@indemn/cli 1.6.0 → 1.7.0

package/src/cli/functions.ts

@@ -1,7 +1,10 @@
 import { Command } from 'commander';
 import chalk from 'chalk';
 import ora from 'ora';
-import { readFileSync, existsSync } from 'node:fs';
+import { readFileSync, existsSync, writeFileSync } from 'node:fs';
+import { confirmOrExit } from './link.js';
+import { CliError, EXIT } from '../core/runtime.js';
+import { proposedSkills, resolveSecretArg, transferDestination } from '../sdk/skills.js';
 import { IndemnClient } from '../sdk/client.js';
 import { FunctionsSDK } from '../sdk/functions.js';
 import { formatTable, printJson, printError, printSuccess, confirm } from './utils/output.js';
@@ -82,19 +85,19 @@ function buildAuthorization(opts: ConfigSchemaOptions): Record<string, unknown>
     if (!opts.authKey || !opts.authValue) {
       throw new Error('--auth-key and --auth-value are required when --auth-type is api-key');
     }
-    return { type: 'api-key', key: opts.authKey, value: opts.authValue };
+    return { type: 'api-key', key: opts.authKey, value: resolveSecretArg('--auth-value', opts.authValue) };
   }
   if (authType === 'basic-auth') {
     if (!opts.authUsername || !opts.authPassword) {
       throw new Error('--auth-username and --auth-password are required when --auth-type is basic-auth');
     }
-    return { type: 'basic-auth', username: opts.authUsername, password: opts.authPassword };
+    return { type: 'basic-auth', username: opts.authUsername, password: resolveSecretArg('--auth-password', opts.authPassword) };
   }
   if (authType === 'bearer-token') {
     if (!opts.authToken) {
       throw new Error('--auth-token is required when --auth-type is bearer-token');
     }
-    return { type: 'bearer-token', token: opts.authToken };
+    return { type: 'bearer-token', token: resolveSecretArg('--auth-token', opts.authToken) };
   }
   return undefined;
 }
@@ -159,7 +162,8 @@ function buildConfigurationSchema(opts: ConfigSchemaOptions, type: string): Reco
   if (type === TRANSFER_CALL_TYPE) {
     // Server's validateTransferCallPayload requires `handoffNumber` (the destination
     // phone number for the call transfer). copilot-server/services/botToolsValidationService.js:52
-    if (opts.handoffNumber !== undefined) result.handoffNumber = opts.handoffNumber;
+    // Saved the way the dashboard saves it (phoneNumber + intlTelObj, or sipUri via --config).
+    if (opts.handoffNumber !== undefined) result.phoneNumber = opts.handoffNumber;
     if (opts.outputInstructions !== undefined) result.outputInstructions = opts.outputInstructions;
   }
 
@@ -178,16 +182,16 @@ function applyConfigSchemaOptions(cmd: Command): Command {
     .option('--no-craft-response', 'Return data directly without LLM crafting')
     .option('--auth-type <type>', 'Auth type: api-key | basic-auth | bearer-token | no-auth')
     .option('--auth-key <name>', 'Header name for api-key auth (e.g. X-API-Key)')
-    .option('--auth-value <value>', 'Header value for api-key auth')
+    .option('--auth-value <value>', 'Header value for api-key auth: @file, env:NAME or - (stdin) keep it out of shell history')
     .option('--auth-username <user>', 'Username for basic-auth')
-    .option('--auth-password <pass>', 'Password for basic-auth')
-    .option('--auth-token <token>', 'Token for bearer-token auth')
+    .option('--auth-password <pass>', 'Password for basic-auth: @file, env:NAME or - (stdin)')
+    .option('--auth-token <token>', 'Token for bearer-token auth: @file, env:NAME or - (stdin)')
     .option('--handoff-number <number>', 'Destination phone number for --type transfer_call (E.164, e.g. +15551234567)')
     .option('--config <path>', 'JSON file with full configurationSchema (individual flags override file values)');
 }
 
 export function registerFunctionCommands(program: Command): void {
-  const functions = program.command('functions').description('Manage agent functions/tools');
+  const functions = program.command('skills').alias('functions').description('Manage agent skills, the actions an agent can take (alias: functions)');
 
   functions
     .command('list')
@@ -263,8 +267,8 @@ export function registerFunctionCommands(program: Command): void {
 
