@dench.com/cli 0.4.9 → 2.0.1

package/host.ts

@@ -1,4 +1,4 @@
-export const PRODUCTION_HOST = "https://dench.dev";
+export const PRODUCTION_HOST = "https://dench.com";
 export const STAGING_HOST = "https://workspace-staging.dench.com";
 export const LOCAL_HOST = "http://localhost:3000";
 export const DEFAULT_HOST = PRODUCTION_HOST;
@@ -63,7 +63,7 @@ export function resolveBackendAlias(input: string): string {
   const value = input.trim();
   if (!value) {
     throw new Error(
-      "Backend value is empty. Pass local, staging, prod, or a URL like https://dench.dev.",
+      "Backend value is empty. Pass local, staging, prod, or a URL like https://dench.com.",
     );
   }
   const normalized = value.toLowerCase();
@@ -80,7 +80,7 @@ export function resolveBackendAlias(input: string): string {
     return normalizeHost(value);
   } catch (_error) {
     throw new Error(
-      `Unrecognized backend "${value}". Use local, staging, prod, or a URL like https://dench.dev.`,
+      `Unrecognized backend "${value}". Use local, staging, prod, or a URL like https://dench.com.`,
     );
   }
 }

package/image.ts

@@ -3,9 +3,9 @@
  * the Dench Cloud Gateway.
  *
  * Mirrors `dench search`: bypasses Convex entirely and talks straight HTTP
- * to the gateway, authenticating with the `DENCH_API_KEY` baked into every
- * sandbox at create time. Works anywhere that env var is exported (sandbox,
- * CI, local dev).
+ * to the gateway, authenticating with either `DENCH_API_KEY` or a
+ * paid-workspace gateway key resolved from the active agent session by the
+ * top-level dispatcher.
  *
  * Persistence model: the gateway already writes the bytes to Convex Storage
  * + the org's fileTree on success (so the workspace UI sees the file
@@ -27,38 +27,33 @@
 
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { dirname, isAbsolute, resolve } from "node:path";
-import {
-  CliArgError,
-  getFlag,
-  hasFlag,
-  shift as shiftRaw,
-} from "./lib/cli-args";
+import { getFlag, hasFlag } from "./lib/cli-args";
 
 type ImageCliContext = {
   args: string[];
   jsonOutput: boolean;
+  bearerToken?: string;
+  gatewayBaseUrl?: string;
 };
 
 class ImageCliError extends Error {}
 
-function shift(args: string[], expected: string): string {
-  try {
-    return shiftRaw(args, expected);
-  } catch (error) {
-    if (error instanceof CliArgError) {
-      throw new ImageCliError(error.message);
-    }
-    throw error;
-  }
-}
-
 const ALLOWED_QUALITIES = new Set(["auto", "low", "medium", "high"]);
 const ALLOWED_FORMATS = new Set(["png", "jpeg", "webp"]);
 
-function resolveGatewayBaseUrl(): string {
+function normalizeGatewayBaseUrl(value: string): string {
+  return value.replace(/\/+$/, "").replace(/\/v1$/, "");
+}
+
+function resolveGatewayBaseUrl(
+  ctx?: Pick<ImageCliContext, "gatewayBaseUrl">,
+): string {
+  if (ctx?.gatewayBaseUrl?.trim()) {
+    return normalizeGatewayBaseUrl(ctx.gatewayBaseUrl.trim());
+  }
   const explicit =
     process.env.DENCH_GATEWAY_URL?.trim() || process.env.GATEWAY_URL?.trim();
-  if (explicit) return explicit.replace(/\/+$/, "");
+  if (explicit) return normalizeGatewayBaseUrl(explicit);
   const host = process.env.DENCH_HOST?.trim();
   if (host && /localhost|127\.0\.0\.1/.test(host)) {
     return "http://localhost:8787";
@@ -66,16 +61,17 @@ function resolveGatewayBaseUrl(): string {
   return "https://gateway.merseoriginals.com";
 }
 
