thinkwork-cli 0.13.1 → 1.0.0

package/dist/terraform/modules/app/agentcore-harness/variables.tf

@@ -1,25 +0,0 @@
-variable "enabled" {
-  description = "Create the AgentCore Harness trial IAM surface (THINK-311 U4). Pure-IAM and inert — nothing invokes Harness until U5 — so it defaults on; flip off to remove the role without touching root variables."
-  type        = bool
-  default     = true
-}
-
-variable "stage" {
-  description = "Deployment stage (dev, prod, etc.)"
-  type        = string
-}
-
-variable "region" {
-  description = "AWS region"
-  type        = string
-}
-
-variable "account_id" {
-  description = "AWS account ID"
-  type        = string
-}
-
-variable "bucket_name" {
-  description = "Stage workspace S3 bucket name — Harness microVMs read tenant skill sources under tenants/*"
-  type        = string
-}

package/dist/terraform/modules/app/hindsight-memory/README.md

@@ -1,89 +0,0 @@
-# Hindsight Memory Module (canonical user and Space memory)
-
-Thinkwork provisions AgentCore managed memory as an AWS platform primitive, but
-full ThinkWork installs use **Hindsight** as the canonical user and Space memory
-provider. AgentCore-only memory remains available as an explicit
-low-cost/development opt-out.
-
-## Memory layers
-
-| Layer                 | Backend                 | Always on                     | What it stores                                                                 |
-| --------------------- | ----------------------- | ----------------------------- | ------------------------------------------------------------------------------ |
-| 1. Workspace files    | S3 per-agent            | Yes                           | Scratchpad, working files                                                      |
-| 2. Thread history     | Aurora `messages` table | Yes                           | Last 30 turns per thread                                                       |
-| 3a. Managed long-term | AgentCore Memory        | **Yes**                       | AWS platform memory primitive and low-cost/development fallback                |
-| 3b. Product long-term | Hindsight ECS service   | **Default for full installs** | Canonical user/Space memory with entity graph + BM25 + cross-encoder reranking |
-
-## How retention works
-
-The agent container automatically emits a `CreateEvent` into AgentCore
-Memory after every turn (user message + assistant response), via
-`memory.store_turn_pair` in `packages/agentcore/agent-container/memory.py`.
-AgentCore's background strategies extract facts into four namespaces:
-
-- `assistant_{actorId}` — semantic facts
-- `preferences_{actorId}` — user preferences
-- `session_{sessionId}` — session summaries
-- `episodes_{actorId}/{sessionId}` — episodic memory
-
-The agent reads them back via the `recall()` tool. There is no need for
-the model to call `remember()` for routine facts — it only exists for
-user-driven "please remember X" requests.
-
-When Hindsight is enabled, the container ALSO registers
-`hindsight_retain`, `hindsight_recall`, and `hindsight_reflect` tools that
-route to the Hindsight service. `remember()` dual-writes to both backends
-so explicit memories land in both systems.
-
-## Usage
-
-### Default — Hindsight canonical memory
-
-```hcl
-module "thinkwork" {
-  source = "thinkwork-ai/thinkwork/aws"
-
-  stage = "prod"
-  # enable_hindsight defaults to true
-}
-```
-
-The `terraform/modules/app/agentcore-memory` module is still instantiated, but
-the active user/Space memory engine resolves to Hindsight.
-
-### Low-cost/development AgentCore-only opt-out
-
-```hcl
-module "thinkwork" {
-  source = "thinkwork-ai/thinkwork/aws"
-
-  stage            = "prod"
-  enable_hindsight = false
-  memory_engine    = "agentcore"
-
-  # This is not the full product memory path.
-}
-```
-
-When `enable_hindsight = true`, Terraform creates:
-
-- ECS Fargate cluster + service (ARM64, 2 vCPU, 4 GB)
-- Application Load Balancer
-- Security groups (ALB → Hindsight → Aurora ingress)
-- CloudWatch log group
-
-Cost: ~$75/mo (ARM64 Fargate + ALB hours).
-
-## Turning Hindsight on/off
-
-Toggling `enable_hindsight` and re-running `thinkwork deploy`:
-
-- **false → true**: creates the ECS + ALB infra. Agents gain the three
-  `hindsight_*` tools on their next invoke. The active memory engine resolves
-  to Hindsight when `memory_engine` is empty.
-- **true → false**: destroys the ECS + ALB infra. Agents lose the
-  `hindsight_*` tools. This should be paired with `memory_engine = "agentcore"`
-  for explicit low-cost/development deployments.
