@indemn/cli 1.5.0 → 1.7.0

package/test/sdk/eval.test.ts

@@ -0,0 +1,155 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { on, recordFetch } from '../helpers/fetch-recorder.js';
+import { cleanEnv, useTempHome } from '../helpers/config-home.js';
+import { jwtExpiringIn } from '../helpers/jwt.js';
+import { connectPair } from '../helpers/mcp-pair.js';
+import { IndemnClient } from '../../src/sdk/client.js';
+import { EvalSDK, gateVerdict } from '../../src/sdk/eval.js';
+import { registerTools } from '../../src/mcp/tools.js';
+import type { EvaluationRun } from '../../src/sdk/types.js';
+
+const ORG = 'aaaaaaaaaaaaaaaaaaaaaaaa';
+const AGENT = '111111111111111111111111';
+const FOREIGN = '999999999999999999999999';
+const run = (over: Partial<EvaluationRun>): EvaluationRun => ({ run_id: 'r1', status: 'completed', total: 10, passed: 9, ...over });
+
+describe('CI gate verdict (same rules as eval_gate.py)', () => {
+  it('passes above the threshold and fails below it', () => {
+    expect(gateVerdict(run({}), { minPassRate: 0.9 })).toMatchObject({ pass: true, passRate: 0.9 });
+    expect(gateVerdict(run({}), { minPassRate: 0.95 }).reasons).toEqual(['pass rate 0.900 < 0.95']);
+  });
+  it('blocks a failed run unless the policy is warn', () => {
+    expect(gateVerdict(run({ status: 'failed' }), {}).reasons).toEqual(['run status=failed']);
+    expect(gateVerdict(run({ status: 'failed' }), { errorPolicy: 'warn' }).pass).toBe(true);
+  });
+  it('fails an empty run, slow runs, and errored cases when asked', () => {
+    expect(gateVerdict(run({ total: 0, passed: 0 }), {}).reasons).toEqual(['no cases evaluated']);
+    expect(gateVerdict(run({ latency: { p95_ms: 9000 } }), { maxP95Ms: 5000 }).reasons).toEqual(['p95 latency 9000 > 5000']);
+    expect(gateVerdict(run({ errors: 2 }), { failOnError: true }).reasons).toEqual(['2 case(s) errored']);
+  });
+});
+
+describe('evaluations stay inside the org', () => {
+  let home: ReturnType<typeof useTempHome>;
+  beforeEach(() => {
+    cleanEnv();
+    home = useTempHome();
+    vi.spyOn(process, 'cwd').mockReturnValue(home.dir);
+    IndemnClient.saveConfig({ environment: 'dev', user_id: 'u1', session: { token: jwtExpiringIn(5 * 3_600_000) }, orgs: [{ id: ORG, name: 'QA A' }] });
+  });
+  afterEach(() => home.cleanup());
+
+  const agents = [
+    on('GET', `/v2/bots/${AGENT}`, { json: [{ _id: AGENT, name: 'Bot' }] }),
+    on('GET', `/v2/bots/${FOREIGN}`, { status: 404, text: 'nope' }),
+  ];
+
+  it('refuses to read a run of another org\'s agent', async () => {
+    recordFetch([...agents, on('GET', '/api/v1/runs/r9', { json: { run_id: 'r9', agent_id: FOREIGN, status: 'completed' } })]);
+    await expect(new EvalSDK(new IndemnClient()).getRunInOrg('r9')).rejects.toThrow(/not in the organization/);
+  });
+
+  it('MCP run_evaluation asks first, refuses a foreign agent, and turns a date range into transcript mode', async () => {
+    const { calls } = recordFetch([
+      ...agents,
+      on('GET', '/api/v1/test-sets/ts1', { json: { test_set_id: 'ts1', agent_id: AGENT, items: [{}, {}] } }),
+      on('POST', '/api/v1/evaluations', { json: { run_id: 'r1', status: 'pending', total: 2 } }),
+    ]);
+    const pair = await connectPair((server) => { registerTools(server, new IndemnClient()); });
+    const dry = await pair.call('run_evaluation', { bot_id: AGENT, test_set_id: 'ts1' });
+    expect(dry.body.dry_run).toBe(true);
+    expect(dry.body.would).toMatch(/paid model calls and cannot be cancelled/);
+
+    const foreign = await pair.call('run_evaluation', { bot_id: FOREIGN, test_set_id: 'ts1', confirm: true });
+    expect(foreign.isError).toBe(true);
+    expect(calls.some((c) => c.url.endsWith('/api/v1/evaluations'))).toBe(false);
+
+    await pair.call('run_evaluation', { bot_id: AGENT, test_set_id: 'ts1', date_from: '2026-09-01', date_to: '2026-09-28', confirm: true });
+    const trigger = calls.find((c) => c.url.endsWith('/api/v1/evaluations'))!;
+    expect(trigger.body).toMatchObject({ bot_id: AGENT, test_set_id: 'ts1', date_from: '2026-09-01', date_to: '2026-09-28', mode: 'transcript' });
+    await pair.close();
+  });
+
+  it('MCP lists rubrics and test sets only for an agent of the org', async () => {
+    const { calls } = recordFetch([...agents, on('GET', '/api/v1/rubrics', { json: [] }), on('GET', '/api/v1/test-sets', { json: [] })]);
