@dench.com/cli 3.6.6-staging.386 → 3.8.0-staging.389

package/app-sdk.d.ts

@@ -12,6 +12,67 @@
 // ── Operation request/response types (from cli/lib/api-schemas.ts) ──────
 
 export interface ApiRequests {
+  /** List workspace-shared reusable setups and ready revisions (metadata only). — `dench env list` — GET /api/v1/environments */
+  "environments.list": {
+    limit?: number;
+    cursor?: string;
+  };
+  /** Inspect a saved setup, its manifest, and an optional immutable revision. — `dench env show` — GET /api/v1/environments/{name} */
+  "environments.get": {
+    name: string;
+    revision?: string;
+  };
+  /** Reserve an owner-bound source upload. Prefix the uploaded bytes with the returned proof before saving. — `dench env save` — POST /api/v1/environments/uploads */
+  "environments.upload": {
+    kind: "source";
+    size: number;
+    sha256: string;
+  };
+  /** Publish an explicitly saved source and manifest for one-time preparation. Returns pending/building until verified; does not run the task. — `dench env save` — POST /api/v1/environments/{name} */
+  "environments.save": {
+    name: string;
+    manifest: {
+      version: 1;
+      name: string;
+      purpose: string;
+      files: string[];
+      prepare: string[];
+      verify: string[];
+      env?: Record<string, string>;
+      secretEnv?: Record<string, string>;
+      secretFiles?: {
+        path: string;
+        secret: string;
+        mutable?: boolean;
+      }[];
+      statePaths?: string[];
+      portable?: boolean;
+    };
+    uploadId: string;
+    storageId: string;
+    sha256: string;
+  };
+  /** Retire a saved setup from new selection; retain immutable revisions and active job evidence. — `dench env delete` — DELETE /api/v1/environments/{name} */
+  "environments.delete": {
+    name: string;
+  };
+  /** List workspace-shared credential names, kinds and versions; never values. — `dench secrets list` — GET /api/v1/secrets */
+  "secrets.list": {
+    limit?: number;
+    cursor?: string;
+  };
+  /** Encrypt a workspace credential. Use CLI stdin or the secure chat form; return metadata only. Do not put values in chat, manifests or scripts. — `dench secrets set` — PUT /api/v1/secrets/{name} */
+  "secrets.set": {
+    name: string;
+    kind: "env" | "file";
+    value: string;
+    expectedVersion?: number;
+  };
+  /** Revoke a workspace credential for future resolution, optionally checking its version. — `dench secrets delete` — DELETE /api/v1/secrets/{name} */
+  "secrets.delete": {
+    name: string;
+    expectedVersion?: number;
+  };
   /** Create an idempotent empty campaign draft with the caller's available sender pools. Does not launch or send. — `dench campaign draft` — POST /api/v1/campaigns/drafts */
   "campaigns.drafts.create": {
     /** Your stable id for this request, 8-64 characters. Retrying with the same id returns the same draft instead of creating another. */
@@ -699,6 +760,7 @@ export interface ApiRequests {
   };
   /** Start a new chat-turn workflow. — `dench chat new` — POST /api/v1/chat/threads */
   "chat.new": {
+    environment?: string;
     /** The user message that starts the turn. */
     prompt: string;
     model?: string;
@@ -722,6 +784,8 @@ export interface ApiRequests {
   };
   /** List CRM objects. — `dench crm objects list` — GET /api/v1/crm/objects */
   "crm.objects.list": Record<string, unknown>;
+  /** List names, display labels, visibility and workspace counts without internal state. — `dench crm objects list --compact` — GET /api/v1/crm/catalog/objects */
+  "crm.objects.listCompact": Record<string, unknown>;
   /** Get a CRM object. — `dench crm objects get` — GET /api/v1/crm/objects/{name} */
   "crm.objects.get": {
     name: string;
@@ -883,6 +947,10 @@ export interface ApiRequests {
   "crm.fields.list": {
     objectName: string;
   };
