thinkwork-cli 0.13.0 → 0.13.1

package/dist/terraform/modules/app/deployment-control-plane/test_runner_bundle.py

@@ -94,6 +94,68 @@ def write_drizzle_files(source_dir: Path, names: list[str]) -> None:
         (migrations / name).write_text(f"-- {name}\n", encoding="utf-8")
 
 
+def test_customer_update_requires_explicit_agentcore_pi_source_image() -> None:
+    runner = load_runner()
+
+    with pytest.raises(RuntimeError, match="agentcorePiSourceImageUri"):
+        runner.resolve_agentcore_pi_source_image_uri(
+            {
+                "action": "update",
+                "operation": {"kind": "foundation", "action": "update"},
+            }
+        )
+
+
+def test_customer_update_rejects_non_customer_agentcore_pi_source_image() -> None:
+    runner = load_runner()
+
+    with pytest.raises(RuntimeError, match="customer-owned ECR"):
+        runner.resolve_agentcore_pi_source_image_uri(
+            {
+                "action": "update",
+                "awsAccountId": "637423202447",
+                "awsRegion": "us-east-1",
+                "agentcorePiSourceImageUri": (
+                    "ghcr.io/thinkwork-ai/thinkwork-agentcore@sha256:abc"
+                ),
+            }
+        )
+
+
+def test_customer_update_accepts_customer_ecr_agentcore_pi_source_image() -> None:
+    runner = load_runner()
+    image = (
+        "637423202447.dkr.ecr.us-east-1.amazonaws.com/"
+        "thinkwork-tei-e2e-agentcore:pinned@sha256:abc"
+    )
+
+    assert runner.resolve_agentcore_pi_source_image_uri(
+        {
+            "action": "update",
+            "awsAccountId": "637423202447",
+            "awsRegion": "us-east-1",
+            "agentcorePiSourceImageUri": image,
+        }
+    ) == image
+
+
+def test_bootstrap_can_fall_back_to_release_agentcore_pi_image(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    runner = load_runner()
+    monkeypatch.setattr(
+        runner,
+        "release_runtime_image",
+        lambda name: "ghcr.io/thinkwork-ai/thinkwork-agentcore@sha256:abc"
+        if name == "agentcore-pi-amd64"
+        else "",
+    )
+
+    assert runner.resolve_agentcore_pi_source_image_uri({"action": "deploy"}) == (
+        "ghcr.io/thinkwork-ai/thinkwork-agentcore@sha256:abc"
+    )
+
+
 def test_sync_release_artifacts_stages_artifacts_from_platform_bundle(
     tmp_path: Path, monkeypatch: pytest.MonkeyPatch
 ) -> None:
@@ -1122,6 +1184,38 @@ def test_write_runner_files_cognito_email_vars_prefer_runner_secrets_and_default
     assert vars_json_default["app_certificate_arn"] == ""
 
 
+def test_write_runner_files_wires_analyst_lambda_vpc_egress(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """analyst_lambda_vpc_egress needs all three wiring points (vars_json,
+    root variable, module argument) and reads runner-secrets first — the
+    durable per-environment home for the flag — with a payload fallback.
+    Secrets Manager JSON strings ("true") must land as real booleans."""
+    runner = load_runner()
+    tf_dir = _cognito_email_runner_env(runner, tmp_path, monkeypatch)
+    base_payload = {
+        "stage": "tei-e2e",
+        "awsRegion": "us-east-1",
+        "awsAccountId": "637423202447",
+        "dbPassword": "db-secret",
+        "apiAuthSecret": "api-secret",
+    }
+
+    assert runner.write_runner_files(base_payload, {})[
+        "analyst_lambda_vpc_egress"
+    ] is False
+    assert runner.write_runner_files(
+        base_payload, {"analystLambdaVpcEgress": "true"}
+    )["analyst_lambda_vpc_egress"] is True
+    assert runner.write_runner_files(
+        {**base_payload, "analystLambdaVpcEgress": True}, {}
+    )["analyst_lambda_vpc_egress"] is True
+
+    main_tf = (tf_dir / "main.tf").read_text(encoding="utf-8")
+    assert 'variable "analyst_lambda_vpc_egress"' in main_tf
+    assert "= var.analyst_lambda_vpc_egress" in main_tf
+
+
 def test_write_runner_files_threads_customer_domain_vars_from_payload(
     tmp_path: Path, monkeypatch: pytest.MonkeyPatch
 ) -> None:

package/dist/terraform/modules/app/lambda-api/capability-search-alarms.tf

@@ -0,0 +1,60 @@
+# THINK-280 U8 — governed capability runtime external-search observability.
+#
+# The external MCP search facade (/mcp/capabilities) and the confidential
+# client_credentials token leg are the LAST rollout stage. These alarms fire
+# from AWS/Lambda Errors metrics that EXIST without any log-group management
+# (handler crashes, including ones that never reach a log line) — the same
+# constraint memory-alarms.tf documents. Log-metric filters over the broker's
+# structured replay/policy/readiness/adapter/provider failure codes require the
+# /aws/lambda/<function> groups (created only after first invocation) and are a
+# coordinated follow-up; until then those failure classes are observable through
+# the structured logs + the capability_broker_calls evidence table.
+#
+# DISABLE PATH: flip `enable_capability_broker = false` (or the tenant/env gate
+# CAPABILITY_EXTERNAL_SEARCH_ENABLED). The handler + route stay deployed but
+# return an empty, no-data projection, so no new external access is granted —
+# while all historical capability_broker_calls / compliance evidence remains
+# queryable. These alarms only exist while the broker is enabled.
+#
+# alarm_actions are intentionally empty (see memory-alarms.tf): operators wire
+# an SNS topic when the rollout needs paging.
+
+resource "aws_cloudwatch_metric_alarm" "capability_search_lambda_errors" {
+  count = local.deploy_lambda_handlers && var.enable_capability_broker ? 1 : 0
+
+  alarm_name          = "thinkwork-${var.stage}-mcp-capability-search-lambda-errors"
+  alarm_description   = "mcp-capability-search (external capability search facade) crashed. External hosts see a failed search; no capability data is exposed on error (fail closed). Investigate before continuing the external-search rollout."
+  namespace           = "AWS/Lambda"
+  metric_name         = "Errors"
+  statistic           = "Sum"
+  period              = 300
+  evaluation_periods  = 1
+  threshold           = 1
+  comparison_operator = "GreaterThanOrEqualToThreshold"
+  treat_missing_data  = "notBreaching"
+  alarm_actions       = []
+
+  dimensions = {
+    FunctionName = aws_lambda_function.handler["mcp-capability-search"].function_name
+  }
+}
+
+resource "aws_cloudwatch_metric_alarm" "capability_oauth_token_errors" {
+  count = local.deploy_lambda_handlers && var.enable_capability_broker ? 1 : 0
+
+  alarm_name          = "thinkwork-${var.stage}-mcp-oauth-lambda-errors"
+  alarm_description   = "mcp-oauth crashed — includes the confidential client_credentials token leg for external capability clients. Token minting failing hard (never issuing on a bad secret is expected + returns 401, not an Error). Investigate credential/DB reachability."
+  namespace           = "AWS/Lambda"
+  metric_name         = "Errors"
+  statistic           = "Sum"
+  period              = 300
+  evaluation_periods  = 1
+  threshold           = 3
+  comparison_operator = "GreaterThanOrEqualToThreshold"
+  treat_missing_data  = "notBreaching"
+  alarm_actions       = []
+
+  dimensions = {
+    FunctionName = aws_lambda_function.handler["mcp-oauth"].function_name
+  }
+}