callkaro-cli-unofficial 0.1.0 → 0.2.0

package/README.md

@@ -2,11 +2,12 @@
 
 An unofficial fork of the [CallKaro CLI](https://www.npmjs.com/package/@callkaro-official/cli). It installs as `cku`, so it sits alongside the official `ck` without either one overwriting the other.
 
-Manage voice agents, calls, phone numbers, batch campaigns, simulations and analytics from the terminal.
+Manage voice agents, calls, phone numbers, batch campaigns, simulations and analytics from the terminal — plus the dashboard side, which the official CLI doesn't reach at all.
 
 ```
 cku agents list
 cku calls make --agent <id> --to <number> --test
+cku kpi tasks --severity "Very High" --column action_items
 cku accounts use tejas@acme.com
 ```
 
@@ -14,12 +15,12 @@ cku accounts use tejas@acme.com
 
 ## Why this exists
 
-Three reasons, all of them things the official CLI can't do.
-
 **It doesn't fight the official CLI for a name.** Both packages write to the same global `node_modules/.bin`. If both were called `ck`, whichever npm install ran last would silently take over. You'd type `ck`, get official behaviour, and get no signal anything had changed. `cku` cannot collide.
 
 **It holds several accounts at once.** The official CLI keeps one session. This one keeps a file per account, and can pin an account to a folder, so two agents working in two directories can't switch each other out from under themselves.
 
+**It reaches the dashboard API.** The official CLI only talks to `/cli/*`. That leaves the KPI board, the call analyzers, and the server's own model catalogue unreachable from a terminal — [`cku kpi`](#only-in-cku) is the whole of that surface.
+
 **It fixes three upstream bugs.** Details and evidence in [`docs/BUG-REPORT.md`](docs/BUG-REPORT.md).
 
 ---
@@ -68,7 +69,7 @@ Every arrow above is a real import or a real call, checked against the source. `
   /cli/*  ·  61 endpoints  ·  Bearer ck_5b02…
 ```
 
-One thing worth knowing up front: the official CLI ships **compiled output only**. Its npm package has `dist/` and nothing else: no TypeScript, no tests, no build config, and it isn't in any public repo. So this is a reconstruction. The `/cli/*` contract was rebuilt from the published bundle, and the command surface matches v4.0.0 exactly (44 subcommands against the official 40; the four extras are the `accounts` group).
+One thing worth knowing up front: the official CLI ships **compiled output only**. Its npm package has `dist/` and nothing else: no TypeScript, no tests, no build config, and it isn't in any public repo. So this is a reconstruction. The `/cli/*` contract was rebuilt from the published bundle, and the command surface matches v4.0.1 (the official CLI's commands plus the `accounts` group and the dashboard-side `dashboard`, `kpi`, `analyzers` and `models` groups).
 
 The public API at `api.callkaro.ai` is a different thing entirely, with an `X-API-KEY` header and three documented endpoints. This CLI doesn't use it. [`docs/architecture.md`](docs/architecture.md) covers the boundaries, and [`docs/api.md`](docs/api.md) has the full endpoint inventory.
 
@@ -120,6 +121,69 @@ My own first port of this fix had a worse version of the same bug: I merged agai
 
 ---
 
+## Only in `cku`
+
+Commands and capabilities the official CLI does not have at all. Not bug fixes — surface area.
+
+### The KPI manager and the pending-task board
+
+The official `ck` has **no KPI commands whatsoever**. This is the only way to reach the board from a terminal.
+
+```bash
+cku kpi tasks --severity "Very High" --column action_items --since 7d
+cku kpi show "<taskId>"                 # cause, recommended fix, metric impact
+cku kpi create --cause "…" --fix "…" --severity High
+cku kpi move "<taskId>" in_progress
+cku kpi comment "<taskId>" "Fixed in v3"
+cku kpi assign "<taskId>" --to "Name"   # or --to ai_fde
+cku kpi target --agent <id> --value 25
+cku kpi rca --agent <id> --since 2026-09-01 --until 2026-09-30
+```
+
+There is **no delete** for a card — the board retires one by moving it to `rejected`, which is reversible. Only `description` is editable after creation; `cause`, fix and severity are fixed at create, so correcting one means creating a replacement.
+
+`GET /pending-tasks` returns every column including `done` and `rejected`, so a closed card is not a gone card. The list prints a **COLUMN** column for exactly that reason, and `--column` filters on it.
+
+### The dashboard credential
+
+```bash
+cku dashboard login     # separate from `cku login`; the token lasts 24h, renewed silently
+cku dashboard whoami
+cku dashboard probe     # which dashboard routes this token reaches
+```
+
+The dashboard API needs a *different* token from `/cli/*` — they're not interchangeable, and each rejects the other with an opaque 401. This also unlocks `cku analyzers` and `cku models`. The dashboard token expires every 24h with no refresh endpoint, so `cku dashboard login` saves your password (plain text, mode 0600, alongside the tokens) and re-logs in for you when it lapses. Pass `--no-save-password` to keep it off disk and re-enter it daily; `cku dashboard logout` deletes it.
+
+### Knowing which models are actually valid
+
+```bash
+cku models               # per slot, and which field each governs
+cku models --slot agent
+```
+
+Models are scoped per slot and **the slots disagree**: `agent` has 44, `post-call` has 9 and excludes `gpt-4o` and `o4-mini`. So the same value is valid in `model` and refused in `postcallmodel`. Works with or without a dashboard session, and says which source it read.
+
+### A catalogue that can't silently rot
+
+The provider tables, and now the model lists, are regenerated from the server rather than hand-copied:
+
+```bash
+npm run catalog:sync     # refresh from the bundle + the live server
+npm run catalog:check    # fail if catalog.json disagrees with the snapshot
+```
+
+`catalog:check` runs offline against a committed snapshot, so it works in CI with no credentials. On 1 October 2026 it caught shipped tables that listed withdrawn models *and* missed live ones in both directions. A wrong voice model otherwise persists silently and only surfaces as a broken call.
+
+### Smaller things
+
+- `cku calls logs` — grep/awk/sed over the raw call log, in-process, no subprocess and no shell
+- `cku accounts status` — reports which account is in effect **and where that choice came from**
+- Per-project binding, so parallel agents can't redirect each other
+- `secrets set` without the value on the command line
+- `--json` that stays unpaged for scripting, with human tables paged
+
+---
+
 ## Staying current
 
 A daily workflow checks npm for a newer `@callkaro-official/cli` and, when it finds one, regenerates the provider catalogue and opens a PR onto the `official` branch. It never merges anything itself.

