@dench.com/cli 2.7.2 → 2.7.3

package/dench.ts

@@ -40,6 +40,7 @@ import {
   type StoredSessionEntry,
   selectStoredSession,
   selectStoredSessionEntry,
+  usesInjectedAgentSession,
   withCurrentSessionSelection,
   withSavedSession,
 } from "./session";
@@ -2392,7 +2393,13 @@ async function getRuntime() {
   if (!hasFlag("--dev")) {
     const config = await loadConfig();
     const host = resolveHost(config, scope);
-    const stored = await getStoredSession(host, scope);
+
+    // An injected agent-session token outranks whatever `dench signin` last
+    // saved here — see `usesInjectedAgentSession` for why the API key does not
+    // get the same treatment.
+    const stored = usesInjectedAgentSession()
+      ? ({ status: "missing" } as const)
+      : await getStoredSession(host, scope);
     if (stored.status === "found") {
       return {
         mode: "session" as const,
@@ -2451,9 +2458,9 @@ async function getRuntime() {
       };
     }
 
-    // Fallback: no API key present (older sandbox images / custom setups) —
-    // use the agent-session token. Still subject to expiry, but it's the
-    // only credential available in this branch.
+    // No API key present: an older sandbox image, a custom setup, or Dench
+    // Code, which injects only this token. Still subject to expiry, but it is
+    // the only credential available in this branch.
     const sandboxAgentToken = process.env.DENCH_AGENT_SESSION_TOKEN?.trim();
     if (sandboxAgentToken && sandboxConvexUrl) {
       const apiHost = resolveApiHost(host);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dench.com/cli",
-  "version": "2.7.2",
+  "version": "2.7.3",
   "description": "Dench agent workspace CLI.",
   "type": "module",
   "bin": {

package/session.ts

@@ -208,6 +208,26 @@ export function resolveSessionScope({
   };
 }
 
+/**
+ * Whether an injected agent-session token should stand in for a saved
+ * `dench signin` session.
+ *
+ * `DENCH_AGENT_SESSION_TOKEN` names which identity to act as, so it outranks
+ * whatever was last saved on the host. Only sandboxes and Dench Code set it —
+ * nobody exports it by hand — and without this a host with any saved session
+ * silently ignores it, or fails as `session_ambiguous` when several are saved.
+ *
+ * `DENCH_API_KEY` deliberately does not qualify. People export that one
+ * manually for unrelated reasons, and quietly swapping their identity would be
+ * a surprise. Sandboxes set both and have no saved session anyway, so they
+ * keep landing on the API key, which is what they want: the key has no TTL
+ * while the agent-session token expires.
+ */
+export function usesInjectedAgentSession(env: Env = process.env) {
+  if (env.DENCH_API_KEY?.trim()) return false;
+  return Boolean(env.DENCH_AGENT_SESSION_TOKEN?.trim());
+}
+
 export function sessionConfigKey(host: string, scope: SessionScope) {
   return `${normalizeHostValue(host)}#${scope.key}`;
 }