@indemn/cli 1.7.7 → 1.7.9

package/test/sdk/campaigns.test.ts

@@ -1,14 +1,15 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import { readFileSync } from 'node:fs';
-import { on, recordFetch } from '../helpers/fetch-recorder.js';
+import { on, recordFetch, type RecordedCall } from '../helpers/fetch-recorder.js';
 import { cleanEnv, useTempHome } from '../helpers/config-home.js';
 import { jwtExpiringIn } from '../helpers/jwt.js';
 import { IndemnClient } from '../../src/sdk/client.js';
 import { CampaignsSDK } from '../../src/sdk/campaigns.js';
 
 const ORG = 'aaaaaaaaaaaaaaaaaaaaaaaa';
+const base = `/api/organization/${ORG}/campaigns-service`;
+const seen = (calls: RecordedCall[]) => calls.map((c) => `${c.method} ${new URL(c.url).pathname.replace(base, '')}`);
 
-describe('campaigns are read-only', () => {
+describe('campaigns: reads, and writes to configuration only', () => {
   let home: ReturnType<typeof useTempHome>;
   beforeEach(() => {
     cleanEnv();
@@ -18,26 +19,83 @@ describe('campaigns are read-only', () => {
   });
   afterEach(() => home.cleanup());
 
-  it('has no write call in the campaigns module', () => {
-    const src = readFileSync(new URL('../../src/sdk/campaigns.ts', import.meta.url), 'utf8');
-    expect(src).not.toMatch(/copilot(Post|Put|Delete|RequestRaw|PostForm|Binary)/);
-  });
-
-  it('reads through the org proxy with GET only', async () => {
+  it('reads through the org proxy with GET, books included', async () => {
     const { calls } = recordFetch([on('GET', '/campaigns-service/', { json: { total: 0, limit: 50, skip: 0, items: [] } })]);
     const sdk = new CampaignsSDK(new IndemnClient());
-    await sdk.list(); await sdk.detail('c1', 'forecast', 30); await sdk.templates(); await sdk.template('t1', true);
-    expect(calls.map((c) => `${c.method} ${new URL(c.url).pathname}`)).toEqual([
-      `GET /api/organization/${ORG}/campaigns-service/campaigns`,
-      `GET /api/organization/${ORG}/campaigns-service/campaigns/c1/forecast`,
-      `GET /api/organization/${ORG}/campaigns-service/templates`,
-      `GET /api/organization/${ORG}/campaigns-service/templates/t1/versions`,
-    ]);
+    await sdk.list(); await sdk.detail('c1', 'forecast', 30); await sdk.templates(); await sdk.template('t1', true); await sdk.books(); await sdk.book('b1');
+    expect(seen(calls)).toEqual(['GET /campaigns', 'GET /campaigns/c1/forecast', 'GET /templates', 'GET /templates/t1/versions', 'GET /books', 'GET /books/b1']);
   });
 
