thinkwork-cli 0.13.2 → 1.0.0

package/dist/terraform/modules/app/agentcore-harness/scripts/harness-tool-contract.mjs

@@ -1,193 +0,0 @@
-import { createHash } from "node:crypto";
-
-export const GOVERNED_TOOL_TYPES = new Map([
-  ["thinkwork_gateway", "agentcore_gateway"],
-  ["browser", "agentcore_browser"],
-  ["emit_document", "inline_function"],
-  ["goal_complete", "inline_function"],
-  ["submit_skill_draft", "inline_function"],
-]);
-
-export function canonicalJson(value) {
-  if (Array.isArray(value)) {
-    return `[${value.map(canonicalJson).join(",")}]`;
-  }
-  if (value && typeof value === "object") {
-    return `{${Object.keys(value)
-      .sort()
-      .map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`)
-      .join(",")}}`;
-  }
-  return JSON.stringify(value);
-}
-
-export function fingerprintGovernedHarnessTools(value) {
-  return createHash("sha256").update(canonicalJson(value)).digest("hex");
-}
-
-export function selectHarnessEndpointsForRetention(
-  endpoints,
-  { activeEndpointName, endpointPrefix, legacyEndpointName },
-) {
-  const managed = endpoints.filter(
-    (endpoint) =>
-      endpoint.endpointName === legacyEndpointName ||
-      endpoint.endpointName?.startsWith(endpointPrefix),
-  );
-  const rollbackEndpointName = managed
-    .filter((endpoint) => endpoint.endpointName !== activeEndpointName)
-    .sort((left, right) =>
-      String(right.liveVersion ?? right.targetVersion ?? "").localeCompare(
-        String(left.liveVersion ?? left.targetVersion ?? ""),
-        undefined,
-        { numeric: true },
-      ),
-    )[0]?.endpointName;
-  const retainedEndpointNames = new Set(
-    [activeEndpointName, rollbackEndpointName].filter(
-      (value) => typeof value === "string",
-    ),
-  );
-  return {
-    rollbackEndpointName,
-    retainedEndpointNames: [...retainedEndpointNames],
-    deletedEndpointNames: managed
-      .map((endpoint) => endpoint.endpointName)
-      .filter(
-        (endpointName) =>
-          endpointName && !retainedEndpointNames.has(endpointName),
-      ),
-  };
-}
-
-/**
- * One canonical producer contract for both Harness reconciliation and
- * immutable-version readback. Keeping the complete inline schemas here makes
- * schema drift a deployment failure instead of re-attesting it into SSM.
- */
-export function buildGovernedHarnessTools({ gatewayArn, providerArn }) {
-  return [
-    {
-      type: "agentcore_gateway",
-      name: "thinkwork_gateway",
-      config: {
-        agentCoreGateway: {
-          gatewayArn,
-          outboundAuth: {
-            oauth: {
-              providerArn,
-              scopes: ["gateway:invoke"],
-              customParameters: {
-                subject_token_type: "urn:ietf:params:oauth:token-type:jwt",
-              },
-              grantType: "TOKEN_EXCHANGE",
-            },
-          },
-        },
-      },
-    },
-    {
-      type: "agentcore_browser",
-      name: "browser",
-      config: { agentCoreBrowser: {} },
-    },
-    {
-      type: "inline_function",
-      name: "emit_document",
-      config: {
-        inlineFunction: {
-          description:
-            "Emit a durable ThinkWork HTML plate from markdown. Use genre report, plan, brief, or ideation. The platform compiles, validates, persists, and attaches it to the thread. On rejection, fix every diagnostic and call again with document_id when supplied.",
-          inputSchema: {
-            type: "object",
-            properties: {
-              genre: {
-                type: "string",
-                enum: ["report", "plan", "brief", "ideation"],
-              },
-              title: { type: "string" },
-              abstract: { type: "string" },
-              digest_markdown: {
-                type: "string",
-                description: "Complete markdown document body.",
-              },
-              status: { type: "string", enum: ["draft", "final"] },
-              document_id: { type: "string" },
-              space_id: { type: "string" },
-            },
-            required: ["genre", "title", "abstract", "digest_markdown"],
-            additionalProperties: false,
-          },
-        },
-      },
-    },
-    {
-      type: "inline_function",
-      name: "goal_complete",
-      config: {
-        inlineFunction: {
-          description:
-            "Mark the current ThinkWork-managed Goal mode objective complete. Call exactly once only after the objective is fully satisfied.",
-          inputSchema: {
-            type: "object",
-            properties: {
-              summary: {
-                type: "string",
-                description: "Concise user-facing completion summary.",
-              },
-              completion_notes: {
-                type: "string",
-                description: "Optional bounded completion details.",
-              },
-              verification_notes: {
-                type: "array",
-                items: { type: "string" },
-                maxItems: 5,
-                description: "Concrete checks proving completion.",
-              },
-            },
-            required: ["summary"],
-            additionalProperties: false,
-          },
-        },
-      },
-    },
-    {
-      type: "inline_function",
-      name: "submit_skill_draft",
-      config: {
-        inlineFunction: {
-          description:
-            "Submit a complete Agent Skills draft to ThinkWork's governed review and trust queue. Available only during a trusted /skill-creator turn; this does not publish the skill.",
-          inputSchema: {
-            type: "object",
-            properties: {
-              skill_markdown: {
-                type: "string",
-                description:
-                  "Complete SKILL.md including valid name and description frontmatter.",
-              },
-              supporting_files: {
-                type: "array",
-                maxItems: 20,
-                items: {
-                  type: "object",
-                  properties: {
-                    path: { type: "string" },
-                    content: { type: "string" },
-                  },
-                  required: ["path", "content"],
-                  additionalProperties: false,
-                },
-                description:
-                  "Optional bounded text references, scripts, or assets required by the skill.",
-              },
-            },
-            required: ["skill_markdown"],
-            additionalProperties: false,
-          },
-        },
-      },
-    },
-  ];
-}