package/dist/commands/accounts.js

@@ -34,6 +34,7 @@ async function loginCommand(opts) {
     }
     try {
         const { api } = (0, config_1.getClient)();
+        (0, ui_1.needTty)('Use `cku login` (browser sign-in) or set CK_TOKEN.');
         const answers = await (0, prompts_1.default)([
             { type: opts.email ? null : 'text', name: 'email', message: 'Email' },
             { type: 'password', name: 'password', message: 'Password' },
@@ -58,6 +59,7 @@ async function registerCommand(opts) {
             return;
         }
         const { api } = (0, config_1.getClient)();
+        (0, ui_1.needTty)('Registration is interactive (it sends a verification code); run it in a terminal.');
         const answers = await (0, prompts_1.default)([
             { type: opts.email ? null : 'text', name: 'email', message: 'Email' },
             { type: opts.name ? null : 'text', name: 'name', message: 'Your name' },
@@ -254,16 +256,8 @@ async function accountsRemoveCommand(emailOrSlug, opts) {
         accounts.find((a) => (0, config_1.slugFor)(a.email || '').startsWith(wanted));
     if (!match)
         return (0, ui_1.handleError)(new Error(`No saved account matches "${emailOrSlug}".`));
-    if (!opts.yes) {
-        const { ok } = await (0, prompts_1.default)({
-            type: 'confirm',
-            name: 'ok',
-            message: `Remove the saved login for ${match.email}?`,
-            initial: false,
-        });
-        if (!ok)
-            return void (0, ui_1.info)('Cancelled.');
-    }
+    if (!(await (0, ui_1.confirm)(`Remove the saved login for ${match.email}?`, opts.yes)))
+        return;
     const slug = (0, config_1.slugFor)(match.email || '');
     (0, config_1.removeAccount)(slug);
     (0, ui_1.success)(`Removed ${match.email}.`);

package/dist/commands/agentPhone.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.setInboundCommand = setInboundCommand;
+exports.setWhatsappOutboundCommand = setWhatsappOutboundCommand;
+exports.setWhatsappInboundCommand = setWhatsappInboundCommand;
 exports.setOutboundCommand = setOutboundCommand;
 const session_1 = require("../lib/session");
 const ui_1 = require("../lib/ui");
@@ -33,6 +35,42 @@ async function setInboundCommand(agentId, opts) {
         (0, ui_1.handleError)(err);
     }
 }
+/**
+ * `cku agents set-whatsapp-outbound <agentId> --number <id>` (or `--clear`)
+ *
+ * Reuses PUT /cli/agents/:id, like voice outbound. The id is the WhatsApp phone
+ * number id from `cku whatsapp list`, not the display number.
+ */
+async function setWhatsappOutboundCommand(agentId, opts) {
+    const api = (0, session_1.requireApi)();
+    if (!opts.clear && !opts.number)
+        return (0, ui_1.handleError)(new Error('--number <phoneNumberId> or --clear is required'));
+    try {
+        await api.updateAgent(agentId, undefined, { whatsappPhoneNumber: opts.clear ? null : opts.number });
+        (0, ui_1.success)(opts.clear ? `Cleared WhatsApp outbound number on agent ${agentId}.` : `Set WhatsApp outbound number on agent ${agentId}.`);
+    }
+    catch (err) {
+        (0, ui_1.handleError)(err);
+    }
+}
+/**
+ * `cku agents set-whatsapp-inbound <agentId> --number <id>` (or `--clear`)
+ *
+ * Own endpoint, and a single number rather than an array: the backend clears the
+ * number off any other agent holding it first (one inbound agent per number).
+ */
+async function setWhatsappInboundCommand(agentId, opts) {
+    const api = (0, session_1.requireApi)();
+    if (!opts.clear && !opts.number)
+        return (0, ui_1.handleError)(new Error('--number <phoneNumberId> or --clear is required'));
+    try {
+        await api.setWhatsappInbound(agentId, opts.clear ? null : opts.number);
+        (0, ui_1.success)(opts.clear ? `Cleared WhatsApp inbound number on agent ${agentId}.` : `Set WhatsApp inbound number on agent ${agentId}.`);
+    }
+    catch (err) {
+        (0, ui_1.handleError)(err);
+    }
+}
 /** `cku agents set-outbound <agentId> --number <id>` (or `--clear`) */
 async function setOutboundCommand(agentId, opts) {
     const api = (0, session_1.requireApi)();

package/dist/commands/agents.js

@@ -234,6 +234,7 @@ async function agentsExportCommand(agentId, opts) {
             const versions = res.versions || [];
             if (!versions.length)
                 return (0, ui_1.handleError)(new Error('This agent has no versions'));
+            (0, ui_1.needTty)('Pass --versions <ids> to choose which versions to export.');
             const picked = await (0, prompts_1.default)({
                 type: 'multiselect',
                 name: 'ids',

package/dist/commands/calls.js

@@ -39,11 +39,14 @@ async function callsListCommand(opts) {
         const res = await api.listCalls({
             ...buildCallQuery(opts),
             pageSize: (0, ui_1.intFlag)(opts.limit, '--limit', 50),
-            page: 1,
+            page: (0, ui_1.intFlag)(opts.page, '--page', 1),
         });
         const calls = res.calls || [];
-        if (opts.json)
-            return void console.log(JSON.stringify(calls, null, 2));
+        // --json stays a bare array so existing parsers keep working; --meta is the
+        // opt-in that also exposes pagination (totalDocs, next page) for scripts.
+        if (opts.json) {
+            return void console.log(JSON.stringify(opts.meta ? { calls, pagination: res.pagination ?? null } : calls, null, 2));
+        }
         if (!calls.length)
             return void (0, ui_1.info)('No calls found.');
         (0, ui_1.table)(['TYPE', 'FROM', 'TO', 'AGENT', 'VERSION', 'DURATION', 'HANGUP', 'TIME'], calls.map((c) => [

package/dist/commands/dashboardApiCmd.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dashboardApiCommand = dashboardApiCommand;
+const dashboardApi_1 = require("../lib/dashboardApi");
+const ui_1 = require("../lib/ui");
+const jsonInput_1 = require("./jsonInput");
+const METHODS = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'];
+/**
+ * `cku dashboard api <METHOD> <path> [--body <json|@file>] [--query k=v ...]`
+ *
+ * The escape hatch for a dashboard route the CLI has no command for yet. It goes
+ * through `dashboardApi().request`, so the session cookie stays inside the CLI
+ * (a script otherwise has to read it out of the account file) and the path rules
+ * there apply: it must start with "/", redirects are refused, and the host is
+ * always the configured backend. Prints the response body as JSON. On a non-2xx
+ * it prints the status and the whole error body to stderr and exits 1; it never
+ * prints a header, so a token cannot leak through it.
+ */
+async function dashboardApiCommand(method, path, opts) {
+    try {
+        const verb = method.toUpperCase();
+        if (!METHODS.includes(verb))
+            throw new Error(`Method must be one of ${METHODS.join(', ')} (got "${method}").`);
+        let target = path;
+        if (opts.query?.length) {
+            const params = new URLSearchParams();
+            for (const kv of opts.query) {
+                const i = kv.indexOf('=');
+                if (i < 1)
+                    throw new Error(`--query expects key=value (got "${kv}").`);
+                params.append(kv.slice(0, i), kv.slice(i + 1));
+            }
+            target += (path.includes('?') ? '&' : '?') + params.toString();
+        }
+        const body = opts.body ? await (0, jsonInput_1.readJsonFlag)(opts.body, '--body') : undefined;
+        const res = await (0, dashboardApi_1.dashboardApi)().request(verb, target, body);
+        console.log(JSON.stringify(res ?? null, null, 2));
+    }
+    catch (err) {
+        if (err instanceof dashboardApi_1.DashboardError) {
+            console.error(`HTTP ${err.status}`);
+            console.error(JSON.stringify(err.data ?? { message: err.message }, null, 2));
+            process.exitCode = 1;
+            return;
+        }
+        (0, ui_1.handleError)(err);
+    }
+}

package/dist/commands/jsonInput.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.jsonHelpTip = jsonHelpTip;
 exports.resolveJsonInput = resolveJsonInput;
 exports.parseJsonInput = parseJsonInput;
+exports.readJsonFlag = readJsonFlag;
 const fs_1 = require("fs");
 const looseJson_1 = require("../lib/looseJson");
 async function readStdin() {
@@ -54,3 +55,18 @@ async function resolveJsonInput(arg, file) {
 function parseJsonInput({ raw, fromShell }) {
     return fromShell ? (0, looseJson_1.parseLooseJson)(raw) : JSON.parse(raw);
 }
+/**
+ * Read one JSON-valued flag (`--variables`, `--body`) given inline or as `@file`.
+ * Errors name the flag, so the message says which input was bad.
