@withone/cli 1.21.0 → 1.23.0

package/dist/index.js

@@ -16,7 +16,7 @@ import {
   loadFlowWithMeta,
   resolveFlowPath,
   saveFlow
-} from "./chunk-KZOFPEHD.js";
+} from "./chunk-Z45IBT5P.js";
 
 // src/index.ts
 import { createRequire as createRequire2 } from "module";
@@ -25,10 +25,10 @@ import { Command } from "commander";
 // src/commands/init.ts
 import * as p3 from "@clack/prompts";
 import pc2 from "picocolors";
-import fs3 from "fs";
-import path3 from "path";
-import os3 from "os";
-import { fileURLToPath } from "url";
+import fs4 from "fs";
+import path4 from "path";
+import os4 from "os";
+import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/lib/config.ts
 import fs from "fs";
@@ -53,11 +53,11 @@ function readConfig() {
     return null;
   }
 }
-function writeConfig(config) {
+function writeConfig(config2) {
   if (!fs.existsSync(CONFIG_DIR)) {
     fs.mkdirSync(CONFIG_DIR, { mode: 448 });
   }
-  fs.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2), { mode: 384 });
+  fs.writeFileSync(CONFIG_FILE, JSON.stringify(config2, null, 2), { mode: 384 });
 }
 function readOneRc() {
   const rcPath = path.join(process.cwd(), ".onerc");
@@ -108,32 +108,32 @@ function getAccessControl() {
 }
 var DEFAULT_API_BASE = "https://api.withone.ai/v1";
 function getApiBase() {
-  const config = readConfig();
-  if (config?.apiBase) return `${config.apiBase}/v1`;
+  const config2 = readConfig();
+  if (config2?.apiBase) return `${config2.apiBase}/v1`;
   return DEFAULT_API_BASE;
 }
 function updateApiBase(url) {
-  const config = readConfig();
-  if (!config) return;
+  const config2 = readConfig();
+  if (!config2) return;
   if (url) {
-    config.apiBase = url;
+    config2.apiBase = url;
   } else {
-    delete config.apiBase;
+    delete config2.apiBase;
   }
-  writeConfig(config);
+  writeConfig(config2);
 }
 function getCacheTtl() {
   if (process.env.ONE_CACHE_TTL) {
     const val = parseInt(process.env.ONE_CACHE_TTL, 10);
     if (!isNaN(val) && val > 0) return val;
   }
-  const config = readConfig();
-  if (config?.cacheTtl && config.cacheTtl > 0) return config.cacheTtl;
+  const config2 = readConfig();
+  if (config2?.cacheTtl && config2.cacheTtl > 0) return config2.cacheTtl;
   return 3600;
 }
 function updateAccessControl(settings) {
-  const config = readConfig();
-  if (!config) return;
+  const config2 = readConfig();
+  if (!config2) return;
   const cleaned = {};
   if (settings.permissions && settings.permissions !== "admin") {
     cleaned.permissions = settings.permissions;
@@ -148,11 +148,11 @@ function updateAccessControl(settings) {
     cleaned.knowledgeAgent = true;
   }
   if (Object.keys(cleaned).length === 0) {
-    delete config.accessControl;
+    delete config2.accessControl;
   } else {
-    config.accessControl = cleaned;
+    config2.accessControl = cleaned;
   }
-  writeConfig(config);
+  writeConfig(config2);
 }
 
 // src/lib/agents.ts
@@ -274,16 +274,16 @@ function readAgentConfig(agent, scope = "global") {
     return {};
   }
 }
-function writeAgentConfig(agent, config, scope = "global") {
+function writeAgentConfig(agent, config2, scope = "global") {
   const configPath = getAgentConfigPath(agent, scope);
   const configDir = path2.dirname(configPath);
   if (!fs2.existsSync(configDir)) {
     fs2.mkdirSync(configDir, { recursive: true });
   }
   if (agent.configFormat === "toml") {
-    fs2.writeFileSync(configPath, stringifyToml(config));
+    fs2.writeFileSync(configPath, stringifyToml(config2));
   } else {
-    fs2.writeFileSync(configPath, JSON.stringify(config, null, 2));
+    fs2.writeFileSync(configPath, JSON.stringify(config2, null, 2));
   }
 }
 function getMcpServerConfig(apiKey, accessControl) {
@@ -311,17 +311,17 @@ function getMcpServerConfig(apiKey, accessControl) {
   };
 }
 function installMcpConfig(agent, apiKey, scope = "global", accessControl) {
-  const config = readAgentConfig(agent, scope);
+  const config2 = readAgentConfig(agent, scope);
   const configKey = agent.configKey;
-  const mcpServers = config[configKey] || {};
+  const mcpServers = config2[configKey] || {};
   mcpServers["one"] = getMcpServerConfig(apiKey, accessControl);
-  config[configKey] = mcpServers;
-  writeAgentConfig(agent, config, scope);
+  config2[configKey] = mcpServers;
+  writeAgentConfig(agent, config2, scope);
 }
 function isMcpInstalled(agent, scope = "global") {
-  const config = readAgentConfig(agent, scope);
+  const config2 = readAgentConfig(agent, scope);
   const configKey = agent.configKey;
-  const mcpServers = config[configKey];
+  const mcpServers = config2[configKey];
   return mcpServers?.["one"] !== void 0;
 }
 function getAgentStatuses() {
@@ -397,8 +397,8 @@ async function configCommand() {
   if (isAgentMode()) {
     error("This command requires interactive input. Run without --agent.");
   }
-  const config = readConfig();
-  if (!config) {
+  const config2 = readConfig();
+  if (!config2) {
     p2.log.error(`No One config found. Run ${pc.cyan("one init")} first.`);
     return;
   }
@@ -439,7 +439,7 @@ async function configCommand() {
   }
   let connectionKeys;
   if (connectionMode === "specific") {
-    connectionKeys = await selectConnections(config.apiKey);
+    connectionKeys = await selectConnections(config2.apiKey);
     if (connectionKeys === void 0) {
       p2.outro("No changes made.");
       return;
@@ -500,7 +500,7 @@ async function configCommand() {
     p2.outro("No changes made.");
     return;
   }
-  let newApiKey = config.apiKey;
+  let newApiKey = config2.apiKey;
   if (baseUrlMode === "custom") {
     const customUrl = await p2.text({
       message: "Enter API base URL:",
@@ -601,7 +601,7 @@ async function configCommand() {
   };
   updateAccessControl(settings);
   const updatedConfig = readConfig();
-  if (updatedConfig && newApiKey !== config.apiKey) {
+  if (updatedConfig && newApiKey !== config2.apiKey) {
     updatedConfig.apiKey = newApiKey;
     writeConfig(updatedConfig);
   }
@@ -667,6 +667,214 @@ function formatList(list) {
 
 // src/commands/init.ts
 import open2 from "open";
+
+// src/lib/skill-sync.ts
+import fs3 from "fs";
+import os3 from "os";
+import path3 from "path";
+import { fileURLToPath } from "url";
+
+// src/commands/update.ts
+import { createRequire } from "module";
+import { spawn } from "child_process";
