@dench.com/cli 2.0.3 → 2.1.0

package/agent-config.ts

@@ -34,11 +34,51 @@ import { mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import type { ConvexHttpClient } from "convex/browser";
-import { api } from "@/../convex/_generated/api";
+import { makeFunctionReference } from "convex/server";
 import { CliArgError, getFlag, hasFlag } from "./lib/cli-args";
 
 class AgentConfigCliError extends Error {}
 
+const api = {
+  functions: {
+    agentConfig: {
+      getAgentConfig: makeFunctionReference<"query">(
+        "functions/agentConfig:getAgentConfig",
+      ),
+      updateIdentity: makeFunctionReference<"mutation">(
+        "functions/agentConfig:updateIdentity",
+      ),
+      updateOrganisation: makeFunctionReference<"mutation">(
+        "functions/agentConfig:updateOrganisation",
+      ),
+      updateMemory: makeFunctionReference<"mutation">(
+        "functions/agentConfig:updateMemory",
+      ),
+      updateToolsNotes: makeFunctionReference<"mutation">(
+        "functions/agentConfig:updateToolsNotes",
+      ),
+      updateUserProfile: makeFunctionReference<"mutation">(
+        "functions/agentConfig:updateUserProfile",
+      ),
+      updateHeartbeat: makeFunctionReference<"mutation">(
+        "functions/agentConfig:updateHeartbeat",
+      ),
+      updateBootstrapTemplate: makeFunctionReference<"mutation">(
+        "functions/agentConfig:updateBootstrapTemplate",
+      ),
+      completeBootstrap: makeFunctionReference<"mutation">(
+        "functions/agentConfig:completeBootstrap",
+      ),
+      setDefaultChatModelV2: makeFunctionReference<"mutation">(
+        "functions/agentConfig:setDefaultChatModelV2",
+      ),
+      setThreadModelOverride: makeFunctionReference<"mutation">(
+        "functions/agentConfig:setThreadModelOverride",
+      ),
+    },
+  },
+};
+
 type CliCtx = {
   convex: ConvexHttpClient;
   args: string[];
@@ -86,7 +126,9 @@ async function readContentFromStdin(): Promise<string> {
   return new Promise((resolve, reject) => {
     const chunks: Buffer[] = [];
     process.stdin.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
-    process.stdin.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+    process.stdin.on("end", () =>
+      resolve(Buffer.concat(chunks).toString("utf8")),
+    );
     process.stdin.on("error", reject);
   });
 }
@@ -150,7 +192,10 @@ async function loadAgentConfig(ctx: CliCtx): Promise<{
   userProfile: { content: string; updatedAt: number } | null;
   organizationId: string;
 }> {
-  const result = (await runQuery(ctx, api.functions.agentConfig.getAgentConfig)) as {
+  const result = (await runQuery(
+    ctx,
+    api.functions.agentConfig.getAgentConfig,
+  )) as {
     agentConfig: {
       identity: { content: string; updatedAt: number } | null;
       organisation: { content: string; updatedAt: number } | null;
@@ -212,14 +257,14 @@ async function handleSimpleMagicFile(
     } else {
       const config = await loadAgentConfig(ctx);
       const initial = opts.perMember
-        ? config.userProfile?.content ?? ""
+        ? (config.userProfile?.content ?? "")
         : opts.field === "memoryAggregate"
-          ? config.agentConfig.memoryAggregate?.content ?? ""
+          ? (config.agentConfig.memoryAggregate?.content ?? "")
           : opts.field === "toolsNotes"
-            ? config.agentConfig.toolsNotes?.content ?? ""
+            ? (config.agentConfig.toolsNotes?.content ?? "")
             : opts.field === "identity"
-              ? config.agentConfig.identity?.content ?? ""
-              : config.agentConfig.organisation?.content ?? "";
+              ? (config.agentConfig.identity?.content ?? "")
+              : (config.agentConfig.organisation?.content ?? "");
       content = openEditor(initial, opts.label);
     }
     if (!content.trim().length) {
@@ -519,8 +564,7 @@ export async function runMemoryAggregateCommand(ctx: CliCtx): Promise<void> {
   }
   if (sub === "append") {
     const text = ctx.args.slice(1).join(" ").trim();
-    if (!text)
-      throw new AgentConfigCliError("Usage: dench mem append <text>");
+    if (!text) throw new AgentConfigCliError("Usage: dench mem append <text>");
     await runMutation(ctx, api.functions.agentConfig.updateMemory, {
       content: text,
       append: true,
@@ -593,9 +637,7 @@ export async function runDailyCommand(ctx: CliCtx): Promise<void> {
   if (sub === "show") {
     const date = ctx.args[1];
     if (!date) {
-      throw new AgentConfigCliError(
-        "Usage: dench daily show <YYYY-MM-DD>",
-      );
+      throw new AgentConfigCliError("Usage: dench daily show <YYYY-MM-DD>");
     }
     out(
       ctx,

package/chat-spawn.ts

@@ -16,8 +16,6 @@
  * (`/api/chat/[runId]/stream`) and pretty-prints text deltas + tool
  * calls until the workflow finishes.
  */
-
-import { getCurrentRuntimeTimeZone } from "@/lib/timezone";
 import { hasFlag } from "./lib/cli-args";
 
 class ChatSpawnError extends Error {}
@@ -33,6 +31,18 @@ type ChatSpawnContext = {
   jsonOutput: boolean;
 };
 
