@indemn/cli 1.7.0 → 1.7.2

package/src/mcp/tools.ts

@@ -54,9 +54,12 @@ function withAuthorization<T extends AuthFields & { configuration?: Record<strin
   return { ...args, configuration: { ...(args.configuration ?? {}), authorization } };
 }
 
-// Helper: format a successful MCP tool result
+/** The CI gate's threshold when the caller gives none (evaluations repo scripts/eval_gate.py uses the same). */
+const DEFAULT_MIN_PASS_RATE = 0.8;
+
+// Helper: format a successful MCP tool result (the registry adds the context and formats it)
 function success(data: unknown) {
-  return { content: [{ type: 'text' as const, text: JSON.stringify(data, null, 2) }] };
+  return { content: [{ type: 'text' as const, text: JSON.stringify(data) }] };
 }
 
 // Helper: format an error MCP tool result
@@ -130,6 +133,20 @@ const parseJsonText = (v: unknown) => {
   try { return JSON.parse(v); } catch { return v; }
 };
 const jsonObject = () => z.preprocess(parseJsonText, z.record(z.any()));
+// A list a model may also write as JSON text.
+const jsonArray = <T extends z.ZodTypeAny>(item: T) => z.preprocess(parseJsonText, z.array(item));
+
+// What the knowledge base import accepts: typed, so a wrong shape is refused here instead of being
+// "imported" as nothing (copilot answers success for any body).
+const kbImportSchema = z.preprocess(parseJsonText, z.object({
+  type: z.enum(['file']).describe('Kind of import; files from the organization\'s file store'),
+  sources: z.array(z.object({
+    name: z.string().optional().describe('File name shown in the knowledge base'),
+    file_type: z.string().optional().describe('Extension, e.g. pdf, txt, docx (taken from the name when missing)'),
+    url: z.string().describe('The file\'s link in the file store'),
+  }).passthrough()).min(1),
+  is_qna_import: z.boolean().optional().describe('The file holds question/answer pairs'),
+}).passthrough());
 
