@velaro/cli 1.4.106 → 1.4.108

package/lib/commands/safety.js

@@ -40,9 +40,56 @@ function printSettings(s) {
   console.log(`Count alert:       ${s.threshold?.count ?? 0} events in ${s.threshold?.windowMinutes ?? 60} minutes`);
 }
 
+
+// ── Safety policy (Compliance > Safety Controls) ─────────────────────────────────────────────
+// Wraps SafetyPolicyController. Customer routes take the site from login; Velaro staff pass --site to use the staff routes.
+// Turning a control OFF needs the recorded liability acknowledgement: the CLI prints the exact text and only sends it when you pass --accept.
+const policyPath = (a) => (a.site ? `/SafetyPolicy/staff/${Number(a.site)}` : '/SafetyPolicy');
+const AUDIENCES = ['ai_bot', 'human_agent'];
+
+function printPolicy(v) {
+  console.log('Safety controls (on by default):');
+  for (const c of v.controls ?? []) {
+    console.log(`  ${c.control}: AI bot ${c.aiBot ? 'on' : 'OFF'}, human agent ${c.humanAgent ? 'on' : 'OFF'}`);
+  }
+  console.log(`Always on (floor): ${(v.floor ?? []).join(', ')}`);
+  if (v.anyOff) console.log(`\nWARNING: ${v.warning}`);
+  const feats = Object.keys(v.overrides?.features ?? {});
+  if (feats.length) console.log(`Per-feature overrides: ${feats.join(', ')}`);
+  console.log(`Acknowledgement version: ${v.acknowledgement?.version}`);
+}
+
+async function applyChange(a, enabled) {
+  const audiences = a.audience === 'both' ? AUDIENCES : [a.audience];
+  let last;
+  if (enabled === false) {
+    if (!a.accept) {
+      const cur = await messagingGet(policyPath(a));
+      console.error(`Turning off a safety control needs the acknowledgement. Read it, then re-run with --accept:\n\n${cur.acknowledgement?.text}\n`);
+      throw new Error('Acknowledgement not accepted (pass --accept after reading the text above).');
+    }
+  }
+  const ack = enabled === false ? (await messagingGet(policyPath(a))).acknowledgement : null;
+  for (const audience of audiences) {
+    last = await messagingPut(policyPath(a), {
+      control: a.control,
+      audience,
+      featureKey: a.feature ?? null,
+      enabled,
+      ...(enabled === false ? { acknowledged: true, ackTextVersion: ack.version } : {}),
+    });
+  }
+  return last;
+}
+
+const siteOpt = { type: 'number', describe: 'Velaro staff only: target site ID (uses the staff route)' };
+const controlOpt = { type: 'string', demandOption: true, describe: 'emergency_self_harm | abuse_ladder | threat_detection | input_jailbreak | output_filter' };
+const audienceOpt = { type: 'string', choices: [...AUDIENCES, 'both'], default: 'both' };
+const featureOpt = { type: 'string', describe: 'Per-feature/channel scope (chat, voice, sms, whatsapp, email). Omit for the whole account.' };
+
 export const safetyCommand = {
   command: 'safety',
-  describe: 'Safety events and alerts: list events, acknowledge, alert settings, test alert, ask Velaro for help',
+  describe: 'Safety events, alerts and safety controls: list events, acknowledge, alert settings, policy (on/off controls), test alert, ask Velaro for help',
   builder: (yargs) => yargs
     .command('events', 'List safety events', (y) => y
       .option('from', { type: 'string', describe: 'ISO start' })
@@ -106,6 +153,35 @@ export const safetyCommand = {
       await messagingPost('/SafetyEvents/need-help', { message: a.message });
       console.log('Sent. The Velaro team has been alerted.');
     }))
-    .demandCommand(1, 'Specify a subcommand: events, summary, ack, settings, test, need-help'),
+    .command('policy <action>', 'Safety controls on/off policy (get | set)', (y) => y
+      .positional('action', { choices: ['get', 'set'] })
+      .option('site', siteOpt)
+      .option('control', { ...controlOpt, demandOption: false })
+      .option('audience', audienceOpt)
+      .option('feature', featureOpt)
+      .option('enabled', { type: 'boolean', describe: 'true = on, false = off (off needs --accept)' })
+      .option('reset', { type: 'boolean', describe: 'Clear the override and use the default (on)' })
+      .option('accept', { type: 'boolean', describe: 'Accept the liability acknowledgement (required to turn a control off)' })
+      .option('json', { type: 'boolean' }),
+    runCommand(async (a) => {
+      if (a.action === 'get') return out(a, await messagingGet(policyPath(a)), printPolicy);
+      if (!a.control) throw new Error('--control is required for set.');
+      if (a.reset && a.enabled !== undefined) throw new Error('Use either --enabled or --reset, not both.');
+      if (!a.reset && a.enabled === undefined) throw new Error('Pass --enabled true|false or --reset.');
+      const v = await applyChange(a, a.reset ? null : a.enabled);
+      out(a, v, (x) => { console.log('Saved.\n'); printPolicy(x); });
+    }))
+    .command('acknowledge-off', 'Turn a safety control OFF after accepting the liability acknowledgement', (y) => y
+      .option('site', siteOpt)
+      .option('control', controlOpt)
+      .option('audience', audienceOpt)
+      .option('feature', featureOpt)
+      .option('accept', { type: 'boolean', describe: 'I have read the acknowledgement text and accept it' })
+      .option('json', { type: 'boolean' }),
+    runCommand(async (a) => {
+      const v = await applyChange(a, false);
+      out(a, v, (x) => { console.log(`${a.control} turned off. The acceptance was recorded.\n`); printPolicy(x); });
+    }))
+    .demandCommand(1, 'Specify a subcommand: events, summary, ack, settings, policy, acknowledge-off, test, need-help'),
   handler: () => {},
 };

