thinkwork-cli 0.5.2 → 0.5.4

package/dist/cli.js

@@ -752,8 +752,8 @@ function registerBootstrapCommand(program2) {
       bucket = await getTerraformOutput(cwd, "bucket_name");
       dbEndpoint = await getTerraformOutput(cwd, "db_cluster_endpoint");
       const secretArn = await getTerraformOutput(cwd, "db_secret_arn");
-      const { execSync: execSync9 } = await import("child_process");
-      const secretJson = execSync9(
+      const { execSync: execSync10 } = await import("child_process");
+      const secretJson = execSync10(
         `aws secretsmanager get-secret-value --secret-id "${secretArn}" --query SecretString --output text`,
         { encoding: "utf-8" }
       ).trim();
@@ -901,10 +901,10 @@ async function ensurePrerequisites() {
 }
 
 // src/commands/login.ts
-function ask(prompt) {
+function ask(prompt2) {
   const rl = createInterface2({ input: process.stdin, output: process.stdout });
   return new Promise((resolve3) => {
-    rl.question(prompt, (answer) => {
+    rl.question(prompt2, (answer) => {
       rl.close();
       resolve3(answer.trim());
     });
@@ -994,19 +994,19 @@ import { fileURLToPath } from "url";
 import { createInterface as createInterface3 } from "readline";
 import chalk5 from "chalk";
 var __dirname = dirname(fileURLToPath(import.meta.url));
-function ask2(prompt, defaultVal = "") {
+function ask2(prompt2, defaultVal = "") {
   const rl = createInterface3({ input: process.stdin, output: process.stdout });
   const suffix = defaultVal ? chalk5.dim(` [${defaultVal}]`) : "";
   return new Promise((resolve3) => {
-    rl.question(`  ${prompt}${suffix}: `, (answer) => {
+    rl.question(`  ${prompt2}${suffix}: `, (answer) => {
       rl.close();
       resolve3(answer.trim() || defaultVal);
     });
   });
 }
-function choose(prompt, options, defaultVal) {
+function choose(prompt2, options, defaultVal) {
   const optStr = options.map((o) => o === defaultVal ? chalk5.bold(o) : chalk5.dim(o)).join(" / ");
-  return ask2(`${prompt} (${optStr})`, defaultVal);
+  return ask2(`${prompt2} (${optStr})`, defaultVal);
 }
 function generateSecret(length = 32) {
   const chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
@@ -1017,9 +1017,9 @@ function generateSecret(length = 32) {
   return result;
 }
 function findBundledTerraform() {
-  const bundled = resolve2(__dirname, "..", "terraform");
+  const bundled = resolve2(__dirname, "terraform");
   if (existsSync5(join3(bundled, "modules"))) return bundled;
-  const repoTf = resolve2(__dirname, "..", "..", "..", "..", "terraform");
+  const repoTf = resolve2(__dirname, "..", "..", "..", "terraform");
   if (existsSync5(join3(repoTf, "modules"))) return repoTf;
   throw new Error(
     "Terraform modules not found. The CLI package may be incomplete.\nTry reinstalling: npm install -g thinkwork-cli@latest"
@@ -1202,21 +1202,86 @@ provider "aws" {
   region = var.region
 }
 
