@dench.com/cli 0.4.5 → 0.4.7

package/dench.ts

@@ -18,7 +18,12 @@ import { agentKindLabel, normalizeAgentKind } from "./agentKind";
 import {
   DEFAULT_HOST,
   isLocalHost,
+  LOCAL_HOST,
   normalizeHost,
+  PRODUCTION_API_URL,
+  PRODUCTION_CONVEX_URL,
+  PRODUCTION_HOST,
+  resolveBackendAlias,
   resolveHostFromArgs,
   STAGING_HOST,
 } from "./host";
@@ -29,7 +34,6 @@ import {
   listStoredSessionEntries,
   removeAllStoredSessions,
   removeStoredSession,
-  resolveConfigHost,
   resolveSessionScope,
   type SessionScope,
   type StoredSessionEntry,
@@ -65,6 +69,24 @@ type StoredSession = {
 };
 
 type ConfigFile = {
+  /**
+   * Explicit user choice of which Dench backend to talk to by default,
+   * set via `dench backend set <local|staging|prod|<url>>`. Takes
+   * precedence over the legacy `currentHost` field (which used to be
+   * silently updated by every `dench login` and caused the CLI to
+   * silently follow the last-logged-in environment).
+   *
+   * Resolution order in `resolveHost`:
+   *   1. CLI flags (`--prod`, `--staging`, `--backend`, `--host`)
+   *   2. `DENCH_HOST` env var
+   *   3. `defaultBackend` from this config
+   *   4. `PRODUCTION_HOST` (the safe fallback)
+   *
+   * `currentHost` / `currentHosts` / `currentSessionKey` /
+   * `currentSessionKeys` keep their old role of remembering which
+   * stored session to use, but they no longer drive backend choice.
+   */
+  defaultBackend?: string;
   currentHost?: string;
   currentSessionKey?: string;
   currentHosts?: Record<string, string>;
@@ -197,16 +219,6 @@ const api = {
 };
 const CONFIG_DIR = join(homedir(), ".dench");
 const CONFIG_PATH = join(CONFIG_DIR, "config.json");
-const AUTONOMOUS_DEFAULT_API_BASE = "http://localhost:3000";
-const SAFE_LONG_SESSION_CONSTRAINTS = [
-  "do not edit files",
-  "publish",
-  "deploy",
-  "spend money",
-  "send external messages",
-  "access secrets",
-  "or change production data unless the user explicitly approves it",
-];
 const args = process.argv.slice(2);
 const json = args.includes("--json");
 const filteredArgs = args.filter((arg) => arg !== "--json");
@@ -254,6 +266,7 @@ const BOOLEAN_FLAGS = new Set([
   "--staging",
   "--prod",
   "--no-open",
+  "--use-dev-env",
   "--version",
   "--yolo",
   "--ask-before-publishing",
@@ -417,6 +430,7 @@ Usage:
   dench sessions [--host <host>] [--json]
   dench use <session-key-or-workspace-slug> [--host <host>] [--json]
   dench logout [session-key-or-workspace-slug] [--session <key-or-scope>] [--host <host>] [--all] [--json]
+  dench backend [show|set|clear] [<production|staging|local|<url>>] [--json]
   dench context [--json]
   dench status [--mine|--self] [--json]
   dench tasks [--json]
@@ -442,8 +456,6 @@ Usage:
   dench tool connect <toolkit> [--json]
   dench tool search "create github issue" [--toolkit github] [--limit 20] [--compact] [--json]
   dench tool run <composio_tool_slug> --args '{"key":"value"}' [--account <connected_account_id>] [--approval <approvalId>] [--json]
-  dench autonomous run "Inspect this repo and summarize the relevant feature. Do not edit files, publish, deploy, spend money, send external messages, access secrets, or change production data." [--duration 1h] [--model <model>] [--api-base http://localhost:3000] [--yolo] [--json]
-
 CRM (Daytona-native rewrite):
   dench crm objects <list|get|create|update|rename|delete> ...
   dench crm fields <list|create|update|delete|reorder> <object> ...
@@ -561,13 +573,25 @@ Agent setup:
   Use dench memory and dench artifacts to continue from durable context.
   Do not create, claim, or log a setup task by default.
 
