@indemn/cli 1.3.1 → 1.5.0

package/src/cli/functions.ts

@@ -1,9 +1,178 @@
 import { Command } from 'commander';
+import chalk from 'chalk';
 import ora from 'ora';
+import { readFileSync, existsSync } from 'node:fs';
 import { IndemnClient } from '../sdk/client.js';
 import { FunctionsSDK } from '../sdk/functions.js';
 import { formatTable, printJson, printError, printSuccess, confirm } from './utils/output.js';
 
+const REST_API_TYPE = 'rest_api';
+const CUSTOM_TOOL_TYPE = 'custom_tool';
+// Server expects kebab-case auth types (see copilot-server/utils/constants.js
+// AI_FUNCTIONS_REST_API_HEADERS). Snake_case values pass validation but silently
+// produce no Authorization header.
+const VALID_AUTH_TYPES = ['api-key', 'basic-auth', 'bearer-token', 'no-auth'] as const;
+const VALID_HTTP_METHODS = ['GET', 'POST', 'PUT', 'DELETE', 'PATCH'] as const;
+
+interface ConfigSchemaOptions {
+  config?: string;
+  endpoint?: string;
+  method?: string;
+  payload?: string;
+  payloadFile?: string;
+  responseField?: string;
+  outputInstructions?: string;
+  craftResponse?: boolean;
+  authType?: string;
+  authKey?: string;
+  authValue?: string;
+  authUsername?: string;
+  authPassword?: string;
+  authToken?: string;
+}
+
+function loadConfigFile(filePath: string): Record<string, unknown> {
+  if (!existsSync(filePath)) {
+    throw new Error(`--config file not found: ${filePath}`);
+  }
+  const content = readFileSync(filePath, 'utf-8');
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(content);
+  } catch {
+    throw new Error(`--config file is not valid JSON: ${filePath}`);
+  }
+  if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+    throw new Error(`--config file must contain a JSON object: ${filePath}`);
+  }
+  const obj = parsed as Record<string, unknown>;
+  // Auto-unwrap if the file is a full BotFunction dump rather than just configurationSchema contents.
+  // (e.g. user piped `functions list --json` into a file). Detected by presence of the wrapping key.
+  if (obj.configurationSchema && typeof obj.configurationSchema === 'object' && !Array.isArray(obj.configurationSchema)) {
+    return obj.configurationSchema as Record<string, unknown>;
+  }
+  return obj;
+}
+
+function loadPayloadString(opts: ConfigSchemaOptions): string | undefined {
+  if (opts.payload !== undefined && opts.payloadFile !== undefined) {
+    throw new Error('--payload and --payload-file are mutually exclusive');
+  }
+  if (opts.payload !== undefined) return opts.payload;
+  if (opts.payloadFile !== undefined) {
+    if (!existsSync(opts.payloadFile)) {
+      throw new Error(`--payload-file not found: ${opts.payloadFile}`);
+    }
+    return readFileSync(opts.payloadFile, 'utf-8');
+  }
+  return undefined;
+}
+
+function buildAuthorization(opts: ConfigSchemaOptions): Record<string, unknown> | undefined {
+  if (opts.authType === undefined) return undefined;
+  // Accept snake_case as a user-friendly alias for kebab-case (idiomatic CLI variants).
+  const authType = opts.authType.replace(/_/g, '-');
+  if (!(VALID_AUTH_TYPES as readonly string[]).includes(authType)) {
+    throw new Error(`--auth-type must be one of: ${VALID_AUTH_TYPES.join(', ')}`);
+  }
+  if (authType === 'no-auth') return { type: 'no-auth' };
+  if (authType === 'api-key') {
+    if (!opts.authKey || !opts.authValue) {
+      throw new Error('--auth-key and --auth-value are required when --auth-type is api-key');
+    }
+    return { type: 'api-key', key: opts.authKey, value: opts.authValue };
+  }
+  if (authType === 'basic-auth') {
+    if (!opts.authUsername || !opts.authPassword) {
+      throw new Error('--auth-username and --auth-password are required when --auth-type is basic-auth');
+    }
+    return { type: 'basic-auth', username: opts.authUsername, password: opts.authPassword };
+  }
+  if (authType === 'bearer-token') {
+    if (!opts.authToken) {
+      throw new Error('--auth-token is required when --auth-type is bearer-token');
+    }
+    return { type: 'bearer-token', token: opts.authToken };
+  }
+  return undefined;
+}
+
