@indemn/cli 1.6.0 → 1.7.1

package/test/sdk/auth.test.ts

@@ -0,0 +1,70 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { on, recordFetch } from '../helpers/fetch-recorder.js';
+import { cleanEnv, useTempHome } from '../helpers/config-home.js';
+import { jwtExpiringIn } from '../helpers/jwt.js';
+import { login, logout, whoami } from '../../src/sdk/auth.js';
+import { IndemnClient } from '../../src/sdk/client.js';
+
+const A = { _id: 'aaaaaaaaaaaaaaaaaaaaaaaa', name: 'QA A' };
+const B = { _id: 'bbbbbbbbbbbbbbbbbbbbbbbb', name: 'QA B' };
+const fakeFirebase = vi.fn(async () => ({ idToken: 'id1', refreshToken: 'r1' }));
+
+describe('token-first login', () => {
+  let home: ReturnType<typeof useTempHome>;
+  beforeEach(() => { cleanEnv(); home = useTempHome(); });
+  afterEach(() => home.cleanup());
+
+  it('keeps the session and the org list, and never creates an API key', async () => {
+    const token = jwtExpiringIn(24 * 3_600_000);
+    const { calls } = recordFetch([
+      on('POST', '/auth/firebase/signin', { json: { success: true, token: `JWT ${token}`, user: { _id: 'u1', email: 'qa@indemn.ai' } } }),
+      on('GET', '/organization', { json: { success: true, userOrganizations: [A, B] } }),
+    ]);
+    const result = await login('qa@indemn.ai', 'pw', 'dev', { firebaseSignIn: fakeFirebase });
+
+    expect(calls.map((c) => `${c.method} ${new URL(c.url).pathname}`)).toEqual(['POST /api/auth/firebase/signin', 'GET /api/organization']);
+    expect(calls.some((c) => c.url.includes('/auth/api-keys'))).toBe(false);
+    expect(calls[1].headers.authorization).toBe(`JWT ${token}`);
+    expect(result.orgs).toEqual([{ id: A._id, name: 'QA A' }, { id: B._id, name: 'QA B' }]);
+
+    const saved = JSON.parse(readFileSync(join(home.dir, '.indemn', 'config.json'), 'utf8'));
+    expect(saved.session).toMatchObject({ token, refresh_token: 'r1' });
+    expect(saved.orgs).toHaveLength(2);
+    expect(saved).not.toHaveProperty('api_key');
+    expect(saved).not.toHaveProperty('org_id');
+    expect(saved.environment).toBe('dev');
+  });
+
+  it('asks for the MFA code when the account has MFA', async () => {
+    const ask = vi.fn(async () => '654321');
+    recordFetch([
+      on('POST', '/auth/firebase/signin', { json: { success: true, requiresMfa: true, mfaSessionId: 's1' } }),
+      on('POST', '/auth/firebase/mfa/verify', { json: { success: true, token: `JWT ${jwtExpiringIn(3_600_000 * 24)}`, user: { _id: 'u1' } } }),
+      on('GET', '/organization', { json: { success: true, userOrganizations: [A] } }),
+    ]);
+    await login('qa@indemn.ai', 'pw', 'production', { firebaseSignIn: fakeFirebase, mfaCodePrompt: ask });
+    expect(ask).toHaveBeenCalledTimes(1);
+    expect(IndemnClient.loadConfig()?.environment).toBe('production');
+  });
+
+  it('logout revokes the session on copilot, then forgets it', async () => {
+    const token = jwtExpiringIn(3_600_000 * 24);
+    IndemnClient.saveConfig({ environment: 'dev', user_id: 'u1', session: { token } });
+    const { calls } = recordFetch([on('POST', '/auth/firebase/logout', { json: { success: true } })]);
+    await expect(logout()).resolves.toEqual({ revoked: true });
+    expect(calls[0].headers.authorization).toBe(`JWT ${token}`);
+    expect(IndemnClient.loadConfig()).toBeNull();
+  });
+
+  it('whoami reports who and where but no secret', () => {
+    const token = jwtExpiringIn(3_600_000 * 24);
+    IndemnClient.saveConfig({ environment: 'dev', user_id: 'u1', email: 'qa@indemn.ai', session: { token, refresh_token: 'r1', expires_at: '2026-09-29T12:00:00.000Z' }, orgs: [{ id: A._id, name: 'QA A' }] });
+    const info = whoami();
+    expect(info).toMatchObject({ environment: 'dev', email: 'qa@indemn.ai', credential: 'session', source: 'config', sessionExpiresAt: '2026-09-29T12:00:00.000Z' });
+    const text = JSON.stringify(info);
+    expect(text).not.toContain(token);
+    expect(text).not.toContain('r1');
+  });
+});