-  it('refuses a path outside the readable list', async () => {
+  it('never sends, runs, uploads, ticks or deletes: those paths are refused before any call', async () => {
     const { calls } = recordFetch();
-    await expect(new CampaignsSDK(new IndemnClient()).get('c1/../../communications/x/send')).rejects.toThrow(/not readable/);
+    const sdk = new CampaignsSDK(new IndemnClient());
+    await expect(sdk.get('c1/../../communications/x/send')).rejects.toThrow(/not readable/);
+    const write = (sdk as unknown as { write: (m: string, p: string, b?: unknown) => Promise<unknown> }).write.bind(sdk);
+    for (const [method, path] of [['POST', '/communications/x/send'], ['POST', '/work-items/w/resolve'], ['POST', '/books/b/runs'], ['POST', '/books/b/uploads'],
+      ['POST', '/campaigns/c/test-tick'], ['POST', '/campaigns/c/candidates/evaluate'], ['POST', '/enrollments/e/close'], ['POST', '/activity'],
+      ['DELETE', '/campaigns/c'], ['PUT', '/campaigns/c'], ['POST', '/campaigns/c/../../communications/x/send']]) {
+      await expect(write(method, path, {})).rejects.toThrow(/not allowed from the CLI/);
+    }
     expect(calls).toHaveLength(0);
   });
+
+  it('a touchpoint is added, or merged into the one with its key; a template given without a version is pinned to its latest', async () => {
+    const draft = { audience: { field: 'status', op: 'eq', value: 'active' }, touchpoints: [{ key: 't1', channel: 'email', terminal_action: 'draft', when: { field: 'derived.days_out', op: 'lte', value: 60 } }], escalation_policy: { then: 'create_work_item' }, channel_policy: {} };
+    const { calls } = recordFetch([
+      on('GET', '/campaigns/c1', { json: { id: 'c1', name: 'Renewals', status: 'draft', draft } }),
+      on('GET', '/templates/tpl1/versions', { json: { total: 2, items: [{ version_n: 2, subject: 'S2', body: 'B2' }, { version_n: 1 }] } }),
+      on('PUT', '/campaigns/c1/draft', (c) => ({ json: c.body })),
+    ]);
+    const sdk = new CampaignsSDK(new IndemnClient());
+    await sdk.setTouchpoint('c1', { key: 't2', channel: 'email', when: { field: 'derived.days_out', op: 'lte', value: 30 }, template_id: 'tpl1' });
+    await sdk.setTouchpoint('c1', { key: 't1', when: { field: 'derived.days_out', op: 'lte', value: 45 } });
+    const puts = calls.filter((c) => c.method === 'PUT').map((c) => c.body as typeof draft);
+    expect(puts[0].touchpoints).toEqual([draft.touchpoints[0], { key: 't2', channel: 'email', terminal_action: 'draft', when: { field: 'derived.days_out', op: 'lte', value: 30 }, template_id: 'tpl1', template_version_n: 2 }]);
+    expect(puts[0].audience).toEqual(draft.audience);  // the rest of the draft is kept
+    expect(puts[1].touchpoints).toEqual([{ ...draft.touchpoints[0], when: { field: 'derived.days_out', op: 'lte', value: 45 } }]);
+  });
+
+  it('a draft change keeps its touchpoints; a template change starts from its latest version', async () => {
+    const draft = { audience: null, touchpoints: [{ key: 't1', channel: 'email' }], escalation_policy: {}, channel_policy: {} };
+    const { calls } = recordFetch([
+      on('GET', '/campaigns/c1', { json: { id: 'c1', draft } }),
+      on('PUT', '/campaigns/c1/draft', (c) => ({ json: c.body })),
+      on('GET', '/templates/tpl1/versions', { json: { items: [{ version_n: 3, subject: 'Hi {{ contact.first_name }}', body: 'Old body', html: '', uses_variables: [{ key: 'contact.first_name', required: true, example: 'Ana' }], selection_tags: {}, skills: {}, batch_row: '', published_by: 'u0' }] } }),