+function validateTypeFlagCompatibility(type: string, opts: ConfigSchemaOptions): void {
+  // REST-only flags must not be used with non-rest_api types — point them at --config instead.
+  const restOnlyFlags: Array<[keyof ConfigSchemaOptions, string]> = [
+    ['endpoint', '--endpoint'],
+    ['method', '--method'],
+    ['payload', '--payload'],
+    ['payloadFile', '--payload-file'],
+    ['responseField', '--response-field'],
+    ['authType', '--auth-type'],
+    ['authKey', '--auth-key'],
+    ['authValue', '--auth-value'],
+    ['authUsername', '--auth-username'],
+    ['authPassword', '--auth-password'],
+    ['authToken', '--auth-token'],
+  ];
+  if (type !== REST_API_TYPE) {
+    for (const [opt, flag] of restOnlyFlags) {
+      if (opts[opt] !== undefined) {
+        throw new Error(`${flag} is only valid for --type rest_api. Use --config for other function types.`);
+      }
+    }
+  }
+  if (opts.method !== undefined) {
+    const upper = opts.method.toUpperCase();
+    if (!(VALID_HTTP_METHODS as readonly string[]).includes(upper)) {
+      throw new Error(`--method must be one of: ${VALID_HTTP_METHODS.join(', ')}`);
+    }
+  }
+}
+
+function buildConfigurationSchema(opts: ConfigSchemaOptions, type: string): Record<string, unknown> | undefined {
+  // Start from --config file if provided; layer individual flags on top so CLI wins.
+  const result: Record<string, unknown> = opts.config ? loadConfigFile(opts.config) : {};
+
+  if (type === REST_API_TYPE) {
+    if (opts.endpoint !== undefined) result.endpoint = opts.endpoint;
+    if (opts.method !== undefined) result.method = opts.method.toUpperCase();
+    const payloadStr = loadPayloadString(opts);
+    if (payloadStr !== undefined) result.payload = payloadStr;
+    if (opts.responseField !== undefined) result.responseField = opts.responseField;
+    const auth = buildAuthorization(opts);
+    if (auth !== undefined) result.authorization = auth;
+    // Server's validateRestApiPayload requires authorization.type. Default to "no-auth"
+    // so callers don't have to pass --auth-type explicitly for unauthenticated APIs.
+    if (result.authorization === undefined) {
+      result.authorization = { type: 'no-auth' };
+    }
+  }
+
+  if (type === REST_API_TYPE || type === CUSTOM_TOOL_TYPE) {
+    if (opts.outputInstructions !== undefined) result.outputInstructions = opts.outputInstructions;
+    if (opts.craftResponse !== undefined) result.craftResponse = !!opts.craftResponse;
+  }
+
+  return Object.keys(result).length > 0 ? result : undefined;
+}
+
+function applyConfigSchemaOptions(cmd: Command): Command {
+  return cmd
+    .option('--endpoint <url>', 'REST API endpoint URL')
+    .option('--method <method>', 'HTTP method (GET|POST|PUT|DELETE|PATCH)')
+    .option('--payload <json>', 'Request body as JSON string (server JSON.parses at execution)')
+    .option('--payload-file <path>', 'Path to file containing request body JSON (alt to --payload)')
+    .option('--response-field <path>', 'Dot-path for extracting from response (e.g. data.result)')
+    .option('--output-instructions <text>', 'Instructions for how the LLM uses the response')
+    .option('--craft-response', 'Have LLM craft response (use --no-craft-response to return data directly)')
+    .option('--no-craft-response', 'Return data directly without LLM crafting')
+    .option('--auth-type <type>', 'Auth type: api-key | basic-auth | bearer-token | no-auth')
+    .option('--auth-key <name>', 'Header name for api-key auth (e.g. X-API-Key)')
+    .option('--auth-value <value>', 'Header value for api-key auth')
+    .option('--auth-username <user>', 'Username for basic-auth')
+    .option('--auth-password <pass>', 'Password for basic-auth')
+    .option('--auth-token <token>', 'Token for bearer-token auth')
+    .option('--config <path>', 'JSON file with full configurationSchema (individual flags override file values)');
+}
+
 export function registerFunctionCommands(program: Command): void {
   const functions = program.command('functions').description('Manage agent functions/tools');
 
