@indemn/cli 1.5.0 → 1.7.0

package/src/cli/tickets.ts

@@ -0,0 +1,130 @@
+import { Command } from 'commander';
+import chalk from 'chalk';
+import { IndemnClient } from '../sdk/client.js';
+import { TicketsSDK, type TicketPriority, type TicketStatus } from '../sdk/tickets.js';
+import { confirmOrExit } from './link.js';
+import { formatTable, printError, printJson, printSuccess } from './utils/output.js';
+
+function run(fn: () => Promise<void>): Promise<void> {
+  return fn().catch((err) => {
+    printError(err);
+    process.exit(1);
+  });
+}
+const sdk = () => new TicketsSDK(new IndemnClient());
+
+export function registerTicketCommands(program: Command): void {
+  const tickets = program.command('tickets').description('Support tickets (the org must have tickets turned on)');
+
+  tickets.command('list')
+    .option('--status <list>', 'not_started, in_progress, completed (comma-separated)')
+    .option('--assignee <user-id>', 'Assigned to this member')
+    .option('--search <text>', 'Search title, description and reference')
+    .option('--limit <n>', 'At most this many', '50')
+    .option('--json', 'Output as JSON')
+    .action((options) => run(async () => {
+      const rows = await sdk().list({ status: options.status?.split(',') as TicketStatus[] | undefined, assignee: options.assignee, search: options.search, limit: Number(options.limit) });
+      if (options.json) { printJson(rows); return; }
+      console.log(formatTable(['ID', 'Ref', 'Title', 'Status', 'Priority'], rows.map((t) => [t._id, String(t.ticket_ref ?? ''), String(t.title ?? '').slice(0, 50), String(t.status ?? ''), String(t.priority ?? '')])));
+    }));
+
+  tickets.command('get').argument('<ticket-id>').action((id: string) => run(async () => printJson(await sdk().get(id))));
+
+  tickets.command('create')
+    .requiredOption('--title <text>', 'Title')
+    .option('--description <text>', 'Description')
+    .option('--priority <p>', 'urgent, high, normal or low')
+    .option('--assign <user-id>', 'Assign to this member')
+    .option('--conversation <request-id>', 'Attach a conversation')
+    .option('--force', 'Create even if similar tickets exist (skips the duplicate check)')
+    .action((options) => run(async () => {
+      const res = await sdk().create({
+        title: options.title, description: options.description, priority: options.priority as TicketPriority | undefined,
+        ...(options.assign ? { assignee: { type: 'user', target: options.assign } } : {}),
+        ...(options.conversation ? { conversations: [{ request_id: options.conversation }] } : {}),
+      }, { force: options.force });
+      if (!res.saved) {
+        console.log(chalk.yellow(res.message));
+        for (const t of res.similar) console.log(`  ${t._id}  ${t.title ?? ''}`);
+        process.exit(2);
+      }
+      printSuccess(`Ticket created: ${res.ticket._id}`);
+    }));
+
+  tickets.command('update')
+    .argument('<ticket-id>')
+    .option('--title <text>').option('--description <text>').option('--notes <text>')
+    .option('--status <status>', 'not_started or in_progress (use `resolve` to close)')
+    .option('--priority <p>', 'urgent, high, normal or low')
+    .action((id: string, options) => run(async () => {
+      const changes: Record<string, unknown> = {};
+      for (const k of ['title', 'description', 'notes', 'status', 'priority']) if (options[k] !== undefined) changes[k] = options[k];
+      printJson(await sdk().update(id, changes));
+    }));
+
+  tickets.command('assign')
+    .argument('<ticket-id>')
+    .argument('[user-id]', 'Member to assign; omit with --unassign')
+    .option('--unassign', 'Remove the assignee')
+    .action((id: string, userId: string | undefined, options) => run(async () => {
+      printJson(await sdk().assign(id, options.unassign || !userId ? null : { type: 'user', target: userId }));
+    }));
+
+  tickets.command('resolve')
+    .argument('<ticket-id>')
+    .option('--note <text>', 'Closing note')
+    .description('Close a ticket')
+    .action((id: string, options) => run(async () => { printJson(await sdk().resolve(id, options.note)); }));
+
+  tickets.command('link')
+    .argument('<ticket-id>')
+    .argument('<related-ticket-id>')
+    .action((id: string, related: string) => run(async () => { printJson(await sdk().link(id, related)); }));
+
+  tickets.command('archive')
+    .argument('<ticket-id>')
+    .option('--yes', 'Do not ask for confirmation')
+    .action((id: string, options) => run(async () => {
+      await confirmOrExit(`Archive ticket ${id}?`, Boolean(options.yes));
+      await sdk().archive(id);
+      printSuccess(`Ticket ${id} archived.`);
+    }));
+
+  const rules = tickets.command('rules').description('Rules that let agents open tickets from conversations');
+  rules.command('list').option('--agent <id>', 'Rules enabled for this agent').action((options) => run(async () => printJson(await sdk().listRules({ agentId: options.agent }))));
+  rules.command('create')
+    .requiredOption('--prompt <text>', 'When should a ticket be created?')
+    .option('--name <name>', 'Rule name (max 75 characters)')
+    .option('--agents <ids>', 'Only these agents (comma-separated); default all agents')
+    .option('--assign <user-id>', 'Assign created tickets to this member')
+    .option('--disabled', 'Create switched off')
+    .option('--force', 'Skip the overlap check')
+    .action((options) => run(async () => {
+      const res = await sdk().saveRule({
+        name: options.name, prompt: options.prompt, enabled: !options.disabled,
+        scope: options.agents ? { kind: 'specific', agents: options.agents.split(',') } : { kind: 'all_agents', agents: [] },
+        ...(options.assign ? { assignment: { type: 'user', target: options.assign } } : {}),
+      }, { force: options.force });
+      if (!res.saved) {
+        console.log(chalk.yellow('The rule overlaps existing ones; nothing was saved. Use --force to save anyway.'));
+        printJson({ caveats: res.caveats, suggested_name: res.suggested_name });
+        process.exit(2);
+      }
+      printJson(res.rule);
+    }));
+  rules.command('update')
+    .argument('<rule-id>')
+    .option('--name <name>').option('--prompt <text>')
+    .option('--enable').option('--disable')
+    .action((id: string, options) => run(async () => {
+      printJson((await sdk().saveRule({ ruleId: id, name: options.name, prompt: options.prompt, enabled: options.enable ? true : options.disable ? false : undefined })).rule);
+    }));
+  rules.command('delete')
+    .argument('<rule-id>')
+    .option('--yes', 'Do not ask for confirmation')
+    .action((id: string, options) => run(async () => {
+      await confirmOrExit(`Delete ticket rule ${id}? Agents stop opening tickets for it.`, Boolean(options.yes));
+      await sdk().deleteRule(id);
+      printSuccess(`Rule ${id} deleted.`);
+    }));
+}