 // A skill for bulk_create_skills with flat fields (the configuration is built as create_function builds it);
 // a proposal from generate_skills_from_doc keeps its own configurationSchema.
@@ -170,12 +187,23 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
             },
             (err) => { if (what && notFound.test(err instanceof Error ? err.message : String(err))) missing.push(`${what} ${id}`); })
           : undefined;
+      const agentId = typeof args.agent_id === 'string' ? args.agent_id : undefined;
+      const label = (name: unknown) => ({ name: typeof name === 'string' && name ? name : undefined });
       await Promise.all([
         add(args.agent_id ?? args.bot_id, 'agent', (id) => agents.getAgent(id)),
-        typeof args.agent_id === 'string' ? add(args.function_id, 'skill', (id) => skillOf(String(args.agent_id), id)) : undefined,
+        agentId ? add(args.function_id, 'skill', (id) => skillOf(agentId, id)) : undefined,
         add(args.kb_id, 'knowledge base', (id) => kb.getKB(id)),
+        ...((Array.isArray(args.kb_ids) ? args.kb_ids : []) as unknown[]).map((id) => add(id, 'knowledge base', (x) => kb.getKB(x))),
         add(args.test_set_id, 'test set', (id) => testSets.getTestSet(id)),
         add(args.rubric_id, 'rubric', (id) => rubrics.getRubric(id)),
+        // The rest name things the cards used to show as raw ids.
+        typeof args.kb_id === 'string' ? add(args.source_id, null, (id) => kb.findDataSource(String(args.kb_id), id).then((d) => label(d?.question ?? d?.name ?? d?.source_url))) : undefined,
+        add(args.ticket_id, null, (id) => tickets.get(id).then((t) => { const x = t as { ticket_ref?: string; title?: string }; return label([x.ticket_ref, x.title].filter(Boolean).join(' ')); })),
+        add(args.rule_id, null, (id) => tickets.listRules({ includeTrashed: true }).then((rules) => label((rules as Array<{ _id?: string; id?: string; name?: string }>).find((r) => (r._id ?? r.id) === id)?.name))),
+        add(args.distribution_id, null, (id) => distribution.list().then((d) => { const p = (d.paths ?? []).find((x) => x.id === id); return label(p ? `${p.path_name ?? ''} (${p.host_name ?? '*'}${p.path_expression ?? ''})`.trim() : undefined); })),
+        add(args.template_id, null, (id) => distribution.listTemplates().then((ts) => label((ts as Array<{ _id?: string; name?: string }>).find((t) => t._id === id)?.name))),
+        add(args.owner_id, null, (id) => orgs.listMembers().then((ms) => { const m = ms.find((x) => x.user_id === id); return label(m?.name ?? m?.email); })),
+        agentId && typeof args.function_id === 'string' ? add(args.parameter_id, null, (id) => skillOf(agentId, String(args.function_id)).then((s) => functions.listParameters(agentId, s._id)).then((ps) => label(ps.find((p) => p._id === id)?.name))) : undefined,
         add(orgId, null, (id) => client.copilotGet<{ organization?: { name?: string } }>(`/organization/${id}`).then((r) => r.organization)),
       ]);
       return { names, missing };
@@ -231,6 +259,18 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
   const config = new ConfigSDK(client);
   const functions = new FunctionsSDK(client);
   // A skill of an agent by its id.
+  /** An export result with a signed download_url: the services hand out unsigned file-store links (403 in a browser). */
+  const withDownloadLink = async <T extends object>(result: T, stored?: string) => {
+    if (!stored || typeof stored !== 'string') return result;
+    const signed = /X-Amz-Signature=/.test(stored) ? stored : await kb.signedLink(stored);
+    return { ...result, download_url: signed ?? stored, ...(signed ? {} : { note: 'The link could not be signed; it may need signing in to the dashboard.' }) };
+  };
+  /** A report file written by this process, put in the organization's file store so the person can download it. */
+  const deliver = async (result: { file_path: string; file_name: string; file_type: string }, upload?: boolean) => {
+    if (!upload) return result;
+    const { signedUrl, url } = await kb.storeFile(result.file_path);
+    return { ...result, download_url: signedUrl ?? url };
+  };
   const skillOf = async (agentId: string, id: string) => {
     const skill = (await functions.listFunctions(agentId)).find((f) => f._id === id);
     if (!skill) throw new Error(`Skill ${id} is not on agent ${agentId}.`);
@@ -259,11 +299,15 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
   reg.tool(
     'list_agents',
     'List the agents (bots) of the organization: id, name, channels. Start here to find an agent id.',
-    { channel: z.string().optional().describe('Only agents on this channel, e.g. web, voice, email') },
+    {
+      channel: z.string().optional().describe('Only agents on this channel, e.g. web, voice, email'),
+      search: z.string().optional().describe('Only agents whose name contains this text'),
+    },
     async (args) => {
       try {
         const pages = await orgPages(client);
         const wanted = args.channel?.trim().toUpperCase();
+        const needle = args.search?.trim().toLowerCase();
         // What a person needs, not the stored record (a page of full records ran to 73k characters).
         const rows = (await agents.listAgents()).map((a) => ({
           _id: a._id,
@@ -275,7 +319,8 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
           updated_at: a.updatedAt,
           url: `${pages}/ai-studio/bot/${a._id}/configurations`,
         }));
-        return success(wanted ? rows.filter((a) => a.channels.some((c) => c.toUpperCase() === wanted)) : rows);
+        const byChannel = wanted ? rows.filter((a) => a.channels.some((c) => c.toUpperCase() === wanted)) : rows;
+        return success(needle ? byChannel.filter((a) => a.name.toLowerCase().includes(needle)) : byChannel);
       } catch (err) { return error(err); }
     },
   );
@@ -392,7 +437,7 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
       preview: async (a) => {
         const agent = await agents.getAgent(String(a.agent_id));
         const lifecycle = await lifecycleOf(String(a.agent_id));
-        return `This will delete agent "${agent.name}"${mayBeLive(lifecycle) ? `, which ${liveText(lifecycle)}` : ''}. It cannot be restored from the CLI.`;
+        return `This will delete agent "${agent.name}"${mayBeLive(lifecycle) ? `, which ${liveText(lifecycle)}` : ''}. It cannot be restored.`;
       },
     },
   );
@@ -450,7 +495,16 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
     },
     async (args) => {
       try {
-        return success(await agents.cloneAgent(args.agent_id, { name: args.name, channels: args.channels }));
+        const copy = await agents.cloneAgent(args.agent_id, { name: args.name, channels: args.channels });
+        // copilot's clone answers { new_agent_id, new_agent_name, ... } and leaves the description empty:
+        // carry the original's over.
+        const copyId = copy._id ?? (copy as unknown as { new_agent_id?: string }).new_agent_id;
+        const source = await agents.getAgent(args.agent_id);
+        if (source.description && !copy.description && copyId) {
+          const described = await agents.updateAgent(copyId, { description: source.description }).then(() => true).catch(() => false);
+          return success({ ...copy, ...(described ? { description: source.description } : {}) });
+        }
+        return success(copy);
       } catch (err) { return error(err); }
     },
   );
@@ -468,7 +522,7 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
     'import_agent',
     'Create a new agent in this org from a bundle made by export_agent (possibly from another org or platform). Lists skills that failed and secrets to fill in.',
     {
-      bundle: z.record(z.unknown()).describe('The bundle returned by export_agent'),
+      bundle: jsonObject().describe('The bundle returned by export_agent (an object, or JSON text)'),
       name: z.string().optional().describe('Name for the new agent (default: the bundle name)'),
       link_knowledge_bases: z.boolean().optional().describe('Link the same knowledge base ids if they exist in this org'),
       allow_duplicate: z.boolean().optional(),
@@ -515,16 +569,18 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
     system_prompt: a.system_prompt as string | undefined,
     greeting: a.first_message as string | undefined,
     model: a.model ? modelArg(String(a.model)) : undefined,
+    parameters: a.temperature !== undefined ? { temperature: a.temperature } : undefined,
   });
 
