thinkwork-cli 0.13.1 → 1.0.0

package/dist/plugins/twenty/smoke/twenty-managed-app-smoke.mjs

@@ -1,359 +0,0 @@
-#!/usr/bin/env node
-/**
- * Smoke test the Twenty CRM managed application deployment.
- *
- * Dry-run is the default. Set SMOKE_ENABLE_TWENTY_MANAGED_APP=1 after deploy
- * to read Terraform/API deployment status and probe the public Twenty /healthz
- * endpoint when the runtime is enabled.
- *
- * Optional live env:
- *   SMOKE_TERRAFORM_DIR=terraform/examples/greenfield
- *   SMOKE_TWENTY_URL=https://crm.example.com
- *   SMOKE_TENANT_ID=<tenant-id>
- *   VITE_GRAPHQL_HTTP_URL, GRAPHQL_HTTP_URL, or API_GRAPHQL_URL
- *   API_AUTH_SECRET, THINKWORK_API_SECRET, VITE_GRAPHQL_API_KEY, or GRAPHQL_API_KEY
- */
-
-import { execFileSync } from "node:child_process";
-import fs from "node:fs";
-import path from "node:path";
-import process from "node:process";
-import { attachSmokeEvidence } from "../../../scripts/smoke/deployment-evidence.mjs";
-
-const LIVE_ENABLED = process.env.SMOKE_ENABLE_TWENTY_MANAGED_APP === "1";
-const TIMEOUT_MS = Number(process.env.SMOKE_TIMEOUT_MS || 15_000);
-
-const env = {
-  ...loadEnvFile(),
-  ...process.env,
-};
-
-const terraformDir = env.SMOKE_TERRAFORM_DIR || "terraform/examples/greenfield";
-const apiUrl = first(
-  env.VITE_GRAPHQL_HTTP_URL,
-  env.GRAPHQL_HTTP_URL,
-  env.API_GRAPHQL_URL,
-);
-const apiSecret = first(env.API_AUTH_SECRET, env.THINKWORK_API_SECRET);
-const apiKey = first(
-  env.VITE_GRAPHQL_API_KEY,
-  env.APPSYNC_API_KEY,
-  env.GRAPHQL_API_KEY,
-);
-const tenantId = first(env.SMOKE_TENANT_ID, env.TENANT_ID);
-
-if (!LIVE_ENABLED) {
-  console.log(
-    JSON.stringify(
-      await attachSmokeEvidence(
-        "twenty-managed-app",
-        {
-          ok: true,
-          skippedLive: true,
-          reason:
-            "set SMOKE_ENABLE_TWENTY_MANAGED_APP=1 to run the deployed Twenty managed-app smoke",
-          dryRun: {
-            terraformDir,
-            requiredWhenRunning: [
-              "Terraform outputs in SMOKE_TERRAFORM_DIR or SMOKE_TWENTY_URL",
-              "Twenty provisioned/runtime deployment status",
-            ],
-            optionalGraphqlEnv: [
-              "SMOKE_TENANT_ID",
-              "VITE_GRAPHQL_HTTP_URL or GRAPHQL_HTTP_URL or API_GRAPHQL_URL",
-              "API_AUTH_SECRET or THINKWORK_API_SECRET or VITE_GRAPHQL_API_KEY or GRAPHQL_API_KEY",
-            ],
-            verifies: [
-              "twenty_provisioned false skips cleanly",
-              "twenty_runtime_enabled true requires HTTPS twenty_url",
-              "public Twenty /healthz responds successfully",
-              "optional GraphQL deployment status and managed-app health agree with the public URL",
-            ],
-          },
-        },
-        env,
-      ),
-      null,
-      2,
-    ),
-  );
-  process.exit(0);
-}
-
-try {
-  const result = await runLiveSmoke();
-  console.log(
-    JSON.stringify(
-      await attachSmokeEvidence(
-        "twenty-managed-app",
-        { ok: true, ...result },
-        env,
-      ),
-      null,
-      2,
-    ),
-  );
-} catch (error) {
-  fail(error instanceof Error ? error.message : String(error));
-}
-
-async function runLiveSmoke() {
-  const terraform = readTerraformOutputs(terraformDir);
-  const graphql = await readGraphqlStatus().catch((error) => ({
-    error: error instanceof Error ? error.message : String(error),
-  }));