package/src/cli/utils/output.ts

@@ -1,7 +1,9 @@
 import Table from 'cli-table3';
 import chalk from 'chalk';
 import * as readline from 'readline';
-import { IndemnClient } from '../../sdk/client.js';
+import { onOrgResolved } from '../../core/scope.js';
+import type { OrgChoice } from '../../core/org-resolver.js';
+import { CliError, EXIT, NeedsInputError } from '../../core/runtime.js';
 
 export function formatTable(headers: string[], rows: string[][]): string {
   const table = new Table({
@@ -18,10 +20,21 @@ export function printJson(data: unknown): void {
   console.log(JSON.stringify(data, null, 2));
 }
 
+/**
+ * Print an error. A CliError that carries its own exit code (2: a choice is
+ * needed, 3: log in again) ends the process with that code here, so every
+ * command gets the right code without handling it itself.
+ */
 export function printError(error: unknown): void {
   const message =
     error instanceof Error ? error.message : String(error);
   console.error(chalk.red(`Error: ${message}`));
+  if (error instanceof NeedsInputError && error.choices.length) {
+    for (const c of error.choices) console.error(`  ${c.id}  ${c.label}`);
+  }
+  if (error instanceof CliError && error.exitCode !== EXIT.ERROR) {
+    process.exit(error.exitCode);
+  }
 }
 
 export function printSuccess(message: string): void {
@@ -29,51 +42,47 @@ export function printSuccess(message: string): void {
 }
 