-function requireApiKey(): string {
-  const apiKey = process.env.DENCH_API_KEY?.trim();
-  if (!apiKey) {
+function requireBearerToken(
+  ctx?: Pick<ImageCliContext, "bearerToken">,
+): string {
+  const bearerToken =
+    ctx?.bearerToken?.trim() || process.env.DENCH_API_KEY?.trim();
+  if (!bearerToken) {
     throw new ImageCliError(
-      "DENCH_API_KEY is not set. Inside a Dench sandbox it is baked into " +
-        "the env automatically; outside, export it manually or run " +
-        "`dench login` first.",
+      "No Dench gateway credential found. Set DENCH_API_KEY or run `dench signin` for a paid workspace.",
     );
   }
-  return apiKey;
+  return bearerToken;
 }
 
 function resolveDefaultVolumeRoot(): string {
@@ -125,16 +121,17 @@ type GatewayImageResponse = {
 };
 
 async function callGateway(
+  ctx: ImageCliContext,
   path: "/v1/images/generations" | "/v1/images/edits",
   body: Record<string, unknown>,
 ): Promise<GatewayImageResponse> {
-  const apiKey = requireApiKey();
-  const baseUrl = resolveGatewayBaseUrl();
+  const bearerToken = requireBearerToken(ctx);
+  const baseUrl = resolveGatewayBaseUrl(ctx);
   const response = await fetch(`${baseUrl}${path}`, {
     method: "POST",
     headers: {
       "content-type": "application/json",
-      Authorization: `Bearer ${apiKey}`,
+      Authorization: `Bearer ${bearerToken}`,
     },
     body: JSON.stringify(body),
   });
@@ -246,7 +243,16 @@ function parseCommonOpts(args: string[]): CommonImageOpts {
       `Invalid --moderation: ${moderation}. Allowed: auto, low`,
     );
   }
-  return { size, quality, format, savePath, output, noWrite, background, moderation };
+  return {
+    size,
+    quality,
+    format,
+    savePath,
+    output,
+    noWrite,
+    background,
+    moderation,
+  };
 }
 
 function buildGenerationBody(
@@ -283,7 +289,7 @@ async function runGenerateSubcommand(ctx: ImageCliContext): Promise<void> {
     );
   }
   const body = buildGenerationBody(prompt, opts);
-  const result = await callGateway("/v1/images/generations", body);
+  const result = await callGateway(ctx, "/v1/images/generations", body);
   if (!result.b64_json) {
     throw new ImageCliError("Gateway response did not include image bytes.");
   }
@@ -341,14 +347,16 @@ async function runEditSubcommand(ctx: ImageCliContext): Promise<void> {
       `Too many --input paths (${inputs.length}); the gateway accepts at most 8.`,
     );
   }
-  const inputBase64 = await Promise.all(inputs.map((p) => readBase64FromPath(p)));
+  const inputBase64 = await Promise.all(
+    inputs.map((p) => readBase64FromPath(p)),
+  );
   const maskBase64 = mask ? await readBase64FromPath(mask) : undefined;
   const body = {
     ...buildGenerationBody(prompt, opts),
     input_images_base64: inputBase64,
     ...(maskBase64 ? { mask_base64: maskBase64 } : {}),
   };
-  const result = await callGateway("/v1/images/edits", body);
+  const result = await callGateway(ctx, "/v1/images/edits", body);
   if (!result.b64_json) {
     throw new ImageCliError("Gateway response did not include image bytes.");
   }
@@ -379,9 +387,10 @@ function imageHelp(): void {
   console.log(`Usage: dench image <subcommand>
 
 Generate or edit images via the Dench Cloud Gateway (gpt-image-2). Auths
-with DENCH_API_KEY (baked into every sandbox automatically). Each call
-writes the bytes to Convex Storage (workspace tree updates immediately)
-and, when running inside a sandbox, also writes the decoded bytes to
+with DENCH_API_KEY or the active \`dench signin\` agent session. Agent
+sessions require a paid workspace. Each call writes the bytes to Convex
+Storage (workspace tree updates immediately) and, when running inside a sandbox,
+also writes the decoded bytes to
 local disk so subsequent bash commands see the file without waiting on
 the daemon's downward sync.
 
