@indemn/cli 1.7.6 → 1.7.8

package/src/sdk/client.ts

@@ -1,8 +1,9 @@
 import Conf from 'conf';
 import { chmodSync } from 'node:fs';
+import { dirname } from 'node:path';
 import type { ApiResponse, Environment, EnvironmentHosts, IndemnConfig, OrgSummary } from './types.js';
 import { CliError, cliVersion, indemnHost, isDebug, SessionExpiredError } from '../core/runtime.js';
-import { copilotAuthHeader, darwinAuthHeader, resolveCredential, type Credential } from './credentials.js';
+import { copilotAuthHeader, darwinAuthHeader, evaluationsAuthHeader, resolveCredential, type Credential } from './credentials.js';
 import { tokenExpiry } from './session.js';
 import { findLinkFile, resolveOrg, type LinkFile, type ResolvedOrg } from '../core/org-resolver.js';
 import { emitOrgResolved, getAskers, getOrgFlag, scopedOrg } from '../core/scope.js';
@@ -71,6 +72,8 @@ export class IndemnClient {
   private environment: Environment;
   private hosts: EnvironmentHosts;
   private resolvedOrg?: Promise<OrgContext>;
+  /** The org `resolvedOrg` settled on, readable without waiting or asking. */
+  private settledOrgId?: string;
   private linkCache?: LinkFile | null;
   private membershipCache?: OrgSummary[];
 
@@ -126,6 +129,7 @@ export class IndemnClient {
         orgs: store.get('orgs'),
         api_key: apiKey,
         hosts: store.get('hosts', DEFAULT_HOSTS),
+        access: store.get('access'),
       };
     } catch {
       return null;
@@ -138,9 +142,10 @@ export class IndemnClient {
       if (value === undefined) store.delete(key as keyof IndemnConfig);
       else store.set(key as keyof IndemnConfig, value);
     }
-    // Restrict config file to owner-only (contains credentials)
+    // Restrict the config file and its folder to owner-only (they hold the session)
     try {
       chmodSync(store.path, 0o600);
+      chmodSync(dirname(store.path), 0o700);
     } catch {
       // Non-fatal — Windows doesn't support Unix permissions
     }
@@ -246,6 +251,7 @@ export class IndemnClient {
     if (explicit || opts.cache === false) return run();
     if (!this.resolvedOrg) {
       this.resolvedOrg = run().then((org) => {
+        this.settledOrgId = org.id;
         emitOrgResolved({ id: org.id, name: org.name, source: org.source, environment: this.environment });
         return org;
       });
@@ -322,6 +328,12 @@ export class IndemnClient {
     }
     if (backend === 'copilot' && opts.auth !== false) {
       headers['Authorization'] = await this.authHeader();
+    } else if (backend === 'evaluations' && opts.auth !== false && this.getCredential()) {
+      // Without any credential the request goes out bare, as before; the service then answers 401.
+      headers['Authorization'] = evaluationsAuthHeader(await this.freshCredential());
+      // Only an org already in effect: the service resolves the user's orgs itself, so never ask or look one up here.
+      const org = scopedOrg() ?? this.settledOrgId;
+      if (org) headers['X-Organization-Id'] = org;
     }
 
     const attempts = method === 'GET' ? RETRY_DELAYS_MS.length + 1 : 1;
@@ -429,7 +441,7 @@ export class IndemnClient {
     return res.json() as Promise<T>;
   }
 
-  // Evaluations Service requests (no /api/ prefix, no org_id, no auth)
+  // Evaluations Service requests (no /api/ prefix, no org_id in the path; the credential goes as Bearer, see send())
   async evalsGet<T = unknown>(path: string, query?: Record<string, string>): Promise<T> {
     const res = await this.send('evaluations', 'GET', this.withQuery(this.buildEvalsUrl(path), query));
     return this.handleEvalsResponse<T>(res);
@@ -490,6 +502,16 @@ export class IndemnClient {
   }
 
   private async handleEvalsResponse<T>(res: Response): Promise<T> {
+    if (res.status === 401 || res.status === 403) {
+      // Keep the service's reason. 401: no valid credential (log in again). 403: signed in but not allowed.
+      const text = await res.text().catch(() => '');
+      let detail: unknown = text;
+      try { detail = (JSON.parse(text) as { detail?: unknown }).detail ?? text; } catch { /* plain text */ }
+      const reason = (typeof detail === 'string' ? detail : JSON.stringify(detail)).trim();
+      const shown = reason && !reason.startsWith('<') ? ` (${reason.slice(0, 200)})` : '';
+      if (res.status === 401) throw new SessionExpiredError(this.loginAgain(`The evaluations service refused the request${shown}.`));
+      throw new CliError(`The evaluations service denied access${shown}.`);
+    }
     if (!res.ok) {
       const text = await res.text();
       throw new Error(`Evaluations API error (${res.status}): ${text}`);

