@indemn/cli 1.6.0 → 1.7.1

package/test/sdk/skills.test.ts

@@ -0,0 +1,235 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { mkdtempSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { on, recordFetch } from '../helpers/fetch-recorder.js';
+import { cleanEnv, useTempHome } from '../helpers/config-home.js';
+import { jwtExpiringIn } from '../helpers/jwt.js';
+import { connectPair } from '../helpers/mcp-pair.js';
+import { IndemnClient } from '../../src/sdk/client.js';
+import { FunctionsSDK } from '../../src/sdk/functions.js';
+import { assertSkillNameAllowed, proposedSkills, resolveSecretArg, skillNameKey, transferDestination } from '../../src/sdk/skills.js';
+import { registerTools } from '../../src/mcp/tools.js';
+
+const ORG = 'aaaaaaaaaaaaaaaaaaaaaaaa';
+const AGENT = '111111111111111111111111';
+
+describe('skill names', () => {
+  it('reduces spelling variants of the FAQ retriever to one key, like copilot', () => {
+    expect(['FAQs Retriever', 'FQ retrievers', 'F.A.Q. retrieval tool', 'faqs-retriever'].map(skillNameKey)).toEqual(Array(4).fill('fqrtrv'));
+  });
+
+  it('rejects a name that imitates a built-in skill, but not the built-in itself or other names', () => {
+    expect(() => assertSkillNameAllowed('FAQ Retrieval Tool', 'rest_api')).toThrow(/too similar to the built-in skill/);
+    expect(() => assertSkillNameAllowed('faqs-retriever', 'faqs-retriever')).not.toThrow();
+    expect(() => assertSkillNameAllowed('Quote lookup', 'rest_api')).not.toThrow();
+  });
+});
+
+describe('secrets on the command line', () => {
+  beforeEach(() => cleanEnv());
+
+  it('reads @file and env:NAME without warning, and warns for a typed value', () => {
+    const dir = mkdtempSync(join(tmpdir(), 'indemn-secret-'));
+    writeFileSync(join(dir, 'tok'), 'from-file\n');
+    vi.stubEnv('MY_TOKEN', 'from-env');
+    const warn = vi.fn();
+    expect(resolveSecretArg('--auth-token', `@${join(dir, 'tok')}`, warn)).toBe('from-file');
+    expect(resolveSecretArg('--auth-token', 'env:MY_TOKEN', warn)).toBe('from-env');
+    expect(warn).not.toHaveBeenCalled();
+    expect(resolveSecretArg('--auth-token', 'typed', warn)).toBe('typed');
+    expect(warn).toHaveBeenCalledWith(expect.stringContaining('shell history'));
+    expect(() => resolveSecretArg('--auth-token', 'env:MISSING_VAR', warn)).toThrow(/not set/);
+  });
+});
+
+describe('skills SDK and tools', () => {
+  let home: ReturnType<typeof useTempHome>;
+  beforeEach(() => {
+    cleanEnv();
+    home = useTempHome();
+    vi.spyOn(process, 'cwd').mockReturnValue(home.dir);
+    IndemnClient.saveConfig({ environment: 'dev', user_id: 'u1', session: { token: jwtExpiringIn(5 * 3_600_000) }, orgs: [{ id: ORG, name: 'QA A' }] });
+  });
+  afterEach(() => home.cleanup());
+
+  it('stops a reserved name before any request', async () => {
+    const { calls } = recordFetch();
+    await expect(new FunctionsSDK(new IndemnClient()).createFunction(AGENT, { type: 'rest_api', name: 'FAQs Retriever', description: 'x' })).rejects.toMatchObject({ exitCode: 2 });
+    expect(calls).toHaveLength(0);
+  });
+
+  it('MCP test_function sends the saved configuration with sample values in its placeholders', async () => {
+    const { calls } = recordFetch([
+      on('GET', `/bots/${AGENT}/functions`, { json: { success: true, data: [{ _id: 'f1', type: 'rest_api',
+        configurationSchema: { endpoint: 'https://x/date', method: 'POST', payload: '{"date_str":"{{event_date}}","n":"{{other}}"}', authorization: { type: 'no-auth' } } }] } }),
+      on('POST', '/functions/f1/test-rest-api', { json: { statusCode: 200, response: { valid: true } } }),
+    ]);
+    const pair = await connectPair((server) => { registerTools(server, new IndemnClient()); });
+    await pair.call('test_function', { agent_id: AGENT, function_id: 'f1', params: { event_date: '2027-06-12' } });
+    expect(calls.find((c) => c.url.endsWith('/test-rest-api'))?.body).toEqual({ endpoint: 'https://x/date', method: 'POST',
+      payload: '{"date_str":"2027-06-12","n":"{{other}}"}', authorization: { type: 'no-auth' } });
+    await pair.close();
+  });
+
+  it('adds allowed values the way copilot stores them, and updates keep what is not changed', async () => {
+    const saved = { _id: 'p1', name: 'coverage', type: 'string', description: 'Which cover', is_required: true, question_title: 'Which cover?',
+      enums: [{ title: 'Liability', payload: 'Liability', type: 'postback' }], isEnumsEnabled: true };
+    const { calls } = recordFetch([
+      on('GET', '/functions/f1/parameters', { json: { success: true, data: [saved] } }),
