@indemn/cli 1.7.7 → 1.7.8

package/test/mcp/access.test.ts

@@ -0,0 +1,158 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { ToolListChangedNotificationSchema } from '@modelcontextprotocol/sdk/types.js';
+import { on, recordFetch } from '../helpers/fetch-recorder.js';
+import { cleanEnv, useTempHome } from '../helpers/config-home.js';
+import { jwtExpiringIn } from '../helpers/jwt.js';
+import { connectPair } from '../helpers/mcp-pair.js';
+import { IndemnClient } from '../../src/sdk/client.js';
+import { registerTools } from '../../src/mcp/tools.js';
+import { refreshAccess, resetAccess, usableSomewhere, type Access } from '../../src/sdk/access.js';
+import type { Registry } from '../../src/mcp/registry.js';
+
+const A = 'aaaaaaaaaaaaaaaaaaaaaaaa';
+const B = 'bbbbbbbbbbbbbbbbbbbbbbbb';
+
+function accessWith(bTickets = false): Access {
+  return {
+    user: { id: 'u1', email: 'pat@example.test', name: 'Pat' },
+    is_indemn_staff: false,
+    capabilities: [],
+    orgs: [
+      { org_id: A, org_name: 'QA A', role: 'admin', is_org_admin: true, capabilities: ['member', 'tickets'],
+        projects: [{ project_id: 'p1', name: 'A main', role: 'admin', capabilities: ['conversations:messages', 'conversations:read'] }] },
+      { org_id: B, org_name: 'QA B', role: 'guest', is_org_admin: false, capabilities: bTickets ? ['member', 'tickets'] : ['member'],
+        projects: [{ project_id: 'p2', name: 'B main', role: 'guest', capabilities: ['conversations:messages'] }] },
+    ],
+  };
+}
+
+describe('role-aware MCP tools', () => {
+  let home: ReturnType<typeof useTempHome>;
+  let registry: Registry;
+
+  beforeEach(() => {
+    cleanEnv();
+    home = useTempHome();
+    resetAccess();
+    vi.spyOn(process, 'cwd').mockReturnValue(home.dir);
+    IndemnClient.saveConfig({
+      environment: 'dev', user_id: 'u1', session: { token: jwtExpiringIn(5 * 3_600_000) },
+      orgs: [{ id: A, name: 'QA A' }, { id: B, name: 'QA B' }],
+      access: accessWith(),
+    });
+  });
+  afterEach(() => { resetAccess(); home.cleanup(); });
+
+  function setup(server: Parameters<typeof registerTools>[0]) {
+    registry = registerTools(server, new IndemnClient());
+    registry.applyVisibility();
+  }
+
+  async function toolNames(pair: Awaited<ReturnType<typeof connectPair>>) {
+    return (await pair.client.listTools()).tools.map((t) => t.name);
+  }
+
+  it('hides tools the person can use nowhere, keeps the rest', async () => {
+    recordFetch();
+    const pair = await connectPair(setup);
+    const names = await toolNames(pair);
+    expect(names).toContain('list_tickets'); // tickets on in QA A
+    expect(names).toContain('get_conversation'); // admin in A's project
+    expect(names).toContain('list_agents'); // membership only
+    expect(names).not.toContain('set_org_admin_settings'); // staff only
+    expect(names).not.toContain('create_sandbox_org'); // support account only
+    expect(names).not.toContain('mark_conversation_test'); // staff + agent
+    await pair.close();
+  });
+
+  it('a folder linked to one org counts only that org', async () => {
+    vi.stubEnv('INDEMN_ORG_ID', B);
+    recordFetch();
+    const pair = await connectPair(setup);
+    const names = await toolNames(pair);
+    expect(names).not.toContain('list_tickets');
+    expect(names).not.toContain('get_conversation');
+    expect(names).toContain('list_agents');
+    await pair.close();
+  });
+
+  it('refuses early, with the reason, where the org has no access (after asking again)', async () => {
+    const { calls } = recordFetch([on('GET', '/auth/me/access', { json: accessWith() })]);
+    const pair = await connectPair(setup);
+    const res = await pair.call('list_tickets', { org_id: B });
+    expect(res.isError).toBe(true);
