thinkwork-cli 0.13.2 → 1.0.0

package/dist/terraform/modules/app/agentcore-admin/main.tf

@@ -100,6 +100,28 @@ variable "graphql_db_secret_arn" {
   type        = string
 }
 
+# ---- VPC placement (THINK-1082) ------------------------------------------------
+# The handler opens DATABASE_URL against Aurora's public endpoint today. When
+# in_vpc is on it attaches to the private subnets behind the api-lambda
+# security group (which the database SG admits) so the public rule can close.
+variable "in_vpc" {
+  description = "Attach the admin Lambda to the VPC (vpc_subnet_ids + vpc_security_group_ids); NAT-routed subnets required. Default off = no change."
+  type        = bool
+  default     = false
+}
+
+variable "vpc_subnet_ids" {
+  description = "Private (NAT-routed) subnet IDs for the admin Lambda when in_vpc is true."
+  type        = list(string)
+  default     = []
+}
+
+variable "vpc_security_group_ids" {
+  description = "Security groups for the admin Lambda when in_vpc is true."
+  type        = list(string)
+  default     = []
+}
+
 # ---- Capability-private interpreter VPC placement (THINK-280 U4) ---------------
 # Empty when the capability broker is disabled → handler skips capability-private
 # provisioning. Sourced from the broker outputs via the code-interpreter module.
@@ -174,6 +196,14 @@ resource "aws_secretsmanager_secret_version" "admin_token" {
 # AWS SDK calls (see packages/lambda/agentcore-admin.ts).
 ################################################################################
 
+# THINK-1082: ENI grant for the in_vpc lane; never created when off.
+resource "aws_iam_role_policy_attachment" "admin_vpc_access" {
+  count = local.deploy && var.in_vpc ? 1 : 0
+
+  role       = aws_iam_role.admin[0].name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
+}
+
 resource "aws_iam_role" "admin" {
   count = local.deploy ? 1 : 0
   name  = "thinkwork-${var.stage}-agentcore-admin"
@@ -333,6 +363,23 @@ resource "aws_lambda_function" "admin" {
     }
   }
 
+  # THINK-1082: network-only VPC attachment; absent when in_vpc is off.
+  dynamic "vpc_config" {
+    for_each = var.in_vpc ? [1] : []
+
+    content {
+      subnet_ids         = var.vpc_subnet_ids
+      security_group_ids = var.vpc_security_group_ids
+    }
+  }
+
+  lifecycle {
+    precondition {
+      condition     = !var.in_vpc || (length(var.vpc_subnet_ids) > 0 && length(var.vpc_security_group_ids) > 0)
+      error_message = "in_vpc requires non-empty vpc_subnet_ids and vpc_security_group_ids."
+    }
+  }
+
   tags = {
     Name    = local.function_name
     Stage   = var.stage

package/dist/terraform/modules/app/agentcore-code-interpreter/README.md

@@ -1,53 +1,45 @@
-# `agentcore-code-interpreter` — stage-level base image substrate
+# `agentcore-code-interpreter` — stage-level sandbox substrate
 
