@dench.com/cli 3.7.0-staging.387 → 3.8.1-staging.390

package/lib/api-schemas.ts

@@ -20,15 +20,23 @@
  */
 import { type ZodTypeAny, z } from "zod";
 import {
+  CONDITION_CHECKS,
+  CONDITION_OPERATORS,
   checkCampaignSteps,
   checkStepEdits,
+  hasWorkflowShape,
   LINKEDIN_REACTIONS,
+  MAX_ACCEPTANCE_WAIT_HOURS,
   MAX_CAMPAIGN_STEPS,
   MAX_INMAIL_BODY_CHARS,
   MAX_INMAIL_SUBJECT_CHARS,
   MAX_LIKE_POST_AGE_DAYS,
+  MAX_LIKE_POST_COUNT,
   MAX_WAIT_HOURS,
+  MIN_ACCEPTANCE_WAIT_HOURS,
   MIN_WITHDRAW_AFTER_HOURS,
+  STEP_TYPES,
+  WORKFLOW_END,
 } from "./campaign-steps";
 
 const nativeEmailRecipient = z.object({
@@ -667,16 +675,25 @@ const campaignSendSchedule = z
   );
 
 const campaignStepType = z
-  .enum([
-    "email",
-    "wait",
-    "linkedin_visit",
-    "linkedin_connection",
-    "linkedin_message",
-    "linkedin_like_post",
-    "linkedin_inmail",
-  ])
-  .describe("Step type.");
+  .enum(STEP_TYPES)
+  .describe(
+    "Step type. condition (If / else) and wait_for_connection (Wait for them to accept) send nothing; they continue on yesNext or noNext and make the campaign a workflow.",
+  );
+
+const workflowTarget = (exit: string) =>
+  z
+    .string()
+    .min(1)
+    .optional()
+    .describe(
+      `Workflow steps: ${exit}: another step's key, or "${WORKFLOW_END}" to stop there. Fixed once the campaign launches.`,
+    );
+
+const campaignStepModel = z
+  .enum(["linear", "workflow"])
+  .describe(
+    "linear: steps run in order. workflow: steps have keys and paths (next, yesNext, noNext) and may include condition and wait_for_connection. Left out, a workflow stays one and steps with keys, paths or those types make one; nothing turns a workflow back into a list.",
+  );
 
 const campaignStepInput = z
   .object({
@@ -723,7 +740,7 @@ const campaignStepInput = z
       .string()
       .optional()
       .describe(
-        "Legacy LinkedIn step sender. Pool campaigns use the campaign's linkedinAccountIds instead.",
+        "Legacy LinkedIn step sender (also on wait_for_connection, and on a condition that checks linkedin_connected). Pool campaigns use the campaign's linkedinAccountIds instead.",
       ),
     linkedinMessageBody: z
       .string()
@@ -743,7 +760,7 @@ const campaignStepInput = z
       .max(MAX_WAIT_HOURS)
       .optional()
       .describe(
-        `linkedin_message with linkedinMessageMode=wait_until_connected: wait 1-${MAX_WAIT_HOURS} hours for acceptance (default 720). After a connection step this mode is the default.`,
+        `linkedin_message with linkedinMessageMode=wait_until_connected: wait 1-${MAX_WAIT_HOURS} hours for acceptance (default 720); after a connection step this mode is the default in a linear campaign. wait_for_connection: wait ${MIN_ACCEPTANCE_WAIT_HOURS}-${MAX_ACCEPTANCE_WAIT_HOURS} hours (1-90 days, default 720) before taking the Not accepted path.`,
       ),
     likeReaction: z
       .enum(LINKEDIN_REACTIONS)
@@ -760,12 +777,27 @@ const campaignStepInput = z
       .describe(
         `linkedin_like_post only: select the newest eligible original post from the last 1-${MAX_LIKE_POST_AGE_DAYS} days (default 30).`,
       ),
+    likeSkipPreviousWait: z
+      .boolean()
+      .optional()
+      .describe(
+        "linkedin_like_post only: before the immediately preceding wait starts, check for eligible posts. If none exist, skip that wait and the like step, keeping following waits. Defaults to false when omitted.",
+      ),
     likeSkipNextWait: z
       .boolean()
       .optional()
       .describe(
         "linkedin_like_post only: skip consecutive following wait steps whenever the reaction step is skipped (default true). False keeps those waits.",
       ),
+    likeCount: z
+      .number()
+      .int()
+      .min(1)
+      .max(MAX_LIKE_POST_COUNT)
+      .optional()
+      .describe(
+        `linkedin_like_post only: how many recent posts to react to, 1-${MAX_LIKE_POST_COUNT} (default 1).`,
+      ),
     inmailSubject: z
       .string()
       .optional()
@@ -781,6 +813,46 @@ const campaignStepInput = z
       .describe(
         `linkedin_connection only: withdraw a still-pending invitation sent by this campaign after ${MIN_WITHDRAW_AFTER_HOURS}-${MAX_WAIT_HOURS} hours (7-90 days). Omitted means off on creation; null turns it off on edit.`,
       ),
+    key: z
+      .string()
+      .min(1)
+      .optional()
+      .describe(
+        `Workflow steps: this step's id, unique in the campaign, which next, yesNext and noNext point at (not "${WORKFLOW_END}"). Left out, one is made.`,
+      ),
