thinkwork-cli 0.2.0 → 0.3.0

package/README.md

@@ -23,27 +23,32 @@ thinkwork login
 # 2. Check prerequisites
 thinkwork doctor -s dev
 
-# 3. Initialize a new environment
+# 3. Initialize a new environment (interactive)
 thinkwork init -s dev
 
 # 4. Review the plan
 thinkwork plan -s dev
 
-# 5. Deploy
+# 5. Deploy (~5 min)
 thinkwork deploy -s dev
 
 # 6. Seed workspace files + skill catalog
 thinkwork bootstrap -s dev
+
+# 7. Show what was deployed
+thinkwork outputs -s dev
 ```
 
+No repo clone required — `thinkwork init` scaffolds all Terraform modules from the npm package.
+
 ## Commands
 
 ### Setup
 
 | Command | Description |
 |---------|-------------|
-| `thinkwork login` | Configure AWS credentials (access keys or SSO) |
-| `thinkwork init -s <stage>` | Initialize a new environment (generates tfvars, runs terraform init) |
+| `thinkwork login` | Configure AWS credentials (access keys or `--sso`) |
+| `thinkwork init -s <stage>` | Initialize a new environment — generates terraform.tfvars, scaffolds Terraform modules, runs `terraform init` |
 | `thinkwork doctor -s <stage>` | Check prerequisites (AWS CLI, Terraform, credentials, Bedrock access) |
 
 ### Deploy
@@ -60,6 +65,8 @@ thinkwork bootstrap -s dev
 | Command | Description |
 |---------|-------------|
 | `thinkwork outputs -s <stage>` | Show deployment outputs (API URL, Cognito IDs, etc.) |
+| `thinkwork config list` | List all initialized environments |
+| `thinkwork config list -s <stage>` | Show full config for an environment (secrets masked) |
 | `thinkwork config get <key> -s <stage>` | Read a configuration value |
 | `thinkwork config set <key> <value> -s <stage>` | Update a configuration value |
 
@@ -70,23 +77,48 @@ thinkwork bootstrap -s dev
 -p, --profile <name>    AWS profile to use
 -c, --component <tier>  Component tier: foundation, data, app, or all (default: all)
 -y, --yes               Skip confirmation prompts (for CI)
+--defaults              Skip interactive prompts in init (use all defaults)
 -v, --version           Print CLI version
 -h, --help              Show help
 ```
 
+## Interactive Init
+
+`thinkwork init` walks you through all configuration options:
+
+- **AWS Region** — where to deploy (default: us-east-1)
+- **Database engine** — `aurora-serverless` (production) or `rds-postgres` (dev, cheaper)
+- **Memory engine** — `managed` (built-in) or `hindsight` (ECS Fargate with semantic + graph retrieval)
+- **Google OAuth** — optional social login for Cognito
+- **Admin UI URL** — callback URL for the admin dashboard
+- **Mobile app scheme** — deep link scheme for the mobile app
+- **Secrets** — DB password and API auth secret are auto-generated
+
+For CI, use `--defaults` to skip prompts:
+
+```bash
+thinkwork init -s staging --defaults
+```
+
+## Environment Registry
+
+All initialized environments are saved to `~/.thinkwork/environments/<stage>/config.json`. This means:
+
+- **No `cd` required** — all commands auto-resolve the terraform directory
+- **List all stages** — `thinkwork config list` shows a table of all environments
+- **Inspect any stage** — `thinkwork config list -s dev` shows full config
+
 ## Examples
 
 ### Switch memory engine
 
 ```bash
-# Switch from managed to Hindsight memory
 thinkwork config set memory-engine hindsight -s dev --apply
 ```
 
 ### Deploy a specific tier
 
 ```bash
-# Only deploy the app tier (Lambda functions, API Gateway)
 thinkwork deploy -s dev -c app
 ```
 
@@ -100,7 +132,9 @@ thinkwork deploy -s dev --profile my-org
 ### CI/CD (non-interactive)
 
 ```bash
+thinkwork init -s prod --defaults
 thinkwork deploy -s prod -y
+thinkwork bootstrap -s prod
 ```
 
 ## Prerequisites
@@ -112,14 +146,14 @@ thinkwork deploy -s prod -y
 
 ## What Gets Deployed
 
-Thinkwork provisions a complete AI agent stack:
+Thinkwork provisions a complete AI agent stack (~250 AWS resources):
 
