@withone/cli 1.20.3 → 1.22.0

package/dist/index.js

@@ -1,17 +1,22 @@
 #!/usr/bin/env node
 import {
+  FLOW_SCHEMA,
   FlowRunner,
   OneApi,
   TimeoutError,
   buildActionKnowledgeWithGuidance,
   filterByPermissions,
+  flowRequiresBash,
+  generateFlowGuide,
+  getNestedStepsKeys,
+  getStepTypeDescriptor,
   isActionAllowed,
   isMethodAllowed,
   listFlows,
-  loadFlow,
+  loadFlowWithMeta,
   resolveFlowPath,
   saveFlow
-} from "./chunk-DPOG6BQ5.js";
+} from "./chunk-KZOFPEHD.js";
 
 // src/index.ts
 import { createRequire as createRequire2 } from "module";
@@ -20,10 +25,10 @@ import { Command } from "commander";
 // src/commands/init.ts
 import * as p3 from "@clack/prompts";
 import pc2 from "picocolors";
-import fs3 from "fs";
-import path3 from "path";
-import os3 from "os";
-import { fileURLToPath } from "url";
+import fs4 from "fs";
+import path4 from "path";
+import os4 from "os";
+import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/lib/config.ts
 import fs from "fs";
@@ -48,11 +53,11 @@ function readConfig() {
     return null;
   }
 }
-function writeConfig(config) {
+function writeConfig(config2) {
   if (!fs.existsSync(CONFIG_DIR)) {
     fs.mkdirSync(CONFIG_DIR, { mode: 448 });
   }
-  fs.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2), { mode: 384 });
+  fs.writeFileSync(CONFIG_FILE, JSON.stringify(config2, null, 2), { mode: 384 });
 }
 function readOneRc() {
   const rcPath = path.join(process.cwd(), ".onerc");
@@ -103,32 +108,32 @@ function getAccessControl() {
 }
 var DEFAULT_API_BASE = "https://api.withone.ai/v1";
 function getApiBase() {
-  const config = readConfig();
-  if (config?.apiBase) return `${config.apiBase}/v1`;
+  const config2 = readConfig();
+  if (config2?.apiBase) return `${config2.apiBase}/v1`;
   return DEFAULT_API_BASE;
 }
 function updateApiBase(url) {
-  const config = readConfig();
-  if (!config) return;
+  const config2 = readConfig();
+  if (!config2) return;
   if (url) {
-    config.apiBase = url;
+    config2.apiBase = url;
   } else {
-    delete config.apiBase;
+    delete config2.apiBase;
   }
-  writeConfig(config);
+  writeConfig(config2);
 }
 function getCacheTtl() {
   if (process.env.ONE_CACHE_TTL) {
     const val = parseInt(process.env.ONE_CACHE_TTL, 10);
     if (!isNaN(val) && val > 0) return val;
   }
-  const config = readConfig();
-  if (config?.cacheTtl && config.cacheTtl > 0) return config.cacheTtl;
+  const config2 = readConfig();
+  if (config2?.cacheTtl && config2.cacheTtl > 0) return config2.cacheTtl;
   return 3600;
 }
 function updateAccessControl(settings) {
-  const config = readConfig();
-  if (!config) return;
+  const config2 = readConfig();
+  if (!config2) return;
   const cleaned = {};
   if (settings.permissions && settings.permissions !== "admin") {
     cleaned.permissions = settings.permissions;
@@ -143,11 +148,11 @@ function updateAccessControl(settings) {
     cleaned.knowledgeAgent = true;
   }
   if (Object.keys(cleaned).length === 0) {
-    delete config.accessControl;
+    delete config2.accessControl;
   } else {
-    config.accessControl = cleaned;
+    config2.accessControl = cleaned;
   }
-  writeConfig(config);
+  writeConfig(config2);
 }
 
 // src/lib/agents.ts
@@ -269,16 +274,16 @@ function readAgentConfig(agent, scope = "global") {
     return {};
   }
 }
-function writeAgentConfig(agent, config, scope = "global") {
+function writeAgentConfig(agent, config2, scope = "global") {
   const configPath = getAgentConfigPath(agent, scope);
   const configDir = path2.dirname(configPath);
   if (!fs2.existsSync(configDir)) {
     fs2.mkdirSync(configDir, { recursive: true });
   }
   if (agent.configFormat === "toml") {
-    fs2.writeFileSync(configPath, stringifyToml(config));
+    fs2.writeFileSync(configPath, stringifyToml(config2));
   } else {
-    fs2.writeFileSync(configPath, JSON.stringify(config, null, 2));
+    fs2.writeFileSync(configPath, JSON.stringify(config2, null, 2));
   }
 }
 function getMcpServerConfig(apiKey, accessControl) {
@@ -306,17 +311,17 @@ function getMcpServerConfig(apiKey, accessControl) {
   };
 }
 function installMcpConfig(agent, apiKey, scope = "global", accessControl) {
-  const config = readAgentConfig(agent, scope);
+  const config2 = readAgentConfig(agent, scope);
   const configKey = agent.configKey;
-  const mcpServers = config[configKey] || {};
+  const mcpServers = config2[configKey] || {};
   mcpServers["one"] = getMcpServerConfig(apiKey, accessControl);
-  config[configKey] = mcpServers;
-  writeAgentConfig(agent, config, scope);
+  config2[configKey] = mcpServers;
+  writeAgentConfig(agent, config2, scope);
 }
 function isMcpInstalled(agent, scope = "global") {
-  const config = readAgentConfig(agent, scope);
+  const config2 = readAgentConfig(agent, scope);
   const configKey = agent.configKey;
-  const mcpServers = config[configKey];
+  const mcpServers = config2[configKey];
   return mcpServers?.["one"] !== void 0;
 }
 function getAgentStatuses() {
@@ -392,8 +397,8 @@ async function configCommand() {
   if (isAgentMode()) {
     error("This command requires interactive input. Run without --agent.");
   }
-  const config = readConfig();
-  if (!config) {
+  const config2 = readConfig();
+  if (!config2) {
     p2.log.error(`No One config found. Run ${pc.cyan("one init")} first.`);
     return;
   }
@@ -434,7 +439,7 @@ async function configCommand() {
   }
   let connectionKeys;
   if (connectionMode === "specific") {
-    connectionKeys = await selectConnections(config.apiKey);
+    connectionKeys = await selectConnections(config2.apiKey);
     if (connectionKeys === void 0) {
       p2.outro("No changes made.");
       return;
@@ -495,7 +500,7 @@ async function configCommand() {
     p2.outro("No changes made.");
     return;
   }
-  let newApiKey = config.apiKey;
+  let newApiKey = config2.apiKey;
   if (baseUrlMode === "custom") {
     const customUrl = await p2.text({
       message: "Enter API base URL:",
@@ -596,7 +601,7 @@ async function configCommand() {
   };
   updateAccessControl(settings);
   const updatedConfig = readConfig();
-  if (updatedConfig && newApiKey !== config.apiKey) {
+  if (updatedConfig && newApiKey !== config2.apiKey) {
     updatedConfig.apiKey = newApiKey;
     writeConfig(updatedConfig);
   }
@@ -662,6 +667,214 @@ function formatList(list) {
 
 // src/commands/init.ts
 import open2 from "open";
+
+// src/lib/skill-sync.ts
+import fs3 from "fs";
+import os3 from "os";
+import path3 from "path";
+import { fileURLToPath } from "url";
+
+// src/commands/update.ts
+import { createRequire } from "module";
+import { spawn } from "child_process";
+import { readFileSync, writeFileSync, mkdirSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+var require2 = createRequire(import.meta.url);
+var { version: currentVersion } = require2("../package.json");
+var CACHE_PATH = join(homedir(), ".one", "update-check.json");
+var CHECK_INTERVAL_MS = 4 * 60 * 60 * 1e3;
+var AGE_GATE_MS = 30 * 60 * 1e3;
+async function fetchLatestVersionInfo() {
+  try {
+    const res = await fetch("https://registry.npmjs.org/@withone/cli");
+    if (!res.ok) return null;
+    const data = await res.json();
+    const latest = data["dist-tags"]?.latest;
+    if (!latest) return null;
+    return { version: latest, publishedAt: data.time?.[latest] ?? null };
+  } catch {
+    return null;
+  }
+}
+function readCache() {
+  try {
+    return JSON.parse(readFileSync(CACHE_PATH, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function writeCache(latestVersion, publishedAt) {
+  try {
+    mkdirSync(join(homedir(), ".one"), { recursive: true });
+    writeFileSync(CACHE_PATH, JSON.stringify({ lastCheck: Date.now(), latestVersion, publishedAt }));
+  } catch {
+  }
+}
+async function checkLatestVersion() {
+  const info = await fetchLatestVersionInfo();
+  if (info) writeCache(info.version, info.publishedAt);
+  return info?.version ?? null;
+}
+async function checkLatestVersionCached() {
+  const cache2 = readCache();
+  if (cache2 && Date.now() - cache2.lastCheck < CHECK_INTERVAL_MS) {
+    return { version: cache2.latestVersion, publishedAt: cache2.publishedAt ?? null };
+  }
+  const info = await fetchLatestVersionInfo();
+  if (info) writeCache(info.version, info.publishedAt);
+  return info;
+}
+function getCurrentVersion() {
+  return currentVersion;
+}
+async function updateCommand() {
+  const s = createSpinner();
+  s.start("Checking for updates...");
+  const latestVersion = await checkLatestVersion();
+  if (!latestVersion) {
+    s.stop("");
+    error("Failed to check for updates \u2014 could not reach npm registry");
+  }
+  if (currentVersion === latestVersion) {
+    s.stop("Already up to date");
+    if (isAgentMode()) {
+      json({ current: currentVersion, latest: latestVersion, updated: false, message: "Already up to date" });
+    } else {
+      console.log(`Already up to date (v${currentVersion})`);
+    }
+    return;
+  }
+  s.stop(`Update available: v${currentVersion} \u2192 v${latestVersion}`);
+  console.log(`Updating @withone/cli: v${currentVersion} \u2192 v${latestVersion}...`);
+  const code = await new Promise((resolve) => {
+    const child = spawn("npm", ["install", "-g", "@withone/cli@latest", "--force"], {
+      stdio: isAgentMode() ? "pipe" : "inherit",
+      shell: true
+    });
+    child.on("close", resolve);
+    child.on("error", () => resolve(1));
+  });
+  if (code === 0) {
+    if (isAgentMode()) {
