@dench.com/cli 2.0.0 → 2.0.2

package/dench.ts

@@ -97,7 +97,6 @@ type ConfigFile = {
 type WorkspaceOverview = {
   agents: Array<{ _id: string } & JsonRecord>;
   projects: JsonRecord[];
-  tasks: JsonRecord[];
   approvals: Array<{ status?: string } & JsonRecord>;
   rules: JsonRecord[];
   recentArtifacts?: JsonRecord[];
@@ -119,33 +118,12 @@ type AgentStatus = {
 const api = {
   functions: {
     agentWorkspace: {
-      agentAppendLog: makeFunctionReference<"mutation">(
-        "functions/agentWorkspace:agentAppendLog",
-      ),
-      agentClaimTask: makeFunctionReference<"mutation">(
-        "functions/agentWorkspace:agentClaimTask",
-      ),
-      agentCreateTask: makeFunctionReference<"mutation">(
-        "functions/agentWorkspace:agentCreateTask",
-      ),
-      agentAddTaskComment: makeFunctionReference<"mutation">(
-        "functions/agentWorkspace:agentAddTaskComment",
-      ),
-      agentAddTaskDependency: makeFunctionReference<"mutation">(
-        "functions/agentWorkspace:agentAddTaskDependency",
-      ),
-      agentConvertSuggestionToTask: makeFunctionReference<"mutation">(
-        "functions/agentWorkspace:agentConvertSuggestionToTask",
-      ),
       agentDecideApproval: makeFunctionReference<"mutation">(
         "functions/agentWorkspace:agentDecideApproval",
       ),
       agentListArtifacts: makeFunctionReference<"query">(
         "functions/agentWorkspace:agentListArtifacts",
       ),
-      agentListTasks: makeFunctionReference<"query">(
-        "functions/agentWorkspace:agentListTasks",
-      ),
       agentRequestApproval: makeFunctionReference<"mutation">(
         "functions/agentWorkspace:agentRequestApproval",
       ),
@@ -161,24 +139,12 @@ const api = {
       getAgentBillingStatus: makeFunctionReference<"query">(
         "functions/agentWorkspace:getAgentBillingStatus",
       ),
-      agentUpdateTaskStatus: makeFunctionReference<"mutation">(
-        "functions/agentWorkspace:agentUpdateTaskStatus",
-      ),
       createSignInRequest: makeFunctionReference<"mutation">(
         "functions/agentWorkspace:createSignInRequest",
       ),
-      devAppendLog: makeFunctionReference<"mutation">(
-        "functions/agentWorkspace:devAppendLog",
-      ),
-      devClaimTask: makeFunctionReference<"mutation">(
-        "functions/agentWorkspace:devClaimTask",
-      ),
       devCreateProject: makeFunctionReference<"mutation">(
         "functions/agentWorkspace:devCreateProject",
       ),
-      devCreateTask: makeFunctionReference<"mutation">(
-        "functions/agentWorkspace:devCreateTask",
-      ),
       devListWorkspaceOverview: makeFunctionReference<"query">(
         "functions/agentWorkspace:devListWorkspaceOverview",
       ),
@@ -431,20 +397,11 @@ Usage:
   dench backend [show|set|clear] [<production|staging|local|<url>>] [--json]
   dench context [--json]
   dench status [--mine|--self] [--json]
-  dench tasks [--json]
-  dench task create "title" [--description "..."] [--priority low|medium|high] [--risk low|medium|high] [--json]
-  dench task status <taskId> <open|claimed|in_progress|waiting_approval|completed|canceled> [--note "..."] [--json]
-  dench task comment <taskId> "message" [--json]
-  dench task handoff <taskId> "message" --agent <agentId> [--json]
-  dench task block <taskId> "message" [--json]
-  dench claim <taskId> [--json]
-  dench log "message" [--task <taskId>] [--json]
   dench memory search "query" [--limit 8] [--json]
   dench memory save <key> "text" [--kind fact|decision|preference|goal|tool_note|other] [--tags a,b] [--sensitivity normal|broad|sensitive] [--json]
   dench artifacts [--limit 25] [--json]
   dench suggested-work [--json]
-  dench suggested-work task <artifactId> [--json]
-  dench approval request "message" [--task <taskId>] [--json]
+  dench approval request "message" [--json]
   dench approval approve <approvalId> [--evidence "User said yes in chat"] [--json]
   dench approval reject <approvalId> [--evidence "User said no in chat"] [--json]
   dench billing status [--json]
@@ -483,7 +440,7 @@ Workspace members (for CRM \`user\`-type fields):
       cells assign to real members instead of being stored as unlinked
       display-name strings. See \`dench members help\`.
 
-Live web search (Exa via the Dench Cloud Gateway, auths with DENCH_API_KEY):
+Live web search (Exa via the Dench Cloud Gateway, auths with the active \`dench signin\` agent session or DENCH_API_KEY):
   dench search "<query>" [--num-results N] [--type auto|fast|deep|deep-reasoning|neural] [--category news|company|people|...] [--include-domains a.com,b.com] [--exclude-domains c.com] [--max-chars 800] [--json]
   dench search contents <url> [<url>...] [--max-chars 4000] [--summary "..."] [--json]
   dench search answer "<query>" [--json]
@@ -579,8 +536,9 @@ Agent setup:
   Defaults to "other" when omitted. Values are normalized to lowercase
   snake_case before send (e.g. "Claude Code" -> claude_code).
   After sign-in, run dench context --json and dench crm objects list --json
-  to verify the workspace + CRM are wired up.
-  Do not create, claim, or log a setup task by default.
+  to verify the workspace + CRM are wired up. Tasks live as CRM \`task\`
+  entries — there is no separate \`dench tasks\` / \`dench task\` /
+  \`dench claim\` / \`dench log\` command.
 
