@dench.com/cli 3.7.0-staging.387 → 3.8.0-staging.389

package/lib/app-sdk-catalog.generated.ts

@@ -53,6 +53,8 @@ export const APP_SDK_SCOPES = [
   "cron:schedule",
   "email:read",
   "email:write",
+  "environments:read",
+  "environments:write",
   "files:read",
   "files:write",
   "http:external",
@@ -70,6 +72,8 @@ export const APP_SDK_SCOPES = [
   "notifications:read",
   "notifications:write",
   "search:read",
+  "secrets:read",
+  "secrets:write",
   "settings:read",
   "settings:write",
   "store:read",
@@ -77,12 +81,21 @@ export const APP_SDK_SCOPES = [
   "ui",
   "web:read",
   "webhooks:receive",
-  "workspace:read"
+  "workspace:read",
+  "workspace:write"
 ] as const;
 export type AppSdkScope = (typeof APP_SDK_SCOPES)[number];
 
 /** Every public /api/v1 operation reachable through dench.api.call. */
 export const APP_SDK_OPERATIONS: readonly AppSdkOperationInfo[] = [
+  {"id":"environments.list","group":"environments","summary":"List workspace-shared reusable setups and ready revisions (metadata only).","cli":"dench env list","method":"GET","path":"/environments","permission":"environments:read","pathParams":[]},
+  {"id":"environments.get","group":"environments","summary":"Inspect a saved setup, its manifest, and an optional immutable revision.","cli":"dench env show","method":"GET","path":"/environments/{name}","permission":"environments:read","pathParams":["name"]},
+  {"id":"environments.upload","group":"environments","summary":"Reserve an owner-bound source upload. Prefix the uploaded bytes with the returned proof before saving.","cli":"dench env save","method":"POST","path":"/environments/uploads","permission":"environments:write","pathParams":[]},
+  {"id":"environments.save","group":"environments","summary":"Publish an explicitly saved source and manifest for one-time preparation. Returns pending/building until verified; does not run the task.","cli":"dench env save","method":"POST","path":"/environments/{name}","permission":"environments:write","pathParams":["name"]},
+  {"id":"environments.delete","group":"environments","summary":"Retire a saved setup from new selection; retain immutable revisions and active job evidence.","cli":"dench env delete","method":"DELETE","path":"/environments/{name}","permission":"environments:write","pathParams":["name"]},
+  {"id":"secrets.list","group":"secrets","summary":"List workspace-shared credential names, kinds and versions; never values.","cli":"dench secrets list","method":"GET","path":"/secrets","permission":"secrets:read","pathParams":[]},
+  {"id":"secrets.set","group":"secrets","summary":"Encrypt a workspace credential. Use CLI stdin or the secure chat form; return metadata only. Do not put values in chat, manifests or scripts.","cli":"dench secrets set","method":"PUT","path":"/secrets/{name}","permission":"secrets:write","pathParams":["name"]},
+  {"id":"secrets.delete","group":"secrets","summary":"Revoke a workspace credential for future resolution, optionally checking its version.","cli":"dench secrets delete","method":"DELETE","path":"/secrets/{name}","permission":"secrets:write","pathParams":["name"]},
   {"id":"campaigns.drafts.create","group":"campaigns","summary":"Create an idempotent empty campaign draft with the caller's available sender pools. Does not launch or send.","cli":"dench campaign draft","method":"POST","path":"/campaigns/drafts","permission":"campaigns:write","pathParams":[]},
   {"id":"campaigns.audience.search","group":"campaigns","summary":"Search people by filters without adding CRM records or campaign recipients. Search credits apply; this is not a free provider preview.","cli":"dench campaign search","method":"POST","path":"/campaigns/audience/search","permission":"campaigns:write","pathParams":[]},
   {"id":"campaigns.people.addFromSearch","group":"campaigns","summary":"Search and add up to 50 people to an existing campaign. New identities become Leads. Search credits apply; use nextPageToken for another page.","cli":"dench campaign add --search","method":"POST","path":"/campaigns/{sequenceId}/people/search","permission":"campaigns:write","pathParams":["sequenceId"]},
@@ -458,23 +471,24 @@ export const APP_SDK_OPERATIONS: readonly AppSdkOperationInfo[] = [
   {"id":"browser.session.create","group":"browser","summary":"Create a Dench Browser session and return a CDP connect URL for Playwright (chromium.connectOverCDP) plus a live-view URL. Use for durable scripts run from the sandbox.","cli":"dench browser session create","method":"POST","path":"/browser/sessions","permission":"browser:write","pathParams":[]},
