@dench.com/cli 3.7.0-staging.387 → 3.8.1-staging.390

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dench.com/cli",
-  "version": "3.7.0-staging.387",
+  "version": "3.8.1-staging.390",
   "description": "Dench agent workspace CLI.",
   "type": "module",
   "bin": {
@@ -26,7 +26,6 @@
     "home-sync",
     "home-sync.ts",
     "home-sync-lib.ts",
-    "agent.ts",
     "chat.ts",
     "chat-spawn.ts",
     "crm.ts",
@@ -60,7 +59,10 @@
     "lib/organizationSelector.ts",
     "lib/",
     "app-sdk.d.ts",
-    "README.md"
+    "README.md",
+    "environments.ts",
+    "workspace-secrets.ts",
+    "context-settings.ts"
   ],
   "exports": {
     "./app-sdk": {

package/workspace-secrets.ts

@@ -0,0 +1,231 @@
+import { readFile, stat } from "node:fs/promises";
+import type { ConvexHttpClient } from "convex/browser";
+import { makeFunctionReference } from "convex/server";
+import { CliArgError } from "./lib/cli-args";
+import {
+  integerOption,
+  isEnvironmentHelp,
+  parseEnvironmentOptions,
+  requireSecretName,
+} from "./lib/environment-cli-args";
+import { EnvironmentOutputRedactor } from "./lib/environment-execution";
+
+const MAX_SECRET_BYTES = 64 * 1024;
+const HELP = `dench secrets — workspace-shared encrypted credentials
+
+  dench secrets set NAME --stdin [--kind env|file] [--expected-version N] [--json]
+  dench secrets set NAME --file PATH [--kind env|file] [--expected-version N] [--json]
+  dench secrets list [--json]
+  dench secrets delete NAME [--expected-version N] [--json]
+
+Values are accepted only through stdin or a file. Values are never printed.
+Bind a stored name in dench-env.json secretEnv or secretFiles; env run injects
+only those bindings. Memory is not credential storage. --kind defaults to env.
+Example: dench secrets set OPENAI_API_KEY --stdin < /private/path/key.txt`;
+
+export function workspaceSecretsHelpText(): string {
+  return HELP;
+}
+
+export function validateWorkspaceSecretsArgs(input: readonly string[]) {
+  if (isEnvironmentHelp(input)) return { verb: "help" as const };
+  const verb = input[0];
+  if (!verb || !["set", "list", "delete"].includes(verb))
+    throw new CliArgError(
+      "Use dench secrets set, list, or delete; see --help.",
+    );
+  const opts = parseEnvironmentOptions(
+    input.slice(1),
+    verb === "set"
+      ? ["--file", "--kind", "--expected-version"]
+      : verb === "delete"
+        ? ["--expected-version"]
+        : [],
+    verb === "set" ? ["--stdin", "--json"] : ["--json"],
+  );
+  if (opts.child.length || opts.positional.length !== (verb === "list" ? 0 : 1))
+    throw new CliArgError(
+      `Unexpected or missing arguments for dench secrets ${verb}.`,
+    );
+  const name =
+    verb === "list" ? undefined : requireSecretName(opts.positional[0]);
+  const kind = opts.flags["--kind"] ?? "env";
+  if (kind !== "env" && kind !== "file")
+    throw new CliArgError("--kind must be env or file.");
+  if (
+    verb === "set" &&
+    Number(Boolean(opts.flags["--stdin"])) +
+      Number(Boolean(opts.flags["--file"])) !==
+      1
+  )
+    throw new CliArgError(
+      "Use exactly one of --stdin or --file; never put secret values in command arguments.",
+    );
+  const expectedVersion =
+    opts.flags["--expected-version"] === undefined
+      ? undefined
+      : integerOption(
+          opts.flags["--expected-version"],
+          "--expected-version",
+          0,
+          0,
+          Number.MAX_SAFE_INTEGER,
+        );
+  return {
+    verb: verb as "set" | "list" | "delete",
+    name,
+    kind,
+    expectedVersion,
+    file: opts.flags["--file"] as string | undefined,
+  };
+}
+
+async function readSecretInput(): Promise<string> {
+  if (process.stdin.isTTY)
+    throw new CliArgError(
+      "Pipe the credential into stdin, or use --file. Interactive plaintext entry is not supported.",
+    );
+  const chunks: Buffer[] = [];
+  let bytes = 0;
+  for await (const chunk of process.stdin) {
+    const buffer = Buffer.from(chunk);
+    bytes += buffer.length;
+    if (bytes > MAX_SECRET_BYTES)
+      throw new CliArgError("Secret exceeds the 64 KiB limit.");
+    chunks.push(buffer);
+  }
+  return new TextDecoder("utf-8", { fatal: true }).decode(
+    Buffer.concat(chunks),
+  );
+}
+
+export async function runWorkspaceSecretsCommand(opts: {
+  convex: ConvexHttpClient;
+  args: string[];
+  sessionToken?: string;
+  readStdin?: () => Promise<string>;
+}): Promise<void> {
+  const parsed = validateWorkspaceSecretsArgs(opts.args);
+  if (parsed.verb === "help") {
+    console.log(HELP);
+    return;
+  }
+  const token = opts.sessionToken ? { sessionToken: opts.sessionToken } : {};
+  if (parsed.verb === "list") {
+    console.log(
+      JSON.stringify(
+        await opts.convex.query(
+          makeFunctionReference<"query">("functions/workspaceSecrets:list"),
+          token,
+        ),
+        null,
+        2,
+      ),
+    );
+    return;
+  }
+  if (parsed.verb === "delete") {
+    console.log(
+      JSON.stringify(
+        await opts.convex.mutation(
+          makeFunctionReference<"mutation">(
+            "functions/workspaceSecrets:remove",
+          ),
+          {
+            ...token,
+            name: parsed.name,
+            ...(parsed.expectedVersion === undefined
+              ? {}
+              : { expectedVersion: parsed.expectedVersion }),
+          },
+        ),
+        null,
+        2,
+      ),
+    );
+    return;
+  }
+  if (parsed.file && (await stat(parsed.file)).size > MAX_SECRET_BYTES)
+    throw new CliArgError("Secret exceeds the 64 KiB limit.");
+  let value = parsed.file
+    ? new TextDecoder("utf-8", { fatal: true }).decode(
+        await readFile(parsed.file),
+      )
+    : await (opts.readStdin ?? readSecretInput)();
+  // Text files commonly contain a final newline; preserve credential-file bytes.
+  if (parsed.kind === "env") value = value.replace(/\r?\n$/, "");
+  if (
+    !value ||
+    Buffer.byteLength(value, "utf8") > MAX_SECRET_BYTES ||
+    value.includes("\0")
+  )
+    throw new CliArgError(
+      "Credential must be nonempty UTF-8 text without NUL, up to 64 KiB.",
+    );
+  let result: unknown;
+  try {
+    result = await opts.convex.action(
+      makeFunctionReference<"action">("functions/workspaceSecretsNode:set"),
+      {
+        ...token,
+        name: parsed.name,
+        kind: parsed.kind,
+        value,
+        ...(parsed.expectedVersion === undefined
+          ? {}
+          : { expectedVersion: parsed.expectedVersion }),
+      },
+    );
+  } catch (error) {
+    const redactor = new EnvironmentOutputRedactor([value]);
+    const data = (
+      error as {
+        data?: { code?: string; receiptId?: string; version?: number };
+      }
+    ).data;
+    const sanitized = new Error(
+      redactor.push(
+        error instanceof Error ? error.message : String(error),
+        true,
+      ),
+    );
+    Object.assign(sanitized, {
+      data: {
+        message: sanitized.message,
+        ...(data?.code ? { code: data.code } : {}),
+        ...(data?.receiptId ? { receiptId: data.receiptId } : {}),
+        ...(data?.version !== undefined ? { version: data.version } : {}),
+      },
+    });
+    throw sanitized;
+  }
+  // Do not print an arbitrary response shape from a credential endpoint.
+  const safe = result as {
+    name?: string;
+    version?: number;
+    kind?: string;
+    updatedAt?: number;
+  };
+  if (
+    !safe ||
+    !Number.isSafeInteger(safe.version) ||
+    (safe.version ?? 0) < 1 ||
+    (safe.name && safe.name !== parsed.name)
+  )
+    throw new Error(
+      "secret_storage_unconfirmed: Storage did not return a valid version. Inspect dench secrets list before retrying.",
+    );
+  console.log(
+    JSON.stringify(
+      {
+        name: safe.name ?? parsed.name,
+        version: safe.version,
+        kind: safe.kind ?? parsed.kind,
+        updatedAt: safe.updatedAt,
+        stored: true,
+      },
+      null,
+      2,
+    ),
+  );
+}

