thinkwork-cli 0.12.12 → 0.12.15

package/dist/plugins/workos-auth/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "@thinkwork/plugin-workos-auth",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "main": "./src/index.ts",
+  "exports": {
+    ".": "./src/index.ts",
+    "./manifest": "./src/manifest.ts",
+    "./provider-contract": "./src/provider-contract.ts"
+  },
+  "scripts": {
+    "build": "tsc --build",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  },
+  "devDependencies": {
+    "@thinkwork/plugin-catalog": "workspace:*",
+    "typescript": "^5.5.0",
+    "vitest": "^2.0.0"
+  }
+}

package/dist/plugins/workos-auth/src/index.ts

@@ -0,0 +1,30 @@
+import { workosAuthManifest } from "./manifest";
+
+export const workosAuthPluginPackage = {
+  packageKey: "workos-auth",
+  sourceRoot: "plugins/workos-auth",
+  manifest: workosAuthManifest,
+  ownedSources: [
+    {
+      kind: "manifest",
+      path: "plugins/workos-auth/src/manifest.ts",
+      description:
+        "WorkOS Auth catalog manifest and Cognito auth-provider component contract.",
+    },
+    {
+      kind: "api",
+      path: "plugins/workos-auth/src/provider-contract.ts",
+      description:
+        "WorkOS Auth provider keys, admin config fields, and U1-approved public option metadata.",
+    },
+    {
+      kind: "tests",
+      path: "plugins/workos-auth/test",
+      description: "WorkOS Auth package-local manifest and contract tests.",
+    },
+  ],
+  compatibilityLinks: [],
+} as const;
+
+export { workosAuthManifest };
+export * from "./provider-contract";

package/dist/plugins/workos-auth/src/manifest.ts

@@ -0,0 +1,40 @@
+import type { PluginManifest } from "@thinkwork/plugin-catalog/contracts";
+
+import {
+  WORKOS_AUTH_COGNITO_IDP_NAME,
+  WORKOS_AUTH_PROVIDER_COMPONENT_KEY,
+  WORKOS_AUTH_SETTINGS_SURFACE,
+  workosAuthConfigFields,
+  workosAuthPublicOptions,
+} from "./provider-contract";
+
+export const workosAuthManifest = {
+  pluginKey: "workos-auth",
+  displayName: "WorkOS Auth",
+  description:
+    "WorkOS-backed SSO broker that federates through Cognito while keeping Cognito as ThinkWork's final session issuer.",
+  versions: [
+    {
+      version: "0.1.0",
+      requiredOauthScopes: [],
+      components: [
+        {
+          type: "auth-provider",
+          key: WORKOS_AUTH_PROVIDER_COMPONENT_KEY,
+          displayName: "WorkOS Cognito federation",
+          provider: "workos",
+          settingsSurface: WORKOS_AUTH_SETTINGS_SURFACE,
+          cognitoIdentityProviderName: WORKOS_AUTH_COGNITO_IDP_NAME,
+          configFields: workosAuthConfigFields,
+          publicOptions: workosAuthPublicOptions,
+        },
+        {
+          type: "ui-surface",
+          key: "settings",
+          displayName: "WorkOS Auth settings",
+          intendedMount: WORKOS_AUTH_SETTINGS_SURFACE,
+        },
+      ],
+    },
+  ],
+} satisfies PluginManifest;

package/dist/plugins/workos-auth/src/provider-contract.ts

@@ -0,0 +1,39 @@
+import type {
+  AuthProviderConfigField,
+  AuthProviderPublicOption,
+} from "@thinkwork/plugin-catalog/contracts";
+
+export const WORKOS_AUTH_PROVIDER_COMPONENT_KEY = "workos-auth" as const;
+export const WORKOS_AUTH_SETTINGS_SURFACE =
+  "settings.plugins.workos-auth" as const;
+export const WORKOS_AUTH_COGNITO_IDP_NAME = "WorkOSAuth" as const;
+
+export const workosAuthConfigFields = [
+  {
+    key: "issuerUrl",
+    displayName: "WorkOS AuthKit issuer URL",
+    required: true,
+    storage: "metadata",
+  },
+  {
+    key: "clientId",
+    displayName: "WorkOS OAuth client ID",
+    required: true,
+    storage: "metadata",
+  },
+  {
+    key: "clientSecret",
+    displayName: "WorkOS OAuth client secret",
+    required: true,
+    storage: "secret-ref",
+  },
+] satisfies AuthProviderConfigField[];
+
+export const workosAuthPublicOptions = [
+  {
+    key: "sso",
+    displayName: "Continue with SSO",
+    providerSpecific: false,
+    recommended: true,
+  },
+] satisfies AuthProviderPublicOption[];

