@indemn/cli 1.5.0 → 1.7.0

package/.claude-plugin/marketplace.json

@@ -5,12 +5,12 @@
     "name": "Indemn",
     "email": "support@indemn.com"
   },
-  "version": "1.0.0",
+  "version": "1.7.0",
   "plugins": [
     {
       "name": "indemn-cli",
-      "description": "Manage Indemn AI agents — create, configure, evaluate, and chat with agents programmatically",
-      "version": "1.0.0",
+      "description": "Manage Indemn AI agents \u2014 create, configure, evaluate, and chat with agents programmatically",
+      "version": "1.7.0",
       "author": {
         "name": "Indemn",
         "email": "support@indemn.com"

package/.claude-plugin/plugin.json

@@ -1,13 +1,18 @@
 {
   "name": "indemn-cli",
-  "version": "1.0.0",
-  "description": "Manage Indemn AI agents — create, configure, evaluate, and chat with agents programmatically",
+  "version": "1.7.0",
+  "description": "Manage Indemn AI agents \u2014 create, configure, evaluate, and chat with agents programmatically",
   "author": {
     "name": "Indemn",
     "email": "support@indemn.com"
   },
-  "homepage": "https://docs.indemn.com/cli",
+  "homepage": "https://github.com/indemn-ai/indemn-cli#readme",
   "repository": "https://github.com/indemn-ai/indemn-cli",
   "license": "MIT",
-  "keywords": ["ai-agents", "insurance", "evaluations", "indemn"]
+  "keywords": [
+    "ai-agents",
+    "insurance",
+    "evaluations",
+    "indemn"
+  ]
 }

package/.github/workflows/ci.yml

@@ -18,3 +18,13 @@ jobs:
       - run: npm ci
       - run: npm run build
       - run: npm test
+      - run: npm run check:skills
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - name: Validate skills (Agent Skills reference validator)
+        run: |
+          pip install skills-ref==0.1.1
+          for dir in skills/*/; do agentskills validate "$dir"; done
+      - name: CLI starts and reports its version
+        run: node dist/cli/index.js --version

package/.github/workflows/publish.yml

@@ -9,6 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      id-token: write # npm trusted publishing (OIDC), no NPM_TOKEN needed
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -16,9 +17,8 @@ jobs:
           node-version: 22
           cache: npm
           registry-url: https://registry.npmjs.org
+      - run: npm install -g npm@11 # trusted publishing needs npm >= 11.5.1; pinned to major
       - run: npm ci
       - run: npm run build
       - run: npm test
       - run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

package/.mcp.json

@@ -1,9 +1,6 @@
 {
   "indemn": {
     "command": "npx",
-    "args": ["@indemn/cli", "mcp", "serve"],
-    "env": {
-      "INDEMN_API_KEY": "${INDEMN_API_KEY}"
-    }
+    "args": ["@indemn/cli", "mcp", "serve"]
   }
 }

package/CONTRIBUTING.md

@@ -57,4 +57,6 @@ Open GitHub issues for bugs, feature requests, or questions. Include:
 
 ## Publishing
 
-CI/CD handles publishing to npm on merge to main (once set up). Do not publish manually unless necessary.
+CI/CD publishes `@indemn/cli` to npm on every push to the `prod` branch (`.github/workflows/publish.yml`, using the `NPM_TOKEN` repo secret). Bump `version` in `package.json` before releasing; npm rejects republishing an existing version. Do not publish manually unless necessary.
+
+Package ownership should sit with the `@indemn` npm organization, not an individual account. Use a granular automation token owned by an org member for `NPM_TOKEN`.

package/README.md

@@ -1,6 +1,6 @@
 # @indemn/cli
 
-CLI, MCP server, and Claude Code plugin for managing Indemn AI agents. Create, configure, evaluate, and chat with agents programmatically.
+CLI, MCP server and Claude Code plugin for Indemn AI agents. Create and configure agents, test them by chatting, run evaluations, and reach every area of the platform from a terminal or from an AI assistant.
 