 Backends and hosts:
   Default backend: ${DEFAULT_HOST} (overridden by \`dench backend set\`)
@@ -622,10 +580,11 @@ Usage:
   dench tool disconnect <connectionId> [--json]
 
 Auth:
-  All commands authenticate with DENCH_API_KEY (Bearer) directly to the
-  Dench Cloud Gateway. No \`dench signin\` agent session is required —
-  inside a Dench sandbox the key is baked into the env automatically;
-  outside, export DENCH_API_KEY=<key> first.
+  All commands authenticate with the active \`dench signin\` agent
+  session OR with DENCH_API_KEY (Bearer), whichever is set. Inside a
+  Dench sandbox DENCH_API_KEY is baked into the env automatically; on
+  a developer machine \`dench signin\` to a paid workspace works the
+  same way (the CLI exchanges the session for a gateway key on demand).
 
 Notes:
   dench apps is an alias for dench tool status.
@@ -664,10 +623,8 @@ function artifactsHelp() {
 Usage:
   dench artifacts [--limit 25] [--json]
   dench suggested-work [--json]
-  dench suggested-work task <artifactId> [--json]
 
-Artifacts are durable outputs for human or agent review. Suggested work can
-be converted into a workspace task.
+Artifacts are durable outputs for human or agent review.
 `);
 }
 
@@ -727,20 +684,6 @@ Notes:
 `);
 }
 
-function tasksHelp() {
-  console.log(`Dench tasks
-
-Usage:
-  dench tasks [--json]
-
-Notes:
-  List workspace tasks before creating new ones.
-  Do not create, claim, or log a setup task by default.
-  Only create or claim a task if the human assigns work, an open matching task
-  exists, or coordination benefits from creating one.
-`);
-}
-
 function logoutHelp() {
   console.log(`Dench logout
 
@@ -761,9 +704,9 @@ Usage:
   dench apps [--json]
 
 Lists all external apps connected to this organization (Slack, Gmail,
-GitHub, etc.). Authenticates with DENCH_API_KEY (Bearer) directly to the
-Dench Cloud Gateway — no \`dench signin\` agent session required. Alias
-for \`dench tool status\`.
+GitHub, etc.). Authenticates with the active \`dench signin\` agent
+session or DENCH_API_KEY (Bearer), whichever is set. Alias for
+\`dench tool status\`.
 `);
 }
 
@@ -966,11 +909,12 @@ function backendSnapshot(config: ConfigFile) {
     : null;
   const envHost = process.env.DENCH_HOST?.trim() || null;
   const argBackend =
-    option("--backend") ?? (hasFlag("--prod")
+    option("--backend") ??
+    (hasFlag("--prod")
       ? "production"
       : hasFlag("--staging")
         ? "staging"
-        : option("--host") ?? null);
+        : (option("--host") ?? null));
 
   let source: "flag" | "env" | "config" | "default";
   if (argBackend) source = "flag";
@@ -1078,7 +1022,9 @@ async function backendSet() {
       "Local backend selected. dench will now also load .env / .env.local from the workspace so GATEWAY_URL etc. are picked up.",
     );
   }
-  print("Future `dench` commands without --prod/--staging/--host will target this backend.");
+  print(
+    "Future `dench` commands without --prod/--staging/--host will target this backend.",
+  );
 }
 
 async function backendClear() {
@@ -1706,8 +1652,7 @@ async function signinViaBrowser(input: {
       agentName: input.agentName,
       agentKind: input.agentKind,
       intent: input.intent,
-      proposedOrganizationName:
-        input.proposedOrganizationName ?? undefined,
+      proposedOrganizationName: input.proposedOrganizationName ?? undefined,
       requestedOrganizationSelector: input.orgSelector ?? undefined,
       userAgent: "@dench.com/cli",
     },
@@ -1841,7 +1786,8 @@ async function signinViaOtp(input: {
   // resolvable (single admin org or create_workspace intent) and the
   // server hands us a session, OR we get an auth token + list and
   // need a third call.
-  const code = option("--otp-code")?.trim() || (await promptLine("Paste OTP: "));
+  const code =
+    option("--otp-code")?.trim() || (await promptLine("Paste OTP: "));
   if (!/^\d{6}$/.test(code)) {
     throw new CliError("OTP code must be exactly 6 digits.", {
       code: "invalid_otp_code",
@@ -1857,8 +1803,7 @@ async function signinViaOtp(input: {
       agentKind: input.agentKind,
       sessionTokenHash: input.sessionTokenHash,
       intent: input.intent,
-      proposedOrganizationName:
-        input.proposedOrganizationName ?? undefined,
+      proposedOrganizationName: input.proposedOrganizationName ?? undefined,
       organizationSelector: input.orgSelector ?? undefined,
       userAgent: "@dench.com/cli",
     }),
@@ -1878,8 +1823,15 @@ async function signinViaOtp(input: {
 
