@withone/cli 1.33.0 → 1.35.0

package/dist/index.js

@@ -19,7 +19,7 @@ import {
   resolveFlowPath,
   saveFlow,
   validateActionInput
-} from "./chunk-T7LTS2IE.js";
+} from "./chunk-HZP7NT4K.js";
 
 // src/index.ts
 import { createRequire as createRequire2 } from "module";
@@ -27,7 +27,7 @@ import path16 from "path";
 import { Command } from "commander";
 
 // src/commands/init.ts
-import * as p3 from "@clack/prompts";
+import * as p4 from "@clack/prompts";
 import pc2 from "picocolors";
 import fs4 from "fs";
 import path4 from "path";
@@ -265,11 +265,11 @@ import fs2 from "fs";
 import path2 from "path";
 import os2 from "os";
 import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
-function expandPath(p8) {
-  if (p8.startsWith("~/")) {
-    return path2.join(os2.homedir(), p8.slice(2));
+function expandPath(p10) {
+  if (p10.startsWith("~/")) {
+    return path2.join(os2.homedir(), p10.slice(2));
   }
-  return p8;
+  return p10;
 }
 function getClaudeDesktopConfigPath() {
   switch (process.platform) {
@@ -459,6 +459,13 @@ async function openConnectionPage(platform, params) {
 async function openApiKeyPage() {
   await open(getApiKeyUrl());
 }
+function getCliAuthUrl(port, state) {
+  return `${ONE_APP_URL}/cli/auth?port=${port}&state=${encodeURIComponent(state)}`;
+}
+async function openCliAuthPage(port, state) {
+  const url = getCliAuthUrl(port, state);
+  await open(url);
+}
 
 // src/commands/config.ts
 import * as p2 from "@clack/prompts";
@@ -649,24 +656,24 @@ async function configCommand() {
       p2.outro("No changes made.");
       return;
     }
-    const spinner5 = p2.spinner();
-    spinner5.start("Validating API key...");
+    const spinner6 = p2.spinner();
+    spinner6.start("Validating API key...");
     let isValid = false;
     try {
       const api = new OneApi(apiKey, `${normalized}/v1`);
       isValid = await api.validateApiKey();
     } catch (err) {
-      spinner5.stop("Connection failed");
+      spinner6.stop("Connection failed");
       const msg = err instanceof Error ? err.message : String(err);
       p2.log.error(`Could not reach ${pc.cyan(normalized)}: ${msg}`);
       return;
     }
     if (!isValid) {
-      spinner5.stop("Invalid API key");
+      spinner6.stop("Invalid API key");
       p2.log.error(`Invalid API key for ${pc.cyan(normalized)}.`);
       return;
     }
-    spinner5.stop("API key validated");
+    spinner6.stop("API key validated");
     updateApiBase(normalized);
     newApiKey = apiKey;
   } else if (isCustomBase) {
@@ -685,24 +692,24 @@ async function configCommand() {
       p2.outro("No changes made.");
       return;
     }
-    const spinner5 = p2.spinner();
-    spinner5.start("Validating API key...");
+    const spinner6 = p2.spinner();
+    spinner6.start("Validating API key...");
     let isValid = false;
     try {
       const api = new OneApi(apiKey, "https://api.withone.ai/v1");
       isValid = await api.validateApiKey();
     } catch (err) {
-      spinner5.stop("Connection failed");
+      spinner6.stop("Connection failed");
       const msg = err instanceof Error ? err.message : String(err);
       p2.log.error(`Could not reach ${pc.cyan("https://api.withone.ai")}: ${msg}`);
       return;
     }
     if (!isValid) {
-      spinner5.stop("Invalid API key");
+      spinner6.stop("Invalid API key");
       p2.log.error(`Invalid API key. Get a valid key at ${getApiKeyUrl()}`);
       return;
     }
-    spinner5.stop("API key validated");
+    spinner6.stop("API key validated");
     updateApiBase(null);
     newApiKey = apiKey;
   }
@@ -738,16 +745,16 @@ async function configCommand() {
   p2.outro("Configuration updated.");
 }
 async function selectConnections(apiKey) {
-  const spinner5 = p2.spinner();
-  spinner5.start("Fetching connections...");
+  const spinner6 = p2.spinner();
+  spinner6.start("Fetching connections...");
   let connections;
   try {
     const api = new OneApi(apiKey, getApiBase());
     const rawConnections = await api.listConnections();
     connections = rawConnections.map((c) => ({ platform: c.platform, key: c.key }));
-    spinner5.stop(`Found ${connections.length} connection(s)`);
+    spinner6.stop(`Found ${connections.length} connection(s)`);
   } catch {
-    spinner5.stop("Could not fetch connections");
+    spinner6.stop("Could not fetch connections");
     const manual = await p2.text({
       message: "Enter connection keys manually (comma-separated):",
       placeholder: "conn_key_1, conn_key_2",
@@ -996,6 +1003,224 @@ function getSkillStatus() {
   };
 }
 