package/test/sdk/billing.test.ts

@@ -0,0 +1,47 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { on, recordFetch } from '../helpers/fetch-recorder.js';
+import { cleanEnv, useTempHome } from '../helpers/config-home.js';
+import { jwtExpiringIn } from '../helpers/jwt.js';
+import { IndemnClient } from '../../src/sdk/client.js';
+import { BillingSDK } from '../../src/sdk/billing.js';
+
+const ORG = 'aaaaaaaaaaaaaaaaaaaaaaaa';
+
+describe('billing is read-only', () => {
+  let home: ReturnType<typeof useTempHome>;
+  beforeEach(() => {
+    cleanEnv();
+    home = useTempHome();
+    vi.spyOn(process, 'cwd').mockReturnValue(home.dir);
+    IndemnClient.saveConfig({ environment: 'dev', user_id: 'u1', session: { token: jwtExpiringIn(5 * 3_600_000) }, orgs: [{ id: ORG, name: 'QA A' }] });
+  });
+  afterEach(() => home.cleanup());
+
+  it('has no write call in the billing module', () => {
+    const src = readFileSync(new URL('../../src/sdk/billing.ts', import.meta.url), 'utf8');
+    expect(src).not.toMatch(/copilot(Post|Put|Delete|RequestRaw|PostForm|Binary)|platformRequest|evalsPost/);
+  });
+
+  it('only ever sends GET requests, even across every call', async () => {
+    const { calls } = recordFetch([
+      on('GET', '/billing-subscription', { json: { success: true, _id: 'sub1', status: 'active' } }),
+      on('GET', '/subscription/sub1/unpaid', { json: { success: true, unpaidInvoices: [] } }),
+      on('GET', '/subscription/sub1', { json: { success: true, invoices: [{ amount: 100 }] } }),
+      on('GET', '/usage-forecast', { json: { success: true, meters: [] } }),
+      on('GET', '/customer-plans', { json: { success: true, plans: [] } }),
+      on('GET', '/subscription-plans', { json: { success: true, data: [] } }),
+    ]);
+    const sdk = new BillingSDK(new IndemnClient());
+    await sdk.status(); await sdk.invoices(); await sdk.unpaid(); await sdk.usageForecast(); await sdk.plans();
+    expect(calls.length).toBeGreaterThan(5);
+    expect(calls.every((c) => c.method === 'GET')).toBe(true);
+  });
+
+  it('treats "no subscription" (a 500 from copilot) as none', async () => {
+    recordFetch([on('GET', '/billing-subscription', { status: 500, text: 'boom' })]);
+    const sdk = new BillingSDK(new IndemnClient());
+    expect(await sdk.status()).toBeNull();
+    expect(await sdk.invoices()).toEqual([]);
+  });
+});

package/test/sdk/campaigns.test.ts

@@ -0,0 +1,43 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { on, recordFetch } from '../helpers/fetch-recorder.js';
+import { cleanEnv, useTempHome } from '../helpers/config-home.js';
+import { jwtExpiringIn } from '../helpers/jwt.js';
+import { IndemnClient } from '../../src/sdk/client.js';
+import { CampaignsSDK } from '../../src/sdk/campaigns.js';
+
+const ORG = 'aaaaaaaaaaaaaaaaaaaaaaaa';
+
+describe('campaigns are read-only', () => {
+  let home: ReturnType<typeof useTempHome>;
+  beforeEach(() => {
+    cleanEnv();
+    home = useTempHome();
+    vi.spyOn(process, 'cwd').mockReturnValue(home.dir);
+    IndemnClient.saveConfig({ environment: 'dev', user_id: 'u1', session: { token: jwtExpiringIn(5 * 3_600_000) }, orgs: [{ id: ORG, name: 'QA A' }] });
+  });
+  afterEach(() => home.cleanup());
+
+  it('has no write call in the campaigns module', () => {
+    const src = readFileSync(new URL('../../src/sdk/campaigns.ts', import.meta.url), 'utf8');
+    expect(src).not.toMatch(/copilot(Post|Put|Delete|RequestRaw|PostForm|Binary)/);
+  });
+
+  it('reads through the org proxy with GET only', async () => {
+    const { calls } = recordFetch([on('GET', '/campaigns-service/', { json: { total: 0, limit: 50, skip: 0, items: [] } })]);
+    const sdk = new CampaignsSDK(new IndemnClient());
+    await sdk.list(); await sdk.detail('c1', 'forecast', 30); await sdk.templates(); await sdk.template('t1', true);
+    expect(calls.map((c) => `${c.method} ${new URL(c.url).pathname}`)).toEqual([
+      `GET /api/organization/${ORG}/campaigns-service/campaigns`,
+      `GET /api/organization/${ORG}/campaigns-service/campaigns/c1/forecast`,
+      `GET /api/organization/${ORG}/campaigns-service/templates`,
+      `GET /api/organization/${ORG}/campaigns-service/templates/t1/versions`,
+    ]);
+  });
+
+  it('refuses a path outside the readable list', async () => {
+    const { calls } = recordFetch();
+    await expect(new CampaignsSDK(new IndemnClient()).get('c1/../../communications/x/send')).rejects.toThrow(/not readable/);
+    expect(calls).toHaveLength(0);
+  });
+});

