@dench.com/cli 3.6.4-staging.377 → 3.6.6-staging.386

package/lib/app-sdk-surface.ts

@@ -908,6 +908,55 @@ export const APP_SDK_SURFACE: AppSdkSurface = {
   },
 
   email: {
+    createDraft: {
+      op: "email.drafts.create",
+      doc: "Create a native mailbox draft with a stable request receipt.",
+      args: `draft: ${A("email.drafts.create")}`,
+      returns: R("email.drafts.create"),
+    },
+    draft: {
+      op: "email.drafts.get",
+      doc: "Read a native email draft and sync status.",
+      args: "draftId: string",
+      returns: R("email.drafts.get"),
+    },
+    updateDraft: {
+      op: "email.drafts.update",
+      doc: "Save the next email draft revision.",
+      args: `input: ${A("email.drafts.update")}`,
+      returns: R("email.drafts.update"),
+    },
+    sendDraft: {
+      op: "email.drafts.send",
+      doc: "Send the frozen native email draft revision.",
+      args: `input: ${A("email.drafts.send")}`,
+      returns: R("email.drafts.send"),
+    },
+    senders: {
+      op: "email.drafts.senders",
+      doc: "List eligible native mailboxes.",
+      args: `opts?: ${A("email.drafts.senders")}`,
+      returns: R("email.drafts.senders"),
+    },
+    uploadAttachment: {
+      op: "email.drafts.upload",
+      doc: "Upload attachment bytes for a native draft.",
+      args: `input: ${A("email.drafts.upload")}`,
+      returns: R("email.drafts.upload"),
+    },
+    signature: {
+      op: "email.drafts.signature",
+      doc: "Load the selected mailbox signature for visible insertion.",
+      args: "draftId: string",
+      returns: R("email.drafts.signature"),
+    },
+    sendFromMailbox: {
+      op: "email.native.send",
+      doc: "Explicitly send through a native Gmail or Outlook mailbox.",
+      args: `message: ${A("email.native.send")}`,
+      returns: R("email.native.send"),
+    },
+
     send: {
       op: "email.send",
       doc: "Send one email from a verified identity.",

package/lib/command-registry.ts

@@ -34,6 +34,9 @@ export type CustomOperation = {
     | "cronRunNow"
     | "connectionsList"
     | "toolDisconnect"
+    | "nativeToolSearch"
+    | "nativeToolRun"
+    | "nativeToolConnect"
     | "billingTopup"
     | "upgrade"
     | "filesMove"
@@ -468,6 +471,18 @@ const rawApiOperations = [
     backend: local("Backend selection is local CLI state."),
   }),
 
