@dench.com/cli 3.7.0-staging.387 → 3.8.1-staging.390

package/README.md

@@ -112,9 +112,8 @@ next commands. Add `--json` for structured output.
 
 Browse and search the user's past chat threads in this workspace (own +
 shared). Useful for pulling in earlier context when the user refers to
-something they discussed before. The chat agent has the equivalent
-in-process tools (`list_past_chats`, `search_past_chats`,
-`read_past_chat`); this CLI surface is the same data accessed via bash.
+something they discussed before. The shared chat harness uses these same CLI
+commands through its execution tool; there is no separate agent-only chat-history command family.
 
 ```bash
 dench chat list [--query <substr>] [--limit N] [--include-archived] [--json]
@@ -391,54 +390,53 @@ Outreach needs a workspace member's credentials (a `dench signin` session, a
 member-bound `DENCH_API_KEY`, or an agent session); an organization-only key
 is refused.
 
-## Workspace sync
+## Workspace files and reusable setup
 
-Starting with CLI 2.9.8, `dench fs status` reports cached local daemon
-health, not a live comparison between disk and the cloud copy. The status
-probe does not scan the workspace, contact the backend, or start a mount
-worker.
+Use `dench files` for saved workspace documents and `dench stage` for outputs.
+Harness A keeps a separate scratch directory per job. The old filesystem and
+home-sync daemons are legacy compatibility infrastructure; they are not needed
+to execute a command or restore a saved environment.
 
-```bash
-dench fs status --json
-dench fs status --workspace /workspace --json
-```
-
-| JSON field | Meaning |
-| --- | --- |
-| `daemon.healthy` | The process is alive and cached progress passes freshness checks, with a short startup grace before the first scan. |
-| `daemon.workspaceMatches` | The cached daemon serves the requested workspace root. A mismatch also makes `healthy` false. |
-| `daemon.state.mountWorker` | Cached worker state, PID, last progress time, restart count, and error. |
-| `counts.onDisk` | Last successful scan's count, only for the matching root; `null` when unavailable. Not a fresh count. |
-| `counts.inConvex`, `counts.onlyOnDisk`, `counts.onlyInConvex`, `counts.hashMismatches` | `null`: these counts are unknown, not zero. |
-| `driftStatus`, `drift` | `"not_checked"` and `[]`; an empty list does not prove that files match. |
-
-Status exits **1** when the daemon is missing, dead, stale, stalled, or
-serves a different root, including with `--json`; exit **0** means cached
-health passed, not that every pending write has synced. The legacy
-`--no-hash` and `--drift-limit N` flags remain accepted but have no effect.
-
-To pull a workspace file through the running daemon:
-
-```bash
-dench fs pull "/reports/example.csv" --wait --timeout-ms 10000 --json
+```sh
+dench files cat /reports/example.md
+dench env list --json
+dench env save openai-report --path ./openai-report --json
+dench env show openai-report --json
+dench env run openai-report -- node report.mjs
+dench secrets set OPENAI_API_KEY --stdin < /private/path/key.txt
 ```
 
-`--timeout-ms` covers the whole request, including queueing, metadata,
-download, and mounted write (default 10 seconds, capped at 60 seconds).
-Successful `--wait` means the downloaded original passed its SHA-256 check
-and the write finished before the deadline. Without `--wait`, success
-means only that the request was queued.
-
-A running daemon process does not hot-upgrade: restart it after installing a
-new CLI.
+A saved directory requires `dench-env.json`, `SKILL.md`, an explicit file allowlist
+and verification commands. It builds dependencies once, publishes a ready
+revision, and reuses the prepared snapshot or compatible bundle. Only the chosen
+environment is loaded. Secrets are encrypted separately and injected into the
+executing process; they never become dependency archives or memory facts.
+
+New automation runs select the latest ready revision; active jobs and their
+children retain the resolved revision. State is isolated by job or automation
+unless an explicit shared state key is chosen. State writes and refreshed
+credential files use compare-and-set versions; conflicts do not replay business
+operations. Rotate credentials without reinstalling packages.
+
+On a different local OS/runtime, explicitly prepare a separate platform cache
+once using `dench env run openai-report --prepare-local -- node report.mjs`.
+Normal ready runs never invoke a package installer. The local executor provides
+separate directories, not operating-system isolation.
+
+See [the environment reference](https://dench.com/references/ENVIRONMENTS.md)
+for the manifest, cold-start costs, mutable state and recovery receipts. Use
+`dench memory search/save` for facts and preferences, `dench context set` for
+standing context, and `dench secrets` for credentials. An old memory claiming
+that a service is configured cannot replace a successful storage receipt.
 