+import { readFileSync, writeFileSync, mkdirSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+var require2 = createRequire(import.meta.url);
+var { version: currentVersion } = require2("../package.json");
+var CACHE_PATH = join(homedir(), ".one", "update-check.json");
+var CHECK_INTERVAL_MS = 4 * 60 * 60 * 1e3;
+var AGE_GATE_MS = 30 * 60 * 1e3;
+async function fetchLatestVersionInfo() {
+  try {
+    const res = await fetch("https://registry.npmjs.org/@withone/cli");
+    if (!res.ok) return null;
+    const data = await res.json();
+    const latest = data["dist-tags"]?.latest;
+    if (!latest) return null;
+    return { version: latest, publishedAt: data.time?.[latest] ?? null };
+  } catch {
+    return null;
+  }
+}
+function readCache() {
+  try {
+    return JSON.parse(readFileSync(CACHE_PATH, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function writeCache(latestVersion, publishedAt) {
+  try {
+    mkdirSync(join(homedir(), ".one"), { recursive: true });
+    writeFileSync(CACHE_PATH, JSON.stringify({ lastCheck: Date.now(), latestVersion, publishedAt }));
+  } catch {
+  }
+}
+async function checkLatestVersion() {
+  const info = await fetchLatestVersionInfo();
+  if (info) writeCache(info.version, info.publishedAt);
+  return info?.version ?? null;
+}
+async function checkLatestVersionCached() {
+  const cache2 = readCache();
+  if (cache2 && Date.now() - cache2.lastCheck < CHECK_INTERVAL_MS) {
+    return { version: cache2.latestVersion, publishedAt: cache2.publishedAt ?? null };
+  }
+  const info = await fetchLatestVersionInfo();
+  if (info) writeCache(info.version, info.publishedAt);
+  return info;
+}
+function getCurrentVersion() {
+  return currentVersion;
+}
+async function updateCommand() {
+  const s = createSpinner();
+  s.start("Checking for updates...");
+  const latestVersion = await checkLatestVersion();
+  if (!latestVersion) {
+    s.stop("");
+    error("Failed to check for updates \u2014 could not reach npm registry");
+  }
+  if (currentVersion === latestVersion) {
+    s.stop("Already up to date");
+    if (isAgentMode()) {
+      json({ current: currentVersion, latest: latestVersion, updated: false, message: "Already up to date" });
+    } else {
+      console.log(`Already up to date (v${currentVersion})`);
+    }
+    return;
+  }
+  s.stop(`Update available: v${currentVersion} \u2192 v${latestVersion}`);
+  console.log(`Updating @withone/cli: v${currentVersion} \u2192 v${latestVersion}...`);
+  const code = await new Promise((resolve) => {
+    const child = spawn("npm", ["install", "-g", "@withone/cli@latest", "--force"], {
+      stdio: isAgentMode() ? "pipe" : "inherit",
+      shell: true
+    });
+    child.on("close", resolve);
+    child.on("error", () => resolve(1));
+  });
+  if (code === 0) {
+    if (isAgentMode()) {
+      json({ current: currentVersion, latest: latestVersion, updated: true, message: "Updated successfully" });
+    } else {
+      console.log(`Successfully updated to v${latestVersion}`);
+    }
+  } else {
+    error("Update failed \u2014 try running: npm install -g @withone/cli@latest");
+  }
+}
+function isNewerVersion(latest, current) {
+  const parse = (v) => v.split(".").map(Number);
+  const [lMaj, lMin, lPat] = parse(latest);
+  const [cMaj, cMin, cPat] = parse(current);
+  if (lMaj !== cMaj) return lMaj > cMaj;
+  if (lMin !== cMin) return lMin > cMin;
+  return lPat > cPat;
+}
+function autoUpdate(targetVersion, publishedAt) {
+  if (publishedAt) {
+    const age = Date.now() - new Date(publishedAt).getTime();
+    if (age < AGE_GATE_MS) return;
+  }
+  const child = spawn("npm", ["install", "-g", `@withone/cli@${targetVersion}`], {
+    detached: true,
+    stdio: "ignore",
+    shell: true
+  });
+  child.unref();
+}
+
+// src/lib/skill-sync.ts
+var CANONICAL_SKILL_DIR = ".agents/skills";
+var VERSION_MARKER = ".one-cli-version";
+function getPackagedSkillDir() {
+  const here = path3.dirname(fileURLToPath(import.meta.url));
+  return path3.resolve(here, "..", "skills", "one");
+}
+function getCanonicalSkillPath() {
+  return path3.join(os3.homedir(), CANONICAL_SKILL_DIR, "one");
+}
+function getVersionMarkerPath() {
+  return path3.join(getCanonicalSkillPath(), VERSION_MARKER);
+}
+function isSkillInstalled() {
+  return fs3.existsSync(path3.join(getCanonicalSkillPath(), "SKILL.md"));
+}
+function readInstalledSkillVersion() {
+  try {
+    return fs3.readFileSync(getVersionMarkerPath(), "utf-8").trim() || null;
+  } catch {
+    return null;
+  }
+}
+function writeInstalledSkillVersion(version2) {
+  try {
+    fs3.mkdirSync(getCanonicalSkillPath(), { recursive: true });
+    fs3.writeFileSync(getVersionMarkerPath(), `${version2}
+`);
+  } catch {
+  }
+}
+function copyDirSync(src, dest) {
+  fs3.mkdirSync(dest, { recursive: true });
+  for (const entry of fs3.readdirSync(src, { withFileTypes: true })) {
+    const srcPath = path3.join(src, entry.name);
+    const destPath = path3.join(dest, entry.name);
+    if (entry.isDirectory()) {
+      copyDirSync(srcPath, destPath);
+    } else {
+      fs3.copyFileSync(srcPath, destPath);
+    }
+  }
+}
+function syncSkillsIfStale() {
+  if (!isSkillInstalled()) {
+    return { synced: false, reason: "not-installed" };
+  }
+  const current = getCurrentVersion();
+  const installed = readInstalledSkillVersion();
+  if (installed === current) {
+    return { synced: false, reason: "up-to-date", from: installed, to: current };
+  }
+  return performSync(current, installed === null ? "missing-marker" : "stale");
+}
+function forceSyncSkills() {
+  if (!isSkillInstalled()) {
+    return { synced: false, reason: "not-installed" };
+  }
+  return performSync(getCurrentVersion(), "forced");
+}
+function performSync(current, reason) {
+  const source = getPackagedSkillDir();
+  if (!fs3.existsSync(path3.join(source, "SKILL.md"))) {
+    return { synced: false, reason: "source-missing" };
+  }
+  const canonical = getCanonicalSkillPath();
+  try {
+    copyDirSync(source, canonical);
+    writeInstalledSkillVersion(current);
+    return { synced: true, reason, from: readInstalledSkillVersion() ?? null, to: current };
+  } catch (err) {
+    return { synced: false, reason: "error", error: err instanceof Error ? err.message : String(err) };
+  }
+}
+function getSkillStatus() {
+  const installed = isSkillInstalled();
+  const installedVersion = readInstalledSkillVersion();
+  const currentVersion2 = getCurrentVersion();