-Stage-scoped artifacts for the AgentCore Code Interpreter sandbox. **Per-tenant
+Stage-scoped substrate for the AgentCore Code Interpreter sandbox. **Per-tenant
 Code Interpreter instances are created at runtime** by the `agentcore-admin`
 Lambda (see `docs/adrs/per-tenant-aws-resource-fanout.md`) — this module
-stops at the substrate everything else depends on.
-
-## What it creates
-
-- **ECR repository** `thinkwork-{stage}-sandbox-base` — immutable tags, last 10
-  kept, scan-on-push.
-- **Outputs** consumed by downstream modules + the provisioning Lambda:
-  - `ecr_repository_url` — where the blessed image lives.
-  - `environment_ids` + `environments` — the v1 environment catalog (`default-public`,
-    `internal-only`) with network modes.
-  - `tenant_role_trust_policy_template` / `tenant_role_inline_policy_template` —
-    JSON templates the provisioning Lambda substitutes `{tenant_id}` into at
-    `CreateRole` time (plan Unit 5).
-
-## Files
-
-| File                                     | Purpose                                                                                                                                   |
-| ---------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
-| `main.tf`                                | ECR + outputs. No per-tenant resources.                                                                                                   |
-| `Dockerfile.sandbox-base`                | Python 3.12 + pinned libs + `sitecustomize.py`. Build context is the **repo root** so the COPY can reach the module-owned sandbox helper. |
-| `scripts/build_and_push_sandbox_base.sh` | CI builds + pushes. Not called from Terraform — image lifecycle is a reviewable-PR concern.                                               |
-
-The Python source `sitecustomize.py` and its pytest suite `test_sitecustomize.py`
-live under `terraform/modules/app/agentcore-code-interpreter/sandbox/`, next to
-the sandbox base image they protect.
+stops at the stage-level pieces everything else depends on.
+
+## What it provides
+
+The module creates no AWS resources today; it is a typed catalog + policy-template
+surface consumed by the provisioning Lambda and by downstream modules:
+
+- `environment_ids` + `environments` — the environment catalog (`default-public`,
+  `internal-only`, `capability-private`) with network modes.
+- `tenant_role_trust_policy_template` / `tenant_role_inline_policy_template` —
+  JSON templates the provisioning Lambda substitutes `{tenant_id}` into at
+  `CreateRole` time (plan Unit 5).
+- `capability_private_role_inline_policy_template` — logs-only policy for the
+  THINK-280 U4 capability-private interpreter role.
+- `capability_private_subnet_ids` / `capability_private_security_group_ids` —
+  pass-through of the broker's no-NAT VPC placement (empty when the broker is
+  disabled); wired into the `agentcore-admin` module.
+
+## No custom sandbox image (THINK-617)
+
+This module used to own an ECR repo (`thinkwork-{stage}-sandbox-base`), a
+`Dockerfile.sandbox-base` (Python 3.12 + pinned libs + a `sitecustomize.py`
+stdio scrubber) and a CI build script. **AgentCore Code Interpreter cannot use
+a custom image** — `CreateCodeInterpreterRequest` has no image/container
+parameter (verified against `@aws-sdk/client-bedrock-agentcore-control`
+3.1103.0), and `agentcore-admin` has only ever created interpreters on the
+AWS-managed image.
+
+The practical need (openpyxl et al. in the sandbox) is covered by the runtime's
+on-demand install preamble — `ON_DEMAND_LIBRARIES` in
+`packages/agentcore-pi/agent-container/src/runtime/tools/execute-code.ts`.
+
+Consequence for log scrubbing: the value-based in-image redactor never ran in
+production. The `sandbox-log-scrubber` CloudWatch subscription filter
+(pattern-based, known OAuth token shapes) is the only scrubbing layer.
 
 ## What this module does **not** do
 
-- Create per-tenant Code Interpreter instances — that's Unit 5 (agentcore-admin Lambda).
-- Build or push the Docker image — that's CI, via the shell script above.
-- Grant the provisioning Lambda IAM permissions on the new resources — that's added in Unit 5 when the Lambda resource lands.
-
-## Bumping the image
-
-1. Edit `Dockerfile.sandbox-base` (pin a new pandas / add a lib / etc.).
-2. Edit `terraform/modules/app/agentcore-code-interpreter/sandbox/sitecustomize.py` if the R13 invariant or its coverage gaps shift.
-3. PR. CI runs `pytest` on the scrubber plus a build-then-startup-assertion smoke test.
-4. After merge, `build_and_push_sandbox_base.sh` tags with the merge-commit SHA.
-
-## Named residual
-
-The R13 invariant this module's scrubber enforces is **honestly scoped** to
-Python-stdio-mediated writes + known-shape CloudWatch patterns. See the
-brainstorm and the `sitecustomize.py` module docstring for the full list of
-stdio-bypass classes (os.write, subprocess env dumps, C-extension direct
-writes, multiprocessing workers, adversarial split-writes) that the Unit 12
-pattern backstop catches partially and the v2 in-process credential proxy
-addresses structurally.
+- Create per-tenant Code Interpreter instances — that's the `agentcore-admin` Lambda.
+- Build or push any container image.

