@dench.com/cli 2.0.2 → 2.0.4

package/agent-config.ts

@@ -34,11 +34,51 @@ import { mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import type { ConvexHttpClient } from "convex/browser";
-import { api } from "@/../convex/_generated/api";
+import { makeFunctionReference } from "convex/server";
 import { CliArgError, getFlag, hasFlag } from "./lib/cli-args";
 
 class AgentConfigCliError extends Error {}
 
+const api = {
+  functions: {
+    agentConfig: {
+      getAgentConfig: makeFunctionReference<"query">(
+        "functions/agentConfig:getAgentConfig",
+      ),
+      updateIdentity: makeFunctionReference<"mutation">(
+        "functions/agentConfig:updateIdentity",
+      ),
+      updateOrganisation: makeFunctionReference<"mutation">(
+        "functions/agentConfig:updateOrganisation",
+      ),
+      updateMemory: makeFunctionReference<"mutation">(
+        "functions/agentConfig:updateMemory",
+      ),
+      updateToolsNotes: makeFunctionReference<"mutation">(
+        "functions/agentConfig:updateToolsNotes",
+      ),
+      updateUserProfile: makeFunctionReference<"mutation">(
+        "functions/agentConfig:updateUserProfile",
+      ),
+      updateHeartbeat: makeFunctionReference<"mutation">(
+        "functions/agentConfig:updateHeartbeat",
+      ),
+      updateBootstrapTemplate: makeFunctionReference<"mutation">(
+        "functions/agentConfig:updateBootstrapTemplate",
+      ),
+      completeBootstrap: makeFunctionReference<"mutation">(
+        "functions/agentConfig:completeBootstrap",
+      ),
+      setDefaultChatModelV2: makeFunctionReference<"mutation">(
+        "functions/agentConfig:setDefaultChatModelV2",
+      ),
+      setThreadModelOverride: makeFunctionReference<"mutation">(
+        "functions/agentConfig:setThreadModelOverride",
+      ),
+    },
+  },
+};
+
 type CliCtx = {
   convex: ConvexHttpClient;
   args: string[];
@@ -86,7 +126,9 @@ async function readContentFromStdin(): Promise<string> {
   return new Promise((resolve, reject) => {
     const chunks: Buffer[] = [];
     process.stdin.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
-    process.stdin.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+    process.stdin.on("end", () =>
+      resolve(Buffer.concat(chunks).toString("utf8")),
+    );
     process.stdin.on("error", reject);
   });
 }
@@ -150,7 +192,10 @@ async function loadAgentConfig(ctx: CliCtx): Promise<{
   userProfile: { content: string; updatedAt: number } | null;
   organizationId: string;
 }> {
-  const result = (await runQuery(ctx, api.functions.agentConfig.getAgentConfig)) as {
+  const result = (await runQuery(
+    ctx,
+    api.functions.agentConfig.getAgentConfig,
+  )) as {
     agentConfig: {
       identity: { content: string; updatedAt: number } | null;
       organisation: { content: string; updatedAt: number } | null;
@@ -212,14 +257,14 @@ async function handleSimpleMagicFile(
     } else {
       const config = await loadAgentConfig(ctx);
       const initial = opts.perMember
-        ? config.userProfile?.content ?? ""
+        ? (config.userProfile?.content ?? "")
         : opts.field === "memoryAggregate"
-          ? config.agentConfig.memoryAggregate?.content ?? ""
+          ? (config.agentConfig.memoryAggregate?.content ?? "")
           : opts.field === "toolsNotes"
-            ? config.agentConfig.toolsNotes?.content ?? ""
+            ? (config.agentConfig.toolsNotes?.content ?? "")
             : opts.field === "identity"
-              ? config.agentConfig.identity?.content ?? ""
-              : config.agentConfig.organisation?.content ?? "";
+              ? (config.agentConfig.identity?.content ?? "")
+              : (config.agentConfig.organisation?.content ?? "");
       content = openEditor(initial, opts.label);
     }
     if (!content.trim().length) {
@@ -519,8 +564,7 @@ export async function runMemoryAggregateCommand(ctx: CliCtx): Promise<void> {
   }
   if (sub === "append") {
     const text = ctx.args.slice(1).join(" ").trim();
-    if (!text)
-      throw new AgentConfigCliError("Usage: dench mem append <text>");
+    if (!text) throw new AgentConfigCliError("Usage: dench mem append <text>");
     await runMutation(ctx, api.functions.agentConfig.updateMemory, {
       content: text,
       append: true,
@@ -593,9 +637,7 @@ export async function runDailyCommand(ctx: CliCtx): Promise<void> {
   if (sub === "show") {
     const date = ctx.args[1];
     if (!date) {
-      throw new AgentConfigCliError(
-        "Usage: dench daily show <YYYY-MM-DD>",
-      );
+      throw new AgentConfigCliError("Usage: dench daily show <YYYY-MM-DD>");
     }
     out(
       ctx,

