@indemn/cli 1.6.0 → 1.7.0

package/test/mcp/registry.test.ts

@@ -0,0 +1,169 @@
+import { describe, expect, it, vi } from 'vitest';
+import { z } from 'zod/v3';
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { createRegistry, fitForm } from '../../src/mcp/registry.js';
+import type { ToolMeta } from '../../src/mcp/tool-meta.js';
+import { NeedsInputError } from '../../src/core/runtime.js';
+import { connectPair } from '../helpers/mcp-pair.js';
+
+const meta: Record<string, ToolMeta> = {
+  wipe: {
+    title: 'Wipe thing',
+    guard: true,
+    describe: (a) => `This will delete thing ${a.id}.`,
+    annotations: { destructiveHint: true, readOnlyHint: false },
+  },
+  look: { title: 'Look at thing', annotations: { readOnlyHint: true } },
+  pick: { title: 'Pick org', annotations: { readOnlyHint: true } },
+};
+
+function setup(handler = vi.fn(async () => ({ content: [{ type: 'text' as const, text: JSON.stringify({ ok: true }) }] }))) {
+  return {
+    handler,
+    register: (server: Parameters<typeof createRegistry>[0]) => {
+      const reg = createRegistry(server, { context: () => ({ org_id: 'org1', environment: 'dev' }), meta });
+      reg.tool('wipe', 'Delete a thing', { id: z.string() }, handler);
+      reg.tool('look', 'Read a thing', {}, handler);
+      reg.tool('pick', 'Needs a choice', {}, async () => { throw new NeedsInputError('Which org?', [{ id: 'a', label: 'A' }]); });
+    },
+  };
+}
+
+describe('registry', () => {
+  it('refuses a tool with no metadata', () => {
+    const reg = createRegistry(new McpServer({ name: 't', version: '0' }), { context: () => ({ environment: 'dev' }), meta });
+    expect(() => reg.tool('mystery', 'x', {}, vi.fn())).toThrow(/no entry in tool-meta/);
+  });
+
+  it('wraps results with the org and platform that answered', async () => {
+    const { register } = setup();
+    const pair = await connectPair(register);
+    const res = await pair.call('look');
+    expect(res.body).toEqual({ context: { org_id: 'org1', environment: 'dev' }, data: { ok: true } });
+    await pair.close();
+  });
+
+  it('turns a needed choice into needs_input instead of an error', async () => {
+    const { register } = setup();
+    const pair = await connectPair(register);
+    const res = await pair.call('pick');
+    expect(res.isError).toBe(false);
+    expect(res.body).toMatchObject({ needs_input: true, message: 'Which org?', choices: [{ id: 'a', label: 'A' }] });
+    expect(res.body.to_proceed).toMatch(/org_id/);
+    await pair.close();
+  });
+
+  it('tells an MCP caller to pass org_id, not the CLI flag', async () => {
+    const pair = await connectPair((server) => {
+      const reg = createRegistry(server, { context: () => ({ environment: 'dev' }), meta });
+      reg.tool('pick', 'Needs a choice', {}, async () => {
+        throw new NeedsInputError('You belong to 2 organizations. Choose one with --org <id>, or pin this folder with `indemn link --org <id>`.', [{ id: 'a', label: 'A' }]);
+      });
+    });
+    const res = await pair.call('pick');
+    expect(res.body.message).toBe('You belong to 2 organizations. Call again with org_id set to one of the ids below, or pin this folder with `indemn link --org <id>`.');
+    await pair.close();
+  });
+
+  it('returns a dry run and makes no call without confirm', async () => {
+    const { register, handler } = setup();
+    const pair = await connectPair(register);
+    const res = await pair.call('wipe', { id: 't1' });
+    expect(res.body).toMatchObject({ dry_run: true, action: 'wipe', would: 'This will delete thing t1. Platform: dev.' });
+    expect(handler).not.toHaveBeenCalled();
+    await pair.close();
+  });
+
+  it('makes exactly one call with confirm: true', async () => {
+    const { register, handler } = setup();
+    const pair = await connectPair(register);
+    await pair.call('wipe', { id: 't1', confirm: true });
+    expect(handler).toHaveBeenCalledTimes(1);
+    await pair.close();
+  });
+
+  it('asks the person through elicitation and ignores a self-set confirm', async () => {
+    const { register, handler } = setup();
+    const pair = await connectPair(register, { elicit: () => ({ action: 'decline' }) });
+    const res = await pair.call('wipe', { id: 't1', confirm: true });
+    expect(res.body).toMatchObject({ cancelled: true, reason: expect.stringMatching(/^The person pressed Decline: they chose not to make this change\. Nothing was changed\. .*do not call this tool again/) });
