callkaro-cli-unofficial 0.5.1 → 0.6.1

package/README.md

@@ -166,6 +166,20 @@ cku dashboard probe     # which dashboard routes this token reaches
 
 The dashboard API needs a *different* token from `/cli/*` — they're not interchangeable, and each rejects the other with an opaque 401. This also unlocks `cku analyzers` and `cku models`. The dashboard token expires every 24h with no refresh endpoint, so `cku dashboard login` saves your password (plain text, mode 0600, alongside the tokens) and re-logs in for you when it lapses. Pass `--no-save-password` to keep it off disk and re-enter it daily; `cku dashboard logout` deletes it.
 
+### The admin console credential
+
+```bash
+cku admin login                   # a third credential: the internal admin console
+cku admin clients                 # the client accounts you are assigned to
+cku admin impersonate <accountId> # mint a real ck_ token for one of them
+```
+
+The internal admin console (`intadmin.callkaro.ai`) is a *third* credential, separate from both the `ck_` token and the dashboard session — each rejects the other two with an opaque 401. It is the only place the console's write routes live, and the only way to act on a client account when no login of yours is assigned to it.
+
+`cku admin impersonate` is the console's "Login as this user" in the terminal: it mints a real `ck_` token through the admin session, stores it under the client's own email, and scopes it to that client account — so `cku accounts use` picks it up and it renews itself by impersonating again. The client-facing `/cli/*` surface has no equivalent, and hand-rolling the cookie chain is four hops of undocumented routes.
+
+The console's writes — recharge, concurrency, pause/resume, phone numbers — are all confirmed, and need `--yes` without a terminal. `cku admin recharge` moves real credits and the console has no undo, so it checks the account's own minimum first. The full route map, role gates and request bodies are in [`docs/admin-api.md`](docs/admin-api.md).
+
 ### Knowing which models are actually valid
 
 ```bash

package/dist/commands/accounts.js

@@ -175,7 +175,7 @@ async function accountsCommand(opts) {
     // Never print tokens or passwords: this output ends up in agent transcripts
     // and CI logs. `signedIn` says whether a credential is held, not what it is.
     if (opts.json) {
-        return void console.log(JSON.stringify(accounts.map(({ token, password, dashboard, ...a }) => ({
+        return void console.log(JSON.stringify(accounts.map(({ token, password, dashboard, admin, ...a }) => ({
             ...a,
             signedIn: Boolean(token),
             ...(dashboard
@@ -189,22 +189,36 @@ async function accountsCommand(opts) {
                     },
                 }
                 : {}),
+            ...(admin
+                ? {
+                    admin: {
+                        email: admin.email,
+                        userId: admin.userId,
+                        role: admin.role,
+                        expiresAt: admin.expiresAt,
+                        savedAt: admin.savedAt,
+                        signedIn: Boolean(admin.token),
+                    },
+                }
+                : {}),
         })), null, 2));
     }
     if (!accounts.length) {
         return void (0, ui_1.info)('No accounts saved. Run `cku login` to add one.');
     }
-    (0, ui_1.table)(['', 'EMAIL', 'CK TOKEN', 'DASHBOARD', 'SAVED'], accounts.map((a) => [
+    (0, ui_1.table)(['', 'EMAIL', 'CK TOKEN', 'DASHBOARD', 'ADMIN', 'SAVED'], accounts.map((a) => [
         active && (0, config_1.slugFor)(a.email || '') === active ? '*' : '',
         a.email || '(unknown)',
         a.token ? 'yes' : 'no',
         a.dashboard?.token ? (0, dashboardAuth_1.expiryLabel)(a.dashboard.token) : '—',
+        a.admin?.token ? (0, dashboardAuth_1.expiryLabel)(a.admin.token) : '—',
         a.savedAt ? new Date(a.savedAt).toLocaleString('en-US') : '',
     ]));
     const source = (0, config_1.accountSource)();
