@dench.com/cli 3.6.4-staging.377 → 3.6.5-staging.384

package/README.md

@@ -465,3 +465,19 @@ Commands that need to impersonate a specific agent (`dench memory`,
 (`dench signin`) — the unified API key is org-scoped and cannot speak
 as a single agent. Those commands return a clear "agent session
 required" error in API-key mode.
+
+### Focused workspace context
+
+`dench context --instructions` reads explicit IDENTITY, RULES and TOOLS notes,
+plus document availability/revisions. It does not load business profiles,
+personal profiles or aggregate memory. Fetch only what the task needs:
+
+```sh
+dench context --sections organisation,user,memory --json
+```
+
+Section names are `identity`, `organisation`, `user`, `memory`, `rules`, and
+`tools`. Multiple names use one query. The existing `organisation show`,
+`user show`, and `mem show` commands use the same saved documents; reading never
+fills profiles or writes memory. Personal USER context is unavailable to shared
+channel sessions. `dench context --json` keeps its existing workspace overview.

package/agent-config.ts

@@ -215,22 +215,16 @@ async function handleSimpleMagicFile(
 ): Promise<void> {
   const sub = args[0];
   if (!sub || sub === "show") {
-    const config = await loadAgentConfig(ctx);
-    const value =
-      opts.field === "memoryAggregate"
-        ? config.agentConfig.memoryAggregate
-        : opts.field === "toolsNotes"
-          ? config.agentConfig.toolsNotes
-          : opts.field === "identity"
-            ? config.agentConfig.identity
-            : opts.field === "organisation"
-              ? config.agentConfig.organisation
-              : null;
-    if (opts.perMember) {
-      out(ctx, config.userProfile?.content ?? "(empty)");
-      return;
-    }
-    out(ctx, value?.content ?? "(empty)");
+    const context = (await runQuery(
+      ctx,
+      makeFunctionReference<"query">("functions/agentConfig:workspaceContext"),
+      { sections: [opts.label] },
+    )) as { documents: Array<{ name: string; content?: string }> };
+    out(
+      ctx,
+      context.documents.find((document) => document.name === opts.label)
+        ?.content || "(empty)",
+    );
     return;
   }
   if (sub === "edit" || sub === "set") {