-variable "stage" { type = string }
-variable "region" { type = string; default = "us-east-1" }
-variable "account_id" { type = string }
-variable "db_password" { type = string; sensitive = true }
-variable "database_engine" { type = string; default = "aurora-serverless" }
-variable "enable_hindsight" { type = bool; default = false }
-variable "google_oauth_client_id" { type = string; default = "" }
-variable "google_oauth_client_secret" { type = string; sensitive = true; default = "" }
-variable "pre_signup_lambda_zip" { type = string; default = "" }
-variable "lambda_zips_dir" { type = string; default = "" }
-variable "api_auth_secret" { type = string; sensitive = true; default = "" }
-variable "admin_callback_urls" { type = list(string); default = ["http://localhost:5174", "http://localhost:5174/auth/callback"] }
-variable "admin_logout_urls" { type = list(string); default = ["http://localhost:5174"] }
-variable "mobile_callback_urls" { type = list(string); default = ["exp://localhost:8081", "thinkwork://", "thinkwork://auth/callback"] }
-variable "mobile_logout_urls" { type = list(string); default = ["exp://localhost:8081", "thinkwork://"] }
+variable "stage" {
+  type = string
+}
+
+variable "region" {
+  type    = string
+  default = "us-east-1"
+}
+
+variable "account_id" {
+  type = string
+}
+
+variable "db_password" {
+  type      = string
+  sensitive = true
+}
+
+variable "database_engine" {
+  type    = string
+  default = "aurora-serverless"
+}
+
+variable "enable_hindsight" {
+  type    = bool
+  default = false
+}
+
+variable "agentcore_memory_id" {
+  type        = string
+  default     = ""
+  description = "Optional pre-existing Bedrock AgentCore Memory resource ID. Leave empty to auto-provision."
+}
+
+variable "google_oauth_client_id" {
+  type    = string
+  default = ""
+}
+
+variable "google_oauth_client_secret" {
+  type      = string
+  sensitive = true
+  default   = ""
+}
+
+variable "pre_signup_lambda_zip" {
+  type    = string
+  default = ""
+}
+
+variable "lambda_zips_dir" {
+  type    = string
+  default = ""
+}
+
+variable "api_auth_secret" {
+  type      = string
+  sensitive = true
+  default   = ""
+}
+
+variable "admin_callback_urls" {
+  type    = list(string)
+  default = ["http://localhost:5174", "http://localhost:5174/auth/callback"]
+}
+
+variable "admin_logout_urls" {
+  type    = list(string)
+  default = ["http://localhost:5174"]
+}
+
+variable "mobile_callback_urls" {
+  type    = list(string)
+  default = ["exp://localhost:8081", "thinkwork://", "thinkwork://auth/callback"]
+}
+
+variable "mobile_logout_urls" {
+  type    = list(string)
+  default = ["exp://localhost:8081", "thinkwork://"]
+}
 
 module "thinkwork" {
   source = "./modules/thinkwork"
@@ -1228,6 +1293,7 @@ module "thinkwork" {
   db_password                = var.db_password
   database_engine            = var.database_engine
   enable_hindsight           = var.enable_hindsight
+  agentcore_memory_id        = var.agentcore_memory_id
   google_oauth_client_id     = var.google_oauth_client_id
   google_oauth_client_secret = var.google_oauth_client_secret
   pre_signup_lambda_zip      = var.pre_signup_lambda_zip
@@ -1239,17 +1305,50 @@ module "thinkwork" {
   mobile_logout_urls         = var.mobile_logout_urls
 }
 
-output "api_endpoint"       { value = module.thinkwork.api_endpoint }
-output "user_pool_id"       { value = module.thinkwork.user_pool_id }
-output "admin_client_id"    { value = module.thinkwork.admin_client_id }
-output "mobile_client_id"   { value = module.thinkwork.mobile_client_id }
-output "bucket_name"        { value = module.thinkwork.bucket_name }
-output "db_cluster_endpoint" { value = module.thinkwork.db_cluster_endpoint }
-output "db_secret_arn"      { value = module.thinkwork.db_secret_arn; sensitive = true }
-output "ecr_repository_url"  { value = module.thinkwork.ecr_repository_url }
-output "hindsight_enabled"   { value = module.thinkwork.hindsight_enabled }
-output "hindsight_endpoint"  { value = module.thinkwork.hindsight_endpoint }
-output "agentcore_memory_id" { value = module.thinkwork.agentcore_memory_id }
+output "api_endpoint" {
+  value = module.thinkwork.api_endpoint
+}
+
+output "user_pool_id" {
+  value = module.thinkwork.user_pool_id
+}
+
+output "admin_client_id" {
+  value = module.thinkwork.admin_client_id
+}
+
+output "mobile_client_id" {
+  value = module.thinkwork.mobile_client_id
+}
+
+output "bucket_name" {
+  value = module.thinkwork.bucket_name
+}
+
+output "db_cluster_endpoint" {
+  value = module.thinkwork.db_cluster_endpoint
+}
+
+output "db_secret_arn" {
+  value     = module.thinkwork.db_secret_arn
+  sensitive = true
+}
+
+output "ecr_repository_url" {
+  value = module.thinkwork.ecr_repository_url
+}
+
+output "hindsight_enabled" {
+  value = module.thinkwork.hindsight_enabled
+}
+
+output "hindsight_endpoint" {
+  value = module.thinkwork.hindsight_endpoint
+}
+
+output "agentcore_memory_id" {
+  value = module.thinkwork.agentcore_memory_id
+}
 `);
     }
     console.log(`  Wrote ${chalk5.cyan(tfDir + "/")}`);
@@ -1691,12 +1790,247 @@ function registerMcpCommand(program2) {
   });
 }
 