 - **Compute**: Lambda functions (39 handlers), AgentCore container (Lambda + ECR)
 - **Database**: Aurora Serverless PostgreSQL with pgvector
 - **Auth**: Cognito user pool (admin + mobile clients)
 - **API**: API Gateway (REST + GraphQL), AppSync (WebSocket subscriptions)
 - **Storage**: S3 (workspace files, skills, knowledge bases)
-- **Memory**: Managed (built-in) or Hindsight (ECS Fargate, opt-in)
+- **Memory**: Managed (built-in) or Hindsight (ECS Fargate with semantic + BM25 + entity graph retrieval)
 
 ## License
 

package/dist/cli.js

@@ -485,19 +485,67 @@ function registerOutputsCommand(program2) {
 }
 
 // src/commands/config.ts
-import { readFileSync, writeFileSync, existsSync as existsSync2 } from "fs";
+import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync as existsSync3 } from "fs";
+import chalk3 from "chalk";
+
+// src/environments.ts
+import { existsSync as existsSync2, mkdirSync, writeFileSync, readFileSync, readdirSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+var THINKWORK_HOME = join(homedir(), ".thinkwork");
+var ENVIRONMENTS_DIR = join(THINKWORK_HOME, "environments");
+function ensureDir(dir) {
+  if (!existsSync2(dir)) mkdirSync(dir, { recursive: true });
+}
+function saveEnvironment(config) {
+  ensureDir(ENVIRONMENTS_DIR);
+  const envDir = join(ENVIRONMENTS_DIR, config.stage);
+  ensureDir(envDir);
+  writeFileSync(
+    join(envDir, "config.json"),
+    JSON.stringify(config, null, 2) + "\n"
+  );
+}
+function loadEnvironment(stage) {
+  const configPath = join(ENVIRONMENTS_DIR, stage, "config.json");
+  if (!existsSync2(configPath)) return null;
+  return JSON.parse(readFileSync(configPath, "utf-8"));
+}
+function listEnvironments() {
+  if (!existsSync2(ENVIRONMENTS_DIR)) return [];
+  return readdirSync(ENVIRONMENTS_DIR).filter((name) => {
+    return existsSync2(join(ENVIRONMENTS_DIR, name, "config.json"));
+  }).map((name) => {
+    return JSON.parse(
+      readFileSync(join(ENVIRONMENTS_DIR, name, "config.json"), "utf-8")
+    );
+  }).sort((a, b) => a.stage.localeCompare(b.stage));
+}
+function resolveTerraformDir(stage) {
+  const env = loadEnvironment(stage);
+  if (env?.terraformDir && existsSync2(env.terraformDir)) {
+    return env.terraformDir;
+  }
+  const envVar = process.env.THINKWORK_TERRAFORM_DIR;
+  if (envVar && existsSync2(envVar)) return envVar;
+  const cwdTf = join(process.cwd(), "terraform");
+  if (existsSync2(join(cwdTf, "main.tf"))) return cwdTf;
+  return null;
+}
+
+// src/commands/config.ts
 var VALID_MEMORY_ENGINES = ["managed", "hindsight"];
 function readTfVar(tfvarsPath, key) {
-  if (!existsSync2(tfvarsPath)) return null;
-  const content = readFileSync(tfvarsPath, "utf-8");
+  if (!existsSync3(tfvarsPath)) return null;
+  const content = readFileSync2(tfvarsPath, "utf-8");
   const match = content.match(new RegExp(`^${key}\\s*=\\s*"([^"]*)"`, "m"));
   return match ? match[1] : null;
 }
 function setTfVar(tfvarsPath, key, value) {
-  if (!existsSync2(tfvarsPath)) {
+  if (!existsSync3(tfvarsPath)) {
     throw new Error(`terraform.tfvars not found at ${tfvarsPath}`);
   }
-  let content = readFileSync(tfvarsPath, "utf-8");
+  let content = readFileSync2(tfvarsPath, "utf-8");
   const regex = new RegExp(`^(${key}\\s*=\\s*)"[^"]*"`, "m");
   if (regex.test(content)) {
     content = content.replace(regex, `$1"${value}"`);
@@ -506,19 +554,93 @@ function setTfVar(tfvarsPath, key, value) {
 ${key} = "${value}"
 `;
   }
-  writeFileSync(tfvarsPath, content);
+  writeFileSync2(tfvarsPath, content);
+}
+function resolveTfvarsPath(stage) {
+  const tfDir = resolveTerraformDir(stage);
+  if (tfDir) {
+    const direct = `${tfDir}/terraform.tfvars`;
+    if (existsSync3(direct)) return direct;
+  }
+  const terraformDir = process.env.THINKWORK_TERRAFORM_DIR || process.cwd();
+  const cwd = resolveTierDir(terraformDir, stage, "app");
+  return `${cwd}/terraform.tfvars`;
 }
 function registerConfigCommand(program2) {
   const config = program2.command("config").description("View or change stack configuration");
+  config.command("list").description("List all environments, or show config for a specific stage").option("-s, --stage <name>", "Show config for a specific stage").action((opts) => {
+    if (opts.stage) {
+      const env = loadEnvironment(opts.stage);
+      if (!env) {
+        printError(`Environment "${opts.stage}" not found. Run \`thinkwork init -s ${opts.stage}\` first.`);
+        process.exit(1);
+      }
+      console.log("");
+      console.log(chalk3.bold.cyan(`  \u2B21 ${env.stage}`));
+      console.log(chalk3.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+      console.log(`  ${chalk3.bold("Region:")}          ${env.region}`);
+      console.log(`  ${chalk3.bold("Account:")}         ${env.accountId}`);
+      console.log(`  ${chalk3.bold("Database:")}        ${env.databaseEngine}`);
+      console.log(`  ${chalk3.bold("Memory:")}          ${env.memoryEngine}`);
+      console.log(`  ${chalk3.bold("Terraform dir:")}   ${env.terraformDir}`);
+      console.log(`  ${chalk3.bold("Created:")}         ${env.createdAt}`);
+      console.log(`  ${chalk3.bold("Updated:")}         ${env.updatedAt}`);
+      console.log(chalk3.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+      const tfvarsPath = `${env.terraformDir}/terraform.tfvars`;