package/app-sdk.d.ts

@@ -497,10 +497,17 @@ export interface ApiRequests {
     organizationId?: string;
     newOrganizationName?: string;
   };
+  /** Read selected scoped workspace documents and a compact context index without writes. — `dench context --sections` — GET /api/v1/context/sections */
+  "workspace.context.sections": {
+    organizationId?: string;
+    sections?: Array<"identity" | "organisation" | "user" | "memory" | "rules" | "tools">;
+  };
   /** Return the current Dench workspace context for the bearer. — `dench context` — GET /api/v1/context */
   "workspace.context": Record<string, unknown>;
   /** Return the current workspace's standing instructions for external agents. — `dench context --instructions` — GET /api/v1/context/instructions */
-  "workspace.instructions": Record<string, unknown>;
+  "workspace.instructions": {
+    organizationId?: string;
+  };
   /** Return workspace and agent status. — `dench status` — GET /api/v1/status */
   "workspace.status": Record<string, unknown>;
   /** List agents visible in the workspace status payload. — `dench agents` — GET /api/v1/agents */
@@ -2172,6 +2179,116 @@ export interface ApiRequests {
     /** Identity id, sender email, or domain (deletes every sender on the domain). Permanent: re-adding requires re-verification. */
     identity: string;
   };
+  /** Create an editable Dench email draft and synchronize its selected native mailbox asynchronously. Use a stable requestId for retries. — `dench email draft create` — POST /api/v1/email/drafts */
+  "email.drafts.create": {
+    organizationId?: string;
+    threadId?: string;
+    mailbox?: string;
+    requestId: string;
+    to?: {
+      email: string;
+      name?: string;
+    }[];
+    cc?: {
+      email: string;
+      name?: string;
+    }[];
+    bcc?: {
+      email: string;
+      name?: string;
+    }[];
+    subject?: string;
+    htmlBody?: string;
+    textBody?: string;
+    attachments?: {
+      storageId: string;
+      name: string;
+      contentType: string;
+      size: number;
+    }[];
+  };
+  /** Read an email draft, eligible senders and provider sync status. — `dench email draft show` — GET /api/v1/email/drafts/{draftId} */
+  "email.drafts.get": {
+    draftId: string;
+  };
+  /** List native mailboxes this caller may use. — `dench email draft senders` — GET /api/v1/email/drafts/senders */
+  "email.drafts.senders": {
+    organizationId?: string;
+  };
+  /** Save draft content using expectedRevision; sender changes require a new draft after provider binding. — `dench email draft update` — PATCH /api/v1/email/drafts/{draftId} */
+  "email.drafts.update": {
+    draftId: string;
+    expectedRevision: number;
+    patch: {
+      mailboxAccountId?: string;
+      to?: {
+        email: string;
+        name?: string;
+      }[];
+      cc?: {
+        email: string;
+        name?: string;
+      }[];
+      bcc?: {
+        email: string;
+        name?: string;
+      }[];
+      subject?: string;
+      htmlBody?: string;
+      textBody?: string;
+      attachments?: {
+        storageId: string;
+        name: string;
+        contentType: string;
+        size: number;
+      }[];
+    };
+  };
+  /** Send the current Dench draft revision through its native mailbox. Repeated requests share a durable receipt. — `dench email draft send` — POST /api/v1/email/drafts/{draftId}/send */
+  "email.drafts.send": {
+    draftId: string;
+    expectedRevision: number;
+    requestId?: string;
+  };
+  /** Upload attachment bytes authorized against this draft before adding its storage reference. — `dench email draft attach` — POST /api/v1/email/drafts/{draftId}/attachments */
+  "email.drafts.upload": {
+    draftId: string;
+    name: string;
+    contentType: string;
+    contentBase64: string;
+  };
+  /** Load the selected mailbox signature for explicit visible insertion. — `dench email draft signature` — GET /api/v1/email/drafts/{draftId}/signature */
+  "email.drafts.signature": {
+    draftId: string;
+  };
+  /** Send through a native Gmail or Outlook mailbox with a durable request receipt. Only use for an explicit send request. — `dench email send --mailbox` — POST /api/v1/email/native/send */
+  "email.native.send": {
+    organizationId?: string;
+    threadId?: string;
+    mailbox?: string;
+    requestId: string;
+    to?: {
+      email: string;
+      name?: string;
+    }[];
+    cc?: {
+      email: string;
+      name?: string;
+    }[];
+    bcc?: {
+      email: string;
+      name?: string;
+    }[];
+    subject?: string;
+    htmlBody?: string;
+    textBody?: string;
+    attachments?: {
+      storageId: string;
+      name: string;
+      contentType: string;
+      size: number;
+    }[];
+  };
   /** Send one raw email (no campaign): to/cc/bcc, custom from-name and reply-to, optional reply threading via replyToMessageId. — `dench email send` — POST /api/v1/email/send */
   "email.send": {
     /** Verified sender mailbox. */
@@ -3017,17 +3134,25 @@ export interface ApiRequests {
   /** Create a tool OAuth connection link. Slack is in-house, never a third-party connection: for toolkit slack the CLI prints the first-party install URL (/api/slack/install?slug=<workspace>, org admin) instead of calling this endpoint. — `dench tool connect` — POST /api/v1/tools/connections */
   "tool.connect": {
     /** Toolkit slug, e.g. github, gmail, stripe. */
-    toolkit: string;
+    toolkit?: string;
+    toolkit_slug?: string;
     /** Optional OAuth callback URL. */
     callback_url?: string;
+    /** Native OAuth return path within the workspace. */
+    returnTo?: string;
   };
   /** Search for external tool actions. — `dench tool search` — POST /api/v1/tools/search */
   "tool.search": {
-    queries: {
+    queries?: {
       /** Natural-language use case. */
       use_case: string;
       known_fields?: string;
     }[];
+    query?: string;
+    toolkit?: string;
+    toolkit_slug?: string;
+    limit?: number;
+    important?: boolean;
     session?: {
       id?: string;
       generate_id?: boolean;
@@ -3045,6 +3170,8 @@ export interface ApiRequests {
     /** Tool arguments object. */
     arguments?: Record<string, unknown>;
     account?: string;
+    connected_account_id?: string;
+    approvalId?: string;
   };
   /** Disconnect an external tool account. — `dench tool disconnect` — DELETE /api/v1/tools/connections/{connectionId} */