-// src/commands/update.ts
+// src/commands/tools.ts
+import { readFileSync as readFileSync4, existsSync as existsSync7 } from "fs";
 import { execSync as execSync8 } from "child_process";
+import { createInterface as createInterface4 } from "readline";
 import chalk8 from "chalk";
+function readTfVar3(tfvarsPath, key) {
+  if (!existsSync7(tfvarsPath)) return null;
+  const content = readFileSync4(tfvarsPath, "utf-8");
+  const match = content.match(new RegExp(`^${key}\\s*=\\s*"([^"]*)"`, "m"));
+  return match ? match[1] : null;
+}
+function resolveTfvarsPath3(stage) {
+  const tfDir = resolveTerraformDir(stage);
+  if (tfDir) {
+    const direct = `${tfDir}/terraform.tfvars`;
+    if (existsSync7(direct)) return direct;
+  }
+  const terraformDir = process.env.THINKWORK_TERRAFORM_DIR || process.cwd();
+  const cwd = resolveTierDir(terraformDir, stage, "app");
+  return `${cwd}/terraform.tfvars`;
+}
+function getApiEndpoint2(stage, region) {
+  try {
+    const raw = execSync8(
+      `aws apigatewayv2 get-apis --region ${region} --query "Items[?Name=='thinkwork-${stage}-api'].ApiEndpoint|[0]" --output text`,
+      { encoding: "utf-8", timeout: 15e3, stdio: ["pipe", "pipe", "pipe"] }
+    ).trim();
+    return raw && raw !== "None" ? raw : null;
+  } catch {
+    return null;
+  }
+}
+async function apiFetch2(apiUrl, authSecret, path2, options = {}, extraHeaders = {}) {
+  const res = await fetch(`${apiUrl}${path2}`, {
+    ...options,
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${authSecret}`,
+      ...extraHeaders,
+      ...options.headers
+    }
+  });
+  if (!res.ok) {
+    const body = await res.json().catch(() => ({}));
+    throw new Error(body.error || `HTTP ${res.status}`);
+  }
+  return res.json();
+}
+function resolveApiConfig2(stage) {
+  const tfvarsPath = resolveTfvarsPath3(stage);
+  const authSecret = readTfVar3(tfvarsPath, "api_auth_secret");
+  if (!authSecret) {
+    printError(`Cannot read api_auth_secret from ${tfvarsPath}`);
+    return null;
+  }
+  const region = readTfVar3(tfvarsPath, "region") || "us-east-1";
+  const apiUrl = getApiEndpoint2(stage, region);
+  if (!apiUrl) {
+    printError(`Cannot discover API endpoint for stage "${stage}". Is the stack deployed?`);
+    return null;
+  }
+  return { apiUrl, authSecret };
+}
+function prompt(question) {
+  const rl = createInterface4({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve3) => {
+    rl.question(question, (answer) => {
+      rl.close();
+      resolve3(answer.trim());
+    });
+  });
+}
+var TOOL_PROVIDERS = {
+  "web-search": ["exa", "serpapi"]
+};
+function registerToolsCommand(program2) {
+  const tools = program2.command("tools").description("Configure built-in agent tools (web_search, \u2026) for your tenant");
+  tools.command("list").description("List configured built-in tools").requiredOption("-s, --stage <name>", "Deployment stage").requiredOption("--tenant <slug>", "Tenant slug").action(async (opts) => {
+    const check = validateStage(opts.stage);
+    if (!check.valid) {
+      printError(check.error);
+      process.exit(1);
+    }
+    const api = resolveApiConfig2(opts.stage);
+    if (!api) process.exit(1);
+    printHeader("tools list", opts.stage);
+    try {
+      const { tools: rows } = await apiFetch2(
+        api.apiUrl,
+        api.authSecret,
+        "/api/skills/builtin-tools",
+        {},
+        { "x-tenant-slug": opts.tenant }
+      );
+      if (!rows || rows.length === 0) {
+        console.log(chalk8.dim("  No built-in tools configured."));
+        console.log(chalk8.dim("  Try: thinkwork tools web-search set --tenant <slug> -s <stage>"));
+        return;
+      }
+      console.log("");
+      for (const r of rows) {
+        const status = r.enabled ? chalk8.green("enabled") : chalk8.dim("disabled");
+        const key = r.hasSecret ? chalk8.green("yes") : chalk8.red("no");
+        const provider = r.provider ?? chalk8.dim("\u2014");
+        console.log(`  ${chalk8.bold(r.toolSlug)}  ${status}`);
+        console.log(`    Provider:  ${provider}`);
+        console.log(`    Has key:   ${key}`);
+        if (r.lastTestedAt) {
+          console.log(`    Tested:    ${new Date(r.lastTestedAt).toLocaleString()}`);
+        }
+        console.log("");
+      }
+    } catch (err) {
+      printError(err.message);