+      if (existsSync3(tfvarsPath)) {
+        console.log("");
+        console.log(chalk3.dim("  terraform.tfvars:"));
+        const content = readFileSync2(tfvarsPath, "utf-8");
+        for (const line of content.split("\n")) {
+          if (line.trim() && !line.trim().startsWith("#")) {
+            const masked = line.replace(
+              /^(db_password\s*=\s*)".*"/,
+              '$1"********"'
+            ).replace(
+              /^(api_auth_secret\s*=\s*)".*"/,
+              '$1"********"'
+            ).replace(
+              /^(google_oauth_client_secret\s*=\s*)".*"/,
+              '$1"********"'
+            );
+            console.log(`  ${chalk3.dim(masked)}`);
+          }
+        }
+      }
+      console.log("");
+      return;
+    }
+    const envs = listEnvironments();
+    if (envs.length === 0) {
+      console.log("");
+      console.log("  No environments found.");
+      console.log(`  Run ${chalk3.cyan("thinkwork init -s <stage>")} to create one.`);
+      console.log("");
+      return;
+    }
+    console.log("");
+    console.log(chalk3.bold("  Environments"));
+    console.log(chalk3.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+    for (const env of envs) {
+      const memBadge = env.memoryEngine === "hindsight" ? chalk3.magenta("hindsight") : chalk3.dim("managed");
+      const dbBadge = env.databaseEngine === "rds-postgres" ? chalk3.yellow("rds") : chalk3.dim("aurora");
+      console.log(
+        `  ${chalk3.bold.cyan(env.stage.padEnd(16))}${env.region.padEnd(14)}${env.accountId.padEnd(16)}${dbBadge.padEnd(20)}${memBadge}`
+      );
+    }
+    console.log(chalk3.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+    console.log(chalk3.dim(`  ${envs.length} environment(s)`));
+    console.log("");
+    console.log(`  Show details: ${chalk3.cyan("thinkwork config list -s <stage>")}`);
+    console.log("");
+  });
   config.command("get <key>").description("Get a configuration value (e.g. memory-engine)").requiredOption("-s, --stage <name>", "Deployment stage").action((key, opts) => {
     const stageCheck = validateStage(opts.stage);
     if (!stageCheck.valid) {
       printError(stageCheck.error);
       process.exit(1);
     }
-    const terraformDir = process.env.THINKWORK_TERRAFORM_DIR || process.cwd();
-    const cwd = resolveTierDir(terraformDir, opts.stage, "app");
-    const tfvarsPath = `${cwd}/terraform.tfvars`;
+    const tfvarsPath = resolveTfvarsPath(opts.stage);
     const tfKey = key.replace(/-/g, "_");
     const value = readTfVar(tfvarsPath, tfKey);
     if (value === null) {
@@ -527,7 +649,7 @@ function registerConfigCommand(program2) {
       console.log(`  ${key} = ${value}`);
     }
   });
-  config.command("set <key> <value>").description("Set a configuration value and optionally deploy (e.g. config set memory-engine hindsight)").requiredOption("-s, --stage <name>", "Deployment stage").option("--apply", "Run terraform apply after changing the value").action(async (key, value, opts) => {
+  config.command("set <key> <value>").description("Set a configuration value and optionally deploy").requiredOption("-s, --stage <name>", "Deployment stage").option("--apply", "Run terraform apply after changing the value").action(async (key, value, opts) => {
     const stageCheck = validateStage(opts.stage);
     if (!stageCheck.valid) {
       printError(stageCheck.error);
@@ -540,18 +662,21 @@ function registerConfigCommand(program2) {
     }
     const identity = getAwsIdentity();
     printHeader("config set", opts.stage, identity);
-    const terraformDir = process.env.THINKWORK_TERRAFORM_DIR || process.cwd();
-    const cwd = resolveTierDir(terraformDir, opts.stage, "app");
-    const tfvarsPath = `${cwd}/terraform.tfvars`;
+    const tfvarsPath = resolveTfvarsPath(opts.stage);
     const oldValue = readTfVar(tfvarsPath, tfKey);
     setTfVar(tfvarsPath, tfKey, value);
     console.log(`  ${key}: ${oldValue ?? "(unset)"} \u2192 ${value}`);
     if (opts.apply) {
+      const tfDir = resolveTerraformDir(opts.stage);
+      if (!tfDir) {
+        printError("Cannot find terraform directory. Run `thinkwork init` first.");
+        process.exit(1);
+      }
       console.log("");
       console.log("  Applying configuration change...");
-      await ensureInit(cwd);
-      await ensureWorkspace(cwd, opts.stage);
-      const code = await runTerraform(cwd, [
+      await ensureInit(tfDir);
+      await ensureWorkspace(tfDir, opts.stage);
+      const code = await runTerraform(tfDir, [
         "apply",
         "-auto-approve",
         `-var=stage=${opts.stage}`
@@ -613,8 +738,8 @@ function registerBootstrapCommand(program2) {
       bucket = await getTerraformOutput(cwd, "bucket_name");
       dbEndpoint = await getTerraformOutput(cwd, "db_cluster_endpoint");
       const secretArn = await getTerraformOutput(cwd, "db_secret_arn");
-      const { execSync: execSync5 } = await import("child_process");
-      const secretJson = execSync5(
+      const { execSync: execSync6 } = await import("child_process");
+      const secretJson = execSync6(
         `aws secretsmanager get-secret-value --secret-id "${secretArn}" --query SecretString --output text`,
         { encoding: "utf-8" }
       ).trim();
@@ -637,8 +762,131 @@ function registerBootstrapCommand(program2) {
 }
 
