@dench.com/cli 3.6.6-staging.386 → 3.8.0-staging.389

package/lib/api-schemas.ts

@@ -57,6 +57,48 @@ const nativeEmailCreate = z.object({
   requestId: z.string(),
   ...nativeEmailContent,
 });
+const inboxHeader = z.object({
+  messageHandle: z.string(),
+  threadHandle: z.string(),
+  mailboxId: z.string(),
+  from: nativeEmailRecipient,
+  to: z.array(nativeEmailRecipient),
+  subject: z.string(),
+  at: z.number(),
+  dateSource: z.enum(["sentAt", "createdAt"]),
+  direction: z.enum(["inbound", "outbound"]),
+  status: z.string(),
+  hasAttachments: z.boolean(),
+  headersTruncated: z.boolean(),
+});
+const inboxCoverage = z.object({
+  source: z.literal("synced"),
+  scope: z.literal("mailbox_linked_messages"),
+  mailboxId: z.string(),
+  mailboxEmail: z.string(),
+  mailboxStatus: z.string(),
+  ingestionMode: z.string(),
+  phase: z.string(),
+  syncStatus: z.string().nullable(),
+  lastPolledAt: z.number().nullable(),
+  lastBackfillCompletedAt: z.number().nullable(),
+  oldestSeenAt: z.number().nullable(),
+  backfillStatus: z.string().nullable(),
+  backfillCapped: z.boolean(),
+  providerComplete: z.literal(false),
+  privacyLimited: z.boolean(),
+});
+const inboxPaging = {
+  limit: z.coerce.number().int().min(1).max(50).optional(),
+  cursor: z.string().optional(),
+};
+const inboxPage = z.object({
+  page: z.array(inboxHeader),
+  continueCursor: z.string().nullable(),
+  isDone: z.boolean(),
+  coverage: inboxCoverage,
+  order: z.literal("sentAt_desc_then_undated"),
+});
 const nativeEmailReceipt = z
   .object({
     ok: z.boolean(),
@@ -2118,7 +2160,7 @@ const composioToolRun = z.object({
   tool_slug: z
     .string()
     .optional()
-    .describe("Tool slug, e.g. GMAIL_FETCH_EMAILS."),
+    .describe("Tool slug, e.g. SLACK_LIST_CHANNELS."),
   arguments: z
     .record(z.string(), z.unknown())
     .optional()
@@ -3392,8 +3434,34 @@ export const requestSchemas: Record<string, ZodTypeAny> = {
       )
       .optional(),
   }),
+  "email.inbox.search": z.object({
+    ...inboxPaging,
+    mailbox: z.string().optional(),
+    from: z.string().min(1).max(500).optional(),
+    to: z.string().min(1).max(500).optional(),
+    subject: z.string().min(1).max(500).optional(),
+    after: z.coerce
+      .number()
+      .optional()
+      .describe(
+        "Inclusive Unix milliseconds; missing sentAt falls back to createdAt.",
+      ),
+    before: z.coerce
+      .number()
+      .optional()
+      .describe("Exclusive Unix milliseconds."),
+    direction: z.enum(["inbound", "outbound"]).optional(),
+  }),
+  "email.inbox.thread": z.object({ ...inboxPaging, threadHandle: z.string() }),
+  "email.inbox.message": z.object({
+    messageHandle: z.string(),
+    format: z.enum(["text", "html"]).optional(),
+    maxBytes: z.coerce.number().int().min(1).max(100000).optional(),
+  }),
   "email.drafts.create": nativeEmailCreate,
-  "email.native.send": nativeEmailCreate,
+  "email.native.send": nativeEmailCreate.extend({
+    to: z.array(nativeEmailRecipient).min(1),
+  }),
   "email.drafts.get": z.object({ draftId: z.string() }),
   "email.drafts.senders": z.object({ organizationId: z.string().optional() }),
   "email.drafts.update": z.object({
@@ -3516,6 +3584,10 @@ export const requestSchemas: Record<string, ZodTypeAny> = {
     includeAutomated: z.boolean().optional(),
   }),
   "chat.new": z.object({
+    environment: z
+      .string()
+      .regex(/^[a-z][a-z0-9-]{0,63}$/)
+      .optional(),
     prompt: z.string().describe("The user message that starts the turn."),
     model: z.string().optional(),
     fileContextPath: z.string().optional(),
@@ -3536,6 +3608,7 @@ export const requestSchemas: Record<string, ZodTypeAny> = {
 
   // CRM objects
   "crm.objects.list": noInput,
+  "crm.objects.listCompact": noInput,
   "crm.objects.get": z.object({ name: z.string() }),
   "crm.objects.create": z.object({
     name: z.string().describe("Object name (lowercased, singular)."),
@@ -3631,6 +3704,7 @@ export const requestSchemas: Record<string, ZodTypeAny> = {
 
