@dench.com/cli 0.3.8 → 0.4.1

package/dench.ts

@@ -38,6 +38,7 @@ import {
   withCurrentSessionSelection,
   withSavedSession,
 } from "./session";
+import { fetchConnectedAppsSummary, runToolCommand } from "./tools";
 
 type JsonRecord = Record<string, unknown>;
 
@@ -172,20 +173,6 @@ const api = {
         "functions/agentWorkspace:whatCanIDoHere",
       ),
     },
-    agentToolsNode: {
-      agentToolConnect: makeFunctionReference<"action">(
-        "functions/agentToolsNode:agentToolConnect",
-      ),
-      agentToolRun: makeFunctionReference<"action">(
-        "functions/agentToolsNode:agentToolRun",
-      ),
-      agentToolSearch: makeFunctionReference<"action">(
-        "functions/agentToolsNode:agentToolSearch",
-      ),
-      agentToolStatus: makeFunctionReference<"action">(
-        "functions/agentToolsNode:agentToolStatus",
-      ),
-    },
     files: {
       listTree: makeFunctionReference<"query">("functions/files:listTree"),
       deleteFile: makeFunctionReference<"mutation">(
@@ -362,7 +349,7 @@ function normalizeCliError(error: unknown): CliError {
   return new CliError(message);
 }
 
-function parseJsonObjectOption(name: string) {
+function _parseJsonObjectOption(name: string) {
   const raw = option(name);
   if (!raw) return {};
   let parsed: unknown;
@@ -492,6 +479,10 @@ Past chat threads (own + shared in this workspace):
   dench chat list [--query <substr>] [--limit N] [--include-archived] [--json]
   dench chat search "<query>" [--limit N] [--include-current] [--json]
   dench chat read <thread-id> [--limit N] [--json]
+  dench chat rename <thread-id> <new-title> [--json]
+  dench chat rename --from-stdin [--json]            (batch via JSON {items:[...]})
+  dench chat delete <thread-id> [<thread-id>...] [--yes] [--json]
+  dench chat delete --ids id1,id2 [--yes] [--json]   (PERMANENTLY deletes threads)
 
 Spawn a new chat-turn workflow (same as the web UI):
   dench chat new "<prompt>" [--model <m>] [--file-context <path>] [--visibility private|shared] [--title T] [--yolo] [--follow] [--json]
@@ -534,6 +525,20 @@ Subagents (Daytona-native rewrite):
 
   dench --version
 
+Self-updating agent harness (OpenClaw parity):
+  dench identity show | edit                    IDENTITY.md (org-wide)
+  dench organisation show | edit                ORGANISATION.md
+  dench user show | edit                        USER.md (per-member)
+  dench tools show | edit                       TOOLS.md notes section
+  dench mem show | append "<text>" | set        MEMORY.md aggregate
+  dench heartbeat status | enable | disable
+                  | interval <30m|1h|…> | instructions
+  dench bootstrap status | complete | reopen | template
+  dench model default <id|clear>
+  dench model thread <threadId> <id|clear>
+  dench daily today | show <YYYY-MM-DD>
+  Help: dench identity help
+
 External tools:
   dench apps is an alias for dench tool status -- it lists connected apps.
   dench tool with no subcommand prints tool help.
@@ -576,16 +581,22 @@ function toolHelp() {
 Usage:
   dench apps [--json]
   dench tool status [toolkit] [--json]
-  dench tool connect <toolkit> [--json]
-  dench tool search "create github issue" [--toolkit github] [--limit 20] [--compact] [--json]
-  dench tool run <composio_tool_slug> --args '{"key":"value"}' [--account <connected_account_id>] [--approval <approvalId>] [--json]
+  dench tool connect <toolkit> [--callback-url <url>] [--json]
+  dench tool search "create github issue" [--toolkit github] [--limit 20] [--json]
+  dench tool run <composio_tool_slug> --args '{"key":"value"}' [--account <connectedAccountId>] [--json]
+  dench tool disconnect <connectionId> [--json]
+
+Auth:
+  All commands authenticate with DENCH_API_KEY (Bearer) directly to the
+  Dench Cloud Gateway. No \`dench login\` agent session is required —
+  inside a Dench sandbox the key is baked into the env automatically;
+  outside, export DENCH_API_KEY=<key> first.
 