         // For transfer_call on create, require handoffNumber (server validation rejects without it).
         if (options.type === TRANSFER_CALL_TYPE) {
-          if (!configurationSchema || !configurationSchema.handoffNumber) {
-            throw new Error('--handoff-number (or --config with handoffNumber) is required for --type transfer_call');
+          if (!configurationSchema || !(configurationSchema.phoneNumber || configurationSchema.handoffNumber || configurationSchema.sipUri)) {
+            throw new Error('--handoff-number (or --config with phoneNumber or sipUri) is required for --type transfer_call');
           }
         }
 
@@ -288,7 +292,7 @@ export function registerFunctionCommands(program: Command): void {
             finalFunc = await sdk.updateFunction(agentId, func._id, {
               type: options.type,
               description: options.description || '',
-              configurationSchema,
+              configurationSchema: options.type === TRANSFER_CALL_TYPE ? transferDestination({}, configurationSchema) : configurationSchema,
             });
           } catch (err) {
             spinner.fail(`Function created (${func._id}) but configuration step failed.`);
@@ -347,10 +351,10 @@ export function registerFunctionCommands(program: Command): void {
         // otherwise `update --endpoint X` would wipe everything else.
         const patch = buildConfigurationSchema(options, current.type);
         if (patch) {
-          input.configurationSchema = {
-            ...(current.configurationSchema || {}),
-            ...patch,
-          };
+          // A new transfer destination must replace the saved one of either kind (copilot prefers sipUri, then phoneNumber).
+          input.configurationSchema = current.type === TRANSFER_CALL_TYPE
+            ? transferDestination(current.configurationSchema || {}, patch)
+            : { ...(current.configurationSchema || {}), ...patch };
         }
 
         // Anything actually changing? type+description are always set; require at least one explicit option.
@@ -377,24 +381,20 @@ export function registerFunctionCommands(program: Command): void {
   functions
     .command('delete')
     .argument('<agent-id>', 'Agent ID')
-    .argument('<func-id>', 'Function ID')
-    .description('Delete a function')
-    .action(async (agentId: string, funcId: string) => {
+    .argument('<func-id>', 'Skill ID')
+    .option('--yes', 'Do not ask for confirmation')
+    .description('Delete a skill')
+    .action(async (agentId: string, funcId: string, options) => {
       try {
-        const confirmed = await confirm(`Delete function ${funcId}? This cannot be undone.`);
-        if (!confirmed) {
-          console.log('Cancelled.');
-          return;
-        }
-
         const client = new IndemnClient();
         const sdk = new FunctionsSDK(client);
-        const spinner = ora('Deleting function...').start();
-
+        const skill = (await sdk.listFunctions(agentId)).find((f) => f._id === funcId);
+        if (!skill) throw new Error(`Skill ${funcId} is not on agent ${agentId}.`);
+        await confirmOrExit(`Delete skill "${skill.name ?? skill.type}" (${funcId}) from agent ${agentId}?`, Boolean(options.yes));
+        const spinner = ora('Deleting skill...').start();
         await sdk.deleteFunction(agentId, funcId);
         spinner.stop();
-
-        printSuccess(`Function ${funcId} deleted.`);
+        printSuccess(`Skill ${funcId} deleted.`);
       } catch (err) {
         printError(err);
         process.exit(1);
@@ -466,18 +466,23 @@ export function registerFunctionCommands(program: Command): void {
   functions
     .command('import')
     .argument('<agent-id>', 'Agent ID')
-    .description('Import functions from a URL')
-    .requiredOption('--url <url>', 'URL to import from')
+    .description('Import skills from a URL. REPLACES every skill of the agent, including the built-in handoff and FAQ retriever')
+    .requiredOption('--url <url>', 'URL of a skills JSON file (made by `skills export`); copilot downloads it itself')
+    .option('--yes', 'Do not ask for confirmation')
     .action(async (agentId: string, options) => {
       try {
         const client = new IndemnClient();
         const sdk = new FunctionsSDK(client);
-        const spinner = ora('Importing functions...').start();
-
+        const current = await sdk.listFunctions(agentId);
+        const builtIn = current.filter((f) => ['human_handoff', 'faqs-retriever'].includes(f.type)).length;
+        await confirmOrExit(
+          `Replace all ${current.length} skill(s) of agent ${agentId} (${builtIn} built-in) with the file's skills? There is no undo; export first with \`indemn skills export ${agentId}\`.`,
+          Boolean(options.yes),
+        );
+        const spinner = ora('Importing skills...').start();
         const result = await sdk.importFunctions(agentId, options.url);
         spinner.stop();
-
-        printSuccess('Functions imported successfully.');
+        printSuccess('Skills imported.');
         printJson(result);
       } catch (err) {
         printError(err);
@@ -485,6 +490,63 @@ export function registerFunctionCommands(program: Command): void {
       }
     });
 