+function getCurrentRuntimeTimeZone(): string | null {
+  try {
+    const timeZone = Intl.DateTimeFormat().resolvedOptions().timeZone;
+    if (!timeZone || timeZone.length > 100) return null;
+    // Validate that Intl accepts the resolved value before forwarding it.
+    Intl.DateTimeFormat("en-US", { timeZone }).format(new Date());
+    return timeZone;
+  } catch {
+    return null;
+  }
+}
+
 function consumeFlagValue(args: string[], name: string): string | undefined {
   const idx = args.indexOf(name);
   if (idx === -1) return undefined;

package/crm.ts

@@ -48,12 +48,16 @@ import {
   getRequiredFieldsForApolloPath,
 } from "./lib/crm-enrichment";
 import {
+  type AviatoEnrichCompanyBody,
+  type AviatoEnrichPersonBody,
   aviatoEnrichCompany,
   aviatoEnrichPerson,
+  type EnrichCompanyBody,
   EnrichmentGatewayError,
   type EnrichmentGatewayOptions,
+  type EnrichPersonBody,
   enrichCompany,
-  enrichPersonByIdentifier,
+  enrichPerson,
 } from "./lib/enrichment-gateway";
 
 // Contact-info fields that Aviato does not return.
@@ -383,6 +387,21 @@ const api = {
     update: makeFunctionReference<"mutation">("functions/crm/fields:update"),
     remove: makeFunctionReference<"mutation">("functions/crm/fields:remove"),
     reorder: makeFunctionReference<"mutation">("functions/crm/fields:reorder"),
+    reorderEnumValues: makeFunctionReference<"mutation">(
+      "functions/crm/fields:reorderEnumValues",
+    ),
+    addEnumValue: makeFunctionReference<"mutation">(
+      "functions/crm/fields:addEnumValue",
+    ),
+    removeEnumValue: makeFunctionReference<"mutation">(
+      "functions/crm/fields:removeEnumValue",
+    ),
+    setEnumColor: makeFunctionReference<"mutation">(
+      "functions/crm/fields:setEnumColor",
+    ),
+    renameEnumValue: makeFunctionReference<"mutation">(
+      "functions/crm/fields:renameEnumValue",
+    ),
   },
   entries: {
     list: makeFunctionReference<"query">("functions/crm/entries:list"),
@@ -693,6 +712,105 @@ async function runFieldsCommand(ctx: CrmCliContext): Promise<void> {
       );
       return;
     }
+    case "enum-reorder": {
+      const objectName = shift(ctx.args, "object name");
+      const fieldName = shift(ctx.args, "field name");
+      // Same pattern as `reorder`: peel positional args after asserting
+      // there are no stray flags so a typo'd `--limit` fails loud
+      // instead of being silently consumed as an enum value.
+      assertNoUnknownFlags(ctx.args, "crm fields enum-reorder");
+      const orderedValues = [...ctx.args];
+      if (orderedValues.length === 0) {
+        throw new CrmCliError(
+          "dench crm fields enum-reorder requires at least one value. " +
+            'Pass each enum value as a positional arg: `enum-reorder task Status "Done" "In Progress" "To Do"`',
+        );
+      }
+      out(
+        ctx,
+        await callMutation(ctx, api.fields.reorderEnumValues, {
+          objectName,
+          fieldName,
+          orderedValues,
+        }),
+      );
+      return;
+    }
+    case "enum-add": {
+      const objectName = shift(ctx.args, "object name");
+      const fieldName = shift(ctx.args, "field name");
+      const value = shift(ctx.args, "enum value");
+      const color = getFlag(ctx.args, "--color");
+      const positionStr = getFlag(ctx.args, "--position");
+      const position =
+        positionStr !== undefined ? Number.parseInt(positionStr, 10) : undefined;
+      if (position !== undefined && !Number.isFinite(position)) {
+        throw new CrmCliError(
+          `--position must be an integer, got "${positionStr}"`,
+        );
+      }
+      assertNoUnknownFlags(ctx.args, "crm fields enum-add");
+      out(
+        ctx,
+        await callMutation(ctx, api.fields.addEnumValue, {
+          objectName,
+          fieldName,
+          value,
+          color,
+          position,
+        }),
+      );
+      return;
+    }
+    case "enum-remove": {
+      const objectName = shift(ctx.args, "object name");
+      const fieldName = shift(ctx.args, "field name");
+      const value = shift(ctx.args, "enum value");
+      assertNoUnknownFlags(ctx.args, "crm fields enum-remove");
+      out(
+        ctx,
+        await callMutation(ctx, api.fields.removeEnumValue, {
+          objectName,
+          fieldName,
+          value,
+        }),
+      );
+      return;
+    }
+    case "enum-rename": {
+      const objectName = shift(ctx.args, "object name");
+      const fieldName = shift(ctx.args, "field name");
+      const oldValue = shift(ctx.args, "old enum value");
+      const newValue = shift(ctx.args, "new enum value");
+      assertNoUnknownFlags(ctx.args, "crm fields enum-rename");
+      out(
+        ctx,
+        await callMutation(ctx, api.fields.renameEnumValue, {
+          objectName,
+          fieldName,
+          oldValue,
+          newValue,
+        }),
+      );
+      return;
+    }
+    case "enum-set-color": {
+      const objectName = shift(ctx.args, "object name");
+      const fieldName = shift(ctx.args, "field name");
+      const value = shift(ctx.args, "enum value");
+      const color = shift(ctx.args, "hex color");
+      assertNoUnknownFlags(ctx.args, "crm fields enum-set-color");
+      out(
+        ctx,
+        await callMutation(ctx, api.fields.setEnumColor, {
+          objectName,
+          fieldName,
+          value,
+          color,
+        }),
+      );
+      return;
+    }
     default:
       throw new CrmCliError(`Unknown crm fields verb: ${verb ?? "<none>"}`);
   }
@@ -1704,6 +1822,21 @@ async function resolveEnrichmentTarget(
   };
 }
 