 Notes:
-  dench apps lists all connected apps. It returns the same shape as dench tool status --json.
-  dench tool search prints compact ranked results by default. Add --json only when you need full schemas.
-  Run clear read-only FETCH, GET, LIST, SEARCH, READ, and FIND tools through Dench without manual approval.
-  Non-JSON tool run output redacts likely OTP codes, secrets, and tokens for display.
-  Dench enforces the final policy and returns requiresApproval when approval is needed.
+  dench apps is an alias for dench tool status.
+  dench tool connect prints the OAuth redirect URL for the human to open.
+  dench tool run output is redacted for display; pass --json for raw JSON.
+  Override the gateway base with DENCH_GATEWAY_URL or GATEWAY_URL.
 `);
 }
 
@@ -727,8 +738,10 @@ function appsHelp() {
 Usage:
   dench apps [--json]
 
-Lists all connected external apps for the current Dench session.
-This is an alias for dench tool status [--json].
+Lists all external apps connected to this organization (Slack, Gmail,
+GitHub, etc.). Authenticates with DENCH_API_KEY (Bearer) directly to the
+Dench Cloud Gateway — no \`dench login\` agent session required. Alias
+for \`dench tool status\`.
 `);
 }
 
@@ -1794,30 +1807,6 @@ async function getRuntime() {
       });
     }
 
-    // Sandbox session-mode path: workflow minting provisions a real
-    // dch_agent_* token at sandbox-create time. Prefer it over apiKey so
-    // agentWorkspace.* commands (Composio tools) work inside sandboxes.
-    const sandboxAgentToken = process.env.DENCH_AGENT_SESSION_TOKEN?.trim();
-    const sandboxConvexUrl = resolveApiKeyConvexUrl();
-    if (sandboxAgentToken && sandboxConvexUrl) {
-      const orgId = process.env.DENCH_ORG_ID?.trim();
-      const orgSlug = process.env.DENCH_ORG_SLUG?.trim();
-      const apiHost =
-        process.env.DENCH_API_URL?.trim() ||
-        process.env.DENCH_INTERNAL_BASE?.trim() ||
-        host;
-      return {
-        mode: "session" as const,
-        host: apiHost,
-        client: new ConvexHttpClient(sandboxConvexUrl),
-        sessionToken: sandboxAgentToken,
-        organization:
-          orgId && orgSlug
-            ? { id: orgId, name: orgSlug, slug: orgSlug }
-            : undefined,
-      };
-    }
-
     // Sandbox / automation path: the unified Dench API key + Convex URL
     // baked into sandbox envVars (see
     // src/lib/secrets/sandbox-tokens.ts) is enough to drive every
@@ -1905,10 +1894,7 @@ function requireSessionRuntime(
  * (`dench_*` / `gw_sk_*` / etc.) baked into sandbox envVars. The
  * server-side `requireCrmAccess` helper dispatches on the prefix.
  */
-type AuthenticatedRuntime = Extract<
-  Runtime,
-  { mode: "session" | "apiKey" }
->;
+type AuthenticatedRuntime = Extract<Runtime, { mode: "session" | "apiKey" }>;
 
 function requireAuthenticatedRuntime(
   runtime: Runtime,
@@ -1956,25 +1942,6 @@ function rejectApiKeyForAgentCommand(
   }
 }
 