+    expect(handler).not.toHaveBeenCalled();
+    expect(pair.questions[0].message).toBe('This will delete thing t1. Platform: dev. Proceed?');
+    await pair.close();
+  });
+
+  it('names things in the approval instead of showing their ids', async () => {
+    const handler = vi.fn(async () => ({ content: [{ type: 'text' as const, text: '{}' }] }));
+    const pair = await connectPair((server) => {
+      const reg = createRegistry(server, {
+        context: () => ({ environment: 'dev' }), meta,
+        resolveOrg: async () => ({ id: 'org1' }),
+        displayNames: async (args, orgId) => ({ names: { [String(args.id)]: 'Garden party', [String(orgId)]: 'Rudra-Dev' } }),
+      });
+      reg.tool('wipe', 'Delete a thing', { id: z.string() }, handler);
+    }, { elicit: () => ({ action: 'decline' }) });
+    await pair.call('wipe', { id: 't1' });
+    expect(pair.questions[0].message).toBe('This will delete thing "Garden party". Org: Rudra-Dev. Platform: dev. Proceed?');
+    await pair.close();
+  });
+
+  it('asks nothing about a thing that does not exist', async () => {
+    const handler = vi.fn(async () => ({ content: [{ type: 'text' as const, text: '{}' }] }));
+    const pair = await connectPair((server) => {
+      const reg = createRegistry(server, {
+        context: () => ({ environment: 'dev' }), meta,
+        displayNames: async () => ({ names: {}, missing: ['skill lc_123'] }),
+      });
+      reg.tool('wipe', 'Delete a thing', { id: z.string() }, handler);
+    }, { elicit: () => ({ action: 'accept', content: { confirm: true } }) });
+    const res = await pair.call('wipe', { id: 'lc_123' });
+    expect(res.isError).toBe(true);
+    expect(String(res.body)).toMatch(/Not found: skill lc_123\. Nothing was changed and nothing was asked/);
+    expect(pair.questions).toHaveLength(0);
+    expect(handler).not.toHaveBeenCalled();
+    await pair.close();
+  });
+
+  it('says why when the host cancels at once (Claude Code in -p mode)', async () => {
+    const { register, handler } = setup();
+    const pair = await connectPair(register, { elicit: () => ({ action: 'cancel' }) });
+    const res = await pair.call('wipe', { id: 't1', confirm: true });
+    expect(res.body.reason).toMatch(/cannot show it.*confirm: true does not help/);
+    expect(handler).not.toHaveBeenCalled();
+    await pair.close();
+  });
+
+  it('keeps the approval form short enough to show its Proceed box', async () => {
+    const long = { ...meta, wipe: { ...meta.wipe, describe: () => Array.from({ length: 30 }, (_, i) => `line ${i} ${'x'.repeat(400)}`).join('\n') } };
+    const pair = await connectPair((server) => {
+      const reg = createRegistry(server, { context: () => ({ environment: 'dev' }), meta: long });
+      reg.tool('wipe', 'Delete a thing', { id: z.string() }, vi.fn(async () => ({ content: [{ type: 'text' as const, text: '{}' }] })));
+    }, { elicit: () => ({ action: 'decline' }) });
+    await pair.call('wipe', { id: 't1' });
+    const message = pair.questions[0].message as string;
+    expect(message.split('\n').length).toBeLessThanOrEqual(10);
+    expect(message).toMatch(/Shortened to fit/);
+    expect(message).toMatch(/Platform: dev\. Proceed\?$/);
+    const warning = `This will BUY +13312173972 from Twilio and attach it to agent X. ${'The org pays for it every month, and it cannot be undone from here. '.repeat(3)}`;
+    expect(fitForm(warning)).toBe(warning);
+    await pair.close();
+  });
+
+  it('proceeds when the person accepts', async () => {
+    const { register, handler } = setup();
+    const pair = await connectPair(register, { elicit: () => ({ action: 'accept', content: { confirm: true } }) });
+    const res = await pair.call('wipe', { id: 't1' });
+    expect(handler).toHaveBeenCalledTimes(1);
+    expect(res.body.context.approved_by_person).toBe(true);
+    await pair.close();
+  });
+
+  it('changes nothing when the approval form cannot be shown, even with a self-set confirm', async () => {
+    const { register, handler } = setup();
+    const pair = await connectPair(register, { elicit: () => { throw new Error('the form could not open'); } });
+    const res = await pair.call('wipe', { id: 't1', confirm: true });
+    expect(res.body).toMatchObject({ cancelled: true, reason: expect.stringMatching(/could not be shown, so nothing was changed/) });