+  /** List field names, types and effective constraints without indexing or enrichment internals. — `dench crm fields list --compact` — GET /api/v1/crm/catalog/objects/{objectName}/fields */
+  "crm.fields.listCompact": {
+    objectName: string;
+  };
   /** Create a CRM field or read-only campaign activity boolean column. — `dench crm fields create` — POST /api/v1/crm/objects/{objectName}/fields */
   "crm.fields.create": {
     objectName: string;
@@ -1374,6 +1442,16 @@ export interface ApiRequests {
     objectName?: string;
     limit?: number;
   };
+  /** Search bounded pages of readable CRM entries, optionally projecting cells. Always follow continueCursor until isDone. — `dench crm search --page` — GET /api/v1/crm/search/page */
+  "crm.search.page": {
+    /** Full-text query over readable entries. */
+    text: string;
+    objectName?: string;
+    select?: string[];
+    limit?: number;
+    /** Use the preceding continueCursor, with the same query and projection. */
+    cursor?: string;
+  };
   /** List CRM statuses. — `dench crm statuses list` — GET /api/v1/crm/objects/{objectName}/statuses */
   "crm.statuses.list": {
     objectName: string;
@@ -2179,6 +2257,32 @@ export interface ApiRequests {
     /** Identity id, sender email, or domain (deletes every sender on the domain). Permanent: re-adding requires re-verification. */
     identity: string;
   };
+  /** Search authorized synced mailbox headers with bounded cursor pagination. isDone covers stored records, not provider completeness. — `dench email inbox search` — GET /api/v1/email/inbox/search */
+  "email.inbox.search": {
+    limit?: number;
+    cursor?: string;
+    mailbox?: string;
+    from?: string;
+    to?: string;
+    subject?: string;
+    /** Inclusive Unix milliseconds; missing sentAt falls back to createdAt. */
+    after?: number;
+    /** Exclusive Unix milliseconds. */
+    before?: number;
+    direction?: "inbound" | "outbound";
+  };
+  /** Read a bounded page of synced headers using an exact thread handle from inbox search; bodies remain on demand. — `dench email inbox thread` — GET /api/v1/email/inbox/threads/{threadHandle} */
+  "email.inbox.thread": {
+    limit?: number;
+    cursor?: string;
+    threadHandle: string;
+  };
+  /** Read a bounded stored body using an exact message handle from inbox search; rechecks mailbox and record privacy. — `dench email inbox message` — GET /api/v1/email/inbox/messages/{messageHandle} */
+  "email.inbox.message": {
+    messageHandle: string;
+    format?: "text" | "html";
+    maxBytes?: number;
+  };
   /** Create an editable Dench email draft and synchronize its selected native mailbox asynchronously. Use a stable requestId for retries. — `dench email draft create` — POST /api/v1/email/drafts */
   "email.drafts.create": {
     organizationId?: string;
@@ -2261,13 +2365,13 @@ export interface ApiRequests {
   "email.drafts.signature": {
     draftId: string;
   };
-  /** Send through a native Gmail or Outlook mailbox with a durable request receipt. Only use for an explicit send request. — `dench email send --mailbox` — POST /api/v1/email/native/send */
+  /** Send through a native Gmail or Outlook mailbox with a durable request receipt. Only use for an explicit send request. — `dench email send [--mailbox <id/email>]` — POST /api/v1/email/native/send */
   "email.native.send": {
     organizationId?: string;
     threadId?: string;
     mailbox?: string;
     requestId: string;
-    to?: {
+    to: {
       email: string;
       name?: string;
     }[];
@@ -2289,7 +2393,7 @@ export interface ApiRequests {
       size: number;
     }[];
   };
-  /** Send one raw email (no campaign): to/cc/bcc, custom from-name and reply-to, optional reply threading via replyToMessageId. — `dench email send` — POST /api/v1/email/send */
+  /** Send one raw email (no campaign): to/cc/bcc, custom from-name and reply-to, optional reply threading via replyToMessageId. — `dench email send --from <verified-email>` — POST /api/v1/email/send */