   // Branch A: server minted the session in one shot.
   if (result.kind === "completed") {
-    assertOtpCompletedOrgMatchesSelector(result.organization, input.orgSelector);
-    await finalizeOtpSession(input, result.organization, result.sessionExpiresAt);
+    assertOtpCompletedOrgMatchesSelector(
+      result.organization,
+      input.orgSelector,
+    );
+    await finalizeOtpSession(
+      input,
+      result.organization,
+      result.sessionExpiresAt,
+    );
     return;
   }
 
@@ -2020,7 +1972,11 @@ async function resolveOrgChoiceForOtp(input: {
 
   const answer = await promptLine("Pick a number: ");
   const choice = Number(answer);
-  if (!Number.isFinite(choice) || choice < 1 || choice > input.organizations.length + 1) {
+  if (
+    !Number.isFinite(choice) ||
+    choice < 1 ||
+    choice > input.organizations.length + 1
+  ) {
     throw new CliError(`Invalid choice: ${answer}`, {
       code: "invalid_org_choice",
     });
@@ -2234,9 +2190,7 @@ async function denchUpgrade(runtime: Runtime) {
   if (updatedInPlace) {
     const message = `Upgraded to Dench ${tierFlag === "pro" ? "Pro" : "Max"} in place — no Stripe Checkout needed.`;
     print(
-      json
-        ? { ok: true, updated: true, tier: tierFlag, message }
-        : message,
+      json ? { ok: true, updated: true, tier: tierFlag, message } : message,
     );
     return;
   }
@@ -2487,6 +2441,103 @@ function requireAuthenticatedRuntime(
   throw loginRequiredError(command);
 }
 
+type GatewayCommandAuth = {
+  bearerToken: string;
+  gatewayBaseUrl?: string;
+};
+
+function gatewayBaseUrlForCli(value: unknown): string | undefined {
+  if (typeof value !== "string") return undefined;
+  const trimmed = value.trim().replace(/\/+$/, "");
+  if (!trimmed) return undefined;
+  // The desktop endpoint returns a `/v1` base; CLI gateway modules append
+  // `/v1/...` paths themselves, so normalize to the root origin here.
+  return trimmed.replace(/\/v1$/, "");
+}
+
+async function parseJsonResponseBody(response: Response): Promise<JsonRecord> {
+  const text = await response.text().catch(() => "");
+  if (!text.trim()) return {};
+  try {
+    const parsed = JSON.parse(text);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed)
+      ? (parsed as JsonRecord)
+      : {};
+  } catch {
+    return { error: text };
+  }
+}
+
+function gatewayAuthError(
+  command: string,
+  response: Response,
+  body: JsonRecord,
+) {
+  const code =
+    typeof body.error === "string" && body.error.trim()
+      ? body.error.trim()
+      : `gateway_key_${response.status}`;
+  if (response.status === 403 && code === "no_active_subscription") {
+    return new CliError(`${command} requires a paid Dench workspace`, {
+      code: "paid_workspace_required",
+      nextActions: [
+        "Run dench upgrade --tier pro or dench upgrade --tier max, then retry.",
+      ],
+    });
+  }
+  if (response.status === 401) {
+    return loginRequiredError(command);
+  }
+  return new CliError(`${command} could not get a gateway key (${code})`, {
+    code,
+    status: response.status,
+    nextActions: [
+      "Confirm this agent is signed in to the intended workspace.",
+      "If the workspace is paid, retry after a minute in case gateway key provisioning is still finishing.",
+    ],
+  });
+}
+
+async function resolveGatewayCommandAuth(
+  runtime: Runtime,
+  command: string,
+): Promise<GatewayCommandAuth> {
+  if (runtime.mode === "apiKey") {
+    return { bearerToken: runtime.sessionToken };
+  }
+
+  if (runtime.mode === "session") {
+    const response = await fetch(
+      `${runtime.host.replace(/\/+$/, "")}/api/desktop/organizations/gateway-key`,
+      {
+        headers: {
+          accept: "application/json",
+          authorization: `Bearer ${runtime.sessionToken}`,
+        },
+      },
+    );
+    const body = await parseJsonResponseBody(response);
+    if (!response.ok) {
+      throw gatewayAuthError(command, response, body);
+    }
+    const gatewayKey =
+      typeof body.gatewayKey === "string" ? body.gatewayKey.trim() : "";
+    if (!gatewayKey) {
+      throw new CliError(`${command} could not get a gateway key`, {
+        code: "missing_gateway_key",
+      });
+    }
+    return {
+      bearerToken: gatewayKey,
+      gatewayBaseUrl: gatewayBaseUrlForCli(body.gatewayBaseUrl),
+    };
+  }
+
+  const envApiKey = process.env.DENCH_API_KEY?.trim();
+  if (envApiKey) return { bearerToken: envApiKey };
+  throw loginRequiredError(command);
+}
+
 function encodeDevCrmSessionToken(args: {
   workspaceSlug: string;
   devKey: string;
@@ -2508,10 +2559,9 @@ function agentSessionRequiredError(command: string) {
 }
 
