@dench.com/cli 3.6.4-staging.377 → 3.6.6-staging.386

package/dench.ts

@@ -32,7 +32,6 @@ import { cliVersion } from "./lib/cli-version";
 import { denchConfigDirectory } from "./lib/config-path.mjs";
 import { resolveOrganizationBySelector } from "./lib/organizationSelector";
 import { backendErrorText } from "./lib/public-error";
-import { normalizeUnipileToolkitSlug } from "./lib/unipile-toolkits";
 import { formatApprovalOpenMessage, openUrl } from "./openUrl";
 import {
   explicitSessionKeyInput,
@@ -176,6 +175,9 @@ const api = {
       ),
     },
     agentConfig: {
+      workspaceContext: makeFunctionReference<"query">(
+        "functions/agentConfig:workspaceContext",
+      ),
       workspaceInstructions: makeFunctionReference<"query">(
         "functions/agentConfig:workspaceInstructions",
       ),
@@ -465,6 +467,7 @@ Usage:
   dench logout [session-key-or-workspace-slug] [--session <key-or-scope>] [--host <host>] [--all] [--json]
   dench backend [show|set|clear] [<production|staging|local|<url>>] [--json]
   dench context [--instructions] [--json]
+  dench context --sections organisation,user,memory [--json]
   dench instructions [--json]
   dench status [--mine|--self] [--json]
   dench memory search "query" [--limit 8] [--json]
@@ -742,6 +745,7 @@ function contextHelp() {
 
 Usage:
   dench context [--instructions] [--json]
+  dench context --sections organisation,user,memory [--json]
   dench instructions [--json]
 
 Shows the current workspace, current agent, assigned tasks, pending approvals
@@ -3222,19 +3226,22 @@ function formatContext(context: JsonRecord) {
 
 async function buildWorkspaceInstructionsContext(
   runtime: Awaited<ReturnType<typeof getRuntime>>,
+  sections?: string[],
 ) {
   if (runtime.mode === "dev") {
     return (await runtime.client.query(
       api.functions.agentConfig.devWorkspaceInstructions,
-      runtime.workspaceArgs,
+      { ...runtime.workspaceArgs, ...(sections ? { sections } : {}) },
     )) as JsonRecord;
   }
   if (runtime.mode !== "session" && runtime.mode !== "apiKey") {
     throw loginRequiredError("dench context --instructions");
   }
   return (await runtime.client.query(
-    api.functions.agentConfig.workspaceInstructions,
-    { sessionToken: runtime.sessionToken },
+    sections
+      ? api.functions.agentConfig.workspaceContext
+      : api.functions.agentConfig.workspaceInstructions,
+    { sessionToken: runtime.sessionToken, ...(sections ? { sections } : {}) },
   )) as JsonRecord;
 }
 