-
-Memory data is not migrated between backends. Hindsight records and
-AgentCore records live in separate stores.

package/dist/terraform/modules/app/hindsight-memory/main.tf

@@ -1,411 +0,0 @@
-################################################################################
-# Hindsight Memory (Optional Add-On) — App Module
-#
-# Optional ECS Fargate + ALB service for Hindsight long-term memory. Only
-# created when `enable_hindsight = true`. AgentCore managed memory is
-# always on (see ../agentcore-memory) — Hindsight runs alongside it as an
-# add-on, not as a replacement.
-#
-# Hindsight provides hindsight_retain/recall/reflect tools for cross-thread
-# organizational memory with entity-graph traversal and cross-encoder
-# reranking. It runs local embeddings + reranker and uses the shared Aurora
-# PostgreSQL instance with pgvector.
-################################################################################
-
-variable "stage" {
-  type = string
-}
-
-variable "vpc_id" {
-  type = string
-}
-
-variable "subnet_ids" {
-  type = list(string)
-}
-
-variable "db_security_group_id" {
-  type = string
-}
-
-variable "database_url" {
-  type      = string
-  sensitive = true
-}
-
-variable "database_name" {
-  description = <<-EOT
-    Dedicated Hindsight database name (THINK-220). Empty (default) keeps the
-    legacy layout: Hindsight lives in the `hindsight` schema of the primary
-    database named in database_url. Set (e.g. "thinkwork_hindsight") to point
-    the service at that database on the same cluster with schema `public` —
-    the vanilla upstream configuration, which its maintenance-loop discovery
-    queries require. The database must already exist (bootstrap SQL; Terraform
-    cannot CREATE DATABASE inside the cluster).
-  EOT
-  type        = string
-  default     = ""
-}
-
-locals {
-  # database_url with its path segment swapped for var.database_name.
-  # Matches "...host:port/<db>" with an optional "?query" tail.
-  hindsight_database_url = (
-    var.database_name == ""
-    ? var.database_url
-    : replace(var.database_url, "/(/[^/?]+)([?].*)?$/", "/${var.database_name}$2")
-  )
-}
-
-variable "image_tag" {
-  description = "Hindsight Docker image tag (ghcr.io/vectorize-io/hindsight:<tag>)"
-  type        = string
-  default     = "0.8.4"
-}
-
-variable "enable_auto_consolidation" {
-  description = "Run Hindsight's observation consolidation engine automatically after retain. Service-level default; per-bank config overrides apply on top."
-  type        = bool
-  default     = true
-}
-
-variable "consolidation_dedup_threshold" {
-  description = "Cosine-similarity threshold for near-duplicate observation reconciliation (0.0-1.0; 1.0 disables). Hindsight default is 0.97 — set explicitly so deploys don't drift with image defaults."
-  type        = string
-  default     = "0.97"
-}
-
-variable "retain_llm_model" {
-  description = "Bedrock model id for Hindsight's retain/extraction pass. Default = Haiku 4.5, validated on image 0.8.4 (THINK-201, 2026-07-06): 12.9% dangling-referent rate vs ~38% for gpt-oss-20b, best usefulness of any measured config, zero Anthropic tool-schema errors (the 0.5.0 incompatibility that caused the THINK-198 incident is fixed upstream). Evidence: docs/solutions/tooling-decisions/hindsight-084-upgrade-validation-2026-07-06.md. Requires image >= 0.8.x for anthropic.* models."
-  type        = string
-  default     = "us.anthropic.claude-haiku-4-5-20251001-v1:0"
-}
-
-variable "observations_mission" {
-  description = "Service-level default observations mission steering what consolidation synthesizes. Empty string omits the env var so the image default applies. Per-bank overrides apply on top."
-  type        = string
-  default     = "Synthesize durable, institutional facts about the business: customers, projects, decisions, processes, tools, relationships, and recurring patterns. Filter out ephemeral state, secrets, and personal small talk."