+    expect(handler).not.toHaveBeenCalled();
+    await pair.close();
+  });
+});

package/test/mcp/shaping.test.ts

@@ -0,0 +1,41 @@
+import { describe, expect, it } from 'vitest';
+import { z } from 'zod/v3';
+import { createRegistry, MAX_RESULT_CHARS } from '../../src/mcp/registry.js';
+import type { ToolMeta } from '../../src/mcp/tool-meta.js';
+import { connectPair } from '../helpers/mcp-pair.js';
+
+const meta: Record<string, ToolMeta> = {
+  many: { title: 'Many', annotations: { readOnlyHint: true }, paginate: true },
+  huge: { title: 'Huge', annotations: { readOnlyHint: true } },
+};
+const ok = (data: unknown) => ({ content: [{ type: 'text' as const, text: JSON.stringify(data) }] });
+
+describe('result shaping', () => {
+  it('pages list tools and says whether more exist', async () => {
+    const pair = await connectPair((server) => {
+      const reg = createRegistry(server, { context: () => ({ environment: 'dev' }), meta });
+      reg.tool('many', 'x', {}, async () => ok(Array.from({ length: 120 }, (_, i) => i)));
+      reg.tool('huge', 'x', {}, async () => ok(Array.from({ length: 5000 }, (_, i) => ({ i, pad: 'x'.repeat(100) }))));
+    });
+    const first = await pair.call('many');
+    expect(first.body.data).toMatchObject({ page: 1, limit: 50, total: 120, has_more: true, next: '70 more: call again with page 2' });
+    expect(first.body.data.items).toHaveLength(50);
+    const last = await pair.call('many', { page: 3 });
+    expect(last.body.data).toMatchObject({ page: 3, has_more: false, items: Array.from({ length: 20 }, (_, i) => 100 + i) });
+    expect(last.body.data).not.toHaveProperty('next');
+
+    const big = await pair.call('huge');
+    const text = (big.raw.content as Array<{ text: string }>)[0].text;
+    expect(text.length).toBeLessThanOrEqual(MAX_RESULT_CHARS);
+    expect(big.body.data).toMatchObject({ truncated: true, total: 5000 });
+    expect(big.body.data.hint).toMatch(/limit\/page/);
+    await pair.close();
+  });
+
+  it('refuses a paged tool that brings its own limit (it would never page)', async () => {
+    await connectPair((server) => {
+      const reg = createRegistry(server, { context: () => ({ environment: 'dev' }), meta });
+      expect(() => reg.tool('many', 'x', { limit: z.number().optional() }, async () => ok([]))).toThrow(/paged by the registry/);
+    });
+  });
+});

package/test/mcp/tools-snapshot.test.ts

@@ -0,0 +1,42 @@
+import { describe, expect, it } from 'vitest';
+import { registerTools } from '../../src/mcp/tools.js';
+import { IndemnClient } from '../../src/sdk/client.js';
+import { connectPair } from '../helpers/mcp-pair.js';
+import { cleanEnv } from '../helpers/config-home.js';
+
+describe('MCP tool list', () => {
+  it('gives every tool a title and annotations', async () => {
+    cleanEnv();
+    const client = new IndemnClient({ apiKey: `ind_dev_${'a'.repeat(64)}`, orgId: 'org1', environment: 'dev' });
+    const pair = await connectPair((server) => { registerTools(server, client); });
+    const { tools } = await pair.client.listTools();
+    for (const tool of tools) {
+      expect(tool.title, tool.name).toBeTruthy();
+      expect(tool.annotations, tool.name).toBeTypeOf('object');
+      expect(typeof tool.annotations?.readOnlyHint, tool.name).toBe('boolean');
+    }
+    expect(tools.map((t) => t.name).sort()).toMatchSnapshot();
+    expect(tools).toHaveLength(139); // +numbers // +set_agent_transcriber // +set_org_admin_settings
+    const props = (name: string) => Object.keys((tools.find((t) => t.name === name)!.inputSchema as { properties?: object }).properties ?? {});
+    for (const name of ['list_agents', 'delete_agent', 'set_prompt', 'list_org_members', 'list_channels', 'chat_with_agent']) {
+      expect(props(name), name).toContain('org_id');
+    }
+    for (const name of ['whoami', 'list_organizations', 'eval_quality_metrics']) {
+      expect(props(name), name).not.toContain('org_id');
+    }
+    // Test items and rubric rules have declared fields (Gemini cannot fill open objects).
+    const itemsOf = (name: string, field: string) => ((tools.find((t) => t.name === name)!.inputSchema as { properties: Record<string, { items?: { properties?: object } }> }).properties[field].items?.properties ?? {});
+    // ... and no nested objects: Gemini writes constructors for them that Google rejects.