+      on('POST', '/functions/f1/parameters', { json: { success: true, data: [saved] } }),
+    ]);
+    const sdk = new FunctionsSDK(new IndemnClient());
+    await sdk.addParameter(AGENT, 'f1', { name: 'coverage', type: 'string', required: true, allowedValues: ['Liability', 'Both'] });
+    const posts = () => calls.filter((c) => c.method === 'POST').map((c) => (c.body as unknown[])[0]);
+    expect(posts()[0]).toMatchObject({ isEnumsEnabled: true, enums: JSON.stringify([{ title: 'Liability', payload: 'Liability', type: 'postback' }, { title: 'Both', payload: 'Both', type: 'postback' }]) });
+    await sdk.updateParameter(AGENT, 'f1', 'p1', { description: 'Coverage type' });
+    expect(posts()[1]).toEqual({ id: 'p1', name: 'coverage', type: 'string', description: 'Coverage type', question_title: 'Which cover?', is_required: true,
+      enums: JSON.stringify(saved.enums), isEnumsEnabled: true });
+    await sdk.updateParameter(AGENT, 'f1', 'p1', { allowedValues: [] });
+    expect(posts()[2]).toMatchObject({ enums: '[]', isEnumsEnabled: false, is_required: true, description: 'Which cover' });
+  });
+
+  it('saves call-transfer destinations the way the dashboard does, and a new one replaces the old', async () => {
+    expect(transferDestination({}, { handoffNumber: '+15551230000' })).toEqual({ phoneNumber: '+15551230000', intlTelObj: { number: '+15551230000', e164Number: '+15551230000' } });
+    expect(transferDestination({}, { payload: JSON.stringify({ action: 'transfer', payload: { to: '+15551230001' } }), payloadOps: [] }))
+      .toEqual({ phoneNumber: '+15551230001', intlTelObj: { number: '+15551230001', e164Number: '+15551230001' } });
+    expect(transferDestination({ sipUri: 'sip:old@x', sipHeaders: { a: '1' }, outputInstructions: 'k' }, { phoneNumber: '+15551230002' }))
+      .toEqual({ outputInstructions: 'k', phoneNumber: '+15551230002', intlTelObj: { number: '+15551230002', e164Number: '+15551230002' } });
+    expect(transferDestination({ phoneNumber: '+15551230003', intlTelObj: {} }, { sipUri: 'sip:desk@x' })).toEqual({ sipUri: 'sip:desk@x' });
+  });
+
+  it('bulk-creates with the body copilot expects', async () => {
+    const { calls } = recordFetch([on('POST', '/functions/bulk-create', { json: { success: true, data: [{ _id: 'f1' }] } })]);
+    await new FunctionsSDK(new IndemnClient()).bulkCreate(AGENT, [{ type: 'rest_api', name: 'quote', description: 'q' }]);
+    expect(calls[0].body).toEqual({ functions: [{ type: 'rest_api', name: 'quote', description: 'q' }] });
+  });
+
+  it('finds proposed skills wherever the answer nests them', () => {
+    expect(proposedSkills({ data: { functions: [{ name: 'a' }] } })).toEqual([{ name: 'a' }]);
+    expect(proposedSkills({ nothing: true })).toBeNull();
+  });
+
+  it('MCP create_function saves endpoint, method and body in a second step; update_function keeps the rest', async () => {
+    const { calls } = recordFetch([
+      on('POST', `/bots/${AGENT}/functions`, { json: { success: true, data: { _id: 'f1', type: 'rest_api' } } }),
+      on('GET', `/bots/${AGENT}/functions`, { json: { success: true, data: [{ _id: 'f1', type: 'rest_api', description: 'Checks a date',
+        configurationSchema: { endpoint: 'https://x/date', method: 'POST', authorization: { type: 'bearer-token', token: 't' } } }] } }),
+      on('PUT', `/bots/${AGENT}/functions/f1`, { json: { success: true, data: { _id: 'f1' } } }),
+    ]);
+    const pair = await connectPair((server) => { registerTools(server, new IndemnClient()); });
+    await pair.call('create_function', { agent_id: AGENT, type: 'rest_api', name: 'validate_date', description: 'Checks a date', url: 'https://x/date', method: 'post', payload: { date_str: '{{event_date}}' } });
+    expect(calls.find((c) => c.method === 'POST')?.body).toEqual({ type: 'rest_api', name: 'validate_date', description: 'Checks a date' });
+    expect(calls.filter((c) => c.method === 'PUT')[0].body).toEqual({ type: 'rest_api', description: 'Checks a date',
+      configurationSchema: { endpoint: 'https://x/date', method: 'POST', payload: '{"date_str":"{{event_date}}"}', authorization: { type: 'no-auth' }, craftResponse: true } });
+    await pair.call('update_function', { agent_id: AGENT, function_id: 'f1', response_field: 'data.valid' });
+    expect(calls.filter((c) => c.method === 'PUT')[1].body).toEqual({ type: 'rest_api', description: 'Checks a date',
+      configurationSchema: { endpoint: 'https://x/date', method: 'POST', authorization: { type: 'bearer-token', token: 't' }, responseField: 'data.valid' } });
