@indemn/cli 1.7.5 → 1.7.7

package/dist/sdk/orgs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"orgs.d.ts","sourceRoot":"","sources":["../../src/sdk/orgs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AASjE,qBAAa,OAAO;IACN,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,YAAY;IAExC,+FAA+F;IACzF,iBAAiB,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAIhD,8EAA8E;IACxE,WAAW,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;IAkCzC,+DAA+D;IACzD,YAAY,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;CAIzC"}
+{"version":3,"file":"orgs.d.ts","sourceRoot":"","sources":["../../src/sdk/orgs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AASjE,MAAM,WAAW,UAAU;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,qBAAa,OAAO;IACN,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,YAAY;IAExC,+FAA+F;IACzF,iBAAiB,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAIhD,8EAA8E;IACxE,WAAW,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;IAkCzC;;;OAGG;IACG,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAetD,+DAA+D;IACzD,YAAY,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;CAIzC"}

package/dist/sdk/orgs.js

@@ -45,6 +45,21 @@ export class OrgsSDK {
         }
         return [...byUser.values()];
     }
+    /**
+     * A sandbox organization for a prospect. Only the Indemn support account may create one (copilot
+     * refuses anyone else), and copilot always puts it on the sandbox plan set for the platform.
+     */
+    async createSandbox(name) {
+        const res = await this.client.copilotPost('/organization/sandbox', { organizationName: name });
+        const base = this.client.getHosts().copilot.replace(/\/api\/?$/, '');
+        return {
+            organization_id: res.id_organization,
+            name,
+            project_id: res.id_project,
+            plan_id: res.id_plan,
+            url: `${base}/#/organization/${res.id_organization}/ai-studio/bots`,
+        };
+    }
     /** Channels an agent can be published on (WEB, VOICE, ...). */
     async listChannels() {
         const channels = await this.client.copilotGet('/organization/:org_id/ai-studio/channels');

package/dist/sdk/orgs.js.map

@@ -1 +1 @@
-{"version":3,"file":"orgs.js","sourceRoot":"","sources":["../../src/sdk/orgs.ts"],"names":[],"mappings":"AAUA,MAAM,OAAO,OAAO;IACE;IAApB,YAAoB,MAAoB;QAApB,WAAM,GAAN,MAAM,CAAc;IAAG,CAAC;IAE5C,+FAA+F;IAC/F,KAAK,CAAC,iBAAiB;QACrB,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,WAAW;QACf,IAAI,IAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAsC,sCAAsC,CAAC,CAAC;YACtH,IAAI,GAAG,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mFAAmF;YACnF,IAAI,GAAG,YAAY,KAAK,IAAI,uCAAuC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,OAAO,EAAE,CAAC;YACjG,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAqB,CAAC;QAC5C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/G,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;YAClC,IAAI,CAAC,EAAE;gBAAE,SAAS;YAClB,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YACvG,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChC,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;oBAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACrF,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChI,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE;gBACb,OAAO,EAAE,EAAE;gBACX,KAAK,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;gBAC/C,IAAI,EAAE,IAAI,IAAI,SAAS;gBACvB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;aACnC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,YAAY;QAChB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAY,0CAA0C,CAAC,CAAC;QACrG,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC/G,CAAC;CACF"}
+{"version":3,"file":"orgs.js","sourceRoot":"","sources":["../../src/sdk/orgs.ts"],"names":[],"mappings":"AAkBA,MAAM,OAAO,OAAO;IACE;IAApB,YAAoB,MAAoB;QAApB,WAAM,GAAN,MAAM,CAAc;IAAG,CAAC;IAE5C,+FAA+F;IAC/F,KAAK,CAAC,iBAAiB;QACrB,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,WAAW;QACf,IAAI,IAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAsC,sCAAsC,CAAC,CAAC;YACtH,IAAI,GAAG,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mFAAmF;YACnF,IAAI,GAAG,YAAY,KAAK,IAAI,uCAAuC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,OAAO,EAAE,CAAC;YACjG,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAqB,CAAC;QAC5C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/G,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;YAClC,IAAI,CAAC,EAAE;gBAAE,SAAS;YAClB,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YACvG,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChC,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;oBAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACrF,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChI,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE;gBACb,OAAO,EAAE,EAAE;gBACX,KAAK,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;gBAC/C,IAAI,EAAE,IAAI,IAAI,SAAS;gBACvB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;aACnC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,IAAY;QAC9B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CACvC,uBAAuB,EACvB,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAC3B,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACrE,OAAO;YACL,eAAe,EAAE,GAAG,CAAC,eAAe;YACpC,IAAI;YACJ,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,GAAG,EAAE,GAAG,IAAI,mBAAmB,GAAG,CAAC,eAAe,iBAAiB;SACpE,CAAC;IACJ,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,YAAY;QAChB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAY,0CAA0C,CAAC,CAAC;QACrG,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC/G,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indemn/cli",
-  "version": "1.7.5",
+  "version": "1.7.7",
   "description": "CLI, MCP server, and plugin for managing Indemn AI agents",
   "type": "module",
   "main": "./dist/sdk/index.js",

