@dench.com/cli 2.0.3 → 2.0.4

package/agent-config.ts

@@ -34,11 +34,51 @@ import { mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import type { ConvexHttpClient } from "convex/browser";
-import { api } from "@/../convex/_generated/api";
+import { makeFunctionReference } from "convex/server";
 import { CliArgError, getFlag, hasFlag } from "./lib/cli-args";
 
 class AgentConfigCliError extends Error {}
 
+const api = {
+  functions: {
+    agentConfig: {
+      getAgentConfig: makeFunctionReference<"query">(
+        "functions/agentConfig:getAgentConfig",
+      ),
+      updateIdentity: makeFunctionReference<"mutation">(
+        "functions/agentConfig:updateIdentity",
+      ),
+      updateOrganisation: makeFunctionReference<"mutation">(
+        "functions/agentConfig:updateOrganisation",
+      ),
+      updateMemory: makeFunctionReference<"mutation">(
+        "functions/agentConfig:updateMemory",
+      ),
+      updateToolsNotes: makeFunctionReference<"mutation">(
+        "functions/agentConfig:updateToolsNotes",
+      ),
+      updateUserProfile: makeFunctionReference<"mutation">(
+        "functions/agentConfig:updateUserProfile",
+      ),
+      updateHeartbeat: makeFunctionReference<"mutation">(
+        "functions/agentConfig:updateHeartbeat",
+      ),
+      updateBootstrapTemplate: makeFunctionReference<"mutation">(
+        "functions/agentConfig:updateBootstrapTemplate",
+      ),
+      completeBootstrap: makeFunctionReference<"mutation">(
+        "functions/agentConfig:completeBootstrap",
+      ),
+      setDefaultChatModelV2: makeFunctionReference<"mutation">(
+        "functions/agentConfig:setDefaultChatModelV2",
+      ),
+      setThreadModelOverride: makeFunctionReference<"mutation">(
+        "functions/agentConfig:setThreadModelOverride",
+      ),
+    },
+  },
+};
+
 type CliCtx = {
   convex: ConvexHttpClient;
   args: string[];
@@ -86,7 +126,9 @@ async function readContentFromStdin(): Promise<string> {
   return new Promise((resolve, reject) => {
     const chunks: Buffer[] = [];
     process.stdin.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
-    process.stdin.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+    process.stdin.on("end", () =>
+      resolve(Buffer.concat(chunks).toString("utf8")),
+    );
     process.stdin.on("error", reject);
   });
 }
@@ -150,7 +192,10 @@ async function loadAgentConfig(ctx: CliCtx): Promise<{
   userProfile: { content: string; updatedAt: number } | null;
   organizationId: string;
 }> {
-  const result = (await runQuery(ctx, api.functions.agentConfig.getAgentConfig)) as {
+  const result = (await runQuery(
+    ctx,
+    api.functions.agentConfig.getAgentConfig,
+  )) as {
     agentConfig: {
       identity: { content: string; updatedAt: number } | null;
       organisation: { content: string; updatedAt: number } | null;
@@ -212,14 +257,14 @@ async function handleSimpleMagicFile(
     } else {
       const config = await loadAgentConfig(ctx);
       const initial = opts.perMember
-        ? config.userProfile?.content ?? ""
+        ? (config.userProfile?.content ?? "")
         : opts.field === "memoryAggregate"
-          ? config.agentConfig.memoryAggregate?.content ?? ""
+          ? (config.agentConfig.memoryAggregate?.content ?? "")
           : opts.field === "toolsNotes"
-            ? config.agentConfig.toolsNotes?.content ?? ""
+            ? (config.agentConfig.toolsNotes?.content ?? "")
             : opts.field === "identity"
-              ? config.agentConfig.identity?.content ?? ""
-              : config.agentConfig.organisation?.content ?? "";
+              ? (config.agentConfig.identity?.content ?? "")
+              : (config.agentConfig.organisation?.content ?? "");
       content = openEditor(initial, opts.label);
     }
     if (!content.trim().length) {
@@ -519,8 +564,7 @@ export async function runMemoryAggregateCommand(ctx: CliCtx): Promise<void> {
   }
   if (sub === "append") {
     const text = ctx.args.slice(1).join(" ").trim();
-    if (!text)
-      throw new AgentConfigCliError("Usage: dench mem append <text>");
+    if (!text) throw new AgentConfigCliError("Usage: dench mem append <text>");
     await runMutation(ctx, api.functions.agentConfig.updateMemory, {
       content: text,
       append: true,
@@ -593,9 +637,7 @@ export async function runDailyCommand(ctx: CliCtx): Promise<void> {
   if (sub === "show") {
     const date = ctx.args[1];
     if (!date) {
-      throw new AgentConfigCliError(
-        "Usage: dench daily show <YYYY-MM-DD>",
-      );
+      throw new AgentConfigCliError("Usage: dench daily show <YYYY-MM-DD>");
     }
     out(
       ctx,