   reg.tool(
     'set_config',
-    'Change an agent\'s prompt, greeting and/or model. The confirmation shows the prompt diff and whether the agent is published; published agents need confirm_published too. The result says what was saved (read back from the platform).',
+    'Change an agent\'s prompt, greeting, model and/or temperature. The confirmation shows the prompt diff and whether the agent is published; published agents need confirm_published too. The result says what was saved (read back from the platform).',
     {
       agent_id: z.string().describe('The agent ID'),
       system_prompt: z.string().optional().describe('New system prompt (whole text)'),
       first_message: z.string().optional().describe('New greeting shown to users'),
       model: z.string().optional().describe('provider/model, e.g. openai/gpt-4.1 (see list_llm_models)'),
+      temperature: z.number().min(0).max(2).optional().describe('Model temperature (0 = most predictable); only for models that expose it'),
       confirm_published: z.boolean().optional().describe('Required with confirm when the agent is published and the user explicitly agreed'),
     },
     async (args, meta) => {
@@ -592,10 +648,16 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
       ...skillAuthFields,
       configuration: jsonObject().optional().describe('Other configurationSchema fields (an object, or JSON text); the fields above win'),
       transfer_to: z.string().optional().describe('transfer_call: phone number (E.164, e.g. +15551234567) or SIP address (sip:...) calls are transferred to'),
+      parameters: jsonArray(z.object({
+        name: z.string(), type: z.string().describe('string, number or boolean'),
+        description: z.string().optional(), required: z.boolean().optional(),
+        allowed_values: z.array(z.string()).optional().describe('Fixed choices the customer picks from'),
+      })).optional().describe('What the skill collects from the customer before it runs ({{name}} placeholders in url/payload)'),
     },
     async (args) => {
       try {
         const { agent_id, type, name, description } = args;
+        const parameters = (args.parameters ?? []) as Array<{ name: string; type: string; description?: string; required?: boolean; allowed_values?: string[] }>;
         const configurationSchema = skillConfiguration(type, withAuthorization(args));
         // copilot sends a REST answer straight to the customer unless craftResponse is on; with nothing to say
         // how to present it, let the agent phrase it.
@@ -613,9 +675,16 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
         if (same) throw new Error(`The agent already has a skill named "${name}" (function_id ${same._id}). Change it with update_function instead of creating another.`);
         // copilot turns configurationSchema into the executable form only on update: create, then configure.
         const created = await functions.createFunction(agent_id, { type, name, description });
-        if (!configurationSchema) return success(created);
+        // Parameters are their own records: a skill created with parameters used to lose them silently.
+        const addParameters = async () => {
+          const saved = [];
+          for (const { allowed_values, ...p } of parameters) saved.push(await functions.addParameter(agent_id, created._id, { ...p, allowedValues: allowed_values }));
+          return saved;
+        };
+        if (!configurationSchema) return success(parameters.length ? { ...created, parameters: await addParameters() } : created);
         try {
-          return success(await functions.updateFunction(agent_id, created._id, { type, description: description ?? '', configurationSchema }));
+          const configured = await functions.updateFunction(agent_id, created._id, { type, description: description ?? '', configurationSchema });
+          return success(parameters.length ? { ...configured, parameters: await addParameters() } : configured);
         } catch (err) {
           // Leave no half-made skill behind: remove the empty one, then say why nothing was saved.
           const why = err instanceof Error ? err.message : String(err);
@@ -707,12 +776,12 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
 
   reg.tool(
     'export_functions',
-    'Export every skill of an agent as a JSON file (to copy them or keep a backup before import_functions).',
+    'Export every skill of an agent as a JSON file (to copy them or keep a backup before import_functions); download_url is the link to give the person.',
     { agent_id: z.string().describe('The agent ID') },
     async (args) => {
       try {
-        const result = await functions.exportFunctions(args.agent_id);
-        return success(result);
+        const result = await functions.exportFunctions(args.agent_id) as { fileUrl?: string; signedUrl?: string; url?: string };
+        return success(await withDownloadLink(result, result.signedUrl ?? result.fileUrl ?? result.url));
       } catch (err) { return error(err); }
     },
   );
@@ -807,6 +876,7 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
         return success(result);
       } catch (err) { return error(err); }
     },
+    liveChange('a skill parameter', ['function_id']),
   );
 
   reg.tool(
@@ -829,6 +899,7 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
         return success(result);
       } catch (err) { return error(err); }
     },
+    liveChange('a skill parameter', ['function_id', 'parameter_id']),
   );
 