@@ -4452,18 +4459,22 @@ async function main() {
   if (command === "crm") {
     const subArgs = stripRuntimeFlags(args.slice(args.indexOf("crm") + 1));
     const sub = subArgs[0];
+    const { runCrmCommand, isCrmReadHelpRequest } = await import("./crm");
     // Short-circuit help so users don't need a session to read the
     // surface. The crm dispatcher's own help resolves --json + the
     // subcommand list inline.
-    if (!sub || sub === "help" || sub === "--help") {
-      const { runCrmCommand } = await import("./crm");
+    if (
+      !sub ||
+      sub === "help" ||
+      sub === "--help" ||
+      isCrmReadHelpRequest(subArgs)
+    ) {
       // runCrmCommand only needs `convex` for actual queries; help
       // doesn't touch it. Pass a minimal stub.
       // biome-ignore lint/suspicious/noExplicitAny: harmless help-only stub
       await runCrmCommand({ convex: {} as any, args: subArgs });
       return;
     }
-    const { runCrmCommand } = await import("./crm");
     const runtime = await getRuntime();
     // CRM is org-scoped — accept either an agent session token
     // (`dch_agent_*` from `dench signin`) or a unified Dench API key
@@ -4801,7 +4812,14 @@ async function main() {
       | Awaited<ReturnType<typeof resolveGatewayCommandAuth>>
       | undefined;
     try {
-      gatewayAuth = await resolveGatewayCommandAuth(runtime, "dench email");
+      if (
+        subArgs[0] !== "draft" &&
+        !subArgs.some(
+          (arg) => arg === "--mailbox" || arg.startsWith("--mailbox="),
+        )
+      ) {
+        gatewayAuth = await resolveGatewayCommandAuth(runtime, "dench email");
+      }
     } catch {
       gatewayAuth = undefined;
     }
@@ -4882,35 +4900,16 @@ async function main() {
       if (argsIndex !== -1) parseJson(filteredSubArgs[argsIndex + 1]);
     }
     const runtime = await getRuntime();
-    const isSlackConnect =
-      sub === "connect" &&
-      ["slack", "slackbot"].includes(
-        (filteredSubArgs[1] ?? "").trim().toLowerCase(),
-      );
-    const isUnipileCommand =
-      (sub === "connect" || sub === "status") &&
-      normalizeUnipileToolkitSlug(filteredSubArgs[1] ?? "") !== null;
-    let gatewayAuth: GatewayCommandAuth | null = null;
-    let gatewayAuthError: string | undefined;
-    if (!isSlackConnect && !isUnipileCommand) {
-      try {
-        gatewayAuth = await resolveGatewayCommandAuth(runtime, "dench tool");
-      } catch (error) {
-        if (sub !== "status") throw error;
-        gatewayAuthError = gatewayAuthFailureReason(error);
-      }
-    }
     await runToolCommand({
       args: filteredSubArgs,
       jsonOutput: json,
-      gatewayAuthError,
-      ...(gatewayAuth
-        ? {
-            bearerToken: gatewayAuth.bearerToken,
-            gatewayBaseUrl: gatewayAuth.gatewayBaseUrl,
-            gatewayHeaders: gatewayAuth.gatewayHeaders,
-          }
-        : {}),
+      resolveGatewayAuth: async () => {
+        try {
+          return await resolveGatewayCommandAuth(runtime, "dench tool");
+        } catch (error) {
+          return { gatewayAuthError: gatewayAuthFailureReason(error) };
+        }
+      },
       ...unipileQueryAuth(runtime),
       ...(runtime.mode !== "dev"
         ? {
@@ -5261,6 +5260,44 @@ async function main() {
     return;
   }
 
+  if (command === "context" && args.includes("--sections")) {
+    const raw = args[args.indexOf("--sections") + 1];
+    const sections = raw
+      ?.split(",")
+      .map((section) => section.trim().toLowerCase())
+      .filter(Boolean);
+    const allowed = [
+      "identity",
+      "organisation",
+      "user",
+      "memory",
+      "rules",
+      "tools",
+    ];
+    if (
+      !sections?.length ||
+      sections.some((section) => !allowed.includes(section))
+    )
+      throw new Error(
+        `Usage: dench context --sections ${allowed.join(",")} [--json]`,
+      );
+    const context = await buildWorkspaceInstructionsContext(runtime, [
+      ...new Set(sections),
+    ]);
+    const documents = Array.isArray(context.documents)
+      ? (context.documents as Array<{ name: string; content?: string }>)
+      : [];
+    print(
+      json
+        ? context
+        : documents
+            .filter((doc) => doc.content !== undefined)
+            .map((doc) => `## ${doc.name}\n${doc.content || "(empty)"}`)
+            .join("\n\n"),
+    );
+    return;
+  }
+
   if (command === "context" && args.includes("--instructions")) {
     const instructions = await buildWorkspaceInstructionsContext(runtime);
     print(

package/email.ts

@@ -1,7 +1,15 @@
-import { readFile } from "node:fs/promises";
+import { createHash, createHmac, randomUUID } from "node:crypto";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { basename, extname, join } from "node:path";
 import type { ConvexHttpClient } from "convex/browser";
 import { makeFunctionReference } from "convex/server";
-import { getFlag, hasFlag, parseJson } from "./lib/cli-args";
+import {
+  assertNoUnknownFlags,
+  getFlag,
+  hasFlag,
+  parseJson,
+} from "./lib/cli-args";
+import { denchConfigDirectory } from "./lib/config-path.mjs";
 
 type EmailCliContext = {
   convex: ConvexHttpClient;
@@ -358,6 +366,13 @@ export function emailHelp() {
   console.log(`dench email — outbound email from a connected inbox (or Dench Emailing Service)
 