-async function printToolStatus(runtime: Runtime, toolkit?: string) {
-  const sessionRuntime = requireSessionRuntime(runtime, "dench tool status");
-  try {
-    print(
-      await sessionRuntime.client.action(
-        api.functions.agentToolsNode.agentToolStatus,
-        {
-          sessionToken: sessionRuntime.sessionToken,
-          toolkit,
-        },
-      ),
-    );
-  } catch (error) {
-    const unavailable = toolGatewayUnavailable(error, { toolkit });
-    if (!unavailable) throw error;
-    print(json ? unavailable : formatToolUnavailable(unavailable));
-  }
-}
-
 function asRecord(value: unknown): JsonRecord | undefined {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     return undefined;
@@ -2010,7 +1977,7 @@ function numberField(record: JsonRecord | undefined, ...names: string[]) {
   return undefined;
 }
 
-function booleanField(record: JsonRecord | undefined, ...names: string[]) {
+function _booleanField(record: JsonRecord | undefined, ...names: string[]) {
   if (!record) return undefined;
   for (const name of names) {
     const value = record[name];
@@ -2033,94 +2000,6 @@ function isMissingConvexFunction(error: unknown) {
   return /Could not find public function/i.test(errorMessage(error));
 }
 
-function toolGatewayUnavailable(error: unknown, context: JsonRecord = {}) {
-  const message = errorMessage(error);
-  if (!/gateway API key|callGateway|Composio/i.test(message)) {
-    return null;
-  }
-  const invalidKey = /Invalid gateway API key/i.test(message);
-  const query = stringField(context, "query");
-  const toolkit = stringField(context, "toolkit");
-  const retryCommand = query
-    ? `Retry dench tool search ${JSON.stringify(query)}${toolkit ? ` --toolkit ${toolkit}` : ""} after the gateway key is fixed.`
-    : "Retry dench apps --json after the gateway key is fixed.";
-  return {
-    ok: false,
-    available: false,
-    code: invalidKey ? "invalid_gateway_api_key" : "tool_gateway_unavailable",
-    reason: invalidKey
-      ? "The workspace gateway key is invalid or out of sync."
-      : "The connected-app gateway is unavailable.",
-    ...context,
-    nextActions: [
-      "Ask a workspace admin to repair or rotate the Dench gateway key.",
-      retryCommand,
-    ],
-  };
-}
-
-function formatToolUnavailable(payload: JsonRecord) {
-  return [
-    "Connected apps unavailable.",
-    `Reason: ${stringField(payload, "reason") ?? "tool gateway unavailable"}`,
-    "",
-    "Next actions:",
-    ...(
-      (Array.isArray(payload.nextActions)
-        ? payload.nextActions
-        : []) as unknown[]
-    )
-      .filter((item): item is string => typeof item === "string")
-      .map((item) => `  - ${item}`),
-  ].join("\n");
-}
-
-const READ_ONLY_TOOL_ACTIONS = new Set([
-  "FETCH",
-  "GET",
-  "LIST",
-  "SEARCH",
-  "READ",
-  "FIND",
-]);
-
-function toolSlugTokens(toolSlug: string) {
-  return toolSlug
-    .toUpperCase()
-    .split(/[^A-Z0-9]+/)
-    .filter(Boolean);
-}
-
-function toolApprovalHint(toolSlug: string | undefined) {
-  if (!toolSlug) return "approval unknown";
-  const readOnly = toolSlugTokens(toolSlug).find((token) =>
-    READ_ONLY_TOOL_ACTIONS.has(token),
-  );
-  return readOnly ? `read-only (${readOnly})` : "approval likely";
-}
-
-function compactConnection(connection: JsonRecord) {
-  return {
-    toolkit: stringField(connection, "toolkit") ?? "unknown",
-    status: stringField(connection, "status") ?? "unknown",
-    connectedAccountId:
-      stringField(connection, "connectedAccountId", "connected_account_id") ??
-      stringField(connection, "id"),
-    accountLabel:
-      stringField(connection, "accountLabel", "account_label", "label") ?? null,
-  };
-}
-
-function summarizeConnectedApps(value: unknown) {
-  const record = asRecord(value);
-  const connections = asRecordArray(record?.connections).map(compactConnection);
-  return {
-    available: true,
-    count: connections.length,
-    connections,
-  };
-}
-
 function workspaceSlugFromContext(context: JsonRecord) {
   const workspace = asRecord(context.workspace);
   return (
@@ -2147,41 +2026,12 @@ function nextContextCommands() {
   ];
 }
 