 /**
- * Some legacy `agentWorkspace.*` commands (task create / claim / log /
- * approval request) have separate session vs dev branches. With apiKey
- * mode added, the dev branch would silently receive partial args. Use
- * this to short-circuit those branches with a clear error.
+ * `dench approval request` has separate session vs dev branches. With
+ * apiKey mode added, the dev branch would silently receive partial args.
+ * Use this to short-circuit that branch with a clear error.
  *
  * Asserts away the `apiKey` mode so the caller's downstream type
  * narrowing (e.g. `runtime.workspaceArgs`) keeps working.
@@ -2602,19 +2652,30 @@ function workspaceUrls(host: string, workspaceSlug: string | undefined) {
 function nextContextCommands() {
   return [
     "dench context --json",
-    "dench tasks --json",
-    'dench log "Brief progress update"',
+    "dench crm entries list task --json",
     'dench tool search "what you need" --toolkit <app>',
     'dench approval request "Risky action to approve"',
   ];
 }
 
-async function connectedAppsContext(_runtime: Runtime) {
-  // Reach the Dench gateway directly with DENCH_API_KEY (mirrors the
-  // denchclaw pattern). This works for every Runtime mode — session,
-  // apiKey, dev — because the gateway only cares about the bearer key,
-  // not which Convex session is calling.
-  return fetchConnectedAppsSummary();
+async function connectedAppsContext(runtime: Runtime) {
+  try {
+    const gatewayAuth = await resolveGatewayCommandAuth(
+      runtime,
+      "dench context",
+    );
+    return fetchConnectedAppsSummary({
+      bearerToken: gatewayAuth.bearerToken,
+      gatewayBaseUrl: gatewayAuth.gatewayBaseUrl,
+    });
+  } catch (error) {
+    return {
+      available: false,
+      reason: errorMessage(error),
+      count: 0,
+      connections: [],
+    };
+  }
 }
 
 async function buildContext(runtime: Runtime) {
@@ -2677,15 +2738,6 @@ function formatContext(context: JsonRecord) {
   const workspace = asRecord(context.workspace);
   const connectedApps = asRecord(context.connectedApps);
   const connections = asRecordArray(connectedApps?.connections);
-  const tasksRecord = asRecord(context.tasks);
-  const tasks =
-    asRecordArray(tasksRecord?.assignedToMe).length > 0 ||
-    asRecordArray(tasksRecord?.open).length > 0
-      ? [
-          ...asRecordArray(tasksRecord?.assignedToMe),
-          ...asRecordArray(tasksRecord?.open),
-        ]
-      : asRecordArray(context.tasks);
   const approvals = asRecordArray(context.pendingApprovals);
   const suggestedWork = asRecordArray(context.suggestedWork);
   const memories = asRecordArray(context.memory);
@@ -2708,10 +2760,7 @@ function formatContext(context: JsonRecord) {
     `Agent: ${agentDisplayName(agent)}${
       stringField(agent, "kind") ? ` [${stringField(agent, "kind")}]` : ""
     }`,
-    `Counts: ${formatCount(counts?.tasks ?? tasks.length)} visible tasks, ${formatCount(
-      counts?.myAssignedTasks ??
-        asRecordArray(tasksRecord?.assignedToMe).length,
-    )} assigned to me, ${formatCount(
+    `Counts: ${formatCount(
       counts?.myPendingApprovals ?? approvals.length,
     )} pending approvals`,
   ];
@@ -2725,21 +2774,6 @@ function formatContext(context: JsonRecord) {
     );
   }
 
-  lines.push("", "Assigned tasks:");
-
-  if (tasks.length === 0) {
-    lines.push("  none");
-  } else {
-    lines.push(
-      ...tasks
-        .slice(0, 5)
-        .map(
-          (task) =>
-            `  - ${stringField(task, "title") ?? stringField(task, "id") ?? "untitled"} [${stringField(task, "status") ?? "unknown"}]`,
-        ),
-    );
-  }
-
   lines.push("", "Pending approvals requested by me:");
   if (approvals.length === 0) {
     lines.push("  none");
@@ -2838,7 +2872,6 @@ function summarizeDevOverview(workspaceSlug: string, data: WorkspaceOverview) {
     workspace: workspaceSlug,
     agents: data.agents.length,
     projects: data.projects.length,
-    tasks: data.tasks.length,
     approvals: data.approvals.filter(
       (approval) => approval.status === "pending",
     ).length,
@@ -2846,37 +2879,18 @@ function summarizeDevOverview(workspaceSlug: string, data: WorkspaceOverview) {
   };
 }
 
-function compactTask(task: JsonRecord) {
-  return {
-    id: task._id ?? task.id,
-    title: task.title,
-    status: task.status,
-    priority: task.priority,
-    risk: task.risk,
-    assignedAgentId: task.assignedAgentId,
-  };
-}
-
 function compactApproval(approval: JsonRecord) {
   return {
     id: approval.id ?? approval._id,
     title: approval.title,
     risk: approval.risk,
     status: approval.status,
-    taskId: approval.taskId,
     createdAt: approval.createdAt,
   };
 }
 