 /**
- * Render the active-org banner: [Voice Demos · 69a40cd9…6807f · dev]
- *
- * Printed to stderr so it never pollutes stdout pipes (JSON output stays clean
- * without --json suppression). Rendered red for prod to reinforce blast-radius
- * awareness. Silent if not logged in or if the caller opts out.
- *
- * Self-heals when org_name is missing from config (e.g., after upgrading from
- * a pre-1.4 install) by fetching /organization/:id once and caching.
+ * Print the org banner once, when a command's org is decided:
+ * [Voice Demos · 69a40cd9…6807 · dev · linked]. It goes to stderr so stdout
+ * stays clean for pipes, and is red on production.
  */
-export async function printBanner(): Promise<void> {
-  if (process.env.INDEMN_NO_BANNER === '1') return;
+export function installBanner(): void {
+  onOrgResolved((org) => {
+    if (process.env.INDEMN_NO_BANNER === '1') return;
+    const shortId = org.id.length > 12 ? `${org.id.slice(0, 8)}…${org.id.slice(-4)}` : org.id;
+    const how = { flag: '--org', env: 'INDEMN_ORG_ID', link: 'linked folder', single: 'only org', asked: 'chosen' }[org.source];
+    const text = `[${org.name ?? '(unnamed org)'} · ${shortId} · ${org.environment} · ${how}]`;
+    const colored = org.environment === 'production' ? chalk.red.bold(text) : chalk.yellow.dim(text);
+    // The org is often decided while a spinner is drawing on this line: clear it first.
+    const clear = process.stderr.isTTY ? '\r\x1b[2K' : '';
+    process.stderr.write(clear + colored + '\n');
+  });
+}
 
-  const config = IndemnClient.loadConfig();
-  if (!config || !config.api_key || !config.org_id) return;
+/** Read one line from the terminal, writing the question to stderr so stdout stays clean. */
+export function askLine(question: string): Promise<string> {
+  const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+  return new Promise((resolve) => {
+    rl.question(question, (answer) => {
+      rl.close();
+      resolve(answer.trim());
+    });
+  });
+}
 
-  let orgName = config.org_name;
-  if (!orgName) {
-    // Lazy one-time fetch so post-upgrade installs don't render "(unknown)" forever.
-    try {
-      const client = new IndemnClient();
-      const orgRes = await fetch(`${client.getHosts().copilot}/organization/${config.org_id}`, {
-        headers: {
-          'Authorization': `Bearer ${client.getApiKey()}`,
-          'Content-Type': 'application/json',
-        },
-      });
-      if (orgRes.ok) {
-        const data = await orgRes.json() as { organization?: { name?: string } };
-        orgName = data.organization?.name;
-        if (orgName) IndemnClient.saveConfig({ org_name: orgName });
-      }
-    } catch {
-      // Silent — banner degrades to ID-only display
-    }
-  }
+/** Terminal version of "which org?": a numbered list; answer with the number or the id. */
+export async function askOrgInTerminal(choices: OrgChoice[]): Promise<string | undefined> {
+  process.stderr.write(chalk.bold('You belong to several organizations. Which one?\n'));
+  choices.forEach((c, i) => process.stderr.write(`  ${i + 1}) ${c.name ?? c.id}  ${chalk.dim(c.id)}\n`));
+  const answer = await askLine('Number or id: ');
+  const index = Number.parseInt(answer, 10);
+  if (String(index) === answer && index >= 1 && index <= choices.length) return choices[index - 1].id;
+  return choices.find((c) => c.id === answer)?.id;
+}
 