   // CRM fields
   "crm.fields.list": z.object({ objectName: z.string() }),
+  "crm.fields.listCompact": z.object({ objectName: z.string() }),
   "crm.fields.create": z.object({
     objectName: z.string(),
     name: z.string(),
@@ -4163,6 +4237,18 @@ export const requestSchemas: Record<string, ZodTypeAny> = {
         "Number field to total per bucket (e.g. Amount grouped by Stage). Exact at any table size.",
       ),
   }),
+  "crm.search.page": z.object({
+    text: z.string().describe("Full-text query over readable entries."),
+    objectName: z.string().optional(),
+    select: z.array(z.string().min(1)).min(1).max(30).optional(),
+    limit: z.coerce.number().int().min(1).max(100).optional(),
+    cursor: z
+      .string()
+      .optional()
+      .describe(
+        "Use the preceding continueCursor, with the same query and projection.",
+      ),
+  }),
   "crm.search": z.object({
     text: z.string().describe("Full-text query."),
     objectName: z.string().optional().describe("Omit to search org-wide."),
@@ -5157,6 +5243,24 @@ export const responseSchemas: Record<string, ZodTypeAny> = {
 
   // Workspace orientation
   "workspace.context.sections": z.object({}).passthrough(),
+  "email.inbox.search": inboxPage,
+  "email.inbox.thread": inboxPage,
+  "email.inbox.message": z.object({
+    header: inboxHeader,
+    coverage: inboxCoverage,
+    body: z.object({
+      format: z.enum(["text", "html"]),
+      content: z.string(),
+      truncated: z.boolean(),
+      totalBytes: z.number(),
+    }),
+    recipients: z.object({
+      to: z.array(nativeEmailRecipient),
+      cc: z.array(nativeEmailRecipient),
+      bcc: z.array(nativeEmailRecipient),
+      truncated: z.boolean(),
+    }),
+  }),
   "email.drafts.create": nativeEmailReceipt,
   "email.drafts.get": nativeEmailReceipt,
   "email.drafts.update": nativeEmailReceipt,
@@ -5283,6 +5387,18 @@ export const responseSchemas: Record<string, ZodTypeAny> = {
 
   // CRM objects
   "crm.objects.list": z.array(crmObjectDoc),
+  "crm.objects.listCompact": z.array(
+    z.object({
+      _id: z.string(),
+      name: z.string(),
+      displayName: z.string(),
+      description: z.string().optional(),
+      entryCount: z.number().nullable(),
+      countScope: z.enum(["workspace", "private_unknown"]),
+      visibility: z.enum(["workspace", "owner_only", "owner_plus_members"]),
+      archived: z.boolean(),
+    }),
+  ),
   "crm.objects.get": crmObjectDoc.nullable(),
   "crm.objects.create": z.object({ id: z.string() }),
   "crm.objects.update": okResponse,
@@ -5337,6 +5453,20 @@ export const responseSchemas: Record<string, ZodTypeAny> = {
 
   // CRM fields
   "crm.fields.list": z.array(crmFieldDoc),
+  "crm.fields.listCompact": z.array(
+    z.object({
+      _id: z.string(),
+      name: z.string(),
+      type: z.string(),
+      required: z.boolean(),
+      readOnly: z.boolean(),
+      defaultValue: z.string().optional(),
+      enumValues: z.array(z.string()).optional(),
+      enumMultiple: z.boolean(),
+      relatedObjectId: z.string().optional(),
+      relationshipType: z.string().optional(),
+    }),
+  ),
   "crm.fields.create": z.object({ id: z.string() }),
   "crm.fields.update": okResponse,
   "crm.fields.delete": okResponse,
@@ -5493,6 +5623,16 @@ export const responseSchemas: Record<string, ZodTypeAny> = {
       sumNumber: z.number().optional(),
     }),
   ),
+  "crm.search.page": z.object({
+    page: z.array(
+      z.object({ _id: z.string(), objectId: z.string(), data: fieldsMap }),
+    ),
+    isDone: z.boolean(),
+    continueCursor: z.string().nullable(),
+    returnedCount: z.number(),
+    selectedFields: z.array(z.string()).nullable(),
+    completeness: z.literal("page"),
+  }),
   "crm.search": z.array(
     z
       .object({
@@ -6217,6 +6357,12 @@ export const convexExtras: Record<string, ConvexExtras> = {
 // ---------------------------------------------------------------------------
 
