@dench.com/cli 3.7.0-staging.387 → 3.8.0-staging.389

package/README.md

@@ -112,9 +112,8 @@ next commands. Add `--json` for structured output.
 
 Browse and search the user's past chat threads in this workspace (own +
 shared). Useful for pulling in earlier context when the user refers to
-something they discussed before. The chat agent has the equivalent
-in-process tools (`list_past_chats`, `search_past_chats`,
-`read_past_chat`); this CLI surface is the same data accessed via bash.
+something they discussed before. The shared chat harness uses these same CLI
+commands through its execution tool; there is no separate agent-only chat-history command family.
 
 ```bash
 dench chat list [--query <substr>] [--limit N] [--include-archived] [--json]
@@ -391,54 +390,53 @@ Outreach needs a workspace member's credentials (a `dench signin` session, a
 member-bound `DENCH_API_KEY`, or an agent session); an organization-only key
 is refused.
 
-## Workspace sync
+## Workspace files and reusable setup
 
-Starting with CLI 2.9.8, `dench fs status` reports cached local daemon
-health, not a live comparison between disk and the cloud copy. The status
-probe does not scan the workspace, contact the backend, or start a mount
-worker.
+Use `dench files` for saved workspace documents and `dench stage` for outputs.
+Harness A keeps a separate scratch directory per job. The old filesystem and
+home-sync daemons are legacy compatibility infrastructure; they are not needed
+to execute a command or restore a saved environment.
 
-```bash
-dench fs status --json
-dench fs status --workspace /workspace --json
-```
-
-| JSON field | Meaning |
-| --- | --- |
-| `daemon.healthy` | The process is alive and cached progress passes freshness checks, with a short startup grace before the first scan. |
-| `daemon.workspaceMatches` | The cached daemon serves the requested workspace root. A mismatch also makes `healthy` false. |
-| `daemon.state.mountWorker` | Cached worker state, PID, last progress time, restart count, and error. |
-| `counts.onDisk` | Last successful scan's count, only for the matching root; `null` when unavailable. Not a fresh count. |
-| `counts.inConvex`, `counts.onlyOnDisk`, `counts.onlyInConvex`, `counts.hashMismatches` | `null`: these counts are unknown, not zero. |
-| `driftStatus`, `drift` | `"not_checked"` and `[]`; an empty list does not prove that files match. |
-
-Status exits **1** when the daemon is missing, dead, stale, stalled, or
-serves a different root, including with `--json`; exit **0** means cached
-health passed, not that every pending write has synced. The legacy
-`--no-hash` and `--drift-limit N` flags remain accepted but have no effect.
-
-To pull a workspace file through the running daemon:
-
-```bash
-dench fs pull "/reports/example.csv" --wait --timeout-ms 10000 --json
+```sh
+dench files cat /reports/example.md
+dench env list --json
+dench env save openai-report --path ./openai-report --json
+dench env show openai-report --json
+dench env run openai-report -- node report.mjs
+dench secrets set OPENAI_API_KEY --stdin < /private/path/key.txt
 ```
 
-`--timeout-ms` covers the whole request, including queueing, metadata,
-download, and mounted write (default 10 seconds, capped at 60 seconds).
-Successful `--wait` means the downloaded original passed its SHA-256 check
-and the write finished before the deadline. Without `--wait`, success
-means only that the request was queued.
-
-A running daemon process does not hot-upgrade: restart it after installing a
-new CLI.
+A saved directory requires `dench-env.json`, `SKILL.md`, an explicit file allowlist
+and verification commands. It builds dependencies once, publishes a ready
+revision, and reuses the prepared snapshot or compatible bundle. Only the chosen
+environment is loaded. Secrets are encrypted separately and injected into the
+executing process; they never become dependency archives or memory facts.
+
+New automation runs select the latest ready revision; active jobs and their
+children retain the resolved revision. State is isolated by job or automation
+unless an explicit shared state key is chosen. State writes and refreshed
+credential files use compare-and-set versions; conflicts do not replay business
+operations. Rotate credentials without reinstalling packages.
+
+On a different local OS/runtime, explicitly prepare a separate platform cache
+once using `dench env run openai-report --prepare-local -- node report.mjs`.
+Normal ready runs never invoke a package installer. The local executor provides
+separate directories, not operating-system isolation.
+
+See [the environment reference](https://dench.com/references/ENVIRONMENTS.md)
+for the manifest, cold-start costs, mutable state and recovery receipts. Use
+`dench memory search/save` for facts and preferences, `dench context set` for
+standing context, and `dench secrets` for credentials. An old memory claiming
+that a service is configured cannot replace a successful storage receipt.
 