     (0, ui_1.info)(`\n* = active account (${source === 'env' ? 'CK_ACCOUNT' : source === 'project' ? 'this folder\'s .cku.json' : 'global default'}).`);
     (0, ui_1.info)('CK TOKEN gates /cli/* commands. DASHBOARD gates /auth/* and /v2/*, and is a separate');
     (0, ui_1.info)('login that expires in 24h — add one with `cku dashboard login`.');
+    (0, ui_1.info)('ADMIN gates /monitor/*, the internal admin console — add one with `cku admin login`.');
     if (source === 'global') {
         (0, ui_1.info)('  Tip: `cku accounts bind <email>` pins an account to this folder, so parallel');
         (0, ui_1.info)('  agents in different folders cannot switch each other out from under themselves.');

package/dist/commands/admin.js

@@ -0,0 +1,519 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.activeAccount = exports.getClient = void 0;
+exports.adminClientsCommand = adminClientsCommand;
+exports.adminClientCommand = adminClientCommand;
+exports.adminCoworkersCommand = adminCoworkersCommand;
+exports.adminImpersonateCommand = adminImpersonateCommand;
+exports.adminAnalyticsCommand = adminAnalyticsCommand;
+exports.adminCostsCommand = adminCostsCommand;
+exports.adminRechargesCommand = adminRechargesCommand;
+exports.adminCallsCommand = adminCallsCommand;
+exports.adminBotsCommand = adminBotsCommand;
+exports.adminSentryCommand = adminSentryCommand;
+exports.adminRechargeCommand = adminRechargeCommand;
+exports.adminClientSetCommand = adminClientSetCommand;
+exports.adminClientActionCommand = adminClientActionCommand;
+exports.adminAgentActionCommand = adminAgentActionCommand;
+exports.adminNumbersCommand = adminNumbersCommand;
+exports.adminVoiceCacheCommand = adminVoiceCacheCommand;
+exports.adminApiCommand = adminApiCommand;
+const adminApi_1 = require("../lib/adminApi");
+const adminAuth_1 = require("../lib/adminAuth");
+const config_1 = require("../lib/config");
+Object.defineProperty(exports, "getClient", { enumerable: true, get: function () { return config_1.getClient; } });
+Object.defineProperty(exports, "activeAccount", { enumerable: true, get: function () { return config_1.activeAccount; } });
+const ui_1 = require("../lib/ui");
+const jsonInput_1 = require("./jsonInput");
+const looseJson_1 = require("../lib/looseJson");
+/** The route segments the path may contain — see `repairPosixPath`. */
+const PATH_SEGMENTS = ['monitor'];
+/**
+ * `cku admin` — the internal admin console (intadmin.callkaro.ai).
+ *
+ * A third surface, on a third credential: the `/monitor/*` routes answer to the
+ * `access_token_monitor` cookie and to nothing else. It is the only place the
+ * console's write routes exist — recharge, concurrency, pause/resume, phone
+ * numbers — and the only way to act on a client account when no login of yours
+ * is assigned to it.
+ */
+/** The window analytics and costs default to when the user gives none. */
+function defaultWindow() {
+    const end = new Date();
+    const start = new Date(end);
+    start.setMonth(start.getMonth() - 1);
+    const iso = (d) => d.toISOString().slice(0, 10);
+    return { startDate: iso(start), endDate: iso(end) };
+}
+/** Reject a date that is not YYYY-MM-DD, naming the format. */
+function dateArg(raw, flag, fallback) {
+    if (!raw)
+        return fallback;
+    if (!/^\d{4}-\d{2}-\d{2}$/.test(raw)) {
+        throw new Error(`${flag} must be YYYY-MM-DD (got "${raw}").`);
+    }
+    return raw;
+}
+/** The admin's own id — the route that lists the clients is keyed by it. */
+async function adminId() {
+    const res = await (0, adminApi_1.adminApi)().getAdmin();
+    const id = res?.user?._id || res?._id;
+    if (!id)
+        throw new Error('The admin console did not return an id for this user.');
+    return id;
+}
+/**
+ * One client account's record.
+ *
+ * It comes out of the admin's *own* user record, not out of
+ * `GET /monitor/users/:clientId` — that route 403s, because a client id is not
+ * an admin you are allowed to see. The console's own clients page reads the
+ * same way.