-async function connectedAppsContext(runtime: Runtime) {
-  if (runtime.mode !== "session") {
-    return {
-      available: false,
-      reason: "Connected apps require a logged-in Dench agent session.",
-      count: 0,
-      connections: [],
-    };
-  }
-
-  try {
-    return summarizeConnectedApps(
-      await runtime.client.action(
-        api.functions.agentToolsNode.agentToolStatus,
-        {
-          sessionToken: runtime.sessionToken,
-        },
-      ),
-    );
-  } catch (error) {
-    const unavailable = toolGatewayUnavailable(error);
-    if (unavailable) {
-      return {
-        ...unavailable,
-        count: 0,
-        connections: [],
-      };
-    }
-    return {
-      available: false,
-      error: errorMessage(error),
-      count: 0,
-      connections: [],
-    };
-  }
+async function connectedAppsContext(_runtime: Runtime) {
+  // Reach the Dench gateway directly with DENCH_API_KEY (mirrors the
+  // denchclaw pattern). This works for every Runtime mode — session,
+  // apiKey, dev — because the gateway only cares about the bearer key,
+  // not which Convex session is calling.
+  return fetchConnectedAppsSummary();
 }
 
 async function buildContext(runtime: Runtime) {
@@ -2420,223 +2270,6 @@ function formatContext(context: JsonRecord) {
   return lines.join("\n");
 }
 
