@indemn/cli 1.7.5 → 1.7.6

package/dist/sdk/orgs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"orgs.d.ts","sourceRoot":"","sources":["../../src/sdk/orgs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AASjE,qBAAa,OAAO;IACN,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,YAAY;IAExC,+FAA+F;IACzF,iBAAiB,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAIhD,8EAA8E;IACxE,WAAW,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;IAkCzC,+DAA+D;IACzD,YAAY,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;CAIzC"}
+{"version":3,"file":"orgs.d.ts","sourceRoot":"","sources":["../../src/sdk/orgs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AASjE,MAAM,WAAW,UAAU;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,qBAAa,OAAO;IACN,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,YAAY;IAExC,+FAA+F;IACzF,iBAAiB,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAIhD,8EAA8E;IACxE,WAAW,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;IAkCzC;;;OAGG;IACG,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAetD,+DAA+D;IACzD,YAAY,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;CAIzC"}

package/dist/sdk/orgs.js

@@ -45,6 +45,21 @@ export class OrgsSDK {
         }
         return [...byUser.values()];
     }
+    /**
+     * A sandbox organization for a prospect. Only the Indemn support account may create one (copilot
+     * refuses anyone else), and copilot always puts it on the sandbox plan set for the platform.
+     */
+    async createSandbox(name) {
+        const res = await this.client.copilotPost('/organization/sandbox', { organizationName: name });
+        const base = this.client.getHosts().copilot.replace(/\/api\/?$/, '');
+        return {
+            organization_id: res.id_organization,
+            name,
+            project_id: res.id_project,
+            plan_id: res.id_plan,
+            url: `${base}/#/organization/${res.id_organization}/ai-studio/bots`,
+        };
+    }
     /** Channels an agent can be published on (WEB, VOICE, ...). */
     async listChannels() {
         const channels = await this.client.copilotGet('/organization/:org_id/ai-studio/channels');

package/dist/sdk/orgs.js.map

@@ -1 +1 @@
-{"version":3,"file":"orgs.js","sourceRoot":"","sources":["../../src/sdk/orgs.ts"],"names":[],"mappings":"AAUA,MAAM,OAAO,OAAO;IACE;IAApB,YAAoB,MAAoB;QAApB,WAAM,GAAN,MAAM,CAAc;IAAG,CAAC;IAE5C,+FAA+F;IAC/F,KAAK,CAAC,iBAAiB;QACrB,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,WAAW;QACf,IAAI,IAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAsC,sCAAsC,CAAC,CAAC;YACtH,IAAI,GAAG,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mFAAmF;YACnF,IAAI,GAAG,YAAY,KAAK,IAAI,uCAAuC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,OAAO,EAAE,CAAC;YACjG,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAqB,CAAC;QAC5C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/G,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;YAClC,IAAI,CAAC,EAAE;gBAAE,SAAS;YAClB,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YACvG,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChC,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;oBAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACrF,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChI,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE;gBACb,OAAO,EAAE,EAAE;gBACX,KAAK,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;gBAC/C,IAAI,EAAE,IAAI,IAAI,SAAS;gBACvB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;aACnC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,YAAY;QAChB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAY,0CAA0C,CAAC,CAAC;QACrG,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC/G,CAAC;CACF"}
+{"version":3,"file":"orgs.js","sourceRoot":"","sources":["../../src/sdk/orgs.ts"],"names":[],"mappings":"AAkBA,MAAM,OAAO,OAAO;IACE;IAApB,YAAoB,MAAoB;QAApB,WAAM,GAAN,MAAM,CAAc;IAAG,CAAC;IAE5C,+FAA+F;IAC/F,KAAK,CAAC,iBAAiB;QACrB,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,WAAW;QACf,IAAI,IAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAsC,sCAAsC,CAAC,CAAC;YACtH,IAAI,GAAG,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mFAAmF;YACnF,IAAI,GAAG,YAAY,KAAK,IAAI,uCAAuC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,OAAO,EAAE,CAAC;YACjG,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAqB,CAAC;QAC5C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/G,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;YAClC,IAAI,CAAC,EAAE;gBAAE,SAAS;YAClB,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YACvG,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChC,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;oBAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACrF,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChI,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE;gBACb,OAAO,EAAE,EAAE;gBACX,KAAK,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;gBAC/C,IAAI,EAAE,IAAI,IAAI,SAAS;gBACvB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;aACnC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,IAAY;QAC9B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CACvC,uBAAuB,EACvB,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAC3B,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACrE,OAAO;YACL,eAAe,EAAE,GAAG,CAAC,eAAe;YACpC,IAAI;YACJ,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,GAAG,EAAE,GAAG,IAAI,mBAAmB,GAAG,CAAC,eAAe,iBAAiB;SACpE,CAAC;IACJ,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,YAAY;QAChB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAY,0CAA0C,CAAC,CAAC;QACrG,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC/G,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indemn/cli",
-  "version": "1.7.5",
+  "version": "1.7.6",
   "description": "CLI, MCP server, and plugin for managing Indemn AI agents",
   "type": "module",
   "main": "./dist/sdk/index.js",