+      json({ current: currentVersion, latest: latestVersion, updated: true, message: "Updated successfully" });
+    } else {
+      console.log(`Successfully updated to v${latestVersion}`);
+    }
+  } else {
+    error("Update failed \u2014 try running: npm install -g @withone/cli@latest");
+  }
+}
+function isNewerVersion(latest, current) {
+  const parse = (v) => v.split(".").map(Number);
+  const [lMaj, lMin, lPat] = parse(latest);
+  const [cMaj, cMin, cPat] = parse(current);
+  if (lMaj !== cMaj) return lMaj > cMaj;
+  if (lMin !== cMin) return lMin > cMin;
+  return lPat > cPat;
+}
+function autoUpdate(targetVersion, publishedAt) {
+  if (publishedAt) {
+    const age = Date.now() - new Date(publishedAt).getTime();
+    if (age < AGE_GATE_MS) return;
+  }
+  const child = spawn("npm", ["install", "-g", `@withone/cli@${targetVersion}`], {
+    detached: true,
+    stdio: "ignore",
+    shell: true
+  });
+  child.unref();
+}
+
+// src/lib/skill-sync.ts
+var CANONICAL_SKILL_DIR = ".agents/skills";
+var VERSION_MARKER = ".one-cli-version";
+function getPackagedSkillDir() {
+  const here = path3.dirname(fileURLToPath(import.meta.url));
+  return path3.resolve(here, "..", "skills", "one");
+}
+function getCanonicalSkillPath() {
+  return path3.join(os3.homedir(), CANONICAL_SKILL_DIR, "one");
+}
+function getVersionMarkerPath() {
+  return path3.join(getCanonicalSkillPath(), VERSION_MARKER);
+}
+function isSkillInstalled() {
+  return fs3.existsSync(path3.join(getCanonicalSkillPath(), "SKILL.md"));
+}
+function readInstalledSkillVersion() {
+  try {
+    return fs3.readFileSync(getVersionMarkerPath(), "utf-8").trim() || null;
+  } catch {
+    return null;
+  }
+}
+function writeInstalledSkillVersion(version2) {
+  try {
+    fs3.mkdirSync(getCanonicalSkillPath(), { recursive: true });
+    fs3.writeFileSync(getVersionMarkerPath(), `${version2}
+`);
+  } catch {
+  }
+}
+function copyDirSync(src, dest) {
+  fs3.mkdirSync(dest, { recursive: true });
+  for (const entry of fs3.readdirSync(src, { withFileTypes: true })) {
+    const srcPath = path3.join(src, entry.name);
+    const destPath = path3.join(dest, entry.name);
+    if (entry.isDirectory()) {
+      copyDirSync(srcPath, destPath);
+    } else {
+      fs3.copyFileSync(srcPath, destPath);
+    }
+  }
+}
+function syncSkillsIfStale() {
+  if (!isSkillInstalled()) {
+    return { synced: false, reason: "not-installed" };
+  }
+  const current = getCurrentVersion();
+  const installed = readInstalledSkillVersion();
+  if (installed === current) {
+    return { synced: false, reason: "up-to-date", from: installed, to: current };
+  }
+  return performSync(current, installed === null ? "missing-marker" : "stale");
+}
+function forceSyncSkills() {
+  if (!isSkillInstalled()) {
+    return { synced: false, reason: "not-installed" };
+  }
+  return performSync(getCurrentVersion(), "forced");
+}
+function performSync(current, reason) {
+  const source = getPackagedSkillDir();
+  if (!fs3.existsSync(path3.join(source, "SKILL.md"))) {
+    return { synced: false, reason: "source-missing" };
+  }
+  const canonical = getCanonicalSkillPath();
+  try {
+    copyDirSync(source, canonical);
+    writeInstalledSkillVersion(current);
+    return { synced: true, reason, from: readInstalledSkillVersion() ?? null, to: current };
+  } catch (err) {
+    return { synced: false, reason: "error", error: err instanceof Error ? err.message : String(err) };
+  }
+}
+function getSkillStatus() {
+  const installed = isSkillInstalled();
+  const installedVersion = readInstalledSkillVersion();
+  const currentVersion2 = getCurrentVersion();
+  return {
+    installed,
+    canonicalPath: getCanonicalSkillPath(),
+    installedVersion,
+    currentVersion: currentVersion2,
+    upToDate: installed && installedVersion === currentVersion2,
+    markerExists: installedVersion !== null
+  };
+}
+
+// src/commands/init.ts
 async function initCommand(options) {
   if (isAgentMode()) {
     error("This command requires interactive input. Run without --agent.");
@@ -677,7 +890,7 @@ async function initCommand(options) {
 async function handleExistingConfig(apiKey, options) {
   const statuses = getAgentStatuses();
   const masked = maskApiKey(apiKey);
-  const skillInstalled = isSkillInstalled();
+  const skillInstalled = isSkillInstalled2();
   console.log();
   console.log(`  ${pc2.bold("Current Setup")}`);
   console.log(`  ${pc2.dim("\u2500".repeat(42))}`);
@@ -813,12 +1026,12 @@ ${pc2.cyan(getApiKeyUrl())}`, "API Key");
       reinstalled.push(`${s.agent.name} (project)`);
     }
   }
-  const config = readConfig();
+  const config2 = readConfig();
   writeConfig({
     apiKey: newKey,
-    installedAgents: config?.installedAgents ?? [],
-    createdAt: config?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
-    accessControl: config?.accessControl
+    installedAgents: config2?.installedAgents ?? [],
+    createdAt: config2?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    accessControl: config2?.accessControl
   });
   if (reinstalled.length > 0) {
     p3.log.success(`Updated MCP configs: ${reinstalled.join(", ")}`);
@@ -837,48 +1050,49 @@ var SKILL_AGENTS = [
   { id: "opencode", name: "OpenCode", skillDir: ".opencode/skills" },
   { id: "roo", name: "Roo", skillDir: ".roo/skills" }
 ];
-var CANONICAL_SKILL_DIR = ".agents/skills";
+var CANONICAL_SKILL_DIR2 = ".agents/skills";
 function getSkillSourceDir() {
-  const __dirname2 = path3.dirname(fileURLToPath(import.meta.url));
-  return path3.resolve(__dirname2, "..", "skills", "one");
+  const __dirname2 = path4.dirname(fileURLToPath2(import.meta.url));
+  return path4.resolve(__dirname2, "..", "skills", "one");
 }
-function getCanonicalSkillPath() {
-  return path3.join(os3.homedir(), CANONICAL_SKILL_DIR, "one");
+function getCanonicalSkillPath2() {
+  return path4.join(os4.homedir(), CANONICAL_SKILL_DIR2, "one");
 }
 function getAgentSkillPath(agent) {
-  return path3.join(os3.homedir(), agent.skillDir, "one");
+  return path4.join(os4.homedir(), agent.skillDir, "one");
 }
-function isSkillInstalled() {
-  return fs3.existsSync(path3.join(getCanonicalSkillPath(), "SKILL.md"));
+function isSkillInstalled2() {
+  return fs4.existsSync(path4.join(getCanonicalSkillPath2(), "SKILL.md"));
 }
 function isSkillInstalledForAgent(agent) {
-  return fs3.existsSync(path3.join(getAgentSkillPath(agent), "SKILL.md"));
+  return fs4.existsSync(path4.join(getAgentSkillPath(agent), "SKILL.md"));
 }
-function copyDirSync(src, dest) {
-  fs3.mkdirSync(dest, { recursive: true });
-  for (const entry of fs3.readdirSync(src, { withFileTypes: true })) {
-    const srcPath = path3.join(src, entry.name);
-    const destPath = path3.join(dest, entry.name);
+function copyDirSync2(src, dest) {
+  fs4.mkdirSync(dest, { recursive: true });
+  for (const entry of fs4.readdirSync(src, { withFileTypes: true })) {
+    const srcPath = path4.join(src, entry.name);
+    const destPath = path4.join(dest, entry.name);
     if (entry.isDirectory()) {
-      copyDirSync(srcPath, destPath);
+      copyDirSync2(srcPath, destPath);
     } else {
-      fs3.copyFileSync(srcPath, destPath);
+      fs4.copyFileSync(srcPath, destPath);
     }
   }
 }
 function installSkillForAgents(agentIds) {
   const source = getSkillSourceDir();
-  const canonical = getCanonicalSkillPath();
+  const canonical = getCanonicalSkillPath2();
   const installed = [];
   const failed = [];
-  if (!fs3.existsSync(path3.join(source, "SKILL.md"))) {
+  if (!fs4.existsSync(path4.join(source, "SKILL.md"))) {
     return { installed: [], failed: ["skill source not found"] };
   }
   try {
-    if (fs3.existsSync(canonical)) {
-      fs3.rmSync(canonical, { recursive: true });
+    if (fs4.existsSync(canonical)) {
+      fs4.rmSync(canonical, { recursive: true });
     }
-    copyDirSync(source, canonical);
+    copyDirSync2(source, canonical);
+    writeInstalledSkillVersion(getCurrentVersion());
   } catch {
     return { installed: [], failed: ["canonical copy"] };
   }
@@ -892,15 +1106,15 @@ function installSkillForAgents(agentIds) {
       continue;
     }
     try {
-      const agentSkillsDir = path3.dirname(agentPath);
-      fs3.mkdirSync(agentSkillsDir, { recursive: true });
+      const agentSkillsDir = path4.dirname(agentPath);
+      fs4.mkdirSync(agentSkillsDir, { recursive: true });
       try {
-        fs3.lstatSync(agentPath);
-        fs3.rmSync(agentPath, { recursive: true });
+        fs4.lstatSync(agentPath);
+        fs4.rmSync(agentPath, { recursive: true });
       } catch {
       }
-      const relative = path3.relative(agentSkillsDir, canonical);
-      fs3.symlinkSync(relative, agentPath);
+      const relative = path4.relative(agentSkillsDir, canonical);
+      fs4.symlinkSync(relative, agentPath);
       installed.push(agent.name);
       seen.set(agentPath, true);
     } catch {
@@ -1548,35 +1762,35 @@ import * as p6 from "@clack/prompts";
 import pc6 from "picocolors";
 
 // src/lib/cache.ts
-import fs4 from "fs";
-import path4 from "path";
-import os4 from "os";
-var CACHE_BASE = path4.join(os4.homedir(), ".one", "cache");
-var KNOWLEDGE_DIR = path4.join(CACHE_BASE, "knowledge");
-var SEARCH_DIR = path4.join(CACHE_BASE, "search");
+import fs5 from "fs";
+import path5 from "path";
+import os5 from "os";
+var CACHE_BASE = path5.join(os5.homedir(), ".one", "cache");
+var KNOWLEDGE_DIR = path5.join(CACHE_BASE, "knowledge");
+var SEARCH_DIR = path5.join(CACHE_BASE, "search");
