@dench.com/cli 2.0.0 → 2.0.2

package/README.md

@@ -4,17 +4,21 @@ Agent-facing CLI for the Dench agent workspace.
 
 ## Usage
 
-Run without installing:
+Run without installing. The npm package is `@dench.com/cli`, but the binary
+it installs is named `dench`, so always invoke it as
+`npx -y -p @dench.com/cli dench <command>`. A bare
+`npx -y @dench.com/cli <command>` will fail because `npx` looks for a bin
+matching the package's last path segment (`cli`) and there isn't one.
 
 ```bash
-npx -y @dench.com/cli login --name "AI Agent - Billing Repo"
+npx -y -p @dench.com/cli dench signin --name "AI Agent - Billing Repo"
 ```
 
 Or install globally:
 
 ```bash
 npm install -g @dench.com/cli
-dench login --name "AI Agent - Billing Repo"
+dench signin --name "AI Agent - Billing Repo"
 ```
 
 `--kind` accepts any string. Suggested values: `claude_code`, `codex`, `cursor`,
@@ -47,11 +51,13 @@ DENCH_HOST=https://example.com dench <cmd>
 
 The smooth setup flow is:
 
-1. Run `dench login --name "AI Agent - Billing Repo"` once.
+1. Run `dench signin --name "AI Agent - Billing Repo"` once.
 2. Let the CLI open the approval link. If it cannot, ask the human to open the
    printed link and confirm the email/workspace. Use `--no-open` to print the
    link without opening it.
-3. Run `dench status --mine --json` and `dench tasks --json` to verify setup.
+3. Run `dench status --mine --json` and `dench crm entries list task --json`
+   to verify setup. Tasks live as CRM `task` entries — there is no separate
+   `dench tasks` command.
 
 The CLI selects the approved session for later commands automatically.
 Setup is complete after approval, both verification commands work, and you know
@@ -71,11 +77,11 @@ dench sessions
 dench use <session-key-or-workspace-slug>
 ```
 
-Use a human-readable `DENCH_SESSION_KEY` at login time only for long-lived
+Use a human-readable `DENCH_SESSION_KEY` at sign-in time only for long-lived
 agents or when the human asks for a stable identity:
 
 ```bash
-DENCH_SESSION_KEY=billing-repo-agent dench login --name "AI Agent - Billing Repo"
+DENCH_SESSION_KEY=billing-repo-agent dench signin --name "AI Agent - Billing Repo"
 DENCH_SESSION_KEY=billing-repo-agent dench status --mine --json
 ```
 
@@ -88,18 +94,18 @@ context. Other saved sessions can still be reused by future chats. To remove the
 wrong local session, run `dench logout --session <session-key>`. Use
 `dench logout --all` only when you want to clear every local Dench session.
 
-Do not create or edit local agent memory files during setup. Use Dench logs for
-meaningful progress, and use Dench memory only when the human asks or when
-saving a stable workspace fact.
+Do not create or edit local agent memory files during setup. Use Dench
+memory only when the human asks or when saving a stable workspace fact.
 
-Do not create, claim, or log a setup task by default. Only create or claim a
-task if the human assigns work, an open matching task exists, or coordination
-benefits from creating one. For ad-hoc requests, work directly and only log
-meaningful work.
+Tasks live as CRM `task` entries — there is no separate `dench tasks`,
+`dench task`, `dench claim`, or `dench log` command. Create one via
+`dench crm entries create task --cells '{"Name":"…","Status":"Open"}'`
+only when the human assigns durable work or coordination benefits from
+a tracked entry. For ad-hoc requests, work directly.
 
-Use `dench context` when you need to know who you are, which workspace you are
-using, assigned tasks, pending approvals you requested, connected apps, and the
-best next commands. Add `--json` for structured output.
+Use `dench context` when you need to know who you are, which workspace you
+are using, pending approvals you requested, connected apps, and the best
+next commands. Add `--json` for structured output.
 
 ## Past chat threads
 
@@ -123,7 +129,7 @@ text — pick concrete tokens that the prior chat would have used (file
 paths, product names, error strings) rather than paraphrases.
 
 Inside a sandbox, `dench chat` uses `DENCH_API_KEY` + `DENCH_RUN_ID`
-automatically; locally, run `dench login` first.
+automatically; locally, run `dench signin` first.
 
 ## Billing
 
@@ -190,16 +196,16 @@ Run `dench tool --help` or `dench apps --help` for command help.
 For staging:
 
 ```bash
-dench login --staging
-dench login --host https://workspace-staging.dench.com
+dench signin --staging
+dench signin --host https://workspace-staging.dench.com
 ```
 
-## Sandbox / API key auth (no `dench login` required)
+## Sandbox / API key auth (no `dench signin` required)
 
 Inside a Daytona sandbox the unified Dench API key is baked into envVars
 at create time (see `src/lib/secrets/sandbox-tokens.ts`). When
 `DENCH_API_KEY` and `CONVEX_URL` are both present, the CLI skips the
-`dench login` flow entirely and uses the API key as a bearer for every
+`dench signin` flow entirely and uses the API key as a bearer for every
 org-scoped command — `dench crm`, `dench files`, `dench fs sync`, etc.
 