   {"id":"browser.session.status","group":"browser","summary":"Get the status, connect URL, and live-view URL for a Dench Browser session.","cli":"dench browser session status","method":"GET","path":"/browser/sessions/{sessionId}","permission":"browser:read","pathParams":["sessionId"]},
   {"id":"browser.session.stop","group":"browser","summary":"Stop a Dench Browser session and release the remote browser.","cli":"dench browser session stop","method":"DELETE","path":"/browser/sessions/{sessionId}","permission":"browser:write","pathParams":["sessionId"]},
-  {"id":"agentConfig.identity.show","group":"agent-config","summary":"Read IDENTITY.md.","cli":"dench identity show","method":"GET","path":"/agent-config/identity","permission":"agent-config:read","pathParams":[]},
-  {"id":"agentConfig.identity.edit","group":"agent-config","summary":"Update IDENTITY.md.","cli":"dench identity edit","method":"PUT","path":"/agent-config/identity","permission":"agent-config:write","pathParams":[]},
-  {"id":"agentConfig.organisation.show","group":"agent-config","summary":"Read ORGANISATION.md.","cli":"dench organisation show","method":"GET","path":"/agent-config/organisation","permission":"agent-config:read","pathParams":[]},
-  {"id":"agentConfig.organisation.edit","group":"agent-config","summary":"Update ORGANISATION.md.","cli":"dench organisation edit","method":"PUT","path":"/agent-config/organisation","permission":"agent-config:write","pathParams":[]},
-  {"id":"agentConfig.user.show","group":"agent-config","summary":"Read USER.md.","cli":"dench user show","method":"GET","path":"/agent-config/user","permission":"agent-config:read","pathParams":[]},
-  {"id":"agentConfig.user.edit","group":"agent-config","summary":"Update USER.md.","cli":"dench user edit","method":"PUT","path":"/agent-config/user","permission":"agent-config:write","pathParams":[]},
-  {"id":"agentConfig.tools.show","group":"agent-config","summary":"Read tool notes.","cli":"dench tools show","method":"GET","path":"/agent-config/tools","permission":"agent-config:read","pathParams":[]},
-  {"id":"agentConfig.tools.edit","group":"agent-config","summary":"Update tool notes.","cli":"dench tools edit","method":"PUT","path":"/agent-config/tools","permission":"agent-config:write","pathParams":[]},
-  {"id":"agentConfig.mem.show","group":"agent-config","summary":"Read aggregate memory.","cli":"dench mem show","method":"GET","path":"/agent-config/mem","permission":"agent-config:read","pathParams":[]},
-  {"id":"agentConfig.mem.edit","group":"agent-config","summary":"Update aggregate memory.","cli":"dench mem set","method":"PUT","path":"/agent-config/mem","permission":"agent-config:write","pathParams":[]},
-  {"id":"agentConfig.bootstrap.show","group":"agent-config","summary":"Read bootstrap state.","cli":"dench bootstrap status","method":"GET","path":"/agent-config/bootstrap","permission":"agent-config:read","pathParams":[]},
-  {"id":"agentConfig.bootstrap.complete","group":"agent-config","summary":"Complete bootstrap.","cli":"dench bootstrap complete","method":"POST","path":"/agent-config/bootstrap/complete","permission":"agent-config:write","pathParams":[]},
-  {"id":"agentConfig.bootstrap.template","group":"agent-config","summary":"Update bootstrap template.","cli":"dench bootstrap template","method":"PUT","path":"/agent-config/bootstrap/template","permission":"agent-config:write","pathParams":[]},
+  {"id":"agentConfig.identity.show","group":"agent-config","summary":"Read IDENTITY.md.","cli":"dench context --sections identity","method":"GET","path":"/agent-config/identity","permission":"agent-config:read","pathParams":[]},
+  {"id":"agentConfig.identity.edit","group":"agent-config","summary":"Update IDENTITY.md.","cli":"dench context set identity","method":"PUT","path":"/agent-config/identity","permission":"agent-config:write","pathParams":[]},
+  {"id":"agentConfig.organisation.show","group":"agent-config","summary":"Read ORGANISATION.md.","cli":"dench context --sections organisation","method":"GET","path":"/agent-config/organisation","permission":"agent-config:read","pathParams":[]},
+  {"id":"agentConfig.organisation.edit","group":"agent-config","summary":"Update ORGANISATION.md.","cli":"dench context set organisation","method":"PUT","path":"/agent-config/organisation","permission":"agent-config:write","pathParams":[]},
+  {"id":"agentConfig.user.show","group":"agent-config","summary":"Read USER.md.","cli":"dench context --sections user","method":"GET","path":"/agent-config/user","permission":"agent-config:read","pathParams":[]},