+/**
+ * Build the gateway request body from a CRM entry the same way the
+ * chat-turn `enrich_person` / `enrich_company` / `enrich_person_basic` /
+ * `enrich_company_basic` tools do — pass every structured identifier the
+ * row has (email, firstName, lastName, linkedinUrl, domain, …) and let the
+ * shared gateway client (`enrichPerson`, `enrichCompany`,
+ * `aviatoEnrichPerson`, `aviatoEnrichCompany`) validate + dispatch.
+ *
+ * The previous implementation collapsed the entry to a single
+ * `--input-field` value and called `enrichPersonByIdentifier`, which
+ * threw away the rest of the row and made FullEnrich fail with
+ * `missing_people_identifier` whenever the input field was just an
+ * Email (no first/last name reached the gateway, so the validator
+ * rejected the request before any provider was called).
+ */
 async function callEnrichmentGatewayForEntry(args: {
   target: EnrichmentTarget;
   entry: CrmEntryForEnrichment;
@@ -1711,64 +1844,167 @@ async function callEnrichmentGatewayForEntry(args: {
   provider?: string;
   gateway?: Pick<EnrichmentGatewayOptions, "apiKey" | "baseUrl">;
 }): Promise<Record<string, unknown>> {
-  const input = args.entry.fields[args.target.inputField.name];
-  if (!hasCellValue(input)) {
+  const { entry, target } = args;
+  // Sanity gate: the column the user picked as `--input-field` must be
+  // populated. The body builder will pass every other available identifier
+  // too, so the gateway has the best possible chance of resolving the row.
+  if (!hasCellValue(entry.fields[target.inputField.name])) {
     throw new CrmCliError(
-      `Entry ${args.entry.id} has no value for input field "${args.target.inputField.name}"`,
+      `Entry ${entry.id} has no value for input field "${target.inputField.name}"`,
     );
   }
-  const inputValue = String(input);
-  const isCompany = args.target.category === "company";
+  const isCompany = target.category === "company";
   const resolvedProvider =
     args.provider ?? (isCompany ? "aviato" : "fullenrich");
 
   if (resolvedProvider === "aviato") {
-    // Guard: Aviato does not return phone or email.
-    const contactFields = args.target.requiredFields.filter(isContactField);
+    // Aviato does not return phone or email — surface a clear error
+    // before we waste a gateway round-trip.
+    const contactFields = target.requiredFields.filter(isContactField);
     if (contactFields.length > 0) {
       throw new CrmCliError(
         `Aviato does not return phone or email; use --provider fullenrich for contact fields (${contactFields.join(", ")}).`,
       );
     }
-
     if (isCompany) {
-      // inputValue is typically a domain; try to detect linkedin URLs
-      const isLinkedin = /linkedin\.com/i.test(inputValue);
       return aviatoEnrichCompany(
-        isLinkedin ? { linkedinUrl: inputValue } : { website: inputValue },
+        buildAviatoCompanyBodyFromEntry(entry),
         args.gateway,
       );
-    } else {
-      // For people, inputValue may be a LinkedIn URL, email, or LinkedIn ID
-      const isLinkedin = /linkedin\.com/i.test(inputValue);
-      const isEmail = /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(inputValue);
-      if (isLinkedin) {
-        return aviatoEnrichPerson({ linkedinUrl: inputValue }, args.gateway);
-      }
-      if (isEmail) {
-        return aviatoEnrichPerson({ email: inputValue }, args.gateway);
-      }
-      return aviatoEnrichPerson({ linkedinID: inputValue }, args.gateway);
     }
+    return aviatoEnrichPerson(
+      buildAviatoPersonBodyFromEntry(entry),
+      args.gateway,
+    );
   }
 
-  // fullenrich path (default for people, explicit override for companies)
+  // FullEnrich path. Mirrors `enrichPersonStep` / `enrichCompanyStep` in
+  // src/workflows/enrichment-steps.ts: build a structured body, hand it
+  // to the same shared gateway client.
   if (isCompany) {
     return enrichCompany(
-      {
-        domain: inputValue,
-        requiredFields: args.target.requiredFields,
-      },
+      buildCompanyBodyFromEntry(entry, target.requiredFields),
       args.gateway,
     );
   }
-  return enrichPersonByIdentifier(
-    inputValue,
-    args.target.requiredFields,
+  return enrichPerson(
+    buildPersonBodyFromEntry(entry, target.requiredFields),
     args.gateway,
   );
 }
 