 export const requestExamples: Record<string, unknown> = {
+  "email.native.send": {
+    requestId: "send-intro-001",
+    to: [{ email: "ada@example.com", name: "Ada" }],
+    subject: "Introduction",
+    textBody: "Hello Ada",
+  },
   "campaigns.accounts.linkedin": {},
   "campaigns.create": {
     name: "Founder outreach",
@@ -6470,11 +6616,11 @@ export const requestExamples: Record<string, unknown> = {
     input_images_base64: ["iVBORw0KGgoAAAANSUhEUg..."],
   },
   "tool.search": {
-    queries: [{ use_case: "fetch the 10 most recent emails" }],
+    queries: [{ use_case: "list Slack channels" }],
   },
   "tool.run": {
-    tool_slug: "GMAIL_FETCH_EMAILS",
-    arguments: { max_results: 10 },
+    tool_slug: "SLACK_LIST_CHANNELS",
+    arguments: { limit: 10 },
   },
   "crm.people.search": {
     titles: ["Head of Sales"],
@@ -8019,18 +8165,18 @@ export const responseExamples: Record<string, unknown> = {
     error: null,
     results: [
       {
-        use_case: "fetch recent emails",
-        primary_tool_slugs: ["GMAIL_FETCH_EMAILS"],
-        toolkits: ["gmail"],
+        use_case: "list Slack channels",
+        primary_tool_slugs: ["SLACK_LIST_CHANNELS"],
+        toolkits: ["slack"],
       },
     ],
     toolkit_connection_statuses: [
-      { toolkit: "gmail", has_active_connection: true },
+      { toolkit: "slack", has_active_connection: true },
     ],
     tool_schemas: {
-      GMAIL_FETCH_EMAILS: {
-        toolkit: "gmail",
-        tool_slug: "GMAIL_FETCH_EMAILS",
+      SLACK_LIST_CHANNELS: {
+        toolkit: "slack",
+        tool_slug: "SLACK_LIST_CHANNELS",
         execution_ref: "eyJzZXNzaW9uIjoi...",
         execution_ref_version: 1,
       },
@@ -8039,11 +8185,11 @@ export const responseExamples: Record<string, unknown> = {
     execution_ref_version: 1,
   },
   "tool.run": {
-    data: { messages: [{ id: "msg01", subject: "Quick intro" }] },
+    data: { channels: [{ id: "C_EXAMPLE", name: "general" }] },
     error: null,
     log_id: "log_exec_01",
     execution_mode: "gateway_tool_router",
-    tool_slug: "GMAIL_FETCH_EMAILS",
+    tool_slug: "SLACK_LIST_CHANNELS",
     tool_router_session_id: "trs_abc123",
   },
   "tool.disconnect": { id: "ca_github01", deleted: true },

package/lib/app-sdk-catalog.generated.ts

@@ -53,6 +53,8 @@ export const APP_SDK_SCOPES = [
   "cron:schedule",
   "email:read",
   "email:write",
+  "environments:read",
+  "environments:write",
   "files:read",
   "files:write",
   "http:external",
@@ -70,6 +72,8 @@ export const APP_SDK_SCOPES = [
   "notifications:read",
   "notifications:write",
   "search:read",
+  "secrets:read",
+  "secrets:write",
   "settings:read",
   "settings:write",
   "store:read",
@@ -77,12 +81,21 @@ export const APP_SDK_SCOPES = [
   "ui",
   "web:read",
   "webhooks:receive",
-  "workspace:read"
+  "workspace:read",
+  "workspace:write"
 ] as const;
 export type AppSdkScope = (typeof APP_SDK_SCOPES)[number];
 
