@dench.com/cli 2.4.0 → 2.5.0

package/README.md

@@ -158,10 +158,10 @@ Do not claim the top-up succeeded until Stripe returns success or
 List connected apps:
 
 ```bash
-dench apps --json
+dench integrations --json
 ```
 
-`dench apps` is an alias for `dench tool status` with no toolkit.
+`dench integrations` is an alias for `dench tool status` with no toolkit.
 
 Other tool commands:
 
@@ -192,7 +192,7 @@ Do not repeat OTP codes, security codes, passwords, tokens, API keys, or secrets
 from email bodies. Non-JSON `tool run` display redacts likely sensitive codes;
 `--json` preserves the raw provider response for cases that need it.
 
-Run `dench tool --help` or `dench apps --help` for command help.
+Run `dench tool --help` or `dench integrations --help` for command help.
 
 For staging:
 

package/crm.ts

@@ -437,6 +437,21 @@ async function callMutation(
   }
 }
 
+async function callAction(
+  ctx: CrmCliContext,
+  fn: Parameters<ConvexHttpClient["action"]>[0],
+  args: Record<string, unknown> = {},
+): Promise<unknown> {
+  try {
+    return await ctx.convex.action(fn, {
+      ...args,
+      ...(ctx.sessionToken ? { sessionToken: ctx.sessionToken } : {}),
+    } as never);
+  } catch (error) {
+    throw normalizeRpcError(error);
+  }
+}
+
 async function suppressForwardedConvexLogs<T>(
   fn: () => Promise<T>,
 ): Promise<T> {
@@ -613,9 +628,16 @@ const api = {
   },
   actions: {
     list: makeFunctionReference<"query">("functions/crm/actions:list"),
+    run: makeFunctionReference<"action">("functions/crm/actions:run"),
     startActionRun: makeFunctionReference<"mutation">(
       "functions/crm/actions:startActionRun",
     ),
+    define: makeFunctionReference<"mutation">(
+      "functions/crm/actions:defineAction",
+    ),
+    remove: makeFunctionReference<"mutation">(
+      "functions/crm/actions:deleteAction",
+    ),
   },
   members: {
     list: makeFunctionReference<"query">("functions/crm/members:list"),
@@ -770,10 +792,7 @@ async function runTemplatesCommand(ctx: CrmCliContext): Promise<void> {
     case "install": {
       const templateId = shift(ctx.args, "template id");
       assertNoUnknownFlags(ctx.args, "crm templates install");
-      out(
-        ctx,
-        await callMutation(ctx, api.templates.install, { templateId }),
-      );
+      out(ctx, await callMutation(ctx, api.templates.install, { templateId }));
       return;
     }
     case "remove-sample-data": {
@@ -1493,7 +1512,9 @@ async function runHistoryCommand(ctx: CrmCliContext): Promise<void> {
       entryId,
       includeSystem,
       paginationOpts: {
-        numItems: Number.isFinite(limit) ? Math.min(Math.max(limit, 1), 100) : 50,
+        numItems: Number.isFinite(limit)
+          ? Math.min(Math.max(limit, 1), 100)
+          : 50,
         cursor: cursor ?? null,
       },
     }),
@@ -1771,9 +1792,88 @@ async function runActionsCommand(ctx: CrmCliContext): Promise<void> {
       return;
     }
     case "run": {
-      throw new CrmCliError(
-        "dench crm actions run has been removed. Start a normal agent with `dench agent new --follow` and ask it to perform the CRM action.",
+      const objectName = shift(ctx.args, "object name");
+      const fieldId = shift(ctx.args, "field id");
+      const actionId = shift(ctx.args, "action id");
+      const entryIds = ctx.args.filter((a) => !a.startsWith("--"));
+      if (entryIds.length === 0) {
+        throw new CrmCliError("Provide at least one entry id");
+      }
+      out(
+        ctx,
+        await callAction(ctx, api.actions.run, {
+          objectName,
+          fieldId: fieldId as any,
+          actionId,
+          entryIds: entryIds as any,
+        }),
       );
+      return;
+    }
+    case "create":
+    case "edit": {
+      const objectName = shift(ctx.args, "object name");
+      const fieldName = shift(ctx.args, "field name");
+      const actionId =
+        verb === "edit"
+          ? shift(ctx.args, "action id")
+          : getFlag(ctx.args, "--id");
+      const label = getFlag(ctx.args, "--label");
+      const recipeRaw = getFlag(ctx.args, "--recipe");
+      const script = getFlag(ctx.args, "--script");
+      const scriptPath = getFlag(ctx.args, "--script-path");
+      const url = getFlag(ctx.args, "--url");
+      const variant = getFlag(ctx.args, "--variant");
+      const icon = getFlag(ctx.args, "--icon");
+      const confirmMessage = getFlag(ctx.args, "--confirm");
+      assertNoUnknownFlags(ctx.args, `crm actions ${verb}`);
+      if (verb === "create" && !label) {
+        throw new CrmCliError("dench crm actions create requires --label");
+      }
+      const recipe = recipeRaw
+        ? (parseJson(recipeRaw) as unknown[] | undefined)
+        : undefined;
+      out(
+        ctx,
+        await callMutation(ctx, api.actions.define, {
+          objectName,
+          fieldName,
+          ...(actionId ? { actionId } : {}),
+          ...(label ? { label } : {}),
+          ...(recipe ? { recipe } : {}),
+          ...(script ? { script } : {}),
+          ...(scriptPath ? { scriptPath } : {}),
+          ...(url ? { url } : {}),
+          ...(variant ? { variant } : {}),
+          ...(icon ? { icon } : {}),
+          ...(confirmMessage ? { confirmMessage } : {}),
+        }),
+      );
+      return;
+    }
+    case "delete": {
+      const objectName = shift(ctx.args, "object name");
+      const actionId = shift(ctx.args, "action id");
+      const fieldName = getFlag(ctx.args, "--field");
+      const fieldId = getFlag(ctx.args, "--field-id");
+      const deleteFieldIfEmpty = hasFlag(ctx.args, "--delete-field-if-empty");
+      assertNoUnknownFlags(ctx.args, "crm actions delete");
+      if (!fieldName && !fieldId) {
+        throw new CrmCliError(
+          "dench crm actions delete needs --field <name> or --field-id <id>",
+        );
+      }
+      out(
+        ctx,
+        await callMutation(ctx, api.actions.remove, {
+          objectName,
+          actionId,
+          ...(fieldName ? { fieldName } : {}),
+          ...(fieldId ? { fieldId: fieldId as never } : {}),
+          ...(deleteFieldIfEmpty ? { deleteFieldIfEmpty: true } : {}),
+        }),
+      );
+      return;
     }
     default:
       throw new CrmCliError(`Unknown crm actions verb: ${verb ?? "<none>"}`);
@@ -3048,9 +3148,30 @@ Automations (deterministic rules, fire inside entry writes):
   dench crm automations enable <automationId>
   dench crm automations disable <automationId>
 