+  functions
+    .command('generate')
+    .argument('<agent-id>', 'Agent ID')
+    .description('Propose skills from an API document or pasted text. Creates nothing unless --create')
+    .option('--file <path>', 'Document to read (for example an API description)')
+    .option('--text <text>', 'Text to read instead of a file')
+    .option('-o, --output <file>', 'Save the proposal to review and edit, then use `skills bulk-create --file`')
+    .option('--create', 'Create the proposed skills right away')
+    .option('--yes', 'With --create: do not ask for confirmation')
+    .action(async (agentId: string, options) => {
+      try {
+        if (!options.file && !options.text) throw new CliError('Give --file <path> or --text <text>.', EXIT.NEEDS_INPUT);
+        const client = new IndemnClient();
+        const sdk = new FunctionsSDK(client);
+        const spinner = ora('Reading the document...').start();
+        const proposal = await sdk.generateFromDoc(agentId, { filePath: options.file, text: options.text });
+        spinner.stop();
+        const skills = proposedSkills(proposal);
+        if (options.output) {
+          writeFileSync(options.output, JSON.stringify({ functions: skills ?? proposal }, null, 2) + '\n');
+          printSuccess(`Wrote ${options.output} (${skills?.length ?? 'unknown number of'} skill(s)).`);
+        }
+        if (!options.create) {
+          if (!options.output) printJson(proposal);
+          return;
+        }
+        if (!skills?.length) throw new CliError('Could not find a list of skills in the answer. Save it with -o, fix it, then use `skills bulk-create --file`.');
+        await confirmOrExit(`Create ${skills.length} skill(s) on agent ${agentId}?`, Boolean(options.yes));
+        const created = await sdk.bulkCreate(agentId, skills);
+        printSuccess(`Created ${created.length} skill(s).`);
+      } catch (err) {
+        printError(err);
+        process.exit(1);
+      }
+    });
+
+  functions
+    .command('bulk-create')
+    .argument('<agent-id>', 'Agent ID')
+    .requiredOption('--file <path>', 'JSON: { "functions": [...] } or a list of skills')
+    .option('--yes', 'Do not ask for confirmation')
+    .description('Create several skills at once (names are checked first; a failure part-way can leave some created)')
+    .action(async (agentId: string, options) => {
+      try {
+        const raw = JSON.parse(readFileSync(options.file, 'utf8')) as unknown;
+        const skills = proposedSkills(raw);
+        if (!skills?.length) throw new CliError(`${options.file} has no list of skills.`);
+        const sdk = new FunctionsSDK(new IndemnClient());
+        await confirmOrExit(`Create ${skills.length} skill(s) on agent ${agentId}?`, Boolean(options.yes));
+        const created = await sdk.bulkCreate(agentId, skills);
+        printSuccess(`Created ${created.length} skill(s).`);
+      } catch (err) {
+        printError(err);
+        process.exit(1);
+      }
+    });
+
   const params = functions.command('params').description('Manage function parameters');
 