+    await pair.call('create_function', { agent_id: AGENT, type: 'rest_api', name: 'said', url: 'https://x/a', method: 'GET', output_instructions: 'Your quote is {{response.total}}.' });
+    expect(calls.filter((c) => c.method === 'PUT')[2].body.configurationSchema).toMatchObject({ outputInstructions: 'Your quote is {{response.total}}.' });
+    expect(calls.filter((c) => c.method === 'PUT')[2].body.configurationSchema.craftResponse).toBeUndefined();
+    const missing = await pair.call('create_function', { agent_id: AGENT, type: 'rest_api', name: 'no_url' });
+    expect(missing.isError).toBe(true);
+    await pair.close();
+  });
+
+  it('MCP skill tools take typed REST auth and JSON text for free-form objects (as Gemini sends them)', async () => {
+    const NEW = 'fn-new';
+    const { calls } = recordFetch([
+      on('POST', `/ai-studio/bots/${AGENT}/functions`, { json: { success: true, data: { _id: NEW, type: 'rest_api', name: 'get_quote' } } }),
+      on('PUT', `/functions/${NEW}`, { json: { success: true, data: {} } }),
+    ]);
+    const pair = await connectPair((server) => { registerTools(server, new IndemnClient()); });
+    const res = await pair.call('create_function', {
+      agent_id: AGENT, type: 'rest_api', name: 'get_quote', url: 'https://api.example.com/quote', method: 'POST',
+      auth_type: 'bearer-token', auth_token: 'abc', auth_key: '', auth_username: '',
+      payload: '{"event_date": "{{event_date}}", "guests": {{guests}}}',
+      configuration: '{"outputInstructions": "Your premium is {{response.premium}}"}',
+    });
+    expect(res.isError).toBeFalsy();
+    const saved = calls.find((c) => c.method === 'PUT')?.body.configurationSchema;
+    expect(saved).toMatchObject({ endpoint: 'https://api.example.com/quote', method: 'POST', outputInstructions: 'Your premium is {{response.premium}}' });
+    expect(saved.authorization).toEqual({ type: 'bearer-token', token: 'abc' }); // only the fields of its type
+    expect(saved.payload).toBe('{"event_date": "{{event_date}}", "guests": "{{guests}}"}'); // bare placeholder quoted, as the dashboard does
+    await pair.close();
+  });
+
+  it('MCP create_function refuses a second skill with the same name; skill tools take the tool name too', async () => {
+    const existing = { _id: 'f1', toolName: 'lc_abc', name: 'get_quote', type: 'rest_api', configurationSchema: { endpoint: 'https://x', method: 'GET' } };
+    const { calls } = recordFetch([
+      on('GET', `/v2/bots/${AGENT}`, { json: [{ _id: AGENT, name: 'Bot' }] }),
+      on('GET', `/ai-studio/bots/${AGENT}/functions`, { json: { success: true, data: [existing] } }),
+      on('DELETE', '/functions/f1', { json: { success: true } }),
+    ]);
+    const pair = await connectPair((server) => { registerTools(server, new IndemnClient()); });
+    const dup = await pair.call('create_function', { agent_id: AGENT, type: 'rest_api', name: 'Get_Quote', url: 'https://y', method: 'POST' });
+    expect(dup.isError).toBe(true);
+    expect(String(dup.body)).toMatch(/already has a skill named "Get_Quote" \(function_id f1\)\. Change it with update_function/);
+    expect(calls.some((c) => c.method === 'POST')).toBe(false);
+    const ghost = await pair.call('delete_function', { agent_id: AGENT, function_id: 'lc_abc', confirm: true });
+    expect(ghost.isError).toBe(true);
+    expect(String(ghost.body)).toMatch(/Not found: skill lc_abc/);
+    expect(calls.some((c) => c.method === 'DELETE')).toBe(false);
+    const del = await pair.call('delete_function', { agent_id: AGENT, function_id: 'f1', confirm: true });
+    expect(del.body.data).toMatchObject({ deleted: true, function_id: 'f1', name: 'get_quote' });
+    await pair.close();
+  });
+
+  it('MCP create_function saves nothing for a body that is not JSON, and removes the skill when copilot refuses its configuration', async () => {
+    const { calls } = recordFetch([
+      on('POST', `/ai-studio/bots/${AGENT}/functions`, { json: { success: true, data: { _id: 'fx', type: 'rest_api', name: 'quote' } } }),
+      on('PUT', '/functions/fx', { status: 500, json: { error: 'Payload must be a valid JSON string.' } }),
+      on('DELETE', '/functions/fx', { json: { success: true } }),
+    ]);
+    const pair = await connectPair((server) => { registerTools(server, new IndemnClient()); });
+    const bad = await pair.call('create_function', { agent_id: AGENT, type: 'rest_api', name: 'quote', url: 'https://x', method: 'POST', payload: '{"a": 1,}' });
+    expect(bad.isError).toBe(true);
+    expect(String(bad.body)).toMatch(/request body is not valid JSON.*Nothing was saved/);