-  const status = resolveStatus({ terraform, graphql });
-
-  if (!status.provisioned) {
-    return {
-      skippedLive: true,
-      reason: "Twenty CRM is not provisioned for this stage.",
-      terraform,
-      graphql,
-    };
-  }
-
-  if (!status.runtimeEnabled) {
-    return {
-      skippedLive: true,
-      reason: "Twenty CRM is provisioned but runtime is parked.",
-      status,
-      terraform,
-      graphql,
-    };
-  }
-
-  if (!status.url) {
-    throw new Error(
-      "Twenty runtime is enabled but no public URL was resolved.",
-    );
-  }
-  if (!status.url.startsWith("https://")) {
-    throw new Error(`Twenty URL must be HTTPS, got ${status.url}.`);
-  }
-
-  const publicHealth = await probeHealthz(status.url);
-  const graphqlHealth =
-    graphql?.deploymentStatus && !graphql.error
-      ? await readGraphqlHealth().catch((error) => ({
-          error: error instanceof Error ? error.message : String(error),
-        }))
-      : null;
-
-  if (!publicHealth.healthy) {
-    throw new Error(
-      `Twenty /healthz failed: HTTP ${publicHealth.statusCode ?? "none"} ${publicHealth.message}`,
-    );
-  }
-  if (graphqlHealth && "healthy" in graphqlHealth && !graphqlHealth.healthy) {
-    throw new Error(
-      `GraphQL managed health reported unhealthy: ${graphqlHealth.message}`,
-    );
-  }
-
-  return {
-    status,
-    publicHealth,
-    graphqlHealth,
-    terraform,
-    graphql,
-  };
-}
-
-function resolveStatus({ terraform, graphql }) {
-  const app = graphql?.deploymentStatus?.managedApplications?.find(
-    (entry) => entry.key === "twenty",
-  );
-  return {
-    provisioned: bool(
-      firstDefined(
-        app?.provisioned,
-        terraform.twenty_provisioned,
-        !!env.SMOKE_TWENTY_URL,
-      ),
-    ),
-    runtimeEnabled: bool(
-      firstDefined(
-        app?.runtimeEnabled,
-        terraform.twenty_runtime_enabled,
-        !!env.SMOKE_TWENTY_URL,
-      ),
-    ),
-    url: first(env.SMOKE_TWENTY_URL, app?.url, terraform.twenty_url),
-    source: app ? "graphql" : terraform.available ? "terraform" : "env",
-    status: app?.status ?? null,
-    message: app?.message ?? null,
-  };
-}
-
-async function probeHealthz(baseUrl) {
-  const endpoint = new URL("/healthz", baseUrl).toString();
-  const started = Date.now();
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
-  try {
-    const response = await fetch(endpoint, { signal: controller.signal });
-    const body = await response.text().catch(() => "");
-    return {
-      endpoint,
-      healthy: response.ok,
-      statusCode: response.status,
-      latencyMs: Date.now() - started,
-      message: body.slice(0, 300),
-    };
-  } finally {
-    clearTimeout(timer);
-  }
-}
-
-function readTerraformOutputs(dir) {
-  const resolved = path.resolve(dir);
-  if (!fs.existsSync(resolved)) {
-    return { available: false, reason: `Terraform dir not found: ${dir}` };
-  }
-
-  try {
-    const raw = execFileSync(
-      "terraform",
-      ["-chdir=" + resolved, "output", "-json"],
-      {
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "pipe"],
-      },
-    );
-    const parsed = JSON.parse(raw);
-    return {
-      available: true,
-      twenty_provisioned: outputValue(parsed.twenty_provisioned),
-      twenty_runtime_enabled: outputValue(parsed.twenty_runtime_enabled),
-      twenty_url: outputValue(parsed.twenty_url),