 ## Install
 
@@ -8,224 +8,117 @@ CLI, MCP server, and Claude Code plugin for managing Indemn AI agents. Create, c
 npm install -g @indemn/cli
 ```
 
-## Authenticate
+## Log in
 
 ```bash
-indemn login --env dev
-# Enter your Indemn email and password
-# MFA code will be sent to your email if enabled
+indemn login --env dev          # or --env production
+indemn whoami
 ```
 
-This does a one-time Firebase login, generates a persistent API key, and saves it to `~/.indemn/config.json`. You won't need to log in again.
+Login keeps the same session the dashboard uses; no API key is created. The session is stored in `~/.indemn/config.json` (readable only by you). It renews itself when it nears its expiry (if the platform sets one) or when the platform rejects it; accounts with MFA are asked for the emailed code at renewal. `indemn whoami` shows when the session ends, if it has an end. When renewal is impossible (password changed, access removed), commands stop with exit code 3 and ask you to log in again. `indemn logout` revokes the session on the server.
 
-## Verify
+The platform (dev or production) is the one you logged in to. There is no per-command switch.
 
-```bash
-indemn whoami          # shows your user, org, environment
-indemn agents list     # lists your agents
-```
-
-## Quick Start
-
-```bash
-# Create an agent
-indemn agents create --name "My Insurance Bot"
-
-# Set its prompt
-indemn config set <agent-id> --prompt "You are a helpful insurance assistant."
-
-# Chat with it
-indemn chat <agent-id>
-
-# Run evaluations
-indemn eval run <agent-id> --test-set <id> --rubric <id> --wait
-```
+## Organizations
 
-## Command Reference
+You may belong to several organizations. Commands never guess which one:
 
-### Authentication
-```bash
-indemn login [--env dev|production]   # Authenticate via Firebase
-indemn logout                          # Clear stored credentials
-indemn whoami                          # Show current user/org/env
-```
+1. `--org <id>` on the command, or `org_id` on an MCP tool;
+2. otherwise the folder's link, made with `indemn link --org <id> [agent-ids...]` (writes `.indemn/project.json`; linked folders refuse agents not on the list);
+3. otherwise your only org;
+4. otherwise the CLI asks, or exits with code 2 and lists your orgs.
 
-### Agent Management
 ```bash
-indemn agents list [--json] [--limit N]
-indemn agents get <id> [--json]
-indemn agents create --name "..." [--channels WEB,VOICE]
-indemn agents update <id> [--name] [--description] [--webhook-url]
-indemn agents delete <id>
-indemn agents clone <id>
+indemn org list | current | members
+indemn link --org <org-id> <agent-id>
+indemn unlink
 ```
 
-### Configuration
-```bash
-indemn config get <agent-id> [--field prompt|greeting|model] [--json]
-indemn config set <agent-id> [--prompt "..."] [--prompt-file path] [--model "..."]
-```
+## Safety
 
-### Functions
-```bash
-indemn functions list <agent-id> [--json]
-indemn functions create <agent-id> --type rest_api --description "..."
-indemn functions update <agent-id> <func-id> [--description "..."]
-indemn functions delete <agent-id> <func-id>
-indemn functions test <agent-id> <func-id>
-indemn functions export <agent-id>
-indemn functions import <agent-id> --url "..."
-indemn functions master-list                    # list master function templates
-indemn functions params list <agent-id> <func-id>
-indemn functions params add <agent-id> <func-id> --name "..." --type string [--required]
-indemn functions params update <agent-id> <func-id> <param-id> [--description "..."]
-indemn functions params delete <agent-id> <func-id> <param-id>
-```
-
-### Knowledge Bases
-```bash
-indemn kb list [--json] [--limit N] [--page N]
-indemn kb create --name "..." --type qna
-indemn kb get <kb-id>
-indemn kb update <kb-id> [--name "..."]
-indemn kb delete <kb-id>
-indemn kb data list <kb-id>
-indemn kb data add <kb-id> --question "..." --answer "..."     # QnA data
-indemn kb data add <kb-id> --source-url "https://..."          # URL scraping
-indemn kb data add <kb-id> --file /path/to/file.pdf            # file upload
-indemn kb link <agent-id> <kb-id> [kb-id...]
-indemn kb unlink <agent-id> <kb-id>
-indemn kb export <kb-id> [--format csv]
-```
+- **Every chat is a test conversation.** `indemn chat` and the MCP `chat_with_agent` mark the conversation as a test, show the tester's name in the dashboard, and read the stored conversation back before the first message; if it was stored as live or in another org, nothing is sent.
+- **Changes ask first.** Deleting, importing, replacing a prompt or model, changing lifecycle, attaching numbers and starting paid runs show what would happen and ask. Scripts pass `--yes`. Published agents also need `--confirm-published`, and an agent whose status cannot be read is treated as published. Changing a skill or the webhook of an agent that may be live asks first too. MCP tools return a dry run until the user agrees; hosts that support elicitation ask the user directly.
+- **Read-only areas.** Billing and campaigns are read-only. Phone numbers are bought only after a person confirms that exact number (`agents numbers buy`, or the approval form in MCP; an AI cannot confirm a purchase itself); searching is free. Shared V2 catalogs (components, connectors) are read-only.
+- **Exit codes.** 0 success, 1 error, 2 a choice is needed, 3 log in again.
 
-### Evaluations
-```bash
-indemn eval run <agent-id> --test-set <id> [--rubric <id>] [--wait] [--eval-model gpt-4o] [--limit N]
-indemn eval list [--agent-id <id>] [--json] [--limit N]
-indemn eval status <run-id> [--json]
-indemn eval results <run-id> [--json]
-indemn eval bot-context <agent-id> [--json]
-```
+## Commands
 
-### Rubrics & Test Sets
-```bash
-indemn rubric list [--agent-id <id>]
-indemn rubric create --file rubric.json
-indemn rubric get <id> [--revision N]
-indemn rubric update <id> --file rubric.json
-indemn rubric delete <id>
-indemn rubric versions <id>
-
-indemn testset list --agent-id <id>              # --agent-id required
-indemn testset create --file testset.json
-indemn testset get <id> [--revision N]
-indemn testset update <id> --file testset.json
-indemn testset delete <id>
-indemn testset versions <id>
-```
+| Area | Commands |
+|---|---|
+| Login and orgs | `login`, `logout`, `whoami`, `org list\|current\|members\|switch\|config`, `link`, `unlink`, `channels list` |
+| Agents | `agents list\|get\|create\|update\|delete\|clone\|summary\|stats\|lifecycle\|owner\|export\|import\|embed\|card` |
+| Prompt and model | `config get\|set` (diff, `--dry-run`, `--yes`), `models` |
+| Skills | `skills list\|create\|update\|delete\|test\|export\|import\|generate\|bulk-create\|params` (alias `functions`) |
+| Knowledge bases | `kb list\|get\|create\|update\|delete\|link\|unlink\|export\|import\|status\|gaps\|check`, `kb data list\|add\|update\|delete\|chunks\|reimport` |
+| Chat and conversations | `chat`, `conversations list\|get\|export [--as-testset]\|mark-test` |
+| Voice | `voices list\|filters\|play`, `voice-models list`, `agents voice get\|set\|play`, `agents numbers list\|attach\|detach`, `agents voice-preview` |
+| Website | `distributions list\|create\|update`, `templates list\|create\|update\|delete`, `solutions list` |
+| Analytics and settings | `analytics metrics\|performance\|volume\|handoffs\|feedback\|conversations\|charts\|chart`, `org config get\|timezone\|business-hours\|holidays`, `audit list` |
+| Tickets | `tickets list\|get\|create\|update\|assign\|resolve\|link\|archive`, `tickets rules list\|create\|update\|delete` |
+| Billing (read-only) | `billing status\|invoices\|usage-forecast\|plans` |
+| Campaigns (read-only) | `campaigns list\|get\|counts\|forecast\|next-touchpoints\|versions`, `campaigns templates list\|get\|skills` |
+| Evaluations | `eval run\|status\|results\|list\|trends\|compare\|report\|export\|metrics\|transcript\|prod-calls\|datasets\|evaluators`, `rubric ...`, `testset ...` |
+| V2 platform and Jarvis | `platform agents\|templates\|components\|connectors\|bindings\|scenarios\|simulations\|org-evaluations`, `jarvis chat`, `jarvis jobs create\|list\|get` |
 
-### Chat
-```bash
-indemn chat <agent-id> [--session <session-id>]           # interactive
-indemn chat <agent-id> --message "Hello"                   # single message
-```
+Global flags: `--org <id>`, `--debug` (prints every request and status, never credentials), `--no-banner`, and `--json` on most commands.
 
-### Models
-```bash
-indemn models                                              # list available LLM providers and models
-```
+### CI evaluation gate
 
-### MCP Server
 ```bash
-indemn mcp serve   # Start MCP server on stdio
+indemn eval run <agent-id> --test-set <id> --min-pass-rate 0.9 --max-p95-ms 6000 --fail-on-error --yes
 ```
 
-## Claude Code Integration
-
-### MCP Server (tools)
+Exits 1 when the run misses the bar (same rules as the evaluations repo's gate script).
 
-Add the MCP server so Claude Code can manage agents directly:
+## Claude Code
 