 /** Every public /api/v1 operation reachable through dench.api.call. */
 export const APP_SDK_OPERATIONS: readonly AppSdkOperationInfo[] = [
+  {"id":"environments.list","group":"environments","summary":"List workspace-shared reusable setups and ready revisions (metadata only).","cli":"dench env list","method":"GET","path":"/environments","permission":"environments:read","pathParams":[]},
+  {"id":"environments.get","group":"environments","summary":"Inspect a saved setup, its manifest, and an optional immutable revision.","cli":"dench env show","method":"GET","path":"/environments/{name}","permission":"environments:read","pathParams":["name"]},
+  {"id":"environments.upload","group":"environments","summary":"Reserve an owner-bound source upload. Prefix the uploaded bytes with the returned proof before saving.","cli":"dench env save","method":"POST","path":"/environments/uploads","permission":"environments:write","pathParams":[]},
+  {"id":"environments.save","group":"environments","summary":"Publish an explicitly saved source and manifest for one-time preparation. Returns pending/building until verified; does not run the task.","cli":"dench env save","method":"POST","path":"/environments/{name}","permission":"environments:write","pathParams":["name"]},
+  {"id":"environments.delete","group":"environments","summary":"Retire a saved setup from new selection; retain immutable revisions and active job evidence.","cli":"dench env delete","method":"DELETE","path":"/environments/{name}","permission":"environments:write","pathParams":["name"]},
+  {"id":"secrets.list","group":"secrets","summary":"List workspace-shared credential names, kinds and versions; never values.","cli":"dench secrets list","method":"GET","path":"/secrets","permission":"secrets:read","pathParams":[]},
+  {"id":"secrets.set","group":"secrets","summary":"Encrypt a workspace credential. Use CLI stdin or the secure chat form; return metadata only. Do not put values in chat, manifests or scripts.","cli":"dench secrets set","method":"PUT","path":"/secrets/{name}","permission":"secrets:write","pathParams":["name"]},
+  {"id":"secrets.delete","group":"secrets","summary":"Revoke a workspace credential for future resolution, optionally checking its version.","cli":"dench secrets delete","method":"DELETE","path":"/secrets/{name}","permission":"secrets:write","pathParams":["name"]},
   {"id":"campaigns.drafts.create","group":"campaigns","summary":"Create an idempotent empty campaign draft with the caller's available sender pools. Does not launch or send.","cli":"dench campaign draft","method":"POST","path":"/campaigns/drafts","permission":"campaigns:write","pathParams":[]},
   {"id":"campaigns.audience.search","group":"campaigns","summary":"Search people by filters without adding CRM records or campaign recipients. Search credits apply; this is not a free provider preview.","cli":"dench campaign search","method":"POST","path":"/campaigns/audience/search","permission":"campaigns:write","pathParams":[]},
   {"id":"campaigns.people.addFromSearch","group":"campaigns","summary":"Search and add up to 50 people to an existing campaign. New identities become Leads. Search credits apply; use nextPageToken for another page.","cli":"dench campaign add --search","method":"POST","path":"/campaigns/{sequenceId}/people/search","permission":"campaigns:write","pathParams":["sequenceId"]},
@@ -141,6 +154,7 @@ export const APP_SDK_OPERATIONS: readonly AppSdkOperationInfo[] = [
   {"id":"chat.send","group":"chat","summary":"Send a message to an existing chat thread.","cli":"dench chat send","method":"POST","path":"/chat/threads/{threadId}/messages","permission":"ai:chat","pathParams":["threadId"]},
   {"id":"chat.follow","group":"chat","summary":"Follow a live chat response stream.","cli":"dench chat follow","method":"GET","path":"/chat/threads/{threadId}/stream","permission":"ai:chat","pathParams":["threadId"]},
   {"id":"crm.objects.list","group":"crm","summary":"List CRM objects.","cli":"dench crm objects list","method":"GET","path":"/crm/objects","permission":"crm:read","pathParams":[]},
+  {"id":"crm.objects.listCompact","group":"crm","summary":"List names, display labels, visibility and workspace counts without internal state.","cli":"dench crm objects list --compact","method":"GET","path":"/crm/catalog/objects","permission":"crm:read","pathParams":[]},
   {"id":"crm.objects.get","group":"crm","summary":"Get a CRM object.","cli":"dench crm objects get","method":"GET","path":"/crm/objects/{name}","permission":"crm:read","pathParams":["name"]},
   {"id":"crm.objects.create","group":"crm","summary":"Create a CRM object.","cli":"dench crm objects create","method":"POST","path":"/crm/objects","permission":"crm:write","pathParams":[]},
   {"id":"crm.objects.update","group":"crm","summary":"Update a CRM object.","cli":"dench crm objects update","method":"PATCH","path":"/crm/objects/{name}","permission":"crm:write","pathParams":["name"]},
@@ -165,6 +179,7 @@ export const APP_SDK_OPERATIONS: readonly AppSdkOperationInfo[] = [
   {"id":"crm.sidebar.groups.move-item","group":"crm","summary":"Move a sidebar row into a group (groupId set) or back to the top level (groupId null). Open to any member.","cli":"dench crm sidebar group add","method":"POST","path":"/crm/sidebar/groups/move","permission":"crm:write","pathParams":[]},
   {"id":"crm.sidebar.pins.set","group":"crm","summary":"Pin (pinned true) or unpin a Library row — or a whole group — on the home-level Pinned shortcut strip (the \"tab on the left\"). Does not move the row inside Library. Workspace-shared; open to any member.","cli":"dench crm sidebar pin","method":"POST","path":"/crm/sidebar/pins","permission":"crm:write","pathParams":[]},
   {"id":"crm.fields.list","group":"crm","summary":"List fields for a CRM object, including read-only calculation metadata.","cli":"dench crm fields list","method":"GET","path":"/crm/objects/{objectName}/fields","permission":"crm:read","pathParams":["objectName"]},