+    expect(res.body).toContain('Tickets are not turned on for QA B');
+    expect(calls.some((c) => c.url.includes('/auth/me/access'))).toBe(true); // stale access is re-checked first
+    expect(calls.some((c) => c.url.includes('/tickets'))).toBe(false);
+    await pair.close();
+  });
+
+  it('a refresh that grants access lets the call through', async () => {
+    const { calls } = recordFetch([on('GET', '/auth/me/access', { json: accessWith(true) })]);
+    const pair = await connectPair(setup);
+    const res = await pair.call('list_tickets', { org_id: B });
+    expect(res.isError).toBe(false);
+    expect(calls.some((c) => c.url.includes(`/organization/${B}/tickets`))).toBe(true);
+    await pair.close();
+  });
+
+  it('concurrent calls for different orgs each get their own answer', async () => {
+    const { calls } = recordFetch([on('GET', '/auth/me/access', { json: accessWith() })]);
+    const pair = await connectPair(setup);
+    const [inA, inB, inA2] = await Promise.all([
+      pair.call('list_tickets', { org_id: A }),
+      pair.call('list_tickets', { org_id: B }),
+      pair.call('list_tickets', { org_id: A }),
+    ]);
+    expect(inA.isError).toBe(false);
+    expect(inA2.isError).toBe(false);
+    expect(inB.isError).toBe(true);
+    expect(inA.body.context.org_id).toBe(A);
+    const ticketCalls = calls.filter((c) => c.url.includes('/tickets'));
+    expect(ticketCalls).toHaveLength(2);
+    expect(ticketCalls.every((c) => c.url.includes(`/organization/${A}/tickets`))).toBe(true);
+    await pair.close();
+  });
+
+  it('a server refusal names the person\'s role', async () => {
+    recordFetch([
+      on('GET', '/auth/me/access', { json: accessWith() }),
+      on('GET', '/ai-studio/v2/bots', { status: 403, json: { success: false, msg: 'Forbidden' } }),
+    ]);
+    const pair = await connectPair(setup);
+    const res = await pair.call('list_agents', { org_id: B });
+    expect(res.isError).toBe(true);
+    expect(res.body).toContain('Not allowed');
+    expect(res.body).toContain('Your role: guest in QA B.');
+    await pair.close();
+  });
+
+  it('tells the host when the visible tools change', async () => {
+    vi.stubEnv('INDEMN_ORG_ID', B);
+    recordFetch([on('GET', '/auth/me/access', { json: accessWith(true) })]);
+    const pair = await connectPair(setup);
+    let changed = 0;
+    pair.client.setNotificationHandler(ToolListChangedNotificationSchema, async () => { changed += 1; });
+    expect(await toolNames(pair)).not.toContain('list_tickets');
+    await refreshAccess(new IndemnClient());
+    registry.applyVisibility();
+    await vi.waitFor(() => expect(changed).toBeGreaterThan(0));
+    expect(await toolNames(pair)).toContain('list_tickets');
+    await pair.close();
+  });
+
+  it('unknown access hides nothing', () => {
+    expect(usableSomewhere('set_org_admin_settings', null)).toBe(true);
+    expect(usableSomewhere('list_tickets', null)).toBe(true);
+  });
+
+  it('a host session (INDEMN_TOKEN) never writes access to this machine', async () => {
+    IndemnClient.clearConfig();
+    vi.stubEnv('INDEMN_TOKEN', jwtExpiringIn(3_600_000));
+    vi.stubEnv('INDEMN_ENV', 'dev');
+    recordFetch([on('GET', '/auth/me/access', { json: accessWith() })]);
+    const got = await refreshAccess(new IndemnClient());
+    expect(got?.orgs).toHaveLength(2);
+    expect(IndemnClient.loadConfig()).toBeNull();
+  });
+});

package/test/sdk/auth.test.ts

@@ -24,7 +24,8 @@ describe('token-first login', () => {
     ]);
     const result = await login('qa@indemn.ai', 'pw', 'dev', { firebaseSignIn: fakeFirebase });
 
-    expect(calls.map((c) => `${c.method} ${new URL(c.url).pathname}`)).toEqual(['POST /api/auth/firebase/signin', 'GET /api/organization']);
+    // Then what the person may do, kept with the login (display only).