 ```bash
-claude mcp add -s user \
-  -e INDEMN_API_KEY=ind_dev_... \
-  -e INDEMN_ENV=dev \
-  -- indemn npx @indemn/cli mcp serve
+indemn init
 ```
 
-Or add manually to your Claude Code MCP settings:
-```json
-{
-  "indemn": {
-    "command": "npx",
-    "args": ["@indemn/cli", "mcp", "serve"],
-    "env": {
-      "INDEMN_API_KEY": "ind_dev_...",
-      "INDEMN_ENV": "dev"
-    }
-  }
-}
-```
-
-The MCP server exposes 55 tools: `list_agents`, `create_agent`, `set_prompt`, `run_evaluation`, `chat_with_agent`, etc.
+Writes the skills and rules into `.claude/`, adds the MCP server to `.mcp.json`, and adds permission rules to `.claude/settings.json`: read-only tools run without asking, tools that change things ask every time. `indemn init --status` shows what is set up. Existing files are merged, not overwritten.
 
-### Plugin (skills)
+The MCP server (`indemn mcp serve`) exposes the same actions as tools. Each tool has a title and read-only or destructive labels; list tools take `limit` and `page`; large results are trimmed with a hint instead of failing.
 
-Install the plugin to get workflow skills in Claude Code:
+Plugin install:
 