+    expect(calls.some((c) => c.method === 'POST')).toBe(false);
+    const refused = await pair.call('create_function', { agent_id: AGENT, type: 'rest_api', name: 'quote', url: 'https://x', method: 'POST' });
+    expect(String(refused.body)).toMatch(/Nothing was saved: the skill's configuration was refused/);
+    expect(calls.filter((c) => c.method === 'DELETE').map((c) => c.url)).toEqual([expect.stringContaining('/functions/fx')]);
+    await pair.close();
+  });
+
+  it('MCP import_functions warns that everything is replaced and waits for confirmation', async () => {
+    const { calls } = recordFetch([on('GET', `/v2/bots/${AGENT}`, { json: [{ _id: AGENT, name: 'Bot' }] })]);
+    const pair = await connectPair((server) => { registerTools(server, new IndemnClient()); });
+    const res = await pair.call('import_functions', { agent_id: AGENT, url: 'https://x/skills.json' });
+    expect(res.body).toMatchObject({ dry_run: true });
+    expect(res.body.would).toMatch(/DELETE every skill .* built-in handoff and FAQ retriever/);
+    expect(calls.filter((c) => c.method !== 'GET')).toHaveLength(0); // only name lookups
+    await pair.close();
+  });
+
+  it('MCP update_function and update_agent ask first when the agent may be live, and not for a prototype', async () => {
+    let lifecycle = 'published';
+    const { calls } = recordFetch([
+      on('GET', `/v1-agents/${AGENT}`, () => ({ json: { id: AGENT, name: 'Bot', lifecycle } })),
+      on('GET', `/v2/bots/${AGENT}`, { json: [{ _id: AGENT, name: 'Bot' }] }),
+      on('GET', `/bots/${AGENT}/functions`, { json: { success: true, data: [{ _id: 'f1', type: 'rest_api', description: 'Checks a date',
+        configurationSchema: { endpoint: 'https://x/date', method: 'POST', authorization: { type: 'bearer-token', token: 't' } } }] } }),
+      on('PUT', `/bots/${AGENT}/functions/f1`, { json: { success: true, data: { _id: 'f1' } } }),
+      on('PUT', `/bots/${AGENT}`, { json: { success: true, data: { _id: AGENT } } }),
+      on('PATCH', `/bots/${AGENT}`, { json: { success: true, data: { _id: AGENT } } }),
+    ]);
+    const pair = await connectPair((server) => { registerTools(server, new IndemnClient()); });
+    const writes = () => calls.filter((c) => c.method === 'PUT' || c.method === 'PATCH').length;
+
+    const skill = await pair.call('update_function', { agent_id: AGENT, function_id: 'f1', url: 'https://evil/x', auth_token: 's3cret' });
+    expect(skill.body.dry_run).toBe(true);
+    expect(skill.body.would).toMatch(/of agent "Bot": url, auth_token\. The agent is PUBLISHED \(live for customers\)/);
+    expect(skill.body.would).not.toContain('s3cret');
+    const hook = await pair.call('update_agent', { agent_id: AGENT, webhook_url: 'https://evil/hook' });
+    expect(hook.body.dry_run).toBe(true);
+    expect(writes()).toBe(0);
+
+    await pair.call('update_function', { agent_id: AGENT, function_id: 'f1', url: 'https://x/v2', confirm: true });
+    expect(writes()).toBe(1);
+
+    lifecycle = 'prototype';
+    await pair.call('update_function', { agent_id: AGENT, function_id: 'f1', url: 'https://x/v3' });
+    expect(writes()).toBe(2);
+    await pair.close();
+  });
+});

package/test/sdk/test-chat.test.ts

@@ -0,0 +1,112 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { on, recordFetch, type Responder } from '../helpers/fetch-recorder.js';
+import { cleanEnv, useTempHome } from '../helpers/config-home.js';
+import { jwtExpiringIn } from '../helpers/jwt.js';
+import { startFakeMiddleware, type FakeMiddleware } from '../helpers/fake-middleware.js';
+import { connectPair } from '../helpers/mcp-pair.js';
+import { IndemnClient } from '../../src/sdk/client.js';
+import { ChatSession } from '../../src/sdk/chat.js';
+import { ConversationsSDK } from '../../src/sdk/conversations.js';
+import { ensurePreview, exchange, openTestChat } from '../../src/sdk/test-chat.js';
+import { registerTools } from '../../src/mcp/tools.js';
+
+const ORG = 'aaaaaaaaaaaaaaaaaaaaaaaa';
+const OTHER = 'bbbbbbbbbbbbbbbbbbbbbbbb';
+const AGENT = '111111111111111111111111';
+const PROJ = '222222222222222222222222';
+
+const agentOk = on('GET', `/ai-studio/v2/bots/${AGENT}`, { json: { success: true, data: [{ _id: AGENT, name: 'Quote Bot', id_project: PROJ }] } });
+const previewExisting = on('GET', '/preview/agent', { json: { success: true, data: { _id: 'prev1' } } });
+const stored = (over: Record<string, unknown> = {}): Responder =>
+  on('GET', `/${PROJ}/requests/`, (c) => ({ json: { _id: 'r1', request_id: decodeURIComponent(c.url.split('/requests/')[1]), id_project: PROJ, id_organization: ORG, isTestMode: true, attributes: { isTestMode: true }, ...over } }));