 Usage:
+  dench email draft create --to <email> --subject <subject> --text <body> [--mailbox <id/email>] [--request-id <id>] [--json]
+  dench email draft show <id> [--json]
+  dench email draft update|send <id> --revision <n> [--json]
+  dench email draft attach <id> --revision <n> --file <path> [--content-type <mime>] [--json]  # up to 5 MB/file
+  dench email draft signature <id> [--json]  # read signature HTML; insert visibly into the body
+  # Identical native create/send invocations reuse a saved request ID. Use --request-id <new-id> for another identical email.
+  dench email send --mailbox <id/email> --to <email> --subject <subject> --text <body> [--request-id <id>] [--json]
   dench email identity verify --from founder@example.com [--private] [--json]
   dench email identity verify --domain example.com [--from founder@example.com] [--private] [--json]
   dench email identity list [--domain example.com] [--json]
@@ -432,11 +447,20 @@ Email + LinkedIn multichannel sequences (see \`dench campaign\` — the fuller s
 }
 
 export async function runEmailCommand(ctx: EmailCliContext): Promise<void> {
+  ctx.args = ctx.args.flatMap((arg) => {
+    const split = arg.startsWith("--") ? arg.indexOf("=") : -1;
+    return split > 2 ? [arg.slice(0, split), arg.slice(split + 1)] : [arg];
+  });
+  ctx.jsonOutput = hasFlag(ctx.args, "--json") || ctx.jsonOutput;
   const group = ctx.args.shift();
   if (!group || group === "help" || group === "--help" || group === "-h") {
     emailHelp();
     return;
   }
+  if (group === "draft") {
+    await runDraft(ctx);
+    return;
+  }
   if (group === "identity") {
     await runIdentity(ctx);
     return;
@@ -500,6 +524,17 @@ function parseAddressList(
 }
 
 async function runSend(ctx: EmailCliContext) {
+  if (ctx.args.includes("--mailbox")) {
+    const content = {
+      ...(await draftContent(ctx)),
+      mailbox: requiredFlag(ctx.args, "--mailbox"),
+      threadId: getFlag(ctx.args, "--thread") ?? process.env.DENCH_THREAD_ID,
+      mode: "send",
+    };
+    const payload = await createNativeEmail(ctx, content);
+    out(ctx, payload, JSON.stringify(payload, null, 2));
+    return;
+  }
   const from = requiredFlag(ctx.args, "--from");
   const to = parseAddressList(requiredFlag(ctx.args, "--to"));
   if (to.length === 0) {
@@ -540,6 +575,176 @@ async function runSend(ctx: EmailCliContext) {
   );
 }
 