-function toolkitSlugFromTool(tool: JsonRecord) {
-  const toolkit = tool.toolkit;
-  if (typeof toolkit === "string") return toolkit;
-  const toolkitRecord = asRecord(toolkit);
-  return (
-    stringField(toolkitRecord, "slug", "name") ??
-    stringField(tool, "toolkit_slug")
-  );
-}
-
-function connectedToolkitSet(data: JsonRecord | undefined) {
-  const connected = new Set<string>();
-  const connectedToolkits = Array.isArray(data?.connected_toolkits)
-    ? data?.connected_toolkits
-    : [];
-  for (const toolkit of connectedToolkits) {
-    const value = stringValue(toolkit);
-    if (value) connected.add(value.toLowerCase());
-  }
-  for (const status of asRecordArray(data?.toolkit_connection_statuses)) {
-    const toolkit = stringField(status, "toolkit");
-    const isConnected = booleanField(status, "has_active_connection");
-    if (toolkit && isConnected) connected.add(toolkit.toLowerCase());
-  }
-  return connected;
-}
-
-function searchToolItems(searchResult: unknown) {
-  const root = asRecord(searchResult);
-  const data = asRecord(root?.data) ?? root;
-  const directItems = asRecordArray(data?.items);
-  if (directItems.length > 0) {
-    return { data, items: directItems };
-  }
-
-  const schemas = asRecord(data?.tool_schemas);
-  if (!schemas) return { data, items: [] };
-  return {
-    data,
-    items: Object.entries(schemas).flatMap<JsonRecord>(([slug, value]) => {
-      const tool = asRecord(value);
-      return tool
-        ? [{ ...tool, tool_slug: stringField(tool, "tool_slug") ?? slug }]
-        : [];
-    }),
-  };
-}
-
-function compactToolSearchResult(searchResult: unknown) {
-  const root = asRecord(searchResult);
-  const { data, items } = searchToolItems(searchResult);
-  const connected = connectedToolkitSet(data);
-  const tools = items.map((tool) => {
-    const toolkit = toolkitSlugFromTool(tool);
-    const connectionStatus = asRecord(tool.connection_status);
-    const isConnected =
-      booleanField(connectionStatus, "is_connected") ??
-      (toolkit ? connected.has(toolkit.toLowerCase()) : undefined);
-    const slug = stringField(tool, "slug", "tool_slug") ?? "unknown_tool";
-    return {
-      slug,
-      name: stringField(tool, "display_name", "name") ?? slug,
-      toolkit: toolkit ?? "unknown",
-      approval: toolApprovalHint(slug),
-      connected:
-        isConnected === undefined
-          ? "connection unknown"
-          : isConnected
-            ? "connected"
-            : "not connected",
-      description: compactLine(tool.description) ?? null,
-    };
-  });
-
-  return {
-    ok: root?.ok ?? true,
-    query: stringField(root, "query") ?? stringField(data, "query") ?? null,
-    returned: tools.length,
-    total:
-      numberField(data, "total_items", "total", "count") ??
-      numberField(root, "total_items", "total", "count") ??
-      tools.length,
-    tools,
-  };
-}
-
-function formatToolSearchResult(searchResult: unknown) {
-  const summary = compactToolSearchResult(searchResult);
-  const query = summary.query ? ` for "${summary.query}"` : "";
-  if (summary.tools.length === 0) {
-    return `No matching tools found${query}.\nUse --json if you need the raw provider response.`;
-  }
-
-  const lines = [`Top tools${query}:`];
-  for (const [index, tool] of summary.tools.entries()) {
-    lines.push(
-      `${index + 1}. ${tool.slug} - ${tool.name}`,
-      `   toolkit: ${tool.toolkit} | ${tool.approval} | ${tool.connected}`,
-    );
-    if (tool.description) {
-      lines.push(`   ${tool.description}`);
-    }
-  }
-  lines.push(
-    "",
-    "Use dench tool run <slug> --args '{...}' when ready.",
-    "Use --json only when you need full schemas or raw arguments.",
-  );
-  return lines.join("\n");
-}
-
-function printToolSearchResult(searchResult: unknown) {
-  print(json ? searchResult : formatToolSearchResult(searchResult));
-}
-
-const SENSITIVE_KEY_RE =
-  /(?:otp|oneTime|verification|security|passcode|password|secret|api[_-]?key|access[_-]?token|refresh[_-]?token|authorization)/i;
-
-function redactSensitiveString(value: string) {
-  return value
-    .replace(