+    const pair = await connectPair((server) => { registerTools(server, new IndemnClient()); });
+    for (const tool of ['list_rubrics', 'list_test_sets']) {
+      expect((await pair.call(tool, {})).isError, tool).toBe(true);
+      expect((await pair.call(tool, { agent_id: FOREIGN })).isError, tool).toBe(true);
+      expect((await pair.call(tool, { agent_id: AGENT })).isError, tool).toBeFalsy();
+    }
+    const listed = calls.filter((c) => /\/api\/v1\/(rubrics|test-sets)/.test(c.url));
+    expect(listed).toHaveLength(2);
+    expect(listed.every((c) => c.url.includes(`agent_id=${AGENT}`))).toBe(true);
+    await pair.close();
+  });
+
+  it('MCP rubric and test-set lists take org_id with several orgs, and never report "which org?" as a foreign agent', async () => {
+    const TWO = 'cccccccccccccccccccccccc';
+    IndemnClient.saveConfig({ environment: 'dev', user_id: 'u1', session: { token: jwtExpiringIn(5 * 3_600_000) }, orgs: [{ id: ORG, name: 'QA A' }, { id: TWO, name: 'QA B' }] });
+    const { calls } = recordFetch([...agents, on('GET', '/api/v1/rubrics', { json: [] }), on('GET', '/api/v1/test-sets', { json: [] })]);
+    await expect(new EvalSDK(new IndemnClient()).assertAgentInOrg(AGENT)).rejects.not.toThrow(/not in the organization/);
+    const pair = await connectPair((server) => { registerTools(server, new IndemnClient()); });
+    for (const tool of ['list_rubrics', 'list_test_sets']) {
+      const res = await pair.call(tool, { agent_id: AGENT, org_id: ORG });
+      expect(res.isError, tool).toBeFalsy();
+    }
+    expect(calls.filter((c) => c.url.includes(`/organization/${ORG}/ai-studio/v2/bots/${AGENT}`))).toHaveLength(2);
+    await pair.close();
+  });
+
+  it('MCP rubric and test-set tools act only on items of an agent in this org, and deletes ask first', async () => {
+    const { calls } = recordFetch([...agents,
+      on('GET', '/api/v1/rubrics/r-foreign', { json: { rubric_id: 'r-foreign', agent_id: FOREIGN } }),
+      on('GET', '/api/v1/test-sets/t-own', { json: { test_set_id: 't-own', agent_id: AGENT } }),
+      on('DELETE', '/api/v1/test-sets/t-own', { json: {} }),
+    ]);
+    const pair = await connectPair((server) => { registerTools(server, new IndemnClient()); });
+    expect((await pair.call('get_rubric', { rubric_id: 'r-foreign' })).isError).toBe(true);
+    expect((await pair.call('delete_rubric', { rubric_id: 'r-foreign', confirm: true })).isError).toBe(true);
+    expect((await pair.call('create_rubric', { name: 'x', rules: [], agent_id: FOREIGN })).isError).toBe(true);
+    expect((await pair.call('delete_test_set', { test_set_id: 't-own' })).body.dry_run).toBe(true);
+    await pair.call('delete_test_set', { test_set_id: 't-own', confirm: true });
+    expect(calls.filter((c) => c.method === 'DELETE').map((c) => c.url)).toEqual([expect.stringContaining('/api/v1/test-sets/t-own')]);
+    await pair.close();
+  });
+
+  it('MCP run_evaluation takes agent_id like every other tool (bot_id still works)', async () => {
+    const { calls } = recordFetch([...agents, on('GET', '/api/v1/test-sets/ts1', { json: { test_set_id: 'ts1', agent_id: AGENT, items: [{}] } }),
+      on('POST', '/api/v1/evaluations', { json: { run_id: 'r1' } })]);
+    const pair = await connectPair((server) => { registerTools(server, new IndemnClient()); });
+    expect(String((await pair.call('run_evaluation', { test_set_id: 'ts1', confirm: true })).body)).toMatch(/Give agent_id/);
+    await pair.call('run_evaluation', { agent_id: AGENT, test_set_id: 'ts1', confirm: true });
+    expect(calls.filter((c) => c.method === 'POST').map((c) => c.body)).toEqual([expect.objectContaining({ bot_id: AGENT, test_set_id: 'ts1' })]);
+    await pair.close();
+  });
+
+  it('MCP get_eval_status waits for a running run instead of being called every few seconds', async () => {
+    vi.useFakeTimers({ toFake: ['setTimeout', 'Date'] });
+    let polls = 0;
+    const { calls } = recordFetch([...agents, on('GET', '/runs/r1', () => {
+      polls += 1;
+      return { json: { run_id: 'r1', agent_id: AGENT, status: polls < 3 ? 'running' : 'completed' } };
+    })]);
+    const pair = await connectPair((server) => { registerTools(server, new IndemnClient()); });
+    const pending = pair.call('get_eval_status', { run_id: 'r1' });
+    await vi.advanceTimersByTimeAsync(10_000);
+    const res = await pending;