package/src/sdk/credentials.ts

@@ -51,3 +51,8 @@ export function darwinAuthHeader(c: Credential): string {
   }
   return `Bearer ${c.token}`;
 }
+
+/** The evaluations service takes the session or an API key, both as Bearer; it checks a key and pins it to the key's org. */
+export function evaluationsAuthHeader(c: Credential): string {
+  return `Bearer ${c.kind === 'token' ? c.token : c.key}`;
+}

package/src/sdk/eval.ts

@@ -33,9 +33,9 @@ export class EvalSDK {
   }
 
   /**
-   * The evaluations service checks nothing about orgs. Before acting on an
-   * agent, confirm through copilot (which refuses other orgs' agents) that it
-   * belongs to the org this command acts on.
+   * The evaluations service now enforces org scope itself; this check is defense
+   * in depth. Before acting on an agent, confirm through copilot (which refuses
+   * other orgs' agents) that it belongs to the org this command acts on.
    */
   async assertAgentInOrg(agentId: string): Promise<void> {
     const { AgentsSDK } = await import('./agents.js');

package/src/sdk/types.ts

@@ -1,3 +1,4 @@
+import type { Access } from './access.js';
 // Environment and configuration types
 
 export type Environment = 'dev' | 'production';
@@ -53,6 +54,8 @@ export interface IndemnConfig {
   org_id?: string;
   org_name?: string;
   hosts: Record<Environment, EnvironmentHosts>;
+  /** What the person may do (GET /auth/me/access), saved with the login; display only. */
+  access?: Access;
 }
 