-}
-
-data "aws_region" "current" {}
-
-################################################################################
-# ECS Cluster
-################################################################################
-
-resource "aws_ecs_cluster" "main" {
-  name = "thinkwork-${var.stage}-cluster"
-
-  setting {
-    name  = "containerInsights"
-    value = "enabled"
-  }
-
-  tags = { Name = "thinkwork-${var.stage}-cluster" }
-}
-
-################################################################################
-# IAM
-################################################################################
-
-resource "aws_iam_role" "ecs_execution" {
-  name = "thinkwork-${var.stage}-hindsight-execution"
-
-  assume_role_policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [{
-      Action    = "sts:AssumeRole"
-      Effect    = "Allow"
-      Principal = { Service = "ecs-tasks.amazonaws.com" }
-    }]
-  })
-}
-
-resource "aws_iam_role_policy_attachment" "ecs_execution" {
-  role       = aws_iam_role.ecs_execution.name
-  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
-}
-
-resource "aws_iam_role" "ecs_task" {
-  name = "thinkwork-${var.stage}-hindsight-task"
-
-  assume_role_policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [{
-      Action    = "sts:AssumeRole"
-      Effect    = "Allow"
-      Principal = { Service = "ecs-tasks.amazonaws.com" }
-    }]
-  })
-}
-
-resource "aws_iam_role_policy" "bedrock_access" {
-  name = "bedrock-access"
-  role = aws_iam_role.ecs_task.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [{
-      Effect   = "Allow"
-      Action   = ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"]
-      Resource = "*"
-    }]
-  })
-}
-
-################################################################################
-# Security Groups
-################################################################################
-
-resource "aws_security_group" "hindsight" {
-  name_prefix = "thinkwork-${var.stage}-hindsight-"
-  description = "Hindsight ECS task"
-  vpc_id      = var.vpc_id
-
-  ingress {
-    description     = "ALB to Hindsight API"
-    from_port       = 8888
-    to_port         = 8888
-    protocol        = "tcp"
-    security_groups = [aws_security_group.alb.id]
-  }
-
-  egress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
-
-  tags = { Name = "thinkwork-${var.stage}-hindsight-sg" }
-  lifecycle { create_before_destroy = true }
-}
-
-resource "aws_security_group" "alb" {
-  name_prefix = "thinkwork-${var.stage}-hindsight-alb-"
-  description = "Hindsight ALB"
-  vpc_id      = var.vpc_id
-
-  ingress {
-    from_port   = 80
-    to_port     = 80
-    protocol    = "tcp"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
-
-  egress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
-
-  tags = { Name = "thinkwork-${var.stage}-hindsight-alb-sg" }
-  lifecycle { create_before_destroy = true }
-}
-
-resource "aws_security_group_rule" "aurora_from_hindsight" {
-  type                     = "ingress"
-  from_port                = 5432
-  to_port                  = 5432
-  protocol                 = "tcp"
-  source_security_group_id = aws_security_group.hindsight.id
-  security_group_id        = var.db_security_group_id
-}
-
-################################################################################
-# ALB
-################################################################################
-
-resource "aws_lb" "hindsight" {
-  name               = "tw-${var.stage}-hindsight"
-  internal           = false
-  load_balancer_type = "application"
-  security_groups    = [aws_security_group.alb.id]
-  subnets            = var.subnet_ids
-
-  # Synchronous retain runs LLM extraction + auto-consolidation and routinely
-  # exceeds the 60s ALB default, which returned 504s to the retain Lambda
-  # while Hindsight was still working (every dead-lettered retain attempt on
-  # dev showed ~60.1-60.5s backend latency). Must stay above the retain
-  # Lambda's HINDSIGHT_TIMEOUT_MS so the client, not the ALB, owns timeouts.
-  idle_timeout = 300
-
-  tags = { Name = "thinkwork-${var.stage}-hindsight-alb" }
-}
-
-resource "aws_lb_target_group" "hindsight" {
-  name        = "tw-${var.stage}-hindsight"
-  port        = 8888
-  protocol    = "HTTP"
-  vpc_id      = var.vpc_id
-  target_type = "ip"
-
-  health_check {
-    path                = "/health"
-    port                = "8888"
-    protocol            = "HTTP"
-    healthy_threshold   = 2
-    unhealthy_threshold = 3
-    timeout             = 10
-    interval            = 30
-    matcher             = "200-399"
-  }
-
-  tags = { Name = "thinkwork-${var.stage}-hindsight-tg" }
-}
-
-resource "aws_lb_listener" "hindsight" {
-  load_balancer_arn = aws_lb.hindsight.arn
-  port              = 80
-  protocol          = "HTTP"
-
-  default_action {
-    type             = "forward"
-    target_group_arn = aws_lb_target_group.hindsight.arn
-  }
-}
-
-################################################################################
-# CloudWatch Logs
-################################################################################
-
-resource "aws_cloudwatch_log_group" "hindsight" {
-  name              = "/thinkwork/${var.stage}/hindsight"
-  retention_in_days = 14
-
-  tags = { Name = "thinkwork-${var.stage}-hindsight-logs" }
-}
-
-################################################################################
-# ECS Task Definition
-################################################################################
-
-resource "aws_ecs_task_definition" "hindsight" {
-  family                   = "thinkwork-${var.stage}-hindsight"
-  requires_compatibilities = ["FARGATE"]
-  network_mode             = "awsvpc"
-  cpu                      = 2048
-  memory                   = 4096
-  execution_role_arn       = aws_iam_role.ecs_execution.arn
-  task_role_arn            = aws_iam_role.ecs_task.arn
-
-  lifecycle {
-    precondition {
-      # A dedicated Hindsight database that is actually the primary database
-      # would put Hindsight's `public` schema on top of the thinkwork tables.