+    vi.useRealTimers();
+    expect(res.body.data.status).toBe('completed');
+    expect(polls).toBe(3);
+    expect(calls.filter((c) => c.url.includes('/v2/bots/')).length).toBe(1);  // org checked once
+    const now = await pair.call('get_eval_status', { run_id: 'r1', wait_seconds: 0 });
+    expect(now.body.data.status).toBe('completed');
+    await pair.close();
+  });
+
+  it('MCP run_evaluation refuses a test set written for another agent', async () => {
+    recordFetch([...agents, on('GET', '/api/v1/test-sets/ts2', { json: { test_set_id: 'ts2', agent_id: 'someone-else', items: [{}] } })]);
+    const pair = await connectPair((server) => { registerTools(server, new IndemnClient()); });
+    const res = await pair.call('run_evaluation', { bot_id: AGENT, test_set_id: 'ts2', confirm: true });
+    expect(res.isError).toBe(true);
+    expect(JSON.stringify(res.raw.content)).toContain('written for agent someone-else');
+    await pair.close();
+  });
+});

package/test/sdk/kb-upload.test.ts

@@ -0,0 +1,50 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { mkdtempSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { on, recordFetch } from '../helpers/fetch-recorder.js';
+import { cleanEnv, useTempHome } from '../helpers/config-home.js';
+import { jwtExpiringIn } from '../helpers/jwt.js';
+import { IndemnClient } from '../../src/sdk/client.js';
+import { KBSDK } from '../../src/sdk/kb.js';
+
+const ORG = 'aaaaaaaaaaaaaaaaaaaaaaaa';
+
+describe('adding a document to a knowledge base', () => {
+  let home: ReturnType<typeof useTempHome>;
+  let dir: string;
+  beforeEach(() => {
+    cleanEnv();
+    home = useTempHome();
+    vi.spyOn(process, 'cwd').mockReturnValue(home.dir);
+    IndemnClient.saveConfig({ environment: 'dev', user_id: 'u1', session: { token: jwtExpiringIn(5 * 3_600_000) }, orgs: [{ id: ORG, name: 'QA A' }] });
+    dir = mkdtempSync(join(tmpdir(), 'indemn-kbfile-'));
+  });
+  afterEach(() => home.cleanup());
+
+  it('uploads to the org file store, then imports from the signed link (like the dashboard)', async () => {
+    const pdf = join(dir, 'Evaluation Report.pdf');
+    writeFileSync(pdf, '%PDF-1.4 test');
+    const { calls } = recordFetch([
+      on('POST', '/files/upload-org', { json: { url: 'https://s3/plain.pdf', signedUrl: 'https://s3/signed.pdf?sig=1' } }),
+      on('POST', '/knowledge-bases/kb1/import', { json: { success: true, data: { _id: 'job1', status: 'started' } } }),
+    ]);
+    await new KBSDK(new IndemnClient()).uploadFile('kb1', pdf);
+    const upload = new URL(calls[0].url);
+    expect(upload.pathname).toBe(`/api/organization/${ORG}/files/upload-org`);
+    expect(upload.searchParams.get('generateSignedUrl')).toBe('true');
+    expect(calls.some((c) => c.url.includes('upload-urls'))).toBe(false);
+    expect(calls[1].body).toEqual({ type: 'file', sources: [{ name: 'Evaluation Report.pdf', file_type: 'pdf', url: 'https://s3/signed.pdf?sig=1' }] });
+  });
+
+  it('refuses unsupported types and files over 10 MB before uploading', async () => {
+    const png = join(dir, 'logo.png');
+    writeFileSync(png, 'x');
+    const { calls } = recordFetch();
+    await expect(new KBSDK(new IndemnClient()).uploadFile('kb1', png)).rejects.toThrow(/Unsupported file type/);
+    const big = join(dir, 'big.pdf');
+    writeFileSync(big, Buffer.alloc(10 * 1024 * 1024 + 1));
+    await expect(new KBSDK(new IndemnClient()).uploadFile('kb1', big)).rejects.toThrow(/limit is 10 MB/);
+    expect(calls).toHaveLength(0);
+  });
+});

package/test/sdk/kb.test.ts

@@ -0,0 +1,95 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { on, recordFetch } from '../helpers/fetch-recorder.js';
+import { cleanEnv, useTempHome } from '../helpers/config-home.js';
+import { jwtExpiringIn } from '../helpers/jwt.js';
+import { connectPair } from '../helpers/mcp-pair.js';
+import { IndemnClient } from '../../src/sdk/client.js';
+import { KBSDK } from '../../src/sdk/kb.js';
+import { registerTools } from '../../src/mcp/tools.js';
+
+const ORG = 'aaaaaaaaaaaaaaaaaaaaaaaa';
+
+describe('knowledge bases', () => {
+  let home: ReturnType<typeof useTempHome>;
+  beforeEach(() => {
+    cleanEnv();
+    home = useTempHome();
+    vi.spyOn(process, 'cwd').mockReturnValue(home.dir);
+    IndemnClient.saveConfig({ environment: 'dev', user_id: 'u1', session: { token: jwtExpiringIn(5 * 3_600_000) }, orgs: [{ id: ORG, name: 'QA A' }] });
