thinkwork-cli 0.12.11 → 0.12.15

package/dist/terraform/examples/greenfield/terraform.tfvars.example

@@ -13,12 +13,59 @@ account_id = "123456789012"  # your AWS account ID
 database_engine = "rds-postgres"
 
 # Memory:
-#   AgentCore managed memory is always on — every agent gets automatic
-#   per-turn retention with zero config. Uncomment the line below to
-#   enable Hindsight as an optional add-on (adds an ECS+ALB service for
-#   semantic + entity-graph + cross-encoder retrieval tools alongside the
-#   built-in remember/recall/forget tools).
-# enable_hindsight = true
+#   Hindsight is the canonical user and Space memory provider for full
+#   ThinkWork installs and is enabled by default. Set enable_hindsight = false
+#   and memory_engine = "agentcore" only for explicit low-cost/development
+#   AgentCore-only deployments.
+# enable_hindsight = false
+# memory_engine    = "agentcore"
+
+# Managed applications:
+#   Twenty CRM is optional. First enable should set both booleans true after
+#   the deployment workflow has created the dedicated database URL secret and
+#   encryption-key secret. Later disable should leave twenty_provisioned=true
+#   and set twenty_runtime_enabled=false so CRM data/storage/cache are retained.
+#   Full cleanup should set both booleans false through the Managed
+#   Applications Destroy action so the deploy workflow can also drop the
+#   dedicated database and delete Twenty secrets after Terraform teardown.
+#
+# twenty_provisioned                = false
+# twenty_runtime_enabled            = false
+# twenty_image_uri                  = "twentycrm/twenty@sha256:..."
+# twenty_db_username                = "thinkwork_twenty"
+# twenty_db_name                    = "thinkwork_twenty"
+# twenty_db_url_secret_arn          = "arn:aws:secretsmanager:us-east-1:123456789012:secret:thinkwork/dev/twenty/db-url-..."
+# twenty_encryption_key_secret_arn  = "arn:aws:secretsmanager:us-east-1:123456789012:secret:thinkwork/dev/twenty/encryption-key-..."
+# twenty_public_url                 = "" # empty derives https://crm.<www_domain>
+# twenty_certificate_arn            = "" # empty creates a dedicated crm.<www_domain> certificate
+# twenty_email_from_address         = "" # empty derives noreply@ses_inbound_domain for SES SMTP
+# twenty_email_from_name            = "ThinkWork CRM"
+#
+#   n8n is optional. First enable should set both booleans true after the
+#   managed-app workflow has prepared the dedicated thinkwork_n8n database URL
+#   secret, N8N_ENCRYPTION_KEY secret, shared operator credential, tenant
+#   service credential, wrapper image, and retained artifact bucket. Later
+#   disable should leave n8n_provisioned=true and set
+#   n8n_runtime_enabled=false so workflow data, credentials, cache, and
+#   artifacts are retained.
+#
+# n8n_provisioned                       = false
+# n8n_runtime_enabled                   = false
+# n8n_image_uri                         = "123456789012.dkr.ecr.us-east-1.amazonaws.com/thinkwork-n8n@sha256:..."
+# n8n_database_admin_secret_arn         = "arn:aws:secretsmanager:us-east-1:123456789012:secret:thinkwork/dev/database-admin-..."
+# n8n_database_url_secret_arn           = "arn:aws:secretsmanager:us-east-1:123456789012:secret:thinkwork/dev/n8n/database-url-..."
+# n8n_database_username                 = "thinkwork_n8n"
+# n8n_database_name                     = "thinkwork_n8n"
+# n8n_encryption_key_secret_arn         = "arn:aws:secretsmanager:us-east-1:123456789012:secret:thinkwork/dev/n8n/encryption-key-..."
+# n8n_operator_secret_arn               = "arn:aws:secretsmanager:us-east-1:123456789012:secret:thinkwork/dev/n8n/operator-..."
+# n8n_service_credential_secret_arn     = "arn:aws:secretsmanager:us-east-1:123456789012:secret:thinkwork/dev/n8n/service-credential-..."
+# n8n_agent_step_bridge_credential_secret_arn = "arn:aws:secretsmanager:us-east-1:123456789012:secret:thinkwork/dev/n8n/agent-step-bridge-credential-..."
+# n8n_storage_bucket_name               = "thinkwork-dev-n8n"
+# n8n_container_port                    = 5678
+# n8n_cache_engine                      = "valkey"
+# n8n_domain                            = "" # empty derives n8n.<www_domain>
+# n8n_public_url                        = "" # empty derives https://n8n.<www_domain>
+# n8n_certificate_arn                   = "" # empty creates a dedicated n8n.<www_domain> certificate
 