+    expect(calls.map((c) => `${c.method} ${new URL(c.url).pathname}`)).toEqual(['POST /api/auth/firebase/signin', 'GET /api/organization', 'GET /api/auth/me/access']);
     expect(calls.some((c) => c.url.includes('/auth/api-keys'))).toBe(false);
     expect(calls[1].headers.authorization).toBe(`JWT ${token}`);
     expect(result.orgs).toEqual([{ id: A._id, name: 'QA A' }, { id: B._id, name: 'QA B' }]);

package/test/sdk/browser-login.test.ts

@@ -0,0 +1,147 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { createHash } from 'node:crypto';
+import { readFileSync, statSync } from 'node:fs';
+import { request } from 'node:http';
+import { join } from 'node:path';
+import { on, recordFetch } from '../helpers/fetch-recorder.js';
+import { cleanEnv, useTempHome } from '../helpers/config-home.js';
+import { jwtExpiringIn } from '../helpers/jwt.js';
+import { approveUrl, createPkce, dashboardUrl, startLoopback } from '../../src/sdk/browser-login.js';
+import { loginWithBrowser } from '../../src/sdk/auth.js';
+
+/** GET a loopback URL with node:http (global fetch is recorded in these tests). */
+function hit(url: string): Promise<{ status: number; body: string }> {
+  return new Promise((resolve, reject) => {
+    request(url, (res) => {
+      let body = '';
+      res.on('data', (c) => (body += c));
+      res.on('end', () => resolve({ status: res.statusCode ?? 0, body }));
+    }).on('error', reject).end();
+  });
+}
+
+describe('PKCE and URLs', () => {
+  beforeEach(() => cleanEnv());
+
+  it('challenge is the base64url SHA-256 of the verifier; values are fresh each time', () => {
+    const a = createPkce();
+    const b = createPkce();
+    expect(a.challenge).toBe(createHash('sha256').update(a.verifier).digest('base64url'));
+    expect(a.challenge).toMatch(/^[A-Za-z0-9_-]{43}$/);
+    expect(a.verifier).toMatch(/^[A-Za-z0-9_-]{43}$/);
+    expect(a.state).toMatch(/^[A-Za-z0-9_-]{43}$/);
+    expect(a.verifier).not.toBe(b.verifier);
+    expect(a.state).not.toBe(b.state);
+  });
+
+  it('dashboard is the copilot host without /api, or INDEMN_DASHBOARD_URL (Indemn or localhost only)', () => {
+    expect(dashboardUrl('https://devcopilot.indemn.ai/api')).toBe('https://devcopilot.indemn.ai');
+    vi.stubEnv('INDEMN_DASHBOARD_URL', 'http://localhost:5174/');
+    expect(dashboardUrl('https://devcopilot.indemn.ai/api')).toBe('http://localhost:5174');
+    vi.stubEnv('INDEMN_DASHBOARD_URL', 'https://evil.example');
+    expect(() => dashboardUrl('https://devcopilot.indemn.ai/api')).toThrow(/indemn\.ai/);
+  });
+
+  it('approve URL carries port, state and challenge but never the verifier', () => {
+    const p = createPkce();
+    const url = approveUrl('https://copilot.indemn.ai', 50123, p);
+    expect(url.startsWith('https://copilot.indemn.ai/#/cli-login?')).toBe(true);
+    const q = new URLSearchParams(url.split('?')[1]);
+    expect(q.get('port')).toBe('50123');
+    expect(q.get('state')).toBe(p.state);
+    expect(q.get('challenge')).toBe(p.challenge);
+    expect(url).not.toContain(p.verifier);
+  });
+});
+
+describe('loopback listener', () => {
+  it('binds 127.0.0.1, ignores a wrong state, takes the first matching callback, then closes', async () => {