+ */
+async function readJsonFlag(raw, flag) {
+    if (!raw.trim())
+        throw new Error(`${flag} needs JSON or @file.json.`);
+    const input = await resolveJsonInput(raw);
+    try {
+        return parseJsonInput(input);
+    }
+    catch (err) {
+        throw new Error(`${flag} is not valid JSON: ${err.message}${jsonHelpTip(input.raw, input.fromShell)}`);
+    }
+}

package/dist/commands/kpi.js

@@ -596,9 +596,14 @@ async function kpiTargetCommand(opts) {
         try {
             current = (await api.kpiAgentConfig(agentId)) || {};
         }
-        catch {
-            // No config yet is a normal state, not a failure: the PUT creates it.
-            current = {};
+        catch (err) {
+            // 404 is the only "no config yet" case, and it is a normal state — the PUT
+            // creates it. Anything else (401, 500, a network drop) is a real failure,
+            // and treating it as "no config" would send a PUT that clears the RCA
+            // prompt this read was supposed to preserve. That is silent data loss, so
+            // it has to stop here.
+            if (!(0, dashboardApi_1.isNotFound)(err))
+                throw err;
         }
         const metricName = 'connected_to_conversion_percentage';
         const body = {

package/dist/commands/numbers.js

@@ -1,7 +1,4 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.numbersListCommand = numbersListCommand;
 exports.numbersCatalogCommand = numbersCatalogCommand;
@@ -9,7 +6,6 @@ exports.numbersBuyCommand = numbersBuyCommand;
 exports.numbersSpamCommand = numbersSpamCommand;
 exports.numbersUnspamCommand = numbersUnspamCommand;
 exports.numbersReleaseCommand = numbersReleaseCommand;
-const prompts_1 = __importDefault(require("prompts"));
 const session_1 = require("../lib/session");
 const ui_1 = require("../lib/ui");
 function fmtDate(v) {
@@ -92,16 +88,8 @@ async function numbersBuyCommand(numberOrId, opts) {
         if (!number) {
             return (0, ui_1.handleError)(new Error('That number is not in the buyable pool (already taken or invalid id).'));
         }
-        if (!opts.yes) {
-            const { ok } = await (0, prompts_1.default)({
-                type: 'confirm',
-                name: 'ok',
-                message: `Buy +${number.phoneNumber} for ₹${pricepernumber}? This deducts credits.`,
-                initial: false,
-            });
-            if (!ok)
-                return void (0, ui_1.info)('Cancelled.');
-        }
+        if (!(await (0, ui_1.confirm)(`Buy +${number.phoneNumber} for ₹${pricepernumber}? This deducts credits.`, opts.yes)))
+            return;
         const res = await api.buyNumber(numberId, pricepernumber);
         return void (0, ui_1.success)(res.message || `Bought +${number.phoneNumber}.`);
     }
@@ -135,16 +123,8 @@ async function numbersReleaseCommand(numberOrId, opts) {
     const api = (0, session_1.requireApi)();
     try {
         const numberId = await resolveNumberId(api, numberOrId);
-        if (!opts.yes) {
-            const { ok } = await (0, prompts_1.default)({
-                type: 'confirm',
-                name: 'ok',
-                message: 'Release (unrent) this number? It will be unassigned from all agents.',
-                initial: false,
-            });
-            if (!ok)
-                return void (0, ui_1.info)('Cancelled.');
-        }
+        if (!(await (0, ui_1.confirm)('Release (unrent) this number? It will be unassigned from all agents.', opts.yes)))
+            return;
         const res = await api.releaseNumber(numberId);
         (0, ui_1.success)(res.message || 'Released.');
     }

package/dist/commands/secrets.js

@@ -35,6 +35,7 @@ async function readSecretValue(name, fromStdin) {
             throw new Error('--stdin requires piped or redirected input');
         return (await readStdin()).trim();
     }
+    (0, ui_1.needTty)('Pass --stdin and pipe the value in.');
     const answer = await (0, prompts_1.default)({ type: 'password', name: 'value', message: `Value for ${name}` });
     return typeof answer.value === 'string' ? answer.value.trim() : undefined;
 }
@@ -84,16 +85,8 @@ async function secretsRemoveCommand(inputName, opts) {
         const list = secrets || [];
         if (!list.some((secret) => secret.name === name))
             throw new Error(`Secret "${name}" not found`);
-        if (!opts.yes) {
-            const answer = await (0, prompts_1.default)({
-                type: 'confirm',
-                name: 'ok',
-                message: `Remove secret "${name}"?`,
-                initial: false,
-            });
-            if (!answer.ok)
-                return void (0, ui_1.info)('Cancelled.');
-        }
+        if (!(await (0, ui_1.confirm)(`Remove secret "${name}"?`, opts.yes)))
+            return;
         await api.saveSecrets(list.filter((secret) => secret.name !== name).map(preserve));
         (0, ui_1.success)(`Secret "${name}" removed.`);
     }

package/dist/commands/simVariables.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.simVarsListCommand = simVarsListCommand;
+exports.simVarsShowCommand = simVarsShowCommand;
+exports.simVarsCreateCommand = simVarsCreateCommand;
+exports.simVarsDeleteCommand = simVarsDeleteCommand;
+const dashboardApi_1 = require("../lib/dashboardApi");
+const ui_1 = require("../lib/ui");
+const jsonInput_1 = require("./jsonInput");
+const simulations_1 = require("./simulations");
+/**
+ * Saved variable sets: named bundles of `testVariables` the dashboard's "Import
+ * Variables" button loads into a test case. Dashboard-only (cookie-authed), so
+ * these commands need `cku dashboard login`; `cku sim create --variables` needs
+ * no session and takes the same JSON.