   "email.send": {
     /** Verified sender mailbox. */
     fromEmail: string;
@@ -3165,7 +3269,7 @@ export interface ApiRequests {
     /** Execution ref from a prior search, OR pass session_id+tool_slug. */
     execution_ref?: string;
     session_id?: string;
-    /** Tool slug, e.g. GMAIL_FETCH_EMAILS. */
+    /** Tool slug, e.g. SLACK_LIST_CHANNELS. */
     tool_slug?: string;
     /** Tool arguments object. */
     arguments?: Record<string, unknown>;
@@ -3193,30 +3297,34 @@ export interface ApiRequests {
   "browser.session.status": Record<string, unknown>;
   /** Stop a Dench Browser session and release the remote browser. — `dench browser session stop` — DELETE /api/v1/browser/sessions/{sessionId} */
   "browser.session.stop": Record<string, unknown>;
-  /** Read IDENTITY.md. — `dench identity show` — GET /api/v1/agent-config/identity */
+  /** Read IDENTITY.md. — `dench context --sections identity` — GET /api/v1/agent-config/identity */
   "agentConfig.identity.show": Record<string, unknown>;
-  /** Update IDENTITY.md. — `dench identity edit` — PUT /api/v1/agent-config/identity */
+  /** Update IDENTITY.md. — `dench context set identity` — PUT /api/v1/agent-config/identity */
   "agentConfig.identity.edit": {
     content: string;
   };
-  /** Read ORGANISATION.md. — `dench organisation show` — GET /api/v1/agent-config/organisation */
+  /** Read ORGANISATION.md. — `dench context --sections organisation` — GET /api/v1/agent-config/organisation */
   "agentConfig.organisation.show": Record<string, unknown>;
-  /** Update ORGANISATION.md. — `dench organisation edit` — PUT /api/v1/agent-config/organisation */
+  /** Update ORGANISATION.md. — `dench context set organisation` — PUT /api/v1/agent-config/organisation */
   "agentConfig.organisation.edit": {
     content: string;
   };
-  /** Read USER.md. — `dench user show` — GET /api/v1/agent-config/user */
+  /** Read USER.md. — `dench context --sections user` — GET /api/v1/agent-config/user */
   "agentConfig.user.show": Record<string, unknown>;
-  /** Update USER.md. — `dench user edit` — PUT /api/v1/agent-config/user */
+  /** Update USER.md. — `dench context set user` — PUT /api/v1/agent-config/user */
   "agentConfig.user.edit": {
     content: string;
   };
-  /** Read tool notes. — `dench tools show` — GET /api/v1/agent-config/tools */
+  /** Read tool notes. — `dench context --sections tools` — GET /api/v1/agent-config/tools */
   "agentConfig.tools.show": Record<string, unknown>;
-  /** Update tool notes. — `dench tools notes-edit` — PUT /api/v1/agent-config/tools */
+  /** Update tool notes. — `dench context set tools` — PUT /api/v1/agent-config/tools */
   "agentConfig.tools.edit": {
     content: string;
   };
+  /** Update standing workspace rules; credentials belong in secrets and runnable setup in environments. — `dench context set rules` — PUT /api/v1/context/rules */
+  "workspace.context.rules.set": {
+    content: string;
+  };
   /** Read aggregate memory. — `dench mem show` — GET /api/v1/agent-config/mem */
   "agentConfig.mem.show": Record<string, unknown>;
   /** Update aggregate memory. — `dench mem set` — PUT /api/v1/agent-config/mem */
@@ -3305,6 +3413,20 @@ export interface ApiRequests {
 }
 
 export interface ApiResponses {
+  "environments.list": unknown;
+  "environments.get": unknown;
+  "environments.upload": unknown;
+  "environments.save": unknown;
+  "environments.delete": unknown;
+  "secrets.list": unknown;
+  "secrets.set": {
+    name: string;
+    kind: "env" | "file";
+    version: number;
+    revision: number;
+    status: "stored";
+  };
+  "secrets.delete": unknown;
   "campaigns.drafts.create": {
     sequenceId: string;
   };
@@ -4097,6 +4219,16 @@ export interface ApiResponses {
     updatedAt: number;
     [key: string]: unknown;
   }>;
+  "crm.objects.listCompact": Array<{
+    _id: string;
+    name: string;