   params
@@ -516,6 +578,7 @@ export function registerFunctionCommands(program: Command): void {
     .requiredOption('--type <type>', 'Parameter type (e.g. string, number, boolean)')
     .option('--description <desc>', 'Parameter description')
     .option('--required', 'Mark as required')
+    .option('--allowed-values <list>', 'Fixed choices, comma-separated (shown as buttons)')
     .action(async (agentId: string, funcId: string, options) => {
       try {
         const client = new IndemnClient();
@@ -524,6 +587,7 @@ export function registerFunctionCommands(program: Command): void {
         const result = await sdk.addParameter(agentId, funcId, {
           name: options.name, type: options.type,
           description: options.description, required: options.required || false,
+          allowedValues: options.allowedValues ? String(options.allowedValues).split(',').map((v: string) => v.trim()).filter(Boolean) : undefined,
         });
         spinner.stop();
         // Server returns array of upserted params; extract the first one
@@ -542,6 +606,7 @@ export function registerFunctionCommands(program: Command): void {
     .option('--type <type>', 'Parameter type')
     .option('--description <desc>', 'Parameter description')
     .option('--required', 'Mark as required')
+    .option('--allowed-values <list>', 'New fixed choices, comma-separated ("" removes them)')
     .action(async (agentId: string, funcId: string, paramId: string, options) => {
       try {
         const input: Record<string, unknown> = {};
@@ -549,6 +614,7 @@ export function registerFunctionCommands(program: Command): void {
         if (options.type) input.type = options.type;
         if (options.description) input.description = options.description;
         if (options.required !== undefined) input.required = options.required;
+        if (options.allowedValues !== undefined) input.allowedValues = String(options.allowedValues).split(',').map((v: string) => v.trim()).filter(Boolean);
         if (Object.keys(input).length === 0) { printError('No options provided.'); process.exit(1); }
         const client = new IndemnClient();
         const sdk = new FunctionsSDK(client);
@@ -564,11 +630,11 @@ export function registerFunctionCommands(program: Command): void {
     .argument('<agent-id>', 'Agent ID')
     .argument('<func-id>', 'Function ID')
     .argument('<param-id>', 'Parameter ID')
-    .description('Delete a function parameter')
-    .action(async (agentId: string, funcId: string, paramId: string) => {
+    .description('Delete a skill parameter')
+    .option('--yes', 'Do not ask for confirmation')
+    .action(async (agentId: string, funcId: string, paramId: string, options) => {
       try {
-        const confirmed = await confirm(`Delete parameter ${paramId}?`);
-        if (!confirmed) { console.log('Cancelled.'); return; }
+        await confirmOrExit(`Delete parameter ${paramId} of skill ${funcId}?`, Boolean(options.yes));
         const client = new IndemnClient();
         const sdk = new FunctionsSDK(client);
         const spinner = ora('Deleting parameter...').start();

package/src/cli/index.ts

@@ -11,16 +11,29 @@ import { registerKBCommands } from './kb.js';
 import { registerEvalCommands } from './eval.js';
 import { registerChatCommand } from './chat.js';
 import { registerOrgCommands } from './org.js';
-import { printBanner } from './utils/output.js';
+import { registerLinkCommands } from './link.js';
+import { registerConversationCommands } from './conversations.js';
+import { registerVoiceCommands } from './voice.js';
+import { registerDistributionCommands } from './distribution.js';
+import { registerAnalyticsCommands } from './analytics.js';
+import { registerTicketCommands } from './tickets.js';
+import { registerBillingCommands } from './billing.js';
+import { registerCampaignCommands } from './campaigns.js';
+import { registerPlatformCommands } from './platform.js';
+import { registerInitCommand } from './init.js';
+import { askMfaInTerminal, askOrgInTerminal, installBanner } from './utils/output.js';
+import { setAskers, setOrgFlag } from '../core/scope.js';
+import { cliVersion, isNonInteractive } from '../core/runtime.js';
 
 const program = new Command();
 
 program
   .name('indemn')
   .description('CLI for managing Indemn AI agents')
-  .version('1.5.0');
+  .version(cliVersion());
 
-program.option('--env <environment>', 'Environment (dev or production)');
+program.option('--debug', 'Print every request and response status to stderr');
+program.option('--org <id>', 'Organization to act on (otherwise: linked folder, your only org, or you are asked)');
 program.option('--no-banner', 'Suppress the active-org banner');
 
 // Commands that already surface org identity themselves — no banner needed.
@@ -30,7 +43,10 @@ const BANNER_SKIP = new Set([
   'whoami',
   'init',
   'org list',
+  'org current',
   'org switch',
+  'link',
+  'unlink',
   'mcp serve',
 ]);
 
@@ -47,8 +63,15 @@ function fullCommandName(cmd: Command): string {
 // Hook runs before any command action
 program.hook('preAction', async (thisCommand, actionCommand) => {
   const globalOpts = thisCommand.opts();
-  if (globalOpts.env) {
-    process.env.INDEMN_ENV = globalOpts.env;
+  // The environment is fixed by `indemn login --env`; there is no per-command switch.
+  if (globalOpts.debug) {
+    process.env.INDEMN_DEBUG = '1';
+  }
+  setOrgFlag(globalOpts.org);
+
+  // Ask in the terminal only when a person can answer; agents and CI get exit code 2 instead.
+  if (fullCommandName(actionCommand) !== 'mcp serve' && !isNonInteractive()) {
+    setAskers({ chooseOrg: askOrgInTerminal, mfaCode: askMfaInTerminal });
   }
 
