@dench.com/cli 2.1.4 → 2.1.5

package/dench.ts

@@ -2351,6 +2351,7 @@ async function getRuntime() {
       return {
         mode: "session" as const,
         host: resolveApiHost(host),
+        convexUrl: stored.session.convexUrl,
         client: createCliConvexClient(stored.session.convexUrl),
         sessionToken: stored.session.sessionToken,
         organization: stored.session.organization,
@@ -2397,6 +2398,7 @@ async function getRuntime() {
       return {
         mode: "apiKey" as const,
         host: apiHost,
+        convexUrl: sandboxConvexUrl,
         client: createCliConvexClient(sandboxConvexUrl),
         sessionToken: apiKey,
         organization: sandboxOrganization,
@@ -2412,6 +2414,7 @@ async function getRuntime() {
       return {
         mode: "session" as const,
         host: apiHost,
+        convexUrl: sandboxConvexUrl,
         client: createCliConvexClient(sandboxConvexUrl),
         sessionToken: sandboxAgentToken,
         organization: sandboxOrganization,
@@ -2981,13 +2984,44 @@ function suggestedWorkFromArtifacts(artifacts: JsonRecord[]) {
   );
 }
 
+/**
+ * The fs daemon authenticates purely from `CONVEX_URL` + `DENCH_API_KEY`
+ * env vars (sandboxes bake them in). Local shells running off an OAuth
+ * agent session have neither — resolve the active session and inject
+ * its convexUrl + `dch_agent_*` token. The server-side files functions
+ * accept the agent-session token in the same `apiKey` slot (prefix
+ * dispatch, like `requireCrmAccess`), so the daemon works unchanged.
+ */
+async function resolveFsDaemonEnv(): Promise<NodeJS.ProcessEnv> {
+  if (process.env.CONVEX_URL?.trim() && process.env.DENCH_API_KEY?.trim()) {
+    return process.env;
+  }
+  try {
+    const runtime = await getRuntime();
+    if (runtime.mode === "session" || runtime.mode === "apiKey") {
+      return {
+        ...process.env,
+        CONVEX_URL: process.env.CONVEX_URL?.trim() || runtime.convexUrl,
+        DENCH_API_KEY:
+          process.env.DENCH_API_KEY?.trim() || runtime.sessionToken,
+      };
+    }
+  } catch {
+    // No saved session / dev env — fall through with the unmodified env;
+    // the daemon prints its own missing-credential error for subcommands
+    // that need Convex access.
+  }
+  return process.env;
+}
+
 async function runFsCommand() {
   const subArgs = args.slice(args.indexOf("fs") + 1);
   const configuredBinary = process.env.DENCH_FS_DAEMON_BIN?.trim();
   const binary = configuredBinary || "dench-fs-daemon";
+  const daemonEnv = await resolveFsDaemonEnv();
   let exitCode: number;
   try {
-    exitCode = await spawnInherited(binary, subArgs);
+    exitCode = await spawnInherited(binary, subArgs, daemonEnv);
   } catch (error) {
     if (configuredBinary || !isCommandNotFound(error)) {
       throw error;
@@ -2995,7 +3029,11 @@ async function runFsCommand() {
     const localDaemon = fileURLToPath(
       new URL("./fs-daemon.ts", import.meta.url),
     );
-    exitCode = await spawnInherited("bun", [localDaemon, ...subArgs]);
+    exitCode = await spawnInherited(
+      "bun",
+      [localDaemon, ...subArgs],
+      daemonEnv,
+    );
   }
   if (exitCode !== 0) {
     process.exitCode = exitCode;
@@ -3025,8 +3063,18 @@ async function requireFilesApiKey(
   runtime: Runtime,
   command: string,
 ): Promise<string> {
-  const auth = await resolveGatewayCommandAuth(runtime, command);
-  return auth.bearerToken;
+  // The Convex files functions accept either a unified Dench API key OR a
+  // `dch_agent_*` OAuth agent-session token in their `apiKey` arg (the
+  // server dispatches on prefix, same as `requireCrmAccess`). So the
+  // runtime's own bearer works directly — no gateway-key exchange, which
+  // used to gate OAuth sessions behind a paid workspace and an extra
+  // host round-trip.
+  if (runtime.mode === "session" || runtime.mode === "apiKey") {
+    return runtime.sessionToken;
+  }
+  const envApiKey = process.env.DENCH_API_KEY?.trim();
+  if (envApiKey) return envApiKey;
+  throw loginRequiredError(command);
 }
 
 type FileTreeRow = {
@@ -3603,11 +3651,15 @@ function sha256HexSync(bytes: Uint8Array): string {
   return createHash("sha256").update(bytes).digest("hex");
 }
 
-async function spawnInherited(binary: string, commandArgs: string[]) {
+async function spawnInherited(
+  binary: string,
+  commandArgs: string[],
+  env: NodeJS.ProcessEnv = process.env,
+) {
   return await new Promise<number>((resolve, reject) => {
     const child = spawn(binary, commandArgs, {
       stdio: "inherit",
-      env: process.env,
+      env,
     });
     child.on("error", reject);
     child.on("close", (code) => resolve(code ?? 1));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dench.com/cli",
-  "version": "2.1.4",
+  "version": "2.1.5",
   "description": "Dench agent workspace CLI. v2 unifies auth behind `dench signin`; the legacy `dench login` / `dench onboard` / `dench setup` / `dench what-can-i-do` / `dench register` commands now error with a redirect.",
   "type": "module",
   "bin": {