@@ -397,7 +406,7 @@ Edit / remix one or more existing images (image-to-image):
                               [--save-path ...] [--output ...] [--no-write] [--json]
 
 Environment variables:
-  DENCH_API_KEY        Required. Bearer token sent to the gateway.
+  DENCH_API_KEY        Optional when a dench signin agent session is active.
   DENCH_GATEWAY_URL    Override the gateway base URL.
   GATEWAY_URL          Same, used when DENCH_GATEWAY_URL is unset.
   DENCH_HOST           If it points at localhost, defaults to

package/lib/enrichment-gateway.ts

@@ -81,7 +81,7 @@ export function resolveEnrichmentGatewayBaseUrl(
   env: EnrichmentGatewayEnv = process.env,
 ): string {
   const explicit = env.DENCH_GATEWAY_URL?.trim() || env.GATEWAY_URL?.trim();
-  if (explicit) return explicit.replace(/\/+$/, "");
+  if (explicit) return explicit.replace(/\/+$/, "").replace(/\/v1$/, "");
 
   const host = env.DENCH_HOST?.trim();
   if (host && /localhost|127\.0\.0\.1/.test(host)) {
@@ -161,6 +161,7 @@ export type ApolloPersonEnvelope = {
     linkedin_url?: string;
     title?: string;
     headline?: string;
+    location?: string;
     contact: {
       phone_numbers: Array<{
         sanitized_number: string;
@@ -178,7 +179,12 @@ type EnrichedPersonUpsertLike = {
   /** Structured title from the person's current role (distinct from headline). */
   currentTitle?: string;
   linkedinID?: string;
-  emails?: Array<{ address?: string; normalizedAddress?: string; type?: string }>;
+  location?: string;
+  emails?: Array<{
+    address?: string;
+    normalizedAddress?: string;
+    type?: string;
+  }>;
   phones?: Array<{ number?: string; normalizedNumber?: string }>;
 };
 
@@ -201,6 +207,7 @@ function shapePersonToApolloEnvelope(
         : undefined,
       title: u.currentTitle,
       headline: u.headline,
+      location: u.location,
       contact: {
         phone_numbers: (u.phones ?? []).map((p) => ({
           sanitized_number: p.normalizedNumber ?? p.number ?? "",
@@ -523,8 +530,7 @@ async function submitContactBulkChunk(
   const cached = resp.cachedResults ?? [];
   const seenIndexes = new Set<number>();
   for (const hit of cached) {
-    const idx =
-      typeof hit.inputIndex === "number" ? hit.inputIndex : undefined;
+    const idx = typeof hit.inputIndex === "number" ? hit.inputIndex : undefined;
     if (idx === undefined) continue;
     seenIndexes.add(idx);
     results.set(idx, {
@@ -684,7 +690,10 @@ export async function enrichPersonBulk(
       return;
     }
     try {
-      validContacts.push({ inputIndex: index, payload: buildContactPayload(body) });
+      validContacts.push({
+        inputIndex: index,
+        payload: buildContactPayload(body),
+      });
     } catch (err) {
       results.set(index, {
         ok: false,
@@ -751,8 +760,7 @@ async function submitReverseEmailBulkChunk(
 
   const cached = resp.cachedResults ?? [];
   for (const hit of cached) {
-    const idx =
-      typeof hit.inputIndex === "number" ? hit.inputIndex : undefined;
+    const idx = typeof hit.inputIndex === "number" ? hit.inputIndex : undefined;
     if (idx === undefined) continue;
     // The gateway dedupes emails, so a cache hit at index i corresponds to
     // the deduped email at that position in the request — we then fan out to
@@ -988,7 +996,9 @@ export async function enrichCompany(
   body: EnrichCompanyBody,
   options: EnrichmentGatewayOptions = {},
 ): Promise<Record<string, unknown>> {
-  const domain = body.domain ? extractDomain(body.domain) ?? body.domain : undefined;
+  const domain = body.domain
+    ? (extractDomain(body.domain) ?? body.domain)
+    : undefined;
   const companyName = body.companyName?.trim();
   const linkedinUrl = body.linkedinUrl?.trim();
 