@@ -55,65 +224,126 @@ export function registerFunctionCommands(program: Command): void {
       }
     });
 
-  functions
-    .command('create')
-    .argument('<agent-id>', 'Agent ID')
-    .description('Create a function for an agent')
-    .requiredOption('--type <type>', 'Function type')
-    .option('--name <name>', 'Function name')
-    .option('--description <description>', 'Function description')
+  applyConfigSchemaOptions(
+    functions
+      .command('create')
+      .argument('<agent-id>', 'Agent ID')
+      .description('Create a function for an agent')
+      .requiredOption('--type <type>', 'Function type')
+      .option('--name <name>', 'Function name')
+      .option('--description <description>', 'Function description')
+  )
     .action(async (agentId: string, options) => {
       try {
+        validateTypeFlagCompatibility(options.type, options);
+        const configurationSchema = buildConfigurationSchema(options, options.type);
+
+        // For rest_api on create, require endpoint+method (unless supplied via --config).
+        if (options.type === REST_API_TYPE) {
+          if (!configurationSchema || !configurationSchema.endpoint) {
+            throw new Error('--endpoint (or --config with endpoint) is required for --type rest_api');
+          }
+          if (!configurationSchema.method) {
+            throw new Error('--method (or --config with method) is required for --type rest_api');
+          }
+        }
+
         const client = new IndemnClient();
         const sdk = new FunctionsSDK(client);
         const spinner = ora('Creating function...').start();
 
+        // Step 1: POST skeleton (server's createBotTool doesn't convert configurationSchema —
+        // only the update path does. So a two-step create is needed for the function to be executable.)
         const func = await sdk.createFunction(agentId, {
           type: options.type,
           name: options.name,
           description: options.description,
         });
+
+        // Step 2: PUT configurationSchema so the server converts it into executionSchema.
+        let finalFunc = func;
+        if (configurationSchema) {
+          spinner.text = 'Configuring function...';
+          try {
+            finalFunc = await sdk.updateFunction(agentId, func._id, {
+              type: options.type,
+              description: options.description || '',
+              configurationSchema,
+            });
+          } catch (err) {
+            spinner.fail(`Function created (${func._id}) but configuration step failed.`);
+            printError(err);
+            console.log(chalk.dim(`Retry: indemn functions update <agent-id> ${func._id} ...`));
+            console.log(chalk.dim(`Or remove: indemn functions delete <agent-id> ${func._id}`));
+            process.exit(1);
+          }
+        }
         spinner.stop();
 
-        printSuccess(`Function created: ${func._id}`);
-        console.log(`  Name: ${func.name || '(none)'}`);
-        console.log(`  Type: ${func.type}`);
+        printSuccess(`Function created: ${finalFunc._id}`);
+        console.log(`  Name: ${finalFunc.name || '(none)'}`);
+        console.log(`  Type: ${finalFunc.type}`);
       } catch (err) {
         printError(err);
         process.exit(1);
       }
     });
 