-Actions:
+Actions (buttons on an \`action\`-typed field; author + run from CLI/API/agent):
   dench crm actions list <entryId>
-  dench crm actions run <actionId> --field-id <id> --entry-id <id>
+  dench crm actions run <object> <fieldId> <actionId> <entryId> [<entryId> ...]
+  dench crm actions create <object> <fieldName> --label "Mark Won" \\
+        [--recipe '<json steps>'] [--script '<js>'] [--script-path <path>] \\
+        [--url '<link>'] \\
+        [--variant primary|destructive|success|warning] [--icon <name>] \\
+        [--confirm "Are you sure?"] [--id <actionId>]
+      <fieldName> is the column header — give it a clear custom name (e.g.
+      "Quick actions", "Outreach"), not just "Actions". One column can hold
+      several buttons: reuse the same <fieldName> to add more.
+      Creates the \`action\` field if missing. A button is one kind:
+      --recipe (Tier-A, runs inline), --script/--script-path (Tier-B, spawns a
+      Dench agent), or --url (a link — opens a workspace deep link or external
+      URL). --recipe is a JSON array of steps, e.g.
+      '[{"op":"update_entry","assignments":[{"field":"Status","value":{"from":"static","value":"Won"}}]}]'
+      --url supports {id}, {object}, and {Field Name} tokens, e.g.
+      --url '/?path=deal&entry=deal:{id}' (open this record) or
+      --url 'https://app.stripe.com/customers/{Stripe ID}' (external). See
+      references/NAVIGATION.md for internal deep-link paths.
+      Pass --url WITH --recipe for a "run-then-open" dynamic link: the recipe
+      runs first, then the URL is resolved against the updated row and opened.
+  dench crm actions edit <object> <fieldName> <actionId> [--label ...] [--recipe ...] [...same flags]
+  dench crm actions delete <object> <actionId> --field <fieldName> | --field-id <id> [--delete-field-if-empty]
 