@@ -1075,7 +1085,11 @@ export async function aviatoEnrichPerson(
 
   const resp = raw as {
     data?: EnrichedPersonUpsertLike | null;
-    billing?: { charged_cents?: number; cache_hit?: boolean; preview?: boolean };
+    billing?: {
+      charged_cents?: number;
+      cache_hit?: boolean;
+      preview?: boolean;
+    };
     provider?: { name?: string; aviato_id?: string };
   };
 
@@ -1125,7 +1139,11 @@ export async function aviatoEnrichCompany(
 
   const resp = raw as {
     data?: EnrichedCompanyUpsertLike | null;
-    billing?: { charged_cents?: number; cache_hit?: boolean; preview?: boolean };
+    billing?: {
+      charged_cents?: number;
+      cache_hit?: boolean;
+      preview?: boolean;
+    };
     provider?: { name?: string; aviato_id?: string };
   };
 
@@ -1219,8 +1237,7 @@ async function callGatewayJson(
   });
 
   const isOk =
-    response.ok ||
-    (args.expectedStatus?.includes(response.status) ?? false);
+    response.ok || (args.expectedStatus?.includes(response.status) ?? false);
 
   if (!isOk) {
     throw await buildGatewayError(response, pathOrUrl.toString());
@@ -1231,7 +1248,7 @@ async function callGatewayJson(
 
 function resolveBaseUrl(options: EnrichmentGatewayOptions): string {
   return (
-    options.baseUrl?.trim().replace(/\/+$/, "") ??
+    options.baseUrl?.trim().replace(/\/+$/, "").replace(/\/v1$/, "") ??
     resolveEnrichmentGatewayBaseUrl(options.env)
   );
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@dench.com/cli",
-  "version": "0.4.9",
-  "description": "Dench agent workspace CLI.",
+  "version": "2.0.1",
+  "description": "Dench agent workspace CLI. v2 unifies auth behind `dench signin`; the legacy `dench login` / `dench onboard` / `dench setup` / `dench what-can-i-do` / `dench register` commands now error with a redirect.",
   "type": "module",
   "bin": {
     "dench": "dench",

package/search.ts

@@ -2,11 +2,9 @@
  * `dench search` — live web access through the Dench Cloud Gateway.
  *
  * The gateway exposes Exa Search at three routes; we mirror them as
- * three subcommands and authenticate with the `DENCH_API_KEY` baked
- * into every sandbox at create time. Unlike most other CLI surfaces
- * this one bypasses Convex entirely — it speaks straight HTTP to the
- * gateway, so it works in any environment that has the env var
- * (sandboxes, CI, local dev with `DENCH_API_KEY` exported manually).
+ * three subcommands and authenticate with either `DENCH_API_KEY` or a
+ * paid-workspace gateway key resolved from the active agent session by
+ * the top-level dispatcher.
  *
  * Subcommands:
  *   search "<query>"       [--num-results N] [--type auto|fast|deep|deep-reasoning|neural]
@@ -17,32 +15,21 @@
  *   search answer "<query>" [--json]
  */
 
-import {
-  CliArgError,
-  getFlag,
-  hasFlag,
-  shift as shiftRaw,
-} from "./lib/cli-args";
+import { getFlag } from "./lib/cli-args";
 
 type SearchCliContext = {
   args: string[];
   jsonOutput: boolean;
+  bearerToken?: string;
+  gatewayBaseUrl?: string;
 };
 
 class SearchCliError extends Error {}
 
-function shift(args: string[], expected: string): string {
-  try {
-    return shiftRaw(args, expected);
-  } catch (error) {
-    if (error instanceof CliArgError) {
-      throw new SearchCliError(error.message);
-    }
-    throw error;
-  }
-}
-
-function parsePositiveInt(name: string, raw: string | undefined): number | undefined {
+function parsePositiveInt(
+  name: string,
+  raw: string | undefined,
+): number | undefined {
   if (raw === undefined) return undefined;
   const parsed = Number(raw);
   if (!Number.isFinite(parsed) || parsed <= 0) {
@@ -78,10 +65,19 @@ const ALLOWED_CATEGORIES = new Set([
   "people",
 ]);
 