+    displayName: string;
+    description?: string;
+    entryCount: number | null;
+    countScope: "workspace" | "private_unknown";
+    visibility: "workspace" | "owner_only" | "owner_plus_members";
+    archived: boolean;
+  }>;
   "crm.objects.get": {
     _id: string;
     _creationTime: number;
@@ -4235,6 +4367,18 @@ export interface ApiResponses {
     updatedAt: number;
     [key: string]: unknown;
   }>;
+  "crm.fields.listCompact": {
+    _id: string;
+    name: string;
+    type: string;
+    required: boolean;
+    readOnly: boolean;
+    defaultValue?: string;
+    enumValues?: string[];
+    enumMultiple: boolean;
+    relatedObjectId?: string;
+    relationshipType?: string;
+  }[];
   "crm.fields.create": {
     id: string;
   };
@@ -4576,6 +4720,19 @@ export interface ApiResponses {
     updatedBy: string;
     [key: string]: unknown;
   }[];
+  "crm.search.page": {
+    page: {
+      _id: string;
+      objectId: string;
+      /** Field-name -> cell value map. */
+      data: Record<string, unknown>;
+    }[];
+    isDone: boolean;
+    continueCursor: string | null;
+    returnedCount: number;
+    selectedFields: string[] | null;
+    completeness: "page";
+  };
   "crm.statuses.list": {
     _id: string;
     _creationTime: number;
@@ -5447,6 +5604,150 @@ export interface ApiResponses {
       disabled: boolean;
     }[];
   };
+  "email.inbox.search": {
+    page: Array<{
+      messageHandle: string;
+      threadHandle: string;
+      mailboxId: string;
+      from: {
+        email: string;
+        name?: string;
+      };
+      to: {
+        email: string;
+        name?: string;
+      }[];
+      subject: string;
+      at: number;
+      dateSource: "sentAt" | "createdAt";
+      direction: "inbound" | "outbound";
+      status: string;
+      hasAttachments: boolean;
+      headersTruncated: boolean;
+    }>;
+    continueCursor: string | null;
+    isDone: boolean;
+    coverage: {
+      source: "synced";
+      scope: "mailbox_linked_messages";
+      mailboxId: string;
+      mailboxEmail: string;
+      mailboxStatus: string;
+      ingestionMode: string;
+      phase: string;
+      syncStatus: string | null;
+      lastPolledAt: number | null;
+      lastBackfillCompletedAt: number | null;
+      oldestSeenAt: number | null;
+      backfillStatus: string | null;
+      backfillCapped: boolean;
+      providerComplete: false;
+      privacyLimited: boolean;
+    };
+    order: "sentAt_desc_then_undated";
+  };
+  "email.inbox.thread": {
+    page: Array<{
+      messageHandle: string;
+      threadHandle: string;
+      mailboxId: string;
+      from: {
+        email: string;
+        name?: string;
+      };
+      to: {
+        email: string;
+        name?: string;
+      }[];
+      subject: string;
+      at: number;
+      dateSource: "sentAt" | "createdAt";
+      direction: "inbound" | "outbound";
+      status: string;
+      hasAttachments: boolean;
+      headersTruncated: boolean;
+    }>;
+    continueCursor: string | null;
+    isDone: boolean;
+    coverage: {
+      source: "synced";
+      scope: "mailbox_linked_messages";
+      mailboxId: string;
+      mailboxEmail: string;
+      mailboxStatus: string;
+      ingestionMode: string;
+      phase: string;
+      syncStatus: string | null;
+      lastPolledAt: number | null;
+      lastBackfillCompletedAt: number | null;
+      oldestSeenAt: number | null;
+      backfillStatus: string | null;
+      backfillCapped: boolean;
+      providerComplete: false;
+      privacyLimited: boolean;
+    };
+    order: "sentAt_desc_then_undated";
+  };
+  "email.inbox.message": {
+    header: {
+      messageHandle: string;
+      threadHandle: string;
+      mailboxId: string;
+      from: {
+        email: string;
+        name?: string;
+      };
+      to: {
+        email: string;
+        name?: string;
+      }[];
+      subject: string;
