thinkwork-cli 0.2.1 → 0.3.1

package/README.md

@@ -23,27 +23,32 @@ thinkwork login
 # 2. Check prerequisites
 thinkwork doctor -s dev
 
-# 3. Initialize a new environment
+# 3. Initialize a new environment (interactive)
 thinkwork init -s dev
 
 # 4. Review the plan
 thinkwork plan -s dev
 
-# 5. Deploy
+# 5. Deploy (~5 min)
 thinkwork deploy -s dev
 
 # 6. Seed workspace files + skill catalog
 thinkwork bootstrap -s dev
+
+# 7. Show what was deployed
+thinkwork outputs -s dev
 ```
 
+No repo clone required — `thinkwork init` scaffolds all Terraform modules from the npm package.
+
 ## Commands
 
 ### Setup
 
 | Command | Description |
 |---------|-------------|
-| `thinkwork login` | Configure AWS credentials (access keys or SSO) |
-| `thinkwork init -s <stage>` | Initialize a new environment (generates tfvars, runs terraform init) |
+| `thinkwork login` | Configure AWS credentials (access keys or `--sso`) |
+| `thinkwork init -s <stage>` | Initialize a new environment — generates terraform.tfvars, scaffolds Terraform modules, runs `terraform init` |
 | `thinkwork doctor -s <stage>` | Check prerequisites (AWS CLI, Terraform, credentials, Bedrock access) |
 
 ### Deploy
@@ -60,6 +65,8 @@ thinkwork bootstrap -s dev
 | Command | Description |
 |---------|-------------|
 | `thinkwork outputs -s <stage>` | Show deployment outputs (API URL, Cognito IDs, etc.) |
+| `thinkwork config list` | List all initialized environments |
+| `thinkwork config list -s <stage>` | Show full config for an environment (secrets masked) |
 | `thinkwork config get <key> -s <stage>` | Read a configuration value |
 | `thinkwork config set <key> <value> -s <stage>` | Update a configuration value |
 
@@ -70,23 +77,48 @@ thinkwork bootstrap -s dev
 -p, --profile <name>    AWS profile to use
 -c, --component <tier>  Component tier: foundation, data, app, or all (default: all)
 -y, --yes               Skip confirmation prompts (for CI)
+--defaults              Skip interactive prompts in init (use all defaults)
 -v, --version           Print CLI version
 -h, --help              Show help
 ```
 
+## Interactive Init
+
+`thinkwork init` walks you through all configuration options:
+
+- **AWS Region** — where to deploy (default: us-east-1)
+- **Database engine** — `aurora-serverless` (production) or `rds-postgres` (dev, cheaper)
+- **Memory engine** — `managed` (built-in) or `hindsight` (ECS Fargate with semantic + graph retrieval)
+- **Google OAuth** — optional social login for Cognito
+- **Admin UI URL** — callback URL for the admin dashboard
+- **Mobile app scheme** — deep link scheme for the mobile app
+- **Secrets** — DB password and API auth secret are auto-generated
+
+For CI, use `--defaults` to skip prompts:
+
+```bash
+thinkwork init -s staging --defaults
+```
+
+## Environment Registry
+
+All initialized environments are saved to `~/.thinkwork/environments/<stage>/config.json`. This means:
+
+- **No `cd` required** — all commands auto-resolve the terraform directory
+- **List all stages** — `thinkwork config list` shows a table of all environments
+- **Inspect any stage** — `thinkwork config list -s dev` shows full config
+
 ## Examples
 
 ### Switch memory engine
 
 ```bash
-# Switch from managed to Hindsight memory
 thinkwork config set memory-engine hindsight -s dev --apply
 ```
 
 ### Deploy a specific tier
 
 ```bash
-# Only deploy the app tier (Lambda functions, API Gateway)
 thinkwork deploy -s dev -c app
 ```
 
@@ -100,7 +132,9 @@ thinkwork deploy -s dev --profile my-org
 ### CI/CD (non-interactive)
 
 ```bash
+thinkwork init -s prod --defaults
 thinkwork deploy -s prod -y
+thinkwork bootstrap -s prod
 ```
 
 ## Prerequisites
@@ -112,14 +146,14 @@ thinkwork deploy -s prod -y
 
 ## What Gets Deployed
 
-Thinkwork provisions a complete AI agent stack:
+Thinkwork provisions a complete AI agent stack (~250 AWS resources):
 