package/dist/terraform/modules/app/agentcore-harness/scripts/prune_harness.sh

@@ -1,5 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-exec node "$script_dir/harness-lifecycle.mjs" prune

package/dist/terraform/modules/app/agentcore-harness/scripts/read_harness.sh

@@ -1,5 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-exec node "$script_dir/harness-lifecycle.mjs" read

package/dist/terraform/modules/app/agentcore-harness/scripts/reconcile_harness.sh

@@ -1,5 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-exec node "$script_dir/harness-lifecycle.mjs" reconcile

package/dist/terraform/modules/app/agentcore-harness/variables.tf

@@ -1,96 +0,0 @@
-variable "enabled" {
-  description = "Create the AgentCore Harness execution IAM surface. The role is independent of whether a managed tenant/profile runtime is enabled."
-  type        = bool
-  default     = true
-}
-
-variable "stage" {
-  description = "Deployment stage (dev, prod, etc.)"
-  type        = string
-}
-
-variable "region" {
-  description = "AWS region"
-  type        = string
-}
-
-variable "account_id" {
-  description = "AWS account ID"
-  type        = string
-}
-
-variable "bucket_name" {
-  description = "Stage workspace S3 bucket name — Harness microVMs read tenant skill sources under tenants/*"
-  type        = string
-}
-
-variable "managed_runtime_enabled" {
-  description = "Reconcile the managed tenant/profile AgentCore Harness runtime. The base IAM role may remain enabled while this is false."
-  type        = bool
-  default     = false
-}
-
-variable "tenant_slug" {
-  description = "Tenant slug whose skill prefix and managed Harness profile are admitted."
-  type        = string
-  default     = ""
-
-  validation {
-    condition     = var.tenant_slug == "" || can(regex("^[a-z0-9][a-z0-9-]{0,47}$", var.tenant_slug))
-    error_message = "tenant_slug must be a lowercase slug up to 48 characters."
-  }
-}
-
-variable "trust_profile" {
-  description = "Stable execution/trust profile. Ordinary agent/user/tool differences do not create more Harnesses."
-  type        = string
-  default     = "default"
-
-  validation {
-    condition     = can(regex("^[a-z][a-z0-9-]{0,31}$", var.trust_profile))
-    error_message = "trust_profile must be a lowercase slug up to 32 characters."
-  }
-}
-
-variable "discovery_url" {
-  description = "OIDC discovery URL used by the Harness CUSTOM_JWT authorizer."
-  type        = string
-  default     = ""
-}
-
-variable "harness_audience" {
-  description = "Exact audience accepted by the Harness CUSTOM_JWT authorizer."
-  type        = string
-  default     = ""
-}
-
-variable "gateway_arn" {
-  description = "Exact selected AgentCore Gateway ARN exposed as the native Harness tool."
-  type        = string
-  default     = ""
-}
-
-variable "oauth_credential_provider_arn" {
-  description = "Identity provider ARN used for the Harness on-behalf-of Gateway token exchange."
-  type        = string
-  default     = ""
-}
-
-variable "oauth_credential_secret_arn" {
-  description = "AgentCore-managed Secrets Manager ARN backing the selected OAuth provider."
-  type        = string
-  default     = ""
-  sensitive   = true
-}
-
-variable "oauth_return_url" {
-  description = "Application callback that verifies the active user and completes AgentCore Identity OAuth session binding."
-  type        = string
-  default     = ""
-}
-
-variable "model_id" {
-  description = "Safe baseline Bedrock model for the managed Harness profile. Per-turn trusted projection may narrow/replace it."
-  type        = string
-  default     = "us.anthropic.claude-haiku-4-5-20251001-v1:0"
-}

