@dench.com/cli 0.3.5 → 0.3.7

package/dench.ts

@@ -1,9 +1,16 @@
 #!/usr/bin/env tsx
 import { Buffer } from "node:buffer";
 import { spawn } from "node:child_process";
-import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
+import {
+  chmod,
+  mkdir,
+  readdir,
+  readFile,
+  stat,
+  writeFile,
+} from "node:fs/promises";
 import { homedir, hostname, userInfo } from "node:os";
-import { join } from "node:path";
+import { basename, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { ConvexHttpClient } from "convex/browser";
 import { makeFunctionReference } from "convex/server";
@@ -190,6 +197,11 @@ const api = {
       commitFileUpload: makeFunctionReference<"mutation">(
         "functions/files:commitFileUpload",
       ),
+      // Used by `dench stage` to record dir rows for intermediate
+      // parents (commitFileUpload only inserts leaf rows).
+      recordDirCreate: makeFunctionReference<"mutation">(
+        "functions/files:recordDirCreate",
+      ),
       getFileSignedDownloadUrl: makeFunctionReference<"action">(
         "functions/files:getFileSignedDownloadUrl",
       ),
@@ -430,6 +442,17 @@ CRM (Daytona-native rewrite):
   dench crm batch --file ops.jsonl
   Help: dench crm help
 
+Live web search (Exa via the Dench Cloud Gateway, auths with DENCH_API_KEY):
+  dench search "<query>" [--num-results N] [--type auto|fast|deep|deep-reasoning|neural] [--category news|company|people|...] [--include-domains a.com,b.com] [--exclude-domains c.com] [--max-chars 800] [--json]
+  dench search contents <url> [<url>...] [--max-chars 4000] [--summary "..."] [--json]
+  dench search answer "<query>" [--json]
+  Help: dench search help
+
+Image generation / editing (gpt-image-2 via the Dench Cloud Gateway):
+  dench image generate "<prompt>" [--size 1024x1024] [--quality auto|low|medium|high] [--format png|jpeg|webp] [--save-path /workspace/path/file.png] [--output <local file>] [--no-write] [--json]
+  dench image edit "<prompt>" --input <path> [--input <path> ...] [--mask <path>] [--size ...] [--quality ...] [--format ...] [--save-path ...] [--output ...] [--json]
+  Help: dench image help
+
 Past chat threads (own + shared in this workspace):
   dench chat list [--query <substr>] [--limit N] [--include-archived] [--json]
   dench chat search "<query>" [--limit N] [--include-current] [--json]
@@ -456,6 +479,9 @@ returns ENOSYS on the FUSE-backed volume mount):
   dench files mv <src> <dst> [--json]
   dench files rm <path> [--recursive] [--json]
 
+Persist scratch -> workspace (cp from /tmp into /workspace + Convex sync):
+  dench stage <local-path> [<workspace-dest>] [--clean] [--json]
+
 Subagents (Daytona-native rewrite):
   dench agent spawn '<goal>' [--parent-run-id <id>] [--sandbox own|share_parent] [--time-budget-ms N]
   dench agent await --hook <token> | --children id1,id2,id3
@@ -3038,6 +3064,267 @@ async function runFilesCommand() {
   });
 }
 
