Metadata-Version: 2.4
Name: vijil-console
Version: 0.4.12
Summary: CLI for the Vijil AI trust platform
License: Apache-2.0
License-File: LICENSE
Author: Vijil AI
Author-email: engineering@vijil.ai
Requires-Python: >=3.10
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Classifier: Programming Language :: Python :: 3.15
Requires-Dist: click (>=8.1,<9.0)
Requires-Dist: httpx (>=0.24)
Requires-Dist: pyyaml (>=6.0,<7.0)
Description-Content-Type: text/markdown

# vijil-console

CLI for the Vijil AI trust platform. Manage agents, evaluations, evolutions, and more from the command line against a Vijil Console deployed in your VPC.

## Install

```bash
pip install vijil-console
# or isolated:
pipx install vijil-console
```

## Connecting to a deployed environment

The CLI talks to the Vijil Console nginx gateway — the single load balancer that routes to all backend microservices. You need one URL: the external address of the `vijil-console-nginx` service.

### 1. Find your Console API URL

If you have `kubectl` access to the EKS cluster:

```bash
kubectl get svc vijil-console-nginx -n vijil-console \
  -o jsonpath='{.status.loadBalancer.ingress[0].hostname}'
```

This gives you the raw ELB hostname. If a DNS record exists (e.g., `console-api.dev05.vijil.ai`), use that instead — check Route 53 for CNAME records pointing at this ELB.

### 2. Initialize the CLI

```bash
vijil-console auth init
# Prompt: Vijil Console URL []: http://console-api.dev05.vijil.ai
```

This saves the URL to `~/.vijil/config.yaml`. The init command verifies connectivity by hitting `/teams/healthz` through the gateway.

**Note:** The gateway does not expose a root `/healthz` — health checks are routed per-service (e.g., `/teams/healthz`, `/evaluations/healthz`). The CLI uses `/teams/healthz` as the connectivity check since the teams service handles authentication and is always required.

### 3. Authenticate

```bash
vijil-console auth login
# Prompt: Email: user@example.com
# Prompt: Password: ********
```

The CLI sends a JSON `POST /auth/jwt/login` with `{"email": "...", "password": "..."}` to the teams service. On success it stores the JWT access token and (if available) refresh token in `~/.vijil/config.yaml`.

If your account belongs to a single team, the CLI auto-selects it. If you belong to multiple teams, select one:

```bash
vijil-console team list
vijil-console team use <team_id>
```

The active `team_id` is injected automatically into API calls that require it (evaluations, harnesses, etc.). `discover` commands send it as the `X-Vijil-Team` header instead, and refuse to run until a team is selected.

### 4. Use

```bash
vijil-console agent list                         # list agents
vijil-console agent get <agent_id>               # agent details
vijil-console eval run --agent-id <id> --wait    # run evaluation, poll until done
vijil-console eval list                          # list evaluations
vijil-console eval results <evaluation_id>       # get results
vijil-console harness list                       # list standard harnesses
vijil-console evolution run <agent_id> --wait    # trigger Darwin evolution
vijil-console proposal list                      # list mutation proposals
vijil-console dashboard show --json              # trust dashboard
```

Every command supports `--json` for machine-readable output and `--help` for usage details.

## Configuration

All CLI state is stored in `~/.vijil/config.yaml`:

```yaml
console_url: http://console-api.dev05.vijil.ai
auth_token: eyJhbG...
refresh_token: ...
default_team_id: c58aea71-3861-4f28-b8c4-20832a2f22ee
```

Token refresh is automatic — if a request returns 401, the CLI attempts `POST /auth/jwt/refresh` before failing.

### Which Console URL is in effect

Resolved from the first of these that carries a value:

1. `VIJIL_CONSOLE_URL`
2. `console_url` in `~/.vijil/config.yaml` (what `auth init` and `auth login` write)
3. `url` in `~/.vijil/credentials.json` — the **carrier**, written by whichever
   client (this CLI or the `vijil` SDK) logged in most recently, so configuring
   one client is enough for the other
4. the public default, `https://console-api.vijil.ai`

A value that is not an `http(s)://` URL is a configuration error naming the file
it came from, never a network error. When one of these sources names a host
different from the one a command is actually calling, the CLI prints one warning
on stderr naming both — the usual cause of an unexplained 401 is a token minted
at one Console being sent to another.

**`VIJIL_CONSOLE_URL` is not an ephemeral override at login time.**
`auth login` / `auth login-browser` persist the URL they actually signed in
against into `config.yaml`, so a login run with `VIJIL_CONSOLE_URL=<dev>` pins
`console_url: <dev>` durably — unsetting the variable afterwards does **not**
undo it. That is deliberate (the token only works at the host that issued it);
run `vijil-console auth init --url <other>` to move it.

### Which credential is in effect

`VIJIL_CLIENT_ID` + `VIJIL_CLIENT_SECRET` (an API key pair) → `VIJIL_API_KEY`
(a raw bearer) → `auth_token` in `config.yaml` → `token` in `credentials.json`.
The environment outranks disk deliberately, so a stale `~/.vijil/` file cannot
beat the credential a CI job was given. An unexpanded `${VIJIL_CLIENT_ID}`-style
placeholder is **not** an environment credential and does not outrank anything:
some MCP hosts pass a manifest's `env` values through without expanding them,
and a literal that shadowed a session the user had just signed into would be the
worst of both outcomes (CON-725). `VIJIL_TEAM_ID` is read the same way. A rejected environment credential never
silently falls back to an on-disk session: the error says which URL it called,
which variable supplied the credential, that a session exists and is unused, and
the `unset` to run.

### Checking it

```bash
vijil-console auth status            # also --json, and --no-verify to skip the network
# Authenticated
#   mode:       env_pair
#   credential: vk_W…HI
#   url:        https://console-api.example.com  (source: own_config)
#   team:       c58aea71-3861-4f28-b8c4-20832a2f22ee
```

`status` reports the credential mode, the masked credential (never a full
secret — a 4-character prefix and a 2-character suffix, and `***` with nothing
revealed for anything 16 characters or shorter), the URL, **where the URL came
from** — one of `env`, `own_config`, `carrier`, `foreign_config` (vijil-sdk's
`config.toml`), `default`, or `invalid` (nothing resolved; the reason is in
`detail`) — and the resolved team. It also lists `unusable_url_sources`: any
place a Console URL is configured that could not be used, by file and
classification, never by content. `--json` adds `authenticated` and `verified`
as separate keys: `verified` means the gateway was *asked*, so a rejected
credential or an unreachable host reports `verified: true` with
`authenticated: false`, and `verified: false` means only that nothing was
checked (`--no-verify`, or no credential at all).

## Commands

Run `vijil-console --help` for the full list:

```
auth        Authentication and CLI configuration (init, login, login-browser, logout, status, change-password)
team        Manage team context (list, use)
agent       Manage AI agents (list, create, get, update, delete, import)
eval        Run and manage evaluations (run, status, list, results)
harness     Manage test harnesses (list, custom-list, custom-create, ...)
dome        Dome guardrail configuration and detection
telemetry   Query observability telemetry (metrics, traces, logs)
evolution   Darwin evolution engine (run, status)
proposal    Manage mutation proposals (list, approve, reject)
genome      Manage agent genomes (list, get, create, extract)
persona     Manage test personas
policy      Manage compliance policies and rules
dashboard   Trust dashboard
discover    Discover (Shadow control plane): scan surfaces, scanners and findings (see docs/DISCOVER2.md)
```