package/skills/sandbox/SKILL.md

@@ -0,0 +1,26 @@
+---
+name: sandbox
+description: Create a sandbox organization for a prospect on the Indemn platform. Use when the person asks for a sandbox, a sandbox org, a trial org, or a new organization for a prospect or customer.
+---
+
+# Sandbox organizations
+
+A sandbox is a new organization for a prospect, set up so they can try the platform. The platform puts every sandbox on its sandbox plan (a trial, then the plan's monthly price on invoice terms), invoiced to the Indemn support account.
+
+## Who can do it
+
+Only the Indemn support account. The platform refuses anyone else, including other Indemn staff. If the person is not signed in as support, say so and stop; do not try another way.
+
+## What to do
+
+1. Get the organization's name from the person. If they did not give one, ask for it. Ask for nothing else: never ask for a plan, price, trial length or payment terms. The platform sets them.
+2. Create it:
+   - MCP: `create_sandbox_org` with `name`. The person approves it in the approval form.
+   - Terminal: `indemn org create-sandbox "<name>"`. It asks the person to confirm; it has no `--yes`.
+3. Reply with the new organization's name, id and dashboard link. Mention that they can rename it in Organization Settings and invite the prospect's users from there.
+
+## If it fails
+
+- **Only the Indemn support account can create sandbox organizations**: the person is signed in as someone else.
+- **Sandbox plan is not configured**: the platform has no sandbox plan set. Tell the person to contact the Indemn engineering team; do not create an org another way.
+- **Organization created and subscribed, but setting up its project failed**: the org exists. Give its id and tell the person to finish the set-up from the dashboard; do not create it again.

package/src/cli/init.ts

@@ -47,6 +47,7 @@ The \`indemn\` CLI and its MCP server manage Indemn AI agents. Run \`indemn whoa
 
 - **agent-builder**: create, configure and test agents (prompt, skills, knowledge bases, voice, chat).
 - **evaluations**: rubrics, test sets, runs, CI gates, reports.
+- **sandbox**: create a sandbox organization for a prospect (support account only).
 `;
 
 export interface InitReport {
@@ -121,7 +122,7 @@ export function initStatus(cwd: string): Array<[string, boolean, string]> {
   let link: string | null = null;
   try { link = findLinkFile(cwd)?.path ?? null; } catch { link = null; }
   return [
-    ['Skills', existsSync(join(cwd, '.claude', 'skills', 'agent-builder', 'SKILL.md')), '.claude/skills/agent-builder, evaluations'],
+    ['Skills', existsSync(join(cwd, '.claude', 'skills', 'agent-builder', 'SKILL.md')), '.claude/skills/agent-builder, evaluations, sandbox'],
     ['Rules', existsSync(join(cwd, '.claude', 'rules', 'indemn.md')), '.claude/rules/indemn.md'],
     ['MCP server', Boolean(mcp.mcpServers?.indemn), '.mcp.json'],
     ['Permissions', (settings.permissions?.ask ?? []).some((r: string) => r.startsWith('mcp__indemn__')), '.claude/settings.json'],