 Object names: commands take the canonical object name (singular lowercase,
 e.g. people, company, prospect). Display labels shown in the UI (a template

package/dench.ts

@@ -795,11 +795,11 @@ Notes:
 `);
 }
 
-function appsHelp() {
-  console.log(`Dench apps
+function integrationsHelp() {
+  console.log(`Dench integrations
 
 Usage:
-  dench apps [--json]
+  dench integrations [--json]
 
 Lists all external apps connected to this organization (Slack, Gmail,
 GitHub, etc.). Authenticates with the active \`dench signin\` agent
@@ -3759,8 +3759,11 @@ async function main() {
     return;
   }
 
-  if (command === "apps" && (subcommand === "help" || hasFlag("--help"))) {
-    appsHelp();
+  if (
+    command === "integrations" &&
+    (subcommand === "help" || hasFlag("--help"))
+  ) {
+    integrationsHelp();
     return;
   }
 
@@ -4046,9 +4049,14 @@ async function main() {
     return;
   }
 
-  if (command === "apps") {
+  // `dench integrations` — Composio connected apps (alias for `dench tool
+  // status`). Composio tool search/run/connect stay under `dench tool`.
+  if (command === "integrations") {
     const runtime = await getRuntime();
-    const gatewayAuth = await resolveGatewayCommandAuth(runtime, "dench apps");
+    const gatewayAuth = await resolveGatewayCommandAuth(
+      runtime,
+      "dench integrations",
+    );
     await runToolCommand({
       args: ["status"],
       jsonOutput: json,
@@ -4059,6 +4067,33 @@ async function main() {
     return;
   }
 
+  // `dench apps` — the App Store (create / install / publish / list …).
+  if (command === "apps") {
+    const { runAppsCommand } = await import("./apps");
+    const subArgs = stripRuntimeFlags(args.slice(args.indexOf("apps") + 1));
+    if (!subArgs[0] || subArgs[0] === "help" || subArgs[0] === "--help") {
+      // biome-ignore lint/suspicious/noExplicitAny: help-only stub, no client needed
+      await runAppsCommand({ convex: {} as any, args: subArgs });
+      return;
+    }
+    const runtime = await getRuntime();
+    if (runtime.mode === "dev") {
+      await runAppsCommand({
+        convex: runtime.client,
+        args: subArgs,
+        sessionToken: encodeDevCrmSessionToken(runtime.workspaceArgs),
+      });
+      return;
+    }
+    const authedRuntime = requireAuthenticatedRuntime(runtime, "dench apps");
+    await runAppsCommand({
+      convex: authedRuntime.client,
+      args: subArgs,
+      sessionToken: authedRuntime.sessionToken,
+    });
+    return;
+  }
+
   if (command === "tool") {
     const subArgs = stripRuntimeFlags(args.slice(args.indexOf("tool") + 1));
     const filteredSubArgs = subArgs.filter((a) => a !== "--json");

package/fs-daemon.ts

@@ -15,8 +15,10 @@
  *     `lastSyncedHash`, we download from Convex Storage to /workspace.
  *   • Per-path 300ms trailing debounce on uploads (batches tight write
  *     loops like editor saves).
- *   • Optimistic conflict via `expectedPreviousHash`. On 409, we fetch
- *     latest, write to `<path>.conflicted-<ts>`, surface in UI.
+ *   • Optimistic conflict via `expectedPreviousHash`. On 409, we stash the
+ *     local copy at the next free `<name> (N).<ext>` sibling (reusing an
+ *     existing sibling that already holds the same bytes), then re-pull the
+ *     latest canonical version. Surfaced in UI.
  *   • Per-path circuit breaker: if a path syncs >5 times in 10s, pause
  *     sync on that path and log loudly to stderr (the live state of
  *     active breakers is exposed via `dench fs status`).
@@ -58,7 +60,7 @@ import {
   unlink,
   writeFile,
 } from "node:fs/promises";
-import { dirname, relative } from "node:path";
+import { basename, dirname, extname, join, relative } from "node:path";
 import { ConvexClient, ConvexHttpClient } from "convex/browser";
 import { makeFunctionReference } from "convex/server";
 import { decodeInlineTextOrUndefined } from "./fs-daemon-binary";
@@ -149,6 +151,56 @@ function sha256(bytes: Uint8Array): string {
   return createHash("sha256").update(bytes).digest("hex");
 }
 