-  const shortId = config.org_id.length > 12
-    ? `${config.org_id.slice(0, 8)}…${config.org_id.slice(-4)}`
-    : config.org_id;
-  const label = orgName || '(unknown org)';
-  const text = `[${label} · ${shortId} · ${config.environment}]`;
-  const colored = config.environment === 'production'
-    ? chalk.red.bold(text)
-    : chalk.yellow.dim(text);
-  process.stderr.write(colored + '\n');
+export async function askMfaInTerminal(): Promise<string> {
+  process.stderr.write(chalk.yellow('Your session needs renewing and your account uses MFA. A code was emailed to you.\n'));
+  return askLine('MFA code: ');
 }
 
 export async function confirm(message: string): Promise<boolean> {

package/src/cli/voice.ts

@@ -0,0 +1,204 @@
+import { Command } from 'commander';
+import chalk from 'chalk';
+import { writeFileSync } from 'node:fs';
+import { IndemnClient } from '../sdk/client.js';
+import { VoiceSDK, toE164 } from '../sdk/voice.js';
+import { CliError, EXIT } from '../core/runtime.js';
+import { confirmOrExit } from './link.js';
+import { formatTable, printError, printJson, printSuccess } from './utils/output.js';
+
+function run(fn: () => Promise<void>): Promise<void> {
+  return fn().catch((err) => {
+    printError(err);
+    process.exit(1);
+  });
+}
+
+export function registerVoiceCommands(program: Command): void {
+  const voices = program.command('voices').description('Text-to-speech voices an agent can use');
+
+  voices.command('list')
+    .option('--provider <name>', 'cartesia (default) or elevenlabs', 'cartesia')
+    .option('--language <code>', 'For example en')
+    .option('--gender <gender>', 'masculine, feminine or gender_neutral')
+    .option('--search <text>', 'Name search (ElevenLabs needs 3+ characters)')
+    .option('--limit <n>', 'At most this many', '50')
+    .option('--json', 'Output as JSON')
+    .description('List voices; copy the id, name, gender, language and country into `agents voice set`')
+    .action((options) => run(async () => {
+      const res = await new VoiceSDK(new IndemnClient()).listVoices({ provider: options.provider, language: options.language, gender: options.gender, q: options.search, limit: Number(options.limit) });
+      if (options.json) { printJson(res); return; }
+      const rows = (res.data ?? []) as Array<Record<string, unknown>>;
+      console.log(formatTable(['ID', 'Name', 'Gender', 'Language', 'Country'], rows.map((v) => [String(v.id), String(v.name ?? ''), String(v.gender ?? ''), String(v.language ?? ''), String(v.countryCode ?? '')])));
+      if (res.has_more) console.log(chalk.dim('More voices exist; narrow with --language, --gender or --search.'));
+    }));
+
+  voices.command('filters')
+    .argument('<provider>', 'cartesia or elevenlabs')
+    .description('Languages, genders and accents a provider offers')
+    .action((provider: string) => run(async () => printJson(await new VoiceSDK(new IndemnClient()).voiceFilters(provider))));
+
+  voices.command('play')
+    .argument('<voice-id>', 'Voice ID')
+    .option('--text <text>', 'What to say')
+    .option('--speed <n>', 'Speaking speed')
+    .requiredOption('-o, --output <file>', 'Audio file to write')
+    .description('Save a speech sample of a voice')
+    .action((voiceId: string, options) => run(async () => {
+      const audio = await new VoiceSDK(new IndemnClient()).playVoice(voiceId, options.text, options.speed ? Number(options.speed) : undefined);
+      writeFileSync(options.output, audio.data);
+      printSuccess(`Wrote ${options.output} (${audio.contentType}, ${audio.data.length} bytes).`);
+    }));
+
+  program.command('voice-models')
+    .description('Speech providers and models')
+    .command('list')
+    .requiredOption('--kind <kind>', 'stt (speech to text) or tts (text to speech)')
+    .action((options) => run(async () => {
+      if (!['stt', 'tts'].includes(options.kind)) throw new CliError('--kind must be stt or tts.', EXIT.NEEDS_INPUT);
+      printJson(await new VoiceSDK(new IndemnClient()).voiceModels(options.kind));
+    }));
+
+  const agents = program.commands.find((c) => c.name() === 'agents');
+  if (!agents) throw new Error('agents command group must be registered before voice commands');
+
+  const voice = agents.command('voice').description('Voice settings of an agent (they live on its phone number)');
+  voice.command('get')
+    .argument('<agent-id>', 'Agent ID')
+    .action((agentId: string) => run(async () => printJson(await new VoiceSDK(new IndemnClient()).getAgentVoice(agentId))));
+
+  voice.command('set')