 ```bash
 claude plugins marketplace add https://github.com/indemn-ai/indemn-cli
 claude plugins install indemn-cli
 ```
 
-| Skill | Purpose |
-|-------|---------|
-| `eval-orchestration` | Full evaluation lifecycle with directive allocation |
-| `test-set-creation` | Design test sets with scenarios and diagnostics |
-| `rubric-creation` | Create universal behavioral rubrics (3-6 rules) |
-| `agent-setup` | End-to-end agent creation workflow |
-
-## Global Flags
+Skills: `agent-builder` (create, configure and test agents) and `evaluations` (rubrics, test sets, runs, analysis, reports).
 
-```bash
-indemn --env dev agents list       # override environment for a single command
-indemn agents list --json          # JSON output (available on most commands)
-indemn agents list --limit 5       # limit results
-indemn agents list --limit 5 --page 2  # pagination
-```
+## Environment variables
 
-## Environment Variables
-
-| Variable | Description |
-|----------|-------------|
-| `INDEMN_API_KEY` | API key (alternative to `indemn login`) |
-| `INDEMN_ENV` | Environment: `dev` or `production` (default: `dev`) |
-| `INDEMN_ORG_ID` | Organization ID (alternative to config file) |
+| Variable | Meaning |
+|---|---|
+| `INDEMN_TOKEN` + `INDEMN_ENV` | A session token supplied by a host (for example Darwin starting the toolbox for Jarvis), and its platform |
+| `INDEMN_ORG_ID` | Org for a host-supplied session; same as `--org` |
+| `INDEMN_API_KEY` | An existing dev API key for pipelines; login no longer creates keys |
+| `INDEMN_DEBUG=1` | Same as `--debug` |
+| `INDEMN_NON_INTERACTIVE=1` | Never prompt (also automatic under Claude Code, CI, or without a terminal) |
+| `INDEMN_COPILOT_URL`, `INDEMN_EVALS_URL`, `INDEMN_MIDDLEWARE_URL`, `INDEMN_PLATFORM_URL` | Override service hosts (local development) |
 
 ## Architecture
 
 ```
-@indemn/cli
-├── SDK (TypeScript API client)
-│   ├── Copilot Server → Agents, Functions, KBs, Config
-│   ├── Evaluations Service → Rubrics, Test Sets, Runs
-│   └── Middleware → Chat via Socket.IO
-├── CLI (Commander.js terminal interface)
-├── MCP Server (55 tools for Claude Code)
-└── Skills (workflow guides for Claude)
+src/
+  core/     runtime rules (exit codes, non-interactive), org resolver, per-call org scope, diff
+  sdk/      one client per backend path: copilot-server (REST), middleware (Socket.IO chat),
+            evaluations (REST), Darwin V2 platform (REST + WebSocket for Jarvis)
+  cli/      Commander commands, one module per area
+  mcp/      MCP server: tool registry (titles, annotations, org_id, confirmation, result shaping)
+  report/   PDF and Markdown reports
 ```
 
+Every request names the client (`User-Agent: indemn-cli/<version>`, `X-Indemn-Client: cli|mcp`), retries reads only, and re-reads the saved login so a new login in another terminal is picked up.
+
 ## Development
 
 ```bash
-git clone https://github.com/indemn-ai/indemn-cli.git
-cd indemn-cli
-npm install
-npm run build        # Compile TypeScript
-npm run dev          # Watch mode
-npm test             # Run tests
+npm ci
+npm run build
+npm test
+npm run check:skills
 ```
-
-## License
-
-MIT

package/dist/cli/agents.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/cli/agents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAcpC,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAqN5D"}
+{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/cli/agents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAwBpC,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA+X5D"}