+      process.exit(1);
+    }
+  });
+  const webSearch = tools.command("web-search").description("Configure the web_search built-in tool");
+  webSearch.command("set").description("Set or update web_search provider + API key (enables the tool)").requiredOption("-s, --stage <name>", "Deployment stage").requiredOption("--tenant <slug>", "Tenant slug").option("--provider <name>", `Provider (${TOOL_PROVIDERS["web-search"].join("|")})`).option("--key <key>", "API key").action(async (opts) => {
+    const check = validateStage(opts.stage);
+    if (!check.valid) {
+      printError(check.error);
+      process.exit(1);
+    }
+    const api = resolveApiConfig2(opts.stage);
+    if (!api) process.exit(1);
+    let provider = opts.provider;
+    if (!provider) {
+      provider = (await prompt(`Provider [${TOOL_PROVIDERS["web-search"].join("/")}]: `)).toLowerCase();
+    }
+    if (!TOOL_PROVIDERS["web-search"].includes(provider)) {
+      printError(`provider must be one of: ${TOOL_PROVIDERS["web-search"].join(", ")}`);
+      process.exit(1);
+    }
+    let apiKey = opts.key;
+    if (!apiKey) {
+      apiKey = await prompt(`${provider} API key: `);
+    }
+    if (!apiKey) {
+      printError("API key is required");
+      process.exit(1);
+    }
+    try {
+      await apiFetch2(
+        api.apiUrl,
+        api.authSecret,
+        "/api/skills/builtin-tools/web-search",
+        {
+          method: "PUT",
+          body: JSON.stringify({ provider, apiKey, enabled: true })
+        },
+        { "x-tenant-slug": opts.tenant }
+      );
+      printSuccess(`web_search configured with provider=${provider}, enabled=true`);
+      printWarning("Run `thinkwork tools web-search test` to verify connectivity.");
+    } catch (err) {
+      printError(err.message);
+      process.exit(1);
+    }
+  });
+  webSearch.command("test").description("Test the stored web_search provider + key against the provider API").requiredOption("-s, --stage <name>", "Deployment stage").requiredOption("--tenant <slug>", "Tenant slug").action(async (opts) => {
+    const check = validateStage(opts.stage);
+    if (!check.valid) {
+      printError(check.error);
+      process.exit(1);
+    }
+    const api = resolveApiConfig2(opts.stage);
+    if (!api) process.exit(1);
+    printHeader("tools web-search test", opts.stage);
+    try {
+      const result = await apiFetch2(
+        api.apiUrl,
+        api.authSecret,
+        "/api/skills/builtin-tools/web-search/test",
+        { method: "POST", body: "{}" },
+        { "x-tenant-slug": opts.tenant }
+      );
+      if (result.ok) {
+        printSuccess(`${result.provider}: ${result.resultCount} result(s) returned.`);
+      } else {
+        printError(`Test failed: ${result.error}`);
+        process.exit(1);
+      }
+    } catch (err) {
+      printError(err.message);
+      process.exit(1);
+    }
+  });
+  webSearch.command("disable").description("Disable web_search without deleting the stored key").requiredOption("-s, --stage <name>", "Deployment stage").requiredOption("--tenant <slug>", "Tenant slug").action(async (opts) => {
+    const check = validateStage(opts.stage);
+    if (!check.valid) {
+      printError(check.error);
+      process.exit(1);
+    }
+    const api = resolveApiConfig2(opts.stage);
+    if (!api) process.exit(1);
+    try {
+      await apiFetch2(
+        api.apiUrl,
+        api.authSecret,
+        "/api/skills/builtin-tools/web-search",
+        { method: "PUT", body: JSON.stringify({ enabled: false }) },
+        { "x-tenant-slug": opts.tenant }
+      );
+      printSuccess("web_search disabled.");
+    } catch (err) {
+      printError(err.message);
+      process.exit(1);
+    }
+  });
+  webSearch.command("clear").description("Remove web_search config entirely (deletes stored key)").requiredOption("-s, --stage <name>", "Deployment stage").requiredOption("--tenant <slug>", "Tenant slug").action(async (opts) => {
+    const check = validateStage(opts.stage);
+    if (!check.valid) {
+      printError(check.error);
+      process.exit(1);
+    }
+    const api = resolveApiConfig2(opts.stage);
+    if (!api) process.exit(1);
+    try {
+      await apiFetch2(
+        api.apiUrl,
+        api.authSecret,
+        "/api/skills/builtin-tools/web-search",
+        { method: "DELETE" },
+        { "x-tenant-slug": opts.tenant }
