@dench.com/cli 2.0.1 → 2.0.3

package/README.md

@@ -4,17 +4,21 @@ Agent-facing CLI for the Dench agent workspace.
 
 ## Usage
 
-Run without installing:
+Run without installing. The npm package is `@dench.com/cli`, but the binary
+it installs is named `dench`, so always invoke it as
+`npx -y -p @dench.com/cli dench <command>`. A bare
+`npx -y @dench.com/cli <command>` will fail because `npx` looks for a bin
+matching the package's last path segment (`cli`) and there isn't one.
 
 ```bash
-npx -y @dench.com/cli login --name "AI Agent - Billing Repo"
+npx -y -p @dench.com/cli dench signin --name "AI Agent - Billing Repo"
 ```
 
 Or install globally:
 
 ```bash
 npm install -g @dench.com/cli
-dench login --name "AI Agent - Billing Repo"
+dench signin --name "AI Agent - Billing Repo"
 ```
 
 `--kind` accepts any string. Suggested values: `claude_code`, `codex`, `cursor`,
@@ -47,11 +51,13 @@ DENCH_HOST=https://example.com dench <cmd>
 
 The smooth setup flow is:
 
-1. Run `dench login --name "AI Agent - Billing Repo"` once.
+1. Run `dench signin --name "AI Agent - Billing Repo"` once.
 2. Let the CLI open the approval link. If it cannot, ask the human to open the
    printed link and confirm the email/workspace. Use `--no-open` to print the
    link without opening it.
-3. Run `dench status --mine --json` and `dench tasks --json` to verify setup.
+3. Run `dench status --mine --json` and `dench crm entries list task --json`
+   to verify setup. Tasks live as CRM `task` entries — there is no separate
+   `dench tasks` command.
 
 The CLI selects the approved session for later commands automatically.
 Setup is complete after approval, both verification commands work, and you know
@@ -71,11 +77,11 @@ dench sessions
 dench use <session-key-or-workspace-slug>
 ```
 
-Use a human-readable `DENCH_SESSION_KEY` at login time only for long-lived
+Use a human-readable `DENCH_SESSION_KEY` at sign-in time only for long-lived
 agents or when the human asks for a stable identity:
 
 ```bash
-DENCH_SESSION_KEY=billing-repo-agent dench login --name "AI Agent - Billing Repo"
+DENCH_SESSION_KEY=billing-repo-agent dench signin --name "AI Agent - Billing Repo"
 DENCH_SESSION_KEY=billing-repo-agent dench status --mine --json
 ```
 
@@ -88,18 +94,18 @@ context. Other saved sessions can still be reused by future chats. To remove the
 wrong local session, run `dench logout --session <session-key>`. Use
 `dench logout --all` only when you want to clear every local Dench session.
 
-Do not create or edit local agent memory files during setup. Use Dench logs for
-meaningful progress, and use Dench memory only when the human asks or when
-saving a stable workspace fact.
+Do not create or edit local agent memory files during setup. Use Dench
+memory only when the human asks or when saving a stable workspace fact.
 
-Do not create, claim, or log a setup task by default. Only create or claim a
-task if the human assigns work, an open matching task exists, or coordination
-benefits from creating one. For ad-hoc requests, work directly and only log
-meaningful work.
+Tasks live as CRM `task` entries — there is no separate `dench tasks`,
+`dench task`, `dench claim`, or `dench log` command. Create one via
+`dench crm entries create task --cells '{"Name":"…","Status":"Open"}'`
+only when the human assigns durable work or coordination benefits from
+a tracked entry. For ad-hoc requests, work directly.
 
-Use `dench context` when you need to know who you are, which workspace you are
-using, assigned tasks, pending approvals you requested, connected apps, and the
-best next commands. Add `--json` for structured output.
+Use `dench context` when you need to know who you are, which workspace you
+are using, pending approvals you requested, connected apps, and the best
+next commands. Add `--json` for structured output.
 
 ## Past chat threads
 
@@ -123,7 +129,7 @@ text — pick concrete tokens that the prior chat would have used (file
 paths, product names, error strings) rather than paraphrases.
 
 Inside a sandbox, `dench chat` uses `DENCH_API_KEY` + `DENCH_RUN_ID`
-automatically; locally, run `dench login` first.
+automatically; locally, run `dench signin` first.
 
 ## Billing
 
@@ -190,16 +196,16 @@ Run `dench tool --help` or `dench apps --help` for command help.
 For staging:
 