   reg.tool(
@@ -950,11 +1021,12 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
 
   reg.tool(
     'list_kb_data',
-    'The question/answer pairs typed into a knowledge base (website and file sources are listed by get_knowledge_base).',
+    'The question/answer pairs typed into a knowledge base (website and file sources are listed by get_knowledge_base). Each entry: id, question, answer, whether it is trained. full: true adds the stored chunks.',
     {
       kb_id: z.string().describe('The knowledge base ID'),
       page: z.number().optional().describe('Page number'),
       limit: z.number().optional().describe('Items per page'),
+      full: z.boolean().optional().describe('Include the chunks and statistics of every entry'),
     },
     async (args) => {
       try {
@@ -962,7 +1034,15 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
         if (args.page !== undefined) query.page = String(args.page);
         if (args.limit !== undefined) query.limit = String(args.limit);
         const result = await kb.listDataSources(args.kb_id, Object.keys(query).length ? query : undefined);
-        return success(result);
+        if (args.full) return success(result);
+        // The stored record repeats every chunk twice (chunks, chunks_text): a page of it is tens of kilobytes.
+        const entries = (result.dataSources ?? []).map((d) => ({
+          _id: d._id, type: d.type, question: d.question ?? d.name, answer: d.answer,
+          ...(d.source_url ? { source_url: d.source_url } : {}),
+          trained: (d as { trained?: boolean }).trained, ...(d.status ? { status: d.status } : {}),
+          ...((d as { error_message?: string }).error_message ? { error: (d as { error_message?: string }).error_message } : {}),
+        }));
+        return success({ ...result, dataSources: entries });
       } catch (err) { return error(err); }
     },
   );
@@ -1144,30 +1224,37 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
 
   reg.tool(
     'export_kb',
-    'Export the question/answer pairs of a knowledge base as a CSV or XLSX download link.',
+    'Export the question/answer pairs of a knowledge base as a CSV or XLSX file; download_url is the link to give the person (valid for a while).',
     {
       kb_id: z.string().describe('The knowledge base ID'),
-      format: z.string().optional().describe('Export format (e.g. "json", "csv")'),
+      format: z.string().optional().describe('Export format: csv (default) or xlsx'),
     },
     async (args) => {
       try {
-        const result = await kb.exportKB(args.kb_id, args.format || 'json');
-        return success(result);
+        const result = await kb.exportKB(args.kb_id, args.format || 'csv') as { fileUrl?: string; signedUrl?: string };
+        return success(await withDownloadLink(result, result.signedUrl ?? result.fileUrl));
       } catch (err) { return error(err); }
     },
   );
 
   reg.tool(
     'import_kb',
-    'Import websites or files into a knowledge base; processed in the background (see kb_scrape_status).',
+    'Import files (already in the organization\'s file store) into a knowledge base; processed in the background (see kb_scrape_status). For a website use scrape_url.',
     {
       kb_id: z.string().describe('The knowledge base ID'),
-      data: z.record(z.unknown()).describe('Data to import'),
+      data: kbImportSchema.describe('{ type: "file", sources: [{ name, file_type, url }] } (an object, or JSON text)'),
     },
     async (args) => {
       try {
-        const result = await kb.importKB(args.kb_id, args.data);
-        return success(result);
+        const data = args.data as { type: string; sources: Array<{ name?: string; url: string; file_type?: string }> };
+        // The import service tells the file's kind from file_type: fill it from the name or the link.
+        const sources = data.sources.map((s) => ({
+          ...s,
+          name: s.name ?? s.url.split('?')[0].split('/').pop() ?? 'file',
+          file_type: (s.file_type ?? (s.name ?? s.url.split('?')[0]).split('.').pop() ?? '').toLowerCase(),
+        }));
+        const result = await kb.importKB(args.kb_id, { ...data, sources });
+        return success({ ...(result as object), imported: sources.map((s) => s.name) });
       } catch (err) { return error(err); }
     },
   );
@@ -1220,7 +1307,8 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
         return success({
           conversation_id: conversation.request_id, test: conversation.isTestMode === true,
           url: conversationUrl(client, projectId, conversation.request_id),
-          messages: messages.map((m) => ({ role: m.role, text: m.text, at: m.createdAt })),
+          // System lines carry the dashboard's template ("{{userLabel}} has ended the call"): say it in words.
+          messages: messages.map((m) => ({ role: m.role, text: (m.text ?? '').replace(/\{\{\s*userLabel\s*\}\}/g, 'The customer'), at: m.createdAt })),
         });
       } catch (err) { return error(err); }
     },
@@ -1322,10 +1410,18 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
 