package/chat-spawn.ts

@@ -16,8 +16,6 @@
  * (`/api/chat/[runId]/stream`) and pretty-prints text deltas + tool
  * calls until the workflow finishes.
  */
-
-import { getCurrentRuntimeTimeZone } from "@/lib/timezone";
 import { hasFlag } from "./lib/cli-args";
 
 class ChatSpawnError extends Error {}
@@ -33,6 +31,18 @@ type ChatSpawnContext = {
   jsonOutput: boolean;
 };
 
+function getCurrentRuntimeTimeZone(): string | null {
+  try {
+    const timeZone = Intl.DateTimeFormat().resolvedOptions().timeZone;
+    if (!timeZone || timeZone.length > 100) return null;
+    // Validate that Intl accepts the resolved value before forwarding it.
+    Intl.DateTimeFormat("en-US", { timeZone }).format(new Date());
+    return timeZone;
+  } catch {
+    return null;
+  }
+}
+
 function consumeFlagValue(args: string[], name: string): string | undefined {
   const idx = args.indexOf(name);
   if (idx === -1) return undefined;

package/dench.ts

@@ -440,13 +440,13 @@ Workspace members (for CRM \`user\`-type fields):
       cells assign to real members instead of being stored as unlinked
       display-name strings. See \`dench members help\`.
 
-Live web search (Exa via the Dench Cloud Gateway, auths with the active \`dench signin\` agent session or DENCH_API_KEY):
+Live web search (Exa via the Dench Gateway, auths with the active \`dench signin\` agent session or DENCH_API_KEY):
   dench search "<query>" [--num-results N] [--type auto|fast|deep|deep-reasoning|neural] [--category news|company|people|...] [--include-domains a.com,b.com] [--exclude-domains c.com] [--max-chars 800] [--json]
   dench search contents <url> [<url>...] [--max-chars 4000] [--summary "..."] [--json]
   dench search answer "<query>" [--json]
   Help: dench search help
 
-Image generation / editing (gpt-image-2 via the Dench Cloud Gateway):
+Image generation / editing (via the Dench Gateway):
   dench image generate "<prompt>" [--size 1024x1024] [--quality auto|low|medium|high] [--format png|jpeg|webp] [--save-path /workspace/path/file.png] [--output <local file>] [--no-write] [--json]
   dench image edit "<prompt>" --input <path> [--input <path> ...] [--mask <path>] [--size ...] [--quality ...] [--format ...] [--save-path ...] [--output ...] [--json]
   Help: dench image help
@@ -472,7 +472,7 @@ Spawn a new chat-turn workflow (same as the web UI):
 
   Help: dench chat help
 
-File sync (Daytona-native rewrite):
+File sync:
   dench fs status [--json] [--workspace /workspace] [--no-hash] [--drift-limit N]
   dench fs sync --initial --org-id <orgId> [--workspace /workspace]
   dench fs stream-open <path>
@@ -488,7 +488,7 @@ returns ENOSYS on the FUSE-backed volume mount):
 Persist scratch -> workspace (cp from /tmp into /workspace + Convex sync):
   dench stage <local-path> [<workspace-dest>] [--clean] [--json]
 