+// src/commands/login.ts
+import http from "http";
+import crypto from "crypto";
+import * as p3 from "@clack/prompts";
+var LOGIN_TIMEOUT_MS = 5 * 60 * 1e3;
+var PORT_RANGE_START = 49152;
+var PORT_RANGE_END = 65535;
+var MAX_PORT_ATTEMPTS = 5;
+var SUCCESS_HTML = `<!DOCTYPE html>
+<html><head><title>One CLI</title></head>
+<body style="font-family:system-ui;display:flex;justify-content:center;align-items:center;height:100vh;margin:0;background:#0a0a0a;color:#fafafa">
+<div style="text-align:center">
+<div style="width:48px;height:48px;border-radius:50%;background:rgba(34,197,94,0.1);display:flex;align-items:center;justify-content:center;margin:0 auto 16px">
+<svg width="24" height="24" fill="none" stroke="#22c55e" stroke-width="2" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" d="M5 13l4 4L19 7"/></svg>
+</div>
+<h1 style="font-size:20px;margin:0 0 8px">You're all set!</h1>
+<p style="color:#a1a1aa;font-size:14px">Return to your terminal. You can close this tab.</p>
+</div></body></html>`;
+function randomPort() {
+  return PORT_RANGE_START + Math.floor(Math.random() * (PORT_RANGE_END - PORT_RANGE_START));
+}
+function startCallbackServer(expectedState) {
+  return new Promise((resolveSetup, rejectSetup) => {
+    let attempts = 0;
+    function tryListen() {
+      const port = randomPort();
+      attempts++;
+      let resolveResult;
+      const result = new Promise((res) => {
+        resolveResult = res;
+      });
+      const server = http.createServer((req, res) => {
+        const url = new URL(req.url || "/", `http://localhost:${port}`);
+        if (url.pathname !== "/callback") {
+          res.writeHead(404, { "Content-Type": "text/plain" });
+          res.end("Not found");
+          return;
+        }
+        const encodedKey = url.searchParams.get("s");
+        const state = url.searchParams.get("state");
+        const apiKey = encodedKey ? Buffer.from(encodedKey, "base64").toString("utf-8") : null;
+        if (!apiKey || !state) {
+          res.writeHead(400, { "Content-Type": "text/plain" });
+          res.end("Missing required parameters");
+          return;
+        }
+        if (state !== expectedState) {
+          res.writeHead(403, { "Content-Type": "text/plain" });
+          res.end("State mismatch");
+          return;
+        }
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end(SUCCESS_HTML);
+        resolveResult({ apiKey, state });
+      });
+      server.on("error", (err) => {
+        if (err.code === "EADDRINUSE" && attempts < MAX_PORT_ATTEMPTS) {
+          tryListen();
+          return;
+        }
+        rejectSetup(err);
+      });
+      server.listen(port, "127.0.0.1", () => {
+        resolveSetup({ server, port, result });
+      });
+    }
+    tryListen();
+  });
+}
+async function browserLogin() {
+  const state = crypto.randomUUID();
+  const spin = p3.spinner();
+  let server;
+  let port;
+  let resultPromise;
+  try {
+    ({ server, port, result: resultPromise } = await startCallbackServer(state));
+  } catch {
+    error("Could not start local server. Try: one init");
+    return null;
+  }
+  const authUrl = getCliAuthUrl(port, state);
+  p3.note(
+    `If the browser doesn't open, visit:
+${authUrl}`,
+    "Opening browser for authentication..."
+  );
+  try {
+    await openCliAuthPage(port, state);
+  } catch {
+  }
+  spin.start("Waiting for authentication... (timeout: 5 min)");
+  const timeout = new Promise((_, reject) => {
+    const timer = setTimeout(() => {
+      reject(new Error("timeout"));
+    }, LOGIN_TIMEOUT_MS);
+    timer.unref();
+  });
+  try {
+    const payload = await Promise.race([resultPromise, timeout]);
+    spin.stop("Authentication received!");
+    const apiBase = getApiBase();
+    const api = new OneApi(payload.apiKey, apiBase);
+    const whoami = await api.whoami();
+    return { apiKey: payload.apiKey, whoami };
+  } catch (err) {
+    spin.stop("Authentication failed.");
+    if (err instanceof Error && err.message === "timeout") {
+      error("Authentication timed out (5 min). Try again with: one login");
+    } else if (err instanceof ApiError) {
+      error(`Authentication failed: ${err.message}`);
+    } else {
+      error("Authentication failed. Try: one init");
+    }
+    return null;
+  } finally {
+    server.closeAllConnections();
+    server.close();
+  }
+}
+function saveCredentials(apiKey, scope) {
+  const existing = scope === "project" ? readProjectConfig() : readGlobalConfig();
+  writeConfig({
+    apiKey,
+    installedAgents: existing?.installedAgents ?? [],
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    accessControl: existing?.accessControl,
+    cacheTtl: existing?.cacheTtl,
+    apiBase: existing?.apiBase
+  }, scope);
+}
+async function loginCommand() {
+  if (isAgentMode()) {
+    json({ error: "Browser login not available in agent mode. Use: one init" });
+    return;
+  }
+  let targetScope = "global";
+  const existingKey = getApiKey();
+  if (existingKey) {
+    const pc13 = (await import("picocolors")).default;
+    const resolved2 = resolveConfig();
+    const whoami2 = resolved2.config?.whoami;
+    const env2 = getEnvFromApiKey(existingKey);
+    const envLabel2 = env2 === "test" ? pc13.yellow("test") : pc13.green("live");
+    const currentScope = resolved2.scope === "project" ? pc13.cyan("local config") : pc13.magenta("global config");
+    const lines = ["You are already logged in.", ""];
+    if (whoami2) {
+      const contextParts2 = [];
+      if (whoami2.organization) contextParts2.push(whoami2.organization.name);
+      if (whoami2.project) contextParts2.push(whoami2.project.name);
+      const scopeDisplay2 = contextParts2.length > 0 ? contextParts2.join(" / ") : "Personal";
+      lines.push(`${pc13.bold(scopeDisplay2)} ${pc13.dim("\xB7")} ${envLabel2}`);
+      lines.push(`${whoami2.user.name} ${pc13.dim(`(${whoami2.user.email})`)}`);
+      if (whoami2.organization) lines.push(`${pc13.dim("Org:")} ${whoami2.organization.name}`);
+      if (whoami2.project) lines.push(`${pc13.dim("Project:")} ${whoami2.project.name}`);
+    }
+    lines.push("");
+    lines.push(`${pc13.dim("Stored in")} ${currentScope}`);
+    p3.note(lines.join("\n"));
+    const scopeChoice = await p3.select({
+      message: "Where would you like to log in?",
+      options: [
+        { value: "global", label: "Globally", hint: "applies everywhere" },
+        { value: "project", label: "This directory", hint: "only this project" }
+      ]
+    });
+    if (p3.isCancel(scopeChoice)) {
+      p3.cancel("Login cancelled.");
+      return;
+    }
+    targetScope = scopeChoice;
+  }
+  const result = await browserLogin();
+  if (!result) return;
+  const { apiKey, whoami } = result;
+  saveCredentials(apiKey, targetScope);
+  const resolved = resolveConfig();
+  if (resolved.config) {
+    writeConfig({ ...resolved.config, whoami }, targetScope);
+  }
+  const pc12 = (await import("picocolors")).default;
+  const env = getEnvFromApiKey(apiKey);
+  const contextParts = [];
+  if (whoami.organization) contextParts.push(whoami.organization.name);
+  if (whoami.project) contextParts.push(whoami.project.name);
+  const scopeDisplay = contextParts.length > 0 ? contextParts.join(" / ") : "Personal";
+  const envLabel = env === "test" ? pc12.yellow("test") : pc12.green("live");
+  const configLabel = targetScope === "project" ? pc12.cyan("local config") : pc12.magenta("global config");
+  const infoLines = [
+    `${pc12.bold(scopeDisplay)} ${pc12.dim("\xB7")} ${envLabel}`,
+    `${whoami.user.name} ${pc12.dim(`(${whoami.user.email})`)}`
+  ];
+  if (whoami.organization) infoLines.push(`${pc12.dim("Org:")} ${whoami.organization.name}`);
+  if (whoami.project) infoLines.push(`${pc12.dim("Project:")} ${whoami.project.name}`);
+  infoLines.push("");
+  infoLines.push(`${pc12.dim("Stored in")} ${configLabel}`);
+  p3.note(infoLines.join("\n"), "Logged in");
+  console.log();
+  console.log(`  ${pc12.dim("Next steps:")}`);
+  console.log(`  ${pc12.cyan("one add <platform>")}  ${pc12.dim("\u2014")} Connect a platform (e.g. gmail, slack, stripe)`);
+  console.log();
+  console.log(pc12.bold("  Copy-paste this to your AI agent:"));
+  console.log();
+  console.log(pc12.cyan("  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  console.log(pc12.cyan("  \u2502"));
+  console.log(pc12.cyan("  \u2502  The One CLI (`one`) is now installed on this machine. It"));
+  console.log(pc12.cyan("  \u2502  lets you interact with 250+ third-party platforms (Gmail,"));
+  console.log(pc12.cyan("  \u2502  Slack, Shopify, HubSpot, Stripe, GitHub, etc.) through"));
+  console.log(pc12.cyan("  \u2502  their APIs. Whenever you need to interact with any"));
+  console.log(pc12.cyan("  \u2502  third-party platform or external service, use the `one`"));
+  console.log(pc12.cyan("  \u2502  skill. Please save this to your project instructions or"));
+  console.log(pc12.cyan("  \u2502  memory so you remember it in future conversations."));
+  console.log(pc12.cyan("  \u2502"));
+  console.log(pc12.cyan("  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  console.log();
+  p3.outro("Happy building!");
+}
+
 // src/commands/init.ts
 async function initCommand(options) {
   if (isAgentMode()) {
@@ -1004,7 +1229,7 @@ async function initCommand(options) {
   printBanner();
   const scope = await chooseConfigScope(options);
   if (scope === null) {
-    p3.cancel("Setup cancelled.");
+    p4.cancel("Setup cancelled.");
     return;
   }
   const existingConfig = scope === "project" ? readProjectConfig() : readGlobalConfig();
@@ -1030,7 +1255,7 @@ async function chooseConfigScope(options) {
     console.log(`  ${pc2.bold("Active config:")} ${pc2.cyan("project")} ${pc2.dim("\xB7 " + homeProject)}`);
     console.log();
     if (hasGlobal) {
-      const which2 = await p3.select({
+      const which2 = await p4.select({
         message: "Which config do you want to edit?",
         options: [
           { value: "project", label: `This project (${projectName})`, hint: homeProject },
@@ -1038,7 +1263,7 @@ async function chooseConfigScope(options) {
         ],
         initialValue: "project"
       });
-      if (p3.isCancel(which2)) return null;
+      if (p4.isCancel(which2)) return null;
       return which2;
     }
     return "project";
@@ -1052,8 +1277,8 @@ async function chooseConfigScope(options) {
   console.log();
   const defaultScope = hasGlobal ? "project" : "global";
   const hint = hasGlobal ? "Your global config stays as-is. This folder gets its own setup." : "No global config yet \u2014 this becomes your default for every folder.";
-  p3.note(hint, defaultScope === "project" ? "Recommended: project" : "Recommended: global");
-  const which = await p3.select({
+  p4.note(hint, defaultScope === "project" ? "Recommended: project" : "Recommended: global");
+  const which = await p4.select({
     message: "Where should this setup live?",
     options: [
       {
@@ -1069,7 +1294,7 @@ async function chooseConfigScope(options) {
     ],
     initialValue: defaultScope
   });
-  if (p3.isCancel(which)) return null;
+  if (p4.isCancel(which)) return null;
   return which;
 }
 function tildify(filePath) {
@@ -1133,12 +1358,12 @@ async function handleExistingConfig(apiKey, scope, options) {
     value: "start-fresh",
     label: "Start fresh (reconfigure everything)"
   });
-  const action = await p3.select({
+  const action = await p4.select({
     message: scopedMessage(scope, "What would you like to do?"),
     options: actionOptions
   });
-  if (p3.isCancel(action)) {
-    p3.outro("No changes made.");
+  if (p4.isCancel(action)) {
+    p4.outro("No changes made.");
     return;
   }
   switch (action) {
@@ -1146,15 +1371,15 @@ async function handleExistingConfig(apiKey, scope, options) {
       const success = await promptSkillInstall();
       if (success) {
         printOnboardingPrompt();
-        p3.outro("Skill installed. Paste the prompt above to your AI agent.");
+        p4.outro("Skill installed. Paste the prompt above to your AI agent.");
       } else {
-        p3.outro("Done.");
+        p4.outro("Done.");
       }
       break;
     }
     case "show-prompt":
       printOnboardingPrompt();
-      p3.outro("Paste the prompt above to your AI agent.");
+      p4.outro("Paste the prompt above to your AI agent.");
       break;
     case "add-connection": {
       const whoamiCached = getWhoAmI();
@@ -1164,7 +1389,7 @@ async function handleExistingConfig(apiKey, scope, options) {
         ...whoamiCached?.project && { projectId: whoamiCached.project.id }
       };
       await promptConnectIntegrations(apiKey, addConnParams);
-      p3.outro("Done.");
+      p4.outro("Done.");
       break;
     }
     case "update-key":
@@ -1179,51 +1404,76 @@ async function handleExistingConfig(apiKey, scope, options) {
   }
 }
 async function handleUpdateKey(statuses, scope) {
-  p3.note(`Get your API key at:
-${pc2.cyan(getApiKeyUrl())}`, `API Key ${scopeLabel(scope)}`);
-  const openBrowser = await p3.confirm({
-    message: scopedMessage(scope, "Open browser to get API key?"),
-    initialValue: true
+  const authMethod = await p4.select({
+    message: scopedMessage(scope, "How would you like to authenticate?"),
+    options: [
+      { value: "browser", label: "Browser login", hint: "recommended \u2014 opens app.withone.ai" },
+      { value: "manual", label: "Paste API key manually" }
+    ]
   });
-  if (p3.isCancel(openBrowser)) {
-    p3.cancel("Cancelled.");
+  if (p4.isCancel(authMethod)) {
+    p4.cancel("Cancelled.");
     process.exit(0);
   }
-  if (openBrowser) {
-    await openApiKeyPage();
-  }
-  const newKey = await p3.text({
-    message: scopedMessage(scope, "Enter your new One API key:"),
-    placeholder: "sk_live_...",
-    validate: (value) => {
-      if (!value) return "API key is required";
-      if (!value.startsWith("sk_live_") && !value.startsWith("sk_test_")) {
-        return "API key should start with sk_live_ or sk_test_";
+  let newKey;
+  let whoamiResult;
+  if (authMethod === "browser") {
+    const result = await browserLogin();
+    if (!result) {
+      p4.cancel("Browser login did not complete.");
+      process.exit(1);
+    }
+    newKey = result.apiKey;
+    whoamiResult = result.whoami;
+  } else {
+    p4.note(`Get your API key at:
+${pc2.cyan(getApiKeyUrl())}`, `API Key ${scopeLabel(scope)}`);
+    const openBrowser = await p4.confirm({
+      message: scopedMessage(scope, "Open browser to get API key?"),
+      initialValue: true
+    });
+    if (p4.isCancel(openBrowser)) {
+      p4.cancel("Cancelled.");
+      process.exit(0);
+    }
+    if (openBrowser) {
+      await openApiKeyPage();
+    }
+    const inputKey = await p4.text({
+      message: scopedMessage(scope, "Enter your new One API key:"),
+      placeholder: "sk_live_...",
+      validate: (value) => {
+        if (!value) return "API key is required";
+        if (!value.startsWith("sk_live_") && !value.startsWith("sk_test_")) {
+          return "API key should start with sk_live_ or sk_test_";
+        }
+        return void 0;
       }
-      return void 0;
+    });
+    if (p4.isCancel(inputKey)) {
+      p4.cancel("Cancelled.");
+      process.exit(0);
     }
-  });
-  if (p3.isCancel(newKey)) {
-    p3.cancel("Cancelled.");
-    process.exit(0);
-  }
-  const spinner5 = p3.spinner();
-  spinner5.start("Validating API key...");
-  const api = new OneApi(newKey, getApiBase());
-  const whoamiResult = await api.validateApiKey();
-  if (!whoamiResult) {
-    spinner5.stop("Invalid API key");
-    p3.cancel(`Invalid API key. Get a valid key at ${getApiKeyUrl()}`);
-    process.exit(1);
+    newKey = inputKey;
+    const spinner6 = p4.spinner();
+    spinner6.start("Validating API key...");
+    const api = new OneApi(newKey, getApiBase());
+    const validated = await api.validateApiKey();
+    if (!validated) {
+      spinner6.stop("Invalid API key");
+      p4.cancel(`Invalid API key. Get a valid key at ${getApiKeyUrl()}`);
+      process.exit(1);
+    }
+    spinner6.stop("API key validated");
+    whoamiResult = validated;
   }
-  spinner5.stop("API key validated");
   const env = getEnvFromApiKey(newKey);
   const contextParts = [];
   if (whoamiResult.organization) contextParts.push(whoamiResult.organization.name);
   if (whoamiResult.project) contextParts.push(whoamiResult.project.name);
   const scopeDisplay = contextParts.length > 0 ? contextParts.join(" / ") : "Personal";
   const envLabel = env === "test" ? pc2.yellow("test") : pc2.green("live");
-  p3.note(
+  p4.note(
     `${scopeDisplay} ${pc2.dim("\xB7")} ${envLabel}
 ${whoamiResult.user.name} ${pc2.dim(`(${whoamiResult.user.email})`)}`,
     "Account"
@@ -1254,9 +1504,9 @@ ${whoamiResult.user.name} ${pc2.dim(`(${whoamiResult.user.email})`)}`,
     scope
   );
   if (reinstalled.length > 0) {
-    p3.log.success(`Updated MCP configs: ${reinstalled.join(", ")}`);
+    p4.log.success(`Updated MCP configs: ${reinstalled.join(", ")}`);
   }
-  p3.outro("API key updated.");
+  p4.outro("API key updated.");
 }
 var SKILL_AGENTS = [
   { id: "claude-code", name: "Claude Code", skillDir: ".claude/skills", primary: true },
@@ -1359,18 +1609,18 @@ async function promptSkillInstall() {
       hint: otherAgents.map((a) => a.name).join(", ")
     }
   ];
-  const choice = await p3.multiselect({
+  const choice = await p4.multiselect({
     message: "Install the One skill to:",
     options,
     initialValues: primaryAgents.map((a) => a.id)
   });
-  if (p3.isCancel(choice)) {
+  if (p4.isCancel(choice)) {
     return false;
   }
   let selectedIds = choice;
   if (selectedIds.includes("_other")) {
     selectedIds = selectedIds.filter((id) => id !== "_other");
-    const otherChoice = await p3.multiselect({
+    const otherChoice = await p4.multiselect({
       message: "Select additional agents:",
       options: otherAgents.map((a) => ({
         value: a.id,
@@ -1378,23 +1628,23 @@ async function promptSkillInstall() {
         hint: isSkillInstalledForAgent(a) ? pc2.green("installed") : void 0
       }))
     });
-    if (!p3.isCancel(otherChoice)) {
+    if (!p4.isCancel(otherChoice)) {
       selectedIds.push(...otherChoice);
     }
   }
   if (selectedIds.length === 0) {
-    p3.log.info("No agents selected.");
+    p4.log.info("No agents selected.");
     return false;
   }
-  const spinner5 = p3.spinner();
-  spinner5.start("Installing skill...");
+  const spinner6 = p4.spinner();
+  spinner6.start("Installing skill...");
   const { installed, failed } = installSkillForAgents(selectedIds);
-  spinner5.stop(installed.length > 0 ? "Skill installed" : "Installation failed");
+  spinner6.stop(installed.length > 0 ? "Skill installed" : "Installation failed");
   for (const name of installed) {
-    p3.log.success(`${name}: ${pc2.green("\u2713")} skill installed`);
+    p4.log.success(`${name}: ${pc2.green("\u2713")} skill installed`);
   }
   for (const name of failed) {
-    p3.log.warn(`${name}: failed to install`);
+    p4.log.warn(`${name}: failed to install`);
   }
   return installed.length > 0;
 }
@@ -1416,75 +1666,119 @@ function printOnboardingPrompt() {
   console.log();
 }
 async function freshSetup(scope, options) {
-  p3.note(`Get your API key at:
-${pc2.cyan(getApiKeyUrl())}`, `API Key ${scopeLabel(scope)}`);
-  const openBrowser = await p3.confirm({
-    message: scopedMessage(scope, "Open browser to get API key?"),
-    initialValue: true
+  const authMethod = await p4.select({
+    message: scopedMessage(scope, "How would you like to authenticate?"),
+    options: [
+      { value: "browser", label: "Browser login", hint: "recommended \u2014 opens app.withone.ai" },
+      { value: "manual", label: "Paste API key manually" }
+    ]
   });
-  if (p3.isCancel(openBrowser)) {
-    p3.cancel("Setup cancelled.");
+  if (p4.isCancel(authMethod)) {
+    p4.cancel("Setup cancelled.");
     process.exit(0);
   }
-  if (openBrowser) {
-    await openApiKeyPage();
-  }
-  const apiKey = await p3.text({
-    message: scopedMessage(scope, "Enter your One API key:"),
-    placeholder: "sk_live_...",
-    validate: (value) => {
-      if (!value) return "API key is required";
-      if (!value.startsWith("sk_live_") && !value.startsWith("sk_test_")) {
-        return "API key should start with sk_live_ or sk_test_";
+  let apiKey;
+  if (authMethod === "browser") {
+    const result = await browserLogin();
+    if (!result) {
+      p4.cancel("Browser login did not complete. Try: one init");
+      process.exit(1);
+    }
+    apiKey = result.apiKey;
+    const env2 = getEnvFromApiKey(apiKey);
+    const contextParts = [];
+    if (result.whoami.organization) contextParts.push(result.whoami.organization.name);
+    if (result.whoami.project) contextParts.push(result.whoami.project.name);
+    const scopeDisplay = contextParts.length > 0 ? contextParts.join(" / ") : "Personal";
+    const envLabel = env2 === "test" ? pc2.yellow("test") : pc2.green("live");
+    p4.note(
+      `${scopeDisplay} ${pc2.dim("\xB7")} ${envLabel}
+${result.whoami.user.name} ${pc2.dim(`(${result.whoami.user.email})`)}`,
+      "Account"
+    );
+    writeConfig(
+      {
+        apiKey,
+        installedAgents: [],
+        createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+        whoami: result.whoami
+      },
+      scope
+    );
+  } else {
+    p4.note(`Get your API key at:
+${pc2.cyan(getApiKeyUrl())}`, `API Key ${scopeLabel(scope)}`);
+    const openBrowser = await p4.confirm({
+      message: scopedMessage(scope, "Open browser to get API key?"),
+      initialValue: true
+    });
+    if (p4.isCancel(openBrowser)) {
+      p4.cancel("Setup cancelled.");
+      process.exit(0);
+    }
+    if (openBrowser) {
+      await openApiKeyPage();
+    }
+    const inputKey = await p4.text({
+      message: scopedMessage(scope, "Enter your One API key:"),
+      placeholder: "sk_live_...",
+      validate: (value) => {
+        if (!value) return "API key is required";
+        if (!value.startsWith("sk_live_") && !value.startsWith("sk_test_")) {
+          return "API key should start with sk_live_ or sk_test_";
+        }
+        return void 0;
       }
-      return void 0;
+    });
+    if (p4.isCancel(inputKey)) {
+      p4.cancel("Setup cancelled.");
+      process.exit(0);
     }
-  });
-  if (p3.isCancel(apiKey)) {
-    p3.cancel("Setup cancelled.");
-    process.exit(0);
-  }
-  const spinner5 = p3.spinner();
-  spinner5.start("Validating API key...");
-  const api = new OneApi(apiKey, getApiBase());
-  const whoami = await api.validateApiKey();
-  if (!whoami) {
-    spinner5.stop("Invalid API key");
-    p3.cancel(`Invalid API key. Get a valid key at ${getApiKeyUrl()}`);
-    process.exit(1);
-  }
-  spinner5.stop("API key validated");
-  const env = getEnvFromApiKey(apiKey);
-  const contextParts = [];
-  if (whoami.organization) contextParts.push(whoami.organization.name);
-  if (whoami.project) contextParts.push(whoami.project.name);
-  const scope_label = contextParts.length > 0 ? contextParts.join(" / ") : "Personal";
-  const envLabel = env === "test" ? pc2.yellow("test") : pc2.green("live");
-  p3.note(
-    `${scope_label} ${pc2.dim("\xB7")} ${envLabel}
+    apiKey = inputKey;
+    const spinner6 = p4.spinner();
+    spinner6.start("Validating API key...");
+    const api = new OneApi(apiKey, getApiBase());
+    const whoami = await api.validateApiKey();
+    if (!whoami) {
+      spinner6.stop("Invalid API key");
+      p4.cancel(`Invalid API key. Get a valid key at ${getApiKeyUrl()}`);
+      process.exit(1);
+    }
+    spinner6.stop("API key validated");
+    const env2 = getEnvFromApiKey(apiKey);
+    const contextParts = [];
+    if (whoami.organization) contextParts.push(whoami.organization.name);
+    if (whoami.project) contextParts.push(whoami.project.name);
+    const scopeDisplay = contextParts.length > 0 ? contextParts.join(" / ") : "Personal";
+    const envLabel = env2 === "test" ? pc2.yellow("test") : pc2.green("live");
+    p4.note(
+      `${scopeDisplay} ${pc2.dim("\xB7")} ${envLabel}
 ${whoami.user.name} ${pc2.dim(`(${whoami.user.email})`)}`,
-    "Account"
-  );
-  writeConfig(
-    {
-      apiKey,
-      installedAgents: [],
-      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-      whoami
-    },
-    scope
-  );
+      "Account"
+    );
+    writeConfig(
+      {
+        apiKey,
+        installedAgents: [],
+        createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+        whoami
+      },
+      scope
+    );
+  }
   await promptSkillInstall();
+  const env = getEnvFromApiKey(apiKey);
+  const savedConfig = readConfig();
   const connParams = {
     env,
-    ...whoami.organization && { orgId: whoami.organization.id },
-    ...whoami.project && { projectId: whoami.project.id }
+    ...savedConfig?.whoami?.organization && { orgId: savedConfig.whoami.organization.id },
+    ...savedConfig?.whoami?.project && { projectId: savedConfig.whoami.project.id }
   };
   await promptConnectIntegrations(apiKey, connParams);
   const savedPath = scope === "project" ? getProjectConfigPath() : getGlobalConfigPath();
   const resolutionHint = scope === "project" ? `When you run ${pc2.cyan("one")} from ${pc2.bold(path4.basename(getProjectRoot()))}, it uses this project config.
 From anywhere else, it falls back to your global config.` : `This config applies to every folder unless a project config is set.`;
-  p3.note(
+  p4.note(
     `${scopeLabel(scope)} Config saved to:
 ${pc2.dim(tildify(savedPath))}
 