package/test/sdk/client.test.ts

@@ -0,0 +1,80 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { on, recordFetch } from '../helpers/fetch-recorder.js';
+import { cleanEnv, useTempHome } from '../helpers/config-home.js';
+import { IndemnClient } from '../../src/sdk/client.js';
+
+const version = JSON.parse(readFileSync(new URL('../../package.json', import.meta.url), 'utf8')).version;
+const DEV_KEY = `ind_dev_${'a'.repeat(64)}`;
+const LIVE_KEY = `ind_live_${'b'.repeat(64)}`;
+
+describe('IndemnClient request path', () => {
+  let home: ReturnType<typeof useTempHome>;
+  beforeEach(() => {
+    cleanEnv();
+    home = useTempHome();
+    vi.spyOn(globalThis, 'setTimeout').mockImplementation(((fn: () => void) => { fn(); return 0; }) as never);
+  });
+  afterEach(() => {
+    IndemnClient.setClientKind('cli');
+    home.cleanup();
+  });
+
+  it('names the CLI and its version on copilot and evaluations requests', async () => {
+    const { calls } = recordFetch();
+    const client = new IndemnClient({ apiKey: DEV_KEY, orgId: 'org1', environment: 'dev' });
+    await client.copilotGet('/organization/:org_id/ai-studio/v2/bots');
+    await client.evalsGet('/api/v1/rubrics');
+    IndemnClient.setClientKind('mcp');
+    await client.copilotGet('/organization/:org_id/ai-studio/v2/bots');
+    expect(calls.map((c) => c.headers['user-agent'])).toEqual(Array(3).fill(`indemn-cli/${version}`));
+    expect(calls.map((c) => c.headers['x-indemn-client'])).toEqual(['cli', 'cli', 'mcp']);
+  });
+
+  it('ignores a stray INDEMN_ENV: the saved login decides the platform', async () => {
+    IndemnClient.saveConfig({ api_key: DEV_KEY, org_id: 'org1', user_id: 'u1', environment: 'dev' });
+    vi.stubEnv('INDEMN_ENV', 'production');
+    const { calls } = recordFetch();
+    await new IndemnClient({ orgId: 'org1' }).copilotGet('/organization/:org_id/ai-studio/v2/bots');
+    expect(calls[0].url).toBe('https://devcopilot.indemn.ai/api/organization/org1/ai-studio/v2/bots');
+  });
+
+  it('takes the environment from the API key prefix when there is no saved login', () => {
+    vi.stubEnv('INDEMN_API_KEY', LIVE_KEY);
+    expect(new IndemnClient().getEnvironment()).toBe('production');
+    vi.stubEnv('INDEMN_API_KEY', DEV_KEY);
+    expect(new IndemnClient().getEnvironment()).toBe('dev');
+  });
+
+  it('keeps the server\'s reason when something is not found', async () => {
+    recordFetch([on('GET', '/voice-thing', { status: 404, json: { success: false, message: 'Phone number not found in channel configuration' } }), on('GET', '/html-404', { status: 404, text: '<html>nope</html>' })]);
+    const client = new IndemnClient({ apiKey: DEV_KEY, orgId: 'org1', environment: 'dev' });
+    await expect(client.copilotGet('/voice-thing')).rejects.toThrow('Not found: Phone number not found in channel configuration');
+    await expect(client.copilotGet('/html-404')).rejects.toThrow('Resource not found.');
+  });
+
+  it('retries a read on 503 but never a write', async () => {
+    let gets = 0;
+    const { calls } = recordFetch([
+      on('GET', '/bots', () => (++gets === 1 ? { status: 503, text: 'busy' } : { json: { success: true, data: [{ _id: 'b1' }] } })),
+      on('POST', '/bots', { status: 503, text: 'busy' }),
+    ]);
+    const client = new IndemnClient({ apiKey: DEV_KEY, orgId: 'org1', environment: 'dev' });
+    await expect(client.copilotGet('/organization/:org_id/ai-studio/v2/bots')).resolves.toEqual([{ _id: 'b1' }]);
+    await expect(client.copilotPost('/organization/:org_id/ai-studio/bots', { name: 'x' })).rejects.toThrow(/503/);
+    expect(calls.filter((c) => c.method === 'GET')).toHaveLength(2);
+    expect(calls.filter((c) => c.method === 'POST')).toHaveLength(1);
+  });
+
+  it('traces requests with --debug and never prints the credential', async () => {
+    vi.stubEnv('INDEMN_DEBUG', '1');
+    const writes: string[] = [];
+    vi.spyOn(process.stderr, 'write').mockImplementation(((chunk: string) => { writes.push(String(chunk)); return true; }) as never);
+    recordFetch();
+    await new IndemnClient({ apiKey: DEV_KEY, orgId: 'org1', environment: 'dev' }).copilotGet('/organization/:org_id/ai-studio/v2/bots');
+    const out = writes.join('');
+    expect(out).toContain('GET https://devcopilot.indemn.ai/api/organization/org1/ai-studio/v2/bots');
+    expect(out).toContain('200');
+    expect(out).not.toContain(DEV_KEY);
+  });
+});

