thinkwork-cli 0.13.2 → 1.0.0

package/dist/plugins/twenty/smoke/twenty-managed-app-smoke.mjs

@@ -1,359 +0,0 @@
-#!/usr/bin/env node
-/**
- * Smoke test the Twenty CRM managed application deployment.
- *
- * Dry-run is the default. Set SMOKE_ENABLE_TWENTY_MANAGED_APP=1 after deploy
- * to read Terraform/API deployment status and probe the public Twenty /healthz
- * endpoint when the runtime is enabled.
- *
- * Optional live env:
- *   SMOKE_TERRAFORM_DIR=terraform/examples/greenfield
- *   SMOKE_TWENTY_URL=https://crm.example.com
- *   SMOKE_TENANT_ID=<tenant-id>
- *   VITE_GRAPHQL_HTTP_URL, GRAPHQL_HTTP_URL, or API_GRAPHQL_URL
- *   API_AUTH_SECRET, THINKWORK_API_SECRET, VITE_GRAPHQL_API_KEY, or GRAPHQL_API_KEY
- */
-
-import { execFileSync } from "node:child_process";
-import fs from "node:fs";
-import path from "node:path";
-import process from "node:process";
-import { attachSmokeEvidence } from "../../../scripts/smoke/deployment-evidence.mjs";
-
-const LIVE_ENABLED = process.env.SMOKE_ENABLE_TWENTY_MANAGED_APP === "1";
-const TIMEOUT_MS = Number(process.env.SMOKE_TIMEOUT_MS || 15_000);
-
-const env = {
-  ...loadEnvFile(),
-  ...process.env,
-};
-
-const terraformDir = env.SMOKE_TERRAFORM_DIR || "terraform/examples/greenfield";
-const apiUrl = first(
-  env.VITE_GRAPHQL_HTTP_URL,
-  env.GRAPHQL_HTTP_URL,
-  env.API_GRAPHQL_URL,
-);
-const apiSecret = first(env.API_AUTH_SECRET, env.THINKWORK_API_SECRET);
-const apiKey = first(
-  env.VITE_GRAPHQL_API_KEY,
-  env.APPSYNC_API_KEY,
-  env.GRAPHQL_API_KEY,
-);
-const tenantId = first(env.SMOKE_TENANT_ID, env.TENANT_ID);
-
-if (!LIVE_ENABLED) {
-  console.log(
-    JSON.stringify(
-      await attachSmokeEvidence(
-        "twenty-managed-app",
-        {
-          ok: true,
-          skippedLive: true,
-          reason:
-            "set SMOKE_ENABLE_TWENTY_MANAGED_APP=1 to run the deployed Twenty managed-app smoke",
-          dryRun: {
-            terraformDir,
-            requiredWhenRunning: [
-              "Terraform outputs in SMOKE_TERRAFORM_DIR or SMOKE_TWENTY_URL",
-              "Twenty provisioned/runtime deployment status",
-            ],
-            optionalGraphqlEnv: [
-              "SMOKE_TENANT_ID",
-              "VITE_GRAPHQL_HTTP_URL or GRAPHQL_HTTP_URL or API_GRAPHQL_URL",
-              "API_AUTH_SECRET or THINKWORK_API_SECRET or VITE_GRAPHQL_API_KEY or GRAPHQL_API_KEY",
-            ],
-            verifies: [
-              "twenty_provisioned false skips cleanly",
-              "twenty_runtime_enabled true requires HTTPS twenty_url",
-              "public Twenty /healthz responds successfully",
-              "optional GraphQL deployment status and managed-app health agree with the public URL",
-            ],
-          },
-        },
-        env,
-      ),
-      null,
-      2,
-    ),
-  );
-  process.exit(0);
-}
-
-try {
-  const result = await runLiveSmoke();
-  console.log(
-    JSON.stringify(
-      await attachSmokeEvidence(
-        "twenty-managed-app",
-        { ok: true, ...result },
-        env,
-      ),
-      null,
-      2,
-    ),
-  );
-} catch (error) {
-  fail(error instanceof Error ? error.message : String(error));
-}
-
-async function runLiveSmoke() {
-  const terraform = readTerraformOutputs(terraformDir);
-  const graphql = await readGraphqlStatus().catch((error) => ({
-    error: error instanceof Error ? error.message : String(error),
-  }));
-  const status = resolveStatus({ terraform, graphql });