+  {"id":"crm.fields.listCompact","group":"crm","summary":"List field names, types and effective constraints without indexing or enrichment internals.","cli":"dench crm fields list --compact","method":"GET","path":"/crm/catalog/objects/{objectName}/fields","permission":"crm:read","pathParams":["objectName"]},
   {"id":"crm.fields.create","group":"crm","summary":"Create a CRM field or read-only campaign activity boolean column.","cli":"dench crm fields create","method":"POST","path":"/crm/objects/{objectName}/fields","permission":"crm:write","pathParams":["objectName"]},
   {"id":"crm.fields.update","group":"crm","summary":"Update a CRM field or change/explicitly clear an existing campaign calculation.","cli":"dench crm fields update","method":"PATCH","path":"/crm/objects/{objectName}/fields/{fieldName}","permission":"crm:write","pathParams":["objectName","fieldName"]},
   {"id":"crm.fields.delete","group":"crm","summary":"Delete a CRM field.","cli":"dench crm fields delete","method":"DELETE","path":"/crm/objects/{objectName}/fields/{fieldName}","permission":"crm:write","pathParams":["objectName","fieldName"]},
@@ -237,6 +252,7 @@ export const APP_SDK_OPERATIONS: readonly AppSdkOperationInfo[] = [
   {"id":"crm.sql","group":"crm","summary":"Run CRM SQL-compatible query.","cli":"dench crm sql","method":"POST","path":"/crm/sql","permission":"crm:read","pathParams":[]},
   {"id":"crm.aggregate","group":"crm","summary":"Aggregate CRM entries.","cli":"dench crm aggregate","method":"POST","path":"/crm/aggregate","permission":"crm:read","pathParams":[]},
   {"id":"crm.search","group":"crm","summary":"Search CRM entries.","cli":"dench crm search","method":"GET","path":"/crm/search","permission":"crm:read","pathParams":[]},
+  {"id":"crm.search.page","group":"crm","summary":"Search bounded pages of readable CRM entries, optionally projecting cells. Always follow continueCursor until isDone.","cli":"dench crm search --page","method":"GET","path":"/crm/search/page","permission":"crm:read","pathParams":[]},
   {"id":"crm.statuses.list","group":"crm","summary":"List CRM statuses.","cli":"dench crm statuses list","method":"GET","path":"/crm/objects/{objectName}/statuses","permission":"crm:read","pathParams":["objectName"]},
   {"id":"crm.statuses.set","group":"crm","summary":"Set CRM statuses.","cli":"dench crm statuses set","method":"PUT","path":"/crm/objects/{objectName}/statuses","permission":"crm:write","pathParams":["objectName"]},
   {"id":"crm.batch","group":"crm","summary":"Apply a CRM batch.","cli":"dench crm batch","method":"POST","path":"/crm/batch","permission":"crm:write","pathParams":[]},
@@ -315,6 +331,9 @@ export const APP_SDK_OPERATIONS: readonly AppSdkOperationInfo[] = [
   {"id":"email.identity.disable","group":"email","summary":"Soft-disable a sender (or every sender on a domain) for the workspace; sends are blocked until restored.","cli":"dench email identity disable","method":"POST","path":"/email/sending-identities/{identity}/disable","permission":"email:write","pathParams":["identity"]},
   {"id":"email.identity.restore","group":"email","summary":"Restore a previously disabled sender for the workspace.","cli":"dench email identity restore","method":"POST","path":"/email/sending-identities/{identity}/restore","permission":"email:write","pathParams":["identity"]},
   {"id":"email.identity.delete","group":"email","summary":"Permanently delete a sender (or every sender on a domain) from the workspace; re-adding it requires verification from scratch.","cli":"dench email identity delete","method":"DELETE","path":"/email/sending-identities/{identity}","permission":"email:write","pathParams":["identity"]},
+  {"id":"email.inbox.search","group":"email","summary":"Search authorized synced mailbox headers with bounded cursor pagination. isDone covers stored records, not provider completeness.","cli":"dench email inbox search","method":"GET","path":"/email/inbox/search","permission":"email:read","pathParams":[]},
+  {"id":"email.inbox.thread","group":"email","summary":"Read a bounded page of synced headers using an exact thread handle from inbox search; bodies remain on demand.","cli":"dench email inbox thread","method":"GET","path":"/email/inbox/threads/{threadHandle}","permission":"email:read","pathParams":["threadHandle"]},
+  {"id":"email.inbox.message","group":"email","summary":"Read a bounded stored body using an exact message handle from inbox search; rechecks mailbox and record privacy.","cli":"dench email inbox message","method":"GET","path":"/email/inbox/messages/{messageHandle}","permission":"email:read","pathParams":["messageHandle"]},
   {"id":"email.drafts.create","group":"email","summary":"Create an editable Dench email draft and synchronize its selected native mailbox asynchronously. Use a stable requestId for retries.","cli":"dench email draft create","method":"POST","path":"/email/drafts","permission":"email:write","pathParams":[]},
   {"id":"email.drafts.get","group":"email","summary":"Read an email draft, eligible senders and provider sync status.","cli":"dench email draft show","method":"GET","path":"/email/drafts/{draftId}","permission":"email:read","pathParams":["draftId"]},
   {"id":"email.drafts.senders","group":"email","summary":"List native mailboxes this caller may use.","cli":"dench email draft senders","method":"GET","path":"/email/drafts/senders","permission":"email:read","pathParams":[]},
@@ -322,8 +341,8 @@ export const APP_SDK_OPERATIONS: readonly AppSdkOperationInfo[] = [
   {"id":"email.drafts.send","group":"email","summary":"Send the current Dench draft revision through its native mailbox. Repeated requests share a durable receipt.","cli":"dench email draft send","method":"POST","path":"/email/drafts/{draftId}/send","permission":"email:write","pathParams":["draftId"]},