+ */
+async function simVarsListCommand(agentId, opts) {
+    try {
+        const res = await (0, dashboardApi_1.dashboardApi)().testVariableSets(agentId);
+        const sets = res?.data || [];
+        if (opts.json)
+            return void console.log(JSON.stringify(sets, null, 2));
+        if (!sets.length)
+            return void (0, ui_1.info)('No saved variable sets for this agent.');
+        (0, ui_1.table)(['NAME', 'ID', 'VARIABLES', 'CREATED'], sets.map((s) => [
+            s.name,
+            s._id,
+            Object.keys(s.callMetadata || {}).length,
+            s.createdAt ? new Date(s.createdAt).toLocaleString('en-US') : '',
+        ]));
+    }
+    catch (err) {
+        (0, ui_1.handleError)(err);
+    }
+}
+async function simVarsShowCommand(agentId, nameOrId, opts) {
+    try {
+        const set = await findSet(agentId, nameOrId);
+        if (opts.json)
+            return void console.log(JSON.stringify(set.callMetadata || {}, null, 2));
+        (0, ui_1.table)(['VARIABLE', 'VALUE'], Object.entries(set.callMetadata || {}).map(([k, v]) => [k, String(v)]));
+    }
+    catch (err) {
+        (0, ui_1.handleError)(err);
+    }
+}
+async function simVarsCreateCommand(agentId, name, opts) {
+    try {
+        if (!opts.variables) {
+            return (0, ui_1.handleError)(new Error('--variables <json|@file.json> is required, e.g. --variables @lead.json'));
+        }
+        const callMetadata = (0, simulations_1.toTestVariables)(await (0, jsonInput_1.readJsonFlag)(opts.variables, '--variables'));
+        const res = await (0, dashboardApi_1.dashboardApi)().createTestVariableSet({ agentId, name, callMetadata });
+        (0, ui_1.success)(`Saved variable set "${name}" (${res?.data?._id || ''}) with ${Object.keys(callMetadata).length} variables.`);
+    }
+    catch (err) {
+        (0, ui_1.handleError)(err);
+    }
+}
+async function simVarsDeleteCommand(agentId, nameOrId, opts) {
+    try {
+        const set = await findSet(agentId, nameOrId);
+        if (!(await (0, ui_1.confirm)(`Delete saved variable set "${set.name}"?`, opts.yes)))
+            return;
+        await (0, dashboardApi_1.dashboardApi)().deleteTestVariableSet(set._id);
+        (0, ui_1.success)(`Deleted "${set.name}".`);
+    }
+    catch (err) {
+        (0, ui_1.handleError)(err);
+    }
+}
+/** Match by exact id, then by exact name; an ambiguous name is an error, not a guess. */
+async function findSet(agentId, nameOrId) {
+    const res = await (0, dashboardApi_1.dashboardApi)().testVariableSets(agentId);
+    const sets = res?.data || [];
+    const byId = sets.find((s) => s._id === nameOrId);
+    if (byId)
+        return byId;
+    const byName = sets.filter((s) => s.name === nameOrId);
+    if (byName.length === 1)
+        return byName[0];
+    if (byName.length > 1) {
+        throw new Error(`${byName.length} saved sets are named "${nameOrId}". Use an id: ${byName.map((s) => s._id).join(', ')}`);
+    }
+    throw new Error(`No saved variable set "${nameOrId}" for this agent. List them: cku sim variables list ${agentId}`);
+}

package/dist/commands/simulations.js

@@ -3,15 +3,47 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.sleep = void 0;
+exports.toTestVariables = toTestVariables;
+exports.toTestFunctions = toTestFunctions;
 exports.simTestsListCommand = simTestsListCommand;
 exports.simCreateCommand = simCreateCommand;
 exports.simDeleteCommand = simDeleteCommand;
+exports.waitForBatch = waitForBatch;
 exports.simRunCommand = simRunCommand;
 exports.simRunsListCommand = simRunsListCommand;
 exports.simResultsCommand = simResultsCommand;
 const prompts_1 = __importDefault(require("prompts"));
 const session_1 = require("../lib/session");
 const ui_1 = require("../lib/ui");
+const jsonInput_1 = require("./jsonInput");
+/**
+ * `testVariables` is a flat name -> string map on the backend (ids, "True", and
+ * JSON-encoded arrays are all strings). Accept natural JSON and stringify what is
+ * not already a string, so `{"lead_id": 900029, "pointers": ["a"]}` works.
+ */
+function toTestVariables(input) {
+    if (!input || typeof input !== 'object' || Array.isArray(input)) {
+        throw new Error('--variables must be a JSON object of name -> value, e.g. {"lead_id":"900029"}.');
+    }
+    const out = {};
+    for (const [k, v] of Object.entries(input)) {
+        out[k] = typeof v === 'string' ? v : v === null || v === undefined ? '' : typeof v === 'object' ? JSON.stringify(v) : String(v);
+    }
+    return out;
+}
+/** `testFunctions` is a list of `{name, response}` mocks; `response` is an object or a string. */
+function toTestFunctions(input) {
+    if (!Array.isArray(input)) {
+        throw new Error('--functions must be a JSON array of {"name": ..., "response": ...} mocks.');
+    }
+    return input.map((f, i) => {
+        if (!f || typeof f !== 'object' || typeof f.name !== 'string' || !f.name || !('response' in f)) {
+            throw new Error(`--functions[${i}] needs a "name" (string) and a "response" (object or string).`);
+        }
+        return { name: f.name, response: f.response };
+    });
+}
 async function simTestsListCommand(agentId, opts) {
     const api = (0, session_1.requireApi)();
     try {
@@ -30,8 +62,12 @@ async function simTestsListCommand(agentId, opts) {
 async function simCreateCommand(agentId, opts) {
     const api = (0, session_1.requireApi)();
     try {
+        // Parse the JSON flags before prompting, so a typo fails before any typing.
+        const testVariables = opts.variables ? toTestVariables(await (0, jsonInput_1.readJsonFlag)(opts.variables, '--variables')) : {};
+        const testFunctions = opts.functions ? toTestFunctions(await (0, jsonInput_1.readJsonFlag)(opts.functions, '--functions')) : [];
         let { name, prompt, criteria } = opts;
         if (!name || !prompt || !criteria) {
+            (0, ui_1.needTty)('Pass --name, --prompt and --criteria.');
             const answers = await (0, prompts_1.default)([
                 { type: name ? null : 'text', name: 'name', message: 'Test case name' },
                 { type: prompt ? null : 'text', name: 'prompt', message: 'Simulated user prompt' },
@@ -50,8 +86,8 @@ async function simCreateCommand(agentId, opts) {
             userPrompt: prompt,
             successCriteria: criteria,
             testLLMModel: opts.model || 'gpt-4.1-mini',
-            testVariables: {},
-            testFunctions: [],
+            testVariables,
+            testFunctions,
         });
         (0, ui_1.success)(`Created test case ${res.testCase?._id || ''}.`);
     }
@@ -62,13 +98,8 @@ async function simCreateCommand(agentId, opts) {
 async function simDeleteCommand(testCaseId, opts) {
     const api = (0, session_1.requireApi)();
     try {
-        if (!opts.yes) {
-            const { ok } = await (0, prompts_1.default)({
-                type: 'confirm', name: 'ok', message: `Delete test case ${testCaseId}?`, initial: false,
-            });
-            if (!ok)
-                return void (0, ui_1.info)('Cancelled.');
-        }
+        if (!(await (0, ui_1.confirm)(`Delete test case ${testCaseId}?`, opts.yes)))
+            return;
         const res = await api.deleteTestCase(testCaseId);
         (0, ui_1.success)(res.msg || 'Deleted.');
     }
@@ -76,6 +107,48 @@ async function simDeleteCommand(testCaseId, opts) {
         (0, ui_1.handleError)(err);
     }
 }
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+exports.sleep = sleep;
+/**
+ * Poll a batch until it has produced every row it will produce.
+ *
+ * The backend has no "finished" flag. A batch carries `totalRuns` and the
+ * dashboard counts rows in the results list against it, so that is the done
+ * signal here too. Progress goes to stderr, so `--json` output stays parseable.
+ * Returns the last rows seen and whether the batch completed before the timeout.