-Hosts:
-  Default production host: ${DEFAULT_HOST}
-  Staging: dench login --staging
-  Staging with explicit host: dench login --host ${STAGING_HOST}
-
-Dev fallback:
+Backends and hosts:
+  Default backend: ${DEFAULT_HOST} (overridden by \`dench backend set\`)
+  Show / change the persistent default:
+    dench backend show
+    dench backend set production | staging | local | <url>
+    dench backend clear
+  One-shot overrides for a single command:
+    dench --prod <cmd>
+    dench --staging <cmd>
+    dench --backend local <cmd>
+    dench --host https://example.com <cmd>
+    DENCH_HOST=https://example.com dench <cmd>
+
+Dev fallback (run against a local Convex deployment with a dev key):
   DENCH_DEV_AGENT_KEY=... DENCH_WORKSPACE=... NEXT_PUBLIC_CONVEX_URL=... dench status --dev
+  Inside the dench.com repo, --dev also auto-loads .env / .env.local
+  so GATEWAY_URL etc. flow through. Use --use-dev-env (or
+  DENCH_USE_DEV_ENV=1) when you want that auto-load without switching
+  the runtime to the dev workspace mode.
 
 Advanced:
   For long-lived agents or when the human asks:
@@ -602,26 +626,6 @@ Notes:
 `);
 }
 
-function autonomousHelp() {
-  console.log(`Dench Long Session commands
-
-Usage:
-  dench autonomous run "Inspect this repo and summarize the relevant feature. Do not edit files, publish, deploy, spend money, send external messages, access secrets, or change production data." [--duration 1h] [--model <model>] [--api-base http://localhost:3000] [--yolo] [--json]
-
-Notes:
-  Starts a Long Session through /api/runs.
-  Duration supports 30m, 1h, 3h, 5h, or until-done.
-  API base defaults to ${AUTONOMOUS_DEFAULT_API_BASE}.
-  Override with --api-base, --host, DENCH_AUTONOMOUS_API_BASE, or DENCH_HOST.
-  If needed, run dench login --host <api-base> once so the CLI can authenticate.
-  Omit --model to use the server default.
-  Approval flags: --ask-before-publishing --ask-before-spending --ask-before-external-messages --ask-before-production-changes --ask-before-secrets.
-  --yolo: skip every approval gate (overrides --ask-before-* / --approval-rules). Equivalent to the workspace's YOLO mode in /<slug>/settings -> Approvals.
-  Without any approval flags, the run inherits the workspace's Approvals policy from /<slug>/settings.
-  Safe goals should explicitly say: ${SAFE_LONG_SESSION_CONSTRAINTS.join(", ")}.
-`);
-}
-
 function contextHelp() {
   console.log(`Dench context
 
@@ -653,8 +657,8 @@ Usage:
   dench suggested-work [--json]
   dench suggested-work task <artifactId> [--json]
 
-Artifacts are durable Long Session outputs for human or agent review.
-Suggested work can be converted into a workspace task.
+Artifacts are durable outputs for human or agent review. Suggested work can
+be converted into a workspace task.
 `);
 }
 
@@ -667,8 +671,8 @@ Usage:
   dench what-can-i-do [--kind <kind>] [--name "AI Agent - Project"] [--no-open] [--json]
 
 Logs in if needed, then shows what this agent can do here: workspace rules,
-open work, suggested work, Long Session options, connected-tool commands,
-memory, approvals, and next actions.
+open work, suggested work, connected-tool commands, memory, approvals, and
+next actions.
 `);
 }
 