@@ -1492,7 +1786,7 @@ ${resolutionHint}`,
     "Setup Complete"
   );
   printOnboardingPrompt();
-  p3.outro("Done! Paste the prompt above to your AI agent.");
+  p4.outro("Done! Paste the prompt above to your AI agent.");
 }
 function printBanner() {
   console.log();
@@ -1541,48 +1835,48 @@ async function promptConnectIntegrations(apiKey, connParams) {
       { value: "skip", label: "Skip for now", hint: "you can always run one add later" }
     ];
     const message = first ? "Connect your first integration?" : "Connect another?";
-    const choice = await p3.select({ message, options });
-    if (p3.isCancel(choice) || choice === "skip") {
+    const choice = await p4.select({ message, options });
+    if (p4.isCancel(choice) || choice === "skip") {
       break;
     }
     if (choice === "more") {
       try {
         await open2("https://app.withone.ai/connections");
-        p3.log.info("Opened One dashboard in browser.");
+        p4.log.info("Opened One dashboard in browser.");
       } catch {
-        p3.note("https://app.withone.ai/connections", "Open in browser");
+        p4.note("https://app.withone.ai/connections", "Open in browser");
       }
-      p3.log.info(`Connect from the dashboard, or use ${pc2.cyan("one add <platform>")}`);
+      p4.log.info(`Connect from the dashboard, or use ${pc2.cyan("one add <platform>")}`);
       break;
     }
     const platform = choice;
     const integration = TOP_INTEGRATIONS.find((i) => i.value === platform);
     const label = integration?.label ?? platform;
-    p3.log.info(`Opening browser to connect ${pc2.cyan(label)}...`);
+    p4.log.info(`Opening browser to connect ${pc2.cyan(label)}...`);
     try {
       await openConnectionPage(platform, connParams);
     } catch {
       const url = getConnectionUrl(platform, connParams);
-      p3.log.warn("Could not open browser automatically.");
-      p3.note(url, "Open manually");
+      p4.log.warn("Could not open browser automatically.");
+      p4.note(url, "Open manually");
     }
-    const spinner5 = p3.spinner();
-    spinner5.start("Waiting for connection... (complete auth in browser)");
+    const spinner6 = p4.spinner();
+    spinner6.start("Waiting for connection... (complete auth in browser)");
     try {
       await api.waitForConnection(platform, 5 * 60 * 1e3, 5e3);
-      spinner5.stop(`${label} connected!`);
-      p3.log.success(`${pc2.green("\u2713")} ${label} is now available to your AI agents`);
+      spinner6.stop(`${label} connected!`);
+      p4.log.success(`${pc2.green("\u2713")} ${label} is now available to your AI agents`);
       connected.push(platform);
       first = false;
     } catch (error2) {
-      spinner5.stop("Connection timed out");
+      spinner6.stop("Connection timed out");
       if (error2 instanceof TimeoutError) {
-        p3.log.warn(`No worries. Connect later with: ${pc2.cyan(`one add ${platform}`)}`);
+        p4.log.warn(`No worries. Connect later with: ${pc2.cyan(`one add ${platform}`)}`);
       }
       first = false;
     }
     if (TOP_INTEGRATIONS.every((i) => connected.includes(i.value))) {
-      p3.log.success("All top integrations connected!");
+      p4.log.success("All top integrations connected!");
       break;
     }
   }
@@ -1593,23 +1887,23 @@ function maskApiKey(key) {
 }
 