+  });
+  afterEach(() => home.cleanup());
+  const sdk = () => new KBSDK(new IndemnClient());
+
+  it('imports a website with the source shape the dashboard sends', async () => {
+    const { calls } = recordFetch([on('POST', '/knowledge-bases/kb1/import', { json: { success: true, data: {} } })]);
+    await sdk().scrapeUrl('kb1', 'https://www.acme.test/faq', 'selected');
+    await sdk().scrapeUrl('kb1', 'https://www.acme.test');
+    const [one, full] = calls.filter((c) => c.url.endsWith('/import')).map((c) => c.body);
+    expect(one).toEqual({ type: 'url', manual: false, sources: [{ url: 'https://www.acme.test', crawl_mode: 'selected', selected_urls: ['https://www.acme.test/faq'], exclude_urls: [], js_script: '' }] });
+    expect(full).toEqual({ type: 'url', manual: false, sources: [{ url: 'https://www.acme.test', crawl_mode: 'full', selected_urls: [], exclude_urls: [], js_script: '' }] });
+  });
+
+  it('creates with the uppercase type copilot stores', async () => {
+    const { calls } = recordFetch([on('POST', '/knowledge-bases', { json: { success: true, data: { _id: 'kb1' } } })]);
+    await sdk().createKB({ name: 'FAQ', type: 'qna' } as never);
+    expect(calls[0].body).toEqual({ name: 'FAQ', type: 'QNA' });
+  });
+
+  it('treats an import that copilot reports as success but whose job failed as a failure', async () => {
+    recordFetch([on('POST', '/import', { json: { success: true, data: { status: 'error', message: 'unreachable url' } } })]);
+    await expect(sdk().importKB('kb1', { type: 'url', sources: [{ url: 'https://x' }] })).rejects.toThrow('Import failed: unreachable url');
+  });
+
+  it('re-imports a source and fails loudly the same way', async () => {
+    const { calls } = recordFetch([on('PUT', '/data-source/ds1/re-import', { json: { success: true, data: { status: 'error', message: 'not a url' } } })]);
+    await expect(sdk().reimport('kb1', 'ds1')).rejects.toThrow('Re-import failed: not a url');
+    expect(calls[0].body).toEqual({});
+  });
+
+  it('reads scrape status from the knowledge base sources', async () => {
+    recordFetch([on('GET', '/knowledge-bases/kb1', { json: { success: true, data: [{ _id: 'kb1', fileWebSources: [
+      { _id: 's1', source: 'https://a', status: 'pending', source_details: { id_scrape_request: { status: 'started' } } },
+      { _id: 's2', source: 'b.pdf', status: 'failed', error_message: 'bad pdf' },
+    ] }] } })]);
+    expect(await sdk().scrapeStatus('kb1')).toEqual([
+      { id: 's1', source: 'https://a', status: 'pending', job_status: 'started', error: undefined, completed_at: undefined },
+      { id: 's2', source: 'b.pdf', status: 'failed', job_status: undefined, error: 'bad pdf', completed_at: undefined },
+    ]);
+  });
+
+  it('asks for gaps with 0-based pages and test conversations excluded by default', async () => {
+    const { calls } = recordFetch([on('GET', '/unanswered/embeddings', { json: { success: true, data: { responses: [] } } })]);
+    await sdk().gaps({ agentId: 'b1' });
+    const q = new URL(calls[0].url).searchParams;
+    expect(Object.fromEntries(q)).toEqual({ page: '0', limit: '20', isDismissed: 'false', isTestMode: 'false', id_bot: 'b1' });
+  });
+
+  it('MCP lists knowledge bases by page, with a source count instead of every crawled page', async () => {
+    const pages = Array.from({ length: 3000 }, (_, i) => ({ url: `https://acme.test/p${i}`, status: 'done' }));
+    recordFetch([on('GET', '/knowledge-bases', { json: Array.from({ length: 12 }, (_, i) => ({ _id: `kb${i}`, name: `KB ${i}`, fileWebSources: pages, kbSampleFaqs: ['q'] })) })]);
+    const pair = await connectPair((server) => { registerTools(server, new IndemnClient()); });
+    const res = await pair.call('list_knowledge_bases', { limit: 5, page: 3 });
+    expect(res.body.data).toMatchObject({ page: 3, limit: 5, total: 12, has_more: false });
+    const link = (id: string) => expect.stringMatching(new RegExp(`/#/organization/[^/]+/ai-studio/knowledge-base/${id}$`));
+    expect(res.body.data.items).toEqual([{ _id: 'kb10', name: 'KB 10', sources: 3000, url: link('kb10') }, { _id: 'kb11', name: 'KB 11', sources: 3000, url: link('kb11') }]);
+    await pair.close();
+  });
+
+  it('MCP delete tools wait for confirmation', async () => {
+    const { calls } = recordFetch([