+// ── Body builders ────────────────────────────────────────────────────────
+//
+// Pick whichever canonical column name the entry happens to use. Field
+// naming on CRM objects has historically drifted (`Name` vs `Full Name`,
+// `Email` vs `Email Address`, `Website` vs `Domain`), so each builder
+// accepts a small list of synonyms before giving up.
+
+const PEOPLE_FULL_NAME_FIELDS = ["Name", "Full Name", "Person Name"] as const;
+const PEOPLE_FIRST_NAME_FIELDS = ["First Name", "Given Name"] as const;
+const PEOPLE_LAST_NAME_FIELDS = ["Last Name", "Family Name", "Surname"] as const;
+const PEOPLE_EMAIL_FIELDS = [
+  "Email",
+  "Email Address",
+  "Work Email",
+  "Personal Email",
+] as const;
+const PEOPLE_LINKEDIN_FIELDS = ["LinkedIn URL", "LinkedIn", "Linkedin URL"] as const;
+const PEOPLE_DOMAIN_FIELDS = ["Domain", "Company Domain"] as const;
+
+const COMPANY_WEBSITE_FIELDS = ["Website", "Domain", "URL", "Site"] as const;
+const COMPANY_LINKEDIN_FIELDS = [
+  "LinkedIn URL",
+  "LinkedIn",
+  "Linkedin URL",
+] as const;
+const COMPANY_NAME_FIELDS = [
+  "Company Name",
+  "Name",
+  "Organization",
+  "Organization Name",
+] as const;
+
+function readEntryField(
+  entry: CrmEntryForEnrichment,
+  candidates: readonly string[],
+): string | undefined {
+  for (const name of candidates) {
+    const value = entry.fields[name];
+    if (typeof value === "string") {
+      const trimmed = value.trim();
+      if (trimmed.length > 0) return trimmed;
+    }
+  }
+  return undefined;
+}
+
+/** Split "Mendy Edri" → { firstName: "Mendy", lastName: "Edri" }. */
+export function splitFullName(fullName: string): {
+  firstName?: string;
+  lastName?: string;
+} {
+  const trimmed = fullName.trim();
+  if (!trimmed) return {};
+  const parts = trimmed.split(/\s+/);
+  if (parts.length === 1) return { firstName: parts[0] };
+  return { firstName: parts[0], lastName: parts.slice(1).join(" ") };
+}
+
+export function buildPersonBodyFromEntry(
+  entry: CrmEntryForEnrichment,
+  requiredFields: string[] | undefined,
+): EnrichPersonBody {
+  let firstName = readEntryField(entry, PEOPLE_FIRST_NAME_FIELDS);
+  let lastName = readEntryField(entry, PEOPLE_LAST_NAME_FIELDS);
+  if (!firstName || !lastName) {
+    const fullName = readEntryField(entry, PEOPLE_FULL_NAME_FIELDS);
+    if (fullName) {
+      const split = splitFullName(fullName);
+      firstName ??= split.firstName;
+      lastName ??= split.lastName;
+    }
+  }
+  return {
+    email: readEntryField(entry, PEOPLE_EMAIL_FIELDS),
+    linkedinUrl: readEntryField(entry, PEOPLE_LINKEDIN_FIELDS),
+    firstName,
+    lastName,
+    domain: readEntryField(entry, PEOPLE_DOMAIN_FIELDS),
+    requiredFields,
+  };
+}
+
+export function buildCompanyBodyFromEntry(
+  entry: CrmEntryForEnrichment,
+  requiredFields: string[] | undefined,
+): EnrichCompanyBody {
+  return {
+    domain: readEntryField(entry, COMPANY_WEBSITE_FIELDS),
+    companyName: readEntryField(entry, COMPANY_NAME_FIELDS),
+    linkedinUrl: readEntryField(entry, COMPANY_LINKEDIN_FIELDS),
+    requiredFields,
+  };
+}
+
+export function buildAviatoPersonBodyFromEntry(
+  entry: CrmEntryForEnrichment,
+): AviatoEnrichPersonBody {
+  return {
+    linkedinUrl: readEntryField(entry, PEOPLE_LINKEDIN_FIELDS),
+    email: readEntryField(entry, PEOPLE_EMAIL_FIELDS),
+  };
+}
+
+export function buildAviatoCompanyBodyFromEntry(
+  entry: CrmEntryForEnrichment,
+): AviatoEnrichCompanyBody {
+  return {
+    website: readEntryField(entry, COMPANY_WEBSITE_FIELDS),
+    linkedinUrl: readEntryField(entry, COMPANY_LINKEDIN_FIELDS),
+  };
+}
+
 async function enrichOneEntry(
   ctx: CrmCliContext,
   args: Omit<CellEnrichmentArgs, "entryId"> & {
@@ -2148,6 +2384,28 @@ Fields (columns):
   dench crm fields delete <object> <field>
   dench crm fields reorder <object> <field1> <field2> <field3> ...
 