+  return {
+    installed,
+    canonicalPath: getCanonicalSkillPath(),
+    installedVersion,
+    currentVersion: currentVersion2,
+    upToDate: installed && installedVersion === currentVersion2,
+    markerExists: installedVersion !== null
+  };
+}
+
+// src/commands/init.ts
 async function initCommand(options) {
   if (isAgentMode()) {
     error("This command requires interactive input. Run without --agent.");
@@ -682,7 +890,7 @@ async function initCommand(options) {
 async function handleExistingConfig(apiKey, options) {
   const statuses = getAgentStatuses();
   const masked = maskApiKey(apiKey);
-  const skillInstalled = isSkillInstalled();
+  const skillInstalled = isSkillInstalled2();
   console.log();
   console.log(`  ${pc2.bold("Current Setup")}`);
   console.log(`  ${pc2.dim("\u2500".repeat(42))}`);
@@ -818,12 +1026,12 @@ ${pc2.cyan(getApiKeyUrl())}`, "API Key");
       reinstalled.push(`${s.agent.name} (project)`);
     }
   }
-  const config = readConfig();
+  const config2 = readConfig();
   writeConfig({
     apiKey: newKey,
-    installedAgents: config?.installedAgents ?? [],
-    createdAt: config?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
-    accessControl: config?.accessControl
+    installedAgents: config2?.installedAgents ?? [],
+    createdAt: config2?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    accessControl: config2?.accessControl
   });
   if (reinstalled.length > 0) {
     p3.log.success(`Updated MCP configs: ${reinstalled.join(", ")}`);
@@ -842,48 +1050,49 @@ var SKILL_AGENTS = [
   { id: "opencode", name: "OpenCode", skillDir: ".opencode/skills" },
   { id: "roo", name: "Roo", skillDir: ".roo/skills" }
 ];
-var CANONICAL_SKILL_DIR = ".agents/skills";
+var CANONICAL_SKILL_DIR2 = ".agents/skills";
 function getSkillSourceDir() {
-  const __dirname2 = path3.dirname(fileURLToPath(import.meta.url));
-  return path3.resolve(__dirname2, "..", "skills", "one");
+  const __dirname2 = path4.dirname(fileURLToPath2(import.meta.url));
+  return path4.resolve(__dirname2, "..", "skills", "one");
 }
-function getCanonicalSkillPath() {
-  return path3.join(os3.homedir(), CANONICAL_SKILL_DIR, "one");
+function getCanonicalSkillPath2() {
+  return path4.join(os4.homedir(), CANONICAL_SKILL_DIR2, "one");
 }
 function getAgentSkillPath(agent) {
-  return path3.join(os3.homedir(), agent.skillDir, "one");
+  return path4.join(os4.homedir(), agent.skillDir, "one");
 }
-function isSkillInstalled() {
-  return fs3.existsSync(path3.join(getCanonicalSkillPath(), "SKILL.md"));
+function isSkillInstalled2() {
+  return fs4.existsSync(path4.join(getCanonicalSkillPath2(), "SKILL.md"));
 }
 function isSkillInstalledForAgent(agent) {
-  return fs3.existsSync(path3.join(getAgentSkillPath(agent), "SKILL.md"));
+  return fs4.existsSync(path4.join(getAgentSkillPath(agent), "SKILL.md"));
 }
-function copyDirSync(src, dest) {
-  fs3.mkdirSync(dest, { recursive: true });
-  for (const entry of fs3.readdirSync(src, { withFileTypes: true })) {
-    const srcPath = path3.join(src, entry.name);
-    const destPath = path3.join(dest, entry.name);
+function copyDirSync2(src, dest) {
+  fs4.mkdirSync(dest, { recursive: true });
+  for (const entry of fs4.readdirSync(src, { withFileTypes: true })) {
+    const srcPath = path4.join(src, entry.name);
+    const destPath = path4.join(dest, entry.name);
     if (entry.isDirectory()) {
-      copyDirSync(srcPath, destPath);
+      copyDirSync2(srcPath, destPath);
     } else {
-      fs3.copyFileSync(srcPath, destPath);
+      fs4.copyFileSync(srcPath, destPath);
     }
   }
 }
 function installSkillForAgents(agentIds) {
   const source = getSkillSourceDir();
-  const canonical = getCanonicalSkillPath();
+  const canonical = getCanonicalSkillPath2();
   const installed = [];
   const failed = [];
-  if (!fs3.existsSync(path3.join(source, "SKILL.md"))) {
+  if (!fs4.existsSync(path4.join(source, "SKILL.md"))) {
     return { installed: [], failed: ["skill source not found"] };
   }
   try {
-    if (fs3.existsSync(canonical)) {
-      fs3.rmSync(canonical, { recursive: true });
+    if (fs4.existsSync(canonical)) {
+      fs4.rmSync(canonical, { recursive: true });
     }
-    copyDirSync(source, canonical);
+    copyDirSync2(source, canonical);
+    writeInstalledSkillVersion(getCurrentVersion());
   } catch {
     return { installed: [], failed: ["canonical copy"] };
   }
@@ -897,15 +1106,15 @@ function installSkillForAgents(agentIds) {
       continue;
     }
     try {
-      const agentSkillsDir = path3.dirname(agentPath);
-      fs3.mkdirSync(agentSkillsDir, { recursive: true });
+      const agentSkillsDir = path4.dirname(agentPath);
+      fs4.mkdirSync(agentSkillsDir, { recursive: true });
       try {
-        fs3.lstatSync(agentPath);
-        fs3.rmSync(agentPath, { recursive: true });
+        fs4.lstatSync(agentPath);
+        fs4.rmSync(agentPath, { recursive: true });
       } catch {
       }
-      const relative = path3.relative(agentSkillsDir, canonical);
-      fs3.symlinkSync(relative, agentPath);
+      const relative = path4.relative(agentSkillsDir, canonical);
+      fs4.symlinkSync(relative, agentPath);
       installed.push(agent.name);
       seen.set(agentPath, true);
     } catch {
@@ -1553,35 +1762,35 @@ import * as p6 from "@clack/prompts";
 import pc6 from "picocolors";
 
 // src/lib/cache.ts
-import fs4 from "fs";
-import path4 from "path";
-import os4 from "os";
-var CACHE_BASE = path4.join(os4.homedir(), ".one", "cache");
-var KNOWLEDGE_DIR = path4.join(CACHE_BASE, "knowledge");
-var SEARCH_DIR = path4.join(CACHE_BASE, "search");
+import fs5 from "fs";
+import path5 from "path";
+import os5 from "os";
+var CACHE_BASE = path5.join(os5.homedir(), ".one", "cache");
+var KNOWLEDGE_DIR = path5.join(CACHE_BASE, "knowledge");
+var SEARCH_DIR = path5.join(CACHE_BASE, "search");
 function sanitizeFilename(input) {
   return input.replace(/[^a-zA-Z0-9_\-\.]/g, "_");
 }
 function knowledgeCachePath(actionId) {
-  return path4.join(KNOWLEDGE_DIR, `${sanitizeFilename(actionId)}.json`);
+  return path5.join(KNOWLEDGE_DIR, `${sanitizeFilename(actionId)}.json`);
 }
 function searchCachePath(platform, query, type) {
   const key = `${platform}_${sanitizeFilename(query)}_${type || "knowledge"}`;
-  return path4.join(SEARCH_DIR, `${key}.json`);
+  return path5.join(SEARCH_DIR, `${key}.json`);