+    const nested = (props: Record<string, { type?: string }>) => Object.entries(props).filter(([, p]) => p.type === 'object').map(([k]) => k);
+    expect(Object.keys(itemsOf('create_test_set', 'items'))).toEqual(expect.arrayContaining(['type', 'name', 'message', 'success_criteria']));
+    expect(nested(itemsOf('create_test_set', 'items') as never)).toEqual([]);
+    expect(Object.keys(itemsOf('update_test_set', 'items'))).toEqual(expect.arrayContaining(['type', 'message', 'success_criteria']));
+    expect(Object.keys(itemsOf('create_rubric', 'rules'))).toEqual(expect.arrayContaining(['id', 'name', 'severity', 'category', 'description', 'pass_conditions']));
+    expect(nested(itemsOf('create_rubric', 'rules') as never)).toEqual([]);
+    expect(Object.keys(itemsOf('update_rubric', 'rules'))).toEqual(expect.arrayContaining(['id', 'severity']));
+    const skillProps = Object.keys((tools.find((t) => t.name === 'create_function')!.inputSchema as { properties: object }).properties);
+    expect(skillProps).toEqual(expect.arrayContaining(['auth_type', 'auth_token']));
+    expect(skillProps).not.toContain('authorization');
+    await pair.close();
+  });
+});

package/test/sdk/agents.test.ts

@@ -0,0 +1,232 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { on, recordFetch } from '../helpers/fetch-recorder.js';
+import { cleanEnv, useTempHome } from '../helpers/config-home.js';
+import { jwtExpiringIn } from '../helpers/jwt.js';
+import { connectPair } from '../helpers/mcp-pair.js';
+import { IndemnClient } from '../../src/sdk/client.js';
+import { AgentInsightsSDK, AgentsSDK } from '../../src/sdk/agents.js';
+import { createAgentFromSkeleton, exportAgent, importAgent, parseModel, redactSecrets } from '../../src/sdk/agent-bundle.js';
+import { registerTools } from '../../src/mcp/tools.js';
+import { setAskers } from '../../src/core/scope.js';
+import { mcpAskers } from '../../src/mcp/server.js';
+
+const ORG = 'aaaaaaaaaaaaaaaaaaaaaaaa';
+const AGENT = '111111111111111111111111';
+const NEW = '444444444444444444444444';
+const list = (names: string[]) => on('GET', '/ai-studio/v2/bots', (c) => (c.url.endsWith('/v2/bots') ? { json: names.map((n, i) => ({ _id: `b${i}`, name: n })) } : undefined as never));
+
+describe('agents', () => {
+  let home: ReturnType<typeof useTempHome>;
+  let token: string;
+  beforeEach(() => {
+    cleanEnv();
+    home = useTempHome();
+    vi.spyOn(process, 'cwd').mockReturnValue(home.dir);
+    token = jwtExpiringIn(5 * 3_600_000);
+    IndemnClient.saveConfig({ environment: 'dev', user_id: 'u1', session: { token }, orgs: [{ id: ORG, name: 'QA A' }] });
+    setAskers({});
+  });
+  afterEach(() => home.cleanup());
+
+  it('refuses a duplicate name before creating anything', async () => {
+    const { calls } = recordFetch([list(['Quote Bot'])]);
+    await expect(createAgentFromSkeleton(new IndemnClient(), { name: ' quote bot ' })).rejects.toMatchObject({ exitCode: 2 });
+    expect(calls.some((c) => c.method === 'POST')).toBe(false);
+  });
+
+  it('creates the skeleton: agent, purpose, prompt and model', async () => {
+    const { calls } = recordFetch([
+      list([]),
+      on('POST', '/ai-studio/bots', { json: { success: true, data: { _id: NEW, name: 'Renewals', channels: ['WEB'] } } }),
+      on('PUT', `/ai-studio/bots/${NEW}/configurations`, { json: { success: true, data: {} } }),
+      on('PUT', `/ai-studio/bots/${NEW}`, { json: { success: true, data: { _id: NEW } } }),
+      on('GET', '/ai-studio/llm-models', { json: { success: true, data: [{ provider: 'openai', models: [{ model_id: 'gpt-4.1', channels: ['CHAT', 'VOICE'], exposed_fields: { temperature: { default: 0 } } }, { model_id: 'o-text', channels: ['CHAT'] }] }] } }),
+    ]);
+    const { set } = await createAgentFromSkeleton(new IndemnClient(), {
+      name: 'Renewals', description: 'Handles renewals', system_prompt: 'You are...', model: parseModel('openai/gpt-4.1'),
+    });
+    expect(set).toEqual(['name', 'channels', 'description', 'system_prompt', 'model']);
+    expect(calls.find((c) => c.method === 'POST')?.body).toEqual({ name: 'Renewals', channels: ['WEB'] });
+    expect(calls.find((c) => c.url.endsWith('/configurations'))?.body).toEqual({ system_prompt: 'You are...', llm_config: { provider: 'openai', model: 'gpt-4.1', parameters: { temperature: 0 } } });
+  });
+
+  it('rejects a model without a provider', () => {
+    expect(() => parseModel('gpt-4.1')).toThrow(/provider\/model/);
+  });
+
+  it('redacts secrets in exported skills and lists where', () => {