+  Enum option management (on existing enum fields):
+  dench crm fields enum-reorder <object> <field> <value1> <value2> ...
+      Canonical way to set the order of kanban columns / table picker options.
+      The trailing positional values must be a permutation of the field's
+      current enumValues; additions/removals are rejected (use enum-add /
+      enum-remove first). Also keeps any matching crmStatuses rows in sync
+      so the kanban (which prefers statuses over enumValues) reflects the
+      new order.
+  dench crm fields enum-add <object> <field> <value> [--color HEX] [--position N]
+      Appends <value> to the field's enumValues. --color is a hex like
+      "#22c55e"; --position is a 0-based insertion index (defaults to append).
+      Idempotent: re-adding an existing value only updates its color when given.
+  dench crm fields enum-remove <object> <field> <value>
+      Removes the value from the option list. Historical entry rows that held
+      <value> keep the literal string (the badge falls back to the default
+      tint), matching Notion's "remove option, keep history" semantics.
+  dench crm fields enum-rename <object> <field> <oldValue> <newValue>
+      Renames the option AND rewrites every entry that referenced the old
+      value (bounded to 1000 rows per call) AND renames matching crmStatuses.
+  dench crm fields enum-set-color <object> <field> <value> <hex>
+      Update the color (e.g. "#3b82f6") for an existing enum option.
+
 Entries (rows):
   dench crm entries list <object> [--limit N] [--with-meta] [--json]
   dench crm entries get <object> <entryId>

package/dench.ts

@@ -376,6 +376,30 @@ function parseCommaOption(name: string) {
   );
 }
 
+function parseMemoryVisibilityOption() {
+  const scope = option("--scope");
+  const visibility = option("--visibility");
+  if (scope && visibility && scope !== visibility) {
+    throw new CliError(
+      "--scope and --visibility must match when both are set",
+      {
+        code: "memory_scope_conflict",
+        nextActions: ["Use only --scope user or --scope org."],
+      },
+    );
+  }
+  const value = scope ?? visibility ?? "user";
+  if (value !== "user" && value !== "org") {
+    throw new CliError("--scope must be user or org", {
+      code: "invalid_memory_scope",
+      nextActions: [
+        "Use --scope user for private user memory or --scope org for shared organization memory.",
+      ],
+    });
+  }
+  return value;
+}
+
 function logHuman(message: string) {
   if (!json) {
     console.error(message);
@@ -398,7 +422,7 @@ Usage:
   dench context [--json]
   dench status [--mine|--self] [--json]
   dench memory search "query" [--limit 8] [--json]
-  dench memory save <key> "text" [--kind fact|decision|preference|goal|tool_note|other] [--tags a,b] [--sensitivity normal|broad|sensitive] [--json]
+  dench memory save <key> "text" [--kind fact|decision|preference|goal|tool_note|other] [--tags a,b] [--sensitivity normal|broad|sensitive] [--scope user|org] [--json]
   dench artifacts [--limit 25] [--json]
   dench suggested-work [--json]
   dench approval request "message" [--json]
@@ -440,13 +464,13 @@ Workspace members (for CRM \`user\`-type fields):
       cells assign to real members instead of being stored as unlinked
       display-name strings. See \`dench members help\`.
 
-Live web search (Exa via the Dench Cloud Gateway, auths with the active \`dench signin\` agent session or DENCH_API_KEY):
+Live web search (Exa via the Dench Gateway, auths with the active \`dench signin\` agent session or DENCH_API_KEY):
   dench search "<query>" [--num-results N] [--type auto|fast|deep|deep-reasoning|neural] [--category news|company|people|...] [--include-domains a.com,b.com] [--exclude-domains c.com] [--max-chars 800] [--json]
   dench search contents <url> [<url>...] [--max-chars 4000] [--summary "..."] [--json]
   dench search answer "<query>" [--json]
   Help: dench search help
 
-Image generation / editing (gpt-image-2 via the Dench Cloud Gateway):
+Image generation / editing (via the Dench Gateway):
   dench image generate "<prompt>" [--size 1024x1024] [--quality auto|low|medium|high] [--format png|jpeg|webp] [--save-path /workspace/path/file.png] [--output <local file>] [--no-write] [--json]
   dench image edit "<prompt>" --input <path> [--input <path> ...] [--mask <path>] [--size ...] [--quality ...] [--format ...] [--save-path ...] [--output ...] [--json]
   Help: dench image help
@@ -472,7 +496,7 @@ Spawn a new chat-turn workflow (same as the web UI):
 
   Help: dench chat help
 
-File sync (Daytona-native rewrite):
+File sync:
   dench fs status [--json] [--workspace /workspace] [--no-hash] [--drift-limit N]
   dench fs sync --initial --org-id <orgId> [--workspace /workspace]
   dench fs stream-open <path>
@@ -488,7 +512,7 @@ returns ENOSYS on the FUSE-backed volume mount):
 Persist scratch -> workspace (cp from /tmp into /workspace + Convex sync):
   dench stage <local-path> [<workspace-dest>] [--clean] [--json]
 
-Subagents (Daytona-native rewrite):
+Subagents:
   dench agent spawn '<goal>' [--parent-run-id <id>] [--sandbox own|share_parent] [--time-budget-ms N]
   dench agent await --hook <token> | --children id1,id2,id3
   dench agent message <toRunId> '<text>' [--from-run-id <id>]
@@ -501,7 +525,7 @@ Subagents (Daytona-native rewrite):
 
   dench --version
 
-Self-updating agent harness (OpenClaw parity):
+Self-updating agent harness:
   dench identity show | edit                    IDENTITY.md (org-wide)
   dench organisation show | edit                ORGANISATION.md
   dench user show | edit                        USER.md (per-member)
@@ -610,10 +634,11 @@ function memoryHelp() {
 
 Usage:
   dench memory search "query" [--limit 8] [--json]
-  dench memory save <key> "text" [--kind fact|decision|preference|goal|tool_note|other] [--tags a,b] [--sensitivity normal|broad|sensitive] [--json]
+  dench memory save <key> "text" [--kind fact|decision|preference|goal|tool_note|other] [--tags a,b] [--sensitivity normal|broad|sensitive] [--scope user|org] [--json]
 