   // Banner suppression: global flag, env var, command opts-out, or JSON output mode.
@@ -58,18 +81,45 @@ program.hook('preAction', async (thisCommand, actionCommand) => {
   if (actionOpts.json) return;
   if (BANNER_SKIP.has(fullCommandName(actionCommand))) return;
 
-  await printBanner();
+  installBanner();
 });
 
 // Register all command groups
 registerAuthCommands(program);
+// Groups other modules extend (org, agents) are registered first.
+registerOrgCommands(program);
+registerLinkCommands(program);
 registerAgentCommands(program);
 registerConfigCommands(program);
 registerFunctionCommands(program);
 registerKBCommands(program);
 registerEvalCommands(program);
 registerChatCommand(program);
-registerOrgCommands(program);
+registerConversationCommands(program);
+registerVoiceCommands(program);
+registerDistributionCommands(program);
+registerAnalyticsCommands(program);
+registerTicketCommands(program);
+registerBillingCommands(program);
+registerCampaignCommands(program);
+registerPlatformCommands(program);
+
+program
+  .command('channels')
+  .description('Channels an agent can be published on')
+  .command('list')
+  .description('List channels')
+  .option('--json', 'Output as JSON')
+  .action(async (options) => {
+    const { IndemnClient } = await import('../sdk/client.js');
+    const { OrgsSDK } = await import('../sdk/orgs.js');
+    const { formatTable, printJson, printError } = await import('./utils/output.js');
+    try {
+      const channels = await new OrgsSDK(new IndemnClient()).listChannels();
+      if (options.json) { printJson(channels); return; }
+      console.log(formatTable(['ID', 'Name', 'Type', 'Description'], channels.map((c) => [c._id, c.name, c.type ?? '', c.description ?? ''])));
+    } catch (err) { printError(err); process.exit(1); }
+  });
 
 // MCP serve command
 const mcp = program.command('mcp').description('MCP server commands');
@@ -102,53 +152,6 @@ program
     } catch (err) { printError(err); process.exit(1); }
   });
 
-// Init command — set up Claude Code integration
-program
-  .command('init')
-  .description('Set up Claude Code skills in the current project')
-  .option('--force', 'Overwrite existing files')
-  .action(async (options) => {
-    const __filename = fileURLToPath(import.meta.url);
-    const __dirname = dirname(__filename);
-    const packageRoot = resolve(__dirname, '..', '..');
-    const skillsSource = join(packageRoot, 'skills');
-    const cwd = process.cwd();
-    const skillsTarget = join(cwd, '.claude', 'skills', 'indemn');
-    const rulesTarget = join(cwd, '.claude', 'rules');
-
-    if (existsSync(skillsTarget) && !options.force) {
-      console.log('Indemn skills already installed. Use --force to overwrite.');
-      return;
-    }
-
-    // Copy skills
-    mkdirSync(skillsTarget, { recursive: true });
-    cpSync(skillsSource, skillsTarget, { recursive: true });
-
-    // Write rules file
-    mkdirSync(rulesTarget, { recursive: true });
-    const rulesPath = join(rulesTarget, 'indemn.md');
-    if (!existsSync(rulesPath) || options.force) {
-      writeFileSync(rulesPath, [
-        '# Indemn CLI',
-        '',
-        'The `indemn` CLI is available for managing AI agents. Run `indemn whoami` to verify authentication.',
-        '',
-        '## Skills',
-        '',
-        '- **agent-builder** — Create, configure, and test agents (prompts, functions, knowledge bases, chat)',
-        '- **evaluations** — Create rubrics and test sets, run evaluations, analyze results, export reports',
-        '',
-        'Use these skills for any agent management or evaluation task. They contain the complete command reference.',
-        '',
-      ].join('\n'));
-    }
-
-    console.log('Indemn CLI integration set up:');
-    console.log(`  Skills:  ${skillsTarget}/`);
-    console.log(`  Rules:   ${rulesPath}`);
-    console.log('');
-    console.log('Claude Code will now discover the indemn skills automatically.');
-  });
+registerInitCommand(program);
 