+  op({
+    id: "workspace.context.sections",
+    group: "workspace",
+    summary:
+      "Read selected scoped workspace documents and a compact context index without writes.",
+    cli: "dench context --sections",
+    method: "GET",
+    path: "/context/sections",
+    requestSchema: anyObject,
+    responseSchema: anyResponse,
+    backend: convex("query", "functions/agentConfig:workspaceContext"),
+  }),
   // Workspace orientation.
   op({
     id: "workspace.context",
@@ -3332,6 +3347,103 @@ const rawApiOperations = [
     responseSchema: anyResponse,
     backend: convex("mutation", "functions/emailCampaigns:deleteIdentity"),
   }),
+  op({
+    id: "email.drafts.create",
+    group: "email",
+    summary:
+      "Create an editable Dench email draft and synchronize its selected native mailbox asynchronously. Use a stable requestId for retries.",
+    cli: "dench email draft create",
+    method: "POST",
+    path: "/email/drafts",
+    requestSchema: anyObject,
+    responseSchema: anyResponse,
+    backend: convex("mutation", "functions/emailDrafts:create"),
+  }),
+  op({
+    id: "email.drafts.get",
+    group: "email",
+    summary: "Read an email draft, eligible senders and provider sync status.",
+    cli: "dench email draft show",
+    method: "GET",
+    path: "/email/drafts/{draftId}",
+    requestSchema: anyObject,
+    responseSchema: anyResponse,
+    backend: convex("query", "functions/emailDrafts:get"),
+  }),
+  op({
+    id: "email.drafts.senders",
+    group: "email",
+    summary: "List native mailboxes this caller may use.",
+    cli: "dench email draft senders",
+    method: "GET",
+    path: "/email/drafts/senders",
+    requestSchema: anyObject,
+    responseSchema: anyResponse,
+    backend: convex("query", "functions/emailDrafts:listSenders"),
+  }),
+  op({
+    id: "email.drafts.update",
+    group: "email",
+    summary:
+      "Save draft content using expectedRevision; sender changes require a new draft after provider binding.",
+    cli: "dench email draft update",
+    method: "PATCH",
+    path: "/email/drafts/{draftId}",
+    requestSchema: anyObject,
+    responseSchema: anyResponse,
+    backend: convex("mutation", "functions/emailDrafts:update"),
+  }),
+  op({
+    id: "email.drafts.send",
+    group: "email",
+    summary:
+      "Send the current Dench draft revision through its native mailbox. Repeated requests share a durable receipt.",
+    cli: "dench email draft send",
+    method: "POST",
+    path: "/email/drafts/{draftId}/send",
+    requestSchema: anyObject,
+    responseSchema: anyResponse,
+    backend: convex("mutation", "functions/emailDrafts:send"),
+  }),
+  op({
+    id: "email.drafts.upload",
+    group: "email",
+    summary:
+      "Upload attachment bytes authorized against this draft before adding its storage reference.",
+    cli: "dench email draft attach",
+    method: "POST",
+    path: "/email/drafts/{draftId}/attachments",
+    requestSchema: anyObject,
+    responseSchema: anyResponse,
+    backend: convex("action", "functions/emailDraftsNode:uploadAttachment"),
+  }),
+  op({
+    id: "email.drafts.signature",
+    group: "email",
+    summary:
+      "Load the selected mailbox signature for explicit visible insertion.",
+    cli: "dench email draft signature",
+    method: "GET",
+    path: "/email/drafts/{draftId}/signature",
+    requestSchema: anyObject,
+    responseSchema: anyResponse,
+    backend: convex("action", "functions/emailDraftsNode:loadSignature"),
+  }),
+  op({
+    id: "email.native.send",
+    group: "email",
+    summary:
+      "Send through a native Gmail or Outlook mailbox with a durable request receipt. Only use for an explicit send request.",
+    cli: "dench email send --mailbox",
+    method: "POST",
+    path: "/email/native/send",
+    requestSchema: anyObject,
+    responseSchema: anyResponse,
+    backend: {
+      ...convex("mutation", "functions/emailDrafts:create"),
+      fixedArgs: { mode: "send" },
+    },
+  }),
   op({
     id: "email.send",
     group: "email",
@@ -4825,7 +4937,7 @@ const rawApiOperations = [
     path: "/tools/connections",
     requestSchema: anyObject,
     responseSchema: anyResponse,
-    backend: gateway("POST", "/composio/connect"),
+    backend: custom("nativeToolConnect", "bearer"),
   }),
   op({
     id: "tool.search",
@@ -4836,7 +4948,7 @@ const rawApiOperations = [
     path: "/tools/search",
     requestSchema: anyObject,
     responseSchema: anyResponse,
-    backend: gateway("POST", "/composio/tool-router/search"),
+    backend: custom("nativeToolSearch", "bearer"),
   }),
   op({
     id: "tool.run",
@@ -4852,7 +4964,7 @@ const rawApiOperations = [
     path: "/tools/run",
     requestSchema: anyObject,
     responseSchema: anyResponse,
-    backend: gateway("POST", "/composio/tool-router/execute"),
+    backend: custom("nativeToolRun", "bearer"),
   }),
   op({
     id: "tool.disconnect",