+// ── dench stage ──────────────────────────────────────────────────────────
+//
+// Copy a tree from a /tmp scratch path into /workspace AND update the
+// Convex `fileTree` mirror so the UI tree reflects the new files
+// immediately. The agent's `stage_to_workspace` typed tool calls into
+// the same primitive server-side; this CLI variant exists so a human at
+// a sandbox shell (or a script) can run the same operation manually
+// without bouncing through the chat API.
+//
+// Why upload to Convex (instead of `cp -r local /workspace`):
+//   /workspace is FUSE-backed (Mountpoint-S3) and the file daemon
+//   reconciles between the volume and Convex. Uploading via Convex
+//   guarantees the UI tree updates immediately (no wait for the
+//   daemon's polling tick) and avoids stomping a daemon-in-flight
+//   change on the same path.
+
+const STAGE_IGNORED_BASENAMES = new Set([
+  ".DS_Store",
+  ".ds_store",
+  "Thumbs.db",
+  "thumbs.db",
+  "desktop.ini",
+]);
+
+const STAGE_IGNORED_DIRS = new Set([
+  ".git",
+  ".next",
+  ".vercel",
+  "__MACOSX",
+  "build",
+  "coverage",
+  "dist",
+  "node_modules",
+]);
+
+function shouldIgnoreStagePath(relPath: string): boolean {
+  const parts = relPath.split("/").filter(Boolean);
+  if (parts.some((p) => STAGE_IGNORED_DIRS.has(p))) return true;
+  const base = parts.at(-1) ?? "";
+  if (STAGE_IGNORED_BASENAMES.has(base)) return true;
+  if (base.startsWith("._")) return true;
+  if (
+    base === ".env" ||
+    (base.startsWith(".env.") &&
+      ![".env.example", ".env.sample", ".env.template"].includes(base))
+  ) {
+    return true;
+  }
+  if (base.endsWith(".pem") || base.endsWith(".key")) return true;
+  return false;
+}
+
+type DirEntryLike = {
+  name: string;
+  isDirectory(): boolean;
+  isFile(): boolean;
+};
+
+async function* walkLocalFiles(
+  rootAbs: string,
+): AsyncGenerator<{ absPath: string; rel: string; size: number }> {
+  const queue: string[] = [rootAbs];
+  while (queue.length > 0) {
+    const dir = queue.shift();
+    if (!dir) continue;
+    let entries: DirEntryLike[];
+    try {
+      // The Node typings for readdir({ withFileTypes: true }) lean on
+      // generics that bun's stub doesn't surface cleanly; cast through
+      // unknown so we get the {name, isDirectory, isFile} contract we
+      // actually depend on without dragging Dirent generics through.
+      entries = (await readdir(dir, {
+        withFileTypes: true,
+      })) as unknown as DirEntryLike[];
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      const abs = join(dir, entry.name);
+      const rel = relative(rootAbs, abs).replace(/\\/g, "/");
+      if (shouldIgnoreStagePath(rel)) continue;
+      if (entry.isDirectory()) {
+        queue.push(abs);
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      const stats = await stat(abs).catch(() => null);
+      if (!stats) continue;
+      yield { absPath: abs, rel, size: stats.size };
+    }
+  }
+}
+
+async function runStage() {
+  const runtime = await getRuntime();
+  const apiKey = requireFilesApiKey(runtime, "dench stage");
+  const localRaw = positional(1);
+  const destRaw = positional(2);
+  if (!localRaw) {
+    throw new CliError(
+      "Usage: dench stage <local-path> [<workspace-dest>] [--clean] [--json]",
+      {
+        code: "stage_usage",
+        nextActions: [
+          "Pass an absolute local path (typically under /tmp) to stage from.",
+          "Optional second arg is the /workspace destination (defaults to /<basename>).",
+        ],
+      },
+    );
+  }
+  const localAbs = resolve(localRaw);
+  if (localAbs.startsWith("/workspace/") || localAbs === "/workspace") {
+    throw new CliError(
+      `localPath must not be inside /workspace (got ${localAbs}). Stage from /tmp scratch instead.`,
+      { code: "stage_local_in_workspace" },
+    );
+  }
+
+  let localStat: Awaited<ReturnType<typeof stat>>;
+  try {
+    localStat = await stat(localAbs);
+  } catch (error) {
+    throw new CliError(
+      `Local path not found: ${localAbs} (${error instanceof Error ? error.message : String(error)})`,
+      { code: "stage_local_missing" },
+    );
+  }
+
+  // Default workspace destination = /<basename of source>. The agent
+  // typed tool requires explicit dest; the CLI gives a friendly default
+  // because humans usually want "stage this dir to /workspace/<dir>".
+  const destWorkspace = destRaw
+    ? normalizeFilesPath(destRaw)
+    : normalizeFilesPath(`/${basename(localAbs)}`);
+  const clean = hasFlag("--clean");
+  // `--json` is consumed at the top of the file into the module-level
+  // `json` flag (and filtered out of `args`); read that, not `hasFlag`.
+  const jsonOut = json;
+
+  if (clean) {
+    // Wipe Convex rows under destWorkspace so a clean install really
+    // is clean. The daemon will mirror the deletes onto the volume
+    // on its next reconcile tick.
+    const existing = await listConvexTreeRecursive(
+      runtime,
+      apiKey,
+      destWorkspace,
+    );
+    const fileRows = existing.filter((r) => !r.isDir);
+    const dirRows = existing.filter((r) => r.isDir);
+    dirRows.sort((a, b) => b.path.length - a.path.length);
+    for (const row of fileRows) {
+      await runtime.client.mutation(api.functions.files.deleteFile, {
+        path: row.path,
+        apiKey,
+      } as never);
+    }
+    for (const row of dirRows) {
+      await runtime.client.mutation(api.functions.files.deleteFile, {
+        path: row.path,
+        apiKey,
+      } as never);
+    }
+  }
+
+  const staged: Array<{ from: string; to: string; bytes: number }> = [];
+  const recordedDirs = new Set<string>();
+  let bytesStaged = 0;
+
+  // `commitFileUpload` only inserts the leaf file row — it does NOT
+  // create rows for the file's intermediate parent dirs. Without
+  // those, `listTree(prefix)` won't surface a `sub` directory in the
+  // UI tree even when `sub/notes.txt` exists. We record each unique
+  // parent dir explicitly via `recordDirCreate` so the right-pane
+  // tree mirrors the staged structure 1:1.
+  async function ensureDirRowsFor(filePath: string): Promise<void> {
+    let parent = parentOfPath(filePath);
+    while (parent && parent !== "/" && !recordedDirs.has(parent)) {
+      recordedDirs.add(parent);
+      try {
+        await runtime.client.mutation(api.functions.files.recordDirCreate, {
+          path: parent,
+          apiKey,
+        } as never);
+      } catch (error) {
+        // Best-effort: a transient failure on a single dir shouldn't
+        // fail the entire stage. The leaf files are already persisted;
+        // worst case the daemon's reconciler picks up the dir on its
+        // next tick.
+        if (!jsonOut) {
+          process.stderr.write(
+            `dench stage: warn — recordDirCreate ${parent} failed: ${
+              error instanceof Error ? error.message : String(error)
+            }\n`,
+          );
+        }
+      }
+      parent = parentOfPath(parent);
+    }
+  }
+
+  if (localStat.isFile()) {
+    const bytes = await readFile(localAbs);
+    const dest = destWorkspace;
+    await ensureDirRowsFor(dest);
+    await uploadConvexFileBytes(runtime, apiKey, {
+      path: dest,
+      bytes: new Uint8Array(bytes),
+    });
+    staged.push({ from: localAbs, to: dest, bytes: bytes.byteLength });
+    bytesStaged += bytes.byteLength;
+  } else if (localStat.isDirectory()) {
+    for await (const entry of walkLocalFiles(localAbs)) {
+      const dest = entry.rel
+        ? normalizeFilesPath(`${destWorkspace}/${entry.rel}`)
+        : destWorkspace;
+      await ensureDirRowsFor(dest);
+      const bytes = await readFile(entry.absPath);
+      await uploadConvexFileBytes(runtime, apiKey, {
+        path: dest,
+        bytes: new Uint8Array(bytes),
+      });
+      staged.push({
+        from: entry.absPath,
+        to: dest,
+        bytes: bytes.byteLength,
+      });
+      bytesStaged += bytes.byteLength;
+      if (!jsonOut && staged.length % 25 === 0) {
+        process.stdout.write(
+          `dench stage: ${staged.length} files, ${bytesStaged}B…\n`,
+        );
+      }
+    }
+  } else {
+    throw new CliError(
+      `Local path is neither a file nor a directory: ${localAbs}`,
+      { code: "stage_local_unsupported" },
+    );
+  }
+
+  if (jsonOut) {
+    print({
+      ok: true,
+      localPath: localAbs,
+      workspacePath: destWorkspace,
+      filesStaged: staged.length,
+      bytesStaged,
+      files: staged,
+      clean,
+    });
+    return;
+  }
+
+  process.stdout.write(
+    `dench stage: ${staged.length} files (${bytesStaged}B) staged from ${localAbs} -> ${destWorkspace}${
+      clean ? " [clean install]" : ""
+    }\n`,
+  );
+}
+
 function parentOfPath(input: string): string {
   const normalized = normalizeFilesPath(input);
   if (normalized === "/") return "/";
@@ -3210,6 +3497,34 @@ async function main() {
     return;
   }
 