+      on('GET', '/knowledge-bases/kb1', { json: { success: true, data: { _id: 'kb1', name: 'Coverage FAQ' } } }),
+      on('GET', '/v2/bots/b1', { json: [{ _id: 'b1', name: 'Wedding Bot' }] }),
+    ]);
+    const pair = await connectPair((server) => { registerTools(server, new IndemnClient()); });
+    for (const [tool, args] of [
+      ['delete_knowledge_base', { kb_id: 'kb1' }],
+      ['delete_kb_data', { kb_id: 'kb1', source_id: 's1' }],
+      ['unlink_kb', { agent_id: 'b1', kb_id: 'kb1' }],
+    ] as const) {
+      const res = await pair.call(tool, args);
+      expect(res.body.dry_run, tool).toBe(true);
+    }
+    expect(calls.filter((c) => c.method !== 'GET')).toHaveLength(0); // only name lookups
+    await pair.close();
+  });
+});

package/test/sdk/orgs.test.ts

@@ -0,0 +1,48 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { on, recordFetch } from '../helpers/fetch-recorder.js';
+import { cleanEnv, useTempHome } from '../helpers/config-home.js';
+import { jwtExpiringIn } from '../helpers/jwt.js';
+import { IndemnClient } from '../../src/sdk/client.js';
+import { OrgsSDK } from '../../src/sdk/orgs.js';
+
+const A = 'aaaaaaaaaaaaaaaaaaaaaaaa';
+
+describe('OrgsSDK', () => {
+  let home: ReturnType<typeof useTempHome>;
+  beforeEach(() => {
+    cleanEnv();
+    home = useTempHome();
+    IndemnClient.saveConfig({ environment: 'dev', user_id: 'u1', session: { token: jwtExpiringIn(5 * 3_600_000) }, orgs: [] });
+  });
+  afterEach(() => home.cleanup());
+
+  it('lists orgs and refreshes the saved list', async () => {
+    recordFetch([on('GET', '/organization', { json: { success: true, userOrganizations: [{ _id: A, name: 'QA A', active: true }] } })]);
+    await expect(new OrgsSDK(new IndemnClient()).listOrganizations()).resolves.toEqual([{ id: A, name: 'QA A' }]);
+    expect(IndemnClient.loadConfig()?.orgs).toEqual([{ id: A, name: 'QA A' }]);
+  });
+
+  it('lists members once per person with only safe fields', async () => {
+    const user = { _id: 'u9', email: 'x@y.z', firstname: 'Ada', lastname: 'L', password: 'hash' };
+    recordFetch([on('GET', `/organization/${A}/projects-users`, {
+      json: { success: true, projectUsers: [
+        { role: 'owner', status: 'active', id_user: user, id_project: { name: 'P1' } },
+        { role: 'owner', status: 'active', id_user: user, id_project: { name: 'P2' } },
+      ] },
+    })]);
+    const members = await new OrgsSDK(new IndemnClient({ orgId: A })).listMembers();
+    expect(members).toEqual([{ user_id: 'u9', email: 'x@y.z', name: 'Ada L', role: 'owner', status: 'active', projects: ['P1', 'P2'] }]);
+    expect(JSON.stringify(members)).not.toContain('hash');
+  });
+
+  it('treats copilot "no members" as an empty list', async () => {
+    recordFetch([on('GET', '/projects-users', { json: { success: false, message: 'Projects and users not found for the given organization.' } })]);
+    await expect(new OrgsSDK(new IndemnClient({ orgId: A })).listMembers()).resolves.toEqual([]);
+  });
+
+  it('lists channels', async () => {
+    const { calls } = recordFetch([on('GET', '/ai-studio/channels', { json: { success: true, data: [{ _id: 'c1', name: 'WEB', type: 'web' }] } })]);
+    await expect(new OrgsSDK(new IndemnClient({ orgId: A })).listChannels()).resolves.toEqual([{ _id: 'c1', name: 'WEB', type: 'web', description: undefined }]);
+    expect(new URL(calls[0].url).pathname).toBe(`/api/organization/${A}/ai-studio/channels`);
+  });
+});

package/test/sdk/platform.test.ts

@@ -0,0 +1,89 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { WebSocketServer } from 'ws';
+import type { AddressInfo } from 'node:net';
+import { on, recordFetch } from '../helpers/fetch-recorder.js';
+import { cleanEnv, useTempHome } from '../helpers/config-home.js';
+import { fakeJwt } from '../helpers/jwt.js';
+import { IndemnClient } from '../../src/sdk/client.js';
+import { PlatformSDK } from '../../src/sdk/platform.js';
+import { jarvisChat } from '../../src/sdk/jarvis-chat.js';
+
+const ORG = 'aaaaaaaaaaaaaaaaaaaaaaaa';
+const USER = '555555555555555555555555';
+
+describe('V2 platform and Jarvis', () => {
+  let home: ReturnType<typeof useTempHome>;
+  let token: string;
+  beforeEach(() => {
+    cleanEnv();
+    home = useTempHome();
+    vi.spyOn(process, 'cwd').mockReturnValue(home.dir);
+    token = fakeJwt({ _id: USER, email: 'qa@indemn.ai', exp: Math.floor(Date.now() / 1000) + 5 * 3600 });