package/test/sdk/config-change.test.ts

@@ -0,0 +1,142 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { on, recordFetch, type Responder } from '../helpers/fetch-recorder.js';
+import { cleanEnv, useTempHome } from '../helpers/config-home.js';
+import { jwtExpiringIn } from '../helpers/jwt.js';
+import { connectPair } from '../helpers/mcp-pair.js';
+import { IndemnClient } from '../../src/sdk/client.js';
+import { formatDiff, lineDiff } from '../../src/core/diff.js';
+import { applyConfigChange, modelArg, planConfigChange } from '../../src/sdk/config-change.js';
+import { registerTools } from '../../src/mcp/tools.js';
+
+const ORG = 'aaaaaaaaaaaaaaaaaaaaaaaa';
+const AGENT = '111111111111111111111111';
+
+const CATALOG = on('GET', '/ai-studio/llm-models', { json: { success: true, data: [{ provider: 'openai', models: [{ model_id: 'gpt-4.1', channels: ['CHAT', 'VOICE'], exposed_fields: { temperature: { default: 0 } } }, { model_id: 'o-text', channels: ['CHAT'] }] }] } });
+
+function configServer(initial: { prompt: string; greeting?: string; model?: string }, opts: { lifecycle?: string; ignoreWrites?: boolean; voice?: boolean } = {}) {
+  let state = { ...initial };
+  const responders: Responder[] = [
+    on('GET', `/bots/${AGENT}/configurations`, () => ({ json: { success: true, data: {
+      ai_config: { system_prompt: state.prompt, system_prompt_ops: 'stale' },
+      first_message: { text: state.greeting ?? '', quick_replies: [{ title: 'Quote' }] },
+      llm_config: state.model ? { provider: state.model.split('/')[0], model: state.model.split('/')[1] } : undefined,
+    } } })),
+    on('PUT', `/bots/${AGENT}/configurations`, (c) => {
+      const b = c.body as Record<string, unknown>;
+      if (!opts.ignoreWrites) {
+        if (b.system_prompt !== undefined) state.prompt = String(b.system_prompt);
+        if (b.first_message) state.greeting = JSON.parse(String(b.first_message)).text;
+        if (b.llm_config) state.model = `${(b.llm_config as { provider: string }).provider}/${(b.llm_config as { model: string }).model}`;
+      }
+      return { json: { success: true, data: false } };
+    }),
+    on('GET', `/v2/bots/${AGENT}`, { json: [{ _id: AGENT, name: 'Bot', channels: [{ type: opts.voice ? 'VOICE' : 'WEB' }] }] }),
+    CATALOG,
+    on('GET', `/v1-agents/${AGENT}`, opts.lifecycle ? { json: { id: AGENT, name: 'Bot', lifecycle: opts.lifecycle } } : { status: 503, text: 'down' }),
+  ];
+  return { responders, state: () => state };
+}
+
+describe('model for a voice agent', () => {
+  let home: ReturnType<typeof useTempHome>;
+  beforeEach(() => {
+    cleanEnv();
+    home = useTempHome();
+    vi.spyOn(process, 'cwd').mockReturnValue(home.dir);
+    IndemnClient.saveConfig({ environment: 'dev', user_id: 'u1', session: { token: jwtExpiringIn(5 * 3_600_000) }, orgs: [{ id: 'aaaaaaaaaaaaaaaaaaaaaaaa', name: 'QA A' }] });
+  });
+  afterEach(() => home.cleanup());
+
+  it('refuses a model that cannot take calls for an agent that answers the phone', async () => {
+    recordFetch(configServer({ prompt: 'p', model: 'openai/gpt-4.1' }, { voice: true }).responders);
+    await expect(planConfigChange(new IndemnClient(), AGENT, { model: modelArg('openai/o-text') })).rejects.toThrow(/cannot take calls/);
+    await expect(planConfigChange(new IndemnClient(), AGENT, { model: modelArg('openai/nope') })).rejects.toThrow(/not in the platform's model list/);
+  });
+});
+
+describe('diff', () => {
+  it('shows removed and added lines with context', () => {
+    const d = lineDiff('a\nb\nc\nd', 'a\nB\nc\nd');
+    expect(formatDiff(d, { context: 1 })).toBe('  a\n- b\n+ B\n  c');
+  });
+});
+
+describe('configuration changes', () => {
+  let home: ReturnType<typeof useTempHome>;
+  beforeEach(() => {
+    cleanEnv();
+    home = useTempHome();
+    vi.spyOn(process, 'cwd').mockReturnValue(home.dir);
+    IndemnClient.saveConfig({ environment: 'dev', user_id: 'u1', session: { token: jwtExpiringIn(5 * 3_600_000) }, orgs: [{ id: ORG, name: 'QA A' }] });
+  });
+  afterEach(() => home.cleanup());
+
+  it('plans only real changes and reads the lifecycle, or "unknown" when the V2 platform is down', async () => {
+    const srv = configServer({ prompt: 'one\ntwo', greeting: 'Hi', model: 'openai/gpt-4.1' });