 // src/commands/connection.ts
-import * as p4 from "@clack/prompts";
+import * as p5 from "@clack/prompts";
 import pc4 from "picocolors";
 
 // src/lib/platforms.ts
 function findPlatform(platforms, query) {
   const normalizedQuery = query.toLowerCase().trim();
   const exact = platforms.find(
-    (p8) => p8.platform.toLowerCase() === normalizedQuery || p8.name.toLowerCase() === normalizedQuery
+    (p10) => p10.platform.toLowerCase() === normalizedQuery || p10.name.toLowerCase() === normalizedQuery
   );
   if (exact) return exact;
   return null;
 }
 function findSimilarPlatforms(platforms, query, limit = 3) {
   const normalizedQuery = query.toLowerCase().trim();
-  const scored = platforms.map((p8) => {
-    const name = p8.name.toLowerCase();
-    const slug = p8.platform.toLowerCase();
+  const scored = platforms.map((p10) => {
+    const name = p10.name.toLowerCase();
+    const slug = p10.platform.toLowerCase();
     let score = 0;
     if (name.includes(normalizedQuery) || slug.includes(normalizedQuery)) {
       score = 10;
@@ -1618,7 +1912,7 @@ function findSimilarPlatforms(platforms, query, limit = 3) {
     } else {
       score = countMatchingChars(normalizedQuery, slug);
     }
-    return { platform: p8, score };
+    return { platform: p10, score };
   }).filter((item) => item.score > 0).sort((a, b) => b.score - a.score).slice(0, limit);
   return scored.map((item) => item.platform);
 }
@@ -1672,22 +1966,22 @@ async function connectionAddCommand(platformArg) {
   if (isAgentMode()) {
     error("This command requires interactive input. Run without --agent.");
   }
-  p4.intro(pc4.bgCyan(pc4.black(" One ")));
+  p5.intro(pc4.bgCyan(pc4.black(" One ")));
   const apiKey = getApiKey();
   if (!apiKey) {
-    p4.cancel("Not configured. Run `one init` first.");
+    p5.cancel("Not configured. Run `one init` first.");
     process.exit(1);
   }
   const api = new OneApi(apiKey, getApiBase());
-  const spinner5 = p4.spinner();
-  spinner5.start("Loading platforms...");
+  const spinner6 = p5.spinner();
+  spinner6.start("Loading platforms...");
   let platforms;
   try {
     platforms = await api.listPlatforms();
-    spinner5.stop(`${platforms.length} platforms available`);
+    spinner6.stop(`${platforms.length} platforms available`);
   } catch (error2) {
-    spinner5.stop("Failed to load platforms");
-    p4.cancel(`Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
+    spinner6.stop("Failed to load platforms");
+    p5.cancel(`Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
     process.exit(1);
   }
   let platform;
@@ -1698,29 +1992,29 @@ async function connectionAddCommand(platformArg) {
     } else {
       const similar = findSimilarPlatforms(platforms, platformArg);
       if (similar.length > 0) {
-        p4.log.warn(`Unknown platform: ${platformArg}`);
-        const suggestion = await p4.select({
+        p5.log.warn(`Unknown platform: ${platformArg}`);
+        const suggestion = await p5.select({
           message: "Did you mean:",
           options: [
             ...similar.map((s) => ({ value: s.platform, label: `${s.name} (${s.platform})` })),
             { value: "__other__", label: "None of these" }
           ]
         });
-        if (p4.isCancel(suggestion) || suggestion === "__other__") {
-          p4.note(`Run ${pc4.cyan("one platforms")} to see all available platforms.`);
-          p4.cancel("Connection cancelled.");
+        if (p5.isCancel(suggestion) || suggestion === "__other__") {
+          p5.note(`Run ${pc4.cyan("one platforms")} to see all available platforms.`);
+          p5.cancel("Connection cancelled.");
           process.exit(0);
         }
         platform = suggestion;
       } else {
-        p4.cancel(`Unknown platform: ${platformArg}
+        p5.cancel(`Unknown platform: ${platformArg}
 
 Run ${pc4.cyan("one platforms")} to see available platforms.`);
         process.exit(1);
       }
     }
   } else {
-    const platformInput = await p4.text({
+    const platformInput = await p5.text({
       message: "Which platform do you want to connect?",
       placeholder: "gmail, slack, hubspot...",
       validate: (value) => {
@@ -1728,15 +2022,15 @@ Run ${pc4.cyan("one platforms")} to see available platforms.`);
         return void 0;
       }
     });
-    if (p4.isCancel(platformInput)) {
-      p4.cancel("Connection cancelled.");
+    if (p5.isCancel(platformInput)) {
+      p5.cancel("Connection cancelled.");
       process.exit(0);
     }
     const found = findPlatform(platforms, platformInput);
     if (found) {
       platform = found.platform;
     } else {
-      p4.cancel(`Unknown platform: ${platformInput}
+      p5.cancel(`Unknown platform: ${platformInput}
 
 Run ${pc4.cyan("one platforms")} to see available platforms.`);
       process.exit(1);
@@ -1749,26 +2043,26 @@ Run ${pc4.cyan("one platforms")} to see available platforms.`);
     ...whoami?.project && { projectId: whoami.project.id }
   };
   const url = getConnectionUrl(platform, connParams);
-  p4.log.info(`Opening browser to connect ${pc4.cyan(platform)}...`);
-  p4.note(pc4.dim(url), "URL");
+  p5.log.info(`Opening browser to connect ${pc4.cyan(platform)}...`);
+  p5.note(pc4.dim(url), "URL");
   try {
     await openConnectionPage(platform, connParams);
   } catch {
-    p4.log.warn("Could not open browser automatically.");
-    p4.note(`Open this URL manually:
+    p5.log.warn("Could not open browser automatically.");
+    p5.note(`Open this URL manually:
 ${url}`);
   }
-  const pollSpinner = p4.spinner();
+  const pollSpinner = p5.spinner();
   pollSpinner.start("Waiting for connection... (complete auth in browser)");
   try {
     const connection2 = await api.waitForConnection(platform, 5 * 60 * 1e3, 5e3);
     pollSpinner.stop(`${platform} connected!`);
-    p4.log.success(`${pc4.green("\u2713")} ${connection2.platform} is now available to your AI agents.`);
-    p4.outro("Connection complete!");
+    p5.log.success(`${pc4.green("\u2713")} ${connection2.platform} is now available to your AI agents.`);
+    p5.outro("Connection complete!");
   } catch (error2) {
     pollSpinner.stop("Connection timed out");
     if (error2 instanceof TimeoutError) {
-      p4.note(
+      p5.note(
         `Possible issues:
   - OAuth flow was not completed in the browser
   - Browser popup was blocked
@@ -1778,7 +2072,7 @@ Try again with: ${pc4.cyan(`one connection add ${platform}`)}`,
         "Timed Out"
       );
     } else {
-      p4.log.error(`Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
+      p5.log.error(`Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
     }
     process.exit(1);
   }
@@ -1789,8 +2083,8 @@ async function connectionListCommand(options) {
     error("Not configured. Run `one init` first.");
   }
   const api = new OneApi(apiKey, getApiBase());
-  const spinner5 = createSpinner();
-  spinner5.start("Loading connections...");
+  const spinner6 = createSpinner();
+  spinner6.start("Loading connections...");
   try {
     const allConnections = await api.listConnections();
     const ac = getAccessControlFromAllSources();
@@ -1818,17 +2112,17 @@ async function connectionListCommand(options) {
       });
       return;
     }
-    spinner5.stop(`${filtered.length} connection${filtered.length === 1 ? "" : "s"} found`);
+    spinner6.stop(`${filtered.length} connection${filtered.length === 1 ? "" : "s"} found`);
     if (filtered.length === 0) {
       if (searchQuery) {
-        p4.note(
+        p5.note(
           `No connections matching "${searchQuery}".
 
 Try: ${pc4.cyan("one connection list")} to see all connections.`,
           "No Results"
         );
       } else {
-        p4.note(
+        p5.note(
           `No connections yet.
 
 Add one with: ${pc4.cyan("one connection add gmail")}`,
@@ -1857,9 +2151,9 @@ Add one with: ${pc4.cyan("one connection add gmail")}`,
       rows
     );
     console.log();
-    p4.note(`Add more with: ${pc4.cyan("one connection add <platform>")}`, "Tip");
+    p5.note(`Add more with: ${pc4.cyan("one connection add <platform>")}`, "Tip");
   } catch (error2) {
-    spinner5.stop("Failed to load connections");
+    spinner6.stop("Failed to load connections");
     error(`Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
   }
 }
@@ -1869,13 +2163,13 @@ async function connectionDeleteCommand(connectionKey, options) {
     error("Not configured. Run `one init` first.");
   }
   const api = new OneApi(apiKey, getApiBase());
-  const spinner5 = createSpinner();
-  spinner5.start("Finding connection...");
+  const spinner6 = createSpinner();
+  spinner6.start("Finding connection...");
   let allConnections;
   try {
     allConnections = await api.listConnections();
   } catch (error2) {
-    spinner5.stop("Failed to load connections");
+    spinner6.stop("Failed to load connections");
     error(`Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
     return;
   }
@@ -1884,22 +2178,22 @@ async function connectionDeleteCommand(connectionKey, options) {
   const connections = allowedKeys.includes("*") ? allConnections : allConnections.filter((conn) => allowedKeys.includes(conn.key));
   const match = connections.find((conn) => conn.key === connectionKey);
   if (!match) {
-    spinner5.stop("Connection not found");
+    spinner6.stop("Connection not found");
     error(`No connection found with key: ${connectionKey}`);
     return;
   }
   const connection2 = match;
-  spinner5.stop(`Found ${connection2.platform} (${connection2.state})`);
+  spinner6.stop(`Found ${connection2.platform} (${connection2.state})`);
   if (!isAgentMode() && !options?.force) {
     console.log();
     console.log(`  ${getStatusIndicator(connection2.state)} ${connection2.platform}  ${pc4.dim(connection2.key)}`);
     console.log();
-    const confirmed = await p4.confirm({
+    const confirmed = await p5.confirm({
       message: "Are you sure you want to delete this connection?",
       initialValue: false
     });
-    if (p4.isCancel(confirmed) || !confirmed) {
-      p4.cancel("Deletion cancelled.");
+    if (p5.isCancel(confirmed) || !confirmed) {
+      p5.cancel("Deletion cancelled.");
       process.exit(0);
     }
   }
@@ -1916,7 +2210,7 @@ async function connectionDeleteCommand(connectionKey, options) {
       });
       return;
     }
-    p4.log.success(`${pc4.green("\u2713")} ${connection2.platform} connection removed.`);
+    p5.log.success(`${pc4.green("\u2713")} ${connection2.platform} connection removed.`);
   } catch (error2) {
     deleteSpinner.stop("Failed to delete connection");
     error(`Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
@@ -1936,7 +2230,7 @@ function getStatusIndicator(state) {
 }
 