 // src/commands/login.ts
-import { execSync as execSync3 } from "child_process";
+import { execSync as execSync4 } from "child_process";
 import { createInterface as createInterface2 } from "readline";
+
+// src/prerequisites.ts
+import { execSync as execSync3 } from "child_process";
+import { mkdirSync as mkdirSync2, createWriteStream, chmodSync } from "fs";
+import { join as join2 } from "path";
+import { homedir as homedir2, platform, arch } from "os";
+import chalk4 from "chalk";
+function run(cmd, opts) {
+  try {
+    return execSync3(cmd, {
+      encoding: "utf-8",
+      timeout: 3e4,
+      stdio: opts?.silent ? ["pipe", "pipe", "pipe"] : void 0
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function isInstalled(cmd) {
+  return run(`which ${cmd}`, { silent: true }) !== null;
+}
+function hasBrew() {
+  return isInstalled("brew");
+}
+async function ensureAwsCli() {
+  if (isInstalled("aws")) return true;
+  console.log(`  ${chalk4.yellow("\u2192")} AWS CLI not found. Installing...`);
+  const os = platform();
+  if (os === "darwin" && hasBrew()) {
+    const result = run("brew install awscli");
+    if (result !== null && isInstalled("aws")) {
+      console.log(`  ${chalk4.green("\u2713")} AWS CLI installed via Homebrew`);
+      return true;
+    }
+  }
+  if (os === "linux") {
+    try {
+      const tmpDir = join2(homedir2(), ".thinkwork", "tmp");
+      mkdirSync2(tmpDir, { recursive: true });
+      const zipPath = join2(tmpDir, "awscliv2.zip");
+      console.log("    Downloading AWS CLI...");
+      run(`curl -sL "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "${zipPath}"`);
+      run(`cd "${tmpDir}" && unzip -qo "${zipPath}"`);
+      run(`"${tmpDir}/aws/install" --install-dir "${homedir2()}/.thinkwork/aws-cli" --bin-dir "${homedir2()}/.local/bin" --update`);
+      process.env.PATH = `${homedir2()}/.local/bin:${process.env.PATH}`;
+      if (isInstalled("aws")) {
+        console.log(`  ${chalk4.green("\u2713")} AWS CLI installed to ~/.local/bin/aws`);
+        return true;
+      }
+    } catch {
+    }
+  }
+  if (os === "darwin") {
+    try {
+      const tmpDir = join2(homedir2(), ".thinkwork", "tmp");
+      mkdirSync2(tmpDir, { recursive: true });
+      const pkgPath = join2(tmpDir, "AWSCLIV2.pkg");
+      console.log("    Downloading AWS CLI...");
+      run(`curl -sL "https://awscli.amazonaws.com/AWSCLIV2.pkg" -o "${pkgPath}"`);
+      run(`installer -pkg "${pkgPath}" -target CurrentUserHomeDirectory 2>/dev/null || sudo installer -pkg "${pkgPath}" -target /`);
+      if (isInstalled("aws")) {
+        console.log(`  ${chalk4.green("\u2713")} AWS CLI installed`);
+        return true;
+      }
+    } catch {
+    }
+  }
+  console.log(`  ${chalk4.red("\u2717")} Could not auto-install AWS CLI.`);
+  console.log(`    Install manually: ${chalk4.cyan("https://aws.amazon.com/cli/")}`);
+  return false;
+}
+async function ensureTerraform() {
+  if (isInstalled("terraform")) return true;
+  console.log(`  ${chalk4.yellow("\u2192")} Terraform not found. Installing...`);
+  const os = platform();
+  if ((os === "darwin" || os === "linux") && hasBrew()) {
+    const result = run("brew install hashicorp/tap/terraform");
+    if (result !== null && isInstalled("terraform")) {
+      console.log(`  ${chalk4.green("\u2713")} Terraform installed via Homebrew`);
+      return true;
+    }
+  }
+  const tfVersion = "1.12.1";
+  const osName = os === "darwin" ? "darwin" : "linux";
+  const archName = arch() === "arm64" ? "arm64" : "amd64";
+  const url = `https://releases.hashicorp.com/terraform/${tfVersion}/terraform_${tfVersion}_${osName}_${archName}.zip`;