 Use memory only for stable facts, decisions, preferences, recurring goals, and
-tool notes. Do not store secrets or scratch notes.
+tool notes. Do not store secrets or scratch notes. Saved memories are scoped to
+the signed-in user by default; pass --scope org to share with the organization.
 `);
 }
 
@@ -2038,25 +2063,31 @@ function parseBillingTopupAmountUsd() {
 }
 
 async function billingStatus(runtime: Runtime) {
-  const sessionRuntime = requireSessionRuntime(runtime, "dench billing status");
-  const status = await sessionRuntime.client.query(
+  const authedRuntime = requireAuthenticatedRuntime(
+    runtime,
+    "dench billing status",
+  );
+  const status = await authedRuntime.client.query(
     api.functions.agentWorkspace.getAgentBillingStatus,
-    { sessionToken: sessionRuntime.sessionToken },
+    { sessionToken: authedRuntime.sessionToken },
   );
   print(json ? status : formatBillingStatus(status));
 }
 
 async function billingTopup(runtime: Runtime) {
-  const sessionRuntime = requireSessionRuntime(runtime, "dench billing topup");
+  const authedRuntime = requireAuthenticatedRuntime(
+    runtime,
+    "dench billing topup",
+  );
   const amountUsd = parseBillingTopupAmountUsd();
   const response = await fetch(
-    `${sessionRuntime.host.replace(/\/+$/, "")}/api/stripe/create-ai-topup`,
+    `${authedRuntime.host.replace(/\/+$/, "")}/api/stripe/create-ai-topup`,
     {
       method: "POST",
       headers: {
         accept: "application/json",
         "content-type": "application/json",
-        authorization: `Bearer ${sessionRuntime.sessionToken}`,
+        authorization: `Bearer ${authedRuntime.sessionToken}`,
       },
       body: JSON.stringify({
         amountUsd,
@@ -2123,7 +2154,7 @@ async function billingTopup(runtime: Runtime) {
  * needed in that case). We surface either outcome cleanly.
  */
 async function denchUpgrade(runtime: Runtime) {
-  const sessionRuntime = requireSessionRuntime(runtime, "dench upgrade");
+  const authedRuntime = requireAuthenticatedRuntime(runtime, "dench upgrade");
   const tierFlag = option("--tier")?.trim().toLowerCase() || "pro";
   const cycleFlag =
     option("--cycle")?.trim().toLowerCase() ||
@@ -2146,13 +2177,13 @@ async function denchUpgrade(runtime: Runtime) {
   const internalTier = tierFlag === "pro" ? "desktop" : "cloud";
 
   const response = await fetch(
-    `${sessionRuntime.host.replace(/\/+$/, "")}/api/stripe/create-checkout`,
+    `${authedRuntime.host.replace(/\/+$/, "")}/api/stripe/create-checkout`,
     {
       method: "POST",
       headers: {
         accept: "application/json",
         "content-type": "application/json",
-        authorization: `Bearer ${sessionRuntime.sessionToken}`,
+        authorization: `Bearer ${authedRuntime.sessionToken}`,
       },
       body: JSON.stringify({
         tier: internalTier,
@@ -2394,25 +2425,6 @@ function stripRuntimeFlags(args: string[]) {
   return stripped;
 }
 
-/**
- * `session` mode is required for `agentWorkspace.*` calls because they
- * gate on `validateAgentSession` server-side, which only accepts the
- * `dch_agent_*` token format. Sandboxes that only have a unified
- * `DENCH_API_KEY` (apiKey mode) cannot impersonate a specific agent
- * and will fail at the server with `Invalid agent session` — surface
- * that here as a clear error instead.
- */
-function requireSessionRuntime(
-  runtime: Runtime,
-  command: string,
-): Extract<Runtime, { mode: "session" }> {
-  if (runtime.mode === "session") return runtime;
-  if (runtime.mode === "apiKey") {
-    throw agentSessionRequiredError(command);
-  }
-  throw loginRequiredError(command);
-}
-
 /**
  * Org-scoped commands (`dench crm`, `dench files`, etc.) accept either
  * a `dch_agent_*` agent session token OR a unified Dench API key
@@ -2432,6 +2444,7 @@ function requireAuthenticatedRuntime(
 type GatewayCommandAuth = {
   bearerToken: string;
   gatewayBaseUrl?: string;
+  gatewayHeaders?: Record<string, string>;
 };
 
 function gatewayBaseUrlForCli(value: unknown): string | undefined {
@@ -2528,6 +2541,12 @@ async function resolveGatewayCommandAuth(
     return {
       bearerToken: gatewayKey,
       gatewayBaseUrl: gatewayBaseUrlForCli(body.gatewayBaseUrl),
+      gatewayHeaders:
+        body.gatewayHeaders &&
+        typeof body.gatewayHeaders === "object" &&
+        !Array.isArray(body.gatewayHeaders)
+          ? (body.gatewayHeaders as Record<string, string>)
+          : undefined,
     };
   }
 
@@ -2543,36 +2562,6 @@ function encodeDevCrmSessionToken(args: {
   return `dch_dev_${encodeURIComponent(args.workspaceSlug)}:${encodeURIComponent(args.devKey)}`;
 }
 