package/dist/terraform/modules/app/agentcore-code-interpreter/main.tf

@@ -1,23 +1,25 @@
 ################################################################################
 # AgentCore Code Interpreter — App Module (stage-level)
 #
-# Stage-scoped artifacts for the AgentCore Code Interpreter sandbox:
-#   * ECR repository for the blessed sandbox base image (Python 3.12 +
-#     pinned libs + sitecustomize.py R13 scrubber baked in).
-#   * Lifecycle policy to trim old images.
-#   * Outputs the per-tenant provisioning Lambda (Unit 5) consumes to
-#     CreateCodeInterpreter for each tenant on demand.
+# Stage-scoped substrate for the AgentCore Code Interpreter sandbox:
+#   * The environment catalog (network modes) the runtime selects from.
+#   * IAM policy templates + capability-private VPC placement the per-tenant
+#     provisioning Lambda (Unit 5) consumes to CreateCodeInterpreter for each
+#     tenant on demand.
 #
 # **Per-tenant resources live elsewhere.** AgentCore Code Interpreter
 # instances are created per-tenant by the ``agentcore-admin`` Lambda at
 # tenant-create time — see docs/adrs/per-tenant-aws-resource-fanout.md.
 # This module stops at the stage-level substrate.
 #
-# **Image build.** The Dockerfile.sandbox-base next to this file is built
-# and pushed by a CI job (scripts/build_and_push_sandbox_base.sh) — not by
-# Terraform. Terraform owns the ECR repo and IAM plumbing; the image
-# lifecycle is intentionally owned by CI so a repository bump is a
-# reviewable PR rather than a ``terraform apply`` side-effect.
+# **No custom image (THINK-617).** This module used to own an ECR repo for a
+# "blessed" sandbox base image (Python 3.12 + pinned libs + a sitecustomize.py
+# stdio scrubber). AgentCore Code Interpreter has no way to attach one:
+# CreateCodeInterpreterRequest carries no image/container parameter. Sandboxes
+# always run the AWS-managed image; libraries that image may lack are installed
+# on demand by the runtime's execute_code preamble (ON_DEMAND_LIBRARIES in
+# packages/agentcore-pi/.../tools/execute-code.ts). The image substrate was
+# retired — git history and THINK-617 preserve it.
 ################################################################################
 
 terraform {
@@ -44,12 +46,6 @@ variable "account_id" {
   type        = string
 }
 
-variable "image_retention_count" {
-  description = "Keep the last N image tags in ECR; older ones are lifecycle-expired."
-  type        = number
-  default     = 10
-}
-
 # THINK-280 U4 — VPC placement for the capability-private interpreter. Sourced
 # (when the capability broker is enabled) from the broker module's no-NAT
 # interpreter subnets + dedicated egress-only SG. Empty by default: the
@@ -91,45 +87,6 @@ locals {
   }
 }
 
-################################################################################
-# ECR repository — stage-level base image
-################################################################################
-
-resource "aws_ecr_repository" "sandbox_base" {
-  name                 = "thinkwork-${var.stage}-sandbox-base"
-  image_tag_mutability = "IMMUTABLE"
-  force_delete         = true
-
-  image_scanning_configuration {
-    scan_on_push = true
-  }
-
-  tags = {
-    Name    = "thinkwork-${var.stage}-sandbox-base"
-    Stage   = var.stage
-    Purpose = "agentcore-code-interpreter-base-image"
-  }
-}
-
-resource "aws_ecr_lifecycle_policy" "sandbox_base" {
-  repository = aws_ecr_repository.sandbox_base.name
-
-  policy = jsonencode({
-    rules = [{
-      rulePriority = 1
-      description  = "Keep last ${var.image_retention_count} images"
-      selection = {
-        tagStatus   = "any"
-        countType   = "imageCountMoreThan"
-        countNumber = var.image_retention_count
-      }
-      action = {
-        type = "expire"
-      }
-    }]
-  })
-}
-
 ################################################################################
 # IAM policy document — per-tenant trust template
 #
@@ -207,16 +164,6 @@ locals {
 # Outputs
 ################################################################################
 