 // API response types

package/test/mcp/access.test.ts

@@ -0,0 +1,158 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { ToolListChangedNotificationSchema } from '@modelcontextprotocol/sdk/types.js';
+import { on, recordFetch } from '../helpers/fetch-recorder.js';
+import { cleanEnv, useTempHome } from '../helpers/config-home.js';
+import { jwtExpiringIn } from '../helpers/jwt.js';
+import { connectPair } from '../helpers/mcp-pair.js';
+import { IndemnClient } from '../../src/sdk/client.js';
+import { registerTools } from '../../src/mcp/tools.js';
+import { refreshAccess, resetAccess, usableSomewhere, type Access } from '../../src/sdk/access.js';
+import type { Registry } from '../../src/mcp/registry.js';
+
+const A = 'aaaaaaaaaaaaaaaaaaaaaaaa';
+const B = 'bbbbbbbbbbbbbbbbbbbbbbbb';
+
+function accessWith(bTickets = false): Access {
+  return {
+    user: { id: 'u1', email: 'pat@example.test', name: 'Pat' },
+    is_indemn_staff: false,
+    capabilities: [],
+    orgs: [
+      { org_id: A, org_name: 'QA A', role: 'admin', is_org_admin: true, capabilities: ['member', 'tickets'],
+        projects: [{ project_id: 'p1', name: 'A main', role: 'admin', capabilities: ['conversations:messages', 'conversations:read'] }] },
+      { org_id: B, org_name: 'QA B', role: 'guest', is_org_admin: false, capabilities: bTickets ? ['member', 'tickets'] : ['member'],
+        projects: [{ project_id: 'p2', name: 'B main', role: 'guest', capabilities: ['conversations:messages'] }] },
+    ],
+  };
+}
+
+describe('role-aware MCP tools', () => {
+  let home: ReturnType<typeof useTempHome>;
+  let registry: Registry;
+
+  beforeEach(() => {
+    cleanEnv();
+    home = useTempHome();
+    resetAccess();
+    vi.spyOn(process, 'cwd').mockReturnValue(home.dir);
+    IndemnClient.saveConfig({
+      environment: 'dev', user_id: 'u1', session: { token: jwtExpiringIn(5 * 3_600_000) },
+      orgs: [{ id: A, name: 'QA A' }, { id: B, name: 'QA B' }],
+      access: accessWith(),
+    });
+  });
+  afterEach(() => { resetAccess(); home.cleanup(); });
+
+  function setup(server: Parameters<typeof registerTools>[0]) {
+    registry = registerTools(server, new IndemnClient());
+    registry.applyVisibility();
+  }
+
+  async function toolNames(pair: Awaited<ReturnType<typeof connectPair>>) {
+    return (await pair.client.listTools()).tools.map((t) => t.name);
+  }
+
+  it('hides tools the person can use nowhere, keeps the rest', async () => {
+    recordFetch();
+    const pair = await connectPair(setup);
+    const names = await toolNames(pair);
+    expect(names).toContain('list_tickets'); // tickets on in QA A
+    expect(names).toContain('get_conversation'); // admin in A's project
+    expect(names).toContain('list_agents'); // membership only
+    expect(names).not.toContain('set_org_admin_settings'); // staff only
+    expect(names).not.toContain('create_sandbox_org'); // support account only
+    expect(names).not.toContain('mark_conversation_test'); // staff + agent
+    await pair.close();
+  });
+
+  it('a folder linked to one org counts only that org', async () => {
+    vi.stubEnv('INDEMN_ORG_ID', B);
+    recordFetch();
+    const pair = await connectPair(setup);
+    const names = await toolNames(pair);
+    expect(names).not.toContain('list_tickets');
+    expect(names).not.toContain('get_conversation');
+    expect(names).toContain('list_agents');
+    await pair.close();
+  });
+
+  it('refuses early, with the reason, where the org has no access (after asking again)', async () => {
+    const { calls } = recordFetch([on('GET', '/auth/me/access', { json: accessWith() })]);
+    const pair = await connectPair(setup);
+    const res = await pair.call('list_tickets', { org_id: B });
+    expect(res.isError).toBe(true);
+    expect(res.body).toContain('Tickets are not turned on for QA B');
+    expect(calls.some((c) => c.url.includes('/auth/me/access'))).toBe(true); // stale access is re-checked first
+    expect(calls.some((c) => c.url.includes('/tickets'))).toBe(false);
+    await pair.close();
+  });
+
+  it('a refresh that grants access lets the call through', async () => {
+    const { calls } = recordFetch([on('GET', '/auth/me/access', { json: accessWith(true) })]);
+    const pair = await connectPair(setup);
+    const res = await pair.call('list_tickets', { org_id: B });
+    expect(res.isError).toBe(false);
+    expect(calls.some((c) => c.url.includes(`/organization/${B}/tickets`))).toBe(true);
+    await pair.close();
+  });
+
+  it('concurrent calls for different orgs each get their own answer', async () => {
+    const { calls } = recordFetch([on('GET', '/auth/me/access', { json: accessWith() })]);
+    const pair = await connectPair(setup);
+    const [inA, inB, inA2] = await Promise.all([
+      pair.call('list_tickets', { org_id: A }),
+      pair.call('list_tickets', { org_id: B }),
+      pair.call('list_tickets', { org_id: A }),
+    ]);
+    expect(inA.isError).toBe(false);
+    expect(inA2.isError).toBe(false);
+    expect(inB.isError).toBe(true);
+    expect(inA.body.context.org_id).toBe(A);
+    const ticketCalls = calls.filter((c) => c.url.includes('/tickets'));
+    expect(ticketCalls).toHaveLength(2);
+    expect(ticketCalls.every((c) => c.url.includes(`/organization/${A}/tickets`))).toBe(true);
+    await pair.close();
+  });
+
+  it('a server refusal names the person\'s role', async () => {
+    recordFetch([
+      on('GET', '/auth/me/access', { json: accessWith() }),
+      on('GET', '/ai-studio/v2/bots', { status: 403, json: { success: false, msg: 'Forbidden' } }),
+    ]);
+    const pair = await connectPair(setup);
+    const res = await pair.call('list_agents', { org_id: B });
+    expect(res.isError).toBe(true);
+    expect(res.body).toContain('Not allowed');
+    expect(res.body).toContain('Your role: guest in QA B.');
+    await pair.close();
+  });
+
+  it('tells the host when the visible tools change', async () => {
+    vi.stubEnv('INDEMN_ORG_ID', B);
+    recordFetch([on('GET', '/auth/me/access', { json: accessWith(true) })]);
+    const pair = await connectPair(setup);
+    let changed = 0;
+    pair.client.setNotificationHandler(ToolListChangedNotificationSchema, async () => { changed += 1; });
+    expect(await toolNames(pair)).not.toContain('list_tickets');
+    await refreshAccess(new IndemnClient());
+    registry.applyVisibility();
+    await vi.waitFor(() => expect(changed).toBeGreaterThan(0));
+    expect(await toolNames(pair)).toContain('list_tickets');
+    await pair.close();
+  });
+
+  it('unknown access hides nothing', () => {
+    expect(usableSomewhere('set_org_admin_settings', null)).toBe(true);
+    expect(usableSomewhere('list_tickets', null)).toBe(true);
+  });
+
+  it('a host session (INDEMN_TOKEN) never writes access to this machine', async () => {
+    IndemnClient.clearConfig();
+    vi.stubEnv('INDEMN_TOKEN', jwtExpiringIn(3_600_000));
+    vi.stubEnv('INDEMN_ENV', 'dev');
+    recordFetch([on('GET', '/auth/me/access', { json: accessWith() })]);
+    const got = await refreshAccess(new IndemnClient());
+    expect(got?.orgs).toHaveLength(2);
+    expect(IndemnClient.loadConfig()).toBeNull();
+  });
+});

package/test/mcp/registry.test.ts

@@ -92,6 +92,20 @@ describe('registry', () => {
     await pair.close();
   });
 