-function resolveGatewayBaseUrl(): string {
+function normalizeGatewayBaseUrl(value: string): string {
+  return value.replace(/\/+$/, "").replace(/\/v1$/, "");
+}
+
+function resolveGatewayBaseUrl(
+  ctx?: Pick<SearchCliContext, "gatewayBaseUrl">,
+): string {
+  if (ctx?.gatewayBaseUrl?.trim()) {
+    return normalizeGatewayBaseUrl(ctx.gatewayBaseUrl.trim());
+  }
   const explicit =
     process.env.DENCH_GATEWAY_URL?.trim() || process.env.GATEWAY_URL?.trim();
-  if (explicit) return explicit.replace(/\/+$/, "");
+  if (explicit) return normalizeGatewayBaseUrl(explicit);
   // Local dev: the gateway listens on :8787 (matches gateway/src/index.ts
   // and the dev-server skill). Anything that smells like localhost in
   // DENCH_HOST routes to the local gateway too so `dench --host
@@ -93,29 +89,31 @@ function resolveGatewayBaseUrl(): string {
   return "https://gateway.merseoriginals.com";
 }
 
-function requireApiKey(): string {
-  const apiKey = process.env.DENCH_API_KEY?.trim();
-  if (!apiKey) {
+function requireBearerToken(
+  ctx?: Pick<SearchCliContext, "bearerToken">,
+): string {
+  const bearerToken =
+    ctx?.bearerToken?.trim() || process.env.DENCH_API_KEY?.trim();
+  if (!bearerToken) {
     throw new SearchCliError(
-      "DENCH_API_KEY is not set. Inside a Dench sandbox it is baked into " +
-        "the env automatically; outside, export it manually or run " +
-        "`dench login` first.",
+      "No Dench gateway credential found. Set DENCH_API_KEY or run `dench signin` for a paid workspace.",
     );
   }
-  return apiKey;
+  return bearerToken;
 }
 
 async function callGateway(
+  ctx: SearchCliContext,
   path: "/v1/search" | "/v1/search/contents" | "/v1/search/answer",
   body: Record<string, unknown>,
 ): Promise<unknown> {
-  const apiKey = requireApiKey();
-  const baseUrl = resolveGatewayBaseUrl();
+  const bearerToken = requireBearerToken(ctx);
+  const baseUrl = resolveGatewayBaseUrl(ctx);
   const response = await fetch(`${baseUrl}${path}`, {
     method: "POST",
     headers: {
       "content-type": "application/json",
-      Authorization: `Bearer ${apiKey}`,
+      Authorization: `Bearer ${bearerToken}`,
     },
     body: JSON.stringify(body),
   });
@@ -143,7 +141,9 @@ function asString(value: unknown): string | undefined {
 }
 
 function asNumber(value: unknown): number | undefined {
-  return typeof value === "number" && Number.isFinite(value) ? value : undefined;
+  return typeof value === "number" && Number.isFinite(value)
+    ? value
+    : undefined;
 }
 
 function asObject(value: unknown): Record<string, unknown> | undefined {
@@ -184,7 +184,8 @@ function formatSearchResults(payload: unknown, limit?: number): string {
     lines.push("(no results)");
     return lines.join("\n");
   }
-  const cap = limit !== undefined ? Math.min(results.length, limit) : results.length;
+  const cap =
+    limit !== undefined ? Math.min(results.length, limit) : results.length;
   for (let i = 0; i < cap; i++) {
     const result = asObject(results[i]);
     if (!result) continue;
@@ -197,7 +198,9 @@ function formatSearchResults(payload: unknown, limit?: number): string {
     const snippet =
       asString(result.text) ??
       (Array.isArray(result.highlights)
-        ? result.highlights.filter((h): h is string => typeof h === "string").join(" ")
+        ? result.highlights
+            .filter((h): h is string => typeof h === "string")
+            .join(" ")
         : undefined) ??
       asString(result.summary);
     lines.push(`${i + 1}. ${title}`);
@@ -284,7 +287,10 @@ function out(ctx: SearchCliContext, payload: unknown, formatted: string): void {
 // ────────────────────────────────────────────────────────────────────────────
 