 program.parse();

package/src/cli/init.ts

@@ -0,0 +1,154 @@
+import { Command } from 'commander';
+import chalk from 'chalk';
+import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { TOOL_META } from '../mcp/tool-meta.js';
+import { IndemnClient } from '../sdk/client.js';
+import { findLinkFile } from '../core/org-resolver.js';
+import { printError, printSuccess } from './utils/output.js';
+
+export const MCP_SERVER_ENTRY = { command: 'npx', args: ['-y', '@indemn/cli', 'mcp', 'serve'] };
+
+/** Claude Code permission rules: read-only tools run without asking, anything that changes the platform asks every time. */
+export function permissionBlock(): { allow: string[]; ask: string[] } {
+  const allow: string[] = [];
+  const ask: string[] = [];
+  for (const [name, meta] of Object.entries(TOOL_META)) {
+    const rule = `mcp__indemn__${name}`;
+    if (meta.annotations.readOnlyHint && !meta.guard) allow.push(rule);
+    else ask.push(rule);
+  }
+  return { allow: allow.sort(), ask: ask.sort() };
+}
+
+function readJson(path: string): Record<string, any> {
+  if (!existsSync(path)) return {};
+  try {
+    return JSON.parse(readFileSync(path, 'utf8'));
+  } catch {
+    throw new Error(`${path} is not valid JSON; fix it or move it away, then run init again.`);
+  }
+}
+
+const RULES = `# Indemn CLI
+
+The \`indemn\` CLI and its MCP server manage Indemn AI agents. Run \`indemn whoami\` to see the platform (dev or production), the user and which org commands here act on.
+
+- Every chat with an agent is a test conversation: never billed, never in analytics, shown with the tester's name.
+- Actions that change or delete something are approved by the user first. When an approval form appears, that form is the question: call the tool and do not ask again in chat. When a tool returns a dry_run instead, show it and pass confirm: true only after the user agreed to that exact change.
+- If a tool returns needs_input (for example which org), ask the user and call again with their answer.
+- Talk in names: call agents, knowledge bases, test sets and runs by their names; show ids only when asked or to tell two items apart. Plain words, short answers, details on request.
+
+## Skills
+
+- **agent-builder**: create, configure and test agents (prompt, skills, knowledge bases, voice, chat).
+- **evaluations**: rubrics, test sets, runs, CI gates, reports.
+`;
+
+export interface InitReport {
+  skills: string;
+  rules: string;
+  mcp: 'added' | 'kept' | 'skipped';
+  permissions: 'added' | 'merged' | 'skipped';
+}
+
+/** Set up Claude Code in `cwd`. Existing files are merged, never overwritten, unless force is set for skills and rules. */
+export function initProject(cwd: string, opts: { force?: boolean; mcp?: boolean; permissions?: boolean; packageRoot?: string } = {}): InitReport {
+  const packageRoot = opts.packageRoot ?? resolve(dirname(fileURLToPath(import.meta.url)), '..', '..');
+  // Claude Code finds project skills at .claude/skills/<name>/SKILL.md, one folder per skill.
+  const skillsTarget = join(cwd, '.claude', 'skills');
+  for (const skill of readdirSync(join(packageRoot, 'skills'), { withFileTypes: true }).filter((d) => d.isDirectory())) {
+    const target = join(skillsTarget, skill.name);
+    if (!existsSync(target) || opts.force) {
+      mkdirSync(target, { recursive: true });
+      cpSync(join(packageRoot, 'skills', skill.name), target, { recursive: true });
+    }
+  }
+  const rulesPath = join(cwd, '.claude', 'rules', 'indemn.md');
+  if (!existsSync(rulesPath) || opts.force) {
+    mkdirSync(dirname(rulesPath), { recursive: true });
+    writeFileSync(rulesPath, RULES);
+  }
+
+  let mcp: InitReport['mcp'] = 'skipped';
+  if (opts.mcp !== false) {
+    const path = join(cwd, '.mcp.json');
+    const cfg = readJson(path);
+    cfg.mcpServers = cfg.mcpServers ?? {};
+    if (cfg.mcpServers.indemn) {
+      mcp = 'kept';
+    } else {
+      cfg.mcpServers.indemn = MCP_SERVER_ENTRY;
