thinkwork-cli 0.5.1 → 0.5.3

package/dist/cli.js

@@ -534,24 +534,28 @@ function resolveTerraformDir(stage) {
 }
 
 // src/commands/config.ts
-var VALID_MEMORY_ENGINES = ["managed", "hindsight"];
 function readTfVar(tfvarsPath, key) {
   if (!existsSync3(tfvarsPath)) return null;
   const content = readFileSync2(tfvarsPath, "utf-8");
-  const match = content.match(new RegExp(`^${key}\\s*=\\s*"([^"]*)"`, "m"));
-  return match ? match[1] : null;
+  const quoted = content.match(new RegExp(`^${key}\\s*=\\s*"([^"]*)"`, "m"));
+  if (quoted) return quoted[1];
+  const bare = content.match(new RegExp(`^${key}\\s*=\\s*([^\\s#]+)`, "m"));
+  return bare ? bare[1] : null;
 }
+var BARE_KEYS = /* @__PURE__ */ new Set(["enable_hindsight"]);
 function setTfVar(tfvarsPath, key, value) {
   if (!existsSync3(tfvarsPath)) {
     throw new Error(`terraform.tfvars not found at ${tfvarsPath}`);
   }
   let content = readFileSync2(tfvarsPath, "utf-8");
-  const regex = new RegExp(`^(${key}\\s*=\\s*)"[^"]*"`, "m");
-  if (regex.test(content)) {
-    content = content.replace(regex, `$1"${value}"`);
+  const bare = BARE_KEYS.has(key);
+  const newLine = bare ? `${key} = ${value}` : `${key} = "${value}"`;
+  const existingRegex = new RegExp(`^${key}\\s*=\\s*(?:"[^"]*"|[^\\s#]+)`, "m");
+  if (existingRegex.test(content)) {
+    content = content.replace(existingRegex, newLine);
   } else {
     content += `
-${key} = "${value}"
+${newLine}
 `;
   }
   writeFileSync2(tfvarsPath, content);
@@ -581,7 +585,7 @@ function registerConfigCommand(program2) {
       console.log(`  ${chalk3.bold("Region:")}          ${env.region}`);
       console.log(`  ${chalk3.bold("Account:")}         ${env.accountId}`);
       console.log(`  ${chalk3.bold("Database:")}        ${env.databaseEngine}`);
-      console.log(`  ${chalk3.bold("Memory:")}          ${env.memoryEngine}`);
+      console.log(`  ${chalk3.bold("Memory:")}          managed (always on)${env.enableHindsight ? " + hindsight" : ""}`);
       console.log(`  ${chalk3.bold("Terraform dir:")}   ${env.terraformDir}`);
       console.log(`  ${chalk3.bold("Created:")}         ${env.createdAt}`);
       console.log(`  ${chalk3.bold("Updated:")}         ${env.updatedAt}`);
@@ -622,7 +626,7 @@ function registerConfigCommand(program2) {
     console.log(chalk3.bold("  Environments"));
     console.log(chalk3.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
     for (const env of envs) {
-      const memBadge = env.memoryEngine === "hindsight" ? chalk3.magenta("hindsight") : chalk3.dim("managed");
+      const memBadge = env.enableHindsight ? chalk3.magenta("managed+hindsight") : chalk3.dim("managed");
       const dbBadge = env.databaseEngine === "rds-postgres" ? chalk3.yellow("rds") : chalk3.dim("aurora");
       console.log(
         `  ${chalk3.bold.cyan(env.stage.padEnd(16))}${env.region.padEnd(14)}${env.accountId.padEnd(16)}${dbBadge.padEnd(20)}${memBadge}`
@@ -634,7 +638,7 @@ function registerConfigCommand(program2) {
     console.log(`  Show details: ${chalk3.cyan("thinkwork config list -s <stage>")}`);
     console.log("");
   });
-  config.command("get <key>").description("Get a configuration value (e.g. memory-engine)").requiredOption("-s, --stage <name>", "Deployment stage").action((key, opts) => {
+  config.command("get <key>").description("Get a configuration value (e.g. enable-hindsight)").requiredOption("-s, --stage <name>", "Deployment stage").action((key, opts) => {
     const stageCheck = validateStage(opts.stage);
     if (!stageCheck.valid) {
       printError(stageCheck.error);
@@ -655,17 +659,27 @@ function registerConfigCommand(program2) {
       printError(stageCheck.error);
       process.exit(1);
     }
-    const tfKey = key.replace(/-/g, "_");
-    if (tfKey === "memory_engine" && !VALID_MEMORY_ENGINES.includes(value)) {
-      printError(`Invalid memory engine "${value}". Must be: ${VALID_MEMORY_ENGINES.join(", ")}`);
+    let tfKey = key.replace(/-/g, "_");
+    let tfValue = value;
+    if (tfKey === "memory_engine") {
+      if (value !== "managed" && value !== "hindsight") {
+        printError(`Invalid memory engine "${value}". Must be 'managed' or 'hindsight'. Note: memory_engine is deprecated \u2014 use enable_hindsight instead.`);