+  it('shows Proceed ticked, so approving is Enter twice, and still takes an untick as a no', async () => {
+    const { register, handler } = setup();
+    const pair = await connectPair(register, { elicit: () => ({ action: 'accept', content: { confirm: false } }) });
+    const res = await pair.call('wipe', { id: 't1' });
+    expect(pair.questions[0].requestedSchema).toEqual({
+      type: 'object',
+      properties: { confirm: { type: 'boolean', title: 'Proceed', description: 'Ticked already: press Enter twice to approve (Space unticks).', default: true } },
+      required: ['confirm'],
+    });
+    expect(res.body).toMatchObject({ cancelled: true, reason: 'Proceed was not ticked. Nothing was changed.' });
+    expect(handler).not.toHaveBeenCalled();
+    await pair.close();
+  });
+
   it('names things in the approval instead of showing their ids', async () => {
     const handler = vi.fn(async () => ({ content: [{ type: 'text' as const, text: '{}' }] }));
     const pair = await connectPair((server) => {

package/test/mcp/tools-snapshot.test.ts

@@ -1,5 +1,6 @@
 import { describe, expect, it } from 'vitest';
 import { registerTools } from '../../src/mcp/tools.js';
+import { TOOL_META } from '../../src/mcp/tool-meta.js';
 import { IndemnClient } from '../../src/sdk/client.js';
 import { connectPair } from '../helpers/mcp-pair.js';
 import { cleanEnv } from '../helpers/config-home.js';
@@ -28,6 +29,9 @@ describe('MCP tool list', () => {
     for (const name of ['delete_agent', 'create_function', 'test_function', 'add_kb_data', 'scrape_url', 'upload_kb_file']) {
       expect(props(name), name).toContain('confirm');
     }
+    // The person chooses how much of a website is crawled: only scrape_url crawls, and it needs their choice.
+    expect((tools.find((t) => t.name === 'scrape_url')!.inputSchema as { required?: string[] }).required).toContain('crawl_mode');
+    expect(props('add_kb_data')).not.toContain('source_url');
     // Test items and rubric rules have declared fields (Gemini cannot fill open objects).
     const itemsOf = (name: string, field: string) => ((tools.find((t) => t.name === name)!.inputSchema as { properties: Record<string, { items?: { properties?: object } }> }).properties[field].items?.properties ?? {});
     // ... and no nested objects: Gemini writes constructors for them that Google rejects.
@@ -43,4 +47,10 @@ describe('MCP tool list', () => {
     expect(skillProps).not.toContain('authorization');
     await pair.close();
   });
+
+  it('says in the crawl approval whether it is the whole site or one page', () => {
+    const describe = TOOL_META.scrape_url.describe!;
+    expect(describe({ kb_id: 'kb1', url: 'https://www.aaa.com' })).toMatch(/^This will crawl the whole site from https:\/\/www\.aaa\.com \(up to 100 pages\) into knowledge base kb1;/);
+    expect(describe({ kb_id: 'kb1', url: 'https://www.aaa.com/pricing', crawl_mode: 'selected' })).toMatch(/^This will import only the page https:\/\/www\.aaa\.com\/pricing into knowledge base kb1;/);
+  });
 });

package/test/sdk/auth.test.ts

@@ -24,7 +24,8 @@ describe('token-first login', () => {
     ]);
     const result = await login('qa@indemn.ai', 'pw', 'dev', { firebaseSignIn: fakeFirebase });
 
-    expect(calls.map((c) => `${c.method} ${new URL(c.url).pathname}`)).toEqual(['POST /api/auth/firebase/signin', 'GET /api/organization']);
+    // Then what the person may do, kept with the login (display only).
+    expect(calls.map((c) => `${c.method} ${new URL(c.url).pathname}`)).toEqual(['POST /api/auth/firebase/signin', 'GET /api/organization', 'GET /api/auth/me/access']);
     expect(calls.some((c) => c.url.includes('/auth/api-keys'))).toBe(false);
     expect(calls[1].headers.authorization).toBe(`JWT ${token}`);
     expect(result.orgs).toEqual([{ id: A._id, name: 'QA A' }, { id: B._id, name: 'QA B' }]);