-Subagents (Daytona-native rewrite):
+Subagents:
   dench agent spawn '<goal>' [--parent-run-id <id>] [--sandbox own|share_parent] [--time-budget-ms N]
   dench agent await --hook <token> | --children id1,id2,id3
   dench agent message <toRunId> '<text>' [--from-run-id <id>]
@@ -501,7 +501,7 @@ Subagents (Daytona-native rewrite):
 
   dench --version
 
-Self-updating agent harness (OpenClaw parity):
+Self-updating agent harness:
   dench identity show | edit                    IDENTITY.md (org-wide)
   dench organisation show | edit                ORGANISATION.md
   dench user show | edit                        USER.md (per-member)
@@ -2038,25 +2038,31 @@ function parseBillingTopupAmountUsd() {
 }
 
 async function billingStatus(runtime: Runtime) {
-  const sessionRuntime = requireSessionRuntime(runtime, "dench billing status");
-  const status = await sessionRuntime.client.query(
+  const authedRuntime = requireAuthenticatedRuntime(
+    runtime,
+    "dench billing status",
+  );
+  const status = await authedRuntime.client.query(
     api.functions.agentWorkspace.getAgentBillingStatus,
-    { sessionToken: sessionRuntime.sessionToken },
+    { sessionToken: authedRuntime.sessionToken },
   );
   print(json ? status : formatBillingStatus(status));
 }
 
 async function billingTopup(runtime: Runtime) {
-  const sessionRuntime = requireSessionRuntime(runtime, "dench billing topup");
+  const authedRuntime = requireAuthenticatedRuntime(
+    runtime,
+    "dench billing topup",
+  );
   const amountUsd = parseBillingTopupAmountUsd();
   const response = await fetch(
-    `${sessionRuntime.host.replace(/\/+$/, "")}/api/stripe/create-ai-topup`,
+    `${authedRuntime.host.replace(/\/+$/, "")}/api/stripe/create-ai-topup`,
     {
       method: "POST",
       headers: {
         accept: "application/json",
         "content-type": "application/json",
-        authorization: `Bearer ${sessionRuntime.sessionToken}`,
+        authorization: `Bearer ${authedRuntime.sessionToken}`,
       },
       body: JSON.stringify({
         amountUsd,
@@ -2123,7 +2129,7 @@ async function billingTopup(runtime: Runtime) {
  * needed in that case). We surface either outcome cleanly.
  */
 async function denchUpgrade(runtime: Runtime) {
-  const sessionRuntime = requireSessionRuntime(runtime, "dench upgrade");
+  const authedRuntime = requireAuthenticatedRuntime(runtime, "dench upgrade");
   const tierFlag = option("--tier")?.trim().toLowerCase() || "pro";
   const cycleFlag =
     option("--cycle")?.trim().toLowerCase() ||
@@ -2146,13 +2152,13 @@ async function denchUpgrade(runtime: Runtime) {
   const internalTier = tierFlag === "pro" ? "desktop" : "cloud";
 
   const response = await fetch(
-    `${sessionRuntime.host.replace(/\/+$/, "")}/api/stripe/create-checkout`,
+    `${authedRuntime.host.replace(/\/+$/, "")}/api/stripe/create-checkout`,
     {
       method: "POST",
       headers: {
         accept: "application/json",
         "content-type": "application/json",
-        authorization: `Bearer ${sessionRuntime.sessionToken}`,
+        authorization: `Bearer ${authedRuntime.sessionToken}`,
       },
       body: JSON.stringify({
         tier: internalTier,
@@ -2394,25 +2400,6 @@ function stripRuntimeFlags(args: string[]) {
   return stripped;
 }
 
-/**
- * `session` mode is required for `agentWorkspace.*` calls because they
- * gate on `validateAgentSession` server-side, which only accepts the
- * `dch_agent_*` token format. Sandboxes that only have a unified
- * `DENCH_API_KEY` (apiKey mode) cannot impersonate a specific agent
- * and will fail at the server with `Invalid agent session` — surface
- * that here as a clear error instead.
- */
-function requireSessionRuntime(
-  runtime: Runtime,
-  command: string,
-): Extract<Runtime, { mode: "session" }> {
-  if (runtime.mode === "session") return runtime;
-  if (runtime.mode === "apiKey") {
-    throw agentSessionRequiredError(command);
-  }
-  throw loginRequiredError(command);
-}
-
 /**
  * Org-scoped commands (`dench crm`, `dench files`, etc.) accept either
  * a `dch_agent_*` agent session token OR a unified Dench API key
@@ -2543,36 +2530,6 @@ function encodeDevCrmSessionToken(args: {
   return `dch_dev_${encodeURIComponent(args.workspaceSlug)}:${encodeURIComponent(args.devKey)}`;
 }
 
