thinkwork-cli 0.12.11 → 0.12.15

package/dist/commands/enterprise/templates/deploy-repo/.github/workflows/deploy.yml

@@ -26,6 +26,7 @@ on:
           - all
           - foundation
           - artifacts
+          - web
           - overlays
           - smokes
       run_smokes:
@@ -105,24 +106,29 @@ jobs:
           terraform_wrapper: false
 
       - name: Prepare release artifacts
-        if: ${{ github.event.inputs.operation == 'deploy' && (github.event.inputs.component == 'all' || github.event.inputs.component == 'foundation' || github.event.inputs.component == 'artifacts') }}
+        if: ${{ github.event.inputs.operation == 'deploy' && (github.event.inputs.component == 'all' || github.event.inputs.component == 'foundation' || github.event.inputs.component == 'artifacts' || github.event.inputs.component == 'web') }}
         shell: bash
         run: |
           set -euo pipefail
+          PREPARE_ARGS=()
+          if [ "$COMPONENT" = "web" ]; then
+            PREPARE_ARGS+=(--artifact-type static-site --artifact-name web)
+          fi
           node scripts/apply-release.mjs prepare \
             --manifest "$RELEASE_MANIFEST" \
             --work-dir "$RELEASE_DIR" \
             --artifact-bucket "${{ steps.lock.outputs.artifact_bucket }}" \
-            --lambda-prefix "${{ steps.lock.outputs.lambda_prefix }}"
+            --lambda-prefix "${{ steps.lock.outputs.lambda_prefix }}" \
+            "${PREPARE_ARGS[@]}"
 
       - name: Terraform init
-        if: ${{ github.event.inputs.operation == 'destroy' || github.event.inputs.component == 'all' || github.event.inputs.component == 'foundation' || github.event.inputs.component == 'artifacts' || github.event.inputs.component == 'smokes' }}
+        if: ${{ github.event.inputs.operation == 'destroy' || github.event.inputs.component == 'all' || github.event.inputs.component == 'foundation' || github.event.inputs.component == 'artifacts' || github.event.inputs.component == 'web' || github.event.inputs.component == 'smokes' }}
         working-directory: terraform
         shell: bash
         run: terraform init -backend-config="backend-${STAGE}.hcl"
 
       - name: Select Terraform workspace
-        if: ${{ github.event.inputs.operation == 'destroy' || github.event.inputs.component == 'all' || github.event.inputs.component == 'foundation' || github.event.inputs.component == 'artifacts' || github.event.inputs.component == 'smokes' }}
+        if: ${{ github.event.inputs.operation == 'destroy' || github.event.inputs.component == 'all' || github.event.inputs.component == 'foundation' || github.event.inputs.component == 'artifacts' || github.event.inputs.component == 'web' || github.event.inputs.component == 'smokes' }}
         working-directory: terraform
         shell: bash
         run: |
@@ -187,14 +193,19 @@ jobs:
             --region "${{ vars.AWS_REGION }}"
 
       - name: Sync static site bundles
-        if: ${{ github.event.inputs.operation == 'deploy' && (github.event.inputs.component == 'all' || github.event.inputs.component == 'foundation' || github.event.inputs.component == 'artifacts') }}
+        if: ${{ github.event.inputs.operation == 'deploy' && (github.event.inputs.component == 'all' || github.event.inputs.component == 'foundation' || github.event.inputs.component == 'artifacts' || github.event.inputs.component == 'web') }}
         shell: bash
         run: |
           set -euo pipefail
+          STATIC_ARGS=()
+          if [ "$COMPONENT" = "web" ]; then
+            STATIC_ARGS+=(--artifact-name web)
+          fi
           node scripts/apply-release.mjs sync-static \
             --manifest "$RELEASE_MANIFEST" \
             --work-dir "$RELEASE_DIR" \
-            --terraform-dir terraform
+            --terraform-dir terraform \
+            "${STATIC_ARGS[@]}"
 
       - name: Apply customer overlay contract
         if: ${{ github.event.inputs.operation == 'deploy' && (github.event.inputs.component == 'all' || github.event.inputs.component == 'overlays') }}

package/dist/commands/enterprise/templates/deploy-repo/docs/runbook.md

@@ -5,12 +5,22 @@
 This repository deploys a pinned ThinkWork release into the customer AWS
 account. It is a deployment repository, not a source fork.
 