+        process.exit(1);
+      }
+      printWarning("memory_engine is deprecated \u2014 translating to enable_hindsight. Managed memory is always on.");
+      tfKey = "enable_hindsight";
+      tfValue = value === "hindsight" ? "true" : "false";
+    }
+    if (tfKey === "enable_hindsight" && tfValue !== "true" && tfValue !== "false") {
+      printError(`Invalid enable_hindsight value "${tfValue}". Must be 'true' or 'false'.`);
       process.exit(1);
     }
     const identity = getAwsIdentity();
     printHeader("config set", opts.stage, identity);
     const tfvarsPath = resolveTfvarsPath(opts.stage);
     const oldValue = readTfVar(tfvarsPath, tfKey);
-    setTfVar(tfvarsPath, tfKey, value);
-    console.log(`  ${key}: ${oldValue ?? "(unset)"} \u2192 ${value}`);
+    setTfVar(tfvarsPath, tfKey, tfValue);
+    console.log(`  ${tfKey}: ${oldValue ?? "(unset)"} \u2192 ${tfValue}`);
     if (opts.apply) {
       const tfDir = resolveTerraformDir(opts.stage);
       if (!tfDir) {
@@ -685,9 +699,9 @@ function registerConfigCommand(program2) {
         printError(`Deploy failed (exit ${code})`);
         process.exit(code);
       }
-      printSuccess(`Configuration applied: ${key} = ${value}`);
+      printSuccess(`Configuration applied: ${tfKey} = ${tfValue}`);
     } else {
-      printSuccess(`Configuration updated: ${key} = ${value}`);
+      printSuccess(`Configuration updated: ${tfKey} = ${tfValue}`);
       printWarning("Run with --apply to deploy the change, or run 'thinkwork deploy' separately.");
     }
   });
@@ -738,8 +752,8 @@ function registerBootstrapCommand(program2) {
       bucket = await getTerraformOutput(cwd, "bucket_name");
       dbEndpoint = await getTerraformOutput(cwd, "db_cluster_endpoint");
       const secretArn = await getTerraformOutput(cwd, "db_secret_arn");
-      const { execSync: execSync9 } = await import("child_process");
-      const secretJson = execSync9(
+      const { execSync: execSync10 } = await import("child_process");
+      const secretJson = execSync10(
         `aws secretsmanager get-secret-value --secret-id "${secretArn}" --query SecretString --output text`,
         { encoding: "utf-8" }
       ).trim();
@@ -887,10 +901,10 @@ async function ensurePrerequisites() {
 }
 
 // src/commands/login.ts
-function ask(prompt) {
+function ask(prompt2) {
   const rl = createInterface2({ input: process.stdin, output: process.stdout });
   return new Promise((resolve3) => {
-    rl.question(prompt, (answer) => {
+    rl.question(prompt2, (answer) => {
       rl.close();
       resolve3(answer.trim());
     });
@@ -980,19 +994,19 @@ import { fileURLToPath } from "url";
 import { createInterface as createInterface3 } from "readline";
 import chalk5 from "chalk";
 var __dirname = dirname(fileURLToPath(import.meta.url));
-function ask2(prompt, defaultVal = "") {
+function ask2(prompt2, defaultVal = "") {
   const rl = createInterface3({ input: process.stdin, output: process.stdout });
   const suffix = defaultVal ? chalk5.dim(` [${defaultVal}]`) : "";
   return new Promise((resolve3) => {
-    rl.question(`  ${prompt}${suffix}: `, (answer) => {
+    rl.question(`  ${prompt2}${suffix}: `, (answer) => {
       rl.close();
       resolve3(answer.trim() || defaultVal);
     });
   });
 }
-function choose(prompt, options, defaultVal) {
+function choose(prompt2, options, defaultVal) {
   const optStr = options.map((o) => o === defaultVal ? chalk5.bold(o) : chalk5.dim(o)).join(" / ");
-  return ask2(`${prompt} (${optStr})`, defaultVal);
+  return ask2(`${prompt2} (${optStr})`, defaultVal);
 }
 function generateSecret(length = 32) {
   const chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
@@ -1003,9 +1017,9 @@ function generateSecret(length = 32) {
   return result;
 }
 function findBundledTerraform() {
-  const bundled = resolve2(__dirname, "..", "terraform");
+  const bundled = resolve2(__dirname, "terraform");
   if (existsSync5(join3(bundled, "modules"))) return bundled;
-  const repoTf = resolve2(__dirname, "..", "..", "..", "..", "terraform");
+  const repoTf = resolve2(__dirname, "..", "..", "..", "terraform");
   if (existsSync5(join3(repoTf, "modules"))) return repoTf;