package/lib/commands/teams-phone.js

@@ -5,6 +5,9 @@
  *   velaro teams-phone set --tenant-id ...        Create or update the configuration
  *   velaro teams-phone remove                     Delete the configuration
  *   velaro teams-phone test                       Run the inbound-calling readiness checks
+ *   velaro teams-phone agents list                List agents and their Teams user object IDs
+ *   velaro teams-phone agents set <agentId> <teamsUserId>   Map an agent to an Entra user Object ID
+ *   velaro teams-phone agents delete <agentId>    Clear an agent's mapping
  *
  * Backend contract: server/Velaro.Messaging/Controllers/Voice/TeamsPhoneConfigController.cs
  * (velaro-messaging). Site is resolved server-side from the auth context — never
@@ -98,6 +101,39 @@ async function testHandler() {
   if (!result?.success) process.exitCode = 1;
 }
 
+// -- agents (agent -> Entra user object id) ---------------------------------------
+
+async function agentsListHandler() {
+  const agents = await messagingGet('/TeamsPhone/Agents');
+  if (!Array.isArray(agents) || agents.length === 0) {
+    console.log(`
+${DIM}No agents found.${RST}
+`);
+    return;
+  }
+  console.log(`
+${BOLD}Teams Phone agent mapping${RST}`);
+  for (const a of agents) {
+    const name = `${a.firstName ?? ''} ${a.lastName ?? ''}`.trim();
+    console.log(`  ${String(a.id).padEnd(8)} ${name.padEnd(28)} ${String(a.email ?? '').padEnd(34)} ${a.teamsUserId ? GRN + a.teamsUserId + RST : DIM + '(unmapped)' + RST}`);
+  }
+  console.log('');
+}
+
+async function agentsSetHandler(argv) {
+  const r = await messagingPut(`/TeamsPhone/Agents/${encodeURIComponent(argv.agentId)}`, { teamsUserId: argv.teamsUserId });
+  console.log(`
+${GRN}✓${RST} Agent ${argv.agentId} mapped to Teams user ${r?.teamsUserId ?? argv.teamsUserId}.
+`);
+}
+
+async function agentsDeleteHandler(argv) {
+  await messagingDel(`/TeamsPhone/Agents/${encodeURIComponent(argv.agentId)}`);
+  console.log(`
+${GRN}✓${RST} Agent ${argv.agentId} mapping cleared.
+`);
+}
+
 // -- command export ------------------------------------------------------------------
 