+      on('POST', '/templates/tpl1/versions', (c) => ({ json: { version_n: 4, ...(c.body as object) } })),
+    ]);
+    const sdk = new CampaignsSDK(new IndemnClient());
+    await sdk.updateDraft('c1', { audience: { field: 'status', op: 'eq', value: 'active' } });
+    await sdk.updateTemplate('tpl1', { body: 'New body {{ record.policy.number }}', uses_variables: ['contact.first_name', 'record.policy.number'], change_summary: 'shorter' });
+    expect(calls.find((c) => c.method === 'PUT')!.body).toEqual({ ...draft, audience: { field: 'status', op: 'eq', value: 'active' } });
+    // Variables given as keys: a key already declared keeps its entry, a new one is declared as {key}.
+    expect(calls.find((c) => c.method === 'POST')!.body).toEqual({ subject: 'Hi {{ contact.first_name }}', body: 'New body {{ record.policy.number }}', html: '', uses_variables: [{ key: 'contact.first_name', required: true, example: 'Ana' }, { key: 'record.policy.number' }], selection_tags: {}, skills: {}, batch_row: '', change_summary: 'shorter' });
+  });
+
+  it('writes each configuration call with its method, path and body', async () => {
+    const { calls } = recordFetch([
+      on('GET', '/template-skills/s1', { json: { id: 's1', name: 'Tone', instructions: 'Be brief.' } }),
+      on('GET', '/books/b1', { json: { id: 'b1', name: 'Book' } }),
+      (c) => (c.method === 'GET' ? undefined : { json: { id: 'x' } }),
+    ]);
+    const sdk = new CampaignsSDK(new IndemnClient());
+    await sdk.createCampaign({ solution_id: 's', book_id: 'b', name: 'N', campaign_type: 'renewal' });
+    await sdk.publish('c1', 'first');
+    await sdk.setStatus('c1', 'paused');
+    await sdk.createTemplate({ solution_id: 's', name: 'T', channel: 'email', subject: 'S', body: 'B {{ record.account.name }}', uses_variables: ['record.account.name'] });
+    await sdk.createTemplateSkill({ solution_id: 's', key: 'tone', name: 'Tone', instructions: 'Be brief.' });
+    await sdk.updateTemplateSkill('s1', { instructions: 'Be warm.' });
+    await sdk.createBook({ solution_id: 's', name: 'Book' });
+    await sdk.updateBook('b1', { source: { kind: 'upload' }, identity_keys: ['policy.number'], display: { primary: ['policy.number'], secondary: ['insured.name'] } });
+    const writes = calls.filter((c) => c.method !== 'GET');
+    expect(seen(writes)).toEqual([
+      'POST /campaigns', 'POST /campaigns/c1/publish', 'POST /campaigns/c1/status', 'POST /templates', 'POST /template-skills',
+      'PUT /template-skills/s1', 'POST /books', 'PATCH /books/b1/source', 'PUT /books/b1/identity-keys', 'PUT /books/b1/display',
+    ]);
+    expect(writes.map((c) => c.body)).toEqual([
+      { solution_id: 's', book_id: 'b', name: 'N', campaign_type: 'renewal' }, { change_summary: 'first' }, { status: 'paused' },
+      { solution_id: 's', name: 'T', channel: 'email', subject: 'S', body: 'B {{ record.account.name }}', uses_variables: [{ key: 'record.account.name' }] }, { solution_id: 's', key: 'tone', name: 'Tone', instructions: 'Be brief.' },
+      { name: 'Tone', instructions: 'Be warm.' }, { solution_id: 's', name: 'Book' }, { source: { kind: 'upload' } },  // the service reads body.source
+      { identity_keys: ['policy.number'] }, { display: { primary: ['policy.number'], secondary: ['insured.name'] } },
+    ]);
+  });
 });