+
+describe('CLI chats are always test conversations', () => {
+  let home: ReturnType<typeof useTempHome>;
+  let mw: FakeMiddleware;
+  beforeEach(async () => {
+    cleanEnv();
+    home = useTempHome();
+    vi.spyOn(process, 'cwd').mockReturnValue(home.dir);
+    IndemnClient.saveConfig({ environment: 'dev', user_id: 'u1', email: 'qa@indemn.ai', session: { token: jwtExpiringIn(5 * 3_600_000) }, orgs: [{ id: ORG, name: 'QA A' }] });
+    mw = await startFakeMiddleware();
+    vi.stubEnv('INDEMN_MIDDLEWARE_URL', mw.url);
+  });
+  afterEach(async () => { await mw.close(); home.cleanup(); });
+
+  it('a caller cannot turn test mode off', () => {
+    const s = new ChatSession(AGENT, 'http://x', undefined, { tester: 't@x', preview: 'p1', customData: { isTestMode: false, other: 1 } });
+    expect(s.getCustomData()).toEqual({ other: 1, conversation_tester: 't@x', preview: 'p1', isTestMode: true });
+  });
+
+  it('opens with isTestMode, the tester email and the preview record, then reads it back', async () => {
+    const { calls } = recordFetch([agentOk, previewExisting, stored()]);
+    const chat = await openTestChat(new IndemnClient(), AGENT);
+    expect(mw.sessionRequests[0].customData).toEqual({ conversation_tester: 'qa@indemn.ai', preview: 'prev1', isTestMode: true });
+    expect(calls.some((c) => c.method === 'POST' && c.url.includes('/preview/agent'))).toBe(false);
+    expect(calls.some((c) => c.url.endsWith(`/${PROJ}/requests/sess-1`))).toBe(true);
+    expect(chat.url).toBe(`https://devcopilot.indemn.ai/#/project/${PROJ}/wsrequest/sess-1/messages?view=single`);
+    await chat.session.disconnect();
+  });
+
+  it('opens with the agent\'s saved greeting, as the dashboard preview does', async () => {
+    const greeting = { text: 'Welcome to Acme renewals!', quick_replies: [] };
+    recordFetch([agentOk, previewExisting, stored(), on('GET', `/bots/${AGENT}/configurations`, { json: { success: true, data: { first_message: greeting } } })]);
+    const chat = await openTestChat(new IndemnClient(), AGENT);
+    expect(mw.sessionRequests[0].customData).toEqual({ first_message: greeting, conversation_tester: 'qa@indemn.ai', preview: 'prev1', isTestMode: true });
+    await chat.session.disconnect();
+  });
+
+  it('stops before any message when the platform stored it as live', async () => {
+    recordFetch([agentOk, previewExisting, stored({ isTestMode: false })]);
+    await expect(openTestChat(new IndemnClient(), AGENT)).rejects.toThrow(/stored as a live conversation.*Nothing was sent/);
+    await new Promise((r) => setTimeout(r, 50));
+    expect(mw.userMessages).toHaveLength(0);
+    expect(mw.closed).toEqual([{ session_id: 'sess-1', reason: 'client_close_conversation' }]);
+  });
+
+  it('stops before any message when it landed in another org', async () => {
+    recordFetch([agentOk, previewExisting, stored({ id_organization: OTHER })]);
+    await expect(openTestChat(new IndemnClient(), AGENT)).rejects.toThrow(`stored in org ${OTHER}`);
+    expect(mw.userMessages).toHaveLength(0);
+  });
+
+  it('waits for the conversation to appear, then accepts it', async () => {
+    let tries = 0;
+    recordFetch([on('GET', '/requests/', () => (++tries < 3 ? { status: 404, text: 'nope' } : { json: { request_id: 's', isTestMode: true, id_organization: ORG } }))]);
+    await new ConversationsSDK(new IndemnClient()).verifyTestConversation(PROJ, 's', ORG, { intervalMs: 5 });
+    expect(tries).toBe(3);
+  });
+
+  it('creates a preview record only when the person has none', async () => {
+    const { calls } = recordFetch([
+      on('GET', '/preview/agent', { json: { success: true, data: null } }),
+      on('POST', '/preview/agent', { json: { success: true, data: { _id: 'prev9' } } }),
+    ]);
+    await expect(ensurePreview(new IndemnClient({ orgId: ORG }), AGENT)).resolves.toBe('prev9');
+    expect(calls.find((c) => c.method === 'POST')?.body).toEqual({});
+  });
+
+  it('sends a message and returns the greeting and the reply', async () => {
+    recordFetch([agentOk, previewExisting, stored()]);
+    const chat = await openTestChat(new IndemnClient(), AGENT);
+    const out = await exchange(chat, 'hi', { settleMs: 50 });
+    expect(out).toEqual({ greeting: 'Hello there', response: 'echo: hi' });
+    await chat.session.disconnect();
+  });
+
+  it('MCP chat keeps the conversation open for the next turn unless asked to end it', async () => {
+    recordFetch([agentOk, previewExisting, stored()]);
+    const pair = await connectPair((server) => { registerTools(server, new IndemnClient()); });