-      /\b((?:one[-\s]?time|verification|security|login|sign[-\s]?in|auth(?:entication)?|2fa|mfa|otp|passcode|code)[^.\n\r]{0,80}?)(\d[\d\s-]{2,10}\d)\b/gi,
-      "$1[redacted-code]",
-    )
-    .replace(
-      /\b((?:api[_\s-]?key|secret|token|password)[^.\n\r]{0,60}?)([A-Za-z0-9_=-]{12,})\b/gi,
-      "$1[redacted-secret]",
-    );
-}
-
-function redactSensitiveDisplay(value: unknown, key?: string): unknown {
-  if (typeof value === "string") {
-    return key && SENSITIVE_KEY_RE.test(key)
-      ? "[redacted]"
-      : redactSensitiveString(value);
-  }
-  if (typeof value === "number" && key && SENSITIVE_KEY_RE.test(key)) {
-    return "[redacted]";
-  }
-  if (Array.isArray(value)) {
-    return value.map((item) => redactSensitiveDisplay(item));
-  }
-  const record = asRecord(value);
-  if (!record) return value;
-
-  return Object.fromEntries(
-    Object.entries(record).map(([entryKey, entryValue]) => [
-      entryKey,
-      redactSensitiveDisplay(entryValue, entryKey),
-    ]),
-  );
-}
-
-function connectionUrlFromToolConnect(result: unknown) {
-  const record = asRecord(result);
-  const data = asRecord(record?.data);
-  return (
-    stringField(record, "connectUrl", "redirect_url", "redirectUrl", "url") ??
-    stringField(data, "redirect_url", "redirectUrl", "url")
-  );
-}
-
-function withToolConnectSummary(result: unknown) {
-  const record = asRecord(result);
-  if (!record) return result;
-  const toolkit = stringField(record, "toolkit") ?? "app";
-  const connectUrl = connectionUrlFromToolConnect(record);
-  if (!connectUrl) return record;
-  return {
-    ...record,
-    connectUrl,
-    linkText: `Connect ${toolkit} here`,
-    message: `Connect ${toolkit} here: ${connectUrl}`,
-  };
-}
-
-function formatToolConnectResult(result: unknown) {
-  const record = asRecord(withToolConnectSummary(result));
-  if (!record) return String(result);
-  const toolkit = stringField(record, "toolkit") ?? "app";
-  const connectUrl = stringField(record, "connectUrl");
-  if (connectUrl) {
-    return `Connect ${toolkit} here: ${connectUrl}`;
-  }
-  return JSON.stringify(record, null, 2);
-}
-
-function withToolRunGuidance(runtime: Runtime, result: unknown) {
-  const record = asRecord(result);
-  if (!record || record.requiresApproval !== true) return result;
-  const approvalId = stringField(record, "approvalId");
-  const statusContext =
-    runtime.mode === "session" || runtime.mode === "apiKey"
-      ? workspaceUrls(runtime.host, runtime.organization?.slug)
-      : {};
-  const approvalCommand = approvalId
-    ? `dench approval approve ${approvalId} --evidence "User said yes in chat" --json`
-    : undefined;
-  return {
-    ...record,
-    ...statusContext,
-    ...(approvalCommand ? { approvalCommand } : {}),
-    nextActions: [
-      "Ask the human for an explicit yes/no in chat.",
-      ...(approvalCommand ? [`If yes, run: ${approvalCommand}`] : []),
-      approvalId
-        ? `Rerun the exact same dench tool run command with --approval ${approvalId}.`
-        : "Rerun the exact same dench tool run command after approval.",
-    ],
-  };
-}
-
-function printToolRunResult(runtime: Runtime, result: unknown) {
-  const guided = withToolRunGuidance(runtime, result);
-  print(json ? guided : redactSensitiveDisplay(guided));
-}
-
 async function devOverview(runtime: Awaited<ReturnType<typeof getRuntime>>) {
   if (runtime.mode !== "dev") {
     throw new Error("Not in dev mode");
@@ -2829,10 +2462,12 @@ async function runFsCommand() {
 function normalizeFilesPath(input: string): string {
   if (!input || input === "/") return "/";
   let cleaned = input.replace(/\\/g, "/").replace(/\/+/g, "/");
-  if (cleaned.startsWith("/workspace/")) cleaned = cleaned.slice("/workspace".length);
+  if (cleaned.startsWith("/workspace/"))
+    cleaned = cleaned.slice("/workspace".length);
   else if (cleaned === "/workspace") cleaned = "/";
   if (!cleaned.startsWith("/")) cleaned = `/${cleaned}`;
-  if (cleaned.length > 1 && cleaned.endsWith("/")) cleaned = cleaned.slice(0, -1);
+  if (cleaned.length > 1 && cleaned.endsWith("/"))
+    cleaned = cleaned.slice(0, -1);
   return cleaned;
 }
 