+ */
+async function lookupClient(clientId) {
+    const id = await adminId();
+    const res = await (0, adminApi_1.adminApi)().myClients(id);
+    const client = (res?.users || []).find((c) => (c._id || c.id) === clientId);
+    if (!client) {
+        throw new Error(`No client account with id ${clientId} is assigned to this admin user.\n` +
+            '  Run `cku admin clients` to see the ones you have.');
+    }
+    return client;
+}
+// --- identity --------------------------------------------------------------
+async function adminClientsCommand(opts) {
+    try {
+        const id = await adminId();
+        const res = await (0, adminApi_1.adminApi)().myClients(id);
+        const clients = res?.users || [];
+        if (opts.json)
+            return void console.log(JSON.stringify(clients, null, 2));
+        if (!clients.length)
+            return void (0, ui_1.info)('No client accounts are assigned to this admin user.');
+        (0, ui_1.table)(['NAME', 'EMAIL', 'ACCOUNT ID', 'PLAN', 'CREDITS', 'CONCURRENCY', 'PAUSED'], clients.map((c) => [
+            c.name || '',
+            c.email || '',
+            c._id || c.id || '',
+            c.plan_type || '—',
+            c.currentCredits !== undefined ? Math.round(c.currentCredits) : '—',
+            c.concurrency ?? '—',
+            c.isPaused ? 'yes' : 'no',
+        ]));
+    }
+    catch (err) {
+        (0, ui_1.handleError)(err);
+    }
+}
+async function adminClientCommand(clientId, opts) {
+    try {
+        const c = await lookupClient(clientId);
+        if (opts.json)
+            return void console.log(JSON.stringify(c, null, 2));
+        (0, ui_1.keyValue)({
+            name: c?.name,
+            email: c?.email,
+            id: c?._id || c?.id,
+            plan: c?.plan_type,
+            credits: c?.currentCredits !== undefined ? Math.round(c.currentCredits) : undefined,
+            minRechargeAmount: c?.minRechargeAmount,
+            concurrency: c?.concurrency,
+            phoneNumbers: (c?.phoneNumbers || []).join(', ') || undefined,
+            queueSize: c?.queueSize,
+            paused: c?.isPaused,
+            triggerWindow: c?.min_trigger_time && c?.max_trigger_time ? `${c.min_trigger_time}–${c.max_trigger_time}` : undefined,
+        });
+    }
+    catch (err) {
+        (0, ui_1.handleError)(err);
+    }
+}
+async function adminCoworkersCommand(clientId, opts) {
+    try {
+        const res = await (0, adminApi_1.adminApi)().coworkers(clientId);
+        const people = res?.coworkers || [];
+        if (opts.json)
+            return void console.log(JSON.stringify(people, null, 2));
+        if (!people.length)
+            return void (0, ui_1.info)('No coworkers on that client account.');
+        (0, ui_1.table)(['NAME', 'EMAIL', 'EMPLOYEE ID', 'ROLE', 'PHONE'], people.map((p) => [p.name || '', p.email || '', p.employee_id || '', p.role || '', p.phone_number || '']));
+    }
+    catch (err) {
+        (0, ui_1.handleError)(err);
+    }
+}
+// --- impersonation ---------------------------------------------------------
+/**
+ * `cku admin impersonate <clientId>` — mint a real `ck_` token for a client
+ * account and store it, scoped to that client.
+ *
+ * This is the "Login as this user" button, in the terminal. The token is stored
+ * under the *client's* own email so `cku accounts use` and `cku accounts bind`
+ * find it, and the global default is left alone — minting a client token must
+ * not silently redirect the admin's own commands.
+ */
+async function adminImpersonateCommand(clientId, opts) {
+    try {
+        // Find the client so the token is filed under its own email.
+        const client = await lookupClient(clientId);
+        const clientEmail = client.email;
+        const slug = (0, config_1.slugFor)(clientEmail);
+        const existing = (0, config_1.loadAccount)(slug);
+        if (existing.token && !(await (0, ui_1.confirm)(`${clientEmail} already has a stored login. Replace it with the impersonated token?`, opts.yes))) {
+            return;
+        }
+        const { token, email: adminEmail, dashboard } = await (0, adminAuth_1.impersonateClient)(clientId, { adminEmail: (await (0, adminAuth_1.requireAdmin)()).email });
+        // activate: false — the admin's own account stays the default.