+  try {
+    const tmpDir = join2(homedir2(), ".thinkwork", "tmp");
+    const binDir = join2(homedir2(), ".local", "bin");
+    mkdirSync2(tmpDir, { recursive: true });
+    mkdirSync2(binDir, { recursive: true });
+    const zipPath = join2(tmpDir, "terraform.zip");
+    console.log(`    Downloading Terraform ${tfVersion}...`);
+    run(`curl -sL "${url}" -o "${zipPath}"`);
+    run(`unzip -qo "${zipPath}" -d "${binDir}"`);
+    chmodSync(join2(binDir, "terraform"), 493);
+    if (!process.env.PATH?.includes(binDir)) {
+      process.env.PATH = `${binDir}:${process.env.PATH}`;
+    }
+    if (isInstalled("terraform")) {
+      console.log(`  ${chalk4.green("\u2713")} Terraform ${tfVersion} installed to ~/.local/bin/terraform`);
+      return true;
+    }
+  } catch {
+  }
+  console.log(`  ${chalk4.red("\u2717")} Could not auto-install Terraform.`);
+  console.log(`    Install manually: ${chalk4.cyan("https://developer.hashicorp.com/terraform/install")}`);
+  return false;
+}
+async function ensurePrerequisites() {
+  console.log(chalk4.dim("  Checking prerequisites...\n"));
+  const awsOk = await ensureAwsCli();
+  const tfOk = await ensureTerraform();
+  if (awsOk && tfOk) {
+    console.log("");
+    return true;
+  }
+  console.log("");
+  console.log(`  ${chalk4.red("Missing prerequisites.")} Install them and try again.`);
+  return false;
+}
+
+// src/commands/login.ts
 function ask(prompt) {
   const rl = createInterface2({ input: process.stdin, output: process.stdout });
   return new Promise((resolve3) => {
@@ -651,6 +899,10 @@ function ask(prompt) {
 function registerLoginCommand(program2) {
   program2.command("login").description("Configure AWS credentials for Thinkwork deployments").option("--profile <name>", "AWS profile name to configure", "thinkwork").option("--sso", "Use AWS SSO (Identity Center) login").action(async (opts) => {
     printHeader("login", opts.profile);
+    const awsOk = await ensureAwsCli();
+    if (!awsOk) {
+      process.exit(1);
+    }
     const existing = getAwsIdentity();
     if (existing) {
       console.log(`  Already authenticated:`);
@@ -668,7 +920,7 @@ function registerLoginCommand(program2) {
       console.log("  Launching AWS SSO login...");
       console.log("");
       try {
-        execSync3(`aws sso login --profile ${opts.profile}`, {
+        execSync4(`aws sso login --profile ${opts.profile}`, {
           stdio: "inherit"
         });
         process.env.AWS_PROFILE = opts.profile;
@@ -699,9 +951,9 @@ function registerLoginCommand(program2) {
     const region = await ask("  Default region [us-east-1]: ");
     const finalRegion = region || "us-east-1";
     try {
-      execSync3(`aws configure set aws_access_key_id "${accessKeyId}" --profile ${opts.profile}`, { stdio: "pipe" });
-      execSync3(`aws configure set aws_secret_access_key "${secretAccessKey}" --profile ${opts.profile}`, { stdio: "pipe" });
-      execSync3(`aws configure set region "${finalRegion}" --profile ${opts.profile}`, { stdio: "pipe" });
+      execSync4(`aws configure set aws_access_key_id "${accessKeyId}" --profile ${opts.profile}`, { stdio: "pipe" });
+      execSync4(`aws configure set aws_secret_access_key "${secretAccessKey}" --profile ${opts.profile}`, { stdio: "pipe" });
+      execSync4(`aws configure set region "${finalRegion}" --profile ${opts.profile}`, { stdio: "pipe" });
     } catch (err) {
       printError(`Failed to save credentials: ${err}`);
       process.exit(1);
@@ -721,16 +973,16 @@ function registerLoginCommand(program2) {
 }
 