package/chat-spawn.ts

@@ -16,8 +16,6 @@
  * (`/api/chat/[runId]/stream`) and pretty-prints text deltas + tool
  * calls until the workflow finishes.
  */
-
-import { getCurrentRuntimeTimeZone } from "@/lib/timezone";
 import { hasFlag } from "./lib/cli-args";
 
 class ChatSpawnError extends Error {}
@@ -33,6 +31,18 @@ type ChatSpawnContext = {
   jsonOutput: boolean;
 };
 
+function getCurrentRuntimeTimeZone(): string | null {
+  try {
+    const timeZone = Intl.DateTimeFormat().resolvedOptions().timeZone;
+    if (!timeZone || timeZone.length > 100) return null;
+    // Validate that Intl accepts the resolved value before forwarding it.
+    Intl.DateTimeFormat("en-US", { timeZone }).format(new Date());
+    return timeZone;
+  } catch {
+    return null;
+  }
+}
+
 function consumeFlagValue(args: string[], name: string): string | undefined {
   const idx = args.indexOf(name);
   if (idx === -1) return undefined;

package/dench.ts

@@ -16,11 +16,11 @@ import { ConvexHttpClient } from "convex/browser";
 import { makeFunctionReference } from "convex/server";
 import { agentKindLabel, normalizeAgentKind } from "./agentKind";
 import {
+  apiHostForDenchHost,
   DEFAULT_HOST,
   isLocalHost,
   LOCAL_HOST,
   normalizeHost,
-  PRODUCTION_API_URL,
   PRODUCTION_CONVEX_URL,
   PRODUCTION_HOST,
   resolveBackendAlias,
@@ -440,13 +440,13 @@ Workspace members (for CRM \`user\`-type fields):
       cells assign to real members instead of being stored as unlinked
       display-name strings. See \`dench members help\`.
 
-Live web search (Exa via the Dench Cloud Gateway, auths with the active \`dench signin\` agent session or DENCH_API_KEY):
+Live web search (Exa via the Dench Gateway, auths with the active \`dench signin\` agent session or DENCH_API_KEY):
   dench search "<query>" [--num-results N] [--type auto|fast|deep|deep-reasoning|neural] [--category news|company|people|...] [--include-domains a.com,b.com] [--exclude-domains c.com] [--max-chars 800] [--json]
   dench search contents <url> [<url>...] [--max-chars 4000] [--summary "..."] [--json]
   dench search answer "<query>" [--json]
   Help: dench search help
 
-Image generation / editing (gpt-image-2 via the Dench Cloud Gateway):
+Image generation / editing (via the Dench Gateway):
   dench image generate "<prompt>" [--size 1024x1024] [--quality auto|low|medium|high] [--format png|jpeg|webp] [--save-path /workspace/path/file.png] [--output <local file>] [--no-write] [--json]
   dench image edit "<prompt>" --input <path> [--input <path> ...] [--mask <path>] [--size ...] [--quality ...] [--format ...] [--save-path ...] [--output ...] [--json]
   Help: dench image help
@@ -472,7 +472,7 @@ Spawn a new chat-turn workflow (same as the web UI):
 
   Help: dench chat help
 
-File sync (Daytona-native rewrite):
+File sync:
   dench fs status [--json] [--workspace /workspace] [--no-hash] [--drift-limit N]
   dench fs sync --initial --org-id <orgId> [--workspace /workspace]
   dench fs stream-open <path>
@@ -488,7 +488,7 @@ returns ENOSYS on the FUSE-backed volume mount):
 Persist scratch -> workspace (cp from /tmp into /workspace + Convex sync):
   dench stage <local-path> [<workspace-dest>] [--clean] [--json]
 