+        (0, config_1.saveAccount)(clientEmail, {
+            token,
+            user: { email: clientEmail },
+            monitoring: { id: clientId, name: client.name, email: clientEmail },
+            impersonated: { adminEmail, clientId },
+        }, { activate: false });
+        (0, config_1.saveDashboardSession)(clientEmail, { email: clientEmail, ...dashboard, savedAt: new Date().toISOString() });
+        (0, ui_1.success)(`Impersonating ${client.name || clientEmail} (${clientEmail}).`);
+        (0, ui_1.info)('  minted a ck_ token through the admin console and stored it, scoped to that client account.');
+        (0, ui_1.info)(`  Use it:  cku accounts use ${clientEmail}`);
+        (0, ui_1.info)(`  Or pin a folder:  cku accounts bind ${clientEmail}`);
+        (0, ui_1.info)('  Also stored a dashboard session for it, so `cku dashboard api` reaches /v2/agents/.');
+        (0, ui_1.info)('  Both renew themselves by impersonating again.');
+    }
+    catch (err) {
+        (0, ui_1.handleError)(err);
+    }
+}
+// --- analytics and costs ---------------------------------------------------
+async function adminAnalyticsCommand(opts) {
+    try {
+        const win = defaultWindow();
+        const startDate = dateArg(opts.start, '--start', win.startDate);
+        const endDate = dateArg(opts.end, '--end', win.endDate);
+        // The server's filter is `user_ids` (a csv). `userIds` is accepted and
+        // answered with "At least one user must be selected", which reads like a
+        // permissions problem rather than a wrong parameter name.
+        const user_ids = opts.client;
+        const res = await (0, adminApi_1.adminApi)().analytics({ startDate, endDate, user_ids });
+        const rows = res?.data?.user_wise || [];
+        if (opts.json)
+            return void console.log(JSON.stringify(res?.data ?? res, null, 2));
+        if (!rows.length)
+            return void (0, ui_1.info)('No analytics for that window.');
+        (0, ui_1.table)(['CLIENT ID', 'CALLS', 'MINUTES', 'CONNECTED', 'CONNECTED MIN', 'PULSE MIN', 'COST'], rows.map((r) => [
+            r.userId,
+            r.total_calls ?? '',
+            Math.round(r.minutes ?? 0),
+            r.connected_calls ?? '',
+            Math.round(r.connected_minutes ?? 0),
+            Math.round(r.pulse_minutes ?? 0),
+            r.total_cost !== undefined ? Math.round(r.total_cost) : '',
+        ]));
+    }
+    catch (err) {
+        (0, ui_1.handleError)(err);
+    }
+}
+async function adminCostsCommand(opts) {
+    try {
+        const win = defaultWindow();
+        const startDate = dateArg(opts.start, '--start', win.startDate);
+        const endDate = dateArg(opts.end, '--end', win.endDate);
+        const user_ids = opts.client;
+        const res = await (0, adminApi_1.adminApi)().costs({ startDate, endDate, user_ids });
+        const data = res?.data || res;
+        if (opts.json)
+            return void console.log(JSON.stringify(data, null, 2));
+        (0, ui_1.keyValue)({ totalCost: data?.totalCost, days: (data?.daily || []).length });
+        const daily = (data?.daily || []).slice(-30);
+        if (!daily.length)
+            return;
+        (0, ui_1.table)(['DATE', 'TOTAL'], daily.map((d) => [d.date, Math.round(d.total ?? 0)]));
+    }
+    catch (err) {
+        (0, ui_1.handleError)(err);
+    }
+}
+async function adminRechargesCommand(clientId, opts) {
+    try {
+        const win = defaultWindow();
+        const startDate = dateArg(opts.start, '--start', win.startDate);
+        const endDate = dateArg(opts.end, '--end', win.endDate);
+        const res = await (0, adminApi_1.adminApi)().recharges(clientId, { startDate, endDate });
+        const rows = res?.recharges || [];
+        if (opts.json)
+            return void console.log(JSON.stringify(rows, null, 2));
+        if (!rows.length)
+            return void (0, ui_1.info)('No recharges in that window.');
+        (0, ui_1.table)(['DATE', 'AMOUNT', 'CREDITS', 'STATUS', 'METHOD', 'INVOICE'], rows.map((r) => [
+            r.createdAt || r.date || '',
+            r.amount ?? '',
+            r.credits ?? '',
+            r.status || '',
+            r.paymentMethod || '',
+            r.invoiceNumber || '',
+        ]));
+    }
+    catch (err) {
+        (0, ui_1.handleError)(err);
+    }
+}
+// --- calls -----------------------------------------------------------------
+async function adminCallsCommand(opts) {
+    try {
+        // The server needs exactly one of these; filling more than one narrows the
+        // search rather than widening it.