 ```bash
@@ -217,7 +223,7 @@ Auth precedence:
 
 1. Explicit `--dev` flag → use the dev workspace env (`NEXT_PUBLIC_CONVEX_URL`,
    `DENCH_WORKSPACE`, `DENCH_DEV_AGENT_KEY`).
-2. A locally-stored `dench login` session for the current backend (set via
+2. A locally-stored `dench signin` session for the current backend (set via
    `dench backend`, `--host`, `--prod`, or `--staging`).
 3. `DENCH_API_KEY` + `CONVEX_URL` (sandbox / automation path).
 
@@ -243,7 +249,7 @@ Auto-load now turns on only when one of:
 Explicit shell exports (`GATEWAY_URL=… ./dench …`) always win regardless.
 
 Commands that need to impersonate a specific agent (`dench memory`,
-`dench task`, `dench claim`, `dench log`, `dench approval request`,
-etc.) still require an agent session (`dench login`) — the unified API
-key is org-scoped and cannot speak as a single agent. Those commands
-return a clear "agent session required" error in API-key mode.
+`dench approval request`, etc.) still require an agent session
+(`dench signin`) — the unified API key is org-scoped and cannot speak
+as a single agent. Those commands return a clear "agent session
+required" error in API-key mode.

package/crm.ts

@@ -26,7 +26,7 @@
  *   crm docs      list / create / link
  *   crm actions   list / run / runs
  */
-import { ConvexHttpClient } from "convex/browser";
+import type { ConvexHttpClient } from "convex/browser";
 import { makeFunctionReference } from "convex/server";
 import {
   assertNoUnknownFlags as assertNoUnknownFlagsRaw,
@@ -40,18 +40,19 @@ import {
 import {
   autoDetectInputField,
   detectEnrichmentCategory,
-  extractEnrichmentValue,
-  findEnrichmentColumn,
-  getRequiredFieldsForApolloPath,
   type EnrichmentCategory,
   type EnrichmentColumnDef,
+  extractEnrichmentValue,
   type FieldCandidate,
+  findEnrichmentColumn,
+  getRequiredFieldsForApolloPath,
 } from "./lib/crm-enrichment";
 import {
   aviatoEnrichCompany,
   aviatoEnrichPerson,
-  enrichCompany,
   EnrichmentGatewayError,
+  type EnrichmentGatewayOptions,
+  enrichCompany,
   enrichPersonByIdentifier,
 } from "./lib/enrichment-gateway";
 
@@ -82,6 +83,7 @@ type CrmCliContext = {
    * organization context.
    */
   sessionToken?: string;
+  enrichmentGateway?: Pick<EnrichmentGatewayOptions, "apiKey" | "baseUrl">;
 };
 
 // Adapt the shared helpers to throw CrmCliError so existing call sites
@@ -310,12 +312,14 @@ function out(ctx: CrmCliContext, value: unknown): void {
   console.log(JSON.stringify(value, null, 2));
 }
 
-function getFieldEnrichmentFlag(args: string[]): {
-  category: EnrichmentCategory;
-  key: string;
-  apolloPath: string;
-  inputFieldName: string;
-} | undefined {
+function getFieldEnrichmentFlag(args: string[]):
+  | {
+      category: EnrichmentCategory;
+      key: string;
+      apolloPath: string;
+      inputFieldName: string;
+    }
+  | undefined {
   const category = parseCategoryFlag(getFlag(args, "--enrichment-category"));
   const key = getFlag(args, "--enrichment-key");
   const apolloPath = getFlag(args, "--apollo-path");
@@ -431,6 +435,7 @@ export async function runCrmCommand(opts: {
   convex: ConvexHttpClient;
   args: string[];
   sessionToken?: string;
+  enrichmentGateway?: Pick<EnrichmentGatewayOptions, "apiKey" | "baseUrl">;
 }): Promise<void> {
   const args = [...opts.args];
   const jsonOutput = hasFlag(args, "--json");
@@ -439,6 +444,7 @@ export async function runCrmCommand(opts: {
     args,
     jsonOutput,
     sessionToken: opts.sessionToken,
+    enrichmentGateway: opts.enrichmentGateway,
   };
   const subcommand = args.shift();
   if (!subcommand || subcommand === "help" || subcommand === "--help") {
@@ -1531,13 +1537,18 @@ type ObjectEnrichmentArgs = Omit<CellEnrichmentArgs, "entryId"> & {
   limit?: number;
 };
 
-function parseCategoryFlag(value: string | undefined): EnrichmentCategory | undefined {
+function parseCategoryFlag(
+  value: string | undefined,
+): EnrichmentCategory | undefined {
   if (value === undefined) return undefined;
   if (value === "people" || value === "company") return value;
   throw new CrmCliError("--category must be people or company");
 }
 