+// Stash a conflicting local copy at a sibling path, using an incrementing
+// suffix (`foo (1).txt`, `foo (2).txt`, …) instead of a timestamp so
+// repeated conflicts produce a clean, stable series rather than an
+// ever-growing pile of `.conflicted-<ts>` files. The file is written
+// locally; the daemon's normal watcher path syncs it to Convex like any
+// other file. Returns the local path written.
+//
+// Two properties keep the deterministic suffix safe:
+//   • Content-aware reuse — if a `(N)` slot already holds these exact bytes,
+//     the copy is already stashed, so we return it instead of minting yet
+//     another sibling. This is what keeps repeated conflicts on the same
+//     unsynced content from piling up (the whole point of the change), and
+//     it also means an unrelated remote `(N)` file mirrored to local disk is
+//     skipped rather than overwritten.
+//   • Atomic claim — otherwise we write with O_EXCL (`wx`), so two handlers
+//     racing for the same slot can't clobber each other; the loser gets
+//     EEXIST and advances to the next N.
+async function stashConflictCopy(args: {
+  absPath: string;
+  bytes: Uint8Array;
+  hash: string;
+}): Promise<string> {
+  const { absPath, bytes, hash } = args;
+  const dir = dirname(absPath);
+  const ext = extname(absPath);
+  const stem = basename(absPath, ext);
+  for (let i = 1; i <= 1000; i++) {
+    const candidate = join(dir, `${stem} (${i})${ext}`);
+    const existing = await readFile(candidate).catch(() => null);
+    if (existing) {
+      // Already holds our bytes → nothing to do. Different content → this
+      // slot belongs to something else, try the next one.
+      if (sha256(existing) === hash) return candidate;
+      continue;
+    }
+    try {
+      await writeFile(candidate, bytes, { flag: "wx" });
+      return candidate;
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === "EEXIST") continue;
+      throw error;
+    }
+  }
+  // Every increment up to the cap is taken — fall back to a timestamp, which
+  // is effectively unique, so we still stash the bytes somewhere.
+  const fallback = join(dir, `${stem} (${Date.now()})${ext}`);
+  await writeFile(fallback, bytes);
+  return fallback;
+}
+
 function normalizePosixWorkspacePath(input: string): string {
   let cleaned = input.replace(/\\/g, "/").replace(/\/+/g, "/");
   if (cleaned.startsWith("/workspace/")) {
@@ -772,8 +824,7 @@ async function runDaemon(daemonArgs: Args): Promise<void> {
       if (result.versionConflict) {
         // Stash the local copy in a sibling file, then re-pull the remote
         // version into the canonical path.
-        const conflicted = `${absPath}.conflicted-${Date.now()}`;
-        await writeFile(conflicted, bytes);
+        const conflicted = await stashConflictCopy({ absPath, bytes, hash });
         console.warn(
           `[dench-fs-daemon] version conflict for ${posixPath}; local copy stashed at ${conflicted}`,
         );

package/lib/api-schemas.ts

@@ -1580,10 +1580,49 @@ export const requestSchemas: Record<string, ZodTypeAny> = {
     entryId: z.string().optional(),
   }),
   "crm.actions.list": z.object({ entryId: z.string() }),
+  "crm.actions.create": z
+    .object({
+      objectName: z.string(),
+      fieldName: z.string(),
+      actionId: z.string().optional(),
+      label: z.string().optional(),
+      variant: z.string().optional(),
+      icon: z.string().optional(),
+      confirmMessage: z.string().optional(),
+      recipe: z.array(z.any()).optional(),
+      script: z.string().optional(),
+      scriptPath: z.string().optional(),
+    })
+    .passthrough(),
+  "crm.actions.update": z
+    .object({
+      actionId: z.string(),
+      objectName: z.string(),
+      fieldName: z.string(),
+      label: z.string().optional(),
+      variant: z.string().optional(),
+      icon: z.string().optional(),
+      confirmMessage: z.string().optional(),
+      recipe: z.array(z.any()).optional(),
+      script: z.string().optional(),
+      scriptPath: z.string().optional(),
+    })
+    .passthrough(),
+  "crm.actions.delete": z
+    .object({
+      actionId: z.string(),
+      objectName: z.string(),
+      fieldName: z.string().optional(),
+      fieldId: z.string().optional(),
+      deleteFieldIfEmpty: z.boolean().optional(),
+    })
+    .passthrough(),
   "crm.actions.run": z.object({
     actionId: z.string(),
+    objectName: z.string(),
     fieldId: z.string(),
-    entryId: z.string(),
+    entryIds: z.array(z.string()),
+    prompts: z.record(z.string(), z.string()).optional(),
   }),
   "crm.reports.generate": z.object({
     objectName: z.string(),
@@ -1847,7 +1886,7 @@ export const requestSchemas: Record<string, ZodTypeAny> = {
   "agentConfig.daily.show": z.object({}),
 