 - **Compute**: Lambda functions (39 handlers), AgentCore container (Lambda + ECR)
 - **Database**: Aurora Serverless PostgreSQL with pgvector
 - **Auth**: Cognito user pool (admin + mobile clients)
 - **API**: API Gateway (REST + GraphQL), AppSync (WebSocket subscriptions)
 - **Storage**: S3 (workspace files, skills, knowledge bases)
-- **Memory**: Managed (built-in) or Hindsight (ECS Fargate, opt-in)
+- **Memory**: Managed (built-in) or Hindsight (ECS Fargate with semantic + BM25 + entity graph retrieval)
 
 ## License
 

package/dist/cli.js

@@ -738,8 +738,8 @@ function registerBootstrapCommand(program2) {
       bucket = await getTerraformOutput(cwd, "bucket_name");
       dbEndpoint = await getTerraformOutput(cwd, "db_cluster_endpoint");
       const secretArn = await getTerraformOutput(cwd, "db_secret_arn");
-      const { execSync: execSync5 } = await import("child_process");
-      const secretJson = execSync5(
+      const { execSync: execSync7 } = await import("child_process");
+      const secretJson = execSync7(
         `aws secretsmanager get-secret-value --secret-id "${secretArn}" --query SecretString --output text`,
         { encoding: "utf-8" }
       ).trim();
@@ -762,8 +762,131 @@ function registerBootstrapCommand(program2) {
 }
 