@@ -3010,9 +2645,9 @@ async function runFilesMv() {
   }
 
   const sourceRows = await listConvexTreeRecursive(runtime, apiKey, from);
-  const sourceSelf = (await listConvexTreeAt(runtime, apiKey, parentOfPath(from))).find(
-    (row) => row.path === from,
-  );
+  const sourceSelf = (
+    await listConvexTreeAt(runtime, apiKey, parentOfPath(from))
+  ).find((row) => row.path === from);
   if (!sourceSelf && sourceRows.length === 0) {
     throw new CliError(`Source not found in Convex: ${from}`, {
       code: "files_mv_not_found",
@@ -3074,7 +2709,11 @@ async function runFilesRm() {
   const target = normalizeFilesPath(targetRaw);
   const recursive = hasFlag("--recursive") || hasFlag("-r");
 
-  const parentRows = await listConvexTreeAt(runtime, apiKey, parentOfPath(target));
+  const parentRows = await listConvexTreeAt(
+    runtime,
+    apiKey,
+    parentOfPath(target),
+  );
   const self = parentRows.find((row) => row.path === target);
   if (!self) {
     if (hasFlag("--json")) {
@@ -3621,6 +3260,25 @@ async function main() {
     return;
   }
 
+  if (command === "apps") {
+    // `dench apps` is an alias for `dench tool status`. Both speak
+    // straight HTTP to the Dench Cloud Gateway with DENCH_API_KEY —
+    // mirrors the denchclaw pattern. No Convex session involved.
+    await runToolCommand({ args: ["status"], jsonOutput: json });
+    return;
+  }
+
+  if (command === "tool") {
+    // `dench tool {status,connect,search,run,disconnect}` is the model-facing
+    // composio surface and only needs DENCH_API_KEY (Bearer) on the
+    // gateway. Bypasses requireSessionRuntime entirely so it works in
+    // every sandbox / API-key context.
+    const subArgs = stripRuntimeFlags(args.slice(args.indexOf("tool") + 1));
+    const filteredSubArgs = subArgs.filter((a) => a !== "--json");
+    await runToolCommand({ args: filteredSubArgs, jsonOutput: json });
+    return;
+  }
+
   if (command === "chat") {
     const subArgs = args.slice(args.indexOf("chat") + 1);
     const sub = subArgs[0];
@@ -3713,8 +3371,11 @@ async function main() {
     return;
   }
 
-  if (command === "cron") {
-    const subArgs = args.slice(args.indexOf("cron") + 1);
+  // `dench routine` / `dench routines` are UI-friendly aliases for
+  // `dench cron`. Same dispatch, same auth, same handler — only the
+  // top-level command name differs to match the workspace UI rename.
+  if (command === "cron" || command === "routine" || command === "routines") {
+    const subArgs = args.slice(args.indexOf(command) + 1);
     const sub = subArgs[0];
     // Help is a no-auth path so users can read the surface without a
     // session — mirrors `dench crm help`.
@@ -3733,7 +3394,10 @@ async function main() {
     // bearer prefix and resolves the org for both. The Bearer token
     // must carry `crons:read` (queries) or `crons:write` (mutations)
     // scope, or the wildcard `*`.
-    const authedRuntime = requireAuthenticatedRuntime(runtime, "dench cron");
+    const authedRuntime = requireAuthenticatedRuntime(
+      runtime,
+      `dench ${command}`,
+    );
     await runCronCommand({
       convex: authedRuntime.client,
       args: subArgs,
@@ -3742,6 +3406,85 @@ async function main() {
     return;
   }
 
+  // ── OpenClaw-parity self-update CLI surface ──────────────────────────
+  //
+  // Dispatch all `dench identity / organisation / user / tools / mem /
+  // heartbeat / bootstrap / model / daily` traffic through the shared
+  // agent-config CLI module. Each command requires the same auth shape
+  // as `dench cron` (Bearer DENCH_API_KEY or `dench login` session
+  // token) so server-side `requireCronAccess` accepts both.
+  const AGENT_CONFIG_COMMANDS = new Set([
+    "identity",
+    "organisation",
+    "user",
+    "tools",
+    "mem",
+    "heartbeat",
+    "bootstrap",
+    "model",
+    "daily",
+  ]);
+  if (AGENT_CONFIG_COMMANDS.has(command)) {
+    const subArgs = args.slice(args.indexOf(command) + 1);
+    if (
+      subArgs[0] === "help" ||
+      subArgs.includes("--help") ||
+      subArgs.includes("-h")
+    ) {
+      const { printAgentConfigCliHelp } = await import("./agent-config");
+      printAgentConfigCliHelp();
+      return;
+    }
+    const runtime = await getRuntime();
+    const authedRuntime = requireAuthenticatedRuntime(
+      runtime,
+      `dench ${command}`,
+    );
+    const ctxBase = {
+      convex: authedRuntime.client,
+      args: subArgs,
+      jsonOutput: json,
+      sessionToken: authedRuntime.sessionToken,
+    };
+    const mod = await import("./agent-config");
+    if (command === "identity") {
+      await mod.runIdentityCommand(ctxBase);
+      return;
+    }
+    if (command === "organisation") {
+      await mod.runOrganisationCommand(ctxBase);
+      return;
+    }
+    if (command === "user") {
+      await mod.runUserCommand(ctxBase);
+      return;
+    }
+    if (command === "tools") {
+      await mod.runToolsCommand(ctxBase);
+      return;
+    }
+    if (command === "mem") {
+      await mod.runMemoryAggregateCommand(ctxBase);
+      return;
+    }
+    if (command === "heartbeat") {
+      await mod.runHeartbeatCommand(ctxBase);
+      return;
+    }
+    if (command === "bootstrap") {
+      await mod.runBootstrapCommand(ctxBase);
+      return;
+    }
+    if (command === "model") {
+      await mod.runModelCommand(ctxBase);
+      return;
+    }
+    if (command === "daily") {
+      await mod.runDailyCommand(ctxBase);
+      return;
+    }
+  }
+
   if (command === "login") {
     await login();
     return;
@@ -3786,11 +3529,6 @@ async function main() {
     return;
   }
 