 ```bash
-dench login --staging
-dench login --host https://workspace-staging.dench.com
+dench signin --staging
+dench signin --host https://workspace-staging.dench.com
 ```
 
-## Sandbox / API key auth (no `dench login` required)
+## Sandbox / API key auth (no `dench signin` required)
 
 Inside a Daytona sandbox the unified Dench API key is baked into envVars
 at create time (see `src/lib/secrets/sandbox-tokens.ts`). When
 `DENCH_API_KEY` and `CONVEX_URL` are both present, the CLI skips the
-`dench login` flow entirely and uses the API key as a bearer for every
+`dench signin` flow entirely and uses the API key as a bearer for every
 org-scoped command — `dench crm`, `dench files`, `dench fs sync`, etc.
 
 ```bash
@@ -217,7 +223,7 @@ Auth precedence:
 
 1. Explicit `--dev` flag → use the dev workspace env (`NEXT_PUBLIC_CONVEX_URL`,
    `DENCH_WORKSPACE`, `DENCH_DEV_AGENT_KEY`).
-2. A locally-stored `dench login` session for the current backend (set via
+2. A locally-stored `dench signin` session for the current backend (set via
    `dench backend`, `--host`, `--prod`, or `--staging`).
 3. `DENCH_API_KEY` + `CONVEX_URL` (sandbox / automation path).
 
@@ -243,7 +249,7 @@ Auto-load now turns on only when one of:
 Explicit shell exports (`GATEWAY_URL=… ./dench …`) always win regardless.
 
 Commands that need to impersonate a specific agent (`dench memory`,
-`dench task`, `dench claim`, `dench log`, `dench approval request`,
-etc.) still require an agent session (`dench login`) — the unified API
-key is org-scoped and cannot speak as a single agent. Those commands
-return a clear "agent session required" error in API-key mode.
+`dench approval request`, etc.) still require an agent session
+(`dench signin`) — the unified API key is org-scoped and cannot speak
+as a single agent. Those commands return a clear "agent session
+required" error in API-key mode.