package/lib/native-providers.ts

@@ -0,0 +1,44 @@
+import { normalizeUnipileToolkitSlug } from "./unipile-toolkits";
+
+/** Provider ownership is independent of connection health and search results. */
+export function nativeToolkit(slug: string): string | null {
+  const normalized = slug
+    .trim()
+    .toLowerCase()
+    .replace(/[\s_-]+/g, "");
+  if (normalized === "slack" || normalized === "slackbot") return "slack";
+  return normalizeUnipileToolkitSlug(slug);
+}
+
+export function nativeToolkitForTool(slug: string): string | null {
+  const parts = slug.trim().split(/[_-]+/);
+  // Providers with separator aliases (GOOGLE_CALENDAR, MICROSOFT_OUTLOOK)
+  // are resolved before considering the remainder as an action name.
+  for (let length = Math.min(3, parts.length - 1); length > 0; length--) {
+    const toolkit = nativeToolkit(parts.slice(0, length).join(""));
+    if (toolkit) return toolkit;
+  }
+  return null;
+}
+
+export function isNativeToolRecord(value: {
+  slug?: unknown;
+  tool_slug?: unknown;
+  toolkit_slug?: unknown;
+  toolkit?: unknown;
+}): boolean {
+  const toolkit =
+    value.toolkit && typeof value.toolkit === "object"
+      ? (value.toolkit as { slug?: unknown; name?: unknown })
+      : {};
+  const name =
+    value.toolkit_slug ??
+    (typeof value.toolkit === "string"
+      ? value.toolkit
+      : (toolkit.slug ?? toolkit.name));
+  const slug = value.slug ?? value.tool_slug;
+  return (
+    (typeof name === "string" && nativeToolkit(name) !== null) ||
+    (typeof slug === "string" && nativeToolkitForTool(slug) !== null)
+  );
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dench.com/cli",
-  "version": "3.6.4-staging.377",
+  "version": "3.6.6-staging.386",
   "description": "Dench agent workspace CLI.",
   "type": "module",
   "bin": {

package/tools.ts

@@ -57,6 +57,11 @@ import {
   type ConnectionSource,
   connectionSource,
 } from "./lib/connection-source";
+import {
+  isNativeToolRecord,
+  nativeToolkit,
+  nativeToolkitForTool,
+} from "./lib/native-providers";
 import {
   normalizeUnipileToolkitSlug,
   unipileConnectKindFromToolkitSlug,
@@ -75,6 +80,8 @@ export type ToolCliContext = {
   gatewayBaseUrl?: string;
   gatewayHeaders?: Record<string, string>;
   gatewayAuthError?: string;
+  /** Resolve the gateway only when a third-party operation actually needs it. */
+  resolveGatewayAuth?: () => Promise<GatewayAuthContext>;
   /**
    * Convex client + bearer for the Unipile half of the list. Absent on the
    * help path and whenever the caller could not be authenticated, in which
@@ -93,7 +100,11 @@ export type ToolCliContext = {
 
 type GatewayAuthContext = Pick<
   ToolCliContext,
-  "bearerToken" | "gatewayBaseUrl" | "gatewayHeaders" | "gatewayAuthError"
+  | "bearerToken"
+  | "gatewayBaseUrl"
+  | "gatewayHeaders"
+  | "gatewayAuthError"
+  | "resolveGatewayAuth"
 >;
 
 type UnipileAuthContext = Pick<ToolCliContext, "convex" | "sessionToken">;
@@ -152,43 +163,9 @@ const connectCalendarRef = makeFunctionReference<"action">(
   "functions/calendarUnipileNode:createCalendarHostedAuthLink",
 );
 
-/**
- * Gmail, Outlook, Calendar and LinkedIn are brokered by Dench, and Composio
- * refuses to connect them — so its catalogue entries for those toolkits can
- * never execute, and showing them next to the ones that work just teaches an
- * agent to pick a tool that always answers `composio_not_connected`.
- *
- * The set comes from the server with the tools themselves rather than being
- * hardcoded here, so a fifth platform needs no CLI change.
- */
-
-/**
- * Composio spells some toolkits without a separator (`googlecalendar`), while
- * our registry uses the hyphenated form. Normalize through this map before the
- * membership test, or the dead Composio calendar entries survive the filter
- * and sit next to the working ones under two names for one product.
- */
-const COMPOSIO_TOOLKIT_ALIASES: Record<string, string> = {
-  googlecalendar: "google-calendar",
-  outlookcalendar: "outlook-calendar",
-};
-
-function withoutShadowedComposioTools(
-  items: JsonRecord[],
-  ownedToolkits: Set<string>,
-): JsonRecord[] {
-  if (ownedToolkits.size === 0) return items;
-  return items.filter((item) => {
-    const slug = (
-      stringField(item, "toolkit_slug") ??
-      stringField(asRecord(item.toolkit), "slug", "name") ??
-      ""
-    )
-      .toLowerCase()
-      .replaceAll("_", "-");
-    const canonical = COMPOSIO_TOOLKIT_ALIASES[slug] ?? slug;
-    return !canonical || !ownedToolkits.has(canonical);
-  });
+/** Native ownership survives empty searches, disconnections and registry failures. */
+function withoutShadowedComposioTools(items: JsonRecord[]): JsonRecord[] {
+  return items.filter((item) => !isNativeToolRecord(item));
 }
 