 }
-function readCache(filePath) {
+function readCache2(filePath) {
   try {
-    const content = fs4.readFileSync(filePath, "utf-8");
+    const content = fs5.readFileSync(filePath, "utf-8");
     return JSON.parse(content);
   } catch {
     return null;
   }
 }
-function writeCache(filePath, entry) {
+function writeCache2(filePath, entry) {
   try {
-    const dir = path4.dirname(filePath);
-    fs4.mkdirSync(dir, { recursive: true });
-    fs4.writeFileSync(filePath, JSON.stringify(entry, null, 2));
+    const dir = path5.dirname(filePath);
+    fs5.mkdirSync(dir, { recursive: true });
+    fs5.writeFileSync(filePath, JSON.stringify(entry, null, 2));
   } catch {
   }
 }
@@ -1619,11 +1828,11 @@ function listCacheEntries() {
   const entries = [];
   for (const [dir, type] of [[KNOWLEDGE_DIR, "knowledge"], [SEARCH_DIR, "search"]]) {
     try {
-      const files = fs4.readdirSync(dir);
+      const files = fs5.readdirSync(dir);
       for (const file of files) {
         if (!file.endsWith(".json")) continue;
-        const filePath = path4.join(dir, file);
-        const entry = readCache(filePath);
+        const filePath = path5.join(dir, file);
+        const entry = readCache2(filePath);
         if (entry) {
           entries.push({ type, filePath, entry });
         }
@@ -1637,12 +1846,12 @@ function clearAll() {
   let count = 0;
   for (const dir of [KNOWLEDGE_DIR, SEARCH_DIR]) {
     try {
-      const files = fs4.readdirSync(dir);
+      const files = fs5.readdirSync(dir);
       for (const file of files) {
-        fs4.unlinkSync(path4.join(dir, file));
+        fs5.unlinkSync(path5.join(dir, file));
         count++;
       }
-      fs4.rmdirSync(dir);
+      fs5.rmdirSync(dir);
     } catch {
     }
   }
@@ -1651,7 +1860,7 @@ function clearAll() {
 function clearEntry(actionId) {
   const filePath = knowledgeCachePath(actionId);
   try {
-    fs4.unlinkSync(filePath);
+    fs5.unlinkSync(filePath);
     return true;
   } catch {
     return false;
@@ -1697,7 +1906,7 @@ async function actionsSearchCommand(platform, query, options) {
     const agentType = knowledgeAgent ? "knowledge" : options.type || "execute";
     const useCache = options.cache !== false;
     const cachePath = searchCachePath(platform, query, agentType || "knowledge");
-    const cached = useCache ? readCache(cachePath) : null;
+    const cached = useCache ? readCache2(cachePath) : null;
     let cleanedActions;
     let cacheHit = false;
     if (cached && isFresh(cached)) {
@@ -1713,7 +1922,7 @@ async function actionsSearchCommand(platform, query, options) {
         );
         if (result.status === 304 && cached) {
           cached.cachedAt = (/* @__PURE__ */ new Date()).toISOString();
-          writeCache(cachePath, cached);
+          writeCache2(cachePath, cached);
           cleanedActions = cached.data.actions;
           cacheHit = true;
         } else {
@@ -1726,7 +1935,7 @@ async function actionsSearchCommand(platform, query, options) {
             method: action.method,
             path: action.path
           }));
-          writeCache(cachePath, makeCacheEntry(
+          writeCache2(cachePath, makeCacheEntry(
             `${platform}_${query}_${agentType || "knowledge"}`,
             { actions: cleanedActions },
             result.etag
@@ -1750,7 +1959,7 @@ async function actionsSearchCommand(platform, query, options) {
       if (cacheHit && cached) {
         response._cache = buildCacheMeta(cached, true);
       } else {
-        const freshEntry = readCache(cachePath);
+        const freshEntry = readCache2(cachePath);
         response._cache = buildCacheMeta(freshEntry, false);
       }
       json(response);
@@ -1810,7 +2019,7 @@ Execute:     ${pc6.cyan(`one actions execute ${platform} <actionId> <connectionK
 async function actionsKnowledgeCommand(platform, actionId, options) {
   const cachePath = knowledgeCachePath(actionId);
   if (options.cacheStatus) {
-    const entry = readCache(cachePath);
+    const entry = readCache2(cachePath);
     if (!entry) {
       json({
         cached: false,
@@ -1858,7 +2067,7 @@ async function actionsKnowledgeCommand(platform, actionId, options) {
   spinner5.start(`Loading knowledge for action ${pc6.dim(actionId)}...`);
   try {
     const useCache = options.cache !== false;
-    const cached = useCache ? readCache(cachePath) : null;
+    const cached = useCache ? readCache2(cachePath) : null;
     let knowledgeData;
     let cacheHit = false;
     let cacheEntry = cached;
@@ -1873,13 +2082,13 @@ async function actionsKnowledgeCommand(platform, actionId, options) {
         );
         if (result.status === 304 && cached) {
           cached.cachedAt = (/* @__PURE__ */ new Date()).toISOString();
-          writeCache(cachePath, cached);
+          writeCache2(cachePath, cached);
           knowledgeData = cached.data;
           cacheHit = true;
         } else {
           knowledgeData = result.data;
           const newEntry = makeCacheEntry(actionId, knowledgeData, result.etag);
-          writeCache(cachePath, newEntry);
+          writeCache2(cachePath, newEntry);
           cacheEntry = newEntry;
         }
       } catch (fetchError) {
@@ -2034,6 +2243,9 @@ function colorMethod(method) {
 import pc7 from "picocolors";
 
 // src/lib/flow-validator.ts
+import fs6 from "fs";
+import path6 from "path";
+import { spawnSync } from "child_process";
 function validateFlowSchema(flow2) {
   const errors = [];
   if (!flow2 || typeof flow2 !== "object") {
@@ -2092,26 +2304,26 @@ function validateStepsArray(steps, pathPrefix, errors) {
   const validTypes = FLOW_SCHEMA.stepTypes.map((st) => st.type);
   for (let i = 0; i < steps.length; i++) {
     const step = steps[i];
-    const path5 = `${pathPrefix}[${i}]`;
+    const path8 = `${pathPrefix}[${i}]`;
     if (!step || typeof step !== "object" || Array.isArray(step)) {
-      errors.push({ path: path5, message: "Step must be an object" });
+      errors.push({ path: path8, message: "Step must be an object" });
       continue;
     }
     const s = step;
     if (!s.id || typeof s.id !== "string") {
-      errors.push({ path: `${path5}.id`, message: 'Step must have a string "id"' });
+      errors.push({ path: `${path8}.id`, message: 'Step must have a string "id"' });
     }
     if (!s.name || typeof s.name !== "string") {
-      errors.push({ path: `${path5}.name`, message: 'Step must have a string "name"' });