 // src/commands/platforms.ts
-import * as p5 from "@clack/prompts";
+import * as p6 from "@clack/prompts";
 import pc5 from "picocolors";
 async function platformsCommand(options) {
   const apiKey = getApiKey();
@@ -1947,11 +2241,11 @@ async function platformsCommand(options) {
     options.json = true;
   }
   const api = new OneApi(apiKey, getApiBase());
-  const spinner5 = createSpinner();
-  spinner5.start("Loading platforms...");
+  const spinner6 = createSpinner();
+  spinner6.start("Loading platforms...");
   try {
     const platforms = await api.listPlatforms();
-    spinner5.stop(`${platforms.length} platforms available`);
+    spinner6.stop(`${platforms.length} platforms available`);
     let filtered = platforms;
     if (options.category) {
       filtered = platforms.filter((plat) => (plat.category || "Other") === options.category);
@@ -1961,7 +2255,7 @@ async function platformsCommand(options) {
           json({ error: `Unknown category "${options.category}"`, availableCategories: categories });
           process.exit(1);
         }
-        p5.note(`Available categories:
+        p6.note(`Available categories:
   ${categories.join(", ")}`, "Unknown Category");
         process.exit(1);
       }
@@ -2003,15 +2297,15 @@ async function platformsCommand(options) {
       );
     }
     console.log();
-    p5.note(`Connect with: ${pc5.cyan("one connection add <platform>")}`, "Tip");
+    p6.note(`Connect with: ${pc5.cyan("one connection add <platform>")}`, "Tip");
   } catch (error2) {
-    spinner5.stop("Failed to load platforms");
+    spinner6.stop("Failed to load platforms");
     error(`Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
   }
 }
 
 // src/commands/actions.ts
-import * as p6 from "@clack/prompts";
+import * as p7 from "@clack/prompts";
 import pc6 from "picocolors";
 
 // src/lib/cache.ts
@@ -2153,8 +2447,8 @@ async function actionsSearchCommand(platform, query, options) {
   intro2(pc6.bgCyan(pc6.black(" One ")));
   const { apiKey, permissions, actionIds, knowledgeAgent } = getConfig();
   const api = new OneApi(apiKey, getApiBase());
-  const spinner5 = createSpinner();
-  spinner5.start(`Searching actions on ${pc6.cyan(platform)} for "${query}"...`);
+  const spinner6 = createSpinner();
+  spinner6.start(`Searching actions on ${pc6.cyan(platform)} for "${query}"...`);
   try {
     const agentType = knowledgeAgent ? "knowledge" : options.type || "execute";
     const useCache = options.cache !== false;
@@ -2219,8 +2513,8 @@ async function actionsSearchCommand(platform, query, options) {
       return;
     }
     if (cleanedActions.length === 0) {
-      spinner5.stop("No actions found");
-      p6.note(
+      spinner6.stop("No actions found");
+      p7.note(
         `No actions found for platform '${platform}' matching query '${query}'.
 