-
-  if (!status.provisioned) {
-    return {
-      skippedLive: true,
-      reason: "Twenty CRM is not provisioned for this stage.",
-      terraform,
-      graphql,
-    };
-  }
-
-  if (!status.runtimeEnabled) {
-    return {
-      skippedLive: true,
-      reason: "Twenty CRM is provisioned but runtime is parked.",
-      status,
-      terraform,
-      graphql,
-    };
-  }
-
-  if (!status.url) {
-    throw new Error(
-      "Twenty runtime is enabled but no public URL was resolved.",
-    );
-  }
-  if (!status.url.startsWith("https://")) {
-    throw new Error(`Twenty URL must be HTTPS, got ${status.url}.`);
-  }
-
-  const publicHealth = await probeHealthz(status.url);
-  const graphqlHealth =
-    graphql?.deploymentStatus && !graphql.error
-      ? await readGraphqlHealth().catch((error) => ({
-          error: error instanceof Error ? error.message : String(error),
-        }))
-      : null;
-
-  if (!publicHealth.healthy) {
-    throw new Error(
-      `Twenty /healthz failed: HTTP ${publicHealth.statusCode ?? "none"} ${publicHealth.message}`,
-    );
-  }
-  if (graphqlHealth && "healthy" in graphqlHealth && !graphqlHealth.healthy) {
-    throw new Error(
-      `GraphQL managed health reported unhealthy: ${graphqlHealth.message}`,
-    );
-  }
-
-  return {
-    status,
-    publicHealth,
-    graphqlHealth,
-    terraform,
-    graphql,
-  };
-}
-
-function resolveStatus({ terraform, graphql }) {
-  const app = graphql?.deploymentStatus?.managedApplications?.find(
-    (entry) => entry.key === "twenty",
-  );
-  return {
-    provisioned: bool(
-      firstDefined(
-        app?.provisioned,
-        terraform.twenty_provisioned,
-        !!env.SMOKE_TWENTY_URL,
-      ),
-    ),
-    runtimeEnabled: bool(
-      firstDefined(
-        app?.runtimeEnabled,
-        terraform.twenty_runtime_enabled,
-        !!env.SMOKE_TWENTY_URL,
-      ),
-    ),
-    url: first(env.SMOKE_TWENTY_URL, app?.url, terraform.twenty_url),
-    source: app ? "graphql" : terraform.available ? "terraform" : "env",
-    status: app?.status ?? null,
-    message: app?.message ?? null,
-  };
-}
-
-async function probeHealthz(baseUrl) {
-  const endpoint = new URL("/healthz", baseUrl).toString();
-  const started = Date.now();
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
-  try {
-    const response = await fetch(endpoint, { signal: controller.signal });
-    const body = await response.text().catch(() => "");
-    return {
-      endpoint,
-      healthy: response.ok,
-      statusCode: response.status,
-      latencyMs: Date.now() - started,
-      message: body.slice(0, 300),
-    };
-  } finally {
-    clearTimeout(timer);
-  }
-}
-
-function readTerraformOutputs(dir) {
-  const resolved = path.resolve(dir);
-  if (!fs.existsSync(resolved)) {
-    return { available: false, reason: `Terraform dir not found: ${dir}` };
-  }
-
-  try {
-    const raw = execFileSync(
-      "terraform",
-      ["-chdir=" + resolved, "output", "-json"],
-      {
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "pipe"],
-      },
-    );
-    const parsed = JSON.parse(raw);
-    return {
-      available: true,
-      twenty_provisioned: outputValue(parsed.twenty_provisioned),
-      twenty_runtime_enabled: outputValue(parsed.twenty_runtime_enabled),
-      twenty_url: outputValue(parsed.twenty_url),
-      twenty_server_log_group_name: outputValue(
-        parsed.twenty_server_log_group_name,
-      ),