-function agentSessionRequiredError(command: string) {
-  return new CliError(
-    `${command} requires an agent session — DENCH_API_KEY is org-scoped and cannot impersonate a specific agent`,
-    {
-      code: "agent_session_required",
-      nextActions: [
-        'Run dench signin --kind <kind> --name "AI Agent - Project" to mint an agent session for this command.',
-        "Or run the equivalent action via the workspace UI / dench crm if it is org-level (e.g. CRM data, files).",
-      ],
-    },
-  );
-}
-
-/**
- * `dench approval request` has separate session vs dev branches. With
- * apiKey mode added, the dev branch would silently receive partial args.
- * Use this to short-circuit that branch with a clear error.
- *
- * Asserts away the `apiKey` mode so the caller's downstream type
- * narrowing (e.g. `runtime.workspaceArgs`) keeps working.
- */
-function rejectApiKeyForAgentCommand(
-  runtime: Runtime,
-  command: string,
-): asserts runtime is Exclude<Runtime, { mode: "apiKey" }> {
-  if (runtime.mode === "apiKey") {
-    throw agentSessionRequiredError(command);
-  }
-}
-
 function asRecord(value: unknown): JsonRecord | undefined {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     return undefined;
@@ -2679,7 +2636,7 @@ async function connectedAppsContext(runtime: Runtime) {
 async function buildContext(runtime: Runtime) {
   let mine: JsonRecord;
   let urls: JsonRecord;
-  if (runtime.mode === "session") {
+  if (runtime.mode === "session" || runtime.mode === "apiKey") {
     mine = (await runtime.client.query(
       api.functions.agentWorkspace.whatCanIDoHere,
       { sessionToken: runtime.sessionToken },
@@ -2692,20 +2649,7 @@ async function buildContext(runtime: Runtime) {
     );
     urls = {};
   } else {
-    // apiKey mode: no agent session is available, so we can't call
-    // `whatCanIDoHere` (it gates on `validateAgentSession`). Return a
-    // minimal context derived from sandbox envVars so dench-cli help
-    // surfaces still work without a full login.
-    mine = {
-      authMode: "apiKey",
-      organization: runtime.organization ?? null,
-      runId: process.env.DENCH_RUN_ID?.trim() ?? null,
-      parentRunId: process.env.DENCH_PARENT_RUN_ID?.trim() ?? null,
-      rootRunId: process.env.DENCH_ROOT_RUN_ID?.trim() ?? null,
-    };
-    urls = runtime.host
-      ? workspaceUrls(runtime.host, runtime.organization?.slug)
-      : {};
+    throw loginRequiredError("dench context");
   }
 
   return {
@@ -2933,7 +2877,7 @@ function summarizeDevMine(workspaceSlug: string, data: WorkspaceOverview) {
 }
 
 async function listArtifacts(runtime: Runtime, limit?: number) {
-  if (runtime.mode === "session") {
+  if (runtime.mode === "session" || runtime.mode === "apiKey") {
     try {
       return (await runtime.client.query(
         api.functions.agentWorkspace.agentListArtifacts,
@@ -2951,12 +2895,6 @@ async function listArtifacts(runtime: Runtime, limit?: number) {
       );
     }
   }
-  if (runtime.mode === "apiKey") {
-    // No agent identity → no artifact list. Return empty so callers
-    // (e.g. `dench artifacts`, `dench suggested-work`) degrade gracefully
-    // instead of throwing for sandbox callers.
-    return [] as JsonRecord[];
-  }
   const data = await devOverview(runtime);
   return asRecordArray(data.recentArtifacts);
 }
@@ -4165,15 +4103,15 @@ async function main() {
   }
 
   if (command === "memory") {
-    const sessionRuntime = requireSessionRuntime(runtime, "dench memory");
+    const authedRuntime = requireAuthenticatedRuntime(runtime, "dench memory");
     if (subcommand === "search") {
       const query = positionalsFrom(2).join(" ").trim();
       if (!query) throw new Error('Usage: dench memory search "query"');
       print(
-        await sessionRuntime.client.query(
+        await authedRuntime.client.query(
           api.functions.agentWorkspace.agentSearchMemory,
           {
-            sessionToken: sessionRuntime.sessionToken,
+            sessionToken: authedRuntime.sessionToken,
             query,
             limit: parseNumberOption("--limit"),
           },
@@ -4188,10 +4126,10 @@ async function main() {
         throw new Error('Usage: dench memory save <key> "text"');
       }
       print(
-        await sessionRuntime.client.mutation(
+        await authedRuntime.client.mutation(
           api.functions.agentWorkspace.agentSaveMemory,
           {
-            sessionToken: sessionRuntime.sessionToken,
+            sessionToken: authedRuntime.sessionToken,
             key,
             kind: (option("--kind") ?? "fact") as never,
             text,
@@ -4216,9 +4154,9 @@ async function main() {
   }
 