 Suggestions:
@@ -2237,7 +2531,7 @@ Examples of good queries:
       );
       return;
     }
-    spinner5.stop(
+    spinner6.stop(
       `Found ${cleanedActions.length} action(s) for '${platform}' matching '${query}'`
     );
     console.log();
@@ -2257,13 +2551,13 @@ Examples of good queries:
       rows
     );
     console.log();
-    p6.note(
+    p7.note(
       `Get details: ${pc6.cyan(`one actions knowledge ${platform} <actionId>`)}
 Execute:     ${pc6.cyan(`one actions execute ${platform} <actionId> <connectionKey>`)}`,
       "Next Steps"
     );
   } catch (error2) {
-    spinner5.stop("Search failed");
+    spinner6.stop("Search failed");
     error(
       `Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`
     );
@@ -2299,25 +2593,25 @@ async function actionsKnowledgeCommand(platform, actionId, options) {
     error(`Action "${actionId}" is not in the allowed action list.`);
   }
   if (!connectionKeys.includes("*")) {
-    const spinner6 = createSpinner();
-    spinner6.start("Checking connections...");
+    const spinner7 = createSpinner();
+    spinner7.start("Checking connections...");
     try {
       const connections = await api.listConnections();
       const connectedPlatforms = connections.map((c) => c.platform);
       if (!connectedPlatforms.includes(platform)) {
-        spinner6.stop("Platform not connected");
+        spinner7.stop("Platform not connected");
         error(`Platform "${platform}" has no allowed connections.`);
       }
-      spinner6.stop("Connection verified");
+      spinner7.stop("Connection verified");
     } catch (error2) {
-      spinner6.stop("Failed to check connections");
+      spinner7.stop("Failed to check connections");
       error(
         `Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`
       );
     }
   }
-  const spinner5 = createSpinner();
-  spinner5.start(`Loading knowledge for action ${pc6.dim(actionId)}...`);
+  const spinner6 = createSpinner();
+  spinner6.start(`Loading knowledge for action ${pc6.dim(actionId)}...`);
   try {
     const useCache = options.cache !== false;
     const cached2 = useCache ? readCache2(cachePath) : null;
@@ -2372,16 +2666,16 @@ async function actionsKnowledgeCommand(platform, actionId, options) {
       json(response);
       return;
     }
-    spinner5.stop("Knowledge loaded");
+    spinner6.stop("Knowledge loaded");
     console.log();
     console.log(knowledgeWithGuidance);
     console.log();
-    p6.note(
+    p7.note(
       `Execute: ${pc6.cyan(`one actions execute ${platform} ${actionId} <connectionKey>`)}`,
       "Next Step"
     );
   } catch (error2) {
-    spinner5.stop("Failed to load knowledge");
+    spinner6.stop("Failed to load knowledge");
     error(
       `Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`
     );
@@ -2402,17 +2696,17 @@ async function actionsExecuteCommand(platform, actionId, connectionKey, options)
     error(`Connection key "${connectionKey}" is not allowed.`);
   }
   const api = new OneApi(apiKey, getApiBase());
-  const spinner5 = createSpinner();
-  spinner5.start("Loading action details...");
+  const spinner6 = createSpinner();
+  spinner6.start("Loading action details...");
   try {
     const actionDetails = await api.getActionDetails(actionId);
     if (!isMethodAllowed(actionDetails.method, permissions)) {
-      spinner5.stop("Permission denied");
+      spinner6.stop("Permission denied");
       error(
         `Method "${actionDetails.method}" is not allowed under "${permissions}" permission level.`
       );
     }
-    spinner5.stop(`Action: ${actionDetails.title} [${actionDetails.method}]`);
+    spinner6.stop(`Action: ${actionDetails.title} [${actionDetails.method}]`);
     const data = options.data ? parseJsonArg(options.data, "--data") : void 0;
     const pathVariables = options.pathVars ? parseJsonArg(options.pathVars, "--path-vars") : void 0;
     const queryParams = options.queryParams ? parseJsonArg(options.queryParams, "--query-params") : void 0;
@@ -2420,7 +2714,7 @@ async function actionsExecuteCommand(platform, actionId, connectionKey, options)
     if (!options.skipValidation) {
       const validation = validateActionInput(actionDetails, { data, pathVariables, queryParams });
       if (!validation.valid) {
-        spinner5.stop("Validation failed");
+        spinner6.stop("Validation failed");
         if (isAgentMode()) {
           json({
             error: "Validation failed: missing required parameters",
@@ -2441,7 +2735,7 @@ async function actionsExecuteCommand(platform, actionId, connectionKey, options)
       }
     }
     if (options.mock) {
-      spinner5.stop("Mock \u2014 returning example response");
+      spinner6.stop("Mock \u2014 returning example response");
       const mockResponse = actionDetails.ioSchema?.ioExample?.output ?? null;
       if (isAgentMode()) {
         json({
@@ -2516,7 +2810,7 @@ async function actionsExecuteCommand(platform, actionId, connectionKey, options)
       console.log(JSON.stringify(result.responseData, null, 2));
     }
   } catch (error2) {
-    spinner5.stop("Execution failed");
+    spinner6.stop("Execution failed");
     error(
       `Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`
     );
@@ -3463,8 +3757,15 @@ async function flowCreateCommand(key, options) {
   } else {
     error("Interactive workflow creation not yet supported. Use --definition <json> or pipe JSON via stdin.");
   }
+  let group;
   if (key) {
-    flow2.key = key;
+    if (key.includes("/")) {
+      const parts = key.split("/");
+      flow2.key = parts.pop();
+      group = parts.join("/");
+    } else {
+      flow2.key = key;
+    }
   }
   const errors = validateFlow(flow2);
   if (errors.length > 0) {
@@ -3475,7 +3776,7 @@ async function flowCreateCommand(key, options) {
     error(`Validation failed:
 ${errors.map((e) => `  ${e.path}: ${e.message}`).join("\n")}`);
   }
-  const flowPath = saveFlow(flow2, options.output);
+  const flowPath = saveFlow(flow2, options.output, group);
   if (isAgentMode()) {
     json({ created: true, key: flow2.key, path: flowPath });
     return;
@@ -3488,8 +3789,8 @@ async function flowExecuteCommand(keyOrPath, options) {
   intro2(pc7.bgCyan(pc7.black(" One Workflow ")));
   const { apiKey, permissions, actionIds } = getConfig2();
   const api = new OneApi(apiKey, getApiBase());
-  const spinner5 = createSpinner();
-  spinner5.start(`Loading workflow "${keyOrPath}"...`);
+  const spinner6 = createSpinner();
+  spinner6.start(`Loading workflow "${keyOrPath}"...`);
   let flow2;
   let rootDir;
   let flowFilePath;
@@ -3499,11 +3800,11 @@ async function flowExecuteCommand(keyOrPath, options) {
     rootDir = loaded.rootDir;
     flowFilePath = loaded.filePath;
   } catch (err) {
-    spinner5.stop("Workflow not found");
+    spinner6.stop("Workflow not found");
     error(err instanceof Error ? err.message : String(err));
     return;
   }
-  spinner5.stop(`Workflow: ${flow2.name} (${flow2.steps.length} steps)`);
+  spinner6.stop(`Workflow: ${flow2.name} (${flow2.steps.length} steps)`);
   const preflightErrors = validateFlow(flow2, rootDir);
   if (preflightErrors.length > 0) {
     if (isAgentMode()) {
@@ -3639,7 +3940,7 @@ async function flowListCommand() {
       { key: "flags", label: "Requires" }
     ],
     flows.map((f) => ({
-      key: f.key,
+      key: f.group ? `${f.group}/${f.key}` : f.key,
       name: f.name,
       layout: f.layout,
       inputCount: String(f.inputCount),
@@ -3651,8 +3952,8 @@ async function flowListCommand() {
 }
 async function flowValidateCommand(keyOrPath) {
   intro2(pc7.bgCyan(pc7.black(" One Workflow ")));
-  const spinner5 = createSpinner();
-  spinner5.start(`Validating "${keyOrPath}"...`);
+  const spinner6 = createSpinner();
+  spinner6.start(`Validating "${keyOrPath}"...`);
   let flowData;
   let rootDir;
   try {
@@ -3667,12 +3968,12 @@ async function flowValidateCommand(keyOrPath) {
       rootDir = path7.dirname(flowPath);
     }
   } catch (err) {
-    spinner5.stop("Validation failed");
+    spinner6.stop("Validation failed");
     error(`Could not read workflow: ${err instanceof Error ? err.message : String(err)}`);
   }
   const errors = validateFlow(flowData, rootDir);
   if (errors.length > 0) {
-    spinner5.stop("Validation failed");
+    spinner6.stop("Validation failed");
     if (isAgentMode()) {
       json({ valid: false, errors });
       process.exit(1);
@@ -3684,7 +3985,7 @@ async function flowValidateCommand(keyOrPath) {
     console.log();
     error(`${errors.length} validation error(s) found`);
   }
-  spinner5.stop("Workflow is valid");
+  spinner6.stop("Workflow is valid");
   if (isAgentMode()) {
     json({ valid: true, key: flowData.key });
     return;
@@ -3718,11 +4019,11 @@ async function flowResumeCommand(runId) {
       json(event);
     }
   };
-  const spinner5 = createSpinner();
-  spinner5.start(`Resuming run ${runId} (${state.completedSteps.length} steps already completed)...`);
+  const spinner6 = createSpinner();
+  spinner6.start(`Resuming run ${runId} (${state.completedSteps.length} steps already completed)...`);
   try {
     const context = await runner.resume(flow2, api, permissions, actionIds, { onEvent, rootDir });
-    spinner5.stop("Workflow completed");
+    spinner6.stop("Workflow completed");
     if (isAgentMode()) {
       json({
         event: "workflow:result",
@@ -3736,7 +4037,7 @@ async function flowResumeCommand(runId) {
     console.log(`  ${pc7.green("\u2713")} Resumed and completed successfully`);
     console.log(`  ${pc7.dim(`Log: ${runner.getLogPath()}`)}`);
   } catch (error2) {
-    spinner5.stop("Resume failed");
+    spinner6.stop("Resume failed");
     const errorMsg = error2 instanceof Error ? error2.message : String(error2);
     if (isAgentMode()) {
       json({ event: "workflow:result", runId, status: "failed", error: errorMsg });
@@ -4023,8 +4324,8 @@ async function relayCreateCommand(options) {
     error(`Connection key "${options.connectionKey}" is not allowed.`);
   }
   const api = new OneApi(apiKey, getApiBase());
-  const spinner5 = createSpinner();
-  spinner5.start("Creating relay endpoint...");
+  const spinner6 = createSpinner();
+  spinner6.start("Creating relay endpoint...");
   try {
     const body = {
       connectionKey: options.connectionKey
@@ -4038,7 +4339,7 @@ async function relayCreateCommand(options) {
       json(result);
       return;
     }
-    spinner5.stop("Relay endpoint created");
+    spinner6.stop("Relay endpoint created");
     console.log();
     console.log(`  ${pc8.dim("ID:")}          ${result.id}`);
     console.log(`  ${pc8.dim("URL:")}         ${result.url}`);
@@ -4048,15 +4349,15 @@ async function relayCreateCommand(options) {
     if (result.webhookPayload?.id) console.log(`  ${pc8.dim("Webhook ID:")}  ${result.webhookPayload.id}`);
     console.log();
   } catch (error2) {
-    spinner5.stop("Failed to create relay endpoint");
+    spinner6.stop("Failed to create relay endpoint");
     error(`Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
   }
 }
 async function relayListCommand(options) {
   const { apiKey } = getConfig3();
   const api = new OneApi(apiKey, getApiBase());
-  const spinner5 = createSpinner();
-  spinner5.start("Loading relay endpoints...");
+  const spinner6 = createSpinner();
+  spinner6.start("Loading relay endpoints...");
   try {
     const query = {};
     if (options.limit) query.limit = options.limit;
@@ -4079,7 +4380,7 @@ async function relayListCommand(options) {
       });
       return;
     }
-    spinner5.stop(`${endpoints.length} relay endpoint${endpoints.length === 1 ? "" : "s"} found`);
+    spinner6.stop(`${endpoints.length} relay endpoint${endpoints.length === 1 ? "" : "s"} found`);
     if (endpoints.length === 0) {
       console.log("\n  No relay endpoints yet.\n");
       return;
@@ -4101,22 +4402,22 @@ async function relayListCommand(options) {
       }))
     );
   } catch (error2) {
-    spinner5.stop("Failed to list relay endpoints");
+    spinner6.stop("Failed to list relay endpoints");
     error(`Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
   }
 }
 async function relayGetCommand(id) {
   const { apiKey } = getConfig3();
   const api = new OneApi(apiKey, getApiBase());
-  const spinner5 = createSpinner();
-  spinner5.start("Loading relay endpoint...");
+  const spinner6 = createSpinner();
+  spinner6.start("Loading relay endpoint...");
   try {
     const result = await api.getRelayEndpoint(id);
     if (isAgentMode()) {
       json(result);
       return;
     }
-    spinner5.stop("Relay endpoint loaded");
+    spinner6.stop("Relay endpoint loaded");
     console.log();
     console.log(`  ${pc8.dim("ID:")}          ${result.id}`);
     console.log(`  ${pc8.dim("URL:")}         ${result.url}`);
@@ -4132,15 +4433,15 @@ async function relayGetCommand(id) {
     console.log(`  ${pc8.dim("Created:")}     ${result.createdAt}`);
     console.log();
   } catch (error2) {
-    spinner5.stop("Failed to load relay endpoint");
+    spinner6.stop("Failed to load relay endpoint");
     error(`Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
   }
 }
 async function relayUpdateCommand(id, options) {
   const { apiKey } = getConfig3();
   const api = new OneApi(apiKey, getApiBase());
-  const spinner5 = createSpinner();
-  spinner5.start("Updating relay endpoint...");
+  const spinner6 = createSpinner();
+  spinner6.start("Updating relay endpoint...");
   try {
     const body = {};
     if (options.description !== void 0) body.description = options.description;
@@ -4153,40 +4454,40 @@ async function relayUpdateCommand(id, options) {
       json(result);
       return;
     }
-    spinner5.stop("Relay endpoint updated");
+    spinner6.stop("Relay endpoint updated");
     console.log(`  ${pc8.dim("ID:")} ${result.id}`);
     console.log(`  ${pc8.dim("Active:")} ${result.active}`);
     console.log(`  ${pc8.dim("Actions:")} ${result.actions?.length || 0}`);
     console.log();
   } catch (error2) {
-    spinner5.stop("Failed to update relay endpoint");
+    spinner6.stop("Failed to update relay endpoint");
     error(`Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
   }
 }
 async function relayDeleteCommand(id) {
   const { apiKey } = getConfig3();
   const api = new OneApi(apiKey, getApiBase());
-  const spinner5 = createSpinner();
-  spinner5.start("Deleting relay endpoint...");
+  const spinner6 = createSpinner();
+  spinner6.start("Deleting relay endpoint...");
   try {
     const result = await api.deleteRelayEndpoint(id);
     if (isAgentMode()) {
       json({ deleted: true, id: result.id });
       return;
     }
-    spinner5.stop("Relay endpoint deleted");
+    spinner6.stop("Relay endpoint deleted");
     console.log(`  Deleted: ${result.id}`);
     console.log();
   } catch (error2) {
-    spinner5.stop("Failed to delete relay endpoint");
+    spinner6.stop("Failed to delete relay endpoint");
     error(`Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
   }
 }
 async function relayActivateCommand(id, options) {
   const { apiKey } = getConfig3();
   const api = new OneApi(apiKey, getApiBase());
-  const spinner5 = createSpinner();
-  spinner5.start("Activating relay endpoint...");
+  const spinner6 = createSpinner();
+  spinner6.start("Activating relay endpoint...");
   try {
     const actions2 = parseJsonArg2(options.actions, "--actions");
     const body = { actions: actions2 };
@@ -4196,21 +4497,21 @@ async function relayActivateCommand(id, options) {
       json(result);
       return;
     }
-    spinner5.stop("Relay endpoint activated");
+    spinner6.stop("Relay endpoint activated");
     console.log(`  ${pc8.dim("ID:")} ${result.id}`);
     console.log(`  ${pc8.dim("Active:")} ${result.active}`);
     console.log(`  ${pc8.dim("Actions:")} ${result.actions?.length || 0}`);
     console.log();
   } catch (error2) {
-    spinner5.stop("Failed to activate relay endpoint");
+    spinner6.stop("Failed to activate relay endpoint");
     error(`Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
   }
 }
 async function relayEventsCommand(options) {
   const { apiKey } = getConfig3();
   const api = new OneApi(apiKey, getApiBase());
-  const spinner5 = createSpinner();
-  spinner5.start("Loading relay events...");
+  const spinner6 = createSpinner();
+  spinner6.start("Loading relay events...");
   try {
     const query = {};
     if (options.limit) query.limit = options.limit;
@@ -4234,7 +4535,7 @@ async function relayEventsCommand(options) {
       });
       return;
     }
-    spinner5.stop(`${events.length} event${events.length === 1 ? "" : "s"} found`);
+    spinner6.stop(`${events.length} event${events.length === 1 ? "" : "s"} found`);
     if (events.length === 0) {
       console.log("\n  No events found.\n");
       return;
@@ -4254,22 +4555,22 @@ async function relayEventsCommand(options) {
       }))
     );
   } catch (error2) {
-    spinner5.stop("Failed to list relay events");
+    spinner6.stop("Failed to list relay events");
     error(`Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
   }
 }
 async function relayEventGetCommand(id) {
   const { apiKey } = getConfig3();
   const api = new OneApi(apiKey, getApiBase());
-  const spinner5 = createSpinner();
-  spinner5.start("Loading relay event...");
+  const spinner6 = createSpinner();
+  spinner6.start("Loading relay event...");
   try {
     const result = await api.getRelayEvent(id);
     if (isAgentMode()) {
       json(result);
       return;
     }
-    spinner5.stop("Relay event loaded");
+    spinner6.stop("Relay event loaded");
     console.log();
     console.log(`  ${pc8.dim("ID:")}        ${result.id}`);
     console.log(`  ${pc8.dim("Platform:")}  ${result.platform}`);
@@ -4279,7 +4580,7 @@ async function relayEventGetCommand(id) {
     console.log(JSON.stringify(result.payload, null, 2));
     console.log();
   } catch (error2) {
-    spinner5.stop("Failed to load relay event");
+    spinner6.stop("Failed to load relay event");
     error(`Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
   }
 }
@@ -4289,8 +4590,8 @@ async function relayDeliveriesCommand(options) {
   }
   const { apiKey } = getConfig3();
   const api = new OneApi(apiKey, getApiBase());
-  const spinner5 = createSpinner();
-  spinner5.start("Loading deliveries...");
+  const spinner6 = createSpinner();
+  spinner6.start("Loading deliveries...");
   try {
     const deliveries = options.endpointId ? await api.listRelayEndpointDeliveries(options.endpointId) : await api.listRelayEventDeliveries(options.eventId);
     const items = Array.isArray(deliveries) ? deliveries : deliveries.rows || [];
@@ -4298,7 +4599,7 @@ async function relayDeliveriesCommand(options) {
       json({ deliveries: items });
       return;
     }
-    spinner5.stop(`${items.length} deliver${items.length === 1 ? "y" : "ies"} found`);
+    spinner6.stop(`${items.length} deliver${items.length === 1 ? "y" : "ies"} found`);
     if (items.length === 0) {
       console.log("\n  No deliveries found.\n");
       return;
@@ -4320,22 +4621,22 @@ async function relayDeliveriesCommand(options) {
       }))
     );
   } catch (error2) {
-    spinner5.stop("Failed to load deliveries");
+    spinner6.stop("Failed to load deliveries");
     error(`Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
   }
 }
 async function relayEventTypesCommand(platform) {
   const { apiKey } = getConfig3();
   const api = new OneApi(apiKey, getApiBase());
-  const spinner5 = createSpinner();
-  spinner5.start(`Loading event types for ${pc8.cyan(platform)}...`);
+  const spinner6 = createSpinner();
+  spinner6.start(`Loading event types for ${pc8.cyan(platform)}...`);
   try {
     const eventTypes = await api.listRelayEventTypes(platform);
     if (isAgentMode()) {
       json({ platform, eventTypes });
       return;
     }
-    spinner5.stop(`${eventTypes.length} event type${eventTypes.length === 1 ? "" : "s"} found`);
+    spinner6.stop(`${eventTypes.length} event type${eventTypes.length === 1 ? "" : "s"} found`);
     if (eventTypes.length === 0) {
       console.log(`
   No event types found for ${platform}.
@@ -4348,7 +4649,7 @@ async function relayEventTypesCommand(platform) {
     }
     console.log();
   } catch (error2) {
-    spinner5.stop("Failed to load event types");
+    spinner6.stop("Failed to load event types");
     error(`Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
   }
 }
@@ -6741,7 +7042,7 @@ async function searchSyncedData(query, options) {
 
