thinkwork-cli 0.12.12 → 0.12.15

package/dist/terraform/modules/app/agentcore-pi/variables.tf

@@ -0,0 +1,145 @@
+################################################################################
+# AgentCore Pi — App Module (variables)
+#
+# Provisions the Pi agent runtime as a Lambda+LWA function. Shared AgentCore
+# platform substrate (ECR repo + async DLQ) is injected from the parent
+# composition so Pi can carry its own IAM role, log group, Lambda function, and
+# event-invoke config without duplicating shared resources.
+################################################################################
+
+variable "stage" {
+  description = "Deployment stage"
+  type        = string
+}
+
+variable "account_id" {
+  description = "AWS account ID"
+  type        = string
+}
+
+variable "region" {
+  description = "AWS region"
+  type        = string
+}
+
+variable "bucket_name" {
+  description = "Primary S3 bucket for skills and workspace files."
+  type        = string
+}
+
+variable "ecr_repository_url" {
+  description = "ECR repository URL for AgentCore container images. Pi pulls the pi-latest / <sha>-pi image tags from this repo."
+  type        = string
+}
+
+variable "source_image_uri" {
+  description = "Optional release image URI to copy into ecr_repository_url:pi-latest before creating the Pi Lambda. Used by GitHub-free customer deployments."
+  type        = string
+  default     = ""
+}
+
+variable "async_dlq_arn" {
+  description = "SQS DLQ ARN for failed `kind=run_skill` async invokes. Shared AgentCore queue for operator inspection."
+  type        = string
+}
+
+variable "hindsight_endpoint" {
+  description = "Hindsight API endpoint. Empty string (default) disables Hindsight tools in the container; set to an endpoint URL to enable Hindsight as an add-on alongside the always-on managed memory."
+  type        = string
+  default     = ""
+}
+
+variable "agentcore_memory_id" {
+  description = "AgentCore Memory resource ID. Populated automatically by the agentcore-memory module; injected into the container as AGENTCORE_MEMORY_ID for auto-retention."
+  type        = string
+  default     = ""
+}
+
+variable "api_endpoint" {
+  description = "Deployed API Gateway base URL. Injected as THINKWORK_API_URL so the composition runner (run_skill dispatch) can POST terminal state back to /api/skills/complete."
+  type        = string
+  default     = ""
+}
+
+variable "api_auth_secret" {
+  description = "Service-auth bearer shared secret. Injected as API_AUTH_SECRET so the composition runner can authenticate to /api/skills/complete. Matches the lambda-api module's value."
+  type        = string
+  default     = ""
+  sensitive   = true
+}
+
+variable "memory_engine" {
+  description = "Active long-term memory engine ('hindsight', 'agentcore', or 'cognee'). Surfaced to the runtime as MEMORY_ENGINE for telemetry/debugging only; engine selection itself happens in the API's normalized memory layer when memory-retain is invoked."
+  type        = string
+  default     = "hindsight"
+  validation {
+    condition     = contains(["hindsight", "agentcore", "cognee"], var.memory_engine)
+    error_message = "memory_engine must be 'hindsight', 'agentcore', or 'cognee'."
+  }
+}
+
+variable "requester_idle_memory_learning_enabled" {
+  description = "When true, requester memory learning runs through the API idle/dreaming pipeline instead of runtime retain-on-every-turn."
+  type        = bool
+  default     = false
+}
+
+variable "db_cluster_arn" {
+  description = "Aurora DB cluster ARN. Injected as DB_CLUSTER_ARN so AuroraSessionStore (plan §005 U4) can target the cluster via the RDS Data API. The cluster's IAM resource scope (thinkwork-<stage>-db-* in agentcore-pi's role policy) covers any cluster-id suffix."
+  type        = string
+  default     = ""
+}
+
+variable "db_secret_arn" {
+  description = "Secrets Manager ARN for the Aurora cluster credentials. Injected as DB_SECRET_ARN so AuroraSessionStore can authenticate against the cluster via the RDS Data API. Matches the secret graphql-http already consumes — single source of truth."
+  type        = string
+  default     = ""
+}
+
+variable "cognee_subnet_ids" {
+  description = "Subnet IDs for Pi's private-network attachment when Company Brain/Cognee direct MCP access is enabled."
+  type        = list(string)
+  default     = []
+}
+
+variable "cognee_security_group_ids" {
+  description = "Security group IDs for Pi's private-network attachment when Company Brain/Cognee direct MCP access is enabled."
+  type        = list(string)
+  default     = []
+}
+
+variable "okf_efs_enabled" {
+  description = "When true, mount the generated OKF wiki EFS view into Pi. Requires subnet/security-group inputs and an access point ARN."
+  type        = bool
+  default     = false
+}
+
+variable "okf_efs_subnet_ids" {
+  description = "Subnet IDs for the Pi Lambda VPC attachment used by the OKF wiki EFS mount."
+  type        = list(string)
+  default     = []
+}
+
+variable "okf_efs_security_group_ids" {
+  description = "Security group IDs for the Pi Lambda VPC attachment used by the OKF wiki EFS mount."
+  type        = list(string)
+  default     = []
+}
+
+variable "okf_efs_file_system_arn" {
+  description = "EFS file system ARN for read-only Pi OKF wiki access."
+  type        = string
+  default     = ""
+}
+
+variable "okf_efs_read_access_point_arn" {
+  description = "EFS access point ARN mounted read-only by Pi for OKF wiki traversal."
+  type        = string
+  default     = ""
+}
+
+variable "okf_efs_mount_path" {
+  description = "Local Lambda mount path for the OKF wiki EFS view. Must be under /mnt."
+  type        = string
+  default     = "/mnt/thinkwork-okf"
+}