-function agentSessionRequiredError(command: string) {
-  return new CliError(
-    `${command} requires an agent session — DENCH_API_KEY is org-scoped and cannot impersonate a specific agent`,
-    {
-      code: "agent_session_required",
-      nextActions: [
-        'Run dench signin --kind <kind> --name "AI Agent - Project" to mint an agent session for this command.',
-        "Or run the equivalent action via the workspace UI / dench crm if it is org-level (e.g. CRM data, files).",
-      ],
-    },
-  );
-}
-
-/**
- * `dench approval request` has separate session vs dev branches. With
- * apiKey mode added, the dev branch would silently receive partial args.
- * Use this to short-circuit that branch with a clear error.
- *
- * Asserts away the `apiKey` mode so the caller's downstream type
- * narrowing (e.g. `runtime.workspaceArgs`) keeps working.
- */
-function rejectApiKeyForAgentCommand(
-  runtime: Runtime,
-  command: string,
-): asserts runtime is Exclude<Runtime, { mode: "apiKey" }> {
-  if (runtime.mode === "apiKey") {
-    throw agentSessionRequiredError(command);
-  }
-}
-
 function asRecord(value: unknown): JsonRecord | undefined {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     return undefined;
@@ -2665,6 +2654,7 @@ async function connectedAppsContext(runtime: Runtime) {
     return fetchConnectedAppsSummary({
       bearerToken: gatewayAuth.bearerToken,
       gatewayBaseUrl: gatewayAuth.gatewayBaseUrl,
+      gatewayHeaders: gatewayAuth.gatewayHeaders,
     });
   } catch (error) {
     return {
@@ -2679,7 +2669,7 @@ async function connectedAppsContext(runtime: Runtime) {
 async function buildContext(runtime: Runtime) {
   let mine: JsonRecord;
   let urls: JsonRecord;
-  if (runtime.mode === "session") {
+  if (runtime.mode === "session" || runtime.mode === "apiKey") {
     mine = (await runtime.client.query(
       api.functions.agentWorkspace.whatCanIDoHere,
       { sessionToken: runtime.sessionToken },
@@ -2692,20 +2682,7 @@ async function buildContext(runtime: Runtime) {
     );
     urls = {};
   } else {
-    // apiKey mode: no agent session is available, so we can't call
-    // `whatCanIDoHere` (it gates on `validateAgentSession`). Return a
-    // minimal context derived from sandbox envVars so dench-cli help
-    // surfaces still work without a full login.
-    mine = {
-      authMode: "apiKey",
-      organization: runtime.organization ?? null,
-      runId: process.env.DENCH_RUN_ID?.trim() ?? null,
-      parentRunId: process.env.DENCH_PARENT_RUN_ID?.trim() ?? null,
-      rootRunId: process.env.DENCH_ROOT_RUN_ID?.trim() ?? null,
-    };
-    urls = runtime.host
-      ? workspaceUrls(runtime.host, runtime.organization?.slug)
-      : {};
+    throw loginRequiredError("dench context");
   }
 
   return {
@@ -2933,7 +2910,7 @@ function summarizeDevMine(workspaceSlug: string, data: WorkspaceOverview) {
 }
 
 async function listArtifacts(runtime: Runtime, limit?: number) {
-  if (runtime.mode === "session") {
+  if (runtime.mode === "session" || runtime.mode === "apiKey") {
     try {
       return (await runtime.client.query(
         api.functions.agentWorkspace.agentListArtifacts,
@@ -2951,12 +2928,6 @@ async function listArtifacts(runtime: Runtime, limit?: number) {
       );
     }
   }
-  if (runtime.mode === "apiKey") {
-    // No agent identity → no artifact list. Return empty so callers
-    // (e.g. `dench artifacts`, `dench suggested-work`) degrade gracefully
-    // instead of throwing for sandbox callers.
-    return [] as JsonRecord[];
-  }
   const data = await devOverview(runtime);
   return asRecordArray(data.recentArtifacts);
 }
@@ -3884,6 +3855,7 @@ async function main() {
       jsonOutput: json,
       bearerToken: gatewayAuth.bearerToken,
       gatewayBaseUrl: gatewayAuth.gatewayBaseUrl,
+      gatewayHeaders: gatewayAuth.gatewayHeaders,
     });
     return;
   }
@@ -3903,6 +3875,7 @@ async function main() {
       jsonOutput: json,
       bearerToken: gatewayAuth.bearerToken,
       gatewayBaseUrl: gatewayAuth.gatewayBaseUrl,
+      gatewayHeaders: gatewayAuth.gatewayHeaders,
     });
     return;
   }
@@ -4165,15 +4138,15 @@ async function main() {
   }
 
   if (command === "memory") {
-    const sessionRuntime = requireSessionRuntime(runtime, "dench memory");
+    const authedRuntime = requireAuthenticatedRuntime(runtime, "dench memory");
     if (subcommand === "search") {
       const query = positionalsFrom(2).join(" ").trim();
       if (!query) throw new Error('Usage: dench memory search "query"');
       print(
-        await sessionRuntime.client.query(
+        await authedRuntime.client.query(
           api.functions.agentWorkspace.agentSearchMemory,
           {
-            sessionToken: sessionRuntime.sessionToken,
+            sessionToken: authedRuntime.sessionToken,
             query,
             limit: parseNumberOption("--limit"),
           },
@@ -4188,15 +4161,16 @@ async function main() {
         throw new Error('Usage: dench memory save <key> "text"');
       }
       print(
-        await sessionRuntime.client.mutation(
+        await authedRuntime.client.mutation(
           api.functions.agentWorkspace.agentSaveMemory,
           {
-            sessionToken: sessionRuntime.sessionToken,
+            sessionToken: authedRuntime.sessionToken,
             key,
             kind: (option("--kind") ?? "fact") as never,
             text,
             tags: parseCommaOption("--tags"),
             sensitivity: (option("--sensitivity") ?? "normal") as never,
+            visibility: parseMemoryVisibilityOption() as never,
           },
         ),
       );
@@ -4216,9 +4190,9 @@ async function main() {
   }
 