package/dench.ts

@@ -16,11 +16,11 @@ import { ConvexHttpClient } from "convex/browser";
 import { makeFunctionReference } from "convex/server";
 import { agentKindLabel, normalizeAgentKind } from "./agentKind";
 import {
+  apiHostForDenchHost,
   DEFAULT_HOST,
   isLocalHost,
   LOCAL_HOST,
   normalizeHost,
-  PRODUCTION_API_URL,
   PRODUCTION_CONVEX_URL,
   PRODUCTION_HOST,
   resolveBackendAlias,
@@ -97,7 +97,6 @@ type ConfigFile = {
 type WorkspaceOverview = {
   agents: Array<{ _id: string } & JsonRecord>;
   projects: JsonRecord[];
-  tasks: JsonRecord[];
   approvals: Array<{ status?: string } & JsonRecord>;
   rules: JsonRecord[];
   recentArtifacts?: JsonRecord[];
@@ -119,33 +118,12 @@ type AgentStatus = {
 const api = {
   functions: {
     agentWorkspace: {
-      agentAppendLog: makeFunctionReference<"mutation">(
-        "functions/agentWorkspace:agentAppendLog",
-      ),
-      agentClaimTask: makeFunctionReference<"mutation">(
-        "functions/agentWorkspace:agentClaimTask",
-      ),
-      agentCreateTask: makeFunctionReference<"mutation">(
-        "functions/agentWorkspace:agentCreateTask",
-      ),
-      agentAddTaskComment: makeFunctionReference<"mutation">(
-        "functions/agentWorkspace:agentAddTaskComment",
-      ),
-      agentAddTaskDependency: makeFunctionReference<"mutation">(
-        "functions/agentWorkspace:agentAddTaskDependency",
-      ),
-      agentConvertSuggestionToTask: makeFunctionReference<"mutation">(
-        "functions/agentWorkspace:agentConvertSuggestionToTask",
-      ),
       agentDecideApproval: makeFunctionReference<"mutation">(
         "functions/agentWorkspace:agentDecideApproval",
       ),
       agentListArtifacts: makeFunctionReference<"query">(
         "functions/agentWorkspace:agentListArtifacts",
       ),
-      agentListTasks: makeFunctionReference<"query">(
-        "functions/agentWorkspace:agentListTasks",
-      ),
       agentRequestApproval: makeFunctionReference<"mutation">(
         "functions/agentWorkspace:agentRequestApproval",
       ),
@@ -161,24 +139,12 @@ const api = {
       getAgentBillingStatus: makeFunctionReference<"query">(
         "functions/agentWorkspace:getAgentBillingStatus",
       ),
-      agentUpdateTaskStatus: makeFunctionReference<"mutation">(
-        "functions/agentWorkspace:agentUpdateTaskStatus",
-      ),
       createSignInRequest: makeFunctionReference<"mutation">(
         "functions/agentWorkspace:createSignInRequest",
       ),
-      devAppendLog: makeFunctionReference<"mutation">(
-        "functions/agentWorkspace:devAppendLog",
-      ),
-      devClaimTask: makeFunctionReference<"mutation">(
-        "functions/agentWorkspace:devClaimTask",
-      ),
       devCreateProject: makeFunctionReference<"mutation">(
         "functions/agentWorkspace:devCreateProject",
       ),
-      devCreateTask: makeFunctionReference<"mutation">(
-        "functions/agentWorkspace:devCreateTask",
-      ),
       devListWorkspaceOverview: makeFunctionReference<"query">(
         "functions/agentWorkspace:devListWorkspaceOverview",
       ),
@@ -431,20 +397,11 @@ Usage:
   dench backend [show|set|clear] [<production|staging|local|<url>>] [--json]
   dench context [--json]
   dench status [--mine|--self] [--json]
-  dench tasks [--json]
-  dench task create "title" [--description "..."] [--priority low|medium|high] [--risk low|medium|high] [--json]
-  dench task status <taskId> <open|claimed|in_progress|waiting_approval|completed|canceled> [--note "..."] [--json]
-  dench task comment <taskId> "message" [--json]
-  dench task handoff <taskId> "message" --agent <agentId> [--json]
-  dench task block <taskId> "message" [--json]
-  dench claim <taskId> [--json]
-  dench log "message" [--task <taskId>] [--json]
   dench memory search "query" [--limit 8] [--json]
   dench memory save <key> "text" [--kind fact|decision|preference|goal|tool_note|other] [--tags a,b] [--sensitivity normal|broad|sensitive] [--json]
   dench artifacts [--limit 25] [--json]
   dench suggested-work [--json]
-  dench suggested-work task <artifactId> [--json]
-  dench approval request "message" [--task <taskId>] [--json]
+  dench approval request "message" [--json]
   dench approval approve <approvalId> [--evidence "User said yes in chat"] [--json]
   dench approval reject <approvalId> [--evidence "User said no in chat"] [--json]
   dench billing status [--json]
@@ -483,7 +440,7 @@ Workspace members (for CRM \`user\`-type fields):
       cells assign to real members instead of being stored as unlinked
       display-name strings. See \`dench members help\`.
 
-Live web search (Exa via the Dench Cloud Gateway, auths with DENCH_API_KEY):
+Live web search (Exa via the Dench Cloud Gateway, auths with the active \`dench signin\` agent session or DENCH_API_KEY):
   dench search "<query>" [--num-results N] [--type auto|fast|deep|deep-reasoning|neural] [--category news|company|people|...] [--include-domains a.com,b.com] [--exclude-domains c.com] [--max-chars 800] [--json]
   dench search contents <url> [<url>...] [--max-chars 4000] [--summary "..."] [--json]
   dench search answer "<query>" [--json]
@@ -579,8 +536,9 @@ Agent setup:
   Defaults to "other" when omitted. Values are normalized to lowercase
   snake_case before send (e.g. "Claude Code" -> claude_code).
   After sign-in, run dench context --json and dench crm objects list --json
-  to verify the workspace + CRM are wired up.
-  Do not create, claim, or log a setup task by default.
+  to verify the workspace + CRM are wired up. Tasks live as CRM \`task\`
+  entries — there is no separate \`dench tasks\` / \`dench task\` /
+  \`dench claim\` / \`dench log\` command.
 
 Backends and hosts:
   Default backend: ${DEFAULT_HOST} (overridden by \`dench backend set\`)
@@ -622,10 +580,11 @@ Usage:
   dench tool disconnect <connectionId> [--json]
 
 Auth:
-  All commands authenticate with DENCH_API_KEY (Bearer) directly to the
-  Dench Cloud Gateway. No \`dench signin\` agent session is required —
-  inside a Dench sandbox the key is baked into the env automatically;
-  outside, export DENCH_API_KEY=<key> first.
+  All commands authenticate with the active \`dench signin\` agent
+  session OR with DENCH_API_KEY (Bearer), whichever is set. Inside a
+  Dench sandbox DENCH_API_KEY is baked into the env automatically; on
+  a developer machine \`dench signin\` to a paid workspace works the
+  same way (the CLI exchanges the session for a gateway key on demand).
 