+ */
+async function waitForBatch(api, batchId, agentId, opts) {
+    const timeoutMs = (0, ui_1.intFlag)(opts.timeout, '--timeout', 600) * 1000;
+    const every = opts.intervalMs ?? 5000;
+    const deadline = Date.now() + timeoutMs;
+    let rows = [];
+    let total;
+    for (;;) {
+        const res = await api.simulationResults(batchId);
+        rows = res.simulations || res.results || res.data || [];
+        if (total === undefined && agentId) {
+            const runs = (await api.listSimulationRuns(agentId)).batches || [];
+            total = runs.find((b) => b._id === batchId)?.totalRuns;
+        }
+        console.error(`  ${rows.length}${total ? `/${total}` : ''} results`);
+        if (total && rows.length >= total)
+            return { rows, done: true, total };
+        if (Date.now() + every > deadline)
+            return { rows, done: false, total };
+        await (0, exports.sleep)(every);
+    }
+}
+function resultTable(rows) {
+    (0, ui_1.table)(['TEST CASE', 'VERSION', 'RESULT', 'TURNS', 'SUMMARY'], rows.map((r) => [
+        r.testcaseId?.testcaseName || r.testcaseName || r.testcaseId || '',
+        r.versionId?.versionName || r.versionId || '',
+        r.isTestSucceed === undefined ? '' : r.isTestSucceed ? 'PASS' : 'FAIL',
+        r.total_turns ?? '',
+        String(r.testResultSummary || '').replace(/\s+/g, ' ').slice(0, 70),
+    ]));
+    const passed = rows.filter((r) => r.isTestSucceed).length;
+    (0, ui_1.info)(`\n${passed}/${rows.length} passed.`);
+}
 async function simRunCommand(agentId, opts) {
     const api = (0, session_1.requireApi)();
     const testIds = (opts.tests || '').split(',').map((s) => s.trim()).filter(Boolean);
@@ -85,13 +158,31 @@ async function simRunCommand(agentId, opts) {
     if (!versionIds.length)
         return (0, ui_1.handleError)(new Error('--versions <versionIds> is required'));
     try {
+        const epoch = (0, ui_1.intFlag)(opts.epoch, '--epoch', 1);
+        (0, ui_1.intFlag)(opts.timeout, '--timeout', 600); // reject a bad value before starting a run
         const res = await api.runSimulation({
             agentId, testIds, versionIds,
             batchName: opts.name || `cli-run-${Date.now()}`,
-            epoch: 1,
+            epoch,
         });
-        (0, ui_1.success)(`Simulation run started (${res.batch?._id || ''}). Results arrive asynchronously.`);
-        (0, ui_1.info)(`Check with: cku sim results ${res.batch?._id || '<batchId>'}`);
+        const batchId = res.batch?._id || '';
+        if (!opts.wait) {
+            (0, ui_1.success)(`Simulation run started (${batchId}). Results arrive asynchronously.`);
+            return void (0, ui_1.info)(`Check with: cku sim results ${batchId || '<batchId>'}   (or re-run with --wait)`);
+        }
+        if (!batchId)
+            return (0, ui_1.handleError)(new Error('The backend did not return a batch id, so there is nothing to wait on.'));
+        console.error(`Run started (${batchId}); waiting for ${testIds.length * versionIds.length * epoch} results …`);
+        const { rows, done, total } = await waitForBatch(api, batchId, agentId, opts);
+        if (opts.json)
+            console.log(JSON.stringify(rows, null, 2));
+        else
+            resultTable(rows);
+        if (!done) {
+            return (0, ui_1.handleError)(new Error(`Timed out with ${rows.length}${total ? `/${total}` : ''} results. The run is still going: cku sim results ${batchId} --wait`));
+        }
+        if (rows.some((r) => !r.isTestSucceed))
+            process.exitCode = 1;
     }
     catch (err) {
         (0, ui_1.handleError)(err);
@@ -101,15 +192,16 @@ async function simRunsListCommand(agentId, opts) {
     const api = (0, session_1.requireApi)();
     try {
         const res = await api.listSimulationRuns(agentId);
-        const rows = res.runs || res.data || [];
+        const rows = res.batches || res.runs || res.data || [];
         if (opts.json)
             return void console.log(JSON.stringify(rows, null, 2));
         if (!rows.length)
             return void (0, ui_1.info)('No simulation runs yet.');
-        (0, ui_1.table)(['NAME', 'BATCH ID', 'STATUS', 'CREATED'], rows.map((r) => [
+        (0, ui_1.table)(['NAME', 'BATCH ID', 'RUNS', 'EPOCH', 'CREATED'], rows.map((r) => [
             r.batchName || r.name || '',
-            r.batch?._id || r._id || '',
-            r.status || '',
+            r._id || r.batch?._id || '',
+            r.totalRuns ?? '',
+            r.epoch ?? '',
             r.createdAt ? new Date(r.createdAt).toLocaleString('en-US') : '',
         ]));
     }
@@ -120,18 +212,24 @@ async function simRunsListCommand(agentId, opts) {
 async function simResultsCommand(batchId, opts) {
     const api = (0, session_1.requireApi)();
     try {
-        const res = await api.simulationResults(batchId);
-        const rows = res.results || res.data || [];
+        let rows;
+        if (opts.wait) {
+            if (!opts.agent)
+                return (0, ui_1.handleError)(new Error('--wait needs --agent <agentId> to know how many results to expect.'));
+            const out = await waitForBatch(api, batchId, opts.agent, opts);
+            rows = out.rows;
+            if (!out.done)
+                process.exitCode = 1;
+        }
+        else {
+            const res = await api.simulationResults(batchId);
+            rows = res.simulations || res.results || res.data || [];
+        }
         if (opts.json)
             return void console.log(JSON.stringify(rows, null, 2));
         if (!rows.length)
-            return void (0, ui_1.info)('No results yet — runs are asynchronous.');
-        (0, ui_1.table)(['TEST CASE', 'VERSION', 'PASSED', 'SCORE'], rows.map((r) => [
-            r.testcaseName || r.testCaseId || '',
-            r.versionId?.versionName || r.versionId || '',
-            r.passed === undefined ? '' : r.passed ? 'yes' : 'no',
-            r.score ?? '',
-        ]));
+            return void (0, ui_1.info)('No results yet — runs are asynchronous. Use --wait --agent <agentId> to wait.');
+        resultTable(rows);
     }
     catch (err) {
         (0, ui_1.handleError)(err);

package/dist/commands/whatsapp.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.whatsappListCommand = whatsappListCommand;
+const session_1 = require("../lib/session");
+const ui_1 = require("../lib/ui");
+/**
+ * `cku whatsapp list`
+ *
+ * Numbers come from Meta (the linked WhatsApp Business Account), not a platform
+ * pool, so there is no catalog/buy/register here. Adding one is Meta's embedded
+ * signup (Facebook login) behind the dashboard's "+ Add Phone Number" button, an
+ * interactive OAuth flow the CLI cannot drive.
+ */
+async function whatsappListCommand(opts) {
+    const api = (0, session_1.requireApi)();
+    try {
+        const { phoneNumbers } = await api.listWhatsappNumbers();
+        const list = phoneNumbers || [];
+        if (opts.json)
+            return void console.log(JSON.stringify(list, null, 2));
+        if (!list.length) {
+            return void console.log('No WhatsApp numbers linked yet — add one on the dashboard first ("+ Add Phone Number").');
+        }
+        (0, ui_1.table)(['NUMBER', 'ID', 'VERIFIED NAME', 'STATUS', 'QUALITY'], list.map((n) => [
+            n.display_phone_number,
+            n.id,
+            n.verified_name || '',
+            n.code_verification_status || '',
+            n.quality_rating || '',
+        ]));
+    }
+    catch (err) {
+        (0, ui_1.handleError)(err);
+    }
+}

package/dist/index.js

@@ -17,6 +17,7 @@ const models_1 = require("./commands/models");
 const agents_1 = require("./commands/agents");
 const agentVersions_1 = require("./commands/agentVersions");
 const agentPhone_1 = require("./commands/agentPhone");
+const whatsapp_1 = require("./commands/whatsapp");
 const numbers_1 = require("./commands/numbers");
 const calls_1 = require("./commands/calls");
 const ongoing_1 = require("./commands/ongoing");
@@ -28,6 +29,8 @@ const update_1 = require("./commands/update");
 const analytics_1 = require("./commands/analytics");
 const batches_1 = require("./commands/batches");
 const simulations_1 = require("./commands/simulations");
+const simVariables_1 = require("./commands/simVariables");
+const dashboardApiCmd_1 = require("./commands/dashboardApiCmd");
 const auditStrategies_1 = require("./commands/auditStrategies");
 const chatAgents_1 = require("./commands/chatAgents");
 // The command this fork installs as. Deliberately NOT `ck` or `callkaro`:
@@ -78,6 +81,7 @@ dashboard
     .command('login')
     .description('sign in with email + password, exactly as the login form does')
     .option('--email <email>', 'skip the email prompt')
+    .option('--no-save-password', "don't keep the password (the session then lapses after 24h)")
     .action(dashboardAuth_1.dashboardLoginCommand);
 dashboard
     .command('whoami')
@@ -93,6 +97,13 @@ dashboard
     .description('forget the dashboard session (the ck_ token is kept)')
     .option('--yes', 'skip the confirmation')
     .action(dashboardAuth_1.dashboardLogoutCommand);
+dashboard
+    .command('api <method> <path>')
+    .description('call any dashboard route with the stored session (the token never leaves the CLI)')
+    .option('--body <json|@file>', 'JSON request body')
+    .option('--query <k=v...>', 'query parameter, repeatable', (v, prev = []) => [...prev, v])
+    .addHelpText('after', '\n  Example: cku dashboard api GET /v1/test-simulations --query agentId=<id>\n  Errors print the status and full body to stderr and exit 1.')