+> Legacy compatibility: new customer-owned deployments should use the
+> GitHub-free AWS control-plane bootstrap. This generated repository runbook is
+> retained for existing customers that still operate through GitHub Actions.
+
 The exact operational path is:
 
 ```text
 bootstrap -> workflow dispatch -> CI deploy -> overlay apply -> smoke summary
 ```
 
+The GitHub-free operational path is:
+
+```text
+bootstrap -> customer AWS Step Functions -> CodeBuild deploy -> smoke evidence
+```
+
 ## First-Time Setup
 
 Run these commands from an operator machine with temporary customer AWS admin
@@ -148,18 +158,58 @@ one-line flow into explicit steps.
      -f run_smokes=false
    ```
 
-   Prefer `thinkwork destroy`; use direct `gh workflow run` only as a
-   troubleshooting fallback.
+Prefer `thinkwork destroy`; use direct `gh workflow run` only as a
+troubleshooting fallback.
+
+## GitHub-Free Bootstrap Smoke
+
+When operating a GitHub-free customer deployment, run the foundation smoke from
+the ThinkWork release workspace or support checkout after bootstrap:
+
+```bash
+node scripts/smoke/foundation-bootstrap-smoke.mjs
+
+SMOKE_ENABLE_FOUNDATION_BOOTSTRAP=1 \
+  SMOKE_TERRAFORM_DIR=terraform/examples/greenfield \
+  SMOKE_EVIDENCE_FILE=deploy-artifacts/foundation-smoke.json \
+  node scripts/smoke/foundation-bootstrap-smoke.mjs
+```
+
+Set `SMOKE_EVIDENCE_S3_URI=s3://<evidence-bucket>/<prefix>` to upload the
+evidence envelope. The evidence must include release/manifest identifiers,
+deployment job identifiers when available, endpoint status, and smoke results.
+It must not include secrets.
+
+## Managed Application Smokes
+
+Run managed-app smokes after deploy, destroy, park, or release upgrade jobs:
+
+```bash
+SMOKE_ENABLE_COGNEE_MANAGED_APP=1 \
+  SMOKE_TENANT_ID=<tenant-id> \
+  SMOKE_EVIDENCE_FILE=deploy-artifacts/cognee-smoke.json \
+  node plugins/company-brain/smoke/cognee-managed-app-smoke.mjs
+
+SMOKE_ENABLE_TWENTY_MANAGED_APP=1 \
+  SMOKE_TENANT_ID=<tenant-id> \
+  SMOKE_EVIDENCE_FILE=deploy-artifacts/twenty-smoke.json \
+  node plugins/twenty/smoke/twenty-managed-app-smoke.mjs
+```
+
+Cognee and Twenty smokes skip with explicit evidence when the app is not
+enabled, unprovisioned, or parked. A skipped smoke is valid evidence only when
+that app state is intentional for the stage.
 
 ## Workflow Components
 
-| Component    | What it does                                                                                                                                           |
-| ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `all`        | First deploy and normal release upgrades: release artifact prep, Terraform apply, runtime image copy, AgentCore update, static sync, overlays, smokes. |
-| `foundation` | Terraform apply and artifact/runtime/static sync without overlays.                                                                                     |
-| `artifacts`  | Re-copy pinned Lambda/static/runtime artifacts without Terraform apply.                                                                                |
-| `overlays`   | Apply only `customer/` evals, skills, workspace defaults, seeds, and branding records.                                                                 |
-| `smokes`     | Run smoke checks against an already-deployed stage.                                                                                                    |
+| Component    | What it does                                                                                                                                            |
+| ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `all`        | First deploy and normal release upgrades: release artifact prep, Terraform apply, runtime image copy, AgentCore update, static sync, overlays, smokes.  |
+| `foundation` | Terraform apply and artifact/runtime/static sync without overlays.                                                                                      |
+| `artifacts`  | Re-copy pinned Lambda/static/runtime artifacts without Terraform apply.                                                                                 |
+| `web`        | Sync only the pinned end-user web static bundle and invalidate its CloudFront distribution. Does not apply Terraform, copy lambdas, or update runtimes. |
+| `overlays`   | Apply only `customer/` evals, skills, workspace defaults, seeds, and branding records.                                                                  |
+| `smokes`     | Run smoke checks against an already-deployed stage.                                                                                                     |
 