+      writeFileSync(path, JSON.stringify(cfg, null, 2) + '\n');
+      mcp = 'added';
+    }
+  }
+
+  let permissions: InitReport['permissions'] = 'skipped';
+  if (opts.permissions !== false) {
+    const path = join(cwd, '.claude', 'settings.json');
+    const cfg = readJson(path);
+    const had = Boolean(cfg.permissions);
+    cfg.permissions = cfg.permissions ?? {};
+    const block = permissionBlock();
+    const denied = new Set<string>(cfg.permissions.deny ?? []);
+    const askSet = new Set<string>([...(cfg.permissions.ask ?? []), ...block.ask]);
+    // A tool the user already restricted is never loosened.
+    const allowSet = new Set<string>([...(cfg.permissions.allow ?? []), ...block.allow.filter((r) => !askSet.has(r) && !denied.has(r))]);
+    cfg.permissions.allow = [...allowSet].sort();
+    cfg.permissions.ask = [...askSet].filter((r) => !denied.has(r)).sort();
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, JSON.stringify(cfg, null, 2) + '\n');
+    permissions = had ? 'merged' : 'added';
+  }
+  return { skills: skillsTarget, rules: rulesPath, mcp, permissions };
+}
+
+/** What is set up in `cwd`, for `indemn init --status`. */
+export function initStatus(cwd: string): Array<[string, boolean, string]> {
+  const mcp = readJson(join(cwd, '.mcp.json'));
+  const settings = readJson(join(cwd, '.claude', 'settings.json'));
+  const login = IndemnClient.loadConfig();
+  let link: string | null = null;
+  try { link = findLinkFile(cwd)?.path ?? null; } catch { link = null; }
+  return [
+    ['Skills', existsSync(join(cwd, '.claude', 'skills', 'agent-builder', 'SKILL.md')), '.claude/skills/agent-builder, evaluations'],
+    ['Rules', existsSync(join(cwd, '.claude', 'rules', 'indemn.md')), '.claude/rules/indemn.md'],
+    ['MCP server', Boolean(mcp.mcpServers?.indemn), '.mcp.json'],
+    ['Permissions', (settings.permissions?.ask ?? []).some((r: string) => r.startsWith('mcp__indemn__')), '.claude/settings.json'],
+    ['Logged in', Boolean(login), login ? `${login.email ?? login.user_id} on ${login.environment}` : 'run `indemn login`'],
+    ['Folder linked', Boolean(link), link ?? 'optional: `indemn link --org <id>`'],
+  ];
+}
+
+export function registerInitCommand(program: Command): void {
+  program
+    .command('init')
+    .description('Set up Claude Code here: skills, rules, the MCP server in .mcp.json, and permissions (reads allowed, changes ask)')
+    .option('--force', 'Overwrite the installed skills and rules')
+    .option('--no-mcp', 'Do not add the MCP server to .mcp.json')
+    .option('--no-permissions', 'Do not add permission rules to .claude/settings.json')
+    .option('--status', 'Show what is set up and stop')
+    .action((options) => {
+      try {
+        const cwd = process.cwd();
+        if (options.status) {
+          for (const [what, ok, detail] of initStatus(cwd)) console.log(`${ok ? chalk.green('✓') : chalk.yellow('·')} ${what.padEnd(14)} ${chalk.dim(detail)}`);
+          return;
+        }
+        const r = initProject(cwd, { force: options.force, mcp: options.mcp, permissions: options.permissions });
+        printSuccess('Indemn CLI set up for Claude Code:');
+        console.log(`  Skills:      ${r.skills}`);
+        console.log(`  Rules:       ${r.rules}`);
+        console.log(`  MCP server:  ${r.mcp === 'added' ? 'added to .mcp.json' : r.mcp === 'kept' ? 'already in .mcp.json (kept)' : 'skipped'}`);
+        console.log(`  Permissions: ${r.permissions === 'skipped' ? 'skipped' : `${r.permissions} in .claude/settings.json (reads allowed, changes ask)`}`);
+        const login = IndemnClient.loadConfig();
+        if (!login) console.log(chalk.yellow('Next: run `indemn login --env dev` (or production).'));
+        else if ((login.orgs?.length ?? 0) > 1 && !findLinkFile(cwd)) console.log(chalk.dim('Tip: pin this folder to one org with `indemn link --org <id>`.'));
+      } catch (err) {
+        printError(err);
+        process.exit(1);
+      }
+    });
+}