   throw new Error(
     "Terraform modules not found. The CLI package may be incomplete.\nTry reinstalling: npm install -g thinkwork-cli@latest"
@@ -1027,7 +1041,9 @@ function buildTfvars(config) {
     `db_password     = "${config.db_password}"`,
     ``,
     `# \u2500\u2500 Memory \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500`,
-    `memory_engine = "${config.memory_engine}"`,
+    `# AgentCore managed memory is always on (automatic retention).`,
+    `# Hindsight is an optional add-on for semantic + graph retrieval.`,
+    `enable_hindsight = ${config.enable_hindsight === "true"}`,
     ``,
     `# \u2500\u2500 Auth \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500`,
     `api_auth_secret = "${config.api_auth_secret}"`
@@ -1094,7 +1110,7 @@ function registerInitCommand(program2) {
     if (opts.defaults) {
       config.region = identity.region !== "unknown" ? identity.region : "us-east-1";
       config.database_engine = "aurora-serverless";
-      config.memory_engine = "managed";
+      config.enable_hindsight = "false";
       config.google_oauth_client_id = "";
       config.google_oauth_client_secret = "";
       config.admin_url = "http://localhost:5174";
@@ -1108,9 +1124,11 @@ function registerInitCommand(program2) {
       config.database_engine = await choose("Database engine", ["aurora-serverless", "rds-postgres"], "aurora-serverless");
       console.log("");
       console.log(chalk5.dim("  \u2500\u2500 Memory \u2500\u2500"));
-      console.log(chalk5.dim("  managed    = Built-in AgentCore memory (remember/recall/forget)"));
-      console.log(chalk5.dim("  hindsight  = ECS Fargate service with semantic + graph retrieval"));
-      config.memory_engine = await choose("Memory engine", ["managed", "hindsight"], "managed");
+      console.log(chalk5.dim("  AgentCore managed memory is always on (automatic retention)."));
+      console.log(chalk5.dim("  Hindsight is an optional add-on: ECS Fargate service for"));
+      console.log(chalk5.dim("  semantic + entity-graph retrieval (~$75/mo)."));
+      const hindsightAnswer = await ask2("Enable Hindsight long-term memory add-on? (y/N)", "N");
+      config.enable_hindsight = hindsightAnswer.toLowerCase() === "y" ? "true" : "false";
       console.log("");
       console.log(chalk5.dim("  \u2500\u2500 Auth \u2500\u2500"));
       const useGoogle = await ask2("Enable Google OAuth login? (y/N)", "N");
@@ -1184,21 +1202,86 @@ provider "aws" {
   region = var.region
 }
 
-variable "stage" { type = string }
-variable "region" { type = string; default = "us-east-1" }
-variable "account_id" { type = string }
-variable "db_password" { type = string; sensitive = true }
-variable "database_engine" { type = string; default = "aurora-serverless" }
-variable "memory_engine" { type = string; default = "managed" }
-variable "google_oauth_client_id" { type = string; default = "" }
-variable "google_oauth_client_secret" { type = string; sensitive = true; default = "" }
-variable "pre_signup_lambda_zip" { type = string; default = "" }
-variable "lambda_zips_dir" { type = string; default = "" }
-variable "api_auth_secret" { type = string; sensitive = true; default = "" }
-variable "admin_callback_urls" { type = list(string); default = ["http://localhost:5174", "http://localhost:5174/auth/callback"] }
-variable "admin_logout_urls" { type = list(string); default = ["http://localhost:5174"] }
-variable "mobile_callback_urls" { type = list(string); default = ["exp://localhost:8081", "thinkwork://", "thinkwork://auth/callback"] }
-variable "mobile_logout_urls" { type = list(string); default = ["exp://localhost:8081", "thinkwork://"] }
+variable "stage" {
+  type = string
+}
+
+variable "region" {
+  type    = string
+  default = "us-east-1"
+}
+
+variable "account_id" {
+  type = string
+}
+
+variable "db_password" {
+  type      = string
+  sensitive = true
+}
+
+variable "database_engine" {
+  type    = string
+  default = "aurora-serverless"
+}
+
+variable "enable_hindsight" {
+  type    = bool
+  default = false
+}
+
+variable "agentcore_memory_id" {
+  type        = string
+  default     = ""
+  description = "Optional pre-existing Bedrock AgentCore Memory resource ID. Leave empty to auto-provision."