 // src/commands/login.ts
-import { execSync as execSync3 } from "child_process";
+import { execSync as execSync4 } from "child_process";
 import { createInterface as createInterface2 } from "readline";
+
+// src/prerequisites.ts
+import { execSync as execSync3 } from "child_process";
+import { mkdirSync as mkdirSync2, createWriteStream, chmodSync } from "fs";
+import { join as join2 } from "path";
+import { homedir as homedir2, platform, arch } from "os";
+import chalk4 from "chalk";
+function run(cmd, opts) {
+  try {
+    return execSync3(cmd, {
+      encoding: "utf-8",
+      timeout: 3e4,
+      stdio: opts?.silent ? ["pipe", "pipe", "pipe"] : void 0
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function isInstalled(cmd) {
+  return run(`which ${cmd}`, { silent: true }) !== null;
+}
+function hasBrew() {
+  return isInstalled("brew");
+}
+async function ensureAwsCli() {
+  if (isInstalled("aws")) return true;
+  console.log(`  ${chalk4.yellow("\u2192")} AWS CLI not found. Installing...`);
+  const os = platform();
+  if (os === "darwin" && hasBrew()) {
+    const result = run("brew install awscli");
+    if (result !== null && isInstalled("aws")) {
+      console.log(`  ${chalk4.green("\u2713")} AWS CLI installed via Homebrew`);
+      return true;
+    }
+  }
+  if (os === "linux") {
+    try {
+      const tmpDir = join2(homedir2(), ".thinkwork", "tmp");
+      mkdirSync2(tmpDir, { recursive: true });
+      const zipPath = join2(tmpDir, "awscliv2.zip");
+      console.log("    Downloading AWS CLI...");
+      run(`curl -sL "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "${zipPath}"`);
+      run(`cd "${tmpDir}" && unzip -qo "${zipPath}"`);
+      run(`"${tmpDir}/aws/install" --install-dir "${homedir2()}/.thinkwork/aws-cli" --bin-dir "${homedir2()}/.local/bin" --update`);
+      process.env.PATH = `${homedir2()}/.local/bin:${process.env.PATH}`;
+      if (isInstalled("aws")) {
+        console.log(`  ${chalk4.green("\u2713")} AWS CLI installed to ~/.local/bin/aws`);
+        return true;
+      }
+    } catch {
+    }
+  }
+  if (os === "darwin") {
+    try {
+      const tmpDir = join2(homedir2(), ".thinkwork", "tmp");
+      mkdirSync2(tmpDir, { recursive: true });
+      const pkgPath = join2(tmpDir, "AWSCLIV2.pkg");
+      console.log("    Downloading AWS CLI...");
+      run(`curl -sL "https://awscli.amazonaws.com/AWSCLIV2.pkg" -o "${pkgPath}"`);
+      run(`installer -pkg "${pkgPath}" -target CurrentUserHomeDirectory 2>/dev/null || sudo installer -pkg "${pkgPath}" -target /`);
+      if (isInstalled("aws")) {
+        console.log(`  ${chalk4.green("\u2713")} AWS CLI installed`);
+        return true;
+      }
+    } catch {
+    }
+  }
+  console.log(`  ${chalk4.red("\u2717")} Could not auto-install AWS CLI.`);
+  console.log(`    Install manually: ${chalk4.cyan("https://aws.amazon.com/cli/")}`);
+  return false;
+}
+async function ensureTerraform() {
+  if (isInstalled("terraform")) return true;
+  console.log(`  ${chalk4.yellow("\u2192")} Terraform not found. Installing...`);
+  const os = platform();
+  if ((os === "darwin" || os === "linux") && hasBrew()) {
+    const result = run("brew install hashicorp/tap/terraform");
+    if (result !== null && isInstalled("terraform")) {
+      console.log(`  ${chalk4.green("\u2713")} Terraform installed via Homebrew`);
+      return true;
+    }
+  }
+  const tfVersion = "1.12.1";
+  const osName = os === "darwin" ? "darwin" : "linux";
+  const archName = arch() === "arm64" ? "arm64" : "amd64";
+  const url = `https://releases.hashicorp.com/terraform/${tfVersion}/terraform_${tfVersion}_${osName}_${archName}.zip`;
+  try {
+    const tmpDir = join2(homedir2(), ".thinkwork", "tmp");
+    const binDir = join2(homedir2(), ".local", "bin");
+    mkdirSync2(tmpDir, { recursive: true });
+    mkdirSync2(binDir, { recursive: true });
+    const zipPath = join2(tmpDir, "terraform.zip");
+    console.log(`    Downloading Terraform ${tfVersion}...`);
+    run(`curl -sL "${url}" -o "${zipPath}"`);
+    run(`unzip -qo "${zipPath}" -d "${binDir}"`);
+    chmodSync(join2(binDir, "terraform"), 493);
+    if (!process.env.PATH?.includes(binDir)) {
+      process.env.PATH = `${binDir}:${process.env.PATH}`;
+    }
+    if (isInstalled("terraform")) {
+      console.log(`  ${chalk4.green("\u2713")} Terraform ${tfVersion} installed to ~/.local/bin/terraform`);
+      return true;
+    }
+  } catch {
+  }
+  console.log(`  ${chalk4.red("\u2717")} Could not auto-install Terraform.`);
+  console.log(`    Install manually: ${chalk4.cyan("https://developer.hashicorp.com/terraform/install")}`);
+  return false;
+}
+async function ensurePrerequisites() {
+  console.log(chalk4.dim("  Checking prerequisites...\n"));
+  const awsOk = await ensureAwsCli();
+  const tfOk = await ensureTerraform();
+  if (awsOk && tfOk) {
+    console.log("");
+    return true;
+  }
+  console.log("");
+  console.log(`  ${chalk4.red("Missing prerequisites.")} Install them and try again.`);
+  return false;
+}
+
+// src/commands/login.ts
 function ask(prompt) {
   const rl = createInterface2({ input: process.stdin, output: process.stdout });
   return new Promise((resolve3) => {
@@ -776,6 +899,10 @@ function ask(prompt) {
 function registerLoginCommand(program2) {
   program2.command("login").description("Configure AWS credentials for Thinkwork deployments").option("--profile <name>", "AWS profile name to configure", "thinkwork").option("--sso", "Use AWS SSO (Identity Center) login").action(async (opts) => {
     printHeader("login", opts.profile);
+    const awsOk = await ensureAwsCli();
+    if (!awsOk) {
+      process.exit(1);
+    }
     const existing = getAwsIdentity();
     if (existing) {
       console.log(`  Already authenticated:`);
@@ -793,7 +920,7 @@ function registerLoginCommand(program2) {
       console.log("  Launching AWS SSO login...");
       console.log("");
       try {
-        execSync3(`aws sso login --profile ${opts.profile}`, {
+        execSync4(`aws sso login --profile ${opts.profile}`, {
           stdio: "inherit"
         });
         process.env.AWS_PROFILE = opts.profile;
@@ -824,9 +951,9 @@ function registerLoginCommand(program2) {
     const region = await ask("  Default region [us-east-1]: ");
     const finalRegion = region || "us-east-1";
     try {
-      execSync3(`aws configure set aws_access_key_id "${accessKeyId}" --profile ${opts.profile}`, { stdio: "pipe" });
-      execSync3(`aws configure set aws_secret_access_key "${secretAccessKey}" --profile ${opts.profile}`, { stdio: "pipe" });
-      execSync3(`aws configure set region "${finalRegion}" --profile ${opts.profile}`, { stdio: "pipe" });
+      execSync4(`aws configure set aws_access_key_id "${accessKeyId}" --profile ${opts.profile}`, { stdio: "pipe" });
+      execSync4(`aws configure set aws_secret_access_key "${secretAccessKey}" --profile ${opts.profile}`, { stdio: "pipe" });
+      execSync4(`aws configure set region "${finalRegion}" --profile ${opts.profile}`, { stdio: "pipe" });
     } catch (err) {
       printError(`Failed to save credentials: ${err}`);
       process.exit(1);
@@ -846,16 +973,16 @@ function registerLoginCommand(program2) {
 }
 