+      at: number;
+      dateSource: "sentAt" | "createdAt";
+      direction: "inbound" | "outbound";
+      status: string;
+      hasAttachments: boolean;
+      headersTruncated: boolean;
+    };
+    coverage: {
+      source: "synced";
+      scope: "mailbox_linked_messages";
+      mailboxId: string;
+      mailboxEmail: string;
+      mailboxStatus: string;
+      ingestionMode: string;
+      phase: string;
+      syncStatus: string | null;
+      lastPolledAt: number | null;
+      lastBackfillCompletedAt: number | null;
+      oldestSeenAt: number | null;
+      backfillStatus: string | null;
+      backfillCapped: boolean;
+      providerComplete: false;
+      privacyLimited: boolean;
+    };
+    body: {
+      format: "text" | "html";
+      content: string;
+      truncated: boolean;
+      totalBytes: number;
+    };
+    recipients: {
+      to: {
+        email: string;
+        name?: string;
+      }[];
+      cc: {
+        email: string;
+        name?: string;
+      }[];
+      bcc: {
+        email: string;
+        name?: string;
+      }[];
+      truncated: boolean;
+    };
+  };
   "email.drafts.create": {
     ok: boolean;
     kind: "email";
@@ -7034,6 +7335,7 @@ export interface ApiResponses {
       template?: string;
     };
   };
+  "workspace.context.rules.set": unknown;
   "agentConfig.mem.show": {
     agentConfig: {
       identity: {
@@ -7345,9 +7647,9 @@ export type DenchApiTree = {
       today(args?: Req<"agentConfig.daily.today">): Promise<Res<"agentConfig.daily.today">>;
     };
     identity: {
-      /** Update IDENTITY.md. (`dench identity edit`) */
+      /** Update IDENTITY.md. (`dench context set identity`) */
       edit(args: Req<"agentConfig.identity.edit">): Promise<Res<"agentConfig.identity.edit">>;
-      /** Read IDENTITY.md. (`dench identity show`) */
+      /** Read IDENTITY.md. (`dench context --sections identity`) */
       show(args?: Req<"agentConfig.identity.show">): Promise<Res<"agentConfig.identity.show">>;
     };
     mem: {
@@ -7363,21 +7665,21 @@ export type DenchApiTree = {
       thread(args: Req<"agentConfig.model.thread">): Promise<Res<"agentConfig.model.thread">>;
     };
     organisation: {
-      /** Update ORGANISATION.md. (`dench organisation edit`) */
+      /** Update ORGANISATION.md. (`dench context set organisation`) */
       edit(args: Req<"agentConfig.organisation.edit">): Promise<Res<"agentConfig.organisation.edit">>;
-      /** Read ORGANISATION.md. (`dench organisation show`) */
+      /** Read ORGANISATION.md. (`dench context --sections organisation`) */
       show(args?: Req<"agentConfig.organisation.show">): Promise<Res<"agentConfig.organisation.show">>;
     };
     tools: {
-      /** Update tool notes. (`dench tools notes-edit`) */
+      /** Update tool notes. (`dench context set tools`) */
       edit(args: Req<"agentConfig.tools.edit">): Promise<Res<"agentConfig.tools.edit">>;
-      /** Read tool notes. (`dench tools show`) */
+      /** Read tool notes. (`dench context --sections tools`) */
       show(args?: Req<"agentConfig.tools.show">): Promise<Res<"agentConfig.tools.show">>;
     };
     user: {
-      /** Update USER.md. (`dench user edit`) */
+      /** Update USER.md. (`dench context set user`) */
       edit(args: Req<"agentConfig.user.edit">): Promise<Res<"agentConfig.user.edit">>;
-      /** Read USER.md. (`dench user show`) */
+      /** Read USER.md. (`dench context --sections user`) */
       show(args?: Req<"agentConfig.user.show">): Promise<Res<"agentConfig.user.show">>;
     };
   };
@@ -7770,6 +8072,8 @@ export type DenchApiTree = {
       };
       /** List fields for a CRM object, including read-only calculation metadata. (`dench crm fields list`) */
       list(args: Req<"crm.fields.list">): Promise<Res<"crm.fields.list">>;
+      /** List field names, types and effective constraints without indexing or enrichment internals. (`dench crm fields list --compact`) */