 # Database master password — use a strong password
 db_password = "CHANGE_ME_strong_password_here"
@@ -27,8 +74,9 @@ db_password = "CHANGE_ME_strong_password_here"
 # google_oauth_client_id     = ""
 # google_oauth_client_secret = ""
 
-# Pre-signup Lambda (optional — leave empty if not using custom pre-signup logic)
-# pre_signup_lambda_zip = "./lambdas/pre-signup.zip"
+# Cognito trigger Lambdas (optional — leave empty if not using custom auth logic)
+# pre_signup_lambda_zip           = "./lambdas/cognito-pre-signup.zip"
+# cognito_custom_auth_lambda_zip  = "./lambdas/cognito-custom-auth.zip"
 
 # Lambda artifacts:
 # - Source checkout deploys can set lambda_zips_dir after `pnpm build:lambdas`.
@@ -65,3 +113,14 @@ db_password = "CHANGE_ME_strong_password_here"
 # variable. NEVER put the token in this file.
 # www_domain         = "thinkwork.ai"
 # cloudflare_zone_id = "your-cloudflare-zone-id"
+
+# Tenant-scoped Space email addresses (optional).
+# Keep the legacy agents.thinkwork.ai domain configured until retirement
+# notices are no longer needed, then add tenant slugs before announcing
+# <space>@<tenant>.thinkwork.ai addresses. Terraform creates one SES receiving
+# identity and delegated Route53 subzone per tenant slug, then publishes NS
+# delegation records in the Cloudflare parent zone above.
+#
+# ses_inbound_domain = "agents.thinkwork.ai"
+# ses_parent_domain = "thinkwork.ai"
+# tenant_slugs      = ["dev"]

package/dist/terraform/modules/app/agentcore-code-interpreter/Dockerfile.sandbox-base

@@ -9,7 +9,7 @@
 # Tags are immutable; a bump ships as a reviewable PR.
 #
 # Build context is the repository root so the COPY line can reach the
-# Python source under packages/agentcore-strands/agent-container-sandbox/.
+# module-owned Python source below.
 #
 #   docker build -f terraform/modules/app/agentcore-code-interpreter/Dockerfile.sandbox-base .
 
@@ -47,7 +47,7 @@ RUN pip install --no-cache-dir \
 # (and before the framework traceback on cold start). See the module
 # docstring for the honestly-scoped invariant and named residual gaps.
 # ---------------------------------------------------------------------------
-COPY packages/agentcore-strands/agent-container-sandbox/sitecustomize.py \
+COPY terraform/modules/app/agentcore-code-interpreter/sandbox/sitecustomize.py \
      /usr/local/lib/python3.12/site-packages/sitecustomize.py
 
 # ---------------------------------------------------------------------------

package/dist/terraform/modules/app/agentcore-code-interpreter/README.md

@@ -19,16 +19,15 @@ stops at the substrate everything else depends on.
 
 ## Files
 
-| File | Purpose |
-|---|---|
-| `main.tf` | ECR + outputs. No per-tenant resources. |
-| `Dockerfile.sandbox-base` | Python 3.12 + pinned libs + `sitecustomize.py`. Build context is the **repo root** so the COPY can reach `packages/agentcore-strands/agent-container-sandbox/sitecustomize.py`. |
-| `scripts/build_and_push_sandbox_base.sh` | CI builds + pushes. Not called from Terraform — image lifecycle is a reviewable-PR concern. |
+| File                                     | Purpose                                                                                                                                   |
+| ---------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
+| `main.tf`                                | ECR + outputs. No per-tenant resources.                                                                                                   |
+| `Dockerfile.sandbox-base`                | Python 3.12 + pinned libs + `sitecustomize.py`. Build context is the **repo root** so the COPY can reach the module-owned sandbox helper. |
+| `scripts/build_and_push_sandbox_base.sh` | CI builds + pushes. Not called from Terraform — image lifecycle is a reviewable-PR concern.                                               |
 
 The Python source `sitecustomize.py` and its pytest suite `test_sitecustomize.py`
-live under `packages/agentcore-strands/agent-container-sandbox/` (colocated with
-the rest of the Strands agent-container Python, per handoff P2 #10). That's
-where `uv run pytest` finds them without extra config.
+live under `terraform/modules/app/agentcore-code-interpreter/sandbox/`, next to
+the sandbox base image they protect.
 