+    const { value, redacted } = redactSecrets([{ configurationSchema: { headers: { Authorization: 'Bearer x', 'X-Trace': '1' }, api_key: 'k' } }]);
+    expect(value).toEqual([{ configurationSchema: { headers: { Authorization: '<redacted>', 'X-Trace': '1' }, api_key: '<redacted>' } }]);
+    expect(redacted).toEqual(['[0].configurationSchema.headers.Authorization', '[0].configurationSchema.api_key']);
+  });
+
+  it('treats webhook addresses and addresses with a key in them as secrets', () => {
+    const { value, redacted } = redactSecrets([
+      { configurationSchema: { endpoint: 'https://hooks.slack.com/services/T0/B0/xyz', method: 'POST' } },
+      { configurationSchema: { endpoint: 'https://n8n.example.com/webhook/1234-abcd' } },
+      { configurationSchema: { endpoint: 'https://api.acme.test/quote?api_key=abc' } },
+      { configurationSchema: { endpoint: 'https://api.acme.test/quote' } },
+    ]);
+    expect(redacted).toEqual(['[0].configurationSchema.endpoint', '[1].configurationSchema.endpoint', '[2].configurationSchema.endpoint']);
+    expect(value[3].configurationSchema.endpoint).toBe('https://api.acme.test/quote');
+  });
+
+  it('exports and imports an agent with its skills and parameters', async () => {
+    recordFetch([
+      on('GET', `/v2/bots/${AGENT}`, { json: [{ _id: AGENT, name: 'Quote Bot', description: 'Quotes', channels: ['WEB'] }] }),
+      on('GET', `/bots/${AGENT}/configurations`, { json: { success: true, data: { ai_config: { system_prompt: 'P' }, first_message: { text: 'Hi' }, llm_config: { provider: 'openai', model: 'gpt-4.1' } } } }),
+      on('GET', `/bots/${AGENT}/functions/f1/parameters`, { json: { success: true, data: [{ _id: 'p1', name: 'zip', type: 'string', is_required: true }] } }),
+      on('GET', `/bots/${AGENT}/functions`, { json: { success: true, data: [{ _id: 'f1', type: 'rest_api', name: 'quote', configurationSchema: { url: 'https://x', token: 'secret' } }] } }),
+      on('GET', `/bots/${AGENT}/mappings`, { json: { success: true, data: [{ id: 'kb1', name: 'FAQ' }] } }),
+    ]);
+    const bundle = await exportAgent(new IndemnClient(), AGENT);
+    expect(bundle).toMatchObject({
+      format: 'indemn-agent/1',
+      agent: { name: 'Quote Bot', channels: ['WEB'] },
+      configuration: { system_prompt: 'P', llm_config: { model: 'gpt-4.1' } },
+      skills: [{ name: 'quote', configurationSchema: { url: 'https://x', token: '<redacted>' }, parameters: [{ name: 'zip', type: 'string', is_required: true }] }],
+      knowledge_base_ids: ['kb1'],
+      redacted: ['[0].configurationSchema.token'],
+    });
+
+    const { calls } = recordFetch([
+      list([]),
+      on('POST', '/ai-studio/bots/444444444444444444444444/functions/f9/parameters', { json: { success: true, data: [{ _id: 'p9' }] } }),
+      on('POST', `/ai-studio/bots/${NEW}/functions`, { json: { success: true, data: { _id: 'f9' } } }),
+      on('POST', '/ai-studio/bots', { json: { success: true, data: { _id: NEW, name: 'Quote Bot' } } }),
+      on('PUT', '/functions/f9', { json: { success: true, data: { _id: 'f9' } } }),
+      on('PUT', '/configurations', { json: { success: true, data: {} } }),
+      on('PUT', `/ai-studio/bots/${NEW}`, { json: { success: true, data: {} } }),
+    ]);
+    const report = await importAgent(new IndemnClient(), bundle);
+    expect(report).toMatchObject({ skills_created: 1, skills_failed: [], needs_secrets: ['[0].configurationSchema.token'], knowledge_bases_skipped: ['kb1'] });
+    expect(calls.find((c) => c.url.endsWith('/configurations'))?.body).toMatchObject({ first_message: JSON.stringify({ text: 'Hi' }) });
+  });
+
+  it('import reuses the built-in skills a new agent already has', async () => {
+    const NEW = '444444444444444444444444';
+    const bundle = { format: 'indemn-agent/1', agent: { name: 'Copy', channels: ['WEB'] }, configuration: {}, knowledge_base_ids: [], redacted: [],
+      skills: [
+        { type: 'faqs-retriever', name: 'FAQs Retriever', configurationSchema: { metadataFilter: {} }, parameters: [{ name: 'query', type: 'string' }] },
+        { type: 'human_handoff', name: 'Live Handoff', configurationSchema: { humanHandoffFallback: 'email' }, parameters: [] },
+        { type: 'rest_api', name: 'quote', configurationSchema: { endpoint: 'https://x' }, parameters: [] },
+      ] } as never;
+    const { calls } = recordFetch([
+      list([]),
+      on('GET', `/ai-studio/bots/${NEW}/functions`, { json: { success: true, data: [
+        { _id: 'b1', type: 'faqs-retriever', name: 'FAQs Retriever', systemDeveloped: true },
+        { _id: 'b2', type: 'human_handoff', name: 'Live Handoff', systemDeveloped: true },
+      ] } }),