-  functions
-    .command('update')
-    .argument('<agent-id>', 'Agent ID')
-    .argument('<func-id>', 'Function ID')
-    .description('Update a function')
-    .option('--name <name>', 'Function name')
-    .option('--description <description>', 'Function description')
+  applyConfigSchemaOptions(
+    functions
+      .command('update')
+      .argument('<agent-id>', 'Agent ID')
+      .argument('<func-id>', 'Function ID')
+      .description('Update a function')
+      .option('--name <name>', 'Function name')
+      .option('--description <description>', 'Function description')
+  )
     .action(async (agentId: string, funcId: string, options) => {
       try {
-        const input: Record<string, unknown> = {};
-        if (options.name) input.name = options.name;
-        if (options.description) input.description = options.description;
-
-        if (Object.keys(input).length === 0) {
-          printError('No update options provided. Use --name or --description.');
-          process.exit(1);
-        }
-
         const client = new IndemnClient();
         const sdk = new FunctionsSDK(client);
-        const spinner = ora('Updating function...').start();
 
-        // Server requires type and description on updates — fetch current values as defaults
+        // Fetch current function — required so we can preserve type/description and merge configurationSchema.
+        const fetchSpinner = ora('Fetching current function...').start();
         const functions = await sdk.listFunctions(agentId);
         const current = functions.find((f) => f._id === funcId);
-        if (current) {
-          if (!input.type) input.type = current.type;
-          if (!input.description) input.description = current.description;
+        fetchSpinner.stop();
+        if (!current) {
+          printError(`Function ${funcId} not found.`);
+          process.exit(1);
         }
 
+        validateTypeFlagCompatibility(current.type, options);
+
+        const input: Record<string, unknown> = {
+          // Server requires type + description on every update.
+          type: current.type,
+          description: options.description || current.description || '',
+        };
+        if (options.name) input.name = options.name;
+
+        // Build configurationSchema patch from flags + --config, then shallow-merge over current.
+        // Server replaces executionSchema wholesale on each update, so we must send the full merged schema —
+        // otherwise `update --endpoint X` would wipe everything else.
+        const patch = buildConfigurationSchema(options, current.type);
+        if (patch) {
+          input.configurationSchema = {
+            ...(current.configurationSchema || {}),
+            ...patch,
+          };
+        }
+
+        // Anything actually changing? type+description are always set; require at least one explicit option.
+        const hasUserChanges =
+          options.name !== undefined ||
+          options.description !== undefined ||
+          patch !== undefined;
+        if (!hasUserChanges) {
+          printError('No update options provided. Use --name, --description, --endpoint, --config, etc.');
+          process.exit(1);
+        }
+
+        const spinner = ora('Updating function...').start();
         await sdk.updateFunction(agentId, funcId, input);
         spinner.stop();
 
@@ -161,9 +391,18 @@ export function registerFunctionCommands(program: Command): void {
       try {
         const client = new IndemnClient();
         const sdk = new FunctionsSDK(client);
-        const spinner = ora('Testing function...').start();
 
-        const result = await sdk.testFunction(agentId, funcId);
+        // Server's /test-rest-api endpoint expects the configurationSchema in the request body
+        // (it re-converts via convertPayloadToExecutionSchema). It does NOT read the stored
+        // schema from the DB. So we fetch the function's current configurationSchema and send it.
+        const spinner = ora('Testing function...').start();
+        const all = await sdk.listFunctions(agentId);
+        const current = all.find((f) => f._id === funcId);
+        if (!current) {
+          spinner.fail(`Function ${funcId} not found.`);
+          process.exit(1);
+        }
+        const result = await sdk.testFunction(agentId, funcId, current.configurationSchema || {});
         spinner.stop();
 
         if (options.json) {

package/src/cli/index.ts

@@ -11,22 +11,54 @@ import { registerKBCommands } from './kb.js';
 import { registerEvalCommands } from './eval.js';
 import { registerChatCommand } from './chat.js';
 import { registerOrgCommands } from './org.js';
+import { printBanner } from './utils/output.js';
 
 const program = new Command();
 
 program
   .name('indemn')
   .description('CLI for managing Indemn AI agents')
-  .version('1.2.0');
+  .version('1.5.0');
 
 program.option('--env <environment>', 'Environment (dev or production)');
+program.option('--no-banner', 'Suppress the active-org banner');
 