+    next: workflowTarget(
+      "where a step that isn't a condition or wait_for_connection goes; left out, the following step",
+    ),
+    yesNext: workflowTarget(
+      "condition and wait_for_connection only, required: where the Yes (Accepted) path goes",
+    ),
+    noNext: workflowTarget(
+      "condition and wait_for_connection only, required: where the No (Not accepted) path goes",
+    ),
+    check: z
+      .enum(CONDITION_CHECKS)
+      .optional()
+      .describe(
+        "condition only, required: linkedin_connected, has_email, opened_last_email (needs an email before it on every path) or field_value. Fixed once the campaign launches.",
+      ),
+    conditionField: z
+      .string()
+      .optional()
+      .describe(
+        'condition with check=field_value: the lead field to check, like "Job Title" or "Source" (the campaign itself changes Status, Last touch and LinkedIn connection). Fixed once the campaign launches.',
+      ),
+    conditionOperator: z
+      .enum(CONDITION_OPERATORS)
+      .optional()
+      .describe(
+        "condition with check=field_value: is, is_not, contains, is_empty or is_not_empty (all case-insensitive). Fixed once the campaign launches.",
+      ),
+    conditionValue: z
+      .string()
+      .optional()
+      .describe(
+        "condition with check=field_value and is, is_not or contains: the text to compare with. Editable after launch.",
+      ),
   })
   .describe("One campaign step, in order.");
 
@@ -814,10 +886,16 @@ const campaignTimelineRun = z
       .optional()
       .describe("The email this run sent, in emailMessages[]."),
     lastError: z.string().optional(),
+    timeoutAt: z
+      .number()
+      .optional()
+      .describe("wait_for_connection: when it stops waiting for the accept."),
     result: z
       .unknown()
       .optional()
-      .describe("For a skipped step, { reason } says why."),
+      .describe(
+        'For a skipped step, { reason } says why. A finished condition or wait_for_connection has { branch: "yes" | "no" } (Yes / Accepted or No / Not accepted), and { reason } for some No paths.',
+      ),
   })
   .passthrough();
 
@@ -863,6 +941,7 @@ const campaignRow = z
     sendSchedules: z.array(campaignSendSchedule).optional(),
     dailySendCap: z.number().optional(),
     stepCount: z.number(),
+    stepModel: campaignStepModel.optional(),
     totalEnrolled: z.number(),
     activeCount: z.number(),
     pausedCount: z.number(),
@@ -3110,7 +3189,12 @@ export const requestSchemas: Record<string, ZodTypeAny> = {
         .min(1)
         .max(MAX_CAMPAIGN_STEPS)
         .describe(
-          "Every step, in send order. Rejected, not trimmed: a field the step type would drop (onlyIf off email/post-like steps, a body on a visit, reply-in-thread on the first email), a missing subject or required body, an overlength note/message/InMail subject, out-of-range wait/withdrawal/post-age values, and {TOKEN} single braces, which would be sent as typed.",
+          "Every step, in send order (a workflow may list them in any order; they are stored in path order). Rejected, not trimmed: a field the step type would drop (onlyIf off email/post-like steps, a body on a visit, reply-in-thread on the first email, condition fields its check ignores), a missing subject or required body, an overlength note/message/InMail subject, out-of-range wait/withdrawal/post-age/acceptance values, {TOKEN} single braces, which would be sent as typed, and workflow paths that don't hold together (duplicate keys, a target that isn't a key or end, a condition or wait_for_connection without both yesNext and noNext, or any other step with them).",
+        ),
+      stepModel: campaignStepModel
+        .optional()
+        .describe(
+          "linear: steps run in order. workflow: steps have keys and paths (next, yesNext, noNext) and may include condition and wait_for_connection. Left out, a workflow stays one and steps with keys, paths or those types make one; nothing turns a workflow back into a list. When replacing a workflow's steps, send workflow, so steps without keys or paths are checked here the way they will be saved.",
         ),
       allowSingleBraces: z
         .boolean()
@@ -3121,8 +3205,20 @@ export const requestSchemas: Record<string, ZodTypeAny> = {
     })
     .strict()
     .superRefine((input, ctx) => {
+      if (input.stepModel === "linear") {
+        const shaped = input.steps.findIndex(hasWorkflowShape);
+        if (shaped >= 0)
+          ctx.addIssue({
+            code: "custom",