@@ -760,8 +764,49 @@ Notes:
 `);
 }
 
-function resolveHost(config: ConfigFile | undefined, scope: SessionScope) {
-  return resolveHostFromArgs(filteredArgs, resolveConfigHost(config, scope));
+function backendHelp() {
+  console.log(`Dench backend
+
+Usage:
+  dench backend                                         # alias for "show"
+  dench backend show [--json]
+  dench backend set <production|staging|local|<url>> [--json]
+  dench backend clear [--json]
+
+Aliases: prod = production, dev / localhost = local, stage = staging.
+
+What this does:
+  The default Dench backend is production (${PRODUCTION_HOST}). "dench backend set"
+  stores an explicit override in ~/.dench/config.json so every future
+  "dench" invocation talks to that backend by default. Use it instead of
+  relying on a stale currentHost from a past "dench login".
+
+  Setting the backend to "local" also opts the CLI into auto-loading
+  .env and .env.local from the dench.com workspace at startup, which is
+  needed for GATEWAY_URL and similar local-only env vars.
+
+One-shot overrides (no config change):
+  dench --prod <cmd>             # one command against production
+  dench --staging <cmd>          # one command against staging
+  dench --backend local <cmd>    # one command against http://localhost:3000
+  dench --host https://… <cmd>   # one command against a custom URL
+  DENCH_HOST=https://… dench …   # same, via env
+
+Opt into dev .env auto-loading without changing the default backend:
+  --use-dev-env             # one-shot flag
+  DENCH_USE_DEV_ENV=1       # env var (e.g. via direnv)
+`);
+}
+
+function resolveHost(config: ConfigFile | undefined, _scope: SessionScope) {
+  // `defaultBackend` is only ever set via `dench backend set`, so it
+  // represents an explicit user choice. Production wins on fresh
+  // installs (no flags, no env, no config) — which is the safe default
+  // for an agent CLI. The per-scope `currentHosts[scope.key]` map is
+  // intentionally NOT consulted here so that a past `dench login
+  // --host http://localhost:3000` doesn't silently keep routing every
+  // future command at local dev.
+  return resolveHostFromArgs(filteredArgs, config?.defaultBackend);
 }
 
 async function loadConfig(): Promise<ConfigFile> {
@@ -900,6 +945,194 @@ function formatSessionChoices(
   return lines.length > 0 ? lines.join("\n") : "  No Dench sessions found.";
 }
 