+}
+
+variable "google_oauth_client_id" {
+  type    = string
+  default = ""
+}
+
+variable "google_oauth_client_secret" {
+  type      = string
+  sensitive = true
+  default   = ""
+}
+
+variable "pre_signup_lambda_zip" {
+  type    = string
+  default = ""
+}
+
+variable "lambda_zips_dir" {
+  type    = string
+  default = ""
+}
+
+variable "api_auth_secret" {
+  type      = string
+  sensitive = true
+  default   = ""
+}
+
+variable "admin_callback_urls" {
+  type    = list(string)
+  default = ["http://localhost:5174", "http://localhost:5174/auth/callback"]
+}
+
+variable "admin_logout_urls" {
+  type    = list(string)
+  default = ["http://localhost:5174"]
+}
+
+variable "mobile_callback_urls" {
+  type    = list(string)
+  default = ["exp://localhost:8081", "thinkwork://", "thinkwork://auth/callback"]
+}
+
+variable "mobile_logout_urls" {
+  type    = list(string)
+  default = ["exp://localhost:8081", "thinkwork://"]
+}
 
 module "thinkwork" {
   source = "./modules/thinkwork"
@@ -1209,7 +1292,8 @@ module "thinkwork" {
 
   db_password                = var.db_password
   database_engine            = var.database_engine
-  memory_engine              = var.memory_engine
+  enable_hindsight           = var.enable_hindsight
+  agentcore_memory_id        = var.agentcore_memory_id
   google_oauth_client_id     = var.google_oauth_client_id
   google_oauth_client_secret = var.google_oauth_client_secret
   pre_signup_lambda_zip      = var.pre_signup_lambda_zip
@@ -1221,16 +1305,50 @@ module "thinkwork" {
   mobile_logout_urls         = var.mobile_logout_urls
 }
 
-output "api_endpoint"       { value = module.thinkwork.api_endpoint }
-output "user_pool_id"       { value = module.thinkwork.user_pool_id }
-output "admin_client_id"    { value = module.thinkwork.admin_client_id }
-output "mobile_client_id"   { value = module.thinkwork.mobile_client_id }
-output "bucket_name"        { value = module.thinkwork.bucket_name }
-output "db_cluster_endpoint" { value = module.thinkwork.db_cluster_endpoint }
-output "db_secret_arn"      { value = module.thinkwork.db_secret_arn; sensitive = true }
-output "ecr_repository_url" { value = module.thinkwork.ecr_repository_url }
-output "memory_engine"      { value = module.thinkwork.memory_engine }
-output "hindsight_endpoint"  { value = module.thinkwork.hindsight_endpoint }
+output "api_endpoint" {
+  value = module.thinkwork.api_endpoint
+}
+
+output "user_pool_id" {
+  value = module.thinkwork.user_pool_id
+}
+
+output "admin_client_id" {
+  value = module.thinkwork.admin_client_id
+}
+
+output "mobile_client_id" {
+  value = module.thinkwork.mobile_client_id
+}
+
+output "bucket_name" {
+  value = module.thinkwork.bucket_name
+}
+
+output "db_cluster_endpoint" {
+  value = module.thinkwork.db_cluster_endpoint
+}
+
+output "db_secret_arn" {
+  value     = module.thinkwork.db_secret_arn
+  sensitive = true
+}
+
+output "ecr_repository_url" {
+  value = module.thinkwork.ecr_repository_url
+}
+
+output "hindsight_enabled" {
+  value = module.thinkwork.hindsight_enabled
+}
+
+output "hindsight_endpoint" {
+  value = module.thinkwork.hindsight_endpoint
+}
+
+output "agentcore_memory_id" {
+  value = module.thinkwork.agentcore_memory_id
+}
 `);
     }
     console.log(`  Wrote ${chalk5.cyan(tfDir + "/")}`);
@@ -1240,7 +1358,7 @@ output "hindsight_endpoint"  { value = module.thinkwork.hindsight_endpoint }
     console.log(`  ${chalk5.bold("Region:")}          ${config.region}`);
     console.log(`  ${chalk5.bold("Account:")}         ${config.account_id}`);
     console.log(`  ${chalk5.bold("Database:")}        ${config.database_engine}`);
-    console.log(`  ${chalk5.bold("Memory:")}          ${config.memory_engine}`);
+    console.log(`  ${chalk5.bold("Memory:")}          managed (always on)${config.enable_hindsight === "true" ? " + hindsight" : ""}`);