   {"id":"email.drafts.upload","group":"email","summary":"Upload attachment bytes authorized against this draft before adding its storage reference.","cli":"dench email draft attach","method":"POST","path":"/email/drafts/{draftId}/attachments","permission":"email:write","pathParams":["draftId"]},
   {"id":"email.drafts.signature","group":"email","summary":"Load the selected mailbox signature for explicit visible insertion.","cli":"dench email draft signature","method":"GET","path":"/email/drafts/{draftId}/signature","permission":"email:read","pathParams":["draftId"]},
-  {"id":"email.native.send","group":"email","summary":"Send through a native Gmail or Outlook mailbox with a durable request receipt. Only use for an explicit send request.","cli":"dench email send --mailbox","method":"POST","path":"/email/native/send","permission":"email:write","pathParams":[]},
-  {"id":"email.send","group":"email","summary":"Send one raw email (no campaign): to/cc/bcc, custom from-name and reply-to, optional reply threading via replyToMessageId.","cli":"dench email send","method":"POST","path":"/email/send","permission":"email:write","pathParams":[]},
+  {"id":"email.native.send","group":"email","summary":"Send through a native Gmail or Outlook mailbox with a durable request receipt. Only use for an explicit send request.","cli":"dench email send [--mailbox <id/email>]","method":"POST","path":"/email/native/send","permission":"email:write","pathParams":[]},
+  {"id":"email.send","group":"email","summary":"Send one raw email (no campaign): to/cc/bcc, custom from-name and reply-to, optional reply threading via replyToMessageId.","cli":"dench email send --from <verified-email>","method":"POST","path":"/email/send","permission":"email:write","pathParams":[]},
   {"id":"email.message.get","group":"email","summary":"Read a raw email message's status and open/click counters.","cli":"dench email message status","method":"GET","path":"/email/messages/{messageId}","permission":"email:read","pathParams":["messageId"]},
   {"id":"email.message.list","group":"email","summary":"List recent raw email messages for the workspace.","cli":"dench email message list","method":"GET","path":"/email/messages","permission":"email:read","pathParams":[]},
   {"id":"email.template.create","group":"email","summary":"Create a managed email campaign template.","cli":"dench email template create","method":"POST","path":"/email/templates","permission":"email:write","pathParams":[]},
@@ -452,23 +471,24 @@ export const APP_SDK_OPERATIONS: readonly AppSdkOperationInfo[] = [
   {"id":"browser.session.create","group":"browser","summary":"Create a Dench Browser session and return a CDP connect URL for Playwright (chromium.connectOverCDP) plus a live-view URL. Use for durable scripts run from the sandbox.","cli":"dench browser session create","method":"POST","path":"/browser/sessions","permission":"browser:write","pathParams":[]},
   {"id":"browser.session.status","group":"browser","summary":"Get the status, connect URL, and live-view URL for a Dench Browser session.","cli":"dench browser session status","method":"GET","path":"/browser/sessions/{sessionId}","permission":"browser:read","pathParams":["sessionId"]},
   {"id":"browser.session.stop","group":"browser","summary":"Stop a Dench Browser session and release the remote browser.","cli":"dench browser session stop","method":"DELETE","path":"/browser/sessions/{sessionId}","permission":"browser:write","pathParams":["sessionId"]},
-  {"id":"agentConfig.identity.show","group":"agent-config","summary":"Read IDENTITY.md.","cli":"dench identity show","method":"GET","path":"/agent-config/identity","permission":"agent-config:read","pathParams":[]},
-  {"id":"agentConfig.identity.edit","group":"agent-config","summary":"Update IDENTITY.md.","cli":"dench identity edit","method":"PUT","path":"/agent-config/identity","permission":"agent-config:write","pathParams":[]},
-  {"id":"agentConfig.organisation.show","group":"agent-config","summary":"Read ORGANISATION.md.","cli":"dench organisation show","method":"GET","path":"/agent-config/organisation","permission":"agent-config:read","pathParams":[]},
-  {"id":"agentConfig.organisation.edit","group":"agent-config","summary":"Update ORGANISATION.md.","cli":"dench organisation edit","method":"PUT","path":"/agent-config/organisation","permission":"agent-config:write","pathParams":[]},
-  {"id":"agentConfig.user.show","group":"agent-config","summary":"Read USER.md.","cli":"dench user show","method":"GET","path":"/agent-config/user","permission":"agent-config:read","pathParams":[]},
-  {"id":"agentConfig.user.edit","group":"agent-config","summary":"Update USER.md.","cli":"dench user edit","method":"PUT","path":"/agent-config/user","permission":"agent-config:write","pathParams":[]},
-  {"id":"agentConfig.tools.show","group":"agent-config","summary":"Read tool notes.","cli":"dench tools show","method":"GET","path":"/agent-config/tools","permission":"agent-config:read","pathParams":[]},
-  {"id":"agentConfig.tools.edit","group":"agent-config","summary":"Update tool notes.","cli":"dench tools notes-edit","method":"PUT","path":"/agent-config/tools","permission":"agent-config:write","pathParams":[]},
-  {"id":"agentConfig.mem.show","group":"agent-config","summary":"Read aggregate memory.","cli":"dench mem show","method":"GET","path":"/agent-config/mem","permission":"agent-config:read","pathParams":[]},
-  {"id":"agentConfig.mem.edit","group":"agent-config","summary":"Update aggregate memory.","cli":"dench mem set","method":"PUT","path":"/agent-config/mem","permission":"agent-config:write","pathParams":[]},
-  {"id":"agentConfig.bootstrap.show","group":"agent-config","summary":"Read bootstrap state.","cli":"dench bootstrap status","method":"GET","path":"/agent-config/bootstrap","permission":"agent-config:read","pathParams":[]},
-  {"id":"agentConfig.bootstrap.complete","group":"agent-config","summary":"Complete bootstrap.","cli":"dench bootstrap complete","method":"POST","path":"/agent-config/bootstrap/complete","permission":"agent-config:write","pathParams":[]},