+    .action(dashboardApiCmd_1.dashboardApiCommand);
 // Which models the server accepts. Same source the validator uses, so it cannot drift.
 program
     .command('models')
@@ -325,6 +336,14 @@ agents.command('set-outbound <agentId>').description("set/clear an agent's outbo
     .option('--number <id>', 'phone number id')
     .option('--clear', 'clear the outbound number')
     .action(agentPhone_1.setOutboundCommand);
+agents.command('set-whatsapp-inbound <agentId>').description("set/clear an agent's WhatsApp inbound number")
+    .option('--number <id>', 'WhatsApp phone number id (see `cku whatsapp list`)')
+    .option('--clear', 'clear the inbound number')
+    .action(agentPhone_1.setWhatsappInboundCommand);
+agents.command('set-whatsapp-outbound <agentId>').description("set/clear an agent's WhatsApp outbound number")
+    .option('--number <id>', 'WhatsApp phone number id (see `cku whatsapp list`)')
+    .option('--clear', 'clear the outbound number')
+    .action(agentPhone_1.setWhatsappOutboundCommand);
 // Version management: clone, publish, activate, A/B testing
 agents.command('clone-version <agentId>').description('clone a version with a required target prompt mode and language')
     .option('--versions <id>', 'source version id')
@@ -419,6 +438,13 @@ addSkillsProviderOptions(skills.command('dir'))
     .description('print the selected install location(s)')
     .option('--project', 'print project location(s)')
     .action(skills_1.skillsDirCommand);
+// --- whatsapp --------------------------------------------------------------
+// Numbers come from your linked Meta WhatsApp Business Account, not a platform
+// pool: add one on the dashboard ("+ Add Phone Number", a Facebook-login flow the
+// CLI cannot run), then list/assign it here. No catalog/buy/register.
+const whatsapp = program.command('whatsapp').description('manage WhatsApp numbers (from your linked Meta WhatsApp Business Account)');
+whatsapp.command('list').description('list WhatsApp numbers on your linked WhatsApp Business Account')
+    .option('--json', 'raw JSON').action(whatsapp_1.whatsappListCommand);
 // --- numbers ---------------------------------------------------------------
 const numbers = program.command('numbers').description('manage phone numbers');
 numbers.command('list').description('list your phone numbers').option('--json', 'raw JSON').action(numbers_1.numbersListCommand);
@@ -506,7 +532,9 @@ calls.command('make').description('place a single outbound call (real, or --test
     .action(calls_1.callsMakeCommand);
 addCallFilters(calls.command('list').description('list call history'))
     .option('--limit <n>', 'page size (default 50)')
-    .option('--json', 'raw JSON')
+    .option('--page <n>', 'page number (default 1)')
+    .option('--json', 'raw JSON (a bare array of calls)')
+    .option('--meta', 'with --json, wrap as {calls, pagination} so scripts can see totalDocs')
     .action(calls_1.callsListCommand);
 calls.command('get <callId>').description('show one call (with recording URL)')
     .option('--json', 'raw JSON')
@@ -601,6 +629,8 @@ sim.command('create <agentId>').description('create a test case')
     .option('--prompt <text>', 'simulated user prompt')
     .option('--criteria <text>', 'success criteria')
     .option('--model <model>', 'test LLM model')
+    .option('--variables <json|@file>', 'testVariables: a JSON object of name -> value (non-strings are stringified)')
+    .option('--functions <json|@file>', 'function mocks: a JSON array of {"name": ..., "response": ...}')
     .action(simulations_1.simCreateCommand);
 sim.command('delete <testCaseId>').description('delete a test case').option('--yes', 'skip confirmation')
     .action(simulations_1.simDeleteCommand);
@@ -608,10 +638,28 @@ sim.command('run <agentId>').description('run a batch simulation (async)')
     .option('--tests <ids>', 'comma-separated test case ids')
     .option('--versions <ids>', 'comma-separated version ids')
     .option('--name <name>', 'run name')
+    .option('--epoch <n>', 'times to run each test case (default 1)')
+    .option('--wait', 'block until every result is in; exit 1 if any test fails')
+    .option('--timeout <seconds>', 'with --wait, give up after this long (default 600)')
+    .option('--json', 'with --wait, print the results as a bare JSON array')
     .action(simulations_1.simRunCommand);
 sim.command('runs <agentId>').description('list simulation runs').option('--json', 'raw JSON').action(simulations_1.simRunsListCommand);
 sim.command('results <batchId>').description('results of a simulation run').option('--json', 'raw JSON')
+    .option('--wait', 'block until the batch has all its results (needs --agent)')
+    .option('--agent <agentId>', 'with --wait, the agent the batch belongs to')
+    .option('--timeout <seconds>', 'with --wait, give up after this long (default 600)')
     .action(simulations_1.simResultsCommand);
+// Saved variable sets are dashboard-only (cookie-authed): they need `cku dashboard login`.
+const simVars = sim.command('variables').description('saved variable sets for test cases (needs `cku dashboard login`)');
+simVars.command('list <agentId>').description('list saved variable sets').option('--json', 'raw JSON')
+    .action(simVariables_1.simVarsListCommand);
+simVars.command('show <agentId> <nameOrId>').description('show one saved set').option('--json', 'bare variables object')
+    .action(simVariables_1.simVarsShowCommand);
+simVars.command('create <agentId> <name>').description('save a variable set')
+    .option('--variables <json|@file>', 'a JSON object of name -> value')
+    .action(simVariables_1.simVarsCreateCommand);
+simVars.command('delete <agentId> <nameOrId>').description('delete a saved set').option('--yes', 'skip confirmation')
+    .action(simVariables_1.simVarsDeleteCommand);
 // --- audit strategies ------------------------------------------------------
 const audit = program.command('audit-strategies').alias('audit').description('AI Auditor audit strategies');
 audit.command('list <agentId>').description('list audit strategies for an agent').option('--json', 'raw JSON')

package/dist/lib/api.js

@@ -144,6 +144,14 @@ class Api {
     publishChatAgentVersion(agentId, versionId) {
         return this.request('POST', `/cli/chat-agents/${agentId}/publish`, { versionId });
     }
+    // --- whatsapp numbers -----------------------------------------------------
+    // Numbers come from Meta (the linked WhatsApp Business Account), not a
+    // platform pool, so there is no buy/catalog counterpart to /cli/numbers.
+    listWhatsappNumbers() { return this.request('GET', '/cli/whatsapp'); }
+    /** Pass null to clear. The backend first unassigns the number from any other agent. */
+    setWhatsappInbound(agentId, whatsappInboundPhoneNumber) {
+        return this.request('POST', '/cli/agents/whatsapp-inbound', { agentId, whatsappInboundPhoneNumber });
+    }
     // --- phone numbers --------------------------------------------------------
     listNumbers() { return this.request('GET', '/cli/numbers'); }
     numbersCatalog() { return this.request('GET', '/cli/numbers/catalog'); }

package/dist/lib/config.js

@@ -249,9 +249,8 @@ function saveAccount(email, session) {
 function saveDashboardSession(email, dashboard) {
     const slug = slugFor(email);
     const current = loadAccount(slug);
-    // Built field by field rather than spread. A caller that accidentally passes a
-    // password (or anything else) must not have it written to disk — the guarantee
-    // that no password is ever persisted has to hold here, not at the call site.