 // src/commands/init.ts
-import { existsSync as existsSync3, mkdirSync, writeFileSync as writeFileSync2, cpSync } from "fs";
-import { resolve as resolve2, join, dirname } from "path";
-import { execSync as execSync4 } from "child_process";
+import { existsSync as existsSync5, mkdirSync as mkdirSync3, writeFileSync as writeFileSync3, cpSync } from "fs";
+import { resolve as resolve2, join as join3, dirname } from "path";
+import { execSync as execSync5 } from "child_process";
 import { fileURLToPath } from "url";
 import { createInterface as createInterface3 } from "readline";
-import chalk3 from "chalk";
+import chalk5 from "chalk";
 var __dirname = dirname(fileURLToPath(import.meta.url));
 function ask2(prompt, defaultVal = "") {
   const rl = createInterface3({ input: process.stdin, output: process.stdout });
-  const suffix = defaultVal ? chalk3.dim(` [${defaultVal}]`) : "";
+  const suffix = defaultVal ? chalk5.dim(` [${defaultVal}]`) : "";
   return new Promise((resolve3) => {
     rl.question(`  ${prompt}${suffix}: `, (answer) => {
       rl.close();
@@ -739,7 +991,7 @@ function ask2(prompt, defaultVal = "") {
   });
 }
 function choose(prompt, options, defaultVal) {
-  const optStr = options.map((o) => o === defaultVal ? chalk3.bold(o) : chalk3.dim(o)).join(" / ");
+  const optStr = options.map((o) => o === defaultVal ? chalk5.bold(o) : chalk5.dim(o)).join(" / ");
   return ask2(`${prompt} (${optStr})`, defaultVal);
 }
 function generateSecret(length = 32) {
@@ -752,9 +1004,9 @@ function generateSecret(length = 32) {
 }
 function findBundledTerraform() {
   const bundled = resolve2(__dirname, "..", "terraform");
-  if (existsSync3(join(bundled, "modules"))) return bundled;
+  if (existsSync5(join3(bundled, "modules"))) return bundled;
   const repoTf = resolve2(__dirname, "..", "..", "..", "..", "terraform");
-  if (existsSync3(join(repoTf, "modules"))) return repoTf;
+  if (existsSync5(join3(repoTf, "modules"))) return repoTf;
   throw new Error(
     "Terraform modules not found. The CLI package may be incomplete.\nTry reinstalling: npm install -g thinkwork-cli@latest"
   );
@@ -813,14 +1065,18 @@ function registerInitCommand(program2) {
     }
     const identity = getAwsIdentity();
     printHeader("init", opts.stage, identity);
+    const prereqsOk = await ensurePrerequisites();
+    if (!prereqsOk) {
+      process.exit(1);
+    }
     if (!identity) {
       printError("AWS credentials not configured. Run `thinkwork login` first.");
       process.exit(1);
     }
     const targetDir = resolve2(opts.dir);
-    const tfDir = join(targetDir, "terraform");
-    const tfvarsPath = join(tfDir, "terraform.tfvars");
-    if (existsSync3(tfvarsPath)) {
+    const tfDir = join3(targetDir, "terraform");
+    const tfvarsPath = join3(tfDir, "terraform.tfvars");
+    if (existsSync5(tfvarsPath)) {
       printWarning(`terraform.tfvars already exists at ${tfvarsPath}`);
       const overwrite = await ask2("Overwrite?", "N");
       if (overwrite.toLowerCase() !== "y") {
@@ -844,19 +1100,19 @@ function registerInitCommand(program2) {
       config.admin_url = "http://localhost:5174";
       config.mobile_scheme = "thinkwork";
     } else {
-      console.log(chalk3.bold("  Configure your Thinkwork environment\n"));
+      console.log(chalk5.bold("  Configure your Thinkwork environment\n"));
       const defaultRegion = identity.region !== "unknown" ? identity.region : "us-east-1";
       config.region = await ask2("AWS Region", defaultRegion);
       console.log("");
-      console.log(chalk3.dim("  \u2500\u2500 Database \u2500\u2500"));
+      console.log(chalk5.dim("  \u2500\u2500 Database \u2500\u2500"));
       config.database_engine = await choose("Database engine", ["aurora-serverless", "rds-postgres"], "aurora-serverless");
       console.log("");
-      console.log(chalk3.dim("  \u2500\u2500 Memory \u2500\u2500"));