 ## Sandbox / API key auth (no `dench signin` required)
 
 Inside a Dench sandbox the Dench API key is set in the environment when the
 sandbox starts. When `DENCH_API_KEY` is present, the CLI skips the
 `dench signin` flow entirely and uses the key as a bearer for every org-scoped
-command — `dench crm`, `dench files`, `dench fs sync`, etc. The key targets
-production.
+command — `dench crm`, `dench files`, and other workspace operations. The
+selected connection determines the backend; hosted credentials stay scoped to
+the authorized workspace and job.
 
 ```bash
 export DENCH_API_KEY=dench_pk_live_…
@@ -477,7 +475,8 @@ dench context --sections organisation,user,memory --json
 ```
 
 Section names are `identity`, `organisation`, `user`, `memory`, `rules`, and
-`tools`. Multiple names use one query. The existing `organisation show`,
-`user show`, and `mem show` commands use the same saved documents; reading never
-fills profiles or writes memory. Personal USER context is unavailable to shared
+`tools`. Multiple names use one query. Reading never fills profiles or writes
+memory. Edit the selected context with
+`dench context set <identity|organisation|user|tools|rules> --stdin`; older profile
+aliases remain compatibility paths. Personal USER context is unavailable to shared
 channel sessions. `dench context --json` keeps its existing workspace overview.

package/agent-config.ts

@@ -1,5 +1,5 @@
 /**
- * `dench identity / organisation / user / bootstrap / model / daily /
+ * `dench identity / organisation / user / bootstrap / model /
  *  mem aggregate` — CLI surface for the OpenClaw-
  * parity self-updating harness.
  *
@@ -15,14 +15,13 @@
  *   identity show | edit
  *   organisation show | edit
  *   user show | edit
- *   tools show | notes-edit
+ *   tools show | edit
  *   memory show | append <text> | set                   (MEMORY.md aggregate)
  *   bootstrap status | complete | reopen | template
  *   model default <id> | model default clear |
  *   model thread <threadId> <id> | model thread <threadId> clear
- *   daily today | daily show <YYYY-MM-DD> | daily append <text>
  *
- * `edit` / `notes-edit` / `template` open the
+ * `edit` / `template` open the
  * user's `$EDITOR` (default `vi`) to capture the new body. The
  * stdin path is also supported via `--stdin`, useful in scripts.
  */
@@ -496,66 +495,17 @@ export async function runModelCommand(ctx: CliCtx): Promise<void> {
   await handleModel(ctx, ctx.args);
 }
 