-output "ecr_repository_name" {
-  description = "Name of the sandbox base image ECR repo."
-  value       = aws_ecr_repository.sandbox_base.name
-}
-
-output "ecr_repository_url" {
-  description = "Full URL of the sandbox base image ECR repo."
-  value       = aws_ecr_repository.sandbox_base.repository_url
-}
-
 output "environment_ids" {
   description = "Enum of valid sandbox environment identifiers."
   value       = keys(local.environments)

package/dist/terraform/modules/app/agentcore-identity/main.tf

@@ -21,12 +21,22 @@ terraform {
 ################################################################################
 
 locals {
+  # THINK-324: the workload identity is SHARED — live Twenty 3LO
+  # (lib/harness/agentcore-user-oauth.ts via AGENTCORE_IDENTITY_WORKLOAD_NAME)
+  # rides the same workload identity the proof plane created. It must exist
+  # whenever either half is enabled, and its deletion is owned by the Twenty
+  # cleanup owner (not the proof lifecycle) so retiring the proof plane never
+  # invalidates per-user Twenty grants.
+  identity_enabled                = var.enabled || var.twenty_enabled
   workload_identity_name          = "thinkwork-${var.stage}-multiplayer-proof"
   credential_provider_name        = "thinkwork-${var.stage}-proof-oauth"
   twenty_credential_provider_name = "thinkwork-${var.stage}-twenty-crm"
-  oauth_issuer                    = trimsuffix(var.oauth_issuer, "/")
-  oauth_return_url                = "${local.oauth_issuer}/complete"
-  allowed_oauth_return_urls       = distinct(concat([local.oauth_return_url], var.user_federation_return_urls))
+  oauth_issuer = trimsuffix(var.oauth_issuer, "/")
+  # THINK-324: with the proof plane retired the issuer is empty; a bare
+  # "/complete" fails UpdateWorkloadIdentity's URL-pattern validation, so the
+  # proof return URL only joins the allowlist when an issuer is configured.
+  oauth_return_url                = local.oauth_issuer != "" ? "${local.oauth_issuer}/complete" : ""
+  allowed_oauth_return_urls       = distinct(concat(compact([local.oauth_return_url]), var.user_federation_return_urls))
   configuration_hash = nonsensitive(sha256(jsonencode({
     issuer        = local.oauth_issuer
     client_id     = var.oauth_client_id
@@ -39,6 +49,9 @@ locals {
     twenty_oauth_issuer             = var.twenty_oauth_issuer
     twenty_oauth_resource           = var.twenty_oauth_resource
     twenty_client_secret_arn        = try(aws_secretsmanager_secret.twenty_oauth_client[0].arn, "")
+    bootstrap_script_sha256         = filesha256("${path.module}/scripts/bootstrap_twenty_oauth_client.sh")
+    provider_reconciler_sha256      = filesha256("${path.module}/scripts/reconcile_twenty_provider.mjs")
+    identity_reconciler_sha256      = filesha256("${path.module}/scripts/reconcile_twenty_identity.sh")
   })))
 }
 
@@ -46,7 +59,7 @@ locals {
 # value never enters Terraform state. AgentCore Identity reads the JSON key
 # directly and remains the sole custodian of each user's downstream grant.
 resource "aws_secretsmanager_secret" "twenty_oauth_client" {
-  count = var.enabled ? 1 : 0
+  count = var.twenty_enabled ? 1 : 0
 
   name                    = "thinkwork/${var.stage}/agentcore-identity/twenty-crm-oauth-client"
   description             = "Confidential Twenty OAuth client used only by AgentCore Identity Token Vault"
@@ -60,7 +73,7 @@ resource "aws_secretsmanager_secret" "twenty_oauth_client" {
 }
 
 resource "aws_secretsmanager_secret_policy" "twenty_oauth_client" {
-  count      = var.enabled ? 1 : 0
+  count      = var.twenty_enabled ? 1 : 0
   secret_arn = aws_secretsmanager_secret.twenty_oauth_client[0].arn
   policy = jsonencode({
     Version = "2012-10-17"
@@ -111,12 +124,82 @@ resource "terraform_data" "identity_lifecycle" {
   }
 }
 