 Notes:
   dench apps is an alias for dench tool status.
@@ -664,10 +623,8 @@ function artifactsHelp() {
 Usage:
   dench artifacts [--limit 25] [--json]
   dench suggested-work [--json]
-  dench suggested-work task <artifactId> [--json]
 
-Artifacts are durable outputs for human or agent review. Suggested work can
-be converted into a workspace task.
+Artifacts are durable outputs for human or agent review.
 `);
 }
 
@@ -727,20 +684,6 @@ Notes:
 `);
 }
 
-function tasksHelp() {
-  console.log(`Dench tasks
-
-Usage:
-  dench tasks [--json]
-
-Notes:
-  List workspace tasks before creating new ones.
-  Do not create, claim, or log a setup task by default.
-  Only create or claim a task if the human assigns work, an open matching task
-  exists, or coordination benefits from creating one.
-`);
-}
-
 function logoutHelp() {
   console.log(`Dench logout
 
@@ -761,9 +704,9 @@ Usage:
   dench apps [--json]
 
 Lists all external apps connected to this organization (Slack, Gmail,
-GitHub, etc.). Authenticates with DENCH_API_KEY (Bearer) directly to the
-Dench Cloud Gateway — no \`dench signin\` agent session required. Alias
-for \`dench tool status\`.
+GitHub, etc.). Authenticates with the active \`dench signin\` agent
+session or DENCH_API_KEY (Bearer), whichever is set. Alias for
+\`dench tool status\`.
 `);
 }
 
@@ -2050,16 +1993,6 @@ async function resolveOrgChoiceForOtp(input: {
   return { newOrganizationName: newName.trim() };
 }
 
-function normalizeApiBase(input: string) {
-  const trimmed = input.trim();
-  const withProtocol = /^https?:\/\//.test(trimmed)
-    ? trimmed
-    : /^(localhost|127\.0\.0\.1|\[::1\])(?::|$)/.test(trimmed)
-      ? `http://${trimmed}`
-      : `https://${trimmed}`;
-  return new URL(withProtocol).origin;
-}
-
 async function parseResponseBody(response: Response) {
   const text = await response.text();
   if (!text) return {};
@@ -2313,16 +2246,14 @@ function resolveApiKeyConvexUrl(): string | undefined {
 /**
  * Resolve the Next.js API host the CLI should hit for HTTP calls (e.g.
  * Stripe billing topup, the gateway proxy). Same defense-in-depth
- * pattern as `resolveApiKeyConvexUrl`: env wins, then the resolved
- * Dench host the runtime is targeting, and finally
- * `PRODUCTION_API_URL` as the last resort.
+ * pattern as `resolveApiKeyConvexUrl`: env wins, then the canonical API
+ * origin for the Dench host the runtime is targeting.
  */
 function resolveApiHost(fallbackHost: string): string {
   return (
     process.env.DENCH_API_URL?.trim() ||
     process.env.DENCH_INTERNAL_BASE?.trim() ||
-    fallbackHost ||
-    PRODUCTION_API_URL
+    apiHostForDenchHost(fallbackHost)
   );
 }
 
@@ -2362,7 +2293,7 @@ async function getRuntime() {
     if (stored.status === "found") {
       return {
         mode: "session" as const,
-        host,
+        host: resolveApiHost(host),
         client: new ConvexHttpClient(stored.session.convexUrl),
         sessionToken: stored.session.sessionToken,
         organization: stored.session.organization,
@@ -2543,7 +2474,17 @@ function gatewayAuthError(
     });
   }
   if (response.status === 401) {
-    return loginRequiredError(command);
+    return new CliError(
+      `${command} could not exchange the active Dench session for a gateway key (${code})`,
+      {
+        code,
+        status: response.status,
+        nextActions: [
+          "Run dench sessions --json to confirm the selected session.",
+          'Run dench signin --kind <kind> --name "AI Agent - Project" to refresh the agent session if it expired.',
+        ],
+      },
+    );
   }
   return new CliError(`${command} could not get a gateway key (${code})`, {
     code,
@@ -2616,10 +2557,9 @@ function agentSessionRequiredError(command: string) {
 }
 