 ## What this module does **not** do
 
@@ -39,7 +38,7 @@ where `uv run pytest` finds them without extra config.
 ## Bumping the image
 
 1. Edit `Dockerfile.sandbox-base` (pin a new pandas / add a lib / etc.).
-2. Edit `packages/agentcore-strands/agent-container-sandbox/sitecustomize.py` if the R13 invariant or its coverage gaps shift.
+2. Edit `terraform/modules/app/agentcore-code-interpreter/sandbox/sitecustomize.py` if the R13 invariant or its coverage gaps shift.
 3. PR. CI runs `pytest` on the scrubber plus a build-then-startup-assertion smoke test.
 4. After merge, `build_and_push_sandbox_base.sh` tags with the merge-commit SHA.
 

package/dist/terraform/modules/app/agentcore-code-interpreter/sandbox/sitecustomize.py

@@ -0,0 +1,227 @@
+"""sitecustomize — primary R13 token redactor for the AgentCore sandbox base image.
+
+Python auto-imports any module named ``sitecustomize`` during interpreter
+startup (before user code, before the preamble, before framework tracebacks on
+cold start). This file installs a stdio write-wrapper keyed on a session-scoped
+set of token values so no token leaks to stdout / stderr via Python-stdio
+writes.
+
+The invariant is honestly scoped per the brainstorm's R13 (as aligned in
+docs/brainstorms/2026-04-22-agentcore-code-sandbox-requirements.md):
+
+  "no token value reaches a persisted log ... via Python-stdio-mediated writes"
+
+Bytes that bypass Python stdio (``os.write(fd, ...)``, subprocesses inheriting
+fds, C extensions, multiprocessing children) are the named residual class
+covered by the Unit 12 CloudWatch subscription-filter backstop for known
+OAuth prefixes, not by this module.
+
+Public API, callable from the sandbox preamble:
+  register_token(value: str) -> None
+  register_tokens(values: Iterable[str]) -> None
+  clear_tokens() -> None
+  installed() -> bool
+"""
+
+from __future__ import annotations
+
+import base64
+import binascii
+import os
+import sys
+import urllib.parse
+from collections.abc import Iterable
+from typing import Any
+
+# ---------------------------------------------------------------------------
+# Module state
+# ---------------------------------------------------------------------------
+
+# Every unique byte-sequence we redact. Populated by ``register_token`` — each
+# registered token expands into its cleartext, standard base64, URL-safe
+# base64, URL-encoded, and hex forms (only the forms whose length is at least
+# MIN_TOKEN_LEN, to avoid redacting short accidental matches like "AQ").
+_redactions: set[bytes] = set()
+
+# Redaction placeholder. Length unimportant — stream layout survives because
+# writes stay synchronous.
+_REDACTION = b"<redacted>"
+
+# Forms shorter than this are rejected — redacting 3-character strings is the
+# shape of a wildcard bug, not a security control.
+MIN_TOKEN_LEN = 12
+
+# Rolling-suffix buffer size. Set at ``register_token`` time to
+# max(existing, 2 * len(new_token_form)). The wrapper keeps this many bytes
+# from the previous write and prepends them to the current write before
+# searching, so a token split across two ``write()`` calls is caught as long
+# as neither split half exceeds the buffer. Adversarial fragmentation at
+# arbitrary positions is a named residual (see R13).
+_rolling_buffer_size: int = 0
+
+
+def _expand(value: str) -> list[bytes]:
+    """Return the encoded forms of a token value we treat as equivalent.
+
+    Each form is added to the redaction set so ``print(base64.b64encode(token))``
+    and the cleartext ``print(token)`` are both scrubbed.
+    """
+    if not value:
+        return []
+    raw = value.encode("utf-8")
+    forms: list[bytes] = []
+
+    def maybe_add(candidate: bytes) -> None:
+        if len(candidate) >= MIN_TOKEN_LEN:
+            forms.append(candidate)
+
+    maybe_add(raw)
+    maybe_add(base64.b64encode(raw).rstrip(b"="))
+    maybe_add(base64.b64encode(raw))
+    maybe_add(base64.urlsafe_b64encode(raw).rstrip(b"="))
+    maybe_add(base64.urlsafe_b64encode(raw))
+    maybe_add(urllib.parse.quote(value, safe="").encode("ascii"))
+    maybe_add(binascii.hexlify(raw))
+    return forms
+
+
+def register_token(value: str) -> None:
+    """Add a token (and its derived encodings) to the redaction set.
+
+    Safe to call multiple times with the same value. No-op for empty values.
+    """
+    global _rolling_buffer_size
+    for form in _expand(value):
+        _redactions.add(form)
+        required = 2 * len(form)
+        if required > _rolling_buffer_size:
+            _rolling_buffer_size = required