package/test/sdk/browser-login.test.ts

@@ -0,0 +1,147 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { createHash } from 'node:crypto';
+import { readFileSync, statSync } from 'node:fs';
+import { request } from 'node:http';
+import { join } from 'node:path';
+import { on, recordFetch } from '../helpers/fetch-recorder.js';
+import { cleanEnv, useTempHome } from '../helpers/config-home.js';
+import { jwtExpiringIn } from '../helpers/jwt.js';
+import { approveUrl, createPkce, dashboardUrl, startLoopback } from '../../src/sdk/browser-login.js';
+import { loginWithBrowser } from '../../src/sdk/auth.js';
+
+/** GET a loopback URL with node:http (global fetch is recorded in these tests). */
+function hit(url: string): Promise<{ status: number; body: string }> {
+  return new Promise((resolve, reject) => {
+    request(url, (res) => {
+      let body = '';
+      res.on('data', (c) => (body += c));
+      res.on('end', () => resolve({ status: res.statusCode ?? 0, body }));
+    }).on('error', reject).end();
+  });
+}
+
+describe('PKCE and URLs', () => {
+  beforeEach(() => cleanEnv());
+
+  it('challenge is the base64url SHA-256 of the verifier; values are fresh each time', () => {
+    const a = createPkce();
+    const b = createPkce();
+    expect(a.challenge).toBe(createHash('sha256').update(a.verifier).digest('base64url'));
+    expect(a.challenge).toMatch(/^[A-Za-z0-9_-]{43}$/);
+    expect(a.verifier).toMatch(/^[A-Za-z0-9_-]{43}$/);
+    expect(a.state).toMatch(/^[A-Za-z0-9_-]{43}$/);
+    expect(a.verifier).not.toBe(b.verifier);
+    expect(a.state).not.toBe(b.state);
+  });
+
+  it('dashboard is the copilot host without /api, or INDEMN_DASHBOARD_URL (Indemn or localhost only)', () => {
+    expect(dashboardUrl('https://devcopilot.indemn.ai/api')).toBe('https://devcopilot.indemn.ai');
+    vi.stubEnv('INDEMN_DASHBOARD_URL', 'http://localhost:5174/');
+    expect(dashboardUrl('https://devcopilot.indemn.ai/api')).toBe('http://localhost:5174');
+    vi.stubEnv('INDEMN_DASHBOARD_URL', 'https://evil.example');
+    expect(() => dashboardUrl('https://devcopilot.indemn.ai/api')).toThrow(/indemn\.ai/);
+  });
+
+  it('approve URL carries port, state and challenge but never the verifier', () => {
+    const p = createPkce();
+    const url = approveUrl('https://copilot.indemn.ai', 50123, p);
+    expect(url.startsWith('https://copilot.indemn.ai/#/cli-login?')).toBe(true);
+    const q = new URLSearchParams(url.split('?')[1]);
+    expect(q.get('port')).toBe('50123');
+    expect(q.get('state')).toBe(p.state);
+    expect(q.get('challenge')).toBe(p.challenge);
+    expect(url).not.toContain(p.verifier);
+  });
+});
+
+describe('loopback listener', () => {
+  it('binds 127.0.0.1, ignores a wrong state, takes the first matching callback, then closes', async () => {
+    const loop = await startLoopback('the-state', 10_000);
+    const base = `http://127.0.0.1:${loop.port}`;
+    expect((await hit(`${base}/other`)).status).toBe(404);
+    expect((await hit(`${base}/callback?code=x&state=wrong`)).status).toBe(400);
+    const ok = await hit(`${base}/callback?code=the-code&state=the-state`);
+    expect(ok.status).toBe(200);
+    expect(ok.body).toContain('close this tab');
+    expect(ok.body).not.toContain('the-code');
+    await expect(loop.result).resolves.toEqual({ code: 'the-code' });
+    await expect(hit(`${base}/callback?code=again&state=the-state`)).rejects.toThrow();
+  });
+
+  it('reports a cancel from the browser', async () => {
+    const loop = await startLoopback('s', 10_000);
+    await hit(`http://127.0.0.1:${loop.port}/callback?error=access_denied&state=s`);
+    await expect(loop.result).resolves.toEqual({ error: 'access_denied' });
+  });
+
+  it('times out', async () => {
