@withone/cli 1.38.0 → 1.39.1

package/README.md

@@ -330,6 +330,8 @@ one sync init stripe balanceTransactions --config '{"onInsert":"one flow execute
 one sync run stripe --full-refresh
 ```
 
+> **Sync uses passthrough actions only.** Profiles referencing a custom/composer action are rejected at runtime. `sync models` already filters to passthrough-only; if a model has no passthrough list endpoint, compose a flow instead of syncing.
+
 | Subcommand | What it does |
 |------------|-------------|
 | `install` / `doctor` | Install + verify the SQLite engine |

package/dist/index.js

@@ -4666,6 +4666,9 @@ function parseActionType(actionKey) {
   if (parts.length < 5) return null;
   return parts[4];
 }
+function isCustomAction(tags) {
+  return !!tags && tags.includes("custom");
+}
 async function discoverModels(api, platform) {
   const actions2 = await api.listAvailableActions(platform);
   const listActionTypes = /* @__PURE__ */ new Set(["get_many", "list", "get_all"]);
@@ -4674,6 +4677,7 @@ async function discoverModels(api, platform) {
     const actionType = parseActionType(action.key);
     if (!actionType) continue;
     if (!listActionTypes.has(actionType)) continue;
+    if (isCustomAction(action.tags)) continue;
     const modelName = action.modelName;
     if (!modelName) continue;
     if (modelMap.has(modelName)) {
@@ -4697,7 +4701,7 @@ async function discoverModels(api, platform) {
       try {
         const searchResults = await api.searchActions(platform, model.displayName, "execute");
         const resolved = searchResults.find(
-          (a) => a.path === model.listAction.path && a.method === model.listAction.method
+          (a) => a.path === model.listAction.path && a.method === model.listAction.method && !isCustomAction(a.tags)
         );
         if (resolved?.systemId) {
           model.listAction.actionId = resolved.systemId;
@@ -4706,7 +4710,8 @@ async function discoverModels(api, platform) {
       }
     })
   );
-  return models.sort((a, b) => a.name.localeCompare(b.name));
+  const syncable = models.filter((m) => m.listAction.actionId.startsWith("conn_mod_def::"));
+  return syncable.sort((a, b) => a.name.localeCompare(b.name));
 }
 
 // src/lib/sync/profile.ts
@@ -5524,6 +5529,11 @@ async function enrichPhase(api, db, config2, model, idField, connectionKey, plat
       `Enrich: could not load action ${config2.actionId}: ${err instanceof Error ? err.message : String(err)}`
     );
   }
+  if (detailAction.tags?.includes("custom")) {
+    throw new Error(
+      `Enrich does not support custom actions. Action ${config2.actionId} is tagged "custom". Use a passthrough detail endpoint \u2014 run 'one actions search ${platform} "<model> get"' to find one.`
+    );
+  }
   let concurrency = config2.concurrency ?? DEFAULT_CONCURRENCY;
   let enriched = 0;
   let skipped = 0;
@@ -5913,6 +5923,11 @@ async function syncModel(api, profile, options) {
       }
     }
     const actionDetails = await api.getActionDetails(profile.actionId);
+    if (actionDetails.tags?.includes("custom")) {
+      throw new Error(
+        `Sync does not support custom actions. Action ${profile.actionId} is tagged "custom". Use a passthrough action \u2014 run 'one actions search ${platform} "${model}"' to find one, or compose a flow that chains passthrough calls if the logic is complex.`
+      );
+    }
     const maxPages = options.maxPages ?? Infinity;
     let tableCreated = tableExists(db, model);
     let currentPageQueryParams = { ...queryParams };
@@ -6272,6 +6287,14 @@ async function testSyncProfile(api, profile) {
     });
     return report;
   }
+  if (actionDetails.tags?.includes("custom")) {
+    checks.push({
+      name: "action is passthrough (not custom)",
+      ok: false,
+      detail: `Action ${profile.actionId} is tagged "custom". Sync only supports passthrough actions. Run 'one actions search ${profile.platform} "${profile.model}"' to find one.`
+    });
+    return report;
+  }
   let responseData;
   try {
     const result = await api.executePassthroughRequest({
@@ -8582,23 +8605,29 @@ one --agent sync profiles stripe       # filter by platform
 
 When a built-in exists, \`sync init\` uses it automatically \u2014 no inference needed, no manual config. The agent just needs to match the user's intent to a profile description.
 
-## Action Resolution
+## Action Resolution \u2014 custom actions are hard-blocked
 
-Sync profiles MUST prefer passthrough actions over custom actions.
-Custom actions add server-side fan-out and transformation that causes timeouts
-and payload size failures at scale. The sync engine handles pagination, retries,
-rate limiting, and enrichment locally \u2014 a server-side middleware layer on top
-of that creates problems, not value.
+Sync refuses to run against custom/composer actions (tag \`custom\`). Both
+the list action and any enrich detail action in a profile MUST be passthrough.
+\`sync run\` loads the action's knowledge, checks for the \`custom\` tag, and
+aborts with a clear error pointing at the passthrough alternative.
 
-When resolving actions for sync profiles:
-1. Search with knowledge mode (not execute mode) to include passthrough actions
-2. Prefer GET passthrough endpoints (e.g. /gmail/v1/users/{userId}/threads)
-   over POST custom endpoints (e.g. /gmail/get-threads)
-3. Use enrich config for per-record detail fetching instead of relying on
-   custom actions that fan out server-side
-4. Only fall back to custom actions when no passthrough equivalent exists
+Why the block:
+- Custom actions run on a small shared fleet that collapses under sync-scale load
+- Custom list endpoints often expect filters in the body and silently return
+  unfiltered or empty results (sync sends params as query/path only by design)
+- The sync engine already handles pagination, retry, rate limiting, and per-record
+  enrichment locally \u2014 server-side fan-out on top of that creates 5xx, not value
 
-This applies to sync models discovery, sync init, and enrich action selection.
+How to build a profile:
+1. \`one actions search <platform> "<model>"\` surfaces passthrough actions.
+   \`sync init\`'s auto-infer also drops customs before offering choices.
+2. Prefer GET passthrough endpoints (e.g. /gmail/v1/users/{userId}/threads)
+   over POST custom endpoints (e.g. /gmail/get-threads).
+3. If no passthrough list action exists for a model, that model can't be
+   synced. Compose a flow that chains passthrough calls instead. Custom
+   actions are for one-off agent use only \u2014 never sync, never flow.
+4. The enrich \`actionId\` is held to the same rule: must be passthrough.
 
 ## Workflow: init \u2192 run \u2192 query
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@withone/cli",
-  "version": "1.38.0",
+  "version": "1.39.1",
   "description": "CLI for managing One",
   "type": "module",
   "files": [

package/skills/one/SKILL.md

@@ -173,6 +173,8 @@ one --agent sync list stripe                     # progress + freshness
 one sync schedule add stripe --every 1h
 ```
 
+**Sync rejects custom actions** — profiles must use passthrough. `sync init` only surfaces passthrough models; `sync run` aborts if the list or enrich action is tagged `custom`. If no passthrough exists, compose a flow instead.
+
 **Advanced features** (enrich, transform, exclude, identityKey, hooks, --full-refresh, --where-sql delete, cursor resume): run `one guide sync` for the full reference.
 
 ## Beyond Single Actions