-      twenty_worker_log_group_name: outputValue(
-        parsed.twenty_worker_log_group_name,
-      ),
-      twenty_cache_endpoint: outputValue(parsed.twenty_cache_endpoint),
-    };
-  } catch (error) {
-    return {
-      available: false,
-      reason: error instanceof Error ? error.message : String(error),
-    };
-  }
-}
-
-async function readGraphqlStatus() {
-  if (!apiUrl || (!apiSecret && !apiKey)) return null;
-  const data = await gql(`
-    query TwentySmokeDeploymentStatus {
-      deploymentStatus {
-        stage
-        region
-        twentyProvisioned
-        twentyRuntimeEnabled
-        twentyUrl
-        managedApplications {
-          key
-          status
-          provisioned
-          runtimeEnabled
-          url
-          message
-        }
-      }
-    }
-  `);
-  return data;
-}
-
-async function readGraphqlHealth() {
-  const data = await gql(`
-    query TwentySmokeManagedApplicationHealth {
-      managedApplicationHealthCheck(key: "twenty") {
-        healthy
-        statusCode
-        latencyMs
-        endpoint
-        message
-      }
-    }
-  `);
-  return data.managedApplicationHealthCheck;
-}
-
-async function gql(query) {
-  const headers = { "content-type": "application/json" };
-  if (tenantId) headers["x-tenant-id"] = tenantId;
-  if (apiSecret) headers.authorization = `Bearer ${apiSecret}`;
-  else headers["x-api-key"] = apiKey;
-
-  const response = await fetch(apiUrl, {
-    method: "POST",
-    headers,
-    body: JSON.stringify({ query }),
-  });
-  if (!response.ok) {
-    throw new Error(
-      `GraphQL HTTP ${response.status}: ${await response.text()}`,
-    );
-  }
-  const body = await response.json();
-  if (body.errors?.length) {
-    throw new Error(`GraphQL errors: ${JSON.stringify(body.errors)}`);
-  }
-  return body.data;
-}
-
-function outputValue(entry) {
-  return entry && Object.prototype.hasOwnProperty.call(entry, "value")
-    ? entry.value
-    : undefined;
-}
-
-function firstDefined(...values) {
-  return values.find((value) => value !== undefined && value !== null);
-}
-
-function bool(value) {
-  return value === true || value === "true" || value === "1";
-}
-
-function loadEnvFile() {
-  const explicit = process.env.COMPUTER_ENV_FILE;
-  if (explicit === "none") return {};
-  const candidates = [explicit, "apps/web/.env", ".env"].filter(Boolean);
-
-  for (const candidate of candidates) {
-    const resolved = path.resolve(candidate);
-    if (!fs.existsSync(resolved)) continue;
-    return Object.fromEntries(
-      fs
-        .readFileSync(resolved, "utf8")
-        .split(/\r?\n/)
-        .map((line) => line.trim())
-        .filter((line) => line && !line.startsWith("#") && line.includes("="))
-        .map((line) => {
-          const index = line.indexOf("=");
-          const key = line.slice(0, index).trim();
-          const value = line
-            .slice(index + 1)
-            .trim()
-            .replace(/^['"]|['"]$/g, "");
-          return [key, value];
-        }),
-    );
-  }
-  return {};
-}
-
-function first(...values) {
-  return values.find(
-    (value) => value !== undefined && value !== null && value !== "",
-  );
-}
-
-function fail(message) {
-  console.error(JSON.stringify({ ok: false, error: message }, null, 2));
-  process.exit(1);
-}

package/dist/terraform/modules/app/agentcore-code-interpreter/Dockerfile.sandbox-base

@@ -1,61 +0,0 @@
-# Sandbox base image for the AgentCore Code Interpreter.