   reg.tool(
     'list_agent_numbers',
-    'Phone numbers attached to an agent, or (without agent_id) every number the org owns.',
+    'Phone numbers attached to an agent, or (without agent_id) every number the org owns: the ones attached to an agent (with the agent) and the free ones.',
     { agent_id: z.string().optional() },
     async (args) => {
-      try { return success(args.agent_id ? await voice.agentNumbers(args.agent_id) : await voice.orgNumbers()); } catch (err) { return error(err); }
+      try {
+        if (args.agent_id) return success(await voice.agentNumbers(args.agent_id));
+        // copilot's org list holds only unattached ("reserve") numbers; the attached ones sit on the agents.
+        const [free, all] = await Promise.all([voice.orgNumbers(), agents.listAgents()]);
+        const attached = all
+          .filter((a) => (a as { connected_phone?: string }).connected_phone)
+          .map((a) => ({ phone_number: (a as { connected_phone?: string }).connected_phone, attached: true, agent_id: a._id, agent_name: a.name }));
+        return success([...attached, ...free.map((n) => ({ phone_number: n.phoneNumber, attached: false, name: n.friendlyName, type: n.type }))]);
+      } catch (err) { return error(err); }
     },
   );
 
@@ -1374,7 +1470,7 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
     async (args, meta) => {
       try {
         // A purchase needs the person, not the model: confirm: true from a host without approval forms is not enough.
-        if (!meta.confirmedByPerson) throw new Error('Buying a number needs a person to approve it in an approval form, and this host cannot show one. Nothing was bought. Buy it in the dashboard, or with `indemn agents numbers buy` in a terminal.');
+        if (!meta.confirmedByPerson) throw new Error('Buying a number needs a person to approve it in an approval form, and this host cannot show one. Nothing was bought. Buy it in the dashboard instead.');
         return success(await voice.buyNumber(args.agent_id, args.phone_number, { country: args.country, tollFree: args.toll_free }));
       } catch (err) { return error(err); }
     },
@@ -1512,19 +1608,64 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
     try { return success(await orgSettings.setTimezone(args.timezone)); } catch (err) { return error(err); }
   });
 
+  const DAY_NAMES = ['Sunday', 'Monday', 'Tuesday', 'Wednesday', 'Thursday', 'Friday', 'Saturday'];
+  const clock = (hhmm: string) => {
+    const [h, m] = hhmm.split(':').map(Number);
+    const hour = ((h + 11) % 12) + 1;
+    return `${hour}${m ? `:${String(m).padStart(2, '0')}` : ''}${h < 12 ? 'am' : 'pm'}`;
+  };
+  /** What agents say about the hours, built from the hours themselves so it never contradicts them. */
+  const hoursMessage = (days: Array<{ day: number; slots: Array<{ start: string; end: string }> }>) => {
+    const open = days.filter((d) => d.slots.length).sort((a, b) => a.day - b.day);
+    if (!open.length) return 'We are currently closed.';
+    const parts = open.map((d) => `${DAY_NAMES[d.day]} ${d.slots.map((s) => `${clock(s.start)} to ${clock(s.end)}`).join(' and ')}`);
+    return `We're open ${parts.join('; ')}.`;
+  };
+
   reg.tool(
     'set_business_hours',
-    'Replace the org business hours. days: 0 Sunday to 6; an empty slots list closes that day.',
-    { enabled: z.boolean(), hours: z.array(z.object({ day: z.number().int().min(0).max(6), slots: z.array(z.object({ start: z.string().describe('HH:MM'), end: z.string().describe('HH:MM') })) })).optional(), out_of_hours_message: z.string().optional() },
+    'Replace the org business hours: every day not listed is closed. days: 0 Sunday to 6. enabled turns enforcement on or off (unchanged when omitted). The out-of-hours message is rebuilt from the hours unless given.',
+    {
+      enabled: z.boolean().optional().describe('Enforce the hours (agents say the out-of-hours message outside them); unchanged when omitted'),
+      hours: jsonArray(z.object({ day: z.number().int().min(0).max(6), slots: z.array(z.object({ start: z.string().describe('HH:MM'), end: z.string().describe('HH:MM') })) })).optional(),
+      out_of_hours_message: z.string().optional(),
+    },
     async (args) => {
       try {
-        return success(await orgSettings.setBusinessHours({ businessHoursEnabled: args.enabled, businessHours: args.hours, ...(args.out_of_hours_message ? { businessHoursUtterance: args.out_of_hours_message } : {}) }));
+        const current = (await orgSettings.get()) as { businessHoursConfig?: { businessHoursEnabled?: boolean } };
+        const enabled = args.enabled ?? Boolean(current.businessHoursConfig?.businessHoursEnabled);
+        const given = (args.hours ?? []) as Array<{ day: number; slots: Array<{ start: string; end: string }> }>;
+        // Replace means replace: a day the person did not mention is closed.
+        const days = args.hours ? DAY_NAMES.map((_, day) => ({ day, slots: given.filter((d) => d.day === day).flatMap((d) => d.slots) })) : undefined;
+        return success(await orgSettings.setBusinessHours({
+          businessHoursEnabled: enabled,
+          ...(days ? { businessHours: days, businessHoursUtterance: args.out_of_hours_message ?? hoursMessage(days) } : {}),
+          ...(!days && args.out_of_hours_message ? { businessHoursUtterance: args.out_of_hours_message } : {}),
+        }));
       } catch (err) { return error(err); }
     },
-  );
+    { preview: async (a) => {
+      const hours = (a.hours ?? []) as Array<{ day: number; slots: Array<{ start: string; end: string }> }>;
+      const what = a.hours ? hoursMessage(DAY_NAMES.map((_, day) => ({ day, slots: hours.filter((d) => d.day === day).flatMap((d) => d.slots) }))) : 'the hours unchanged';
+      return `This will replace the org business hours: ${what}${a.enabled === undefined ? '' : a.enabled ? ' Enforced: agents say the out-of-hours message outside them.' : ' Not enforced.'}`;
+    } },
+  );
+
+  reg.tool('add_holiday', 'Close the org on a date.', {
+    date: z.string().describe('YYYY-MM-DD'), name: z.string(),
+    message: z.string().optional().describe('What agents say that day (default: closed on account of the holiday)'),
+    type: z.string().optional().describe('public or custom (default custom)'),
+  }, async (args) => {
+    try {
+      return success(await orgSettings.addHolidays([{
+        name: args.name, date: args.date, type: args.type ?? 'custom',
+        holidayFallbackUtterance: args.message ?? `Our offices are currently closed on account of ${args.name}.`,
+      }]));
+    } catch (err) { return error(err); }
+  });
 