 Set workflow `operation=destroy` to remove the selected stage stack. Destroy
 always uses Terraform for the whole stage; component-specific destroy is not
@@ -223,6 +273,17 @@ supported.
    thinkwork deploy --customer {{CUSTOMER_SLUG}} --stage dev --component all
    ```
 
+For a web-application-only redeploy after updating `thinkwork.lock`, use:
+
+```bash
+thinkwork deploy --customer {{CUSTOMER_SLUG}} --stage dev --component web --no-run-smokes
+```
+
+This path reads existing Terraform outputs for the web bucket and CloudFront
+distribution, syncs only the `web` static release artifact, and invalidates the
+web distribution. It intentionally skips Terraform apply, Lambda artifact
+promotion, runtime image copy, AgentCore updates, overlays, and database work.
+
 3. Deploy to production after dev passes.
 
 ## Secrets
@@ -237,6 +298,17 @@ Never commit secrets. Supported secret homes are:
 Do not store plaintext secrets in `terraform/stages/*.tfvars`, `.env`,
 `customer/`, or runbook files.
 
+## GitHub-Free Failure Triage
+
+| Failure                           | First response                                                                                                      |
+| --------------------------------- | ------------------------------------------------------------------------------------------------------------------- |
+| Manifest verification failed      | Stop before mutation. Fetch a trusted release manifest and compare the expected SHA-256.                            |
+| Plan failed                       | Inspect the CodeBuild log and Terraform plan artifact linked from the deployment job.                               |
+| Apply failed                      | Inspect Step Functions event history, then CodeBuild logs. Retry only after preserving evidence.                    |
+| Smoke failed                      | Attach the smoke evidence JSON to the deployment job/support case and inspect endpoint-specific details.            |
+| First-admin claim mismatch        | Verify Cognito email verification and the bootstrap first-admin email.                                              |
+| Deployment profile import blocked | Confirm required profile fields, TLS URLs, signature trust, and that the user signed out before replacing profiles. |
+
 ## Rollback
 
 To roll back application code, restore `thinkwork.lock` to the previously

package/dist/commands/enterprise/templates/deploy-repo/scripts/apply-release.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // thinkwork-managed: enterprise-deploy-template
 import { createHash } from "node:crypto";
-import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { execFileSync } from "node:child_process";
 
@@ -52,8 +52,20 @@ async function validateManifest() {
       `Release manifest version ${manifest.release?.version} does not match lock ${expectedRelease}`,
     );
   }
+  const hasBundle = (manifest.artifactBundles ?? []).length > 0;
+  for (const bundle of manifest.artifactBundles ?? []) {
+    if (!bundle.url || !bundle.sha256 || !bundle.fileName) {
+      throw new Error(
+        `Release artifact bundle ${bundle.name} is missing url, sha256, or fileName`,
+      );
+    }
+  }
   for (const artifact of manifest.artifacts ?? []) {
-    if (!artifact.url || !artifact.sha256 || !artifact.fileName) {
+    if (
+      (!hasBundle && !artifact.url) ||
+      !artifact.sha256 ||
+      !artifact.fileName
+    ) {
       throw new Error(
         `Release artifact ${artifact.name} is missing url, sha256, or fileName`,
       );
@@ -67,13 +79,17 @@ async function prepareArtifacts() {
   const workDir = required("--work-dir");
   const artifactBucket = required("--artifact-bucket");
   const lambdaPrefix = required("--lambda-prefix").replace(/^\/+|\/+$/g, "");
+  const artifactType = optional("--artifact-type");
+  const artifactName = optional("--artifact-name");
   const downloadDir = join(workDir, "downloads");
   await mkdir(downloadDir, { recursive: true });
+  const bundle = await prepareArtifactBundle(manifest, downloadDir);
 