-Subagents (Daytona-native rewrite):
+Subagents:
   dench agent spawn '<goal>' [--parent-run-id <id>] [--sandbox own|share_parent] [--time-budget-ms N]
   dench agent await --hook <token> | --children id1,id2,id3
   dench agent message <toRunId> '<text>' [--from-run-id <id>]
@@ -501,7 +501,7 @@ Subagents (Daytona-native rewrite):
 
   dench --version
 
-Self-updating agent harness (OpenClaw parity):
+Self-updating agent harness:
   dench identity show | edit                    IDENTITY.md (org-wide)
   dench organisation show | edit                ORGANISATION.md
   dench user show | edit                        USER.md (per-member)
@@ -1993,16 +1993,6 @@ async function resolveOrgChoiceForOtp(input: {
   return { newOrganizationName: newName.trim() };
 }
 
-function normalizeApiBase(input: string) {
-  const trimmed = input.trim();
-  const withProtocol = /^https?:\/\//.test(trimmed)
-    ? trimmed
-    : /^(localhost|127\.0\.0\.1|\[::1\])(?::|$)/.test(trimmed)
-      ? `http://${trimmed}`
-      : `https://${trimmed}`;
-  return new URL(withProtocol).origin;
-}
-
 async function parseResponseBody(response: Response) {
   const text = await response.text();
   if (!text) return {};
@@ -2048,25 +2038,31 @@ function parseBillingTopupAmountUsd() {
 }
 
 async function billingStatus(runtime: Runtime) {
-  const sessionRuntime = requireSessionRuntime(runtime, "dench billing status");
-  const status = await sessionRuntime.client.query(
+  const authedRuntime = requireAuthenticatedRuntime(
+    runtime,
+    "dench billing status",
+  );
+  const status = await authedRuntime.client.query(
     api.functions.agentWorkspace.getAgentBillingStatus,
-    { sessionToken: sessionRuntime.sessionToken },
+    { sessionToken: authedRuntime.sessionToken },
   );
   print(json ? status : formatBillingStatus(status));
 }
 
 async function billingTopup(runtime: Runtime) {
-  const sessionRuntime = requireSessionRuntime(runtime, "dench billing topup");
+  const authedRuntime = requireAuthenticatedRuntime(
+    runtime,
+    "dench billing topup",
+  );
   const amountUsd = parseBillingTopupAmountUsd();
   const response = await fetch(
-    `${sessionRuntime.host.replace(/\/+$/, "")}/api/stripe/create-ai-topup`,
+    `${authedRuntime.host.replace(/\/+$/, "")}/api/stripe/create-ai-topup`,
     {
       method: "POST",
       headers: {
         accept: "application/json",
         "content-type": "application/json",
-        authorization: `Bearer ${sessionRuntime.sessionToken}`,
+        authorization: `Bearer ${authedRuntime.sessionToken}`,
       },
       body: JSON.stringify({
         amountUsd,
@@ -2133,7 +2129,7 @@ async function billingTopup(runtime: Runtime) {
  * needed in that case). We surface either outcome cleanly.
  */
 async function denchUpgrade(runtime: Runtime) {
-  const sessionRuntime = requireSessionRuntime(runtime, "dench upgrade");
+  const authedRuntime = requireAuthenticatedRuntime(runtime, "dench upgrade");
   const tierFlag = option("--tier")?.trim().toLowerCase() || "pro";
   const cycleFlag =
     option("--cycle")?.trim().toLowerCase() ||
@@ -2156,13 +2152,13 @@ async function denchUpgrade(runtime: Runtime) {
   const internalTier = tierFlag === "pro" ? "desktop" : "cloud";
 
   const response = await fetch(
-    `${sessionRuntime.host.replace(/\/+$/, "")}/api/stripe/create-checkout`,
+    `${authedRuntime.host.replace(/\/+$/, "")}/api/stripe/create-checkout`,
     {
       method: "POST",
       headers: {
         accept: "application/json",
         "content-type": "application/json",
-        authorization: `Bearer ${sessionRuntime.sessionToken}`,
+        authorization: `Bearer ${authedRuntime.sessionToken}`,
       },
       body: JSON.stringify({
         tier: internalTier,
@@ -2256,16 +2252,14 @@ function resolveApiKeyConvexUrl(): string | undefined {
 /**
  * Resolve the Next.js API host the CLI should hit for HTTP calls (e.g.
  * Stripe billing topup, the gateway proxy). Same defense-in-depth
- * pattern as `resolveApiKeyConvexUrl`: env wins, then the resolved
- * Dench host the runtime is targeting, and finally
- * `PRODUCTION_API_URL` as the last resort.
+ * pattern as `resolveApiKeyConvexUrl`: env wins, then the canonical API
+ * origin for the Dench host the runtime is targeting.
  */
 function resolveApiHost(fallbackHost: string): string {
   return (
     process.env.DENCH_API_URL?.trim() ||
     process.env.DENCH_INTERNAL_BASE?.trim() ||
-    fallbackHost ||
-    PRODUCTION_API_URL
+    apiHostForDenchHost(fallbackHost)
   );
 }
 