-#
-# Builds a Python 3.12 container with a small, pinned set of libraries
-# template authors can rely on without paying the first-turn `pip install`
-# tax. Installs sitecustomize.py so the stdout/stderr token redactor is
-# active before any user code or framework traceback runs on cold start.
-#
-# Image tagging is CI-driven (see scripts/build_and_push_sandbox_base.sh).
-# Tags are immutable; a bump ships as a reviewable PR.
-#
-# Build context is the repository root so the COPY line can reach the
-# module-owned Python source below.
-#
-#   docker build -f terraform/modules/app/agentcore-code-interpreter/Dockerfile.sandbox-base .
-
-FROM python:3.12-slim AS base
-
-# ---------------------------------------------------------------------------
-# System packages — minimal. The sandbox runs agent code, not a full distro.
-# ---------------------------------------------------------------------------
-RUN apt-get update && apt-get install -y --no-install-recommends \
-        ca-certificates \
-        curl \
-        git \
-    && rm -rf /var/lib/apt/lists/*
-
-# ---------------------------------------------------------------------------
-# Blessed Python libraries — pinned to explicit versions per plan R14/R24.
-# Bumps happen in reviewable PRs. Runtime `pip install` is still allowed
-# (per R15; T2 residual is named), but these baseline packages install once
-# at image bake and don't pay the per-turn cost.
-# ---------------------------------------------------------------------------
-RUN pip install --no-cache-dir \
-        pandas==2.2.3 \
-        numpy==2.1.3 \
-        requests==2.32.3 \
-        boto3==1.38.0 \
-        httpx==0.28.1 \
-        pyyaml==6.0.2 \
-        openpyxl==3.1.5 \
-        python-dateutil==2.9.0.post0
-
-# ---------------------------------------------------------------------------
-# sitecustomize.py — the R13 stdout/stderr token redactor. Python
-# auto-imports any module named "sitecustomize" on interpreter startup, so
-# placing it in site-packages makes the redactor load before any user code
-# (and before the framework traceback on cold start). See the module
-# docstring for the honestly-scoped invariant and named residual gaps.
-# ---------------------------------------------------------------------------
-COPY terraform/modules/app/agentcore-code-interpreter/sandbox/sitecustomize.py \
-     /usr/local/lib/python3.12/site-packages/sitecustomize.py
-
-# ---------------------------------------------------------------------------
-# Startup assertion — fail loudly if the module isn't wired up or
-# THINKWORK_SANDBOX_SCRUBBER=off slips through to prod. Runs in the same
-# image smoke-test CI job that pushes the tag.
-# ---------------------------------------------------------------------------
-RUN python -c "import sitecustomize; assert sitecustomize.installed(), 'sitecustomize did not install its stdio wrapper on import'; print('sitecustomize: OK')"
-
-# AgentCore Code Interpreter supplies its own entrypoint; we provide the
-# libraries + scrubber only. No CMD/ENTRYPOINT override.

package/dist/terraform/modules/app/agentcore-code-interpreter/sandbox/sitecustomize.py

@@ -1,227 +0,0 @@
-"""sitecustomize — primary R13 token redactor for the AgentCore sandbox base image.
-
-Python auto-imports any module named ``sitecustomize`` during interpreter
-startup (before user code, before the preamble, before framework tracebacks on
-cold start). This file installs a stdio write-wrapper keyed on a session-scoped
-set of token values so no token leaks to stdout / stderr via Python-stdio
-writes.