-function summarizeAgentStatus(
-  status: AgentStatus,
-  tasks: JsonRecord[],
-  host?: string,
-) {
+function summarizeAgentStatus(status: AgentStatus, host?: string) {
   const agentId = status.agent?.id;
-  const assignedTasks = agentId
-    ? tasks.filter((task) => task.assignedAgentId === agentId)
-    : [];
   const pendingApprovals = (status.approvals ?? []).filter(
     (approval) => approval.status === "pending" && approval.agentId === agentId,
   );
@@ -2889,11 +2903,9 @@ function summarizeAgentStatus(
     agent: status.agent,
     counts: {
       ...(status.counts ?? {}),
-      myAssignedTasks: assignedTasks.length,
       myPendingApprovals: pendingApprovals.length,
     },
     rules: status.rules ?? [],
-    tasks: assignedTasks.map(compactTask),
     pendingApprovals: pendingApprovals.map(compactApproval),
   };
 }
@@ -2901,7 +2913,6 @@ function summarizeAgentStatus(
 function summarizeDevMine(workspaceSlug: string, data: WorkspaceOverview) {
   const agentId = option("--agent") ?? data.agents[0]?._id;
   const agent = data.agents.find((item) => item._id === agentId) ?? null;
-  const tasks = data.tasks.filter((task) => task.assignedAgentId === agentId);
   const pendingApprovals = data.approvals.filter(
     (approval) => approval.status === "pending" && approval.agentId === agentId,
   );
@@ -2912,33 +2923,17 @@ function summarizeDevMine(workspaceSlug: string, data: WorkspaceOverview) {
     counts: {
       agents: data.agents.length,
       projects: data.projects.length,
-      tasks: data.tasks.length,
       pendingApprovals: data.approvals.filter(
         (approval) => approval.status === "pending",
       ).length,
       rules: data.rules.length,
-      myAssignedTasks: tasks.length,
       myPendingApprovals: pendingApprovals.length,
     },
     rules: data.rules,
-    tasks: tasks.map(compactTask),
     pendingApprovals: pendingApprovals.map(compactApproval),
   };
 }
 
-async function defaultDevAgentId(
-  runtime: Awaited<ReturnType<typeof getRuntime>>,
-) {
-  const data = await devOverview(runtime);
-  const agent = data.agents[0];
-  if (!agent) {
-    throw new Error(
-      'No agent registered yet. Run: dench signin --kind <kind> --name "AI Agent - Project"',
-    );
-  }
-  return agent._id;
-}
-
 async function listArtifacts(runtime: Runtime, limit?: number) {
   if (runtime.mode === "session") {
     try {
@@ -3024,26 +3019,12 @@ function normalizeFilesPath(input: string): string {
   return cleaned;
 }
 
-function filesApiKey(runtime: Runtime): string | undefined {
-  if (runtime.mode === "apiKey") return runtime.sessionToken;
-  return process.env.DENCH_API_KEY?.trim() || undefined;
-}
-
-function requireFilesApiKey(runtime: Runtime, command: string): string {
-  const apiKey = filesApiKey(runtime);
-  if (!apiKey) {
-    throw new CliError(
-      `${command} needs DENCH_API_KEY (or a sandbox-baked api-key session). It bypasses the user-session auth path.`,
-      {
-        code: "files_api_key_required",
-        nextActions: [
-          "Run inside a Dench sandbox where DENCH_API_KEY is baked in.",
-          "Or export DENCH_API_KEY=<key> first (see dench signin output).",
-        ],
-      },
-    );
-  }
-  return apiKey;
+async function requireFilesApiKey(
+  runtime: Runtime,
+  command: string,
+): Promise<string> {
+  const auth = await resolveGatewayCommandAuth(runtime, command);
+  return auth.bearerToken;
 }
 
 type FileTreeRow = {
@@ -3143,7 +3124,7 @@ async function uploadConvexFileBytes(
 
 async function runFilesLs() {
   const runtime = await getRuntime();
-  const apiKey = requireFilesApiKey(runtime, "dench files ls");
+  const apiKey = await requireFilesApiKey(runtime, "dench files ls");
   const target = normalizeFilesPath(positional(2) ?? "/");
   const recursive = hasFlag("--recursive") || hasFlag("-r");
   const rows = recursive
@@ -3180,7 +3161,7 @@ async function runFilesLs() {
 
 async function runFilesMv() {
   const runtime = await getRuntime();
-  const apiKey = requireFilesApiKey(runtime, "dench files mv");
+  const apiKey = await requireFilesApiKey(runtime, "dench files mv");
   const fromRaw = positional(2);
   const toRaw = positional(3);
   if (!fromRaw || !toRaw) {
@@ -3252,7 +3233,7 @@ async function runFilesMv() {
 
 async function runFilesRm() {
   const runtime = await getRuntime();
-  const apiKey = requireFilesApiKey(runtime, "dench files rm");
+  const apiKey = await requireFilesApiKey(runtime, "dench files rm");
   const targetRaw = positional(2);
   if (!targetRaw) {
     throw new CliError("Usage: dench files rm <path> [--recursive]", {
@@ -3439,7 +3420,7 @@ async function* walkLocalFiles(
 
 async function runStage() {
   const runtime = await getRuntime();
-  const apiKey = requireFilesApiKey(runtime, "dench stage");
+  const apiKey = await requireFilesApiKey(runtime, "dench stage");
   const localRaw = positional(1);
   const destRaw = positional(2);
   if (!localRaw) {
@@ -3694,15 +3675,13 @@ async function main() {
   // clean redirect to the new unified surface so old `npx` caches and
   // pre-existing agent prompts get a one-line nudge instead of an
   // opaque "Unknown command" error.
-  if (
-    isDeprecatedAuthCommand
-  ) {
+  if (isDeprecatedAuthCommand) {
     throw new CliError(
       `\`dench ${command}\` was removed in @dench.com/cli v2. Run \`dench signin\` instead.`,
       {
         code: "deprecated_command",
         nextActions: [
-          'Run `dench signin` to connect this agent to an existing workspace.',
+          "Run `dench signin` to connect this agent to an existing workspace.",
           'Run `dench signin --new-workspace --org-name "<name>"` to create a free CRM-only workspace.',
           "Upgrade the CLI globally with `npm install -g @dench.com/cli@latest`.",
         ],
@@ -3736,20 +3715,12 @@ async function main() {
     return;
   }
 