+      );
+      printSuccess("web_search configuration cleared.");
+    } catch (err) {
+      printError(err.message);
+      process.exit(1);
+    }
+  });
+}
+
+// src/commands/update.ts
+import { execSync as execSync9 } from "child_process";
+import { realpathSync } from "fs";
+import chalk9 from "chalk";
 function getLatestVersion() {
   try {
-    return execSync8("npm view thinkwork-cli version", {
+    return execSync9("npm view thinkwork-cli version", {
       encoding: "utf-8",
       timeout: 1e4,
       stdio: ["pipe", "pipe", "pipe"]
@@ -1707,13 +2041,17 @@ function getLatestVersion() {
 }
 function detectInstallMethod() {
   try {
-    const which = execSync8("which thinkwork", {
+    const which = execSync9("which thinkwork", {
       encoding: "utf-8",
       timeout: 5e3,
       stdio: ["pipe", "pipe", "pipe"]
     }).trim();
-    if (which.includes("Cellar") || which.includes("homebrew")) return "homebrew";
-    if (which.includes("node_modules") || which.includes("npm") || which.includes("nvm") || which.includes("fnm")) return "npm";
+    let resolved = which;
+    try {
+      resolved = realpathSync(which);
+    } catch {
+    }
+    if (resolved.includes("/Cellar/")) return "homebrew";
     return "npm";
   } catch {
     return "npm";
@@ -1731,28 +2069,28 @@ function compareVersions(a, b) {
 function registerUpdateCommand(program2) {
   program2.command("update").description("Check for and install CLI updates").option("--check", "Only check for updates, don't install").action(async (opts) => {
     printHeader("update", "", null);
-    console.log(`  Current version: ${chalk8.bold(VERSION)}`);
+    console.log(`  Current version: ${chalk9.bold(VERSION)}`);
     const latest = getLatestVersion();
     if (!latest) {
-      console.log(chalk8.yellow("  Could not check npm registry for updates."));
+      console.log(chalk9.yellow("  Could not check npm registry for updates."));
       return;
     }
-    console.log(`  Latest version:  ${chalk8.bold(latest)}`);
+    console.log(`  Latest version:  ${chalk9.bold(latest)}`);
     console.log("");
     const cmp = compareVersions(VERSION, latest);
     if (cmp >= 0) {
-      console.log(chalk8.green("  \u2713 You're on the latest version."));
+      console.log(chalk9.green("  \u2713 You're on the latest version."));
       console.log("");
       return;
     }
-    console.log(chalk8.cyan(`  Update available: ${VERSION} \u2192 ${latest}`));
+    console.log(chalk9.cyan(`  Update available: ${VERSION} \u2192 ${latest}`));
     console.log("");
     if (opts.check) {
       const method2 = detectInstallMethod();
       if (method2 === "homebrew") {
-        console.log(`  Run: ${chalk8.cyan("brew upgrade thinkwork-ai/tap/thinkwork")}`);
+        console.log(`  Run: ${chalk9.cyan("brew upgrade thinkwork-ai/tap/thinkwork")}`);
       } else {
-        console.log(`  Run: ${chalk8.cyan(`npm install -g thinkwork-cli@${latest}`)}`);
+        console.log(`  Run: ${chalk9.cyan(`npm install -g thinkwork-cli@${latest}`)}`);
       }
       console.log("");
       return;
@@ -1760,16 +2098,16 @@ function registerUpdateCommand(program2) {
     const method = detectInstallMethod();
     const cmd = method === "homebrew" ? "brew upgrade thinkwork-ai/tap/thinkwork" : `npm install -g thinkwork-cli@${latest}`;
     console.log(`  Installing via ${method}...`);
-    console.log(chalk8.dim(`  $ ${cmd}`));
+    console.log(chalk9.dim(`  $ ${cmd}`));
     console.log("");
     try {
-      execSync8(cmd, { stdio: "inherit", timeout: 12e4 });
+      execSync9(cmd, { stdio: "inherit", timeout: 12e4 });
       console.log("");
-      console.log(chalk8.green(`  \u2713 Upgraded to thinkwork-cli@${latest}`));
+      console.log(chalk9.green(`  \u2713 Upgraded to thinkwork-cli@${latest}`));
     } catch {
       console.log("");
-      console.log(chalk8.red(`  Failed to upgrade. Try manually:`));
-      console.log(`    ${chalk8.cyan(cmd)}`);
+      console.log(chalk9.red(`  Failed to upgrade. Try manually:`));
+      console.log(`    ${chalk9.cyan(cmd)}`);
     }
     console.log("");
   });
@@ -1800,5 +2138,6 @@ registerStatusCommand(program);
 registerOutputsCommand(program);
 registerConfigCommand(program);
 registerMcpCommand(program);
+registerToolsCommand(program);
 registerUpdateCommand(program);
 program.parse();