-  if (command === "apps") {
-    await printToolStatus(runtime);
-    return;
-  }
-
   if (command === "context") {
     const context = await buildContext(runtime);
     print(json ? context : formatContext(context));
@@ -3943,9 +3681,7 @@ async function main() {
       return;
     }
     if (runtime.mode === "apiKey") {
-      throw loginRequiredError(
-        "dench tasks (agent-scoped task list)",
-      );
+      throw loginRequiredError("dench tasks (agent-scoped task list)");
     }
     const data = await devOverview(runtime);
     print(data.tasks);
@@ -4235,79 +3971,6 @@ async function main() {
     return;
   }
 
-  if (command === "tool") {
-    const sessionRuntime = requireSessionRuntime(runtime, "dench tool");
-
-    if (subcommand === "status") {
-      await printToolStatus(sessionRuntime, positional(2));
-      return;
-    }
-
-    if (subcommand === "connect") {
-      const toolkit = positional(2);
-      if (!toolkit) throw new Error("Missing toolkit");
-      const result = await sessionRuntime.client.action(
-        api.functions.agentToolsNode.agentToolConnect,
-        {
-          sessionToken: sessionRuntime.sessionToken,
-          toolkit,
-          callbackUrl: option("--callback-url"),
-        },
-      );
-      print(
-        json ? withToolConnectSummary(result) : formatToolConnectResult(result),
-      );
-      return;
-    }
-
-    if (subcommand === "search") {
-      const query = positional(2);
-      if (!query) throw new Error("Missing search query");
-      try {
-        printToolSearchResult(
-          await sessionRuntime.client.action(
-            api.functions.agentToolsNode.agentToolSearch,
-            {
-              sessionToken: sessionRuntime.sessionToken,
-              query,
-              toolkit: option("--toolkit"),
-              limit: parseNumberOption("--limit"),
-            },
-          ),
-        );
-      } catch (error) {
-        const unavailable = toolGatewayUnavailable(error, {
-          query,
-          toolkit: option("--toolkit"),
-        });
-        if (!unavailable) throw error;
-        print(json ? unavailable : formatToolUnavailable(unavailable));
-      }
-      return;
-    }
-
-    if (subcommand === "run") {
-      const toolSlug = positional(2);
-      if (!toolSlug) throw new Error("Missing Composio tool slug");
-      printToolRunResult(
-        sessionRuntime,
-        await sessionRuntime.client.action(
-          api.functions.agentToolsNode.agentToolRun,
-          {
-            sessionToken: sessionRuntime.sessionToken,
-            toolSlug,
-            arguments: parseJsonObjectOption("--args"),
-            connectedAccountId: option("--account"),
-            approvalId: option("--approval") as never,
-          },
-        ),
-      );
-      return;
-    }
-
-    throw new Error(`Unknown tool command: ${filteredArgs.join(" ")}`);
-  }
-
   if (
     command === "approval" &&
     (subcommand === "approve" || subcommand === "reject")