-  if (command === "tasks" && hasFlag("--help")) {
-    tasksHelp();
-    return;
-  }
-
   if (command === "logout" && hasFlag("--help")) {
     logoutHelp();
     return;
   }
 
-  if (
-    command === "backend" &&
-    (subcommand === "help" || hasFlag("--help"))
-  ) {
+  if (command === "backend" && (subcommand === "help" || hasFlag("--help"))) {
     backendHelp();
     return;
   }
@@ -3776,18 +3747,38 @@ async function main() {
     // `requireCrmAccess` (convex/lib/crm/access.ts) dispatches on the
     // bearer prefix and resolves the org for both.
     if (runtime.mode === "dev") {
+      const gatewayAuth =
+        subArgs[0] === "enrich"
+          ? await resolveGatewayCommandAuth(runtime, "dench crm enrich")
+          : undefined;
       await runCrmCommand({
         convex: runtime.client,
         args: subArgs,
         sessionToken: encodeDevCrmSessionToken(runtime.workspaceArgs),
+        enrichmentGateway: gatewayAuth
+          ? {
+              apiKey: gatewayAuth.bearerToken,
+              baseUrl: gatewayAuth.gatewayBaseUrl,
+            }
+          : undefined,
       });
       return;
     }
     const authedRuntime = requireAuthenticatedRuntime(runtime, "dench crm");
+    const gatewayAuth =
+      subArgs[0] === "enrich"
+        ? await resolveGatewayCommandAuth(authedRuntime, "dench crm enrich")
+        : undefined;
     await runCrmCommand({
       convex: authedRuntime.client,
       args: subArgs,
       sessionToken: authedRuntime.sessionToken,
+      enrichmentGateway: gatewayAuth
+        ? {
+            apiKey: gatewayAuth.bearerToken,
+            baseUrl: gatewayAuth.gatewayBaseUrl,
+          }
+        : undefined,
     });
     return;
   }
@@ -3820,10 +3811,7 @@ async function main() {
       });
       return;
     }
-    const authedRuntime = requireAuthenticatedRuntime(
-      runtime,
-      "dench members",
-    );
+    const authedRuntime = requireAuthenticatedRuntime(runtime, "dench members");
     await runMembersCommand({
       convex: authedRuntime.client,
       args: subArgs,
@@ -3848,44 +3836,76 @@ async function main() {
   }
 
   if (command === "search") {
-    // `dench search` talks straight to the gateway over HTTP using
-    // DENCH_API_KEY; it deliberately bypasses requireSessionRuntime so
-    // it works in any sandbox / CI environment that has the key.
     const subArgs = args.slice(args.indexOf("search") + 1);
     const filteredSubArgs = subArgs.filter((a) => a !== "--json");
     const { runSearchCommand } = await import("./search");
-    await runSearchCommand({ args: filteredSubArgs, jsonOutput: json });
+    const sub = filteredSubArgs[0];
+    if (!sub || sub === "help" || sub === "--help" || sub === "-h") {
+      await runSearchCommand({ args: filteredSubArgs, jsonOutput: json });
+      return;
+    }
+    const runtime = await getRuntime();
+    const gatewayAuth = await resolveGatewayCommandAuth(
+      runtime,
+      "dench search",
+    );
+    await runSearchCommand({
+      args: filteredSubArgs,
+      jsonOutput: json,
+      bearerToken: gatewayAuth.bearerToken,
+      gatewayBaseUrl: gatewayAuth.gatewayBaseUrl,
+    });
     return;
   }
 
   if (command === "image") {
-    // `dench image generate|edit` mirrors `dench search`: straight HTTP
-    // to the gateway with DENCH_API_KEY, no Convex session required.
-    // The gateway writes the bytes to Convex Storage on success; we
-    // also drop them on local disk so the next bash command sees them.
     const subArgs = args.slice(args.indexOf("image") + 1);
     const filteredSubArgs = subArgs.filter((a) => a !== "--json");
     const { runImageCommand } = await import("./image");
-    await runImageCommand({ args: filteredSubArgs, jsonOutput: json });
+    const sub = filteredSubArgs[0];
+    if (!sub || sub === "help" || sub === "--help" || sub === "-h") {
+      await runImageCommand({ args: filteredSubArgs, jsonOutput: json });
+      return;
+    }
+    const runtime = await getRuntime();
+    const gatewayAuth = await resolveGatewayCommandAuth(runtime, "dench image");
+    await runImageCommand({
+      args: filteredSubArgs,
+      jsonOutput: json,
+      bearerToken: gatewayAuth.bearerToken,
+      gatewayBaseUrl: gatewayAuth.gatewayBaseUrl,
+    });
     return;
   }
 