+/** Persist before HTTP. Identical invocations recover the same request even
+ * after the CLI process dies; an explicit new --request-id starts another email. */
+async function createNativeEmail(ctx: EmailCliContext, content: JsonRecord) {
+  let requestId = getFlag(ctx.args, "--request-id");
+  assertEmailArgs(ctx);
+  if (!requestId) {
+    // The credential keys the receipt fingerprint; it is never serialized into
+    // receipt data. Different sessions must not reuse one another's request IDs.
+    const fingerprint = ctx.sessionToken
+      ? createHmac("sha256", ctx.sessionToken)
+      : createHash("sha256");
+    const key = fingerprint
+      .update(JSON.stringify([ctx.convex.url, content]))
+      .digest("hex");
+    const directory = join(denchConfigDirectory(), "email-requests");
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    const path = join(directory, `${key}.json`);
+    const proposed = randomUUID();
+    try {
+      await writeFile(path, JSON.stringify({ requestId: proposed }), {
+        flag: "wx",
+        mode: 0o600,
+      });
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error;
+    }
+    const saved = JSON.parse(await readFile(path, "utf8")) as {
+      requestId: string;
+    };
+    if (typeof saved.requestId !== "string" || !saved.requestId)
+      throw new EmailCliError("Invalid local email request receipt");
+    requestId = saved.requestId;
+  }
+  return await callMutation(ctx, "functions/emailDrafts:create", {
+    ...content,
+    requestId,
+  });
+}
+
+function assertEmailArgs(ctx: EmailCliContext) {
+  assertNoUnknownFlags(ctx.args, "dench email");
+  if (ctx.args.length)
+    throw new EmailCliError(`Unexpected argument: ${ctx.args[0]}`);
+}
+
+function draftIdArg(ctx: EmailCliContext) {
+  const positional =
+    ctx.args[0] && !ctx.args[0].startsWith("--") ? ctx.args.shift() : undefined;
+  return positional ?? requiredFlag(ctx.args, "--draft");
+}
+
+function revisionArg(ctx: EmailCliContext) {
+  const revision = Number(requiredFlag(ctx.args, "--revision"));
+  if (!Number.isSafeInteger(revision) || revision < 1)
+    throw new EmailCliError(
+      "--revision must be a positive integer from draft show",
+    );
+  return revision;
+}
+
+async function draftContent(ctx: EmailCliContext) {
+  const to = getFlag(ctx.args, "--to");
+  const cc = getFlag(ctx.args, "--cc");
+  const bcc = getFlag(ctx.args, "--bcc");
+  const subject = getFlag(ctx.args, "--subject");
+  const htmlBody = await readTextFlag(ctx.args, "--html", "--html-file");
+  const textBody = await readTextFlag(ctx.args, "--text", "--text-file");
+  return {
+    ...(to !== undefined ? { to: parseAddressList(to) } : {}),
+    ...(cc !== undefined ? { cc: parseAddressList(cc) } : {}),
+    ...(bcc !== undefined ? { bcc: parseAddressList(bcc) } : {}),
+    ...(subject !== undefined ? { subject } : {}),
+    ...(htmlBody !== undefined ? { htmlBody } : {}),
+    ...(textBody !== undefined ? { textBody } : {}),
+  };
+}
+
+async function runDraft(ctx: EmailCliContext) {
+  const sub = ctx.args.shift();
+  let result: unknown;
+  if (sub === "create") {
+    result = await createNativeEmail(ctx, {
+      ...(await draftContent(ctx)),
+      mailbox: getFlag(ctx.args, "--mailbox"),
+      threadId: getFlag(ctx.args, "--thread") ?? process.env.DENCH_THREAD_ID,
+    });
+  } else if (sub === "show" || sub === "signature") {
+    const draftId = draftIdArg(ctx);
+    assertEmailArgs(ctx);
+    result =
+      sub === "show"
+        ? await callQuery(ctx, "functions/emailDrafts:get", { draftId })
+        : await callAction(ctx, "functions/emailDraftsNode:loadSignature", {
+            draftId,
+          });
+  } else if (sub === "update" || sub === "send") {
+    const draftId = draftIdArg(ctx);
+    const expectedRevision = revisionArg(ctx);
+    const args =
+      sub === "update"
+        ? {
+            draftId,
+            expectedRevision,
+            patch: {
+              ...(await draftContent(ctx)),
+              mailboxAccountId: getFlag(ctx.args, "--mailbox"),
+            },
+          }
+        : {
+            draftId,
+            expectedRevision,
+            requestId: getFlag(ctx.args, "--request-id"),
+          };
+    assertEmailArgs(ctx);
+    result = await callMutation(ctx, `functions/emailDrafts:${sub}`, args);
+  } else if (sub === "attach") {
+    const draftId = draftIdArg(ctx);
+    const expectedRevision = revisionArg(ctx);
+    const file = requiredFlag(ctx.args, "--file");
+    const contentType =
+      getFlag(ctx.args, "--content-type") ??
+      (
+        {
+          ".txt": "text/plain",
+          ".csv": "text/csv",
+          ".pdf": "application/pdf",
+          ".png": "image/png",
+          ".jpg": "image/jpeg",
+          ".jpeg": "image/jpeg",
+          ".json": "application/json",
+          ".html": "text/html",
+        } as Record<string, string>
+      )[extname(file).toLowerCase()] ??
+      "application/octet-stream";
+    assertEmailArgs(ctx);
+    const bytes = await readFile(file);
+    if (bytes.length > 5 * 1024 * 1024)
+      throw new EmailCliError("Attachments can be up to 5 MB each");
+    const draft = (await callQuery(ctx, "functions/emailDrafts:get", {
+      draftId,
+    })) as { revision: number; attachments: unknown[]; canEdit: boolean };
+    if (draft.revision !== expectedRevision)
+      throw new EmailCliError("Draft changed. Refresh before attaching a file");
+    if (!draft.canEdit) throw new EmailCliError("This draft is read-only");
+    const attachment = await callAction(
+      ctx,
+      "functions/emailDraftsNode:uploadAttachment",
+      {
+        draftId,
+        name: basename(file),
+        contentType,
+        contentBase64: bytes.toString("base64"),
+      },
+    );
+    result = await callMutation(ctx, "functions/emailDrafts:update", {
+      draftId,
+      expectedRevision,
+      patch: { attachments: [...draft.attachments, attachment] },
+    });
+  } else if (sub === "senders") {
+    assertEmailArgs(ctx);
+    result = await callQuery(ctx, "functions/emailDrafts:listSenders", {});
+  } else {
+    throw new EmailCliError(
+      "Usage: dench email draft create|show|update|send|senders|attach|signature. update/send/attach require --revision from draft show. attach: --file <path> [--content-type <mime>]. create: --to --subject --text/--html [--mailbox <id/email>] [--request-id <stable-id>] [--thread <chat-id>].",
+    );
+  }
+  out(ctx, result, JSON.stringify(result, null, 2));
+}
+
 async function runMessage(ctx: EmailCliContext) {
   const sub = ctx.args.shift();
   if (sub === "status") {