-/**
- * Daily activity log subcommands (real fileTree files under
- * `/workspace/daily/`). Today / show <YYYY-MM-DD> read the inline
- * cache; append delegates to the agent action so timestamps and
- * heading wrappers stay consistent.
- */
-export async function runDailyCommand(ctx: CliCtx): Promise<void> {
-  consumeOutputFlag(ctx);
-  const sub = ctx.args[0];
-  if (!sub || sub === "today") {
-    const today = new Date();
-    const yyyy = today.getUTCFullYear();
-    const mm = String(today.getUTCMonth() + 1).padStart(2, "0");
-    const dd = String(today.getUTCDate()).padStart(2, "0");
-    const path = `/daily/${yyyy}-${mm}-${dd}.md`;
-    // Daily logs are real files — fetch via the workspace file API
-    // hop so the same auth (Convex Auth or API key) works.
-    out(
-      ctx,
-      ctx.jsonOutput
-        ? { path }
-        : `Today's daily log lives at ${path}. Use \`dench fs cat ${path}\` to read it, or open it in the workspace UI.`,
-    );
-    return;
-  }
-  if (sub === "show") {
-    const date = ctx.args[1];
-    if (!date) {
-      throw new AgentConfigCliError("Usage: dench daily show <YYYY-MM-DD>");
-    }
-    out(
-      ctx,
-      ctx.jsonOutput
-        ? { path: `/daily/${date}.md` }
-        : `Daily log for ${date} lives at /daily/${date}.md. Use \`dench fs cat\` to read it.`,
-    );
-    return;
-  }
-  if (sub === "append") {
-    throw new AgentConfigCliError(
-      "Daily append is currently only available via the agent's `append_daily_log` tool. Use the chat to log entries with timestamps.",
-    );
-  }
-  throw new AgentConfigCliError(
-    `Unknown daily subcommand: "${sub}". Try "today", "show <YYYY-MM-DD>".`,
-  );
-}
-
 export function printAgentConfigCliHelp(): void {
   console.log(
-    `Self-updating agent harness:
+    `Workspace context compatibility aliases (prefer dench context --sections / context set):
 
   dench identity show | edit                        IDENTITY.md (org-wide)
   dench organisation show | edit                    ORGANISATION.md
   dench user show | edit                            USER.md (per-member)
-  dench tools show | notes-edit                     TOOLS.md notes section
+  dench tools show | edit                     TOOLS.md notes section
   dench mem show | append <text> | set              MEMORY.md aggregate
   dench bootstrap status | complete | reopen | template
   dench model default <id|clear> | model thread <threadId> <id|clear>
-  dench daily today | show <YYYY-MM-DD>              Activity log paths
 
 Editing flags:
   --content "<markdown>"   Inline body

package/app-sdk.d.ts

@@ -12,6 +12,67 @@
 // ── Operation request/response types (from cli/lib/api-schemas.ts) ──────
 