+    const loop = await startLoopback('s', 50);
+    await expect(loop.result).rejects.toThrow(/Timed out/);
+  });
+});
+
+describe('loginWithBrowser', () => {
+  let home: ReturnType<typeof useTempHome>;
+  beforeEach(() => { cleanEnv(); home = useTempHome(); });
+  afterEach(() => home.cleanup());
+
+  /** A fake browser: reads the approve URL and calls back like the dashboard would. */
+  function approvingBrowser(seen: { challenge?: string }, outcome: 'approve' | 'cancel' = 'approve') {
+    return async (url: string) => {
+      const q = new URLSearchParams(url.split('?')[1]);
+      seen.challenge = q.get('challenge') ?? undefined;
+      const back = new URLSearchParams(outcome === 'approve' ? { code: 'one-time-code', state: q.get('state')! } : { error: 'access_denied', state: q.get('state')! });
+      setTimeout(() => void hit(`http://127.0.0.1:${q.get('port')}/callback?${back}`), 10);
+      return true;
+    };
+  }
+
+  it('exchanges the code with the verifier and saves the session like a normal login', async () => {
+    const token = jwtExpiringIn(24 * 3_600_000, { cli: true });
+    const { calls } = recordFetch([
+      on('POST', '/auth/cli/token', { json: { token: `JWT ${token}`, expires_at: 'x', user: { _id: 'u1', email: 'pat@example.test' } } }),
+      on('GET', '/organization', { json: { success: true, userOrganizations: [{ _id: 'aaaaaaaaaaaaaaaaaaaaaaaa', name: 'Acme' }] } }),
+    ]);
+    const seen: { challenge?: string } = {};
+    const result = await loginWithBrowser('dev', { open: approvingBrowser(seen), timeoutMs: 10_000 });
+
+    const exchange = calls.find((c) => c.url.endsWith('/auth/cli/token'))!;
+    expect(new URL(exchange.url).origin).toBe('https://devcopilot.indemn.ai');
+    expect(exchange.headers.authorization).toBeUndefined();
+    const body = exchange.body as { code: string; code_verifier: string };
+    expect(body.code).toBe('one-time-code');
+    expect(createHash('sha256').update(body.code_verifier).digest('base64url')).toBe(seen.challenge);
+
+    expect(result.email).toBe('pat@example.test');
+    expect(result.orgs).toEqual([{ id: 'aaaaaaaaaaaaaaaaaaaaaaaa', name: 'Acme' }]);
+    const saved = JSON.parse(readFileSync(join(home.dir, '.indemn', 'config.json'), 'utf8'));
+    expect(saved.session.token).toBe(token);
+    expect(saved.email).toBe('pat@example.test');
+    expect(saved).not.toHaveProperty('api_key');
+    if (process.platform !== 'win32') {
+      expect(statSync(join(home.dir, '.indemn', 'config.json')).mode & 0o777).toBe(0o600);
+      expect(statSync(join(home.dir, '.indemn')).mode & 0o777).toBe(0o700);
+    }
+  });
+
+  it('cancel in the browser saves nothing', async () => {
+    recordFetch([]);
+    await expect(loginWithBrowser('dev', { open: approvingBrowser({}, 'cancel'), timeoutMs: 10_000 })).rejects.toThrow(/cancelled/);
+    expect(() => readFileSync(join(home.dir, '.indemn', 'config.json'))).toThrow();
+  });
+
+  it('a refused code says to log in again', async () => {
+    recordFetch([on('POST', '/auth/cli/token', { status: 400, json: { success: false, error: 'invalid_grant' } })]);
+    await expect(loginWithBrowser('dev', { open: approvingBrowser({}), timeoutMs: 10_000 })).rejects.toThrow(/not accepted/);
+  });
+
+  it('shows the URL even when the browser cannot be opened', async () => {
+    recordFetch([]);
+    const shown: Array<[string, boolean]> = [];
+    const pending = loginWithBrowser('dev', { open: async () => false, showUrl: (u, o) => shown.push([u, o]), timeoutMs: 100 });
+    await expect(pending).rejects.toThrow(/Timed out/);
+    expect(shown).toHaveLength(1);
+    expect(shown[0][1]).toBe(false);
+    expect(shown[0][0]).toContain('/#/cli-login?');
+  });
+});