+    const first = await pair.call('chat_with_agent', { agent_id: AGENT, message: 'one' });
+    expect(first.body.data).toMatchObject({ session_id: 'sess-1', test_conversation: true, tester: 'qa@indemn.ai', response: 'echo: one' });
+    expect(first.body.context.org_id).toBe(ORG);
+    await new Promise((r) => setTimeout(r, 50));
+    expect(mw.closed).toHaveLength(0);
+
+    const second = await pair.call('chat_with_agent', { agent_id: AGENT, message: 'two', session_id: 'sess-1', end_conversation: true });
+    expect(second.body.data.response).toBe('echo: two');
+    await new Promise((r) => setTimeout(r, 50));
+    expect(mw.closed).toEqual([{ session_id: 'sess-1', reason: 'client_close_conversation' }]);
+    await pair.close();
+  }, 15_000);
+});

package/test/sdk/tickets.test.ts

@@ -0,0 +1,42 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { on, recordFetch } from '../helpers/fetch-recorder.js';
+import { cleanEnv, useTempHome } from '../helpers/config-home.js';
+import { jwtExpiringIn } from '../helpers/jwt.js';
+import { IndemnClient } from '../../src/sdk/client.js';
+import { TicketsSDK } from '../../src/sdk/tickets.js';
+
+const ORG = 'aaaaaaaaaaaaaaaaaaaaaaaa';
+
+describe('tickets', () => {
+  let home: ReturnType<typeof useTempHome>;
+  beforeEach(() => {
+    cleanEnv();
+    home = useTempHome();
+    vi.spyOn(process, 'cwd').mockReturnValue(home.dir);
+    IndemnClient.saveConfig({ environment: 'dev', user_id: 'u1', session: { token: jwtExpiringIn(5 * 3_600_000) }, orgs: [{ id: ORG, name: 'QA A' }] });
+  });
+  afterEach(() => home.cleanup());
+  const sdk = () => new TicketsSDK(new IndemnClient());
+
+  it('reports similar tickets instead of pretending a ticket was created', async () => {
+    recordFetch([on('POST', '/tickets', { json: { success: true, saved: false, similar: [{ _id: 't9', title: 'Same issue' }] } })]);
+    expect(await sdk().create({ title: 'Broken quote' })).toMatchObject({ saved: false, similar: [{ _id: 't9' }] });
+  });
+
+  it('creates with force and returns the ticket', async () => {
+    const { calls } = recordFetch([on('POST', '/tickets', { json: { success: true, saved: true, data: { _id: 't1', title: 'Broken quote' } } })]);
+    expect(await sdk().create({ title: 'Broken quote' }, { force: true })).toEqual({ saved: true, ticket: { _id: 't1', title: 'Broken quote' } });
+    expect(calls[0].body).toEqual({ title: 'Broken quote', force: true });
+  });
+
+  it('lists with comma-separated statuses', async () => {
+    const { calls } = recordFetch([on('GET', '/tickets', { json: { success: true, data: [] } })]);
+    await sdk().list({ status: ['not_started', 'in_progress'] });
+    expect(new URL(calls[0].url).searchParams.get('status')).toBe('not_started,in_progress');
+  });
+
+  it('reports rule caveats instead of saving an overlapping rule', async () => {
+    recordFetch([on('POST', '/ticket-creation-rules', { json: { success: true, saved: false, caveats: ['overlaps rule A'], suggested_name: 'Refunds' } })]);
+    expect(await sdk().saveRule({ prompt: 'refund requests' })).toEqual({ saved: false, caveats: ['overlaps rule A'], suggested_name: 'Refunds' });
+  });
+});

package/test/sdk/voice.test.ts

@@ -0,0 +1,147 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { on, recordFetch } from '../helpers/fetch-recorder.js';
+import { cleanEnv, useTempHome } from '../helpers/config-home.js';
+import { jwtExpiringIn } from '../helpers/jwt.js';
+import { IndemnClient } from '../../src/sdk/client.js';
+import { VoiceSDK } from '../../src/sdk/voice.js';
+
+const ORG = 'aaaaaaaaaaaaaaaaaaaaaaaa';
+const AGENT = '111111111111111111111111';
+const FOREIGN = '999999999999999999999999';
+const agents = [
+  on('GET', `/v2/bots/${AGENT}`, { json: [{ _id: AGENT, name: 'Bot', channels: [{ type: 'VOICE' }] }] }),
+  on('GET', `/v2/bots/${FOREIGN}`, { status: 404, text: 'nope' }),
+];
+
+describe('voice', () => {
+  let home: ReturnType<typeof useTempHome>;
+  beforeEach(() => {
+    cleanEnv();
+    home = useTempHome();
+    vi.spyOn(process, 'cwd').mockReturnValue(home.dir);
+    IndemnClient.saveConfig({ environment: 'dev', user_id: 'u1', session: { token: jwtExpiringIn(5 * 3_600_000) }, orgs: [{ id: ORG, name: 'QA A' }] });
+  });
+  afterEach(() => home.cleanup());
+  const sdk = () => new VoiceSDK(new IndemnClient());
+
+  it('searches available numbers like the dashboard and shows five by default', async () => {
+    const offered = Array.from({ length: 7 }, (_, i) => ({ phoneNumber: `+1331204491${i}`, friendlyName: `(331) 204-491${i}`, locality: 'Aurora', region: 'IL' }));