+            message: `Step ${shaped + 1}: condition, wait_for_connection, key, next, yesNext and noNext only work in a workflow. Send stepModel "workflow", or leave it out.`,
+            path: ["steps", shaped],
+          });
+      }
       for (const issue of checkCampaignSteps(input.steps, {
         allowSingleBraces: input.allowSingleBraces,
+        ...(input.stepModel
+          ? { workflow: input.stepModel === "workflow" }
+          : {}),
       }).errors)
         ctx.addIssue({
           code: "custom",
@@ -3154,13 +3250,13 @@ export const requestSchemas: Record<string, ZodTypeAny> = {
             })
             .strict()
             .describe(
-              "One step edit: only the fields given change. Clear text with an empty string, onlyIf with always, emailReplyToPrevious with false and withdrawAfterHours with null. Like settings are optional; omitted values stay unchanged.",
+              "One step edit: only the fields given change. Clear text with an empty string, onlyIf with always, emailReplyToPrevious with false and withdrawAfterHours with null. Like settings are optional; omitted values stay unchanged. A workflow step's key, next, yesNext, noNext, check, conditionField and conditionOperator can't change after launch (send them unchanged or leave them out); conditionValue and a wait_for_connection's connectionTimeoutHours can.",
             ),
         )
         .min(1)
         .max(MAX_CAMPAIGN_STEPS)
         .describe(
-          "The steps to change. Rejected, not trimmed: a field the step type would drop, an overlength note/message/InMail subject, out-of-range wait/withdrawal/post-age values, and {TOKEN} single braces.",
+          "The steps to change. Rejected, not trimmed: a field the step type would drop, an overlength note/message/InMail subject, out-of-range wait/withdrawal/post-age/acceptance values, {TOKEN} single braces, and a changed path or If / else check.",
         ),
       allowSingleBraces: z
         .boolean()
@@ -3584,6 +3680,10 @@ export const requestSchemas: Record<string, ZodTypeAny> = {
     includeAutomated: z.boolean().optional(),
   }),
   "chat.new": z.object({
+    environment: z
+      .string()
+      .regex(/^[a-z][a-z0-9-]{0,63}$/)
+      .optional(),
     prompt: z.string().describe("The user message that starts the turn."),
     model: z.string().optional(),
     fileContextPath: z.string().optional(),
@@ -5035,7 +5135,11 @@ export const responseSchemas: Record<string, ZodTypeAny> = {
   "campaigns.get": z
     .object({
       sequence: campaignRow,
-      steps: z.array(campaignStepInput.passthrough()),
+      steps: z
+        .array(campaignStepInput.passthrough())
+        .describe(
+          "The steps in order, each with its _id. condition and wait_for_connection steps also carry a readable label.",
+        ),
       enrollments: z.array(z.record(z.string(), z.unknown())),
       currentRuns: z
         .record(z.string(), z.unknown())
@@ -5075,6 +5179,22 @@ export const responseSchemas: Record<string, ZodTypeAny> = {
       replyRate: z.number(),
       openRate: z.number(),
       clickRate: z.number(),
+      branchStats: z
+        .array(
+          z.object({
+            stepId: z.string(),
+            yes: z
+              .number()
+              .describe("People who took the Yes (Accepted) path."),
+            no: z
+              .number()
+              .describe("People who took the No (Not accepted) path."),
+          }),
+        )
+        .optional()
+        .describe(
+          "Workflows only: each condition and wait_for_connection step, in step order, with how many people took each path.",
+        ),
       truncated: z.boolean(),
     })
     .passthrough(),
@@ -5087,7 +5207,28 @@ export const responseSchemas: Record<string, ZodTypeAny> = {
       dailySendCap: z.number().nullable(),
       nextEmailAt: z.number().nullable(),
       now: z.record(z.string(), z.unknown()).nullable(),
-      next: z.record(z.string(), z.unknown()).nullable(),
+      next: z
+        .object({
+          kind: z
+            .string()
+            .describe(
+              "profile, visit, invite, message, like, inmail, withdraw, email, wait or check (an If / else).",
+            ),
+          acceptanceDeadline: z
+            .number()
+            .optional()
+            .describe(
+              "Waiting for them to accept: when the wait ends either way.",
+            ),
+          label: z
+            .string()
+            .optional()
+            .describe(
+              'kind check: what the If / else checks, e.g. "Has an email address".',