 export interface ApiRequests {
+  /** List workspace-shared reusable setups and ready revisions (metadata only). — `dench env list` — GET /api/v1/environments */
+  "environments.list": {
+    limit?: number;
+    cursor?: string;
+  };
+  /** Inspect a saved setup, its manifest, and an optional immutable revision. — `dench env show` — GET /api/v1/environments/{name} */
+  "environments.get": {
+    name: string;
+    revision?: string;
+  };
+  /** Reserve an owner-bound source upload. Prefix the uploaded bytes with the returned proof before saving. — `dench env save` — POST /api/v1/environments/uploads */
+  "environments.upload": {
+    kind: "source";
+    size: number;
+    sha256: string;
+  };
+  /** Publish an explicitly saved source and manifest for one-time preparation. Returns pending/building until verified; does not run the task. — `dench env save` — POST /api/v1/environments/{name} */
+  "environments.save": {
+    name: string;
+    manifest: {
+      version: 1;
+      name: string;
+      purpose: string;
+      files: string[];
+      prepare: string[];
+      verify: string[];
+      env?: Record<string, string>;
+      secretEnv?: Record<string, string>;
+      secretFiles?: {
+        path: string;
+        secret: string;
+        mutable?: boolean;
+      }[];
+      statePaths?: string[];
+      portable?: boolean;
+    };
+    uploadId: string;
+    storageId: string;
+    sha256: string;
+  };
+  /** Retire a saved setup from new selection; retain immutable revisions and active job evidence. — `dench env delete` — DELETE /api/v1/environments/{name} */
+  "environments.delete": {
+    name: string;
+  };
+  /** List workspace-shared credential names, kinds and versions; never values. — `dench secrets list` — GET /api/v1/secrets */
+  "secrets.list": {
+    limit?: number;
+    cursor?: string;
+  };
+  /** Encrypt a workspace credential. Use CLI stdin or the secure chat form; return metadata only. Do not put values in chat, manifests or scripts. — `dench secrets set` — PUT /api/v1/secrets/{name} */
+  "secrets.set": {
+    name: string;
+    kind: "env" | "file";
+    value: string;
+    expectedVersion?: number;
+  };
+  /** Revoke a workspace credential for future resolution, optionally checking its version. — `dench secrets delete` — DELETE /api/v1/secrets/{name} */
+  "secrets.delete": {
+    name: string;
+    expectedVersion?: number;
+  };
   /** Create an idempotent empty campaign draft with the caller's available sender pools. Does not launch or send. — `dench campaign draft` — POST /api/v1/campaigns/drafts */
   "campaigns.drafts.create": {
     /** Your stable id for this request, 8-64 characters. Retrying with the same id returns the same draft instead of creating another. */
@@ -699,6 +760,7 @@ export interface ApiRequests {
   };
   /** Start a new chat-turn workflow. — `dench chat new` — POST /api/v1/chat/threads */
   "chat.new": {
+    environment?: string;
     /** The user message that starts the turn. */
     prompt: string;
     model?: string;
@@ -3235,30 +3297,34 @@ export interface ApiRequests {
   "browser.session.status": Record<string, unknown>;
   /** Stop a Dench Browser session and release the remote browser. — `dench browser session stop` — DELETE /api/v1/browser/sessions/{sessionId} */
   "browser.session.stop": Record<string, unknown>;
-  /** Read IDENTITY.md. — `dench identity show` — GET /api/v1/agent-config/identity */
+  /** Read IDENTITY.md. — `dench context --sections identity` — GET /api/v1/agent-config/identity */
   "agentConfig.identity.show": Record<string, unknown>;
-  /** Update IDENTITY.md. — `dench identity edit` — PUT /api/v1/agent-config/identity */
+  /** Update IDENTITY.md. — `dench context set identity` — PUT /api/v1/agent-config/identity */
   "agentConfig.identity.edit": {
     content: string;
   };
-  /** Read ORGANISATION.md. — `dench organisation show` — GET /api/v1/agent-config/organisation */
+  /** Read ORGANISATION.md. — `dench context --sections organisation` — GET /api/v1/agent-config/organisation */
   "agentConfig.organisation.show": Record<string, unknown>;
-  /** Update ORGANISATION.md. — `dench organisation edit` — PUT /api/v1/agent-config/organisation */
+  /** Update ORGANISATION.md. — `dench context set organisation` — PUT /api/v1/agent-config/organisation */
   "agentConfig.organisation.edit": {
     content: string;
   };
-  /** Read USER.md. — `dench user show` — GET /api/v1/agent-config/user */
+  /** Read USER.md. — `dench context --sections user` — GET /api/v1/agent-config/user */
   "agentConfig.user.show": Record<string, unknown>;
-  /** Update USER.md. — `dench user edit` — PUT /api/v1/agent-config/user */
+  /** Update USER.md. — `dench context set user` — PUT /api/v1/agent-config/user */
   "agentConfig.user.edit": {
     content: string;
   };
-  /** Read tool notes. — `dench tools show` — GET /api/v1/agent-config/tools */
+  /** Read tool notes. — `dench context --sections tools` — GET /api/v1/agent-config/tools */
   "agentConfig.tools.show": Record<string, unknown>;
-  /** Update tool notes. — `dench tools edit` — PUT /api/v1/agent-config/tools */
+  /** Update tool notes. — `dench context set tools` — PUT /api/v1/agent-config/tools */
   "agentConfig.tools.edit": {
     content: string;
   };
+  /** Update standing workspace rules; credentials belong in secrets and runnable setup in environments. — `dench context set rules` — PUT /api/v1/context/rules */
+  "workspace.context.rules.set": {
+    content: string;
+  };
   /** Read aggregate memory. — `dench mem show` — GET /api/v1/agent-config/mem */
   "agentConfig.mem.show": Record<string, unknown>;
   /** Update aggregate memory. — `dench mem set` — PUT /api/v1/agent-config/mem */
@@ -3347,6 +3413,20 @@ export interface ApiRequests {
 }
 