-      condition     = var.database_name == "" || !endswith(split("?", var.database_url)[0], "/${var.database_name}")
-      error_message = "database_name must be distinct from the primary database in database_url (THINK-220)."
-    }
-  }
-
-  runtime_platform {
-    operating_system_family = "LINUX"
-    cpu_architecture        = "ARM64"
-  }
-
-  container_definitions = jsonencode([{
-    name      = "hindsight"
-    image     = "ghcr.io/vectorize-io/hindsight:${var.image_tag}"
-    essential = true
-
-    portMappings = [{
-      containerPort = 8888
-      protocol      = "tcp"
-    }]
-
-    environment = concat([
-      { name = "HINDSIGHT_API_DATABASE_URL", value = local.hindsight_database_url },
-      # `public` on a dedicated database is upstream's vanilla layout — the
-      # maintenance-loop discovery queries only work there (THINK-220).
-      { name = "HINDSIGHT_API_DATABASE_SCHEMA", value = var.database_name == "" ? "hindsight" : "public" },
-      { name = "HINDSIGHT_API_VECTOR_EXTENSION", value = "pgvector" },
-      { name = "HINDSIGHT_API_TEXT_SEARCH_EXTENSION", value = "native" },
-      { name = "HINDSIGHT_API_RUN_MIGRATIONS_ON_STARTUP", value = "true" },
-      { name = "HINDSIGHT_API_LLM_PROVIDER", value = "bedrock" },
-      { name = "HINDSIGHT_API_LLM_MODEL", value = "openai.gpt-oss-20b-1:0" },
-      { name = "AWS_REGION_NAME", value = data.aws_region.current.name },
-      { name = "AWS_DEFAULT_REGION", value = data.aws_region.current.name },
-      { name = "HINDSIGHT_API_RETAIN_LLM_PROVIDER", value = "bedrock" },
-      { name = "HINDSIGHT_API_RETAIN_LLM_MODEL", value = var.retain_llm_model },
-      { name = "HINDSIGHT_API_REFLECT_LLM_PROVIDER", value = "bedrock" },
-      { name = "HINDSIGHT_API_REFLECT_LLM_MODEL", value = "openai.gpt-oss-120b-1:0" },
-      { name = "HINDSIGHT_API_EMBEDDINGS_PROVIDER", value = "local" },
-      { name = "HINDSIGHT_API_EMBEDDINGS_LOCAL_MODEL", value = "BAAI/bge-small-en-v1.5" },
-      { name = "HINDSIGHT_API_RERANKER_PROVIDER", value = "local" },
-      { name = "HINDSIGHT_API_RERANKER_MAX_CANDIDATES", value = "20" },
-      { name = "HINDSIGHT_API_RERANKER_LOCAL_BUCKET_BATCHING", value = "true" },
-      { name = "HINDSIGHT_API_RERANKER_LOCAL_MAX_CONCURRENT", value = "1" },
-      { name = "HINDSIGHT_API_RECALL_BUDGET_FUNCTION", value = "adaptive" },
-      { name = "HINDSIGHT_API_RECALL_BUDGET_MIN", value = "5" },
-      { name = "HINDSIGHT_API_RECALL_BUDGET_MAX", value = "300" },
-      { name = "HINDSIGHT_API_ENABLE_AUTO_CONSOLIDATION", value = tostring(var.enable_auto_consolidation) },
-      { name = "HINDSIGHT_API_CONSOLIDATION_DEDUP_THRESHOLD", value = var.consolidation_dedup_threshold },
-      ],
-      var.observations_mission != "" ? [
-        { name = "HINDSIGHT_API_OBSERVATIONS_MISSION", value = var.observations_mission },
-      ] : [],
-    )
-
-    logConfiguration = {
-      logDriver = "awslogs"
-      options = {
-        "awslogs-group"         = aws_cloudwatch_log_group.hindsight.name
-        "awslogs-region"        = data.aws_region.current.name
-        "awslogs-stream-prefix" = "hindsight"
-      }
-    }
-
-    healthCheck = {
-      command     = ["CMD-SHELL", "curl -f http://localhost:8888/health || exit 1"]
-      interval    = 30
-      timeout     = 10
-      retries     = 3
-      startPeriod = 300
-    }
-  }])
-
-  tags = { Name = "thinkwork-${var.stage}-hindsight" }
-}
-
-################################################################################
-# ECS Service
-################################################################################
-
-resource "aws_ecs_service" "hindsight" {
-  name            = "thinkwork-${var.stage}-hindsight"