+    .argument('<agent-id>', 'Agent ID')
+    .requiredOption('--voice-id <id>', 'Voice ID from `voices list`')
+    .requiredOption('--name <name>', 'Voice name')
+    .requiredOption('--gender <gender>', 'Voice gender')
+    .requiredOption('--language <code>', 'Language, for example en')
+    .requiredOption('--country <code>', 'Country code, for example US')
+    .option('--provider <name>', 'cartesia or elevenlabs', 'cartesia')
+    .option('--model <model>', 'TTS model')
+    .option('--speed <n>', 'Speaking speed')
+    .option('--yes', 'Do not ask for confirmation')
+    .description('Change the voice of an agent')
+    .action((agentId: string, options) => run(async () => {
+      const sdk = new VoiceSDK(new IndemnClient());
+      const current = await sdk.getAgentVoice(agentId) as { tts?: { name?: string; voice_id?: string } };
+      await confirmOrExit(`Change the voice of agent ${agentId} from ${current.tts?.name ?? current.tts?.voice_id ?? '(default)'} to ${options.name}? Callers hear it on the next call.`, Boolean(options.yes));
+      await sdk.setAgentVoice(agentId, {
+        provider: options.provider, voice_id: options.voiceId, name: options.name, gender: options.gender, language: options.language,
+        countryCode: options.country, ...(options.model ? { model: options.model } : {}), ...(options.speed ? { settings: { speed: Number(options.speed) } } : {}),
+      });
+      printSuccess(`Voice of ${agentId} is now ${options.name}.`);
+    }));
+
+  voice.command('transcriber')
+    .argument('<agent-id>', 'Agent ID')
+    .requiredOption('--provider <name>', 'Speech-to-text provider (see `voice-models list --kind stt`)')
+    .requiredOption('--model <model>', 'Speech-to-text model')
+    .requiredOption('--language <code>', 'Language, for example en')
+    .option('--keyterms <list>', 'Words to listen for, comma-separated (up to 50)')
+    .option('--yes', 'Do not ask for confirmation')
+    .description('Change how the agent hears callers (speech-to-text)')
+    .action((agentId: string, options) => run(async () => {
+      const sdk = new VoiceSDK(new IndemnClient());
+      await confirmOrExit(`Change the transcriber of agent ${agentId} to ${options.provider}/${options.model} (${options.language})? It applies from the next call.`, Boolean(options.yes));
+      await sdk.setAgentTranscriber(agentId, { provider: options.provider, model: options.model, language: options.language, keyterms: options.keyterms ? String(options.keyterms).split(',') : undefined });
+      printSuccess(`Transcriber of ${agentId} is now ${options.provider}/${options.model}.`);
+    }));
+
+  voice.command('play')
+    .argument('<agent-id>', 'Agent ID')
+    .option('--text <text>', 'What to say')
+    .requiredOption('-o, --output <file>', 'Audio file to write')
+    .description('Save a speech sample in the agent\'s current voice')
+    .action((agentId: string, options) => run(async () => {
+      const sdk = new VoiceSDK(new IndemnClient());
+      const tts = (await sdk.getAgentVoice(agentId) as { tts?: { voice_id?: string; provider?: string; name?: string; language?: string } }).tts;
+      if (!tts?.voice_id) throw new CliError(`Agent ${agentId} has no text-to-speech voice set.`);
+      const audio = await sdk.playVoice(tts.voice_id, options.text, undefined, { provider: tts.provider, name: tts.name, language: tts.language });
+      writeFileSync(options.output, audio.data);
+      printSuccess(`Wrote ${options.output}.`);
+    }));
+
+  const numbers = agents.command('numbers').description('Phone numbers of an agent');
+  numbers.command('list')
+    .argument('[agent-id]', 'Agent ID (omit to list every number the org owns)')
+    .option('--json', 'Output as JSON')
+    .action((agentId: string | undefined, options) => run(async () => {
+      const sdk = new VoiceSDK(new IndemnClient());
+      const rows = agentId ? await sdk.agentNumbers(agentId) : await sdk.orgNumbers();
+      if (options.json) { printJson(rows); return; }
+      console.log(formatTable(['Number', 'Name', 'Attached'], rows.map((n) => [String(n.phoneNumber ?? ''), String(n.friendlyName ?? ''), agentId ? 'yes' : n.is_active ? 'yes' : 'no'])));
+    }));
+
+  numbers.command('attach')
+    .argument('<agent-id>', 'Agent ID')
+    .argument('<phone-number>', 'A number the org already owns (see `agents numbers list`)')
+    .option('--yes', 'Do not ask for confirmation')
+    .description('Attach an owned number; never buys one. Its voice settings reset to the defaults')