-
-The invariant is honestly scoped per the brainstorm's R13 (as aligned in
-docs/brainstorms/2026-04-22-agentcore-code-sandbox-requirements.md):
-
-  "no token value reaches a persisted log ... via Python-stdio-mediated writes"
-
-Bytes that bypass Python stdio (``os.write(fd, ...)``, subprocesses inheriting
-fds, C extensions, multiprocessing children) are the named residual class
-covered by the Unit 12 CloudWatch subscription-filter backstop for known
-OAuth prefixes, not by this module.
-
-Public API, callable from the sandbox preamble:
-  register_token(value: str) -> None
-  register_tokens(values: Iterable[str]) -> None
-  clear_tokens() -> None
-  installed() -> bool
-"""
-
-from __future__ import annotations
-
-import base64
-import binascii
-import os
-import sys
-import urllib.parse
-from collections.abc import Iterable
-from typing import Any
-
-# ---------------------------------------------------------------------------
-# Module state
-# ---------------------------------------------------------------------------
-
-# Every unique byte-sequence we redact. Populated by ``register_token`` — each
-# registered token expands into its cleartext, standard base64, URL-safe
-# base64, URL-encoded, and hex forms (only the forms whose length is at least
-# MIN_TOKEN_LEN, to avoid redacting short accidental matches like "AQ").
-_redactions: set[bytes] = set()
-
-# Redaction placeholder. Length unimportant — stream layout survives because
-# writes stay synchronous.
-_REDACTION = b"<redacted>"
-
-# Forms shorter than this are rejected — redacting 3-character strings is the
-# shape of a wildcard bug, not a security control.
-MIN_TOKEN_LEN = 12
-
-# Rolling-suffix buffer size. Set at ``register_token`` time to
-# max(existing, 2 * len(new_token_form)). The wrapper keeps this many bytes
-# from the previous write and prepends them to the current write before
-# searching, so a token split across two ``write()`` calls is caught as long
-# as neither split half exceeds the buffer. Adversarial fragmentation at
-# arbitrary positions is a named residual (see R13).
-_rolling_buffer_size: int = 0
-
-
-def _expand(value: str) -> list[bytes]:
-    """Return the encoded forms of a token value we treat as equivalent.
-
-    Each form is added to the redaction set so ``print(base64.b64encode(token))``
-    and the cleartext ``print(token)`` are both scrubbed.
-    """
-    if not value:
-        return []
-    raw = value.encode("utf-8")
-    forms: list[bytes] = []
-
-    def maybe_add(candidate: bytes) -> None:
-        if len(candidate) >= MIN_TOKEN_LEN:
-            forms.append(candidate)
-
-    maybe_add(raw)
-    maybe_add(base64.b64encode(raw).rstrip(b"="))
-    maybe_add(base64.b64encode(raw))
-    maybe_add(base64.urlsafe_b64encode(raw).rstrip(b"="))
-    maybe_add(base64.urlsafe_b64encode(raw))
-    maybe_add(urllib.parse.quote(value, safe="").encode("ascii"))
-    maybe_add(binascii.hexlify(raw))
-    return forms
-
-
-def register_token(value: str) -> None:
-    """Add a token (and its derived encodings) to the redaction set.
-
-    Safe to call multiple times with the same value. No-op for empty values.
-    """
-    global _rolling_buffer_size
-    for form in _expand(value):
-        _redactions.add(form)
-        required = 2 * len(form)
-        if required > _rolling_buffer_size:
-            _rolling_buffer_size = required
-
-
-def register_tokens(values: Iterable[str]) -> None:
-    for v in values:
-        register_token(v)
-
-
-def clear_tokens() -> None:
-    """Drop every registered token. Called at session teardown by the container."""
-    global _rolling_buffer_size
-    _redactions.clear()
-    _rolling_buffer_size = 0
-
-
-# ---------------------------------------------------------------------------
-# Stdio wrapper
-# ---------------------------------------------------------------------------
-
-
-def _redact(chunk: bytes, tail_buffer: bytearray) -> tuple[bytes, bytearray]:
-    """Return (scrubbed_output_chunk, new_tail_buffer).