@@ -2305,7 +2299,7 @@ async function getRuntime() {
     if (stored.status === "found") {
       return {
         mode: "session" as const,
-        host,
+        host: resolveApiHost(host),
         client: new ConvexHttpClient(stored.session.convexUrl),
         sessionToken: stored.session.sessionToken,
         organization: stored.session.organization,
@@ -2406,25 +2400,6 @@ function stripRuntimeFlags(args: string[]) {
   return stripped;
 }
 
-/**
- * `session` mode is required for `agentWorkspace.*` calls because they
- * gate on `validateAgentSession` server-side, which only accepts the
- * `dch_agent_*` token format. Sandboxes that only have a unified
- * `DENCH_API_KEY` (apiKey mode) cannot impersonate a specific agent
- * and will fail at the server with `Invalid agent session` — surface
- * that here as a clear error instead.
- */
-function requireSessionRuntime(
-  runtime: Runtime,
-  command: string,
-): Extract<Runtime, { mode: "session" }> {
-  if (runtime.mode === "session") return runtime;
-  if (runtime.mode === "apiKey") {
-    throw agentSessionRequiredError(command);
-  }
-  throw loginRequiredError(command);
-}
-
 /**
  * Org-scoped commands (`dench crm`, `dench files`, etc.) accept either
  * a `dch_agent_*` agent session token OR a unified Dench API key
@@ -2486,7 +2461,17 @@ function gatewayAuthError(
     });
   }
   if (response.status === 401) {
-    return loginRequiredError(command);
+    return new CliError(
+      `${command} could not exchange the active Dench session for a gateway key (${code})`,
+      {
+        code,
+        status: response.status,
+        nextActions: [
+          "Run dench sessions --json to confirm the selected session.",
+          'Run dench signin --kind <kind> --name "AI Agent - Project" to refresh the agent session if it expired.',
+        ],
+      },
+    );
   }
   return new CliError(`${command} could not get a gateway key (${code})`, {
     code,
@@ -2545,36 +2530,6 @@ function encodeDevCrmSessionToken(args: {
   return `dch_dev_${encodeURIComponent(args.workspaceSlug)}:${encodeURIComponent(args.devKey)}`;
 }
 
-function agentSessionRequiredError(command: string) {
-  return new CliError(
-    `${command} requires an agent session — DENCH_API_KEY is org-scoped and cannot impersonate a specific agent`,
-    {
-      code: "agent_session_required",
-      nextActions: [
-        'Run dench signin --kind <kind> --name "AI Agent - Project" to mint an agent session for this command.',
-        "Or run the equivalent action via the workspace UI / dench crm if it is org-level (e.g. CRM data, files).",
-      ],
-    },
-  );
-}
-
-/**
- * `dench approval request` has separate session vs dev branches. With
- * apiKey mode added, the dev branch would silently receive partial args.
- * Use this to short-circuit that branch with a clear error.
- *
- * Asserts away the `apiKey` mode so the caller's downstream type
- * narrowing (e.g. `runtime.workspaceArgs`) keeps working.
- */
-function rejectApiKeyForAgentCommand(
-  runtime: Runtime,
-  command: string,
-): asserts runtime is Exclude<Runtime, { mode: "apiKey" }> {
-  if (runtime.mode === "apiKey") {
-    throw agentSessionRequiredError(command);
-  }
-}
-
 function asRecord(value: unknown): JsonRecord | undefined {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     return undefined;
@@ -2681,7 +2636,7 @@ async function connectedAppsContext(runtime: Runtime) {
 async function buildContext(runtime: Runtime) {
   let mine: JsonRecord;
   let urls: JsonRecord;
-  if (runtime.mode === "session") {
+  if (runtime.mode === "session" || runtime.mode === "apiKey") {
     mine = (await runtime.client.query(
       api.functions.agentWorkspace.whatCanIDoHere,
       { sessionToken: runtime.sessionToken },
@@ -2694,20 +2649,7 @@ async function buildContext(runtime: Runtime) {
     );
     urls = {};
   } else {
-    // apiKey mode: no agent session is available, so we can't call
-    // `whatCanIDoHere` (it gates on `validateAgentSession`). Return a
-    // minimal context derived from sandbox envVars so dench-cli help
-    // surfaces still work without a full login.
-    mine = {
-      authMode: "apiKey",
-      organization: runtime.organization ?? null,
-      runId: process.env.DENCH_RUN_ID?.trim() ?? null,
-      parentRunId: process.env.DENCH_PARENT_RUN_ID?.trim() ?? null,
-      rootRunId: process.env.DENCH_ROOT_RUN_ID?.trim() ?? null,
-    };
-    urls = runtime.host
-      ? workspaceUrls(runtime.host, runtime.organization?.slug)
-      : {};
+    throw loginRequiredError("dench context");
   }
 