 export interface ApiResponses {
+  "environments.list": unknown;
+  "environments.get": unknown;
+  "environments.upload": unknown;
+  "environments.save": unknown;
+  "environments.delete": unknown;
+  "secrets.list": unknown;
+  "secrets.set": {
+    name: string;
+    kind: "env" | "file";
+    version: number;
+    revision: number;
+    status: "stored";
+  };
+  "secrets.delete": unknown;
   "campaigns.drafts.create": {
     sequenceId: string;
   };
@@ -7255,6 +7335,7 @@ export interface ApiResponses {
       template?: string;
     };
   };
+  "workspace.context.rules.set": unknown;
   "agentConfig.mem.show": {
     agentConfig: {
       identity: {
@@ -7566,9 +7647,9 @@ export type DenchApiTree = {
       today(args?: Req<"agentConfig.daily.today">): Promise<Res<"agentConfig.daily.today">>;
     };
     identity: {
-      /** Update IDENTITY.md. (`dench identity edit`) */
+      /** Update IDENTITY.md. (`dench context set identity`) */
       edit(args: Req<"agentConfig.identity.edit">): Promise<Res<"agentConfig.identity.edit">>;
-      /** Read IDENTITY.md. (`dench identity show`) */
+      /** Read IDENTITY.md. (`dench context --sections identity`) */
       show(args?: Req<"agentConfig.identity.show">): Promise<Res<"agentConfig.identity.show">>;
     };
     mem: {
@@ -7584,21 +7665,21 @@ export type DenchApiTree = {
       thread(args: Req<"agentConfig.model.thread">): Promise<Res<"agentConfig.model.thread">>;
     };
     organisation: {
-      /** Update ORGANISATION.md. (`dench organisation edit`) */
+      /** Update ORGANISATION.md. (`dench context set organisation`) */
       edit(args: Req<"agentConfig.organisation.edit">): Promise<Res<"agentConfig.organisation.edit">>;
-      /** Read ORGANISATION.md. (`dench organisation show`) */
+      /** Read ORGANISATION.md. (`dench context --sections organisation`) */
       show(args?: Req<"agentConfig.organisation.show">): Promise<Res<"agentConfig.organisation.show">>;
     };
     tools: {
-      /** Update tool notes. (`dench tools edit`) */
+      /** Update tool notes. (`dench context set tools`) */
       edit(args: Req<"agentConfig.tools.edit">): Promise<Res<"agentConfig.tools.edit">>;
-      /** Read tool notes. (`dench tools show`) */
+      /** Read tool notes. (`dench context --sections tools`) */
       show(args?: Req<"agentConfig.tools.show">): Promise<Res<"agentConfig.tools.show">>;
     };
     user: {
-      /** Update USER.md. (`dench user edit`) */
+      /** Update USER.md. (`dench context set user`) */
       edit(args: Req<"agentConfig.user.edit">): Promise<Res<"agentConfig.user.edit">>;
-      /** Read USER.md. (`dench user show`) */
+      /** Read USER.md. (`dench context --sections user`) */
       show(args?: Req<"agentConfig.user.show">): Promise<Res<"agentConfig.user.show">>;
     };
   };
@@ -8362,6 +8443,18 @@ export type DenchApiTree = {
       preview(args: Req<"enrichment.search.preview">): Promise<Res<"enrichment.search.preview">>;
     };
   };
+  environments: {
+    /** Retire a saved setup from new selection; retain immutable revisions and active job evidence. (`dench env delete`) */
+    delete(args: Req<"environments.delete">): Promise<Res<"environments.delete">>;
+    /** Inspect a saved setup, its manifest, and an optional immutable revision. (`dench env show`) */
+    get(args: Req<"environments.get">): Promise<Res<"environments.get">>;
+    /** List workspace-shared reusable setups and ready revisions (metadata only). (`dench env list`) */
+    list(args?: Req<"environments.list">): Promise<Res<"environments.list">>;
+    /** Publish an explicitly saved source and manifest for one-time preparation. Returns pending/building until verified; does not run the task. (`dench env save`) */
+    save(args: Req<"environments.save">): Promise<Res<"environments.save">>;
+    /** Reserve an owner-bound source upload. Prefix the uploaded bytes with the returned proof before saving. (`dench env save`) */
+    upload(args: Req<"environments.upload">): Promise<Res<"environments.upload">>;
+  };
   files: {
     /** Read a workspace file's text. (`dench files cat`) */
     content(args?: Req<"files.content">): Promise<Res<"files.content">>;
@@ -8506,6 +8599,14 @@ export type DenchApiTree = {
     /** Search the web through the Dench gateway. (`dench search`) */
     web(args: Req<"search.web">): Promise<Res<"search.web">>;
   };
+  secrets: {
+    /** Revoke a workspace credential for future resolution, optionally checking its version. (`dench secrets delete`) */
+    delete(args: Req<"secrets.delete">): Promise<Res<"secrets.delete">>;
+    /** List workspace-shared credential names, kinds and versions; never values. (`dench secrets list`) */
+    list(args?: Req<"secrets.list">): Promise<Res<"secrets.list">>;
+    /** Encrypt a workspace credential. Use CLI stdin or the secure chat form; return metadata only. Do not put values in chat, manifests or scripts. (`dench secrets set`) */
+    set(args: Req<"secrets.set">): Promise<Res<"secrets.set">>;
+  };
   settings: {
     sync: {
       /** Read the workspace's Sync switches (accounts from email, contacts from LinkedIn, Slack Connect, calendar, dossier, tasks from email, lead auto-qualify, summaries and Brief). All on by default. (`dench settings sync`) */
@@ -8575,6 +8676,10 @@ export type DenchApiTree = {
       /** Return the current Dench workspace context for the bearer. (`dench context`) */
       (args?: Req<"workspace.context">): Promise<Res<"workspace.context">>;
       $call(args?: Req<"workspace.context">): Promise<Res<"workspace.context">>;
+      rules: {
+        /** Update standing workspace rules; credentials belong in secrets and runnable setup in environments. (`dench context set rules`) */
+        set(args: Req<"workspace.context.rules.set">): Promise<Res<"workspace.context.rules.set">>;
+      };
       /** Read selected scoped workspace documents and a compact context index without writes. (`dench context --sections`) */
       sections(args?: Req<"workspace.context.sections">): Promise<Res<"workspace.context.sections">>;
     };