-      console.log(chalk3.dim("  managed    = Built-in AgentCore memory (remember/recall/forget)"));
-      console.log(chalk3.dim("  hindsight  = ECS Fargate service with semantic + graph retrieval"));
+      console.log(chalk5.dim("  \u2500\u2500 Memory \u2500\u2500"));
+      console.log(chalk5.dim("  managed    = Built-in AgentCore memory (remember/recall/forget)"));
+      console.log(chalk5.dim("  hindsight  = ECS Fargate service with semantic + graph retrieval"));
       config.memory_engine = await choose("Memory engine", ["managed", "hindsight"], "managed");
       console.log("");
-      console.log(chalk3.dim("  \u2500\u2500 Auth \u2500\u2500"));
+      console.log(chalk5.dim("  \u2500\u2500 Auth \u2500\u2500"));
       const useGoogle = await ask2("Enable Google OAuth login? (y/N)", "N");
       if (useGoogle.toLowerCase() === "y") {
         config.google_oauth_client_id = await ask2("Google OAuth Client ID");
@@ -866,13 +1122,13 @@ function registerInitCommand(program2) {
         config.google_oauth_client_secret = "";
       }
       console.log("");
-      console.log(chalk3.dim("  \u2500\u2500 Frontend URLs \u2500\u2500"));
+      console.log(chalk5.dim("  \u2500\u2500 Frontend URLs \u2500\u2500"));
       config.admin_url = await ask2("Admin UI URL", "http://localhost:5174");
       config.mobile_scheme = await ask2("Mobile app URL scheme", "thinkwork");
       console.log("");
-      console.log(chalk3.dim("  \u2500\u2500 Secrets (auto-generated) \u2500\u2500"));
-      console.log(chalk3.dim(`  DB password:     ${config.db_password.slice(0, 8)}...`));
-      console.log(chalk3.dim(`  API auth secret: ${config.api_auth_secret.slice(0, 16)}...`));
+      console.log(chalk5.dim("  \u2500\u2500 Secrets (auto-generated) \u2500\u2500"));
+      console.log(chalk5.dim(`  DB password:     ${config.db_password.slice(0, 8)}...`));
+      console.log(chalk5.dim(`  API auth secret: ${config.api_auth_secret.slice(0, 16)}...`));
     }
     console.log("");
     console.log("  Scaffolding Terraform modules...");
@@ -883,24 +1139,24 @@ function registerInitCommand(program2) {
       printError(String(err));
       process.exit(1);
     }
-    mkdirSync(tfDir, { recursive: true });
+    mkdirSync3(tfDir, { recursive: true });
     const copyDirs = ["modules", "examples"];
     for (const dir of copyDirs) {
-      const src = join(bundledTf, dir);
-      const dst = join(tfDir, dir);
-      if (existsSync3(src) && !existsSync3(dst)) {
+      const src = join3(bundledTf, dir);
+      const dst = join3(tfDir, dir);
+      if (existsSync5(src) && !existsSync5(dst)) {
         cpSync(src, dst, { recursive: true });
       }
     }
-    const schemaPath = join(bundledTf, "schema.graphql");
-    if (existsSync3(schemaPath) && !existsSync3(join(tfDir, "schema.graphql"))) {
-      cpSync(schemaPath, join(tfDir, "schema.graphql"));
+    const schemaPath = join3(bundledTf, "schema.graphql");
+    if (existsSync5(schemaPath) && !existsSync5(join3(tfDir, "schema.graphql"))) {
+      cpSync(schemaPath, join3(tfDir, "schema.graphql"));
     }
     const tfvars = buildTfvars(config);
-    writeFileSync2(tfvarsPath, tfvars);
-    const mainTfPath = join(tfDir, "main.tf");
-    if (!existsSync3(mainTfPath)) {
-      writeFileSync2(mainTfPath, `################################################################################
+    writeFileSync3(tfvarsPath, tfvars);
+    const mainTfPath = join3(tfDir, "main.tf");
+    if (!existsSync5(mainTfPath)) {
+      writeFileSync3(mainTfPath, `################################################################################
 # Thinkwork \u2014 ${config.stage}
 # Generated by: thinkwork init -s ${config.stage}
 ################################################################################
@@ -977,31 +1233,42 @@ output "memory_engine"      { value = module.thinkwork.memory_engine }