+    .action((agentId: string, phone: string, options) => run(async () => {
+      await confirmOrExit(`Attach ${phone} to agent ${agentId}? Calls to it reach this agent, and its voice settings reset to the defaults.`, Boolean(options.yes));
+      await new VoiceSDK(new IndemnClient()).attachNumber(agentId, phone);
+      printSuccess(`${phone} is attached to ${agentId}.`);
+    }));
+
+  numbers.command('search')
+    .option('--area-code <code>', 'Three-digit area code, for example 331')
+    .option('--contains <digits>', 'Only numbers containing these digits')
+    .option('--country <code>', 'US, CA, GB or AU', 'US')
+    .option('--toll-free', 'Toll-free numbers instead of local ones')
+    .option('--limit <n>', 'How many to show (default 5)', '5')
+    .option('--json', 'Output as JSON')
+    .description('Numbers available to buy (nothing is bought)')
+    .action((options) => run(async () => {
+      const rows = await new VoiceSDK(new IndemnClient()).searchNumbers({ areaCode: options.areaCode, contains: options.contains, country: options.country, tollFree: Boolean(options.tollFree), limit: Number(options.limit) });
+      if (options.json) { printJson(rows); return; }
+      if (!rows.length) { console.log('No numbers available for that search.'); return; }
+      console.log(formatTable(['Number', 'E.164', 'Location', 'Voice / SMS'], rows.map((r) => [
+        String(r.friendlyName ?? ''), String(r.phoneNumber ?? ''), [r.locality, r.region].filter(Boolean).join(', '),
+        `${r.capabilities?.voice ? 'yes' : 'no'} / ${r.capabilities?.SMS ?? r.capabilities?.sms ? 'yes' : 'no'}`,
+      ])));
+      console.log(chalk.dim('Buy one with `indemn agents numbers buy <agent-id> <number>`. Buying costs the org money every month.'));
+    }));
+
+  numbers.command('get')
+    .argument('<agent-id>', 'Agent ID')
+    .description('The agent\'s phone number: location, type and voice settings')
+    .action((agentId: string) => run(async () => printJson(await new VoiceSDK(new IndemnClient()).numberDetails(agentId))));
+
+  numbers.command('buy')
+    .argument('<agent-id>', 'Voice agent to attach the number to')
+    .argument('<number>', 'A number from `agents numbers search`')
+    .option('--country <code>', 'US, CA, GB or AU', 'US')
+    .option('--toll-free', 'The number is toll-free')
+    .option('--yes', 'Do not ask for confirmation')
+    .option('--confirm-purchase', 'Required with --yes: you agree to buy this number')
+    .description('Buy an available number and attach it to a voice agent (costs money every month)')
+    .action((agentId: string, number: string, options) => run(async () => {
+      const phone = toE164(number, String(options.country).toUpperCase());
+      if (options.yes && !options.confirmPurchase) throw new CliError('Buying a number costs money: pass --confirm-purchase with --yes, or run without --yes to be asked.', EXIT.NEEDS_INPUT);
+      await confirmOrExit(`Buy ${phone} and attach it to agent ${agentId}? The org pays for it every month, and it cannot be undone from the CLI.`, Boolean(options.yes));
+      const res = await new VoiceSDK(new IndemnClient()).buyNumber(agentId, number, { country: options.country, tollFree: Boolean(options.tollFree) });
+      printSuccess(`Bought ${res.name ?? res.phone_number}${res.locality ? ` (${res.locality}, ${res.region})` : ''} and attached it to ${res.agent}. Its voice settings are the defaults.`);
+    }));
+
+  numbers.command('detach')
+    .argument('<agent-id>', 'Agent ID')
+    .argument('<phone-number>', 'Number to detach (the org keeps owning it)')
+    .option('--yes', 'Do not ask for confirmation')
+    .action((agentId: string, phone: string, options) => run(async () => {
+      await confirmOrExit(`Detach ${phone} from agent ${agentId}? Calls to it stop reaching the agent.`, Boolean(options.yes));
+      await new VoiceSDK(new IndemnClient()).detachNumber(agentId, phone);
+      printSuccess(`${phone} detached.`);
+    }));
+
+  agents.command('voice-preview')
+    .argument('<agent-id>', 'Agent ID')
+    .option('--json', 'Output as JSON')
+    .description('A browser link for a test voice call with the agent (marked as test, valid 1 hour)')
+    .action((agentId: string, options) => run(async () => {
+      const res = await new VoiceSDK(new IndemnClient()).voicePreview(agentId);
+      if (options.json) { printJson(res); return; }
+      console.log(res.join_url);
+      console.log(chalk.dim(`Test call room ${res.room_name}. The link carries a token valid for 1 hour; do not share it.`));
+    }));
+}