-function parsePositiveInt(flag: string, value: string | undefined): number | undefined {
+function parsePositiveInt(
+  flag: string,
+  value: string | undefined,
+): number | undefined {
   if (value === undefined) return undefined;
   const parsed = Number(value);
   if (!Number.isInteger(parsed) || parsed < 1) {
@@ -1556,7 +1567,9 @@ function asFields(value: unknown): CrmFieldForEnrichment[] {
     .filter((field): field is CrmFieldForEnrichment => {
       if (!field || typeof field !== "object") return false;
       const candidate = field as Record<string, unknown>;
-      return typeof candidate.name === "string" && typeof candidate.type === "string";
+      return (
+        typeof candidate.name === "string" && typeof candidate.type === "string"
+      );
     })
     .map((field) => ({
       id: typeof field.id === "string" ? field.id : undefined,
@@ -1601,7 +1614,9 @@ function asEntry(value: unknown): CrmEntryForEnrichment | null {
 
 function asEntries(value: unknown): CrmEntryForEnrichment[] {
   if (!Array.isArray(value)) return [];
-  return value.map(asEntry).filter((entry): entry is CrmEntryForEnrichment => !!entry);
+  return value
+    .map(asEntry)
+    .filter((entry): entry is CrmEntryForEnrichment => !!entry);
 }
 
 function resolveEnrichmentColumn(args: {
@@ -1668,7 +1683,8 @@ async function resolveEnrichmentTarget(
     apolloPath: args.apolloPath ?? outputField.enrichment?.apolloPath,
   });
 
-  const inputFieldName = args.inputFieldName ?? outputField.enrichment?.inputFieldName;
+  const inputFieldName =
+    args.inputFieldName ?? outputField.enrichment?.inputFieldName;
   const inputField = inputFieldName
     ? fields.find((field) => field.name === inputFieldName)
     : autoDetectInputField(category, fields);
@@ -1693,6 +1709,7 @@ async function callEnrichmentGatewayForEntry(args: {
   entry: CrmEntryForEnrichment;
   /** Explicit provider override. Defaults: people=fullenrich, company=aviato. */
   provider?: string;
+  gateway?: Pick<EnrichmentGatewayOptions, "apiKey" | "baseUrl">;
 }): Promise<Record<string, unknown>> {
   const input = args.entry.fields[args.target.inputField.name];
   if (!hasCellValue(input)) {
@@ -1702,7 +1719,8 @@ async function callEnrichmentGatewayForEntry(args: {
   }
   const inputValue = String(input);
   const isCompany = args.target.category === "company";
-  const resolvedProvider = args.provider ?? (isCompany ? "aviato" : "fullenrich");
+  const resolvedProvider =
+    args.provider ?? (isCompany ? "aviato" : "fullenrich");
 
   if (resolvedProvider === "aviato") {
     // Guard: Aviato does not return phone or email.
@@ -1718,25 +1736,37 @@ async function callEnrichmentGatewayForEntry(args: {
       const isLinkedin = /linkedin\.com/i.test(inputValue);
       return aviatoEnrichCompany(
         isLinkedin ? { linkedinUrl: inputValue } : { website: inputValue },
+        args.gateway,
       );
     } else {
       // For people, inputValue may be a LinkedIn URL, email, or LinkedIn ID
       const isLinkedin = /linkedin\.com/i.test(inputValue);
       const isEmail = /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(inputValue);
-      if (isLinkedin) return aviatoEnrichPerson({ linkedinUrl: inputValue });
-      if (isEmail) return aviatoEnrichPerson({ email: inputValue });
-      return aviatoEnrichPerson({ linkedinID: inputValue });
+      if (isLinkedin) {
+        return aviatoEnrichPerson({ linkedinUrl: inputValue }, args.gateway);
+      }
+      if (isEmail) {
+        return aviatoEnrichPerson({ email: inputValue }, args.gateway);
+      }
+      return aviatoEnrichPerson({ linkedinID: inputValue }, args.gateway);
     }
   }
 
   // fullenrich path (default for people, explicit override for companies)
   if (isCompany) {
-    return enrichCompany({
-      domain: inputValue,
-      requiredFields: args.target.requiredFields,
-    });
+    return enrichCompany(
+      {
+        domain: inputValue,
+        requiredFields: args.target.requiredFields,
+      },
+      args.gateway,
+    );
   }
-  return enrichPersonByIdentifier(inputValue, args.target.requiredFields);
+  return enrichPersonByIdentifier(
+    inputValue,
+    args.target.requiredFields,
+    args.gateway,
+  );
 }
 
 async function enrichOneEntry(
@@ -1751,6 +1781,7 @@ async function enrichOneEntry(
       target: args.target,
       entry: args.entry,
       provider: args.provider,
+      gateway: ctx.enrichmentGateway,
     });
     const value = extractEnrichmentValue(payload, args.target.column);
     if (value === null) {
@@ -1779,7 +1810,10 @@ async function enrichOneEntry(
       ...writeResult,
     };
   } catch (error) {
-    if (error instanceof EnrichmentGatewayError || error instanceof CrmCliError) {
+    if (
+      error instanceof EnrichmentGatewayError ||
+      error instanceof CrmCliError
+    ) {
       return {
         entryId: args.entry.id,
         ok: false,