-      twenty_server_log_group_name: outputValue(
-        parsed.twenty_server_log_group_name,
-      ),
-      twenty_worker_log_group_name: outputValue(
-        parsed.twenty_worker_log_group_name,
-      ),
-      twenty_cache_endpoint: outputValue(parsed.twenty_cache_endpoint),
-    };
-  } catch (error) {
-    return {
-      available: false,
-      reason: error instanceof Error ? error.message : String(error),
-    };
-  }
-}
-
-async function readGraphqlStatus() {
-  if (!apiUrl || (!apiSecret && !apiKey)) return null;
-  const data = await gql(`
-    query TwentySmokeDeploymentStatus {
-      deploymentStatus {
-        stage
-        region
-        twentyProvisioned
-        twentyRuntimeEnabled
-        twentyUrl
-        managedApplications {
-          key
-          status
-          provisioned
-          runtimeEnabled
-          url
-          message
-        }
-      }
-    }
-  `);
-  return data;
-}
-
-async function readGraphqlHealth() {
-  const data = await gql(`
-    query TwentySmokeManagedApplicationHealth {
-      managedApplicationHealthCheck(key: "twenty") {
-        healthy
-        statusCode
-        latencyMs
-        endpoint
-        message
-      }
-    }
-  `);
-  return data.managedApplicationHealthCheck;
-}
-
-async function gql(query) {
-  const headers = { "content-type": "application/json" };
-  if (tenantId) headers["x-tenant-id"] = tenantId;
-  if (apiSecret) headers.authorization = `Bearer ${apiSecret}`;
-  else headers["x-api-key"] = apiKey;
-
-  const response = await fetch(apiUrl, {
-    method: "POST",
-    headers,
-    body: JSON.stringify({ query }),
-  });
-  if (!response.ok) {
-    throw new Error(
-      `GraphQL HTTP ${response.status}: ${await response.text()}`,
-    );
-  }
-  const body = await response.json();
-  if (body.errors?.length) {
-    throw new Error(`GraphQL errors: ${JSON.stringify(body.errors)}`);
-  }
-  return body.data;
-}
-
-function outputValue(entry) {
-  return entry && Object.prototype.hasOwnProperty.call(entry, "value")
-    ? entry.value
-    : undefined;
-}
-
-function firstDefined(...values) {
-  return values.find((value) => value !== undefined && value !== null);
-}
-
-function bool(value) {
-  return value === true || value === "true" || value === "1";
-}
-
-function loadEnvFile() {
-  const explicit = process.env.COMPUTER_ENV_FILE;
-  if (explicit === "none") return {};
-  const candidates = [explicit, "apps/web/.env", ".env"].filter(Boolean);
-
-  for (const candidate of candidates) {
-    const resolved = path.resolve(candidate);
-    if (!fs.existsSync(resolved)) continue;
-    return Object.fromEntries(
-      fs
-        .readFileSync(resolved, "utf8")
-        .split(/\r?\n/)
-        .map((line) => line.trim())
-        .filter((line) => line && !line.startsWith("#") && line.includes("="))
-        .map((line) => {
-          const index = line.indexOf("=");
-          const key = line.slice(0, index).trim();
-          const value = line
-            .slice(index + 1)
-            .trim()
-            .replace(/^['"]|['"]$/g, "");
-          return [key, value];
-        }),
-    );
-  }
-  return {};
-}
-
-function first(...values) {
-  return values.find(
-    (value) => value !== undefined && value !== null && value !== "",
-  );
-}
-
-function fail(message) {
-  console.error(JSON.stringify({ ok: false, error: message }, null, 2));
-  process.exit(1);
-}