package/skills/sandbox/SKILL.md

@@ -0,0 +1,26 @@
+---
+name: sandbox
+description: Create a sandbox organization for a prospect on the Indemn platform. Use when the person asks for a sandbox, a sandbox org, a trial org, or a new organization for a prospect or customer.
+---
+
+# Sandbox organizations
+
+A sandbox is a new organization for a prospect, set up so they can try the platform. The platform puts every sandbox on its sandbox plan (a trial, then the plan's monthly price on invoice terms), invoiced to the Indemn support account.
+
+## Who can do it
+
+Only the Indemn support account. The platform refuses anyone else, including other Indemn staff. If the person is not signed in as support, say so and stop; do not try another way.
+
+## What to do
+
+1. Get the organization's name from the person. If they did not give one, ask for it. Ask for nothing else: never ask for a plan, price, trial length or payment terms. The platform sets them.
+2. Create it:
+   - MCP: `create_sandbox_org` with `name`. The person approves it in the approval form.
+   - Terminal: `indemn org create-sandbox "<name>"`. It asks the person to confirm; it has no `--yes`.
+3. Reply with the new organization's name, id and dashboard link. Mention that they can rename it in Organization Settings and invite the prospect's users from there.
+
+## If it fails
+
+- **Only the Indemn support account can create sandbox organizations**: the person is signed in as someone else.
+- **Sandbox plan is not configured**: the platform has no sandbox plan set. Tell the person to contact the Indemn engineering team; do not create an org another way.
+- **Organization created and subscribed, but setting up its project failed**: the org exists. Give its id and tell the person to finish the set-up from the dashboard; do not create it again.

package/src/cli/init.ts

@@ -47,6 +47,7 @@ The \`indemn\` CLI and its MCP server manage Indemn AI agents. Run \`indemn whoa
 
 - **agent-builder**: create, configure and test agents (prompt, skills, knowledge bases, voice, chat).
 - **evaluations**: rubrics, test sets, runs, CI gates, reports.
+- **sandbox**: create a sandbox organization for a prospect (support account only).
 `;
 
 export interface InitReport {
@@ -121,7 +122,7 @@ export function initStatus(cwd: string): Array<[string, boolean, string]> {
   let link: string | null = null;
   try { link = findLinkFile(cwd)?.path ?? null; } catch { link = null; }
   return [
-    ['Skills', existsSync(join(cwd, '.claude', 'skills', 'agent-builder', 'SKILL.md')), '.claude/skills/agent-builder, evaluations'],
+    ['Skills', existsSync(join(cwd, '.claude', 'skills', 'agent-builder', 'SKILL.md')), '.claude/skills/agent-builder, evaluations, sandbox'],
     ['Rules', existsSync(join(cwd, '.claude', 'rules', 'indemn.md')), '.claude/rules/indemn.md'],
     ['MCP server', Boolean(mcp.mcpServers?.indemn), '.mcp.json'],
     ['Permissions', (settings.permissions?.ask ?? []).some((r: string) => r.startsWith('mcp__indemn__')), '.claude/settings.json'],

package/src/cli/org.ts

@@ -4,6 +4,7 @@ import ora from 'ora';
 import { IndemnClient } from '../sdk/client.js';
 import { OrgsSDK } from '../sdk/orgs.js';
 import { getAskers, setAskers } from '../core/scope.js';
+import { CliError, EXIT, isNonInteractive } from '../core/runtime.js';
 import type { OrgContext } from '../sdk/client.js';
 import { confirmOrExit, writeLink } from './link.js';
 import { formatTable, printError, printJson, printSuccess } from './utils/output.js';
@@ -97,6 +98,34 @@ export function registerOrgCommands(program: Command): void {
       }
     });
 