 function sanitizeFilename(input) {
   return input.replace(/[^a-zA-Z0-9_\-\.]/g, "_");
 }
 function knowledgeCachePath(actionId) {
-  return path4.join(KNOWLEDGE_DIR, `${sanitizeFilename(actionId)}.json`);
+  return path5.join(KNOWLEDGE_DIR, `${sanitizeFilename(actionId)}.json`);
 }
 function searchCachePath(platform, query, type) {
   const key = `${platform}_${sanitizeFilename(query)}_${type || "knowledge"}`;
-  return path4.join(SEARCH_DIR, `${key}.json`);
+  return path5.join(SEARCH_DIR, `${key}.json`);
 }
-function readCache(filePath) {
+function readCache2(filePath) {
   try {
-    const content = fs4.readFileSync(filePath, "utf-8");
+    const content = fs5.readFileSync(filePath, "utf-8");
     return JSON.parse(content);
   } catch {
     return null;
   }
 }
-function writeCache(filePath, entry) {
+function writeCache2(filePath, entry) {
   try {
-    const dir = path4.dirname(filePath);
-    fs4.mkdirSync(dir, { recursive: true });
-    fs4.writeFileSync(filePath, JSON.stringify(entry, null, 2));
+    const dir = path5.dirname(filePath);
+    fs5.mkdirSync(dir, { recursive: true });
+    fs5.writeFileSync(filePath, JSON.stringify(entry, null, 2));
   } catch {
   }
 }
@@ -1614,11 +1828,11 @@ function listCacheEntries() {
   const entries = [];
   for (const [dir, type] of [[KNOWLEDGE_DIR, "knowledge"], [SEARCH_DIR, "search"]]) {
     try {
-      const files = fs4.readdirSync(dir);
+      const files = fs5.readdirSync(dir);
       for (const file of files) {
         if (!file.endsWith(".json")) continue;
-        const filePath = path4.join(dir, file);
-        const entry = readCache(filePath);
+        const filePath = path5.join(dir, file);
+        const entry = readCache2(filePath);
         if (entry) {
           entries.push({ type, filePath, entry });
         }
@@ -1632,12 +1846,12 @@ function clearAll() {
   let count = 0;
   for (const dir of [KNOWLEDGE_DIR, SEARCH_DIR]) {
     try {
-      const files = fs4.readdirSync(dir);
+      const files = fs5.readdirSync(dir);
       for (const file of files) {
-        fs4.unlinkSync(path4.join(dir, file));
+        fs5.unlinkSync(path5.join(dir, file));
         count++;
       }
-      fs4.rmdirSync(dir);
+      fs5.rmdirSync(dir);
     } catch {
     }
   }
@@ -1646,7 +1860,7 @@ function clearAll() {
 function clearEntry(actionId) {
   const filePath = knowledgeCachePath(actionId);
   try {
-    fs4.unlinkSync(filePath);
+    fs5.unlinkSync(filePath);
     return true;
   } catch {
     return false;
@@ -1692,7 +1906,7 @@ async function actionsSearchCommand(platform, query, options) {
     const agentType = knowledgeAgent ? "knowledge" : options.type || "execute";
     const useCache = options.cache !== false;
     const cachePath = searchCachePath(platform, query, agentType || "knowledge");
-    const cached = useCache ? readCache(cachePath) : null;
+    const cached = useCache ? readCache2(cachePath) : null;
     let cleanedActions;
     let cacheHit = false;
     if (cached && isFresh(cached)) {
@@ -1708,7 +1922,7 @@ async function actionsSearchCommand(platform, query, options) {
         );
         if (result.status === 304 && cached) {
           cached.cachedAt = (/* @__PURE__ */ new Date()).toISOString();
-          writeCache(cachePath, cached);
+          writeCache2(cachePath, cached);
           cleanedActions = cached.data.actions;
           cacheHit = true;
         } else {
@@ -1721,7 +1935,7 @@ async function actionsSearchCommand(platform, query, options) {
             method: action.method,
             path: action.path
           }));
-          writeCache(cachePath, makeCacheEntry(
+          writeCache2(cachePath, makeCacheEntry(
             `${platform}_${query}_${agentType || "knowledge"}`,
             { actions: cleanedActions },
             result.etag
@@ -1745,7 +1959,7 @@ async function actionsSearchCommand(platform, query, options) {
       if (cacheHit && cached) {
         response._cache = buildCacheMeta(cached, true);
       } else {
-        const freshEntry = readCache(cachePath);
+        const freshEntry = readCache2(cachePath);
         response._cache = buildCacheMeta(freshEntry, false);
       }
       json(response);
@@ -1805,7 +2019,7 @@ Execute:     ${pc6.cyan(`one actions execute ${platform} <actionId> <connectionK
 async function actionsKnowledgeCommand(platform, actionId, options) {
   const cachePath = knowledgeCachePath(actionId);
   if (options.cacheStatus) {
-    const entry = readCache(cachePath);
+    const entry = readCache2(cachePath);
     if (!entry) {
       json({
         cached: false,
@@ -1853,7 +2067,7 @@ async function actionsKnowledgeCommand(platform, actionId, options) {
   spinner5.start(`Loading knowledge for action ${pc6.dim(actionId)}...`);
   try {
     const useCache = options.cache !== false;
-    const cached = useCache ? readCache(cachePath) : null;
+    const cached = useCache ? readCache2(cachePath) : null;
     let knowledgeData;
     let cacheHit = false;
     let cacheEntry = cached;
@@ -1868,13 +2082,13 @@ async function actionsKnowledgeCommand(platform, actionId, options) {
         );
         if (result.status === 304 && cached) {
           cached.cachedAt = (/* @__PURE__ */ new Date()).toISOString();
-          writeCache(cachePath, cached);
+          writeCache2(cachePath, cached);
           knowledgeData = cached.data;
           cacheHit = true;
         } else {
           knowledgeData = result.data;
           const newEntry = makeCacheEntry(actionId, knowledgeData, result.etag);
-          writeCache(cachePath, newEntry);
+          writeCache2(cachePath, newEntry);
           cacheEntry = newEntry;
         }
       } catch (fetchError) {
@@ -2028,551 +2242,6 @@ function colorMethod(method) {
 // src/commands/flow.ts
 import pc7 from "picocolors";
 
-// src/lib/flow-schema.ts
-var FLOW_SCHEMA = {
-  errorStrategies: ["fail", "continue", "retry", "fallback"],
-  validInputTypes: ["string", "number", "boolean", "object", "array"],
-  flowFields: {
-    key: { type: "string", required: true, description: "Unique kebab-case identifier", pattern: /^[a-z0-9][a-z0-9-]*[a-z0-9]$/ },
-    name: { type: "string", required: true, description: "Human-readable flow name" },
-    description: { type: "string", required: false, description: "What this flow does" },
-    version: { type: "string", required: false, description: "Semver or arbitrary version string" },
-    inputs: { type: "object", required: true, description: "Input declarations (Record<string, InputDeclaration>)" },
-    steps: { type: "array", required: true, description: "Ordered array of steps", stepsArray: true }
-  },
-  inputFields: {
-    type: { type: "string", required: true, description: "Data type: string, number, boolean, object, array", enum: ["string", "number", "boolean", "object", "array"] },
-    required: { type: "boolean", required: false, description: "Whether this input must be provided" },
-    default: { type: "unknown", required: false, description: "Default value if not provided" },
-    description: { type: "string", required: false, description: "Human-readable description" },
-    connection: { type: "object", required: false, description: 'Connection metadata: { platform: "gmail" } \u2014 enables auto-resolution' }
-  },
-  stepCommonFields: {
-    id: { type: "string", required: true, description: "Unique step identifier (used in selectors)" },
-    name: { type: "string", required: true, description: "Human-readable step label" },
-    type: { type: "string", required: true, description: "Step type (determines which config object is required)" },
-    if: { type: "string", required: false, description: "JS expression \u2014 skip step if falsy" },
-    unless: { type: "string", required: false, description: "JS expression \u2014 skip step if truthy" }
-  },
-  stepTypes: [
-    {
-      type: "action",
-      configKey: "action",
-      description: "Execute a platform API action",
-      fields: {
-        platform: { type: "string", required: true, description: "Platform name (kebab-case)" },
-        actionId: { type: "string", required: true, description: "Action ID from `actions search`" },
-        connectionKey: { type: "string", required: true, description: "Connection key (use $.input selector)" },
-        data: { type: "object", required: false, description: "Request body (POST/PUT/PATCH)" },
-        pathVars: { type: "object", required: false, description: "URL path variables" },
-        queryParams: { type: "object", required: false, description: "Query parameters" },
-        headers: { type: "object", required: false, description: "Additional headers" }
-      },
-      example: {
-        id: "findCustomer",
-        name: "Search Stripe customers",
-        type: "action",
-        action: {
-          platform: "stripe",
-          actionId: "conn_mod_def::xxx::yyy",
-          connectionKey: "$.input.stripeConnectionKey",
-          data: { query: "email:'{{$.input.customerEmail}}'" }
-        }
-      }
-    },
-    {
-      type: "transform",
-      configKey: "transform",
-      description: "Single JS expression with implicit return",
-      fields: {
-        expression: { type: "string", required: true, description: "JS expression evaluated with flow context as $" }
-      },
-      example: {
-        id: "extractNames",
-        name: "Extract customer names",
-        type: "transform",
-        transform: { expression: "$.steps.findCustomer.response.data.map(c => c.name)" }