 /**
@@ -277,14 +254,16 @@ export async function fetchConnectedAppsSummary(
       connections: unipile.connections,
       ...unipileFields,
     };
-    return error instanceof MissingApiKeyError
-      ? { ...failure, reason: error.message }
-      : { ...failure, error: errorMessage(error) };
+    return ctx.gatewayAuthError
+      ? { ...failure, reason: ctx.gatewayAuthError }
+      : error instanceof MissingApiKeyError
+        ? { ...failure, reason: error.message }
+        : { ...failure, error: errorMessage(error) };
   }
   const connections = [
     ...extractConnections(payload)
       .map(compactConnection)
-      .filter((connection) => !normalizeUnipileToolkitSlug(connection.toolkit)),
+      .filter((connection) => !nativeToolkit(connection.toolkit)),
     ...unipile.connections,
   ];
   return {
@@ -305,7 +284,7 @@ async function runStatusSubcommand(ctx: ToolCliContext): Promise<void> {
     : ctx.args[0];
   if (requestedToolkit) ctx.args.shift();
   const unipileToolkit = requestedToolkit
-    ? normalizeUnipileToolkitSlug(requestedToolkit)
+    ? nativeToolkit(requestedToolkit)
     : null;
   const filterToolkit = unipileToolkit ?? requestedToolkit;
 
@@ -369,7 +348,11 @@ async function runStatusSubcommand(ctx: ToolCliContext): Promise<void> {
 }
 
 async function runSearchSubcommand(ctx: ToolCliContext): Promise<void> {
-  const toolkit = getFlag(ctx.args, "--toolkit");
+  const requestedToolkit = getFlag(ctx.args, "--toolkit");
+  const ownedToolkit = requestedToolkit
+    ? nativeToolkit(requestedToolkit)
+    : null;
+  const toolkit = ownedToolkit ?? requestedToolkit;
   const limitRaw = getFlag(ctx.args, "--limit");
   const limit = limitRaw ? parsePositiveInt("--limit", limitRaw) : undefined;
   const compact = hasFlag(ctx.args, "--compact");
@@ -395,28 +378,43 @@ async function runSearchSubcommand(ctx: ToolCliContext): Promise<void> {
   if (toolkit) body.toolkit_slug = toolkit;
   if (limit) body.limit = limit;
 
-  const [payload, unipile] = await Promise.all([
-    callGateway(ctx, "POST", "/v1/composio/tools/search", body),
+  const [gateway, unipile] = await Promise.all([
+    ownedToolkit
+      ? Promise.resolve({
+          payload: {} as unknown,
+          error: undefined as string | undefined,
+        })
+      : callGateway(ctx, "POST", "/v1/composio/tools/search", body)
+          .then((payload) => ({
+            payload,
+            error: undefined as string | undefined,
+          }))
+          .catch((error) => ({
+            payload: {} as unknown,
+            error: errorMessage(error),
+          })),
     fetchUnipileTools(ctx, { query, ...(toolkit ? { toolkit } : {}) }),
   ]);
 
-  const record = asRecord(payload) ?? {};
-  const ownedToolkits = new Set(
-    unipile.tools
-      .map((tool) => stringField(asRecord(tool.toolkit), "slug") ?? "")
-      .filter(Boolean),
-  );
+  const record = asRecord(gateway.payload) ?? {};
   const merged = {
-    ...record,
+    query,
     items: [
+      ...unipile.tools,
       ...withoutShadowedComposioTools(
-        extractSearchItems(record),
-        ownedToolkits,
+        extractSearchItems(asRecord(record.data) ?? record),
+      ),
+    ].slice(0, limit ?? 100),
+    // Do not retain unfiltered nested tool_schemas/data from the gateway.
+    connected_toolkits: [
+      ...[...connectedToolkitSet(asRecord(record.data) ?? record)].filter(
+        (slug) => !nativeToolkit(slug),
       ),
-      ...unipile.tools,
     ],
     nativeAvailable: unipile.available,
     ...(unipile.error ? { nativeError: unipile.error } : {}),
+    ...(gateway.error ? { gatewayError: gateway.error } : {}),
+    ...(ownedToolkit ? { toolkit: ownedToolkit } : {}),
   };
 
   if (ctx.jsonOutput) {
@@ -427,20 +425,27 @@ async function runSearchSubcommand(ctx: ToolCliContext): Promise<void> {
 }
 