+      on('POST', `/ai-studio/bots/${NEW}/functions`, { json: { success: true, data: { _id: 'f9' } } }),
+      on('POST', '/ai-studio/bots', { json: { success: true, data: { _id: NEW, name: 'Copy' } } }),
+      on('PUT', '/functions/', { json: { success: true, data: {} } }),
+    ]);
+    const report = await importAgent(new IndemnClient(), bundle);
+    expect(report).toMatchObject({ skills_created: 1, built_in_skills_reused: ['FAQs Retriever', 'Live Handoff'], skills_failed: [] });
+    expect(calls.filter((c) => c.method === 'POST' && c.url.endsWith(`/bots/${NEW}/functions`))).toHaveLength(1);
+    expect(calls.find((c) => c.method === 'PUT' && c.url.endsWith('/functions/b2'))?.body).toMatchObject({ configurationSchema: { humanHandoffFallback: 'email' } });
+    expect(calls.some((c) => c.url.includes('/functions/b1/parameters') || c.url.includes('/functions/b2/parameters'))).toBe(false);
+  });
+
+  it('MCP list_agents pages', async () => {
+    recordFetch([list(['a', 'b', 'c'])]);
+    const pair = await connectPair((server) => { registerTools(server, new IndemnClient()); });
+    const res = await pair.call('list_agents', { limit: 2, page: 2 });
+    expect(res.body.data).toMatchObject({ page: 2, limit: 2, total: 3, has_more: false, items: [{ _id: 'b2', name: 'c' }] });
+    // A link to offer the person instead of the id
+    expect(res.body.data.items[0].url).toMatch(/^https:\/\/devcopilot\.indemn\.ai\/#\/organization\/[^/]+\/ai-studio\/bot\/b2\/configurations$/);
+    await pair.close();
+  });
+
+  it('MCP list_agents gives what a person needs, with a link, and filters by channel', async () => {
+    const channel = (name: string) => ({ _id: `c-${name}`, name, type: name, createdBy: 'u1', updatedAt: '2024-10-30T14:42:17.197Z' });
+    recordFetch([on('GET', '/ai-studio/v2/bots', { json: [
+      { _id: 'v1', name: 'Petra', description: null, channels: [channel('VOICE')], connected_phone: '+17759428775', updatedAt: '2026-08-19T03:49:01.061Z', intentsEngine: 'none', certifiedTags: [], last_updated_by: { email: 'x@indemn.ai' } },
+      { _id: 'w1', name: 'Wedding', channels: [channel('WEB')], updatedAt: '2026-06-01T00:00:00.000Z' },
+    ] })]);
+    const pair = await connectPair((server) => { registerTools(server, new IndemnClient()); });
+    const res = await pair.call('list_agents', { channel: 'voice' });
+    expect(res.body.data.items).toEqual([{
+      _id: 'v1', name: 'Petra', channels: ['VOICE'], phone: '+17759428775', updated_at: '2026-08-19T03:49:01.061Z',
+      url: expect.stringMatching(/\/ai-studio\/bot\/v1\/configurations$/),
+    }]);
+    expect((await pair.call('list_agents')).body.data.total).toBe(2);
+    await pair.close();
+  });
+
+  it('MCP delete_agent names the agent, warns when it is published, and needs confirm_published without a person', async () => {
+    const { calls } = recordFetch([
+      on('GET', `/v2/bots/${AGENT}`, { json: [{ _id: AGENT, name: 'Quote Bot' }] }),
+      on('GET', `/v1-agents/${AGENT}`, { json: { id: AGENT, lifecycle: 'published' } }),
+      on('DELETE', `/bots/${AGENT}`, { json: { success: true } }),
+    ]);
+    const pair = await connectPair((server) => { registerTools(server, new IndemnClient()); });
+    const dry = await pair.call('delete_agent', { agent_id: AGENT });
+    expect(dry.body.would).toMatch(/"Quote Bot", which is PUBLISHED/);
+    expect((await pair.call('delete_agent', { agent_id: AGENT, confirm: true })).isError).toBe(true);
+    expect(calls.some((c) => c.method === 'DELETE')).toBe(false);
+    await pair.call('delete_agent', { agent_id: AGENT, confirm: true, confirm_published: true });
+    expect(calls.filter((c) => c.method === 'DELETE')).toHaveLength(1);
+    await pair.close();
+  });
+
+  it('sends channel names the way copilot matches them', async () => {
+    const { calls } = recordFetch([on('POST', '/ai-studio/bots', { json: { success: true, data: { _id: 'n1' } } })]);
+    await new AgentsSDK(new IndemnClient()).createAgent({ name: 'Caller', channels: ['voice'] });
+    expect(calls.find((c) => c.method === 'POST')?.body).toMatchObject({ channels: ['VOICE'] });
+  });
+
+  it('never clones an agent from another org', async () => {
+    const { calls } = recordFetch([on('GET', `/v2/bots/${AGENT}`, { status: 404, text: 'not found' })]);
+    await expect(new AgentsSDK(new IndemnClient()).cloneAgent(AGENT)).rejects.toThrow();
+    expect(calls.some((c) => c.method === 'POST')).toBe(false);
+  });
+
+  it('says a deleted agent was not found (copilot answers with an empty list)', async () => {
+    recordFetch([on('GET', `/v2/bots/${AGENT}`, { json: [] })]);