+function backendLabelForHost(host: string) {
+  const normalized = normalizeHost(host);
+  if (normalized === PRODUCTION_HOST) return "production";
+  if (normalized === STAGING_HOST) return "staging";
+  if (isLocalHost(normalized)) return "local";
+  return "custom";
+}
+
+function backendSnapshot(config: ConfigFile) {
+  const resolved = resolveHost(config, {
+    key: "auto:backend-show",
+    label: "cwd",
+  });
+  const stored = config.defaultBackend?.trim()
+    ? normalizeHost(config.defaultBackend.trim())
+    : null;
+  const envHost = process.env.DENCH_HOST?.trim() || null;
+  const argBackend =
+    option("--backend") ?? (hasFlag("--prod")
+      ? "production"
+      : hasFlag("--staging")
+        ? "staging"
+        : option("--host") ?? null);
+
+  let source: "flag" | "env" | "config" | "default";
+  if (argBackend) source = "flag";
+  else if (envHost) source = "env";
+  else if (stored) source = "config";
+  else source = "default";
+
+  return {
+    host: resolved,
+    label: backendLabelForHost(resolved),
+    source,
+    defaultBackend: stored,
+    envHost,
+    knownBackends: {
+      production: PRODUCTION_HOST,
+      staging: STAGING_HOST,
+      local: LOCAL_HOST,
+    },
+  };
+}
+
+function formatBackendShow(snapshot: ReturnType<typeof backendSnapshot>) {
+  const sourceHint =
+    snapshot.source === "flag"
+      ? "(set via CLI flag for this invocation)"
+      : snapshot.source === "env"
+        ? "(set via DENCH_HOST env var)"
+        : snapshot.source === "config"
+          ? "(set via `dench backend set`)"
+          : "(default — no explicit choice in env or config)";
+  const lines = [
+    `Active backend: ${snapshot.host} [${snapshot.label}] ${sourceHint}`,
+  ];
+  if (snapshot.defaultBackend && snapshot.source !== "config") {
+    lines.push(`Stored default backend: ${snapshot.defaultBackend}`);
+  }
+  if (snapshot.envHost) {
+    lines.push(`DENCH_HOST env: ${snapshot.envHost}`);
+  }
+  lines.push(
+    "",
+    "Manage default backend:",
+    "  dench backend set production            # default fallback",
+    "  dench backend set staging",
+    "  dench backend set local                 # http://localhost:3000",
+    "  dench backend set https://example.com   # custom URL",
+    "  dench backend clear                     # revert to production default",
+    "",
+    "One-shot override flags also work on every command:",
+    "  dench --prod <cmd>     dench --staging <cmd>",
+    "  dench --backend local <cmd>     dench --host https://example.com <cmd>",
+  );
+  return lines.join("\n");
+}
+
+async function backendShow() {
+  const config = await loadConfig();
+  const snapshot = backendSnapshot(config);
+  print(json ? snapshot : formatBackendShow(snapshot));
+}
+
+async function backendSet() {
+  const target = positional(2);
+  if (!target) {
+    throw new CliError(
+      "Missing backend value. Pass local, staging, prod, or a URL.",
+      {
+        code: "backend_set_missing_value",
+        nextActions: [
+          "Run dench backend set production.",
+          "Run dench backend set local.",
+          "Run dench backend set https://your-host.example.com.",
+        ],
+      },
+    );
+  }
+  let resolved: string;
+  try {
+    resolved = resolveBackendAlias(target);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new CliError(message, {
+      code: "backend_set_invalid_value",
+      nextActions: [
+        "Run dench backend set production / staging / local.",
+        "Or pass an explicit URL: dench backend set https://your-host.example.com.",
+      ],
+    });
+  }
+  const config = await loadConfig();
+  await saveConfig({ ...config, defaultBackend: resolved });
+  const label = backendLabelForHost(resolved);
+  if (json) {
+    print({
+      ok: true,
+      defaultBackend: resolved,
+      label,
+      message: `Default Dench backend set to ${resolved} (${label}).`,
+    });
+    return;
+  }
+  print(`Default Dench backend set to ${resolved} (${label}).`);
+  if (label === "local") {
+    print(
+      "Local backend selected. dench will now also load .env / .env.local from the workspace so GATEWAY_URL etc. are picked up.",
+    );
+  }
+  print("Future `dench` commands without --prod/--staging/--host will target this backend.");
+}
+
+async function backendClear() {
+  const config = await loadConfig();
+  if (!config.defaultBackend) {
+    print(
+      json
+        ? { ok: true, cleared: false, defaultBackend: null }
+        : "No default backend is set. dench already falls back to production.",
+    );
+    return;
+  }
+  const previous = config.defaultBackend;
+  const next: ConfigFile = { ...config };
+  delete next.defaultBackend;
+  await saveConfig(next);
+  print(
+    json
+      ? {
+          ok: true,
+          cleared: true,
+          previous,
+          defaultBackend: null,
+          fallback: PRODUCTION_HOST,
+        }
+      : `Cleared default backend (was ${previous}). dench will fall back to ${PRODUCTION_HOST}.`,
+  );
+}
+
+async function runBackendCommand() {
+  const sub = positional(1);
+  if (!sub || sub === "show" || sub === "status") {
+    await backendShow();
+    return;
+  }
+  if (sub === "set") {
+    await backendSet();
+    return;
+  }
+  if (sub === "clear" || sub === "reset" || sub === "unset") {
+    await backendClear();
+    return;
+  }
+  if (sub === "help" || sub === "--help" || sub === "-h") {
+    backendHelp();
+    return;
+  }
+  throw new CliError(`Unknown dench backend subcommand: ${sub}`, {
+    code: "unknown_backend_subcommand",
+    nextActions: [
+      "Run dench backend show to print the active backend.",
+      "Run dench backend set <local|staging|prod|<url>>.",
+      "Run dench backend clear to revert to production.",
+    ],
+  });
+}
+
 async function listSessions() {
   const config = await loadConfig();
   const scope = resolveSessionScope({ args: filteredArgs });
@@ -1395,176 +1628,6 @@ function normalizeApiBase(input: string) {
   return new URL(withProtocol).origin;
 }
 