-# Additive user-federation lifecycle. It may update the workload's callback
-# allowlist in place, but it never owns or deletes the workload/Gateway provider.
-# This keeps the proven exact-user admission path live while Twenty is added,
-# rotated, or removed independently.
-resource "terraform_data" "twenty_identity_lifecycle" {
-  count = var.enabled ? 1 : 0
+# THINK-324 — Twenty-side workload-identity guarantee. When the proof plane
+# is retired (enabled = false) the identity_lifecycle resource above no longer
+# runs, but live Twenty 3LO still needs the shared workload identity. This
+# ensure step is create-if-missing only (it never rewrites the return-url
+# allowlist — twenty_identity_reconciliation owns that) and has NO destroy
+# action; deletion is owned by workload_identity_cleanup_owner below.
+resource "terraform_data" "workload_identity_ensure" {
+  count = var.twenty_enabled ? 1 : 0
+
+  input = {
+    region                 = var.region
+    workload_identity_name = local.workload_identity_name
+  }
+
+  provisioner "local-exec" {
+    command = "bash ${path.module}/scripts/ensure_workload_identity.sh"
+    environment = {
+      AWS_REGION             = var.region
+      WORKLOAD_IDENTITY_NAME = local.workload_identity_name
+      OAUTH_RETURN_URLS_JSON = jsonencode(local.allowed_oauth_return_urls)
+    }
+  }
+}
+
+# THINK-324 — the shared workload identity's deletion moved here from the
+# proof lifecycle (delete_identity.sh no longer touches it): it is deleted
+# only when the Twenty identity half itself is removed, never when the proof
+# plane is retired. Note: on a hypothetical proof-only stage (enabled = true,
+# twenty_enabled = false) the workload identity is leaked on teardown rather
+# than risking a destructive replace of identity_lifecycle here; no such
+# stage exists (dev, the only proof stage, runs Twenty).
+resource "terraform_data" "workload_identity_cleanup_owner" {
+  count = var.twenty_enabled ? 1 : 0
+
+  input = {
+    region                 = var.region
+    workload_identity_name = local.workload_identity_name
+  }
+
+  provisioner "local-exec" {
+    when    = destroy
+    command = "bash ${path.module}/scripts/delete_workload_identity.sh"
+    environment = {
+      AWS_REGION             = self.input.region
+      WORKLOAD_IDENTITY_NAME = self.input.workload_identity_name
+    }
+  }
+}
+
+# Stable cleanup ownership is deliberately separate from reconciliation.
+# Script-only changes must never replace a resource whose destroy provisioner
+# deletes the external provider and invalidates its service-issued callback.
+resource "terraform_data" "twenty_identity_cleanup_owner" {
+  count = var.twenty_enabled ? 1 : 0
+
+  input = {
+    region                          = var.region
+    twenty_credential_provider_name = local.twenty_credential_provider_name
+  }
+
+  provisioner "local-exec" {
+    when    = destroy
+    command = "bash ${path.module}/scripts/delete_twenty_identity.sh"
+    environment = {
+      AWS_REGION                      = self.input.region
+      TWENTY_CREDENTIAL_PROVIDER_NAME = self.input.twenty_credential_provider_name
+    }
+  }
+}
+
+# Additive user-federation reconciliation. Code/configuration revisions replace
+# only this terraform_data record; it has no destroy action and always updates
+# the provider in place. The stable owner above deletes only when the module is
+# truly disabled or removed.
+resource "terraform_data" "twenty_identity_reconciliation" {
+  count = var.twenty_enabled ? 1 : 0
 
   input = {
     region                          = var.region
@@ -138,17 +221,10 @@ resource "terraform_data" "twenty_identity_lifecycle" {
     }
   }
 