package/dist/terraform/modules/app/agentcore-platform/main.tf

@@ -0,0 +1,83 @@
+################################################################################
+# AgentCore Platform — Shared App Module
+#
+# Owns shared AgentCore substrate that is not runtime-specific. Pi consumes the
+# ECR repository for container images and the async DLQ for failed Event invokes.
+################################################################################
+
+variable "stage" {
+  description = "Deployment stage"
+  type        = string
+}
+
+################################################################################
+# ECR Repository
+################################################################################
+
+resource "aws_ecr_repository" "agentcore" {
+  name                 = "thinkwork-${var.stage}-agentcore"
+  image_tag_mutability = "MUTABLE"
+  force_delete         = true
+
+  image_scanning_configuration {
+    scan_on_push = true
+  }
+
+  tags = {
+    Name = "thinkwork-${var.stage}-agentcore"
+  }
+}
+
+resource "aws_ecr_lifecycle_policy" "agentcore" {
+  repository = aws_ecr_repository.agentcore.name
+
+  policy = jsonencode({
+    rules = [{
+      rulePriority = 1
+      description  = "Expire stale untagged images; retain tagged release/runtime pins"
+      selection = {
+        tagStatus   = "untagged"
+        countType   = "sinceImagePushed"
+        countUnit   = "days"
+        countNumber = 14
+      }
+      action = {
+        type = "expire"
+      }
+    }]
+  })
+}
+
+################################################################################
+# Async-invoke DLQ
+################################################################################
+
+resource "aws_sqs_queue" "agentcore_async_dlq" {
+  name                       = "thinkwork-${var.stage}-agentcore-async-dlq"
+  message_retention_seconds  = 1209600 # 14 days
+  visibility_timeout_seconds = 900     # matches runtime Lambda timeout
+  sqs_managed_sse_enabled    = true
+
+  tags = {
+    Name = "thinkwork-${var.stage}-agentcore-async-dlq"
+  }
+}
+
+################################################################################
+# Outputs
+################################################################################
+
+output "ecr_repository_url" {
+  description = "ECR repository URL for AgentCore runtime container images"
+  value       = aws_ecr_repository.agentcore.repository_url
+}
+
+output "agentcore_async_dlq_arn" {
+  description = "SQS queue ARN that catches failed kind=run_skill async invokes"
+  value       = aws_sqs_queue.agentcore_async_dlq.arn
+}
+
+output "agentcore_async_dlq_url" {
+  description = "SQS queue URL for operator inspection of failed async invokes"
+  value       = aws_sqs_queue.agentcore_async_dlq.url
+}