package/test/sdk/client.test.ts

@@ -1,8 +1,11 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { readFileSync } from 'node:fs';
-import { on, recordFetch } from '../helpers/fetch-recorder.js';
+import { on, recordFetch, type RecordedCall } from '../helpers/fetch-recorder.js';
 import { cleanEnv, useTempHome } from '../helpers/config-home.js';
+import { jwtExpiringIn } from '../helpers/jwt.js';
 import { IndemnClient } from '../../src/sdk/client.js';
+import { runWithOrg } from '../../src/core/scope.js';
+import { EXIT, SessionExpiredError } from '../../src/core/runtime.js';
 
 const version = JSON.parse(readFileSync(new URL('../../package.json', import.meta.url), 'utf8')).version;
 const DEV_KEY = `ind_dev_${'a'.repeat(64)}`;
@@ -91,3 +94,133 @@ describe('IndemnClient request path', () => {
     expect(() => jarvisSocketUrl(new IndemnClient())).toThrow(/only to Indemn/);
   });
 });
+
+describe('evaluations requests carry the credential', () => {
+  const ORG = 'aaaaaaaaaaaaaaaaaaaaaaaa';
+  const TWO = 'cccccccccccccccccccccccc';
+  let home: ReturnType<typeof useTempHome>;
+  beforeEach(() => {
+    cleanEnv();
+    home = useTempHome();
+    vi.spyOn(process, 'cwd').mockReturnValue(home.dir);
+  });
+  afterEach(() => home.cleanup());
+
+  const evalsCall = (calls: RecordedCall[]) => calls.find((c) => c.url.startsWith('https://devevaluations.indemn.ai/'))!;
+
+  it('sends a saved session as Bearer, and copilot and Darwin keep their own schemes', async () => {
+    const token = jwtExpiringIn(5 * 3_600_000);
+    IndemnClient.saveConfig({ environment: 'dev', user_id: 'u1', session: { token }, orgs: [{ id: ORG, name: 'QA A' }] });
+    const { calls } = recordFetch([on('GET', '/v1-agents', { json: [] })]);
+    const client = new IndemnClient();
+    await client.evalsGet('/api/v1/rubrics');
+    await client.copilotGet('/organization/:org_id/ai-studio/v2/bots');
+    await client.platformRequest('GET', '/v1-agents');
+    expect(calls.map((c) => c.headers.authorization)).toEqual([`Bearer ${token}`, `JWT ${token}`, `Bearer ${token}`]);
+    expect(calls[2].headers['x-organization-id']).toBe(ORG);
+  });
+
+  it('sends an API key as Bearer (evaluations checks it and pins it to the key\'s org)', async () => {
+    vi.stubEnv('INDEMN_API_KEY', DEV_KEY);
+    const { calls } = recordFetch();
+    const client = new IndemnClient({ orgId: 'org1' });
+    await client.evalsPost('/api/v1/rubrics', { name: 'r' });
+    await client.copilotGet('/organization/:org_id/ai-studio/v2/bots');
+    expect(calls.map((c) => c.headers.authorization)).toEqual([`Bearer ${DEV_KEY}`, `Bearer ${DEV_KEY}`]);
+  });
+
+  it('passes on the session a host hands over (Darwin starting the toolbox for Jarvis)', async () => {
+    const token = jwtExpiringIn(5 * 3_600_000);
+    vi.stubEnv('INDEMN_TOKEN', `JWT ${token}`);
+    vi.stubEnv('INDEMN_ENV', 'dev');
+    const { calls } = recordFetch();
+    await new IndemnClient().evalsGet('/api/v1/runs/r1');
+    expect(evalsCall(calls).headers.authorization).toBe(`Bearer ${token}`);
+  });
+
+  it('names the org once one is in effect: an MCP call\'s scope or the org this client already settled on', async () => {
+    vi.stubEnv('INDEMN_API_KEY', DEV_KEY);
+    const { calls } = recordFetch();
+    const client = new IndemnClient({ orgId: 'org1' });
+    await client.evalsGet('/api/v1/rubrics');
+    expect(calls[0].headers['x-organization-id']).toBeUndefined();
+    await runWithOrg('org-scoped', () => client.evalsGet('/api/v1/rubrics'));
+    expect(calls[1].headers['x-organization-id']).toBe('org-scoped');
+    await client.copilotGet('/organization/:org_id/ai-studio/v2/bots');
+    await client.evalsGet('/api/v1/rubrics');
+    expect(calls[3].headers['x-organization-id']).toBe('org1');
+  });
+
+  it('never asks which org or looks one up just to call evaluations', async () => {
+    IndemnClient.saveConfig({ environment: 'dev', user_id: 'u1', session: { token: jwtExpiringIn(5 * 3_600_000) }, orgs: [{ id: ORG, name: 'QA A' }, { id: TWO, name: 'QA B' }] });
+    const { calls } = recordFetch();
+    await new IndemnClient().evalsGet('/api/v1/runs', { agent_id: 'a1' });
+    expect(calls).toHaveLength(1);
+    expect(calls[0].headers.authorization).toMatch(/^Bearer /);
+    expect(calls[0].headers['x-organization-id']).toBeUndefined();
+  });
+
+  it('sends nothing without a credential or with auth: false', async () => {
+    const { calls } = recordFetch();
+    await new IndemnClient().evalsGet('/api/v1/rubrics');
+    expect(calls[0].headers.authorization).toBeUndefined();