-  reg.tool('add_holiday', 'Close the org on a date.', { date: z.string().describe('YYYY-MM-DD'), name: z.string(), message: z.string().optional().describe('What agents say that day') }, async (args) => {
-    try { return success(await orgSettings.addHolidays([{ name: args.name, date: args.date, ...(args.message ? { holidayFallbackUtterance: args.message } : {}) }])); } catch (err) { return error(err); }
+  reg.tool('remove_holiday', 'Open the org again on a date that was a holiday.', { date: z.string().describe('YYYY-MM-DD, as get_org_settings lists it') }, async (args) => {
+    try { return success(await orgSettings.removeHolidays([args.date])); } catch (err) { return error(err); }
   });
 
   reg.tool(
@@ -1562,7 +1703,16 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
     'Who changed what in the org, newest first, filtered here (the server has no filters).',
     { since: z.string().optional(), action: z.string().optional(), resource_type: z.string().optional(), user_id: z.string().optional(), limit: z.number().int().min(1).max(500).optional() },
     async (args) => {
-      try { return success(await new AuditSDK(client).list({ since: args.since, action: args.action, resourceType: args.resource_type, user: args.user_id, limit: args.limit })); } catch (err) { return error(err); }
+      try {
+        const entries = await new AuditSDK(client).list({ since: args.since, action: args.action, resourceType: args.resource_type, user: args.user_id, limit: args.limit });
+        // copilot's log carries the person's id only: name them from the member list (one read).
+        const members = entries.some((e) => e.id_user) ? await orgs.listMembers().catch(() => []) : [];
+        const byId = new Map(members.map((m) => [m.user_id, m]));
+        return success(entries.map((e) => {
+          const m = byId.get(String(e.id_user ?? ''));
+          return m ? { ...e, user_name: m.name, user_email: m.email } : e;
+        }));
+      } catch (err) { return error(err); }
     },
   );
 