+  {"id":"agentConfig.user.edit","group":"agent-config","summary":"Update USER.md.","cli":"dench context set user","method":"PUT","path":"/agent-config/user","permission":"agent-config:write","pathParams":[]},
+  {"id":"agentConfig.tools.show","group":"agent-config","summary":"Read tool notes.","cli":"dench context --sections tools","method":"GET","path":"/agent-config/tools","permission":"agent-config:read","pathParams":[]},
+  {"id":"agentConfig.tools.edit","group":"agent-config","summary":"Update tool notes.","cli":"dench context set tools","method":"PUT","path":"/agent-config/tools","permission":"agent-config:write","pathParams":[]},
+  {"id":"workspace.context.rules.set","group":"workspace","summary":"Update standing workspace rules; credentials belong in secrets and runnable setup in environments.","cli":"dench context set rules","method":"PUT","path":"/context/rules","permission":"workspace:write","pathParams":[]},
+  {"id":"agentConfig.mem.show","group":"agent-config","summary":"Read aggregate memory.","cli":"dench mem show","method":"GET","path":"/agent-config/mem","permission":"agent-config:read","deprecated":true,"pathParams":[]},
+  {"id":"agentConfig.mem.edit","group":"agent-config","summary":"Update aggregate memory.","cli":"dench mem set","method":"PUT","path":"/agent-config/mem","permission":"agent-config:write","deprecated":true,"pathParams":[]},
+  {"id":"agentConfig.bootstrap.show","group":"agent-config","summary":"Read bootstrap state.","cli":"dench bootstrap status","method":"GET","path":"/agent-config/bootstrap","permission":"agent-config:read","deprecated":true,"pathParams":[]},
+  {"id":"agentConfig.bootstrap.complete","group":"agent-config","summary":"Complete bootstrap.","cli":"dench bootstrap complete","method":"POST","path":"/agent-config/bootstrap/complete","permission":"agent-config:write","deprecated":true,"pathParams":[]},
+  {"id":"agentConfig.bootstrap.template","group":"agent-config","summary":"Update bootstrap template.","cli":"dench bootstrap template","method":"PUT","path":"/agent-config/bootstrap/template","permission":"agent-config:write","deprecated":true,"pathParams":[]},
   {"id":"agentConfig.model.default","group":"agent-config","summary":"Set the default chat model.","cli":"dench model default","method":"PUT","path":"/agent-config/model/default","permission":"agent-config:write","pathParams":[]},
   {"id":"agentConfig.model.thread","group":"agent-config","summary":"Set a thread model override.","cli":"dench model thread","method":"PUT","path":"/agent-config/model/threads/{threadId}","permission":"agent-config:write","pathParams":["threadId"]},
-  {"id":"agentConfig.daily.today","group":"agent-config","summary":"Read today's daily activity path.","cli":"dench daily today","method":"GET","path":"/agent-config/daily/today","permission":"agent-config:read","pathParams":[]},
-  {"id":"agentConfig.daily.show","group":"agent-config","summary":"Read a daily activity path.","cli":"dench daily show","method":"GET","path":"/agent-config/daily/{date}","permission":"agent-config:read","pathParams":["date"]},
+  {"id":"agentConfig.daily.today","group":"agent-config","summary":"Read today's daily activity path.","cli":"dench daily today","method":"GET","path":"/agent-config/daily/today","permission":"agent-config:read","deprecated":true,"pathParams":[]},
+  {"id":"agentConfig.daily.show","group":"agent-config","summary":"Read a daily activity path.","cli":"dench daily show","method":"GET","path":"/agent-config/daily/{date}","permission":"agent-config:read","deprecated":true,"pathParams":["date"]},
   {"id":"notifications.list","group":"notifications","summary":"List your notifications (inbox, unread, archived, or all).","cli":"dench notifications list","method":"GET","path":"/notifications","permission":"notifications:read","pathParams":[]},
   {"id":"notifications.unreadCount","group":"notifications","summary":"How many unread notifications you have.","cli":"dench notifications count","method":"GET","path":"/notifications/unread-count","permission":"notifications:read","pathParams":[]},
   {"id":"notifications.read","group":"notifications","summary":"Mark a notification read (or unread).","cli":"dench notifications read","method":"PATCH","path":"/notifications/{notificationId}","permission":"notifications:write","pathParams":["notificationId"]},
@@ -487,7 +501,7 @@ export const APP_SDK_OPERATIONS: readonly AppSdkOperationInfo[] = [
 ];
 