package/test/sdk/client.test.ts

@@ -1,8 +1,11 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { readFileSync } from 'node:fs';
-import { on, recordFetch } from '../helpers/fetch-recorder.js';
+import { on, recordFetch, type RecordedCall } from '../helpers/fetch-recorder.js';
 import { cleanEnv, useTempHome } from '../helpers/config-home.js';
+import { jwtExpiringIn } from '../helpers/jwt.js';
 import { IndemnClient } from '../../src/sdk/client.js';
+import { runWithOrg } from '../../src/core/scope.js';
+import { EXIT, SessionExpiredError } from '../../src/core/runtime.js';
 
 const version = JSON.parse(readFileSync(new URL('../../package.json', import.meta.url), 'utf8')).version;
 const DEV_KEY = `ind_dev_${'a'.repeat(64)}`;
@@ -91,3 +94,133 @@ describe('IndemnClient request path', () => {
     expect(() => jarvisSocketUrl(new IndemnClient())).toThrow(/only to Indemn/);
   });
 });
+
+describe('evaluations requests carry the credential', () => {
+  const ORG = 'aaaaaaaaaaaaaaaaaaaaaaaa';
+  const TWO = 'cccccccccccccccccccccccc';
+  let home: ReturnType<typeof useTempHome>;
+  beforeEach(() => {
+    cleanEnv();
+    home = useTempHome();
+    vi.spyOn(process, 'cwd').mockReturnValue(home.dir);
+  });
+  afterEach(() => home.cleanup());
+
+  const evalsCall = (calls: RecordedCall[]) => calls.find((c) => c.url.startsWith('https://devevaluations.indemn.ai/'))!;
+
+  it('sends a saved session as Bearer, and copilot and Darwin keep their own schemes', async () => {
+    const token = jwtExpiringIn(5 * 3_600_000);
+    IndemnClient.saveConfig({ environment: 'dev', user_id: 'u1', session: { token }, orgs: [{ id: ORG, name: 'QA A' }] });
+    const { calls } = recordFetch([on('GET', '/v1-agents', { json: [] })]);
+    const client = new IndemnClient();
+    await client.evalsGet('/api/v1/rubrics');
+    await client.copilotGet('/organization/:org_id/ai-studio/v2/bots');
+    await client.platformRequest('GET', '/v1-agents');
+    expect(calls.map((c) => c.headers.authorization)).toEqual([`Bearer ${token}`, `JWT ${token}`, `Bearer ${token}`]);
+    expect(calls[2].headers['x-organization-id']).toBe(ORG);
+  });
+
+  it('sends an API key as Bearer (evaluations checks it and pins it to the key\'s org)', async () => {
+    vi.stubEnv('INDEMN_API_KEY', DEV_KEY);
+    const { calls } = recordFetch();
+    const client = new IndemnClient({ orgId: 'org1' });
+    await client.evalsPost('/api/v1/rubrics', { name: 'r' });
+    await client.copilotGet('/organization/:org_id/ai-studio/v2/bots');
+    expect(calls.map((c) => c.headers.authorization)).toEqual([`Bearer ${DEV_KEY}`, `Bearer ${DEV_KEY}`]);
+  });
+
+  it('passes on the session a host hands over (Darwin starting the toolbox for Jarvis)', async () => {
+    const token = jwtExpiringIn(5 * 3_600_000);
+    vi.stubEnv('INDEMN_TOKEN', `JWT ${token}`);
+    vi.stubEnv('INDEMN_ENV', 'dev');
+    const { calls } = recordFetch();
+    await new IndemnClient().evalsGet('/api/v1/runs/r1');
+    expect(evalsCall(calls).headers.authorization).toBe(`Bearer ${token}`);
+  });
+
+  it('names the org once one is in effect: an MCP call\'s scope or the org this client already settled on', async () => {
+    vi.stubEnv('INDEMN_API_KEY', DEV_KEY);
+    const { calls } = recordFetch();
+    const client = new IndemnClient({ orgId: 'org1' });
+    await client.evalsGet('/api/v1/rubrics');
+    expect(calls[0].headers['x-organization-id']).toBeUndefined();
+    await runWithOrg('org-scoped', () => client.evalsGet('/api/v1/rubrics'));
+    expect(calls[1].headers['x-organization-id']).toBe('org-scoped');
+    await client.copilotGet('/organization/:org_id/ai-studio/v2/bots');
+    await client.evalsGet('/api/v1/rubrics');
+    expect(calls[3].headers['x-organization-id']).toBe('org1');
+  });
+
+  it('never asks which org or looks one up just to call evaluations', async () => {
+    IndemnClient.saveConfig({ environment: 'dev', user_id: 'u1', session: { token: jwtExpiringIn(5 * 3_600_000) }, orgs: [{ id: ORG, name: 'QA A' }, { id: TWO, name: 'QA B' }] });
+    const { calls } = recordFetch();
+    await new IndemnClient().evalsGet('/api/v1/runs', { agent_id: 'a1' });
+    expect(calls).toHaveLength(1);
+    expect(calls[0].headers.authorization).toMatch(/^Bearer /);
+    expect(calls[0].headers['x-organization-id']).toBeUndefined();
+  });
+
+  it('sends nothing without a credential or with auth: false', async () => {
+    const { calls } = recordFetch();
+    await new IndemnClient().evalsGet('/api/v1/rubrics');
+    expect(calls[0].headers.authorization).toBeUndefined();