@@ -1604,11 +1754,13 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
 
   reg.tool(
     'update_ticket',
-    'Change a ticket: fields, assignee (user id, or unassign: true), or close it with resolve: true (and an optional note).',
+    'Change a ticket: fields, a note (added to its notes, or the closing note with resolve), assignee (user id, or unassign: true), or close it with resolve: true.',
     {
-      ticket_id: z.string(), title: z.string().optional(), description: z.string().optional(), notes: z.string().optional(),
+      ticket_id: z.string(), title: z.string().optional(), description: z.string().optional(),
+      notes: z.string().optional().describe('Replace the whole notes text'),
       status: z.enum(['not_started', 'in_progress']).optional(), priority: ticketPriority.optional(),
-      assignee_user_id: z.string().optional(), unassign: z.boolean().optional(), resolve: z.boolean().optional(), note: z.string().optional(),
+      assignee_user_id: z.string().optional(), unassign: z.boolean().optional(), resolve: z.boolean().optional(),
+      note: z.string().optional().describe('A note to add: appended to the ticket\'s notes, or the closing note when resolving'),
       link_ticket_id: z.string().optional().describe('Link to another ticket'),
     },
     async (args) => {
@@ -1616,6 +1768,11 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
         const out: Record<string, unknown> = {};
         const changes: Record<string, unknown> = {};
         for (const k of ['title', 'description', 'notes', 'status', 'priority'] as const) if (args[k] !== undefined) changes[k] = args[k];
+        // A note outside resolve used to be dropped silently: it goes onto the ticket's notes.
+        if (args.note && !args.resolve) {
+          const existing = String(((await tickets.get(args.ticket_id)) as { notes?: unknown }).notes ?? '').trim();
+          changes.notes = args.notes !== undefined ? `${args.notes}\n${args.note}`.trim() : existing ? `${existing}\n${args.note}` : args.note;
+        }
         if (Object.keys(changes).length) out.updated = await tickets.update(args.ticket_id, changes);
         if (args.assignee_user_id || args.unassign) out.assigned = await tickets.assign(args.ticket_id, args.unassign ? null : { type: 'user', target: args.assignee_user_id! });
         if (args.link_ticket_id) out.linked = await tickets.link(args.ticket_id, args.link_ticket_id);
@@ -1718,7 +1875,7 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
   reg.tool(
     'platform_save',
     'Create (no id) or change (id) a V2 agent, template, connector binding or scenario. Components and connectors are read-only shared catalogs.',
-    { resource: z.enum(['agents', 'templates', 'connector-bindings', 'scenarios']), id: z.string().optional(), body: z.record(z.unknown()) },
+    { resource: z.enum(['agents', 'templates', 'connector-bindings', 'scenarios']), id: z.string().optional(), body: jsonObject().describe('The item to save (an object, or JSON text)') },
     async (args) => {
       try { return success(args.id ? await platform.update(args.resource, args.id, args.body) : await platform.create(args.resource, args.body)); } catch (err) { return error(err); }
     },
@@ -1883,7 +2040,7 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
     'Judge a finished run like the CI gate: pass rate = passed/total, optional p95 limit, failed runs fail by default.',
     {
       run_id: z.string(),
-      min_pass_rate: z.number().min(0).max(1).optional(),
+      min_pass_rate: z.number().min(0).max(1).optional().describe('Pass rate the run must reach (default 0.8)'),
       max_p95_ms: z.number().optional(),
       error_policy: z.enum(['block', 'warn']).optional(),
       fail_on_error: z.boolean().optional(),
@@ -1892,7 +2049,9 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
       try {
         const run = await evals.getRunInOrg(args.run_id);
         if (run.status !== 'completed' && run.status !== 'failed') return success({ finished: false, status: run.status });
-        return success({ finished: true, ...gateVerdict(run, { minPassRate: args.min_pass_rate, maxP95Ms: args.max_p95_ms, errorPolicy: args.error_policy, failOnError: args.fail_on_error }) });
+        // Without a threshold any finished run "passed" (a 1-of-3 run was reported as a pass): judge against 80%.
+        const minPassRate = args.min_pass_rate ?? DEFAULT_MIN_PASS_RATE;
+        return success({ finished: true, min_pass_rate: minPassRate, ...gateVerdict(run, { minPassRate, maxP95Ms: args.max_p95_ms, errorPolicy: args.error_policy, failOnError: args.fail_on_error }) });
       } catch (err) { return error(err); }
     },
   );
@@ -2006,20 +2165,42 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
     },
   );
 
+  // get_conversation says "agent"; the evaluations service says "bot". Both are accepted.
+  const transcriptTurn = z.object({ sender: z.enum(['user', 'bot', 'agent', 'system']), text: z.string() });
+  const transcriptForService = (turns: Array<{ sender: string; text: string }>) => turns
+    .filter((t) => t.sender !== 'system')
+    .map((t) => ({ sender: (t.sender === 'user' ? 'user' : 'bot') as 'user' | 'bot', text: t.text }));
+  const transcriptPreconditions = async (a: Record<string, unknown>) => {
+    const agentId = String(a.agent_id);
+    await evals.assertAgentInOrg(agentId);
+    const configs = await evals.listEvaluatorConfigs(agentId) as { items?: unknown[] } | unknown[];
+    const count = Array.isArray(configs) ? configs.length : (configs.items ?? []).length;
+    if (!count) throw new Error('This agent has no evaluator yet, so a transcript cannot be graded. Create a rubric and run an evaluation first (run_evaluation stores the evaluator).');
+    if (JSON.stringify(a.baseline_transcript) === JSON.stringify(a.replay_transcript)) {
+      throw new Error('The baseline and the replay are the same conversation; grading compares a replay with its baseline. Give the replayed conversation as replay_transcript.');
+    }
+  };
+
   reg.tool(
     'evaluate_transcript',
-    'Grade a replayed conversation against a baseline with the agent\'s stored evaluator (paid model calls).',
+    'Grade a replayed conversation against a baseline with the agent\'s stored evaluator (paid model calls). The agent needs an evaluator (a finished run), and the replay must differ from the baseline.',
     {
       agent_id: z.string(),
-      baseline_transcript: z.array(z.object({ sender: z.enum(['user', 'bot']), text: z.string() })),
-      replay_transcript: z.array(z.object({ sender: z.enum(['user', 'bot']), text: z.string() })),
+      baseline_transcript: jsonArray(transcriptTurn),
+      replay_transcript: jsonArray(transcriptTurn),
     },
     async (args) => {
       try {
-        await evals.assertAgentInOrg(args.agent_id);
-        return success(await evals.evaluateTranscript(args));
+        await transcriptPreconditions(args);
+        return success(await evals.evaluateTranscript({
+          agent_id: args.agent_id,
+          baseline_transcript: transcriptForService(args.baseline_transcript),
+          replay_transcript: transcriptForService(args.replay_transcript),
+        }));
       } catch (err) { return error(err); }
     },
+    // Checked before the approval card: a card for something that cannot run wastes the person's answer.
+    { preview: async (a) => { await transcriptPreconditions(a); return `This will grade a replayed transcript for agent ${a.agent_id} with paid model calls.`; } },
   );
 