 /**
- * Whether this slug is ours. A lookup failure answers "not ours", so an old
- * deployment routes everything to Composio exactly as it did before.
+ * Resolve a native action without interpreting a broken registry as another provider.
  */
 async function resolveUnipileTool(
   ctx: UnipileAuthContext,
   slug: string,
 ): Promise<JsonRecord | null> {
-  if (!ctx.convex) return null;
+  if (!ctx.convex) {
+    if (nativeToolkitForTool(slug))
+      throw new ToolCliError(
+        "native_unavailable: Sign in to Dench to use this integration.",
+      );
+    return null;
+  }
   try {
     return (
       asRecord(await ctx.convex.query(getUnipileToolRef, { slug } as never)) ??
       null
     );
-  } catch {
+  } catch (error) {
+    if (nativeToolkitForTool(slug))
+      throw new ToolCliError(`native_unavailable: ${errorMessage(error)}`);
     return null;
   }
 }
@@ -528,7 +533,11 @@ async function fetchUnipileTools(
         .filter((row): row is JsonRecord => row !== undefined)
         .map((row) =>
           typeof row.source === "string"
-            ? { ...row, source: connectionSource(row.source, "dench") }
+            ? {
+                ...row,
+                source: connectionSource(row.source, "dench"),
+                connection_status: { is_connected: true },
+              }
             : row,
         ),
     };
@@ -565,9 +574,18 @@ async function runRunSubcommand(ctx: ToolCliContext): Promise<void> {
   // routed to Composio, which 404s.
   const unipileTool = await resolveUnipileTool(ctx, toolSlug);
   if (unipileTool) {
+    if (account)
+      throw new ToolCliError(
+        "--account is for third-party connections. Pass the native mailbox/account field in --args.",
+      );
     await runUnipileTool(ctx, toolSlug, parsedArgs, approval);
     return;
   }
+  if (nativeToolkitForTool(toolSlug)) {
+    throw new ToolCliError(
+      `unsupported_native_capability: ${toolSlug} is not supported by Dench's native integration. For email drafts use dench email draft create; do not reconnect or try another provider.`,
+    );
+  }
 
   const body: Record<string, unknown> = {
     tool_slug: toolSlug,
@@ -697,6 +715,21 @@ async function runConnectSubcommand(ctx: ToolCliContext): Promise<void> {
   ctx.args.shift();
 
   const normalizedToolkit = toolkit.trim().toLowerCase();
+  // Hosted chat owns the human connection UI. Do not mint OAuth credentials
+  // in a model command or journal them in a tool result. External CLI clients
+  // retain their ordinary link-based flow.
+  if (process.env.DENCH_CHAT_ARTIFACTS === "1") {
+    console.log(
+      JSON.stringify({
+        ok: true,
+        kind: "connect",
+        toolkit: nativeToolkit(toolkit) ?? normalizedToolkit,
+        action: "connect",
+      }),
+    );
+    return;
+  }
+
   if (normalizedToolkit === "slack" || normalizedToolkit === "slackbot") {
     await runSlackConnectSubcommand(ctx, normalizedToolkit);
     return;
@@ -920,6 +953,11 @@ async function callGateway(
   path: string,
   body?: Record<string, unknown>,
 ): Promise<unknown> {
+  if (ctx.resolveGatewayAuth && !ctx.bearerToken) {
+    const resolve = ctx.resolveGatewayAuth;
+    ctx.resolveGatewayAuth = undefined;
+    Object.assign(ctx, await resolve());
+  }
   const bearerToken = requireBearerToken(ctx);
   const baseUrl = resolveGatewayBaseUrl(ctx);
   const init: RequestInit = {
@@ -1239,6 +1277,13 @@ function formatSearchResult(searchResult: unknown, compact = false): string {
   const items = extractSearchItems(data);
   const connectedSet = connectedToolkitSet(data);
 
+  if (
+    items.length === 0 &&
+    typeof data?.toolkit === "string" &&
+    nativeToolkit(data.toolkit)
+  ) {
+    return `No matching native action for ${data.toolkit}. For email drafts use dench email draft create; otherwise inspect dench tool status ${data.toolkit} --json. Native apps never fall back to Composio.`;
+  }
   if (items.length === 0) {
     return [
       "No matching tools found.",