package/chat-spawn.ts

@@ -16,7 +16,7 @@
  * (`/api/chat/[runId]/stream`) and pretty-prints text deltas + tool
  * calls until the workflow finishes.
  */
-import { hasFlag } from "./lib/cli-args";
+import { assertNoUnknownFlags, hasFlag } from "./lib/cli-args";
 
 class ChatSpawnError extends Error {}
 
@@ -47,6 +47,10 @@ function consumeFlagValue(args: string[], name: string): string | undefined {
   const idx = args.indexOf(name);
   if (idx === -1) return undefined;
   const value = args[idx + 1];
+  if (!value || value.startsWith("--"))
+    throw new ChatSpawnError(`${name} requires a value.`);
+  if (args.indexOf(name, idx + 1) !== -1)
+    throw new ChatSpawnError(`Duplicate flag: ${name}`);
   args.splice(idx, 2);
   return value;
 }
@@ -372,17 +376,21 @@ function joinPositionalsExceptFlags(args: string[]): string {
 }
 
 async function runChatNew(ctx: ChatSpawnContext): Promise<void> {
+  const environment = consumeFlagValue(ctx.args, "--environment");
+  if (environment !== undefined && !/^[a-z][a-z0-9-]{0,63}$/.test(environment))
+    throw new ChatSpawnError("Invalid environment name");
   const model = consumeFlagValue(ctx.args, "--model");
   const fileContextPath = consumeFlagValue(ctx.args, "--file-context");
   const visibility = consumeFlagValue(ctx.args, "--visibility");
   const title = consumeFlagValue(ctx.args, "--title");
   const yolo = consumeFlag(ctx.args, "--yolo");
   const follow = consumeFlag(ctx.args, "--follow");
+  assertNoUnknownFlags(ctx.args, "chat new");
 