     console.log(`  ${chalk5.bold("Google OAuth:")}    ${config.google_oauth_client_id ? "enabled" : "disabled"}`);
     console.log(`  ${chalk5.bold("Directory:")}       ${tfDir}`);
     console.log(chalk5.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
@@ -1258,7 +1376,7 @@ output "hindsight_endpoint"  { value = module.thinkwork.hindsight_endpoint }
       accountId: config.account_id,
       terraformDir: tfDir,
       databaseEngine: config.database_engine,
-      memoryEngine: config.memory_engine,
+      enableHindsight: config.enable_hindsight === "true",
       createdAt: now,
       updatedAt: now
     });
@@ -1332,7 +1450,7 @@ function discoverAwsStages(region) {
       `ecs describe-services --cluster thinkwork-${stage}-cluster --services thinkwork-${stage}-hindsight --region ${region} --query "services[0].runningCount" --output text 2>/dev/null`
     );
     if (ecsRaw && ecsRaw !== "None" && ecsRaw !== "0") {
-      info.memoryEngine = "hindsight";
+      info.hindsightEnabled = true;
       const albRaw = runAws(
         `elbv2 describe-load-balancers --region ${region} --query "LoadBalancers[?contains(LoadBalancerName, 'tw-${stage}-hindsight')].DNSName|[0]" --output text`
       );
@@ -1346,7 +1464,7 @@ function discoverAwsStages(region) {
         }
       }
     } else {
-      info.memoryEngine = "managed";
+      info.hindsightEnabled = false;
     }
     const dbRaw = runAws(
       `rds describe-db-clusters --region ${region} --query "DBClusters[?starts_with(DBClusterIdentifier, 'thinkwork-${stage}')].Endpoint|[0]" --output text`
@@ -1380,8 +1498,9 @@ function printStageDetail(info) {
   console.log(`  ${chalk6.bold("Account:")}         ${info.accountId}`);
   console.log(`  ${chalk6.bold("Lambda fns:")}      ${info.lambdaCount || "\u2014"}`);
   console.log(`  ${chalk6.bold("AgentCore:")}       ${info.agentcoreStatus || "unknown"}`);
-  console.log(`  ${chalk6.bold("Memory:")}          ${info.memoryEngine || "unknown"}`);
-  if (info.hindsightHealth) console.log(`  ${chalk6.bold("Hindsight:")}       ${info.hindsightHealth}`);
+  console.log(`  ${chalk6.bold("Memory:")}          managed (always on)`);
+  const hindsightLabel = info.hindsightEnabled === void 0 ? "unknown" : info.hindsightEnabled ? info.hindsightHealth || "running" : "disabled";
+  console.log(`  ${chalk6.bold("Hindsight:")}       ${hindsightLabel}`);
   if (info.bucketName) console.log(`  ${chalk6.bold("S3 bucket:")}       ${info.bucketName}`);
   if (info.dbEndpoint) console.log(`  ${chalk6.bold("Database:")}        ${info.dbEndpoint}`);
   if (info.ecrUrl) console.log(`  ${chalk6.bold("ECR:")}             ${info.ecrUrl}`);
@@ -1671,12 +1790,246 @@ function registerMcpCommand(program2) {
   });
 }
 
-// src/commands/upgrade.ts
+// src/commands/tools.ts
+import { readFileSync as readFileSync4, existsSync as existsSync7 } from "fs";
 import { execSync as execSync8 } from "child_process";
+import { createInterface as createInterface4 } from "readline";
 import chalk8 from "chalk";
+function readTfVar3(tfvarsPath, key) {
+  if (!existsSync7(tfvarsPath)) return null;
+  const content = readFileSync4(tfvarsPath, "utf-8");
+  const match = content.match(new RegExp(`^${key}\\s*=\\s*"([^"]*)"`, "m"));
+  return match ? match[1] : null;
+}
+function resolveTfvarsPath3(stage) {
+  const tfDir = resolveTerraformDir(stage);
+  if (tfDir) {
+    const direct = `${tfDir}/terraform.tfvars`;
+    if (existsSync7(direct)) return direct;
+  }
+  const terraformDir = process.env.THINKWORK_TERRAFORM_DIR || process.cwd();
+  const cwd = resolveTierDir(terraformDir, stage, "app");
+  return `${cwd}/terraform.tfvars`;
+}
+function getApiEndpoint2(stage, region) {
+  try {
+    const raw = execSync8(
+      `aws apigatewayv2 get-apis --region ${region} --query "Items[?Name=='thinkwork-${stage}-api'].ApiEndpoint|[0]" --output text`,
+      { encoding: "utf-8", timeout: 15e3, stdio: ["pipe", "pipe", "pipe"] }