+    expect(calls[0].headers['x-organization-id']).toBeUndefined();
+
+    vi.stubEnv('INDEMN_API_KEY', DEV_KEY);
+    const client = new IndemnClient();
+    // No evaluations caller passes auth: false today; the switch is honoured like copilot's.
+    await (client as unknown as { send: (b: string, m: string, u: string, o: object) => Promise<Response> })
+      .send('evaluations', 'GET', 'https://devevaluations.indemn.ai/api/v1/rubrics', { auth: false });
+    expect(calls[1].headers.authorization).toBeUndefined();
+  });
+
+  it('refuses locally once a saved login has ended, like copilot', async () => {
+    IndemnClient.saveConfig({ environment: 'dev', user_id: 'u1', session: { token: jwtExpiringIn(-60_000), expires_at: new Date(Date.now() - 60_000).toISOString() } });
+    const { calls } = recordFetch();
+    await expect(new IndemnClient().evalsGet('/api/v1/rubrics')).rejects.toThrow(/indemn login/);
+    expect(calls).toHaveLength(0);
+  });
+
+  it('turns a 401 from evaluations into "log in again", keeping the service\'s reason', async () => {
+    vi.stubEnv('INDEMN_API_KEY', DEV_KEY);
+    recordFetch([on('GET', '/api/v1/rubrics', { status: 401, json: { detail: 'Invalid or expired credential' } })]);
+    const unauth = await new IndemnClient().evalsGet('/api/v1/rubrics').catch((e) => e);
+    expect(unauth).toBeInstanceOf(SessionExpiredError);
+    expect(unauth.exitCode).toBe(EXIT.AUTH);
+    expect(unauth.message).toMatch(/Invalid or expired credential.*Run `indemn login`/);
+  });
+
+  it('reports a 403 from evaluations as a denial with the service\'s reason, not as a login problem', async () => {
+    vi.stubEnv('INDEMN_API_KEY', DEV_KEY);
+    recordFetch([
+      on('POST', '/api/v1/rubrics', { status: 403, json: { detail: 'Access denied to this agent' } }),
+      on('GET', '/api/v1/test-sets', { status: 403, json: { detail: "API key's organization is no longer accessible" } }),
+    ]);
+    const client = new IndemnClient();
+    const denied = await client.evalsPost('/api/v1/rubrics', { name: 'r' }).catch((e) => e);
+    expect(denied).not.toBeInstanceOf(SessionExpiredError);
+    expect(denied.exitCode).toBe(EXIT.ERROR);
+    expect(denied.message).toBe('The evaluations service denied access (Access denied to this agent).');
+    const gone = await client.evalsGet('/api/v1/test-sets').catch((e) => e);
+    expect(gone.message).toBe("The evaluations service denied access (API key's organization is no longer accessible).");
+    expect(gone.message).not.toMatch(/indemn login|Sign in/);
+  });
+
+  it('a host\'s session is told to sign in to Copilot again on a 401', async () => {
+    vi.stubEnv('INDEMN_TOKEN', jwtExpiringIn(5 * 3_600_000));
+    vi.stubEnv('INDEMN_ENV', 'dev');
+    recordFetch([on('GET', '/api/v1/runs', { status: 401, json: { detail: 'expired' } })]);
+    await expect(new IndemnClient().evalsGet('/api/v1/runs')).rejects.toThrow(/Sign in to Copilot again/);
+  });
+
+  it('never prints the evaluations credential with --debug', async () => {
+    vi.stubEnv('INDEMN_DEBUG', '1');
+    vi.stubEnv('INDEMN_API_KEY', DEV_KEY);
+    const writes: string[] = [];
+    vi.spyOn(process.stderr, 'write').mockImplementation(((chunk: string) => { writes.push(String(chunk)); return true; }) as never);
+    recordFetch();
+    await new IndemnClient().evalsGet('/api/v1/rubrics');
+    expect(writes.join('')).toContain('GET https://devevaluations.indemn.ai/api/v1/rubrics');
+    expect(writes.join('')).not.toContain(DEV_KEY);
+  });
+});

package/test/sdk/credentials.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest';
-import { copilotAuthHeader, darwinAuthHeader, resolveCredential } from '../../src/sdk/credentials.js';
+import { copilotAuthHeader, darwinAuthHeader, evaluationsAuthHeader, resolveCredential } from '../../src/sdk/credentials.js';
 import type { IndemnConfig } from '../../src/sdk/types.js';
 
 const DEV_KEY = `ind_dev_${'a'.repeat(64)}`;
@@ -30,4 +30,9 @@ describe('auth headers', () => {
     expect(darwinAuthHeader({ kind: 'token', token: 't', source: 'config', environment: 'dev' })).toBe('Bearer t');
     expect(() => darwinAuthHeader({ kind: 'api_key', key: DEV_KEY, source: 'env', environment: 'dev' })).toThrow(/login session/);
   });
+
+  it('sends the session or an API key to evaluations as Bearer', () => {
+    expect(evaluationsAuthHeader({ kind: 'token', token: 't', source: 'config', environment: 'dev' })).toBe('Bearer t');
+    expect(evaluationsAuthHeader({ kind: 'api_key', key: DEV_KEY, source: 'env', environment: 'dev' })).toBe(`Bearer ${DEV_KEY}`);
+  });
 });