+        const query = {};
+        if (opts.phone)
+            query.to = opts.phone;
+        if (opts.leadId)
+            query.lead_id = opts.leadId;
+        if (opts.buylead)
+            query.buylead = opts.buylead;
+        if (opts.callSid)
+            query.call_sid = opts.callSid;
+        if (opts.callId)
+            query.call_id = opts.callId;
+        if (!Object.keys(query).length) {
+            throw new Error('Give one of --phone, --lead-id, --buylead, --call-sid or --call-id.\n' +
+                '  The search needs one of them; filling more than one narrows it.');
+        }
+        const res = await (0, adminApi_1.adminApi)().calls(query);
+        const calls = res?.calls || [];
+        if (opts.json)
+            return void console.log(JSON.stringify(calls, null, 2));
+        if (!calls.length)
+            return void (0, ui_1.info)('No calls matched.');
+        (0, ui_1.table)(['CALL ID', 'AGENT', 'VERSION', 'TO', 'DURATION', 'STATUS', 'DATE'], calls.map((c) => [
+            c._id || '',
+            c.agent?.name || '',
+            c.versionId?.versionName || '',
+            c.to_number || c.to || '',
+            c.duration ?? '',
+            c.status || c.disposition || '',
+            c.createdAt || c.date || '',
+        ]));
+    }
+    catch (err) {
+        (0, ui_1.handleError)(err);
+    }
+}
+async function adminBotsCommand(opts) {
+    try {
+        const win = defaultWindow();
+        const startDate = dateArg(opts.start, '--start', win.startDate);
+        const endDate = dateArg(opts.end, '--end', win.endDate);
+        const res = await (0, adminApi_1.adminApi)().bots({ startDate, endDate });
+        const bots = res?.bots || [];
+        if (opts.json)
+            return void console.log(JSON.stringify(bots, null, 2));
+        if (!bots.length)
+            return void (0, ui_1.info)('No bots in that window.');
+        (0, ui_1.table)(['AGENT', 'CLIENT', 'AGENT ID', 'LEAD STAGE', 'PRIORITY'], bots.map((b) => [
+            b.agentName || b.agent?.name || '',
+            b.clientName || b.client?.name || '',
+            b.agentId || '',
+            b.leadStage || b.lead_stage || '',
+            b.priority ?? '',
+        ]));
+    }
+    catch (err) {
+        (0, ui_1.handleError)(err);
+    }
+}
+async function adminSentryCommand(opts) {
+    try {
+        const res = await (0, adminApi_1.adminApi)().sentryTransactions();
+        if (opts.json)
+            return void console.log(JSON.stringify(res, null, 2));
+        const rows = res?.rows || [];
+        if (!rows.length)
+            return void (0, ui_1.info)('No Sentry transactions in the last 24h.');
+        (0, ui_1.table)(['TRANSACTION', 'COUNT', 'ERRORS', 'P95'], rows.map((r) => [r.transaction || r.name || '', r.count ?? '', r.errors ?? '', r.p95 ?? '']));
+    }
+    catch (err) {
+        (0, ui_1.handleError)(err);
+    }
+}
+// --- writes ----------------------------------------------------------------
+/**
+ * `cku admin recharge <clientId> --amount <n>` — add credits to a client account.
+ *
+ * This moves real money into a live account and the console has no undo, so it
+ * is confirmed, and the client's own `minRechargeAmount` is checked first.