   // Gateway: search + images + tools
-  "apps.list": noInput,
+  "integrations.list": noInput,
   "tool.status": noInput,
   "search.web": exaSearch,
   "search.contents": exaContents,
@@ -2201,7 +2240,31 @@ export const responseSchemas: Record<string, ZodTypeAny> = {
       })
       .passthrough(),
   ),
-  "crm.actions.run": z.object({ id: z.string() }),
+  "crm.actions.create": z.object({
+    fieldId: z.string(),
+    actionId: z.string(),
+    fieldCreated: z.boolean(),
+  }),
+  "crm.actions.update": z.object({
+    fieldId: z.string(),
+    actionId: z.string(),
+    fieldCreated: z.boolean(),
+  }),
+  "crm.actions.delete": z.object({
+    ok: z.boolean(),
+    remaining: z.number(),
+    fieldDeleted: z.boolean(),
+  }),
+  "crm.actions.run": z.object({
+    results: z.array(
+      z.object({
+        entryId: z.string(),
+        status: z.enum(["success", "error"]),
+        operations: z.number().optional(),
+        error: z.string().optional(),
+      }),
+    ),
+  }),
   "crm.members.list": z.object({
     members: z.array(memberShape),
     organizationId: z.string(),
@@ -2461,7 +2524,7 @@ export const responseSchemas: Record<string, ZodTypeAny> = {
   "search.answer": exaAnswerResponse,
   "image.generate": imageEnvelope,
   "image.edit": imageEnvelope,
-  "apps.list": composioConnectionsResponse,
+  "integrations.list": composioConnectionsResponse,
   "tool.status": composioConnectionsResponse,
   "tool.connect": z
     .object({
@@ -3180,7 +3243,20 @@ export const responseExamples: Record<string, unknown> = {
       result: "Enriched 4 fields",
     },
   ],
-  "crm.actions.run": { id: "arun_02" },
+  "crm.actions.create": {
+    fieldId: "fld_actions",
+    actionId: "mark_won",
+    fieldCreated: true,
+  },
+  "crm.actions.update": {
+    fieldId: "fld_actions",
+    actionId: "mark_won",
+    fieldCreated: false,
+  },
+  "crm.actions.delete": { ok: true, remaining: 0, fieldDeleted: false },
+  "crm.actions.run": {
+    results: [{ entryId: "ent_lead99", status: "success", operations: 1 }],
+  },
   "crm.members.list": {
     members: [
       {
@@ -3695,7 +3771,7 @@ export const responseExamples: Record<string, unknown> = {
     signedUrl: "https://happy-animal-123.convex.cloud/api/storage/img124",
     sizeBytes: 198432,
   },
-  "apps.list": {
+  "integrations.list": {
     items: [
       {
         id: "ca_github01",