   if (command === "status") {
-    if (runtime.mode === "session") {
+    if (runtime.mode === "session" || runtime.mode === "apiKey") {
       const status = (await runtime.client.query(
-        api.functions.agentWorkspace.agentStatus,
+        api.functions.agentWorkspace.whatCanIDoHere,
         {
           sessionToken: runtime.sessionToken,
         },
@@ -4230,13 +4204,6 @@ async function main() {
       print(status);
       return;
     }
-    if (runtime.mode === "apiKey") {
-      // No agent session → no agent-status query. Fall back to a thin
-      // env-derived snapshot so sandbox callers still get something
-      // useful from `dench status`.
-      print(await buildContext(runtime));
-      return;
-    }
     const data = await devOverview(runtime);
     const output = scopedStatus
       ? summarizeDevMine(runtime.workspaceArgs.workspaceSlug, data)
@@ -4248,9 +4215,9 @@ async function main() {
   }
 
   if (command === "agents") {
-    if (runtime.mode === "session") {
+    if (runtime.mode === "session" || runtime.mode === "apiKey") {
       const status = await runtime.client.query(
-        api.functions.agentWorkspace.agentStatus,
+        api.functions.agentWorkspace.whatCanIDoHere,
         {
           sessionToken: runtime.sessionToken,
         },
@@ -4258,18 +4225,15 @@ async function main() {
       print(status.agents);
       return;
     }
-    if (runtime.mode === "apiKey") {
-      throw loginRequiredError("dench agents");
-    }
     const data = await devOverview(runtime);
     print(data.agents);
     return;
   }
 
   if (command === "approvals") {
-    if (runtime.mode === "session") {
+    if (runtime.mode === "session" || runtime.mode === "apiKey") {
       const status = await runtime.client.query(
-        api.functions.agentWorkspace.agentStatus,
+        api.functions.agentWorkspace.whatCanIDoHere,
         {
           sessionToken: runtime.sessionToken,
         },
@@ -4277,9 +4241,6 @@ async function main() {
       print(status.approvals);
       return;
     }
-    if (runtime.mode === "apiKey") {
-      throw loginRequiredError("dench approvals");
-    }
     const data = await devOverview(runtime);
     print(data.approvals);
     return;
@@ -4309,7 +4270,7 @@ async function main() {
   if (command === "approval" && subcommand === "request") {
     const title = positional(2);
     if (!title) throw new Error("Missing approval title");
-    if (runtime.mode === "session") {
+    if (runtime.mode === "session" || runtime.mode === "apiKey") {
       print(
         await runtime.client.mutation(
           api.functions.agentWorkspace.agentRequestApproval,
@@ -4323,7 +4284,6 @@ async function main() {
       );
       return;
     }
-    rejectApiKeyForAgentCommand(runtime, "dench approval request");
     const approvalId = await runtime.client.mutation(
       api.functions.agentWorkspace.devRequestApproval,
       {
@@ -4346,15 +4306,15 @@ async function main() {
   ) {
     const approvalId = positional(2);
     if (!approvalId) throw new Error("Missing approval id");
-    const sessionRuntime = requireSessionRuntime(
+    const authedRuntime = requireAuthenticatedRuntime(
       runtime,
       "dench approval approve/reject",
     );
     const decision = subcommand === "approve" ? "approved" : "rejected";
-    const result = await sessionRuntime.client.mutation(
+    const result = await authedRuntime.client.mutation(
       api.functions.agentWorkspace.agentDecideApproval,
       {
-        sessionToken: sessionRuntime.sessionToken,
+        sessionToken: authedRuntime.sessionToken,
         approvalId: approvalId as never,
         decision,
         evidence: option("--evidence"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dench.com/cli",
-  "version": "2.0.3",
+  "version": "2.1.0",
   "description": "Dench agent workspace CLI. v2 unifies auth behind `dench signin`; the legacy `dench login` / `dench onboard` / `dench setup` / `dench what-can-i-do` / `dench register` commands now error with a redirect.",
   "type": "module",
   "bin": {

package/tools.ts

@@ -50,11 +50,12 @@ export type ToolCliContext = {
   jsonOutput: boolean;
   bearerToken?: string;
   gatewayBaseUrl?: string;
+  gatewayHeaders?: Record<string, string>;
 };
 
 type GatewayAuthContext = Pick<
   ToolCliContext,
-  "bearerToken" | "gatewayBaseUrl"
+  "bearerToken" | "gatewayBaseUrl" | "gatewayHeaders"
 >;
 
 export async function runToolCommand(ctx: ToolCliContext): Promise<void> {
@@ -453,6 +454,7 @@ async function callGateway(
     headers: {
       "content-type": "application/json",
       authorization: `Bearer ${bearerToken}`,
+      ...(ctx.gatewayHeaders ?? {}),
     },
   };
   if (body !== undefined) init.body = JSON.stringify(body);