@dench.com/cli 0.4.9 → 2.0.1

package/tools.ts

@@ -3,13 +3,9 @@
  * Composio's get-apps / get-tools / execute-tool surface.
  *
  * Mirrors `denchclaw`'s pattern: this CLI is a thin wrapper over five
- * gateway endpoints, authenticated with the unified `DENCH_API_KEY`
- * baked into every Dench sandbox at create time. There is no Convex
- * session involved; that means these subcommands work in any
- * environment that has the API key (sandboxes, CI, local dev with the
- * key exported manually). The previous implementation forced
- * `requireSessionRuntime` and routed through a Convex action, which
- * broke `apiKey` runtime mode entirely.
+ * gateway endpoints, authenticated with either `DENCH_API_KEY` or a
+ * paid-workspace gateway key resolved from the active agent session by
+ * the top-level dispatcher.
  *
  * Subcommands:
  *
@@ -20,7 +16,7 @@
  *   dench tool connect <toolkit> [--callback-url <url>] [--json]   — print OAuth redirect URL
  *   dench tool disconnect <connectionId> [--json]
  *
- * Endpoints used (all `Authorization: Bearer DENCH_API_KEY`):
+ * Endpoints used (all `Authorization: Bearer <gateway credential>`):
  *
  *   GET    /v1/composio/connections
  *   GET    /v1/composio/toolkits?search=<slug>
@@ -36,10 +32,7 @@
  * working.
  */
 
-import {
-  PRODUCTION_API_URL,
-  PRODUCTION_GATEWAY_URL,
-} from "./host";
+import { PRODUCTION_API_URL, PRODUCTION_GATEWAY_URL } from "./host";
 import {
   CliArgError,
   getFlag,
@@ -55,8 +48,15 @@ import {
 export type ToolCliContext = {
   args: string[];
   jsonOutput: boolean;
+  bearerToken?: string;
+  gatewayBaseUrl?: string;
 };
 
+type GatewayAuthContext = Pick<
+  ToolCliContext,
+  "bearerToken" | "gatewayBaseUrl"
+>;
+
 export async function runToolCommand(ctx: ToolCliContext): Promise<void> {
   const sub = ctx.args[0];
   if (!sub || sub === "help" || sub === "--help" || sub === "-h") {
@@ -91,11 +91,14 @@ export async function runToolCommand(ctx: ToolCliContext): Promise<void> {
 
 /**
  * Summarise the user's connected apps for `dench context` and friends.
- * Bypasses any Convex session and speaks straight to the gateway.
+ * Speaks straight to the gateway with either DENCH_API_KEY or a gateway
+ * key resolved from the active agent session.
  * Returns the same legacy shape the previous Convex-routed path did so
  * existing parsers don't need to change.
  */
-export async function fetchConnectedAppsSummary(): Promise<{
+export async function fetchConnectedAppsSummary(
+  ctx: GatewayAuthContext = {},
+): Promise<{
   available: boolean;
   count: number;
   connections: Array<{
@@ -109,7 +112,7 @@ export async function fetchConnectedAppsSummary(): Promise<{
 }> {
   let payload: unknown;
   try {
-    payload = await callGateway("GET", "/v1/composio/connections");
+    payload = await callGateway(ctx, "GET", "/v1/composio/connections");
   } catch (error) {
     if (error instanceof MissingApiKeyError) {
       return {
@@ -139,6 +142,7 @@ async function runStatusSubcommand(ctx: ToolCliContext): Promise<void> {
   if (filterToolkit) ctx.args.shift();
 
   const connectionsPayload = await callGateway(
+    ctx,
     "GET",
     "/v1/composio/connections",
   );
@@ -146,6 +150,7 @@ async function runStatusSubcommand(ctx: ToolCliContext): Promise<void> {
   if (filterToolkit) {
     const search = encodeURIComponent(filterToolkit);
     toolkitsPayload = await callGateway(
+      ctx,
       "GET",
       `/v1/composio/toolkits?search=${search}`,
     );
@@ -194,7 +199,12 @@ async function runSearchSubcommand(ctx: ToolCliContext): Promise<void> {
   if (toolkit) body.toolkit_slug = toolkit;
   if (limit) body.limit = limit;
 
-  const payload = await callGateway("POST", "/v1/composio/tools/search", body);
+  const payload = await callGateway(
+    ctx,
+    "POST",
+    "/v1/composio/tools/search",
+    body,
+  );
   if (ctx.jsonOutput) {
     console.log(JSON.stringify(payload, null, 2));
     return;
@@ -231,7 +241,12 @@ async function runRunSubcommand(ctx: ToolCliContext): Promise<void> {
 
   let payload: unknown;
   try {
-    payload = await callGateway("POST", "/v1/composio/tools/execute", body);
+    payload = await callGateway(
+      ctx,
+      "POST",
+      "/v1/composio/tools/execute",
+      body,
+    );
   } catch (error) {
     if (error instanceof GatewayHttpError && isLikelyNoConnection(error)) {
       const noConnPayload = noConnectionPayload(toolSlug, error);
@@ -266,7 +281,7 @@ async function runConnectSubcommand(ctx: ToolCliContext): Promise<void> {
     process.env.DENCH_OAUTH_CALLBACK_URL?.trim() ??
     `${resolveAppPublicOrigin()}/api/composio/callback`;
 