   const prepared = [];
   for (const artifact of manifest.artifacts ?? []) {
-    const localPath = join(downloadDir, artifact.fileName);
-    await downloadAndVerify(artifact, localPath);
+    if (artifactType && artifact.type !== artifactType) continue;
+    if (artifactName && artifact.name !== artifactName) continue;
+    const localPath = await prepareArtifact(artifact, downloadDir, bundle);
     prepared.push({ ...artifact, localPath });
     if (artifact.type === "lambda") {
       run("aws", [
@@ -84,6 +100,11 @@ async function prepareArtifacts() {
       ]);
     }
   }
+  if ((artifactType || artifactName) && prepared.length === 0) {
+    throw new Error(
+      `No release artifacts matched${artifactType ? ` type=${artifactType}` : ""}${artifactName ? ` name=${artifactName}` : ""}`,
+    );
+  }
 
   await writeJson(join(workDir, "prepared-artifacts.json"), {
     release: manifest.release,
@@ -91,6 +112,35 @@ async function prepareArtifacts() {
   });
 }
 
+async function prepareArtifactBundle(manifest, downloadDir) {
+  const bundle = (manifest.artifactBundles ?? [])[0];
+  if (!bundle) return null;
+
+  const localPath = join(downloadDir, bundle.fileName);
+  await downloadAndVerify(bundle, localPath);
+
+  const extractDir = join(downloadDir, "platform-artifacts");
+  await rm(extractDir, { recursive: true, force: true });
+  await mkdir(extractDir, { recursive: true });
+  run("tar", ["-xzf", localPath, "-C", extractDir]);
+
+  return { ...bundle, localPath, extractDir };
+}
+
+async function prepareArtifact(artifact, downloadDir, bundle) {
+  if (artifact.url) {
+    const localPath = join(downloadDir, artifact.fileName);
+    await downloadAndVerify(artifact, localPath);
+    return localPath;
+  }
+  if (!bundle) {
+    throw new Error(`Release artifact ${artifact.name} is missing url`);
+  }
+  const localPath = join(bundle.extractDir, artifact.relativePath);
+  await verifyExistingArtifact(artifact, localPath);
+  return localPath;
+}
+
 async function copyRuntimeImages() {
   const manifest = await readManifest(required("--manifest"));
   const workDir = required("--work-dir");
@@ -138,16 +188,25 @@ async function updateAgentCoreRuntimes() {
     "text",
   ]);
 
-  for (const runtime of ["strands", "flue"]) {
+  for (const runtime of ["strands", "pi"]) {
     const image = copied.find(
       (item) => item.runtime === runtime && item.architecture === "arm64",
     );
     if (!image) continue;
+    if (runtime === "pi") {
+      updates.push(
+        updatePiLambdaRuntime({
+          stage,
+          region,
+          imageUri: image.stageUri,
+        }),
+      );
+    }
     const runtimeId = findAgentCoreRuntimeId({ stage, runtime, region });
     if (!runtimeId) {
-      if (runtime === "flue") {
+      if (runtime === "pi") {
         updates.push(
-          createFlueAgentCoreRuntime({
+          createPiAgentCoreRuntime({
             stage,
             region,
             accountId,
@@ -175,6 +234,87 @@ async function updateAgentCoreRuntimes() {
   await writeJson(join(workDir, "runtime-updates.json"), updates);
 }
 