 // src/commands/init.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync2, writeFileSync as writeFileSync3, cpSync } from "fs";
-import { resolve as resolve2, join as join2, dirname } from "path";
-import { execSync as execSync4 } from "child_process";
+import { existsSync as existsSync5, mkdirSync as mkdirSync3, writeFileSync as writeFileSync3, cpSync } from "fs";
+import { resolve as resolve2, join as join3, dirname } from "path";
+import { execSync as execSync5 } from "child_process";
 import { fileURLToPath } from "url";
 import { createInterface as createInterface3 } from "readline";
-import chalk4 from "chalk";
+import chalk5 from "chalk";
 var __dirname = dirname(fileURLToPath(import.meta.url));
 function ask2(prompt, defaultVal = "") {
   const rl = createInterface3({ input: process.stdin, output: process.stdout });
-  const suffix = defaultVal ? chalk4.dim(` [${defaultVal}]`) : "";
+  const suffix = defaultVal ? chalk5.dim(` [${defaultVal}]`) : "";
   return new Promise((resolve3) => {
     rl.question(`  ${prompt}${suffix}: `, (answer) => {
       rl.close();
@@ -864,7 +991,7 @@ function ask2(prompt, defaultVal = "") {
   });
 }
 function choose(prompt, options, defaultVal) {
-  const optStr = options.map((o) => o === defaultVal ? chalk4.bold(o) : chalk4.dim(o)).join(" / ");
+  const optStr = options.map((o) => o === defaultVal ? chalk5.bold(o) : chalk5.dim(o)).join(" / ");
   return ask2(`${prompt} (${optStr})`, defaultVal);
 }
 function generateSecret(length = 32) {
@@ -877,9 +1004,9 @@ function generateSecret(length = 32) {
 }
 function findBundledTerraform() {
   const bundled = resolve2(__dirname, "..", "terraform");
-  if (existsSync4(join2(bundled, "modules"))) return bundled;
+  if (existsSync5(join3(bundled, "modules"))) return bundled;
   const repoTf = resolve2(__dirname, "..", "..", "..", "..", "terraform");
-  if (existsSync4(join2(repoTf, "modules"))) return repoTf;
+  if (existsSync5(join3(repoTf, "modules"))) return repoTf;
   throw new Error(
     "Terraform modules not found. The CLI package may be incomplete.\nTry reinstalling: npm install -g thinkwork-cli@latest"
   );
@@ -938,14 +1065,18 @@ function registerInitCommand(program2) {
     }
     const identity = getAwsIdentity();
     printHeader("init", opts.stage, identity);
+    const prereqsOk = await ensurePrerequisites();
+    if (!prereqsOk) {
+      process.exit(1);
+    }
     if (!identity) {
       printError("AWS credentials not configured. Run `thinkwork login` first.");
       process.exit(1);
     }
     const targetDir = resolve2(opts.dir);
-    const tfDir = join2(targetDir, "terraform");
-    const tfvarsPath = join2(tfDir, "terraform.tfvars");
-    if (existsSync4(tfvarsPath)) {
+    const tfDir = join3(targetDir, "terraform");
+    const tfvarsPath = join3(tfDir, "terraform.tfvars");
+    if (existsSync5(tfvarsPath)) {
       printWarning(`terraform.tfvars already exists at ${tfvarsPath}`);
       const overwrite = await ask2("Overwrite?", "N");
       if (overwrite.toLowerCase() !== "y") {
@@ -969,19 +1100,19 @@ function registerInitCommand(program2) {
       config.admin_url = "http://localhost:5174";
       config.mobile_scheme = "thinkwork";
     } else {
-      console.log(chalk4.bold("  Configure your Thinkwork environment\n"));
+      console.log(chalk5.bold("  Configure your Thinkwork environment\n"));
       const defaultRegion = identity.region !== "unknown" ? identity.region : "us-east-1";
       config.region = await ask2("AWS Region", defaultRegion);
       console.log("");
-      console.log(chalk4.dim("  \u2500\u2500 Database \u2500\u2500"));
+      console.log(chalk5.dim("  \u2500\u2500 Database \u2500\u2500"));
       config.database_engine = await choose("Database engine", ["aurora-serverless", "rds-postgres"], "aurora-serverless");
       console.log("");
-      console.log(chalk4.dim("  \u2500\u2500 Memory \u2500\u2500"));