+ */
+async function adminRechargeCommand(clientId, opts) {
+    try {
+        const amount = Number(opts.amount);
+        if (!Number.isFinite(amount) || amount <= 0) {
+            throw new Error(`--amount must be a positive number (got "${opts.amount}").`);
+        }
+        const client = await lookupClient(clientId);
+        const minimum = client?.minRechargeAmount;
+        if (minimum && amount < minimum) {
+            throw new Error(`The client account's minimum recharge is ${minimum}; ${amount} is below it.\n` +
+                '  The server would reject it.');
+        }
+        const name = client?.name || clientId;
+        if (!(await (0, ui_1.confirm)(`Recharge ${amount} credits to ${name} (${clientId})? This adds real credits and the console has no undo.`, opts.yes))) {
+            return;
+        }
+        const out = await (0, adminApi_1.adminApi)().recharge(clientId, amount);
+        (0, ui_1.success)(`Recharged ${amount} to ${name}.`);
+        if (out?.user?.currentCredits !== undefined) {
+            (0, ui_1.info)(`  Balance is now ${Math.round(out.user.currentCredits)}.`);
+        }
+    }
+    catch (err) {
+        (0, ui_1.handleError)(err);
+    }
+}
+/** `cku admin client set <clientId> --concurrency <n>` */
+async function adminClientSetCommand(clientId, opts) {
+    try {
+        if (opts.concurrency === undefined) {
+            throw new Error('Nothing to set. Pass --concurrency <n>.');
+        }
+        const concurrency = Number(opts.concurrency);
+        if (!Number.isInteger(concurrency) || concurrency < 0) {
+            throw new Error(`--concurrency must be a non-negative whole number (got "${opts.concurrency}").`);
+        }
+        const client = await lookupClient(clientId);
+        const name = client?.name || clientId;
+        if (!(await (0, ui_1.confirm)(`Set concurrency of ${name} to ${concurrency}?`, opts.yes)))
+            return;
+        const out = await (0, adminApi_1.adminApi)().updateClient(clientId, { concurrency });
+        (0, ui_1.success)(`Concurrency set to ${concurrency} on ${name}.`);
+        if (out?.user?.concurrency !== undefined)
+            (0, ui_1.info)(`  It reads back as ${out.user.concurrency}.`);
+    }
+    catch (err) {
+        (0, ui_1.handleError)(err);
+    }
+}
+/** `cku admin client pause|resume|clear <clientId>` */
+async function adminClientActionCommand(action, clientId, opts) {
+    try {
+        const what = action === 'pause' ? 'Pause this client account — no more calls dial out for it.'
+            : action === 'resume' ? 'Resume this client account.'
+                : "Clear this client account's whole call queue — queued calls are dropped.";
+        if (!(await (0, ui_1.confirm)(`${what}\n  Client: ${clientId}`, opts.yes)))
+            return;
+        const api = (0, adminApi_1.adminApi)();
+        if (action === 'pause')
+            await api.pauseClient(clientId);
+        else if (action === 'resume')
+            await api.resumeClient(clientId);
+        else
+            await api.clearClientQueue(clientId);
+        (0, ui_1.success)(`Client ${clientId}: ${action} done.`);
+    }
+    catch (err) {
+        (0, ui_1.handleError)(err);
+    }
+}
+/** `cku admin agent pause|resume|clear <clientId> <agentId>` */
+async function adminAgentActionCommand(action, clientId, agentId, opts) {
+    try {
+        if (!['pause', 'resume', 'clear'].includes(action)) {
+            throw new Error(`Action must be pause, resume or clear (got "${action}").`);
+        }
+        const what = action === 'pause' ? 'Pause this agent — no more calls dial out for it.'
+            : action === 'resume' ? 'Resume this agent.'
+                : "Clear this agent's call queue — queued calls are dropped.";
+        if (!(await (0, ui_1.confirm)(`${what}\n  Client: ${clientId}  Agent: ${agentId}`, opts.yes)))
+            return;
+        const api = (0, adminApi_1.adminApi)();
+        if (action === 'pause')
+            await api.pauseAgent(clientId, agentId);
+        else if (action === 'resume')
+            await api.resumeAgent(clientId, agentId);
+        else
+            await api.clearAgentQueue(clientId, agentId);
+        (0, ui_1.success)(`Agent ${agentId}: ${action} done.`);
+    }
+    catch (err) {
+        (0, ui_1.handleError)(err);
+    }
+}
+/**
+ * `cku admin numbers bulk-update <clientIds...> --phone <n,n> [--mode add|replace]`
+ *
+ * The console normalises every number to `+` plus 12 digits and rejects
+ * anything else before it sends, so this does the same and says why.