+    const loop = await startLoopback('the-state', 10_000);
+    const base = `http://127.0.0.1:${loop.port}`;
+    expect((await hit(`${base}/other`)).status).toBe(404);
+    expect((await hit(`${base}/callback?code=x&state=wrong`)).status).toBe(400);
+    const ok = await hit(`${base}/callback?code=the-code&state=the-state`);
+    expect(ok.status).toBe(200);
+    expect(ok.body).toContain('close this tab');
+    expect(ok.body).not.toContain('the-code');
+    await expect(loop.result).resolves.toEqual({ code: 'the-code' });
+    await expect(hit(`${base}/callback?code=again&state=the-state`)).rejects.toThrow();
+  });
+
+  it('reports a cancel from the browser', async () => {
+    const loop = await startLoopback('s', 10_000);
+    await hit(`http://127.0.0.1:${loop.port}/callback?error=access_denied&state=s`);
+    await expect(loop.result).resolves.toEqual({ error: 'access_denied' });
+  });
+
+  it('times out', async () => {
+    const loop = await startLoopback('s', 50);
+    await expect(loop.result).rejects.toThrow(/Timed out/);
+  });
+});
+
+describe('loginWithBrowser', () => {
+  let home: ReturnType<typeof useTempHome>;
+  beforeEach(() => { cleanEnv(); home = useTempHome(); });
+  afterEach(() => home.cleanup());
+
+  /** A fake browser: reads the approve URL and calls back like the dashboard would. */
+  function approvingBrowser(seen: { challenge?: string }, outcome: 'approve' | 'cancel' = 'approve') {
+    return async (url: string) => {
+      const q = new URLSearchParams(url.split('?')[1]);
+      seen.challenge = q.get('challenge') ?? undefined;
+      const back = new URLSearchParams(outcome === 'approve' ? { code: 'one-time-code', state: q.get('state')! } : { error: 'access_denied', state: q.get('state')! });
+      setTimeout(() => void hit(`http://127.0.0.1:${q.get('port')}/callback?${back}`), 10);
+      return true;
+    };
+  }
+
+  it('exchanges the code with the verifier and saves the session like a normal login', async () => {
+    const token = jwtExpiringIn(24 * 3_600_000, { cli: true });
+    const { calls } = recordFetch([
+      on('POST', '/auth/cli/token', { json: { token: `JWT ${token}`, expires_at: 'x', user: { _id: 'u1', email: 'pat@example.test' } } }),
+      on('GET', '/organization', { json: { success: true, userOrganizations: [{ _id: 'aaaaaaaaaaaaaaaaaaaaaaaa', name: 'Acme' }] } }),
+    ]);
+    const seen: { challenge?: string } = {};
+    const result = await loginWithBrowser('dev', { open: approvingBrowser(seen), timeoutMs: 10_000 });
+
+    const exchange = calls.find((c) => c.url.endsWith('/auth/cli/token'))!;
+    expect(new URL(exchange.url).origin).toBe('https://devcopilot.indemn.ai');
+    expect(exchange.headers.authorization).toBeUndefined();
+    const body = exchange.body as { code: string; code_verifier: string };
+    expect(body.code).toBe('one-time-code');
+    expect(createHash('sha256').update(body.code_verifier).digest('base64url')).toBe(seen.challenge);
+
+    expect(result.email).toBe('pat@example.test');
+    expect(result.orgs).toEqual([{ id: 'aaaaaaaaaaaaaaaaaaaaaaaa', name: 'Acme' }]);