   return {
@@ -2935,7 +2877,7 @@ function summarizeDevMine(workspaceSlug: string, data: WorkspaceOverview) {
 }
 
 async function listArtifacts(runtime: Runtime, limit?: number) {
-  if (runtime.mode === "session") {
+  if (runtime.mode === "session" || runtime.mode === "apiKey") {
     try {
       return (await runtime.client.query(
         api.functions.agentWorkspace.agentListArtifacts,
@@ -2953,12 +2895,6 @@ async function listArtifacts(runtime: Runtime, limit?: number) {
       );
     }
   }
-  if (runtime.mode === "apiKey") {
-    // No agent identity → no artifact list. Return empty so callers
-    // (e.g. `dench artifacts`, `dench suggested-work`) degrade gracefully
-    // instead of throwing for sandbox callers.
-    return [] as JsonRecord[];
-  }
   const data = await devOverview(runtime);
   return asRecordArray(data.recentArtifacts);
 }
@@ -4167,15 +4103,15 @@ async function main() {
   }
 
   if (command === "memory") {
-    const sessionRuntime = requireSessionRuntime(runtime, "dench memory");
+    const authedRuntime = requireAuthenticatedRuntime(runtime, "dench memory");
     if (subcommand === "search") {
       const query = positionalsFrom(2).join(" ").trim();
       if (!query) throw new Error('Usage: dench memory search "query"');
       print(
-        await sessionRuntime.client.query(
+        await authedRuntime.client.query(
           api.functions.agentWorkspace.agentSearchMemory,
           {
-            sessionToken: sessionRuntime.sessionToken,
+            sessionToken: authedRuntime.sessionToken,
             query,
             limit: parseNumberOption("--limit"),
           },
@@ -4190,10 +4126,10 @@ async function main() {
         throw new Error('Usage: dench memory save <key> "text"');
       }
       print(
-        await sessionRuntime.client.mutation(
+        await authedRuntime.client.mutation(
           api.functions.agentWorkspace.agentSaveMemory,
           {
-            sessionToken: sessionRuntime.sessionToken,
+            sessionToken: authedRuntime.sessionToken,
             key,
             kind: (option("--kind") ?? "fact") as never,
             text,
@@ -4218,9 +4154,9 @@ async function main() {
   }
 
   if (command === "status") {
-    if (runtime.mode === "session") {
+    if (runtime.mode === "session" || runtime.mode === "apiKey") {
       const status = (await runtime.client.query(
-        api.functions.agentWorkspace.agentStatus,
+        api.functions.agentWorkspace.whatCanIDoHere,
         {
           sessionToken: runtime.sessionToken,
         },
@@ -4232,13 +4168,6 @@ async function main() {
       print(status);
       return;
     }
-    if (runtime.mode === "apiKey") {
-      // No agent session → no agent-status query. Fall back to a thin
-      // env-derived snapshot so sandbox callers still get something
-      // useful from `dench status`.
-      print(await buildContext(runtime));
-      return;
-    }
     const data = await devOverview(runtime);
     const output = scopedStatus
       ? summarizeDevMine(runtime.workspaceArgs.workspaceSlug, data)
@@ -4250,9 +4179,9 @@ async function main() {
   }
 
   if (command === "agents") {
-    if (runtime.mode === "session") {
+    if (runtime.mode === "session" || runtime.mode === "apiKey") {
       const status = await runtime.client.query(
-        api.functions.agentWorkspace.agentStatus,
+        api.functions.agentWorkspace.whatCanIDoHere,
         {
           sessionToken: runtime.sessionToken,
         },
@@ -4260,18 +4189,15 @@ async function main() {
       print(status.agents);
       return;
     }
-    if (runtime.mode === "apiKey") {
-      throw loginRequiredError("dench agents");
-    }
     const data = await devOverview(runtime);
     print(data.agents);
     return;
   }
 