-  cluster         = aws_ecs_cluster.main.id
-  task_definition = aws_ecs_task_definition.hindsight.arn
-  desired_count   = 1
-  launch_type     = "FARGATE"
-
-  network_configuration {
-    subnets          = var.subnet_ids
-    security_groups  = [aws_security_group.hindsight.id]
-    assign_public_ip = true
-  }
-
-  load_balancer {
-    target_group_arn = aws_lb_target_group.hindsight.arn
-    container_name   = "hindsight"
-    container_port   = 8888
-  }
-
-  depends_on = [aws_lb_listener.hindsight]
-
-  tags = { Name = "thinkwork-${var.stage}-hindsight" }
-}
-
-################################################################################
-# Outputs
-################################################################################
-
-output "hindsight_endpoint" {
-  description = "Hindsight API endpoint (ALB URL)"
-  value       = "http://${aws_lb.hindsight.dns_name}"
-}
-
-output "ecs_cluster_arn" {
-  description = "ECS cluster ARN"
-  value       = aws_ecs_cluster.main.arn
-}

package/dist/terraform/modules/data/bedrock-knowledge-base/main.tf

@@ -1,102 +0,0 @@
-################################################################################
-# Bedrock Knowledge Base — Data Module
-#
-# Creates the IAM service role that Bedrock Knowledge Bases need to access
-# S3 documents, invoke Titan embeddings, use RDS Data API, and read secrets.
-################################################################################
-
-variable "stage" {
-  description = "Deployment stage"
-  type        = string
-}
-
-variable "account_id" {
-  description = "AWS account ID"
-  type        = string
-}
-
-variable "region" {
-  description = "AWS region"
-  type        = string
-}
-
-variable "bucket_name" {
-  description = "S3 bucket name for knowledge base documents"
-  type        = string
-}
-
-data "aws_iam_policy_document" "kb_assume" {
-  statement {
-    effect  = "Allow"
-    actions = ["sts:AssumeRole"]
-    principals {
-      type        = "Service"
-      identifiers = ["bedrock.amazonaws.com"]
-    }
-    condition {
-      test     = "StringEquals"
-      variable = "aws:SourceAccount"
-      values   = [var.account_id]
-    }
-  }
-}
-
-resource "aws_iam_role" "kb_service" {
-  name               = "thinkwork-${var.stage}-kb-service-role"
-  assume_role_policy = data.aws_iam_policy_document.kb_assume.json
-}
-
-resource "aws_iam_role_policy" "kb_permissions" {
-  name = "knowledge-base-permissions"
-  role = aws_iam_role.kb_service.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Sid    = "S3ReadDocs"
-        Effect = "Allow"
-        Action = [
-          "s3:GetObject",
-          "s3:ListBucket",
-        ]
-        Resource = [
-          "arn:aws:s3:::${var.bucket_name}",
-          "arn:aws:s3:::${var.bucket_name}/*",
-        ]
-      },
-      {
-        Sid    = "BedrockEmbedding"
-        Effect = "Allow"
-        Action = ["bedrock:InvokeModel"]
-        Resource = "arn:aws:bedrock:${var.region}::foundation-model/amazon.titan-embed-text-v2:0"
-      },
-      {
-        Sid    = "RDSDataAPI"
-        Effect = "Allow"
-        Action = [
-          "rds-data:ExecuteStatement",
-          "rds-data:BatchExecuteStatement",
-        ]
-        Resource = "*"
-      },
-      {
-        Sid    = "RDSDescribe"
-        Effect = "Allow"
-        Action = ["rds:DescribeDBClusters"]
-        Resource = "*"
-      },
-      {
-        Sid    = "SecretsManager"
-        Effect = "Allow"
-        Action = ["secretsmanager:GetSecretValue"]
-        Resource = "*"
-      },
-    ]
-  })
-}
-
-output "kb_service_role_arn" {
-  description = "IAM role ARN for Bedrock Knowledge Base service"
-  value       = aws_iam_role.kb_service.arn
-}