 ## Sandbox / API key auth (no `dench signin` required)
 
 Inside a Dench sandbox the Dench API key is set in the environment when the
 sandbox starts. When `DENCH_API_KEY` is present, the CLI skips the
 `dench signin` flow entirely and uses the key as a bearer for every org-scoped
-command — `dench crm`, `dench files`, `dench fs sync`, etc. The key targets
-production.
+command — `dench crm`, `dench files`, and other workspace operations. The
+selected connection determines the backend; hosted credentials stay scoped to
+the authorized workspace and job.
 
 ```bash
 export DENCH_API_KEY=dench_pk_live_…
@@ -477,7 +475,8 @@ dench context --sections organisation,user,memory --json
 ```
 
 Section names are `identity`, `organisation`, `user`, `memory`, `rules`, and
-`tools`. Multiple names use one query. The existing `organisation show`,
-`user show`, and `mem show` commands use the same saved documents; reading never
-fills profiles or writes memory. Personal USER context is unavailable to shared
+`tools`. Multiple names use one query. Reading never fills profiles or writes
+memory. Edit the selected context with
+`dench context set <identity|organisation|user|tools|rules> --stdin`; older profile
+aliases remain compatibility paths. Personal USER context is unavailable to shared
 channel sessions. `dench context --json` keeps its existing workspace overview.

package/agent-config.ts

@@ -1,5 +1,5 @@
 /**
- * `dench identity / organisation / user / bootstrap / model / daily /
+ * `dench identity / organisation / user / bootstrap / model /
  *  mem aggregate` — CLI surface for the OpenClaw-
  * parity self-updating harness.
  *
@@ -15,14 +15,13 @@
  *   identity show | edit
  *   organisation show | edit
  *   user show | edit
- *   tools show | notes-edit
+ *   tools show | edit
  *   memory show | append <text> | set                   (MEMORY.md aggregate)
  *   bootstrap status | complete | reopen | template
  *   model default <id> | model default clear |
  *   model thread <threadId> <id> | model thread <threadId> clear
- *   daily today | daily show <YYYY-MM-DD> | daily append <text>
  *
- * `edit` / `notes-edit` / `template` open the
+ * `edit` / `template` open the
  * user's `$EDITOR` (default `vi`) to capture the new body. The
  * stdin path is also supported via `--stdin`, useful in scripts.
  */
@@ -496,66 +495,17 @@ export async function runModelCommand(ctx: CliCtx): Promise<void> {
   await handleModel(ctx, ctx.args);
 }
 
-/**
- * Daily activity log subcommands (real fileTree files under
- * `/workspace/daily/`). Today / show <YYYY-MM-DD> read the inline
- * cache; append delegates to the agent action so timestamps and
- * heading wrappers stay consistent.
- */
-export async function runDailyCommand(ctx: CliCtx): Promise<void> {
-  consumeOutputFlag(ctx);
-  const sub = ctx.args[0];
-  if (!sub || sub === "today") {
-    const today = new Date();
-    const yyyy = today.getUTCFullYear();
-    const mm = String(today.getUTCMonth() + 1).padStart(2, "0");
-    const dd = String(today.getUTCDate()).padStart(2, "0");
-    const path = `/daily/${yyyy}-${mm}-${dd}.md`;
-    // Daily logs are real files — fetch via the workspace file API
-    // hop so the same auth (Convex Auth or API key) works.
-    out(
-      ctx,
-      ctx.jsonOutput
-        ? { path }
-        : `Today's daily log lives at ${path}. Use \`dench fs cat ${path}\` to read it, or open it in the workspace UI.`,
-    );
-    return;
-  }
-  if (sub === "show") {
-    const date = ctx.args[1];
-    if (!date) {
-      throw new AgentConfigCliError("Usage: dench daily show <YYYY-MM-DD>");
-    }
-    out(
-      ctx,
-      ctx.jsonOutput
-        ? { path: `/daily/${date}.md` }
-        : `Daily log for ${date} lives at /daily/${date}.md. Use \`dench fs cat\` to read it.`,
-    );
-    return;
-  }
-  if (sub === "append") {
-    throw new AgentConfigCliError(
-      "Daily append is currently only available via the agent's `append_daily_log` tool. Use the chat to log entries with timestamps.",
-    );
-  }
-  throw new AgentConfigCliError(
-    `Unknown daily subcommand: "${sub}". Try "today", "show <YYYY-MM-DD>".`,
-  );
-}
-
 export function printAgentConfigCliHelp(): void {
   console.log(
-    `Self-updating agent harness:
+    `Workspace context compatibility aliases (prefer dench context --sections / context set):
 
   dench identity show | edit                        IDENTITY.md (org-wide)
   dench organisation show | edit                    ORGANISATION.md
   dench user show | edit                            USER.md (per-member)
-  dench tools show | notes-edit                     TOOLS.md notes section
+  dench tools show | edit                     TOOLS.md notes section
   dench mem show | append <text> | set              MEMORY.md aggregate
   dench bootstrap status | complete | reopen | template
   dench model default <id|clear> | model thread <threadId> <id|clear>
-  dench daily today | show <YYYY-MM-DD>              Activity log paths
 
 Editing flags:
   --content "<markdown>"   Inline body