+  org
+    .command('create-sandbox')
+    .description('Create a sandbox organization for a prospect (Indemn support account only; the platform picks the sandbox plan)')
+    .argument('<name>', 'Name of the new organization')
+    .option('--json', 'Output as JSON')
+    .action(async (name: string, options) => {
+      try {
+        const question = `Create organization "${name}" on the sandbox plan? It starts its trial now and is then invoiced to the support account.`;
+        // A new org on a paid plan: a person answers here; there is no --yes.
+        if (isNonInteractive()) throw new CliError(`${question} Run this in a terminal so a person can confirm it.`, EXIT.NEEDS_INPUT);
+        await confirmOrExit(question, false);
+        const client = new IndemnClient({ ignoreLink: true });
+        const spinner = ora('Creating sandbox organization...').start();
+        const created = await new OrgsSDK(client).createSandbox(name);
+        spinner.stop();
+        if (options.json) {
+          printJson(created);
+          return;
+        }
+        printSuccess(`Created ${created.name} (${created.organization_id}) on ${client.getEnvironment()}.`);
+        console.log(`  ${created.url}`);
+        console.log(chalk.dim('Rename it any time in Organization Settings.'));
+      } catch (err) {
+        printError(err);
+        process.exit(1);
+      }
+    });
+
   org
     .command('switch')
     .description('Pin this folder to an org (there is no global default org any more)')

package/src/mcp/registry.ts

@@ -118,7 +118,9 @@ export async function guardDestructive(
         message: `${formText} Proceed?`,
         requestedSchema: {
           type: 'object',
-          properties: { confirm: { type: 'boolean', title: 'Proceed', description: 'Tick (Space), then submit, to make this change.' } },
+          // Ticked already, so approving takes Enter twice in Claude Code (to Accept, then submit), not Space then
+          // Enter. Still one boolean field: Darwin's card reads that as an approval (Approve / Decline).
+          properties: { confirm: { type: 'boolean', title: 'Proceed', description: 'Ticked already: press Enter twice to approve (Space unticks).', default: true } },
           required: ['confirm'],
         },
       }, { timeout: PERSON_TIMEOUT_MS });

package/src/mcp/tool-meta.ts

@@ -39,6 +39,12 @@ export const TOOL_META: Record<string, ToolMeta> = {
   // Login and organizations
   whoami: { ...read('Who am I'), orgScoped: false },
   list_organizations: { ...read('List my organizations'), orgScoped: false },
+  create_sandbox_org: {
+    ...write('Create sandbox organization'),
+    orgScoped: false,
+    guard: true,
+    describe: (a) => `This will create a new organization "${a.name}" on the sandbox plan (its trial, then the plan's monthly price, invoiced to the support account).`,
+  },
   list_org_members: { ...read('List organization members'), paginate: true },
   list_channels: read('List channels'),
 
@@ -108,7 +114,8 @@ export const TOOL_META: Record<string, ToolMeta> = {
   delete_knowledge_base: { ...destroy('Delete knowledge base'), guard: true, describe: (a) => `This will delete knowledge base ${a.kb_id} with all its sources and vectors.` },
   list_kb_data: read('List knowledge base entries'),
   add_kb_data: { ...write('Add knowledge base entry'), guard: true, describe: (a) => `This will add an entry to knowledge base ${a.kb_id}; agents using it answer from it at once.` },
-  scrape_url: { ...write('Scrape a website into a knowledge base', { openWorldHint: true }), guard: true, describe: (a) => `This will crawl ${a.url} into knowledge base ${a.kb_id}; agents using it answer from it once it is imported.` },
+  // The approval says which crawl it is: a whole-site crawl stops at kb-service's default of 100 pages.
+  scrape_url: { ...write('Scrape a website into a knowledge base', { openWorldHint: true }), guard: true, describe: (a) => `${a.crawl_mode === 'selected' ? `This will import only the page ${a.url}` : `This will crawl the whole site from ${a.url} (up to 100 pages)`} into knowledge base ${a.kb_id}; agents using it answer from it once it is imported.` },
   upload_kb_file: { ...write('Upload file to knowledge base'), guard: true, describe: (a) => `This will upload ${a.file_path} into knowledge base ${a.kb_id}; agents using it answer from it once it is imported.` },
   update_kb_data: {
     ...write('Update knowledge base entry', { idempotentHint: true }),

package/src/mcp/tools.ts

@@ -241,6 +241,19 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
     },
   );
 