package/lib/api-schemas.ts

@@ -31,6 +31,42 @@ import {
   MIN_WITHDRAW_AFTER_HOURS,
 } from "./campaign-steps";
 
+const nativeEmailRecipient = z.object({
+  email: z.string(),
+  name: z.string().optional(),
+});
+const nativeEmailAttachment = z.object({
+  storageId: z.string(),
+  name: z.string(),
+  contentType: z.string(),
+  size: z.number(),
+});
+const nativeEmailContent = {
+  to: z.array(nativeEmailRecipient).optional(),
+  cc: z.array(nativeEmailRecipient).optional(),
+  bcc: z.array(nativeEmailRecipient).optional(),
+  subject: z.string().optional(),
+  htmlBody: z.string().optional(),
+  textBody: z.string().optional(),
+  attachments: z.array(nativeEmailAttachment).optional(),
+};
+const nativeEmailCreate = z.object({
+  organizationId: z.string().optional(),
+  threadId: z.string().optional(),
+  mailbox: z.string().optional(),
+  requestId: z.string(),
+  ...nativeEmailContent,
+});
+const nativeEmailReceipt = z
+  .object({
+    ok: z.boolean(),
+    kind: z.literal("email"),
+    draftId: z.string(),
+    syncStatus: z.string(),
+    revision: z.number(),
+  })
+  .passthrough();
+
 // ---------------------------------------------------------------------------
 // Shared enums + fragments (mirror convex validators)
 // ---------------------------------------------------------------------------
@@ -1786,7 +1822,11 @@ const toolSearchResponse = z
     session: z
       .object({ id: z.string() })
       .passthrough()
+      .optional()
       .describe("Tool-router session; reuse session.id for follow-up calls."),
+    items: z.array(z.record(z.string(), z.unknown())).optional(),
+    nativeAvailable: z.boolean().optional(),
+    available: z.boolean().optional(),
     execution_ref_version: z.number().optional(),
   })
   .passthrough()
@@ -2022,13 +2062,27 @@ const imageEdit = imageGenerate.extend({
   mask_base64: z.string().optional().describe("Optional base64 mask image."),
 });
 