package/src/cli/org.ts

@@ -4,6 +4,7 @@ import ora from 'ora';
 import { IndemnClient } from '../sdk/client.js';
 import { OrgsSDK } from '../sdk/orgs.js';
 import { getAskers, setAskers } from '../core/scope.js';
+import { CliError, EXIT, isNonInteractive } from '../core/runtime.js';
 import type { OrgContext } from '../sdk/client.js';
 import { confirmOrExit, writeLink } from './link.js';
 import { formatTable, printError, printJson, printSuccess } from './utils/output.js';
@@ -97,6 +98,34 @@ export function registerOrgCommands(program: Command): void {
       }
     });
 
+  org
+    .command('create-sandbox')
+    .description('Create a sandbox organization for a prospect (Indemn support account only; the platform picks the sandbox plan)')
+    .argument('<name>', 'Name of the new organization')
+    .option('--json', 'Output as JSON')
+    .action(async (name: string, options) => {
+      try {
+        const question = `Create organization "${name}" on the sandbox plan? It starts its trial now and is then invoiced to the support account.`;
+        // A new org on a paid plan: a person answers here; there is no --yes.
+        if (isNonInteractive()) throw new CliError(`${question} Run this in a terminal so a person can confirm it.`, EXIT.NEEDS_INPUT);
+        await confirmOrExit(question, false);
+        const client = new IndemnClient({ ignoreLink: true });
+        const spinner = ora('Creating sandbox organization...').start();
+        const created = await new OrgsSDK(client).createSandbox(name);
+        spinner.stop();
+        if (options.json) {
+          printJson(created);
+          return;
+        }
+        printSuccess(`Created ${created.name} (${created.organization_id}) on ${client.getEnvironment()}.`);
+        console.log(`  ${created.url}`);
+        console.log(chalk.dim('Rename it any time in Organization Settings.'));
+      } catch (err) {
+        printError(err);
+        process.exit(1);
+      }
+    });
+
   org
     .command('switch')
     .description('Pin this folder to an org (there is no global default org any more)')

package/src/mcp/tool-meta.ts

@@ -39,6 +39,12 @@ export const TOOL_META: Record<string, ToolMeta> = {
   // Login and organizations
   whoami: { ...read('Who am I'), orgScoped: false },
   list_organizations: { ...read('List my organizations'), orgScoped: false },
+  create_sandbox_org: {
+    ...write('Create sandbox organization'),
+    orgScoped: false,
+    guard: true,
+    describe: (a) => `This will create a new organization "${a.name}" on the sandbox plan (its trial, then the plan's monthly price, invoiced to the support account).`,
+  },
   list_org_members: { ...read('List organization members'), paginate: true },
   list_channels: read('List channels'),
 

package/src/mcp/tools.ts

@@ -241,6 +241,19 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
     },
   );
 
+  reg.tool(
+    'create_sandbox_org',
+    'Create a sandbox organization for a prospect when the person asks for "a sandbox" or "a new org" and gives its name. Only the Indemn support account can do this; the platform picks the sandbox plan itself, so never ask for a plan, price or terms. Ask for the name if it is missing. Returns the new org id and its dashboard link; the person can rename it later in Organization Settings. The host asks the person to approve; without an approval form this is refused.',
+    { name: z.string().trim().min(1).describe('Name of the new organization, as the person gave it') },
+    async (args, meta) => {
+      try {
+        // A new org on a paid plan needs the person, not the model: confirm: true is not enough.
+        if (!meta.confirmedByPerson) throw new Error('Creating a sandbox organization needs a person to approve it in an approval form, and this host cannot show one. Nothing was created. Run `indemn org create-sandbox` in a terminal instead.');
+        return success(await orgs.createSandbox(args.name));
+      } catch (err) { return error(err); }
+    },
+  );
+
   reg.tool(
     'list_org_members',
     'List the owners, admins and agents of an organization, with their roles.',