+    const saved = JSON.parse(readFileSync(join(home.dir, '.indemn', 'config.json'), 'utf8'));
+    expect(saved.session.token).toBe(token);
+    expect(saved.email).toBe('pat@example.test');
+    expect(saved).not.toHaveProperty('api_key');
+    if (process.platform !== 'win32') {
+      expect(statSync(join(home.dir, '.indemn', 'config.json')).mode & 0o777).toBe(0o600);
+      expect(statSync(join(home.dir, '.indemn')).mode & 0o777).toBe(0o700);
+    }
+  });
+
+  it('cancel in the browser saves nothing', async () => {
+    recordFetch([]);
+    await expect(loginWithBrowser('dev', { open: approvingBrowser({}, 'cancel'), timeoutMs: 10_000 })).rejects.toThrow(/cancelled/);
+    expect(() => readFileSync(join(home.dir, '.indemn', 'config.json'))).toThrow();
+  });
+
+  it('a refused code says to log in again', async () => {
+    recordFetch([on('POST', '/auth/cli/token', { status: 400, json: { success: false, error: 'invalid_grant' } })]);
+    await expect(loginWithBrowser('dev', { open: approvingBrowser({}), timeoutMs: 10_000 })).rejects.toThrow(/not accepted/);
+  });
+
+  it('shows the URL even when the browser cannot be opened', async () => {
+    recordFetch([]);
+    const shown: Array<[string, boolean]> = [];
+    const pending = loginWithBrowser('dev', { open: async () => false, showUrl: (u, o) => shown.push([u, o]), timeoutMs: 100 });
+    await expect(pending).rejects.toThrow(/Timed out/);
+    expect(shown).toHaveLength(1);
+    expect(shown[0][1]).toBe(false);
+    expect(shown[0][0]).toContain('/#/cli-login?');
+  });
+});

package/test/sdk/client.test.ts

@@ -1,8 +1,11 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { readFileSync } from 'node:fs';
-import { on, recordFetch } from '../helpers/fetch-recorder.js';
+import { on, recordFetch, type RecordedCall } from '../helpers/fetch-recorder.js';
 import { cleanEnv, useTempHome } from '../helpers/config-home.js';
+import { jwtExpiringIn } from '../helpers/jwt.js';
 import { IndemnClient } from '../../src/sdk/client.js';
+import { runWithOrg } from '../../src/core/scope.js';
+import { EXIT, SessionExpiredError } from '../../src/core/runtime.js';
 
 const version = JSON.parse(readFileSync(new URL('../../package.json', import.meta.url), 'utf8')).version;
 const DEV_KEY = `ind_dev_${'a'.repeat(64)}`;
@@ -91,3 +94,133 @@ describe('IndemnClient request path', () => {
     expect(() => jarvisSocketUrl(new IndemnClient())).toThrow(/only to Indemn/);
   });
 });
+
+describe('evaluations requests carry the credential', () => {
+  const ORG = 'aaaaaaaaaaaaaaaaaaaaaaaa';
+  const TWO = 'cccccccccccccccccccccccc';
+  let home: ReturnType<typeof useTempHome>;
+  beforeEach(() => {
+    cleanEnv();
+    home = useTempHome();
+    vi.spyOn(process, 'cwd').mockReturnValue(home.dir);
+  });
+  afterEach(() => home.cleanup());
+
+  const evalsCall = (calls: RecordedCall[]) => calls.find((c) => c.url.startsWith('https://devevaluations.indemn.ai/'))!;
+
+  it('sends a saved session as Bearer, and copilot and Darwin keep their own schemes', async () => {
+    const token = jwtExpiringIn(5 * 3_600_000);
+    IndemnClient.saveConfig({ environment: 'dev', user_id: 'u1', session: { token }, orgs: [{ id: ORG, name: 'QA A' }] });