-
-    The tail buffer holds the trailing N bytes of the previous write so we can
-    catch tokens split across write boundaries. The output we emit is the part
-    of ``tail_buffer + chunk`` that is safely past the trailing window; the
-    suffix stays in the new tail for the next call.
-    """
-    if not _redactions:
-        return chunk, tail_buffer
-
-    combined = bytes(tail_buffer) + chunk
-    for form in _redactions:
-        combined = combined.replace(form, _REDACTION)
-
-    if _rolling_buffer_size and len(combined) > _rolling_buffer_size:
-        emit = combined[:-_rolling_buffer_size]
-        new_tail = bytearray(combined[-_rolling_buffer_size:])
-    else:
-        emit = b""
-        new_tail = bytearray(combined)
-
-    return emit, new_tail
-
-
-class _RedactingStream:
-    """Wraps sys.stdout / sys.stderr's underlying buffer with a redactor.
-
-    Intercepts both ``write(str)`` (TextIOBase) and ``.buffer.write(bytes)``
-    paths so ``print(...)``, ``sys.stdout.write(...)``, and
-    ``sys.stdout.buffer.write(...)`` all flow through the scrubber.
-    """
-
-    def __init__(self, wrapped: Any, name: str) -> None:
-        self._wrapped = wrapped
-        self._name = name
-        self._tail = bytearray()
-        # AgentCore writes to stdout/stderr line-buffered; we flush our tail
-        # on every newline-terminated write so output appears promptly.
-
-    def write(self, data: Any) -> int:
-        if isinstance(data, str):
-            payload = data.encode("utf-8", errors="replace")
-            wrote_str = True
-        elif isinstance(data, (bytes, bytearray, memoryview)):
-            payload = bytes(data)
-            wrote_str = False
-        else:
-            # Defer unknown types to the wrapped object — let it raise.
-            return self._wrapped.write(data)
-
-        emit, self._tail = _redact(payload, self._tail)
-        # A newline forces a tail flush so output doesn't lag arbitrarily when
-        # no new writes arrive. This is a UX concession, not a security one —
-        # redaction is complete whether we flush or not.
-        if b"\n" in payload:
-            emit = emit + bytes(self._tail)
-            self._tail = bytearray()
-
-        if not emit:
-            return len(data) if wrote_str else len(payload)
-
-        if wrote_str:
-            self._wrapped.write(emit.decode("utf-8", errors="replace"))
-        else:
-            # TextIOWrapper.write raises on bytes; prefer the underlying buffer.
-            buf = getattr(self._wrapped, "buffer", None)
-            if buf is not None:
-                buf.write(emit)
-            else:
-                self._wrapped.write(emit)
-        return len(data) if wrote_str else len(payload)
-
-    def flush(self) -> None:
-        if self._tail:
-            data = bytes(self._tail)
-            self._tail = bytearray()
-            buf = getattr(self._wrapped, "buffer", None)
-            if buf is not None:
-                buf.write(data)
-            else:
-                self._wrapped.write(data.decode("utf-8", errors="replace"))
-        self._wrapped.flush()
-
-    # Forward any other attribute access (fileno, isatty, encoding, etc.) so
-    # libraries that introspect the stream still see what they expect.
-    def __getattr__(self, item: str) -> Any:
-        return getattr(self._wrapped, item)
-
-
-_installed = False
-
-
-def installed() -> bool:
-    return _installed
-
-
-def _install() -> None:
-    global _installed
-    if _installed:
-        return
-    sys.stdout = _RedactingStream(sys.stdout, "stdout")
-    sys.stderr = _RedactingStream(sys.stderr, "stderr")
-    _installed = True
-
-
-# Install unconditionally on import. Disable only for a pytest diagnostic
-# marker the test suite can opt out of (set THINKWORK_SANDBOX_SCRUBBER=off).
-if os.environ.get("THINKWORK_SANDBOX_SCRUBBER", "on") != "off":
-    _install()