   "tool.disconnect": {
@@ -3374,6 +3501,7 @@ export interface ApiResponses {
       sessionExpiresAt?: number;
     };
   };
+  "workspace.context.sections": Record<string, unknown>;
   "workspace.context": {
     workspace: {
       id: string;
@@ -5319,6 +5447,54 @@ export interface ApiResponses {
       disabled: boolean;
     }[];
   };
+  "email.drafts.create": {
+    ok: boolean;
+    kind: "email";
+    draftId: string;
+    syncStatus: string;
+    revision: number;
+    [key: string]: unknown;
+  };
+  "email.drafts.get": {
+    ok: boolean;
+    kind: "email";
+    draftId: string;
+    syncStatus: string;
+    revision: number;
+    [key: string]: unknown;
+  };
+  "email.drafts.senders": Record<string, unknown>[];
+  "email.drafts.update": {
+    ok: boolean;
+    kind: "email";
+    draftId: string;
+    syncStatus: string;
+    revision: number;
+    [key: string]: unknown;
+  };
+  "email.drafts.send": {
+    ok: boolean;
+    kind: "email";
+    draftId: string;
+    syncStatus: string;
+    revision: number;
+    [key: string]: unknown;
+  };
+  "email.drafts.upload": {
+    storageId: string;
+    name: string;
+    contentType: string;
+    size: number;
+  };
+  "email.drafts.signature": Record<string, unknown>;
+  "email.native.send": {
+    ok: boolean;
+    kind: "email";
+    draftId: string;
+    syncStatus: string;
+    revision: number;
+    [key: string]: unknown;
+  };
   "email.send": {
     ok: boolean;
     /** Dench message id for `dench email message status`. */
@@ -6567,6 +6743,14 @@ export interface ApiResponses {
     /** OAuth URL the user opens to finish connecting. */
     redirect_url?: string;
     connection_id?: string;
+    redirectUrl?: string;
+    link?: string;
+    artifact?: {
+      kind: "connect";
+      data: {
+        toolkit: string;
+      };
+    };
     [key: string]: unknown;
   };
   "tool.search": {
@@ -6592,10 +6776,13 @@ export interface ApiResponses {
     /** Tool slug -> schema with gateway-added execution_ref for tool.run. */
     tool_schemas?: Record<string, Record<string, unknown>>;
     /** Tool-router session; reuse session.id for follow-up calls. */
-    session: {
+    session?: {
       id: string;
       [key: string]: unknown;
     };
+    items?: Record<string, unknown>[];
+    nativeAvailable?: boolean;
+    available?: boolean;
     execution_ref_version?: number;
     [key: string]: unknown;
   };
@@ -7810,6 +7997,22 @@ export type DenchApiTree = {
       /** Submit a campaign for approval or sending. (`dench email campaign submit`) */
       submit(args: Req<"email.campaign.submit">): Promise<Res<"email.campaign.submit">>;
     };
+    drafts: {
+      /** Create an editable Dench email draft and synchronize its selected native mailbox asynchronously. Use a stable requestId for retries. (`dench email draft create`) */
+      create(args: Req<"email.drafts.create">): Promise<Res<"email.drafts.create">>;
+      /** Read an email draft, eligible senders and provider sync status. (`dench email draft show`) */
+      get(args: Req<"email.drafts.get">): Promise<Res<"email.drafts.get">>;
+      /** Send the current Dench draft revision through its native mailbox. Repeated requests share a durable receipt. (`dench email draft send`) */
+      send(args: Req<"email.drafts.send">): Promise<Res<"email.drafts.send">>;
+      /** List native mailboxes this caller may use. (`dench email draft senders`) */
+      senders(args?: Req<"email.drafts.senders">): Promise<Res<"email.drafts.senders">>;
+      /** Load the selected mailbox signature for explicit visible insertion. (`dench email draft signature`) */
+      signature(args: Req<"email.drafts.signature">): Promise<Res<"email.drafts.signature">>;
+      /** Save draft content using expectedRevision; sender changes require a new draft after provider binding. (`dench email draft update`) */
+      update(args: Req<"email.drafts.update">): Promise<Res<"email.drafts.update">>;
+      /** Upload attachment bytes authorized against this draft before adding its storage reference. (`dench email draft attach`) */
+      upload(args: Req<"email.drafts.upload">): Promise<Res<"email.drafts.upload">>;
+    };
     identity: {
       /** Begin the full Dench sender verification flow for a sending identity. (`dench email identity verify`) */
       beginVerification(args: Req<"email.identity.beginVerification">): Promise<Res<"email.identity.beginVerification">>;
@@ -7838,6 +8041,10 @@ export type DenchApiTree = {
       /** List recent raw email messages for the workspace. (`dench email message list`) */
       list(args?: Req<"email.message.list">): Promise<Res<"email.message.list">>;
     };
+    native: {
+      /** Send through a native Gmail or Outlook mailbox with a durable request receipt. Only use for an explicit send request. (`dench email send --mailbox`) */
+      send(args: Req<"email.native.send">): Promise<Res<"email.native.send">>;
+    };
     /** Send one raw email (no campaign): to/cc/bcc, custom from-name and reply-to, optional reply threading via replyToMessageId. (`dench email send`) */
     send(args: Req<"email.send">): Promise<Res<"email.send">>;
     sequence: {
@@ -8126,8 +8333,13 @@ export type DenchApiTree = {
       /** List artifacts for the authenticated workspace. (`dench artifacts`) */
       list(args?: Req<"workspace.artifacts.list">): Promise<Res<"workspace.artifacts.list">>;
     };
-    /** Return the current Dench workspace context for the bearer. (`dench context`) */
-    context(args?: Req<"workspace.context">): Promise<Res<"workspace.context">>;
+    context: {
+      /** Return the current Dench workspace context for the bearer. (`dench context`) */
+      (args?: Req<"workspace.context">): Promise<Res<"workspace.context">>;
+      $call(args?: Req<"workspace.context">): Promise<Res<"workspace.context">>;
+      /** Read selected scoped workspace documents and a compact context index without writes. (`dench context --sections`) */
+      sections(args?: Req<"workspace.context.sections">): Promise<Res<"workspace.context.sections">>;
+    };
     /** Return the current workspace's standing instructions for external agents. (`dench context --instructions`) */
     instructions(args?: Req<"workspace.instructions">): Promise<Res<"workspace.instructions">>;
     /** Return workspace and agent status. (`dench status`) */
@@ -8555,6 +8767,22 @@ export interface DenchCampaigns {
 }
 