 /** CLI-only operation ids (sessions, fs, imports): never callable from an app. */
-export const APP_SDK_LOCAL_OPERATIONS: readonly string[] = ["sessions.local.list","sessions.local.use","sessions.local.logout","backend.local.configure","enrichment.filters.options","crm.import","crm.export","meetings.import","fs.daemon","apps.validate"];
+export const APP_SDK_LOCAL_OPERATIONS: readonly string[] = ["environments.run","sessions.local.list","sessions.local.use","sessions.local.logout","backend.local.configure","enrichment.filters.options","crm.import","crm.export","meetings.import","fs.daemon","apps.validate"];
 
 /** Curated window.dench methods → permission (host + aliases). */
 export const APP_SDK_METHODS: Readonly<Record<string, AppSdkMethodInfo>> = {

package/lib/command-args.ts

@@ -51,6 +51,17 @@ export const COMMAND_ARGUMENTS = [
   spec("use", [1, 1]),
   spec("backend set", [1, 1]),
   spec("backend clear", [0, 0]),
+  spec("env list", [0, 0], "--limit --cursor"),
+  spec("env show", [1, 1], "--revision"),
+  spec("env save", [1, 1], "--path --wait", "--no-wait"),
+  spec("env run", [1, 1], "--revision --state-key", "--prepare-local"),
+  spec("env delete", [1, 1]),
+  spec("secrets set", [1, 1], "--file --kind --expected-version", "--stdin"),
+  spec("secrets list", [0, 0]),
+  spec("secrets delete", [1, 1], "--expected-version"),
+  ...["identity", "organisation", "user", "tools", "rules"].map((section) =>
+    spec(`context set ${section}`, [0, 0], "--content", "--stdin"),
+  ),
   ...["install", "uninstall", "refresh"].map((verb) =>
     spec(
       `ads ${verb}`,
@@ -80,7 +91,7 @@ export const COMMAND_ARGUMENTS = [
   spec(
     "chat new",
     [1, null],
-    "--model --file-context --visibility --title",
+    "--model --file-context --visibility --title --environment",
     "--yolo --follow",
   ),
   spec("chat send", [2, null], "--model", "--yolo --follow"),
@@ -113,13 +124,14 @@ export const COMMAND_ARGUMENTS = [
   spec(
     "cron create",
     [1, 1],
-    "--prompt --description --overlap --target --type --at --cron --tz --every --every-ms --connection --event --toolkit --trigger-config --object --where --where-logic",
+    "--prompt --description --overlap --target --type --at --cron --tz --every --every-ms --connection --event --toolkit --trigger-config --object --where --where-logic --environment",
     "--disabled --delete-after-run --no-secret --signed",
   ),
   spec(
     "cron update",
     [1, 1],
-    "--name --prompt --description --overlap --enabled --at --cron --tz --every --every-ms",
+    "--name --prompt --description --overlap --enabled --at --cron --tz --every --every-ms --environment",
+    "--clear-environment",
   ),
   spec("cron run", [1, 1], "", "--wait"),
   spec("cron secret", [1, 1], "", "--off"),
@@ -189,7 +201,10 @@ export const COMMAND_ARGUMENTS = [
 ];
 
 export function assertDeclaredCommandFlags(argv: readonly string[]): void {
-  const args = argv.filter((arg) => arg !== "--json");
+  const boundary = argv.indexOf("--");
+  const args = argv
+    .slice(0, boundary < 0 ? undefined : boundary)
+    .filter((arg) => arg !== "--json");
   if (["routine", "routines"].includes(args[0])) args[0] = "cron";
   if (["ad", "adline"].includes(args[0])) args[0] = "ads";
   if (args[0] === "agent" && ["new", "send"].includes(args[1]))