package/dist/plugins/workos-auth/test/manifest.test.ts

@@ -0,0 +1,94 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  validatePluginManifest,
+  type AuthProviderComponent,
+} from "@thinkwork/plugin-catalog/contracts";
+import { defineFirstPartyPluginPackage } from "@thinkwork/plugin-catalog/plugin-package";
+
+import { workosAuthPluginPackage } from "../src";
+import { workosAuthManifest } from "../src/manifest";
+import {
+  WORKOS_AUTH_COGNITO_IDP_NAME,
+  WORKOS_AUTH_PROVIDER_COMPONENT_KEY,
+  WORKOS_AUTH_SETTINGS_SURFACE,
+  workosAuthConfigFields,
+  workosAuthPublicOptions,
+} from "../src/provider-contract";
+
+function authProviderComponent(): AuthProviderComponent {
+  const component = workosAuthManifest.versions[0].components.find(
+    (candidate) => candidate.type === "auth-provider",
+  );
+  if (component?.type !== "auth-provider") {
+    throw new Error("WorkOS Auth manifest is missing auth-provider component");
+  }
+  return component;
+}
+
+describe("WorkOS Auth plugin manifest", () => {
+  it("validates as an auth-provider plugin with a settings surface", () => {
+    const validated = validatePluginManifest(workosAuthManifest);
+
+    expect(validated.pluginKey).toBe("workos-auth");
+    expect(validated.displayName).toBe("WorkOS Auth");
+    expect(validated.versions[0].requiredOauthScopes).toEqual([]);
+    expect(validated.versions[0].components.map((component) => component.type))
+      .toEqual(["auth-provider", "ui-surface"]);
+  });
+
+  it("declares the U1-approved single SSO fallback instead of provider buttons", () => {
+    const component = authProviderComponent();
+
+    expect(component).toMatchObject({
+      type: "auth-provider",
+      key: WORKOS_AUTH_PROVIDER_COMPONENT_KEY,
+      provider: "workos",
+      settingsSurface: WORKOS_AUTH_SETTINGS_SURFACE,
+      cognitoIdentityProviderName: WORKOS_AUTH_COGNITO_IDP_NAME,
+    });
+    expect(component.publicOptions).toEqual(workosAuthPublicOptions);
+    expect(component.publicOptions).toEqual([
+      {
+        key: "sso",
+        displayName: "Continue with SSO",
+        providerSpecific: false,
+        recommended: true,
+      },
+    ]);
+  });
+
+  it("models secrets as secret references, never manifest values", () => {
+    expect(workosAuthConfigFields).toEqual([
+      {
+        key: "issuerUrl",
+        displayName: "WorkOS AuthKit issuer URL",
+        required: true,
+        storage: "metadata",
+      },
+      {
+        key: "clientId",
+        displayName: "WorkOS OAuth client ID",
+        required: true,
+        storage: "metadata",
+      },
+      {
+        key: "clientSecret",
+        displayName: "WorkOS OAuth client secret",
+        required: true,
+        storage: "secret-ref",
+      },
+    ]);
+    expect(JSON.stringify(workosAuthManifest)).not.toMatch(
+      /client_secret|sk_|secretValue|currentValue/,
+    );
+  });
+
+  it("defines a first-party package boundary under plugins/workos-auth", () => {
+    const defined = defineFirstPartyPluginPackage(workosAuthPluginPackage);
+
+    expect(defined.packageKey).toBe("workos-auth");
+    expect(defined.sourceRoot).toBe("plugins/workos-auth");
+    expect(defined.compatibilityLinks).toEqual([]);
+  });
+});

package/dist/plugins/workos-auth/tsconfig.json

@@ -0,0 +1,8 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "./dist",
+    "rootDir": "."
+  },
+  "include": ["./**/*.ts"]
+}