package/dist/plugins/workos-auth/package.json

@@ -1,22 +0,0 @@
-{
-  "name": "@thinkwork/plugin-workos-auth",
-  "version": "0.0.0",
-  "private": true,
-  "type": "module",
-  "main": "./src/index.ts",
-  "exports": {
-    ".": "./src/index.ts",
-    "./manifest": "./src/manifest.ts",
-    "./provider-contract": "./src/provider-contract.ts"
-  },
-  "scripts": {
-    "build": "tsc --build",
-    "typecheck": "tsc --noEmit",
-    "test": "vitest run"
-  },
-  "devDependencies": {
-    "@thinkwork/plugin-catalog": "workspace:*",
-    "typescript": "^5.5.0",
-    "vitest": "^2.0.0"
-  }
-}

package/dist/plugins/workos-auth/src/index.ts

@@ -1,30 +0,0 @@
-import { workosAuthManifest } from "./manifest";
-
-export const workosAuthPluginPackage = {
-  packageKey: "workos-auth",
-  sourceRoot: "plugins/workos-auth",
-  manifest: workosAuthManifest,
-  ownedSources: [
-    {
-      kind: "manifest",
-      path: "plugins/workos-auth/src/manifest.ts",
-      description:
-        "WorkOS Auth catalog manifest and Cognito auth-provider component contract.",
-    },
-    {
-      kind: "api",
-      path: "plugins/workos-auth/src/provider-contract.ts",
-      description:
-        "WorkOS Auth provider keys, admin config fields, and U1-approved public option metadata.",
-    },
-    {
-      kind: "tests",
-      path: "plugins/workos-auth/test",
-      description: "WorkOS Auth package-local manifest and contract tests.",
-    },
-  ],
-  compatibilityLinks: [],
-} as const;
-
-export { workosAuthManifest };
-export * from "./provider-contract";

package/dist/plugins/workos-auth/src/manifest.ts

@@ -1,40 +0,0 @@
-import type { PluginManifest } from "@thinkwork/plugin-catalog/contracts";
-
-import {
-  WORKOS_AUTH_COGNITO_IDP_NAME,
-  WORKOS_AUTH_PROVIDER_COMPONENT_KEY,
-  WORKOS_AUTH_SETTINGS_SURFACE,
-  workosAuthConfigFields,
-  workosAuthPublicOptions,
-} from "./provider-contract";
-
-export const workosAuthManifest = {
-  pluginKey: "workos-auth",
-  displayName: "WorkOS Auth",
-  description:
-    "WorkOS-backed SSO broker that federates through Cognito while keeping Cognito as ThinkWork's final session issuer.",
-  versions: [
-    {
-      version: "0.1.0",
-      requiredOauthScopes: [],
-      components: [
-        {
-          type: "auth-provider",
-          key: WORKOS_AUTH_PROVIDER_COMPONENT_KEY,
-          displayName: "WorkOS Cognito federation",
-          provider: "workos",
-          settingsSurface: WORKOS_AUTH_SETTINGS_SURFACE,
-          cognitoIdentityProviderName: WORKOS_AUTH_COGNITO_IDP_NAME,
-          configFields: workosAuthConfigFields,
-          publicOptions: workosAuthPublicOptions,
-        },
-        {
-          type: "ui-surface",
-          key: "settings",
-          displayName: "WorkOS Auth settings",
-          intendedMount: WORKOS_AUTH_SETTINGS_SURFACE,
-        },
-      ],
-    },
-  ],
-} satisfies PluginManifest;