 export const teamsPhoneCommand = {
@@ -137,6 +173,33 @@ export const teamsPhoneCommand = {
       builder:  yy => yy,
       handler:  testHandler,
     })
+    .command({
+      command:  'agents <action>',
+      describe: 'Agent mapping: which Entra user Object ID is which Velaro agent (list | set | delete)',
+      builder: yy => yy
+        .command({
+          command: 'list',
+          describe: 'List agents with their Teams user Object ID',
+          builder: z => z,
+          handler: agentsListHandler,
+        })
+        .command({
+          command: 'set <agentId> <teamsUserId>',
+          describe: 'Map a Velaro agent (workspace user id) to a Microsoft Entra user Object ID (GUID)',
+          builder: z => z
+            .positional('agentId', { type: 'number', describe: 'Velaro agent (workspace user) id' })
+            .positional('teamsUserId', { type: 'string', describe: 'Entra user Object ID (GUID); "" clears' }),
+          handler: agentsSetHandler,
+        })
+        .command({
+          command: 'delete <agentId>',
+          describe: 'Clear the Teams user mapping for a Velaro agent',
+          builder: z => z.positional('agentId', { type: 'number', describe: 'Velaro agent (workspace user) id' }),
+          handler: agentsDeleteHandler,
+        })
+        .demandCommand(1, 'Specify list, set or delete.'),
+      handler: () => {},
+    })
     .demandCommand(1, 'Specify a teams-phone subcommand.')
     .strict(),
   handler: () => {},

package/lib/log-search.js

@@ -207,3 +207,46 @@ export function describeRawMeta(resp) {
   const bestEffort = resp.exact === false ? ' exact=false (answered from the best-effort search index: it can lag and misses text that starts mid-word, so treat counts as a floor, not exact)' : '';
   return `searchPath=${resp.searchPath} scannedRows=${resp.scannedRows} truncated=${t}${t ? ' (NOT proof of absence; continue with nextCursor or narrow the window)' : ''}${bestEffort}${resp.nextCursor ? ' nextCursor=present' : ''}`;
 }
+
+// ── Time window + raw query building (shared by server.js and staff-server.js velaro_logs_search) ──
+// Bug fixed 2026-10-21: the tool only honored `last` and silently ignored from/to, so an explicit
+// historical range returned the newest entries instead. from/to accept an ISO timestamp or a
+// relative duration (30m, 2h, 1d = that long ago). `to` defaults to now, `from` to to - last (2h).
+const DUR_RE = /^(\d+)(m|h|d)$/i;
+const durMs = (s) => {
+  const m = DUR_RE.exec(String(s).trim());
+  const n = parseInt(m[1], 10);
+  const u = m[2].toLowerCase();
+  return u === 'm' ? n * 60000 : u === 'h' ? n * 3600000 : n * 86400000;
+};
+function parseWhen(label, v, nowMs) {
+  const s = String(v).trim();
+  if (DUR_RE.test(s)) return new Date(nowMs - durMs(s));
+  const d = new Date(s);
+  if (Number.isNaN(d.getTime())) throw new Error(`Invalid ${label} "${v}": use an ISO timestamp (2026-10-20T00:00:00Z) or a relative duration like 2h.`);
+  return d;
+}
+export function resolveLogWindow(args = {}, nowMs = Date.now()) {
+  const given = (v) => v !== undefined && v !== null && String(v).trim() !== '';
+  const to = given(args.to) ? parseWhen('to', args.to, nowMs) : new Date(nowMs);
+  const lastMs = DUR_RE.test(String(args.last ?? '').trim()) ? durMs(args.last) : 2 * 3600000;
+  const from = given(args.from) ? parseWhen('from', args.from, nowMs) : new Date(to.getTime() - lastMs);
+  if (from.getTime() >= to.getTime()) throw new Error(`Invalid window: from (${from.toISOString()}) must be before to (${to.toISOString()}).`);
+  return { from, to };
+}
+
+// Query string for GET /superadmin/logs/search (same params as /internal/logs/search).
+export function buildRawLogQuery(args, from, to) {
+  const params = new URLSearchParams({ from: from.toISOString(), to: to.toISOString(), take: String(args.take ?? 50) });
+  if (args.q)             params.set('q',             args.q);
+  if (args.level)         params.set('level',         String(args.level).toUpperCase());
+  if (args.logger)        params.set('logger',        args.logger);
+  if (args.integration)   params.set('integration',   args.integration);
+  if (args.siteId)        params.set('siteId',        String(args.siteId));
+  if (args.source)        params.set('source',        args.source);
+  if (args.platform)      params.set('platform',      args.platform);
+  if (args.environment)   params.set('environment',   args.environment);
+  if (args.correlationId) params.set('correlationId', args.correlationId);
+  if (args.regex)         params.set('regex',         'true');
+  return params.toString();
+}