package/dist/scripts/bootstrap-workspace.sh

@@ -0,0 +1,162 @@
+#!/usr/bin/env bash
+# Bootstrap workspace default files for a Thinkwork stage.
+#
+# Uploads the canonical workspace templates, then copies defaults to any
+# existing templates that are missing workspace files.
+#
+# Usage:
+#   scripts/bootstrap-workspace.sh <stage> <bucket> <database-url>
+#
+# Example:
+#   scripts/bootstrap-workspace.sh dev thinkwork-dev-storage \
+#     "postgresql://thinkwork_admin:pass@host:5432/thinkwork?sslmode=no-verify"
+#
+# Robustness notes:
+# - The ERR trap reports line + command before set -e kills the process, so
+#   silent failures (e.g. a command substitution with pipefail) surface with
+#   a usable source location instead of exit-code-1-with-no-context.
+# - The per-tenant seeding loop used to contain `[ … ] && continue` patterns
+#   that are technically safe under set -e + pipefail in isolation but become
+#   silent gotchas when combined with command substitutions earlier in the
+#   iteration. The patterns are now written as explicit `if … then continue`
+#   so the intent and the exit-status propagation are both obvious.
+# - The seeding block is wrapped in a failure-isolating subshell so a flaky
+#   AWS call on one tenant doesn't kill the whole deploy. Individual failures
+#   are logged and the final "=== Bootstrap complete ===" line is guaranteed
+#   to print.
+
+set -euo pipefail
+
+# Line + command on any set-e kill. Replaces the previous silent-exit-1.
+trap 'rc=$?; echo "ERR (exit=$rc) on line $LINENO: $BASH_COMMAND" >&2' ERR
+
+STAGE="${1:?Usage: bootstrap-workspace.sh <stage> <bucket> <database-url>}"
+BUCKET="${2:?Usage: bootstrap-workspace.sh <stage> <bucket> <database-url>}"
+DATABASE_URL="${3:?Usage: bootstrap-workspace.sh <stage> <bucket> <database-url>}"
+
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+
+# Workspace defaults live in the repo checkout OR the CLI bundle (dist/
+# layout: dist/scripts/ + dist/workspace-defaults/files — packaged installs
+# have no packages/ tree; harness cycle-7 ledger entry).
+DEFAULTS_DIR="$REPO_ROOT/packages/workspace-defaults/files"
+if [ ! -d "$DEFAULTS_DIR" ]; then
+  DEFAULTS_DIR="$REPO_ROOT/workspace-defaults/files"
+fi
+if [ ! -d "$DEFAULTS_DIR" ]; then
+  echo "ERROR: workspace defaults not found (looked in packages/workspace-defaults/files and workspace-defaults/files under $REPO_ROOT)" >&2
+  exit 1
+fi
+
+echo "=== Thinkwork Workspace Bootstrap ==="
+echo "  Stage:  $STAGE"
+echo "  Bucket: $BUCKET"
+echo ""
+
+# ── 1. Upload workspace default files to S3 ──────────────────────────────────
+# These are uploaded to a well-known prefix that ensureDefaultsExist() checks.
+# Any tenant's first template creation copies from here.
+
+echo "── Uploading workspace defaults to S3 ──"
+
+# Single loop over the consolidated source dir. Plan §008 U2 moved every
+# canonical seed into `packages/workspace-defaults/files/`; the S3 key shape
+# (`workspace-defaults/<basename>`) is unchanged so consumers keep working.
+for f in "$DEFAULTS_DIR/"*.md; do
+  fname=$(basename "$f")
+  aws s3 cp "$f" "s3://$BUCKET/workspace-defaults/$fname" --quiet
+  echo "  ✓ $fname"
+done
+
+echo ""
+
+# ── 2. Seed per-tenant defaults ──────────────────────────────────────────────
+# For each tenant that has agents but missing workspace defaults in S3,
+# upload the default files.
+
+echo "── Seeding per-tenant workspace defaults ──"
+
+# Strip sslmode=no-verify (Node.js pg) and replace with sslmode=require (psql-compatible)
+PSQL_URL=$(echo "$DATABASE_URL" | sed 's/sslmode=no-verify/sslmode=require/g')