+    recordFetch(srv.responders);
+    const plan = await planConfigChange(new IndemnClient(), AGENT, { system_prompt: 'one\nTWO', greeting: 'Hi', model: modelArg('openai/gpt-4.1') });
+    expect(plan.changes).toEqual(['system_prompt']);
+    expect(plan.lifecycle).toBe('unknown');
+  });
+
+  it('clears the stale dashboard copy, sends the greeting as JSON text, and confirms by reading back', async () => {
+    const srv = configServer({ prompt: 'old', greeting: 'Hi' }, { lifecycle: 'beta' });
+    const { calls } = recordFetch(srv.responders);
+    const client = new IndemnClient();
+    const change = { system_prompt: 'new', greeting: 'Hello', model: modelArg('gpt-4.1') };
+    const plan = await planConfigChange(client, AGENT, change);
+    const result = await applyConfigChange(client, plan, change);
+    const put = calls.find((c) => c.method === 'PUT')!.body as Record<string, unknown>;
+    expect(put.system_prompt_ops).toBeNull();
+    expect(JSON.parse(String(put.first_message))).toEqual({ text: 'Hello', quick_replies: [{ title: 'Quote' }] });
+    expect(put.llm_config).toEqual({ provider: 'openai', model: 'gpt-4.1', parameters: { temperature: 0 } });
+    expect(result).toEqual({ applied: ['system_prompt', 'greeting', 'model'], mismatched: [] });
+  });
+
+  it('reports what did not save even when copilot answers success', async () => {
+    const srv = configServer({ prompt: 'old' }, { lifecycle: 'beta', ignoreWrites: true });
+    recordFetch(srv.responders);
+    const client = new IndemnClient();
+    const plan = await planConfigChange(client, AGENT, { system_prompt: 'new' });
+    await expect(applyConfigChange(client, plan, { system_prompt: 'new' })).resolves.toEqual({ applied: [], mismatched: ['system_prompt'] });
+  });
+
+  it('MCP set_prompt shows the diff before changing anything', async () => {
+    const srv = configServer({ prompt: 'keep\nold line' }, { lifecycle: 'beta' });
+    const { calls } = recordFetch(srv.responders);
+    const pair = await connectPair((server) => { registerTools(server, new IndemnClient()); });
+    const dry = await pair.call('set_prompt', { agent_id: AGENT, prompt: 'keep\nnew line' });
+    expect(dry.body.dry_run).toBe(true);
+    expect(dry.body.would).toContain('- old line\n+ new line');
+    expect(calls.some((c) => c.method === 'PUT')).toBe(false);
+    const done = await pair.call('set_prompt', { agent_id: AGENT, prompt: 'keep\nnew line', confirm: true });
+    expect(done.body.data).toMatchObject({ changed: ['system_prompt'], not_saved: [] });
+    await pair.close();
+  });
+
+  it('MCP needs confirm_published for a published agent when no person confirmed', async () => {
+    const srv = configServer({ prompt: 'old' }, { lifecycle: 'published' });
+    const { calls } = recordFetch(srv.responders);
+    const pair = await connectPair((server) => { registerTools(server, new IndemnClient()); });
+    const res = await pair.call('set_prompt', { agent_id: AGENT, prompt: 'new', confirm: true });
+    expect(res.body).toMatchObject({ needs_input: true });
+    expect(res.body.message).toMatch(/published/);
+    expect(calls.some((c) => c.method === 'PUT')).toBe(false);
+    const ok = await pair.call('set_prompt', { agent_id: AGENT, prompt: 'new', confirm: true, confirm_published: true });
+    expect(ok.body.data.changed).toEqual(['system_prompt']);
+    await pair.close();
+  });
+
+  it('MCP treats an agent whose status cannot be read as published', async () => {
+    const srv = configServer({ prompt: 'old' });  // the V2 platform is down: lifecycle "unknown"
+    const { calls } = recordFetch(srv.responders);
+    const pair = await connectPair((server) => { registerTools(server, new IndemnClient()); });
+    const res = await pair.call('set_prompt', { agent_id: AGENT, prompt: 'new', confirm: true });
+    expect(res.body).toMatchObject({ needs_input: true });
+    expect(res.body.message).toMatch(/may be live for customers \(its status could not be read\)/);
+    expect(calls.some((c) => c.method === 'PUT')).toBe(false);
+    const ok = await pair.call('set_prompt', { agent_id: AGENT, prompt: 'new', confirm: true, confirm_published: true });
+    expect(ok.body.data.changed).toEqual(['system_prompt']);
+    await pair.close();
+  });
+});