-      }
-    },
-    {
-      type: "code",
-      configKey: "code",
-      description: "Multi-line async JS with explicit return",
-      fields: {
-        source: { type: "string", required: true, description: "JS function body (flow context as $, supports await)" }
-      },
-      example: {
-        id: "processData",
-        name: "Process and enrich data",
-        type: "code",
-        code: { source: "const items = $.steps.fetch.response.data;\nreturn items.filter(i => i.active);" }
-      }
-    },
-    {
-      type: "condition",
-      configKey: "condition",
-      description: "If/then/else branching",
-      fields: {
-        expression: { type: "string", required: true, description: "JS expression \u2014 truthy runs then, falsy runs else" },
-        then: { type: "array", required: true, description: "Steps to run when true", stepsArray: true },
-        else: { type: "array", required: false, description: "Steps to run when false", stepsArray: true }
-      },
-      example: {
-        id: "checkFound",
-        name: "Check if customer exists",
-        type: "condition",
-        condition: {
-          expression: "$.steps.search.response.data.length > 0",
-          then: [{ id: "notify", name: "Send notification", type: "action", action: { platform: "slack", actionId: "...", connectionKey: "$.input.slackKey", data: { text: "Found!" } } }],
-          else: [{ id: "logMiss", name: "Log not found", type: "transform", transform: { expression: "'Not found'" } }]
-        }
-      }
-    },
-    {
-      type: "loop",
-      configKey: "loop",
-      description: "Iterate over an array with optional concurrency",
-      fields: {
-        over: { type: "string", required: true, description: "Selector resolving to an array" },
-        as: { type: "string", required: true, description: "Variable name for current item ($.loop.<as>)" },
-        indexAs: { type: "string", required: false, description: "Variable name for index" },
-        steps: { type: "array", required: true, description: "Steps to run per iteration", stepsArray: true },
-        maxIterations: { type: "number", required: false, description: "Safety cap (default: no limit)" },
-        maxConcurrency: { type: "number", required: false, description: "Parallel batch size (default: 1 = sequential)" }
-      },
-      example: {
-        id: "processOrders",
-        name: "Process each order",
-        type: "loop",
-        loop: {
-          over: "$.steps.listOrders.response.data",
-          as: "order",
-          steps: [{ id: "createInvoice", name: "Create invoice", type: "action", action: { platform: "stripe", actionId: "...", connectionKey: "$.input.stripeKey", data: { amount: "$.loop.order.total" } } }]
-        }
-      }
-    },
-    {
-      type: "parallel",
-      configKey: "parallel",
-      description: "Run steps concurrently",
-      fields: {
-        steps: { type: "array", required: true, description: "Steps to run in parallel", stepsArray: true },
-        maxConcurrency: { type: "number", required: false, description: "Max concurrent steps (default: 5)" }
-      },
-      example: {
-        id: "lookups",
-        name: "Parallel data lookups",
-        type: "parallel",
-        parallel: {
-          steps: [
-            { id: "getStripe", name: "Get Stripe data", type: "action", action: { platform: "stripe", actionId: "...", connectionKey: "$.input.stripeKey" } },
-            { id: "getSlack", name: "Get Slack data", type: "action", action: { platform: "slack", actionId: "...", connectionKey: "$.input.slackKey" } }
-          ]
-        }
-      }
-    },
-    {
-      type: "file-read",
-      configKey: "fileRead",
-      description: "Read a file (optional JSON parse)",
-      fields: {
-        path: { type: "string", required: true, description: "File path to read" },
-        parseJson: { type: "boolean", required: false, description: "Parse contents as JSON (default: false)" }
-      },
-      example: {
-        id: "readConfig",
-        name: "Read config file",
-        type: "file-read",
-        fileRead: { path: "./data/config.json", parseJson: true }
-      }
-    },
-    {
-      type: "file-write",
-      configKey: "fileWrite",
-      description: "Write or append to a file",
-      fields: {
-        path: { type: "string", required: true, description: "File path to write" },
-        content: { type: "unknown", required: true, description: "Content to write (supports selectors)" },
-        append: { type: "boolean", required: false, description: "Append instead of overwrite (default: false)" }
-      },
-      example: {
-        id: "writeResults",
-        name: "Save results",
-        type: "file-write",
-        fileWrite: { path: "./output/results.json", content: "$.steps.transform.output" }
-      }
-    },
-    {
-      type: "while",
-      configKey: "while",
-      description: "Do-while loop with condition check",
-      fields: {
-        condition: { type: "string", required: true, description: "JS expression checked before each iteration (after first)" },
-        steps: { type: "array", required: true, description: "Steps to run each iteration", stepsArray: true },
-        maxIterations: { type: "number", required: false, description: "Safety cap (default: 100)" }
-      },
-      example: {
-        id: "paginate",
-        name: "Paginate through pages",
-        type: "while",
-        while: {
-          condition: "$.steps.paginate.output.lastResult.nextPageToken != null",
-          maxIterations: 50,
-          steps: [{ id: "fetchPage", name: "Fetch next page", type: "action", action: { platform: "gmail", actionId: "...", connectionKey: "$.input.gmailKey" } }]
-        }
-      }
-    },
-    {
-      type: "flow",
-      configKey: "flow",
-      description: "Execute a sub-flow (supports composition)",
-      fields: {
-        key: { type: "string", required: true, description: "Flow key or path of the sub-flow" },
-        inputs: { type: "object", required: false, description: "Inputs to pass to the sub-flow (supports selectors)" }
-      },
-      example: {
-        id: "enrich",
-        name: "Run enrichment sub-flow",
-        type: "flow",
-        flow: { key: "enrich-customer", inputs: { email: "$.steps.getCustomer.response.email" } }
-      }
-    },
-    {
-      type: "paginate",
-      configKey: "paginate",
-      description: "Auto-paginate API results into a single array",
-      fields: {
-        action: { type: "object", required: true, description: "Action config (same shape as action step: platform, actionId, connectionKey)" },
-        pageTokenField: { type: "string", required: true, description: "Dot-path in response to next page token" },
-        resultsField: { type: "string", required: true, description: "Dot-path in response to results array" },
-        inputTokenParam: { type: "string", required: true, description: "Dot-path in action config where page token is injected" },
-        maxPages: { type: "number", required: false, description: "Max pages to fetch (default: 10)" }
-      },
-      example: {
-        id: "allMessages",
-        name: "Fetch all Gmail messages",
-        type: "paginate",
-        paginate: {
-          action: { platform: "gmail", actionId: "...", connectionKey: "$.input.gmailKey", queryParams: { maxResults: 100 } },
-          pageTokenField: "nextPageToken",
-          resultsField: "messages",
-          inputTokenParam: "queryParams.pageToken",
-          maxPages: 10
-        }
-      }
-    },
-    {
-      type: "bash",
-      configKey: "bash",
-      description: "Shell command (requires --allow-bash)",
-      fields: {
-        command: { type: "string", required: true, description: "Shell command to execute (supports selectors)" },
-        timeout: { type: "number", required: false, description: "Timeout in ms (default: 30000)" },
-        parseJson: { type: "boolean", required: false, description: "Parse stdout as JSON (default: false)" },
-        cwd: { type: "string", required: false, description: "Working directory (supports selectors)" },
-        env: { type: "object", required: false, description: "Additional environment variables" }
-      },
-      example: {
-        id: "analyze",
-        name: "Analyze with Claude",
-        type: "bash",
-        bash: {
-          command: "cat /tmp/data.json | claude --print 'Analyze this data' --output-format json",
-          timeout: 18e4,
-          parseJson: true
-        }
-      }
-    }
-  ]
-};
-var _coveredTypes = Object.fromEntries(
-  FLOW_SCHEMA.stepTypes.map((st) => [st.type, true])
-);
-var _stepTypeMap = new Map(
-  FLOW_SCHEMA.stepTypes.map((st) => [st.type, st])
-);
-function getStepTypeDescriptor(type) {
-  return _stepTypeMap.get(type);
-}
-function getValidStepTypes() {
-  return FLOW_SCHEMA.stepTypes.map((st) => st.type);
-}
-function getNestedStepsKeys() {
-  const result = [];
-  for (const st of FLOW_SCHEMA.stepTypes) {
-    for (const [fieldName, fd] of Object.entries(st.fields)) {
-      if (fd.stepsArray) {
-        result.push({ configKey: st.configKey, fieldName });
-      }
-    }
-  }
-  return result;
-}
-function generateFlowGuide() {
-  const validTypes = getValidStepTypes();
-  const sections = [];
-  sections.push(`# One Flows \u2014 Reference
-
-## Overview
-
-Workflows are JSON files at \`.one/flows/<key>.flow.json\` that chain actions across platforms.