+    await expect(new AgentsSDK(new IndemnClient()).getAgent(AGENT)).rejects.toThrow(/not found in this organization/);
+  });
+
+  it('changes lifecycle through the V2 platform with the bare session token and the org header', async () => {
+    const { calls } = recordFetch([on('PATCH', `/v1-agents/${AGENT}/lifecycle`, { json: { id: AGENT, lifecycle: 'beta' } })]);
+    await new AgentInsightsSDK(new IndemnClient()).setLifecycle(AGENT, 'beta');
+    expect(calls[0].url).toBe(`https://devplatform.indemn.ai/api/v1/v1-agents/${AGENT}/lifecycle`);
+    expect(calls[0].headers.authorization).toBe(`Bearer ${token}`);
+    expect(calls[0].headers['x-organization-id']).toBe(ORG);
+    expect(calls[0].body).toEqual({ lifecycle: 'beta' });
+  });
+
+  it('shows the V2 platform\'s reason when a non-owner is refused', async () => {
+    recordFetch([on('PATCH', '/lifecycle', { status: 403, json: { detail: 'Only the agent owner or organization admin can change lifecycle' } })]);
+    await expect(new AgentInsightsSDK(new IndemnClient()).setLifecycle(AGENT, 'published')).rejects.toThrow(/Only the agent owner/);
+  });
+
+  it('MCP create_agent asks for missing basics, or lists them when it cannot ask', async () => {
+    recordFetch([
+      list([]),
+      on('POST', '/ai-studio/bots', { json: { success: true, data: { _id: NEW, name: 'Renewals' } } }),
+      on('PUT', '/configurations', { json: { success: true, data: {} } }),
+      on('PUT', `/ai-studio/bots/${NEW}`, { json: { success: true, data: {} } }),
+    ]);
+    const blind = await connectPair((server) => { setAskers(mcpAskers(server)); registerTools(server, new IndemnClient()); });
+    const res = await blind.call('create_agent', { name: 'Renewals' });
+    expect(res.body).toMatchObject({ needs_input: true, choices: [{ id: 'description' }, { id: 'system_prompt' }] });
+    await blind.close();
+
+    const asking = await connectPair((server) => { setAskers(mcpAskers(server)); registerTools(server, new IndemnClient()); },
+      { elicit: () => ({ action: 'accept', content: { description: 'Renewals desk', system_prompt: 'You renew policies.' } }) });
+    const made = await asking.call('create_agent', { name: 'Renewals' });
+    expect(made.body.data).toMatchObject({ set: ['name', 'channels', 'description', 'system_prompt'], not_set: [] });
+    await asking.close();
+  });
+
+  it('MCP delete_agent is a dry run until confirmed', async () => {
+    const { calls } = recordFetch([on('GET', `/v2/bots/${AGENT}`, { json: [{ _id: AGENT, name: 'Quote Bot' }] })]);
+    const pair = await connectPair((server) => { registerTools(server, new IndemnClient()); });
+    const res = await pair.call('delete_agent', { agent_id: AGENT });
+    expect(res.body).toMatchObject({ dry_run: true });
+    expect(res.body.would).toContain('delete agent "Quote Bot"');
+    expect(calls.some((c) => c.method === 'DELETE')).toBe(false);
+    await pair.close();
+  });
+});

package/test/sdk/analytics.test.ts

@@ -0,0 +1,89 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { on, recordFetch } from '../helpers/fetch-recorder.js';
+import { cleanEnv, useTempHome } from '../helpers/config-home.js';
+import { jwtExpiringIn } from '../helpers/jwt.js';
+import { IndemnClient } from '../../src/sdk/client.js';
+import { AnalyticsSDK, AuditSDK, OrgSettingsSDK, planAdminSettings, rangeQuery } from '../../src/sdk/analytics.js';
+import { connectPair } from '../helpers/mcp-pair.js';
+import { registerTools } from '../../src/mcp/tools.js';
+
+const ORG = 'aaaaaaaaaaaaaaaaaaaaaaaa';
+
+describe('analytics, settings and audit', () => {
+  let home: ReturnType<typeof useTempHome>;
+  beforeEach(() => {
+    cleanEnv();
+    home = useTempHome();
+    vi.spyOn(process, 'cwd').mockReturnValue(home.dir);
+    IndemnClient.saveConfig({ environment: 'dev', user_id: 'u1', session: { token: jwtExpiringIn(5 * 3_600_000) }, orgs: [{ id: ORG, name: 'QA A' }] });
+  });
+  afterEach(() => home.cleanup());
+
+  it('defaults to the last 30 days and refuses more than 365', () => {
+    expect(rangeQuery({ to: '2026-09-28' })).toEqual({ date_from: '2026-08-29', date_to: '2026-09-28', channel: 'all' });
+    expect(() => rangeQuery({ from: '2025-01-01', to: '2026-09-28' })).toThrow(/365 days/);
+  });
+
+  it('asks for one agent\'s metrics and never asks copilot to refresh (which can cost LLM calls)', async () => {
+    const { calls } = recordFetch([on('GET', '/analytics/', { json: { success: true, data: {} } })]);
+    const sdk = new AnalyticsSDK(new IndemnClient());
+    await sdk.get('metrics', { from: '2026-09-01', to: '2026-09-28', agentId: 'b1' });