+            ),
+        })
+        .passthrough()
+        .nullable(),
       paused: z.record(z.string(), z.unknown()).nullable(),
       senders: z.array(z.record(z.string(), z.unknown())),
     })
@@ -6383,18 +6524,41 @@ export const requestExamples: Record<string, unknown> = {
   },
   "campaigns.steps.replace": {
     sequenceId: "<sequenceId>",
+    stepModel: "workflow",
     steps: [
-      { type: "linkedin_visit" },
       {
+        key: "connected",
+        type: "condition",
+        check: "linkedin_connected",
+        yesNext: "message",
+        noNext: "invite",
+      },
+      {
+        key: "invite",
         type: "linkedin_connection",
         linkedinMessageBody:
           "Hi {{First name}}, enjoyed your post on {{Topic}}.",
+        next: "accept",
+      },
+      {
+        key: "accept",
+        type: "wait_for_connection",
+        connectionTimeoutHours: 240,
+        yesNext: "message",
+        noNext: "email",
       },
-      { type: "wait", waitHours: 48 },
       {
+        key: "email",
         type: "email",
         emailSubject: "Quick question, {{First name}}",
         emailTextBody: "Hi {{First name}}, ...",
+        next: "end",
+      },
+      {
+        key: "message",
+        type: "linkedin_message",
+        linkedinMessageBody: "Thanks for connecting, {{First name}}. ...",
+        next: "end",
       },
     ],
   },
@@ -6413,6 +6577,12 @@ export const requestExamples: Record<string, unknown> = {
         type: "wait",
         waitHours: 96,
       },
+      {
+        stepId: "<waitForConnectionStepId>",
+        expectedUpdatedAt: 1765526400000,
+        type: "wait_for_connection",
+        connectionTimeoutHours: 336,
+      },
     ],
   },
   "campaigns.personalization.set": {

package/lib/app-sdk-catalog.generated.ts

@@ -53,6 +53,8 @@ export const APP_SDK_SCOPES = [
   "cron:schedule",
   "email:read",
   "email:write",
+  "environments:read",
+  "environments:write",
   "files:read",
   "files:write",
   "http:external",
@@ -70,6 +72,8 @@ export const APP_SDK_SCOPES = [
   "notifications:read",
   "notifications:write",
   "search:read",
+  "secrets:read",
+  "secrets:write",
   "settings:read",
   "settings:write",
   "store:read",
@@ -77,12 +81,21 @@ export const APP_SDK_SCOPES = [
   "ui",
   "web:read",
   "webhooks:receive",
-  "workspace:read"
+  "workspace:read",
+  "workspace:write"
 ] as const;
 export type AppSdkScope = (typeof APP_SDK_SCOPES)[number];
 
 /** Every public /api/v1 operation reachable through dench.api.call. */
 export const APP_SDK_OPERATIONS: readonly AppSdkOperationInfo[] = [
+  {"id":"environments.list","group":"environments","summary":"List workspace-shared reusable setups and ready revisions (metadata only).","cli":"dench env list","method":"GET","path":"/environments","permission":"environments:read","pathParams":[]},
+  {"id":"environments.get","group":"environments","summary":"Inspect a saved setup, its manifest, and an optional immutable revision.","cli":"dench env show","method":"GET","path":"/environments/{name}","permission":"environments:read","pathParams":["name"]},
+  {"id":"environments.upload","group":"environments","summary":"Reserve an owner-bound source upload. Prefix the uploaded bytes with the returned proof before saving.","cli":"dench env save","method":"POST","path":"/environments/uploads","permission":"environments:write","pathParams":[]},
+  {"id":"environments.save","group":"environments","summary":"Publish an explicitly saved source and manifest for one-time preparation. Returns pending/building until verified; does not run the task.","cli":"dench env save","method":"POST","path":"/environments/{name}","permission":"environments:write","pathParams":["name"]},
+  {"id":"environments.delete","group":"environments","summary":"Retire a saved setup from new selection; retain immutable revisions and active job evidence.","cli":"dench env delete","method":"DELETE","path":"/environments/{name}","permission":"environments:write","pathParams":["name"]},
+  {"id":"secrets.list","group":"secrets","summary":"List workspace-shared credential names, kinds and versions; never values.","cli":"dench secrets list","method":"GET","path":"/secrets","permission":"secrets:read","pathParams":[]},
+  {"id":"secrets.set","group":"secrets","summary":"Encrypt a workspace credential. Use CLI stdin or the secure chat form; return metadata only. Do not put values in chat, manifests or scripts.","cli":"dench secrets set","method":"PUT","path":"/secrets/{name}","permission":"secrets:write","pathParams":["name"]},