-
-## Commands
-
-\`\`\`bash
-one --agent flow create <key> --definition '<json>'   # Create (or --definition @file.json)
-one --agent flow create <key> --definition @flow.json  # Create from file
-one --agent flow list                                  # List
-one --agent flow validate <key>                        # Validate
-one --agent flow execute <key> -i name=value           # Execute
-one --agent flow execute <key> --dry-run --mock        # Test with mock data
-one --agent flow execute <key> --allow-bash            # Enable bash steps
-one --agent flow runs [flowKey]                        # List past runs
-one --agent flow resume <runId>                        # Resume failed run
-one --agent flow scaffold [template]                   # Generate a starter template
-\`\`\`
-
-You can also write the JSON file directly to \`.one/flows/<key>.flow.json\` \u2014 this is often easier than passing large JSON via --definition.
-
-## Building a Workflow
-
-1. **Design first** \u2014 clarify the end goal, map the full value chain, identify where AI analysis is needed
-2. **Discover connections** \u2014 \`one --agent connection list\`
-3. **Get knowledge** for every action \u2014 \`one --agent actions knowledge <platform> <actionId>\`
-4. **Construct JSON** \u2014 declare inputs, wire steps with selectors
-5. **Validate** \u2014 \`one --agent flow validate <key>\`
-6. **Execute** \u2014 \`one --agent flow execute <key> -i param=value\``);
-  sections.push(`## Flow JSON Schema
-
-\`\`\`json
-{
-  "key": "my-workflow",
-  "name": "My Workflow",
-  "description": "What this flow does",
-  "version": "1",
-  "inputs": {
-    "connectionKey": {
-      "type": "string",
-      "required": true,
-      "description": "Platform connection key",
-      "connection": { "platform": "stripe" }
-    },
-    "param": {
-      "type": "string",
-      "required": true,
-      "description": "A user parameter"
-    }
-  },
-  "steps": [
-    {
-      "id": "stepId",
-      "name": "Human-readable step name",
-      "type": "action",
-      "action": {
-        "platform": "stripe",
-        "actionId": "conn_mod_def::xxx::yyy",
-        "connectionKey": "$.input.connectionKey",
-        "data": { "query": "{{$.input.param}}" }
-      }
-    }
-  ]
-}
-\`\`\`
-
-### Top-level fields
-
-| Field | Type | Required | Description |
-|-------|------|----------|-------------|`);
-  for (const [name, fd] of Object.entries(FLOW_SCHEMA.flowFields)) {
-    sections.push(`| \`${name}\` | ${fd.type} | ${fd.required ? "yes" : "no"} | ${fd.description} |`);
-  }
-  sections.push(`
-### Input declarations
-
-| Field | Type | Required | Description |
-|-------|------|----------|-------------|`);
-  for (const [name, fd] of Object.entries(FLOW_SCHEMA.inputFields)) {
-    sections.push(`| \`${name}\` | ${fd.type} | ${fd.required ? "yes" : "no"} | ${fd.description} |`);
-  }
-  sections.push(`
-### Step fields (all steps)
-
-Every step MUST have \`id\`, \`name\`, and \`type\`. The \`type\` determines which config object is required.
-
-| Field | Type | Required | Description |
-|-------|------|----------|-------------|`);
-  for (const [name, fd] of Object.entries(FLOW_SCHEMA.stepCommonFields)) {
-    sections.push(`| \`${name}\` | ${fd.type} | ${fd.required ? "yes" : "no"} | ${fd.description} |`);
-  }
-  sections.push(`| \`onError\` | object | no | Error handling: \`{ "strategy": "${FLOW_SCHEMA.errorStrategies.join(" | ")}", "retries": 3, "retryDelayMs": 1000 }\` |`);
-  sections.push(`
-## Step Types
-
-**IMPORTANT:** Each step type requires a config object nested under a specific key. The type name and config key differ for some types (noted below).
-
-| Type | Config Key | Description |
-|------|-----------|-------------|`);
-  for (const st of FLOW_SCHEMA.stepTypes) {
-    const keyNote = st.type !== st.configKey ? ` \u26A0\uFE0F` : "";
-    sections.push(`| \`${st.type}\` | \`${st.configKey}\`${keyNote} | ${st.description} |`);
-  }
-  sections.push(`
-## Step Type Reference`);
-  for (const st of FLOW_SCHEMA.stepTypes) {
-    sections.push(`
-### \`${st.type}\` \u2014 ${st.description}`);
-    if (st.type !== st.configKey) {
-      sections.push(`
-> **Note:** Type is \`"${st.type}"\` but config key is \`"${st.configKey}"\` (camelCase).`);
-    }
-    sections.push(`
-| Field | Type | Required | Description |
-|-------|------|----------|-------------|`);
-    for (const [name, fd] of Object.entries(st.fields)) {
-      sections.push(`| \`${name}\` | ${fd.type} | ${fd.required ? "yes" : "no"} | ${fd.description} |`);
-    }
-    sections.push(`
-\`\`\`json
-${JSON.stringify(st.example, null, 2)}
-\`\`\``);
-  }
-  sections.push(`
-## Selectors
-
-| Pattern | Resolves To |
-|---------|-------------|
-| \`$.input.paramName\` | Input value |
-| \`$.steps.stepId.response\` | Full API response |
-| \`$.steps.stepId.response.data[0].email\` | Nested field |
-| \`$.steps.stepId.response.data[*].id\` | Wildcard array map |
-| \`$.env.MY_VAR\` | Environment variable |
-| \`$.loop.item\` / \`$.loop.i\` | Loop iteration |
-| \`"Hello {{$.steps.getUser.response.name}}"\` | String interpolation |
-
-### When to use bare selectors vs \`{{...}}\` interpolation
-
-- **Bare selectors** (\`$.input.x\`): Use for fields the engine resolves directly \u2014 \`connectionKey\`, \`over\`, \`path\`, \`expression\`, \`condition\`, and any field where the entire value is a single selector. The resolved value keeps its original type (object, array, number).
-- **Interpolation** (\`{{$.input.x}}\`): Use inside string values where the selector is embedded in text \u2014 e.g., \`"Hello {{$.steps.getUser.response.name}}"\`. The resolved value is always stringified. Use this in \`data\`, \`pathVars\`, and \`queryParams\` when mixing selectors with literal text.
-- **Rule of thumb**: If the value is purely a selector, use bare. If it's a string containing a selector, use \`{{...}}\`.
-
-### Selectors vs expressions
-
-Selectors in data fields (\`data\`, \`queryParams\`, \`pathVars\`, \`connectionKey\`) are **dot-path lookups only** \u2014 they do not support JavaScript operators like \`||\` or \`&&\`. For default values, use the \`default\` field on the input definition:
-
-\`\`\`json
-{ "inputs": { "maxResults": { "type": "number", "default": 10 } } }
-\`\`\`
-
-The \`if\`, \`unless\`, \`condition.expression\`, \`while.condition\`, \`transform.expression\`, and \`code.source\` fields **do** support full JavaScript expressions (e.g., \`$.input.email && $.input.email.length > 0\`).
-
-### \`output\` vs \`response\` on step results
-
-Every completed step produces both \`output\` and \`response\`:
-- **Action steps**: \`response\` is the raw API response. \`output\` is the same as \`response\`.
-- **Code/transform steps**: \`output\` is the return value. \`response\` is an alias for \`output\`.
-- **In practice**: Use \`$.steps.stepId.response\` for action steps (API data) and \`$.steps.stepId.output\` for code/transform steps (computed data). Both work interchangeably, but using the semantically correct one makes flows easier to read.
-
-## Error Handling
-
-\`\`\`json
-{"onError": {"strategy": "retry", "retries": 3, "retryDelayMs": 1000}}
-\`\`\`
-
-Strategies: \`${FLOW_SCHEMA.errorStrategies.join("`, `")}\`
-
-Conditional execution: \`"if": "$.steps.prev.response.data.length > 0"\`
-
-## Input Connection Auto-Resolution
-
-When an input has \`"connection": { "platform": "stripe" }\`, the flow engine can automatically resolve the connection key at execution time. If the user has exactly one connection for that platform, the engine fills in the key without requiring \`-i connectionKey=...\`. If multiple connections exist, the user must specify which one. This is metadata for tooling \u2014 it does not affect the flow JSON structure, but it makes execution more convenient.