   if (command === "apps") {
-    // `dench apps` is an alias for `dench tool status`. Both speak
-    // straight HTTP to the Dench Cloud Gateway with DENCH_API_KEY —
-    // mirrors the denchclaw pattern. No Convex session involved.
-    await runToolCommand({ args: ["status"], jsonOutput: json });
+    const runtime = await getRuntime();
+    const gatewayAuth = await resolveGatewayCommandAuth(runtime, "dench apps");
+    await runToolCommand({
+      args: ["status"],
+      jsonOutput: json,
+      bearerToken: gatewayAuth.bearerToken,
+      gatewayBaseUrl: gatewayAuth.gatewayBaseUrl,
+    });
     return;
   }
 
   if (command === "tool") {
-    // `dench tool {status,connect,search,run,disconnect}` is the model-facing
-    // composio surface and only needs DENCH_API_KEY (Bearer) on the
-    // gateway. Bypasses requireSessionRuntime entirely so it works in
-    // every sandbox / API-key context.
     const subArgs = stripRuntimeFlags(args.slice(args.indexOf("tool") + 1));
     const filteredSubArgs = subArgs.filter((a) => a !== "--json");
-    await runToolCommand({ args: filteredSubArgs, jsonOutput: json });
+    const sub = filteredSubArgs[0];
+    if (!sub || sub === "help" || sub === "--help" || sub === "-h") {
+      await runToolCommand({ args: filteredSubArgs, jsonOutput: json });
+      return;
+    }
+    const runtime = await getRuntime();
+    const gatewayAuth = await resolveGatewayCommandAuth(runtime, "dench tool");
+    await runToolCommand({
+      args: filteredSubArgs,
+      jsonOutput: json,
+      bearerToken: gatewayAuth.bearerToken,
+      gatewayBaseUrl: gatewayAuth.gatewayBaseUrl,
+    });
     return;
   }
 
@@ -4193,50 +4213,6 @@ async function main() {
   }
 
   if (command === "suggested-work") {
-    if (subcommand === "task") {
-      const sessionRuntime = requireSessionRuntime(
-        runtime,
-        "dench suggested-work task",
-      );
-      const artifactId = positional(2);
-      if (!artifactId) {
-        throw new Error("Usage: dench suggested-work task <artifactId>");
-      }
-      print(
-        await sessionRuntime.client
-          .mutation(api.functions.agentWorkspace.agentConvertSuggestionToTask, {
-            sessionToken: sessionRuntime.sessionToken,
-            artifactId: artifactId as never,
-          })
-          .catch(async (error) => {
-            if (!isMissingConvexFunction(error)) throw error;
-            const suggestion = (await listSuggestedWork(runtime)).find(
-              (item) => stringField(item, "id") === artifactId,
-            );
-            if (!suggestion) throw error;
-            const title = stringField(suggestion, "title") ?? "Suggested work";
-            const created = (await sessionRuntime.client.mutation(
-              api.functions.agentWorkspace.agentCreateTask,
-              {
-                sessionToken: sessionRuntime.sessionToken,
-                title,
-                description: stringField(suggestion, "content"),
-                priority: "medium",
-                risk: "medium",
-              },
-            )) as JsonRecord;
-            return {
-              ok: true,
-              fallback: true,
-              artifactId,
-              title,
-              taskId: created.taskId,
-              note: "Created a task from suggested work. Artifact status will update after the backend conversion function is deployed.",
-            };
-          }),
-      );
-      return;
-    }
     print(await listSuggestedWork(runtime));
     return;
   }
@@ -4250,13 +4226,7 @@ async function main() {
         },
       )) as AgentStatus;
       if (scopedStatus) {
-        const tasks = (await runtime.client.query(
-          api.functions.agentWorkspace.agentListTasks,
-          {
-            sessionToken: runtime.sessionToken,
-          },
-        )) as JsonRecord[];
-        print(summarizeAgentStatus(status, tasks, runtime.host));
+        print(summarizeAgentStatus(status, runtime.host));
         return;
       }
       print(status);
@@ -4279,26 +4249,6 @@ async function main() {
     return;
   }
 
-  if (command === "tasks") {
-    if (runtime.mode === "session") {
-      print(
-        await runtime.client.query(
-          api.functions.agentWorkspace.agentListTasks,
-          {
-            sessionToken: runtime.sessionToken,
-          },
-        ),
-      );
-      return;
-    }
-    if (runtime.mode === "apiKey") {
-      throw loginRequiredError("dench tasks (agent-scoped task list)");
-    }
-    const data = await devOverview(runtime);
-    print(data.tasks);
-    return;
-  }
-
   if (command === "agents") {
     if (runtime.mode === "session") {
       const status = await runtime.client.query(
@@ -4358,176 +4308,6 @@ async function main() {
     return;
   }
 