-      console.log(chalk4.dim("  managed    = Built-in AgentCore memory (remember/recall/forget)"));
-      console.log(chalk4.dim("  hindsight  = ECS Fargate service with semantic + graph retrieval"));
+      console.log(chalk5.dim("  \u2500\u2500 Memory \u2500\u2500"));
+      console.log(chalk5.dim("  managed    = Built-in AgentCore memory (remember/recall/forget)"));
+      console.log(chalk5.dim("  hindsight  = ECS Fargate service with semantic + graph retrieval"));
       config.memory_engine = await choose("Memory engine", ["managed", "hindsight"], "managed");
       console.log("");
-      console.log(chalk4.dim("  \u2500\u2500 Auth \u2500\u2500"));
+      console.log(chalk5.dim("  \u2500\u2500 Auth \u2500\u2500"));
       const useGoogle = await ask2("Enable Google OAuth login? (y/N)", "N");
       if (useGoogle.toLowerCase() === "y") {
         config.google_oauth_client_id = await ask2("Google OAuth Client ID");
@@ -991,13 +1122,13 @@ function registerInitCommand(program2) {
         config.google_oauth_client_secret = "";
       }
       console.log("");
-      console.log(chalk4.dim("  \u2500\u2500 Frontend URLs \u2500\u2500"));
+      console.log(chalk5.dim("  \u2500\u2500 Frontend URLs \u2500\u2500"));
       config.admin_url = await ask2("Admin UI URL", "http://localhost:5174");
       config.mobile_scheme = await ask2("Mobile app URL scheme", "thinkwork");
       console.log("");
-      console.log(chalk4.dim("  \u2500\u2500 Secrets (auto-generated) \u2500\u2500"));
-      console.log(chalk4.dim(`  DB password:     ${config.db_password.slice(0, 8)}...`));
-      console.log(chalk4.dim(`  API auth secret: ${config.api_auth_secret.slice(0, 16)}...`));
+      console.log(chalk5.dim("  \u2500\u2500 Secrets (auto-generated) \u2500\u2500"));
+      console.log(chalk5.dim(`  DB password:     ${config.db_password.slice(0, 8)}...`));
+      console.log(chalk5.dim(`  API auth secret: ${config.api_auth_secret.slice(0, 16)}...`));
     }
     console.log("");
     console.log("  Scaffolding Terraform modules...");
@@ -1008,23 +1139,23 @@ function registerInitCommand(program2) {
       printError(String(err));
       process.exit(1);
     }
-    mkdirSync2(tfDir, { recursive: true });
+    mkdirSync3(tfDir, { recursive: true });
     const copyDirs = ["modules", "examples"];
     for (const dir of copyDirs) {
-      const src = join2(bundledTf, dir);
-      const dst = join2(tfDir, dir);
-      if (existsSync4(src) && !existsSync4(dst)) {
+      const src = join3(bundledTf, dir);
+      const dst = join3(tfDir, dir);
+      if (existsSync5(src) && !existsSync5(dst)) {
         cpSync(src, dst, { recursive: true });
       }
     }
-    const schemaPath = join2(bundledTf, "schema.graphql");
-    if (existsSync4(schemaPath) && !existsSync4(join2(tfDir, "schema.graphql"))) {
-      cpSync(schemaPath, join2(tfDir, "schema.graphql"));
+    const schemaPath = join3(bundledTf, "schema.graphql");
+    if (existsSync5(schemaPath) && !existsSync5(join3(tfDir, "schema.graphql"))) {
+      cpSync(schemaPath, join3(tfDir, "schema.graphql"));
     }
     const tfvars = buildTfvars(config);
     writeFileSync3(tfvarsPath, tfvars);
-    const mainTfPath = join2(tfDir, "main.tf");
-    if (!existsSync4(mainTfPath)) {
+    const mainTfPath = join3(tfDir, "main.tf");
+    if (!existsSync5(mainTfPath)) {
       writeFileSync3(mainTfPath, `################################################################################
 # Thinkwork \u2014 ${config.stage}
 # Generated by: thinkwork init -s ${config.stage}
@@ -1102,20 +1233,20 @@ output "memory_engine"      { value = module.thinkwork.memory_engine }
 output "hindsight_endpoint"  { value = module.thinkwork.hindsight_endpoint }
 `);
     }
-    console.log(`  Wrote ${chalk4.cyan(tfDir + "/")}`);
+    console.log(`  Wrote ${chalk5.cyan(tfDir + "/")}`);