-const composioConnect = z.object({
-  toolkit: z
-    .string()
-    .min(1)
-    .describe("Toolkit slug, e.g. github, gmail, stripe."),
-  callback_url: z.string().optional().describe("Optional OAuth callback URL."),
-});
+const composioConnect = z
+  .object({
+    toolkit: z
+      .string()
+      .min(1)
+      .optional()
+      .describe("Toolkit slug, e.g. github, gmail, stripe."),
+    toolkit_slug: z.string().min(1).optional(),
+    callback_url: z
+      .string()
+      .optional()
+      .describe("Optional OAuth callback URL."),
+    returnTo: z
+      .string()
+      .optional()
+      .describe("Native OAuth return path within the workspace."),
+  })
+  .refine((value) => Boolean(value.toolkit || value.toolkit_slug), {
+    message: "A toolkit is required.",
+    path: ["toolkit"],
+  });
 
 const composioToolSearch = z.object({
   queries: z
@@ -2039,7 +2093,13 @@ const composioToolSearch = z.object({
       }),
     )
     .min(1)
-    .max(7),
+    .max(7)
+    .optional(),
+  query: z.string().min(1).optional(),
+  toolkit: z.string().min(1).optional(),
+  toolkit_slug: z.string().min(1).optional(),
+  limit: z.number().int().min(1).max(100).optional(),
+  important: z.boolean().optional(),
   session: z
     .object({ id: z.string().optional(), generate_id: z.boolean().optional() })
     .optional(),
@@ -2064,6 +2124,8 @@ const composioToolRun = z.object({
     .optional()
     .describe("Tool arguments object."),
   account: z.string().optional(),
+  connected_account_id: z.string().optional(),
+  approvalId: z.string().optional(),
 });
 
 /**
@@ -3315,8 +3377,47 @@ export const requestSchemas: Record<string, ZodTypeAny> = {
   }),
 
   // Workspace
+  "workspace.context.sections": z.object({
+    organizationId: z.string().optional(),
+    sections: z
+      .array(
+        z.enum([
+          "identity",
+          "organisation",
+          "user",
+          "memory",
+          "rules",
+          "tools",
+        ]),
+      )
+      .optional(),
+  }),
+  "email.drafts.create": nativeEmailCreate,
+  "email.native.send": nativeEmailCreate,
+  "email.drafts.get": z.object({ draftId: z.string() }),
+  "email.drafts.senders": z.object({ organizationId: z.string().optional() }),
+  "email.drafts.update": z.object({
+    draftId: z.string(),
+    expectedRevision: z.number().int().nonnegative(),
+    patch: z.object({
+      mailboxAccountId: z.string().optional(),
+      ...nativeEmailContent,
+    }),
+  }),
+  "email.drafts.send": z.object({
+    draftId: z.string(),
+    expectedRevision: z.number().int().nonnegative(),
+    requestId: z.string().optional(),
+  }),
+  "email.drafts.upload": z.object({
+    draftId: z.string(),
+    name: z.string(),
+    contentType: z.string(),
+    contentBase64: z.string(),
+  }),
+  "email.drafts.signature": z.object({ draftId: z.string() }),
   "workspace.context": noInput,
-  "workspace.instructions": noInput,
+  "workspace.instructions": z.object({ organizationId: z.string().optional() }),
   "workspace.status": noInput,
   "workspace.agents": noInput,
   "workspace.approvals.list": noInput,
@@ -5055,6 +5156,15 @@ export const responseSchemas: Record<string, ZodTypeAny> = {
   }),
 
   // Workspace orientation
+  "workspace.context.sections": z.object({}).passthrough(),
+  "email.drafts.create": nativeEmailReceipt,
+  "email.drafts.get": nativeEmailReceipt,
+  "email.drafts.update": nativeEmailReceipt,
+  "email.drafts.send": nativeEmailReceipt,
+  "email.native.send": nativeEmailReceipt,
+  "email.drafts.senders": z.array(z.object({}).passthrough()),
+  "email.drafts.upload": nativeEmailAttachment,
+  "email.drafts.signature": z.object({}).passthrough(),
   "workspace.context": workspaceStatusPayload,
   "workspace.instructions": workspaceInstructionsResponse,
   "workspace.status": workspaceStatusPayload,
@@ -5865,6 +5975,14 @@ export const responseSchemas: Record<string, ZodTypeAny> = {
         .optional()
         .describe("OAuth URL the user opens to finish connecting."),
       connection_id: z.string().optional(),
+      redirectUrl: z.string().optional(),
+      link: z.string().optional(),
+      artifact: z
+        .object({
+          kind: z.literal("connect"),
+          data: z.object({ toolkit: z.string() }),
+        })
+        .optional(),
     })
     .passthrough()
     .describe("Connect-link response."),