+  {"id":"secrets.delete","group":"secrets","summary":"Revoke a workspace credential for future resolution, optionally checking its version.","cli":"dench secrets delete","method":"DELETE","path":"/secrets/{name}","permission":"secrets:write","pathParams":["name"]},
   {"id":"campaigns.drafts.create","group":"campaigns","summary":"Create an idempotent empty campaign draft with the caller's available sender pools. Does not launch or send.","cli":"dench campaign draft","method":"POST","path":"/campaigns/drafts","permission":"campaigns:write","pathParams":[]},
   {"id":"campaigns.audience.search","group":"campaigns","summary":"Search people by filters without adding CRM records or campaign recipients. Search credits apply; this is not a free provider preview.","cli":"dench campaign search","method":"POST","path":"/campaigns/audience/search","permission":"campaigns:write","pathParams":[]},
   {"id":"campaigns.people.addFromSearch","group":"campaigns","summary":"Search and add up to 50 people to an existing campaign. New identities become Leads. Search credits apply; use nextPageToken for another page.","cli":"dench campaign add --search","method":"POST","path":"/campaigns/{sequenceId}/people/search","permission":"campaigns:write","pathParams":["sequenceId"]},
@@ -368,12 +381,12 @@ export const APP_SDK_OPERATIONS: readonly AppSdkOperationInfo[] = [
   {"id":"campaigns.create","group":"campaigns","summary":"Create a draft outreach campaign with email and LinkedIn sender pools and a business-hours send window in the given timezone.","cli":"dench campaign create","method":"POST","path":"/campaigns","permission":"campaigns:write","pathParams":[]},
   {"id":"campaigns.duplicate","group":"campaigns","summary":"Copy a campaign into a new draft named \"<name> copy\": the same steps, schedule, sender pools and personalized lines, its lead source paused, and no people. To reach more than 300 people, duplicate and add the next page of the search to the copy.","cli":"dench campaign duplicate","method":"POST","path":"/campaigns/{sequenceId}/duplicate","permission":"campaigns:write","pathParams":["sequenceId"]},
   {"id":"campaigns.get","group":"campaigns","summary":"Read a campaign: settings, steps, people, their current step and hold, last touches, linked leads.","cli":"dench campaign get","method":"GET","path":"/campaigns/{sequenceId}","permission":"campaigns:read","pathParams":["sequenceId"]},
-  {"id":"campaigns.analytics","group":"campaigns","summary":"Campaign funnel: enrolled, contacted, invited, accepted, messaged, replied, opens and clicks.","cli":"dench campaign get","method":"GET","path":"/campaigns/{sequenceId}/analytics","permission":"campaigns:read","pathParams":["sequenceId"]},
+  {"id":"campaigns.analytics","group":"campaigns","summary":"Campaign funnel: enrolled, contacted, invited, accepted, messaged, replied, opens and clicks, and for a workflow how many people took each If / else and Wait for them to accept path (branchStats).","cli":"dench campaign get","method":"GET","path":"/campaigns/{sequenceId}/analytics","permission":"campaigns:read","pathParams":["sequenceId"]},
   {"id":"campaigns.live","group":"campaigns","summary":"What the campaign is doing now, what comes next and when, and why it is holding.","cli":"dench campaign get","method":"GET","path":"/campaigns/{sequenceId}/live","permission":"campaigns:read","pathParams":["sequenceId"]},
   {"id":"campaigns.pipeline","group":"campaigns","summary":"Where a campaign's people sit in the workspace's lead pipeline right now: each lead Status in order with how many enrolled leads are at it, and how many have no lead or a status outside the pipeline.","cli":"dench campaign pipeline","method":"GET","path":"/campaigns/{sequenceId}/pipeline","permission":"campaigns:read","pathParams":["sequenceId"]},
   {"id":"campaigns.update","group":"campaigns","summary":"Change a campaign's name, sender pools, send windows, daily email cap, stop-on-reply, start or end. Works until archived; existing conversations keep their assigned sender.","cli":"dench campaign set","method":"PATCH","path":"/campaigns/{sequenceId}","permission":"campaigns:write","pathParams":["sequenceId"]},
-  {"id":"campaigns.steps.replace","group":"campaigns","summary":"Replace every step of a draft campaign (email, wait, LinkedIn visit, connection request, message, post reaction, InMail). Steps are checked first: a field the step type would drop, missing text or {TOKEN} single braces are rejected, not saved. Configure sender pools on the campaign; step sender ids are legacy-only.","cli":"dench campaign steps set","method":"PUT","path":"/campaigns/{sequenceId}/steps","permission":"campaigns:write","pathParams":["sequenceId"]},