 // src/lib/sync/index.ts
 import { spawn as spawn4 } from "child_process";
-import * as p7 from "@clack/prompts";
+import * as p8 from "@clack/prompts";
 import pc9 from "picocolors";
 async function syncInstallCommand() {
   if (await isSqliteAvailable()) {
@@ -6828,12 +7129,12 @@ async function syncProfilesCommand(platform) {
   const profiles = listBuiltinProfiles(platform);
   if (isAgentMode()) {
     json({
-      profiles: profiles.map((p8) => ({
-        platform: p8.platform,
-        model: p8.model,
-        description: p8.description,
-        hasEnrich: !!p8.enrich,
-        hasIdentityKey: !!p8.identityKey
+      profiles: profiles.map((p10) => ({
+        platform: p10.platform,
+        model: p10.model,
+        description: p10.description,
+        hasEnrich: !!p10.enrich,
+        hasIdentityKey: !!p10.identityKey
       })),
       total: profiles.length,
       _hint: profiles.length > 0 ? "Use a built-in profile: one --agent sync init <platform> <model>" : "No built-in profiles found. Use sync init to auto-infer from action knowledge."
@@ -6847,24 +7148,24 @@ async function syncProfilesCommand(platform) {
     );
     return;
   }
-  for (const p8 of profiles) {
+  for (const p10 of profiles) {
     const extras = [];
-    if (p8.enrich) extras.push("enrich");
-    if (p8.identityKey) extras.push("identity");
-    if (p8.dateFilter) extras.push("incremental");
+    if (p10.enrich) extras.push("enrich");
+    if (p10.identityKey) extras.push("identity");
+    if (p10.dateFilter) extras.push("incremental");
     const tags = extras.length > 0 ? ` ${pc9.dim(`[${extras.join(", ")}]`)}` : "";
-    console.log(`  ${pc9.bold(`${p8.platform}/${p8.model}`.padEnd(35))} ${p8.description}${tags}`);
+    console.log(`  ${pc9.bold(`${p10.platform}/${p10.model}`.padEnd(35))} ${p10.description}${tags}`);
   }
   console.log(`
 ${profiles.length} built-in profile(s). Run ${pc9.bold("one sync init <platform> <model>")} to use one.`);
 }
 async function syncModelsCommand(platform) {
   const api = getApi();
-  const spinner5 = createSpinner();
-  spinner5.start(`Discovering models for ${platform}...`);
+  const spinner6 = createSpinner();
+  spinner6.start(`Discovering models for ${platform}...`);
   try {
     const models = await discoverModels(api, platform);
-    spinner5.stop(`Found ${models.length} models`);
+    spinner6.stop(`Found ${models.length} models`);
     if (isAgentMode()) {
       json({ platform, models, total: models.length });
       return;
@@ -6878,15 +7179,15 @@ async function syncModelsCommand(platform) {
     );
     note2(lines.join("\n"), `${platform} \u2014 ${models.length} models`);
   } catch (err) {
-    spinner5.stop("Failed");
+    spinner6.stop("Failed");
     error(`Error discovering models: ${err instanceof Error ? err.message : String(err)}`);
   }
 }
 async function syncInitCommand(platform, model, options) {
   if (!options.config) {
     const api = getApi();
-    const spinner5 = createSpinner();
-    spinner5.start(`Looking up ${platform}/${model}...`);
+    const spinner6 = createSpinner();
+    spinner6.start(`Looking up ${platform}/${model}...`);
     try {
       const models = await discoverModels(api, platform);
       const match = models.find((m) => m.name === model || m.name.toLowerCase() === model.toLowerCase());
@@ -6896,9 +7197,9 @@ async function syncInitCommand(platform, model, options) {
         if (actionId && !actionId.startsWith("conn_mod_def::")) {
           actionId = void 0;
         }
-        spinner5.stop(actionId ? "Found model + action ID" : "Found model (action ID not resolved)");
+        spinner6.stop(actionId ? "Found model + action ID" : "Found model (action ID not resolved)");
       } else {
-        spinner5.stop("Model not found in available actions");
+        spinner6.stop("Model not found in available actions");
       }
       const builtin = loadBuiltinProfile(platform, model);
       let template;
@@ -6998,7 +7299,7 @@ Run with --config to save:
         }
       }
     } catch (err) {
-      spinner5.stop("Failed");
+      spinner6.stop("Failed");
       error(`Error: ${err instanceof Error ? err.message : String(err)}`);
     }
     return;
@@ -7084,7 +7385,7 @@ async function syncRunCommand(platform, options) {
   const api = getApi();
   const profiles = listProfiles(platform);
   const targetModels = options.models;
-  const toSync = targetModels ? profiles.filter((p8) => targetModels.includes(p8.model)) : profiles;
+  const toSync = targetModels ? profiles.filter((p10) => targetModels.includes(p10.model)) : profiles;
   if (toSync.length === 0) {
     error(
       `No sync profiles found for ${platform}` + (targetModels ? ` with models: ${targetModels.join(", ")}` : "") + `. Run 'one sync init ${platform} <model> --config ...' first.`
@@ -7239,8 +7540,8 @@ async function syncDeleteCommand(platformModel, options) {
       return;
     }
     if (!options.yes && !isAgentMode()) {
-      const confirmed = await p7.confirm({ message: `Delete ${preview.count} record(s) from ${platform}/${model}?` });
-      if (p7.isCancel(confirmed) || !confirmed) {
+      const confirmed = await p8.confirm({ message: `Delete ${preview.count} record(s) from ${platform}/${model}?` });
+      if (p8.isCancel(confirmed) || !confirmed) {
         db.close();
         cancel2("Cancelled.");
         return;
@@ -7262,15 +7563,15 @@ async function syncDeleteCommand(platformModel, options) {
 async function syncListCommand(platform) {
   const profiles = listProfiles(platform);
   const state = readSyncState();
-  const syncs = profiles.map((p8) => {
-    const modelState = state[p8.platform]?.[p8.model];
+  const syncs = profiles.map((p10) => {
+    const modelState = state[p10.platform]?.[p10.model];
     return {
-      platform: p8.platform,
-      model: p8.model,
+      platform: p10.platform,
+      model: p10.model,
       lastSync: modelState?.lastSync ?? null,
       totalRecords: modelState?.totalRecords ?? 0,
       pagesProcessed: modelState?.pagesProcessed ?? 0,
-      dbSize: getDatabaseSize(p8.platform),
+      dbSize: getDatabaseSize(p10.platform),
       status: modelState?.status ?? "idle"
     };
   });
@@ -7293,7 +7594,7 @@ async function syncRemoveCommand(platform, options) {
   const modelList = options.models?.split(",").map((m) => m.trim());
   const preview = [];
   const profiles = listProfiles(platform);
-  const targetModels = modelList ?? profiles.map((p8) => p8.model);
+  const targetModels = modelList ?? profiles.map((p10) => p10.model);
   try {
     if (targetModels.length > 0) {
       const db = await openDatabase(platform);
@@ -7305,14 +7606,14 @@ async function syncRemoveCommand(platform, options) {
   } catch {
     for (const model of targetModels) preview.push({ model, records: 0 });
   }
-  const totalRecords = preview.reduce((sum, p8) => sum + p8.records, 0);
+  const totalRecords = preview.reduce((sum, p10) => sum + p10.records, 0);
   const dbSize = getDatabaseSize(platform);
   if (options.dryRun) {
     if (isAgentMode()) {
       json({ dryRun: true, platform, models: preview, totalRecords, dbSize });
     } else {
       note2(
-        preview.map((p8) => `  ${p8.model.padEnd(30)} ${String(p8.records).padStart(8)} records`).join("\n") + `
+        preview.map((p10) => `  ${p10.model.padEnd(30)} ${String(p10.records).padStart(8)} records`).join("\n") + `
 
   Total: ${totalRecords} records across ${preview.length} model(s), ${dbSize} on disk`,
         `Would remove from ${platform}`
@@ -7322,10 +7623,10 @@ async function syncRemoveCommand(platform, options) {
   }
   if (!options.yes && !isAgentMode()) {
     const target = modelList ? `${platform}/${modelList.join(", ")}` : `all synced data for ${platform}`;
-    const confirmed = await p7.confirm({
+    const confirmed = await p8.confirm({
       message: `Remove ${target}? (${totalRecords} records, ${dbSize} on disk)`
     });
-    if (p7.isCancel(confirmed) || !confirmed) {
+    if (p8.isCancel(confirmed) || !confirmed) {
       cancel2("Cancelled.");
       return;
     }
@@ -7617,8 +7918,8 @@ async function cacheUpdateAllCommand() {
     console.log("No cached entries to update");
     return;
   }
-  const spinner5 = createSpinner();
-  spinner5.start(`Updating ${entries.length} cached ${entries.length === 1 ? "entry" : "entries"}...`);
+  const spinner6 = createSpinner();
+  spinner6.start(`Updating ${entries.length} cached ${entries.length === 1 ? "entry" : "entries"}...`);
   let updated = 0;
   let failed = 0;
   const errors = [];
@@ -7642,7 +7943,7 @@ async function cacheUpdateAllCommand() {
       });
     }
   }
-  spinner5.stop(`Updated ${updated} ${updated === 1 ? "entry" : "entries"}${failed > 0 ? `, ${failed} failed` : ""}`);
+  spinner6.stop(`Updated ${updated} ${updated === 1 ? "entry" : "entries"}${failed > 0 ? `, ${failed} failed` : ""}`);
   if (isAgentMode()) {
     json({ updated, failed, errors: errors.length > 0 ? errors : void 0 });
     return;
@@ -7663,10 +7964,12 @@ var GUIDE_OVERVIEW = `# One CLI \u2014 Agent Guide
 
 ## Setup
 
-1. Run \`one init\` to configure your API key (interactive \u2014 can be global or per-project)
+1. Run \`one init\` for full interactive setup (authentication, skill installation, and platform connections)
 2. Run \`one add <platform>\` to connect platforms via OAuth
 3. Run \`one --agent connection list\` to verify connections
 
+You can also use \`one login\` / \`one logout\` to manage authentication separately (global or per-directory).
+
 ## The --agent Flag
 
 Always use \`--agent\` for machine-readable JSON output. It disables colors, spinners, and interactive prompts.
@@ -7720,7 +8023,7 @@ one --agent flow list                                 # List all workflows
 \`\`\`
 