 /**
- * Some legacy `agentWorkspace.*` commands (task create / claim / log /
- * approval request) have separate session vs dev branches. With apiKey
- * mode added, the dev branch would silently receive partial args. Use
- * this to short-circuit those branches with a clear error.
+ * `dench approval request` has separate session vs dev branches. With
+ * apiKey mode added, the dev branch would silently receive partial args.
+ * Use this to short-circuit that branch with a clear error.
  *
  * Asserts away the `apiKey` mode so the caller's downstream type
  * narrowing (e.g. `runtime.workspaceArgs`) keeps working.
@@ -2710,8 +2650,7 @@ function workspaceUrls(host: string, workspaceSlug: string | undefined) {
 function nextContextCommands() {
   return [
     "dench context --json",
-    "dench tasks --json",
-    'dench log "Brief progress update"',
+    "dench crm entries list task --json",
     'dench tool search "what you need" --toolkit <app>',
     'dench approval request "Risky action to approve"',
   ];
@@ -2797,15 +2736,6 @@ function formatContext(context: JsonRecord) {
   const workspace = asRecord(context.workspace);
   const connectedApps = asRecord(context.connectedApps);
   const connections = asRecordArray(connectedApps?.connections);
-  const tasksRecord = asRecord(context.tasks);
-  const tasks =
-    asRecordArray(tasksRecord?.assignedToMe).length > 0 ||
-    asRecordArray(tasksRecord?.open).length > 0
-      ? [
-          ...asRecordArray(tasksRecord?.assignedToMe),
-          ...asRecordArray(tasksRecord?.open),
-        ]
-      : asRecordArray(context.tasks);
   const approvals = asRecordArray(context.pendingApprovals);
   const suggestedWork = asRecordArray(context.suggestedWork);
   const memories = asRecordArray(context.memory);
@@ -2828,10 +2758,7 @@ function formatContext(context: JsonRecord) {
     `Agent: ${agentDisplayName(agent)}${
       stringField(agent, "kind") ? ` [${stringField(agent, "kind")}]` : ""
     }`,
-    `Counts: ${formatCount(counts?.tasks ?? tasks.length)} visible tasks, ${formatCount(
-      counts?.myAssignedTasks ??
-        asRecordArray(tasksRecord?.assignedToMe).length,
-    )} assigned to me, ${formatCount(
+    `Counts: ${formatCount(
       counts?.myPendingApprovals ?? approvals.length,
     )} pending approvals`,
   ];
@@ -2845,21 +2772,6 @@ function formatContext(context: JsonRecord) {
     );
   }
 
-  lines.push("", "Assigned tasks:");
-
-  if (tasks.length === 0) {
-    lines.push("  none");
-  } else {
-    lines.push(
-      ...tasks
-        .slice(0, 5)
-        .map(
-          (task) =>
-            `  - ${stringField(task, "title") ?? stringField(task, "id") ?? "untitled"} [${stringField(task, "status") ?? "unknown"}]`,
-        ),
-    );
-  }
-
   lines.push("", "Pending approvals requested by me:");
   if (approvals.length === 0) {
     lines.push("  none");
@@ -2958,7 +2870,6 @@ function summarizeDevOverview(workspaceSlug: string, data: WorkspaceOverview) {
     workspace: workspaceSlug,
     agents: data.agents.length,
     projects: data.projects.length,
-    tasks: data.tasks.length,
     approvals: data.approvals.filter(
       (approval) => approval.status === "pending",
     ).length,
@@ -2966,37 +2877,18 @@ function summarizeDevOverview(workspaceSlug: string, data: WorkspaceOverview) {
   };
 }
 
-function compactTask(task: JsonRecord) {
-  return {
-    id: task._id ?? task.id,
-    title: task.title,
-    status: task.status,
-    priority: task.priority,
-    risk: task.risk,
-    assignedAgentId: task.assignedAgentId,
-  };
-}
-
 function compactApproval(approval: JsonRecord) {
   return {
     id: approval.id ?? approval._id,
     title: approval.title,
     risk: approval.risk,
     status: approval.status,
-    taskId: approval.taskId,
     createdAt: approval.createdAt,
   };
 }
 