 output "hindsight_endpoint"  { value = module.thinkwork.hindsight_endpoint }
 `);
     }
-    console.log(`  Wrote ${chalk3.cyan(tfDir + "/")}`);
+    console.log(`  Wrote ${chalk5.cyan(tfDir + "/")}`);
     console.log("");
-    console.log(chalk3.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-    console.log(`  ${chalk3.bold("Stage:")}           ${config.stage}`);
-    console.log(`  ${chalk3.bold("Region:")}          ${config.region}`);
-    console.log(`  ${chalk3.bold("Account:")}         ${config.account_id}`);
-    console.log(`  ${chalk3.bold("Database:")}        ${config.database_engine}`);
-    console.log(`  ${chalk3.bold("Memory:")}          ${config.memory_engine}`);
-    console.log(`  ${chalk3.bold("Google OAuth:")}    ${config.google_oauth_client_id ? "enabled" : "disabled"}`);
-    console.log(`  ${chalk3.bold("Directory:")}       ${tfDir}`);
-    console.log(chalk3.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+    console.log(chalk5.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+    console.log(`  ${chalk5.bold("Stage:")}           ${config.stage}`);
+    console.log(`  ${chalk5.bold("Region:")}          ${config.region}`);
+    console.log(`  ${chalk5.bold("Account:")}         ${config.account_id}`);
+    console.log(`  ${chalk5.bold("Database:")}        ${config.database_engine}`);
+    console.log(`  ${chalk5.bold("Memory:")}          ${config.memory_engine}`);
+    console.log(`  ${chalk5.bold("Google OAuth:")}    ${config.google_oauth_client_id ? "enabled" : "disabled"}`);
+    console.log(`  ${chalk5.bold("Directory:")}       ${tfDir}`);
+    console.log(chalk5.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
     console.log("\n  Initializing Terraform...\n");
     try {
-      execSync4("terraform init", { cwd: tfDir, stdio: "inherit" });
+      execSync5("terraform init", { cwd: tfDir, stdio: "inherit" });
     } catch {
       printWarning("Terraform init failed. Run `thinkwork doctor -s " + opts.stage + "` to check prerequisites.");
       return;
     }
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    saveEnvironment({
+      stage: config.stage,
+      region: config.region,
+      accountId: config.account_id,
+      terraformDir: tfDir,
+      databaseEngine: config.database_engine,
+      memoryEngine: config.memory_engine,
+      createdAt: now,
+      updatedAt: now
+    });
     printSuccess(`Environment "${opts.stage}" initialized`);
     console.log("");
     console.log("  Next steps:");
-    console.log(`    ${chalk3.cyan("1.")} thinkwork plan -s ${opts.stage}        ${chalk3.dim("# Review infrastructure plan")}`);
-    console.log(`    ${chalk3.cyan("2.")} thinkwork deploy -s ${opts.stage}       ${chalk3.dim("# Deploy to AWS (~5 min)")}`);
-    console.log(`    ${chalk3.cyan("3.")} thinkwork bootstrap -s ${opts.stage}    ${chalk3.dim("# Seed workspace files + skills")}`);
-    console.log(`    ${chalk3.cyan("4.")} thinkwork outputs -s ${opts.stage}      ${chalk3.dim("# Show API URL, Cognito IDs, etc.")}`);
+    console.log(`    ${chalk5.cyan("1.")} thinkwork plan -s ${opts.stage}        ${chalk5.dim("# Review infrastructure plan")}`);
+    console.log(`    ${chalk5.cyan("2.")} thinkwork deploy -s ${opts.stage}       ${chalk5.dim("# Deploy to AWS (~5 min)")}`);
+    console.log(`    ${chalk5.cyan("3.")} thinkwork bootstrap -s ${opts.stage}    ${chalk5.dim("# Seed workspace files + skills")}`);
+    console.log(`    ${chalk5.cyan("4.")} thinkwork outputs -s ${opts.stage}      ${chalk5.dim("# Show API URL, Cognito IDs, etc.")}`);
     console.log("");
   });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkwork-cli",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Thinkwork CLI — deploy, manage, and interact with your Thinkwork stack",
   "license": "MIT",
   "type": "module",