+    IndemnClient.saveConfig({ environment: 'dev', user_id: USER, session: { token }, orgs: [{ id: ORG, name: 'QA A' }] });
+  });
+  afterEach(() => home.cleanup());
+
+  it('lists with the bare session token and the org header', async () => {
+    const { calls } = recordFetch([on('GET', 'devplatform.indemn.ai/api/v1/templates', { json: [] })]);
+    await new PlatformSDK(new IndemnClient()).list('templates');
+    expect(calls[0].headers).toMatchObject({ authorization: `Bearer ${token}`, 'x-organization-id': ORG });
+  });
+
+  it('never writes to the shared component or connector catalogs', async () => {
+    const { calls } = recordFetch();
+    await expect(new PlatformSDK(new IndemnClient()).create('components', { name: 'x' })).rejects.toMatchObject({ exitCode: 2 });
+    await expect(new PlatformSDK(new IndemnClient()).remove('connectors', 'c1')).rejects.toThrow(/only reads/);
+    expect(calls).toHaveLength(0);
+  });
+
+  it('checks the agent is visible to the org before running a simulation', async () => {
+    const { calls } = recordFetch([on('GET', '/agents/a9', { status: 403, json: { detail: 'Access denied' } })]);
+    await expect(new PlatformSDK(new IndemnClient()).runSimulation('a9')).rejects.toThrow(/Access denied/);
+    expect(calls.some((c) => c.url.includes('/simulations/run'))).toBe(false);
+  });
+
+  it('creates a Jarvis job and waits until it completes', async () => {
+    let polls = 0;
+    const { calls } = recordFetch([
+      on('POST', '/jarvis/jobs', { json: { job_id: 'jarvis_job_1', status: 'pending' } }),
+      on('GET', '/jarvis/jobs/jarvis_job_1', () => ({ json: { job_id: 'jarvis_job_1', status: ++polls < 2 ? 'running' : 'completed', progress: { results: [{ bot_id: 'b1', success: true }] } } })),
+    ]);
+    const sdk = new PlatformSDK(new IndemnClient());
+    const job = await sdk.createJarvisJob(['b1']);
+    expect(calls[0].body).toEqual({ job_type: 'baseline_generation', bot_ids: ['b1'] });
+    expect((await sdk.waitForJarvisJob(job.job_id, { intervalMs: 5 })).status).toBe('completed');
+  });
+
+  it('chats with Jarvis over the WebSocket: thread from a new conversation, reply until done, tools deduplicated', async () => {
+    const wss = new WebSocketServer({ port: 0, host: '127.0.0.1' });
+    const seen: { url?: string; auth?: string; sent?: any } = {};
+    wss.on('connection', (socket, req) => {
+      seen.url = req.url;
+      seen.auth = req.headers.authorization;
+      socket.on('message', (raw) => {
+        const msg = JSON.parse(String(raw));
+        if (msg.type !== 'jarvis') return;
+        seen.sent = msg;
+        const tool = (id: string, status: string) => socket.send(JSON.stringify({ type: 'jarvis_tool', payload: { event: status === 'running' ? 'start' : 'end', tool_call: { id, name: 'list_templates', status } } }));
+        tool('llm-1', 'running');
+        tool('uuid-2', 'running');
+        tool('uuid-2', 'success');
+        socket.send(JSON.stringify({ type: 'jarvis_chunk', payload: { id: 'r', content: 'Hello', done: false } }));
+        socket.send(JSON.stringify({ type: 'jarvis_chunk', payload: { id: 'r', content: ' world', done: false } }));
+        socket.send(JSON.stringify({ type: 'jarvis_chunk', payload: { id: 'r', content: '', done: true } }));
+      });
+    });
+    await new Promise((r) => wss.once('listening', r));
+    vi.stubEnv('INDEMN_PLATFORM_WS_URL', `ws://127.0.0.1:${(wss.address() as AddressInfo).port}/ws`);
+    recordFetch([on('POST', '/conversations', { json: { conversation_id: 'conv_1' } })]);
+
+    const res = await jarvisChat(new IndemnClient(), 'Which templates exist?', { context: { federation_bot_id: 'b1' } });
+    expect(res).toEqual({ conversation_id: 'conv_1', reply: 'Hello world', tools: [{ name: 'list_templates', status: 'success' }] });
+    const q = new URL(`ws://x${seen.url}`).searchParams;
+    expect(q.get('user_id')).toBe(USER);
+    expect(q.get('organization_id')).toBe(ORG);
+    expect(seen.sent.payload).toEqual({ content: 'Which templates exist?', thread_id: 'conv_1', context: { federation_bot_id: 'b1' } });
+    expect(seen.auth).toBe(`Bearer ${token}`);
+    await new Promise((r) => wss.close(r));
+  });
+});

package/test/sdk/renewal.test.ts

@@ -0,0 +1,115 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { on, recordFetch } from '../helpers/fetch-recorder.js';