     console.log("");
-    console.log(chalk4.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-    console.log(`  ${chalk4.bold("Stage:")}           ${config.stage}`);
-    console.log(`  ${chalk4.bold("Region:")}          ${config.region}`);
-    console.log(`  ${chalk4.bold("Account:")}         ${config.account_id}`);
-    console.log(`  ${chalk4.bold("Database:")}        ${config.database_engine}`);
-    console.log(`  ${chalk4.bold("Memory:")}          ${config.memory_engine}`);
-    console.log(`  ${chalk4.bold("Google OAuth:")}    ${config.google_oauth_client_id ? "enabled" : "disabled"}`);
-    console.log(`  ${chalk4.bold("Directory:")}       ${tfDir}`);
-    console.log(chalk4.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+    console.log(chalk5.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+    console.log(`  ${chalk5.bold("Stage:")}           ${config.stage}`);
+    console.log(`  ${chalk5.bold("Region:")}          ${config.region}`);
+    console.log(`  ${chalk5.bold("Account:")}         ${config.account_id}`);
+    console.log(`  ${chalk5.bold("Database:")}        ${config.database_engine}`);
+    console.log(`  ${chalk5.bold("Memory:")}          ${config.memory_engine}`);
+    console.log(`  ${chalk5.bold("Google OAuth:")}    ${config.google_oauth_client_id ? "enabled" : "disabled"}`);
+    console.log(`  ${chalk5.bold("Directory:")}       ${tfDir}`);
+    console.log(chalk5.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
     console.log("\n  Initializing Terraform...\n");
     try {
-      execSync4("terraform init", { cwd: tfDir, stdio: "inherit" });
+      execSync5("terraform init", { cwd: tfDir, stdio: "inherit" });
     } catch {
       printWarning("Terraform init failed. Run `thinkwork doctor -s " + opts.stage + "` to check prerequisites.");
       return;
@@ -1134,10 +1265,164 @@ output "hindsight_endpoint"  { value = module.thinkwork.hindsight_endpoint }
     printSuccess(`Environment "${opts.stage}" initialized`);
     console.log("");
     console.log("  Next steps:");
-    console.log(`    ${chalk4.cyan("1.")} thinkwork plan -s ${opts.stage}        ${chalk4.dim("# Review infrastructure plan")}`);
-    console.log(`    ${chalk4.cyan("2.")} thinkwork deploy -s ${opts.stage}       ${chalk4.dim("# Deploy to AWS (~5 min)")}`);
-    console.log(`    ${chalk4.cyan("3.")} thinkwork bootstrap -s ${opts.stage}    ${chalk4.dim("# Seed workspace files + skills")}`);
-    console.log(`    ${chalk4.cyan("4.")} thinkwork outputs -s ${opts.stage}      ${chalk4.dim("# Show API URL, Cognito IDs, etc.")}`);
+    console.log(`    ${chalk5.cyan("1.")} thinkwork plan -s ${opts.stage}        ${chalk5.dim("# Review infrastructure plan")}`);
+    console.log(`    ${chalk5.cyan("2.")} thinkwork deploy -s ${opts.stage}       ${chalk5.dim("# Deploy to AWS (~5 min)")}`);
+    console.log(`    ${chalk5.cyan("3.")} thinkwork bootstrap -s ${opts.stage}    ${chalk5.dim("# Seed workspace files + skills")}`);
+    console.log(`    ${chalk5.cyan("4.")} thinkwork outputs -s ${opts.stage}      ${chalk5.dim("# Show API URL, Cognito IDs, etc.")}`);
+    console.log("");
+  });
+}
+
+// src/commands/status.ts
+import { execSync as execSync6 } from "child_process";
+import chalk6 from "chalk";
+function runAws(cmd) {
+  try {
+    return execSync6(`aws ${cmd}`, {
+      encoding: "utf-8",
+      timeout: 15e3,
+      stdio: ["pipe", "pipe", "pipe"]
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function discoverAwsStages(region) {
+  const stages = /* @__PURE__ */ new Map();
+  const raw = runAws(
+    `lambda list-functions --region ${region} --query "Functions[?starts_with(FunctionName, 'thinkwork-')].FunctionName" --output json`
+  );
+  if (!raw) return stages;
+  const functions = JSON.parse(raw);
+  for (const fn of functions) {
+    const match = fn.match(/^thinkwork-(.+?)-api-graphql-http$/);