package/test/sdk/conversations.test.ts

@@ -0,0 +1,80 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { on, recordFetch } from '../helpers/fetch-recorder.js';
+import { cleanEnv, useTempHome } from '../helpers/config-home.js';
+import { jwtExpiringIn } from '../helpers/jwt.js';
+import { connectPair } from '../helpers/mcp-pair.js';
+import { IndemnClient } from '../../src/sdk/client.js';
+import { ConversationsSDK, conversationToTestSet } from '../../src/sdk/conversations.js';
+import { registerTools } from '../../src/mcp/tools.js';
+
+const ORG = 'aaaaaaaaaaaaaaaaaaaaaaaa';
+const AGENT = '111111111111111111111111';
+const OTHER_AGENT = '333333333333333333333333';
+const PROJ = '222222222222222222222222';
+const agentOk = on('GET', `/ai-studio/v2/bots/${AGENT}`, { json: { success: true, data: [{ _id: AGENT, name: 'Quote Bot', id_project: PROJ }] } });
+
+describe('conversations', () => {
+  let home: ReturnType<typeof useTempHome>;
+  beforeEach(() => {
+    cleanEnv();
+    home = useTempHome();
+    vi.spyOn(process, 'cwd').mockReturnValue(home.dir);
+    IndemnClient.saveConfig({ environment: 'dev', user_id: 'u1', session: { token: jwtExpiringIn(5 * 3_600_000) }, orgs: [{ id: ORG, name: 'QA A' }] });
+  });
+  afterEach(() => home.cleanup());
+
+  it('lists one agent\'s conversations through the org API, test ones included, and can keep only CLI ones', async () => {
+    const { calls } = recordFetch([on('GET', `/organization/${ORG}/conversations`, { json: { perPage: 50, count: 2, conversations: [
+      { request_id: 'r1', isTestMode: 'false', user_id: 'cli-user-1', created_at: '2026-09-28T10:00:00Z' },
+      { request_id: 'r2', isTestMode: true, user_id: 'web-9' },
+    ] } })]);
+    const sdk = new ConversationsSDK(new IndemnClient({ orgId: ORG }));
+    expect((await sdk.list(AGENT)).conversations.map((c) => c.request_id)).toEqual(['r1', 'r2']);
+    expect((await sdk.list(AGENT, { cliOnly: true, includeTest: false })).conversations.map((c) => c.request_id)).toEqual(['r1']);
+    const url = new URL(calls[0].url);
+    expect(url.pathname).toBe(`/api/organization/${ORG}/conversations`);
+    expect(url.searchParams.get('attr[id_bot]')).toBe(AGENT);
+  });
+
+  it('labels who said each message', async () => {
+    recordFetch([on('GET', '/messages', { json: [
+      { sender: 'cli-user-1', text: 'Get Started' }, { sender: `bot_${AGENT}`, text: 'Hi' }, { sender: 'system', text: 'Marked as test' },
+      { sender: AGENT, text: 'Replies come under the bare agent id' }, { sender: 'cli-user-1', text: 'Thanks' },
+    ] })]);
+    const msgs = await new ConversationsSDK(new IndemnClient()).messages(PROJ, 'r1', AGENT);
+    expect(msgs.map((m) => m.role)).toEqual(['user', 'agent', 'system', 'agent', 'user']);
+  });
+
+  it('marks a conversation as test through the dashboard route', async () => {
+    const { calls } = recordFetch([on('PATCH', `/${PROJ}/requests/r1`, { json: { request_id: 'r1', isTestMode: true } })]);
+    await new ConversationsSDK(new IndemnClient()).markTest(PROJ, 'r1');
+    expect(calls[0]).toMatchObject({ method: 'PATCH', body: { isTestMode: true } });
+    expect(calls[0].headers.authorization).toMatch(/^JWT /);
+  });
+
+  it('turns a conversation into a scenario test item without inventing criteria', () => {
+    const set = conversationToTestSet({ _id: 'x', request_id: 'r1', id_project: PROJ }, [
+      { role: 'user', text: 'Get Started' }, { role: 'agent', text: 'Hi' }, { role: 'user', text: 'Quote for a van' },
+      { role: 'agent', text: 'Here is your quote' }, { role: 'user', text: 'Thanks' },
+    ], AGENT);
+    expect(set.items[0]).toMatchObject({
+      type: 'scenario',
+      inputs: { initial_message: 'Quote for a van', max_turns: 2 },
+      expected: { success_criteria: [], expected_outcome: 'Here is your quote' },
+    });
+  });
+
+  it('MCP mark_conversation_test returns a dry run until confirmed', async () => {
+    const { calls } = recordFetch([agentOk, on('PATCH', '/requests/', { json: { isTestMode: true } })]);
+    const pair = await connectPair((server) => { registerTools(server, new IndemnClient()); });
+    const dry = await pair.call('mark_conversation_test', { agent_id: AGENT, conversation_ids: ['r1', 'r2'] });
+    expect(dry.body).toMatchObject({ dry_run: true });
+    expect(dry.body.would).toContain('2 conversation(s)');
+    expect(dry.body.would).toContain('Org: QA A');
+    expect(calls.filter((c) => c.method === 'PATCH')).toHaveLength(0);
+    const done = await pair.call('mark_conversation_test', { agent_id: AGENT, conversation_ids: ['r1', 'r2'], confirm: true });
+    expect(done.body.data).toEqual({ marked_test: ['r1', 'r2'] });
+    expect(calls.filter((c) => c.method === 'PATCH')).toHaveLength(2);
+    await pair.close();
+  });
+});