+
+
+def register_tokens(values: Iterable[str]) -> None:
+    for v in values:
+        register_token(v)
+
+
+def clear_tokens() -> None:
+    """Drop every registered token. Called at session teardown by the container."""
+    global _rolling_buffer_size
+    _redactions.clear()
+    _rolling_buffer_size = 0
+
+
+# ---------------------------------------------------------------------------
+# Stdio wrapper
+# ---------------------------------------------------------------------------
+
+
+def _redact(chunk: bytes, tail_buffer: bytearray) -> tuple[bytes, bytearray]:
+    """Return (scrubbed_output_chunk, new_tail_buffer).
+
+    The tail buffer holds the trailing N bytes of the previous write so we can
+    catch tokens split across write boundaries. The output we emit is the part
+    of ``tail_buffer + chunk`` that is safely past the trailing window; the
+    suffix stays in the new tail for the next call.
+    """
+    if not _redactions:
+        return chunk, tail_buffer
+
+    combined = bytes(tail_buffer) + chunk
+    for form in _redactions:
+        combined = combined.replace(form, _REDACTION)
+
+    if _rolling_buffer_size and len(combined) > _rolling_buffer_size:
+        emit = combined[:-_rolling_buffer_size]
+        new_tail = bytearray(combined[-_rolling_buffer_size:])
+    else:
+        emit = b""
+        new_tail = bytearray(combined)
+
+    return emit, new_tail
+
+
+class _RedactingStream:
+    """Wraps sys.stdout / sys.stderr's underlying buffer with a redactor.
+
+    Intercepts both ``write(str)`` (TextIOBase) and ``.buffer.write(bytes)``
+    paths so ``print(...)``, ``sys.stdout.write(...)``, and
+    ``sys.stdout.buffer.write(...)`` all flow through the scrubber.
+    """
+
+    def __init__(self, wrapped: Any, name: str) -> None:
+        self._wrapped = wrapped
+        self._name = name
+        self._tail = bytearray()
+        # AgentCore writes to stdout/stderr line-buffered; we flush our tail
+        # on every newline-terminated write so output appears promptly.
+
+    def write(self, data: Any) -> int:
+        if isinstance(data, str):
+            payload = data.encode("utf-8", errors="replace")
+            wrote_str = True
+        elif isinstance(data, (bytes, bytearray, memoryview)):
+            payload = bytes(data)
+            wrote_str = False
+        else:
+            # Defer unknown types to the wrapped object — let it raise.
+            return self._wrapped.write(data)
+
+        emit, self._tail = _redact(payload, self._tail)
+        # A newline forces a tail flush so output doesn't lag arbitrarily when
+        # no new writes arrive. This is a UX concession, not a security one —
+        # redaction is complete whether we flush or not.
+        if b"\n" in payload:
+            emit = emit + bytes(self._tail)
+            self._tail = bytearray()
+
+        if not emit:
+            return len(data) if wrote_str else len(payload)
+
+        if wrote_str:
+            self._wrapped.write(emit.decode("utf-8", errors="replace"))
+        else:
+            # TextIOWrapper.write raises on bytes; prefer the underlying buffer.
+            buf = getattr(self._wrapped, "buffer", None)
+            if buf is not None:
+                buf.write(emit)
+            else:
+                self._wrapped.write(emit)
+        return len(data) if wrote_str else len(payload)
+
+    def flush(self) -> None:
+        if self._tail:
+            data = bytes(self._tail)
+            self._tail = bytearray()
+            buf = getattr(self._wrapped, "buffer", None)
+            if buf is not None:
+                buf.write(data)
+            else:
+                self._wrapped.write(data.decode("utf-8", errors="replace"))
+        self._wrapped.flush()
+
+    # Forward any other attribute access (fileno, isatty, encoding, etc.) so
+    # libraries that introspect the stream still see what they expect.
+    def __getattr__(self, item: str) -> Any:
+        return getattr(self._wrapped, item)
+
+
+_installed = False
+
+
+def installed() -> bool:
+    return _installed
+
+
+def _install() -> None:
+    global _installed
+    if _installed:
+        return
+    sys.stdout = _RedactingStream(sys.stdout, "stdout")
+    sys.stderr = _RedactingStream(sys.stderr, "stderr")
+    _installed = True
+
+
+# Install unconditionally on import. Disable only for a pytest diagnostic
+# marker the test suite can opt out of (set THINKWORK_SANDBOX_SCRUBBER=off).
+if os.environ.get("THINKWORK_SANDBOX_SCRUBBER", "on") != "off":
+    _install()