package/lib/command-help.ts

@@ -37,8 +37,23 @@ export function commandHelp(argv: readonly string[], usageText = ""): string {
       description: "",
     })),
     ...apiOperations
-      .filter((op) => !op.deprecated)
-      .map((op) => ({ usage: op.cli, description: op.summary })),
+      .filter((op) => {
+        if (!op.deprecated) return true;
+        // Keep exact legacy leaf help available without adding those commands
+        // back to the broad index or a parent family's discovery.
+        const command = words(op.cli);
+        return (
+          command.length > 1 &&
+          input.length >= command.length &&
+          matches(input.slice(0, command.length), command)
+        );
+      })
+      .map((op) => ({
+        usage: op.cli,
+        description: op.deprecated
+          ? `Compatibility command. ${op.summary}`
+          : op.summary,
+      })),
   ];
   let prefix = input;
   while (

package/lib/command-registry.ts

@@ -137,6 +137,190 @@ function local(reason: string): LocalOnlyOperation {
 }
 
 const rawApiOperations = [
+  op({
+    id: "environments.list",
+    group: "environments",
+    summary:
+      "List workspace-shared reusable setups and ready revisions (metadata only).",
+    cli: "dench env list",
+    method: "GET",
+    path: "/environments",
+    requestSchema: z
+      .object({
+        limit: z.number().int().min(1).max(100).optional(),
+        cursor: z.string().optional(),
+      })
+      .strict(),
+    responseSchema: anyResponse,
+    backend: convex("query", "functions/environments:list"),
+  }),
+  op({
+    id: "environments.get",
+    group: "environments",
+    summary:
+      "Inspect a saved setup, its manifest, and an optional immutable revision.",
+    cli: "dench env show",
+    method: "GET",
+    path: "/environments/{name}",
+    requestSchema: z
+      .object({
+        name: z.string().regex(/^[a-z][a-z0-9-]{0,63}$/),
+        revision: z
+          .string()
+          .regex(/^[a-f0-9]{64}$/)
+          .optional(),
+      })
+      .strict(),
+    responseSchema: anyResponse,
+    backend: convex("query", "functions/environments:get"),
+  }),
+  op({
+    id: "environments.upload",
+    group: "environments",
+    summary:
+      "Reserve an owner-bound source upload. Prefix the uploaded bytes with the returned proof before saving.",
+    cli: "dench env save",
+    method: "POST",
+    path: "/environments/uploads",
+    requestSchema: z
+      .object({
+        kind: z.literal("source"),
+        size: z.number().int().min(1).max(16777216),
+        sha256: z.string().regex(/^[a-f0-9]{64}$/),
+      })
+      .strict(),
+    responseSchema: anyResponse,
+    backend: convex("mutation", "functions/environments:requestUpload"),
+  }),
+  op({
+    id: "environments.save",
+    group: "environments",
+    summary:
+      "Publish an explicitly saved source and manifest for one-time preparation. Returns pending/building until verified; does not run the task.",
+    cli: "dench env save",
+    method: "POST",
+    path: "/environments/{name}",
+    requestSchema: z
+      .object({
+        name: z.string().regex(/^[a-z][a-z0-9-]{0,63}$/),
+        manifest: z
+          .object({
+            version: z.literal(1),
+            name: z.string(),
+            purpose: z.string(),
+            files: z.array(z.string()),
+            prepare: z.array(z.string()),
+            verify: z.array(z.string()),
+            env: z.record(z.string(), z.string()).optional(),
+            secretEnv: z.record(z.string(), z.string()).optional(),
+            secretFiles: z
+              .array(
+                z.object({
+                  path: z.string(),
+                  secret: z.string(),
+                  mutable: z.boolean().optional(),
+                }),
+              )
+              .optional(),
+            statePaths: z.array(z.string()).optional(),
+            portable: z.boolean().optional(),
+          })
+          .strict(),
+        uploadId: z.string(),
+        storageId: z.string(),
+        sha256: z.string().regex(/^[a-f0-9]{64}$/),