+    const { calls } = recordFetch([on('GET', '/v1-agents', { json: [] })]);
+    const client = new IndemnClient();
+    await client.evalsGet('/api/v1/rubrics');
+    await client.copilotGet('/organization/:org_id/ai-studio/v2/bots');
+    await client.platformRequest('GET', '/v1-agents');
+    expect(calls.map((c) => c.headers.authorization)).toEqual([`Bearer ${token}`, `JWT ${token}`, `Bearer ${token}`]);
+    expect(calls[2].headers['x-organization-id']).toBe(ORG);
+  });
+
+  it('sends an API key as Bearer (evaluations checks it and pins it to the key\'s org)', async () => {
+    vi.stubEnv('INDEMN_API_KEY', DEV_KEY);
+    const { calls } = recordFetch();
+    const client = new IndemnClient({ orgId: 'org1' });
+    await client.evalsPost('/api/v1/rubrics', { name: 'r' });
+    await client.copilotGet('/organization/:org_id/ai-studio/v2/bots');
+    expect(calls.map((c) => c.headers.authorization)).toEqual([`Bearer ${DEV_KEY}`, `Bearer ${DEV_KEY}`]);
+  });
+
+  it('passes on the session a host hands over (Darwin starting the toolbox for Jarvis)', async () => {
+    const token = jwtExpiringIn(5 * 3_600_000);
+    vi.stubEnv('INDEMN_TOKEN', `JWT ${token}`);
+    vi.stubEnv('INDEMN_ENV', 'dev');
+    const { calls } = recordFetch();
+    await new IndemnClient().evalsGet('/api/v1/runs/r1');
+    expect(evalsCall(calls).headers.authorization).toBe(`Bearer ${token}`);
+  });
+
+  it('names the org once one is in effect: an MCP call\'s scope or the org this client already settled on', async () => {
+    vi.stubEnv('INDEMN_API_KEY', DEV_KEY);
+    const { calls } = recordFetch();
+    const client = new IndemnClient({ orgId: 'org1' });
+    await client.evalsGet('/api/v1/rubrics');
+    expect(calls[0].headers['x-organization-id']).toBeUndefined();
+    await runWithOrg('org-scoped', () => client.evalsGet('/api/v1/rubrics'));
+    expect(calls[1].headers['x-organization-id']).toBe('org-scoped');
+    await client.copilotGet('/organization/:org_id/ai-studio/v2/bots');
+    await client.evalsGet('/api/v1/rubrics');
+    expect(calls[3].headers['x-organization-id']).toBe('org1');
+  });
+
+  it('never asks which org or looks one up just to call evaluations', async () => {
+    IndemnClient.saveConfig({ environment: 'dev', user_id: 'u1', session: { token: jwtExpiringIn(5 * 3_600_000) }, orgs: [{ id: ORG, name: 'QA A' }, { id: TWO, name: 'QA B' }] });
+    const { calls } = recordFetch();
+    await new IndemnClient().evalsGet('/api/v1/runs', { agent_id: 'a1' });
+    expect(calls).toHaveLength(1);
+    expect(calls[0].headers.authorization).toMatch(/^Bearer /);
+    expect(calls[0].headers['x-organization-id']).toBeUndefined();
+  });
+
+  it('sends nothing without a credential or with auth: false', async () => {
+    const { calls } = recordFetch();
+    await new IndemnClient().evalsGet('/api/v1/rubrics');
+    expect(calls[0].headers.authorization).toBeUndefined();
+    expect(calls[0].headers['x-organization-id']).toBeUndefined();
+
+    vi.stubEnv('INDEMN_API_KEY', DEV_KEY);
+    const client = new IndemnClient();
+    // No evaluations caller passes auth: false today; the switch is honoured like copilot's.