+    if (match) {
+      const stage = match[1];
+      stages.set(stage, { stage, source: "aws", region });
+    }
+  }
+  for (const [stage, info] of stages) {
+    const count = functions.filter((f) => f.startsWith(`thinkwork-${stage}-`)).length;
+    info.lambdaCount = count;
+    const apiRaw = runAws(
+      `apigatewayv2 get-apis --region ${region} --query "Items[?Name=='thinkwork-${stage}-api'].ApiEndpoint|[0]" --output text`
+    );
+    if (apiRaw && apiRaw !== "None") info.apiEndpoint = apiRaw;
+    const acRaw = runAws(
+      `lambda get-function --function-name thinkwork-${stage}-agentcore --region ${region} --query "Configuration.State" --output text 2>/dev/null`
+    );
+    info.agentcoreStatus = acRaw || "not deployed";
+    const bucketRaw = runAws(
+      `s3api head-bucket --bucket thinkwork-${stage}-storage --region ${region} 2>/dev/null && echo "exists"`
+    );
+    info.bucketName = bucketRaw ? `thinkwork-${stage}-storage` : void 0;
+    const ecsRaw = runAws(
+      `ecs describe-services --cluster thinkwork-${stage}-cluster --services thinkwork-${stage}-hindsight --region ${region} --query "services[0].runningCount" --output text 2>/dev/null`
+    );
+    if (ecsRaw && ecsRaw !== "None" && ecsRaw !== "0") {
+      info.memoryEngine = "hindsight";
+      const albRaw = runAws(
+        `elbv2 describe-load-balancers --region ${region} --query "LoadBalancers[?contains(LoadBalancerName, 'tw-${stage}-hindsight')].DNSName|[0]" --output text`
+      );
+      if (albRaw && albRaw !== "None") {
+        try {
+          const health = execSync6(`curl -s --max-time 3 http://${albRaw}/health`, { encoding: "utf-8" }).trim();
+          info.hindsightHealth = health.includes("healthy") ? "healthy" : "unhealthy";
+        } catch {
+          info.hindsightHealth = "unreachable";
+        }
+      }
+    } else {
+      info.memoryEngine = "managed";
+    }
+  }
+  return stages;
+}
+function registerStatusCommand(program2) {
+  program2.command("status").description("Show all Thinkwork environments (AWS + local)").option("-s, --stage <name>", "Show details for a specific stage").option("--region <region>", "AWS region to scan", "us-east-1").action(async (opts) => {
+    const identity = getAwsIdentity();
+    printHeader("status", opts.stage || "all", identity);
+    if (!identity) {
+      printError("AWS credentials not configured. Run `thinkwork login` first.");
+      process.exit(1);
+    }
+    console.log(chalk6.dim("  Scanning AWS account for Thinkwork deployments...\n"));
+    const awsStages = discoverAwsStages(opts.region);
+    const localEnvs = listEnvironments();
+    const merged = /* @__PURE__ */ new Map();
+    for (const [stage, info] of awsStages) {
+      const local = localEnvs.find((e) => e.stage === stage);
+      merged.set(stage, {
+        stage,
+        source: local ? "both" : "aws",
+        region: opts.region,
+        accountId: identity.account,
+        ...info
+      });
+    }
+    for (const env of localEnvs) {
+      if (!merged.has(env.stage)) {
+        merged.set(env.stage, {
+          stage: env.stage,
+          source: "local",
+          region: env.region,
+          accountId: env.accountId
+        });
+      }
+    }
+    if (opts.stage) {
+      const info = merged.get(opts.stage);
+      if (!info) {
+        printError(`No environment "${opts.stage}" found in AWS or local config.`);
+        process.exit(1);
+      }
+      console.log(chalk6.bold.cyan(`  \u2B21 ${info.stage}`));
+      console.log(chalk6.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+      console.log(`  ${chalk6.bold("Source:")}          ${info.source === "both" ? "AWS + local config" : info.source === "aws" ? "AWS (no local config)" : "local only (not in AWS)"}`);
+      console.log(`  ${chalk6.bold("Region:")}          ${info.region}`);