package/agent.ts

@@ -1,37 +0,0 @@
-import type { ConvexHttpClient } from "convex/browser";
-
-class AgentCliError extends Error {}
-
-function agentHelp(): void {
-  console.log(`Usage: dench agent <subcommand>
-
-Agent sessions are normal chat-turn workflows, the same path used by the web UI:
-  dench agent new "<prompt>" [--model <m>] [--file-context <path>] [--visibility private|shared] [--title T] [--yolo] [--follow] [--json]
-  dench agent send <thread-id> "<message>" [--model <m>] [--yolo] [--follow] [--json]
-  dench agent follow <thread-id> [--json]
-
-These are aliases for:
-  dench chat new
-  dench chat send
-  dench chat follow
-
-Use spawn_agent from inside a running chat to create child agents. Child agents
-are also normal chat threads and can be followed with dench agent follow.
-`);
-}
-
-export async function runAgentCommand(_opts: {
-  convex: ConvexHttpClient;
-  args: string[];
-  sessionToken?: string;
-  callerRunId?: string;
-}): Promise<void> {
-  const subcommand = _opts.args[0];
-  if (!subcommand || subcommand === "help" || subcommand === "--help") {
-    agentHelp();
-    return;
-  }
-  throw new AgentCliError(
-    `Unknown agent subcommand: ${subcommand}. Use dench agent new, send, or follow.`,
-  );
-}