-
-## Complete Example: Fetch Data, Transform, Notify
-
-\`\`\`json
-{
-  "key": "contacts-to-slack",
-  "name": "CRM Contacts Summary to Slack",
-  "description": "Fetch recent contacts from CRM, build a summary, post to Slack",
-  "version": "1",
-  "inputs": {
-    "crmConnectionKey": {
-      "type": "string",
-      "required": true,
-      "description": "CRM platform connection key",
-      "connection": { "platform": "attio" }
-    },
-    "slackConnectionKey": {
-      "type": "string",
-      "required": true,
-      "description": "Slack connection key",
-      "connection": { "platform": "slack" }
-    },
-    "slackChannel": {
-      "type": "string",
-      "required": true,
-      "description": "Slack channel name or ID"
-    }
-  },
-  "steps": [
-    {
-      "id": "fetchContacts",
-      "name": "Fetch recent contacts",
-      "type": "action",
-      "action": {
-        "platform": "attio",
-        "actionId": "ATTIO_LIST_PEOPLE_ACTION_ID",
-        "connectionKey": "$.input.crmConnectionKey",
-        "queryParams": { "limit": "10" }
-      }
-    },
-    {
-      "id": "buildSummary",
-      "name": "Build formatted summary",
-      "type": "code",
-      "code": {
-        "source": "const contacts = $.steps.fetchContacts.response.data || [];\\nconst lines = contacts.map((c, i) => \`\${i+1}. \${c.name || 'Unknown'} \u2014 \${c.email || 'no email'}\`);\\nreturn { summary: \`Found \${contacts.length} contacts:\\n\${lines.join('\\n')}\` };"
-      }
-    },
-    {
-      "id": "notifySlack",
-      "name": "Post summary to Slack",
-      "type": "action",
-      "action": {
-        "platform": "slack",
-        "actionId": "SLACK_SEND_MESSAGE_ACTION_ID",
-        "connectionKey": "$.input.slackConnectionKey",
-        "data": {
-          "channel": "$.input.slackChannel",
-          "text": "{{$.steps.buildSummary.output.summary}}"
-        }
-      }
-    }
-  ]
-}
-\`\`\`
-
-Note: Action IDs above are placeholders. Always use \`one --agent actions search <platform> "<query>"\` to find real IDs.
-
-## AI-Augmented Pattern
-
-For workflows that need analysis/summarization, use the file-write \u2192 bash \u2192 code pattern:
-
-1. \`file-write\` \u2014 save data to temp file
-2. \`bash\` \u2014 \`claude --print\` analyzes it (\`parseJson: true\`, \`timeout: 180000\`)
-3. \`code\` \u2014 parse and structure the output
-
-Set timeout to at least 180000ms (3 min). Run Claude-heavy flows sequentially, not in parallel.
-
-## Notes
-
-- Connection keys are **inputs**, not hardcoded
-- Action IDs in examples are placeholders \u2014 always use \`actions search\`
-- Code steps allow \`crypto\`, \`buffer\`, \`url\`, \`path\` \u2014 \`fs\`, \`http\`, \`child_process\` are blocked
-- Bash steps require \`--allow-bash\` flag
-- State is persisted after every step \u2014 resume picks up where it left off`);
-  return sections.join("\n");
-}
-
 // src/lib/flow-validator.ts
 function validateFlowSchema(flow2) {
   const errors = [];
@@ -2632,26 +2301,26 @@ function validateStepsArray(steps, pathPrefix, errors) {
   const validTypes = FLOW_SCHEMA.stepTypes.map((st) => st.type);
   for (let i = 0; i < steps.length; i++) {
     const step = steps[i];
-    const path5 = `${pathPrefix}[${i}]`;
+    const path6 = `${pathPrefix}[${i}]`;
     if (!step || typeof step !== "object" || Array.isArray(step)) {
-      errors.push({ path: path5, message: "Step must be an object" });
+      errors.push({ path: path6, message: "Step must be an object" });
       continue;
     }
     const s = step;
     if (!s.id || typeof s.id !== "string") {
-      errors.push({ path: `${path5}.id`, message: 'Step must have a string "id"' });
+      errors.push({ path: `${path6}.id`, message: 'Step must have a string "id"' });
     }
     if (!s.name || typeof s.name !== "string") {
-      errors.push({ path: `${path5}.name`, message: 'Step must have a string "name"' });
+      errors.push({ path: `${path6}.name`, message: 'Step must have a string "name"' });
     }
     if (!s.type || !validTypes.includes(s.type)) {
-      errors.push({ path: `${path5}.type`, message: `Step type must be one of: ${validTypes.join(", ")}` });
+      errors.push({ path: `${path6}.type`, message: `Step type must be one of: ${validTypes.join(", ")}` });
       continue;
     }
     if (s.onError && typeof s.onError === "object") {
       const oe = s.onError;
       if (!FLOW_SCHEMA.errorStrategies.includes(oe.strategy)) {
-        errors.push({ path: `${path5}.onError.strategy`, message: `Error strategy must be one of: ${FLOW_SCHEMA.errorStrategies.join(", ")}` });
+        errors.push({ path: `${path6}.onError.strategy`, message: `Error strategy must be one of: ${FLOW_SCHEMA.errorStrategies.join(", ")}` });
       }
     }
     const descriptor = getStepTypeDescriptor(s.type);
@@ -2661,15 +2330,15 @@ function validateStepsArray(steps, pathPrefix, errors) {
     if (!configObj || typeof configObj !== "object") {
       const hint = detectFlatConfigHint(s, descriptor);
       errors.push({
-        path: `${path5}.${configKey}`,
+        path: `${path6}.${configKey}`,
         message: `${capitalize(descriptor.type)} step must have a "${configKey}" config object${hint}`
       });
       continue;
     }
-    const config = configObj;
+    const config2 = configObj;
     for (const [fieldName, fd] of Object.entries(descriptor.fields)) {
-      const fieldPath = `${path5}.${configKey}.${fieldName}`;
-      const value = config[fieldName];
+      const fieldPath = `${path6}.${configKey}.${fieldName}`;
+      const value = config2[fieldName];
       if (fd.required && (value === void 0 || value === null || value === "")) {
         errors.push({ path: fieldPath, message: `${capitalize(descriptor.type)} must have ${fd.type === "string" ? "a string" : fd.type === "array" ? "a" : "a"} "${fieldName}"` });
         continue;
@@ -2700,6 +2369,25 @@ function validateStepsArray(steps, pathPrefix, errors) {
         }
       }
     }
+    if (descriptor.type === "code") {
+      const hasSource = typeof config2.source === "string" && config2.source.length > 0;
+      const hasModule = typeof config2.module === "string" && config2.module.length > 0;
+      if (!hasSource && !hasModule) {
+        errors.push({ path: `${path6}.${configKey}`, message: 'Code step must define either "source" (inline JS) or "module" (path to .mjs file)' });
+      } else if (hasSource && hasModule) {
+        errors.push({ path: `${path6}.${configKey}`, message: 'Code step cannot define both "source" and "module" \u2014 pick one' });
+      }
+      if (hasModule) {
+        const m = config2.module;
+        if (m.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(m)) {
+          errors.push({ path: `${path6}.${configKey}.module`, message: "Code module path must be relative to the flow folder (no absolute paths)" });
+        } else if (m.split(/[\\/]/).includes("..")) {
+          errors.push({ path: `${path6}.${configKey}.module`, message: 'Code module path must not escape the flow folder ("..")' });
+        } else if (!m.endsWith(".mjs")) {
+          errors.push({ path: `${path6}.${configKey}.module`, message: "Code module must be a .mjs file" });
+        }
+      }
+    }
   }
 }
 function detectFlatConfigHint(step, descriptor) {
@@ -2720,16 +2408,16 @@ function validateStepIds(flow2) {
   function collectIds(steps, pathPrefix) {
     for (let i = 0; i < steps.length; i++) {
       const step = steps[i];
-      const path5 = `${pathPrefix}[${i}]`;
+      const path6 = `${pathPrefix}[${i}]`;
       if (seen.has(step.id)) {
-        errors.push({ path: `${path5}.id`, message: `Duplicate step ID: "${step.id}"` });
+        errors.push({ path: `${path6}.id`, message: `Duplicate step ID: "${step.id}"` });
       } else {
         seen.add(step.id);
       }
       for (const { configKey, fieldName } of nestedKeys) {
-        const config = step[configKey];
-        if (config && Array.isArray(config[fieldName])) {
-          collectIds(config[fieldName], `${path5}.${configKey}.${fieldName}`);
+        const config2 = step[configKey];
+        if (config2 && Array.isArray(config2[fieldName])) {
+          collectIds(config2[fieldName], `${path6}.${configKey}.${fieldName}`);
         }
       }
     }
@@ -2746,9 +2434,9 @@ function validateSelectorReferences(flow2) {
     for (const step of steps) {
       ids.add(step.id);
       for (const { configKey, fieldName } of nestedKeys) {
-        const config = step[configKey];
-        if (config && Array.isArray(config[fieldName])) {
-          for (const id of getAllStepIds(config[fieldName])) ids.add(id);
+        const config2 = step[configKey];
+        if (config2 && Array.isArray(config2[fieldName])) {
+          for (const id of getAllStepIds(config2[fieldName])) ids.add(id);
         }
       }
     }
@@ -2777,7 +2465,7 @@ function validateSelectorReferences(flow2) {
     }
     return selectors;
   }
-  function checkSelectors(selectors, path5) {
+  function checkSelectors(selectors, path6) {
     for (const selector of selectors) {
       const parts = selector.split(".");
       if (parts.length < 3) continue;
@@ -2785,31 +2473,31 @@ function validateSelectorReferences(flow2) {
       if (root === "input") {
         const inputName = parts[2];