+  if (command === "stage") {
+    await runStage();
+    return;
+  }
+
+  if (command === "search") {
+    // `dench search` talks straight to the gateway over HTTP using
+    // DENCH_API_KEY; it deliberately bypasses requireSessionRuntime so
+    // it works in any sandbox / CI environment that has the key.
+    const subArgs = args.slice(args.indexOf("search") + 1);
+    const filteredSubArgs = subArgs.filter((a) => a !== "--json");
+    const { runSearchCommand } = await import("./search");
+    await runSearchCommand({ args: filteredSubArgs, jsonOutput: json });
+    return;
+  }
+
+  if (command === "image") {
+    // `dench image generate|edit` mirrors `dench search`: straight HTTP
+    // to the gateway with DENCH_API_KEY, no Convex session required.
+    // The gateway writes the bytes to Convex Storage on success; we
+    // also drop them on local disk so the next bash command sees them.
+    const subArgs = args.slice(args.indexOf("image") + 1);
+    const filteredSubArgs = subArgs.filter((a) => a !== "--json");
+    const { runImageCommand } = await import("./image");
+    await runImageCommand({ args: filteredSubArgs, jsonOutput: json });
+    return;
+  }
+
   if (command === "chat") {
     const subArgs = args.slice(args.indexOf("chat") + 1);
     const sub = subArgs[0];
@@ -3298,6 +3613,35 @@ async function main() {
     return;
   }
 