package/lib/app-sdk-catalog.generated.ts

@@ -106,6 +106,7 @@ export const APP_SDK_OPERATIONS: readonly AppSdkOperationInfo[] = [
   {"id":"auth.otp.start","group":"auth","summary":"Start the email OTP sign-in flow.","cli":"dench signin --email","method":"POST","path":"/auth/otp/start","permission":"auth:write","pathParams":[]},
   {"id":"auth.otp.verify","group":"auth","summary":"Verify an email OTP sign-in code.","cli":"dench signin --email","method":"POST","path":"/auth/otp/verify","permission":"auth:write","pathParams":[]},
   {"id":"auth.otp.finalize","group":"auth","summary":"Finalize an email OTP sign-in session.","cli":"dench signin --email","method":"POST","path":"/auth/otp/finalize","permission":"auth:write","pathParams":[]},
+  {"id":"workspace.context.sections","group":"workspace","summary":"Read selected scoped workspace documents and a compact context index without writes.","cli":"dench context --sections","method":"GET","path":"/context/sections","permission":"workspace:read","pathParams":[]},
   {"id":"workspace.context","group":"workspace","summary":"Return the current Dench workspace context for the bearer.","cli":"dench context","method":"GET","path":"/context","permission":"workspace:read","pathParams":[]},
   {"id":"workspace.instructions","group":"workspace","summary":"Return the current workspace's standing instructions for external agents.","cli":"dench context --instructions","method":"GET","path":"/context/instructions","permission":"workspace:read","pathParams":[]},
   {"id":"workspace.status","group":"workspace","summary":"Return workspace and agent status.","cli":"dench status","method":"GET","path":"/status","permission":"workspace:read","pathParams":[]},
@@ -314,6 +315,14 @@ export const APP_SDK_OPERATIONS: readonly AppSdkOperationInfo[] = [
   {"id":"email.identity.disable","group":"email","summary":"Soft-disable a sender (or every sender on a domain) for the workspace; sends are blocked until restored.","cli":"dench email identity disable","method":"POST","path":"/email/sending-identities/{identity}/disable","permission":"email:write","pathParams":["identity"]},
   {"id":"email.identity.restore","group":"email","summary":"Restore a previously disabled sender for the workspace.","cli":"dench email identity restore","method":"POST","path":"/email/sending-identities/{identity}/restore","permission":"email:write","pathParams":["identity"]},
   {"id":"email.identity.delete","group":"email","summary":"Permanently delete a sender (or every sender on a domain) from the workspace; re-adding it requires verification from scratch.","cli":"dench email identity delete","method":"DELETE","path":"/email/sending-identities/{identity}","permission":"email:write","pathParams":["identity"]},
+  {"id":"email.drafts.create","group":"email","summary":"Create an editable Dench email draft and synchronize its selected native mailbox asynchronously. Use a stable requestId for retries.","cli":"dench email draft create","method":"POST","path":"/email/drafts","permission":"email:write","pathParams":[]},
+  {"id":"email.drafts.get","group":"email","summary":"Read an email draft, eligible senders and provider sync status.","cli":"dench email draft show","method":"GET","path":"/email/drafts/{draftId}","permission":"email:read","pathParams":["draftId"]},
+  {"id":"email.drafts.senders","group":"email","summary":"List native mailboxes this caller may use.","cli":"dench email draft senders","method":"GET","path":"/email/drafts/senders","permission":"email:read","pathParams":[]},
+  {"id":"email.drafts.update","group":"email","summary":"Save draft content using expectedRevision; sender changes require a new draft after provider binding.","cli":"dench email draft update","method":"PATCH","path":"/email/drafts/{draftId}","permission":"email:write","pathParams":["draftId"]},