-  {"id":"agentConfig.bootstrap.template","group":"agent-config","summary":"Update bootstrap template.","cli":"dench bootstrap template","method":"PUT","path":"/agent-config/bootstrap/template","permission":"agent-config:write","pathParams":[]},
+  {"id":"agentConfig.identity.show","group":"agent-config","summary":"Read IDENTITY.md.","cli":"dench context --sections identity","method":"GET","path":"/agent-config/identity","permission":"agent-config:read","pathParams":[]},
+  {"id":"agentConfig.identity.edit","group":"agent-config","summary":"Update IDENTITY.md.","cli":"dench context set identity","method":"PUT","path":"/agent-config/identity","permission":"agent-config:write","pathParams":[]},
+  {"id":"agentConfig.organisation.show","group":"agent-config","summary":"Read ORGANISATION.md.","cli":"dench context --sections organisation","method":"GET","path":"/agent-config/organisation","permission":"agent-config:read","pathParams":[]},
+  {"id":"agentConfig.organisation.edit","group":"agent-config","summary":"Update ORGANISATION.md.","cli":"dench context set organisation","method":"PUT","path":"/agent-config/organisation","permission":"agent-config:write","pathParams":[]},
+  {"id":"agentConfig.user.show","group":"agent-config","summary":"Read USER.md.","cli":"dench context --sections user","method":"GET","path":"/agent-config/user","permission":"agent-config:read","pathParams":[]},
+  {"id":"agentConfig.user.edit","group":"agent-config","summary":"Update USER.md.","cli":"dench context set user","method":"PUT","path":"/agent-config/user","permission":"agent-config:write","pathParams":[]},
+  {"id":"agentConfig.tools.show","group":"agent-config","summary":"Read tool notes.","cli":"dench context --sections tools","method":"GET","path":"/agent-config/tools","permission":"agent-config:read","pathParams":[]},
+  {"id":"agentConfig.tools.edit","group":"agent-config","summary":"Update tool notes.","cli":"dench context set tools","method":"PUT","path":"/agent-config/tools","permission":"agent-config:write","pathParams":[]},
+  {"id":"workspace.context.rules.set","group":"workspace","summary":"Update standing workspace rules; credentials belong in secrets and runnable setup in environments.","cli":"dench context set rules","method":"PUT","path":"/context/rules","permission":"workspace:write","pathParams":[]},
+  {"id":"agentConfig.mem.show","group":"agent-config","summary":"Read aggregate memory.","cli":"dench mem show","method":"GET","path":"/agent-config/mem","permission":"agent-config:read","deprecated":true,"pathParams":[]},
+  {"id":"agentConfig.mem.edit","group":"agent-config","summary":"Update aggregate memory.","cli":"dench mem set","method":"PUT","path":"/agent-config/mem","permission":"agent-config:write","deprecated":true,"pathParams":[]},
+  {"id":"agentConfig.bootstrap.show","group":"agent-config","summary":"Read bootstrap state.","cli":"dench bootstrap status","method":"GET","path":"/agent-config/bootstrap","permission":"agent-config:read","deprecated":true,"pathParams":[]},
+  {"id":"agentConfig.bootstrap.complete","group":"agent-config","summary":"Complete bootstrap.","cli":"dench bootstrap complete","method":"POST","path":"/agent-config/bootstrap/complete","permission":"agent-config:write","deprecated":true,"pathParams":[]},
+  {"id":"agentConfig.bootstrap.template","group":"agent-config","summary":"Update bootstrap template.","cli":"dench bootstrap template","method":"PUT","path":"/agent-config/bootstrap/template","permission":"agent-config:write","deprecated":true,"pathParams":[]},
   {"id":"agentConfig.model.default","group":"agent-config","summary":"Set the default chat model.","cli":"dench model default","method":"PUT","path":"/agent-config/model/default","permission":"agent-config:write","pathParams":[]},
   {"id":"agentConfig.model.thread","group":"agent-config","summary":"Set a thread model override.","cli":"dench model thread","method":"PUT","path":"/agent-config/model/threads/{threadId}","permission":"agent-config:write","pathParams":["threadId"]},
-  {"id":"agentConfig.daily.today","group":"agent-config","summary":"Read today's daily activity path.","cli":"dench daily today","method":"GET","path":"/agent-config/daily/today","permission":"agent-config:read","pathParams":[]},
-  {"id":"agentConfig.daily.show","group":"agent-config","summary":"Read a daily activity path.","cli":"dench daily show","method":"GET","path":"/agent-config/daily/{date}","permission":"agent-config:read","pathParams":["date"]},
+  {"id":"agentConfig.daily.today","group":"agent-config","summary":"Read today's daily activity path.","cli":"dench daily today","method":"GET","path":"/agent-config/daily/today","permission":"agent-config:read","deprecated":true,"pathParams":[]},
+  {"id":"agentConfig.daily.show","group":"agent-config","summary":"Read a daily activity path.","cli":"dench daily show","method":"GET","path":"/agent-config/daily/{date}","permission":"agent-config:read","deprecated":true,"pathParams":["date"]},
   {"id":"notifications.list","group":"notifications","summary":"List your notifications (inbox, unread, archived, or all).","cli":"dench notifications list","method":"GET","path":"/notifications","permission":"notifications:read","pathParams":[]},
   {"id":"notifications.unreadCount","group":"notifications","summary":"How many unread notifications you have.","cli":"dench notifications count","method":"GET","path":"/notifications/unread-count","permission":"notifications:read","pathParams":[]},
   {"id":"notifications.read","group":"notifications","summary":"Mark a notification read (or unread).","cli":"dench notifications read","method":"PATCH","path":"/notifications/{notificationId}","permission":"notifications:write","pathParams":["notificationId"]},
@@ -481,7 +501,7 @@ export const APP_SDK_OPERATIONS: readonly AppSdkOperationInfo[] = [
 ];
 