+    ).trim();
+    return raw && raw !== "None" ? raw : null;
+  } catch {
+    return null;
+  }
+}
+async function apiFetch2(apiUrl, authSecret, path2, options = {}, extraHeaders = {}) {
+  const res = await fetch(`${apiUrl}${path2}`, {
+    ...options,
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${authSecret}`,
+      ...extraHeaders,
+      ...options.headers
+    }
+  });
+  if (!res.ok) {
+    const body = await res.json().catch(() => ({}));
+    throw new Error(body.error || `HTTP ${res.status}`);
+  }
+  return res.json();
+}
+function resolveApiConfig2(stage) {
+  const tfvarsPath = resolveTfvarsPath3(stage);
+  const authSecret = readTfVar3(tfvarsPath, "api_auth_secret");
+  if (!authSecret) {
+    printError(`Cannot read api_auth_secret from ${tfvarsPath}`);
+    return null;
+  }
+  const region = readTfVar3(tfvarsPath, "region") || "us-east-1";
+  const apiUrl = getApiEndpoint2(stage, region);
+  if (!apiUrl) {
+    printError(`Cannot discover API endpoint for stage "${stage}". Is the stack deployed?`);
+    return null;
+  }
+  return { apiUrl, authSecret };
+}
+function prompt(question) {
+  const rl = createInterface4({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve3) => {
+    rl.question(question, (answer) => {
+      rl.close();
+      resolve3(answer.trim());
+    });
+  });
+}
+var TOOL_PROVIDERS = {
+  "web-search": ["exa", "serpapi"]
+};
+function registerToolsCommand(program2) {
+  const tools = program2.command("tools").description("Configure built-in agent tools (web_search, \u2026) for your tenant");
+  tools.command("list").description("List configured built-in tools").requiredOption("-s, --stage <name>", "Deployment stage").requiredOption("--tenant <slug>", "Tenant slug").action(async (opts) => {
+    const check = validateStage(opts.stage);
+    if (!check.valid) {
+      printError(check.error);
+      process.exit(1);
+    }
+    const api = resolveApiConfig2(opts.stage);
+    if (!api) process.exit(1);
+    printHeader("tools list", opts.stage);
+    try {
+      const { tools: rows } = await apiFetch2(
+        api.apiUrl,
+        api.authSecret,
+        "/api/skills/builtin-tools",
+        {},
+        { "x-tenant-slug": opts.tenant }
+      );
+      if (!rows || rows.length === 0) {
+        console.log(chalk8.dim("  No built-in tools configured."));
+        console.log(chalk8.dim("  Try: thinkwork tools web-search set --tenant <slug> -s <stage>"));
+        return;
+      }
+      console.log("");
+      for (const r of rows) {
+        const status = r.enabled ? chalk8.green("enabled") : chalk8.dim("disabled");
+        const key = r.hasSecret ? chalk8.green("yes") : chalk8.red("no");
+        const provider = r.provider ?? chalk8.dim("\u2014");
+        console.log(`  ${chalk8.bold(r.toolSlug)}  ${status}`);
+        console.log(`    Provider:  ${provider}`);
+        console.log(`    Has key:   ${key}`);
+        if (r.lastTestedAt) {
+          console.log(`    Tested:    ${new Date(r.lastTestedAt).toLocaleString()}`);
+        }
+        console.log("");
+      }
+    } catch (err) {
+      printError(err.message);
+      process.exit(1);
+    }
+  });
+  const webSearch = tools.command("web-search").description("Configure the web_search built-in tool");
+  webSearch.command("set").description("Set or update web_search provider + API key (enables the tool)").requiredOption("-s, --stage <name>", "Deployment stage").requiredOption("--tenant <slug>", "Tenant slug").option("--provider <name>", `Provider (${TOOL_PROVIDERS["web-search"].join("|")})`).option("--key <key>", "API key").action(async (opts) => {
+    const check = validateStage(opts.stage);
+    if (!check.valid) {
+      printError(check.error);
+      process.exit(1);
+    }
+    const api = resolveApiConfig2(opts.stage);
+    if (!api) process.exit(1);
+    let provider = opts.provider;