-// Hook to set environment before any command runs
-program.hook('preAction', (thisCommand) => {
-  const opts = thisCommand.opts();
-  if (opts.env) {
-    process.env.INDEMN_ENV = opts.env;
+// Commands that already surface org identity themselves — no banner needed.
+const BANNER_SKIP = new Set([
+  'login',
+  'logout',
+  'whoami',
+  'init',
+  'org list',
+  'org switch',
+  'mcp serve',
+]);
+
+function fullCommandName(cmd: Command): string {
+  const parts: string[] = [cmd.name()];
+  let p: Command | null = cmd.parent;
+  while (p && p.name() !== 'indemn') {
+    parts.unshift(p.name());
+    p = p.parent;
+  }
+  return parts.join(' ');
+}
+
+// Hook runs before any command action
+program.hook('preAction', async (thisCommand, actionCommand) => {
+  const globalOpts = thisCommand.opts();
+  if (globalOpts.env) {
+    process.env.INDEMN_ENV = globalOpts.env;
   }
+
+  // Banner suppression: global flag, env var, command opts-out, or JSON output mode.
+  if (globalOpts.banner === false) return;
+  if (process.env.INDEMN_NO_BANNER === '1') return;
+  const actionOpts = actionCommand.opts();
+  if (actionOpts.json) return;
+  if (BANNER_SKIP.has(fullCommandName(actionCommand))) return;
+
+  await printBanner();
 });
 
 // Register all command groups

package/src/cli/org.ts

@@ -56,6 +56,13 @@ export function registerOrgCommands(program: Command): void {
         }
 
         const currentOrgId = client.getOrgId();
+
+        // Opportunistically sync the cached org_name while we have fresh data.
+        const activeOrg = orgs.find(o => o._id === currentOrgId);
+        if (activeOrg) {
+          IndemnClient.saveConfig({ org_name: activeOrg.name });
+        }
+
         console.log(chalk.bold('Organizations'));
         console.log('');
         for (const o of orgs.sort((a, b) => a.name.localeCompare(b.name))) {
@@ -95,8 +102,8 @@ export function registerOrgCommands(program: Command): void {
         const data = await orgRes.json() as { organization: { _id: string; name: string } };
         const orgName = data.organization.name;
 
-        // Update config
-        IndemnClient.saveConfig({ org_id: orgId });
+        // Update config — cache both org_id and org_name so the banner can render without a lookup.
+        IndemnClient.saveConfig({ org_id: orgId, org_name: orgName });
 
         spinner.succeed(`Switched to ${orgName} (${orgId})`);
       } catch (err) {

package/src/cli/utils/output.ts

@@ -1,6 +1,7 @@
 import Table from 'cli-table3';
 import chalk from 'chalk';
 import * as readline from 'readline';
+import { IndemnClient } from '../../sdk/client.js';
 
 export function formatTable(headers: string[], rows: string[][]): string {
   const table = new Table({
@@ -27,6 +28,54 @@ export function printSuccess(message: string): void {
   console.log(chalk.green(message));
 }
 