+import { cleanEnv, useTempHome } from '../helpers/config-home.js';
+import { jwtExpiringIn } from '../helpers/jwt.js';
+import { IndemnClient } from '../../src/sdk/client.js';
+import { setAskers } from '../../src/core/scope.js';
+import { SessionExpiredError } from '../../src/core/runtime.js';
+
+const ORG = 'aaaaaaaaaaaaaaaaaaaaaaaa';
+const BOTS = `/organization/${ORG}/ai-studio/v2/bots`;
+
+function login(token: string, refresh = 'r1') {
+  IndemnClient.saveConfig({
+    environment: 'dev', user_id: 'u1', email: 'qa@indemn.ai',
+    session: { token, refresh_token: refresh }, orgs: [{ id: ORG, name: 'QA A' }],
+  });
+}
+
+describe('session renewal', () => {
+  let home: ReturnType<typeof useTempHome>;
+  beforeEach(() => { cleanEnv(); home = useTempHome(); setAskers({}); });
+  afterEach(() => home.cleanup());
+
+  it('sends the saved session to copilot with the JWT scheme', async () => {
+    const token = jwtExpiringIn(5 * 3_600_000);
+    login(token);
+    const { calls } = recordFetch();
+    await new IndemnClient().copilotGet(BOTS);
+    expect(calls).toHaveLength(1);
+    expect(calls[0].headers.authorization).toBe(`JWT ${token}`);
+  });
+
+  it('renews silently under an hour of life, revokes the old token, then sends the request', async () => {
+    const old = jwtExpiringIn(30 * 60_000);
+    const fresh = jwtExpiringIn(24 * 3_600_000, { jti: 'new' });
+    login(old);
+    const { calls } = recordFetch([
+      on('POST', 'securetoken.googleapis.com', { json: { id_token: 'id2', refresh_token: 'r2' } }),
+      on('POST', '/auth/firebase/signin', { json: { success: true, token: `JWT ${fresh}`, user: { _id: 'u1' } } }),
+      on('POST', '/auth/firebase/logout', { json: { success: true } }),
+    ]);
+    await new IndemnClient().copilotGet(BOTS);
+    expect(calls.map((c) => `${c.method} ${new URL(c.url).pathname}`)).toEqual([
+      'POST /v1/token',
+      'POST /api/auth/firebase/signin',
+      'POST /api/auth/firebase/logout',
+      `GET /api${BOTS}`,
+    ]);
+    expect(calls[2].headers.authorization).toBe(`JWT ${old}`);
+    expect(calls[3].headers.authorization).toBe(`JWT ${fresh}`);
+    expect(IndemnClient.loadConfig()?.session).toMatchObject({ token: fresh, refresh_token: 'r2' });
+  });
+
+  it('with MFA and nobody to ask, stops with exit 3 and never sends the request', async () => {
+    login(jwtExpiringIn(10 * 60_000));
+    const { calls } = recordFetch([
+      on('POST', 'securetoken', { json: { id_token: 'id2', refresh_token: 'r2' } }),
+      on('POST', '/auth/firebase/signin', { json: { success: true, requiresMfa: true, mfaSessionId: 's1' } }),
+    ]);
+    const err = await new IndemnClient().copilotGet(BOTS).catch((e) => e);
+    expect(err).toBeInstanceOf(SessionExpiredError);
+    expect(err.exitCode).toBe(3);
+    expect(calls.some((c) => c.url.includes('/ai-studio/'))).toBe(false);
+  });
+
+  it('with MFA and a way to ask, asks once and continues', async () => {
+    login(jwtExpiringIn(10 * 60_000));
+    const ask = vi.fn(async () => '123456');
+    setAskers({ mfaCode: ask });
+    const fresh = jwtExpiringIn(24 * 3_600_000);
+    recordFetch([
+      on('POST', 'securetoken', { json: { id_token: 'id2', refresh_token: 'r2' } }),
+      on('POST', '/auth/firebase/signin', { json: { success: true, requiresMfa: true, mfaSessionId: 's1' } }),
+      on('POST', '/auth/firebase/mfa/verify', { json: { success: true, token: `JWT ${fresh}`, user: { _id: 'u1' } } }),
+    ]);
+    await new IndemnClient().copilotGet(BOTS);
+    expect(ask).toHaveBeenCalledTimes(1);
+    expect(IndemnClient.loadConfig()?.session?.token).toBe(fresh);
+  });
+
+  it('re-reads the saved login on every request', async () => {
+    login(jwtExpiringIn(5 * 3_600_000, { n: 1 }));
+    const { calls } = recordFetch();
+    const client = new IndemnClient();
+    await client.copilotGet(BOTS);
+    const second = jwtExpiringIn(5 * 3_600_000, { n: 2 });
+    login(second);
+    await client.copilotGet(BOTS);
+    expect(calls[1].headers.authorization).toBe(`JWT ${second}`);
+  });
+
+  it('on a 401 renews once and retries once; a second 401 means log in again', async () => {
+    login(jwtExpiringIn(5 * 3_600_000));
+    let gets = 0;
+    const { calls } = recordFetch([
+      on('GET', '/ai-studio/', () => (++gets === 1 ? { status: 401, text: 'revoked' } : { json: { success: true, data: [] } })),