   const prompt = joinPositionalsExceptFlags(ctx.args);
   if (!prompt) {
     throw new ChatSpawnError(
-      'Usage: dench chat new "<prompt>" [--model M] [--file-context PATH] [--visibility private|shared] [--title T] [--yolo] [--follow] [--json]',
+      'Usage: dench chat new "<prompt>" [--environment NAME] [--model M] [--file-context PATH] [--visibility private|shared] [--title T] [--yolo] [--follow] [--json]',
     );
   }
 
@@ -391,6 +399,7 @@ async function runChatNew(ctx: ChatSpawnContext): Promise<void> {
     ctx.runtime.bearerToken,
     {
       prompt,
+      ...(environment ? { environment } : {}),
       model,
       fileContextPath,
       visibility,

package/chat.ts

@@ -145,7 +145,7 @@ PERMANENTLY delete one or more past chat threads (and all their messages):
     server REFUSES to delete them unless \`--include-automated\` is set.
 
 Spawn a new chat-turn workflow (same agent loop as the web UI):
-  dench chat new "<prompt>" [--model <m>] [--file-context <path>] [--visibility private|shared] [--title T] [--yolo] [--follow] [--json]
+  dench chat new "<prompt>" [--environment NAME] [--model <m>] [--file-context <path>] [--visibility private|shared] [--title T] [--yolo] [--follow] [--json]
   dench chat send <thread-id> "<message>" [--model <m>] [--yolo] [--follow] [--json]
   dench chat follow <thread-id> [--json]
   dench chat tree [<root-thread-id>] [--limit N] [--json]

package/context-settings.ts

@@ -0,0 +1,86 @@
+import type { ConvexHttpClient } from "convex/browser";
+import { makeFunctionReference } from "convex/server";
+import { CliArgError } from "./lib/cli-args";
+import { parseEnvironmentOptions } from "./lib/environment-cli-args";
+
+export const CONTEXT_SECTIONS = [
+  "identity",
+  "organisation",
+  "user",
+  "tools",
+  "rules",
+] as const;
+export function validateContextSet(input: readonly string[]) {
+  const parsed = parseEnvironmentOptions(
+    input,
+    ["--content"],
+    ["--stdin", "--json"],
+  );
+  const [verb, section] = parsed.positional;
+  if (
+    verb !== "set" ||
+    parsed.positional.length !== 2 ||
+    !CONTEXT_SECTIONS.includes(section as never) ||
+    parsed.child.length
+  )
+    throw new CliArgError(
+      `Usage: dench context set <${CONTEXT_SECTIONS.join("|")}> --stdin | --content <text> [--json]`,
+    );
+  if (
+    Number(parsed.flags["--stdin"] === true) +
+      Number(typeof parsed.flags["--content"] === "string") !==
+    1
+  )
+    throw new CliArgError(
+      "Choose exactly one of --stdin or --content. Store credentials with dench secrets set, never in context.",
+    );
+  return {
+    section: section as (typeof CONTEXT_SECTIONS)[number],
+    content: parsed.flags["--content"] as string | undefined,
+  };
+}
+
+export async function runContextSet(opts: {
+  convex: ConvexHttpClient;
+  args: string[];
+  sessionToken?: string;
+  readStdin?: () => Promise<string>;
+}) {
+  const parsed = validateContextSet(opts.args);
+  const content =
+    parsed.content ??
+    (await (
+      opts.readStdin ??
+      (async () => {
+        const chunks: Buffer[] = [];
+        let size = 0;
+        for await (const chunk of process.stdin) {
+          size += Buffer.byteLength(chunk);
+          if (size > 32000)
+            throw new CliArgError(
+              "Context exceeds 32 KB. Keep standing instructions short; use workspace files for references.",
+            );
+          chunks.push(Buffer.from(chunk));
+        }
+        return Buffer.concat(chunks).toString("utf8");
+      })
+    )());
+  if (!content.trim() || Buffer.byteLength(content) > 32000)
+    throw new CliArgError("Context must contain 1–32000 UTF-8 bytes.");
+  const fn = {
+    identity: "updateIdentity",
+    organisation: "updateOrganisation",
+    user: "updateUserProfile",
+    tools: "updateToolsNotes",
+    rules: "writeMagicFileFromUI",
+  }[parsed.section];
+  await opts.convex.mutation(
+    makeFunctionReference<"mutation">(`functions/agentConfig:${fn}`),
+    {
+      ...(opts.sessionToken ? { sessionToken: opts.sessionToken } : {}),
+      content,
+      ...(parsed.section === "rules" ? { path: "/RULES.md" } : {}),
+    },
+  );
+  console.log(JSON.stringify({ ok: true, section: parsed.section }));
+}