-function resolveAutonomousApiBase() {
-  const explicit =
-    option("--api-base") ??
-    option("--host") ??
-    process.env.DENCH_AUTONOMOUS_API_BASE ??
-    process.env.DENCH_HOST;
-  return explicit ? normalizeApiBase(explicit) : AUTONOMOUS_DEFAULT_API_BASE;
-}
-
-async function resolveAutonomousSessionToken(apiBase: string) {
-  const config = await loadConfig();
-  const scope = resolveSessionScope({ args: filteredArgs });
-  const stored = await getStoredSession(apiBase, scope);
-  if (stored.status === "found") {
-    return stored.session.sessionToken;
-  }
-  if (stored.status === "ambiguous") {
-    throw new Error(ambiguousSessionMessage(config, scope, apiBase));
-  }
-  return undefined;
-}
-
-function formatAutonomousRunResult(value: unknown) {
-  const record = asRecord(value);
-  if (!record) {
-    return typeof value === "string" ? value : JSON.stringify(value, null, 2);
-  }
-
-  const runId = stringField(record, "runId", "id");
-  const workflowRunId = stringField(record, "workflowRunId");
-  const status = stringField(record, "status");
-  const url = stringField(record, "url", "runUrl");
-
-  if (!runId && !workflowRunId && !status && !url) {
-    return JSON.stringify(value, null, 2);
-  }
-
-  const lines = ["Started Long Session"];
-  if (runId) lines.push(`Run ID: ${runId}`);
-  if (workflowRunId) lines.push(`Workflow Run ID: ${workflowRunId}`);
-  if (status) lines.push(`Status: ${status}`);
-  if (url) lines.push(`URL: ${url}`);
-  return lines.join("\n");
-}
-
-function autonomousRunUrl(apiBase: string, runId: string) {
-  return `${apiBase.replace(/\/+$/, "")}/labs/autonomous/${encodeURIComponent(runId)}`;
-}
-
-function withAutonomousRunUrl(payload: unknown, apiBase: string) {
-  const record = asRecord(payload);
-  const runId = stringField(record, "runId", "id");
-  if (!record || !runId || stringField(record, "runUrl", "url")) {
-    return payload;
-  }
-  return { ...record, runUrl: autonomousRunUrl(apiBase, runId) };
-}
-
-function formatAutonomousRunError(args: {
-  status: number;
-  payload: unknown;
-  apiBase: string;
-  hasSession: boolean;
-  statusText: string;
-}) {
-  const record = asRecord(args.payload);
-  const error =
-    stringField(record, "error", "message") ??
-    (typeof args.payload === "string" && args.payload.trim()
-      ? args.payload.trim()
-      : args.statusText);
-  const nextActions = stringArrayField(record, "nextActions");
-  if (args.status === 401 && !args.hasSession) {
-    nextActions.unshift(`Run: dench login --host ${args.apiBase}`);
-  } else if (args.status === 401) {
-    nextActions.push(
-      "Run dench sessions --json to inspect saved sessions.",
-      `Run dench login --host ${args.apiBase} if this session is expired.`,
-    );
-  } else if (args.status === 402 && nextActions.length === 0) {
-    nextActions.push(
-      "Top up AI credits in Dench usage/billing.",
-      "Retry the same Long Session command after credits update.",
-    );
-  }
-  if (stringField(record, "topUpUrl")) {
-    nextActions.unshift(`Top up: ${stringField(record, "topUpUrl")}`);
-  }
-  return new CliError(`Long Session failed (${args.status}): ${error}`, {
-    status: args.status,
-    code: stringField(record, "code") ?? `http_${args.status}`,
-    apiBase: args.apiBase,
-    topUpUrl: stringField(record, "topUpUrl"),
-    nextActions: [...new Set(nextActions)],
-  });
-}
-
-function safeLongSessionExample() {
-  return 'dench autonomous run "Inspect this repo and summarize the relevant feature. Do not edit files, publish, deploy, spend money, send external messages, access secrets, or change production data." --duration 30m';
-}
-
-function parseDurationMs(rawDuration?: string) {
-  const raw = rawDuration?.trim().toLowerCase();
-  if (!raw) return undefined;
-  if (["until-done", "until_done", "done", "max"].includes(raw)) {
-    return 24 * 60 * 60 * 1000;
-  }
-  const match = raw.match(
-    /^(\d+(?:\.\d+)?)(m|min|mins|minute|minutes|h|hr|hrs|hour|hours)$/,
-  );
-  if (!match) {
-    throw new CliError(
-      "--duration must look like 30m, 1h, 3h, 5h, or until-done",
-      {
-        code: "invalid_duration",
-        nextActions: [
-          "Use one of: 30m, 1h, 3h, 5h, until-done.",
-          safeLongSessionExample(),
-        ],
-      },
-    );
-  }
-  const value = Number(match[1]);
-  const unit = match[2];
-  if (!Number.isFinite(value) || value <= 0) {
-    throw new CliError("--duration must be positive", {
-      code: "invalid_duration",
-      nextActions: ["Use a positive duration like 30m or 1h."],
-    });
-  }
-  const minutes = unit.startsWith("h") ? value * 60 : value;
-  return Math.round(minutes * 60 * 1000);
-}
-
-function durationPreset(rawDuration?: string) {
-  const raw = rawDuration?.trim().toLowerCase();
-  if (!raw) return undefined;
-  return raw.replace("-", "_");
-}
-
-function parseApprovalRules() {
-  // --yolo wins over everything else: every approval gate is off,
-  // mirroring the org-level YOLO mode (settings -> Approvals).
-  if (hasFlag("--yolo")) return [];
-  const explicit = option("--approval-rules")
-    ?.split(",")
-    .map((rule) => rule.trim())
-    .filter(Boolean);
-  if (explicit && explicit.length > 0) return explicit;
-  const rules: string[] = [];
-  if (hasFlag("--ask-before-publishing")) rules.push("publishing");
-  if (hasFlag("--ask-before-spending")) rules.push("spending");
-  if (hasFlag("--ask-before-external-messages")) {
-    rules.push("external_messages");
-  }
-  if (hasFlag("--ask-before-production-changes")) {
-    rules.push("production_changes");
-  }
-  if (hasFlag("--ask-before-secrets")) rules.push("secrets");
-  return rules.length > 0
-    ? rules
-    : [
-        "publishing",
-        "spending",
-        "external_messages",
-        "production_changes",
-        "secrets",
-      ];
-}
-
 async function parseResponseBody(response: Response) {
   const text = await response.text();
   if (!text) return {};
@@ -1575,65 +1638,6 @@ async function parseResponseBody(response: Response) {
   }
 }
 