package/dist/plugins/workos-auth/src/provider-contract.ts

@@ -1,39 +0,0 @@
-import type {
-  AuthProviderConfigField,
-  AuthProviderPublicOption,
-} from "@thinkwork/plugin-catalog/contracts";
-
-export const WORKOS_AUTH_PROVIDER_COMPONENT_KEY = "workos-auth" as const;
-export const WORKOS_AUTH_SETTINGS_SURFACE =
-  "settings.plugins.workos-auth" as const;
-export const WORKOS_AUTH_COGNITO_IDP_NAME = "WorkOSAuth" as const;
-
-export const workosAuthConfigFields = [
-  {
-    key: "issuerUrl",
-    displayName: "WorkOS AuthKit issuer URL",
-    required: true,
-    storage: "metadata",
-  },
-  {
-    key: "clientId",
-    displayName: "WorkOS OAuth client ID",
-    required: true,
-    storage: "metadata",
-  },
-  {
-    key: "clientSecret",
-    displayName: "WorkOS OAuth client secret",
-    required: true,
-    storage: "secret-ref",
-  },
-] satisfies AuthProviderConfigField[];
-
-export const workosAuthPublicOptions = [
-  {
-    key: "sso",
-    displayName: "Continue with SSO",
-    providerSpecific: false,
-    recommended: true,
-  },
-] satisfies AuthProviderPublicOption[];

package/dist/plugins/workos-auth/test/manifest.test.ts

@@ -1,94 +0,0 @@
-import { describe, expect, it } from "vitest";
-
-import {
-  validatePluginManifest,
-  type AuthProviderComponent,
-} from "@thinkwork/plugin-catalog/contracts";
-import { defineFirstPartyPluginPackage } from "@thinkwork/plugin-catalog/plugin-package";
-
-import { workosAuthPluginPackage } from "../src";
-import { workosAuthManifest } from "../src/manifest";
-import {
-  WORKOS_AUTH_COGNITO_IDP_NAME,
-  WORKOS_AUTH_PROVIDER_COMPONENT_KEY,
-  WORKOS_AUTH_SETTINGS_SURFACE,
-  workosAuthConfigFields,
-  workosAuthPublicOptions,
-} from "../src/provider-contract";
-
-function authProviderComponent(): AuthProviderComponent {
-  const component = workosAuthManifest.versions[0].components.find(
-    (candidate) => candidate.type === "auth-provider",
-  );
-  if (component?.type !== "auth-provider") {
-    throw new Error("WorkOS Auth manifest is missing auth-provider component");
-  }
-  return component;
-}
-
-describe("WorkOS Auth plugin manifest", () => {
-  it("validates as an auth-provider plugin with a settings surface", () => {
-    const validated = validatePluginManifest(workosAuthManifest);
-
-    expect(validated.pluginKey).toBe("workos-auth");
-    expect(validated.displayName).toBe("WorkOS Auth");
-    expect(validated.versions[0].requiredOauthScopes).toEqual([]);
-    expect(validated.versions[0].components.map((component) => component.type))
-      .toEqual(["auth-provider", "ui-surface"]);
-  });
-
-  it("declares the U1-approved single SSO fallback instead of provider buttons", () => {
-    const component = authProviderComponent();
-
-    expect(component).toMatchObject({
-      type: "auth-provider",
-      key: WORKOS_AUTH_PROVIDER_COMPONENT_KEY,
-      provider: "workos",
-      settingsSurface: WORKOS_AUTH_SETTINGS_SURFACE,
-      cognitoIdentityProviderName: WORKOS_AUTH_COGNITO_IDP_NAME,
-    });
-    expect(component.publicOptions).toEqual(workosAuthPublicOptions);
-    expect(component.publicOptions).toEqual([
-      {
-        key: "sso",
-        displayName: "Continue with SSO",
-        providerSpecific: false,
-        recommended: true,
-      },
-    ]);
-  });
-
-  it("models secrets as secret references, never manifest values", () => {
-    expect(workosAuthConfigFields).toEqual([
-      {
-        key: "issuerUrl",
-        displayName: "WorkOS AuthKit issuer URL",
-        required: true,
-        storage: "metadata",
-      },
-      {
-        key: "clientId",
-        displayName: "WorkOS OAuth client ID",
-        required: true,
-        storage: "metadata",
-      },
-      {
-        key: "clientSecret",
-        displayName: "WorkOS OAuth client secret",
-        required: true,
-        storage: "secret-ref",
-      },
-    ]);
-    expect(JSON.stringify(workosAuthManifest)).not.toMatch(
-      /client_secret|sk_|secretValue|currentValue/,
-    );
-  });
-
-  it("defines a first-party package boundary under plugins/workos-auth", () => {
-    const defined = defineFirstPartyPluginPackage(workosAuthPluginPackage);
-
-    expect(defined.packageKey).toBe("workos-auth");
-    expect(defined.sourceRoot).toBe("plugins/workos-auth");
-    expect(defined.compatibilityLinks).toEqual([]);
-  });
-});