+      errors.push({ path: `${path8}.name`, message: 'Step must have a string "name"' });
     }
     if (!s.type || !validTypes.includes(s.type)) {
-      errors.push({ path: `${path5}.type`, message: `Step type must be one of: ${validTypes.join(", ")}` });
+      errors.push({ path: `${path8}.type`, message: `Step type must be one of: ${validTypes.join(", ")}` });
       continue;
     }
     if (s.onError && typeof s.onError === "object") {
       const oe = s.onError;
       if (!FLOW_SCHEMA.errorStrategies.includes(oe.strategy)) {
-        errors.push({ path: `${path5}.onError.strategy`, message: `Error strategy must be one of: ${FLOW_SCHEMA.errorStrategies.join(", ")}` });
+        errors.push({ path: `${path8}.onError.strategy`, message: `Error strategy must be one of: ${FLOW_SCHEMA.errorStrategies.join(", ")}` });
       }
     }
     const descriptor = getStepTypeDescriptor(s.type);
@@ -2121,15 +2333,15 @@ function validateStepsArray(steps, pathPrefix, errors) {
     if (!configObj || typeof configObj !== "object") {
       const hint = detectFlatConfigHint(s, descriptor);
       errors.push({
-        path: `${path5}.${configKey}`,
+        path: `${path8}.${configKey}`,
         message: `${capitalize(descriptor.type)} step must have a "${configKey}" config object${hint}`
       });
       continue;
     }
-    const config = configObj;
+    const config2 = configObj;
     for (const [fieldName, fd] of Object.entries(descriptor.fields)) {
-      const fieldPath = `${path5}.${configKey}.${fieldName}`;
-      const value = config[fieldName];
+      const fieldPath = `${path8}.${configKey}.${fieldName}`;
+      const value = config2[fieldName];
       if (fd.required && (value === void 0 || value === null || value === "")) {
         errors.push({ path: fieldPath, message: `${capitalize(descriptor.type)} must have ${fd.type === "string" ? "a string" : fd.type === "array" ? "a" : "a"} "${fieldName}"` });
         continue;
@@ -2161,21 +2373,27 @@ function validateStepsArray(steps, pathPrefix, errors) {
       }
     }
     if (descriptor.type === "code") {
-      const hasSource = typeof config.source === "string" && config.source.length > 0;
-      const hasModule = typeof config.module === "string" && config.module.length > 0;
+      const hasSource = typeof config2.source === "string" && config2.source.length > 0;
+      const hasModule = typeof config2.module === "string" && config2.module.length > 0;
       if (!hasSource && !hasModule) {
-        errors.push({ path: `${path5}.${configKey}`, message: 'Code step must define either "source" (inline JS) or "module" (path to .mjs file)' });
+        errors.push({ path: `${path8}.${configKey}`, message: 'Code step must define either "source" (inline JS) or "module" (path to .mjs file)' });
       } else if (hasSource && hasModule) {
-        errors.push({ path: `${path5}.${configKey}`, message: 'Code step cannot define both "source" and "module" \u2014 pick one' });
+        errors.push({ path: `${path8}.${configKey}`, message: 'Code step cannot define both "source" and "module" \u2014 pick one' });
       }
       if (hasModule) {
-        const m = config.module;
+        const m = config2.module;
         if (m.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(m)) {
-          errors.push({ path: `${path5}.${configKey}.module`, message: "Code module path must be relative to the flow folder (no absolute paths)" });
+          errors.push({ path: `${path8}.${configKey}.module`, message: "Code module path must be relative to the flow folder (no absolute paths)" });
         } else if (m.split(/[\\/]/).includes("..")) {
-          errors.push({ path: `${path5}.${configKey}.module`, message: 'Code module path must not escape the flow folder ("..")' });
+          errors.push({ path: `${path8}.${configKey}.module`, message: 'Code module path must not escape the flow folder ("..")' });
         } else if (!m.endsWith(".mjs")) {
-          errors.push({ path: `${path5}.${configKey}.module`, message: "Code module must be a .mjs file" });
+          errors.push({ path: `${path8}.${configKey}.module`, message: "Code module must be a .mjs file" });
+        }
+      }
+      if (hasSource) {
+        const syntaxError = checkCodeSourceSyntax(config2.source);
+        if (syntaxError) {
+          errors.push({ path: `${path8}.${configKey}.source`, message: `Syntax error in code step: ${syntaxError}` });
         }
       }
     }
@@ -2192,6 +2410,17 @@ function detectFlatConfigHint(step, descriptor) {
 function capitalize(s) {
   return s.charAt(0).toUpperCase() + s.slice(1);
 }
+var AsyncFunctionCtor = Object.getPrototypeOf(async function() {
+}).constructor;
+function checkCodeSourceSyntax(source) {
+  try {
+    new AsyncFunctionCtor("$", "require", source);
+    return null;
+  } catch (err) {
+    if (err instanceof SyntaxError) return err.message;
+    return err.message;
+  }
+}
 function validateStepIds(flow2) {
   const errors = [];
   const seen = /* @__PURE__ */ new Set();
@@ -2199,16 +2428,16 @@ function validateStepIds(flow2) {
   function collectIds(steps, pathPrefix) {
     for (let i = 0; i < steps.length; i++) {
       const step = steps[i];
-      const path5 = `${pathPrefix}[${i}]`;
+      const path8 = `${pathPrefix}[${i}]`;
       if (seen.has(step.id)) {
-        errors.push({ path: `${path5}.id`, message: `Duplicate step ID: "${step.id}"` });
+        errors.push({ path: `${path8}.id`, message: `Duplicate step ID: "${step.id}"` });
       } else {
         seen.add(step.id);
       }
       for (const { configKey, fieldName } of nestedKeys) {
-        const config = step[configKey];
-        if (config && Array.isArray(config[fieldName])) {
-          collectIds(config[fieldName], `${path5}.${configKey}.${fieldName}`);
+        const config2 = step[configKey];
+        if (config2 && Array.isArray(config2[fieldName])) {
+          collectIds(config2[fieldName], `${path8}.${configKey}.${fieldName}`);
         }
       }
     }
@@ -2225,9 +2454,9 @@ function validateSelectorReferences(flow2) {
     for (const step of steps) {
       ids.add(step.id);
       for (const { configKey, fieldName } of nestedKeys) {
-        const config = step[configKey];
-        if (config && Array.isArray(config[fieldName])) {
-          for (const id of getAllStepIds(config[fieldName])) ids.add(id);