package/dist/terraform/modules/app/agentcore-code-interpreter/sandbox/test_sitecustomize.py

@@ -0,0 +1,277 @@
+"""Unit tests for the AgentCore sandbox base-image stdio token redactor.
+
+Tests hit ``_RedactingStream`` directly with a test-owned stream instead of
+mutating ``sys.stdout`` — that side-steps pytest's capture machinery, which
+owns sys.stdout at test time and would otherwise see writes before the
+wrapper does. Correctness of the sys.stdout replacement path is proven by
+a separate end-to-end test that runs the module as a subprocess with its
+auto-install path active.
+"""
+
+from __future__ import annotations
+
+import base64
+import binascii
+import importlib.util
+import io
+import os
+import subprocess
+import sys
+import urllib.parse
+
+import pytest
+
+os.environ["THINKWORK_SANDBOX_SCRUBBER"] = "off"
+
+_HERE = os.path.dirname(os.path.abspath(__file__))
+_SPEC = importlib.util.spec_from_file_location(
+    "sandbox_base_sitecustomize",
+    os.path.join(_HERE, "sitecustomize.py"),
+)
+assert _SPEC is not None and _SPEC.loader is not None
+sc = importlib.util.module_from_spec(_SPEC)
+_SPEC.loader.exec_module(sc)
+
+
+class _StringSink:
+    """Minimal sys.stdout-shaped target: the wrapper writes strings into us,
+    we collect them as UTF-8 bytes. Also exposes ``.buffer`` so bytes-path
+    writes have a path through the wrapper."""
+
+    def __init__(self) -> None:
+        self.str_bytes = bytearray()
+        self.buffer = io.BytesIO()
+        self.name = "test-sink"
+        self.encoding = "utf-8"
+        self.errors = "strict"
+
+    def write(self, s: str) -> int:
+        self.str_bytes.extend(s.encode("utf-8", errors="replace"))
+        return len(s)
+
+    def flush(self) -> None:
+        pass
+
+    def captured(self) -> str:
+        combined = bytes(self.str_bytes) + self.buffer.getvalue()
+        return combined.decode("utf-8", errors="replace")
+
+
+@pytest.fixture
+def wrapper() -> tuple:
+    """A fresh redactor wrapping a new sink, with an empty token set."""
+    sc.clear_tokens()
+    sink = _StringSink()
+    stream = sc._RedactingStream(sink, "test-stdout")  # type: ignore[attr-defined]
+    yield stream, sink
+    stream.flush()
+    sc.clear_tokens()
+
+
+def test_cleartext_is_redacted(wrapper):
+    stream, sink = wrapper
+    token = "ghp_abc123abc123abc123"
+    sc.register_token(token)
+    stream.write(f"the token was {token} and not noticeable\n")
+    stream.flush()
+    text = sink.captured()
+    assert token not in text
+    assert "<redacted>" in text
+    assert "the token was" in text
+
+
+def test_base64_form_is_redacted(wrapper):
+    stream, sink = wrapper
+    token = "ghp_abc123abc123abc123"
+    sc.register_token(token)
+    encoded = base64.b64encode(token.encode()).decode()
+    stream.write(f"encoded={encoded}\n")
+    stream.flush()
+    text = sink.captured()
+    assert encoded not in text
+    assert "<redacted>" in text
+
+
+def test_urlsafe_base64_form_is_redacted(wrapper):
+    stream, sink = wrapper
+    token = "some_opaque_secret_for_urlsafe"
+    sc.register_token(token)
+    encoded = base64.urlsafe_b64encode(token.encode()).decode()
+    stream.write(f"encoded={encoded}\n")
+    stream.flush()
+    text = sink.captured()
+    assert encoded not in text
+    assert "<redacted>" in text
+
+
+def test_url_encoded_form_is_redacted(wrapper):
+    stream, sink = wrapper
+    token = "token with spaces & special=chars"
+    sc.register_token(token)
+    encoded = urllib.parse.quote(token, safe="")
+    stream.write(f"in_url={encoded}\n")
+    stream.flush()
+    text = sink.captured()
+    assert encoded not in text
+    assert "<redacted>" in text
+
+
+def test_hex_form_is_redacted(wrapper):
+    stream, sink = wrapper
+    token = "0123456789abcdef01234567"
+    sc.register_token(token)
+    encoded = binascii.hexlify(token.encode()).decode()
+    stream.write(f"hex={encoded}\n")
+    stream.flush()
+    text = sink.captured()
+    assert encoded not in text
+    assert "<redacted>" in text
+
+
+def test_register_after_first_write_still_redacts_subsequent(wrapper):
+    stream, sink = wrapper
+    stream.write("before registration\n")
+    token = "late_registered_token_value"
+    sc.register_token(token)
+    stream.write(f"after {token} registration\n")
+    stream.flush()
+    text = sink.captured()
+    assert "before registration" in text
+    assert token not in text
+    assert "<redacted>" in text
+
+
+def test_split_write_across_boundary_is_caught(wrapper):
+    stream, sink = wrapper
+    token = "ghp_splitfragmenttokenvalue"
+    sc.register_token(token)