package/src/sdk/orgs.ts

@@ -8,6 +8,14 @@ interface RawProjectUser {
   id_project?: { name?: string } | string | null;
 }
 
+export interface SandboxOrg {
+  organization_id: string;
+  name: string;
+  project_id?: string;
+  plan_id?: string;
+  url: string;
+}
+
 export class OrgsSDK {
   constructor(private client: IndemnClient) {}
 
@@ -51,6 +59,25 @@ export class OrgsSDK {
     return [...byUser.values()];
   }
 
+  /**
+   * A sandbox organization for a prospect. Only the Indemn support account may create one (copilot
+   * refuses anyone else), and copilot always puts it on the sandbox plan set for the platform.
+   */
+  async createSandbox(name: string): Promise<SandboxOrg> {
+    const res = await this.client.copilotPost<{ id_organization: string; id_project?: string; id_plan?: string }>(
+      '/organization/sandbox',
+      { organizationName: name },
+    );
+    const base = this.client.getHosts().copilot.replace(/\/api\/?$/, '');
+    return {
+      organization_id: res.id_organization,
+      name,
+      project_id: res.id_project,
+      plan_id: res.id_plan,
+      url: `${base}/#/organization/${res.id_organization}/ai-studio/bots`,
+    };
+  }
+
   /** Channels an agent can be published on (WEB, VOICE, ...). */
   async listChannels(): Promise<Channel[]> {
     const channels = await this.client.copilotGet<Channel[]>('/organization/:org_id/ai-studio/channels');

package/test/mcp/__snapshots__/tools-snapshot.test.ts.snap

@@ -20,6 +20,7 @@ exports[`MCP tool list > gives every tool a title and annotations 1`] = `
   "create_function",
   "create_knowledge_base",
   "create_rubric",
+  "create_sandbox_org",
   "create_template",
   "create_test_set",
   "create_ticket",

package/test/mcp/sandbox.test.ts

@@ -0,0 +1,45 @@
+import { afterEach, describe, expect, it } from 'vitest';
+import { on, recordFetch } from '../helpers/fetch-recorder.js';
+import { cleanEnv } from '../helpers/config-home.js';
+import { connectPair } from '../helpers/mcp-pair.js';
+import { IndemnClient } from '../../src/sdk/client.js';
+import { registerTools } from '../../src/mcp/tools.js';
+
+const ORG = 'aaaaaaaaaaaaaaaaaaaaaaaa';
+const created = on('POST', '/organization/sandbox', { json: { success: true, id_organization: ORG, id_project: 'p1', id_plan: 'plan1' } });
+
+async function pair(elicit?: () => { action: 'accept' | 'decline'; content?: { confirm: boolean } }) {
+  cleanEnv();
+  const client = new IndemnClient({ apiKey: `ind_dev_${'a'.repeat(64)}`, environment: 'dev' });
+  return connectPair((server) => { registerTools(server, client); }, { elicit });
+}
+
+describe('create_sandbox_org', () => {
+  let p: Awaited<ReturnType<typeof pair>> | undefined;
+  afterEach(async () => { await p?.close(); p = undefined; });
+
+  it('creates the org once the person approves, sending only its name', async () => {
+    const { calls } = recordFetch([created]);
+    p = await pair(() => ({ action: 'accept', content: { confirm: true } }));
+    const res = await p.call('create_sandbox_org', { name: 'Acme Insurance' });
+    expect(res.isError).toBe(false);
+    expect(p.questions[0]?.message).toContain('Acme Insurance');
+    expect(calls.find((c) => c.method === 'POST')?.body).toEqual({ organizationName: 'Acme Insurance' });
+    expect(res.body.data).toMatchObject({ organization_id: ORG, url: `https://devcopilot.indemn.ai/#/organization/${ORG}/ai-studio/bots` });
+  });
+
+  it('creates nothing when the person declines', async () => {
+    const { calls } = recordFetch([created]);
+    p = await pair(() => ({ action: 'decline' }));
+    await p.call('create_sandbox_org', { name: 'Acme' });
+    expect(calls.some((c) => c.method === 'POST')).toBe(false);
+  });
+
+  it('refuses the model\'s own confirm when the host cannot ask the person', async () => {
+    const { calls } = recordFetch([created]);
+    p = await pair();
+    const res = await p.call('create_sandbox_org', { name: 'Acme', confirm: true });
+    expect(JSON.stringify(res.body)).toContain('needs a person to approve it');
+    expect(calls.some((c) => c.method === 'POST')).toBe(false);
+  });
+});