+        const config2 = step[configKey];
+        if (config2 && Array.isArray(config2[fieldName])) {
+          for (const id of getAllStepIds(config2[fieldName])) ids.add(id);
         }
       }
     }
@@ -2256,7 +2485,7 @@ function validateSelectorReferences(flow2) {
     }
     return selectors;
   }
-  function checkSelectors(selectors, path5) {
+  function checkSelectors(selectors, path8, precedingStepIds) {
     for (const selector of selectors) {
       const parts = selector.split(".");
       if (parts.length < 3) continue;
@@ -2264,83 +2493,142 @@ function validateSelectorReferences(flow2) {
       if (root === "input") {
         const inputName = parts[2];
         if (!inputNames.has(inputName)) {
-          errors.push({ path: path5, message: `Selector "${selector}" references undefined input "${inputName}"` });
+          errors.push({ path: path8, message: `Selector "${selector}" references undefined input "${inputName}"` });
         }
       } else if (root === "steps") {
-        const stepId = parts[2];
+        const stepId = parts[2].replace(/[\[\]]/g, "").split(/[\[\]]/)[0];
         if (!allStepIds.has(stepId)) {
-          errors.push({ path: path5, message: `Selector "${selector}" references undefined step "${stepId}"` });
+          errors.push({ path: path8, message: `Selector "${selector}" references undefined step "${stepId}"` });
+        } else if (precedingStepIds && !precedingStepIds.has(stepId)) {
+          errors.push({
+            path: path8,
+            message: `Selector "${selector}" references step "${stepId}" which is declared after the current step. Steps execute in declaration order, so this will always resolve to undefined at runtime \u2014 move the dependency earlier in the steps array.`
+          });
         }
       }
     }
   }
   const EXPRESSION_FIELDS = /* @__PURE__ */ new Set(["condition.expression", "while.condition"]);
-  function checkOperatorsInSelectorField(value, path5) {
+  function checkOperatorsInSelectorField(value, path8) {
     if (typeof value === "string" && value.startsWith("$.")) {
       if (value.includes("||")) {
-        errors.push({ path: path5, message: `Selector "${value}" contains unsupported operator "||". Selectors in data fields use dot-path resolution, not JS evaluation. Use the "default" field on the input definition instead, or use a "code" step for complex expressions.` });
+        errors.push({ path: path8, message: `Selector "${value}" contains unsupported operator "||". Selectors in data fields use dot-path resolution, not JS evaluation. Use the "default" field on the input definition instead, or use a "code" step for complex expressions.` });
       } else if (value.includes("&&")) {
-        errors.push({ path: path5, message: `Selector "${value}" contains unsupported operator "&&". Selectors in data fields use dot-path resolution, not JS evaluation. Use a "condition" step or "code" step for complex expressions.` });
+        errors.push({ path: path8, message: `Selector "${value}" contains unsupported operator "&&". Selectors in data fields use dot-path resolution, not JS evaluation. Use a "condition" step or "code" step for complex expressions.` });
       }
     } else if (value && typeof value === "object" && !Array.isArray(value)) {
       for (const [k, v] of Object.entries(value)) {
-        checkOperatorsInSelectorField(v, `${path5}.${k}`);
+        checkOperatorsInSelectorField(v, `${path8}.${k}`);
       }
     } else if (Array.isArray(value)) {
       for (let i = 0; i < value.length; i++) {
-        checkOperatorsInSelectorField(value[i], `${path5}[${i}]`);
+        checkOperatorsInSelectorField(value[i], `${path8}[${i}]`);
       }
     }
   }
-  function checkStep(step, pathPrefix) {
-    if (step.if) checkSelectors(extractSelectors(step.if), `${pathPrefix}.if`);
-    if (step.unless) checkSelectors(extractSelectors(step.unless), `${pathPrefix}.unless`);
+  function checkStep(step, pathPrefix, preceding2) {
+    if (step.if) checkSelectors(extractSelectors(step.if), `${pathPrefix}.if`, preceding2);
+    if (step.unless) checkSelectors(extractSelectors(step.unless), `${pathPrefix}.unless`, preceding2);
     const descriptor = getStepTypeDescriptor(step.type);
     if (descriptor) {
-      const config = step[descriptor.configKey];
-      if (config && typeof config === "object") {
+      const config2 = step[descriptor.configKey];
+      if (config2 && typeof config2 === "object") {
         if (step.type !== "transform" && step.type !== "code") {
           for (const [fieldName, fd] of Object.entries(descriptor.fields)) {
             if (fd.stepsArray) continue;
-            const value = config[fieldName];
+            const value = config2[fieldName];
             if (value !== void 0) {
               const fieldKey = `${descriptor.configKey}.${fieldName}`;
               const fieldPath = `${pathPrefix}.${fieldKey}`;
-              checkSelectors(extractSelectors(value), fieldPath);
+              checkSelectors(extractSelectors(value), fieldPath, preceding2);
               if (!EXPRESSION_FIELDS.has(fieldKey)) {
                 checkOperatorsInSelectorField(value, fieldPath);
               }
             }
           }
+        } else {
+          const c = config2;
+          const codeSource = step.type === "code" ? c.source : void 0;
+          const transformExpr = step.type === "transform" ? c.expression : void 0;
+          const text4 = codeSource ?? transformExpr;
+          if (typeof text4 === "string") {
+            const fieldName = step.type === "code" ? "source" : "expression";
+            checkSelectors(extractSelectors(text4), `${pathPrefix}.${descriptor.configKey}.${fieldName}`, preceding2);
+          }
         }
       }
       for (const { configKey, fieldName } of nestedKeys) {
         if (configKey === descriptor.configKey) {
           const c = step[configKey];
           if (c && Array.isArray(c[fieldName])) {
-            c[fieldName].forEach(
-              (s, i) => checkStep(s, `${pathPrefix}.${configKey}.${fieldName}[${i}]`)
-            );
+            const childPreceding = new Set(preceding2);
+            c[fieldName].forEach((s, i) => {
+              checkStep(s, `${pathPrefix}.${configKey}.${fieldName}[${i}]`, childPreceding);
+              childPreceding.add(s.id);
+            });
           }