+ */
+async function adminNumbersCommand(clientIds, opts) {
+    try {
+        const mode = opts.mode || 'replace';
+        if (mode !== 'add' && mode !== 'replace') {
+            throw new Error(`--mode must be "add" or "replace" (got "${mode}").`);
+        }
+        const phones = opts.phone.split(',').map((p) => p.trim()).filter(Boolean);
+        if (!phones.length)
+            throw new Error('--phone needs at least one number, comma separated.');
+        const normalised = phones.map(adminApi_1.normalisePhone);
+        const bad = normalised.filter((p) => p.length !== 13);
+        if (bad.length) {
+            throw new Error(`Each phone number must be 12 digits (e.g. +911234567890). Invalid: ${bad.join(', ')}\n` +
+                '  The server rejects anything else.');
+        }
+        const verb = mode === 'add' ? 'Add' : 'Replace';
+        if (!(await (0, ui_1.confirm)(`${verb} the phone numbers ${normalised.join(', ')} on ${clientIds.length} client account(s)?`, opts.yes))) {
+            return;
+        }
+        await (0, adminApi_1.adminApi)().bulkUpdatePhoneNumbers(clientIds, normalised, mode);
+        (0, ui_1.success)(`Phone numbers updated for ${clientIds.length} client account(s).`);
+    }
+    catch (err) {
+        (0, ui_1.handleError)(err);
+    }
+}
+/** `cku admin voice-cache clear` */
+async function adminVoiceCacheCommand(opts) {
+    try {
+        if (!(await (0, ui_1.confirm)('Clear the console-wide voice cache? Every client is affected.', opts.yes)))
+            return;
+        const res = await (0, adminApi_1.adminApi)().clearVoiceCache();
+        (0, ui_1.success)(`Voice cache cleared (${res?.clearedEntries ?? 0} entries).`);
+    }
+    catch (err) {
+        (0, ui_1.handleError)(err);
+    }
+}
+// --- escape hatch ----------------------------------------------------------
+/**
+ * `cku admin api <METHOD> <path> [--body] [--query]` — the escape hatch for a
+ * `/monitor/*` route the CLI has no command for. Mirrors `cku dashboard api`:
+ * the session cookie stays inside the CLI, the path must start with "/",
+ * redirects are refused, and a non-2xx prints the status and the whole body to
+ * stderr and exits 1. It never prints a header, so a token cannot leak.
+ */
+async function adminApiCommand(method, path, opts) {
+    try {
+        const verb = method.toUpperCase();
+        if (!['GET', 'POST', 'PUT', 'PATCH', 'DELETE'].includes(verb)) {
+            throw new Error(`Method must be one of GET, POST, PUT, PATCH, DELETE (got "${method}").`);
+        }
+        // Git Bash rewrites a leading "/" into a Windows path; put it back.
+        let target = (0, looseJson_1.repairPosixPath)(path, PATH_SEGMENTS);
+        if (opts.query?.length) {
+            const params = new URLSearchParams();
+            for (const kv of opts.query) {
+                const i = kv.indexOf('=');
+                if (i < 1)
+                    throw new Error(`--query expects key=value (got "${kv}").`);
+                params.append(kv.slice(0, i), kv.slice(i + 1));
+            }
+            target += (path.includes('?') ? '&' : '?') + params.toString();
+        }
+        const body = opts.body ? await (0, jsonInput_1.readJsonFlag)(opts.body, '--body') : undefined;
+        const res = await (0, adminApi_1.adminApi)().request(verb, target, body);
+        console.log(JSON.stringify(res ?? null, null, 2));
+    }
+    catch (err) {
+        if (err instanceof adminApi_1.AdminError) {
+            console.error(`HTTP ${err.status}`);
+            console.error(JSON.stringify(err.data ?? { message: err.message }, null, 2));
+            process.exitCode = 1;
+            return;
+        }
+        (0, ui_1.handleError)(err);
+    }
+}

package/dist/commands/dashboardApiCmd.js

@@ -4,7 +4,10 @@ exports.dashboardApiCommand = dashboardApiCommand;
 const dashboardApi_1 = require("../lib/dashboardApi");
 const ui_1 = require("../lib/ui");
 const jsonInput_1 = require("./jsonInput");
+const looseJson_1 = require("../lib/looseJson");
 const METHODS = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'];
+/** The route segments the path may contain — see `repairPosixPath`. */
+const PATH_SEGMENTS = ['auth', 'v1', 'v2', 'v3', 'kpi-manager', 'pending-tasks', 'phone-number'];
 /**
  * `cku dashboard api <METHOD> <path> [--body <json|@file>] [--query k=v ...]`
  *
@@ -21,7 +24,8 @@ async function dashboardApiCommand(method, path, opts) {
         const verb = method.toUpperCase();
         if (!METHODS.includes(verb))
             throw new Error(`Method must be one of ${METHODS.join(', ')} (got "${method}").`);
-        let target = path;
+        // Git Bash rewrites a leading "/" into a Windows path; put it back.
+        let target = (0, looseJson_1.repairPosixPath)(path, PATH_SEGMENTS);
         if (opts.query?.length) {
             const params = new URLSearchParams();
             for (const kv of opts.query) {