+function updatePiLambdaRuntime({ stage, region, imageUri }) {
+  const functionName = `thinkwork-${stage}-agentcore-pi`;
+  const expectedDigest = resolveEcrImageDigest({ imageUri, region });
+  run("aws", [
+    "lambda",
+    "update-function-code",
+    "--region",
+    region,
+    "--function-name",
+    functionName,
+    "--image-uri",
+    imageUri,
+  ]);
+  run("aws", [
+    "lambda",
+    "wait",
+    "function-updated",
+    "--region",
+    region,
+    "--function-name",
+    functionName,
+  ]);
+
+  const fn = awsJson([
+    "lambda",
+    "get-function",
+    "--region",
+    region,
+    "--function-name",
+    functionName,
+    "--output",
+    "json",
+  ]);
+  const resolvedImageUri = fn.Code?.ResolvedImageUri ?? "";
+  if (!resolvedImageUri.endsWith(`@${expectedDigest}`)) {
+    throw new Error(
+      `${functionName} resolved ${resolvedImageUri || "(missing)"} instead of ${expectedDigest}`,
+    );
+  }
+
+  return {
+    runtime: "pi-lambda",
+    status: "updated",
+    image: imageUri,
+    resolvedImageUri,
+    functionName,
+  };
+}
+
+function resolveEcrImageDigest({ imageUri, region }) {
+  const parsed = parseEcrImageUri(imageUri);
+  const image = awsJson([
+    "ecr",
+    "describe-images",
+    "--region",
+    region,
+    "--repository-name",
+    parsed.repositoryName,
+    "--image-ids",
+    `imageTag=${parsed.tag}`,
+    "--query",
+    "imageDetails[0]",
+    "--output",
+    "json",
+  ]);
+  if (!image?.imageDigest) {
+    throw new Error(`Could not resolve ECR image digest for ${imageUri}`);
+  }
+  return image.imageDigest;
+}
+
+function parseEcrImageUri(imageUri) {
+  const match = imageUri.match(
+    /^[^.]+\.dkr\.ecr\.[^.]+\.amazonaws\.com\/(.+):([^:@]+)$/,
+  );
+  if (!match) {
+    throw new Error(`Expected tagged ECR image URI, got ${imageUri}`);
+  }
+  return { repositoryName: match[1], tag: match[2] };
+}
+
 function findAgentCoreRuntimeId({ stage, runtime, region }) {
   const parameterValue = awsText([
     "ssm",
@@ -204,11 +344,11 @@ function findAgentCoreRuntimeId({ stage, runtime, region }) {
   return listed && listed !== "None" ? listed : "";
 }
 
-function createFlueAgentCoreRuntime({ stage, region, accountId, imageUri }) {
+function createPiAgentCoreRuntime({ stage, region, accountId, imageUri }) {
   if (!accountId) {
-    throw new Error("AWS account ID is required to create the Flue runtime");
+    throw new Error("AWS account ID is required to create the Pi runtime");
   }
-  const runtimeNameValue = `thinkwork_${stage}_flue`;
+  const runtimeNameValue = `thinkwork_${stage}_pi`;
   const runtimeId = awsText([
     "bedrock-agentcore-control",
     "create-agent-runtime",
@@ -219,7 +359,7 @@ function createFlueAgentCoreRuntime({ stage, region, accountId, imageUri }) {
     "--agent-runtime-artifact",
     `containerConfiguration={containerUri=${imageUri}}`,
     "--role-arn",
-    canonicalAgentCoreRoleArn({ stage, runtime: "flue", accountId }),
+    canonicalAgentCoreRoleArn({ stage, runtime: "pi", accountId }),
     "--network-configuration",
     "networkMode=PUBLIC",
     "--protocol-configuration",
@@ -236,7 +376,7 @@ function createFlueAgentCoreRuntime({ stage, region, accountId, imageUri }) {
     "ssm",
     "put-parameter",
     "--name",
-    `/thinkwork/${stage}/agentcore/runtime-id-flue`,
+    `/thinkwork/${stage}/agentcore/runtime-id-pi`,
     "--value",
     runtimeId,
     "--type",
@@ -245,9 +385,9 @@ function createFlueAgentCoreRuntime({ stage, region, accountId, imageUri }) {
     "--region",
     region,
   ]);
-  waitForAgentCoreRuntime({ runtime: "flue", runtimeId, region, imageUri });
+  waitForAgentCoreRuntime({ runtime: "pi", runtimeId, region, imageUri });
   return {
-    runtime: "flue",
+    runtime: "pi",
     status: "created",
     image: imageUri,
     runtimeId,
@@ -369,8 +509,8 @@ function waitForAgentCoreRuntime({
 