         if (!inputNames.has(inputName)) {
-          errors.push({ path: path5, message: `Selector "${selector}" references undefined input "${inputName}"` });
+          errors.push({ path: path6, message: `Selector "${selector}" references undefined input "${inputName}"` });
         }
       } else if (root === "steps") {
         const stepId = parts[2];
         if (!allStepIds.has(stepId)) {
-          errors.push({ path: path5, message: `Selector "${selector}" references undefined step "${stepId}"` });
+          errors.push({ path: path6, message: `Selector "${selector}" references undefined step "${stepId}"` });
         }
       }
     }
   }
   const EXPRESSION_FIELDS = /* @__PURE__ */ new Set(["condition.expression", "while.condition"]);
-  function checkOperatorsInSelectorField(value, path5) {
+  function checkOperatorsInSelectorField(value, path6) {
     if (typeof value === "string" && value.startsWith("$.")) {
       if (value.includes("||")) {
-        errors.push({ path: path5, message: `Selector "${value}" contains unsupported operator "||". Selectors in data fields use dot-path resolution, not JS evaluation. Use the "default" field on the input definition instead, or use a "code" step for complex expressions.` });
+        errors.push({ path: path6, message: `Selector "${value}" contains unsupported operator "||". Selectors in data fields use dot-path resolution, not JS evaluation. Use the "default" field on the input definition instead, or use a "code" step for complex expressions.` });
       } else if (value.includes("&&")) {
-        errors.push({ path: path5, message: `Selector "${value}" contains unsupported operator "&&". Selectors in data fields use dot-path resolution, not JS evaluation. Use a "condition" step or "code" step for complex expressions.` });
+        errors.push({ path: path6, message: `Selector "${value}" contains unsupported operator "&&". Selectors in data fields use dot-path resolution, not JS evaluation. Use a "condition" step or "code" step for complex expressions.` });
       }
     } else if (value && typeof value === "object" && !Array.isArray(value)) {
       for (const [k, v] of Object.entries(value)) {
-        checkOperatorsInSelectorField(v, `${path5}.${k}`);
+        checkOperatorsInSelectorField(v, `${path6}.${k}`);
       }
     } else if (Array.isArray(value)) {
       for (let i = 0; i < value.length; i++) {
-        checkOperatorsInSelectorField(value[i], `${path5}[${i}]`);
+        checkOperatorsInSelectorField(value[i], `${path6}[${i}]`);
       }
     }
   }
@@ -2818,12 +2506,12 @@ function validateSelectorReferences(flow2) {
     if (step.unless) checkSelectors(extractSelectors(step.unless), `${pathPrefix}.unless`);
     const descriptor = getStepTypeDescriptor(step.type);
     if (descriptor) {
-      const config = step[descriptor.configKey];
-      if (config && typeof config === "object") {
+      const config2 = step[descriptor.configKey];
+      if (config2 && typeof config2 === "object") {
         if (step.type !== "transform" && step.type !== "code") {
           for (const [fieldName, fd] of Object.entries(descriptor.fields)) {
             if (fd.stepsArray) continue;
-            const value = config[fieldName];
+            const value = config2[fieldName];
             if (value !== void 0) {
               const fieldKey = `${descriptor.configKey}.${fieldName}`;
               const fieldPath = `${pathPrefix}.${fieldKey}`;
@@ -2861,7 +2549,7 @@ function validateFlow(flow2) {
 }
 
 // src/commands/flow.ts
-import fs5 from "fs";
+import fs6 from "fs";
 function getConfig2() {
   const apiKey = getApiKey();
   if (!apiKey) {
@@ -2919,7 +2607,7 @@ async function flowCreateCommand(key, options) {
     if (raw.startsWith("@")) {
       const filePath = raw.slice(1);
       try {
-        raw = fs5.readFileSync(filePath, "utf-8");
+        raw = fs6.readFileSync(filePath, "utf-8");
       } catch (err) {
         error(`Cannot read file "${filePath}": ${err.message}`);
       }
@@ -2971,14 +2659,35 @@ async function flowExecuteCommand(keyOrPath, options) {
   const spinner5 = createSpinner();
   spinner5.start(`Loading workflow "${keyOrPath}"...`);
   let flow2;
+  let rootDir;
+  let flowFilePath;
   try {
-    flow2 = loadFlow(keyOrPath);
+    const loaded = loadFlowWithMeta(keyOrPath);
+    flow2 = loaded.flow;
+    rootDir = loaded.rootDir;
+    flowFilePath = loaded.filePath;
   } catch (err) {
     spinner5.stop("Workflow not found");
     error(err instanceof Error ? err.message : String(err));
     return;
   }
   spinner5.stop(`Workflow: ${flow2.name} (${flow2.steps.length} steps)`);
+  if (flowFilePath.endsWith(".flow.json")) {
+    const msg = `Workflow "${flow2.key}" uses the deprecated single-file layout. Migrate to .one/flows/${flow2.key}/flow.json (see: one guide flows).`;
+    if (isAgentMode()) {
+      json({ event: "flow:deprecation", flowKey: flow2.key, warning: msg });
+    } else {
+      console.error(pc7.yellow(`\u26A0 ${msg}`));
+    }
+  }
+  if (!options.allowBash && flowRequiresBash(flow2)) {
+    const msg = `Workflow "${flow2.key}" contains bash steps. Re-run with --allow-bash to permit shell execution.`;
+    if (isAgentMode()) {
+      json({ error: msg, requiresBash: true, flowKey: flow2.key });
+      process.exit(1);
+    }
+    error(msg);
+  }
   const inputs = parseInputs(options.input || []);
   const resolvedInputs = await autoResolveConnectionInputs(flow2, inputs, api);
   const runner = new FlowRunner(flow2, resolvedInputs);
@@ -3017,6 +2726,7 @@ ${pc7.yellow("Pausing after current step completes...")} (run ID: ${runId})`);
       mock: options.mock,
       verbose: options.verbose,
       allowBash: options.allowBash,
+      rootDir,
       onEvent
     });
     process.off("SIGINT", sigintHandler);
@@ -3081,16 +2791,18 @@ async function flowListCommand() {
     [
       { key: "key", label: "Key" },
       { key: "name", label: "Name" },
-      { key: "description", label: "Description" },
+      { key: "layout", label: "Layout" },
       { key: "inputCount", label: "Inputs" },
-      { key: "stepCount", label: "Steps" }
+      { key: "stepCount", label: "Steps" },
+      { key: "flags", label: "Requires" }
     ],
     flows.map((f) => ({
       key: f.key,
       name: f.name,
-      description: f.description || "",
+      layout: f.layout,
       inputCount: String(f.inputCount),
-      stepCount: String(f.stepCount)
+      stepCount: String(f.stepCount),
+      flags: f.requiresBash ? "--allow-bash" : ""
     }))
   );
   console.log();
@@ -3102,7 +2814,7 @@ async function flowValidateCommand(keyOrPath) {
   let flowData;
   try {
     const flowPath = resolveFlowPath(keyOrPath);
-    const content = fs5.readFileSync(flowPath, "utf-8");
+    const content = fs6.readFileSync(flowPath, "utf-8");
     flowData = JSON.parse(content);
   } catch (err) {
     spinner5.stop("Validation failed");
@@ -3141,8 +2853,11 @@ async function flowResumeCommand(runId) {
   const { apiKey, permissions, actionIds } = getConfig2();
   const api = new OneApi(apiKey, getApiBase());
   let flow2;
+  let rootDir;
   try {
-    flow2 = loadFlow(state.flowKey);
+    const loaded = loadFlowWithMeta(state.flowKey);
+    flow2 = loaded.flow;
+    rootDir = loaded.rootDir;
   } catch (err) {
     error(`Could not load workflow "${state.flowKey}": ${err instanceof Error ? err.message : String(err)}`);
     return;
@@ -3156,7 +2871,7 @@ async function flowResumeCommand(runId) {
   const spinner5 = createSpinner();
   spinner5.start(`Resuming run ${runId} (${state.completedSteps.length} steps already completed)...`);
   try {
-    const context = await runner.resume(flow2, api, permissions, actionIds, { onEvent });
+    const context = await runner.resume(flow2, api, permissions, actionIds, { onEvent, rootDir });
     spinner5.stop("Workflow completed");
     if (isAgentMode()) {
       json({
@@ -3857,11 +3572,11 @@ async function cacheUpdateAllCommand() {
       if (e.type === "knowledge") {
         const result = await api.getActionKnowledgeWithMeta(e.entry.key);
         const newEntry = makeCacheEntry(e.entry.key, result.data, result.etag);
-        writeCache(e.filePath, newEntry);
+        writeCache2(e.filePath, newEntry);
         updated++;
       } else {
         const refreshed = { ...e.entry, cachedAt: (/* @__PURE__ */ new Date()).toISOString() };
-        writeCache(e.filePath, refreshed);
+        writeCache2(e.filePath, refreshed);
         updated++;
       }
     } catch (err) {
@@ -3946,7 +3661,8 @@ one --agent flow list                                 # List all workflows
 \`\`\`
 
 **Key concepts:**
-- Workflows are JSON files at \`.one/flows/<key>.flow.json\`
+- Workflows live at \`.one/flows/<key>/flow.json\` (folder layout \u2014 REQUIRED for new flows). The legacy \`.one/flows/<key>.flow.json\` single-file layout is DEPRECATED but still loads for backward compatibility
+- Code steps can reference an external \`.mjs\` module under the flow's \`lib/\` folder (stdin JSON in, stdout JSON out) \u2014 keeps JS out of JSON strings and makes flows shareable
 - 12 step types: action, transform, code, condition, loop, parallel, file-read, file-write, while, flow, paginate, bash