 export interface DenchEmail {
+  /** Create a native mailbox draft with a stable request receipt. Permission: `email:write`. Wraps `email.drafts.create`. */
+  createDraft(draft: Req<"email.drafts.create">): Promise<Res<"email.drafts.create">>;
+  /** Read a native email draft and sync status. Permission: `email:read`. Wraps `email.drafts.get`. */
+  draft(draftId: string): Promise<Res<"email.drafts.get">>;
+  /** Save the next email draft revision. Permission: `email:write`. Wraps `email.drafts.update`. */
+  updateDraft(input: Req<"email.drafts.update">): Promise<Res<"email.drafts.update">>;
+  /** Send the frozen native email draft revision. Permission: `email:write`. Wraps `email.drafts.send`. */
+  sendDraft(input: Req<"email.drafts.send">): Promise<Res<"email.drafts.send">>;
+  /** List eligible native mailboxes. Permission: `email:read`. Wraps `email.drafts.senders`. */
+  senders(opts?: Req<"email.drafts.senders">): Promise<Res<"email.drafts.senders">>;
+  /** Upload attachment bytes for a native draft. Permission: `email:write`. Wraps `email.drafts.upload`. */
+  uploadAttachment(input: Req<"email.drafts.upload">): Promise<Res<"email.drafts.upload">>;
+  /** Load the selected mailbox signature for visible insertion. Permission: `email:read`. Wraps `email.drafts.signature`. */
+  signature(draftId: string): Promise<Res<"email.drafts.signature">>;
+  /** Explicitly send through a native Gmail or Outlook mailbox. Permission: `email:write`. Wraps `email.native.send`. */
+  sendFromMailbox(message: Req<"email.native.send">): Promise<Res<"email.native.send">>;
   /** Send one email from a verified identity. Permission: `email:write`. Wraps `email.send`. */
   send(message: Req<"email.send">): Promise<Res<"email.send">>;
   /** Sent messages. Permission: `email:read`. Wraps `email.message.list`. */