+      on('POST', 'securetoken', { json: { id_token: 'id2', refresh_token: 'r2' } }),
+      on('POST', '/auth/firebase/signin', { json: { success: true, token: `JWT ${jwtExpiringIn(24 * 3_600_000)}`, user: { _id: 'u1' } } }),
+    ]);
+    await expect(new IndemnClient().copilotGet(BOTS)).resolves.toEqual([]);
+    expect(calls.filter((c) => c.url.includes('/ai-studio/'))).toHaveLength(2);
+
+    recordFetch([
+      on('GET', '/ai-studio/', { status: 401, text: 'revoked' }),
+      on('POST', 'securetoken', { json: { id_token: 'id3', refresh_token: 'r3' } }),
+      on('POST', '/auth/firebase/signin', { json: { success: true, token: `JWT ${jwtExpiringIn(24 * 3_600_000)}`, user: { _id: 'u1' } } }),
+    ]);
+    await expect(new IndemnClient().copilotGet(BOTS)).rejects.toBeInstanceOf(SessionExpiredError);
+  });
+
+  it('with no login at all, exits 3', async () => {
+    recordFetch();
+    await expect(new IndemnClient().copilotGet(BOTS)).rejects.toMatchObject({ exitCode: 3 });
+  });
+});

package/test/sdk/session.test.ts

@@ -0,0 +1,60 @@
+import { describe, expect, it, vi } from 'vitest';
+import { on, recordFetch } from '../helpers/fetch-recorder.js';
+import { fakeJwt, jwtExpiringIn } from '../helpers/jwt.js';
+import { exchangeIdToken, needsRenewal, refreshIdToken, tokenExpiry } from '../../src/sdk/session.js';
+import { FIREBASE_CONFIGS } from '../../src/sdk/auth.js';
+import { SessionExpiredError } from '../../src/core/runtime.js';
+
+describe('token expiry', () => {
+  it('reads exp from the token', () => {
+    expect(tokenExpiry(fakeJwt({ exp: 1_900_000_000 }))?.toISOString()).toBe(new Date(1_900_000_000_000).toISOString());
+    expect(tokenExpiry(fakeJwt({}))).toBeNull();
+  });
+
+  it('renews under one hour of life, not with five hours, never without an expiry', () => {
+    expect(needsRenewal({ token: jwtExpiringIn(30 * 60_000) })).toBe(true);
+    expect(needsRenewal({ token: jwtExpiringIn(5 * 3_600_000) })).toBe(false);
+    expect(needsRenewal({ token: fakeJwt({}) })).toBe(false);
+    expect(needsRenewal({ token: fakeJwt({}), expires_at: new Date(Date.now() - 1000).toISOString() })).toBe(true);
+  });
+});
+
+describe('refreshIdToken', () => {
+  it('posts the refresh token to Google with the environment web key', async () => {
+    const { calls } = recordFetch([on('POST', 'securetoken.googleapis.com', { json: { id_token: 'id2', refresh_token: 'r2' } })]);
+    await expect(refreshIdToken('dev', 'r1')).resolves.toEqual({ idToken: 'id2', refreshToken: 'r2' });
+    expect(calls[0].url).toBe(`https://securetoken.googleapis.com/v1/token?key=${FIREBASE_CONFIGS.dev.apiKey}`);
+    expect(calls[0].body).toBe('grant_type=refresh_token&refresh_token=r1');
+  });
+
+  it('turns a rejected refresh token into a log-in-again error', async () => {
+    recordFetch([on('POST', 'securetoken', { status: 400, json: { error: { message: 'TOKEN_EXPIRED' } } })]);
+    const err = await refreshIdToken('production', 'dead').catch((e) => e);
+    expect(err).toBeInstanceOf(SessionExpiredError);
+    expect(err.exitCode).toBe(3);
+  });
+});
+
+describe('exchangeIdToken', () => {
+  it('returns the copilot token without the JWT prefix', async () => {
+    const post = vi.fn(async () => ({ token: 'JWT abc', user: { _id: 'u1', email: 'qa@indemn.ai' } }));
+    await expect(exchangeIdToken(post as never, 'id1')).resolves.toEqual({ token: 'abc', userId: 'u1', email: 'qa@indemn.ai' });
+    expect(post).toHaveBeenCalledWith('/auth/firebase/signin', { idToken: 'id1' });
+  });
+
+  it('asks for the MFA code and verifies it', async () => {
+    const post = vi.fn()
+      .mockResolvedValueOnce({ requiresMfa: true, mfaSessionId: 's1' })
+      .mockResolvedValueOnce({ token: 'JWT def', user: { _id: 'u1' } });
+    const ask = vi.fn(async () => ' 123456 ');
+    await expect(exchangeIdToken(post as never, 'id1', ask)).resolves.toMatchObject({ token: 'def' });
+    expect(post).toHaveBeenLastCalledWith('/auth/firebase/mfa/verify', { sessionId: 's1', code: '123456' });
+  });
+
+  it('cannot complete MFA without a way to ask', async () => {
+    const post = vi.fn(async () => ({ requiresMfa: true, mfaSessionId: 's1' }));
+    const err = await exchangeIdToken(post as never, 'id1').catch((e) => e);
+    expect(err).toBeInstanceOf(SessionExpiredError);
+    expect(err.message).toMatch(/indemn login.*terminal/);
+  });
+});