@dench.com/cli 2.0.2 → 2.0.3

package/dench.ts

@@ -16,11 +16,11 @@ import { ConvexHttpClient } from "convex/browser";
 import { makeFunctionReference } from "convex/server";
 import { agentKindLabel, normalizeAgentKind } from "./agentKind";
 import {
+  apiHostForDenchHost,
   DEFAULT_HOST,
   isLocalHost,
   LOCAL_HOST,
   normalizeHost,
-  PRODUCTION_API_URL,
   PRODUCTION_CONVEX_URL,
   PRODUCTION_HOST,
   resolveBackendAlias,
@@ -1993,16 +1993,6 @@ async function resolveOrgChoiceForOtp(input: {
   return { newOrganizationName: newName.trim() };
 }
 
-function normalizeApiBase(input: string) {
-  const trimmed = input.trim();
-  const withProtocol = /^https?:\/\//.test(trimmed)
-    ? trimmed
-    : /^(localhost|127\.0\.0\.1|\[::1\])(?::|$)/.test(trimmed)
-      ? `http://${trimmed}`
-      : `https://${trimmed}`;
-  return new URL(withProtocol).origin;
-}
-
 async function parseResponseBody(response: Response) {
   const text = await response.text();
   if (!text) return {};
@@ -2256,16 +2246,14 @@ function resolveApiKeyConvexUrl(): string | undefined {
 /**
  * Resolve the Next.js API host the CLI should hit for HTTP calls (e.g.
  * Stripe billing topup, the gateway proxy). Same defense-in-depth
- * pattern as `resolveApiKeyConvexUrl`: env wins, then the resolved
- * Dench host the runtime is targeting, and finally
- * `PRODUCTION_API_URL` as the last resort.
+ * pattern as `resolveApiKeyConvexUrl`: env wins, then the canonical API
+ * origin for the Dench host the runtime is targeting.
  */
 function resolveApiHost(fallbackHost: string): string {
   return (
     process.env.DENCH_API_URL?.trim() ||
     process.env.DENCH_INTERNAL_BASE?.trim() ||
-    fallbackHost ||
-    PRODUCTION_API_URL
+    apiHostForDenchHost(fallbackHost)
   );
 }
 
@@ -2305,7 +2293,7 @@ async function getRuntime() {
     if (stored.status === "found") {
       return {
         mode: "session" as const,
-        host,
+        host: resolveApiHost(host),
         client: new ConvexHttpClient(stored.session.convexUrl),
         sessionToken: stored.session.sessionToken,
         organization: stored.session.organization,
@@ -2486,7 +2474,17 @@ function gatewayAuthError(
     });
   }
   if (response.status === 401) {
-    return loginRequiredError(command);
+    return new CliError(
+      `${command} could not exchange the active Dench session for a gateway key (${code})`,
+      {
+        code,
+        status: response.status,
+        nextActions: [
+          "Run dench sessions --json to confirm the selected session.",
+          'Run dench signin --kind <kind> --name "AI Agent - Project" to refresh the agent session if it expired.',
+        ],
+      },
+    );
   }
   return new CliError(`${command} could not get a gateway key (${code})`, {
     code,

package/host.ts

@@ -14,7 +14,8 @@ export const DEFAULT_HOST = PRODUCTION_HOST;
  * deployment + Next.js host backs `https://www.dench.com`.
  */
 export const PRODUCTION_API_URL = "https://www.dench.com";
-export const PRODUCTION_CONVEX_URL = "https://beaming-alligator-67.convex.cloud";
+export const PRODUCTION_CONVEX_URL =
+  "https://beaming-alligator-67.convex.cloud";
 export const PRODUCTION_GATEWAY_URL = "https://gateway.merseoriginals.com";
 
 export type BackendAlias = "production" | "prod" | "staging" | "local";
@@ -52,6 +53,16 @@ export function isLocalHost(input: string) {
   );
 }
 
+export function apiHostForDenchHost(input: string | undefined) {
+  if (!input?.trim()) return PRODUCTION_API_URL;
+  const normalized = normalizeHost(input);
+  // `dench.com` redirects to `www.dench.com` in production. Fetch drops the
+  // Authorization header across that redirect, so CLI API calls must start on
+  // the canonical API origin.
+  if (normalized === PRODUCTION_HOST) return PRODUCTION_API_URL;
+  return normalized;
+}
+
 /**
  * Resolve `local|staging|prod|production|<url>` -> a normalized host
  * origin. Aliases let `dench backend set <alias>` (and `--backend
@@ -73,7 +84,11 @@ export function resolveBackendAlias(input: string): string {
   if (normalized === "staging" || normalized === "stage") {
     return STAGING_HOST;
   }
-  if (normalized === "local" || normalized === "localhost" || normalized === "dev") {
+  if (
+    normalized === "local" ||
+    normalized === "localhost" ||
+    normalized === "dev"
+  ) {
     return LOCAL_HOST;
   }
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dench.com/cli",
-  "version": "2.0.2",
+  "version": "2.0.3",
   "description": "Dench agent workspace CLI. v2 unifies auth behind `dench signin`; the legacy `dench login` / `dench onboard` / `dench setup` / `dench what-can-i-do` / `dench register` commands now error with a redirect.",
   "type": "module",
   "bin": {