+TENANT_SLUGS=$(psql "$PSQL_URL" -t -A -c "SELECT slug FROM tenants" 2>/dev/null || echo "")
+
+# Running the tenant-seed loop in a subshell with its own set-e behavior means
+# an error on one tenant logs + skips rather than killing the overall deploy.
+# The final "=== Bootstrap complete ===" line is the signal that the step ran
+# to completion; any per-tenant warnings appear in-line above it.
+bootstrap_status=0
+(
+  set +e
+  if [ -z "$TENANT_SLUGS" ]; then
+    echo "  No tenants found (or DB not reachable). Skipping per-tenant seeding."
+    exit 0
+  fi
+
+  for slug in $TENANT_SLUGS; do
+    # Guard against a stray empty slug from a trailing newline in psql output.
+    if [ -z "$slug" ]; then
+      continue
+    fi
+
+    DEFAULTS_PREFIX="tenants/$slug/agents/_catalog/defaults/workspace/"
+
+    # Check if defaults already exist. `aws s3 ls` returns non-zero on an
+    # empty prefix in some CLI versions, and with `set -o pipefail` that
+    # would kick through `wc -l`. Running without pipefail here is fine —
+    # `wc -l` on empty input prints `0`, which is exactly what we want.
+    ( set +o pipefail; aws s3 ls "s3://$BUCKET/$DEFAULTS_PREFIX" 2>/dev/null | wc -l | tr -d ' ' ) > /tmp/.bs_count
+    COUNT=$(cat /tmp/.bs_count || echo 0)
+    rm -f /tmp/.bs_count
+    COUNT=${COUNT:-0}
+
+    # Expect at least 11 files (8 consolidated workspace-defaults/files/ +
+    # ROUTER.md + 3 memory stubs). Plan §008 U2 unified all seed content under
+    # packages/workspace-defaults/files/; the S3 layout is unchanged.
+    if [ "$COUNT" -ge "11" ]; then
+      echo "  ✓ $slug — defaults exist ($COUNT files)"
+    else
+      echo "  → Seeding defaults for $slug..."
+      upload_ok=1
+      # Consolidated workspace defaults
+      for f in "$DEFAULTS_DIR/"*.md; do
+        aws s3 cp "$f" "s3://$BUCKET/${DEFAULTS_PREFIX}$(basename "$f")" --quiet || upload_ok=0
+      done
+      # Memory stubs
+      echo "# Lessons Learned" | aws s3 cp - "s3://$BUCKET/${DEFAULTS_PREFIX}memory/lessons.md" --quiet || upload_ok=0
+      echo "# Preferences" | aws s3 cp - "s3://$BUCKET/${DEFAULTS_PREFIX}memory/preferences.md" --quiet || upload_ok=0
+      echo "# Contacts" | aws s3 cp - "s3://$BUCKET/${DEFAULTS_PREFIX}memory/contacts.md" --quiet || upload_ok=0
+      if [ "$upload_ok" = "1" ]; then
+        echo "  ✓ $slug — seeded"
+      else
+        echo "  ! $slug — partial failure during seeding (continuing)"
+      fi
+    fi
+
+    # Copy defaults to any templates missing workspace files.
+    TEMPLATE_SLUGS=$(psql "$PSQL_URL" -t -A -c "SELECT slug FROM agent_templates WHERE tenant_id = (SELECT id FROM tenants WHERE slug = '$slug')" 2>/dev/null || true)
+    for tpl in $TEMPLATE_SLUGS; do
+      if [ -z "$tpl" ]; then
+        continue
+      fi
+      TPL_PREFIX="tenants/$slug/agents/_catalog/$tpl/workspace/"
+      ( set +o pipefail; aws s3 ls "s3://$BUCKET/$TPL_PREFIX" 2>/dev/null | wc -l | tr -d ' ' ) > /tmp/.bs_tpl
+      TPL_COUNT=$(cat /tmp/.bs_tpl || echo 0)
+      rm -f /tmp/.bs_tpl
+      TPL_COUNT=${TPL_COUNT:-0}
+      if [ "$TPL_COUNT" -lt "3" ]; then
+        echo "  → Copying defaults to template '$tpl'..."
+        aws s3 cp --recursive "s3://$BUCKET/$DEFAULTS_PREFIX" "s3://$BUCKET/$TPL_PREFIX" --quiet 2>/dev/null || true
+        echo "  ✓ template '$tpl' seeded"
+      else
+        echo "  ✓ template '$tpl' — workspace exists ($TPL_COUNT files)"
+      fi
+    done
+  done
+) || bootstrap_status=$?
+
+if [ "$bootstrap_status" -ne 0 ]; then
+  echo "  ! Tenant seeding finished with warnings (subshell exit=$bootstrap_status)"
+fi
+
+echo ""
+echo "=== Bootstrap complete ==="