+  reg.tool(
+    'create_sandbox_org',
+    'Create a sandbox organization for a prospect when the person asks for "a sandbox" or "a new org" and gives its name. Only the Indemn support account can do this; the platform picks the sandbox plan itself, so never ask for a plan, price or terms. Ask for the name if it is missing. Returns the new org id and its dashboard link; the person can rename it later in Organization Settings. The host asks the person to approve; without an approval form this is refused.',
+    { name: z.string().trim().min(1).describe('Name of the new organization, as the person gave it') },
+    async (args, meta) => {
+      try {
+        // A new org on a paid plan needs the person, not the model: confirm: true is not enough.
+        if (!meta.confirmedByPerson) throw new Error('Creating a sandbox organization needs a person to approve it in an approval form, and this host cannot show one. Nothing was created. Run `indemn org create-sandbox` in a terminal instead.');
+        return success(await orgs.createSandbox(args.name));
+      } catch (err) { return error(err); }
+    },
+  );
+
   reg.tool(
     'list_org_members',
     'List the owners, admins and agents of an organization, with their roles.',
@@ -1057,16 +1070,12 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
       kb_id: z.string().describe('The knowledge base ID'),
       question: z.string().optional().describe('FAQ question'),
       answer: z.string().optional().describe('FAQ answer'),
-      source_url: z.string().optional().describe('Source URL (initiates scraping via import endpoint)'),
       content: z.string().optional().describe('Raw content'),
     },
     async (args) => {
       try {
+        // A website goes through scrape_url, where the person chooses the whole site or one page.
         const { kb_id, ...input } = args;
-        if (input.source_url) {
-          const result = await kb.scrapeUrl(kb_id, input.source_url as string);
-          return success(result);
-        }
         const result = await kb.addDataSource(kb_id, input);
         return success(result);
       } catch (err) { return error(err); }
@@ -1075,11 +1084,11 @@ export function registerTools(server: McpServer, client: IndemnClient): Registry
 
   reg.tool(
     'scrape_url',
-    'Scrape a website URL and add it as a data source to a knowledge base. The crawl runs in the background; its pages appear in the knowledge base only when it ends.',
+    'Scrape a website URL and add it as a data source to a knowledge base. The crawl runs in the background; its pages appear in the knowledge base only when it ends. Unless the person already said, ask them first whether to crawl the whole site (up to 100 pages) or import only this page.',
     {
       kb_id: z.string().describe('The knowledge base ID'),
       url: z.string().describe('URL to scrape'),
-      crawl_mode: z.string().optional().describe('Crawl mode: "full" (entire site) or "selected"'),
+      crawl_mode: z.enum(['full', 'selected']).describe('What the person chose: "full" crawls the whole site from url (up to 100 pages); "selected" imports only this page (one call per page).'),
     },
     async (args) => {
       try {

package/src/sdk/orgs.ts

@@ -8,6 +8,14 @@ interface RawProjectUser {
   id_project?: { name?: string } | string | null;
 }
 
+export interface SandboxOrg {
+  organization_id: string;
+  name: string;
+  project_id?: string;
+  plan_id?: string;
+  url: string;
+}
+
 export class OrgsSDK {
   constructor(private client: IndemnClient) {}
 
@@ -51,6 +59,25 @@ export class OrgsSDK {
     return [...byUser.values()];
   }
 
+  /**
+   * A sandbox organization for a prospect. Only the Indemn support account may create one (copilot
+   * refuses anyone else), and copilot always puts it on the sandbox plan set for the platform.
+   */
+  async createSandbox(name: string): Promise<SandboxOrg> {
+    const res = await this.client.copilotPost<{ id_organization: string; id_project?: string; id_plan?: string }>(
+      '/organization/sandbox',
+      { organizationName: name },
+    );
+    const base = this.client.getHosts().copilot.replace(/\/api\/?$/, '');
+    return {
+      organization_id: res.id_organization,
+      name,
+      project_id: res.id_project,
+      plan_id: res.id_plan,
+      url: `${base}/#/organization/${res.id_organization}/ai-studio/bots`,
+    };
+  }
+
   /** Channels an agent can be published on (WEB, VOICE, ...). */
   async listChannels(): Promise<Channel[]> {
     const channels = await this.client.copilotGet<Channel[]>('/organization/:org_id/ai-studio/channels');

package/test/mcp/__snapshots__/tools-snapshot.test.ts.snap

@@ -20,6 +20,7 @@ exports[`MCP tool list > gives every tool a title and annotations 1`] = `
   "create_function",
   "create_knowledge_base",
   "create_rubric",
+  "create_sandbox_org",
   "create_template",
   "create_test_set",
   "create_ticket",

package/test/mcp/registry.test.ts

@@ -92,6 +92,20 @@ describe('registry', () => {
     await pair.close();
   });
 