+      listCompact(args: Req<"crm.fields.listCompact">): Promise<Res<"crm.fields.listCompact">>;
       /** Reorder CRM fields. (`dench crm fields reorder`) */
       reorder(args: Req<"crm.fields.reorder">): Promise<Res<"crm.fields.reorder">>;
       /** Update a CRM field or change/explicitly clear an existing campaign calculation. (`dench crm fields update`) */
@@ -7796,6 +8100,8 @@ export type DenchApiTree = {
       get(args: Req<"crm.objects.get">): Promise<Res<"crm.objects.get">>;
       /** List CRM objects. (`dench crm objects list`) */
       list(args?: Req<"crm.objects.list">): Promise<Res<"crm.objects.list">>;
+      /** List names, display labels, visibility and workspace counts without internal state. (`dench crm objects list --compact`) */
+      listCompact(args?: Req<"crm.objects.listCompact">): Promise<Res<"crm.objects.listCompact">>;
       /** Rename a CRM object. (`dench crm objects rename`) */
       rename(args: Req<"crm.objects.rename">): Promise<Res<"crm.objects.rename">>;
       /** Restore a CRM object's workspace sidebar row. Admin-only. (`dench crm objects unarchive`) */
@@ -7821,8 +8127,13 @@ export type DenchApiTree = {
       /** Generate a CRM report. (`dench crm reports generate`) */
       generate(args: Req<"crm.reports.generate">): Promise<Res<"crm.reports.generate">>;
     };
-    /** Search CRM entries. (`dench crm search`) */
-    search(args?: Req<"crm.search">): Promise<Res<"crm.search">>;
+    search: {
+      /** Search CRM entries. (`dench crm search`) */
+      (args?: Req<"crm.search">): Promise<Res<"crm.search">>;
+      $call(args?: Req<"crm.search">): Promise<Res<"crm.search">>;
+      /** Search bounded pages of readable CRM entries, optionally projecting cells. Always follow continueCursor until isDone. (`dench crm search --page`) */
+      page(args?: Req<"crm.search.page">): Promise<Res<"crm.search.page">>;
+    };
     sidebar: {
       groups: {
         /** Create a named sidebar group (e.g. "Hiring") in the workspace-shared Library. Open to any member. (`dench crm sidebar group create`) */
@@ -8035,6 +8346,14 @@ export type DenchApiTree = {
       /** Start Dench Emailing Service sender verification. (`dench email identity verify`) */
       verify(args: Req<"email.identity.verify">): Promise<Res<"email.identity.verify">>;
     };
+    inbox: {
+      /** Read a bounded stored body using an exact message handle from inbox search; rechecks mailbox and record privacy. (`dench email inbox message`) */
+      message(args: Req<"email.inbox.message">): Promise<Res<"email.inbox.message">>;
+      /** Search authorized synced mailbox headers with bounded cursor pagination. isDone covers stored records, not provider completeness. (`dench email inbox search`) */
+      search(args?: Req<"email.inbox.search">): Promise<Res<"email.inbox.search">>;
+      /** Read a bounded page of synced headers using an exact thread handle from inbox search; bodies remain on demand. (`dench email inbox thread`) */
+      thread(args: Req<"email.inbox.thread">): Promise<Res<"email.inbox.thread">>;
+    };
     message: {
       /** Read a raw email message's status and open/click counters. (`dench email message status`) */
       get(args: Req<"email.message.get">): Promise<Res<"email.message.get">>;
@@ -8042,10 +8361,10 @@ export type DenchApiTree = {
       list(args?: Req<"email.message.list">): Promise<Res<"email.message.list">>;
     };
     native: {
-      /** Send through a native Gmail or Outlook mailbox with a durable request receipt. Only use for an explicit send request. (`dench email send --mailbox`) */
+      /** Send through a native Gmail or Outlook mailbox with a durable request receipt. Only use for an explicit send request. (`dench email send [--mailbox <id/email>]`) */
       send(args: Req<"email.native.send">): Promise<Res<"email.native.send">>;
     };