-  if (command === "task" && subcommand === "create") {
-    const title = positional(2);
-    if (!title) throw new Error("Missing task title");
-    const taskArgs = {
-      title,
-      description: option("--description"),
-      priority: (option("--priority") ?? "medium") as "low" | "medium" | "high",
-      risk: (option("--risk") ?? "medium") as "low" | "medium" | "high",
-    };
-    if (runtime.mode === "session") {
-      print(
-        await runtime.client.mutation(
-          api.functions.agentWorkspace.agentCreateTask,
-          {
-            sessionToken: runtime.sessionToken,
-            ...taskArgs,
-          },
-        ),
-      );
-      return;
-    }
-    rejectApiKeyForAgentCommand(runtime, "dench task create");
-    const taskId = await runtime.client.mutation(
-      api.functions.agentWorkspace.devCreateTask,
-      {
-        ...runtime.workspaceArgs,
-        ...taskArgs,
-      },
-    );
-    print({ ok: true, taskId });
-    return;
-  }
-
-  if (command === "task" && subcommand === "status") {
-    const sessionRuntime = requireSessionRuntime(runtime, "dench task status");
-    const taskId = positional(2);
-    const status = positional(3);
-    if (!taskId || !status) {
-      throw new Error("Usage: dench task status <taskId> <status>");
-    }
-    print(
-      await sessionRuntime.client.mutation(
-        api.functions.agentWorkspace.agentUpdateTaskStatus,
-        {
-          sessionToken: sessionRuntime.sessionToken,
-          taskId: taskId as never,
-          status: status as never,
-          note: option("--note"),
-        },
-      ),
-    );
-    return;
-  }
-
-  if (
-    command === "task" &&
-    (subcommand === "comment" ||
-      subcommand === "handoff" ||
-      subcommand === "block")
-  ) {
-    const sessionRuntime = requireSessionRuntime(
-      runtime,
-      `dench task ${subcommand}`,
-    );
-    const taskId = positional(2);
-    const body = positionalsFrom(3).join(" ").trim();
-    if (!taskId || !body) {
-      throw new Error(`Usage: dench task ${subcommand} <taskId> "message"`);
-    }
-    print(
-      await sessionRuntime.client.mutation(
-        api.functions.agentWorkspace.agentAddTaskComment,
-        {
-          sessionToken: sessionRuntime.sessionToken,
-          taskId: taskId as never,
-          kind:
-            subcommand === "handoff"
-              ? "handoff"
-              : subcommand === "block"
-                ? "blocker"
-                : "comment",
-          body,
-          targetAgentId: option("--agent") as never,
-        },
-      ),
-    );
-    return;
-  }
-
-  if (command === "task" && subcommand === "depends-on") {
-    const sessionRuntime = requireSessionRuntime(
-      runtime,
-      "dench task depends-on",
-    );
-    const taskId = positional(2);
-    const dependsOnTaskId = positional(3);
-    if (!taskId || !dependsOnTaskId) {
-      throw new Error(
-        "Usage: dench task depends-on <taskId> <dependsOnTaskId>",
-      );
-    }
-    print(
-      await sessionRuntime.client.mutation(
-        api.functions.agentWorkspace.agentAddTaskDependency,
-        {
-          sessionToken: sessionRuntime.sessionToken,
-          taskId: taskId as never,
-          dependsOnTaskId: dependsOnTaskId as never,
-          note: option("--note"),
-        },
-      ),
-    );
-    return;
-  }
-
-  if (command === "claim") {
-    const taskId = positional(1);
-    if (!taskId) throw new Error("Missing task id");
-    if (runtime.mode === "session") {
-      print(
-        await runtime.client.mutation(
-          api.functions.agentWorkspace.agentClaimTask,
-          {
-            sessionToken: runtime.sessionToken,
-            taskId: taskId as never,
-          },
-        ),
-      );
-      return;
-    }
-    rejectApiKeyForAgentCommand(runtime, "dench claim");
-    const agentId = option("--agent") ?? (await defaultDevAgentId(runtime));
-    print(
-      await runtime.client.mutation(api.functions.agentWorkspace.devClaimTask, {
-        ...runtime.workspaceArgs,
-        taskId: taskId as never,
-        agentId: agentId as never,
-      }),
-    );
-    return;
-  }
-
-  if (command === "log") {
-    const message = positional(1);
-    if (!message) throw new Error("Missing log message");
-    if (runtime.mode === "session") {
-      print(
-        await runtime.client.mutation(
-          api.functions.agentWorkspace.agentAppendLog,
-          {
-            sessionToken: runtime.sessionToken,
-            message,
-            taskId: option("--task") as never,
-          },
-        ),
-      );
-      return;
-    }
-    rejectApiKeyForAgentCommand(runtime, "dench log");
-    print(
-      await runtime.client.mutation(api.functions.agentWorkspace.devAppendLog, {
-        ...runtime.workspaceArgs,
-        message,
-        agentId: option("--agent") as never,
-        taskId: option("--task") as never,
-      }),
-    );
-    return;
-  }
-
   if (command === "approval" && subcommand === "request") {
     const title = positional(2);
     if (!title) throw new Error("Missing approval title");
@@ -4540,7 +4320,6 @@ async function main() {
             title,
             reason: option("--reason"),
             risk: (option("--risk") ?? "high") as "low" | "medium" | "high",
-            taskId: option("--task") as never,
           },
         ),
       );
@@ -4557,7 +4336,6 @@ async function main() {
           "Agent requests human approval before a risky action.",
         risk: (option("--risk") ?? "high") as "low" | "medium" | "high",
         agentId: option("--agent") as never,
-        taskId: option("--task") as never,
       },
     );
     print({ ok: true, approvalId });