package/lib/log-search.test.js

@@ -321,7 +321,7 @@ test('fetchRetry429 retries only 429 and returns the final response after the re
 });
 
 test('bot_full_diagnostic: errors use the server-side level=ERROR filter, patterns are a separate read; neither is the old text regex', () => {
-  for (const rel of ['../../mcp/staff-server.js', '../../mcp/server.js']) {
+  for (const rel of ['../../mcp/staff-server.js']) { // bot_full_diagnostic is staff-only since MCP 2.0.0
     const src = fs.readFileSync(path.join(here, rel), 'utf8');
     const a = src.indexOf('const velaroLoggerP = safeJson');
     const body = src.slice(a, a + 2600);

package/lib/parity-util.js

@@ -0,0 +1,27 @@
+// Shared helpers for the MCP-parity command groups (diag-groups.js, ops-groups.js).
+export const show = (r) => console.log(typeof r === 'string' ? r : JSON.stringify(r, null, 2));
+export const qs = (o) => {
+  const p = new URLSearchParams();
+  for (const [k, v] of Object.entries(o)) if (v !== undefined && v !== null && v !== '') p.set(k, String(v));
+  const s = p.toString();
+  return s ? `?${s}` : '';
+};
+export const run = (fn) => async (argv) => {
+  try { await fn(argv); } catch (e) { console.error(`Error: ${e.message}`); process.exit(1); }
+};
+export const needYes = (argv, what) => {
+  if (!argv.yes) { console.error(`Refusing to ${what} without --yes.`); process.exit(1); }
+};
+// Build a yargs group body (spread into `{ command: 'name', ...group(...) }` so the parity validator sees the command name): subs = [[command, describe, builderFn|null, handler]]
+export function group(describe, subs) {
+  return {
+    describe,
+    builder: (y) => {
+      for (const [command, desc, b, handler] of subs) {
+        y.command({ command, describe: desc, builder: b || ((x) => x), handler: run(handler) });
+      }
+      return y.demandCommand(1, `Specify a subcommand: ${subs.map((s) => s[0].split(' ')[0]).join(' | ')}`);
+    },
+    handler: () => {},
+  };
+}

package/lib/sign-versions.test.js

@@ -42,7 +42,7 @@ import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join as pjoin } from 'node:path';
 const root = pjoin(dirname(fileURLToPath(import.meta.url)), '..', '..');
-for (const f of ['mcp/server.js', 'mcp/staff-server.js', 'server/Velaro.Admin/Controllers/StaffMcpController.cs']) {
+for (const f of ['mcp/staff-server.js', 'server/Velaro.Admin/Controllers/StaffMcpController.cs']) {
   test(`${f} registers sign_versions tools`, () => {
     const s = readFileSync(pjoin(root, f), 'utf8');
     for (const t of ['sign_versions_list', 'sign_versions_diff', 'sign_versions_upload']) assert.ok(s.includes(t), `${t} missing in ${f}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@velaro/cli",
-  "version": "1.4.106",
+  "version": "1.4.108",
   "description": "Velaro Workspace v20 — command-line interface for managing bots, knowledge base ingestion, MCP API keys, search indexes, and ops health.",
   "type": "module",
   "bin": {