 function canonicalAgentCoreRoleArn({ stage, runtime, accountId }) {
   const roleName =
-    runtime === "flue"
-      ? `thinkwork-${stage}-agentcore-flue-role`
+    runtime === "pi"
+      ? `thinkwork-${stage}-agentcore-pi-role`
       : `thinkwork-${stage}-agentcore-role`;
   return `arn:aws:iam::${accountId}:role/${roleName}`;
 }
@@ -379,6 +519,7 @@ async function syncStaticSites() {
   const manifest = await readManifest(required("--manifest"));
   const workDir = required("--work-dir");
   const terraformDir = required("--terraform-dir");
+  const artifactName = optional("--artifact-name");
   const prepared = await readJson(join(workDir, "prepared-artifacts.json"), {
     artifacts: [],
   });
@@ -388,7 +529,8 @@ async function syncStaticSites() {
   const synced = [];
 
   for (const artifact of manifest.artifacts?.filter(
-    (item) => item.type === "static-site",
+    (item) =>
+      item.type === "static-site" && (!artifactName || item.name === artifactName),
   ) ?? []) {
     const localPath = downloadByName.get(artifact.name);
     if (!localPath) {
@@ -398,19 +540,21 @@ async function syncStaticSites() {
     await rm(extractDir, { recursive: true, force: true });
     await mkdir(extractDir, { recursive: true });
     run("tar", ["-xzf", localPath, "-C", extractDir]);
+    const terraformOutputPrefix =
+      artifact.name === "spaces" ? "computer" : artifact.name;
     const bucket = terraformOutput(
       terraformDir,
-      `${artifact.name}_bucket_name`,
+      `${terraformOutputPrefix}_bucket_name`,
     );
     if (!bucket) {
       throw new Error(
-        `Terraform output ${artifact.name}_bucket_name is missing`,
+        `Terraform output ${terraformOutputPrefix}_bucket_name is missing`,
       );
     }
     run("aws", ["s3", "sync", "--delete", extractDir, `s3://${bucket}/`]);
     const distributionId = terraformOutput(
       terraformDir,
-      `${artifact.name}_distribution_id`,
+      `${terraformOutputPrefix}_distribution_id`,
     );
     if (distributionId) {
       run("aws", [
@@ -491,9 +635,27 @@ async function downloadAndVerify(artifact, localPath) {
   }
 }
 
+async function verifyExistingArtifact(artifact, localPath) {
+  try {
+    const fileStat = await stat(localPath);
+    if (!fileStat.isFile()) {
+      throw new Error(`not a file`);
+    }
+  } catch {
+    throw new Error(
+      `Bundled release artifact ${artifact.name} is missing at ${artifact.relativePath}`,
+    );
+  }
+  const actual = await sha256File(localPath);
+  if (actual !== artifact.sha256) {
+    throw new Error(`Checksum mismatch for ${artifact.name}: got ${actual}`);
+  }
+}
+
 function terraformOutputs(terraformDir) {
   const names = [
     "api_endpoint",
+    "app_url",
     "admin_url",
     "computer_url",
     "docs_url",
@@ -565,7 +727,7 @@ async function sha256File(path) {
 }
 
 function runtimeName(name) {
-  if (name.includes("flue")) return "flue";
+  if (name.includes("pi")) return "pi";
   if (name.includes("strands")) return "strands";
   return name;
 }

package/dist/commands/enterprise/templates/deploy-repo/scripts/smoke.mjs

@@ -12,8 +12,7 @@ try {
   const outputPath = required("--summary");
   const targets = [
     ["api_endpoint", "api"],
-    ["admin_url", "admin"],
-    ["computer_url", "computer"],
+    ["app_url", "web"],
     ["docs_url", "docs"],
   ]
     .map(([output, name]) => ({