+    expect(calls[0].headers['x-organization-id']).toBeUndefined();
+
+    vi.stubEnv('INDEMN_API_KEY', DEV_KEY);
+    const client = new IndemnClient();
+    // No evaluations caller passes auth: false today; the switch is honoured like copilot's.
+    await (client as unknown as { send: (b: string, m: string, u: string, o: object) => Promise<Response> })
+      .send('evaluations', 'GET', 'https://devevaluations.indemn.ai/api/v1/rubrics', { auth: false });
+    expect(calls[1].headers.authorization).toBeUndefined();
+  });
+
+  it('refuses locally once a saved login has ended, like copilot', async () => {
+    IndemnClient.saveConfig({ environment: 'dev', user_id: 'u1', session: { token: jwtExpiringIn(-60_000), expires_at: new Date(Date.now() - 60_000).toISOString() } });
+    const { calls } = recordFetch();
+    await expect(new IndemnClient().evalsGet('/api/v1/rubrics')).rejects.toThrow(/indemn login/);
+    expect(calls).toHaveLength(0);
+  });
+
+  it('turns a 401 from evaluations into "log in again", keeping the service\'s reason', async () => {
+    vi.stubEnv('INDEMN_API_KEY', DEV_KEY);
+    recordFetch([on('GET', '/api/v1/rubrics', { status: 401, json: { detail: 'Invalid or expired credential' } })]);
+    const unauth = await new IndemnClient().evalsGet('/api/v1/rubrics').catch((e) => e);
+    expect(unauth).toBeInstanceOf(SessionExpiredError);
+    expect(unauth.exitCode).toBe(EXIT.AUTH);
+    expect(unauth.message).toMatch(/Invalid or expired credential.*Run `indemn login`/);
+  });
+
+  it('reports a 403 from evaluations as a denial with the service\'s reason, not as a login problem', async () => {
+    vi.stubEnv('INDEMN_API_KEY', DEV_KEY);
+    recordFetch([
+      on('POST', '/api/v1/rubrics', { status: 403, json: { detail: 'Access denied to this agent' } }),
+      on('GET', '/api/v1/test-sets', { status: 403, json: { detail: "API key's organization is no longer accessible" } }),
+    ]);
+    const client = new IndemnClient();
+    const denied = await client.evalsPost('/api/v1/rubrics', { name: 'r' }).catch((e) => e);
+    expect(denied).not.toBeInstanceOf(SessionExpiredError);
+    expect(denied.exitCode).toBe(EXIT.ERROR);
+    expect(denied.message).toBe('The evaluations service denied access (Access denied to this agent).');
+    const gone = await client.evalsGet('/api/v1/test-sets').catch((e) => e);
+    expect(gone.message).toBe("The evaluations service denied access (API key's organization is no longer accessible).");
+    expect(gone.message).not.toMatch(/indemn login|Sign in/);
+  });
+
+  it('a host\'s session is told to sign in to Copilot again on a 401', async () => {
+    vi.stubEnv('INDEMN_TOKEN', jwtExpiringIn(5 * 3_600_000));
+    vi.stubEnv('INDEMN_ENV', 'dev');
+    recordFetch([on('GET', '/api/v1/runs', { status: 401, json: { detail: 'expired' } })]);
+    await expect(new IndemnClient().evalsGet('/api/v1/runs')).rejects.toThrow(/Sign in to Copilot again/);
+  });
+
+  it('never prints the evaluations credential with --debug', async () => {
+    vi.stubEnv('INDEMN_DEBUG', '1');
+    vi.stubEnv('INDEMN_API_KEY', DEV_KEY);
+    const writes: string[] = [];
+    vi.spyOn(process.stderr, 'write').mockImplementation(((chunk: string) => { writes.push(String(chunk)); return true; }) as never);
+    recordFetch();
+    await new IndemnClient().evalsGet('/api/v1/rubrics');
+    expect(writes.join('')).toContain('GET https://devevaluations.indemn.ai/api/v1/rubrics');
+    expect(writes.join('')).not.toContain(DEV_KEY);
+  });
+});

package/test/sdk/credentials.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest';
-import { copilotAuthHeader, darwinAuthHeader, resolveCredential } from '../../src/sdk/credentials.js';
+import { copilotAuthHeader, darwinAuthHeader, evaluationsAuthHeader, resolveCredential } from '../../src/sdk/credentials.js';
 import type { IndemnConfig } from '../../src/sdk/types.js';
 
 const DEV_KEY = `ind_dev_${'a'.repeat(64)}`;
@@ -30,4 +30,9 @@ describe('auth headers', () => {
     expect(darwinAuthHeader({ kind: 'token', token: 't', source: 'config', environment: 'dev' })).toBe('Bearer t');
     expect(() => darwinAuthHeader({ kind: 'api_key', key: DEV_KEY, source: 'env', environment: 'dev' })).toThrow(/login session/);
   });
+
+  it('sends the session or an API key to evaluations as Bearer', () => {
+    expect(evaluationsAuthHeader({ kind: 'token', token: 't', source: 'config', environment: 'dev' })).toBe('Bearer t');
+    expect(evaluationsAuthHeader({ kind: 'api_key', key: DEV_KEY, source: 'env', environment: 'dev' })).toBe(`Bearer ${DEV_KEY}`);
+  });
 });