package/cron.ts

@@ -392,6 +392,9 @@ async function runCreate(ctx: CronCliContext): Promise<void> {
       "--prompt is required (becomes the user message of each cron-fired chat thread)",
     );
   }
+  const environment = getFlag(ctx.args, "--environment");
+  if (environment && !/^[a-z][a-z0-9-]{0,63}$/.test(environment))
+    throw new CronCliError("Invalid environment name");
   const description = getFlag(ctx.args, "--description");
   const overlapPolicy = getFlag(ctx.args, "--overlap") as
     | "skip"
@@ -431,6 +434,7 @@ async function runCreate(ctx: CronCliContext): Promise<void> {
       triggerType,
       name,
       prompt,
+      environment,
       description,
       overlapPolicy,
       disabled,
@@ -462,6 +466,7 @@ async function runCreate(ctx: CronCliContext): Promise<void> {
   const created = (await callMutation(ctx, createCronTriggerRef, {
     name,
     prompt,
+    environment,
     triggerType,
     schedule,
     description,
@@ -551,6 +556,7 @@ async function runSecret(ctx: CronCliContext): Promise<void> {
 }
 
 export type AppOrCrmCreateBase = {
+  environment?: string;
   triggerType: "composio" | "crm";
   name: string;
   prompt: string;
@@ -584,6 +590,7 @@ export function buildAppOrCrmCreateBody(
   const body: Record<string, unknown> = {
     name: base.name,
     prompt: base.prompt,
+    environment: base.environment,
     triggerType: base.triggerType,
     description: base.description,
     overlapPolicy: base.overlapPolicy,
@@ -731,6 +738,15 @@ async function runEvents(ctx: CronCliContext): Promise<void> {
 
 async function runUpdate(ctx: CronCliContext): Promise<void> {
   const jobId = shift(ctx.args, "job id");
+  const environment = getFlag(ctx.args, "--environment");
+  const clearEnvironment = hasFlag(ctx.args, "--clear-environment");
+  if (
+    environment &&
+    (clearEnvironment || !/^[a-z][a-z0-9-]{0,63}$/.test(environment))
+  )
+    throw new CronCliError(
+      "Choose a valid --environment name or --clear-environment",
+    );
   const name = getFlag(ctx.args, "--name");
   const prompt = getFlag(ctx.args, "--prompt");
   const description = getFlag(ctx.args, "--description");
@@ -753,6 +769,7 @@ async function runUpdate(ctx: CronCliContext): Promise<void> {
   const schedule = consumeScheduleFlags(ctx.args);
   const result = await callMutation(ctx, updateCronTriggerRef, {
     jobId,
+    environment: clearEnvironment ? null : environment,
     name,
     prompt,
     description,
@@ -866,6 +883,8 @@ Browse:
   dench cron events <toolkit> [--json]            # app-event types for a connected app
 
 Create / update:
+  Add --environment <name> to bind a ready reusable setup.
+  New runs use its latest ready revision; --clear-environment removes the binding on update.
   dench cron create "Daily standup digest" \\
       --prompt "Pull yesterday's commits + Slack #standup msgs and post a summary…" \\
       --type schedule                     # default. also: webhook | app | crm (see below)