package/dench.ts

@@ -32,7 +32,6 @@ import { cliVersion } from "./lib/cli-version";
 import { denchConfigDirectory } from "./lib/config-path.mjs";
 import { resolveOrganizationBySelector } from "./lib/organizationSelector";
 import { backendErrorText } from "./lib/public-error";
-import { normalizeUnipileToolkitSlug } from "./lib/unipile-toolkits";
 import { formatApprovalOpenMessage, openUrl } from "./openUrl";
 import {
   explicitSessionKeyInput,
@@ -176,6 +175,9 @@ const api = {
       ),
     },
     agentConfig: {
+      workspaceContext: makeFunctionReference<"query">(
+        "functions/agentConfig:workspaceContext",
+      ),
       workspaceInstructions: makeFunctionReference<"query">(
         "functions/agentConfig:workspaceInstructions",
       ),
@@ -465,6 +467,7 @@ Usage:
   dench logout [session-key-or-workspace-slug] [--session <key-or-scope>] [--host <host>] [--all] [--json]
   dench backend [show|set|clear] [<production|staging|local|<url>>] [--json]
   dench context [--instructions] [--json]
+  dench context --sections organisation,user,memory [--json]
   dench instructions [--json]
   dench status [--mine|--self] [--json]
   dench memory search "query" [--limit 8] [--json]
@@ -742,6 +745,7 @@ function contextHelp() {
 
 Usage:
   dench context [--instructions] [--json]
+  dench context --sections organisation,user,memory [--json]
   dench instructions [--json]
 
 Shows the current workspace, current agent, assigned tasks, pending approvals
@@ -3222,19 +3226,22 @@ function formatContext(context: JsonRecord) {
 
 async function buildWorkspaceInstructionsContext(
   runtime: Awaited<ReturnType<typeof getRuntime>>,
+  sections?: string[],
 ) {
   if (runtime.mode === "dev") {
     return (await runtime.client.query(
       api.functions.agentConfig.devWorkspaceInstructions,
-      runtime.workspaceArgs,
+      { ...runtime.workspaceArgs, ...(sections ? { sections } : {}) },
     )) as JsonRecord;
   }
   if (runtime.mode !== "session" && runtime.mode !== "apiKey") {
     throw loginRequiredError("dench context --instructions");
   }
   return (await runtime.client.query(
-    api.functions.agentConfig.workspaceInstructions,
-    { sessionToken: runtime.sessionToken },
+    sections
+      ? api.functions.agentConfig.workspaceContext
+      : api.functions.agentConfig.workspaceInstructions,
+    { sessionToken: runtime.sessionToken, ...(sections ? { sections } : {}) },
   )) as JsonRecord;
 }
 