+    stream.write(token[:10])
+    stream.write(token[10:])
+    stream.write("\n")
+    stream.flush()
+    text = sink.captured()
+    assert token not in text
+    assert "<redacted>" in text
+
+
+def test_short_token_below_min_len_is_ignored(wrapper):
+    """Redacting 3-char strings would produce wildcard false-positives."""
+    stream, sink = wrapper
+    sc.register_token("AQ")
+    stream.write("AQ should appear unchanged because AQ is too short to redact\n")
+    stream.flush()
+    text = sink.captured()
+    assert "AQ" in text
+    assert "<redacted>" not in text
+
+
+def test_bytes_path_through_buffer(wrapper):
+    stream, sink = wrapper
+    token = "some_token_value_we_registered"
+    sc.register_token(token)
+    # Write bytes through the wrapper — it routes into sink.buffer.
+    stream.write(b"\x00\x01\x02binary with " + token.encode() + b" embedded\n")
+    stream.flush()
+    text = sink.captured()
+    assert token not in text
+    assert "<redacted>" in text
+    assert "binary with" in text
+
+
+def test_clear_tokens_disables_redaction_for_later_writes(wrapper):
+    stream, sink = wrapper
+    token = "a_token_that_will_be_cleared_soon"
+    sc.register_token(token)
+    stream.write(f"before clear: {token}\n")
+    sc.clear_tokens()
+    stream.write(f"after clear: {token}\n")
+    stream.flush()
+    text = sink.captured()
+    assert text.count("<redacted>") == 1
+    assert text.count(token) == 1
+
+
+def test_register_tokens_plural_is_equivalent(wrapper):
+    stream, sink = wrapper
+    sc.register_tokens(["first_registered_token_abc", "second_registered_token_def"])
+    stream.write("first_registered_token_abc / second_registered_token_def\n")
+    stream.flush()
+    text = sink.captured()
+    assert "first_registered_token_abc" not in text
+    assert "second_registered_token_def" not in text
+    assert text.count("<redacted>") >= 2
+
+
+def test_empty_token_is_ignored(wrapper):
+    stream, sink = wrapper
+    sc.register_token("")
+    stream.write("nothing to redact here\n")
+    stream.flush()
+    text = sink.captured()
+    assert "nothing to redact here" in text
+    assert "<redacted>" not in text
+
+
+def test_no_crash_on_raw_bytes_without_matching_token(wrapper):
+    stream, sink = wrapper
+    sc.register_token("something_registered_but_not_present")
+    stream.write(b"\x00\x01\x02binary bytes\n")
+    stream.flush()
+    text = sink.captured()
+    assert "binary bytes" in text
+
+
+# --- End-to-end: the auto-install path ---------------------------------------
+#
+# Tests above exercise _RedactingStream directly, which is fine for the
+# redaction logic itself but bypasses the sitecustomize auto-install step
+# that replaces sys.stdout on interpreter startup. This subprocess test
+# proves that step works — a fresh Python process, with PYTHONPATH pointed
+# at the module directory and THINKWORK_SANDBOX_SCRUBBER unset, installs
+# the wrapper on its own and redacts a registered token before stdout is
+# flushed.
+
+
+def test_auto_install_redacts_on_fresh_interpreter(tmp_path):
+    script = tmp_path / "run.py"
+    script.write_text(
+        """
+import sys, sitecustomize
+sitecustomize.register_token("ghp_autoInstallValueTokenX")
+print("auto-install redacts ghp_autoInstallValueTokenX mid-line here")
+""".strip()
+    )
+    env = os.environ.copy()
+    # Strip our opt-out so sitecustomize installs on import.
+    env.pop("THINKWORK_SANDBOX_SCRUBBER", None)
+    # Prepend the module dir so Python's startup hook finds our
+    # sitecustomize.py before any installed one.
+    env["PYTHONPATH"] = _HERE + os.pathsep + env.get("PYTHONPATH", "")
+    out = subprocess.run(
+        [sys.executable, str(script)],
+        env=env,
+        check=True,
+        capture_output=True,
+        text=True,
+    )
+    assert "ghp_autoInstallValueTokenX" not in out.stdout
+    assert "<redacted>" in out.stdout
+    assert "auto-install redacts" in out.stdout
+
+
+def test_installed_reports_true_after_auto_install(tmp_path):
+    """Probe ``installed()`` from a fresh interpreter — confirms the startup
+    hook ran (and set the flag)."""
+    script = tmp_path / "run.py"
+    script.write_text("import sitecustomize; print(sitecustomize.installed())")
+    env = os.environ.copy()
+    env.pop("THINKWORK_SANDBOX_SCRUBBER", None)
+    env["PYTHONPATH"] = _HERE + os.pathsep + env.get("PYTHONPATH", "")
+    out = subprocess.run(
+        [sys.executable, str(script)],
+        env=env,
+        check=True,
+        capture_output=True,
+        text=True,
+    )
+    assert out.stdout.strip() == "True"

