntry(targetProfile)) process.exit(1);
+        process.env.AWS_PROFILE = targetProfile;
+        const { region: region2 } = finalizeAws(targetProfile, "access keys");
+        await offerApiLoginChain({ region: region2, ...chainOpts });
         return;
       }
       const profiles = listAwsProfiles();
@@ -1986,9 +2047,10 @@ Registered callback URL:
         console.log(
           chalk7.dim("  Falling through to access-key entry for a new profile.")
         );
-        if (!await runKeyEntry(opts.profile)) process.exit(1);
-        process.env.AWS_PROFILE = opts.profile;
-        finalizeAws(opts.profile, "access keys");
+        if (!await runKeyEntry(targetProfile)) process.exit(1);
+        process.env.AWS_PROFILE = targetProfile;
+        const { region: region2 } = finalizeAws(targetProfile, "access keys");
+        await offerApiLoginChain({ region: region2, ...chainOpts });
         return;
       }
       const choice = await pickProfile(profiles);
@@ -1998,15 +2060,17 @@ Registered callback URL:
         return;
       }
       if (choice.kind === "keys") {
-        if (!await runKeyEntry(opts.profile)) process.exit(1);
-        process.env.AWS_PROFILE = opts.profile;
-        finalizeAws(opts.profile, "access keys");
+        if (!await runKeyEntry(targetProfile)) process.exit(1);
+        process.env.AWS_PROFILE = targetProfile;
+        const { region: region2 } = finalizeAws(targetProfile, "access keys");
+        await offerApiLoginChain({ region: region2, ...chainOpts });
         return;
       }
       if (choice.kind === "sso") {
-        if (!runSsoLogin(opts.profile)) process.exit(1);
-        process.env.AWS_PROFILE = opts.profile;
-        finalizeAws(opts.profile, "SSO");
+        if (!runSsoLogin(targetProfile)) process.exit(1);
+        process.env.AWS_PROFILE = targetProfile;
+        const { region: region2 } = finalizeAws(targetProfile, "SSO");
+        await offerApiLoginChain({ region: region2, ...chainOpts });
         return;
       }
       const picked = choice.name;
@@ -2020,7 +2084,8 @@ Registered callback URL:
         process.exit(1);
       }
       process.env.AWS_PROFILE = picked;
-      finalizeAws(picked, "existing profile");
+      const { region } = finalizeAws(picked, "existing profile");
+      await offerApiLoginChain({ region, ...chainOpts });
     }
   );
 }
@@ -8243,7 +8308,7 @@ async function runTenantSettingsSet(tenantArg, opts) {
     input20.autoCloseThreadMinutes = Math.round(Number.parseFloat(opts.autoCloseAfterDays) * 60 * 24);
   }
   const features = parseFeatureFlags(opts.feature);
-  if (features !== void 0) input20.features = features;
+  if (features !== void 0) input20.features = JSON.stringify(features);
   if (Object.keys(input20).length === 0) {
     printError(
       "Nothing to set. Pass at least one of --default-model, --monthly-budget-usd, --max-agents, --auto-close-after-days, --feature."

package/dist/terraform/modules/app/lambda-api/handlers.tf

@@ -253,12 +253,13 @@ locals {
     # the routine-approval-callback function name in the SFN execution
     # input so the inbox_approval recipe can fanout to it on .waitForTaskToken.
     "job-trigger" = {
-      AWS_ACCOUNT_ID                          = var.account_id
-      ROUTINE_APPROVAL_CALLBACK_FUNCTION_NAME = "thinkwork-${var.stage}-api-routine-approval-callback"
-      EMAIL_SEND_FUNCTION_NAME                = "thinkwork-${var.stage}-api-email-send"
-      ROUTINE_TASK_PYTHON_FUNCTION_NAME       = "thinkwork-${var.stage}-api-routine-task-python"
-      ADMIN_OPS_MCP_FUNCTION_NAME             = "thinkwork-${var.stage}-api-admin-ops-mcp"
-      SLACK_SEND_FUNCTION_NAME                = "thinkwork-${var.stage}-api-slack-send"
+      AWS_ACCOUNT_ID                            = var.account_id
+      ROUTINE_APPROVAL_CALLBACK_FUNCTION_NAME   = "thinkwork-${var.stage}-api-routine-approval-callback"
+      EMAIL_SEND_FUNCTION_NAME                  = "thinkwork-${var.stage}-api-email-send"
+      ROUTINE_TASK_PYTHON_FUNCTION_NAME         = "thinkwork-${var.stage}-api-routine-task-python"
+      ADMIN_OPS_MCP_FUNCTION_NAME               = "thinkwork-${var.stage}-api-admin-ops-mcp"
+      SLACK_SEND_FUNCTION_NAME                  = "thinkwork-${var.stage}-api-slack-send"
+      THREAD_IDLE_MEMORY_LEARNING_FUNCTION_NAME = "thinkwork-${var.stage}-api-thread-idle-memory-learning"
     }
     # Phase 3 U4 Compliance outbox drainer.
     # Connects to Aurora as the compliance_drainer role (provisioned in
@@ -307,6 +308,7 @@ resource "aws_lambda_function" "handler" {
     "budgets",
     "guardrails",
     "scheduled-jobs",
+    "thread-idle-memory-learning",
     "job-schedule-manager",
     "job-trigger",
     "routine-task-weather-email",