+    if (!provider) {
+      provider = (await prompt(`Provider [${TOOL_PROVIDERS["web-search"].join("/")}]: `)).toLowerCase();
+    }
+    if (!TOOL_PROVIDERS["web-search"].includes(provider)) {
+      printError(`provider must be one of: ${TOOL_PROVIDERS["web-search"].join(", ")}`);
+      process.exit(1);
+    }
+    let apiKey = opts.key;
+    if (!apiKey) {
+      apiKey = await prompt(`${provider} API key: `);
+    }
+    if (!apiKey) {
+      printError("API key is required");
+      process.exit(1);
+    }
+    try {
+      await apiFetch2(
+        api.apiUrl,
+        api.authSecret,
+        "/api/skills/builtin-tools/web-search",
+        {
+          method: "PUT",
+          body: JSON.stringify({ provider, apiKey, enabled: true })
+        },
+        { "x-tenant-slug": opts.tenant }
+      );
+      printSuccess(`web_search configured with provider=${provider}, enabled=true`);
+      printWarning("Run `thinkwork tools web-search test` to verify connectivity.");
+    } catch (err) {
+      printError(err.message);
+      process.exit(1);
+    }
+  });
+  webSearch.command("test").description("Test the stored web_search provider + key against the provider API").requiredOption("-s, --stage <name>", "Deployment stage").requiredOption("--tenant <slug>", "Tenant slug").action(async (opts) => {
+    const check = validateStage(opts.stage);
+    if (!check.valid) {
+      printError(check.error);
+      process.exit(1);
+    }
+    const api = resolveApiConfig2(opts.stage);
+    if (!api) process.exit(1);
+    printHeader("tools web-search test", opts.stage);
+    try {
+      const result = await apiFetch2(
+        api.apiUrl,
+        api.authSecret,
+        "/api/skills/builtin-tools/web-search/test",
+        { method: "POST", body: "{}" },
+        { "x-tenant-slug": opts.tenant }
+      );
+      if (result.ok) {
+        printSuccess(`${result.provider}: ${result.resultCount} result(s) returned.`);
+      } else {
+        printError(`Test failed: ${result.error}`);
+        process.exit(1);
+      }
+    } catch (err) {
+      printError(err.message);
+      process.exit(1);
+    }
+  });
+  webSearch.command("disable").description("Disable web_search without deleting the stored key").requiredOption("-s, --stage <name>", "Deployment stage").requiredOption("--tenant <slug>", "Tenant slug").action(async (opts) => {
+    const check = validateStage(opts.stage);
+    if (!check.valid) {
+      printError(check.error);
+      process.exit(1);
+    }
+    const api = resolveApiConfig2(opts.stage);
+    if (!api) process.exit(1);
+    try {
+      await apiFetch2(
+        api.apiUrl,
+        api.authSecret,
+        "/api/skills/builtin-tools/web-search",
+        { method: "PUT", body: JSON.stringify({ enabled: false }) },
+        { "x-tenant-slug": opts.tenant }
+      );
+      printSuccess("web_search disabled.");
+    } catch (err) {
+      printError(err.message);
+      process.exit(1);
+    }
+  });
+  webSearch.command("clear").description("Remove web_search config entirely (deletes stored key)").requiredOption("-s, --stage <name>", "Deployment stage").requiredOption("--tenant <slug>", "Tenant slug").action(async (opts) => {
+    const check = validateStage(opts.stage);
+    if (!check.valid) {
+      printError(check.error);
+      process.exit(1);
+    }
+    const api = resolveApiConfig2(opts.stage);
+    if (!api) process.exit(1);
+    try {
+      await apiFetch2(
+        api.apiUrl,
+        api.authSecret,
+        "/api/skills/builtin-tools/web-search",
+        { method: "DELETE" },
+        { "x-tenant-slug": opts.tenant }
+      );
+      printSuccess("web_search configuration cleared.");
+    } catch (err) {
+      printError(err.message);
+      process.exit(1);
+    }
+  });
+}
+
+// src/commands/update.ts
+import { execSync as execSync9 } from "child_process";
+import chalk9 from "chalk";