+    await sdk.get('critical-feedback', { from: '2026-09-01', to: '2026-09-28' });
+    expect(Object.fromEntries(new URL(calls[0].url).searchParams)).toEqual({ date_from: '2026-09-01', date_to: '2026-09-28', channel: 'all', agent_id: 'b1' });
+    expect(calls.every((c) => !c.url.includes('refresh'))).toBe(true);
+  });
+
+  it('validates the timezone before sending', async () => {
+    const { calls } = recordFetch([on('PATCH', '/configurations', { json: { timezone: 'Europe/Rome' } })]);
+    const sdk = new OrgSettingsSDK(new IndemnClient());
+    await expect(sdk.setTimezone('Mars/Base')).rejects.toMatchObject({ exitCode: 2 });
+    await sdk.setTimezone('Europe/Rome');
+    expect(calls).toHaveLength(1);
+    expect(calls[0].body).toEqual({ timezone: 'Europe/Rome' });
+  });
+
+  it('plans an Admin-tab change as the page does: real switches, timers in days, the page\'s words', () => {
+    const plan = planAdminSettings({ underwriting_portal: true, underwriting_portal_name: ' Submissions ', tickets: false, ended_to_resolved_minutes: 120, resolved_to_archived_minutes: 0, web_ai_disclosure_text: '', org_id: ORG });
+    expect(plan.body).toEqual({ enableUnderwritingPortal: true, enableTickets: false, underwritingPortalName: 'Submissions', endedToResolvedDays: 120 / 1440, resolvedToArchivedDays: null });
+    expect(plan.changes).toEqual(['turn on Underwriting Portal (Intake Manager)', 'turn off Tickets', 'name the Intake Manager item "Submissions"', 'set Ended → Resolved to 2 hours', 'set Resolved → Archived back to the default']);
+    expect(() => planAdminSettings({ ended_to_resolved_minutes: 5 })).toThrow(/at least 10 minutes, or 0 for the default/);
+    expect(() => planAdminSettings({ org_id: ORG, underwriting_portal_name: '' })).toThrow(/at least one Admin setting/);
+    expect(() => planAdminSettings({ web_ai_disclosure: true }, { aiDisclosureWeb: '' })).toThrow(/needs its text/);
+    expect(planAdminSettings({ web_ai_disclosure: true }, { aiDisclosureWeb: 'You are chatting with an AI.' }).body).toEqual({ showAiDisclosureWeb: true });
+  });
+
+  it('reads the saved disclosure only when a change touches it', async () => {
+    const { calls } = recordFetch([on('GET', '/configurations', { json: { showAiDisclosureWeb: false, aiDisclosureWeb: '' } })]);
+    const sdk = new OrgSettingsSDK(new IndemnClient());
+    await sdk.planAdmin({ tickets: true });
+    expect(calls).toHaveLength(0);
+    await expect(sdk.planAdmin({ web_ai_disclosure: true })).rejects.toThrow(/needs its text/);
+    expect(calls).toHaveLength(1);
+  });
+
+  it('MCP set_org_admin_settings asks in the page\'s words, sends real switches, and asks nothing for a refused value', async () => {
+    const { calls } = recordFetch([
+      on('PATCH', '/configurations/admin-settings', { json: { success: true, orgConfigs: { enableUnderwritingPortal: true, underwritingPortalName: 'Submissions', enableTickets: false } } }),
+    ]);
+    const pair = await connectPair((server) => { registerTools(server, new IndemnClient()); }, { elicit: () => ({ action: 'accept', content: { confirm: true } }) });
+    const bad = await pair.call('set_org_admin_settings', { ended_to_resolved_minutes: 5 });
+    expect(bad.isError).toBe(true);
+    expect(String(bad.body)).toMatch(/Ended → Resolved must be at least 10 minutes/);
+    expect(pair.questions).toHaveLength(0);
+    const ok = await pair.call('set_org_admin_settings', { underwriting_portal: true, underwriting_portal_name: 'Submissions' });
+    expect(pair.questions.map((q) => q.message)).toEqual([expect.stringMatching(/^This will turn on Underwriting Portal \(Intake Manager\); name the Intake Manager item "Submissions"\..*Proceed\?$/)]);
+    expect(calls.filter((c) => c.method === 'PATCH').map((c) => c.body)).toEqual([{ enableUnderwritingPortal: true, underwritingPortalName: 'Submissions' }]);
+    expect(ok.body.data).toEqual({ saved: { enableUnderwritingPortal: true, underwritingPortalName: 'Submissions' } });
+    await pair.close();
+  });
+
+  it('filters the full audit history here', async () => {
+    recordFetch([on('GET', '/audit-logs', { json: { success: true, data: [
+      { action: 'update', resource_type: 'bot', createdAt: '2026-09-27T10:00:00Z' },
+      { action: 'delete', resource_type: 'kb', createdAt: '2026-09-20T10:00:00Z' },
+      { action: 'update', resource_type: 'kb', createdAt: '2026-09-10T10:00:00Z' },
+    ] } })]);
+    const rows = await new AuditSDK(new IndemnClient()).list({ since: '2026-09-15', action: 'update' });
+    expect(rows).toEqual([expect.objectContaining({ resource_type: 'bot' })]);
+  });
+});