@@ -4801,7 +4808,14 @@ async function main() {
       | Awaited<ReturnType<typeof resolveGatewayCommandAuth>>
       | undefined;
     try {
-      gatewayAuth = await resolveGatewayCommandAuth(runtime, "dench email");
+      if (
+        subArgs[0] !== "draft" &&
+        !subArgs.some(
+          (arg) => arg === "--mailbox" || arg.startsWith("--mailbox="),
+        )
+      ) {
+        gatewayAuth = await resolveGatewayCommandAuth(runtime, "dench email");
+      }
     } catch {
       gatewayAuth = undefined;
     }
@@ -4882,35 +4896,16 @@ async function main() {
       if (argsIndex !== -1) parseJson(filteredSubArgs[argsIndex + 1]);
     }
     const runtime = await getRuntime();
-    const isSlackConnect =
-      sub === "connect" &&
-      ["slack", "slackbot"].includes(
-        (filteredSubArgs[1] ?? "").trim().toLowerCase(),
-      );
-    const isUnipileCommand =
-      (sub === "connect" || sub === "status") &&
-      normalizeUnipileToolkitSlug(filteredSubArgs[1] ?? "") !== null;
-    let gatewayAuth: GatewayCommandAuth | null = null;
-    let gatewayAuthError: string | undefined;
-    if (!isSlackConnect && !isUnipileCommand) {
-      try {
-        gatewayAuth = await resolveGatewayCommandAuth(runtime, "dench tool");
-      } catch (error) {
-        if (sub !== "status") throw error;
-        gatewayAuthError = gatewayAuthFailureReason(error);
-      }
-    }
     await runToolCommand({
       args: filteredSubArgs,
       jsonOutput: json,
-      gatewayAuthError,
-      ...(gatewayAuth
-        ? {
-            bearerToken: gatewayAuth.bearerToken,
-            gatewayBaseUrl: gatewayAuth.gatewayBaseUrl,
-            gatewayHeaders: gatewayAuth.gatewayHeaders,
-          }
-        : {}),
+      resolveGatewayAuth: async () => {
+        try {
+          return await resolveGatewayCommandAuth(runtime, "dench tool");
+        } catch (error) {
+          return { gatewayAuthError: gatewayAuthFailureReason(error) };
+        }
+      },
       ...unipileQueryAuth(runtime),
       ...(runtime.mode !== "dev"
         ? {
@@ -5261,6 +5256,44 @@ async function main() {
     return;
   }
 
+  if (command === "context" && args.includes("--sections")) {
+    const raw = args[args.indexOf("--sections") + 1];
+    const sections = raw
+      ?.split(",")
+      .map((section) => section.trim().toLowerCase())
+      .filter(Boolean);
+    const allowed = [
+      "identity",
+      "organisation",
+      "user",
+      "memory",
+      "rules",
+      "tools",
+    ];
+    if (
+      !sections?.length ||
+      sections.some((section) => !allowed.includes(section))
+    )
+      throw new Error(
+        `Usage: dench context --sections ${allowed.join(",")} [--json]`,
+      );
+    const context = await buildWorkspaceInstructionsContext(runtime, [
+      ...new Set(sections),
+    ]);
+    const documents = Array.isArray(context.documents)
+      ? (context.documents as Array<{ name: string; content?: string }>)
+      : [];
+    print(
+      json
+        ? context
+        : documents
+            .filter((doc) => doc.content !== undefined)
+            .map((doc) => `## ${doc.name}\n${doc.content || "(empty)"}`)
+            .join("\n\n"),
+    );
+    return;
+  }
+
   if (command === "context" && args.includes("--instructions")) {
     const instructions = await buildWorkspaceInstructionsContext(runtime);
     print(