-  provisioner "local-exec" {
-    when    = destroy
-    command = "bash ${path.module}/scripts/delete_twenty_identity.sh"
-    environment = {
-      AWS_REGION                      = self.input.region
-      TWENTY_CREDENTIAL_PROVIDER_NAME = self.input.twenty_credential_provider_name
-    }
-  }
-
   depends_on = [
     terraform_data.identity_lifecycle,
+    terraform_data.workload_identity_ensure,
+    terraform_data.twenty_identity_cleanup_owner,
     aws_secretsmanager_secret_policy.twenty_oauth_client,
   ]
 }
@@ -157,17 +233,21 @@ resource "terraform_data" "twenty_identity_lifecycle" {
 # Gateway IAM can therefore scope vault and secret access exactly rather than
 # granting a token-vault or Secrets Manager wildcard.
 data "external" "identity_state" {
-  count = var.enabled ? 1 : 0
+  count = local.identity_enabled ? 1 : 0
   depends_on = [
     terraform_data.identity_lifecycle,
-    terraform_data.twenty_identity_lifecycle,
+    terraform_data.workload_identity_ensure,
+    terraform_data.twenty_identity_reconciliation,
   ]
   program = ["bash", "${path.module}/scripts/read_identity.sh"]
 
   query = {
-    region                          = var.region
-    workload_identity_name          = local.workload_identity_name
-    credential_provider_name        = local.credential_provider_name
-    twenty_credential_provider_name = local.twenty_credential_provider_name
+    region                 = var.region
+    workload_identity_name = local.workload_identity_name
+    # Empty names tell the reader to skip that half (THINK-324: the proof
+    # provider is absent once the proof plane is retired; the Twenty provider
+    # is absent on proof-only stages).
+    credential_provider_name        = var.enabled ? local.credential_provider_name : ""
+    twenty_credential_provider_name = var.twenty_enabled ? local.twenty_credential_provider_name : ""
   }
 }

package/dist/terraform/modules/app/agentcore-identity/outputs.tf

@@ -1,6 +1,6 @@
 output "workload_identity_name" {
   description = "Name used for GetWorkloadAccessTokenForJWT. Empty when disabled."
-  value       = var.enabled ? local.workload_identity_name : ""
+  value       = local.identity_enabled ? local.workload_identity_name : ""
 }
 
 output "credential_provider_name" {
@@ -15,28 +15,28 @@ output "oauth_return_url" {
 
 output "twenty_credential_provider_name" {
   description = "AgentCore Identity provider name for per-user Twenty grants."
-  value       = var.enabled ? local.twenty_credential_provider_name : ""
+  value       = var.twenty_enabled ? local.twenty_credential_provider_name : ""
 }
 
 output "twenty_credential_provider_arn" {
   description = "AgentCore Identity provider ARN for per-user Twenty grants."
-  value       = var.enabled ? data.external.identity_state[0].result.twenty_credential_provider_arn : ""
+  value       = var.twenty_enabled ? data.external.identity_state[0].result.twenty_credential_provider_arn : ""
 }
 
 output "twenty_oauth_callback_url" {
   description = "Service-generated callback URL registered with Twenty OAuth."
-  value       = var.enabled ? data.external.identity_state[0].result.twenty_oauth_callback_url : ""
+  value       = var.twenty_enabled ? data.external.identity_state[0].result.twenty_oauth_callback_url : ""
 }
 
 output "twenty_client_secret_arn" {
   description = "External Secrets Manager client record consumed by AgentCore Identity."
-  value       = var.enabled ? aws_secretsmanager_secret.twenty_oauth_client[0].arn : ""
+  value       = var.twenty_enabled ? aws_secretsmanager_secret.twenty_oauth_client[0].arn : ""
   sensitive   = true
 }
 
 output "workload_identity_arn" {
   description = "Service-generated workload identity ARN. Empty when disabled."
-  value       = var.enabled ? data.external.identity_state[0].result.workload_identity_arn : ""
+  value       = local.identity_enabled ? data.external.identity_state[0].result.workload_identity_arn : ""
 }
 
 output "credential_provider_arn" {