-async function startAutonomousRun() {
-  const goal = positionalsFrom(2).join(" ").trim();
-  if (!goal) {
-    throw new CliError("Missing goal", {
-      code: "missing_goal",
-      nextActions: [
-        safeLongSessionExample(),
-        "Keep the goal specific and include safety constraints for risky actions.",
-      ],
-    });
-  }
-
-  const model = option("--model")?.trim();
-  const duration = option("--duration");
-  const body: JsonRecord = {
-    goal,
-    metadata: {
-      sessionKind: "long_session",
-      approvalRules: parseApprovalRules(),
-      safetyConstraints: SAFE_LONG_SESSION_CONSTRAINTS,
-      ...(duration ? { durationPreset: durationPreset(duration) } : {}),
-    },
-  };
-  if (model) body.model = model;
-  const timeBudgetMs = parseDurationMs(duration);
-  if (timeBudgetMs) body.timeBudgetMs = timeBudgetMs;
-
-  const apiBase = resolveAutonomousApiBase();
-  const agentSessionToken = await resolveAutonomousSessionToken(apiBase);
-  const headers: Record<string, string> = {
-    accept: "application/json",
-    "content-type": "application/json",
-  };
-  if (agentSessionToken) {
-    headers.authorization = `Bearer ${agentSessionToken}`;
-  }
-
-  const response = await fetch(`${apiBase}/api/runs`, {
-    method: "POST",
-    headers,
-    body: JSON.stringify(body),
-  });
-  const payload = await parseResponseBody(response);
-
-  if (!response.ok) {
-    throw formatAutonomousRunError({
-      status: response.status,
-      payload,
-      apiBase,
-      hasSession: Boolean(agentSessionToken),
-      statusText: response.statusText,
-    });
-  }
-
-  const output = withAutonomousRunUrl(payload, apiBase);
-  throwIfCliError(output);
-  print(json ? output : formatAutonomousRunResult(output));
-}
-
 function formatUsd(cents: number | undefined) {
   const value = typeof cents === "number" && Number.isFinite(cents) ? cents : 0;
   return `$${(value / 100).toFixed(2)}`;
@@ -1748,12 +1752,37 @@ function hasDevEnv() {
  * dev typically only has `NEXT_PUBLIC_CONVEX_URL` exported. We accept
  * either so the same code path works in both shells without callers
  * needing to know which env var is set.
+ *
+ * When neither env var is set we fall back to the baked-in production
+ * Convex URL (`PRODUCTION_CONVEX_URL`). This is a deliberate
+ * defense-in-depth move: if a sandbox is provisioned while a Vercel
+ * deployment is half-configured and `CONVEX_URL` lands as empty
+ * string, the CLI inside it still ends up pointed at the production
+ * deployment instead of crashing on a "missing Convex URL" error.
+ * Dev / staging shells override this by exporting `CONVEX_URL` or
+ * `NEXT_PUBLIC_CONVEX_URL` explicitly.
  */
 function resolveApiKeyConvexUrl(): string | undefined {
   return (
     process.env.CONVEX_URL?.trim() ||
     process.env.NEXT_PUBLIC_CONVEX_URL?.trim() ||
-    undefined
+    PRODUCTION_CONVEX_URL
+  );
+}
+
+/**
+ * Resolve the Next.js API host the CLI should hit for HTTP calls (e.g.
+ * Stripe billing topup, the gateway proxy). Same defense-in-depth
+ * pattern as `resolveApiKeyConvexUrl`: env wins, then the resolved
+ * Dench host the runtime is targeting, and finally
+ * `PRODUCTION_API_URL` as the last resort.
+ */
+function resolveApiHost(fallbackHost: string): string {
+  return (
+    process.env.DENCH_API_URL?.trim() ||
+    process.env.DENCH_INTERNAL_BASE?.trim() ||
+    fallbackHost ||
+    PRODUCTION_API_URL
   );
 }
 