package/dist/terraform/examples/greenfield/main.tf

@@ -72,10 +72,10 @@ variable "database_engine" {
   default     = "aurora-serverless"
 }
 
-variable "memory_engine" {
-  description = "Memory engine: 'managed' (AgentCore built-in, default) or 'hindsight' (ECS+ALB, opt-in)"
-  type        = string
-  default     = "managed"
+variable "enable_hindsight" {
+  description = "Optional Hindsight add-on alongside the always-on managed memory (ECS+ALB for semantic + graph retrieval)"
+  type        = bool
+  default     = false
 }
 
 variable "google_oauth_client_id" {
@@ -119,7 +119,7 @@ module "thinkwork" {
 
   db_password                = var.db_password
   database_engine            = var.database_engine
-  memory_engine              = var.memory_engine
+  enable_hindsight           = var.enable_hindsight
   google_oauth_client_id     = var.google_oauth_client_id
   google_oauth_client_secret = var.google_oauth_client_secret
   pre_signup_lambda_zip      = var.pre_signup_lambda_zip
@@ -199,16 +199,21 @@ output "database_name" {
   value       = module.thinkwork.database_name
 }
 
-output "memory_engine" {
-  description = "Active memory engine (managed or hindsight)"
-  value       = module.thinkwork.memory_engine
+output "hindsight_enabled" {
+  description = "Whether the Hindsight add-on is enabled"
+  value       = module.thinkwork.hindsight_enabled
 }
 
 output "hindsight_endpoint" {
-  description = "Hindsight API endpoint (null when memory_engine = managed)"
+  description = "Hindsight API endpoint (null when enable_hindsight = false)"
   value       = module.thinkwork.hindsight_endpoint
 }
 
+output "agentcore_memory_id" {
+  description = "AgentCore Memory resource ID used for automatic retention"
+  value       = module.thinkwork.agentcore_memory_id
+}
+
 output "admin_url" {
   description = "Admin app URL"
   value       = "https://${module.thinkwork.admin_distribution_domain}"

package/dist/terraform/examples/greenfield/terraform.tfvars.example

@@ -12,10 +12,13 @@ account_id = "123456789012"  # your AWS account ID
 #   "rds-postgres"      — Standard RDS PostgreSQL (dev/test, cheaper, deletion protection off)
 database_engine = "rds-postgres"
 
-# Memory engine:
-#   "managed"   — AgentCore built-in long-term memory (default, no extra infra)
-#   "hindsight" — Hindsight ECS+ALB service (opt-in, adds retain/recall/reflect tools)
-memory_engine = "managed"
+# Memory:
+#   AgentCore managed memory is always on — every agent gets automatic
+#   per-turn retention with zero config. Uncomment the line below to
+#   enable Hindsight as an optional add-on (adds an ECS+ALB service for
+#   semantic + entity-graph + cross-encoder retrieval tools alongside the
+#   built-in remember/recall/forget tools).
+# enable_hindsight = true
 
 # Database master password — use a strong password
 db_password = "CHANGE_ME_strong_password_here"