-function summarizeAgentStatus(
-  status: AgentStatus,
-  tasks: JsonRecord[],
-  host?: string,
-) {
+function summarizeAgentStatus(status: AgentStatus, host?: string) {
   const agentId = status.agent?.id;
-  const assignedTasks = agentId
-    ? tasks.filter((task) => task.assignedAgentId === agentId)
-    : [];
   const pendingApprovals = (status.approvals ?? []).filter(
     (approval) => approval.status === "pending" && approval.agentId === agentId,
   );
@@ -3009,11 +2901,9 @@ function summarizeAgentStatus(
     agent: status.agent,
     counts: {
       ...(status.counts ?? {}),
-      myAssignedTasks: assignedTasks.length,
       myPendingApprovals: pendingApprovals.length,
     },
     rules: status.rules ?? [],
-    tasks: assignedTasks.map(compactTask),
     pendingApprovals: pendingApprovals.map(compactApproval),
   };
 }
@@ -3021,7 +2911,6 @@ function summarizeAgentStatus(
 function summarizeDevMine(workspaceSlug: string, data: WorkspaceOverview) {
   const agentId = option("--agent") ?? data.agents[0]?._id;
   const agent = data.agents.find((item) => item._id === agentId) ?? null;
-  const tasks = data.tasks.filter((task) => task.assignedAgentId === agentId);
   const pendingApprovals = data.approvals.filter(
     (approval) => approval.status === "pending" && approval.agentId === agentId,
   );
@@ -3032,33 +2921,17 @@ function summarizeDevMine(workspaceSlug: string, data: WorkspaceOverview) {
     counts: {
       agents: data.agents.length,
       projects: data.projects.length,
-      tasks: data.tasks.length,
       pendingApprovals: data.approvals.filter(
         (approval) => approval.status === "pending",
       ).length,
       rules: data.rules.length,
-      myAssignedTasks: tasks.length,
       myPendingApprovals: pendingApprovals.length,
     },
     rules: data.rules,
-    tasks: tasks.map(compactTask),
     pendingApprovals: pendingApprovals.map(compactApproval),
   };
 }
 
-async function defaultDevAgentId(
-  runtime: Awaited<ReturnType<typeof getRuntime>>,
-) {
-  const data = await devOverview(runtime);
-  const agent = data.agents[0];
-  if (!agent) {
-    throw new Error(
-      'No agent registered yet. Run: dench signin --kind <kind> --name "AI Agent - Project"',
-    );
-  }
-  return agent._id;
-}
-
 async function listArtifacts(runtime: Runtime, limit?: number) {
   if (runtime.mode === "session") {
     try {
@@ -3840,11 +3713,6 @@ async function main() {
     return;
   }
 
-  if (command === "tasks" && hasFlag("--help")) {
-    tasksHelp();
-    return;
-  }
-
   if (command === "logout" && hasFlag("--help")) {
     logoutHelp();
     return;
@@ -4343,50 +4211,6 @@ async function main() {
   }
 
   if (command === "suggested-work") {
-    if (subcommand === "task") {
-      const sessionRuntime = requireSessionRuntime(
-        runtime,
-        "dench suggested-work task",
-      );
-      const artifactId = positional(2);
-      if (!artifactId) {
-        throw new Error("Usage: dench suggested-work task <artifactId>");
-      }
-      print(
-        await sessionRuntime.client
-          .mutation(api.functions.agentWorkspace.agentConvertSuggestionToTask, {
-            sessionToken: sessionRuntime.sessionToken,
-            artifactId: artifactId as never,
-          })
-          .catch(async (error) => {
-            if (!isMissingConvexFunction(error)) throw error;
-            const suggestion = (await listSuggestedWork(runtime)).find(
-              (item) => stringField(item, "id") === artifactId,
-            );
-            if (!suggestion) throw error;
-            const title = stringField(suggestion, "title") ?? "Suggested work";
-            const created = (await sessionRuntime.client.mutation(
-              api.functions.agentWorkspace.agentCreateTask,
-              {
-                sessionToken: sessionRuntime.sessionToken,
-                title,
-                description: stringField(suggestion, "content"),
-                priority: "medium",
-                risk: "medium",
-              },
-            )) as JsonRecord;
-            return {
-              ok: true,
-              fallback: true,
-              artifactId,
-              title,
-              taskId: created.taskId,
-              note: "Created a task from suggested work. Artifact status will update after the backend conversion function is deployed.",
-            };
-          }),
-      );
-      return;
-    }
     print(await listSuggestedWork(runtime));
     return;
   }
@@ -4400,13 +4224,7 @@ async function main() {
         },
       )) as AgentStatus;
       if (scopedStatus) {
-        const tasks = (await runtime.client.query(
-          api.functions.agentWorkspace.agentListTasks,
-          {
-            sessionToken: runtime.sessionToken,
-          },
-        )) as JsonRecord[];
-        print(summarizeAgentStatus(status, tasks, runtime.host));
+        print(summarizeAgentStatus(status, runtime.host));
         return;
       }
       print(status);
@@ -4429,26 +4247,6 @@ async function main() {
     return;
   }
 