package/test/sdk/credentials.test.ts

@@ -0,0 +1,33 @@
+import { describe, expect, it } from 'vitest';
+import { copilotAuthHeader, darwinAuthHeader, resolveCredential } from '../../src/sdk/credentials.js';
+import type { IndemnConfig } from '../../src/sdk/types.js';
+
+const DEV_KEY = `ind_dev_${'a'.repeat(64)}`;
+const config = (over: Partial<IndemnConfig> = {}) => ({ environment: 'dev', user_id: 'u1', hosts: {} as never, ...over }) as IndemnConfig;
+
+describe('resolveCredential order', () => {
+  it('prefers a host-supplied token, which must name its platform', () => {
+    expect(resolveCredential(config({ session: { token: 'saved' } }), { INDEMN_TOKEN: 'JWT host', INDEMN_ENV: 'production' }))
+      .toEqual({ kind: 'token', token: 'host', source: 'env', environment: 'production' });
+    expect(() => resolveCredential(null, { INDEMN_TOKEN: 'host' })).toThrow(/INDEMN_ENV/);
+  });
+
+  it('then a pipeline API key, then the saved session, then a legacy saved key', () => {
+    expect(resolveCredential(config({ session: { token: 'saved' } }), { INDEMN_API_KEY: DEV_KEY })).toMatchObject({ kind: 'api_key', source: 'env', environment: 'dev' });
+    expect(resolveCredential(config({ session: { token: 'saved' }, api_key: DEV_KEY }), {})).toMatchObject({ kind: 'token', token: 'saved', source: 'config' });
+    expect(resolveCredential(config({ api_key: DEV_KEY }), {})).toMatchObject({ kind: 'api_key', source: 'config' });
+    expect(resolveCredential(null, {})).toBeNull();
+  });
+});
+
+describe('auth headers', () => {
+  it('sends the session to copilot with the JWT scheme and a key as Bearer', () => {
+    expect(copilotAuthHeader({ kind: 'token', token: 't', source: 'config', environment: 'dev' })).toBe('JWT t');
+    expect(copilotAuthHeader({ kind: 'api_key', key: DEV_KEY, source: 'env', environment: 'dev' })).toBe(`Bearer ${DEV_KEY}`);
+  });
+
+  it('sends the session to Darwin as Bearer and refuses an API key', () => {
+    expect(darwinAuthHeader({ kind: 'token', token: 't', source: 'config', environment: 'dev' })).toBe('Bearer t');
+    expect(() => darwinAuthHeader({ kind: 'api_key', key: DEV_KEY, source: 'env', environment: 'dev' })).toThrow(/login session/);
+  });
+});