+    await (client as unknown as { send: (b: string, m: string, u: string, o: object) => Promise<Response> })
+      .send('evaluations', 'GET', 'https://devevaluations.indemn.ai/api/v1/rubrics', { auth: false });
+    expect(calls[1].headers.authorization).toBeUndefined();
+  });
+
+  it('refuses locally once a saved login has ended, like copilot', async () => {
+    IndemnClient.saveConfig({ environment: 'dev', user_id: 'u1', session: { token: jwtExpiringIn(-60_000), expires_at: new Date(Date.now() - 60_000).toISOString() } });
+    const { calls } = recordFetch();
+    await expect(new IndemnClient().evalsGet('/api/v1/rubrics')).rejects.toThrow(/indemn login/);
+    expect(calls).toHaveLength(0);
+  });
+
+  it('turns a 401 from evaluations into "log in again", keeping the service\'s reason', async () => {
+    vi.stubEnv('INDEMN_API_KEY', DEV_KEY);
+    recordFetch([on('GET', '/api/v1/rubrics', { status: 401, json: { detail: 'Invalid or expired credential' } })]);
+    const unauth = await new IndemnClient().evalsGet('/api/v1/rubrics').catch((e) => e);
+    expect(unauth).toBeInstanceOf(SessionExpiredError);
+    expect(unauth.exitCode).toBe(EXIT.AUTH);
+    expect(unauth.message).toMatch(/Invalid or expired credential.*Run `indemn login`/);
+  });
+
+  it('reports a 403 from evaluations as a denial with the service\'s reason, not as a login problem', async () => {
+    vi.stubEnv('INDEMN_API_KEY', DEV_KEY);
+    recordFetch([
+      on('POST', '/api/v1/rubrics', { status: 403, json: { detail: 'Access denied to this agent' } }),
+      on('GET', '/api/v1/test-sets', { status: 403, json: { detail: "API key's organization is no longer accessible" } }),
+    ]);
+    const client = new IndemnClient();
+    const denied = await client.evalsPost('/api/v1/rubrics', { name: 'r' }).catch((e) => e);
+    expect(denied).not.toBeInstanceOf(SessionExpiredError);
+    expect(denied.exitCode).toBe(EXIT.ERROR);
+    expect(denied.message).toBe('The evaluations service denied access (Access denied to this agent).');
+    const gone = await client.evalsGet('/api/v1/test-sets').catch((e) => e);
+    expect(gone.message).toBe("The evaluations service denied access (API key's organization is no longer accessible).");
+    expect(gone.message).not.toMatch(/indemn login|Sign in/);
+  });
+
+  it('a host\'s session is told to sign in to Copilot again on a 401', async () => {
+    vi.stubEnv('INDEMN_TOKEN', jwtExpiringIn(5 * 3_600_000));
+    vi.stubEnv('INDEMN_ENV', 'dev');
+    recordFetch([on('GET', '/api/v1/runs', { status: 401, json: { detail: 'expired' } })]);
+    await expect(new IndemnClient().evalsGet('/api/v1/runs')).rejects.toThrow(/Sign in to Copilot again/);
+  });
+
+  it('never prints the evaluations credential with --debug', async () => {
+    vi.stubEnv('INDEMN_DEBUG', '1');
+    vi.stubEnv('INDEMN_API_KEY', DEV_KEY);
+    const writes: string[] = [];
+    vi.spyOn(process.stderr, 'write').mockImplementation(((chunk: string) => { writes.push(String(chunk)); return true; }) as never);
+    recordFetch();
+    await new IndemnClient().evalsGet('/api/v1/rubrics');
+    expect(writes.join('')).toContain('GET https://devevaluations.indemn.ai/api/v1/rubrics');
+    expect(writes.join('')).not.toContain(DEV_KEY);
+  });
+});

package/test/sdk/credentials.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest';
-import { copilotAuthHeader, darwinAuthHeader, resolveCredential } from '../../src/sdk/credentials.js';
+import { copilotAuthHeader, darwinAuthHeader, evaluationsAuthHeader, resolveCredential } from '../../src/sdk/credentials.js';
 import type { IndemnConfig } from '../../src/sdk/types.js';
 
 const DEV_KEY = `ind_dev_${'a'.repeat(64)}`;
@@ -30,4 +30,9 @@ describe('auth headers', () => {
     expect(darwinAuthHeader({ kind: 'token', token: 't', source: 'config', environment: 'dev' })).toBe('Bearer t');
     expect(() => darwinAuthHeader({ kind: 'api_key', key: DEV_KEY, source: 'env', environment: 'dev' })).toThrow(/login session/);
   });
+
+  it('sends the session or an API key to evaluations as Bearer', () => {
+    expect(evaluationsAuthHeader({ kind: 'token', token: 't', source: 'config', environment: 'dev' })).toBe('Bearer t');
+    expect(evaluationsAuthHeader({ kind: 'api_key', key: DEV_KEY, source: 'env', environment: 'dev' })).toBe(`Bearer ${DEV_KEY}`);
+  });
 });