+  it('shows Proceed ticked, so approving is Enter twice, and still takes an untick as a no', async () => {
+    const { register, handler } = setup();
+    const pair = await connectPair(register, { elicit: () => ({ action: 'accept', content: { confirm: false } }) });
+    const res = await pair.call('wipe', { id: 't1' });
+    expect(pair.questions[0].requestedSchema).toEqual({
+      type: 'object',
+      properties: { confirm: { type: 'boolean', title: 'Proceed', description: 'Ticked already: press Enter twice to approve (Space unticks).', default: true } },
+      required: ['confirm'],
+    });
+    expect(res.body).toMatchObject({ cancelled: true, reason: 'Proceed was not ticked. Nothing was changed.' });
+    expect(handler).not.toHaveBeenCalled();
+    await pair.close();
+  });
+
   it('names things in the approval instead of showing their ids', async () => {
     const handler = vi.fn(async () => ({ content: [{ type: 'text' as const, text: '{}' }] }));
     const pair = await connectPair((server) => {

package/test/mcp/sandbox.test.ts

@@ -0,0 +1,45 @@
+import { afterEach, describe, expect, it } from 'vitest';
+import { on, recordFetch } from '../helpers/fetch-recorder.js';
+import { cleanEnv } from '../helpers/config-home.js';
+import { connectPair } from '../helpers/mcp-pair.js';
+import { IndemnClient } from '../../src/sdk/client.js';
+import { registerTools } from '../../src/mcp/tools.js';
+
+const ORG = 'aaaaaaaaaaaaaaaaaaaaaaaa';
+const created = on('POST', '/organization/sandbox', { json: { success: true, id_organization: ORG, id_project: 'p1', id_plan: 'plan1' } });
+
+async function pair(elicit?: () => { action: 'accept' | 'decline'; content?: { confirm: boolean } }) {
+  cleanEnv();
+  const client = new IndemnClient({ apiKey: `ind_dev_${'a'.repeat(64)}`, environment: 'dev' });
+  return connectPair((server) => { registerTools(server, client); }, { elicit });
+}
+
+describe('create_sandbox_org', () => {
+  let p: Awaited<ReturnType<typeof pair>> | undefined;
+  afterEach(async () => { await p?.close(); p = undefined; });
+
+  it('creates the org once the person approves, sending only its name', async () => {
+    const { calls } = recordFetch([created]);
+    p = await pair(() => ({ action: 'accept', content: { confirm: true } }));
+    const res = await p.call('create_sandbox_org', { name: 'Acme Insurance' });
+    expect(res.isError).toBe(false);
+    expect(p.questions[0]?.message).toContain('Acme Insurance');
+    expect(calls.find((c) => c.method === 'POST')?.body).toEqual({ organizationName: 'Acme Insurance' });
+    expect(res.body.data).toMatchObject({ organization_id: ORG, url: `https://devcopilot.indemn.ai/#/organization/${ORG}/ai-studio/bots` });
+  });
+
+  it('creates nothing when the person declines', async () => {
+    const { calls } = recordFetch([created]);
+    p = await pair(() => ({ action: 'decline' }));
+    await p.call('create_sandbox_org', { name: 'Acme' });
+    expect(calls.some((c) => c.method === 'POST')).toBe(false);
+  });
+
+  it('refuses the model\'s own confirm when the host cannot ask the person', async () => {
+    const { calls } = recordFetch([created]);
+    p = await pair();
+    const res = await p.call('create_sandbox_org', { name: 'Acme', confirm: true });
+    expect(JSON.stringify(res.body)).toContain('needs a person to approve it');
+    expect(calls.some((c) => c.method === 'POST')).toBe(false);
+  });
+});