         }
       }
     }
   }
-  flow2.steps.forEach((step, i) => checkStep(step, `steps[${i}]`));
+  const preceding = /* @__PURE__ */ new Set();
+  flow2.steps.forEach((step, i) => {
+    checkStep(step, `steps[${i}]`, preceding);
+    preceding.add(step.id);
+  });
   return errors;
 }
-function validateFlow(flow2) {
+function validateFlow(flow2, rootDir) {
   const schemaErrors = validateFlowSchema(flow2);
   if (schemaErrors.length > 0) return schemaErrors;
   const f = flow2;
   return [
     ...validateStepIds(f),
-    ...validateSelectorReferences(f)
+    ...validateSelectorReferences(f),
+    ...rootDir ? validateCodeModules(f, rootDir) : []
   ];
 }
+function validateCodeModules(flow2, rootDir) {
+  const errors = [];
+  const nestedKeys = getNestedStepsKeys();
+  function walk(steps, pathPrefix) {
+    for (let i = 0; i < steps.length; i++) {
+      const step = steps[i];
+      const stepPath = `${pathPrefix}[${i}]`;
+      if (step.type === "code" && step.code?.module) {
+        const m = step.code.module;
+        const abs = path6.resolve(rootDir, m);
+        if (!fs6.existsSync(abs)) {
+          errors.push({
+            path: `${stepPath}.code.module`,
+            message: `Code module "${m}" not found at ${abs}`
+          });
+        } else {
+          const res = spawnSync(process.execPath, ["--check", abs], { encoding: "utf-8" });
+          if (res.status !== 0) {
+            const msg = (res.stderr || "").split("\n").find((l) => l.includes("SyntaxError") || l.includes("Error")) || res.stderr || "Syntax check failed";
+            errors.push({
+              path: `${stepPath}.code.module`,
+              message: `Syntax error in code module "${m}": ${msg.trim()}`
+            });
+          }
+        }
+      }
+      for (const { configKey, fieldName } of nestedKeys) {
+        const config2 = step[configKey];
+        if (config2 && Array.isArray(config2[fieldName])) {
+          walk(config2[fieldName], `${stepPath}.${configKey}.${fieldName}`);
+        }
+      }
+    }
+  }
+  walk(flow2.steps, "steps");
+  return errors;
+}
 
 // src/commands/flow.ts
-import fs5 from "fs";
+import fs7 from "fs";
+import path7 from "path";
 function getConfig2() {
   const apiKey = getApiKey();
   if (!apiKey) {
@@ -2398,7 +2686,7 @@ async function flowCreateCommand(key, options) {
     if (raw.startsWith("@")) {
       const filePath = raw.slice(1);
       try {
-        raw = fs5.readFileSync(filePath, "utf-8");
+        raw = fs7.readFileSync(filePath, "utf-8");
       } catch (err) {
         error(`Cannot read file "${filePath}": ${err.message}`);
       }
@@ -2463,6 +2751,15 @@ async function flowExecuteCommand(keyOrPath, options) {
     return;
   }
   spinner5.stop(`Workflow: ${flow2.name} (${flow2.steps.length} steps)`);
+  const preflightErrors = validateFlow(flow2, rootDir);
+  if (preflightErrors.length > 0) {
+    if (isAgentMode()) {
+      json({ error: "Validation failed", errors: preflightErrors });
+      process.exit(1);
+    }
+    error(`Validation failed:
+${preflightErrors.map((e) => `  ${e.path}: ${e.message}`).join("\n")}`);
+  }
   if (flowFilePath.endsWith(".flow.json")) {
     const msg = `Workflow "${flow2.key}" uses the deprecated single-file layout. Migrate to .one/flows/${flow2.key}/flow.json (see: one guide flows).`;
     if (isAgentMode()) {
@@ -2603,15 +2900,23 @@ async function flowValidateCommand(keyOrPath) {
   const spinner5 = createSpinner();
   spinner5.start(`Validating "${keyOrPath}"...`);
   let flowData;
+  let rootDir;
   try {
-    const flowPath = resolveFlowPath(keyOrPath);
-    const content = fs5.readFileSync(flowPath, "utf-8");
-    flowData = JSON.parse(content);
+    try {
+      const loaded = loadFlowWithMeta(keyOrPath);
+      flowData = loaded.flow;
+      rootDir = loaded.rootDir;
+    } catch {
+      const flowPath = resolveFlowPath(keyOrPath);
+      const content = fs7.readFileSync(flowPath, "utf-8");
+      flowData = JSON.parse(content);
+      rootDir = path7.dirname(flowPath);
+    }
   } catch (err) {
     spinner5.stop("Validation failed");
     error(`Could not read workflow: ${err instanceof Error ? err.message : String(err)}`);
   }
-  const errors = validateFlow(flowData);
+  const errors = validateFlow(flowData, rootDir);
   if (errors.length > 0) {
     spinner5.stop("Validation failed");
     if (isAgentMode()) {
@@ -3363,11 +3668,11 @@ async function cacheUpdateAllCommand() {
       if (e.type === "knowledge") {
         const result = await api.getActionKnowledgeWithMeta(e.entry.key);
         const newEntry = makeCacheEntry(e.entry.key, result.data, result.etag);
-        writeCache(e.filePath, newEntry);
+        writeCache2(e.filePath, newEntry);
         updated++;
       } else {
         const refreshed = { ...e.entry, cachedAt: (/* @__PURE__ */ new Date()).toISOString() };
-        writeCache(e.filePath, refreshed);
+        writeCache2(e.filePath, refreshed);
         updated++;
       }
     } catch (err) {
@@ -3495,6 +3800,7 @@ Request specific sections:
 - Always use the **exact action ID** from search results \u2014 don't guess
 - Always read **knowledge** before executing any action
 - Connection keys come from \`one connection list\` \u2014 don't hardcode them
+- Skills stay in lockstep with the CLI version automatically \u2014 every command checks a \`.one-cli-version\` marker in the canonical skill dir and refreshes the files if the CLI has been upgraded. Check manually with \`one config skills status\`; force a resync with \`one config skills sync\`
 `;
 var GUIDE_ACTIONS = `# One Actions \u2014 Reference
 
@@ -4098,118 +4404,6 @@ function buildWorkflowIdeas(connections) {
   return lines.join("\n");
 }
 
-// src/commands/update.ts
-import { createRequire } from "module";
-import { spawn } from "child_process";
-import { readFileSync, writeFileSync, mkdirSync } from "fs";
-import { homedir } from "os";
-import { join } from "path";
-var require2 = createRequire(import.meta.url);
-var { version: currentVersion } = require2("../package.json");
-var CACHE_PATH = join(homedir(), ".one", "update-check.json");
-var CHECK_INTERVAL_MS = 4 * 60 * 60 * 1e3;
-var AGE_GATE_MS = 30 * 60 * 1e3;
-async function fetchLatestVersionInfo() {
-  try {
-    const res = await fetch("https://registry.npmjs.org/@withone/cli");
-    if (!res.ok) return null;
-    const data = await res.json();