package/dist/terraform/modules/app/lambda-api/main.tf

@@ -535,6 +535,10 @@ resource "aws_iam_role_policy" "lambda_api_cross_invoke" {
         # decision. Calls SendTaskSuccess/SendTaskFailure on the SFN
         # task token; idempotent on already-consumed tokens.
         "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-routine-resume",
+        # thread-idle-memory-learning: job-trigger invokes this
+        # RequestResponse after a 15-minute requester-thread idle timer
+        # passes its stale guard.
+        "arn:aws:lambda:${var.region}:${var.account_id}:function:thinkwork-${var.stage}-api-thread-idle-memory-learning",
         # workspace-files-efs: workspace-files invokes this (RequestResponse)
         # for Computer-target list/get to bypass the computer_tasks queue
         # and read EFS directly. Standalone resource below.

package/dist/terraform/schema.graphql

@@ -212,63 +212,33 @@ type Mutation {
 
 type Subscription {
   _empty: String
-  onAgentStatusChanged(tenantId: ID!): AgentStatusEvent
-    @aws_api_key
-    @aws_cognito_user_pools
-    @aws_iam
+  onAgentStatusChanged(tenantId: ID!): AgentStatusEvent @aws_api_key @aws_cognito_user_pools @aws_iam
     @aws_subscribe(mutations: ["notifyAgentStatus"])
 
-  onNewMessage(threadId: ID!): NewMessageEvent
-    @aws_api_key
-    @aws_cognito_user_pools
-    @aws_iam
+  onNewMessage(threadId: ID!): NewMessageEvent @aws_api_key @aws_cognito_user_pools @aws_iam
     @aws_subscribe(mutations: ["notifyNewMessage"])
 
-  onHeartbeatActivity(tenantId: ID!): HeartbeatActivityEvent
-    @aws_api_key
-    @aws_cognito_user_pools
-    @aws_iam
+  onHeartbeatActivity(tenantId: ID!): HeartbeatActivityEvent @aws_api_key @aws_cognito_user_pools @aws_iam
     @aws_subscribe(mutations: ["notifyHeartbeatActivity"])
 
-  onThreadUpdated(tenantId: ID!): ThreadUpdateEvent
-    @aws_api_key
-    @aws_cognito_user_pools
-    @aws_iam
+  onThreadUpdated(tenantId: ID!): ThreadUpdateEvent @aws_api_key @aws_cognito_user_pools @aws_iam
     @aws_subscribe(mutations: ["notifyThreadUpdate"])
 
-  onInboxItemStatusChanged(tenantId: ID!): InboxItemStatusEvent
-    @aws_api_key
-    @aws_cognito_user_pools
-    @aws_iam
+  onInboxItemStatusChanged(tenantId: ID!): InboxItemStatusEvent @aws_api_key @aws_cognito_user_pools @aws_iam
     @aws_subscribe(mutations: ["notifyInboxItemUpdate"])
 
-  onThreadTurnUpdated(tenantId: ID!): ThreadTurnUpdateEvent
-    @aws_api_key
-    @aws_cognito_user_pools
-    @aws_iam
+  onThreadTurnUpdated(tenantId: ID!): ThreadTurnUpdateEvent @aws_api_key @aws_cognito_user_pools @aws_iam
     @aws_subscribe(mutations: ["notifyThreadTurnUpdate"])
 
-  onComputerThreadChunk(threadId: ID!): ComputerThreadChunkEvent
-    @aws_api_key
-    @aws_cognito_user_pools
-    @aws_iam
+  onComputerThreadChunk(threadId: ID!): ComputerThreadChunkEvent @aws_api_key @aws_cognito_user_pools @aws_iam
     @aws_subscribe(mutations: ["publishComputerThreadChunk"])
 
-  onOrgUpdated(tenantId: ID!): OrgUpdateEvent
-    @aws_api_key
-    @aws_cognito_user_pools
-    @aws_iam
+  onOrgUpdated(tenantId: ID!): OrgUpdateEvent @aws_api_key @aws_cognito_user_pools @aws_iam
     @aws_subscribe(mutations: ["notifyOrgUpdate"])
 
-  onCostRecorded(tenantId: ID!): CostRecordedEvent
-    @aws_api_key
-    @aws_cognito_user_pools
-    @aws_iam
+  onCostRecorded(tenantId: ID!): CostRecordedEvent @aws_api_key @aws_cognito_user_pools @aws_iam
     @aws_subscribe(mutations: ["notifyCostRecorded"])
 
-  onEvalRunUpdated(tenantId: ID!): EvalRunUpdateEvent
-    @aws_api_key
-    @aws_cognito_user_pools
-    @aws_iam
+  onEvalRunUpdated(tenantId: ID!): EvalRunUpdateEvent @aws_api_key @aws_cognito_user_pools @aws_iam
     @aws_subscribe(mutations: ["notifyEvalRunUpdate"])
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkwork-cli",
-  "version": "0.12.0",
+  "version": "0.12.2",
   "description": "Thinkwork CLI — deploy, manage, and interact with your Thinkwork stack",
   "license": "Apache-2.0",
   "type": "module",