+    const { calls } = recordFetch([on('GET', '/voice/configurations/numbers/local', { json: { success: true, data: offered } })]);
+    const rows = await sdk().searchNumbers({ areaCode: '(331)', contains: '204' });
+    expect(rows).toHaveLength(5);
+    const url = new URL(calls[0].url);
+    expect(Object.fromEntries(url.searchParams)).toEqual({ countryCode: 'US', limit: '5', areaCode: '331', pattern: '204' });
+    await expect(sdk().searchNumbers({ country: 'FR' })).rejects.toThrow(/US, CA, GB, AU/);
+  });
+
+  it('buys a still-available number for a voice agent with the Twilio record, and refuses the unsafe cases first', async () => {
+    const pick = { phoneNumber: '+13312044919', friendlyName: '(331) 204-4919', locality: 'Aurora', region: 'IL' };
+    const { calls } = recordFetch([
+      ...agents,
+      on('GET', '/v2/bots/222222222222222222222222', { json: [{ _id: '222222222222222222222222', name: 'Web', channels: [{ type: 'WEB' }] }] }),
+      on('GET', '/voice/configurations/numbers/local', { json: { success: true, data: [pick] } }),
+      on('GET', '/voice/configurations/numbers', { json: { success: true, data: [{ phoneNumber: '+13310000000' }] } }),
+      on('GET', `/bots/${AGENT}/configurations/voice/numbers`, { json: { success: true, data: [] } }),
+      on('POST', '/configurations/voice/numbers', { json: { success: true, data: { phoneNumber: pick.phoneNumber } } }),
+    ]);
+    await expect(sdk().buyNumber('222222222222222222222222', '(331) 204-4919')).rejects.toThrow(/does not answer the phone/);
+    await expect(sdk().buyNumber(AGENT, '(331) 000-0000')).rejects.toThrow(/already owns/);
+    await expect(sdk().buyNumber(AGENT, '(331) 204-1111')).rejects.toThrow(/no longer available/);
+    expect(calls.some((c) => c.method === 'POST')).toBe(false);
+    const res = await sdk().buyNumber(AGENT, '(331) 204-4919');
+    expect(calls.find((c) => c.method === 'POST')?.body).toEqual({ type: 'local', friendlyName: '(331) 204-4919', phoneNumber: '+13312044919', payload: pick });
+    expect(res).toMatchObject({ phone_number: '+13312044919', locality: 'Aurora', agent: 'Bot' });
+  });
+
+  it('refuses to set the voice of another org\'s agent before any write', async () => {
+    const { calls } = recordFetch(agents);
+    await expect(sdk().setAgentVoice(FOREIGN, { provider: 'cartesia', voice_id: 'v', name: 'n', gender: 'g', language: 'en', countryCode: 'US' })).rejects.toThrow(/not in the organization/);
+    expect(calls.some((c) => c.method === 'POST')).toBe(false);
+  });
+
+  it('explains that an agent without a phone number has no voice settings', async () => {
+    recordFetch([...agents, on('GET', '/configurations/voice/numbers', { json: { success: true, data: [] } })]);
+    await expect(sdk().getAgentVoice(AGENT)).rejects.toMatchObject({ exitCode: 2 });
+  });
+
+  it('never buys a number: an unowned number is refused before the attach call', async () => {
+    const { calls } = recordFetch([...agents, on('GET', '/voice/configurations/numbers', { json: { success: true, data: [{ phoneNumber: '+15550001', is_active: false, type: 'local' }] } })]);
+    await expect(sdk().attachNumber(AGENT, '+15559999')).rejects.toThrow(/not a number this org owns/);
+    expect(calls.some((c) => c.method === 'POST')).toBe(false);
+  });
+
+  it('moves a number between agents even when copilot lists no owned numbers, and still refuses unknown ones', async () => {
+    const OTHER = '222222222222222222222222';
+    const { calls } = recordFetch([
+      ...agents,
+      on('GET', `/v2/bots/${OTHER}`, { json: [{ _id: OTHER, name: 'New', channels: [{ type: 'VOICE' }] }] }),
+      on('GET', `/bots/${AGENT}/configurations/voice/numbers`, { json: { success: true, data: [{ phoneNumber: '+15550001', type: 'local', friendlyName: '(555) 000-1', additionalDetails: { locality: 'Chicago' } }] } }),
+      on('GET', `/bots/${OTHER}/configurations/voice/numbers`, { json: { success: true, data: [] } }),
+      on('DELETE', '/configurations/voice/numbers', { json: { success: true, data: {} } }),
+      // copilot's owned-numbers list comes back empty when the org is served from its cache
+      on('GET', '/voice/configurations/numbers', { json: { success: true, data: [] } }),
+      on('POST', '/configurations/voice/numbers', { json: { success: true, data: {} } }),
+    ]);
+    const voice = sdk();
+    await expect(voice.attachNumber(OTHER, '+15559999')).rejects.toThrow(/not a number this org owns/);
+    await voice.detachNumber(AGENT, '+15550001');
+    await voice.attachNumber(OTHER, '+15550001');