-  if (command === "tasks") {
-    if (runtime.mode === "session") {
-      print(
-        await runtime.client.query(
-          api.functions.agentWorkspace.agentListTasks,
-          {
-            sessionToken: runtime.sessionToken,
-          },
-        ),
-      );
-      return;
-    }
-    if (runtime.mode === "apiKey") {
-      throw loginRequiredError("dench tasks (agent-scoped task list)");
-    }
-    const data = await devOverview(runtime);
-    print(data.tasks);
-    return;
-  }
-
   if (command === "agents") {
     if (runtime.mode === "session") {
       const status = await runtime.client.query(
@@ -4508,176 +4306,6 @@ async function main() {
     return;
   }
 
-  if (command === "task" && subcommand === "create") {
-    const title = positional(2);
-    if (!title) throw new Error("Missing task title");
-    const taskArgs = {
-      title,
-      description: option("--description"),
-      priority: (option("--priority") ?? "medium") as "low" | "medium" | "high",
-      risk: (option("--risk") ?? "medium") as "low" | "medium" | "high",
-    };
-    if (runtime.mode === "session") {
-      print(
-        await runtime.client.mutation(
-          api.functions.agentWorkspace.agentCreateTask,
-          {
-            sessionToken: runtime.sessionToken,
-            ...taskArgs,
-          },
-        ),
-      );
-      return;
-    }
-    rejectApiKeyForAgentCommand(runtime, "dench task create");
-    const taskId = await runtime.client.mutation(
-      api.functions.agentWorkspace.devCreateTask,
-      {
-        ...runtime.workspaceArgs,
-        ...taskArgs,
-      },
-    );
-    print({ ok: true, taskId });
-    return;
-  }
-
-  if (command === "task" && subcommand === "status") {
-    const sessionRuntime = requireSessionRuntime(runtime, "dench task status");
-    const taskId = positional(2);
-    const status = positional(3);
-    if (!taskId || !status) {
-      throw new Error("Usage: dench task status <taskId> <status>");
-    }
-    print(
-      await sessionRuntime.client.mutation(
-        api.functions.agentWorkspace.agentUpdateTaskStatus,
-        {
-          sessionToken: sessionRuntime.sessionToken,
-          taskId: taskId as never,
-          status: status as never,
-          note: option("--note"),
-        },
-      ),
-    );
-    return;
-  }
-
-  if (
-    command === "task" &&
-    (subcommand === "comment" ||
-      subcommand === "handoff" ||
-      subcommand === "block")
-  ) {
-    const sessionRuntime = requireSessionRuntime(
-      runtime,
-      `dench task ${subcommand}`,
-    );
-    const taskId = positional(2);
-    const body = positionalsFrom(3).join(" ").trim();
-    if (!taskId || !body) {
-      throw new Error(`Usage: dench task ${subcommand} <taskId> "message"`);
-    }
-    print(
-      await sessionRuntime.client.mutation(
-        api.functions.agentWorkspace.agentAddTaskComment,
-        {
-          sessionToken: sessionRuntime.sessionToken,
-          taskId: taskId as never,
-          kind:
-            subcommand === "handoff"
-              ? "handoff"
-              : subcommand === "block"
-                ? "blocker"
-                : "comment",
-          body,
-          targetAgentId: option("--agent") as never,
-        },
-      ),
-    );
-    return;
-  }
-
-  if (command === "task" && subcommand === "depends-on") {
-    const sessionRuntime = requireSessionRuntime(
-      runtime,
-      "dench task depends-on",
-    );
-    const taskId = positional(2);
-    const dependsOnTaskId = positional(3);
-    if (!taskId || !dependsOnTaskId) {
-      throw new Error(
-        "Usage: dench task depends-on <taskId> <dependsOnTaskId>",
-      );
-    }
-    print(
-      await sessionRuntime.client.mutation(
-        api.functions.agentWorkspace.agentAddTaskDependency,
-        {
-          sessionToken: sessionRuntime.sessionToken,
-          taskId: taskId as never,
-          dependsOnTaskId: dependsOnTaskId as never,
-          note: option("--note"),
-        },
-      ),
-    );
-    return;
-  }
-
-  if (command === "claim") {
-    const taskId = positional(1);
-    if (!taskId) throw new Error("Missing task id");
-    if (runtime.mode === "session") {
-      print(
-        await runtime.client.mutation(
-          api.functions.agentWorkspace.agentClaimTask,
-          {
-            sessionToken: runtime.sessionToken,
-            taskId: taskId as never,
-          },
-        ),
-      );
-      return;
-    }
-    rejectApiKeyForAgentCommand(runtime, "dench claim");
-    const agentId = option("--agent") ?? (await defaultDevAgentId(runtime));
-    print(
-      await runtime.client.mutation(api.functions.agentWorkspace.devClaimTask, {
-        ...runtime.workspaceArgs,
-        taskId: taskId as never,
-        agentId: agentId as never,
-      }),
-    );
-    return;
-  }
-
-  if (command === "log") {
-    const message = positional(1);
-    if (!message) throw new Error("Missing log message");
-    if (runtime.mode === "session") {
-      print(
-        await runtime.client.mutation(
-          api.functions.agentWorkspace.agentAppendLog,
-          {
-            sessionToken: runtime.sessionToken,
-            message,
-            taskId: option("--task") as never,
-          },
-        ),
-      );
-      return;
-    }
-    rejectApiKeyForAgentCommand(runtime, "dench log");
-    print(
-      await runtime.client.mutation(api.functions.agentWorkspace.devAppendLog, {
-        ...runtime.workspaceArgs,
-        message,
-        agentId: option("--agent") as never,
-        taskId: option("--task") as never,
-      }),
-    );
-    return;
-  }
-
   if (command === "approval" && subcommand === "request") {
     const title = positional(2);
     if (!title) throw new Error("Missing approval title");
@@ -4690,7 +4318,6 @@ async function main() {
             title,
             reason: option("--reason"),
             risk: (option("--risk") ?? "high") as "low" | "medium" | "high",
-            taskId: option("--task") as never,
           },
         ),
       );
@@ -4707,7 +4334,6 @@ async function main() {
           "Agent requests human approval before a risky action.",
         risk: (option("--risk") ?? "high") as "low" | "medium" | "high",
         agentId: option("--agent") as never,
-        taskId: option("--task") as never,
       },
     );
     print({ ok: true, approvalId });