   if (command === "approvals") {
-    if (runtime.mode === "session") {
+    if (runtime.mode === "session" || runtime.mode === "apiKey") {
       const status = await runtime.client.query(
-        api.functions.agentWorkspace.agentStatus,
+        api.functions.agentWorkspace.whatCanIDoHere,
         {
           sessionToken: runtime.sessionToken,
         },
@@ -4279,9 +4205,6 @@ async function main() {
       print(status.approvals);
       return;
     }
-    if (runtime.mode === "apiKey") {
-      throw loginRequiredError("dench approvals");
-    }
     const data = await devOverview(runtime);
     print(data.approvals);
     return;
@@ -4311,7 +4234,7 @@ async function main() {
   if (command === "approval" && subcommand === "request") {
     const title = positional(2);
     if (!title) throw new Error("Missing approval title");
-    if (runtime.mode === "session") {
+    if (runtime.mode === "session" || runtime.mode === "apiKey") {
       print(
         await runtime.client.mutation(
           api.functions.agentWorkspace.agentRequestApproval,
@@ -4325,7 +4248,6 @@ async function main() {
       );
       return;
     }
-    rejectApiKeyForAgentCommand(runtime, "dench approval request");
     const approvalId = await runtime.client.mutation(
       api.functions.agentWorkspace.devRequestApproval,
       {
@@ -4348,15 +4270,15 @@ async function main() {
   ) {
     const approvalId = positional(2);
     if (!approvalId) throw new Error("Missing approval id");
-    const sessionRuntime = requireSessionRuntime(
+    const authedRuntime = requireAuthenticatedRuntime(
       runtime,
       "dench approval approve/reject",
     );
     const decision = subcommand === "approve" ? "approved" : "rejected";
-    const result = await sessionRuntime.client.mutation(
+    const result = await authedRuntime.client.mutation(
       api.functions.agentWorkspace.agentDecideApproval,
       {
-        sessionToken: sessionRuntime.sessionToken,
+        sessionToken: authedRuntime.sessionToken,
         approvalId: approvalId as never,
         decision,
         evidence: option("--evidence"),

package/host.ts

@@ -14,7 +14,8 @@ export const DEFAULT_HOST = PRODUCTION_HOST;
  * deployment + Next.js host backs `https://www.dench.com`.
  */
 export const PRODUCTION_API_URL = "https://www.dench.com";
-export const PRODUCTION_CONVEX_URL = "https://beaming-alligator-67.convex.cloud";
+export const PRODUCTION_CONVEX_URL =
+  "https://beaming-alligator-67.convex.cloud";
 export const PRODUCTION_GATEWAY_URL = "https://gateway.merseoriginals.com";
 
 export type BackendAlias = "production" | "prod" | "staging" | "local";
@@ -52,6 +53,16 @@ export function isLocalHost(input: string) {
   );
 }
 
+export function apiHostForDenchHost(input: string | undefined) {
+  if (!input?.trim()) return PRODUCTION_API_URL;
+  const normalized = normalizeHost(input);
+  // `dench.com` redirects to `www.dench.com` in production. Fetch drops the
+  // Authorization header across that redirect, so CLI API calls must start on
+  // the canonical API origin.
+  if (normalized === PRODUCTION_HOST) return PRODUCTION_API_URL;
+  return normalized;
+}
+
 /**
  * Resolve `local|staging|prod|production|<url>` -> a normalized host
  * origin. Aliases let `dench backend set <alias>` (and `--backend
@@ -73,7 +84,11 @@ export function resolveBackendAlias(input: string): string {
   if (normalized === "staging" || normalized === "stage") {
     return STAGING_HOST;
   }
-  if (normalized === "local" || normalized === "localhost" || normalized === "dev") {
+  if (
+    normalized === "local" ||
+    normalized === "localhost" ||
+    normalized === "dev"
+  ) {
     return LOCAL_HOST;
   }
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dench.com/cli",
-  "version": "2.0.2",
+  "version": "2.0.4",
   "description": "Dench agent workspace CLI. v2 unifies auth behind `dench signin`; the legacy `dench login` / `dench onboard` / `dench setup` / `dench what-can-i-do` / `dench register` commands now error with a redirect.",
   "type": "module",
   "bin": {