+/**
+ * Render the active-org banner: [Voice Demos · 69a40cd9…6807f · dev]
+ *
+ * Printed to stderr so it never pollutes stdout pipes (JSON output stays clean
+ * without --json suppression). Rendered red for prod to reinforce blast-radius
+ * awareness. Silent if not logged in or if the caller opts out.
+ *
+ * Self-heals when org_name is missing from config (e.g., after upgrading from
+ * a pre-1.4 install) by fetching /organization/:id once and caching.
+ */
+export async function printBanner(): Promise<void> {
+  if (process.env.INDEMN_NO_BANNER === '1') return;
+
+  const config = IndemnClient.loadConfig();
+  if (!config || !config.api_key || !config.org_id) return;
+
+  let orgName = config.org_name;
+  if (!orgName) {
+    // Lazy one-time fetch so post-upgrade installs don't render "(unknown)" forever.
+    try {
+      const client = new IndemnClient();
+      const orgRes = await fetch(`${client.getHosts().copilot}/organization/${config.org_id}`, {
+        headers: {
+          'Authorization': `Bearer ${client.getApiKey()}`,
+          'Content-Type': 'application/json',
+        },
+      });
+      if (orgRes.ok) {
+        const data = await orgRes.json() as { organization?: { name?: string } };
+        orgName = data.organization?.name;
+        if (orgName) IndemnClient.saveConfig({ org_name: orgName });
+      }
+    } catch {
+      // Silent — banner degrades to ID-only display
+    }
+  }
+
+  const shortId = config.org_id.length > 12
+    ? `${config.org_id.slice(0, 8)}…${config.org_id.slice(-4)}`
+    : config.org_id;
+  const label = orgName || '(unknown org)';
+  const text = `[${label} · ${shortId} · ${config.environment}]`;
+  const colored = config.environment === 'production'
+    ? chalk.red.bold(text)
+    : chalk.yellow.dim(text);
+  process.stderr.write(colored + '\n');
+}
+
 export async function confirm(message: string): Promise<boolean> {
   const rl = readline.createInterface({
     input: process.stdin,

package/src/sdk/auth.ts

@@ -91,9 +91,27 @@ export async function login(email: string, password: string, env: Environment =
     throw new Error('Login succeeded but no organization found. Contact your admin to be added to an organization.');
   }
 
+  // Step 3.5: Fetch the org name so the banner can display it without a lookup on every command.
+  let orgName: string | undefined;
+  try {
+    const orgRes = await fetch(`${client.getHosts().copilot}/organization/${apiKeyResponse.org_id}`, {
+      headers: {
+        'Authorization': `Bearer ${apiKeyResponse.key}`,
+        'Content-Type': 'application/json',
+      },
+    });
+    if (orgRes.ok) {
+      const data = await orgRes.json() as { organization?: { name?: string } };
+      orgName = data.organization?.name;
+    }
+  } catch {
+    // Non-fatal — banner falls back to org ID if name unavailable
+  }
+
   const config = {
     api_key: apiKeyResponse.key,
     org_id: apiKeyResponse.org_id,
+    org_name: orgName,
     user_id: userId,
     environment: env,
   };

package/src/sdk/client.ts

@@ -53,6 +53,7 @@ export class IndemnClient {
       return {
         api_key: apiKey,
         org_id: store.get('org_id', ''),
+        org_name: store.get('org_name', '') || undefined,
         user_id: store.get('user_id', ''),
         environment: store.get('environment', 'dev'),
         hosts: store.get('hosts', DEFAULT_HOSTS),

package/src/sdk/types.ts

@@ -11,6 +11,7 @@ export interface EnvironmentHosts {
 export interface IndemnConfig {
   api_key: string;
   org_id: string;
+  org_name?: string;
   user_id: string;
   environment: Environment;
   hosts: Record<Environment, EnvironmentHosts>;
@@ -102,6 +103,8 @@ export interface BotFunction {
   headers?: Record<string, string>;
   body?: Record<string, unknown>;
   parameters?: FunctionParameter[];
+  configurationSchema?: Record<string, unknown>;
+  executionSchema?: Record<string, unknown>;
   id_bot?: string;
   createdAt?: string;
   updatedAt?: string;
@@ -119,6 +122,10 @@ export interface CreateFunctionInput {
   type: string;
   description?: string;
   name?: string;
+  // Server stores configurationSchema and converts to executionSchema in the update path.
+  // Note: url/method/headers/body at the root are unused legacy fields — actual REST API
+  // config lives inside configurationSchema. See AI-369.
+  configurationSchema?: Record<string, unknown>;
   url?: string;
   method?: string;
   headers?: Record<string, string>;
@@ -126,8 +133,10 @@ export interface CreateFunctionInput {
 }
 
 export interface UpdateFunctionInput {
+  type?: string;
   description?: string;
   name?: string;
+  configurationSchema?: Record<string, unknown>;
   url?: string;
   method?: string;
   headers?: Record<string, string>;