 async function runSearchSubcommand(ctx: SearchCliContext): Promise<void> {
-  const numResults = parsePositiveInt("--num-results", getFlag(ctx.args, "--num-results"));
+  const numResults = parsePositiveInt(
+    "--num-results",
+    getFlag(ctx.args, "--num-results"),
+  );
   const type = getFlag(ctx.args, "--type");
   if (type !== undefined && !ALLOWED_TYPES.has(type)) {
     throw new SearchCliError(
@@ -321,12 +327,15 @@ async function runSearchSubcommand(ctx: SearchCliContext): Promise<void> {
   if (category) body.category = category;
   if (includeDomains) body.includeDomains = includeDomains;
   if (excludeDomains) body.excludeDomains = excludeDomains;
-  const payload = await callGateway("/v1/search", body);
+  const payload = await callGateway(ctx, "/v1/search", body);
   out(ctx, payload, formatSearchResults(payload, numResults));
 }
 
 async function runContentsSubcommand(ctx: SearchCliContext): Promise<void> {
-  const maxChars = parsePositiveInt("--max-chars", getFlag(ctx.args, "--max-chars"));
+  const maxChars = parsePositiveInt(
+    "--max-chars",
+    getFlag(ctx.args, "--max-chars"),
+  );
   const summary = getFlag(ctx.args, "--summary");
   const urls = ctx.args.slice();
   ctx.args.length = 0;
@@ -346,7 +355,7 @@ async function runContentsSubcommand(ctx: SearchCliContext): Promise<void> {
     highlights: { maxCharacters: 200 },
   };
   if (summary) body.summary = { query: summary };
-  const payload = await callGateway("/v1/search/contents", body);
+  const payload = await callGateway(ctx, "/v1/search/contents", body);
   out(ctx, payload, formatContentsResults(payload));
 }
 
@@ -355,11 +364,9 @@ async function runAnswerSubcommand(ctx: SearchCliContext): Promise<void> {
   ctx.args.length = 0;
   const query = queryParts.join(" ").trim();
   if (!query) {
-    throw new SearchCliError(
-      'Usage: dench search answer "<query>" [--json]',
-    );
+    throw new SearchCliError('Usage: dench search answer "<query>" [--json]');
   }
-  const payload = await callGateway("/v1/search/answer", {
+  const payload = await callGateway(ctx, "/v1/search/answer", {
     query,
     text: true,
     stream: false,
@@ -371,7 +378,8 @@ function searchHelp(): void {
   console.log(`Usage: dench search <subcommand>
 
 Live web access through the Dench Cloud Gateway (Exa Search). Auths
-with DENCH_API_KEY (baked into every sandbox automatically).
+with DENCH_API_KEY or the active \`dench signin\` agent session. Agent
+sessions require a paid workspace.
 
 Search the web (default subcommand):
   dench search "<query>" [--num-results N] [--type auto|fast|deep|deep-reasoning|neural]
@@ -386,7 +394,7 @@ One-shot synthesised answer with citations (Exa /search/answer):
   dench search answer "<query>" [--json]
 
 Environment variables:
-  DENCH_API_KEY        Required. Bearer token sent to the gateway.
+  DENCH_API_KEY        Optional when a dench signin agent session is active.
   DENCH_GATEWAY_URL    Override the gateway base URL.
   GATEWAY_URL          Same, used when DENCH_GATEWAY_URL is unset.
   DENCH_HOST           If it points at localhost, defaults to