+  if (command === "cron") {
+    const subArgs = args.slice(args.indexOf("cron") + 1);
+    const sub = subArgs[0];
+    // Help is a no-auth path so users can read the surface without a
+    // session — mirrors `dench crm help`.
+    if (!sub || sub === "help" || sub === "--help") {
+      const { runCronCommand } = await import("./cron");
+      // biome-ignore lint/suspicious/noExplicitAny: help-only stub, never queries
+      await runCronCommand({ convex: {} as any, args: subArgs });
+      return;
+    }
+    const { runCronCommand } = await import("./cron");
+    const runtime = await getRuntime();
+    // Cron CRUD is org-scoped — accept either an agent session token
+    // (`dch_agent_*` from `dench login`) or a unified Dench API key
+    // (`DENCH_API_KEY` baked into sandbox envVars). Server-side
+    // `requireCronAccess` (convex/lib/cronAccess.ts) dispatches on the
+    // bearer prefix and resolves the org for both. The Bearer token
+    // must carry `crons:read` (queries) or `crons:write` (mutations)
+    // scope, or the wildcard `*`.
+    const authedRuntime = requireAuthenticatedRuntime(runtime, "dench cron");
+    await runCronCommand({
+      convex: authedRuntime.client,
+      args: subArgs,
+      sessionToken: authedRuntime.sessionToken,
+    });
+    return;
+  }
+
   if (command === "login") {
     await login();
     return;