package/src/core/diff.ts

@@ -0,0 +1,52 @@
+export interface DiffLine {
+  op: ' ' | '+' | '-';
+  text: string;
+}
+
+/** Line diff by longest common subsequence. Very large inputs fall back to "all removed, all added". */
+export function lineDiff(before: string, after: string): DiffLine[] {
+  const a = before.split('\n');
+  const b = after.split('\n');
+  if (a.length * b.length > 4_000_000) {
+    return [...a.map((text) => ({ op: '-' as const, text })), ...b.map((text) => ({ op: '+' as const, text }))];
+  }
+  const lcs: number[][] = Array.from({ length: a.length + 1 }, () => new Array<number>(b.length + 1).fill(0));
+  for (let i = a.length - 1; i >= 0; i--) {
+    for (let j = b.length - 1; j >= 0; j--) {
+      lcs[i][j] = a[i] === b[j] ? lcs[i + 1][j + 1] + 1 : Math.max(lcs[i + 1][j], lcs[i][j + 1]);
+    }
+  }
+  const out: DiffLine[] = [];
+  let i = 0;
+  let j = 0;
+  while (i < a.length && j < b.length) {
+    if (a[i] === b[j]) { out.push({ op: ' ', text: a[i] }); i++; j++; }
+    else if (lcs[i + 1][j] >= lcs[i][j + 1]) out.push({ op: '-', text: a[i++] });
+    else out.push({ op: '+', text: b[j++] });
+  }
+  while (i < a.length) out.push({ op: '-', text: a[i++] });
+  while (j < b.length) out.push({ op: '+', text: b[j++] });
+  return out;
+}
+
+export function diffStats(diff: DiffLine[]): { added: number; removed: number } {
+  return { added: diff.filter((d) => d.op === '+').length, removed: diff.filter((d) => d.op === '-').length };
+}
+
+/** Changed lines with `context` unchanged lines around them, as unified-style text. */
+export function formatDiff(diff: DiffLine[], opts: { context?: number; maxLines?: number } = {}): string {
+  const context = opts.context ?? 2;
+  const keep = new Set<number>();
+  diff.forEach((d, i) => {
+    if (d.op !== ' ') for (let k = Math.max(0, i - context); k <= Math.min(diff.length - 1, i + context); k++) keep.add(k);
+  });
+  const lines: string[] = [];
+  let last = -1;
+  for (const i of [...keep].sort((x, y) => x - y)) {
+    if (last >= 0 && i > last + 1) lines.push('…');
+    lines.push(`${diff[i].op} ${diff[i].text}`);
+    last = i;
+  }
+  const max = opts.maxLines ?? Infinity;
+  return lines.length > max ? [...lines.slice(0, max), `… ${lines.length - max} more line(s)`].join('\n') : lines.join('\n');
+}