   if (command === "status") {
-    if (runtime.mode === "session") {
+    if (runtime.mode === "session" || runtime.mode === "apiKey") {
       const status = (await runtime.client.query(
-        api.functions.agentWorkspace.agentStatus,
+        api.functions.agentWorkspace.whatCanIDoHere,
         {
           sessionToken: runtime.sessionToken,
         },
@@ -4230,13 +4168,6 @@ async function main() {
       print(status);
       return;
     }
-    if (runtime.mode === "apiKey") {
-      // No agent session → no agent-status query. Fall back to a thin
-      // env-derived snapshot so sandbox callers still get something
-      // useful from `dench status`.
-      print(await buildContext(runtime));
-      return;
-    }
     const data = await devOverview(runtime);
     const output = scopedStatus
       ? summarizeDevMine(runtime.workspaceArgs.workspaceSlug, data)
@@ -4248,9 +4179,9 @@ async function main() {
   }
 
   if (command === "agents") {
-    if (runtime.mode === "session") {
+    if (runtime.mode === "session" || runtime.mode === "apiKey") {
       const status = await runtime.client.query(
-        api.functions.agentWorkspace.agentStatus,
+        api.functions.agentWorkspace.whatCanIDoHere,
         {
           sessionToken: runtime.sessionToken,
         },
@@ -4258,18 +4189,15 @@ async function main() {
       print(status.agents);
       return;
     }
-    if (runtime.mode === "apiKey") {
-      throw loginRequiredError("dench agents");
-    }
     const data = await devOverview(runtime);
     print(data.agents);
     return;
   }
 
   if (command === "approvals") {
-    if (runtime.mode === "session") {
+    if (runtime.mode === "session" || runtime.mode === "apiKey") {
       const status = await runtime.client.query(
-        api.functions.agentWorkspace.agentStatus,
+        api.functions.agentWorkspace.whatCanIDoHere,
         {
           sessionToken: runtime.sessionToken,
         },
@@ -4277,9 +4205,6 @@ async function main() {
       print(status.approvals);
       return;
     }
-    if (runtime.mode === "apiKey") {
-      throw loginRequiredError("dench approvals");
-    }
     const data = await devOverview(runtime);
     print(data.approvals);
     return;
@@ -4309,7 +4234,7 @@ async function main() {
   if (command === "approval" && subcommand === "request") {
     const title = positional(2);
     if (!title) throw new Error("Missing approval title");
-    if (runtime.mode === "session") {
+    if (runtime.mode === "session" || runtime.mode === "apiKey") {
       print(
         await runtime.client.mutation(
           api.functions.agentWorkspace.agentRequestApproval,
@@ -4323,7 +4248,6 @@ async function main() {
       );
       return;
     }
-    rejectApiKeyForAgentCommand(runtime, "dench approval request");
     const approvalId = await runtime.client.mutation(
       api.functions.agentWorkspace.devRequestApproval,
       {
@@ -4346,15 +4270,15 @@ async function main() {
   ) {
     const approvalId = positional(2);
     if (!approvalId) throw new Error("Missing approval id");
-    const sessionRuntime = requireSessionRuntime(
+    const authedRuntime = requireAuthenticatedRuntime(
       runtime,
       "dench approval approve/reject",
     );
     const decision = subcommand === "approve" ? "approved" : "rejected";
-    const result = await sessionRuntime.client.mutation(
+    const result = await authedRuntime.client.mutation(
       api.functions.agentWorkspace.agentDecideApproval,
       {
-        sessionToken: sessionRuntime.sessionToken,
+        sessionToken: authedRuntime.sessionToken,
         approvalId: approvalId as never,
         decision,
         evidence: option("--evidence"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dench.com/cli",
-  "version": "2.0.3",
+  "version": "2.0.4",
   "description": "Dench agent workspace CLI. v2 unifies auth behind `dench signin`; the legacy `dench login` / `dench onboard` / `dench setup` / `dench what-can-i-do` / `dench register` commands now error with a redirect.",
   "type": "module",
   "bin": {