-  {"id":"campaigns.steps.update","group":"campaigns","summary":"Edit the text, waits and conditions of a launched (or paused) campaign's steps in place. Each step keeps its id, type and place; pass the stepId and the updatedAt you read, and only the fields you change. Messages already sent or being prepared keep their text; drafts use campaigns.steps.replace.","cli":"dench campaign steps edit","method":"PATCH","path":"/campaigns/{sequenceId}/steps","permission":"campaigns:write","pathParams":["sequenceId"]},
+  {"id":"campaigns.steps.replace","group":"campaigns","summary":"Replace every step of a draft campaign (email, wait, LinkedIn visit, connection request, message, post reaction, InMail, If / else, Wait for them to accept). A workflow (stepModel workflow, or steps with key, next, yesNext or noNext) branches: condition and wait_for_connection steps continue on yesNext or noNext, other steps on next; each points at another step's key or end. Steps are checked first: a field the step type would drop, missing text, {TOKEN} single braces or paths that don't hold together are rejected, not saved. Configure sender pools on the campaign; step sender ids are legacy-only.","cli":"dench campaign steps set","method":"PUT","path":"/campaigns/{sequenceId}/steps","permission":"campaigns:write","pathParams":["sequenceId"]},
+  {"id":"campaigns.steps.update","group":"campaigns","summary":"Edit the text, waits and conditions of a launched (or paused) campaign's steps in place. Each step keeps its id, type and place; pass the stepId and the updatedAt you read, and only the fields you change. A workflow keeps its paths and what each If / else checks (key, next, yesNext, noNext, check, conditionField, conditionOperator); conditionValue and acceptance waits stay editable. Messages already sent or being prepared keep their text; drafts use campaigns.steps.replace.","cli":"dench campaign steps edit","method":"PATCH","path":"/campaigns/{sequenceId}/steps","permission":"campaigns:write","pathParams":["sequenceId"]},
   {"id":"campaigns.personalization.get","group":"campaigns","summary":"Read a campaign's personalized lines (written for each person): their {{keys}} for steps, instructions and fallbacks, how many people have them, and the cost per person.","cli":"dench campaign personalize get","method":"GET","path":"/campaigns/{sequenceId}/personalization","permission":"campaigns:read","pathParams":["sequenceId"]},
   {"id":"campaigns.personalization.set","group":"campaigns","summary":"Define up to 5 personalized lines (each used as {{key}} in steps) and what you sell. Saving starts writing missing lines for up to 100 people, about 3 cents a person; for more it returns needsConfirm and writes nothing until campaigns.personalization.write is confirmed.","cli":"dench campaign personalize set","method":"PUT","path":"/campaigns/{sequenceId}/personalization","permission":"campaigns:write","pathParams":["sequenceId"]},
   {"id":"campaigns.personalization.clear","group":"campaigns","summary":"Turn off a campaign's personalized lines and cancel the ones not yet written. Refused while a step still uses one of the {{keys}}.","cli":"dench campaign personalize clear","method":"DELETE","path":"/campaigns/{sequenceId}/personalization","permission":"campaigns:write","pathParams":["sequenceId"]},
@@ -458,23 +471,24 @@ export const APP_SDK_OPERATIONS: readonly AppSdkOperationInfo[] = [
   {"id":"browser.session.create","group":"browser","summary":"Create a Dench Browser session and return a CDP connect URL for Playwright (chromium.connectOverCDP) plus a live-view URL. Use for durable scripts run from the sandbox.","cli":"dench browser session create","method":"POST","path":"/browser/sessions","permission":"browser:write","pathParams":[]},
   {"id":"browser.session.status","group":"browser","summary":"Get the status, connect URL, and live-view URL for a Dench Browser session.","cli":"dench browser session status","method":"GET","path":"/browser/sessions/{sessionId}","permission":"browser:read","pathParams":["sessionId"]},
   {"id":"browser.session.stop","group":"browser","summary":"Stop a Dench Browser session and release the remote browser.","cli":"dench browser session stop","method":"DELETE","path":"/browser/sessions/{sessionId}","permission":"browser:write","pathParams":["sessionId"]},