+      })
+      .strict(),
+    responseSchema: anyResponse,
+    backend: convex("action", "functions/environmentsNode:save"),
+  }),
+  op({
+    id: "environments.delete",
+    group: "environments",
+    summary:
+      "Retire a saved setup from new selection; retain immutable revisions and active job evidence.",
+    cli: "dench env delete",
+    method: "DELETE",
+    path: "/environments/{name}",
+    requestSchema: z
+      .object({ name: z.string().regex(/^[a-z][a-z0-9-]{0,63}$/) })
+      .strict(),
+    responseSchema: anyResponse,
+    backend: convex("mutation", "functions/environments:remove"),
+  }),
+  op({
+    id: "environments.run",
+    group: "environments",
+    summary:
+      "Run a command with prepared dependencies and declared credentials, saving declared state with a revision check.",
+    cli: "dench env run",
+    method: "POST",
+    path: "/local/environments/run",
+    requestSchema: noBody,
+    responseSchema: anyResponse,
+    backend: local(
+      "Execution occurs in the CLI process. Use dench env run NAME -- COMMAND; secret-bearing execution resolution is not a general REST read endpoint.",
+    ),
+  }),
+  op({
+    id: "secrets.list",
+    group: "secrets",
+    summary:
+      "List workspace-shared credential names, kinds and versions; never values.",
+    cli: "dench secrets list",
+    method: "GET",
+    path: "/secrets",
+    requestSchema: z
+      .object({
+        limit: z.number().int().min(1).max(100).optional(),
+        cursor: z.string().optional(),
+      })
+      .strict(),
+    responseSchema: anyResponse,
+    backend: convex("query", "functions/workspaceSecrets:list"),
+  }),
+  op({
+    id: "secrets.set",
+    group: "secrets",
+    summary:
+      "Encrypt a workspace credential. Use CLI stdin or the secure chat form; return metadata only. Do not put values in chat, manifests or scripts.",
+    cli: "dench secrets set",
+    method: "PUT",
+    path: "/secrets/{name}",
+    requestSchema: z
+      .object({
+        name: z.string().regex(/^[A-Z][A-Z0-9_]{0,127}$/),
+        kind: z.enum(["env", "file"]),
+        value: z.string().min(1).max(65536),
+        expectedVersion: z.number().int().nonnegative().optional(),
+      })
+      .strict(),
+    responseSchema: z.object({
+      name: z.string(),
+      kind: z.enum(["env", "file"]),
+      version: z.number(),
+      revision: z.number(),
+      status: z.literal("stored"),
+    }),
+    backend: convex("action", "functions/workspaceSecretsNode:set"),
+  }),
+  op({
+    id: "secrets.delete",
+    group: "secrets",
+    summary:
+      "Revoke a workspace credential for future resolution, optionally checking its version.",
+    cli: "dench secrets delete",
+    method: "DELETE",
+    path: "/secrets/{name}",
+    requestSchema: z
+      .object({
+        name: z.string().regex(/^[A-Z][A-Z0-9_]{0,127}$/),
+        expectedVersion: z.number().int().nonnegative().optional(),
+      })
+      .strict(),
+    responseSchema: anyResponse,
+    backend: convex("mutation", "functions/workspaceSecrets:remove"),
+  }),
   op({
     id: "campaigns.drafts.create",
     group: "campaigns",
@@ -5134,7 +5318,8 @@ const rawApiOperations = [
     id: "agentConfig.identity.show",
     group: "agent-config",
     summary: "Read IDENTITY.md.",
-    cli: "dench identity show",
+    cli: "dench context --sections identity",
+    aliases: ["dench identity show"],
     method: "GET",
     path: "/agent-config/identity",
     requestSchema: noBody,
@@ -5145,7 +5330,8 @@ const rawApiOperations = [
     id: "agentConfig.identity.edit",
     group: "agent-config",
     summary: "Update IDENTITY.md.",
-    cli: "dench identity edit",
+    cli: "dench context set identity",
+    aliases: ["dench identity edit"],
     method: "PUT",
     path: "/agent-config/identity",
     requestSchema: anyObject,
@@ -5156,7 +5342,8 @@ const rawApiOperations = [
     id: "agentConfig.organisation.show",
     group: "agent-config",
     summary: "Read ORGANISATION.md.",
-    cli: "dench organisation show",