+    // Built field by field rather than spread, so stray fields a caller passes are
+    // not written to disk. `password` is the one deliberate exception.
     const stored = {
         email: dashboard.email || email,
         token: dashboard.token,
@@ -259,6 +258,7 @@ function saveDashboardSession(email, dashboard) {
         ...(dashboard.sessionToken ? { sessionToken: dashboard.sessionToken } : {}),
         ...(dashboard.userId ? { userId: dashboard.userId } : {}),
         ...(dashboard.expiresAt ? { expiresAt: dashboard.expiresAt } : {}),
+        ...(dashboard.password ? { password: dashboard.password } : {}),
     };
     writeJson(accountPath(slug), { ...current, email, dashboard: stored, savedAt: new Date().toISOString() });
     return slug;

package/dist/lib/dashboardApi.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DashboardApi = void 0;
+exports.DashboardApi = exports.DashboardError = void 0;
+exports.isNotFound = isNotFound;
 exports.dashboardApi = dashboardApi;
 const config_1 = require("./config");
 const dashboardAuth_1 = require("./dashboardAuth");
@@ -27,6 +28,29 @@ const dashboardAuth_1 = require("./dashboardAuth");
  *
  * Everything on this surface is undocumented and can change without notice.
  */
+/**
+ * A non-2xx response from the dashboard API.
+ *
+ * Deliberately shaped like `ApiError` on the `/cli/*` side, so a caller reads
+ * `err.status` the same way on both surfaces. Extends Error so existing
+ * `handleError` paths and message-based assertions keep working unchanged.
+ */
+class DashboardError extends Error {
+    status;
+    data;
+    /** `data` is the parsed error body, kept whole for callers (`dashboard api`) that print it. */
+    constructor(status, message, data) {
+        super(message);
+        this.status = status;
+        this.data = data;
+        this.name = 'DashboardError';
+    }
+}
+exports.DashboardError = DashboardError;
+/** True when the failure was "no such record", as opposed to a real error. */
+function isNotFound(err) {
+    return err instanceof DashboardError && err.status === 404;
+}
 class DashboardApi {
     baseUrl;
     constructor(baseUrl) {
@@ -38,7 +62,12 @@ class DashboardApi {
      * stored 24h token is still valid, and a long-lived client must not outlive it.
      */
     async request(method, path, body) {
-        const { token, sessionToken } = (0, dashboardAuth_1.requireDashboard)();
+        // baseUrl + path is the whole URL, so a path that does not start with "/" can
+        // rewrite the host ("https://backend.callkaro.ai" + "@evil.com/x") and carry
+        // the session cookie with it.
+        if (!path.startsWith('/'))
+            throw new Error(`Dashboard path must start with "/" (got "${path}").`);
+        const { token, sessionToken } = await (0, dashboardAuth_1.requireDashboard)();
         const headers = { 'Content-Type': 'application/json' };
         if (usesCookieAuth(path)) {
             headers.Cookie = `access_token=${sessionToken}`;
@@ -52,6 +81,9 @@ class DashboardApi {
                 method,
                 headers,
                 body: body === undefined ? undefined : JSON.stringify(body),
+                // A redirect would re-send the cookie to wherever it points.
+                redirect: 'error',
+                signal: AbortSignal.timeout(30_000),
             });
         }
         catch (err) {
@@ -66,7 +98,12 @@ class DashboardApi {
             data = { msg: text.slice(0, 200) };
         }
         if (!res.ok) {
-            throw new Error(data?.msg || data?.message || `Request failed (${res.status})`);
+            // Carry the status, not just the message. A caller that cannot tell 404
+            // from 500 has to treat every failure the same, and for a read-modify-write
+            // that is the difference between "no config yet" and "the read failed" —
+            // collapsing them sends a write that discards what it failed to read.
+            // Mirrors ApiError on the /cli/* side.
+            throw new DashboardError(res.status, data?.msg || data?.message || `Request failed (${res.status})`, data);
         }
         return data;
     }
@@ -96,6 +133,17 @@ class DashboardApi {
         return this.request('GET', `/pending-tasks${qs(query)}`);
     }
     teamMembers() { return this.request('GET', '/feedback/users/team-members'); }
+    // --- saved simulation variable sets ----------------------------------------
+    /** `agentId` is required; without it the backend answers 400 "Invalid agentId". */
+    testVariableSets(agentId) {
+        return this.request('GET', `/v1/call-metadata-test-variables${qs({ agentId })}`);
+    }
+    createTestVariableSet(body) {
+        return this.request('POST', '/v1/call-metadata-test-variables', body);
+    }
+    deleteTestVariableSet(id) {
+        return this.request('DELETE', `/v1/call-metadata-test-variables/${encodeURIComponent(id)}`);
+    }
     // --- KPI board writes -----------------------------------------------------
     //
     // Routes, bodies and the column set below were read out of the dashboard's own

package/dist/lib/dashboardAuth.js

@@ -60,7 +60,7 @@ function msUntilExpiry(token) {
 }
 /**
  * Password sign-in against the dashboard, exactly as the web form does it.
- * The password is used here and then discarded — it is never stored.
+ * Returns the session without the password; the caller decides whether to keep it.
  *
  * Two JWTs come back and both are kept, because they authorise different routes:
  * `auth-token` in the body serves `GET /v2/agents/` as a bearer, while
@@ -133,34 +133,44 @@ function forgetDashboard(email) {
  * Returns BOTH tokens, because the two halves of the dashboard need different
  * ones. `dashboardApi.ts` picks per route; callers should not choose.
  *
- * There is nothing to refresh — the tokens last 24h and the backend has no
- * refresh endpoint (confirmed by capture). So this checks expiry locally and
- * fails with the concrete next command, rather than pretending it can renew.
+ * The backend has no refresh endpoint (confirmed by capture), so a lapsed
+ * session is renewed by logging in again. With a stored password that happens
+ * here, silently; without one this fails with the concrete next command.
  */
-function requireDashboard() {
+async function requireDashboard() {
     const slug = (0, config_1.activeAccount)();
     const email = slug ? (0, config_1.loadAccount)(slug).email : undefined;
-    const session = dashboardSession(email);
+    let session = dashboardSession(email);
     if (!session?.token) {
         throw new Error(`No dashboard session for ${email || 'the account in effect'}.\n` +
             '  Dashboard endpoints (/auth/*, /v1/*, /kpi-manager, /pending-tasks) need a dashboard login, not a ck_ token.\n' +
             '  Run: cku dashboard login');
     }
-    if (!session.sessionToken) {
-        // A session stored before the two-token split. Re-issuing is the only fix;
-        // the cookie token cannot be derived from the body token.
-        throw new Error(`The stored dashboard session for ${email} is incomplete — it predates the two-token fix.\n` +
-            '  /auth/login returns a separate access_token cookie that the dashboard routes require.\n' +
-            '  Run: cku dashboard login');
-    }
     // Expiry is read off the cookie token: it is the one that guards every route
     // except /v2/agents/, so it is the one that matters for a session's lifetime.
-    const left = msUntilExpiry(session.sessionToken);
-    if (left !== undefined && left <= 0) {
-        const when = new Date(Date.now() + left).toLocaleString('en-US');
-        throw new Error(`Dashboard session for ${email} expired ${when}.\n` +
-            '  There is no refresh endpoint — the token lives 24h and must be re-issued.\n' +
-            '  Run: cku dashboard login');
+    // A session stored before the two-token split has no cookie token, and that
+    // cannot be derived from the body token, so it needs a fresh login too.