+      console.log(`  ${chalk6.bold("Account:")}         ${info.accountId}`);
+      if (info.apiEndpoint) console.log(`  ${chalk6.bold("API:")}             ${info.apiEndpoint}`);
+      if (info.lambdaCount) console.log(`  ${chalk6.bold("Lambda fns:")}      ${info.lambdaCount}`);
+      console.log(`  ${chalk6.bold("AgentCore:")}       ${info.agentcoreStatus || "unknown"}`);
+      console.log(`  ${chalk6.bold("Memory:")}          ${info.memoryEngine || "unknown"}`);
+      if (info.hindsightHealth) console.log(`  ${chalk6.bold("Hindsight:")}       ${info.hindsightHealth}`);
+      if (info.bucketName) console.log(`  ${chalk6.bold("S3 bucket:")}       ${info.bucketName}`);
+      console.log(chalk6.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+      const local = loadEnvironment(opts.stage);
+      if (local) {
+        console.log("");
+        console.log(chalk6.dim(`  Terraform dir: ${local.terraformDir}`));
+      } else {
+        console.log("");
+        console.log(chalk6.dim(`  No local config. Run: thinkwork init -s ${opts.stage}`));
+      }
+      console.log("");
+      return;
+    }
+    if (merged.size === 0) {
+      console.log("  No Thinkwork environments found.");
+      console.log(`  Run ${chalk6.cyan("thinkwork init -s <stage>")} to create one.`);
+      console.log("");
+      return;
+    }
+    console.log(chalk6.bold("  Environments"));
+    console.log(chalk6.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+    console.log(
+      chalk6.dim("  ") + "Stage".padEnd(16) + "Source".padEnd(10) + "Lambdas".padEnd(10) + "AgentCore".padEnd(14) + "Memory".padEnd(14) + "API"
+    );
+    console.log(chalk6.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+    for (const [, info] of [...merged].sort((a, b) => a[0].localeCompare(b[0]))) {
+      const sourceBadge = info.source === "both" ? chalk6.green("\u25CF") : info.source === "aws" ? chalk6.yellow("\u25CF") : chalk6.dim("\u25CB");
+      const acStatus = info.agentcoreStatus === "Active" ? chalk6.green("active") : info.agentcoreStatus === "not deployed" ? chalk6.dim("\u2014") : chalk6.yellow(info.agentcoreStatus || "\u2014");
+      const memBadge = info.memoryEngine === "hindsight" ? info.hindsightHealth === "healthy" ? chalk6.magenta("hindsight \u2713") : chalk6.yellow("hindsight ?") : chalk6.dim(info.memoryEngine || "\u2014");
+      console.log(
+        `  ${sourceBadge} ` + chalk6.bold(info.stage.padEnd(14)) + (info.source === "both" ? "aws+cli" : info.source).padEnd(10) + String(info.lambdaCount || "\u2014").padEnd(10) + acStatus.padEnd(22) + memBadge.padEnd(22) + chalk6.dim(info.apiEndpoint || "\u2014")
+      );
+    }
+    console.log(chalk6.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+    console.log(chalk6.dim(`  ${merged.size} environment(s)  `) + chalk6.green("\u25CF") + chalk6.dim(" aws+cli  ") + chalk6.yellow("\u25CF") + chalk6.dim(" aws only  ") + chalk6.dim("\u25CB local only"));
+    console.log("");
+    console.log(`  Details: ${chalk6.cyan("thinkwork status -s <stage>")}`);
     console.log("");
   });
 }
@@ -1163,6 +1448,7 @@ registerPlanCommand(program);
 registerDeployCommand(program);
 registerBootstrapCommand(program);
 registerDestroyCommand(program);
+registerStatusCommand(program);
 registerOutputsCommand(program);
 registerConfigCommand(program);
 program.parse();

package/dist/terraform/modules/app/hindsight-memory/main.tf

@@ -34,7 +34,7 @@ variable "database_url" {
 variable "image_tag" {
   description = "Hindsight Docker image tag (ghcr.io/vectorize-io/hindsight:<tag>)"
   type        = string
-  default     = "0.4.22"
+  default     = "0.5.0"
 }
 
 data "aws_region" "current" {}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkwork-cli",
-  "version": "0.2.1",
+  "version": "0.3.1",
   "description": "Thinkwork CLI — deploy, manage, and interact with your Thinkwork stack",
   "license": "MIT",
   "type": "module",