package/dist/terraform/modules/app/agentcore-runtime/main.tf

@@ -59,12 +59,12 @@ variable "nova_act_api_key" {
 }
 
 variable "memory_engine" {
-  description = "Active long-term memory engine ('hindsight' or 'agentcore'). Surfaced to the runtime as MEMORY_ENGINE for telemetry/debugging only; engine selection itself happens in the API's normalized memory layer when memory-retain is invoked."
+  description = "Active long-term memory engine ('hindsight', 'agentcore', or 'cognee'). Surfaced to the runtime as MEMORY_ENGINE for telemetry/debugging only; engine selection itself happens in the API's normalized memory layer when memory-retain is invoked."
   type        = string
   default     = "hindsight"
   validation {
-    condition     = contains(["hindsight", "agentcore"], var.memory_engine)
-    error_message = "memory_engine must be 'hindsight' or 'agentcore'."
+    condition     = contains(["hindsight", "agentcore", "cognee"], var.memory_engine)
+    error_message = "memory_engine must be 'hindsight', 'agentcore', or 'cognee'."
   }
 }
 
@@ -152,9 +152,9 @@ resource "aws_iam_role" "agentcore" {
 }
 
 resource "aws_iam_role_policy" "agentcore" {
-  # Sibling policy: ../agentcore-flue/main.tf `aws_iam_role_policy.agentcore_flue`.
+  # Sibling policy: ../agentcore-pi/main.tf `aws_iam_role_policy.agentcore_pi`.
   # The two policies share ~83% of statements (S3, Bedrock, AgentCore Memory,
-  # Code Interpreter, Logs, X-Ray, ECR, SSM, MemoryRetain). Flue adds Aurora
+  # Code Interpreter, Logs, X-Ray, ECR, SSM, MemoryRetain). Pi adds Aurora
   # Data API + Secrets Manager for U4 SessionStore. Keep both surfaces in
   # sync for shared statements.
   name = "agentcore-permissions"
@@ -466,9 +466,7 @@ output "agentcore_async_dlq_url" {
   value       = aws_sqs_queue.agentcore_async_dlq.url
 }
 
-# Plan §005 U1 → U2 — the `agentcore_flue` resources that previously lived here
-# (renamed from `agentcore_pi` in U1) moved out to `../agentcore-flue/main.tf` in
-# U2. Cross-module state migration is declared in `terraform/modules/thinkwork/main.tf`
-# via `moved {}` blocks at the parent composition layer. The U1 in-module `moved`
-# blocks (`agentcore_pi` → `agentcore_flue`) were applied on the U1 deploy and
-# are no longer needed here — the resources have left the module entirely.
+# The dedicated non-Strands runtime now lives in `../agentcore-pi/main.tf`.
+# Cross-module state migration for the Flue-module to Pi-module rename is
+# declared in `terraform/modules/thinkwork/main.tf` via parent-level `moved {}`
+# blocks.

package/dist/terraform/modules/app/appsync-subscriptions/main.tf

@@ -74,11 +74,15 @@ locals {
     "notifyAgentStatus",
     "notifyNewMessage",
     "notifyHeartbeatActivity",
+    "notifyThreadActivity",
     "notifyThreadUpdate",
     "notifyInboxItemUpdate",
     "notifyThreadTurnUpdate",
-    "publishComputerThreadChunk",
+    "notifyThreadTurnStep",
     "notifyOrgUpdate",
+    "notifyCostRecorded",
+    "notifyEvalRunUpdate",
+    "notifyWorkspaceAccessRevoked",
   ]
 }