 function getLatestVersion() {
   try {
-    return execSync8("npm view thinkwork-cli version", {
+    return execSync9("npm view thinkwork-cli version", {
       encoding: "utf-8",
       timeout: 1e4,
       stdio: ["pipe", "pipe", "pipe"]
@@ -1687,7 +2040,7 @@ function getLatestVersion() {
 }
 function detectInstallMethod() {
   try {
-    const which = execSync8("which thinkwork", {
+    const which = execSync9("which thinkwork", {
       encoding: "utf-8",
       timeout: 5e3,
       stdio: ["pipe", "pipe", "pipe"]
@@ -1708,31 +2061,31 @@ function compareVersions(a, b) {
   }
   return 0;
 }
-function registerUpgradeCommand(program2) {
-  program2.command("upgrade").description("Check for and install CLI updates").option("--check", "Only check for updates, don't install").action(async (opts) => {
-    printHeader("upgrade", "", null);
-    console.log(`  Current version: ${chalk8.bold(VERSION)}`);
+function registerUpdateCommand(program2) {
+  program2.command("update").description("Check for and install CLI updates").option("--check", "Only check for updates, don't install").action(async (opts) => {
+    printHeader("update", "", null);
+    console.log(`  Current version: ${chalk9.bold(VERSION)}`);
     const latest = getLatestVersion();
     if (!latest) {
-      console.log(chalk8.yellow("  Could not check npm registry for updates."));
+      console.log(chalk9.yellow("  Could not check npm registry for updates."));
       return;
     }
-    console.log(`  Latest version:  ${chalk8.bold(latest)}`);
+    console.log(`  Latest version:  ${chalk9.bold(latest)}`);
     console.log("");
     const cmp = compareVersions(VERSION, latest);
     if (cmp >= 0) {
-      console.log(chalk8.green("  \u2713 You're on the latest version."));
+      console.log(chalk9.green("  \u2713 You're on the latest version."));
       console.log("");
       return;
     }
-    console.log(chalk8.cyan(`  Update available: ${VERSION} \u2192 ${latest}`));
+    console.log(chalk9.cyan(`  Update available: ${VERSION} \u2192 ${latest}`));
     console.log("");
     if (opts.check) {
       const method2 = detectInstallMethod();
       if (method2 === "homebrew") {
-        console.log(`  Run: ${chalk8.cyan("brew upgrade thinkwork-ai/tap/thinkwork")}`);
+        console.log(`  Run: ${chalk9.cyan("brew upgrade thinkwork-ai/tap/thinkwork")}`);
       } else {
-        console.log(`  Run: ${chalk8.cyan(`npm install -g thinkwork-cli@${latest}`)}`);
+        console.log(`  Run: ${chalk9.cyan(`npm install -g thinkwork-cli@${latest}`)}`);
       }
       console.log("");
       return;
@@ -1740,16 +2093,16 @@ function registerUpgradeCommand(program2) {
     const method = detectInstallMethod();
     const cmd = method === "homebrew" ? "brew upgrade thinkwork-ai/tap/thinkwork" : `npm install -g thinkwork-cli@${latest}`;
     console.log(`  Installing via ${method}...`);
-    console.log(chalk8.dim(`  $ ${cmd}`));
+    console.log(chalk9.dim(`  $ ${cmd}`));
     console.log("");
     try {
-      execSync8(cmd, { stdio: "inherit", timeout: 12e4 });
+      execSync9(cmd, { stdio: "inherit", timeout: 12e4 });
       console.log("");
-      console.log(chalk8.green(`  \u2713 Upgraded to thinkwork-cli@${latest}`));
+      console.log(chalk9.green(`  \u2713 Upgraded to thinkwork-cli@${latest}`));
     } catch {
       console.log("");
-      console.log(chalk8.red(`  Failed to upgrade. Try manually:`));
-      console.log(`    ${chalk8.cyan(cmd)}`);
+      console.log(chalk9.red(`  Failed to upgrade. Try manually:`));
+      console.log(`    ${chalk9.cyan(cmd)}`);
     }
     console.log("");
   });
@@ -1780,5 +2133,6 @@ registerStatusCommand(program);
 registerOutputsCommand(program);
 registerConfigCommand(program);
 registerMcpCommand(program);
-registerUpgradeCommand(program);
+registerToolsCommand(program);
+registerUpdateCommand(program);
 program.parse();