 /** CLI-only operation ids (sessions, fs, imports): never callable from an app. */
-export const APP_SDK_LOCAL_OPERATIONS: readonly string[] = ["sessions.local.list","sessions.local.use","sessions.local.logout","backend.local.configure","enrichment.filters.options","crm.import","crm.export","meetings.import","fs.daemon","apps.validate"];
+export const APP_SDK_LOCAL_OPERATIONS: readonly string[] = ["environments.run","sessions.local.list","sessions.local.use","sessions.local.logout","backend.local.configure","enrichment.filters.options","crm.import","crm.export","meetings.import","fs.daemon","apps.validate"];
 
 /** Curated window.dench methods → permission (host + aliases). */
 export const APP_SDK_METHODS: Readonly<Record<string, AppSdkMethodInfo>> = {

package/lib/bundled-references.ts

@@ -0,0 +1,17 @@
+import bundle from "./references.generated.json";
+
+export const referenceRevision = bundle.revision;
+const files: Record<string, { sha256: string; content: string }> = bundle.files;
+export function getBundledReference(path: string): string | undefined {
+  return Object.hasOwn(files, path) ? files[path].content : undefined;
+}
+export function bundledReferenceIndex() {
+  return {
+    revision: referenceRevision,
+    references: Object.entries(files).map(([path, file]) => ({
+      path,
+      sha256: file.sha256,
+      bytes: new TextEncoder().encode(file.content).byteLength,
+    })),
+  };
+}

package/lib/cli-args.ts

@@ -27,7 +27,15 @@
  * the caller adapts.
  */
 
-export class CliArgError extends Error {}
+export class CliArgError extends Error {
+  readonly code = "invalid_arguments";
+}
+
+/** Help is a local operation, even after otherwise valid mutation arguments. */
+export function isHelpRequest(args: readonly string[]): boolean {
+  if (args.includes("--help") || args.includes("-h")) return true;
+  return args[0] === "help" || args[1] === "help";
+}
 
 export function shift(args: string[], expected: string): string {
   const value = args.shift();
@@ -35,10 +43,28 @@ export function shift(args: string[], expected: string): string {
   return value;
 }
 
+/** A standalone short option cannot supply another flag's value. Descending
+ * --sort uses -Field (including single-letter fields); negative numbers remain
+ * ordinary values. Longer dash-prefixed text remains supported. */
+export function missingFlagValue(
+  value: string | undefined,
+  name: string,
+): boolean {
+  return (
+    value === undefined ||
+    value.startsWith("--") ||
+    value === "-h" ||
+    (name !== "--sort" && /^-[a-zA-Z]$/.test(value))
+  );
+}
+
 export function getFlag(args: string[], name: string): string | undefined {
   const idx = args.indexOf(name);
   if (idx === -1) return undefined;
   const value = args[idx + 1];
+  if (missingFlagValue(value, name)) {
+    throw new CliArgError(`${name} needs a value`);
+  }
   args.splice(idx, 2);
   return value;
 }
@@ -141,9 +167,10 @@ export function assertNoUnknownFlags(
   // some shells to terminate option parsing) is allowed.
   for (const token of args) {
     if (token === "--") continue;
-    if (token.startsWith("--")) {
+    if (/^--?[^\d.]/.test(token)) {
+      const path = command.replace(/^dench\s+/, "");
       throw new CliArgError(
-        `Unknown flag for ${command}: ${token}. Run \`dench ${command.split(" ")[0]} help\` for the full flag list.`,
+        `Unknown flag for ${path}: ${token}. Run \`dench ${path} --help\` for usage.`,
       );
     }
   }