package/dist/terraform/modules/app/hindsight-memory/README.md

@@ -1,89 +0,0 @@
-# Hindsight Memory Module (canonical user and Space memory)
-
-Thinkwork provisions AgentCore managed memory as an AWS platform primitive, but
-full ThinkWork installs use **Hindsight** as the canonical user and Space memory
-provider. AgentCore-only memory remains available as an explicit
-low-cost/development opt-out.
-
-## Memory layers
-
-| Layer                 | Backend                 | Always on                     | What it stores                                                                 |
-| --------------------- | ----------------------- | ----------------------------- | ------------------------------------------------------------------------------ |
-| 1. Workspace files    | S3 per-agent            | Yes                           | Scratchpad, working files                                                      |
-| 2. Thread history     | Aurora `messages` table | Yes                           | Last 30 turns per thread                                                       |
-| 3a. Managed long-term | AgentCore Memory        | **Yes**                       | AWS platform memory primitive and low-cost/development fallback                |
-| 3b. Product long-term | Hindsight ECS service   | **Default for full installs** | Canonical user/Space memory with entity graph + BM25 + cross-encoder reranking |
-
-## How retention works
-
-The agent container automatically emits a `CreateEvent` into AgentCore
-Memory after every turn (user message + assistant response), via
-`memory.store_turn_pair` in `packages/agentcore/agent-container/memory.py`.
-AgentCore's background strategies extract facts into four namespaces:
-
-- `assistant_{actorId}` — semantic facts
-- `preferences_{actorId}` — user preferences
-- `session_{sessionId}` — session summaries
-- `episodes_{actorId}/{sessionId}` — episodic memory
-
-The agent reads them back via the `recall()` tool. There is no need for
-the model to call `remember()` for routine facts — it only exists for
-user-driven "please remember X" requests.
-
-When Hindsight is enabled, the container ALSO registers
-`hindsight_retain`, `hindsight_recall`, and `hindsight_reflect` tools that
-route to the Hindsight service. `remember()` dual-writes to both backends
-so explicit memories land in both systems.
-
-## Usage
-
-### Default — Hindsight canonical memory
-
-```hcl
-module "thinkwork" {
-  source = "thinkwork-ai/thinkwork/aws"
-
-  stage = "prod"
-  # enable_hindsight defaults to true
-}
-```
-
-The `terraform/modules/app/agentcore-memory` module is still instantiated, but
-the active user/Space memory engine resolves to Hindsight.
-
-### Low-cost/development AgentCore-only opt-out
-
-```hcl
-module "thinkwork" {
-  source = "thinkwork-ai/thinkwork/aws"
-
-  stage            = "prod"
-  enable_hindsight = false
-  memory_engine    = "agentcore"
-
-  # This is not the full product memory path.
-}
-```
-
-When `enable_hindsight = true`, Terraform creates:
-
-- ECS Fargate cluster + service (ARM64, 2 vCPU, 4 GB)
-- Application Load Balancer
-- Security groups (ALB → Hindsight → Aurora ingress)
-- CloudWatch log group
-
-Cost: ~$75/mo (ARM64 Fargate + ALB hours).
-
-## Turning Hindsight on/off
-
-Toggling `enable_hindsight` and re-running `thinkwork deploy`:
-
-- **false → true**: creates the ECS + ALB infra. Agents gain the three
-  `hindsight_*` tools on their next invoke. The active memory engine resolves
-  to Hindsight when `memory_engine` is empty.
-- **true → false**: destroys the ECS + ALB infra. Agents lose the
-  `hindsight_*` tools. This should be paired with `memory_engine = "agentcore"`
-  for explicit low-cost/development deployments.
-
-Memory data is not migrated between backends. Hindsight records and
-AgentCore records live in separate stores.