+    expect(calls.filter((c) => c.method === 'POST').map((c) => c.body)).toEqual([
+      { type: 'local', phoneNumber: '+15550001', friendlyName: '(555) 000-1', payload: { locality: 'Chicago' } },
+    ]);
+  });
+
+  it('attaches an owned, free number with its own type', async () => {
+    const { calls } = recordFetch([
+      ...agents,
+      on('GET', '/voice/configurations/numbers', { json: { success: true, data: [{ phoneNumber: '+15550001', is_active: false, type: 'toll-free' }] } }),
+      on('POST', '/configurations/voice/numbers', { json: { success: true, data: {} } }),
+    ]);
+    await sdk().attachNumber(AGENT, '+15550001');
+    expect(calls.find((c) => c.method === 'POST')?.body).toEqual({ type: 'toll-free', phoneNumber: '+15550001' });
+  });
+
+  it('marks a voice preview as a test call, like the dashboard', async () => {
+    const { calls } = recordFetch([...agents, on('GET', `/bots/${AGENT}/configurations/voice/numbers`, { json: { success: true, data: [{ phoneNumber: '+15550001' }] } }),
+      on('POST', '/livekit/token', { json: { token: 't', server_url: 'wss://lk', room_name: 'call_x' } })]);
+    const res = await sdk().voicePreview(AGENT);
+    const body = calls.find((c) => c.url.endsWith('/livekit/token'))!.body as { bot_id: string; user_attributes: Record<string, string> };
+    expect(body.bot_id).toBe(AGENT);
+    expect(body.user_attributes.isTestMode).toBe('true');
+    expect(body.user_attributes['sip.twilio.callSid']).toMatch(/^CA[0-9A-F]{32}$/);
+    expect(res.join_url).toBe('https://meet.livekit.io/custom?liveKitUrl=wss%3A%2F%2Flk&token=t');
+    expect(body.user_attributes['sip.trunkPhoneNumber']).toBe('+15550001');
+  });
+
+  it('refuses a test call for an agent without a number (it would never join)', async () => {
+    const { calls } = recordFetch([...agents, on('GET', '/configurations/voice/numbers', { json: { success: true, data: [] } })]);
+    await expect(sdk().voicePreview(AGENT)).rejects.toThrow(/no phone number/);
+    expect(calls.some((c) => c.url.endsWith('/livekit/token'))).toBe(false);
+  });
+
+  it('keeps the saved speed and sends the country in lower case', async () => {
+    const { calls } = recordFetch([...agents, on('GET', '/configurations/voice/numbers', { json: { success: true, data: [{ phoneNumber: '+15550001', modelSettings: { tts: { settings: { speed: 1.2 } } } }] } }),
+      on('POST', '/voices', { json: { success: true, data: {} } })]);
+    await sdk().setAgentVoice(AGENT, { provider: 'cartesia', voice_id: 'v', name: 'n', gender: 'g', language: 'en', countryCode: 'US' });
+    expect(calls.find((c) => c.method === 'POST')?.body).toMatchObject({ countryCode: 'us', settings: { speed: 1.2 } });
+  });
+
+  it('sets the transcriber with key terms the way the dashboard does', async () => {
+    const { calls } = recordFetch([...agents, on('GET', '/configurations/voice/numbers', { json: { success: true, data: [{ phoneNumber: '+15550001' }] } }),
+      on('POST', '/voices', { json: { success: true, data: {} } })]);
+    await sdk().setAgentTranscriber(AGENT, { provider: 'deepgram', model: 'flux-general-en', language: 'en', keyterms: [' Markel ', 'EventGuard'] });
+    expect(calls.find((c) => c.method === 'POST')?.body).toEqual({ stt: { provider: 'deepgram', model: 'flux-general-en', language: 'en', config: { keyterm: ['Markel', 'EventGuard'] } } });
+    await expect(sdk().setAgentTranscriber(AGENT, { provider: 'd', model: 'm', language: 'en', keyterms: ['x'.repeat(101)] })).rejects.toThrow(/100 characters/);
+  });
+
+  it('refuses to attach a second number or a number to an agent that does not answer the phone', async () => {
+    const { calls } = recordFetch([
+      on('GET', `/v2/bots/${AGENT}`, { json: [{ _id: AGENT, name: 'Bot', channels: [{ type: 'VOICE' }] }] }),
+      on('GET', '/v2/bots/222222222222222222222222', { json: [{ _id: '222222222222222222222222', name: 'Web', channels: [{ type: 'WEB' }] }] }),
+      on('GET', `/bots/${AGENT}/configurations/voice/numbers`, { json: { success: true, data: [{ phoneNumber: '+15550002' }] } }),
+    ]);
+    await expect(sdk().attachNumber(AGENT, '+15550001')).rejects.toThrow(/already has \+15550002/);
+    await expect(sdk().attachNumber('222222222222222222222222', '+15550001')).rejects.toThrow(/does not answer the phone/);
+    expect(calls.some((c) => c.method === 'POST')).toBe(false);
+  });
+});

package/vitest.config.ts

@@ -0,0 +1,11 @@
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    include: ['test/**/*.test.ts'],
+    environment: 'node',
+    restoreMocks: true,
+    unstubGlobals: true,
+    unstubEnvs: true,
+  },
+});