package/src/core/org-resolver.ts

@@ -0,0 +1,113 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import type { Environment } from '../sdk/types.js';
+import { CliError, EXIT, NeedsInputError } from './runtime.js';
+
+/** Where `indemn link` pins a project folder to one org and its agents. */
+export const LINK_RELATIVE_PATH = join('.indemn', 'project.json');
+
+export interface OrgChoice {
+  id: string;
+  name?: string;
+}
+
+export interface LinkFile {
+  org_id: string;
+  org_name?: string;
+  environment: Environment;
+  agents: string[];
+  /** Absolute path of the file, for messages. */
+  path: string;
+}
+
+export type OrgSource = 'flag' | 'env' | 'link' | 'single' | 'asked';
+
+export interface ResolvedOrg {
+  id: string;
+  source: OrgSource;
+  link: LinkFile | null;
+}
+
+/** Walk up from `startDir` to the filesystem root looking for `.indemn/project.json`. */
+export function findLinkFile(startDir: string = process.cwd()): LinkFile | null {
+  let dir = resolve(startDir);
+  for (;;) {
+    const candidate = join(dir, LINK_RELATIVE_PATH);
+    if (existsSync(candidate)) {
+      let raw: Partial<LinkFile>;
+      try {
+        raw = JSON.parse(readFileSync(candidate, 'utf8'));
+      } catch {
+        throw new CliError(`Cannot read ${candidate}. Fix the file or run \`indemn unlink\` in ${dir}.`);
+      }
+      if (!raw.org_id || (raw.environment !== 'dev' && raw.environment !== 'production')) {
+        throw new CliError(`${candidate} has no org_id or environment. Run \`indemn link\` again in ${dir}.`);
+      }
+      return {
+        org_id: raw.org_id,
+        org_name: raw.org_name,
+        environment: raw.environment,
+        agents: Array.isArray(raw.agents) ? raw.agents.map(String) : [],
+        path: candidate,
+      };
+    }
+    const parent = dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+
+function label(o: OrgChoice): string {
+  return o.name ? `${o.name}` : o.id;
+}
+
+/**
+ * Decide which org a command acts on. The saved config never decides.
+ * Order: the --org flag (or an MCP tool's org_id), INDEMN_ORG_ID from a host,
+ * the linked folder, the only org the user belongs to, otherwise ask.
+ */
+export async function resolveOrg(input: {
+  flag?: string;
+  envOrg?: string;
+  link: LinkFile | null;
+  environment: Environment;
+  memberships: () => Promise<OrgChoice[]>;
+  ask?: (choices: OrgChoice[]) => Promise<string | undefined>;
+}): Promise<ResolvedOrg> {
+  const { link } = input;
+  if (link && link.environment !== input.environment) {
+    throw new CliError(
+      `This folder is linked to ${link.environment} (${link.path}) but you are logged in to ${input.environment}. ` +
+        'Log in to the matching platform or run `indemn unlink`.',
+    );
+  }
+
+  const explicit = input.flag || input.envOrg;
+  if (explicit) {
+    if (link && link.org_id !== explicit) {
+      throw new CliError(
+        `This folder is linked to org ${link.org_name ?? link.org_id} (${link.path}); ` +
+          `refusing to act on ${explicit}. Remove --org, or run \`indemn unlink\` first.`,
+        EXIT.NEEDS_INPUT,
+      );
+    }
+    return { id: explicit, source: input.flag ? 'flag' : 'env', link };
+  }
+
+  if (link) return { id: link.org_id, source: 'link', link };
+
+  const orgs = await input.memberships();
+  if (orgs.length === 0) {
+    throw new CliError('You are not a member of any organization on this platform. Ask an admin to add you.');
+  }
+  if (orgs.length === 1) return { id: orgs[0].id, source: 'single', link: null };
+
+  if (input.ask) {
+    const chosen = await input.ask(orgs);
+    if (chosen && orgs.some((o) => o.id === chosen)) return { id: chosen, source: 'asked', link: null };
+  }
+  throw new NeedsInputError(
+    `You belong to ${orgs.length} organizations. Choose one with --org <id>, or pin this folder with \`indemn link --org <id>\`.`,
+    orgs.map((o) => ({ id: o.id, label: label(o) })),
+  );
+}