-    const latest = data["dist-tags"]?.latest;
-    if (!latest) return null;
-    return { version: latest, publishedAt: data.time?.[latest] ?? null };
-  } catch {
-    return null;
-  }
-}
-function readCache3() {
-  try {
-    return JSON.parse(readFileSync(CACHE_PATH, "utf8"));
-  } catch {
-    return null;
-  }
-}
-function writeCache2(latestVersion, publishedAt) {
-  try {
-    mkdirSync(join(homedir(), ".one"), { recursive: true });
-    writeFileSync(CACHE_PATH, JSON.stringify({ lastCheck: Date.now(), latestVersion, publishedAt }));
-  } catch {
-  }
-}
-async function checkLatestVersion() {
-  const info = await fetchLatestVersionInfo();
-  if (info) writeCache2(info.version, info.publishedAt);
-  return info?.version ?? null;
-}
-async function checkLatestVersionCached() {
-  const cache2 = readCache3();
-  if (cache2 && Date.now() - cache2.lastCheck < CHECK_INTERVAL_MS) {
-    return { version: cache2.latestVersion, publishedAt: cache2.publishedAt ?? null };
-  }
-  const info = await fetchLatestVersionInfo();
-  if (info) writeCache2(info.version, info.publishedAt);
-  return info;
-}
-function getCurrentVersion() {
-  return currentVersion;
-}
-async function updateCommand() {
-  const s = createSpinner();
-  s.start("Checking for updates...");
-  const latestVersion = await checkLatestVersion();
-  if (!latestVersion) {
-    s.stop("");
-    error("Failed to check for updates \u2014 could not reach npm registry");
-  }
-  if (currentVersion === latestVersion) {
-    s.stop("Already up to date");
-    if (isAgentMode()) {
-      json({ current: currentVersion, latest: latestVersion, updated: false, message: "Already up to date" });
-    } else {
-      console.log(`Already up to date (v${currentVersion})`);
-    }
-    return;
-  }
-  s.stop(`Update available: v${currentVersion} \u2192 v${latestVersion}`);
-  console.log(`Updating @withone/cli: v${currentVersion} \u2192 v${latestVersion}...`);
-  const code = await new Promise((resolve) => {
-    const child = spawn("npm", ["install", "-g", "@withone/cli@latest", "--force"], {
-      stdio: isAgentMode() ? "pipe" : "inherit",
-      shell: true
-    });
-    child.on("close", resolve);
-    child.on("error", () => resolve(1));
-  });
-  if (code === 0) {
-    if (isAgentMode()) {
-      json({ current: currentVersion, latest: latestVersion, updated: true, message: "Updated successfully" });
-    } else {
-      console.log(`Successfully updated to v${latestVersion}`);
-    }
-  } else {
-    error("Update failed \u2014 try running: npm install -g @withone/cli@latest");
-  }
-}
-function isNewerVersion(latest, current) {
-  const parse = (v) => v.split(".").map(Number);
-  const [lMaj, lMin, lPat] = parse(latest);
-  const [cMaj, cMin, cPat] = parse(current);
-  if (lMaj !== cMaj) return lMaj > cMaj;
-  if (lMin !== cMin) return lMin > cMin;
-  return lPat > cPat;
-}
-function autoUpdate(targetVersion, publishedAt) {
-  if (publishedAt) {
-    const age = Date.now() - new Date(publishedAt).getTime();
-    if (age < AGE_GATE_MS) return;
-  }
-  const child = spawn("npm", ["install", "-g", `@withone/cli@${targetVersion}`], {
-    detached: true,
-    stdio: "ignore",
-    shell: true
-  });
-  child.unref();
-}
-
 // src/index.ts
 var require3 = createRequire2(import.meta.url);
 var { version } = require3("../package.json");
@@ -4275,6 +4469,12 @@ program.hook("preAction", (thisCommand) => {
   if (commandName !== "update") {
     updateCheckPromise = checkLatestVersionCached();
   }
+  if (commandName !== "init" && commandName !== "update") {
+    try {
+      syncSkillsIfStale();
+    } catch {
+    }
+  }
 });
 program.hook("postAction", async () => {
   if (!updateCheckPromise) return;
@@ -4287,9 +4487,48 @@ program.hook("postAction", async () => {
 program.command("init").description("Set up One and install MCP to your AI agents").option("-y, --yes", "Skip confirmations").option("-g, --global", "Install MCP globally (available in all projects)").option("-p, --project", "Install MCP for this project only (creates .mcp.json)").action(async (options) => {
   await initCommand(options);
 });
-program.command("config").description("Configure MCP access control (permissions, connections, actions)").action(async () => {
+var config = program.command("config").description("Configure the CLI (access control, skills, ...)").action(async () => {
   await configCommand();
 });
+var configSkills = config.command("skills").description("Manage locally-installed skill files");
+configSkills.command("sync").description("Re-copy packaged skill files over the local install (runs automatically after CLI upgrades)").action(async () => {
+  const result = forceSyncSkills();
+  if (isAgentMode()) {
+    json({ command: "config skills sync", ...result });
+    return;
+  }
+  if (result.reason === "not-installed") {
+    console.log("No skill is installed yet. Run 'one init' first and opt in to skill installation.");
+    return;
+  }
+  if (result.synced) {
+    console.log(`\u2713 Skills synced to v${result.to}`);
+    return;
+  }
+  if (result.reason === "source-missing") {
+    console.log("\u2717 Packaged skill source not found in this CLI build");
+    return;
+  }
+  console.log(`\u2717 Sync failed${result.error ? ": " + result.error : ""}`);
+});
+configSkills.command("status").description("Show installed skill version and whether it matches the current CLI").action(async () => {
+  const status = getSkillStatus();
+  if (isAgentMode()) {
+    json({ command: "config skills status", ...status });
+    return;
+  }
+  if (!status.installed) {
+    console.log("Skill is not installed. Run 'one init' to install it.");
+    console.log(`Canonical path (empty): ${status.canonicalPath}`);
+    return;
+  }
+  const marker = status.installedVersion ?? "(no marker \u2014 pre-sync install)";
+  const state = status.upToDate ? "\u2713 up to date" : "\u26A0 stale \u2014 will sync on next command";
+  console.log(`Skill: ${state}`);
+  console.log(`  installed: ${marker}`);
+  console.log(`  current:   ${status.currentVersion}`);
+  console.log(`  path:      ${status.canonicalPath}`);
+});
 var connection = program.command("connection").description("Manage connections");
 connection.command("add [platform]").alias("a").description("Add a new connection").action(async (platform) => {
   await connectionAddCommand(platform);