package/lib/command-registry.ts

@@ -1057,16 +1057,50 @@ const rawApiOperations = [
     responseSchema: anyResponse,
     backend: convex("query", "functions/crm/actions:list"),
   }),
+  op({
+    id: "crm.actions.create",
+    group: "crm",
+    summary:
+      "Create or upsert an action button on a named action column (fieldName is the column header; a column can hold multiple buttons — reuse fieldName to add more).",
+    cli: "dench crm actions create",
+    method: "POST",
+    path: "/crm/actions",
+    requestSchema: anyObject,
+    responseSchema: anyResponse,
+    backend: convex("mutation", "functions/crm/actions:defineAction"),
+  }),
+  op({
+    id: "crm.actions.update",
+    group: "crm",
+    summary: "Update an action button on a CRM field.",
+    cli: "dench crm actions edit",
+    method: "PATCH",
+    path: "/crm/actions/{actionId}",
+    requestSchema: anyObject,
+    responseSchema: anyResponse,
+    backend: convex("mutation", "functions/crm/actions:defineAction"),
+  }),
+  op({
+    id: "crm.actions.delete",
+    group: "crm",
+    summary: "Delete an action button from a CRM field.",
+    cli: "dench crm actions delete",
+    method: "DELETE",
+    path: "/crm/actions/{actionId}",
+    requestSchema: anyObject,
+    responseSchema: anyResponse,
+    backend: convex("mutation", "functions/crm/actions:deleteAction"),
+  }),
   op({
     id: "crm.actions.run",
     group: "crm",
-    summary: "Start a CRM action run.",
+    summary: "Run a CRM action on one or more entries.",
     cli: "dench crm actions run",
     method: "POST",
     path: "/crm/actions/{actionId}/runs",
     requestSchema: anyObject,
     responseSchema: anyResponse,
-    backend: convex("mutation", "functions/crm/actions:startActionRun"),
+    backend: convex("action", "functions/crm/actions:run"),
   }),
   op({
     id: "crm.members.list",
@@ -1963,16 +1997,104 @@ const rawApiOperations = [
     backend: gateway("POST", "/images/edits"),
   }),
   op({
-    id: "apps.list",
+    id: "integrations.list",
     group: "gateway",
-    summary: "List connected apps.",
-    cli: "dench apps",
+    summary: "List connected Composio integrations.",
+    cli: "dench integrations",
     method: "GET",
-    path: "/apps",
+    path: "/integrations",
     requestSchema: noBody,
     responseSchema: anyResponse,
     backend: gateway("GET", "/composio/connections"),
   }),
+  op({
+    id: "apps.list",
+    group: "apps",
+    summary: "List installed App Store apps in the workspace.",
+    cli: "dench apps list",
+    method: "GET",
+    path: "/apps",
+    requestSchema: noBody,
+    responseSchema: anyResponse,
+    backend: convex("query", "functions/appStore:listInstalled"),
+  }),
+  op({
+    id: "apps.gallery",
+    group: "apps",
+    summary: "List Discover listings — Official (Dench) + Community shelves.",
+    cli: "dench apps gallery",
+    method: "GET",
+    path: "/apps/gallery",
+    requestSchema: noBody,
+    responseSchema: anyResponse,
+    backend: convex("query", "functions/appStore:listGallery"),
+  }),
+  op({
+    id: "apps.create",
+    group: "apps",
+    summary: "Scaffold and register a new App Store app.",
+    cli: "dench apps create",
+    method: "POST",
+    path: "/apps",
+    requestSchema: anyObject,
+    responseSchema: anyResponse,
+    backend: convex("action", "functions/appStore:createApp"),
+  }),
+  op({
+    id: "apps.install",
+    group: "apps",
+    summary: "Install an App Store listing into the workspace.",
+    cli: "dench apps install",
+    method: "POST",
+    path: "/apps/install",
+    requestSchema: anyObject,
+    responseSchema: anyResponse,
+    backend: convex("action", "functions/appStore:install"),
+  }),
+  op({
+    id: "apps.publish",
+    group: "apps",
+    summary: "Publish an app's files as a versioned App Store listing.",
+    cli: "dench apps publish",
+    method: "POST",
+    path: "/apps/publish",
+    requestSchema: anyObject,
+    responseSchema: anyResponse,
+    backend: convex("action", "functions/appStore:publish"),
+  }),
+  op({
+    id: "apps.uninstall",
+    group: "apps",
+    summary: "Uninstall an app from the workspace.",
+    cli: "dench apps uninstall",
+    method: "DELETE",
+    path: "/apps/{slug}",
+    requestSchema: anyObject,
+    responseSchema: anyResponse,
+    backend: convex("mutation", "functions/appStore:uninstall"),
+  }),
+  op({
+    id: "apps.setEnabled",
+    group: "apps",
+    summary: "Enable or disable an installed app.",
+    cli: "dench apps enable",
+    method: "PATCH",
+    path: "/apps/{slug}",
+    requestSchema: anyObject,
+    responseSchema: anyResponse,
+    backend: convex("mutation", "functions/appStore:setEnabled"),
+  }),
+  op({
+    id: "apps.setPinned",
+    group: "apps",
+    summary: "Pin or unpin an installed app in the rail.",
+    cli: "dench apps pin",
+    method: "POST",
+    path: "/apps/{slug}/pin",
+    requestSchema: anyObject,
+    responseSchema: anyResponse,
+    backend: convex("mutation", "functions/appStore:setPinned"),
+  }),
   op({
     id: "tool.status",
     group: "gateway",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dench.com/cli",
-  "version": "2.4.0",
+  "version": "2.5.0",
   "description": "Dench agent workspace CLI. v2 unifies auth behind `dench signin`; the legacy `dench login` / `dench onboard` / `dench setup` / `dench what-can-i-do` / `dench register` commands now error with a redirect.",
   "type": "module",
   "bin": {