@@ -1817,10 +1846,7 @@ async function getRuntime() {
     if (sandboxAgentToken && sandboxConvexUrl) {
       const orgId = process.env.DENCH_ORG_ID?.trim();
       const orgSlug = process.env.DENCH_ORG_SLUG?.trim();
-      const apiHost =
-        process.env.DENCH_API_URL?.trim() ||
-        process.env.DENCH_INTERNAL_BASE?.trim() ||
-        host;
+      const apiHost = resolveApiHost(host);
       return {
         mode: "session" as const,
         host: apiHost,
@@ -1844,10 +1870,7 @@ async function getRuntime() {
     if (apiKey && convexUrl) {
       const orgId = process.env.DENCH_ORG_ID?.trim();
       const orgSlug = process.env.DENCH_ORG_SLUG?.trim();
-      const apiHost =
-        process.env.DENCH_API_URL?.trim() ||
-        process.env.DENCH_INTERNAL_BASE?.trim() ||
-        host;
+      const apiHost = resolveApiHost(host);
       return {
         mode: "apiKey" as const,
         host: apiHost,
@@ -1880,8 +1903,13 @@ async function getRuntime() {
 type Runtime = Awaited<ReturnType<typeof getRuntime>>;
 
 function stripRuntimeFlags(args: string[]) {
-  const booleanFlags = new Set(["--dev", "--prod", "--staging"]);
-  const valueFlags = new Set(["--convex-url", "--host"]);
+  const booleanFlags = new Set([
+    "--dev",
+    "--prod",
+    "--staging",
+    "--use-dev-env",
+  ]);
+  const valueFlags = new Set(["--convex-url", "--host", "--backend"]);
   const stripped: string[] = [];
   for (let i = 0; i < args.length; i++) {
     const arg = args[i];
@@ -3198,16 +3226,12 @@ async function main() {
     return;
   }
 
-  if (command === "autonomous") {
-    if (!subcommand || subcommand === "help" || hasFlag("--help")) {
-      autonomousHelp();
-      return;
-    }
-    if (subcommand === "run") {
-      await startAutonomousRun();
-      return;
-    }
-    throw new Error(`Unknown autonomous command: ${filteredArgs.join(" ")}`);
+  if (
+    command === "backend" &&
+    (subcommand === "help" || hasFlag("--help"))
+  ) {
+    backendHelp();
+    return;
   }
 
   if (command === "crm") {
@@ -3540,6 +3564,11 @@ async function main() {
     return;
   }
 
+  if (command === "backend") {
+    await runBackendCommand();
+    return;
+  }
+
   const runtime = await getRuntime();
 
   if (command === "billing") {