-    /** Send one raw email (no campaign): to/cc/bcc, custom from-name and reply-to, optional reply threading via replyToMessageId. (`dench email send`) */
+    /** Send one raw email (no campaign): to/cc/bcc, custom from-name and reply-to, optional reply threading via replyToMessageId. (`dench email send --from <verified-email>`) */
     send(args: Req<"email.send">): Promise<Res<"email.send">>;
     sequence: {
       /** Activate a sequence so its enrollments begin sending. (`dench email sequence activate`) */
@@ -8124,6 +8443,18 @@ export type DenchApiTree = {
       preview(args: Req<"enrichment.search.preview">): Promise<Res<"enrichment.search.preview">>;
     };
   };
+  environments: {
+    /** Retire a saved setup from new selection; retain immutable revisions and active job evidence. (`dench env delete`) */
+    delete(args: Req<"environments.delete">): Promise<Res<"environments.delete">>;
+    /** Inspect a saved setup, its manifest, and an optional immutable revision. (`dench env show`) */
+    get(args: Req<"environments.get">): Promise<Res<"environments.get">>;
+    /** List workspace-shared reusable setups and ready revisions (metadata only). (`dench env list`) */
+    list(args?: Req<"environments.list">): Promise<Res<"environments.list">>;
+    /** Publish an explicitly saved source and manifest for one-time preparation. Returns pending/building until verified; does not run the task. (`dench env save`) */
+    save(args: Req<"environments.save">): Promise<Res<"environments.save">>;
+    /** Reserve an owner-bound source upload. Prefix the uploaded bytes with the returned proof before saving. (`dench env save`) */
+    upload(args: Req<"environments.upload">): Promise<Res<"environments.upload">>;
+  };
   files: {
     /** Read a workspace file's text. (`dench files cat`) */
     content(args?: Req<"files.content">): Promise<Res<"files.content">>;
@@ -8268,6 +8599,14 @@ export type DenchApiTree = {
     /** Search the web through the Dench gateway. (`dench search`) */
     web(args: Req<"search.web">): Promise<Res<"search.web">>;
   };
+  secrets: {
+    /** Revoke a workspace credential for future resolution, optionally checking its version. (`dench secrets delete`) */
+    delete(args: Req<"secrets.delete">): Promise<Res<"secrets.delete">>;
+    /** List workspace-shared credential names, kinds and versions; never values. (`dench secrets list`) */
+    list(args?: Req<"secrets.list">): Promise<Res<"secrets.list">>;
+    /** Encrypt a workspace credential. Use CLI stdin or the secure chat form; return metadata only. Do not put values in chat, manifests or scripts. (`dench secrets set`) */
+    set(args: Req<"secrets.set">): Promise<Res<"secrets.set">>;
+  };
   settings: {
     sync: {
       /** Read the workspace's Sync switches (accounts from email, contacts from LinkedIn, Slack Connect, calendar, dossier, tasks from email, lead auto-qualify, summaries and Brief). All on by default. (`dench settings sync`) */
@@ -8337,6 +8676,10 @@ export type DenchApiTree = {
       /** Return the current Dench workspace context for the bearer. (`dench context`) */
       (args?: Req<"workspace.context">): Promise<Res<"workspace.context">>;
       $call(args?: Req<"workspace.context">): Promise<Res<"workspace.context">>;
+      rules: {
+        /** Update standing workspace rules; credentials belong in secrets and runnable setup in environments. (`dench context set rules`) */
+        set(args: Req<"workspace.context.rules.set">): Promise<Res<"workspace.context.rules.set">>;
+      };
       /** Read selected scoped workspace documents and a compact context index without writes. (`dench context --sections`) */
       sections(args?: Req<"workspace.context.sections">): Promise<Res<"workspace.context.sections">>;
     };

package/chat-spawn.ts

@@ -16,7 +16,7 @@
  * (`/api/chat/[runId]/stream`) and pretty-prints text deltas + tool
  * calls until the workflow finishes.