package/test/mcp/tools-snapshot.test.ts

@@ -16,7 +16,7 @@ describe('MCP tool list', () => {
       expect(typeof tool.annotations?.readOnlyHint, tool.name).toBe('boolean');
     }
     expect(tools.map((t) => t.name).sort()).toMatchSnapshot();
-    expect(tools).toHaveLength(140); // +numbers // +set_agent_transcriber // +set_org_admin_settings // +remove_holiday
+    expect(tools).toHaveLength(141); // +numbers // +set_agent_transcriber // +set_org_admin_settings // +remove_holiday // +create_sandbox_org
     const props = (name: string) => Object.keys((tools.find((t) => t.name === name)!.inputSchema as { properties?: object }).properties ?? {});
     for (const name of ['list_agents', 'delete_agent', 'set_prompt', 'list_org_members', 'list_channels', 'chat_with_agent']) {
       expect(props(name), name).toContain('org_id');

package/test/sdk/orgs.test.ts

@@ -58,6 +58,21 @@ describe('OrgsSDK', () => {
     await expect(new OrgsSDK(new IndemnClient({ orgId: A })).listMembers()).resolves.toEqual([]);
   });
 
+  it('creates a sandbox org with only its name and links to it', async () => {
+    const { calls } = recordFetch([on('POST', '/organization/sandbox', { json: { success: true, id_organization: A, id_project: 'p1', id_plan: 'plan1' } })]);
+    await expect(new OrgsSDK(new IndemnClient()).createSandbox('Acme Insurance')).resolves.toEqual({
+      organization_id: A, name: 'Acme Insurance', project_id: 'p1', plan_id: 'plan1',
+      url: `https://devcopilot.indemn.ai/#/organization/${A}/ai-studio/bots`,
+    });
+    expect(new URL(calls[0].url).pathname).toBe('/api/organization/sandbox');
+    expect(calls[0].body).toEqual({ organizationName: 'Acme Insurance' });
+  });
+
+  it('keeps copilot\'s reason when someone other than support asks for a sandbox', async () => {
+    recordFetch([on('POST', '/organization/sandbox', { status: 403, json: { success: false, msg: 'Only the Indemn support account can create sandbox organizations.' } })]);
+    await expect(new OrgsSDK(new IndemnClient()).createSandbox('Acme')).rejects.toThrow('Not allowed: Only the Indemn support account can create sandbox organizations.');
+  });
+
   it('lists channels', async () => {
     const { calls } = recordFetch([on('GET', '/ai-studio/channels', { json: { success: true, data: [{ _id: 'c1', name: 'WEB', type: 'web' }] } })]);
     await expect(new OrgsSDK(new IndemnClient({ orgId: A })).listChannels()).resolves.toEqual([{ _id: 'c1', name: 'WEB', type: 'web', description: undefined }]);