package/test/sdk/distribution.test.ts

@@ -0,0 +1,55 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { on, recordFetch } from '../helpers/fetch-recorder.js';
+import { cleanEnv, useTempHome } from '../helpers/config-home.js';
+import { jwtExpiringIn } from '../helpers/jwt.js';
+import { IndemnClient } from '../../src/sdk/client.js';
+import { DistributionSDK } from '../../src/sdk/distribution.js';
+
+const ORG = 'aaaaaaaaaaaaaaaaaaaaaaaa';
+const OTHER_ORG = 'bbbbbbbbbbbbbbbbbbbbbbbb';
+const AGENT = '111111111111111111111111';
+
+describe('distributions and templates', () => {
+  let home: ReturnType<typeof useTempHome>;
+  beforeEach(() => {
+    cleanEnv();
+    home = useTempHome();
+    vi.spyOn(process, 'cwd').mockReturnValue(home.dir);
+    IndemnClient.saveConfig({ environment: 'dev', user_id: 'u1', session: { token: jwtExpiringIn(5 * 3_600_000) }, orgs: [{ id: ORG, name: 'QA A' }] });
+  });
+  afterEach(() => home.cleanup());
+  const sdk = () => new DistributionSDK(new IndemnClient());
+  const list = on('GET', '/distributions', { json: { success: true, data: { paths: [{ id: 'd1', host_name: 'x.com', path_expression: '/q', id_bot: AGENT }], scriptTag: '<script src="s.js"></script>' } } });
+
+  it('never updates a distribution id that is not in this org (copilot would create it)', async () => {
+    const { calls } = recordFetch([list]);
+    await expect(sdk().update('d-unknown', { greetingMessage: 'hi' })).rejects.toThrow(/not in this org/);
+    expect(calls.some((c) => c.method === 'PUT')).toBe(false);
+  });
+
+  it('gives the embed code and the paths of one agent', async () => {
+    recordFetch([on('GET', `/v2/bots/${AGENT}`, { json: [{ _id: AGENT }] }), list]);
+    expect(await sdk().embed(AGENT)).toEqual({ scriptTag: '<script src="s.js"></script>', paths: [expect.objectContaining({ id: 'd1' })] });
+  });
+
+  it('refuses to delete a template made from another org\'s agent', async () => {
+    const { calls } = recordFetch([on('GET', '/templates', { json: { success: true, data: [{ _id: 't1', name: 'Theirs', agent_id: { _id: 'x', id_organization: OTHER_ORG } }] } })]);
+    await expect(new DistributionSDK(new IndemnClient({ orgId: ORG })).deleteTemplate('t1')).rejects.toThrow(/another org/);
+    expect(calls.some((c) => c.method === 'DELETE')).toBe(false);
+  });
+
+  it('creates an agent from a template by cloning its source agent', async () => {
+    const { calls } = recordFetch([
+      on('GET', '/templates', { json: { success: true, data: [{ _id: 't1', name: 'Quote', agent_id: { _id: 'src1', id_organization: OTHER_ORG } }] } }),
+      on('POST', '/v2/bots/clone', { json: { success: true, data: { new_agent_id: 'n1', new_agent_name: 'Mine' } } }),
+    ]);
+    const res = await new DistributionSDK(new IndemnClient({ orgId: ORG })).createFromTemplate('t1', { name: 'Mine' });
+    expect(res.new_agent_id).toBe('n1');
+    expect(calls.find((c) => c.method === 'POST')?.body).toEqual({ source_id_bot: 'src1', agent_name: 'Mine' });
+  });
+
+  it('reads solutions from their own key', async () => {
+    recordFetch([on('GET', '/solutions', { json: { success: true, solutions: [{ name: 'Renewals' }] } })]);
+    expect(await new DistributionSDK(new IndemnClient({ orgId: ORG })).listSolutions()).toEqual([{ name: 'Renewals' }]);
+  });
+});