-  {"id":"agentConfig.identity.show","group":"agent-config","summary":"Read IDENTITY.md.","cli":"dench identity show","method":"GET","path":"/agent-config/identity","permission":"agent-config:read","pathParams":[]},
-  {"id":"agentConfig.identity.edit","group":"agent-config","summary":"Update IDENTITY.md.","cli":"dench identity edit","method":"PUT","path":"/agent-config/identity","permission":"agent-config:write","pathParams":[]},
-  {"id":"agentConfig.organisation.show","group":"agent-config","summary":"Read ORGANISATION.md.","cli":"dench organisation show","method":"GET","path":"/agent-config/organisation","permission":"agent-config:read","pathParams":[]},
-  {"id":"agentConfig.organisation.edit","group":"agent-config","summary":"Update ORGANISATION.md.","cli":"dench organisation edit","method":"PUT","path":"/agent-config/organisation","permission":"agent-config:write","pathParams":[]},
-  {"id":"agentConfig.user.show","group":"agent-config","summary":"Read USER.md.","cli":"dench user show","method":"GET","path":"/agent-config/user","permission":"agent-config:read","pathParams":[]},
-  {"id":"agentConfig.user.edit","group":"agent-config","summary":"Update USER.md.","cli":"dench user edit","method":"PUT","path":"/agent-config/user","permission":"agent-config:write","pathParams":[]},
-  {"id":"agentConfig.tools.show","group":"agent-config","summary":"Read tool notes.","cli":"dench tools show","method":"GET","path":"/agent-config/tools","permission":"agent-config:read","pathParams":[]},
-  {"id":"agentConfig.tools.edit","group":"agent-config","summary":"Update tool notes.","cli":"dench tools edit","method":"PUT","path":"/agent-config/tools","permission":"agent-config:write","pathParams":[]},
-  {"id":"agentConfig.mem.show","group":"agent-config","summary":"Read aggregate memory.","cli":"dench mem show","method":"GET","path":"/agent-config/mem","permission":"agent-config:read","pathParams":[]},
-  {"id":"agentConfig.mem.edit","group":"agent-config","summary":"Update aggregate memory.","cli":"dench mem set","method":"PUT","path":"/agent-config/mem","permission":"agent-config:write","pathParams":[]},
-  {"id":"agentConfig.bootstrap.show","group":"agent-config","summary":"Read bootstrap state.","cli":"dench bootstrap status","method":"GET","path":"/agent-config/bootstrap","permission":"agent-config:read","pathParams":[]},
-  {"id":"agentConfig.bootstrap.complete","group":"agent-config","summary":"Complete bootstrap.","cli":"dench bootstrap complete","method":"POST","path":"/agent-config/bootstrap/complete","permission":"agent-config:write","pathParams":[]},
-  {"id":"agentConfig.bootstrap.template","group":"agent-config","summary":"Update bootstrap template.","cli":"dench bootstrap template","method":"PUT","path":"/agent-config/bootstrap/template","permission":"agent-config:write","pathParams":[]},
+  {"id":"agentConfig.identity.show","group":"agent-config","summary":"Read IDENTITY.md.","cli":"dench context --sections identity","method":"GET","path":"/agent-config/identity","permission":"agent-config:read","pathParams":[]},
+  {"id":"agentConfig.identity.edit","group":"agent-config","summary":"Update IDENTITY.md.","cli":"dench context set identity","method":"PUT","path":"/agent-config/identity","permission":"agent-config:write","pathParams":[]},
+  {"id":"agentConfig.organisation.show","group":"agent-config","summary":"Read ORGANISATION.md.","cli":"dench context --sections organisation","method":"GET","path":"/agent-config/organisation","permission":"agent-config:read","pathParams":[]},
+  {"id":"agentConfig.organisation.edit","group":"agent-config","summary":"Update ORGANISATION.md.","cli":"dench context set organisation","method":"PUT","path":"/agent-config/organisation","permission":"agent-config:write","pathParams":[]},
+  {"id":"agentConfig.user.show","group":"agent-config","summary":"Read USER.md.","cli":"dench context --sections user","method":"GET","path":"/agent-config/user","permission":"agent-config:read","pathParams":[]},
+  {"id":"agentConfig.user.edit","group":"agent-config","summary":"Update USER.md.","cli":"dench context set user","method":"PUT","path":"/agent-config/user","permission":"agent-config:write","pathParams":[]},
+  {"id":"agentConfig.tools.show","group":"agent-config","summary":"Read tool notes.","cli":"dench context --sections tools","method":"GET","path":"/agent-config/tools","permission":"agent-config:read","pathParams":[]},
+  {"id":"agentConfig.tools.edit","group":"agent-config","summary":"Update tool notes.","cli":"dench context set tools","method":"PUT","path":"/agent-config/tools","permission":"agent-config:write","pathParams":[]},