package/dist/plugins/workos-auth/tsconfig.json

@@ -1,8 +0,0 @@
-{
-  "extends": "../../tsconfig.base.json",
-  "compilerOptions": {
-    "outDir": "./dist",
-    "rootDir": "."
-  },
-  "include": ["./**/*.ts"]
-}

package/dist/terraform/modules/app/agentcore-code-interpreter/Dockerfile.sandbox-base

@@ -1,61 +0,0 @@
-# Sandbox base image for the AgentCore Code Interpreter.
-#
-# Builds a Python 3.12 container with a small, pinned set of libraries
-# template authors can rely on without paying the first-turn `pip install`
-# tax. Installs sitecustomize.py so the stdout/stderr token redactor is
-# active before any user code or framework traceback runs on cold start.
-#
-# Image tagging is CI-driven (see scripts/build_and_push_sandbox_base.sh).
-# Tags are immutable; a bump ships as a reviewable PR.
-#
-# Build context is the repository root so the COPY line can reach the
-# module-owned Python source below.
-#
-#   docker build -f terraform/modules/app/agentcore-code-interpreter/Dockerfile.sandbox-base .
-
-FROM python:3.12-slim AS base
-
-# ---------------------------------------------------------------------------
-# System packages — minimal. The sandbox runs agent code, not a full distro.
-# ---------------------------------------------------------------------------
-RUN apt-get update && apt-get install -y --no-install-recommends \
-        ca-certificates \
-        curl \
-        git \
-    && rm -rf /var/lib/apt/lists/*
-
-# ---------------------------------------------------------------------------
-# Blessed Python libraries — pinned to explicit versions per plan R14/R24.
-# Bumps happen in reviewable PRs. Runtime `pip install` is still allowed
-# (per R15; T2 residual is named), but these baseline packages install once
-# at image bake and don't pay the per-turn cost.
-# ---------------------------------------------------------------------------
-RUN pip install --no-cache-dir \
-        pandas==2.2.3 \
-        numpy==2.1.3 \
-        requests==2.32.3 \
-        boto3==1.38.0 \
-        httpx==0.28.1 \
-        pyyaml==6.0.2 \
-        openpyxl==3.1.5 \
-        python-dateutil==2.9.0.post0
-
-# ---------------------------------------------------------------------------
-# sitecustomize.py — the R13 stdout/stderr token redactor. Python
-# auto-imports any module named "sitecustomize" on interpreter startup, so
-# placing it in site-packages makes the redactor load before any user code
-# (and before the framework traceback on cold start). See the module
-# docstring for the honestly-scoped invariant and named residual gaps.
-# ---------------------------------------------------------------------------
-COPY terraform/modules/app/agentcore-code-interpreter/sandbox/sitecustomize.py \
-     /usr/local/lib/python3.12/site-packages/sitecustomize.py
-
-# ---------------------------------------------------------------------------
-# Startup assertion — fail loudly if the module isn't wired up or
-# THINKWORK_SANDBOX_SCRUBBER=off slips through to prod. Runs in the same
-# image smoke-test CI job that pushes the tag.
-# ---------------------------------------------------------------------------
-RUN python -c "import sitecustomize; assert sitecustomize.installed(), 'sitecustomize did not install its stdio wrapper on import'; print('sitecustomize: OK')"
-
-# AgentCore Code Interpreter supplies its own entrypoint; we provide the
-# libraries + scrubber only. No CMD/ENTRYPOINT override.