 - Data wiring via selectors: \`$.input.param\`, \`$.steps.stepId.response\`, \`$.loop.item\`
 - AI analysis via bash steps: \`claude --print\` with \`parseJson: true\`
@@ -3988,6 +3704,7 @@ Request specific sections:
 - Always use the **exact action ID** from search results \u2014 don't guess
 - Always read **knowledge** before executing any action
 - Connection keys come from \`one connection list\` \u2014 don't hardcode them
+- Skills stay in lockstep with the CLI version automatically \u2014 every command checks a \`.one-cli-version\` marker in the canonical skill dir and refreshes the files if the CLI has been upgraded. Check manually with \`one config skills status\`; force a resync with \`one config skills sync\`
 `;
 var GUIDE_ACTIONS = `# One Actions \u2014 Reference
 
@@ -4591,118 +4308,6 @@ function buildWorkflowIdeas(connections) {
   return lines.join("\n");
 }
 
-// src/commands/update.ts
-import { createRequire } from "module";
-import { spawn } from "child_process";
-import { readFileSync, writeFileSync, mkdirSync } from "fs";
-import { homedir } from "os";
-import { join } from "path";
-var require2 = createRequire(import.meta.url);
-var { version: currentVersion } = require2("../package.json");
-var CACHE_PATH = join(homedir(), ".one", "update-check.json");
-var CHECK_INTERVAL_MS = 4 * 60 * 60 * 1e3;
-var AGE_GATE_MS = 30 * 60 * 1e3;
-async function fetchLatestVersionInfo() {
-  try {
-    const res = await fetch("https://registry.npmjs.org/@withone/cli");
-    if (!res.ok) return null;
-    const data = await res.json();
-    const latest = data["dist-tags"]?.latest;
-    if (!latest) return null;
-    return { version: latest, publishedAt: data.time?.[latest] ?? null };
-  } catch {
-    return null;
-  }
-}
-function readCache3() {
-  try {
-    return JSON.parse(readFileSync(CACHE_PATH, "utf8"));
-  } catch {
-    return null;
-  }
-}
-function writeCache2(latestVersion, publishedAt) {
-  try {
-    mkdirSync(join(homedir(), ".one"), { recursive: true });
-    writeFileSync(CACHE_PATH, JSON.stringify({ lastCheck: Date.now(), latestVersion, publishedAt }));
-  } catch {
-  }
-}
-async function checkLatestVersion() {
-  const info = await fetchLatestVersionInfo();
-  if (info) writeCache2(info.version, info.publishedAt);
-  return info?.version ?? null;
-}
-async function checkLatestVersionCached() {
-  const cache2 = readCache3();
-  if (cache2 && Date.now() - cache2.lastCheck < CHECK_INTERVAL_MS) {
-    return { version: cache2.latestVersion, publishedAt: cache2.publishedAt ?? null };
-  }
-  const info = await fetchLatestVersionInfo();
-  if (info) writeCache2(info.version, info.publishedAt);
-  return info;
-}
-function getCurrentVersion() {
-  return currentVersion;
-}
-async function updateCommand() {
-  const s = createSpinner();
-  s.start("Checking for updates...");
-  const latestVersion = await checkLatestVersion();
-  if (!latestVersion) {
-    s.stop("");
-    error("Failed to check for updates \u2014 could not reach npm registry");
-  }
-  if (currentVersion === latestVersion) {
-    s.stop("Already up to date");
-    if (isAgentMode()) {
-      json({ current: currentVersion, latest: latestVersion, updated: false, message: "Already up to date" });
-    } else {
-      console.log(`Already up to date (v${currentVersion})`);
-    }
-    return;
-  }
-  s.stop(`Update available: v${currentVersion} \u2192 v${latestVersion}`);
-  console.log(`Updating @withone/cli: v${currentVersion} \u2192 v${latestVersion}...`);
-  const code = await new Promise((resolve) => {
-    const child = spawn("npm", ["install", "-g", "@withone/cli@latest", "--force"], {
-      stdio: isAgentMode() ? "pipe" : "inherit",
-      shell: true
-    });
-    child.on("close", resolve);
-    child.on("error", () => resolve(1));
-  });
-  if (code === 0) {
-    if (isAgentMode()) {
-      json({ current: currentVersion, latest: latestVersion, updated: true, message: "Updated successfully" });
-    } else {
-      console.log(`Successfully updated to v${latestVersion}`);
-    }
-  } else {
-    error("Update failed \u2014 try running: npm install -g @withone/cli@latest");
-  }
-}
-function isNewerVersion(latest, current) {
-  const parse = (v) => v.split(".").map(Number);
-  const [lMaj, lMin, lPat] = parse(latest);
-  const [cMaj, cMin, cPat] = parse(current);
-  if (lMaj !== cMaj) return lMaj > cMaj;
-  if (lMin !== cMin) return lMin > cMin;
-  return lPat > cPat;
-}
-function autoUpdate(targetVersion, publishedAt) {
-  if (publishedAt) {
-    const age = Date.now() - new Date(publishedAt).getTime();
-    if (age < AGE_GATE_MS) return;
-  }
-  const child = spawn("npm", ["install", "-g", `@withone/cli@${targetVersion}`], {
-    detached: true,
-    stdio: "ignore",
-    shell: true
-  });
-  child.unref();
-}
-
 // src/index.ts
 var require3 = createRequire2(import.meta.url);
 var { version } = require3("../package.json");
@@ -4768,6 +4373,12 @@ program.hook("preAction", (thisCommand) => {
   if (commandName !== "update") {
     updateCheckPromise = checkLatestVersionCached();
   }
+  if (commandName !== "init" && commandName !== "update") {
+    try {
+      syncSkillsIfStale();
+    } catch {
+    }
+  }
 });
 program.hook("postAction", async () => {
   if (!updateCheckPromise) return;
@@ -4780,9 +4391,48 @@ program.hook("postAction", async () => {
 program.command("init").description("Set up One and install MCP to your AI agents").option("-y, --yes", "Skip confirmations").option("-g, --global", "Install MCP globally (available in all projects)").option("-p, --project", "Install MCP for this project only (creates .mcp.json)").action(async (options) => {
   await initCommand(options);
 });
-program.command("config").description("Configure MCP access control (permissions, connections, actions)").action(async () => {
+var config = program.command("config").description("Configure the CLI (access control, skills, ...)").action(async () => {
   await configCommand();
 });
+var configSkills = config.command("skills").description("Manage locally-installed skill files");
+configSkills.command("sync").description("Re-copy packaged skill files over the local install (runs automatically after CLI upgrades)").action(async () => {
+  const result = forceSyncSkills();
+  if (isAgentMode()) {
+    json({ command: "config skills sync", ...result });
+    return;
+  }
+  if (result.reason === "not-installed") {
+    console.log("No skill is installed yet. Run 'one init' first and opt in to skill installation.");
+    return;
+  }
+  if (result.synced) {
+    console.log(`\u2713 Skills synced to v${result.to}`);
+    return;
+  }
+  if (result.reason === "source-missing") {
+    console.log("\u2717 Packaged skill source not found in this CLI build");
+    return;
+  }
+  console.log(`\u2717 Sync failed${result.error ? ": " + result.error : ""}`);
+});
+configSkills.command("status").description("Show installed skill version and whether it matches the current CLI").action(async () => {
+  const status = getSkillStatus();
+  if (isAgentMode()) {
+    json({ command: "config skills status", ...status });
+    return;
+  }
+  if (!status.installed) {
+    console.log("Skill is not installed. Run 'one init' to install it.");
+    console.log(`Canonical path (empty): ${status.canonicalPath}`);
+    return;
+  }
+  const marker = status.installedVersion ?? "(no marker \u2014 pre-sync install)";
+  const state = status.upToDate ? "\u2713 up to date" : "\u26A0 stale \u2014 will sync on next command";
+  console.log(`Skill: ${state}`);
+  console.log(`  installed: ${marker}`);
+  console.log(`  current:   ${status.currentVersion}`);
+  console.log(`  path:      ${status.canonicalPath}`);
+});
 var connection = program.command("connection").description("Manage connections");
 connection.command("add [platform]").alias("a").description("Add a new connection").action(async (platform) => {
   await connectionAddCommand(platform);
@@ -4815,7 +4465,7 @@ actions.command("execute <platform> <actionId> <connectionKey>").alias("x").desc
   });
 });
 var flow = program.command("flow").alias("f").description("Create, execute, and manage multi-step workflows");
-flow.command("create [key]").description("Create a new workflow from JSON definition").option("--definition <json>", "Workflow definition as JSON string").option("-o, --output <path>", "Custom output path (default .one/flows/<key>.flow.json)").action(async (key, options) => {
+flow.command("create [key]").description("Create a new workflow from JSON definition").option("--definition <json>", "Workflow definition as JSON string").option("-o, --output <path>", "Custom output path (default .one/flows/<key>/flow.json)").action(async (key, options) => {
   await flowCreateCommand(key, options);
 });
 flow.command("execute <keyOrPath>").alias("x").description("Execute a workflow by key or file path").option("-i, --input <name=value>", "Input parameter (repeatable)", collect, []).option("--dry-run", "Validate and show execution plan without running").option("--mock", "With --dry-run: execute transforms/code with mock API responses").option("--allow-bash", "Allow bash step execution (disabled by default for security)").option("-v, --verbose", "Show full request/response for each step").action(async (keyOrPath, options) => {