-  const payload = await callGateway("POST", "/v1/composio/connect", {
+  const payload = await callGateway(ctx, "POST", "/v1/composio/connect", {
     toolkit,
     callback_url: callbackUrl,
   });
@@ -313,7 +328,7 @@ async function runDisconnectSubcommand(ctx: ToolCliContext): Promise<void> {
   const path = `/v1/composio/connections/${encodeURIComponent(connectionId)}`;
   let payload: unknown = { ok: true, deleted: true };
   try {
-    payload = await callGateway("DELETE", path);
+    payload = await callGateway(ctx, "DELETE", path);
   } catch (error) {
     // Composio returns 404 for connections that are already gone — surface
     // that as a soft success so callers can keep their local state in sync.
@@ -350,9 +365,8 @@ class ToolCliError extends Error {
 class MissingApiKeyError extends ToolCliError {
   constructor() {
     super(
-      "DENCH_API_KEY is not set. Inside a Dench sandbox it is baked into " +
-        "the env automatically; outside, export it manually or run " +
-        "`dench login` and copy the api-key from the output.",
+      "No Dench gateway credential found. Set DENCH_API_KEY or run " +
+        "`dench signin` for a paid workspace.",
     );
     this.name = "MissingApiKeyError";
   }
@@ -376,10 +390,19 @@ class GatewayHttpError extends ToolCliError {
   }
 }
 
-function resolveGatewayBaseUrl(): string {
+function normalizeGatewayBaseUrl(value: string): string {
+  return value.replace(/\/+$/, "").replace(/\/v1$/, "");
+}
+
+function resolveGatewayBaseUrl(
+  ctx?: Pick<ToolCliContext, "gatewayBaseUrl">,
+): string {
+  if (ctx?.gatewayBaseUrl?.trim()) {
+    return normalizeGatewayBaseUrl(ctx.gatewayBaseUrl.trim());
+  }
   const explicit =
     process.env.DENCH_GATEWAY_URL?.trim() || process.env.GATEWAY_URL?.trim();
-  if (explicit) return explicit.replace(/\/+$/, "");
+  if (explicit) return normalizeGatewayBaseUrl(explicit);
   const host = process.env.DENCH_HOST?.trim();
   if (host && /localhost|127\.0\.0\.1/.test(host)) {
     return "http://localhost:8787";
@@ -410,24 +433,26 @@ function resolveAppPublicOrigin(): string {
   return PRODUCTION_API_URL;
 }
 
-function requireApiKey(): string {
-  const apiKey = process.env.DENCH_API_KEY?.trim();
-  if (!apiKey) throw new MissingApiKeyError();
-  return apiKey;
+function requireBearerToken(ctx?: Pick<ToolCliContext, "bearerToken">): string {
+  const bearerToken =
+    ctx?.bearerToken?.trim() || process.env.DENCH_API_KEY?.trim();
+  if (!bearerToken) throw new MissingApiKeyError();
+  return bearerToken;
 }
 
 async function callGateway(
+  ctx: GatewayAuthContext,
   method: "GET" | "POST" | "DELETE",
   path: string,
   body?: Record<string, unknown>,
 ): Promise<unknown> {
-  const apiKey = requireApiKey();
-  const baseUrl = resolveGatewayBaseUrl();
+  const bearerToken = requireBearerToken(ctx);
+  const baseUrl = resolveGatewayBaseUrl(ctx);
   const init: RequestInit = {
     method,
     headers: {
       "content-type": "application/json",
-      authorization: `Bearer ${apiKey}`,
+      authorization: `Bearer ${bearerToken}`,
     },
   };
   if (body !== undefined) init.body = JSON.stringify(body);
@@ -730,8 +755,8 @@ Usage:
   dench tool disconnect <connectionId> [--json]
 
 Notes:
-  All commands authenticate with DENCH_API_KEY (Bearer) directly to the
-  Dench Cloud Gateway. No \`dench login\` agent session required.
+  All commands authenticate with DENCH_API_KEY or the active \`dench signin\`
+  agent session. Agent sessions require a paid workspace.
   dench tool connect prints the OAuth redirect URL for the human to open.
   dench tool run output is redacted for display; pass --json for raw output.
   Override the gateway base with DENCH_GATEWAY_URL or GATEWAY_URL.
@@ -804,7 +829,7 @@ function parsePositiveInt(name: string, raw: string): number {
 // them as unused when callers tree-shake.
 export { ToolCliError, GatewayHttpError, MissingApiKeyError };
 // Kept reachable so a future caller can build their own dispatcher.
-export { resolveGatewayBaseUrl, requireApiKey, callGateway };
+export { resolveGatewayBaseUrl, requireBearerToken, callGateway };
 // shiftRaw / hasFlag from cli-args are not used in this module yet but
 // keep the import group consistent with cli/search.ts conventions.
 void shiftRaw;