+  {"id":"workspace.context.rules.set","group":"workspace","summary":"Update standing workspace rules; credentials belong in secrets and runnable setup in environments.","cli":"dench context set rules","method":"PUT","path":"/context/rules","permission":"workspace:write","pathParams":[]},
+  {"id":"agentConfig.mem.show","group":"agent-config","summary":"Read aggregate memory.","cli":"dench mem show","method":"GET","path":"/agent-config/mem","permission":"agent-config:read","deprecated":true,"pathParams":[]},
+  {"id":"agentConfig.mem.edit","group":"agent-config","summary":"Update aggregate memory.","cli":"dench mem set","method":"PUT","path":"/agent-config/mem","permission":"agent-config:write","deprecated":true,"pathParams":[]},
+  {"id":"agentConfig.bootstrap.show","group":"agent-config","summary":"Read bootstrap state.","cli":"dench bootstrap status","method":"GET","path":"/agent-config/bootstrap","permission":"agent-config:read","deprecated":true,"pathParams":[]},
+  {"id":"agentConfig.bootstrap.complete","group":"agent-config","summary":"Complete bootstrap.","cli":"dench bootstrap complete","method":"POST","path":"/agent-config/bootstrap/complete","permission":"agent-config:write","deprecated":true,"pathParams":[]},
+  {"id":"agentConfig.bootstrap.template","group":"agent-config","summary":"Update bootstrap template.","cli":"dench bootstrap template","method":"PUT","path":"/agent-config/bootstrap/template","permission":"agent-config:write","deprecated":true,"pathParams":[]},
   {"id":"agentConfig.model.default","group":"agent-config","summary":"Set the default chat model.","cli":"dench model default","method":"PUT","path":"/agent-config/model/default","permission":"agent-config:write","pathParams":[]},
   {"id":"agentConfig.model.thread","group":"agent-config","summary":"Set a thread model override.","cli":"dench model thread","method":"PUT","path":"/agent-config/model/threads/{threadId}","permission":"agent-config:write","pathParams":["threadId"]},
-  {"id":"agentConfig.daily.today","group":"agent-config","summary":"Read today's daily activity path.","cli":"dench daily today","method":"GET","path":"/agent-config/daily/today","permission":"agent-config:read","pathParams":[]},
-  {"id":"agentConfig.daily.show","group":"agent-config","summary":"Read a daily activity path.","cli":"dench daily show","method":"GET","path":"/agent-config/daily/{date}","permission":"agent-config:read","pathParams":["date"]},
+  {"id":"agentConfig.daily.today","group":"agent-config","summary":"Read today's daily activity path.","cli":"dench daily today","method":"GET","path":"/agent-config/daily/today","permission":"agent-config:read","deprecated":true,"pathParams":[]},
+  {"id":"agentConfig.daily.show","group":"agent-config","summary":"Read a daily activity path.","cli":"dench daily show","method":"GET","path":"/agent-config/daily/{date}","permission":"agent-config:read","deprecated":true,"pathParams":["date"]},
   {"id":"notifications.list","group":"notifications","summary":"List your notifications (inbox, unread, archived, or all).","cli":"dench notifications list","method":"GET","path":"/notifications","permission":"notifications:read","pathParams":[]},
   {"id":"notifications.unreadCount","group":"notifications","summary":"How many unread notifications you have.","cli":"dench notifications count","method":"GET","path":"/notifications/unread-count","permission":"notifications:read","pathParams":[]},
   {"id":"notifications.read","group":"notifications","summary":"Mark a notification read (or unread).","cli":"dench notifications read","method":"PATCH","path":"/notifications/{notificationId}","permission":"notifications:write","pathParams":["notificationId"]},
@@ -487,7 +501,7 @@ export const APP_SDK_OPERATIONS: readonly AppSdkOperationInfo[] = [
 ];
 
 /** CLI-only operation ids (sessions, fs, imports): never callable from an app. */
-export const APP_SDK_LOCAL_OPERATIONS: readonly string[] = ["sessions.local.list","sessions.local.use","sessions.local.logout","backend.local.configure","enrichment.filters.options","crm.import","crm.export","meetings.import","fs.daemon","apps.validate"];
+export const APP_SDK_LOCAL_OPERATIONS: readonly string[] = ["environments.run","sessions.local.list","sessions.local.use","sessions.local.logout","backend.local.configure","enrichment.filters.options","crm.import","crm.export","meetings.import","fs.daemon","apps.validate"];
 
 /** Curated window.dench methods → permission (host + aliases). */
 export const APP_SDK_METHODS: Readonly<Record<string, AppSdkMethodInfo>> = {