package/host.ts

@@ -14,7 +14,8 @@ export const DEFAULT_HOST = PRODUCTION_HOST;
  * deployment + Next.js host backs `https://www.dench.com`.
  */
 export const PRODUCTION_API_URL = "https://www.dench.com";
-export const PRODUCTION_CONVEX_URL = "https://beaming-alligator-67.convex.cloud";
+export const PRODUCTION_CONVEX_URL =
+  "https://beaming-alligator-67.convex.cloud";
 export const PRODUCTION_GATEWAY_URL = "https://gateway.merseoriginals.com";
 
 export type BackendAlias = "production" | "prod" | "staging" | "local";
@@ -52,6 +53,16 @@ export function isLocalHost(input: string) {
   );
 }
 
+export function apiHostForDenchHost(input: string | undefined) {
+  if (!input?.trim()) return PRODUCTION_API_URL;
+  const normalized = normalizeHost(input);
+  // `dench.com` redirects to `www.dench.com` in production. Fetch drops the
+  // Authorization header across that redirect, so CLI API calls must start on
+  // the canonical API origin.
+  if (normalized === PRODUCTION_HOST) return PRODUCTION_API_URL;
+  return normalized;
+}
+
 /**
  * Resolve `local|staging|prod|production|<url>` -> a normalized host
  * origin. Aliases let `dench backend set <alias>` (and `--backend
@@ -73,7 +84,11 @@ export function resolveBackendAlias(input: string): string {
   if (normalized === "staging" || normalized === "stage") {
     return STAGING_HOST;
   }
-  if (normalized === "local" || normalized === "localhost" || normalized === "dev") {
+  if (
+    normalized === "local" ||
+    normalized === "localhost" ||
+    normalized === "dev"
+  ) {
     return LOCAL_HOST;
   }
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dench.com/cli",
-  "version": "2.0.1",
+  "version": "2.0.3",
   "description": "Dench agent workspace CLI. v2 unifies auth behind `dench signin`; the legacy `dench login` / `dench onboard` / `dench setup` / `dench what-can-i-do` / `dench register` commands now error with a redirect.",
   "type": "module",
   "bin": {