+    cli: "dench context --sections organisation",
+    aliases: ["dench organisation show"],
     method: "GET",
     path: "/agent-config/organisation",
     requestSchema: noBody,
@@ -5167,7 +5354,8 @@ const rawApiOperations = [
     id: "agentConfig.organisation.edit",
     group: "agent-config",
     summary: "Update ORGANISATION.md.",
-    cli: "dench organisation edit",
+    cli: "dench context set organisation",
+    aliases: ["dench organisation edit"],
     method: "PUT",
     path: "/agent-config/organisation",
     requestSchema: anyObject,
@@ -5178,7 +5366,8 @@ const rawApiOperations = [
     id: "agentConfig.user.show",
     group: "agent-config",
     summary: "Read USER.md.",
-    cli: "dench user show",
+    cli: "dench context --sections user",
+    aliases: ["dench user show"],
     method: "GET",
     path: "/agent-config/user",
     requestSchema: noBody,
@@ -5189,7 +5378,8 @@ const rawApiOperations = [
     id: "agentConfig.user.edit",
     group: "agent-config",
     summary: "Update USER.md.",
-    cli: "dench user edit",
+    cli: "dench context set user",
+    aliases: ["dench user edit"],
     method: "PUT",
     path: "/agent-config/user",
     requestSchema: anyObject,
@@ -5200,7 +5390,8 @@ const rawApiOperations = [
     id: "agentConfig.tools.show",
     group: "agent-config",
     summary: "Read tool notes.",
-    cli: "dench tools show",
+    cli: "dench context --sections tools",
+    aliases: ["dench tools show"],
     method: "GET",
     path: "/agent-config/tools",
     requestSchema: noBody,
@@ -5211,15 +5402,32 @@ const rawApiOperations = [
     id: "agentConfig.tools.edit",
     group: "agent-config",
     summary: "Update tool notes.",
-    cli: "dench tools edit",
+    cli: "dench context set tools",
+    aliases: ["dench tools edit"],
     method: "PUT",
     path: "/agent-config/tools",
     requestSchema: anyObject,
     responseSchema: anyResponse,
     backend: convex("mutation", "functions/agentConfig:updateToolsNotes"),
   }),
+  op({
+    id: "workspace.context.rules.set",
+    group: "workspace",
+    summary:
+      "Update standing workspace rules; credentials belong in secrets and runnable setup in environments.",
+    cli: "dench context set rules",
+    method: "PUT",
+    path: "/context/rules",
+    requestSchema: z.object({ content: z.string().min(1).max(32000) }).strict(),
+    responseSchema: anyResponse,
+    backend: {
+      ...convex("mutation", "functions/agentConfig:writeMagicFileFromUI"),
+      fixedArgs: { path: "/RULES.md" },
+    },
+  }),
   op({
     id: "agentConfig.mem.show",
+    deprecated: true,
     group: "agent-config",
     summary: "Read aggregate memory.",
     cli: "dench mem show",
@@ -5231,6 +5439,7 @@ const rawApiOperations = [
   }),
   op({
     id: "agentConfig.mem.edit",
+    deprecated: true,
     group: "agent-config",
     summary: "Update aggregate memory.",
     cli: "dench mem set",
@@ -5242,6 +5451,7 @@ const rawApiOperations = [
   }),
   op({
     id: "agentConfig.bootstrap.show",
+    deprecated: true,
     group: "agent-config",
     summary: "Read bootstrap state.",
     cli: "dench bootstrap status",
@@ -5253,6 +5463,7 @@ const rawApiOperations = [
   }),
   op({
     id: "agentConfig.bootstrap.complete",
+    deprecated: true,
     group: "agent-config",
     summary: "Complete bootstrap.",
     cli: "dench bootstrap complete",
@@ -5264,6 +5475,7 @@ const rawApiOperations = [
   }),
   op({
     id: "agentConfig.bootstrap.template",
+    deprecated: true,
     group: "agent-config",
     summary: "Update bootstrap template.",
     cli: "dench bootstrap template",
@@ -5300,6 +5512,7 @@ const rawApiOperations = [
   }),
   op({
     id: "agentConfig.daily.today",
+    deprecated: true,
     group: "agent-config",
     summary: "Read today's daily activity path.",
     cli: "dench daily today",
@@ -5311,6 +5524,7 @@ const rawApiOperations = [
   }),
   op({
     id: "agentConfig.daily.show",
+    deprecated: true,
     group: "agent-config",
     summary: "Read a daily activity path.",
     cli: "dench daily show",