package/test/mcp/tools-snapshot.test.ts

@@ -1,5 +1,6 @@
 import { describe, expect, it } from 'vitest';
 import { registerTools } from '../../src/mcp/tools.js';
+import { TOOL_META } from '../../src/mcp/tool-meta.js';
 import { IndemnClient } from '../../src/sdk/client.js';
 import { connectPair } from '../helpers/mcp-pair.js';
 import { cleanEnv } from '../helpers/config-home.js';
@@ -16,7 +17,7 @@ describe('MCP tool list', () => {
       expect(typeof tool.annotations?.readOnlyHint, tool.name).toBe('boolean');
     }
     expect(tools.map((t) => t.name).sort()).toMatchSnapshot();
-    expect(tools).toHaveLength(140); // +numbers // +set_agent_transcriber // +set_org_admin_settings // +remove_holiday
+    expect(tools).toHaveLength(141); // +numbers // +set_agent_transcriber // +set_org_admin_settings // +remove_holiday // +create_sandbox_org
     const props = (name: string) => Object.keys((tools.find((t) => t.name === name)!.inputSchema as { properties?: object }).properties ?? {});
     for (const name of ['list_agents', 'delete_agent', 'set_prompt', 'list_org_members', 'list_channels', 'chat_with_agent']) {
       expect(props(name), name).toContain('org_id');
@@ -28,6 +29,9 @@ describe('MCP tool list', () => {
     for (const name of ['delete_agent', 'create_function', 'test_function', 'add_kb_data', 'scrape_url', 'upload_kb_file']) {
       expect(props(name), name).toContain('confirm');
     }
+    // The person chooses how much of a website is crawled: only scrape_url crawls, and it needs their choice.
+    expect((tools.find((t) => t.name === 'scrape_url')!.inputSchema as { required?: string[] }).required).toContain('crawl_mode');
+    expect(props('add_kb_data')).not.toContain('source_url');
     // Test items and rubric rules have declared fields (Gemini cannot fill open objects).
     const itemsOf = (name: string, field: string) => ((tools.find((t) => t.name === name)!.inputSchema as { properties: Record<string, { items?: { properties?: object } }> }).properties[field].items?.properties ?? {});
     // ... and no nested objects: Gemini writes constructors for them that Google rejects.
@@ -43,4 +47,10 @@ describe('MCP tool list', () => {
     expect(skillProps).not.toContain('authorization');
     await pair.close();
   });
+
+  it('says in the crawl approval whether it is the whole site or one page', () => {
+    const describe = TOOL_META.scrape_url.describe!;
+    expect(describe({ kb_id: 'kb1', url: 'https://www.aaa.com' })).toMatch(/^This will crawl the whole site from https:\/\/www\.aaa\.com \(up to 100 pages\) into knowledge base kb1;/);
+    expect(describe({ kb_id: 'kb1', url: 'https://www.aaa.com/pricing', crawl_mode: 'selected' })).toMatch(/^This will import only the page https:\/\/www\.aaa\.com\/pricing into knowledge base kb1;/);
+  });
 });

package/test/sdk/orgs.test.ts

@@ -58,6 +58,21 @@ describe('OrgsSDK', () => {
     await expect(new OrgsSDK(new IndemnClient({ orgId: A })).listMembers()).resolves.toEqual([]);
   });
 
+  it('creates a sandbox org with only its name and links to it', async () => {
+    const { calls } = recordFetch([on('POST', '/organization/sandbox', { json: { success: true, id_organization: A, id_project: 'p1', id_plan: 'plan1' } })]);
+    await expect(new OrgsSDK(new IndemnClient()).createSandbox('Acme Insurance')).resolves.toEqual({
+      organization_id: A, name: 'Acme Insurance', project_id: 'p1', plan_id: 'plan1',
+      url: `https://devcopilot.indemn.ai/#/organization/${A}/ai-studio/bots`,
+    });
+    expect(new URL(calls[0].url).pathname).toBe('/api/organization/sandbox');
+    expect(calls[0].body).toEqual({ organizationName: 'Acme Insurance' });
+  });
+
+  it('keeps copilot\'s reason when someone other than support asks for a sandbox', async () => {
+    recordFetch([on('POST', '/organization/sandbox', { status: 403, json: { success: false, msg: 'Only the Indemn support account can create sandbox organizations.' } })]);
+    await expect(new OrgsSDK(new IndemnClient()).createSandbox('Acme')).rejects.toThrow('Not allowed: Only the Indemn support account can create sandbox organizations.');
+  });
+
   it('lists channels', async () => {
     const { calls } = recordFetch([on('GET', '/ai-studio/channels', { json: { success: true, data: [{ _id: 'c1', name: 'WEB', type: 'web' }] } })]);
     await expect(new OrgsSDK(new IndemnClient({ orgId: A })).listChannels()).resolves.toEqual([{ _id: 'c1', name: 'WEB', type: 'web', description: undefined }]);