package/dist/terraform/modules/app/agentcore-memory/README.md

@@ -1,13 +1,13 @@
 # AgentCore Memory — App Module
 
 Provisions an AWS Bedrock AgentCore Memory resource with the four strategies
-the thinkwork Strands agent container uses for automatic retention:
+the ThinkWork AgentCore runtime uses for automatic retention:
 
-| Strategy    | Namespace template           | Purpose                                  |
-|-------------|------------------------------|------------------------------------------|
-| semantic    | `assistant_{actorId}`        | Cross-thread facts about the user        |
-| preferences | `preferences_{actorId}`      | User-stated preferences                  |
-| summaries   | `session_{sessionId}`        | Per-thread rolling summaries             |
+| Strategy    | Namespace template               | Purpose                              |
+| ----------- | -------------------------------- | ------------------------------------ |
+| semantic    | `assistant_{actorId}`            | Cross-thread facts about the user    |
+| preferences | `preferences_{actorId}`          | User-stated preferences              |
+| summaries   | `session_{sessionId}`            | Per-thread rolling summaries         |
 | episodes    | `episodes_{actorId}/{sessionId}` | Episodic memory of past interactions |
 
 Automatic retention is wired in the agent container: every turn emits a

package/dist/terraform/modules/app/agentcore-memory/main.tf

@@ -2,7 +2,7 @@
 # AgentCore Memory — App Module
 #
 # Provisions an AWS Bedrock AgentCore Memory resource with the four strategies
-# the Strands agent container expects (semantic, preferences, summaries,
+# the ThinkWork AgentCore runtime expects (semantic, preferences, summaries,
 # episodes). The resource is always created — AgentCore managed memory is
 # on by default so every agent gets automatic per-turn retention into
 # semantic / preference / summary / episode strategies without any tool-