 **Key concepts:**
-- Workflows live at \`.one/flows/<key>/flow.json\` (folder layout \u2014 REQUIRED for new flows). The legacy \`.one/flows/<key>.flow.json\` single-file layout is DEPRECATED but still loads for backward compatibility
+- Workflows live at \`.one/flows/<key>/flow.json\` (folder layout \u2014 REQUIRED for new flows). Flows can be organized into subdirectory groups: \`.one/flows/<group>/<key>/flow.json\`. Reference them as \`group/key\` or just the bare key. The legacy \`.one/flows/<key>.flow.json\` single-file layout is DEPRECATED but still loads for backward compatibility
 - Code steps can reference an external \`.mjs\` module under the flow's \`lib/\` folder (stdin JSON in, stdout JSON out) \u2014 keeps JS out of JSON strings and makes flows shareable
 - 12 step types: action, transform, code, condition, loop, parallel, file-read, file-write, while, flow, paginate, bash
 - Data wiring via selectors: \`$.input.param\`, \`$.steps.stepId.response\`, \`$.loop.item\`
@@ -8392,7 +8695,7 @@ function pairKey(a, b) {
 }
 function getWorkflowExamples(connectedPlatforms) {
   const results = [];
-  const platforms = connectedPlatforms.map((p8) => p8.toLowerCase());
+  const platforms = connectedPlatforms.map((p10) => p10.toLowerCase());
   for (let i = 0; i < platforms.length; i++) {
     for (let j = i + 1; j < platforms.length; j++) {
       const key = pairKey(platforms[i], platforms[j]);
@@ -8636,13 +8939,13 @@ function buildDemoActions(connections) {
   const connectedPlatforms = connections.map((c) => c.platform.toLowerCase());
   const popularPlatforms = ["gmail", "google-calendar", "slack", "shopify", "hub-spot", "github"];
   const platformsToShow = [
-    ...connectedPlatforms.filter((p8) => PLATFORM_DEMO_ACTIONS[p8]),
-    ...popularPlatforms.filter((p8) => !connectedPlatforms.includes(p8))
+    ...connectedPlatforms.filter((p10) => PLATFORM_DEMO_ACTIONS[p10]),
+    ...popularPlatforms.filter((p10) => !connectedPlatforms.includes(p10))
   ];
   const seen = /* @__PURE__ */ new Set();
-  const unique = platformsToShow.filter((p8) => {
-    if (seen.has(p8)) return false;
-    seen.add(p8);
+  const unique = platformsToShow.filter((p10) => {
+    if (seen.has(p10)) return false;
+    seen.add(p10);
     return true;
   }).slice(0, 6);
   for (const platform of unique) {
@@ -8673,6 +8976,125 @@ function buildWorkflowIdeas(connections) {
   return lines.join("\n");
 }
 
+// src/commands/logout.ts
+import fs16 from "fs";
+import * as p9 from "@clack/prompts";
+function formatWhoami(config2, apiKey, pc12) {
+  const whoami = config2.whoami;
+  const env = getEnvFromApiKey(apiKey);
+  const envLabel = env === "test" ? pc12.yellow("test") : pc12.green("live");
+  const lines = [];
+  if (whoami) {
+    const contextParts = [];
+    if (whoami.organization) contextParts.push(whoami.organization.name);
+    if (whoami.project) contextParts.push(whoami.project.name);
+    const scopeDisplay = contextParts.length > 0 ? contextParts.join(" / ") : "Personal";
+    lines.push(`${pc12.bold(scopeDisplay)} ${pc12.dim("\xB7")} ${envLabel}`);
+    lines.push(`${whoami.user.name} ${pc12.dim(`(${whoami.user.email})`)}`);
+  } else {
+    lines.push(`${pc12.dim("Key:")} ${apiKey.slice(0, 8)}... ${pc12.dim("\xB7")} ${envLabel}`);
+  }
+  return lines;
+}
+async function logoutCommand() {
+  const apiKey = getApiKey();
+  if (!apiKey) {
+    if (isAgentMode()) {
+      json({ error: "Not logged in." });
+      process.exit(1);
+    }
+    error("Not logged in. Run: one login");
+    return;
+  }
+  if (isAgentMode()) {
+    const globalPath = getGlobalConfigPath();
+    const projectPath = getProjectConfigPath();
+    let cleared = false;
+    if (fs16.existsSync(projectPath)) {
+      fs16.unlinkSync(projectPath);
+      cleared = true;
+    }
+    if (fs16.existsSync(globalPath)) {
+      fs16.unlinkSync(globalPath);
+      cleared = true;
+    }
+    json({ status: cleared ? "logged_out" : "not_logged_in", message: cleared ? "Credentials cleared." : "No config found." });
+    return;
+  }
+  const pc12 = (await import("picocolors")).default;
+  const globalConfig = readGlobalConfig();
+  const projectConfig = readProjectConfig();
+  const hasGlobal = globalConfig?.apiKey != null;
+  const hasProject = projectConfig?.apiKey != null;
+  let targetScope;
+  if (hasGlobal && hasProject) {
+    const infoLines = ["You are logged in with multiple configs.", ""];
+    if (projectConfig) {
+      infoLines.push(`${pc12.cyan("Local config:")}`);
+      infoLines.push(...formatWhoami(projectConfig, projectConfig.apiKey, pc12));
+      infoLines.push("");
+    }
+    if (globalConfig) {
+      infoLines.push(`${pc12.magenta("Global config:")}`);
+      infoLines.push(...formatWhoami(globalConfig, globalConfig.apiKey, pc12));
+    }
+    p9.note(infoLines.join("\n"));
+    const choice = await p9.select({
+      message: "What would you like to log out of?",
+      options: [
+        { value: "project", label: "This directory", hint: "local config only" },
+        { value: "global", label: "Globally", hint: "global config only" },
+        { value: "both", label: "Both", hint: "remove all credentials" }
+      ]
+    });
+    if (p9.isCancel(choice)) {
+      p9.cancel("Logout cancelled.");
+      return;
+    }
+    targetScope = choice;
+  } else if (hasProject) {
+    const infoLines = ["You are logged in.", ""];
+    infoLines.push(`${pc12.dim("Stored in")} ${pc12.cyan("local config")}`);
+    infoLines.push(...formatWhoami(projectConfig, projectConfig.apiKey, pc12));
+    p9.note(infoLines.join("\n"));
+    targetScope = "project";
+  } else if (hasGlobal) {
+    const infoLines = ["You are logged in.", ""];
+    infoLines.push(`${pc12.dim("Stored in")} ${pc12.magenta("global config")}`);
+    infoLines.push(...formatWhoami(globalConfig, globalConfig.apiKey, pc12));
+    p9.note(infoLines.join("\n"));
+    targetScope = "global";
+  } else {
+    p9.log.warn("Credentials are set via environment variable or .onerc, not a config file.");
+    p9.log.info("Remove the ONE_SECRET variable from your environment or .onerc file.");
+    p9.outro("Nothing to remove.");
+    return;
+  }
+  const scopeLabels = {
+    project: "local",
+    global: "global",
+    both: "all"
+  };
+  const confirm6 = await p9.confirm({
+    message: `Remove ${scopeLabels[targetScope]} credentials?`
+  });
+  if (p9.isCancel(confirm6) || !confirm6) {
+    p9.cancel("Logout cancelled.");
+    return;
+  }
+  if (targetScope === "project" || targetScope === "both") {
+    const projectPath = getProjectConfigPath();
+    if (fs16.existsSync(projectPath)) fs16.unlinkSync(projectPath);
+  }
+  if (targetScope === "global" || targetScope === "both") {
+    const globalPath = getGlobalConfigPath();
+    if (fs16.existsSync(globalPath)) fs16.unlinkSync(globalPath);
+  }
+  p9.log.success("Credentials cleared.");
+  p9.log.info("Your API key is still active. Manage keys at app.withone.ai/settings");
+  p9.outro("Logged out.");
+}
+
 // src/index.ts
 var require3 = createRequire2(import.meta.url);
 var { version } = require3("../package.json");
@@ -8680,6 +9102,8 @@ var program = new Command();
 program.name("one").option("--agent", "Machine-readable JSON output (no colors, spinners, or prompts)").description(`One CLI \u2014 Connect AI agents to 250+ platforms through one interface.
 
   Setup:
+    one login                             Authenticate via browser (opens app.withone.ai)
+    one logout                            Clear local credentials
     one init                              Set up API key and install MCP server
     one add <platform>                    Connect a platform via OAuth (e.g. gmail, slack, shopify)
     one connection delete <key>           Remove a connection (alias: one connection rm)
@@ -8697,8 +9121,8 @@ program.name("one").option("--agent", "Machine-readable JSON output (no colors,
 
   Workflows (multi-step):
     one flow list                         List saved workflows
-    one flow create [key]                 Create a workflow from JSON
-    one flow execute <key>                Execute a workflow
+    one flow create [key]                 Create a workflow from JSON (key can be group/key)
+    one flow execute <key>                Execute a workflow (key can be group/key)
     one flow validate <key>               Validate a flow
 
   Data Sync (run "one sync install" first, then "one guide sync" for full reference):
@@ -8766,6 +9190,12 @@ program.hook("postAction", async () => {
 program.command("init").description("Set up One and install MCP to your AI agents (interactive: picks global or project scope)").option("-y, --yes", "Skip confirmations").option("-g, --global", "Write the One config globally (~/.one/config.json) \u2014 skips the scope picker").option("-p, --project", "Write the One config for this project only (~/.one/projects/<slug>/) \u2014 skips the scope picker").action(async (options) => {
   await initCommand(options);
 });
+program.command("login").description("Authenticate with One via browser").action(async () => {
+  await loginCommand();
+});
+program.command("logout").description("Clear local credentials").action(async () => {
+  await logoutCommand();
+});
 var config = program.command("config").description("Configure the CLI (access control, skills, ...)").action(async () => {
   await configCommand();
 });
@@ -8855,18 +9285,18 @@ config.command("reset").description("Remove the project config for the current d
       return;
     }
     if (!isAgentMode()) {
-      const p8 = await import("@clack/prompts");
-      const confirmed = await p8.confirm({
+      const p10 = await import("@clack/prompts");
+      const confirmed = await p10.confirm({
         message: "Delete the global config? This removes your API key for all projects without a project config.",
         initialValue: false
       });
-      if (p8.isCancel(confirmed) || !confirmed) {
+      if (p10.isCancel(confirmed) || !confirmed) {
         console.log("Cancelled.");
         return;
       }
     }
-    const fs17 = await import("fs");
-    fs17.unlinkSync(globalPath);
+    const fs18 = await import("fs");
+    fs18.unlinkSync(globalPath);
     if (isAgentMode()) {
       json({ deleted: true, scope: "global" });
     } else {
@@ -8883,12 +9313,12 @@ config.command("reset").description("Remove the project config for the current d
     }
     return;
   }
-  const fs16 = await import("fs");
-  const configContent = fs16.readFileSync(resolved.path, "utf-8");
-  fs16.unlinkSync(resolved.path);
+  const fs17 = await import("fs");
+  const configContent = fs17.readFileSync(resolved.path, "utf-8");
+  fs17.unlinkSync(resolved.path);
   const next = resolveConfig();
-  fs16.mkdirSync(path16.dirname(resolved.path), { recursive: true });
-  fs16.writeFileSync(resolved.path, configContent);
+  fs17.mkdirSync(path16.dirname(resolved.path), { recursive: true });
+  fs17.writeFileSync(resolved.path, configContent);
   let fallbackLabel;
   if (next.scope === "project") {
     fallbackLabel = `parent project config (${path16.basename(next.projectRoot)})`;
@@ -8898,19 +9328,19 @@ config.command("reset").description("Remove the project config for the current d
     fallbackLabel = "no config";
   }
   if (!isAgentMode()) {
-    const p8 = await import("@clack/prompts");
-    const confirmed = await p8.confirm({
+    const p10 = await import("@clack/prompts");
+    const confirmed = await p10.confirm({
       message: `Delete project config for ${path16.basename(resolved.projectRoot)}? Will fall back to ${fallbackLabel}.`,
       initialValue: false
     });
-    if (p8.isCancel(confirmed) || !confirmed) {
+    if (p10.isCancel(confirmed) || !confirmed) {
       console.log("Cancelled.");
       return;
     }
   }
-  fs16.unlinkSync(resolved.path);
+  fs17.unlinkSync(resolved.path);
   try {
-    fs16.rmdirSync(path16.dirname(resolved.path));
+    fs17.rmdirSync(path16.dirname(resolved.path));
   } catch {
   }
   if (isAgentMode()) {