+    // With a stored password, renew a minute early so the token cannot lapse
+    // mid-request; without one a token that still has time left is still valid.
+    const left = session.sessionToken ? msUntilExpiry(session.sessionToken) : 0;
+    if (left !== undefined && left <= (session.password ? 60_000 : 0)) {
+        if (!session.password) {
+            const why = session.sessionToken
+                ? `Dashboard session for ${email} expired ${new Date(Date.now() + left).toLocaleString('en-US')}.\n` +
+                    '  There is no refresh endpoint — the token lives 24h and must be re-issued.'
+                : `The stored dashboard session for ${email} is incomplete — it predates the two-token fix.\n` +
+                    '  /auth/login returns a separate access_token cookie that the dashboard routes require.';
+            throw new Error(`${why}\n  Run: cku dashboard login`);
+        }
+        try {
+            const renewed = await dashboardLogin(session.email || email, session.password);
+            saveDashboard(email, { ...renewed, password: session.password });
+            session = renewed;
+        }
+        catch (err) {
+            throw new Error(`Dashboard session for ${email} expired and re-login with the stored password failed: ${err.message}\n` +
+                '  If the password changed, run: cku dashboard login');
+        }
     }
     return { token: session.token, sessionToken: session.sessionToken, email: session.email };
 }
@@ -182,6 +192,7 @@ function expiryLabel(token) {
 /** `cku dashboard login` — the browser's email+password flow, minus the browser. */
 async function dashboardLoginCommand(opts) {
     try {
+        (0, ui_1.needTty)('Dashboard login is interactive; sign in from a terminal.');
         const answers = await (0, prompts_1.default)([
             { type: opts.email ? null : 'text', name: 'email', message: 'Email' },
             { type: 'password', name: 'password', message: 'Password' },
@@ -191,10 +202,18 @@ async function dashboardLoginCommand(opts) {
         if (!email || !password)
             return (0, ui_1.handleError)(new Error('Email and password are required'));
         const session = await dashboardLogin(email, password);
-        saveDashboard(email, session);
+        // Kept by default so the session renews itself every 24h; --no-save-password
+        // opts out and brings back a daily re-login.
+        const keep = opts.savePassword !== false;
+        saveDashboard(email, keep ? { ...session, password } : session);
         (0, ui_1.success)(`Dashboard session stored for ${session.email} (expires in ${expiryLabel(session.token)}).`);
-        (0, ui_1.info)('  Your password was not stored. The token cannot be refreshed, so you re-run');
-        (0, ui_1.info)('  this command once it expires.');
+        if (keep) {
+            (0, ui_1.info)('  Password saved (plain text, mode 0600) so the session renews itself when it lapses.');
+            (0, ui_1.info)('  Remove it with `cku dashboard logout`, or sign in with --no-save-password.');
+        }
+        else {
+            (0, ui_1.info)('  Password not saved. The token cannot be refreshed, so re-run this once it expires.');
+        }
     }
     catch (err) {
         (0, ui_1.handleError)(err);
@@ -203,7 +222,7 @@ async function dashboardLoginCommand(opts) {
 /** `cku dashboard whoami` — prove the stored session still works. */
 async function dashboardWhoamiCommand(opts) {
     try {
-        const { sessionToken, email } = requireDashboard();
+        const { sessionToken, email } = await requireDashboard();
         const res = await fetch(`${(0, config_1.backendUrl)()}/auth/get-user`, {
             headers: { Cookie: `access_token=${sessionToken}` },
         });
@@ -238,7 +257,7 @@ async function dashboardProbeCommand() {
         '/phone-number/',
     ];
     try {
-        const { token, sessionToken, email } = requireDashboard();
+        const { token, sessionToken, email } = await requireDashboard();
         const base = (0, config_1.backendUrl)();
         const send = (path, which) => fetch(`${base}${path}`, {
             headers: which === 'bearer' ? { Authorization: `Bearer ${token}` } : { Cookie: `access_token=${sessionToken}` },
@@ -318,16 +337,8 @@ async function dashboardLogoutCommand(opts) {
         const email = slug ? (0, config_1.loadAccount)(slug).email : undefined;
         if (!hasDashboard(email))
             return void (0, ui_1.info)('No dashboard session stored for this account.');
-        if (!opts.yes) {
-            const { ok } = await (0, prompts_1.default)({
-                type: 'confirm',
-                name: 'ok',
-                message: `Forget the dashboard session for ${email}? (your ck_ token is kept)`,
-                initial: false,
-            });
-            if (!ok)
-                return void (0, ui_1.info)('Cancelled.');
-        }
+        if (!(await (0, ui_1.confirm)(`Forget the dashboard session for ${email}? (your ck_ token is kept)`, opts.yes)))
+            return;
         if (email && forgetDashboard(email))
             (0, ui_1.success)(`Dashboard session removed for ${email}.`);
         else

package/dist/lib/ui.js

@@ -6,11 +6,14 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.fail = exports.info = exports.success = void 0;
 exports.banner = banner;
 exports.keyValue = keyValue;
+exports.needTty = needTty;
+exports.confirm = confirm;
 exports.table = table;
 exports.handleError = handleError;
 exports.intFlag = intFlag;
 const chalk_1 = __importDefault(require("chalk"));
 const cli_table3_1 = __importDefault(require("cli-table3"));
+const prompts_1 = __importDefault(require("prompts"));
 const types_1 = require("./types");
 const success = (msg) => console.log(chalk_1.default.green('✔') + ' ' + msg);
 exports.success = success;
@@ -46,9 +49,35 @@ function keyValue(obj) {
         console.log(`${chalk_1.default.dim(k.padEnd(width))}  ${v}`);
     }
 }
+/**
+ * Throw when a prompt is about to run with nobody to answer it. `prompts` waits
+ * on stdin forever in a non-interactive shell, so a script or agent hangs
+ * instead of failing. `hint` names the flag that skips the prompt.
+ */
+function needTty(hint) {
+    if (!process.stdin.isTTY) {
+        throw new Error(`This needs input, but there is no terminal to ask on. ${hint}`);
+    }
+}
+/** Ask y/N, defaulting to no. `--yes` skips it; no terminal and no `--yes` is an error, not a hang. */
+async function confirm(message, yes) {
+    if (yes)
+        return true;
+    needTty('Re-run with --yes to confirm.');
+    const { ok } = await (0, prompts_1.default)({ type: 'confirm', name: 'ok', message, initial: false });
+    if (!ok)
+        (0, exports.info)('Cancelled.');
+    return Boolean(ok);
+}
 /** Render rows as a bordered table with a highlighted header. */
 function table(headers, rows) {
-    const t = new cli_table3_1.default({ head: headers.map((h) => chalk_1.default.cyan(h)) });
+    // cli-table3 colours borders and header red/grey by default, independent of
+    // chalk, so piped output carried escape codes. Tie its style to chalk's level.
+    const colour = chalk_1.default.level > 0;
+    const t = new cli_table3_1.default({
+        head: headers.map((h) => chalk_1.default.cyan(h)),
+        style: { head: [], border: colour ? ['grey'] : [] },
+    });
     for (const row of rows) {
         t.push(row.map((cell) => (cell === undefined || cell === null ? '' : String(cell))));
     }

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "callkaro-cli-unofficial",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "license": "Apache-2.0",
-  "description": "Unofficial fork of the CallKaro CLI \u2014 manage your voice AI agents from the terminal",
+  "description": "Unofficial fork of the CallKaro CLI — manage your voice AI agents from the terminal",
   "bin": {
     "cku": "dist/index.js"
   },