  */
-import { hasFlag } from "./lib/cli-args";
+import { assertNoUnknownFlags, hasFlag } from "./lib/cli-args";
 
 class ChatSpawnError extends Error {}
 
@@ -47,6 +47,10 @@ function consumeFlagValue(args: string[], name: string): string | undefined {
   const idx = args.indexOf(name);
   if (idx === -1) return undefined;
   const value = args[idx + 1];
+  if (!value || value.startsWith("--"))
+    throw new ChatSpawnError(`${name} requires a value.`);
+  if (args.indexOf(name, idx + 1) !== -1)
+    throw new ChatSpawnError(`Duplicate flag: ${name}`);
   args.splice(idx, 2);
   return value;
 }
@@ -372,17 +376,21 @@ function joinPositionalsExceptFlags(args: string[]): string {
 }
 
 async function runChatNew(ctx: ChatSpawnContext): Promise<void> {
+  const environment = consumeFlagValue(ctx.args, "--environment");
+  if (environment !== undefined && !/^[a-z][a-z0-9-]{0,63}$/.test(environment))
+    throw new ChatSpawnError("Invalid environment name");
   const model = consumeFlagValue(ctx.args, "--model");
   const fileContextPath = consumeFlagValue(ctx.args, "--file-context");
   const visibility = consumeFlagValue(ctx.args, "--visibility");
   const title = consumeFlagValue(ctx.args, "--title");
   const yolo = consumeFlag(ctx.args, "--yolo");
   const follow = consumeFlag(ctx.args, "--follow");
+  assertNoUnknownFlags(ctx.args, "chat new");
 
   const prompt = joinPositionalsExceptFlags(ctx.args);
   if (!prompt) {
     throw new ChatSpawnError(
-      'Usage: dench chat new "<prompt>" [--model M] [--file-context PATH] [--visibility private|shared] [--title T] [--yolo] [--follow] [--json]',
+      'Usage: dench chat new "<prompt>" [--environment NAME] [--model M] [--file-context PATH] [--visibility private|shared] [--title T] [--yolo] [--follow] [--json]',
     );
   }
 
@@ -391,6 +399,7 @@ async function runChatNew(ctx: ChatSpawnContext): Promise<void> {
     ctx.runtime.bearerToken,
     {
       prompt,
+      ...(environment ? { environment } : {}),
       model,
       fileContextPath,
       visibility,

package/chat.ts

@@ -145,7 +145,7 @@ PERMANENTLY delete one or more past chat threads (and all their messages):
     server REFUSES to delete them unless \`--include-automated\` is set.
 
 Spawn a new chat-turn workflow (same agent loop as the web UI):
-  dench chat new "<prompt>" [--model <m>] [--file-context <path>] [--visibility private|shared] [--title T] [--yolo] [--follow] [--json]
+  dench chat new "<prompt>" [--environment NAME] [--model <m>] [--file-context <path>] [--visibility private|shared] [--title T] [--yolo] [--follow] [--json]
   dench chat send <thread-id> "<message>" [--model <m>] [--yolo] [--follow] [--json]
   dench chat follow <thread-id> [--json]
   dench chat tree [<root-thread-id>] [--limit N] [--json]