+  {"id":"email.drafts.send","group":"email","summary":"Send the current Dench draft revision through its native mailbox. Repeated requests share a durable receipt.","cli":"dench email draft send","method":"POST","path":"/email/drafts/{draftId}/send","permission":"email:write","pathParams":["draftId"]},
+  {"id":"email.drafts.upload","group":"email","summary":"Upload attachment bytes authorized against this draft before adding its storage reference.","cli":"dench email draft attach","method":"POST","path":"/email/drafts/{draftId}/attachments","permission":"email:write","pathParams":["draftId"]},
+  {"id":"email.drafts.signature","group":"email","summary":"Load the selected mailbox signature for explicit visible insertion.","cli":"dench email draft signature","method":"GET","path":"/email/drafts/{draftId}/signature","permission":"email:read","pathParams":["draftId"]},
+  {"id":"email.native.send","group":"email","summary":"Send through a native Gmail or Outlook mailbox with a durable request receipt. Only use for an explicit send request.","cli":"dench email send --mailbox","method":"POST","path":"/email/native/send","permission":"email:write","pathParams":[]},
   {"id":"email.send","group":"email","summary":"Send one raw email (no campaign): to/cc/bcc, custom from-name and reply-to, optional reply threading via replyToMessageId.","cli":"dench email send","method":"POST","path":"/email/send","permission":"email:write","pathParams":[]},
   {"id":"email.message.get","group":"email","summary":"Read a raw email message's status and open/click counters.","cli":"dench email message status","method":"GET","path":"/email/messages/{messageId}","permission":"email:read","pathParams":["messageId"]},
   {"id":"email.message.list","group":"email","summary":"List recent raw email messages for the workspace.","cli":"dench email message list","method":"GET","path":"/email/messages","permission":"email:read","pathParams":[]},
@@ -608,6 +617,14 @@ export const APP_SDK_METHODS: Readonly<Record<string, AppSdkMethodInfo>> = {
   "campaigns.campaignsForRecord": {"kind":"op","permission":"campaigns:read","op":"campaigns.people.forRecord","doc":"The campaigns a CRM record is in, with its status in each."},
   "campaigns.personTimeline": {"kind":"op","permission":"campaigns:read","op":"campaigns.people.timeline","doc":"Everything a campaign did for one person, step by step."},
   "campaigns.removePerson": {"kind":"op","permission":"campaigns:write","op":"campaigns.people.remove","doc":"Remove a never-contacted person from a draft campaign."},
+  "email.createDraft": {"kind":"op","permission":"email:write","op":"email.drafts.create","doc":"Create a native mailbox draft with a stable request receipt."},
+  "email.draft": {"kind":"op","permission":"email:read","op":"email.drafts.get","doc":"Read a native email draft and sync status."},
+  "email.updateDraft": {"kind":"op","permission":"email:write","op":"email.drafts.update","doc":"Save the next email draft revision."},
+  "email.sendDraft": {"kind":"op","permission":"email:write","op":"email.drafts.send","doc":"Send the frozen native email draft revision."},
+  "email.senders": {"kind":"op","permission":"email:read","op":"email.drafts.senders","doc":"List eligible native mailboxes."},
+  "email.uploadAttachment": {"kind":"op","permission":"email:write","op":"email.drafts.upload","doc":"Upload attachment bytes for a native draft."},
+  "email.signature": {"kind":"op","permission":"email:read","op":"email.drafts.signature","doc":"Load the selected mailbox signature for visible insertion."},
+  "email.sendFromMailbox": {"kind":"op","permission":"email:write","op":"email.native.send","doc":"Explicitly send through a native Gmail or Outlook mailbox."},
   "email.send": {"kind":"op","permission":"email:write","op":"email.send","doc":"Send one email from a verified identity."},
   "email.messages": {"kind":"op","permission":"email:read","op":"email.message.list","doc":"Sent messages."},
   "email.message": {"kind":"op","permission":"email:read","op":"email.message.get","doc":"One sent message with delivery events."},