   reg.tool(
@@ -2236,17 +2417,20 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
   // Export tools
   // ---------------------------------------------------------------------------
 
+  const uploadArg = z.boolean().optional().describe('Put the file in the organization\'s file store and return download_url (use it when the person cannot reach this machine\'s files)');
+
   reg.tool(
     'export_eval_markdown',
     'Export evaluation results as a structured markdown file with conversations, scores, and criteria',
     {
       run_id: z.string().describe('The evaluation run ID'),
       output_path: z.string().optional().describe('Output file path (defaults to current directory)'),
+      upload: uploadArg,
     },
     async (args) => {
       try {
         const result = await exportEvalMarkdown(args.run_id, args.output_path, client);
-        return success(result);
+        return success(await deliver(result, args.upload));
       } catch (err) { return error(err); }
     },
   );
@@ -2257,11 +2441,12 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
     {
       run_id: z.string().describe('The evaluation run ID'),
       output_path: z.string().optional().describe('Output file path (defaults to current directory)'),
+      upload: uploadArg,
     },
     async (args) => {
       try {
         const result = await exportEvalReport(args.run_id, args.output_path, client);
-        return success(result);
+        return success(await deliver(result, args.upload));
       } catch (err) { return error(err); }
     },
   );
@@ -2272,11 +2457,12 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
     {
       agent_id: z.string().describe('The agent ID'),
       output_path: z.string().optional().describe('Output file path (defaults to current directory)'),
+      upload: uploadArg,
     },
     async (args) => {
       try {
         const result = await exportAgentCard(args.agent_id, args.output_path, client);
-        return success(result);
+        return success(await deliver(result, args.upload));
       } catch (err) { return error(err); }
     },
   );

package/src/report/styles.ts

@@ -2,9 +2,13 @@
 import { Font, StyleSheet } from '@react-pdf/renderer';
 import { fileURLToPath } from 'url';
 import { dirname, join } from 'path';
+import { existsSync } from 'fs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
-const assetsDir = join(__dirname, 'assets');
+// Fonts and logo: copied next to the built code by `npm run build`; the published package also carries
+// src/report/assets, so an install whose build step skipped the copy still finds them.
+const candidates = [join(__dirname, 'assets'), join(__dirname, '..', '..', 'src', 'report', 'assets')];
+export const assetsDir = candidates.find((dir) => existsSync(join(dir, 'fonts', 'Barlow-Regular.ttf'))) ?? candidates[0];
 
 // Register Barlow font family from bundled files
 Font.register({

package/src/sdk/auth.ts

@@ -1,5 +1,5 @@
-import { initializeApp, getApp } from 'firebase/app';
-import { getAuth, signInWithEmailAndPassword } from 'firebase/auth';
+import { initializeApp, getApp } from '@firebase/app';
+import { getAuth, signInWithEmailAndPassword } from '@firebase/auth';
 import { DEFAULT_HOSTS, IndemnClient } from './client.js';
 import { exchangeIdToken, toStoredSession } from './session.js';
 import type { Credential } from './credentials.js';

package/src/sdk/client.ts

@@ -483,7 +483,11 @@ export class IndemnClient {
       throw new SessionExpiredError('Authentication failed. Run `indemn login` to re-authenticate.');
     }
     if (res.status === 403) {
-      throw new Error('Access denied. You may not have permission for this operation.');
+      // Keep the server's reason: "Tickets are not enabled for this organization." is not a permission problem.
+      const text = await res.text().catch(() => '');
+      let reason = '';
+      try { const b = JSON.parse(text) as { message?: unknown; error?: unknown; msg?: unknown }; reason = String(b.message ?? b.error ?? b.msg ?? ''); } catch { reason = ''; }
+      throw new Error(reason ? `Not allowed: ${reason}` : 'Access denied. You may not have permission for this operation.');
     }
     if (res.status === 404) {
       // Keep the server's reason: voice-service answers 404 with specific messages (no phone number, ...).